From 541a4c381d94d268bf0839820da519cb7e416185 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 10:47:32 +1200
Subject: [PATCH 001/333] charts: make every scrubbable graph read like the
 screen around it (#1664)

Tapping a graph printed a different number from the metric written beside it:
a rounded headline over a one-decimal chart. Reported by @bartmuskala
against #1662.

This is the unfinished half of #463. `formatValue` exists BECAUSE of that
report -- Trends' Effort chart tapped to the stored 0-100 figure beside a 0-21
axis -- but only that one call site was wired up. Three of twelve passed a
formatter; the rest kept lineChartSelectionLabel's fallback, which collapses
near-integers and otherwise prints one decimal.

Seven call sites now pass the formatter their own screen already uses for the
read-out beside the chart: Vital Signs detail, Explore, Stress, the Sleep
metric sheet, two Sleep hours cards and Sleep debt. BarChart had no
formatValue parameter at all -- it hardcoded null -- so its three scrubbable
callers could not be fixed from outside; added, with LineChart's default and
fallback.

Explore was worse than a decimal. Its values are the RAW stored numbers and
MetricSpec.format is what rescales Effort to the WHOOP 0-21 axis. The Y labels
and the hero went through it; the scrub read-out did not, so the axis said
12.4 and tapping the same point said 59.

Consequence worth naming: a rounded metric now READS rounded on tap. HRV
scrubs as "62 ms" where it said "62.4". That is the alignment asked for, but a
visible loss of detail rather than a pure tidy-up.

The shared default is unchanged: a genuinely fractional metric still wants its
decimal, and after this no scrubbable chart reaches the fallback -- verified by
walking all twelve call sites.

iOS needed nothing, and not for the reason I first assumed. Its default is a
rounded int, but it never reaches it: 7 of 7 TrendChart and 2 of 2
OverviewHRChart production sites already pass valueFormat. Apple finished the
wiring this fix completes on Android. Its Stress chart already uses the exact
"%.1f" formatter chosen here.

Verified: 4516 Android tests, CI green on the merged head.
---
 .../app/src/main/java/com/noop/ui/Charts.kt   |  7 +-
 .../src/main/java/com/noop/ui/HealthScreen.kt |  5 ++
 .../java/com/noop/ui/SleepMetricCardsUi.kt    |  8 ++
 .../com/noop/ui/SleepMetricDetailSheet.kt     |  3 +
 .../src/main/java/com/noop/ui/StressScreen.kt |  4 +
 .../java/com/noop/ui/TrendsExploreScreen.kt   |  7 ++
 .../noop/ui/ChartScrubFormatterParityTest.kt  | 87 +++++++++++++++++++
 7 files changed, 120 insertions(+), 1 deletion(-)
 create mode 100644 android/app/src/test/java/com/noop/ui/ChartScrubFormatterParityTest.kt

diff --git a/android/app/src/main/java/com/noop/ui/Charts.kt b/android/app/src/main/java/com/noop/ui/Charts.kt
index a1484c2b17..a2473aa5a0 100644
--- a/android/app/src/main/java/com/noop/ui/Charts.kt
+++ b/android/app/src/main/java/com/noop/ui/Charts.kt
@@ -548,6 +548,11 @@ fun BarChart(
     // Optional per-point display labels index-aligned with [values]; when supplied, a tap shows
     // "<label> · <value>" (e.g. "16 Jul · 87") instead of the bare value — parity with LineChart (#691).
     selectionLabels: List<String>? = null,
+    // The caller's own value formatter, so the scrub read-out prints what the surrounding screen prints
+    // (#1662). Without one the label falls back to [formatLineValue], which shows a decimal for any
+    // non-integer — so a metric whose headline is rounded answered "72.4" on tap against a "72" beside
+    // it. Same parameter, same default, same fallback as LineChart's.
+    formatValue: ((Double) -> String)? = null,
 ) {
     val cleanValues = remember(values) { values.map { if (it.isFinite() && it > 0.0) it else 0.0 } }
     // cleanValues ZEROES (never drops) non-finite bars, so indices stay aligned with [values] and the
@@ -655,7 +660,7 @@ fun BarChart(
                                 drawText(
                                     lineChartSelectionLabel(
                                         value = clean[selectedIndex],
-                                        formatValue = null,
+                                        formatValue = formatValue,
                                         pointLabel = cleanSelectionLabels?.getOrNull(selectedIndex),
                                     ),
                                     8f, 32f, barLabelPaint,
diff --git a/android/app/src/main/java/com/noop/ui/HealthScreen.kt b/android/app/src/main/java/com/noop/ui/HealthScreen.kt
index 69e624cfd1..7429f1078c 100644
--- a/android/app/src/main/java/com/noop/ui/HealthScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/HealthScreen.kt
@@ -2072,6 +2072,11 @@ fun VitalDetailScreen(vm: AppViewModel, key: String) {
                     // two are equal in length by construction rather than by luck — `LineChart` drops
                     // mismatched labels SILENTLY, which is a failure that looks exactly like doing nothing.
                     selectionLabels = dayLabels,
+                    // #1662: the metric's OWN formatter AND unit — byte-for-byte what the Min/Avg/Max
+                    // row below renders. Without it the scrub read-out falls back to LineChart's
+                    // default, which prints a decimal for any non-integer, so a rounded metric answered
+                    // "72.4" on tap with "72 ms" written directly underneath.
+                    formatValue = { "${detail.format(it)} ${detail.unit}".trim() },
                     segmentIds = if (key == "vo2max_est") vo2MaxTrendSegmentIds(filteredReadings) else null,
                 )
                 Box(
diff --git a/android/app/src/main/java/com/noop/ui/SleepMetricCardsUi.kt b/android/app/src/main/java/com/noop/ui/SleepMetricCardsUi.kt
index 33f309db27..8ead30b153 100644
--- a/android/app/src/main/java/com/noop/ui/SleepMetricCardsUi.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepMetricCardsUi.kt
@@ -499,6 +499,8 @@ internal fun AsleepDurationHostCard(hours: List<Double>, dates: List<String>) {
                         color = Palette.restColor,
                         selectionEnabled = true,
                         selectionLabels = dates.map(::shortDayLabel),
+                        // #1662: hours with one decimal and the unit, matching the Avg/Min/Max row above.
+                        formatValue = { String.format(Locale.US, "%.1f h", it) },
                     )
                     DateAxisRow(dates)
                 }
@@ -545,6 +547,8 @@ internal fun DurationTrend(m: SleepModel) {
                         // #691: on tap, show the DATE alongside the value (the shared chart's tooltip),
                         // matching the other trend graphs. trendDates is index-aligned with the values.
                         selectionLabels = m.trendDates.map(::shortDayLabel),
+                        // #1662: same hours format as the Avg/Min/Max row above.
+                        formatValue = { String.format(Locale.US, "%.1f h", it) },
                     )
                     DateAxisRow(m.trendDates)
                 }
@@ -579,6 +583,10 @@ internal fun DurationTrend(m: SleepModel) {
                         color = Palette.metricRose,
                         selectionEnabled = true,
                         selectionLabels = m.trendDates.map(::shortDayLabel),   // #691: hover shows date + value
+                        // #1662: debt is shown as a DURATION ("7h 20m") in the card's trailing value and
+                        // its Avg/Max row, so a bare "7.3" on tap was a different unit, not just a
+                        // different precision.
+                        formatValue = { durationText(it * 60.0) },
                     )
                     DateAxisRow(m.trendDates)
                 }
diff --git a/android/app/src/main/java/com/noop/ui/SleepMetricDetailSheet.kt b/android/app/src/main/java/com/noop/ui/SleepMetricDetailSheet.kt
index 3c0ac9ceb3..d27df55a4e 100644
--- a/android/app/src/main/java/com/noop/ui/SleepMetricDetailSheet.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepMetricDetailSheet.kt
@@ -111,6 +111,9 @@ internal fun SleepMetricDetailSheetContent(vm: AppViewModel, key: String) {
                     fill = true,
                     selectionEnabled = true,
                     selectionLabels = filteredPoints.map { shortDayLabel(it.first) },   // #691: hover shows date + value
+                    // #1662: the same `spec.format` + unit the max/avg/min column to the left renders,
+                    // so the tapped point and the column beside it read identically.
+                    formatValue = { "${spec.format(it)} ${spec.unit}".trim() },
                 )
             }
             Row(modifier = Modifier.fillMaxWidth()) {
diff --git a/android/app/src/main/java/com/noop/ui/StressScreen.kt b/android/app/src/main/java/com/noop/ui/StressScreen.kt
index 94f1cfa630..df5e4a4d5f 100644
--- a/android/app/src/main/java/com/noop/ui/StressScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/StressScreen.kt
@@ -1064,6 +1064,10 @@ private fun StressTrendSection(model: StressModel, modifier: Modifier = Modifier
                         // trend that opted into selection and then had nothing to say but the number.
                         // Both lists map from the one windowed `points`, so they cannot desynchronise.
                         selectionLabels = dayLabels,
+                        // #1662: one decimal, matching the Today/Avg/Peak footer below. The default
+                        // formatter collapses a value within 0.05 of an integer, so a 2.0 stress day
+                        // scrubbed as "2" beside a footer reading "2.0".
+                        formatValue = { String.format(Locale.US, "%.1f", it) },
                     )
                     HorizontalDivider(color = Palette.hairline)
                     Row(modifier = Modifier.fillMaxWidth()) {
diff --git a/android/app/src/main/java/com/noop/ui/TrendsExploreScreen.kt b/android/app/src/main/java/com/noop/ui/TrendsExploreScreen.kt
index eb45a3b4f1..3ffc1cd8fd 100644
--- a/android/app/src/main/java/com/noop/ui/TrendsExploreScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TrendsExploreScreen.kt
@@ -667,6 +667,13 @@ private fun HeroChartCard(
                                 fill = true,
                                 selectionEnabled = true,
                                 selectionLabels = windowed.map { prettyExploreDate(it.day) },
+                                // #1662, and here it was worse than a decimal: `values` are the RAW
+                                // stored numbers, and `MetricSpec.format` is what rescales Effort to the
+                                // WHOOP 0–21 axis. The Y labels and the hero went through it; the scrub
+                                // read-out did not — so on that scale the axis said 12.4 and tapping the
+                                // same point said 59. Routing the label through the same formatter makes
+                                // the chart agree with itself.
+                                formatValue = metric::format,
                             )
                             ExploreGlowEndCap(values = values, tipColor = metric.accent)
                         }
diff --git a/android/app/src/test/java/com/noop/ui/ChartScrubFormatterParityTest.kt b/android/app/src/test/java/com/noop/ui/ChartScrubFormatterParityTest.kt
new file mode 100644
index 0000000000..a7cf4bd777
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/ChartScrubFormatterParityTest.kt
@@ -0,0 +1,87 @@
+package com.noop.ui
+
+import java.util.Locale
+import kotlin.math.roundToInt
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
+import org.junit.Test
+
+/**
+ * #1662: a metric's scrub read-out must print what the screen around it prints.
+ *
+ * `formatValue` was added for #463, when Trends' Effort chart tapped to the stored 0–100 number beside
+ * a 0–21 axis. Only that call site was wired up, so every other scrubbable chart kept the default —
+ * [lineChartSelectionLabel]'s fallback, which collapses near-integers and otherwise prints one decimal.
+ * The reporter's screenshot is the same defect on the screens #463 never reached: a rounded headline
+ * with a one-decimal graph beneath it.
+ *
+ * These pin the DIVERGENCE (what the default does) beside the FIX (what each injected formatter does),
+ * so a future caller that forgets one has a written statement of what goes wrong.
+ */
+class ChartScrubFormatterParityTest {
+
+    /**
+     * Vital Signs detail: `detail.format` is `it.roundToInt().toString()` for the rounded metrics, and
+     * the screen renders it WITH the unit — the scrub read-out has to match the whole reading, not just
+     * the number, or "62" still disagrees with the "62 ms" beside it.
+     */
+    private val roundedMetric: (Double) -> String = { "${it.roundToInt()} ms".trim() }
+
+    /** Stress: the Today/Avg/Peak footer prints one decimal on the 0–3 scale. */
+    private val stressScore: (Double) -> String = { String.format(Locale.US, "%.1f", it) }
+
+    /** Sleep cards: hours with a unit, matching the Avg/Min/Max row above the bars. */
+    private val sleepHours: (Double) -> String = { String.format(Locale.US, "%.1f h", it) }
+
+    @Test
+    fun theDefaultDisagreesWithARoundedHeadline() {
+        // An HRV of 62.4 is a "62" everywhere on the Vital Signs detail screen except, until now, the
+        // graph — which is exactly what the report shows.
+        assertEquals("62.4", lineChartSelectionLabel(62.4, null))
+        assertEquals("62 ms", lineChartSelectionLabel(62.4, roundedMetric))
+        assertNotEquals(lineChartSelectionLabel(62.4, null), lineChartSelectionLabel(62.4, roundedMetric))
+    }
+
+    @Test
+    fun aRoundedMetricAgreesWithItsGraphAcrossTheRange() {
+        for ((raw, expected) in listOf(62.4 to "62 ms", 72.5 to "73 ms", 99.9 to "100 ms", 0.4 to "0 ms")) {
+            assertEquals(expected, lineChartSelectionLabel(raw, roundedMetric))
+        }
+    }
+
+    /**
+     * The default's near-integer collapse is its own mismatch: it drops the decimal a one-decimal
+     * read-out keeps, so a flat 2.0 stress day scrubbed as "2" beside a footer reading "2.0".
+     */
+    @Test
+    fun theDefaultCollapsesAnExactValueThatTheScreenSpellsOut() {
+        assertEquals("2", lineChartSelectionLabel(2.0, null))
+        assertEquals("2.0", lineChartSelectionLabel(2.0, stressScore))
+    }
+
+    /** Sleep hours carry a unit; the bare number was a different reading, not a rounder one. */
+    @Test
+    fun sleepHoursKeepTheirUnit() {
+        assertEquals("7.3", lineChartSelectionLabel(7.3, null))
+        assertEquals("7.3 h", lineChartSelectionLabel(7.3, sleepHours))
+    }
+
+    /**
+     * Explore was the worst of them: `values` are RAW stored numbers and `MetricSpec.format` is what
+     * rescales Effort to WHOOP's 0–21 axis. The Y labels and the hero went through it and the scrub
+     * read-out did not, so the axis said one number and tapping the same point said another — a
+     * different VALUE, not a different precision. This is the #463 failure, unfixed on that screen.
+     */
+    @Test
+    fun anAxisConvertedMetricDisagreedOnTheValueItself() {
+        val toWhoopScale: (Double) -> String = { UnitFormatter.effortDisplay(it, EffortScale.WHOOP) }
+        assertEquals("59", lineChartSelectionLabel(59.0, null))          // raw, as the chart used to say
+        assertEquals("12.4", lineChartSelectionLabel(59.0, toWhoopScale)) // what the axis says
+    }
+
+    /** A day label still prefixes the formatted value, so #691's date context survives the fix. */
+    @Test
+    fun theDayLabelStillPrefixesTheFormattedValue() {
+        assertEquals("16 Jul · 62 ms", lineChartSelectionLabel(62.4, roundedMetric, pointLabel = "16 Jul"))
+    }
+}

From 387a83bce1c5f2a6be6236ff1573f31f314677b4 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 11:22:29 +1200
Subject: [PATCH 002/333] health: lead the skin-temp tile with the absolute,
 deviation beneath (#1665)

The tile only ever showed a deviation, and a deviation with no anchor cannot
be read: "+0.9" is a fever or a warm bedroom and nothing says which. The
reporter's flu night read "+0.94 dF", which looks like nothing, against 96.4 F
on a 24-night mean of 94.4 F. Requested by @justinjor-bit in #1636.

The display half; #1663 persisted the value.

Scoped to the TILE on both platforms. An earlier draft changed Android's
DETAIL and iOS's TILE -- not the same surface -- which left each platform's
screen disagreeing with its own drill-in, the #1664 defect reintroduced. The
tile is what both platforms share, both can read from skinTempC, and it has no
range picker: the detail's range chips key off the displayed series, and a
21-day absolute history would have locked M/3M/6M/1Y permanently, since only
the trailing 21 days are ever re-scored.

Same rule on both: resolve the displayed night, then lead with its absolute if
it has one. Asking about the row already shown is what stops the tile stepping
back to an older night when the freshest is import-only.

A calibrating night is the reverse and is a real win: recomputeSkinTempDev
returns null until the baseline is usable (~4 nights) while the absolute is
already measured, so those wearers read "needs ~4 worn nights" today with a
real temperature sitting unshown behind it.

iOS gains a `secondary` slot kept distinct from `caveat` -- caveat says a
reading is unreliable, secondary says what it means. Kotlin gains the twin.
Banding, sparkline, range caption and the previous-value delta all follow
whichever series is displayed.

Verified: 4526 Android tests, 10 Kotlin + 5 Swift for this change, app-build
green on both legs with StrandTests executed.
---
 Strand/Screens/VitalSignsSummary.swift        |  51 ++++++-
 .../SkinTempAbsoluteDisplayTests.swift        | 142 ++++++++++++++++++
 .../java/com/noop/ui/HealthVitalsLogic.kt     |  69 ++++++++-
 .../noop/ui/SkinTempAbsoluteDisplayTest.kt    | 105 +++++++++++++
 4 files changed, 354 insertions(+), 13 deletions(-)
 create mode 100644 StrandTests/SkinTempAbsoluteDisplayTests.swift
 create mode 100644 android/app/src/test/java/com/noop/ui/SkinTempAbsoluteDisplayTest.kt

diff --git a/Strand/Screens/VitalSignsSummary.swift b/Strand/Screens/VitalSignsSummary.swift
index 0cb30a375b..9756aa5f63 100644
--- a/Strand/Screens/VitalSignsSummary.swift
+++ b/Strand/Screens/VitalSignsSummary.swift
@@ -27,6 +27,14 @@ struct BodyVitalReading: Identifiable {
     /// strap's own capture is known-unreliable for it (e.g. a WHOOP 4.0 R-R over-count contaminating HRV).
     /// nil = no caveat. Defaulted so existing call sites keep compiling unchanged.
     var caveat: String? = nil
+    /// A second reading shown with the caption, under the headline value (#1636).
+    ///
+    /// Distinct from `caveat`, which says the value is unreliable; this one says what the value means.
+    /// Skin temperature is the case: the absolute leads, and the deviation it was derived from is what
+    /// makes it legible — "+0.2" says nothing without an anchor, and 34.6 °C says little without
+    /// knowing it runs high for you. Pure formatted data (a number and a unit), never a sentence.
+    /// Defaulted so existing call sites keep compiling unchanged.
+    var secondary: String? = nil
 
     var id: String { key }
 
@@ -48,7 +56,9 @@ struct BodyVitalReading: Identifiable {
     /// line when nothing resolved, so an empty tile still says why instead of a bare dash.
     var stateCaption: String {
         guard let day else { return missingCaption }
-        var parts = [Self.dayLabel(day)]
+        // #1636: the secondary reading leads, so it sits directly under the headline value.
+        var parts = secondary.map { [$0] } ?? []
+        parts.append(Self.dayLabel(day))
         if let sourceText = Self.sourceLabel(source, key: key) {
             parts.append(sourceText)
         }
@@ -183,6 +193,10 @@ enum BodyVitalSigns {
         let rhrPoints = points(key: "rhr") { $0.restingHr.map(Double.init) }
         let hrvPoints = points(key: "hrv", \.avgHrv)
         let skinPoints = points(key: "skin", \.skinTempDevC)
+        // #1636: the night's ABSOLUTE, when the strap measured one. Nights scored before that column
+        // shipped carry only the deviation and refill on the next scoring pass, so this is empty until
+        // then and everything below falls through to the deviation-led behaviour unchanged.
+        let skinAbsPoints = points(key: "skin", \.skinTempC)
 
         let respRow = latest(respPoints)
         // #103/queue-11a: fall back to the spo2_candidate mean when no calibrated spo2Pct exists. The
@@ -193,7 +207,7 @@ enum BodyVitalSigns {
         let spo2rawRow = latest(spo2rawPoints)
         let rhrRow = latest(rhrPoints)
         let hrvRow = latest(hrvPoints)
-        let skinRow = latest(skinPoints)
+        let skinRowDeviation = latest(skinPoints)
         // #1118: mark HRV "unverified" when this night's in-sleep R-R was over-counted — the WHOOP 4.0
         // two-optical-channel artifact that inflates R-R and contaminates RMSSD, so NOOP's HRV won't match
         // WHOOP until the de-dup fix lands. The flag is written only for NOOP's OWN measured capture (an
@@ -214,13 +228,28 @@ enum BodyVitalSigns {
         // Skin temp is bimodal: CSV imports store ABSOLUTE °C, the on-device pipeline a ±°C DEVIATION —
         // partition the history to the displayed value's kind and pick the matching config + population
         // fallback (±0.6 °C mirrors the illness watch's flag threshold).
+        //
+        // #1636: resolve the DISPLAYED night first — the freshest that carries either reading — then
+        // lead with its absolute if it has one. Asking "does the row I am already showing have an
+        // absolute?" is what keeps the tile from silently stepping back to an older night: an
+        // import-only night has a deviation and no absolute, and a CALIBRATING night has the reverse
+        // (`recomputeSkinTempDev` returns nil until the baseline is usable, while the absolute is
+        // already measured — those wearers read "needs ~4 worn nights" today with a real temperature
+        // sitting unshown behind it).
+        let skinAbsCandidate = latest(skinAbsPoints)
+        let skinRowDay: String? = [skinRowDeviation?.day, skinAbsCandidate?.day].compactMap { $0 }.max()
+        let skinAbsRow = skinAbsCandidate.flatMap { $0.day == skinRowDay ? $0 : nil }
+        let skinRow = skinAbsRow ?? skinRowDeviation
         let skin = skinRow?.value
-        let skinIsAbsolute = skin.map(VitalBands.isAbsoluteSkinTemp) ?? true
+        let skinIsAbsolute = skinAbsRow != nil || (skin.map(VitalBands.isAbsoluteSkinTemp) ?? true)
+        // The series the tile is actually showing — banding and the sparkline must both read from it, or
+        // an absolute would be scored against a history of deviations (#1636).
+        let skinSeries = skinAbsRow != nil ? skinAbsPoints : skinPoints
         let skinResult: VitalBands.Result
         if let skin {
             skinResult = VitalBands.band(
                 value: skin,
-                history: VitalBands.skinTempHistory(matching: skin, in: history(before: skinRow?.day, skinPoints)),
+                history: VitalBands.skinTempHistory(matching: skin, in: history(before: skinRow?.day, skinSeries)),
                 populationRange: skinIsAbsolute ? 33...36 : (-0.6)...0.6,
                 cfg: skinIsAbsolute ? Baselines.metricCfg["skin_temp"]! : VitalBands.skinTempDeviationCfg
             )
@@ -239,6 +268,15 @@ enum BodyVitalSigns {
         let skinFormat: (Double) -> String = { c in
             SkinTempDisplay.numberString(c, kind: skinKind, fahrenheit: fahrenheit, decimals: 1)
         }
+        // #1636: the deviation for THE DISPLAYED NIGHT — not the freshest one anywhere. A calibrating
+        // night carries an absolute and no deviation, and reaching for the latest deviation there would
+        // print a previous night's number under tonight's temperature.
+        let skinSecondary: String? = skinAbsRow == nil ? nil
+            : skinPoints.last(where: { $0.day == skinRow?.day }).map { dev in
+                let n = SkinTempDisplay.numberString(dev.value, kind: .deviation,
+                                                     fahrenheit: fahrenheit, decimals: 1)
+                return "\(n) \(SkinTempDisplay.unitSymbol(kind: .deviation, fahrenheit: fahrenheit))"
+            }
 
         return [
             BodyVitalReading(
@@ -371,7 +409,10 @@ enum BodyVitalSigns {
                 missingCaption: String(localized: "No nightly skin-temp yet — needs ~4 worn nights (or import a WHOOP CSV)"),
                 // Keep the trail on the displayed value's kind — absolute °C and ±deviation must not
                 // mix on one sparkline (matches the banding partition above).
-                sparkline: trail(skinPoints.filter { VitalBands.isAbsoluteSkinTemp($0.value) == skinIsAbsolute })
+                sparkline: trail(skinSeries.filter { VitalBands.isAbsoluteSkinTemp($0.value) == skinIsAbsolute }),
+                // #1636: the deviation this absolute was derived from, shown beneath it. Only when the
+                // headline IS the absolute — on a deviation-led tile it would just repeat the value.
+                secondary: skinSecondary
             ),
         ]
     }
diff --git a/StrandTests/SkinTempAbsoluteDisplayTests.swift b/StrandTests/SkinTempAbsoluteDisplayTests.swift
new file mode 100644
index 0000000000..bbdba9f399
--- /dev/null
+++ b/StrandTests/SkinTempAbsoluteDisplayTests.swift
@@ -0,0 +1,142 @@
+import XCTest
+import SwiftUI
+import StrandAnalytics
+import WhoopStore
+@testable import Strand
+
+/// #1636: the skin-temp tile leads with the night's ABSOLUTE, with the deviation in the caption beneath.
+///
+/// A deviation with no anchor cannot be read — the reporter's flu night was "+0.94 Δ°F", which looks like
+/// nothing, against 96.4 °F on a 94.4 °F mean, which reads as a fever. Both numbers are needed and
+/// neither is sufficient.
+///
+/// `BodyVitalReading.stateCaption` is pure, so the ordering is asserted directly. Twin of Kotlin
+/// `SkinTempAbsoluteDisplayTest`, which asserts the same two properties through its own pure seams
+/// (`latestSkinAbsoluteC` / `skinTempSecondaryNote`) because Android's builder resolves resources and
+/// cannot run in a JVM test.
+final class SkinTempAbsoluteDisplayTests: XCTestCase {
+
+    private func reading(secondary: String?, caveat: String? = nil) -> BodyVitalReading {
+        BodyVitalReading(
+            key: "skin", label: "Skin Temp", unit: "°C", value: 34.6,
+            format: { String(format: "%.1f", $0) },
+            banding: VitalBands.Result(band: .inRange, basis: .population, nights: 24),
+            metricColor: .orange, day: "2026-08-25", source: .noopComputed,
+            missingCaption: "none", caveat: caveat, secondary: secondary)
+    }
+
+    func testTheSecondaryLeadsTheCaptionSoItSitsUnderTheValue() {
+        let caption = reading(secondary: "+0.9 Δ°F").stateCaption
+        XCTAssertTrue(caption.hasPrefix("+0.9 Δ°F · "),
+                      "the deviation must come first, directly under the headline — got \(caption)")
+        XCTAssertTrue(caption.contains("25 Aug") || caption.contains("Aug 25"),
+                      "the day must still be there — got \(caption)")
+    }
+
+    func testWithoutASecondaryTheCaptionIsUnchanged() {
+        // Every other vital passes nil, so their captions must be byte-identical to before.
+        let caption = reading(secondary: nil).stateCaption
+        XCTAssertFalse(caption.hasPrefix(" · "), "a nil secondary must not leave an empty leading part")
+        XCTAssertFalse(caption.contains("Δ"))
+    }
+
+    func testTheSecondaryIsIndependentOfTheCaveat() {
+        // `caveat` says the reading is unreliable; `secondary` says what it means. A tile may carry
+        // both, and they must not be confused for one another.
+        let caption = reading(secondary: "+0.9 Δ°F", caveat: "unverified").stateCaption
+        XCTAssertTrue(caption.hasPrefix("+0.9 Δ°F · "))
+        XCTAssertTrue(caption.hasSuffix("unverified"))
+    }
+
+    // MARK: - The tile itself, not just the caption helper
+
+    /// A day key `daysAgo` before the CURRENT logical day.
+    ///
+    /// Not a hardcoded date: `latest()` resolves through `Baselines.freshestCarried`, which only carries
+    /// a reading within `vitalCarryDays` of today. A fixed fixture date passes now and silently stops
+    /// resolving once the real clock moves past that window — a test that rots into a false green.
+    private func dayKey(_ daysAgo: Int) -> String {
+        Baselines.cutoffKey(todayKey: BodyVitalSigns.logicalDayKey(Date()), carryDays: daysAgo)
+    }
+
+    private func day(_ d: String, abs: Double? = nil, dev: Double? = nil) -> DailyMetric {
+        DailyMetric(day: d, totalSleepMin: nil, efficiency: nil, deepMin: nil, remMin: nil,
+                    lightMin: nil, disturbances: nil, restingHr: nil, avgHrv: nil,
+                    recovery: nil, strain: nil, exerciseCount: nil,
+                    skinTempDevC: dev, skinTempC: abs)
+    }
+
+    private func skinTile(_ days: [DailyMetric],
+                          _ unit: TemperatureUnit = .celsius) throws -> BodyVitalReading {
+        let all = BodyVitalSigns.readings(days: days, today: days.last, temperatureUnit: unit)
+        return try XCTUnwrap(all.first { $0.key == "skin" })
+    }
+
+    /// The reported case: the night measured both, so the absolute leads and the deviation sits under it.
+    func testANightWithBothLeadsWithTheAbsolute() throws {
+        let tile = try skinTile([day(dayKey(0), abs: 34.6, dev: 0.52)])
+        XCTAssertEqual(try XCTUnwrap(tile.value), 34.6, accuracy: 0.001)
+        XCTAssertEqual(tile.unit, "°C")
+        XCTAssertEqual(tile.secondary, "+0.5 Δ°C")
+    }
+
+    func testTheAbsoluteAndItsNoteFollowTheTemperatureSetting() throws {
+        let tile = try skinTile([day(dayKey(0), abs: 34.6, dev: 0.52)], .fahrenheit)
+        XCTAssertEqual(tile.unit, "°F")
+        XCTAssertEqual(tile.secondary, "+0.9 Δ°F")
+    }
+
+    /// A night predating the column keeps exactly the tile that shipped before.
+    func testADeviationOnlyNightIsUnchanged() throws {
+        let tile = try skinTile([day(dayKey(0), dev: 0.52)])
+        XCTAssertEqual(try XCTUnwrap(tile.value), 0.52, accuracy: 0.001)
+        XCTAssertEqual(tile.unit, "Δ°C")
+        XCTAssertNil(tile.secondary, "a deviation-led tile would only repeat its own headline")
+    }
+
+    /// Calibrating: the absolute is measured before the baseline is usable, so there is no deviation
+    /// yet. The tile shows the temperature instead of "needs ~4 worn nights", and omits the note.
+    func testACalibratingNightShowsTheAbsoluteWithNoNote() throws {
+        let tile = try skinTile([day(dayKey(0), abs: 34.6)])
+        XCTAssertEqual(try XCTUnwrap(tile.value), 34.6, accuracy: 0.001)
+        XCTAssertEqual(tile.unit, "°C")
+        XCTAssertNil(tile.secondary)
+    }
+
+    /// The regression the displayed-row rule exists for: an import-only night is NEWER than the last
+    /// strap night. The tile must stay on the import rather than stepping back to a stale absolute.
+    func testANewerImportOnlyNightDoesNotStepBackToAnOlderAbsolute() throws {
+        let tile = try skinTile([
+            day(dayKey(1), abs: 34.6, dev: 0.52),   // the strap's last scored night
+            day(dayKey(0), dev: 0.20),              // a WHOOP CSV import: deviation only
+        ])
+        XCTAssertEqual(try XCTUnwrap(tile.value), 0.20, accuracy: 0.001,
+                       "showing 34.6 here would be yesterday's reading dressed as today's")
+        XCTAssertEqual(tile.day, dayKey(0))
+        XCTAssertNil(tile.secondary)
+    }
+
+    /// The secondary must be THIS night's deviation. Reaching for the freshest one anywhere would
+    /// print a previous night's number under tonight's temperature.
+    func testTheNoteBelongsToTheDisplayedNight() throws {
+        let tile = try skinTile([
+            day(dayKey(1), abs: 33.9, dev: -0.40),
+            day(dayKey(0), abs: 34.6, dev: 0.52),
+        ])
+        XCTAssertEqual(tile.secondary, "+0.5 Δ°C", "the note must not come from the previous night")
+    }
+
+    /// The formatting the tile's secondary carries, pinned to the same helper Android formats with.
+    func testTheDeviationNoteMatchesTheKotlinTwin() {
+        func note(_ c: Double, fahrenheit: Bool) -> String {
+            let n = SkinTempDisplay.numberString(c, kind: .deviation, fahrenheit: fahrenheit, decimals: 1)
+            return "\(n) \(SkinTempDisplay.unitSymbol(kind: .deviation, fahrenheit: fahrenheit))"
+        }
+        XCTAssertEqual(note(0.52, fahrenheit: false), "+0.5 Δ°C")
+        XCTAssertEqual(note(0.52, fahrenheit: true), "+0.9 Δ°F")
+        XCTAssertEqual(note(-0.5, fahrenheit: false), "-0.5 Δ°C")
+        XCTAssertEqual(note(-0.5, fahrenheit: true), "-0.9 Δ°F")
+        // A whole degree of DEVIATION is 1.8 °F, never 33.8 — no +32 offset on a difference.
+        XCTAssertEqual(note(1.0, fahrenheit: true), "+1.8 Δ°F")
+    }
+}
diff --git a/android/app/src/main/java/com/noop/ui/HealthVitalsLogic.kt b/android/app/src/main/java/com/noop/ui/HealthVitalsLogic.kt
index cf961730f2..3e3da2a8e9 100644
--- a/android/app/src/main/java/com/noop/ui/HealthVitalsLogic.kt
+++ b/android/app/src/main/java/com/noop/ui/HealthVitalsLogic.kt
@@ -41,6 +41,14 @@ internal data class Vital(
      *  Kotlin twin of `BodyVitalReading.caveat` (VitalSignsSummary.swift). Defaulted so other vitals are
      *  unaffected. */
     val caveat: String? = null,
+    /** #1636: a second reading shown with the caption, under the headline value.
+     *
+     *  Distinct from [caveat], which says the value is unreliable; this says what it MEANS. Skin
+     *  temperature is the case: the absolute leads, and the deviation it was derived from is what makes
+     *  it legible — "+0.2" says nothing without an anchor, and 34.6 °C says little without knowing it
+     *  runs high for you. Pure formatted data, never a sentence, so it carries no translatable string.
+     *  Kotlin twin of `BodyVitalReading.secondary`. Defaulted so other vitals are unaffected. */
+    val secondary: String? = null,
 ) {
     /** Value with its unit appended, or null when no data. */
     val formattedValue: String? = value?.let { "${format(it)} $unit" }
@@ -76,8 +84,13 @@ internal data class Vital(
     /** #1118: the base caption plus any "unverified" caveat (an over-counted HRV night), so the caveat
      *  rides the same line the user already reads. Never on an empty tile. Twin of Swift's stateCaption
      *  append in VitalSignsSummary.swift. */
-    val stateCaption: String =
-        if (caveat != null && banding.band != VitalBands.Band.NO_DATA) "$baseCaption · $caveat" else baseCaption
+    val stateCaption: String = run {
+        val withCaveat =
+            if (caveat != null && banding.band != VitalBands.Band.NO_DATA) "$baseCaption · $caveat" else baseCaption
+        // #1636: the secondary reading LEADS, so it sits directly under the headline value. Never on an
+        // empty tile, where the caption is the "why it's empty" line and a number would contradict it.
+        if (secondary != null && banding.band != VitalBands.Band.NO_DATA) "$secondary · $withCaveat" else withCaveat
+    }
 
     val accessibilityText: String =
         formattedValue?.let {
@@ -85,6 +98,36 @@ internal data class Vital(
         } ?: "$label: no data"
 }
 
+/**
+ * Whether the skin-temp tile leads with the night's ABSOLUTE (#1636).
+ *
+ * True whenever the displayed night measured one. A deviation with no anchor cannot be read — "+0.9" is
+ * a fever or a warm bedroom and nothing on the tile says which — so the absolute leads and the deviation
+ * becomes the context beneath it.
+ *
+ * Two cases make this more than a preference:
+ *  - a night scored before `skinTempC` shipped has only a deviation, so the tile keeps exactly the
+ *    display that shipped before until a scoring pass refills it;
+ *  - a CALIBRATING night has the reverse — `recomputeSkinTempDev` returns null until the baseline is
+ *    usable (~4 nights), while the absolute is already measured. Those wearers currently read "needs ~4
+ *    worn nights" with a real temperature sitting unshown behind it.
+ *
+ * Twin of the Swift tile's `skinAbsRow != nil` branch.
+ */
+internal fun skinTempLeadsWithAbsolute(absC: Double?): Boolean = absC != null
+
+/**
+ * The deviation note shown beneath an absolute skin temperature — "+0.2 Δ°F" (#1636).
+ *
+ * Null when the night has no deviation (a calibrating night), so the line is omitted rather than printed
+ * empty. Pure formatted data, never a sentence, so it carries no translatable string.
+ */
+internal fun skinTempSecondaryNote(devC: Double?, fahrenheit: Boolean): String? =
+    devC?.let {
+        val n = SkinTempDisplay.numberString(it, SkinTempDisplay.Kind.DEVIATION, fahrenheit, decimals = 1)
+        "$n ${SkinTempDisplay.unitSymbol(SkinTempDisplay.Kind.DEVIATION, fahrenheit)}"
+    }
+
 /**
  * Which "no value" line the Blood O₂ tile shows, given whether that night decoded raw red/IR counts.
  *
@@ -161,16 +204,23 @@ internal fun vitalsFor(
     // config + population fallback (±0.6 °C mirrors the illness watch's flag threshold).
     // This also fixes the live bug where a strap-computed +0.2 °C deviation read
     // "Out of range" against the 33–36 absolute band.
-    val skin = d?.skinTempDevC
+    // #1636: lead with the night's measured ABSOLUTE when it has one; otherwise the deviation-led
+    // display that shipped before, unchanged. `leadsAbsolute` also decides which SERIES backs the
+    // banding and the trail below — an absolute scored against a history of deviations would be
+    // nonsense, so the two must move together.
+    val leadsAbsolute = skinTempLeadsWithAbsolute(d?.skinTempC)
+    val skin = if (leadsAbsolute) d?.skinTempC else d?.skinTempDevC
     // Track which kind the value is so the temperature converter picks the right rule: an ABSOLUTE
     // reading uses the full C→F formula (×9/5 + 32); a ±DEVIATION must omit the offset.
-    val skinIsAbsolute = skin?.let { VitalBands.isAbsoluteSkinTemp(it) } ?: true
+    val skinIsAbsolute = if (leadsAbsolute) true else skin?.let { VitalBands.isAbsoluteSkinTemp(it) } ?: true
+    val skinSelector: (DailyMetric) -> Double? =
+        if (leadsAbsolute) { row -> row.skinTempC } else { row -> row.skinTempDevC }
     val skinResult: VitalBands.Result = if (skin == null) {
         VitalBands.Result(VitalBands.Band.NO_DATA, VitalBands.Basis.POPULATION, 0)
     } else {
         VitalBands.band(
             value = skin,
-            history = VitalBands.skinTempHistory(skin, series { it.skinTempDevC }),
+            history = VitalBands.skinTempHistory(skin, series(skinSelector)),
             populationRange = if (skinIsAbsolute) 33.0..36.0 else -0.6..0.6,
             cfg = if (skinIsAbsolute) Baselines.metricCfg.getValue("skin_temp") else VitalBands.skinTempDeviationCfg,
         )
@@ -189,7 +239,7 @@ internal fun vitalsFor(
         SkinTempDisplay.numberString(c, skinKind, fahrenheit, decimals = 1)
     }
     val previousSkin = history.asReversed().asSequence()
-        .mapNotNull { row -> row.skinTempDevC?.takeIf { VitalBands.isAbsoluteSkinTemp(it) == skinIsAbsolute } }
+        .mapNotNull { row -> skinSelector(row)?.takeIf { VitalBands.isAbsoluteSkinTemp(it) == skinIsAbsolute } }
         .firstOrNull()
     val respRangeCaption = rangeCaption(days.mapNotNull { it.respRateBpm }, "rpm") { String.format(Locale.US, "%.1f", it) }
     val spo2RangeCaption = rangeCaption(days.mapNotNull { it.spo2Pct }, "%") { String.format(Locale.US, "%.0f", it) }
@@ -197,7 +247,7 @@ internal fun vitalsFor(
     val hrvRangeCaption = rangeCaption(days.mapNotNull { it.avgHrv }, "ms") { it.roundToInt().toString() }
     val skinRangeCaption = rangeCaption(
         days.mapNotNull { row ->
-            row.skinTempDevC?.takeIf { VitalBands.isAbsoluteSkinTemp(it) == skinIsAbsolute }
+            skinSelector(row)?.takeIf { VitalBands.isAbsoluteSkinTemp(it) == skinIsAbsolute }
         },
         skinUnitLabel,
         skinFormat,
@@ -320,8 +370,11 @@ internal fun vitalsFor(
             banding = skinResult, metricColor = Palette.metricAmber,
             // Keep the trail on the displayed value's kind — absolute °C and ±deviation must not mix.
             sparkline = trail(skin) { row ->
-                row.skinTempDevC?.takeIf { VitalBands.isAbsoluteSkinTemp(it) == skinIsAbsolute }
+                skinSelector(row)?.takeIf { VitalBands.isAbsoluteSkinTemp(it) == skinIsAbsolute }
             },
+            // #1636: the deviation this absolute was derived from, beneath it. Only on an absolute-led
+            // tile — on a deviation-led one it would simply repeat the headline.
+            secondary = if (leadsAbsolute) skinTempSecondaryNote(d?.skinTempDevC, fahrenheit) else null,
         ),
     )
 }
diff --git a/android/app/src/test/java/com/noop/ui/SkinTempAbsoluteDisplayTest.kt b/android/app/src/test/java/com/noop/ui/SkinTempAbsoluteDisplayTest.kt
new file mode 100644
index 0000000000..582a366745
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/SkinTempAbsoluteDisplayTest.kt
@@ -0,0 +1,105 @@
+package com.noop.ui
+
+import com.noop.analytics.VitalBands
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #1636: the skin-temp TILE leads with the night's ABSOLUTE, with the deviation beneath it.
+ *
+ * A deviation with no anchor cannot be read — the reporter's flu night was "+0.94 Δ°F", which looks
+ * like nothing, against 96.4 °F on a 94.4 °F mean. Both numbers are needed and neither is sufficient.
+ *
+ * `vitalsFor` resolves strings through `NoopApplication` and cannot run in a JVM test at all, so the
+ * BRANCH and the FORMATTING are asserted through their pure seams — the arrangement
+ * `Spo2MissingCaptionTest` already uses for the same reason. Twin of Swift `SkinTempAbsoluteDisplayTests`.
+ */
+class SkinTempAbsoluteDisplayTest {
+
+    // The branch: absolute-led, or the pre-#1636 deviation-led display
+
+    @Test
+    fun aNightThatMeasuredAnAbsoluteLeadsWithIt() {
+        assertTrue(skinTempLeadsWithAbsolute(34.6))
+    }
+
+    @Test
+    fun aNightPredatingTheColumnKeepsTheOldDisplay() {
+        // Deviation-only: the tile must look exactly as it did before, not blank out.
+        assertFalse(skinTempLeadsWithAbsolute(null))
+    }
+
+    // The secondary note: the deviation, in the user's own unit
+
+    @Test
+    fun theNoteCarriesTheSignAndTheDeltaUnit() {
+        // The reporter's Aug 14, both ways round.
+        assertEquals("+0.5 Δ°C", skinTempSecondaryNote(0.52, fahrenheit = false))
+        assertEquals("+0.9 Δ°F", skinTempSecondaryNote(0.52, fahrenheit = true))
+    }
+
+    @Test
+    fun aNegativeDeviationKeepsItsSign() {
+        assertEquals("-0.5 Δ°C", skinTempSecondaryNote(-0.5, fahrenheit = false))
+        assertEquals("-0.9 Δ°F", skinTempSecondaryNote(-0.5, fahrenheit = true))
+    }
+
+    @Test
+    fun aFahrenheitDeviationScalesWithoutTheOffset() {
+        // A whole degree of DEVIATION is 1.8 °F, never 33.8 — the +32 offset would be wrong for a delta.
+        assertEquals("+1.8 Δ°F", skinTempSecondaryNote(1.0, fahrenheit = true))
+    }
+
+    // The caption ordering, the Kotlin twin of Swift's stateCaption assertions
+
+    private fun tile(secondary: String?, caveat: String? = null, band: VitalBands.Band = VitalBands.Band.IN_RANGE) =
+        Vital(
+            key = "skin", label = "Skin Temp", unit = "°C", value = 34.6,
+            format = { String.format(java.util.Locale.US, "%.1f", it) },
+            missingCaption = "none",
+            banding = VitalBands.Result(band, VitalBands.Basis.PERSONAL, 24),
+            metricColor = androidx.compose.ui.graphics.Color.Yellow,
+            caveat = caveat, secondary = secondary,
+        )
+
+    @Test
+    fun theSecondaryLeadsTheCaptionSoItSitsUnderTheValue() {
+        assertTrue(tile(secondary = "+0.9 Δ°F").stateCaption.startsWith("+0.9 Δ°F · "))
+    }
+
+    @Test
+    fun withoutASecondaryTheCaptionIsUnchanged() {
+        // Every other vital passes null, so their captions must be byte-identical to before.
+        assertEquals("In your range", tile(secondary = null).stateCaption)
+    }
+
+    @Test
+    fun theSecondaryIsIndependentOfTheCaveat() {
+        // `caveat` says the reading is unreliable; `secondary` says what it means. A tile may carry
+        // both, and they must not be confused for one another.
+        val caption = tile(secondary = "+0.9 Δ°F", caveat = "unverified").stateCaption
+        assertTrue(caption.startsWith("+0.9 Δ°F · "))
+        assertTrue(caption.endsWith("unverified"))
+    }
+
+    @Test
+    fun anEmptyTileNeverCarriesASecondary() {
+        // The caption there is the "why it's empty" line; a number beside it would contradict it.
+        assertEquals("none", tile(secondary = "+0.9 Δ°F", band = VitalBands.Band.NO_DATA).stateCaption)
+    }
+
+    /**
+     * A CALIBRATING night is the case worth having: `recomputeSkinTempDev` returns null until the
+     * baseline is usable (~4 nights) while the absolute is already measured. The tile leads with the
+     * temperature and simply omits the note, rather than printing an empty line under the headline.
+     */
+    @Test
+    fun aCalibratingNightLeadsWithTheAbsoluteAndOmitsTheNote() {
+        assertTrue(skinTempLeadsWithAbsolute(34.6))
+        assertNull(skinTempSecondaryNote(null, fahrenheit = false))
+        assertNull(skinTempSecondaryNote(null, fahrenheit = true))
+    }
+}

From c578c28d886c0347013e3fd3f62e6b4b15a6a1d1 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 11:33:15 +1200
Subject: [PATCH 003/333] capture: an empty raw capture is no capture, not a
 successful share (#1666)

A 5/MG raw capture left running overnight produced a 282-byte file: three
header comment lines and not one frame. The share reported success.

The share gated on the capture file EXISTING, and existence is not evidence
anything was recorded -- startWhoop5BackfillCapture opens in APPEND mode,
which CREATES the file the moment capture starts. A night that captured
nothing was indistinguishable, at that gate, from a night that captured
everything.

The overnight strap log confirms the cause: across five connects the only
subscriptions were the standard profile (00002a37 HR, 00002a19 battery), and
the puffin notify chars fd4b0003/4/5/7 appear ZERO times. They are subscribed
only in the CLIENT_HELLO-ack branch, and every connect logged "createBond was
accepted but the device never left this state". No puffin channel, no frames,
by construction.

noCaptureMsgText already had the right words ("history sync needs the full
encrypted pairing") and its test already pinned that it must not tell someone
to wait for a sync their strap cannot reach. It never ran, because the empty
file looked like a capture. This is the gate that lets it run: content, not
existence. File.length() is 0 for a missing file, so the old existence check
is subsumed rather than replaced.

Fixed at all three sites. The detailed-capture LOG had the identical flaw, and
the scheduled auto-export would have written a zero-byte .bin into every drop
forever. One predicate decides all three.

Verified: 4522 Android tests, CI green. Android-only; the raw capture has no
Apple counterpart. No BLE path touched -- this is what the app SAYS about a
capture, not how it records one.

Does not make the capture non-empty. That needs the pairing failure resolved,
or the standard-profile notifications captured instead.
---
 .../src/main/java/com/noop/ui/LogExport.kt    | 28 +++++++-
 .../java/com/noop/ui/EmptyRawCaptureTest.kt   | 71 +++++++++++++++++++
 2 files changed, 96 insertions(+), 3 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ui/EmptyRawCaptureTest.kt

diff --git a/android/app/src/main/java/com/noop/ui/LogExport.kt b/android/app/src/main/java/com/noop/ui/LogExport.kt
index 5d9019049f..7cd8b8352f 100644
--- a/android/app/src/main/java/com/noop/ui/LogExport.kt
+++ b/android/app/src/main/java/com/noop/ui/LogExport.kt
@@ -157,7 +157,9 @@ object LogExport {
             // present when a 5/MG owner has the opt-in capture on and a history sync has run.
             val main = File(context.filesDir, com.noop.ble.WhoopBleClient.WHOOP5_CAPTURE_FILE)
             val prev = File(context.filesDir, "${com.noop.ble.WhoopBleClient.WHOOP5_CAPTURE_FILE}.1")
-            if (main.exists() || prev.exists()) {
+            // Same rule as the interactive share: content, not existence. An empty capture file would
+            // otherwise put a zero-byte `.bin` into every scheduled drop, forever.
+            if (captureHasFrames(main.length(), prev.length())) {
                 val rawFile = File(dir, rawCaptureFilename(nowMs))
                 rawFile.outputStream().bufferedWriter().use { w ->
                     for (f in listOf(prev, main)) if (f.exists()) f.bufferedReader().use { r -> r.copyTo(w) }
@@ -281,7 +283,16 @@ object LogExport {
     private fun writeCaptureFile(context: Context): File? {
         val main = File(context.filesDir, com.noop.ble.WhoopBleClient.WHOOP5_CAPTURE_FILE)
         val prev = File(context.filesDir, "${com.noop.ble.WhoopBleClient.WHOOP5_CAPTURE_FILE}.1")
-        if (!main.exists() && !prev.exists()) return null
+        // An EMPTY capture is no capture. This used to gate on the files EXISTING, and existence is not
+        // evidence that anything was recorded: `startWhoop5BackfillCapture` opens in append mode, which
+        // CREATES the file the moment capture starts. A strap that never completes its handshake then
+        // produces a zero-byte capture that still exists — and the share emitted a 282-byte header with
+        // no frames under it, reporting success for a night that recorded nothing.
+        //
+        // Returning null here routes those to `noCaptureMsg`, which already knows how to explain the
+        // common cause: without the encrypted bond the puffin notify chars are never subscribed, so no
+        // frames can reach the writer at all.
+        if (captureHasFrames(main.length(), prev.length()).not()) return null
         val header = buildString {
             appendLine("# NOOP 5/MG raw backfill capture (JSONL; one frame per line)")
             appendLine("# App: ${BuildConfig.VERSION_NAME} (${BuildConfig.TIER}) · Android ${Build.VERSION.RELEASE} (SDK ${Build.VERSION.SDK_INT}) · ${Build.MANUFACTURER} ${Build.MODEL}")
@@ -330,7 +341,9 @@ object LogExport {
     private fun writeCaptureLogFile(context: Context): File? {
         val main = File(context.filesDir, com.noop.ble.WhoopBleClient.CAPTURE_LOG_FILE)
         val prev = File(context.filesDir, "${com.noop.ble.WhoopBleClient.CAPTURE_LOG_FILE}.1")
-        if (!main.exists() && !prev.exists()) return null
+        // Content, not existence — the same flaw the raw capture had. This writer opens on demand too,
+        // so a toggle switched on with nothing yet logged would share a header and no log under it.
+        if (captureHasFrames(main.length(), prev.length()).not()) return null
         val header = buildString {
             appendLine("# NOOP detailed capture — rolling strap log (PII-scrubbed at source)")
             appendLine("# App: ${BuildConfig.VERSION_NAME} (${BuildConfig.TIER}) · Android ${Build.VERSION.RELEASE} (SDK ${Build.VERSION.SDK_INT}) · ${Build.MANUFACTURER} ${Build.MODEL}")
@@ -381,6 +394,15 @@ object LogExport {
         sharingLog = sharingLog,
     )
 
+    /**
+     * Whether the on-disk capture holds any frames at all.
+     *
+     * `File.length()` is 0 for a file that does not exist, so this subsumes the old existence check and
+     * additionally rejects a file that was opened and never written. Pure so the rule is assertable
+     * without touching the filesystem.
+     */
+    internal fun captureHasFrames(mainBytes: Long, prevBytes: Long): Boolean = mainBytes + prevBytes > 0L
+
     /**
      * The no-capture copy, as a pure function of what we know.
      *
diff --git a/android/app/src/test/java/com/noop/ui/EmptyRawCaptureTest.kt b/android/app/src/test/java/com/noop/ui/EmptyRawCaptureTest.kt
new file mode 100644
index 0000000000..75847c24f3
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/EmptyRawCaptureTest.kt
@@ -0,0 +1,71 @@
+package com.noop.ui
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * An EMPTY 5/MG raw capture must report as no capture, not as a successful share.
+ *
+ * Field report: a capture left running overnight produced a 282-byte file — the three header comment
+ * lines and not one frame. The share path gated on the capture file EXISTING, and existence proves
+ * nothing was recorded: `startWhoop5BackfillCapture` opens in APPEND mode, which creates the file the
+ * moment capture starts.
+ *
+ * The cause is upstream and known: the puffin notify characteristics are subscribed only in the
+ * CLIENT_HELLO-ack branch, so a 5/MG that never completes its handshake (#1635) can never deliver a
+ * frame to the writer. `noCaptureMsgText` already explains exactly that — it simply never ran, because
+ * the empty file looked like a capture. This is the gate that lets it run.
+ */
+class EmptyRawCaptureTest {
+
+    @Test
+    fun `a capture file that exists but holds no frames is not a capture`() {
+        // The reported night: capture started (so the file exists) and recorded nothing.
+        assertFalse(LogExport.captureHasFrames(mainBytes = 0L, prevBytes = 0L))
+    }
+
+    @Test
+    fun `a capture with frames in the live file counts`() {
+        assertTrue(LogExport.captureHasFrames(mainBytes = 4_096L, prevBytes = 0L))
+    }
+
+    @Test
+    fun `a capture whose only frames are in the ROTATED generation still counts`() {
+        // The live file can be freshly rotated and empty while the previous generation holds the
+        // material — dropping that would discard exactly the long-run capture this feature exists for.
+        assertTrue(LogExport.captureHasFrames(mainBytes = 0L, prevBytes = 4_096L))
+    }
+
+    @Test
+    fun `absent files report as no capture`() {
+        // File.length() is 0 for a file that does not exist, so the old existence check is subsumed
+        // rather than replaced — a never-started capture still reports as no capture.
+        assertFalse(LogExport.captureHasFrames(mainBytes = 0L, prevBytes = 0L))
+    }
+
+    @Test
+    fun `the same rule guards the detailed capture log and the scheduled drop`() {
+        // Both had the identical exists()-not-content flaw: the log writer opens on demand too, and the
+        // scheduled auto-export would otherwise write a zero-byte .bin into every drop, forever. One
+        // predicate now decides all three, so a future caller cannot get a fourth one subtly different.
+        assertFalse(LogExport.captureHasFrames(0L, 0L))
+        assertTrue(LogExport.captureHasFrames(1L, 0L))
+        assertTrue(LogExport.captureHasFrames(0L, 1L))
+    }
+
+    /**
+     * The message the gate now lets through, for the night that was actually reported: capture on,
+     * strap connected, no encrypted bond. It must not tell the wearer to wait for a sync their strap
+     * cannot reach — they already waited all night.
+     */
+    @Test
+    fun `an unbonded strap is told why, not told to wait`() {
+        val msg = LogExport.noCaptureMsgText(
+            whoop5Connected = true, captureEnabled = true, encryptedBond = false, sharingLog = false,
+        )
+        assertTrue(msg.contains("encrypted pairing"))
+        assertFalse("waiting is not the remedy when the strap cannot pair",
+                    msg.contains("Let a 5/MG history sync run"))
+    }
+}

From 3f3d111e89831abb72262a324234e11e0bed9222 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 11:59:05 +1200
Subject: [PATCH 004/333] diagnostics: stop calling a second strap's night a
 read failure (#1667)

The night funnel printed, for a wearer with two straps:

  (no raw biometric samples under the ACTIVE id 'whoop-FD:..' for this night
   - they are under 'my-whoop' (59304 rows) instead. ... this is NOT a fresh
   re-add, the samples exist and are not being read.)

They were being read. The wearer had worn the OTHER strap that night, and
DayOwnerResolver had correctly given the night to it -- the same log's own
dayOwner lines show readId=my-whoop with ~192k rows for each of those days,
resolved on hasData exactly as designed.

The line knows two things: the active id has no samples for the night, and
another id does. From that it concluded a read failure, which is one of two
explanations and not the likelier one for anybody who owns two straps. It cost
a real investigation before the dayOwner lines corrected it.

That is the mirror image of the bug it was written to fix: it replaced an
over-confident INNOCENT explanation ("expected on a freshly re-added strap")
with an over-confident GUILTY one, against the rule that a diagnostic may only
assert what it can attribute.

Adds the third branch. When an id holding the samples is a registered,
non-archived strap, the line says so and points at the dayOwner line that
names the owner -- no bug claimed. When it is NOT a live device row, the #1193
split really is the remaining explanation and that wording is unchanged.

Excluding archived devices is deliberate and matches the resolver: an archived
device cannot own a day (candidatePriorities filters it), so samples under one
genuinely are unreachable and the split wording is right there.

Parity verified at every layer rather than assumed: both platforms read the
registry with byte-identical SQL through different APIs, the Android "archived"
literal is DeviceStatus.archived.name, the assembled prose compares
byte-identical, and the four new tests correspond one-to-one by name.

The registry is read only when the active id came back empty, so a healthy
install pays nothing. The new parameter defaults to empty, so every existing
caller and both original suites are byte-identical.

Verified: 4536 Android tests, app-build green on both legs with StrandTests
executed, 3/3 PR checks.
---
 Strand/System/DebugDataDiagnostics.swift      | 27 +++++++-
 StrandTests/OrphanedSamplesLineTests.swift    | 49 +++++++++++++++
 .../com/noop/testcentre/AndroidDiagnostics.kt | 33 +++++++++-
 .../testcentre/OrphanedSamplesLineTest.kt     | 61 +++++++++++++++++++
 4 files changed, 166 insertions(+), 4 deletions(-)

diff --git a/Strand/System/DebugDataDiagnostics.swift b/Strand/System/DebugDataDiagnostics.swift
index 4287e75d27..00ddc7c0b4 100644
--- a/Strand/System/DebugDataDiagnostics.swift
+++ b/Strand/System/DebugDataDiagnostics.swift
@@ -199,7 +199,14 @@ enum DebugDataDiagnostics {
             // back empty, so a healthy install pays nothing.
             let elsewhere = ((try? await store.rawSampleCountsByDevice(from: cs.startTs, to: cs.endTs)) ?? [])
                 .filter { $0.0 != did }
-            lines.append(orphanedSamplesLine(activeId: did, othersWithSamples: elsewhere))
+            // The registry, so a SECOND strap's night is not reported as a read failure. Only read when
+            // the active id came back empty, so a healthy install still pays nothing.
+            let otherStraps = Set(
+                ((try? DeviceRegistryStore(dbQueue: store.registryWriter).all()) ?? [])
+                    .filter { $0.status != .archived && $0.id != did }
+                    .map(\.id))
+            lines.append(orphanedSamplesLine(activeId: did, othersWithSamples: elsewhere,
+                                             otherLiveStrapIds: otherStraps))
             return lines
         }
         if let rem = SleepStager.remFunnelDiagnostic(start: cs.startTs, end: cs.endTs, grav: grav, hr: hr, rr: rr, resp: resp) {
@@ -476,11 +483,27 @@ enum DebugDataDiagnostics {
     ///
     /// Pure so the wording is unit-tested without a database, a strap, or a registry. Kotlin twin:
     /// `com.noop.testcentre.orphanedSamplesLine`.
-    static func orphanedSamplesLine(activeId: String, othersWithSamples: [(String, Int)]) -> String {
+    /// `otherLiveStrapIds` is the registered, non-archived device ids OTHER than the active one. It exists
+    /// because the "not being read" wording was itself an over-assertion — the mirror image of the one it
+    /// replaced. A wearer with TWO straps has nights owned by the other one, and `DayOwnerResolver` hands
+    /// each day to whichever device actually holds its data. Samples under another id are then completely
+    /// normal, and calling that a read failure sends the reader hunting a bug that is not there. Only when
+    /// the id holding the samples is NOT a live registered strap is the #1193 split the explanation left.
+    static func orphanedSamplesLine(activeId: String, othersWithSamples: [(String, Int)],
+                                    otherLiveStrapIds: Set<String> = []) -> String {
         if othersWithSamples.isEmpty {
             return "(no raw biometric samples under '\(activeId)' for this night — expected on a freshly "
                 + "re-added strap; reconnect + let a history sync run, then re-export)"
         }
+        let ownedByAnotherStrap = othersWithSamples.filter { otherLiveStrapIds.contains($0.0) }
+        if !ownedByAnotherStrap.isEmpty {
+            let who = ownedByAnotherStrap.sorted { $0.1 != $1.1 ? $0.1 > $1.1 : $0.0 < $1.0 }
+                .map { "'\($0.0)' (\($0.1) rows)" }
+                .joined(separator: ", ")
+            return "(no raw biometric samples under the ACTIVE id '\(activeId)' for this night — they are "
+                + "under \(who), another registered strap. A night worn on a different strap is OWNED by that "
+                + "strap, so this is expected; the dayOwner line for this date names the owner.)"
+        }
         // Tie-break on id: Kotlin's sortedByDescending is stable but Swift's `sorted` is NOT, so equal
         // counts could otherwise order differently on the two platforms and the twin lines would diverge.
         // The tie-break itself compares Unicode canonical order here and UTF-16 code units in Kotlin; those
diff --git a/StrandTests/OrphanedSamplesLineTests.swift b/StrandTests/OrphanedSamplesLineTests.swift
index efd7a5b82a..4a1025bafb 100644
--- a/StrandTests/OrphanedSamplesLineTests.swift
+++ b/StrandTests/OrphanedSamplesLineTests.swift
@@ -45,4 +45,53 @@ final class OrphanedSamplesLineTests: XCTestCase {
         )
         XCTAssertTrue(line.contains("'whoop-aa' (50 rows), 'whoop-zz' (50 rows)"))
     }
+
+    // MARK: - #1193 wording is for a genuine split — NOT for a second strap's night
+
+    /// The over-assertion this branch exists for. A wearer with two straps has nights owned by the other
+    /// one; `DayOwnerResolver` hands each day to whichever device holds its data. Samples under that id
+    /// are expected, and calling it a read failure sends the reader hunting a bug that is not there.
+    func testASecondRegisteredStrapsNightIsExpectedNotAReadFailure() {
+        let line = DebugDataDiagnostics.orphanedSamplesLine(
+            activeId: "whoop-FD:4A",
+            othersWithSamples: [("my-whoop", 59_304)],
+            otherLiveStrapIds: ["my-whoop"])
+        XCTAssertTrue(line.contains("another registered strap"))
+        XCTAssertTrue(line.contains("'my-whoop' (59304 rows)"))
+        XCTAssertTrue(line.contains("dayOwner"), "must point at the line that settles it")
+        XCTAssertFalse(line.contains("are not being read"), "must not claim a bug")
+        XCTAssertFalse(line.contains("#1193"))
+    }
+
+    /// An id that is NOT a live registered strap is still the #1193 split — that wording must survive.
+    func testAnUnregisteredIdHoldingTheSamplesIsStillReportedAsASplit() {
+        let line = DebugDataDiagnostics.orphanedSamplesLine(
+            activeId: "whoop-FD:4A",
+            othersWithSamples: [("my-whoop", 59_304)],
+            otherLiveStrapIds: ["whoop-OTHER"])
+        XCTAssertTrue(line.contains("#1193"))
+        XCTAssertTrue(line.contains("are not being read"))
+    }
+
+    /// No registry supplied (the default) keeps every existing caller byte-identical.
+    func testWithoutARegistryTheWordingIsUnchanged() {
+        let withDefault = DebugDataDiagnostics.orphanedSamplesLine(
+            activeId: "whoop-FD:4A", othersWithSamples: [("my-whoop", 59_304)])
+        let explicitEmpty = DebugDataDiagnostics.orphanedSamplesLine(
+            activeId: "whoop-FD:4A", othersWithSamples: [("my-whoop", 59_304)], otherLiveStrapIds: [])
+        XCTAssertEqual(withDefault, explicitEmpty)
+        XCTAssertTrue(withDefault.contains("#1193"))
+    }
+
+    /// Mixed: one id is a live strap, one is not — the live strap explains it, so no bug is claimed.
+    func testALiveStrapAmongTheIdsWinsOverTheSplitWording() {
+        let line = DebugDataDiagnostics.orphanedSamplesLine(
+            activeId: "whoop-FD:4A",
+            othersWithSamples: [("orphan-id", 10), ("my-whoop", 59_304)],
+            otherLiveStrapIds: ["my-whoop"])
+        XCTAssertTrue(line.contains("another registered strap"))
+        XCTAssertTrue(line.contains("'my-whoop' (59304 rows)"))
+        XCTAssertFalse(line.contains("'orphan-id'"),
+                       "the orphan id is not the story when a real strap owns the night")
+    }
 }
diff --git a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
index 688434ffcb..1284e2252e 100644
--- a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
@@ -196,7 +196,15 @@ object AndroidDiagnostics {
                     repo.rawSampleCountsByDevice(session.startTs, session.endTs)
                         .filter { it.first != id }
                 }.getOrDefault(emptyList())
-                add(orphanedSamplesLine(id, elsewhere))
+                // The registry, so a SECOND strap's night is not reported as a read failure. Only queried
+                // when the active id came back empty, so a healthy install still pays nothing.
+                val otherStraps = runCatching {
+                    repo.pairedDevices()
+                        .filter { it.status != "archived" && it.id != id }
+                        .map { it.id }
+                        .toSet()
+                }.getOrDefault(emptySet())
+                add(orphanedSamplesLine(id, elsewhere, otherStraps))
                 return@runCatching
             }
             com.noop.analytics.SleepStager.remFunnelDiagnostic(session.startTs, session.endTs, grav, hr, rr, resp)
@@ -478,13 +486,34 @@ object AndroidDiagnostics {
      * the same window. Empty means the samples genuinely are not there and the fresh-re-add wording is
      * right; non-empty names the id that has them so the split is visible rather than inferred.
      *
+     * [otherLiveStrapIds] is the registered, non-archived device ids OTHER than the active one. It exists
+     * because the "not being read" wording was itself an over-assertion — the mirror image of the one it
+     * replaced. A wearer with TWO straps has nights owned by the other one, and [DayOwnerResolver] hands
+     * each day to whichever device actually holds its data. Samples under another id are then completely
+     * normal, and calling that a read failure sends the reader hunting a bug that is not there (it sent
+     * ME hunting one). Only when the id holding the samples is NOT a live registered strap is the #1193
+     * split the remaining explanation.
+     *
      * Pure so the wording is unit-tested without a database, a strap, or a registry.
      */
-    internal fun orphanedSamplesLine(activeId: String, othersWithSamples: List<Pair<String, Int>>): String {
+    internal fun orphanedSamplesLine(
+        activeId: String,
+        othersWithSamples: List<Pair<String, Int>>,
+        otherLiveStrapIds: Set<String> = emptySet(),
+    ): String {
         if (othersWithSamples.isEmpty()) {
             return "(no raw biometric samples under '$activeId' for this night — expected on a freshly " +
                 "re-added strap; reconnect + let a history sync run, then re-export)"
         }
+        val ownedByAnotherStrap = othersWithSamples.filter { it.first in otherLiveStrapIds }
+        if (ownedByAnotherStrap.isNotEmpty()) {
+            val who = ownedByAnotherStrap
+                .sortedWith(compareByDescending<Pair<String, Int>> { it.second }.thenBy { it.first })
+                .joinToString(", ") { "'${it.first}' (${it.second} rows)" }
+            return "(no raw biometric samples under the ACTIVE id '$activeId' for this night — they are " +
+                "under $who, another registered strap. A night worn on a different strap is OWNED by that " +
+                "strap, so this is expected; the dayOwner line for this date names the owner.)"
+        }
         // Tie-break on id: Kotlin's sortedByDescending is stable but Swift's `sorted` is NOT, so equal
         // counts could otherwise order differently on the two platforms and the twin lines would diverge.
         // The tie-break itself compares UTF-16 code units here and Unicode canonical order in Swift; those
diff --git a/android/app/src/test/java/com/noop/testcentre/OrphanedSamplesLineTest.kt b/android/app/src/test/java/com/noop/testcentre/OrphanedSamplesLineTest.kt
index 22613dbc30..12aaa4e5a0 100644
--- a/android/app/src/test/java/com/noop/testcentre/OrphanedSamplesLineTest.kt
+++ b/android/app/src/test/java/com/noop/testcentre/OrphanedSamplesLineTest.kt
@@ -1,6 +1,7 @@
 package com.noop.testcentre
 
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Test
 
@@ -57,4 +58,64 @@ class OrphanedSamplesLineTest {
         )
         assertTrue(line.contains("'whoop-aa' (50 rows), 'whoop-zz' (50 rows)"))
     }
+
+    // #1193 wording is for a genuine split — NOT for a second strap's night
+
+    /**
+     * The over-assertion this branch exists for. A wearer with two straps has nights owned by the other
+     * one; DayOwnerResolver hands each day to whichever device holds its data. Samples under that id are
+     * expected, and calling it a read failure sends the reader hunting a bug that is not there.
+     */
+    @Test
+    fun `a second registered strap's night is expected, not a read failure`() {
+        val line = AndroidDiagnostics.orphanedSamplesLine(
+            activeId = "whoop-FD:4A",
+            othersWithSamples = listOf("my-whoop" to 59_304),
+            otherLiveStrapIds = setOf("my-whoop"),
+        )
+        assertTrue(line.contains("another registered strap"))
+        assertTrue(line.contains("'my-whoop' (59304 rows)"))
+        assertTrue("must point at the line that settles it", line.contains("dayOwner"))
+        assertFalse("must not claim a bug", line.contains("are not being read"))
+        assertFalse(line.contains("#1193"))
+    }
+
+    /** An id that is NOT a live registered strap is still the #1193 split — that wording must survive. */
+    @Test
+    fun `an unregistered id holding the samples is still reported as a split`() {
+        val line = AndroidDiagnostics.orphanedSamplesLine(
+            activeId = "whoop-FD:4A",
+            othersWithSamples = listOf("my-whoop" to 59_304),
+            otherLiveStrapIds = setOf("whoop-OTHER"),   // my-whoop is not a live device row
+        )
+        assertTrue(line.contains("#1193"))
+        assertTrue(line.contains("are not being read"))
+    }
+
+    /** No registry supplied (the default) keeps every existing caller byte-identical. */
+    @Test
+    fun `without a registry the wording is unchanged`() {
+        val withDefault = AndroidDiagnostics.orphanedSamplesLine(
+            "whoop-FD:4A", listOf("my-whoop" to 59_304),
+        )
+        val explicitEmpty = AndroidDiagnostics.orphanedSamplesLine(
+            "whoop-FD:4A", listOf("my-whoop" to 59_304), emptySet(),
+        )
+        assertEquals(withDefault, explicitEmpty)
+        assertTrue(withDefault.contains("#1193"))
+    }
+
+    /** Mixed: one id is a live strap, one is not — the live strap explains it, so no bug is claimed. */
+    @Test
+    fun `a live strap among the ids wins over the split wording`() {
+        val line = AndroidDiagnostics.orphanedSamplesLine(
+            activeId = "whoop-FD:4A",
+            othersWithSamples = listOf("orphan-id" to 10, "my-whoop" to 59_304),
+            otherLiveStrapIds = setOf("my-whoop"),
+        )
+        assertTrue(line.contains("another registered strap"))
+        assertTrue(line.contains("'my-whoop' (59304 rows)"))
+        assertFalse("the orphan id is not the story when a real strap owns the night",
+                    line.contains("'orphan-id'"))
+    }
 }

From 50f9d27cdc7ce96d7966402b6356d5143b8091f2 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 13:22:19 +1200
Subject: [PATCH 005/333] ble: opt-in switch to send the CLIENT_HELLO despite
 the suppression latch (#1669)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An opt-in switch to send the CLIENT_HELLO even when the suppression latch is
set. Default OFF, in Settings beside "Ask Android to pair".

It was built to answer one question, and it answered it. An HCI capture taken
with the switch on shows the hello reaching the wire for the first time in
weeks, and the strap's reply:

  → HELLO written (Write Request, fd4b0002)
  ← ATT ERROR 0x05  Insufficient Authentication   (+0.05s)
  ✗ LINK DISCONNECTED                             (+3.08s)

Ten times, byte-identical. The +3.08s is the signature from the original
report ("3.158s, 3.159s, 3.155s after the write"), so the 4.8s reconnect loop
is now fully accounted for.

Combined with the strap answering every Pairing Request with SMP "Pairing Not
Supported", the two refusals form a closed loop: the hello needs encryption,
encryption needs a bond, bonding needs SMP, SMP is refused. Written up on
issue #1635.

So the switch can never succeed on a strap in this state, and default-off is
now the EVIDENCED position rather than the cautious one. It is kept as an
instrument: if a capture of the official app ever reveals an unlock step, this
is how a hello gets tested afterwards.

Two defects were caught during the work, and only hardware could find either:

  - the give-up counter read the raw latch pref, so with the override on every
    drop was excused and the bond-loop pause could never fire -- an unbounded
    hello-drop-reconnect loop with nothing to stop it, worse than before #1642.
    The caller now passes `suppressed && !override`.

  - the override never reached explicitBondDefersHello, which returns early
    when a bond has been requested. With "Ask Android to pair" on, that defers
    the hello "to the next connect" -- which requests a bond and defers again.
    The deferral is permanent, and it is why two full captures contain zero
    hello writes. The switch was a no-op for exactly the people who would turn
    it on.

Also corrects HelloSuppression's doc, which read "the strap is not refusing a
pairing". It is refusing, categorically.

Verification: 12 HelloSuppression + 12 ExplicitBond tests, walking every
latch/override and bond/override combination. Android 4544 tests green,
compile, doc_comment_lint, i18n_audit and lintVitalFullRelease clean -- the
last because new strings across seven locales are what compile and the audit
both miss. Android-only; no Swift twin exists for the latch or the toggle.

Field-validated on a WHOOP 5/MG: the switch does what it says, and what it
says is now known to be futile on this hardware. That is the result.
---
 .../main/java/com/noop/ble/ExplicitBond.kt    | 16 ++++-
 .../java/com/noop/ble/HelloSuppression.kt     | 16 +++--
 .../java/com/noop/ble/PuffinExperiment.kt     | 22 +++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 25 +++++++-
 .../main/java/com/noop/ui/SettingsScreen.kt   | 35 +++++++++++
 .../app/src/main/res/values-de/strings.xml    |  2 +
 .../app/src/main/res/values-es/strings.xml    |  2 +
 .../app/src/main/res/values-fr/strings.xml    |  2 +
 .../app/src/main/res/values-pl/strings.xml    |  2 +
 .../src/main/res/values-pt-rPT/strings.xml    |  2 +
 .../app/src/main/res/values-zh/strings.xml    |  2 +
 android/app/src/main/res/values/strings.xml   |  2 +
 .../java/com/noop/ble/ExplicitBondTest.kt     | 27 ++++++++
 .../java/com/noop/ble/HelloSuppressionTest.kt | 63 +++++++++++++++++++
 14 files changed, 210 insertions(+), 8 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ble/ExplicitBond.kt b/android/app/src/main/java/com/noop/ble/ExplicitBond.kt
index 6c78814dd3..11548ef966 100644
--- a/android/app/src/main/java/com/noop/ble/ExplicitBond.kt
+++ b/android/app/src/main/java/com/noop/ble/ExplicitBond.kt
@@ -57,8 +57,22 @@ internal fun shouldRequestExplicitBond(
  * The hello is left for the NEXT connection. If the pairing succeeds the strap is OS-bonded by then, the
  * link comes up already encrypted, and the write has a chance to complete for the first time. If it fails
  * the strap is no worse off than it is today, and the trace says which happened.
+ *
+ * That reasoning assumed the pairing might succeed. An HCI capture has since shown it cannot: a 5/MG
+ * answers every Pairing Request with SMP `Pairing Not Supported` (0x05). So "leave it for the next
+ * connect" never resolves — the next connect requests a bond too, and defers again. The deferral is
+ * permanent, which is why neither capture contains a single hello write.
+ *
+ * [helloOverride] breaks that cycle. The write-while-pairing hazard it guards against is real, but there
+ * is no pairing in flight to protect: the refusal arrives in milliseconds, long before the hello. Someone
+ * who has explicitly opted into "send hello despite bond refusal" is asking for exactly this write, and
+ * silently swallowing it because a doomed pairing was requested first would make that switch a no-op for
+ * everyone running the pairing experiment — which is precisely who would turn it on.
  */
-internal fun explicitBondDefersHello(requestedThisLink: Boolean): Boolean = requestedThisLink
+internal fun explicitBondDefersHello(
+    requestedThisLink: Boolean,
+    helloOverride: Boolean = false,
+): Boolean = requestedThisLink && !helloOverride
 
 /**
  * The outcome line when `createBond()` THREW rather than returning.
diff --git a/android/app/src/main/java/com/noop/ble/HelloSuppression.kt b/android/app/src/main/java/com/noop/ble/HelloSuppression.kt
index 372955a7d1..af34f4077c 100644
--- a/android/app/src/main/java/com/noop/ble/HelloSuppression.kt
+++ b/android/app/src/main/java/com/noop/ble/HelloSuppression.kt
@@ -6,9 +6,16 @@ package com.noop.ble
  * The #1635 field captures show the hello is what ends the link. Across two sessions and sixteen writes it
  * was never once acknowledged, and the drop is locked to the HELLO rather than to the connect: 3.158s,
  * 3.159s, 3.155s after the write, cycle after cycle, while live HR streams happily over the standard
- * profile the whole time. The bond-state trace added for this (#1639) records no OS pairing attempt at all,
- * so the strap is not refusing a pairing — the write simply never completes and the local stack drops the
- * ACL, which the log reports as an unattributed GATT status 22.
+ * profile the whole time. The bond-state trace added for this (#1639) records no OS pairing attempt at all
+ * — the write simply never completes and the local stack drops the ACL, which the log reports as an
+ * unattributed GATT status 22.
+ *
+ * That trace was later read as "the strap is not refusing a pairing". An HCI capture disproves it: the
+ * phone DOES transmit an SMP Pairing Request and the strap answers `Pairing Not Supported` (0x05). The
+ * refusal is real, and it is categorical — the encrypted bond this hello was waiting behind can never
+ * arrive on a 5/MG. That does not invalidate the suppression, whose evidence is about the hello's own
+ * fate, but it does mean suppressing it leaves the app attempting NEITHER handshake. Hence the opt-in
+ * override below.
  *
  * The result is a strap that CAN deliver live HR being knocked off every five seconds by a handshake that
  * has never once succeeded. Suppressing the hello after the give-up latches trades an unreachable
@@ -31,7 +38,8 @@ package com.noop.ble
 internal fun shouldSendClientHello(
     suppressedForDevice: Boolean,
     userInitiated: Boolean,
-): Boolean = !suppressedForDevice || userInitiated
+    overrideSuppression: Boolean = false,
+): Boolean = !suppressedForDevice || userInitiated || overrideSuppression
 
 /**
  * Should the give-up latch suppress the hello, rather than pause auto-reconnect?
diff --git a/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt b/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt
index 1f811bd05e..0d0e5b7013 100644
--- a/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt
+++ b/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt
@@ -111,6 +111,25 @@ class PuffinExperiment(private val prefs: SharedPreferences) {
         get() = prefs.getBoolean(KEY_MOTION_AWARE_WAKE, false)
         set(v) = prefs.edit().putBoolean(KEY_MOTION_AWARE_WAKE, v).apply()
 
+    /**
+     * Send the CLIENT_HELLO even when the suppression latch says not to (default false, #1635).
+     *
+     * The latch exists because the hello was never once acknowledged and the drop is locked to it. But an
+     * HCI capture has since changed the premise it was reasoned from: the strap answers `createBond` with
+     * SMP `Pairing Not Supported` (0x05), so the encrypted bond the hello was waiting behind can NEVER
+     * arrive. With SMP unavailable and the hello suppressed, the app now attempts NEITHER handshake — the
+     * same capture shows zero writes to fd4b0002 other than DISABLE_ALARM, and zero puffin subscriptions.
+     *
+     * Whether the strap will answer a hello on a link it has explicitly refused to encrypt is unknown, and
+     * unknowable without asking. This switch asks. It is deliberately its own toggle rather than a change
+     * to the latch: the latch's reasoning is still sound for anyone whose strap DOES bond, and the failure
+     * mode it prevents (hello, drop at ~4.8s, reconnect, forever) is real. Opting in accepts that loop in
+     * exchange for the answer.
+     */
+    var helloDespiteBondRefusal: Boolean
+        get() = prefs.getBoolean(KEY_HELLO_DESPITE_REFUSAL, false)
+        set(v) = prefs.edit().putBoolean(KEY_HELLO_DESPITE_REFUSAL, v).apply()
+
     /** True if the user opted in to "Ask Android to pair" (#1635, default false): NOOP calls
      *  `BluetoothDevice.createBond()` explicitly instead of relying on a write to the encrypted
      *  characteristic to provoke pairing — which the #1639 bond-state trace showed never happens at all.
@@ -164,6 +183,9 @@ class PuffinExperiment(private val prefs: SharedPreferences) {
          *  so no macOS key to mirror. */
         const val KEY_EXPLICIT_BOND = "noopWhoop5ExplicitBond"
 
+        /** #1635: send the CLIENT_HELLO even when the suppression latch is set. Default OFF. */
+        const val KEY_HELLO_DESPITE_REFUSAL = "noopWhoop5HelloDespiteRefusal"
+
         /** The 5/MG-only probe keys, in ONE place: [resetFiveMGGatedProbes] clears exactly these, and
          *  SettingsScreen watches exactly these for external writes. Two lists would drift. */
         internal val FIVE_MG_GATED_KEYS =
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 94fe81b2ad..33befcd0ca 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -7636,7 +7636,12 @@ class WhoopBleClient(
                         onFailure = { log(explicitBondThrewLine(it.javaClass.simpleName, where)) },
                     )
                 }
-                if (explicitBondDefersHello(explicitBondRequestedThisLink)) {
+                // #1635: read once, before the deferral gate — the override has to reach BOTH, or a
+                // deferred hello returns early and the switch below is never evaluated at all.
+                val helloOverride = runCatching {
+                    PuffinExperiment.from(context).helloDespiteBondRefusal
+                }.getOrDefault(false)
+                if (explicitBondDefersHello(explicitBondRequestedThisLink, helloOverride = helloOverride)) {
                     // Same trap as the suppression path below, and worse here. The watchdog was armed at
                     // discovery and bounces the link whenever didBond is false — which deferring the hello
                     // guarantees. Tearing the link down while an OS pairing is in flight is the single
@@ -7661,7 +7666,15 @@ class WhoopBleClient(
                 val suppressed = runCatching {
                     com.noop.ui.NoopPrefs.helloSuppressed(context, g.device.address)
                 }.getOrDefault(false)
-                if (shouldSendClientHello(suppressed, userInitiated = userAsked)) {
+                if (shouldSendClientHello(suppressed, userInitiated = userAsked, overrideSuppression = helloOverride)) {
+                    if (suppressed && helloOverride && !userAsked) {
+                        // Say WHY a suppressed strap is getting a hello anyway, or the next reader sees the
+                        // latch set and a hello on the wire and has to guess which of them is broken.
+                        log("WHOOP 5/MG: CLIENT_HELLO sent DESPITE the suppression latch — \"send hello" +
+                            " despite bond refusal\" is on. The strap refuses SMP pairing (Pairing Not" +
+                            " Supported), so this is the only handshake left to try; expect the ~4.8s drop" +
+                            " loop to return if it still goes unanswered (#1635, experimental).")
+                    }
                     writeClientHello(g, cmd)
                 } else {
                     // The watchdog was armed at discovery, before this decision could be made, and it
@@ -8688,8 +8701,14 @@ class WhoopBleClient(
                 staleDirectBond = staleDirectBond,
                 status = status,
                 alreadyPausedForBondLoop = autoReconnectPausedForBondLoop,
+                // The question is whether the hello was ACTUALLY withheld on this link, not whether the
+                // latch is set. With the #1635 override on, the latch stays set while we send the hello
+                // anyway — and reading the raw pref here would disable the give-up for exactly the case
+                // that needs it, leaving an unbounded hello-drop-reconnect loop with nothing to stop it.
+                // Mirrors the `suppressed && !override` decision that chose to send.
                 helloSuppressed = runCatching {
-                    com.noop.ui.NoopPrefs.helloSuppressed(context, lastDeviceAddress)
+                    com.noop.ui.NoopPrefs.helloSuppressed(context, lastDeviceAddress) &&
+                        !PuffinExperiment.from(context).helloDespiteBondRefusal
                 }.getOrDefault(false),
             ) && bondWatchdogBackoff.recordBounce()
         ) {
diff --git a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
index 9c26d63161..4f585e5392 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
@@ -587,6 +587,7 @@ fun SettingsScreen(
     val r22FlagCount = Whoop5Config.enableR22Sequence.size
     var broadcastHr by remember(rev) { mutableStateOf(puffinExperiment.broadcastHr) }
     var explicitBond by remember(rev) { mutableStateOf(puffinExperiment.explicitBond) }
+    var helloDespiteRefusal by remember(rev) { mutableStateOf(puffinExperiment.helloDespiteBondRefusal) }
     // ECG raw-data gate (#891): the opt-in, the write result, and the attested-MG gate the buttons need.
     var ecgRawData by remember(rev) { mutableStateOf(puffinExperiment.ecgRawData) }
     val ecgGateReport by vm.ble.ecgRawDataGate.collectAsStateWithLifecycle()
@@ -2339,6 +2340,40 @@ fun SettingsScreen(
                         },
                     )
                 }
+
+                // --- Send the hello even when the suppression latch is set. (#1635) ---
+                // An HCI capture shows the strap answers createBond with SMP "Pairing Not Supported", so
+                // the bond the hello waits behind can never arrive — and with the hello suppressed the app
+                // attempts neither handshake. This asks the only question left.
+                Row(
+                    modifier = Modifier.fillMaxWidth(),
+                    verticalAlignment = Alignment.CenterVertically,
+                    horizontalArrangement = Arrangement.spacedBy(16.dp),
+                ) {
+                    Text(
+                        uiString(R.string.l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795),
+                        style = NoopType.subhead,
+                        color = Palette.textPrimary,
+                        modifier = Modifier.weight(1f),
+                    )
+                    Switch(
+                        checked = helloDespiteRefusal,
+                        onCheckedChange = {
+                            helloDespiteRefusal = it
+                            puffinExperiment.helloDespiteBondRefusal = it
+                        },
+                        colors = SwitchDefaults.colors(
+                            checkedThumbColor = Palette.surfaceBase,
+                            checkedTrackColor = Palette.accent,
+                            uncheckedThumbColor = Palette.textSecondary,
+                            uncheckedTrackColor = Palette.surfaceInset,
+                            uncheckedBorderColor = Palette.hairline,
+                        ),
+                        modifier = Modifier.semantics {
+                            contentDescription = uiString(R.string.l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd)
+                        },
+                    )
+                }
                 Text(
                     uiString(R.string.l10n_settings_screen_noop_has_always_hoped_that_writing_19967036),
                     style = NoopType.caption,
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index bab45f8753..9e3ed58127 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2466,4 +2466,6 @@
     <string name="l10n_settings_screen_ask_android_to_pair_experimental_250a81e9">Android um Kopplung bitten (experimentell)</string>
     <string name="l10n_settings_screen_noop_has_always_hoped_that_writing_19967036">NOOP hat bisher darauf gesetzt, dass ein Schreibvorgang an dein 5.0/MG Android zur Kopplung veranlasst. Das passiert nie. Diese Option fragt Android direkt und kann einen System-Kopplungsdialog anzeigen. Die Live-Herzfrequenz funktioniert in beiden Fällen weiter; schalte sie aus, wenn der Dialog stört.</string>
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">Android um Kopplung bitten</string>
+    <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Hello trotz Kopplungsverweigerung senden (experimentell)</string>
+    <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Hello trotz Kopplungsverweigerung senden</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 7519d50f1c..41fac8272a 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2452,4 +2452,6 @@
     <string name="l10n_settings_screen_ask_android_to_pair_experimental_250a81e9">Pedir a Android que vincule (experimental)</string>
     <string name="l10n_settings_screen_noop_has_always_hoped_that_writing_19967036">NOOP siempre ha confiado en que escribir en tu 5.0/MG hiciera que Android lo vinculara. Nunca ocurre. Esta opción se lo pide a Android directamente, por lo que puede mostrar un diálogo de vinculación del sistema. La frecuencia cardíaca en directo sigue funcionando igualmente; desactívala si el diálogo molesta.</string>
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">Pedir a Android que vincule</string>
+    <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Enviar hello pese al rechazo de vinculación (experimental)</string>
+    <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Enviar hello pese al rechazo de vinculación</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 0dfe92a673..c97ebb6719 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2451,4 +2451,6 @@
     <string name="l10n_settings_screen_ask_android_to_pair_experimental_250a81e9">Demander à Android de s\'appairer (expérimental)</string>
     <string name="l10n_settings_screen_noop_has_always_hoped_that_writing_19967036">NOOP a toujours compté sur l\'écriture vers votre 5.0/MG pour qu\'Android s\'appaire. Cela n\'arrive jamais. Cette option le demande directement à Android et peut afficher une boîte de dialogue d\'appairage du système. La fréquence cardiaque en direct continue de fonctionner dans les deux cas ; désactivez-la si la boîte de dialogue vous gêne.</string>
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">Demander à Android de s\'appairer</string>
+    <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Envoyer le hello malgré le refus d\'appairage (expérimental)</string>
+    <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Envoyer le hello malgré le refus d\'appairage</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 693c632e02..1909b25020 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2457,4 +2457,6 @@
     <string name="l10n_settings_screen_ask_android_to_pair_experimental_250a81e9">Poproś Androida o sparowanie (eksperymentalne)</string>
     <string name="l10n_settings_screen_noop_has_always_hoped_that_writing_19967036">NOOP zawsze liczył na to, że zapis do 5.0/MG skłoni Androida do sparowania. To się nigdy nie dzieje. Ta opcja prosi Androida bezpośrednio, więc może pojawić się systemowe okno parowania. Tętno na żywo działa tak czy inaczej; wyłącz, jeśli okno przeszkadza.</string>
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">Poproś Androida o sparowanie</string>
+    <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Wyślij hello mimo odmowy parowania (eksperymentalne)</string>
+    <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Wyślij hello mimo odmowy parowania</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 5c063f9d7b..bb1537dd9a 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2445,4 +2445,6 @@
     <string name="l10n_settings_screen_ask_android_to_pair_experimental_250a81e9">Pedir ao Android para emparelhar (experimental)</string>
     <string name="l10n_settings_screen_noop_has_always_hoped_that_writing_19967036">O NOOP sempre contou que escrever na sua 5.0/MG fizesse o Android emparelhar. Isso nunca acontece. Esta opção pede diretamente ao Android, pelo que pode mostrar uma caixa de diálogo de emparelhamento do sistema. A frequência cardíaca em direto continua a funcionar de qualquer forma; desative se a caixa de diálogo incomodar.</string>
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">Pedir ao Android para emparelhar</string>
+    <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Enviar hello apesar da recusa de emparelhamento (experimental)</string>
+    <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Enviar hello apesar da recusa de emparelhamento</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 7f878733b9..f0be87580b 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2366,4 +2366,6 @@
     <string name="l10n_settings_screen_ask_android_to_pair_experimental_250a81e9">请求 Android 配对（实验性）</string>
     <string name="l10n_settings_screen_noop_has_always_hoped_that_writing_19967036">NOOP 一直寄望于向 5.0/MG 写入数据来促使 Android 配对，但这从未发生。此选项会直接请求 Android，因此可能弹出系统配对对话框。无论哪种方式，实时心率都会继续工作；如果对话框造成困扰，请关闭此选项。</string>
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">请求 Android 配对</string>
+    <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">即使拒绝配对也发送 hello（实验性）</string>
+    <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">即使拒绝配对也发送 hello</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 6b31c3ce4e..2aa851030b 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2478,4 +2478,6 @@
     <string name="l10n_health_screen_your_strap_reports_a_blood_oxygen_349fe34a">Your strap reports a blood oxygen estimate, but it is unverified and off by default. Turn on the strap estimate in Settings to see it, or import a WHOOP export in Data Sources for the calibrated value.</string>
     <string name="l10n_health_screen_no_blood_oxygen_percentage_from_a_1d3d383e">No blood oxygen percentage from a WHOOP 4.0</string>
     <string name="l10n_health_screen_your_strap_banks_the_raw_optical_b52a0f80">Your strap banks the raw optical channels, but NOOP does not turn them into a blood oxygen percentage, so this stays empty however long you wear it. Import a WHOOP export in Data Sources to fill it from your account history.</string>
+    <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Send hello despite bond refusal (experimental)</string>
+    <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Send hello despite bond refusal</string>
 </resources>
diff --git a/android/app/src/test/java/com/noop/ble/ExplicitBondTest.kt b/android/app/src/test/java/com/noop/ble/ExplicitBondTest.kt
index 6c63abc0e5..46e5153e6a 100644
--- a/android/app/src/test/java/com/noop/ble/ExplicitBondTest.kt
+++ b/android/app/src/test/java/com/noop/ble/ExplicitBondTest.kt
@@ -78,4 +78,31 @@ class ExplicitBondTest {
         assertFalse(threw.contains("refused to START pairing"))
         assertFalse(refused.contains("local problem"))
     }
+
+    // #1635: the deferral is permanent unless the override breaks it
+
+    /**
+     * The capture that forced this. "Leave the hello for the next connect" assumed the pairing might
+     * succeed; a 5/MG answers every Pairing Request with `Pairing Not Supported`, and the next connect
+     * requests a bond and defers again. Two full btsnoop captures contain zero hello writes as a result.
+     */
+    @Test
+    fun `without the override a requested bond defers the hello forever`() {
+        assertTrue(explicitBondDefersHello(requestedThisLink = true))
+        assertTrue(explicitBondDefersHello(requestedThisLink = true, helloOverride = false))
+    }
+
+    /** The override breaks the cycle — otherwise the switch is a no-op for everyone running the
+     *  pairing experiment, which is exactly who would turn it on. */
+    @Test
+    fun `the override lets the hello through despite a requested bond`() {
+        assertFalse(explicitBondDefersHello(requestedThisLink = true, helloOverride = true))
+    }
+
+    /** No bond requested means nothing to defer, override or not. */
+    @Test
+    fun `no bond request never defers`() {
+        assertFalse(explicitBondDefersHello(requestedThisLink = false))
+        assertFalse(explicitBondDefersHello(requestedThisLink = false, helloOverride = true))
+    }
 }
diff --git a/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt b/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
index 4449b2722c..b8212fa6f5 100644
--- a/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
+++ b/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
@@ -62,4 +62,67 @@ class HelloSuppressionTest {
         // it asks for a pairing instead, which is self-limiting.
         assertFalse(shouldSendClientHello(suppressedForDevice = true, userInitiated = false))
     }
+
+    // #1635: the opt-in override, after the HCI capture changed the premise
+
+    /**
+     * The capture showed the strap answers createBond with SMP "Pairing Not Supported", so the encrypted
+     * bond the hello waits behind can never arrive. With the hello also suppressed the app attempts
+     * NEITHER handshake — the same capture shows zero writes to fd4b0002 beyond DISABLE_ALARM and zero
+     * puffin subscriptions. The override exists to ask the only question left.
+     */
+    @Test
+    fun `the override sends the hello on a suppressed strap`() {
+        assertTrue(shouldSendClientHello(suppressedForDevice = true, userInitiated = false,
+                                         overrideSuppression = true))
+    }
+
+    /** Default OFF must leave the latch behaving exactly as it did — no behaviour change for anyone else. */
+    @Test
+    fun `without the override a suppressed strap still skips the hello`() {
+        assertFalse(shouldSendClientHello(suppressedForDevice = true, userInitiated = false))
+        assertFalse(shouldSendClientHello(suppressedForDevice = true, userInitiated = false,
+                                          overrideSuppression = false))
+    }
+
+    /** The override is not needed to explain an unsuppressed strap, and must not change it. */
+    @Test
+    fun `an unsuppressed strap is unaffected by the override either way`() {
+        assertTrue(shouldSendClientHello(suppressedForDevice = false, userInitiated = false))
+        assertTrue(shouldSendClientHello(suppressedForDevice = false, userInitiated = false,
+                                         overrideSuppression = true))
+    }
+
+    /** A user-initiated Connect already overrode the latch; the new switch must not disturb that path. */
+    @Test
+    fun `a user-initiated connect still wins on its own`() {
+        assertTrue(shouldSendClientHello(suppressedForDevice = true, userInitiated = true,
+                                         overrideSuppression = false))
+    }
+
+    /**
+     * The give-up must still fire while the override is sending hellos.
+     *
+     * `shouldCountNeverBondedSelfDrop` skips counting when the hello was withheld — correct, because a
+     * suppressed strap's drops are ordinary link losses, not a failing handshake. But the override leaves
+     * the LATCH set while sending the hello anyway, so reading the raw pref there would disable the
+     * give-up for precisely the case that needs it: an unbounded hello-drop-reconnect loop with nothing
+     * to stop it. The caller passes `suppressed && !override`, which is the same expression that decided
+     * to send. This pins the semantics that expression has to satisfy.
+     */
+    @Test
+    fun `a drop counts toward the give-up whenever the hello was actually sent`() {
+        // Effective suppression = the latch AND no override. These are the four combinations.
+        fun effectivelySuppressed(latched: Boolean, override: Boolean) = latched && !override
+        assertTrue(effectivelySuppressed(latched = true, override = false))    // withheld: do not count
+        assertFalse(effectivelySuppressed(latched = true, override = true))    // SENT: must count
+        assertFalse(effectivelySuppressed(latched = false, override = false))  // sent normally: counts
+        assertFalse(effectivelySuppressed(latched = false, override = true))   // sent: counts
+        // And the send decision agrees with it in every case.
+        for (latched in listOf(true, false)) for (ov in listOf(true, false)) {
+            val sent = shouldSendClientHello(latched, userInitiated = false, overrideSuppression = ov)
+            assertTrue("counting must be the inverse of withholding",
+                       sent != effectivelySuppressed(latched, ov))
+        }
+    }
 }

From 3ee70c63a6d1556775ee38cc06e85f4f8ac8011f Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 13:23:54 +1200
Subject: [PATCH 006/333] ble: the bond poll cannot convict Android, and an HCI
 capture says it is wrong (#1668)

The line read:

  bond state poll: BOND_NONE - createBond was accepted but the device never
  left this state and nothing was heard, so Android did not begin pairing at all

An HCI capture disproves it. The phone DOES transmit an SMP Pairing Request,
and the WHOOP 5/MG answers "Pairing Failed - Pairing Not Supported" (0x05).
Thirty exchanges across three capture sessions, every one identical, from a
strap whose sibling WHOOP 4.0 is bonded normally on the same phone.

A REFUSED pairing ends at BOND_NONE with no BONDED transition, which is
indistinguishable from never starting when the bond state is all you can see.
Two causes, one observation - and the verdict picked one and stated it as fact.

That line cost an entire evening. It pointed at the phone while the strap had
been answering plainly the whole time, and every step after it built on a false
premise. It is also the third diagnostic this week to assert more than it
observed, after the trends-report unit line and the night funnel's "the samples
exist and are not being read".

The verdict now names both causes, carries the known 5/MG answer, and names the
HCI capture as the only thing that separates them. The bond-state logic is
unchanged: it was never wrong about what it read, only about what that meant.
No behaviour change.

One line comes out of this vindicated and is deliberately left alone:
"reconnect paused=bondLoop (strap refusing bond)". The strap really is refusing.

Verification: the test that pinned the disproved wording now pins its ABSENCE
plus the corrected content, so the old verdict cannot quietly return. Android
tests green, doc_comment_lint and i18n_audit clean. Android-only; BondStateTrace
has no Swift twin.
---
 .../src/main/java/com/noop/ble/BondStateTrace.kt | 15 ++++++++++++---
 .../test/java/com/noop/ble/BondStateTraceTest.kt | 16 ++++++++++++++--
 2 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ble/BondStateTrace.kt b/android/app/src/main/java/com/noop/ble/BondStateTrace.kt
index 78e2978937..19fc5a503d 100644
--- a/android/app/src/main/java/com/noop/ble/BondStateTrace.kt
+++ b/android/app/src/main/java/com/noop/ble/BondStateTrace.kt
@@ -112,7 +112,13 @@ internal fun bondStateAtConnectLine(bondState: Int, address: String?): String {
  *
  * Polling the device directly removes the broadcast from the chain, so the answer no longer depends on
  * the component under suspicion. A `BOND_BONDING` here with no transition line above it convicts our
- * receiver; a `BOND_NONE` clears it and puts the silence on Android.
+ * receiver; a `BOND_NONE` clears it.
+ *
+ * It does NOT, however, put the silence on Android — which is what this line used to say, and it was
+ * wrong. An HCI capture of exactly this case settled it: the phone DOES transmit an SMP Pairing Request,
+ * and a WHOOP 5/MG answers `Pairing Failed — Pairing Not Supported (0x05)`. A refused pairing ends at
+ * BOND_NONE with no BONDED transition, which is indistinguishable from never starting when all you can
+ * see is the bond state. Two causes, one observation; the old verdict picked one and stated it as fact.
  *
  * Deliberately a single delayed read rather than a subscription: one fact is wanted, not a stream.
  */
@@ -126,8 +132,11 @@ internal fun bondStatePollLine(bondState: Int, sawTransitionLine: Boolean): Stri
             " — pairing underway, as the transition line already said"
         bondState == android.bluetooth.BluetoothDevice.BOND_BONDED -> " — paired"
         !sawTransitionLine ->
-            " — createBond was accepted but the device never left this state and nothing was heard," +
-                " so Android did not begin pairing at all"
+            " — createBond was accepted and the bond did not complete. This is NOT evidence that Android" +
+                " stayed silent: a REFUSED pairing ends here too. On a WHOOP 5/MG an HCI capture shows the" +
+                " phone does transmit a Pairing Request and the strap answers \"Pairing Not Supported\"" +
+                " (SMP 0x05), which lands in exactly this state (#1635). Only an HCI capture separates a" +
+                " refused pairing from one never attempted"
         else -> " — back to this state after a transition"
     }
     return "bond state poll: $name$verdict"
diff --git a/android/app/src/test/java/com/noop/ble/BondStateTraceTest.kt b/android/app/src/test/java/com/noop/ble/BondStateTraceTest.kt
index 690fc1f557..b2b196a47e 100644
--- a/android/app/src/test/java/com/noop/ble/BondStateTraceTest.kt
+++ b/android/app/src/test/java/com/noop/ble/BondStateTraceTest.kt
@@ -130,10 +130,22 @@ class BondStateTraceTest {
         assertTrue(line.contains("a NOOP bug, not the strap"))
     }
 
+    /**
+     * The verdict this line used to give was "Android did not begin pairing at all". An HCI capture of
+     * exactly this case disproved it: the phone DOES transmit an SMP Pairing Request and a WHOOP 5/MG
+     * answers "Pairing Failed — Pairing Not Supported" (0x05). A refused pairing ends at BOND_NONE with
+     * no BONDED transition, which is indistinguishable from never starting if the bond state is all you
+     * can see. The line must now name both causes and the capture that separates them.
+     */
     @Test
-    fun `NONE with no transition line puts the silence on Android`() {
+    fun `NONE with no transition line names BOTH causes rather than convicting Android`() {
         val line = bondStatePollLine(android.bluetooth.BluetoothDevice.BOND_NONE, sawTransitionLine = false)
-        assertTrue(line.contains("did not begin pairing at all"))
+        assertFalse("the disproved verdict must not come back", line.contains("did not begin pairing at all"))
+        assertFalse("nor its softer form", line.contains("nothing was heard"))
+        assertTrue("a refusal must be named as the other cause", line.contains("REFUSED pairing ends here too"))
+        assertTrue("the known 5/MG answer belongs in the line", line.contains("Pairing Not Supported"))
+        assertTrue(line.contains("SMP 0x05"))
+        assertTrue("name the discriminator", line.contains("HCI capture"))
         assertFalse(line.contains("NOOP bug"))
     }
 

From 202c925b62d41fc3636549a71c75b9a847a24025 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 13:46:11 +1200
Subject: [PATCH 007/333] ble: bound the #1635 hello override so it cannot loop
 the link (#1670)

The "send hello despite bond refusal" experiment (#1669) shipped without a bound
of its own and ran 57 reconnect cycles in an hour on a real strap. The shared
give-up could not stop it: shouldCountNeverBondedSelfDrop excludes
GATT_CONN_TERMINATE_LOCAL_HOST, and the hello failure arrives as exactly that
status - the strap answers the write with Insufficient Authentication, the local
stack tries to elevate security, SMP is refused, and the ACL is torn down.

So the bound lives with the override instead: a cap of 6 unanswered hellos,
charged only when the override is what put the hello on the wire, reported once
when spent, and re-armed on a genuine bond or on the user flipping the switch
back on.

Three review passes turned up seven defects, the last four in the bound itself:

  - the budget was charged for hellos the override did not cause, which would
    have retired the experiment after six ordinary connects and then reported
    unanswered hellos about writes it never caused
  - the give-up guard tested `== cap` against a non-atomic ++, so two
    overlapping connects could step past the boundary and silence the line for
    good, leaving the override inert with nothing explaining why
  - a spent override still read as on at the never-bonded detector, which kept
    counting self-drops the hello no longer caused and would have paused
    auto-reconnect and raised the stale-pairing guide over a cause that never
    happened - the didBond-reader trap from CLAUDE.md, pointed the other way.
    Both readers now ask one helper so the polarity cannot drift apart again.
  - the counter outlived the switch, so re-enabling a spent override did nothing
    at all, and said nothing, the give-up line being one-shot and already latched

#1635 remains open. The strap's SMP refusal (Pairing Not Supported, 0x05) is
hardware behaviour no app-side change can alter; this only bounds the experiment
that probes it. The switch stays default-off and experimental.

Verification: Android 4552 tests green, compile and doc_comment_lint clean.
Behaviour observed on a real WHOOP 5/MG - the loop reproduced with the switch on
and the link returned to stable live HR with it off. Android-only, as the rest of
the series is; no Swift twin of this path exists.
---
 .../java/com/noop/ble/HelloSuppression.kt     |  71 +++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  |  54 +++++++-
 .../java/com/noop/ble/HelloSuppressionTest.kt | 117 ++++++++++++++++++
 3 files changed, 236 insertions(+), 6 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ble/HelloSuppression.kt b/android/app/src/main/java/com/noop/ble/HelloSuppression.kt
index af34f4077c..6ba6ccbe4a 100644
--- a/android/app/src/main/java/com/noop/ble/HelloSuppression.kt
+++ b/android/app/src/main/java/com/noop/ble/HelloSuppression.kt
@@ -41,6 +41,77 @@ internal fun shouldSendClientHello(
     overrideSuppression: Boolean = false,
 ): Boolean = !suppressedForDevice || userInitiated || overrideSuppression
 
+/**
+ * How many times the #1635 override may write an unanswered hello before it stops on its own.
+ *
+ * The override needs a bound that does not depend on the disconnect status, and the shared give-up cannot
+ * supply one. `shouldCountNeverBondedSelfDrop` excludes `GATT_CONN_TERMINATE_LOCAL_HOST` (0x16) because
+ * that normally means WE hung up — our own `gatt.disconnect()` or the bond-watchdog bounce — and counting
+ * those would be self-referential. But the hello failure arrives as exactly that status: the strap answers
+ * the write with ATT `Insufficient Authentication`, the local stack tries to elevate security, SMP is
+ * refused, and the stack tears the ACL down. Not our teardown, same status code.
+ *
+ * Field result of leaving it unbounded: 57 reconnect cycles in an hour, each ~4.8s, with nothing able to
+ * stop it. So the cap lives here instead — small enough to spare the battery, large enough that a strap
+ * which answers on a later attempt is not written off.
+ */
+internal const val HELLO_OVERRIDE_MAX_ATTEMPTS = 6
+
+/**
+ * May the override write another hello, given how many it has already written unanswered?
+ *
+ * Counted per app process and reset on a genuine bond. A process restart resets it too, which is the
+ * honest limit of an in-memory bound — but the loop it exists to stop runs within one process, and a
+ * restart is not the failure mode.
+ */
+internal fun overrideHelloStillAllowed(
+    attemptsSoFar: Int,
+    cap: Int = HELLO_OVERRIDE_MAX_ATTEMPTS,
+): Boolean = attemptsSoFar < cap
+
+/**
+ * Is the override actually in force — opted in AND with budget left?
+ *
+ * Every reader must ask through here rather than reading the pref directly. A spent override is not
+ * "on": the hello genuinely stops going out, and a caller still reading the raw pref believes a hello
+ * is on the wire that is not. That is the `didBond`-reader trap from CLAUDE.md pointed the other way,
+ * and it had already reached [shouldCountNeverBondedSelfDrop]: with the budget spent, the app is in the
+ * deliberate suppressed-hello live-HR state, but the raw pref reported the hello as still being sent, so
+ * the never-bonded detector kept counting self-drops and would eventually pause auto-reconnect and raise
+ * the stale-pairing guide — telling the user to re-pair for a cause that never happened.
+ *
+ * The boundary is deliberate: the link carrying the LAST permitted hello reads as inactive at its own
+ * disconnect, because [helloOverrideAttempts] is charged when that hello is written. Under-counting that
+ * one drop is the wanted behaviour — no further hello follows it, so the loop is already over, and
+ * counting it could trip the pause at the exact moment the override retires.
+ */
+internal fun helloOverrideActive(
+    optedIn: Boolean,
+    attemptsSoFar: Int,
+    cap: Int = HELLO_OVERRIDE_MAX_ATTEMPTS,
+): Boolean = optedIn && overrideHelloStillAllowed(attemptsSoFar, cap)
+
+/**
+ * Does flipping the switch to on re-arm a spent budget?
+ *
+ * Turning the experiment off and on again is the user explicitly asking for another try, and without
+ * this they would not get one: the counter outlives the toggle, so re-enabling a spent override does
+ * nothing whatsoever — and silently, because the give-up line is one-shot and has already latched. The
+ * edge is sampled per connect, which is the only moment the override can act anyway.
+ */
+internal fun helloOverrideBudgetRearms(optedInNow: Boolean, optedInLastSeen: Boolean): Boolean =
+    optedInNow && !optedInLastSeen
+
+/**
+ * The line printed when the override gives up, so the log says why the hello stopped rather than leaving
+ * a reader to notice its absence.
+ */
+internal fun helloOverrideExhaustedLine(attempts: Int): String =
+    "WHOOP 5/MG: \"send hello despite bond refusal\" has written $attempts unanswered hellos — stopping." +
+        " The strap answers the write with Insufficient Authentication and refuses SMP pairing, so the" +
+        " handshake cannot complete; continuing would only loop the link. Turn the switch off to return to" +
+        " the stable live-HR state (#1635)."
+
 /**
  * Should the give-up latch suppress the hello, rather than pause auto-reconnect?
  *
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 33befcd0ca..578f4befea 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -5730,6 +5730,8 @@ class WhoopBleClient(
                     // these as REALTIME_DATA — the strap rejected them on the unauthenticated link), then arm
                     // realtime HR with puffin framing. Mirrors the macOS post-bond flow.
                     didBond = true
+                    helloOverrideAttempts = 0     // #1635: the strap answered — the override's budget resets
+                    helloOverrideExhaustedLogged = false
                     cancelBondWatchdog()          // genuine bond reached — the handshake watchdog stands down (#50)
                     noteGenuineBond(g.device.address)   // #52: this strap bonds fine; clears any pin-refusal streak
                     clearPairingHint()            // #78: a genuine bond means the pairing guidance no longer applies
@@ -7638,9 +7640,24 @@ class WhoopBleClient(
                 }
                 // #1635: read once, before the deferral gate — the override has to reach BOTH, or a
                 // deferred hello returns early and the switch below is never evaluated at all.
-                val helloOverride = runCatching {
+                val overrideOptedIn = runCatching {
                     PuffinExperiment.from(context).helloDespiteBondRefusal
                 }.getOrDefault(false)
+                // Flipping the switch off and back on is the user asking for another try. The counter
+                // outlives the toggle, so without this a re-enabled override does nothing at all — and
+                // says nothing, the give-up line having already latched.
+                if (helloOverrideBudgetRearms(overrideOptedIn, helloOverrideOptInSeen)) {
+                    helloOverrideAttempts = 0
+                    helloOverrideExhaustedLogged = false
+                }
+                helloOverrideOptInSeen = overrideOptedIn
+                // Spent budget makes the override inert rather than merely quiet: it must stop reaching the
+                // deferral bypass too, or the link keeps being taken down by a hello nobody will answer.
+                val helloOverride = helloOverrideActive(overrideOptedIn, helloOverrideAttempts)
+                if (overrideOptedIn && !helloOverride && !helloOverrideExhaustedLogged) {
+                    helloOverrideExhaustedLogged = true
+                    log(helloOverrideExhaustedLine(helloOverrideAttempts))
+                }
                 if (explicitBondDefersHello(explicitBondRequestedThisLink, helloOverride = helloOverride)) {
                     // Same trap as the suppression path below, and worse here. The watchdog was armed at
                     // discovery and bounces the link whenever didBond is false — which deferring the hello
@@ -7667,6 +7684,12 @@ class WhoopBleClient(
                     com.noop.ui.NoopPrefs.helloSuppressed(context, g.device.address)
                 }.getOrDefault(false)
                 if (shouldSendClientHello(suppressed, userInitiated = userAsked, overrideSuppression = helloOverride)) {
+                    // Charge the budget only when the override is what put this hello on the wire: a
+                    // strap that is neither suppressed nor deferring would have sent it anyway, and
+                    // counting those would retire the experiment without ever having run it.
+                    if (helloOverride && !userAsked && (suppressed || explicitBondRequestedThisLink)) {
+                        helloOverrideAttempts++
+                    }
                     if (suppressed && helloOverride && !userAsked) {
                         // Say WHY a suppressed strap is getting a hello anyway, or the next reader sees the
                         // latch set and a hello on the wire and has to guess which of them is broken.
@@ -8702,13 +8725,20 @@ class WhoopBleClient(
                 status = status,
                 alreadyPausedForBondLoop = autoReconnectPausedForBondLoop,
                 // The question is whether the hello was ACTUALLY withheld on this link, not whether the
-                // latch is set. With the #1635 override on, the latch stays set while we send the hello
-                // anyway — and reading the raw pref here would disable the give-up for exactly the case
-                // that needs it, leaving an unbounded hello-drop-reconnect loop with nothing to stop it.
-                // Mirrors the `suppressed && !override` decision that chose to send.
+                // latch is set. With the #1635 override in force the latch stays set while we send the
+                // hello anyway, and treating that as withheld would disable the give-up for exactly the
+                // case that needs it, leaving an unbounded hello-drop-reconnect loop with nothing to stop
+                // it. But a SPENT override withholds the hello for real, so this must ask
+                // [helloOverrideActive] rather than the raw pref — mirroring the `helloOverride` that
+                // decided whether to send. Reading the pref alone kept the detector counting after the
+                // hellos had stopped, and would have paused auto-reconnect and raised the stale-pairing
+                // guide over a cause that never happened.
                 helloSuppressed = runCatching {
                     com.noop.ui.NoopPrefs.helloSuppressed(context, lastDeviceAddress) &&
-                        !PuffinExperiment.from(context).helloDespiteBondRefusal
+                        !helloOverrideActive(
+                            PuffinExperiment.from(context).helloDespiteBondRefusal,
+                            helloOverrideAttempts,
+                        )
                 }.getOrDefault(false),
             ) && bondWatchdogBackoff.recordBounce()
         ) {
@@ -9025,6 +9055,18 @@ class WhoopBleClient(
     // across sessions with per-session ids (his fork truncated per session, losing overnight data);
     // rotates at the cap; fail-soft — capture can never break the sync it observes.
 
+    /** #1635: unanswered hellos the override CAUSED this process. Bounds the experiment on its own,
+     *  because the shared give-up cannot — see HELLO_OVERRIDE_MAX_ATTEMPTS. Reset on a genuine bond. */
+    @Volatile private var helloOverrideAttempts = 0
+
+    /** Last opt-in state the connect path saw, so an off->on flip can re-arm a spent budget (#1635). */
+    @Volatile private var helloOverrideOptInSeen = false
+
+    /** One-shot guard for the give-up line. Separate from the counter because `++` on a @Volatile Int is
+     *  not atomic: two overlapping connects could step past the cap together, and an `== cap` test would
+     *  then never fire, leaving the override inert with nothing in the log to say why. */
+    @Volatile private var helloOverrideExhaustedLogged = false
+
     @Volatile private var captureWriter: java.io.BufferedWriter? = null
     @Volatile private var captureDisabled = false
     @Volatile private var captureLines = 0
diff --git a/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt b/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
index b8212fa6f5..2393b340fd 100644
--- a/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
+++ b/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
@@ -125,4 +125,121 @@ class HelloSuppressionTest {
                        sent != effectivelySuppressed(latched, ov))
         }
     }
+
+    // #1635: the override must bound itself — the shared give-up cannot
+
+    /**
+     * The field failure this exists for. With the override on, the hello fails with ATT
+     * `Insufficient Authentication`, the local stack tears the ACL down, and the disconnect arrives as
+     * GATT_CONN_TERMINATE_LOCAL_HOST (22) — which `shouldCountNeverBondedSelfDrop` excludes, because that
+     * status normally means WE hung up. So nothing counted, nothing paused, and a real strap ran 57
+     * reconnect cycles in an hour. The cap does not consult the status at all.
+     */
+    @Test
+    fun `the override stops itself after the cap`() {
+        assertTrue(overrideHelloStillAllowed(0))
+        assertTrue(overrideHelloStillAllowed(HELLO_OVERRIDE_MAX_ATTEMPTS - 1))
+        assertFalse(overrideHelloStillAllowed(HELLO_OVERRIDE_MAX_ATTEMPTS))
+        assertFalse(overrideHelloStillAllowed(57))   // the observed field value
+    }
+
+    @Test
+    fun `the cap is small enough to bound the loop and large enough to be a fair test`() {
+        // ~4.8s per cycle, so the whole experiment costs well under a minute of churn.
+        assertTrue("a cap of 1 would not survive a single flaky link", HELLO_OVERRIDE_MAX_ATTEMPTS >= 3)
+        assertTrue("more than ~10 is a loop, not an experiment", HELLO_OVERRIDE_MAX_ATTEMPTS <= 10)
+    }
+
+    /** The give-up line must name the cause and the remedy, not merely announce that it stopped. */
+    @Test
+    fun `the exhausted line says why and what to do`() {
+        val line = helloOverrideExhaustedLine(HELLO_OVERRIDE_MAX_ATTEMPTS)
+        assertTrue(line.contains("unanswered hellos"))
+        assertTrue(line.contains("Insufficient Authentication"))
+        assertTrue(line.contains("refuses SMP pairing"))
+        assertTrue("must tell the user how to get back to a working strap",
+                   line.contains("Turn the switch off"))
+    }
+
+    /**
+     * The budget must only be charged for hellos the override CAUSED.
+     *
+     * `shouldSendClientHello` also returns true for a strap that is neither suppressed nor deferring a
+     * bond — that hello goes out regardless of the switch. Charging those would retire the experiment
+     * after six ordinary connects without it ever having done anything, and then report "6 unanswered
+     * hellos" about writes it never caused.
+     */
+    @Test
+    fun `the budget is charged only when the override is load-bearing`() {
+        fun charges(suppressed: Boolean, bondDeferred: Boolean, override: Boolean, userAsked: Boolean) =
+            shouldSendClientHello(suppressed, userAsked, override) &&
+                override && !userAsked && (suppressed || bondDeferred)
+
+        // Load-bearing: the hello would NOT have gone out without the override.
+        assertTrue(charges(suppressed = true, bondDeferred = false, override = true, userAsked = false))
+        assertTrue(charges(suppressed = false, bondDeferred = true, override = true, userAsked = false))
+        // Not load-bearing: nothing was standing in the hello's way.
+        assertFalse(charges(suppressed = false, bondDeferred = false, override = true, userAsked = false))
+        // A user-initiated Connect already overrides the latch on its own.
+        assertFalse(charges(suppressed = true, bondDeferred = false, override = true, userAsked = true))
+        // Switch off: never charged.
+        assertFalse(charges(suppressed = true, bondDeferred = true, override = false, userAsked = false))
+    }
+
+    /**
+     * The give-up line must still fire if the counter steps PAST the cap. `++` on a @Volatile Int is not
+     * atomic, so two overlapping connects can skip the exact boundary; an `== cap` guard would then leave
+     * the override inert with nothing in the log to explain it.
+     */
+    @Test
+    fun `the give-up condition holds past the cap, not only at it`() {
+        assertFalse(overrideHelloStillAllowed(HELLO_OVERRIDE_MAX_ATTEMPTS))
+        assertFalse(overrideHelloStillAllowed(HELLO_OVERRIDE_MAX_ATTEMPTS + 1))
+        assertFalse(overrideHelloStillAllowed(HELLO_OVERRIDE_MAX_ATTEMPTS + 7))
+        // And the line reports whatever count it actually reached, not a hardcoded cap.
+        assertTrue(helloOverrideExhaustedLine(9).contains("9 unanswered hellos"))
+    }
+
+    /**
+     * A spent override is not "on". Every reader must agree on that, because they act in opposite
+     * directions: the connect path stops writing hellos, and the never-bonded detector must go back to
+     * counting self-drops. Reading the raw pref made the detector believe hellos were still on the wire
+     * after they had stopped.
+     */
+    @Test
+    fun `the override is only in force while opted in AND under the cap`() {
+        assertTrue(helloOverrideActive(optedIn = true, attemptsSoFar = 0))
+        assertTrue(helloOverrideActive(optedIn = true, attemptsSoFar = HELLO_OVERRIDE_MAX_ATTEMPTS - 1))
+        assertFalse(helloOverrideActive(optedIn = true, attemptsSoFar = HELLO_OVERRIDE_MAX_ATTEMPTS))
+        assertFalse(helloOverrideActive(optedIn = true, attemptsSoFar = HELLO_OVERRIDE_MAX_ATTEMPTS + 3))
+        assertFalse(helloOverrideActive(optedIn = false, attemptsSoFar = 0))
+    }
+
+    /**
+     * The never-bonded detector's input, spelled out end to end: `latch && !active`. A spent override
+     * must report the hello as withheld, or the detector keeps counting drops the hello no longer causes
+     * and eventually pauses auto-reconnect over a cause that never happened.
+     */
+    @Test
+    fun `a spent override reports the hello as withheld again`() {
+        fun withheld(latched: Boolean, optedIn: Boolean, attempts: Int) =
+            latched && !helloOverrideActive(optedIn, attempts)
+
+        assertTrue(withheld(latched = true, optedIn = false, attempts = 0))
+        // In force: the hello IS on the wire, so the detector must stay armed.
+        assertFalse(withheld(latched = true, optedIn = true, attempts = 0))
+        // Spent: the hello has genuinely stopped, so we are back to the suppressed live-HR state.
+        assertTrue(withheld(latched = true, optedIn = true, attempts = HELLO_OVERRIDE_MAX_ATTEMPTS))
+        // No latch, nothing withheld, whatever the switch says.
+        assertFalse(withheld(latched = false, optedIn = true, attempts = HELLO_OVERRIDE_MAX_ATTEMPTS))
+    }
+
+    /** Only the off->on edge re-arms, so a spent override does not silently resurrect on every connect. */
+    @Test
+    fun `flipping the switch back on re-arms the budget, staying on does not`() {
+        assertTrue(helloOverrideBudgetRearms(optedInNow = true, optedInLastSeen = false))
+        assertFalse(helloOverrideBudgetRearms(optedInNow = true, optedInLastSeen = true))
+        assertFalse(helloOverrideBudgetRearms(optedInNow = false, optedInLastSeen = true))
+        assertFalse(helloOverrideBudgetRearms(optedInNow = false, optedInLastSeen = false))
+    }
 }

From 240c48ae520d9b47a3253ace4845d7ad8259a358 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 14:15:16 +1200
Subject: [PATCH 008/333] ui: show skin temperature in the reader's unit on the
 alert banner and the fusion row (#1671)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two surfaces printed a hardcoded "°C" and ignored the temperature preference
entirely.

The illness-signal label welded the unit into the translated string itself
("Skin temperature +%@ °C", in all ten locales), so a Fahrenheit reader was told
"+0.7 °C" by the health banner while every other surface rendered that same
night as "+1.3 Δ°F". The fused-record row formatted with String(format:
"%.1f°C"), which no preference could reach. Both now resolve the unit the way
every screen does - UnitPrefs.resolveTemperature, explicit override when set,
else derived from the unit system.

Routing through SkinTempDisplay rather than UnitFormatter is the part that
matters. skin_temp / skinTempDevC is BIMODAL (#111, #622): a CSV or Apple Health
night carries an ABSOLUTE wrist °C, a live BLE night a signed DEVIATION from
baseline, and they share one column. Only the absolute reading takes the +32
offset. Converting a deviation with the absolute formula is the regression those
issues are named for - it once rendered a -4.2 deviation as "24.4 °F" - and the
first cut of this change reintroduced exactly that, surviving until the
deviation half got a test of its own. The fusion screen is the one place both
modes can appear side by side, so the mode is taken from the value, never
assumed. MetricCatalog already did it this way; this now matches that precedent.

The phrase lives in UnitFormatter.skinTempSignalPhrase rather than inline, so
the bimodal branch is reachable from StrandTests - it previously sat in a
private AppModel method where nothing could test it. The number is formatted
there rather than by SkinTempDisplay.format because those decimals go through
AppLanguage.activeLocale: a German reader must see "0,7", which the package's
plain String(format:) flattens to "0.7". Only the kind, the chip and the 9/5
rule come from shared code, so the conversion keeps one home -
UnitFormatter.celsiusDeltaToFahrenheit is added for that and is what
temperatureDeltaFromCelsius now calls.

Verification: every expected string generated by compiling SkinTempDisplay
standalone with swiftc and pasted verbatim, per the oracle rule - not derived by
eye. 12 tests: both bimodal modes, the 20 °C boundary either side,
delta-vs-absolute divergence at zero, a sweep pinning the Double and String
converters together, the German and French decimal separators, and that the
threaded unit cannot alter bpm/ms/steps. doc_comment_lint clean; i18n audit 0
gaps in the gated locales with all 10 translations kept. app-build dispatched on
this head - both the macOS Strand leg (which runs StrandTests) and the iOS leg,
since FusedRecordView is shared.

Apple-only: the Android twin (V5HealthSignals) renders "skin temp up" with no
number or unit, so there is nothing to convert there.
---
 Strand/App/AppModel.swift                | 28 ++++++++++++-
 Strand/Data/Units.swift                  | 33 +++++++++++++++-
 Strand/Resources/Localizable.xcstrings   |  4 +-
 Strand/Screens/FusedRecordView.swift     | 44 ++++++++++++++++-----
 StrandTests/FusionFormatUnitsTests.swift | 43 ++++++++++++++++++++
 StrandTests/UnitFormatterTests.swift     | 50 ++++++++++++++++++++++++
 6 files changed, 187 insertions(+), 15 deletions(-)
 create mode 100644 StrandTests/FusionFormatUnitsTests.swift

diff --git a/Strand/App/AppModel.swift b/Strand/App/AppModel.swift
index 4de5e170f9..8c7f100b0d 100644
--- a/Strand/App/AppModel.swift
+++ b/Strand/App/AppModel.swift
@@ -1671,6 +1671,17 @@ final class AppModel: ObservableObject {
         }
     }
 
+    /// The reader's temperature unit, resolved the way every screen resolves it. AppModel is not a View,
+    /// so there is no @AppStorage — but the resolution must stay identical (explicit override when set,
+    /// else derived from the unit system), or the alert banner and the Skin Temp card disagree about
+    /// what unit the same number is in.
+    private var displayTemperatureUnit: TemperatureUnit {
+        let d = UserDefaults.standard
+        let system = UnitSystem(rawValue: d.string(forKey: UnitPrefs.systemKey) ?? "") ?? .metric
+        return UnitPrefs.resolveTemperature(system: system,
+                                            override: d.string(forKey: UnitPrefs.temperatureKey) ?? "")
+    }
+
     /// Run the `IllnessSignalEngine` from the day history + the journal-derived confounder context, then
     /// publish the result + the semantic `healthAlert` banner payload.
     private func applyIllnessSignal(_ days: [DailyMetric], alcohol: Bool,
@@ -1741,8 +1752,21 @@ final class AppModel: ObservableObject {
             labels["hrv"] = String(localized: "HRV −\(percent)%")
         }
         if let r = rm({ $0.skinTempDevC }), r > 0 {
-            let temperature = String(format: "%.1f", locale: AppLanguage.activeLocale, r)
-            labels["skinTemp"] = String(localized: "Skin temperature +\(temperature) °C")
+            // The value is STORED in °C but must be SHOWN in the reader's unit: this label welded "°C"
+            // into the translated string, so a Fahrenheit user got "+0.7 °C" from the banner while every
+            // other surface rendered the same night as "+1.3 Δ°F".
+            //
+            // #111/#622: skinTempDevC is BIMODAL — an imported night is an ABSOLUTE wrist °C, a live one
+            // a signed DEVIATION — so neither the conversion nor the unit chip may be assumed. Kind and
+            // chip come from SkinTempDisplay, the same authority the Today and Health tiles use. The
+            // NUMBER is formatted here rather than by SkinTempDisplay because these decimals go through
+            // AppLanguage.activeLocale: a German reader sees "0,7", which the package's plain
+            // String(format:) would flatten to "0.7".
+            let temperature = UnitFormatter.skinTempSignalPhrase(
+                r,
+                fahrenheit: displayTemperatureUnit == .fahrenheit,
+                locale: AppLanguage.activeLocale)
+            labels["skinTemp"] = String(localized: "Skin temperature \(temperature)")
         }
         if let r = rm({ $0.respRateBpm }), let b = mean(base.compactMap { $0.respRateBpm }), r > b {
             labels["respiration"] = String(localized: "Respiration up")
diff --git a/Strand/Data/Units.swift b/Strand/Data/Units.swift
index b5dd1d90ac..a6ff53544e 100644
--- a/Strand/Data/Units.swift
+++ b/Strand/Data/Units.swift
@@ -1,4 +1,5 @@
 import Foundation
+import StrandAnalytics
 
 // MARK: - Unit system preference
 //
@@ -252,13 +253,43 @@ enum UnitFormatter {
         }
     }
 
+    /// °C delta → °F delta: a DIFFERENCE scales by 9/5 with NO +32 offset (the offset cancels between
+    /// the two absolute temperatures a delta is made of). Exposed as a Double because callers that need
+    /// locale-aware decimals — the illness-signal label formats through `AppLanguage.activeLocale` so a
+    /// German reader sees "0,7" — have to do their own formatting and would otherwise inline the 9/5,
+    /// scattering the one rule that must not drift.
+    static func celsiusDeltaToFahrenheit(_ dc: Double) -> Double { dc * 9.0 / 5.0 }
+
     /// Format a temperature DEVIATION (a ±Δ°C, e.g. the skin-temp deviation pipeline). A delta scales by
     /// 9/5 but does NOT add the +32 offset — that would be wrong for a difference.
     static func temperatureDeltaFromCelsius(_ dc: Double, unit: TemperatureUnit, decimals: Int = 1) -> String {
         switch unit {
         case .celsius:    return decimalString(dc, decimals) + " °C"
-        case .fahrenheit: return decimalString(dc * 9.0 / 5.0, decimals) + " °F"
+        case .fahrenheit: return decimalString(celsiusDeltaToFahrenheit(dc), decimals) + " °F"
+        }
+    }
+
+    /// The skin-temperature phrase used by the illness-signal label — number AND unit chip, ready to
+    /// interpolate into one `%@`.
+    ///
+    /// #111/#622: the field is BIMODAL. An imported night carries an ABSOLUTE wrist °C, a live one a
+    /// signed DEVIATION from baseline, and they share a column — so the +32 offset belongs to only one
+    /// of them, and the chip is "°F" for one and "Δ°F" for the other. Both come from `SkinTempDisplay`,
+    /// the same authority the Today and Health tiles use.
+    ///
+    /// The NUMBER is formatted here rather than by `SkinTempDisplay.format` purely so it can honour
+    /// [locale]: the banner formats through `AppLanguage.activeLocale`, and a German reader must see
+    /// "0,7" where the package's plain `String(format:)` would give "0.7". Pass nil for POSIX decimals.
+    static func skinTempSignalPhrase(_ value: Double, fahrenheit: Bool, locale: Locale?) -> String {
+        let kind = SkinTempDisplay.kind(of: value)
+        let shown: Double
+        if fahrenheit {
+            shown = kind == .absolute ? celsiusToFahrenheit(value) : celsiusDeltaToFahrenheit(value)
+        } else {
+            shown = value
         }
+        let number = String(format: kind == .absolute ? "%.1f" : "%+.1f", locale: locale, shown)
+        return number + " " + SkinTempDisplay.unitSymbol(kind: kind, fahrenheit: fahrenheit)
     }
 
     /// Temperature unit label only. "°C" / "°F".
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index ac5eaae10c..13bd1f227c 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -7,8 +7,8 @@
     "HRV −%lld%%": { "localizations": {
       "de": { "stringUnit": { "state": "translated", "value": "HRV −%lld%%" } }, "en": { "stringUnit": { "state": "translated", "value": "HRV −%lld%%" } }, "es": { "stringUnit": { "state": "translated", "value": "VFC −%lld%%" } }, "fr": { "stringUnit": { "state": "translated", "value": "VFC −%lld%%" } }, "it": { "stringUnit": { "state": "translated", "value": "HRV −%lld%%" } }, "pl": { "stringUnit": { "state": "translated", "value": "HRV −%lld%%" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "VFC −%lld%%" } }, "ru": { "stringUnit": { "state": "translated", "value": "ВСР −%lld%%" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "HRV −%lld%%" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "HRV −%lld%%" } }
     } },
-    "Skin temperature +%@ °C": { "localizations": {
-      "de": { "stringUnit": { "state": "translated", "value": "Hauttemperatur +%@ °C" } }, "en": { "stringUnit": { "state": "translated", "value": "Skin temperature +%@ °C" } }, "es": { "stringUnit": { "state": "translated", "value": "Temperatura de la piel +%@ °C" } }, "fr": { "stringUnit": { "state": "translated", "value": "Température cutanée +%@ °C" } }, "it": { "stringUnit": { "state": "translated", "value": "Temperatura cutanea +%@ °C" } }, "pl": { "stringUnit": { "state": "translated", "value": "Temperatura skóry +%@ °C" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Temperatura da pele +%@ °C" } }, "ru": { "stringUnit": { "state": "translated", "value": "Температура кожи +%@ °C" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "皮肤温度 +%@ °C" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "皮膚溫度 +%@ °C" } }
+    "Skin temperature %@": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Hauttemperatur %@" } }, "en": { "stringUnit": { "state": "translated", "value": "Skin temperature %@" } }, "es": { "stringUnit": { "state": "translated", "value": "Temperatura de la piel %@" } }, "fr": { "stringUnit": { "state": "translated", "value": "Température cutanée %@" } }, "it": { "stringUnit": { "state": "translated", "value": "Temperatura cutanea %@" } }, "pl": { "stringUnit": { "state": "translated", "value": "Temperatura skóry %@" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Temperatura da pele %@" } }, "ru": { "stringUnit": { "state": "translated", "value": "Температура кожи %@" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "皮肤温度 %@" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "皮膚溫度 %@" } }
     } },
     "Respiration up": { "localizations": {
       "de": { "stringUnit": { "state": "translated", "value": "Atemfrequenz erhöht" } }, "en": { "stringUnit": { "state": "translated", "value": "Respiration up" } }, "es": { "stringUnit": { "state": "translated", "value": "Respiración elevada" } }, "fr": { "stringUnit": { "state": "translated", "value": "Respiration élevée" } }, "it": { "stringUnit": { "state": "translated", "value": "Respirazione elevata" } }, "pl": { "stringUnit": { "state": "translated", "value": "Oddech podwyższony" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Respiração elevada" } }, "ru": { "stringUnit": { "state": "translated", "value": "Частота дыхания повышена" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "呼吸频率升高" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "呼吸頻率升高" } }
diff --git a/Strand/Screens/FusedRecordView.swift b/Strand/Screens/FusedRecordView.swift
index 1266ddcb07..487ea354ed 100644
--- a/Strand/Screens/FusedRecordView.swift
+++ b/Strand/Screens/FusedRecordView.swift
@@ -202,6 +202,15 @@ private struct FusedMetricRowView: View {
     let showProvenance: Bool
     let onCompare: () -> Void
 
+    // Each screen resolves °C/°F for itself (TodayView, FullDayChartView, MetricExplorerView do the
+    // same); the fused row used to print a hardcoded "°C" and was the last reader here ignoring it.
+    @AppStorage(UnitPrefs.systemKey) private var unitSystemRaw = UnitSystem.metric.rawValue
+    @AppStorage(UnitPrefs.temperatureKey) private var temperatureRaw = ""
+    private var temperatureUnit: TemperatureUnit {
+        UnitPrefs.resolveTemperature(system: UnitSystem(rawValue: unitSystemRaw) ?? .metric,
+                                     override: temperatureRaw)
+    }
+
     private var point: FusedMetricPoint { row.point }
 
     private var accent: Color {
@@ -217,7 +226,7 @@ private struct FusedMetricRowView: View {
                     .font(StrandFont.headline)
                     .foregroundStyle(StrandPalette.textPrimary)
                 Spacer(minLength: 8)
-                Text(FusionFormat.value(point.value, metricKey: point.metric))
+                Text(FusionFormat.value(point.value, metricKey: point.metric, temperature: temperatureUnit))
                     .font(StrandFont.number(20))
                     .foregroundStyle(accent)
                     .lineLimit(1)
@@ -268,7 +277,7 @@ private struct FusedMetricRowView: View {
 
         case .agree:
             if let other = point.contributors.dropFirst().first {
-                Text("\(other.source.displayName) agrees: \(FusionFormat.value(other.value, metricKey: point.metric))")
+                Text("\(other.source.displayName) agrees: \(FusionFormat.value(other.value, metricKey: point.metric, temperature: temperatureUnit))")
                     .font(StrandFont.footnote)
                     .foregroundStyle(StrandPalette.textTertiary)
             }
@@ -277,7 +286,7 @@ private struct FusedMetricRowView: View {
             if let other = point.contributors.dropFirst().first {
                 HStack(spacing: 6) {
                     StatePill("Differs slightly", tone: .neutral, showsDot: false)
-                    Text("\(other.source.displayName): \(FusionFormat.value(other.value, metricKey: point.metric))")
+                    Text("\(other.source.displayName): \(FusionFormat.value(other.value, metricKey: point.metric, temperature: temperatureUnit))")
                         .font(StrandFont.footnote)
                         .foregroundStyle(StrandPalette.textSecondary)
                     Spacer(minLength: 0)
@@ -306,7 +315,7 @@ private struct FusedMetricRowView: View {
     /// "Apple Health says 6h 40m. Tap to compare" style line for a conflict.
     private var conflictSummary: String {
         guard let other = point.contributors.dropFirst().first else { return String(localized: "Tap to compare") }
-        return String(localized: "\(other.source.displayName) says \(FusionFormat.value(other.value, metricKey: point.metric)). Tap to compare")
+        return String(localized: "\(other.source.displayName) says \(FusionFormat.value(other.value, metricKey: point.metric, temperature: temperatureUnit)). Tap to compare")
     }
 }
 
@@ -369,6 +378,15 @@ private struct ContributorRow: View {
     let metricKey: String
     let isWinner: Bool
 
+    // Each screen resolves °C/°F for itself (TodayView, FullDayChartView, MetricExplorerView do the
+    // same); the fused row used to print a hardcoded "°C" and was the last reader here ignoring it.
+    @AppStorage(UnitPrefs.systemKey) private var unitSystemRaw = UnitSystem.metric.rawValue
+    @AppStorage(UnitPrefs.temperatureKey) private var temperatureRaw = ""
+    private var temperatureUnit: TemperatureUnit {
+        UnitPrefs.resolveTemperature(system: UnitSystem(rawValue: unitSystemRaw) ?? .metric,
+                                     override: temperatureRaw)
+    }
+
     var body: some View {
         HStack(alignment: .center, spacing: 12) {
             VStack(alignment: .leading, spacing: 4) {
@@ -384,7 +402,7 @@ private struct ContributorRow: View {
                     .foregroundStyle(StrandPalette.textTertiary)
             }
             Spacer(minLength: 8)
-            Text(FusionFormat.value(contrib.value, metricKey: metricKey))
+            Text(FusionFormat.value(contrib.value, metricKey: metricKey, temperature: temperatureUnit))
                 .font(StrandFont.number(18))
                 .foregroundStyle(isWinner ? StrandPalette.textPrimary : StrandPalette.textSecondary)
                 .lineLimit(1)
@@ -394,8 +412,8 @@ private struct ContributorRow: View {
         .accessibilityElement(children: .combine)
         // Whole-string key per variant (never a concatenated localized tail on an a11y label).
         .accessibilityLabel(isWinner
-            ? "\(contrib.source.displayName), \(FusionFormat.value(contrib.value, metricKey: metricKey)), in use"
-            : "\(contrib.source.displayName), \(FusionFormat.value(contrib.value, metricKey: metricKey))")
+            ? "\(contrib.source.displayName), \(FusionFormat.value(contrib.value, metricKey: metricKey, temperature: temperatureUnit)), in use"
+            : "\(contrib.source.displayName), \(FusionFormat.value(contrib.value, metricKey: metricKey, temperature: temperatureUnit))")
     }
 }
 
@@ -403,9 +421,10 @@ private struct ContributorRow: View {
 
 /// Formats a fused metric's `Double` value for display by its resolver key. Pure + local to this
 /// screen: the engine deals in numbers, the UI owns units. Sleep/duration keys read as "7h 12m";
-/// temp as "34.1°C"; HR/HRV/steps as plain integers with the right unit.
+/// temp as "34.1 °C" / "93.4 °F" per the reader's preference; HR/HRV/steps as plain
+/// integers with the right unit.
 enum FusionFormat {
-    static func value(_ v: Double, metricKey: String) -> String {
+    static func value(_ v: Double, metricKey: String, temperature: TemperatureUnit) -> String {
         switch MetricArbitrationPolicy.kind(forKey: metricKey) {
         case .restingHR, .heartRate:
             return "\(Int(v.rounded())) bpm"
@@ -414,7 +433,12 @@ enum FusionFormat {
         case .spo2:
             return "\(Int(v.rounded()))%"
         case .skinTemp:
-            return String(format: "%.1f°C", v)
+            // #111/#622: this column is BIMODAL — CSV/Health imports carry an ABSOLUTE wrist °C (~30-35),
+            // the live BLE pipeline a signed DEVIATION from baseline. Fusion is the one screen that can
+            // show both at once, side by side, so the conversion cannot be assumed: +32 belongs only to
+            // the absolute reading, and applying it to a −4.2 deviation is what once printed "24.4 °F".
+            // SkinTempDisplay picks the conversion AND the chip ("°F" vs "Δ°F") from the value itself.
+            return SkinTempDisplay.format(v, fahrenheit: temperature == .fahrenheit)
         case .steps:
             return integerGrouped(v)
         case .sleep:
diff --git a/StrandTests/FusionFormatUnitsTests.swift b/StrandTests/FusionFormatUnitsTests.swift
new file mode 100644
index 0000000000..2580db990c
--- /dev/null
+++ b/StrandTests/FusionFormatUnitsTests.swift
@@ -0,0 +1,43 @@
+import XCTest
+import StrandAnalytics
+@testable import Strand
+
+/// The fused-record row renders a skin temperature that is STORED in °C. It printed a hardcoded "°C"
+/// regardless of the reader's preference, so a Fahrenheit user saw a Celsius number on the fusion screen
+/// while every other surface converted it.
+final class FusionFormatUnitsTests: XCTestCase {
+
+    /// An ABSOLUTE wrist reading (CSV / Apple Health) converts with the +32 offset.
+    func testAbsoluteSkinTempFollowsTheReadersUnit() {
+        XCTAssertEqual(FusionFormat.value(34.1, metricKey: "skin_temp", temperature: .celsius), "34.1 °C")
+        // 34.1 °C = 93.38 °F
+        XCTAssertEqual(FusionFormat.value(34.1, metricKey: "skin_temp", temperature: .fahrenheit), "93.4 °F")
+    }
+
+    /// A DEVIATION (the live BLE pipeline) scales by 9/5 with NO offset and is chipped "Δ". This is the
+    /// half a naive `temperatureFromCelsius` call gets wrong: it would render +0.7 as "33.3 °F".
+    func testDeviationSkinTempKeepsItsDeltaChipAndSkipsTheOffset() {
+        XCTAssertEqual(FusionFormat.value(0.7, metricKey: "skin_temp", temperature: .celsius), "+0.7 Δ°C")
+        // 0.7 × 9/5 = 1.26 — NOT 33.3
+        XCTAssertEqual(FusionFormat.value(0.7, metricKey: "skin_temp", temperature: .fahrenheit), "+1.3 Δ°F")
+        // The regression #111/#622 names by number: the absolute formula turned this into "24.4 °F".
+        XCTAssertEqual(FusionFormat.value(-4.2, metricKey: "skin_temp", temperature: .fahrenheit), "-7.6 Δ°F")
+    }
+
+    /// Fusion is the screen that can show both modes side by side, so the split must come from the value
+    /// and land either side of VitalBands' 20 °C boundary.
+    func testTheModeIsDecidedByTheValueNotTheCaller() {
+        XCTAssertTrue(FusionFormat.value(19.9, metricKey: "skin_temp", temperature: .celsius).contains("Δ"))
+        XCTAssertFalse(FusionFormat.value(20.0, metricKey: "skin_temp", temperature: .celsius).contains("Δ"))
+    }
+
+    /// The unit must reach ONLY the temperature branch: every other metric formats identically either
+    /// way, so a threaded parameter cannot quietly change bpm/ms/steps.
+    func testNonTemperatureMetricsAreUnaffectedByTheUnit() {
+        for key in ["resting_hr", "avg_hr", "hrv", "steps", "spo2", "active_kcal", "asleep_min"] {
+            XCTAssertEqual(FusionFormat.value(62, metricKey: key, temperature: .celsius),
+                           FusionFormat.value(62, metricKey: key, temperature: .fahrenheit),
+                           "\(key) changed with the temperature unit")
+        }
+    }
+}
diff --git a/StrandTests/UnitFormatterTests.swift b/StrandTests/UnitFormatterTests.swift
index 0fce9073aa..14dbde8db2 100644
--- a/StrandTests/UnitFormatterTests.swift
+++ b/StrandTests/UnitFormatterTests.swift
@@ -118,6 +118,56 @@ final class UnitFormatterTests: XCTestCase {
         XCTAssertEqual(UnitFormatter.temperatureDeltaFromCelsius(0.6, unit: .celsius), "0.6 °C")
     }
 
+    /// The Double-returning delta converter and the String one must not drift: callers that need
+    /// locale-aware decimals (the illness-signal label formats through AppLanguage.activeLocale) use the
+    /// Double form, and a second copy of the 9/5 rule is exactly what that split invites.
+    func testDeltaConverterAgreesWithTheFormatter() {
+        XCTAssertEqual(UnitFormatter.celsiusDeltaToFahrenheit(0.6), 1.08, accuracy: 1e-9)
+        XCTAssertEqual(UnitFormatter.celsiusDeltaToFahrenheit(-4.2), -7.56, accuracy: 1e-9)
+        XCTAssertEqual(UnitFormatter.celsiusDeltaToFahrenheit(0), 0, accuracy: 1e-9)
+        for c in stride(from: -5.0, through: 5.0, by: 0.25) {
+            XCTAssertEqual(
+                String(format: "%.1f", UnitFormatter.celsiusDeltaToFahrenheit(c)) + " °F",
+                UnitFormatter.temperatureDeltaFromCelsius(c, unit: .fahrenheit),
+                "diverged at \(c) °C")
+        }
+    }
+
+    /// A delta must never pick up the +32: at 0 the two conversions differ by exactly the offset, which
+    /// is what made a −4.2 °C deviation read as a fever once before (#111/#622).
+    func testDeltaAndAbsoluteConversionsAreDistinct() {
+        XCTAssertEqual(UnitFormatter.celsiusToFahrenheit(0), 32.0, accuracy: 1e-9)
+        XCTAssertEqual(UnitFormatter.celsiusDeltaToFahrenheit(0), 0.0, accuracy: 1e-9)
+    }
+
+    /// The illness-signal phrase. Expected strings generated by compiling SkinTempDisplay standalone
+    /// with swiftc and pasted verbatim — the oracle rule, not arithmetic done by eye.
+    func testSkinTempSignalPhraseHandlesBothModes() {
+        // Deviation (live BLE): signed, "Δ" chip, ×9/5 with NO offset.
+        XCTAssertEqual(UnitFormatter.skinTempSignalPhrase(0.7, fahrenheit: false, locale: nil), "+0.7 Δ°C")
+        XCTAssertEqual(UnitFormatter.skinTempSignalPhrase(0.7, fahrenheit: true, locale: nil), "+1.3 Δ°F")
+        // Absolute (CSV / Apple Health): unsigned, bare chip, +32 offset applied.
+        XCTAssertEqual(UnitFormatter.skinTempSignalPhrase(34.1, fahrenheit: false, locale: nil), "34.1 °C")
+        XCTAssertEqual(UnitFormatter.skinTempSignalPhrase(34.1, fahrenheit: true, locale: nil), "93.4 °F")
+    }
+
+    /// The 20 °C boundary decides the mode, and it belongs to the ABSOLUTE side.
+    func testSkinTempSignalPhraseSplitsAtTwentyDegrees() {
+        XCTAssertEqual(UnitFormatter.skinTempSignalPhrase(19.9, fahrenheit: false, locale: nil), "+19.9 Δ°C")
+        XCTAssertEqual(UnitFormatter.skinTempSignalPhrase(20.0, fahrenheit: false, locale: nil), "20.0 °C")
+    }
+
+    /// The whole reason the number is formatted here instead of by SkinTempDisplay: the banner passes
+    /// AppLanguage.activeLocale, and a German reader must see "0,7" rather than "0.7".
+    func testSkinTempSignalPhraseHonoursTheLocalesDecimalSeparator() {
+        let de = Locale(identifier: "de_DE")
+        XCTAssertEqual(UnitFormatter.skinTempSignalPhrase(0.7, fahrenheit: false, locale: de), "+0,7 Δ°C")
+        XCTAssertEqual(UnitFormatter.skinTempSignalPhrase(34.1, fahrenheit: false, locale: de), "34,1 °C")
+        XCTAssertEqual(
+            UnitFormatter.skinTempSignalPhrase(0.7, fahrenheit: true, locale: Locale(identifier: "fr_FR")),
+            "+1,3 Δ°F")
+    }
+
     // #111/#622: skin_temp holds EITHER a signed deviation (v < 20 °C) or an absolute reading (v >= 20 °C).
     // A DEVIATION converts ×9/5 with NO +32 (the absolute formula turned a −4.2 °C deviation into the
     // nonsense "24.4 °F") and is labelled as a signed baseline delta — "Δ°C" / "Δ°F", sign always shown —

From 6c79e36aa496031546340598d41ffb8083e31000 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 14:50:18 +1200
Subject: [PATCH 009/333] ble: port the 5/MG CLIENT_HELLO suppression to
 iOS/macOS (#1672)

Android has stopped the 5/MG reconnect loop since #1642. iOS never got it, so a
5/MG here still wrote the CLIENT_HELLO every connect, lost the link ~3s later and
reconnected forever - the behaviour v10.6.0 shipped on both platforms.

An HCI capture settled the cause: the phone sends an SMP Pairing Request and the
strap answers Pairing Not Supported (0x05), so the encrypted bond the hello waits
behind can never arrive on a 5/MG. Suppressing it after the give-up latches
trades an unreachable capability (puffin commands, history offload) for one that
demonstrably works - continuous live HR, the "Live HR, not fully paired" state
the app already models (#69).

Ported, mirroring the Kotlin twins: shouldSendClientHello, giveUpSuppressesHello,
countsAsBondRefusal and helloSuppressionPrefKey in a new pure
Strand/BLE/HelloSuppression.swift; helloSuppressedEpitaph, helloSuppressedHint
and pausedHintHandshakeUnanswered on BondRefusalGiveUp; and
recordWhoop5BondRefusal, shared by both causes so the split cannot drift.

#1640 had to come with it. An unanswered hello produces no write error at all -
the link just drops - so it never reached this platform's give-up, which only
ever saw INSUFFICIENT_AUTHENTICATION. Without that half the suppression could
never trigger.

didBond stays permanently false once suppressed, and CLAUDE.md names that the
trap. The audit: iOS has no bond watchdog and no #982 detector, so neither can
undo it; countsAsBondRefusal gates on family, so a 4.0 can never latch; an auth
refusal cannot be double-counted or mislabelled, because the write-error branch
clears clientHelloWriteAt before the count; and only user-driven paths reach
connect(), so the one-shot retry cannot leak into an automatic reconnect.

Three re-review passes found three defects, all of that same family:

  - keepAliveFire ALSO read didBond, so the timer - and with it the liveness
    watchdog - would have been switched off for exactly the link the suppression
    keeps up for hours, leaving a stalled stream with nothing to bounce it. The
    first correction was dead code: both existing startKeepAlive() sites are
    post-bond, so on a suppressed link the timer never started at all.
  - the latch outlived the strap. releaseStrap/forgetDevice reset the give-up
    under the invariant that no state outlives the strap it belonged to, but the
    latch is persisted and survived a removal. ANDROID HAD THIS TOO, since
    #1642; the Kotlin half is in this PR, per the parity contract.
  - the keep-alive started in the wrong place. Android starts it on the live-HR
    bonded transition, which also covers an unbonded 5/MG that has not latched
    yet; iOS would have had no watchdog during the give-up's first five cycles.

SettingsView carried a comment left for whoever did this port: its status line
falls through to "Finishing the secure pairing handshake" and would describe a
handshake no longer being attempted. It now carries the same "streaming but not
fully paired" arm as SettingsLogic.strapStatusLine, in all ten locales, placed
after the hint so the actionable text still wins.

NOT ported: the #1669 opt-in override, which is experimental, default-off, and
produced 57 reconnect cycles in an hour on hardware before #1670 bounded it.

KNOWN REMAINING GAP: Android reads the Device Information Service on an unbonded
link (#1647/#1652/#1653); iOS reads it post-bond only, so a suppressed iOS 5/MG
never learns its firmware or whether it is an MG, leaving MG-only capabilities
locked. Deliberately left as a follow-up - it is a separate feature that was
never ported here at all.

Verification: the three hint strings are proven byte-identical to the Kotlin
source by extracting and comparing both, not by eye. 17 tests over the pure
rules, incl. the family gate across every DeviceFamily case, the keep-alive gate
either side, and the latch's case-insensitivity; the pure file also compiled
standalone with swiftc and every rule exercised. Android 4552 tests green.
app-build green on Build Strand, Test Strand and Build NOOPiOS.

NOT HARDWARE-VALIDATED. BLE behaviour cannot be CI-tested and no 5/MG was
available on iOS. The falsifiable prediction is the one Android's change
carried: after the latch, the loop stops and live HR streams continuously. If a
link still drops on a cycle with no CLIENT_HELLO line, the port is wrong.
---
 Strand/BLE/BLEManager.swift                   | 164 +++++++++++++++--
 Strand/BLE/HelloSuppression.swift             | 126 +++++++++++++
 Strand/Resources/Localizable.xcstrings        |  64 +++++++
 Strand/Screens/SettingsView.swift             |  15 +-
 StrandTests/HelloSuppressionTests.swift       | 174 ++++++++++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  |   7 +
 6 files changed, 530 insertions(+), 20 deletions(-)
 create mode 100644 Strand/BLE/HelloSuppression.swift
 create mode 100644 StrandTests/HelloSuppressionTests.swift

diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index a9db87dbc5..2f0a3e22dc 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -191,6 +191,41 @@ struct BondRefusalGiveUp {
         "NOOP stopped retrying because your strap keeps refusing to pair. It is likely still held by the official WHOOP app, or your phone is holding an old pairing. Close the WHOOP app, put the strap in pairing mode (tap until the LEDs flash blue), and if it is listed in your Bluetooth settings choose Forget This Device. Then tap Connect to try again."
     }
 
+    /// #1635: the log epitaph for the SUPPRESSION path.
+    ///
+    /// Separate from [epitaphLine] because that one asserts a cause ("almost certainly held by the
+    /// official WHOOP app") that only an auth refusal supports. Reusing it here would print a confident
+    /// explanation for a write that simply vanished.
+    ///
+    /// Pure. Byte-identical to the Kotlin `BondRefusalGiveUp.helloSuppressedEpitaph`.
+    static func helloSuppressedEpitaph(refusals: Int, opaqueId: String) -> String {
+        "Bond epitaph: the strap [\(opaqueId)] never acknowledged the secure handshake \(refusals)x in a row, and the attempt is what drops the link - leaving the handshake off so live heart rate keeps streaming. Tap Connect to try it again."
+    }
+
+    /// #1635: the hint shown when the hello is switched off and the link is KEPT.
+    ///
+    /// Nothing is paused on this branch, so it must not say auto-reconnect stopped. It names what was lost
+    /// (history sync) and the one action that restores the attempt, without asserting a cause.
+    ///
+    /// Pure. Byte-identical to the Kotlin `BondRefusalGiveUp.helloSuppressedHint`.
+    static func helloSuppressedHint() -> String {
+        "The secure handshake with your strap never completes, and the attempt itself is what drops the link. NOOP has switched it off for this strap so live heart rate keeps streaming. History sync stays unavailable until it pairs. Tap Connect to try the handshake again."
+    }
+
+    /// The paused hint for a bond that failed WITHOUT the strap ever answering (#1635).
+    ///
+    /// [pausedHint] names a cause — the strap still held by the official WHOOP app, or a stale OS pairing —
+    /// which is well founded when the refusal arrived as INSUFFICIENT_AUTHENTICATION or
+    /// INSUFFICIENT_ENCRYPTION: the strap actively said no. It is NOT founded when the CLIENT_HELLO simply
+    /// goes unanswered and the link drops on a timer, which is a different observation with several
+    /// possible causes. Telling that user to close the WHOOP app would be a guess dressed as instruction,
+    /// and if it is wrong they have no way to know.
+    ///
+    /// Pure. Byte-identical to the Kotlin `BondRefusalGiveUp.pausedHintHandshakeUnanswered`.
+    static func pausedHintHandshakeUnanswered() -> String {
+        "NOOP stopped retrying because the secure handshake with your strap never completes: the strap does not answer, and the link drops a few seconds later. Auto-reconnect is paused so it stops draining both batteries. Tap Connect to try again, and if it keeps happening please share your strap log."
+    }
+
     /// #750: a short OPAQUE token from a CoreBluetooth-local peripheral UUID for the epitaph. The CB UUID is
     /// per-install (NOT the hardware MAC), and we keep only its first 8 hex chars, so the token is stable
     /// within a log but carries no device-identifying PII. Pure + deterministic. Twin of the Android helper.
@@ -915,6 +950,11 @@ public final class BLEManager: NSObject, ObservableObject {
     private var reassembler = Reassembler()
     private var seq: UInt8 = 0
     private var didBond = false
+    /// #1635: one explicit Connect grants one fresh CLIENT_HELLO even when the suppression latch is set.
+    /// Consumed unconditionally by the write site, so the retry belongs to THIS session — leaving it set
+    /// would hand a stale retry to some later automatic reconnect and restart the loop the suppression
+    /// exists to end. Kotlin twin: `WhoopBleClient.helloRetryRequested`.
+    private var helloRetryRequested = false
     /// WHOOP 5/MG only: realtime HR has been armed (puffin TOGGLE_REALTIME_HR sent) once for this
     /// connection, so the post-bond callback re-firing on later `.withResponse` writes doesn't re-send it.
     private var whoop5RealtimeArmed = false
@@ -1325,6 +1365,12 @@ public final class BLEManager: NSObject, ObservableObject {
             autoReconnectPausedForBondLoop = false
             bondLoopPausedAt = nil
         }
+        // #1635: the suppression path pauses NOTHING, so the reset above never fires for it. An explicit
+        // Connect is exactly the signal that the user has acted (pairing mode, closed the WHOOP app), so
+        // it must grant a fresh handshake regardless — that is also the only way to clear the latch short
+        // of a genuine bond. Deliberately NOT in connectCore: a system-initiated reconnect must not.
+        helloRetryRequested = true
+        bondGiveUp.reset()
         connectCore(model: model)
     }
 
@@ -1447,6 +1493,9 @@ public final class BLEManager: NSObject, ObservableObject {
     public func forgetDevice(_ peripheralId: String?) {
         let target = peripheralId.flatMap { UUID(uuidString: $0) }
         let isCurrent = target == nil || peripheral?.identifier == target
+        // Captured BEFORE the teardown below nils `peripheral`, since a nil argument means "the current
+        // strap" and that is the only place its identifier can still be read.
+        let releasedUUID = peripheralId ?? peripheral?.identifier.uuidString
         intentionalDisconnect = true            // defuses the disconnect→3s-reconnect loop's guard
         cancelScanFallback()
         readoptingTo = nil                       // abandon any in-flight #52 pin handoff
@@ -1467,6 +1516,12 @@ public final class BLEManager: NSObject, ObservableObject {
         }
         // #747/#750 invariant: releasing a strap fully resets the give-up + pause (like disconnect()) so
         // a paused state can never outlive the strap it belonged to and wedge a later re-add.
+        //
+        // #1635: the hello-suppression latch is exactly that kind of state, and it is PERSISTED - so
+        // without this it outlives the strap it belonged to, silently suppressing the handshake on a
+        // re-add and leaving a stale key behind for a strap the user removed. Re-latching costs the same
+        // five refusals it always did, so a strap that genuinely cannot bond is no worse off.
+        HelloSuppressionStore.setSuppressed(releasedUUID, false)
         bondGiveUp.reset()
         autoReconnectPausedForBondLoop = false
         bondLoopPausedAt = nil
@@ -3987,8 +4042,18 @@ public final class BLEManager: NSObject, ObservableObject {
     }
 
     private func keepAliveFire() {
-        guard state.connected, didBond else { return }
-        enableLiveNotifications(reason: "keepalive")
+        // #1635: a SUPPRESSED 5/MG never bonds, so a bare `didBond` gate switches this whole timer off for
+        // exactly the link that now stays up for hours - taking the liveness watchdog below with it and
+        // leaving a stalled stream with nothing to bounce it. That would quietly break the "stable live HR"
+        // the suppression exists to deliver. Android gates its twin on `bonded` (the live-HR shortcut, #69)
+        // and so reaches the same watchdog.
+        //
+        // Deliberately NARROWER than Android's gate: admitted only for a streaming 5/MG, and only as far as
+        // the watchdog. Everything past it needs the encrypted bond, so a second `didBond` guard closes the
+        // door again rather than letting an unbonded link issue puffin work that cannot land.
+        guard keepAliveMayRun(connected: state.connected, didBond: didBond,
+                              bonded: state.bonded, family: selectedModel.deviceFamily) else { return }
+        if didBond { enableLiveNotifications(reason: "keepalive") }
         // Liveness watchdog: if NOTHING has arrived for a while, the stream/link stalled.
         // Bounce the connection — the auto-rescan on disconnect re-bonds and resumes streaming.
         // #580 / #1414: the standard 0x2A37 HR profile keeps the link genuinely alive, but its packets can
@@ -4005,6 +4070,9 @@ public final class BLEManager: NSObject, ObservableObject {
             if let p = peripheral { central.cancelPeripheralConnection(p) }
             return
         }
+        // The watchdog above is the whole of the keep-alive an unbonded 5/MG can use. Everything below
+        // sends puffin-framed work that needs the encrypted bond.
+        guard didBond else { return }
         guard !backfilling else { return }            // never poke the strap mid-offload
         // #927: continuous capture can be overnight-only, which makes the want TIME-dependent; nothing
         // else re-evaluates it while the app just sits connected, so the keep-alive tick re-derives it.
@@ -4890,6 +4958,48 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
         return "code?"
     }
 
+    /// Feed one 5/MG bond refusal into the #747 give-up and act on the trip (#1635).
+    ///
+    /// Both causes arrive here, and they want OPPOSITE treatment — see `giveUpSuppressesHello`. An auth
+    /// refusal means the strap actively declined, so pausing auto-reconnect is right. An unanswered
+    /// handshake means the write vanished while the link streamed live HR the whole time, so pausing
+    /// would throw away a working strap to punish a handshake nobody is waiting on.
+    ///
+    /// Shared by both call sites so the split cannot drift: the auth path (a write error) and the
+    /// unanswered path (a disconnect with a hello still outstanding) reach the same decision.
+    private func recordWhoop5BondRefusal(authRefusal: Bool, peripheralUUID: String) {
+        guard bondGiveUp.recordRefusal() else { return }
+        let opaque = BondRefusalGiveUp.opaqueId(fromLocalUUID: peripheralUUID)
+        let suppress = giveUpSuppressesHello(authRefusal: authRefusal)
+        if suppress {
+            HelloSuppressionStore.setSuppressed(peripheralUUID, true)
+            log(BondRefusalGiveUp.helloSuppressedEpitaph(refusals: bondGiveUp.refusals, opaqueId: opaque))
+        } else {
+            autoReconnectPausedForBondLoop = true
+            bondLoopPausedAt = Date()   // starts the #78 hole-4 salvage-probe floor
+            // #1539: park the connect in the same breath as the pause, so this can end while backgrounded.
+            standingConnectWhilePausedIfDue(justTripped: true)
+            log(BondRefusalGiveUp.epitaphLine(refusals: bondGiveUp.refusals, opaqueId: opaque))
+        }
+        // Each branch gets the hint that matches what it actually DID. The paused hints say "auto-reconnect
+        // is paused"; on the suppression branch nothing is paused, so saying so would be the same
+        // confidently-wrong diagnostic this issue has produced twice already (#1635). The third arm is
+        // unreachable while `giveUpSuppressesHello` is `!authRefusal`, and is kept because the Kotlin twin
+        // keeps it: if that rule ever changes, both platforms must change behaviour together.
+        if suppress {
+            state.pairingHint = BondRefusalGiveUp.helloSuppressedHint()
+        } else if authRefusal {
+            state.pairingHint = BondRefusalGiveUp.pausedHint()
+        } else {
+            state.pairingHint = BondRefusalGiveUp.pausedHintHandshakeUnanswered()
+        }
+        if TestCentre.active(.connection) {
+            state.append(log: "bond gaveUp refusals=\(bondGiveUp.refusals) id=\(opaque) " +
+                (suppress ? "(hello suppressed, staying connected)" : "(auto-reconnect paused)"),
+                domain: .connection)
+        }
+    }
+
     public func centralManager(_ central: CBCentralManager,
                                didDisconnectPeripheral peripheral: CBPeripheral,
                                error: Error?) {
@@ -5007,6 +5117,18 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
         }
         state.clearBiometrics()       // and a stale HR / R-R must not outlive the link either
         state.liveFeedActive = false  // a drop while Live is open must not leave a stale "Stop live feed"
+        // #1635: an unanswered CLIENT_HELLO produces no write error at all - the link simply drops a few
+        // seconds later - so it never reached the give-up on this platform and nothing could end the loop.
+        // Read it HERE, while `clientHelloWriteAt` and `didBond` are both still valid, and feed it in
+        // through the same split the auth path uses. `countsAsBondRefusal` gates on family, so a 4.0 (which
+        // bonds cleanly) can never latch the suppression.
+        if countsAsBondRefusal(isAuthRefusalStatus: false,
+                               helloUnacked: clientHelloWriteAt != nil,
+                               alreadyBonded: didBond,
+                               family: selectedModel.deviceFamily) {
+            recordWhoop5BondRefusal(authRefusal: false,
+                                    peripheralUUID: peripheral.identifier.uuidString)
+        }
         didBond = false
         clientHelloWriteAt = nil   // #1635: no hello survives the link that carried it
         whoop5RealtimeArmed = false
@@ -5337,7 +5459,16 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                 // fires for a 5/MG strap. Live HR/battery come from the standard profiles; this just
                 // opens the puffin session. Unverified on real MG hardware.
                 cmdCharacteristic = c
-                if let hello = selectedModel.deviceFamily.clientHello {
+                // #1635: once the give-up has latched, the hello is what ends the link — skip it and let
+                // the standard-profile HR stream keep running. Consumed unconditionally so an explicit
+                // Connect's single retry belongs to this session and cannot leak into a later automatic one.
+                let helloUserAsked = helloRetryRequested
+                helloRetryRequested = false
+                let helloSuppressed = HelloSuppressionStore.suppressed(peripheral.identifier.uuidString)
+                if !shouldSendClientHello(suppressedForDevice: helloSuppressed, userInitiated: helloUserAsked) {
+                    log("WHOOP 5/MG: CLIENT_HELLO suppressed for this strap - it was never acknowledged and the write is what drops the link. Staying on live HR (not fully paired); press Connect to try the handshake again (#1635).")
+                    state.pairingHint = BondRefusalGiveUp.helloSuppressedHint()
+                } else if let hello = selectedModel.deviceFamily.clientHello {
                     // CONTRIBUTOR FIX (issue #17 — diagnosed from the logs, unverified on hardware here):
                     // write CLIENT_HELLO with .withResponse so CoreBluetooth runs just-works bonding when
                     // the link needs authenticating, AND so didWriteValueFor fires. That callback is where
@@ -5442,19 +5573,11 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                 // threshold (the pairing hint has had several cycles to be acted on), pause auto-reconnect so
                 // we stop hammering a strap that can't bond, write the one-line epitaph (opaque id only, no
                 // PII), and surface the honest paused hint. A genuine bond or a manual reconnect re-arms it.
-                if bondGiveUp.recordRefusal() {
-                    autoReconnectPausedForBondLoop = true
-                    bondLoopPausedAt = Date()   // starts the #78 hole-4 salvage-probe floor
-                    // #1539: same reasoning as the #617 trip — park a connect now so this pause can end
-                    // while the app is backgrounded, not only when the user next opens it.
-                    standingConnectWhilePausedIfDue(justTripped: true)
-                    let opaque = BondRefusalGiveUp.opaqueId(fromLocalUUID: peripheral.identifier.uuidString)
-                    log(BondRefusalGiveUp.epitaphLine(refusals: bondGiveUp.refusals, opaqueId: opaque))
-                    state.pairingHint = BondRefusalGiveUp.pausedHint()
-                    if TestCentre.active(.connection) {
-                        state.append(log: "bond gaveUp refusals=\(bondGiveUp.refusals) id=\(opaque) (auto-reconnect paused)", domain: .connection)
-                    }
-                }
+                // #1635: the trip itself now lives in recordWhoop5BondRefusal, shared with the
+                // unanswered-handshake path at disconnect, so the two causes cannot drift apart. This
+                // one is an AUTH refusal — the strap actively declined — so it still pauses.
+                recordWhoop5BondRefusal(authRefusal: true,
+                                        peripheralUUID: peripheral.identifier.uuidString)
             }
             // Multi-WHOOP stale-pin recovery (#52). When a stale registry pin points at a strap that keeps
             // refusing the encrypted bond ("Encryption/Authentication is insufficient") but a DIFFERENT
@@ -5505,6 +5628,10 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                 isWhoop5: true
             ) {
                 didBond = true
+                // #1635: the handshake demonstrably works on this strap - drop the latch so a later
+                // transient failure starts from a clean slate rather than inheriting an old verdict.
+                HelloSuppressionStore.setSuppressed(peripheral.identifier.uuidString, false)
+                bondGiveUp.reset()
                 state.bonded = true
                 state.encryptedBond = true   // genuine encrypted bond (not the live-HR shortcut) — #69
                 bondedAt = Date()            // #617: start the bond→drop stopwatch for the bond-loop detector
@@ -5830,6 +5957,11 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
             if selectedModel.deviceFamily == .whoop5, !state.bonded {
                 state.bonded = true
                 log("WHOOP 5/MG: live HR streaming — marking the link established (experimental).")
+                // #1635: a 5/MG has no confirmed-write handshake, so the keep-alive (and with it the
+                // liveness watchdog) is started HERE, on the bonded transition, exactly as the Kotlin twin
+                // does. The other two start sites are post-bond, which a suppressed strap never reaches —
+                // and this also covers an unbonded 5/MG that has not latched yet.
+                startKeepAlive()
             }
         case BLEManager.batteryChar:
             // 0x2A19 = percent — 5/MG ONLY. The WHOOP 4.0's 0x2A19 is a stub constant 100 (real value =
diff --git a/Strand/BLE/HelloSuppression.swift b/Strand/BLE/HelloSuppression.swift
new file mode 100644
index 0000000000..96ff7b3c94
--- /dev/null
+++ b/Strand/BLE/HelloSuppression.swift
@@ -0,0 +1,126 @@
+import Foundation
+import WhoopProtocol
+
+/// Whether to send the WHOOP 5/MG CLIENT_HELLO at all on this connect.
+///
+/// The #1635 field captures show the hello is what ends the link. Across two sessions and sixteen writes it
+/// was never once acknowledged, and the drop is locked to the HELLO rather than to the connect: 3.158s,
+/// 3.159s, 3.155s after the write, cycle after cycle, while live HR streams happily over the standard
+/// profile the whole time.
+///
+/// An HCI capture later established the cause: the phone transmits an SMP Pairing Request and the strap
+/// answers `Pairing Not Supported` (0x05). The refusal is categorical — the encrypted bond this hello waits
+/// behind can never arrive on a 5/MG — so the write is a handshake that has never once succeeded knocking a
+/// strap that CAN deliver live HR off every few seconds.
+///
+/// Suppressing it after the give-up latches trades an unreachable capability (puffin commands, history
+/// offload) for one that demonstrably works (continuous live HR) — the "Live HR, not fully paired" state
+/// the app already models (#69), reached deliberately instead of never at all.
+///
+/// [userInitiated] always re-attempts: suppression is a fallback for automatic reconnects, never a
+/// permanent verdict. Someone who puts the strap in pairing mode and presses Connect must get a fresh try,
+/// and that is also how the suppression is cleared.
+///
+/// Kotlin twin: `com.noop.ble.shouldSendClientHello`.
+func shouldSendClientHello(suppressedForDevice: Bool, userInitiated: Bool) -> Bool {
+    !suppressedForDevice || userInitiated
+}
+
+/// Should the give-up latch suppress the hello, rather than pause auto-reconnect?
+///
+/// The two give-up causes want opposite treatment, which is why they are split here rather than sharing
+/// one branch:
+///
+///  - An AUTH REFUSAL means the strap actively declined the encrypted bond — typically because it is still
+///    held by the official WHOOP app. Reconnecting cannot help until the user acts, so pausing is right.
+///  - An UNANSWERED HANDSHAKE means the write vanished. The link itself is healthy and streaming, so
+///    pausing throws away working live HR to punish a handshake nobody is waiting on. Suppress the hello
+///    and stay connected instead.
+///
+/// Splitting them is the whole point: before this, both ended in the same pause, so the strap that could
+/// still deliver HR was treated exactly like the one that could not.
+///
+/// Kotlin twin: `com.noop.ble.giveUpSuppressesHello`.
+func giveUpSuppressesHello(authRefusal: Bool) -> Bool { !authRefusal }
+
+/// Does this disconnect count as the strap refusing to bond?
+///
+/// Two observations mean the same thing for the purpose of giving up: the strap answered the bond write
+/// with INSUFFICIENT_AUTHENTICATION / INSUFFICIENT_ENCRYPTION, or it never answered the CLIENT_HELLO at
+/// all. The second was invisible to the give-up on this platform, because the gate tested only the write
+/// error — and an unanswered handshake produces no write error at all, just a link that drops a few
+/// seconds later. The consequence is the loop #1635 describes, with nothing able to end it.
+///
+/// Deliberately does NOT widen what counts as an AUTH refusal — [helloUnacked] is a separate signal carried
+/// separately, so the user-facing guidance can stay honest about which was observed. An auth refusal
+/// supports naming a cause; an unanswered handshake does not.
+///
+/// Pure so the rule is unit-tested without a radio. Kotlin twin: `com.noop.ble.countsAsBondRefusal`.
+func countsAsBondRefusal(
+    isAuthRefusalStatus: Bool,
+    helloUnacked: Bool,
+    alreadyBonded: Bool,
+    family: DeviceFamily
+) -> Bool {
+    if alreadyBonded { return false }        // bonded already — not a pairing problem
+    if family != .whoop5 { return false }    // the 4.0 bonds cleanly; this is the 5/MG handshake
+    return isAuthRefusalStatus || helloUnacked
+}
+
+/// UserDefaults key holding the hello-suppression latch for one strap.
+///
+/// Per device, and lowercased for the same reason the firmware key is: the same strap can present its
+/// identifier in different cases across sessions, and a case-sensitive key would silently latch a second
+/// time under a second key instead of reading the first.
+///
+/// DIVERGENCE FROM ANDROID (deliberate, PII): the identifier here is the CoreBluetooth-local peripheral
+/// UUID, which is per-install rather than the hardware address. The key SHAPE is shared with the Kotlin
+/// twin so the two are recognisably the same latch; the value that goes into it is not the same kind of
+/// identifier, and deliberately so.
+///
+/// Kotlin twin: `com.noop.ble.helloSuppressionPrefKey`.
+func helloSuppressionPrefKey(_ peripheralId: String?) -> String? {
+    guard let raw = peripheralId?.trimmingCharacters(in: .whitespacesAndNewlines), !raw.isEmpty else {
+        return nil
+    }
+    return "noop.helloUnanswered.\(raw.lowercased())"
+}
+
+/// Read/write the per-strap hello-suppression latch. Kept beside the key helper so no caller hand-rolls
+/// the key, which is how the Android side ended up with a case-sensitivity bug worth a comment.
+enum HelloSuppressionStore {
+    static func suppressed(_ peripheralId: String?) -> Bool {
+        guard let key = helloSuppressionPrefKey(peripheralId) else { return false }
+        return UserDefaults.standard.bool(forKey: key)
+    }
+
+    static func setSuppressed(_ peripheralId: String?, _ suppressed: Bool) {
+        guard let key = helloSuppressionPrefKey(peripheralId) else { return }
+        if suppressed {
+            UserDefaults.standard.set(true, forKey: key)
+        } else {
+            // Remove rather than store false: an absent key and a false one mean the same thing, and this
+            // keeps a strap that never latched from leaving a permanent entry behind.
+            UserDefaults.standard.removeObject(forKey: key)
+        }
+    }
+}
+
+/// May the keep-alive timer do its work on this link?
+///
+/// #1635: the timer used to gate on the genuine encrypted bond alone. A SUPPRESSED 5/MG never reaches
+/// one, so that gate switched the whole timer off for exactly the link the suppression keeps up for
+/// hours — taking the liveness watchdog with it and leaving a stalled stream with nothing to bounce it.
+/// The stable-live-HR promise would have quietly depended on a stream nothing was watching.
+///
+/// So a 5/MG that is STREAMING (`bonded` is the live-HR shortcut of #8/#69, set when HR actually arrives
+/// over the standard profile) is admitted too. Deliberately narrower than the Android twin, which admits
+/// any `bonded` link: here it is 5/MG only, and only as far as the watchdog — the caller re-guards on the
+/// real bond before anything puffin-framed, which an unbonded link cannot land anyway.
+///
+/// Pure so the rule is pinned without a radio.
+func keepAliveMayRun(connected: Bool, didBond: Bool, bonded: Bool, family: DeviceFamily) -> Bool {
+    guard connected else { return false }
+    if didBond { return true }
+    return bonded && family == .whoop5
+}
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 13bd1f227c..32e4b87fff 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -50640,6 +50640,70 @@
         }
       }
     },
+    "Live heart rate is streaming, but your strap is not fully paired. Buzz, alarms and history sync need the encrypted pairing.": {
+      "localizations": {
+        "de": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Die Live-Herzfrequenz wird übertragen, aber dein Strap ist nicht vollständig gekoppelt. Vibration, Wecker und Verlaufssynchronisierung benötigen die verschlüsselte Kopplung."
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Live heart rate is streaming, but your strap is not fully paired. Buzz, alarms and history sync need the encrypted pairing."
+          }
+        },
+        "es": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "La frecuencia cardíaca en tiempo real se está transmitiendo, pero tu pulsera no está completamente emparejada. La vibración, las alarmas y la sincronización del historial necesitan el emparejamiento cifrado."
+          }
+        },
+        "fr": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "La fréquence cardiaque en direct est diffusée, mais votre bracelet n'est pas entièrement associé. Les vibrations, les alarmes et la synchronisation de l'historique nécessitent l'association chiffrée."
+          }
+        },
+        "it": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "La frequenza cardiaca in tempo reale è in streaming, ma la tua fascia non è completamente associata. Vibrazione, sveglie e sincronizzazione della cronologia richiedono l'associazione cifrata."
+          }
+        },
+        "pl": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Tętno na żywo jest przesyłane, ale twój pasek nie jest w pełni sparowany. Wibracje, alarmy i synchronizacja historii wymagają szyfrowanego parowania."
+          }
+        },
+        "pt-PT": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "A frequência cardíaca em tempo real está a ser transmitida, mas a tua bracelete não está totalmente emparelhada. A vibração, os alarmes e a sincronização do histórico necessitam do emparelhamento encriptado."
+          }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Пульс в реальном времени передаётся, но ваш браслет сопряжён не полностью. Вибрация, будильники и синхронизация истории требуют зашифрованного сопряжения."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "实时心率正在传输，但你的手环尚未完全配对。震动、闹钟和历史同步需要加密配对。"
+          }
+        },
+        "zh-Hant": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "即時心率正在傳輸，但你的手環尚未完全配對。震動、鬧鐘和歷史同步需要加密配對。"
+          }
+        }
+      }
+    },
     "Connected. Finishing the secure pairing handshake…": {
       "localizations": {
         "de": {
diff --git a/Strand/Screens/SettingsView.swift b/Strand/Screens/SettingsView.swift
index 7c76d02b5a..a27a1d141c 100644
--- a/Strand/Screens/SettingsView.swift
+++ b/Strand/Screens/SettingsView.swift
@@ -1477,14 +1477,21 @@ struct SettingsView: View {
         //
         // A live-HR link falls through to the pairing hint when one is set, and otherwise to "Finishing
         // the secure pairing handshake…", which is accurate HERE because this platform still retries the
-        // CLIENT_HELLO on every connect. Android has an explicit "streaming but not fully paired" arm
-        // instead, because #1635 suppression stops it retrying and nothing is finishing any more. If that
-        // suppression is ported here, this branch must gain the same arm or it starts describing a
-        // handshake that is no longer being attempted.
+        // CLIENT_HELLO on every connect. The #1635 suppression is now ported here too, so once it latches
+        // nothing is finishing any more and the old fall-through would describe a handshake that is no
+        // longer being attempted. The `bonded && connected` arm below is that fix, matching the Android
+        // twin (`SettingsLogic.strapStatusLine`).
         if live.encryptedBond && live.connected {
             return String(localized: "Your strap is paired and sending data. Open Live for a real-time heart rate.")
         }
+        // An actionable hint outranks the generic arm: the suppression hint names the one action that
+        // restores the handshake, which "not fully paired" alone does not.
         if live.connected, let hint = live.pairingHint { return hint }
+        // Live HR over the UNBONDED standard profile (#69). True whenever the handshake is suppressed or
+        // simply has not landed, and the honest description either way.
+        if live.bonded && live.connected {
+            return String(localized: "Live heart rate is streaming, but your strap is not fully paired. Buzz, alarms and history sync need the encrypted pairing.")
+        }
         if live.connected { return String(localized: "Connected. Finishing the secure pairing handshake…") }
         if live.bonded { return String(localized: "Previously paired but not currently connected. Re-scan to reconnect.") }
         return String(localized: "No strap connected. Put your WHOOP nearby and tap Re-scan to pair.")
diff --git a/StrandTests/HelloSuppressionTests.swift b/StrandTests/HelloSuppressionTests.swift
new file mode 100644
index 0000000000..662059e744
--- /dev/null
+++ b/StrandTests/HelloSuppressionTests.swift
@@ -0,0 +1,174 @@
+import XCTest
+import WhoopProtocol
+@testable import Strand
+
+/// The #1635 CLIENT_HELLO suppression, ported from Android.
+///
+/// The rules are pure so they can be pinned without a radio — which matters more here than usual, because
+/// nothing else validates this path: BLE behaviour is not CI-testable, and the app target has no default
+/// CI at all.
+final class HelloSuppressionTests: XCTestCase {
+
+    // MARK: - shouldSendClientHello
+
+    func testTheHelloIsSentUntilTheLatchSets() {
+        XCTAssertTrue(shouldSendClientHello(suppressedForDevice: false, userInitiated: false))
+        XCTAssertFalse(shouldSendClientHello(suppressedForDevice: true, userInitiated: false))
+    }
+
+    /// Suppression is a fallback for AUTOMATIC reconnects, never a permanent verdict. Someone who puts the
+    /// strap in pairing mode and presses Connect must get a fresh try — that is also the only way to clear
+    /// the latch short of a genuine bond.
+    func testAnExplicitConnectAlwaysReattempts() {
+        XCTAssertTrue(shouldSendClientHello(suppressedForDevice: true, userInitiated: true))
+        XCTAssertTrue(shouldSendClientHello(suppressedForDevice: false, userInitiated: true))
+    }
+
+    // MARK: - giveUpSuppressesHello
+
+    /// The two give-up causes want OPPOSITE treatment, and collapsing them is the bug this split exists to
+    /// undo: before it, a strap that could still stream live HR was treated exactly like one that could not.
+    func testOnlyAnUnansweredHandshakeSuppresses() {
+        XCTAssertTrue(giveUpSuppressesHello(authRefusal: false))   // vanished write -> keep the link
+        XCTAssertFalse(giveUpSuppressesHello(authRefusal: true))   // strap said no  -> pause instead
+    }
+
+    // MARK: - countsAsBondRefusal
+
+    /// The family gate is what keeps a WHOOP 4.0 out of this entirely. The latch is stored per device with
+    /// no family in the key, so without this gate a 4.0 could latch and silently lose history sync.
+    func testAFourOhCanNeverReachTheSuppression() {
+        for family in DeviceFamily.allCases where family != .whoop5 {
+            XCTAssertFalse(
+                countsAsBondRefusal(isAuthRefusalStatus: true, helloUnacked: true,
+                                    alreadyBonded: false, family: family),
+                "\(family) must not count toward the 5/MG handshake give-up")
+        }
+    }
+
+    func testBothCausesCountForAFiveMG() {
+        // The strap actively declined.
+        XCTAssertTrue(countsAsBondRefusal(isAuthRefusalStatus: true, helloUnacked: false,
+                                          alreadyBonded: false, family: .whoop5))
+        // The write simply vanished — invisible to this platform's give-up before the port.
+        XCTAssertTrue(countsAsBondRefusal(isAuthRefusalStatus: false, helloUnacked: true,
+                                          alreadyBonded: false, family: .whoop5))
+        // Neither: an ordinary drop is not a pairing problem.
+        XCTAssertFalse(countsAsBondRefusal(isAuthRefusalStatus: false, helloUnacked: false,
+                                           alreadyBonded: false, family: .whoop5))
+    }
+
+    /// A bonded link that drops is not a pairing failure, and counting it would latch the suppression on a
+    /// strap whose handshake demonstrably works.
+    func testAlreadyBondedNeverCounts() {
+        XCTAssertFalse(countsAsBondRefusal(isAuthRefusalStatus: true, helloUnacked: true,
+                                           alreadyBonded: true, family: .whoop5))
+    }
+
+    // MARK: - the latch key
+
+    /// Lowercased for the same reason the firmware key is: the same strap can present its identifier in
+    /// different cases across sessions, and a case-sensitive key would latch a second time under a second
+    /// key instead of reading the first.
+    func testTheLatchKeyIsCaseInsensitiveAndTrimmed() {
+        let upper = helloSuppressionPrefKey("AABBCCDD-1122")
+        XCTAssertEqual(upper, "noop.helloUnanswered.aabbccdd-1122")
+        XCTAssertEqual(helloSuppressionPrefKey("  aabbccdd-1122  "), upper)
+    }
+
+    func testTheLatchKeyRejectsNothingToKeyOn() {
+        XCTAssertNil(helloSuppressionPrefKey(nil))
+        XCTAssertNil(helloSuppressionPrefKey(""))
+        XCTAssertNil(helloSuppressionPrefKey("   "))
+    }
+
+    // MARK: - the latch itself
+
+    func testTheLatchRoundTripsAndClearsCompletely() {
+        let id = "unit-test-\(#function)"
+        defer { HelloSuppressionStore.setSuppressed(id, false) }
+
+        XCTAssertFalse(HelloSuppressionStore.suppressed(id))
+        HelloSuppressionStore.setSuppressed(id, true)
+        XCTAssertTrue(HelloSuppressionStore.suppressed(id))
+        // Case must not open a second latch beside the first.
+        XCTAssertTrue(HelloSuppressionStore.suppressed(id.uppercased()))
+        HelloSuppressionStore.setSuppressed(id, false)
+        XCTAssertFalse(HelloSuppressionStore.suppressed(id))
+        // Cleared means REMOVED, so a strap that never latched leaves nothing behind.
+        XCTAssertNil(UserDefaults.standard.object(forKey: helloSuppressionPrefKey(id)!))
+    }
+
+    /// An unkeyable id must not throw or write a stray default.
+    func testStoringAgainstNothingIsANoOp() {
+        HelloSuppressionStore.setSuppressed(nil, true)
+        XCTAssertFalse(HelloSuppressionStore.suppressed(nil))
+    }
+
+    // MARK: - the hints (byte-identical to the Kotlin twin)
+
+    /// The suppression branch pauses NOTHING, so its hint must not say auto-reconnect stopped — that was
+    /// the confidently-wrong diagnostic #1635 produced twice. It names what was lost and the one action
+    /// that restores the attempt.
+    func testTheSuppressionHintDoesNotClaimAnythingIsPaused() {
+        let hint = BondRefusalGiveUp.helloSuppressedHint()
+        XCTAssertTrue(hint.contains("live heart rate keeps streaming"))
+        XCTAssertTrue(hint.contains("History sync stays unavailable"))
+        XCTAssertTrue(hint.contains("Tap Connect"))
+        XCTAssertFalse(hint.lowercased().contains("paused"))
+        XCTAssertFalse(hint.lowercased().contains("stopped retrying"))
+    }
+
+    /// The unanswered-handshake hint must not name a cause. `pausedHint` blames the official WHOOP app or a
+    /// stale pairing, which an INSUFFICIENT_AUTHENTICATION refusal supports and a vanished write does not.
+    func testTheUnansweredHintNamesNoCause() {
+        let unanswered = BondRefusalGiveUp.pausedHintHandshakeUnanswered()
+        XCTAssertTrue(unanswered.contains("never completes"))
+        XCTAssertFalse(unanswered.contains("WHOOP app"))
+        XCTAssertFalse(unanswered.contains("Forget This Device"))
+        // …whereas the auth-refusal hint is exactly where naming that cause belongs.
+        XCTAssertTrue(BondRefusalGiveUp.pausedHint().contains("WHOOP app"))
+    }
+
+    /// Likewise the epitaph: `epitaphLine` asserts "almost certainly held by the official WHOOP app", which
+    /// only an auth refusal supports.
+    func testTheSuppressionEpitaphAssertsNoCause() {
+        let e = BondRefusalGiveUp.helloSuppressedEpitaph(refusals: 5, opaqueId: "abcd1234")
+        XCTAssertTrue(e.contains("[abcd1234]"))
+        XCTAssertTrue(e.contains("5x in a row"))
+        XCTAssertFalse(e.contains("almost certainly"))
+        XCTAssertFalse(e.contains("\u{2014}"))          // project rule: no em-dash in these lines
+    }
+
+    // MARK: - the keep-alive gate
+
+    /// The defect this gate exists for: the timer used to require the genuine encrypted bond, which a
+    /// suppressed 5/MG never reaches — so the liveness watchdog was switched off for exactly the link the
+    /// suppression keeps up for hours, and a stalled stream would have had nothing to bounce it.
+    func testAStreamingSuppressedFiveMGReachesTheWatchdog() {
+        XCTAssertTrue(keepAliveMayRun(connected: true, didBond: false, bonded: true, family: .whoop5))
+    }
+
+    /// Before HR arrives there is nothing to watch, so starting the timer early at the suppression point
+    /// is harmless — the gate simply returns false until the stream marks the link established (#8).
+    func testItStaysShutUntilTheStreamActuallyStarts() {
+        XCTAssertFalse(keepAliveMayRun(connected: true, didBond: false, bonded: false, family: .whoop5))
+    }
+
+    /// Narrower than the Android twin on purpose: only a 5/MG is admitted unbonded. A 4.0 reaching here
+    /// without a bond would be a real fault, not a suppressed link, and must not be kept alive.
+    func testOnlyAFiveMGIsAdmittedWithoutABond() {
+        for family in DeviceFamily.allCases where family != .whoop5 {
+            XCTAssertFalse(keepAliveMayRun(connected: true, didBond: false, bonded: true, family: family),
+                           "\(family) must not run the keep-alive unbonded")
+        }
+    }
+
+    func testABondedLinkAlwaysRunsAndADroppedOneNever() {
+        for family in DeviceFamily.allCases {
+            XCTAssertTrue(keepAliveMayRun(connected: true, didBond: true, bonded: true, family: family))
+            XCTAssertFalse(keepAliveMayRun(connected: false, didBond: true, bonded: true, family: family))
+        }
+    }
+}
+
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 578f4befea..6058bf3c87 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -3281,6 +3281,8 @@ class WhoopBleClient(
         // changed in between, and that is exactly when a new characteristic would appear.
         gattTreeDumpedFor = null
         handler.post {
+            // Captured before the clearing below nulls `lastDevice`, which `lastDeviceAddress` reads through.
+            val releasedAddress = lastDeviceAddress
             intentionalDisconnect = true     // defuse the disconnect→3s-reconnect loop's guard
             handler.removeCallbacks(scanTimeoutRunnable)
             handler.removeCallbacks(scanFallbackRunnable)
@@ -3293,6 +3295,11 @@ class WhoopBleClient(
             // so a paused state can never outlive the strap it belonged to and wedge a later re-add.
             bondRefusalStreak = 0
             bondGiveUp.reset()
+            // #1635: the hello-suppression latch is exactly that kind of state and, unlike the give-up, it
+            // is PERSISTED — so without this it outlives the strap it belonged to, silently suppressing the
+            // handshake on a re-add and leaving a stale pref behind for a strap the user removed.
+            // Re-latching costs the same five refusals it always did. Twin of the Swift `forgetDevice`.
+            runCatching { com.noop.ui.NoopPrefs.setHelloSuppressed(context, releasedAddress, false) }
             autoReconnectPausedForBondLoop = false
             bondLoopPausedAtMs = null
             // Drop the persisted last-device pin so a relaunch / radio-on doesn't auto-reconnect to it (#67).

From a20f72794111a82f8840baf02cec06ef5e957c66 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 15:26:04 +1200
Subject: [PATCH 010/333] ble: read the Device Information Service on an
 unbonded 5/MG (iOS/macOS) (#1673)

The gap #1672 left open. iOS issued the DIS identity read only inside the
post-bond handshake, so a 5/MG that never bonds never read DIS at all - and
since the #1635 suppression landed, "never bonded" is a PERMANENT state on these
straps rather than a transient one. The Devices screen showed a WHOOP 4.0 with
its firmware beside a 5/MG with none, and MG-only capabilities stayed locked
because the strap never got to attest what it is. Android has had this since
#1647/#1649/#1653.

Ported: shouldReadDisUnbonded, disRefusedPrefKey, disReadFailureLine and
shouldPublishDisFirmware as a pure Strand/BLE/DisUnbondedRead.swift twinning
DisUnbondedRead.kt; the unbonded attempt itself, scheduled from the suppressed
path and nowhere else, because that is the only 5/MG state known to be stable;
and the four DIS characteristics this platform never read - firmware (0x2A26),
manufacturer, model number, software revision.

Firmware is the point of it. DIS 0x2A26 is the ONLY source an unbonded strap
has, since the puffin report needs the bond that never happens - and #1634
records that the 5/MG hello frequently decodes no firmware even when it DOES
bond, so this fills a real void rather than racing a value that is coming.
Published as a FALLBACK, never an override.

Self-limiting, deliberately. A read is the same class of operation as the write
that provokes the teardown, so this could cost the stable link the suppression
just bought: once per link, and never again on a strap that has refused once. A
refusal is a RESULT - it settles #490, which no capture has ever done - so it is
reported with its status rather than swallowed by the generic notify-failure
line.

Five review passes found five defects, and the last two are the ones worth
reading:

  - the ECG PROBE was blocked only by accident. Its gate checks opt-in, attested
    MG and connected - but not the bond. On a suppressed strap the MG check
    blocked it incidentally, because the variant could only resolve from a
    post-bond read. Reading DIS unbonded removes that accident, and the gate
    would then have let the probe write puffin frames to fd4b0002 - the very
    characteristic whose write tears the link down, spending the stable link the
    suppression exists to buy. send() is no backstop: it guards connected, not
    bonded. The gate now requires the encrypted bond, as the ECG GATE-WRITE path
    always did (#269).
  - the per-device firmware key had readers and NO writer. I first claimed iOS
    had no FirmwareAttribution twin; that was wrong, and wrong because I grepped
    Kotlin's names against Swift. It exists, has tests, and is read by
    DevicesView and the debug export - but the decoded path cannot key on
    identity, which its own comment concedes, so perDevice always resolved nil
    and both readers fell back to a global value that is wrong the moment a
    second strap exists. The DIS site has the peripheral, so it is the one place
    that can attribute a firmware honestly. That fills a hole predating this
    change.

Also from the passes: the delayed read now checks `connected`, because
`peripheral` outlives a disconnect on this platform and the line would otherwise
claim an attempt that never happened; three comments still describing the read
as post-bond-only were corrected; and the delay is pinned to the twin's actual
number (1500 x 2 = 3.0s, not the 4.0 I first guessed).

Deliberate divergences, all documented in code: the extras are issued together
rather than chained, because CoreBluetooth already serialises reads; the refusal
latches only for an UNBONDED attempt, since a transient failure on a bonded link
would poison a permanent latch; there is no explicit-bond-deferred call site,
that experiment being Android-only; and the post-bond path stays silent about a
missing serial, because it is re-entered from the keep-alive tick and would log
every cycle.

Verification: disReadFailureLine and both firmware log lines proven
byte-identical to the Kotlin source by extracting and comparing - which caught a
hyphen where Kotlin has an em-dash. All six DIS UUIDs verified against the twin.
14 tests over the pure rules incl. every arm of the attempt gate, the
fallback-not-override rule, and that the DIS latch key cannot collide with the
hello-suppression one; the pure file also compiled standalone with swiftc and
every rule exercised. doc_comment_lint and the i18n gate clean.

NOT hardware-validated, and this one is genuinely unproven rather than merely
untested: whether a 5/MG answers a standard read on an unencrypted link is the
open question #490 asks, and nothing here can settle it without a strap. Either
outcome is informative, and a refusal costs one read per strap, once.
---
 Strand/BLE/BLEManager.swift            | 184 +++++++++++++++++++++++--
 Strand/BLE/DisUnbondedRead.swift       |  83 +++++++++++
 StrandTests/DisUnbondedReadTests.swift |  94 +++++++++++++
 3 files changed, 351 insertions(+), 10 deletions(-)
 create mode 100644 Strand/BLE/DisUnbondedRead.swift
 create mode 100644 StrandTests/DisUnbondedReadTests.swift

diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index 2f0a3e22dc..73691832f2 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -542,6 +542,17 @@ public final class BLEManager: NSObject, ObservableObject {
     static let disService       = CBUUID(string: "180A")
     static let disSerialChar    = CBUUID(string: "2A25") // Serial Number String
     static let disHwRevChar     = CBUUID(string: "2A27") // Hardware Revision String
+    static let disFwRevChar     = CBUUID(string: "2A26") // Firmware Revision String
+    static let disManufacturerChar = CBUUID(string: "2A29") // Manufacturer Name String
+    static let disModelNumberChar  = CBUUID(string: "2A24") // Model Number String
+    static let disSwRevChar     = CBUUID(string: "2A28") // Software Revision String
+    /// Every DIS characteristic NOOP reads, in ONE place. The failure reporter tests membership here, so
+    /// a characteristic added beside these cannot go silently unreported — the exact "a refused read is
+    /// indistinguishable from one never issued" gap the reporter exists to close. Kotlin twin: DIS_CHARS.
+    static let disChars: Set<CBUUID> = [
+        disSerialChar, disHwRevChar, disFwRevChar,
+        disManufacturerChar, disModelNumberChar, disSwRevChar,
+    ]
 
     static let restoreID = "com.openwhoop.ble.central"
 
@@ -930,9 +941,11 @@ public final class BLEManager: NSObject, ObservableObject {
     private var dataNotifyCharacteristic: CBCharacteristic?
     private var heartRateCharacteristic: CBCharacteristic?
     private var batteryCharacteristic: CBCharacteristic?
-    /// #520 DIS: remembered at discovery, READ post-bond (see the #490 note — a 5/MG refuses standard
-    /// reads before the link is encrypted). Serial + hardware revision are immutable, so they are read
-    /// ONCE per connection (`disRead`), never re-polled like the battery.
+    /// #520 DIS: remembered at discovery, READ post-bond — and since #1635 also on a SUPPRESSED link that
+    /// will never bond, which is now a permanent state rather than a transient one. The #490 note (a 5/MG
+    /// refuses standard reads before the link is encrypted) is the open question that attempt settles
+    /// either way. Serial + hardware revision are immutable, so they are read ONCE per connection
+    /// (`disRead`), never re-polled like the battery.
     /// Peripheral whose GATT tree has already been dumped, so the ~30-line enumeration is emitted once per
     /// device rather than once per connect (#1635). Not persisted: a fresh launch is exactly when the tree
     /// is worth seeing again, and a strap whose firmware changed between runs may expose something new.
@@ -941,8 +954,22 @@ public final class BLEManager: NSObject, ObservableObject {
     private var disSerialCharacteristic: CBCharacteristic?
     private var disHwRevCharacteristic: CBCharacteristic?
     private var disRead = false
+    /// 3.0s — the Kotlin twin's `BATTERY_ON_CONNECT_DELAY_MS * 2` (1500 × 2), and the same 1.5s on-connect
+    /// pacing this file already uses before `requestSync(.connect)`. Long enough that the link has settled
+    /// after the suppression decision, short enough to land in the same session. Pinned to the twin's
+    /// number rather than an independently chosen one: this read can cost the link, so the two platforms
+    /// should not be probing at different moments when a field capture has to explain a drop.
+    static let unbondedDisReadDelay: TimeInterval = 3.0
     private var disSerial: String?
     private var disHwRev: String?
+    /// #1635 follow-up: the DIS identity extras (firmware, manufacturer, model, software revision) as
+    /// discovered. Held as a list rather than one property each because nothing branches on them
+    /// individually — they are read as a set and reported as a set.
+    private var disExtraCharacteristics: [CBCharacteristic] = []
+    /// The DIS firmware string (0x2A26), which is the ONLY firmware source an unbonded 5/MG has: the
+    /// puffin report needs the bond that never happens. Published only as a fallback, never as an
+    /// override — see `shouldPublishDisFirmware`.
+    private var disFirmware: String?
     /// EXPERIMENTAL WHOOP 5.0/MG puffin notify chars (fd4b0003/4/5/7), remembered at discovery so we
     /// can re-subscribe them AFTER bonding — the strap refuses them ("Authentication is insufficient")
     /// until the link is encrypted (issue #17).
@@ -3781,6 +3808,20 @@ public final class BLEManager: NSObject, ObservableObject {
             log("ECG probe: ignored — not connected")
             return false
         }
+        // #1635: the MG check above used to block this incidentally on a suppressed strap, because the
+        // variant could only resolve from a POST-BOND DIS read and so stayed `.unknown` forever. Now that
+        // DIS is read on an unbonded link too, a suppressed MG can attest itself — and this gate would
+        // have let the probe write puffin frames to fd4b0002, the very characteristic whose write tears
+        // the link down. That would spend the stable link the suppression exists to buy, on commands the
+        // strap cannot answer unbonded anyway.
+        //
+        // The ECG GATE-WRITE path already required this and says why (#269: a config write over the
+        // live-HR-only link silently fails). The probe needs it for the same reason, and now also to stay
+        // out of the way of #1635.
+        guard state.encryptedBond else {
+            log("ECG probe: ignored — needs the full encrypted bond, not the live-HR-only link (#1635/#269)")
+            return false
+        }
         return true
     }
 
@@ -4219,9 +4260,11 @@ public final class BLEManager: NSObject, ObservableObject {
         batteryCharacteristic = nil
         disSerialCharacteristic = nil
         disHwRevCharacteristic = nil
+        disExtraCharacteristics = []
         disRead = false
         disSerial = nil
         disHwRev = nil
+        disFirmware = nil
         whoop5NotifyCharacteristics.removeAll()
     }
 
@@ -4346,9 +4389,80 @@ public final class BLEManager: NSObject, ObservableObject {
             disRead = true
             p.readValue(for: serialChar)
             if let c = disHwRevCharacteristic, c.properties.contains(.read) { p.readValue(for: c) }
+            readDisExtras(p)
         }
     }
 
+    /// Read the DIS identity extras — firmware above all, which an unbonded 5/MG has no other source for.
+    ///
+    /// DIVERGENCE FROM ANDROID (deliberate, platform): the Kotlin twin CHAINS these one read per callback,
+    /// because its GATT queue runs a single operation at a time and a second read issued early is simply
+    /// dropped. CoreBluetooth queues reads itself, so chaining here would add a state machine to serialise
+    /// something already serialised. Same characteristics, same data, no chain.
+    ///
+    /// A strap need not implement all of DIS: a missing or unreadable characteristic is skipped, because
+    /// "not implemented" is per-characteristic and the ones it DOES publish should still be read.
+    private func readDisExtras(_ p: CBPeripheral) {
+        for c in disExtraCharacteristics where c.properties.contains(.read) {
+            p.readValue(for: c)
+        }
+    }
+
+    /// The UNBONDED DIS attempt (#1635 follow-up). Deliberately separate from the post-bond identity read,
+    /// which runs only inside the handshake and therefore never runs at all on a strap that will not bond.
+    ///
+    /// Delayed for the same reason the Kotlin twin delays it: this is only safe in the settled state the
+    /// suppression leaves behind — no handshake outstanding, nothing else in flight, the link holding.
+    private func scheduleUnbondedDisRead() {
+        DispatchQueue.main.asyncAfter(deadline: .now() + BLEManager.unbondedDisReadDelay) { [weak self] in
+            self?.readDisIdentityUnbonded()
+        }
+    }
+
+    private func readDisIdentityUnbonded() {
+        // `peripheral` is only cleared by forgetDevice, so it OUTLIVES a disconnect - and this read is
+        // scheduled with a delay, on a strap whose entire failure mode is dropping the link. Without the
+        // connected check the reads would be issued into a dead link and the line below would claim an
+        // attempt that never happened, which is precisely what a diagnostic may not do.
+        guard state.connected, let p = peripheral else { return }
+        let refused = disRefusedPrefKey(p.identifier.uuidString)
+            .map { UserDefaults.standard.bool(forKey: $0) } ?? false
+        guard shouldReadDisUnbonded(isWhoop5: selectedModel.deviceFamily == .whoop5,
+                                    bonded: didBond,
+                                    alreadyReadThisLink: disRead,
+                                    previouslyRefused: refused) else { return }
+        guard let serialChar = disSerialCharacteristic, serialChar.properties.contains(.read) else {
+            log("DIS: serial characteristic unavailable — hardware variant stays unknown")
+            return
+        }
+        log("DIS: trying the identity read on an UNbonded link — unproven, and a refusal is itself the answer to whether DIS needs an encrypted bond (#490)")
+        disRead = true
+        p.readValue(for: serialChar)
+        if let c = disHwRevCharacteristic, c.properties.contains(.read) { p.readValue(for: c) }
+        readDisExtras(p)
+    }
+
+    /// A DIS read that came back with a failure status.
+    ///
+    /// Scoped to the DIS characteristics: they are the reads whose refusal is a FINDING (it settles #490
+    /// and means the firmware cannot be had without a bond). The refusal is latched per device, so a strap
+    /// that declines says so once instead of on every reconnect forever.
+    private func noteDisReadFailure(_ uuid: CBUUID, _ error: Error) {
+        guard BLEManager.disChars.contains(uuid) else { return }
+        log(disReadFailureLine(uuid: uuid.uuidString, status: error.localizedDescription))
+        // Report it, but latch it ONLY for an unbonded attempt. The latch is persisted and permanent, so a
+        // transient failure on a BONDED link would disable the unbonded read for this strap for good and
+        // blame the strap for something that was never its policy. This is the analogue of the Kotlin
+        // twin's explicit-bond guard: same reasoning, different thing to exclude, because the bonded read
+        // is the only way a DIS failure reaches here without being the finding we are looking for.
+        guard !didBond else {
+            log("DIS: not latching that refusal — the link is bonded, so the failure is not attributable to the strap's unbonded-read policy")
+            return
+        }
+        guard let key = disRefusedPrefKey(peripheral?.identifier.uuidString) else { return }
+        UserDefaults.standard.set(true, forKey: key)
+    }
+
     /// Resolve + log the 5/MG hardware variant once a DIS string lands (#520). Both characteristics
     /// arrive as SEPARATE async callbacks, so this runs on each and re-resolves — the contradiction rule
     /// in `Whoop5Variant` needs both before it can disagree. Diagnostic only: nothing gates on it yet.
@@ -5396,9 +5510,11 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
             case BLEManager.batteryService:
                 peripheral.discoverCharacteristics([BLEManager.batteryChar], for: s)
             case BLEManager.disService:
-                // #520: read-only identity strings. Discovered here, but READ post-bond (below).
+                // #520: read-only identity strings. Discovered here; READ post-bond, or on a suppressed
+                // link via `readDisIdentityUnbonded` (#1635) — a strap that never bonds has no other
+                // source for its firmware at all.
                 peripheral.discoverCharacteristics(
-                    [BLEManager.disSerialChar, BLEManager.disHwRevChar], for: s)
+                    BLEManager.disChars.map { $0 }, for: s)
             case BLEManager.whoop5Service:
                 // EXPERIMENTAL WHOOP 5.0/MG path: discover the puffin command + notify characteristics
                 // so we can send CLIENT_HELLO and receive frames. Live HR/battery still arrive over the
@@ -5468,6 +5584,11 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                 if !shouldSendClientHello(suppressedForDevice: helloSuppressed, userInitiated: helloUserAsked) {
                     log("WHOOP 5/MG: CLIENT_HELLO suppressed for this strap - it was never acknowledged and the write is what drops the link. Staying on live HR (not fully paired); press Connect to try the handshake again (#1635).")
                     state.pairingHint = BondRefusalGiveUp.helloSuppressedHint()
+                    // The unbonded DIS attempt rides HERE and nowhere else: this is the only 5/MG state
+                    // known to be stable - the handshake is off and the link is holding - and it is now
+                    // PERMANENT rather than transient, so without it a suppressed strap never learns its
+                    // firmware or whether it is an MG at all (#490).
+                    scheduleUnbondedDisRead()
                 } else if let hello = selectedModel.deviceFamily.clientHello {
                     // CONTRIBUTOR FIX (issue #17 — diagnosed from the logs, unverified on hardware here):
                     // write CLIENT_HELLO with .withResponse so CoreBluetooth runs just-works bonding when
@@ -5501,13 +5622,22 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                 default: break
                 }
                 requestNotify(c, on: peripheral, reason: "discovery")
-            case BLEManager.disSerialChar, BLEManager.disHwRevChar:
-                // #520: CAPTURE ONLY — the read is issued post-bond (a 5/MG refuses standard reads on an
-                // unencrypted link, see #490). These are read-only identity strings: never subscribed
-                // (no notify property) and never written. Must be handled BEFORE `default`, or they'd be
-                // retained as puffin notify characteristics.
+            case BLEManager.disSerialChar, BLEManager.disHwRevChar, BLEManager.disFwRevChar,
+                 BLEManager.disManufacturerChar, BLEManager.disModelNumberChar, BLEManager.disSwRevChar:
+                // #520: CAPTURE ONLY — the read is issued post-bond, and since #1635 ALSO on a suppressed
+                // link that will never bond (see `readDisIdentityUnbonded`; whether a 5/MG answers a
+                // standard read unencrypted is the open question #490 asks). These are read-only identity
+                // strings: never subscribed (no notify property) and never written. Must be handled BEFORE
+                // `default`, or they'd be retained as puffin notify characteristics.
                 if c.uuid == BLEManager.disSerialChar {
                     disSerialCharacteristic = c
+                } else if c.uuid != BLEManager.disHwRevChar {
+                    // The identity extras are read straight off the discovered service, so they need no
+                    // dedicated property — but they must still be claimed here or `default` would retain
+                    // them as puffin notify characteristics.
+                    if !disExtraCharacteristics.contains(where: { $0.uuid == c.uuid }) {
+                        disExtraCharacteristics.append(c)
+                    }
                 } else {
                     disHwRevCharacteristic = c
                 }
@@ -5941,6 +6071,9 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                            didUpdateValueFor characteristic: CBCharacteristic,
                            error: Error?) {
         if let error {
+            // A DIS refusal is a FINDING, not noise — report it specifically and latch it, or a capture
+            // cannot tell a refusal from a read that was never issued (#490, #1635).
+            noteDisReadFailure(characteristic.uuid, error)
             log("Notify update failed for \(characteristic.uuid): \(error.localizedDescription)")
             return
         }
@@ -5979,6 +6112,37 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
             disHwRev = String(decoding: bytes, as: UTF8.self)
                 .trimmingCharacters(in: CharacterSet(charactersIn: "\0").union(.whitespacesAndNewlines))
             noteWhoop5VariantFromDIS()
+        case BLEManager.disFwRevChar:
+            disFirmware = String(decoding: bytes, as: UTF8.self)
+                .trimmingCharacters(in: CharacterSet(charactersIn: "\0").union(.whitespacesAndNewlines))
+            // FALLBACK only. The puffin report is the strap's own account of what it is running and lands
+            // later in the connect; a value that appeared and then changed would be worse than one that
+            // arrived once, so this yields rather than racing it.
+            if shouldPublishDisFirmware(disFirmware: disFirmware, alreadyDecoded: state.strapFirmware) {
+                state.strapFirmware = disFirmware
+                // #1634: persist it against THIS strap. The per-device key has readers (DevicesView, the
+                // debug export) but had no writer at all - the decoded path cannot key on identity, which
+                // its own comment concedes - so `perDevice` always resolved nil and iOS fell back to a
+                // global value that is wrong the moment a second strap exists. This site DOES have the
+                // peripheral, so it is the one place that can attribute a firmware honestly. Kotlin twin:
+                // NoopPrefs.setFirmwareFor beside the same publish.
+                if let key = FirmwareAttribution.prefKey(peripheralId: peripheral.identifier.uuidString),
+                   let fw = disFirmware {
+                    UserDefaults.standard.set(fw, forKey: key)
+                }
+                // Named as the DIS source, because it is not the same reading as the decoded one a 4.0
+                // shows and a capture must not have to guess which it is looking at.
+                log("DIS: firmware=\(disFirmware ?? "?") (standard profile, no bond required)")
+            } else {
+                let shown = (disFirmware?.isEmpty ?? true) ? "?" : (disFirmware ?? "?")
+                log("DIS: firmware=\(shown) not published — a decoded value already stands")
+            }
+        case BLEManager.disManufacturerChar, BLEManager.disModelNumberChar, BLEManager.disSwRevChar:
+            // Diagnostic only: nothing gates on these, but they cost one read each and are exactly what
+            // is missing when someone reports an unidentified strap.
+            let v = String(decoding: bytes, as: UTF8.self)
+                .trimmingCharacters(in: CharacterSet(charactersIn: "\0").union(.whitespacesAndNewlines))
+            if !v.isEmpty { log("DIS: \(characteristic.uuid.uuidString) = \(v)") }
         case BLEManager.dataNotifyChar,
              BLEManager.cmdNotifyChar,
              BLEManager.eventNotifyChar:
diff --git a/Strand/BLE/DisUnbondedRead.swift b/Strand/BLE/DisUnbondedRead.swift
new file mode 100644
index 0000000000..c0ec3eb30d
--- /dev/null
+++ b/Strand/BLE/DisUnbondedRead.swift
@@ -0,0 +1,83 @@
+import Foundation
+
+/// Should NOOP try reading the Device Information Service on a 5/MG that has NOT bonded?
+///
+/// `readDisIdentity` is issued only inside the post-bond handshake, so a strap that never bonds never
+/// reads DIS at all — and since #1635 the suppression makes that state PERMANENT rather than transient.
+/// The Devices screen shows a WHOOP 4.0 with its firmware beside a 5/MG with none. The firmware, the
+/// serial and the MG-vs-5.0 hardware revision all sit behind the same bond that never happens.
+///
+/// Whether they NEED that bond is unproven, and the evidence is one-sided in an uncomfortable way.
+/// Standard NOTIFICATIONS demonstrably work unbonded — live HR and battery both arrive that way on
+/// exactly these straps — but nothing shows a standard READ working unbonded, and this file's own
+/// platform carries the #490 note that a 5/MG refuses standard reads on an unencrypted link. A read is
+/// also the same class of operation as the write that has been provoking the teardown, so this can
+/// plausibly cost the stable link the suppression just bought.
+///
+/// Hence: once per device, and never again after a refusal. [previouslyRefused] is persisted, so a strap
+/// that says no says it once rather than on every reconnect forever. That makes the experiment
+/// self-limiting in the same way the hello suppression is — "keeps trying something that will never
+/// work" is the failure mode this whole area keeps producing.
+///
+/// A refusal is a RESULT, not a defeat: it settles #490, which no capture has ever done.
+///
+/// Kotlin twin: `com.noop.ble.shouldReadDisUnbonded`.
+func shouldReadDisUnbonded(
+    isWhoop5: Bool,
+    bonded: Bool,
+    alreadyReadThisLink: Bool,
+    previouslyRefused: Bool
+) -> Bool {
+    if !isWhoop5 { return false }
+    if bonded { return false }            // the post-bond path already covers this
+    if alreadyReadThisLink { return false }
+    return !previouslyRefused
+}
+
+/// Persisted key for "this strap refused an unbonded DIS read". Per device and lowercased, for the same
+/// reason the hello-suppression key is.
+///
+/// DIVERGENCE FROM ANDROID (deliberate, PII): the identifier here is the CoreBluetooth-local peripheral
+/// UUID, per-install rather than the hardware address. Same key SHAPE, different kind of identifier.
+///
+/// Kotlin twin: `com.noop.ble.disRefusedPrefKey`.
+func disRefusedPrefKey(_ peripheralId: String?) -> String? {
+    guard let raw = peripheralId?.trimmingCharacters(in: .whitespacesAndNewlines), !raw.isEmpty else {
+        return nil
+    }
+    return "noop.disRefused.\(raw.lowercased())"
+}
+
+/// The line for a DIS read that came back with a failure status.
+///
+/// Without it the read fails into the generic notify-failure line, so a capture cannot tell a refusal
+/// from a read that was never issued. That is the same ambiguity that made the CLIENT_HELLO failure
+/// unreadable for eleven weeks, and it is not worth reproducing.
+///
+/// Insufficient authentication / encryption are the interesting answers: they say the strap requires an
+/// encrypted link for this read, which settles #490 and means the firmware simply cannot be had without
+/// a bond.
+///
+/// Pure. Byte-identical to the Kotlin `disReadFailureLine`.
+func disReadFailureLine(uuid: String, status: String) -> String {
+    "DIS: read of \(uuid) failed \(status) — the strap declined it on this link. If this is an insufficient-authentication or -encryption status, DIS needs an encrypted bond and the firmware cannot be read without one (#490)"
+}
+
+/// Should the standard Device Information Service firmware string be published for this strap?
+///
+/// A 5/MG that never completes the puffin handshake has no firmware to show, because the only source
+/// NOOP reads it from is a framed command that needs the bond. DIS `0x2A26` sits in the same service the
+/// serial and hardware revision come from; it was simply never asked for on this platform.
+///
+/// DIS is a FALLBACK, never an override. The puffin value is the strap's own report of the firmware it
+/// is running and is what the 4.0 has always shown; DIS is whatever the device chose to publish in its
+/// standard profile, and the two are not guaranteed to agree. So this yields to anything already decoded
+/// rather than racing it — the decode lands later in the connect, and a value that appeared and then
+/// changed would be worse than one that arrived once.
+///
+/// Kotlin twin: `com.noop.ble.shouldPublishDisFirmware`.
+func shouldPublishDisFirmware(disFirmware: String?, alreadyDecoded: String?) -> Bool {
+    guard let dis = disFirmware, !dis.trimmingCharacters(in: .whitespaces).isEmpty else { return false }
+    guard let decoded = alreadyDecoded else { return true }
+    return decoded.trimmingCharacters(in: .whitespaces).isEmpty
+}
diff --git a/StrandTests/DisUnbondedReadTests.swift b/StrandTests/DisUnbondedReadTests.swift
new file mode 100644
index 0000000000..2ccb03c002
--- /dev/null
+++ b/StrandTests/DisUnbondedReadTests.swift
@@ -0,0 +1,94 @@
+import XCTest
+@testable import Strand
+
+/// The unbonded Device Information Service read, ported from Android (#1647/#1649/#1653).
+///
+/// Since the #1635 suppression, "never bonded" is a PERMANENT state on a 5/MG rather than a transient
+/// one — so a post-bond-only DIS read means such a strap never learns its firmware, its serial or whether
+/// it is an MG at all. These rules decide when to try, and when to stop trying.
+final class DisUnbondedReadTests: XCTestCase {
+
+    // MARK: - when to attempt
+
+    func testACleanFiveMGAttemptsTheRead() {
+        XCTAssertTrue(shouldReadDisUnbonded(isWhoop5: true, bonded: false,
+                                            alreadyReadThisLink: false, previouslyRefused: false))
+    }
+
+    /// A 4.0 bonds cleanly and its post-bond read already works, so it has no business here.
+    func testAFourOhNeverAttemptsIt() {
+        XCTAssertFalse(shouldReadDisUnbonded(isWhoop5: false, bonded: false,
+                                             alreadyReadThisLink: false, previouslyRefused: false))
+    }
+
+    func testABondedLinkLeavesItToThePostBondPath() {
+        XCTAssertFalse(shouldReadDisUnbonded(isWhoop5: true, bonded: true,
+                                             alreadyReadThisLink: false, previouslyRefused: false))
+    }
+
+    func testItIsAtMostOncePerLink() {
+        XCTAssertFalse(shouldReadDisUnbonded(isWhoop5: true, bonded: false,
+                                             alreadyReadThisLink: true, previouslyRefused: false))
+    }
+
+    /// The self-limiting half. A read is the same class of operation as the write that provokes the
+    /// teardown, so retrying one the strap has already refused risks the stable link the suppression
+    /// bought — and "keeps trying something that will never work" is the failure mode this whole area
+    /// keeps producing.
+    func testARefusalIsPermanentForThatStrap() {
+        XCTAssertFalse(shouldReadDisUnbonded(isWhoop5: true, bonded: false,
+                                             alreadyReadThisLink: false, previouslyRefused: true))
+    }
+
+    // MARK: - the refusal latch key
+
+    func testTheRefusalKeyIsCaseInsensitiveAndTrimmed() {
+        XCTAssertEqual(disRefusedPrefKey("AABB-11"), "noop.disRefused.aabb-11")
+        XCTAssertEqual(disRefusedPrefKey("  AABB-11 "), disRefusedPrefKey("aabb-11"))
+    }
+
+    func testTheRefusalKeyRejectsNothingToKeyOn() {
+        XCTAssertNil(disRefusedPrefKey(nil))
+        XCTAssertNil(disRefusedPrefKey(""))
+        XCTAssertNil(disRefusedPrefKey("   "))
+    }
+
+    /// The two latches this area now persists must never collide — they answer different questions about
+    /// the same strap, and one key serving both would make a DIS refusal suppress the handshake.
+    func testTheDisLatchCannotCollideWithTheHelloLatch() {
+        XCTAssertNotEqual(disRefusedPrefKey("aabb-11"), helloSuppressionPrefKey("aabb-11"))
+    }
+
+    // MARK: - the firmware fallback
+
+    /// DIS is the ONLY firmware source an unbonded strap has: the puffin report needs the bond that never
+    /// happens.
+    func testDisFirmwarePublishesWhenNothingWasDecoded() {
+        XCTAssertTrue(shouldPublishDisFirmware(disFirmware: "1.2.3", alreadyDecoded: nil))
+        XCTAssertTrue(shouldPublishDisFirmware(disFirmware: "1.2.3", alreadyDecoded: ""))
+        XCTAssertTrue(shouldPublishDisFirmware(disFirmware: "1.2.3", alreadyDecoded: "   "))
+    }
+
+    /// FALLBACK, never override. The puffin value is the strap's own account of what it is running and
+    /// lands later in the connect; a firmware that appeared and then changed would be worse than one that
+    /// arrived once.
+    func testDisFirmwareNeverOverridesTheDecodedValue() {
+        XCTAssertFalse(shouldPublishDisFirmware(disFirmware: "1.2.3", alreadyDecoded: "9.9.9"))
+    }
+
+    func testThereIsNothingToPublishWithoutADisString() {
+        XCTAssertFalse(shouldPublishDisFirmware(disFirmware: nil, alreadyDecoded: nil))
+        XCTAssertFalse(shouldPublishDisFirmware(disFirmware: "  ", alreadyDecoded: nil))
+    }
+
+    // MARK: - the failure line (byte-identical to the Kotlin twin)
+
+    /// Generated by compiling the pure file standalone with swiftc and pasted verbatim, per the oracle
+    /// rule. Without this line a refused read is indistinguishable from one never issued — the ambiguity
+    /// that made the CLIENT_HELLO failure unreadable for eleven weeks.
+    func testTheFailureLineIsExact() {
+        XCTAssertEqual(
+            disReadFailureLine(uuid: "2A26", status: "err"),
+            "DIS: read of 2A26 failed err — the strap declined it on this link. If this is an insufficient-authentication or -encryption status, DIS needs an encrypted bond and the firmware cannot be read without one (#490)")
+    }
+}

From 63801ae1c293ae303d32a9cf873afc1d2a22ed28 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 17:47:25 +1200
Subject: [PATCH 011/333] updates: notice a new release and say so, on both
 platforms (#1674)

The ask in #1659 was in-app .ipa updates. That specific thing is not possible and
will not become possible: iOS gives a sandboxed app no API to install or re-sign
another app, a free-signed sideload expires every seven days, and itms-services
OTA needs an enterprise certificate this project cannot hold while staying
anonymous and off the App Store. AltStore/SideStore already automate the install
for anyone who added NOOP's source, and that source is current.

What was missing is the half in between, and it turned out both halves already
existed and were never connected: there is a manual "Check for updates" button,
and there is an Updates inbox with a bell. Nothing bridged them, so an install
with no source added had no way to learn a release happened without going
looking.

So: an opt-in daily check that posts ONE row into the inbox the app already has.
No new surface, no notification, no interruption.

  - UpdateAvailability (Swift + Kotlin twins, pure): when a check is due, when a
    result is worth saying, when an announcement has gone stale, and how the
    row's body is assembled
  - UpdateWatch: decide, fetch, post, remember - separate so the rules stay
    testable without a network or a clock
  - UpdateKind.newVersion, deliberately NOT whatsNew: that one means "here is
    what you just got", this means "here is what you have not got yet", and
    sharing a row would make the bell ambiguous exactly when it matters
  - a Settings toggle beside the existing button, so the two read as one feature

OFF BY DEFAULT, and that is a reading of a hard project rule rather than
timidity. "Fully offline, on-device, no telemetry" is the headline promise, and
both checkers justify themselves in their own doc comments as running ONLY on a
tap. A launch request nobody asked for would contradict that. One constant flips
it - UpdateAvailability.defaultEnabled / DEFAULT_ENABLED - and nothing else about
the feature changes.

Behaviour decisions worth knowing:
  - once per VERSION, not per day. Acting on iOS means AltStore or a re-sign, so
    reading the row and doing nothing is reasonable; an app that repeats itself
    daily teaches people to ignore the bell.
  - the day's slot is stamped BEFORE the result is examined, so an unreachable
    GitHub costs one attempt rather than retrying every launch.
  - a clock that moves backwards counts as due, or a restored backup could park
    the next check arbitrarily far out.
  - the announcement is PRUNED once the install catches up. "NOOP 10.7.0 is
    available" is false the moment you install 10.7.0, and it would have sat
    beside the What's New row for that same version. Evaluated before every other
    guard including the toggle, so a stale row cannot outlive the feature that
    posted it.
  - the fetch is shared with the manual button rather than copied, so the two
    cannot drift about what "latest" means. bundleVersionString was private to
    SettingsView; hoisted for the same reason.

Three review passes found three things, and the middle one is the one worth
reading:

  - the announcement never expired (above).
  - THE COPY WAS BUILT AS A BYTE-IDENTICAL TWIN, the way the BLE diagnostic lines
    are, and verified as such. That is the wrong half of the parity contract:
    analytics and stored data are byte-identical, user-facing copy is LOCALIZED
    per platform. iOS's sibling What's New row already uses String(localized:),
    so this row would have rendered in English beside a translated one - and
    nothing would have caught it, because the i18n audits scan Text and
    @Composable literals, not model-layer strings, while the byte-identical test
    would have stayed green defending exactly the property that needed to stop
    being true. The copy now lives at each platform edge; what stays twinned is
    composeMessage - order, spacing, the blank line before notes, the trimming.
  - the Android English used curly apostrophes against its own file's convention
    (170 escaped straight vs 13 curly) and against the iOS twin's identical
    sentence. Straightened, which changed the sha1 and so the l10n key.

Verification: every iOS String(localized:) literal confirmed to map to a real
catalog key (a byte mismatch there falls back silently to English), and all 14
Android entries confirmed to carry exactly the placeholders their call site
passes (a stray %3$s throws at runtime; seven were hand-written). The two English
sentences are character-identical across platforms once placeholder syntax is
normalised. 16 Swift + 15 Kotlin tests over the pure rules, incl. the interval
boundary either side, a backwards clock, the skipped-release case, and the prune
in both directions. Android 4566 tests green, compile clean,
lintVitalFullRelease -PstagingRelease clean, both i18n audits clean,
doc_comment_lint clean. New copy in all 10 Apple locales and all 7 Android ones.

NOT hardware-validated in the sense that no release was actually published to
check against; the network path is the same one the existing button already uses.
---
 Strand/App/ContentView.swift                  |   4 +
 Strand/Data/UpdateStore.swift                 |   9 +-
 Strand/Resources/Localizable.xcstrings        | 320 ++++++++++++++++++
 Strand/Screens/SettingsView.swift             |  23 +-
 Strand/Screens/UpdatesInboxView.swift         |   3 +
 Strand/System/UpdateAvailability.swift        | 176 ++++++++++
 Strand/System/UpdateChecker.swift             |  49 ++-
 StrandTests/UpdateAvailabilityTests.swift     | 129 +++++++
 StrandiOS/App/StrandiOSApp.swift              |   4 +
 .../src/main/java/com/noop/ui/MainActivity.kt |   6 +
 .../main/java/com/noop/ui/SettingsScreen.kt   |  42 +++
 .../src/main/java/com/noop/ui/UpdateStore.kt  |  14 +-
 .../java/com/noop/ui/UpdatesInboxScreen.kt    |   4 +
 .../com/noop/update/UpdateAvailability.kt     | 193 +++++++++++
 .../app/src/main/res/values-de/strings.xml    |   4 +
 .../app/src/main/res/values-es/strings.xml    |   4 +
 .../app/src/main/res/values-fr/strings.xml    |   4 +
 .../app/src/main/res/values-pl/strings.xml    |   4 +
 .../src/main/res/values-pt-rPT/strings.xml    |   4 +
 .../app/src/main/res/values-zh/strings.xml    |   4 +
 android/app/src/main/res/values/strings.xml   |   4 +
 .../com/noop/update/UpdateAvailabilityTest.kt | 133 ++++++++
 22 files changed, 1113 insertions(+), 24 deletions(-)
 create mode 100644 Strand/System/UpdateAvailability.swift
 create mode 100644 StrandTests/UpdateAvailabilityTests.swift
 create mode 100644 android/app/src/main/java/com/noop/update/UpdateAvailability.kt
 create mode 100644 android/app/src/test/java/com/noop/update/UpdateAvailabilityTest.kt

diff --git a/Strand/App/ContentView.swift b/Strand/App/ContentView.swift
index 43b312d241..6928a287ef 100644
--- a/Strand/App/ContentView.swift
+++ b/Strand/App/ContentView.swift
@@ -53,6 +53,10 @@ struct ContentView: View {
             // Seed the current What's New into the Updates inbox (idempotent per version) so the bell
             // collects it even if the user dismisses the auto sheet.
             UpdateStore.shared.seedWhatsNewIfNeeded()
+            // #1659: iOS cannot auto-update a sideloaded build - no API lets an app install or re-sign an
+            // .ipa - so the most NOOP can do is NOTICE a release and say so. Opt-in and silent when off,
+            // which is the default; see UpdateAvailability.defaultEnabled.
+            UpdateWatch.runIfDue(currentVersion: UpdateWatch.installedVersion, sideloadHint: false)
         }
         .onChangeCompat(of: acceptedTerms) { _ in showWhatsNewIfDue() }
     }
diff --git a/Strand/Data/UpdateStore.swift b/Strand/Data/UpdateStore.swift
index af0c1ac8ae..b0a6b27077 100644
--- a/Strand/Data/UpdateStore.swift
+++ b/Strand/Data/UpdateStore.swift
@@ -15,6 +15,10 @@ struct UpdateItem: Identifiable, Codable, Equatable {
         case whatsNew        // a release note (seeded from AppChangelog on first run after an update)
         case reading         // new data arrived (e.g. "N days backfilled") — links to Trends
         case strapAlert      // a strap-side heads-up (low battery, sync) — informational
+        /// A NEWER RELEASE exists that this install does not have (#1659). Deliberately not `.whatsNew`:
+        /// that one means "here is what you just got", this one means "here is what you have not got yet",
+        /// and giving them the same row would make the bell ambiguous at the moment it matters most.
+        case newVersion
     }
 
     let id: UUID
@@ -131,7 +135,10 @@ final class UpdateStore: ObservableObject {
     }
 
     private static func isInformational(_ kind: UpdateItem.Kind) -> Bool {
-        kind == .reading || kind == .whatsNew
+        // `.newVersion` is informational: it dedupes and is evictable like the others. It cannot spam on
+        // its own (UpdateAvailability posts once per version), but a user who ignores several releases
+        // should not have them crowd out the actionable rows.
+        kind == .reading || kind == .whatsNew || kind == .newVersion
     }
 
     /// Trim the informational backlog to the newest `maxItems`. Actionable rows (`.dismissedCard`,
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 32e4b87fff..d78bd6608c 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -50704,6 +50704,326 @@
         }
       }
     },
+    "Check automatically": {
+      "localizations": {
+        "de": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Automatisch prüfen"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Check automatically"
+          }
+        },
+        "es": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Comprobar automáticamente"
+          }
+        },
+        "fr": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Vérifier automatiquement"
+          }
+        },
+        "it": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Controlla automaticamente"
+          }
+        },
+        "pl": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Sprawdzaj automatycznie"
+          }
+        },
+        "pt-PT": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Verificar automaticamente"
+          }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Проверять автоматически"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "自动检查"
+          }
+        },
+        "zh-Hant": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "自動檢查"
+          }
+        }
+      }
+    },
+    "Once a day, NOOP asks GitHub for the latest version number and puts a note in Updates if there's a newer one. Nothing about you is sent, and it never installs anything.": {
+      "localizations": {
+        "de": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Einmal täglich fragt NOOP bei GitHub die neueste Versionsnummer ab und legt einen Hinweis in Updates ab, wenn es eine neuere gibt. Es werden keine Daten über dich gesendet, und es wird nie etwas installiert."
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Once a day, NOOP asks GitHub for the latest version number and puts a note in Updates if there's a newer one. Nothing about you is sent, and it never installs anything."
+          }
+        },
+        "es": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Una vez al día, NOOP consulta a GitHub el número de la última versión y deja un aviso en Novedades si hay una más reciente. No se envía nada sobre ti y nunca instala nada."
+          }
+        },
+        "fr": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Une fois par jour, NOOP demande à GitHub le numéro de la dernière version et dépose une note dans Mises à jour s'il en existe une plus récente. Aucune donnée vous concernant n'est envoyée, et rien n'est jamais installé."
+          }
+        },
+        "it": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Una volta al giorno, NOOP chiede a GitHub il numero dell'ultima versione e lascia una nota in Aggiornamenti se ne esiste una più recente. Non viene inviato nulla su di te e non installa mai nulla."
+          }
+        },
+        "pl": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Raz dziennie NOOP pyta GitHub o numer najnowszej wersji i dodaje notatkę w Aktualizacjach, jeśli jest nowsza. Nic o tobie nie jest wysyłane i nic nigdy nie jest instalowane."
+          }
+        },
+        "pt-PT": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Uma vez por dia, o NOOP pergunta ao GitHub o número da versão mais recente e deixa uma nota em Atualizações se existir uma mais recente. Não é enviado nada sobre si e nunca instala nada."
+          }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Раз в день NOOP запрашивает у GitHub номер последней версии и оставляет заметку в «Обновлениях», если появилась более новая. Ничего о вас не отправляется, и ничего никогда не устанавливается."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "NOOP 每天向 GitHub 查询一次最新版本号，如果有更新版本，就在「更新」中留下提示。不会发送任何与你有关的信息，也绝不会安装任何东西。"
+          }
+        },
+        "zh-Hant": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "NOOP 每天向 GitHub 查詢一次最新版本號，如果有更新版本，就在「更新」中留下提示。不會傳送任何與你有關的資訊，也絕不會安裝任何東西。"
+          }
+        }
+      }
+    },
+    "NOOP %@ is available": {
+      "localizations": {
+        "de": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "NOOP %@ ist verfügbar"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "NOOP %@ is available"
+          }
+        },
+        "es": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "NOOP %@ ya está disponible"
+          }
+        },
+        "fr": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "NOOP %@ est disponible"
+          }
+        },
+        "it": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "NOOP %@ è disponibile"
+          }
+        },
+        "pl": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "NOOP %@ jest dostępny"
+          }
+        },
+        "pt-PT": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "O NOOP %@ está disponível"
+          }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Доступна версия NOOP %@"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "NOOP %@ 可用"
+          }
+        },
+        "zh-Hant": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "NOOP %@ 可用"
+          }
+        }
+      }
+    },
+    "You're on %@. Open Settings and use Check for updates to see what's new and download %@.": {
+      "localizations": {
+        "de": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Du nutzt %@. Öffne die Einstellungen und tippe auf „Nach Updates suchen“, um die Neuerungen zu sehen und %@ herunterzuladen."
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "You're on %@. Open Settings and use Check for updates to see what's new and download %@."
+          }
+        },
+        "es": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Tienes la %@. Abre Ajustes y usa Buscar actualizaciones para ver las novedades y descargar la %@."
+          }
+        },
+        "fr": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Vous utilisez la version %@. Ouvrez les Réglages et utilisez Rechercher des mises à jour pour voir les nouveautés et télécharger la %@."
+          }
+        },
+        "it": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Stai usando la %@. Apri Impostazioni e usa Cerca aggiornamenti per vedere le novità e scaricare la %@."
+          }
+        },
+        "pl": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Masz wersję %@. Otwórz Ustawienia i użyj opcji Sprawdź aktualizacje, aby zobaczyć nowości i pobrać %@."
+          }
+        },
+        "pt-PT": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Tem a versão %@. Abra as Definições e use Procurar atualizações para ver as novidades e transferir a %@."
+          }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "У вас версия %@. Откройте «Настройки» и нажмите «Проверить обновления», чтобы посмотреть, что нового, и загрузить %@."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "你当前使用 %@。打开「设置」并使用「检查更新」查看新增内容并下载 %@。"
+          }
+        },
+        "zh-Hant": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "你目前使用 %@。開啟「設定」並使用「檢查更新」查看新增內容並下載 %@。"
+          }
+        }
+      }
+    },
+    "AltStore or SideStore can install it for you automatically if you added NOOP's source; a direct .ipa still has to be signed on your device.": {
+      "localizations": {
+        "de": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "AltStore oder SideStore installieren es automatisch für dich, wenn du NOOPs Quelle hinzugefügt hast; eine direkte .ipa muss weiterhin auf deinem Gerät signiert werden."
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "AltStore or SideStore can install it for you automatically if you added NOOP's source; a direct .ipa still has to be signed on your device."
+          }
+        },
+        "es": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "AltStore o SideStore pueden instalarla automáticamente si añadiste la fuente de NOOP; un .ipa directo aún debe firmarse en tu dispositivo."
+          }
+        },
+        "fr": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "AltStore ou SideStore peuvent l'installer automatiquement si vous avez ajouté la source de NOOP ; un .ipa direct doit toujours être signé sur votre appareil."
+          }
+        },
+        "it": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "AltStore o SideStore possono installarla automaticamente se hai aggiunto la sorgente di NOOP; un .ipa diretto deve comunque essere firmato sul tuo dispositivo."
+          }
+        },
+        "pl": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "AltStore lub SideStore zainstalują ją automatycznie, jeśli dodano źródło NOOP; bezpośredni plik .ipa nadal trzeba podpisać na urządzeniu."
+          }
+        },
+        "pt-PT": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "O AltStore ou o SideStore podem instalá-la automaticamente se adicionou a fonte do NOOP; um .ipa direto continua a ter de ser assinado no seu dispositivo."
+          }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "AltStore или SideStore установят её автоматически, если вы добавили источник NOOP; прямой .ipa всё равно нужно подписать на устройстве."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "如果你添加了 NOOP 的源，AltStore 或 SideStore 可以自动为你安装；直接下载的 .ipa 仍需在设备上签名。"
+          }
+        },
+        "zh-Hant": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "如果你加入了 NOOP 的來源，AltStore 或 SideStore 可以自動為你安裝；直接下載的 .ipa 仍需在裝置上簽名。"
+          }
+        }
+      }
+    },
     "Connected. Finishing the secure pairing handshake…": {
       "localizations": {
         "de": {
diff --git a/Strand/Screens/SettingsView.swift b/Strand/Screens/SettingsView.swift
index a27a1d141c..d3b2bb4cb6 100644
--- a/Strand/Screens/SettingsView.swift
+++ b/Strand/Screens/SettingsView.swift
@@ -294,6 +294,9 @@ struct SettingsView: View {
 
     /// User-initiated GitHub release check behind the About "Check for updates" button.
     @StateObject private var updateChecker = UpdateChecker()
+    /// #1659. Default comes from `UpdateAvailability.defaultEnabled` so the toggle and the launch check
+    /// cannot disagree about what "unset" means.
+    @AppStorage(UpdateWatch.Keys.enabled) private var autoCheckUpdates = UpdateAvailability.defaultEnabled
     @Environment(\.openURL) private var openURL
 
     /// Whether the "Advanced" disclosure (Recovery, Test Centre, experimental probes, Backup &
@@ -2627,9 +2630,7 @@ struct SettingsView: View {
     /// project.yml MARKETING_VERSION), so the About pill can never go stale the way a hand-edited
     /// Swift constant can. Mirrors how Android's pill reads BuildConfig.VERSION_NAME. Falls back to
     /// the hand-maintained changelog version only if the Info.plist key is somehow missing.
-    private var bundleVersionString: String {
-        (Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String) ?? AppChangelog.currentVersion
-    }
+    private var bundleVersionString: String { UpdateWatch.installedVersion }
 
     private var aboutCard: some View {
         SettingsSection(
@@ -2812,6 +2813,22 @@ struct SettingsView: View {
                         Spacer()
                     }
 
+                    // #1659: the automatic half. iOS cannot auto-update a sideloaded build at all — no API
+                    // lets an app install or re-sign an .ipa — so noticing and saying so is the whole of
+                    // what is possible. Off by default: an unasked-for launch request would contradict the
+                    // offline promise this project leads with.
+                    Toggle(isOn: $autoCheckUpdates) {
+                        VStack(alignment: .leading, spacing: 2) {
+                            Text("Check automatically")
+                                .font(StrandFont.subhead)
+                                .foregroundStyle(StrandPalette.textPrimary)
+                            Text("Once a day, NOOP asks GitHub for the latest version number and puts a note in Updates if there's a newer one. Nothing about you is sent, and it never installs anything.")
+                                .font(StrandFont.footnote)
+                                .foregroundStyle(StrandPalette.textSecondary)
+                        }
+                    }
+                    .tint(StrandPalette.accent)
+
                     // Update available: show what's new, with a download straight to the release.
                     if case .available(let v, let url, let notes) = updateChecker.state {
                         VStack(alignment: .leading, spacing: 8) {
diff --git a/Strand/Screens/UpdatesInboxView.swift b/Strand/Screens/UpdatesInboxView.swift
index ef80eb26db..d73f6b5d21 100644
--- a/Strand/Screens/UpdatesInboxView.swift
+++ b/Strand/Screens/UpdatesInboxView.swift
@@ -249,6 +249,8 @@ private struct UpdateRow: View {
         case .whatsNew:      return "sparkles"
         case .reading:       return "waveform.path.ecg"
         case .strapAlert:    return "exclamationmark.triangle"
+        // Distinct from `.whatsNew`'s sparkles on purpose: this is something you have NOT got yet.
+        case .newVersion:    return "arrow.down.circle"
         }
     }
 
@@ -259,6 +261,7 @@ private struct UpdateRow: View {
         case .whatsNew:      return StrandPalette.accent
         case .reading:       return StrandPalette.restColor
         case .strapAlert:    return StrandPalette.statusWarning
+        case .newVersion:    return StrandPalette.accent
         }
     }
 
diff --git a/Strand/System/UpdateAvailability.swift b/Strand/System/UpdateAvailability.swift
new file mode 100644
index 0000000000..cb288d7716
--- /dev/null
+++ b/Strand/System/UpdateAvailability.swift
@@ -0,0 +1,176 @@
+import Foundation
+import WhoopProtocol
+
+/// When may NOOP look for a newer release on its own, and when is that worth telling the user about?
+///
+/// The manual "Check for updates" button has always been deliberately user-initiated (see `UpdateChecker`).
+/// This adds the automatic half, for the reason #1659 asks for it: on iOS there is NO auto-update to fall
+/// back on. A sideloaded app cannot install or re-sign an `.ipa` — only AltStore/SideStore can, and only
+/// for people who added the source. Everyone else has no way to learn a release happened without going
+/// looking, which is exactly the state the issue describes.
+///
+/// So the most the app can honestly do is NOTICE and SAY SO. It posts into the Updates inbox the app
+/// already has, which means no new surface and no interruption: the bell picks up an unread row, the same
+/// way What's New does after an update.
+///
+/// Kotlin twin: `com.noop.update.UpdateAvailability`.
+enum UpdateAvailability {
+
+    /// OFF by default, and that is a deliberate reading of a hard project rule rather than timidity.
+    /// "Fully offline, on-device, no telemetry" is the headline promise, and both update checkers
+    /// currently justify themselves in their own doc comments as running ONLY on a tap. A check that
+    /// phones GitHub on launch without being asked would contradict that, however harmless the request
+    /// is. Flip this ONE constant to make it default-on; everything else about the feature is unchanged.
+    static let defaultEnabled = false
+
+    /// Once a day. The thing being watched moves on the order of days-to-weeks, so anything tighter spends
+    /// requests (and a little battery) to learn nothing.
+    static let checkInterval: TimeInterval = 24 * 60 * 60
+
+    /// May a background check run now?
+    ///
+    /// [lastCheckedAt] is epoch seconds, 0 meaning "never checked". A never-checked install is due
+    /// immediately, so turning the toggle on gives an answer during that session rather than tomorrow.
+    ///
+    /// A clock that has moved BACKWARDS (timezone edit, NTP correction, a restored backup) would otherwise
+    /// park the next check arbitrarily far in the future — `now < lastCheckedAt` is treated as due, which
+    /// self-heals on the next write.
+    static func shouldCheckNow(enabled: Bool,
+                               lastCheckedAt: TimeInterval,
+                               now: TimeInterval,
+                               interval: TimeInterval = checkInterval) -> Bool {
+        guard enabled else { return false }
+        if lastCheckedAt <= 0 { return true }
+        if now < lastCheckedAt { return true }          // clock went backwards — don't strand the check
+        return now - lastCheckedAt >= interval
+    }
+
+    /// Is this result worth a row in the inbox?
+    ///
+    /// ONCE PER VERSION. [lastPostedVersion] is persisted, so a user who reads the row and does nothing —
+    /// which on iOS may be entirely reasonable, since acting means AltStore or a re-sign — is not told
+    /// again tomorrow, and the day after. An app that nags about something the user cannot act on quickly
+    /// teaches people to ignore the bell, which costs more than the feature is worth.
+    static func shouldPost(latest: String, current: String, lastPostedVersion: String?) -> Bool {
+        guard VersionCheck.isNewer(latest, than: current) else { return false }
+        return latest != lastPostedVersion
+    }
+
+    /// Has the install CAUGHT UP with a version we previously announced?
+    ///
+    /// The row says "NOOP 10.7.0 is available". Once the user actually installs 10.7.0 that sentence is
+    /// false, and it sits in the inbox directly beside the What's New row for the same version — an app
+    /// telling you to get something you already have. Nothing else prunes it, because the row carries no
+    /// version field of its own; the persisted `lastPostedVersion` is what makes this answerable without
+    /// parsing the title back out.
+    ///
+    /// Must be evaluated even when the toggle is OFF: someone can post a row, switch the check off, then
+    /// update — and the stale row would otherwise outlive the feature that made it.
+    static func shouldPruneAnnouncement(lastPostedVersion: String?, current: String) -> Bool {
+        guard let posted = lastPostedVersion, !posted.isEmpty else { return false }
+        return !VersionCheck.isNewer(posted, than: current)
+    }
+
+    /// Assemble the row's body from ALREADY-LOCALIZED fragments.
+    ///
+    /// The copy itself deliberately does NOT live here any more. A first cut built these strings as a
+    /// byte-identical twin, the way the BLE diagnostic lines are — but that is the wrong half of the
+    /// parity contract. Analytics and stored data are byte-identical; user-facing copy is LOCALIZED per
+    /// platform, and the sibling What's New row on iOS already is. An unlocalized row would have sat in a
+    /// translated inbox in English, and no i18n gate would have caught it: they scan SwiftUI `Text` and
+    /// `@Composable` literals, not model-layer strings.
+    ///
+    /// What stays twinned is the ASSEMBLY — order, the single space, the blank line before notes, and the
+    /// trimming — which is real logic and is what the tests pin. The fragments are separate sentences, so
+    /// joining them cannot produce the word-order damage that concatenating clauses would.
+    static func composeMessage(body: String, sideload: String?, notes: String) -> String {
+        var s = body
+        if let sideload, !sideload.isEmpty { s += " " + sideload }
+        let trimmed = notes.trimmingCharacters(in: .whitespacesAndNewlines)
+        if !trimmed.isEmpty { s += "\n\n" + trimmed }
+        return s
+    }
+}
+
+// MARK: - The automatic check
+
+/// Drives the #1659 automatic check: decide, fetch, post, remember. Kept out of `UpdateAvailability` so
+/// that stays pure — every rule this obeys is tested there without a network or a clock.
+///
+/// Kotlin twin: `com.noop.update.UpdateWatch`.
+enum UpdateWatch {
+
+    enum Keys {
+        /// Opt-in. See `UpdateAvailability.defaultEnabled` for why this is off until asked for.
+        static let enabled = "updates.autoCheck"
+        static let lastCheckedAt = "updates.lastCheckedAt"
+        static let lastPostedVersion = "updates.lastPostedVersion"
+    }
+
+    /// The real marketing version straight from the bundle (CFBundleShortVersionString, set from
+    /// project.yml MARKETING_VERSION), so a check can never compare against a hand-edited constant that
+    /// has gone stale — which is exactly the bug that once told v7 users they were behind. Hoisted here
+    /// from SettingsView, which had it private, so the button and the automatic check cannot disagree
+    /// about what version is installed.
+    static var installedVersion: String {
+        (Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String) ?? AppChangelog.currentVersion
+    }
+
+    /// Re-entrancy guard. `runIfDue` is called from `.onAppear`, which is not guaranteed to fire once,
+    /// and the day's slot is stamped INSIDE the task — so two appearances in quick succession could both
+    /// pass the due check before either had written anything, and fire two requests for one answer.
+    @MainActor private static var inFlight = false
+
+    static var isEnabled: Bool {
+        UserDefaults.standard.object(forKey: Keys.enabled) as? Bool ?? UpdateAvailability.defaultEnabled
+    }
+
+    /// Run a check if one is due, and post to the inbox if the result is worth saying.
+    ///
+    /// Every early return is silent BY DESIGN — this runs at launch, and an install with the toggle off
+    /// (the default) must produce no line, no request and no trace. The manual button remains the loud
+    /// path: it reports "couldn't check", because there a human is waiting on an answer.
+    @MainActor
+    static func runIfDue(currentVersion: String, sideloadHint: Bool, now: Date = Date()) {
+        let d = UserDefaults.standard
+        // Runs before every guard below, including the toggle: a stale announcement must not outlive the
+        // feature that posted it (see `shouldPruneAnnouncement`).
+        if UpdateAvailability.shouldPruneAnnouncement(
+            lastPostedVersion: d.string(forKey: Keys.lastPostedVersion), current: currentVersion) {
+            for item in UpdateStore.shared.items where item.kind == .newVersion {
+                UpdateStore.shared.remove(item.id)
+            }
+            d.removeObject(forKey: Keys.lastPostedVersion)
+        }
+        guard !inFlight else { return }
+        guard UpdateAvailability.shouldCheckNow(enabled: isEnabled,
+                                                lastCheckedAt: d.double(forKey: Keys.lastCheckedAt),
+                                                now: now.timeIntervalSince1970) else { return }
+        inFlight = true
+        Task {
+            defer { inFlight = false }
+            // Stamped BEFORE the result is examined, and deliberately: a failed or unparseable read must
+            // still consume the day's slot. Stamping only on success would retry every launch for as long
+            // as GitHub is unreachable, which is the one shape a background check must never take.
+            d.set(now.timeIntervalSince1970, forKey: Keys.lastCheckedAt)
+            guard let release = await UpdateChecker.fetchLatest() else { return }
+            guard UpdateAvailability.shouldPost(latest: release.version,
+                                                current: currentVersion,
+                                                lastPostedVersion: d.string(forKey: Keys.lastPostedVersion))
+            else { return }
+            d.set(release.version, forKey: Keys.lastPostedVersion)
+            // Localized HERE, at the platform edge, so the row reads in the user's language like the
+            // What's New row beside it. `composeMessage` only assembles what it is handed.
+            let body = String(localized: "You're on \(currentVersion). Open Settings and use Check for updates to see what's new and download \(release.version).")
+            let sideload = sideloadHint
+                ? String(localized: "AltStore or SideStore can install it for you automatically if you added NOOP's source; a direct .ipa still has to be signed on your device.")
+                : nil
+            UpdateStore.shared.post(UpdateItem(
+                kind: .newVersion,
+                title: String(localized: "NOOP \(release.version) is available"),
+                message: UpdateAvailability.composeMessage(body: body,
+                                                           sideload: sideload,
+                                                           notes: release.notes)))
+        }
+    }
+}
diff --git a/Strand/System/UpdateChecker.swift b/Strand/System/UpdateChecker.swift
index c43de30b16..56597e7693 100644
--- a/Strand/System/UpdateChecker.swift
+++ b/Strand/System/UpdateChecker.swift
@@ -20,30 +20,43 @@ final class UpdateChecker: ObservableObject {
 
     private static let endpoint = URL(string: "https://api.github.com/repos/ryanbr/noop/releases/latest")!
 
+    /// One release read. Shared by the button and the automatic check (#1659) so there is exactly one
+    /// copy of the endpoint, the headers and the parsing — a second copy is how the two would drift into
+    /// disagreeing about what "latest" means.
+    struct Release: Equatable {
+        let version: String
+        let url: URL
+        let notes: String
+    }
+
+    static func fetchLatest() async -> Release? {
+        do {
+            var req = URLRequest(url: Self.endpoint, timeoutInterval: 12)
+            req.setValue("application/vnd.github+json", forHTTPHeaderField: "Accept")
+            let (data, resp) = try await URLSession.shared.data(for: req)
+            guard (resp as? HTTPURLResponse)?.statusCode == 200,
+                  let json = try JSONSerialization.jsonObject(with: data) as? [String: Any],
+                  let tag = json["tag_name"] as? String,
+                  let urlString = json["html_url"] as? String,
+                  let url = URL(string: urlString) else { return nil }
+            let latest = tag.hasPrefix("v") ? String(tag.dropFirst()) : tag
+            return Release(version: latest, url: url, notes: cleanNotes(json["body"] as? String ?? ""))
+        } catch {
+            return nil
+        }
+    }
+
     func check(currentVersion: String) {
         guard state != .checking else { return }
         state = .checking
         Task {
-            do {
-                var req = URLRequest(url: Self.endpoint, timeoutInterval: 12)
-                req.setValue("application/vnd.github+json", forHTTPHeaderField: "Accept")
-                let (data, resp) = try await URLSession.shared.data(for: req)
-                guard (resp as? HTTPURLResponse)?.statusCode == 200,
-                      let json = try JSONSerialization.jsonObject(with: data) as? [String: Any],
-                      let tag = json["tag_name"] as? String,
-                      let urlString = json["html_url"] as? String,
-                      let url = URL(string: urlString) else {
-                    state = .failed
-                    return
-                }
-                let latest = tag.hasPrefix("v") ? String(tag.dropFirst()) : tag
-                let notes = Self.cleanNotes(json["body"] as? String ?? "")
-                state = VersionCheck.isNewer(latest, than: currentVersion)
-                    ? .available(version: latest, url: url, notes: notes)
-                    : .upToDate(version: latest)
-            } catch {
+            guard let release = await Self.fetchLatest() else {
                 state = .failed
+                return
             }
+            state = VersionCheck.isNewer(release.version, than: currentVersion)
+                ? .available(version: release.version, url: release.url, notes: release.notes)
+                : .upToDate(version: release.version)
         }
     }
 
diff --git a/StrandTests/UpdateAvailabilityTests.swift b/StrandTests/UpdateAvailabilityTests.swift
new file mode 100644
index 0000000000..9c4e931106
--- /dev/null
+++ b/StrandTests/UpdateAvailabilityTests.swift
@@ -0,0 +1,129 @@
+import XCTest
+@testable import Strand
+
+/// The #1659 automatic update check.
+///
+/// iOS cannot auto-update a sideloaded build — no API lets an app install or re-sign an `.ipa` — so the
+/// most NOOP can do is notice a release and say so. These rules decide when it may look, and when the
+/// result is worth a row in the Updates inbox.
+final class UpdateAvailabilityTests: XCTestCase {
+
+    private let day = UpdateAvailability.checkInterval
+
+    // MARK: - when it may look
+
+    /// Off by default, and off means SILENT: no request, no line, no trace. That is what keeps the
+    /// feature compatible with the project's offline promise.
+    func testDisabledNeverChecks() {
+        XCTAssertFalse(UpdateAvailability.shouldCheckNow(enabled: false, lastCheckedAt: 0, now: 1_000_000))
+        XCTAssertFalse(UpdateAvailability.shouldCheckNow(enabled: false, lastCheckedAt: 1, now: 1_000_000))
+    }
+
+    /// Turning the toggle on should answer during THAT session, not tomorrow.
+    func testANeverCheckedInstallIsDueImmediately() {
+        XCTAssertTrue(UpdateAvailability.shouldCheckNow(enabled: true, lastCheckedAt: 0, now: 1_000_000))
+    }
+
+    func testItWaitsOutTheInterval() {
+        let t = 1_000_000.0
+        XCTAssertFalse(UpdateAvailability.shouldCheckNow(enabled: true, lastCheckedAt: t, now: t + day - 1))
+        XCTAssertTrue(UpdateAvailability.shouldCheckNow(enabled: true, lastCheckedAt: t, now: t + day))
+        XCTAssertTrue(UpdateAvailability.shouldCheckNow(enabled: true, lastCheckedAt: t, now: t + day * 3))
+    }
+
+    /// A clock that moves BACKWARDS — timezone edit, NTP correction, a restored backup — would otherwise
+    /// park the next check arbitrarily far in the future. Treating it as due self-heals on the next write.
+    func testAClockGoingBackwardsDoesNotStrandTheCheck() {
+        let t = 1_000_000.0
+        XCTAssertTrue(UpdateAvailability.shouldCheckNow(enabled: true, lastCheckedAt: t, now: t - 5))
+        XCTAssertTrue(UpdateAvailability.shouldCheckNow(enabled: true, lastCheckedAt: t, now: t - day * 400))
+    }
+
+    // MARK: - when it is worth saying
+
+    func testItPostsOnlyForANewerVersion() {
+        XCTAssertTrue(UpdateAvailability.shouldPost(latest: "10.7.0", current: "10.6.0", lastPostedVersion: nil))
+        XCTAssertFalse(UpdateAvailability.shouldPost(latest: "10.6.0", current: "10.6.0", lastPostedVersion: nil))
+        XCTAssertFalse(UpdateAvailability.shouldPost(latest: "10.5.0", current: "10.6.0", lastPostedVersion: nil))
+    }
+
+    /// ONCE PER VERSION. On iOS acting means AltStore or a re-sign, so a user may reasonably read the row
+    /// and do nothing — and an app that repeats itself daily about something the user has already seen
+    /// teaches people to ignore the bell, which costs more than the feature is worth.
+    func testItNeverNagsAboutAVersionAlreadyPosted() {
+        XCTAssertFalse(UpdateAvailability.shouldPost(latest: "10.7.0", current: "10.6.0",
+                                                     lastPostedVersion: "10.7.0"))
+        // …but the NEXT release is new news again.
+        XCTAssertTrue(UpdateAvailability.shouldPost(latest: "10.8.0", current: "10.6.0",
+                                                    lastPostedVersion: "10.7.0"))
+    }
+
+    /// The counters are versions, not booleans: a user who skipped 10.7.0 and is still on 10.6.0 must
+    /// still hear about 10.8.0.
+    func testSkippingAReleaseDoesNotSilenceTheNextOne() {
+        XCTAssertTrue(UpdateAvailability.shouldPost(latest: "11.0.0", current: "10.6.0",
+                                                    lastPostedVersion: "10.7.0"))
+    }
+
+    // MARK: - the inbox row
+
+    /// `.newVersion` must be INFORMATIONAL so it dedupes and can be evicted. It cannot spam on its own,
+    /// but a user who ignores several releases should not have them crowd out the actionable rows.
+    func testTheRowIsInformationalAndDistinctFromWhatsNew() {
+        let item = UpdateItem(kind: .newVersion, title: "t", message: "m")
+        XCTAssertEqual(item.kind, .newVersion)
+        XCTAssertNotEqual(item.kind, .whatsNew)
+        // Round-trips through the persisted store's Codable rawValue.
+        XCTAssertEqual(UpdateItem.Kind(rawValue: "newVersion"), .newVersion)
+    }
+
+    // MARK: - pruning a stale announcement
+
+    /// The row says "10.7.0 is available". Once the user installs 10.7.0 that sentence is false, and it
+    /// sits beside the What's New row for the same version — an app telling you to get what you have.
+    func testTheAnnouncementIsPrunedOnceInstalled() {
+        XCTAssertTrue(UpdateAvailability.shouldPruneAnnouncement(lastPostedVersion: "10.7.0", current: "10.7.0"))
+        // Overshot it (a user who jumped straight to 10.8.0) — equally stale.
+        XCTAssertTrue(UpdateAvailability.shouldPruneAnnouncement(lastPostedVersion: "10.7.0", current: "10.8.0"))
+    }
+
+    /// Still behind: the row is still TRUE and must survive, or the announcement would delete itself on
+    /// the very next launch and the feature would do nothing at all.
+    func testAnAnnouncementStillAheadSurvives() {
+        XCTAssertFalse(UpdateAvailability.shouldPruneAnnouncement(lastPostedVersion: "10.7.0", current: "10.6.0"))
+    }
+
+    func testNothingAnnouncedIsNothingToPrune() {
+        XCTAssertFalse(UpdateAvailability.shouldPruneAnnouncement(lastPostedVersion: nil, current: "10.6.0"))
+        XCTAssertFalse(UpdateAvailability.shouldPruneAnnouncement(lastPostedVersion: "", current: "10.6.0"))
+    }
+
+    // MARK: - assembling the row body
+
+    /// The COPY is localized at the platform edge now, so what is pinned here is the ASSEMBLY: order, the
+    /// single space between sentences, the blank line before notes, and the trimming. A first cut tested
+    /// the English strings byte-for-byte against Kotlin — the wrong property, and one that would have
+    /// stayed green while the row rendered in English inside a translated inbox.
+    func testComposeJoinsSentencesWithASingleSpace() {
+        XCTAssertEqual(UpdateAvailability.composeMessage(body: "A.", sideload: "B.", notes: ""), "A. B.")
+    }
+
+    func testComposeOmitsAnAbsentOrEmptySideloadSentence() {
+        XCTAssertEqual(UpdateAvailability.composeMessage(body: "A.", sideload: nil, notes: ""), "A.")
+        XCTAssertEqual(UpdateAvailability.composeMessage(body: "A.", sideload: "", notes: ""), "A.")
+    }
+
+    /// Release notes are a block, not a sentence: blank line before, and trimmed — GitHub bodies arrive
+    /// with padding.
+    func testComposeAppendsTrimmedNotesAfterABlankLine() {
+        XCTAssertEqual(UpdateAvailability.composeMessage(body: "A.", sideload: nil, notes: "  N.  "),
+                       "A.\n\nN.")
+        XCTAssertEqual(UpdateAvailability.composeMessage(body: "A.", sideload: "B.", notes: "N."),
+                       "A. B.\n\nN.")
+    }
+
+    /// Whitespace-only notes must not leave a trailing blank line hanging in the row.
+    func testComposeTreatsBlankNotesAsNone() {
+        XCTAssertEqual(UpdateAvailability.composeMessage(body: "A.", sideload: nil, notes: "   \n  "), "A.")
+    }
+}
diff --git a/StrandiOS/App/StrandiOSApp.swift b/StrandiOS/App/StrandiOSApp.swift
index 366bc066e0..6a105c3b72 100644
--- a/StrandiOS/App/StrandiOSApp.swift
+++ b/StrandiOS/App/StrandiOSApp.swift
@@ -400,6 +400,10 @@ private struct iOSRootView: View {
             // Seed the current What's New into the Updates inbox (idempotent per version) so the bell
             // collects it even if the user dismisses the auto sheet.
             UpdateStore.shared.seedWhatsNewIfNeeded()
+            // #1659: iOS cannot auto-update a sideloaded build - no API lets an app install or re-sign an
+            // .ipa - so the most NOOP can do is NOTICE a release and say so. Opt-in and silent when off,
+            // which is the default; see UpdateAvailability.defaultEnabled.
+            UpdateWatch.runIfDue(currentVersion: UpdateWatch.installedVersion, sideloadHint: true)
         }
         .onChange(of: acceptedTerms) { _, _ in showWhatsNewIfDue() }
     }
diff --git a/android/app/src/main/java/com/noop/ui/MainActivity.kt b/android/app/src/main/java/com/noop/ui/MainActivity.kt
index 210ddca0a3..3446218164 100644
--- a/android/app/src/main/java/com/noop/ui/MainActivity.kt
+++ b/android/app/src/main/java/com/noop/ui/MainActivity.kt
@@ -1329,6 +1329,12 @@ fun NoopRoot() {
     // bell in the Today header surfaces it; the inbox row deep-links to the full changelog read.
     LaunchedEffect(onboarded) {
         if (onboarded) UpdateStore.from(context).seedWhatsNewIfNeeded()
+        // #1659: a sideloaded build has no store to update it, so the most NOOP can do is NOTICE a
+        // release and say so in the same inbox. Opt-in, and silent when off, which is the default —
+        // see UpdateAvailability.DEFAULT_ENABLED. Onboarded-only for the same reason as the seed above.
+        if (onboarded) {
+            com.noop.update.UpdateWatch.runIfDue(context, BuildConfig.VERSION_NAME)
+        }
     }
 
     // Terms acknowledgment gate, over EVERYTHING (before onboarding/pairing/Bluetooth) until the
diff --git a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
index 4f585e5392..9913e28dbe 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
@@ -3340,6 +3340,13 @@ fun SettingsScreen(
                 // is sent. Android already holds INTERNET (for the opt-in Coach), so this adds nothing.
                 var updChecking by remember { mutableStateOf(false) }
                 var updResult by remember { mutableStateOf<UpdateCheck.Result?>(null) }
+                // #1659: the automatic half. A sideloaded build has no store to update it, so noticing a
+                // release and saying so in the Updates inbox is the whole of what is possible. Off by
+                // default: an unasked-for launch request would contradict the offline promise this project
+                // leads with. See UpdateAvailability.DEFAULT_ENABLED.
+                var autoCheck by remember {
+                    mutableStateOf(com.noop.update.UpdateWatch.isEnabled(context))
+                }
                 Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
                     Row(
                         verticalAlignment = Alignment.CenterVertically,
@@ -3385,6 +3392,41 @@ fun SettingsScreen(
                         }
                     }
 
+                    // #1659: the automatic half, directly under the manual button so the two read as one
+                    // feature — the same placement as the Swift twin.
+                    Row(
+                        verticalAlignment = Alignment.CenterVertically,
+                        horizontalArrangement = Arrangement.spacedBy(10.dp),
+                        modifier = Modifier.fillMaxWidth(),
+                    ) {
+                        Column(modifier = Modifier.weight(1f)) {
+                            Text(
+                                uiString(R.string.l10n_settings_screen_check_automatically_7cd229d2),
+                                style = NoopType.subhead,
+                                color = Palette.textPrimary,
+                            )
+                            Text(
+                                uiString(R.string.l10n_settings_screen_once_a_day_noop_asks_github_5683aad3),
+                                style = NoopType.footnote,
+                                color = Palette.textTertiary,
+                            )
+                        }
+                        Switch(
+                            checked = autoCheck,
+                            onCheckedChange = {
+                                autoCheck = it
+                                com.noop.update.UpdateWatch.setEnabled(context, it)
+                            },
+                            colors = SwitchDefaults.colors(
+                                checkedThumbColor = Palette.surfaceBase,
+                                checkedTrackColor = Palette.accent,
+                                uncheckedThumbColor = Palette.textSecondary,
+                                uncheckedTrackColor = Palette.surfaceInset,
+                                uncheckedBorderColor = Palette.hairline,
+                            ),
+                        )
+                    }
+
                     // Update available: show what's new, with a download straight to the release.
                     (updResult as? UpdateCheck.Result.Available)?.let { avail ->
                         Column(
diff --git a/android/app/src/main/java/com/noop/ui/UpdateStore.kt b/android/app/src/main/java/com/noop/ui/UpdateStore.kt
index 23fb7b8da8..7f6fd14155 100644
--- a/android/app/src/main/java/com/noop/ui/UpdateStore.kt
+++ b/android/app/src/main/java/com/noop/ui/UpdateStore.kt
@@ -31,7 +31,14 @@ enum class UpdateKind(val storageValue: String) {
     READING("reading"),
 
     /** a strap-side heads-up (low battery, sync) — informational */
-    STRAP_ALERT("strapAlert");
+    STRAP_ALERT("strapAlert"),
+
+    /**
+     * A NEWER RELEASE exists that this install does not have (#1659). Deliberately not [WHATS_NEW]: that
+     * one means "here is what you just got", this one means "here is what you have not got yet", and
+     * giving them the same row would make the bell ambiguous at the moment it matters most.
+     */
+    NEW_VERSION("newVersion");
 
     companion object {
         fun fromStorage(raw: String?): UpdateKind =
@@ -197,7 +204,10 @@ class UpdateStore private constructor(private val prefs: SharedPreferences) {
     }
 
     private fun isInformational(kind: UpdateKind): Boolean =
-        kind == UpdateKind.READING || kind == UpdateKind.WHATS_NEW
+        // NEW_VERSION is informational: it dedupes and is evictable like the others. It cannot spam on its
+        // own (UpdateAvailability posts once per version), but a user who ignores several releases should
+        // not have them crowd out the actionable rows.
+        kind == UpdateKind.READING || kind == UpdateKind.WHATS_NEW || kind == UpdateKind.NEW_VERSION
 
     /** Trim the informational backlog to the newest [MAX_ITEMS]. Actionable rows
      *  ([UpdateKind.DISMISSED_CARD]/[UpdateKind.STRAP_ALERT]) are exempt — only READING/WHATS_NEW are
diff --git a/android/app/src/main/java/com/noop/ui/UpdatesInboxScreen.kt b/android/app/src/main/java/com/noop/ui/UpdatesInboxScreen.kt
index d51cc2b34f..0facfd387d 100644
--- a/android/app/src/main/java/com/noop/ui/UpdatesInboxScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/UpdatesInboxScreen.kt
@@ -27,6 +27,7 @@ import androidx.compose.material.icons.outlined.AutoAwesome
 import androidx.compose.material.icons.outlined.DeleteSweep
 import androidx.compose.material.icons.outlined.Done
 import androidx.compose.material.icons.outlined.DoneAll
+import androidx.compose.material.icons.outlined.Download
 import androidx.compose.material.icons.outlined.Layers
 import androidx.compose.material.icons.outlined.MonitorHeart
 import androidx.compose.material.icons.outlined.NotificationsOff
@@ -405,6 +406,8 @@ private fun kindIcon(kind: UpdateKind): ImageVector = when (kind) {
     UpdateKind.WHATS_NEW -> Icons.Outlined.AutoAwesome
     UpdateKind.READING -> Icons.Outlined.MonitorHeart
     UpdateKind.STRAP_ALERT -> Icons.Outlined.Warning
+    // Distinct from WHATS_NEW's sparkle on purpose: this is something you have NOT got yet.
+    UpdateKind.NEW_VERSION -> Icons.Outlined.Download
 }
 
 /** A per-kind tint drawn from the domain palette so each row reads in its own colour world.
@@ -414,6 +417,7 @@ private fun kindTint(kind: UpdateKind): Color = when (kind) {
     UpdateKind.WHATS_NEW -> Palette.accent
     UpdateKind.READING -> Palette.restColor
     UpdateKind.STRAP_ALERT -> Palette.statusWarning
+    UpdateKind.NEW_VERSION -> Palette.accent
 }
 
 /** Tapping a row marks it read, then routes if it carries a deep link (else just stays open). */
diff --git a/android/app/src/main/java/com/noop/update/UpdateAvailability.kt b/android/app/src/main/java/com/noop/update/UpdateAvailability.kt
new file mode 100644
index 0000000000..7c119da2c2
--- /dev/null
+++ b/android/app/src/main/java/com/noop/update/UpdateAvailability.kt
@@ -0,0 +1,193 @@
+package com.noop.update
+
+/**
+ * When may NOOP look for a newer release on its own, and when is that worth telling the user about?
+ *
+ * The manual "Check for updates" button has always been deliberately user-initiated (see [UpdateCheck]).
+ * This adds the automatic half, for the reason #1659 asks for it: on iOS there is NO auto-update to fall
+ * back on. A sideloaded app cannot install or re-sign an `.ipa` — only AltStore/SideStore can, and only
+ * for people who added the source. Everyone else has no way to learn a release happened without going
+ * looking, which is exactly the state the issue describes. Android sideloads share the problem, minus the
+ * seven-day re-sign.
+ *
+ * So the most the app can honestly do is NOTICE and SAY SO. It posts into the Updates inbox the app
+ * already has, which means no new surface and no interruption: the bell picks up an unread row, the same
+ * way What's New does after an update.
+ *
+ * Swift twin: `UpdateAvailability`.
+ */
+object UpdateAvailability {
+
+    /**
+     * OFF by default, and that is a deliberate reading of a hard project rule rather than timidity.
+     * "Fully offline, on-device, no telemetry" is the headline promise, and both update checkers
+     * currently justify themselves in their own doc comments as running ONLY on a tap. A check that
+     * phones GitHub on launch without being asked would contradict that, however harmless the request
+     * is. Flip this ONE constant to make it default-on; everything else about the feature is unchanged.
+     */
+    const val DEFAULT_ENABLED = false
+
+    /** Once a day. The thing being watched moves on the order of days-to-weeks, so anything tighter
+     *  spends requests (and a little battery) to learn nothing. */
+    const val CHECK_INTERVAL_MS = 24L * 60L * 60L * 1000L
+
+    /**
+     * May a background check run now?
+     *
+     * [lastCheckedAtMs] is epoch millis, 0 meaning "never checked". A never-checked install is due
+     * immediately, so turning the toggle on gives an answer during that session rather than tomorrow.
+     *
+     * A clock that has moved BACKWARDS (timezone edit, NTP correction, a restored backup) would otherwise
+     * park the next check arbitrarily far in the future — `now < lastCheckedAt` is treated as due, which
+     * self-heals on the next write.
+     */
+    fun shouldCheckNow(
+        enabled: Boolean,
+        lastCheckedAtMs: Long,
+        nowMs: Long,
+        intervalMs: Long = CHECK_INTERVAL_MS,
+    ): Boolean {
+        if (!enabled) return false
+        if (lastCheckedAtMs <= 0L) return true
+        if (nowMs < lastCheckedAtMs) return true       // clock went backwards — don't strand the check
+        return nowMs - lastCheckedAtMs >= intervalMs
+    }
+
+    /**
+     * Is this result worth a row in the inbox?
+     *
+     * ONCE PER VERSION. [lastPostedVersion] is persisted, so a user who reads the row and does nothing is
+     * not told again tomorrow, and the day after. An app that nags about something the user may not want
+     * to act on quickly teaches people to ignore the bell, which costs more than the feature is worth.
+     */
+    fun shouldPost(latest: String, current: String, lastPostedVersion: String?): Boolean {
+        if (!UpdateCheck.isNewer(latest, current)) return false
+        return latest != lastPostedVersion
+    }
+
+    /**
+     * Has the install CAUGHT UP with a version we previously announced?
+     *
+     * The row says "NOOP 10.7.0 is available". Once the user actually installs 10.7.0 that sentence is
+     * false, and it sits in the inbox directly beside the What's New row for the same version — an app
+     * telling you to get something you already have. Nothing else prunes it, because the row carries no
+     * version field of its own; the persisted last-posted version is what makes this answerable without
+     * parsing the title back out.
+     *
+     * Must be evaluated even when the toggle is OFF: someone can post a row, switch the check off, then
+     * update — and the stale row would otherwise outlive the feature that made it.
+     */
+    fun shouldPruneAnnouncement(lastPostedVersion: String?, current: String): Boolean {
+        if (lastPostedVersion.isNullOrEmpty()) return false
+        return !UpdateCheck.isNewer(lastPostedVersion, current)
+    }
+
+    /**
+     * Assemble the row's body from ALREADY-LOCALIZED fragments.
+     *
+     * The copy itself deliberately does NOT live here any more. A first cut built these strings as a
+     * byte-identical twin, the way the BLE diagnostic lines are — but that is the wrong half of the
+     * parity contract. Analytics and stored data are byte-identical; user-facing copy is LOCALIZED per
+     * platform. An unlocalized row would have sat in a translated inbox in English, and no i18n gate
+     * would have caught it: they scan `Text` and `@Composable` literals, not model-layer strings.
+     *
+     * What stays twinned is the ASSEMBLY — order, the single space, the blank line before notes, and the
+     * trimming — which is real logic and is what the tests pin. The fragments are separate sentences, so
+     * joining them cannot produce the word-order damage that concatenating clauses would.
+     */
+    fun composeMessage(body: String, sideload: String?, notes: String): String {
+        var s = body
+        if (!sideload.isNullOrEmpty()) s += " " + sideload
+        val trimmed = notes.trim()
+        if (trimmed.isNotEmpty()) s += "\n\n" + trimmed
+        return s
+    }
+}
+
+/**
+ * Drives the #1659 automatic check: decide, fetch, post, remember. Kept out of [UpdateAvailability] so
+ * that stays pure — every rule this obeys is tested there without a network or a clock.
+ *
+ * Swift twin: `UpdateWatch`.
+ */
+object UpdateWatch {
+
+    /** Opt-in. See [UpdateAvailability.DEFAULT_ENABLED] for why this is off until asked for. */
+    const val KEY_ENABLED = "updates.autoCheck"
+    const val KEY_LAST_CHECKED_AT = "updates.lastCheckedAt"
+    const val KEY_LAST_POSTED_VERSION = "updates.lastPostedVersion"
+
+    fun isEnabled(context: android.content.Context): Boolean =
+        prefs(context).getBoolean(KEY_ENABLED, UpdateAvailability.DEFAULT_ENABLED)
+
+    fun setEnabled(context: android.content.Context, on: Boolean) {
+        prefs(context).edit().putBoolean(KEY_ENABLED, on).apply()
+    }
+
+    private fun prefs(context: android.content.Context) =
+        context.getSharedPreferences(com.noop.ui.NoopPrefs.NAME, android.content.Context.MODE_PRIVATE)
+
+    /**
+     * Run a check if one is due, and post to the inbox if the result is worth saying.
+     *
+     * Every early return is silent BY DESIGN — this runs at launch, and an install with the toggle off
+     * (the default) must produce no line, no request and no trace. The manual button remains the loud
+     * path: it reports "couldn't check", because there a human is waiting on an answer.
+     *
+     * [nowMs] is injected so the caller's clock is the only one, and tests need no real one.
+     */
+    suspend fun runIfDue(
+        context: android.content.Context,
+        currentVersion: String,
+        nowMs: Long = System.currentTimeMillis(),
+    ) {
+        val p = prefs(context)
+        // Runs before every guard below, including the toggle: a stale announcement must not outlive the
+        // feature that posted it (see [UpdateAvailability.shouldPruneAnnouncement]).
+        if (UpdateAvailability.shouldPruneAnnouncement(
+                p.getString(KEY_LAST_POSTED_VERSION, null), currentVersion)
+        ) {
+            val store = com.noop.ui.UpdateStore.from(context)
+            store.items.filter { it.kind == com.noop.ui.UpdateKind.NEW_VERSION }
+                .forEach { store.remove(it.id) }
+            p.edit().remove(KEY_LAST_POSTED_VERSION).apply()
+        }
+        if (!UpdateAvailability.shouldCheckNow(
+                enabled = isEnabled(context),
+                lastCheckedAtMs = p.getLong(KEY_LAST_CHECKED_AT, 0L),
+                nowMs = nowMs,
+            )
+        ) return
+        // Stamped BEFORE the result is examined, and deliberately: a failed or unparseable read must still
+        // consume the day's slot. Stamping only on success would retry every launch for as long as GitHub
+        // is unreachable, which is the one shape a background check must never take.
+        p.edit().putLong(KEY_LAST_CHECKED_AT, nowMs).apply()
+        val result = runCatching { UpdateCheck.check(currentVersion) }.getOrNull()
+        val available = result as? UpdateCheck.Result.Available ?: return
+        if (!UpdateAvailability.shouldPost(
+                latest = available.version,
+                current = currentVersion,
+                lastPostedVersion = p.getString(KEY_LAST_POSTED_VERSION, null),
+            )
+        ) return
+        p.edit().putString(KEY_LAST_POSTED_VERSION, available.version).apply()
+        // Localized HERE, at the platform edge, so the row reads in the user's language; composeMessage
+        // only assembles what it is handed. No sideload sentence on Android: an APK has no seven-day
+        // re-sign and no AltStore, so the iOS-only advice would be noise. That is the one place the
+        // twins legitimately differ.
+        com.noop.ui.UpdateStore.from(context).post(
+            com.noop.ui.UpdateItem(
+                kind = com.noop.ui.UpdateKind.NEW_VERSION,
+                title = context.getString(
+                    com.noop.R.string.l10n_updates_noop_1s_is_available_05d8ef55, available.version),
+                message = UpdateAvailability.composeMessage(
+                    body = context.getString(
+                        com.noop.R.string.l10n_updates_youre_on_1s_open_settings_and_35b9e135,
+                        currentVersion, available.version),
+                    sideload = null,
+                    notes = available.notes,
+                ),
+            )
+        )
+    }
+}
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 9e3ed58127..f18158e664 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2468,4 +2468,8 @@
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">Android um Kopplung bitten</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Hello trotz Kopplungsverweigerung senden (experimentell)</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Hello trotz Kopplungsverweigerung senden</string>
+    <string name="l10n_settings_screen_check_automatically_7cd229d2">Automatisch prüfen</string>
+    <string name="l10n_settings_screen_once_a_day_noop_asks_github_5683aad3">Einmal täglich fragt NOOP bei GitHub die neueste Versionsnummer ab und legt einen Hinweis in Updates ab, wenn es eine neuere gibt. Es werden keine Daten über dich gesendet, und es wird nie etwas installiert.</string>
+    <string name="l10n_updates_noop_1s_is_available_05d8ef55">NOOP %1$s ist verfügbar</string>
+    <string name="l10n_updates_youre_on_1s_open_settings_and_35b9e135">Du nutzt %1$s. Öffne die Einstellungen und tippe auf „Nach Updates suchen“, um die Neuerungen zu sehen und %2$s herunterzuladen.</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 41fac8272a..e0041e4150 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2454,4 +2454,8 @@
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">Pedir a Android que vincule</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Enviar hello pese al rechazo de vinculación (experimental)</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Enviar hello pese al rechazo de vinculación</string>
+    <string name="l10n_settings_screen_check_automatically_7cd229d2">Comprobar automáticamente</string>
+    <string name="l10n_settings_screen_once_a_day_noop_asks_github_5683aad3">Una vez al día, NOOP consulta a GitHub el número de la última versión y deja un aviso en Novedades si hay una más reciente. No se envía nada sobre ti y nunca instala nada.</string>
+    <string name="l10n_updates_noop_1s_is_available_05d8ef55">NOOP %1$s ya está disponible</string>
+    <string name="l10n_updates_youre_on_1s_open_settings_and_35b9e135">Tienes la %1$s. Abre Ajustes y usa Buscar actualizaciones para ver las novedades y descargar la %2$s.</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index c97ebb6719..464451c602 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2453,4 +2453,8 @@
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">Demander à Android de s\'appairer</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Envoyer le hello malgré le refus d\'appairage (expérimental)</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Envoyer le hello malgré le refus d\'appairage</string>
+    <string name="l10n_settings_screen_check_automatically_7cd229d2">Vérifier automatiquement</string>
+    <string name="l10n_settings_screen_once_a_day_noop_asks_github_5683aad3">Une fois par jour, NOOP demande à GitHub le numéro de la dernière version et dépose une note dans Mises à jour s’il en existe une plus récente. Aucune donnée vous concernant n’est envoyée, et rien n’est jamais installé.</string>
+    <string name="l10n_updates_noop_1s_is_available_05d8ef55">NOOP %1$s est disponible</string>
+    <string name="l10n_updates_youre_on_1s_open_settings_and_35b9e135">Vous utilisez la version %1$s. Ouvrez les Réglages et utilisez Rechercher des mises à jour pour voir les nouveautés et télécharger la %2$s.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 1909b25020..4dfeae05eb 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2459,4 +2459,8 @@
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">Poproś Androida o sparowanie</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Wyślij hello mimo odmowy parowania (eksperymentalne)</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Wyślij hello mimo odmowy parowania</string>
+    <string name="l10n_settings_screen_check_automatically_7cd229d2">Sprawdzaj automatycznie</string>
+    <string name="l10n_settings_screen_once_a_day_noop_asks_github_5683aad3">Raz dziennie NOOP pyta GitHub o numer najnowszej wersji i dodaje notatkę w Aktualizacjach, jeśli jest nowsza. Nic o tobie nie jest wysyłane i nic nigdy nie jest instalowane.</string>
+    <string name="l10n_updates_noop_1s_is_available_05d8ef55">NOOP %1$s jest dostępny</string>
+    <string name="l10n_updates_youre_on_1s_open_settings_and_35b9e135">Masz wersję %1$s. Otwórz Ustawienia i użyj opcji Sprawdź aktualizacje, aby zobaczyć nowości i pobrać %2$s.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index bb1537dd9a..4ffd0b859d 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2447,4 +2447,8 @@
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">Pedir ao Android para emparelhar</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Enviar hello apesar da recusa de emparelhamento (experimental)</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Enviar hello apesar da recusa de emparelhamento</string>
+    <string name="l10n_settings_screen_check_automatically_7cd229d2">Verificar automaticamente</string>
+    <string name="l10n_settings_screen_once_a_day_noop_asks_github_5683aad3">Uma vez por dia, o NOOP pergunta ao GitHub o número da versão mais recente e deixa uma nota em Atualizações se existir uma mais recente. Não é enviado nada sobre si e nunca instala nada.</string>
+    <string name="l10n_updates_noop_1s_is_available_05d8ef55">O NOOP %1$s está disponível</string>
+    <string name="l10n_updates_youre_on_1s_open_settings_and_35b9e135">Tem a versão %1$s. Abra as Definições e use Procurar atualizações para ver as novidades e transferir a %2$s.</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index f0be87580b..611a008cd5 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2368,4 +2368,8 @@
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">请求 Android 配对</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">即使拒绝配对也发送 hello（实验性）</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">即使拒绝配对也发送 hello</string>
+    <string name="l10n_settings_screen_check_automatically_7cd229d2">自动检查</string>
+    <string name="l10n_settings_screen_once_a_day_noop_asks_github_5683aad3">NOOP 每天向 GitHub 查询一次最新版本号，如果有更新版本，就在「更新」中留下提示。不会发送任何与你有关的信息，也绝不会安装任何东西。</string>
+    <string name="l10n_updates_noop_1s_is_available_05d8ef55">NOOP %1$s 可用</string>
+    <string name="l10n_updates_youre_on_1s_open_settings_and_35b9e135">你当前使用 %1$s。打开「设置」并使用「检查更新」查看新增内容并下载 %2$s。</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 2aa851030b..9fc1171f79 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2480,4 +2480,8 @@
     <string name="l10n_health_screen_your_strap_banks_the_raw_optical_b52a0f80">Your strap banks the raw optical channels, but NOOP does not turn them into a blood oxygen percentage, so this stays empty however long you wear it. Import a WHOOP export in Data Sources to fill it from your account history.</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Send hello despite bond refusal (experimental)</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Send hello despite bond refusal</string>
+    <string name="l10n_settings_screen_check_automatically_7cd229d2">Check automatically</string>
+    <string name="l10n_settings_screen_once_a_day_noop_asks_github_5683aad3">Once a day, NOOP asks GitHub for the latest version number and puts a note in Updates if there’s a newer one. Nothing about you is sent, and it never installs anything.</string>
+    <string name="l10n_updates_noop_1s_is_available_05d8ef55">NOOP %1$s is available</string>
+    <string name="l10n_updates_youre_on_1s_open_settings_and_35b9e135">You\'re on %1$s. Open Settings and use Check for updates to see what\'s new and download %2$s.</string>
 </resources>
diff --git a/android/app/src/test/java/com/noop/update/UpdateAvailabilityTest.kt b/android/app/src/test/java/com/noop/update/UpdateAvailabilityTest.kt
new file mode 100644
index 0000000000..a1e7e70f86
--- /dev/null
+++ b/android/app/src/test/java/com/noop/update/UpdateAvailabilityTest.kt
@@ -0,0 +1,133 @@
+package com.noop.update
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The #1659 automatic update check.
+ *
+ * A sideloaded build has no store to update it, so the most NOOP can do is notice a release and say so.
+ * These rules decide when it may look, and when the result is worth a row in the Updates inbox.
+ *
+ * Twin of `UpdateAvailabilityTests` (Swift); the copy assertions below are byte-identical to it.
+ */
+class UpdateAvailabilityTest {
+
+    private val day = UpdateAvailability.CHECK_INTERVAL_MS
+
+    // --- when it may look ---
+
+    /** Off by default, and off means SILENT: no request, no line, no trace. */
+    @Test
+    fun `disabled never checks`() {
+        assertFalse(UpdateAvailability.shouldCheckNow(false, 0L, 1_000_000L))
+        assertFalse(UpdateAvailability.shouldCheckNow(false, 1L, 1_000_000L))
+    }
+
+    /** Turning the toggle on should answer during THAT session, not tomorrow. */
+    @Test
+    fun `a never-checked install is due immediately`() {
+        assertTrue(UpdateAvailability.shouldCheckNow(true, 0L, 1_000_000L))
+    }
+
+    @Test
+    fun `it waits out the interval`() {
+        val t = 1_000_000L
+        assertFalse(UpdateAvailability.shouldCheckNow(true, t, t + day - 1))
+        assertTrue(UpdateAvailability.shouldCheckNow(true, t, t + day))
+        assertTrue(UpdateAvailability.shouldCheckNow(true, t, t + day * 3))
+    }
+
+    /**
+     * A clock that moves BACKWARDS — timezone edit, NTP correction, a restored backup — would otherwise
+     * park the next check arbitrarily far in the future. Treating it as due self-heals on the next write.
+     */
+    @Test
+    fun `a clock going backwards does not strand the check`() {
+        val t = 1_000_000L
+        assertTrue(UpdateAvailability.shouldCheckNow(true, t, t - 5))
+        assertTrue(UpdateAvailability.shouldCheckNow(true, t, t - day * 400))
+    }
+
+    // --- when it is worth saying ---
+
+    @Test
+    fun `it posts only for a newer version`() {
+        assertTrue(UpdateAvailability.shouldPost("10.7.0", "10.6.0", null))
+        assertFalse(UpdateAvailability.shouldPost("10.6.0", "10.6.0", null))
+        assertFalse(UpdateAvailability.shouldPost("10.5.0", "10.6.0", null))
+    }
+
+    /**
+     * ONCE PER VERSION. An app that repeats itself daily about something the user has already seen teaches
+     * people to ignore the bell, which costs more than the feature is worth.
+     */
+    @Test
+    fun `it never nags about a version already posted`() {
+        assertFalse(UpdateAvailability.shouldPost("10.7.0", "10.6.0", "10.7.0"))
+        assertTrue(UpdateAvailability.shouldPost("10.8.0", "10.6.0", "10.7.0"))
+    }
+
+    /** The counters are versions, not booleans: skipping 10.7.0 must not silence 11.0.0. */
+    @Test
+    fun `skipping a release does not silence the next one`() {
+        assertTrue(UpdateAvailability.shouldPost("11.0.0", "10.6.0", "10.7.0"))
+    }
+
+    // --- pruning a stale announcement ---
+
+    /**
+     * The row says "10.7.0 is available". Once the user installs 10.7.0 that sentence is false, and it
+     * sits beside the What's New row for the same version — an app telling you to get what you have.
+     */
+    @Test
+    fun `the announcement is pruned once installed`() {
+        assertTrue(UpdateAvailability.shouldPruneAnnouncement("10.7.0", "10.7.0"))
+        assertTrue(UpdateAvailability.shouldPruneAnnouncement("10.7.0", "10.8.0"))
+    }
+
+    /** Still behind: the row is still TRUE and must survive, or it would delete itself on the next launch. */
+    @Test
+    fun `an announcement still ahead survives`() {
+        assertFalse(UpdateAvailability.shouldPruneAnnouncement("10.7.0", "10.6.0"))
+    }
+
+    @Test
+    fun `nothing announced is nothing to prune`() {
+        assertFalse(UpdateAvailability.shouldPruneAnnouncement(null, "10.6.0"))
+        assertFalse(UpdateAvailability.shouldPruneAnnouncement("", "10.6.0"))
+    }
+
+    // --- assembling the row body ---
+
+    /**
+     * The COPY is localized at the platform edge now, so what is pinned here is the ASSEMBLY: order, the
+     * single space between sentences, the blank line before notes, and the trimming. A first cut tested
+     * the English strings byte-for-byte against Swift — the wrong property, and one that would have
+     * stayed green while the row rendered in English inside a translated inbox.
+     */
+    @Test
+    fun `compose joins sentences with a single space`() {
+        assertEquals("A. B.", UpdateAvailability.composeMessage("A.", "B.", ""))
+    }
+
+    @Test
+    fun `compose omits an absent or empty sideload sentence`() {
+        assertEquals("A.", UpdateAvailability.composeMessage("A.", null, ""))
+        assertEquals("A.", UpdateAvailability.composeMessage("A.", "", ""))
+    }
+
+    @Test
+    fun `compose appends trimmed notes after a blank line`() {
+        assertEquals("A.\n\nN.", UpdateAvailability.composeMessage("A.", null, "  N.  "))
+        assertEquals("A. B.\n\nN.", UpdateAvailability.composeMessage("A.", "B.", "N."))
+    }
+
+    /** Whitespace-only notes must not leave a trailing blank line hanging in the row. */
+    @Test
+    fun `compose treats blank notes as none`() {
+        assertEquals("A.", UpdateAvailability.composeMessage("A.", null, "   \n  "))
+    }
+}

From 1b2d6c014bee64694b9de3a1afbd6296a20ada5c Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 18:15:23 +1200
Subject: [PATCH 012/333] updates: turn the automatic check on by default, and
 make the privacy docs true (#1675)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Maintainer's call on #1659. It shipped off, on the reading that "fully offline, no
telemetry" made an unasked-for launch request wrong on principle. The
counter-argument won: a sideloaded app has no store to update it, so a user who
never finds the setting is a user who silently runs an old build - which is the
whole problem the issue reported. A default nobody discovers is not a compromise,
it is the feature not existing.

The flip is one constant per platform. The rest of this is what the flip actually
costs, and it is the larger half.

A GATING BUG the default-off state was hiding. Android gated the launch check on
`onboarded`; the Swift hooks did not gate at all. With the check off that was
invisible. With it on, a fresh install would have reached the network during
first run, before the Terms gate the user has not accepted. All three hooks now
gate on onboarding AND terms - and finding it in one place was not the end of it:
the first pass fixed iOS only, and macOS plus Android's terms case were still
open a review later.

THE PRIVACY DOCS WERE ALREADY WRONG, and this made fixing them unavoidable.
PRIVACY_SECURITY.md claimed "the only networking anywhere in the app is the AI
Coach" - but the MANUAL update check has always made a network call and was never
documented, so the doc had been inaccurate since that button shipped. New §1.1c
documents both paths: the same public endpoint, what is sent (nothing - no
identifier, no account, no device info, no biometric data), what comes back, that
it never installs anything, that it is on by default and switchable off, and that
the request exposes an IP to GitHub exactly as opening the releases page in a
browser would. A reader who objects can act on that; a privacy doc that omits the
trade is not protecting anyone.

README said the AI Coach was "the only feature that ever uses the network" in two
places, including the summary near the top. It is the most-read document in the
project and was making the strongest claim; an earlier sweep of docs/ missed it
because I grepped for the phrasings I remembered writing rather than the claim.
CONTRIBUTING.md's "no network call" now states what it actually means - your data
never leaves the device - with the three requests named and a rule for a fourth.

FIVE COMMENTS still described the old behaviour, and none of them was cosmetic.
Both UpdateChecker/UpdateCheck file headers still said the read happens "ONLY
when the user taps the button - there is no background polling", which stopped
being true the moment the shared fetch gained an automatic caller. Those two
files are what someone opens to answer "does this app poll?". Both Settings
toggle comments still read "Off by default", directly contradicted by the code
beneath them.

Two tests for the property the change depends on: an unset pref resolves to what
the Settings toggle shows (the launch check reads UserDefaults, the toggle reads
@AppStorage, and a mismatch would have the switch saying one thing while the app
did another), and an explicit choice wins in BOTH directions - so flipping the
shipped default cannot silently override someone who had already opted out.

Parity verified end to end: both defaults true, the same 86400s interval either
side, all three pref keys identical, every pure rule twinned and tested on both,
all three hooks gated alike, both stamping before examining and pruning before
every other guard. Deliberate divergences documented - the sideload sentence is
iOS-only, Swift hoists installedVersion while Android reads a compile-time
constant, and Android needs no re-entrancy guard because LaunchedEffect re-runs
only on a key change where .onAppear promises nothing.

KNOWN GAP, deliberately not addressed here: updates.autoCheck is not in the
.noopbak whitelist, so an opt-out does not survive a restore - newly consequential
now the default is on. It is not specific to this feature: that contract carries
only int/double/string, has no Bool kind and no Boolean entries, so NO toggle in
the app survives a backup. Closing it means extending a byte-identical contract
across both codecs and both test suites, which is its own change.

Android 4566 tests green, compile clean, lintVitalFullRelease -PstagingRelease
clean, both i18n audits clean, doc_comment_lint clean.
---
 README.md                                     | 10 ++++-
 Strand/App/ContentView.swift                  | 13 +++++--
 Strand/Screens/SettingsView.swift             |  5 ++-
 Strand/System/UpdateAvailability.swift        | 21 +++++++----
 Strand/System/UpdateChecker.swift             | 18 +++++++--
 StrandTests/UpdateAvailabilityTests.swift     | 32 ++++++++++++++++
 StrandiOS/App/StrandiOSApp.swift              | 12 ++++--
 .../src/main/java/com/noop/ui/MainActivity.kt | 19 ++++++++--
 .../main/java/com/noop/ui/SettingsScreen.kt   |  6 +--
 .../com/noop/update/UpdateAvailability.kt     | 21 +++++++----
 .../main/java/com/noop/update/UpdateCheck.kt  | 19 +++++++---
 docs/CONTRIBUTING.md                          | 11 ++++--
 docs/FAQ.md                                   |  6 +++
 docs/PRIVACY_SECURITY.md                      | 37 ++++++++++++++++---
 14 files changed, 181 insertions(+), 49 deletions(-)

diff --git a/README.md b/README.md
index 4226c6019a..806463cf88 100644
--- a/README.md
+++ b/README.md
@@ -95,7 +95,7 @@ Pre-built apps you can run right now:
 
 Prefer to build it yourself? See [`docs/BUILD.md`](docs/BUILD.md).
 
-Everything runs **offline**. The only feature that ever uses the network is the optional **AI Coach**, and only with your own API key.
+Everything runs **offline** — your data never leaves the device. NOOP makes only two kinds of network request, both described in [`docs/PRIVACY_SECURITY.md`](docs/PRIVACY_SECURITY.md): the optional **AI Coach** (off until you add your own API key), and a once-a-day check for a newer release, which sends nothing about you and never installs anything. Turn the check off in Settings → About and it makes no request at all.
 
 ---
 
@@ -187,7 +187,7 @@ shared cross-platform code.
 | **Data Sources** | One-tap import of a WHOOP CSV export, an Apple Health export, or a **nutrition CSV** (Cronometer / MacroFactor), plus live-strap status. "Bring your history in once, then it's yours." |
 | **Notifications** | Configure local notifications and thresholds (`Strand/Data/NotificationSettingsStore.swift`). |
 | **Automations** | Turn the strap's physical inputs and live biometrics into Mac actions — all on-device (see below). |
-| **Coach** | An optional **AI Coach** you can ask about your data in plain language. It's the one feature that can ever use the network: off until you add your own key — Anthropic, OpenAI, or any OpenAI-compatible endpoint including a local/self-hosted model (Ollama, LM Studio) — and it sends only a short text summary of recent metrics plus your question, never raw streams or identifiers. With a local model the conversation never leaves your machine. Available on macOS, Android, and iOS. See [`docs/PRIVACY_SECURITY.md`](docs/PRIVACY_SECURITY.md). |
+| **Coach** | An optional **AI Coach** you can ask about your data in plain language. It's the one feature that can ever send anything about your data over the network: off until you add your own key — Anthropic, OpenAI, or any OpenAI-compatible endpoint including a local/self-hosted model (Ollama, LM Studio) — and it sends only a short text summary of recent metrics plus your question, never raw streams or identifiers. With a local model the conversation never leaves your machine. Available on macOS, Android, and iOS. See [`docs/PRIVACY_SECURITY.md`](docs/PRIVACY_SECURITY.md). |
 | **Settings** | Profile, preferences, **step calibration** (tune the stride/step estimate to your own walking), unit choices, the in-app **What's new** changelog, and an opt-in **Experimental** section (WHOOP 5/MG protocol probes). On **iOS**, also **Export for Shortcuts** — a HealthKit-free path that hands your metrics to Apple Health via the Shortcuts app. |
 
 There is also a **menu-bar extra** (`Strand/MenuBar/MenuBarContent.swift`) with a
@@ -525,6 +525,12 @@ Every arrow stays on your machine.
 strap data, imports, and computed metrics live in a local SQLite database on your
 device and never leave it.
 
+The app makes two kinds of network request, neither carrying anything about you: the optional
+**AI Coach** (off until you add your own key), and a once-a-day read of the latest release number so a
+sideloaded install can tell you an update exists — on by default, switchable off in Settings → About,
+and it never installs anything. Both are detailed in
+[`docs/PRIVACY_SECURITY.md`](docs/PRIVACY_SECURITY.md).
+
 ---
 
 ## Attribution
diff --git a/Strand/App/ContentView.swift b/Strand/App/ContentView.swift
index 6928a287ef..c1d1067e7f 100644
--- a/Strand/App/ContentView.swift
+++ b/Strand/App/ContentView.swift
@@ -53,10 +53,15 @@ struct ContentView: View {
             // Seed the current What's New into the Updates inbox (idempotent per version) so the bell
             // collects it even if the user dismisses the auto sheet.
             UpdateStore.shared.seedWhatsNewIfNeeded()
-            // #1659: iOS cannot auto-update a sideloaded build - no API lets an app install or re-sign an
-            // .ipa - so the most NOOP can do is NOTICE a release and say so. Opt-in and silent when off,
-            // which is the default; see UpdateAvailability.defaultEnabled.
-            UpdateWatch.runIfDue(currentVersion: UpdateWatch.installedVersion, sideloadHint: false)
+            // #1659: NOOP is sideloaded on every platform, so nothing else will tell you a release
+            // happened. On by default and switchable off - see UpdateAvailability.defaultEnabled.
+            //
+            // Gated on the SAME condition as showWhatsNewIfDue below, matching the iOS and Android hooks:
+            // a default-on check must not reach the network during first run, before the Terms gate has
+            // been accepted. (No sideload sentence here - macOS has no seven-day re-sign and no AltStore.)
+            if onboarded && acceptedTerms == Terms.currentVersion {
+                UpdateWatch.runIfDue(currentVersion: UpdateWatch.installedVersion, sideloadHint: false)
+            }
         }
         .onChangeCompat(of: acceptedTerms) { _ in showWhatsNewIfDue() }
     }
diff --git a/Strand/Screens/SettingsView.swift b/Strand/Screens/SettingsView.swift
index d3b2bb4cb6..c728ae2e1e 100644
--- a/Strand/Screens/SettingsView.swift
+++ b/Strand/Screens/SettingsView.swift
@@ -2815,8 +2815,9 @@ struct SettingsView: View {
 
                     // #1659: the automatic half. iOS cannot auto-update a sideloaded build at all — no API
                     // lets an app install or re-sign an .ipa — so noticing and saying so is the whole of
-                    // what is possible. Off by default: an unasked-for launch request would contradict the
-                    // offline promise this project leads with.
+                    // what is possible. ON by default, because a sideloaded app has no store to tell the
+                    // user anything and a setting nobody finds is the feature not existing; switching it
+                    // off here stops the request entirely. See UpdateAvailability.defaultEnabled.
                     Toggle(isOn: $autoCheckUpdates) {
                         VStack(alignment: .leading, spacing: 2) {
                             Text("Check automatically")
diff --git a/Strand/System/UpdateAvailability.swift b/Strand/System/UpdateAvailability.swift
index cb288d7716..5ab0815221 100644
--- a/Strand/System/UpdateAvailability.swift
+++ b/Strand/System/UpdateAvailability.swift
@@ -16,12 +16,19 @@ import WhoopProtocol
 /// Kotlin twin: `com.noop.update.UpdateAvailability`.
 enum UpdateAvailability {
 
-    /// OFF by default, and that is a deliberate reading of a hard project rule rather than timidity.
-    /// "Fully offline, on-device, no telemetry" is the headline promise, and both update checkers
-    /// currently justify themselves in their own doc comments as running ONLY on a tap. A check that
-    /// phones GitHub on launch without being asked would contradict that, however harmless the request
-    /// is. Flip this ONE constant to make it default-on; everything else about the feature is unchanged.
-    static let defaultEnabled = false
+    /// ON by default (maintainer's call, #1659).
+    ///
+    /// It shipped off first, on the reading that "fully offline, on-device, no telemetry" made an
+    /// unasked-for launch request wrong on principle. The counter-argument won: a sideloaded app has no
+    /// store to update it, so a user who never finds this setting is a user who silently runs an old
+    /// build — which is the whole problem the issue reported. A default nobody discovers is not a
+    /// compromise, it is the feature not existing.
+    ///
+    /// What keeps it honest is what the request IS: one read of a public version number, once a day,
+    /// after onboarding and the Terms gate. Nothing about the user is sent, nothing is uploaded, and no
+    /// data leaves the device — the offline promise is about the user's HEALTH DATA, and that is
+    /// untouched. Anyone who disagrees turns it off in Settings, and it then makes no request at all.
+    static let defaultEnabled = true
 
     /// Once a day. The thing being watched moves on the order of days-to-weeks, so anything tighter spends
     /// requests (and a little battery) to learn nothing.
@@ -101,7 +108,7 @@ enum UpdateAvailability {
 enum UpdateWatch {
 
     enum Keys {
-        /// Opt-in. See `UpdateAvailability.defaultEnabled` for why this is off until asked for.
+        /// On by default; see `UpdateAvailability.defaultEnabled` for why, and what the request is.
         static let enabled = "updates.autoCheck"
         static let lastCheckedAt = "updates.lastCheckedAt"
         static let lastPostedVersion = "updates.lastPostedVersion"
diff --git a/Strand/System/UpdateChecker.swift b/Strand/System/UpdateChecker.swift
index 56597e7693..0449ca9cf8 100644
--- a/Strand/System/UpdateChecker.swift
+++ b/Strand/System/UpdateChecker.swift
@@ -1,10 +1,20 @@
 import Foundation
 import WhoopProtocol
 
-/// User-initiated "Check for updates": one call to the project's PUBLIC releases API (GitHub),
-/// made ONLY when the user taps the button. No background polling and no auto-update — it just reads the latest version
-/// number and compares it to the installed one; nothing about the user is sent. (Uses the
-/// network-client entitlement, which is otherwise only for the opt-in, off-by-default AI Coach.)
+/// "Check for updates": one call to the project's PUBLIC releases API (GitHub), reading the latest
+/// version number and comparing it to the installed one. Nothing about the user is sent, and it never
+/// installs anything — on iOS no API permits that for a sideloaded app.
+///
+/// TWO callers share this, and the distinction matters to anyone auditing what the app does on its own:
+///  - the Settings button, which runs only when tapped;
+///  - `UpdateWatch`, the #1659 daily check, which runs at most once a day after onboarding and the Terms
+///    gate. It is ON by default and switching it off in Settings stops the request entirely.
+///
+/// This header previously said the read happened ONLY on a tap. That stopped being true the moment the
+/// automatic caller was added, and a false claim here is worse than none: it is the file someone opens to
+/// answer "does this app poll?". Documented for real in docs/PRIVACY_SECURITY.md §1.1c.
+///
+/// (Uses the network-client entitlement, which is otherwise only for the opt-in, off-by-default AI Coach.)
 @MainActor
 final class UpdateChecker: ObservableObject {
 
diff --git a/StrandTests/UpdateAvailabilityTests.swift b/StrandTests/UpdateAvailabilityTests.swift
index 9c4e931106..c49ff9f48d 100644
--- a/StrandTests/UpdateAvailabilityTests.swift
+++ b/StrandTests/UpdateAvailabilityTests.swift
@@ -126,4 +126,36 @@ final class UpdateAvailabilityTests: XCTestCase {
     func testComposeTreatsBlankNotesAsNone() {
         XCTAssertEqual(UpdateAvailability.composeMessage(body: "A.", sideload: nil, notes: "   \n  "), "A.")
     }
+
+    // MARK: - the default
+
+    /// An UNSET pref must resolve to the same answer the Settings toggle shows. The launch check reads
+    /// UserDefaults directly and the toggle reads @AppStorage; both fall back to `defaultEnabled`, and if
+    /// one were changed without the other the switch would say one thing while the app did another.
+    func testAnUnsetPrefMatchesWhatTheToggleWouldShow() {
+        let key = UpdateWatch.Keys.enabled
+        let saved = UserDefaults.standard.object(forKey: key)
+        defer {
+            if let saved { UserDefaults.standard.set(saved, forKey: key) }
+            else { UserDefaults.standard.removeObject(forKey: key) }
+        }
+        UserDefaults.standard.removeObject(forKey: key)
+        XCTAssertEqual(UpdateWatch.isEnabled, UpdateAvailability.defaultEnabled)
+    }
+
+    /// An explicit choice always wins over the default, in BOTH directions — otherwise flipping the
+    /// shipped default would silently override people who had already opted out.
+    func testAnExplicitChoiceOverridesTheDefault() {
+        let key = UpdateWatch.Keys.enabled
+        let saved = UserDefaults.standard.object(forKey: key)
+        defer {
+            if let saved { UserDefaults.standard.set(saved, forKey: key) }
+            else { UserDefaults.standard.removeObject(forKey: key) }
+        }
+        UserDefaults.standard.set(false, forKey: key)
+        XCTAssertFalse(UpdateWatch.isEnabled)
+        UserDefaults.standard.set(true, forKey: key)
+        XCTAssertTrue(UpdateWatch.isEnabled)
+    }
 }
+
diff --git a/StrandiOS/App/StrandiOSApp.swift b/StrandiOS/App/StrandiOSApp.swift
index 6a105c3b72..8ede93a008 100644
--- a/StrandiOS/App/StrandiOSApp.swift
+++ b/StrandiOS/App/StrandiOSApp.swift
@@ -401,9 +401,15 @@ private struct iOSRootView: View {
             // collects it even if the user dismisses the auto sheet.
             UpdateStore.shared.seedWhatsNewIfNeeded()
             // #1659: iOS cannot auto-update a sideloaded build - no API lets an app install or re-sign an
-            // .ipa - so the most NOOP can do is NOTICE a release and say so. Opt-in and silent when off,
-            // which is the default; see UpdateAvailability.defaultEnabled.
-            UpdateWatch.runIfDue(currentVersion: UpdateWatch.installedVersion, sideloadHint: true)
+            // .ipa - so the most NOOP can do is NOTICE a release and say so.
+            //
+            // Gated on the SAME condition as showWhatsNewIfDue above, and the Android hook. This matters
+            // now that the check is on by default: without it a brand-new install would reach the network
+            // during first run, before the Terms gate the user has not accepted yet. While the default was
+            // off, nothing made that visible.
+            if onboarded && acceptedTerms == Terms.currentVersion {
+                UpdateWatch.runIfDue(currentVersion: UpdateWatch.installedVersion, sideloadHint: true)
+            }
         }
         .onChange(of: acceptedTerms) { _, _ in showWhatsNewIfDue() }
     }
diff --git a/android/app/src/main/java/com/noop/ui/MainActivity.kt b/android/app/src/main/java/com/noop/ui/MainActivity.kt
index 3446218164..c7bb30f5ed 100644
--- a/android/app/src/main/java/com/noop/ui/MainActivity.kt
+++ b/android/app/src/main/java/com/noop/ui/MainActivity.kt
@@ -1330,9 +1330,22 @@ fun NoopRoot() {
     LaunchedEffect(onboarded) {
         if (onboarded) UpdateStore.from(context).seedWhatsNewIfNeeded()
         // #1659: a sideloaded build has no store to update it, so the most NOOP can do is NOTICE a
-        // release and say so in the same inbox. Opt-in, and silent when off, which is the default —
-        // see UpdateAvailability.DEFAULT_ENABLED. Onboarded-only for the same reason as the seed above.
-        if (onboarded) {
+        // release and say so in the same inbox. On by default and switchable off in Settings — see
+        // UpdateAvailability.DEFAULT_ENABLED.
+        //
+        // Gated on onboarding AND terms, matching both Swift hooks: a default-on check must not reach the
+        // network during first run, nor while a returning user is looking at a re-prompted clickwrap —
+        // the Terms gate below sits AFTER this effect, so `onboarded` alone would not have held it back.
+        // Read from prefs rather than the `acceptedTerms` state, which is not declared until after this
+        // block.
+        //
+        // No re-entrancy guard here, unlike the Swift twin's `inFlight`: LaunchedEffect does not re-run on
+        // recomposition, only when its key changes, so this cannot fire twice for one launch. `.onAppear`
+        // gives no such promise, which is why the Swift side needs the flag. Moving this call anywhere
+        // that re-runs (a plain composable body, a keyless effect) would need the guard back.
+        val termsCurrent =
+            prefs.getString(NoopPrefs.KEY_ACCEPTED_TERMS_VERSION, "") == Terms.CURRENT_VERSION
+        if (onboarded && termsCurrent) {
             com.noop.update.UpdateWatch.runIfDue(context, BuildConfig.VERSION_NAME)
         }
     }
diff --git a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
index 9913e28dbe..b15a128844 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
@@ -3341,9 +3341,9 @@ fun SettingsScreen(
                 var updChecking by remember { mutableStateOf(false) }
                 var updResult by remember { mutableStateOf<UpdateCheck.Result?>(null) }
                 // #1659: the automatic half. A sideloaded build has no store to update it, so noticing a
-                // release and saying so in the Updates inbox is the whole of what is possible. Off by
-                // default: an unasked-for launch request would contradict the offline promise this project
-                // leads with. See UpdateAvailability.DEFAULT_ENABLED.
+                // release and saying so in the Updates inbox is the whole of what is possible. ON by
+                // default, because a setting nobody finds is the feature not existing; switching it off
+                // here stops the request entirely. See UpdateAvailability.DEFAULT_ENABLED.
                 var autoCheck by remember {
                     mutableStateOf(com.noop.update.UpdateWatch.isEnabled(context))
                 }
diff --git a/android/app/src/main/java/com/noop/update/UpdateAvailability.kt b/android/app/src/main/java/com/noop/update/UpdateAvailability.kt
index 7c119da2c2..3b57c69630 100644
--- a/android/app/src/main/java/com/noop/update/UpdateAvailability.kt
+++ b/android/app/src/main/java/com/noop/update/UpdateAvailability.kt
@@ -19,13 +19,20 @@ package com.noop.update
 object UpdateAvailability {
 
     /**
-     * OFF by default, and that is a deliberate reading of a hard project rule rather than timidity.
-     * "Fully offline, on-device, no telemetry" is the headline promise, and both update checkers
-     * currently justify themselves in their own doc comments as running ONLY on a tap. A check that
-     * phones GitHub on launch without being asked would contradict that, however harmless the request
-     * is. Flip this ONE constant to make it default-on; everything else about the feature is unchanged.
+     * ON by default (maintainer's call, #1659).
+     *
+     * It shipped off first, on the reading that "fully offline, on-device, no telemetry" made an
+     * unasked-for launch request wrong on principle. The counter-argument won: a sideloaded app has no
+     * store to update it, so a user who never finds this setting is a user who silently runs an old
+     * build — which is the whole problem the issue reported. A default nobody discovers is not a
+     * compromise, it is the feature not existing.
+     *
+     * What keeps it honest is what the request IS: one read of a public version number, once a day,
+     * after onboarding. Nothing about the user is sent, nothing is uploaded, and no data leaves the
+     * device — the offline promise is about the user's HEALTH DATA, and that is untouched. Anyone who
+     * disagrees turns it off in Settings, and it then makes no request at all.
      */
-    const val DEFAULT_ENABLED = false
+    const val DEFAULT_ENABLED = true
 
     /** Once a day. The thing being watched moves on the order of days-to-weeks, so anything tighter
      *  spends requests (and a little battery) to learn nothing. */
@@ -112,7 +119,7 @@ object UpdateAvailability {
  */
 object UpdateWatch {
 
-    /** Opt-in. See [UpdateAvailability.DEFAULT_ENABLED] for why this is off until asked for. */
+    /** On by default; see [UpdateAvailability.DEFAULT_ENABLED] for why, and what the request is. */
     const val KEY_ENABLED = "updates.autoCheck"
     const val KEY_LAST_CHECKED_AT = "updates.lastCheckedAt"
     const val KEY_LAST_POSTED_VERSION = "updates.lastPostedVersion"
diff --git a/android/app/src/main/java/com/noop/update/UpdateCheck.kt b/android/app/src/main/java/com/noop/update/UpdateCheck.kt
index ff10cbb31e..66948fc25d 100644
--- a/android/app/src/main/java/com/noop/update/UpdateCheck.kt
+++ b/android/app/src/main/java/com/noop/update/UpdateCheck.kt
@@ -7,11 +7,20 @@ import java.net.HttpURLConnection
 import java.net.URL
 
 /**
- * User-initiated "Check for updates": a single call to the project's PUBLIC releases API (GitHub) that reads the
- * latest version and compares it to the installed one. It runs ONLY when the user taps the button —
- * there is no background polling and no auto-update. Nothing about the user is sent; it just reads a
- * version number. (Android already holds INTERNET for the opt-in AI Coach, so this adds no new
- * capability.)
+ * "Check for updates": a single call to the project's PUBLIC releases API (GitHub) that reads the latest
+ * version and compares it to the installed one. Nothing about the user is sent, and it never installs
+ * anything.
+ *
+ * TWO callers share this, and the distinction matters to anyone auditing what the app does on its own:
+ *  - the Settings button, which runs only when tapped;
+ *  - [UpdateWatch], the #1659 daily check, which runs at most once a day after onboarding and the Terms
+ *    gate. It is ON by default and switching it off in Settings stops the request entirely.
+ *
+ * This header previously said the read happened ONLY on a tap. That stopped being true the moment the
+ * automatic caller was added, and a false claim here is worse than none: it is the file someone opens to
+ * answer "does this app poll?". Documented for real in docs/PRIVACY_SECURITY.md §1.1c.
+ *
+ * (Android already holds INTERNET for the opt-in AI Coach, so this adds no new capability.)
  */
 object UpdateCheck {
 
diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index af6c98f866..034033f9fc 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -40,9 +40,14 @@ non-negotiable (especially on the Bluetooth path).
 
 A few principles run through the whole codebase. Internalize them before opening a PR.
 
-1. **Offline by design.** There is no server, no telemetry, no account, no network call. A change
-   that phones home — for any reason — does not belong here. Strap data, imports, and computed
-   metrics live in a local SQLite database and never leave the device.
+1. **Offline by design.** There is no server, no telemetry and no account, and **your data never
+   leaves the device.** Strap data, imports, and computed metrics live in a local SQLite database.
+   A change that uploads any of it — for any reason — does not belong here.
+   The app makes exactly three network requests, all documented in
+   [docs/PRIVACY_SECURITY.md §1.1](PRIVACY_SECURITY.md): the opt-in AI Coach, the
+   compile-time-optional Oura history import, and the update check (a read of a public version
+   number, on by default, switchable off). Each sends nothing about the user. Adding a fourth needs
+   a very good reason and the same treatment: named in the privacy doc, and switchable off.
 2. **Interoperability, not impersonation.** NOOP talks to a strap the user already owns. It does not
    log into a WHOOP account, bypass a paywall, or ship WHOOP's proprietary code/firmware/assets/logos.
    Keep contributions on the right side of that line, and keep all WHOOP references *nominative*
diff --git a/docs/FAQ.md b/docs/FAQ.md
index c6da72b0ef..52dad66d78 100644
--- a/docs/FAQ.md
+++ b/docs/FAQ.md
@@ -58,6 +58,12 @@ Two things do carry your data off-device **when you choose to send them**:
 
 Both are user-initiated. See [docs/PRIVACY_SECURITY.md](PRIVACY_SECURITY.md).
 
+NOOP also checks once a day whether a newer release exists, because it is sideloaded on every platform
+and has no store to update it. That is a read of a public version number and sends nothing about you —
+no identifier, no account, no health data — and it never installs anything. It is on by default and
+switchable off in Settings → About, and the full detail is in
+[docs/PRIVACY_SECURITY.md §1.1c](PRIVACY_SECURITY.md).
+
 ## Which numbers are measured, and which are NOOP's own estimates?
 
 Measured from the strap: heart rate, R-R intervals, resting HR, skin temperature, respiratory rate,
diff --git a/docs/PRIVACY_SECURITY.md b/docs/PRIVACY_SECURITY.md
index c75c2a4549..ace5c0470f 100644
--- a/docs/PRIVACY_SECURITY.md
+++ b/docs/PRIVACY_SECURITY.md
@@ -46,12 +46,12 @@ deliberately export it to another store on the **same device**:
 | Oura history import (opt-in build flag, §1.1b) | HTTPS OAuth + REST, `api.ouraring.com` → device | Read-only from your own Oura account |
 | Apple Health export, incl. iOS "Export for Shortcuts" | On-device, user-initiated | NOOP → your Apple Health, on your device only (§1.3) |
 
-The only **network** paths are the opt-in AI Coach and the compile-time-optional Oura
-history import; the
+The **network** paths are the opt-in AI Coach, the compile-time-optional Oura history import, and the
+update check (§1.1c); the
 biometric pipeline produces no network traffic of any kind. The Apple Health export above is
 an **on-device** hand-off, not a network upload — see §1.3.
 
-### 1.1 Network code: only the two optional exceptions
+### 1.1 Network code: the three exceptions
 
 The biometric pipeline and all five Swift packages
 (`WhoopProtocol`, `WhoopStore`, `StrandAnalytics`, `StrandImport`, `StrandDesign`)
@@ -64,9 +64,34 @@ TestFlight — and was folded into the main tree in v1.94), so the Swift-side pr
 behaviour described here applies equally to both. Android is a separate codebase using
 Room for storage and Kotlin for the BLE / import / Coach paths; its own Oura support is
 the local BLE ring-pairing lane, not a network API, so it has no equivalent to §1.1b. The
-**only** networking anywhere in the app is the AI Coach (`Strand/AI/AICoach.swift` on the
-Swift side — macOS and iOS — `com.noop.ai.AiCoach` on Android), described in §1.1a, and
-the Oura history import (`Strand/Oura/`, Swift-only — macOS and iOS), described in §1.1b.
+networking anywhere in the app is the AI Coach (`Strand/AI/AICoach.swift` on the
+Swift side — macOS and iOS — `com.noop.ai.AiCoach` on Android), described in §1.1a,
+the Oura history import (`Strand/Oura/`, Swift-only — macOS and iOS), described in §1.1b,
+and the update check, described in §1.1c.
+#### 1.1c The update check
+
+NOOP is sideloaded on every platform — there is no App Store or Play Store to update it — so an install
+that is never told about a release simply runs an old build indefinitely. Two paths address that, and
+both read the **same** public endpoint: `https://api.github.com/repos/ryanbr/noop/releases/latest`.
+
+- **"Check for updates"** in Settings → About. Runs only when tapped. It has always existed;
+  it was previously undocumented here, which is why this section is new rather than merely amended.
+- **"Check automatically"**, beside it. At most once a day, after onboarding (and, on iOS, after the
+  Terms gate), NOOP reads that endpoint and — if a newer release exists — puts a row in the Updates
+  inbox. **On by default**, and switchable off, at which point it makes no request at all.
+
+What is sent: nothing. It is an unauthenticated `GET` of a public URL, carrying no identifier, no
+account, no device information and no biometric data. What comes back is a version number and the
+release notes. **It never installs anything** — on iOS no API permits that for a sideloaded app (see
+[docs/IOS.md](IOS.md)); the row tells you a release exists and where to get it.
+
+The request is a plain HTTPS call, so your IP address is visible to GitHub exactly as it would be if
+you opened the releases page in a browser. If that is not a trade you want, turn the toggle off; the
+manual button then remains the only way NOOP touches the network for this.
+
+Code: `Strand/System/UpdateChecker.swift` + `Strand/System/UpdateAvailability.swift` (Swift),
+`com.noop.update.UpdateCheck` + `com.noop.update.UpdateAvailability` (Android).
+
 The package manifests reference dependency *download* URLs that Swift Package Manager
 resolves at build time, never at runtime:
 

From 6c33fd693cd591e75383f620e1a10281cd4d0ab7 Mon Sep 17 00:00:00 2001
From: Kaveman <66108693+kavemang@users.noreply.github.com>
Date: Thu, 27 Aug 2026 01:44:31 -0500
Subject: [PATCH 013/333] steps: use the active strap's motion in the
 calibration screen (#1644)

Thanks to @kavemang, who both reported this and sent the fix.

The Steps calibration screen said it read motion "the same way the engine does",
and stopped being true the moment a strap was re-added: the engine resolves each
day's owner before reading gravity, while the screen passed a hardcoded
"my-whoop". A strap banking live motion under a fresh whoop-<uuid> id therefore
produced estimates the engine could see and the screen could not.

gravitySamplesUnion reads the active strap plus the canonical id and dedupes by
timestamp with the active id winning, mirroring hrSamplesUnion line for line;
mergeGravityByTs mirrors mergeHrByTs, including returning a single-id read
unchanged so a canonical-only install performs exactly the DAO read it did
before.

Reviewed against the things that would have made it silently wrong: the dedup
depends on importedSourceIdsFor returning the active id FIRST, which it does;
a canonical active id collapses to one element so the pre-union path is
untouched; vm.activeStrapId is non-null with a sound fallback; and the screen's
line was the ONLY hardcoded canonical gravity read left in the app, so this is
the whole bug rather than the instance the report named.

Four tests, matching the four cases the report asked for, and written against the
pure helpers so they need no database. Verified locally: compiles clean, full
Android suite green, GravityReadUnionTest 4/4.

Two things deliberately left, both wider than this change:

  - iOS has the MIRROR half. Strand/Screens/SettingsView.swift reads
    repo.deviceId (active only) rather than importedReadIds, so after a re-add it
    misses the canonical history where Android missed the live strap. The union
    machinery already exists on the Swift side, so the twin is small - it is
    simply not this PR.
  - the report also hoped the screen would share the estimator's per-day owner
    resolution. It does not: resolveDayOwner picks from registry candidates,
    which on a multi-strap install can be neither the active nor the canonical
    id. Narrower case, and threading that into a UI screen is a much larger
    change than the union the report itself proposed.
---
 .../java/com/noop/data/WhoopRepository.kt     | 28 ++++++++
 .../com/noop/ui/StepsCalibrationScreen.kt     |  3 +-
 .../com/noop/data/GravityReadUnionTest.kt     | 70 +++++++++++++++++++
 3 files changed, 100 insertions(+), 1 deletion(-)
 create mode 100644 android/app/src/test/java/com/noop/data/GravityReadUnionTest.kt

diff --git a/android/app/src/main/java/com/noop/data/WhoopRepository.kt b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
index b0fe987961..80b7b2dea4 100644
--- a/android/app/src/main/java/com/noop/data/WhoopRepository.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
@@ -1330,6 +1330,22 @@ class WhoopRepository(
     suspend fun gravitySamples(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
         dao.gravitySamples(deviceId, from, to, limit)
 
+    /**
+     * Gravity samples over the read-side union of the active strap id and canonical "my-whoop",
+     * deduped by timestamp with the active strap winning. A re-added strap banks live motion under its
+     * fresh device id while older/imported motion can remain under the canonical id; calibration reads
+     * need both histories just like [hrSamplesUnion]. A canonical active id still performs one unchanged
+     * DAO read.
+     */
+    suspend fun gravitySamplesUnion(
+        activeDeviceId: String,
+        from: Long,
+        to: Long,
+        limit: Int = DEFAULT_LIMIT,
+    ): List<GravitySample> = mergeGravityByTs(
+        importedSourceIds(activeDeviceId).map { dao.gravitySamples(it, from, to, limit) },
+    )
+
     suspend fun sleepSessions(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
         dao.sleepSessions(deviceId, from, to, limit)
 
@@ -2339,6 +2355,18 @@ class WhoopRepository(
             return byTs.values.sortedBy { it.ts }
         }
 
+        /**
+         * Merge gravity sample lists into one time-ordered stream, deduped by timestamp with the FIRST
+         * list (the active strap) winning on a tie. A single-id read is returned unchanged, matching the
+         * pre-union path and [mergeHrByTs].
+         */
+        internal fun mergeGravityByTs(lists: List<List<GravitySample>>): List<GravitySample> {
+            if (lists.size == 1) return lists[0]
+            val byTs = LinkedHashMap<Long, GravitySample>()
+            for (list in lists) for (s in list) byTs.putIfAbsent(s.ts, s)
+            return byTs.values.sortedBy { it.ts }
+        }
+
         /**
          * Merge HR bucket lists (the active-id ∪ canonical union) into one time-ordered stream, deduped
          * by bucket start with the FIRST list (the active strap) winning on a tie. Kotlin twin of the
diff --git a/android/app/src/main/java/com/noop/ui/StepsCalibrationScreen.kt b/android/app/src/main/java/com/noop/ui/StepsCalibrationScreen.kt
index 86c1f7db08..ee7f55d45b 100644
--- a/android/app/src/main/java/com/noop/ui/StepsCalibrationScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/StepsCalibrationScreen.kt
@@ -132,11 +132,12 @@ fun StepsCalibrationScreen(
         )
         val rows = ArrayList<StepsComparisonRow>()
         val motions = ArrayList<Double>()
+        val activeStrapId = vm.activeStrapId
         for ((day, phone) in phoneDays.take(10)) {           // scan extra to fill 7 after motion gaps
             val mid = runCatching {
                 LocalDate.parse(day).atStartOfDay(ZoneId.systemDefault()).toEpochSecond()
             }.getOrNull() ?: continue
-            val grav = vm.repo.gravitySamples("my-whoop", mid, mid + 86_400 - 1)
+            val grav = vm.repo.gravitySamplesUnion(activeStrapId, mid, mid + 86_400 - 1)
             val motion = StepsEstimateEngine.dayMotionIntensity(grav)
             val est = StepsEstimateEngine.estimate(motion, cal) ?: continue
             motions.add(motion)
diff --git a/android/app/src/test/java/com/noop/data/GravityReadUnionTest.kt b/android/app/src/test/java/com/noop/data/GravityReadUnionTest.kt
new file mode 100644
index 0000000000..835a9c64f1
--- /dev/null
+++ b/android/app/src/test/java/com/noop/data/GravityReadUnionTest.kt
@@ -0,0 +1,70 @@
+package com.noop.data
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertSame
+import org.junit.Test
+
+/** Regression coverage for the gravity read used by the Steps calibration screen (#1643). */
+class GravityReadUnionTest {
+
+    private val canonical = WhoopRepository.WHOOP_SOURCE
+    private val active = "whoop-abc"
+
+    private fun sample(deviceId: String, ts: Long, x: Double) =
+        GravitySample(deviceId = deviceId, ts = ts, x = x, y = 0.0, z = 1.0)
+
+    @Test
+    fun activeOnlyMotionIsSurfacedWhenCanonicalIsEmpty() {
+        val activeRows = listOf(
+            sample(active, 100, 0.1),
+            sample(active, 101, 0.2),
+        )
+        val byId = mapOf(active to activeRows, canonical to emptyList())
+
+        val ids = WhoopRepository.importedSourceIdsFor(active)
+        val merged = WhoopRepository.mergeGravityByTs(ids.map { byId.getValue(it) })
+
+        assertEquals(listOf(active, canonical), ids)
+        assertEquals(activeRows, merged)
+    }
+
+    @Test
+    fun activeAndCanonicalHistoryMergeInTimestampOrderWithActiveWinningTies() {
+        val activeRows = listOf(
+            sample(active, 101, 9.0),
+            sample(active, 103, 9.2),
+        )
+        val canonicalRows = listOf(
+            sample(canonical, 100, 5.0),
+            sample(canonical, 101, 5.1),
+            sample(canonical, 102, 5.2),
+        )
+
+        val merged = WhoopRepository.mergeGravityByTs(listOf(activeRows, canonicalRows))
+
+        assertEquals(listOf(100L, 101L, 102L, 103L), merged.map { it.ts })
+        assertEquals(active, merged.first { it.ts == 101L }.deviceId)
+        assertEquals(9.0, merged.first { it.ts == 101L }.x, 0.0)
+    }
+
+    @Test
+    fun canonicalActiveIdKeepsTheExistingSingleReadUnchanged() {
+        val rows = listOf(
+            sample(canonical, 100, 0.1),
+            sample(canonical, 101, 0.2),
+        )
+
+        val ids = WhoopRepository.importedSourceIdsFor(canonical)
+        val merged = WhoopRepository.mergeGravityByTs(listOf(rows))
+
+        assertEquals(listOf(canonical), ids)
+        assertSame(rows, merged)
+    }
+
+    @Test
+    fun noMotionUnderEitherIdStaysEmpty() {
+        val merged = WhoopRepository.mergeGravityByTs(listOf(emptyList(), emptyList()))
+
+        assertEquals(emptyList<GravitySample>(), merged)
+    }
+}

From 9bdad2d1dfe0bfd717183db70dda797c06ba1ccc Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 19:01:19 +1200
Subject: [PATCH 014/333] steps: read the gravity union in the iOS/macOS
 calibration screen too (#1676)

The Swift half of the bug @kavemang reported, and solved on Android in #1644.

Same shape, opposite detail. Android hardcoded the canonical "my-whoop" and so
missed a re-added strap's LIVE motion. This side reads `repo.deviceId`, which
follows the active strap, and so missed the CANONICAL history a prior import or
an earlier strap identity had banked. Either way the calibration screen
disagreed with the estimator it exists to reconstruct, which is the thing the
report actually asked to stop happening.

The union machinery was already here. `importedReadIds` - active strap first,
collapsing to a single id on a single-device install - has been used by
CsvExport and the Repository's own daily/series facades for a while. The screen
simply never went through it. So this adds gravitySamplesUnion beside those
facades and points the screen at it.

The signature differs from the Kotlin twin on purpose: that one takes the active
id as a parameter because its repository is not device-scoped, and this one
already knows importedReadIds. The MERGE RULE is byte-identical - first list wins
a shared timestamp, and a single-id read is returned UNTOUCHED, so the
overwhelmingly common install performs exactly the read it always did.

Verification: 6 tests over the pure merge, including BOTH one-sided cases (the
Android half and the iOS half), the single-id passthrough, and out-of-order
input - the store returns rows per id, and concatenating two id-ordered lists is
not itself ordered. Expected values generated by compiling the rule standalone
with swiftc, since Xcode is unavailable in this environment. app-build green on
Build Strand, Test Strand and Build NOOPiOS; doc_comment_lint clean.

Two residuals, both named when reviewing #1644 and neither introduced here:
multi-strap installs, where the estimator's per-day resolveDayOwner picks from
registry candidates and can land on an id that is neither active nor canonical,
so the screen could still disagree; and the screen's read limit, which is not the
estimator's STREAM_LIMIT on either platform. Both are wider than this change.
---
 Strand/Data/Repository.swift            | 34 ++++++++++++++
 Strand/Screens/SettingsView.swift       |  8 ++--
 StrandTests/GravityReadUnionTests.swift | 60 +++++++++++++++++++++++++
 3 files changed, 99 insertions(+), 3 deletions(-)
 create mode 100644 StrandTests/GravityReadUnionTests.swift

diff --git a/Strand/Data/Repository.swift b/Strand/Data/Repository.swift
index 1e6d455d4e..eeff3df288 100644
--- a/Strand/Data/Repository.swift
+++ b/Strand/Data/Repository.swift
@@ -285,6 +285,40 @@ final class Repository: ObservableObject {
         return byDay.values.sorted { $0.day < $1.day }
     }
 
+    /// Gravity samples across the imported union, deduped by timestamp with the ACTIVE STRAP winning.
+    ///
+    /// #1643: the Steps calibration screen read a SINGLE id and so disagreed with the estimator, which
+    /// resolves an owner per day before reading gravity. Android hit the canonical half of this (it
+    /// hardcoded "my-whoop" and missed a re-added strap's live motion, @kavemang's #1644); the Swift
+    /// screen had the mirror half — it read the ACTIVE id and so missed the canonical history a prior
+    /// import or an earlier strap identity had banked.
+    ///
+    /// Twin of Kotlin `WhoopRepository.gravitySamplesUnion`. It takes the active id as a parameter
+    /// because its repository is not device-scoped; this one already knows `importedReadIds`.
+    func gravitySamplesUnion(from: Int, to: Int, limit: Int = 200_000) async -> [GravitySample] {
+        guard let store = await storeHandle() else { return [] }
+        var lists: [[GravitySample]] = []
+        for id in importedReadIds {   // active strap FIRST → it wins any shared timestamp
+            lists.append((try? await store.gravitySamples(deviceId: id, from: from, to: to, limit: limit)) ?? [])
+        }
+        return Self.mergeGravityByTs(lists)
+    }
+
+    /// Merge gravity lists into one time-ordered stream, deduped by timestamp with the FIRST list (the
+    /// active strap) winning a tie. A single-id read is returned UNCHANGED, so a single-device install
+    /// performs exactly the read it did before the union existed.
+    ///
+    /// Byte-identical rule to Kotlin `mergeGravityByTs`. Pure + static so the dedup is unit-tested
+    /// without a store — the property that actually matters here is "active wins, nothing double-counts".
+    nonisolated static func mergeGravityByTs(_ lists: [[GravitySample]]) -> [GravitySample] {
+        if lists.count == 1 { return lists[0] }
+        var byTs: [Int: GravitySample] = [:]
+        for list in lists {
+            for s in list where byTs[s.ts] == nil { byTs[s.ts] = s }
+        }
+        return byTs.values.sorted { $0.ts < $1.ts }
+    }
+
     /// One day held by two source ids in the SAME bucket, folded into `winner`'s row: `winner` keeps every
     /// column it carries (NON-nil — a measured zero is a reading) and `filler` supplies only the ones it
     /// left nil. Whole-row first-wins let a hollow row (steps and nothing else) discard a complete one, and
diff --git a/Strand/Screens/SettingsView.swift b/Strand/Screens/SettingsView.swift
index c728ae2e1e..856d4710f3 100644
--- a/Strand/Screens/SettingsView.swift
+++ b/Strand/Screens/SettingsView.swift
@@ -3638,7 +3638,7 @@ struct StepsCalibrationSheet: View {
             .sorted { $0.day > $1.day }
 
         // Reconstruct the estimate for the most recent phone-covered days, motion-by-motion.
-        guard coeff > 0, let store = await repo.storeHandle() else { return }
+        guard coeff > 0 else { return }
         let cal = StepsEstimateEngine.Calibration(coefficient: coeff,
                                                   sampleDays: profile.stepsCalibrationSampleDays,
                                                   confidence: profile.stepsCalibrationConfidence,
@@ -3650,8 +3650,10 @@ struct StepsCalibrationSheet: View {
         for entry in phoneDays.prefix(10) {           // scan a few extra to fill 7 after motion gaps
             guard let dayDate = dayParser.date(from: entry.day) else { continue }
             let mid = Int(calendar.startOfDay(for: dayDate).timeIntervalSince1970)
-            let grav = (try? await store.gravitySamples(deviceId: repo.deviceId, from: mid,
-                                                        to: mid + 86_400 - 1, limit: 200_000)) ?? []
+            // #1643: the UNION, not `repo.deviceId` alone — a re-added strap leaves motion under both the
+            // active id and the canonical one, and reading either by itself makes this screen disagree
+            // with the estimator it is supposed to be reconstructing.
+            let grav = await repo.gravitySamplesUnion(from: mid, to: mid + 86_400 - 1)
             let motion = StepsEstimateEngine.dayMotionIntensity(grav)
             guard motion > 0, let est = StepsEstimateEngine.estimate(motion: motion, calibration: cal) else { continue }
             motions.append(motion)
diff --git a/StrandTests/GravityReadUnionTests.swift b/StrandTests/GravityReadUnionTests.swift
new file mode 100644
index 0000000000..d3ac4b5cbe
--- /dev/null
+++ b/StrandTests/GravityReadUnionTests.swift
@@ -0,0 +1,60 @@
+import XCTest
+import WhoopProtocol
+@testable import Strand
+
+/// The gravity read behind the Steps calibration screen (#1643).
+///
+/// Swift twin of Android's `GravityReadUnionTest` (@kavemang, #1644). The bug was the same shape on both
+/// platforms and opposite in detail: Android hardcoded the canonical id and missed a re-added strap's live
+/// motion; this side read the ACTIVE id alone and missed the canonical history. Either way the screen
+/// disagreed with the estimator it exists to reconstruct.
+final class GravityReadUnionTests: XCTestCase {
+
+    private func sample(_ ts: Int, _ x: Double) -> GravitySample {
+        GravitySample(ts: ts, x: x, y: 0, z: 1)
+    }
+
+    /// The active strap wins a shared timestamp, and nothing double-counts — the two properties the
+    /// screen's motion total depends on.
+    func testActiveWinsTiesAndTheStreamIsTimeOrdered() {
+        let active = [sample(101, 9.0), sample(103, 9.2)]
+        let canonical = [sample(100, 5.0), sample(101, 5.1), sample(102, 5.2)]
+
+        let merged = Repository.mergeGravityByTs([active, canonical])
+
+        XCTAssertEqual(merged.map(\.ts), [100, 101, 102, 103])
+        XCTAssertEqual(merged.first { $0.ts == 101 }?.x, 9.0)   // active, not canonical
+    }
+
+    /// A re-added strap with no canonical history must still populate: this is the reported failure on
+    /// the Android side, and the union has to cover it here too.
+    func testActiveOnlyMotionSurfacesWhenCanonicalIsEmpty() {
+        let active = [sample(100, 0.1), sample(101, 0.2)]
+        XCTAssertEqual(Repository.mergeGravityByTs([active, []]).map(\.ts), [100, 101])
+    }
+
+    /// The mirror case, which is the half THIS platform had: canonical history and no active-id rows.
+    func testCanonicalHistorySurfacesWhenTheActiveIdIsEmpty() {
+        let canonical = [sample(100, 0.1), sample(101, 0.2)]
+        XCTAssertEqual(Repository.mergeGravityByTs([[], canonical]).map(\.ts), [100, 101])
+    }
+
+    /// A single-device install collapses to one id, and that read is returned UNCHANGED — so this change
+    /// cannot alter what the overwhelmingly common install already saw.
+    func testASingleIdReadIsReturnedUntouched() {
+        let rows = [sample(100, 0.1), sample(101, 0.2)]
+        XCTAssertEqual(Repository.mergeGravityByTs([rows]), rows)
+    }
+
+    func testNoMotionUnderEitherIdStaysEmpty() {
+        XCTAssertTrue(Repository.mergeGravityByTs([[], []]).isEmpty)
+    }
+
+    /// Unsorted input still comes back time-ordered: the store returns rows per id, and concatenating two
+    /// id-ordered lists is not itself ordered.
+    func testOutOfOrderInputIsSorted() {
+        let a = [sample(300, 1), sample(100, 2)]
+        let b = [sample(200, 3)]
+        XCTAssertEqual(Repository.mergeGravityByTs([a, b]).map(\.ts), [100, 200, 300])
+    }
+}

From 06a55ebe186bc6f60eeb82307605db92e8853411 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 21:20:09 +1200
Subject: [PATCH 015/333] health-connect: retract sleep records the export no
 longer produces (#1679)

@FlixiDoe reports a partial night exported to Health Connect mid-sync and never
corrected: NOOP's own sleep session becomes complete, Google Health keeps the
truncated one forever, and re-running the export does not help.

The half they proposed as an alternative already exists. writeSleep writes
Metadata(clientRecordId = "noop-sleep-<startTs>", clientRecordVersion = endSec),
so a night that grows has a higher version and Health Connect upserts it, and
#364 already deletes absorbed fragments. That covers a record whose id STAYS THE
SAME.

It cannot cover one whose id stops being produced, and for sleep that is routine.
sleepSession's primary key is (deviceId, startTs), so a re-detection landing on a
different start is a DIFFERENT ROW, and the #1248/#1284 heal deletes the stale row
once a fuller copy wins - SleepSessionDedup exists precisely because one night
accumulates several rows with different starts. absorbedClientIds is computed from
rows STILL IN THE DATABASE, so the moment the heal drops that row the exporter
loses all knowledge that it ever wrote a record under its id. That is why
re-running the export does not fix it, which is the most diagnostic line in the
report: a pure timing bug would self-heal on a re-run.

So the exporter now keeps its own memory of the ids it has written and retracts
the ones a later export no longer produces.

THE DANGEROUS PART IS THE RESTRAINT, NOT THE RETRACTION. Every defect the three
review passes found was on the "deletes too much" side, which is inherent: giving
code the power to remove data from an external store puts all the risk there.

  - "wrote it before, not writing it now" would delete the user's history. The
    export covers a rolling 60-day window, so a night that merely aged out is
    absent from the current set while its record is perfectly good. An id is
    retracted only when its own timestamp falls inside the window this export
    actually covered.
  - an id whose timestamp will not parse is never retracted. Abstaining costs one
    stale row; guessing costs data.
  - an empty plan set retracts nothing. "No plans" is not the same statement as
    "the user has no sleep", and a read that came back empty for any reason would
    otherwise wipe the window.
  - a FAILED retraction stays on the books and is retried. Dropping its id while
    its record was still live would orphan it permanently - this bug rebuilt
    inside its own fix, which the first draft did.
  - the ledger is keyed PER STRAP. The export is device-scoped, so with one shared
    ledger a two-strap user who switched active strap would have had the next
    export retract the other strap's records. A global key would have turned
    harmless staleness into real data loss.
  - exports are serialized. Three callers can start one with no uniqueness guard;
    two overlapping exports would read the same ledger and the loser's
    carried-forward retractions would vanish.
  - the bulk delete falls back to per id. This reporter had already deleted the
    bad record by hand, so a missing id is live rather than hypothetical and must
    not take the batch down with it.

Considered and rejected: read-back reconciliation, which is self-healing, needs no
stored state and would clean up existing damage - but read permission belongs to
the IMPORTER's separate grant, so a user who enabled only share-back (exactly the
affected users) has write and not read. Also rejected: pausing the export during
strap sync, the report's primary proposal. Re-staging is not confined to strap
sync - the heal runs on analyzeRecent passes, an Oura ring banking a night
triggers it, a re-import does too - and "sync complete" is not a clean edge since
backfill interrupts and resumes.

Also verified, no change needed: insertChunked batches at 1000 against a 60-day
window holding a couple of hundred rows, so a partial insert cannot leave written
ids unrecorded at any reachable volume; sleepSessionsMerged reads with
DEFAULT_LIMIT 100_000, so a truncated read cannot fake an absent night; a night
starting before the window but ending inside it is always in the current set; and
the ledger key is not in the .noopbak whitelist, so it cannot restore onto a
device whose Health Connect never saw those ids.

Android-only: Health Connect is.

Verification: 14 tests over the pure rules - the reported id-moved case, the
aged-out night that must survive, both window edges, a future-dated id, junk ids,
sorting, a non-sleep prefix, the carry-forward of a failed retraction and its
retry, and the per-strap and per-record-type key separation. Android 4584 tests
green, compile clean, doc_comment_lint clean.

KNOWN LIMIT, stated plainly: the ledger starts empty, so a record already orphaned
before this ships is not cleaned up by it. @FlixiDoe still has to delete the
current bad entry by hand once. This stops it recurring.

Workouts ("noop-workout-<startTs>") share the id shape and the exposure, but are
written from a different lifecycle and their start has not been shown to move the
way sleep's demonstrably does. Left alone rather than fixed blind.
---
 .../com/noop/ingest/HealthConnectLedger.kt    | 105 +++++++++
 .../com/noop/ingest/HealthConnectWriter.kt    |  73 ++++++-
 .../noop/ingest/HealthConnectLedgerTest.kt    | 203 ++++++++++++++++++
 3 files changed, 375 insertions(+), 6 deletions(-)
 create mode 100644 android/app/src/main/java/com/noop/ingest/HealthConnectLedger.kt
 create mode 100644 android/app/src/test/java/com/noop/ingest/HealthConnectLedgerTest.kt

diff --git a/android/app/src/main/java/com/noop/ingest/HealthConnectLedger.kt b/android/app/src/main/java/com/noop/ingest/HealthConnectLedger.kt
new file mode 100644
index 0000000000..7268478a8d
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ingest/HealthConnectLedger.kt
@@ -0,0 +1,105 @@
+package com.noop.ingest
+
+import android.content.Context
+
+/**
+ * What NOOP has already written to Health Connect, so it can take it back (#1677).
+ *
+ * The writer is idempotent by `clientRecordId` and versions each record so a later, fuller copy upserts
+ * over an earlier one. That covers a record whose id STAYS THE SAME. It cannot cover a record whose id
+ * stops being produced — Health Connect never removes an id you simply stop writing.
+ *
+ * That case is routine for sleep, not exotic. `sleepSession`'s primary key is (deviceId, startTs), so a
+ * re-detection that lands on a different start is a DIFFERENT ROW, and the #1248/#1284 heal deletes the
+ * stale row once a fuller copy wins — `SleepSessionDedup` exists because one night really can accumulate
+ * several rows with different starts. The exporter's only cleanup path, `absorbedClientIds`, is computed
+ * from rows STILL IN THE DATABASE, so the moment the heal drops that row the exporter loses all knowledge
+ * that it ever wrote a Health Connect record under its id. The record then cannot be corrected or removed
+ * by any later export, which is exactly what #1677 reports: re-running the export does not fix it.
+ *
+ * So the exporter needs a memory of its own. This is that memory: the ids written per record type, and
+ * the rule for which of them a later export should retract.
+ */
+object HealthConnectLedger {
+
+    /** One entry per record type whose id embeds a MUTABLE timestamp. Day-keyed ids
+     *  (`noop-<metric>-<day>`) need no ledger: a day never changes its own key. */
+    const val SLEEP_PREFIX = "noop-sleep-"
+    const val WORKOUT_PREFIX = "noop-workout-"
+
+    /**
+     * PER STRAP, and that is load-bearing rather than tidy.
+     *
+     * The export is device-scoped: `sleepSessionsMerged(deviceId)` reads that strap union the canonical
+     * id, so nights banked under a DIFFERENT strap are not in its result. With one shared ledger, an
+     * export running as strap B would find strap A's ids absent-but-in-window and retract them —
+     * deleting Health Connect records that are perfectly valid, for a user who did nothing but switch
+     * which strap is active. Before any of this those records merely lingered; a global key would have
+     * turned a harmless staleness into data loss.
+     *
+     * Keyed per strap, each export can only ever take back what that same strap put there. Nights under
+     * the canonical id appear in every strap's union, so they land in every ledger and are never the odd
+     * one out.
+     *
+     * Pure so the separation is pinned by a test rather than by this comment.
+     */
+    fun ledgerKey(deviceId: String, prefix: String) = "hc.written.$deviceId.$prefix"
+
+    fun previouslyWritten(context: Context, deviceId: String, prefix: String): Set<String> =
+        prefs(context).getStringSet(ledgerKey(deviceId, prefix), emptySet()) ?: emptySet()
+
+    fun remember(context: Context, deviceId: String, prefix: String, ids: Set<String>) {
+        // A COPY: SharedPreferences keeps the very set instance it was handed, and mutating or re-reading
+        // it afterwards is documented as undefined. Cheap insurance against a bug that only shows up later.
+        prefs(context).edit().putStringSet(ledgerKey(deviceId, prefix), HashSet(ids)).apply()
+    }
+
+    private fun prefs(context: Context) =
+        context.getSharedPreferences(com.noop.ui.NoopPrefs.NAME, Context.MODE_PRIVATE)
+
+    /**
+     * What the ledger should carry into the NEXT export.
+     *
+     * Not simply the ids just written. A retraction that FAILED — Health Connect unavailable, the
+     * permission pulled mid-export, a transient remote error — still has a live record behind it, and
+     * dropping its id here would forget it forever. That is the exact failure this whole file exists to
+     * prevent, reintroduced through the error path, and the first version of this change had it.
+     *
+     * So a failed retraction stays on the books and is retried next time. It costs one id in a
+     * SharedPreferences set until it succeeds.
+     */
+    fun ledgerAfterExport(current: Set<String>, unretracted: Set<String>): Set<String> =
+        current + unretracted
+
+    /**
+     * Which previously-written ids should this export RETRACT?
+     *
+     * The obvious answer — everything we wrote before and are not writing now — is WRONG, and wrong in
+     * the most expensive direction: it deletes the user's data. The export covers a rolling window, so a
+     * night that simply aged out of that window is absent from [current] while its Health Connect record
+     * is perfectly good. Retracting it would silently destroy history the user still has.
+     *
+     * So an id is retracted only when its own timestamp falls INSIDE the window this export actually
+     * covered. Outside it, the export had nothing to say about that record and says nothing.
+     *
+     * An id whose timestamp cannot be parsed is never retracted. It is not ours to reason about, and
+     * guessing costs data while abstaining costs one stale row.
+     *
+     * Pure so both rules are pinned without a Health Connect client or a clock.
+     */
+    fun staleClientIds(
+        previous: Set<String>,
+        current: Set<String>,
+        prefix: String,
+        windowStartSec: Long,
+        nowSec: Long,
+    ): List<String> = previous
+        .asSequence()
+        .filter { it !in current }
+        .filter { id ->
+            val ts = id.removePrefix(prefix).toLongOrNull()
+            ts != null && ts in windowStartSec..nowSec
+        }
+        .sorted()   // deterministic, so a log line and a test read the same order
+        .toList()
+}
diff --git a/android/app/src/main/java/com/noop/ingest/HealthConnectWriter.kt b/android/app/src/main/java/com/noop/ingest/HealthConnectWriter.kt
index 1dd8196aad..c1c6cbef98 100644
--- a/android/app/src/main/java/com/noop/ingest/HealthConnectWriter.kt
+++ b/android/app/src/main/java/com/noop/ingest/HealthConnectWriter.kt
@@ -1,5 +1,7 @@
 package com.noop.ingest
 
+import kotlinx.coroutines.sync.withLock
+
 import android.content.Context
 import androidx.health.connect.client.HealthConnectClient
 import androidx.health.connect.client.permission.HealthPermission
@@ -89,6 +91,16 @@ object HealthConnectWriter {
     val PERMISSIONS: Set<String> =
         WRITE_RECORDS.map { HealthPermission.getWritePermission(it) }.toSet()
 
+    /**
+     * #1677: exports are serialized. Three callers can start one - the post-sync hook in WhoopBleClient
+     * and two in AppViewModel - with no uniqueness guard between them, so two could previously overlap on
+     * the same external store. That is newly consequential now the writer keeps a ledger: both would read
+     * the same `previous`, both would write their own result, and the loser's carried-forward retractions
+     * would be forgotten, orphaning exactly the records this change exists to retract. Serializing also
+     * stops two exports doing the same insert work twice.
+     */
+    private val exportMutex = kotlinx.coroutines.sync.Mutex()
+
     /**
      * Write the last [WINDOW_DAYS] of computed metrics. Returns a [WritebackResult] — the record
      * count PLUS any per-concern failure categories, so a revoked permission no longer looks like a
@@ -99,7 +111,10 @@ object HealthConnectWriter {
      * rows under `whoop-<address>`, so a hardcoded legacy "my-whoop" id reads empty tables and
      * exports nothing.
      */
-    suspend fun write(context: Context, repo: WhoopRepository, deviceId: String): WritebackResult {
+    suspend fun write(context: Context, repo: WhoopRepository, deviceId: String): WritebackResult =
+        exportMutex.withLock { writeLocked(context, repo, deviceId) }
+
+    private suspend fun writeLocked(context: Context, repo: WhoopRepository, deviceId: String): WritebackResult {
         if (HealthConnectClient.getSdkStatus(context) != HealthConnectClient.SDK_AVAILABLE) return WritebackResult.UNAVAILABLE
 
         // Guard the pre-insert work (client acquisition + the day read) the same way the concern inserts
@@ -172,7 +187,7 @@ object HealthConnectWriter {
         }
         runCatching { writeHeartRate(client, context, repo, deviceId, version) }
             .fold({ total += it }, { failures += it.writebackCategory() })
-        runCatching { writeSleep(client, repo, deviceId) }
+        runCatching { writeSleep(client, context, repo, deviceId) }
             .fold({ total += it }, { failures += it.writebackCategory() })
         // #1525: separate attempt on purpose. The daily records above go in ONE insertRecords call, so a
         // missing permission there loses resting HR, HRV, SpO2 and respiratory rate together. On its own,
@@ -259,13 +274,21 @@ object HealthConnectWriter {
      * and the absorbed fragments' old per-fragment records are DELETED (HC upserts by id but never
      * removes an id we stop writing).
      */
-    private suspend fun writeSleep(client: HealthConnectClient, repo: WhoopRepository, deviceId: String): Int {
+    private suspend fun writeSleep(
+        client: HealthConnectClient,
+        context: Context,
+        repo: WhoopRepository,
+        deviceId: String,
+    ): Int {
         val now = System.currentTimeMillis() / 1000
         val floor = now - WINDOW_DAYS * 86_400
         val sessions = repo.sleepSessionsMerged(deviceId, from = floor, to = now)
             .map { HealthExportPlan.SleepInput(it.startTs, it.effectiveStartTs, it.endTs, it.stagesJSON) }
         val offsetSec = (java.util.TimeZone.getDefault().getOffset(now * 1000) / 1000).toLong()
         val plans = HealthExportPlan.sleepSessions(sessions, now, offsetSec)
+        // Deliberately BEFORE the ledger below. "No plans" is not the same statement as "the user has no
+        // sleep": a read that came back empty for any reason would, with retraction enabled, delete every
+        // night this window covers. Saying nothing is the recoverable failure; deleting is not.
         if (plans.isEmpty()) return 0
 
         val zone = ZoneId.systemDefault()
@@ -295,13 +318,51 @@ object HealthConnectWriter {
         // Clear absorbed fragments' old records BEFORE the merged upsert, so a night previously
         // exported as two entries never lingers as one merged + one stale fragment. (#364)
         val absorbed = plans.flatMap { it.absorbedClientIds }
-        if (absorbed.isNotEmpty()) {
+        // #1677: and the ids we wrote on a PREVIOUS export that this one no longer produces. `absorbed`
+        // cannot cover those: it is derived from sleepSession rows still in the database, and the
+        // #1248/#1284 heal deletes a stale row the moment a fuller copy of that night wins. A record
+        // exported mid-sync under the partial night's start then had nothing left pointing at it, so no
+        // later export could correct or remove it — the permanent wrong duration #1677 describes.
+        // Scoped to this export's own window by `staleClientIds`, so a night that merely aged out is
+        // never retracted.
+        val currentIds = plans.map { it.clientId }.toSet()
+        val stale = HealthConnectLedger.staleClientIds(
+            previous = HealthConnectLedger.previouslyWritten(
+                context, deviceId, HealthConnectLedger.SLEEP_PREFIX),
+            current = currentIds,
+            prefix = HealthConnectLedger.SLEEP_PREFIX,
+            windowStartSec = floor,
+            nowSec = now,
+        )
+        val retract = (absorbed + stale).distinct()
+        // Ids whose retraction did NOT land. They stay on the books so the next export tries again -
+        // forgetting one would orphan its record permanently, which is the very failure this fixes.
+        val unretracted = LinkedHashSet<String>()
+        if (retract.isNotEmpty()) {
+            // One call for the common case. If it throws, retry per id: the reporter of #1677 had already
+            // deleted the bad record by hand, and an id that is no longer there must not take the rest of
+            // the batch down with it. `retract` is a handful of entries at most, so the fallback is cheap.
             runCatching {
                 client.deleteRecords(SleepSessionRecord::class,
-                    recordIdsList = emptyList(), clientRecordIdsList = absorbed)
+                    recordIdsList = emptyList(), clientRecordIdsList = retract)
+            }.onFailure {
+                for (one in retract) {
+                    runCatching {
+                        client.deleteRecords(SleepSessionRecord::class,
+                            recordIdsList = emptyList(), clientRecordIdsList = listOf(one))
+                    }.onFailure { unretracted += one }
+                }
             }
         }
-        return insertChunked(client, records)
+        val written = insertChunked(client, records)
+        // Recorded only AFTER the write lands. Remembering ids we failed to write would make the NEXT
+        // export retract records that never existed - harmless in itself, but it would also drop the ids
+        // that do need retracting from the ledger, quietly restoring the bug this fixes.
+        HealthConnectLedger.remember(
+            context, deviceId, HealthConnectLedger.SLEEP_PREFIX,
+            HealthConnectLedger.ledgerAfterExport(currentIds, unretracted),
+        )
+        return written
     }
 
     /**
diff --git a/android/app/src/test/java/com/noop/ingest/HealthConnectLedgerTest.kt b/android/app/src/test/java/com/noop/ingest/HealthConnectLedgerTest.kt
new file mode 100644
index 0000000000..4718d321a8
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ingest/HealthConnectLedgerTest.kt
@@ -0,0 +1,203 @@
+package com.noop.ingest
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #1677: a Health Connect record NOOP stops writing is a record NOOP can no longer take back, because
+ * Health Connect never removes an id you simply stop producing. These rules decide which previously
+ * written ids an export retracts — and, far more importantly, which it must leave alone.
+ */
+class HealthConnectLedgerTest {
+
+    private val p = HealthConnectLedger.SLEEP_PREFIX
+    private val now = 1_800_000_000L
+    private val windowStart = now - 60L * 86_400L
+
+    private fun id(ts: Long) = "$p$ts"
+
+    /**
+     * The reported bug, end to end. A partial night exported mid-sync under its own start; the heal then
+     * replaced that row with a fuller copy starting earlier, so the next export produces a DIFFERENT id
+     * and the first record had nothing left pointing at it.
+     */
+    @Test
+    fun `an id the export no longer produces is retracted`() {
+        val partial = id(now - 3 * 86_400)          // written during the strap sync
+        val full = id(now - 3 * 86_400 - 7_200)     // same night, re-detected two hours earlier
+        val stale = HealthConnectLedger.staleClientIds(
+            previous = setOf(partial), current = setOf(full),
+            prefix = p, windowStartSec = windowStart, nowSec = now,
+        )
+        assertEquals(listOf(partial), stale)
+    }
+
+    /** An id still being produced is an upsert, not a retraction. */
+    @Test
+    fun `an id still produced is never retracted`() {
+        val keep = id(now - 86_400)
+        assertTrue(
+            HealthConnectLedger.staleClientIds(
+                previous = setOf(keep), current = setOf(keep),
+                prefix = p, windowStartSec = windowStart, nowSec = now,
+            ).isEmpty(),
+        )
+    }
+
+    /**
+     * THE one that matters most. The export covers a rolling window, so a night that simply aged out is
+     * absent from `current` while its record is perfectly good. Retracting on absence alone would delete
+     * the user's history — the failure this rule exists to prevent, not a side note.
+     */
+    @Test
+    fun `a night that merely aged out of the window is left alone`() {
+        val old = id(windowStart - 86_400)           // one day older than this export could see
+        assertTrue(
+            HealthConnectLedger.staleClientIds(
+                previous = setOf(old), current = emptySet(),
+                prefix = p, windowStartSec = windowStart, nowSec = now,
+            ).isEmpty(),
+        )
+    }
+
+    /** The boundaries are inclusive, so the window's own edges are covered rather than skipped. */
+    @Test
+    fun `the window edges are inclusive`() {
+        val edges = setOf(id(windowStart), id(now))
+        assertEquals(
+            edges.sorted(),
+            HealthConnectLedger.staleClientIds(
+                previous = edges, current = emptySet(),
+                prefix = p, windowStartSec = windowStart, nowSec = now,
+            ),
+        )
+    }
+
+    /** A future-dated id is not something this export spoke about either. */
+    @Test
+    fun `an id past the window's end is left alone`() {
+        assertTrue(
+            HealthConnectLedger.staleClientIds(
+                previous = setOf(id(now + 3_600)), current = emptySet(),
+                prefix = p, windowStartSec = windowStart, nowSec = now,
+            ).isEmpty(),
+        )
+    }
+
+    /**
+     * An id whose timestamp will not parse is not ours to reason about. Abstaining costs one stale row;
+     * guessing costs the user's data, so the tie is broken toward doing nothing.
+     */
+    @Test
+    fun `an unparseable id is never retracted`() {
+        val junk = setOf("${p}not-a-number", "noop-sleep-", "some-other-app-record")
+        assertTrue(
+            HealthConnectLedger.staleClientIds(
+                previous = junk, current = emptySet(),
+                prefix = p, windowStartSec = windowStart, nowSec = now,
+            ).isEmpty(),
+        )
+    }
+
+    /** Deterministic order, so a log line and a test read the same sequence. */
+    @Test
+    fun `retractions come back sorted`() {
+        val a = id(now - 5 * 86_400); val b = id(now - 2 * 86_400); val c = id(now - 9 * 86_400)
+        assertEquals(
+            listOf(a, b, c).sorted(),
+            HealthConnectLedger.staleClientIds(
+                previous = setOf(b, c, a), current = emptySet(),
+                prefix = p, windowStartSec = windowStart, nowSec = now,
+            ),
+        )
+    }
+
+    /** The workout ids share the shape, so the rule has to be prefix-agnostic rather than sleep-shaped. */
+    @Test
+    fun `the rule works for any prefixed id`() {
+        val w = HealthConnectLedger.WORKOUT_PREFIX
+        assertEquals(
+            listOf("$w${now - 86_400}"),
+            HealthConnectLedger.staleClientIds(
+                previous = setOf("$w${now - 86_400}"), current = emptySet(),
+                prefix = w, windowStartSec = windowStart, nowSec = now,
+            ),
+        )
+    }
+
+    // --- what the ledger carries forward ---
+
+    /**
+     * The defect this guards is one I shipped in the first version of this change: remembering only the
+     * ids just written. A retraction that FAILED still has a live record behind it, and dropping its id
+     * forgets it forever — the exact orphan this file exists to prevent, reintroduced through the error
+     * path. Anyone "simplifying" this back to `current` should fail here.
+     */
+    @Test
+    fun `a failed retraction stays on the books for the next export`() {
+        val written = setOf(id(now - 86_400))
+        val couldNotDelete = setOf(id(now - 4 * 86_400))
+        val next = HealthConnectLedger.ledgerAfterExport(written, couldNotDelete)
+        assertTrue(next.containsAll(written))
+        assertTrue(next.containsAll(couldNotDelete))
+    }
+
+    /** And it is retried: still in `previous`, still absent from `current`, still inside the window. */
+    @Test
+    fun `the carried-forward id is retracted again next time`() {
+        val stuck = id(now - 4 * 86_400)
+        val next = HealthConnectLedger.ledgerAfterExport(setOf(id(now - 86_400)), setOf(stuck))
+        assertEquals(
+            listOf(stuck),
+            HealthConnectLedger.staleClientIds(
+                previous = next, current = setOf(id(now - 86_400)),
+                prefix = p, windowStartSec = windowStart, nowSec = now,
+            ),
+        )
+    }
+
+    /** Nothing failed: the ledger is exactly what was written, so it cannot grow without cause. */
+    @Test
+    fun `a clean export carries nothing extra`() {
+        val written = setOf(id(now - 86_400), id(now - 2 * 86_400))
+        assertEquals(written, HealthConnectLedger.ledgerAfterExport(written, emptySet()))
+    }
+
+    // --- one ledger per strap ---
+
+    /**
+     * The regression this keying prevents, and it is a data-loss one. The export is device-scoped:
+     * `sleepSessionsMerged(deviceId)` reads that strap union the canonical id, so a night banked under a
+     * DIFFERENT strap is simply not in its result. Share one ledger and an export running as strap B
+     * finds strap A's ids absent-but-in-window and retracts them — deleting valid Health Connect records
+     * because the user switched which strap is active.
+     */
+    @Test
+    fun `two straps do not share a ledger`() {
+        assertNotEquals(
+            HealthConnectLedger.ledgerKey("whoop-aaa", p),
+            HealthConnectLedger.ledgerKey("whoop-bbb", p),
+        )
+    }
+
+    /** The same strap keeps the same key across exports, or nothing would ever be retracted. */
+    @Test
+    fun `one strap keeps one key`() {
+        assertEquals(
+            HealthConnectLedger.ledgerKey("whoop-aaa", p),
+            HealthConnectLedger.ledgerKey("whoop-aaa", p),
+        )
+    }
+
+    /** Record types stay separate too: retracting sleep must never reach a workout id. */
+    @Test
+    fun `record types do not share a ledger either`() {
+        assertNotEquals(
+            HealthConnectLedger.ledgerKey("whoop-aaa", HealthConnectLedger.SLEEP_PREFIX),
+            HealthConnectLedger.ledgerKey("whoop-aaa", HealthConnectLedger.WORKOUT_PREFIX),
+        )
+    }
+}
+

From 39f284b52b4768546d0a0c76d286ffb5f89801b3 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 21:48:42 +1200
Subject: [PATCH 016/333] rescore: only the pass that owes the debt may settle
 it (#1684)

@pipiche38 traced this to source and the diagnosis holds exactly.

RescoreBackgroundScheduler tracks "a re-score is owed" with a single global
UserDefaults boolean, and markRescoreCompleted cleared it UNCONDITIONALLY at the
end of any pass that reached its natural completion. A trigger firing mid-pass -
for data that arrived after that pass had already read its inputs - had its debt
erased before the correction it was recorded for ever ran.

The day-scoring loop counts backwards from today, so the night most likely to
still be receiving data is the first thing any pass reads and the likeliest to be
caught mid-write. Their capture shows one night scored from 199 minutes against
~427-486 by two independent references, sitting at a calm-looking 87.5% recovery
with nothing to suggest anything was wrong. The mechanism that exists so a
deferred pass is never dropped was losing the debt itself.

markRescoreOwed now stamps a token and returns it; analyzeRecent keeps its own
and hands it back; markRescoreCompleted settles only if that token is still the
current one, so a newer debt outlives the pass that did not pay it.

A TOKEN, NOT A COUNTER. A counter needs read-modify-write, so two triggers marking
at the same moment could both read N and both write N+1 - losing an increment, and
with it exactly the debt this protects. A fresh token is a single write:
concurrent marks each produce a distinct one, the last wins, and it cannot equal
any pass's captured token.

WHY THIS WAS A SLIP, NOT A DESIGN GAP - the parity audit's most useful output.
The watermark beside it already captures its value at the top of the pass and
writes back THAT value at the end, so HR arriving mid-pass leaves the watermark
behind and the next trigger re-scores. True on iOS (wmKey read at :557, written
at :2365) and on Android, whose post-offload gate says it in its own words:
"captured before the run, written only on success, so an interrupted/failed pass
can never advance the watermark past unscored data." The owed flag was the ONE
piece of per-pass state that skipped capture-then-compare and just cleared. The
fix restores a discipline the surrounding code already followed, and the rule is
now written beside the token capture for whoever adds the next piece of per-pass
state. Everything analyzeRecent persists at pass end was enumerated: the
watermark and the completion mark, nothing else. No third instance.

Three review passes, three finds, none in the happy path:
  - six existing call sites were updated by a blanket regex into technically
    correct but misleading tests - handing them the CURRENT token read as though
    a debt were being settled and made settlement trivially true, so one
    assertion had quietly become a tautology. They say `owedToken: nil` now:
    bank a measurement, settle nothing.
  - declining to settle was SILENT. The log said "re-score: done" either way, so
    the new and interesting outcome was indistinguishable in a capture from an
    ordinary completion - the exact failure #1538 is remembered for, quoted in
    this very issue ("cost three nights because the log recorded that scoring had
    not happened without ever recording why"). markRescoreCompleted now reports
    whether it settled and analyzeRecent names the cause when it did not.
  - the parity framing above.

Apple-only, verified by concept rather than by symbol name: owed / pendingRescore
/ needsRescore / deferRescore and every WorkManager worker. Android has no
deferred-rescore bookkeeping and none of its workers runs scoring, because #1538
is an iOS suspension problem.

Deliberate directions, each the recoverable one: a pass with no token never
settles (costs an extra pass, versus a night's scores staying stale); the pass
duration is banked either way, being telemetry about that pass and true whoever
owes; the deferral path discards its token because it records a debt for someone
else to pay.

Verification: 8 new tests - the reported mid-pass race, the current-token holder
still settling (or the flag would never clear), the duration banked by a pass that
cannot settle, the no-token and mismatch rules, 50 marks stamping 50 distinct
tokens, and completion reporting its own outcome. Existing call sites were updated
rather than given a default that would have left the old unconditional behaviour
reachable. Settlement rule also compiled standalone with swiftc. Verified with no
change needed: each function is defined ONCE above the file's #if os(iOS) splits;
no early exit sits between marking and settling; the policy consults
rescoreAlreadyOwed only when backgrounded, so a surviving debt cannot wedge
anything; and the token is not in the .noopbak whitelist.

app-build green on Build Strand, Test Strand and Build NOOPiOS.

Not the PR that claimed to fix this: #1682 added a markdown file describing a
patch against invented symbols and changed no source. It was closed.
---
 Strand/Data/IntelligenceEngine.swift          | 22 ++++-
 .../System/RescoreBackgroundScheduler.swift   | 52 ++++++++++-
 .../RescoreBackgroundSchedulerTests.swift     | 93 +++++++++++++++++--
 3 files changed, 154 insertions(+), 13 deletions(-)

diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index ecb8e01162..84f869d389 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -607,7 +607,18 @@ final class IntelligenceEngine: ObservableObject {
         // between here and there, so "started and never finished" means exactly "killed", never a silent
         // internal skip. `RescoreBackgroundPolicy` reads it to stop re-attempting a pass that cannot
         // finish in the background, which is the livelock in #1538.
-        RescoreBackgroundScheduler.markRescoreOwed()
+        // #1681: keep the token this debt was stamped with. At the end of the pass it is what tells our
+        // own debt apart from one a LATER trigger recorded while we were running - the latter must
+        // survive us, because the data it was recorded for arrived after we had already read our inputs.
+        //
+        // This is the SAME discipline the watermark beside it already used and the owed flag did not:
+        // capture the value at the start, compare against it at the end, never re-read. `wmKey` is read
+        // once at the top and the pass writes back THAT value, so HR arriving mid-pass leaves the
+        // watermark behind and the next trigger re-scores. The owed flag was the one piece of per-pass
+        // state that skipped the capture and just cleared, which is exactly where #1681 lived. The
+        // Kotlin post-offload gate makes the same point in its own words: "captured before the run,
+        // written only on success".
+        let owedToken = RescoreBackgroundScheduler.markRescoreOwed()
         // #899-A re-arm: clear the lock, then if a forced rescore was dropped while this pass held it,
         // run it ONCE. The flag is cleared BEFORE the re-invoke (a single re-arm), so a forced call landing
         // DURING the re-invoke re-arms it again but a quiet one does not , this can never recurse unbounded.
@@ -2365,8 +2376,15 @@ final class IntelligenceEngine: ObservableObject {
         // background wake from one that never could, instead of guessing from a constant — the cost varies
         // by more than an order of magnitude with history size.
         let elapsed = Date().timeIntervalSince(reScoreStart)
-        RescoreBackgroundScheduler.markRescoreCompleted(seconds: elapsed)
+        let settled = RescoreBackgroundScheduler.markRescoreCompleted(seconds: elapsed, owedToken: owedToken)
         diagnosticSink?("re-score: done — scored \(scoredNights.count) night(s) in \(Int(elapsed * 1000)) ms (#1005)", nil)
+        // #1681: a pass that completes while leaving the mark SET looks identical in a capture to one that
+        // cleared it. Rare-event evidence, so always-on: it costs a line only when it actually happens,
+        // and it is exactly what is missing when someone reports the app re-scoring on every launch.
+        if !settled {
+            diagnosticSink?("re-score: debt NOT settled — a newer re-score was recorded while this pass "
+                            + "was running, so the mark stays and another pass will run (#1681)", nil)
+        }
     }
 
     /// UserDefaults key for the #836 idle-tick gate: the `(count:maxTs)` HR fingerprint the last completed
diff --git a/Strand/System/RescoreBackgroundScheduler.swift b/Strand/System/RescoreBackgroundScheduler.swift
index 590cbda71d..8933eede0e 100644
--- a/Strand/System/RescoreBackgroundScheduler.swift
+++ b/Strand/System/RescoreBackgroundScheduler.swift
@@ -36,8 +36,18 @@ enum RescoreBackgroundScheduler {
     /// Seconds the last COMPLETED pass took. Only ever written by a pass that reached the end.
     static let lastPassSecondsKey = "noop.rescoreLastPassSeconds"
 
+    /// Identifies the MOST RECENT debt, so a pass can tell its own from someone else's (#1681).
+    ///
+    /// A token rather than a counter, deliberately. A counter needs read-modify-write, and two triggers
+    /// marking a debt at the same moment could both read N and both write N+1 — losing an increment, and
+    /// with it exactly the debt this is meant to protect. A fresh token is a single write: concurrent
+    /// marks each produce a distinct one, the last wins, and it cannot equal any pass's captured token.
+    static let owedTokenKey = "noop.rescoreOwedToken"
+
     static var isRescoreOwed: Bool { UserDefaults.standard.bool(forKey: owedKey) }
 
+    static var currentOwedToken: String? { UserDefaults.standard.string(forKey: owedTokenKey) }
+
     static var lastCompletedPassSeconds: Double? {
         guard UserDefaults.standard.object(forKey: lastPassSecondsKey) != nil else { return nil }
         let value = UserDefaults.standard.double(forKey: lastPassSecondsKey)
@@ -47,17 +57,53 @@ enum RescoreBackgroundScheduler {
     /// Mark a re-score as owed. Called by `IntelligenceEngine` once a pass is past every gate and is
     /// definitely about to work — so that a kill leaves the debt behind — and by the deferral path, where
     /// no pass is attempted at all but the work is just as outstanding.
-    static func markRescoreOwed() {
+    /// Returns the token stamped on this debt. A pass keeps it and hands it back at completion; every
+    /// other caller (the deferral path) can ignore it, since it is not the one that will settle up.
+    @discardableResult
+    static func markRescoreOwed() -> String {
+        let token = UUID().uuidString
         UserDefaults.standard.set(true, forKey: owedKey)
+        UserDefaults.standard.set(token, forKey: owedTokenKey)
+        return token
+    }
+
+    /// May a pass holding [capturedToken] settle the debt?
+    ///
+    /// Only if nothing newer was recorded while it ran. The bug in #1681 is that this question was never
+    /// asked: completion cleared one global boolean unconditionally, so a trigger firing mid-pass — for
+    /// data that arrived AFTER the pass had already read its inputs — had its debt erased before the
+    /// correction it was recorded for ever ran. The scoring loop starts at today, so the night most
+    /// likely to still be syncing is the first thing read and the likeliest to be caught mid-write.
+    ///
+    /// A pass with NO token never settles. That errs toward one extra pass, which costs battery; the
+    /// other direction costs a night's scores until something unrelated happens to re-score it, which is
+    /// the failure being fixed.
+    ///
+    /// Pure, so the rule is pinned without UserDefaults or a background task.
+    static func maySettleDebt(capturedToken: String?, currentToken: String?) -> Bool {
+        guard let capturedToken, !capturedToken.isEmpty else { return false }
+        return capturedToken == currentToken
     }
 
     /// Settle the debt at the end of a completed pass, beside the watermark advance. A pass that is
     /// killed never reaches this, which is what leaves the mark set for the next launch to find.
-    static func markRescoreCompleted(seconds: Double) {
-        UserDefaults.standard.set(false, forKey: owedKey)
+    /// [owedToken] is the token this pass received from its own `markRescoreOwed()`. The debt is settled
+    /// only if it is still the current one — see `maySettleDebt`. The pass duration is recorded either
+    /// way: it is telemetry about THIS pass, and true regardless of whose debt is now outstanding.
+    /// Returns whether the debt was actually settled, so the caller can SAY when it was not. Declining
+    /// is the interesting outcome and it must not be silent: #1538 cost three nights because the log
+    /// recorded that scoring had not happened without ever recording why, and a pass that completes
+    /// while leaving the mark set looks identical to one that cleared it unless something says so.
+    @discardableResult
+    static func markRescoreCompleted(seconds: Double, owedToken: String?) -> Bool {
+        let settled = maySettleDebt(capturedToken: owedToken, currentToken: currentOwedToken)
+        if settled {
+            UserDefaults.standard.set(false, forKey: owedKey)
+        }
         if seconds.isFinite, seconds > 0 {
             UserDefaults.standard.set(seconds, forKey: lastPassSecondsKey)
         }
+        return settled
     }
 
     /// Whether the app is somewhere a long pass might not survive. Always false on macOS — see the type doc.
diff --git a/StrandTests/RescoreBackgroundSchedulerTests.swift b/StrandTests/RescoreBackgroundSchedulerTests.swift
index 6f830af4f9..e1d79ccdc9 100644
--- a/StrandTests/RescoreBackgroundSchedulerTests.swift
+++ b/StrandTests/RescoreBackgroundSchedulerTests.swift
@@ -13,6 +13,7 @@ final class RescoreBackgroundSchedulerTests: XCTestCase {
 
     private var savedOwed: Any?
     private var savedSeconds: Any?
+    private var savedToken: Any?
 
     override func setUp() {
         super.setUp()
@@ -20,13 +21,16 @@ final class RescoreBackgroundSchedulerTests: XCTestCase {
         // restore rather than assume this suite owns them.
         savedOwed = UserDefaults.standard.object(forKey: RescoreBackgroundScheduler.owedKey)
         savedSeconds = UserDefaults.standard.object(forKey: RescoreBackgroundScheduler.lastPassSecondsKey)
+        savedToken = UserDefaults.standard.object(forKey: RescoreBackgroundScheduler.owedTokenKey)
         UserDefaults.standard.removeObject(forKey: RescoreBackgroundScheduler.owedKey)
         UserDefaults.standard.removeObject(forKey: RescoreBackgroundScheduler.lastPassSecondsKey)
+        UserDefaults.standard.removeObject(forKey: RescoreBackgroundScheduler.owedTokenKey)
     }
 
     override func tearDown() {
         restore(savedOwed, RescoreBackgroundScheduler.owedKey)
         restore(savedSeconds, RescoreBackgroundScheduler.lastPassSecondsKey)
+        restore(savedToken, RescoreBackgroundScheduler.owedTokenKey)
         super.tearDown()
     }
 
@@ -41,9 +45,9 @@ final class RescoreBackgroundSchedulerTests: XCTestCase {
     /// discover that an earlier one was killed — the killed process never gets to report anything itself.
     func testAStartedPassOwesUntilItCompletes() {
         XCTAssertFalse(RescoreBackgroundScheduler.isRescoreOwed)
-        RescoreBackgroundScheduler.markRescoreOwed()
+        let token = RescoreBackgroundScheduler.markRescoreOwed()
         XCTAssertTrue(RescoreBackgroundScheduler.isRescoreOwed)
-        RescoreBackgroundScheduler.markRescoreCompleted(seconds: 12)
+        RescoreBackgroundScheduler.markRescoreCompleted(seconds: 12, owedToken: token)
         XCTAssertFalse(RescoreBackgroundScheduler.isRescoreOwed)
     }
 
@@ -51,10 +55,10 @@ final class RescoreBackgroundSchedulerTests: XCTestCase {
     /// whether a background wake can finish the work, so a garbage value must read as "no measurement"
     /// rather than as a number.
     func testOnlyAUsableDurationIsBanked() {
-        RescoreBackgroundScheduler.markRescoreCompleted(seconds: 474.778)
+        RescoreBackgroundScheduler.markRescoreCompleted(seconds: 474.778, owedToken: nil)   // fixture: bank a duration, settle nothing
         XCTAssertEqual(RescoreBackgroundScheduler.lastCompletedPassSeconds ?? 0, 474.778, accuracy: 0.001)
 
-        RescoreBackgroundScheduler.markRescoreCompleted(seconds: .nan)
+        RescoreBackgroundScheduler.markRescoreCompleted(seconds: .nan, owedToken: nil)   // fixture: bank a duration, settle nothing
         XCTAssertEqual(RescoreBackgroundScheduler.lastCompletedPassSeconds ?? 0, 474.778, accuracy: 0.001,
                        "a NaN must not overwrite a good measurement")
 
@@ -68,7 +72,7 @@ final class RescoreBackgroundSchedulerTests: XCTestCase {
     /// to has nothing to find.
     func testDeferringMarksTheWorkOwedAndDoesNotRunIt() async {
         // A measured pass far over the background budget, so the policy defers.
-        RescoreBackgroundScheduler.markRescoreCompleted(seconds: 474.778)
+        RescoreBackgroundScheduler.markRescoreCompleted(seconds: 474.778, owedToken: nil)   // fixture: bank a duration, settle nothing
         XCTAssertFalse(RescoreBackgroundScheduler.isRescoreOwed)
 
         var ran = false
@@ -88,7 +92,7 @@ final class RescoreBackgroundSchedulerTests: XCTestCase {
     /// A foregrounded pass runs, whatever the measurement says. This is the case the mechanism must not
     /// break: there is no suspension deadline, so deferring would be a pure regression.
     func testAForegroundPassRunsEvenWhenSlow() async {
-        RescoreBackgroundScheduler.markRescoreCompleted(seconds: 474.778)
+        RescoreBackgroundScheduler.markRescoreCompleted(seconds: 474.778, owedToken: nil)   // fixture: bank a duration, settle nothing
 
         var ran = false
         var logged: [String] = []
@@ -125,7 +129,7 @@ final class RescoreBackgroundSchedulerTests: XCTestCase {
     /// run here is simply skipped. Recording a debt for it would send a processing task off to run a
     /// forced full pass when most likely nothing changed — the churn #1146 exists to avoid.
     func testASkippedBackstopDoesNotConjureADebt() async {
-        RescoreBackgroundScheduler.markRescoreCompleted(seconds: 474.778)
+        RescoreBackgroundScheduler.markRescoreCompleted(seconds: 474.778, owedToken: nil)   // fixture: bank a duration, settle nothing
 
         var ran = false
         var logged: [String] = []
@@ -160,9 +164,82 @@ final class RescoreBackgroundSchedulerTests: XCTestCase {
         XCTAssertTrue(foreground)
 
         var affordable = false
-        RescoreBackgroundScheduler.markRescoreCompleted(seconds: 3)
+        RescoreBackgroundScheduler.markRescoreCompleted(seconds: 3, owedToken: nil)   // fixture: bank a duration, settle nothing
         await RescoreBackgroundScheduler.run(isBackground: true, owesOnDefer: false,
                                              log: { _ in }) { affordable = true }
         XCTAssertTrue(affordable)
     }
+
+    // MARK: - #1681: whose debt is it?
+
+    /// The reported bug. A pass records its debt, and while it is running a LATER trigger records another
+    /// — for data that arrived after this pass had already read its inputs. Completion used to clear one
+    /// global boolean unconditionally, erasing that newer debt before the correction it was recorded for
+    /// ever ran. The night stayed scored from a partial sync until something unrelated happened to
+    /// re-score it.
+    func testADebtRecordedMidPassSurvivesThatPassCompleting() {
+        let mine = RescoreBackgroundScheduler.markRescoreOwed()
+        _ = RescoreBackgroundScheduler.markRescoreOwed()   // a later trigger, while the pass is still running
+
+        RescoreBackgroundScheduler.markRescoreCompleted(seconds: 9, owedToken: mine)
+
+        XCTAssertTrue(RescoreBackgroundScheduler.isRescoreOwed,
+                      "the newer debt must outlive the pass that did not pay it")
+    }
+
+    /// …and the pass that DOES hold the current token still settles, or the flag would never clear and
+    /// every launch would re-score forever.
+    func testTheHolderOfTheCurrentTokenSettles() {
+        _ = RescoreBackgroundScheduler.markRescoreOwed()
+        let latest = RescoreBackgroundScheduler.markRescoreOwed()
+        RescoreBackgroundScheduler.markRescoreCompleted(seconds: 9, owedToken: latest)
+        XCTAssertFalse(RescoreBackgroundScheduler.isRescoreOwed)
+    }
+
+    /// The duration is telemetry about THIS pass and is banked either way — it is true regardless of
+    /// whose debt is now outstanding, and the policy needs it to size a background wake.
+    func testAPassThatCannotSettleStillBanksItsDuration() {
+        let mine = RescoreBackgroundScheduler.markRescoreOwed()
+        _ = RescoreBackgroundScheduler.markRescoreOwed()
+        RescoreBackgroundScheduler.markRescoreCompleted(seconds: 33.5, owedToken: mine)
+        XCTAssertEqual(RescoreBackgroundScheduler.lastCompletedPassSeconds ?? 0, 33.5, accuracy: 0.001)
+    }
+
+    // MARK: - the settlement rule itself
+
+    /// A pass with NO token never settles. That costs one extra pass; the other direction costs a night's
+    /// scores until something unrelated re-scores it, which is the failure being fixed.
+    func testNoTokenNeverSettles() {
+        XCTAssertFalse(RescoreBackgroundScheduler.maySettleDebt(capturedToken: nil, currentToken: "a"))
+        XCTAssertFalse(RescoreBackgroundScheduler.maySettleDebt(capturedToken: "", currentToken: ""))
+    }
+
+    func testOnlyTheCurrentTokenSettles() {
+        XCTAssertTrue(RescoreBackgroundScheduler.maySettleDebt(capturedToken: "a", currentToken: "a"))
+        XCTAssertFalse(RescoreBackgroundScheduler.maySettleDebt(capturedToken: "a", currentToken: "b"))
+        XCTAssertFalse(RescoreBackgroundScheduler.maySettleDebt(capturedToken: "a", currentToken: nil))
+    }
+
+    /// Each mark stamps a DISTINCT token. A counter would need read-modify-write, and two triggers marking
+    /// at the same moment could both read N and both write N+1 — losing exactly the debt this protects.
+    func testEveryMarkStampsADistinctToken() {
+        let seen = Set((0..<50).map { _ in RescoreBackgroundScheduler.markRescoreOwed() })
+        XCTAssertEqual(seen.count, 50)
+    }
+
+    // MARK: - the outcome has to be reportable
+
+    /// Declining is the interesting outcome, and the caller can only SAY so if it is told. #1538 cost
+    /// three nights because the log recorded that scoring had not happened without recording why; a pass
+    /// that completes while leaving the mark set looks identical in a capture to one that cleared it.
+    func testCompletionReportsWhetherItSettled() {
+        let mine = RescoreBackgroundScheduler.markRescoreOwed()
+        _ = RescoreBackgroundScheduler.markRescoreOwed()
+        XCTAssertFalse(RescoreBackgroundScheduler.markRescoreCompleted(seconds: 1, owedToken: mine),
+                       "a pass that could not settle must report that, or the log cannot explain itself")
+
+        let latest = RescoreBackgroundScheduler.markRescoreOwed()
+        XCTAssertTrue(RescoreBackgroundScheduler.markRescoreCompleted(seconds: 1, owedToken: latest))
+    }
 }
+

From 19765ff81dc9578e89b61ca92bcfc49d7a32433c Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 22:36:45 +1200
Subject: [PATCH 017/333] backfill: say how old the strap's newest record is
 when a sync banks nothing (#1686)

@UncreativeX's capture shows four consecutive completed offloads that banked no
sensor rows, and a strap whose newest stored record is 24 days old. NOOP knew
that second fact - GET_DATA_RANGE gave it, and the client already logged the raw
offset as "2128521s" - and never said it in a form anyone would read. The user
was told only "the strap banked no sensor history", which is the SAME line a
perfectly healthy caught-up strap produces. That ambiguity is why #1541 has
stayed open and unactionable since May.

This is the counterpart futureRtcLine never had. That one handles a strap whose
clock runs AHEAD: it names the day count and gives the remedy. Nothing handled a
strap whose newest record sits far in the PAST.

The wording states the FACT and lets the condition carry the interpretation: "the
strap's newest stored record is about 24 day(s) old. If you have worn it since
then, it has stopped saving history to its flash." A strap left in a drawer shows
the same number innocently, so asserting a corrupt RTC would claim more than the
data supports - which is exactly how this area has misled people before.

It also says the part the standing advice omits. NOOP re-sends SET_CLOCK to a
WHOOP 4.0 on EVERY connect, in both firmware payload forms (#120), so "charge to
100% and reconnect" has effectively been retried every session for 24 days.
Telling this user to do it again was never going to help. The line gives the real
escalation - charge, Restart strap, forget and re-pair - and the one test that
settles whether NOOP is involved at all: if the official WHOOP app is also
missing those days, the strap is the cause.

CHECKED FROM THE CODE BEFORE WRITING ANY OF IT. The "banked nothing" verdict
requires decodedChunks == 0, so this is NOT records decoded and then dropped by
the #547 gate - there was nothing to decode, and the existing attribution is
honest. The backoff is not trapping them either: MANUAL is never floored, and
CONNECT/FOREGROUND use the flat 90s event floor with no multiplier.

Three review passes, three finds:

  - THE BANNER, not just the log. The first version put the age only in the strap
    log, which a user sees by exporting a capture. The message they actually read
    still said "Fully charge it to 100%, then reconnect, and it should start
    banking again" - omitting the age, and PROMISING a recovery that has not
    happened in three weeks. A fix aimed at making this actionable was reaching
    the one audience that already had the log. staleRecordBanner is the same
    honesty in banner length, and a test asserts the promise cannot come back.
  - the field was read twice, once for the log and once for the banner, so a
    mutation between them could have had the two disagree about whether the strap
    is stale. Read once now, in the enclosing scope both consume.
  - PARITY: the twinned functions matched, the INPUT did not. strapNewestTs is
    gated on feedsSync in Swift (#695 - WHOOP4 today) and set for any family that
    answers GET_DATA_RANGE on Android, so a 5/MG would have shown the dated
    wording on one platform only. Both reads are now gated on WHOOP4 explicitly,
    including where it is redundant today, so a later widening of feedsSync cannot
    silently invert which side fires. The pre-existing population difference is
    left alone: changing it would alter 5/MG sync behaviour, which is #695's
    business.

Second, smaller fix in the same area. "Backfill: skipped (FOREGROUND) - policy
floor not met (empty streak 4)" appended the streak for EVERY trigger, but the
streak - and the future-dated clock note beside it - gate PERIODIC and STRAP only;
a FOREGROUND skip is just "58s since the last sync against a 90s floor". The line
named a cause it could not attribute, and its practical cost was real: it misled
me while reading this very capture. Android only, because Swift has no such line.

Verification: the rules are pure and twinned, and BOTH staleRecordLine and
staleRecordBanner are proven byte-identical across platforms by extracting and
comparing. 12 tests (6 per platform), including the reporter's real numbers -
newest 1785692420 against wall 1787820941 - producing "about 24 day(s) old", the
two-day boundary, a night off-wrist staying silent, a future-dated record staying
futureRtcLine's job, and that neither string says "corrupt" or promises banking
will resume. Also compiled standalone with swiftc against those same capture
values. Android 4576 tests green, compile clean, doc_comment_lint and i18n clean.
app-build green on Build Strand, Test Strand and Build NOOPiOS.

Every in-repo surface carrying the old advice was swept; what remains is release
notes and changelog entries, which are historical records and stay as written.
The Troubleshooting WIKI still carries it and is not in this repo - worth
updating, since the issue template points reporters at exactly that page.

What this does NOT do: make the strap bank again. If it has genuinely stopped
writing to flash that is strap-side. It tells the user that, with evidence,
instead of leaving them to re-charge for another three weeks.
---
 Strand/BLE/BLEManager.swift                   | 25 ++++++-
 Strand/Collect/Backfiller.swift               | 48 ++++++++++++++
 StrandTests/BackfillerSessionTallyTests.swift | 58 ++++++++++++++++
 .../src/main/java/com/noop/ble/Backfiller.kt  | 66 +++++++++++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 40 +++++++++--
 .../noop/ble/BackfillerSessionTallyTest.kt    | 59 +++++++++++++++++
 6 files changed, 291 insertions(+), 5 deletions(-)

diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index 73691832f2..ed9b32c4e8 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -2438,8 +2438,31 @@ public final class BLEManager: NSObject, ObservableObject {
                     ? "console-only across \(state.consoleChunksThisSession) chunks"
                     : "metadata-only, 0 sensor rows persisted"
                 log("Backfill: completed but the strap banked no sensor history (\(detail)); consecutive empty syncs = \(emptySyncTracker.consecutiveEmptySyncs).")
+                // #1683: say HOW OLD the strap's newest stored record is. Without it the line above reads
+                // identically for a strap that is caught up and one that stopped banking three weeks ago -
+                // GET_DATA_RANGE already told us the difference and we simply never said so, which is why
+                // #1541 stayed open and unactionable. Rare-event evidence, so always-on.
+                let wallNowUnix = Int(Date().timeIntervalSince1970)
+                // Read the field ONCE: it feeds both the log line and the banner below, and they must not
+                // disagree about whether the strap is stale.
+                // WHOOP4 only, explicitly, on BOTH platforms. Redundant here today - `strapNewestTs` is
+                // only assigned when `feedsSync` (#695), which is WHOOP4 - but stated so a later widening
+                // of feedsSync cannot make this fire where the Android twin does not. A 5/MG that cannot
+                // offload has no business being told it stopped saving to flash.
+                let staleNewest: Int? = selectedModel.deviceFamily == .whoop4
+                    ? strapNewestTs.flatMap {
+                        Backfiller.isStaleNewestRecord(newestUnix: $0, wallNowUnix: wallNowUnix) ? $0 : nil
+                    }
+                    : nil
+                if let newest = staleNewest {
+                    log(Backfiller.staleRecordLine(newestUnix: newest, wallNowUnix: wallNowUnix))
+                }
+                // #1683: when the strap's own newest record dates the silence, SAY it. The generic copy
+                // below omits that and promises a recovery the charge advice has already been retried for
+                // every session; the dated version is the one a stuck user can act on.
                 state.lastSyncError = sustainedEmpty
-                    ? "Synced, but your strap had no stored history to hand over - only its diagnostic output. This usually means its clock has lost sync, so it isn't saving data to flash. Fully charge it to 100%, then reconnect, and it should start banking again."
+                    ? (staleNewest.map { Backfiller.staleRecordBanner(newestUnix: $0, wallNowUnix: wallNowUnix) }
+                        ?? "Synced, but your strap had no stored history to hand over - only its diagnostic output. This usually means its clock has lost sync, so it isn't saving data to flash. Fully charge it to 100%, then reconnect, and it should start banking again.")
                     : nil
             } else if let futureBanner = futureClockBanner {
                 // #324/#928: the strap banked records but its newest is dated implausibly in the FUTURE
diff --git a/Strand/Collect/Backfiller.swift b/Strand/Collect/Backfiller.swift
index 1f78b47a67..4fce4af55d 100644
--- a/Strand/Collect/Backfiller.swift
+++ b/Strand/Collect/Backfiller.swift
@@ -428,6 +428,54 @@ final class Backfiller {
         return "Backfill: the strap reported a record dated about \(aheadDays) day(s) in the FUTURE - its clock (RTC) is corrupt, not a NOOP problem. Those records can't be filed onto the right day. Fully charge the strap to 100% and reconnect so it re-syncs its clock; if it persists, forget and re-pair the strap."
     }
 
+    /// #1683: how far BEHIND the wall clock the strap's newest stored record may sit before a sync that
+    /// banked nothing is worth explaining. Two days, not one: a strap left off-wrist overnight is ordinary,
+    /// and this line only ever accompanies a completed offload that banked nothing anyway.
+    nonisolated static let staleRecordToleranceSeconds = 2 * 86_400
+
+    /// Is the strap's newest stored record far enough in the past to be worth naming? A nil or
+    /// non-positive value is not a date and never qualifies.
+    nonisolated static func isStaleNewestRecord(newestUnix: Int?, wallNowUnix: Int) -> Bool {
+        guard let newestUnix, newestUnix > 0 else { return false }
+        return newestUnix <= wallNowUnix - staleRecordToleranceSeconds
+    }
+
+    /// #1683: the counterpart `futureRtcLine` never had. A strap that stopped banking weeks ago and one
+    /// that is simply caught up produce the SAME "banked no sensor history" line today, so neither the user
+    /// nor anyone reading their log can tell them apart. #1541 stayed open and vague for exactly that
+    /// reason.
+    ///
+    /// Deliberately states the FACT and lets the condition carry the interpretation. A newest record two
+    /// weeks old means the strap stopped recording IF it was being worn; if it sat in a drawer, the same
+    /// number is unremarkable. Asserting a corrupt RTC here would claim more than the data supports, which
+    /// is how this area has misled people before.
+    ///
+    /// It also says the part the existing advice omits: NOOP re-sends SET_CLOCK on every connect, so
+    /// "charge it" alone has already been retried every session.
+    ///
+    /// Byte-identical to the Android twin. No em-dash (project rule).
+    nonisolated static func staleRecordLine(newestUnix: Int, wallNowUnix: Int) -> String {
+        let ageDays = max(0, wallNowUnix - newestUnix) / 86_400
+        return "Backfill: this sync banked nothing and the strap's newest stored record is about \(ageDays) day(s) old. If you have worn it since then, it has stopped saving history to its flash. NOOP already re-sends the clock on every connect, so charging alone may not be enough: charge to 100% and reconnect, then use Restart strap in Devices, and if that does not help forget and re-pair. If the official WHOOP app is also missing these days, the strap is the cause and not NOOP."
+    }
+
+
+    /// #1683: the same honesty as `staleRecordLine`, for the message the user actually READS.
+    ///
+    /// The standing banner says "fully charge it to 100%, then reconnect, and it should start banking
+    /// again". It omits the one fact that makes the situation legible - how long the strap has been
+    /// silent - and it PROMISES a recovery that has already failed every session for weeks, because NOOP
+    /// re-sends SET_CLOCK on every connect and the charge advice has therefore been retried all along. A
+    /// banner that keeps promising something that keeps not happening teaches people to distrust the app
+    /// rather than their strap.
+    ///
+    /// Byte-identical to the Android twin. Not localized, matching the sibling `lastSyncError` copy on
+    /// both platforms; localizing that surface is its own change. No em-dash (project rule).
+    nonisolated static func staleRecordBanner(newestUnix: Int, wallNowUnix: Int) -> String {
+        let ageDays = max(0, wallNowUnix - newestUnix) / 86_400
+        return "Synced, but your strap handed over no stored history, and its newest saved record is about \(ageDays) day(s) old. If you have been wearing it since then, it has stopped saving to flash. Charge it to 100% and reconnect; NOOP already re-sets its clock every connect, so if that does not help, try Restart strap in Devices, then forget and re-pair. If the official WHOOP app is missing these days too, the strap is the cause and not NOOP."
+    }
+
     /// Commit one HISTORY_END chunk: (persist decoded → enqueueRaw when present) → setCursor → ackTrim.
     /// Early-returns on any throw to preserve the safe-trim invariant.
     ///
diff --git a/StrandTests/BackfillerSessionTallyTests.swift b/StrandTests/BackfillerSessionTallyTests.swift
index 3ad3f0e91d..b787258cf7 100644
--- a/StrandTests/BackfillerSessionTallyTests.swift
+++ b/StrandTests/BackfillerSessionTallyTests.swift
@@ -285,4 +285,62 @@ final class BackfillerSessionTallyTests: XCTestCase {
                       "a truly-empty no-cursor session must still warn the strap has no banked history")
         XCTAssertTrue(joined.contains("fully charge it"))
     }
+
+    // MARK: - #1683: the stale counterpart to futureRtcLine
+
+    /// A strap that stopped banking weeks ago and one that is caught up produced the SAME "banked no
+    /// sensor history" line, so neither the user nor a triager could tell them apart. That is why #1541
+    /// stayed open and unactionable.
+    func testACaughtUpOrBrieflyIdleStrapIsNotStale() {
+        let now = 1_700_000_000
+        XCTAssertFalse(Backfiller.isStaleNewestRecord(newestUnix: nil, wallNowUnix: now))
+        XCTAssertFalse(Backfiller.isStaleNewestRecord(newestUnix: 0, wallNowUnix: now))
+        XCTAssertFalse(Backfiller.isStaleNewestRecord(newestUnix: now, wallNowUnix: now))
+        XCTAssertFalse(Backfiller.isStaleNewestRecord(newestUnix: now - 86_400, wallNowUnix: now),
+                       "one night off-wrist is ordinary and must stay silent")
+    }
+
+    func testTwoDaysIsTheBoundaryAndQualifies() {
+        let now = 1_700_000_000
+        XCTAssertTrue(Backfiller.isStaleNewestRecord(newestUnix: now - 2 * 86_400, wallNowUnix: now))
+    }
+
+    /// A future-dated record belongs to `futureRtcLine`; this rule must not also claim it.
+    func testAFutureDatedRecordIsNotStale() {
+        let now = 1_700_000_000
+        XCTAssertFalse(Backfiller.isStaleNewestRecord(newestUnix: now + 86_400, wallNowUnix: now))
+    }
+
+    /// The numbers from the #1683 capture: newest stored record 1785692420 against a wall clock of
+    /// 1787820941. The user was told only "banked no sensor history"; this says three weeks.
+    func testStaleRecordLineReportsTheRealCaptureAsTwentyFourDays() {
+        let line = Backfiller.staleRecordLine(newestUnix: 1_785_692_420, wallNowUnix: 1_787_820_941)
+        XCTAssertTrue(line.contains("about 24 day(s) old"), line)
+        XCTAssertTrue(line.contains("stopped saving history"), line)
+        // The part the old advice omitted: charging alone has already been retried every connect.
+        XCTAssertTrue(line.contains("re-sends the clock on every connect"), line)
+        // The test that tells the user whether NOOP is even involved.
+        XCTAssertTrue(line.contains("official WHOOP app"), line)
+        XCTAssertFalse(line.contains("\u{2014}"))
+    }
+
+    /// States the fact, never the diagnosis: a drawered strap shows the same number innocently.
+    func testStaleRecordLineDoesNotAssertACorruptClock() {
+        let line = Backfiller.staleRecordLine(newestUnix: 1_700_000_000 - 20 * 86_400,
+                                              wallNowUnix: 1_700_000_000)
+        XCTAssertFalse(line.contains("corrupt"), line)
+        XCTAssertTrue(line.contains("If you have worn it"), line)
+    }
+
+    /// The banner is what the user READS; the log line needs a capture export. The standing banner
+    /// omitted the age entirely and PROMISED that charging "should" work - advice NOOP has effectively
+    /// retried on every connect for weeks, since it re-sends SET_CLOCK each time.
+    func testStaleRecordBannerDatesTheSilenceAndPromisesNothing() {
+        let line = Backfiller.staleRecordBanner(newestUnix: 1_785_692_420, wallNowUnix: 1_787_820_941)
+        XCTAssertTrue(line.contains("about 24 day(s) old"), line)
+        XCTAssertTrue(line.contains("If you have been wearing it"), line)
+        XCTAssertTrue(line.contains("official WHOOP app"), line)
+        XCTAssertFalse(line.contains("should start banking again"), line)
+        XCTAssertFalse(line.contains("\u{2014}"))
+    }
 }
diff --git a/android/app/src/main/java/com/noop/ble/Backfiller.kt b/android/app/src/main/java/com/noop/ble/Backfiller.kt
index 27e2284c5c..2759786d01 100644
--- a/android/app/src/main/java/com/noop/ble/Backfiller.kt
+++ b/android/app/src/main/java/com/noop/ble/Backfiller.kt
@@ -797,6 +797,72 @@ class Backfiller(
                 "right day. Fully charge the strap to 100% and reconnect so it re-syncs its clock; if it " +
                 "persists, forget and re-pair the strap."
         }
+
+        /**
+         * #1683: how far BEHIND the wall clock the strap's newest stored record may sit before a sync that
+         * banked nothing is worth explaining. Two days, not one: a strap left off-wrist overnight is
+         * ordinary, and this line only ever accompanies a completed offload that banked nothing anyway.
+         */
+        const val STALE_RECORD_TOLERANCE_SECONDS = 2 * 86_400L
+
+        /** Is the strap's newest stored record far enough in the past to be worth naming? A null or
+         *  non-positive value is not a date and never qualifies. */
+        fun isStaleNewestRecord(newestUnix: Long?, wallNowUnix: Long): Boolean =
+            newestUnix != null && newestUnix > 0L &&
+                newestUnix <= wallNowUnix - STALE_RECORD_TOLERANCE_SECONDS
+
+        /**
+         * #1683: the counterpart [futureRtcLine] never had. A strap that stopped banking weeks ago and a
+         * strap that is simply caught up produce the SAME "banked no sensor history" line today, so
+         * neither the user nor anyone reading their log can tell them apart. #1541 stayed open and vague
+         * for exactly that reason.
+         *
+         * Deliberately states the FACT and lets the condition carry the interpretation. A newest record
+         * two weeks old means the strap stopped recording IF it was being worn; if it sat in a drawer, the
+         * same number is unremarkable. Asserting a corrupt RTC here would be claiming more than the data
+         * supports, which is how this area has misled people before.
+         *
+         * It also says the part the existing advice omits: NOOP re-sends SET_CLOCK on every connect, so
+         * "charge it" alone has already been retried every session. The escalation and the
+         * compare-with-the-official-app test are what actually move a stuck case forward.
+         *
+         * Byte-identical to the Swift twin. No em-dash (project rule).
+         */
+        fun staleRecordLine(newestUnix: Long, wallNowUnix: Long): String {
+            val ageDays = maxOf(0L, wallNowUnix - newestUnix) / 86_400L
+            return "Backfill: this sync banked nothing and the strap's newest stored record is about " +
+                "$ageDays day(s) old. If you have worn it since then, it has stopped saving history to " +
+                "its flash. NOOP already re-sends the clock on every connect, so charging alone may not " +
+                "be enough: charge to 100% and reconnect, then use Restart strap in Devices, and if that " +
+                "does not help forget and re-pair. If the official WHOOP app is also missing these days, " +
+                "the strap is the cause and not NOOP."
+        }
+
+        /**
+         * #1683: the same honesty as [staleRecordLine], for the message the user actually READS.
+         *
+         * The standing banner says "fully charge it to 100%, then reconnect, and it should start banking
+         * again". It omits the one fact that makes the situation legible - how long the strap has been
+         * silent - and it PROMISES a recovery that has already failed every session for weeks, because
+         * NOOP re-sends SET_CLOCK on every connect and the charge advice has therefore been retried all
+         * along. A banner that keeps promising something that keeps not happening teaches people to
+         * distrust the app rather than their strap.
+         *
+         * Shorter than the log line: a banner is glanced at, not read. Same discipline though - state the
+         * age, condition the diagnosis on having worn it, and name the check that says whether NOOP is
+         * even involved.
+         *
+         * Byte-identical to the Swift twin. Not localized, matching the sibling `lastSyncError` copy on
+         * both platforms; localizing that surface is its own change. No em-dash (project rule).
+         */
+        fun staleRecordBanner(newestUnix: Long, wallNowUnix: Long): String {
+            val ageDays = maxOf(0L, wallNowUnix - newestUnix) / 86_400L
+            return "Synced, but your strap handed over no stored history, and its newest saved record is " +
+                "about $ageDays day(s) old. If you have been wearing it since then, it has stopped saving " +
+                "to flash. Charge it to 100% and reconnect; NOOP already re-sets its clock every connect, " +
+                "so if that does not help, try Restart strap in Devices, then forget and re-pair. If the " +
+                "official WHOOP app is missing these days too, the strap is the cause and not NOOP."
+        }
     }
 }
 
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 6058bf3c87..ad4e8ba26f 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -8023,10 +8023,21 @@ class WhoopBleClient(
                 clockUntrusted = clockUntrusted,
             )
         ) {
+            // #1683: the empty streak only stretches the floor for the AUTOMATIC triggers (PERIODIC and
+            // STRAP). Naming it on a CONNECT/FOREGROUND skip - which uses the flat event floor and is not
+            // backed off at all - reads as though the streak caused the skip. It misled a reader of a real
+            // capture, so the line now names the streak only where the streak is actually doing something.
+            val streakGatesThisTrigger =
+                trigger == BackfillTrigger.PERIODIC || trigger == BackfillTrigger.STRAP
             log(
-                "Backfill: skipped ($trigger) - policy floor not met " +
-                    "(empty streak ${emptySyncTracker.consecutiveEmptySyncs}" +
-                    "${if (clockUntrusted) ", clock future-dated" else ""})",
+                "Backfill: skipped ($trigger) - policy floor not met" +
+                    // BOTH the streak and the future-dated clock gate PERIODIC/STRAP only; CONNECT and
+                    // FOREGROUND use the flat event floor. Naming either on those triggers reads as a
+                    // cause, which is how this line misled a reader of a real capture.
+                    (if (streakGatesThisTrigger)
+                        " (empty streak ${emptySyncTracker.consecutiveEmptySyncs}" +
+                            "${if (clockUntrusted) ", clock future-dated" else ""})"
+                    else ""),
             )
             return
         }
@@ -8239,6 +8250,18 @@ class WhoopBleClient(
                 bankedSensorRecords = bankedSensorRecords,
                 consoleOnly = bankedNothingRaw,
             ) else false
+        // #1683: the strap's newest stored record, ONLY when it is stale enough to be worth naming.
+        // Declared out here because both the log line inside the block below and the user-facing banner
+        // further down consume it, and they must not disagree about whether the strap is stale.
+        // WHOOP4 only, explicitly, on BOTH platforms. The underlying field is not populated alike: Swift
+        // gates it on `feedsSync` (#695 - WHOOP4 today, the 5/MG path deliberately leaves it unset), while
+        // this side sets it for any family that answers GET_DATA_RANGE. Reading it without a gate would
+        // let a 5/MG show the dated wording here and not on iOS. Gating the READ on both keeps the two in
+        // step whichever way that pre-existing difference is settled later, and a 5/MG that cannot offload
+        // has no business being told it stopped saving to flash.
+        val staleNewestSeen: Long? = strapNewestTs
+            ?.takeIf { connectedFamily == DeviceFamily.WHOOP4 }
+            ?.takeIf { Backfiller.isStaleNewestRecord(it, nowSec) }
         if (bankedNothing) {
             val detail = if (consoleChunksThisSession >= 3)
                 "console-only across $consoleChunksThisSession chunks"
@@ -8247,6 +8270,11 @@ class WhoopBleClient(
                 "Backfill: completed but the strap banked no sensor history ($detail); " +
                     "consecutive empty syncs = ${emptySyncTracker.consecutiveEmptySyncs}.",
             )
+            // #1683: say HOW OLD the strap's newest stored record is. Without this the line above reads
+            // identically for a strap that is caught up and one that stopped banking three weeks ago -
+            // NOOP knows the difference (GET_DATA_RANGE gave it) and simply never said so, which is why
+            // #1541 stayed open and unactionable. Rare-event evidence, so always-on.
+            staleNewestSeen?.let { log(Backfiller.staleRecordLine(it, nowSec)) }
         }
         // #battery: maintain the empty-offload backoff counter (see [consecutiveEmptyOffloads]). A 0-row
         // session — clean HISTORY_COMPLETE-empty OR an idle-timeout STALL — means there was nothing new to
@@ -8312,7 +8340,11 @@ class WhoopBleClient(
                 // the two platforms never disagree on which banner a given sync shows.
                 lastSyncError = when {
                     bankedNothing && sustainedEmpty ->
-                        "Synced, but your strap had no stored history to hand over - only its diagnostic output. This usually means its clock has lost sync, so it isn't saving data to flash. Fully charge it to 100%, then reconnect, and it should start banking again."
+                        // #1683: when the strap's own newest record dates the silence, SAY it. The
+                        // generic copy omits that and promises a recovery the charge advice has already
+                        // been retried for every session.
+                        staleNewestSeen?.let { Backfiller.staleRecordBanner(it, nowSec) }
+                            ?: "Synced, but your strap had no stored history to hand over - only its diagnostic output. This usually means its clock has lost sync, so it isn't saving data to flash. Fully charge it to 100%, then reconnect, and it should start banking again."
                     bankedNothing -> null   // banked nothing but not yet sustained — stay silent (matches Swift)
                     // #324/#928: the strap banked records but its newest is dated implausibly in the future
                     // (RTC relatched ahead). #773 drops the samples so nothing is misfiled, but this path
diff --git a/android/app/src/test/java/com/noop/ble/BackfillerSessionTallyTest.kt b/android/app/src/test/java/com/noop/ble/BackfillerSessionTallyTest.kt
index d553f5a722..4aad4bc896 100644
--- a/android/app/src/test/java/com/noop/ble/BackfillerSessionTallyTest.kt
+++ b/android/app/src/test/java/com/noop/ble/BackfillerSessionTallyTest.kt
@@ -123,6 +123,65 @@ class BackfillerSessionTallyTest {
     }
 
     // The recovery hint names the cause + fix, reports days-ahead, and has no em-dash. Byte-identical to Swift.
+    // #1683: the stale counterpart. A strap that stopped banking weeks ago and one that is caught up
+    // produced the SAME "banked no sensor history" line, so neither the user nor a triager could tell
+    // them apart — the reason #1541 stayed open and unactionable.
+
+    @Test fun aCaughtUpOrBrieflyIdleStrapIsNotStale() {
+        val now = 1_700_000_000L
+        assertFalse(Backfiller.isStaleNewestRecord(null, now))          // no reading at all
+        assertFalse(Backfiller.isStaleNewestRecord(0L, now))            // 0 is not a date
+        assertFalse(Backfiller.isStaleNewestRecord(now, now))           // caught up
+        assertFalse(Backfiller.isStaleNewestRecord(now - 86_400L, now)) // one night off-wrist is ordinary
+    }
+
+    @Test fun twoDaysIsTheBoundaryAndQualifies() {
+        val now = 1_700_000_000L
+        assertTrue(Backfiller.isStaleNewestRecord(now - 2L * 86_400L, now))
+    }
+
+    /** A future-dated record belongs to futureRtcLine; this rule must not also claim it. */
+    @Test fun aFutureDatedRecordIsNotStale() {
+        val now = 1_700_000_000L
+        assertFalse(Backfiller.isStaleNewestRecord(now + 86_400L, now))
+    }
+
+    /**
+     * The numbers from the #1683 capture: newest stored record 1785692420 against a wall clock of
+     * 1787820941. The user was told only "banked no sensor history"; this says three weeks.
+     */
+    @Test fun staleRecordLineReportsTheRealCaptureAsTwentyFourDays() {
+        val line = Backfiller.staleRecordLine(1_785_692_420L, 1_787_820_941L)
+        assertTrue(line, line.contains("about 24 day(s) old"))
+        assertTrue(line, line.contains("stopped saving history"))
+        // The part the old advice omitted: charging alone has already been retried every connect.
+        assertTrue(line, line.contains("re-sends the clock on every connect"))
+        // The test that tells the user whether NOOP is even involved.
+        assertTrue(line, line.contains("official WHOOP app"))
+        assertFalse(line.contains("\u2014"))
+    }
+
+    /** States the fact, never the diagnosis: a drawered strap shows the same number innocently. */
+    @Test fun staleRecordLineDoesNotAssertACorruptClock() {
+        val line = Backfiller.staleRecordLine(1_700_000_000L - 20L * 86_400L, 1_700_000_000L)
+        assertFalse(line, line.contains("corrupt"))
+        assertTrue(line, line.contains("If you have worn it"))
+    }
+
+    /**
+     * The banner is what the user READS; the log line needs a capture export. The standing banner omitted
+     * the age entirely and PROMISED that charging "should" work - advice NOOP has effectively retried on
+     * every connect for weeks, since it re-sends SET_CLOCK each time.
+     */
+    @Test fun staleRecordBannerDatesTheSilenceAndPromisesNothing() {
+        val line = Backfiller.staleRecordBanner(1_785_692_420L, 1_787_820_941L)
+        assertTrue(line, line.contains("about 24 day(s) old"))
+        assertTrue(line, line.contains("If you have been wearing it"))
+        assertTrue(line, line.contains("official WHOOP app"))
+        assertFalse(line, line.contains("should start banking again"))
+        assertFalse(line.contains("\u2014"))
+    }
+
     @Test fun futureRtcLineWording() {
         val now = 1_700_000_000L
         val line = Backfiller.futureRtcLine(now + 10L * 86_400L, now)

From 73833984719b15cc077ec33f07e0e9633bec59e8 Mon Sep 17 00:00:00 2001
From: Pipiche <8291674+pipiche38@users.noreply.github.com>
Date: Thu, 27 Aug 2026 12:48:59 +0200
Subject: [PATCH 018/333] doc(oura): correct stale real_steps gating claim
 (#1629)

Thanks to @pipiche38, who captured the evidence and wrote the correction.

Commands.swift claimed real_steps is server-flag-gated off and so "never emitted
for an offline NOOP-only ring". On-device captures show the status read
(2f 02 20 0b) coming back status=1 (enabled) identically from an authenticated
Oura-app session and from NOOP's own fully offline, unauthenticated connection to
the same ring, so the gate is ring-side state rather than something tied to which
client asks.

The wording gets the important things right. It replaces an absolute with an
observation and hedges it ("Do not assume 'off for NOOP' without checking a live
read"), and it keeps the separate safety claim intact - the command is the 0x20
READ verb, never an enable or set-mode write. Those two claims were entangled in
one comment and only one of them was wrong.

Comment-only; no behaviour change. OuraProtocol tests green.

FOLLOW-UP OWED, and not this PR's job. The same claim is asserted in four more
places that this does not touch: com/noop/oura/Commands.kt:30 and :172 are
word-for-word twins of the two lines corrected here, OuraLiveSource.kt:1812 says
it again, and OURA_PROTOCOL.md:989 is the source all of them cite.

The doc needs more care than a find-and-replace. It does not merely state the
gate - it uses it as an EXPLANATION: "This explains 0x7E/0x7F never once
appearing across the PR #960 live sessions - the ring isn't sending them, it is
not a NOOP decode gap." If the gate reads enabled, that explanation no longer
holds, which reopens a question that sentence had closed. Note that status=1 is
NOT evidence the ring emits those tags, so the honest correction is "gating no
longer explains the absence; the cause is unknown", not "therefore it is a decode
gap".
---
 .../Sources/OuraProtocol/Commands.swift          | 16 +++++++++++-----
 Strand/BLE/OuraLiveSource.swift                  |  6 ++++--
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/Packages/OuraProtocol/Sources/OuraProtocol/Commands.swift b/Packages/OuraProtocol/Sources/OuraProtocol/Commands.swift
index a63f55a0f1..0c75875db3 100644
--- a/Packages/OuraProtocol/Sources/OuraProtocol/Commands.swift
+++ b/Packages/OuraProtocol/Sources/OuraProtocol/Commands.swift
@@ -20,8 +20,12 @@ public enum OuraCommands {
     public static let featureDaytimeHR: UInt8 = 0x02
     // The SpO2 feature id. Per OURA_PROTOCOL.md s7.1.
     public static let featureSpO2: UInt8 = 0x04
-    // The real-steps feature id. Server-flag-gated (activity/real_steps, default off), so it is never
-    // emitted for an offline NOOP-only ring. Per OURA_PROTOCOL.md s7.1 / s7.3 [open_oura-feat].
+    // The real-steps feature id (`activity/real_steps`). Nominally server-flag-gated per
+    // OURA_PROTOCOL.md s7.1/s7.3 [open_oura-feat], but on-device 2026-08-25 real-steps status reads
+    // came back enabled (status=1) from BOTH an authenticated Oura-app session and NOOP's own fully
+    // offline, unauthenticated read of the same ring — the gate is ring-side state, not tied to which
+    // client asks or whether that client is cloud-authenticated. Do not assume "off for NOOP" without
+    // checking a live read.
     public static let featureRealSteps: UInt8 = 0x0B
 
     // MARK: - Pre-auth / identity (unauthenticated OK)
@@ -148,9 +152,11 @@ public enum OuraCommands {
         OuraCommand(label: "spo2_status", bytes: [0x2F, 0x02, 0x20, featureSpO2])
     }
 
-    /// Read the real-steps feature status, `2f 02 20 0b` (READ verb, not enable). The `0x21` reply confirms
-    /// the server-flag gate (`activity/real_steps`, default off) from the ring itself. Read-only diagnostic.
-    /// [open_oura-feat]
+    /// Read the real-steps feature status, `2f 02 20 0b` (READ verb, not enable). The `0x21` reply reports
+    /// the ring's own real_steps gate state — NOT reliably "off" for an offline ring: on-device
+    /// 2026-08-25 this read back status=1 (enabled) from NOOP's own unauthenticated connection, matching
+    /// the real Oura app's read of the same ring byte-for-byte. Read-only diagnostic either way — never
+    /// enables anything, never writes a mode. [open_oura-feat]
     public static func realStepsReadStatus() -> OuraCommand {
         OuraCommand(label: "realsteps_status", bytes: [0x2F, 0x02, 0x20, featureRealSteps])
     }
diff --git a/Strand/BLE/OuraLiveSource.swift b/Strand/BLE/OuraLiveSource.swift
index 58f037ce44..106ece6ac4 100644
--- a/Strand/BLE/OuraLiveSource.swift
+++ b/Strand/BLE/OuraLiveSource.swift
@@ -1397,8 +1397,10 @@ public final class OuraLiveSource: NSObject, ObservableObject {
                 fetchHistoryIfIdle()   // pull last night's banked temp/SpO2/HRV/sleep-phase right away
                 write([OuraCommands.getBattery()])   // ask once HR streams; the 0x0D reply routes to onBattery
                 // Read-only diagnostic: ask the ring its SpO2 / real-steps feature status once, so a capture
-                // confirms (from the ring itself) that these server-flag features are subscription-gated OFF
-                // for an offline ring. NEVER an enable/set-mode write - purely the 0x20 read verb.
+                // sees the ring's own gate state. NOT reliably "off" for an offline ring — on-device
+                // 2026-08-25 real_steps read back status=1 (enabled) here, matching the real Oura app's read
+                // of the same ring byte-for-byte (worklog analysis/2026-08-25-noop-ring-hci-realsteps-
+                // confirmation.txt). NEVER an enable/set-mode write - purely the 0x20 read verb.
                 write([OuraCommands.spo2ReadStatus(), OuraCommands.realStepsReadStatus()])
                 // Read-only capture (#771/#772): the ring's GetProductInfo serial + hardware pages are
                 // pre-auth readable. The SERIAL is a STABLE per-ring identity — unlike the CoreBluetooth UUID,

From 8f272f65a792b0acc9bdabf2a1ecc02ee6a17d74 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 22:57:32 +1200
Subject: [PATCH 019/333] doc(oura): carry the real_steps correction to the
 twins, the spec, and a test (#1687)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to **@pipiche38's #1629**, which corrected the claim in the two Swift files. The same assertion lived in **four more places** — and the Kotlin ones are *word-for-word copies* of the lines that PR changed, so the tree was left saying opposite things in twin files:

| Location | What it said |
|---|---|
| `com/noop/oura/Commands.kt:30` | identical to the corrected Swift line |
| `com/noop/oura/Commands.kt:172` | identical to the corrected Swift doc |
| `ble/OuraLiveSource.kt:1812` | used it to dismiss the tags' absence |
| `docs/OURA_PROTOCOL.md` §7.3 | the source all of them cite |

## The spec needed more than a find-and-replace

This is the part worth reading. §7.3 didn't merely *state* the gate — it **reasoned from it**:

> *"This explains `0x7E`/`0x7F` never once appearing across the PR #960 live sessions - the ring isn't sending them, it is not a NOOP decode gap."*

If the ring's own status read comes back **enabled**, that explanation no longer holds. The observation stands — those tags still never appeared — but the cause attributed to it doesn't. **And that sentence is what closed the investigation.**

So the correction says what is actually known and no more:

- `status=1` removes *gating* as the explanation
- it is **not** evidence the ring emits those tags
- the reason for their absence is now **unknown**
- a decode gap is back on the table as a possibility rather than ruled out

The old text is quoted in place, so anyone who cited that paragraph can see exactly what changed and why.

## A test gap the sweep exposed

The sweep found a test comment reading an all-zero fixture as *"server-gated off"* — describing the fixture as though it were a ring's answer. Reworded; and the gap it hid is now covered.

`OuraFeatureStatusTests` only ever exercised the **all-zero** reply. So the one reading anybody has actually observed on hardware — `status=1` — was the one nothing pinned. That case is now a test, asserting the **decode only**, with the same caution written into it: it says the ring reports the feature enabled, not that the ring emits `0x7E`/`0x7F`.

## Verification

Comment, doc and test only; no behaviour change. `OuraProtocol` tests green (7), Android **4590 green**, compile clean, `doc_comment_lint` clean. No app-target Swift touched, so no app-build needed.
---
 .../OuraFeatureStatusTests.swift                | 17 +++++++++++++++--
 .../main/java/com/noop/ble/OuraLiveSource.kt    |  6 ++++--
 .../app/src/main/java/com/noop/oura/Commands.kt | 16 +++++++++++-----
 docs/OURA_PROTOCOL.md                           |  8 +++++++-
 4 files changed, 37 insertions(+), 10 deletions(-)

diff --git a/Packages/OuraProtocol/Tests/OuraProtocolTests/OuraFeatureStatusTests.swift b/Packages/OuraProtocol/Tests/OuraProtocolTests/OuraFeatureStatusTests.swift
index fbb046104b..4a0e4d9c41 100644
--- a/Packages/OuraProtocol/Tests/OuraProtocolTests/OuraFeatureStatusTests.swift
+++ b/Packages/OuraProtocol/Tests/OuraProtocolTests/OuraFeatureStatusTests.swift
@@ -42,14 +42,27 @@ final class OuraFeatureStatusTests: XCTestCase {
 
     func testSpO2AndStepsReadsSurfaceFeatureStatus() {
         let d = OuraDriver(ringGen: .gen3, authKey: key)
-        // SpO2 (0x04): subscription 0 → server-gated off.
+        // An all-zero reply. The comment here used to read the zeros as "server-gated off"; it describes
+        // the FIXTURE, not a ring's real answer, and #1629 showed a real ring answering otherwise.
         XCTAssertEqual(d.handleSecureFrame(OuraSecureFrame(subop: 0x21, subBody: [0x04, 0x00, 0x00, 0x00, 0x00])),
                        .featureStatus(OuraFeatureStatus(feature: 0x04, mode: 0, status: 0, state: 0, subscription: 0)))
-        // real_steps (0x0b): subscription 0 → server-gated off.
         XCTAssertEqual(d.handleSecureFrame(OuraSecureFrame(subop: 0x21, subBody: [0x0B, 0x00, 0x00, 0x00, 0x00])),
                        .featureStatus(OuraFeatureStatus(feature: 0x0B, mode: 0, status: 0, state: 0, subscription: 0)))
     }
 
+    /// #1629: the shape a REAL ring actually answers with. On-device captures read real_steps back as
+    /// `status=1` from both an authenticated Oura-app session and NOOP's own offline, unauthenticated
+    /// connection to the same ring. Until now the suite only ever exercised the all-zero reply, so the
+    /// one reading anybody has actually observed on hardware was the one nothing pinned.
+    ///
+    /// This asserts the DECODE only. `status=1` says the ring reports the feature enabled; it is not
+    /// evidence that the ring emits `0x7E`/`0x7F`, and nothing here should be read as claiming that.
+    func testAnEnabledRealStepsStatusDecodesAsObservedOnHardware() {
+        let d = OuraDriver(ringGen: .gen3, authKey: key)
+        XCTAssertEqual(d.handleSecureFrame(OuraSecureFrame(subop: 0x21, subBody: [0x0B, 0x00, 0x01, 0x00, 0x00])),
+                       .featureStatus(OuraFeatureStatus(feature: 0x0B, mode: 0, status: 1, state: 0, subscription: 0)))
+    }
+
     func testUndecodableDiagnosticReplyFallsBackToEnableAck() {
         // A too-short 0x21 (can't decode a feature) must not crash or mis-route; it stays `.enableAck` so
         // the triplet never stalls on a malformed reply.
diff --git a/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt b/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt
index a0da2a59ea..1d5f797f39 100644
--- a/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt
+++ b/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt
@@ -1809,8 +1809,10 @@ class OuraLiveSource(
                     // Other Tier-B tags (real_steps / activity-summary / sleep-summary / smoothed-SpO2,
                     // OURA_PROTOCOL.md s7.3; PR #960): logged ONCE PER KIND with the raw bytes so we can
                     // see whether the ring sends these tags at all and collect capture material - e.g.
-                    // real_steps 0x7E/0x7F is server-flag-gated OFF by default ([open_oura-feat]), so its
-                    // continued absence here is the ring's doing, not a decode gap.
+                    // real_steps 0x7E/0x7F was assumed server-flag-gated OFF ([open_oura-feat]), which
+                    // made its absence self-explanatory. That no longer holds: the ring's own status read
+                    // came back ENABLED on-device (#1629), so gating does NOT explain why these tags never
+                    // arrive, and whether that is the ring's doing or a decode gap is currently unknown.
                     if (loggedTierBKinds.add(e.value.kind)) {
                         val hex = e.value.rawPayload.joinToString(" ") { "%02x".format(it) }
                         log("Oura: Tier-B ${e.value.kind} seen (tag 0x${e.value.tag.toString(16)}) - raw: $hex")
diff --git a/android/app/src/main/java/com/noop/oura/Commands.kt b/android/app/src/main/java/com/noop/oura/Commands.kt
index 9b6f3b2a05..933cdd5186 100644
--- a/android/app/src/main/java/com/noop/oura/Commands.kt
+++ b/android/app/src/main/java/com/noop/oura/Commands.kt
@@ -27,8 +27,12 @@ object OuraCommands {
 
     // The SpO2 feature id. Per OURA_PROTOCOL.md s7.1.
     const val featureSpO2 = 0x04
-    // The real-steps feature id. Server-flag-gated (activity/real_steps, default off), so it is never
-    // emitted for an offline NOOP-only ring. Per OURA_PROTOCOL.md s7.1 / s7.3 [open_oura-feat].
+    // The real-steps feature id (`activity/real_steps`). Nominally server-flag-gated per
+    // OURA_PROTOCOL.md s7.1/s7.3 [open_oura-feat], but on-device 2026-08-25 real-steps status reads
+    // came back enabled (status=1) from BOTH an authenticated Oura-app session and NOOP's own fully
+    // offline, unauthenticated read of the same ring - the gate is ring-side state, not tied to which
+    // client asks or whether that client is cloud-authenticated. Do not assume "off for NOOP" without
+    // checking a live read.
     const val featureRealSteps = 0x0b
 
     // MARK: - Pre-auth / identity (unauthenticated OK)
@@ -168,9 +172,11 @@ object OuraCommands {
         OuraCommand("spo2_status", intArrayOf(0x2F, 0x02, 0x20, featureSpO2))
 
     /**
-     * Read the real-steps feature status, `2f 02 20 0b` (READ verb, not enable). The `0x21` reply confirms
-     * the server-flag gate (`activity/real_steps`, default off) from the ring itself. Read-only diagnostic.
-     * [open_oura-feat]
+     * Read the real-steps feature status, `2f 02 20 0b` (READ verb, not enable). The `0x21` reply reports
+     * the ring's own real_steps gate state - NOT reliably "off" for an offline ring: on-device
+     * 2026-08-25 this read back status=1 (enabled) from NOOP's own unauthenticated connection, matching
+     * the real Oura app's read of the same ring byte-for-byte. Read-only diagnostic either way - never
+     * enables anything, never writes a mode. [open_oura-feat]
      */
     fun realStepsReadStatus(): OuraCommand =
         OuraCommand("realsteps_status", intArrayOf(0x2F, 0x02, 0x20, featureRealSteps))
diff --git a/docs/OURA_PROTOCOL.md b/docs/OURA_PROTOCOL.md
index de1e88d5e2..62444c91c6 100644
--- a/docs/OURA_PROTOCOL.md
+++ b/docs/OURA_PROTOCOL.md
@@ -986,7 +986,13 @@ edit of the ring's tag.
     window is the single regime a walking-equivalent model should do best in, and it does not overturn the
     857-day picture (median ≈ 0, p90 +186 %) that gates it. It is recorded because it bounds the error on
     the one regime where the estimate is meant to apply.
-  - **Real Steps (feature `0x0B`) server gating [open_oura-feat]:** real_steps is behind the server flag `activity/real_steps` (default **false**; `FeatureDefinitions.ActivityRealSteps`, Gen 3+), the same server-flag-off pattern as SpO2 (§7.1). This explains `0x7E`/`0x7F` never once appearing across the PR #960 live sessions - the ring isn't sending them, it is not a NOOP decode gap. `0x50` itself is an always-on base stream (not feature-gated), matching it appearing in every session.
+  - **Real Steps (feature `0x0B`) server gating [open_oura-feat]:** real_steps is documented as sitting behind the server flag `activity/real_steps` (default **false**; `FeatureDefinitions.ActivityRealSteps`, Gen 3+), the same server-flag-off pattern as SpO2 (§7.1).
+
+    **CORRECTED 2026-08-27 (#1629).** This section previously concluded: *"This explains `0x7E`/`0x7F` never once appearing across the PR #960 live sessions - the ring isn't sending them, it is not a NOOP decode gap."* **That explanation no longer holds.** On-device captures read the ring's own real_steps status (`2f 02 20 0b`) back as **`status=1` (enabled)** — identically from an authenticated Oura-app session and from NOOP's own fully offline, unauthenticated connection to the same ring. The gate is ring-side state, not something tied to which client asks.
+
+    So the *observation* stands — `0x7E`/`0x7F` still never appeared in those sessions — but the *cause* attributed to it does not. Be careful about what the new reading does and does not show: **`status=1` is not evidence the ring emits those tags.** It only removes gating as the explanation. Why they are absent is currently **unknown**, and a decode gap is back on the table as a possibility rather than ruled out. `0x50` is unaffected: an always-on base stream, not feature-gated, and it appears in every session.
+
+    Anything that cited this paragraph to close a line of investigation should be re-read on that basis.
 - **`0x7E`/`0x7F` real_steps_features 1/2** (18 B each): bit-packed step features merged across the paired events. **(UNVERIFIED - partial)** [ringverse]
   - **Unpack formula ([oura-rs] - Th0rgal/open_oura `crates/oura-protocol/src/events.rs#L566`, clean-room
     fact citation): 14 fields from the 14-byte body.** Fields 0 and 8 are genuine 9-bit values built as

From 7b9184c6b5255f384bad9bffe527f879f91bb1a8 Mon Sep 17 00:00:00 2001
From: Pipiche <8291674+pipiche38@users.noreply.github.com>
Date: Thu, 27 Aug 2026 13:09:35 +0200
Subject: [PATCH 020/333] feat(oura): add Skin Temp as a Key Metrics tile
 option (#1678)

Thanks to @pipiche38, who found this, wrote it, and rebuilt it on current main
after the first attempt was overtaken.

Skin Temp was already a "Your Cards" (DashboardCard) option on both platforms but
was never offered as a small Key Metrics grid tile - not a display-path bug, just
a case the KeyMetric enum never had. Found while diagnosing a "Skin Temp visible
on the Deep Timeline, missing from the Cards" report, where it turned out there
are two different Cards screens and the two features each work on one.

New KeyMetric.skinTemp / KeyMetric.SKIN_TEMP on both platforms, deliberately NOT
added to defaultOrder: an existing user's saved layout and a fresh install's
default stay byte-identical, and the tile appears only once opted into via the
layout editor. Verified rather than taken on trust, because that is the claim
that would affect every user: both defaultOrder arrays still hold exactly ten
entries and neither contains skinTemp.

Reuses the sibling tile's title, icon and SkinTempDisplay formatting - the same
bimodal absolute-vs-deviation handling from #622 - so no new copy and no i18n
debt, and the two surfaces cannot disagree about how a deviation reads. The
Android tap-through reuses the "skin" vital_detail key the DashboardCard path
already routes to, a confirmed destination rather than a new one. Android also
gained a per-field skin-temp carry, from the earlier review round: carriedDay is
a whole-row carry that lands on rows with a null skinTempDevC, so without it the
tile fell through to blank on a night whose recovery-scored row happened not to
carry a reading. Pulled out as resolveSkinTempDevC so the fallback chain is
testable without Compose.

THIS SUPERSEDES #1589, WHICH COULD NOT BE MERGED. That PR was green, MERGEABLE
and CLEAN, and would have broken the build: #1654 landed after it was opened and
added the same @AppStorage/temperatureUnit block to LiquidTodayView, so merging
produced four invalid redeclarations and failed both Apple targets. Git saw no
conflict because the two blocks never overlapped textually, and no active
workflow compiles app-target Swift.

So this was reviewed the same way that was proved: by merging main + this branch
onto a scratch branch and running app-build against the RESULT, not the PR head.
Each of the four properties is now declared exactly once, and Build Strand, Test
Strand and Build NOOPiOS all pass on the merged tree. Scratch branch deleted.

Verification: 4 tests (2 per platform) pinning the two contract points that
matter for a new persisted enum case - the raw token round-trips ("skinTemp",
identical across platforms) and it stays out of defaultOrder - plus the Android
carry-fallback tests from review. Android 4577 tests green on the branch.

Minor and not blocking: KeyMetricSkinTempTest's doc says the raw-token parity
matters "so a backup/restore reads the same layout on either OS", but
today.keyMetrics is not in the .noopbak whitelist - only today.hostedCards is.
The parity is worth keeping; the stated reason is not right. A device screenshot
of the new tile is still owed, as the PR says.
---
 Strand/Data/KeyMetricPrefs.swift              |  8 ++
 Strand/Liquid/LiquidTodayView.swift           | 18 +++++
 .../Screens/TodayCustomizationMetadata.swift  |  4 +-
 Strand/Screens/TodayView.swift                | 19 +++++
 StrandTests/KeyMetricPrefsDecodeTests.swift   | 13 +++
 .../main/java/com/noop/ui/KeyMetricPrefs.kt   |  8 +-
 .../src/main/java/com/noop/ui/TodayScreen.kt  | 49 +++++++++++
 .../java/com/noop/ui/KeyMetricSkinTempTest.kt | 81 +++++++++++++++++++
 8 files changed, 198 insertions(+), 2 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ui/KeyMetricSkinTempTest.kt

diff --git a/Strand/Data/KeyMetricPrefs.swift b/Strand/Data/KeyMetricPrefs.swift
index 91b050395a..49d12d8cd6 100644
--- a/Strand/Data/KeyMetricPrefs.swift
+++ b/Strand/Data/KeyMetricPrefs.swift
@@ -26,6 +26,11 @@ enum KeyMetric: String, CaseIterable, Identifiable {
     case steps
     case weight
     case calories
+    /// Added 2026-08-24 (queue 11c follow-up): Skin Temp was already a "Your Cards" (`DashboardCard`)
+    /// option, but was never offered as a Key Metrics tile — not a bug, just never added. New case, NOT
+    /// added to `defaultOrder` below, so an existing user's saved layout (and a fresh install's default)
+    /// is byte-identical to before; only opts in via the layout editor.
+    case skinTemp
 
     var id: String { rawValue }
 
@@ -42,6 +47,9 @@ enum KeyMetric: String, CaseIterable, Identifiable {
         case .steps:       return String(localized: "Steps")
         case .weight:      return String(localized: "Weight")
         case .calories:    return String(localized: "Calories")
+        // Same short label the sibling "Your Cards" tile (`DashboardCard.skinTemp`) already uses —
+        // reuses its translation key rather than adding a new "Skin Temperature" one for this tile.
+        case .skinTemp:    return String(localized: "Skin Temp")
         }
     }
 
diff --git a/Strand/Liquid/LiquidTodayView.swift b/Strand/Liquid/LiquidTodayView.swift
index 28d5e0280d..855f678e66 100644
--- a/Strand/Liquid/LiquidTodayView.swift
+++ b/Strand/Liquid/LiquidTodayView.swift
@@ -1218,6 +1218,20 @@ struct LiquidTodayView: View {
             // detail source, so the number, its sparkline and the chart it opens all agree.
             ktile(String(localized: "Calories"), icon: keyMetricIcon(metric), intText(caloriesCount), "kcal", StrandPalette.metricAmber,
                   fracOver(caloriesCount, 800), key: "energy_kcal", detailMetric: caloriesDetailMetric)
+        case .skinTemp:
+            // Added 2026-08-24 (queue 11c follow-up): first Key Metrics appearance for Skin Temp — was
+            // already a "Your Cards" tile (`DashboardCard.skinTemp`), never a Key Metrics one. Same
+            // 2-level carry the Blood Oxygen case just above uses (displayDay → the cached vitals carry),
+            // and the SAME `SkinTempDisplay` formatter every other skin-temp surface uses so a deviation
+            // reads "+0.1 Δ°C" here exactly as it does on "Your Cards"/the Deep Timeline, never the plain
+            // `%+.1f°` that read a fabricated absolute value for a signed deviation (#622).
+            let skinValue = displayDay?.skinTempDevC ?? vitalsDay?.skinTempDevC
+            let skinText = skinValue.map {
+                SkinTempDisplay.format($0, fahrenheit: temperatureUnit == .fahrenheit)
+            } ?? "—"
+            // The card's own unit is deliberately empty — the value carries "°C"/"Δ°F" itself, same as
+            // the classic TodayView Skin Temp card.
+            ktile(String(localized: "Skin Temp"), icon: keyMetricIcon(metric), skinText, "", StrandPalette.metricAmber, nil, key: "skin_temp")
         }
     }
 
@@ -1233,6 +1247,7 @@ struct LiquidTodayView: View {
         case .steps: return "figure.walk"
         case .weight: return "scalemass.fill"
         case .calories: return "flame.fill"
+        case .skinTemp: return "thermometer.medium"
         }
     }
 
@@ -1511,6 +1526,9 @@ struct LiquidTodayView: View {
             "rhr": sparkRows.compactMap { r in r.restingHr.map { (r.day, Double($0)) } },
             "spo2": sparkRows.compactMap { r in r.spo2Pct.map { (r.day, $0) } },
             "spo2_candidate": spo2CandSeries.filter { $0.day >= sparkCutoff && $0.day <= selectedDayKey },
+            // Added 2026-08-24 (queue 11c follow-up) for the new Skin Temp Key Metrics tile — already
+            // loaded on `sparkRows` (`daysSnapshot`), same as every other DailyMetric-column tile above.
+            "skin_temp": sparkRows.compactMap { r in r.skinTempDevC.map { (r.day, $0) } },
             "resp_rate": sparkRows.compactMap { r in r.respRateBpm.map { (r.day, $0) } },
             "steps": sparkRows.compactMap { r in r.steps.map { (r.day, Double($0)) } },
             // #616: the Calories tile drew no trend line — this dict had no matching entry, so windowedSpark
diff --git a/Strand/Screens/TodayCustomizationMetadata.swift b/Strand/Screens/TodayCustomizationMetadata.swift
index 5f9ca15cc0..94f561eef8 100644
--- a/Strand/Screens/TodayCustomizationMetadata.swift
+++ b/Strand/Screens/TodayCustomizationMetadata.swift
@@ -48,6 +48,8 @@ extension KeyMetric {
         case .steps: return "figure.walk"
         case .weight: return "scalemass"
         case .calories: return "flame.fill"
+        // Same glyph the sibling "Your Cards" tile (`DashboardCard.skinTemp`) already uses.
+        case .skinTemp: return "thermometer.medium"
         }
     }
 
@@ -59,7 +61,7 @@ extension KeyMetric {
         case .restingHr: return StrandPalette.metricRose
         case .bloodOxygen, .steps: return StrandPalette.metricCyan
         case .respiratory, .weight: return StrandPalette.accent
-        case .calories: return StrandPalette.metricAmber
+        case .calories, .skinTemp: return StrandPalette.metricAmber
         }
     }
 }
diff --git a/Strand/Screens/TodayView.swift b/Strand/Screens/TodayView.swift
index aeb367be35..b4541a58b7 100644
--- a/Strand/Screens/TodayView.swift
+++ b/Strand/Screens/TodayView.swift
@@ -3808,6 +3808,20 @@ struct TodayView: View {
                 sparkline: sparks["active_kcal"],
                 sparkColor: StrandPalette.metricAmber
             )
+        case .skinTemp:
+            // Added 2026-08-24 (queue 11c follow-up): first Key Metrics appearance for Skin Temp — was
+            // already a "Your Cards" tile (`DashboardCard.skinTemp`), never a Key Metrics one. Reuses the
+            // SAME value chain and `skinTempCardValue` formatter the "Your Cards" case above already
+            // uses, so the two tiles can never disagree.
+            let skinTempValue = d?.skinTempDevC ?? lastVitalsDay?.skinTempDevC ?? lastSkinTempDay?.skinTempDevC
+            StatTile(
+                label: "Skin Temp",
+                value: Self.skinTempCardValue(skinTempValue, fahrenheit: temperatureUnit == .fahrenheit),
+                caption: skinTempValue == nil ? Self.needsStrapCaption : "",
+                accent: skinTempValue == nil ? StrandPalette.textPrimary : StrandPalette.metricAmber,
+                sparkline: sparks["skin_temp"],
+                sparkColor: StrandPalette.metricAmber
+            )
         }
     }
 
@@ -4256,6 +4270,10 @@ struct TodayView: View {
         // toggle is OFF (the engine writes nothing) or the owner has no in-band reading. Used as a
         // fallback for the Blood Oxygen tile when `spo2Pct` is nil, labelled "strap estimate (unverified)".
         async let spo2CandidateSpark = sparkValuesExplore("spo2_candidate", source: "my-whoop", window: 14)
+        // Added 2026-08-24 (queue 11c follow-up) for the new Skin Temp Key Metrics tile. `exploreSeries`
+        // so a BLE-only strap's computed `DailyMetric.skinTempDevC` column backs the trend, same as
+        // `resp_rate` above — the engine writes the column, not a metricSeries point.
+        async let skinTempSpark      = sparkValuesExplore("skin_temp", source: "my-whoop", window: 14)
         // `resp_rate` via `exploreSeries` so a BLE-only WHOOP 5 user's on-device computed
         // `DailyMetric.respRateBpm` backs the trend (the engine writes the column, not a metricSeries
         // point). The old `series(… source: "apple-health")` read only Apple Health's metricSeries,
@@ -4273,6 +4291,7 @@ struct TodayView: View {
         sparks["rhr"]             = await rhrSpark
         sparks["spo2"]            = await spo2Spark
         sparks["spo2_candidate"]  = await spo2CandidateSpark
+        sparks["skin_temp"]       = await skinTempSpark
         sparks["resp_rate"]   = await respRateSpark
         sparks["steps"]       = await stepsAppleSpark
         // Steps prefer the strap's own @57 daily total (no metricSeries, it lives on the daily row),
diff --git a/StrandTests/KeyMetricPrefsDecodeTests.swift b/StrandTests/KeyMetricPrefsDecodeTests.swift
index 99b5af1148..c6be7ce157 100644
--- a/StrandTests/KeyMetricPrefsDecodeTests.swift
+++ b/StrandTests/KeyMetricPrefsDecodeTests.swift
@@ -44,4 +44,17 @@ final class KeyMetricPrefsDecodeTests: XCTestCase {
         XCTAssertEqual(KeyMetricPrefs.decodeEnabled("   "), KeyMetric.defaultOrder)
         XCTAssertEqual(KeyMetricPrefs.decodeEnabled(""), KeyMetric.defaultOrder)
     }
+
+    /// Queue 11c follow-up (2026-08-24): `.skinTemp` is a NEW persisted case (Skin Temp was already a
+    /// "Your Cards" `DashboardCard` option, never a Key Metrics one). Pins the two contract points that
+    /// matter for adding a case without disturbing anyone's saved layout: the raw token round-trips
+    /// ("skinTemp", byte-identical to Kotlin's `KeyMetric.SKIN_TEMP.raw`), and it does NOT join
+    /// `defaultOrder` — a fresh install's default (and an existing user's saved layout) stays
+    /// byte-identical to before this case existed.
+    func testSkinTempRawTokenRoundTripsAndIsNotInDefaultOrder() {
+        XCTAssertEqual(KeyMetric(rawValue: "skinTemp"), .skinTemp)
+        XCTAssertEqual(KeyMetric.skinTemp.rawValue, "skinTemp")
+        XCTAssertFalse(KeyMetric.defaultOrder.contains(.skinTemp))
+        XCTAssertFalse(KeyMetricPrefs.decodeEnabled("").contains(.skinTemp))
+    }
 }
diff --git a/android/app/src/main/java/com/noop/ui/KeyMetricPrefs.kt b/android/app/src/main/java/com/noop/ui/KeyMetricPrefs.kt
index 502a590f06..5de92ef27f 100644
--- a/android/app/src/main/java/com/noop/ui/KeyMetricPrefs.kt
+++ b/android/app/src/main/java/com/noop/ui/KeyMetricPrefs.kt
@@ -30,7 +30,13 @@ enum class KeyMetric(val raw: String, @StringRes val titleRes: Int) {
     RESPIRATORY("respiratory", R.string.today_metric_respiratory),
     STEPS("steps", R.string.today_metric_steps),
     WEIGHT("weight", R.string.today_metric_weight),
-    CALORIES("calories", R.string.today_metric_calories);
+    CALORIES("calories", R.string.today_metric_calories),
+    // Added 2026-08-24 (queue 11c follow-up): Skin Temp was already a "Your Cards" (DashboardCard)
+    // option, but was never offered as a Key Metrics tile — not a bug, just never added. Reuses
+    // DashboardCard.SKIN_TEMP's own title resource rather than adding a new one. New case, NOT added
+    // to defaultOrder below, so an existing user's saved layout (and a fresh install's default) is
+    // byte-identical to before; only opts in via the layout editor.
+    SKIN_TEMP("skinTemp", R.string.today_card_skin_temp);
 
     companion object {
         fun fromRaw(raw: String?): KeyMetric? = entries.firstOrNull { it.raw == raw }
diff --git a/android/app/src/main/java/com/noop/ui/TodayScreen.kt b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
index e9e919e2ad..9e4b77c1c6 100644
--- a/android/app/src/main/java/com/noop/ui/TodayScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
@@ -53,6 +53,7 @@ import androidx.compose.material.icons.filled.LocalFireDepartment
 import androidx.compose.material.icons.filled.MonitorHeart
 import androidx.compose.material.icons.filled.MonitorWeight
 import androidx.compose.material.icons.filled.KeyboardArrowUp
+import androidx.compose.material.icons.filled.Thermostat
 import androidx.compose.material.icons.filled.Timeline
 import androidx.compose.material.icons.filled.TrackChanges
 import androidx.compose.material.icons.filled.WaterDrop
@@ -1547,6 +1548,7 @@ fun TodayScreen(
                                     spo2CarryDay = lastSpo2Day,
                                     respCarryDay = lastRespDay,
                                     spo2CandidateByDay = spo2CandidateByDay,
+                                    skinTempCarryDay = lastSkinTempDay,
                                     unitSystem = unitSystem,
                                     effortScale = effortScale,
                                     effortForDay = effortForDay,   // #1001: same figure as the hero ring
@@ -4862,6 +4864,18 @@ private fun RecordingStatusChip(state: RecordingState, onConnect: () -> Unit) {
 // the Rest vessel (see heroSourceLabel + ScoreHeroRow). The pure `dayOwnerSource` /
 // `provenanceBadgeLabel` By-Day mappers are kept (Intelligence/Trends + tests still use that vocabulary).
 
+/**
+ * The Key Metrics Skin Temp tile's 3-way fallback: today's row, then the whole-row recovery carry,
+ * then the per-field skin-temp carry (mirrors spo2CarryDay/respCarryDay's reasoning — carriedDay can
+ * land on a row with null skinTempDevC even when a genuine reading exists further back). Extracted so
+ * the carry regression ryanbr's PR #1589 review flagged is testable without Compose/Robolectric.
+ */
+internal fun resolveSkinTempDevC(
+    d: DailyMetric?,
+    carriedDay: DailyMetric?,
+    skinTempCarryDay: DailyMetric?,
+): Double? = d?.skinTempDevC ?: carriedDay?.skinTempDevC ?: skinTempCarryDay?.skinTempDevC
+
 /**
  * The full 14-day metric grid, mirroring the macOS LazyVGrid order:
  * Charge, Effort, Rest, HRV, Resting HR, Blood Oxygen, Respiratory,
@@ -4888,6 +4902,12 @@ private fun MetricGrid(
     // outside the window and the line cannot — but neither can now show data the other has no access to,
     // which is what made this tile render a number above a blank panel.
     spo2CandidateByDay: Map<String, Double> = emptyMap(),
+    // PER-FIELD skin-temp carry (ryanbr review, PR #1589): same reason as spo2CarryDay/respCarryDay —
+    // carriedDay (lastScoredRecoveryDay) is a whole-row carry that lands on rows with null
+    // skinTempDevC, so the Key Metrics tile falls through to the last row that actually has a
+    // reading. Mirrors the "Your Cards" DashboardCard.SKIN_TEMP path's skinTempDay fallback and iOS
+    // TodayView's lastSkinTempDay chain.
+    skinTempCarryDay: DailyMetric? = null,
     unitSystem: UnitSystem = UnitSystem.METRIC,
     effortScale: EffortScale = EffortScale.HUNDRED,
     // #1001: the day's resolved Effort (live-preferring for today, floored at the stored row). Threaded
@@ -5085,6 +5105,25 @@ private fun MetricGrid(
                 spark = caloriesSpark,   // #616: imported-first trend (was missing → no trend line)
             )
         },
+        KeyMetric.SKIN_TEMP to run {
+            // Added 2026-08-24 (queue 11c follow-up): first Key Metrics appearance for Skin Temp — was
+            // already a "Your Cards" tile (DashboardCard.SKIN_TEMP), never a Key Metrics one. Same
+            // `d ?: carriedDay` idiom every other simple tile above uses (HRV/RESTING_HR), and the SAME
+            // `SkinTempDisplay` formatter the DashboardCard.SKIN_TEMP branch uses so a deviation reads
+            // "+0.1 Δ°C" identically on both surfaces (#622: bimodal absolute-vs-deviation field).
+            val v = resolveSkinTempDevC(d, carriedDay, skinTempCarryDay)
+            val fahrenheit = UnitPrefs.temperature(LocalContext.current) == TemperatureUnit.FAHRENHEIT
+            KeyTileData(
+                label = uiString(R.string.today_card_skin_temp),
+                // The value carries its own "°C"/"Δ°F" (SkinTempDisplay.format), so unit stays empty —
+                // same as the DashboardCard.SKIN_TEMP card and the classic TodayView Skin Temp tile.
+                value = v?.let { com.noop.analytics.SkinTempDisplay.format(it, fahrenheit = fahrenheit) } ?: NO_DATA,
+                unit = "",
+                tint = Palette.metricAmber,
+                frac = null,
+                spark = w.skinTemp,
+            )
+        },
     )
 
     // Resolve the enabled tiles to their descriptors (keeping the metric for the tap mapping), dropping
@@ -5106,6 +5145,10 @@ private fun MetricGrid(
         KeyMetric.STEPS -> if (stepsOpenCalibration) onOpenStepsCalibration else ({ onOpenMetric("steps_est") })
         KeyMetric.CALORIES -> ({ onOpenMetric("active_kcal") })
         KeyMetric.WEIGHT -> null
+        // Same "skin" vital_detail key `dashboardCardMetricKey(DashboardCard.SKIN_TEMP)` already routes
+        // to — confirmed a working destination there, so this tile opens the SAME screen "Your Cards"
+        // already does, not a new/unverified route.
+        KeyMetric.SKIN_TEMP -> ({ onOpenMetric("skin") })
     }
     // S5: slice from the FRONT of the saved order so a pinned/selected tile is never dropped or reordered
     // (#251); only the tail folds behind the expander. Mirrors the iOS visibleKeyMetrics prefix(cap).
@@ -5201,6 +5244,8 @@ private fun keyMetricIcon(metric: KeyMetric): ImageVector = when (metric) {
     KeyMetric.STEPS -> Icons.AutoMirrored.Filled.DirectionsWalk
     KeyMetric.WEIGHT -> Icons.Filled.MonitorWeight
     KeyMetric.CALORIES -> Icons.Filled.LocalFireDepartment
+    // Same glyph the sibling "Your Cards" tile (DashboardCard.SKIN_TEMP) already uses.
+    KeyMetric.SKIN_TEMP -> Icons.Filled.Thermostat
 }
 
 /**
@@ -6698,6 +6743,9 @@ private data class Window(
     // (on-device-first), matching iOS kSparks "steps". (Calories is imported-first, so its spark is threaded
     // separately as caloriesSpark, not read off a DailyMetric column here.)
     val steps: List<Double>,
+    // Added 2026-08-24 (queue 11c follow-up) for the new Skin Temp Key Metrics tile — matches the iOS
+    // `sparks["skin_temp"]` sparkline added at the same time.
+    val skinTemp: List<Double>,
 )
 
 /**
@@ -6737,6 +6785,7 @@ private fun rememberTrendWindow(
             spo2Candidate = recent.mapNotNull { spo2Candidate[it.day] },
             resp = series { it.respRateBpm },
             steps = series { it.steps?.toDouble() },   // #616
+            skinTemp = series { it.skinTempDevC },
         )
     }
 
diff --git a/android/app/src/test/java/com/noop/ui/KeyMetricSkinTempTest.kt b/android/app/src/test/java/com/noop/ui/KeyMetricSkinTempTest.kt
new file mode 100644
index 0000000000..1e7958baab
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/KeyMetricSkinTempTest.kt
@@ -0,0 +1,81 @@
+package com.noop.ui
+
+import com.noop.data.DailyMetric
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * Queue 11c follow-up (2026-08-24): Skin Temp was already a "Your Cards" (`DashboardCard.SKIN_TEMP`)
+ * option, but was never offered as a Key Metrics tile — not a bug, just never added. Pins the two
+ * contract points that matter for a NEW persisted enum case: the raw token round-trips
+ * ("skinTemp", byte-identical to the Swift `KeyMetric.skinTemp` rawValue so a backup/restore reads the
+ * same layout on either OS), and it does NOT join `defaultOrder` — an existing user's saved layout, and
+ * a fresh install's default, must stay byte-identical to before this case existed.
+ */
+class KeyMetricSkinTempTest {
+
+    @Test fun rawTokenRoundTrips() {
+        assertEquals(KeyMetric.SKIN_TEMP, KeyMetric.fromRaw("skinTemp"))
+        assertEquals("skinTemp", KeyMetric.SKIN_TEMP.raw)
+    }
+
+    @Test fun notInDefaultOrder() {
+        assertFalse(KeyMetric.defaultOrder.contains(KeyMetric.SKIN_TEMP))
+    }
+
+    @Test fun blankLayoutStillExcludesIt() {
+        // A fresh install (blank saved layout) decodes to defaultOrder, which must not have picked up
+        // the new case — the whole point of adding it to `entries`/CaseIterable without touching
+        // defaultOrder.
+        assertTrue(KeyMetricPrefs.decodeEnabled("").none { it == KeyMetric.SKIN_TEMP })
+    }
+
+    private fun day(skinTempDevC: Double?) =
+        DailyMetric(deviceId = "my-whoop-noop", day = "2026-08-25", skinTempDevC = skinTempDevC)
+
+    /**
+     * Regression for ryanbr's PR #1589 review: carriedDay (lastScoredRecoveryDay) is a whole-row
+     * carry that lands on a row with null skinTempDevC even when a genuine reading exists further
+     * back, so the tile must fall through to the per-field skinTempCarryDay — exactly like
+     * spo2CarryDay/respCarryDay, and matching iOS TodayView's lastSkinTempDay chain.
+     */
+    @Test fun nullSkinTempDevCFallsThroughToPerFieldCarry() {
+        val perFieldCarry = day(skinTempDevC = 0.4)
+        assertEquals(
+            0.4,
+            resolveSkinTempDevC(d = null, carriedDay = day(skinTempDevC = null), skinTempCarryDay = perFieldCarry)!!,
+            0.0,
+        )
+    }
+
+    @Test fun todaysOwnReadingWinsOverEitherCarry() {
+        assertEquals(
+            0.2,
+            resolveSkinTempDevC(
+                d = day(skinTempDevC = 0.2),
+                carriedDay = day(skinTempDevC = -0.1),
+                skinTempCarryDay = day(skinTempDevC = 0.4),
+            )!!,
+            0.0,
+        )
+    }
+
+    @Test fun wholeRowCarryWinsOverPerFieldCarryWhenBothPresent() {
+        assertEquals(
+            -0.1,
+            resolveSkinTempDevC(
+                d = null,
+                carriedDay = day(skinTempDevC = -0.1),
+                skinTempCarryDay = day(skinTempDevC = 0.4),
+            )!!,
+            0.0,
+        )
+    }
+
+    @Test fun noRowAnywhereYieldsNull() {
+        assertNull(resolveSkinTempDevC(d = null, carriedDay = null, skinTempCarryDay = null))
+    }
+}

From 4d2891acc884241ded85f3e639afd3048a728ea7 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 23:22:35 +1200
Subject: [PATCH 021/333] test(ui): correct the rationale for the skinTemp
 key-metric parity pin

The doc on KeyMetricSkinTempTest justified pinning the "skinTemp" raw token
"so a backup/restore reads the same layout on either OS". That is not what
happens. today.keyMetrics is not in the .noopbak whitelist at all;
today.hostedCards is the one layout pref carried across, which
BackupSettings.swift says in as many words. So a restore on the other platform
reads that platform's own saved layout and never sees this token.

The assertion itself is right and stays: the token IS the persisted form, and
two independent implementations must not drift on how they spell one. It would
also become load-bearing the day that pref is whitelisted. Only the stated
reason was wrong, and a wrong reason sitting in a test is what someone reasons
from later.

The Swift twin (KeyMetricPrefsDecodeTests) never made the claim, so this is one
stray sentence rather than a parity gap between the two suites.

Comment only, no assertion touched. Ran the class rather than assuming it:
7 tests, 0 failures, with the stale result XMLs cleared first so the count
belongs to this run.

Follow-up to #1678, spotted at review time and left out of the merge.
---
 .../test/java/com/noop/ui/KeyMetricSkinTempTest.kt   | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/android/app/src/test/java/com/noop/ui/KeyMetricSkinTempTest.kt b/android/app/src/test/java/com/noop/ui/KeyMetricSkinTempTest.kt
index 1e7958baab..3066e2144b 100644
--- a/android/app/src/test/java/com/noop/ui/KeyMetricSkinTempTest.kt
+++ b/android/app/src/test/java/com/noop/ui/KeyMetricSkinTempTest.kt
@@ -11,9 +11,15 @@ import org.junit.Test
  * Queue 11c follow-up (2026-08-24): Skin Temp was already a "Your Cards" (`DashboardCard.SKIN_TEMP`)
  * option, but was never offered as a Key Metrics tile — not a bug, just never added. Pins the two
  * contract points that matter for a NEW persisted enum case: the raw token round-trips
- * ("skinTemp", byte-identical to the Swift `KeyMetric.skinTemp` rawValue so a backup/restore reads the
- * same layout on either OS), and it does NOT join `defaultOrder` — an existing user's saved layout, and
- * a fresh install's default, must stay byte-identical to before this case existed.
+ * ("skinTemp", byte-identical to the Swift `KeyMetric.skinTemp` rawValue — the token IS the persisted
+ * form, and two independent implementations must not drift on how they spell one), and it does NOT
+ * join `defaultOrder` — an existing user's saved layout, and a fresh install's default, must stay
+ * byte-identical to before this case existed.
+ *
+ * NOT a backup/restore contract, despite how it reads: the layout pref `today.keyMetrics` is not in
+ * the `.noopbak` whitelist at all — `today.hostedCards` is the one layout pref carried across — so a
+ * restore on the other OS reads that platform's own saved layout, never this token. The parity is
+ * worth pinning anyway, and would become load-bearing the day the pref IS whitelisted.
  */
 class KeyMetricSkinTempTest {
 

From ea6a3261979c08b96db1dd3608f4d8d3b55797fa Mon Sep 17 00:00:00 2001
From: Zebsi <66969936+Zebsi235@users.noreply.github.com>
Date: Thu, 27 Aug 2026 13:28:57 +0200
Subject: [PATCH 022/333] hrv: multiMs overflows a 32-bit Int, so the R-R
 delivery census reports a negative percentage (#1685)

Thanks to @Zebsi235, who found this in their own capture logs, traced it to the
arithmetic, and wrote the fix with the evidence attached.

HrvAnalyzer.pct serves two kinds of input. multiSec and multiRows pass row and
second counts, which are small; multiMs passes BEAT-TIME IN MILLISECONDS summed
over a whole night. part * 200 is evaluated in a 32-bit Int on Kotlin, so a real
over-count night - 7 to 8 h at 60-83% multiSec - runs several times past what the
expression can hold and wraps silently. Swift's Int is 64-bit on iOS and macOS,
so the same source computed the right answer there: a parity break between two
functions documented as byte-parity twins.

Verified rather than accepted. pct is pure arithmetic with no GRDB dependency, so
the twin extracts and compiles standalone even where the package will not build,
and the oracle CLAUDE.md asks for was run over both asserted literals, the
pre-existing tie cases, and a sweep against an independent half-up reference:

  pct(15264177,35498088) = 43   32-bit = -16
  pct(36296594,39886368) = 91   32-bit = -16
  pct(1,8)=13  pct(3,8)=38  pct(0,0)=0     unchanged by the widening
  sweep mismatches: 0

The -16 is what the submitter's 08-22 and 08-26 nights actually printed, so the
reported symptom is explained by the diagnosed cause rather than merely
coinciding with it.

WORTH KNOWING FOR ANYONE RE-READING OLD ANDROID CAPTURES: the wrap does not
always land negative. pct(28800000, 28800000) - a 100% multi-share 8 h night -
returns 25 on 32-bit. Positive, plausible, and wrong by 75 points. So "look for a
negative multiMs" is NOT a sound filter for affected logs; every Android multiMs
past the threshold is suspect, including the ones that read fine. That is the
more dangerous half of this bug, because a readable wrong number gets trusted.

The widening is applied to the operation, not the signature, so no caller changes
and the integer half-up tie behaviour is untouched. It follows a rule this file
already states twice - the duplicatePairRatios guard 28 lines up, and the same
reasoning in V18AuxCodec - both of which arrived after pct and neither of which
was retrofitted to it. The Swift side states Int64 rather than inheriting the
platform width, which is not cosmetic: StrandAnalytics declares .watchOS(.v10)
and NOOPWatch depends on it, and Int is 32 bits on arm64_32. Nothing under
NOOPWatch calls HRVAnalyzer today, so there is no live watch bug - the submitter
scoped that correctly rather than overclaiming it.

Checked for siblings: pct is the only Int-domain multiply in the file that can
reach millisecond scale (spotCaptureOverCounted is Long x Double), so this is the
whole family, not one instance of it.

Regression case on both platforms, in the file that already pins pct. The
existing cases could never have caught it - the largest rrMs anywhere in that
test file is 1309.0 - which is why it sat behind a green suite. CI covers both
halves: test (StrandAnalytics) on macOS and build-and-test on Android, both green.

Nothing here is app-target Swift, so green means what it says for once.

The doc comments quote the overflow threshold as 10,737,418 ms, which is the
bound for part * 200 alone; the numerator is part * 200 + total, so first
overflow is nearer total > 10,684,993. A follow-up covers that and the
positive-wrap note.

Refs #1008, #1118, #1331, #1451 - all four size from this census, and on Android
they were sizing from an unreadable number. This corrects the instrument only.
---
 .../Sources/StrandAnalytics/HRVAnalyzer.swift    |  9 ++++++++-
 .../HRVAnalyzerSampleOrdTests.swift              |  9 +++++++++
 .../main/java/com/noop/analytics/HrvAnalyzer.kt  | 12 ++++++++++--
 .../noop/analytics/HrvAnalyzerSampleOrdTest.kt   | 16 ++++++++++++++++
 4 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/HRVAnalyzer.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/HRVAnalyzer.swift
index 99eb32fbc3..603aff60c4 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/HRVAnalyzer.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/HRVAnalyzer.swift
@@ -808,8 +808,15 @@ public enum HRVAnalyzer {
     static func msToInt(_ ms: Double) -> Int { ms > 0 ? Int(ms + 0.5) : 0 }
 
     /// Whole-percent, integer half-up, so both platforms round a tie the same way. 0 when `total` is 0.
+    ///
+    /// The arithmetic is widened to `Int64` because `deliveryHistogram` passes BEAT-TIME IN
+    /// MILLISECONDS summed over a whole night, not a row count. `part * 200` needs more than 32 bits
+    /// above 10,737,418 ms (2.98 h of beat-time on multi-delivery seconds) and a real over-count night
+    /// carries 3-4x that. `Int` is 64-bit on iOS/macOS so this platform read correctly while the Kotlin
+    /// twin wrapped to a negative percentage; it is 32-bit on `arm64_32`, and StrandAnalytics already
+    /// builds for watchOS, so the width is stated rather than inherited. Twin of Kotlin `pct`.
     static func pct(_ part: Int, _ total: Int) -> Int {
-        total > 0 ? (part * 200 + total) / (total * 2) : 0
+        total > 0 ? Int((Int64(part) * 200 + Int64(total)) / (Int64(total) * 2)) : 0
     }
 
     /// #1008: a compact, deterministic RAW-ROW sample of the beats around the DENSEST second, for the
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HRVAnalyzerSampleOrdTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HRVAnalyzerSampleOrdTests.swift
index c17a9cb062..83d6e8c6a7 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HRVAnalyzerSampleOrdTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HRVAnalyzerSampleOrdTests.swift
@@ -82,4 +82,13 @@ final class HRVAnalyzerSampleOrdTests: XCTestCase {
         XCTAssertEqual(HRVAnalyzer.pct(3, 8), 38)    // 37.5 -> 38
         XCTAssertEqual(HRVAnalyzer.pct(0, 0), 0)
     }
+
+    /// Twin of Kotlin `pctSurvivesAWholeNightOfBeatTime`. `deliveryHistogram` passes a whole night's
+    /// beat-time in milliseconds, so `part * 200` needs more than 32 bits. `Int` is 64-bit here, so this
+    /// passed before the widening as well - it is a parity pin and a guard for `arm64_32`, where
+    /// StrandAnalytics also builds and where the Kotlin failure would reproduce exactly.
+    func testPctSurvivesAWholeNightOfBeatTime() {
+        XCTAssertEqual(HRVAnalyzer.pct(15_264_177, 35_498_088), 43)
+        XCTAssertEqual(HRVAnalyzer.pct(36_296_594, 39_886_368), 91)
+    }
 }
diff --git a/android/app/src/main/java/com/noop/analytics/HrvAnalyzer.kt b/android/app/src/main/java/com/noop/analytics/HrvAnalyzer.kt
index 686831112a..c82530ff4a 100644
--- a/android/app/src/main/java/com/noop/analytics/HrvAnalyzer.kt
+++ b/android/app/src/main/java/com/noop/analytics/HrvAnalyzer.kt
@@ -772,9 +772,17 @@ object HrvAnalyzer {
      */
     internal fun msToInt(ms: Double): Int = if (ms > 0) (ms + 0.5).toInt() else 0
 
-    /** Whole-percent, integer half-up, so both platforms round a tie the same way. 0 when [total] is 0. */
+    /** Whole-percent, integer half-up, so both platforms round a tie the same way. 0 when [total] is 0.
+     *
+     *  The arithmetic is widened to `Long` because [deliveryHistogram] passes BEAT-TIME IN MILLISECONDS
+     *  summed over a whole night, not a row count. `part * 200` overflows a 32-bit `Int` above
+     *  2147483647 / 200 = 10,737,418 ms, i.e. 2.98 h of beat-time on multi-delivery seconds, and a real
+     *  over-count night carries 3-4x that. Kotlin's `Int` wraps silently, so `multiMs` was reported
+     *  NEGATIVE on every such night while the Swift twin (64-bit `Int`) reported the right value from the
+     *  same source - the parity these two are supposed to hold. Widening the operation rather than the
+     *  signature keeps every caller and the half-up tie behaviour untouched. */
     internal fun pct(part: Int, total: Int): Int =
-        if (total > 0) (part * 200 + total) / (total * 2) else 0
+        if (total > 0) ((part.toLong() * 200 + total) / (total.toLong() * 2)).toInt() else 0
 
     /**
      * #1008: a compact, deterministic RAW-ROW sample of the beats around the DENSEST second, for the
diff --git a/android/app/src/test/java/com/noop/analytics/HrvAnalyzerSampleOrdTest.kt b/android/app/src/test/java/com/noop/analytics/HrvAnalyzerSampleOrdTest.kt
index 1b5bc4d3f3..6549aacbf1 100644
--- a/android/app/src/test/java/com/noop/analytics/HrvAnalyzerSampleOrdTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/HrvAnalyzerSampleOrdTest.kt
@@ -102,4 +102,20 @@ class HrvAnalyzerSampleOrdTest {
         assertEquals(38, HrvAnalyzer.pct(3, 8))
         assertEquals(0, HrvAnalyzer.pct(0, 0))
     }
+
+    /**
+     * `deliveryHistogram` feeds `pct` a whole night's BEAT-TIME IN MILLISECONDS, not a row count, and
+     * `part * 200` needs more than 32 bits past 10,737,418 ms. The numbers below are one real MG night
+     * (34,002 beats, meanNN 1044 ms, multiSec 23%): before the widening `part * 200` wrapped and this
+     * returned -16, a percentage of a positive subset of a positive total that cannot be negative.
+     *
+     * The existing cases above cannot reach it - the largest `rrMs` anywhere in this file is 1309.0 - so
+     * the overflow sat behind a green suite on Android while the 64-bit Swift twin read correctly.
+     */
+    @Test fun pctSurvivesAWholeNightOfBeatTime() {
+        assertEquals(43, HrvAnalyzer.pct(15_264_177, 35_498_088))
+        // The widest multi-delivery share in the same capture: 91% of a 39.9 M ms night (42,981 beats,
+        // meanNN 928 ms). Also wrapped to -16, which is what the log reported for that night.
+        assertEquals(91, HrvAnalyzer.pct(36_296_594, 39_886_368))
+    }
 }

From 4c7b1b5a03e2f56cda71a981d7476a81ed07a53b Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 27 Aug 2026 23:42:54 +1200
Subject: [PATCH 023/333] hrv: state the real pct overflow bound, and pin that
 the wrap could land positive (#1688)

Follow-up to #1685, which widened HrvAnalyzer.pct correctly. What that PR left
slightly wrong is the doc comments it added, and those are what the next person
reasons from.

THE QUOTED BOUND UNDERSTATES THE EXPOSURE. Both comments say the overflow starts
above 2147483647 / 200 = 10,737,418 ms. That is the bound for `part * 200` in
isolation; the numerator is `part * 200 + total`. With part <= total it first
exceeds Int.MAX_VALUE at total >= 10,683,999 (2147483647 / 201) - about 53,000 ms
lower, 2.97 h rather than 2.98 h. 10,737,418 is also the last value that does NOT
overflow even for the multiply alone; that starts one higher, at 10,737,419.

THE WRAP DID NOT ALWAYS LAND NEGATIVE, AND THAT IS THE HALF THAT MATTERS. A 100%
multi-share 8 h night, pct(28_800_000, 28_800_000), returned 25 in 32 bits:
positive, plausible, and wrong by 75 points. So a negative multiMs was a SYMPTOM
of this bug and never a TEST for it. Anyone re-reading pre-fix Android captures
for #1008 / #1118 / #1331 / #1451 cannot filter on the sign - every Android
multiMs past the bound is suspect, including the ones that read fine, and those
are precisely the ones that would have been trusted. This is a stronger claim
than the original made and it changes what the existing logs are worth.

Comments corrected on both platforms, plus a twin test pinning the exact boundary
and the readable-wrong case: 10,683,998 was still computed correctly in 32 bits,
10,683,999 wrapped to -100, 28,800,000 wrapped to 25.

No behaviour change. pct itself is untouched and all three assertions pass on both
platforms today; they are a parity pin and a guard for arm64_32, where the Kotlin
failure reproduces exactly.

VERIFIED RATHER THAN REASONED. Two independently written models of 32-bit
truncation - one in Swift via the standalone oracle, one in Python - agree on all
five values, and both reproduce the -16 that @Zebsi235's real 08-22 and 08-26
nights printed. Reproducing the observed data is what earns them the 25.

The new test was falsified before being trusted: with pct reverted to Int
arithmetic it fails expected:<100> but was:<-100> on the 10,683,999 case, a value
the original comment described as safe. That is the correction, executable. The
revert was undone and the pushed branch re-checked to confirm both merged
arithmetic changes are intact. 10 tests, 0 failures, on freshly cleared result
XMLs.

Tools/doc_comment_lint.py: OK, no new detached doc comments. swift test not run
locally (StrandAnalytics needs macOS via GRDB); swift-packages.yml covers it, and
the asserted values came from the oracle rather than from reading the code.

Refs #1685. Docs and tests only.
---
 .../Sources/StrandAnalytics/HRVAnalyzer.swift  | 16 +++++++++++-----
 .../HRVAnalyzerSampleOrdTests.swift            | 14 ++++++++++++++
 .../java/com/noop/analytics/HrvAnalyzer.kt     | 18 ++++++++++++------
 .../noop/analytics/HrvAnalyzerSampleOrdTest.kt | 15 +++++++++++++++
 4 files changed, 52 insertions(+), 11 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/HRVAnalyzer.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/HRVAnalyzer.swift
index 603aff60c4..f435b709a7 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/HRVAnalyzer.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/HRVAnalyzer.swift
@@ -810,11 +810,17 @@ public enum HRVAnalyzer {
     /// Whole-percent, integer half-up, so both platforms round a tie the same way. 0 when `total` is 0.
     ///
     /// The arithmetic is widened to `Int64` because `deliveryHistogram` passes BEAT-TIME IN
-    /// MILLISECONDS summed over a whole night, not a row count. `part * 200` needs more than 32 bits
-    /// above 10,737,418 ms (2.98 h of beat-time on multi-delivery seconds) and a real over-count night
-    /// carries 3-4x that. `Int` is 64-bit on iOS/macOS so this platform read correctly while the Kotlin
-    /// twin wrapped to a negative percentage; it is 32-bit on `arm64_32`, and StrandAnalytics already
-    /// builds for watchOS, so the width is stated rather than inherited. Twin of Kotlin `pct`.
+    /// MILLISECONDS summed over a whole night, not a row count. The numerator is `part * 200 + total`,
+    /// so with `part <= total` it needs more than 32 bits from `total >= 10,683,999` ms (2.97 h of
+    /// beat-time on multi-delivery seconds) and a real over-count night carries 3-4x that. The multiply
+    /// ALONE would survive to `part >= 10,737,419`; the `+ total` term is what brings the bound down, so
+    /// quoting the multiply's limit understates the exposure. `Int` is 64-bit on iOS/macOS so this
+    /// platform read correctly while the Kotlin twin wrapped; it is 32-bit on `arm64_32`, and
+    /// StrandAnalytics already builds for watchOS, so the width is stated rather than inherited.
+    ///
+    /// The wrap did not always land negative, which is the dangerous half: a 100% multi-share 8 h night
+    /// (`pct(28_800_000, 28_800_000)`) returned 25 in 32 bits - positive, plausible, and wrong by 75
+    /// points. A negative percentage was a symptom of this, never the test for it. Twin of Kotlin `pct`.
     static func pct(_ part: Int, _ total: Int) -> Int {
         total > 0 ? Int((Int64(part) * 200 + Int64(total)) / (Int64(total) * 2)) : 0
     }
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HRVAnalyzerSampleOrdTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HRVAnalyzerSampleOrdTests.swift
index 83d6e8c6a7..45e1ff6361 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HRVAnalyzerSampleOrdTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HRVAnalyzerSampleOrdTests.swift
@@ -91,4 +91,18 @@ final class HRVAnalyzerSampleOrdTests: XCTestCase {
         XCTAssertEqual(HRVAnalyzer.pct(15_264_177, 35_498_088), 43)
         XCTAssertEqual(HRVAnalyzer.pct(36_296_594, 39_886_368), 91)
     }
+
+    /// Twin of Kotlin `pctWrapWasNotAlwaysNegative`. The 32-bit wrap did not always produce a NEGATIVE
+    /// percentage, so "is it negative" was never a sound test for an affected capture.
+    ///
+    /// These pin the exact boundary and the readable-wrong case. The bound is `part * 200 + total`
+    /// exceeding `Int32.max`, not `part * 200` alone: 10,683,998 was still computed correctly in 32
+    /// bits, 10,683,999 wrapped to -100, and a 100% multi-share 8 h night wrapped to 25 - positive,
+    /// plausible, and wrong by 75 points. `Int` is 64-bit here, so these pass either way; they are a
+    /// parity pin and a guard for `arm64_32`, where the Kotlin failure would reproduce exactly.
+    func testPctWrapWasNotAlwaysNegative() {
+        XCTAssertEqual(HRVAnalyzer.pct(10_683_998, 10_683_998), 100)
+        XCTAssertEqual(HRVAnalyzer.pct(10_683_999, 10_683_999), 100)
+        XCTAssertEqual(HRVAnalyzer.pct(28_800_000, 28_800_000), 100)
+    }
 }
diff --git a/android/app/src/main/java/com/noop/analytics/HrvAnalyzer.kt b/android/app/src/main/java/com/noop/analytics/HrvAnalyzer.kt
index c82530ff4a..1e9cdf6a8b 100644
--- a/android/app/src/main/java/com/noop/analytics/HrvAnalyzer.kt
+++ b/android/app/src/main/java/com/noop/analytics/HrvAnalyzer.kt
@@ -775,12 +775,18 @@ object HrvAnalyzer {
     /** Whole-percent, integer half-up, so both platforms round a tie the same way. 0 when [total] is 0.
      *
      *  The arithmetic is widened to `Long` because [deliveryHistogram] passes BEAT-TIME IN MILLISECONDS
-     *  summed over a whole night, not a row count. `part * 200` overflows a 32-bit `Int` above
-     *  2147483647 / 200 = 10,737,418 ms, i.e. 2.98 h of beat-time on multi-delivery seconds, and a real
-     *  over-count night carries 3-4x that. Kotlin's `Int` wraps silently, so `multiMs` was reported
-     *  NEGATIVE on every such night while the Swift twin (64-bit `Int`) reported the right value from the
-     *  same source - the parity these two are supposed to hold. Widening the operation rather than the
-     *  signature keeps every caller and the half-up tie behaviour untouched. */
+     *  summed over a whole night, not a row count. The numerator is `part * 200 + total`, so with
+     *  `part <= total` it needs more than 32 bits from `total >= 10,683,999` ms - 2.97 h of beat-time on
+     *  multi-delivery seconds, and a real over-count night carries 3-4x that. The multiply ALONE would
+     *  survive to `part >= 10,737,419`; the `+ total` term is what brings the bound down, so quoting the
+     *  multiply's limit understates the exposure. Kotlin's `Int` wraps silently while the Swift twin
+     *  (64-bit `Int`) read correctly from the same source - the parity these two are supposed to hold.
+     *
+     *  The wrap did NOT always land negative, which is the dangerous half: a 100% multi-share 8 h night
+     *  (`pct(28_800_000, 28_800_000)`) returned 25 - positive, plausible, and wrong by 75 points. A
+     *  negative `multiMs` was a symptom of this, never the test for it, so every pre-fix Android capture
+     *  past the bound is suspect including the ones that read fine. Widening the operation rather than
+     *  the signature keeps every caller and the half-up tie behaviour untouched. */
     internal fun pct(part: Int, total: Int): Int =
         if (total > 0) ((part.toLong() * 200 + total) / (total.toLong() * 2)).toInt() else 0
 
diff --git a/android/app/src/test/java/com/noop/analytics/HrvAnalyzerSampleOrdTest.kt b/android/app/src/test/java/com/noop/analytics/HrvAnalyzerSampleOrdTest.kt
index 6549aacbf1..1d2c9fb7ad 100644
--- a/android/app/src/test/java/com/noop/analytics/HrvAnalyzerSampleOrdTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/HrvAnalyzerSampleOrdTest.kt
@@ -118,4 +118,19 @@ class HrvAnalyzerSampleOrdTest {
         // meanNN 928 ms). Also wrapped to -16, which is what the log reported for that night.
         assertEquals(91, HrvAnalyzer.pct(36_296_594, 39_886_368))
     }
+
+    /**
+     * The 32-bit wrap did not always produce a NEGATIVE percentage, so "is it negative" was never a
+     * sound test for an affected capture - which matters for anyone re-reading pre-fix Android logs.
+     *
+     * These pin the exact boundary and the readable-wrong case. The bound is `part * 200 + total`
+     * exceeding `Int.MAX_VALUE`, not `part * 200` alone: 10,683,998 was still computed correctly in 32
+     * bits, 10,683,999 wrapped to -100, and a 100% multi-share 8 h night wrapped to 25 - positive,
+     * plausible, and wrong by 75 points. Twin of Swift `testPctWrapWasNotAlwaysNegative`.
+     */
+    @Test fun pctWrapWasNotAlwaysNegative() {
+        assertEquals(100, HrvAnalyzer.pct(10_683_998, 10_683_998)) // last total 32 bits still got right
+        assertEquals(100, HrvAnalyzer.pct(10_683_999, 10_683_999)) // first that wrapped, to -100
+        assertEquals(100, HrvAnalyzer.pct(28_800_000, 28_800_000)) // wrapped to 25, not to anything negative
+    }
 }

From bff6c271c67f4b3d76348189be9cb6902962d0b8 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 00:31:26 +1200
Subject: [PATCH 024/333] workouts: put Pause/Resume on the active-workout
 cards, and stop five clocks ignoring it (#1690)

Community request: a Pause/Unpause button on the workout cards.

The button itself already existed - #1533, thanks @bhelm, shipped in v10.6.0 - but only
on the full-screen live workout view. Working out why people still asked for it turned
up a defect worth more than the request.

FIVE OF THE SEVEN CLOCKS IGNORED PAUSE. Seven surfaces show an in-flight workout's
elapsed time. #1533 taught the two full-screen views to subtract paused time; the other
five still read now - start - both Today cards, both Live cards, and the Workouts-tab
banner. Pausing froze two clocks and left five counting up, so a wearer who paused and
backed out watched the session apparently keep running. The saved duration was correct the whole time, which is what
made it confusing rather than merely wrong: the only evidence on screen contradicted the
button just pressed. That is a plausible route to asking for a feature that already
exists.

On iOS the Today indicator could not have been right: ActiveWorkoutIndicatorModel is the
value type the card renders from and carried only sport + startedAt, so the pause state
never reached it however correct AppModel was.

ONE SHARED CLOCK. New pure ActiveWorkoutClock on both platforms owns the subtraction -
wall time, minus completed pauses, minus the one still open - and all seven surfaces
route through it, including the full-screen views that were already right. A new surface
cannot reintroduce the divergence by open-coding it again.

A SECOND, INDEPENDENT SPLIT: four of the seven formatted with their own %d:%02d and no
hour roll-over - the iOS Live card, the Workouts banner, and BOTH full-screen heroes - so
a 90-minute session read "90:00" there and "1:30:00" on the three that rolled over. The
two sets overlap but are not the same set, which is why one sweep did not find both. All
seven now share one formatter.

THE REQUEST ITSELF: Pause/Resume as a single toggle, on every surface that also offers
End, and on neither Today card, which offers neither. Those cards previously had End and
nothing else - the reversible control behind a screen you had to open, the irreversible
one right there. A "Paused" tag on all of them, because a frozen clock with no tag is
indistinguishable from a stalled one.

No new user-facing copy: Pause / Resume / Paused were localized by #1533 and are reused,
so no xcstrings or strings.xml churn and no new i18n debt.

FOUR OF THE SIX COMMITS EXIST BECAUSE RE-REVIEWS FOUND DEFECTS IN JUST-WRITTEN CODE,
including a claim in one of my own commit messages that turned out to be false:

  - TalkBack could not see the Paused tag on the Android Today card: that card sets one
    contentDescription on a merged node, which REPLACES child semantics. Visible on
    screen, absent from the accessibility tree. The other three were checked rather than
    assumed - only that one had the override, and it was the one I had changed.
  - The iOS Live card labelled itself "RECORDING WORKOUT" beside the new Paused tag,
    asserting both at once. Nothing is recorded while paused; the label swaps instead.
  - A fifth pause-blind clock, after a commit message claiming "five surfaces, all now on
    the shared helper" - a count that was itself wrong, since six were already known. The
    Workouts-tab banner matched neither grep: it hand-rolled its format, and I had read
    only the top hits of the other. Re-swept on the DATA (every site doing arithmetic with
    a workout start) rather than on the vocabulary, and the counts here are taken from that
    sweep rather than from recollection.
  - The parity matrix, built from the code, caught the two heroes. Fixing only iOS would
    have CREATED a divergence: the two agreed with each other before and would not have
    after.

Deliberately left: GpsSession/GpsWorkoutRecorder compute pace elapsed without the
open-pause term, which is not reachable - Android returns early from append() while
paused, iOS guards ingest() on isRecording, which pause() clears. NOOPWatch has its own
clock but it is a separate HealthKit session on HKLiveWorkoutBuilder.elapsedTime, already
pause-aware. No auto-pause: nothing in the tree has ever had it, and a speed threshold
needs field data and per-sport behaviour rather than a guess.

VERIFICATION. Twin Kotlin/Swift tests over the same scenario table, byte-parity checked by
ORACLE rather than by eye: the Swift helper compiles standalone and matches the Kotlin
expectations value for value (65/45/30/40/30/30/0/0, and 0:00 1:05 1:00:00 1:30:00
2:05:09 0:00). The load-bearing case is clockIsFrozenWhilePaused - a clock that subtracts
a CONSTANT still ticks, so the open pause must grow with now - and it was FALSIFIED
rather than trusted: dropping that term fails it expected:<30> but was:<65>.

Android 4603 tests 0 failures on a genuine --rerun-tasks pass. doc_comment_lint OK, i18n
gate green. App-target Swift has no default CI, so app-build was dispatched on the branch
and returned Build Strand: success, Test Strand: success, Build NOOPiOS: success - the
#1589 lesson, where green and mergeable meant nothing.

NOT VALIDATED ON A DEVICE. This is UI on both platforms and the new two-row banner and
button rows want a real screen, particularly on a narrow phone.
---
 Strand/App/ActiveWorkoutClock.swift           | 50 +++++++++++++
 Strand/App/AppModel.swift                     |  5 +-
 Strand/Screens/LiveView.swift                 | 37 +++++----
 Strand/Screens/LiveWorkoutView.swift          |  7 +-
 Strand/Screens/TodayView.swift                | 40 +++++++---
 StrandTests/ActiveWorkoutClockTests.swift     | 69 +++++++++++++++++
 .../java/com/noop/ui/ActiveWorkoutClock.kt    | 40 ++++++++++
 .../src/main/java/com/noop/ui/AppViewModel.kt | 11 ++-
 .../src/main/java/com/noop/ui/LiveScreen.kt   | 44 ++++++++---
 .../java/com/noop/ui/LiveWorkoutScreen.kt     | 11 ++-
 .../src/main/java/com/noop/ui/TodayScreen.kt  | 22 +++++-
 .../src/main/java/com/noop/ui/WorkoutStart.kt | 75 +++++++++++++------
 .../com/noop/ui/ActiveWorkoutClockTest.kt     | 58 ++++++++++++++
 13 files changed, 401 insertions(+), 68 deletions(-)
 create mode 100644 Strand/App/ActiveWorkoutClock.swift
 create mode 100644 StrandTests/ActiveWorkoutClockTests.swift
 create mode 100644 android/app/src/main/java/com/noop/ui/ActiveWorkoutClock.kt
 create mode 100644 android/app/src/test/java/com/noop/ui/ActiveWorkoutClockTest.kt

diff --git a/Strand/App/ActiveWorkoutClock.swift b/Strand/App/ActiveWorkoutClock.swift
new file mode 100644
index 0000000000..b6798cf730
--- /dev/null
+++ b/Strand/App/ActiveWorkoutClock.swift
@@ -0,0 +1,50 @@
+import Foundation
+
+/// The ONE pause-aware elapsed calculation for an in-flight workout, shared by every surface that shows
+/// its clock.
+///
+/// #1533 added Pause/Resume to the full-screen live workout view and taught THAT view's timer to subtract
+/// the paused time. The Today "workout in progress" indicator and the Live tab's active-workout card were
+/// not part of it: both still read `now - start`. So pausing froze one clock and left two others counting
+/// up, and a wearer who paused and backed out saw the session apparently still running. The saved duration
+/// was correct the whole time, which is what made it confusing rather than merely wrong — the only
+/// evidence on screen contradicted the button that had just been pressed.
+///
+/// Kept pure and in one place so a new surface cannot reintroduce the divergence by open-coding the
+/// subtraction again. Twin of Kotlin `ActiveWorkoutClock`.
+enum ActiveWorkoutClock {
+
+    /// Seconds of ACTIVE time: wall time since `start`, minus every completed pause, minus the one still
+    /// open if the session is paused right now.
+    ///
+    /// Clamped at zero so a clock-skew negative reads 0:00 rather than counting backwards. The open-pause
+    /// term is deliberately NOT clamped on its own: the single clamp on the result is what the Kotlin twin
+    /// does, and two clamps would disagree with it for a `pausedAt` in the future.
+    ///
+    /// Twin of Kotlin `ActiveWorkoutClock.activeElapsedSeconds` — the NAMES differ (this one takes
+    /// `Date`/`TimeInterval`, that one Long milliseconds), so neither turns up in a grep for the other.
+    /// Same arithmetic and the same single clamp; the platforms truncate to whole seconds at different
+    /// points and agree because both truncate toward zero.
+    static func activeElapsed(start: Date, pausedAt: Date?, pausedDuration: TimeInterval,
+                              now: Date = Date()) -> TimeInterval {
+        max(0, now.timeIntervalSince(start) - pausedDuration
+            - (pausedAt.map { now.timeIntervalSince($0) } ?? 0))
+    }
+
+    /// `M:SS` up to an hour, `H:MM:SS` once an hour has passed, so a 90-minute session reads "1:30:00"
+    /// rather than "90:00". Negative input clamps to "0:00".
+    ///
+    /// The Live card used to carry its own `%d:%02d` formatter with no hour roll-over at all, so a long
+    /// session read "90:00" there while the Today indicator beside it read "1:30:00" — and Android's
+    /// shared `elapsedClock` documents itself as mirroring the iOS one, which by then it no longer did.
+    /// Twin of Kotlin `elapsedClock`.
+    static func clock(_ seconds: Int) -> String {
+        let total = max(0, seconds)
+        let h = total / 3600
+        let m = (total % 3600) / 60
+        let s = total % 60
+        return h > 0
+            ? String(format: "%d:%02d:%02d", h, m, s)
+            : String(format: "%d:%02d", m, s)
+    }
+}
diff --git a/Strand/App/AppModel.swift b/Strand/App/AppModel.swift
index 8c7f100b0d..4b154828cd 100644
--- a/Strand/App/AppModel.swift
+++ b/Strand/App/AppModel.swift
@@ -118,9 +118,10 @@ final class AppModel: ObservableObject {
 
         var isPaused: Bool { pausedAt != nil }
 
+        /// Delegates to `ActiveWorkoutClock` so this and the two card surfaces cannot drift apart again.
         func elapsed(at now: Date = Date()) -> TimeInterval {
-            max(0, now.timeIntervalSince(start) - pausedDuration
-                - (pausedAt.map { now.timeIntervalSince($0) } ?? 0))
+            ActiveWorkoutClock.activeElapsed(start: start, pausedAt: pausedAt,
+                                             pausedDuration: pausedDuration, now: now)
         }
     }
     struct HealthAlert: Equatable {
diff --git a/Strand/Screens/LiveView.swift b/Strand/Screens/LiveView.swift
index aad7ca8e1f..d9dc0364df 100644
--- a/Strand/Screens/LiveView.swift
+++ b/Strand/Screens/LiveView.swift
@@ -361,28 +361,44 @@ struct LiveView: View {
             VStack(alignment: .leading, spacing: 12) {
                 HStack(spacing: 8) {
                     Circle().fill(StrandPalette.metricRose).frame(width: 8, height: 8)
-                    Text("RECORDING WORKOUT").font(StrandFont.overline)
-                        .tracking(StrandFont.overlineTracking).foregroundStyle(StrandPalette.metricRose)
+                    // "RECORDING" is a factual claim, and while paused nothing IS being recorded — the
+                    // sample capture drops every reading. So the label swaps rather than gaining a tag
+                    // beside it, which would leave the card asserting both at once. Reuses the "Paused"
+                    // string #1533 already localized. (The Today card says "IN PROGRESS", which stays
+                    // true while paused, so it keeps its label and takes the tag instead.)
+                    Text(w.isPaused ? "Paused" : "RECORDING WORKOUT").font(StrandFont.overline)
+                        .tracking(StrandFont.overlineTracking)
+                        .foregroundStyle(w.isPaused ? StrandPalette.textSecondary : StrandPalette.metricRose)
                     Spacer()
                     // Re-render once a second so the elapsed clock ticks without a manual Timer.
-                    TimelineView(.periodic(from: .now, by: 1)) { _ in
-                        Text(Self.elapsed(since: w.start)).font(StrandFont.number(17)).monospacedDigit()
+                    TimelineView(.periodic(from: .now, by: 1)) { context in
+                        Text(ActiveWorkoutClock.clock(Int(w.elapsed(at: context.date))))
+                            .font(StrandFont.number(17)).monospacedDigit()
                             .foregroundStyle(StrandPalette.textPrimary)
                     }
                 }
                 // Live HR / avg / peak / effort — the leaf owns LiveState + the active workout so the
                 // 1 Hz stat refresh re-renders only these tiles, plus a liquid effort tube under them.
                 ActiveWorkoutLive(workout: w, effortScale: effortScale)
+                // The card used to offer End and nothing else, so the only IRREVERSIBLE control was the
+                // one reachable without opening the live view, while Pause — the reversible one — was
+                // not. Pause/Resume is one toggle (a paused session has exactly one sensible action), and
+                // End moves to its own row so a destructive tap is not adjacent to a routine one.
                 HStack(spacing: NoopMetrics.rowSpacing) {
+                    NoopButton(w.isPaused ? "Resume" : "Pause",
+                               systemImage: w.isPaused ? "play.fill" : "pause.fill",
+                               kind: .secondary, fullWidth: true) {
+                        model.toggleWorkoutPause()
+                    }
                     // Re-open the full live workout screen (#238) after it's been dismissed.
                     NoopButton("Open live view", systemImage: "rectangle.expand.vertical",
                                kind: .secondary, fullWidth: true) {
                         showLiveWorkout = true
                     }
-                    NoopButton("End workout", systemImage: "stop.circle.fill",
-                               kind: .destructive, fullWidth: true) {
-                        confirmingEndWorkout = true
-                    }
+                }
+                NoopButton("End workout", systemImage: "stop.circle.fill",
+                           kind: .destructive, fullWidth: true) {
+                    confirmingEndWorkout = true
                 }
             }
         }
@@ -401,11 +417,6 @@ struct LiveView: View {
         .padding(.horizontal, 4)
     }
 
-    private static func elapsed(since start: Date) -> String {
-        let s = max(0, Int(Date().timeIntervalSince(start)))
-        return String(format: "%d:%02d", s / 60, s % 60)
-    }
-
     private func reconnectGuideBanner(_ guide: String) -> some View {
         HStack(alignment: .top, spacing: 10) {
             Image(systemName: "exclamationmark.triangle.fill")
diff --git a/Strand/Screens/LiveWorkoutView.swift b/Strand/Screens/LiveWorkoutView.swift
index 1fa83dd943..6bbb741300 100644
--- a/Strand/Screens/LiveWorkoutView.swift
+++ b/Strand/Screens/LiveWorkoutView.swift
@@ -423,9 +423,12 @@ struct LiveWorkoutView: View {
 
     // MARK: - Helpers
 
+    /// Delegates to the shared clock. This carried its own `%d:%02d` with NO hour roll-over, so a
+    /// 90-minute session read "90:00" here while Android's live workout screen read "1:30:00" — and,
+    /// after the card fix, while the iOS card that opens THIS screen read "1:30:00" too. The math was
+    /// already pause-aware (`workout.elapsed()`); only the formatting was the odd one out.
     private static func elapsed(seconds: TimeInterval) -> String {
-        let s = max(0, Int(seconds))
-        return String(format: "%d:%02d", s / 60, s % 60)
+        ActiveWorkoutClock.clock(Int(seconds))
     }
 
     private static func zoneName(_ zone: Int) -> String {
diff --git a/Strand/Screens/TodayView.swift b/Strand/Screens/TodayView.swift
index b4541a58b7..955c296eab 100644
--- a/Strand/Screens/TodayView.swift
+++ b/Strand/Screens/TodayView.swift
@@ -65,24 +65,32 @@ private struct HRChartFrameKey: PreferenceKey {
 struct ActiveWorkoutIndicatorModel: Equatable {
     let sport: String
     let startedAt: Date
+    /// The pause state has to be CARRIED, not just consulted: this value type is what the card renders
+    /// from, so without these two fields the indicator cannot subtract the paused time or say it is
+    /// paused, however correct `AppModel` is. That is precisely how it kept counting through #1533.
+    var pausedAt: Date? = nil
+    var pausedDuration: TimeInterval = 0
+
+    var isPaused: Bool { pausedAt != nil }
 
     static func make(from workout: AppModel.ActiveWorkout?) -> ActiveWorkoutIndicatorModel? {
         guard let workout else { return nil }
-        return ActiveWorkoutIndicatorModel(sport: workout.sport, startedAt: workout.start)
+        return ActiveWorkoutIndicatorModel(sport: workout.sport, startedAt: workout.start,
+                                           pausedAt: workout.pausedAt,
+                                           pausedDuration: workout.pausedDuration)
     }
 
-    /// Elapsed time since `start`, formatted M:SS up to an hour and H:MM:SS once an hour has passed (so a
+    /// Elapsed ACTIVE time, formatted M:SS up to an hour and H:MM:SS once an hour has passed (so a
     /// 90-minute session reads "1:30:00", not "90:00"). Clamped at zero so a clock-skew negative reads 0:00.
     /// Pure + injectable `now` for deterministic tests. (StrandFont.bodyNumber already applies tabular figures,
     /// so the call site does NOT add `.monospacedDigit()`.)
-    static func elapsed(since start: Date, now: Date = Date()) -> String {
-        let total = max(0, Int(now.timeIntervalSince(start)))
-        let h = total / 3600
-        let m = (total % 3600) / 60
-        let s = total % 60
-        return h > 0
-            ? String(format: "%d:%02d:%02d", h, m, s)
-            : String(format: "%d:%02d", m, s)
+    ///
+    /// `pausedAt`/`pausedDuration` default to "never paused" so the existing call sites and tests that
+    /// predate pause keep their exact meaning; the math itself lives in `ActiveWorkoutClock`.
+    static func elapsed(since start: Date, pausedAt: Date? = nil, pausedDuration: TimeInterval = 0,
+                        now: Date = Date()) -> String {
+        ActiveWorkoutClock.clock(Int(ActiveWorkoutClock.activeElapsed(
+            start: start, pausedAt: pausedAt, pausedDuration: pausedDuration, now: now)))
     }
 }
 
@@ -103,12 +111,22 @@ private struct ActiveWorkoutIndicatorCard: View {
                         .font(StrandFont.overline)
                         .tracking(StrandFont.overlineTracking)
                         .foregroundStyle(StrandPalette.metricRose)
+                    // A frozen clock alone is ambiguous with a STALLED one, so say which it is. Reuses the
+                    // "Paused" string #1533 already localized rather than minting new copy for a tag.
+                    if model.isPaused {
+                        Text("Paused")
+                            .font(StrandFont.overline)
+                            .tracking(StrandFont.overlineTracking)
+                            .foregroundStyle(StrandPalette.textSecondary)
+                    }
                     Spacer(minLength: NoopMetrics.space2)
                     // A per-second live clock. The TimelineView re-evaluates ONLY this Text every second, so
                     // the tick never re-renders the rest of the card (let alone TodayView.body). bodyNumber
                     // already carries `.monospacedDigit()`, so no extra modifier here.
                     TimelineView(.periodic(from: .now, by: 1)) { context in
-                        Text(ActiveWorkoutIndicatorModel.elapsed(since: model.startedAt, now: context.date))
+                        Text(ActiveWorkoutIndicatorModel.elapsed(
+                            since: model.startedAt, pausedAt: model.pausedAt,
+                            pausedDuration: model.pausedDuration, now: context.date))
                             .font(StrandFont.bodyNumber)
                             .foregroundStyle(StrandPalette.textPrimary)
                     }
diff --git a/StrandTests/ActiveWorkoutClockTests.swift b/StrandTests/ActiveWorkoutClockTests.swift
new file mode 100644
index 0000000000..69f2e51351
--- /dev/null
+++ b/StrandTests/ActiveWorkoutClockTests.swift
@@ -0,0 +1,69 @@
+import XCTest
+@testable import Strand
+
+/// Pins the pause-aware workout clock every live surface now shares.
+///
+/// #1533 added Pause/Resume but only the full-screen live view's timer subtracted the paused time; the
+/// Today indicator and the Live card kept reading `now - start`, so pausing froze one clock and left two
+/// counting. These cases are the twin of Kotlin `ActiveWorkoutClockTest` — same scenarios, same expected
+/// seconds — so the two platforms cannot drift on what "elapsed" means for a paused session.
+final class ActiveWorkoutClockTests: XCTestCase {
+
+    private let start = Date(timeIntervalSince1970: 1_000)
+
+    private func elapsed(pausedAt: TimeInterval? = nil, pausedDuration: TimeInterval = 0,
+                         now: TimeInterval) -> Int {
+        Int(ActiveWorkoutClock.activeElapsed(
+            start: start,
+            pausedAt: pausedAt.map { start.addingTimeInterval($0) },
+            pausedDuration: pausedDuration,
+            now: start.addingTimeInterval(now)))
+    }
+
+    func testActiveElapsedSubtractsCompletedAndOpenPauses() {
+        XCTAssertEqual(elapsed(now: 65), 65)                                     // never paused
+        XCTAssertEqual(elapsed(pausedDuration: 20, now: 65), 45)                 // one finished pause
+        XCTAssertEqual(elapsed(pausedAt: 30, now: 65), 30)                       // paused at 30s, still paused
+        XCTAssertEqual(elapsed(pausedAt: 50, pausedDuration: 10, now: 65), 40)   // both
+    }
+
+    /// The whole point of the fix: while paused the number must not move, however much wall time passes.
+    /// This is what the two card surfaces got wrong, and a clock that merely subtracts a CONSTANT would
+    /// still tick — so the open pause has to grow with `now`.
+    func testClockIsFrozenWhilePaused() {
+        XCTAssertEqual(elapsed(pausedAt: 30, now: 65), 30)
+        XCTAssertEqual(elapsed(pausedAt: 30, now: 99), 30)
+        XCTAssertEqual(elapsed(pausedAt: 30, now: 4_000), 30)
+    }
+
+    func testNeverCountsBackwards() {
+        XCTAssertEqual(elapsed(now: -5), 0)                        // clock skew
+        XCTAssertEqual(elapsed(pausedDuration: 70, now: 65), 0)    // paused longer than the session
+    }
+
+    /// The Live card carried its own `%d:%02d` formatter with no hour roll-over, so a 90-minute session
+    /// read "90:00" there and "1:30:00" on the Today indicator beside it. One formatter now.
+    func testClockFormatRollsOverAtAnHour() {
+        XCTAssertEqual(ActiveWorkoutClock.clock(0), "0:00")
+        XCTAssertEqual(ActiveWorkoutClock.clock(65), "1:05")
+        XCTAssertEqual(ActiveWorkoutClock.clock(3_600), "1:00:00")
+        XCTAssertEqual(ActiveWorkoutClock.clock(5_400), "1:30:00")
+        XCTAssertEqual(ActiveWorkoutClock.clock(2 * 3_600 + 5 * 60 + 9), "2:05:09")
+        XCTAssertEqual(ActiveWorkoutClock.clock(-5), "0:00")
+    }
+
+    /// The Today indicator renders from a value type, so the pause state has to reach IT — being correct
+    /// on `AppModel` is not enough, and that is exactly how the card kept counting.
+    func testIndicatorModelCarriesPauseStateAndFreezes() {
+        var workout = AppModel.ActiveWorkout(start: start)
+        workout.pausedAt = start.addingTimeInterval(30)
+        let model = ActiveWorkoutIndicatorModel.make(from: workout)
+        XCTAssertEqual(model?.isPaused, true)
+        XCTAssertEqual(model?.pausedAt, workout.pausedAt)
+        XCTAssertEqual(
+            ActiveWorkoutIndicatorModel.elapsed(since: start, pausedAt: model?.pausedAt,
+                                                pausedDuration: model?.pausedDuration ?? 0,
+                                                now: start.addingTimeInterval(600)),
+            "0:30")
+    }
+}
diff --git a/android/app/src/main/java/com/noop/ui/ActiveWorkoutClock.kt b/android/app/src/main/java/com/noop/ui/ActiveWorkoutClock.kt
new file mode 100644
index 0000000000..8916e504cc
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ui/ActiveWorkoutClock.kt
@@ -0,0 +1,40 @@
+package com.noop.ui
+
+/**
+ * The ONE pause-aware elapsed calculation for an in-flight workout, shared by every surface that shows
+ * its clock.
+ *
+ * #1533 added Pause/Resume to the full-screen live workout screen and taught THAT screen's timer to
+ * subtract the paused time. The Today "workout in progress" card and the Live tab's active-workout card
+ * were not part of it: both still read `now - startMs`. So pausing froze one clock and left two others
+ * counting up, and a wearer who paused and left the screen saw the session apparently still running. The
+ * saved duration was correct the whole time, which is what made it confusing rather than merely wrong —
+ * the only evidence on screen contradicted the button that had just been pressed.
+ *
+ * Kept pure and in one place so a new surface cannot reintroduce the divergence by open-coding the
+ * subtraction again. Twin of Swift `ActiveWorkoutClock`.
+ */
+object ActiveWorkoutClock {
+
+    /**
+     * Seconds of ACTIVE time: wall time since [startMs], minus every completed pause
+     * ([pausedDurationMs]), minus the one still open when [pausedAtMs] is non-null.
+     *
+     * Clamped at zero so a clock-skew negative reads 0:00 rather than counting backwards. The open-pause
+     * term is deliberately NOT clamped on its own: the single clamp on the result is what the Swift twin
+     * does, and two clamps would disagree with it for a [pausedAtMs] in the future.
+     *
+     * Twin of Swift `ActiveWorkoutClock.activeElapsed` — the NAMES differ (that one takes
+     * `Date`/`TimeInterval`, this one Long milliseconds), so neither turns up in a grep for the other.
+     * Same arithmetic and the same single clamp.
+     */
+    fun activeElapsedSeconds(
+        startMs: Long,
+        pausedAtMs: Long?,
+        pausedDurationMs: Long,
+        nowMs: Long,
+    ): Long {
+        val openPauseMs = pausedAtMs?.let { nowMs - it } ?: 0L
+        return ((nowMs - startMs - pausedDurationMs - openPauseMs) / 1000).coerceAtLeast(0L)
+    }
+}
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index a1f8dbdbfa..9be92ab20f 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -2992,9 +2992,14 @@ internal fun earliestStrapAlarmEpochSec(smartEpoch: Long?, buzzEpoch: Long?): Lo
 
 /**
  * Elapsed-workout clock from a whole-second count: M:SS up to an hour, H:MM:SS once an hour has passed (so a
- * 90-minute session reads "1:30:00", not "90:00"). Negative inputs clamp to zero ("0:00"). Pure so the
- * Today "workout in progress" indicator and the Live card share ONE format, and the iOS-parity H:MM:SS
- * roll-over is unit-testable without composing any UI. Mirrors iOS ActiveWorkoutIndicatorModel.elapsed.
+ * 90-minute session reads "1:30:00", not "90:00"). Negative inputs clamp to zero ("0:00"). Pure so every
+ * surface showing an in-flight workout — the Today card, the Live card, the Workouts-tab banner and the
+ * full-screen live screen — shares ONE format, and the iOS-parity H:MM:SS roll-over is unit-testable
+ * without composing any UI.
+ *
+ * Twin of Swift `ActiveWorkoutClock.clock`. (It used to name ActiveWorkoutIndicatorModel.elapsed, which
+ * no longer owns the formatting — that now delegates, like everything else, so the reference moved with
+ * the code rather than being left pointing at a caller.)
  */
 internal fun elapsedClock(elapsedS: Long): String {
     val total = elapsedS.coerceAtLeast(0)
diff --git a/android/app/src/main/java/com/noop/ui/LiveScreen.kt b/android/app/src/main/java/com/noop/ui/LiveScreen.kt
index 3bb9a72a7a..c1ba271e97 100644
--- a/android/app/src/main/java/com/noop/ui/LiveScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/LiveScreen.kt
@@ -16,6 +16,7 @@ import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.automirrored.filled.KeyboardArrowRight
@@ -370,11 +371,20 @@ fun LiveScreen(viewModel: AppViewModel, onManageDevices: () -> Unit = {}) {
             LaunchedEffect(w.startMs) {
                 while (true) { nowMs = System.currentTimeMillis(); delay(1000) }
             }
-            val elapsedS = ((nowMs - w.startMs) / 1000).coerceAtLeast(0)
+            val elapsedS = ActiveWorkoutClock.activeElapsedSeconds(
+                startMs = w.startMs, pausedAtMs = w.pausedAtMs,
+                pausedDurationMs = w.pausedDurationMs, nowMs = nowMs,
+            )
             NoopCard(tint = Palette.effortColor) {
                 Column(verticalArrangement = Arrangement.spacedBy(10.dp)) {
                     Row(verticalAlignment = Alignment.CenterVertically, modifier = Modifier.fillMaxWidth()) {
                         Text(uiString(R.string.l10n_live_screen_w_sport_name_uppercase_e59bc678, w.sport.name.uppercase()), style = NoopType.overline, color = Palette.statusCritical)
+                        // A frozen clock alone is ambiguous with a STALLED one, so say which it is. Reuses
+                        // the string #1533 already localized rather than minting new copy for a tag.
+                        if (w.pausedAtMs != null) {
+                            Spacer(Modifier.width(Metrics.space8))
+                            Text(uiString(R.string.workout_action_paused), style = NoopType.overline, color = Palette.textSecondary)
+                        }
                         Spacer(Modifier.weight(1f))
                         Text(
                             // Shared clock: M:SS up to an hour, H:MM:SS past it (so a long session reads
@@ -397,14 +407,30 @@ fun LiveScreen(viewModel: AppViewModel, onManageDevices: () -> Unit = {}) {
                             StatTile(modifier = Modifier.weight(1f), label = uiString(R.string.l10n_live_screen_pace_7a9a6226), value = w.paceSecPerKm?.let { livePace(it, unitSystem) } ?: "—")
                         }
                     }
-                    Button(
-                        onClick = { confirmingEnd = true },
-                        modifier = Modifier.fillMaxWidth(),
-                        contentPadding = PaddingValues(horizontal = 10.dp, vertical = 8.dp),
-                        colors = ButtonDefaults.buttonColors(
-                            containerColor = Palette.statusCritical, contentColor = Palette.surfaceBase,
-                        ),
-                    ) { Text(uiString(R.string.l10n_live_screen_end_workout_3e8d6238), style = NoopType.captionNumber) }
+                    // The card used to offer End and nothing else, so the only IRREVERSIBLE control was the
+                    // one reachable without opening the live overlay, while Pause — the reversible one —
+                    // was not. One toggle: a paused session has exactly one sensible next action.
+                    Row(horizontalArrangement = Arrangement.spacedBy(Metrics.gap), modifier = Modifier.fillMaxWidth()) {
+                        Button(
+                            onClick = { viewModel.toggleWorkoutPause() },
+                            modifier = Modifier.weight(1f),
+                            contentPadding = PaddingValues(horizontal = 10.dp, vertical = 8.dp),
+                        ) {
+                            Text(
+                                if (w.pausedAtMs != null) uiString(R.string.workout_action_resume)
+                                else uiString(R.string.workout_action_pause),
+                                style = NoopType.captionNumber,
+                            )
+                        }
+                        Button(
+                            onClick = { confirmingEnd = true },
+                            modifier = Modifier.weight(1f),
+                            contentPadding = PaddingValues(horizontal = 10.dp, vertical = 8.dp),
+                            colors = ButtonDefaults.buttonColors(
+                                containerColor = Palette.statusCritical, contentColor = Palette.surfaceBase,
+                            ),
+                        ) { Text(uiString(R.string.l10n_live_screen_end_workout_3e8d6238), style = NoopType.captionNumber) }
+                    }
                 }
             }
             if (confirmingEnd) {
diff --git a/android/app/src/main/java/com/noop/ui/LiveWorkoutScreen.kt b/android/app/src/main/java/com/noop/ui/LiveWorkoutScreen.kt
index c361f13fb7..0ad26459ba 100644
--- a/android/app/src/main/java/com/noop/ui/LiveWorkoutScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/LiveWorkoutScreen.kt
@@ -108,8 +108,10 @@ fun LiveWorkoutScreen(vm: AppViewModel, onClose: () -> Unit) {
     LaunchedEffect(w.startMs) {
         while (true) { nowMs = System.currentTimeMillis(); delay(1000) }
     }
-    val currentPauseMs = w.pausedAtMs?.let { nowMs - it } ?: 0L
-    val elapsedS = ((nowMs - w.startMs - w.pausedDurationMs - currentPauseMs) / 1000).coerceAtLeast(0)
+    val elapsedS = ActiveWorkoutClock.activeElapsedSeconds(
+        startMs = w.startMs, pausedAtMs = w.pausedAtMs,
+        pausedDurationMs = w.pausedDurationMs, nowMs = nowMs,
+    )
 
     // A scenic Effort-tinted backdrop behind the whole in-exercise screen — the live workout reads as
     // an Effort-world hero, not a flat panel.
@@ -163,7 +165,10 @@ fun LiveWorkoutScreen(vm: AppViewModel, onClose: () -> Unit) {
             ) {
                 Overline("Time", color = Palette.textSecondary)
                 Text(
-                    String.format("%d:%02d", elapsedS / 60, elapsedS % 60),
+                    // elapsedClock, not a local %d:%02d — that one had no hour roll-over, so this hero
+                    // read "90:00" for a 90-minute session while every card that opens this screen read
+                    // "1:30:00". The iOS twin had the identical local formatter and is fixed alongside.
+                    elapsedClock(elapsedS),
                     style = NoopType.number(56f), color = Palette.textPrimary,
                 )
             }
diff --git a/android/app/src/main/java/com/noop/ui/TodayScreen.kt b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
index 9e4b77c1c6..17cc5485b3 100644
--- a/android/app/src/main/java/com/noop/ui/TodayScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
@@ -1853,9 +1853,17 @@ private fun WorkoutInProgressCard(
             kotlinx.coroutines.delay(1000)
         }
     }
-    val elapsedS = ((nowMs - workout.startMs) / 1000).coerceAtLeast(0)
+    val elapsedS = ActiveWorkoutClock.activeElapsedSeconds(
+        startMs = workout.startMs, pausedAtMs = workout.pausedAtMs,
+        pausedDurationMs = workout.pausedDurationMs, nowMs = nowMs,
+    )
     val elapsed = elapsedClock(elapsedS)
     val sportLabel = workout.sport.name
+    // The card below sets ONE contentDescription on a merged node, which REPLACES its children's
+    // semantics — so the visible "Paused" tag would be invisible to TalkBack unless it is folded in
+    // here. A frozen clock the screen reader cannot explain is worse than a running one.
+    val pausedSuffix =
+        if (workout.pausedAtMs != null) ", " + uiString(R.string.workout_action_paused) else ""
 
     // liquidPress on the whole tappable "return to workout" card (same interactionSource on clickable + press).
     val interaction = remember { MutableInteractionSource() }
@@ -1868,7 +1876,7 @@ private fun WorkoutInProgressCard(
             .liquidPress(interaction)
             .clickable(interactionSource = interaction, indication = null, onClick = onReturn)
             .semantics(mergeDescendants = true) {
-                contentDescription = uiString(R.string.l10n_today_screen_workout_in_progress_sportlabel_elapsed_return_95ce4bda, sportLabel, elapsed)
+                contentDescription = uiString(R.string.l10n_today_screen_workout_in_progress_sportlabel_elapsed_return_95ce4bda, sportLabel, elapsed) + pausedSuffix
             },
     ) {
         Column(verticalArrangement = Arrangement.spacedBy(Metrics.space12)) {
@@ -1887,6 +1895,16 @@ private fun WorkoutInProgressCard(
                     style = NoopType.overline,
                     color = Palette.metricRose,
                 )
+                // A frozen clock alone is ambiguous with a STALLED one, so say which it is. Reuses the
+                // string #1533 already localized rather than minting new copy for a tag.
+                if (workout.pausedAtMs != null) {
+                    Spacer(Modifier.width(Metrics.space8))
+                    Text(
+                        uiString(R.string.workout_action_paused),
+                        style = NoopType.overline,
+                        color = Palette.textSecondary,
+                    )
+                }
                 Spacer(Modifier.weight(1f))
                 Text(elapsed, style = NoopType.number(15f), color = Palette.textPrimary)
             }
diff --git a/android/app/src/main/java/com/noop/ui/WorkoutStart.kt b/android/app/src/main/java/com/noop/ui/WorkoutStart.kt
index 6ab2f444ff..110db40d57 100644
--- a/android/app/src/main/java/com/noop/ui/WorkoutStart.kt
+++ b/android/app/src/main/java/com/noop/ui/WorkoutStart.kt
@@ -203,33 +203,62 @@ fun WorkoutStartSection(vm: AppViewModel, onAdd: () -> Unit) {
         LaunchedEffect(w.startMs) {
             while (true) { nowMs = System.currentTimeMillis(); delay(1000) }
         }
-        val elapsedS = ((nowMs - w.startMs) / 1000).coerceAtLeast(0)
+        val elapsedS = ActiveWorkoutClock.activeElapsedSeconds(
+            startMs = w.startMs, pausedAtMs = w.pausedAtMs,
+            pausedDurationMs = w.pausedDurationMs, nowMs = nowMs,
+        )
         // Recording: the live banner, with Add kept visible below so a past workout can still be logged
         // mid-session (it used to live in the range bar).
         Column(verticalArrangement = Arrangement.spacedBy(10.dp)) {
             NoopCard {
-                Row(verticalAlignment = Alignment.CenterVertically, modifier = Modifier.fillMaxWidth()) {
-                    Text(uiString(R.string.l10n_workout_start_w_sport_name_uppercase_e59bc678, w.sport.name.uppercase()), style = NoopType.overline, color = Palette.statusCritical)
-                Spacer(Modifier.width(10.dp))
-                Text(
-                    String.format("%d:%02d", elapsedS / 60, elapsedS % 60),
-                    style = NoopType.title2, color = Palette.textPrimary,
-                )
-                Spacer(Modifier.weight(1f))
-                // Re-open the full-screen live workout view.
-                OutlinedButton(
-                    onClick = { showLiveWorkout = true },
-                    contentPadding = PaddingValues(horizontal = 14.dp, vertical = 8.dp),
-                    colors = ButtonDefaults.outlinedButtonColors(contentColor = Palette.accent),
-                ) { Text(uiString(R.string.l10n_workout_start_open_cf9b7706), style = NoopType.captionNumber) }
-                Spacer(Modifier.width(8.dp))
-                Button(
-                    onClick = { confirmingEnd = true },
-                    contentPadding = PaddingValues(horizontal = 14.dp, vertical = 8.dp),
-                    colors = ButtonDefaults.buttonColors(
-                        containerColor = Palette.statusCritical, contentColor = Palette.surfaceBase,
-                    ),
-                ) { Text(uiString(R.string.l10n_workout_start_end_a2bb9d34), style = NoopType.captionNumber) }
+                // Two rows, not one: this banner already carried a sport label, a clock, Open and End,
+                // and a third button would squeeze all five onto one line on a narrow phone. The state
+                // reads on top, the actions sit below with equal weight.
+                Column(verticalArrangement = Arrangement.spacedBy(10.dp), modifier = Modifier.fillMaxWidth()) {
+                    Row(verticalAlignment = Alignment.CenterVertically, modifier = Modifier.fillMaxWidth()) {
+                        Text(uiString(R.string.l10n_workout_start_w_sport_name_uppercase_e59bc678, w.sport.name.uppercase()), style = NoopType.overline, color = Palette.statusCritical)
+                        // A frozen clock alone is ambiguous with a STALLED one, so say which it is. Reuses
+                        // the string #1533 already localized rather than minting new copy for a tag.
+                        if (w.pausedAtMs != null) {
+                            Spacer(Modifier.width(8.dp))
+                            Text(uiString(R.string.workout_action_paused), style = NoopType.overline, color = Palette.textSecondary)
+                        }
+                        Spacer(Modifier.width(10.dp))
+                        // elapsedClock, not a local %d:%02d — that one had no hour roll-over at all, so a
+                        // 90-minute session read "90:00" here while every other surface read "1:30:00".
+                        Text(elapsedClock(elapsedS), style = NoopType.title2, color = Palette.textPrimary)
+                        Spacer(Modifier.weight(1f))
+                    }
+                    Row(horizontalArrangement = Arrangement.spacedBy(8.dp), modifier = Modifier.fillMaxWidth()) {
+                        // End was reachable here and Pause was not, so the only control this banner
+                        // offered without opening the live view was the irreversible one.
+                        Button(
+                            onClick = { vm.toggleWorkoutPause() },
+                            modifier = Modifier.weight(1f),
+                            contentPadding = PaddingValues(horizontal = 14.dp, vertical = 8.dp),
+                        ) {
+                            Text(
+                                if (w.pausedAtMs != null) uiString(R.string.workout_action_resume)
+                                else uiString(R.string.workout_action_pause),
+                                style = NoopType.captionNumber,
+                            )
+                        }
+                        // Re-open the full-screen live workout view.
+                        OutlinedButton(
+                            onClick = { showLiveWorkout = true },
+                            modifier = Modifier.weight(1f),
+                            contentPadding = PaddingValues(horizontal = 14.dp, vertical = 8.dp),
+                            colors = ButtonDefaults.outlinedButtonColors(contentColor = Palette.accent),
+                        ) { Text(uiString(R.string.l10n_workout_start_open_cf9b7706), style = NoopType.captionNumber) }
+                        Button(
+                            onClick = { confirmingEnd = true },
+                            modifier = Modifier.weight(1f),
+                            contentPadding = PaddingValues(horizontal = 14.dp, vertical = 8.dp),
+                            colors = ButtonDefaults.buttonColors(
+                                containerColor = Palette.statusCritical, contentColor = Palette.surfaceBase,
+                            ),
+                        ) { Text(uiString(R.string.l10n_workout_start_end_a2bb9d34), style = NoopType.captionNumber) }
+                    }
                 }
             }
             AddWorkoutButton(onAdd, Modifier.fillMaxWidth())
diff --git a/android/app/src/test/java/com/noop/ui/ActiveWorkoutClockTest.kt b/android/app/src/test/java/com/noop/ui/ActiveWorkoutClockTest.kt
new file mode 100644
index 0000000000..6fe22a4b44
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/ActiveWorkoutClockTest.kt
@@ -0,0 +1,58 @@
+package com.noop.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+/**
+ * Pins the pause-aware workout clock every live surface now shares.
+ *
+ * #1533 added Pause/Resume but only the full-screen live workout screen's timer subtracted the paused
+ * time; the Today card and the Live card kept reading `now - startMs`, so pausing froze one clock and
+ * left two counting. These cases are the twin of Swift `ActiveWorkoutClockTests` — same scenarios, same
+ * expected seconds — so the two platforms cannot drift on what "elapsed" means for a paused session.
+ */
+class ActiveWorkoutClockTest {
+
+    private val startMs = 1_000_000L
+
+    private fun elapsed(pausedAtS: Long? = null, pausedDurationS: Long = 0, nowS: Long): Long =
+        ActiveWorkoutClock.activeElapsedSeconds(
+            startMs = startMs,
+            pausedAtMs = pausedAtS?.let { startMs + it * 1000 },
+            pausedDurationMs = pausedDurationS * 1000,
+            nowMs = startMs + nowS * 1000,
+        )
+
+    @Test fun activeElapsedSubtractsCompletedAndOpenPauses() {
+        assertEquals(65L, elapsed(nowS = 65))                                        // never paused
+        assertEquals(45L, elapsed(pausedDurationS = 20, nowS = 65))                  // one finished pause
+        assertEquals(30L, elapsed(pausedAtS = 30, nowS = 65))                        // paused at 30s, still paused
+        assertEquals(40L, elapsed(pausedAtS = 50, pausedDurationS = 10, nowS = 65))  // both
+    }
+
+    /**
+     * The whole point of the fix: while paused the number must not move, however much wall time passes.
+     * This is what the two card surfaces got wrong, and a clock that merely subtracts a CONSTANT would
+     * still tick — so the open pause has to grow with `now`.
+     */
+    @Test fun clockIsFrozenWhilePaused() {
+        assertEquals(30L, elapsed(pausedAtS = 30, nowS = 65))
+        assertEquals(30L, elapsed(pausedAtS = 30, nowS = 99))
+        assertEquals(30L, elapsed(pausedAtS = 30, nowS = 4_000))
+    }
+
+    @Test fun neverCountsBackwards() {
+        assertEquals(0L, elapsed(nowS = -5))                          // clock skew
+        assertEquals(0L, elapsed(pausedDurationS = 70, nowS = 65))    // paused longer than the session
+    }
+
+    /** The shared formatter, unchanged by this work but pinned beside its Swift twin. */
+    @Test fun clockFormatRollsOverAtAnHour() {
+        assertEquals("0:00", elapsedClock(0))
+        assertEquals("1:05", elapsedClock(65))
+        assertEquals("1:00:00", elapsedClock(3_600))
+        assertEquals("1:30:00", elapsedClock(5_400))
+        assertEquals("2:05:09", elapsedClock(2 * 3_600 + 5 * 60 + 9L))
+        assertEquals("0:00", elapsedClock(-5))
+    }
+}

From 35182be5efbcefb66fe9ef94e572621348a7442e Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 00:31:51 +1200
Subject: [PATCH 025/333] Bump build numbers for the next 10.6.1 staging build

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 21857254e3..2e3f35a041 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 373
+        versionCode = 374
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 012dd13a5a..0483640305 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "254"
+    CURRENT_PROJECT_VERSION: "255"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From cdf01f147dbced4c6d71b202e0740aa2df4aac0e Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 11:56:52 +1200
Subject: [PATCH 026/333] diag(hrv): census the two LIVE R-R transports, not
 just the historical one (#1693)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instrumentation for #1118, prompted by the report in #1689 — thanks @Meriquium, whose log
carries half the answer already.

THREE WRITERS PUT R-R ROWS IN ONE TABLE AND ONLY ONE OF THEM WAS CENSUSED.

  standard 0x2A37 notify   stamped at the ARRIVAL wall-clock second   no census
  puffin REALTIME_DATA     stamped from the strap's record clock      no census
  historical offload       stamped from the record's own second      rr emit path=historical

The standard path is unconditional by design — its own comment reads "Record it
continuously — independent of the realtime stream or which screen is open" — so on a strap
that also banks those beats, one beat can be stored at the second it ARRIVED and at the
second it was RECORDED. Different ts, so the (deviceId, ts) primary key cannot collapse
them. That is exactly the crossSecondOverCount verdict every affected night prints.

WHY THIS IS INSTRUMENTATION AND NOT A REPAIR. The #1689 log already reports the historical
transport's own number: ratioRep=0.99, against a stored night reading coverage=2.77.
RrEmissionStats' own doc names that case — "near 1.0 while the stored night still reads 1.7
means the duplication is in ingest". One transport measured clean is suggestive; three
measured clean while the union reads 2.77 is proof, and only one of the three reported. The
same log's cov40=1.97 is the other half of the shape: collapsing same-second near-duplicates
leaves almost exactly two full copies of the beat train.

So the same pure census now runs on both live paths before the rows are stored, emitting
`rr emit path=live-standard` and `path=live-realtime` beside the existing historical line.
Nothing reads any of it: no scoring change, no storage change, no schema change.

SMALLER THAN THE CHANGE PROPOSED. The plan was a nullable transport column plus a Room +
GRDB migration, because nothing in the stored data can attribute a row to its writer
(srcChannel is Oura-only; WHOOP rows log src=none). Still true — and not needed to ANSWER
the question. Comparing each transport's pre-storage ratioRep against the stored night's
coverage settles which side of the store the duplication is on, with no persisted tag. A
migration is the right tool for a repair that has to drop one transport's rows; it is the
wrong tool for finding out whether that is the repair.

THREE OF THE FOUR COMMITS CAME FROM RE-REVIEWS, AND TWO FOUND REAL DEFECTS IN JUST-WRITTEN
CODE:

  - The live lines passed `offered` as `inserted`, printing `offered=N inserted=N`, which
    reads as "the primary key absorbed nothing". Neither live path can say that — the
    census runs BEFORE the insert. The comment beside it said "reporting a guessed inserted
    would be the diagnostic asserting more than it observed" while the next line did exactly
    that. CLAUDE.md states the rule, and GpsSession already applies it with rawFixes = null
    rendering n/a, in a file read earlier in this same investigation. `inserted` is nullable
    now and renders n/a; both platforms' shape tests pin it.
  - The lifetime comment added by the pass before was BACKWARDS. WhoopBleClient is the
    process-wide singleton on NoopApplication and a device switch mutates deviceId rather
    than rebuilding it, so Android's stamps never reset. Swift's live on Collector, which
    bootstrapStore() rebuilds. The divergence is real and runs the other way; both ends now
    state their own lifetime and name the other's.

A BUG THE ORACLE FOUND IN THE HELPER ITSELF. The rate-limit documented "0 = never emitted,
so the first flush always reports". It did not: with lastEmit=0 the gap arithmetic returns
false for any nowSec under 900. It behaved correctly in production only because a real unix
timestamp is ~1.8e9 and clears the gap by accident of magnitude — the same accident that
would have made a test with small timestamps fail. The sentinel is explicit now and the test
table pins exactly those rows.

VERIFIED RATHER THAN ASSUMED, because the instrument depends on each of these:

  - The 4.0 drives BOTH live transports: onInbound routes HEART_RATE_CHAR (0x2A37) to
    parseStandardHr for every strap, and the reporter's log shows TOGGLE_REALTIME_HR
    payload=01. Had the standard path been generic-strap-only, live-standard would never
    have printed for the strap this was built for.
  - Both standard-HR parsers convert 1/1024 s to ms with round(raw / 1024.0 * 1000.0). An
    unconverted value would bias every live ratioRep to ~1.024 — a systematic error in the
    exact number the comparison turns on.
  - StreamPersistence.toBatch maps rr 1:1 with no filtering, so censusing batch.rr on Kotlin
    and streams.rr on Swift measures the same set.
  - Nothing else constructs a Collector, so the new optional log sink cannot break a caller.

Twin tests over one table, oracle-checked: the Swift helper compiled standalone reproduces
the Kotlin expectations row for row, including the clock-moved-backwards case (emit rather
than wedge the instrument shut). Parity matrix built from the code — helper, 900 s constant,
nullable inserted, both census sites, the rate-limit test and the n/a pin, each present once
per platform. Android 4604 tests 0 failures on a --rerun-tasks pass; doc_comment_lint OK;
i18n green. app-build green on every commit that touched Swift.

NOT VALIDATED ON A STRAP. These lines are emitted from the BLE path, so what they PRINT on
real hardware is unproven until someone posts a log — which is the point of shipping them.
The next WHOOP 4.0 log carrying all three lines settles the mechanism behind #1118.
---
 .../StrandAnalytics/RrEmissionStats.swift     | 37 +++++++++++++-
 .../RrEmissionStatsTests.swift                | 24 +++++++++
 Strand/BLE/BLEManager.swift                   |  3 +-
 Strand/Collect/Collector.swift                | 49 +++++++++++++++++++
 .../com/noop/analytics/RrEmissionStats.kt     | 36 +++++++++++++-
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 45 +++++++++++++++++
 .../com/noop/analytics/RrEmissionStatsTest.kt | 31 ++++++++++++
 7 files changed, 220 insertions(+), 5 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/RrEmissionStats.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/RrEmissionStats.swift
index 5456fe079c..0d3fef9edc 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/RrEmissionStats.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/RrEmissionStats.swift
@@ -127,6 +127,34 @@ public enum RrEmissionStats {
                       spanSec: span, ratio: ratio, perSecond: hist, gapHist: gapHist, fill: fill)
     }
 
+    /// 15 minutes: rare enough not to bury the log, frequent enough to sample a night several times.
+    public static let liveCensusMinGapSec: Int = 900
+
+    /// Should a LIVE census line be emitted now? (#1118 instrumentation.)
+    ///
+    /// The historical census is emitted once per offload SESSION, which is naturally rare. The two live
+    /// paths flush roughly every 30 readings, so emitting per flush would put a line on the strap log
+    /// every ~30 seconds all night — a volume that buries the very evidence it exists to provide. One
+    /// line per path per `minGapSec` is plenty: a single flush already spans enough seconds to make
+    /// `ratioRep` meaningful (the historical line settles it on 39 s), and what matters is comparing the
+    /// paths, not sampling either densely.
+    ///
+    /// `lastEmitSec` is 0 before the first line, so the first flush of a connection always reports.
+    /// A clock that moves BACKWARDS emits rather than suppresses: the alternative wedges the census shut
+    /// until wall time catches up, and a silent instrument is worse than a duplicated line.
+    ///
+    /// Byte-parity twin of Kotlin `RrEmissionStats.shouldEmitLiveCensus`.
+    public static func shouldEmitLiveCensus(lastEmitSec: Int, nowSec: Int,
+                                            minGapSec: Int = liveCensusMinGapSec) -> Bool {
+        // The "never emitted" sentinel is checked EXPLICITLY. Falling through to the gap arithmetic
+        // gets the right answer in production only because a real unix `nowSec` is ~1.8e9 and so
+        // trivially clears any gap — an accident of magnitude, not a rule. It also made the helper
+        // untestable with small timestamps, which is how this was caught.
+        if lastEmitSec <= 0 { return true }
+        if nowSec < lastEmitSec { return true }
+        return nowSec - lastEmitSec >= minGapSec
+    }
+
     /// One compact log line. `offered`/`inserted` come from the caller: `inserted` is what the store
     /// actually wrote after its `ON CONFLICT` key, so `offered - inserted` is how much the primary key
     /// already absorbs — the third number needed to tell emission from ingest.
@@ -140,11 +168,16 @@ public enum RrEmissionStats {
     /// gapless, and `ratioRep` is the one to trust when they disagree. (`ratioRep`'s denominator can
     /// double-count at most one second per chunk boundary when a session's counts are summed, which is
     /// negligible against thousands of seconds — and errs the same safe way, low.)
-    public static func logLine(path: String, offered: Int, inserted: Int, _ r: Result) -> String {
+    public static func logLine(path: String, offered: Int, inserted: Int?, _ r: Result) -> String {
+        // NIL renders "n/a", never a number. Only the historical path can see what the store's conflict
+        // key actually kept; the live paths census BEFORE the insert and have no such count. Echoing
+        // `offered` there would print `offered=N inserted=N`, which reads as "the primary key absorbed
+        // nothing" — a measurement neither path made. Same reason GpsSession passes rawFixes = nil.
+        let ins = inserted.map(String.init) ?? "n/a"
         let ratio = String(format: "%.2f", r.ratio)
         let rep = r.secondsWithRr > 0 ? Double(r.sumRrMs) / 1000.0 / Double(r.secondsWithRr) : 0
         let h = r.perSecond
-        return "rr emit path=\(path) offered=\(offered) inserted=\(inserted) secs=\(r.secondsWithRr) "
+        return "rr emit path=\(path) offered=\(offered) inserted=\(ins) secs=\(r.secondsWithRr) "
             + "sumRr=\(r.sumRrMs / 1000)s span=\(r.spanSec)s ratio=\(ratio) "
             + "ratioRep=\(String(format: "%.2f", rep)) "
             + "perSec[1/2/3/4+]=\(h[0])/\(h[1])/\(h[2])/\(h[3]) "
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RrEmissionStatsTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RrEmissionStatsTests.swift
index 18c4082566..a723262eb6 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RrEmissionStatsTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RrEmissionStatsTests.swift
@@ -112,6 +112,12 @@ final class RrEmissionStatsTests: XCTestCase {
         let line = RrEmissionStats.logLine(path: "historical", offered: 3, inserted: 2, r)
         XCTAssertTrue(line.hasPrefix("rr emit path=historical offered=3 inserted=2 secs=2 "), line)
         XCTAssertTrue(line.contains("perSec[1/2/3/4+]=1/1/0/0"), line)
+
+        // A LIVE path censuses before the insert and cannot know what the conflict key kept, so it
+        // passes nil and the line must say "n/a". Echoing `offered` there would read as "the primary
+        // key absorbed nothing" — a claim neither live path is in a position to make.
+        let live = RrEmissionStats.logLine(path: "live-standard", offered: 3, inserted: nil, r)
+        XCTAssertTrue(live.contains("offered=3 inserted=n/a "), live)
     }
 
     /// A GAP must not read as healthy emission. Two doubled seconds an hour apart carry a 2.0 emission
@@ -127,4 +133,22 @@ final class RrEmissionStatsTests: XCTestCase {
         let line = RrEmissionStats.logLine(path: "historical", offered: 4, inserted: 4, r)
         XCTAssertTrue(line.contains("ratio=0.00 ratioRep=1.60"), line)
     }
+
+    /// The LIVE census rate-limit. Twin of Kotlin `shouldEmitLiveCensusRateLimits` — same table, same
+    /// answers, oracle-checked against a standalone Swift build of the helper.
+    ///
+    /// The `lastEmit=0` rows are the ones that matter. The sentinel is checked explicitly, not left to
+    /// the gap arithmetic: with a real unix `nowSec` (~1.8e9) the subtraction clears any gap by accident
+    /// of magnitude, so the "first flush always reports" contract held in production while being false
+    /// for small timestamps — which is exactly what a unit test uses.
+    func testShouldEmitLiveCensus() {
+        XCTAssertTrue(RrEmissionStats.shouldEmitLiveCensus(lastEmitSec: 0, nowSec: 0))
+        XCTAssertTrue(RrEmissionStats.shouldEmitLiveCensus(lastEmitSec: 0, nowSec: 1))
+        XCTAssertTrue(RrEmissionStats.shouldEmitLiveCensus(lastEmitSec: 0, nowSec: 1_700_000_000))
+        XCTAssertFalse(RrEmissionStats.shouldEmitLiveCensus(lastEmitSec: 1_700_000_000, nowSec: 1_700_000_000))
+        XCTAssertFalse(RrEmissionStats.shouldEmitLiveCensus(lastEmitSec: 1_700_000_000, nowSec: 1_700_000_899))
+        XCTAssertTrue(RrEmissionStats.shouldEmitLiveCensus(lastEmitSec: 1_700_000_000, nowSec: 1_700_000_900))
+        XCTAssertTrue(RrEmissionStats.shouldEmitLiveCensus(lastEmitSec: 1_700_000_000, nowSec: 1_700_000_901))
+        XCTAssertTrue(RrEmissionStats.shouldEmitLiveCensus(lastEmitSec: 1_700_000_900, nowSec: 1_700_000_000))
+    }
 }
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index ed9b32c4e8..f409aab1b0 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -1286,7 +1286,8 @@ public final class BLEManager: NSObject, ObservableObject {
         // persists raw frames. Flip "enableRawCapture" in UserDefaults to capture raw again.
         let enableRawCapture = UserDefaults.standard.bool(forKey: "enableRawCapture")
         collector = Collector(store: store, deviceId: deviceId,
-                              enableRawCapture: enableRawCapture)
+                              enableRawCapture: enableRawCapture,
+                              log: { [weak self] line in self?.log(line) })
         // The store can finish bootstrapping AFTER connect(model:) already ran (both wait on
         // poweredOn), so apply the family/clock configuration here too — whichever runs last wins.
         configureCollectorFamily()
diff --git a/Strand/Collect/Collector.swift b/Strand/Collect/Collector.swift
index 87279bfa0a..ad92438137 100644
--- a/Strand/Collect/Collector.swift
+++ b/Strand/Collect/Collector.swift
@@ -1,6 +1,7 @@
 import Foundation
 import WhoopProtocol
 import WhoopStore
+import StrandAnalytics
 
 /// The subset of WhoopStore the Collector needs. A protocol so tests can inject a spy
 /// (WhoopStore is `final`). WhoopStore conforms via the extension below.
@@ -72,6 +73,24 @@ final class Collector {
     /// #47: buffer the (raw frame, pre-parsed) pair. The raw bytes are still needed for the raw-capture
     /// outbox; the parse is the one the BLE seam already did, so `flush` doesn't re-decode the batch.
     private var buffer: [(frame: [UInt8], parsed: ParsedFrame)] = []
+    /// #1118: strap-log sink for the per-transport R-R census. Optional and defaulted to nil so the
+    /// test fakes that construct a Collector are untouched; `BLEManager` wires its own `log`.
+    private let log: ((String) -> Void)?
+    /// #1118: last emit of each LIVE census line, unix seconds; 0 = never. Rate-limited — see
+    /// `RrEmissionStats.shouldEmitLiveCensus`.
+    ///
+    /// Lifetime DIVERGES from the Kotlin twin. These reset whenever `BLEManager.bootstrapStore()`
+    /// rebuilds the Collector (a store rebuild after unlock, among other paths), so a log can carry an
+    /// extra line after one of those. Android keeps its stamps on the process-wide `WhoopBleClient`
+    /// singleton, which a device switch mutates rather than rebuilds, so they never reset there.
+    /// Harmless either way — a rate-limit on a diagnostic, not a measurement — but a reader comparing
+    /// two logs should not have to work out why one has more lines than the other.
+    ///
+    /// @MainActor isolation makes these safe without a lock; the Kotlin fields are deliberately
+    /// unsynchronized instead, since a stale read there costs one duplicate line.
+    private var lastStdRrCensusSec: Int = 0
+    private var lastRealtimeRrCensusSec: Int = 0
+
     /// Standard 0x2A37 HR/RR buffer — the reliable, always-on stream, recorded continuously
     /// (independent of the custom realtime stream or which screen is open).
     private var stdHR: [HRSample] = []
@@ -82,10 +101,12 @@ final class Collector {
     init(store: StoreWriting, deviceId: String,
          policy: CollectorPolicy = .default,
          enableRawCapture: Bool = false,
+         log: ((String) -> Void)? = nil,
          now: @escaping () -> Int = { Int(Date().timeIntervalSince1970) },
          monotonic: @escaping () -> TimeInterval = { Date().timeIntervalSinceReferenceDate }) {
         self.store = store; self.deviceId = deviceId; self.policy = policy
         self.enableRawCapture = enableRawCapture
+        self.log = log
         self.now = now; self.monotonic = monotonic
         self.batchStartedAt = monotonic()
         self.concreteStore = store as? WhoopStore
@@ -176,6 +197,19 @@ final class Collector {
         let frames = batch.map(\.frame)         // still needed for the raw-capture outbox
         let parsed = batch.map(\.parsed)        // #47: the seam already decoded these — don't re-parse
         let streams = extractStreams(parsed, deviceClockRef: ref.device, wallClockRef: ref.wall)
+        // #1118: the SECOND live transport. `flushStandardHR` stamps a beat at the second it arrived over
+        // 0x2A37; this one stamps it from the strap's own record clock. The same beat reaching both lands
+        // on two different seconds, which no same-second de-dup can collapse — the signature every
+        // affected night prints as `crossSecondOverCount`.
+        if !streams.rr.isEmpty {
+            let nowSec = now()
+            if RrEmissionStats.shouldEmitLiveCensus(lastEmitSec: lastRealtimeRrCensusSec, nowSec: nowSec) {
+                lastRealtimeRrCensusSec = nowSec
+                let census = RrEmissionStats.compute(streams.rr.map { (ts: $0.ts, rrMs: $0.rrMs) })
+                log?(RrEmissionStats.logLine(path: "live-realtime", offered: streams.rr.count,
+                                             inserted: nil, census))
+            }
+        }
         do {
             try await store.insert(streams, deviceId: deviceId)   // DECODED FIRST (durable)
         } catch {
@@ -217,6 +251,21 @@ final class Collector {
         let hr = stdHR, rr = stdRR
         stdHR.removeAll(keepingCapacity: true)
         stdRR.removeAll(keepingCapacity: true)
+        // #1118: census this batch BEFORE it is stored, exactly as the historical path does, so a strap
+        // log carries one `ratioRep` per transport. If each transport reports ~1.0 while the stored night
+        // reads 2.77, the over-count is the UNION of the transports and no single decoder is at fault —
+        // which is the question this instrumentation exists to settle.
+        if !rr.isEmpty {
+            let nowSec = now()
+            if RrEmissionStats.shouldEmitLiveCensus(lastEmitSec: lastStdRrCensusSec, nowSec: nowSec) {
+                lastStdRrCensusSec = nowSec
+                let census = RrEmissionStats.compute(rr.map { (ts: $0.ts, rrMs: $0.rrMs) })
+                // `inserted` is NIL, not echoed from `offered`: the store's conflict key decides that and
+                // this census runs before the insert. The line renders `inserted=n/a`.
+                log?(RrEmissionStats.logLine(path: "live-standard", offered: rr.count,
+                                             inserted: nil, census))
+            }
+        }
         do {
             try await store.insert(Streams(hr: hr, rr: rr), deviceId: deviceId)
         } catch {
diff --git a/android/app/src/main/java/com/noop/analytics/RrEmissionStats.kt b/android/app/src/main/java/com/noop/analytics/RrEmissionStats.kt
index a8edd47542..2737eb339e 100644
--- a/android/app/src/main/java/com/noop/analytics/RrEmissionStats.kt
+++ b/android/app/src/main/java/com/noop/analytics/RrEmissionStats.kt
@@ -113,6 +113,33 @@ object RrEmissionStats {
         return Result(bySecond.size, rr.size, sum, span, ratio, hist, gapHist, fill)
     }
 
+    /**
+     * Should a LIVE census line be emitted now? (#1118 instrumentation.)
+     *
+     * The historical census is emitted once per offload SESSION, which is naturally rare. The two live
+     * paths flush roughly every 30 readings, so emitting per flush would put a line on the strap log
+     * every ~30 seconds all night — a volume that buries the very evidence it exists to provide. One
+     * line per path per [minGapSec] is plenty: a single flush already spans enough seconds to make
+     * `ratioRep` meaningful (the historical line settles it on 39 s), and what matters is comparing the
+     * paths, not sampling either densely.
+     *
+     * [lastEmitSec] is 0 before the first line, so the first flush of a connection always reports.
+     * A clock that moves BACKWARDS emits rather than suppresses: the alternative wedges the census
+     * shut until wall time catches up, and a silent instrument is worse than a duplicated line.
+     */
+    fun shouldEmitLiveCensus(lastEmitSec: Int, nowSec: Int, minGapSec: Int = LIVE_CENSUS_MIN_GAP_SEC): Boolean {
+        // The "never emitted" sentinel is checked EXPLICITLY. Falling through to the gap arithmetic
+        // gets the right answer in production only because a real unix `nowSec` is ~1.8e9 and so
+        // trivially clears any gap — an accident of magnitude, not a rule. It also made the helper
+        // untestable with small timestamps, which is how this was caught.
+        if (lastEmitSec <= 0) return true
+        if (nowSec < lastEmitSec) return true
+        return nowSec - lastEmitSec >= minGapSec
+    }
+
+    /** 15 minutes: rare enough not to bury the log, frequent enough to sample a night several times. */
+    const val LIVE_CENSUS_MIN_GAP_SEC: Int = 900
+
     /**
      * One compact log line. [offered]/[inserted] come from the caller: [inserted] is what the store
      * actually wrote after its conflict key, so `offered - inserted` is how much the primary key already
@@ -126,11 +153,16 @@ object RrEmissionStats {
      * rather than by the wall span, so it is immune to gaps; the two agreeing means the batch is gapless,
      * and `ratioRep` is the one to trust when they disagree.
      */
-    fun logLine(path: String, offered: Int, inserted: Int, r: Result): String {
+    fun logLine(path: String, offered: Int, inserted: Int?, r: Result): String {
         val ratio = String.format(java.util.Locale.US, "%.2f", r.ratio)
+        // NULL renders "n/a", never a number. Only the historical path can see what the store's conflict
+        // key actually kept; the live paths census BEFORE the insert and have no such count. Echoing
+        // `offered` there would print `offered=N inserted=N`, which reads as "the primary key absorbed
+        // nothing" — a measurement neither path made. Same reason GpsSession passes rawFixes = null.
+        val ins = inserted?.toString() ?: "n/a"
         val rep = if (r.secondsWithRr > 0) r.sumRrMs / 1000.0 / r.secondsWithRr else 0.0
         val h = r.perSecond
-        return "rr emit path=$path offered=$offered inserted=$inserted secs=${r.secondsWithRr} " +
+        return "rr emit path=$path offered=$offered inserted=$ins secs=${r.secondsWithRr} " +
             "sumRr=${r.sumRrMs / 1000}s span=${r.spanSec}s ratio=$ratio " +
             "ratioRep=${String.format(java.util.Locale.US, "%.2f", rep)} " +
             "perSec[1/2/3/4+]=${h[0]}/${h[1]}/${h[2]}/${h[3]} " +
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index ad4e8ba26f..72a4181710 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -7862,6 +7862,17 @@ class WhoopBleClient(
             .maxOrNull() ?: now
         val streams: Streams = extractStreams(parsed, deviceClockRef = newestRealtimeTs, wallClockRef = now)
         val batch = StreamPersistence.toBatch(streams)
+        // #1118: the SECOND live transport. The standard 0x2A37 path above stamps a beat at the second
+        // it arrived; this one stamps it from the strap's own record clock. The same beat reaching both
+        // lands on two different seconds, which no same-second de-dup can collapse — the signature every
+        // affected night prints as `crossSecondOverCount`.
+        if (batch.rr.isNotEmpty()) {
+            if (com.noop.analytics.RrEmissionStats.shouldEmitLiveCensus(lastRealtimeRrCensusSec, now)) {
+                lastRealtimeRrCensusSec = now
+                val census = com.noop.analytics.RrEmissionStats.compute(batch.rr.map { it.ts.toInt() to it.rrMs })
+                log(com.noop.analytics.RrEmissionStats.logLine("live-realtime", batch.rr.size, null, census))
+            }
+        }
         if (!batch.isEmpty) {
             try {
                 repository.insert(batch, deviceId)
@@ -7872,6 +7883,26 @@ class WhoopBleClient(
         }
     }
 
+    /** #1118: last emit of each LIVE R-R census line, unix seconds; 0 = never. See
+     *  [com.noop.analytics.RrEmissionStats.shouldEmitLiveCensus] for why these are rate-limited.
+     *
+     *  Deliberately UNSYNCHRONIZED, unlike the buffers they sit beside. The two flushes can run
+     *  concurrently on the io scope, but a 32-bit write is atomic on the JVM so the worst outcome of a
+     *  stale read is one duplicate diagnostic line — cheaper than taking `collectorLock` on a path whose
+     *  only job is to describe itself. (The Swift twin is @MainActor-isolated and gets the guarantee for
+     *  free; the asymmetry is intentional, not an oversight.)
+     *
+     *  Lifetime, which DIVERGES from the Swift twin and is worth knowing before reading a log:
+     *  `WhoopBleClient` is the process-wide lazy singleton on `NoopApplication`, and a device switch
+     *  mutates `deviceId` via [setActiveDeviceId] rather than rebuilding the client — so these never
+     *  reset for the life of the process, and the 15-minute cadence holds across reconnects. The Swift
+     *  side keeps them on `Collector`, which `BLEManager.bootstrapStore()` REBUILDS (a store rebuild
+     *  after unlock, among other paths), so an iOS log can carry an extra line after one of those.
+     *  Harmless either way — it is a rate-limit on a diagnostic, not a measurement — but a reader
+     *  comparing two logs should not have to work out why one has more lines than the other. */
+    private var lastStdRrCensusSec: Int = 0
+    private var lastRealtimeRrCensusSec: Int = 0
+
     /**
      * Buffer one standard 0x2A37 reading (carries a wall-clock ts directly, no clock ref needed).
      * Auto-flushes ~every 30 readings. Port of `Collector.ingestStandardHR`.
@@ -7893,6 +7924,20 @@ class WhoopBleClient(
             stdHr.clear(); stdRr.clear()
             h to r
         }
+        // #1118: census this batch BEFORE it is stored, exactly as the historical path does, so a
+        // strap log carries one `ratioRep` per transport. If each transport reports ~1.0 while the
+        // stored night reads 2.77, the over-count is the UNION of the transports and no single
+        // decoder is at fault — which is the question this instrumentation exists to settle.
+        if (rr.isNotEmpty()) {
+            val nowSec = (System.currentTimeMillis() / 1000L).toInt()
+            if (com.noop.analytics.RrEmissionStats.shouldEmitLiveCensus(lastStdRrCensusSec, nowSec)) {
+                lastStdRrCensusSec = nowSec
+                val census = com.noop.analytics.RrEmissionStats.compute(rr.map { it.ts.toInt() to it.rrMs })
+                // `inserted` is NULL, not echoed from `offered`: the store's conflict key decides that
+                // and this census runs before the insert. The line renders `inserted=n/a`.
+                log(com.noop.analytics.RrEmissionStats.logLine("live-standard", rr.size, null, census))
+            }
+        }
         try {
             repository.insert(StreamBatch(hr = hr, rr = rr), deviceId)
         } catch (t: Throwable) {
diff --git a/android/app/src/test/java/com/noop/analytics/RrEmissionStatsTest.kt b/android/app/src/test/java/com/noop/analytics/RrEmissionStatsTest.kt
index 6a29a8a365..3a87936362 100644
--- a/android/app/src/test/java/com/noop/analytics/RrEmissionStatsTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/RrEmissionStatsTest.kt
@@ -2,6 +2,7 @@ package com.noop.analytics
 
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertTrue
+import org.junit.Assert.assertFalse
 import org.junit.Test
 
 /**
@@ -122,6 +123,12 @@ class RrEmissionStatsTest {
         val line = RrEmissionStats.logLine("historical", 3, 2, r)
         assertTrue(line, line.startsWith("rr emit path=historical offered=3 inserted=2 secs=2 "))
         assertTrue(line, line.contains("perSec[1/2/3/4+]=1/1/0/0"))
+
+        // A LIVE path censuses before the insert and cannot know what the conflict key kept, so it
+        // passes null and the line must say "n/a". Echoing `offered` there would read as "the primary
+        // key absorbed nothing" — a claim neither live path is in a position to make.
+        val live = RrEmissionStats.logLine("live-standard", 3, null, r)
+        assertTrue(live, live.startsWith("rr emit path=live-standard offered=3 inserted=n/a secs=2 "))
     }
 
     /**
@@ -140,4 +147,28 @@ class RrEmissionStatsTest {
         val line = RrEmissionStats.logLine("historical", 4, 4, r)
         assertTrue(line, line.contains("ratio=0.00 ratioRep=1.60"))
     }
+
+    /**
+     * The LIVE census rate-limit. Twin of Swift `testShouldEmitLiveCensus` — same table, same answers,
+     * oracle-checked against a standalone Swift build of the helper.
+     *
+     * The `lastEmit=0` rows are the ones that matter. The sentinel is checked explicitly, not left to
+     * the gap arithmetic: with a real unix `nowSec` (~1.8e9) the subtraction clears any gap by accident
+     * of magnitude, so the "first flush always reports" contract held in production while being false
+     * for small timestamps — which is exactly what a unit test uses.
+     */
+    @Test fun shouldEmitLiveCensusRateLimits() {
+        // never emitted -> always report, whatever the clock reads
+        assertTrue(RrEmissionStats.shouldEmitLiveCensus(0, 0))
+        assertTrue(RrEmissionStats.shouldEmitLiveCensus(0, 1))
+        assertTrue(RrEmissionStats.shouldEmitLiveCensus(0, 1_700_000_000))
+        // inside the window -> stay quiet
+        assertFalse(RrEmissionStats.shouldEmitLiveCensus(1_700_000_000, 1_700_000_000))
+        assertFalse(RrEmissionStats.shouldEmitLiveCensus(1_700_000_000, 1_700_000_899))
+        // at and past the window -> report
+        assertTrue(RrEmissionStats.shouldEmitLiveCensus(1_700_000_000, 1_700_000_900))
+        assertTrue(RrEmissionStats.shouldEmitLiveCensus(1_700_000_000, 1_700_000_901))
+        // clock moved BACKWARDS -> report rather than wedge the instrument shut until time catches up
+        assertTrue(RrEmissionStats.shouldEmitLiveCensus(1_700_000_900, 1_700_000_000))
+    }
 }

From 14d83c7857eb10686879640b10fbe6ee416d68e9 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 12:51:55 +1200
Subject: [PATCH 027/333] docs: CLAUDE.md described swift-packages.yml as
 Packages-only; it also runs the Tools
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CI table said `swift-packages.yml` covers "`Packages/**` only". It has TWO jobs:
`test` over Packages, and `tools`, which runs swift build + swift test over
Tools/SleepBench, Tools/SleepPSG and Tools/Backfill, with the workflow's path filters
naming all three directories. That job has been there since #943, "Run the tool tests
that nothing was running".

This is not a harmless staleness. A first-time contributor read the row, believed
Tools/ had no CI, and wrote that into a README and into docs/ANALYTICS.md in #1630 —
along with a causal story built on it, that a harness bug "shipped green because nothing
under Tools/ runs". The truth is the more useful lesson and the opposite shape: SleepBench's
tests DO run in CI and DO pass, while the harness was comparing bare "wake" literals. It
was a test-coverage gap, not a CI gap.

A wrong row in this file does not stay in this file. It is the document contributors are
pointed at, so it propagates into their work and their reasoning, and the next person
inherits both.

Corrected to name both jobs and what each covers, including that Backfill has no test
target so its leg is build-only (the job guards on `testTarget` in Package.swift).

Cross-checked against .github/workflows/swift-packages.yml rather than from memory: job
names at lines 34 and 71, path filters at 15-17 and 23-25.
---
 CLAUDE.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 6028f53dfc..e8109a7737 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -115,7 +115,7 @@ xcodegen generate && xcodebuild -project Strand.xcodeproj -scheme Strand \
 ### What each CI job covers — and the gaps
 | Workflow | Covers | Runner | Default state |
 |---|---|---|---|
-| `swift-packages.yml` | `swift test` for **`Packages/**` only** (WhoopProtocol, WhoopStore, StrandAnalytics, StrandImport, StrandDesign, NoopLocalAccess) | macos-15 | **active** |
+| `swift-packages.yml` | TWO jobs. `test`: `swift test` over **`Packages/**`** (WhoopProtocol, WhoopStore, StrandAnalytics, StrandImport, StrandDesign, NoopLocalAccess). `tools`: `swift build` + `swift test` over **`Tools/SleepBench`, `Tools/SleepPSG`, `Tools/Backfill`** — Backfill has no test target, so it is build-only. Path-filtered to those directories. | macos-15 | **active** |
 | `app-build.yml` | Builds the **app targets** (`Strand` macOS + `NOOPiOS` iOS) **and runs `StrandTests`** on the macOS/`Strand` leg only — the iOS leg is compile-only. iOS leg needs **macos-26** (iOS 26 SDK / `glassEffect`). | macos-15 / macos-26 | **disabled** (on-demand) |
 | `android.yml` | `assembleFullDebug` + `testFullDebugUnitTest` | ubuntu | **active**, path-filtered to `android/**` |
 | `source-hygiene.yml` | Doc comments that bind to nothing (`Tools/doc_comment_lint.py`) | ubuntu | **active** |

From 72c76cabbca4a6c772bef8ec69f012dafa579f43 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 14:36:14 +1200
Subject: [PATCH 028/333] refactor(analyze): lift the per-day
 skin/SpO2/wrist-off reads out of analyzeRecentOnCpu (#1696)

analyzeRecentOnCpu had SEVENTEEN bytes of headroom: 61,518 against the 61,535-byte JaCoCo
budget its own guard pins. Not a margin, a wall - and one that announces itself at test time
rather than at review time, so the next person to touch that method for any reason hit it
with no hint it had been full since before they arrived.

  analyzeRecentOnCpu instrumented Code length   61,518 -> 54,087
  margin to the JVM's 65,535 method limit        4,017 -> 11,448

7,431 bytes freed by lifting the per-day skin-temp, SpO2 and off-wrist reads into a private
suspend helper.

IT IS A MOVE, AND THE DIFF PROVES IT. All 44 removed lines reappear verbatim in the
additions; the extra lines are only the signature, the holder, the doc and the call site
re-binding the same six names it used inline. Side-effect order is unchanged - the four
per-owner memo maps are passed by reference and mutated in the same sequence, so WHEN the
WHOOP 4.0 ADC anchor is learned and WHAT FROM are identical. The call sits inside the same
prep timing bracket, so the analyzeRecent cost split still attributes these reads exactly as
before.

WHY EXTRACT RATHER THAN RAISE THE BUDGET. The guard exists because JaCoCo instrumentation
already blew the JVM method limit once (bhelm/noop#102), and this file already answered the
question: persistFitnessVitalityAndSteps was extracted for exactly this reason, with a second
test pinning that it stays extracted and at its required call site. Raising a budget to fit a
change is how the method got to 17 bytes.

WHY THIS BLOCK. Best ratio of bytes freed to boundary crossed - six values out against eleven
in, all already local - and self-contained. The full 115-line read region was the blunt
alternative: sixteen values crossing instead of six, for a refactor whose only job is to make
room.

THE BUDGET IS NOW A RATCHET, 61,535 -> 56,000. Leaving it would have left 7,448 bytes to be
spent the same silent way, which is the mechanism this removes rather than merely resets.
The ~1.9 K margin is deliberate: enough for an ordinary change (the pass-1 sliding read
windows need about 825), small enough that a large regression fails at the test rather than
at the 64 KB wall. 56,000 rather than the 55,000 first floated, because 55,000 would have
left 88 bytes after the wiring and rebuilt the wall inside one PR. The comment states the
discipline: lower it whenever an extraction frees space, never raise it to fit a change.
persistFitnessVitalityAndSteps is left at 12,000 against 6,415 - slack, but not creeping, and
tightening a method nobody is pressing against would be tightening for its own sake.

MARKED DELIBERATELY ONE-SIDED. The Swift engine keeps this block inline, because the
constraint is a JVM one and Swift has neither the limit nor the guard. The doc says do not
mirror it, so a parity audit that finds a Kotlin helper with no Swift counterpart has found
the intended state rather than a gap.

REGRESSION SURFACE, CHECKED RATHER THAN ASSERTED. The three open PRs touching this file
(#1605, #1587, #1572) conflict identically against main and against this branch - 44, 4 and 8
files, with IntelligenceEngine.kt already among #1605's against main. This adds no conflict.
Nor can the ratchet block them: all three pass CI today, which is itself proof they add
nothing to analyzeRecentOnCpu, since any addition would already fail at 17 bytes. They go
from 17 bytes of room to 1,913.

Android 4604 tests 0 failures, the same count as main. doc_comment_lint OK, i18n green. No
Swift touched, so no app-build exposure.
---
 .../com/noop/analytics/IntelligenceEngine.kt  | 144 ++++++++++++------
 .../IntelligenceEngineJacocoBudgetTest.kt     |  15 +-
 2 files changed, 114 insertions(+), 45 deletions(-)

diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index 8c6e3e4682..7ec5f487a4 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -888,50 +888,16 @@ object IntelligenceEngine {
             val vendorResp = OuraRespScale.forVendorRate(respRows, owner)
             val grav = repo.gravitySamples(owner, from, to, STREAM_LIMIT)
             val steps = repo.stepSamples(owner, from, to, STREAM_LIMIT)
-            val skin = repo.skinTempSamples(owner, from, to, STREAM_LIMIT)
-            // #93: WHOOP 4.0 raw SpO2 PPG samples for the night; analyzeDay banks the nightly red/IR ADC
-            // means on the DailyMetric. Empty on a 5/MG (no v24 spo2 channels) → the raw means stay null.
-            val spo2 = repo.spo2Samples(owner, from, to, STREAM_LIMIT)
-            // #938: the strap family that WROTE this owner's skin-temp rows, so analyzeDay converts the raw
-            // register on the right scale (5/MG banks centidegrees, a WHOOP 4.0 v24 banks a raw ADC). The
-            // owner source resolves it from the registry; unknown/non-WHOOP owners fall back to WHOOP5 (the
-            // prior /100 behaviour), so only a device positively identified as a 4.0 changes scale.
-            // Resolved once per DISTINCT owner via [skinFamilyByOwner] (#970 read efficiency, see above).
-            val skinFamily = skinFamilyByOwner.getOrPut(owner) {
-                ownerSource?.skinTempFamily(owner) ?: DeviceFamily.WHOOP5
-            }
-            // #1467: the worn-gate timestamp tolerance for this owner (0 for WHOOP, byte-identical).
-            val skinWornToleranceSec = skinWornToleranceByOwner.getOrPut(owner) {
-                ownerSource?.skinTempWornToleranceSec(owner) ?: 0
-            }
-            // #938 (second capture): learn THIS device's worn skin-temp anchor raw ONCE, WINDOW-WIDE (the
-            // whole scan window's skin samples), not per-night. The @72 skin-temp ADC's register offset is
-            // per-device — a second real 4.0 strap shares the no-contact floor (~509) + 11-bit saturation
-            // (2047) but a worn band ~1100–1600 (nightly mean raw ~1290), which the global 826 anchor maps to
-            // 47–72 °C, so 100% of its worn samples fail the 28–42 °C gate (kept=0, no baseline, no signal).
-            // WINDOW-WIDE, not per-night: a per-night re-centre would subtract each night's own mean and ERASE
-            // the cross-night deviation the skinTempDevC signal exists to carry. Deterministic per run; SAFE
-            // because the skin baseline is re-folded from the SAME window's nightly means every run, so this
-            // constant offset cancels in the deviation. null for a non-4.0 owner (WHOOP5 ignores the anchor)
-            // or when <100 in-band samples exist → the conversion falls back to the global anchor (byte-
-            // identical to today). Computed here once per owner alongside the family resolution.
-            val skinAnchorRaw = if (skinFamily == DeviceFamily.WHOOP4) {
-                if (!skinAnchorResolvedOwners.contains(owner)) {
-                    val windowSkin = repo.skinTempSamples(owner, skinAnchorScanFrom, skinAnchorScanTo, STREAM_LIMIT)
-                    Whoop4SkinTemp.deviceAnchorRaw(windowSkin.map { it.raw })?.let { skinAnchorByOwner[owner] = it }
-                    skinAnchorResolvedOwners.add(owner)
-                }
-                skinAnchorByOwner[owner]
-            } else {
-                null
-            }
-            // Wrist-wear events in the night window, paired into off-wrist [start, end) intervals for the
-            // off-wrist sleep backstop (#500). The HR-gap proxy in the stager is the always-on guard;
-            // these explicit intervals sharpen it under the FRACTIONAL rule (#504) , a session is dropped
-            // only when its off-wrist coverage reaches maxOffWristSleepFraction, so a real night with a
-            // short off-wrist tail survives. Pairing needs WRIST_ON too (to bound each interval); a span
-            // still open at the window end closes at `to`. Empty when the strap emitted no wrist events.
-            val wristOff = AnalyticsEngine.offWristIntervals(repo.events(owner, from, to, STREAM_LIMIT), to)
+            val skinReads = readDaySkinAndWristOff(
+                repo, owner, from, to, ownerSource, skinFamilyByOwner, skinWornToleranceByOwner,
+                skinAnchorByOwner, skinAnchorResolvedOwners, skinAnchorScanFrom, skinAnchorScanTo,
+            )
+            val skin = skinReads.skin
+            val spo2 = skinReads.spo2
+            val skinFamily = skinReads.skinFamily
+            val skinWornToleranceSec = skinReads.skinWornToleranceSec
+            val skinAnchorRaw = skinReads.skinAnchorRaw
+            val wristOff = skinReads.wristOff
 
             // Calendar-day window for the ADDITIVE daily totals (steps + calories). The night window
             // above is anchored to the current time-of-day and ends at dayStart+12h, so for a PAST
@@ -2671,6 +2637,96 @@ object IntelligenceEngine {
         return if (dayStart < nowLocalMidnight) nextMidnight else minOf(nextMidnight, now)
     }
 
+    /**
+     * The per-day skin-temp, SpO2 and off-wrist reads, lifted out of `analyzeRecentOnCpu` (#1538).
+     *
+     * Nothing about this block changed; it moved. The method it came from sits 17 bytes under the JaCoCo
+     * budget its own guard pins, so it could not accept another line — and the established remedy in this
+     * file is to extract, not to raise the budget (see `persistFitnessVitalityAndSteps`, extracted for the
+     * same reason and pinned in place by its own test).
+     *
+     * The per-owner memo maps are passed in and MUTATED here, exactly as they were inline: the WHOOP 4.0
+     * ADC anchor is a property of the device rather than the night, so it is learned once per owner across
+     * the whole scan window and reused for every night. Moving that behind a function does not change when
+     * it is learned or what it is learned from.
+     *
+     * DELIBERATELY ONE-SIDED — do not mirror it. The Swift engine keeps this block inline, because the
+     * constraint that forced the extraction is a JVM one: a method's bytecode must fit 64 KB, and JaCoCo's
+     * instrumentation of it must too. Swift has no equivalent limit and no equivalent guard, so a twin
+     * helper there would buy nothing and cost a reader the question of what it was for. A parity audit
+     * that finds this with no Swift counterpart has found the intended state, not a gap.
+     */
+    private suspend fun readDaySkinAndWristOff(
+        repo: com.noop.data.WhoopRepository,
+        owner: String,
+        from: Long,
+        to: Long,
+        ownerSource: DayOwnerSource?,
+        skinFamilyByOwner: HashMap<String, DeviceFamily>,
+        skinWornToleranceByOwner: HashMap<String, Long>,
+        skinAnchorByOwner: HashMap<String, Double>,
+        skinAnchorResolvedOwners: HashSet<String>,
+        skinAnchorScanFrom: Long,
+        skinAnchorScanTo: Long,
+    ): DaySkinReads {
+        val skin = repo.skinTempSamples(owner, from, to, STREAM_LIMIT)
+        // #93: WHOOP 4.0 raw SpO2 PPG samples for the night; analyzeDay banks the nightly red/IR ADC
+        // means on the DailyMetric. Empty on a 5/MG (no v24 spo2 channels) → the raw means stay null.
+        val spo2 = repo.spo2Samples(owner, from, to, STREAM_LIMIT)
+        // #938: the strap family that WROTE this owner's skin-temp rows, so analyzeDay converts the raw
+        // register on the right scale (5/MG banks centidegrees, a WHOOP 4.0 v24 banks a raw ADC). The
+        // owner source resolves it from the registry; unknown/non-WHOOP owners fall back to WHOOP5 (the
+        // prior /100 behaviour), so only a device positively identified as a 4.0 changes scale.
+        // Resolved once per DISTINCT owner via [skinFamilyByOwner] (#970 read efficiency, see above).
+        val skinFamily = skinFamilyByOwner.getOrPut(owner) {
+            ownerSource?.skinTempFamily(owner) ?: DeviceFamily.WHOOP5
+        }
+        // #1467: the worn-gate timestamp tolerance for this owner (0 for WHOOP, byte-identical).
+        val skinWornToleranceSec = skinWornToleranceByOwner.getOrPut(owner) {
+            ownerSource?.skinTempWornToleranceSec(owner) ?: 0
+        }
+        // #938 (second capture): learn THIS device's worn skin-temp anchor raw ONCE, WINDOW-WIDE (the
+        // whole scan window's skin samples), not per-night. The @72 skin-temp ADC's register offset is
+        // per-device — a second real 4.0 strap shares the no-contact floor (~509) + 11-bit saturation
+        // (2047) but a worn band ~1100–1600 (nightly mean raw ~1290), which the global 826 anchor maps to
+        // 47–72 °C, so 100% of its worn samples fail the 28–42 °C gate (kept=0, no baseline, no signal).
+        // WINDOW-WIDE, not per-night: a per-night re-centre would subtract each night's own mean and ERASE
+        // the cross-night deviation the skinTempDevC signal exists to carry. Deterministic per run; SAFE
+        // because the skin baseline is re-folded from the SAME window's nightly means every run, so this
+        // constant offset cancels in the deviation. null for a non-4.0 owner (WHOOP5 ignores the anchor)
+        // or when <100 in-band samples exist → the conversion falls back to the global anchor (byte-
+        // identical to today). Computed here once per owner alongside the family resolution.
+        val skinAnchorRaw = if (skinFamily == DeviceFamily.WHOOP4) {
+            if (!skinAnchorResolvedOwners.contains(owner)) {
+                val windowSkin = repo.skinTempSamples(owner, skinAnchorScanFrom, skinAnchorScanTo, STREAM_LIMIT)
+                Whoop4SkinTemp.deviceAnchorRaw(windowSkin.map { it.raw })?.let { skinAnchorByOwner[owner] = it }
+                skinAnchorResolvedOwners.add(owner)
+            }
+            skinAnchorByOwner[owner]
+        } else {
+            null
+        }
+        // Wrist-wear events in the night window, paired into off-wrist [start, end) intervals for the
+        // off-wrist sleep backstop (#500). The HR-gap proxy in the stager is the always-on guard;
+        // these explicit intervals sharpen it under the FRACTIONAL rule (#504) , a session is dropped
+        // only when its off-wrist coverage reaches maxOffWristSleepFraction, so a real night with a
+        // short off-wrist tail survives. Pairing needs WRIST_ON too (to bound each interval); a span
+        // still open at the window end closes at `to`. Empty when the strap emitted no wrist events.
+        val wristOff = AnalyticsEngine.offWristIntervals(repo.events(owner, from, to, STREAM_LIMIT), to)
+        return DaySkinReads(skin, spo2, skinFamily, skinWornToleranceSec, skinAnchorRaw, wristOff)
+    }
+
+    /** What [readDaySkinAndWristOff] hands back. A holder rather than loose returns so the call site
+     *  re-binds the same names it used inline and the rest of the loop is untouched. */
+    private data class DaySkinReads(
+        val skin: List<com.noop.data.SkinTempSample>,
+        val spo2: List<com.noop.data.Spo2Sample>,
+        val skinFamily: DeviceFamily,
+        val skinWornToleranceSec: Long,
+        val skinAnchorRaw: Double?,
+        val wristOff: List<Pair<Long, Long>>,
+    )
+
     /**
      * The per-day diagnostic source token from the imported day-key sets. A WHOOP export covering [day]
      * WINS the dashboard merge over our computed row (imports win field-by-field , mergeDaily), so it
diff --git a/android/app/src/test/java/com/noop/analytics/IntelligenceEngineJacocoBudgetTest.kt b/android/app/src/test/java/com/noop/analytics/IntelligenceEngineJacocoBudgetTest.kt
index 6760cde826..a7e9502570 100644
--- a/android/app/src/test/java/com/noop/analytics/IntelligenceEngineJacocoBudgetTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/IntelligenceEngineJacocoBudgetTest.kt
@@ -34,7 +34,20 @@ class IntelligenceEngineJacocoBudgetTest {
         )
         val lengths = methodCodeLengths(instrumented)
 
-        assertExactMethodBudget(lengths, "analyzeRecentOnCpu", 61_535)
+        // RATCHET, not a ceiling. Lower this whenever an extraction frees space; never raise it to fit a
+        // change. It was 61,535 while the method measured 61,518 — SEVENTEEN bytes — so the guard had
+        // stopped guarding and simply blocked everything, at test time, with no hint that the method had
+        // been full since before whoever hit it arrived. Lifting the skin/SpO2/wrist-off reads out brought
+        // it to 54,087, and this number banks that rather than leaving 7,400 bytes to be spent silently
+        // the same way.
+        //
+        // The margin is deliberate and roughly 1.9 K: enough for an ordinary change (the pass-1 sliding
+        // read windows need about 825), small enough that a large regression fails here rather than at the
+        // JVM's 64 KB wall. If a change genuinely needs more, extract — this file already shows the shape
+        // twice over.
+        assertExactMethodBudget(lengths, "analyzeRecentOnCpu", 56_000)
+        // Untouched: 6,415 against 12,000. Slack, but it has not been creeping, and ratcheting a method
+        // nobody is pressing against would be tightening for its own sake.
         assertExactMethodBudget(lengths, "persistFitnessVitalityAndSteps", 12_000)
     }
 

From b89e5afb8fae124125754cca1837747886e3e427 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 15:30:58 +1200
Subject: [PATCH 029/333] perf(analyze): read each pass-1 row once instead of
 2.25x (#1695)

The pass-1 loop read each row about 2.25 times per pass. It now reads each row once.

WHY, AND WHY THIS RATHER THAN SOMETHING ELSE. The prep/score split exists to decide exactly
this, and says so at the emit site: "Reads dominating means the 54-hour window on a 24-hour
stride (each row materialised ~2.25x per pass) is worth narrowing; analyzeDay dominating
means it is not, whatever the row counts look like."

A field log answered it:

  analyzeRecent dayCache reused=0/21 size=21 days=21
  analyzeRecent cost prep=48129ms score=31516ms

1.53:1 against scoring on a cold pass. That single pass was 79.6s and 84% of all
analyzeRecent time across 22 hours and 11 passes; the ten warm passes totalled 15.3s, of
which 14.7s was prep. Optimising the scoring half would have aimed at the wrong 3%.

THE SHAPE. Pass 1 walks BACKWARDS, reading dayStart-30h to the next local midnight, so
consecutive windows overlap by 30 hours. A backward sliding buffer prepends only the missing
stride each day and drops the tail it will never be asked for again. Peak footprint is one
window, which a single day already held.

IT REFUSES RATHER THAN GUESSES. This is the scoring path, so every case the planner cannot
prove safe returns FullRead - byte-for-byte the behaviour that shipped before it existed:

  - a read that hit STREAM_LIMIT cannot be sliced. The queries are ORDER BY ts ASC LIMIT, so
    truncation drops the NEWEST rows and the buffer would be missing its tail with nothing to
    show for it. daySliceFromNight already declines for this reason.
  - the day's resolved owner changed (multi-strap).
  - a gap, left by a dayCache HIT continuing before the reads.
  - today, whose `to` is clamped to now rather than a clean stride.
  - a FAILED read, which is the one that would have corrupted scores. See below.

THE DEFECT THE PARITY PASS FOUND. The engines differ in how a store read fails: Kotlin lets
it throw, Swift wraps reads in `try?` and gets an empty array. Harmless with per-day reads -
that day got nothing, the next read for itself. NOT harmless with a buffer: the empty result
was cached as a true statement about the window, so the next day found its tail "covered",
spliced against rows nobody fetched, and came back missing everything the buffer claimed to
hold. No exception, no log line, days scored on inputs that had quietly lost hours.

An empty SUCCESSFUL read is a statement - there are no rows in that span. An empty FAILED
read is not a statement at all. The reader now returns null/nil on failure and the window
clears itself, so the next day goes back to the store.

FOUR OF THE COMMITS CAME FROM RE-REVIEWING MY OWN WORK, including two claims of mine that
were wrong: "costs no memory" was false on the only path that runs on a cold pass - the
splice allocated three windows to return one - and a doc claimed a Swift twin for the log
line that did not exist, which is now real, shared, and tested on both sides.

VERIFICATION. Twin tests over one table, oracle-checked: the Swift halves compiled standalone
reproduce the Kotlin expectations row for row, including the load-bearing one - after day 0
every day extends by EXACTLY one 86,400s stride - and the byte-for-byte equality of every
window against a direct read, computed from an independent expectation so a wrong splice
cannot agree with its own test.

  backwardWalk: rowsRead=518401 expected=518401 served=432004 -> each row once
  ownerFlip / truncated / gap / failedRead: all match direct reads

Android 4613 tests 0 failures. app-build green on the commit carrying the engine wiring
(Build Strand and Build NOOPiOS both success); everything after it is package-only and
covered by default CI. doc_comment_lint OK, i18n green.

NOT VALIDATED ON REAL DATA. The tests prove the buffer returns byte-identical rows against a
FAKE store. The guarantee it leans on - that the store returns ts ASC - was read out of the
DAO and Reads.swift rather than exercised over a real 1.26 GB one. The honest proof is a
field log showing the new line beside a prep that has actually dropped:

  analyzeRecent windows hr[read=N served=N] rr[read=N served=N]

A pass where served is ~0 means the windows are declining and the reads are back to what they
were. That is why the counters ship rather than just the speedup.
---
 .../StrandAnalytics/SlidingStreamWindow.swift | 119 ++++++++++++++++
 .../StrandAnalytics/WindowedStreamPlan.swift  |  80 +++++++++++
 .../SlidingStreamWindowTests.swift            |  97 +++++++++++++
 .../WindowedStreamPlanTests.swift             |  86 ++++++++++++
 Strand/Data/IntelligenceEngine.swift          |  30 +++-
 .../com/noop/analytics/IntelligenceEngine.kt  |  29 +++-
 .../com/noop/analytics/SlidingStreamWindow.kt | 129 ++++++++++++++++++
 .../com/noop/analytics/WindowedStreamPlan.kt  |  86 ++++++++++++
 .../noop/analytics/SlidingStreamWindowTest.kt | 115 ++++++++++++++++
 .../noop/analytics/WindowedStreamPlanTest.kt  |  92 +++++++++++++
 10 files changed, 859 insertions(+), 4 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Sources/StrandAnalytics/SlidingStreamWindow.swift
 create mode 100644 Packages/StrandAnalytics/Sources/StrandAnalytics/WindowedStreamPlan.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SlidingStreamWindowTests.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/WindowedStreamPlanTests.swift
 create mode 100644 android/app/src/main/java/com/noop/analytics/SlidingStreamWindow.kt
 create mode 100644 android/app/src/main/java/com/noop/analytics/WindowedStreamPlan.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/SlidingStreamWindowTest.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/WindowedStreamPlanTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SlidingStreamWindow.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SlidingStreamWindow.swift
new file mode 100644
index 0000000000..205b88bdaa
--- /dev/null
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SlidingStreamWindow.swift
@@ -0,0 +1,119 @@
+import Foundation
+
+/// One stream's backward sliding read buffer for `analyzeRecent`'s pass-1 loop (#1538).
+///
+/// `WindowedStreamPlan` decides WHETHER a day's window can reuse what the previous day read; this holds
+/// the rows and does the splice. Kept out of the engine because the splice is the part that can silently
+/// be wrong — a row dropped here is a scoring input that vanishes — so it gets its own tests rather than
+/// living inline in a very long loop. Twin of Kotlin `SlidingStreamWindow`.
+///
+/// The buffer always ends up covering EXACTLY the window just served, never more: the walk runs backwards
+/// so the tail above `to` is never asked for again, and holding it would grow the footprint across the
+/// pass instead of keeping it at one window. Rows are stored in the store's own `ts ASC` order and an
+/// extension is always strictly BELOW the buffer, so prepending preserves that order without a sort.
+public final class SlidingStreamWindow<T> {
+
+    private let tsOf: (T) -> Int
+    private let limit: Int
+    /// The store call for `(owner, from, to)`. Bound at CONSTRUCTION to match the Kotlin twin, where the
+    /// two call sites sit inside a method already at its JVM bytecode budget and a per-call lambda put it
+    /// over. It must return `ts ASC` and honour the same `limit`.
+    ///
+    /// `nil` means the read FAILED, which is not the same as returning no rows and must never be cached as
+    /// if it were. An empty successful read is a true statement about a range — the buffer can serve it,
+    /// and the next day may splice against it. An empty FAILED read is no statement at all, and caching it
+    /// would let the following day splice against rows nobody ever fetched, silently dropping the part of
+    /// its window the buffer claimed to hold. This side is the one that needs it: the engine wraps its
+    /// store reads in `try?`, so a failure arrives here as an empty array unless the caller says otherwise.
+    private let read: (String, Int, Int) async -> [T]?
+
+    private var owner: String?
+    private var from = 0
+    private var to = 0
+    private var truncated = false
+    private var rows: [T] = []
+
+    /// Rows this window served from the buffer rather than reading. Diagnostic only.
+    ///
+    /// `Int` here, `Long` on the Kotlin twin, and that is deliberate rather than drift: each side follows
+    /// its own platform's convention for a count, and the value cannot reach either limit — a pass is
+    /// bounded by `maxDays` windows of at most `limit` rows, so about 4 M on a 21-day pass, which fits
+    /// even the 32-bit `Int` of `arm64_32` that this package also builds for. Stated because a width left
+    /// to be inferred is how the 32-bit `pct` over-count got in (#1685).
+    public private(set) var rowsServed = 0
+    /// Rows this window read from the store. Diagnostic only. Same width note as `rowsServed`.
+    public private(set) var rowsRead = 0
+
+    public init(tsOf: @escaping (T) -> Int, limit: Int, read: @escaping (String, Int, Int) async -> [T]?) {
+        self.tsOf = tsOf
+        self.limit = limit
+        self.read = read
+    }
+
+    /// The rows for `[from, to]` under `owner`, reading as little as the plan allows.
+    ///
+    /// The result is byte-for-byte what a direct `read(owner, from, to)` would have returned — that is the
+    /// whole contract, and the reason every case the planner cannot prove falls back to exactly that call.
+    public func rows(owner: String, from: Int, to: Int) async -> [T] {
+        let plan = WindowedStreamPlan.plan(cachedOwner: self.owner, cachedFrom: self.from,
+                                           cachedTo: self.to, cachedTruncated: truncated,
+                                           owner: owner, from: from, to: to)
+        let result: [T]
+        let nowTruncated: Bool
+        switch plan {
+        case .serve:
+            result = rows.filter { tsOf($0) >= from && tsOf($0) <= to }
+            nowTruncated = false
+            rowsServed += result.count
+        case let .extend(readFrom, readTo):
+            guard let head = await read(owner, readFrom, readTo) else { return failedRead() }
+            rowsRead += head.count
+            if head.count >= limit {
+                // A truncated EXTENSION is worse than a truncated buffer: it would leave a hole in the
+                // middle rather than at the end. Discard and read the window whole.
+                guard let full = await read(owner, from, to) else { return failedRead() }
+                rowsRead += full.count
+                result = full
+                nowTruncated = full.count >= limit
+            } else {
+                // Filtered into ONE array rather than `(head + rows).filter { }`: that form allocates
+                // the concatenation AND the filtered copy, so the splice transiently held roughly three
+                // windows' worth of references. Same result, one allocation.
+                var out: [T] = []
+                out.reserveCapacity(head.count + rows.count)
+                for r in head where tsOf(r) >= from && tsOf(r) <= to { out.append(r) }
+                for r in rows where tsOf(r) >= from && tsOf(r) <= to { out.append(r) }
+                result = out
+                nowTruncated = false
+                rowsServed += max(0, result.count - head.count)
+            }
+        case .fullRead:
+            guard let full = await read(owner, from, to) else { return failedRead() }
+            rowsRead += full.count
+            result = full
+            nowTruncated = full.count >= limit
+        }
+        self.owner = owner
+        self.from = from
+        self.to = to
+        self.truncated = nowTruncated
+        self.rows = result
+        return result
+    }
+
+    /// A failed read leaves NO buffer: the next day must go back to the store rather than splice against a
+    /// window nobody successfully filled. Returns empty, which is what the caller saw for a failed read
+    /// before this class existed.
+    private func failedRead() -> [T] {
+        owner = nil
+        // The range is cleared too, not just the owner. Leaving it stale would work only because
+        // `WindowedStreamPlan.plan` happens to test the owner BEFORE the bounds — a cross-file assumption
+        // that holds today and would break silently if those checks were ever reordered. Cheaper to be
+        // self-consistent than to depend on the order of someone else's guards.
+        from = 0
+        to = 0
+        rows = []
+        truncated = false
+        return []
+    }
+}
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/WindowedStreamPlan.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/WindowedStreamPlan.swift
new file mode 100644
index 0000000000..91ccc39936
--- /dev/null
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/WindowedStreamPlan.swift
@@ -0,0 +1,80 @@
+import Foundation
+
+/// How to satisfy one day's windowed stream read given what the previous day already read (#1538).
+///
+/// `analyzeRecent`'s pass-1 loop walks BACKWARDS — `dayStart = nowLocalMidnight - offset * 24h` — and reads
+/// a 54-hour window around each night (`dayStart - 30h` .. next local midnight). On a 24-hour stride that
+/// makes consecutive windows overlap by 30 hours, so every row is materialised about 2.25 times per pass.
+/// The `analyzeRecent cost prep=…ms score=…ms` line exists to decide whether that is worth narrowing, and a
+/// field log answered it: prep 48129ms against score 31516ms on a cold 21-day pass, so the reads are the
+/// larger half and the overlap is worth removing.
+///
+/// This is the DECISION half, kept pure so both platforms can be pinned against one oracle. Splicing the
+/// rows is mechanical and stays with the caller. Twin of Kotlin `WindowedStreamPlan`.
+///
+/// The planner REFUSES rather than guesses. Every case it cannot prove safe returns `.fullRead`, which is
+/// byte-for-byte the behaviour that shipped before this existed — the same stance `daySliceFromNight` takes
+/// when it declines. An optimisation on the scoring path may only ever skip work, never change a number.
+public enum WindowedStreamPlan {
+
+    /// What the sliding windows saved, for the line emitted beside `analyzeRecent`'s `prep`/`score`
+    /// split — the measurement the decision to build them was made from.
+    ///
+    /// `read` is rows fetched from the store, `served` rows a buffer supplied instead. A pass where
+    /// `served` is ~0 means the windows are declining — truncation, an owner flip, or a gap left by a
+    /// dayCache hit — and the reads are back to exactly what they were. That is the honest outcome rather
+    /// than a silent one, which is why the counters ship rather than just the speedup.
+    ///
+    /// Lives HERE rather than on the engine so both platforms put it in the same place and both are
+    /// covered by default CI — the Swift engine is app-target and has none. Byte-identical to the Kotlin
+    /// `WindowedStreamPlan.logLine`.
+    public static func logLine(hrRead: Int, hrServed: Int, rrRead: Int, rrServed: Int) -> String {
+        "analyzeRecent windows hr[read=\(hrRead) served=\(hrServed)] rr[read=\(rrRead) served=\(rrServed)]"
+    }
+
+    /// What the caller should do to obtain rows for the requested window.
+    public enum Plan: Equatable {
+        /// Read the whole window from the store; nothing usable is buffered.
+        case fullRead
+        /// The buffer already covers the window; slice it, read nothing.
+        case serve
+        /// Read only `[readFrom, readTo]` (inclusive, both ends) and prepend it to the buffer. `readTo` is
+        /// one second BELOW the buffer's current start, so the boundary row is never read twice — the
+        /// store's range predicate is inclusive at both ends.
+        case extend(readFrom: Int, readTo: Int)
+    }
+
+    /// Plan the read for `[from, to]` against a buffer holding `[cachedFrom, cachedTo]` for `cachedOwner`.
+    ///
+    /// `cachedOwner` nil means nothing is buffered. `cachedTruncated` means the buffered read hit the
+    /// store's row limit, so its contents do not represent its range — that buffer can never be sliced, for
+    /// the reason `daySliceFromNight` gives.
+    ///
+    /// After the caller acts on the plan the buffer covers exactly `[from, to]`: rows above `to` are
+    /// dropped, which is what keeps the peak footprint at one window rather than the whole pass. A backward
+    /// walk never asks for them again.
+    public static func plan(cachedOwner: String?,
+                            cachedFrom: Int,
+                            cachedTo: Int,
+                            cachedTruncated: Bool,
+                            owner: String,
+                            from: Int,
+                            to: Int) -> Plan {
+        // Nothing buffered, a different strap owns this day, or the buffered read was cut off at the row
+        // limit — none of these can be sliced, and a wrong slice is a wrong score.
+        guard let cachedOwner, cachedOwner == owner, !cachedTruncated else { return .fullRead }
+        // A degenerate or inverted buffer holds nothing meaningful.
+        if cachedFrom > cachedTo { return .fullRead }
+        // An inverted request is not this planner's business to repair.
+        if from > to { return .fullRead }
+        // The buffer covers the request outright.
+        if from >= cachedFrom && to <= cachedTo { return .serve }
+        // The ONLY extension this walk produces: the window moved earlier, and its tail is still inside
+        // what is buffered. Anything else (a window that moved forward, or one disjoint from the buffer)
+        // is not the backward stride this exists for, so it reads in full rather than being reasoned about.
+        if from < cachedFrom && to >= cachedFrom && to <= cachedTo {
+            return .extend(readFrom: from, readTo: cachedFrom - 1)
+        }
+        return .fullRead
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SlidingStreamWindowTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SlidingStreamWindowTests.swift
new file mode 100644
index 0000000000..9de35b0a43
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SlidingStreamWindowTests.swift
@@ -0,0 +1,97 @@
+import XCTest
+@testable import StrandAnalytics
+
+/// Pins the sliding read buffer against the only contract that matters: for every window, it returns
+/// EXACTLY what a direct store read would have returned. Twin of Kotlin `SlidingStreamWindowTest`.
+///
+/// The test store is a plain sorted array, so "what a direct read would have returned" is computable
+/// independently rather than asserted from the implementation's own behaviour — otherwise the test would
+/// agree with a wrong splice.
+final class SlidingStreamWindowTests: XCTestCase {
+
+    private let day = 86_400
+    private let h30 = 108_000
+    private let midnight = 1_787_875_200
+
+    private lazy var store: [Int] = Array(stride(from: midnight - 5 * day, through: midnight + day, by: 1))
+
+    private func direct(_ from: Int, _ to: Int, limit: Int = 1_000_000) -> [Int] {
+        Array(store.filter { $0 >= from && $0 <= to }.prefix(limit))
+    }
+
+    private func window(limit: Int = 1_000_000) -> SlidingStreamWindow<Int> {
+        SlidingStreamWindow<Int>(tsOf: { $0 }, limit: limit) { [self] _, f, t in direct(f, t, limit: limit) }
+    }
+
+    /// Day 0 reads its whole 54 h window; each later day reads exactly one 24 h stride. Without the buffer
+    /// this walk reads 5 x 54 h; the union of all five windows is what it reads instead.
+    func testBackwardWalkMatchesDirectReadsAndReadsEachRowOnce() async {
+        let w = window()
+        for offset in 0..<5 {
+            let dayStart = midnight - offset * day
+            let from = dayStart - h30, to = dayStart + day
+            let got = await w.rows(owner: "owner", from: from, to: to)
+            XCTAssertEqual(got, direct(from, to), "window \(offset) must equal a direct read")
+        }
+        let lastFrom = midnight - 4 * day - h30
+        XCTAssertEqual(w.rowsRead, direct(lastFrom, midnight + day).count, "each row read exactly once")
+        XCTAssertGreaterThan(w.rowsServed, w.rowsRead / 2, "and most rows came from the buffer")
+    }
+
+    func testOwnerFlipFallsBackToADirectRead() async {
+        let w = window()
+        let from = midnight - h30, to = midnight + day
+        _ = await w.rows(owner: "a", from: from, to: to)
+        let readAfterFirst = w.rowsRead
+        let got = await w.rows(owner: "b", from: from - day, to: to - day)
+        XCTAssertEqual(got, direct(from - day, to - day))
+        // A different strap cannot reuse the buffer, so this is a full window read, not a stride.
+        XCTAssertEqual(w.rowsRead - readAfterFirst, to - from + 1)
+    }
+
+    /// A truncated read cannot be sliced, because `ORDER BY ts ASC LIMIT` drops the NEWEST rows — the
+    /// buffer would be missing its tail with nothing to say so.
+    func testTruncatedReadIsNeverSliced() async {
+        let limit = 1_000
+        let w = window(limit: limit)
+        let from = midnight - h30, to = midnight + day
+        let first = await w.rows(owner: "owner", from: from, to: to)
+        XCTAssertEqual(first.count, limit)
+        let next = await w.rows(owner: "owner", from: from - day, to: to - day)
+        XCTAssertEqual(next, direct(from - day, to - day, limit: limit))
+    }
+
+    /// A gap (the day cache skipped a day) must not splice across the hole.
+    func testGapDoesNotSpliceAcrossTheMissingDay() async {
+        let w = window()
+        _ = await w.rows(owner: "owner", from: midnight - h30, to: midnight + day)
+        let skipStart = midnight - 2 * day
+        let got = await w.rows(owner: "owner", from: skipStart - h30, to: skipStart + day)
+        XCTAssertEqual(got, direct(skipStart - h30, skipStart + day))
+    }
+
+    /// A FAILED read must not be cached as if it were an empty range. Twin of Kotlin
+    /// `failedReadIsNotCachedAsEmpty`.
+    ///
+    /// This is the one that bites silently. An empty SUCCESSFUL read is a true statement — there are no
+    /// rows in that span — so the next day may splice against it. An empty FAILED read says nothing, and
+    /// caching it lets the following day splice against rows nobody fetched: its window would come back
+    /// missing everything the buffer claimed to hold, with no error and no log line, and the days built
+    /// from it would be scored on inputs that quietly lost hours.
+    ///
+    /// Reachable on THIS platform in particular: the engine wraps its store reads in `try?`, so a failure
+    /// arrives as an empty array unless the reader says otherwise.
+    func testFailedReadIsNotCachedAsEmpty() async {
+        var failNext = true
+        let w = SlidingStreamWindow<Int>(tsOf: { $0 }, limit: 1_000_000) { [self] _, f, t in
+            if failNext { failNext = false; return nil }
+            return direct(f, t)
+        }
+        let from = midnight - h30, to = midnight + day
+        let first = await w.rows(owner: "owner", from: from, to: to)
+        XCTAssertEqual(first, [], "a failed read yields nothing, as it did before the buffer existed")
+        // The next day must go back to the store, not splice against a window nobody filled.
+        let next = await w.rows(owner: "owner", from: from - day, to: to - day)
+        XCTAssertEqual(next, direct(from - day, to - day))
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/WindowedStreamPlanTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/WindowedStreamPlanTests.swift
new file mode 100644
index 0000000000..6f167767ce
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/WindowedStreamPlanTests.swift
@@ -0,0 +1,86 @@
+import XCTest
+@testable import StrandAnalytics
+
+/// Pins the windowed-read planner. Twin of Kotlin `WindowedStreamPlanTest` — same table, same answers.
+///
+/// Two properties matter here and nothing else does. The walk must collapse to ONE stride of reading per
+/// day, which is the whole point; and every case the planner cannot prove safe must land on `.fullRead`,
+/// because this sits on the scoring path where an optimisation that guesses produces a wrong number rather
+/// than a slow one.
+final class WindowedStreamPlanTests: XCTestCase {
+
+    private let day = 86_400
+    private let h30 = 108_000
+    private let midnight = 1_787_875_200
+
+    /// The real shape: days walked backwards, 54-hour windows on a 24-hour stride. Day 0 reads in full
+    /// because nothing is buffered; every day after it extends by EXACTLY one stride, which is the 2.25x
+    /// overlap being removed.
+    func testBackwardWalkExtendsByExactlyOneStridePerDay() {
+        var owner: String?
+        var cf = 0, ct = 0
+        var plans: [WindowedStreamPlan.Plan] = []
+        for offset in 0..<5 {
+            let dayStart = midnight - offset * day
+            let from = dayStart - h30, to = dayStart + day
+            plans.append(WindowedStreamPlan.plan(cachedOwner: owner, cachedFrom: cf, cachedTo: ct,
+                                                 cachedTruncated: false, owner: "w", from: from, to: to))
+            owner = "w"; cf = from; ct = to
+        }
+        XCTAssertEqual(plans[0], .fullRead)
+        XCTAssertEqual(plans[1], .extend(readFrom: 1_787_680_800, readTo: 1_787_767_199))
+        XCTAssertEqual(plans[2], .extend(readFrom: 1_787_594_400, readTo: 1_787_680_799))
+        XCTAssertEqual(plans[3], .extend(readFrom: 1_787_508_000, readTo: 1_787_594_399))
+        XCTAssertEqual(plans[4], .extend(readFrom: 1_787_421_600, readTo: 1_787_507_999))
+        // Each extension is one stride, inclusive at both ends — the store's range predicate is too.
+        for p in plans.dropFirst() {
+            guard case let .extend(readFrom, readTo) = p else { return XCTFail("expected .extend, got \(p)") }
+            XCTAssertEqual(readTo - readFrom + 1, day)
+        }
+    }
+
+    /// Everything the planner cannot prove safe reads in full — the pre-existing behaviour, unchanged.
+    func testUnprovableCasesReadInFull() {
+        func p(_ co: String?, _ cf: Int, _ ct: Int, _ trunc: Bool, _ o: String, _ f: Int, _ t: Int)
+            -> WindowedStreamPlan.Plan {
+            WindowedStreamPlan.plan(cachedOwner: co, cachedFrom: cf, cachedTo: ct,
+                                    cachedTruncated: trunc, owner: o, from: f, to: t)
+        }
+        XCTAssertEqual(p("a", 100, 200, false, "b", 50, 150), .fullRead)
+        XCTAssertEqual(p("w", 100, 200, true, "w", 50, 150), .fullRead)
+        XCTAssertEqual(p(nil, 0, 0, false, "w", 50, 150), .fullRead)
+        XCTAssertEqual(p("w", 100, 200, false, "w", 10, 99), .fullRead)
+        XCTAssertEqual(p("w", 100, 200, false, "w", 150, 250), .fullRead)
+        XCTAssertEqual(p("w", 200, 100, false, "w", 50, 150), .fullRead)
+        XCTAssertEqual(p("w", 100, 200, false, "w", 150, 50), .fullRead)
+    }
+
+    /// A day whose window the buffer already covers reads nothing. The boundary case is the one worth
+    /// pinning: `to` landing exactly ON the buffer's start still extends only up to the row below it, so the
+    /// boundary row is never read twice.
+    func testCoveredServesAndBoundaryNeverDoubleReads() {
+        func p(_ cf: Int, _ ct: Int, _ f: Int, _ t: Int) -> WindowedStreamPlan.Plan {
+            WindowedStreamPlan.plan(cachedOwner: "w", cachedFrom: cf, cachedTo: ct,
+                                    cachedTruncated: false, owner: "w", from: f, to: t)
+        }
+        XCTAssertEqual(p(100, 200, 120, 180), .serve)
+        XCTAssertEqual(p(100, 200, 100, 200), .serve)
+        XCTAssertEqual(p(100, 200, 50, 150), .extend(readFrom: 50, readTo: 99))
+        XCTAssertEqual(p(100, 200, 50, 100), .extend(readFrom: 50, readTo: 99))
+    }
+
+    /// The saved-rows line. Twin of Kotlin `logLineShape` — same inputs, same string, and the shape is
+    /// pinned because a diagnostic nobody asserts is a diagnostic that can drift into meaning nothing.
+    ///
+    /// The zero case is the one worth having: a pass where the windows decline entirely must SAY so rather
+    /// than simply omit the line, so a reader can tell "the buffer saved nothing" from "the buffer was
+    /// never asked".
+    func testLogLine() {
+        XCTAssertEqual(
+            WindowedStreamPlan.logLine(hrRead: 1_000, hrServed: 9_000, rrRead: 250, rrServed: 750),
+            "analyzeRecent windows hr[read=1000 served=9000] rr[read=250 served=750]")
+        XCTAssertEqual(
+            WindowedStreamPlan.logLine(hrRead: 0, hrServed: 0, rrRead: 0, rrServed: 0),
+            "analyzeRecent windows hr[read=0 served=0] rr[read=0 served=0]")
+    }
+}
diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index 84f869d389..6347b00c41 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -880,6 +880,25 @@ final class IntelligenceEngine: ObservableObject {
             // Together with `dayCacheReused` this is the honest denominator for the reuse ratio — see the
             // diagnostic at the end of the loop.
             var dayCacheCacheable = 0
+            // #1538: backward sliding read buffers for the two heavy streams. Pass 1 walks backwards over
+            // 54-hour windows on a 24-hour stride, so consecutive days overlap by 30 hours and every row
+            // was being materialised ~2.25x per pass. These read the missing stride only; every case the
+            // planner cannot prove safe falls back to exactly the read that shipped before them. HR and
+            // R-R only: the other eight streams are thousands of rows against these two's tens of
+            // thousands, so this is nearly all of the win for two call sites of blast radius.
+            // ONE binding, used as both the read cap and the window's truncation threshold. They must be
+            // the same number: the window declines to slice a read that came back at the cap, because
+            // `ORDER BY ts ASC LIMIT` drops the NEWEST rows. Were the two to drift apart, a truncated read
+            // would stop being recognised and the buffer would be sliced while missing its tail — wrong
+            // scoring inputs, silently. The Kotlin twin cannot drift because it uses `STREAM_LIMIT` for
+            // both; this is the same guarantee spelled locally.
+            let streamLimit = 200_000
+            let hrWindow = SlidingStreamWindow<HRSample>(tsOf: { $0.ts }, limit: streamLimit) { o, f, t in
+                try? await store.hrSamples(deviceId: o, from: f, to: t, limit: streamLimit)
+            }
+            let rrWindow = SlidingStreamWindow<RRInterval>(tsOf: { $0.ts }, limit: streamLimit) { o, f, t in
+                try? await store.rrIntervals(deviceId: o, from: f, to: t, limit: streamLimit)
+            }
             for offset in 0..<maxDays {
                 let dayStart = nowLocalMidnight - offset * 86_400
                 let day = AnalyticsEngine.dayString(dayStart, offsetSec: tzOffset)
@@ -955,7 +974,7 @@ final class IntelligenceEngine: ObservableObject {
                 // what decides whether narrowing the read windows is worth building at all. Measured, not
                 // guessed, for the same reason the day-cache duration is.
                 let tPrep0 = Date()
-                let hr = (try? await store.hrSamples(deviceId: owner, from: from, to: to, limit: 200_000)) ?? []
+                let hr = await hrWindow.rows(owner: owner, from: from, to: to)
                 guard hr.count >= IntelligenceEngine.minHrSamples else {
                     // This day still paid for its read; count it, or the tally under-reports exactly the
                     // sparse-history installs where reads dominate most.
@@ -963,7 +982,7 @@ final class IntelligenceEngine: ObservableObject {
                     skippedSleepDays.append((day: day, hrSamples: hr.count))
                     continue
                 }
-                let rr = (try? await store.rrIntervals(deviceId: owner, from: from, to: to, limit: 200_000)) ?? []
+                let rr = await rrWindow.rows(owner: owner, from: from, to: to)
                 // `forScoring` drops an Oura ring's respiration rows: those are the ring's OWN per-window
                 // RATE (0x6A, milli-bpm, ~1 row per 5 min), stored as instrumentation, while the stager
                 // reads this stream as a ~1 Hz raw ADC waveform. Refusing by provenance keeps the
@@ -1458,6 +1477,13 @@ final class IntelligenceEngine: ObservableObject {
             // narrowing; `analyzeDay` dominating means it is not, whatever the row counts look like.
             skippedDayLines.append("analyzeRecent cost prep=\(Int(dayPrepSeconds * 1000))ms "
                                    + "score=\(Int(dayScoreSeconds * 1000))ms")
+            // #1538: what the sliding windows saved, beside the line the decision to build them was made
+            // from. A pass where `served` is ~0 means they are declining (truncation, an owner flip, or a
+            // gap left by a dayCache hit) and the reads are back to what they were — the honest outcome
+            // rather than a silent one. Byte-identical to the Kotlin `analyzeWindowsLogLine`.
+            skippedDayLines.append(WindowedStreamPlan.logLine(
+                hrRead: hrWindow.rowsRead, hrServed: hrWindow.rowsServed,
+                rrRead: rrWindow.rowsRead, rrServed: rrWindow.rowsServed))
             return (out, skippedDayLines, dayScanCacheLocal)
         }.value
         // #1005: write the loop's updated reuse cache back to the (main-actor) stored property. The pass ran
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index 7ec5f487a4..8b973b9873 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -746,6 +746,15 @@ object IntelligenceEngine {
         // Together with [dayCacheReused] this is the honest denominator for the reuse ratio — see the
         // diagnostic at the end of the loop.
         var dayCacheCacheable = 0
+        // #1538: backward sliding read buffers for the two heavy streams. Pass 1 walks backwards over
+        // 54-hour windows on a 24-hour stride, so consecutive days overlap by 30 hours and every row was
+        // being materialised ~2.25x per pass. These read the missing stride only; every case the planner
+        // cannot prove safe falls back to exactly the read that shipped before them. HR and R-R only:
+        // ~86k and ~54k rows a night against thousands for the other eight streams, so this is nearly all
+        // of the win for two call sites of blast radius.
+        val hrWindow = hrReadWindow(repo)
+        val rrWindow = rrReadWindow(repo)
+
         // #1005: memoise the UN-coalesced registered WHOOP family per owner (null = non-WHOOP → never
         // cached). Kept separate from [skinFamilyByOwner] (which coalesces unknown → WHOOP5 for the skin
         // scale); this must NOT coalesce so a ring can't be cached as a WHOOP.
@@ -848,7 +857,7 @@ object IntelligenceEngine {
             // itself end to end, so whether the per-night cost is store reads or analyzeDay is unmeasured,
             // and that split decides whether narrowing the read windows is worth building.
             val tPrep0 = System.nanoTime()
-            val hr = repo.hrSamples(owner, from, to, STREAM_LIMIT)
+            val hr = hrWindow.rows(owner, from, to)
             // CAPTURE-B: capture this day's resolved read owner + HR-row count so PASS 2 can emit the
             // verbatim universal `dayOwner …` line per SCORED day (matching the iOS emit, which is in the
             // scored-days loop, NOT here). Only when the universal sink is on. A day skipped below for too
@@ -875,7 +884,7 @@ object IntelligenceEngine {
                 skippedSleepDays.add(day, hr.size)
                 continue
             }
-            val rr = repo.rrIntervals(owner, from, to, STREAM_LIMIT)
+            val rr = rrWindow.rows(owner, from, to)
             // ONE read, TWO consumers, and they must not be confused for each other. `forScoring` strips
             // an Oura ring's rows from the STAGER's input: the stager reads this stream as a ~1 Hz raw ADC
             // waveform and peak-detects it, and the ring's rows are a per-window RATE — the wrong shape,
@@ -1268,6 +1277,7 @@ object IntelligenceEngine {
         // (each row materialised ~2.25x per pass) is worth narrowing; analyzeDay dominating means it is
         // not, whatever the row counts look like. Byte-identical line to the Swift twin.
         diag("analyzeRecent cost prep=${dayPrepNanos / 1_000_000}ms score=${dayScoreNanos / 1_000_000}ms")
+        diag(WindowedStreamPlan.logLine(hrWindow.rowsRead, hrWindow.rowsServed, rrWindow.rowsRead, rrWindow.rowsServed))
 
         // ── Seed the baseline from the UNION of imported nightly history + the nightly
         // values just computed. This is the recovery fix: the "-noop" nightly avgHrv/
@@ -2637,6 +2647,21 @@ object IntelligenceEngine {
         return if (dayStart < nowLocalMidnight) nextMidnight else minOf(nextMidnight, now)
     }
 
+    /** The pass-1 HR sliding read window. Constructed OUTSIDE `analyzeRecentOnCpu` so neither the
+     *  element lambda nor the reader lambda counts against that method's bytecode budget, which the
+     *  extraction next door exists to protect. */
+    private fun hrReadWindow(repo: com.noop.data.WhoopRepository) =
+        SlidingStreamWindow<com.noop.data.HrSample>({ it.ts }, STREAM_LIMIT) { o, f, t ->
+            repo.hrSamples(o, f, t, STREAM_LIMIT)
+        }
+
+    /** The pass-1 R-R sliding read window. Same reason as [hrReadWindow] for living out here. */
+    private fun rrReadWindow(repo: com.noop.data.WhoopRepository) =
+        SlidingStreamWindow<com.noop.data.RrInterval>({ it.ts }, STREAM_LIMIT) { o, f, t ->
+            repo.rrIntervals(o, f, t, STREAM_LIMIT)
+        }
+
+
     /**
      * The per-day skin-temp, SpO2 and off-wrist reads, lifted out of `analyzeRecentOnCpu` (#1538).
      *
diff --git a/android/app/src/main/java/com/noop/analytics/SlidingStreamWindow.kt b/android/app/src/main/java/com/noop/analytics/SlidingStreamWindow.kt
new file mode 100644
index 0000000000..44843f7620
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/SlidingStreamWindow.kt
@@ -0,0 +1,129 @@
+package com.noop.analytics
+
+/**
+ * One stream's backward sliding read buffer for `analyzeRecent`'s pass-1 loop (#1538).
+ *
+ * [WindowedStreamPlan] decides WHETHER a day's window can reuse what the previous day read; this holds
+ * the rows and does the splice. Kept out of the engine because the splice is the part that can silently
+ * be wrong — a row dropped here is a scoring input that vanishes — so it gets its own tests rather than
+ * living inline in a 1500-line loop. Twin of Swift `SlidingStreamWindow`.
+ *
+ * The buffer always ends up covering EXACTLY the window just served, never more: the walk runs backwards
+ * so the tail above `to` is never asked for again, and holding it would grow the footprint across the
+ * pass instead of keeping it at one window. Rows are stored in the store's own `ts ASC` order and an
+ * extension is always strictly BELOW the buffer, so prepending preserves that order without a sort.
+ *
+ * @param tsOf the row's timestamp, in the same unit the window bounds use.
+ * @param limit the store's row cap. A read returning [limit] rows was truncated: the queries are
+ *   `ORDER BY ts ASC LIMIT`, so truncation silently drops the NEWEST rows, and a buffer built from one
+ *   would be missing its tail with nothing to indicate it.
+ */
+class SlidingStreamWindow<T>(
+    private val tsOf: (T) -> Long,
+    private val limit: Int,
+    /**
+     * The store call for `(owner, from, to)`. Bound at CONSTRUCTION rather than passed per call: the two
+     * call sites live in `analyzeRecentOnCpu`, which sits close enough to the JVM's 64 KB bytecode ceiling
+     * to have a budget test of its own, and a lambda at each call site put it over. It must return
+     * `ts ASC` and honour the same [limit].
+     *
+     * NULL means the read FAILED, which is not the same as returning no rows and must never be cached as
+     * if it were. An empty successful read is a true statement about a range — the buffer can serve it,
+     * and the next day may splice against it. An empty FAILED read is no statement at all, and caching it
+     * would let the following day splice against rows nobody ever fetched, silently dropping the part of
+     * its window the buffer claimed to hold. This side never returns null today (a repo read throws, and
+     * the throw propagates exactly as it did before the buffer existed); the Swift twin does, because its
+     * engine wraps reads in `try?` and turns a failure into an empty array.
+     */
+    private val read: suspend (String, Long, Long) -> List<T>?,
+) {
+
+    private var owner: String? = null
+    private var from = 0L
+    private var to = 0L
+    private var truncated = false
+    private var rows: List<T> = emptyList()
+
+    /** Rows this window served from the buffer rather than reading. Diagnostic only.
+     *
+     *  `Long` here, `Int` on the Swift twin, and that is deliberate rather than drift: each side follows
+     *  its own platform's convention for a count, and the value cannot reach either limit — a pass is
+     *  bounded by `maxDays` windows of at most [limit] rows, so about 4 M on a 21-day pass. Stated because
+     *  a width left to be inferred is how the 32-bit `pct` over-count got in (#1685). */
+    var rowsServed = 0L
+        private set
+
+    /** Rows this window read from the store. Diagnostic only. Same width note as [rowsServed]. */
+    var rowsRead = 0L
+        private set
+
+    /**
+     * The rows for `[from, to]` under [owner], reading as little as the plan allows.
+     *
+     * The result is byte-for-byte what a direct `read(owner, from, to)` would have returned — that is the
+     * whole contract, and the reason every case the planner cannot prove falls back to exactly that call.
+     */
+    suspend fun rows(owner: String, from: Long, to: Long): List<T> {
+        val plan = WindowedStreamPlan.plan(this.owner, this.from, this.to, truncated, owner, from, to)
+        val result: List<T>
+        val nowTruncated: Boolean
+        when (plan) {
+            is WindowedStreamPlan.Plan.Serve -> {
+                result = rows.filter { tsOf(it) in from..to }
+                nowTruncated = false
+                rowsServed += result.size
+            }
+            is WindowedStreamPlan.Plan.Extend -> {
+                val head = read(owner, plan.readFrom, plan.readTo) ?: return failedRead()
+                rowsRead += head.size
+                if (head.size >= limit) {
+                    // A truncated EXTENSION is worse than a truncated buffer: it would leave a hole in the
+                    // middle rather than at the end. Discard and read the window whole.
+                    val full = read(owner, from, to) ?: return failedRead()
+                    rowsRead += full.size
+                    result = full
+                    nowTruncated = full.size >= limit
+                } else {
+                    // Filtered into ONE list rather than `(head + rows).filter { }`: that form allocates
+                    // the concatenation AND the filtered copy, so the splice transiently held roughly
+                    // three windows' worth of references on a phone during the cold pass. Same result,
+                    // one allocation.
+                    val out = ArrayList<T>(head.size + rows.size)
+                    for (r in head) if (tsOf(r) in from..to) out.add(r)
+                    for (r in rows) if (tsOf(r) in from..to) out.add(r)
+                    result = out
+                    nowTruncated = false
+                    rowsServed += (result.size - head.size).coerceAtLeast(0)
+                }
+            }
+            is WindowedStreamPlan.Plan.FullRead -> {
+                val full = read(owner, from, to) ?: return failedRead()
+                rowsRead += full.size
+                result = full
+                nowTruncated = full.size >= limit
+            }
+        }
+        this.owner = owner
+        this.from = from
+        this.to = to
+        this.truncated = nowTruncated
+        this.rows = result
+        return result
+    }
+
+    /** A failed read leaves NO buffer: the next day must go back to the store rather than splice against
+     *  a window nobody successfully filled. Returns empty, which is what the caller saw for a failed read
+     *  before this class existed. */
+    private fun failedRead(): List<T> {
+        owner = null
+        // The range is cleared too, not just the owner. Leaving it stale would work only because
+        // `WindowedStreamPlan.plan` happens to test the owner BEFORE the bounds — a cross-file assumption
+        // that holds today and would break silently if those checks were ever reordered. Cheaper to be
+        // self-consistent than to depend on the order of someone else's guards.
+        from = 0
+        to = 0
+        rows = emptyList()
+        truncated = false
+        return emptyList()
+    }
+}
diff --git a/android/app/src/main/java/com/noop/analytics/WindowedStreamPlan.kt b/android/app/src/main/java/com/noop/analytics/WindowedStreamPlan.kt
new file mode 100644
index 0000000000..90a2bb0a84
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/WindowedStreamPlan.kt
@@ -0,0 +1,86 @@
+package com.noop.analytics
+
+/**
+ * How to satisfy one day's windowed stream read given what the previous day already read (#1538).
+ *
+ * `analyzeRecent`'s pass-1 loop walks BACKWARDS — `dayStart = nowLocalMidnight - offset * 24h` — and reads
+ * a 54-hour window around each night (`dayStart - 30h` .. next local midnight). On a 24-hour stride that
+ * makes consecutive windows overlap by 30 hours, so every row is materialised about 2.25 times per pass.
+ * The `analyzeRecent cost prep=…ms score=…ms` line exists to decide whether that is worth narrowing, and a
+ * field log answered it: prep 48129ms against score 31516ms on a cold 21-day pass, so the reads are the
+ * larger half and the overlap is worth removing.
+ *
+ * This is the DECISION half, kept pure so both platforms can be pinned against one oracle. Splicing the
+ * rows is mechanical and stays with the caller. Twin of Swift `WindowedStreamPlan`.
+ *
+ * The planner REFUSES rather than guesses. Every case it cannot prove safe returns [FullRead], which is
+ * byte-for-byte the behaviour that shipped before this existed — the same stance `daySliceFromNight` takes
+ * when it declines. An optimisation on the scoring path may only ever skip work, never change a number.
+ */
+object WindowedStreamPlan {
+
+    /**
+     * What the sliding windows saved, for the line emitted beside `analyzeRecent`'s `prep`/`score` split
+     * — the measurement the decision to build them was made from.
+     *
+     * `read` is rows fetched from the store, `served` rows a buffer supplied instead. A pass where
+     * `served` is ~0 means the windows are declining — truncation, an owner flip, or a gap left by a
+     * dayCache hit — and the reads are back to exactly what they were. That is the honest outcome rather
+     * than a silent one, which is why the counters ship rather than just the speedup.
+     *
+     * Lives HERE rather than on the engine so both platforms put it in the same place and both are
+     * covered by default CI. Byte-identical to the Swift `WindowedStreamPlan.logLine`.
+     */
+    fun logLine(hrRead: Long, hrServed: Long, rrRead: Long, rrServed: Long): String =
+        "analyzeRecent windows hr[read=$hrRead served=$hrServed] rr[read=$rrRead served=$rrServed]"
+
+    /** What the caller should do to obtain rows for the requested window. */
+    sealed interface Plan {
+        /** Read the whole window from the store; nothing usable is buffered. */
+        data object FullRead : Plan
+        /** The buffer already covers the window; slice it, read nothing. */
+        data object Serve : Plan
+        /**
+         * Read only `[readFrom, readTo]` (inclusive, both ends) and prepend it to the buffer. `readTo` is
+         * one second BELOW the buffer's current start, so the boundary row is never read twice — the
+         * store's range predicate is inclusive at both ends.
+         */
+        data class Extend(val readFrom: Long, val readTo: Long) : Plan
+    }
+
+    /**
+     * Plan the read for `[from, to]` against a buffer holding `[cachedFrom, cachedTo]` for [cachedOwner].
+     *
+     * [cachedOwner] null means nothing is buffered. [cachedTruncated] means the buffered read hit the
+     * store's row limit, so its contents do not represent its range — that buffer can never be sliced, for
+     * the reason `daySliceFromNight` gives.
+     *
+     * After the caller acts on the plan the buffer covers exactly `[from, to]`: rows above `to` are
+     * dropped, which is what keeps the peak footprint at one window rather than the whole pass. A backward
+     * walk never asks for them again.
+     */
+    fun plan(
+        cachedOwner: String?,
+        cachedFrom: Long,
+        cachedTo: Long,
+        cachedTruncated: Boolean,
+        owner: String,
+        from: Long,
+        to: Long,
+    ): Plan {
+        // Nothing buffered, a different strap owns this day, or the buffered read was cut off at the row
+        // limit — none of these can be sliced, and a wrong slice is a wrong score.
+        if (cachedOwner == null || cachedOwner != owner || cachedTruncated) return Plan.FullRead
+        // A degenerate or inverted buffer holds nothing meaningful.
+        if (cachedFrom > cachedTo) return Plan.FullRead
+        // An inverted request is not this planner's business to repair.
+        if (from > to) return Plan.FullRead
+        // The buffer covers the request outright.
+        if (from >= cachedFrom && to <= cachedTo) return Plan.Serve
+        // The ONLY extension this walk produces: the window moved earlier, and its tail is still inside
+        // what is buffered. Anything else (a window that moved forward, or one disjoint from the buffer)
+        // is not the backward stride this exists for, so it reads in full rather than being reasoned about.
+        if (from < cachedFrom && to in cachedFrom..cachedTo) return Plan.Extend(from, cachedFrom - 1)
+        return Plan.FullRead
+    }
+}
diff --git a/android/app/src/test/java/com/noop/analytics/SlidingStreamWindowTest.kt b/android/app/src/test/java/com/noop/analytics/SlidingStreamWindowTest.kt
new file mode 100644
index 0000000000..fa15eaa789
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/SlidingStreamWindowTest.kt
@@ -0,0 +1,115 @@
+package com.noop.analytics
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import kotlinx.coroutines.runBlocking
+import org.junit.Test
+
+/**
+ * Pins the sliding read buffer against the only contract that matters: for every window, it returns
+ * EXACTLY what a direct store read would have returned. Twin of Swift `SlidingStreamWindowTests`.
+ *
+ * The test store is a plain sorted list, so "what a direct read would have returned" is computable
+ * independently rather than asserted from the implementation's own behaviour — otherwise the test would
+ * agree with a wrong splice.
+ */
+class SlidingStreamWindowTest {
+
+    private val day = 86_400L
+    private val h30 = 108_000L
+    private val midnight = 1_787_875_200L
+
+    /** One row per second across five days, which is the 1 Hz shape the real HR stream has. */
+    private val store: List<Long> = (midnight - 5 * day..midnight + day step 1L).toList()
+
+    private fun direct(from: Long, to: Long, limit: Int = 1_000_000): List<Long> =
+        store.filter { it in from..to }.take(limit)
+
+    private fun window(limit: Int = 1_000_000) =
+        SlidingStreamWindow<Long>({ it }, limit) { _, f, t -> direct(f, t, limit) }
+
+    @Test fun backwardWalkMatchesDirectReadsAndReadsEachRowOnce() = runBlocking {
+        val w = window()
+        for (offset in 0 until 5) {
+            val dayStart = midnight - offset * day
+            val from = dayStart - h30
+            val to = dayStart + day
+            val got = w.rows("owner", from, to)
+            assertEquals("window $offset must equal a direct read", direct(from, to), got)
+        }
+        // Day 0 reads its whole 54 h window; each later day reads exactly one 24 h stride. Without the
+        // buffer this walk reads 5 x 54 h. The union of all five windows is what it now reads instead.
+        val firstFrom = midnight - h30
+        val lastFrom = midnight - 4 * day - h30
+        val expectedDistinct = direct(lastFrom, midnight + day).size.toLong()
+        assertEquals("each row read exactly once", expectedDistinct, w.rowsRead)
+        assertTrue("and most rows came from the buffer", w.rowsServed > w.rowsRead / 2)
+        assertTrue(firstFrom > lastFrom)
+    }
+
+    @Test fun ownerFlipFallsBackToADirectRead() = runBlocking {
+        val w = window()
+        val from = midnight - h30
+        val to = midnight + day
+        w.rows("a", from, to)
+        val readAfterFirst = w.rowsRead
+        val got = w.rows("b", from - day, to - day)
+        assertEquals(direct(from - day, to - day), got)
+        // A different strap cannot reuse the buffer, so this is a full window read, not a stride.
+        assertEquals((to - from + 1), w.rowsRead - readAfterFirst)
+    }
+
+    /**
+     * A truncated read cannot be sliced, because `ORDER BY ts ASC LIMIT` drops the NEWEST rows — the
+     * buffer would be missing its tail with nothing to say so. The next day must read in full and still
+     * match a direct read at the same limit.
+     */
+    @Test fun truncatedReadIsNeverSliced() = runBlocking {
+        val limit = 1_000
+        val w = window(limit)
+        val from = midnight - h30
+        val to = midnight + day
+        val first = w.rows("owner", from, to)
+        assertEquals(limit, first.size)
+        val next = w.rows("owner", from - day, to - day)
+        assertEquals(direct(from - day, to - day, limit), next)
+    }
+
+    /** A gap (the day cache skipped a day) must not splice across the hole. */
+    @Test fun gapDoesNotSpliceAcrossTheMissingDay() = runBlocking {
+        val w = window()
+        val a0 = midnight - h30
+        w.rows("owner", a0, midnight + day)
+        // Skip one day entirely, as a dayCache HIT would, then ask for the one after it.
+        val skipStart = midnight - 2 * day
+        val got = w.rows("owner", skipStart - h30, skipStart + day)
+        assertEquals(direct(skipStart - h30, skipStart + day), got)
+    }
+
+    /**
+     * A FAILED read must not be cached as if it were an empty range. Twin of Swift
+     * `testFailedReadIsNotCachedAsEmpty`.
+     *
+     * This is the one that bites silently. An empty SUCCESSFUL read is a true statement — there are no
+     * rows in that span — so the next day may splice against it. An empty FAILED read says nothing, and
+     * caching it lets the following day splice against rows nobody fetched: its window would come back
+     * missing everything the buffer claimed to hold, with no error and no log line, and the days built
+     * from it would be scored on inputs that quietly lost hours.
+     *
+     * The Swift engine is where this is reachable — it wraps its store reads in `try?` — but the guarantee
+     * belongs to the window, so both sides carry it.
+     */
+    @Test fun failedReadIsNotCachedAsEmpty() = runBlocking {
+        var failNext = true
+        val w = SlidingStreamWindow<Long>({ it }, 1_000_000) { _, f, t ->
+            if (failNext) { failNext = false; null } else direct(f, t)
+        }
+        val from = midnight - h30
+        val to = midnight + day
+        assertEquals("a failed read yields nothing, as it did before the buffer existed",
+            emptyList<Long>(), w.rows("owner", from, to))
+        // The next day must go back to the store, not splice against a window nobody filled.
+        val next = w.rows("owner", from - day, to - day)
+        assertEquals(direct(from - day, to - day), next)
+    }
+}
diff --git a/android/app/src/test/java/com/noop/analytics/WindowedStreamPlanTest.kt b/android/app/src/test/java/com/noop/analytics/WindowedStreamPlanTest.kt
new file mode 100644
index 0000000000..3436895a41
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/WindowedStreamPlanTest.kt
@@ -0,0 +1,92 @@
+package com.noop.analytics
+
+import com.noop.analytics.WindowedStreamPlan.Plan
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+/**
+ * Pins the windowed-read planner. Twin of Swift `WindowedStreamPlanTests` — same table, same answers,
+ * generated by compiling the Swift planner standalone and pasting its output.
+ *
+ * Two properties matter here and nothing else does. The walk must collapse to ONE stride of reading per
+ * day, which is the whole point; and every case the planner cannot prove safe must land on [Plan.FullRead],
+ * because this sits on the scoring path where an optimisation that guesses produces a wrong number rather
+ * than a slow one.
+ */
+class WindowedStreamPlanTest {
+
+    private val day = 86_400L
+    private val h30 = 108_000L
+    private val midnight = 1_787_875_200L
+
+    /**
+     * The real shape: 21 days walked backwards, 54-hour windows on a 24-hour stride. Day 0 reads in full
+     * because nothing is buffered; every day after it extends by EXACTLY one stride, which is the 2.25x
+     * overlap being removed.
+     */
+    @Test fun backwardWalkExtendsByExactlyOneStridePerDay() {
+        var owner: String? = null
+        var cf = 0L
+        var ct = 0L
+        val plans = ArrayList<Plan>()
+        for (offset in 0 until 5) {
+            val dayStart = midnight - offset * day
+            val from = dayStart - h30
+            val to = dayStart + day
+            plans.add(WindowedStreamPlan.plan(owner, cf, ct, false, "w", from, to))
+            owner = "w"; cf = from; ct = to
+        }
+        assertEquals(Plan.FullRead, plans[0])
+        assertEquals(Plan.Extend(1_787_680_800L, 1_787_767_199L), plans[1])
+        assertEquals(Plan.Extend(1_787_594_400L, 1_787_680_799L), plans[2])
+        assertEquals(Plan.Extend(1_787_508_000L, 1_787_594_399L), plans[3])
+        assertEquals(Plan.Extend(1_787_421_600L, 1_787_507_999L), plans[4])
+        // Each extension is one stride, inclusive at both ends — the store's range predicate is too.
+        for (p in plans.drop(1)) {
+            val e = p as Plan.Extend
+            assertEquals(day, e.readTo - e.readFrom + 1)
+        }
+    }
+
+    /** Everything the planner cannot prove safe reads in full — the pre-existing behaviour, unchanged. */
+    @Test fun unprovableCasesReadInFull() {
+        assertEquals(Plan.FullRead, WindowedStreamPlan.plan("a", 100, 200, false, "b", 50, 150))
+        assertEquals(Plan.FullRead, WindowedStreamPlan.plan("w", 100, 200, true, "w", 50, 150))
+        assertEquals(Plan.FullRead, WindowedStreamPlan.plan(null, 0, 0, false, "w", 50, 150))
+        assertEquals(Plan.FullRead, WindowedStreamPlan.plan("w", 100, 200, false, "w", 10, 99))
+        assertEquals(Plan.FullRead, WindowedStreamPlan.plan("w", 100, 200, false, "w", 150, 250))
+        assertEquals(Plan.FullRead, WindowedStreamPlan.plan("w", 200, 100, false, "w", 50, 150))
+        assertEquals(Plan.FullRead, WindowedStreamPlan.plan("w", 100, 200, false, "w", 150, 50))
+    }
+
+    /**
+     * A day whose window the buffer already covers reads nothing. The boundary case is the one worth
+     * pinning: `to` landing exactly ON the buffer's start still extends only up to the row below it, so the
+     * boundary row is never read twice.
+     */
+    @Test fun coveredServesAndBoundaryNeverDoubleReads() {
+        assertEquals(Plan.Serve, WindowedStreamPlan.plan("w", 100, 200, false, "w", 120, 180))
+        assertEquals(Plan.Serve, WindowedStreamPlan.plan("w", 100, 200, false, "w", 100, 200))
+        assertEquals(Plan.Extend(50, 99), WindowedStreamPlan.plan("w", 100, 200, false, "w", 50, 150))
+        assertEquals(Plan.Extend(50, 99), WindowedStreamPlan.plan("w", 100, 200, false, "w", 50, 100))
+    }
+
+    /**
+     * The saved-rows line. Twin of Swift `testLogLine` — same inputs, same string, and the shape is
+     * pinned because a diagnostic nobody asserts is a diagnostic that can drift into meaning nothing.
+     *
+     * The zero case is the one worth having: a pass where the windows decline entirely must SAY so rather
+     * than simply omit the line, so a reader can tell "the buffer saved nothing" from "the buffer was
+     * never asked".
+     */
+    @Test fun logLineShape() {
+        assertEquals(
+            "analyzeRecent windows hr[read=1000 served=9000] rr[read=250 served=750]",
+            WindowedStreamPlan.logLine(1_000L, 9_000L, 250L, 750L),
+        )
+        assertEquals(
+            "analyzeRecent windows hr[read=0 served=0] rr[read=0 served=0]",
+            WindowedStreamPlan.logLine(0L, 0L, 0L, 0L),
+        )
+    }
+}

From 88f0d1964a2445db450d84f852499f1e72beb0be Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 15:37:36 +1200
Subject: [PATCH 030/333] Bump build numbers for the next 10.6.1 staging build

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 2e3f35a041..362d85e4f2 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 374
+        versionCode = 375
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 0483640305..74ee905ef9 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "255"
+    CURRENT_PROJECT_VERSION: "256"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 8e02b237e651909a715c4bf09e2c1b2a0cf55992 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 17:12:08 +1200
Subject: [PATCH 031/333] diag(ble): Apple decoded the strap's own console log
 and then dropped it (#1697)

An Apple strap log has never carried a word of what the strap says about itself.

The 5/MG narrates its own sync engine over CONSOLE_LOGS (type 50) - "BLE: PullStats: Data:
594, Events: 32, Bytes: 76996", "History burst success. Trim: 0x0000000d:0001aed6",
"Historical Dump Complete". Android mirrors that into the strap log and its comment calls it
gold for protocol research. This side decoded the text and discarded it.

WHY IT IS WORTH MORE THAN CURIOSITY. `PullStats: Data: 0` is the STRAP stating it sent no
records. For a "synced but no data" report (#1683) that is categorically stronger than NOOP
inferring emptiness from its own decode - the strap saying nothing was there, against us
saying we found nothing. Every such report from an iPhone has been diagnosed without it.

THREE DEFECTS, EACH FOUND BY RE-REVIEWING RATHER THAN BY THE ORIGINAL WORK.

1. THE KEY. Three implementations decode this field and one disagreed: the Python reference
   golden.json is generated from uses "log", both Swift decoders match it under a parity
   guard, Kotlin used "console". A consumer ported from Android reads "console", gets nil,
   logs nothing. Kotlin now uses "log" so all three agree.

   I tried it the other way first, aligning Swift onto Kotlin because the Swift doc comment
   claimed "console" was the shared name. ParityTests.testSwiftMatchesPythonGolden failed
   immediately: the doc was wrong and so was my direction.

2. THE ROUTING, which made the first fix DEAD CODE. Offload frames never reach FrameRouter -
   BLEManager sends them straight to the Backfiller, and CONSOLE_LOGS is an offload type. So
   the handler only ever saw a console frame arriving OUTSIDE a sync, and the strap narrates
   precisely DURING one. Every line this exists to surface was routed past the code meant to
   surface it, while the unit tests passed and app-build went green.

   The tree already had the pattern: dispatchLiveGestureIfFresh is a carve-out inside the
   same branch so a real gesture still fires mid-sync, with a type-byte pre-check so
   thousands of type-47 records cost one compare. mirrorStrapConsoleIfPresent is that shape,
   called from BOTH offload branches - WHOOP4 and 5/MG are separate paths that would
   otherwise drift - through one shared emitter so live and offload cannot disagree.

3. NOTHING COULD HAVE CAUGHT (2). No test asserted the call site existed. Two source-level
   guards now require the carve-out in both branches AND require each to sit beside the
   gesture one, because a call that drifted to the live path would still compile, still
   satisfy a count of two, and still never fire during a sync.

A COMMENT THAT COST ALL OF THIS. Kotlin said the offload path "mirrors iOS, where the offload
path skips the live router entirely". Android does not skip it - it calls the handler for
every frame and gates only live-only effects; iOS skips the router and carves out exceptions.
Same outcome for the charging pill, opposite structure, and the difference decides which
frames reach a handler at all. Corrected to state both shapes.

KNOWN AND LEFT: Kotlin decodes CONSOLE_LOGS only on the WHOOP 5 path while Swift decodes the
4.0 layout too, so a 4.0 now narrates on iOS and stays silent on Android. Documented at the
Kotlin decode site rather than folded in - it needs the 4.0 offsets and its own vector.

Found by decoding a real WHOOP 5.0 HCI capture (digitalerdude, for #103) with our own
whoop-decode: 293 CONSOLE_LOGS frames reassemble into 164 lines of firmware narration, none
of which would reach an iOS log. Text is clean of PII.

Worth knowing for expectations: a real Android 5/MG log with logging fully on carries no
console lines at all, so the strap emits these only in some sessions or firmwares. That is
part of why the Apple gap went unnoticed - the feature is rarely exercised even where it
works.

Swift package 642 tests 0 failures, Android 4613 tests 0 failures, doc_comment_lint OK,
app-build green on both Apple targets.
---
 .../Sources/WhoopProtocol/Interpreter.swift   |  4 +-
 Strand/BLE/BLEManager.swift                   |  4 ++
 Strand/BLE/FrameRouter.swift                  | 40 +++++++++++++++
 StrandTests/StrapConsoleMirrorTests.swift     | 49 +++++++++++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 13 +++--
 .../main/java/com/noop/protocol/Framing.kt    | 11 ++++-
 .../java/com/noop/protocol/FramingTest.kt     | 12 ++---
 7 files changed, 122 insertions(+), 11 deletions(-)
 create mode 100644 StrandTests/StrapConsoleMirrorTests.swift

diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/Interpreter.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/Interpreter.swift
index aa5e8d6e01..d6568bd17b 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/Interpreter.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/Interpreter.swift
@@ -887,7 +887,9 @@ private func decodeWhoop5Event(_ frame: [UInt8], fb: FieldBuilder, schema: Schem
 /// chunk_len 52, channel 1): `record_index` u16@9 (monotonic per-chunk counter — the frame's u8 seq
 /// slot is its low byte), `unix` u32@12 + `subsec` u16@16 (batch write time), chunk_len u16@18,
 /// channel u8@20, text bytes @21 up to the CRC32 trailer with NUL padding. The Kotlin twin is
-/// `Framing.decodeConsoleLogsWhoop5` (text key "console"), same offsets.
+/// `Framing.decodeConsoleLogsWhoop5`, same offsets. The text key is "log" — matching the Python
+/// reference decoder that `golden.json` is generated from, which `ParityTests` pins. Kotlin used
+/// "console" for the same field, and the mismatch is why a reader ported from that side got nil.
 private func decodeWhoop5ConsoleLogs(_ frame: [UInt8], fb: FieldBuilder, payloadEnd: Int?) {
     if let idx = readDType(frame, 9, "u16") {
         fb.add(9, 2, "record_index", "meta", value: .int(idx), note: "per-chunk counter")
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index f409aab1b0..d8a5a005a5 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -6181,6 +6181,8 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                     // …but a REAL-TIME physical gesture (double-tap / wrist) must still fire even mid-
                     // offload (#69). Gated on ts≈now so replayed historical EVENTs (old ts) are ignored.
                     router.dispatchLiveGestureIfFresh(frame: frame, now: strapClockNow)
+                    // …and the strap's own console narration, which it emits precisely DURING a sync.
+                    router.mirrorStrapConsoleIfPresent(frame: frame)
                     continue
                 }
                 // #47: decode this live WHOOP4 frame ONCE here and thread the result to every consumer
@@ -6278,6 +6280,8 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                         // A real-time double-tap / wrist gesture still fires during a 5/MG offload (which
                         // runs for minutes, #69); the ts≈now gate rejects replayed historical EVENTs.
                         router.dispatchLiveGestureIfFresh(frame: frame, now: strapClockNow)
+                        // …and the strap's own console narration, which it emits precisely DURING a sync.
+                        router.mirrorStrapConsoleIfPresent(frame: frame)
                         continue
                     }
                     router.handle(frame: frame)
diff --git a/Strand/BLE/FrameRouter.swift b/Strand/BLE/FrameRouter.swift
index 7186afea37..f43be26aae 100644
--- a/Strand/BLE/FrameRouter.swift
+++ b/Strand/BLE/FrameRouter.swift
@@ -289,6 +289,20 @@ public final class FrameRouter {
                 }
             }
 
+        case "CONSOLE_LOGS":
+            // The 5/MG strap narrates its own sync engine here — "BLE: PullStats: Data: N, Events: N…",
+            // "History burst success. Trim: 0x…", "Historical Dump Complete". Android has mirrored this
+            // into the strap log since #78 and calls it gold for protocol research; this side decoded the
+            // text and then dropped it on the floor, so an Apple strap log has never carried a word of it.
+            //
+            // It is worth more than curiosity. `PullStats: Data: 0` is the STRAP stating it sent no
+            // records, which is a far stronger answer to a "synced but no data" report (#1683) than NOOP
+            // inferring emptiness from its own decode — the difference between the strap saying nothing
+            // was there and us saying we found nothing.
+            //
+            // Capped at 300 characters to match the Kotlin twin exactly; the ring buffer holds 2k lines.
+            appendStrapConsole(parsed)
+
         case "EVENT":
             if let ev = parsed.parsed["event"]?.stringValue {
                 // #92: don't surface the live-HR stream toggle (BLE_REALTIME_HR_ON/OFF) in "Last
@@ -509,6 +523,32 @@ public final class FrameRouter {
     /// RTC (fix #72) — a live gesture is ~now in the strap's clock, a historical replay is old in it.
     /// Deliberately does NOT touch lastEvent / sync trigger / bonded / battery — those stay on the normal
     /// handle(frame:) path, so backfill UI behaviour is otherwise unchanged.
+    /// Mirror a CONSOLE_LOGS frame's text even during a backfill.
+    ///
+    /// The strap narrates its sync engine EXACTLY while offloading — "BLE: PullStats: Data: N",
+    /// "History burst success. Trim: 0x…", "Historical Dump Complete" — and offload frames are routed
+    /// straight to the Backfiller, bypassing `handle` entirely. So the `case "CONSOLE_LOGS"` there only
+    /// ever sees the rare console frame that arrives outside a sync, which is not the one worth having.
+    /// This is the same carve-out `dispatchLiveGestureIfFresh` makes for a live gesture mid-offload.
+    ///
+    /// Same cheap pre-check as that method: a single type-byte compare skips the CRC + FieldBuilder
+    /// decode for the thousands of type-47 records a sync produces, so the cost on the offload path is a
+    /// byte compare per frame. Family-aware (WHOOP4 type @[4], 5/MG @[8]).
+    func mirrorStrapConsoleIfPresent(frame: [UInt8]) {
+        guard frameTypeName(frame, family: family) == "CONSOLE_LOGS" else { return }
+        let parsed = parseFrame(frame, family: family)
+        guard parsed.ok, parsed.crcOK != false else { return }
+        appendStrapConsole(parsed)
+    }
+
+    /// The one place the strap's own narration reaches the log, so the live and offload paths cannot
+    /// drift in what they emit. Capped at 300 characters to match the Kotlin twin exactly.
+    private func appendStrapConsole(_ parsed: ParsedFrame) {
+        guard parsed.typeName == "CONSOLE_LOGS",
+              let txt = parsed.parsed["log"]?.stringValue, !txt.isEmpty else { return }
+        state.append(log: "strap: \(String(txt.prefix(300)))")
+    }
+
     func dispatchLiveGestureIfFresh(frame: [UInt8], now: Int = Int(Date().timeIntervalSince1970)) {
         // #47: this fires for EVERY frame on the OFFLOAD path (thousands of type-47 records over a
         // multi-minute sync) purely to catch a rare EVENT gesture. Cheap type-only pre-check skips the full
diff --git a/StrandTests/StrapConsoleMirrorTests.swift b/StrandTests/StrapConsoleMirrorTests.swift
new file mode 100644
index 0000000000..8581f690f3
--- /dev/null
+++ b/StrandTests/StrapConsoleMirrorTests.swift
@@ -0,0 +1,49 @@
+import XCTest
+@testable import Strand
+
+/// Guards that the strap's own console narration actually REACHES the log.
+///
+/// The bug this exists for was not a decode bug and not a key bug — both of those were right. Offload
+/// frames are routed straight to the Backfiller and never reach `FrameRouter.handle`, and `CONSOLE_LOGS`
+/// is an offload type, so the handler that mirrors the text only ever saw the rare console frame arriving
+/// outside a sync. Every line worth having — `PullStats`, `History burst success`, `Historical Dump
+/// Complete` — is emitted DURING a sync, and was routed past the code meant to surface it.
+///
+/// Nothing caught that, because nothing asserted the call site existed. Unit tests passed and app-build
+/// was green on a feature that could not fire. So this test reads the source: the two offload branches
+/// (WHOOP4 and 5/MG are separate paths) must each invoke the carve-out.
+@MainActor
+final class StrapConsoleMirrorTests: XCTestCase {
+
+    private func bleManagerSource() throws -> String {
+        // StrandTests/<this file> → repo root → Strand/BLE/BLEManager.swift
+        let here = URL(fileURLWithPath: #filePath)
+        let root = here.deletingLastPathComponent().deletingLastPathComponent()
+        let url = root.appendingPathComponent("Strand/BLE/BLEManager.swift")
+        return try String(contentsOf: url, encoding: .utf8)
+    }
+
+    /// Both offload branches must mirror the console, or one family goes silent mid-sync — which is the
+    /// exact shape of the original defect, just per-family instead of everywhere.
+    func testBothOffloadBranchesMirrorTheStrapConsole() throws {
+        let src = try bleManagerSource()
+        let calls = src.components(separatedBy: "router.mirrorStrapConsoleIfPresent(frame: frame)").count - 1
+        XCTAssertEqual(calls, 2,
+                       "expected the console carve-out in BOTH offload branches (WHOOP4 + 5/MG); "
+                       + "found \(calls). Without it the strap's narration is dropped for that family "
+                       + "during exactly the sync it describes.")
+    }
+
+    /// The carve-out has to sit INSIDE the offload branch, beside the gesture one. If it drifted out to
+    /// the live path it would compile, pass the count check above, and still never fire during a sync.
+    func testTheCarveOutSitsBesideTheLiveGestureOne() throws {
+        let src = try bleManagerSource()
+        for part in src.components(separatedBy: "router.mirrorStrapConsoleIfPresent(frame: frame)").dropLast() {
+            let tail = String(part.suffix(400))
+            XCTAssertTrue(tail.contains("dispatchLiveGestureIfFresh"),
+                          "each console carve-out must sit with the live-gesture carve-out inside the "
+                          + "offload branch; one appears to have drifted to the live path, where it is "
+                          + "redundant with `handle` and silent during a sync")
+        }
+    }
+}
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 72a4181710..78816b4d47 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -5955,8 +5955,15 @@ class WhoopBleClient(
                     // frame. Family-aware, so it's correct for WHOOP4 and 5/MG alike.
                     val parsed = Framing.parseFrame(frame, connectedFamily)
                     // A frame replayed as part of the historical offload (type 47/48/… during a backfill)
-                    // must not drive LIVE-only state (the charging pill). Mirrors iOS, where the offload
-                    // path skips the live router entirely. (PR #568 reimpl)
+                    // must not drive LIVE-only state (the charging pill). (PR #568 reimpl)
+                    //
+                    // NOT the same shape as iOS, despite what this said before. THIS side calls the handler
+                    // for EVERY frame and gates only the live-only effects; iOS skips the router outright
+                    // for offload frames and carves out the few things that must still fire (a live
+                    // gesture, and now the strap's console narration). Same outcome for the charging pill,
+                    // opposite structure — so a reader porting behaviour either way has to check which
+                    // frames reach the handler at all, not assume it matches. That assumption is exactly
+                    // how the console mirror shipped dead on iOS: decoded, keyed correctly, never called.
                     handleFrame(frame, parsed, replayedOffload = offloadFrame)
 
                     // Capture the strap's newest stored record from a GET_DATA_RANGE reply, feeding
@@ -6487,7 +6494,7 @@ class WhoopBleClient(
                 // The 5/MG strap narrates its own sync engine here ("BLE: PullStats: Data: N…",
                 // "RTC timestamp … is invalid") — gold for protocol research, so mirror it into the
                 // strap log (capped; the ring buffer holds 2k lines). (#78 fork)
-                (parsed.parsed["console"] as? String)?.let { txt ->
+                (parsed.parsed["log"] as? String)?.let { txt ->
                     log("strap: ${txt.take(300)}")
                 }
             }
diff --git a/android/app/src/main/java/com/noop/protocol/Framing.kt b/android/app/src/main/java/com/noop/protocol/Framing.kt
index 9045b5f6ef..2fd505c74f 100644
--- a/android/app/src/main/java/com/noop/protocol/Framing.kt
+++ b/android/app/src/main/java/com/noop/protocol/Framing.kt
@@ -312,6 +312,12 @@ object Framing {
             "METADATA" -> decodeMetadataWhoop5(frame, parsed)
             "EVENT" -> decodeEventWhoop5(frame, parsed)
             "COMMAND_RESPONSE" -> decodeCommandResponseWhoop5(frame, parsed)
+            // WHOOP 5/MG ONLY, and that is a gap rather than a decision. Swift decodes the 4.0 console
+            // layout too (`PostHooks`, offsets 11..len-1, pinned by a test on real 4.0 text), so after the
+            // Apple consumer was wired up a WHOOP 4.0 narrates into an iOS strap log and stays silent in an
+            // Android one — the same defect this fixed on Apple, mirrored onto the other strap. Left for a
+            // follow-up rather than smuggled in here: it needs the 4.0 offsets and its own vector, and this
+            // change is already about a key three implementations disagreed on.
             "CONSOLE_LOGS" -> decodeConsoleLogsWhoop5(frame, parsed)
             else -> Unit
         }
@@ -410,7 +416,10 @@ object Framing {
         val text = frame.copyOfRange(21, payEnd)
             .toString(Charsets.UTF_8)
             .trimEnd('\u0000')
-        if (text.isNotEmpty()) parsed["console"] = text.take(2048)
+        // Key "log", not "console": the Python reference decoder golden.json is generated from uses
+        // "log", and Swift matches it under a parity guard. This side was the odd one out, which is
+        // how the Apple consumer ported from here read the wrong key and silently found nothing.
+        if (text.isNotEmpty()) parsed["log"] = text.take(2048)
     }
 
     /**
diff --git a/android/app/src/test/java/com/noop/protocol/FramingTest.kt b/android/app/src/test/java/com/noop/protocol/FramingTest.kt
index a0a27fac8e..e0ea70735c 100644
--- a/android/app/src/test/java/com/noop/protocol/FramingTest.kt
+++ b/android/app/src/test/java/com/noop/protocol/FramingTest.kt
@@ -509,7 +509,7 @@ class FramingTest {
         val parsed = Framing.parseFrame(frame, DeviceFamily.WHOOP5)
         assertEquals("CONSOLE_LOGS", parsed.typeName)
         assertEquals(true, parsed.crcOk)
-        assertEquals("Historical Data\n 55, 2581959: BLE: hist transfer s", parsed.parsed["console"])
+        assertEquals("Historical Data\n 55, 2581959: BLE: hist transfer s", parsed.parsed["log"])
         // Record header (Swift parity: decodeWhoop5ConsoleLogs): per-chunk counter + batch time.
         assertEquals(671, parsed.parsed["record_index"])
         assertEquals(1773607251, parsed.parsed["unix"])
@@ -538,8 +538,8 @@ class FramingTest {
         assertEquals(true, b.crcOk)
         assertEquals(685, a.parsed["record_index"])
         assertEquals(686, b.parsed["record_index"])
-        assertEquals("19, 146552119: BLE: hist transfer start response a", a.parsed["console"])
-        assertEquals("ck, start burst\n 19, 146554630: BLE: History burst", b.parsed["console"])
+        assertEquals("19, 146552119: BLE: hist transfer start response a", a.parsed["log"])
+        assertEquals("ck, start burst\n 19, 146554630: BLE: History burst", b.parsed["log"])
     }
 
     // MARK: - CONSOLE_LOGS text-region hardening edges (synthetic frames, Swift parity)
@@ -565,7 +565,7 @@ class FramingTest {
     fun whoop5_consoleLogs_oversizedTextCappedAt2048() {
         val f = consoleFrame(ByteArray(2100) { 'A'.code.toByte() })
         val p = Framing.parseFrame(f, DeviceFamily.WHOOP5)
-        assertEquals(2048, (p.parsed["console"] as String).length)
+        assertEquals(2048, (p.parsed["log"] as String).length)
     }
 
     /** An all-NUL (padding-only) text region trims to empty -> no `console` key, not an empty string. */
@@ -573,7 +573,7 @@ class FramingTest {
     fun whoop5_consoleLogs_allNulRegionYieldsNoConsole() {
         val f = consoleFrame(ByteArray(6))
         val p = Framing.parseFrame(f, DeviceFamily.WHOOP5)
-        assertNull(p.parsed["console"])
+        assertNull(p.parsed["log"])
     }
 
     /** Only TRAILING NULs are trimmed; the text before them is kept verbatim. */
@@ -581,6 +581,6 @@ class FramingTest {
     fun whoop5_consoleLogs_trailingNulsTrimmed() {
         val f = consoleFrame("AB".toByteArray() + byteArrayOf(0, 0, 0))
         val p = Framing.parseFrame(f, DeviceFamily.WHOOP5)
-        assertEquals("AB", p.parsed["console"])
+        assertEquals("AB", p.parsed["log"])
     }
 }

From e89a4bc733d077f63f46935d8e18d05784a5eda5 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 18:03:04 +1200
Subject: [PATCH 032/333] test(protocol): the v18 R-R cross-check asserted on
 literals and could not fail (#1698)

The v18 test's "R-R is internally consistent with the heart rate" check computed
`Double(602 + 613) / 2.0` and compared it to a literal 102. Both sides constants: it could
not fail, could not detect anything, and read as though the decoder's R-R were checked
against its own HR. The WHOOP 4.0 test next door always did it properly; the Kotlin v18 test
had no such check at all, so even a real one would have guarded a single platform.

Both now read the parse, in the 4.0 test's shape.

BE PRECISE ABOUT WHAT THAT BUYS, because my own first description of this PR overstated it.
The assertions directly above already pin rr_intervals to [602, 613] and heart_rate to 102,
so a wrong offset or width fails THOSE first and the cross-check adds no detection power
over a decode regression. What it guards is the PINS: a decoder change "fixed" by
regenerating expected values until the suite is green - the usual way a golden stops meaning
anything - has to produce numbers that are still physiologically coherent. A check on the
maintenance of the test, which the literal form could not make, since a constant compared to
a constant survives any update to either.

WHAT IT STILL CANNOT DO, written in both files because the absence of that sentence is part
of how #1505 arose. It does not discriminate UNITS and tightening will not make it:
milliseconds and 1/1024-s ticks differ by 2.4%, about 2.5 bpm here, less than a two-beat
sample varies against a heart_rate averaged over the record. On this record the SHIPPED ms
reading is the worse fit - 98.8 against 101.1 bpm - so any tolerance admitting current
behaviour admits the alternative. The units question was settled from 151 real multi-interval
v18 records decoded out of an HCI capture, where ms fits better on 86%; not from here.

THE TOLERANCE IS BOUNDED FROM BOTH SIDES AND FITTED TO ONE RECORD. It must exceed 3.2, this
frame's real error under the shipped reading, or it fails on correct data; it must stay far
below the ~96 bpm a misread offset produces, or it stops being a sanity check. And it does
not generalise: `secondDeviceHR63` (hr 63, one interval of 1020) computes 58.8 bpm, an error
of 4.18, so copying this assertion there fails at this tolerance. Both files say so, because
extending coverage is the obvious next move and that failure would look like a decode bug.

Also recorded from decoding those extra vectors, since it cuts against the units conclusion
rather than for it: that single-interval record favours TICKS, 2.76 against 4.18, where the
oracle's two single-interval records favour ms. Three such records, split 2-1 - the noise the
issue's author predicted when he said they cannot discriminate. It changes nothing about the
151-record result and omitting it would repeat the mistake this work corrected.

Parity checked from the code: both platforms decode the SAME frame, byte-for-byte identical
hex, with the same tolerance, the same empty-R-R guard and the same rationale. Argument order
differs only by each platform's assertion convention.

Swift package 642 tests 0 failures, Kotlin v18 suite 19 tests 0 failures, doc_comment_lint
OK. Tests and comments only - no decoder touched, so no behaviour change and no app-target
Swift.
---
 .../Whoop5HistoricalTests.swift               | 36 +++++++++++++++++--
 .../protocol/Whoop5HistoricalDecodeTest.kt    | 25 +++++++++++++
 2 files changed, 58 insertions(+), 3 deletions(-)

diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5HistoricalTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5HistoricalTests.swift
index d07b79377b..09d329953a 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5HistoricalTests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5HistoricalTests.swift
@@ -50,9 +50,39 @@ final class Whoop5HistoricalTests: XCTestCase {
         let gz = f.parsed["gravity_z"]?.doubleValue ?? 0
         XCTAssertEqual((gx * gx + gy * gy + gz * gz).squareRoot(), 1.0, accuracy: 0.05)
 
-        // R-R is internally consistent with the heart rate (60000 / mean(R-R) ≈ bpm).
-        let meanRR = Double(602 + 613) / 2.0
-        XCTAssertEqual(60000.0 / meanRR, 102, accuracy: 8)
+        // Physiological cross-check: 60000 / mean(R-R) ≈ heart_rate — read from the PARSE, not from
+        // literals. It used to compute `Double(602 + 613) / 2.0` against a literal 102, a constant
+        // expression that could not fail. Same shape as the WHOOP 4.0 test next door.
+        //
+        // Be precise about what this adds, because the pins above already fix both values: a wrong
+        // offset or width fails `rr_intervals` / `heart_rate` FIRST, so this catches nothing the pins
+        // do not. What it guards is the PINS THEMSELVES. If a decoder change is "fixed" by regenerating
+        // the expected values until they are green — the usual way a golden stops meaning anything —
+        // this fails unless the new values are still physiologically coherent. That is a check on the
+        // maintenance of the test, not on the decode, and it is the one the literal form could not make.
+        //
+        // The tolerance does NOT discriminate UNITS, and tightening it will not make it. #1505 asked
+        // whether v18 R-R is milliseconds or 1/1024-s ticks — the two readings differ by 2.4%, which at
+        // this heart rate is ~2.5 bpm, while a two-beat sample legitimately varies more than that against
+        // a heart_rate averaged over the record. On this record the ms reading is the WORSE fit (98.8 vs
+        // 101.1 bpm), so any tolerance admitting the shipped behaviour admits the alternative too.
+        // The units question was settled from 151 real multi-interval v18 records in an HCI capture,
+        // where ms fits better on 86% — not from here, and this check should not be read as evidence.
+        let rr = f.parsed["rr_intervals"]?.intArrayValue ?? []
+        XCTAssertFalse(rr.isEmpty, "no R-R decoded — the cross-check below would be vacuous")
+        let meanRR = Double(rr.reduce(0, +)) / Double(rr.count)
+        let hr = f.parsed["heart_rate"]?.intValue ?? 0
+        // Tolerance 4, and it is bounded from BOTH sides rather than picked. It must exceed 3.2, which
+        // is this record's real error under the shipped reading (98.8 against a heart_rate of 102) — a
+        // two-beat sample against a rate averaged over the record simply differs by that much, so
+        // anything tighter fails on CORRECT data. And it must stay far below the ~96 bpm a misread
+        // offset or width produces, or it stops being a sanity check. Do not tighten it to look
+        // stricter: the next value down fails the very frame this test decodes.
+        // Fitted to THIS record, not a general invariant. The repo's other real v18 vector
+        // (`secondDeviceHR63` in the Kotlin suite: hr 63, a single interval of 1020) computes 58.8 bpm,
+        // an error of 4.18 — so copying this assertion onto that frame fails at this tolerance, and the
+        // right response there is a wider bound with its own justification, not a wider bound here.
+        XCTAssertEqual(60000.0 / meanRR, Double(hr), accuracy: 4)
     }
 
     func testHistoricalV18BiometricFields() {
diff --git a/android/app/src/test/java/com/noop/protocol/Whoop5HistoricalDecodeTest.kt b/android/app/src/test/java/com/noop/protocol/Whoop5HistoricalDecodeTest.kt
index b2fe817e3e..1eaab99396 100644
--- a/android/app/src/test/java/com/noop/protocol/Whoop5HistoricalDecodeTest.kt
+++ b/android/app/src/test/java/com/noop/protocol/Whoop5HistoricalDecodeTest.kt
@@ -39,6 +39,31 @@ class Whoop5HistoricalDecodeTest {
         assertEquals(2, p["rr_count"])
         assertEquals(listOf(602, 613), p["rr_intervals"])
 
+        // Physiological cross-check: 60000 / mean(R-R) ≈ heart_rate, from the PARSE rather than literals.
+        // Twin of the Swift `testHistoricalV18HeartRateRRAndGravity` check, which this side never had.
+        //
+        // The pins above already fix both values, so this catches nothing a wrong offset would not
+        // already trip. What it guards is the PINS: a decoder change "fixed" by regenerating the
+        // expected values until they pass has to produce numbers that are still physiologically
+        // coherent. See the Swift twin for the fuller note.
+        //
+        // It does NOT discriminate UNITS and tightening it will not make it: milliseconds and 1/1024-s
+        // ticks differ by 2.4% (~2.5 bpm here), less than a two-beat sample varies against a heart_rate
+        // averaged over the record. See the Swift twin for why, and where the units question was settled.
+        @Suppress("UNCHECKED_CAST")
+        val rr = p["rr_intervals"] as List<Int>
+        assertTrue("no R-R decoded — the cross-check below would be vacuous", rr.isNotEmpty())
+        val meanRr = rr.sum().toDouble() / rr.size
+        // Delta 4.0, bounded from both sides rather than picked: it must exceed this record's real
+        // 3.2 bpm error under the shipped reading (a two-beat sample against an averaged heart_rate
+        // differs by that much, so anything tighter fails on CORRECT data), and stay well below the
+        // ~96 bpm a misread offset produces. Do not tighten it to look stricter.
+        // Fitted to THIS record, not a general invariant. `secondDeviceHR63` below (hr 63, a single
+        // interval of 1020) computes 58.8 bpm, an error of 4.18 — so copying this assertion onto that
+        // frame fails at this tolerance. A single interval against an averaged rate is simply noisier;
+        // widen it there with its own reason rather than loosening this one.
+        assertEquals((p["heart_rate"] as Int).toDouble(), 60_000.0 / meanRr, 4.0)
+
         val gx = p["gravity_x"] as Double
         val gy = p["gravity_y"] as Double
         val gz = p["gravity_z"] as Double

From 7a8d0b61ab0192fffc1a09f37fca65fd4525c35e Mon Sep 17 00:00:00 2001
From: Zebsi <66969936+Zebsi235@users.noreply.github.com>
Date: Fri, 28 Aug 2026 08:08:33 +0200
Subject: [PATCH 033/333] tooling: doc_comment_lint keys the baseline on
 OS-native paths, so it fails on a clean tree on Windows (#1691)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Thanks to @Zebsi235, who found this by trying to follow the "run doc_comment_lint locally"
guidance and hitting a wall that only exists on Windows.

`Tools/doc_comment_lint.py` built its baseline key with `str(path.relative_to(ROOT))`, which
yields OS-native separators. The baseline file is written with forward slashes, so on Windows
every lookup missed. On a completely clean checkout the gate then exited 1 with "FAIL 25
detached doc comment(s) beyond the baseline" while simultaneously printing all 13 baselined
files as "IMPROVED n -> 0. Lower it in doc_comment_lint_baseline.txt".

The two messages point opposite ways, and the natural reading is that the baseline is stale
and should be regenerated - which the script's own comment forbids, and which would have
erased the grandfathered sites. A contributor following that instinct makes it worse. CI runs
on ubuntu so it stayed green; only a Windows contributor saw it, and only while hunting 25
regressions they did not cause.

`as_posix()` is the one-line fix. Verified it is a genuine no-op on POSIX rather than
something that hides findings: the gate still reports 25 baselined sites, the same count as
before.

THE SECOND FILE IS MINE, NOT SCOPE CREEP. Tools/test_home_i18n.py was FAILING on main - 108
tests, 1 failure - because #1671 moved the sign and the hardcoded °C out of that localized
literal into UnitFormatter.skinTempSignalPhrase. tools-python.yml is path-filtered to
Tools/*.py, my commit touched only Swift, so the workflow never ran and the break sat there.
Touching Tools/ is what made it run, surfacing my breakage as a red check on someone else's
PR. Repairing it rather than working around it was the right call.

That filter is the real gap and it is being taken separately: the test asserts on the contents
of Strand/App/AppModel.swift, Strand/Resources/Localizable.xcstrings,
Packages/StrandAnalytics/.../ReadinessEngine.swift and others, none of which trigger the
workflow. Any Swift change to a file it reads can break it silently until someone happens to
touch Tools/.

Verified: main 108 tests 1 failure, this branch 108 tests 0 failures; doc_comment_lint OK with
the baseline count unchanged.
---
 Tools/doc_comment_lint.py | 6 +++++-
 Tools/test_home_i18n.py   | 6 ++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/Tools/doc_comment_lint.py b/Tools/doc_comment_lint.py
index a82755c2a6..b25c32c920 100644
--- a/Tools/doc_comment_lint.py
+++ b/Tools/doc_comment_lint.py
@@ -130,7 +130,11 @@ def main() -> int:
             scanned += 1
             found = findings(path)
             if found:
-                rel = str(path.relative_to(ROOT))
+                # as_posix(), not str(): the baseline is written with forward slashes, so on Windows
+                # str() yields "android\app\..." and every baseline lookup misses. That made the gate fail
+                # on a clean tree there (every grandfathered site read as a regression, and every
+                # baselined file as IMPROVED -> 0), so a Windows contributor could not run it locally.
+                rel = path.relative_to(ROOT).as_posix()
                 by_file[rel] = [f"{rel}:{ln}  {why}" for ln, why in found]
 
     regressions = [h for f, hs in sorted(by_file.items())
diff --git a/Tools/test_home_i18n.py b/Tools/test_home_i18n.py
index ce2da56f11..8c140b7ba8 100644
--- a/Tools/test_home_i18n.py
+++ b/Tools/test_home_i18n.py
@@ -505,7 +505,9 @@ def test_apple_home_semantic_display_contracts(self) -> None:
         self.assertNotIn('result.copy.contains("numbers agree")', (ROOT / "Strand/Screens/SkinTempCardsView.swift").read_text(encoding="utf-8"))
         self.assertIn('String(localized: "RHR +\\(delta)")', app_model)
         self.assertIn('String(localized: "HRV −\\(percent)%")', app_model)
-        self.assertIn('String(localized: "Skin temperature +\\(temperature) °C")', app_model)
+        # 240c48ae (#1671): the label now carries the reader's unit via UnitFormatter.skinTempSignalPhrase,
+        # so the sign and the hardcoded °C moved out of the localized literal.
+        self.assertIn('String(localized: "Skin temperature \\(temperature)")', app_model)
         self.assertIn('String(localized: "Respiration up")', app_model)
 
         self.assertIn("public enum Evidence", readiness)
@@ -521,7 +523,7 @@ def test_apple_home_semantic_display_contracts(self) -> None:
 
         strings = audit.load_catalog(ROOT / "Strand/Resources/Localizable.xcstrings")["strings"]
         for key in (
-            "RHR +%lld", "HRV −%lld%%", "Skin temperature +%@ °C", "Respiration up",
+            "RHR +%lld", "HRV −%lld%%", "Skin temperature %@", "Respiration up",
             "%@ vs %@ %@", "7d %@ / 28d %@", "monotony %@",
         ):
             self.assertIn(key, strings)

From ad4164fad0351a49e75ada6f416cd415eed512c8 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 18:18:18 +1200
Subject: [PATCH 034/333] ci: gates that never ran on the change they were
 written to catch (#1699)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three workflows were path-filtered to a subset of the files their tests read.

tools-python.yml fired only on Tools/**, but test_home_i18n.py asserts on 33 paths
across the repo; a change to those screens broke it on main and merged green. Filter
removed — the job is 25 seconds and its real surface is most of the repo.

android.yml and swift-packages.yml were worse. Their twin-drift guards deliberately
read the OTHER platform's fixture — DecoderOracleTest compares both committed decoder
oracles precisely to catch a one-sided edit — yet neither workflow fired when only the
other side changed. The tests were written, passing, and structurally unable to run at
the one moment they existed for. Both filters now name the cross-boundary fixtures.

Widened rather than removed because these jobs cost minutes, not seconds; the trade-off
is that the list must track the assertions, and a comment in each file says so.
---
 .github/workflows/android.yml        | 16 ++++++++++++++++
 .github/workflows/swift-packages.yml | 10 ++++++++++
 .github/workflows/tools-python.yml   | 23 +++++++++++++----------
 3 files changed, 39 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index e650d7af6a..467e4759b8 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -12,11 +12,27 @@ on:
     paths:
       - 'android/**'
       - '.github/workflows/android.yml'
+      # The twin-drift guards read the SWIFT side's fixtures on purpose — DecoderOracleTest compares
+      # against Packages/.../decoder_oracle.json to catch a one-sided edit, and the schema/protocol
+      # oracles work the same way. Without these, editing the Swift copy alone leaves the very test
+      # written to catch that from ever running. Keep this list in step with what the tests read.
+      - 'Packages/WhoopProtocol/Sources/WhoopProtocol/Resources/**'
+      - 'Packages/WhoopProtocol/Tests/WhoopProtocolTests/Resources/**'
+      - 'Packages/WhoopStore/Tests/WhoopStoreTests/Resources/**'
+      - 'Strand/Resources/Localizable.xcstrings'
   push:
     branches: [main]
     paths:
       - 'android/**'
       - '.github/workflows/android.yml'
+      # The twin-drift guards read the SWIFT side's fixtures on purpose — DecoderOracleTest compares
+      # against Packages/.../decoder_oracle.json to catch a one-sided edit, and the schema/protocol
+      # oracles work the same way. Without these, editing the Swift copy alone leaves the very test
+      # written to catch that from ever running. Keep this list in step with what the tests read.
+      - 'Packages/WhoopProtocol/Sources/WhoopProtocol/Resources/**'
+      - 'Packages/WhoopProtocol/Tests/WhoopProtocolTests/Resources/**'
+      - 'Packages/WhoopStore/Tests/WhoopStoreTests/Resources/**'
+      - 'Strand/Resources/Localizable.xcstrings'
   workflow_dispatch:
 
 concurrency:
diff --git a/.github/workflows/swift-packages.yml b/.github/workflows/swift-packages.yml
index c46bb25628..cb46672dcf 100644
--- a/.github/workflows/swift-packages.yml
+++ b/.github/workflows/swift-packages.yml
@@ -16,6 +16,11 @@ on:
       - 'Tools/SleepPSG/**'
       - 'Tools/Backfill/**'
       - '.github/workflows/swift-packages.yml'
+      # Mirror of the note in android.yml: package tests read the ANDROID oracles to catch a one-sided
+      # edit, and one reads Strand/Liquid/LiquidCore.swift. Editing only that side would otherwise skip
+      # the guard written for exactly that case. Keep in step with what the tests read.
+      - 'android/app/src/test/resources/**'
+      - 'Strand/Liquid/LiquidCore.swift'
   push:
     branches: [main]
     paths:
@@ -24,6 +29,11 @@ on:
       - 'Tools/SleepPSG/**'
       - 'Tools/Backfill/**'
       - '.github/workflows/swift-packages.yml'
+      # Mirror of the note in android.yml: package tests read the ANDROID oracles to catch a one-sided
+      # edit, and one reads Strand/Liquid/LiquidCore.swift. Editing only that side would otherwise skip
+      # the guard written for exactly that case. Keep in step with what the tests read.
+      - 'android/app/src/test/resources/**'
+      - 'Strand/Liquid/LiquidCore.swift'
   workflow_dispatch:
 
 concurrency:
diff --git a/.github/workflows/tools-python.yml b/.github/workflows/tools-python.yml
index fc18f4429a..f0910c8e16 100644
--- a/.github/workflows/tools-python.yml
+++ b/.github/workflows/tools-python.yml
@@ -5,23 +5,26 @@
 # one of them only ever executed when a contributor remembered to, which meant a decoder could regress and
 # the suite that would have caught it stayed green by never being run.
 #
-# Cheap to run: pure stdlib `unittest`, no dependencies, no fixtures to fetch, ubuntu rather than macOS.
-# Path-filtered so it only fires when the suites it runs change.
+# Cheap to run: pure stdlib `unittest`, no dependencies, no fixtures to fetch, ubuntu rather than macOS —
+# about 25 seconds end to end.
+#
+# NOT path-filtered, and that is deliberate. It used to fire only on `Tools/**.py`, on the premise that a
+# suite can only break when its own source changes. That is false for `test_home_i18n.py`, which asserts
+# on the CONTENTS of app and package files — AppModel.swift, the xcstrings catalogues, ReadinessEngine,
+# DayNavBar. A Swift-only commit broke it (#1671 moved a sign and a hardcoded °C out of a localized
+# literal) and the filter meant this job never ran, so `main` sat red until a contributor touching
+# `Tools/` for something unrelated tripped over it in their own PR (#1691).
+#
+# Widening the filter to name those paths would just re-create the trap one edit later: the list is
+# whatever the assertions happen to read today. Twenty-five seconds on every PR is cheaper than a gate
+# that is green because it did not run.
 name: Tools Python CI
 
 on:
   pull_request:
     branches: [main]
-    paths:
-      - 'Tools/linux-capture/**'
-      - 'Tools/*.py'
-      - '.github/workflows/tools-python.yml'
   push:
     branches: [main]
-    paths:
-      - 'Tools/linux-capture/**'
-      - 'Tools/*.py'
-      - '.github/workflows/tools-python.yml'
   workflow_dispatch:
 
 concurrency:

From d88fd19ea0743c7d9eda99b3882054c79344a2d9 Mon Sep 17 00:00:00 2001
From: Bernd Helm <bhelm@users.noreply.github.com>
Date: Fri, 28 Aug 2026 08:38:14 +0200
Subject: [PATCH 035/333] Add experimental self-hosted one-way push on Android
 (#1631)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Android-first, default-off Experimental export that keeps a fresh copy of NOOP data on a
machine the user owns. Contributed by @bhelm, to the boundary agreed in #1314.

The scope conditions were checked against the code rather than the description:

- Off by default. enqueueExternal returns before WorkManager, Room, or the Keystore are
  touched, and the secrets store is lazy, so a user who never enables it pays one plain
  SharedPreferences boolean read per offload. No new permission — INTERNET was already
  present for the AI Coach.
- One-way. PushCapabilities.parse lets a receiver only narrow a fixed client-side stream
  registry; unknown names throw and remote-control members are rejected outright. The
  receiver cannot add schemas or drive phone state.
- Out of the strap-sync path. The existing HISTORY_COMPLETE hooks keep their stricter
  semantics; the new sink is fire-and-forget beside them.
- Client and versioned format only, no receiver. SCOPE.md records the exception.

Security worth calling out: the endpoint policy validates the resolved InetAddress rather
than the host string, so 2130706433, 127.1, and [::ffff:8.8.8.8] cannot smuggle a public
address past the plain-HTTP rule. The append cursor carries a natural-key fingerprint and
re-reads the row at the stored rowid, which defends the rowid reuse that device-forget and
timestamp-prune deletes make reachable on all eight append tables.

Verified locally on the merged branch: 4,469 unit tests, 0 failures, run with
--rerun-tasks --no-build-cache.

Merging with two known gaps, tracked in an immediate follow-up: nine endpoint-validation
strings and one scheduler error reach the UI as hardcoded English, invisible to the i18n
gate because it only sees literals inside @Composable functions; and
ValidEndpoint.requiresLocalAddress is set but never read.

The doc conflict this carried was semantic — main had since given §1.1c to the update
check. Push is renumbered to §1.1d, and the claims main states absolutely are narrowed,
since a standing export makes "your data never leaves the device" untrue.
---
 CLAUDE.md                                     |  12 +-
 README.md                                     |  12 +-
 SECURITY.md                                   |  21 +-
 android/README.md                             |  15 +-
 android/app/src/main/AndroidManifest.xml      |   8 +-
 .../src/main/java/com/noop/NoopApplication.kt |  13 +-
 .../app/src/main/java/com/noop/ai/AiCoach.kt  |   8 +-
 .../main/java/com/noop/ble/WhoopBleClient.kt  |  12 +-
 .../main/java/com/noop/data/SecurePrefs.kt    |  11 +-
 .../main/java/com/noop/data/WhoopDatabase.kt  |   4 +
 .../noop/push/EndpointScopedProgressStore.kt  |  28 +
 .../java/com/noop/push/PushCapabilities.kt    | 101 +++
 .../java/com/noop/push/PushCoordinator.kt     | 297 ++++++++
 .../src/main/java/com/noop/push/PushDao.kt    | 262 +++++++
 .../java/com/noop/push/PushEndpointPolicy.kt  |  72 ++
 .../main/java/com/noop/push/PushFailure.kt    | 151 ++++
 .../java/com/noop/push/PushHttpTransport.kt   | 155 ++++
 .../src/main/java/com/noop/push/PushModels.kt | 189 +++++
 .../main/java/com/noop/push/PushProtocol.kt   | 542 ++++++++++++++
 .../main/java/com/noop/push/PushRunSignal.kt  | 123 ++++
 .../main/java/com/noop/push/PushWorkerGate.kt |  23 +
 .../com/noop/push/SelfHostedPushScheduler.kt  | 164 +++++
 .../com/noop/push/SelfHostedPushScreen.kt     | 367 ++++++++++
 .../com/noop/push/SelfHostedPushSettings.kt   | 299 ++++++++
 .../com/noop/push/SelfHostedPushWorker.kt     | 313 ++++++++
 .../noop/push/SharedPrefsPushProgressStore.kt | 100 +++
 .../app/src/main/java/com/noop/ui/AppRoot.kt  |   5 +
 .../src/main/java/com/noop/ui/MainActivity.kt |   7 +
 .../main/java/com/noop/ui/SettingsScreen.kt   |  14 +
 .../app/src/main/res/values-de/strings.xml    |  73 ++
 .../app/src/main/res/values-es/strings.xml    |  73 ++
 .../app/src/main/res/values-fr/strings.xml    |  73 ++
 .../app/src/main/res/values-pl/strings.xml    |  73 ++
 .../src/main/res/values-pt-rPT/strings.xml    |  73 ++
 .../app/src/main/res/values-zh/strings.xml    |  73 ++
 android/app/src/main/res/values/strings.xml   |  74 ++
 .../com/noop/ble/SuccessfulOffloadHookTest.kt |  15 +
 .../push/EndpointScopedProgressStoreTest.kt   |  26 +
 .../java/com/noop/push/PushCoordinatorTest.kt | 675 ++++++++++++++++++
 .../test/java/com/noop/push/PushCursorTest.kt | 120 ++++
 .../com/noop/push/PushDaoPreflightTest.kt     |  39 +
 .../com/noop/push/PushEndpointPolicyTest.kt   |  57 ++
 .../noop/push/PushHttpTransportPolicyTest.kt  | 289 ++++++++
 .../java/com/noop/push/PushProtocolTest.kt    | 196 +++++
 .../java/com/noop/push/PushRunSignalTest.kt   |  78 ++
 .../com/noop/push/PushTransportFailureTest.kt |  53 ++
 .../java/com/noop/push/PushWorkerGateTest.kt  |  42 ++
 .../noop/push/SelfHostedPushSchedulerTest.kt  |  50 ++
 .../noop/push/SelfHostedPushSettingsTest.kt   | 212 ++++++
 .../push/SelfHostedPushWorkerPolicyTest.kt    |  48 ++
 docs/CONTRIBUTING.md                          |  16 +-
 docs/FAQ.md                                   |  16 +-
 docs/PRIVACY_SECURITY.md                      |  84 ++-
 docs/PUSH_PROTOCOL.md                         | 393 ++++++++++
 docs/SCOPE.md                                 |  37 +-
 55 files changed, 6208 insertions(+), 78 deletions(-)
 create mode 100644 android/app/src/main/java/com/noop/push/EndpointScopedProgressStore.kt
 create mode 100644 android/app/src/main/java/com/noop/push/PushCapabilities.kt
 create mode 100644 android/app/src/main/java/com/noop/push/PushCoordinator.kt
 create mode 100644 android/app/src/main/java/com/noop/push/PushDao.kt
 create mode 100644 android/app/src/main/java/com/noop/push/PushEndpointPolicy.kt
 create mode 100644 android/app/src/main/java/com/noop/push/PushFailure.kt
 create mode 100644 android/app/src/main/java/com/noop/push/PushHttpTransport.kt
 create mode 100644 android/app/src/main/java/com/noop/push/PushModels.kt
 create mode 100644 android/app/src/main/java/com/noop/push/PushProtocol.kt
 create mode 100644 android/app/src/main/java/com/noop/push/PushRunSignal.kt
 create mode 100644 android/app/src/main/java/com/noop/push/PushWorkerGate.kt
 create mode 100644 android/app/src/main/java/com/noop/push/SelfHostedPushScheduler.kt
 create mode 100644 android/app/src/main/java/com/noop/push/SelfHostedPushScreen.kt
 create mode 100644 android/app/src/main/java/com/noop/push/SelfHostedPushSettings.kt
 create mode 100644 android/app/src/main/java/com/noop/push/SelfHostedPushWorker.kt
 create mode 100644 android/app/src/main/java/com/noop/push/SharedPrefsPushProgressStore.kt
 create mode 100644 android/app/src/test/java/com/noop/ble/SuccessfulOffloadHookTest.kt
 create mode 100644 android/app/src/test/java/com/noop/push/EndpointScopedProgressStoreTest.kt
 create mode 100644 android/app/src/test/java/com/noop/push/PushCoordinatorTest.kt
 create mode 100644 android/app/src/test/java/com/noop/push/PushCursorTest.kt
 create mode 100644 android/app/src/test/java/com/noop/push/PushDaoPreflightTest.kt
 create mode 100644 android/app/src/test/java/com/noop/push/PushEndpointPolicyTest.kt
 create mode 100644 android/app/src/test/java/com/noop/push/PushHttpTransportPolicyTest.kt
 create mode 100644 android/app/src/test/java/com/noop/push/PushProtocolTest.kt
 create mode 100644 android/app/src/test/java/com/noop/push/PushRunSignalTest.kt
 create mode 100644 android/app/src/test/java/com/noop/push/PushTransportFailureTest.kt
 create mode 100644 android/app/src/test/java/com/noop/push/PushWorkerGateTest.kt
 create mode 100644 android/app/src/test/java/com/noop/push/SelfHostedPushSchedulerTest.kt
 create mode 100644 android/app/src/test/java/com/noop/push/SelfHostedPushSettingsTest.kt
 create mode 100644 android/app/src/test/java/com/noop/push/SelfHostedPushWorkerPolicyTest.kt
 create mode 100644 docs/PUSH_PROTOCOL.md

diff --git a/CLAUDE.md b/CLAUDE.md
index e8109a7737..c39986bb52 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -7,14 +7,18 @@ and [`docs/IOS.md`](docs/IOS.md) covers the iOS target. Read this first; follow
 
 ## What NOOP is (and the hard scope limits)
 
-NOOP is a **fully offline, on-device** companion app for WHOOP 4.0 and 5.0/MG straps (with
+NOOP is an **offline-by-default, on-device** companion app for WHOOP 4.0 and 5.0/MG straps (with
 **experimental** Oura support in the tree — gated behind `ExperimentalBrand`, not a shipped supported
 strap). It pairs over Bluetooth, stores everything in on-device SQLite, and computes recovery / strain
-/ HRV / sleep locally. There is **no server, no account, no cloud sync, no telemetry**, and the project stays
-**anonymous** (iOS/Android ship build-from-source / sideload, not via the App Store).
+/ HRV / sleep locally. There is **no NOOP-operated server, no account, no cloud dependency, no
+telemetry**, and the project stays **anonymous** (iOS/Android ship build-from-source / sideload, not
+via the App Store). Issue #1314 permits one narrow exception: a default-off Experimental client may
+export data one way to an HTTP(S) endpoint the user owns and configures. It must remain outside strap
+sync, never read data back, and ship no receiver or hosted service in this repository.
 
 These are hard constraints, not preferences. A PR is out of scope if it:
-- adds a server, account, cloud sync, or sends any data off-device;
+- adds a server, account, cloud dependency, or sends data off-device without the explicit user export
+  boundary in [`docs/SCOPE.md`](docs/SCOPE.md) (including #1314's one-way self-hosted push);
 - adds analytics/telemetry/crash-reporting that phones home;
 - adds WHOOP firmware, decompiled app code, logos/assets, or any DRM circumvention. NOOP is
   **clean-room interoperability** with hardware the user owns — keep it that way. (That bars
diff --git a/README.md b/README.md
index 806463cf88..21385fce50 100644
--- a/README.md
+++ b/README.md
@@ -95,7 +95,7 @@ Pre-built apps you can run right now:
 
 Prefer to build it yourself? See [`docs/BUILD.md`](docs/BUILD.md).
 
-Everything runs **offline** — your data never leaves the device. NOOP makes only two kinds of network request, both described in [`docs/PRIVACY_SECURITY.md`](docs/PRIVACY_SECURITY.md): the optional **AI Coach** (off until you add your own API key), and a once-a-day check for a newer release, which sends nothing about you and never installs anything. Turn the check off in Settings → About and it makes no request at all.
+Everything runs **offline by default** — nothing about you leaves the device unless you switch on a feature that sends it. NOOP makes only three kinds of network request, all described in [`docs/PRIVACY_SECURITY.md`](docs/PRIVACY_SECURITY.md): the optional **AI Coach** (off until you add your own API key), a once-a-day check for a newer release, which sends nothing about you and never installs anything, and Android's default-off Experimental one-way **push** to an endpoint you own. Turn the check off in Settings → About and it makes no request at all. NOOP operates no server, account, or telemetry service.
 
 ---
 
@@ -187,7 +187,7 @@ shared cross-platform code.
 | **Data Sources** | One-tap import of a WHOOP CSV export, an Apple Health export, or a **nutrition CSV** (Cronometer / MacroFactor), plus live-strap status. "Bring your history in once, then it's yours." |
 | **Notifications** | Configure local notifications and thresholds (`Strand/Data/NotificationSettingsStore.swift`). |
 | **Automations** | Turn the strap's physical inputs and live biometrics into Mac actions — all on-device (see below). |
-| **Coach** | An optional **AI Coach** you can ask about your data in plain language. It's the one feature that can ever send anything about your data over the network: off until you add your own key — Anthropic, OpenAI, or any OpenAI-compatible endpoint including a local/self-hosted model (Ollama, LM Studio) — and it sends only a short text summary of recent metrics plus your question, never raw streams or identifiers. With a local model the conversation never leaves your machine. Available on macOS, Android, and iOS. See [`docs/PRIVACY_SECURITY.md`](docs/PRIVACY_SECURITY.md). |
+| **Coach** | An optional **AI Coach** you can ask about your data in plain language. It is off until you add your own key — Anthropic, OpenAI, or any OpenAI-compatible endpoint including a local/self-hosted model (Ollama, LM Studio) — and it sends only a short text summary of recent metrics plus your question, never raw streams or identifiers. With a local model the conversation never leaves your machine. Available on macOS, Android, and iOS. See [`docs/PRIVACY_SECURITY.md`](docs/PRIVACY_SECURITY.md). |
 | **Settings** | Profile, preferences, **step calibration** (tune the stride/step estimate to your own walking), unit choices, the in-app **What's new** changelog, and an opt-in **Experimental** section (WHOOP 5/MG protocol probes). On **iOS**, also **Export for Shortcuts** — a HealthKit-free path that hands your metrics to Apple Health via the Shortcuts app. |
 
 There is also a **menu-bar extra** (`Strand/MenuBar/MenuBarContent.swift`) with a
@@ -521,9 +521,11 @@ Every arrow stays on your machine.
 
 ## Privacy
 
-**Offline by design.** NOOP has no server, no telemetry, and no account. Your
-strap data, imports, and computed metrics live in a local SQLite database on your
-device and never leave it.
+**Offline by default.** NOOP has no server, no telemetry, and no account. Your strap data, imports,
+and computed metrics live in a local SQLite database on your device. They leave only through an
+export or optional network feature you deliberately configure, including Android's default-off
+Experimental one-way push to your own endpoint; see
+[`docs/PRIVACY_SECURITY.md`](docs/PRIVACY_SECURITY.md).
 
 The app makes two kinds of network request, neither carrying anything about you: the optional
 **AI Coach** (off until you add your own key), and a once-a-day read of the latest release number so a
diff --git a/SECURITY.md b/SECURITY.md
index be3eeaa13d..13a74a9559 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,18 +2,25 @@
 
 ## Scope
 
-NOOP is a fully offline, on-device app. It has no servers, no accounts, and no
-cloud sync, so the usual web attack surface does not apply. What remains is local:
+NOOP is an offline-by-default, on-device app. It operates no servers, accounts,
+cloud sync, or telemetry, so the usual hosted-service attack surface does not apply.
+What remains is local or explicitly user-configured:
 
 - **Bluetooth Low Energy** — the link to your WHOOP strap.
 - **Local SQLite database** — every reading is stored on your own device.
 - **File imports** — WHOOP CSV exports and Apple Health ZIP files you choose to open.
-- **AI Coach (optional, off by default)** — the only feature that makes a network
-  request, and only with an API key you supply yourself, to the provider you choose.
-
-A useful security report is one that lets data leave the device when it shouldn't,
+- **AI Coach (optional, off by default)** — sends a compact summary only when asked,
+  with credentials you supply, to the provider you choose.
+- **Self-hosted push (Experimental, Android, off by default)** — sends versioned batches
+  one way to a user-owned endpoint after offload; it never reads records back and never
+  participates in strap sync. A receiver can only narrow the fixed stream registry it accepts.
+  See [`docs/PUSH_PROTOCOL.md`](docs/PUSH_PROTOCOL.md).
+- **Oura history import (compile-time optional)** — pulls from Oura using a developer
+  application and grant supplied by the user; it is absent from default builds.
+
+A useful security report is one that lets data leave the device without the corresponding opt-in,
 lets a malicious strap or crafted import file corrupt the database or run code, or
-otherwise breaks the offline, local-only guarantee the app makes.
+otherwise breaks the offline-by-default or one-way-export guarantees the app makes.
 
 ## Reporting a vulnerability
 
diff --git a/android/README.md b/android/README.md
index baee66a92b..c0a7e48337 100644
--- a/android/README.md
+++ b/android/README.md
@@ -3,7 +3,9 @@
 An **offline WHOOP companion** for Android. NOOP connects directly to a WHOOP 4.0
 (and WHOOP 5.0) strap over Bluetooth Low Energy, reads heart rate, R-R intervals,
 battery, and sensor data, and stores everything **locally** on the device. There is
-no account, no server, and no `INTERNET` permission — nothing leaves the phone.
+no NOOP account, hosted server, or telemetry. Network access exists only for explicit,
+default-off features such as the AI Coach and Experimental one-way push to an endpoint
+the user owns.
 
 This is an independent Kotlin / Jetpack Compose reimplementation of the macOS/iOS
 reference app (`Strand/`, Swift). The protocol, framing, and BLE handshake are
@@ -189,7 +191,12 @@ install side-by-side.
 
 ## Permissions & why
 
-NOOP requests only what BLE needs, and deliberately omits `INTERNET`:
+NOOP requests the platform permissions its local features need. `INTERNET` supports only
+explicit, default-off network features (the AI Coach and Experimental self-hosted push):
+
+- **`INTERNET`** — lets those opt-in clients reach the endpoint the user selected. It is an
+  install-time capability, not evidence of background telemetry; neither feature runs until
+  configured.
 
 - **`BLUETOOTH_SCAN`** (`neverForLocation`) + **`BLUETOOTH_CONNECT`** — Android 12+ (API 31+)
   runtime permissions. `neverForLocation` lets us skip the location grant on modern Android
@@ -257,8 +264,8 @@ phone **and** a WHOOP strap.
 
 **Privacy sanity check:**
 
-- [ ] Confirm the merged manifest contains **no `INTERNET` permission**
-      (`app/build/intermediates/merged_manifests/…`) — the app must stay fully offline.
+- [ ] With AI Coach and self-hosted push unconfigured, confirm no HTTP request is made during
+      launch, BLE collection, offload, analytics, or normal navigation.
 
 ---
 
diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index 6a1734b023..1cbb833bd1 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -3,10 +3,10 @@
     xmlns:tools="http://schemas.android.com/tools">
 
     <!--
-      NOOP is an OFFLINE WHOOP companion. It talks to the strap over BLE and stores
-      everything locally (Room). The ONLY outbound network is the opt-in AI Coach
-      (bring-your-own OpenAI/Anthropic key) — nothing is sent unless the user adds a
-      key and asks a question. Hence the single INTERNET permission below.
+      NOOP is offline by default. It talks to the strap over BLE and stores everything
+      locally (Room). INTERNET supports only explicit opt-ins: the bring-your-own-key
+      AI Coach and Experimental one-way push to a user-owned endpoint. No account,
+      NOOP server, telemetry, or network dependency is introduced by this permission.
     -->
     <uses-permission android:name="android.permission.INTERNET" />
 
diff --git a/android/app/src/main/java/com/noop/NoopApplication.kt b/android/app/src/main/java/com/noop/NoopApplication.kt
index e253344f28..a1b7e8d05c 100644
--- a/android/app/src/main/java/com/noop/NoopApplication.kt
+++ b/android/app/src/main/java/com/noop/NoopApplication.kt
@@ -13,13 +13,15 @@ import com.noop.data.WhoopDatabase
 import com.noop.data.WhoopRepository
 import com.noop.ui.NoopPrefs
 import com.noop.ui.AppLanguagePrefs
+import com.noop.push.SelfHostedPushScheduler
 import kotlinx.coroutines.runBlocking
 
 /**
  * Application entry point.
  *
  * NOOP is a fully on-device WHOOP companion: it connects to the strap over BLE and persists
- * everything locally via Room. There is no network layer (the opt-in AI Coach aside).
+ * everything locally via Room. Network access is opt-in: the AI Coach and the experimental,
+ * one-way self-hosted push are both disabled by default.
  *
  * The data layer ([WhoopRepository]) and the BLE client ([WhoopBleClient]) are owned **here**, at the
  * process level, rather than by the Activity-scoped AppViewModel. That is what lets a connection keep
@@ -71,7 +73,14 @@ class NoopApplication : Application() {
 
     /** Process-wide BLE client. Owns the GATT connection and outlives any single Activity/ViewModel. */
     val ble: WhoopBleClient by lazy {
-        WhoopBleClient(applicationContext, repository = repository, deviceId = activeDeviceId).apply {
+        WhoopBleClient(
+            applicationContext,
+            repository = repository,
+            deviceId = activeDeviceId,
+            successfulOffloadSink = {
+                SelfHostedPushScheduler.enqueueAfterSuccessfulOffload(applicationContext)
+            },
+        ).apply {
             // Apply the persisted "Debug logging" preference at the composition root so the low-level
             // client never has to read the UI/prefs layer. Default OFF — see WhoopBleClient.debugLogcat.
             debugLogcat = NoopPrefs.debugLogging(applicationContext)
diff --git a/android/app/src/main/java/com/noop/ai/AiCoach.kt b/android/app/src/main/java/com/noop/ai/AiCoach.kt
index 68c1a4d5c5..75fa6c9ea0 100644
--- a/android/app/src/main/java/com/noop/ai/AiCoach.kt
+++ b/android/app/src/main/java/com/noop/ai/AiCoach.kt
@@ -24,10 +24,10 @@ import kotlin.math.roundToInt
 /**
  * The AI Coach.
  *
- * Privacy posture: this is the ONE networked feature in the app. Nothing leaves the device
- * until the user has saved their own API key (see [AiKeyStore]) and asked a question. Only a
- * compact plain-text summary of their metrics plus their question is sent to the provider the
- * user picked. No raw samples, no identifiers.
+ * Privacy posture: this is an opt-in networked feature, independent of the default-off Experimental
+ * self-hosted push. Nothing leaves through the Coach until the user has saved their own API key (see
+ * [AiKeyStore]) and asked a question. Only a compact plain-text summary of their metrics plus their
+ * question is sent to the provider the user picked. No raw samples, no identifiers.
  *
  * Anonymous: the only branding is the provider name the user selected. The system prompt does
  * not name any app author or model vendor.
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 78816b4d47..aff7c38b2d 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -430,10 +430,14 @@ class WhoopBleClient(
      * call site unchanged.
      */
     private val gattOpsFactory: (BluetoothGatt) -> GattOps = ::RealGattOps,
+    /** Fire-and-forget notification after a true HISTORY_COMPLETE only. The sink must only enqueue. */
+    private val successfulOffloadSink: () -> Unit = {},
 ) {
 
     companion object {
         private const val TAG = "WhoopBleClient"
+        internal fun shouldNotifySuccessfulOffload(reason: String, bankedRows: Boolean): Boolean =
+            reason == "HISTORY_COMPLETE" || (reason == "timeout" && bankedRows)
         /**
          * Cap on the in-app strap-log ring buffer (for the "Share strap log" diagnostics export).
          * Raised from the old ~1h (2,000 lines) to retain a rolling ~24h of activity (#510 —
@@ -8446,8 +8450,12 @@ class WhoopBleClient(
         backfillDrain.clear()
         closeWhoop5BackfillCapture(flushSummary = true)
         log("Backfill: session ended — reason=$reason")
-        // Inactivity reminder (#419): read-only hook on the natural offload completion (no cadence
-        // change). Only on a true HISTORY_COMPLETE — a timeout/disconnect didn't bring a fresh window.
+        // Downstream export also treats a WHOOP 4 idle timeout with persisted rows as successful: that
+        // firmware routinely finishes productive offloads without emitting HISTORY_COMPLETE.
+        if (shouldNotifySuccessfulOffload(reason, persistedSensorRows)) {
+            runCatching { successfulOffloadSink() }
+        }
+        // Existing inactivity/stress/nap hooks retain their stricter HISTORY_COMPLETE semantics.
         if (reason == "HISTORY_COMPLETE") {
             maybeBuzzInactivity()
             // L3 stress check-in (v5): same read-only hook — fire the StressOnsetDetector over the live
diff --git a/android/app/src/main/java/com/noop/data/SecurePrefs.kt b/android/app/src/main/java/com/noop/data/SecurePrefs.kt
index dc8d0a059b..42eb877aae 100644
--- a/android/app/src/main/java/com/noop/data/SecurePrefs.kt
+++ b/android/app/src/main/java/com/noop/data/SecurePrefs.kt
@@ -10,10 +10,11 @@ import java.util.concurrent.ConcurrentHashMap
  * The one place an encrypted `SharedPreferences` file is opened.
  *
  * Two credential stores needed this and each grew its own copy: `AiKeyStore` (the AI provider API key)
- * and `OuraInstallKeyStore` (per-ring install keys). The bodies were byte-identical apart from the file
+ * and `OuraInstallKeyStore` (per-ring install keys); the self-hosted push bearer token also uses this
+ * single audited helper. The bodies were byte-identical apart from the file
  * name, which is the shape that lets a hardening change, a key-scheme migration or a fallback fix land
- * on one store and silently miss the other. They are the app's only two encrypted files, so one helper
- * covers all of it.
+ * on one store and silently miss the other. One helper now covers every encrypted preference file,
+ * including the default-off self-hosted push bearer token.
  *
  * **Cached, which is the part that matters at runtime.** `EncryptedSharedPreferences.create` is not a
  * cheap accessor: it builds a [MasterKey] — an Android Keystore round trip — and sets up Tink AEAD
@@ -45,8 +46,8 @@ object SecurePrefs {
      *
      * Caveat worth knowing: `ConcurrentHashMap` documents that the mapping function should be "short
      * and simple", and this one is neither — a Keystore round trip plus Tink setup, with the bin
-     * locked throughout. It is acceptable here because there are exactly two files, each built once
-     * per process, and the function never re-enters the map, so the worst case is one thread briefly
+     * locked throughout. It is acceptable here because there are only a few fixed file names, each built
+     * once per process, and the function never re-enters the map, so the worst case is one thread briefly
      * serialising behind another. It would not be acceptable if this map grew keys at runtime.
      */
     fun of(ctx: Context, fileName: String): SharedPreferences =
diff --git a/android/app/src/main/java/com/noop/data/WhoopDatabase.kt b/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
index facba4f159..895f4bfc35 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
@@ -4,6 +4,7 @@ import android.content.Context
 import androidx.room.Database
 import androidx.room.Room
 import androidx.room.RoomDatabase
+import com.noop.push.PushDao
 import androidx.room.migration.Migration
 import androidx.sqlite.db.SupportSQLiteDatabase
 
@@ -66,6 +67,9 @@ import androidx.sqlite.db.SupportSQLiteDatabase
 abstract class WhoopDatabase : RoomDatabase() {
     abstract fun whoopDao(): WhoopDao
 
+    /** Read-only, schema-neutral snapshots for the opt-in self-hosted push worker. */
+    fun pushDao(): PushDao = PushDao(this)
+
     companion object {
         const val DB_NAME = "noop_whoop.db"
         /** Room schema version — MUST equal the `@Database(version = …)` above. Surfaced in the backup
diff --git a/android/app/src/main/java/com/noop/push/EndpointScopedProgressStore.kt b/android/app/src/main/java/com/noop/push/EndpointScopedProgressStore.kt
new file mode 100644
index 0000000000..765a4478a3
--- /dev/null
+++ b/android/app/src/main/java/com/noop/push/EndpointScopedProgressStore.kt
@@ -0,0 +1,28 @@
+package com.noop.push
+
+/** Keeps cursor/window progress independent per normalized endpoint without exposing the URL to Room. */
+class EndpointScopedProgressStore(
+    private val delegate: PushProgressStore,
+    private val endpointNamespace: String,
+) : PushProgressStore {
+    private fun scoped(deviceId: String) = "$endpointNamespace:$deviceId"
+    private val prefix = "$endpointNamespace:"
+
+    override suspend fun knownDeviceIds(): Set<String> = delegate.knownDeviceIds()
+        .filterTo(mutableSetOf()) { it.startsWith(prefix) }
+        .mapTo(mutableSetOf()) { it.removePrefix(prefix) }
+
+    override suspend fun rememberDeviceId(deviceId: String) = delegate.rememberDeviceId(scoped(deviceId))
+
+    override suspend fun cursor(table: PushAppendTable, deviceId: String): PushCursor? =
+        delegate.cursor(table, scoped(deviceId))
+
+    override suspend fun saveCursor(table: PushAppendTable, deviceId: String, cursor: PushCursor) =
+        delegate.saveCursor(table, scoped(deviceId), cursor)
+
+    override suspend fun window(table: PushMutableTable, deviceId: String): PushWindowProgress? =
+        delegate.window(table, scoped(deviceId))
+
+    override suspend fun saveWindow(table: PushMutableTable, deviceId: String, progress: PushWindowProgress) =
+        delegate.saveWindow(table, scoped(deviceId), progress)
+}
diff --git a/android/app/src/main/java/com/noop/push/PushCapabilities.kt b/android/app/src/main/java/com/noop/push/PushCapabilities.kt
new file mode 100644
index 0000000000..7494bd30fa
--- /dev/null
+++ b/android/app/src/main/java/com/noop/push/PushCapabilities.kt
@@ -0,0 +1,101 @@
+package com.noop.push
+
+import org.json.JSONArray
+import org.json.JSONObject
+
+/** A receiver may only narrow the fixed protocol 1.0 registry, never name new data. */
+data class PushCapabilities(
+    val appendTables: Set<PushAppendTable>,
+    val mutableTables: Set<PushMutableTable>,
+    val protocolVersion: String = PushProtocol.VERSION,
+    val receiverStateId: String = UNSCOPED_RECEIVER_STATE_ID,
+) {
+    val isEmpty: Boolean get() = appendTables.isEmpty() && mutableTables.isEmpty()
+    val wireNames: List<String> get() =
+        PushAppendTable.entries.filter { it in appendTables }.map { it.wireName } +
+            PushMutableTable.entries.filter { it in mutableTables }.map { it.wireName }
+
+    companion object {
+        /** Test/local default. Network capability documents must always provide a real receiver state id. */
+        const val UNSCOPED_RECEIVER_STATE_ID = "00000000-0000-4000-8000-000000000000"
+        val ALL = PushCapabilities(PushAppendTable.entries.toSet(), PushMutableTable.entries.toSet())
+
+        fun parse(bytes: ByteArray): PushCapabilities {
+            if (bytes.size > PushProtocol.MAX_ACK_BYTES) {
+                throw PushProtocolException("capabilities exceed size limit")
+            }
+            val obj = try {
+                JSONObject(bytes.toString(Charsets.UTF_8))
+            } catch (_: Throwable) {
+                throw PushProtocolException("capabilities are not valid JSON")
+            }
+            val required = setOf("type", "protocolVersion", "receiverStateId", "streams")
+            val actualMembers = obj.keys().asSequence().toSet()
+            if (!actualMembers.containsAll(required)) {
+                throw PushProtocolException("capabilities are missing required protocol 1.0 members")
+            }
+            if (actualMembers.any { it in PushProtocol.FORBIDDEN_REMOTE_CONTROL_MEMBERS }) {
+                throw PushProtocolException("capabilities contain forbidden remote-control metadata")
+            }
+            if (obj.opt("type") != "capabilities" || obj.opt("protocolVersion") != PushProtocol.VERSION) {
+                throw PushProtocolException("unsupported capability document")
+            }
+            val receiverStateId = (obj.opt("receiverStateId") as? String)?.takeIf(::isCanonicalUuid)
+                ?: throw PushProtocolException("capabilities.receiverStateId must be a canonical UUID")
+            val array = obj.opt("streams") as? JSONArray
+                ?: throw PushProtocolException("capabilities.streams must be an array")
+            val appendByName = PushAppendTable.entries.associateBy { it.wireName }
+            val mutableByName = PushMutableTable.entries.associateBy { it.wireName }
+            val seen = mutableSetOf<String>()
+            val append = linkedSetOf<PushAppendTable>()
+            val mutable = linkedSetOf<PushMutableTable>()
+            for (index in 0 until array.length()) {
+                val name = array.opt(index) as? String
+                    ?: throw PushProtocolException("capability stream names must be strings")
+                if (!seen.add(name)) throw PushProtocolException("duplicate capability stream")
+                when (val table = appendByName[name] ?: mutableByName[name]) {
+                    is PushAppendTable -> append += table
+                    is PushMutableTable -> mutable += table
+                    else -> throw PushProtocolException("unknown capability stream")
+                }
+            }
+            return PushCapabilities(append, mutable, PushProtocol.VERSION, receiverStateId)
+        }
+
+        private fun isCanonicalUuid(value: String): Boolean = runCatching {
+            java.util.UUID.fromString(value).toString() == value
+        }.getOrDefault(false)
+    }
+}
+
+internal class PushConnectionTester(
+    private val transportFactory: (PushEndpointPolicy.ValidEndpoint, String) -> PushTransport =
+        { endpoint, token -> PushHttpTransport(endpoint, token) },
+) {
+    suspend fun test(
+        endpoint: PushEndpointPolicy.ValidEndpoint,
+        token: String,
+    ): PushCapabilitiesResult = try {
+        transportFactory(endpoint, token).capabilities()
+    } catch (cancelled: kotlinx.coroutines.CancellationException) {
+        throw cancelled
+    } catch (_: Throwable) {
+        val failure = PushFailure(PushFailureCode.NETWORK_IO)
+        PushCapabilitiesResult.Rejected(failure.safeCode, failure.retryable, failure)
+    }
+}
+
+internal fun canStartPushConnectionTest(
+    networkAvailable: Boolean,
+    endpointValid: Boolean,
+    tokenAvailable: Boolean,
+): Boolean = networkAvailable && endpointValid && tokenAvailable
+
+sealed interface PushCapabilitiesResult {
+    data class Available(val capabilities: PushCapabilities) : PushCapabilitiesResult
+    data class Rejected(
+        val reason: String,
+        val retryable: Boolean,
+        val failure: PushFailure? = null,
+    ) : PushCapabilitiesResult
+}
diff --git a/android/app/src/main/java/com/noop/push/PushCoordinator.kt b/android/app/src/main/java/com/noop/push/PushCoordinator.kt
new file mode 100644
index 0000000000..9d5ad72d8a
--- /dev/null
+++ b/android/app/src/main/java/com/noop/push/PushCoordinator.kt
@@ -0,0 +1,297 @@
+package com.noop.push
+
+import kotlinx.coroutines.CancellationException
+import java.time.Instant
+import java.time.LocalDate
+import java.time.ZoneId
+
+/** Coordinates bounded Room snapshots and transport without holding a database read across network I/O. */
+class PushCoordinator(
+    private val source: PushSnapshotSource,
+    private val transport: PushTransport,
+    private val progress: PushProgressStore,
+    private val sourceId: String,
+    private val today: () -> LocalDate = { LocalDate.now() },
+    private val zoneId: ZoneId = ZoneId.systemDefault(),
+    private val destinationStillCurrent: () -> Boolean = { true },
+) {
+    suspend fun pushAppend(table: PushAppendTable, deviceId: String): PushResult {
+        val stored = try {
+            progress.cursor(table, deviceId)
+        } catch (cancelled: CancellationException) {
+            throw cancelled
+        } catch (_: Throwable) {
+            return rejected(PushFailure(PushFailureCode.LOCAL_DATABASE))
+        }
+        val effective = if (stored == null || stored.rowId <= 0) {
+            null
+        } else {
+            val atCursor = try {
+                source.appendRecordAt(table, deviceId, stored.rowId)
+            } catch (cancelled: CancellationException) {
+                throw cancelled
+            } catch (invalid: PushProtocolException) {
+                return rejected(PushFailure(PushFailureCode.LOCAL_DATA))
+            } catch (_: Throwable) {
+                return rejected(PushFailure(PushFailureCode.LOCAL_DATABASE))
+            }
+            val fingerprint = atCursor?.let { PushProtocol.keyFingerprint(table, deviceId, it.key) }
+            if (fingerprint == stored.naturalKeyFingerprint) stored else null
+        }
+        val rows = try {
+            source.appendRows(table, deviceId, effective?.rowId ?: 0L, PushProtocol.MAX_RECORDS + 1)
+        } catch (cancelled: CancellationException) {
+            throw cancelled
+        } catch (invalid: PushProtocolException) {
+            return rejected(PushFailure(PushFailureCode.LOCAL_DATA))
+        } catch (_: Throwable) {
+            return rejected(PushFailure(PushFailureCode.LOCAL_DATABASE))
+        }
+        if (rows.isEmpty()) return PushResult.NoData
+        val batch = try {
+            PushProtocol.appendBatch(table, sourceId, deviceId, effective, rows)
+        } catch (t: PushProtocolException) {
+            return rejected(PushFailure(PushFailureCode.LOCAL_DATA))
+        }
+        val accepted = deliver(batch)
+        if (accepted !is PushResult.Accepted) return accepted
+        val end = batch.endCursor ?: return rejected(PushFailure(PushFailureCode.LOCAL_DATA))
+        return try {
+            progress.saveCursor(table, deviceId, end)
+            accepted.copy(hasMore = rows.size > batch.recordCount)
+        } catch (cancelled: CancellationException) {
+            throw cancelled
+        } catch (invalid: PushProtocolException) {
+            return rejected(PushFailure(PushFailureCode.LOCAL_DATA))
+        } catch (_: Throwable) {
+            // The endpoint may have applied the bytes. Keeping the old cursor safely repeats the same upserts.
+            rejected(PushFailure(PushFailureCode.LOCAL_DATABASE))
+        }
+    }
+
+    suspend fun pushMutable(table: PushMutableTable, deviceId: String): PushResult {
+        val fullWindow = PushWindow.ending(today(), zoneId)
+        val rows = try {
+            source.mutableRows(
+                table, deviceId, fullWindow, PushProtocol.MAX_MUTABLE_SNAPSHOT_RECORDS + 1,
+            )
+        } catch (cancelled: CancellationException) {
+            throw cancelled
+        } catch (invalid: PushProtocolException) {
+            return rejected(PushFailure(PushFailureCode.LOCAL_DATA))
+        } catch (_: Throwable) {
+            return rejected(PushFailure(PushFailureCode.LOCAL_DATABASE))
+        }
+        if (rows.size > PushProtocol.MAX_MUTABLE_SNAPSHOT_RECORDS) {
+            return rejected(PushFailure(PushFailureCode.LOCAL_DATA))
+        }
+        var encodedBytes = 0L
+        val days = generateSequence(LocalDate.parse(fullWindow.fromDay)) { previous ->
+            previous.plusDays(1).takeUnless { it.isAfter(LocalDate.parse(fullWindow.toDay)) }
+        }.toList()
+        val recordsByDay = days.associateWith { mutableListOf<PushMutableRecord>() }
+        for (record in rows) {
+            val size = try {
+                PushProtocol.mutableRecordEncodedSize(table, record)
+            } catch (t: PushProtocolException) {
+                return rejected(PushFailure(PushFailureCode.LOCAL_DATA))
+            }
+            encodedBytes += size
+            if (encodedBytes > PushProtocol.MAX_MUTABLE_SNAPSHOT_ENCODED_BYTES) {
+                return rejected(PushFailure(PushFailureCode.LOCAL_DATA))
+            }
+            val day = try {
+                mutableRecordDay(table, record)
+            } catch (_: PushProtocolException) {
+                return rejected(PushFailure(PushFailureCode.LOCAL_DATA))
+            }
+            val bucket = recordsByDay[day]
+                ?: return rejected(PushFailure(PushFailureCode.LOCAL_DATA))
+            bucket += record
+        }
+        val currentHashes = try {
+            recordsByDay.mapKeys { (day, _) -> day.toString() }
+                .mapValues { (_, dayRows) -> PushProtocol.mutableSnapshotHash(table, dayRows) }
+        } catch (_: PushProtocolException) {
+            return rejected(PushFailure(PushFailureCode.LOCAL_DATA))
+        }
+        val previousHashes = try {
+            progress.window(table, deviceId)?.dayHashes.orEmpty()
+        } catch (cancelled: CancellationException) {
+            throw cancelled
+        } catch (_: Throwable) {
+            return rejected(PushFailure(PushFailureCode.LOCAL_DATABASE))
+        }
+        val changedDays = days.filter { day -> previousHashes[day.toString()] != currentHashes[day.toString()] }
+        if (changedDays.isEmpty()) return PushResult.NoData
+        val window = PushWindow.days(changedDays.first(), changedDays.last(), zoneId)
+        val changedRows = days.asSequence()
+            .filter { it >= changedDays.first() && it <= changedDays.last() }
+            .flatMap { recordsByDay.getValue(it).asSequence() }
+            .toList()
+        val batches = try {
+            PushProtocol.mutableBatches(table, sourceId, deviceId, window, changedRows)
+        } catch (t: PushProtocolException) {
+            return rejected(PushFailure(PushFailureCode.LOCAL_DATA))
+        }
+        for (batch in batches) {
+            val accepted = deliver(batch)
+            if (accepted !is PushResult.Accepted) return accepted
+        }
+        val replacementId = batches.first().replacementId ?: batches.first().batchId
+        return try {
+            progress.saveWindow(
+                table,
+                deviceId,
+                PushWindowProgress(fullWindow, replacementId, currentHashes),
+            )
+            PushResult.Accepted(
+                batchId = replacementId,
+                recordCount = changedRows.size,
+                hasMore = false,
+                batchCount = batches.size,
+            )
+        } catch (cancelled: CancellationException) {
+            throw cancelled
+        } catch (_: Throwable) {
+            rejected(PushFailure(PushFailureCode.LOCAL_DATABASE))
+        }
+    }
+
+    private fun mutableRecordDay(table: PushMutableTable, record: PushMutableRecord): LocalDate = when (table) {
+        PushMutableTable.DAILY_METRIC, PushMutableTable.JOURNAL -> {
+            val value = record.key["day"] as? String
+                ?: throw PushProtocolException("mutable day key is not a string")
+            runCatching { LocalDate.parse(value) }
+                .getOrElse { throw PushProtocolException("mutable day key is invalid") }
+        }
+        PushMutableTable.SLEEP_SESSION, PushMutableTable.WORKOUT -> {
+            val value = record.key["startTs"]
+            val timestamp = when (value) {
+                is Byte, is Short, is Int, is Long -> (value as Number).toLong()
+                else -> throw PushProtocolException("mutable startTs key is not an integer")
+            }
+            runCatching { Instant.ofEpochSecond(timestamp).atZone(zoneId).toLocalDate() }
+                .getOrElse { throw PushProtocolException("mutable startTs key is invalid") }
+        }
+    }
+
+    /** One append page and one checksum-minimized mutable replacement per actual source device. */
+    suspend fun pushKnownDevices(
+        startDeviceIndex: Int = 0,
+        maxDevices: Int = Int.MAX_VALUE,
+        capabilities: PushCapabilities = PushCapabilities.ALL,
+    ): PushRunResult {
+        require(startDeviceIndex >= 0)
+        require(maxDevices > 0)
+        if (capabilities.isEmpty) {
+            return PushRunResult(
+                acceptedBatches = 0,
+                acceptedRecords = 0,
+                rejectedBatches = 0,
+                hasMoreAppendRows = false,
+            )
+        }
+        val devices = try {
+            val live = source.knownDeviceIds(capabilities).filter(String::isNotBlank).distinct()
+            live.forEach { progress.rememberDeviceId(it) }
+            (live + progress.knownDeviceIds()).filter(String::isNotBlank).distinct().sorted()
+        } catch (cancelled: CancellationException) {
+            throw cancelled
+        } catch (_: Throwable) {
+            val failure = PushFailure(PushFailureCode.LOCAL_DATABASE)
+            return PushRunResult(acceptedBatches = 0, acceptedRecords = 0, rejectedBatches = 1, hasMoreAppendRows = false, hasRetryableFailure = true, failure = failure)
+        }
+        if (devices.isEmpty()) return PushRunResult(acceptedBatches = 0, acceptedRecords = 0, rejectedBatches = 0, hasMoreAppendRows = false)
+        val start = startDeviceIndex % devices.size
+        val selectedCount = minOf(maxDevices, devices.size)
+        val selectedDevices = (0 until selectedCount).map { devices[(start + it) % devices.size] }
+        val nextDeviceIndex = (start + selectedCount) % devices.size
+        var accepted = 0
+        var acceptedRecords = 0
+        var rejected = 0
+        var more = false
+        var retryableFailure = false
+        var selectedFailure: PushFailure? = null
+        for (deviceId in selectedDevices) {
+            for (table in PushAppendTable.entries.filter { it in capabilities.appendTables }) {
+                when (val result = pushAppend(table, deviceId)) {
+                    is PushResult.Accepted -> {
+                        accepted += result.batchCount
+                        acceptedRecords += result.recordCount
+                        more = more || result.hasMore
+                    }
+                    is PushResult.Rejected -> {
+                        rejected += 1
+                        if (selectedFailure == null || result.retryable && !retryableFailure) {
+                            selectedFailure = result.failure
+                        }
+                        retryableFailure = retryableFailure || result.retryable
+                    }
+                    PushResult.NoData -> Unit
+                }
+            }
+            for (table in PushMutableTable.entries.filter { it in capabilities.mutableTables }) {
+                when (val result = pushMutable(table, deviceId)) {
+                    is PushResult.Accepted -> {
+                        accepted += result.batchCount
+                        acceptedRecords += result.recordCount
+                    }
+                    is PushResult.Rejected -> {
+                        rejected += 1
+                        if (selectedFailure == null || result.retryable && !retryableFailure) {
+                            selectedFailure = result.failure
+                        }
+                        retryableFailure = retryableFailure || result.retryable
+                    }
+                    PushResult.NoData -> Unit
+                }
+            }
+        }
+        return PushRunResult(
+            acceptedBatches = accepted,
+            acceptedRecords = acceptedRecords,
+            rejectedBatches = rejected,
+            hasMoreAppendRows = more,
+            hasRetryableFailure = retryableFailure,
+            nextDeviceIndex = nextDeviceIndex,
+            hasMoreDevices = devices.size > selectedCount,
+            failure = selectedFailure,
+        )
+    }
+
+    private suspend fun deliver(batch: PushBatch): PushResult {
+        if (!destinationStillCurrent()) {
+            throw CancellationException("push destination changed")
+        }
+        val response = try {
+            transport.post(batch)
+        } catch (cancelled: CancellationException) {
+            throw cancelled
+        } catch (transport: PushTransportException) {
+            return rejected(transport.failure)
+        } catch (_: Throwable) {
+            return rejected(PushFailure(PushFailureCode.NETWORK_IO))
+        }
+        if (response.body.size > PushProtocol.MAX_ACK_BYTES) {
+            return rejected(PushFailure(PushFailureCode.ACK_INVALID))
+        }
+        if (response.statusCode !in 200..299) {
+            return rejected(
+                PushFailure.http(response.statusCode, PushError.parseCode(response.body, batch.protocolVersion)),
+            )
+        }
+        val ack = try {
+            PushAck.parse(response.body)
+        } catch (t: PushProtocolException) {
+            return rejected(PushFailure(PushFailureCode.ACK_INVALID))
+        }
+        if (!ack.exactlyMatches(batch)) {
+            return rejected(PushFailure(PushFailureCode.ACK_INVALID))
+        }
+        return PushResult.Accepted(batch.batchId, batch.recordCount, hasMore = false)
+    }
+
+    private fun rejected(failure: PushFailure) =
+        PushResult.Rejected(failure.safeCode, failure.retryable, failure)
+}
diff --git a/android/app/src/main/java/com/noop/push/PushDao.kt b/android/app/src/main/java/com/noop/push/PushDao.kt
new file mode 100644
index 0000000000..e8c73b1460
--- /dev/null
+++ b/android/app/src/main/java/com/noop/push/PushDao.kt
@@ -0,0 +1,262 @@
+package com.noop.push
+
+import android.database.Cursor
+import androidx.room.withTransaction
+import androidx.sqlite.db.SimpleSQLiteQuery
+import com.noop.data.WhoopDatabase
+
+/** SQL-side upper bound evaluated before Android materializes any unrestricted TEXT value. */
+internal object PushSnapshotPreflight {
+    // 4 KiB per row conservatively covers maps, entries, boxed scalars and fixed JSON syntax. The
+    // remaining budget covers text at 6x its UTF-8 byte length, the maximum JSON string expansion.
+    const val FIXED_ROW_OVERHEAD_BYTES = 4 * 1024L
+    const val MAX_ESTIMATED_SNAPSHOT_BYTES = 48 * 1024 * 1024L
+
+    fun rowEstimateExpression(columns: List<String>): String = buildString {
+        append(FIXED_ROW_OVERHEAD_BYTES)
+        columns.forEach { column ->
+            append(" + (CASE WHEN $column IS NULL THEN 4 ")
+            append("WHEN typeof($column) = 'text' THEN length(CAST($column AS BLOB)) * 6 + 2 ")
+            append("WHEN typeof($column) = 'blob' THEN ${MAX_ESTIMATED_SNAPSHOT_BYTES + 1} ")
+            append("ELSE 32 END)")
+        }
+    }
+
+    fun query(table: String, columns: List<String>, predicate: String, orderBy: String): String =
+        "SELECT COALESCE(SUM(${rowEstimateExpression(columns)}), 0) FROM " +
+            "(SELECT ${columns.joinToString()} FROM $table WHERE $predicate ORDER BY $orderBy LIMIT ?)"
+}
+
+internal object PushDeviceDiscovery {
+    fun query(supportedSqlTables: List<String>): String = buildString {
+        append("SELECT id AS deviceId FROM device WHERE id <> ''")
+        supportedSqlTables.distinct().forEach { table ->
+            append(" UNION SELECT deviceId FROM $table WHERE deviceId <> ''")
+        }
+        append(" ORDER BY deviceId")
+    }
+}
+
+/**
+ * Narrow, read-only Room snapshot adapter. SQL identifiers come exclusively from the closed enums below;
+ * user/config input is always a bind argument. Every cursor is consumed and closed inside [withTransaction].
+ */
+class PushDao internal constructor(private val db: WhoopDatabase) : PushSnapshotSource {
+    override suspend fun knownDeviceIds(capabilities: PushCapabilities): List<String> = db.withTransaction {
+        val supportedTables = capabilities.appendTables.map(::appendSpec) +
+            capabilities.mutableTables.map(::mutableSpec)
+        val sql = PushDeviceDiscovery.query(supportedTables.map(TableSpec::sqlName))
+        db.query(SimpleSQLiteQuery(sql)).use { cursor ->
+            buildList {
+                while (cursor.moveToNext()) cursor.getString(0)?.takeIf { it.isNotBlank() }?.let(::add)
+            }
+        }
+    }
+
+    override suspend fun appendRecordAt(
+        table: PushAppendTable,
+        deviceId: String,
+        rowId: Long,
+    ): PushAppendRecord? {
+        val spec = appendSpec(table)
+        return db.withTransaction {
+            val args = arrayOf<Any?>(deviceId, rowId, 1)
+            ensureSnapshotBounded(
+                PushSnapshotPreflight.query(spec.sqlName, spec.columns, "deviceId = ? AND rowid = ?", "rowid ASC"),
+                args,
+            )
+            val sql = "SELECT rowid AS _pushRowId, ${spec.columns.joinToString()} FROM ${spec.sqlName} " +
+                "WHERE deviceId = ? AND rowid = ? LIMIT 1"
+            db.query(SimpleSQLiteQuery(sql, arrayOf(deviceId, rowId))).use { cursor ->
+                if (cursor.moveToFirst()) cursor.appendRecord(spec) else null
+            }
+        }
+    }
+
+    override suspend fun appendRows(
+        table: PushAppendTable,
+        deviceId: String,
+        afterRowId: Long,
+        limit: Int,
+    ): List<PushAppendRecord> {
+        require(limit in 1..PushProtocol.MAX_RECORDS + 1)
+        val spec = appendSpec(table)
+        return db.withTransaction {
+            val args = arrayOf<Any?>(deviceId, afterRowId, limit)
+            ensureSnapshotBounded(
+                PushSnapshotPreflight.query(spec.sqlName, spec.columns, "deviceId = ? AND rowid > ?", "rowid ASC"),
+                args,
+            )
+            val sql = "SELECT rowid AS _pushRowId, ${spec.columns.joinToString()} FROM ${spec.sqlName} " +
+                "WHERE deviceId = ? AND rowid > ? ORDER BY rowid ASC LIMIT ?"
+            db.query(SimpleSQLiteQuery(sql, arrayOf(deviceId, afterRowId, limit))).use { cursor ->
+                buildList {
+                    while (cursor.moveToNext()) add(cursor.appendRecord(spec))
+                }
+            }
+        }
+    }
+
+    override suspend fun mutableRows(
+        table: PushMutableTable,
+        deviceId: String,
+        window: PushWindow,
+        limit: Int,
+    ): List<PushMutableRecord> {
+        require(limit in 1..(PushProtocol.MAX_MUTABLE_SNAPSHOT_RECORDS + 1))
+        val spec = mutableSpec(table)
+        return db.withTransaction {
+            val (predicate, bounds) = when (table) {
+                PushMutableTable.DAILY_METRIC, PushMutableTable.JOURNAL ->
+                    "day >= ? AND day <= ?" to arrayOf<Any?>(window.fromDay, window.toDay)
+                PushMutableTable.SLEEP_SESSION, PushMutableTable.WORKOUT ->
+                    "startTs >= ? AND startTs < ?" to
+                        arrayOf<Any?>(window.startTsInclusive, window.endTsExclusive)
+            }
+            val sql = "SELECT ${spec.columns.joinToString()} FROM ${spec.sqlName} " +
+                "WHERE deviceId = ? AND $predicate ORDER BY ${spec.keyColumns.joinToString()} ASC LIMIT ?"
+            val args = arrayOfNulls<Any?>(bounds.size + 2)
+            args[0] = deviceId
+            bounds.copyInto(args, destinationOffset = 1)
+            args[args.lastIndex] = limit
+            ensureSnapshotBounded(
+                PushSnapshotPreflight.query(
+                    spec.sqlName,
+                    spec.columns,
+                    "deviceId = ? AND $predicate",
+                    "${spec.keyColumns.joinToString()} ASC",
+                ),
+                args,
+            )
+            db.query(SimpleSQLiteQuery(sql, args)).use { cursor ->
+                buildList {
+                    while (cursor.moveToNext()) add(cursor.mutableRecord(spec))
+                }
+            }
+        }
+    }
+
+    private fun ensureSnapshotBounded(sql: String, args: Array<Any?>) {
+        val estimate = db.query(SimpleSQLiteQuery(sql, args)).use { cursor ->
+            if (cursor.moveToFirst()) cursor.getLong(0) else 0L
+        }
+        if (estimate > PushSnapshotPreflight.MAX_ESTIMATED_SNAPSHOT_BYTES) {
+            throw PushProtocolException("snapshot exceeds local memory limit")
+        }
+    }
+
+    private fun Cursor.appendRecord(spec: TableSpec): PushAppendRecord {
+        val values = values(spec)
+        val rowId = getLong(getColumnIndexOrThrow("_pushRowId"))
+        return PushAppendRecord(
+            rowId,
+            spec.keyColumns.associateWith(values::get),
+            spec.dataColumns.associateWith(values::get),
+        )
+    }
+
+    private fun Cursor.mutableRecord(spec: TableSpec): PushMutableRecord {
+        val values = values(spec)
+        return PushMutableRecord(
+            spec.keyColumns.associateWith(values::get),
+            spec.dataColumns.associateWith(values::get),
+        )
+    }
+
+    private fun Cursor.values(spec: TableSpec): Map<String, Any?> = buildMap {
+        for (name in spec.columns) {
+            val index = getColumnIndexOrThrow(name)
+            val value: Any? = when (getType(index)) {
+                Cursor.FIELD_TYPE_NULL -> null
+                Cursor.FIELD_TYPE_INTEGER -> if (name in spec.booleanColumns) getLong(index) != 0L else getLong(index)
+                Cursor.FIELD_TYPE_FLOAT -> getDouble(index)
+                Cursor.FIELD_TYPE_STRING -> getString(index)
+                else -> throw PushProtocolException("unsupported SQLite type in ${spec.sqlName}.$name")
+            }
+            put(name, value)
+        }
+    }
+
+    private data class TableSpec(
+        val sqlName: String,
+        val keyColumns: List<String>,
+        val dataColumns: List<String>,
+        val booleanColumns: Set<String> = emptySet(),
+    ) {
+        val columns: List<String> = keyColumns + dataColumns
+    }
+
+    private fun appendSpec(table: PushAppendTable): TableSpec = when (table) {
+        PushAppendTable.HR_SAMPLE -> HR
+        PushAppendTable.RR_INTERVAL -> RR
+        PushAppendTable.EVENT -> EVENT
+        PushAppendTable.BATTERY -> BATTERY
+        PushAppendTable.SPO2_SAMPLE -> SPO2
+        PushAppendTable.SKIN_TEMP_SAMPLE -> SKIN_TEMP
+        PushAppendTable.RESP_SAMPLE -> RESP
+        PushAppendTable.GRAVITY_SAMPLE -> GRAVITY
+    }
+
+    private fun mutableSpec(table: PushMutableTable): TableSpec = when (table) {
+        PushMutableTable.DAILY_METRIC -> DAILY
+        PushMutableTable.SLEEP_SESSION -> SLEEP
+        PushMutableTable.WORKOUT -> WORKOUT
+        PushMutableTable.JOURNAL -> JOURNAL
+    }
+
+    private companion object {
+        val HR = TableSpec("hrSample", listOf("ts"), listOf("bpm"))
+        val RR = TableSpec(
+            "rrInterval",
+            listOf("ts", "rrMs", "seq"),
+            listOf("ord", "srcChannel", "tsSuspect"),
+        )
+        val EVENT = TableSpec(
+            "event", listOf("ts", "kind"), listOf("payloadJSON"),
+        )
+        val BATTERY = TableSpec(
+            "battery", listOf("ts"), listOf("soc", "mv", "charging"),
+            booleanColumns = setOf("charging"),
+        )
+        val SPO2 = TableSpec(
+            "spo2Sample", listOf("ts"), listOf("red", "ir"),
+        )
+        val SKIN_TEMP = TableSpec(
+            "skinTempSample", listOf("ts"), listOf("raw", "aux1Raw", "aux2Raw"),
+        )
+        val RESP = TableSpec("respSample", listOf("ts"), listOf("raw"))
+        val GRAVITY = TableSpec(
+            "gravitySample", listOf("ts"), listOf("x", "y", "z", "dynAccel"),
+        )
+        val DAILY = TableSpec(
+            "dailyMetric",
+            listOf("day"),
+            listOf(
+                "totalSleepMin", "efficiency", "deepMin", "remMin", "lightMin",
+                "disturbances", "restingHr", "avgHrv", "recovery", "strain", "exerciseCount", "spo2Pct",
+                "skinTempDevC", "respRateBpm", "steps", "activeKcalEst", "spo2Red", "spo2Ir",
+            ),
+        )
+        val SLEEP = TableSpec(
+            "sleepSession",
+            listOf("startTs"),
+            listOf(
+                "endTs", "efficiency", "restingHr", "avgHrv", "stagesJSON",
+                "userEdited", "startTsAdjusted", "motionJSON", "sleepStateJSON", "stagingSparse",
+            ),
+            booleanColumns = setOf("userEdited", "stagingSparse"),
+        )
+        val WORKOUT = TableSpec(
+            "workout",
+            listOf("startTs", "sport"),
+            listOf(
+                "endTs", "source", "durationS", "energyKcal", "avgHr",
+                "maxHr", "strain", "distanceM", "zonesJSON", "notes", "routePolyline", "steps",
+            ),
+        )
+        val JOURNAL = TableSpec(
+            "journal", listOf("day", "question"), listOf("answeredYes", "notes", "numericValue"),
+            booleanColumns = setOf("answeredYes"),
+        )
+    }
+}
diff --git a/android/app/src/main/java/com/noop/push/PushEndpointPolicy.kt b/android/app/src/main/java/com/noop/push/PushEndpointPolicy.kt
new file mode 100644
index 0000000000..9936fb70ab
--- /dev/null
+++ b/android/app/src/main/java/com/noop/push/PushEndpointPolicy.kt
@@ -0,0 +1,72 @@
+package com.noop.push
+
+import java.net.IDN
+import java.net.Inet4Address
+import java.net.Inet6Address
+import java.net.InetAddress
+import java.net.URI
+import java.util.Locale
+
+/** Security boundary for the user-supplied destination. Validation happens before DNS or HTTP. */
+object PushEndpointPolicy {
+    data class ValidEndpoint(val url: String, val host: String, val requiresLocalAddress: Boolean)
+
+    sealed interface Result {
+        data class Valid(val endpoint: ValidEndpoint) : Result
+        data class Invalid(val reason: String) : Result
+    }
+
+    fun validate(raw: String): Result {
+        val uri = runCatching { URI(raw.trim()) }.getOrNull()
+            ?: return Result.Invalid("Enter a valid URL.")
+        val scheme = uri.scheme?.lowercase(Locale.ROOT)
+            ?: return Result.Invalid("The URL needs http:// or https://.")
+        if (scheme != "http" && scheme != "https") return Result.Invalid("Only HTTP and HTTPS are supported.")
+        if (uri.rawUserInfo != null) return Result.Invalid("User names and passwords are not allowed in the URL.")
+        if (uri.rawFragment != null) return Result.Invalid("URL fragments are not allowed.")
+        val rawHost = uri.host?.removePrefix("[")?.removeSuffix("]")?.lowercase(Locale.ROOT)
+            ?: return Result.Invalid("The URL needs a host.")
+        val asciiHost = if (':' in rawHost) rawHost else runCatching { IDN.toASCII(rawHost) }.getOrNull()
+            ?: return Result.Invalid("The URL host is invalid.")
+        if (uri.port !in -1..65535) return Result.Invalid("The URL port is invalid.")
+
+        val literal = parseLiteralAddress(asciiHost)
+        val literalAllowed = literal?.let(::isLocalAddress) == true
+        if (scheme == "http" && !literalAllowed) {
+            return Result.Invalid("Plain HTTP requires a numeric local or private IP address.")
+        }
+
+        val defaultPort = (scheme == "https" && uri.port == 443) || (scheme == "http" && uri.port == 80)
+        val authorityHost = if (asciiHost.contains(':')) "[$asciiHost]" else asciiHost
+        val authority = authorityHost + if (uri.port >= 0 && !defaultPort) ":${uri.port}" else ""
+        val path = uri.rawPath.takeUnless { it.isNullOrEmpty() } ?: "/"
+        val normalized = buildString {
+            append(scheme).append("://").append(authority).append(path)
+            uri.rawQuery?.let { append('?').append(it) }
+        }
+        return Result.Valid(ValidEndpoint(normalized, asciiHost, scheme == "http"))
+    }
+
+    internal fun isLocalAddress(address: InetAddress): Boolean {
+        if (address.isLoopbackAddress || address.isLinkLocalAddress) {
+            return true
+        }
+        if (address is Inet6Address) {
+            val first = address.address.first().toInt() and 0xff
+            return first and 0xfe == 0xfc // fc00::/7 ULA
+        }
+        if (address is Inet4Address) {
+            val b = address.address.map { it.toInt() and 0xff }
+            return b[0] == 10 || (b[0] == 172 && b[1] in 16..31) ||
+                (b[0] == 192 && b[1] == 168) || (b[0] == 169 && b[1] == 254)
+        }
+        return false
+    }
+
+    private fun parseLiteralAddress(host: String): InetAddress? {
+        val looksV6 = ':' in host
+        val looksV4 = host.matches(Regex("[0-9.]+"))
+        if (!looksV4 && !looksV6) return null // Never DNS-resolve while validating user input.
+        return runCatching { InetAddress.getByName(host) }.getOrNull()
+    }
+}
diff --git a/android/app/src/main/java/com/noop/push/PushFailure.kt b/android/app/src/main/java/com/noop/push/PushFailure.kt
new file mode 100644
index 0000000000..cd630512b5
--- /dev/null
+++ b/android/app/src/main/java/com/noop/push/PushFailure.kt
@@ -0,0 +1,151 @@
+package com.noop.push
+
+import android.content.Context
+import com.noop.R
+import java.io.EOFException
+import java.io.IOException
+import java.io.InterruptedIOException
+import java.net.ConnectException
+import java.net.NoRouteToHostException
+import java.net.SocketException
+import java.net.SocketTimeoutException
+import java.net.UnknownHostException
+import java.security.cert.CertificateException
+import javax.net.ssl.SSLException
+import javax.net.ssl.SSLHandshakeException
+import javax.net.ssl.SSLPeerUnverifiedException
+
+enum class PushFailureCode {
+    DNS_LOOKUP,
+    TLS_CERTIFICATE,
+    TLS_HANDSHAKE,
+    NETWORK_TIMEOUT,
+    CONNECTION_REFUSED,
+    NETWORK_UNREACHABLE,
+    CONNECTION_RESET,
+    NETWORK_IO,
+    HTTP_AUTH,
+    HTTP_NOT_FOUND,
+    HTTP_TIMEOUT,
+    HTTP_TOO_LARGE,
+    HTTP_MEDIA_TYPE,
+    HTTP_PROTOCOL_REJECTED,
+    HTTP_RATE_LIMIT,
+    HTTP_SERVER,
+    HTTP_CLIENT,
+    CAPABILITIES_INVALID,
+    ACK_INVALID,
+    LOCAL_DATA,
+    LOCAL_DATABASE,
+}
+
+data class PushFailure(
+    val code: PushFailureCode,
+    val httpStatus: Int? = null,
+    val receiverCode: String? = null,
+) {
+    val safeCode: String get() = buildString {
+        append(code.name.lowercase())
+        httpStatus?.let { append(":http_").append(it) }
+        receiverCode?.let { append(":receiver_").append(it) }
+    }
+
+    val retryable: Boolean get() = when (code) {
+        PushFailureCode.DNS_LOOKUP,
+        PushFailureCode.TLS_HANDSHAKE,
+        PushFailureCode.NETWORK_TIMEOUT,
+        PushFailureCode.CONNECTION_REFUSED,
+        PushFailureCode.NETWORK_UNREACHABLE,
+        PushFailureCode.CONNECTION_RESET,
+        PushFailureCode.NETWORK_IO,
+        PushFailureCode.HTTP_TIMEOUT,
+        PushFailureCode.HTTP_RATE_LIMIT,
+        PushFailureCode.HTTP_SERVER,
+        PushFailureCode.LOCAL_DATABASE,
+        -> true
+        else -> false
+    }
+
+    companion object {
+        fun http(status: Int, receiverCode: String? = null): PushFailure = PushFailure(
+            code = when (status) {
+                401, 403 -> PushFailureCode.HTTP_AUTH
+                404 -> PushFailureCode.HTTP_NOT_FOUND
+                408 -> PushFailureCode.HTTP_TIMEOUT
+                413 -> PushFailureCode.HTTP_TOO_LARGE
+                415 -> PushFailureCode.HTTP_MEDIA_TYPE
+                400, 409, 422 -> PushFailureCode.HTTP_PROTOCOL_REJECTED
+                429 -> PushFailureCode.HTTP_RATE_LIMIT
+                in 500..599 -> PushFailureCode.HTTP_SERVER
+                else -> PushFailureCode.HTTP_CLIENT
+            },
+            httpStatus = status,
+            receiverCode = receiverCode,
+        )
+    }
+}
+
+/** Carries only a stable category; the platform cause is never rendered or persisted. */
+class PushTransportException(
+    val failure: PushFailure,
+    cause: Throwable? = null,
+) : IOException(failure.safeCode, cause)
+
+internal fun classifyPushTransportFailure(throwable: Throwable): PushFailure {
+    val causes = mutableListOf<Throwable>()
+    var current: Throwable? = throwable
+    while (current != null && causes.size < 16 && current !in causes) {
+        causes += current
+        current = current.cause
+    }
+    fun has(type: Class<out Throwable>) = causes.any(type::isInstance)
+    fun messageContains(vararg needles: String) = causes.any { cause ->
+        val message = cause.message.orEmpty().lowercase()
+        needles.any(message::contains)
+    }
+    val code = when {
+        has(UnknownHostException::class.java) -> PushFailureCode.DNS_LOOKUP
+        has(SSLPeerUnverifiedException::class.java) || has(CertificateException::class.java) ->
+            PushFailureCode.TLS_CERTIFICATE
+        has(SSLHandshakeException::class.java) || has(SSLException::class.java) -> PushFailureCode.TLS_HANDSHAKE
+        has(SocketTimeoutException::class.java) || has(InterruptedIOException::class.java) ->
+            PushFailureCode.NETWORK_TIMEOUT
+        has(NoRouteToHostException::class.java) || messageContains("no route", "unreachable") ->
+            PushFailureCode.NETWORK_UNREACHABLE
+        has(ConnectException::class.java) && messageContains("refused", "econnrefused") ->
+            PushFailureCode.CONNECTION_REFUSED
+        has(EOFException::class.java) ||
+            (has(SocketException::class.java) && messageContains("reset", "broken pipe", "unexpected end")) ->
+            PushFailureCode.CONNECTION_RESET
+        else -> PushFailureCode.NETWORK_IO
+    }
+    return PushFailure(code)
+}
+
+internal fun pushFailureMessage(context: Context, failure: PushFailure): String {
+    val base = when (failure.code) {
+        PushFailureCode.DNS_LOOKUP -> context.getString(R.string.push_error_dns)
+        PushFailureCode.TLS_CERTIFICATE -> context.getString(R.string.push_error_tls_certificate)
+        PushFailureCode.TLS_HANDSHAKE -> context.getString(R.string.push_error_tls_handshake)
+        PushFailureCode.NETWORK_TIMEOUT -> context.getString(R.string.push_error_network_timeout)
+        PushFailureCode.CONNECTION_REFUSED -> context.getString(R.string.push_error_connection_refused)
+        PushFailureCode.NETWORK_UNREACHABLE -> context.getString(R.string.push_error_network_unreachable)
+        PushFailureCode.CONNECTION_RESET -> context.getString(R.string.push_error_connection_reset)
+        PushFailureCode.NETWORK_IO -> context.getString(R.string.push_error_network_io)
+        PushFailureCode.HTTP_AUTH -> context.getString(R.string.push_error_http_auth, failure.httpStatus ?: 401)
+        PushFailureCode.HTTP_NOT_FOUND -> context.getString(R.string.push_error_http_not_found, failure.httpStatus ?: 404)
+        PushFailureCode.HTTP_TIMEOUT -> context.getString(R.string.push_error_http_timeout, failure.httpStatus ?: 408)
+        PushFailureCode.HTTP_TOO_LARGE -> context.getString(R.string.push_error_http_too_large, failure.httpStatus ?: 413)
+        PushFailureCode.HTTP_MEDIA_TYPE -> context.getString(R.string.push_error_http_media_type, failure.httpStatus ?: 415)
+        PushFailureCode.HTTP_PROTOCOL_REJECTED ->
+            context.getString(R.string.push_error_http_protocol, failure.httpStatus ?: 422)
+        PushFailureCode.HTTP_RATE_LIMIT -> context.getString(R.string.push_error_http_rate_limit, failure.httpStatus ?: 429)
+        PushFailureCode.HTTP_SERVER -> context.getString(R.string.push_error_http_server, failure.httpStatus ?: 500)
+        PushFailureCode.HTTP_CLIENT -> context.getString(R.string.push_error_http_client, failure.httpStatus ?: 400)
+        PushFailureCode.CAPABILITIES_INVALID -> context.getString(R.string.push_error_capabilities_invalid)
+        PushFailureCode.ACK_INVALID -> context.getString(R.string.push_error_ack_invalid)
+        PushFailureCode.LOCAL_DATA -> context.getString(R.string.push_error_local_data)
+        PushFailureCode.LOCAL_DATABASE -> context.getString(R.string.push_error_local_database)
+    }
+    return failure.receiverCode?.let { "$base ($it)" } ?: base
+}
diff --git a/android/app/src/main/java/com/noop/push/PushHttpTransport.kt b/android/app/src/main/java/com/noop/push/PushHttpTransport.kt
new file mode 100644
index 0000000000..9f26262d83
--- /dev/null
+++ b/android/app/src/main/java/com/noop/push/PushHttpTransport.kt
@@ -0,0 +1,155 @@
+package com.noop.push
+
+import kotlinx.coroutines.ExperimentalCoroutinesApi
+import kotlinx.coroutines.suspendCancellableCoroutine
+import okhttp3.Call
+import okhttp3.Callback
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.Response
+import okhttp3.RequestBody
+import okio.Buffer
+import okio.BufferedSink
+import okio.GzipSink
+import okio.buffer
+import java.io.IOException
+import java.util.concurrent.TimeUnit
+import kotlin.coroutines.resume
+import kotlin.coroutines.resumeWithException
+
+/** Minimal HTTP adapter: no redirects, no logging, and bounded acknowledgement/error reads. */
+class PushHttpTransport(
+    private val endpoint: PushEndpointPolicy.ValidEndpoint,
+    private val bearerToken: String,
+    private val client: OkHttpClient = defaultClient(),
+    private val onBatchStart: (PushBatch) -> Unit = {},
+) : PushTransport {
+    override suspend fun capabilities(): PushCapabilitiesResult {
+        val request = Request.Builder()
+            .url(endpoint.url)
+            .header("Authorization", "Bearer $bearerToken")
+            .header("Accept", "application/json")
+            .header(ACCEPT_VERSION_HEADER, PushProtocol.VERSION)
+            .get()
+            .build()
+        val response = try {
+            executeRequest(request)
+        } catch (cancelled: kotlinx.coroutines.CancellationException) {
+            throw cancelled
+        } catch (failure: PushTransportException) {
+            return PushCapabilitiesResult.Rejected(
+                failure.failure.safeCode,
+                failure.failure.retryable,
+                failure.failure,
+            )
+        } catch (_: Throwable) {
+            val failure = PushFailure(PushFailureCode.NETWORK_IO)
+            return PushCapabilitiesResult.Rejected(failure.safeCode, failure.retryable, failure)
+        }
+        if (response.statusCode !in 200..299) {
+            val failure = PushFailure.http(response.statusCode, PushError.parseCode(response.body))
+            return PushCapabilitiesResult.Rejected(failure.safeCode, failure.retryable, failure)
+        }
+        return try {
+            PushCapabilitiesResult.Available(PushCapabilities.parse(response.body))
+        } catch (invalid: PushProtocolException) {
+            val failure = PushFailure(PushFailureCode.CAPABILITIES_INVALID)
+            PushCapabilitiesResult.Rejected(failure.safeCode, failure.retryable, failure)
+        }
+    }
+
+    override suspend fun post(batch: PushBatch): PushTransportResponse {
+        runCatching { onBatchStart(batch) }
+        val compressedBody = gzip(batch.body)
+        val compressed = execute(compressedBody, contentEncoding = "gzip")
+        if (compressed.statusCode != 415) return compressed
+        // Protocol 1.0 allowed identity requests. A definitive media-type rejection is the only
+        // signal that permits one compatibility attempt with the exact same decoded entity.
+        return execute(batch.body, contentEncoding = null)
+    }
+
+    private suspend fun execute(body: ByteArray, contentEncoding: String?): PushTransportResponse {
+        val request = Request.Builder()
+            .url(endpoint.url)
+            .header("Authorization", "Bearer $bearerToken")
+            .header("Accept", "application/json")
+            .apply { if (contentEncoding != null) header("Content-Encoding", contentEncoding) }
+            .post(FixedRequestBody(body))
+            .build()
+        return executeRequest(request)
+    }
+
+    private suspend fun executeRequest(request: Request): PushTransportResponse {
+        try {
+            return client.newCall(request).await().use { response ->
+                val bytes = response.body?.byteStream()?.use { input ->
+                    val bounded = ByteArray(PushProtocol.MAX_ACK_BYTES + 1)
+                    var total = 0
+                    while (total < bounded.size) {
+                        val read = input.read(bounded, total, bounded.size - total)
+                        if (read < 0) break
+                        total += read
+                    }
+                    bounded.copyOf(total)
+                } ?: ByteArray(0)
+                PushTransportResponse(response.code, bytes)
+            }
+        } catch (cancelled: kotlinx.coroutines.CancellationException) {
+            throw cancelled
+        } catch (failure: PushTransportException) {
+            throw failure
+        } catch (io: IOException) {
+            throw PushTransportException(classifyPushTransportFailure(io), io)
+        }
+    }
+
+    /** Cancelling WorkManager cancels the active socket instead of waiting for the blocking timeout. */
+    @OptIn(ExperimentalCoroutinesApi::class)
+    private suspend fun Call.await(): Response = suspendCancellableCoroutine { continuation ->
+        continuation.invokeOnCancellation { cancel() }
+        enqueue(object : Callback {
+            override fun onFailure(call: Call, e: IOException) {
+                if (continuation.isActive) continuation.resumeWithException(e)
+            }
+
+            override fun onResponse(call: Call, response: Response) {
+                if (continuation.isActive) {
+                    continuation.resume(response) { response.close() }
+                } else {
+                    response.close()
+                }
+            }
+        })
+    }
+
+    companion object {
+        const val ACCEPT_VERSION_HEADER = "NOOP-Push-Accept-Version"
+        private val NDJSON = "application/x-ndjson; charset=utf-8".toMediaType()
+        internal fun defaultClient(): OkHttpClient = OkHttpClient.Builder()
+            .followRedirects(false)
+            .followSslRedirects(false)
+            .connectTimeout(10, TimeUnit.SECONDS)
+            .readTimeout(15, TimeUnit.SECONDS)
+            .writeTimeout(15, TimeUnit.SECONDS)
+            .callTimeout(15, TimeUnit.SECONDS)
+            .build()
+
+        /** Compresses only the already bounded decoded entity and rejects unexpected wire expansion. */
+        internal fun gzip(decoded: ByteArray): ByteArray {
+            require(decoded.size <= PushProtocol.MAX_BODY_BYTES) { "decoded push body exceeds limit" }
+            val buffer = Buffer()
+            GzipSink(buffer).buffer().use { it.write(decoded) }
+            check(buffer.size <= PushProtocol.MAX_WIRE_BODY_BYTES) { "gzip push body exceeds wire limit" }
+            return buffer.readByteArray()
+        }
+
+        private class FixedRequestBody(private val bytes: ByteArray) : RequestBody() {
+            override fun contentType() = NDJSON
+            override fun contentLength(): Long = bytes.size.toLong()
+            override fun writeTo(sink: BufferedSink) {
+                sink.write(bytes)
+            }
+        }
+    }
+}
diff --git a/android/app/src/main/java/com/noop/push/PushModels.kt b/android/app/src/main/java/com/noop/push/PushModels.kt
new file mode 100644
index 0000000000..c42c69dc7e
--- /dev/null
+++ b/android/app/src/main/java/com/noop/push/PushModels.kt
@@ -0,0 +1,189 @@
+package com.noop.push
+
+import java.time.LocalDate
+import java.time.ZoneId
+
+sealed interface PushTable {
+    val wireName: String
+}
+
+/** The complete v1 append registry. Database tables are never discovered reflectively. */
+enum class PushAppendTable(override val wireName: String) : PushTable {
+    HR_SAMPLE("hrSample"),
+    RR_INTERVAL("rrInterval"),
+    EVENT("event"),
+    BATTERY("battery"),
+    SPO2_SAMPLE("spo2Sample"),
+    SKIN_TEMP_SAMPLE("skinTempSample"),
+    RESP_SAMPLE("respSample"),
+    GRAVITY_SAMPLE("gravitySample");
+}
+
+enum class PushMutableTable(override val wireName: String) : PushTable {
+    DAILY_METRIC("dailyMetric"),
+    SLEEP_SESSION("sleepSession"),
+    WORKOUT("workout"),
+    JOURNAL("journal");
+}
+
+/** Key excludes deviceId (which is batch-scoped); data contains only non-key registry columns. */
+data class PushAppendRecord(
+    val rowId: Long,
+    val key: Map<String, Any?>,
+    val data: Map<String, Any?>,
+) {
+    init {
+        require(rowId > 0) { "SQLite rowid must be positive" }
+        require(key.isNotEmpty()) { "natural key must not be empty" }
+    }
+}
+
+data class PushMutableRecord(
+    val key: Map<String, Any?>,
+    val data: Map<String, Any?>,
+) {
+    init {
+        require(key.isNotEmpty()) { "natural key must not be empty" }
+    }
+}
+
+data class PushWindow(
+    val fromDay: String,
+    val toDay: String,
+    val startTsInclusive: Long,
+    val endTsExclusive: Long,
+) {
+    companion object {
+        fun ending(today: LocalDate, zoneId: ZoneId): PushWindow {
+            val from = today.minusDays(13)
+            return PushWindow(
+                fromDay = from.toString(),
+                toDay = today.toString(),
+                startTsInclusive = from.atStartOfDay(zoneId).toEpochSecond(),
+                endTsExclusive = today.plusDays(1).atStartOfDay(zoneId).toEpochSecond(),
+            )
+        }
+
+        fun days(from: LocalDate, to: LocalDate, zoneId: ZoneId): PushWindow {
+            require(!to.isBefore(from))
+            return PushWindow(
+                fromDay = from.toString(),
+                toDay = to.toString(),
+                startTsInclusive = from.atStartOfDay(zoneId).toEpochSecond(),
+                endTsExclusive = to.plusDays(1).atStartOfDay(zoneId).toEpochSecond(),
+            )
+        }
+    }
+}
+
+/** Persisted and transmitted cursor. The fingerprint is SHA-256, never raw key material. */
+data class PushCursor(val rowId: Long, val naturalKeyFingerprint: String)
+
+data class PushWindowProgress(
+    val window: PushWindow,
+    val batchId: String,
+    /** Canonical SHA-256 per local calendar day; absent on pre-checksum installations. */
+    val dayHashes: Map<String, String> = emptyMap(),
+)
+
+/** Fully materialized bounded request; no Room transaction survives into transport. */
+data class PushBatch(
+    val protocolVersion: String,
+    val batchId: String,
+    val sourceId: String,
+    val table: PushTable,
+    val deviceId: String,
+    val mode: String,
+    val startCursor: PushCursor?,
+    val endCursor: PushCursor?,
+    val recordCount: Int,
+    val window: PushWindow?,
+    val replacementId: String? = null,
+    val part: Int? = null,
+    val parts: Int? = null,
+    val body: ByteArray,
+)
+
+data class PushTransportResponse(val statusCode: Int, val body: ByteArray)
+
+/** Bounded, machine-readable receiver diagnostic; arbitrary response text is never retained. */
+data class PushError(val protocolVersion: String, val code: String) {
+    companion object {
+        private val SAFE_CODE = Regex("[a-z][a-z0-9_]{0,63}")
+
+        fun parseCode(bytes: ByteArray, expectedVersion: String = PushProtocol.VERSION): String? {
+            if (bytes.isEmpty() || bytes.size > PushProtocol.MAX_ACK_BYTES) return null
+            return runCatching {
+                val obj = org.json.JSONObject(bytes.toString(Charsets.UTF_8))
+                val code = obj.opt("code") as? String
+                if (obj.opt("type") == "error" && obj.opt("protocolVersion") == expectedVersion &&
+                    code != null && code.matches(SAFE_CODE)
+                ) code else null
+            }.getOrNull()
+        }
+    }
+}
+
+interface PushTransport {
+    suspend fun capabilities(): PushCapabilitiesResult =
+        PushCapabilitiesResult.Available(PushCapabilities.ALL)
+    suspend fun post(batch: PushBatch): PushTransportResponse
+}
+
+interface PushProgressStore {
+    suspend fun knownDeviceIds(): Set<String>
+    suspend fun rememberDeviceId(deviceId: String)
+    suspend fun cursor(table: PushAppendTable, deviceId: String): PushCursor?
+    suspend fun saveCursor(table: PushAppendTable, deviceId: String, cursor: PushCursor)
+    suspend fun window(table: PushMutableTable, deviceId: String): PushWindowProgress?
+    suspend fun saveWindow(table: PushMutableTable, deviceId: String, progress: PushWindowProgress)
+}
+
+/** All methods return bounded snapshots and close their database transaction before returning. */
+interface PushSnapshotSource {
+    suspend fun knownDeviceIds(capabilities: PushCapabilities = PushCapabilities.ALL): List<String>
+
+    suspend fun appendRecordAt(table: PushAppendTable, deviceId: String, rowId: Long): PushAppendRecord?
+
+    suspend fun appendRows(
+        table: PushAppendTable,
+        deviceId: String,
+        afterRowId: Long,
+        limit: Int,
+    ): List<PushAppendRecord>
+
+    suspend fun mutableRows(
+        table: PushMutableTable,
+        deviceId: String,
+        window: PushWindow,
+        limit: Int,
+    ): List<PushMutableRecord>
+}
+
+sealed interface PushResult {
+    data class Accepted(
+        val batchId: String,
+        val recordCount: Int,
+        val hasMore: Boolean,
+        val batchCount: Int = 1,
+    ) : PushResult
+
+    data object NoData : PushResult
+
+    data class Rejected(
+        val reason: String,
+        val retryable: Boolean,
+        val failure: PushFailure? = null,
+    ) : PushResult
+}
+
+data class PushRunResult(
+    val acceptedBatches: Int,
+    val rejectedBatches: Int,
+    val hasMoreAppendRows: Boolean,
+    val acceptedRecords: Int = 0,
+    val hasRetryableFailure: Boolean = false,
+    val nextDeviceIndex: Int = 0,
+    val hasMoreDevices: Boolean = false,
+    val failure: PushFailure? = null,
+)
diff --git a/android/app/src/main/java/com/noop/push/PushProtocol.kt b/android/app/src/main/java/com/noop/push/PushProtocol.kt
new file mode 100644
index 0000000000..212d415b9f
--- /dev/null
+++ b/android/app/src/main/java/com/noop/push/PushProtocol.kt
@@ -0,0 +1,542 @@
+package com.noop.push
+
+import org.json.JSONObject
+import java.security.MessageDigest
+import java.util.UUID
+
+class PushProtocolException(message: String) : IllegalArgumentException(message)
+
+/** Deterministic, bounded NDJSON encoder and acknowledgement codec for protocol 1.0. */
+object PushProtocol {
+    const val VERSION = "1.0"
+    const val MAX_RECORDS = 5_000
+    /** Hard limit for the decoded UTF-8 NDJSON entity, before optional content coding. */
+    const val MAX_BODY_BYTES = 4 * 1024 * 1024
+    /** Deflate framing can be slightly larger than incompressible input; keep that copy bounded too. */
+    const val MAX_WIRE_BODY_BYTES = MAX_BODY_BYTES + 64 * 1024
+    const val MAX_ACK_BYTES = 16 * 1024
+    internal const val SNAPSHOT_PAGE_SIZE = 5_000
+    // A rolling window may be multipart, but client memory use is fail-closed and independent of DB size.
+    internal const val MAX_MUTABLE_SNAPSHOT_RECORDS = 1_000
+    internal const val MAX_MUTABLE_SNAPSHOT_ENCODED_BYTES = 2 * 1024 * 1024
+    internal val FORBIDDEN_REMOTE_CONTROL_MEMBERS = setOf(
+        "command", "commands", "endpoint", "url", "cadence", "schema", "fields",
+    )
+
+    fun appendBatch(
+        table: PushAppendTable,
+        sourceId: String,
+        deviceId: String,
+        startCursor: PushCursor?,
+        records: List<PushAppendRecord>,
+    ): PushBatch {
+        validateUuid(sourceId, "sourceId")
+        if (records.isEmpty()) throw PushProtocolException("append batch must contain a record")
+        require(records.zipWithNext().all { (a, b) -> a.rowId < b.rowId }) {
+            "append records must be strictly ordered by rowid"
+        }
+        records.forEach { validateRecord(table, it.key, it.data) }
+        val candidates = records.take(MAX_RECORDS)
+        val selectedRows = ArrayList<PushAppendRecord>(candidates.size)
+        val selectedLines = ArrayList<ByteArray>(candidates.size)
+        var rowBytes = 0
+        for (i in candidates.indices) {
+            val candidate = candidates[i]
+            // Encode one row at a time so rows beyond the decoded entity bound never create a
+            // second page-sized collection of byte arrays in memory.
+            val encodedRow = encodeRecordLine(candidate)
+            val end = cursorFor(table, deviceId, candidate)
+            val candidateCount = selectedRows.size + 1
+            val headerSize = appendHeader(
+                sourceId, table, deviceId, startCursor, end, candidateCount, UUID_PLACEHOLDER,
+            ).size
+            if (headerSize + rowBytes + encodedRow.size > MAX_BODY_BYTES) break
+            selectedRows += candidate
+            selectedLines += encodedRow
+            rowBytes += encodedRow.size
+        }
+        if (selectedRows.isEmpty()) throw PushProtocolException("first append record exceeds the 4 MiB decoded batch limit")
+
+        val endCursor = cursorFor(table, deviceId, selectedRows.last())
+        val identity = appendIdentity(sourceId, table, deviceId, startCursor, endCursor, selectedRows.size)
+        val batchId = stableUuid(identity, selectedLines)
+        val header = appendHeader(sourceId, table, deviceId, startCursor, endCursor, selectedRows.size, batchId)
+        val body = concatenate(header, selectedLines)
+        check(body.size <= MAX_BODY_BYTES)
+        return PushBatch(
+            protocolVersion = VERSION,
+            batchId = batchId,
+            sourceId = sourceId,
+            table = table,
+            deviceId = deviceId,
+            mode = "append",
+            startCursor = startCursor,
+            endCursor = endCursor,
+            recordCount = selectedRows.size,
+            window = null,
+            body = body,
+        )
+    }
+
+    /** Builds every bounded part of one authoritative replacement. Empty snapshots produce one part. */
+    fun mutableBatches(
+        table: PushMutableTable,
+        sourceId: String,
+        deviceId: String,
+        window: PushWindow,
+        records: List<PushMutableRecord>,
+    ): List<PushBatch> {
+        validateUuid(sourceId, "sourceId")
+        records.forEach { validateRecord(table, it.key, it.data) }
+        val duplicate = records.groupingBy { orderedObjectJson(it.key) }.eachCount().any { it.value > 1 }
+        if (duplicate) throw PushProtocolException("replace_window contains a duplicate key")
+        val lines = records.map(::encodeRecordLine)
+        val replacementIdentity = mapOf(
+            "deviceId" to deviceId,
+            "delivery" to "replace_window",
+            "protocolVersion" to VERSION,
+            "sourceId" to sourceId,
+            "stream" to table.wireName,
+            "window" to selectorBounds(table, window),
+        )
+        val replacementId = stableUuid(replacementIdentity, lines)
+
+        val chunks = mutableListOf<MutableList<ByteArray>>()
+        var current = mutableListOf<ByteArray>()
+        var currentBytes = 0
+        for (line in lines) {
+            val nextCount = current.size + 1
+            val conservativeHeader = mutableHeader(
+                sourceId = sourceId,
+                table = table,
+                deviceId = deviceId,
+                window = window,
+                replacementId = replacementId,
+                part = Int.MAX_VALUE,
+                parts = Int.MAX_VALUE,
+                count = nextCount,
+                batchId = UUID_PLACEHOLDER,
+            )
+            if (nextCount > MAX_RECORDS || conservativeHeader.size + currentBytes + line.size > MAX_BODY_BYTES) {
+                if (current.isEmpty()) throw PushProtocolException("first replace_window record exceeds the 4 MiB decoded batch limit")
+                chunks += current
+                current = mutableListOf()
+                currentBytes = 0
+            }
+            val oneHeader = mutableHeader(
+                sourceId, table, deviceId, window, replacementId,
+                Int.MAX_VALUE, Int.MAX_VALUE, 1, UUID_PLACEHOLDER,
+            )
+            if (oneHeader.size + line.size > MAX_BODY_BYTES) {
+                throw PushProtocolException("replace_window record exceeds the 4 MiB decoded batch limit")
+            }
+            current += line
+            currentBytes += line.size
+        }
+        if (current.isNotEmpty() || chunks.isEmpty()) chunks += current
+
+        val parts = chunks.size
+        return chunks.mapIndexed { index, partLines ->
+            val part = index + 1
+            val identity = mutableIdentity(
+                sourceId, table, deviceId, window, replacementId, part, parts, partLines.size,
+            )
+            val batchId = stableUuid(identity, partLines)
+            val header = mutableHeader(
+                sourceId, table, deviceId, window, replacementId, part, parts, partLines.size, batchId,
+            )
+            val body = concatenate(header, partLines)
+            check(partLines.size <= MAX_RECORDS && body.size <= MAX_BODY_BYTES)
+            PushBatch(
+                protocolVersion = VERSION,
+                batchId = batchId,
+                sourceId = sourceId,
+                table = table,
+                deviceId = deviceId,
+                mode = "replace_window",
+                startCursor = null,
+                endCursor = null,
+                recordCount = partLines.size,
+                window = window,
+                replacementId = replacementId,
+                part = part,
+                parts = parts,
+                body = body,
+            )
+        }
+    }
+
+    fun mutableBatch(
+        table: PushMutableTable,
+        sourceId: String,
+        deviceId: String,
+        window: PushWindow,
+        records: List<PushMutableRecord>,
+    ): PushBatch = mutableBatches(table, sourceId, deviceId, window, records).singleOrNull()
+        ?: throw PushProtocolException("replace_window requires multiple parts")
+
+    /** SHA-256(stream LF device LF compact-natural-key), matching cursor invalidation contract. */
+    fun keyFingerprint(table: PushAppendTable, deviceId: String, key: Map<String, Any?>): String {
+        validateRecordKeys(table, key)
+        return sha256Hex("${table.wireName}\n$deviceId\n${orderedObjectJson(key)}".toByteArray(Charsets.UTF_8))
+    }
+
+    internal fun mutableRecordEncodedSize(table: PushMutableTable, record: PushMutableRecord): Int {
+        validateRecord(table, record.key, record.data)
+        return encodeRecordLine(record).size
+    }
+
+    /** Stable local content identity. It is progress metadata and is never sent to the receiver. */
+    internal fun mutableSnapshotHash(
+        table: PushMutableTable,
+        records: List<PushMutableRecord>,
+    ): String {
+        val lines = records.map { record ->
+            validateRecord(table, record.key, record.data)
+            encodeRecordLine(record)
+        }.sortedWith { left, right -> compareBytes(left, right) }
+        val digest = MessageDigest.getInstance("SHA-256")
+        digest.update("noop-push-day-hash\n$VERSION\n${table.wireName}\n".toByteArray(Charsets.UTF_8))
+        lines.forEach(digest::update)
+        return digest.digest().joinToString("") { "%02x".format(it.toInt() and 0xff) }
+    }
+
+    internal fun canonicalJson(value: Any?): String = buildString { appendCanonical(value, sortMaps = true) }
+
+    private fun orderedObjectJson(value: Map<String, Any?>): String = buildString {
+        appendCanonical(value, sortMaps = false)
+    }
+
+    private fun StringBuilder.appendCanonical(value: Any?, sortMaps: Boolean) {
+        when (value) {
+            null -> append("null")
+            is String -> appendQuoted(value)
+            is Boolean -> append(if (value) "true" else "false")
+            is Byte, is Short, is Int, is Long -> append((value as Number).toLong())
+            is Float, is Double -> {
+                val d = (value as Number).toDouble()
+                if (!d.isFinite()) throw PushProtocolException("non-finite number is not valid JSON")
+                append(java.lang.Double.toString(d))
+            }
+            is Map<*, *> -> {
+                val entries = value.entries.map {
+                    val key = it.key as? String ?: throw PushProtocolException("JSON object key must be a string")
+                    key to it.value
+                }.let { if (sortMaps) it.sortedBy { entry -> entry.first } else it }
+                append('{')
+                entries.forEachIndexed { index, (key, item) ->
+                    if (index > 0) append(',')
+                    appendQuoted(key)
+                    append(':')
+                    appendCanonical(item, sortMaps)
+                }
+                append('}')
+            }
+            is Iterable<*> -> {
+                append('[')
+                value.forEachIndexed { index, item ->
+                    if (index > 0) append(',')
+                    appendCanonical(item, sortMaps)
+                }
+                append(']')
+            }
+            else -> throw PushProtocolException("unsupported JSON value ${value::class.java.name}")
+        }
+    }
+
+    private fun StringBuilder.appendQuoted(value: String) {
+        append('"')
+        for (ch in value) {
+            when (ch) {
+                '"' -> append("\\\"")
+                '\\' -> append("\\\\")
+                '\b' -> append("\\b")
+                '\u000C' -> append("\\f")
+                '\n' -> append("\\n")
+                '\r' -> append("\\r")
+                '\t' -> append("\\t")
+                else -> if (ch.code < 0x20) append("\\u%04x".format(ch.code)) else append(ch)
+            }
+        }
+        append('"')
+    }
+
+    private fun encodeRecordLine(record: PushAppendRecord): ByteArray =
+        encodeLine(mapOf("data" to record.data, "key" to record.key, "type" to "record"))
+
+    private fun encodeRecordLine(record: PushMutableRecord): ByteArray =
+        encodeLine(mapOf("data" to record.data, "key" to record.key, "type" to "record"))
+
+    private fun encodeLine(value: Map<String, Any?>): ByteArray =
+        (canonicalJson(value) + "\n").toByteArray(Charsets.UTF_8)
+
+    private fun appendIdentity(
+        sourceId: String,
+        table: PushAppendTable,
+        deviceId: String,
+        start: PushCursor?,
+        end: PushCursor,
+        count: Int,
+    ): Map<String, Any?> = mapOf(
+        "delivery" to "append",
+        "deviceId" to deviceId,
+        "endCursor" to cursorJson(end),
+        "protocolVersion" to VERSION,
+        "recordCount" to count,
+        "sourceId" to sourceId,
+        "startCursor" to start?.let(::cursorJson),
+        "stream" to table.wireName,
+        "type" to "batch",
+    )
+
+    private fun appendHeader(
+        sourceId: String,
+        table: PushAppendTable,
+        deviceId: String,
+        start: PushCursor?,
+        end: PushCursor,
+        count: Int,
+        batchId: String,
+    ): ByteArray = encodeLine(appendIdentity(sourceId, table, deviceId, start, end, count) + ("batchId" to batchId))
+
+    private fun mutableIdentity(
+        sourceId: String,
+        table: PushMutableTable,
+        deviceId: String,
+        window: PushWindow,
+        replacementId: String,
+        part: Int,
+        parts: Int,
+        count: Int,
+    ): Map<String, Any?> = mapOf(
+        "delivery" to "replace_window",
+        "deviceId" to deviceId,
+        "endCursor" to null,
+        "protocolVersion" to VERSION,
+        "recordCount" to count,
+        "sourceId" to sourceId,
+        "startCursor" to null,
+        "stream" to table.wireName,
+        "type" to "batch",
+        "window" to (selectorBounds(table, window) + mapOf(
+            "part" to part,
+            "parts" to parts,
+            "replacementId" to replacementId,
+        )),
+    )
+
+    private fun mutableHeader(
+        sourceId: String,
+        table: PushMutableTable,
+        deviceId: String,
+        window: PushWindow,
+        replacementId: String,
+        part: Int,
+        parts: Int,
+        count: Int,
+        batchId: String,
+    ): ByteArray = encodeLine(
+        mutableIdentity(sourceId, table, deviceId, window, replacementId, part, parts, count) +
+            ("batchId" to batchId),
+    )
+
+    private fun selectorBounds(table: PushMutableTable, window: PushWindow): Map<String, Any?> = when (table) {
+        PushMutableTable.DAILY_METRIC, PushMutableTable.JOURNAL -> mapOf(
+            "endExclusive" to java.time.LocalDate.parse(window.toDay).plusDays(1).toString(),
+            "selector" to "day",
+            "startInclusive" to window.fromDay,
+        )
+        PushMutableTable.SLEEP_SESSION, PushMutableTable.WORKOUT -> mapOf(
+            "endExclusive" to window.endTsExclusive,
+            "selector" to "startTs",
+            "startInclusive" to window.startTsInclusive,
+        )
+    }
+
+    private fun cursorFor(table: PushAppendTable, deviceId: String, record: PushAppendRecord) =
+        PushCursor(record.rowId, keyFingerprint(table, deviceId, record.key))
+
+    private fun cursorJson(cursor: PushCursor): Map<String, Any?> = mapOf(
+        "keySha256" to cursor.naturalKeyFingerprint,
+        "rowId" to cursor.rowId,
+    )
+
+    private fun stableUuid(header: Map<String, Any?>, lines: List<ByteArray>): String {
+        val digest = MessageDigest.getInstance("SHA-256")
+        digest.update(canonicalJson(header).toByteArray(Charsets.UTF_8))
+        digest.update('\n'.code.toByte())
+        lines.forEach(digest::update)
+        val bytes = digest.digest().copyOf(16)
+        bytes[6] = ((bytes[6].toInt() and 0x0f) or 0x50).toByte()
+        bytes[8] = ((bytes[8].toInt() and 0x3f) or 0x80).toByte()
+        val buffer = java.nio.ByteBuffer.wrap(bytes)
+        return UUID(buffer.long, buffer.long).toString()
+    }
+
+    private fun concatenate(header: ByteArray, lines: List<ByteArray>): ByteArray {
+        val out = ByteArray(header.size + lines.sumOf { it.size })
+        var offset = 0
+        header.copyInto(out, offset)
+        offset += header.size
+        lines.forEach { line ->
+            line.copyInto(out, offset)
+            offset += line.size
+        }
+        return out
+    }
+
+    private fun compareBytes(left: ByteArray, right: ByteArray): Int {
+        val common = minOf(left.size, right.size)
+        for (index in 0 until common) {
+            val difference = (left[index].toInt() and 0xff) - (right[index].toInt() and 0xff)
+            if (difference != 0) return difference
+        }
+        return left.size - right.size
+    }
+
+    private fun validateRecord(table: PushTable, key: Map<String, Any?>, data: Map<String, Any?>) {
+        val spec = REGISTRY.getValue(table.wireName)
+        if (key.keys.toList() != spec.first) throw PushProtocolException("${table.wireName} key does not match registry")
+        if (data.keys.toSet() != spec.second.toSet() || data.size != spec.second.size) {
+            throw PushProtocolException("${table.wireName} data does not match registry")
+        }
+        if ("deviceId" in key || "deviceId" in data || "synced" in data) {
+            throw PushProtocolException("batch-scoped or local-only column in record")
+        }
+    }
+
+    private fun validateRecordKeys(table: PushAppendTable, key: Map<String, Any?>) {
+        if (key.keys.toList() != REGISTRY.getValue(table.wireName).first) {
+            throw PushProtocolException("${table.wireName} key does not match registry")
+        }
+    }
+
+    private fun validateUuid(value: String, name: String) {
+        if (runCatching { UUID.fromString(value).toString() }.getOrNull() != value) {
+            throw PushProtocolException("$name must be a lowercase canonical UUID")
+        }
+    }
+
+    private fun sha256Hex(bytes: ByteArray): String = MessageDigest.getInstance("SHA-256")
+        .digest(bytes).joinToString("") { "%02x".format(it.toInt() and 0xff) }
+
+    private const val UUID_PLACEHOLDER = "00000000-0000-0000-0000-000000000000"
+
+    private val REGISTRY: Map<String, Pair<List<String>, List<String>>> = mapOf(
+        "hrSample" to (listOf("ts") to listOf("bpm")),
+        "rrInterval" to (listOf("ts", "rrMs", "seq") to listOf("ord", "srcChannel", "tsSuspect")),
+        "event" to (listOf("ts", "kind") to listOf("payloadJSON")),
+        "battery" to (listOf("ts") to listOf("soc", "mv", "charging")),
+        "spo2Sample" to (listOf("ts") to listOf("red", "ir")),
+        "skinTempSample" to (listOf("ts") to listOf("raw", "aux1Raw", "aux2Raw")),
+        "respSample" to (listOf("ts") to listOf("raw")),
+        "gravitySample" to (listOf("ts") to listOf("x", "y", "z", "dynAccel")),
+        "dailyMetric" to (listOf("day") to listOf(
+            "totalSleepMin", "efficiency", "deepMin", "remMin", "lightMin", "disturbances",
+            "restingHr", "avgHrv", "recovery", "strain", "exerciseCount", "spo2Pct",
+            "skinTempDevC", "respRateBpm", "steps", "activeKcalEst", "spo2Red", "spo2Ir",
+        )),
+        "sleepSession" to (listOf("startTs") to listOf(
+            "endTs", "efficiency", "restingHr", "avgHrv", "stagesJSON", "userEdited",
+            "startTsAdjusted", "motionJSON", "sleepStateJSON", "stagingSparse",
+        )),
+        "workout" to (listOf("startTs", "sport") to listOf(
+            "endTs", "source", "durationS", "energyKcal", "avgHr", "maxHr", "strain",
+            "distanceM", "zonesJSON", "notes", "routePolyline", "steps",
+        )),
+        "journal" to (listOf("day", "question") to listOf("answeredYes", "notes", "numericValue")),
+    )
+}
+
+data class PushAck(
+    val protocolVersion: String,
+    val batchId: String,
+    val stream: String,
+    val deviceId: String,
+    val endCursor: PushCursor?,
+    val acceptedRows: Int,
+    val status: String,
+) {
+    fun encode(): ByteArray = PushProtocol.canonicalJson(
+        mapOf(
+            "acceptedRows" to acceptedRows,
+            "batchId" to batchId,
+            "deviceId" to deviceId,
+            "endCursor" to endCursor?.let {
+                mapOf("keySha256" to it.naturalKeyFingerprint, "rowId" to it.rowId)
+            },
+            "protocolVersion" to protocolVersion,
+            "status" to status,
+            "stream" to stream,
+        ),
+    ).toByteArray(Charsets.UTF_8)
+
+    fun exactlyMatches(batch: PushBatch): Boolean =
+        protocolVersion == batch.protocolVersion && batchId == batch.batchId &&
+            stream == batch.table.wireName && deviceId == batch.deviceId &&
+            endCursor == batch.endCursor && acceptedRows == batch.recordCount && status == "accepted"
+
+    companion object {
+        fun fromBatch(batch: PushBatch): PushAck = PushAck(
+            batch.protocolVersion, batch.batchId, batch.table.wireName, batch.deviceId,
+            batch.endCursor, batch.recordCount, "accepted",
+        )
+
+        fun parse(bytes: ByteArray): PushAck {
+            if (bytes.size > PushProtocol.MAX_ACK_BYTES) throw PushProtocolException("ack exceeds size limit")
+            val obj = try {
+                JSONObject(bytes.toString(Charsets.UTF_8))
+            } catch (_: Throwable) {
+                throw PushProtocolException("ack is not valid JSON")
+            }
+            val expectedMembers = setOf(
+                "protocolVersion", "batchId", "stream", "deviceId", "endCursor",
+                "acceptedRows", "status",
+            )
+            val actualMembers = obj.keys().asSequence().toSet()
+            if (!actualMembers.containsAll(expectedMembers)) {
+                throw PushProtocolException("ack is missing required protocol 1.0 members")
+            }
+            if (actualMembers.any { it in PushProtocol.FORBIDDEN_REMOTE_CONTROL_MEMBERS }) {
+                throw PushProtocolException("ack contains forbidden remote-control metadata")
+            }
+            fun string(name: String): String = (obj.opt(name) as? String)?.takeIf { it.isNotEmpty() }
+                ?: throw PushProtocolException("ack.$name must be a non-empty string")
+            fun int(name: String): Int {
+                val number = obj.opt(name) as? Number ?: throw PushProtocolException("ack.$name must be an integer")
+                val long = number.toLong()
+                if (number.toDouble() != long.toDouble() || long !in Int.MIN_VALUE..Int.MAX_VALUE) {
+                    throw PushProtocolException("ack.$name must be an integer")
+                }
+                return long.toInt()
+            }
+            val cursor = when (val raw = obj.opt("endCursor")) {
+                null, JSONObject.NULL -> null
+                is JSONObject -> {
+                    if (!raw.keys().asSequence().toSet().containsAll(setOf("rowId", "keySha256"))) {
+                        throw PushProtocolException("ack.endCursor is missing required protocol 1.0 members")
+                    }
+                    val row = raw.opt("rowId") as? Number
+                        ?: throw PushProtocolException("ack.endCursor.rowId must be an integer")
+                    val rowId = row.toLong()
+                    if (row.toDouble() != rowId.toDouble()) {
+                        throw PushProtocolException("ack.endCursor.rowId must be an integer")
+                    }
+                    val sha = (raw.opt("keySha256") as? String)?.takeIf { it.matches(Regex("[0-9a-f]{64}")) }
+                        ?: throw PushProtocolException("ack.endCursor.keySha256 must be lowercase SHA-256")
+                    PushCursor(rowId, sha)
+                }
+                else -> throw PushProtocolException("ack.endCursor must be an object or null")
+            }
+            return PushAck(
+                protocolVersion = string("protocolVersion"),
+                batchId = string("batchId"),
+                stream = string("stream"),
+                deviceId = string("deviceId"),
+                endCursor = cursor,
+                acceptedRows = int("acceptedRows"),
+                status = string("status"),
+            )
+        }
+    }
+}
diff --git a/android/app/src/main/java/com/noop/push/PushRunSignal.kt b/android/app/src/main/java/com/noop/push/PushRunSignal.kt
new file mode 100644
index 0000000000..fd00967bd2
--- /dev/null
+++ b/android/app/src/main/java/com/noop/push/PushRunSignal.kt
@@ -0,0 +1,123 @@
+package com.noop.push
+
+import android.content.Context
+import android.content.SharedPreferences
+
+/** Durable owner/pending handshake spanning reservation, RUNNING, and WorkManager BACKOFF. */
+internal object PushRunSignal {
+    data class Settlement(val owned: Boolean, val pending: Boolean)
+    private const val PREFS = "self_hosted_push_signal"
+    private const val KEY_OWNER = "owner"
+    private const val KEY_STATE = "state"
+    private const val KEY_RESERVED_AT = "reserved_at"
+    private const val KEY_PENDING = "pending"
+    private const val STATE_RESERVED = "reserved"
+    private const val STATE_RUNNING = "running"
+    private const val STATE_BACKOFF = "backoff"
+    private const val RESERVATION_TTL_MILLIS = 2 * 60 * 1_000L
+    private val lock = Any()
+
+    /** Atomically reserves an empty slot, expires an abandoned reservation, or coalesces a trigger. */
+    fun reserve(context: Context, requestId: String): Boolean =
+        reserve(prefs(context), requestId, System.currentTimeMillis())
+
+    internal fun reserve(prefs: SharedPreferences, requestId: String, now: Long = 0L): Boolean = synchronized(lock) {
+        val owner = prefs.getString(KEY_OWNER, null)
+        val staleReservation = owner != null && prefs.getString(KEY_STATE, null) == STATE_RESERVED &&
+            now - prefs.getLong(KEY_RESERVED_AT, now) >= RESERVATION_TTL_MILLIS
+        if (owner != null && !staleReservation) {
+            check(prefs.edit().putBoolean(KEY_PENDING, true).commit()) { "Could not persist push trigger" }
+            false
+        } else {
+            check(prefs.edit().putString(KEY_OWNER, requestId).putString(KEY_STATE, STATE_RESERVED)
+                .putLong(KEY_RESERVED_AT, now).putBoolean(KEY_PENDING, false).commit()) {
+                "Could not reserve push work"
+            }
+            true
+        }
+    }
+
+    fun begin(context: Context, requestId: String) = begin(prefs(context), requestId)
+
+    internal fun begin(prefs: SharedPreferences, requestId: String) = synchronized(lock) {
+        val owner = prefs.getString(KEY_OWNER, null)
+        check(owner == null || owner == requestId) { "Push work owner mismatch" }
+        check(prefs.edit().putString(KEY_OWNER, requestId).putString(KEY_STATE, STATE_RUNNING)
+            .remove(KEY_RESERVED_AT).commit()) { "Could not persist push worker owner" }
+    }
+
+    /** Retry retains ownership through BACKOFF; terminal completion compare-and-clears this owner. */
+    fun finish(context: Context, requestId: String, willRetry: Boolean): Boolean =
+        finish(prefs(context), requestId, willRetry)
+
+    internal fun finish(prefs: SharedPreferences, requestId: String, willRetry: Boolean): Boolean =
+        settle(prefs, requestId, willRetry) {}.pending
+
+    /**
+     * Reads pending, commits the caller's status, then releases/transitions the owner under one lock.
+     * A trigger can therefore land either before the status decision (and force CONTINUING) or after
+     * release (and write QUEUED itself), but an old worker can never overwrite the newer trigger.
+     */
+    fun settle(
+        context: Context,
+        requestId: String,
+        willRetry: Boolean,
+        updateStatus: (pending: Boolean) -> Unit,
+    ): Settlement = settle(prefs(context), requestId, willRetry, updateStatus)
+
+    internal fun settle(
+        prefs: SharedPreferences,
+        requestId: String,
+        willRetry: Boolean,
+        updateStatus: (pending: Boolean) -> Unit,
+    ): Settlement = synchronized(lock) {
+        if (prefs.getString(KEY_OWNER, null) != requestId) return@synchronized Settlement(false, false)
+        val pending = prefs.getBoolean(KEY_PENDING, false)
+        updateStatus(pending)
+        // Only a genuine failure retry keeps this request as owner through WorkManager backoff.
+        // Healthy continuation returns success and is queued as a fresh request by the caller.
+        val keepOwner = willRetry
+        val edit = prefs.edit().putBoolean(KEY_PENDING, false).remove(KEY_RESERVED_AT)
+        if (keepOwner) edit.putString(KEY_STATE, STATE_BACKOFF) else edit.remove(KEY_OWNER).remove(KEY_STATE)
+        check(edit.commit()) { "Could not finish push worker owner" }
+        Settlement(true, pending)
+    }
+
+    /** Safe before begin: a failed enqueue cannot clear a running or backoff owner. */
+    fun releaseReservation(context: Context, requestId: String): Boolean =
+        releaseReservation(prefs(context), requestId) {}
+
+    internal fun releaseReservation(prefs: SharedPreferences, requestId: String): Boolean =
+        releaseReservation(prefs, requestId) {}
+
+    fun releaseReservation(
+        context: Context,
+        requestId: String,
+        updateStatus: (pending: Boolean) -> Unit,
+    ): Boolean = releaseReservation(prefs(context), requestId, updateStatus)
+
+    internal fun releaseReservation(
+        prefs: SharedPreferences,
+        requestId: String,
+        updateStatus: (pending: Boolean) -> Unit,
+    ): Boolean = synchronized(lock) {
+        if (prefs.getString(KEY_OWNER, null) == requestId && prefs.getString(KEY_STATE, null) == STATE_RESERVED) {
+            val pending = prefs.getBoolean(KEY_PENDING, false)
+            // Status is committed while this owner still excludes a successor. A new QUEUED owner
+            // can therefore only write after this failed owner's status decision is finished.
+            updateStatus(pending)
+            check(prefs.edit().remove(KEY_OWNER).remove(KEY_STATE).remove(KEY_RESERVED_AT).remove(KEY_PENDING).commit()) {
+                "Could not release push reservation"
+            }
+            pending
+        } else {
+            false
+        }
+    }
+
+    fun clear(context: Context) = clear(prefs(context))
+    internal fun clear(prefs: SharedPreferences) = synchronized(lock) { prefs.edit().clear().apply() }
+
+    private fun prefs(context: Context) =
+        context.applicationContext.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+}
diff --git a/android/app/src/main/java/com/noop/push/PushWorkerGate.kt b/android/app/src/main/java/com/noop/push/PushWorkerGate.kt
new file mode 100644
index 0000000000..e8119ed191
--- /dev/null
+++ b/android/app/src/main/java/com/noop/push/PushWorkerGate.kt
@@ -0,0 +1,23 @@
+package com.noop.push
+
+/** Ordering seam: stale/disabled work exits before network, Keystore, Room, or HTTP are touched. */
+internal object PushWorkerGate {
+    sealed interface Outcome {
+        data object DisabledOrInvalid : Outcome
+        data object NetworkUnavailable : Outcome
+        data object MissingToken : Outcome
+        data class Executed(val retry: Boolean) : Outcome
+    }
+
+    suspend fun run(
+        enabledEndpoint: () -> PushEndpointPolicy.ValidEndpoint?,
+        networkAvailable: () -> Boolean,
+        token: () -> String?,
+        execute: suspend (PushEndpointPolicy.ValidEndpoint, String) -> Boolean,
+    ): Outcome {
+        val endpoint = enabledEndpoint() ?: return Outcome.DisabledOrInvalid
+        if (!networkAvailable()) return Outcome.NetworkUnavailable
+        val bearer = token() ?: return Outcome.MissingToken
+        return Outcome.Executed(retry = execute(endpoint, bearer))
+    }
+}
diff --git a/android/app/src/main/java/com/noop/push/SelfHostedPushScheduler.kt b/android/app/src/main/java/com/noop/push/SelfHostedPushScheduler.kt
new file mode 100644
index 0000000000..84ee0b63fc
--- /dev/null
+++ b/android/app/src/main/java/com/noop/push/SelfHostedPushScheduler.kt
@@ -0,0 +1,164 @@
+package com.noop.push
+
+import android.content.Context
+import androidx.work.BackoffPolicy
+import androidx.work.Constraints
+import androidx.work.ExistingWorkPolicy
+import androidx.work.NetworkType
+import androidx.work.OneTimeWorkRequest
+import androidx.work.WorkManager
+import androidx.work.await
+import java.util.concurrent.atomic.AtomicBoolean
+import java.util.concurrent.TimeUnit
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.launch
+
+/** Exactly-once cleanup seam shared by synchronous throws and asynchronous Operation failures. */
+internal class PushEnqueueCompletion(
+    private val settleFailure: () -> Boolean,
+    private val requeuePending: () -> Unit,
+) {
+    private val completed = AtomicBoolean(false)
+    @Volatile var requeuedPending: Boolean = false
+        private set
+
+    fun success(): Boolean = completed.compareAndSet(false, true)
+
+    fun failure(): Boolean {
+        if (!completed.compareAndSet(false, true)) return false
+        val pending = settleFailure()
+        if (pending) {
+            requeuedPending = true
+            requeuePending()
+        }
+        return true
+    }
+}
+
+internal fun continuationEnqueueCompletion(
+    settleFailure: () -> Boolean,
+    requeuePending: () -> Unit,
+) = PushEnqueueCompletion(settleFailure, requeuePending)
+
+internal fun requiredPushNetworkType(wifiOnly: Boolean): NetworkType =
+    if (wifiOnly) NetworkType.UNMETERED else NetworkType.CONNECTED
+
+/** The only entry point that queues pushes. Unique work serialises every trigger to one worker. */
+object SelfHostedPushScheduler {
+    internal const val UNIQUE_WORK = "self-hosted-health-push"
+    internal const val BACKOFF_SECONDS = 30L
+    // A new true offload supersedes stale/running work. Cancellable deterministic requests and exact
+    // acks make replay safe, while REPLACE prevents an unbounded chain of rapid offload triggers.
+    internal val EXISTING_WORK_POLICY = ExistingWorkPolicy.REPLACE
+    internal val CONTINUATION_WORK_POLICY = ExistingWorkPolicy.APPEND_OR_REPLACE
+
+    fun enqueueAfterSuccessfulOffload(context: Context) = enqueueExternal(context)
+
+    fun enqueueLaunchCatchUp(context: Context) = enqueueExternal(context)
+
+    fun enqueueManualCatchUp(context: Context) = enqueueExternal(context)
+
+    /** Revoke an in-flight destination snapshot before queueing a baseline for the newly saved URL. */
+    fun destinationChanged(context: Context) {
+        val app = context.applicationContext
+        PushRunSignal.clear(app)
+        WorkManager.getInstance(app).cancelUniqueWork(UNIQUE_WORK)
+        enqueueExternal(app)
+    }
+
+    /** Replace queued work so a changed network policy takes effect immediately. */
+    fun networkPolicyChanged(context: Context) {
+        val app = context.applicationContext
+        PushRunSignal.clear(app)
+        WorkManager.getInstance(app).cancelUniqueWork(UNIQUE_WORK)
+        enqueueExternal(app)
+    }
+
+    /** Queue the next healthy pagination/device slice without WorkManager's failure backoff. */
+    internal suspend fun enqueueContinuation(
+        context: Context,
+        preserveTriggerOnFailure: Boolean = false,
+    ): Boolean {
+        val app = context.applicationContext
+        val settings = SelfHostedPushSettings.from(app)
+        if (settings.enabledEndpoint() == null) return true
+        val request = request(settings.wifiOnly())
+        // Another real trigger won the release/enqueue race and now owns a queued request.
+        if (!PushRunSignal.reserve(app, request.id.toString())) return true
+        val completion = continuationEnqueueCompletion(
+            settleFailure = {
+                PushRunSignal.releaseReservation(app, request.id.toString()) || preserveTriggerOnFailure
+            },
+            // A real trigger may have coalesced while Operation.await() was in flight. Preserve it
+            // as fresh external work; the current worker will observe its owner and return success.
+            requeuePending = { enqueueExternal(app) },
+        )
+        return try {
+            val operation = WorkManager.getInstance(app).enqueueUniqueWork(
+                UNIQUE_WORK, CONTINUATION_WORK_POLICY, request,
+            )
+            operation.await()
+            completion.success()
+            true
+        } catch (cancelled: CancellationException) {
+            completion.failure()
+            throw cancelled
+        } catch (_: Throwable) {
+            completion.failure()
+            completion.requeuedPending
+        }
+    }
+
+    fun cancel(context: Context) {
+        val app = context.applicationContext
+        // This is the immediate correctness boundary; WorkManager cancellation itself is async.
+        // Disabled settings make the UI idle now and cause all late worker status writes to no-op.
+        SelfHostedPushSettings.from(app).setEnabled(false)
+        PushRunSignal.clear(app)
+        WorkManager.getInstance(app).cancelUniqueWork(UNIQUE_WORK)
+    }
+
+    private fun enqueueExternal(context: Context) {
+        val app = context.applicationContext
+        val settings = SelfHostedPushSettings.from(app)
+        if (settings.enabledEndpoint() == null) return
+        val request = request(settings.wifiOnly())
+        if (!PushRunSignal.reserve(app, request.id.toString())) return
+        val completion = PushEnqueueCompletion(
+            settleFailure = {
+                PushRunSignal.releaseReservation(app, request.id.toString()) { pending ->
+                    if (!pending) settings.recordError("Push could not be queued.")
+                }
+            },
+            // A trigger coalesced while WorkManager's async Operation was in flight. Recreate it
+            // after releasing the failed owner; if a newer trigger wins the race, reserve coalesces.
+            requeuePending = { enqueueExternal(app) },
+        )
+        try {
+            settings.recordPushStarted()
+            val operation = WorkManager.getInstance(app).enqueueUniqueWork(UNIQUE_WORK, EXISTING_WORK_POLICY, request)
+            enqueueObserverScope.launch {
+                try {
+                    operation.await()
+                    completion.success()
+                } catch (_: Throwable) {
+                    completion.failure()
+                }
+            }
+        } catch (_: Throwable) {
+            completion.failure()
+        }
+    }
+
+    private fun request(wifiOnly: Boolean) = OneTimeWorkRequest.Builder(SelfHostedPushWorker::class.java)
+        .setConstraints(
+            Constraints.Builder().setRequiredNetworkType(requiredPushNetworkType(wifiOnly)).build(),
+        )
+        .setBackoffCriteria(BackoffPolicy.EXPONENTIAL, BACKOFF_SECONDS, TimeUnit.SECONDS)
+        .build() // Deliberately no input Data: credentials and endpoint never enter Worker metadata.
+
+    private val enqueueObserverScope = CoroutineScope(SupervisorJob() + Dispatchers.Default)
+}
diff --git a/android/app/src/main/java/com/noop/push/SelfHostedPushScreen.kt b/android/app/src/main/java/com/noop/push/SelfHostedPushScreen.kt
new file mode 100644
index 0000000000..481102ad3f
--- /dev/null
+++ b/android/app/src/main/java/com/noop/push/SelfHostedPushScreen.kt
@@ -0,0 +1,367 @@
+package com.noop.push
+
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.CloudUpload
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.OutlinedTextFieldDefaults
+import androidx.compose.material3.LinearProgressIndicator
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.input.PasswordVisualTransformation
+import androidx.compose.ui.text.input.VisualTransformation
+import androidx.compose.ui.unit.dp
+import com.noop.R
+import com.noop.ui.NoopButton
+import com.noop.ui.NoopButtonKind
+import com.noop.ui.NoopType
+import com.noop.ui.Palette
+import com.noop.ui.ScreenScaffold
+import com.noop.ui.SettingsCard
+import com.noop.ui.SettingsToggleRow
+import java.text.DateFormat
+import java.util.Date
+import kotlinx.coroutines.currentCoroutineContext
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.isActive
+import kotlinx.coroutines.launch
+
+private sealed interface CapabilityProbeUi {
+    data object Idle : CapabilityProbeUi
+    data object Testing : CapabilityProbeUi
+    data class Success(val streams: List<String>, val checkedAt: Long) : CapabilityProbeUi
+    data class Failure(val failure: PushFailure) : CapabilityProbeUi
+}
+
+/** Experimental, explicit consent surface for raw one-way health-data egress. */
+@Composable
+fun SelfHostedPushScreen() {
+    val context = LocalContext.current
+    val settings = remember { SelfHostedPushSettings.from(context) }
+    var endpoint by remember { mutableStateOf(settings.endpointText()) }
+    var token by remember { mutableStateOf("") }
+    var snapshot by remember { mutableStateOf(settings.snapshot()) }
+    var validationMessage by remember { mutableStateOf<String?>(null) }
+    var capabilityProbe by remember { mutableStateOf<CapabilityProbeUi>(CapabilityProbeUi.Idle) }
+    var capabilityProbeGeneration by remember { mutableStateOf(0) }
+    val scope = rememberCoroutineScope()
+
+    // WorkManager runs outside this composition. Refresh while visible so progress and completion do
+    // not require navigating away and back (and avoid retaining a UI listener in process globals).
+    LaunchedEffect(settings) {
+        while (currentCoroutineContext().isActive) {
+            snapshot = settings.snapshot()
+            delay(750)
+        }
+    }
+
+    val validatedEndpoint = PushEndpointPolicy.validate(endpoint) as? PushEndpointPolicy.Result.Valid
+    val endpointValid = validatedEndpoint != null
+    val tokenAvailable = token.isNotBlank() || snapshot.hasToken
+    val active = snapshot.runState in setOf(
+        SelfHostedPushSettings.RunState.QUEUED,
+        SelfHostedPushSettings.RunState.RUNNING,
+        SelfHostedPushSettings.RunState.CONTINUING,
+        SelfHostedPushSettings.RunState.RETRYING,
+    )
+
+    ScreenScaffold(
+        title = stringResource(R.string.push_title),
+        subtitle = stringResource(R.string.push_subtitle),
+    ) {
+        SettingsCard(
+            icon = Icons.Filled.CloudUpload,
+            title = stringResource(R.string.push_destination_title),
+            blurb = stringResource(R.string.push_disclosure),
+        ) {
+            Column(verticalArrangement = Arrangement.spacedBy(12.dp)) {
+                Text(
+                    stringResource(R.string.push_one_way_warning),
+                    style = NoopType.footnote,
+                    color = Palette.statusWarning,
+                )
+                PushTextField(
+                    value = endpoint,
+                    onValueChange = {
+                        endpoint = it
+                        validationMessage = null
+                        capabilityProbe = CapabilityProbeUi.Idle
+                        capabilityProbeGeneration++
+                    },
+                    label = stringResource(R.string.push_endpoint),
+                    secret = false,
+                )
+                PushTextField(
+                    value = token,
+                    onValueChange = {
+                        token = it
+                        capabilityProbe = CapabilityProbeUi.Idle
+                        capabilityProbeGeneration++
+                    },
+                    label = if (snapshot.hasToken) stringResource(R.string.push_token_saved) else stringResource(R.string.push_token),
+                    secret = true,
+                )
+                validationMessage?.let {
+                    Text(it, style = NoopType.footnote, color = Palette.statusWarning)
+                }
+                NoopButton(
+                    text = stringResource(R.string.push_save),
+                    kind = NoopButtonKind.Secondary,
+                    fullWidth = true,
+                    enabled = endpointValid && tokenAvailable,
+                    onClick = {
+                        when (val result = settings.saveEndpoint(endpoint)) {
+                            is PushEndpointPolicy.Result.Invalid -> validationMessage = result.reason
+                            is PushEndpointPolicy.Result.Valid -> {
+                                val destinationChanged = snapshot.endpoint?.url != result.endpoint.url
+                                endpoint = result.endpoint.url
+                                if (token.isNotBlank()) settings.saveToken(token)
+                                token = ""
+                                snapshot = settings.snapshot()
+                                if (destinationChanged && snapshot.ready) {
+                                    SelfHostedPushScheduler.destinationChanged(context)
+                                }
+                                validationMessage = context.getString(R.string.push_saved)
+                            }
+                        }
+                    },
+                )
+                NoopButton(
+                    text = if (capabilityProbe == CapabilityProbeUi.Testing) {
+                        stringResource(R.string.push_testing_connection)
+                    } else {
+                        stringResource(R.string.push_test_connection)
+                    },
+                    kind = NoopButtonKind.Secondary,
+                    fullWidth = true,
+                    enabled = endpointValid && tokenAvailable && capabilityProbe != CapabilityProbeUi.Testing,
+                    onClick = {
+                        val valid = PushEndpointPolicy.validate(endpoint) as? PushEndpointPolicy.Result.Valid
+                        val testToken = token.trim().takeIf(String::isNotEmpty) ?: settings.token()
+                        if (valid == null || testToken == null) {
+                            validationMessage = context.getString(R.string.push_config_required)
+                        } else if (!canStartPushConnectionTest(
+                                networkAvailable = isPushNetworkAvailable(
+                                    context,
+                                    wifiOnly = snapshot.wifiOnly,
+                                ),
+                                endpointValid = true,
+                                tokenAvailable = true,
+                            )
+                        ) {
+                            validationMessage = context.getString(R.string.push_test_network_required)
+                        } else {
+                            val generation = capabilityProbeGeneration + 1
+                            capabilityProbeGeneration = generation
+                            val persistResult = token.isBlank() && valid.endpoint.url == snapshot.endpoint?.url
+                            capabilityProbe = CapabilityProbeUi.Testing
+                            scope.launch {
+                                val result = PushConnectionTester().test(valid.endpoint, testToken)
+                                if (capabilityProbeGeneration != generation) return@launch
+                                capabilityProbe = when (result) {
+                                    is PushCapabilitiesResult.Available -> {
+                                        val checkedAt = System.currentTimeMillis()
+                                        if (persistResult) runCatching {
+                                            settings.recordCapabilities(
+                                                valid.endpoint,
+                                                result.capabilities,
+                                                checkedAt,
+                                            )
+                                        }
+                                        snapshot = settings.snapshot()
+                                        CapabilityProbeUi.Success(result.capabilities.wireNames, checkedAt)
+                                    }
+                                    is PushCapabilitiesResult.Rejected -> CapabilityProbeUi.Failure(
+                                        result.failure ?: PushFailure(PushFailureCode.NETWORK_IO),
+                                    )
+                                }
+                            }
+                        }
+                    },
+                )
+                Text(
+                    stringResource(R.string.push_test_connection_detail),
+                    style = NoopType.footnote,
+                    color = Palette.textSecondary,
+                )
+                val probeSuccess = capabilityProbe as? CapabilityProbeUi.Success
+                val savedEndpointMatches = token.isBlank() &&
+                    validatedEndpoint?.endpoint?.url == snapshot.endpoint?.url
+                val shownStreams = probeSuccess?.streams ?: snapshot.supportedStreams.takeIf { savedEndpointMatches }
+                val capabilitiesCheckedAt = probeSuccess?.checkedAt
+                    ?: snapshot.capabilitiesCheckedAt.takeIf { savedEndpointMatches }
+                when (val probe = capabilityProbe) {
+                    is CapabilityProbeUi.Failure -> Text(
+                        pushFailureMessage(context, probe.failure),
+                        style = NoopType.footnote,
+                        color = Palette.statusWarning,
+                    )
+                    CapabilityProbeUi.Testing -> LinearProgressIndicator(
+                        modifier = Modifier.fillMaxWidth(),
+                        color = Palette.accent,
+                    )
+                    else -> Unit
+                }
+                shownStreams?.let { streams ->
+                    Text(
+                        stringResource(
+                            R.string.push_capabilities_summary,
+                            streams.size,
+                            PushCapabilities.ALL.wireNames.size,
+                        ),
+                        style = NoopType.body,
+                        color = if (streams.isEmpty()) Palette.statusWarning else Palette.textPrimary,
+                    )
+                    capabilitiesCheckedAt?.let { checkedAt ->
+                        val checked = DateFormat.getDateTimeInstance(
+                            DateFormat.MEDIUM,
+                            DateFormat.SHORT,
+                        ).format(Date(checkedAt))
+                        Text(
+                            stringResource(R.string.push_capabilities_checked, checked),
+                            style = NoopType.footnote,
+                            color = Palette.textSecondary,
+                        )
+                    }
+                    Text(
+                        if (streams.isEmpty()) stringResource(R.string.push_capabilities_none)
+                        else stringResource(R.string.push_capabilities_streams, streams.joinToString(" · ")),
+                        style = NoopType.footnote,
+                        color = if (streams.isEmpty()) Palette.statusWarning else Palette.textSecondary,
+                    )
+                }
+                if (snapshot.hasToken) {
+                    NoopButton(
+                        text = stringResource(R.string.push_clear_token),
+                        kind = NoopButtonKind.Secondary,
+                        fullWidth = true,
+                        onClick = {
+                            settings.saveToken("")
+                            settings.setEnabled(false)
+                            SelfHostedPushScheduler.cancel(context)
+                            snapshot = settings.snapshot()
+                            validationMessage = context.getString(R.string.push_token_cleared)
+                        },
+                    )
+                }
+                SettingsToggleRow(
+                    title = stringResource(R.string.push_wifi_only),
+                    detail = stringResource(R.string.push_wifi_only_detail),
+                    checked = snapshot.wifiOnly,
+                    onCheckedChange = { requested ->
+                        capabilityProbe = CapabilityProbeUi.Idle
+                        capabilityProbeGeneration++
+                        settings.setWifiOnly(requested)
+                        SelfHostedPushScheduler.networkPolicyChanged(context)
+                        snapshot = settings.snapshot()
+                    },
+                )
+                SettingsToggleRow(
+                    title = stringResource(R.string.push_enabled),
+                    detail = stringResource(R.string.push_enabled_detail),
+                    checked = snapshot.enabled,
+                    onCheckedChange = { requested ->
+                        if (!requested) {
+                            settings.setEnabled(false)
+                            SelfHostedPushScheduler.cancel(context)
+                        } else if (!settings.setEnabled(true)) {
+                            validationMessage = context.getString(R.string.push_config_required)
+                        } else {
+                            SelfHostedPushScheduler.enqueueLaunchCatchUp(context)
+                        }
+                        snapshot = settings.snapshot()
+                    },
+                )
+                NoopButton(
+                    text = stringResource(R.string.push_export_now),
+                    kind = NoopButtonKind.Secondary,
+                    fullWidth = true,
+                    enabled = snapshot.ready,
+                    onClick = {
+                        SelfHostedPushScheduler.enqueueManualCatchUp(context)
+                        snapshot = settings.snapshot()
+                    },
+                )
+                Text(
+                    stringResource(R.string.push_export_now_detail),
+                    style = NoopType.footnote,
+                    color = Palette.textSecondary,
+                )
+            }
+        }
+
+        SettingsCard(
+            icon = Icons.Filled.CloudUpload,
+            title = stringResource(R.string.push_status_title),
+            blurb = stringResource(R.string.push_status_detail),
+        ) {
+            if (active) {
+                LinearProgressIndicator(modifier = Modifier.fillMaxWidth(), color = Palette.accent)
+            }
+            val state = when (snapshot.runState) {
+                SelfHostedPushSettings.RunState.IDLE -> stringResource(R.string.push_state_idle)
+                SelfHostedPushSettings.RunState.QUEUED -> stringResource(R.string.push_state_queued)
+                SelfHostedPushSettings.RunState.RUNNING -> stringResource(R.string.push_state_running)
+                SelfHostedPushSettings.RunState.CONTINUING -> stringResource(R.string.push_state_continuing)
+                SelfHostedPushSettings.RunState.RETRYING -> stringResource(R.string.push_state_retrying)
+                SelfHostedPushSettings.RunState.COMPLETE -> stringResource(R.string.push_state_complete)
+                SelfHostedPushSettings.RunState.FAILED -> stringResource(R.string.push_state_failed)
+            }
+            Text(stringResource(R.string.push_current_state, state), style = NoopType.body, color = Palette.textPrimary)
+            Text(
+                stringResource(R.string.push_progress, snapshot.acceptedBatches, snapshot.acceptedRecords),
+                style = NoopType.footnote,
+                color = Palette.textSecondary,
+            )
+            snapshot.currentStream?.let { stream ->
+                Text(
+                    stringResource(R.string.push_current_stream, stream),
+                    style = NoopType.footnote,
+                    color = Palette.textSecondary,
+                )
+            }
+            val success = snapshot.lastSuccessAt?.let {
+                DateFormat.getDateTimeInstance(DateFormat.MEDIUM, DateFormat.SHORT).format(Date(it))
+            } ?: stringResource(R.string.push_never)
+            Text(stringResource(R.string.push_last_success, success), style = NoopType.body, color = Palette.textPrimary)
+            snapshot.lastError?.let {
+                Text(stringResource(R.string.push_last_error, it), style = NoopType.footnote, color = Palette.statusWarning)
+            }
+        }
+    }
+}
+
+@Composable
+private fun PushTextField(value: String, onValueChange: (String) -> Unit, label: String, secret: Boolean) {
+    OutlinedTextField(
+        value = value,
+        onValueChange = onValueChange,
+        label = { Text(label) },
+        singleLine = true,
+        visualTransformation = if (secret) PasswordVisualTransformation() else VisualTransformation.None,
+        textStyle = NoopType.mono(13f),
+        modifier = Modifier.fillMaxWidth(),
+        shape = RoundedCornerShape(14.dp),
+        colors = OutlinedTextFieldDefaults.colors(
+            focusedTextColor = Palette.textPrimary,
+            unfocusedTextColor = Palette.textPrimary,
+            focusedBorderColor = Palette.accent,
+            unfocusedBorderColor = Palette.hairline,
+            cursorColor = Palette.accent,
+            focusedContainerColor = Palette.surfaceInset,
+            unfocusedContainerColor = Palette.surfaceInset,
+        ),
+    )
+}
diff --git a/android/app/src/main/java/com/noop/push/SelfHostedPushSettings.kt b/android/app/src/main/java/com/noop/push/SelfHostedPushSettings.kt
new file mode 100644
index 0000000000..caddcdb18d
--- /dev/null
+++ b/android/app/src/main/java/com/noop/push/SelfHostedPushSettings.kt
@@ -0,0 +1,299 @@
+package com.noop.push
+
+import android.content.Context
+import android.content.SharedPreferences
+import com.noop.data.SecurePrefs
+import java.security.MessageDigest
+import java.util.UUID
+
+/** Stores configuration without ever placing the bearer token in ordinary preferences. */
+class SelfHostedPushSettings private constructor(
+    private val prefs: SharedPreferences,
+    private val secrets: Lazy<SharedPreferences>,
+) {
+    enum class RunState { IDLE, QUEUED, RUNNING, CONTINUING, RETRYING, COMPLETE, FAILED }
+
+    data class Snapshot(
+        val enabled: Boolean,
+        val wifiOnly: Boolean,
+        val endpoint: PushEndpointPolicy.ValidEndpoint?,
+        val hasToken: Boolean,
+        val lastSuccessAt: Long?,
+        val lastError: String?,
+        val runState: RunState,
+        val acceptedBatches: Int,
+        val acceptedRecords: Long,
+        val currentStream: String?,
+        val supportedStreams: List<String>?,
+        val capabilitiesCheckedAt: Long?,
+    ) {
+        val ready: Boolean get() = enabled && endpoint != null && hasToken
+    }
+
+    fun snapshot(): Snapshot {
+        val enabled = prefs.getBoolean(KEY_ENABLED, false)
+        val endpoint = (PushEndpointPolicy.validate(prefs.getString(KEY_ENDPOINT, "").orEmpty()) as? PushEndpointPolicy.Result.Valid)?.endpoint
+        val capabilities = capabilitiesFor(endpoint)
+        return Snapshot(
+            enabled = enabled,
+            wifiOnly = wifiOnly(),
+            endpoint = endpoint,
+            hasToken = !secrets.value.getString(KEY_TOKEN, null).isNullOrBlank(),
+            lastSuccessAt = prefs.getLong(KEY_LAST_SUCCESS, 0L).takeIf { it > 0 },
+            lastError = prefs.getString(KEY_LAST_ERROR, null),
+            runState = if (!enabled) RunState.IDLE else runCatching {
+                RunState.valueOf(prefs.getString(KEY_RUN_STATE, RunState.IDLE.name).orEmpty())
+            }.getOrDefault(RunState.IDLE),
+            acceptedBatches = prefs.getInt(KEY_ACCEPTED_BATCHES, 0).coerceAtLeast(0),
+            acceptedRecords = prefs.getLong(KEY_ACCEPTED_RECORDS, 0L).coerceAtLeast(0L),
+            currentStream = prefs.getString(KEY_CURRENT_STREAM, null),
+            supportedStreams = capabilities,
+            capabilitiesCheckedAt = prefs.getLong(KEY_CAPABILITIES_AT, 0L)
+                .takeIf { it > 0 && capabilities != null },
+        )
+    }
+
+    fun endpointText(): String = prefs.getString(KEY_ENDPOINT, "").orEmpty()
+    fun wifiOnly(): Boolean = prefs.getBoolean(KEY_WIFI_ONLY, true)
+
+    fun setWifiOnly(wifiOnly: Boolean) {
+        check(prefs.edit().putBoolean(KEY_WIFI_ONLY, wifiOnly).commit()) {
+            "Could not persist push network policy"
+        }
+    }
+
+    /** Plain-pref gate used by stale workers before opening Room or Android Keystore. */
+    fun enabledEndpoint(): PushEndpointPolicy.ValidEndpoint? {
+        if (!prefs.getBoolean(KEY_ENABLED, false)) return null
+        return (PushEndpointPolicy.validate(endpointText()) as? PushEndpointPolicy.Result.Valid)?.endpoint
+    }
+
+    fun token(): String? = secrets.value.getString(KEY_TOKEN, null)?.takeIf { it.isNotBlank() }
+
+    /** Stable, non-secret receiver namespace. Generated only after the worker's stale-work gates pass. */
+    @Synchronized
+    fun sourceId(): String {
+        prefs.getString(KEY_SOURCE_ID, null)?.let { existing ->
+            runCatching { UUID.fromString(existing) }.getOrNull()?.let { return it.toString() }
+        }
+        val generated = UUID.randomUUID().toString()
+        check(prefs.edit().putString(KEY_SOURCE_ID, generated).commit()) { "Could not persist push source id" }
+        return generated
+    }
+
+    /** Saving a different normalized URL changes the progress namespace; token rotation does not. */
+    fun saveEndpoint(raw: String): PushEndpointPolicy.Result {
+        val validation = PushEndpointPolicy.validate(raw)
+        val normalized = (validation as? PushEndpointPolicy.Result.Valid)?.endpoint?.url
+            ?: return validation
+        val edit = prefs.edit().putString(KEY_ENDPOINT, normalized)
+        if (prefs.getString(KEY_CAPABILITIES_ENDPOINT, null) != normalized) {
+            edit.remove(KEY_CAPABILITIES_ENDPOINT)
+                .remove(KEY_CAPABILITIES_STREAMS)
+                .remove(KEY_CAPABILITIES_AT)
+        }
+        edit.apply()
+        return validation
+    }
+
+    fun saveToken(token: String) {
+        val trimmed = token.trim()
+        val changed = secrets.value.getString(KEY_TOKEN, null).orEmpty() != trimmed
+        secrets.value.edit().let { edit ->
+            if (trimmed.isEmpty()) edit.remove(KEY_TOKEN) else edit.putString(KEY_TOKEN, trimmed)
+        }.apply()
+        if (changed) clearCapabilities()
+    }
+
+    fun setEnabled(enabled: Boolean): Boolean = synchronized(statusLock) {
+        if (enabled && !snapshot().copy(enabled = true).ready) return@synchronized false
+        val edit = prefs.edit().putBoolean(KEY_ENABLED, enabled)
+        if (!enabled) edit.putString(KEY_RUN_STATE, RunState.IDLE.name)
+            .remove(KEY_LAST_ERROR).remove(KEY_CURRENT_STREAM)
+        check(edit.commit()) { "Could not persist push enabled state" }
+        true
+    }
+
+    fun progressNamespace(
+        sourceId: String,
+        endpoint: PushEndpointPolicy.ValidEndpoint,
+        protocolVersion: String = PushProtocol.VERSION,
+        receiverStateId: String = PushCapabilities.UNSCOPED_RECEIVER_STATE_ID,
+    ): String =
+        MessageDigest.getInstance("SHA-256").digest(
+            "$sourceId\u0000${endpoint.url}\u0000$protocolVersion\u0000$receiverStateId".toByteArray(),
+        )
+            .take(12).joinToString("") { "%02x".format(it) }
+
+    fun recordSuccess(atMillis: Long = System.currentTimeMillis()) = updateWhileEnabled {
+        it.putLong(KEY_LAST_SUCCESS, atMillis).remove(KEY_LAST_ERROR)
+            .remove(KEY_CURRENT_STREAM)
+            .putString(KEY_RUN_STATE, RunState.COMPLETE.name)
+    }
+
+    fun recordError(message: String) = updateWhileEnabled {
+        it.putString(KEY_LAST_ERROR, message.take(MAX_STATUS_CHARS))
+            .putString(KEY_RUN_STATE, RunState.FAILED.name)
+    }
+
+    /** Starts a new logical catch-up. Continuation workers deliberately do not reset these counters. */
+    fun recordPushStarted() = updateWhileEnabled {
+        it.remove(KEY_LAST_ERROR)
+            .remove(KEY_CURRENT_STREAM)
+            .putInt(KEY_ACCEPTED_BATCHES, 0).putLong(KEY_ACCEPTED_RECORDS, 0L)
+            .putString(KEY_RUN_STATE, RunState.QUEUED.name)
+    }
+
+    fun recordRunning() = updateWhileEnabled { it.putString(KEY_RUN_STATE, RunState.RUNNING.name) }
+
+    fun recordCurrentStream(stream: String) = updateWhileEnabled {
+        require(stream in PushCapabilities.ALL.wireNames) { "unknown push stream" }
+        if (prefs.getString(KEY_CURRENT_STREAM, null) == stream) return@updateWhileEnabled it
+        it.putString(KEY_CURRENT_STREAM, stream)
+    }
+
+    fun recordCapabilities(
+        endpoint: PushEndpointPolicy.ValidEndpoint,
+        capabilities: PushCapabilities,
+        atMillis: Long = System.currentTimeMillis(),
+    ) = synchronized(statusLock) {
+        check(prefs.edit()
+            .putString(KEY_CAPABILITIES_ENDPOINT, endpoint.url)
+            .putString(KEY_CAPABILITIES_STREAMS, capabilities.wireNames.joinToString(","))
+            .putLong(KEY_CAPABILITIES_AT, atMillis)
+            .commit()) { "Could not persist receiver capabilities" }
+    }
+
+    @Synchronized
+    fun recordAcceptedBatches(batches: Int, records: Long = 0L) = synchronized(statusLock) {
+        if (batches <= 0 && records <= 0) return
+        if (!prefs.getBoolean(KEY_ENABLED, false)) return
+        check(prefs.edit()
+            .putInt(
+                KEY_ACCEPTED_BATCHES,
+                prefs.getInt(KEY_ACCEPTED_BATCHES, 0).coerceAtLeast(0) + batches.coerceAtLeast(0),
+            )
+            .putLong(
+                KEY_ACCEPTED_RECORDS,
+                prefs.getLong(KEY_ACCEPTED_RECORDS, 0L).coerceAtLeast(0L) + records.coerceAtLeast(0L),
+            )
+            .commit()) { "Could not persist push progress" }
+    }
+
+    /** Pagination and device rotation are healthy progress, never an error. */
+    fun recordContinuation() = updateWhileEnabled {
+        it.remove(KEY_LAST_ERROR).remove(KEY_CURRENT_STREAM)
+            .putString(KEY_RUN_STATE, RunState.CONTINUING.name)
+    }
+
+    fun recordRetrying(message: String) = updateWhileEnabled {
+        it.putString(KEY_LAST_ERROR, message.take(MAX_STATUS_CHARS))
+            .putString(KEY_RUN_STATE, RunState.RETRYING.name)
+    }
+
+    private inline fun updateWhileEnabled(change: (SharedPreferences.Editor) -> SharedPreferences.Editor) =
+        synchronized(statusLock) {
+            if (!prefs.getBoolean(KEY_ENABLED, false)) return@synchronized
+            check(change(prefs.edit()).commit()) { "Could not persist push status" }
+        }
+
+    private fun capabilitiesFor(endpoint: PushEndpointPolicy.ValidEndpoint?): List<String>? {
+        if (endpoint == null || prefs.getString(KEY_CAPABILITIES_ENDPOINT, null) != endpoint.url) return null
+        if (!prefs.contains(KEY_CAPABILITIES_STREAMS)) return null
+        val encoded = prefs.getString(KEY_CAPABILITIES_STREAMS, "").orEmpty()
+        if (encoded.isEmpty()) return emptyList()
+        val names = encoded.split(',')
+        val known = PushCapabilities.ALL.wireNames.toSet()
+        return names.takeIf { it.size == it.distinct().size && it.all(known::contains) }
+    }
+
+    private fun clearCapabilities() {
+        prefs.edit().remove(KEY_CAPABILITIES_ENDPOINT)
+            .remove(KEY_CAPABILITIES_STREAMS).remove(KEY_CAPABILITIES_AT).apply()
+    }
+
+    fun nextDeviceIndex(namespace: String): Int = prefs.getInt("$KEY_NEXT_DEVICE.$namespace", 0).coerceAtLeast(0)
+
+    fun saveNextDeviceIndex(namespace: String, index: Int) {
+        require(index >= 0)
+        prefs.edit().putInt("$KEY_NEXT_DEVICE.$namespace", index).apply()
+    }
+
+    fun cycleNeedsAnotherPass(namespace: String): Boolean =
+        prefs.getBoolean("$KEY_CYCLE_MORE.$namespace", false)
+
+    fun saveCycleNeedsAnotherPass(namespace: String, needed: Boolean) {
+        prefs.edit().putBoolean("$KEY_CYCLE_MORE.$namespace", needed).apply()
+    }
+
+    fun cycleHadRejection(namespace: String): Boolean = prefs.getBoolean("$KEY_CYCLE_REJECTED.$namespace", false)
+
+    fun saveCycleHadRejection(namespace: String, rejected: Boolean) {
+        prefs.edit().putBoolean("$KEY_CYCLE_REJECTED.$namespace", rejected).apply()
+    }
+
+    /** Persists only a safe category/status, never an exception message or response body. */
+    fun cycleFailure(namespace: String): PushFailure? {
+        val code = prefs.getString("$KEY_CYCLE_FAILURE_CODE.$namespace", null)
+            ?.let { stored -> PushFailureCode.entries.firstOrNull { it.name == stored } }
+            ?: return null
+        val status = prefs.getInt("$KEY_CYCLE_FAILURE_STATUS.$namespace", 0)
+            .takeIf { it in 100..599 }
+        val receiverCode = prefs.getString("$KEY_CYCLE_FAILURE_RECEIVER_CODE.$namespace", null)
+            ?.takeIf { it.matches(Regex("[a-z][a-z0-9_]{0,63}")) }
+        return PushFailure(code, status, receiverCode)
+    }
+
+    fun saveCycleFailure(namespace: String, failure: PushFailure?) {
+        val editor = prefs.edit()
+        if (failure == null) {
+            editor.remove("$KEY_CYCLE_FAILURE_CODE.$namespace")
+                .remove("$KEY_CYCLE_FAILURE_STATUS.$namespace")
+                .remove("$KEY_CYCLE_FAILURE_RECEIVER_CODE.$namespace")
+        } else {
+            editor.putString("$KEY_CYCLE_FAILURE_CODE.$namespace", failure.code.name)
+            failure.httpStatus?.let {
+                editor.putInt("$KEY_CYCLE_FAILURE_STATUS.$namespace", it)
+            } ?: editor.remove("$KEY_CYCLE_FAILURE_STATUS.$namespace")
+            failure.receiverCode?.let {
+                editor.putString("$KEY_CYCLE_FAILURE_RECEIVER_CODE.$namespace", it)
+            } ?: editor.remove("$KEY_CYCLE_FAILURE_RECEIVER_CODE.$namespace")
+        }
+        check(editor.commit()) { "Could not persist push failure category" }
+    }
+
+    companion object {
+        private const val PREFS = "self_hosted_push"
+        private const val SECRETS = "self_hosted_push_secrets"
+        private const val KEY_ENABLED = "enabled"
+        private const val KEY_WIFI_ONLY = "wifi_only"
+        private const val KEY_ENDPOINT = "endpoint"
+        private const val KEY_TOKEN = "bearer_token"
+        private const val KEY_SOURCE_ID = "source_id"
+        private const val KEY_LAST_SUCCESS = "last_success_at"
+        private const val KEY_LAST_ERROR = "last_error"
+        private const val KEY_RUN_STATE = "run_state"
+        private const val KEY_ACCEPTED_BATCHES = "accepted_batches"
+        private const val KEY_ACCEPTED_RECORDS = "accepted_records"
+        private const val KEY_CURRENT_STREAM = "current_stream"
+        private const val KEY_CAPABILITIES_ENDPOINT = "capabilities_endpoint"
+        private const val KEY_CAPABILITIES_STREAMS = "capabilities_streams"
+        private const val KEY_CAPABILITIES_AT = "capabilities_at"
+        private const val KEY_NEXT_DEVICE = "next_device"
+        private const val KEY_CYCLE_MORE = "cycle_more"
+        private const val KEY_CYCLE_REJECTED = "cycle_rejected"
+        private const val KEY_CYCLE_FAILURE_CODE = "cycle_failure_code"
+        private const val KEY_CYCLE_FAILURE_STATUS = "cycle_failure_status"
+        private const val KEY_CYCLE_FAILURE_RECEIVER_CODE = "cycle_failure_receiver_code"
+        private const val MAX_STATUS_CHARS = 300
+        private val statusLock = Any()
+
+        fun from(context: Context) = SelfHostedPushSettings(
+            context.applicationContext.getSharedPreferences(PREFS, Context.MODE_PRIVATE),
+            lazy(LazyThreadSafetyMode.SYNCHRONIZED) { SecurePrefs.of(context.applicationContext, SECRETS) },
+        )
+
+        internal fun forTest(prefs: SharedPreferences, secrets: SharedPreferences) =
+            SelfHostedPushSettings(prefs, lazyOf(secrets))
+    }
+}
diff --git a/android/app/src/main/java/com/noop/push/SelfHostedPushWorker.kt b/android/app/src/main/java/com/noop/push/SelfHostedPushWorker.kt
new file mode 100644
index 0000000000..9e6e03d770
--- /dev/null
+++ b/android/app/src/main/java/com/noop/push/SelfHostedPushWorker.kt
@@ -0,0 +1,313 @@
+package com.noop.push
+
+import android.content.Context
+import android.net.ConnectivityManager
+import android.net.NetworkCapabilities
+import androidx.work.CoroutineWorker
+import androidx.work.ListenableWorker
+import androidx.work.WorkerParameters
+import com.noop.R
+import com.noop.data.WhoopDatabase
+import kotlinx.coroutines.CancellationException
+
+internal fun persistedDeviceIndex(startDeviceIndex: Int, nextDeviceIndex: Int, retryableFailure: Boolean): Int =
+    if (retryableFailure) startDeviceIndex else nextDeviceIndex
+internal const val PUSH_MAX_ATTEMPTS = 32
+internal fun shouldRetryPush(runAttemptCount: Int): Boolean = runAttemptCount + 1 < PUSH_MAX_ATTEMPTS
+internal fun resultAfterScheduledContinuation(
+    current: ListenableWorker.Result,
+    scheduled: Boolean,
+): ListenableWorker.Result = if (scheduled) ListenableWorker.Result.success() else current
+internal fun successorOwnsEnqueueFailure(currentRequestCouldReserve: Boolean): Boolean =
+    !currentRequestCouldReserve
+internal fun shouldScheduleLatePendingSuccessor(willRetry: Boolean, settlementPending: Boolean): Boolean =
+    !willRetry && settlementPending
+internal fun isPushNetworkAvailable(
+    wifiOnly: Boolean,
+    isConnected: Boolean,
+    isWifi: Boolean,
+    isUnmetered: Boolean,
+): Boolean = isConnected && (!wifiOnly || (isWifi && isUnmetered))
+internal fun isPushNetworkAvailable(context: Context, wifiOnly: Boolean): Boolean {
+    val connectivity = context.getSystemService(ConnectivityManager::class.java) ?: return false
+    val network = connectivity.activeNetwork ?: return false
+    val capabilities = connectivity.getNetworkCapabilities(network) ?: return false
+    return isPushNetworkAvailable(
+        wifiOnly = wifiOnly,
+        isConnected = true,
+        isWifi = capabilities.hasTransport(NetworkCapabilities.TRANSPORT_WIFI),
+        isUnmetered = capabilities.hasCapability(NetworkCapabilities.NET_CAPABILITY_NOT_METERED),
+    )
+}
+
+/** One bounded coordinator run. Unique WorkManager work and the trigger lease keep it serial. */
+class SelfHostedPushWorker(
+    appContext: Context,
+    params: WorkerParameters,
+) : CoroutineWorker(appContext, params) {
+    private data class Decision(
+        val result: Result,
+        val willRetry: Boolean,
+        val continueNormally: Boolean = false,
+        val status: Status = Status.NONE,
+        val message: String? = null,
+    )
+
+    private data class ExecutionOutcome(
+        val state: Execution,
+        val failure: PushFailure? = null,
+    )
+
+    private enum class Execution {
+        COMPLETE,
+        CONTINUE,
+        RETRY_FAILURE,
+        CAPABILITY_TERMINAL_FAILURE,
+        TERMINAL_FAILURE,
+    }
+    private enum class Status { NONE, SUCCESS, CONTINUING, RETRYING, FAILED }
+
+    override suspend fun doWork(): Result {
+        val settings = SelfHostedPushSettings.from(applicationContext)
+        // A stale request after disable exits before lease writes, network checks, Keystore, Room, or HTTP.
+        val requestId = id.toString()
+        if (settings.enabledEndpoint() == null) {
+            PushRunSignal.releaseReservation(applicationContext, requestId)
+            return Result.success()
+        }
+        var ownerFinished = false
+        try {
+            PushRunSignal.begin(applicationContext, requestId)
+            settings.recordRunning()
+            var execution = ExecutionOutcome(Execution.COMPLETE)
+            var decision = try {
+                when (val outcome = PushWorkerGate.run(
+                    enabledEndpoint = settings::enabledEndpoint,
+                    networkAvailable = {
+                        isPushNetworkAvailable(applicationContext, wifiOnly = settings.wifiOnly())
+                    },
+                    token = settings::token,
+                    execute = { endpoint, token ->
+                        execution = executeOnce(settings, endpoint, token)
+                        execution.state == Execution.RETRY_FAILURE
+                    },
+                )) {
+                    PushWorkerGate.Outcome.DisabledOrInvalid -> Decision(Result.success(), false)
+                    PushWorkerGate.Outcome.MissingToken -> Decision(
+                        Result.failure(), false, status = Status.FAILED,
+                        message = applicationContext.getString(R.string.push_error_missing_token),
+                    )
+                    PushWorkerGate.Outcome.NetworkUnavailable -> retryOrStop(
+                        applicationContext.getString(R.string.push_error_network),
+                    )
+                    is PushWorkerGate.Outcome.Executed -> when {
+                        outcome.retry -> retryOrStop(failureMessage(execution.failure))
+                        execution.state == Execution.CONTINUE -> Decision(
+                            Result.success(), false, continueNormally = true, status = Status.CONTINUING,
+                        )
+                        execution.state == Execution.CAPABILITY_TERMINAL_FAILURE -> Decision(
+                            Result.failure(), false, status = Status.FAILED,
+                            message = failureMessage(execution.failure),
+                        )
+                        execution.state == Execution.TERMINAL_FAILURE -> Decision(
+                            Result.failure(), false, status = Status.FAILED,
+                            message = failureMessage(execution.failure),
+                        )
+                        else -> Decision(Result.success(), false, status = Status.SUCCESS)
+                    }
+                }
+            } catch (cancelled: CancellationException) {
+                throw cancelled
+            } catch (_: Throwable) {
+                // Deliberately generic: exception strings from TLS/HTTP stacks may include destination data.
+                retryOrStop(applicationContext.getString(R.string.push_error_start))
+            }
+            val settlement = PushRunSignal.settle(
+                applicationContext, requestId, willRetry = decision.willRetry,
+            ) { pending -> recordSettledStatus(settings, decision, pending) }
+            ownerFinished = true
+            // Healthy pagination/device rotation is a fresh successful work item. This deliberately
+            // avoids WorkManager retry/backoff, which is reserved for real network/HTTP failures.
+            val needsContinuation = !decision.willRetry && (decision.continueNormally || settlement.pending)
+            if (needsContinuation && !SelfHostedPushScheduler.enqueueContinuation(applicationContext)) {
+                // The append Operation itself failed asynchronously. Re-arm THIS WorkRequest so
+                // WorkManager's bounded runAttemptCount/backoff handles the infrastructure failure.
+                val enqueueRetry = retryOrStop(applicationContext.getString(R.string.push_error_queue))
+                val currentCouldReserve = PushRunSignal.reserve(applicationContext, requestId)
+                if (successorOwnsEnqueueFailure(currentCouldReserve)) {
+                    // The preserved pending trigger already owns QUEUED work. Do not let this old
+                    // failure (especially terminal attempt 31) overwrite its status or block it.
+                    return Result.success()
+                }
+                PushRunSignal.begin(applicationContext, requestId)
+                val enqueueFailureSettlement = PushRunSignal.settle(
+                    applicationContext, requestId, willRetry = enqueueRetry.willRetry,
+                ) { pending -> recordSettledStatus(settings, enqueueRetry, pending) }
+                if (shouldScheduleLatePendingSuccessor(
+                        enqueueRetry.willRetry,
+                        enqueueFailureSettlement.pending,
+                    )
+                ) {
+                    val scheduled = SelfHostedPushScheduler.enqueueContinuation(
+                        applicationContext,
+                        preserveTriggerOnFailure = true,
+                    )
+                    // A terminal attempt must succeed only when its APPEND prerequisite was actually
+                    // installed (or another owner won inside enqueueContinuation). No retry reset.
+                    return resultAfterScheduledContinuation(enqueueRetry.result, scheduled)
+                }
+                return enqueueRetry.result
+            }
+            // APPEND successors depend on this WorkSpec succeeding. A fresh pending trigger must not
+            // be left BLOCKED behind a terminal failure from the snapshot that preceded that trigger.
+            return resultAfterScheduledContinuation(decision.result, scheduled = needsContinuation)
+        } finally {
+            if (!ownerFinished) runCatching {
+                PushRunSignal.finish(applicationContext, requestId, willRetry = false)
+            }
+        }
+    }
+
+    private suspend fun executeOnce(
+        settings: SelfHostedPushSettings,
+        endpoint: PushEndpointPolicy.ValidEndpoint,
+        token: String,
+    ): ExecutionOutcome {
+        val sourceId = settings.sourceId()
+        // Derive progress from the exact endpoint captured by the stale-work gate. Re-reading prefs
+        // here could otherwise pair an E1 HTTP request with E2 cursor state during a concurrent edit.
+        val transport = PushHttpTransport(endpoint, token) { batch ->
+            settings.recordCurrentStream(batch.table.wireName)
+        }
+        val capabilities = when (val result = transport.capabilities()) {
+            is PushCapabilitiesResult.Available -> result.capabilities
+            is PushCapabilitiesResult.Rejected -> {
+                return if (result.retryable) {
+                    ExecutionOutcome(
+                        Execution.RETRY_FAILURE,
+                        result.failure ?: PushFailure(PushFailureCode.NETWORK_IO),
+                    )
+                } else {
+                    ExecutionOutcome(
+                        Execution.CAPABILITY_TERMINAL_FAILURE,
+                        result.failure ?: PushFailure(PushFailureCode.CAPABILITIES_INVALID),
+                    )
+                }
+            }
+        }
+        runCatching { settings.recordCapabilities(endpoint, capabilities) }
+        val namespace = settings.progressNamespace(
+            sourceId,
+            endpoint,
+            capabilities.protocolVersion,
+            capabilities.receiverStateId,
+        )
+        // Capability discovery deliberately precedes Room: unsupported streams cause no table scan,
+        // snapshot allocation, encoding, or POST. An empty allowlist is a valid caught-up receiver.
+        if (capabilities.isEmpty) {
+            settings.saveNextDeviceIndex(namespace, 0)
+            settings.saveCycleNeedsAnotherPass(namespace, false)
+            settings.saveCycleHadRejection(namespace, false)
+            settings.saveCycleFailure(namespace, null)
+            return ExecutionOutcome(Execution.COMPLETE)
+        }
+        // Room is first opened here, after the stale-work, endpoint, network-policy, token and identity gates.
+        val dao = WhoopDatabase.get(applicationContext).pushDao()
+        val progress = EndpointScopedProgressStore(
+            SharedPrefsPushProgressStore.from(applicationContext),
+            namespace,
+        )
+        val startDeviceIndex = settings.nextDeviceIndex(namespace)
+        val run = PushCoordinator(
+            source = dao,
+            transport = transport,
+            progress = progress,
+            sourceId = sourceId,
+            destinationStillCurrent = { settings.enabledEndpoint() == endpoint },
+        ).pushKnownDevices(startDeviceIndex, MAX_DEVICES_PER_RUN, capabilities)
+        settings.recordAcceptedBatches(
+            run.acceptedBatches,
+            records = run.acceptedRecords.toLong(),
+        )
+        if (run.hasRetryableFailure) {
+            // Do not rotate away from a failing device: this WorkRequest retries the exact same
+            // device with its bounded runAttemptCount. Already-acked tables remain idempotent.
+            return ExecutionOutcome(
+                Execution.RETRY_FAILURE,
+                run.failure ?: PushFailure(PushFailureCode.NETWORK_IO),
+            )
+        }
+        settings.saveNextDeviceIndex(
+            namespace,
+            persistedDeviceIndex(startDeviceIndex, run.nextDeviceIndex, retryableFailure = false),
+        )
+        val cycleNeedsAnotherPass = settings.cycleNeedsAnotherPass(namespace) || run.hasMoreAppendRows
+        val runHadTerminalRejection = run.rejectedBatches > 0 && !run.hasRetryableFailure
+        val cycleHadRejection = settings.cycleHadRejection(namespace) || runHadTerminalRejection
+        val cycleFailure = settings.cycleFailure(namespace) ?: run.failure.takeIf { runHadTerminalRejection }
+        val cycleCompleted = run.nextDeviceIndex == 0
+        settings.saveCycleNeedsAnotherPass(namespace, if (cycleCompleted) false else cycleNeedsAnotherPass)
+        // If append pagination starts another cycle, carry any terminal rejection through that cycle;
+        // otherwise a rejected table alongside a full append page could later be reported as success.
+        settings.saveCycleHadRejection(
+            namespace,
+            if (cycleCompleted && !cycleNeedsAnotherPass) false else cycleHadRejection,
+        )
+        settings.saveCycleFailure(
+            namespace,
+            if (cycleCompleted && !cycleNeedsAnotherPass) null else cycleFailure,
+        )
+
+        return when {
+            !cycleCompleted || cycleNeedsAnotherPass -> {
+                ExecutionOutcome(Execution.CONTINUE)
+            }
+            cycleHadRejection -> {
+                ExecutionOutcome(
+                    Execution.TERMINAL_FAILURE,
+                    cycleFailure ?: PushFailure(PushFailureCode.HTTP_PROTOCOL_REJECTED),
+                )
+            }
+            else -> {
+                ExecutionOutcome(Execution.COMPLETE)
+            }
+        }
+    }
+
+    private fun retryOrStop(message: String): Decision =
+        if (!shouldRetryPush(runAttemptCount)) {
+            Decision(
+                Result.failure(), false, status = Status.FAILED,
+                message = applicationContext.getString(R.string.push_error_paused, message),
+            )
+        } else {
+            Decision(
+                Result.retry(), true, status = Status.RETRYING,
+                message = applicationContext.getString(R.string.push_error_retrying, message),
+            )
+        }
+
+    private fun failureMessage(failure: PushFailure?): String = pushFailureMessage(
+        applicationContext,
+        failure ?: PushFailure(PushFailureCode.NETWORK_IO),
+    )
+
+    private fun recordSettledStatus(
+        settings: SelfHostedPushSettings,
+        decision: Decision,
+        pending: Boolean,
+    ) {
+        when {
+            pending && !decision.willRetry -> settings.recordContinuation()
+            decision.status == Status.SUCCESS -> settings.recordSuccess()
+            decision.status == Status.CONTINUING -> settings.recordContinuation()
+            decision.status == Status.RETRYING -> settings.recordRetrying(decision.message.orEmpty())
+            decision.status == Status.FAILED -> settings.recordError(decision.message.orEmpty())
+            else -> Unit
+        }
+    }
+
+    private companion object {
+        const val MAX_DEVICES_PER_RUN = 1
+    }
+}
diff --git a/android/app/src/main/java/com/noop/push/SharedPrefsPushProgressStore.kt b/android/app/src/main/java/com/noop/push/SharedPrefsPushProgressStore.kt
new file mode 100644
index 0000000000..8f0d0c81e9
--- /dev/null
+++ b/android/app/src/main/java/com/noop/push/SharedPrefsPushProgressStore.kt
@@ -0,0 +1,100 @@
+package com.noop.push
+
+import android.content.Context
+import android.content.SharedPreferences
+import com.noop.data.SecurePrefs
+import java.security.MessageDigest
+
+/** Encrypted durable progress plus remembered device scopes; never endpoint URLs or bearer tokens. */
+class SharedPrefsPushProgressStore private constructor(
+    private val prefs: SharedPreferences,
+) : PushProgressStore {
+    override suspend fun knownDeviceIds(): Set<String> = prefs.getStringSet(KEY_DEVICES, emptySet()).orEmpty()
+
+    override suspend fun rememberDeviceId(deviceId: String) {
+        val updated = knownDeviceIds() + deviceId
+        check(prefs.edit().putStringSet(KEY_DEVICES, updated).commit()) { "Could not persist push device scope" }
+    }
+
+    override suspend fun cursor(table: PushAppendTable, deviceId: String): PushCursor? {
+        val prefix = key("append", table.wireName, deviceId)
+        val rowId = prefs.getLong("$prefix.row", 0L)
+        val fingerprint = prefs.getString("$prefix.key", null)
+        return if (rowId > 0 && fingerprint != null) PushCursor(rowId, fingerprint) else null
+    }
+
+    override suspend fun saveCursor(table: PushAppendTable, deviceId: String, cursor: PushCursor) {
+        val prefix = key("append", table.wireName, deviceId)
+        check(prefs.edit().putLong("$prefix.row", cursor.rowId)
+            .putString("$prefix.key", cursor.naturalKeyFingerprint).commit()) {
+            "Could not persist push cursor"
+        }
+    }
+
+    override suspend fun window(table: PushMutableTable, deviceId: String): PushWindowProgress? {
+        val prefix = key("window", table.wireName, deviceId)
+        val batch = prefs.getString("$prefix.batch", null) ?: return null
+        val from = prefs.getString("$prefix.from", null) ?: return null
+        val to = prefs.getString("$prefix.to", null) ?: return null
+        return PushWindowProgress(
+            PushWindow(
+                fromDay = from,
+                toDay = to,
+                startTsInclusive = prefs.getLong("$prefix.start", 0L),
+                endTsExclusive = prefs.getLong("$prefix.end", 0L),
+            ),
+            batch,
+            parseDayHashes(prefs.getString("$prefix.dayHashes", null)),
+        )
+    }
+
+    override suspend fun saveWindow(table: PushMutableTable, deviceId: String, progress: PushWindowProgress) {
+        val prefix = key("window", table.wireName, deviceId)
+        check(prefs.edit()
+            .putString("$prefix.batch", progress.batchId)
+            .putString("$prefix.from", progress.window.fromDay)
+            .putString("$prefix.to", progress.window.toDay)
+            .putLong("$prefix.start", progress.window.startTsInclusive)
+            .putLong("$prefix.end", progress.window.endTsExclusive)
+            .putString("$prefix.dayHashes", encodeDayHashes(progress.dayHashes))
+            .commit()) { "Could not persist push window" }
+    }
+
+    private fun key(kind: String, table: String, deviceId: String): String =
+        "$kind.$table.${sha256(deviceId)}"
+
+    private fun encodeDayHashes(hashes: Map<String, String>): String {
+        check(hashes.all { (day, hash) ->
+            runCatching { java.time.LocalDate.parse(day) }.isSuccess && hash.matches(HASH_PATTERN)
+        }) { "Invalid mutable day hash progress" }
+        return hashes.toSortedMap().entries.joinToString(",") { (day, hash) -> "$day:$hash" }
+    }
+
+    private fun parseDayHashes(encoded: String?): Map<String, String> {
+        if (encoded.isNullOrEmpty()) return emptyMap()
+        return runCatching {
+            encoded.split(',').associate { item ->
+                val separator = item.indexOf(':')
+                require(separator > 0)
+                val day = item.substring(0, separator)
+                val hash = item.substring(separator + 1)
+                java.time.LocalDate.parse(day)
+                require(hash.matches(HASH_PATTERN))
+                day to hash
+            }
+        }.getOrDefault(emptyMap())
+    }
+
+    companion object {
+        private const val PREFS = "self_hosted_push_progress"
+        private const val KEY_DEVICES = "known_devices"
+        private val HASH_PATTERN = Regex("[0-9a-f]{64}")
+
+        fun from(context: Context) = SharedPrefsPushProgressStore(
+            SecurePrefs.of(context.applicationContext, PREFS),
+        )
+
+        internal fun sha256(value: String): String = MessageDigest.getInstance("SHA-256")
+            .digest(value.toByteArray()).joinToString("") { "%02x".format(it) }
+    }
+}
diff --git a/android/app/src/main/java/com/noop/ui/AppRoot.kt b/android/app/src/main/java/com/noop/ui/AppRoot.kt
index fc533ab50b..c7b4984632 100644
--- a/android/app/src/main/java/com/noop/ui/AppRoot.kt
+++ b/android/app/src/main/java/com/noop/ui/AppRoot.kt
@@ -104,6 +104,7 @@ import androidx.navigation.compose.NavHost
 import androidx.navigation.compose.composable
 import androidx.navigation.compose.currentBackStackEntryAsState
 import androidx.navigation.compose.rememberNavController
+import com.noop.push.SelfHostedPushScreen
 
 // MARK: - Navigation model
 //
@@ -171,6 +172,8 @@ private enum class Destination(
     Notifications("notifications", R.string.nav_notifications, Icons.Filled.Notifications),
     PowerSaving("power_saving", R.string.nav_power_saving, Icons.Filled.BatteryStd),
     Settings("settings", R.string.nav_settings, Icons.Filled.Settings),
+    // Experimental and intentionally absent from More: reachable only through Settings > Advanced.
+    SelfHostedPush("self_hosted_push", R.string.nav_self_hosted_push, Icons.Filled.CloudSync),
     // Nested Settings destination shared by the Settings row and a blank WHOOP 4.0 Steps tile (#1515).
     // Deliberately absent from [drawerGroups]: it is contextual, not another top-level More item.
     StepsCalibration(
@@ -452,6 +455,7 @@ fun AppRoot(viewModel: AppViewModel = viewModel()) {
                         viewModel,
                         onOpenTestCentre = { nav.navigate(Destination.TestCentre.route) },
                         onOpenBackupSync = { nav.navigate(Destination.BackupSync.route) },
+                        onOpenSelfHostedPush = { nav.navigate(Destination.SelfHostedPush.route) },
                         onOpenStepsCalibration = { nav.navigate(Destination.StepsCalibration.route) },
                     )
                 }
@@ -468,6 +472,7 @@ fun AppRoot(viewModel: AppViewModel = viewModel()) {
                         onClose = { nav.popBackStack() },
                     )
                 }
+                composable(Destination.SelfHostedPush.route) { SelfHostedPushScreen() }
                 composable(Destination.TestCentre.route) { TestCentreScreen(viewModel) }
                 // The "More" page — the iOS More tab's twin: a navigated ScreenScaffold page hosting the
                 // full grouped destination list (was a pull-up sheet). A row pushes its destination so
diff --git a/android/app/src/main/java/com/noop/ui/MainActivity.kt b/android/app/src/main/java/com/noop/ui/MainActivity.kt
index c7bb30f5ed..10f77adb07 100644
--- a/android/app/src/main/java/com/noop/ui/MainActivity.kt
+++ b/android/app/src/main/java/com/noop/ui/MainActivity.kt
@@ -29,6 +29,7 @@ import com.noop.NoopApplication
 import com.noop.ble.WhoopModel
 import com.noop.data.DemoSeeder
 import com.noop.data.WhoopRepository
+import com.noop.push.SelfHostedPushScheduler
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.channels.awaitClose
@@ -95,6 +96,12 @@ class MainActivity : ComponentActivity() {
             runCatching { BackupSync.catchUpIfDue(applicationContext) }
         }
 
+        // Experimental self-hosted push: launch only queues a catch-up when fully configured and
+        // enabled. The Activity never reads health rows, credentials, or performs network I/O.
+        lifecycleScope.launch(Dispatchers.IO) {
+            runCatching { SelfHostedPushScheduler.enqueueLaunchCatchUp(applicationContext) }
+        }
+
         // Load the Light/Dark/System + chart-colour preferences before first composition so the theme
         // and chart ramps are correct from the very first frame (no flash).
         AppearancePrefs.load(this)
diff --git a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
index b15a128844..225c67ef47 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
@@ -485,6 +485,7 @@ fun SettingsScreen(
     vm: AppViewModel,
     onOpenTestCentre: () -> Unit = {},
     onOpenBackupSync: () -> Unit = {},
+    onOpenSelfHostedPush: () -> Unit = {},
     onOpenStepsCalibration: () -> Unit = {},
 ) {
     val context = LocalContext.current
@@ -2230,6 +2231,19 @@ fun SettingsScreen(
             onToggle = { advancedOpen = !advancedOpen; SettingsDisclosurePrefs.write(NoopPrefs.of(context), advancedOpen) },
         ) {
         Column(verticalArrangement = Arrangement.spacedBy(Metrics.screenRowSpacing)) {
+        SettingsCard(
+            icon = Icons.Filled.CloudSync,
+            title = uiString(R.string.nav_self_hosted_push),
+            blurb = uiString(R.string.push_settings_row_detail),
+        ) {
+            NoopButton(
+                text = uiString(R.string.nav_self_hosted_push),
+                leadingIcon = Icons.Filled.CloudSync,
+                kind = NoopButtonKind.Secondary,
+                fullWidth = true,
+                onClick = onOpenSelfHostedPush,
+            )
+        }
         // --- Experimental · WHOOP 5 / MG --- (hidden when the user is confidently on a 4.0, #22)
         if (showFiveMGControls) {
         SettingsCard(
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index f18158e664..e5ba3cacbb 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2446,6 +2446,79 @@
     <string name="power_saving_low_refresh_desc">Synchronisiert im Hintergrund stündlich statt alle 15 Minuten, unabhängig vom Ladestand — weniger Verbindungsaufbauten sind die größte Ersparnis bei einer WHOOP 4.0. Es geht nichts verloren: Das Band speichert alles und übergibt es in größeren Paketen. Manuelles Synchronisieren läuft weiterhin sofort, die Live-Herzfrequenz bleibt unberührt.</string>
     <string name="nav_power_saving">Energiesparen</string>
     <string name="l10n_app_changelog_training_load_a_vo_max_without_f9205a67">Trainingsbelastung, VO₂max ohne Maßband und deutlich weniger Akku fürs Neuberechnen</string>
+    <string name="nav_self_hosted_push">Self-hosted Push</string>
+    <string name="push_title">Self-hosted Push</string>
+    <string name="push_subtitle">Experimentell · Android</string>
+    <string name="push_destination_title">Dein Endpunkt</string>
+    <string name="push_disclosure">Wenn aktiviert, sendet NOOP rohe Gesundheitsdaten von diesem Telefon an den von dir kontrollierten Endpunkt. Dabei verlassen Daten ausdrücklich das Gerät.</string>
+    <string name="push_one_way_warning">Nur Einweg-Export. NOOP kann Daten von diesem Endpunkt nicht wiederherstellen und stellt keinen Empfänger bereit.</string>
+    <string name="push_endpoint">Endpunkt-URL</string>
+    <string name="push_token">Bearer-Token (ausgeblendet)</string>
+    <string name="push_token_saved">Bearer-Token (gespeichert; zur Ersetzung eingeben)</string>
+    <string name="push_clear_token">Gespeichertes Token löschen</string>
+    <string name="push_token_cleared">Gespeichertes Token gelöscht. Push wurde deaktiviert.</string>
+    <string name="push_save">Ziel speichern</string>
+    <string name="push_saved">Ziel gespeichert.</string>
+    <string name="push_test_connection">Verbindung testen</string>
+    <string name="push_testing_connection">Verbindung wird getestet…</string>
+    <string name="push_test_connection_detail">Prüft Anmeldung und unterstützte Datenarten. Es werden keine Gesundheitsdaten gesendet.</string>
+    <string name="push_test_network_required">Verbinde dich mit einem Netzwerk, das die Einstellung „Nur WLAN“ erlaubt, bevor du den Server testest.</string>
+    <string name="push_capabilities_retryable_error">Der Server ist derzeit nicht erreichbar. Teste die Verbindung später erneut.</string>
+    <string name="push_capabilities_invalid_error">Der Server hat ungültige oder nicht unterstützte Capabilities geliefert.</string>
+    <string name="push_error_dns">DNS-Auflösung fehlgeschlagen. Prüfe Hostnamen und DNS-Konfiguration des Endpoints.</string>
+    <string name="push_error_tls_certificate">TLS-Zertifikatsprüfung fehlgeschlagen. Prüfe Hostname, Zertifikatskette und Ablaufdatum.</string>
+    <string name="push_error_tls_handshake">TLS-Handshake fehlgeschlagen. Prüfe Reverse Proxy, TLS-Versionen und Cipher-Konfiguration.</string>
+    <string name="push_error_network_timeout">Netzwerk-Timeout vor Abschluss der Anfrage. Prüfe Erreichbarkeit und Proxy-Timeouts.</string>
+    <string name="push_error_connection_refused">Verbindung abgelehnt. Prüfe, ob Receiver und Proxy beziehungsweise Backend-Port laufen und lauschen.</string>
+    <string name="push_error_network_unreachable">Keine Netzwerkroute verfügbar. Prüfe WLAN, Routing und Firewall-Regeln.</string>
+    <string name="push_error_connection_reset">Verbindung wurde zurückgesetzt. Prüfe Neustarts und Verbindungs-Timeouts von Receiver oder Proxy.</string>
+    <string name="push_error_network_io">Netzwerk-E/A fehlgeschlagen, bevor eine dauerhafte Bestätigung empfangen wurde.</string>
+    <string name="push_error_http_auth">HTTP %1$d: Anmeldung abgelehnt. Prüfe Bearer-Token und Weiterleitung des Authorization-Headers im Proxy.</string>
+    <string name="push_error_http_not_found">HTTP %1$d: Endpoint-Pfad nicht gefunden. Prüfe vollständige URL und Reverse-Proxy-Route.</string>
+    <string name="push_error_http_timeout">HTTP %1$d: Receiver oder Proxy hat bei der Verarbeitung das Zeitlimit überschritten.</string>
+    <string name="push_error_http_too_large">HTTP %1$d: Anfrage zu groß. Gleiche Body-Limits von Receiver und Reverse Proxy mit Protokoll 1.0 ab.</string>
+    <string name="push_error_http_media_type">HTTP %1$d: Der Receiver hat sowohl gzip- als auch unkomprimierte NDJSON-Uploads abgelehnt.</string>
+    <string name="push_error_http_protocol">HTTP %1$d: Der Receiver hat den Protokoll-Batch abgelehnt. Prüfe v1-Schema, Stream-Allowlist und Serverlogs.</string>
+    <string name="push_error_http_rate_limit">HTTP %1$d: Rate-Limit des Receivers erreicht. Automatische Wiederholung nutzt Backoff.</string>
+    <string name="push_error_http_server">HTTP %1$d: Fehler im Receiver oder Reverse Proxy. Prüfe Serverlogs und Health-Status.</string>
+    <string name="push_error_http_client">HTTP %1$d: Unerwarteter Clientfehler. Prüfe Endpoint- und Reverse-Proxy-Konfiguration.</string>
+    <string name="push_error_capabilities_invalid">Die Capability-Antwort ist fehlerhaft oder entspricht nicht Protokoll 1.0.</string>
+    <string name="push_error_ack_invalid">Die Bestätigung des Receivers ist fehlerhaft oder passt nicht zum gesendeten Batch. Der Cursor wurde nicht vorgerückt.</string>
+    <string name="push_error_local_data">Ein lokaler Datensatz überschreitet Protokollgrenzen oder lässt sich nicht exakt kodieren. Kein Cursor wurde vorgerückt.</string>
+    <string name="push_error_local_database">Lokale Datenbank oder Push-Fortschritt konnten nicht gelesen oder gespeichert werden.</string>
+    <string name="push_error_network">Warte auf ein Netzwerk, das die Einstellung „Nur WLAN“ erlaubt.</string>
+    <string name="push_error_retrying">%1$s Eine automatische Wiederholung ist eingeplant.</string>
+    <string name="push_error_paused">%1$s Automatische Wiederholungen sind pausiert. Behebe die Ursache und nutze dann „Jetzt exportieren“ oder synchronisiere den Strap erneut.</string>
+    <string name="push_error_missing_token">Der gespeicherte Bearer-Token ist nicht verfügbar. Speichere ihn erneut.</string>
+    <string name="push_error_start">Der Export-Worker konnte nicht sicher gestartet werden.</string>
+    <string name="push_error_queue">Der nächste begrenzte Exportschritt konnte nicht eingereiht werden.</string>
+    <string name="push_capabilities_summary">Server unterstützt %1$d von %2$d Datenarten</string>
+    <string name="push_capabilities_checked">Zuletzt geprüft: %1$s</string>
+    <string name="push_capabilities_none">Dieser Server akzeptiert derzeit keine Gesundheitsdaten aus Protokoll 1.0.</string>
+    <string name="push_capabilities_streams">Akzeptierte Daten: %1$s</string>
+    <string name="push_enabled">Automatischen Export aktivieren</string>
+    <string name="push_enabled_detail">Exportiert neue und geänderte Daten nach vollständiger Strap-Synchronisierung und holt Rückstände beim App-Start nach.</string>
+    <string name="push_wifi_only">Nur WLAN</string>
+    <string name="push_wifi_only_detail">Verwendet für Verbindungstests und Exporte nur ungetaktetes WLAN. Ausschalten, um Mobilfunk und andere verbundene Netzwerke zu erlauben.</string>
+    <string name="push_export_now">Jetzt exportieren</string>
+    <string name="push_export_now_detail">Startet jetzt einen Abgleich. Der automatische Export muss aktiviert sein.</string>
+    <string name="push_config_required">Speichere vor dem Aktivieren einen gültigen Endpunkt und ein Token.</string>
+    <string name="push_status_title">Status</string>
+    <string name="push_status_detail">Zugangsdaten erscheinen nie im Status oder in Worker-Metadaten.</string>
+    <string name="push_never">Nie</string>
+    <string name="push_last_success">Letzter vollständiger Abgleich: %1$s</string>
+    <string name="push_last_error">Letzter Fehler: %1$s</string>
+    <string name="push_current_state">Aktueller Status: %1$s</string>
+    <string name="push_progress">Aktueller Export: %1$d Batches · %2$d Datensätze akzeptiert</string>
+    <string name="push_current_stream">Aktuelle Datenart: %1$s</string>
+    <string name="push_state_idle">Inaktiv</string>
+    <string name="push_state_queued">Eingeplant</string>
+    <string name="push_state_running">Wird gesendet</string>
+    <string name="push_state_continuing">Weitere lokale Daten gefunden; wird fortgesetzt</string>
+    <string name="push_state_retrying">Wiederholung nach einem Fehler</string>
+    <string name="push_state_complete">Aktuell</string>
+    <string name="push_state_failed">Nach einem Fehler pausiert</string>
+    <string name="push_settings_row_detail">Experimenteller Einweg-Export an einen von dir kontrollierten Endpunkt. Standardmäßig aus.</string>
     <string name="l10n_sleep_screen_sleep_outside_the_new_times_was_6229881e">Schlaf außerhalb der neuen Zeiten wurde entfernt. NOOP erkennt ihn nicht erneut.</string>
     <string name="workout_action_pause">Pause</string>
     <string name="workout_action_resume">Fortsetzen</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index e0041e4150..fec6a1d073 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2432,6 +2432,79 @@
     <string name="power_saving_low_refresh_desc">Sincroniza en segundo plano cada hora en vez de cada 15 minutos, sea cual sea la carga de la banda: menos reconexiones es el mayor ahorro en una WHOOP 4.0. No se pierde nada: la banda lo guarda todo y lo entrega en lotes más grandes. Sincronizar manualmente sigue siendo inmediato y la frecuencia cardíaca en vivo no cambia.</string>
     <string name="nav_power_saving">Ahorro de energía</string>
     <string name="l10n_app_changelog_training_load_a_vo_max_without_f9205a67">Carga de entrenamiento, VO₂max sin cinta métrica y mucha menos batería recalculando</string>
+    <string name="nav_self_hosted_push">Envío autoalojado</string>
+    <string name="push_title">Envío autoalojado</string>
+    <string name="push_subtitle">En fase experimental · Android</string>
+    <string name="push_destination_title">Tu endpoint</string>
+    <string name="push_disclosure">Al activarlo, NOOP envía datos de salud sin procesar desde este teléfono al endpoint que controlas. Los datos salen expresamente del dispositivo.</string>
+    <string name="push_one_way_warning">Solo exportación unidireccional. NOOP no puede restaurar datos desde este endpoint ni proporciona un receptor.</string>
+    <string name="push_endpoint">URL del endpoint</string>
+    <string name="push_token">Token Bearer (oculto)</string>
+    <string name="push_token_saved">Token Bearer (guardado; escribe para sustituirlo)</string>
+    <string name="push_clear_token">Borrar token guardado</string>
+    <string name="push_token_cleared">Token guardado borrado. El envío se desactivó.</string>
+    <string name="push_save">Guardar destino</string>
+    <string name="push_saved">Destino guardado.</string>
+    <string name="push_test_connection">Probar conexión</string>
+    <string name="push_testing_connection">Probando conexión…</string>
+    <string name="push_test_connection_detail">Comprueba la autenticación y los tipos de datos admitidos. No envía datos de salud.</string>
+    <string name="push_test_network_required">Conéctate a una red permitida por el ajuste Solo Wi-Fi antes de probar el receptor.</string>
+    <string name="push_capabilities_retryable_error">No se pudo contactar con el receptor. Prueba de nuevo más tarde.</string>
+    <string name="push_capabilities_invalid_error">El receptor devolvió capacidades no válidas o no compatibles.</string>
+    <string name="push_error_dns">Falló la resolución DNS. Comprueba el nombre del host y la configuración DNS del endpoint.</string>
+    <string name="push_error_tls_certificate">Falló la validación del certificado TLS. Comprueba el host, la cadena y la caducidad.</string>
+    <string name="push_error_tls_handshake">Falló la negociación TLS. Comprueba el proxy inverso, las versiones TLS y los cifrados.</string>
+    <string name="push_error_network_timeout">Tiempo de espera de red agotado antes de completar la solicitud. Comprueba la conectividad y los tiempos del proxy.</string>
+    <string name="push_error_connection_refused">Conexión rechazada. Confirma que el receptor está activo y que el puerto del proxy o backend escucha.</string>
+    <string name="push_error_network_unreachable">La ruta de red no está disponible. Comprueba Wi-Fi, enrutamiento y cortafuegos.</string>
+    <string name="push_error_connection_reset">La conexión se restableció. Comprueba reinicios y tiempos de conexión del receptor o proxy.</string>
+    <string name="push_error_network_io">Falló la E/S de red antes de recibir una confirmación duradera.</string>
+    <string name="push_error_http_auth">HTTP %1$d: autenticación rechazada. Comprueba el token y el reenvío del encabezado Authorization.</string>
+    <string name="push_error_http_not_found">HTTP %1$d: no se encontró la ruta del endpoint. Comprueba la URL completa y la ruta del proxy.</string>
+    <string name="push_error_http_timeout">HTTP %1$d: el receptor o proxy agotó el tiempo al procesar la solicitud.</string>
+    <string name="push_error_http_too_large">HTTP %1$d: solicitud demasiado grande. Ajusta los límites del receptor y proxy al protocolo 1.0.</string>
+    <string name="push_error_http_media_type">HTTP %1$d: el receptor rechazó tanto gzip como NDJSON sin compresión.</string>
+    <string name="push_error_http_protocol">HTTP %1$d: el receptor rechazó el lote. Comprueba el esquema v1, los streams admitidos y los registros.</string>
+    <string name="push_error_http_rate_limit">HTTP %1$d: límite de solicitudes alcanzado. El reintento automático usa espera progresiva.</string>
+    <string name="push_error_http_server">HTTP %1$d: error del receptor o proxy. Comprueba sus registros y estado.</string>
+    <string name="push_error_http_client">HTTP %1$d: error de cliente inesperado. Comprueba endpoint y proxy inverso.</string>
+    <string name="push_error_capabilities_invalid">La respuesta de capacidades está dañada o no corresponde al protocolo 1.0.</string>
+    <string name="push_error_ack_invalid">La confirmación está dañada o no coincide con el lote. El cursor no avanzó.</string>
+    <string name="push_error_local_data">Un registro local supera los límites o no puede codificarse exactamente. El cursor no avanzó.</string>
+    <string name="push_error_local_database">No se pudo leer o guardar la base de datos local o el progreso.</string>
+    <string name="push_error_network">Esperando una red permitida por el ajuste Solo Wi-Fi.</string>
+    <string name="push_error_retrying">%1$s Se ha programado un reintento automático.</string>
+    <string name="push_error_paused">%1$s Los reintentos están pausados; corrige la causa y usa Exportar ahora o sincroniza de nuevo la pulsera.</string>
+    <string name="push_error_missing_token">El token guardado no está disponible. Guárdalo de nuevo.</string>
+    <string name="push_error_start">El worker de exportación no pudo iniciarse de forma segura.</string>
+    <string name="push_error_queue">No se pudo poner en cola el siguiente paso de exportación.</string>
+    <string name="push_capabilities_summary">El receptor admite %1$d de %2$d tipos de datos</string>
+    <string name="push_capabilities_checked">Última comprobación: %1$s</string>
+    <string name="push_capabilities_none">Este receptor no acepta actualmente datos de salud del protocolo 1.0.</string>
+    <string name="push_capabilities_streams">Datos aceptados: %1$s</string>
+    <string name="push_enabled">Activar exportación automática</string>
+    <string name="push_enabled_detail">Exporta datos nuevos y modificados tras una sincronización completa de la pulsera y recupera pendientes al iniciar la app.</string>
+    <string name="push_wifi_only">Solo Wi-Fi</string>
+    <string name="push_wifi_only_detail">Usa Wi-Fi sin medición para las pruebas de conexión y las exportaciones. Desactívalo para permitir redes móviles y otras redes conectadas.</string>
+    <string name="push_export_now">Exportar ahora</string>
+    <string name="push_export_now_detail">Inicia ahora una puesta al día. La exportación automática debe estar activada.</string>
+    <string name="push_config_required">Guarda un endpoint válido y un token antes de activar.</string>
+    <string name="push_status_title">Estado</string>
+    <string name="push_status_detail">Las credenciales nunca aparecen en el estado ni en los metadatos del Worker.</string>
+    <string name="push_never">Nunca</string>
+    <string name="push_last_success">Última puesta al día completa: %1$s</string>
+    <string name="push_last_error">Último error: %1$s</string>
+    <string name="push_current_state">Estado actual: %1$s</string>
+    <string name="push_progress">Exportación actual: %1$d lotes · %2$d registros aceptados</string>
+    <string name="push_current_stream">Tipo de datos actual: %1$s</string>
+    <string name="push_state_idle">Inactivo</string>
+    <string name="push_state_queued">En cola</string>
+    <string name="push_state_running">Enviando</string>
+    <string name="push_state_continuing">Hay más datos locales; continuando</string>
+    <string name="push_state_retrying">Reintentando tras un error</string>
+    <string name="push_state_complete">Actualizado</string>
+    <string name="push_state_failed">En pausa tras un error</string>
+    <string name="push_settings_row_detail">Exportación unidireccional experimental a un endpoint que controlas. Desactivada de forma predeterminada.</string>
     <string name="l10n_sleep_screen_sleep_outside_the_new_times_was_6229881e">Se ha eliminado el sueño fuera del nuevo horario. NOOP no volverá a detectarlo.</string>
     <string name="workout_action_pause">Pausar</string>
     <string name="workout_action_resume">Reanudar</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 464451c602..04d6dd27ca 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2431,6 +2431,79 @@
     <string name="power_saving_low_refresh_desc">Synchronise en arrière-plan toutes les heures au lieu de toutes les 15 minutes, quelle que soit la charge du bracelet : moins de reconnexions, c\'est la plus grosse économie sur une WHOOP 4.0. Rien n\'est perdu : le bracelet enregistre tout et le transmet par lots plus importants. La synchro manuelle reste immédiate et la fréquence cardiaque en direct n\'est pas affectée.</string>
     <string name="nav_power_saving">Économie d’énergie</string>
     <string name="l10n_app_changelog_training_load_a_vo_max_without_f9205a67">Charge d\'entraînement, VO₂max sans mètre ruban, et bien moins de batterie à recalculer</string>
+    <string name="nav_self_hosted_push">Envoi auto-hébergé</string>
+    <string name="push_title">Envoi auto-hébergé</string>
+    <string name="push_subtitle">Expérimental · Android</string>
+    <string name="push_destination_title">Votre point de terminaison</string>
+    <string name="push_disclosure">Une fois activé, NOOP envoie les données de santé brutes de ce téléphone au point de terminaison que vous contrôlez. Ces données quittent explicitement l’appareil.</string>
+    <string name="push_one_way_warning">Export à sens unique uniquement. NOOP ne peut pas restaurer les données depuis ce point et ne fournit pas de récepteur.</string>
+    <string name="push_endpoint">URL du point de terminaison</string>
+    <string name="push_token">Jeton Bearer (masqué)</string>
+    <string name="push_token_saved">Jeton Bearer (enregistré ; saisir pour remplacer)</string>
+    <string name="push_clear_token">Effacer le jeton enregistré</string>
+    <string name="push_token_cleared">Jeton enregistré effacé. L’envoi a été désactivé.</string>
+    <string name="push_save">Enregistrer la destination</string>
+    <string name="push_saved">Destination enregistrée.</string>
+    <string name="push_test_connection">Tester la connexion</string>
+    <string name="push_testing_connection">Test de la connexion…</string>
+    <string name="push_test_connection_detail">Vérifie l’authentification et les types de données pris en charge. Aucune donnée de santé n’est envoyée.</string>
+    <string name="push_test_network_required">Connectez-vous à un réseau autorisé par le réglage Wi-Fi uniquement avant de tester le récepteur.</string>
+    <string name="push_capabilities_retryable_error">Le récepteur est inaccessible. Réessayez plus tard.</string>
+    <string name="push_capabilities_invalid_error">Le récepteur a renvoyé des capacités invalides ou non prises en charge.</string>
+    <string name="push_error_dns">Échec de la résolution DNS. Vérifiez le nom d’hôte et la configuration DNS du endpoint.</string>
+    <string name="push_error_tls_certificate">Échec de validation du certificat TLS. Vérifiez l’hôte, la chaîne et l’expiration.</string>
+    <string name="push_error_tls_handshake">Échec de la négociation TLS. Vérifiez le proxy inverse, les versions TLS et les suites de chiffrement.</string>
+    <string name="push_error_network_timeout">Délai réseau dépassé avant la fin de la requête. Vérifiez l’accessibilité et les délais du proxy.</string>
+    <string name="push_error_connection_refused">Connexion refusée. Vérifiez que le récepteur fonctionne et que le port du proxy ou backend écoute.</string>
+    <string name="push_error_network_unreachable">Route réseau indisponible. Vérifiez le Wi-Fi, le routage et le pare-feu.</string>
+    <string name="push_error_connection_reset">Connexion réinitialisée. Vérifiez les redémarrages et délais du récepteur ou proxy.</string>
+    <string name="push_error_network_io">Échec des E/S réseau avant réception d’un accusé durable.</string>
+    <string name="push_error_http_auth">HTTP %1$d : authentification refusée. Vérifiez le jeton et le transfert de l’en-tête Authorization.</string>
+    <string name="push_error_http_not_found">HTTP %1$d : chemin du endpoint introuvable. Vérifiez l’URL complète et la route du proxy.</string>
+    <string name="push_error_http_timeout">HTTP %1$d : délai dépassé par le récepteur ou proxy pendant le traitement.</string>
+    <string name="push_error_http_too_large">HTTP %1$d : requête trop volumineuse. Alignez les limites du récepteur et proxy sur le protocole 1.0.</string>
+    <string name="push_error_http_media_type">HTTP %1$d : le récepteur a refusé les envois NDJSON gzip et non compressés.</string>
+    <string name="push_error_http_protocol">HTTP %1$d : lot refusé. Vérifiez le schéma v1, les flux autorisés et les journaux.</string>
+    <string name="push_error_http_rate_limit">HTTP %1$d : limite de requêtes atteinte. La nouvelle tentative utilise un délai progressif.</string>
+    <string name="push_error_http_server">HTTP %1$d : erreur du récepteur ou proxy. Vérifiez les journaux et l’état.</string>
+    <string name="push_error_http_client">HTTP %1$d : erreur client inattendue. Vérifiez le endpoint et le proxy inverse.</string>
+    <string name="push_error_capabilities_invalid">La réponse de capacités est incorrecte ou ne correspond pas au protocole 1.0.</string>
+    <string name="push_error_ack_invalid">L’accusé est incorrect ou ne correspond pas au lot. Le curseur n’a pas avancé.</string>
+    <string name="push_error_local_data">Un enregistrement local dépasse les limites ou ne peut être encodé exactement. Le curseur n’a pas avancé.</string>
+    <string name="push_error_local_database">Impossible de lire ou enregistrer la base locale ou la progression.</string>
+    <string name="push_error_network">En attente d’un réseau autorisé par le réglage Wi-Fi uniquement.</string>
+    <string name="push_error_retrying">%1$s Une nouvelle tentative automatique est planifiée.</string>
+    <string name="push_error_paused">%1$s Les tentatives sont suspendues ; corrigez la cause puis utilisez Exporter maintenant ou resynchronisez le bracelet.</string>
+    <string name="push_error_missing_token">Le jeton enregistré est indisponible. Enregistrez-le à nouveau.</string>
+    <string name="push_error_start">Le worker d’export n’a pas pu démarrer en toute sécurité.</string>
+    <string name="push_error_queue">Impossible de mettre en file l’étape d’export suivante.</string>
+    <string name="push_capabilities_summary">Le récepteur prend en charge %1$d types sur %2$d</string>
+    <string name="push_capabilities_checked">Dernière vérification : %1$s</string>
+    <string name="push_capabilities_none">Ce récepteur n’accepte actuellement aucune donnée de santé du protocole 1.0.</string>
+    <string name="push_capabilities_streams">Données acceptées : %1$s</string>
+    <string name="push_enabled">Activer l’export automatique</string>
+    <string name="push_enabled_detail">Exporte les données nouvelles et modifiées après une synchronisation complète du bracelet et rattrape le retard au lancement.</string>
+    <string name="push_wifi_only">Wi-Fi uniquement</string>
+    <string name="push_wifi_only_detail">Utilise un Wi-Fi non facturé pour les tests de connexion et les exports. Désactivez pour autoriser les réseaux mobiles et autres réseaux connectés.</string>
+    <string name="push_export_now">Exporter maintenant</string>
+    <string name="push_export_now_detail">Lance un rattrapage maintenant. L’export automatique doit être activé.</string>
+    <string name="push_config_required">Enregistrez un point valide et un jeton avant l’activation.</string>
+    <string name="push_status_title">État</string>
+    <string name="push_status_detail">Les identifiants ne figurent jamais dans l’état ni les métadonnées du Worker.</string>
+    <string name="push_never">Jamais</string>
+    <string name="push_last_success">Dernier rattrapage complet : %1$s</string>
+    <string name="push_last_error">Dernière erreur : %1$s</string>
+    <string name="push_current_state">État actuel : %1$s</string>
+    <string name="push_progress">Export actuel : %1$d lots · %2$d enregistrements acceptés</string>
+    <string name="push_current_stream">Type de données actuel : %1$s</string>
+    <string name="push_state_idle">Inactif</string>
+    <string name="push_state_queued">En attente</string>
+    <string name="push_state_running">Envoi en cours</string>
+    <string name="push_state_continuing">Autres données locales trouvées ; poursuite en cours</string>
+    <string name="push_state_retrying">Nouvelle tentative après une erreur</string>
+    <string name="push_state_complete">À jour</string>
+    <string name="push_state_failed">En pause après une erreur</string>
+    <string name="push_settings_row_detail">Export expérimental à sens unique vers un point que vous contrôlez. Désactivé par défaut.</string>
     <string name="l10n_sleep_screen_sleep_outside_the_new_times_was_6229881e">Le sommeil en dehors des nouveaux horaires a été supprimé. NOOP ne le détectera plus.</string>
     <string name="workout_action_pause">Pause</string>
     <string name="workout_action_resume">Reprendre</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 4dfeae05eb..ce3a22d7f5 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2437,6 +2437,79 @@
     <string name="power_saving_low_refresh_desc">Synchronizuje w tle co godzinę zamiast co 15 minut, niezależnie od poziomu naładowania opaski — mniej ponownych połączeń to największa oszczędność w WHOOP 4.0. Nic nie ginie: opaska zapisuje wszystko i przekazuje w większych paczkach. Ręczna synchronizacja nadal działa od razu, a tętno na żywo pozostaje bez zmian.</string>
     <string name="nav_power_saving">Oszczędzanie energii</string>
     <string name="l10n_app_changelog_training_load_a_vo_max_without_f9205a67">Obciążenie treningowe, VO₂max bez centymetra i znacznie mniej baterii na przeliczanie</string>
+    <string name="nav_self_hosted_push">Wysyłanie na własny serwer</string>
+    <string name="push_title">Wysyłanie na własny serwer</string>
+    <string name="push_subtitle">Eksperymentalne · Android</string>
+    <string name="push_destination_title">Twój endpoint</string>
+    <string name="push_disclosure">Po włączeniu NOOP wysyła surowe dane zdrowotne z tego telefonu do kontrolowanego przez Ciebie endpointu. Dane jawnie opuszczają urządzenie.</string>
+    <string name="push_one_way_warning">Tylko eksport jednokierunkowy. NOOP nie może odtworzyć danych z tego endpointu i nie udostępnia odbiornika.</string>
+    <string name="push_endpoint">URL endpointu</string>
+    <string name="push_token">Token Bearer (ukryty)</string>
+    <string name="push_token_saved">Token Bearer (zapisany; wpisz, aby zastąpić)</string>
+    <string name="push_clear_token">Usuń zapisany token</string>
+    <string name="push_token_cleared">Zapisany token usunięto. Wysyłanie zostało wyłączone.</string>
+    <string name="push_save">Zapisz miejsce docelowe</string>
+    <string name="push_saved">Miejsce docelowe zapisano.</string>
+    <string name="push_test_connection">Sprawdź połączenie</string>
+    <string name="push_testing_connection">Sprawdzanie połączenia…</string>
+    <string name="push_test_connection_detail">Sprawdza uwierzytelnianie i obsługiwane typy danych. Nie wysyła danych zdrowotnych.</string>
+    <string name="push_test_network_required">Przed sprawdzeniem odbiornika połącz się z siecią dozwoloną przez ustawienie Tylko Wi-Fi.</string>
+    <string name="push_capabilities_retryable_error">Nie można połączyć się z odbiornikiem. Spróbuj ponownie później.</string>
+    <string name="push_capabilities_invalid_error">Odbiornik zwrócił nieprawidłowe lub nieobsługiwane możliwości.</string>
+    <string name="push_error_dns">Nie udało się rozwiązać DNS. Sprawdź nazwę hosta i konfigurację DNS endpointu.</string>
+    <string name="push_error_tls_certificate">Weryfikacja certyfikatu TLS nie powiodła się. Sprawdź host, łańcuch i datę ważności.</string>
+    <string name="push_error_tls_handshake">Uzgadnianie TLS nie powiodło się. Sprawdź reverse proxy, wersje TLS i szyfry.</string>
+    <string name="push_error_network_timeout">Przekroczono czas sieci przed zakończeniem żądania. Sprawdź dostępność i limity czasu proxy.</string>
+    <string name="push_error_connection_refused">Połączenie odrzucone. Sprawdź, czy odbiornik działa i port proxy lub backendu nasłuchuje.</string>
+    <string name="push_error_network_unreachable">Trasa sieciowa jest niedostępna. Sprawdź Wi-Fi, routing i zaporę.</string>
+    <string name="push_error_connection_reset">Połączenie zostało zresetowane. Sprawdź restarty i limity czasu odbiornika lub proxy.</string>
+    <string name="push_error_network_io">Błąd operacji sieciowej przed otrzymaniem trwałego potwierdzenia.</string>
+    <string name="push_error_http_auth">HTTP %1$d: odrzucono uwierzytelnienie. Sprawdź token i przekazywanie nagłówka Authorization.</string>
+    <string name="push_error_http_not_found">HTTP %1$d: nie znaleziono ścieżki endpointu. Sprawdź pełny URL i trasę proxy.</string>
+    <string name="push_error_http_timeout">HTTP %1$d: odbiornik lub proxy przekroczył czas przetwarzania.</string>
+    <string name="push_error_http_too_large">HTTP %1$d: żądanie za duże. Dopasuj limity odbiornika i proxy do protokołu 1.0.</string>
+    <string name="push_error_http_media_type">HTTP %1$d: odbiornik odrzucił NDJSON gzip i bez kompresji.</string>
+    <string name="push_error_http_protocol">HTTP %1$d: odbiornik odrzucił partię. Sprawdź schemat v1, listę strumieni i logi.</string>
+    <string name="push_error_http_rate_limit">HTTP %1$d: osiągnięto limit żądań. Automatyczna próba użyje opóźnienia.</string>
+    <string name="push_error_http_server">HTTP %1$d: błąd odbiornika lub proxy. Sprawdź logi i stan usługi.</string>
+    <string name="push_error_http_client">HTTP %1$d: nieoczekiwany błąd klienta. Sprawdź endpoint i reverse proxy.</string>
+    <string name="push_error_capabilities_invalid">Odpowiedź możliwości jest uszkodzona lub niezgodna z protokołem 1.0.</string>
+    <string name="push_error_ack_invalid">Potwierdzenie jest uszkodzone lub nie pasuje do partii. Kursor nie został przesunięty.</string>
+    <string name="push_error_local_data">Lokalny rekord przekracza limity lub nie może zostać dokładnie zakodowany. Kursor nie został przesunięty.</string>
+    <string name="push_error_local_database">Nie można odczytać lub zapisać lokalnej bazy albo postępu.</string>
+    <string name="push_error_network">Oczekiwanie na sieć dozwoloną przez ustawienie Tylko Wi-Fi.</string>
+    <string name="push_error_retrying">%1$s Zaplanowano automatyczną ponowną próbę.</string>
+    <string name="push_error_paused">%1$s Próby są wstrzymane; usuń przyczynę, potem użyj Eksportuj teraz lub zsynchronizuj opaskę ponownie.</string>
+    <string name="push_error_missing_token">Zapisany token jest niedostępny. Zapisz go ponownie.</string>
+    <string name="push_error_start">Nie udało się bezpiecznie uruchomić workera eksportu.</string>
+    <string name="push_error_queue">Nie udało się zakolejkować następnego kroku eksportu.</string>
+    <string name="push_capabilities_summary">Odbiornik obsługuje %1$d z %2$d typów danych</string>
+    <string name="push_capabilities_checked">Ostatnio sprawdzono: %1$s</string>
+    <string name="push_capabilities_none">Ten odbiornik obecnie nie przyjmuje danych zdrowotnych protokołu 1.0.</string>
+    <string name="push_capabilities_streams">Akceptowane dane: %1$s</string>
+    <string name="push_enabled">Włącz automatyczny eksport</string>
+    <string name="push_enabled_detail">Eksportuje nowe i zmienione dane po pełnej synchronizacji opaski oraz uzupełnia zaległości przy uruchomieniu aplikacji.</string>
+    <string name="push_wifi_only">Tylko Wi-Fi</string>
+    <string name="push_wifi_only_detail">Używa nielimitowanego Wi-Fi do testów połączenia i eksportu. Wyłącz, aby zezwolić na sieci komórkowe i inne połączone sieci.</string>
+    <string name="push_export_now">Eksportuj teraz</string>
+    <string name="push_export_now_detail">Rozpoczyna uzupełnianie teraz. Automatyczny eksport musi być włączony.</string>
+    <string name="push_config_required">Przed włączeniem zapisz prawidłowy endpoint i token.</string>
+    <string name="push_status_title">Stan</string>
+    <string name="push_status_detail">Dane logowania nigdy nie pojawiają się w stanie ani metadanych Workera.</string>
+    <string name="push_never">Nigdy</string>
+    <string name="push_last_success">Ostatnie pełne uzupełnienie: %1$s</string>
+    <string name="push_last_error">Ostatni błąd: %1$s</string>
+    <string name="push_current_state">Bieżący stan: %1$s</string>
+    <string name="push_progress">Bieżący eksport: %1$d partii · zaakceptowano %2$d rekordów</string>
+    <string name="push_current_stream">Bieżący typ danych: %1$s</string>
+    <string name="push_state_idle">Bezczynny</string>
+    <string name="push_state_queued">W kolejce</string>
+    <string name="push_state_running">Wysyłanie</string>
+    <string name="push_state_continuing">Znaleziono więcej danych lokalnych; kontynuowanie</string>
+    <string name="push_state_retrying">Ponawianie po błędzie</string>
+    <string name="push_state_complete">Aktualne</string>
+    <string name="push_state_failed">Wstrzymano po błędzie</string>
+    <string name="push_settings_row_detail">Eksperymentalny eksport jednokierunkowy do kontrolowanego endpointu. Domyślnie wyłączony.</string>
     <string name="l10n_sleep_screen_sleep_outside_the_new_times_was_6229881e">Sen poza nowymi godzinami został usunięty. NOOP nie wykryje go ponownie.</string>
     <string name="workout_action_pause">Wstrzymaj</string>
     <string name="workout_action_resume">Wznów</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 4ffd0b859d..55c78e18b3 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2425,6 +2425,79 @@
     <string name="power_saving_low_refresh_desc">Sincroniza em segundo plano a cada hora em vez de a cada 15 minutos, seja qual for a carga da pulseira — menos religações é a maior poupança numa WHOOP 4.0. Nada se perde: a pulseira guarda tudo e entrega em lotes maiores. A sincronização manual continua imediata e a frequência cardíaca em direto não é afetada.</string>
     <string name="nav_power_saving">Poupança de energia</string>
     <string name="l10n_app_changelog_training_load_a_vo_max_without_f9205a67">Carga de treino, VO₂max sem fita métrica e muito menos bateria a recalcular</string>
+    <string name="nav_self_hosted_push">Envio autoalojado</string>
+    <string name="push_title">Envio autoalojado</string>
+    <string name="push_subtitle">Em fase experimental · Android</string>
+    <string name="push_destination_title">O seu endpoint</string>
+    <string name="push_disclosure">Quando ativado, o NOOP envia dados de saúde em bruto deste telemóvel para o endpoint que controla. Estes dados saem explicitamente do dispositivo.</string>
+    <string name="push_one_way_warning">Apenas exportação unidirecional. O NOOP não restaura dados deste endpoint e não fornece um recetor.</string>
+    <string name="push_endpoint">URL do endpoint</string>
+    <string name="push_token">Token Bearer (oculto)</string>
+    <string name="push_token_saved">Token Bearer (guardado; introduza para substituir)</string>
+    <string name="push_clear_token">Limpar token guardado</string>
+    <string name="push_token_cleared">Token guardado limpo. O envio foi desativado.</string>
+    <string name="push_save">Guardar destino</string>
+    <string name="push_saved">Destino guardado.</string>
+    <string name="push_test_connection">Testar ligação</string>
+    <string name="push_testing_connection">A testar ligação…</string>
+    <string name="push_test_connection_detail">Verifica a autenticação e os tipos de dados suportados. Não envia dados de saúde.</string>
+    <string name="push_test_network_required">Ligue-se a uma rede permitida pela definição Apenas Wi-Fi antes de testar o recetor.</string>
+    <string name="push_capabilities_retryable_error">Não foi possível contactar o recetor. Tente novamente mais tarde.</string>
+    <string name="push_capabilities_invalid_error">O recetor devolveu capacidades inválidas ou não suportadas.</string>
+    <string name="push_error_dns">Falha na resolução DNS. Verifique o nome do host e a configuração DNS do endpoint.</string>
+    <string name="push_error_tls_certificate">Falha na validação do certificado TLS. Verifique o host, a cadeia e a validade.</string>
+    <string name="push_error_tls_handshake">Falha na negociação TLS. Verifique o proxy inverso, versões TLS e cifras.</string>
+    <string name="push_error_network_timeout">Tempo de rede esgotado antes de concluir o pedido. Verifique a ligação e os tempos do proxy.</string>
+    <string name="push_error_connection_refused">Ligação recusada. Confirme que o recetor está ativo e que a porta do proxy ou backend está a escutar.</string>
+    <string name="push_error_network_unreachable">A rota de rede está indisponível. Verifique Wi-Fi, encaminhamento e firewall.</string>
+    <string name="push_error_connection_reset">A ligação foi reposta. Verifique reinícios e tempos do recetor ou proxy.</string>
+    <string name="push_error_network_io">Falha de E/S de rede antes de receber uma confirmação durável.</string>
+    <string name="push_error_http_auth">HTTP %1$d: autenticação recusada. Verifique o token e o encaminhamento do cabeçalho Authorization.</string>
+    <string name="push_error_http_not_found">HTTP %1$d: caminho do endpoint não encontrado. Verifique o URL completo e a rota do proxy.</string>
+    <string name="push_error_http_timeout">HTTP %1$d: o recetor ou proxy excedeu o tempo de processamento.</string>
+    <string name="push_error_http_too_large">HTTP %1$d: pedido demasiado grande. Alinhe os limites do recetor e proxy com o protocolo 1.0.</string>
+    <string name="push_error_http_media_type">HTTP %1$d: o recetor recusou NDJSON gzip e sem compressão.</string>
+    <string name="push_error_http_protocol">HTTP %1$d: o recetor recusou o lote. Verifique o esquema v1, streams permitidos e registos.</string>
+    <string name="push_error_http_rate_limit">HTTP %1$d: limite de pedidos atingido. A repetição automática usa atraso progressivo.</string>
+    <string name="push_error_http_server">HTTP %1$d: erro do recetor ou proxy. Verifique registos e estado.</string>
+    <string name="push_error_http_client">HTTP %1$d: erro inesperado do cliente. Verifique o endpoint e proxy inverso.</string>
+    <string name="push_error_capabilities_invalid">A resposta de capacidades está inválida ou não corresponde ao protocolo 1.0.</string>
+    <string name="push_error_ack_invalid">A confirmação está inválida ou não corresponde ao lote. O cursor não avançou.</string>
+    <string name="push_error_local_data">Um registo local excede os limites ou não pode ser codificado exatamente. O cursor não avançou.</string>
+    <string name="push_error_local_database">Não foi possível ler ou guardar a base local ou o progresso.</string>
+    <string name="push_error_network">A aguardar uma rede permitida pela definição Apenas Wi-Fi.</string>
+    <string name="push_error_retrying">%1$s Foi agendada uma repetição automática.</string>
+    <string name="push_error_paused">%1$s As repetições estão pausadas; corrija a causa e use Exportar agora ou sincronize novamente a pulseira.</string>
+    <string name="push_error_missing_token">O token guardado está indisponível. Guarde-o novamente.</string>
+    <string name="push_error_start">Não foi possível iniciar o worker de exportação em segurança.</string>
+    <string name="push_error_queue">Não foi possível colocar em fila o próximo passo da exportação.</string>
+    <string name="push_capabilities_summary">O recetor suporta %1$d de %2$d tipos de dados</string>
+    <string name="push_capabilities_checked">Última verificação: %1$s</string>
+    <string name="push_capabilities_none">Este recetor não aceita atualmente dados de saúde do protocolo 1.0.</string>
+    <string name="push_capabilities_streams">Dados aceites: %1$s</string>
+    <string name="push_enabled">Ativar exportação automática</string>
+    <string name="push_enabled_detail">Exporta dados novos e alterados após uma sincronização completa da pulseira e recupera pendentes ao iniciar a aplicação.</string>
+    <string name="push_wifi_only">Apenas Wi-Fi</string>
+    <string name="push_wifi_only_detail">Usa Wi-Fi não tarifado para testes de ligação e exportações. Desative para permitir redes móveis e outras redes ligadas.</string>
+    <string name="push_export_now">Exportar agora</string>
+    <string name="push_export_now_detail">Inicia agora uma atualização. A exportação automática tem de estar ativada.</string>
+    <string name="push_config_required">Guarde um endpoint válido e um token antes de ativar.</string>
+    <string name="push_status_title">Estado</string>
+    <string name="push_status_detail">As credenciais nunca aparecem no estado nem nos metadados do Worker.</string>
+    <string name="push_never">Nunca</string>
+    <string name="push_last_success">Última atualização completa: %1$s</string>
+    <string name="push_last_error">Último erro: %1$s</string>
+    <string name="push_current_state">Estado atual: %1$s</string>
+    <string name="push_progress">Exportação atual: %1$d lotes · %2$d registos aceites</string>
+    <string name="push_current_stream">Tipo de dados atual: %1$s</string>
+    <string name="push_state_idle">Inativo</string>
+    <string name="push_state_queued">Em fila</string>
+    <string name="push_state_running">A enviar</string>
+    <string name="push_state_continuing">Foram encontrados mais dados locais; a continuar</string>
+    <string name="push_state_retrying">A repetir após um erro</string>
+    <string name="push_state_complete">Atualizado</string>
+    <string name="push_state_failed">Em pausa após um erro</string>
+    <string name="push_settings_row_detail">Exportação unidirecional experimental para um endpoint que controla. Desativada por predefinição.</string>
     <string name="l10n_sleep_screen_sleep_outside_the_new_times_was_6229881e">O sono fora dos novos horários foi removido. O NOOP não o voltará a detetar.</string>
     <string name="workout_action_pause">Pausar</string>
     <string name="workout_action_resume">Retomar</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 611a008cd5..1e3d7537be 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2346,6 +2346,79 @@
     <string name="power_saving_low_refresh_desc">无论手环电量如何，后台同步改为每小时一次而非每 15 分钟一次——减少重新连接是 WHOOP 4.0 上最大的省电项。不会丢失任何数据：手环会记录全部内容，并以更大的批次交付。手动同步仍会立即运行，实时心率不受影响。</string>
     <string name="nav_power_saving">省电模式</string>
     <string name="l10n_app_changelog_training_load_a_vo_max_without_f9205a67">训练负荷、无需量腰围的 VO₂max，以及大幅降低的重算耗电</string>
+    <string name="nav_self_hosted_push">自托管推送</string>
+    <string name="push_title">自托管推送</string>
+    <string name="push_subtitle">实验功能 · Android</string>
+    <string name="push_destination_title">你的端点</string>
+    <string name="push_disclosure">启用后，NOOP 会将此手机上的原始健康记录发送到你控制的端点。这意味着数据会明确离开设备。</string>
+    <string name="push_one_way_warning">仅支持单向导出。NOOP 无法从该端点恢复数据，也不提供接收端。</string>
+    <string name="push_endpoint">端点 URL</string>
+    <string name="push_token">Bearer 令牌（已隐藏）</string>
+    <string name="push_token_saved">Bearer 令牌（已保存；输入新值可替换）</string>
+    <string name="push_clear_token">清除已保存的令牌</string>
+    <string name="push_token_cleared">已清除保存的令牌，并已关闭推送。</string>
+    <string name="push_save">保存目标</string>
+    <string name="push_saved">目标已保存。</string>
+    <string name="push_test_connection">测试连接</string>
+    <string name="push_testing_connection">正在测试连接…</string>
+    <string name="push_test_connection_detail">检查身份验证和支持的数据类型，不会发送健康数据。</string>
+    <string name="push_test_network_required">请先连接“仅限 Wi-Fi”设置允许的网络，再测试接收端。</string>
+    <string name="push_capabilities_retryable_error">无法连接接收端，请稍后重试。</string>
+    <string name="push_capabilities_invalid_error">接收端返回了无效或不支持的能力信息。</string>
+    <string name="push_error_dns">DNS 解析失败。请检查端点主机名和 DNS 配置。</string>
+    <string name="push_error_tls_certificate">TLS 证书验证失败。请检查主机名、证书链和有效期。</string>
+    <string name="push_error_tls_handshake">TLS 握手失败。请检查反向代理、TLS 版本和密码套件。</string>
+    <string name="push_error_network_timeout">请求完成前网络超时。请检查可达性和代理超时设置。</string>
+    <string name="push_error_connection_refused">连接被拒绝。请确认接收端正在运行，且代理或后端端口正在监听。</string>
+    <string name="push_error_network_unreachable">网络路由不可用。请检查 Wi-Fi、路由和防火墙规则。</string>
+    <string name="push_error_connection_reset">连接被重置。请检查接收端或代理是否重启以及连接超时设置。</string>
+    <string name="push_error_network_io">收到持久确认前网络 I/O 失败。</string>
+    <string name="push_error_http_auth">HTTP %1$d：身份验证被拒绝。请检查令牌和代理的 Authorization 头转发。</string>
+    <string name="push_error_http_not_found">HTTP %1$d：找不到端点路径。请检查完整 URL 和反向代理路由。</string>
+    <string name="push_error_http_timeout">HTTP %1$d：接收端或代理处理请求超时。</string>
+    <string name="push_error_http_too_large">HTTP %1$d：请求过大。请将接收端和代理的正文限制与协议 1.0 对齐。</string>
+    <string name="push_error_http_media_type">HTTP %1$d：接收端同时拒绝 gzip 和未压缩 NDJSON 上传。</string>
+    <string name="push_error_http_protocol">HTTP %1$d：接收端拒绝协议批次。请检查 v1 架构、允许的流和日志。</string>
+    <string name="push_error_http_rate_limit">HTTP %1$d：达到接收端速率限制。自动重试将使用退避。</string>
+    <string name="push_error_http_server">HTTP %1$d：接收端或反向代理服务器错误。请检查日志和健康状态。</string>
+    <string name="push_error_http_client">HTTP %1$d：意外的客户端错误。请检查端点和反向代理配置。</string>
+    <string name="push_error_capabilities_invalid">能力响应格式错误或不符合协议 1.0。</string>
+    <string name="push_error_ack_invalid">接收端确认格式错误或与批次不匹配。游标未推进。</string>
+    <string name="push_error_local_data">本地记录超出协议限制或无法精确编码。游标未推进。</string>
+    <string name="push_error_local_database">无法读取或保存本地数据库或推送进度。</string>
+    <string name="push_error_network">正在等待“仅限 Wi-Fi”设置允许的网络。</string>
+    <string name="push_error_retrying">%1$s 已安排自动重试。</string>
+    <string name="push_error_paused">%1$s 自动重试已暂停；请修复原因，然后使用“立即导出”或重新同步腕带。</string>
+    <string name="push_error_missing_token">已保存的令牌不可用。请重新保存。</string>
+    <string name="push_error_start">无法安全启动导出 Worker。</string>
+    <string name="push_error_queue">无法将下一步导出加入队列。</string>
+    <string name="push_capabilities_summary">接收端支持 %1$d/%2$d 种数据类型</string>
+    <string name="push_capabilities_checked">上次检查：%1$s</string>
+    <string name="push_capabilities_none">此接收端目前不接受协议 1.0 健康数据。</string>
+    <string name="push_capabilities_streams">接受的数据：%1$s</string>
+    <string name="push_enabled">启用自动导出</string>
+    <string name="push_enabled_detail">腕带完整同步后自动导出新增和变更的数据，并在应用启动时补发积压数据。</string>
+    <string name="push_wifi_only">仅限 Wi-Fi</string>
+    <string name="push_wifi_only_detail">连接测试和导出仅使用不计费的 Wi-Fi。关闭后可使用移动网络及其他已连接网络。</string>
+    <string name="push_export_now">立即导出</string>
+    <string name="push_export_now_detail">立即开始补发。必须先启用自动导出。</string>
+    <string name="push_config_required">启用前请保存有效端点和令牌。</string>
+    <string name="push_status_title">状态</string>
+    <string name="push_status_detail">凭据绝不会出现在状态或 Worker 元数据中。</string>
+    <string name="push_never">从未</string>
+    <string name="push_last_success">上次完整补发：%1$s</string>
+    <string name="push_last_error">上次错误：%1$s</string>
+    <string name="push_current_state">当前状态：%1$s</string>
+    <string name="push_progress">当前导出：%1$d 批 · 已接受 %2$d 条记录</string>
+    <string name="push_current_stream">当前数据类型：%1$s</string>
+    <string name="push_state_idle">空闲</string>
+    <string name="push_state_queued">已排队</string>
+    <string name="push_state_running">正在发送</string>
+    <string name="push_state_continuing">发现更多本地数据；正在继续</string>
+    <string name="push_state_retrying">出错后重试</string>
+    <string name="push_state_complete">已是最新</string>
+    <string name="push_state_failed">出错后已暂停</string>
+    <string name="push_settings_row_detail">向你控制的端点进行实验性单向导出。默认关闭。</string>
     <string name="l10n_sleep_screen_sleep_outside_the_new_times_was_6229881e">新时间范围之外的睡眠已移除。NOOP 不会再次检测到它。</string>
     <string name="workout_action_pause">暂停</string>
     <string name="workout_action_resume">继续</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 9fc1171f79..3b05e0c988 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -41,8 +41,82 @@
     <string name="nav_support">Support</string>
     <string name="nav_settings">Settings</string>
     <string name="nav_test_centre">Test Centre</string>
+    <string name="nav_self_hosted_push">Self-hosted push</string>
     <string name="nav_more">More</string>
 
+    <string name="push_title">Self-hosted push</string>
+    <string name="push_subtitle">Experimental · Android</string>
+    <string name="push_destination_title">Your endpoint</string>
+    <string name="push_disclosure">When enabled, NOOP sends raw health records from this phone to the endpoint you control. This is explicit data egress from the device.</string>
+    <string name="push_one_way_warning">One-way export only. NOOP cannot restore data from this endpoint and does not provide a receiver.</string>
+    <string name="push_endpoint">Endpoint URL</string>
+    <string name="push_token">Bearer token (hidden)</string>
+    <string name="push_token_saved">Bearer token (saved; enter to replace)</string>
+    <string name="push_clear_token">Clear saved token</string>
+    <string name="push_token_cleared">Saved token cleared. Push was turned off.</string>
+    <string name="push_save">Save destination</string>
+    <string name="push_saved">Destination saved.</string>
+    <string name="push_test_connection">Test connection</string>
+    <string name="push_testing_connection">Testing connection…</string>
+    <string name="push_test_connection_detail">Checks authentication and supported data types. No health data is sent.</string>
+    <string name="push_test_network_required">Connect to a network allowed by the Wi-Fi-only setting before testing the receiver.</string>
+    <string name="push_capabilities_retryable_error">The receiver could not be reached. Try the connection test again later.</string>
+    <string name="push_capabilities_invalid_error">The receiver returned invalid or unsupported capabilities.</string>
+    <string name="push_error_dns">DNS lookup failed. Check the endpoint hostname and DNS configuration.</string>
+    <string name="push_error_tls_certificate">TLS certificate validation failed. Check the hostname, certificate chain, and expiry.</string>
+    <string name="push_error_tls_handshake">TLS handshake failed. Check the reverse proxy, TLS versions, and cipher configuration.</string>
+    <string name="push_error_network_timeout">Network timeout before the request completed. Check reachability and proxy timeouts.</string>
+    <string name="push_error_connection_refused">Connection refused. Confirm the receiver is running and the proxy or backend port is listening.</string>
+    <string name="push_error_network_unreachable">The network route is unavailable. Check Wi-Fi, routing, and firewall rules.</string>
+    <string name="push_error_connection_reset">The connection was reset. Check receiver or proxy restarts and connection timeouts.</string>
+    <string name="push_error_network_io">Network I/O failed before a durable acknowledgement was received.</string>
+    <string name="push_error_http_auth">HTTP %1$d: Authentication rejected. Check the bearer token and proxy Authorization forwarding.</string>
+    <string name="push_error_http_not_found">HTTP %1$d: Endpoint path not found. Check the complete URL and reverse-proxy route.</string>
+    <string name="push_error_http_timeout">HTTP %1$d: The receiver or proxy timed out processing the request.</string>
+    <string name="push_error_http_too_large">HTTP %1$d: Request too large. Align receiver and reverse-proxy body limits with protocol 1.0.</string>
+    <string name="push_error_http_media_type">HTTP %1$d: The receiver rejected both gzip and identity NDJSON uploads.</string>
+    <string name="push_error_http_protocol">HTTP %1$d: The receiver rejected the protocol batch. Check its v1 schema, stream allowlist, and logs.</string>
+    <string name="push_error_http_rate_limit">HTTP %1$d: Receiver rate limit reached. Automatic retry uses backoff.</string>
+    <string name="push_error_http_server">HTTP %1$d: Receiver or reverse-proxy server error. Check server logs and health.</string>
+    <string name="push_error_http_client">HTTP %1$d: Unexpected client error. Check endpoint and reverse-proxy configuration.</string>
+    <string name="push_error_capabilities_invalid">The capability response is malformed or not protocol 1.0.</string>
+    <string name="push_error_ack_invalid">The receiver acknowledgement is malformed or does not match the submitted batch. The cursor was not advanced.</string>
+    <string name="push_error_local_data">A local record exceeds protocol limits or cannot be encoded exactly. No cursor was advanced.</string>
+    <string name="push_error_local_database">The local database or push-progress state could not be read or saved.</string>
+    <string name="push_error_network">Waiting for a network allowed by the Wi-Fi-only setting.</string>
+    <string name="push_error_retrying">%1$s Automatic retry is scheduled.</string>
+    <string name="push_error_paused">%1$s Automatic retries are paused; fix the cause, then use Export now or complete another strap sync.</string>
+    <string name="push_error_missing_token">The saved bearer token is unavailable. Save it again.</string>
+    <string name="push_error_start">The export worker could not start safely.</string>
+    <string name="push_error_queue">The next bounded export step could not be queued.</string>
+    <string name="push_capabilities_summary">Receiver supports %1$d of %2$d data types</string>
+    <string name="push_capabilities_checked">Last checked: %1$s</string>
+    <string name="push_capabilities_none">This receiver currently accepts no protocol 1.0 health data.</string>
+    <string name="push_capabilities_streams">Accepted data: %1$s</string>
+    <string name="push_enabled">Enable automatic export</string>
+    <string name="push_enabled_detail">Exports new and changed data after a complete strap sync and catches up at app launch.</string>
+    <string name="push_wifi_only">Wi-Fi only</string>
+    <string name="push_wifi_only_detail">Use unmetered Wi-Fi for connection tests and exports. Turn off to allow mobile and other connected networks.</string>
+    <string name="push_export_now">Export now</string>
+    <string name="push_export_now_detail">Starts a catch-up now. Automatic export must be enabled.</string>
+    <string name="push_config_required">Save a valid endpoint and token before enabling.</string>
+    <string name="push_status_title">Status</string>
+    <string name="push_status_detail">Credentials are never shown in status or worker metadata.</string>
+    <string name="push_never">Never</string>
+    <string name="push_last_success">Last complete catch-up: %1$s</string>
+    <string name="push_last_error">Last error: %1$s</string>
+    <string name="push_current_state">Current state: %1$s</string>
+    <string name="push_progress">Current export: %1$d batches · %2$d records accepted</string>
+    <string name="push_current_stream">Current data type: %1$s</string>
+    <string name="push_state_idle">Idle</string>
+    <string name="push_state_queued">Queued</string>
+    <string name="push_state_running">Sending</string>
+    <string name="push_state_continuing">More local data found; continuing</string>
+    <string name="push_state_retrying">Retrying after an error</string>
+    <string name="push_state_complete">Up to date</string>
+    <string name="push_state_failed">Paused after an error</string>
+    <string name="push_settings_row_detail">Experimental one-way export to an endpoint you control. Off by default.</string>
+
     <!-- More-page section headers (DISPLAY only; the stored expand/collapse key stays the English
          literal in MoreSectionPrefs so persistence and iOS parity are unaffected). -->
     <string name="more_group_insights">Insights</string>
diff --git a/android/app/src/test/java/com/noop/ble/SuccessfulOffloadHookTest.kt b/android/app/src/test/java/com/noop/ble/SuccessfulOffloadHookTest.kt
new file mode 100644
index 0000000000..cf74341625
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ble/SuccessfulOffloadHookTest.kt
@@ -0,0 +1,15 @@
+package com.noop.ble
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class SuccessfulOffloadHookTest {
+    @Test fun completeOrProductiveTimeoutNotifiesDownstream() {
+        assertTrue(WhoopBleClient.shouldNotifySuccessfulOffload("HISTORY_COMPLETE", bankedRows = true))
+        assertTrue(WhoopBleClient.shouldNotifySuccessfulOffload("timeout", bankedRows = true))
+        assertFalse(WhoopBleClient.shouldNotifySuccessfulOffload("timeout", bankedRows = false))
+        assertFalse(WhoopBleClient.shouldNotifySuccessfulOffload("aborted by user", bankedRows = true))
+        assertFalse(WhoopBleClient.shouldNotifySuccessfulOffload("disconnect", bankedRows = true))
+    }
+}
diff --git a/android/app/src/test/java/com/noop/push/EndpointScopedProgressStoreTest.kt b/android/app/src/test/java/com/noop/push/EndpointScopedProgressStoreTest.kt
new file mode 100644
index 0000000000..d1f91fb96a
--- /dev/null
+++ b/android/app/src/test/java/com/noop/push/EndpointScopedProgressStoreTest.kt
@@ -0,0 +1,26 @@
+package com.noop.push
+
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+class EndpointScopedProgressStoreTest {
+    @Test fun endpointChangeIsolatesProgressWhileSameEndpointCanRotateToken() = runBlocking {
+        val underlying = MemoryProgress()
+        val first = EndpointScopedProgressStore(underlying, "endpoint-a")
+        val sameUrlNewToken = EndpointScopedProgressStore(underlying, "endpoint-a")
+        val changedUrl = EndpointScopedProgressStore(underlying, "endpoint-b")
+        val cursor = PushCursor(42, "natural-key")
+        val window = PushWindow("2026-08-05", "2026-08-18", 1L, 2L)
+        val windowProgress = PushWindowProgress(window, "batch", mapOf("2026-08-18" to "a".repeat(64)))
+
+        first.saveCursor(PushAppendTable.HR_SAMPLE, "strap", cursor)
+        first.saveWindow(PushMutableTable.JOURNAL, "strap", windowProgress)
+
+        assertEquals(cursor, sameUrlNewToken.cursor(PushAppendTable.HR_SAMPLE, "strap"))
+        assertEquals(windowProgress, sameUrlNewToken.window(PushMutableTable.JOURNAL, "strap"))
+        assertNull(changedUrl.cursor(PushAppendTable.HR_SAMPLE, "strap"))
+        assertNull(changedUrl.window(PushMutableTable.JOURNAL, "strap"))
+    }
+}
diff --git a/android/app/src/test/java/com/noop/push/PushCoordinatorTest.kt b/android/app/src/test/java/com/noop/push/PushCoordinatorTest.kt
new file mode 100644
index 0000000000..a4327fa37f
--- /dev/null
+++ b/android/app/src/test/java/com/noop/push/PushCoordinatorTest.kt
@@ -0,0 +1,675 @@
+package com.noop.push
+
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.time.LocalDate
+import java.time.ZoneId
+
+class PushCoordinatorTest {
+    @Test
+    fun endpointChangeFencesRemainingPostsToCapturedDestination() = runBlocking {
+        val settings = SelfHostedPushSettings.forTest(
+            SelfHostedPushSettingsTest.FakePushPrefs(),
+            SelfHostedPushSettingsTest.FakePushPrefs(),
+        )
+        val first = (PushEndpointPolicy.validate("https://one.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+        val second = (PushEndpointPolicy.validate("https://two.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+        settings.saveEndpoint(first.url)
+        settings.saveToken("secret")
+        assertTrue(settings.setEnabled(true))
+        val source = FakePushSource(
+            append = mutableMapOf(
+                key(PushAppendTable.HR_SAMPLE, "a") to mutableListOf(hr(1, 100)),
+                key(PushAppendTable.BATTERY, "a") to mutableListOf(
+                    PushAppendRecord(2, linkedMapOf("ts" to 101L), linkedMapOf("soc" to 80.0, "mv" to null, "charging" to false)),
+                ),
+            ),
+        )
+        val transport = object : PushTransport {
+            var posts = 0
+            override suspend fun post(batch: PushBatch): PushTransportResponse {
+                posts++
+                if (posts == 1) settings.saveEndpoint(second.url)
+                return PushTransportResponse(200, PushAck.fromBatch(batch).encode())
+            }
+        }
+
+        try {
+            PushCoordinator(
+                source, transport, MemoryProgress(), SOURCE_A,
+                destinationStillCurrent = { settings.enabledEndpoint() == first },
+            ).pushKnownDevices(
+                capabilities = PushCapabilities(
+                    appendTables = setOf(PushAppendTable.HR_SAMPLE, PushAppendTable.BATTERY),
+                    mutableTables = emptySet(),
+                ),
+            )
+        } catch (_: kotlinx.coroutines.CancellationException) {
+            // Destination rotation deliberately aborts the captured run before another POST.
+        }
+
+        assertEquals(1, transport.posts)
+    }
+
+    @Test
+    fun exactAckIsRequiredBeforeCursorAdvances() = runBlocking {
+        val row = hr(1, 100)
+        val source = FakePushSource(append = mutableMapOf(key(PushAppendTable.HR_SAMPLE, "a") to mutableListOf(row)))
+        val progress = MemoryProgress()
+        val partial = AckingTransport { batch -> PushAck.fromBatch(batch).copy(acceptedRows = 0) }
+
+        val result = PushCoordinator(source, partial, progress, SOURCE_A).pushAppend(PushAppendTable.HR_SAMPLE, "a")
+
+        assertTrue(result is PushResult.Rejected)
+        assertTrue(progress.cursors.isEmpty())
+    }
+
+    @Test
+    fun acceptedStatusAndFullCursorFingerprintMustMatch() = runBlocking {
+        val row = hr(1, 100)
+        val source = FakePushSource(append = mutableMapOf(key(PushAppendTable.HR_SAMPLE, "a") to mutableListOf(row)))
+        val progress = MemoryProgress()
+        val wrongStatus = AckingTransport { batch -> PushAck.fromBatch(batch).copy(status = "partial") }
+
+        val result = PushCoordinator(source, wrongStatus, progress, SOURCE_A)
+            .pushAppend(PushAppendTable.HR_SAMPLE, "a")
+
+        assertTrue(result is PushResult.Rejected)
+        assertTrue(progress.cursors.isEmpty())
+    }
+
+    @Test
+    fun malformedAckLeavesProgressAndRetryBytesUnchanged() = runBlocking {
+        val source = FakePushSource(
+            append = mutableMapOf(key(PushAppendTable.HR_SAMPLE, "a") to mutableListOf(hr(1, 100))),
+        )
+        val progress = MemoryProgress()
+        val malformed = object : PushTransport {
+            val bodies = mutableListOf<ByteArray>()
+            override suspend fun post(batch: PushBatch): PushTransportResponse {
+                bodies += batch.body.copyOf()
+                return PushTransportResponse(200, "{not-json".toByteArray())
+            }
+        }
+        val coordinator = PushCoordinator(source, malformed, progress, SOURCE_A)
+
+        coordinator.pushAppend(PushAppendTable.HR_SAMPLE, "a")
+        coordinator.pushAppend(PushAppendTable.HR_SAMPLE, "a")
+
+        assertTrue(progress.cursors.isEmpty())
+        assertArrayEquals(malformed.bodies[0], malformed.bodies[1])
+    }
+
+    @Test
+    fun oversizedAckIsRejectedBeforeParsing() = runBlocking {
+        val source = FakePushSource(
+            append = mutableMapOf(key(PushAppendTable.HR_SAMPLE, "a") to mutableListOf(hr(1, 100))),
+        )
+        val progress = MemoryProgress()
+        val transport = object : PushTransport {
+            override suspend fun post(batch: PushBatch) = PushTransportResponse(
+                200,
+                ByteArray(PushProtocol.MAX_ACK_BYTES + 1) { 'x'.code.toByte() },
+            )
+        }
+
+        val result = PushCoordinator(source, transport, progress, SOURCE_A).pushAppend(PushAppendTable.HR_SAMPLE, "a")
+
+        assertTrue(result is PushResult.Rejected)
+        assertTrue(progress.cursors.isEmpty())
+    }
+
+    @Test
+    fun ackWithUndocumentedCommandIsRejectedWithoutAdvancing() = runBlocking {
+        val source = FakePushSource(
+            append = mutableMapOf(key(PushAppendTable.HR_SAMPLE, "a") to mutableListOf(hr(1, 100))),
+        )
+        val progress = MemoryProgress()
+        val transport = object : PushTransport {
+            override suspend fun post(batch: PushBatch): PushTransportResponse {
+                val accepted = PushAck.fromBatch(batch).encode().toString(Charsets.UTF_8)
+                val withCommand = accepted.dropLast(1) + ",\"command\":\"delete-local-data\"}"
+                return PushTransportResponse(200, withCommand.toByteArray())
+            }
+        }
+
+        val result = PushCoordinator(source, transport, progress, SOURCE_A)
+            .pushAppend(PushAppendTable.HR_SAMPLE, "a")
+
+        assertTrue(result is PushResult.Rejected)
+        assertTrue(progress.cursors.isEmpty())
+    }
+
+    @Test
+    fun httpAndTransportFailuresNeverAdvanceAndRetryOnlyTransientClasses() = runBlocking {
+        val expected = listOf(401 to false, 408 to true, 429 to true, 500 to true)
+        for ((status, retryable) in expected) {
+            val source = FakePushSource(
+                append = mutableMapOf(key(PushAppendTable.HR_SAMPLE, "a") to mutableListOf(hr(1, 100))),
+            )
+            val progress = MemoryProgress()
+            val transport = object : PushTransport {
+                override suspend fun post(batch: PushBatch) = PushTransportResponse(status, ByteArray(0))
+            }
+
+            val result = PushCoordinator(source, transport, progress, SOURCE_A)
+                .pushAppend(PushAppendTable.HR_SAMPLE, "a")
+
+            assertTrue("HTTP $status", result is PushResult.Rejected && result.retryable == retryable)
+            assertTrue("HTTP $status moved cursor", progress.cursors.isEmpty())
+        }
+
+        val progress = MemoryProgress()
+        val throwing = object : PushTransport {
+            override suspend fun post(batch: PushBatch): PushTransportResponse = throw java.io.IOException("timeout")
+        }
+        val result = PushCoordinator(
+            FakePushSource(
+                append = mutableMapOf(key(PushAppendTable.HR_SAMPLE, "a") to mutableListOf(hr(1, 100))),
+            ),
+            throwing,
+            progress,
+            SOURCE_A,
+        ).pushAppend(PushAppendTable.HR_SAMPLE, "a")
+        assertTrue(result is PushResult.Rejected && result.retryable)
+        assertTrue(progress.cursors.isEmpty())
+    }
+
+    @Test
+    fun emptyMutableWindowPropagatesDeletionAndAdvancesOnlyOnExactAck() = runBlocking {
+        val source = FakePushSource()
+        val progress = MemoryProgress()
+        val transport = AckingTransport()
+        val coordinator = PushCoordinator(
+            source,
+            transport,
+            progress,
+            SOURCE_A,
+            today = { LocalDate.of(2026, 8, 18) },
+            zoneId = ZoneId.of("Europe/Berlin"),
+        )
+
+        val result = coordinator.pushMutable(PushMutableTable.JOURNAL, "noop-journal")
+
+        assertTrue(result is PushResult.Accepted)
+        assertEquals(0, transport.batches.single().recordCount)
+        assertEquals("replace_window", transport.batches.single().mode)
+        assertEquals("2026-08-05", transport.batches.single().window?.fromDay)
+        assertEquals(
+            transport.batches.single().replacementId,
+            progress.windows[key(PushMutableTable.JOURNAL, "noop-journal")]?.batchId,
+        )
+        assertEquals(14, progress.windows[key(PushMutableTable.JOURNAL, "noop-journal")]?.dayHashes?.size)
+    }
+
+    @Test
+    fun unchangedMutableDaysSkipEveryHttpBatch() = runBlocking {
+        val source = FakePushSource(
+            mutable = mutableMapOf(
+                key(PushMutableTable.JOURNAL, "a") to mutableListOf(journal("2026-08-18", "coffee")),
+            ),
+        )
+        val progress = MemoryProgress()
+        val today = { LocalDate.of(2026, 8, 18) }
+        val first = AckingTransport()
+        val coordinator = PushCoordinator(source, first, progress, SOURCE_A, today, ZoneId.of("UTC"))
+
+        assertTrue(coordinator.pushMutable(PushMutableTable.JOURNAL, "a") is PushResult.Accepted)
+        assertEquals(1, first.batches.size)
+
+        val unchanged = AckingTransport()
+        val result = PushCoordinator(source, unchanged, progress, SOURCE_A, today, ZoneId.of("UTC"))
+            .pushMutable(PushMutableTable.JOURNAL, "a")
+
+        assertEquals(PushResult.NoData, result)
+        assertTrue(unchanged.batches.isEmpty())
+    }
+
+    @Test
+    fun oneChangedDaySendsOnlyThatAuthoritativeDay() = runBlocking {
+        val source = FakePushSource(
+            mutable = mutableMapOf(
+                key(PushMutableTable.JOURNAL, "a") to mutableListOf(
+                    journal("2026-08-17", "coffee", notes = "old"),
+                    journal("2026-08-18", "exercise", notes = "same"),
+                ),
+            ),
+        )
+        val progress = MemoryProgress()
+        val today = { LocalDate.of(2026, 8, 18) }
+        PushCoordinator(source, AckingTransport(), progress, SOURCE_A, today, ZoneId.of("UTC"))
+            .pushMutable(PushMutableTable.JOURNAL, "a")
+        source.mutable.getValue(key(PushMutableTable.JOURNAL, "a"))[0] =
+            journal("2026-08-17", "coffee", notes = "changed")
+
+        val changed = AckingTransport()
+        val result = PushCoordinator(source, changed, progress, SOURCE_A, today, ZoneId.of("UTC"))
+            .pushMutable(PushMutableTable.JOURNAL, "a")
+
+        assertTrue(result is PushResult.Accepted)
+        val batch = changed.batches.single()
+        assertEquals("2026-08-17", batch.window?.fromDay)
+        assertEquals("2026-08-17", batch.window?.toDay)
+        assertEquals(1, batch.recordCount)
+        assertTrue(batch.body.toString(Charsets.UTF_8).contains("changed"))
+        assertFalse(batch.body.toString(Charsets.UTF_8).contains("exercise"))
+    }
+
+    @Test
+    fun legacyWindowProgressWithoutDailyHashesForcesOneFullBaseline() = runBlocking {
+        val source = FakePushSource(
+            mutable = mutableMapOf(
+                key(PushMutableTable.JOURNAL, "a") to mutableListOf(journal("2026-08-18", "coffee")),
+            ),
+        )
+        val progress = MemoryProgress().apply {
+            windows[key(PushMutableTable.JOURNAL, "a")] = PushWindowProgress(
+                PushWindow.days(LocalDate.of(2026, 8, 5), LocalDate.of(2026, 8, 18), ZoneId.of("UTC")),
+                "legacy-batch",
+            )
+        }
+        val transport = AckingTransport()
+
+        PushCoordinator(
+            source, transport, progress, SOURCE_A,
+            today = { LocalDate.of(2026, 8, 18) }, zoneId = ZoneId.of("UTC"),
+        ).pushMutable(PushMutableTable.JOURNAL, "a")
+
+        assertEquals("2026-08-05", transport.batches.single().window?.fromDay)
+        assertEquals("2026-08-18", transport.batches.single().window?.toDay)
+        assertEquals(14, progress.windows.getValue(key(PushMutableTable.JOURNAL, "a")).dayHashes.size)
+    }
+
+    @Test
+    fun timestampSelectedStreamUsesLocalMidnightForChangedDay() = runBlocking {
+        val zone = ZoneId.of("Europe/Berlin")
+        val day = LocalDate.of(2026, 8, 17)
+        val startTs = day.atTime(23, 30).atZone(zone).toEpochSecond()
+        val source = FakePushSource(
+            mutable = mutableMapOf(
+                key(PushMutableTable.SLEEP_SESSION, "a") to mutableListOf(sleep(startTs, efficiency = 0.80)),
+            ),
+        )
+        val progress = MemoryProgress()
+        val today = { LocalDate.of(2026, 8, 18) }
+        PushCoordinator(source, AckingTransport(), progress, SOURCE_A, today, zone)
+            .pushMutable(PushMutableTable.SLEEP_SESSION, "a")
+        source.mutable.getValue(key(PushMutableTable.SLEEP_SESSION, "a"))[0] =
+            sleep(startTs, efficiency = 0.90)
+
+        val changed = AckingTransport()
+        PushCoordinator(source, changed, progress, SOURCE_A, today, zone)
+            .pushMutable(PushMutableTable.SLEEP_SESSION, "a")
+
+        val window = changed.batches.single().window ?: error("missing window")
+        assertEquals(day.toString(), window.fromDay)
+        assertEquals(day.toString(), window.toDay)
+        assertEquals(day.atStartOfDay(zone).toEpochSecond(), window.startTsInclusive)
+        assertEquals(day.plusDays(1).atStartOfDay(zone).toEpochSecond(), window.endTsExclusive)
+    }
+
+    @Test
+    fun deletingLastRowSendsOneEmptyDayAndFailedAckKeepsOldHash() = runBlocking {
+        val source = FakePushSource(
+            mutable = mutableMapOf(
+                key(PushMutableTable.JOURNAL, "a") to mutableListOf(journal("2026-08-17", "coffee")),
+            ),
+        )
+        val progress = MemoryProgress()
+        val today = { LocalDate.of(2026, 8, 18) }
+        PushCoordinator(source, AckingTransport(), progress, SOURCE_A, today, ZoneId.of("UTC"))
+            .pushMutable(PushMutableTable.JOURNAL, "a")
+        val acceptedHashes = progress.windows.getValue(key(PushMutableTable.JOURNAL, "a")).dayHashes
+        source.mutable.getValue(key(PushMutableTable.JOURNAL, "a")).clear()
+        val rejecting = object : PushTransport {
+            val batches = mutableListOf<PushBatch>()
+            override suspend fun post(batch: PushBatch): PushTransportResponse {
+                batches += batch
+                return PushTransportResponse(500, ByteArray(0))
+            }
+        }
+
+        val rejected = PushCoordinator(source, rejecting, progress, SOURCE_A, today, ZoneId.of("UTC"))
+            .pushMutable(PushMutableTable.JOURNAL, "a")
+
+        assertTrue(rejected is PushResult.Rejected)
+        assertEquals("2026-08-17", rejecting.batches.single().window?.fromDay)
+        assertEquals(0, rejecting.batches.single().recordCount)
+        assertEquals(acceptedHashes, progress.windows.getValue(key(PushMutableTable.JOURNAL, "a")).dayHashes)
+
+        val retry = AckingTransport()
+        PushCoordinator(source, retry, progress, SOURCE_A, today, ZoneId.of("UTC"))
+            .pushMutable(PushMutableTable.JOURNAL, "a")
+        assertEquals("2026-08-17", retry.batches.single().window?.fromDay)
+        assertEquals(0, retry.batches.single().recordCount)
+    }
+
+    @Test
+    fun databaseSnapshotEndsBeforeTransportStarts() = runBlocking {
+        val source = FakePushSource(
+            append = mutableMapOf(key(PushAppendTable.HR_SAMPLE, "a") to mutableListOf(hr(1, 100))),
+        )
+        val transport = object : PushTransport {
+            override suspend fun post(batch: PushBatch): PushTransportResponse {
+                assertFalse("database read transaction must be closed before HTTP", source.reading)
+                return PushTransportResponse(200, PushAck.fromBatch(batch).encode())
+            }
+        }
+
+        PushCoordinator(source, transport, MemoryProgress(), SOURCE_A)
+            .pushAppend(PushAppendTable.HR_SAMPLE, "a")
+        Unit
+    }
+
+    @Test
+    fun oversizedMutableWindowFailsBeforeHttpWithoutUnboundedAccumulation() = runBlocking {
+        val huge = PushMutableRecord(
+            linkedMapOf("day" to "2026-08-18", "question" to "large"),
+            linkedMapOf(
+                "answeredYes" to true,
+                "notes" to "x".repeat(PushProtocol.MAX_MUTABLE_SNAPSHOT_ENCODED_BYTES + 1),
+                "numericValue" to null,
+            ),
+        )
+        val source = FakePushSource(
+            mutable = mutableMapOf(key(PushMutableTable.JOURNAL, "a") to mutableListOf(huge)),
+        )
+        val transport = AckingTransport()
+
+        val result = PushCoordinator(source, transport, MemoryProgress(), SOURCE_A)
+            .pushMutable(PushMutableTable.JOURNAL, "a")
+
+        assertTrue(result is PushResult.Rejected && !result.retryable)
+        assertTrue(transport.batches.isEmpty())
+    }
+
+    @Test
+    fun daoPreflightRejectionIsPermanentAndNeverStartsHttp() = runBlocking {
+        val source = FakePushSource().apply {
+            appendRowsFailure = PushProtocolException("snapshot exceeds local memory limit")
+        }
+        val transport = AckingTransport()
+
+        val result = PushCoordinator(source, transport, MemoryProgress(), SOURCE_A)
+            .pushAppend(PushAppendTable.EVENT, "a")
+
+        assertTrue(result is PushResult.Rejected && !result.retryable)
+        assertTrue(transport.batches.isEmpty())
+    }
+
+    @Test
+    fun mutableDaoProtocolRejectionIsPermanentAndNeverStartsHttp() = runBlocking {
+        val source = FakePushSource().apply {
+            mutableRowsFailure = PushProtocolException("snapshot exceeds local memory limit")
+        }
+        val transport = AckingTransport()
+
+        val result = PushCoordinator(source, transport, MemoryProgress(), SOURCE_A)
+            .pushMutable(PushMutableTable.JOURNAL, "a")
+
+        assertTrue(result is PushResult.Rejected && !result.retryable)
+        assertTrue(transport.batches.isEmpty())
+    }
+
+    @Test
+    fun boundedDeviceRotationGuaranteesLaterDeviceProgress() = runBlocking {
+        val source = FakePushSource(
+            append = mutableMapOf(
+                key(PushAppendTable.HR_SAMPLE, "a") to mutableListOf(hr(1, 100)),
+                key(PushAppendTable.HR_SAMPLE, "b") to mutableListOf(hr(2, 200)),
+            ),
+        )
+        val progress = MemoryProgress()
+        val firstTransport = AckingTransport()
+        val first = PushCoordinator(source, firstTransport, progress, SOURCE_A)
+            .pushKnownDevices(startDeviceIndex = 0, maxDevices = 1)
+
+        assertTrue(first.hasMoreDevices)
+        assertEquals(1, first.acceptedRecords)
+        assertEquals(1, first.nextDeviceIndex)
+        assertTrue(firstTransport.batches.isNotEmpty())
+        assertTrue(firstTransport.batches.all { it.deviceId == "a" })
+
+        val secondTransport = AckingTransport()
+        val second = PushCoordinator(source, secondTransport, progress, SOURCE_A)
+            .pushKnownDevices(startDeviceIndex = first.nextDeviceIndex, maxDevices = 1)
+
+        assertEquals(0, second.nextDeviceIndex)
+        assertTrue(secondTransport.batches.isNotEmpty())
+        assertTrue(secondTransport.batches.all { it.deviceId == "b" })
+    }
+
+    @Test
+    fun rememberedDeviceSendsEmptyReplacementAfterItsLastMutableRowIsDeleted() = runBlocking {
+        val source = FakePushSource(
+            mutable = mutableMapOf(
+                key(PushMutableTable.JOURNAL, "noop-journal") to mutableListOf(
+                    PushMutableRecord(
+                        linkedMapOf("day" to "2026-08-18", "question" to "caffeine"),
+                        linkedMapOf("answeredYes" to true, "notes" to null, "numericValue" to null),
+                    ),
+                ),
+            ),
+        )
+        val progress = MemoryProgress()
+        PushCoordinator(source, AckingTransport(), progress, SOURCE_A)
+            .pushKnownDevices()
+        source.mutable.remove(key(PushMutableTable.JOURNAL, "noop-journal"))
+
+        val afterDelete = AckingTransport()
+        PushCoordinator(source, afterDelete, progress, SOURCE_A)
+            .pushKnownDevices()
+
+        val journal = afterDelete.batches.single {
+            it.deviceId == "noop-journal" && it.table == PushMutableTable.JOURNAL
+        }
+        assertEquals(0, journal.recordCount)
+        assertEquals("replace_window", journal.mode)
+    }
+
+    @Test
+    fun capabilitiesPreventEveryUnsupportedStreamSnapshotAndPost() = runBlocking {
+        val source = FakePushSource(
+            append = mutableMapOf(key(PushAppendTable.HR_SAMPLE, "a") to mutableListOf(hr(1, 10))),
+            mutable = mutableMapOf(
+                key(PushMutableTable.JOURNAL, "a") to mutableListOf(
+                    PushMutableRecord(
+                        linkedMapOf("day" to "2026-08-18", "question" to "coffee"),
+                        linkedMapOf("answeredYes" to true, "notes" to null, "numericValue" to null),
+                    ),
+                ),
+            ),
+        )
+        val transport = AckingTransport()
+        val capabilities = PushCapabilities(
+            appendTables = emptySet(),
+            mutableTables = setOf(PushMutableTable.JOURNAL),
+        )
+
+        PushCoordinator(source, transport, MemoryProgress(), SOURCE_A)
+            .pushKnownDevices(capabilities = capabilities)
+
+        assertEquals(emptyList<PushAppendTable>(), source.appendTablesRead)
+        assertEquals(listOf(PushMutableTable.JOURNAL), source.mutableTablesRead)
+        assertEquals(capabilities, source.deviceDiscoveryCapabilities)
+        assertEquals(listOf("journal"), transport.batches.map { it.table.wireName })
+    }
+
+    @Test
+    fun emptyCapabilitiesAvoidEvenDeviceDiscovery() = runBlocking {
+        val source = FakePushSource().apply { knownDeviceIdsFailure = AssertionError("Room must stay unopened") }
+
+        val result = PushCoordinator(source, AckingTransport(), MemoryProgress(), SOURCE_A)
+            .pushKnownDevices(capabilities = PushCapabilities(emptySet(), emptySet()))
+
+        assertEquals(0, result.acceptedBatches)
+        assertEquals(0, result.rejectedBatches)
+    }
+
+    @Test
+    fun structuredTransportFailureSurvivesCoordinatorAggregation() = runBlocking {
+        val source = FakePushSource(
+            append = mutableMapOf(key(PushAppendTable.HR_SAMPLE, "a") to mutableListOf(hr(1, 10))),
+        )
+        val transport = object : PushTransport {
+            override suspend fun post(batch: PushBatch): PushTransportResponse {
+                throw PushTransportException(PushFailure(PushFailureCode.CONNECTION_REFUSED))
+            }
+        }
+
+        val result = PushCoordinator(source, transport, MemoryProgress(), SOURCE_A)
+            .pushKnownDevices(
+                capabilities = PushCapabilities(setOf(PushAppendTable.HR_SAMPLE), emptySet()),
+            )
+
+        assertTrue(result.hasRetryableFailure)
+        assertEquals(PushFailureCode.CONNECTION_REFUSED, result.failure?.code)
+    }
+
+    @Test
+    fun boundedReceiverErrorCodeSurvivesHttpRejection() = runBlocking {
+        val source = FakePushSource(
+            append = mutableMapOf(key(PushAppendTable.HR_SAMPLE, "a") to mutableListOf(hr(1, 10))),
+        )
+        val transport = object : PushTransport {
+            override suspend fun post(batch: PushBatch) = PushTransportResponse(
+                422,
+                """{"type":"error","protocolVersion":"1.0","code":"registry_mismatch","ignored":true}"""
+                    .toByteArray(),
+            )
+        }
+
+        val result = PushCoordinator(source, transport, MemoryProgress(), SOURCE_A)
+            .pushKnownDevices(capabilities = PushCapabilities(setOf(PushAppendTable.HR_SAMPLE), emptySet()))
+
+        assertEquals("registry_mismatch", result.failure?.receiverCode)
+        assertFalse(result.hasRetryableFailure)
+    }
+}
+
+internal fun key(table: PushTable, deviceId: String) = "${table.wireName}|$deviceId"
+
+internal fun hr(rowId: Long, ts: Long) = PushAppendRecord(
+    rowId,
+    linkedMapOf("ts" to ts),
+    linkedMapOf("bpm" to 60),
+)
+
+internal fun journal(day: String, question: String, notes: String? = null) = PushMutableRecord(
+    linkedMapOf("day" to day, "question" to question),
+    linkedMapOf("answeredYes" to true, "notes" to notes, "numericValue" to null),
+)
+
+internal fun sleep(startTs: Long, efficiency: Double) = PushMutableRecord(
+    linkedMapOf("startTs" to startTs),
+    linkedMapOf(
+        "endTs" to startTs + 8 * 60 * 60,
+        "efficiency" to efficiency,
+        "restingHr" to null,
+        "avgHrv" to null,
+        "stagesJSON" to null,
+        "userEdited" to false,
+        "startTsAdjusted" to null,
+        "motionJSON" to null,
+        "sleepStateJSON" to null,
+        "stagingSparse" to null,
+    ),
+)
+
+internal class FakePushSource(
+    val append: MutableMap<String, MutableList<PushAppendRecord>> = mutableMapOf(),
+    val mutable: MutableMap<String, MutableList<PushMutableRecord>> = mutableMapOf(),
+) : PushSnapshotSource {
+    val afterCursors = mutableListOf<Long>()
+    val appendTablesRead = mutableListOf<PushAppendTable>()
+    val mutableTablesRead = mutableListOf<PushMutableTable>()
+    var reading = false
+    var appendRowsFailure: Throwable? = null
+    var mutableRowsFailure: Throwable? = null
+    var knownDeviceIdsFailure: Throwable? = null
+    var deviceDiscoveryCapabilities: PushCapabilities? = null
+
+    override suspend fun knownDeviceIds(capabilities: PushCapabilities): List<String> {
+        deviceDiscoveryCapabilities = capabilities
+        knownDeviceIdsFailure?.let { throw it }
+        val supportedNames = capabilities.appendTables.map { it.wireName }.toSet() +
+            capabilities.mutableTables.map { it.wireName }
+        return (append.keys + mutable.keys)
+            .filter { it.substringBefore('|') in supportedNames }
+            .map { it.substringAfter('|') }
+            .distinct()
+            .sorted()
+    }
+
+    override suspend fun appendRecordAt(
+        table: PushAppendTable,
+        deviceId: String,
+        rowId: Long,
+    ): PushAppendRecord? = append[key(table, deviceId)]?.firstOrNull { it.rowId == rowId }
+
+    override suspend fun appendRows(
+        table: PushAppendTable,
+        deviceId: String,
+        afterRowId: Long,
+        limit: Int,
+    ): List<PushAppendRecord> {
+        appendTablesRead += table
+        appendRowsFailure?.let { throw it }
+        reading = true
+        return try {
+            afterCursors += afterRowId
+            append[key(table, deviceId)].orEmpty().filter { it.rowId > afterRowId }.take(limit)
+        } finally {
+            reading = false
+        }
+    }
+
+    override suspend fun mutableRows(
+        table: PushMutableTable,
+        deviceId: String,
+        window: PushWindow,
+        limit: Int,
+    ): List<PushMutableRecord> {
+        mutableTablesRead += table
+        mutableRowsFailure?.let { throw it }
+        return mutable[key(table, deviceId)].orEmpty().take(limit)
+    }
+}
+
+internal class MemoryProgress : PushProgressStore {
+    val devices = mutableSetOf<String>()
+    val cursors = mutableMapOf<String, PushCursor>()
+    val windows = mutableMapOf<String, PushWindowProgress>()
+
+    override suspend fun knownDeviceIds(): Set<String> = devices.toSet()
+    override suspend fun rememberDeviceId(deviceId: String) { devices += deviceId }
+
+    override suspend fun cursor(table: PushAppendTable, deviceId: String): PushCursor? = cursors[key(table, deviceId)]
+    override suspend fun saveCursor(table: PushAppendTable, deviceId: String, cursor: PushCursor) {
+        cursors[key(table, deviceId)] = cursor
+    }
+
+    override suspend fun window(table: PushMutableTable, deviceId: String): PushWindowProgress? =
+        windows[key(table, deviceId)]
+
+    override suspend fun saveWindow(table: PushMutableTable, deviceId: String, progress: PushWindowProgress) {
+        windows[key(table, deviceId)] = progress
+    }
+}
+
+internal class AckingTransport(
+    private val ack: (PushBatch) -> PushAck = { PushAck.fromBatch(it) },
+) : PushTransport {
+    val batches = mutableListOf<PushBatch>()
+    val bodies = mutableListOf<ByteArray>()
+
+    override suspend fun post(batch: PushBatch): PushTransportResponse {
+        batches += batch
+        bodies += batch.body.copyOf()
+        return PushTransportResponse(200, ack(batch).encode())
+    }
+}
diff --git a/android/app/src/test/java/com/noop/push/PushCursorTest.kt b/android/app/src/test/java/com/noop/push/PushCursorTest.kt
new file mode 100644
index 0000000000..7fbeb55721
--- /dev/null
+++ b/android/app/src/test/java/com/noop/push/PushCursorTest.kt
@@ -0,0 +1,120 @@
+package com.noop.push
+
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class PushCursorTest {
+    @Test
+    fun olderTimestampWithHigherRowidIsNotStranded() = runBlocking {
+        val old = hr(10, 200)
+        val lateBackfill = hr(11, 100)
+        val source = FakePushSource(append = mutableMapOf(key(PushAppendTable.HR_SAMPLE, "a") to mutableListOf(old, lateBackfill)))
+        val progress = MemoryProgress().apply {
+            cursors[key(PushAppendTable.HR_SAMPLE, "a")] = PushCursor(
+                10,
+                PushProtocol.keyFingerprint(PushAppendTable.HR_SAMPLE, "a", old.key),
+            )
+        }
+        val transport = AckingTransport()
+        val coordinator = PushCoordinator(source, transport, progress, SOURCE_A)
+
+        val result = coordinator.pushAppend(PushAppendTable.HR_SAMPLE, "a")
+
+        assertTrue(result is PushResult.Accepted)
+        assertTrue(transport.bodies.single().toString(Charsets.UTF_8).contains("\"ts\":100"))
+        assertEquals(
+            PushCursor(11, PushProtocol.keyFingerprint(PushAppendTable.HR_SAMPLE, "a", lateBackfill.key)),
+            progress.cursors[key(PushAppendTable.HR_SAMPLE, "a")],
+        )
+    }
+
+    @Test
+    fun fullNaturalKeyMismatchResetsEffectiveCursorBeforeReading() = runBlocking {
+        val first = hr(3, 50)
+        val currentAtCursor = hr(10, 200)
+        val source = FakePushSource(
+            append = mutableMapOf(key(PushAppendTable.HR_SAMPLE, "a") to mutableListOf(first, currentAtCursor)),
+        )
+        val progress = MemoryProgress().apply {
+            cursors[key(PushAppendTable.HR_SAMPLE, "a")] = PushCursor(10, "f".repeat(64))
+        }
+        val transport = AckingTransport()
+
+        PushCoordinator(source, transport, progress, SOURCE_A).pushAppend(PushAppendTable.HR_SAMPLE, "a")
+
+        assertEquals(0L, source.afterCursors.single())
+        assertTrue(transport.bodies.single().toString(Charsets.UTF_8).contains("\"ts\":50"))
+    }
+
+    @Test
+    fun rrRowsSharingTimestampRemainDistinctByFullPrimaryKey() {
+        val a = PushAppendRecord(
+            1,
+            linkedMapOf("ts" to 100L, "rrMs" to 900, "seq" to 0),
+            linkedMapOf("ord" to null, "srcChannel" to null, "tsSuspect" to null),
+        )
+        val b = PushAppendRecord(
+            2,
+            linkedMapOf("ts" to 100L, "rrMs" to 900, "seq" to 1),
+            linkedMapOf("ord" to null, "srcChannel" to null, "tsSuspect" to null),
+        )
+
+        assertNotEquals(
+            PushProtocol.keyFingerprint(PushAppendTable.RR_INTERVAL, "a", a.key),
+            PushProtocol.keyFingerprint(PushAppendTable.RR_INTERVAL, "a", b.key),
+        )
+        assertEquals(
+            "3e8a1018cb24f2dcabd66750250c479fe981222da25785cfc78a20d84f1217bb",
+            PushProtocol.keyFingerprint(PushAppendTable.RR_INTERVAL, "a", a.key),
+        )
+        assertEquals(
+            2,
+            PushProtocol.appendBatch(PushAppendTable.RR_INTERVAL, SOURCE_A, "a", null, listOf(a, b)).recordCount,
+        )
+    }
+
+    @Test
+    fun moreThanOnePageOfEqualTimestampRrRowsLosesNothing() = runBlocking {
+        val rows = (0..5_000).map { seq ->
+            PushAppendRecord(
+                rowId = seq + 1L,
+                key = linkedMapOf("ts" to 100L, "rrMs" to 900, "seq" to seq),
+                data = linkedMapOf("ord" to seq, "srcChannel" to null, "tsSuspect" to null),
+            )
+        }.toMutableList()
+        val source = FakePushSource(
+            append = mutableMapOf(key(PushAppendTable.RR_INTERVAL, "a") to rows),
+        )
+        val progress = MemoryProgress()
+        val transport = AckingTransport()
+        val coordinator = PushCoordinator(source, transport, progress, SOURCE_A)
+
+        val first = coordinator.pushAppend(PushAppendTable.RR_INTERVAL, "a")
+        val second = coordinator.pushAppend(PushAppendTable.RR_INTERVAL, "a")
+
+        assertTrue(first is PushResult.Accepted && first.recordCount == 5_000 && first.hasMore)
+        assertTrue(second is PushResult.Accepted && second.recordCount == 1 && !second.hasMore)
+        assertEquals(listOf(5_000, 1), transport.batches.map { it.recordCount })
+        assertEquals(5_001L, progress.cursors[key(PushAppendTable.RR_INTERVAL, "a")]?.rowId)
+    }
+
+    @Test
+    fun cursorProgressIsIsolatedPerDevice() = runBlocking {
+        val source = FakePushSource(
+            append = mutableMapOf(
+                key(PushAppendTable.HR_SAMPLE, "a") to mutableListOf(hr(1, 10)),
+                key(PushAppendTable.HR_SAMPLE, "b") to mutableListOf(hr(1, 20)),
+            ),
+        )
+        val progress = MemoryProgress()
+        val coordinator = PushCoordinator(source, AckingTransport(), progress, SOURCE_A)
+
+        coordinator.pushAppend(PushAppendTable.HR_SAMPLE, "a")
+
+        assertTrue(progress.cursors.containsKey(key(PushAppendTable.HR_SAMPLE, "a")))
+        assertTrue(!progress.cursors.containsKey(key(PushAppendTable.HR_SAMPLE, "b")))
+    }
+}
diff --git a/android/app/src/test/java/com/noop/push/PushDaoPreflightTest.kt b/android/app/src/test/java/com/noop/push/PushDaoPreflightTest.kt
new file mode 100644
index 0000000000..da0fc3825d
--- /dev/null
+++ b/android/app/src/test/java/com/noop/push/PushDaoPreflightTest.kt
@@ -0,0 +1,39 @@
+package com.noop.push
+
+import org.junit.Assert.assertTrue
+import org.junit.Assert.assertFalse
+import org.junit.Test
+
+class PushDaoPreflightTest {
+    @Test fun sqlEstimateUsesUtf8BlobLengthWorstCaseEscapingAndFixedRowOverhead() {
+        val expression = PushSnapshotPreflight.rowEstimateExpression(listOf("notes", "payloadJSON"))
+
+        assertTrue(expression.contains(PushSnapshotPreflight.FIXED_ROW_OVERHEAD_BYTES.toString()))
+        assertTrue(expression.contains("length(CAST(notes AS BLOB)) * 6"))
+        assertTrue(expression.contains("length(CAST(payloadJSON AS BLOB)) * 6"))
+        assertTrue(expression.contains("typeof(notes) = 'blob'"))
+    }
+
+    @Test fun preflightQueryBoundsTheExactOrderedLimitedSelection() {
+        val sql = PushSnapshotPreflight.query(
+            table = "event",
+            columns = listOf("ts", "kind", "payloadJSON"),
+            predicate = "deviceId = ? AND rowid > ?",
+            orderBy = "rowid ASC",
+        )
+
+        assertTrue(sql.contains("FROM (SELECT ts, kind, payloadJSON FROM event"))
+        assertTrue(sql.contains("WHERE deviceId = ? AND rowid > ? ORDER BY rowid ASC LIMIT ?)"))
+        assertTrue(sql.startsWith("SELECT COALESCE(SUM("))
+    }
+
+    @Test fun deviceDiscoveryTouchesOnlyAdvertisedWireTables() {
+        val sql = PushDeviceDiscovery.query(listOf("hrSample", "journal"))
+
+        assertTrue(sql.contains("FROM device"))
+        assertTrue(sql.contains("FROM hrSample"))
+        assertTrue(sql.contains("FROM journal"))
+        assertFalse(sql.contains("FROM rrInterval"))
+        assertFalse(sql.contains("FROM dailyMetric"))
+    }
+}
diff --git a/android/app/src/test/java/com/noop/push/PushEndpointPolicyTest.kt b/android/app/src/test/java/com/noop/push/PushEndpointPolicyTest.kt
new file mode 100644
index 0000000000..78bb4c34b5
--- /dev/null
+++ b/android/app/src/test/java/com/noop/push/PushEndpointPolicyTest.kt
@@ -0,0 +1,57 @@
+package com.noop.push
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class PushEndpointPolicyTest {
+    @Test fun httpsPublicEndpointIsAllowedAndNormalized() {
+        val valid = PushEndpointPolicy.validate(" HTTPS://Example.COM:443/push ") as PushEndpointPolicy.Result.Valid
+        assertEquals("https://example.com/push", valid.endpoint.url)
+        assertFalse(valid.endpoint.requiresLocalAddress)
+    }
+
+    @Test fun publicHttpIsRejectedBeforeAnyResolution() {
+        assertTrue(PushEndpointPolicy.validate("http://example.com/push") is PushEndpointPolicy.Result.Invalid)
+    }
+
+    @Test fun privateAndLoopbackIpv4HttpAreAllowed() {
+        listOf("10.1.2.3", "172.16.1.2", "172.31.255.2", "192.168.4.2", "127.0.0.1", "169.254.1.2").forEach {
+            assertTrue(it, PushEndpointPolicy.validate("http://$it:8080/push") is PushEndpointPolicy.Result.Valid)
+        }
+    }
+
+    @Test fun publicAndNearBoundaryIpv4HttpAreRejected() {
+        listOf("8.8.8.8", "172.15.255.255", "172.32.0.1", "192.169.1.1").forEach {
+            assertTrue(it, PushEndpointPolicy.validate("http://$it/push") is PushEndpointPolicy.Result.Invalid)
+        }
+    }
+
+    @Test fun ipv6UlaLinkLocalAndLoopbackHttpAreAllowed() {
+        listOf("[fc00::1]", "[fd12::1]", "[fe80::1]", "[::1]").forEach {
+            assertTrue(it, PushEndpointPolicy.validate("http://$it/push") is PushEndpointPolicy.Result.Valid)
+        }
+    }
+
+    @Test fun publicIpv6HttpIsRejected() {
+        listOf("[2001:4860:4860::8888]", "[fec0::1]", "[::]").forEach {
+            assertTrue(it, PushEndpointPolicy.validate("http://$it/") is PushEndpointPolicy.Result.Invalid)
+        }
+    }
+
+    @Test fun cleartextHostnamesAreRejectedToRemoveDnsRebindingAndPreResolution() {
+        listOf("localhost", "receiver.local", "private.example").forEach {
+            assertTrue(PushEndpointPolicy.validate("http://$it/push") is PushEndpointPolicy.Result.Invalid)
+        }
+    }
+
+    @Test fun unsafeUrlShapesAreRejected() {
+        listOf(
+            "ftp://192.168.1.2/push",
+            "http://user:pass@192.168.1.2/push",
+            "http://192.168.1.2/push#secret",
+            "not a url",
+        ).forEach { assertTrue(it, PushEndpointPolicy.validate(it) is PushEndpointPolicy.Result.Invalid) }
+    }
+}
diff --git a/android/app/src/test/java/com/noop/push/PushHttpTransportPolicyTest.kt b/android/app/src/test/java/com/noop/push/PushHttpTransportPolicyTest.kt
new file mode 100644
index 0000000000..a40c9ae17c
--- /dev/null
+++ b/android/app/src/test/java/com/noop/push/PushHttpTransportPolicyTest.kt
@@ -0,0 +1,289 @@
+package com.noop.push
+
+import java.net.UnknownHostException
+import kotlinx.coroutines.runBlocking
+import okhttp3.OkHttpClient
+import okhttp3.Protocol
+import okhttp3.Response
+import okhttp3.ResponseBody.Companion.toResponseBody
+import okio.Buffer
+import okio.GzipSource
+import okio.buffer
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class PushHttpTransportPolicyTest {
+    @Test fun capabilityDnsFailureReturnsStructuredSafeDiagnostic() = runBlocking {
+        val client = OkHttpClient.Builder()
+            .addInterceptor { throw UnknownHostException("canary-secret.example") }
+            .build()
+        val endpoint = (PushEndpointPolicy.validate("https://receiver.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+
+        val result = PushHttpTransport(endpoint, "bearer-canary", client).capabilities()
+
+        assertTrue(result is PushCapabilitiesResult.Rejected)
+        val rejected = result as PushCapabilitiesResult.Rejected
+        assertEquals(PushFailureCode.DNS_LOOKUP, rejected.failure?.code)
+        assertFalse(rejected.reason.contains("canary", ignoreCase = true))
+        assertFalse(rejected.reason.contains("receiver.example", ignoreCase = true))
+    }
+
+    @Test fun explicitConnectionTestIsGatedByNetworkPolicyBeforeAnyTransportIsCreated() {
+        assertFalse(canStartPushConnectionTest(networkAvailable = false, endpointValid = true, tokenAvailable = true))
+        assertFalse(canStartPushConnectionTest(networkAvailable = true, endpointValid = false, tokenAvailable = true))
+        assertFalse(canStartPushConnectionTest(networkAvailable = true, endpointValid = true, tokenAvailable = false))
+        assertTrue(canStartPushConnectionTest(networkAvailable = true, endpointValid = true, tokenAvailable = true))
+    }
+
+    @Test fun explicitConnectionTestOnlyReadsCapabilitiesAndNeverPostsHealthData() = runBlocking {
+        var capabilityCalls = 0
+        var postCalls = 0
+        val expected = PushCapabilitiesResult.Available(
+            PushCapabilities(setOf(PushAppendTable.HR_SAMPLE), emptySet()),
+        )
+        val endpoint = (PushEndpointPolicy.validate("https://receiver.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+        val tester = PushConnectionTester { capturedEndpoint, capturedToken ->
+            assertEquals(endpoint, capturedEndpoint)
+            assertEquals("secret", capturedToken)
+            object : PushTransport {
+                override suspend fun capabilities(): PushCapabilitiesResult {
+                    capabilityCalls++
+                    return expected
+                }
+
+                override suspend fun post(batch: PushBatch): PushTransportResponse {
+                    postCalls++
+                    error("connection test must not POST")
+                }
+            }
+        }
+
+        assertEquals(expected, tester.test(endpoint, "secret"))
+        assertEquals(1, capabilityCalls)
+        assertEquals(0, postCalls)
+    }
+
+    @Test fun authenticatedCapabilitiesStrictlyNarrowTheFixedV1Registry() = runBlocking {
+        var method = ""
+        var authorization: String? = null
+        var acceptedVersions: String? = null
+        val client = OkHttpClient.Builder().addInterceptor { chain ->
+            method = chain.request().method
+            authorization = chain.request().header("Authorization")
+            acceptedVersions = chain.request().header("NOOP-Push-Accept-Version")
+            Response.Builder()
+                .request(chain.request())
+                .protocol(Protocol.HTTP_1_1)
+                .code(200)
+                .message("ok")
+                .body(
+                    """{"type":"capabilities","protocolVersion":"1.0","receiverStateId":"00000000-0000-4000-8000-000000000099","streams":["hrSample","journal"],"futureOptional":true}"""
+                        .toResponseBody(),
+                )
+                .build()
+        }.build()
+        val endpoint = (PushEndpointPolicy.validate("https://receiver.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+
+        val result = PushHttpTransport(endpoint, "secret", client).capabilities()
+
+        assertEquals("GET", method)
+        assertEquals("Bearer secret", authorization)
+        assertEquals("1.0", acceptedVersions)
+        assertEquals(
+            PushCapabilitiesResult.Available(
+                PushCapabilities(
+                    appendTables = setOf(PushAppendTable.HR_SAMPLE),
+                    mutableTables = setOf(PushMutableTable.JOURNAL),
+                    receiverStateId = "00000000-0000-4000-8000-000000000099",
+                ),
+            ),
+            result,
+        )
+    }
+
+    @Test fun receiverWithoutCapabilitiesFailsClosedBeforeHealthDataIsSent() = runBlocking {
+        val client = OkHttpClient.Builder().addInterceptor { chain ->
+            Response.Builder().request(chain.request()).protocol(Protocol.HTTP_1_1)
+                .code(405).message("legacy").body(ByteArray(0).toResponseBody()).build()
+        }.build()
+        val endpoint = (PushEndpointPolicy.validate("https://receiver.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+
+        val result = PushHttpTransport(endpoint, "secret", client).capabilities()
+
+        assertTrue(result is PushCapabilitiesResult.Rejected)
+        assertEquals(PushFailureCode.HTTP_CLIENT, (result as PushCapabilitiesResult.Rejected).failure?.code)
+    }
+
+    @Test fun malformedOrExpandingCapabilitiesFailClosed() = runBlocking {
+        val bodies = listOf(
+            """{"type":"capabilities","protocolVersion":"1.0","streams":["hrSample"]}""",
+            """{"type":"capabilities","protocolVersion":"1.0","receiverStateId":"00000000-0000-4000-8000-000000000099","streams":["unknown"]}""",
+            """{"type":"capabilities","protocolVersion":"1.0","receiverStateId":"00000000-0000-4000-8000-000000000099","streams":["hrSample","hrSample"]}""",
+            """{"type":"capabilities","protocolVersion":"1.0","receiverStateId":"00000000-0000-4000-8000-000000000099","streams":"hrSample"}""",
+        )
+        val endpoint = (PushEndpointPolicy.validate("https://receiver.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+        for (body in bodies) {
+            val client = OkHttpClient.Builder().addInterceptor { chain ->
+                Response.Builder().request(chain.request()).protocol(Protocol.HTTP_1_1)
+                    .code(200).message("ok").body(body.toResponseBody()).build()
+            }.build()
+            val result = PushHttpTransport(endpoint, "secret", client).capabilities()
+            assertTrue(result is PushCapabilitiesResult.Rejected && !result.retryable)
+        }
+    }
+
+    @Test fun capabilityFailuresUseTheSameBoundedRetryPolicyAsBatchDelivery() = runBlocking {
+        val endpoint = (PushEndpointPolicy.validate("https://receiver.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+        for ((status, expectedRetryable) in listOf(401 to false, 408 to true, 429 to true, 500 to true)) {
+            val client = OkHttpClient.Builder().addInterceptor { chain ->
+                Response.Builder().request(chain.request()).protocol(Protocol.HTTP_1_1)
+                    .code(status).message("response").body(ByteArray(0).toResponseBody()).build()
+            }.build()
+
+            val result = PushHttpTransport(endpoint, "secret", client).capabilities()
+
+            assertTrue(result is PushCapabilitiesResult.Rejected)
+            assertEquals(expectedRetryable, (result as PushCapabilitiesResult.Rejected).retryable)
+        }
+    }
+
+    @Test fun gzipEncodingIsDeterministicAndBounded() {
+        val decoded = ByteArray(PushProtocol.MAX_BODY_BYTES) { index -> (index * 31).toByte() }
+
+        val first = PushHttpTransport.gzip(decoded)
+        val retry = PushHttpTransport.gzip(decoded)
+
+        assertTrue(first.size <= PushProtocol.MAX_WIRE_BODY_BYTES)
+        assertTrue(first.contentEquals(retry))
+    }
+
+    @Test fun redirectsAreDisabledInBothDirections() {
+        val client = PushHttpTransport.defaultClient()
+        assertFalse(client.followRedirects)
+        assertFalse(client.followSslRedirects)
+    }
+
+    @Test fun definitiveUnsupportedMediaTypeRetriesSameEntityOnceAsIdentity() = runBlocking {
+        val encodings = mutableListOf<String?>()
+        val decodedBodies = mutableListOf<ByteArray>()
+        val client = OkHttpClient.Builder().addInterceptor { chain ->
+            val encoding = chain.request().header("Content-Encoding")
+            encodings += encoding
+            val wire = Buffer().also { chain.request().body!!.writeTo(it) }
+            decodedBodies += if (encoding == "gzip") {
+                GzipSource(wire).buffer().use { it.readByteArray() }
+            } else {
+                wire.readByteArray()
+            }
+            Response.Builder()
+                .request(chain.request())
+                .protocol(Protocol.HTTP_1_1)
+                .code(if (encoding == "gzip") 415 else 200)
+                .message("response")
+                .body(ByteArray(0).toResponseBody())
+                .build()
+        }.build()
+        val endpoint = (PushEndpointPolicy.validate("https://receiver.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+
+        val response = PushHttpTransport(endpoint, "secret", client).post(batch())
+
+        assertEquals(200, response.statusCode)
+        assertEquals(listOf("gzip", null), encodings)
+        assertEquals(2, decodedBodies.size)
+        assertTrue(decodedBodies[0].contentEquals(decodedBodies[1]))
+    }
+
+    @Test fun fallbackIsNotUsedForTransientErrors() = runBlocking {
+        var calls = 0
+        val client = OkHttpClient.Builder().addInterceptor { chain ->
+            calls++
+            Response.Builder()
+                .request(chain.request())
+                .protocol(Protocol.HTTP_1_1)
+                .code(500)
+                .message("error")
+                .body(ByteArray(0).toResponseBody())
+                .build()
+        }.build()
+        val endpoint = (PushEndpointPolicy.validate("https://receiver.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+
+        val response = PushHttpTransport(endpoint, "secret", client).post(batch())
+
+        assertEquals(500, response.statusCode)
+        assertEquals(1, calls)
+    }
+
+    @Test fun redirectIsReturnedWithoutFollowingAndAuthorizationIsHeaderOnly() = runBlocking {
+        var calls = 0
+        var authorization: String? = null
+        var contentEncoding: String? = null
+        var contentType: String? = null
+        var contentLength: Long? = null
+        var sentBody = ""
+        val client = OkHttpClient.Builder().addInterceptor { chain ->
+            calls++
+            authorization = chain.request().header("Authorization")
+            contentEncoding = chain.request().header("Content-Encoding")
+            contentType = chain.request().body!!.contentType().toString()
+            contentLength = chain.request().body!!.contentLength()
+            sentBody = chain.request().body!!.let { body ->
+                val buffer = Buffer()
+                body.writeTo(buffer)
+                GzipSource(buffer).buffer().use { it.readUtf8() }
+            }
+            Response.Builder()
+                .request(chain.request())
+                .protocol(Protocol.HTTP_1_1)
+                .code(307)
+                .message("redirect")
+                .header("Location", "https://elsewhere.example/steal")
+                .body(ByteArray(0).toResponseBody())
+                .build()
+        }.build()
+        val endpoint = (PushEndpointPolicy.validate("https://receiver.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+        val response = PushHttpTransport(endpoint, "top-secret", client).post(batch())
+
+        assertEquals(307, response.statusCode)
+        assertEquals(1, calls)
+        assertEquals("Bearer top-secret", authorization)
+        assertEquals("gzip", contentEncoding)
+        assertEquals("application/x-ndjson; charset=utf-8", contentType)
+        assertTrue(contentLength!! > 0L)
+        assertEquals("{}\n", sentBody)
+        assertFalse(sentBody.contains("top-secret"))
+    }
+
+    @Test fun responseReadIsBoundedForAckAndErrorBodies() = runBlocking {
+        val oversized = ByteArray(PushProtocol.MAX_ACK_BYTES + 500) { 'x'.code.toByte() }
+        val client = OkHttpClient.Builder().addInterceptor { chain ->
+            Response.Builder()
+                .request(chain.request())
+                .protocol(Protocol.HTTP_1_1)
+                .code(500)
+                .message("error")
+                .body(oversized.toResponseBody())
+                .build()
+        }.build()
+        val endpoint = (PushEndpointPolicy.validate("https://receiver.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+        val response = PushHttpTransport(endpoint, "secret", client).post(batch())
+
+        assertEquals(PushProtocol.MAX_ACK_BYTES + 1, response.body.size)
+        assertTrue(response.body.size < oversized.size)
+    }
+
+    private fun batch() = PushBatch(
+        protocolVersion = PushProtocol.VERSION,
+        batchId = "00000000-0000-4000-8000-000000000001",
+        sourceId = "00000000-0000-4000-8000-000000000002",
+        table = PushAppendTable.HR_SAMPLE,
+        deviceId = "strap",
+        mode = "append",
+        startCursor = null,
+        endCursor = null,
+        recordCount = 0,
+        window = null,
+        body = "{}\n".toByteArray(),
+    )
+}
diff --git a/android/app/src/test/java/com/noop/push/PushProtocolTest.kt b/android/app/src/test/java/com/noop/push/PushProtocolTest.kt
new file mode 100644
index 0000000000..f882f1a715
--- /dev/null
+++ b/android/app/src/test/java/com/noop/push/PushProtocolTest.kt
@@ -0,0 +1,196 @@
+package com.noop.push
+
+import org.json.JSONObject
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class PushProtocolTest {
+    @Test fun acknowledgementIgnoresUnknownOptionalMembersWithinTheNegotiatedMajor() {
+        val batch = PushProtocol.appendBatch(
+            PushAppendTable.HR_SAMPLE,
+            SOURCE_A,
+            "strap",
+            null,
+            listOf(hr(1, 10)),
+        )
+        val encoded = PushAck.fromBatch(batch).encode().toString(Charsets.UTF_8)
+        val extended = encoded.dropLast(1) + ",\"futureOptional\":true}"
+
+        assertTrue(PushAck.parse(extended.toByteArray()).exactlyMatches(batch))
+    }
+
+    @Test
+    fun appendRegistryIsExactlyTheEightDocumentedStreams() {
+        assertEquals(
+            listOf(
+                "hrSample", "rrInterval", "event", "battery", "spo2Sample", "skinTempSample",
+                "respSample", "gravitySample",
+            ),
+            PushAppendTable.entries.map { it.wireName },
+        )
+    }
+
+    @Test
+    fun appendWireShapeIsExactDeterministicAndExcludesScopedAndLocalColumns() {
+        val rows = listOf(hrRecord(41, 200, 61), hrRecord(42, 201, 62))
+
+        val first = PushProtocol.appendBatch(PushAppendTable.HR_SAMPLE, SOURCE_A, "strap-a", null, rows)
+        val retry = PushProtocol.appendBatch(PushAppendTable.HR_SAMPLE, SOURCE_A, "strap-a", null, rows)
+
+        assertArrayEquals(first.body, retry.body)
+        assertEquals(first.batchId, retry.batchId)
+        assertTrue(first.batchId.matches(UUID_PATTERN))
+        assertEquals(42L, first.endCursor?.rowId)
+        val lines = first.body.toString(Charsets.UTF_8).trimEnd().lines()
+        val header = JSONObject(lines[0])
+        assertEquals(
+            setOf(
+                "type", "protocolVersion", "batchId", "sourceId", "deviceId", "stream", "delivery",
+                "recordCount", "startCursor", "endCursor",
+            ),
+            header.keys().asSequence().toSet(),
+        )
+        assertEquals("batch", header.getString("type"))
+        assertEquals("1.0", header.getString("protocolVersion"))
+        assertEquals(SOURCE_A, header.getString("sourceId"))
+        assertEquals("hrSample", header.getString("stream"))
+        assertEquals("append", header.getString("delivery"))
+        assertTrue(header.isNull("startCursor"))
+        assertTrue(header.getJSONObject("endCursor").getString("keySha256").matches(Regex("[0-9a-f]{64}")))
+        val record = JSONObject(lines[1])
+        assertEquals(setOf("type", "key", "data"), record.keys().asSequence().toSet())
+        assertEquals(setOf("ts"), record.getJSONObject("key").keys().asSequence().toSet())
+        assertEquals(setOf("bpm"), record.getJSONObject("data").keys().asSequence().toSet())
+        assertFalse(first.body.toString(Charsets.UTF_8).contains("synced"))
+    }
+
+    @Test
+    fun sourceIdScopesStableBatchIdentity() {
+        val rows = listOf(hrRecord(1, 100, 60))
+
+        val a = PushProtocol.appendBatch(PushAppendTable.HR_SAMPLE, SOURCE_A, "same-device", null, rows)
+        val b = PushProtocol.appendBatch(PushAppendTable.HR_SAMPLE, SOURCE_B, "same-device", null, rows)
+
+        assertNotEquals(a.batchId, b.batchId)
+        assertNotEquals(a.body.toList(), b.body.toList())
+    }
+
+    @Test
+    fun appendBatchCapsRowsAtFiveThousand() {
+        val rows = (1L..5_001L).map { hrRecord(it, it, 60) }
+
+        val batch = PushProtocol.appendBatch(PushAppendTable.HR_SAMPLE, SOURCE_A, "strap-a", null, rows)
+
+        assertEquals(PushProtocol.MAX_RECORDS, batch.recordCount)
+        assertEquals(5_000L, batch.endCursor?.rowId)
+        assertTrue(batch.body.size <= PushProtocol.MAX_BODY_BYTES)
+    }
+
+    @Test
+    fun appendBatchStopsBeforeFourMiBDecodedNdjsonLimit() {
+        val rows = (1L..5_000L).map { rowId ->
+            PushAppendRecord(
+                rowId = rowId,
+                key = linkedMapOf("ts" to rowId, "kind" to "large"),
+                data = linkedMapOf("payloadJSON" to "x".repeat(1_000)),
+            )
+        }
+
+        val batch = PushProtocol.appendBatch(PushAppendTable.EVENT, SOURCE_A, "strap-a", null, rows)
+
+        assertTrue(batch.recordCount < PushProtocol.MAX_RECORDS)
+        assertTrue(batch.body.size <= 4 * 1024 * 1024)
+        assertTrue(batch.body.size > 4 * 1024 * 1024 - 2_000)
+    }
+
+    @Test(expected = PushProtocolException::class)
+    fun aSingleOversizedRecordIsRejectedWithoutAdvancing() {
+        val row = PushAppendRecord(
+            rowId = 1,
+            key = linkedMapOf("ts" to 1L, "kind" to "huge"),
+            data = linkedMapOf("payloadJSON" to "x".repeat(PushProtocol.MAX_BODY_BYTES)),
+        )
+
+        PushProtocol.appendBatch(PushAppendTable.EVENT, SOURCE_A, "strap-a", null, listOf(row))
+    }
+
+    @Test
+    fun mutableEmptySnapshotIsAuthoritativeAndUsesDocumentedWindow() {
+        val window = testWindow()
+
+        val batch = PushProtocol.mutableBatch(PushMutableTable.JOURNAL, SOURCE_A, "device-a", window, emptyList())
+
+        assertEquals(0, batch.recordCount)
+        assertNull(batch.endCursor)
+        val header = JSONObject(batch.body.toString(Charsets.UTF_8).trim())
+        assertEquals("replace_window", header.getString("delivery"))
+        val wireWindow = header.getJSONObject("window")
+        assertEquals("day", wireWindow.getString("selector"))
+        assertEquals("2026-08-05", wireWindow.getString("startInclusive"))
+        assertEquals("2026-08-19", wireWindow.getString("endExclusive"))
+        assertEquals(1, wireWindow.getInt("part"))
+        assertEquals(1, wireWindow.getInt("parts"))
+    }
+
+    @Test
+    fun mutableSnapshotIsDeterministicallySplitIntoBoundedParts() {
+        val records = (1..5_001).map { index ->
+            PushMutableRecord(
+                linkedMapOf("day" to "2026-08-${(index % 14 + 5).toString().padStart(2, '0')}", "question" to "q$index"),
+                linkedMapOf("answeredYes" to true, "notes" to null, "numericValue" to null),
+            )
+        }.sortedWith(compareBy({ it.key["day"] as String }, { it.key["question"] as String }))
+
+        val first = PushProtocol.mutableBatches(PushMutableTable.JOURNAL, SOURCE_A, "device-a", testWindow(), records)
+        val retry = PushProtocol.mutableBatches(PushMutableTable.JOURNAL, SOURCE_A, "device-a", testWindow(), records)
+
+        assertEquals(2, first.size)
+        assertTrue(first.all { it.recordCount <= PushProtocol.MAX_RECORDS && it.body.size <= PushProtocol.MAX_BODY_BYTES })
+        assertEquals(first.map { it.batchId }, retry.map { it.batchId })
+        assertEquals(1, first[0].part)
+        assertEquals(2, first[1].part)
+        assertEquals(first[0].replacementId, first[1].replacementId)
+    }
+
+    @Test
+    fun mutableDayHashIsCanonicalAndDistinguishesChangesFromEmpty() {
+        val first = journalRecord("2026-08-18", "coffee", "one")
+        val same = journalRecord("2026-08-18", "coffee", "one")
+        val changed = journalRecord("2026-08-18", "coffee", "two")
+
+        assertEquals(
+            PushProtocol.mutableSnapshotHash(PushMutableTable.JOURNAL, listOf(first)),
+            PushProtocol.mutableSnapshotHash(PushMutableTable.JOURNAL, listOf(same)),
+        )
+        assertNotEquals(
+            PushProtocol.mutableSnapshotHash(PushMutableTable.JOURNAL, listOf(first)),
+            PushProtocol.mutableSnapshotHash(PushMutableTable.JOURNAL, listOf(changed)),
+        )
+        assertNotEquals(
+            PushProtocol.mutableSnapshotHash(PushMutableTable.JOURNAL, listOf(first)),
+            PushProtocol.mutableSnapshotHash(PushMutableTable.JOURNAL, emptyList()),
+        )
+    }
+
+    private fun testWindow() = PushWindow("2026-08-05", "2026-08-18", 1_754_348_400L, 1_755_558_000L)
+}
+
+internal const val SOURCE_A = "3a3486dd-5030-4e17-a00d-a781399890f9"
+internal const val SOURCE_B = "4b4597ee-6141-4f28-b11e-b8924a9a9010"
+private val UUID_PATTERN = Regex("[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}")
+
+internal fun hrRecord(rowId: Long, ts: Long, bpm: Int = 60) = PushAppendRecord(
+    rowId,
+    linkedMapOf("ts" to ts),
+    linkedMapOf("bpm" to bpm),
+)
+
+private fun journalRecord(day: String, question: String, notes: String?) = PushMutableRecord(
+    linkedMapOf("day" to day, "question" to question),
+    linkedMapOf("answeredYes" to true, "notes" to notes, "numericValue" to null),
+)
diff --git a/android/app/src/test/java/com/noop/push/PushRunSignalTest.kt b/android/app/src/test/java/com/noop/push/PushRunSignalTest.kt
new file mode 100644
index 0000000000..45967c23c9
--- /dev/null
+++ b/android/app/src/test/java/com/noop/push/PushRunSignalTest.kt
@@ -0,0 +1,78 @@
+package com.noop.push
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class PushRunSignalTest {
+    @Test fun ownerCoalescesRunningAndBackoffTriggersAndLateFinishCannotClearSuccessor() {
+        val prefs = SelfHostedPushSettingsTest.FakePushPrefs()
+
+        assertTrue(PushRunSignal.reserve(prefs, "a"))
+        PushRunSignal.begin(prefs, "a")
+        assertFalse(PushRunSignal.reserve(prefs, "b"))
+        assertTrue(PushRunSignal.finish(prefs, "a", willRetry = false))
+
+        // A successful owner is released; its caller can enqueue a fresh, non-backoff continuation.
+        assertTrue(PushRunSignal.reserve(prefs, "b"))
+        assertFalse(PushRunSignal.finish(prefs, "a", willRetry = false))
+        assertFalse(PushRunSignal.reserve(prefs, "c"))
+
+        PushRunSignal.begin(prefs, "b")
+        assertTrue(PushRunSignal.finish(prefs, "b", willRetry = true))
+        assertFalse(PushRunSignal.reserve(prefs, "must-coalesce"))
+    }
+
+    @Test fun abandonedPreEnqueueReservationExpiresButBackoffOwnerDoesNot() {
+        val prefs = SelfHostedPushSettingsTest.FakePushPrefs()
+        assertTrue(PushRunSignal.reserve(prefs, "abandoned", now = 1_000L))
+        assertFalse(PushRunSignal.reserve(prefs, "too-soon", now = 120_999L))
+        assertTrue(PushRunSignal.reserve(prefs, "replacement", now = 121_000L))
+
+        PushRunSignal.begin(prefs, "replacement")
+        PushRunSignal.finish(prefs, "replacement", willRetry = true)
+        assertFalse(PushRunSignal.reserve(prefs, "must-coalesce", now = Long.MAX_VALUE))
+    }
+
+    @Test fun settlementSeesPendingBeforeStatusAndReleasesOwnerAfterStatus() {
+        val prefs = SelfHostedPushSettingsTest.FakePushPrefs()
+        assertTrue(PushRunSignal.reserve(prefs, "worker"))
+        PushRunSignal.begin(prefs, "worker")
+        assertFalse(PushRunSignal.reserve(prefs, "offload"))
+        var statusSawPending: Boolean? = null
+
+        val settlement = PushRunSignal.settle(prefs, "worker", willRetry = false) { pending ->
+            statusSawPending = pending
+        }
+
+        assertTrue(settlement.owned)
+        assertTrue(settlement.pending)
+        assertTrue(statusSawPending == true)
+        assertTrue(PushRunSignal.reserve(prefs, "successor"))
+    }
+
+    @Test fun failedReservationReleaseReportsCoalescedPendingExactlyOnce() {
+        val prefs = SelfHostedPushSettingsTest.FakePushPrefs()
+        assertTrue(PushRunSignal.reserve(prefs, "enqueue"))
+        assertFalse(PushRunSignal.reserve(prefs, "trigger"))
+
+        assertTrue(PushRunSignal.releaseReservation(prefs, "enqueue"))
+        assertFalse(PushRunSignal.releaseReservation(prefs, "enqueue"))
+        assertTrue(PushRunSignal.reserve(prefs, "retry"))
+    }
+
+    @Test fun asyncEnqueueFailureArbitratesStatusBeforeReleaseAndPreservesPendingForRequeue() {
+        val prefs = SelfHostedPushSettingsTest.FakePushPrefs()
+        assertTrue(PushRunSignal.reserve(prefs, "failed-enqueue"))
+        assertFalse(PushRunSignal.reserve(prefs, "coalesced-trigger"))
+        var failureWritten = false
+
+        val pending = PushRunSignal.releaseReservation(prefs, "failed-enqueue") {
+            if (!it) failureWritten = true
+        }
+
+        assertTrue(pending)
+        assertFalse(failureWritten)
+        assertTrue(PushRunSignal.reserve(prefs, "requeued-owner"))
+    }
+}
diff --git a/android/app/src/test/java/com/noop/push/PushTransportFailureTest.kt b/android/app/src/test/java/com/noop/push/PushTransportFailureTest.kt
new file mode 100644
index 0000000000..98dc9248a6
--- /dev/null
+++ b/android/app/src/test/java/com/noop/push/PushTransportFailureTest.kt
@@ -0,0 +1,53 @@
+package com.noop.push
+
+import java.io.IOException
+import java.net.ConnectException
+import java.net.NoRouteToHostException
+import java.net.SocketException
+import java.net.SocketTimeoutException
+import java.net.UnknownHostException
+import javax.net.ssl.SSLHandshakeException
+import javax.net.ssl.SSLPeerUnverifiedException
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Test
+
+class PushTransportFailureTest {
+    @Test fun networkExceptionsMapToActionableSanitizedCategories() {
+        val cases = listOf(
+            UnknownHostException("secret.example") to PushFailureCode.DNS_LOOKUP,
+            SSLPeerUnverifiedException("certificate for secret.example") to PushFailureCode.TLS_CERTIFICATE,
+            SSLHandshakeException("handshake with secret.example") to PushFailureCode.TLS_HANDSHAKE,
+            SocketTimeoutException("timeout at secret.example") to PushFailureCode.NETWORK_TIMEOUT,
+            ConnectException("Connection refused: secret.example") to PushFailureCode.CONNECTION_REFUSED,
+            NoRouteToHostException("secret.example") to PushFailureCode.NETWORK_UNREACHABLE,
+            SocketException("Connection reset by secret.example") to PushFailureCode.CONNECTION_RESET,
+            IOException("Bearer canary-secret") to PushFailureCode.NETWORK_IO,
+        )
+
+        for ((throwable, expected) in cases) {
+            val failure = classifyPushTransportFailure(throwable)
+            assertEquals(expected, failure.code)
+            assertFalse(failure.safeCode.contains("secret", ignoreCase = true))
+            assertFalse(failure.safeCode.contains("example", ignoreCase = true))
+        }
+    }
+
+    @Test fun httpStatusesMapWithoutIncludingBodiesOrEndpoints() {
+        val cases = mapOf(
+            401 to PushFailureCode.HTTP_AUTH,
+            404 to PushFailureCode.HTTP_NOT_FOUND,
+            408 to PushFailureCode.HTTP_TIMEOUT,
+            413 to PushFailureCode.HTTP_TOO_LARGE,
+            415 to PushFailureCode.HTTP_MEDIA_TYPE,
+            422 to PushFailureCode.HTTP_PROTOCOL_REJECTED,
+            429 to PushFailureCode.HTTP_RATE_LIMIT,
+            503 to PushFailureCode.HTTP_SERVER,
+        )
+        for ((status, expected) in cases) {
+            val failure = PushFailure.http(status)
+            assertEquals(expected, failure.code)
+            assertEquals(status, failure.httpStatus)
+        }
+    }
+}
diff --git a/android/app/src/test/java/com/noop/push/PushWorkerGateTest.kt b/android/app/src/test/java/com/noop/push/PushWorkerGateTest.kt
new file mode 100644
index 0000000000..9cc86f81b0
--- /dev/null
+++ b/android/app/src/test/java/com/noop/push/PushWorkerGateTest.kt
@@ -0,0 +1,42 @@
+package com.noop.push
+
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class PushWorkerGateTest {
+    @Test fun staleDisabledWorkReturnsWithoutNetworkTokenDatabaseOrHttp() = runBlocking {
+        var networkCalls = 0
+        var tokenCalls = 0
+        var executeCalls = 0
+
+        val outcome = PushWorkerGate.run(
+            enabledEndpoint = { null },
+            networkAvailable = { networkCalls++; true },
+            token = { tokenCalls++; "secret" },
+            execute = { _, _ -> executeCalls++; false },
+        )
+
+        assertEquals(PushWorkerGate.Outcome.DisabledOrInvalid, outcome)
+        assertEquals(0, networkCalls)
+        assertEquals(0, tokenCalls)
+        assertEquals(0, executeCalls)
+    }
+
+    @Test fun disallowedNetworkStopsBeforeKeystoreDatabaseAndHttp() = runBlocking {
+        val endpoint = (PushEndpointPolicy.validate("https://example.com/") as PushEndpointPolicy.Result.Valid).endpoint
+        var tokenCalls = 0
+        var executeCalls = 0
+
+        val outcome = PushWorkerGate.run(
+            enabledEndpoint = { endpoint },
+            networkAvailable = { false },
+            token = { tokenCalls++; "secret" },
+            execute = { _, _ -> executeCalls++; false },
+        )
+
+        assertEquals(PushWorkerGate.Outcome.NetworkUnavailable, outcome)
+        assertEquals(0, tokenCalls)
+        assertEquals(0, executeCalls)
+    }
+}
diff --git a/android/app/src/test/java/com/noop/push/SelfHostedPushSchedulerTest.kt b/android/app/src/test/java/com/noop/push/SelfHostedPushSchedulerTest.kt
new file mode 100644
index 0000000000..1c0fcaeb99
--- /dev/null
+++ b/android/app/src/test/java/com/noop/push/SelfHostedPushSchedulerTest.kt
@@ -0,0 +1,50 @@
+package com.noop.push
+
+import androidx.work.ExistingWorkPolicy
+import androidx.work.NetworkType
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Assert.assertFalse
+import org.junit.Test
+
+class SelfHostedPushSchedulerTest {
+    @Test fun workConstraintHonorsWifiOnlyPreference() {
+        assertEquals(NetworkType.UNMETERED, requiredPushNetworkType(wifiOnly = true))
+        assertEquals(NetworkType.CONNECTED, requiredPushNetworkType(wifiOnly = false))
+    }
+
+    @Test fun workIsSerializedAndBackoffMeetsWorkManagerMinimum() {
+        assertEquals(ExistingWorkPolicy.REPLACE, SelfHostedPushScheduler.EXISTING_WORK_POLICY)
+        assertEquals(ExistingWorkPolicy.APPEND_OR_REPLACE, SelfHostedPushScheduler.CONTINUATION_WORK_POLICY)
+        assertTrue(SelfHostedPushScheduler.UNIQUE_WORK.isNotBlank())
+        assertTrue(SelfHostedPushScheduler.BACKOFF_SECONDS >= 10)
+    }
+
+    @Test fun asyncEnqueueFailureCompletesReservationOnlyOnce() {
+        var settlements = 0
+        var requeues = 0
+        val completion = PushEnqueueCompletion(
+            settleFailure = { settlements += 1; true },
+            requeuePending = { requeues += 1 },
+        )
+
+        assertTrue(completion.failure())
+        assertFalse(completion.failure())
+        assertFalse(completion.success())
+        assertEquals(1, settlements)
+        assertEquals(1, requeues)
+    }
+
+    @Test fun continuationAsyncFailureRequeuesItsCoalescedPendingTrigger() {
+        var settlements = 0
+        var requeues = 0
+        val completion = continuationEnqueueCompletion(
+            settleFailure = { settlements += 1; true },
+            requeuePending = { requeues += 1 },
+        )
+
+        assertTrue(completion.failure())
+        assertEquals(1, settlements)
+        assertEquals(1, requeues)
+    }
+}
diff --git a/android/app/src/test/java/com/noop/push/SelfHostedPushSettingsTest.kt b/android/app/src/test/java/com/noop/push/SelfHostedPushSettingsTest.kt
new file mode 100644
index 0000000000..f3ee5b9f78
--- /dev/null
+++ b/android/app/src/test/java/com/noop/push/SelfHostedPushSettingsTest.kt
@@ -0,0 +1,212 @@
+package com.noop.push
+
+import android.content.SharedPreferences
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class SelfHostedPushSettingsTest {
+    @Test fun wifiOnlyDefaultsOnAndPersistsOptOut() {
+        val plain = FakePushPrefs()
+        val settings = SelfHostedPushSettings.forTest(plain, FakePushPrefs())
+
+        assertTrue(settings.snapshot().wifiOnly)
+        settings.setWifiOnly(false)
+
+        assertFalse(SelfHostedPushSettings.forTest(plain, FakePushPrefs()).snapshot().wifiOnly)
+    }
+
+    @Test fun defaultsOffAndCannotEnableWithoutEndpointAndToken() {
+        val settings = SelfHostedPushSettings.forTest(FakePushPrefs(), FakePushPrefs())
+        assertFalse(settings.snapshot().enabled)
+        assertFalse(settings.setEnabled(true))
+    }
+
+    @Test fun blankTokenRemovesEncryptedCredentialAndTurnsReadinessOff() {
+        val plain = FakePushPrefs()
+        val encrypted = FakePushPrefs()
+        val settings = SelfHostedPushSettings.forTest(plain, encrypted)
+        settings.saveEndpoint("https://example.com/push")
+        settings.saveToken("secret")
+        assertTrue(settings.setEnabled(true))
+        assertTrue(settings.snapshot().ready)
+
+        settings.saveToken("   ")
+
+        assertNull(settings.token())
+        assertFalse(settings.snapshot().ready)
+    }
+
+    @Test fun capturedEndpointKeepsItsOwnProgressNamespaceAcrossConcurrentEdit() {
+        val settings = SelfHostedPushSettings.forTest(FakePushPrefs(), FakePushPrefs())
+        val first = (PushEndpointPolicy.validate("https://one.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+        val second = (PushEndpointPolicy.validate("https://two.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+
+        settings.saveEndpoint(first.url)
+        val firstNamespace = settings.progressNamespace(SOURCE_A, first)
+        settings.saveEndpoint(second.url)
+
+        assertNotEquals(firstNamespace, settings.progressNamespace(SOURCE_A, second))
+        assertTrue(firstNamespace == settings.progressNamespace(SOURCE_A, first))
+    }
+
+    @Test fun receiverStateAndNegotiatedVersionFenceProgressAtTheSameEndpoint() {
+        val settings = SelfHostedPushSettings.forTest(FakePushPrefs(), FakePushPrefs())
+        val endpoint = (PushEndpointPolicy.validate("https://one.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+
+        val first = settings.progressNamespace(SOURCE_A, endpoint, "1.0", "00000000-0000-4000-8000-000000000001")
+        val resetReceiver = settings.progressNamespace(SOURCE_A, endpoint, "1.0", "00000000-0000-4000-8000-000000000002")
+        val upgradedProtocol = settings.progressNamespace(SOURCE_A, endpoint, "1.1", "00000000-0000-4000-8000-000000000001")
+
+        assertNotEquals(first, resetReceiver)
+        assertNotEquals(first, upgradedProtocol)
+    }
+
+    @Test fun progressIsPersistedAndSuccessOnlyAppearsAfterCatchUpCompletes() {
+        val settings = SelfHostedPushSettings.forTest(FakePushPrefs(), FakePushPrefs())
+        settings.saveEndpoint("https://example.com/push")
+        settings.saveToken("secret")
+        assertTrue(settings.setEnabled(true))
+
+        settings.recordPushStarted()
+        settings.recordAcceptedBatches(4, records = 12_000)
+        settings.recordContinuation()
+
+        val continuing = settings.snapshot()
+        assertEquals(SelfHostedPushSettings.RunState.CONTINUING, continuing.runState)
+        assertEquals(4, continuing.acceptedBatches)
+        assertEquals(12_000L, continuing.acceptedRecords)
+        assertNull(continuing.lastSuccessAt)
+        assertNull(continuing.lastError)
+
+        settings.recordAcceptedBatches(3, records = 8_000)
+        settings.recordSuccess(atMillis = 1234L)
+        val complete = settings.snapshot()
+        assertEquals(SelfHostedPushSettings.RunState.COMPLETE, complete.runState)
+        assertEquals(7, complete.acceptedBatches)
+        assertEquals(20_000L, complete.acceptedRecords)
+        assertEquals(1234L, complete.lastSuccessAt)
+    }
+
+    @Test fun disableIsImmediatelyIdleAndRejectsLateWorkerStatusWrites() {
+        val settings = SelfHostedPushSettings.forTest(FakePushPrefs(), FakePushPrefs())
+        settings.saveEndpoint("https://example.com/push")
+        settings.saveToken("secret")
+        assertTrue(settings.setEnabled(true))
+        settings.recordPushStarted()
+        settings.recordRunning()
+
+        assertTrue(settings.setEnabled(false))
+        assertEquals(SelfHostedPushSettings.RunState.IDLE, settings.snapshot().runState)
+
+        settings.recordContinuation()
+        settings.recordRetrying("late retry")
+        settings.recordSuccess(999L)
+        val stopped = settings.snapshot()
+        assertEquals(SelfHostedPushSettings.RunState.IDLE, stopped.runState)
+        assertNull(stopped.lastError)
+        assertNull(stopped.lastSuccessAt)
+    }
+
+    @Test fun capabilitiesArePersistedOnlyForTheirNormalizedEndpoint() {
+        val settings = SelfHostedPushSettings.forTest(FakePushPrefs(), FakePushPrefs())
+        val first = (PushEndpointPolicy.validate("https://one.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+        val second = (PushEndpointPolicy.validate("https://two.example/push") as PushEndpointPolicy.Result.Valid).endpoint
+        settings.saveEndpoint(first.url)
+
+        settings.recordCapabilities(
+            first,
+            PushCapabilities(
+                appendTables = setOf(PushAppendTable.HR_SAMPLE),
+                mutableTables = setOf(PushMutableTable.JOURNAL),
+            ),
+            atMillis = 1234L,
+        )
+
+        assertEquals(listOf("hrSample", "journal"), settings.snapshot().supportedStreams)
+        assertEquals(1234L, settings.snapshot().capabilitiesCheckedAt)
+        settings.saveToken("rotated-token")
+        assertNull(settings.snapshot().supportedStreams)
+        settings.recordCapabilities(first, PushCapabilities.ALL, atMillis = 2345L)
+        settings.saveEndpoint(second.url)
+        assertNull(settings.snapshot().supportedStreams)
+        assertNull(settings.snapshot().capabilitiesCheckedAt)
+    }
+
+    @Test fun liveStreamIsVisibleDuringWorkAndClearedAfterCompleteCatchUp() {
+        val settings = SelfHostedPushSettings.forTest(FakePushPrefs(), FakePushPrefs())
+        settings.saveEndpoint("https://example.com/push")
+        settings.saveToken("secret")
+        assertTrue(settings.setEnabled(true))
+        settings.recordRunning()
+
+        settings.recordCurrentStream("rrInterval")
+        assertEquals("rrInterval", settings.snapshot().currentStream)
+
+        settings.recordSuccess(atMillis = 999L)
+        assertNull(settings.snapshot().currentStream)
+    }
+
+    @Test fun cycleFailurePersistsOnlyStructuredCategoryAndStatus() {
+        val plain = FakePushPrefs()
+        val settings = SelfHostedPushSettings.forTest(plain, FakePushPrefs())
+        val failure = PushFailure(PushFailureCode.HTTP_AUTH, 401)
+
+        settings.saveCycleFailure("receiver-a", failure)
+
+        assertEquals(failure, settings.cycleFailure("receiver-a"))
+        assertFalse(plain.all.values.any { it.toString().contains("secret.example") })
+        settings.saveCycleFailure("receiver-a", null)
+        assertNull(settings.cycleFailure("receiver-a"))
+    }
+
+    @Test fun boundedReceiverErrorCodeSurvivesContinuationWithoutArbitraryText() {
+        val plain = FakePushPrefs()
+        val settings = SelfHostedPushSettings.forTest(plain, FakePushPrefs())
+        val failure = PushFailure(PushFailureCode.HTTP_PROTOCOL_REJECTED, 422, "registry_mismatch")
+
+        settings.saveCycleFailure("receiver-a", failure)
+
+        assertEquals(failure, settings.cycleFailure("receiver-a"))
+        assertFalse(plain.all.values.any { it.toString().contains("response body") })
+    }
+
+    internal class FakePushPrefs : SharedPreferences {
+        private val map = HashMap<String, Any?>()
+        override fun getBoolean(key: String, defValue: Boolean) = map[key] as? Boolean ?: defValue
+        override fun getLong(key: String, defValue: Long) = map[key] as? Long ?: defValue
+        override fun getString(key: String, defValue: String?) = map[key] as? String ?: defValue
+        override fun getInt(key: String, defValue: Int) = map[key] as? Int ?: defValue
+        override fun getFloat(key: String, defValue: Float) = map[key] as? Float ?: defValue
+        @Suppress("UNCHECKED_CAST")
+        override fun getStringSet(key: String, defValues: MutableSet<String>?) =
+            map[key] as? MutableSet<String> ?: defValues
+        override fun getAll(): MutableMap<String, *> = HashMap(map)
+        override fun contains(key: String) = map.containsKey(key)
+        override fun registerOnSharedPreferenceChangeListener(listener: SharedPreferences.OnSharedPreferenceChangeListener?) = Unit
+        override fun unregisterOnSharedPreferenceChangeListener(listener: SharedPreferences.OnSharedPreferenceChangeListener?) = Unit
+        override fun edit(): SharedPreferences.Editor = Editor()
+
+        private inner class Editor : SharedPreferences.Editor {
+            private val pending = HashMap<String, Any?>()
+            private val removals = HashSet<String>()
+            override fun putString(key: String, value: String?) = apply { pending[key] = value }
+            override fun putStringSet(key: String, values: MutableSet<String>?) = apply { pending[key] = values }
+            override fun putInt(key: String, value: Int) = apply { pending[key] = value }
+            override fun putLong(key: String, value: Long) = apply { pending[key] = value }
+            override fun putFloat(key: String, value: Float) = apply { pending[key] = value }
+            override fun putBoolean(key: String, value: Boolean) = apply { pending[key] = value }
+            override fun remove(key: String) = apply { removals += key }
+            override fun clear() = apply { map.clear() }
+            override fun commit(): Boolean { flush(); return true }
+            override fun apply() = flush()
+            private fun flush() {
+                removals.forEach(map::remove)
+                map.putAll(pending)
+            }
+        }
+    }
+}
diff --git a/android/app/src/test/java/com/noop/push/SelfHostedPushWorkerPolicyTest.kt b/android/app/src/test/java/com/noop/push/SelfHostedPushWorkerPolicyTest.kt
new file mode 100644
index 0000000000..a9915afc11
--- /dev/null
+++ b/android/app/src/test/java/com/noop/push/SelfHostedPushWorkerPolicyTest.kt
@@ -0,0 +1,48 @@
+package com.noop.push
+
+import androidx.work.ListenableWorker
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class SelfHostedPushWorkerPolicyTest {
+    @Test fun pushNetworkGateHonorsWifiOnlyPreference() {
+        assertTrue(isPushNetworkAvailable(wifiOnly = true, isConnected = true, isWifi = true, isUnmetered = true))
+        assertFalse(isPushNetworkAvailable(wifiOnly = true, isConnected = true, isWifi = true, isUnmetered = false))
+        assertFalse(isPushNetworkAvailable(wifiOnly = true, isConnected = true, isWifi = false, isUnmetered = true))
+        assertTrue(isPushNetworkAvailable(wifiOnly = false, isConnected = true, isWifi = false, isUnmetered = false))
+        assertFalse(isPushNetworkAvailable(wifiOnly = false, isConnected = false, isWifi = false, isUnmetered = false))
+    }
+
+    @Test fun retryableFailureKeepsFailingDeviceIndex() {
+        assertEquals(2, persistedDeviceIndex(startDeviceIndex = 2, nextDeviceIndex = 3, retryableFailure = true))
+    }
+
+    @Test fun successfulSliceAdvancesDeviceIndex() {
+        assertEquals(3, persistedDeviceIndex(startDeviceIndex = 2, nextDeviceIndex = 3, retryableFailure = false))
+    }
+
+    @Test fun genuineFailureRetryIsBoundedOnTheSameWorkRequestAttemptCount() {
+        assertTrue(shouldRetryPush(0))
+        assertTrue(shouldRetryPush(PUSH_MAX_ATTEMPTS - 2))
+        assertFalse(shouldRetryPush(PUSH_MAX_ATTEMPTS - 1))
+    }
+
+    @Test fun scheduledPendingSuccessorIsNotBlockedByCurrentTerminalFailure() {
+        val result = resultAfterScheduledContinuation(ListenableWorker.Result.failure(), scheduled = true)
+        assertTrue(result is ListenableWorker.Result.Success)
+    }
+
+    @Test fun enqueueFailureCannotWriteTerminalStatusWhenSuccessorAlreadyOwnsSignal() {
+        assertTrue(successorOwnsEnqueueFailure(currentRequestCouldReserve = false))
+        assertFalse(successorOwnsEnqueueFailure(currentRequestCouldReserve = true))
+    }
+
+    @Test fun triggerAfterReacquireStillSchedulesSuccessorAtTerminalAttempt() {
+        assertTrue(shouldScheduleLatePendingSuccessor(willRetry = false, settlementPending = true))
+        assertFalse(shouldScheduleLatePendingSuccessor(willRetry = true, settlementPending = true))
+        assertFalse(shouldScheduleLatePendingSuccessor(willRetry = false, settlementPending = false))
+    }
+}
diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index 034033f9fc..894ef7c365 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -40,14 +40,16 @@ non-negotiable (especially on the Bluetooth path).
 
 A few principles run through the whole codebase. Internalize them before opening a PR.
 
-1. **Offline by design.** There is no server, no telemetry and no account, and **your data never
-   leaves the device.** Strap data, imports, and computed metrics live in a local SQLite database.
-   A change that uploads any of it — for any reason — does not belong here.
-   The app makes exactly three network requests, all documented in
+1. **Offline by design.** There is no NOOP server, telemetry, or account, and **nothing about you
+   leaves the device unless you explicitly switch on a feature that sends it.** Strap data, imports,
+   and computed metrics live in a local SQLite database.
+   The app makes exactly four network requests, all documented in
    [docs/PRIVACY_SECURITY.md §1.1](PRIVACY_SECURITY.md): the opt-in AI Coach, the
-   compile-time-optional Oura history import, and the update check (a read of a public version
-   number, on by default, switchable off). Each sends nothing about the user. Adding a fourth needs
-   a very good reason and the same treatment: named in the privacy doc, and switchable off.
+   compile-time-optional Oura history import, the update check (a read of a public version number,
+   on by default, switchable off), and Android's default-off Experimental one-way export to a
+   user-owned endpoint. Adding a fifth needs a very good reason and the same treatment: named in the
+   privacy doc, and switchable off. New hosted services or undisclosed network calls do not belong
+   here; see [Scope](SCOPE.md).
 2. **Interoperability, not impersonation.** NOOP talks to a strap the user already owns. It does not
    log into a WHOOP account, bypass a paywall, or ship WHOOP's proprietary code/firmware/assets/logos.
    Keep contributions on the right side of that line, and keep all WHOOP references *nominative*
diff --git a/docs/FAQ.md b/docs/FAQ.md
index 52dad66d78..397e48f4c0 100644
--- a/docs/FAQ.md
+++ b/docs/FAQ.md
@@ -47,16 +47,22 @@ into something diagnosable.
 
 ## Does my data ever leave my device?
 
-No, unless you export it yourself. NOOP has no servers, no accounts and no cloud sync. The only
-feature that makes a network request is the optional AI Coach, which is off by default and uses an
-API key you supply, to a provider you choose.
+No, unless you export it yourself or explicitly enable an optional network path. NOOP operates no
+servers, accounts, telemetry, or cloud sync. The AI Coach sends a compact summary only when you ask
+it a question. Android's Experimental self-hosted push can send fresh database rows after offload,
+at app-launch catch-up, or when the user explicitly selects **Export now**,
+but is off until you configure your own endpoint and bearer token; it is one-way and never reads
+records back. A receiver may only advertise which fixed protocol streams it accepts. A source-built
+Oura history importer is inbound-only.
 
-Two things do carry your data off-device **when you choose to send them**:
+These exports can carry your data off-device **when you choose to use them**:
 
 - a `.noopbak` backup, which is a copy of the whole local database
 - the CSV/JSON export
+- the default-off Experimental self-hosted push on Android, to an endpoint you own
 
-Both are user-initiated. See [docs/PRIVACY_SECURITY.md](PRIVACY_SECURITY.md).
+The first two are user-initiated actions; self-hosted push is a standing instruction you explicitly
+configure and can turn off. See [PRIVACY_SECURITY.md](PRIVACY_SECURITY.md).
 
 NOOP also checks once a day whether a newer release exists, because it is sideloaded on every platform
 and has no store to update it. That is a read of a public version number and sends nothing about you —
diff --git a/docs/PRIVACY_SECURITY.md b/docs/PRIVACY_SECURITY.md
index ace5c0470f..e4422c2349 100644
--- a/docs/PRIVACY_SECURITY.md
+++ b/docs/PRIVACY_SECURITY.md
@@ -14,7 +14,8 @@ be checked.
 > are approximations and are not clinically validated. Self-tracking features such
 > as the Mind / mood check-in and nutrition import are **informational only** and are
 > **not** a diagnosis, treatment, or dietary/medical advice. Use at your own risk;
-> your data stays on your device. See `DISCLAIMER.md`, `TERMS.md`, and
+> your data stays on your device unless you explicitly export it or enable an optional network path.
+> See `DISCLAIMER.md`, `TERMS.md`, and
 > `ATTRIBUTION.md` at the repo root.
 
 ---
@@ -26,18 +27,18 @@ local SQLite — has no network layer at all: no phone-home, no analytics, no ac
 no login, no cloud sync, and no telemetry. Everything NOOP computes about you lives in a
 single SQLite file on your own device.
 
-There are exactly **two** opt-in exceptions: the **AI Coach** (§1.1a) and the **Oura history
-import** (§1.1b). The AI Coach is off until you turn it on with your own API key; when you
+There are exactly **three** opt-in network exceptions: the **AI Coach** (§1.1a), the **Oura history
+import** (§1.1b), and Android's Experimental **self-hosted push** (§1.1d). The AI Coach is off until
+you turn it on with your own API key; when you
 ask it a question it sends a short text summary of your recent metrics to the provider you
 choose. The Oura history import is **not even compiled into a default build** — the code
 only exists in your binary if you build from source with your own Oura developer app's
 credentials (§1.1b); instead of sending data out, it pulls your own Oura data **in** over
-OAuth, once, and never sends any of your existing NOOP data out. Nothing else in the app
-ever touches the network, and your raw biometric streams never leave the device through
-either exception.
+OAuth, once, and never sends any of your existing NOOP data out. Self-hosted push is off until an
+Android user configures their own endpoint and bearer token; it then exports registered streams one
+way after offload and never reads records back. Nothing else in the app touches the network.
 
-Data enters NOOP three ways, and leaves it (other than the optional AI Coach) only when **you**
-deliberately export it to another store on the **same device**:
+Data enters or leaves NOOP only through these explicit paths:
 
 | Path | Transport | Direction |
 |------|-----------|-----------|
@@ -45,13 +46,14 @@ deliberately export it to another store on the **same device**:
 | File import (Apple Health, WHOOP CSV, nutrition CSV) | User-selected files on disk | Read-only from disk |
 | Oura history import (opt-in build flag, §1.1b) | HTTPS OAuth + REST, `api.ouraring.com` → device | Read-only from your own Oura account |
 | Apple Health export, incl. iOS "Export for Shortcuts" | On-device, user-initiated | NOOP → your Apple Health, on your device only (§1.3) |
+| Self-hosted push (Experimental, Android, §1.1d) | HTTP(S), configured endpoint | One-way NOOP → user-owned receiver |
 
-The **network** paths are the opt-in AI Coach, the compile-time-optional Oura history import, and the
-update check (§1.1c); the
+The **network** paths are the opt-in AI Coach, the compile-time-optional Oura history import, the
+update check (§1.1c), and Android's default-off Experimental self-hosted push (§1.1d); the
 biometric pipeline produces no network traffic of any kind. The Apple Health export above is
 an **on-device** hand-off, not a network upload — see §1.3.
 
-### 1.1 Network code: the three exceptions
+### 1.1 Network code: the four exceptions
 
 The biometric pipeline and all five Swift packages
 (`WhoopProtocol`, `WhoopStore`, `StrandAnalytics`, `StrandImport`, `StrandDesign`)
@@ -67,7 +69,7 @@ the local BLE ring-pairing lane, not a network API, so it has no equivalent to 
 networking anywhere in the app is the AI Coach (`Strand/AI/AICoach.swift` on the
 Swift side — macOS and iOS — `com.noop.ai.AiCoach` on Android), described in §1.1a,
 the Oura history import (`Strand/Oura/`, Swift-only — macOS and iOS), described in §1.1b,
-and the update check, described in §1.1c.
+the update check, described in §1.1c, and the Android-only self-hosted push, described in §1.1d.
 #### 1.1c The update check
 
 NOOP is sideloaded on every platform — there is no App Store or Play Store to update it — so an install
@@ -105,8 +107,8 @@ importers. Neither opens a socket.
 
 ### 1.1a The AI Coach (optional, off by default, bring your own key)
 
-The AI Coach lets you ask questions about your data in plain language. It is one of the
-two features that use the network (the other is the Oura history import, §1.1b), and only
+The AI Coach lets you ask questions about your data in plain language. It is one of three optional
+network paths (the others are the Oura history import, §1.1b, and self-hosted push, §1.1d), and only
 on your terms:
 
 - **Off until you enable it.** You enter your own API key for the provider you choose
@@ -124,9 +126,9 @@ on your terms:
   provider you picked, under your own account. NOOP runs no server in between and keeps
   no copy.
 
-If you never enable the AI Coach and never build the Oura import in (§1.1b), NOOP makes
-zero network connections — and in a default build, the Oura code isn't in the binary to
-begin with.
+If you never enable the AI Coach or self-hosted push and never build the Oura import in (§1.1b),
+NOOP makes zero application network connections — and in a default build, the Oura code isn't in
+the binary to begin with.
 
 ### 1.1b The Oura history import (compiled out by default, bring your own OAuth app)
 
@@ -169,6 +171,41 @@ API — a one-time, foreground backfill you trigger yourself, not an ongoing bac
 
 If you never build the lane in, your binary cannot call `ouraring.com` — the code is not there.
 
+### 1.1d Self-hosted push (Experimental, Android, off by default)
+
+Self-hosted push keeps a fresh one-way copy of selected rows on a machine the user controls. It is
+not a NOOP cloud, account, restore path, or two-way sync:
+
+- **Off until configured.** No endpoint means the worker does not send. The user supplies both the
+  HTTP(S) URL and bearer token; NOOP operates no intermediary or receiver.
+- **After offload, at launch, or explicitly now — always outside BLE sync.** Automatic work is queued
+  after a complete strap offload and at app launch to catch up; the user may also press **Export now**.
+  An unavailable or slow endpoint cannot delay BLE collection, local persistence, analytics, or UI.
+- **What is sent.** The finite, versioned stream registry in
+  [`PUSH_PROTOCOL.md`](PUSH_PROTOCOL.md) includes biometric rows and rolling snapshots of selected
+  recomputed/editable tables, scoped by a locally generated installation ID and local device ID.
+- **What comes back.** The receiver may advertise only a subset of NOOP's fixed v1 stream names, and
+  acknowledges submitted batches. NOOP never fetches health rows, remote changes, commands, URLs,
+  schemas, settings, or conflict decisions. The local database remains authoritative.
+- **Connection test.** The explicit **Test connection** action performs only the authenticated
+  capability `GET`; it does not open the health database or submit a batch, and uses the same
+  network policy as export work: Wi-Fi only by default, with an explicit option to allow mobile
+  and other connected networks.
+- **Useful diagnostics without leaking secrets.** The screen distinguishes DNS lookup, TLS
+  certificate/handshake, timeout, connection-refused, unreachable/reset connection, HTTP status,
+  capability/acknowledgement, local encoding, and local database failures. It stores and displays
+  only that stable category and (where applicable) the numeric HTTP status. Bearer tokens, response
+  bodies, health rows, endpoint-derived exception text, and stack traces are never placed in push
+  status. Retryable failures also say that backoff is scheduled; permanent failures identify the
+  configuration or receiver area to check.
+- **Credential transport.** The bearer token authenticates every capability `GET` and batch `POST`. Public cleartext endpoints
+  are rejected; HTTP is limited to numeric loopback/private/link-local/ULA addresses. Cleartext
+  hostnames are rejected, so DNS cannot move an allowed local URL to a public address. Even on an
+  allowed IP, HTTP exposes the token and batch contents locally, so HTTPS remains preferable.
+
+The repository ships the Android client and protocol document, not a server. The feature remains
+Experimental and default-off under the boundary in [`SCOPE.md`](SCOPE.md).
+
 ### 1.2 The macOS sandbox (and what it means for the AI Coach and the Oura import)
 
 On macOS the App Sandbox is the backstop. The app ships with a minimal entitlement set
@@ -207,8 +244,8 @@ Notably **absent**:
   the app cannot wander the disk; it sees only what the user hands it through the
   open panel, plus its own sandbox container.
 
-This is the structural guarantee behind "offline by design" on macOS: the sandbox
-permits exactly the two deliberate, opt-in exceptions above and nothing else — no
+This is the structural guarantee behind "offline by default" on macOS: the sandbox
+permits exactly the two Swift-side, opt-in exceptions above and nothing else — no
 undeclared entitlement could smuggle out a connection the user didn't ask for. The
 property is enforced by the OS, not merely by convention.
 
@@ -528,10 +565,9 @@ dedicated source id `nutrition-csv`, alongside your other metrics and entirely o
   OAuth — NOOP never sees your Oura password, only the resulting tokens, kept in the
   Keychain.
 - **No telemetry / analytics / crash reporting.** No third-party SDKs of that kind.
-- **No cloud, no sync, no remote backup of NOOP's own data.** Your NOOP data never
-  leaves the machine via NOOP. The Oura history import (§1.1b) is the one path that
-  reaches a cloud service, and it is **inbound only** — it pulls your own Oura data in;
-  it does not sync or back up any NOOP data out.
+- **No NOOP cloud, account sync, or operated remote backup.** The Oura history import (§1.1b) is
+  **inbound only**. Android self-hosted push (§1.1d) is the sole standing outbound export: off by
+  default, one-way, and directed only to the endpoint the user configured and owns.
 - **No advertising identifiers, no tracking.**
 - **No WHOOP account or API credentials.** NOOP talks only to the strap over local
   BLE; it does not authenticate against, or pull from, any WHOOP server. (Oura is the
@@ -543,7 +579,7 @@ dedicated source id `nutrition-csv`, alongside your other metrics and entirely o
 
 | Surface | Risk | Mitigation | Where |
 |---------|------|------------|-------|
-| Process | Data exfiltration / network egress | Only two opt-in features network: the AI Coach (your key, to your chosen provider, a text summary — §1.1a) and the Oura history import (your own OAuth app, to `api.ouraring.com`, inbound-only — §1.1b). Nothing else makes a network call, and nothing is sent until you ask. Both work on Android/iOS where shipped (Android's Oura support is local-BLE only, no cloud lane); on macOS both cross the sandbox on the same `network.client` entitlement, present since #128 (§1.2) | `Strand/AI/AICoach.swift`, `Strand/Oura/`, `android/.../ai/AiCoach.kt` |
+| Process | Data exfiltration / network egress | Three explicit paths: AI Coach (your key, chosen provider, summary only — §1.1a), Oura history import (your OAuth app, inbound-only — §1.1b), and Android self-hosted push (default-off, user-owned endpoint, one-way versioned batches — §1.1d). No NOOP server, account, or telemetry; ordinary BLE/offline use makes no application network request. | `Strand/AI/AICoach.swift`, `Strand/Oura/`, `android/.../ai/AiCoach.kt`, `docs/PUSH_PROTOCOL.md` |
 | Oura history import | OAuth token / scope leakage, cross-account data mixing | Compiled out by default (`OURA_CLOUD_IMPORT`, §1.1b); tokens Keychain-only (`kSecAttrAccessibleAfterFirstUnlock`, never UserDefaults/plist); fixed OAuth scopes set at build time; raw + normalized rows partitioned under `deviceId = "oura-api"`; Oura's own scores kept reference-only (`ref_*`/`oura_*` metricSeries keys, never NOOP's Charge/Effort/Rest); `.cloudImport` is structurally priority-2 so it never seizes a WHOOP day; Forget Oura access purges tokens + every `oura-api` row incl. the raw archive | `Strand/Oura/OuraTokenStore.swift`, `Strand/Oura/OuraConnectModel.swift`, `Packages/WhoopStore/Sources/WhoopStore/OuraRawStore.swift` |
 | Filesystem | Broad disk access | Only `files.user-selected.read-write`; data stays in the sandbox container | `Strand.entitlements`, `Strand/Collect/StorePaths.swift` |
 | BLE frames | Malformed / adversarial packets | CRC8 + CRC32 (+ CRC16 for v5) gating; reject on failure | `WhoopProtocol/Framing.swift`, `Strand/BLE/FrameRouter.swift` |
diff --git a/docs/PUSH_PROTOCOL.md b/docs/PUSH_PROTOCOL.md
new file mode 100644
index 0000000000..9c06c8be77
--- /dev/null
+++ b/docs/PUSH_PROTOCOL.md
@@ -0,0 +1,393 @@
+# Self-hosted push protocol
+
+This document specifies the wire contract for NOOP's **Experimental**, default-off export to a
+user-owned HTTP(S) endpoint. Protocol version **1.0** covers the Android-first client. It is a
+one-way export protocol: the on-device database is authoritative, the receiver acknowledges writes
+and may advertise only which fixed v1 streams it accepts. NOOP never reads health data, commands,
+URLs, field names, or other configuration back from the receiver.
+
+NOOP does not ship, operate, or endorse a receiver. A receiver is not part of this repository, and
+this contract must not be interpreted as an account, hosted-sync, restore, or two-way-sync API.
+
+## Transport and authentication
+
+The configured endpoint serves authenticated capabilities on `GET` and accepts one `POST` per batch.
+The settings screen may issue this `GET` alone when the user selects **Test connection**; that action
+does not open the health database or send a batch.
+
+```http
+GET /the/user-configured-path HTTP/1.1
+Accept: application/json
+Authorization: Bearer <user-supplied-token>
+NOOP-Push-Accept-Version: 1.0
+```
+
+A successful capability response has these required members:
+
+```json
+{"type":"capabilities","protocolVersion":"1.0","receiverStateId":"5fc7b9a0-8055-4e49-a308-3a290f98d81a","streams":["hrSample","rrInterval","dailyMetric"]}
+```
+
+`NOOP-Push-Accept-Version` is a comma-separated, sender-preferred list of exact versions it can emit.
+The receiver selects the first version in that order it supports and returns it as `protocolVersion`; no common version fails
+with `406` before health data is read. `receiverStateId` is a canonical UUID persisted with receiver
+state. It remains stable across upgrades, database backups and migrations, and changes whenever the
+receiver no longer has continuity with previously acknowledged data. Restoring a stale receiver backup
+therefore requires the operator to rotate this ID. Rotation starts a new idempotency generation: the
+receiver retains health records but atomically discards old batch acknowledgements, replacement staging,
+and generation fences so deterministic baseline batch IDs are applied again rather than short-circuited.
+
+`streams` is a duplicate-free subset of the twelve names in the selected v1 registry; array order has
+no semantic meaning. An empty array is valid. Unknown names, duplicate names, a missing required member,
+an unsupported version, malformed JSON, or a response over 16 KiB fail closed before Room is opened or
+health data is encoded. Unknown optional object members are ignored within a supported major version. The
+receiver cannot add tables or fields: the effective registry is always the intersection of its list
+and the client's compiled v1 registry. Android performs no snapshot read and no batch `POST` for an
+unadvertised stream.
+
+Capability changes affect future attempts only. A client retains progress for an unadvertised
+stream, so advertising it again resumes from the existing cursor. Removing a stream from the list
+is not a deletion command and cannot remove records already stored by the receiver.
+
+There is no implicit capability fallback: `404`, `405`, a missing version response, and every invalid
+capability document send no health data. Transport failures, `408`, `429`, and `5xx` are retryable and
+send no batch in that attempt; other failures are visible protocol/configuration errors. Redirects are
+never followed and the bearer token is never forwarded.
+
+Batch delivery then uses:
+
+```http
+POST /the/user-configured-path HTTP/1.1
+Content-Type: application/x-ndjson; charset=utf-8
+Accept: application/json
+Authorization: Bearer <user-supplied-token>
+Content-Encoding: gzip
+```
+
+- HTTPS endpoints may be public. Plain HTTP is accepted only when the URL uses a numeric loopback,
+  RFC 1918 private IPv4, IPv4/IPv6 link-local, or IPv6 ULA address. Cleartext hostnames (including
+  `.local`) and public cleartext destinations are rejected, eliminating a DNS-rebinding boundary. A
+  bearer token sent over allowed local HTTP is still visible locally, so HTTPS remains preferable.
+- The token and endpoint are supplied by the user. Neither identifies a NOOP account; no such account
+  exists.
+- One request contains exactly one device and one stream. A v1 request contains at most **5,000 record
+  lines** and at most **4 MiB (4,194,304 bytes)** of decoded UTF-8 NDJSON, including newlines.
+- Android sends request entities with `Content-Encoding: gzip` and an explicit `Content-Length`.
+  The decoded NDJSON bound is authoritative; the sender also caps the encoded wire entity at
+  **4 MiB + 64 KiB** so compression cannot introduce unbounded buffering. Receivers must decode
+  before enforcing the NDJSON limit. Other conforming senders may use identity encoding while
+  applying the same 4-MiB decoded bound.
+- For compatibility with protocol-1.0 identity-only receivers, Android retries once without
+  `Content-Encoding` only after a definitive HTTP `415 Unsupported Media Type`. The fallback uses
+  the same endpoint, authorization, `batchId`, and byte-identical decoded NDJSON entity. Redirects,
+  transient failures, and every other status never trigger this fallback.
+- A sender run also caps one mutable-window snapshot at **1,000 records / 2 MiB encoded record
+  data**. Larger local windows fail visibly before the first HTTP request instead of growing memory
+  without bound or sending an incomplete authoritative replacement.
+- Before reading an append page (at most 5,001 queried rows) or mutable snapshot (at most 1,001
+  queried rows), Android performs a length preflight over that exact ordered, limited selection in
+  the same database transaction. The conservative estimate charges every text value at six times
+  its UTF-8 byte length for worst-case JSON escaping plus fixed per-row/object overhead. Oversized
+  snapshots fail without truncation or cursor movement before unrestricted text enters app memory.
+- Network or receiver failure must not block strap offload, local writes, analytics, or UI. Delivery
+  is retried by the independent background worker.
+- Android coalesces triggers that arrive during a running worker, processes at most one remembered
+  device scope per attempt, and rotates that durable device cursor only after the slice completes.
+  Per-call DNS and HTTP deadlines keep the attempt below WorkManager's execution window; automatic
+  retries stop after a finite attempt budget and resume on a later successful offload or app launch.
+
+## Identity and storage scope
+
+`sourceId` is a random UUID generated locally and persisted for that app installation. `deviceId` is
+the identifier already used by NOOP's local `device` table. Neither is an account or a globally
+resolved user identity. The device name and MAC address are not part of this protocol.
+
+A receiver must scope every row and idempotency record by at least:
+
+```text
+(sourceId, deviceId, stream, primary key)
+```
+
+Two installations that happen to use the same strap identifier must therefore not overwrite one
+another. Reinstalling NOOP may create a new `sourceId`; reconciliation between installations is
+deliberately outside v1.
+
+Local progress is scoped by `(sourceId, normalized endpoint, selected protocolVersion,
+receiverStateId)`. A changed endpoint, negotiated version, or receiver state ID forces a fresh
+baseline. Rotating only the bearer token preserves progress. This prevents a newly initialized
+receiver at the same URL from silently missing data and lets a protocol upgrade replay older append
+records when their representation gains fields.
+
+## NDJSON request
+
+Every line is one complete JSON object followed by LF (`0x0a`). There is no BOM, blank line, JSON
+array, or trailing material. The first line is the batch header; exactly `recordCount` record lines
+follow it.
+
+### Header
+
+An append batch has this shape (spacing is illustrative, not canonical):
+
+```json
+{"type":"batch","protocolVersion":"1.0","batchId":"e835f32f-60e7-4c93-90a0-51eb6830119a","sourceId":"3a3486dd-5030-4e17-a00d-a781399890f9","deviceId":"strap-local-id","stream":"hrSample","delivery":"append","recordCount":2,"startCursor":{"rowId":48110,"keySha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"},"endCursor":{"rowId":48119,"keySha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}}
+{"type":"record","key":{"ts":1723939201},"data":{"bpm":61}}
+{"type":"record","key":{"ts":1723939202},"data":{"bpm":62}}
+```
+
+Header members are:
+
+| Member | Meaning |
+|---|---|
+| `type` | Always `"batch"`. |
+| `protocolVersion` | `"1.0"` for this contract. |
+| `batchId` | UUID identifying these exact decoded NDJSON entity bytes. Stable across retries and content codings. |
+| `sourceId` | Locally generated installation UUID. |
+| `deviceId` | Local device identifier; scopes every record in the batch. |
+| `stream` | A name in the versioned stream registry below. |
+| `delivery` | `"append"` or `"replace_window"`, as fixed by the registry. |
+| `recordCount` | Number of record lines, `0...5000`. |
+| `startCursor` | Exclusive append insertion highwater, or `null` for the first append batch and replace-window parts. |
+| `endCursor` | Inclusive insertion highwater of the final append record, or `null` for replace-window parts. |
+| `window` | Required only for `replace_window` delivery; absent for append delivery. |
+
+All UUIDs are lowercase canonical UUID strings. JSON object member order is not semantically
+significant, but the sender must retain the exact decoded NDJSON entity bytes until that batch is
+acknowledged.
+
+### Records
+
+Each subsequent object has `type: "record"`, a `key` containing every primary-key column other than
+the header's `deviceId`, and a `data` object containing the exported non-key columns. Local-only
+bookkeeping such as the vestigial `synced` column is never exported. SQL `NULL` is JSON `null`, integer
+and real values are JSON numbers, text is a JSON string, and database booleans are JSON booleans.
+Text columns whose names end in `JSON` remain strings; their contents are not promoted into nested
+wire objects.
+
+Keys must contain exactly the registry columns. Append records are ordered by their local insertion
+position; replace-window records are sorted by natural key. Natural-key integer components compare
+numerically and text components use unsigned UTF-8 byte order (SQLite `BINARY` order). A receiver
+must reject duplicate keys within a batch or complete replacement window.
+
+## Append delivery and cursors
+
+Each append highwater is local state scoped by `(sourceId, deviceId, stream)` inside the destination
+namespace above. It is an opaque receiver value carrying the sender's persistent monotonic insertion
+position, not a measurement timestamp or natural primary key. The v1 member is named `rowId` because
+NOOP's Android and Apple SQLite stores both map it to SQLite insertion `rowid`; a conforming non-SQLite
+sender may supply an equivalent durable insertion sequence. Receivers validate and echo it but must not
+interpret it as receiver state.
+The sender selects rows for that device whose `rowid` is greater than `startCursor.rowId`, orders by
+`rowid ASC`, and sets `endCursor.rowId` to the final row's insertion position. This matters because a
+later offload can insert old measurement timestamps; a timestamp or lexicographic natural-key
+highwater would permanently strand that backfill.
+
+Each non-null cursor also contains `keySha256`, the lowercase SHA-256 of the UTF-8 bytes formed by
+`stream`, LF, `deviceId`, LF, and the compact JSON natural-key object with members in registry order.
+Before using a saved cursor, the sender must read
+that row and verify the natural-key fingerprint. A missing row or mismatch means a restore, prune,
+`VACUUM`/rowid rewrite, or database replacement invalidated the insertion positions. The sender must
+reset that stream's cursor to null and replay it; receiver primary-key upserts make the replay safe.
+Changing `sourceId`, normalized endpoint, selected version, or `receiverStateId` selects a fresh
+progress namespace and sends a full baseline, avoiding acknowledgements being carried between
+destinations. Implementations may store additional local database-generation evidence, but it is not
+transmitted.
+
+The sender also remembers, per endpoint namespace, every device scope it has considered. Live
+database discovery is unioned with that encrypted set so deleting the final mutable row still emits
+an empty authoritative replacement instead of leaving stale receiver data behind.
+
+An append batch must contain at least one record. Its keys must satisfy:
+
+```text
+startCursor.rowId < first rowid < ... <= final rowid == endCursor.rowId
+```
+
+For an initial batch, `startCursor` is `null` and all insertion positions are eligible. Batches stop before either
+the 5,000-record or 4-MiB decoded bound is exceeded. A receiver applies records as idempotent upserts using the
+scoped primary key. Append streams do not communicate deletions.
+
+The sender advances a stream's local highwater to `endCursor` only after a valid acceptance response
+for the whole batch. A timeout, non-2xx response, invalid body, partial acceptance, or mismatched
+acknowledgement leaves the highwater unchanged and retries the identical `batchId` and decoded
+NDJSON entity bytes. Other
+streams have independent highwaters and may continue.
+
+## Authoritative rolling-window delivery
+
+Mutable and recomputed tables use authoritative `replace_window` operations rather than append cursors.
+After an offload, the sender evaluates the current local calendar day plus the preceding 13 local days
+(approximately 14 times 24 hours across daylight-saving changes). On a fresh destination it sends that
+complete 14-day baseline. Afterwards Android stores a canonical SHA-256 separately for every local day,
+device, stream, source, and endpoint namespace. These hashes are local progress metadata and are never
+transmitted.
+
+If every daily hash is unchanged, no replacement request is necessary. If days changed, Android sends the
+smallest contiguous window spanning those days; unchanged days between the first and last changed day may
+be included. A formerly populated day whose canonical snapshot is now empty is changed and must be sent as
+an empty authoritative window. Hash progress advances only after every part receives an exact durable
+acknowledgement. Therefore a timeout or failed acknowledgement repeats the same deletion or replacement
+instead of losing it. Receivers must accept any non-empty half-open subwindow inside the mutable horizon;
+they must not require every replacement to be exactly 14 days wide.
+
+Day-keyed windows use `YYYY-MM-DD`; timestamp-keyed windows use the corresponding local-midnight bounds
+converted to Unix seconds. Bounds are always half-open:
+`startInclusive <= selector < endExclusive`.
+
+The window header member is:
+
+```json
+"window":{"replacementId":"bf8b735e-f157-4a35-beb2-9b086d10d5bd","selector":"day","startInclusive":"2026-08-05","endExclusive":"2026-08-19","part":1,"parts":1}
+```
+
+For `startTs` selectors the bounds are integer Unix seconds instead of strings. A replacement that fits
+in one request uses `part: 1, parts: 1`. If it exceeds either batch bound, the sender divides the
+sorted records into `parts` bounded requests. Every part has the same `replacementId`, scope, window and
+positive `parts` value; `part` runs from 1 through `parts`; each part has its own stable `batchId`.
+An empty window is represented by one zero-record part and is still authoritative: it deletes all
+receiver rows in that scope and window. `startCursor` and `endCursor` are `null` for all parts.
+
+Daily checksums are an upload-elision mechanism, not receiver state or a synchronization command. A
+receiver remains responsible for durable storage once it acknowledges a batch. A changed destination
+namespace forces the complete baseline; rotating only the bearer token preserves accepted daily hashes.
+
+The receiver durably stages accepted parts. Only when every part is present does it atomically:
+
+1. upsert all replacement records by the scoped primary key; and
+2. delete receiver rows in the declared window whose keys are absent from the complete replacement.
+
+An acknowledgement for the part that completes the set must not be returned until that atomic apply
+succeeds. Retrying any part is harmless. Conflicting reuse of a `replacementId`, part number, or
+`batchId` must be rejected. Rows outside the declared window are untouched. This absence-means-delete
+rule makes edits and deletions within the rolling window converge to NOOP's local state; v1 carries no
+tombstone for a row that has already aged out of that window.
+
+A sender must have at most one incomplete replacement generation per `(sourceId, deviceId, stream)`.
+Observing the first part of a different generation supersedes every older incomplete generation in that
+scope, even when its exact window bounds differ. A receiver rejects late parts of a superseded
+generation with `409`. Senders serialize replacement generations for a scope; retries remain safe and
+parts may arrive out of numerical order.
+
+## Version 1 stream registry
+
+The v1 registry is deliberately finite. A table present in NOOP's database is **not** implicitly part
+of the protocol.
+
+### Append streams
+
+| `stream` | Natural key | `data` members |
+|---|---|---|
+| `hrSample` | `ts` | `bpm` |
+| `rrInterval` | `ts`, `rrMs`, `seq` | `ord` (nullable), `srcChannel` (nullable), `tsSuspect` (nullable) |
+| `event` | `ts`, `kind` | `payloadJSON` |
+| `battery` | `ts` | `soc` (nullable), `mv` (nullable), `charging` (nullable) |
+| `spo2Sample` | `ts` | `red`, `ir` |
+| `skinTempSample` | `ts` | `raw`, `aux1Raw` (nullable), `aux2Raw` (nullable) |
+| `respSample` | `ts` | `raw` |
+| `gravitySample` | `ts` | `x`, `y`, `z`, `dynAccel` (nullable) |
+
+`ts`, `rrMs`, `seq`, `bpm`, `red`, `ir`, and `raw` are integers. `soc`, `x`, `y`, `z`, and
+`dynAccel` are finite numbers. The nullable RR metadata is integer-valued. `charging` is boolean or
+null. The database's `deviceId` is supplied by the header and `synced` is intentionally omitted.
+
+### Mutable replace-window streams
+
+| `stream` | Key | Window selector | `data` members |
+|---|---|---|---|
+| `dailyMetric` | `day` | `day` | `totalSleepMin`, `efficiency`, `deepMin`, `remMin`, `lightMin`, `disturbances`, `restingHr`, `avgHrv`, `recovery`, `strain`, `exerciseCount`, `spo2Pct`, `skinTempDevC`, `respRateBpm`, `steps`, `activeKcalEst`, `spo2Red`, `spo2Ir` (all nullable) |
+| `sleepSession` | `startTs` | `startTs` | `endTs`, `efficiency`, `restingHr`, `avgHrv`, `stagesJSON`, `userEdited`, `startTsAdjusted`, `motionJSON`, `sleepStateJSON`, `stagingSparse` |
+| `workout` | `startTs`, `sport` | `startTs` | `endTs`, `source`, `durationS`, `energyKcal`, `avgHr`, `maxHr`, `strain`, `distanceM`, `zonesJSON`, `notes`, `routePolyline`, `steps` |
+| `journal` | `day`, `question` | `day` | `answeredYes`, `notes`, `numericValue` |
+
+Unless inherent above, mutable data members are nullable exactly as in the current Room schema.
+`sleepSession.endTs`, `workout.endTs`, `workout.source`, and `journal.answeredYes` are required;
+`sleepSession.userEdited` is a required boolean. `day` is `YYYY-MM-DD`; timestamp and count fields
+are integers; metric and measurement fields are finite numbers. See [DATA_MODEL.md](DATA_MODEL.md)
+and `android/app/src/main/java/com/noop/data/Entities.kt` for the local meanings and units. The wire
+registry, not automatic reflection over either database, determines what is sent.
+
+Newer tables such as `ppgHrSample`, `stepSample`, `sleepStateSample`, `metricSeries`, raw waveform /
+IMU tables, and any future schema additions are not silently exported by v1. Adding a stream or an
+optional `data` member requires a documented registry update and protocol minor version.
+
+## Acceptance, errors, and retry idempotency
+
+After atomically accepting an append batch or durably accepting a replace-window part, the receiver returns
+2xx with `Content-Type: application/json` and exactly one acknowledgement object:
+
+```json
+{"protocolVersion":"1.0","batchId":"e835f32f-60e7-4c93-90a0-51eb6830119a","stream":"hrSample","deviceId":"strap-local-id","endCursor":{"rowId":48119,"keySha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"},"acceptedRows":2,"status":"accepted"}
+```
+
+Acceptance is valid only if all of these exactly match the request:
+
+- `protocolVersion`
+- `batchId`
+- `stream`
+- `deviceId`
+- `endCursor` (including `null` for replace-window parts)
+- `acceptedRows == recordCount`
+- `status == "accepted"`
+
+Any missing or mismatched member is a failed delivery even when the HTTP status is 2xx. There is no
+partial success. The acknowledgement contains metadata only; it must not contain source records,
+remote changes, commands, cursors chosen by the server, or configuration for NOOP to apply.
+Capability metadata is confined to the separate authenticated `GET` defined above.
+
+A receiver must remember the hash and acceptance result of each batch under
+`(sourceId, deviceId, batchId)`. Repeating the same `batchId` with byte-identical **decoded NDJSON
+entity bytes** returns the same acknowledgement without duplicating effects. Content coding is not
+part of batch identity: gzip and identity representations of the same decoded entity are the same
+batch. Reusing a `batchId` with different decoded entity bytes is a conflict and must not modify
+data. Recommended failures are `400` for malformed NDJSON, `401`/`403` for auth,
+`409` for conflicting identifiers or replace-window parts, `413` for a decoded body over 4 MiB (or
+an encoded body over the receiver's documented wire limit), `422` for an
+unsupported protocol/stream or invalid record, and `5xx` for a transient receiver failure. NOOP
+automatically retries transport errors, `408`, `429`, and `5xx`. Other `4xx` responses and malformed
+or mismatched acknowledgements retain progress and surface a visible configuration/protocol error;
+they are retried only after a later trigger or configuration change. Responses are never consumed as
+health data.
+
+A receiver should return a bounded machine-readable body for non-2xx responses:
+
+```json
+{"type":"error","protocolVersion":"1.0","code":"registry_mismatch"}
+```
+
+`code` contains 1–64 lowercase ASCII letters, digits, or underscores and starts with a letter. Android
+may display and persist only this validated code alongside the HTTP status; it never retains arbitrary
+response text. Unknown error members are ignored.
+
+The Android client reports a safe, structured cause for self-hosting diagnostics: DNS resolution,
+TLS certificate or handshake, connection timeout/refused/unreachable/reset, numeric HTTP status,
+invalid capabilities or acknowledgement, local encoding limits, or local database state. These
+categories survive bounded continuation work so the final status keeps the original cause. Raw
+exception messages and response bodies are deliberately neither displayed nor persisted because
+network stacks and receiver errors can contain endpoint details, credentials, or health data.
+
+## Versioning and forward compatibility
+
+`protocolVersion` is `MAJOR.MINOR`. Capability discovery negotiates one exact version before Room is
+opened; senders never optimistically emit a version the receiver did not select.
+
+- A major version changes framing, required members, keys, or existing semantics. A receiver must
+  reject an unsupported major version.
+- A minor version may add an optional header/data member or a registry stream. Receivers supporting
+  the same major must ignore unknown object members. They may reject an unknown stream without
+  rejecting batches for supported streams.
+- A sender must not emit a new stream or field while claiming an older minor version. Removing or
+  changing the meaning/type of a field, or changing a stream key or delivery mode, requires a new
+  major version.
+- Receivers must reject malformed known members rather than guessing. They should preserve unknown
+  `data` members if their storage model permits, but must not assign semantics to them.
+
+Capability discovery only selects an offered version and narrows the sender's compiled registry for it.
+It is not general negotiation: the receiver cannot add schemas, change delivery modes, select an
+endpoint, request diagnostics, set cadence, or otherwise control NOOP.
+
+## Apple compatibility
+
+The contract is platform-neutral. NOOP on iOS/macOS uses GRDB/SQLite with the same natural keys and
+logical v1 streams, but every implementation uses explicit registry projections rather than reflection
+or `SELECT *`. A platform lacking a nullable exported column emits `null`; platform-only columns stay
+absent until a later negotiated registry version. Scheduling and credential storage are platform
+concerns and do not change NDJSON, acknowledgement, idempotency, or replacement semantics.
diff --git a/docs/SCOPE.md b/docs/SCOPE.md
index 3ea597005a..450eec63c1 100644
--- a/docs/SCOPE.md
+++ b/docs/SCOPE.md
@@ -9,9 +9,11 @@ features so the boundary is discoverable.
 
 ## The constraints this follows from
 
-NOOP is **fully offline, on-device, and anonymous**: no server, no account, no cloud sync, no telemetry,
-and **not a medical device** (see the [Disclaimer](../DISCLAIMER.md#5-not-a-medical-device)). Those are
-hard constraints, not preferences. Everything below is a consequence of them, not a separate rule.
+NOOP is **offline-first, on-device, and anonymous**: no NOOP-operated server, no account, no cloud
+dependency, no telemetry, and **not a medical device** (see the
+[Disclaimer](../DISCLAIMER.md#5-not-a-medical-device)). Those are hard constraints, not preferences.
+The one explicit network-export exception is the default-off Experimental self-hosted push described
+below. Everything else on this page is a consequence of these constraints, not a separate rule.
 
 ## Out of scope
 
@@ -23,7 +25,7 @@ above. They are out of scope **unless the project deliberately changes its scope
 | Possible-arrhythmia / diagnostic-style alerts | A medical-device-style claim. NOOP is explicitly **not a medical device** and must not tell a user they may have a health condition. | #752 |
 | Community feeds, team chat, social graph, leaderboards, cloud messaging | Require a **server, accounts, and an identity** — the opposite of anonymous and offline. | #755 |
 | Cloud- or account-dependent coaching / notification parity | Requires cloud identity and server sync. NOOP's coach is strictly bring-your-own-key and on-device. | — |
-| Anything requiring telemetry, server sync, user identity, or medical claims | Fails a hard constraint directly. | — |
+| Anything requiring telemetry, an app-dependent/hosted server sync, user identity, or medical claims | Fails a hard constraint directly. The default-off self-hosted export below is the narrow exception: NOOP never depends on its receiver. | — |
 
 ## In scope — the local, non-diagnostic equivalents
 
@@ -36,9 +38,34 @@ on-device from NOOP's own data and make no medical claim.
   downstream gate. This mirrors the physiological-signal rule in
   [CLAUDE.md](../CLAUDE.md): an unproven derivation lands as instrumentation, not a shipped feature.
 - **Local notifications from NOOP's own metrics** — charge, alarm, sync state — computed on-device.
-- **Local export / import / reporting** — your data leaves only when *you* export it.
+- **Local export / import / reporting** — your data leaves only when *you* export it, including the
+  explicit, default-off standing export described below.
 - **Offline insights and explainers** that need no cloud identity.
 
+## Experimental exception — self-hosted one-way push
+
+Issue #1314 deliberately changed the scope for one narrow export path. NOOP may offer a
+**default-off Experimental** client that sends incremental data to an HTTP(S) endpoint the user owns
+and configures. It remains in scope only while all of these boundaries hold:
+
+- With no endpoint configured, it never runs: no network egress and no change to current battery,
+  screens, scores, or local behaviour.
+- It runs in an independent background job after a successful strap offload. Receiver latency,
+  failure, or misconfiguration must never delay or interfere with the strap sync path.
+- It only exports rows. NOOP does not fetch rows, commands, settings, URLs, schemas, or conflict
+  decisions from the receiver; the local on-device database remains the sole authority. The receiver
+  may advertise only a subset of the client's fixed versioned stream registry so unsupported data is
+  not read or sent.
+- Identity is local to the installation and device. There is no NOOP account, hosted service,
+  third-party destination, or telemetry channel. Endpoint and bearer credential are user supplied.
+- This repository ships the client and the versioned [push format](PUSH_PROTOCOL.md), not a server.
+  A receiver, dashboard, vault, or agent belongs to the user and lives outside this repository.
+
+This is automated export, not restore or two-way sync. A NOOP-operated receiver, accounts, server
+read-back, remote writes, or making app behaviour depend on endpoint availability remain out of
+scope. The feature stays Experimental until its Android background behaviour is proven quiet and
+reliable in real-world use.
+
 ## Proposing a scope change
 
 Scope changes are deliberate, not incidental. If you believe one of the out-of-scope areas should move,

From e2dea386cb1d53df6a1ef5225b300ddda9cda27b Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 18:48:42 +1200
Subject: [PATCH 036/333] push: localize the destination errors the settings
 screen shows (#1700)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Ten user-facing strings from the self-hosted push feature shipped as hardcoded English and
were rendered in every locale: nine PushEndpointPolicy refusals drawn straight into a Text()
under the endpoint field, and the scheduler's enqueue failure, which reached the same screen
through lastError inside an otherwise localized frame.

The i18n gate passed on all ten. Tools/i18n_audit.py only sees literals inside @Composable
functions, and PushEndpointPolicy is a plain object — the same blind spot that has now hidden
two separate regressions.

The seam already existed: pushFailureMessage resolves the whole transport failure taxonomy
against R.string.push_error_*. Result.Invalid now carries a Problem code instead of a
sentence, pushEndpointProblemMessage resolves it beside its sibling, and the policy object
keeps its freedom from Android types — the reason it held sentences to begin with. A new test
pins each rejected URL shape to its own code, which an "is Invalid" assertion cannot do.

Also drops ValidEndpoint.requiresLocalAddress: set at validation, asserted once, never read,
and named like a runtime guard that did not exist. The cleartext rule is enforced where it
actually holds, in validate().

The update check was documented as a #### heading ahead of 1.1a, so once push landed as 1.1d
the privacy doc read 1.1c, 1.1a, 1.1b, 1.1d. Moved into sequence and levelled, wording
untouched.

Verified: 4,709 tests, 0 failures with --rerun-tasks --no-build-cache, PushEndpointPolicyTest
confirmed at 9 cases; Tools/i18n_audit.py --ci clean; all seven strings.xml parse with all ten
keys present.
---
 .../java/com/noop/push/PushEndpointPolicy.kt  | 41 +++++++++++-----
 .../main/java/com/noop/push/PushFailure.kt    | 21 +++++++++
 .../com/noop/push/SelfHostedPushScheduler.kt  |  3 +-
 .../com/noop/push/SelfHostedPushScreen.kt     |  3 +-
 .../app/src/main/res/values-de/strings.xml    | 10 ++++
 .../app/src/main/res/values-es/strings.xml    | 10 ++++
 .../app/src/main/res/values-fr/strings.xml    | 10 ++++
 .../app/src/main/res/values-pl/strings.xml    | 10 ++++
 .../src/main/res/values-pt-rPT/strings.xml    | 10 ++++
 .../app/src/main/res/values-zh/strings.xml    | 10 ++++
 android/app/src/main/res/values/strings.xml   | 10 ++++
 .../com/noop/push/PushEndpointPolicyTest.kt   | 24 +++++++++-
 docs/PRIVACY_SECURITY.md                      | 47 ++++++++++---------
 13 files changed, 170 insertions(+), 39 deletions(-)

diff --git a/android/app/src/main/java/com/noop/push/PushEndpointPolicy.kt b/android/app/src/main/java/com/noop/push/PushEndpointPolicy.kt
index 9936fb70ab..15651b4f67 100644
--- a/android/app/src/main/java/com/noop/push/PushEndpointPolicy.kt
+++ b/android/app/src/main/java/com/noop/push/PushEndpointPolicy.kt
@@ -9,31 +9,48 @@ import java.util.Locale
 
 /** Security boundary for the user-supplied destination. Validation happens before DNS or HTTP. */
 object PushEndpointPolicy {
-    data class ValidEndpoint(val url: String, val host: String, val requiresLocalAddress: Boolean)
+    data class ValidEndpoint(val url: String, val host: String)
+
+    /**
+     * Why a destination was refused. A code rather than a sentence: [validate] has no Context, and
+     * the message is user-facing, so the wording is resolved against string resources at the call
+     * site the same way [pushFailureMessage] resolves the transport failure taxonomy.
+     */
+    enum class Problem {
+        MALFORMED_URL,
+        MISSING_SCHEME,
+        UNSUPPORTED_SCHEME,
+        USER_INFO_NOT_ALLOWED,
+        FRAGMENT_NOT_ALLOWED,
+        MISSING_HOST,
+        INVALID_HOST,
+        INVALID_PORT,
+        HTTP_REQUIRES_LOCAL_ADDRESS,
+    }
 
     sealed interface Result {
         data class Valid(val endpoint: ValidEndpoint) : Result
-        data class Invalid(val reason: String) : Result
+        data class Invalid(val problem: Problem) : Result
     }
 
     fun validate(raw: String): Result {
         val uri = runCatching { URI(raw.trim()) }.getOrNull()
-            ?: return Result.Invalid("Enter a valid URL.")
+            ?: return Result.Invalid(Problem.MALFORMED_URL)
         val scheme = uri.scheme?.lowercase(Locale.ROOT)
-            ?: return Result.Invalid("The URL needs http:// or https://.")
-        if (scheme != "http" && scheme != "https") return Result.Invalid("Only HTTP and HTTPS are supported.")
-        if (uri.rawUserInfo != null) return Result.Invalid("User names and passwords are not allowed in the URL.")
-        if (uri.rawFragment != null) return Result.Invalid("URL fragments are not allowed.")
+            ?: return Result.Invalid(Problem.MISSING_SCHEME)
+        if (scheme != "http" && scheme != "https") return Result.Invalid(Problem.UNSUPPORTED_SCHEME)
+        if (uri.rawUserInfo != null) return Result.Invalid(Problem.USER_INFO_NOT_ALLOWED)
+        if (uri.rawFragment != null) return Result.Invalid(Problem.FRAGMENT_NOT_ALLOWED)
         val rawHost = uri.host?.removePrefix("[")?.removeSuffix("]")?.lowercase(Locale.ROOT)
-            ?: return Result.Invalid("The URL needs a host.")
+            ?: return Result.Invalid(Problem.MISSING_HOST)
         val asciiHost = if (':' in rawHost) rawHost else runCatching { IDN.toASCII(rawHost) }.getOrNull()
-            ?: return Result.Invalid("The URL host is invalid.")
-        if (uri.port !in -1..65535) return Result.Invalid("The URL port is invalid.")
+            ?: return Result.Invalid(Problem.INVALID_HOST)
+        if (uri.port !in -1..65535) return Result.Invalid(Problem.INVALID_PORT)
 
         val literal = parseLiteralAddress(asciiHost)
         val literalAllowed = literal?.let(::isLocalAddress) == true
         if (scheme == "http" && !literalAllowed) {
-            return Result.Invalid("Plain HTTP requires a numeric local or private IP address.")
+            return Result.Invalid(Problem.HTTP_REQUIRES_LOCAL_ADDRESS)
         }
 
         val defaultPort = (scheme == "https" && uri.port == 443) || (scheme == "http" && uri.port == 80)
@@ -44,7 +61,7 @@ object PushEndpointPolicy {
             append(scheme).append("://").append(authority).append(path)
             uri.rawQuery?.let { append('?').append(it) }
         }
-        return Result.Valid(ValidEndpoint(normalized, asciiHost, scheme == "http"))
+        return Result.Valid(ValidEndpoint(normalized, asciiHost))
     }
 
     internal fun isLocalAddress(address: InetAddress): Boolean {
diff --git a/android/app/src/main/java/com/noop/push/PushFailure.kt b/android/app/src/main/java/com/noop/push/PushFailure.kt
index cd630512b5..9e21a1f157 100644
--- a/android/app/src/main/java/com/noop/push/PushFailure.kt
+++ b/android/app/src/main/java/com/noop/push/PushFailure.kt
@@ -122,6 +122,27 @@ internal fun classifyPushTransportFailure(throwable: Throwable): PushFailure {
     return PushFailure(code)
 }
 
+/**
+ * Wording for a refused destination. Kept beside [pushFailureMessage] so both user-facing message
+ * taxonomies resolve the same way; [PushEndpointPolicy] itself stays free of Android types.
+ */
+internal fun pushEndpointProblemMessage(
+    context: Context,
+    problem: PushEndpointPolicy.Problem,
+): String = when (problem) {
+    PushEndpointPolicy.Problem.MALFORMED_URL -> context.getString(R.string.push_endpoint_error_malformed)
+    PushEndpointPolicy.Problem.MISSING_SCHEME -> context.getString(R.string.push_endpoint_error_missing_scheme)
+    PushEndpointPolicy.Problem.UNSUPPORTED_SCHEME ->
+        context.getString(R.string.push_endpoint_error_unsupported_scheme)
+    PushEndpointPolicy.Problem.USER_INFO_NOT_ALLOWED -> context.getString(R.string.push_endpoint_error_user_info)
+    PushEndpointPolicy.Problem.FRAGMENT_NOT_ALLOWED -> context.getString(R.string.push_endpoint_error_fragment)
+    PushEndpointPolicy.Problem.MISSING_HOST -> context.getString(R.string.push_endpoint_error_missing_host)
+    PushEndpointPolicy.Problem.INVALID_HOST -> context.getString(R.string.push_endpoint_error_invalid_host)
+    PushEndpointPolicy.Problem.INVALID_PORT -> context.getString(R.string.push_endpoint_error_invalid_port)
+    PushEndpointPolicy.Problem.HTTP_REQUIRES_LOCAL_ADDRESS ->
+        context.getString(R.string.push_endpoint_error_http_requires_local)
+}
+
 internal fun pushFailureMessage(context: Context, failure: PushFailure): String {
     val base = when (failure.code) {
         PushFailureCode.DNS_LOOKUP -> context.getString(R.string.push_error_dns)
diff --git a/android/app/src/main/java/com/noop/push/SelfHostedPushScheduler.kt b/android/app/src/main/java/com/noop/push/SelfHostedPushScheduler.kt
index 84ee0b63fc..ad23445897 100644
--- a/android/app/src/main/java/com/noop/push/SelfHostedPushScheduler.kt
+++ b/android/app/src/main/java/com/noop/push/SelfHostedPushScheduler.kt
@@ -8,6 +8,7 @@ import androidx.work.NetworkType
 import androidx.work.OneTimeWorkRequest
 import androidx.work.WorkManager
 import androidx.work.await
+import com.noop.R
 import java.util.concurrent.atomic.AtomicBoolean
 import java.util.concurrent.TimeUnit
 import kotlinx.coroutines.CancellationException
@@ -130,7 +131,7 @@ object SelfHostedPushScheduler {
         val completion = PushEnqueueCompletion(
             settleFailure = {
                 PushRunSignal.releaseReservation(app, request.id.toString()) { pending ->
-                    if (!pending) settings.recordError("Push could not be queued.")
+                    if (!pending) settings.recordError(app.getString(R.string.push_error_enqueue_failed))
                 }
             },
             // A trigger coalesced while WorkManager's async Operation was in flight. Recreate it
diff --git a/android/app/src/main/java/com/noop/push/SelfHostedPushScreen.kt b/android/app/src/main/java/com/noop/push/SelfHostedPushScreen.kt
index 481102ad3f..865dcf55f4 100644
--- a/android/app/src/main/java/com/noop/push/SelfHostedPushScreen.kt
+++ b/android/app/src/main/java/com/noop/push/SelfHostedPushScreen.kt
@@ -123,7 +123,8 @@ fun SelfHostedPushScreen() {
                     enabled = endpointValid && tokenAvailable,
                     onClick = {
                         when (val result = settings.saveEndpoint(endpoint)) {
-                            is PushEndpointPolicy.Result.Invalid -> validationMessage = result.reason
+                            is PushEndpointPolicy.Result.Invalid ->
+                                validationMessage = pushEndpointProblemMessage(context, result.problem)
                             is PushEndpointPolicy.Result.Valid -> {
                                 val destinationChanged = snapshot.endpoint?.url != result.endpoint.url
                                 endpoint = result.endpoint.url
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index e5ba3cacbb..fcb0780a5f 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2519,6 +2519,16 @@
     <string name="push_state_complete">Aktuell</string>
     <string name="push_state_failed">Nach einem Fehler pausiert</string>
     <string name="push_settings_row_detail">Experimenteller Einweg-Export an einen von dir kontrollierten Endpunkt. Standardmäßig aus.</string>
+    <string name="push_endpoint_error_malformed">Gib eine gültige URL ein.</string>
+    <string name="push_endpoint_error_missing_scheme">Die URL benötigt http:// oder https://.</string>
+    <string name="push_endpoint_error_unsupported_scheme">Nur HTTP und HTTPS werden unterstützt.</string>
+    <string name="push_endpoint_error_user_info">Benutzernamen und Passwörter sind in der URL nicht erlaubt.</string>
+    <string name="push_endpoint_error_fragment">URL-Fragmente sind nicht erlaubt.</string>
+    <string name="push_endpoint_error_missing_host">Die URL benötigt einen Host.</string>
+    <string name="push_endpoint_error_invalid_host">Der URL-Host ist ungültig.</string>
+    <string name="push_endpoint_error_invalid_port">Der URL-Port ist ungültig.</string>
+    <string name="push_endpoint_error_http_requires_local">Einfaches HTTP erfordert eine numerische lokale oder private IP-Adresse.</string>
+    <string name="push_error_enqueue_failed">Push konnte nicht eingereiht werden.</string>
     <string name="l10n_sleep_screen_sleep_outside_the_new_times_was_6229881e">Schlaf außerhalb der neuen Zeiten wurde entfernt. NOOP erkennt ihn nicht erneut.</string>
     <string name="workout_action_pause">Pause</string>
     <string name="workout_action_resume">Fortsetzen</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index fec6a1d073..674bbb3297 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2505,6 +2505,16 @@
     <string name="push_state_complete">Actualizado</string>
     <string name="push_state_failed">En pausa tras un error</string>
     <string name="push_settings_row_detail">Exportación unidireccional experimental a un endpoint que controlas. Desactivada de forma predeterminada.</string>
+    <string name="push_endpoint_error_malformed">Introduce una URL válida.</string>
+    <string name="push_endpoint_error_missing_scheme">La URL necesita http:// o https://.</string>
+    <string name="push_endpoint_error_unsupported_scheme">Solo se admiten HTTP y HTTPS.</string>
+    <string name="push_endpoint_error_user_info">No se permiten nombres de usuario ni contraseñas en la URL.</string>
+    <string name="push_endpoint_error_fragment">No se permiten fragmentos en la URL.</string>
+    <string name="push_endpoint_error_missing_host">La URL necesita un host.</string>
+    <string name="push_endpoint_error_invalid_host">El host de la URL no es válido.</string>
+    <string name="push_endpoint_error_invalid_port">El puerto de la URL no es válido.</string>
+    <string name="push_endpoint_error_http_requires_local">El HTTP simple requiere una dirección IP local o privada numérica.</string>
+    <string name="push_error_enqueue_failed">No se pudo poner el envío en cola.</string>
     <string name="l10n_sleep_screen_sleep_outside_the_new_times_was_6229881e">Se ha eliminado el sueño fuera del nuevo horario. NOOP no volverá a detectarlo.</string>
     <string name="workout_action_pause">Pausar</string>
     <string name="workout_action_resume">Reanudar</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 04d6dd27ca..18ea9857b8 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2504,6 +2504,16 @@
     <string name="push_state_complete">À jour</string>
     <string name="push_state_failed">En pause après une erreur</string>
     <string name="push_settings_row_detail">Export expérimental à sens unique vers un point que vous contrôlez. Désactivé par défaut.</string>
+    <string name="push_endpoint_error_malformed">Saisissez une URL valide.</string>
+    <string name="push_endpoint_error_missing_scheme">L’URL doit commencer par http:// ou https://.</string>
+    <string name="push_endpoint_error_unsupported_scheme">Seuls HTTP et HTTPS sont pris en charge.</string>
+    <string name="push_endpoint_error_user_info">Les noms d’utilisateur et mots de passe ne sont pas autorisés dans l’URL.</string>
+    <string name="push_endpoint_error_fragment">Les fragments d’URL ne sont pas autorisés.</string>
+    <string name="push_endpoint_error_missing_host">L’URL doit comporter un hôte.</string>
+    <string name="push_endpoint_error_invalid_host">L’hôte de l’URL est invalide.</string>
+    <string name="push_endpoint_error_invalid_port">Le port de l’URL est invalide.</string>
+    <string name="push_endpoint_error_http_requires_local">Le HTTP simple exige une adresse IP locale ou privée numérique.</string>
+    <string name="push_error_enqueue_failed">Impossible de mettre l’envoi en file d’attente.</string>
     <string name="l10n_sleep_screen_sleep_outside_the_new_times_was_6229881e">Le sommeil en dehors des nouveaux horaires a été supprimé. NOOP ne le détectera plus.</string>
     <string name="workout_action_pause">Pause</string>
     <string name="workout_action_resume">Reprendre</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index ce3a22d7f5..32004d3c39 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2510,6 +2510,16 @@
     <string name="push_state_complete">Aktualne</string>
     <string name="push_state_failed">Wstrzymano po błędzie</string>
     <string name="push_settings_row_detail">Eksperymentalny eksport jednokierunkowy do kontrolowanego endpointu. Domyślnie wyłączony.</string>
+    <string name="push_endpoint_error_malformed">Wprowadź prawidłowy adres URL.</string>
+    <string name="push_endpoint_error_missing_scheme">Adres URL musi zawierać http:// lub https://.</string>
+    <string name="push_endpoint_error_unsupported_scheme">Obsługiwane są tylko HTTP i HTTPS.</string>
+    <string name="push_endpoint_error_user_info">Nazwy użytkownika i hasła nie są dozwolone w adresie URL.</string>
+    <string name="push_endpoint_error_fragment">Fragmenty adresu URL nie są dozwolone.</string>
+    <string name="push_endpoint_error_missing_host">Adres URL musi zawierać host.</string>
+    <string name="push_endpoint_error_invalid_host">Host w adresie URL jest nieprawidłowy.</string>
+    <string name="push_endpoint_error_invalid_port">Port w adresie URL jest nieprawidłowy.</string>
+    <string name="push_endpoint_error_http_requires_local">Zwykły HTTP wymaga numerycznego lokalnego lub prywatnego adresu IP.</string>
+    <string name="push_error_enqueue_failed">Nie udało się dodać wysyłki do kolejki.</string>
     <string name="l10n_sleep_screen_sleep_outside_the_new_times_was_6229881e">Sen poza nowymi godzinami został usunięty. NOOP nie wykryje go ponownie.</string>
     <string name="workout_action_pause">Wstrzymaj</string>
     <string name="workout_action_resume">Wznów</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 55c78e18b3..5ea8cdcde7 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2498,6 +2498,16 @@
     <string name="push_state_complete">Atualizado</string>
     <string name="push_state_failed">Em pausa após um erro</string>
     <string name="push_settings_row_detail">Exportação unidirecional experimental para um endpoint que controla. Desativada por predefinição.</string>
+    <string name="push_endpoint_error_malformed">Introduza um URL válido.</string>
+    <string name="push_endpoint_error_missing_scheme">O URL precisa de http:// ou https://.</string>
+    <string name="push_endpoint_error_unsupported_scheme">Apenas HTTP e HTTPS são suportados.</string>
+    <string name="push_endpoint_error_user_info">Não são permitidos nomes de utilizador nem palavras-passe no URL.</string>
+    <string name="push_endpoint_error_fragment">Não são permitidos fragmentos no URL.</string>
+    <string name="push_endpoint_error_missing_host">O URL precisa de um host.</string>
+    <string name="push_endpoint_error_invalid_host">O host do URL é inválido.</string>
+    <string name="push_endpoint_error_invalid_port">A porta do URL é inválida.</string>
+    <string name="push_endpoint_error_http_requires_local">O HTTP simples requer um endereço IP local ou privado numérico.</string>
+    <string name="push_error_enqueue_failed">Não foi possível colocar o envio em fila.</string>
     <string name="l10n_sleep_screen_sleep_outside_the_new_times_was_6229881e">O sono fora dos novos horários foi removido. O NOOP não o voltará a detetar.</string>
     <string name="workout_action_pause">Pausar</string>
     <string name="workout_action_resume">Retomar</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 1e3d7537be..ff2aae59af 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2419,6 +2419,16 @@
     <string name="push_state_complete">已是最新</string>
     <string name="push_state_failed">出错后已暂停</string>
     <string name="push_settings_row_detail">向你控制的端点进行实验性单向导出。默认关闭。</string>
+    <string name="push_endpoint_error_malformed">请输入有效的网址。</string>
+    <string name="push_endpoint_error_missing_scheme">网址需要以 http:// 或 https:// 开头。</string>
+    <string name="push_endpoint_error_unsupported_scheme">仅支持 HTTP 和 HTTPS。</string>
+    <string name="push_endpoint_error_user_info">网址中不允许包含用户名和密码。</string>
+    <string name="push_endpoint_error_fragment">不允许使用网址片段。</string>
+    <string name="push_endpoint_error_missing_host">网址需要包含主机。</string>
+    <string name="push_endpoint_error_invalid_host">网址主机无效。</string>
+    <string name="push_endpoint_error_invalid_port">网址端口无效。</string>
+    <string name="push_endpoint_error_http_requires_local">纯 HTTP 需要使用数字形式的本地或专用 IP 地址。</string>
+    <string name="push_error_enqueue_failed">无法将推送加入队列。</string>
     <string name="l10n_sleep_screen_sleep_outside_the_new_times_was_6229881e">新时间范围之外的睡眠已移除。NOOP 不会再次检测到它。</string>
     <string name="workout_action_pause">暂停</string>
     <string name="workout_action_resume">继续</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 3b05e0c988..55e2a8fc76 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -116,6 +116,16 @@
     <string name="push_state_complete">Up to date</string>
     <string name="push_state_failed">Paused after an error</string>
     <string name="push_settings_row_detail">Experimental one-way export to an endpoint you control. Off by default.</string>
+    <string name="push_endpoint_error_malformed">Enter a valid URL.</string>
+    <string name="push_endpoint_error_missing_scheme">The URL needs http:// or https://.</string>
+    <string name="push_endpoint_error_unsupported_scheme">Only HTTP and HTTPS are supported.</string>
+    <string name="push_endpoint_error_user_info">User names and passwords are not allowed in the URL.</string>
+    <string name="push_endpoint_error_fragment">URL fragments are not allowed.</string>
+    <string name="push_endpoint_error_missing_host">The URL needs a host.</string>
+    <string name="push_endpoint_error_invalid_host">The URL host is invalid.</string>
+    <string name="push_endpoint_error_invalid_port">The URL port is invalid.</string>
+    <string name="push_endpoint_error_http_requires_local">Plain HTTP requires a numeric local or private IP address.</string>
+    <string name="push_error_enqueue_failed">Push could not be queued.</string>
 
     <!-- More-page section headers (DISPLAY only; the stored expand/collapse key stays the English
          literal in MoreSectionPrefs so persistence and iOS parity are unaffected). -->
diff --git a/android/app/src/test/java/com/noop/push/PushEndpointPolicyTest.kt b/android/app/src/test/java/com/noop/push/PushEndpointPolicyTest.kt
index 78bb4c34b5..388e025892 100644
--- a/android/app/src/test/java/com/noop/push/PushEndpointPolicyTest.kt
+++ b/android/app/src/test/java/com/noop/push/PushEndpointPolicyTest.kt
@@ -1,7 +1,6 @@
 package com.noop.push
 
 import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Test
 
@@ -9,7 +8,6 @@ class PushEndpointPolicyTest {
     @Test fun httpsPublicEndpointIsAllowedAndNormalized() {
         val valid = PushEndpointPolicy.validate(" HTTPS://Example.COM:443/push ") as PushEndpointPolicy.Result.Valid
         assertEquals("https://example.com/push", valid.endpoint.url)
-        assertFalse(valid.endpoint.requiresLocalAddress)
     }
 
     @Test fun publicHttpIsRejectedBeforeAnyResolution() {
@@ -54,4 +52,26 @@ class PushEndpointPolicyTest {
             "not a url",
         ).forEach { assertTrue(it, PushEndpointPolicy.validate(it) is PushEndpointPolicy.Result.Invalid) }
     }
+
+    /**
+     * The refusal code is what the settings screen turns into wording, so a shape silently mapping to
+     * the wrong one would show the user a message that does not match what they typed.
+     */
+    @Test fun eachRejectedShapeReportsItsOwnProblem() {
+        mapOf(
+            "http://192.168.1.2/push" to null,
+            "" to PushEndpointPolicy.Problem.MISSING_SCHEME,
+            "ftp://192.168.1.2/push" to PushEndpointPolicy.Problem.UNSUPPORTED_SCHEME,
+            "http://user:pass@192.168.1.2/push" to PushEndpointPolicy.Problem.USER_INFO_NOT_ALLOWED,
+            "http://192.168.1.2/push#secret" to PushEndpointPolicy.Problem.FRAGMENT_NOT_ALLOWED,
+            "https:///push" to PushEndpointPolicy.Problem.MISSING_HOST,
+            "http://example.com/push" to PushEndpointPolicy.Problem.HTTP_REQUIRES_LOCAL_ADDRESS,
+            "not a url" to PushEndpointPolicy.Problem.MALFORMED_URL,
+        ).forEach { (raw, expected) ->
+            when (val result = PushEndpointPolicy.validate(raw)) {
+                is PushEndpointPolicy.Result.Valid -> assertEquals(raw, null, expected)
+                is PushEndpointPolicy.Result.Invalid -> assertEquals(raw, expected, result.problem)
+            }
+        }
+    }
 }
diff --git a/docs/PRIVACY_SECURITY.md b/docs/PRIVACY_SECURITY.md
index e4422c2349..a798edb6fb 100644
--- a/docs/PRIVACY_SECURITY.md
+++ b/docs/PRIVACY_SECURITY.md
@@ -70,29 +70,6 @@ networking anywhere in the app is the AI Coach (`Strand/AI/AICoach.swift` on the
 Swift side — macOS and iOS — `com.noop.ai.AiCoach` on Android), described in §1.1a,
 the Oura history import (`Strand/Oura/`, Swift-only — macOS and iOS), described in §1.1b,
 the update check, described in §1.1c, and the Android-only self-hosted push, described in §1.1d.
-#### 1.1c The update check
-
-NOOP is sideloaded on every platform — there is no App Store or Play Store to update it — so an install
-that is never told about a release simply runs an old build indefinitely. Two paths address that, and
-both read the **same** public endpoint: `https://api.github.com/repos/ryanbr/noop/releases/latest`.
-
-- **"Check for updates"** in Settings → About. Runs only when tapped. It has always existed;
-  it was previously undocumented here, which is why this section is new rather than merely amended.
-- **"Check automatically"**, beside it. At most once a day, after onboarding (and, on iOS, after the
-  Terms gate), NOOP reads that endpoint and — if a newer release exists — puts a row in the Updates
-  inbox. **On by default**, and switchable off, at which point it makes no request at all.
-
-What is sent: nothing. It is an unauthenticated `GET` of a public URL, carrying no identifier, no
-account, no device information and no biometric data. What comes back is a version number and the
-release notes. **It never installs anything** — on iOS no API permits that for a sideloaded app (see
-[docs/IOS.md](IOS.md)); the row tells you a release exists and where to get it.
-
-The request is a plain HTTPS call, so your IP address is visible to GitHub exactly as it would be if
-you opened the releases page in a browser. If that is not a trade you want, turn the toggle off; the
-manual button then remains the only way NOOP touches the network for this.
-
-Code: `Strand/System/UpdateChecker.swift` + `Strand/System/UpdateAvailability.swift` (Swift),
-`com.noop.update.UpdateCheck` + `com.noop.update.UpdateAvailability` (Android).
 
 The package manifests reference dependency *download* URLs that Swift Package Manager
 resolves at build time, never at runtime:
@@ -171,6 +148,30 @@ API — a one-time, foreground backfill you trigger yourself, not an ongoing bac
 
 If you never build the lane in, your binary cannot call `ouraring.com` — the code is not there.
 
+### 1.1c The update check
+
+NOOP is sideloaded on every platform — there is no App Store or Play Store to update it — so an install
+that is never told about a release simply runs an old build indefinitely. Two paths address that, and
+both read the **same** public endpoint: `https://api.github.com/repos/ryanbr/noop/releases/latest`.
+
+- **"Check for updates"** in Settings → About. Runs only when tapped. It has always existed;
+  it was previously undocumented here, which is why this section is new rather than merely amended.
+- **"Check automatically"**, beside it. At most once a day, after onboarding (and, on iOS, after the
+  Terms gate), NOOP reads that endpoint and — if a newer release exists — puts a row in the Updates
+  inbox. **On by default**, and switchable off, at which point it makes no request at all.
+
+What is sent: nothing. It is an unauthenticated `GET` of a public URL, carrying no identifier, no
+account, no device information and no biometric data. What comes back is a version number and the
+release notes. **It never installs anything** — on iOS no API permits that for a sideloaded app (see
+[docs/IOS.md](IOS.md)); the row tells you a release exists and where to get it.
+
+The request is a plain HTTPS call, so your IP address is visible to GitHub exactly as it would be if
+you opened the releases page in a browser. If that is not a trade you want, turn the toggle off; the
+manual button then remains the only way NOOP touches the network for this.
+
+Code: `Strand/System/UpdateChecker.swift` + `Strand/System/UpdateAvailability.swift` (Swift),
+`com.noop.update.UpdateCheck` + `com.noop.update.UpdateAvailability` (Android).
+
 ### 1.1d Self-hosted push (Experimental, Android, off by default)
 
 Self-hosted push keeps a fresh one-way copy of selected rows on a machine the user controls. It is

From fbcaee42ed28f0bbb6282526403a299623c66f87 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 19:13:56 +1200
Subject: [PATCH 037/333] today: open a session's detail from the Latest
 Workouts feed (#1701)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Requested by @h-nry in #1694. The Today feed listed recent sessions but every tile was inert,
so the only route to a session's detail was More > Workouts.

Each tile now opens the SAME read-only detail its Workouts list already opens —
WorkoutDetailSheet on Android, WorkoutDetailView on iOS. Reusing those instead of building a
Today-specific view is what makes it safe: neither can edit or delete, so a tap from Today
carries no risk that list does not already carry.

Two things had to be right rather than merely compile. Today's sections are LazyColumn items,
so hosting the sheet inside TodayWorkoutsSection builds clean and looks correct while a
disposed item takes an open sheet down with it; the state lives on TodayScreen and the sheet
sits with Today's other dialogs, which also leaves the section presentational and free of the
view model. And press feedback comes from each platform's own primitive: iOS uses
LiquidPressStyle, the twin of Android's liquidPress, not a plain button that would have given
Android an inward settle and iOS nothing.

Accessibility diverges deliberately — Android gets an onClickLabel string in all seven
locales because Compose derives nothing and the Sources row beside it does the same, while
iOS lets Button derive its label from the tile content exactly as the Workouts rows do.

TodayWorkoutTapTest guards the wiring on both platforms including the lazy-disposal trap. It
reads source, so it strips comments before matching: the first version matched this file's own
prose, which names the symbols under test.

Verified: 4,712 Android tests, 0 failures with --rerun-tasks --no-build-cache; i18n audit
clean; app-build green on both legs with Test Strand passing, which is the only thing that
compiles app-target Swift.

The window/cap/header divergence noticed in this section while reading both sides is filed
separately as #1702 rather than folded in here.
---
 Strand/Screens/TodayView.swift                | 45 +++++++++--
 .../src/main/java/com/noop/ui/TodayScreen.kt  | 26 +++++-
 .../main/java/com/noop/ui/WorkoutsScreen.kt   |  2 +-
 .../app/src/main/res/values-de/strings.xml    |  1 +
 .../app/src/main/res/values-es/strings.xml    |  1 +
 .../app/src/main/res/values-fr/strings.xml    |  1 +
 .../app/src/main/res/values-pl/strings.xml    |  1 +
 .../src/main/res/values-pt-rPT/strings.xml    |  1 +
 .../app/src/main/res/values-zh/strings.xml    |  1 +
 android/app/src/main/res/values/strings.xml   |  1 +
 .../java/com/noop/ui/TodayWorkoutTapTest.kt   | 81 +++++++++++++++++++
 11 files changed, 149 insertions(+), 12 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ui/TodayWorkoutTapTest.kt

diff --git a/Strand/Screens/TodayView.swift b/Strand/Screens/TodayView.swift
index 955c296eab..d351af4cb4 100644
--- a/Strand/Screens/TodayView.swift
+++ b/Strand/Screens/TodayView.swift
@@ -300,6 +300,14 @@ struct TodayView: View {
     // 14-day sparkline series, keyed by metric key. Loaded once in .task.
     @State private var sparks: [String: [Double]] = [:]
     @State private var workouts: [WorkoutRow] = []
+    /// #1694: a tapped Latest-Workouts tile. Wrapped so `.sheet(item:)` drives presentation, mirroring
+    /// WorkoutsView's own detail target — the feed was read-only, so the only route to a session's
+    /// detail was More > Workouts.
+    private struct WorkoutDetailTarget: Identifiable {
+        let row: WorkoutRow
+        let id = UUID()
+    }
+    @State private var workoutDetail: WorkoutDetailTarget?
     @State private var appleDays: [AppleDaily] = []
     // Design Reset / #582, the pinned "Your cards" values (Stress / Fitness age / Vitality), surfaced
     // on Today so the buried Explore features sit on the home screen. Loaded in loadAll; nil hides the row.
@@ -1511,6 +1519,20 @@ struct TodayView: View {
                 hostedCardsRaw: $hostedCardsRaw
             )
         }
+        // #1694: the same read-only WorkoutDetailView the Workouts list opens. Nothing here can edit or
+        // delete, so a tap from Today carries no risk that list does not already carry. Rides its own
+        // NavigationStack because these shared screens are not in a per-screen one — mirrors WorkoutsView.
+        .sheet(item: $workoutDetail) { target in
+            NavigationStack {
+                WorkoutDetailView(row: target.row)
+                    .environmentObject(repo)
+            }
+            #if os(iOS)
+            .noopSheetPresentation(largeFirst: true)
+            #else
+            .frame(width: 620, height: 720)
+            #endif
+        }
         #if os(iOS)
         .fullScreenCover(isPresented: $showLiveSession) {
             LiveSessionView(onClose: { showLiveSession = false })
@@ -3853,14 +3875,21 @@ struct TodayView: View {
                               trailing: String(localized: "\(workouts.count) total"))
                 LazyVGrid(columns: grid, alignment: .leading, spacing: NoopMetrics.gap) {
                     ForEach(Array(workouts.prefix(6).enumerated()), id: \.offset) { _, w in
-                        StatTile(
-                            label: "\(WorkoutSource.displaySport(w.sport))",
-                            value: workoutDuration(w),
-                            caption: workoutCaption(w),
-                            accent: StrandPalette.effortTint(fraction: (w.strain ?? 0) / StrainScorer.maxStrain),
-                            delta: w.energyKcal.map { "\(Int($0.rounded())) kcal" },
-                            deltaColor: StrandPalette.metricAmber
-                        )
+                        Button {
+                            workoutDetail = WorkoutDetailTarget(row: w)
+                        } label: {
+                            StatTile(
+                                label: "\(WorkoutSource.displaySport(w.sport))",
+                                value: workoutDuration(w),
+                                caption: workoutCaption(w),
+                                accent: StrandPalette.effortTint(fraction: (w.strain ?? 0) / StrainScorer.maxStrain),
+                                delta: w.energyKcal.map { "\(Int($0.rounded())) kcal" },
+                                deltaColor: StrandPalette.metricAmber
+                            )
+                        }
+                        // The Workouts list's own rows use this, not .plain: it is the iOS twin of
+                        // Android's liquidPress, so the tile settles inward on press on both platforms.
+                        .buttonStyle(LiquidPressStyle())
                     }
                 }
             }
diff --git a/android/app/src/main/java/com/noop/ui/TodayScreen.kt b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
index 17cc5485b3..feccff58f1 100644
--- a/android/app/src/main/java/com/noop/ui/TodayScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
@@ -663,6 +663,9 @@ fun TodayScreen(
     // existing RecoveryDriversSection (gated to the calibration countdown when the night can't score) plus
     // the folded Readiness card (S4). Not persisted, so it reopens closed. Mirrors iOS showChargeBreakdown.
     var showChargeBreakdown by remember { mutableStateOf(false) }
+    // #1694: the Latest-Workouts tile that was tapped. Held HERE, not inside the section: the Today
+    // sections are LazyColumn items, and a disposed item would take an open sheet down with it.
+    var selectedWorkoutRow by remember { mutableStateOf<WorkoutRow?>(null) }
     // LIVE SESSIONS (beta, default ON): the "Start session" entry under the hero + its full-screen Dialog
     // (the same presentation the live-workout overlay / Charge breakdown use — deliberately NOT a nav
     // destination, so dismissing it leaves the session's runner coaching and this entry is the way back
@@ -1582,7 +1585,7 @@ fun TodayScreen(
                             modifier = Modifier.fillMaxWidth().staggeredAppear(stagger),
                             verticalArrangement = Arrangement.spacedBy(8.dp),
                         ) {
-                            TodayWorkoutsSection(footer.recentWorkouts)
+                            TodayWorkoutsSection(footer.recentWorkouts, onSelect = { selectedWorkoutRow = it })
                         }
                         // HEART RATE, the live HR thread / trend card. #991: header + card in a Column.
                         TodaySection.HEART_RATE -> Column(
@@ -1741,6 +1744,11 @@ fun TodayScreen(
         }
     }
 
+    // #1694: the tapped Latest-Workouts session, in the same read-only sheet the Workouts list opens.
+    selectedWorkoutRow?.let { row ->
+        WorkoutDetailSheet(vm = viewModel, row = row, onDismiss = { selectedWorkoutRow = null })
+    }
+
     // LIVE SESSIONS (beta): the full-screen session dialog — the same presentation the live-workout
     // overlay uses on Live (Dialog, usePlatformDefaultWidth = false). Dismissing it only HIDES the
     // screen: the runner (held in LiveSessionRunner.active, ticking on the app-wide viewModelScope)
@@ -6213,7 +6221,7 @@ private fun WorkoutGlyph(icon: ImageVector, modifier: Modifier = Modifier) {
 // MARK: - Today footer sections
 
 @Composable
-private fun TodayWorkoutsSection(workouts: List<WorkoutRow>) {
+private fun TodayWorkoutsSection(workouts: List<WorkoutRow>, onSelect: (WorkoutRow) -> Unit) {
     // Single column, newest first: the 2x2 grid truncated durations on narrow phones and read as
     // unrelated stat tiles rather than a chronological feed. Full-width tiles have room for the
     // kcal chip, so the #332 compactDelta workaround is no longer needed here.
@@ -6223,10 +6231,22 @@ private fun TodayWorkoutsSection(workouts: List<WorkoutRow>) {
     // "Latest Workouts", not "Last": "Last" read as "final". Mirrored on iOS (TodayView). Lives in
     // strings.xml (values + values-de) so the header is localizable like the nav labels.
     SectionHeader(stringResource(R.string.today_latest_workouts), overline = uiString(R.string.today_workouts_activity), trailing = uiString(R.string.today_workouts_14_days))
+    // #1694: the feed was read-only, so the only way to a session's detail was More > Workouts. The
+    // tap opens the SAME read-only WorkoutDetailSheet the Workouts list uses — nothing there can edit
+    // or delete, so a tap from Today carries no risk that list does not already carry.
     Column(verticalArrangement = Arrangement.spacedBy(Metrics.gap)) {
         feed.forEach { workout ->
+            val interaction = remember(workout.startTs, workout.source) { MutableInteractionSource() }
             StatTile(
-                modifier = Modifier.fillMaxWidth(),
+                modifier = Modifier
+                    .fillMaxWidth()
+                    .liquidPress(interaction)
+                    .clickable(
+                        interactionSource = interaction,
+                        indication = null,
+                        onClickLabel = uiString(R.string.today_action_show_workout),
+                        onClick = { onSelect(workout) },
+                    ),
                 label = WorkoutEditing.displaySport(workout.sport),
                 value = localizedMetricValue(workoutDuration(workout)),
                 caption = workoutCaption(workout),
diff --git a/android/app/src/main/java/com/noop/ui/WorkoutsScreen.kt b/android/app/src/main/java/com/noop/ui/WorkoutsScreen.kt
index 00edac54ea..a8fd9f0125 100644
--- a/android/app/src/main/java/com/noop/ui/WorkoutsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/WorkoutsScreen.kt
@@ -1483,7 +1483,7 @@ private fun SessionRow(
 
 @OptIn(ExperimentalMaterial3Api::class)
 @Composable
-private fun WorkoutDetailSheet(vm: AppViewModel, row: WorkoutRow, onDismiss: () -> Unit) {
+internal fun WorkoutDetailSheet(vm: AppViewModel, row: WorkoutRow, onDismiss: () -> Unit) {
     val sheetState = rememberModalBottomSheetState(skipPartiallyExpanded = true)
 
     // Per-window reads (#410): the HR curve (downsampled bucket means) and the HR-zone split. Zones
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index fcb0780a5f..e1857952ce 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2271,6 +2271,7 @@
     <string name="today_action_reset_hr_zoom">Herzfrequenz-Zoom zurücksetzen</string>
     <string name="today_action_see_what_shaped">Einflüsse auf %1$s anzeigen</string>
     <string name="today_action_show_sources">Synchronisierte NOOP-Quellen anzeigen</string>
+    <string name="today_action_show_workout">Workout-Details anzeigen</string>
     <string name="today_contributors">Einflussfaktoren</string>
     <string name="today_data_sources">Datenquellen</string>
     <string name="today_hr_beats_per_minute">Schläge pro Minute</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 674bbb3297..e3a0732790 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2257,6 +2257,7 @@
     <string name="today_action_reset_hr_zoom">Restablecer zoom de frecuencia cardíaca</string>
     <string name="today_action_see_what_shaped">Ver qué influyó en %1$s</string>
     <string name="today_action_show_sources">Mostrar las fuentes sincronizadas con NOOP</string>
+    <string name="today_action_show_workout">Mostrar los detalles del entrenamiento</string>
     <string name="today_contributors">Factores</string>
     <string name="today_data_sources">Fuentes de datos</string>
     <string name="today_hr_beats_per_minute">Latidos por minuto</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 18ea9857b8..a70dea87fc 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2256,6 +2256,7 @@
     <string name="today_action_reset_hr_zoom">Réinitialiser le zoom de fréquence cardiaque</string>
     <string name="today_action_see_what_shaped">Voir ce qui a influencé %1$s</string>
     <string name="today_action_show_sources">Afficher les sources synchronisées avec NOOP</string>
+    <string name="today_action_show_workout">Afficher les détails de la séance</string>
     <string name="today_contributors">Facteurs</string>
     <string name="today_data_sources">Sources de données</string>
     <string name="today_hr_beats_per_minute">Battements par minute</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 32004d3c39..93827ec201 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2250,6 +2250,7 @@
     <string name="today_action_reset_hr_zoom">Zresetuj powiększenie tętna</string>
     <string name="today_action_see_what_shaped">Zobacz, co wpłynęło na %1$s</string>
     <string name="today_action_show_sources">Pokaż źródła synchronizowane z NOOP</string>
+    <string name="today_action_show_workout">Pokaż szczegóły treningu</string>
     <string name="today_contributors">Czynniki</string>
     <string name="today_data_sources">Źródła danych</string>
     <string name="today_hr_beats_per_minute">Uderzenia na minutę</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 5ea8cdcde7..7d7936250e 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2250,6 +2250,7 @@
     <string name="today_action_reset_hr_zoom">Repor zoom da frequência cardíaca</string>
     <string name="today_action_see_what_shaped">Ver o que influenciou %1$s</string>
     <string name="today_action_show_sources">Mostrar as fontes sincronizadas com o NOOP</string>
+    <string name="today_action_show_workout">Mostrar os detalhes do treino</string>
     <string name="today_contributors">Contributos</string>
     <string name="today_data_sources">Fontes de dados</string>
     <string name="today_hr_beats_per_minute">Batimentos por minuto</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index ff2aae59af..54847fb5aa 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2185,6 +2185,7 @@
     <string name="today_action_reset_hr_zoom">重置心率缩放</string>
     <string name="today_action_see_what_shaped">查看影响 %1$s 的因素</string>
     <string name="today_action_show_sources">查看 NOOP 同步的数据源</string>
+    <string name="today_action_show_workout">查看锻炼详情</string>
     <string name="today_contributors">影响因素</string>
     <string name="today_data_sources">数据源</string>
     <string name="today_hr_beats_per_minute">每分钟心跳</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 55e2a8fc76..cdfd989943 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2370,6 +2370,7 @@
     <string name="today_action_reset_hr_zoom">Reset the heart rate zoom</string>
     <string name="today_action_see_what_shaped">See what shaped your %1$s</string>
     <string name="today_action_show_sources">Show what NOOP is synced from</string>
+    <string name="today_action_show_workout">Show workout detail</string>
     <string name="today_contributors">Contributors</string>
     <string name="today_data_sources">Data sources</string>
     <string name="today_hr_beats_per_minute">Beats per minute</string>
diff --git a/android/app/src/test/java/com/noop/ui/TodayWorkoutTapTest.kt b/android/app/src/test/java/com/noop/ui/TodayWorkoutTapTest.kt
new file mode 100644
index 0000000000..deba608149
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/TodayWorkoutTapTest.kt
@@ -0,0 +1,81 @@
+package com.noop.ui
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.io.File
+
+/**
+ * #1694: the Today "Latest Workouts" tiles open the SAME read-only detail the Workouts list opens.
+ *
+ * Compose wiring has no logic function to assert against, so this reads the sources — the idiom
+ * [ResolvedSeriesCallSiteAuditTest] already uses. What it pins is not cosmetic:
+ *
+ * The Today sections are LazyColumn items. Hosting the sheet inside [TodayWorkoutsSection] compiles and
+ * looks correct, but a disposed item takes an open sheet down with it, so the sheet MUST stay at screen
+ * level — which is also where every other Today dialog lives. That mistake is invisible to a compiler
+ * and to every other test in this suite.
+ */
+class TodayWorkoutTapTest {
+
+    private fun repoRoot(): File {
+        val userDir = File(System.getProperty("user.dir") ?: ".")
+        val candidates = listOf(userDir, File(userDir, ".."), File(userDir, "../.."))
+        return candidates.firstOrNull { File(it, "Strand/Screens/TodayView.swift").isFile }
+            ?: error("could not locate the repo root from ${userDir.absolutePath}")
+    }
+
+    private fun todayScreenKt() = File(repoRoot(), "android/app/src/main/java/com/noop/ui/TodayScreen.kt").readText()
+
+    /**
+     * The section body, from its declaration to the start of the next top-level composable, with `//`
+     * comments removed. Stripping matters: this file's comments NAME the very symbols asserted on, so a
+     * raw substring search matches the prose describing the code rather than the code.
+     */
+    private fun workoutsSectionBody(source: String): String {
+        val start = source.indexOf("private fun TodayWorkoutsSection(")
+        assertTrue("TodayWorkoutsSection not found", start > 0)
+        val next = source.indexOf("\n@Composable", start)
+        val body = source.substring(start, if (next > start) next else source.length)
+        return body.lines().joinToString("\n") { it.substringBefore("//") }
+    }
+
+    @Test
+    fun tilesAreClickableAndReportTheTappedRow() {
+        val body = workoutsSectionBody(todayScreenKt())
+        assertTrue("the feed tiles must be clickable", body.contains(".clickable("))
+        assertTrue("a tap must report the row it was on", body.contains("onSelect(workout)"))
+        assertTrue(
+            "the tap needs an accessibility action label, like the Sources row beside it",
+            body.contains("R.string.today_action_show_workout"),
+        )
+    }
+
+    @Test
+    fun theSheetIsHostedAtScreenLevelNotInsideTheLazySection() {
+        val source = todayScreenKt()
+        assertTrue(
+            "Today must open the Workouts list's own read-only sheet",
+            source.contains("WorkoutDetailSheet(vm = viewModel, row = row"),
+        )
+        assertFalse(
+            "hosting the sheet inside the section loses it when the LazyColumn disposes that item",
+            workoutsSectionBody(source).contains("WorkoutDetailSheet("),
+        )
+    }
+
+    /** Parity: iOS reaches the same read-only detail from the same feed, and presents it at screen level. */
+    @Test
+    fun iosTodayOpensTheSameDetailComponent() {
+        val swift = File(repoRoot(), "Strand/Screens/TodayView.swift").readText()
+        assertTrue("iOS tiles must open a detail", swift.contains("workoutDetail = WorkoutDetailTarget(row: w)"))
+        assertTrue(
+            "iOS must present the SAME read-only view the Workouts list uses",
+            swift.contains("WorkoutDetailView(row: target.row)"),
+        )
+        assertTrue(
+            "the press treatment must match Android's liquidPress, not fall back to .plain",
+            swift.contains("LiquidPressStyle()"),
+        )
+    }
+}

From f402f2ad7e1eef1907d8f50e9f0bcd1f094b97bd Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 19:34:25 +1200
Subject: [PATCH 038/333] today: window the iOS Latest Workouts feed to the
 same 14 days as Android (#1703)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reported as #1702. The two platforms rendered the same section from different data: Android
windows to today-13 at start of day and says "14 days" in the header, while iOS drew from
repo.workoutRows(), whose default is days: 4000 — effectively all-time — under a heading that
says "Latest", trailed by a count of every workout ever recorded. One account read two ways:
someone who last trained three months ago saw no section on Android and six stale sessions on
iOS.

The call sites suggest iOS's behaviour was never a product decision. Android keeps two sets,
recentUnion for the feed and separate all-time queries for the Data Sources counts, while iOS
has a single `workouts` array serving both and the section used what was already there.

That is why the window is applied at the SECTION, not to the array. `workouts` also feeds the
Data Sources Apple-workout count and the HR chart's sport glyphs, both all-time by design, so
windowing it at the source compiles, looks correct, and quietly shrinks two unrelated numbers
on the same screen. A parity assertion in ordinary CI now checks that count still reads the
unwindowed array, so the trap is guarded rather than sidestepped once.

The trailing header describes the window on both platforms; "14 days" was already in the
catalogue in all ten locales, so no new copy. Tile caps stay 4 and 6 deliberately — that is
layout, not content: Android is single-column full-width on purpose (#332), iOS uses an
adaptive grid.

This changes iOS behaviour: the section now disappears when there has been no training for two
weeks, matching Android. That is the intent, not a side effect.

Verified: 4,713 Android tests, 0 failures with --rerun-tasks --no-build-cache; i18n audit
clean; app-build green on both legs, with all five TodayWorkoutsWindowTests confirmed by name
in the log rather than inferred from an aggregate pass. Those pin the cutoff boundary — kept
exactly on it, dropped one second earlier — because an off-by-one there silently drops a
session the other platform still shows.
---
 Strand/Screens/TodayView.swift                | 22 ++++++-
 StrandTests/TodayWorkoutsWindowTests.swift    | 59 +++++++++++++++++++
 .../java/com/noop/ui/TodayWorkoutTapTest.kt   | 35 +++++++++++
 3 files changed, 113 insertions(+), 3 deletions(-)
 create mode 100644 StrandTests/TodayWorkoutsWindowTests.swift

diff --git a/Strand/Screens/TodayView.swift b/Strand/Screens/TodayView.swift
index d351af4cb4..cb19affc93 100644
--- a/Strand/Screens/TodayView.swift
+++ b/Strand/Screens/TodayView.swift
@@ -3867,14 +3867,30 @@ struct TodayView: View {
 
     // MARK: (c) LAST WORKOUTS, SAME grid, uniform 104pt workout tiles.
 
+    /// Android's Today feed contract (`TodayScreen.recentCutoff`): sessions starting on or after the
+    /// start of the day 13 days back — 14 days counting today. Named rather than inlined so the window
+    /// is one thing on this platform too, and so the parity guard has something to point at.
+    static func recentWorkoutsFeed(_ rows: [WorkoutRow], now: Date = Date()) -> [WorkoutRow] {
+        let cal = Calendar.current
+        guard let cutoff = cal.date(byAdding: .day, value: -13, to: cal.startOfDay(for: now)) else { return rows }
+        let cutoffTs = Int(cutoff.timeIntervalSince1970)
+        return rows.filter { $0.startTs >= cutoffTs }
+    }
+
     @ViewBuilder
     private var workoutsSection: some View {
-        if !workouts.isEmpty {
+        // #1702: window HERE, not on `workouts`. That array is shared — it also feeds the Data Sources
+        // Apple-workout count and the HR chart's sport glyphs, both all-time by design — so windowing it
+        // at the source would silently shrink two unrelated numbers on this same screen.
+        let recent = Self.recentWorkoutsFeed(workouts)
+        if !recent.isEmpty {
             VStack(alignment: .leading, spacing: NoopMetrics.gap) {
+                // "14 days" describes the window, like Android's today_workouts_14_days. The old
+                // "\(count) total" counted every workout ever recorded while showing at most six.
                 SectionHeader("Latest Workouts", overline: "Activity",
-                              trailing: String(localized: "\(workouts.count) total"))
+                              trailing: String(localized: "14 days"))
                 LazyVGrid(columns: grid, alignment: .leading, spacing: NoopMetrics.gap) {
-                    ForEach(Array(workouts.prefix(6).enumerated()), id: \.offset) { _, w in
+                    ForEach(Array(recent.prefix(6).enumerated()), id: \.offset) { _, w in
                         Button {
                             workoutDetail = WorkoutDetailTarget(row: w)
                         } label: {
diff --git a/StrandTests/TodayWorkoutsWindowTests.swift b/StrandTests/TodayWorkoutsWindowTests.swift
new file mode 100644
index 0000000000..843f2e93b3
--- /dev/null
+++ b/StrandTests/TodayWorkoutsWindowTests.swift
@@ -0,0 +1,59 @@
+import XCTest
+import WhoopStore
+@testable import Strand
+
+/// #1702: the Today "Latest Workouts" window, pinned to Android's contract.
+///
+/// Android windows the feed to `today − 13` at start of day (`TodayScreen.recentCutoff`) and says so in
+/// the header. iOS showed the same section from `repo.workoutRows()`, whose default is `days: 4000` —
+/// effectively all-time — under a heading that says "Latest", with a trailing count of every workout
+/// ever recorded. Same account, opposite readings on the two platforms.
+///
+/// These pin the boundary rather than the happy path: an off-by-one here silently drops a session the
+/// other platform shows, which is exactly the class of drift that produced the issue.
+final class TodayWorkoutsWindowTests: XCTestCase {
+
+    /// Fixed clock so "13 days back, start of day" is not evaluated against a moving now.
+    private let now = Date(timeIntervalSince1970: 1_756_000_000)  // 2025-08-24T02:26:40Z
+
+    /// WorkoutRow takes every field on purpose (#1444), so spell them all out.
+    private func row(startingAt ts: Int) -> WorkoutRow {
+        WorkoutRow(startTs: ts, endTs: ts + 1_800, sport: "Running", source: "whoop",
+                   durationS: 1_800, energyKcal: nil, avgHr: nil, maxHr: nil, strain: nil,
+                   distanceM: nil, zonesJSON: nil, notes: nil, steps: nil)
+    }
+
+    private var cutoffTs: Int {
+        let cal = Calendar.current
+        return Int(cal.date(byAdding: .day, value: -13, to: cal.startOfDay(for: now))!.timeIntervalSince1970)
+    }
+
+    func testKeepsASessionExactlyOnTheCutoff() {
+        let kept = TodayView.recentWorkoutsFeed([row(startingAt: cutoffTs)], now: now)
+        XCTAssertEqual(kept.count, 1, "the cutoff instant is inside the window, matching Android's >=")
+    }
+
+    func testDropsTheSecondBeforeTheCutoff() {
+        let kept = TodayView.recentWorkoutsFeed([row(startingAt: cutoffTs - 1)], now: now)
+        XCTAssertTrue(kept.isEmpty)
+    }
+
+    func testDropsAnAllTimeSessionThatUsedToShow() {
+        // The behaviour the issue described: a session from months ago listed under "Latest".
+        let threeMonthsAgo = Int(now.timeIntervalSince1970) - 90 * 86_400
+        XCTAssertTrue(TodayView.recentWorkoutsFeed([row(startingAt: threeMonthsAgo)], now: now).isEmpty)
+    }
+
+    func testKeepsTodaysSession() {
+        let kept = TodayView.recentWorkoutsFeed([row(startingAt: Int(now.timeIntervalSince1970))], now: now)
+        XCTAssertEqual(kept.count, 1)
+    }
+
+    func testPreservesInputOrderAndDropsOnlyTheStale() {
+        let recentA = Int(now.timeIntervalSince1970) - 3_600
+        let recentB = Int(now.timeIntervalSince1970) - 7_200
+        let stale = cutoffTs - 86_400
+        let kept = TodayView.recentWorkoutsFeed([row(startingAt: recentA), row(startingAt: stale), row(startingAt: recentB)], now: now)
+        XCTAssertEqual(kept.map(\.startTs), [recentA, recentB], "filtering must not reorder the feed")
+    }
+}
diff --git a/android/app/src/test/java/com/noop/ui/TodayWorkoutTapTest.kt b/android/app/src/test/java/com/noop/ui/TodayWorkoutTapTest.kt
index deba608149..b89136353c 100644
--- a/android/app/src/test/java/com/noop/ui/TodayWorkoutTapTest.kt
+++ b/android/app/src/test/java/com/noop/ui/TodayWorkoutTapTest.kt
@@ -78,4 +78,39 @@ class TodayWorkoutTapTest {
             swift.contains("LiquidPressStyle()"),
         )
     }
+
+    /**
+     * #1702: both platforms must window the feed to the same 14 days, and iOS must do it AT THE SECTION.
+     *
+     * `workouts` on TodayView is shared: the Data Sources Apple-workout count and the HR chart's sport
+     * glyphs both read it and are all-time by design. Windowing the array at its source would compile,
+     * look correct, and silently shrink two unrelated numbers on the same screen.
+     */
+    @Test
+    fun bothPlatformsWindowTheFeedToTheSameFourteenDays() {
+        val kotlin = File(repoRoot(), "android/app/src/main/java/com/noop/ui/TodayMetricsLogic.kt").readText()
+        assertTrue(
+            "Android's feed contract must stay the 14-day window iOS is pinned to",
+            todayScreenKt().contains(".minusDays(13)"),
+        )
+        assertTrue("lastWorkoutsFeed must remain the Android feed contract", kotlin.contains("fun lastWorkoutsFeed"))
+
+        val swift = File(repoRoot(), "Strand/Screens/TodayView.swift").readText()
+        assertTrue(
+            "iOS must window with the same 13-days-back-from-start-of-day cutoff",
+            swift.contains("value: -13, to: cal.startOfDay(for: now)"),
+        )
+        assertTrue(
+            "the iOS section must render the WINDOWED feed, not the shared all-time array",
+            swift.contains("let recent = Self.recentWorkoutsFeed(workouts)") && swift.contains("recent.prefix(6)"),
+        )
+        assertTrue(
+            "the Data Sources Apple count must keep reading the unwindowed array",
+            swift.contains("workouts.filter { WorkoutSource.isAppleHealth"),
+        )
+        assertFalse(
+            "the trailing header must describe the window, not count every workout ever recorded",
+            swift.contains("\\(workouts.count) total"),
+        )
+    }
 }

From 8cecf563847f650fd142a1bdbeef63f517fa96a0 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 20:39:51 +1200
Subject: [PATCH 039/333] analytics: say when a stream read came back at the
 cap (#1704)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The windows line reported read and served. A field log showed that is not enough:
hr[read=1792781 served=1939063] beside rr[read=3727610 served=93980] on the same cold pass,
one stream splicing half its rows and the other almost none, with no way to tell which of the
three refusal causes fired.

One of those causes is also a bug. The reads are ORDER BY ts ASC LIMIT, so a read returning
the cap has dropped its NEWEST rows and the day is then scored on a window missing its tail,
with nothing anywhere saying so. The same log has a strap at 192,680 rows against the 200,000
cap, 96%, with its row count still climbing. The window already computed the fact to decide
whether the buffer could be spliced; it simply never reported it.

A counter beside rowsRead and rowsServed, and two fields on the line. Nothing on the scoring
path moves, so it cannot change a number. It detects rather than cures: whether the answer is
paginating past the cap or raising it should not be chosen before knowing whether truncation
fires at all, and on which stream.

Three review passes went into the counter's own correctness, and each found a false claim
attached to correct code rather than a defect in it. The first shipped it untested. The second
found the comment justifying the design described a case that cannot occur, since a truncated
extension only ever re-reads a superset of what already overran the cap. The third found the
test written to fix the second was vacuous — cachedTruncated is the planner's first guard, so
the follow-up call never reaches the extension branch — and that the branch is unreachable
from a uniform backward walk at all. Both suites now pin seven identical cases and both
comments state the reachability limit instead of implying coverage that does not exist.

Verified: 4,715 Android tests, 0 failures with --rerun-tasks --no-build-cache, including the
analyzeRecentOnCpu bytecode budget guard; both twins live in Packages/StrandAnalytics, so
test (StrandAnalytics) covers the Swift half in default CI without app-build.
---
 .../StrandAnalytics/SlidingStreamWindow.swift | 10 ++++++
 .../StrandAnalytics/WindowedStreamPlan.swift  | 18 +++++++++--
 .../SlidingStreamWindowTests.swift            | 27 ++++++++++++++++
 .../WindowedStreamPlanTests.swift             | 11 ++++---
 Strand/Data/IntelligenceEngine.swift          |  4 ++-
 .../com/noop/analytics/IntelligenceEngine.kt  |  7 ++++-
 .../com/noop/analytics/SlidingStreamWindow.kt | 14 +++++++++
 .../com/noop/analytics/WindowedStreamPlan.kt  | 18 +++++++++--
 .../noop/analytics/SlidingStreamWindowTest.kt | 31 +++++++++++++++++++
 .../noop/analytics/WindowedStreamPlanTest.kt  |  9 +++---
 10 files changed, 135 insertions(+), 14 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SlidingStreamWindow.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SlidingStreamWindow.swift
index 205b88bdaa..fa73ae5dbf 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/SlidingStreamWindow.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SlidingStreamWindow.swift
@@ -43,6 +43,15 @@ public final class SlidingStreamWindow<T> {
     public private(set) var rowsServed = 0
     /// Rows this window read from the store. Diagnostic only. Same width note as `rowsServed`.
     public private(set) var rowsRead = 0
+    /// Reads whose RESULT came back at the store's cap, so the newest rows were dropped and the day was
+    /// scored on an incomplete window. Diagnostic only, but unlike its siblings this one is a correctness
+    /// signal rather than a savings one: a non-zero count means a number may be wrong, not merely slow.
+    ///
+    /// Counted per WINDOW that lost rows, not per pass: once a read is truncated the planner refuses to
+    /// splice at all, so each later window is a fresh full read and is judged on its own. The truncated-
+    /// EXTENSION branch below cannot add a second count for one window either, since it only ever re-reads
+    /// a SUPERSET of what already overran the cap. Pinned by `eachTruncatedWindowCountsSeparately`.
+    public private(set) var truncatedReads = 0
 
     public init(tsOf: @escaping (T) -> Int, limit: Int, read: @escaping (String, Int, Int) async -> [T]?) {
         self.tsOf = tsOf
@@ -97,6 +106,7 @@ public final class SlidingStreamWindow<T> {
         self.from = from
         self.to = to
         self.truncated = nowTruncated
+        if nowTruncated { truncatedReads += 1 }
         self.rows = result
         return result
     }
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/WindowedStreamPlan.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/WindowedStreamPlan.swift
index 91ccc39936..05d0425bee 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/WindowedStreamPlan.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/WindowedStreamPlan.swift
@@ -25,11 +25,25 @@ public enum WindowedStreamPlan {
     /// dayCache hit — and the reads are back to exactly what they were. That is the honest outcome rather
     /// than a silent one, which is why the counters ship rather than just the speedup.
     ///
+    /// `truncated` separates the one of those causes that is also a BUG. The reads are
+    /// `ORDER BY ts ASC LIMIT`, so a read at the cap drops the NEWEST rows and the day is scored on a
+    /// window missing its tail, with nothing else in the log to say so. A field log showed a strap at
+    /// 192,680 rows against the 200,000 cap — 96% — with `served` near zero on one stream and half on the
+    /// other, and no way to tell which cause fired. Hence this counter rather than a guess.
+    ///
     /// Lives HERE rather than on the engine so both platforms put it in the same place and both are
     /// covered by default CI — the Swift engine is app-target and has none. Byte-identical to the Kotlin
     /// `WindowedStreamPlan.logLine`.
-    public static func logLine(hrRead: Int, hrServed: Int, rrRead: Int, rrServed: Int) -> String {
-        "analyzeRecent windows hr[read=\(hrRead) served=\(hrServed)] rr[read=\(rrRead) served=\(rrServed)]"
+    public static func logLine(
+        hrRead: Int,
+        hrServed: Int,
+        hrTruncated: Int,
+        rrRead: Int,
+        rrServed: Int,
+        rrTruncated: Int
+    ) -> String {
+        "analyzeRecent windows hr[read=\(hrRead) served=\(hrServed) truncated=\(hrTruncated)] "
+            + "rr[read=\(rrRead) served=\(rrServed) truncated=\(rrTruncated)]"
     }
 
     /// What the caller should do to obtain rows for the requested window.
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SlidingStreamWindowTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SlidingStreamWindowTests.swift
index 9de35b0a43..5c809559a4 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SlidingStreamWindowTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SlidingStreamWindowTests.swift
@@ -51,6 +51,33 @@ final class SlidingStreamWindowTests: XCTestCase {
 
     /// A truncated read cannot be sliced, because `ORDER BY ts ASC LIMIT` drops the NEWEST rows — the
     /// buffer would be missing its tail with nothing to say so.
+    /// The truncation counter is the one diagnostic here that means a SCORE may be wrong rather than
+    /// merely slow, so pin when it moves and when it does not. Twin of the Kotlin case of the same name.
+    func testTruncatedReadsCountsOnlyReadsThatLostRows() async {
+        let clean = window()
+        _ = await clean.rows(owner: "owner", from: midnight - h30, to: midnight + day)
+        XCTAssertEqual(clean.truncatedReads, 0, "a read under the cap lost nothing")
+
+        let capped = window(limit: 1_000)
+        _ = await capped.rows(owner: "owner", from: midnight - h30, to: midnight + day)
+        XCTAssertEqual(capped.truncatedReads, 1, "a read AT the cap dropped its newest rows")
+    }
+
+    /// Once a read is truncated the planner refuses to splice at all — `cachedTruncated` is its FIRST
+    /// guard — so every later window is a fresh full read. Each of those that is itself at the cap is a
+    /// separate lost tail and counts again: the number is windows-that-lost-rows, not passes.
+    ///
+    /// Deliberately NOT a test of the truncated-extension branch. That branch needs a buffer that is
+    /// valid but whose extension overruns the cap, and a truncated read can never leave a valid buffer,
+    /// so a uniform backward walk cannot reach it.
+    func testEachTruncatedWindowCountsSeparately() async {
+        let w = window(limit: 1_000)
+        _ = await w.rows(owner: "owner", from: midnight - h30, to: midnight + day)
+        let afterFirst = w.truncatedReads
+        _ = await w.rows(owner: "owner", from: midnight - day - h30, to: midnight)
+        XCTAssertEqual(w.truncatedReads, afterFirst + 1, "one increment per window that lost rows")
+    }
+
     func testTruncatedReadIsNeverSliced() async {
         let limit = 1_000
         let w = window(limit: limit)
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/WindowedStreamPlanTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/WindowedStreamPlanTests.swift
index 6f167767ce..366218942e 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/WindowedStreamPlanTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/WindowedStreamPlanTests.swift
@@ -77,10 +77,13 @@ final class WindowedStreamPlanTests: XCTestCase {
     /// never asked".
     func testLogLine() {
         XCTAssertEqual(
-            WindowedStreamPlan.logLine(hrRead: 1_000, hrServed: 9_000, rrRead: 250, rrServed: 750),
-            "analyzeRecent windows hr[read=1000 served=9000] rr[read=250 served=750]")
+            WindowedStreamPlan.logLine(hrRead: 1_000, hrServed: 9_000, hrTruncated: 0,
+                                       rrRead: 250, rrServed: 750, rrTruncated: 3),
+            "analyzeRecent windows hr[read=1000 served=9000 truncated=0] "
+                + "rr[read=250 served=750 truncated=3]")
         XCTAssertEqual(
-            WindowedStreamPlan.logLine(hrRead: 0, hrServed: 0, rrRead: 0, rrServed: 0),
-            "analyzeRecent windows hr[read=0 served=0] rr[read=0 served=0]")
+            WindowedStreamPlan.logLine(hrRead: 0, hrServed: 0, hrTruncated: 0,
+                                       rrRead: 0, rrServed: 0, rrTruncated: 0),
+            "analyzeRecent windows hr[read=0 served=0 truncated=0] rr[read=0 served=0 truncated=0]")
     }
 }
diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index 6347b00c41..ed154ce2e2 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -1483,7 +1483,9 @@ final class IntelligenceEngine: ObservableObject {
             // rather than a silent one. Byte-identical to the Kotlin `analyzeWindowsLogLine`.
             skippedDayLines.append(WindowedStreamPlan.logLine(
                 hrRead: hrWindow.rowsRead, hrServed: hrWindow.rowsServed,
-                rrRead: rrWindow.rowsRead, rrServed: rrWindow.rowsServed))
+                hrTruncated: hrWindow.truncatedReads,
+                rrRead: rrWindow.rowsRead, rrServed: rrWindow.rowsServed,
+                rrTruncated: rrWindow.truncatedReads))
             return (out, skippedDayLines, dayScanCacheLocal)
         }.value
         // #1005: write the loop's updated reuse cache back to the (main-actor) stored property. The pass ran
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index 8b973b9873..bda6e70c23 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -1277,7 +1277,12 @@ object IntelligenceEngine {
         // (each row materialised ~2.25x per pass) is worth narrowing; analyzeDay dominating means it is
         // not, whatever the row counts look like. Byte-identical line to the Swift twin.
         diag("analyzeRecent cost prep=${dayPrepNanos / 1_000_000}ms score=${dayScoreNanos / 1_000_000}ms")
-        diag(WindowedStreamPlan.logLine(hrWindow.rowsRead, hrWindow.rowsServed, rrWindow.rowsRead, rrWindow.rowsServed))
+        diag(
+            WindowedStreamPlan.logLine(
+                hrWindow.rowsRead, hrWindow.rowsServed, hrWindow.truncatedReads,
+                rrWindow.rowsRead, rrWindow.rowsServed, rrWindow.truncatedReads,
+            ),
+        )
 
         // ── Seed the baseline from the UNION of imported nightly history + the nightly
         // values just computed. This is the recovery fix: the "-noop" nightly avgHrv/
diff --git a/android/app/src/main/java/com/noop/analytics/SlidingStreamWindow.kt b/android/app/src/main/java/com/noop/analytics/SlidingStreamWindow.kt
index 44843f7620..197d726704 100644
--- a/android/app/src/main/java/com/noop/analytics/SlidingStreamWindow.kt
+++ b/android/app/src/main/java/com/noop/analytics/SlidingStreamWindow.kt
@@ -57,6 +57,19 @@ class SlidingStreamWindow<T>(
     var rowsRead = 0L
         private set
 
+    /**
+     * Reads whose RESULT came back at the store's cap, so the newest rows were dropped and the day was
+     * scored on an incomplete window. Diagnostic only, but unlike its siblings this one is a correctness
+     * signal rather than a savings one: a non-zero count means a number may be wrong, not merely slow.
+     *
+     * Counted per WINDOW that lost rows, not per pass: once a read is truncated the planner refuses to
+     * splice at all, so each later window is a fresh full read and is judged on its own. The truncated-
+     * EXTENSION branch below cannot add a second count for one window either, since it only ever re-reads
+     * a SUPERSET of what already overran the cap. Pinned by `eachTruncatedWindowCountsSeparately`.
+     */
+    var truncatedReads = 0L
+        private set
+
     /**
      * The rows for `[from, to]` under [owner], reading as little as the plan allows.
      *
@@ -107,6 +120,7 @@ class SlidingStreamWindow<T>(
         this.from = from
         this.to = to
         this.truncated = nowTruncated
+        if (nowTruncated) truncatedReads++
         this.rows = result
         return result
     }
diff --git a/android/app/src/main/java/com/noop/analytics/WindowedStreamPlan.kt b/android/app/src/main/java/com/noop/analytics/WindowedStreamPlan.kt
index 90a2bb0a84..feb8e4b56b 100644
--- a/android/app/src/main/java/com/noop/analytics/WindowedStreamPlan.kt
+++ b/android/app/src/main/java/com/noop/analytics/WindowedStreamPlan.kt
@@ -28,11 +28,25 @@ object WindowedStreamPlan {
      * dayCache hit — and the reads are back to exactly what they were. That is the honest outcome rather
      * than a silent one, which is why the counters ship rather than just the speedup.
      *
+     * `truncated` separates the one of those causes that is also a BUG. The reads are
+     * `ORDER BY ts ASC LIMIT`, so a read at the cap drops the NEWEST rows and the day is scored on a
+     * window missing its tail, with nothing else in the log to say so. A field log showed a strap at
+     * 192,680 rows against the 200,000 cap — 96% — with `served` near zero on one stream and half on the
+     * other, and no way to tell which cause fired. Hence this counter rather than a guess.
+     *
      * Lives HERE rather than on the engine so both platforms put it in the same place and both are
      * covered by default CI. Byte-identical to the Swift `WindowedStreamPlan.logLine`.
      */
-    fun logLine(hrRead: Long, hrServed: Long, rrRead: Long, rrServed: Long): String =
-        "analyzeRecent windows hr[read=$hrRead served=$hrServed] rr[read=$rrRead served=$rrServed]"
+    fun logLine(
+        hrRead: Long,
+        hrServed: Long,
+        hrTruncated: Long,
+        rrRead: Long,
+        rrServed: Long,
+        rrTruncated: Long,
+    ): String =
+        "analyzeRecent windows hr[read=$hrRead served=$hrServed truncated=$hrTruncated] " +
+            "rr[read=$rrRead served=$rrServed truncated=$rrTruncated]"
 
     /** What the caller should do to obtain rows for the requested window. */
     sealed interface Plan {
diff --git a/android/app/src/test/java/com/noop/analytics/SlidingStreamWindowTest.kt b/android/app/src/test/java/com/noop/analytics/SlidingStreamWindowTest.kt
index fa15eaa789..ce67ef527f 100644
--- a/android/app/src/test/java/com/noop/analytics/SlidingStreamWindowTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/SlidingStreamWindowTest.kt
@@ -59,6 +59,37 @@ class SlidingStreamWindowTest {
         assertEquals((to - from + 1), w.rowsRead - readAfterFirst)
     }
 
+    /**
+     * The truncation counter is the one diagnostic here that means a SCORE may be wrong rather than
+     * merely slow, so pin when it moves and when it does not. Twin of the Swift case of the same name.
+     */
+    @Test fun truncatedReadsCountsOnlyReadsThatLostRows() = runBlocking {
+        val clean = window()
+        clean.rows("owner", midnight - h30, midnight + day)
+        assertEquals("a read under the cap lost nothing", 0L, clean.truncatedReads)
+
+        val capped = window(1_000)
+        capped.rows("owner", midnight - h30, midnight + day)
+        assertEquals("a read AT the cap dropped its newest rows", 1L, capped.truncatedReads)
+    }
+
+    /**
+     * Once a read is truncated the planner refuses to splice at all — `cachedTruncated` is its FIRST
+     * guard — so every later window is a fresh full read. Each of those that is itself at the cap is a
+     * separate lost tail and counts again: the number is windows-that-lost-rows, not passes.
+     *
+     * Deliberately NOT a test of the truncated-extension branch. That branch needs a buffer that is
+     * valid but whose extension overruns the cap, and a truncated read can never leave a valid buffer,
+     * so a uniform backward walk cannot reach it.
+     */
+    @Test fun eachTruncatedWindowCountsSeparately() = runBlocking {
+        val w = window(1_000)
+        w.rows("owner", midnight - h30, midnight + day)
+        val afterFirst = w.truncatedReads
+        w.rows("owner", midnight - day - h30, midnight)
+        assertEquals("one increment per window that lost rows", afterFirst + 1L, w.truncatedReads)
+    }
+
     /**
      * A truncated read cannot be sliced, because `ORDER BY ts ASC LIMIT` drops the NEWEST rows — the
      * buffer would be missing its tail with nothing to say so. The next day must read in full and still
diff --git a/android/app/src/test/java/com/noop/analytics/WindowedStreamPlanTest.kt b/android/app/src/test/java/com/noop/analytics/WindowedStreamPlanTest.kt
index 3436895a41..fbe6c406b9 100644
--- a/android/app/src/test/java/com/noop/analytics/WindowedStreamPlanTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/WindowedStreamPlanTest.kt
@@ -81,12 +81,13 @@ class WindowedStreamPlanTest {
      */
     @Test fun logLineShape() {
         assertEquals(
-            "analyzeRecent windows hr[read=1000 served=9000] rr[read=250 served=750]",
-            WindowedStreamPlan.logLine(1_000L, 9_000L, 250L, 750L),
+            "analyzeRecent windows hr[read=1000 served=9000 truncated=0] " +
+                "rr[read=250 served=750 truncated=3]",
+            WindowedStreamPlan.logLine(1_000L, 9_000L, 0L, 250L, 750L, 3L),
         )
         assertEquals(
-            "analyzeRecent windows hr[read=0 served=0] rr[read=0 served=0]",
-            WindowedStreamPlan.logLine(0L, 0L, 0L, 0L),
+            "analyzeRecent windows hr[read=0 served=0 truncated=0] rr[read=0 served=0 truncated=0]",
+            WindowedStreamPlan.logLine(0L, 0L, 0L, 0L, 0L, 0L),
         )
     }
 }

From b214bb79fa1c0f6b6416d008a7b0e7542e729105 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 21:09:45 +1200
Subject: [PATCH 040/333] alarm: attribute the readback to a strap before
 judging it (#1707)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reported as #1706. The debug export said "Model: WHOOP 5.0 / MG", "Last arm: sent 2026-08-26
06:30", then "Strap reports: 2045-06-10 14:03  MISMATCH — strap didn't accept the time".

None of the thirteen alarm.* preferences is device-scoped, and on Android the readback is written
only on the WHOOP 4.0 path. So on an install with a 4.0 and an active 5.0, that verdict compared
an arm sent to one strap against a readback from another, and then named a strap that was never
asked.

It was not cosmetic on Apple, which is what turned this from a wording fix into a bug: the same
comparison drives alarm.rejectStreak, which raises a warning in SmartAlarmView at two, so a
cross-strap reading could climb that streak indefinitely.

Both halves now record the strap they came from, and a shared AlarmReadback returns MATCHES,
MISMATCH, DIFFERENT_STRAP or UNATTRIBUTED. Only a proven same-strap disagreement means refusal.
A cross-strap reading leaves the streak alone: advancing would warn about a strap that was never
asked, clearing would hide a real refusal, and it is evidence of neither.

Review passes found three defects in the change itself. The router's device id could go stale
across connections, which is the same wrong-attribution mistake in a new place, so it is cleared
in the per-connection reset hook and a forgotten assignment now attributes nothing. The streak
change stranded upgraders, whose accumulated values came from the comparison being replaced and
which only a proven match could clear, so the first unattributed readback discards them once. And
that fix left the comment above it asserting the opposite of the code beneath it.

The raw readback frame is persisted beside the epoch now. That is what separates a genuinely
stored stale alarm from a misdecode of a fixed response field, and the capture built for exactly
that question had rolled out of the live log before the export was taken. Nothing here decides
what 2045 was; the next export will carry the bytes that can. The existing plausibility gate is
82 years wide against a stated intent of "near-now", which is why the value was displayed at all
— deliberately left alone, since narrowing it would suppress that evidence before the cause is
known.

Verified: 4,722 Android tests and 15 default checks green, with the verdict twins covered by
test (StrandAnalytics) without app-build; app-build green on both legs with Test Strand passing,
which is the only thing that compiles FrameRouter, BLEManager and DebugDataDiagnostics.
---
 .../StrandAnalytics/AlarmReadback.swift       | 65 ++++++++++++++++++
 .../AlarmReadbackTests.swift                  | 65 ++++++++++++++++++
 Strand/BLE/BLEManager.swift                   |  6 ++
 Strand/BLE/FrameRouter.swift                  | 39 ++++++++++-
 Strand/System/DebugDataDiagnostics.swift      | 19 ++++--
 .../java/com/noop/analytics/AlarmReadback.kt  | 66 +++++++++++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 10 +++
 .../com/noop/testcentre/AndroidDiagnostics.kt | 21 ++++--
 .../com/noop/analytics/AlarmReadbackTest.kt   | 65 ++++++++++++++++++
 9 files changed, 345 insertions(+), 11 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Sources/StrandAnalytics/AlarmReadback.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AlarmReadbackTests.swift
 create mode 100644 android/app/src/main/java/com/noop/analytics/AlarmReadback.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/AlarmReadbackTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/AlarmReadback.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/AlarmReadback.swift
new file mode 100644
index 0000000000..42b760ed58
--- /dev/null
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/AlarmReadback.swift
@@ -0,0 +1,65 @@
+import Foundation
+
+/// Whether the alarm time a strap reports back can be compared with the one we sent (#1706).
+///
+/// The two halves are persisted under flat, device-less keys — `alarm.lastArmSentEpoch` and
+/// `alarm.lastReportedEpoch`. On an install with more than one strap registered they can therefore
+/// describe DIFFERENT devices, and comparing them then produces a confident "strap didn't accept the
+/// time" about a strap that was never asked. On Android the readback is written only on the WHOOP 4.0
+/// path, so a 5.0-active install could only ever be comparing across straps.
+///
+/// That verdict is not cosmetic here: it also drives `alarm.rejectStreak`, which raises a warning in
+/// SmartAlarmView at two. A cross-strap comparison could climb that streak forever.
+///
+/// So attribution is required, not assumed: unless both halves are known to come from the same strap,
+/// this refuses to judge. Refusing is the same stance `WindowedStreamPlan` takes — a diagnosis that
+/// cannot be proven is worse than none, because it sends the reader after the wrong device.
+///
+/// Twin of Kotlin `AlarmReadback`.
+public enum AlarmReadback {
+
+    /// Seconds of slack allowed between what we armed and what the strap reports back.
+    public static let toleranceS = 120
+
+    public enum Verdict: Equatable {
+        /// Same strap, and the readback agrees within `toleranceS`.
+        case matches
+        /// Same strap, and it does not. This is the only value that means the strap refused.
+        case mismatch
+        /// The two halves came from different straps. Nothing can be concluded about either.
+        case differentStrap
+        /// One or both halves predate device attribution, so they cannot be tied to a strap.
+        case unattributed
+    }
+
+    public static func verdict(
+        sentEpoch: Int,
+        reportedEpoch: Int,
+        sentDeviceId: String?,
+        reportedDeviceId: String?,
+        toleranceS: Int = AlarmReadback.toleranceS
+    ) -> Verdict {
+        guard let sentDeviceId, !sentDeviceId.isEmpty,
+              let reportedDeviceId, !reportedDeviceId.isEmpty else { return .unattributed }
+        guard sentDeviceId == reportedDeviceId else { return .differentStrap }
+        return abs(reportedEpoch - sentEpoch) > toleranceS ? .mismatch : .matches
+    }
+
+    /// The suffix the debug export appends after the reported time. Byte-identical to the Kotlin twin.
+    public static func suffix(_ verdict: Verdict) -> String {
+        switch verdict {
+        case .matches: return "  ✓ matches"
+        case .mismatch: return "  ⚠️ MISMATCH — strap didn't accept the time"
+        case .differentStrap: return "  (readback is from a different strap — not comparable)"
+        case .unattributed: return "  (no strap recorded for one of these — not comparable)"
+        }
+    }
+
+    /// Whether this verdict may advance the consecutive-rejection streak. Only a proven same-strap
+    /// disagreement counts: an unattributed or cross-strap reading must leave the streak untouched
+    /// rather than reset it, since neither is evidence either way.
+    public static func countsAsRejection(_ verdict: Verdict) -> Bool { verdict == .mismatch }
+
+    /// Whether this verdict is evidence the strap DID accept, which clears the streak.
+    public static func clearsRejectionStreak(_ verdict: Verdict) -> Bool { verdict == .matches }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AlarmReadbackTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AlarmReadbackTests.swift
new file mode 100644
index 0000000000..a54ca57792
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AlarmReadbackTests.swift
@@ -0,0 +1,65 @@
+import XCTest
+@testable import StrandAnalytics
+
+/// #1706. The values here are the ones from the field log that produced the issue: an arm sent
+/// 2026-08-26 06:30 against a readback claiming 2045-06-10, on a phone with a 4.0 and a 5.0 registered.
+/// Twin of Kotlin `AlarmReadbackTest`.
+final class AlarmReadbackTests: XCTestCase {
+
+    private let sent = 1_787_682_600      // 2026-08-26 06:30 +12:00
+    private let reported = 2_380_672_980  // 2045-06-10 14:03 +12:00, what the strap reported back
+
+    func testSameStrapAndAgreeing() {
+        XCTAssertEqual(AlarmReadback.verdict(sentEpoch: sent, reportedEpoch: sent + 5,
+                                             sentDeviceId: "whoop-a", reportedDeviceId: "whoop-a"), .matches)
+    }
+
+    func testSameStrapAtTheToleranceBoundary() {
+        XCTAssertEqual(AlarmReadback.verdict(sentEpoch: sent, reportedEpoch: sent + 120,
+                                             sentDeviceId: "whoop-a", reportedDeviceId: "whoop-a"), .matches)
+        XCTAssertEqual(AlarmReadback.verdict(sentEpoch: sent, reportedEpoch: sent + 121,
+                                             sentDeviceId: "whoop-a", reportedDeviceId: "whoop-a"), .mismatch)
+    }
+
+    func testSameStrapAndDisagreeingIsTheOnlyRealRefusal() {
+        let v = AlarmReadback.verdict(sentEpoch: sent, reportedEpoch: reported,
+                                      sentDeviceId: "whoop-a", reportedDeviceId: "whoop-a")
+        XCTAssertEqual(v, .mismatch)
+        XCTAssertTrue(AlarmReadback.countsAsRejection(v))
+    }
+
+    /// The field case: the readback can only come from the 4.0, the arm went to the active 5.0.
+    func testCrossStrapIsNotJudged() {
+        let v = AlarmReadback.verdict(sentEpoch: sent, reportedEpoch: reported,
+                                      sentDeviceId: "whoop-5mg", reportedDeviceId: "my-whoop")
+        XCTAssertEqual(v, .differentStrap)
+        XCTAssertFalse(AlarmReadback.countsAsRejection(v), "a strap that was never asked must not be blamed")
+        XCTAssertFalse(AlarmReadback.clearsRejectionStreak(v), "nor may it clear a real refusal")
+    }
+
+    /// Data written before attribution existed. Unknown is not the same as innocent.
+    func testMissingAttributionIsNotJudged() {
+        let pairs: [(String?, String?)] = [(nil, "whoop-a"), ("whoop-a", nil), (nil, nil), ("", "whoop-a")]
+        for (a, b) in pairs {
+            let v = AlarmReadback.verdict(sentEpoch: sent, reportedEpoch: reported,
+                                          sentDeviceId: a, reportedDeviceId: b)
+            XCTAssertEqual(v, .unattributed, "\(String(describing: a)) / \(String(describing: b))")
+            XCTAssertFalse(AlarmReadback.countsAsRejection(v))
+            XCTAssertFalse(AlarmReadback.clearsRejectionStreak(v))
+        }
+    }
+
+    func testOnlyAProvenAgreementClearsTheStreak() {
+        XCTAssertTrue(AlarmReadback.clearsRejectionStreak(.matches))
+        XCTAssertFalse(AlarmReadback.clearsRejectionStreak(.mismatch))
+        XCTAssertFalse(AlarmReadback.clearsRejectionStreak(.differentStrap))
+        XCTAssertFalse(AlarmReadback.clearsRejectionStreak(.unattributed))
+    }
+
+    func testSuffixShape() {
+        XCTAssertEqual(AlarmReadback.suffix(.matches), "  ✓ matches")
+        XCTAssertEqual(AlarmReadback.suffix(.mismatch), "  ⚠️ MISMATCH — strap didn't accept the time")
+        XCTAssertEqual(AlarmReadback.suffix(.differentStrap), "  (readback is from a different strap — not comparable)")
+        XCTAssertEqual(AlarmReadback.suffix(.unattributed), "  (no strap recorded for one of these — not comparable)")
+    }
+}
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index d8a5a005a5..ee5dc7b6ad 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -1427,6 +1427,7 @@ public final class BLEManager: NSObject, ObservableObject {
         // and tell the router which decoder to use. Fresh per connection so no stale bytes carry over.
         reassembler = Reassembler(family: model.deviceFamily)
         router.family = model.deviceFamily
+        router.deviceId = deviceId   // #1706: attribute this connection's alarm readback
         // Live 5/MG persistence: point the Collector's decode at the selected family and install the
         // identity clock ref for a 5/MG (its live timestamps are already real unix). WHOOP 4.0 keeps
         // the GET_CLOCK correlation flow untouched. Re-applied after bootstrapStore builds the
@@ -4302,6 +4303,7 @@ public final class BLEManager: NSObject, ObservableObject {
         selectedModel = model
         reassembler = Reassembler(family: model.deviceFamily)
         router.family = model.deviceFamily
+        router.deviceId = deviceId   // #1706: attribute this connection's alarm readback
         configureCollectorFamily()
         central.stopScan()
         log("Scanning for \(model.displayName)…")
@@ -4643,6 +4645,9 @@ public final class BLEManager: NSObject, ObservableObject {
     private func recordAlarmArm(sentEpoch: Int) {
         let d = UserDefaults.standard
         d.set(sentEpoch, forKey: "alarm.lastArmSentEpoch")
+        // #1706: WHICH strap this arm went to. Without it the export, and the reject streak, compare
+        // this epoch against a readback that on a multi-strap install may be a different device.
+        d.set(deviceId, forKey: "alarm.lastArmDeviceId")
         d.set(Date().timeIntervalSince1970, forKey: "alarm.lastArmAt")
         d.set(commandChannelReady, forKey: "alarm.lastArmConnected")   // #613: true only if the arm actually went out
         // #34: the strap-clock skew (its own RTC minus wall, seconds) AT THE MOMENT we armed. A wrong RTC
@@ -5445,6 +5450,7 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
         selectedModel = .persisted
         reassembler = Reassembler(family: selectedModel.deviceFamily)
         router.family = selectedModel.deviceFamily
+        router.deviceId = deviceId   // #1706: attribute this connection's alarm readback
         configureCollectorFamily()
         // Collection only runs post-bond, so a restored link was already bonded;
         // seed those flags now. `didWriteValueFor` won't re-fire on its own.
diff --git a/Strand/BLE/FrameRouter.swift b/Strand/BLE/FrameRouter.swift
index f43be26aae..83643d4440 100644
--- a/Strand/BLE/FrameRouter.swift
+++ b/Strand/BLE/FrameRouter.swift
@@ -10,6 +10,13 @@ public final class FrameRouter {
     /// Called when the strap pushes an EVENT packet (WHOOP's strap-as-clock catch-up signal). The
     /// BLEManager wires this to a rate-limited requestSync(.strap). nil in pure/unit contexts.
     var onSyncTrigger: (() -> Void)?
+    /// #1706: which strap this connection is talking to, so an alarm readback can be attributed to a
+    /// device. Set per connection by BLEManager immediately AFTER `family`, whose didSet clears this —
+    /// a path that sets the family and forgets the id then attributes nothing rather than carrying the
+    /// previous connection's strap forward, which is the very mistake this attribution exists to stop.
+    /// nil in pure/unit contexts, which the verdict treats as unattributed rather than guessing.
+    var deviceId: String?
+
     /// Which family's framing to decode with. Set per connection by BLEManager. WHOOP 5.0/MG frames
     /// use the CRC16/offset-8 envelope; the biometric field decode for puffin is still a stub, so
     /// WHOOP 5 custom frames currently surface only their envelope (live HR/battery come from the
@@ -18,7 +25,7 @@ public final class FrameRouter {
         // #900: a fresh connection is a fresh capture session — re-arm the per-command raw-frame dump so
         // each connect can re-capture the disputed COMMAND_RESPONSE prefix once. `family` is set fresh per
         // connection by BLEManager (connectCore), so this is the per-session reset hook.
-        didSet { rawDumpedRespCmds.removeAll(); loggedFirmwareGate = nil }
+        didSet { rawDumpedRespCmds.removeAll(); loggedFirmwareGate = nil; deviceId = nil }
     }
 
     /// #900: resp command names (e.g. "GET_BATTERY_LEVEL(26)") whose raw COMMAND_RESPONSE frame has already
@@ -175,15 +182,41 @@ public final class FrameRouter {
                         // #34: persist what the strap reports so the debug export can show sent-vs-reported.
                         let d = UserDefaults.standard
                         d.set(Int(epoch), forKey: "alarm.lastReportedEpoch")
+                        // #1706: the strap this readback came from, and the bytes it came in. The raw
+                        // frame is what separates a genuinely-stored stale alarm from a misdecode of a
+                        // fixed response field, and the live log rolls long before a debug export is
+                        // taken — a 2045 readback went unexplained for exactly that reason.
+                        d.set(deviceId, forKey: "alarm.lastReportedDeviceId")
+                        d.set(raw, forKey: "alarm.lastReportedRaw")
                         d.set(Date().timeIntervalSince1970, forKey: "alarm.lastReportedAt")
                         // #34: count CONSECUTIVE rejections (reported ≠ what we last sent) — the signature of
                         // a corrupted strap alarm register. A matching readback resets it, so a transient
                         // (first read stale, then correct) never trips the warning; only a persistent refusal
                         // climbs. SmartAlarmView surfaces the warning at ≥2; the debug export shows the count.
                         // Observability only — never gates the BLE arm.
+                        // #1706: the streak raises a UI warning at two, so it must only COUNT a
+                        // disagreement PROVEN to be the same strap. A cross-strap reading is evidence of
+                        // nothing and leaves the streak alone — advancing would warn about a strap that
+                        // was never asked, clearing would hide a real refusal. An unattributed one is a
+                        // different case, handled below.
                         if let sent = d.object(forKey: "alarm.lastArmSentEpoch") as? Int {
-                            d.set(abs(Int(epoch) - sent) > 120 ? d.integer(forKey: "alarm.rejectStreak") + 1 : 0,
-                                  forKey: "alarm.rejectStreak")
+                            let verdict = AlarmReadback.verdict(
+                                sentEpoch: sent,
+                                reportedEpoch: Int(epoch),
+                                sentDeviceId: d.string(forKey: "alarm.lastArmDeviceId"),
+                                reportedDeviceId: deviceId)   // the local, not a re-read of what we just wrote
+                            if AlarmReadback.countsAsRejection(verdict) {
+                                d.set(d.integer(forKey: "alarm.rejectStreak") + 1, forKey: "alarm.rejectStreak")
+                            } else if AlarmReadback.clearsRejectionStreak(verdict) {
+                                d.set(0, forKey: "alarm.rejectStreak")
+                            } else if verdict == .unattributed {
+                                // Any streak standing here was built by the cross-strap comparison this
+                                // replaces, so it cannot be trusted — and since only a proven match clears
+                                // the streak now, leaving it would hold SmartAlarmView's warning up forever
+                                // on an install that upgraded mid-streak. Discard once; the next attributed
+                                // readback rebuilds it honestly.
+                                d.set(0, forKey: "alarm.rejectStreak")
+                            }
                         }
                     } else if Self.readbackReportsNoAlarm(in: frame) {
                         // #34 (issue comment 2026-07-12): the strap's "nothing armed" sentinel — the epoch
diff --git a/Strand/System/DebugDataDiagnostics.swift b/Strand/System/DebugDataDiagnostics.swift
index 00ddc7c0b4..7b797caa00 100644
--- a/Strand/System/DebugDataDiagnostics.swift
+++ b/Strand/System/DebugDataDiagnostics.swift
@@ -391,7 +391,9 @@ enum DebugDataDiagnostics {
             } else if behind < -3 * 86400 {
                 lines.append("Strap clock: \(-behind / 86400)d AHEAD of wall (future-dated — alarm unreliable; recent sleep may be misdated, #67)")
             } else {
-                lines.append("Strap clock: OK")
+                // #1706: say what this measures. It reads RECORD timestamps, and sat two lines above an
+                // alarm readback claiming 2045, which reads as the two contradicting.
+                lines.append("Strap clock: OK (from record timestamps, not the alarm readback)")
             }
         }
         if let sent = d.object(forKey: "alarm.lastArmSentEpoch") as? Int {
@@ -413,14 +415,23 @@ enum DebugDataDiagnostics {
             }
             lines.append(line)
             if let reported = d.object(forKey: "alarm.lastReportedEpoch") as? Int {
-                let mismatch = abs(reported - sent) > 120
-                var rline = "Strap reports: \(alarmStamp(reported))"
-                    + (mismatch ? "  ⚠️ MISMATCH — strap didn't accept the time" : "  ✓ matches")
+                // #1706: only judge when both halves are known to be the SAME strap, otherwise this
+                // blames a device that was never asked.
+                let verdict = AlarmReadback.verdict(
+                    sentEpoch: sent,
+                    reportedEpoch: reported,
+                    sentDeviceId: d.string(forKey: "alarm.lastArmDeviceId"),
+                    reportedDeviceId: d.string(forKey: "alarm.lastReportedDeviceId"))
+                var rline = "Strap reports: \(alarmStamp(reported))" + AlarmReadback.suffix(verdict)
                 // #34: consecutive rejections — a persistent refusal (vs a one-off) points at a strap whose
                 // alarm register needs a reset, and is what SmartAlarmView warns the user about at ≥2.
                 let streak = d.integer(forKey: "alarm.rejectStreak")
                 if streak >= 2 { rline += " · \(streak) in a row (register likely needs a reset, #34)" }
                 lines.append(rline)
+                // The bytes the epoch was decoded from: what tells a stored stale alarm from a misdecode.
+                if let raw = d.string(forKey: "alarm.lastReportedRaw"), !raw.isEmpty {
+                    lines.append("Readback frame: \(raw)")
+                }
             } else {
                 lines.append("Strap reports: (no readback)")
             }
diff --git a/android/app/src/main/java/com/noop/analytics/AlarmReadback.kt b/android/app/src/main/java/com/noop/analytics/AlarmReadback.kt
new file mode 100644
index 0000000000..a37707fb61
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/AlarmReadback.kt
@@ -0,0 +1,66 @@
+package com.noop.analytics
+
+/**
+ * Whether the alarm time a strap reports back can be compared with the one we sent (#1706).
+ *
+ * The two halves are persisted under flat, device-less keys — `alarm.lastArmSentEpoch` and
+ * `alarm.lastReportedEpoch`. On an install with more than one strap registered they can therefore
+ * describe DIFFERENT devices, and comparing them then produces a confident "strap didn't accept the
+ * time" about a strap that was never asked. On Android the readback is written only on the WHOOP 4.0
+ * path, so a 5.0-active install could only ever be comparing across straps.
+ *
+ * That verdict is not cosmetic on Apple: it also drives `alarm.rejectStreak`, which raises a warning in
+ * SmartAlarmView at two. A cross-strap comparison could climb that streak forever.
+ *
+ * So attribution is required, not assumed: unless both halves are known to come from the same strap,
+ * this refuses to judge. Refusing is the same stance `WindowedStreamPlan` takes — a diagnosis that
+ * cannot be proven is worse than none, because it sends the reader after the wrong device.
+ *
+ * Twin of Swift `AlarmReadback`.
+ */
+object AlarmReadback {
+
+    /** Seconds of slack allowed between what we armed and what the strap reports back. */
+    const val TOLERANCE_S: Long = 120
+
+    enum class Verdict {
+        /** Same strap, and the readback agrees within [TOLERANCE_S]. */
+        MATCHES,
+        /** Same strap, and it does not. This is the only value that means the strap refused. */
+        MISMATCH,
+        /** The two halves came from different straps. Nothing can be concluded about either. */
+        DIFFERENT_STRAP,
+        /** One or both halves predate device attribution, so they cannot be tied to a strap. */
+        UNATTRIBUTED,
+    }
+
+    fun verdict(
+        sentEpoch: Long,
+        reportedEpoch: Long,
+        sentDeviceId: String?,
+        reportedDeviceId: String?,
+        toleranceS: Long = TOLERANCE_S,
+    ): Verdict {
+        if (sentDeviceId.isNullOrBlank() || reportedDeviceId.isNullOrBlank()) return Verdict.UNATTRIBUTED
+        if (sentDeviceId != reportedDeviceId) return Verdict.DIFFERENT_STRAP
+        return if (kotlin.math.abs(reportedEpoch - sentEpoch) > toleranceS) Verdict.MISMATCH else Verdict.MATCHES
+    }
+
+    /** The suffix the debug export appends after the reported time. Byte-identical to the Swift twin. */
+    fun suffix(verdict: Verdict): String = when (verdict) {
+        Verdict.MATCHES -> "  ✓ matches"
+        Verdict.MISMATCH -> "  ⚠️ MISMATCH — strap didn't accept the time"
+        Verdict.DIFFERENT_STRAP -> "  (readback is from a different strap — not comparable)"
+        Verdict.UNATTRIBUTED -> "  (no strap recorded for one of these — not comparable)"
+    }
+
+    /**
+     * Whether this verdict may advance the consecutive-rejection streak. Only a proven same-strap
+     * disagreement counts: an unattributed or cross-strap reading must leave the streak untouched
+     * rather than reset it, since neither is evidence either way.
+     */
+    fun countsAsRejection(verdict: Verdict): Boolean = verdict == Verdict.MISMATCH
+
+    /** Whether this verdict is evidence the strap DID accept, which clears the streak. */
+    fun clearsRejectionStreak(verdict: Verdict): Boolean = verdict == Verdict.MATCHES
+}
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index aff7c38b2d..51c212cc0d 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -4574,6 +4574,9 @@ class WhoopBleClient(
         runCatching {
             val editor = NoopPrefs.of(context).edit()
                 .putLong("alarm.lastArmSentEpoch", sentEpoch)
+                // #1706: WHICH strap this arm went to. Without it the export compares this epoch against
+                // a readback that, on a multi-strap install, may have come from a different device.
+                .putString("alarm.lastArmDeviceId", deviceId)
                 .putLong("alarm.lastArmAt", System.currentTimeMillis())
                 .putBoolean("alarm.lastArmConnected", _state.value.connected)
             // #34: live HR at the moment of the arm, purely to test a hypothesis raised on a reporter's
@@ -6460,6 +6463,13 @@ class WhoopBleClient(
                         runCatching {
                             NoopPrefs.of(context).edit()
                                 .putLong("alarm.lastReportedEpoch", epoch)
+                                // #1706: the strap this readback came from, and the bytes it came in.
+                                // The raw frame is what separates a genuinely-stored stale alarm from a
+                                // misdecode of a fixed response field, and the live log rolls long before
+                                // a debug export is taken — a 2045 readback went unexplained for exactly
+                                // that reason.
+                                .putString("alarm.lastReportedDeviceId", deviceId)
+                                .putString("alarm.lastReportedRaw", raw)
                                 .putLong("alarm.lastReportedAt", System.currentTimeMillis())
                                 .apply()
                         }
diff --git a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
index 1284e2252e..f0c85c62f6 100644
--- a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
@@ -368,7 +368,9 @@ object AndroidDiagnostics {
                 add(when {
                     behind > 3 * 86400L -> "Strap clock: ${behind / 86400L}d behind wall (reset/stale — alarm unreliable)"
                     behind < -3 * 86400L -> "Strap clock: ${-behind / 86400L}d AHEAD of wall (future-dated — alarm unreliable)"
-                    else -> "Strap clock: OK"
+                    // #1706: say what this is measuring. It reads RECORD timestamps, and sat two lines
+                    // above an alarm readback claiming 2045, which reads as the two contradicting.
+                    else -> "Strap clock: OK (from record timestamps, not the alarm readback)"
                 })
             }
             val sent = p.getLong("alarm.lastArmSentEpoch", 0L)
@@ -383,9 +385,20 @@ object AndroidDiagnostics {
                 add(line)
                 val reported = p.getLong("alarm.lastReportedEpoch", 0L)
                 if (reported > 0L) {
-                    val mismatch = kotlin.math.abs(reported - sent) > 120
-                    add("Strap reports: ${alarmStamp(reported)}" +
-                        if (mismatch) "  ⚠️ MISMATCH — strap didn't accept the time" else "  ✓ matches")
+                    // #1706: only judge when both halves are known to be the SAME strap. The readback is
+                    // written on the WHOOP 4.0 path alone, so a 5.0-active install comparing these was
+                    // always comparing two devices and then blaming one of them.
+                    val verdict = com.noop.analytics.AlarmReadback.verdict(
+                        sentEpoch = sent,
+                        reportedEpoch = reported,
+                        sentDeviceId = p.getString("alarm.lastArmDeviceId", null),
+                        reportedDeviceId = p.getString("alarm.lastReportedDeviceId", null),
+                    )
+                    add("Strap reports: ${alarmStamp(reported)}" + com.noop.analytics.AlarmReadback.suffix(verdict))
+                    // The bytes the epoch was decoded from: what tells a stored stale alarm from a misdecode.
+                    p.getString("alarm.lastReportedRaw", null)
+                        ?.takeIf { it.isNotBlank() }
+                        ?.let { add("Readback frame: $it") }
                 } else add("Strap reports: (no readback)")
             } else add("Last arm: never")
             // #1: did the strap actually fire? (STRAP_DRIVEN_ALARM_EXECUTED)
diff --git a/android/app/src/test/java/com/noop/analytics/AlarmReadbackTest.kt b/android/app/src/test/java/com/noop/analytics/AlarmReadbackTest.kt
new file mode 100644
index 0000000000..1c9bf827a6
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/AlarmReadbackTest.kt
@@ -0,0 +1,65 @@
+package com.noop.analytics
+
+import com.noop.analytics.AlarmReadback.Verdict
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #1706. The values here are the ones from the field log that produced the issue: an arm sent
+ * 2026-08-26 06:30 against a readback claiming 2045-06-10, on a phone with a 4.0 and a 5.0 registered.
+ * Twin of Swift `AlarmReadbackTests`.
+ */
+class AlarmReadbackTest {
+
+    private val sent = 1_787_682_600L      // 2026-08-26 06:30 +12:00
+    private val reported = 2_380_672_980L  // 2045-06-10 14:03 +12:00, what the strap reported back
+
+    @Test fun sameStrapAndAgreeing() {
+        assertEquals(Verdict.MATCHES, AlarmReadback.verdict(sent, sent + 5, "whoop-a", "whoop-a"))
+    }
+
+    @Test fun sameStrapAtTheToleranceBoundary() {
+        assertEquals(Verdict.MATCHES, AlarmReadback.verdict(sent, sent + 120, "whoop-a", "whoop-a"))
+        assertEquals(Verdict.MISMATCH, AlarmReadback.verdict(sent, sent + 121, "whoop-a", "whoop-a"))
+    }
+
+    @Test fun sameStrapAndDisagreeingIsTheOnlyRealRefusal() {
+        val v = AlarmReadback.verdict(sent, reported, "whoop-a", "whoop-a")
+        assertEquals(Verdict.MISMATCH, v)
+        assertTrue(AlarmReadback.countsAsRejection(v))
+    }
+
+    /** The field case: the readback can only come from the 4.0, the arm went to the active 5.0. */
+    @Test fun crossStrapIsNotJudged() {
+        val v = AlarmReadback.verdict(sent, reported, "whoop-5mg", "my-whoop")
+        assertEquals(Verdict.DIFFERENT_STRAP, v)
+        assertFalse("a strap that was never asked must not be blamed", AlarmReadback.countsAsRejection(v))
+        assertFalse("nor may it clear a real refusal", AlarmReadback.clearsRejectionStreak(v))
+    }
+
+    /** Data written before attribution existed. Unknown is not the same as innocent. */
+    @Test fun missingAttributionIsNotJudged() {
+        for (pair in listOf(null to "whoop-a", "whoop-a" to null, null to null, "" to "whoop-a")) {
+            val v = AlarmReadback.verdict(sent, reported, pair.first, pair.second)
+            assertEquals("$pair", Verdict.UNATTRIBUTED, v)
+            assertFalse("$pair", AlarmReadback.countsAsRejection(v))
+            assertFalse("$pair", AlarmReadback.clearsRejectionStreak(v))
+        }
+    }
+
+    @Test fun onlyAProvenAgreementClearsTheStreak() {
+        assertTrue(AlarmReadback.clearsRejectionStreak(Verdict.MATCHES))
+        assertFalse(AlarmReadback.clearsRejectionStreak(Verdict.MISMATCH))
+        assertFalse(AlarmReadback.clearsRejectionStreak(Verdict.DIFFERENT_STRAP))
+        assertFalse(AlarmReadback.clearsRejectionStreak(Verdict.UNATTRIBUTED))
+    }
+
+    @Test fun suffixShape() {
+        assertEquals("  ✓ matches", AlarmReadback.suffix(Verdict.MATCHES))
+        assertEquals("  ⚠️ MISMATCH — strap didn't accept the time", AlarmReadback.suffix(Verdict.MISMATCH))
+        assertEquals("  (readback is from a different strap — not comparable)", AlarmReadback.suffix(Verdict.DIFFERENT_STRAP))
+        assertEquals("  (no strap recorded for one of these — not comparable)", AlarmReadback.suffix(Verdict.UNATTRIBUTED))
+    }
+}

From 51204d72d5b104c9a6ec2c0b5ba54b8e12c90a67 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 21:35:11 +1200
Subject: [PATCH 041/333] analytics: reduce a skin-temp window to one scale
 before anything aggregates it (#1708)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reported by @pipiche38 in #1705, with the file and line references already done. Every citation
checked out against current main before this was written.

skin_temp is deliberately bimodal: a WHOOP CSV import writes ABSOLUTE wrist temperature into the
same field the computed pipeline fills with a signed deviation from the personal baseline.
Formatting survives that, because the per-value formatter re-derives the kind for each number,
which is exactly why nothing looked broken. Aggregates do not. A min, max, mean or
window-over-window delta drawn across both kinds is arithmetic on two scales, and the result is
plausible rather than obviously wrong.

The guard already existed and the Explorer paths had never adopted it. VitalSignsSummary and
HealthVitalsLogic pick one kind and filter to it before touching a sparkline, and SkinTempDisplay
already models the kind on both platforms with tests. So this adds one decision beside it —
dominantKind, the kind a mixed window reduces to, which is the newest entry's — rather than a
fourth inline copy of the >= 20 check.

Applied at the one place each platform merges the layers, not at each screen: Repository
exploreSeries on Swift, WhoopRepository resolvedSeries on Kotlin. That covers every consumer at
once, including two the report did not have to name: the Explorer correlation scan, and Compare's
min-max chart normalisation on Android.

Android was exposed too, which the report left untraced. Its importer emits no metricSeries row and
it has no exploreSeries twin, but sourceCandidates unions the imported and computed identities, so
first-wins resolves older days to one kind and recent days to the other.

Reducing rather than converting is deliberate. Converting the import at write time would fix
unaudited readers too, but it rewrites stored data irreversibly, needs a baseline a fresh
import-only install does not have, and puts both platforms' baseline derivation under the
byte-identical stored-data contract.

Review found the reduction was conditional on a check that happens to always pass: exploreSeries
delegates for any non-my-whoop source, and only the other return path was filtered. Unreachable
today because the sole skin_temp descriptor is my-whoop, but a guard correct only because of a fact
in another file is how the original defect happened. Both paths now share one helper.

The regression guard uses the report's own numbers — the 313-row 32.39..36.64 import against
computed deviations inside +/-0.3 — and pins the defect itself: unfiltered, that mean lands at 15.43
and is labelled a deviation because it falls below 20.

Verified: 4,725 Android tests and 15 default checks green, with the twins covered by
test (StrandAnalytics) without app-build; app-build green on both legs for the app-target call site.
---
 .../StrandAnalytics/SkinTempDisplay.swift     | 20 +++++++++++
 .../SkinTempDisplayTests.swift                | 33 +++++++++++++++++
 Strand/Data/Repository.swift                  | 28 +++++++++++++--
 .../com/noop/analytics/SkinTempDisplay.kt     | 21 +++++++++++
 .../java/com/noop/data/WhoopRepository.kt     | 19 +++++++++-
 .../com/noop/analytics/SkinTempDisplayTest.kt | 35 ++++++++++++++++++-
 6 files changed, 152 insertions(+), 4 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SkinTempDisplay.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SkinTempDisplay.swift
index 3f71229e92..5b8f2aa018 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/SkinTempDisplay.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SkinTempDisplay.swift
@@ -22,6 +22,26 @@ public enum SkinTempDisplay {
         VitalBands.isAbsoluteSkinTemp(value) ? .absolute : .deviation
     }
 
+    /// The one kind a MIXED series must be reduced to before any aggregate is taken (#1705).
+    ///
+    /// A CSV import writes absolute °C and the computed pipeline writes a deviation, both into this
+    /// same field, so one window can hold both. Formatting stays honest per value — `kind(of:)` is
+    /// re-derived for each — but a min, max, mean or window-over-window delta drawn across both is
+    /// arithmetic on two different scales, and it looks plausible: a handful of ~34 °C readings lift a
+    /// should-be-near-zero deviation average past a full degree, and the mean is then itself below 20
+    /// so it gets labelled Δ°C.
+    ///
+    /// The newest entry decides, matching what `VitalSignsSummary` already does for its sparkline —
+    /// the reading the user is actually looking at sets the scale, and older entries of the other kind
+    /// drop out rather than being converted, because converting needs a baseline that a fresh
+    /// import-only install does not have.
+    ///
+    /// - Parameter values: the window's values, ascending by day.
+    /// - Returns: the kind to keep, or nil for an empty window.
+    public static func dominantKind(valuesAscendingByDay values: [Double]) -> Kind? {
+        values.last.map(kind(of:))
+    }
+
     /// Trailing unit chip: `"°C"` / `"°F"` for absolute, `"Δ°C"` / `"Δ°F"` for deviation.
     public static func unitSymbol(kind: Kind, fahrenheit: Bool) -> String {
         let base = fahrenheit ? "°F" : "°C"
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SkinTempDisplayTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SkinTempDisplayTests.swift
index a42d607409..2793cd2859 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SkinTempDisplayTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SkinTempDisplayTests.swift
@@ -66,4 +66,37 @@ final class SkinTempDisplayTests: XCTestCase {
             XCTAssertEqual(SkinTempDisplay.kind(of: v) == .absolute, abs, "v=\(v)")
         }
     }
+
+    // MARK: - dominantKind (#1705)
+
+    func testDominantKindIsTheNewestEntrys() {
+        XCTAssertEqual(SkinTempDisplay.dominantKind(valuesAscendingByDay: [34.6, 35.1, -0.2]), .deviation)
+        XCTAssertEqual(SkinTempDisplay.dominantKind(valuesAscendingByDay: [-0.2, 0.1, 34.6]), .absolute)
+        XCTAssertNil(SkinTempDisplay.dominantKind(valuesAscendingByDay: []))
+    }
+
+    func testDominantKindOfASingleKindWindowIsThatKind() {
+        XCTAssertEqual(SkinTempDisplay.dominantKind(valuesAscendingByDay: [-0.24, 0.21, 0.01]), .deviation)
+        XCTAssertEqual(SkinTempDisplay.dominantKind(valuesAscendingByDay: [32.39, 34.60, 36.64]), .absolute)
+    }
+
+    /// The regression guard the issue asked for: filtering by `dominantKind` must leave a window that
+    /// no aggregate can straddle. Values are the reported ones — a 313-row absolute import
+    /// (32.39…36.64, mean 34.60) coexisting with computed deviations inside ±0.3.
+    func testFilteringByDominantKindLeavesOneScale() {
+        let mixed: [Double] = [34.60, 35.12, 32.39, 36.64, -0.24, 0.21, 0.01, 0.11, 0.0]
+        guard let keep = SkinTempDisplay.dominantKind(valuesAscendingByDay: mixed) else {
+            return XCTFail("a non-empty window must have a kind")
+        }
+        let kept = mixed.filter { SkinTempDisplay.kind(of: $0) == keep }
+        XCTAssertEqual(kept, [-0.24, 0.21, 0.01, 0.11, 0.0])
+        XCTAssertTrue(kept.allSatisfy { SkinTempDisplay.kind(of: $0) == keep })
+        // The defect: unfiltered, the mean of a should-be-near-zero deviation window clears a degree
+        // and then reads BELOW 20, so it gets labelled Δ°C — plausible-looking and wrong.
+        let unfilteredMean = mixed.reduce(0, +) / Double(mixed.count)
+        XCTAssertGreaterThan(unfilteredMean, 1.0)
+        XCTAssertEqual(SkinTempDisplay.kind(of: unfilteredMean), .deviation)
+        let filteredMean = kept.reduce(0, +) / Double(kept.count)
+        XCTAssertLessThan(abs(filteredMean), 0.3)
+    }
 }
diff --git a/Strand/Data/Repository.swift b/Strand/Data/Repository.swift
index eeff3df288..5bd913a6b3 100644
--- a/Strand/Data/Repository.swift
+++ b/Strand/Data/Repository.swift
@@ -2160,7 +2160,9 @@ final class Repository: ObservableObject {
     /// byte-identical. The flag is forwarded to the non-strap `series(...)` delegation below so every source
     /// path honours it.
     func exploreSeries(key: String, source: String, days: Int = 4000, fullHistory: Bool = false) async -> [(day: String, value: Double)] {
-        guard source == "my-whoop" else { return await series(key: key, source: source, days: days, fullHistory: fullHistory) }
+        guard source == "my-whoop" else {
+            return Self.oneSkinTempScale(key: key, await series(key: key, source: source, days: days, fullHistory: fullHistory))
+        }
         guard let store = await ensureStore() else { return [] }
         let now = Date()
         let from = fullHistory ? "0000-01-01" : Self.dayString(now.addingTimeInterval(-Double(days) * 86_400))
@@ -2187,7 +2189,29 @@ final class Repository: ObservableObject {
             for p in (try? await store.metricSeries(deviceId: id, key: key, from: from, to: to)) ?? [] { byDay[p.day] = p.value }
         }
 
-        return byDay.sorted { $0.key < $1.key }.map { (day: $0.key, value: $0.value) }
+        return Self.oneSkinTempScale(key: key, byDay.sorted { $0.key < $1.key }.map { (day: $0.key, value: $0.value) })
+    }
+
+    /// #1705: reduce a `skin_temp` window to a single scale; every other key passes through untouched.
+    ///
+    /// The key is bimodal — a CSV import writes ABSOLUTE °C where the computed layers write a baseline
+    /// DEVIATION, so one window can hold both. Every consumer of an Explore series aggregates it
+    /// (min/max/mean, the window-over-window delta, the correlation scan), and those are arithmetic
+    /// across two scales: on the reported account a few ~34 °C readings lifted a should-be-near-zero
+    /// average past a full degree, and the mean then read below 20 so it was labelled Δ°C.
+    ///
+    /// Applied on BOTH of `exploreSeries`' return paths, deliberately. Today the only `skin_temp`
+    /// descriptor is `my-whoop`, so the delegating path is unreachable for it — but a guard that is
+    /// correct only because of a fact in another file is how this bug happened in the first place.
+    /// `series(day:value:)` is ordered ascending by day, which `dominantKind` relies on.
+    private static func oneSkinTempScale(
+        key: String,
+        _ series: [(day: String, value: Double)]
+    ) -> [(day: String, value: Double)] {
+        guard key == "skin_temp",
+              let keep = SkinTempDisplay.dominantKind(valuesAscendingByDay: series.map(\.value))
+        else { return series }
+        return series.filter { SkinTempDisplay.kind(of: $0.value) == keep }
     }
 
     /// Every catalog metric's Explore series at once, memoized — the cross-catalog scan behind the
diff --git a/android/app/src/main/java/com/noop/analytics/SkinTempDisplay.kt b/android/app/src/main/java/com/noop/analytics/SkinTempDisplay.kt
index d6564aff5d..8d222d02de 100644
--- a/android/app/src/main/java/com/noop/analytics/SkinTempDisplay.kt
+++ b/android/app/src/main/java/com/noop/analytics/SkinTempDisplay.kt
@@ -19,6 +19,27 @@ object SkinTempDisplay {
         DEVIATION,
     }
 
+    /**
+     * The one kind a MIXED series must be reduced to before any aggregate is taken (#1705).
+     *
+     * A CSV import writes absolute °C and the computed pipeline writes a deviation, both into this
+     * same field, so one window can hold both. Formatting stays honest per value — [kind] is
+     * re-derived for each — but a min, max, mean or window-over-window delta drawn across both is
+     * arithmetic on two different scales, and it looks plausible: a handful of ~34 °C readings lift a
+     * should-be-near-zero deviation average past a full degree, and the mean is then itself below 20
+     * so it gets labelled Δ°C.
+     *
+     * The newest entry decides, matching what `HealthVitalsLogic` already does for its sparkline — the
+     * reading the user is actually looking at sets the scale, and older entries of the other kind drop
+     * out rather than being converted, because converting needs a baseline that a fresh import-only
+     * install does not have.
+     *
+     * @param valuesAscendingByDay the window's values, ascending by day.
+     * @return the kind to keep, or null for an empty window.
+     */
+    fun dominantKind(valuesAscendingByDay: List<Double>): Kind? =
+        valuesAscendingByDay.lastOrNull()?.let { kind(it) }
+
     fun kind(value: Double): Kind =
         if (VitalBands.isAbsoluteSkinTemp(value)) Kind.ABSOLUTE else Kind.DEVIATION
 
diff --git a/android/app/src/main/java/com/noop/data/WhoopRepository.kt b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
index 80b7b2dea4..b4b92d35a5 100644
--- a/android/app/src/main/java/com/noop/data/WhoopRepository.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
@@ -1823,7 +1823,24 @@ class WhoopRepository(
         // Book / any resolver read agrees with the mergeDaily dashboards instead of re-surfacing the
         // schedule target the merge already rejects.
         val perCandidate = candidates.map { it to resolvedRows(it, from, to) }
-        return MetricSeriesResolution(preferredSource, candidates, resolveFirstWins(perCandidate))
+        val points = resolveFirstWins(perCandidate)
+        // #1705: skin_temp is bimodal — a CSV import writes ABSOLUTE °C into skinTempDevC while the
+        // computed pipeline writes a baseline DEVIATION, and the candidate list unions the imported and
+        // computed identities, so first-wins can resolve older days to one kind and recent days to the
+        // other. Every consumer aggregates these points (Compare's min/max and its min-max chart
+        // normalisation, Lab Book), and that is arithmetic across two scales. Reduce to the newest
+        // entry's kind HERE, at the one place the candidates are resolved, rather than at each screen.
+        if (key == "skin_temp") {
+            val keep = com.noop.analytics.SkinTempDisplay.dominantKind(points.map { it.value })
+            if (keep != null) {
+                return MetricSeriesResolution(
+                    preferredSource,
+                    candidates,
+                    points.filter { com.noop.analytics.SkinTempDisplay.kind(it.value) == keep },
+                )
+            }
+        }
+        return MetricSeriesResolution(preferredSource, candidates, points)
     }
 
     /**
diff --git a/android/app/src/test/java/com/noop/analytics/SkinTempDisplayTest.kt b/android/app/src/test/java/com/noop/analytics/SkinTempDisplayTest.kt
index 53d97ca1af..450ec4e40a 100644
--- a/android/app/src/test/java/com/noop/analytics/SkinTempDisplayTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/SkinTempDisplayTest.kt
@@ -1,6 +1,7 @@
 package com.noop.analytics
 
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Test
 
@@ -73,4 +74,36 @@ class SkinTempDisplayTest {
             )
         }
     }
-}
+
+    // ---- dominantKind (#1705) ----
+
+    @Test fun dominantKindIsTheNewestEntrys() {
+        assertEquals(SkinTempDisplay.Kind.DEVIATION, SkinTempDisplay.dominantKind(listOf(34.6, 35.1, -0.2)))
+        assertEquals(SkinTempDisplay.Kind.ABSOLUTE, SkinTempDisplay.dominantKind(listOf(-0.2, 0.1, 34.6)))
+        assertNull(SkinTempDisplay.dominantKind(emptyList()))
+    }
+
+    @Test fun dominantKindOfASingleKindWindowIsThatKind() {
+        assertEquals(SkinTempDisplay.Kind.DEVIATION, SkinTempDisplay.dominantKind(listOf(-0.24, 0.21, 0.01)))
+        assertEquals(SkinTempDisplay.Kind.ABSOLUTE, SkinTempDisplay.dominantKind(listOf(32.39, 34.60, 36.64)))
+    }
+
+    /**
+     * The regression guard the issue asked for: filtering by [SkinTempDisplay.dominantKind] must leave a
+     * window that no aggregate can straddle. Values are the reported ones — a 313-row absolute import
+     * (32.39..36.64, mean 34.60) coexisting with computed deviations inside +/-0.3.
+     */
+    @Test fun filteringByDominantKindLeavesOneScale() {
+        val mixed = listOf(34.60, 35.12, 32.39, 36.64, -0.24, 0.21, 0.01, 0.11, 0.0)
+        val keep = SkinTempDisplay.dominantKind(mixed)!!
+        val kept = mixed.filter { SkinTempDisplay.kind(it) == keep }
+        assertEquals(listOf(-0.24, 0.21, 0.01, 0.11, 0.0), kept)
+        assertTrue(kept.all { SkinTempDisplay.kind(it) == keep })
+        // The defect: unfiltered, the mean of a should-be-near-zero deviation window clears a degree and
+        // then reads BELOW 20, so it gets labelled deviation — plausible-looking and wrong.
+        val unfilteredMean = mixed.average()
+        assertTrue(unfilteredMean > 1.0)
+        assertEquals(SkinTempDisplay.Kind.DEVIATION, SkinTempDisplay.kind(unfilteredMean))
+        assertTrue(kotlin.math.abs(kept.average()) < 0.3)
+    }
+}
\ No newline at end of file

From 7146fc2bcbb7c4630b4deeeea8bc7bca17afbd50 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 28 Aug 2026 23:14:08 +1200
Subject: [PATCH 042/333] alarm: let a strap be asked what alarm it has stored
 (#1710)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-on to #1706, which persists the raw readback frame but gave no way to obtain one.

The GET_ALARM_TIME readback was reachable only by ARMING, so an install with its alarm switched off
could not produce the evidence explaining what its strap reports — the exact state of the account
whose 2045 readback prompted the issue. iOS had getStrapAlarm for this but it had never had a caller
on either platform, so porting the function alone would only have added dead code to a second
platform. This is the function plus a way to press it, on both.

A "Check what the strap has stored" button on the strap firmware-alarm card. The reply lands on the
same branch an arm's follow-up read uses, so it persists the reported epoch and the raw bytes for the
debug export.

One deliberate difference, commented at both call sites: the Android button hides until bonded, the
iOS one is always shown. Gating is free on Android because that card already observes LiveState;
SmartAlarmView does not, and this codebase keeps `live` out of parent views so a 1 Hz HR tick cannot
re-render them. getStrapAlarm no-ops and logs when nothing is connected, so always showing it costs
one ignored write rather than a per-second re-render of the whole alarm screen.

Not family-gated, but defensively rather than as a feature: send already no-ops when disconnected and
only the 4.0 branch decodes. Both buttons sit in the 4.0 branch, so nothing captures a 5/MG frame
today. An earlier draft of the doc claimed that frame was the whole point of the button — a path its
only caller cannot reach; the doc now says what the code does.

Strings: Android in all seven files, named without the l10n_ prefix that marks extractor-generated
keys in that file; iOS in all ten catalogue locales, pl included since it is ratcheted. The catalogue
was edited as TEXT — json.dumps(indent=2) expands its hand-compacted entries and turned the same
two-string addition into a 3,426-line diff, which the audit still passed, which is what made it
dangerous. The kept version is six added lines re-parsed to prove it loads.

Verified: 4,725 Android tests, 0 failures; i18n audit clean; lintVitalFullRelease clean; app-build
green on both legs, the only thing that compiles SmartAlarmView.

Note for the next build: lintVitalFullRelease must run separately from the debug test tasks.
Combining them trips a task-wiring validation error between syncRoomSchemaSnapshot and
kspFullReleaseKotlin that reproduces on unmodified main, so it is pre-existing and worth its own
issue.
---
 Strand/Resources/Localizable.xcstrings        |  6 ++++++
 Strand/Screens/SmartAlarmView.swift           | 21 +++++++++++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 21 +++++++++++++++++++
 .../main/java/com/noop/ui/SmartAlarmScreen.kt | 16 ++++++++++++++
 .../app/src/main/res/values-de/strings.xml    |  2 ++
 .../app/src/main/res/values-es/strings.xml    |  2 ++
 .../app/src/main/res/values-fr/strings.xml    |  2 ++
 .../app/src/main/res/values-pl/strings.xml    |  2 ++
 .../src/main/res/values-pt-rPT/strings.xml    |  2 ++
 .../app/src/main/res/values-zh/strings.xml    |  2 ++
 android/app/src/main/res/values/strings.xml   |  2 ++
 11 files changed, 78 insertions(+)

diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index d78bd6608c..1ad4bf61c4 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -208218,6 +208218,12 @@
     } },
     "A cardiovascular load from time in heart-rate zones (Edwards TRIMP): each zone is weighted so harder ones count for more, summed into one daily figure. Settings offers an exponential alternative (Banister) that credits short, hard efforts more.": { "localizations": {
       "de": { "stringUnit": { "state": "translated", "value": "Eine kardiovaskuläre Last aus der Zeit in den Herzfrequenzzonen (Edwards-TRIMP): Jede Zone wird gewichtet, sodass härtere Zonen mehr zählen, aufsummiert zu einer Tageszahl. In den Einstellungen gibt es eine exponentielle Alternative (Banister), die kurze, harte Belastungen stärker anrechnet." } }, "en": { "stringUnit": { "state": "translated", "value": "A cardiovascular load from time in heart-rate zones (Edwards TRIMP): each zone is weighted so harder ones count for more, summed into one daily figure. Settings offers an exponential alternative (Banister) that credits short, hard efforts more." } }, "es": { "stringUnit": { "state": "translated", "value": "Una carga cardiovascular a partir del tiempo en las zonas de frecuencia cardíaca (TRIMP de Edwards): cada zona se pondera para que las más duras cuenten más, sumado en una sola cifra diaria. En Ajustes hay una alternativa exponencial (Banister) que valora más los esfuerzos cortos e intensos." } }, "fr": { "stringUnit": { "state": "translated", "value": "Une charge cardiovasculaire issue du temps passé dans les zones de fréquence cardiaque (TRIMP d’Edwards) : chaque zone est pondérée pour que les plus intenses comptent davantage, additionnée en un seul chiffre journalier. Les Réglages proposent une alternative exponentielle (Banister) qui valorise davantage les efforts courts et intenses." } }, "it": { "stringUnit": { "state": "translated", "value": "Un carico cardiovascolare dato dal tempo nelle zone di frequenza cardiaca (TRIMP di Edwards): ogni zona è ponderata in modo che quelle più dure contino di più, sommato in un unico dato giornaliero. Nelle Impostazioni c’è un’alternativa esponenziale (Banister) che premia di più gli sforzi brevi e intensi." } }, "pl": { "stringUnit": { "state": "translated", "value": "Obciążenie układu krążenia wynikające z czasu w strefach tętna (TRIMP Edwardsa): każda strefa jest ważona tak, aby trudniejsze liczyły się bardziej, zsumowane w jedną wartość dzienną. W Ustawieniach jest alternatywa wykładnicza (Banister), która mocniej docenia krótkie, intensywne wysiłki." } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Uma carga cardiovascular a partir do tempo nas zonas de frequência cardíaca (TRIMP de Edwards): cada zona é ponderada para que as mais difíceis contem mais, resumido num valor diário. Nas Definições existe uma alternativa exponencial (Banister) que valoriza mais os esforços curtos e intensos." } }, "ru": { "stringUnit": { "state": "translated", "value": "Сердечно-сосудистая нагрузка по времени в пульсовых зонах (TRIMP Эдвардса): каждая зона взвешивается так, что более тяжёлые учитываются сильнее, и всё суммируется в одно дневное значение. В настройках есть экспоненциальная альтернатива (Banister), которая сильнее засчитывает короткие интенсивные усилия." } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "根据你在各心率区间的时长得出的心血管负荷（Edwards TRIMP）：区间越高权重越大，汇总为一个每日数字。设置中提供指数式替代方案（Banister），会更看重短时高强度的努力。" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "根據你在各心率區間停留時間得出的心血管負荷（Edwards TRIMP）：區間越高權重越大，加總成每日一個數字。設定中提供指數式替代方案（Banister），會更看重短時高強度的努力。" } }
+    } },
+    "Check what the strap has stored": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Prüfen, was das Band gespeichert hat" } }, "en": { "stringUnit": { "state": "translated", "value": "Check what the strap has stored" } }, "es": { "stringUnit": { "state": "translated", "value": "Comprobar qué tiene guardado la correa" } }, "fr": { "stringUnit": { "state": "translated", "value": "Vérifier ce que le bracelet a enregistré" } }, "it": { "stringUnit": { "state": "translated", "value": "Controlla cosa ha memorizzato il braccialetto" } }, "pl": { "stringUnit": { "state": "translated", "value": "Sprawdź, co zapisała opaska" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Verificar o que a pulseira tem guardado" } }, "ru": { "stringUnit": { "state": "translated", "value": "Проверить, что сохранено на ремешке" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "查看手环已存储的闹钟" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "查看手環已儲存的鬧鐘" } }
+    } },
+    "The answer from the strap appears in your strap log and debug export, with the raw bytes it replied with.": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Die Antwort des Bands erscheint im Band-Log und im Diagnose-Export, samt der empfangenen Rohbytes." } }, "en": { "stringUnit": { "state": "translated", "value": "The answer from the strap appears in your strap log and debug export, with the raw bytes it replied with." } }, "es": { "stringUnit": { "state": "translated", "value": "La respuesta de la correa aparece en el registro y en la exportación de diagnóstico, con los bytes recibidos." } }, "fr": { "stringUnit": { "state": "translated", "value": "La réponse du bracelet apparaît dans le journal et l’export de diagnostic, avec les octets bruts reçus." } }, "it": { "stringUnit": { "state": "translated", "value": "La risposta del braccialetto compare nel log e nell’esportazione diagnostica, con i byte grezzi ricevuti." } }, "pl": { "stringUnit": { "state": "translated", "value": "Odpowiedź opaski pojawi się w logu i eksporcie diagnostycznym, wraz z otrzymanymi surowymi bajtami." } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "A resposta da pulseira aparece no registo e na exportação de diagnóstico, com os bytes recebidos." } }, "ru": { "stringUnit": { "state": "translated", "value": "Ответ ремешка появится в журнале ремешка и диагностическом экспорте вместе с полученными байтами." } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "手环的回应会出现在手环日志和诊断导出中，并附带收到的原始字节。" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "手環的回應會出現在手環日誌和診斷匯出中，並附上收到的原始位元組。" } }
     } }
   },
   "version": "1.0"
diff --git a/Strand/Screens/SmartAlarmView.swift b/Strand/Screens/SmartAlarmView.swift
index f69c181abf..0f6112abc9 100644
--- a/Strand/Screens/SmartAlarmView.swift
+++ b/Strand/Screens/SmartAlarmView.swift
@@ -242,6 +242,27 @@ struct SmartAlarmView: View {
                             .font(StrandFont.footnote)
                             .foregroundStyle(StrandPalette.textTertiary)
                             .frame(maxWidth: .infinity, alignment: .leading)
+                        // #1706: ask the strap what it actually has stored. The readback was otherwise
+                        // only reachable by ARMING, so anyone whose alarm is off could not produce the
+                        // frame that explains a wrong reported time.
+                        //
+                        // Shown unconditionally, where the Android twin hides it until bonded. That is a
+                        // deliberate platform difference, not drift: the Android card already observes
+                        // LiveState, so gating there is free, while this view does not — and pulling
+                        // `live` in would re-render the whole alarm screen on every 1 Hz HR tick, which
+                        // this codebase keeps parent views clear of on purpose. `getStrapAlarm` no-ops
+                        // and logs when nothing is connected, so the worst case is one ignored write.
+                        Divider().overlay(StrandPalette.hairline)
+                        Button {
+                            model.ble.getStrapAlarm()
+                        } label: {
+                            Text("Check what the strap has stored")
+                        }
+                        .buttonStyle(NoopButtonStyle(.secondary, fullWidth: true))
+                        Text("The answer from the strap appears in your strap log and debug export, with the raw bytes it replied with.")
+                            .font(StrandFont.footnote)
+                            .foregroundStyle(StrandPalette.textTertiary)
+                            .frame(maxWidth: .infinity, alignment: .leading)
                     }
                 }
             }
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 51c212cc0d..759e30f5fc 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -4526,6 +4526,27 @@ class WhoopBleClient(
         }
     }
 
+    /**
+     * Ask the strap what alarm it currently has stored (#1706). The reply lands on the command-notify
+     * characteristic and is handled by the same GET_ALARM_TIME branch an arm's own follow-up read uses,
+     * so it persists `alarm.lastReportedEpoch` + the RAW response bytes for the debug export.
+     *
+     * Port of Swift `BLEManager.getStrapAlarm`, which until now had no caller on either platform. It
+     * exists here because the readback was otherwise only reachable by ARMING: a user whose alarm is off
+     * could not produce the evidence needed to explain what their strap reports, and on Android arming
+     * was the sole trigger.
+     *
+     * Not family-gated, unlike [armStrapAlarm] — but that is defensive, not a feature. [send] already
+     * no-ops when nothing is connected, and only the 4.0 branch decodes the reply, so an errant call
+     * costs one ignored write. The single caller today is the 4.0 side of the strap-alarm card, so the
+     * 5/MG frame is NOT currently captured by anything; a caller could be added there if that layout
+     * ever needs recording, and this method would not have to change.
+     */
+    fun getStrapAlarm() {
+        send(CommandNumber.GET_ALARM_TIME, byteArrayOf(0x01))
+        log("Alarm: requested current alarm time")
+    }
+
     /**
      * Arm the strap's **firmware** alarm to buzz at [epochSec] (absolute UTC seconds). The strap fires
      * at that instant even if the phone is asleep or NOOP is closed. SET_CLOCK is sent first so the
diff --git a/android/app/src/main/java/com/noop/ui/SmartAlarmScreen.kt b/android/app/src/main/java/com/noop/ui/SmartAlarmScreen.kt
index b642549f34..660ab8bc37 100644
--- a/android/app/src/main/java/com/noop/ui/SmartAlarmScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SmartAlarmScreen.kt
@@ -287,6 +287,22 @@ private fun StrapAlarmCard(vm: AppViewModel) {
                             "Connect your strap to arm this; it's set on the strap's own firmware alarm. Confirmed working on WHOOP 4.0; still experimental on 5.0 and MG. Keep a backup alarm for anything you truly can't miss.",
                         style = NoopType.footnote, color = Palette.textTertiary,
                     )
+                    // #1706: ask the strap what it actually has stored. The readback was previously only
+                    // reachable by ARMING, so anyone whose alarm is off could not produce the evidence
+                    // that explains a wrong reported time. 4.0 only — the 5/MG readback is not decoded.
+                    if (live.bonded) {
+                        RowDividerLocal()
+                        NoopButton(
+                            text = uiString(R.string.smart_alarm_check_strap_alarm),
+                            kind = NoopButtonKind.Secondary,
+                            fullWidth = true,
+                            onClick = { vm.ble.getStrapAlarm() },
+                        )
+                        Text(
+                            uiString(R.string.smart_alarm_check_strap_alarm_help),
+                            style = NoopType.footnote, color = Palette.textTertiary,
+                        )
+                    }
                 }
             }
         }
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index e1857952ce..67f8a56d1f 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -860,6 +860,8 @@
     <string name="l10n_smart_alarm_screen_remind_me_to_wind_down_4839f0d0">Erinnere mich ans Runterkommen</string>
     <string name="l10n_smart_alarm_screen_shorten_window_5bf5b37d">Fenster verkürzen</string>
     <string name="l10n_smart_alarm_screen_strap_wake_alarm_1828fff3">Strap-Weckalarm</string>
+    <string name="smart_alarm_check_strap_alarm">Prüfen, was das Band gespeichert hat</string>
+    <string name="smart_alarm_check_strap_alarm_help">Die Antwort des Bands erscheint im Band-Log und im Diagnose-Export, samt der empfangenen Rohbytes.</string>
     <string name="l10n_smart_alarm_screen_the_earliest_noop_will_wake_you_b641a2d4">Der früheste NOOP wird Sie wecken.</string>
     <string name="l10n_smart_alarm_screen_the_guaranteed_alarm_fires_this_long_b0c51052">Der garantierte Alarm feuert so lange nach Ihrer frühesten Zeit.</string>
     <string name="l10n_smart_alarm_screen_this_is_a_coarse_cue_from_d6bbabe7">Dies ist ein grober Hinweis auf die Herzfrequenz, keine klinische Schlafphase. Wenn das Gurtband</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index e3a0732790..706c3aea11 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -659,6 +659,8 @@
     <string name="l10n_smart_alarm_screen_remind_me_to_wind_down_4839f0d0">Recuérdame relajarme</string>
     <string name="l10n_smart_alarm_screen_shorten_window_5bf5b37d">Ventana corta</string>
     <string name="l10n_smart_alarm_screen_strap_wake_alarm_1828fff3">Alarma de despertar de la pulsera</string>
+    <string name="smart_alarm_check_strap_alarm">Comprobar qué tiene guardado la pulsera</string>
+    <string name="smart_alarm_check_strap_alarm_help">La respuesta de la pulsera aparece en el registro y en la exportación de diagnóstico, con los bytes recibidos.</string>
     <string name="l10n_smart_alarm_screen_the_earliest_noop_will_wake_you_b641a2d4">La primera NOOP te despertará.</string>
     <string name="l10n_smart_alarm_screen_the_guaranteed_alarm_fires_this_long_b0c51052">La alarma garantizada dispara tanto tiempo después de su primer tiempo.</string>
     <string name="l10n_smart_alarm_screen_this_is_a_coarse_cue_from_d6bbabe7">Este es un cue grueso de la frecuencia cardíaca, no una lectura clínica del estadio del sueño. Si la correa</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index a70dea87fc..8c81a0f00b 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -677,6 +677,8 @@
     <string name="l10n_smart_alarm_screen_remind_me_to_wind_down_4839f0d0">Me rappeler de me détendre</string>
     <string name="l10n_smart_alarm_screen_shorten_window_5bf5b37d">Écourter la fenêtre</string>
     <string name="l10n_smart_alarm_screen_strap_wake_alarm_1828fff3">Alarme de réveil du bracelet</string>
+    <string name="smart_alarm_check_strap_alarm">Vérifier ce que le bracelet a enregistré</string>
+    <string name="smart_alarm_check_strap_alarm_help">La réponse du bracelet apparaît dans le journal et l’export de diagnostic, avec les octets bruts reçus.</string>
     <string name="l10n_smart_alarm_screen_the_earliest_noop_will_wake_you_b641a2d4">Le premier NOOP vous réveillera.</string>
     <string name="l10n_smart_alarm_screen_the_guaranteed_alarm_fires_this_long_b0c51052">L\'alarme garantie tire aussi longtemps après votre plus jeune heure.</string>
     <string name="l10n_smart_alarm_screen_this_is_a_coarse_cue_from_d6bbabe7">Il s\'agit d\'un signal grossier de la fréquence cardiaque, et non d\'une lecture clinique au stade du sommeil. Si le bracelet </string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 93827ec201..651edae8b2 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -811,6 +811,8 @@
     <string name="l10n_smart_alarm_screen_remind_me_to_wind_down_4839f0d0">Przypomnij mi, żebym się uspokoił</string>
     <string name="l10n_smart_alarm_screen_shorten_window_5bf5b37d">Skróć okno</string>
     <string name="l10n_smart_alarm_screen_strap_wake_alarm_1828fff3">Budzik na pasek</string>
+    <string name="smart_alarm_check_strap_alarm">Sprawdź, co zapisała opaska</string>
+    <string name="smart_alarm_check_strap_alarm_help">Odpowiedź opaski pojawi się w logu i eksporcie diagnostycznym, wraz z otrzymanymi surowymi bajtami.</string>
     <string name="l10n_smart_alarm_screen_the_earliest_noop_will_wake_you_b641a2d4">Obudzi Cię najwcześniej NOOP.</string>
     <string name="l10n_smart_alarm_screen_the_guaranteed_alarm_fires_this_long_b0c51052">Gwarantowany alarm uruchomi się tak długo po najwcześniejszym momencie.</string>
     <string name="l10n_smart_alarm_screen_this_is_a_coarse_cue_from_d6bbabe7">Jest to przybliżona wskazówka na podstawie tętna, a nie kliniczny odczyt na etapie snu. Jeśli pasek</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 7d7936250e..d14c3abe8a 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -825,6 +825,8 @@
     <string name="l10n_smart_alarm_screen_remind_me_to_wind_down_4839f0d0">Lembre-me de relaxar</string>
     <string name="l10n_smart_alarm_screen_shorten_window_5bf5b37d">Encurtar janela</string>
     <string name="l10n_smart_alarm_screen_strap_wake_alarm_1828fff3">Bracelete despertador</string>
+    <string name="smart_alarm_check_strap_alarm">Verificar o que a pulseira tem guardado</string>
+    <string name="smart_alarm_check_strap_alarm_help">A resposta da pulseira aparece no registo e na exportação de diagnóstico, com os bytes recebidos.</string>
     <string name="l10n_smart_alarm_screen_the_earliest_noop_will_wake_you_b641a2d4">O primeiro NOOP irá acordá-lo.</string>
     <string name="l10n_smart_alarm_screen_the_guaranteed_alarm_fires_this_long_b0c51052">O alarme garantido dispara muito depois do primeiro horário.</string>
     <string name="l10n_smart_alarm_screen_this_is_a_coarse_cue_from_d6bbabe7">Esta é uma indicação grosseira da frequência cardíaca, não uma leitura clínica da fase do sono. Se a pega </string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 54847fb5aa..dd1df9fad5 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -807,6 +807,8 @@
     <string name="l10n_smart_alarm_screen_remind_me_to_wind_down_4839f0d0">提醒我准备入睡</string>
     <string name="l10n_smart_alarm_screen_shorten_window_5bf5b37d">缩短唤醒窗口</string>
     <string name="l10n_smart_alarm_screen_strap_wake_alarm_1828fff3">手环无声唤醒</string>
+    <string name="smart_alarm_check_strap_alarm">查看手环已存储的闹钟</string>
+    <string name="smart_alarm_check_strap_alarm_help">手环的回应会出现在手环日志和诊断导出中，并附带收到的原始字节。</string>
     <string name="l10n_smart_alarm_screen_the_earliest_noop_will_wake_you_b641a2d4">NOOP 可能会唤醒您的最早时间。</string>
     <string name="l10n_smart_alarm_screen_the_guaranteed_alarm_fires_this_long_b0c51052">如果您在这段时间内未被智能唤醒，保底闹钟将在窗口期结束时必定响起。</string>
     <string name="l10n_smart_alarm_screen_this_is_a_coarse_cue_from_d6bbabe7">这是根据心率变动做出的粗略提示，而非临床级别的睡眠阶段判断。如果手环...</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index cdfd989943..f699e2b81d 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -945,6 +945,8 @@
     <string name="l10n_smart_alarm_screen_remind_me_to_wind_down_4839f0d0">Remind me to wind down</string>
     <string name="l10n_smart_alarm_screen_shorten_window_5bf5b37d">Shorten window</string>
     <string name="l10n_smart_alarm_screen_strap_wake_alarm_1828fff3">Strap wake-alarm</string>
+    <string name="smart_alarm_check_strap_alarm">Check what the strap has stored</string>
+    <string name="smart_alarm_check_strap_alarm_help">The answer from the strap appears in your strap log and debug export, with the raw bytes it replied with.</string>
     <string name="l10n_smart_alarm_screen_the_earliest_noop_will_wake_you_b641a2d4">The earliest NOOP will wake you.</string>
     <string name="l10n_smart_alarm_screen_the_guaranteed_alarm_fires_this_long_b0c51052">The guaranteed alarm fires this long after your earliest time.</string>
     <string name="l10n_smart_alarm_screen_this_is_a_coarse_cue_from_d6bbabe7">This is a coarse cue from heart rate, not a clinical sleep-stage reading. If the strap </string>

From 15a92da77e9506c71e24ea8db452e9d37c23fcd5 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 00:05:27 +1200
Subject: [PATCH 043/333] build: order the Room schema snapshot after every KSP
 round, not just the test ones (#1712)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reported as #1711. Running release lint in the same Gradle invocation as the debug test tasks failed
the build: syncRoomSchemaSnapshot uses the output of kspFullReleaseKotlin without declaring a
dependency on it.

room.schemaLocation is set once, outside any variant block, so EVERY variant's KSP round writes that
directory, while syncRoomSchemaSnapshot declared a relationship with only some of its producers. The
one-variant dependsOn is deliberate and stays: the schema derives from the entities alone, so every
round writes byte-identical JSON and depending on all of them would cost four KSP rounds per test
run. The ordering line was the gap — it covered the hazard actually observed, unit-test KSP clearing
the snapshot after Sync copied it, but kspFullReleaseKotlin writes the same directory and was not
covered. That task is normally absent from the graph, which is why this never surfaced.

Broadened to every ksp*Kotlin round, a strict superset of the old matcher checked name by name, so
the original guard is intact.

Measured rather than argued, since a mustRunAfter that silently forces extra work is the regression
worth fearing here: the previously-failing command now succeeds; it runs the debug, unit-test and
release rounds exactly once each; a plain testFullDebugUnitTest still runs only the debug and
unit-test rounds with no release round, so the optimisation the neighbouring comment protects is
untouched; 4,725 tests, 0 failures.

Worth knowing that CI cannot catch a regression here — it invokes lint and tests separately, which is
why the bug survived in the first place. The evidence is local.

No parity work: Room/KSP schema generation is Android-only. The schema_oracle.json fixture this
pipeline feeds has a byte-identical Swift twin, but that is committed data and build wiring cannot
affect it.
---
 android/app/build.gradle.kts | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 362d85e4f2..1248fec416 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -208,8 +208,17 @@ val syncRoomSchemaSnapshot = tasks.register<Sync>("syncRoomSchemaSnapshot") {
     // variant's KSP round writes byte-identical JSON. Depending on all of them would make a single
     // `testFullDebugUnitTest` run four KSP rounds instead of one.
     dependsOn(tasks.matching { it.name == "kspFullDebugKotlin" })
-    // Unit-test KSP can clear the snapshot after Sync has copied it; order Sync after those tasks.
-    mustRunAfter(tasks.matching { it.name.startsWith("ksp") && it.name.contains("UnitTest") })
+    // Every KSP round writes `roomSchemaDir` — `room.schemaLocation` is set once, outside any variant
+    // block — so EVERY one of them is both a producer Sync must not race and a producer Gradle expects
+    // a declared relationship with. This was scoped to the UnitTest rounds, which covered the observed
+    // hazard (unit-test KSP clearing the snapshot after Sync copied it) but left `kspFullReleaseKotlin`
+    // out. It is normally absent from the graph; pull it in — `lintVitalFullRelease` in the same
+    // invocation as the debug test tasks does — and Gradle fails the build for an undeclared
+    // producer/consumer pair, with an error that reads like a Room problem (#1711).
+    //
+    // Ordering only, so nothing is forced to execute and the one-variant `dependsOn` above keeps its
+    // point: a `testFullDebugUnitTest` run still triggers exactly one KSP round.
+    mustRunAfter(tasks.matching { it.name.startsWith("ksp") && it.name.endsWith("Kotlin") })
 }
 
 tasks.withType<Test>().configureEach {

From bebfd30559bb36896fcd864656d70bde5c3acc8f Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 00:16:01 +1200
Subject: [PATCH 044/333] build: name the KSP predicate the two schema rules
 share (#1714)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to #1712, which is where the need showed up.

That change added a matcher spelled startsWith("ksp") && endsWith("Kotlin") a few lines below one
that already existed and read almost identically — and the existing one deliberately INVERTS on the
UnitTest/AndroidTest rounds. I did not notice while writing it, which is the argument for this rather
than against it: two near-identical predicates meaning opposite things is a trap regardless of who
reads them next.

The shared half is now named, and its comment states the opposition instead of leaving it to be
diffed by eye. isMainSourceSetKspTask excludes those rounds so Gradle is not told they output a
directory they never write and then clears it out from under the round that did;
syncRoomSchemaSnapshot's mustRunAfter includes them because they still race the Sync.

Pure refactor. Both predicates were checked name by name against every KSP and compile task name this
project generates, and neither changes for any of them.

Verified anyway, because the failure mode here is a missing schema export rather than a compile
error, so it does not announce itself: the three-task command from #1712 still succeeds, the debug,
unit-test and release rounds still run exactly once each, 4,725 tests pass, and SchemaOracleTest —
the test that fails when the export goes missing — is 4 for 4. Run before and after the comment
relocation below, with identical results.

One note on how it got here: the first version inserted the new declaration BETWEEN the pre-existing
comment block and the function it documents, orphaning the load-bearing exclusion rationale onto the
wrong function. Caught in review and moved above the block. Worth recording because it is the exact
hazard this change exists to reduce, and because a comment attached to the wrong function is
invisible to every check in CI.
---
 android/app/build.gradle.kts | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 1248fec416..2cd98e4674 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -160,6 +160,16 @@ val roomSchemaDir = layout.buildDirectory.dir("generated/roomSchemas")
 ksp {
     arg("room.schemaLocation", roomSchemaDir.get().asFile.absolutePath)
 }
+// Every KSP round for a Kotlin source set. Both users below start here and then diverge on the
+// UnitTest/AndroidTest rounds — in OPPOSITE directions, which is why this half is named rather than
+// spelled out twice:
+//   - [isMainSourceSetKspTask] EXCLUDES them, so Gradle is not told they output a directory they never
+//     write and then clears it out from under the round that did.
+//   - `syncRoomSchemaSnapshot`'s `mustRunAfter` INCLUDES them, because they still race the Sync (#1711).
+// Two near-identical predicates meaning opposite things is a trap; sharing the common half makes the
+// difference the thing the reader sees.
+fun isKspKotlinTask(name: String) = name.startsWith("ksp") && name.endsWith("Kotlin")
+
 // Room writes the export as a SIDE EFFECT of annotation processing, at a path Gradle knows nothing
 // about. Left undeclared, a KSP task that is UP-TO-DATE or restored FROM-CACHE leaves whatever the last
 // real execution wrote — so an entity edit that is later reverted keeps the stale export on disk and the
@@ -178,8 +188,7 @@ ksp {
 // wiped the export that `kspFullDebugKotlin` had just restored, and the test failed on a clean build with
 // a warm cache with the directory missing entirely.
 fun isMainSourceSetKspTask(name: String) =
-    name.startsWith("ksp") && name.endsWith("Kotlin") &&
-        !name.contains("UnitTest") && !name.contains("AndroidTest")
+    isKspKotlinTask(name) && !name.contains("UnitTest") && !name.contains("AndroidTest")
 
 tasks.matching { isMainSourceSetKspTask(it.name) }.configureEach {
     outputs.dir(roomSchemaDir).withPropertyName("roomSchemaExport")
@@ -218,7 +227,7 @@ val syncRoomSchemaSnapshot = tasks.register<Sync>("syncRoomSchemaSnapshot") {
     //
     // Ordering only, so nothing is forced to execute and the one-variant `dependsOn` above keeps its
     // point: a `testFullDebugUnitTest` run still triggers exactly one KSP round.
-    mustRunAfter(tasks.matching { it.name.startsWith("ksp") && it.name.endsWith("Kotlin") })
+    mustRunAfter(tasks.matching { isKspKotlinTask(it.name) })
 }
 
 tasks.withType<Test>().configureEach {

From 1905e1a7740a293b8c0ed98dc85a557e1a4e226d Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 00:59:45 +1200
Subject: [PATCH 045/333] widgets: make the lock-screen accessory read like a
 lock-screen widget (#1715)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A community request asked for a WHOOP-style mini lock-screen widget. iOS already had one — the
accessoryRectangular family is declared and renders Charge, Effort and Rest from the same snapshot —
so nothing needed building. It needed to behave like a lock-screen widget, and to look like the thing
that was asked for.

It tinted unconditionally. Lock-screen widgets render vibrant or accented, where the system
desaturates whatever colour it is handed and maps it onto the wallpaper, so a domain colour does not
survive as that colour: it lands as an arbitrary grey whose luminance nobody chose. Charge, Effort
and Rest were therefore neither distinguishable from each other nor reliably legible. The cells now
read widgetRenderingMode and hand the system primary and secondary off the lock screen, which are the
levels it is built to map.

It spent a row on its own name. This family gets roughly 72pt of height for everything, and a "NOOP"
title used a whole row restating which widget the user had just chosen to add. The title is gone and
the heart-rate line is conditional, so an install with no live HR gives the scores the entire area.

And it used words where WHOOP uses glyphs. Icons now sit over each value, centred, replacing the 9pt
word that was the second thing naming a metric the icon already names. Accessibility is the part an
icon quietly breaks: a glyph says nothing to VoiceOver, so each cell collapses to one element that
still speaks "Charge, 68 percent".

Three review passes, all of which found prose rather than logic. A String(localized:) that could
never resolve — this extension does not bundle the catalogue, so it would have rendered English in
every locale while compiling, passing app-build, and passing the i18n audit, because the audit checks
the key exists rather than that the asking bundle can reach it. A doc that contradicted itself,
opening with "the tint applies on the home screen" and closing by explaining this family never
renders there. And an inert VStack alignment implying a left edge that is not there.

Deliberately untouched: the home-screen families, whose score rings mirror TodayView's hero trio, so
glyphs there would chase a lock-screen look at the app's expense; and the metric order, where each
platform is internally consistent and self-describing, so reordering one view would break iOS against
itself.

Android cannot host this. NoopCompactGlanceWidget already draws the same three icon cells, but there
is no third-party lock-screen widget surface on a phone.

Verified: app-build green on both legs for this head, which is the only thing that compiles this file
— SwiftUI does not exist on Linux, so none of it could be built locally. The AnyShapeStyle branches
are spelled with explicit types rather than leading-dot inference for that reason. i18n audit clean.
---
 StrandiOSWidgets/NOOPWidget.swift | 90 ++++++++++++++++++++++---------
 1 file changed, 66 insertions(+), 24 deletions(-)

diff --git a/StrandiOSWidgets/NOOPWidget.swift b/StrandiOSWidgets/NOOPWidget.swift
index 5e55dc7ebf..50907d89ef 100644
--- a/StrandiOSWidgets/NOOPWidget.swift
+++ b/StrandiOSWidgets/NOOPWidget.swift
@@ -29,10 +29,14 @@ struct NOOPProvider: TimelineProvider {
 }
 
 /// The glanceable widget — the iOS analogue of the macOS menu-bar extra.
-/// Home Screen families mirror Today's hero trio (Charge · Effort · Rest) as score rings; Lock Screen
-/// accessories stay compact single-line / gauge layouts.
+/// Home Screen families mirror Today's hero trio (Charge · Effort · Rest) as score rings. Lock Screen
+/// accessories are compact: a single line, a gauge, or the rectangular glyph-over-value trio.
 struct NOOPWidgetView: View {
     @Environment(\.widgetFamily) private var family
+    /// `.fullColor` on the home screen and in the gallery; `.vibrant` or `.accented` on the lock screen,
+    /// where the system desaturates any colour it is handed. The accessory cells check this rather than
+    /// tinting unconditionally — see `accessoryScore`.
+    @Environment(\.widgetRenderingMode) private var renderingMode
     let entry: NOOPEntry
 
     private var snap: WidgetSnapshot { entry.snapshot }
@@ -97,37 +101,75 @@ struct NOOPWidgetView: View {
 
     /// Lock-Screen rectangular accessory: Charge · Effort · Rest, same trio as the Home Screen rings.
     private var rectangular: some View {
-        VStack(alignment: .leading, spacing: 2) {
-            HStack(spacing: 4) {
-                Text("NOOP")
-                    .font(.system(size: 11, weight: .bold))
-                    .foregroundStyle(StrandPalette.textSecondary)
-                Spacer(minLength: 0)
-                if let bpm = snap.bpm {
-                    Text("\(bpm) bpm")
-                        .font(.caption2)
-                        .foregroundStyle(StrandPalette.textTertiary)
-                }
+        // The lock screen gives this family roughly 72pt of height for everything. A "NOOP" title spent
+        // a whole row of that restating which widget the user chose to add, leaving the three scores —
+        // the only reason to add it — squeezed underneath. The title is gone and the heart-rate line is
+        // now conditional, so with no live HR the scores get the entire area.
+        VStack(spacing: 2) {
+            if let bpm = snap.bpm {
+                Text("\(bpm) bpm")
+                    .font(.caption2)
+                    .foregroundStyle(.secondary)
+                    .frame(maxWidth: .infinity, alignment: .trailing)
             }
             HStack(alignment: .top, spacing: 0) {
-                accessoryScore("Charge", text: snap.recovery.map { "\($0)%" }, tint: chargeColor)
-                accessoryScore("Effort", text: effortText, tint: effortColor)
-                accessoryScore("Rest", text: snap.rest.map { "\($0)%" }, tint: restColor)
+                accessoryScore("Charge", symbol: "figure.mind.and.body",
+                               text: snap.recovery.map { "\($0)%" }, tint: chargeColor)
+                accessoryScore("Effort", symbol: "figure.strengthtraining.traditional",
+                               text: effortText, tint: effortColor)
+                accessoryScore("Rest", symbol: "moon.fill",
+                               text: snap.rest.map { "\($0)%" }, tint: restColor)
             }
         }
     }
 
-    private func accessoryScore(_ label: String, text: String?, tint: Color) -> some View {
-        VStack(alignment: .leading, spacing: 0) {
+    /// One score cell. On the LOCK SCREEN the domain tint is deliberately dropped; it survives only
+    /// where the system actually renders full colour, which for this family means a gallery preview.
+    ///
+    /// Lock-screen widgets render in `.vibrant` (or `.accented`), where the system desaturates whatever
+    /// colour it is given and maps it onto the wallpaper. A domain colour handed to it does not survive
+    /// as that colour — it lands as an arbitrary grey whose luminance nobody chose, so Charge, Effort and
+    /// Rest stopped being distinguishable AND stopped being legible. `.primary`/`.secondary` are the two
+    /// levels the system is designed to map, so the value reads at full strength and the glyph above it
+    /// recedes, which is the hierarchy the tint was there to express in the first place.
+    ///
+    /// The `.fullColor` branch is defensive rather than hot: this family renders `.vibrant` on the lock
+    /// screen and in StandBy, so the tint realistically only reaches a gallery preview.
+    private func accessoryScore(_ label: String, symbol: String, text: String?, tint: Color) -> some View {
+        VStack(spacing: 1) {
+            // Glyph over value, the shape the request asked for. A 9pt word under each number was
+            // spending scarce height on text nobody needs twice — the icons carry the metric identity.
+            Image(systemName: symbol)
+                .font(.system(size: 11, weight: .semibold))
+                .foregroundStyle(renderingMode == .fullColor
+                                 ? AnyShapeStyle(StrandPalette.textTertiary)
+                                 : AnyShapeStyle(HierarchicalShapeStyle.secondary))
             Text(text ?? "–")
-                .font(.system(size: 16, weight: .semibold, design: .rounded))
-                .foregroundStyle(text == nil ? StrandPalette.textTertiary : tint)
+                .font(.system(size: 15, weight: .semibold, design: .rounded))
+                .foregroundStyle(scoreStyle(hasValue: text != nil, tint: tint))
                 .minimumScaleFactor(0.7)
-            Text(label)
-                .font(.system(size: 9))
-                .foregroundStyle(StrandPalette.textTertiary)
         }
-        .frame(maxWidth: .infinity, alignment: .leading)
+        .frame(maxWidth: .infinity)
+        // An icon says nothing to VoiceOver, and the word it replaced was the only thing naming this
+        // metric. Collapse the cell to one element that still speaks "Charge, 68 percent".
+        .accessibilityElement(children: .ignore)
+        .accessibilityLabel(Text(label))
+        // Plain literal, not String(localized:). This extension's sources are StrandiOSWidgets +
+        // StrandiOSShared only — Strand/Resources/Localizable.xcstrings is NOT in the target, and
+        // String(localized:) resolves against Bundle.main, which for an app extension is the extension's
+        // own bundle. It would compile, look localized, and render English in every locale. Every other
+        // string in this file is a bare literal for the same reason: the widget is not localized yet.
+        .accessibilityValue(Text(text ?? "No data"))
+    }
+
+    private func scoreStyle(hasValue: Bool, tint: Color) -> AnyShapeStyle {
+        // Spelled out rather than leaning on leading-dot inference through AnyShapeStyle's generic
+        // init, which is the kind of expression that type-checks in a playground and not in a build.
+        guard renderingMode == .fullColor else {
+            return hasValue ? AnyShapeStyle(HierarchicalShapeStyle.primary)
+                            : AnyShapeStyle(HierarchicalShapeStyle.secondary)
+        }
+        return hasValue ? AnyShapeStyle(tint) : AnyShapeStyle(StrandPalette.textTertiary)
     }
 
     // MARK: - Home Screen: systemSmall

From eccf1070ef22609bd9d5ee822e48f84939addc4a Mon Sep 17 00:00:00 2001
From: Zebsi <66969936+Zebsi235@users.noreply.github.com>
Date: Fri, 28 Aug 2026 15:06:26 +0200
Subject: [PATCH 046/333] alarm: decode the 4.0 GET_ALARM_TIME readback at the
 offset the firmware actually uses (#1713)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Contributed by @Zebsi235, with three arm/readback captures from a WHOOP 4.0 on fw 41.17.6.0.

The GET readback is 11 bytes and carries a stored flag the 9-byte SET payload does not, so its epoch
sits at offset 2:

  SET  (9):  [form 01][u32 LE epoch][00 00 00 00]
  GET (11):  [form 01][stored flag][u32 LE epoch][00 00][04 00 20]

Decoding it at the SET-mirror offset returned the epoch's low three bytes shifted up a byte plus the
flag — wrong by roughly 256x and free to land anywhere in u32 range. In all three captures it landed
on a 2045 date INSIDE the 2017..2100 plausibility window, so the gate accepted it and a strap whose
alarm register was working perfectly was reported as refusing the time.

Every number re-derived from the raw payloads before merging. The u32-LE at offset 2 is the sent
epoch byte-exact in all three; the u32-LE at offset 1 is exactly what the app logged in all three;
the misreads step by 22,118,400, which is 86400 x 256 — one day of arm, shifted a byte. Three
independent epochs, no misses.

Why it hid: the only fixture in the tree, the #34 field report 01 00 00 00 00 00 00 00 04 00 20, is
this same shape with the flag 00 and the epoch zeroed — and a zeroed epoch region decodes identically
at offsets 1 and 2. The existing test could not have caught this, and did not.

The decode tries the 11-byte shape first and, on an implausible epoch, returns nil to the raw-hex line
rather than falling through to the mirror offsets: those are provably wrong for this shape, so trying
them could resurrect the misread. readbackReportsNoAlarm takes the same ordering, so both functions
read the same shapes in the same order their docs promise, and the length gate keeps the 9-byte #535
capture structurally unreachable from the new branch. Kotlin twin is logically identical; four new
tests per platform, all three captures pinned on both, no existing test touched.

This also changes what earlier reports meant: a pre-fix reported epoch from a 4.0 readback of this
shape cannot be trusted whatever it looked like, sane-looking values included, because an offset-1
read that fell outside the window dropped through to a bare-u32 read of different bytes. #1707 stopped
the cross-strap comparison from accusing the wrong device; this stops the same-strap one from being
wrong as well.

Left alone deliberately, and correctly: the 82-year plausibility window, since on firmwares answering
with some other shape the wide window plus raw-hex fallback is still what gets the bytes captured. And
the 2045 value from the OTHER install in #1706 is not explained here — its low byte is 0xD4, which
cannot be this shape's flag, so that one still needs its own capture.
---
 Strand/BLE/FrameRouter.swift                  | 30 ++++++++---
 StrandTests/AlarmReadbackDecodeTests.swift    | 41 +++++++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 31 ++++++++---
 .../com/noop/ble/AlarmReadbackDecodeTest.kt   | 51 +++++++++++++++++++
 4 files changed, 141 insertions(+), 12 deletions(-)

diff --git a/Strand/BLE/FrameRouter.swift b/Strand/BLE/FrameRouter.swift
index 83643d4440..95f2caf328 100644
--- a/Strand/BLE/FrameRouter.swift
+++ b/Strand/BLE/FrameRouter.swift
@@ -484,10 +484,12 @@ public final class FrameRouter {
     }
 
     /// Extract the armed-alarm epoch from a GET_ALARM_TIME (cmd 67) COMMAND_RESPONSE, defensively.
-    /// The WHOOP 4.0 response layout is UNDOCUMENTED, so this tries the two shapes the firmware could
-    /// plausibly answer with - the SET_ALARM_TIME mirror (`[form 0x01][u32 LE epoch]…`, matching the
-    /// 9-byte payload we arm with) first, then a bare leading u32 LE - and accepts a candidate only when
-    /// it passes `isPlausibleAlarmEpoch`. Anything else returns nil and the caller logs raw hex instead.
+    /// The WHOOP 4.0 response layout is UNDOCUMENTED, so this tries the shapes the firmware has been
+    /// seen to answer with - the 11-byte GET readback captured on fw 41.17.6.0
+    /// (`[form 0x01][stored flag][u32 LE epoch][00 00][04 00 20]`, epoch at offset 2) first, then the
+    /// SET_ALARM_TIME mirror (`[form 0x01][u32 LE epoch]…`, matching the 9-byte payload we arm with),
+    /// then a bare leading u32 LE - and accepts a candidate only when it passes
+    /// `isPlausibleAlarmEpoch`. Anything else returns nil and the caller logs raw hex instead.
     /// Pure and CoreBluetooth-free so golden tests pin it (AlarmReadbackDecodeTests).
     nonisolated static func armedAlarmEpoch(in frame: [UInt8]) -> UInt32? {
         guard let payload = commandResponsePayload(in: frame) else { return nil }
@@ -498,14 +500,29 @@ public final class FrameRouter {
                 | (UInt32(payload[i + 2]) << 16)
                 | (UInt32(payload[i + 3]) << 24)
         }
+        // The GET readback (fw 41.17.6.0, three arm/readback captures 2026-08-26..28, #34/#1706): the
+        // epoch sits ONE byte further than in the SET mirror, because the readback carries a stored
+        // flag (0x00 = nothing stored, 0x01 = stored) the arm payload does not. The mirror-offset read
+        // of this shape returns the epoch's LOW THREE bytes shifted up a byte, plus the flag — wrong
+        // by roughly 256x and free to land anywhere in u32 range. In all three captures it landed on
+        // a 2045 date INSIDE the 2017..2100 plausibility window (an arm for 2026-08-26 read back as
+        // 2045-09-24), so the gate did not catch it and a MISMATCH was counted against a strap whose
+        // register is fine. So on this shape the mirror offsets are known-wrong and must NOT be tried:
+        // offset 2 decodes, or the payload falls to the raw-hex line.
+        if payload.count == 11, payload.first == 0x01 {
+            if let e = u32le(at: 2), isPlausibleAlarmEpoch(e) { return e }
+            return nil
+        }
         if payload.first == 0x01, let e = u32le(at: 1), isPlausibleAlarmEpoch(e) { return e }
         if let e = u32le(at: 0), isPlausibleAlarmEpoch(e) { return e }
         return nil
     }
 
     /// True when a GET_ALARM_TIME readback explicitly reports NO alarm stored — the epoch field decodes
-    /// to 0 in the same shapes `armedAlarmEpoch` reads (SET-mirror `[0x01][u32=0]` first, then a bare
-    /// leading `u32=0`). This is the strap's "nothing armed" sentinel, distinct from a genuinely
+    /// to 0 in the same shapes `armedAlarmEpoch` reads (the 11-byte GET readback `[0x01][flag][u32=0]…`
+    /// first — the #34 field-report payload `01 00 00 00 00 00 00 00 04 00 20` is exactly this shape
+    /// with the stored flag 0x00 — then the SET-mirror `[0x01][u32=0]`, then a bare leading `u32=0`).
+    /// This is the strap's "nothing armed" sentinel, distinct from a genuinely
     /// unparseable payload: an arm the strap silently dropped reads back as epoch 0, so labelling it
     /// "unrecognised" hid the real signal (#34). Only consulted AFTER `armedAlarmEpoch` returns nil, so a
     /// plausible armed epoch never reaches here. Pure/CoreBluetooth-free so AlarmReadbackDecodeTests pin it.
@@ -518,6 +535,7 @@ public final class FrameRouter {
                 | (UInt32(payload[i + 2]) << 16)
                 | (UInt32(payload[i + 3]) << 24)
         }
+        if payload.count == 11, payload.first == 0x01, let e = u32le(at: 2) { return e == 0 }
         if payload.first == 0x01, let e = u32le(at: 1) { return e == 0 }
         if let e = u32le(at: 0) { return e == 0 }
         return false
diff --git a/StrandTests/AlarmReadbackDecodeTests.swift b/StrandTests/AlarmReadbackDecodeTests.swift
index 2e4092d94f..e21b8eda4c 100644
--- a/StrandTests/AlarmReadbackDecodeTests.swift
+++ b/StrandTests/AlarmReadbackDecodeTests.swift
@@ -46,6 +46,40 @@ final class AlarmReadbackDecodeTests: XCTestCase {
         XCTAssertEqual(FrameRouter.armedAlarmEpoch(in: frame), 1_750_990_944)
     }
 
+    /// The armed GET readback, captured verbatim on fw 41.17.6.0 (2026-08-26, #34/#1706): 11 bytes,
+    /// `[form 0x01][stored 0x01][u32 LE epoch][00 00][04 00 20]`, epoch at OFFSET 2. The SET-mirror
+    /// read at offset 1 decodes this very payload to 2_389_889_025 — 2045-09-24, inside the
+    /// plausibility window — so the gate cannot catch the misread and only this fixture pins the
+    /// offset. (The arm that produced it sent epoch 1_787_720_400; the strap stored it exactly.)
+    func testGetReadbackPayload_decodesEpochAtOffsetTwo() {
+        let frame = responseFrame(payload: [0x01, 0x01, 0xD0, 0x72, 0x8E, 0x6A, 0x00, 0x00, 0x04, 0x00, 0x20])
+        XCTAssertEqual(FrameRouter.armedAlarmEpoch(in: frame), 1_787_720_400)
+    }
+
+    /// All three arm/readback pairs from the same capture set (2026-08-26..28): each readback carries
+    /// exactly the epoch the arm sent, at offset 2. Three independent values rule out coincidence —
+    /// under the offset-1 misread each decodes to the value the app actually logged (2389889025 /
+    /// 2412007425 / 2434125825: the sent epoch's low three bytes shifted up a byte, plus the flag).
+    func testGetReadback_allThreeCaptures_decodeTheSentEpoch() {
+        let captures: [([UInt8], UInt32)] = [
+            ([0x01, 0x01, 0xD0, 0x72, 0x8E, 0x6A, 0x00, 0x00, 0x04, 0x00, 0x20], 1_787_720_400),
+            ([0x01, 0x01, 0x50, 0xC4, 0x8F, 0x6A, 0x00, 0x00, 0x04, 0x00, 0x20], 1_787_806_800),
+            ([0x01, 0x01, 0xD0, 0x15, 0x91, 0x6A, 0x00, 0x00, 0x04, 0x00, 0x20], 1_787_893_200),
+        ]
+        for (payload, sentEpoch) in captures {
+            XCTAssertEqual(FrameRouter.armedAlarmEpoch(in: responseFrame(payload: payload)), sentEpoch)
+        }
+    }
+
+    /// An 11-byte readback whose epoch field is implausible falls to the raw-hex line, NOT to the
+    /// mirror offsets — those are known-wrong for this shape (they fold the stored flag into the
+    /// epoch's low byte), so trying them here could resurrect the misread this shape exists to kill.
+    func testGetReadback_implausibleEpoch_fallsToRawHexNotMirrorRead() {
+        let frame = responseFrame(payload: [0x01, 0x01, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x20])
+        XCTAssertNil(FrameRouter.armedAlarmEpoch(in: frame))
+        XCTAssertFalse(FrameRouter.readbackReportsNoAlarm(in: frame))
+    }
+
     /// A result-style single byte (e.g. an UNSUPPORTED echo) must not decode; the router falls back to
     /// the raw-hex line.
     func testShortGarbagePayload_decodesNil() {
@@ -84,6 +118,13 @@ final class AlarmReadbackDecodeTests: XCTestCase {
         XCTAssertFalse(FrameRouter.readbackReportsNoAlarm(in: frame))
     }
 
+    /// An armed 11-byte GET readback is NOT "no alarm" — same mutual exclusion, readback shape.
+    func testArmedGetReadback_isNotReportedAsNoAlarm() {
+        let frame = responseFrame(payload: [0x01, 0x01, 0xD0, 0x72, 0x8E, 0x6A, 0x00, 0x00, 0x04, 0x00, 0x20])
+        XCTAssertEqual(FrameRouter.armedAlarmEpoch(in: frame), 1_787_720_400)
+        XCTAssertFalse(FrameRouter.readbackReportsNoAlarm(in: frame))
+    }
+
     /// A short result-style payload (0x03) is neither an armed epoch NOR the epoch-0 sentinel — it's
     /// genuinely unparseable, so it still falls through to the raw-hex "unrecognised" branch.
     func testShortGarbage_isNotReportedAsNoAlarm() {
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 759e30f5fc..08e42424f6 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -9714,10 +9714,12 @@ internal fun isPlausibleAlarmEpoch(epoch: Long): Boolean = epoch in 1_500_000_00
 
 /**
  * Extract the armed-alarm epoch from a GET_ALARM_TIME (cmd 67) COMMAND_RESPONSE, defensively (#401
- * close-out). The WHOOP 4.0 response layout is UNDOCUMENTED, so this tries the two shapes the firmware
- * could plausibly answer with - the SET_ALARM_TIME mirror (`[form 0x01][u32 LE epoch]…`, matching the
- * 9-byte payload we arm with) first, then a bare leading u32 LE - and accepts a candidate only when it
- * passes [isPlausibleAlarmEpoch]. Anything else returns null and the caller logs raw hex instead.
+ * close-out). The WHOOP 4.0 response layout is UNDOCUMENTED, so this tries the shapes the firmware has
+ * been seen to answer with - the 11-byte GET readback captured on fw 41.17.6.0
+ * (`[form 0x01][stored flag][u32 LE epoch][00 00][04 00 20]`, epoch at offset 2) first, then the
+ * SET_ALARM_TIME mirror (`[form 0x01][u32 LE epoch]…`, matching the 9-byte payload we arm with), then
+ * a bare leading u32 LE - and accepts a candidate only when it passes [isPlausibleAlarmEpoch].
+ * Anything else returns null and the caller logs raw hex instead.
  * Pinned by `AlarmReadbackDecodeTest`; twin of the Swift `FrameRouter.armedAlarmEpoch`.
  */
 internal fun whoop4ArmedAlarmEpoch(frame: ByteArray): Long? {
@@ -9729,6 +9731,18 @@ internal fun whoop4ArmedAlarmEpoch(frame: ByteArray): Long? {
             ((payload[at + 2].toLong() and 0xFFL) shl 16) or
             ((payload[at + 3].toLong() and 0xFFL) shl 24)
     }
+    // The GET readback (fw 41.17.6.0, three arm/readback captures 2026-08-26..28, #34/#1706): the
+    // epoch sits ONE byte further than in the SET mirror, because the readback carries a stored flag
+    // (0x00 = nothing stored, 0x01 = stored) the arm payload does not. The mirror-offset read of this
+    // shape returns the epoch's LOW THREE bytes shifted up a byte, plus the flag — wrong by roughly
+    // 256x and free to land anywhere in u32 range. In all three captures it landed on a 2045 date
+    // INSIDE the 2017..2100 plausibility window (an arm for 2026-08-26 read back as 2045-09-24), so
+    // the gate did not catch it and a MISMATCH was counted against a strap whose register is fine. So
+    // on this shape the mirror offsets are known-wrong and must NOT be tried: offset 2 decodes, or
+    // the payload falls to the raw-hex line.
+    if (payload.size == 11 && payload[0] == 0x01.toByte()) {
+        return u32le(2)?.takeIf { isPlausibleAlarmEpoch(it) }
+    }
     if (payload.isNotEmpty() && payload[0] == 0x01.toByte()) {
         u32le(1)?.takeIf { isPlausibleAlarmEpoch(it) }?.let { return it }
     }
@@ -9737,8 +9751,10 @@ internal fun whoop4ArmedAlarmEpoch(frame: ByteArray): Long? {
 
 /**
  * True when a GET_ALARM_TIME readback explicitly reports NO alarm stored — the epoch field decodes to
- * 0 in the same shapes [whoop4ArmedAlarmEpoch] reads (SET-mirror `[0x01][u32=0]` first, then a bare
- * leading `u32=0`). This is the strap's "nothing armed" sentinel, distinct from a genuinely unparseable
+ * 0 in the same shapes [whoop4ArmedAlarmEpoch] reads (the 11-byte GET readback `[0x01][flag][u32=0]…`
+ * first — the #34 field-report payload `01 00 00 00 00 00 00 00 04 00 20` is exactly this shape with
+ * the stored flag 0x00 — then the SET-mirror `[0x01][u32=0]`, then a bare leading `u32=0`). This is
+ * the strap's "nothing armed" sentinel, distinct from a genuinely unparseable
  * payload: an arm the strap silently dropped reads back as epoch 0, so labelling it "unrecognised" hid
  * the real signal (#34). Only consulted AFTER [whoop4ArmedAlarmEpoch] returns null. Twin of the Swift
  * `FrameRouter.readbackReportsNoAlarm`; pinned by `AlarmReadbackDecodeTest`.
@@ -9752,6 +9768,9 @@ internal fun whoop4ReadbackReportsNoAlarm(frame: ByteArray): Boolean {
             ((payload[at + 2].toLong() and 0xFFL) shl 16) or
             ((payload[at + 3].toLong() and 0xFFL) shl 24)
     }
+    if (payload.size == 11 && payload[0] == 0x01.toByte()) {
+        return u32le(2)?.let { it == 0L } ?: false
+    }
     if (payload.isNotEmpty() && payload[0] == 0x01.toByte()) {
         return u32le(1)?.let { it == 0L } ?: false
     }
diff --git a/android/app/src/test/java/com/noop/ble/AlarmReadbackDecodeTest.kt b/android/app/src/test/java/com/noop/ble/AlarmReadbackDecodeTest.kt
index 3b16408fc1..198b0500b8 100644
--- a/android/app/src/test/java/com/noop/ble/AlarmReadbackDecodeTest.kt
+++ b/android/app/src/test/java/com/noop/ble/AlarmReadbackDecodeTest.kt
@@ -59,6 +59,49 @@ class AlarmReadbackDecodeTest {
         assertEquals(1_750_990_944L, whoop4ArmedAlarmEpoch(frame))
     }
 
+    /**
+     * The armed GET readback, captured verbatim on fw 41.17.6.0 (2026-08-26, #34/#1706): 11 bytes,
+     * `[form 0x01][stored 0x01][u32 LE epoch][00 00][04 00 20]`, epoch at OFFSET 2. The SET-mirror
+     * read at offset 1 decodes this very payload to 2_389_889_025 — 2045-09-24, inside the
+     * plausibility window — so the gate cannot catch the misread and only this fixture pins the
+     * offset. (The arm that produced it sent epoch 1_787_720_400; the strap stored it exactly.)
+     */
+    @Test
+    fun getReadbackPayload_decodesEpochAtOffsetTwo() {
+        val frame = responseFrame(payload = bytes(0x01, 0x01, 0xD0, 0x72, 0x8E, 0x6A, 0x00, 0x00, 0x04, 0x00, 0x20))
+        assertEquals(1_787_720_400L, whoop4ArmedAlarmEpoch(frame))
+    }
+
+    /**
+     * All three arm/readback pairs from the same capture set (2026-08-26..28): each readback carries
+     * exactly the epoch the arm sent, at offset 2. Three independent values rule out coincidence —
+     * under the offset-1 misread each decodes to the value the app actually logged (2389889025 /
+     * 2412007425 / 2434125825: the sent epoch's low three bytes shifted up a byte, plus the flag).
+     */
+    @Test
+    fun getReadback_allThreeCaptures_decodeTheSentEpoch() {
+        val captures = listOf(
+            bytes(0x01, 0x01, 0xD0, 0x72, 0x8E, 0x6A, 0x00, 0x00, 0x04, 0x00, 0x20) to 1_787_720_400L,
+            bytes(0x01, 0x01, 0x50, 0xC4, 0x8F, 0x6A, 0x00, 0x00, 0x04, 0x00, 0x20) to 1_787_806_800L,
+            bytes(0x01, 0x01, 0xD0, 0x15, 0x91, 0x6A, 0x00, 0x00, 0x04, 0x00, 0x20) to 1_787_893_200L,
+        )
+        for ((payload, sentEpoch) in captures) {
+            assertEquals(sentEpoch, whoop4ArmedAlarmEpoch(responseFrame(payload = payload)))
+        }
+    }
+
+    /**
+     * An 11-byte readback whose epoch field is implausible falls to the raw-hex line, NOT to the
+     * mirror offsets — those are known-wrong for this shape (they fold the stored flag into the
+     * epoch's low byte), so trying them here could resurrect the misread this shape exists to kill.
+     */
+    @Test
+    fun getReadback_implausibleEpoch_fallsToRawHexNotMirrorRead() {
+        val frame = responseFrame(payload = bytes(0x01, 0x01, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x20))
+        assertNull(whoop4ArmedAlarmEpoch(frame))
+        assertFalse(whoop4ReadbackReportsNoAlarm(frame))
+    }
+
     /** A result-style single byte (e.g. an UNSUPPORTED echo) must not decode - raw-hex fallback. */
     @Test
     fun shortGarbagePayload_decodesNull() {
@@ -131,6 +174,14 @@ class AlarmReadbackDecodeTest {
         assertFalse(whoop4ReadbackReportsNoAlarm(frame))
     }
 
+    /** An armed 11-byte GET readback is NOT "no alarm" — same mutual exclusion, readback shape. */
+    @Test
+    fun armedGetReadback_isNotReportedAsNoAlarm() {
+        val frame = responseFrame(payload = bytes(0x01, 0x01, 0xD0, 0x72, 0x8E, 0x6A, 0x00, 0x00, 0x04, 0x00, 0x20))
+        assertEquals(1_787_720_400L, whoop4ArmedAlarmEpoch(frame))
+        assertFalse(whoop4ReadbackReportsNoAlarm(frame))
+    }
+
     /** A short result-style payload (0x03) is neither an armed epoch NOR the epoch-0 sentinel. */
     @Test
     fun shortGarbage_isNotReportedAsNoAlarm() {

From 441e88573f07ff6b02711e4d2ce35b89549f4c98 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 01:11:07 +1200
Subject: [PATCH 047/333] Bump build numbers for the next 10.6.1 staging build

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 2cd98e4674..a3e9d0c0fc 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 375
+        versionCode = 376
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 74ee905ef9..ffe7c970c4 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "256"
+    CURRENT_PROJECT_VERSION: "257"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 3fd402ed98fd1550dbb061f4cc04e830a9b6dd31 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 11:17:13 +1200
Subject: [PATCH 048/333] diagnostics: stop the funnel calling a failed sync
 expected (#1719)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Found in a field log from a wearer with a WHOOP 4.0 and a 5.0 on the wrist at the same time.

The night's funnel read grav=0 hr=0 rr=0 resp=0 skin=0 under the ACTIVE strap, and the line beneath
it said "A night worn on a different strap is OWNED by that strap, so this is expected". It was not.
Both straps were worn. The other strap's 59,304 rows are why that id holds samples; the active one
banked nothing because its handshake never completes (#1635) — two backfill attempts that session,
both deferred, zero records decoded. The one line placed to catch that declared it normal, while the
same log shows connections lasting 5.9 hours and 2.5 hours.

No available signal separates the two cases. sync.lastWriteOkAt is app-wide rather than per-device —
in that log it reads 2d ago, which is when the OTHER strap landed the night in question. A per-device
query would be new plumbing on both platforms for something that still could not answer the real
question, which is what was on the wrist. The wearer knows that and this function cannot, so it now
states the fork and names the sync as what to check in the half where something is wrong.

Second correction to this sentence, in the opposite direction from the first: the original asserted a
read failure, otherLiveStrapIds fixed that and over-corrected into denying a real one, and this
asserts neither. Both extremes are recorded in the doc comments so the next reader does not swing it
back a third time.

Parity: the user-facing string is byte-identical across platforms, verified by normalising away the
Kotlin and Swift interpolation and concatenation; the two branches this does not touch are still
identical too; both twin tests gained the same three assertions and all eight case names match.

The case pinning the old wording is renamed — it was called "is expected, not a read failure", which
asserted the exact claim being removed — and its doc comment, which said the same thing, was corrected
in review after the rename had already been made.

Verified: 4,729 Android tests, 0 failures; OrphanedSamplesLineTest 8 of 8; i18n audit clean; both
app-build legs green against this head, which is what compiles the Swift twin test.
---
 Strand/System/DebugDataDiagnostics.swift        | 12 ++++++++++--
 StrandTests/OrphanedSamplesLineTests.swift      | 17 +++++++++++++----
 .../com/noop/testcentre/AndroidDiagnostics.kt   | 12 ++++++++++--
 .../noop/testcentre/OrphanedSamplesLineTest.kt  | 16 ++++++++++++----
 4 files changed, 45 insertions(+), 12 deletions(-)

diff --git a/Strand/System/DebugDataDiagnostics.swift b/Strand/System/DebugDataDiagnostics.swift
index 7b797caa00..bda7d73f51 100644
--- a/Strand/System/DebugDataDiagnostics.swift
+++ b/Strand/System/DebugDataDiagnostics.swift
@@ -500,6 +500,13 @@ enum DebugDataDiagnostics {
     /// each day to whichever device actually holds its data. Samples under another id are then completely
     /// normal, and calling that a read failure sends the reader hunting a bug that is not there. Only when
     /// the id holding the samples is NOT a live registered strap is the #1193 split the explanation left.
+    ///
+    /// That correction then over-corrected. "So this is expected" assumes a night is worn on ONE strap, and
+    /// a reporter wearing a 4.0 and a 5.0 together hit the case it denies: the active strap banked nothing
+    /// because its handshake never completed (#1635), while the other strap's rows made the line declare
+    /// the silence normal. Nothing available here can tell the two apart — the wearer knows which straps
+    /// were on the wrist and this function cannot — so it states the fork instead of picking a side, and
+    /// names the sync as what to check in the half where something IS wrong.
     static func orphanedSamplesLine(activeId: String, othersWithSamples: [(String, Int)],
                                     otherLiveStrapIds: Set<String> = []) -> String {
         if othersWithSamples.isEmpty {
@@ -512,8 +519,9 @@ enum DebugDataDiagnostics {
                 .map { "'\($0.0)' (\($0.1) rows)" }
                 .joined(separator: ", ")
             return "(no raw biometric samples under the ACTIVE id '\(activeId)' for this night — they are "
-                + "under \(who), another registered strap. A night worn on a different strap is OWNED by that "
-                + "strap, so this is expected; the dayOwner line for this date names the owner.)"
+                + "under \(who), another registered strap. If you wore THAT strap this night, this is expected "
+                + "and the dayOwner line for this date names the owner. If you wore BOTH, the active strap "
+                + "banked nothing for this night and its sync is what to check, not this line.)"
         }
         // Tie-break on id: Kotlin's sortedByDescending is stable but Swift's `sorted` is NOT, so equal
         // counts could otherwise order differently on the two platforms and the twin lines would diverge.
diff --git a/StrandTests/OrphanedSamplesLineTests.swift b/StrandTests/OrphanedSamplesLineTests.swift
index 4a1025bafb..f5f49617f8 100644
--- a/StrandTests/OrphanedSamplesLineTests.swift
+++ b/StrandTests/OrphanedSamplesLineTests.swift
@@ -48,10 +48,13 @@ final class OrphanedSamplesLineTests: XCTestCase {
 
     // MARK: - #1193 wording is for a genuine split — NOT for a second strap's night
 
-    /// The over-assertion this branch exists for. A wearer with two straps has nights owned by the other
-    /// one; `DayOwnerResolver` hands each day to whichever device holds its data. Samples under that id
-    /// are expected, and calling it a read failure sends the reader hunting a bug that is not there.
-    func testASecondRegisteredStrapsNightIsExpectedNotAReadFailure() {
+    /// Both over-assertions this branch has carried. It must not call a second strap's night a read
+    /// failure — `DayOwnerResolver` hands each day to whichever device holds its data, so samples under
+    /// that id can be perfectly normal. And it must not call the silence expected either: with a 4.0 and
+    /// a 5.0 worn together the active strap can bank nothing because its handshake never completed
+    /// (#1635), which looks identical from here. The line states both halves; this pins that it keeps
+    /// stating both.
+    func testASecondRegisteredStrapsNightStatesTheForkNeverABareVerdict() {
         let line = DebugDataDiagnostics.orphanedSamplesLine(
             activeId: "whoop-FD:4A",
             othersWithSamples: [("my-whoop", 59_304)],
@@ -61,6 +64,12 @@ final class OrphanedSamplesLineTests: XCTestCase {
         XCTAssertTrue(line.contains("dayOwner"), "must point at the line that settles it")
         XCTAssertFalse(line.contains("are not being read"), "must not claim a bug")
         XCTAssertFalse(line.contains("#1193"))
+        // #1635 dual-wear: it may NOT declare the silence normal outright. Wearing a 4.0 and a 5.0
+        // together, the other strap's rows are present while the ACTIVE one banked nothing because its
+        // handshake never completed — and this function cannot tell that from a single-strap night.
+        XCTAssertTrue(line.contains("If you wore BOTH"), "must state the both-straps half")
+        XCTAssertTrue(line.contains("sync is what to check"), "and name the sync as what to check")
+        XCTAssertFalse(line.contains("OWNED by that strap"), "must not assert one-strap ownership")
     }
 
     /// An id that is NOT a live registered strap is still the #1193 split — that wording must survive.
diff --git a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
index f0c85c62f6..69ba10f20b 100644
--- a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
@@ -507,6 +507,13 @@ object AndroidDiagnostics {
      * ME hunting one). Only when the id holding the samples is NOT a live registered strap is the #1193
      * split the remaining explanation.
      *
+     * That correction then over-corrected. "So this is expected" assumes a night is worn on ONE strap,
+     * and a reporter wearing a 4.0 and a 5.0 together hit the case it denies: the active strap banked
+     * nothing because its handshake never completed (#1635), while the other strap's rows made the line
+     * declare the silence normal. Nothing available here can tell the two apart — the wearer knows which
+     * straps were on the wrist and this function cannot — so it states the fork instead of picking a
+     * side, and names the sync as what to check in the half where something IS wrong.
+     *
      * Pure so the wording is unit-tested without a database, a strap, or a registry.
      */
     internal fun orphanedSamplesLine(
@@ -524,8 +531,9 @@ object AndroidDiagnostics {
                 .sortedWith(compareByDescending<Pair<String, Int>> { it.second }.thenBy { it.first })
                 .joinToString(", ") { "'${it.first}' (${it.second} rows)" }
             return "(no raw biometric samples under the ACTIVE id '$activeId' for this night — they are " +
-                "under $who, another registered strap. A night worn on a different strap is OWNED by that " +
-                "strap, so this is expected; the dayOwner line for this date names the owner.)"
+                "under $who, another registered strap. If you wore THAT strap this night, this is expected " +
+                "and the dayOwner line for this date names the owner. If you wore BOTH, the active strap " +
+                "banked nothing for this night and its sync is what to check, not this line.)"
         }
         // Tie-break on id: Kotlin's sortedByDescending is stable but Swift's `sorted` is NOT, so equal
         // counts could otherwise order differently on the two platforms and the twin lines would diverge.
diff --git a/android/app/src/test/java/com/noop/testcentre/OrphanedSamplesLineTest.kt b/android/app/src/test/java/com/noop/testcentre/OrphanedSamplesLineTest.kt
index 12aaa4e5a0..0122ac0341 100644
--- a/android/app/src/test/java/com/noop/testcentre/OrphanedSamplesLineTest.kt
+++ b/android/app/src/test/java/com/noop/testcentre/OrphanedSamplesLineTest.kt
@@ -62,12 +62,14 @@ class OrphanedSamplesLineTest {
     // #1193 wording is for a genuine split — NOT for a second strap's night
 
     /**
-     * The over-assertion this branch exists for. A wearer with two straps has nights owned by the other
-     * one; DayOwnerResolver hands each day to whichever device holds its data. Samples under that id are
-     * expected, and calling it a read failure sends the reader hunting a bug that is not there.
+     * Both over-assertions this branch has carried. It must not call a second strap's night a read
+     * failure — DayOwnerResolver hands each day to whichever device holds its data, so samples under that
+     * id can be perfectly normal. And it must not call the silence expected either: with a 4.0 and a 5.0
+     * worn together the active strap can bank nothing because its handshake never completed (#1635),
+     * which looks identical from here. The line states both halves; this pins that it keeps stating both.
      */
     @Test
-    fun `a second registered strap's night is expected, not a read failure`() {
+    fun `a second registered strap's night states the fork, never a bare verdict`() {
         val line = AndroidDiagnostics.orphanedSamplesLine(
             activeId = "whoop-FD:4A",
             othersWithSamples = listOf("my-whoop" to 59_304),
@@ -78,6 +80,12 @@ class OrphanedSamplesLineTest {
         assertTrue("must point at the line that settles it", line.contains("dayOwner"))
         assertFalse("must not claim a bug", line.contains("are not being read"))
         assertFalse(line.contains("#1193"))
+        // #1635 dual-wear: it may NOT declare the silence normal outright. Wearing a 4.0 and a 5.0
+        // together, the other strap's rows are present while the ACTIVE one banked nothing because its
+        // handshake never completed — and this function cannot tell that from a single-strap night.
+        assertTrue("must state the both-straps half", line.contains("If you wore BOTH"))
+        assertTrue("and name the sync as what to check", line.contains("sync is what to check"))
+        assertFalse("must not assert one-strap ownership", line.contains("OWNED by that strap"))
     }
 
     /** An id that is NOT a live registered strap is still the #1193 split — that wording must survive. */

From 42354e02e386abb45a6c563f2224c90b03a63a3b Mon Sep 17 00:00:00 2001
From: Bernd Helm <bhelm@users.noreply.github.com>
Date: Sat, 29 Aug 2026 01:23:37 +0200
Subject: [PATCH 049/333] Show a copyable recovery screen after Android crashes
 (#1718)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Contributed by @bhelm. Android already preserved the last uncaught exception for diagnostic exports,
but a startup crash left the user with only the system's "App keeps stopping" flow. This surfaces the
existing record before NOOP initializes its UI, database or BLE state: the full selectable stack
trace, the app/OS/device identity, a one-tap copy, and an explicit retry.

The fingerprint-acknowledge is the part that makes it safe to put in front of launch — an
acknowledged historical crash cannot block every later start, while the crash itself stays on disk
for exports. A newly captured crash after a failed retry shows again.

Android only, by design. The crash surface, its storage and the startup sequence differ enough on
Apple that a twin would be a separate design rather than a port.

Merging with three review points to follow immediately, none of which change what this does:

The crash text is not redacted. redactStrapLogPii exists for exactly this, masks BLE MACs and WHOOP
serials, is documented as total and never throws, and TestBundleAssembler already runs every text
entry through it. The strap-log export has always appended the crash raw, so the exposure predates
this change — but a copy button whose stated purpose is pasting into bug reports turns a latent leak
into an invited one, and the tool to fix it is already in the tree.

pendingCrash runs unguarded in the highest-risk place in the app. lastCrash is wrapped in runCatching,
the file's own pattern, but the surrounding read is not: if getSharedPreferences throws, the app
cannot start at all, which is a poor failure mode for a crash-recovery feature.

acknowledge uses apply() immediately before recreate(). In-process that is fine; a process death
between them loses the acknowledgement and re-shows the same crash. commit() is what the alarm
attribution work settled on for durability-before-action.

Verified: 4 of 4 checks green, 4 new strings present in all seven locale files, and the keys are
hand-authored names rather than the extractor's l10n_*_<hash> convention, which is correct for
strings written by hand.
---
 .../src/main/java/com/noop/CrashCapture.kt    | 56 ++++++++++++++++++-
 .../src/main/java/com/noop/NoopApplication.kt |  6 +-
 .../src/main/java/com/noop/ui/MainActivity.kt | 51 +++++++++++++++++
 .../app/src/main/res/values-de/strings.xml    |  4 ++
 .../app/src/main/res/values-es/strings.xml    |  4 ++
 .../app/src/main/res/values-fr/strings.xml    |  4 ++
 .../app/src/main/res/values-pl/strings.xml    |  4 ++
 .../src/main/res/values-pt-rPT/strings.xml    |  4 ++
 .../app/src/main/res/values-zh/strings.xml    |  4 ++
 android/app/src/main/res/values/strings.xml   |  4 ++
 .../test/java/com/noop/CrashCaptureTest.kt    | 42 ++++++++++++++
 11 files changed, 178 insertions(+), 5 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/CrashCaptureTest.kt

diff --git a/android/app/src/main/java/com/noop/CrashCapture.kt b/android/app/src/main/java/com/noop/CrashCapture.kt
index 5c6b2231df..a4cf0c642c 100644
--- a/android/app/src/main/java/com/noop/CrashCapture.kt
+++ b/android/app/src/main/java/com/noop/CrashCapture.kt
@@ -1,9 +1,11 @@
 package com.noop
 
 import android.content.Context
+import android.os.Build
 import java.io.File
 import java.io.PrintWriter
 import java.io.StringWriter
+import java.security.MessageDigest
 
 /**
  * Captures the last uncaught exception to a file so a crash that only reproduces on a user's own
@@ -14,6 +16,8 @@ import java.io.StringWriter
  */
 object CrashCapture {
     private const val FILE = "last_crash.txt"
+    private const val PREFS = "noop_crash_capture"
+    private const val ACKNOWLEDGED = "acknowledged_fingerprint"
 
     fun install(context: Context) {
         val appContext = context.applicationContext
@@ -24,8 +28,17 @@ object CrashCapture {
                 val sw = StringWriter()
                 throwable.printStackTrace(PrintWriter(sw))
                 val text = buildString {
-                    appendLine("when:   ${java.util.Date()}")
-                    appendLine("thread: ${thread.name}")
+                    append(crashHeader(
+                        whenText = java.util.Date().toString(),
+                        threadName = thread.name,
+                        appVersion = BuildConfig.VERSION_NAME,
+                        versionCode = BuildConfig.VERSION_CODE,
+                        packageName = appContext.packageName,
+                        androidRelease = Build.VERSION.RELEASE,
+                        sdk = Build.VERSION.SDK_INT,
+                        manufacturer = Build.MANUFACTURER,
+                        model = Build.MODEL,
+                    ))
                     appendLine(sw.toString())
                 }
                 File(appContext.filesDir, FILE).writeText(text)
@@ -40,4 +53,43 @@ object CrashCapture {
         if (!f.exists()) return null
         return runCatching { f.readText() }.getOrNull()?.ifBlank { null }
     }
+
+    /** A crash not yet dismissed by the user, shown before launch touches the database or BLE stack. */
+    fun pendingCrash(context: Context): String? {
+        val crash = lastCrash(context) ?: return null
+        val acknowledged = context.applicationContext
+            .getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+            .getString(ACKNOWLEDGED, null)
+        return crash.takeIf { isPending(fingerprint(it), acknowledged) }
+    }
+
+    /** Keep the crash for diagnostics, but allow the next launch attempt to continue. */
+    fun acknowledge(context: Context, crash: String) {
+        context.applicationContext.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+            .edit().putString(ACKNOWLEDGED, fingerprint(crash)).apply()
+    }
+
+    internal fun isPending(fingerprint: String, acknowledged: String?) = fingerprint != acknowledged
+
+    internal fun fingerprint(text: String): String = MessageDigest.getInstance("SHA-256")
+        .digest(text.toByteArray(Charsets.UTF_8))
+        .joinToString("") { "%02x".format(it) }
+
+    internal fun crashHeader(
+        whenText: String,
+        threadName: String,
+        appVersion: String,
+        versionCode: Int,
+        packageName: String,
+        androidRelease: String,
+        sdk: Int,
+        manufacturer: String,
+        model: String,
+    ) = buildString {
+        appendLine("when:   $whenText")
+        appendLine("app:    $appVersion ($versionCode) · $packageName")
+        appendLine("os:     Android $androidRelease (API $sdk)")
+        appendLine("device: $manufacturer $model")
+        appendLine("thread: $threadName")
+    }
 }
diff --git a/android/app/src/main/java/com/noop/NoopApplication.kt b/android/app/src/main/java/com/noop/NoopApplication.kt
index a1b7e8d05c..e9266a514e 100644
--- a/android/app/src/main/java/com/noop/NoopApplication.kt
+++ b/android/app/src/main/java/com/noop/NoopApplication.kt
@@ -43,12 +43,12 @@ class NoopApplication : Application() {
 
     override fun onCreate() {
         super.onCreate()
+        // Install before any app-owned startup work so even an early failure is preserved for the
+        // recovery screen on the next launch.
+        CrashCapture.install(this)
         // #1008: pin the pre-change Overnight-only default for existing installs before anything
         // reads it. Idempotent; a no-op on fresh installs and on every launch after the first.
         com.noop.ui.NoopPrefs.migrateContinuousHrvOvernightDefault(this)
-        // Record any uncaught crash to a file so it rides along in the shareable strap log — a
-        // device-specific crash (e.g. Insights #224/#267) is otherwise lost to an unreachable logcat.
-        CrashCapture.install(this)
     }
 
     /** Process-wide Room-backed store. One instance shared by the UI and the background service. */
diff --git a/android/app/src/main/java/com/noop/ui/MainActivity.kt b/android/app/src/main/java/com/noop/ui/MainActivity.kt
index 10f77adb07..bbbd25576b 100644
--- a/android/app/src/main/java/com/noop/ui/MainActivity.kt
+++ b/android/app/src/main/java/com/noop/ui/MainActivity.kt
@@ -10,7 +10,15 @@ import androidx.activity.ComponentActivity
 import androidx.activity.compose.setContent
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.text.selection.SelectionContainer
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.Button
 import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
@@ -18,6 +26,10 @@ import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalClipboardManager
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.AnnotatedString
+import androidx.compose.ui.unit.dp
 import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.window.Dialog
 import androidx.compose.ui.window.DialogProperties
@@ -25,7 +37,9 @@ import androidx.core.view.WindowCompat
 import androidx.lifecycle.lifecycleScope
 import androidx.lifecycle.viewmodel.compose.viewModel
 import com.noop.BuildConfig
+import com.noop.CrashCapture
 import com.noop.NoopApplication
+import com.noop.R
 import com.noop.ble.WhoopModel
 import com.noop.data.DemoSeeder
 import com.noop.data.WhoopRepository
@@ -57,6 +71,20 @@ class MainActivity : ComponentActivity() {
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
         WindowCompat.setDecorFitsSystemWindows(window, false)
+        CrashCapture.pendingCrash(this)?.let { crash ->
+            setContent {
+                NoopTheme {
+                    CrashRecoveryScreen(
+                        crash = crash,
+                        onContinue = {
+                            CrashCapture.acknowledge(this, crash)
+                            recreate()
+                        },
+                    )
+                }
+            }
+            return
+        }
         // Load the saved "Card transparency" so every frosted card renders at the chosen opacity from launch.
         CardAppearance.init(this)
 
@@ -142,6 +170,29 @@ class MainActivity : ComponentActivity() {
     }
 }
 
+@Composable
+private fun CrashRecoveryScreen(crash: String, onContinue: () -> Unit) {
+    val clipboard = LocalClipboardManager.current
+    Surface(Modifier.fillMaxSize(), color = Palette.surfaceBase) {
+        Column(
+            Modifier.padding(horizontal = 20.dp, vertical = 32.dp).verticalScroll(rememberScrollState()),
+            verticalArrangement = Arrangement.spacedBy(16.dp),
+        ) {
+            Text(stringResource(R.string.crash_recovery_title), style = NoopType.title1, color = Palette.textPrimary)
+            Text(stringResource(R.string.crash_recovery_body), style = NoopType.body, color = Palette.textSecondary)
+            Button(onClick = { clipboard.setText(AnnotatedString(crash)) }) {
+                Text(stringResource(R.string.crash_recovery_copy))
+            }
+            Button(onClick = onContinue) {
+                Text(stringResource(R.string.crash_recovery_continue))
+            }
+            SelectionContainer {
+                Text(crash, style = NoopType.caption, color = Palette.textSecondary)
+            }
+        }
+    }
+}
+
 internal fun appLaunchIntent(context: Context): Intent =
     context.packageManager.getLaunchIntentForPackage(context.packageName)
         ?.apply {
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 67f8a56d1f..114ed45fd2 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2558,4 +2558,8 @@
     <string name="l10n_settings_screen_once_a_day_noop_asks_github_5683aad3">Einmal täglich fragt NOOP bei GitHub die neueste Versionsnummer ab und legt einen Hinweis in Updates ab, wenn es eine neuere gibt. Es werden keine Daten über dich gesendet, und es wird nie etwas installiert.</string>
     <string name="l10n_updates_noop_1s_is_available_05d8ef55">NOOP %1$s ist verfügbar</string>
     <string name="l10n_updates_youre_on_1s_open_settings_and_35b9e135">Du nutzt %1$s. Öffne die Einstellungen und tippe auf „Nach Updates suchen“, um die Neuerungen zu sehen und %2$s herunterzuladen.</string>
+    <string name="crash_recovery_title">NOOP wurde unerwartet beendet</string>
+    <string name="crash_recovery_body">Der letzte Absturz wird unten angezeigt. Du kannst ihn für einen Fehlerbericht kopieren und danach erneut versuchen, die App zu öffnen.</string>
+    <string name="crash_recovery_copy">Fehler kopieren</string>
+    <string name="crash_recovery_continue">NOOP erneut öffnen</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 706c3aea11..b1fa136941 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2544,4 +2544,8 @@
     <string name="l10n_settings_screen_once_a_day_noop_asks_github_5683aad3">Una vez al día, NOOP consulta a GitHub el número de la última versión y deja un aviso en Novedades si hay una más reciente. No se envía nada sobre ti y nunca instala nada.</string>
     <string name="l10n_updates_noop_1s_is_available_05d8ef55">NOOP %1$s ya está disponible</string>
     <string name="l10n_updates_youre_on_1s_open_settings_and_35b9e135">Tienes la %1$s. Abre Ajustes y usa Buscar actualizaciones para ver las novedades y descargar la %2$s.</string>
+    <string name="crash_recovery_title">NOOP se cerró inesperadamente</string>
+    <string name="crash_recovery_body">El último fallo aparece abajo. Puedes copiarlo para informar del error y volver a intentar abrir la aplicación.</string>
+    <string name="crash_recovery_copy">Copiar error</string>
+    <string name="crash_recovery_continue">Intentar abrir NOOP</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 8c81a0f00b..b971d2bf06 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2543,4 +2543,8 @@
     <string name="l10n_settings_screen_once_a_day_noop_asks_github_5683aad3">Une fois par jour, NOOP demande à GitHub le numéro de la dernière version et dépose une note dans Mises à jour s’il en existe une plus récente. Aucune donnée vous concernant n’est envoyée, et rien n’est jamais installé.</string>
     <string name="l10n_updates_noop_1s_is_available_05d8ef55">NOOP %1$s est disponible</string>
     <string name="l10n_updates_youre_on_1s_open_settings_and_35b9e135">Vous utilisez la version %1$s. Ouvrez les Réglages et utilisez Rechercher des mises à jour pour voir les nouveautés et télécharger la %2$s.</string>
+    <string name="crash_recovery_title">NOOP s’est arrêté inopinément</string>
+    <string name="crash_recovery_body">Le dernier plantage est affiché ci-dessous. Vous pouvez le copier pour un rapport, puis réessayer d’ouvrir l’application.</string>
+    <string name="crash_recovery_copy">Copier l’erreur</string>
+    <string name="crash_recovery_continue">Réessayer d’ouvrir NOOP</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 651edae8b2..625efd6959 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2549,4 +2549,8 @@
     <string name="l10n_settings_screen_once_a_day_noop_asks_github_5683aad3">Raz dziennie NOOP pyta GitHub o numer najnowszej wersji i dodaje notatkę w Aktualizacjach, jeśli jest nowsza. Nic o tobie nie jest wysyłane i nic nigdy nie jest instalowane.</string>
     <string name="l10n_updates_noop_1s_is_available_05d8ef55">NOOP %1$s jest dostępny</string>
     <string name="l10n_updates_youre_on_1s_open_settings_and_35b9e135">Masz wersję %1$s. Otwórz Ustawienia i użyj opcji Sprawdź aktualizacje, aby zobaczyć nowości i pobrać %2$s.</string>
+    <string name="crash_recovery_title">NOOP nieoczekiwanie się zatrzymał</string>
+    <string name="crash_recovery_body">Poniżej znajduje się ostatni błąd. Możesz go skopiować do zgłoszenia, a następnie spróbować ponownie otworzyć aplikację.</string>
+    <string name="crash_recovery_copy">Kopiuj błąd</string>
+    <string name="crash_recovery_continue">Spróbuj otworzyć NOOP</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index d14c3abe8a..28cbb2ad93 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2537,4 +2537,8 @@
     <string name="l10n_settings_screen_once_a_day_noop_asks_github_5683aad3">Uma vez por dia, o NOOP pergunta ao GitHub o número da versão mais recente e deixa uma nota em Atualizações se existir uma mais recente. Não é enviado nada sobre si e nunca instala nada.</string>
     <string name="l10n_updates_noop_1s_is_available_05d8ef55">O NOOP %1$s está disponível</string>
     <string name="l10n_updates_youre_on_1s_open_settings_and_35b9e135">Tem a versão %1$s. Abra as Definições e use Procurar atualizações para ver as novidades e transferir a %2$s.</string>
+    <string name="crash_recovery_title">O NOOP terminou inesperadamente</string>
+    <string name="crash_recovery_body">A última falha aparece abaixo. Podes copiá-la para um relatório e voltar a tentar abrir a aplicação.</string>
+    <string name="crash_recovery_copy">Copiar erro</string>
+    <string name="crash_recovery_continue">Tentar abrir o NOOP</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index dd1df9fad5..25b1396b8a 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2458,4 +2458,8 @@
     <string name="l10n_settings_screen_once_a_day_noop_asks_github_5683aad3">NOOP 每天向 GitHub 查询一次最新版本号，如果有更新版本，就在「更新」中留下提示。不会发送任何与你有关的信息，也绝不会安装任何东西。</string>
     <string name="l10n_updates_noop_1s_is_available_05d8ef55">NOOP %1$s 可用</string>
     <string name="l10n_updates_youre_on_1s_open_settings_and_35b9e135">你当前使用 %1$s。打开「设置」并使用「检查更新」查看新增内容并下载 %2$s。</string>
+    <string name="crash_recovery_title">NOOP 意外停止</string>
+    <string name="crash_recovery_body">上次崩溃信息显示在下方。你可以复制它用于错误报告，然后再次尝试打开应用。</string>
+    <string name="crash_recovery_copy">复制错误</string>
+    <string name="crash_recovery_continue">再次打开 NOOP</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index f699e2b81d..b65532a0ea 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2571,4 +2571,8 @@
     <string name="l10n_settings_screen_once_a_day_noop_asks_github_5683aad3">Once a day, NOOP asks GitHub for the latest version number and puts a note in Updates if there’s a newer one. Nothing about you is sent, and it never installs anything.</string>
     <string name="l10n_updates_noop_1s_is_available_05d8ef55">NOOP %1$s is available</string>
     <string name="l10n_updates_youre_on_1s_open_settings_and_35b9e135">You\'re on %1$s. Open Settings and use Check for updates to see what\'s new and download %2$s.</string>
+    <string name="crash_recovery_title">NOOP stopped unexpectedly</string>
+    <string name="crash_recovery_body">The last crash is shown below. You can copy it for a bug report, then try opening the app again.</string>
+    <string name="crash_recovery_copy">Copy error</string>
+    <string name="crash_recovery_continue">Try opening NOOP</string>
 </resources>
diff --git a/android/app/src/test/java/com/noop/CrashCaptureTest.kt b/android/app/src/test/java/com/noop/CrashCaptureTest.kt
new file mode 100644
index 0000000000..8c71a3e3a0
--- /dev/null
+++ b/android/app/src/test/java/com/noop/CrashCaptureTest.kt
@@ -0,0 +1,42 @@
+package com.noop
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class CrashCaptureTest {
+    @Test
+    fun unchangedCrashIsShownUntilAcknowledged() {
+        val fingerprint = CrashCapture.fingerprint("stack trace")
+        assertTrue(CrashCapture.isPending(fingerprint, null))
+        assertTrue(CrashCapture.isPending(fingerprint, "older crash"))
+        assertFalse(CrashCapture.isPending(fingerprint, fingerprint))
+    }
+
+    @Test
+    fun fingerprintIsStableAndDistinguishesNewCrashes() {
+        assertEquals(CrashCapture.fingerprint("same"), CrashCapture.fingerprint("same"))
+        assertNotEquals(CrashCapture.fingerprint("first"), CrashCapture.fingerprint("second"))
+    }
+
+    @Test
+    fun crashHeaderIdentifiesBuildAndAndroidDevice() {
+        val header = CrashCapture.crashHeader(
+            whenText = "Fri Aug 28 18:23:24 GMT+02:00 2026",
+            threadName = "DefaultDispatcher-worker-6",
+            appVersion = "10.6.1-staging",
+            versionCode = 388,
+            packageName = "com.noop.whoop.staging",
+            androidRelease = "16",
+            sdk = 36,
+            manufacturer = "Google",
+            model = "Pixel 9",
+        )
+        assertTrue(header.contains("app:    10.6.1-staging (388) · com.noop.whoop.staging"))
+        assertTrue(header.contains("os:     Android 16 (API 36)"))
+        assertTrue(header.contains("device: Google Pixel 9"))
+        assertTrue(header.contains("thread: DefaultDispatcher-worker-6"))
+    }
+}

From f4ee363da3517d7fded8f56232eac5eaf170d238 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 11:52:08 +1200
Subject: [PATCH 050/333] Redact the captured crash everywhere it leaves the
 device (#1720)

Follow-up to #1718. The recovery screen's copy button was copying the crash verbatim, and the audit found the screen was the smaller half: LogExport.writeLogFile appended the crash unredacted to the shared strap log, the artifact people attach to issues, eight lines below a comment saying one export cannot be safe while the other leaks. The test bundle was already safe.

The crash stays raw for acknowledge(), which fingerprints what it is given while pendingCrash() fingerprints the stored file; redacting before that call would make the screen reappear on every launch forever. A test pins the two fingerprints apart. pendingCrash is now total, since a throw in the first thing onCreate runs stops the app starting at all. acknowledge uses commit() because the caller recreates the Activity immediately.

Android only; Swift has no crash producer and its placeholder already attaches redacted.
---
 .../src/main/java/com/noop/CrashCapture.kt    | 33 ++++++++++++++-----
 .../src/main/java/com/noop/ui/LogExport.kt    | 17 ++++++++--
 .../src/main/java/com/noop/ui/MainActivity.kt | 15 +++++++--
 .../test/java/com/noop/CrashCaptureTest.kt    | 27 +++++++++++++++
 .../com/noop/ui/LogExportCrashSectionTest.kt  | 26 +++++++++++++++
 5 files changed, 105 insertions(+), 13 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ui/LogExportCrashSectionTest.kt

diff --git a/android/app/src/main/java/com/noop/CrashCapture.kt b/android/app/src/main/java/com/noop/CrashCapture.kt
index a4cf0c642c..57c2351be6 100644
--- a/android/app/src/main/java/com/noop/CrashCapture.kt
+++ b/android/app/src/main/java/com/noop/CrashCapture.kt
@@ -54,19 +54,36 @@ object CrashCapture {
         return runCatching { f.readText() }.getOrNull()?.ifBlank { null }
     }
 
-    /** A crash not yet dismissed by the user, shown before launch touches the database or BLE stack. */
-    fun pendingCrash(context: Context): String? {
-        val crash = lastCrash(context) ?: return null
+    /**
+     * A crash not yet dismissed by the user, shown before launch touches the database or BLE stack.
+     *
+     * TOTAL, like [lastCrash] beside it: this is the FIRST thing `MainActivity.onCreate` runs, so a
+     * throw here does not degrade the recovery screen — it stops the app starting at all, on every
+     * launch, with no screen left to explain why. A crash-recovery feature that bricks startup is a
+     * worse failure than the crash it exists to report, so any failure reading the acknowledgement
+     * yields null and normal startup proceeds.
+     */
+    fun pendingCrash(context: Context): String? = runCatching {
+        val crash = lastCrash(context) ?: return@runCatching null
         val acknowledged = context.applicationContext
             .getSharedPreferences(PREFS, Context.MODE_PRIVATE)
             .getString(ACKNOWLEDGED, null)
-        return crash.takeIf { isPending(fingerprint(it), acknowledged) }
-    }
+        crash.takeIf { isPending(fingerprint(it), acknowledged) }
+    }.getOrNull()
 
-    /** Keep the crash for diagnostics, but allow the next launch attempt to continue. */
+    /**
+     * Keep the crash for diagnostics, but allow the next launch attempt to continue.
+     *
+     * `commit()` rather than `apply()`: the caller recreates the Activity immediately, and a process
+     * death between the two would lose an asynchronous write and put the same crash back in front of
+     * the user. The write is one small string on a path taken once per crash, so paying for durability
+     * here costs nothing measurable and removes the only way this can repeat itself.
+     */
     fun acknowledge(context: Context, crash: String) {
-        context.applicationContext.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
-            .edit().putString(ACKNOWLEDGED, fingerprint(crash)).apply()
+        runCatching {
+            context.applicationContext.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+                .edit().putString(ACKNOWLEDGED, fingerprint(crash)).commit()
+        }
     }
 
     internal fun isPending(fingerprint: String, acknowledged: String?) = fingerprint != acknowledged
diff --git a/android/app/src/main/java/com/noop/ui/LogExport.kt b/android/app/src/main/java/com/noop/ui/LogExport.kt
index 7cd8b8352f..54279fc084 100644
--- a/android/app/src/main/java/com/noop/ui/LogExport.kt
+++ b/android/app/src/main/java/com/noop/ui/LogExport.kt
@@ -266,12 +266,11 @@ object LogExport {
 
         // Append the last captured crash (if any) so a device-specific crash like the Insights
         // tab (#224/#267) arrives with its real stack trace instead of being unreachable.
-        val crash = com.noop.CrashCapture.lastCrash(context)
-        val crashSection = if (crash != null) "\n\n${"─".repeat(40)}\nLast crash:\n$crash" else ""
+        val crashText = crashSection(com.noop.CrashCapture.lastCrash(context))
 
         val dir = File(context.cacheDir, "logs").apply { mkdirs() }
         val file = File(dir, "noop-strap-log-${timestamp()}.txt")
-        file.writeText(header + "\n" + body + crashSection)
+        file.writeText(header + "\n" + body + crashText)
         return file
     }
 
@@ -394,6 +393,18 @@ object LogExport {
         sharingLog = sharingLog,
     )
 
+    /**
+     * The trailing "Last crash" section of a shared strap log, with its PII scrubbed.
+     *
+     * The crash file is written by the uncaught-exception handler, so unlike the rolling body it never
+     * passes through `WhoopBleClient.log()`'s sink — an exception message that names a strap ("no device
+     * FD:..") would carry a real BLE address straight into a public issue, and this is the artifact
+     * people attach to one. Same rule the header lines above already follow (#453): one export cannot
+     * be safe while the other leaks. Pure so the redaction is assertable without a Context.
+     */
+    internal fun crashSection(crash: String?): String =
+        if (crash == null) "" else "\n\n${"─".repeat(40)}\nLast crash:\n${com.noop.ble.redactStrapLogPii(crash)}"
+
     /**
      * Whether the on-disk capture holds any frames at all.
      *
diff --git a/android/app/src/main/java/com/noop/ui/MainActivity.kt b/android/app/src/main/java/com/noop/ui/MainActivity.kt
index bbbd25576b..4b37e65c8e 100644
--- a/android/app/src/main/java/com/noop/ui/MainActivity.kt
+++ b/android/app/src/main/java/com/noop/ui/MainActivity.kt
@@ -71,6 +71,10 @@ class MainActivity : ComponentActivity() {
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
         WindowCompat.setDecorFitsSystemWindows(window, false)
+        // NOTE: `crash` stays RAW here on purpose. acknowledge() fingerprints what it is given, and
+        // pendingCrash() fingerprints the stored file — hand it redacted text and the two hashes never
+        // match, so the screen would reappear on every launch forever, which is precisely the loop the
+        // fingerprint exists to prevent. Masking happens where it is SHOWN and COPIED, inside the screen.
         CrashCapture.pendingCrash(this)?.let { crash ->
             setContent {
                 NoopTheme {
@@ -173,6 +177,13 @@ class MainActivity : ComponentActivity() {
 @Composable
 private fun CrashRecoveryScreen(crash: String, onContinue: () -> Unit) {
     val clipboard = LocalClipboardManager.current
+    // Masked for the two paths that leave the device — the visible trace and the clipboard. The stored
+    // file stays verbatim for anything that needs it, and the acknowledgement fingerprint is taken on
+    // the raw text by the caller. redactStrapLogPii is the same sink the strap log and the test bundle
+    // use (BLE MACs and WHOOP serials) and is documented as total, so it cannot throw here. A BLE
+    // exception carrying a device address is exactly its shape, and this screen's copy button exists
+    // to paste into public bug reports.
+    val shown = remember(crash) { com.noop.ble.redactStrapLogPii(crash) }
     Surface(Modifier.fillMaxSize(), color = Palette.surfaceBase) {
         Column(
             Modifier.padding(horizontal = 20.dp, vertical = 32.dp).verticalScroll(rememberScrollState()),
@@ -180,14 +191,14 @@ private fun CrashRecoveryScreen(crash: String, onContinue: () -> Unit) {
         ) {
             Text(stringResource(R.string.crash_recovery_title), style = NoopType.title1, color = Palette.textPrimary)
             Text(stringResource(R.string.crash_recovery_body), style = NoopType.body, color = Palette.textSecondary)
-            Button(onClick = { clipboard.setText(AnnotatedString(crash)) }) {
+            Button(onClick = { clipboard.setText(AnnotatedString(shown)) }) {
                 Text(stringResource(R.string.crash_recovery_copy))
             }
             Button(onClick = onContinue) {
                 Text(stringResource(R.string.crash_recovery_continue))
             }
             SelectionContainer {
-                Text(crash, style = NoopType.caption, color = Palette.textSecondary)
+                Text(shown, style = NoopType.caption, color = Palette.textSecondary)
             }
         }
     }
diff --git a/android/app/src/test/java/com/noop/CrashCaptureTest.kt b/android/app/src/test/java/com/noop/CrashCaptureTest.kt
index 8c71a3e3a0..949ffc5f0d 100644
--- a/android/app/src/test/java/com/noop/CrashCaptureTest.kt
+++ b/android/app/src/test/java/com/noop/CrashCaptureTest.kt
@@ -39,4 +39,31 @@ class CrashCaptureTest {
         assertTrue(header.contains("device: Google Pixel 9"))
         assertTrue(header.contains("thread: DefaultDispatcher-worker-6"))
     }
+
+    // ---- hardening (follow-up to the recovery screen) ----
+
+    /**
+     * The acknowledgement fingerprint is taken on the RAW crash, and the screen shows a REDACTED copy.
+     * If the two ever swap, the hashes stop matching and the recovery screen reappears on every launch
+     * forever — the exact loop the fingerprint exists to prevent, and invisible until someone crashes
+     * with a MAC in the message.
+     */
+    @Test fun redactingForDisplayWouldChangeTheFingerprint() {
+        val raw = "when: now\nthread: main\njava.lang.IllegalStateException: no device FD:12:34:56:78:9A"
+        val shown = com.noop.ble.redactStrapLogPii(raw)
+        assertNotEquals("redaction must actually change this fixture, or the test proves nothing", raw, shown)
+        assertNotEquals(
+            "so acknowledge() must be given the RAW text, never the shown one",
+            CrashCapture.fingerprint(raw),
+            CrashCapture.fingerprint(shown),
+        )
+    }
+
+    /** What the screen renders must carry no MAC, whatever the exception message held. */
+    @Test fun theShownCrashHasItsMacMasked() {
+        val raw = "java.lang.IllegalStateException: no device FD:12:34:56:78:9A"
+        val shown = com.noop.ble.redactStrapLogPii(raw)
+        assertFalse("a full MAC must not survive to the clipboard", shown.contains("FD:12:34:56:78:9A"))
+        assertTrue("and the masked shape is what the rest of the export uses", shown.contains("••"))
+    }
 }
diff --git a/android/app/src/test/java/com/noop/ui/LogExportCrashSectionTest.kt b/android/app/src/test/java/com/noop/ui/LogExportCrashSectionTest.kt
new file mode 100644
index 0000000000..28e9dae4c2
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/LogExportCrashSectionTest.kt
@@ -0,0 +1,26 @@
+package com.noop.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The strap log is the artifact people attach to public issues, and the crash it carries is the one
+ * text in it that never passed through the live log sink's scrub. These pin that it is redacted on
+ * the way out, and that a device with no crash still ships no section rather than an empty heading.
+ */
+class LogExportCrashSectionTest {
+
+    @Test fun aCrashNamingAStrapShipsWithItsMacMasked() {
+        val raw = "when: now\njava.lang.IllegalStateException: no device FD:12:34:56:78:9A"
+        val section = LogExport.crashSection(raw)
+        assertFalse("a full BLE address must not reach a shared log", section.contains("FD:12:34:56:78:9A"))
+        assertTrue("masked in the same shape as the rest of the export", section.contains("••"))
+        assertTrue("and the section is still labelled for whoever reads it", section.contains("Last crash:"))
+    }
+
+    @Test fun noCrashMeansNoSection() {
+        assertEquals("never fabricate a heading for a crash that did not happen", "", LogExport.crashSection(null))
+    }
+}

From def46278de08bd86c059f9ecc99c91ca2cd56eb6 Mon Sep 17 00:00:00 2001
From: Pipiche <8291674+pipiche38@users.noreply.github.com>
Date: Sat, 29 Aug 2026 02:25:38 +0200
Subject: [PATCH 051/333] sleep: a partially-received hypnogram is not a
 complete night (#1717)

A device-provided hypnogram assembled from records that arrived incomplete leaves a hole in stagesJSON while startTs/endTs still span the whole night, so the row looks well-formed and describes a fraction of the night it claims. HypnogramCoverage derives the covered ratio on read - nothing persisted, no migration, so it applies retroactively - and richness becomes a rank (2 covers its span, 1 holed, 0 none) with the computed day winning only when it out-ranks the import. Collapsing 1 and 0 gives back the presence rule exactly, so every case #241 decided it still decides the same way.

Verified on review: all six rank pairs preserve the old outcomes, the new confidence clause sits behind a base != SOLID guard so it can only downgrade, and both platforms carry identical clause ordering and engine accumulation. Full Android suite here: 4739 pass, 0 failures - the two RecoveryDriversTest float failures reported in the PR did not reproduce, so those look environmental. All 15 CI checks green.

Follow-up tracked separately: Swift casts the stage array whole and returns nil when any element is not an object, while Kotlin skips per element and measures the rest, so the two disagree on heterogeneous payloads - unreachable from current producers, and not covered by the oracle's 18 cases. The Xiaomi importer is also the one import path that writes timestamped segments, so it falls under this gate despite the stated scope, untested. And at the engine call site the minute-dict protection comes from the coveredSeconds > 0 guard rather than the shape check described.

Thanks @pipiche38 - 31 nights of ring data with 22 strap-paired for ground truth, and an oracle that pins the 0.95 boundary double.
---
 .../StrandAnalytics/AnalyticsEngine.swift     |  18 ++-
 .../StrandAnalytics/ScoreConfidence.swift     |  27 +++-
 .../AnalyticsEngineTests.swift                |  55 ++++++++
 .../WhoopStore/HypnogramCoverage.swift        |  87 ++++++++++++
 .../Sources/WhoopStore/SleepMerge.swift       |  35 ++++-
 .../HypnogramCoverageTests.swift              | 101 ++++++++++++++
 .../WhoopStoreTests/SleepMergeTests.swift     |  55 ++++++++
 .../com/noop/analytics/AnalyticsEngine.kt     |  19 ++-
 .../com/noop/analytics/HypnogramCoverage.kt   |  98 +++++++++++++
 .../com/noop/analytics/ScoreConfidence.kt     |  27 +++-
 .../java/com/noop/data/WhoopRepository.kt     |  31 ++++-
 .../analytics/ChargeEffortRestScoringTest.kt  |  71 ++++++++++
 .../noop/analytics/HypnogramCoverageTest.kt   | 129 ++++++++++++++++++
 .../com/noop/data/MergeSleepLocalDayTest.kt   |  64 +++++++++
 14 files changed, 796 insertions(+), 21 deletions(-)
 create mode 100644 Packages/WhoopStore/Sources/WhoopStore/HypnogramCoverage.swift
 create mode 100644 Packages/WhoopStore/Tests/WhoopStoreTests/HypnogramCoverageTests.swift
 create mode 100644 android/app/src/main/java/com/noop/analytics/HypnogramCoverage.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/HypnogramCoverageTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
index b7026d65c9..6a4be87dea 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
@@ -546,17 +546,28 @@ public enum AnalyticsEngine {
         var deepS = 0.0, remS = 0.0, lightS = 0.0, tstS = 0.0
         var inBedS = 0.0, effWeighted = 0.0
         var disturbances = 0
+        // Hypnogram COVERAGE across the group: how much of the fragments' own spans the stage segments
+        // actually account for. Accumulated separately from `inBedS` because that one later absorbs the
+        // inter-fragment gap (#777/#705), which is a different quantity — a bridged out-of-bed gap is
+        // known-awake time between two fragments, whereas a hole INSIDE a fragment is time we never
+        // observed at all. Summed straight off `s.stages` (no JSON re-parse: the segments are already
+        // decoded here), then handed to `HypnogramCoverage` so the ratio/clamp/nil rules have ONE
+        // definition shared with the merge-side guard.
+        var coveredS = 0.0, spanS = 0.0
         for s in mainGroup {
             let m = SleepStager.hypnogramMetrics(s)
             let inBed = Double(s.end - s.start)
             inBedS += inBed                       // each fragment's own in-bed span (the gap is added below)
             effWeighted += s.efficiency * inBed   // in-bed-weighted efficiency across the group
+            spanS += inBed
+            for seg in s.stages where seg.end > seg.start { coveredS += Double(seg.end - seg.start) }
             deepS += m.deepMin * 60.0
             remS += m.remMin * 60.0
             lightS += m.lightMin * 60.0
             tstS += m.tstS
             disturbances += m.disturbances
         }
+        let stageCoverage = HypnogramCoverage.fraction(coveredSeconds: coveredS, spanSeconds: spanS)
         // OUT-OF-BED time BETWEEN bridged fragments is AWAKE (#777/#705): a main night bridged from two
         // fragments split by a 20-min wake gap was reporting that gap as nowhere (it is in no fragment's
         // [start,end) span), so 20+ min of real awake read as ~4 min - a v7.1 regression, multi-reporter.
@@ -952,11 +963,14 @@ public enum AnalyticsEngine {
         let effortConfidence = ScoreConfidence.effort(strain: strain, hrSampleCount: hr.count)
         // Rest confidence with H9: downgrade a high-efficiency night whose deep+REM share is implausibly low
         // to low-confidence (likely staging miss) — honest, no faked stages. tstS/efficiency are the
-        // main-group totals computed above; restorative = deepS + remS.
+        // main-group totals computed above; restorative = deepS + remS. `stageCoverage` adds the third
+        // guard: a night whose stage timeline covers only part of its own span (an incompletely-received
+        // device hypnogram) cannot earn a SOLID Rest either, and neither of the other two can see it.
         let restConfidence = ScoreConfidence.rest(hasSession: !matched.isEmpty,
                                                   hasStagedSleep: hasStagedSleep,
                                                   asleepSeconds: tstS, restorativeSeconds: deepS + remS,
-                                                  efficiency: efficiency, gravitySparse: gravitySparse)
+                                                  efficiency: efficiency, gravitySparse: gravitySparse,
+                                                  stageCoverage: stageCoverage)
 
         return DayResult(daily: daily, sleepSessions: matched, cachedSleep: cachedSleep,
                          workouts: workouts, recovery: recovery, strain: strain,
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/ScoreConfidence.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/ScoreConfidence.swift
index 6c7b2f0217..b5d5978e42 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/ScoreConfidence.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/ScoreConfidence.swift
@@ -1,4 +1,5 @@
 import Foundation
+import WhoopStore
 
 // ScoreConfidence.swift — per-score certainty tier for Charge / Effort / Rest.
 //
@@ -78,25 +79,39 @@ public enum ScoreConfidence: String, Equatable, Sendable, Codable {
     /// suspicious case — high efficiency (lots of measured sleep) but implausibly little restorative.
     public static let highEfficiencyThreshold: Double = 0.85
 
-    /// Rest confidence WITH the H9 stage-quality check AND the sparse-motion guard. Starts from
-    /// `rest(hasSession:hasStagedSleep:)`, then DOWNGRADES a `.solid` tier to `.building` (low-confidence)
-    /// when EITHER:
+    /// Rest confidence WITH the H9 stage-quality check, the sparse-motion guard AND the hypnogram-coverage
+    /// guard. Starts from `rest(hasSession:hasStagedSleep:)`, then DOWNGRADES a `.solid` tier to `.building`
+    /// (low-confidence) when ANY of:
     ///  - the night was staged on SPARSE gravity (`gravitySparse`) — a WHOOP 4.0 synced/offload night banks
     ///    motion coarsely, too sparse to reliably stage sleep (#345), so a confident 85–100 Rest is unearned
     ///    however the engine filled the stages. This catches the case H9 MISSES: a sparse night whose staging
     ///    manufactures HIGH efficiency AND HIGH restorative reads SOLID under H9 alone (the #319 signature),
     ///    yet the underlying data can't support it; OR
     ///  - the night is high-efficiency yet its restorative (deep+REM) share is below
-    ///    `restorativeLowConfidenceShare` — a likely staging miss (#H9).
+    ///    `restorativeLowConfidenceShare` — a likely staging miss (#H9); OR
+    ///  - `stageCoverage` says the stage timeline accounts for less than `HypnogramCoverage.minCoverage` of
+    ///    the span it claims. This is the case the other two structurally cannot see: a device-PROVIDED
+    ///    hypnogram assembled from records that arrived incomplete has real stages over the part that DID
+    ///    arrive, so its restorative share is ordinary and H9 stays quiet, while `gravitySparse` describes
+    ///    the on-device motion stager and is false for a provided hypnogram (and inert for Oura outright,
+    ///    which banks no gravity at all). Measured: a ring night covering 23% of its 601-minute span was
+    ///    stored as 70 minutes of sleep and reported SOLID.
     /// `asleepSeconds`/`restorativeSeconds` are the night's totals; efficiency is asleep/in-bed in [0,1].
+    /// `stageCoverage` is nil when coverage is unknown or not applicable — the guard fails OPEN there, so
+    /// an unmeasurable payload keeps its previous tier rather than being downgraded on no evidence.
     /// `.calibrating`/`.building` from the base call are returned unchanged. Confidence-only — never changes
-    /// the Rest score or invents stages. Engine output only; the UI surfaces the tier later. (#H9, #345)
+    /// the Rest score, invents stages, or claims the uncovered time was awake. Engine output only; the UI
+    /// surfaces the tier later. (#H9, #345)
     public static func rest(hasSession: Bool, hasStagedSleep: Bool,
                             asleepSeconds: Double, restorativeSeconds: Double,
-                            efficiency: Double, gravitySparse: Bool = false) -> ScoreConfidence {
+                            efficiency: Double, gravitySparse: Bool = false,
+                            stageCoverage: Double? = nil) -> ScoreConfidence {
         let base = rest(hasSession: hasSession, hasStagedSleep: hasStagedSleep)
         if base != .solid { return base }
         if gravitySparse { return .building }   // #345: sparse-motion staging can't earn a SOLID Rest
+        if let c = stageCoverage, c < HypnogramCoverage.minCoverage {
+            return .building   // the timeline covers only part of the night it claims
+        }
         if asleepSeconds <= 0 { return base }
         let restorativeShare = restorativeSeconds / asleepSeconds
         if efficiency >= highEfficiencyThreshold && restorativeShare < restorativeLowConfidenceShare {
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AnalyticsEngineTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AnalyticsEngineTests.swift
index e8fc28bbb5..70bd0004c0 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AnalyticsEngineTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AnalyticsEngineTests.swift
@@ -474,6 +474,61 @@ final class AnalyticsEngineTests: XCTestCase {
             .building, "high-efficiency night with near-zero deep+REM is low-confidence staging")
     }
 
+    // Hypnogram coverage: a stage timeline that accounts for only part of the span it claims cannot earn
+    // a SOLID Rest. This is the case the other two guards structurally cannot see — see the real night
+    // reproduced in `testRestConfidenceCoverageCatchesTheNightH9AndGravityMiss`.
+    func testRestConfidenceCoverageDowngradesHoledHypnogram() {
+        let asleep = 8.0 * 3600.0
+        XCTAssertEqual(
+            ScoreConfidence.rest(hasSession: true, hasStagedSleep: true,
+                                 asleepSeconds: asleep, restorativeSeconds: asleep * 0.45,
+                                 efficiency: 0.80, stageCoverage: 0.23),
+            .building, "a timeline covering 23% of its span cannot earn a SOLID Rest")
+    }
+
+    func testRestConfidenceCoverageKeepsSolidWhenTimelineCoversItsSpan() {
+        let asleep = 8.0 * 3600.0
+        XCTAssertEqual(
+            ScoreConfidence.rest(hasSession: true, hasStagedSleep: true,
+                                 asleepSeconds: asleep, restorativeSeconds: asleep * 0.45,
+                                 efficiency: 0.80, stageCoverage: 1.0),
+            .solid)
+    }
+
+    /// Unknown coverage must fail OPEN — nil is "not measured", never "measured badly". Omitting the
+    /// argument entirely (every pre-existing caller) must behave identically.
+    func testRestConfidenceCoverageUnknownDoesNotDowngrade() {
+        let asleep = 8.0 * 3600.0
+        for coverage in [nil, Optional(1.0)] {
+            XCTAssertEqual(
+                ScoreConfidence.rest(hasSession: true, hasStagedSleep: true,
+                                     asleepSeconds: asleep, restorativeSeconds: asleep * 0.45,
+                                     efficiency: 0.80, stageCoverage: coverage),
+                .solid, "coverage \(String(describing: coverage)) must not downgrade")
+        }
+    }
+
+    /// The measured night this guard exists for (2026-08-18, Oura ring vs a paired WHOOP strap): the
+    /// hypnogram covered 140 of 601 minutes, so NOOP stored 70 minutes of sleep where the strap recorded
+    /// 494. It read SOLID because NEITHER existing guard applies — `gravitySparse` is false (Oura banks
+    /// no gravity at all, so `isGravitySparse` returns false for every ring night) and H9 needs
+    /// efficiency ≥ 0.85 against this night's 0.50. Pinned so a future refactor cannot quietly lose it.
+    func testRestConfidenceCoverageCatchesTheNightH9AndGravityMiss() {
+        let asleep = 70.0 * 60.0
+        let restorative = asleep * 0.45          // ordinary share over the part that DID arrive
+        XCTAssertEqual(
+            ScoreConfidence.rest(hasSession: true, hasStagedSleep: true,
+                                 asleepSeconds: asleep, restorativeSeconds: restorative,
+                                 efficiency: 0.50, gravitySparse: false),
+            .solid, "precondition: without coverage this night reads SOLID — that is the bug")
+        XCTAssertEqual(
+            ScoreConfidence.rest(hasSession: true, hasStagedSleep: true,
+                                 asleepSeconds: asleep, restorativeSeconds: restorative,
+                                 efficiency: 0.50, gravitySparse: false,
+                                 stageCoverage: 140.0 / 601.0),
+            .building, "with coverage it is correctly low-confidence")
+    }
+
     func testRestConfidenceH9KeepsSolidWhenRestorativeHealthy() {
         // Same high-efficiency night but a healthy ~45% restorative share → stays solid.
         let asleep = 8.0 * 3600.0
diff --git a/Packages/WhoopStore/Sources/WhoopStore/HypnogramCoverage.swift b/Packages/WhoopStore/Sources/WhoopStore/HypnogramCoverage.swift
new file mode 100644
index 0000000000..ff48cda5c9
--- /dev/null
+++ b/Packages/WhoopStore/Sources/WhoopStore/HypnogramCoverage.swift
@@ -0,0 +1,87 @@
+import Foundation
+
+/// How much of a sleep session's `[startTs, endTs)` span its stage segments actually account for.
+///
+/// WHY THIS EXISTS. A session's stage timeline is supposed to TILE its span — `SleepStageTotals`
+/// says so explicitly ("the segment stages noop stores ... TILE the window ... Σ stage minutes equals
+/// the clock span"), and every consumer is written as though it does. One producer breaks that
+/// invariant: a device-PROVIDED hypnogram assembled from records that arrived INCOMPLETE. The Oura
+/// path (`OuraSleepSessionMapping`) merges only CONTIGUOUS codes, so a sleep-phase page that never
+/// arrived leaves a hole in `stagesJSON` while `startTs`/`endTs` still span the whole night. The
+/// result is a session that looks well-formed — non-empty, many segments, a plausible efficiency —
+/// but describes a fraction of the night it claims.
+///
+/// Measured on 31 consecutive ring nights, 8 of them came in under 95% and one covered 23% of its
+/// own span (601 min claimed, 140 min of segments). Downstream that night was stored as 70 minutes of
+/// sleep against a paired strap's 494, and nothing flagged it: the merge's richness rule tests only
+/// that stages are PRESENT, and Rest's two confidence guards are `gravitySparse` (inert here — Oura
+/// stores no gravity at all, so `isGravitySparse` returns false for every ring night) and the #H9
+/// restorative floor (needs efficiency ≥ 0.85; the holed night read 0.50).
+///
+/// So the missing quantity is not a new measurement — it is a RATIO of two numbers already stored.
+/// Nothing here is persisted and no migration is needed: coverage is derived on read, which also means
+/// it applies retroactively to nights already in the database.
+///
+/// HONEST-DATA: this only ever reports how much of the night was OBSERVED. It never fills a hole in,
+/// and in particular it must not let a caller treat unobserved time as awake — we do not know what
+/// happened there, and asserting wake would be the same overreach in the opposite direction.
+///
+/// PARITY: pure + deterministic, byte-identical to the Kotlin twin
+/// (`com.noop.analytics.HypnogramCoverage`). Keep the two in lockstep.
+public enum HypnogramCoverage {
+
+    /// Coverage at or above which a stage timeline is treated as describing its whole span.
+    ///
+    /// The observed split is wide: healthy nights land at 99–100%, the broken ones at 23–93%. 0.95
+    /// sits in the empty middle, so the gate is not balanced on the edge of the data.
+    public static let minCoverage: Double = 0.95
+
+    /// The covered fraction of `spanSeconds`, or nil when the question does not apply.
+    ///
+    /// Returns nil — meaning "unknown, do not judge" — rather than 0 when there is nothing to measure,
+    /// so an unknown coverage can never be mistaken for a bad one by a caller that compares against
+    /// `minCoverage`. Clamped to at most 1: segments that overlap or overhang would otherwise report
+    /// more than a full night, and for a completeness gate the safe direction is to read that as
+    /// "complete" rather than to invent a failure out of malformed input.
+    public static func fraction(coveredSeconds: Double, spanSeconds: Double) -> Double? {
+        guard spanSeconds > 0, coveredSeconds > 0 else { return nil }
+        return min(1.0, coveredSeconds / spanSeconds)
+    }
+
+    /// The covered fraction of `spanSeconds` for a session's stored `stagesJSON`, or nil when coverage
+    /// is not a meaningful question for that payload.
+    ///
+    /// nil for: a nil/blank/`"[]"` payload (no stages at all — that is the richness question, not this
+    /// one) and for the IMPORTED minute-dict shape `{light,deep,rem,awake}`, which carries no
+    /// timestamps and therefore cannot be compared against a span. That second case is what keeps this
+    /// gate away from WHOOP/Apple/Health-Connect imports entirely: they are never judged incomplete
+    /// here, so no existing import behaviour changes.
+    public static func fraction(stagesJSON: String?, spanSeconds: Double) -> Double? {
+        guard let json = stagesJSON?.trimmingCharacters(in: .whitespacesAndNewlines),
+              !json.isEmpty, json != "[]",
+              let data = json.data(using: .utf8),
+              let segs = (try? JSONSerialization.jsonObject(with: data)) as? [[String: Any]]
+        else { return nil }
+        var covered = 0.0
+        for seg in segs {
+            guard let s = (seg["start"] as? NSNumber)?.doubleValue,
+                  let e = (seg["end"] as? NSNumber)?.doubleValue, e > s else { continue }
+            covered += e - s
+        }
+        return fraction(coveredSeconds: covered, spanSeconds: spanSeconds)
+    }
+
+    /// True when the timeline is known to cover less than `minCoverage` of its span — i.e. the session
+    /// demonstrably describes only part of the night it claims. Unknown coverage (nil) is NOT holed:
+    /// every guard built on this fails OPEN, so a payload shape this cannot measure keeps its existing
+    /// behaviour instead of being silently downgraded.
+    public static func isHoled(stagesJSON: String?, spanSeconds: Double) -> Bool {
+        guard let f = fraction(stagesJSON: stagesJSON, spanSeconds: spanSeconds) else { return false }
+        return f < minCoverage
+    }
+
+    /// `isHoled` for a stored session, using its own `[startTs, endTs)` as the span.
+    public static func isHoled(_ s: CachedSleepSession) -> Bool {
+        isHoled(stagesJSON: s.stagesJSON, spanSeconds: Double(s.endTs - s.startTs))
+    }
+}
diff --git a/Packages/WhoopStore/Sources/WhoopStore/SleepMerge.swift b/Packages/WhoopStore/Sources/WhoopStore/SleepMerge.swift
index ecbbcd8d5f..d55d851927 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/SleepMerge.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/SleepMerge.swift
@@ -16,6 +16,23 @@ public enum SleepMerge {
     /// where neither side does, keep the imported-over-computed rule unchanged. (Swift twin of the
     /// Android HealthConnectImporter richness fix, ryanbr/noop#240.)
     ///
+    /// Richness is a RANK, not a yes/no. Presence alone was the original test, and it cannot see a
+    /// device-provided hypnogram assembled from records that arrived incomplete: such a row carries many
+    /// segments — so it passes any presence check — while covering a fraction of the span it claims
+    /// (measured: one ring night with 21 segments over 23% of its 601-minute span, stored as 70 minutes
+    /// of sleep against a paired strap's 494). So a day's best session ranks:
+    ///
+    ///   2  stages that cover the span they claim (`HypnogramCoverage`)
+    ///   1  stages present but HOLED — real, but describing only part of the night
+    ///   0  no stages at all
+    ///
+    /// and the computed day wins only when it OUT-RANKS the import. Collapsing 1 and 0 together gives
+    /// back the original presence rule exactly, so this is a strict generalisation: every case #240
+    /// decided, it still decides the same way. What changes is the pair the old rule could not express
+    /// — a holed import against a COMPLETE computed night, which used to go to the import and now goes
+    /// to the night that actually covers itself. A holed import still beats no stages at all: partial
+    /// data is better than none, it just no longer outranks a whole night.
+    ///
     /// - Parameter endDay: maps a session to its canonical LOCAL end-day key (callers inject their
     ///   timezone-aware keyer so this stays pure and testable).
     public static func merge(imported: [CachedSleepSession],
@@ -30,8 +47,7 @@ public enum SleepMerge {
         out.reserveCapacity(imported.count + computed.count)
         for (day, imp) in importedByDay {
             if let comp = computedByDay[day],
-               !imp.contains(where: hasStages),
-               comp.contains(where: hasStages) {
+               dayRichness(comp) > dayRichness(imp) {
                 out.append(contentsOf: comp)   // richer computed day survives a stage-less import
             } else {
                 out.append(contentsOf: imp)    // imported wins its day (unchanged rule)
@@ -48,4 +64,19 @@ public enum SleepMerge {
         guard let json = s.stagesJSON?.trimmingCharacters(in: .whitespacesAndNewlines) else { return false }
         return !json.isEmpty && json != "[]"
     }
+
+    /// How much of a night this session's stages actually describe: 2 = covers its span, 1 = present but
+    /// holed, 0 = none. A timeline whose coverage cannot be measured (the imported minute-dict shape,
+    /// which has no timestamps) is never holed, so it ranks 2 — imports keep being judged on presence
+    /// exactly as they always were, and this gate cannot reach them.
+    static func richness(_ s: CachedSleepSession) -> Int {
+        guard hasStages(s) else { return 0 }
+        return HypnogramCoverage.isHoled(s) ? 1 : 2
+    }
+
+    /// A day's richness is that of its BEST session — a day with a fully-staged main night plus an
+    /// unstaged nap is a staged day (#715 keeps every session of the winning day either way).
+    static func dayRichness(_ sessions: [CachedSleepSession]) -> Int {
+        sessions.reduce(0) { max($0, richness($1)) }
+    }
 }
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/HypnogramCoverageTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/HypnogramCoverageTests.swift
new file mode 100644
index 0000000000..95978e175d
--- /dev/null
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/HypnogramCoverageTests.swift
@@ -0,0 +1,101 @@
+import XCTest
+@testable import WhoopStore
+
+/// `HypnogramCoverage` — the ratio that tells a well-formed-looking stage timeline from one that
+/// describes only part of the night it claims.
+final class HypnogramCoverageTests: XCTestCase {
+
+    /// Segments tiling `[0, span)` in 30 s steps, `n` of them, starting at `from`.
+    private func segs(_ ranges: [(Int, Int, String)]) -> String {
+        "[" + ranges.map { "{\"start\":\($0.0),\"end\":\($0.1),\"stage\":\"\($0.2)\"}" }
+            .joined(separator: ",") + "]"
+    }
+
+    // MARK: - the ratio itself
+
+    func testFractionIsCoveredOverSpan() {
+        XCTAssertEqual(HypnogramCoverage.fraction(coveredSeconds: 300, spanSeconds: 600)!, 0.5, accuracy: 1e-12)
+        XCTAssertEqual(HypnogramCoverage.fraction(coveredSeconds: 600, spanSeconds: 600)!, 1.0, accuracy: 1e-12)
+    }
+
+    /// Overlapping/overhanging segments would otherwise report more than a whole night. A completeness
+    /// gate must read that as "complete", never manufacture a failure out of malformed input.
+    func testFractionClampsAboveOne() {
+        XCTAssertEqual(HypnogramCoverage.fraction(coveredSeconds: 900, spanSeconds: 600)!, 1.0, accuracy: 1e-12)
+    }
+
+    /// nil means "unknown, do not judge" — distinct from 0, which a caller comparing against
+    /// `minCoverage` would read as a bad night.
+    func testFractionNilWhenNothingToMeasure() {
+        XCTAssertNil(HypnogramCoverage.fraction(coveredSeconds: 300, spanSeconds: 0))
+        XCTAssertNil(HypnogramCoverage.fraction(coveredSeconds: 300, spanSeconds: -1))
+        XCTAssertNil(HypnogramCoverage.fraction(coveredSeconds: 0, spanSeconds: 600))
+    }
+
+    // MARK: - from a stored payload
+
+    func testTilingTimelineCoversItsSpan() {
+        let json = segs([(0, 300, "light"), (300, 600, "deep")])
+        XCTAssertEqual(HypnogramCoverage.fraction(stagesJSON: json, spanSeconds: 600)!, 1.0, accuracy: 1e-12)
+        XCTAssertFalse(HypnogramCoverage.isHoled(stagesJSON: json, spanSeconds: 600))
+    }
+
+    /// The shape this whole change exists for: a hypnogram assembled from records that arrived
+    /// incomplete. Many segments, all real, spanning a night they only partly describe. The measured
+    /// worst case was 140 minutes of segments across a 601-minute span.
+    func testHoledTimelineIsDetected() {
+        let json = segs([(0, 4200, "light"), (4200, 8400, "deep")])   // 140 min over a 601 min span
+        let span = 601.0 * 60.0
+        let f = HypnogramCoverage.fraction(stagesJSON: json, spanSeconds: span)!
+        XCTAssertEqual(f, 8400.0 / span, accuracy: 1e-12)
+        XCTAssertLessThan(f, 0.24)
+        XCTAssertTrue(HypnogramCoverage.isHoled(stagesJSON: json, spanSeconds: span))
+    }
+
+    /// A hole in the MIDDLE is the real failure mode (a page that never arrived), not a short tail.
+    func testInteriorHoleCounts() {
+        let json = segs([(0, 300, "light"), (900, 1200, "deep")])     // 600 s of 1200 s
+        XCTAssertEqual(HypnogramCoverage.fraction(stagesJSON: json, spanSeconds: 1200)!, 0.5, accuracy: 1e-12)
+    }
+
+    func testThresholdBoundaryIsInclusive() {
+        // exactly minCoverage is NOT holed; a hair under it is.
+        let atGate = segs([(0, 950, "light")])
+        let underGate = segs([(0, 949, "light")])
+        XCTAssertFalse(HypnogramCoverage.isHoled(stagesJSON: atGate, spanSeconds: 1000))
+        XCTAssertTrue(HypnogramCoverage.isHoled(stagesJSON: underGate, spanSeconds: 1000))
+    }
+
+    // MARK: - what must NOT be judged
+
+    /// The imported minute-dict shape carries no timestamps, so coverage is unanswerable. It must come
+    /// back nil (not 0), which is what keeps every WHOOP/Apple/Health-Connect import out of this gate.
+    func testImportedMinuteDictIsUnmeasurable() {
+        let dict = "{\"light\":300,\"deep\":100,\"rem\":80,\"awake\":40}"
+        XCTAssertNil(HypnogramCoverage.fraction(stagesJSON: dict, spanSeconds: 3600))
+        XCTAssertFalse(HypnogramCoverage.isHoled(stagesJSON: dict, spanSeconds: 3600))
+    }
+
+    func testEmptyAndMalformedAreUnmeasurable() {
+        for payload in [nil, "", "   ", "[]", "not json"] as [String?] {
+            XCTAssertNil(HypnogramCoverage.fraction(stagesJSON: payload, spanSeconds: 3600),
+                         "payload \(String(describing: payload)) should be unmeasurable")
+            XCTAssertFalse(HypnogramCoverage.isHoled(stagesJSON: payload, spanSeconds: 3600),
+                           "an unmeasurable payload must never read as holed")
+        }
+    }
+
+    /// Every guard built on this fails OPEN: unknown coverage keeps the previous behaviour rather than
+    /// downgrading a night on no evidence.
+    func testSessionOverloadUsesItsOwnSpan() {
+        let holed = CachedSleepSession(startTs: 0, endTs: 1200, efficiency: nil, restingHr: nil,
+                                       avgHrv: nil, stagesJSON: segs([(0, 300, "light")]))
+        let whole = CachedSleepSession(startTs: 0, endTs: 1200, efficiency: nil, restingHr: nil,
+                                       avgHrv: nil, stagesJSON: segs([(0, 1200, "light")]))
+        let stageless = CachedSleepSession(startTs: 0, endTs: 1200, efficiency: nil, restingHr: nil,
+                                          avgHrv: nil, stagesJSON: nil)
+        XCTAssertTrue(HypnogramCoverage.isHoled(holed))
+        XCTAssertFalse(HypnogramCoverage.isHoled(whole))
+        XCTAssertFalse(HypnogramCoverage.isHoled(stageless))
+    }
+}
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/SleepMergeTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/SleepMergeTests.swift
index 4e9320e650..0c5f4b23df 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/SleepMergeTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/SleepMergeTests.swift
@@ -10,7 +10,14 @@ final class SleepMergeTests: XCTestCase {
         CachedSleepSession(startTs: start, endTs: end, efficiency: nil,
                            restingHr: nil, avgHrv: nil, stagesJSON: stages)
     }
+    /// One hour of segments. Against the 8-hour spans these tests use this is a HOLED timeline — which
+    /// is deliberate for the presence-rule cases below (rank 1 behaves exactly as the old "has stages"
+    /// did against a stage-less day) and is the fixture the coverage cases contrast with `tiling`.
     private let someStages = #"[{"start":0,"end":3600,"stage":"deep"}]"#
+    /// A single segment that covers `[start, end)` exactly — a night that accounts for its own span.
+    private func tiling(_ start: Int, _ end: Int) -> String {
+        #"[{"start":\#(start),"end":\#(end),"stage":"deep"}]"#
+    }
     // Deterministic "local day" keyer for the tests (real callers pass their tz-aware keyer).
     private let dayKey: (CachedSleepSession) -> String = { String($0.endTs / 86_400) }
 
@@ -78,6 +85,54 @@ final class SleepMergeTests: XCTestCase {
         XCTAssertEqual(merged.map(\.startTs), [0, 86_400], #""[]" and blank JSON are not stages"#)
     }
 
+    // Coverage rank: a stage timeline that covers only part of the span it claims (a device hypnogram
+    // assembled from records that arrived incomplete) outranks nothing, but not a whole night.
+
+    /// The case the presence-only rule could not express, and the reason this change exists: a HOLED
+    /// import used to win purely by being an import, blanking a computed night that covers itself.
+    func testHoledImportYieldsToFullyCoveredComputedNight() {
+        let comp = session(start: 0, end: 8 * 3600, stages: tiling(0, 8 * 3600))
+        let imp  = session(start: 0, end: 8 * 3600, stages: someStages)   // 1 h of segments over 8 h
+        let merged = SleepMerge.merge(imported: [imp], computed: [comp], endDay: dayKey)
+        XCTAssertEqual(merged.map(\.startTs), [0])
+        XCTAssertEqual(merged.first?.stagesJSON, tiling(0, 8 * 3600),
+                       "the night that covers its own span wins over a holed import")
+    }
+
+    /// …but partial data still beats none. A holed import must not lose to a stage-less computed day.
+    func testHoledImportStillBeatsStagelessComputed() {
+        let comp = session(start: 0, end: 8 * 3600)                        // no stages
+        let imp  = session(start: 3600, end: 8 * 3600 + 1800, stages: someStages)
+        let merged = SleepMerge.merge(imported: [imp], computed: [comp], endDay: dayKey)
+        XCTAssertEqual(merged.map(\.startTs), [3600], "some stages beat none, holed or not")
+    }
+
+    /// Equal rank keeps the imported-over-computed default — the rule only fires on a strict out-rank.
+    func testEquallyHoledSidesKeepImportedWins() {
+        let comp = session(start: 0, end: 8 * 3600, stages: someStages)
+        let imp  = session(start: 3600, end: 8 * 3600 + 1800, stages: someStages)
+        let merged = SleepMerge.merge(imported: [imp], computed: [comp], endDay: dayKey)
+        XCTAssertEqual(merged.map(\.startTs), [3600])
+    }
+
+    /// A fully-covered import is untouched by any of this.
+    func testFullyCoveredImportStillWins() {
+        let comp = session(start: 0, end: 8 * 3600, stages: tiling(0, 8 * 3600))
+        let imp  = session(start: 3600, end: 3600 + 8 * 3600, stages: tiling(3600, 3600 + 8 * 3600))
+        let merged = SleepMerge.merge(imported: [imp], computed: [comp], endDay: dayKey)
+        XCTAssertEqual(merged.map(\.startTs), [3600])
+    }
+
+    /// The imported minute-dict shape carries no timestamps, so it can never be judged holed — every
+    /// WHOOP/Apple/Health-Connect import keeps its existing precedence.
+    func testImportedMinuteDictIsNeverHoled() {
+        let comp = session(start: 0, end: 8 * 3600, stages: tiling(0, 8 * 3600))
+        let imp  = session(start: 3600, end: 8 * 3600 + 1800,
+                           stages: #"{"light":300,"deep":100,"rem":80,"awake":40}"#)
+        let merged = SleepMerge.merge(imported: [imp], computed: [comp], endDay: dayKey)
+        XCTAssertEqual(merged.map(\.startTs), [3600], "a dict-shaped import is not measurable, so it wins as before")
+    }
+
     func testRichnessExceptionKeepsEverySessionOfWinningDay() {
         // Day has computed main night (with stages) + computed nap (no stages); import is stage-less.
         // The WHOLE computed day survives — #715's keep-every-session guarantee still holds.
diff --git a/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt b/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
index b6e09d6d7b..dfecb7be4d 100644
--- a/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
@@ -495,11 +495,22 @@ object AnalyticsEngine {
         var inBedS = 0.0
         var effWeighted = 0.0
         var disturbances = 0
+        // Hypnogram COVERAGE across the group: how much of the fragments' own spans the stage segments
+        // actually account for. Accumulated separately from `inBedS` because that one later absorbs the
+        // inter-fragment gap (#777/#705), which is a different quantity — a bridged out-of-bed gap is
+        // known-awake time between two fragments, whereas a hole INSIDE a fragment is time we never
+        // observed at all. Summed straight off `s.stages` (no JSON re-parse: the segments are already
+        // decoded here), then handed to HypnogramCoverage so the ratio/clamp/null rules have ONE
+        // definition shared with the merge-side guard. Mirrors Swift.
+        var coveredS = 0.0
+        var spanS = 0.0
         for (s in mainGroup) {
             val m = SleepStager.hypnogramMetrics(s)
             val inBed = (s.end - s.start).toDouble()
             inBedS += inBed                       // each fragment's own in-bed span (the gap is added below)
             effWeighted += s.efficiency * inBed   // in-bed-weighted efficiency across the group
+            spanS += inBed
+            for (seg in s.stages) if (seg.end > seg.start) coveredS += (seg.end - seg.start).toDouble()
             deepS += m.deepMin * 60.0
             remS += m.remMin * 60.0
             lightS += m.lightMin * 60.0
@@ -856,8 +867,11 @@ object AnalyticsEngine {
         // Rest confidence with H9 + the #345 sparse-motion guard: downgrade to low-confidence a night whose
         // deep+REM share is implausibly low on a high-efficiency night (H9 staging miss) OR that was staged
         // on sparse gravity (WHOOP 4.0 coarse-banked motion can't reliably stage sleep — a confident 85–100
-        // Rest is unearned however the engine filled it). Confidence-only, no faked stages. tstS/efficiency
-        // are the main-group totals above; restorative = deepS + remS. Mirrors Swift.
+        // Rest is unearned however the engine filled it). `stageCoverage` adds the third guard: a night
+        // whose stage timeline covers only part of its own span (an incompletely-received device
+        // hypnogram) cannot earn a SOLID Rest either, and neither of the other two can see it.
+        // Confidence-only, no faked stages. tstS/efficiency are the main-group totals above;
+        // restorative = deepS + remS. Mirrors Swift.
         val restConfidence = ScoreConfidence.forRest(
             hasSession = matched.isNotEmpty(),
             hasStagedSleep = (deepS + remS) > 0,
@@ -865,6 +879,7 @@ object AnalyticsEngine {
             restorativeSeconds = deepS + remS,
             efficiency = efficiency,
             gravitySparse = gravitySparse,
+            stageCoverage = HypnogramCoverage.fraction(coveredS, spanS),
         )
 
         // ── Per-session per-epoch motion (H8) ─────────────────────────────────
diff --git a/android/app/src/main/java/com/noop/analytics/HypnogramCoverage.kt b/android/app/src/main/java/com/noop/analytics/HypnogramCoverage.kt
new file mode 100644
index 0000000000..c5f8892b45
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/HypnogramCoverage.kt
@@ -0,0 +1,98 @@
+package com.noop.analytics
+
+import org.json.JSONArray
+
+/**
+ * How much of a sleep session's `[startTs, endTs)` span its stage segments actually account for.
+ *
+ * WHY THIS EXISTS. A session's stage timeline is supposed to TILE its span — `SleepStageTotals` says so
+ * explicitly ("the segment stages noop stores ... TILE the window ... Σ stage minutes equals the clock
+ * span"), and every consumer is written as though it does. One producer breaks that invariant: a
+ * device-PROVIDED hypnogram assembled from records that arrived INCOMPLETE. The Oura path
+ * ([com.noop.oura.OuraSleepSessionMapping]) merges only CONTIGUOUS codes, so a sleep-phase page that
+ * never arrived leaves a hole in `stagesJSON` while `startTs`/`endTs` still span the whole night. The
+ * result is a session that looks well-formed — non-empty, many segments, a plausible efficiency — but
+ * describes a fraction of the night it claims.
+ *
+ * Measured on 31 consecutive ring nights, 8 of them came in under 95% and one covered 23% of its own
+ * span (601 min claimed, 140 min of segments). Downstream that night was stored as 70 minutes of sleep
+ * against a paired strap's 494, and nothing flagged it: the merge's richness rule tests only that stages
+ * are PRESENT, and Rest's two confidence guards are `gravitySparse` (inert here — Oura stores no gravity
+ * at all, so `isGravitySparse` returns false for every ring night) and the #H9 restorative floor (needs
+ * efficiency >= 0.85; the holed night read 0.50).
+ *
+ * So the missing quantity is not a new measurement — it is a RATIO of two numbers already stored.
+ * Nothing here is persisted and no migration is needed: coverage is derived on read, which also means it
+ * applies retroactively to nights already in the database.
+ *
+ * HONEST-DATA: this only ever reports how much of the night was OBSERVED. It never fills a hole in, and
+ * in particular it must not let a caller treat unobserved time as awake — we do not know what happened
+ * there, and asserting wake would be the same overreach in the opposite direction.
+ *
+ * PARITY: pure + deterministic, byte-identical to the Swift twin (`WhoopStore.HypnogramCoverage`). Keep
+ * the two in lockstep; `HypnogramCoverageTest` pins the ratio against a Swift-generated oracle.
+ */
+object HypnogramCoverage {
+
+    /**
+     * Coverage at or above which a stage timeline is treated as describing its whole span.
+     *
+     * The observed split is wide: healthy nights land at 99–100%, the broken ones at 23–93%. 0.95 sits
+     * in the empty middle, so the gate is not balanced on the edge of the data. Mirrors Swift
+     * `minCoverage`.
+     */
+    const val minCoverage: Double = 0.95
+
+    /**
+     * The covered fraction of [spanSeconds], or null when the question does not apply.
+     *
+     * Returns null — meaning "unknown, do not judge" — rather than 0 when there is nothing to measure,
+     * so an unknown coverage can never be mistaken for a bad one by a caller comparing against
+     * [minCoverage]. Clamped to at most 1: segments that overlap or overhang would otherwise report more
+     * than a full night, and for a completeness gate the safe direction is to read that as "complete"
+     * rather than to invent a failure out of malformed input.
+     */
+    fun fraction(coveredSeconds: Double, spanSeconds: Double): Double? {
+        if (spanSeconds <= 0.0 || coveredSeconds <= 0.0) return null
+        return minOf(1.0, coveredSeconds / spanSeconds)
+    }
+
+    /**
+     * The covered fraction of [spanSeconds] for a session's stored `stagesJSON`, or null when coverage is
+     * not a meaningful question for that payload.
+     *
+     * null for: a null/blank/`"[]"` payload (no stages at all — that is the richness question, not this
+     * one) and for the IMPORTED minute-dict shape `{light,deep,rem,awake}`, which carries no timestamps
+     * and therefore cannot be compared against a span. That second case is what keeps this gate away from
+     * WHOOP/Apple/Health-Connect imports entirely: they are never judged incomplete here, so no existing
+     * import behaviour changes.
+     */
+    fun fraction(stagesJson: String?, spanSeconds: Double): Double? {
+        val json = stagesJson?.trim() ?: return null
+        if (json.isEmpty() || json == "[]") return null
+        // The dict shape (imported minute totals) throws here and falls through to null — deliberately,
+        // since it carries no timestamps to measure. Same try/catch idiom as SleepStageTotals.minutes.
+        val arr = try { JSONArray(json) } catch (_: Throwable) { return null }
+        var covered = 0.0
+        for (i in 0 until arr.length()) {
+            val seg = arr.optJSONObject(i) ?: continue
+            if (!seg.has("start") || !seg.has("end")) continue
+            val s = seg.optDouble("start", Double.NaN)
+            val e = seg.optDouble("end", Double.NaN)
+            if (s.isNaN() || e.isNaN() || e <= s) continue
+            covered += e - s
+        }
+        return fraction(covered, spanSeconds)
+    }
+
+    /**
+     * True when the timeline is known to cover less than [minCoverage] of its span — i.e. the session
+     * demonstrably describes only part of the night it claims. Unknown coverage (null) is NOT holed:
+     * every guard built on this fails OPEN, so a payload shape this cannot measure keeps its existing
+     * behaviour instead of being silently downgraded.
+     */
+    fun isHoled(stagesJson: String?, spanSeconds: Double): Boolean {
+        val f = fraction(stagesJson, spanSeconds) ?: return false
+        return f < minCoverage
+    }
+}
diff --git a/android/app/src/main/java/com/noop/analytics/ScoreConfidence.kt b/android/app/src/main/java/com/noop/analytics/ScoreConfidence.kt
index 1a76bc1c87..2234a7b74b 100644
--- a/android/app/src/main/java/com/noop/analytics/ScoreConfidence.kt
+++ b/android/app/src/main/java/com/noop/analytics/ScoreConfidence.kt
@@ -117,18 +117,30 @@ enum class ScoreConfidence(val raw: String) {
         const val highEfficiencyThreshold: Double = 0.85
 
         /**
-         * Rest confidence WITH the H9 stage-quality check AND the sparse-motion guard. Starts from
-         * [forRest], then DOWNGRADES a [SOLID] tier to [BUILDING] (low-confidence) when EITHER:
+         * Rest confidence WITH the H9 stage-quality check, the sparse-motion guard AND the
+         * hypnogram-coverage guard. Starts from [forRest], then DOWNGRADES a [SOLID] tier to [BUILDING]
+         * (low-confidence) when ANY of:
          *  - the night was staged on SPARSE gravity ([gravitySparse]) — a WHOOP 4.0 synced/offload night
          *    banks motion coarsely, too sparse to reliably stage sleep (#345), so a confident 85–100 Rest
          *    is unearned however the engine filled the stages. This catches the case H9 MISSES: a sparse
          *    night whose staging manufactures HIGH efficiency AND HIGH restorative reads SOLID under H9
          *    alone (the #319 signature), yet the underlying data can't support it; OR
          *  - the night is high-efficiency yet its restorative (deep+REM) share is below
-         *    [restorativeLowConfidenceShare] — a likely staging miss (#H9).
-         * [CALIBRATING]/[BUILDING] from the base call are returned unchanged. Engine output only; the UI
-         * surfaces the tier later. Confidence-only — it never changes the Rest score or invents stages.
-         * Mirrors Swift `rest(hasSession:hasStagedSleep:asleepSeconds:restorativeSeconds:efficiency:gravitySparse:)`.
+         *    [restorativeLowConfidenceShare] — a likely staging miss (#H9); OR
+         *  - [stageCoverage] says the stage timeline accounts for less than
+         *    [HypnogramCoverage.minCoverage] of the span it claims. This is the case the other two
+         *    structurally cannot see: a device-PROVIDED hypnogram assembled from records that arrived
+         *    incomplete has real stages over the part that DID arrive, so its restorative share is
+         *    ordinary and H9 stays quiet, while [gravitySparse] describes the on-device motion stager and
+         *    is false for a provided hypnogram (and inert for Oura outright, which banks no gravity at
+         *    all). Measured: a ring night covering 23% of its 601-minute span was stored as 70 minutes of
+         *    sleep and reported SOLID.
+         * [stageCoverage] is null when coverage is unknown or not applicable — the guard fails OPEN
+         * there, so an unmeasurable payload keeps its previous tier rather than being downgraded on no
+         * evidence. [CALIBRATING]/[BUILDING] from the base call are returned unchanged. Engine output
+         * only; the UI surfaces the tier later. Confidence-only — it never changes the Rest score,
+         * invents stages, or claims the uncovered time was awake. Mirrors Swift
+         * `rest(hasSession:hasStagedSleep:asleepSeconds:restorativeSeconds:efficiency:gravitySparse:stageCoverage:)`.
          * (#H9, #345)
          */
         fun forRest(
@@ -138,10 +150,13 @@ enum class ScoreConfidence(val raw: String) {
             restorativeSeconds: Double,
             efficiency: Double,
             gravitySparse: Boolean = false,
+            stageCoverage: Double? = null,
         ): ScoreConfidence {
             val base = forRest(hasSession, hasStagedSleep)
             if (base != SOLID) return base
             if (gravitySparse) return BUILDING   // #345: sparse-motion staging can't earn a SOLID Rest
+            // the timeline covers only part of the night it claims
+            if (stageCoverage != null && stageCoverage < HypnogramCoverage.minCoverage) return BUILDING
             if (asleepSeconds <= 0.0) return base
             val restorativeShare = restorativeSeconds / asleepSeconds
             return if (efficiency >= highEfficiencyThreshold && restorativeShare < restorativeLowConfidenceShare) {
diff --git a/android/app/src/main/java/com/noop/data/WhoopRepository.kt b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
index b4b92d35a5..dc062368d5 100644
--- a/android/app/src/main/java/com/noop/data/WhoopRepository.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
@@ -2587,7 +2587,15 @@ class WhoopRepository(
          *  (ryanbr/noop#241): a sparse import (no stage data on ANY of its sessions that day) must NOT clobber
          *  a computed day that HAS stage data — otherwise a stage-less WHOOP/Apple/HC re-import blanks the
          *  stage breakdown for a night the strap fully staged. Days where the import carries stages, or where
-         *  neither side does, keep the imported-wins rule. Mirrors WhoopStore.SleepMerge (SleepMergeTests). */
+         *  neither side does, keep the imported-wins rule. Mirrors WhoopStore.SleepMerge (SleepMergeTests).
+         *
+         *  Richness is a RANK, not a yes/no ([richness]): 2 = stages covering the span they claim, 1 =
+         *  stages present but HOLED, 0 = none — and the computed day wins only when it OUT-RANKS the
+         *  import. Collapsing 1 and 0 gives back the original presence rule exactly, so this is a strict
+         *  generalisation: every case #241 decided it still decides the same way. What changes is the pair
+         *  the old rule could not express — a holed import (a device hypnogram assembled from records that
+         *  arrived incomplete: many segments, a fraction of the span) against a COMPLETE computed night,
+         *  which used to go to the import and now goes to the night that actually covers itself. */
         internal fun mergeSleepRichness(
             imported: List<SleepSession>,
             computed: List<SleepSession>,
@@ -2598,8 +2606,8 @@ class WhoopRepository(
             val out = ArrayList<SleepSession>(imported.size + computed.size)
             for ((day, imp) in importedByDay) {
                 val comp = computedByDay[day]
-                if (comp != null && imp.none { hasStages(it) } && comp.any { hasStages(it) }) {
-                    out.addAll(comp)   // richer computed day survives a stage-less import
+                if (comp != null && dayRichness(comp) > dayRichness(imp)) {
+                    out.addAll(comp)   // richer computed day survives a poorer import
                 } else {
                     out.addAll(imp)    // imported wins its day (unchanged rule)
                 }
@@ -2614,6 +2622,23 @@ class WhoopRepository(
             val json = s.stagesJSON?.trim() ?: return false
             return json.isNotEmpty() && json != "[]"
         }
+
+        /** How much of a night this session's stages actually describe: 2 = covers its span, 1 = present
+         *  but HOLED, 0 = none. A timeline whose coverage cannot be measured (the imported minute-dict
+         *  shape, which has no timestamps) is never holed, so it ranks 2 — imports keep being judged on
+         *  presence exactly as they always were, and this gate cannot reach them.
+         *  Twin of WhoopStore.SleepMerge.richness. */
+        private fun richness(s: SleepSession): Int {
+            if (!hasStages(s)) return 0
+            val span = (s.endTs - s.startTs).toDouble()
+            return if (com.noop.analytics.HypnogramCoverage.isHoled(s.stagesJSON, span)) 1 else 2
+        }
+
+        /** A day's richness is that of its BEST session — a day with a fully-staged main night plus an
+         *  unstaged nap is a staged day (#715 keeps every session of the winning day either way).
+         *  Twin of WhoopStore.SleepMerge.dayRichness. */
+        private fun dayRichness(sessions: List<SleepSession>): Int =
+            sessions.fold(0) { acc, s -> maxOf(acc, richness(s)) }
     }
 }
 
diff --git a/android/app/src/test/java/com/noop/analytics/ChargeEffortRestScoringTest.kt b/android/app/src/test/java/com/noop/analytics/ChargeEffortRestScoringTest.kt
index 0f31c5e695..facf391539 100644
--- a/android/app/src/test/java/com/noop/analytics/ChargeEffortRestScoringTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/ChargeEffortRestScoringTest.kt
@@ -340,6 +340,77 @@ class ChargeEffortRestScoringTest {
         )
     }
 
+    // Hypnogram coverage: a stage timeline that accounts for only part of the span it claims cannot earn
+    // a SOLID Rest. The case the other two guards structurally cannot see. Mirrors Swift.
+    @Test
+    fun confidence_restCoverageDowngradesHoledHypnogram() {
+        val asleep = 8.0 * 3600.0
+        assertEquals(
+            ScoreConfidence.BUILDING,
+            ScoreConfidence.forRest(
+                hasSession = true, hasStagedSleep = true,
+                asleepSeconds = asleep, restorativeSeconds = asleep * 0.45, efficiency = 0.80,
+                stageCoverage = 0.23,
+            ),
+        )
+    }
+
+    @Test
+    fun confidence_restCoverageKeepsSolidWhenTimelineCoversItsSpan() {
+        val asleep = 8.0 * 3600.0
+        assertEquals(
+            ScoreConfidence.SOLID,
+            ScoreConfidence.forRest(
+                hasSession = true, hasStagedSleep = true,
+                asleepSeconds = asleep, restorativeSeconds = asleep * 0.45, efficiency = 0.80,
+                stageCoverage = 1.0,
+            ),
+        )
+    }
+
+    /** Unknown coverage must fail OPEN — null is "not measured", never "measured badly". */
+    @Test
+    fun confidence_restCoverageUnknownDoesNotDowngrade() {
+        val asleep = 8.0 * 3600.0
+        assertEquals(
+            ScoreConfidence.SOLID,
+            ScoreConfidence.forRest(
+                hasSession = true, hasStagedSleep = true,
+                asleepSeconds = asleep, restorativeSeconds = asleep * 0.45, efficiency = 0.80,
+                stageCoverage = null,
+            ),
+        )
+    }
+
+    /**
+     * The measured night this guard exists for (2026-08-18, Oura ring vs a paired WHOOP strap): the
+     * hypnogram covered 140 of 601 minutes, so NOOP stored 70 minutes of sleep where the strap recorded
+     * 494. It read SOLID because NEITHER existing guard applies — gravitySparse is false (Oura banks no
+     * gravity at all) and H9 needs efficiency >= 0.85 against this night's 0.50. Mirrors Swift.
+     */
+    @Test
+    fun confidence_restCoverageCatchesTheNightH9AndGravityMiss() {
+        val asleep = 70.0 * 60.0
+        val restorative = asleep * 0.45
+        assertEquals(
+            "precondition: without coverage this night reads SOLID — that is the bug",
+            ScoreConfidence.SOLID,
+            ScoreConfidence.forRest(
+                hasSession = true, hasStagedSleep = true,
+                asleepSeconds = asleep, restorativeSeconds = restorative, efficiency = 0.50,
+                gravitySparse = false,
+            ),
+        )
+        assertEquals(
+            ScoreConfidence.BUILDING,
+            ScoreConfidence.forRest(
+                hasSession = true, hasStagedSleep = true,
+                asleepSeconds = asleep, restorativeSeconds = restorative, efficiency = 0.50,
+                gravitySparse = false, stageCoverage = 140.0 / 601.0,
+            ),
+        )
+    }
+
     @Test
     fun confidence_restH9KeepsSolidWhenRestorativeHealthy() {
         val asleep = 8.0 * 3600.0
diff --git a/android/app/src/test/java/com/noop/analytics/HypnogramCoverageTest.kt b/android/app/src/test/java/com/noop/analytics/HypnogramCoverageTest.kt
new file mode 100644
index 0000000000..b91d1385f3
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/HypnogramCoverageTest.kt
@@ -0,0 +1,129 @@
+package com.noop.analytics
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * [HypnogramCoverage] — the ratio that tells a well-formed-looking stage timeline from one that
+ * describes only part of the night it claims.
+ *
+ * BYTE-PARITY BY ORACLE, not by eye (CLAUDE.md). [swiftOracle] below is the VERBATIM stdout of the
+ * Swift twin's arithmetic compiled standalone (`swiftc -O main.swift -o oracle && ./oracle`) over the
+ * whole input space that matters: tiling, an interior hole, the measured 2026-08-18 night, the gate
+ * boundary from both sides and exactly on it, overlap/overhang, every unmeasurable payload shape, and
+ * degenerate spans. Reading the two implementations side by side would not catch a divergence in the
+ * clamp, the null rules, or the boundary comparison; this does.
+ *
+ * Note the `gate-exact` row: 950/1000 prints as 0.94999999999999996 because that is the nearest double
+ * to 0.95 — the SAME double the threshold literal denotes — so `< minCoverage` is false and the night is
+ * not holed. Both platforms must agree on that, which is exactly why the row is pinned.
+ */
+class HypnogramCoverageTest {
+
+    /** VERBATIM Swift stdout. Format: label|fraction (17 significant digits, or "null")|isHoled. */
+    private val swiftOracle = """
+        tiling|1|false
+        two-seg tiling|1|false
+        interior hole|0.5|true
+        night-0818|0.23294509151414308|true
+        gate-exact|0.94999999999999996|false
+        gate-under|0.94899999999999995|true
+        gate-over|0.95099999999999996|false
+        overhang|1|false
+        overlap|1|false
+        zero-len segs|null|false
+        neg-len seg|null|false
+        empty-array|null|false
+        blank|null|false
+        nil|null|false
+        not-json|null|false
+        minute-dict|null|false
+        zero-span|null|false
+        neg-span|null|false
+    """.trimIndent()
+
+    private fun seg(vararg r: Pair<Int, Int>): String =
+        r.joinToString(",", "[", "]") { """{"start":${it.first},"end":${it.second},"stage":"deep"}""" }
+
+    /** The same cases the Swift oracle enumerated, in the same order. */
+    private val cases: List<Triple<String, String?, Double>> = listOf(
+        Triple("tiling", seg(0 to 28800), 28800.0),
+        Triple("two-seg tiling", seg(0 to 14400, 14400 to 28800), 28800.0),
+        Triple("interior hole", seg(0 to 300, 900 to 1200), 1200.0),
+        Triple("night-0818", seg(0 to 4200, 4200 to 8400), 601 * 60.0),
+        Triple("gate-exact", seg(0 to 950), 1000.0),
+        Triple("gate-under", seg(0 to 949), 1000.0),
+        Triple("gate-over", seg(0 to 951), 1000.0),
+        Triple("overhang", seg(0 to 1200), 600.0),
+        Triple("overlap", seg(0 to 600, 300 to 900), 900.0),
+        Triple("zero-len segs", seg(500 to 500, 600 to 600), 1000.0),
+        Triple("neg-len seg", """[{"start":900,"end":300,"stage":"deep"}]""", 1000.0),
+        Triple("empty-array", "[]", 1000.0),
+        Triple("blank", "   ", 1000.0),
+        Triple("nil", null, 1000.0),
+        Triple("not-json", "not json", 1000.0),
+        Triple("minute-dict", """{"light":300,"deep":100,"rem":80,"awake":40}""", 3600.0),
+        Triple("zero-span", seg(0 to 300), 0.0),
+        Triple("neg-span", seg(0 to 300), -1.0),
+    )
+
+    @Test
+    fun matchesTheSwiftOracleExactly() {
+        val expected = swiftOracle.lines().map { it.trim() }.filter { it.isNotEmpty() }
+        assertEquals("oracle row count must match the case list", cases.size, expected.size)
+        for ((i, c) in cases.withIndex()) {
+            val (label, json, span) = c
+            val parts = expected[i].split("|")
+            assertEquals("oracle row $i is for a different case", label, parts[0])
+
+            val f = HypnogramCoverage.fraction(json, span)
+            if (parts[1] == "null") {
+                assertNull("$label: expected unmeasurable", f)
+            } else {
+                assertEquals("$label: fraction", parts[1].toDouble(), f!!, 0.0)
+            }
+            assertEquals("$label: isHoled", parts[2].toBoolean(),
+                HypnogramCoverage.isHoled(json, span))
+        }
+    }
+
+    /** nil is "not measured", never "measured badly" — the distinction every guard fails open on. */
+    @Test
+    fun unmeasurableIsNeverHoled() {
+        for (payload in listOf(null, "", "   ", "[]", "not json",
+            """{"light":300,"deep":100,"rem":80,"awake":40}""")) {
+            assertNull(HypnogramCoverage.fraction(payload, 3600.0))
+            assertFalse(HypnogramCoverage.isHoled(payload, 3600.0))
+        }
+    }
+
+    @Test
+    fun ratioOverloadMatchesSwift() {
+        assertEquals(0.5, HypnogramCoverage.fraction(300.0, 600.0)!!, 0.0)
+        assertEquals(1.0, HypnogramCoverage.fraction(600.0, 600.0)!!, 0.0)
+        assertEquals(1.0, HypnogramCoverage.fraction(900.0, 600.0)!!, 0.0)  // clamped
+        assertNull(HypnogramCoverage.fraction(300.0, 0.0))
+        assertNull(HypnogramCoverage.fraction(0.0, 600.0))
+    }
+
+    /** The threshold itself is a stored cross-platform constant; a silent drift would move the gate. */
+    @Test
+    fun thresholdMatchesSwift() {
+        assertEquals(0.95, HypnogramCoverage.minCoverage, 0.0)
+    }
+
+    /**
+     * The measured night this whole change exists for (2026-08-18, Oura ring vs a paired WHOOP strap):
+     * 140 minutes of segments across a 601-minute span, stored as 70 minutes of sleep where the strap
+     * recorded 494.
+     */
+    @Test
+    fun theMeasuredHoledNightIsFlagged() {
+        val span = 601 * 60.0
+        assertTrue(HypnogramCoverage.isHoled(seg(0 to 4200, 4200 to 8400), span))
+        assertEquals(8400.0 / span, HypnogramCoverage.fraction(seg(0 to 4200, 4200 to 8400), span)!!, 1e-12)
+    }
+}
diff --git a/android/app/src/test/java/com/noop/data/MergeSleepLocalDayTest.kt b/android/app/src/test/java/com/noop/data/MergeSleepLocalDayTest.kt
index 7bcab49866..2c69524103 100644
--- a/android/app/src/test/java/com/noop/data/MergeSleepLocalDayTest.kt
+++ b/android/app/src/test/java/com/noop/data/MergeSleepLocalDayTest.kt
@@ -127,6 +127,70 @@ class MergeSleepLocalDayTest {
         assertEquals("\"[]\" and blank JSON are not stages", listOf(comp0.startTs, comp1.startTs), merged.map { it.startTs })
     }
 
+    // Coverage rank (twins of the Swift SleepMergeTests coverage cases): a stage timeline that covers
+    // only part of the span it claims — a device hypnogram assembled from records that arrived
+    // incomplete — outranks nothing, but not a whole night.
+
+    /** A single segment covering `[start, end)` exactly: a night that accounts for its own span. */
+    private fun tiling(start: Long, end: Long) = """[{"start":$start,"end":$end,"stage":"deep"}]"""
+
+    /**
+     * The case the presence-only rule could not express, and the reason this change exists: a HOLED
+     * import used to win purely by being an import, blanking a computed night that covers itself.
+     */
+    @Test
+    fun mergeSleep_holedImportYieldsToFullyCoveredComputedNight() {
+        val start = wake - 8 * 3600L
+        val comp = session(start, wake, tiling(start, wake))
+        val imp = session(start, wake, someStages) // 1 h of segments over an 8 h span
+        val merged = WhoopRepository.mergeSleep(imported = listOf(imp), computed = listOf(comp))
+        assertEquals("the night that covers its own span wins over a holed import",
+            listOf(comp.stagesJSON), merged.map { it.stagesJSON })
+    }
+
+    /** …but partial data still beats none: a holed import must not lose to a stage-less computed day. */
+    @Test
+    fun mergeSleep_holedImportStillBeatsStagelessComputed() {
+        val comp = session(wake - 8 * 3600L, wake, null)
+        val imp = session(wake - 6 * 3600L, wake, someStages)
+        val merged = WhoopRepository.mergeSleep(imported = listOf(imp), computed = listOf(comp))
+        assertEquals("some stages beat none, holed or not", listOf(imp.startTs), merged.map { it.startTs })
+    }
+
+    /** Equal rank keeps the imported-over-computed default — the rule only fires on a strict out-rank. */
+    @Test
+    fun mergeSleep_equallyHoledSidesKeepImportedWins() {
+        val comp = session(wake - 8 * 3600L, wake, someStages)
+        val imp = session(wake - 6 * 3600L, wake, someStages)
+        val merged = WhoopRepository.mergeSleep(imported = listOf(imp), computed = listOf(comp))
+        assertEquals(listOf(imp.startTs), merged.map { it.startTs })
+    }
+
+    /** A fully-covered import is untouched by any of this. */
+    @Test
+    fun mergeSleep_fullyCoveredImportStillWins() {
+        val cs = wake - 8 * 3600L
+        val ist = wake - 6 * 3600L
+        val comp = session(cs, wake, tiling(cs, wake))
+        val imp = session(ist, wake, tiling(ist, wake))
+        val merged = WhoopRepository.mergeSleep(imported = listOf(imp), computed = listOf(comp))
+        assertEquals(listOf(imp.startTs), merged.map { it.startTs })
+    }
+
+    /**
+     * The imported minute-dict shape carries no timestamps, so it can never be judged holed — every
+     * WHOOP/Apple/Health-Connect import keeps its existing precedence.
+     */
+    @Test
+    fun mergeSleep_importedMinuteDictIsNeverHoled() {
+        val cs = wake - 8 * 3600L
+        val comp = session(cs, wake, tiling(cs, wake))
+        val imp = session(wake - 6 * 3600L, wake, """{"light":300,"deep":100,"rem":80,"awake":40}""")
+        val merged = WhoopRepository.mergeSleep(imported = listOf(imp), computed = listOf(comp))
+        assertEquals("a dict-shaped import is not measurable, so it wins as before",
+            listOf(imp.startTs), merged.map { it.startTs })
+    }
+
     @Test
     fun mergeSleep_richnessExceptionKeepsEverySessionOfWinningDay() {
         // computed main night (with stages) + computed nap (no stages); import is stage-less.

From e152f76fffe63c4462a33cd83dc7a06b6beef8b3 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 13:02:49 +1200
Subject: [PATCH 052/333] Make the two hypnogram-coverage readers agree, and
 state the gate's real scope (#1721)

Follow-up to #1717, from reviewing it. No behaviour change for any payload a producer can emit.

The coverage gate was pinned by an oracle over 18 payload shapes, and the two readers still disagreed on shapes it did not enumerate: Swift decodes the stage array as a WHOLE, so one non-object element makes the payload unmeasurable, while Kotlin skipped per element and measured the remainder; optDouble also parsed string bounds that as? NSNumber rejects. Compiled both and ran them - [{seg},5], [{seg},null] and string bounds each read nil/not-holed on Swift and 0.1/HOLED on Kotlin. Unreachable from any current producer, but a divergence in the one module whose contract is byte-parity. Kotlin now bails on a non-object element and reads bounds the way NSNumber does.

The alignment direction was measured rather than assumed, and the obvious version was wrong: a bool bound CONVERTS on both sides because JSONSerialization bridges true to NSNumber 1, and under Foundation {"start":0} reports is Bool == true - so expressing the fix as a bool exclusion would have discarded every timeline whose first segment starts at zero, including the oracle's own tiling case, while all 18 existing rows stayed green.

Re-review added two more rows for shapes argued rather than run. Health Connect's real payload is an ARRAY of {stage,min} objects, not the throwing minute dict the oracle already had: it parses, reaches the loop and exits with zero cover, so the live producer shape this gate claims exemption from was reaching null by an untested path.

Two documentation corrections: the Xiaomi Band importer emits real {start,end,stage} segments and takes its span from bedtime/wake_up_time fields independent of the items array, so Xiaomi nights ARE judged here - the module said imports were exempt as a class, and they are not. And at the engine call site coverage is summed off decoded segments rather than stagesJSON, so what protects timestamp-free imports there is the coveredSeconds > 0 guard, not the payload-shape rule.

Oracle now 25 rows. Android 4752 pass, CI 15/15 green including both macOS Swift jobs, which is what verifies the new Swift expectations on Darwin rather than only on the Linux box they were generated on.
---
 .../StrandAnalytics/AnalyticsEngine.swift     |  8 ++
 .../WhoopStore/HypnogramCoverage.swift        | 18 ++++-
 .../HypnogramCoverageTests.swift              | 78 +++++++++++++++++++
 .../com/noop/analytics/AnalyticsEngine.kt     |  8 ++
 .../com/noop/analytics/HypnogramCoverage.kt   | 55 ++++++++++---
 .../noop/analytics/HypnogramCoverageTest.kt   | 48 ++++++++++++
 6 files changed, 201 insertions(+), 14 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
index 6a4be87dea..8ae469a42f 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
@@ -553,6 +553,14 @@ public enum AnalyticsEngine {
         // observed at all. Summed straight off `s.stages` (no JSON re-parse: the segments are already
         // decoded here), then handed to `HypnogramCoverage` so the ratio/clamp/nil rules have ONE
         // definition shared with the merge-side guard.
+        // NOTE on scope at THIS call site: coverage here is summed off the DECODED segments, not off
+        // `stagesJSON`, so the timestamp-free shapes are not screened out by the payload-shape rule the
+        // merge side uses. A minute-dict session decodes to zero segments and contributes span with no
+        // cover, and what keeps it from reading as a holed night is `fraction`'s `coveredSeconds > 0`
+        // returning nil for a group with no timestamped stages at all. Same outcome, different
+        // mechanism — and it holds only while a group is single-sourced, which the day merge ensures by
+        // choosing one side. A group mixing a timestamped fragment with a minute-dict one would read as
+        // holed; `HypnogramCoverageTests.testMixedSourceGroupReadsAsHoled` pins both halves.
         var coveredS = 0.0, spanS = 0.0
         for s in mainGroup {
             let m = SleepStager.hypnogramMetrics(s)
diff --git a/Packages/WhoopStore/Sources/WhoopStore/HypnogramCoverage.swift b/Packages/WhoopStore/Sources/WhoopStore/HypnogramCoverage.swift
index ff48cda5c9..5b848ce22c 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/HypnogramCoverage.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/HypnogramCoverage.swift
@@ -52,10 +52,20 @@ public enum HypnogramCoverage {
     /// is not a meaningful question for that payload.
     ///
     /// nil for: a nil/blank/`"[]"` payload (no stages at all — that is the richness question, not this
-    /// one) and for the IMPORTED minute-dict shape `{light,deep,rem,awake}`, which carries no
-    /// timestamps and therefore cannot be compared against a span. That second case is what keeps this
-    /// gate away from WHOOP/Apple/Health-Connect imports entirely: they are never judged incomplete
-    /// here, so no existing import behaviour changes.
+    /// one), for the IMPORTED minute-dict shape `{light,deep,rem,awake}` and for Health Connect's
+    /// `{stage,min}` array, neither of which carries timestamps to compare against a span, and for an
+    /// array holding any non-object element (see the Kotlin twin's loop for why that bails rather than
+    /// measuring the remainder).
+    ///
+    /// SCOPE, precisely. Timestamp-free shapes are what keep this gate off the WHOOP CSV, Apple and
+    /// Health Connect imports — they are never judged incomplete, so their behaviour is unchanged. That
+    /// is NOT a blanket exemption for imports, and it was originally written as one: the Xiaomi Band
+    /// importer emits real `{start,end,stage}` segments, and takes its span from `bedtime`/`wake_up_time`
+    /// fields that are independent of the `items` array it builds those segments from. A Xiaomi night
+    /// whose items do not reach its own bed/wake bounds IS judged holed here. That is arguably the right
+    /// answer — the night genuinely is only partly described — but it is a real behaviour change for
+    /// that importer, unvalidated against a Xiaomi export, and it is pinned by test rather than left to
+    /// be discovered.
     public static func fraction(stagesJSON: String?, spanSeconds: Double) -> Double? {
         guard let json = stagesJSON?.trimmingCharacters(in: .whitespacesAndNewlines),
               !json.isEmpty, json != "[]",
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/HypnogramCoverageTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/HypnogramCoverageTests.swift
index 95978e175d..e00cfdfcce 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/HypnogramCoverageTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/HypnogramCoverageTests.swift
@@ -98,4 +98,82 @@ final class HypnogramCoverageTests: XCTestCase {
         XCTAssertFalse(HypnogramCoverage.isHoled(whole))
         XCTAssertFalse(HypnogramCoverage.isHoled(stageless))
     }
+
+    // MARK: - shapes the two readers must agree on
+
+    /// The four payloads on which Swift and Kotlin originally DISAGREED, found by compiling both and
+    /// running them rather than by reading them side by side. Swift's whole-array cast makes one
+    /// non-object element poison the payload; the Kotlin twin used to skip that element and measure the
+    /// remainder, reading 0.1 and HOLED where this side read nil and not-holed. It now bails the same
+    /// way. Kept here so the agreement is asserted from BOTH sides, not only in the Kotlin oracle.
+    func testNonObjectElementMakesThePayloadUnmeasurable() {
+        for json in [#"[{"start":0,"end":100,"stage":"deep"},5]"#,
+                     #"[{"start":0,"end":100,"stage":"deep"},null]"#,
+                     #"[{"start":0,"end":100,"stage":"deep"},"x"]"#] {
+            XCTAssertNil(HypnogramCoverage.fraction(stagesJSON: json, spanSeconds: 1000),
+                         "one non-object element must make the whole payload unmeasurable")
+            XCTAssertFalse(HypnogramCoverage.isHoled(stagesJSON: json, spanSeconds: 1000))
+        }
+    }
+
+    /// A string-valued bound is SKIPPED, not parsed: `NSString` is not an `NSNumber`. The Kotlin twin
+    /// reached the same answer only after dropping `optDouble`, which parses `"0"` happily.
+    func testStringBoundsAreNotCounted() {
+        let json = #"[{"start":"0","end":"100","stage":"deep"}]"#
+        XCTAssertNil(HypnogramCoverage.fraction(stagesJSON: json, spanSeconds: 1000))
+    }
+
+    /// A bool bound DOES convert, on both sides — `JSONSerialization` bridges `true` to `NSNumber` 1.
+    /// Absurd in a stage payload and unreachable from any producer, pinned because it is the one case
+    /// where the tidy-looking alignment (reject anything that is not a number) would have been wrong:
+    /// under Foundation `{"start":0}` reports `is Bool == true`, so a bool exclusion would have thrown
+    /// away every timeline whose first segment starts at zero.
+    func testBoolBoundConvertsOnBothSides() {
+        let json = #"[{"start":true,"end":100,"stage":"deep"}]"#
+        XCTAssertEqual(HypnogramCoverage.fraction(stagesJSON: json, spanSeconds: 1000)!, 0.099, accuracy: 1e-12)
+    }
+
+    /// SCOPE: a timestamped import is judged like any other timeline. This is the Xiaomi Band shape —
+    /// real `{start,end,stage}` segments whose span comes from separate bed/wake fields — and it is the
+    /// one importer this gate reaches. Timestamp-free imports stay exempt, asserted above.
+    func testTimestampedImportIsInScope() {
+        let json = segs([(0, 3600, "light")])
+        XCTAssertEqual(HypnogramCoverage.fraction(stagesJSON: json, spanSeconds: 28800)!, 0.125, accuracy: 1e-12)
+        XCTAssertTrue(HypnogramCoverage.isHoled(stagesJSON: json, spanSeconds: 28800))
+    }
+
+    /// The ENGINE call site sums coverage off decoded segments, not off `stagesJSON`, so the payload
+    /// shape rule that exempts timestamp-free imports at the merge does not run there. What actually
+    /// protects them is this: a group with no timestamped stages at all covers zero, and zero cover is
+    /// unmeasurable rather than bad. Holds only while a group is single-sourced — a group mixing a
+    /// staged fragment with a minute-dict one covers part of its total span and reads as holed.
+    func testGroupWithNoTimestampedStagesIsUnmeasurableNotHoled() {
+        XCTAssertNil(HypnogramCoverage.fraction(coveredSeconds: 0, spanSeconds: 8 * 3600))
+    }
+
+    func testMixedSourceGroupReadsAsHoled() {
+        // 8 h fully-staged fragment + a 2 h minute-dict fragment that decodes to no segments.
+        let covered = 8.0 * 3600, span = 10.0 * 3600
+        XCTAssertEqual(HypnogramCoverage.fraction(coveredSeconds: covered, spanSeconds: span)!, 0.8, accuracy: 1e-12)
+        XCTAssertLessThan(0.8, HypnogramCoverage.minCoverage)
+    }
+
+    /// Health Connect's REAL payload shape. The `minute-dict` case above is the throwing
+    /// `{light,deep,rem,awake}` object; HC emits an ARRAY of `{stage,min}` objects, which parses
+    /// cleanly and reaches the segment loop. It is the live producer shape this gate claims to be
+    /// exempt from, so it is pinned rather than argued: every element is an object (no whole-cast
+    /// failure), none carries bounds (every segment skipped), cover stays 0, and zero cover is
+    /// unmeasurable rather than bad.
+    func testHealthConnectStageMinArrayIsUnmeasurable() {
+        let json = #"[{"stage":"light","min":300},{"stage":"deep","min":100}]"#
+        XCTAssertNil(HypnogramCoverage.fraction(stagesJSON: json, spanSeconds: 3600))
+        XCTAssertFalse(HypnogramCoverage.isHoled(stagesJSON: json, spanSeconds: 3600))
+    }
+
+    /// A JSON null BOUND inside an otherwise well-formed object: the object is fine, so neither side
+    /// bails; both fail to read the bound and skip the segment.
+    func testNullBoundSkipsTheSegment() {
+        XCTAssertNil(HypnogramCoverage.fraction(stagesJSON: #"[{"start":null,"end":100,"stage":"deep"}]"#,
+                                                spanSeconds: 1000))
+    }
 }
diff --git a/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt b/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
index dfecb7be4d..f9b9d97935 100644
--- a/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
@@ -502,6 +502,14 @@ object AnalyticsEngine {
         // observed at all. Summed straight off `s.stages` (no JSON re-parse: the segments are already
         // decoded here), then handed to HypnogramCoverage so the ratio/clamp/null rules have ONE
         // definition shared with the merge-side guard. Mirrors Swift.
+        // NOTE on scope at THIS call site: coverage here is summed off the DECODED segments, not off
+        // `stagesJSON`, so the timestamp-free shapes are not screened out by the payload-shape rule the
+        // merge side uses. A minute-dict session decodes to zero segments and contributes span with no
+        // cover, and what keeps it from reading as a holed night is `fraction`'s `coveredSeconds > 0`
+        // returning nil for a group with no timestamped stages at all. Same outcome, different
+        // mechanism — and it holds only while a group is single-sourced, which the day merge ensures by
+        // choosing one side. A group mixing a timestamped fragment with a minute-dict one would read as
+        // holed; `HypnogramCoverageTest.mixedSourceGroupReadsAsHoled` pins both halves.
         var coveredS = 0.0
         var spanS = 0.0
         for (s in mainGroup) {
diff --git a/android/app/src/main/java/com/noop/analytics/HypnogramCoverage.kt b/android/app/src/main/java/com/noop/analytics/HypnogramCoverage.kt
index c5f8892b45..9c9f072022 100644
--- a/android/app/src/main/java/com/noop/analytics/HypnogramCoverage.kt
+++ b/android/app/src/main/java/com/noop/analytics/HypnogramCoverage.kt
@@ -62,29 +62,64 @@ object HypnogramCoverage {
      * not a meaningful question for that payload.
      *
      * null for: a null/blank/`"[]"` payload (no stages at all — that is the richness question, not this
-     * one) and for the IMPORTED minute-dict shape `{light,deep,rem,awake}`, which carries no timestamps
-     * and therefore cannot be compared against a span. That second case is what keeps this gate away from
-     * WHOOP/Apple/Health-Connect imports entirely: they are never judged incomplete here, so no existing
-     * import behaviour changes.
+     * one), for the IMPORTED minute-dict shape `{light,deep,rem,awake}` and for Health Connect's
+     * `{stage,min}` array, neither of which carries timestamps to compare against a span, and for an
+     * array holding any non-object element (see the loop below for why that bails rather than measuring
+     * the remainder).
+     *
+     * SCOPE, precisely. Timestamp-free shapes are what keep this gate off the WHOOP CSV, Apple and
+     * Health Connect imports — they are never judged incomplete, so their behaviour is unchanged. That
+     * is NOT a blanket exemption for imports, and it was originally written as one: the Xiaomi Band
+     * importer emits real `{start,end,stage}` segments, and takes its span from `bedtime`/`wake_up_time`
+     * fields that are independent of the `items` array it builds those segments from. A Xiaomi night
+     * whose items do not reach its own bed/wake bounds IS judged holed here. That is arguably the right
+     * answer — the night genuinely is only partly described — but it is a real behaviour change for
+     * that importer, unvalidated against a Xiaomi export, and it is pinned by test rather than left to
+     * be discovered.
      */
     fun fraction(stagesJson: String?, spanSeconds: Double): Double? {
         val json = stagesJson?.trim() ?: return null
         if (json.isEmpty() || json == "[]") return null
-        // The dict shape (imported minute totals) throws here and falls through to null — deliberately,
+        // The minute-dict shape (imported totals) throws here and falls through to null — deliberately,
         // since it carries no timestamps to measure. Same try/catch idiom as SleepStageTotals.minutes.
+        // Health Connect's `{stage,min}` array does NOT throw: it parses, reaches the loop, and every
+        // segment is skipped for want of bounds, so it exits with zero cover — unmeasurable by the same
+        // rule, along a different path. Both are pinned in the oracle.
         val arr = try { JSONArray(json) } catch (_: Throwable) { return null }
         var covered = 0.0
         for (i in 0 until arr.length()) {
-            val seg = arr.optJSONObject(i) ?: continue
-            if (!seg.has("start") || !seg.has("end")) continue
-            val s = seg.optDouble("start", Double.NaN)
-            val e = seg.optDouble("end", Double.NaN)
-            if (s.isNaN() || e.isNaN() || e <= s) continue
+            // The Swift twin decodes the array as a WHOLE (`as? [[String: Any]]`), so ONE non-object
+            // element makes the entire payload unmeasurable there. Bail identically rather than
+            // measuring the remainder. Measured on the shipped pair, `[{seg},5]` and `[{seg},null]`
+            // read nil/not-holed on Swift and 0.1/HOLED here — and since this gate can only downgrade
+            // a night, refusing to judge a payload we do not fully understand is the safe half of that
+            // disagreement, and the one the module's fail-OPEN rule already commits to.
+            val seg = arr.optJSONObject(i) ?: return null
+            val s = num(seg.opt("start")) ?: continue
+            val e = num(seg.opt("end")) ?: continue
+            if (e <= s) continue
             covered += e - s
         }
         return fraction(covered, spanSeconds)
     }
 
+    /**
+     * A JSON scalar read the way Swift's `(seg["start"] as? NSNumber)?.doubleValue` reads it.
+     *
+     * A number converts. A STRING does not — `NSString` is not an `NSNumber`, so the Swift side skips
+     * that segment, whereas `optDouble` would have parsed it and counted the segment here. A BOOL does
+     * convert, because `JSONSerialization` bridges `true`/`false` to `NSNumber` and yields 1/0; that is
+     * absurd in a stage payload and no producer emits it, but the two readers must not disagree
+     * anywhere either could be asked. Verified against the Swift twin compiled standalone rather than
+     * read off the page: `{"start":0}` reports `is Bool == true` under Foundation, so a bool EXCLUSION
+     * would have rejected every timeline whose first segment starts at zero.
+     */
+    private fun num(v: Any?): Double? = when (v) {
+        is Number -> v.toDouble()
+        is Boolean -> if (v) 1.0 else 0.0
+        else -> null
+    }
+
     /**
      * True when the timeline is known to cover less than [minCoverage] of its span — i.e. the session
      * demonstrably describes only part of the night it claims. Unknown coverage (null) is NOT holed:
diff --git a/android/app/src/test/java/com/noop/analytics/HypnogramCoverageTest.kt b/android/app/src/test/java/com/noop/analytics/HypnogramCoverageTest.kt
index b91d1385f3..436ede1baf 100644
--- a/android/app/src/test/java/com/noop/analytics/HypnogramCoverageTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/HypnogramCoverageTest.kt
@@ -43,6 +43,13 @@ class HypnogramCoverageTest {
         minute-dict|null|false
         zero-span|null|false
         neg-span|null|false
+        mixed-nonobject|null|false
+        array-with-null|null|false
+        string-numbers|null|false
+        bool-start|0.099|true
+        timestamped-import|0.125|true
+        hc-stage-min|null|false
+        null-bound|null|false
     """.trimIndent()
 
     private fun seg(vararg r: Pair<Int, Int>): String =
@@ -68,6 +75,30 @@ class HypnogramCoverageTest {
         Triple("minute-dict", """{"light":300,"deep":100,"rem":80,"awake":40}""", 3600.0),
         Triple("zero-span", seg(0 to 300), 0.0),
         Triple("neg-span", seg(0 to 300), -1.0),
+        // The four shapes on which the two readers originally DISAGREED, measured rather than read:
+        // Swift's whole-array cast returns nil for a non-object element, where this side used to skip
+        // it and measure the remainder (0.1, HOLED). A string start used to parse via optDouble and
+        // count; Swift's `as? NSNumber` rejects it. A bool start converts on BOTH sides, because
+        // JSONSerialization bridges it to NSNumber — the one case where "reject anything odd" would
+        // have been the wrong alignment, and `{"start":0}` reporting `is Bool == true` under Foundation
+        // is why a bool exclusion could not be used to express it.
+        Triple("mixed-nonobject", """[{"start":0,"end":100,"stage":"deep"},5]""", 1000.0),
+        Triple("array-with-null", """[{"start":0,"end":100,"stage":"deep"},null]""", 1000.0),
+        Triple("string-numbers", """[{"start":"0","end":"100","stage":"deep"}]""", 1000.0),
+        Triple("bool-start", """[{"start":true,"end":100,"stage":"deep"}]""", 1000.0),
+        // A Xiaomi-shaped import: real timestamped segments that do not reach the session's own
+        // bed/wake span. Unlike the timestamp-free imports this IS judged, which is the scope the
+        // module doc now states outright.
+        Triple("timestamped-import", seg(0 to 3600), 28800.0),
+        // Health Connect's REAL shape. The oracle's `minute-dict` row is the throwing `{light,deep,...}`
+        // object; HC emits an ARRAY of `{stage,min}` objects, which parses cleanly and reaches the loop.
+        // It is the live producer shape this gate claims to be exempt from, so it is pinned rather than
+        // argued: every element is an object (no bail), none carries bounds (every segment skipped),
+        // covered stays 0, and zero cover is unmeasurable rather than bad.
+        Triple("hc-stage-min", """[{"stage":"light","min":300},{"stage":"deep","min":100}]""", 3600.0),
+        // A JSON null BOUND inside an otherwise well-formed object: the object itself is fine, so
+        // neither side bails; both fail to read the bound and skip the segment.
+        Triple("null-bound", """[{"start":null,"end":100,"stage":"deep"}]""", 1000.0),
     )
 
     @Test
@@ -126,4 +157,21 @@ class HypnogramCoverageTest {
         assertTrue(HypnogramCoverage.isHoled(seg(0 to 4200, 4200 to 8400), span))
         assertEquals(8400.0 / span, HypnogramCoverage.fraction(seg(0 to 4200, 4200 to 8400), span)!!, 1e-12)
     }
+
+    /**
+     * The ENGINE call site sums coverage off decoded segments, not off `stagesJson`, so the payload
+     * shape rule that exempts timestamp-free imports at the merge does not run there. What actually
+     * protects them is this: a group with no timestamped stages at all covers zero, and zero cover is
+     * unmeasurable rather than bad. Holds only while a group is single-sourced — a group mixing a
+     * staged fragment with a minute-dict one covers part of its total span and reads as holed.
+     */
+    @Test fun groupWithNoTimestampedStagesIsUnmeasurableNotHoled() {
+        assertNull(HypnogramCoverage.fraction(0.0, 8 * 3600.0))
+    }
+
+    @Test fun mixedSourceGroupReadsAsHoled() {
+        // 8 h fully-staged fragment + a 2 h minute-dict fragment that decodes to no segments.
+        assertEquals(0.8, HypnogramCoverage.fraction(8 * 3600.0, 10 * 3600.0)!!, 1e-12)
+        assertTrue(0.8 < HypnogramCoverage.minCoverage)
+    }
 }

From baebe77260e00f06891f6747addb7d008ceabd21 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 16:07:20 +1200
Subject: [PATCH 053/333] Bucket an absolute chronotype from the body-clock
 phase (#1722)

Groundwork for the 24 h body-clock dial asked for in #1680. Analytics only - no UI, no copy, nothing wired to a screen.

The issue proposed bucketing the label from offsetVsScheduleMinutes, and that field cannot carry it: it is documented as minutes relative to the USER'S OWN schedule, so a consistent 03:00-11:00 sleeper sits near zero and would read intermediate while being strongly evening-type. This buckets tempMinHour - absolute phase, already in the same struct - against a population reference derived from the engine's own constants rather than a second hardcoded 4.5.

The comparison is circular, which is the part that needed a test: 23:30 is five hours BEFORE the 04:30 anchor and is a strong morning read, where a naive 23.5 > 5.5 would call it evening. Both platforms reuse the existing signedHourDelta.

Named Chronotype, not ChronotypeLean. estimatePhase already builds a  string from the schedule-relative offset twelve lines away, and the v5 skin-temp spec defines chronotype lean the same way - both relative to the wearer's schedule, where this is relative to the clock, and the two genuinely disagree on that 03:00-11:00 sleeper. Keeping the vocabularies disjoint is the discipline #1405 applied to the two readiness axes.

A named category is returned only for a SOLID fit. observedTempMinHour is supplied only in tests, so tempMinHour is always the activity-derived acrophase minus 12 h; the band is a deliberately wide hour either side and the buckets stay coarse at three.

Oracle pins both band edges, the values just past them, the circular wrap, midnight, both sides of the antipode and out-of-range inputs, asserted from both platforms. Android 4755 pass, CI 15/15.

The dial itself and the sleep-consistency line are deliberately not here - the Sleep screen already carries a consistency tile computed from bedtime spread, which is the better of the two metrics for a timing read.
---
 .../StrandAnalytics/CircadianEngine.swift     | 60 ++++++++++++++
 .../CircadianEngineTests.swift                | 45 +++++++++++
 .../com/noop/analytics/CircadianEngine.kt     | 71 +++++++++++++++++
 .../com/noop/analytics/CircadianEngineTest.kt | 79 +++++++++++++++++++
 4 files changed, 255 insertions(+)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/CircadianEngine.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/CircadianEngine.swift
index f6278a2388..a7f7ca9e9b 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/CircadianEngine.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/CircadianEngine.swift
@@ -48,6 +48,20 @@ public enum CircadianEngine {
     /// Activity acrophase (peak activity) sits roughly this many hours after CBTmin in a typical day — the
     /// offset used to convert the cosinor acrophase into an estimated temperature-minimum time.
     public static let acrophaseAfterCbtMinHours: Double = 12.0
+    /// Population-typical wake hour, used ONLY to place the chronotype reference point.
+    ///
+    /// `offsetVsScheduleMinutes` compares the clock to the USER'S OWN schedule, so it cannot name a
+    /// chronotype: someone reliably asleep 03:00-11:00 has an offset near zero and would read
+    /// "intermediate" while being strongly evening-type. A named lean needs an ABSOLUTE phase, so it is
+    /// bucketed from `tempMinHour` against a population reference instead.
+    public static let chronotypeReferenceWakeHour: Double = 7.0
+    /// Half-width of the "intermediate" band around the reference CBTmin, in hours.
+    ///
+    /// Deliberately wide. `tempMinHour` is derived from an activity cosinor (`acrophase - 12 h`) unless a
+    /// measured `observedTempMinHour` is supplied, and NO production caller supplies one today — so this
+    /// is a lean inferred from movement, not a thermal measurement. A one-hour band either side keeps the
+    /// three buckets coarse enough to be honest about that.
+    public static let chronotypeBandHours: Double = 1.0
 
     // MARK: - Inputs
 
@@ -322,6 +336,52 @@ public enum CircadianEngine {
         return x
     }
 
+    /// A coarse, ABSOLUTE body-clock category: where the temperature minimum sits on the clock.
+    ///
+    /// NOT the "chronotype lean" wording used elsewhere. `estimatePhase` builds a `lean` string from
+    /// `offsetVsScheduleMinutes` ("a night-owl lean"), and the v5 skin-temp design spec defines chronotype
+    /// lean as "earlier/later than your sleep schedule implies" — both RELATIVE to the wearer's own
+    /// schedule. This is relative to the CLOCK, and the two genuinely disagree: a consistent 03:00-11:00
+    /// sleeper is well-aligned by the relative read and `.evening` by this one. Keep the vocabularies
+    /// disjoint in anything user-facing, or the two readings look like a contradiction (#1409).
+    ///
+    /// Three buckets, not a score: the underlying phase estimate is an activity fit, and a finer grain
+    /// would imply precision it does not have.
+    public enum Chronotype: String, Equatable, Sendable, Codable {
+        case morning        // CBTmin earlier than the population reference
+        case intermediate
+        case evening        // CBTmin later than the population reference
+    }
+
+    /// The reference CBTmin clock hour a lean is measured against: the population wake hour minus the
+    /// same `cbtMinBeforeWakeHours` the phase estimator already uses, so the anchor moves with the
+    /// engine's own model rather than being a second, independently-drifting constant.
+    public static var chronotypeAnchorHour: Double {
+        wrap24(chronotypeReferenceWakeHour - cbtMinBeforeWakeHours)
+    }
+
+    /// Bucket an ABSOLUTE temperature-minimum clock hour into a lean.
+    ///
+    /// Compared CIRCULARLY. A `tempMinHour` of 23:30 is five hours BEFORE the 04:30 anchor — a strong
+    /// morning lean — and a naive `23.5 > 5.5` would call it evening instead. Pure, so the boundaries are
+    /// assertable without building a fit.
+    public static func chronotype(tempMinHour: Double) -> Chronotype {
+        let delta = signedHourDelta(from: chronotypeAnchorHour, to: wrap24(tempMinHour))
+        if delta < -chronotypeBandHours { return .morning }
+        if delta > chronotypeBandHours { return .evening }
+        return .intermediate
+    }
+
+    /// The lean for a phase estimate, or nil when the fit is not strong enough to name one.
+    ///
+    /// Gated to `.solid` on purpose. `.wide` is a real fit on thin data and is fine for the continuous
+    /// offset the card already shows, but a NAMED category reads as a fact about the person rather than a
+    /// reading of the week, so it waits for the stronger tier. `.unreadable` never names one.
+    public static func chronotype(_ estimate: PhaseEstimate) -> Chronotype? {
+        guard estimate.confidence == .solid else { return nil }
+        return chronotype(tempMinHour: estimate.tempMinHour)
+    }
+
     /// Signed shortest delta in hours from `a` to `b` on the 24 h clock, in (−12, 12].
     static func signedHourDelta(from a: Double, to b: Double) -> Double {
         var d = (b - a).truncatingRemainder(dividingBy: 24.0)
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CircadianEngineTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CircadianEngineTests.swift
index 6c2f57b17b..d1265a1a00 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CircadianEngineTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CircadianEngineTests.swift
@@ -151,4 +151,49 @@ final class CircadianEngineTests: XCTestCase {
         XCTAssertNotEqual(confidence(mesor: 45, amp: 5), .unreadable)   // 0.111
         XCTAssertEqual(confidence(mesor: 45, amp: 4), .unreadable)      // 0.089
     }
+
+    // MARK: - chronotype lean (absolute phase, not schedule-relative)
+
+    /// The boundaries and the circular case, asserted from this side too so the agreement is pinned on
+    /// both platforms rather than only in the Kotlin oracle. `late-evening-wrap` is the row that matters:
+    /// 23:30 is five hours BEFORE the 04:30 anchor, so it is a strong MORNING lean — a naive
+    /// `23.5 > 5.5` bucket would call it evening.
+    func testChronotypeBucketsAbsolutePhaseCircularly() {
+        XCTAssertEqual(CircadianEngine.chronotypeAnchorHour, 4.5, accuracy: 0,
+                       "the anchor is derived from the engine's own constants, not hardcoded")
+        let cases: [(Double, CircadianEngine.Chronotype)] = [
+            (4.5, .intermediate), (3.5, .intermediate), (3.49, .morning),
+            (5.5, .intermediate), (5.51, .evening),
+            (23.5, .morning), (0.0, .morning), (12.0, .evening),
+            (16.5, .evening), (16.4, .evening), (16.6, .morning),
+            (28.5, .intermediate), (-1.0, .morning),
+        ]
+        for (hour, expected) in cases {
+            XCTAssertEqual(CircadianEngine.chronotype(tempMinHour: hour), expected,
+                           "tempMinHour \(hour)")
+        }
+    }
+
+    /// A NAMED category reads as a fact about the person rather than a reading of the week, so it waits
+    /// for the strongest tier — unlike the continuous offset the card already shows at `.wide`.
+    func testChronotypeIsNamedOnlyForASolidFit() {
+        func estimate(_ confidence: CircadianEngine.PhaseConfidence) -> CircadianEngine.PhaseEstimate {
+            CircadianEngine.PhaseEstimate(tempMinHour: 23.5, acrophaseHours: 11.5,
+                                          offsetVsScheduleMinutes: 0, confidence: confidence, note: "")
+        }
+        XCTAssertEqual(CircadianEngine.chronotype(estimate(.solid)), .morning)
+        XCTAssertNil(CircadianEngine.chronotype(estimate(.wide)),
+                     "a thin fit must not name a chronotype")
+        XCTAssertNil(CircadianEngine.chronotype(estimate(.unreadable)))
+    }
+
+    /// The schedule-relative offset CANNOT name a chronotype, which is why this buckets the absolute
+    /// phase instead. A consistent 03:00-11:00 sleeper is well aligned with their OWN schedule — offset
+    /// ~0 — while being strongly evening-type by the clock.
+    func testConsistentLateSleeperIsEveningTypeDespiteAZeroScheduleOffset() {
+        let alignedButLate = CircadianEngine.PhaseEstimate(
+            tempMinHour: 8.0, acrophaseHours: 20.0, offsetVsScheduleMinutes: 0,
+            confidence: .solid, note: "")
+        XCTAssertEqual(CircadianEngine.chronotype(alignedButLate), .evening)
+    }
 }
diff --git a/android/app/src/main/java/com/noop/analytics/CircadianEngine.kt b/android/app/src/main/java/com/noop/analytics/CircadianEngine.kt
index 1b3a5f6255..59e374cec6 100644
--- a/android/app/src/main/java/com/noop/analytics/CircadianEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/CircadianEngine.kt
@@ -38,6 +38,25 @@ object CircadianEngine {
     const val maxShiftPerDayHours: Double = 1.0
     const val cbtMinBeforeWakeHours: Double = 2.5
     const val acrophaseAfterCbtMinHours: Double = 12.0
+    /**
+     * Population-typical wake hour, used ONLY to place the chronotype reference point.
+     *
+     * [PhaseEstimate.offsetVsScheduleMinutes] compares the clock to the USER'S OWN schedule, so it cannot
+     * name a chronotype: someone reliably asleep 03:00-11:00 has an offset near zero and would read
+     * "intermediate" while being strongly evening-type. A named lean needs an ABSOLUTE phase, so it is
+     * bucketed from [PhaseEstimate.tempMinHour] against a population reference instead.
+     * Mirrors the Swift twin exactly.
+     */
+    const val chronotypeReferenceWakeHour: Double = 7.0
+    /**
+     * Half-width of the "intermediate" band around the reference CBTmin, in hours.
+     *
+     * Deliberately wide. `tempMinHour` is derived from an activity cosinor (`acrophase - 12 h`) unless a
+     * measured `observedTempMinHour` is supplied, and NO production caller supplies one today — so this is
+     * a lean inferred from movement, not a thermal measurement. A one-hour band either side keeps the
+     * three buckets coarse enough to be honest about that. Mirrors the Swift twin exactly.
+     */
+    const val chronotypeBandHours: Double = 1.0
 
     // ── Inputs ──
 
@@ -245,6 +264,58 @@ object CircadianEngine {
         return x
     }
 
+    /**
+     * A coarse, ABSOLUTE body-clock category: where the temperature minimum sits on the clock.
+     *
+     * NOT the "chronotype lean" wording used elsewhere. [estimatePhase] builds a `lean` string from
+     * [PhaseEstimate.offsetVsScheduleMinutes] ("a night-owl lean"), and the v5 skin-temp design spec
+     * defines chronotype lean as "earlier/later than your sleep schedule implies" — both RELATIVE to the
+     * wearer's own schedule. This is relative to the CLOCK, and the two genuinely disagree: a consistent
+     * 03:00-11:00 sleeper is well-aligned by the relative read and EVENING by this one. Keep the
+     * vocabularies disjoint in anything user-facing, or the two readings look like a contradiction (#1409).
+     *
+     * Three buckets, not a score: the underlying phase estimate is an activity fit, and a finer grain
+     * would imply precision it does not have. Twin of Swift `CircadianEngine.Chronotype`.
+     */
+    enum class Chronotype(val raw: String) {
+        MORNING("morning"),          // CBTmin earlier than the population reference
+        INTERMEDIATE("intermediate"),
+        EVENING("evening"),          // CBTmin later than the population reference
+    }
+
+    /**
+     * The reference CBTmin clock hour a lean is measured against: the population wake hour minus the same
+     * [cbtMinBeforeWakeHours] the phase estimator already uses, so the anchor moves with the engine's own
+     * model rather than being a second, independently-drifting constant.
+     */
+    val chronotypeAnchorHour: Double get() = wrap24(chronotypeReferenceWakeHour - cbtMinBeforeWakeHours)
+
+    /**
+     * Bucket an ABSOLUTE temperature-minimum clock hour into a lean.
+     *
+     * Compared CIRCULARLY. A [tempMinHour] of 23:30 is five hours BEFORE the 04:30 anchor — a strong
+     * morning lean — and a naive `23.5 > 5.5` would call it evening instead. Pure, so the boundaries are
+     * assertable without building a fit.
+     */
+    fun chronotype(tempMinHour: Double): Chronotype {
+        val delta = signedHourDelta(chronotypeAnchorHour, wrap24(tempMinHour))
+        if (delta < -chronotypeBandHours) return Chronotype.MORNING
+        if (delta > chronotypeBandHours) return Chronotype.EVENING
+        return Chronotype.INTERMEDIATE
+    }
+
+    /**
+     * The lean for a phase estimate, or null when the fit is not strong enough to name one.
+     *
+     * Gated to [PhaseConfidence.SOLID] on purpose. WIDE is a real fit on thin data and is fine for the
+     * continuous offset the card already shows, but a NAMED category reads as a fact about the person
+     * rather than a reading of the week, so it waits for the stronger tier. UNREADABLE never names one.
+     */
+    fun chronotype(estimate: PhaseEstimate): Chronotype? {
+        if (estimate.confidence != PhaseConfidence.SOLID) return null
+        return chronotype(estimate.tempMinHour)
+    }
+
     /** Signed shortest delta in hours from [a] to [b] on the 24 h clock, in (−12, 12]. */
     internal fun signedHourDelta(a: Double, b: Double): Double {
         var d = (b - a) % 24.0
diff --git a/android/app/src/test/java/com/noop/analytics/CircadianEngineTest.kt b/android/app/src/test/java/com/noop/analytics/CircadianEngineTest.kt
index c4e9cf238b..b10ac5766d 100644
--- a/android/app/src/test/java/com/noop/analytics/CircadianEngineTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/CircadianEngineTest.kt
@@ -138,4 +138,83 @@ class CircadianEngineTest {
         assertTrue(confidence(45.0, 5.0) != CircadianEngine.PhaseConfidence.UNREADABLE)   // 0.111
         assertEquals(CircadianEngine.PhaseConfidence.UNREADABLE, confidence(45.0, 4.0))   // 0.089
     }
+
+    // ---- chronotype lean (absolute phase, not schedule-relative) ----
+
+    /**
+     * VERBATIM stdout of the Swift twin's arithmetic compiled standalone (`swiftc -O`), pinned per
+     * CLAUDE.md's byte-parity rule. Format: label|tempMinHour|signedDelta|lean.
+     *
+     * The `late-evening-wrap` row is the one that earns its place: 23:30 is five hours BEFORE the 04:30
+     * anchor, so it is a strong MORNING lean. A naive `23.5 > 5.5` bucket would call it evening, and
+     * reading the two implementations side by side would not settle which one is right.
+     *
+     * The antipode pair is pinned because it LOOKS like a bug and is not: 16.5 reads evening and 16.6
+     * reads morning, because 16:30 is exactly half a day from the anchor and either direction is equally
+     * far. Inherent to a circular bucket, unreachable in practice (a 16:30 CBTmin is not a physiology),
+     * and pinned so nobody "corrects" the wrap and breaks the 23:30 case with it.
+     */
+    private val chronotypeOracle = """
+        anchor|4.5|0.0|intermediate
+        band-early-edge|3.5|-1.0|intermediate
+        just-morning|3.49|-1.0099999999999998|morning
+        band-late-edge|5.5|1.0|intermediate
+        just-evening|5.51|1.0099999999999998|evening
+        late-evening-wrap|23.5|-5.0|morning
+        midnight|0.0|-4.5|morning
+        noon|12.0|7.5|evening
+        antipode|16.5|12.0|evening
+        just-before-antipode|16.4|11.899999999999999|evening
+        just-past-antipode|16.6|-11.899999999999999|morning
+        over-24-input|28.5|0.0|intermediate
+        negative-input|-1.0|-5.5|morning
+    """.trimIndent()
+
+    @Test
+    fun chronotypeMatchesTheSwiftOracleExactly() {
+        assertEquals("the anchor is derived from the engine's own constants, not hardcoded",
+            4.5, CircadianEngine.chronotypeAnchorHour, 0.0)
+        for (row in chronotypeOracle.lines().map { it.trim() }.filter { it.isNotEmpty() }) {
+            val (label, hourText, deltaText, leanText) = row.split("|")
+            val hour = hourText.toDouble()
+            assertEquals(
+                "$label: signed delta from the anchor",
+                deltaText.toDouble(),
+                CircadianEngine.signedHourDelta(CircadianEngine.chronotypeAnchorHour, CircadianEngine.wrap24(hour)),
+                0.0,
+            )
+            assertEquals("$label: lean", leanText, CircadianEngine.chronotype(hour).raw)
+        }
+    }
+
+    /**
+     * A NAMED category reads as a fact about the person rather than a reading of the week, so it waits
+     * for the strongest tier — unlike the continuous offset the card already shows at WIDE.
+     */
+    @Test
+    fun chronotypeIsNamedOnlyForASolidFit() {
+        fun estimate(confidence: CircadianEngine.PhaseConfidence) = CircadianEngine.PhaseEstimate(
+            tempMinHour = 23.5, acrophaseHours = 11.5, offsetVsScheduleMinutes = 0.0,
+            confidence = confidence, note = "",
+        )
+        assertEquals(CircadianEngine.Chronotype.MORNING,
+            CircadianEngine.chronotype(estimate(CircadianEngine.PhaseConfidence.SOLID)))
+        assertNull("a thin fit must not name a chronotype",
+            CircadianEngine.chronotype(estimate(CircadianEngine.PhaseConfidence.WIDE)))
+        assertNull(CircadianEngine.chronotype(estimate(CircadianEngine.PhaseConfidence.UNREADABLE)))
+    }
+
+    /**
+     * The schedule-relative offset CANNOT name a chronotype, which is why this is bucketed from the
+     * absolute phase instead. A consistent 03:00-11:00 sleeper is well aligned with their OWN schedule —
+     * offset ~0 — while being strongly evening-type by the clock.
+     */
+    @Test
+    fun aConsistentLateSleeperIsEveningTypeDespiteAZeroScheduleOffset() {
+        val alignedButLate = CircadianEngine.PhaseEstimate(
+            tempMinHour = 8.0, acrophaseHours = 20.0, offsetVsScheduleMinutes = 0.0,
+            confidence = CircadianEngine.PhaseConfidence.SOLID, note = "",
+        )
+        assertEquals(CircadianEngine.Chronotype.EVENING, CircadianEngine.chronotype(alignedButLate))
+    }
 }

From 93f85d3bd69a2d739259675ab752a65d5f39be0e Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 18:43:08 +1200
Subject: [PATCH 054/333] Add the 24 h body-clock dial to the Sleep screen
 (#1723)

The visual asked for in #1680: two concentric arcs on one 24 h ring, the outer where the body clock wanted the night and the inner where it happened. Overlap is the message.

Optional without a new setting. The Sleep screen already has an arrange/hide mechanism, so the dial is registered as a SleepSection rather than given a toggle of its own - that buys hide and reorder for free and adds no preference key. Decode inserts a newly-known section at its default position, so existing users get it after Stages without losing their arrangement.

Three shared analytics, byte-identical twins with oracle tests. idealSleepWindow takes the night's OWN length so the dial compares phase alone and a sleep debt cannot masquerade as a body-clock problem. sleepWindowOffsetHours is the caption quantity - the distance between the two arcs DRAWN - and deliberately not offsetVsScheduleMinutes, which compares the clock to the wearer's schedule and is what the Health card reports; the two disagree exactly when someone keeps a consistent schedule that does not suit their clock, which is the case the dial exists to show. A test pins them apart.

Re-review caught three defects in the cards: the decimal separator diverged (Kotlin used the default locale, Swift's String(format:) is C-locale, so German read 1,5 h on one platform and 1.5 h on the other); VoiceOver announced the verdict twice on iOS because the dial carried it as an accessibilityValue beside the caption; and a degenerate night swept a full ring while the ideal arc vanished, stating something false. Both cards now stand down on exactly the input that makes the ideal window unplaceable.

app-build was dispatched twice. The first run found the Swift twins of four section-list fixtures in StrandTests/SleepLayoutPrefsTests.swift - a file that runs ONLY under app-build, so main would have carried four red tests invisibly. The Swift sources compiled clean throughout. Second run green on both legs.

Nine strings across all seven Android locale files and all nine iOS locales, the catalogue edited as text. Android 4759 pass, lintVitalFullRelease clean, PR checks 15/15, app-build macOS and iOS both green.
---
 .../StrandAnalytics/CircadianEngine.swift     |  34 ++++
 .../CircadianEngineTests.swift                |  55 ++++++
 Strand/Data/SleepLayoutPrefs.swift            |   4 +-
 Strand/Resources/Localizable.xcstrings        |  10 +-
 Strand/Screens/BodyClockDialCard.swift        | 157 +++++++++++++++++
 Strand/Screens/SleepCustomizationSheet.swift  |   2 +
 Strand/Screens/SleepView.swift                |  26 +++
 StrandTests/SleepLayoutPrefsTests.swift       |  11 +-
 .../com/noop/analytics/CircadianEngine.kt     |  41 +++++
 .../java/com/noop/ui/BodyClockDialCard.kt     | 165 ++++++++++++++++++
 .../main/java/com/noop/ui/SleepLayoutPrefs.kt |   4 +-
 .../src/main/java/com/noop/ui/SleepScreen.kt  |  30 ++++
 .../app/src/main/res/values-de/strings.xml    |   9 +
 .../app/src/main/res/values-es/strings.xml    |   9 +
 .../app/src/main/res/values-fr/strings.xml    |   9 +
 .../app/src/main/res/values-pl/strings.xml    |   9 +
 .../src/main/res/values-pt-rPT/strings.xml    |   9 +
 .../app/src/main/res/values-zh/strings.xml    |   9 +
 android/app/src/main/res/values/strings.xml   |   9 +
 .../com/noop/analytics/CircadianEngineTest.kt |  92 ++++++++++
 .../java/com/noop/ui/SleepLayoutPrefsTest.kt  |  10 +-
 .../com/noop/ui/SleepSectionReorderTest.kt    |   5 +-
 22 files changed, 695 insertions(+), 14 deletions(-)
 create mode 100644 Strand/Screens/BodyClockDialCard.swift
 create mode 100644 android/app/src/main/java/com/noop/ui/BodyClockDialCard.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/CircadianEngine.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/CircadianEngine.swift
index a7f7ca9e9b..de115ec721 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/CircadianEngine.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/CircadianEngine.swift
@@ -360,6 +360,40 @@ public enum CircadianEngine {
         wrap24(chronotypeReferenceWakeHour - cbtMinBeforeWakeHours)
     }
 
+    /// The chronotype-ideal sleep window for a night of `durationHours`, as clock hours.
+    ///
+    /// Anchored on the temperature minimum: a well-entrained sleeper wakes about `cbtMinBeforeWakeHours`
+    /// after CBTmin, so the ideal wake is `tempMinHour + cbtMinBeforeWakeHours` and the ideal bedtime is
+    /// that minus the night's own length.
+    ///
+    /// USING THE ACTUAL DURATION IS THE POINT. Giving the ideal arc the same length as the real one makes
+    /// the comparison purely about PHASE — did you sleep at the right TIME — so a short night reads as
+    /// aligned-but-short rather than as misaligned. Feeding a "needed" duration instead would fold two
+    /// different failures into one arc and make a debt look like a body-clock problem.
+    ///
+    /// nil for a non-positive or impossible duration; a window longer than a day cannot be placed on a
+    /// 24 h ring, and silently wrapping it would draw a full circle that means nothing.
+    public static func idealSleepWindow(tempMinHour: Double,
+                                        durationHours: Double) -> (bedHour: Double, wakeHour: Double)? {
+        guard durationHours > 0, durationHours < 24 else { return nil }
+        let wake = wrap24(tempMinHour + cbtMinBeforeWakeHours)
+        return (bedHour: wrap24(wake - durationHours), wakeHour: wake)
+    }
+
+    /// Signed hours the ACTUAL sleep window sits later (+) or earlier (−) than the chronotype-ideal one.
+    ///
+    /// Deliberately NOT `offsetVsScheduleMinutes`. That field compares the body clock to the wearer's own
+    /// SCHEDULE; this compares the night actually slept to where the CLOCK wanted it. A dial that draws an
+    /// actual arc against an ideal arc must caption itself with the distance between those two arcs, or
+    /// the number contradicts the picture — the two disagree exactly when someone keeps a consistent
+    /// schedule that does not suit their clock, which is the case the dial exists to show.
+    ///
+    /// Anchored on wake rather than bedtime because `idealSleepWindow` builds the ideal window from the
+    /// wake end; comparing bedtimes would fold the night's DURATION into a phase reading.
+    public static func sleepWindowOffsetHours(tempMinHour: Double, actualWakeHour: Double) -> Double {
+        signedHourDelta(from: wrap24(tempMinHour + cbtMinBeforeWakeHours), to: wrap24(actualWakeHour))
+    }
+
     /// Bucket an ABSOLUTE temperature-minimum clock hour into a lean.
     ///
     /// Compared CIRCULARLY. A `tempMinHour` of 23:30 is five hours BEFORE the 04:30 anchor — a strong
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CircadianEngineTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CircadianEngineTests.swift
index d1265a1a00..adf3378a2e 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CircadianEngineTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CircadianEngineTests.swift
@@ -196,4 +196,59 @@ final class CircadianEngineTests: XCTestCase {
             confidence: .solid, note: "")
         XCTAssertEqual(CircadianEngine.chronotype(alignedButLate), .evening)
     }
+
+    /// The same table the Kotlin oracle pins, asserted from this side too. `typical` says the model is
+    /// sane: a 04:30 temperature minimum and an 8 h night put the ideal window at 23:00-07:00. The wrap
+    /// rows matter because the ideal bedtime routinely lands on the PREVIOUS day.
+    func testIdealSleepWindowPlacesTheWindowOnTheRing() {
+        let cases: [(Double, Double, (Double, Double)?)] = [
+            (4.5, 8.0, (23.0, 7.0)), (4.5, 5.0, (2.0, 7.0)), (4.5, 10.0, (21.0, 7.0)),
+            (7.0, 8.0, (1.5, 9.5)), (2.0, 8.0, (20.5, 4.5)),
+            (1.0, 8.0, (19.5, 3.5)), (23.0, 8.0, (17.5, 1.5)),
+            (4.5, 0.0, nil), (4.5, -1.0, nil), (4.5, 24.0, nil),
+        ]
+        for (tempMin, duration, expected) in cases {
+            let w = CircadianEngine.idealSleepWindow(tempMinHour: tempMin, durationHours: duration)
+            if let expected {
+                XCTAssertEqual(w?.bedHour ?? -1, expected.0, accuracy: 1e-12, "bed for \(tempMin)/\(duration)")
+                XCTAssertEqual(w?.wakeHour ?? -1, expected.1, accuracy: 1e-12, "wake for \(tempMin)/\(duration)")
+            } else {
+                XCTAssertNil(w, "an impossible duration cannot be placed on the ring: \(duration)")
+            }
+        }
+    }
+
+    /// The ideal arc takes the night's OWN length, so the dial compares PHASE alone — which keeps a sleep
+    /// DEBT from rendering as a body-clock problem.
+    func testIdealWindowSharesTheWakeAnchorAcrossDurations() {
+        let short = CircadianEngine.idealSleepWindow(tempMinHour: 4.5, durationHours: 5)
+        let long = CircadianEngine.idealSleepWindow(tempMinHour: 4.5, durationHours: 10)
+        XCTAssertEqual(short?.wakeHour, long?.wakeHour)
+        XCTAssertNotEqual(short?.bedHour, long?.bedHour)
+    }
+
+    /// The dial's caption quantity. `wrap-late` earns its place: a 23:00 temperature minimum puts the
+    /// ideal wake at 01:30, so waking at 02:30 is one hour LATE, not twenty-three hours early.
+    func testSleepWindowOffsetHours() {
+        let cases: [(Double, Double, Double)] = [
+            (4.5, 7.0, 0.0), (4.5, 8.0, 1.0), (4.5, 6.0, -1.0),
+            (23.0, 2.5, 1.0), (1.0, 23.0, -4.5), (4.5, 19.0, 12.0),
+        ]
+        for (tempMin, wake, expected) in cases {
+            XCTAssertEqual(CircadianEngine.sleepWindowOffsetHours(tempMinHour: tempMin, actualWakeHour: wake),
+                           expected, accuracy: 1e-12, "tempMin \(tempMin) wake \(wake)")
+        }
+    }
+
+    /// The dial's caption and the card's existing headline measure DIFFERENT things: a consistent late
+    /// sleeper is well-aligned with their own schedule while sleeping hours from what their clock wants.
+    func testWindowOffsetAndScheduleOffsetAreDifferentQuantities() {
+        let windowOffset = CircadianEngine.sleepWindowOffsetHours(tempMinHour: 8.0, actualWakeHour: 6.5)
+        XCTAssertEqual(windowOffset, -4.0, accuracy: 1e-12)
+        let scheduleAligned = CircadianEngine.PhaseEstimate(
+            tempMinHour: 8.0, acrophaseHours: 20.0, offsetVsScheduleMinutes: 0,
+            confidence: .solid, note: "")
+        XCTAssertEqual(scheduleAligned.offsetVsScheduleMinutes, 0)
+        XCTAssertGreaterThan(abs(windowOffset), 1.0)
+    }
 }
diff --git a/Strand/Data/SleepLayoutPrefs.swift b/Strand/Data/SleepLayoutPrefs.swift
index 6980e65358..75e6cab182 100644
--- a/Strand/Data/SleepLayoutPrefs.swift
+++ b/Strand/Data/SleepLayoutPrefs.swift
@@ -29,6 +29,7 @@ import SwiftUI
 enum SleepSection: String, CaseIterable, Identifiable {
     case sleepMarks
     case stages
+    case bodyClock
     case nightDetail
     case sleepDebt
     case stagesVsTypical
@@ -41,6 +42,7 @@ enum SleepSection: String, CaseIterable, Identifiable {
         switch self {
         case .sleepMarks:      return String(localized: "Sleep marks")
         case .stages:          return String(localized: "Stages")
+        case .bodyClock:       return String(localized: "Body clock")
         case .nightDetail:     return String(localized: "Night detail")
         case .sleepDebt:       return String(localized: "Sleep-debt ledger")
         case .stagesVsTypical: return String(localized: "Stages vs typical")
@@ -53,7 +55,7 @@ enum SleepSection: String, CaseIterable, Identifiable {
     /// with Stages for now — it's drawn inside the stages hero; making it an independently arrangeable
     /// card is a follow-up that requires hoisting the hero's edit/delete callbacks.)
     static let defaultOrder: [SleepSection] = [
-        .sleepMarks, .stages, .nightDetail, .sleepDebt, .stagesVsTypical, .asleepDuration,
+        .sleepMarks, .stages, .bodyClock, .nightDetail, .sleepDebt, .stagesVsTypical, .asleepDuration,
     ]
 }
 
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 1ad4bf61c4..00925990b9 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -208224,7 +208224,15 @@
     } },
     "The answer from the strap appears in your strap log and debug export, with the raw bytes it replied with.": { "localizations": {
       "de": { "stringUnit": { "state": "translated", "value": "Die Antwort des Bands erscheint im Band-Log und im Diagnose-Export, samt der empfangenen Rohbytes." } }, "en": { "stringUnit": { "state": "translated", "value": "The answer from the strap appears in your strap log and debug export, with the raw bytes it replied with." } }, "es": { "stringUnit": { "state": "translated", "value": "La respuesta de la correa aparece en el registro y en la exportación de diagnóstico, con los bytes recibidos." } }, "fr": { "stringUnit": { "state": "translated", "value": "La réponse du bracelet apparaît dans le journal et l’export de diagnostic, avec les octets bruts reçus." } }, "it": { "stringUnit": { "state": "translated", "value": "La risposta del braccialetto compare nel log e nell’esportazione diagnostica, con i byte grezzi ricevuti." } }, "pl": { "stringUnit": { "state": "translated", "value": "Odpowiedź opaski pojawi się w logu i eksporcie diagnostycznym, wraz z otrzymanymi surowymi bajtami." } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "A resposta da pulseira aparece no registo e na exportação de diagnóstico, com os bytes recebidos." } }, "ru": { "stringUnit": { "state": "translated", "value": "Ответ ремешка появится в журнале ремешка и диагностическом экспорте вместе с полученными байтами." } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "手环的回应会出现在手环日志和诊断导出中，并附带收到的原始字节。" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "手環的回應會出現在手環日誌和診斷匯出中，並附上收到的原始位元組。" } }
-    } }
+    } },
+    "Last night against your clock": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Letzte Nacht im Vergleich zu deiner inneren Uhr"}},"es":{"stringUnit":{"state":"translated","value":"Anoche frente a tu reloj interno"}},"fr":{"stringUnit":{"state":"translated","value":"La nuit dernière face à votre horloge"}},"it":{"stringUnit":{"state":"translated","value":"La scorsa notte rispetto al tuo orologio"}},"pl":{"stringUnit":{"state":"translated","value":"Ostatnia noc a Twój zegar biologiczny"}},"pt-PT":{"stringUnit":{"state":"translated","value":"A noite passada face ao seu relógio"}},"ru":{"stringUnit":{"state":"translated","value":"Прошлая ночь и ваши биологические часы"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"昨夜与你的生物钟对比"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"昨夜與你的生理時鐘對比"}}}},
+    "In sync with your body clock": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Im Einklang mit deiner inneren Uhr"}},"es":{"stringUnit":{"state":"translated","value":"En sintonía con tu reloj interno"}},"fr":{"stringUnit":{"state":"translated","value":"En phase avec votre horloge biologique"}},"it":{"stringUnit":{"state":"translated","value":"In sintonia con il tuo orologio biologico"}},"pl":{"stringUnit":{"state":"translated","value":"Zgodnie z zegarem biologicznym"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Em sintonia com o seu relógio biológico"}},"ru":{"stringUnit":{"state":"translated","value":"В согласии с биологическими часами"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"与生物钟同步"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"與生理時鐘同步"}}}},
+    "%@ later than your body clock": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"%@ später als deine innere Uhr"}},"es":{"stringUnit":{"state":"translated","value":"%@ más tarde que tu reloj interno"}},"fr":{"stringUnit":{"state":"translated","value":"%@ plus tard que votre horloge biologique"}},"it":{"stringUnit":{"state":"translated","value":"%@ più tardi del tuo orologio biologico"}},"pl":{"stringUnit":{"state":"translated","value":"%@ później niż Twój zegar biologiczny"}},"pt-PT":{"stringUnit":{"state":"translated","value":"%@ mais tarde do que o seu relógio biológico"}},"ru":{"stringUnit":{"state":"translated","value":"На %@ позже биологических часов"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"比生物钟晚 %@"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"比生理時鐘晚 %@"}}}},
+    "%@ earlier than your body clock": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"%@ früher als deine innere Uhr"}},"es":{"stringUnit":{"state":"translated","value":"%@ más temprano que tu reloj interno"}},"fr":{"stringUnit":{"state":"translated","value":"%@ plus tôt que votre horloge biologique"}},"it":{"stringUnit":{"state":"translated","value":"%@ più presto del tuo orologio biologico"}},"pl":{"stringUnit":{"state":"translated","value":"%@ wcześniej niż Twój zegar biologiczny"}},"pt-PT":{"stringUnit":{"state":"translated","value":"%@ mais cedo do que o seu relógio biológico"}},"ru":{"stringUnit":{"state":"translated","value":"На %@ раньше биологических часов"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"比生物钟早 %@"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"比生理時鐘早 %@"}}}},
+    "Morning type": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Morgentyp"}},"es":{"stringUnit":{"state":"translated","value":"Tipo matutino"}},"fr":{"stringUnit":{"state":"translated","value":"Type matinal"}},"it":{"stringUnit":{"state":"translated","value":"Tipo mattutino"}},"pl":{"stringUnit":{"state":"translated","value":"Typ poranny"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Tipo matutino"}},"ru":{"stringUnit":{"state":"translated","value":"Утренний тип"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"晨型人"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"晨型人"}}}},
+    "Intermediate type": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Mischtyp"}},"es":{"stringUnit":{"state":"translated","value":"Tipo intermedio"}},"fr":{"stringUnit":{"state":"translated","value":"Type intermédiaire"}},"it":{"stringUnit":{"state":"translated","value":"Tipo intermedio"}},"pl":{"stringUnit":{"state":"translated","value":"Typ pośredni"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Tipo intermédio"}},"ru":{"stringUnit":{"state":"translated","value":"Промежуточный тип"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"中间型"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"中間型"}}}},
+    "Evening type": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Abendtyp"}},"es":{"stringUnit":{"state":"translated","value":"Tipo vespertino"}},"fr":{"stringUnit":{"state":"translated","value":"Type vespéral"}},"it":{"stringUnit":{"state":"translated","value":"Tipo serale"}},"pl":{"stringUnit":{"state":"translated","value":"Typ wieczorny"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Tipo vespertino"}},"ru":{"stringUnit":{"state":"translated","value":"Вечерний тип"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"夜型人"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"夜型人"}}}},
+    "Body clock dial": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Zifferblatt der inneren Uhr"}},"es":{"stringUnit":{"state":"translated","value":"Esfera del reloj interno"}},"fr":{"stringUnit":{"state":"translated","value":"Cadran de l'horloge biologique"}},"it":{"stringUnit":{"state":"translated","value":"Quadrante dell'orologio biologico"}},"pl":{"stringUnit":{"state":"translated","value":"Tarcza zegara biologicznego"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Mostrador do relógio biológico"}},"ru":{"stringUnit":{"state":"translated","value":"Циферблат биологических часов"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"生物钟表盘"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"生理時鐘錶盤"}}}}
   },
   "version": "1.0"
 }
diff --git a/Strand/Screens/BodyClockDialCard.swift b/Strand/Screens/BodyClockDialCard.swift
new file mode 100644
index 0000000000..0b05bd8d5e
--- /dev/null
+++ b/Strand/Screens/BodyClockDialCard.swift
@@ -0,0 +1,157 @@
+import SwiftUI
+import StrandAnalytics
+import StrandDesign
+
+/// A 24 h dial comparing the night actually slept against the chronotype-ideal window (#1680).
+///
+/// Two concentric arcs on one ring: the outer is where the body clock wanted the night, the inner is
+/// where it happened. Overlap is the whole message — the card exists so "was last night's timing right"
+/// is answerable at a glance, which the existing text-only `BodyClockCard` on Health cannot do.
+///
+/// VOCABULARY. The caption measures `sleepWindowOffsetHours` — the distance between the two ARCS DRAWN —
+/// and NOT `offsetVsScheduleMinutes`, which compares the clock to the wearer's habitual schedule and is
+/// what the Health card already reports. The two disagree exactly when someone keeps a consistent
+/// schedule that does not suit their clock, and that is the case this dial exists to show, so captioning
+/// it with the other number would contradict the picture.
+///
+/// Nothing here computes a metric: the window, the offset and the chronotype all come from
+/// `CircadianEngine`, byte-identical with the Kotlin twin. Only the drawing is per-platform.
+struct BodyClockDialCard: View {
+    let estimate: CircadianEngine.PhaseEstimate
+    /// The night's own bed/wake clock hours (0..<24, fractional), from the scored session.
+    let actualBedHour: Double
+    let actualWakeHour: Double
+
+    private var hue: Color { StrandPalette.restColor }
+
+    /// The night's length, taken the long way round the clock when it crosses midnight.
+    private var durationHours: Double {
+        let d = (actualWakeHour - actualBedHour).truncatingRemainder(dividingBy: 24)
+        return d <= 0 ? d + 24 : d
+    }
+
+    private var ideal: (bedHour: Double, wakeHour: Double)? {
+        CircadianEngine.idealSleepWindow(tempMinHour: estimate.tempMinHour, durationHours: durationHours)
+    }
+
+    private var offsetHours: Double {
+        CircadianEngine.sleepWindowOffsetHours(tempMinHour: estimate.tempMinHour,
+                                               actualWakeHour: actualWakeHour)
+    }
+
+    var body: some View {
+        // `ideal` is nil exactly when the night's length is non-positive or a full day — the same input
+        // that makes `sweep` wrap to 24 h and draw the actual arc as a complete ring. Rendering a full
+        // circle with no ideal arc beside it would state something false about the night, so the card
+        // stands down instead. Twin of the Kotlin guard.
+        if ideal != nil {
+            NoopCard(tint: hue) {
+                VStack(alignment: .leading, spacing: NoopMetrics.gap) {
+                    header
+                    dial
+                        .frame(maxWidth: .infinity)
+                        .accessibilityElement(children: .ignore)
+                        // Label only. The verdict is the caption Text below, a separate element, so giving
+                        // the dial the same string as its VALUE made VoiceOver announce it twice.
+                        .accessibilityLabel(Text("Body clock dial"))
+                    Text(alignmentText)
+                        .font(StrandFont.title2)
+                        .foregroundStyle(StrandPalette.textPrimary)
+                        .fixedSize(horizontal: false, vertical: true)
+                    if let chronotype = CircadianEngine.chronotype(estimate) {
+                        Text(chronotypeText(chronotype))
+                            .font(StrandFont.footnote)
+                            .foregroundStyle(StrandPalette.textTertiary)
+                    }
+                }
+            }
+            .accessibilityElement(children: .contain)
+        }
+    }
+
+    private var header: some View {
+        HStack(alignment: .firstTextBaseline) {
+            VStack(alignment: .leading, spacing: 2) {
+                Text("Body clock").strandOverline()
+                Text("Last night against your clock")
+                    .font(StrandFont.footnote)
+                    .foregroundStyle(StrandPalette.textTertiary)
+            }
+            Spacer()
+        }
+    }
+
+    /// Midnight at the top, clocking round to the right — the orientation every 24 h dial uses, so the
+    /// ring reads without a legend. SwiftUI's zero angle is at 3 o'clock, hence the −90.
+    private func angle(_ hour: Double) -> Angle { .degrees(hour / 24 * 360 - 90) }
+
+    /// Sweep from `from` to `to` going clockwise, always positive so an arc crossing midnight still draws.
+    private func sweep(_ from: Double, _ to: Double) -> Double {
+        let d = (to - from).truncatingRemainder(dividingBy: 24)
+        return d <= 0 ? d + 24 : d
+    }
+
+    private var dial: some View {
+        Canvas { ctx, size in
+            let side = min(size.width, size.height)
+            let centre = CGPoint(x: size.width / 2, y: size.height / 2)
+            let outer = side / 2 - 10
+            let inner = outer - 16
+
+            // The bare ring, so an empty dial still reads as a clock rather than a broken chart.
+            ctx.stroke(Path(ellipseIn: CGRect(x: centre.x - outer, y: centre.y - outer,
+                                              width: outer * 2, height: outer * 2)),
+                       with: .color(StrandPalette.hairline), lineWidth: 1)
+
+            // Six-hourly ticks: enough to orient the eye, few enough not to compete with the arcs.
+            for tick in stride(from: 0.0, to: 24.0, by: 6.0) {
+                let a = angle(tick).radians
+                var p = Path()
+                p.move(to: CGPoint(x: centre.x + cos(a) * (outer - 4), y: centre.y + sin(a) * (outer - 4)))
+                p.addLine(to: CGPoint(x: centre.x + cos(a) * outer, y: centre.y + sin(a) * outer))
+                ctx.stroke(p, with: .color(StrandPalette.textTertiary.opacity(0.5)), lineWidth: 1)
+            }
+
+            func arc(radius: CGFloat, from: Double, to: Double, colour: Color, width: CGFloat) {
+                var p = Path()
+                p.addArc(center: centre, radius: radius,
+                         startAngle: angle(from),
+                         endAngle: .degrees(angle(from).degrees + sweep(from, to) / 24 * 360),
+                         clockwise: false)
+                ctx.stroke(p, with: .color(colour), style: StrokeStyle(lineWidth: width, lineCap: .round))
+            }
+
+            if let ideal {
+                arc(radius: outer, from: ideal.bedHour, to: ideal.wakeHour,
+                    colour: hue.opacity(0.35), width: 8)
+            }
+            arc(radius: inner, from: actualBedHour, to: actualWakeHour, colour: hue, width: 8)
+        }
+        .frame(height: 170)
+    }
+
+    /// Rounded to five minutes: the underlying phase is an activity fit, so a to-the-minute caption would
+    /// imply a precision the estimate does not carry.
+    private var alignmentText: String {
+        let minutes = Int((offsetHours * 60 / 5).rounded()) * 5
+        if abs(minutes) < 30 { return String(localized: "In sync with your body clock") }
+        let hours = abs(Double(minutes)) / 60
+        // Locale-formatted, NOT String(format:). That is C-locale, so it prints "1.5 h" for a German
+        // reader while the Android twin's String.format prints "1,5 h" from the default locale — the two
+        // platforms disagreeing on a decimal separator in the same sentence.
+        let amount = hours >= 1
+            ? "\(hours.formatted(.number.precision(.fractionLength(1)))) h"
+            : "\(abs(minutes)) min"
+        return minutes > 0
+            ? String(localized: "\(amount) later than your body clock")
+            : String(localized: "\(amount) earlier than your body clock")
+    }
+
+    private func chronotypeText(_ c: CircadianEngine.Chronotype) -> String {
+        switch c {
+        case .morning:      return String(localized: "Morning type")
+        case .intermediate: return String(localized: "Intermediate type")
+        case .evening:      return String(localized: "Evening type")
+        }
+    }
+}
diff --git a/Strand/Screens/SleepCustomizationSheet.swift b/Strand/Screens/SleepCustomizationSheet.swift
index 763d0e01fb..6840bed5a8 100644
--- a/Strand/Screens/SleepCustomizationSheet.swift
+++ b/Strand/Screens/SleepCustomizationSheet.swift
@@ -94,6 +94,7 @@ extension SleepSection {
         switch self {
         case .sleepMarks:      return "bed.double"
         case .stages:          return "chart.bar.xaxis"
+        case .bodyClock:       return "clock.badge.checkmark"
         case .nightDetail:     return "square.grid.2x2"
         case .sleepDebt:       return "arrow.down.right.circle"
         case .stagesVsTypical: return "chart.bar"
@@ -107,6 +108,7 @@ extension SleepSection {
         switch self {
         case .sleepMarks:      return StrandPalette.accent
         case .stages:          return StrandPalette.restColor
+        case .bodyClock:       return StrandPalette.restColor
         case .nightDetail:     return StrandPalette.restBright
         case .sleepDebt:       return StrandPalette.effortColor
         case .stagesVsTypical: return StrandPalette.restColor
diff --git a/Strand/Screens/SleepView.swift b/Strand/Screens/SleepView.swift
index 32ff136edd..6d24b89938 100644
--- a/Strand/Screens/SleepView.swift
+++ b/Strand/Screens/SleepView.swift
@@ -28,6 +28,9 @@ import UIKit
 
 struct SleepView: View {
     @EnvironmentObject var repo: Repository
+    /// For `circadianPhase` only (the body-clock dial). Named `appModel` because `model` on this screen is
+    /// already the built `SleepModel`.
+    @EnvironmentObject var appModel: AppModel
     // NOTE: SleepView itself deliberately does NOT observe `LiveState`. A connected strap publishes
     // at ~1 Hz; observing here would re-evaluate this heavy body on every tick. The only two live
     // dependencies — the "going to sleep / awake" mark card (it appends to the strap log) and the
@@ -401,6 +404,7 @@ struct SleepView: View {
         switch section {
         case .sleepMarks:      SleepMarkCard()
         case .stages:          hero(model)
+        case .bodyClock:       bodyClockDial(model)
         case .nightDetail:     NightDetailCard(model: model)
         case .sleepDebt:       SleepDebtLedgerCard(model: model)
         case .stagesVsTypical: StagesVsTypicalCard(model: model)
@@ -408,6 +412,28 @@ struct SleepView: View {
         }
     }
 
+    /// The 24 h dial (#1680), or nothing at all.
+    ///
+    /// Drawn only for a fit that is at least `.wide`: an `.unreadable` rhythm has no phase to compare a
+    /// night against, and an empty ring would read as a broken chart rather than as "not enough data". The
+    /// card is a reorderable Sleep section, so anyone who does not want it hides it in Arrange — the same
+    /// affordance every other card on this screen already has, rather than a new setting of its own.
+    @ViewBuilder
+    private func bodyClockDial(_ model: SleepModel) -> some View {
+        if let phase = appModel.circadianPhase, phase.confidence != .unreadable {
+            BodyClockDialCard(estimate: phase,
+                              actualBedHour: Self.localClockHour(model.night.session.effectiveStartTs),
+                              actualWakeHour: Self.localClockHour(model.night.session.endTs))
+        }
+    }
+
+    /// A unix second as a fractional local clock hour — the dial's only input beyond the phase estimate.
+    static func localClockHour(_ ts: Int) -> Double {
+        let c = Calendar.current.dateComponents([.hour, .minute],
+                                                from: Date(timeIntervalSince1970: TimeInterval(ts)))
+        return Double(c.hour ?? 0) + Double(c.minute ?? 0) / 60.0
+    }
+
     /// The compact "Customize" affordance above the arrangeable cards — opens the Arrange sheet. Mirrors
     /// the Today tab's arrange entry and the Android Sleep affordance.
     private var sleepArrangeAffordance: some View {
diff --git a/StrandTests/SleepLayoutPrefsTests.swift b/StrandTests/SleepLayoutPrefsTests.swift
index c492273544..475f574024 100644
--- a/StrandTests/SleepLayoutPrefsTests.swift
+++ b/StrandTests/SleepLayoutPrefsTests.swift
@@ -18,7 +18,9 @@ final class SleepLayoutPrefsTests: XCTestCase {
         ]
         let encoded = SleepLayoutPrefs.encode(reordered)
         XCTAssertEqual(encoded, "nightDetail,sleepMarks,asleepDuration,stages,sleepDebt,stagesVsTypical")
-        XCTAssertEqual(SleepLayoutPrefs.decodeOrder(encoded), reordered)
+        // `bodyClock` is absent from the saved order, so decode inserts it at its default position — the
+        // migration path every newly-added section takes for an existing customised layout.
+        XCTAssertEqual(SleepLayoutPrefs.decodeOrder(encoded), [.bodyClock] + reordered)
     }
 
     /// A saved order that leads with `asleepDuration` and ends on `sleepMarks` keeps those two placements
@@ -28,7 +30,7 @@ final class SleepLayoutPrefsTests: XCTestCase {
         let decoded = SleepLayoutPrefs.decodeOrder("asleepDuration,sleepMarks")
         XCTAssertEqual(decoded.count, SleepSection.allCases.count)
         XCTAssertEqual(decoded, [
-            .stages, .nightDetail, .sleepDebt, .stagesVsTypical, .asleepDuration, .sleepMarks,
+            .stages, .bodyClock, .nightDetail, .sleepDebt, .stagesVsTypical, .asleepDuration, .sleepMarks,
         ])
     }
 
@@ -56,7 +58,7 @@ final class SleepLayoutPrefsTests: XCTestCase {
         let order = "nightDetail,sleepMarks,asleepDuration,stages,sleepDebt,stagesVsTypical"
         XCTAssertEqual(
             SleepLayoutPrefs.visibleOrder(orderRaw: order, hiddenRaw: "asleepDuration,sleepDebt"),
-            [.nightDetail, .sleepMarks, .stages, .stagesVsTypical]
+            [.bodyClock, .nightDetail, .sleepMarks, .stages, .stagesVsTypical]
         )
         XCTAssertEqual(SleepLayoutPrefs.decodeOrder(order).count, SleepSection.allCases.count)
     }
@@ -79,7 +81,8 @@ final class SleepLayoutPrefsTests: XCTestCase {
         XCTAssertEqual(raws.count, Set(raws).count)
         // Pin the exact wire strings — they cross the .noopbak boundary and must match Android byte-for-byte.
         XCTAssertEqual(raws, [
-            "sleepMarks", "stages", "nightDetail", "sleepDebt", "stagesVsTypical", "asleepDuration",
+            "sleepMarks", "stages", "bodyClock", "nightDetail", "sleepDebt", "stagesVsTypical",
+            "asleepDuration",
         ])
     }
 }
diff --git a/android/app/src/main/java/com/noop/analytics/CircadianEngine.kt b/android/app/src/main/java/com/noop/analytics/CircadianEngine.kt
index 59e374cec6..df7214e0a5 100644
--- a/android/app/src/main/java/com/noop/analytics/CircadianEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/CircadianEngine.kt
@@ -290,6 +290,47 @@ object CircadianEngine {
      */
     val chronotypeAnchorHour: Double get() = wrap24(chronotypeReferenceWakeHour - cbtMinBeforeWakeHours)
 
+    /** A chronotype-ideal sleep window on the 24 h clock. Twin of the Swift tuple return. */
+    data class IdealSleepWindow(val bedHour: Double, val wakeHour: Double)
+
+    /**
+     * The chronotype-ideal sleep window for a night of [durationHours], as clock hours.
+     *
+     * Anchored on the temperature minimum: a well-entrained sleeper wakes about [cbtMinBeforeWakeHours]
+     * after CBTmin, so the ideal wake is `tempMinHour + cbtMinBeforeWakeHours` and the ideal bedtime is
+     * that minus the night's own length.
+     *
+     * USING THE ACTUAL DURATION IS THE POINT. Giving the ideal arc the same length as the real one makes
+     * the comparison purely about PHASE — did you sleep at the right TIME — so a short night reads as
+     * aligned-but-short rather than as misaligned. Feeding a "needed" duration instead would fold two
+     * different failures into one arc and make a debt look like a body-clock problem.
+     *
+     * null for a non-positive or impossible duration; a window longer than a day cannot be placed on a
+     * 24 h ring, and silently wrapping it would draw a full circle that means nothing.
+     * Mirrors the Swift twin exactly.
+     */
+    fun idealSleepWindow(tempMinHour: Double, durationHours: Double): IdealSleepWindow? {
+        if (durationHours <= 0.0 || durationHours >= 24.0) return null
+        val wake = wrap24(tempMinHour + cbtMinBeforeWakeHours)
+        return IdealSleepWindow(bedHour = wrap24(wake - durationHours), wakeHour = wake)
+    }
+
+    /**
+     * Signed hours the ACTUAL sleep window sits later (+) or earlier (−) than the chronotype-ideal one.
+     *
+     * Deliberately NOT [PhaseEstimate.offsetVsScheduleMinutes]. That field compares the body clock to the
+     * wearer's own SCHEDULE; this compares the night actually slept to where the CLOCK wanted it. A dial
+     * that draws an actual arc against an ideal arc must caption itself with the distance between those
+     * two arcs, or the number contradicts the picture — the two disagree exactly when someone keeps a
+     * consistent schedule that does not suit their clock, which is the case the dial exists to show.
+     *
+     * Anchored on wake rather than bedtime because [idealSleepWindow] builds the ideal window from the
+     * wake end; comparing bedtimes would fold the night's DURATION into a phase reading.
+     * Mirrors the Swift twin exactly.
+     */
+    fun sleepWindowOffsetHours(tempMinHour: Double, actualWakeHour: Double): Double =
+        signedHourDelta(wrap24(tempMinHour + cbtMinBeforeWakeHours), wrap24(actualWakeHour))
+
     /**
      * Bucket an ABSOLUTE temperature-minimum clock hour into a lean.
      *
diff --git a/android/app/src/main/java/com/noop/ui/BodyClockDialCard.kt b/android/app/src/main/java/com/noop/ui/BodyClockDialCard.kt
new file mode 100644
index 0000000000..dd9b4c3013
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ui/BodyClockDialCard.kt
@@ -0,0 +1,165 @@
+package com.noop.ui
+
+import androidx.compose.foundation.Canvas
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.geometry.Offset
+import androidx.compose.ui.geometry.Size
+import androidx.compose.ui.graphics.drawscope.Stroke
+import androidx.compose.ui.graphics.StrokeCap
+import androidx.compose.ui.semantics.contentDescription
+import androidx.compose.ui.semantics.semantics
+import androidx.compose.ui.unit.dp
+import com.noop.R
+import com.noop.analytics.CircadianEngine
+import kotlin.math.cos
+import kotlin.math.min
+import kotlin.math.roundToInt
+import kotlin.math.sin
+
+// MARK: - 24 h body-clock dial (#1680)
+//
+// Two concentric arcs on one ring: the outer is where the body clock wanted the night, the inner is where
+// it happened. Overlap is the whole message — the card exists so "was last night's timing right" is
+// answerable at a glance, which the text-only BodyClockCard on the Health screen cannot do.
+//
+// VOCABULARY. The caption measures sleepWindowOffsetHours — the distance between the two ARCS DRAWN — and
+// NOT offsetVsScheduleMinutes, which compares the clock to the wearer's habitual schedule and is what the
+// Health card already reports. The two disagree exactly when someone keeps a consistent schedule that does
+// not suit their clock, and that is the case this dial exists to show, so captioning it with the other
+// number would contradict the picture.
+//
+// Nothing here computes a metric: the window, the offset and the chronotype all come from CircadianEngine,
+// byte-identical with the Swift twin. Only the drawing is per-platform (visual parity, not pixel parity).
+
+/**
+ * The dial card. [actualBedHour] / [actualWakeHour] are the night's own clock hours (0..<24, fractional),
+ * taken from the scored session by the caller. Twin of Apple `BodyClockDialCard`.
+ */
+@Composable
+fun BodyClockDialCard(
+    estimate: CircadianEngine.PhaseEstimate,
+    actualBedHour: Double,
+    actualWakeHour: Double,
+) {
+    val hue = Palette.restColor
+    // The night's length, taken the long way round the clock when it crosses midnight.
+    val durationHours = ((actualWakeHour - actualBedHour) % 24.0).let { if (it <= 0.0) it + 24.0 else it }
+    // null exactly when the night's length is non-positive or a full day — the same input that makes
+    // sweepHours wrap to 24 h and draw the actual arc as a complete ring. A full circle with no ideal arc
+    // beside it would state something false about the night, so the card stands down. Mirrors Swift.
+    val ideal = CircadianEngine.idealSleepWindow(estimate.tempMinHour, durationHours) ?: return
+    val offsetHours = CircadianEngine.sleepWindowOffsetHours(estimate.tempMinHour, actualWakeHour)
+    val alignment = alignmentText(offsetHours)
+    val dialLabel = uiString(R.string.l10n_body_clock_dial_card_body_clock_dial_03cdbc31)
+
+    NoopCard(tint = hue) {
+        Column(verticalArrangement = Arrangement.spacedBy(Metrics.gap)) {
+            Row(modifier = Modifier.fillMaxWidth(), verticalAlignment = Alignment.Top) {
+                Column(modifier = Modifier.weight(1f)) {
+                    Overline(uiString(R.string.l10n_body_clock_dial_card_body_clock_b0b9b988))
+                    Text(
+                        uiString(R.string.l10n_body_clock_dial_card_last_night_against_your_clock_9183a37c),
+                        style = NoopType.footnote,
+                        color = Palette.textTertiary,
+                    )
+                }
+            }
+
+            Canvas(
+                modifier = Modifier
+                    .fillMaxWidth()
+                    .height(170.dp)
+                    .semantics { contentDescription = dialLabel },
+            ) {
+                val side = min(size.width, size.height)
+                val centre = Offset(size.width / 2f, size.height / 2f)
+                val outer = side / 2f - 10.dp.toPx()
+                val inner = outer - 16.dp.toPx()
+
+                // The bare ring, so an empty dial still reads as a clock rather than a broken chart.
+                drawCircle(color = Palette.hairline, radius = outer, center = centre,
+                    style = Stroke(width = 1.dp.toPx()))
+
+                // Six-hourly ticks: enough to orient the eye, few enough not to compete with the arcs.
+                var tick = 0.0
+                while (tick < 24.0) {
+                    val a = Math.toRadians(hourAngleDegrees(tick))
+                    drawLine(
+                        color = Palette.textTertiary.copy(alpha = 0.5f),
+                        start = Offset(centre.x + (cos(a) * (outer - 4.dp.toPx())).toFloat(),
+                            centre.y + (sin(a) * (outer - 4.dp.toPx())).toFloat()),
+                        end = Offset(centre.x + (cos(a) * outer).toFloat(),
+                            centre.y + (sin(a) * outer).toFloat()),
+                        strokeWidth = 1.dp.toPx(),
+                    )
+                    tick += 6.0
+                }
+
+                fun arc(radius: Float, from: Double, to: Double, colour: androidx.compose.ui.graphics.Color, width: Float) {
+                    drawArc(
+                        color = colour,
+                        startAngle = hourAngleDegrees(from).toFloat(),
+                        sweepAngle = (sweepHours(from, to) / 24.0 * 360.0).toFloat(),
+                        useCenter = false,
+                        topLeft = Offset(centre.x - radius, centre.y - radius),
+                        size = Size(radius * 2, radius * 2),
+                        style = Stroke(width = width, cap = StrokeCap.Round),
+                    )
+                }
+
+                if (ideal != null) {
+                    arc(outer, ideal.bedHour, ideal.wakeHour, hue.copy(alpha = 0.35f), 8.dp.toPx())
+                }
+                arc(inner, actualBedHour, actualWakeHour, hue, 8.dp.toPx())
+            }
+
+            Text(alignment, style = NoopType.title2, color = Palette.textPrimary)
+
+            CircadianEngine.chronotype(estimate)?.let { c ->
+                Text(chronotypeText(c), style = NoopType.footnote, color = Palette.textTertiary)
+            }
+        }
+    }
+}
+
+/** A unix second as a fractional LOCAL clock hour — the dial's only input beyond the phase estimate. */
+internal fun localClockHour(ts: Long): Double {
+    val c = java.util.Calendar.getInstance()
+    c.timeInMillis = ts * 1000L
+    return c.get(java.util.Calendar.HOUR_OF_DAY) + c.get(java.util.Calendar.MINUTE) / 60.0
+}
+
+/** Midnight at the top, clocking round to the right. Compose's zero angle is at 3 o'clock, hence the −90. */
+internal fun hourAngleDegrees(hour: Double): Double = hour / 24.0 * 360.0 - 90.0
+
+/** Sweep from [from] to [to] clockwise, always positive so an arc crossing midnight still draws. */
+internal fun sweepHours(from: Double, to: Double): Double =
+    ((to - from) % 24.0).let { if (it <= 0.0) it + 24.0 else it }
+
+/**
+ * Rounded to five minutes: the underlying phase is an activity fit, so a to-the-minute caption would imply
+ * a precision the estimate does not carry.
+ */
+@Composable
+private fun alignmentText(offsetHours: Double): String {
+    val minutes = (offsetHours * 60 / 5).roundToInt() * 5
+    if (kotlin.math.abs(minutes) < 30) return uiString(R.string.l10n_body_clock_dial_card_in_sync_with_your_body_clock_4b5181c8)
+    val absMinutes = kotlin.math.abs(minutes)
+    val amount = if (absMinutes >= 60) String.format(java.util.Locale.getDefault(), "%.1f h", absMinutes / 60.0) else "$absMinutes min"
+    return if (minutes > 0) uiString(R.string.l10n_body_clock_dial_card_1_s_later_than_your_body_50b7d966, amount) else uiString(R.string.l10n_body_clock_dial_card_1_s_earlier_than_your_body_68877f50, amount)
+}
+
+@Composable
+private fun chronotypeText(c: CircadianEngine.Chronotype): String = when (c) {
+    CircadianEngine.Chronotype.MORNING -> uiString(R.string.l10n_body_clock_dial_card_morning_type_289dd7bf)
+    CircadianEngine.Chronotype.INTERMEDIATE -> uiString(R.string.l10n_body_clock_dial_card_intermediate_type_a7b6b74c)
+    CircadianEngine.Chronotype.EVENING -> uiString(R.string.l10n_body_clock_dial_card_evening_type_3e1ce111)
+}
diff --git a/android/app/src/main/java/com/noop/ui/SleepLayoutPrefs.kt b/android/app/src/main/java/com/noop/ui/SleepLayoutPrefs.kt
index 7cae1cc2e9..0038534d9a 100644
--- a/android/app/src/main/java/com/noop/ui/SleepLayoutPrefs.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepLayoutPrefs.kt
@@ -27,6 +27,7 @@ import com.noop.R
 enum class SleepSection(val raw: String, val title: String) {
     SLEEP_MARKS("sleepMarks", "Sleep marks"),
     STAGES("stages", "Stages"),
+    BODY_CLOCK("bodyClock", "Body clock"),
     NIGHT_DETAIL("nightDetail", "Night detail"),
     SLEEP_DEBT("sleepDebt", "Sleep-debt ledger"),
     STAGES_VS_TYPICAL("stagesVsTypical", "Stages vs typical"),
@@ -49,7 +50,7 @@ enum class SleepSection(val raw: String, val title: String) {
          *  rides with Stages for now — drawn inside the stages hero; making it an independently arrangeable
          *  card is a follow-up that requires hoisting the hero's edit/delete callbacks.) */
         val defaultOrder: List<SleepSection> = listOf(
-            SLEEP_MARKS, STAGES, NIGHT_DETAIL, SLEEP_DEBT, STAGES_VS_TYPICAL, ASLEEP_DURATION,
+            SLEEP_MARKS, STAGES, BODY_CLOCK, NIGHT_DETAIL, SLEEP_DEBT, STAGES_VS_TYPICAL, ASLEEP_DURATION,
             HOURS_VS_NEEDED, CONSISTENCY,
         )
     }
@@ -65,6 +66,7 @@ enum class SleepSection(val raw: String, val title: String) {
 fun SleepSection.localizedTitle(): String = when (this) {
     SleepSection.SLEEP_MARKS -> stringResource(R.string.l10n_sleep_screen_sleep_marks_8e9b86f0)
     SleepSection.STAGES -> stringResource(R.string.l10n_sleep_screen_stages_c1d33ad5)
+    SleepSection.BODY_CLOCK -> stringResource(R.string.l10n_body_clock_dial_card_body_clock_b0b9b988)
     SleepSection.NIGHT_DETAIL -> stringResource(R.string.l10n_sleep_screen_night_detail_8f271bcf)
     SleepSection.SLEEP_DEBT -> stringResource(R.string.l10n_sleep_screen_sleep_debt_ledger_8cc9a992)
     SleepSection.STAGES_VS_TYPICAL -> stringResource(R.string.l10n_sleep_screen_stages_vs_typical_28463f24)
diff --git a/android/app/src/main/java/com/noop/ui/SleepScreen.kt b/android/app/src/main/java/com/noop/ui/SleepScreen.kt
index 7dd933d800..3994e2df6a 100644
--- a/android/app/src/main/java/com/noop/ui/SleepScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepScreen.kt
@@ -71,6 +71,7 @@ import androidx.compose.ui.unit.Dp
 import androidx.compose.ui.unit.dp
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import com.noop.analytics.AnalyticsEngine
+import com.noop.analytics.CircadianEngine
 import com.noop.analytics.SleepEditGuard
 import com.noop.analytics.SleepGroupEdit
 import com.noop.analytics.SleepStageTotals
@@ -127,6 +128,9 @@ fun SleepScreen(
     // the sleep surfaces name a ring-PROVIDED night's provenance "Oura" and flag its split as the ring's
     // RAW on-device stages. Read/UI only, no stored value. Mirrors macOS Repository.activeDeviceIsOura.
     val activeIsOura = com.noop.data.DeviceBrandCatalog.isOura(vm.activeStrapId)
+    // #1680: the body-clock phase behind the 24 h dial section. Same snapshot the Health screen reads for
+    // BodyClockCard, so the two surfaces cannot disagree about the estimate.
+    val v5Signals by vm.v5Signals.collectAsStateWithLifecycle()
 
     // PERF (#scroll-jank): the BLE live state ticks ~1Hz. This screen reads `live` ONLY for the
     // "syncing history" note (backfilling + the chunk count), so reading the whole `live` object at
@@ -749,6 +753,32 @@ fun SleepScreen(
                 // selected day's model failed to build, exactly as iOS keeps them while browsing. Each
                 // `tilesModel?.let { m -> ... }` binds a non-null local so the smart-cast carries across
                 // the item {} lambda boundary — same guard the old `if (tilesModel != null)` block used.
+                // The 24 h body-clock dial (#1680). Drawn only for a fit that is at least WIDE: an
+                // UNREADABLE rhythm has no phase to compare a night against, and an empty ring would read
+                // as a broken chart rather than as "not enough data". It is a reorderable Sleep section,
+                // so anyone who does not want it hides it in Arrange — the same affordance every other
+                // card here already has, rather than a setting of its own. Mirrors SleepView.
+                SleepSection.BODY_CLOCK -> {
+                    val phase = v5Signals?.bodyClock
+                    val session = night?.session
+                    if (phase != null &&
+                        phase.confidence != CircadianEngine.PhaseConfidence.UNREADABLE &&
+                        session != null
+                    ) {
+                        item(key = k) {
+                            SleepReorderableSection(k, sleepListState, sleepSectionDrag, persistSleepOrder) {
+                                Column {
+                                    Spacer(Modifier.height(Metrics.selectorTopUp))
+                                    BodyClockDialCard(
+                                        estimate = phase,
+                                        actualBedHour = localClockHour(session.effectiveStartTs),
+                                        actualWakeHour = localClockHour(session.endTs),
+                                    )
+                                }
+                            }
+                        }
+                    }
+                }
                 SleepSection.NIGHT_DETAIL -> tilesModel?.let { m ->
                     item(key = k) {
                         SleepReorderableSection(k, sleepListState, sleepSectionDrag, persistSleepOrder) {
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 114ed45fd2..8cc4d03c77 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2562,4 +2562,13 @@
     <string name="crash_recovery_body">Der letzte Absturz wird unten angezeigt. Du kannst ihn für einen Fehlerbericht kopieren und danach erneut versuchen, die App zu öffnen.</string>
     <string name="crash_recovery_copy">Fehler kopieren</string>
     <string name="crash_recovery_continue">NOOP erneut öffnen</string>
+    <string name="l10n_body_clock_dial_card_body_clock_b0b9b988">Innere Uhr</string>
+    <string name="l10n_body_clock_dial_card_last_night_against_your_clock_9183a37c">Letzte Nacht im Vergleich zu deiner inneren Uhr</string>
+    <string name="l10n_body_clock_dial_card_in_sync_with_your_body_clock_4b5181c8">Im Einklang mit deiner inneren Uhr</string>
+    <string name="l10n_body_clock_dial_card_1_s_later_than_your_body_50b7d966">%1$s später als deine innere Uhr</string>
+    <string name="l10n_body_clock_dial_card_1_s_earlier_than_your_body_68877f50">%1$s früher als deine innere Uhr</string>
+    <string name="l10n_body_clock_dial_card_morning_type_289dd7bf">Morgentyp</string>
+    <string name="l10n_body_clock_dial_card_intermediate_type_a7b6b74c">Mischtyp</string>
+    <string name="l10n_body_clock_dial_card_evening_type_3e1ce111">Abendtyp</string>
+    <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Zifferblatt der inneren Uhr</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index b1fa136941..afbb107de8 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2548,4 +2548,13 @@
     <string name="crash_recovery_body">El último fallo aparece abajo. Puedes copiarlo para informar del error y volver a intentar abrir la aplicación.</string>
     <string name="crash_recovery_copy">Copiar error</string>
     <string name="crash_recovery_continue">Intentar abrir NOOP</string>
+    <string name="l10n_body_clock_dial_card_body_clock_b0b9b988">Reloj interno</string>
+    <string name="l10n_body_clock_dial_card_last_night_against_your_clock_9183a37c">Anoche frente a tu reloj interno</string>
+    <string name="l10n_body_clock_dial_card_in_sync_with_your_body_clock_4b5181c8">En sintonía con tu reloj interno</string>
+    <string name="l10n_body_clock_dial_card_1_s_later_than_your_body_50b7d966">%1$s más tarde que tu reloj interno</string>
+    <string name="l10n_body_clock_dial_card_1_s_earlier_than_your_body_68877f50">%1$s más temprano que tu reloj interno</string>
+    <string name="l10n_body_clock_dial_card_morning_type_289dd7bf">Tipo matutino</string>
+    <string name="l10n_body_clock_dial_card_intermediate_type_a7b6b74c">Tipo intermedio</string>
+    <string name="l10n_body_clock_dial_card_evening_type_3e1ce111">Tipo vespertino</string>
+    <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Esfera del reloj interno</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index b971d2bf06..183f4000cd 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2547,4 +2547,13 @@
     <string name="crash_recovery_body">Le dernier plantage est affiché ci-dessous. Vous pouvez le copier pour un rapport, puis réessayer d’ouvrir l’application.</string>
     <string name="crash_recovery_copy">Copier l’erreur</string>
     <string name="crash_recovery_continue">Réessayer d’ouvrir NOOP</string>
+    <string name="l10n_body_clock_dial_card_body_clock_b0b9b988">Horloge biologique</string>
+    <string name="l10n_body_clock_dial_card_last_night_against_your_clock_9183a37c">La nuit dernière face à votre horloge</string>
+    <string name="l10n_body_clock_dial_card_in_sync_with_your_body_clock_4b5181c8">En phase avec votre horloge biologique</string>
+    <string name="l10n_body_clock_dial_card_1_s_later_than_your_body_50b7d966">%1$s plus tard que votre horloge biologique</string>
+    <string name="l10n_body_clock_dial_card_1_s_earlier_than_your_body_68877f50">%1$s plus tôt que votre horloge biologique</string>
+    <string name="l10n_body_clock_dial_card_morning_type_289dd7bf">Type matinal</string>
+    <string name="l10n_body_clock_dial_card_intermediate_type_a7b6b74c">Type intermédiaire</string>
+    <string name="l10n_body_clock_dial_card_evening_type_3e1ce111">Type vespéral</string>
+    <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Cadran de l\'horloge biologique</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 625efd6959..46df3c792e 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2553,4 +2553,13 @@
     <string name="crash_recovery_body">Poniżej znajduje się ostatni błąd. Możesz go skopiować do zgłoszenia, a następnie spróbować ponownie otworzyć aplikację.</string>
     <string name="crash_recovery_copy">Kopiuj błąd</string>
     <string name="crash_recovery_continue">Spróbuj otworzyć NOOP</string>
+    <string name="l10n_body_clock_dial_card_body_clock_b0b9b988">Zegar biologiczny</string>
+    <string name="l10n_body_clock_dial_card_last_night_against_your_clock_9183a37c">Ostatnia noc a Twój zegar biologiczny</string>
+    <string name="l10n_body_clock_dial_card_in_sync_with_your_body_clock_4b5181c8">Zgodnie z zegarem biologicznym</string>
+    <string name="l10n_body_clock_dial_card_1_s_later_than_your_body_50b7d966">%1$s później niż Twój zegar biologiczny</string>
+    <string name="l10n_body_clock_dial_card_1_s_earlier_than_your_body_68877f50">%1$s wcześniej niż Twój zegar biologiczny</string>
+    <string name="l10n_body_clock_dial_card_morning_type_289dd7bf">Typ poranny</string>
+    <string name="l10n_body_clock_dial_card_intermediate_type_a7b6b74c">Typ pośredni</string>
+    <string name="l10n_body_clock_dial_card_evening_type_3e1ce111">Typ wieczorny</string>
+    <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Tarcza zegara biologicznego</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 28cbb2ad93..4b45802e62 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2541,4 +2541,13 @@
     <string name="crash_recovery_body">A última falha aparece abaixo. Podes copiá-la para um relatório e voltar a tentar abrir a aplicação.</string>
     <string name="crash_recovery_copy">Copiar erro</string>
     <string name="crash_recovery_continue">Tentar abrir o NOOP</string>
+    <string name="l10n_body_clock_dial_card_body_clock_b0b9b988">Relógio biológico</string>
+    <string name="l10n_body_clock_dial_card_last_night_against_your_clock_9183a37c">A noite passada face ao seu relógio</string>
+    <string name="l10n_body_clock_dial_card_in_sync_with_your_body_clock_4b5181c8">Em sintonia com o seu relógio biológico</string>
+    <string name="l10n_body_clock_dial_card_1_s_later_than_your_body_50b7d966">%1$s mais tarde do que o seu relógio biológico</string>
+    <string name="l10n_body_clock_dial_card_1_s_earlier_than_your_body_68877f50">%1$s mais cedo do que o seu relógio biológico</string>
+    <string name="l10n_body_clock_dial_card_morning_type_289dd7bf">Tipo matutino</string>
+    <string name="l10n_body_clock_dial_card_intermediate_type_a7b6b74c">Tipo intermédio</string>
+    <string name="l10n_body_clock_dial_card_evening_type_3e1ce111">Tipo vespertino</string>
+    <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Mostrador do relógio biológico</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 25b1396b8a..1fb717cb8f 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2462,4 +2462,13 @@
     <string name="crash_recovery_body">上次崩溃信息显示在下方。你可以复制它用于错误报告，然后再次尝试打开应用。</string>
     <string name="crash_recovery_copy">复制错误</string>
     <string name="crash_recovery_continue">再次打开 NOOP</string>
+    <string name="l10n_body_clock_dial_card_body_clock_b0b9b988">生物钟</string>
+    <string name="l10n_body_clock_dial_card_last_night_against_your_clock_9183a37c">昨夜与你的生物钟对比</string>
+    <string name="l10n_body_clock_dial_card_in_sync_with_your_body_clock_4b5181c8">与生物钟同步</string>
+    <string name="l10n_body_clock_dial_card_1_s_later_than_your_body_50b7d966">比生物钟晚 %1$s</string>
+    <string name="l10n_body_clock_dial_card_1_s_earlier_than_your_body_68877f50">比生物钟早 %1$s</string>
+    <string name="l10n_body_clock_dial_card_morning_type_289dd7bf">晨型人</string>
+    <string name="l10n_body_clock_dial_card_intermediate_type_a7b6b74c">中间型</string>
+    <string name="l10n_body_clock_dial_card_evening_type_3e1ce111">夜型人</string>
+    <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">生物钟表盘</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index b65532a0ea..5d3f7e1c99 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2575,4 +2575,13 @@
     <string name="crash_recovery_body">The last crash is shown below. You can copy it for a bug report, then try opening the app again.</string>
     <string name="crash_recovery_copy">Copy error</string>
     <string name="crash_recovery_continue">Try opening NOOP</string>
+    <string name="l10n_body_clock_dial_card_body_clock_b0b9b988">Body clock</string>
+    <string name="l10n_body_clock_dial_card_last_night_against_your_clock_9183a37c">Last night against your clock</string>
+    <string name="l10n_body_clock_dial_card_in_sync_with_your_body_clock_4b5181c8">In sync with your body clock</string>
+    <string name="l10n_body_clock_dial_card_1_s_later_than_your_body_50b7d966">%1$s later than your body clock</string>
+    <string name="l10n_body_clock_dial_card_1_s_earlier_than_your_body_68877f50">%1$s earlier than your body clock</string>
+    <string name="l10n_body_clock_dial_card_morning_type_289dd7bf">Morning type</string>
+    <string name="l10n_body_clock_dial_card_intermediate_type_a7b6b74c">Intermediate type</string>
+    <string name="l10n_body_clock_dial_card_evening_type_3e1ce111">Evening type</string>
+    <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Body clock dial</string>
 </resources>
diff --git a/android/app/src/test/java/com/noop/analytics/CircadianEngineTest.kt b/android/app/src/test/java/com/noop/analytics/CircadianEngineTest.kt
index b10ac5766d..af18708618 100644
--- a/android/app/src/test/java/com/noop/analytics/CircadianEngineTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/CircadianEngineTest.kt
@@ -217,4 +217,96 @@ class CircadianEngineTest {
         )
         assertEquals(CircadianEngine.Chronotype.EVENING, CircadianEngine.chronotype(alignedButLate))
     }
+
+    /**
+     * VERBATIM stdout of the Swift twin compiled standalone. Format:
+     * label|tempMinHour|durationHours|bedHour|wakeHour ("nil" for a rejected duration).
+     *
+     * `typical` is the row that says the model is sane: a 04:30 temperature minimum and an 8 h night put
+     * the ideal window at 23:00-07:00. The wrap rows matter because the ideal bedtime routinely lands on
+     * the PREVIOUS day, so a subtraction without wrap24 would place it at a negative hour.
+     */
+    private val idealWindowOracle = """
+        typical|4.5|8.0|23.0|7.0
+        short-night|4.5|5.0|2.0|7.0
+        long-night|4.5|10.0|21.0|7.0
+        evening-type|7.0|8.0|1.5|9.5
+        morning-type|2.0|8.0|20.5|4.5
+        wrap-past-midnight|1.0|8.0|19.5|3.5
+        tempmin-late-evening|23.0|8.0|17.5|1.5
+        duration-just-under-24|4.5|23.9|7.100000000000001|7.0
+        zero-duration|4.5|0.0|nil|nil
+        negative-duration|4.5|-1.0|nil|nil
+        24h-duration|4.5|24.0|nil|nil
+    """.trimIndent()
+
+    @Test
+    fun idealSleepWindowMatchesTheSwiftOracleExactly() {
+        for (row in idealWindowOracle.lines().map { it.trim() }.filter { it.isNotEmpty() }) {
+            val parts = row.split("|")
+            val (label, tempText, durText) = Triple(parts[0], parts[1], parts[2])
+            val w = CircadianEngine.idealSleepWindow(tempText.toDouble(), durText.toDouble())
+            if (parts[3] == "nil") {
+                assertNull("$label: an impossible duration cannot be placed on the ring", w)
+            } else {
+                assertEquals("$label: bed hour", parts[3].toDouble(), w!!.bedHour, 0.0)
+                assertEquals("$label: wake hour", parts[4].toDouble(), w.wakeHour, 0.0)
+            }
+        }
+    }
+
+    /**
+     * The ideal arc takes the night's OWN length, so the dial compares PHASE alone. A short night and a
+     * long one on the same body clock share a wake time and differ only in where the arc starts — which
+     * is what keeps a sleep DEBT from rendering as a body-clock problem.
+     */
+    @Test
+    fun idealWindowSharesTheWakeAnchorAcrossDurations() {
+        val short = CircadianEngine.idealSleepWindow(4.5, 5.0)!!
+        val long = CircadianEngine.idealSleepWindow(4.5, 10.0)!!
+        assertEquals("both nights wake at the same clock time", short.wakeHour, long.wakeHour, 0.0)
+        assertTrue("only the bedtime moves", short.bedHour != long.bedHour)
+    }
+
+    /**
+     * The dial's caption quantity: how far the night actually slept sits from where the CLOCK wanted it.
+     * Verbatim Swift stdout. Format: label|tempMinHour|actualWakeHour|offsetHours.
+     *
+     * `wrap-late` is the row that earns its place — a 23:00 temperature minimum puts the ideal wake at
+     * 01:30, so waking at 02:30 is one hour LATE, not twenty-three hours early.
+     */
+    @Test
+    fun sleepWindowOffsetMatchesTheSwiftOracleExactly() {
+        val oracle = """
+            on-time|4.5|7.0|0.0
+            late-1h|4.5|8.0|1.0
+            early-1h|4.5|6.0|-1.0
+            wrap-late|23.0|2.5|1.0
+            wrap-early|1.0|23.0|-4.5
+            antipode|4.5|19.0|12.0
+        """.trimIndent()
+        for (row in oracle.lines().map { it.trim() }.filter { it.isNotEmpty() }) {
+            val p = row.split("|")
+            assertEquals("${p[0]}: offset hours", p[3].toDouble(),
+                CircadianEngine.sleepWindowOffsetHours(p[1].toDouble(), p[2].toDouble()), 0.0)
+        }
+    }
+
+    /**
+     * The dial's caption and the card's existing headline measure DIFFERENT things and must not be
+     * conflated: a consistent late sleeper is well-aligned with their own schedule (offset ~0) while
+     * sleeping hours away from what their clock wants. Pinned so the two never get merged by a refactor.
+     */
+    @Test
+    fun windowOffsetAndScheduleOffsetAreDifferentQuantities() {
+        // body clock at 08:00, so the clock wants a 10:30 wake; this sleeper wakes at 06:30.
+        val windowOffset = CircadianEngine.sleepWindowOffsetHours(tempMinHour = 8.0, actualWakeHour = 6.5)
+        assertEquals(-4.0, windowOffset, 1e-12)
+        val scheduleAligned = CircadianEngine.PhaseEstimate(
+            tempMinHour = 8.0, acrophaseHours = 20.0, offsetVsScheduleMinutes = 0.0,
+            confidence = CircadianEngine.PhaseConfidence.SOLID, note = "",
+        )
+        assertEquals("schedule-relative reads aligned", 0.0, scheduleAligned.offsetVsScheduleMinutes, 0.0)
+        assertTrue("while the clock-relative read is hours away", kotlin.math.abs(windowOffset) > 1.0)
+    }
 }
diff --git a/android/app/src/test/java/com/noop/ui/SleepLayoutPrefsTest.kt b/android/app/src/test/java/com/noop/ui/SleepLayoutPrefsTest.kt
index c549d9455d..124d2039d5 100644
--- a/android/app/src/test/java/com/noop/ui/SleepLayoutPrefsTest.kt
+++ b/android/app/src/test/java/com/noop/ui/SleepLayoutPrefsTest.kt
@@ -22,12 +22,12 @@ class SleepLayoutPrefsTest {
     @Test
     fun encodeDecode_roundTripsAReorderedList() {
         val reordered = listOf(
-            SleepSection.NIGHT_DETAIL, SleepSection.SLEEP_MARKS, SleepSection.ASLEEP_DURATION,
+            SleepSection.BODY_CLOCK, SleepSection.NIGHT_DETAIL, SleepSection.SLEEP_MARKS, SleepSection.ASLEEP_DURATION,
             SleepSection.STAGES, SleepSection.SLEEP_DEBT, SleepSection.STAGES_VS_TYPICAL,
             SleepSection.HOURS_VS_NEEDED, SleepSection.CONSISTENCY,
         )
         val encoded = SleepLayoutPrefs.encode(reordered)
-        assertEquals("nightDetail,sleepMarks,asleepDuration,stages,sleepDebt,stagesVsTypical,hoursVsNeeded,consistency", encoded)
+        assertEquals("bodyClock,nightDetail,sleepMarks,asleepDuration,stages,sleepDebt,stagesVsTypical,hoursVsNeeded,consistency", encoded)
         assertEquals(reordered, SleepLayoutPrefs.decodeOrder(encoded))
     }
 
@@ -40,7 +40,7 @@ class SleepLayoutPrefsTest {
         assertEquals(SleepSection.entries.size, decoded.size)
         assertEquals(
             listOf(
-                SleepSection.STAGES, SleepSection.NIGHT_DETAIL, SleepSection.SLEEP_DEBT,
+                SleepSection.STAGES, SleepSection.BODY_CLOCK, SleepSection.NIGHT_DETAIL, SleepSection.SLEEP_DEBT,
                 SleepSection.STAGES_VS_TYPICAL, SleepSection.ASLEEP_DURATION, SleepSection.SLEEP_MARKS,
                 SleepSection.HOURS_VS_NEEDED, SleepSection.CONSISTENCY,
             ),
@@ -76,7 +76,7 @@ class SleepLayoutPrefsTest {
         val order = "nightDetail,sleepMarks,asleepDuration,stages,sleepDebt,stagesVsTypical"
         assertEquals(
             listOf(
-                SleepSection.NIGHT_DETAIL, SleepSection.SLEEP_MARKS, SleepSection.STAGES,
+                SleepSection.BODY_CLOCK, SleepSection.NIGHT_DETAIL, SleepSection.SLEEP_MARKS, SleepSection.STAGES,
                 SleepSection.STAGES_VS_TYPICAL, SleepSection.HOURS_VS_NEEDED, SleepSection.CONSISTENCY,
             ),
             SleepLayoutPrefs.visibleOrder(order, "asleepDuration,sleepDebt"),
@@ -105,7 +105,7 @@ class SleepLayoutPrefsTest {
         assertEquals("raw keys must be unique (they're the persisted identity)", raws.size, raws.toSet().size)
         // Pin the exact wire strings — they cross the .noopbak boundary and must match macOS byte-for-byte.
         assertEquals(
-            listOf("sleepMarks", "stages", "nightDetail", "sleepDebt", "stagesVsTypical", "asleepDuration", "hoursVsNeeded", "consistency"),
+            listOf("sleepMarks", "stages", "bodyClock", "nightDetail", "sleepDebt", "stagesVsTypical", "asleepDuration", "hoursVsNeeded", "consistency"),
             raws,
         )
     }
diff --git a/android/app/src/test/java/com/noop/ui/SleepSectionReorderTest.kt b/android/app/src/test/java/com/noop/ui/SleepSectionReorderTest.kt
index c31d7cf1b7..7beb24571c 100644
--- a/android/app/src/test/java/com/noop/ui/SleepSectionReorderTest.kt
+++ b/android/app/src/test/java/com/noop/ui/SleepSectionReorderTest.kt
@@ -1,6 +1,7 @@
 package com.noop.ui
 
 import com.noop.ui.SleepSection.ASLEEP_DURATION
+import com.noop.ui.SleepSection.BODY_CLOCK
 import com.noop.ui.SleepSection.CONSISTENCY
 import com.noop.ui.SleepSection.HOURS_VS_NEEDED
 import com.noop.ui.SleepSection.NIGHT_DETAIL
@@ -24,14 +25,14 @@ class SleepSectionReorderTest {
 
     @Test fun movingDownPlacesTheCardAtTheTargetsSlot() {
         assertEquals(
-            listOf(STAGES, NIGHT_DETAIL, SLEEP_MARKS, SLEEP_DEBT, STAGES_VS_TYPICAL, ASLEEP_DURATION, HOURS_VS_NEEDED, CONSISTENCY),
+            listOf(STAGES, BODY_CLOCK, NIGHT_DETAIL, SLEEP_MARKS, SLEEP_DEBT, STAGES_VS_TYPICAL, ASLEEP_DURATION, HOURS_VS_NEEDED, CONSISTENCY),
             order.movedSleepSection(SLEEP_MARKS, NIGHT_DETAIL),
         )
     }
 
     @Test fun movingUpPlacesTheCardAtTheTargetsSlot() {
         assertEquals(
-            listOf(SLEEP_MARKS, ASLEEP_DURATION, STAGES, NIGHT_DETAIL, SLEEP_DEBT, STAGES_VS_TYPICAL, HOURS_VS_NEEDED, CONSISTENCY),
+            listOf(SLEEP_MARKS, ASLEEP_DURATION, STAGES, BODY_CLOCK, NIGHT_DETAIL, SLEEP_DEBT, STAGES_VS_TYPICAL, HOURS_VS_NEEDED, CONSISTENCY),
             order.movedSleepSection(ASLEEP_DURATION, STAGES),
         )
     }

From 3644320901f9c5c9a7d89aaaa34221b3c9055171 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 19:32:55 +1200
Subject: [PATCH 055/333] Don't greet an upgrade with a crash from the build it
 replaced (#1724)

Found in the field: a staging build that had NOT crashed opened straight onto "NOOP stopped unexpectedly", showing a crash dated 53 days earlier.

CrashCapture has written last_crash.txt since 2026-06-13; the recovery screen from #1718 landed on 2026-08-29, and the acknowledgement fingerprint it compares against did not exist before it. So the first launch after upgrading read an old crash file as unacknowledged and opened on the recovery screen for something the user lived through weeks ago and has since replaced the build over. Corroborated by the previous staging build, cut twelve minutes BEFORE that screen merged, running fine on the same device with the same file already on disk.

pendingCrash now compares the crash file's mtime against the package's lastUpdateTime and skips anything written before the current install.

The file is deliberately NOT deleted. The strap log and test bundle still carry it, and the stale crash this surfaced turned out to be the obfuscated R8 trace build.gradle.kts has been asking for since minification was switched off - CompositionLocal LocalLifecycleOwner not present at OnboardingScreenKt.OnboardingScreen, right after the terms gate exactly as that comment predicts. Clearing old crashes on upgrade would have destroyed the evidence.

Fails toward SHOWING: an unknown timestamp on either side keeps the previous behaviour, because the screen exists to report crashes and a stale one is a smaller failure than swallowing a real one. Both directions pinned, including a crash written at exactly the install instant, which is kept.

Android-only, like the rest of CrashCapture. Android 4761 pass, checks 4/4.
---
 .../src/main/java/com/noop/CrashCapture.kt    | 28 ++++++++++++++++--
 .../test/java/com/noop/CrashCaptureTest.kt    | 29 +++++++++++++++++++
 2 files changed, 55 insertions(+), 2 deletions(-)

diff --git a/android/app/src/main/java/com/noop/CrashCapture.kt b/android/app/src/main/java/com/noop/CrashCapture.kt
index 57c2351be6..6924b11967 100644
--- a/android/app/src/main/java/com/noop/CrashCapture.kt
+++ b/android/app/src/main/java/com/noop/CrashCapture.kt
@@ -64,9 +64,18 @@ object CrashCapture {
      * yields null and normal startup proceeds.
      */
     fun pendingCrash(context: Context): String? = runCatching {
+        val app = context.applicationContext
         val crash = lastCrash(context) ?: return@runCatching null
-        val acknowledged = context.applicationContext
-            .getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+        // A crash from a build the user has already replaced is not news. The capture handler has written
+        // this file since June while the screen that surfaces it landed in August, so on the first launch
+        // after upgrading, every install carrying an old crash would open on "NOOP stopped unexpectedly"
+        // for something survived weeks earlier — which is how this was found: a 53-day-old crash greeted a
+        // staging build that had not crashed at all.
+        val lastUpdate = runCatching {
+            app.packageManager.getPackageInfo(app.packageName, 0).lastUpdateTime
+        }.getOrDefault(0L)
+        if (isPreUpgradeCrash(File(app.filesDir, FILE).lastModified(), lastUpdate)) return@runCatching null
+        val acknowledged = app.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
             .getString(ACKNOWLEDGED, null)
         crash.takeIf { isPending(fingerprint(it), acknowledged) }
     }.getOrNull()
@@ -86,6 +95,21 @@ object CrashCapture {
         }
     }
 
+    /**
+     * Whether a stored crash belongs to a build the user is no longer running.
+     *
+     * `lastUpdateTime` is when this APK was installed or updated, so a crash file older than it was
+     * written by a version that has since been replaced. The file is NOT deleted — the strap log and the
+     * test bundle still carry it, which is exactly how the long-standing R8 minification crash trace was
+     * recovered — it simply stops opening the app on a recovery screen.
+     *
+     * Fails toward SHOWING. If either timestamp is unknown (0), this returns false and the crash surfaces
+     * as before: the screen exists to report crashes, so an occasional stale one is a smaller failure than
+     * silently swallowing a real one. The acknowledgement fingerprint still caps that at a single screen.
+     */
+    internal fun isPreUpgradeCrash(crashModifiedMs: Long, lastUpdateMs: Long): Boolean =
+        crashModifiedMs > 0L && lastUpdateMs > 0L && crashModifiedMs < lastUpdateMs
+
     internal fun isPending(fingerprint: String, acknowledged: String?) = fingerprint != acknowledged
 
     internal fun fingerprint(text: String): String = MessageDigest.getInstance("SHA-256")
diff --git a/android/app/src/test/java/com/noop/CrashCaptureTest.kt b/android/app/src/test/java/com/noop/CrashCaptureTest.kt
index 949ffc5f0d..d62a124371 100644
--- a/android/app/src/test/java/com/noop/CrashCaptureTest.kt
+++ b/android/app/src/test/java/com/noop/CrashCaptureTest.kt
@@ -66,4 +66,33 @@ class CrashCaptureTest {
         assertFalse("a full MAC must not survive to the clipboard", shown.contains("FD:12:34:56:78:9A"))
         assertTrue("and the masked shape is what the rest of the export uses", shown.contains("••"))
     }
+
+    // ---- pre-upgrade suppression ----
+
+    /**
+     * The capture handler has written last_crash.txt since June; the screen that surfaces it landed in
+     * August. Without this gate, the first launch after upgrading opened on "NOOP stopped unexpectedly"
+     * for a crash survived weeks earlier — found in the field on a staging build that had not crashed at
+     * all, showing a 53-day-old file.
+     */
+    @Test fun aCrashWrittenBeforeTheCurrentInstallIsNotSurfaced() {
+        val installed = 1_700_000_000_000L
+        assertTrue("a crash from the replaced build is not news",
+            CrashCapture.isPreUpgradeCrash(crashModifiedMs = installed - 1, lastUpdateMs = installed))
+        assertFalse("a crash from the build in use IS news",
+            CrashCapture.isPreUpgradeCrash(crashModifiedMs = installed + 1, lastUpdateMs = installed))
+        assertFalse("a crash written exactly at install time is kept — the boundary belongs to the new build",
+            CrashCapture.isPreUpgradeCrash(crashModifiedMs = installed, lastUpdateMs = installed))
+    }
+
+    /**
+     * Fails toward SHOWING. The screen exists to report crashes, so an occasional stale one is a smaller
+     * failure than silently swallowing a real one, and the acknowledgement fingerprint caps it at a single
+     * screen either way.
+     */
+    @Test fun anUnknownTimestampKeepsTheOldBehaviour() {
+        assertFalse("no install time -> show", CrashCapture.isPreUpgradeCrash(1_000L, 0L))
+        assertFalse("no crash mtime -> show", CrashCapture.isPreUpgradeCrash(0L, 1_000L))
+        assertFalse("neither known -> show", CrashCapture.isPreUpgradeCrash(0L, 0L))
+    }
 }

From 911a02c009986ae1b9e5488766d015e4dfa3dc58 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 19:40:23 +1200
Subject: [PATCH 056/333] Bump build numbers for the next 10.6.1 staging build

versionCode 376 -> 377, CURRENT_PROJECT_VERSION 257 -> 258. MARKETING_VERSION
and versionName stay at 10.6.1: bumping those would pre-bump the next real
release and make fork-release skip appchangelog generation.

The 2026-08-29 06:43 staging cut went out at 376, the same number the previous
one carried, because the bump was read as optional. It installs either way -
matching versionCode is a reinstall, not a downgrade - but two staging builds
were left indistinguishable on-device. This restores the one-bump-per-cut
practice.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index a3e9d0c0fc..5b70226b8a 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 376
+        versionCode = 377
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index ffe7c970c4..ff24f0ff1b 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "257"
+    CURRENT_PROJECT_VERSION: "258"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From fd1a26883d64536afc7ff5181191f74bf45e1fc5 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 20:30:35 +1200
Subject: [PATCH 057/333] Report the body clock's inputs in the diagnostics
 (#1726)

A device had no body-clock card on Health and no dial on Sleep, and there was no way to say why. Tracing it by hand established the estimate was null rather than low-confidence, but not WHICH input was short - and nothing in the strap log or Test Centre reported any of them.

Adds a "Body clock inputs" section to the dynamic diagnostics: source id and window, raw bucket count, distinct populated local hours, days observed, and a verdict naming the failing gate.

The verdict earns its place because the card vanishing has two causes that look identical from outside. Below the bucket floor (24 hourly HR buckets in 14 days) or the hour floor (6 distinct local hours) there is NO estimate and HealthScreen's ?.let skips the card. A thin history or a flat rhythm still returns an estimate marked UNREADABLE, which DOES draw a card with its own "hard to read right now" copy. Same blank space, opposite causes.

Hours and days are counted from the RAW buckets rather than from circadianBinsFrom, which short-circuits to empty below the bucket floor - reporting its zeros would print "hours: 0, days: 0" for a device with plenty of both that sits one bucket under the floor, hiding the numbers the line exists to show.

No thresholds changed. Which gate is short, and by how much, is exactly what is not known yet, and CircadianEngine.minRelativeAmplitude already states this project's position on re-tuning an unvalidated candidate.

Android-only, deliberately: the Swift twin's binning lives inline in AppModel.computeCircadianPhase rather than a reusable helper, so mirroring it means extracting that first.

Android 4766 pass. Verdict wording is pure and unit-tested across five cases including an unmeasurable amplitude that must not read as too flat; the store read stays in the Context wrapper.
---
 .../com/noop/testcentre/AndroidDiagnostics.kt | 77 ++++++++++++++++++-
 .../noop/testcentre/CircadianVerdictTest.kt   | 54 +++++++++++++
 2 files changed, 130 insertions(+), 1 deletion(-)
 create mode 100644 android/app/src/test/java/com/noop/testcentre/CircadianVerdictTest.kt

diff --git a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
index 69ba10f20b..c1edf42b07 100644
--- a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
@@ -416,9 +416,84 @@ object AndroidDiagnostics {
     suspend fun dynamicLines(context: Context): List<String> =
         kotlinx.coroutines.withContext(kotlinx.coroutines.Dispatchers.Default) {
             strapAndDataLines(context) + funnelLines(context) + workoutSourceLines(context) +
-                dailyDataLines(context) + alarmLines(context)
+                dailyDataLines(context) + alarmLines(context) + circadianLines(context)
         }
 
+    /** Hourly HR buckets over the 14-day window below which the profile is not pooled at all. Mirrors
+     *  `circadianBinsFrom`'s own floor — kept here so the diagnostic names the real number, not a guess. */
+    internal const val CIRCADIAN_MIN_BUCKETS = 24
+    /** Distinct populated local hours below which no estimate is attempted. Mirrors
+     *  `V5HealthSignals.MIN_CIRCADIAN_BINS`. */
+    internal const val CIRCADIAN_MIN_HOURS = 6
+
+    /**
+     * Which gate the body clock is failing, in the order the pipeline applies them.
+     *
+     * The card vanishes for two DIFFERENT reasons that look identical on screen: below the bucket floor
+     * or the hour floor there is NO estimate at all (`V5HealthSignals` returns null and the card's `?.let`
+     * skips it), while a thin or flat fit still returns an estimate marked UNREADABLE, which DOES draw a
+     * card with its own copy. Without this line those are indistinguishable from the outside — the report
+     * that prompted it had a body clock missing on both the Health card and the Sleep dial with no way to
+     * say which floor was short.
+     *
+     * Pure so the wording is assertable without a store, matching `noCaptureMsgText`.
+     */
+    internal fun circadianVerdict(
+        buckets: Int,
+        populatedHours: Int,
+        daysObserved: Int,
+        relativeAmplitude: Double?,
+    ): String = when {
+        buckets < CIRCADIAN_MIN_BUCKETS ->
+            "no estimate — $buckets hourly HR buckets in 14d, needs $CIRCADIAN_MIN_BUCKETS"
+        populatedHours < CIRCADIAN_MIN_HOURS ->
+            "no estimate — HR lands in $populatedHours of 24 local hours, needs $CIRCADIAN_MIN_HOURS"
+        relativeAmplitude != null &&
+            relativeAmplitude < com.noop.analytics.CircadianEngine.minRelativeAmplitude ->
+            "unreadable — rhythm too flat (amplitude ${"%.1f".format(relativeAmplitude * 100)}% of mesor, " +
+                "needs ${"%.0f".format(com.noop.analytics.CircadianEngine.minRelativeAmplitude * 100)}%)"
+        daysObserved < com.noop.analytics.CircadianEngine.minDaysForFit ->
+            "unreadable — $daysObserved days observed, needs " +
+                "${com.noop.analytics.CircadianEngine.minDaysForFit}"
+        daysObserved < com.noop.analytics.CircadianEngine.goodDaysForFit ->
+            "wide — $daysObserved days observed"
+        else -> "solid — $daysObserved days observed"
+    }
+
+    /**
+     * The body clock's three inputs, read fresh from the store.
+     *
+     * Hours and days are counted from the RAW buckets rather than from `circadianBinsFrom`, which
+     * short-circuits to empty below the bucket floor — reporting its zeros would hide the very numbers
+     * this line exists to show.
+     */
+    suspend fun circadianLines(context: Context): List<String> = buildList {
+        add("─".repeat(40))
+        add("Body clock inputs")
+        runCatching {
+            val repo = com.noop.data.WhoopRepository.from(context)
+            val active = runCatching {
+                (context.applicationContext as com.noop.NoopApplication).activeDeviceId
+            }.getOrNull() ?: "unknown"
+            val nowMs = System.currentTimeMillis()
+            val now = nowMs / 1000L
+            val tz = java.util.TimeZone.getDefault().getOffset(nowMs) / 1000L
+            val buckets = repo.hrBucketsUnion(active, now - 14L * 86_400L, now, 3_600L)
+            val hours = buckets.map { (((it.bucket + tz) % 86_400L + 86_400L) % 86_400L / 3_600L) }
+                .distinct().size
+            val days = buckets.map { (it.bucket + tz) / 86_400L }.distinct().size
+            val bins = com.noop.ui.circadianBinsFrom(buckets, tz).first
+            val amp = com.noop.analytics.CircadianEngine.cosinor(bins)?.let { f ->
+                if (f.mesor != 0.0) f.amplitude / kotlin.math.abs(f.mesor) else 0.0
+            }
+            add("Source: $active (+ imported)  window: last 14d")
+            add("Buckets: ${buckets.size} (floor $CIRCADIAN_MIN_BUCKETS)  " +
+                "hours: $hours/24 (need $CIRCADIAN_MIN_HOURS)  days: $days " +
+                "(need ${com.noop.analytics.CircadianEngine.minDaysForFit})")
+            add("Verdict: " + circadianVerdict(buckets.size, hours, days, amp))
+        }.onFailure { add("  (unavailable: ${it.message})") }
+    }
+
     /** "3h 12m ago" style relative stamp for a positive age in ms. */
     private fun relTime(deltaMs: Long): String {
         if (deltaMs < 60_000L) return "just now"
diff --git a/android/app/src/test/java/com/noop/testcentre/CircadianVerdictTest.kt b/android/app/src/test/java/com/noop/testcentre/CircadianVerdictTest.kt
new file mode 100644
index 0000000000..b5005e1996
--- /dev/null
+++ b/android/app/src/test/java/com/noop/testcentre/CircadianVerdictTest.kt
@@ -0,0 +1,54 @@
+package com.noop.testcentre
+
+import com.noop.analytics.CircadianEngine
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The body-clock verdict line. The card vanishing has two indistinguishable causes on screen — no
+ * estimate at all (below the bucket or hour floor) versus an estimate marked unreadable (thin or flat
+ * fit, which still draws its own card) — so the wording has to name WHICH floor is short.
+ */
+class CircadianVerdictTest {
+
+    private fun verdict(buckets: Int, hours: Int, days: Int, amp: Double? = 0.5) =
+        AndroidDiagnostics.circadianVerdict(buckets, hours, days, amp)
+
+    /** Gates are reported in the order the pipeline applies them: the bucket floor short-circuits first. */
+    @Test fun theBucketFloorIsReportedBeforeAnythingElse() {
+        val v = verdict(buckets = 10, hours = 2, days = 1)
+        assertTrue(v, v.startsWith("no estimate"))
+        assertTrue(v, v.contains("10 hourly HR buckets") && v.contains("needs 24"))
+    }
+
+    @Test fun theHourFloorIsNamedWhenBucketsAreFine() {
+        val v = verdict(buckets = 100, hours = 4, days = 9)
+        assertTrue(v, v.startsWith("no estimate"))
+        assertTrue(v, v.contains("4 of 24 local hours") && v.contains("needs 6"))
+    }
+
+    /**
+     * A flat rhythm and a short history BOTH yield UNREADABLE from the engine, and the card still draws
+     * for either — so the line must distinguish them or it explains nothing.
+     */
+    @Test fun aFlatRhythmIsDistinguishedFromAShortHistory() {
+        val flat = verdict(buckets = 300, hours = 20, days = 20, amp = 0.02)
+        assertTrue(flat, flat.startsWith("unreadable") && flat.contains("too flat"))
+        val thin = verdict(buckets = 300, hours = 20, days = 3, amp = 0.5)
+        assertTrue(thin, thin.startsWith("unreadable") && thin.contains("3 days observed"))
+    }
+
+    /** The readable tiers name the confidence the card will actually show. */
+    @Test fun readableTiersMatchTheEnginesOwnThresholds() {
+        val wide = verdict(buckets = 300, hours = 20, days = CircadianEngine.minDaysForFit)
+        assertTrue(wide, wide.startsWith("wide"))
+        val solid = verdict(buckets = 300, hours = 20, days = CircadianEngine.goodDaysForFit)
+        assertTrue(solid, solid.startsWith("solid"))
+    }
+
+    /** An unmeasurable amplitude must not be read as a flat rhythm. */
+    @Test fun anUnknownAmplitudeDoesNotReadAsFlat() {
+        val v = verdict(buckets = 300, hours = 20, days = 20, amp = null)
+        assertTrue(v, v.startsWith("solid"))
+    }
+}

From c472fc9ea1c08c120f26ff013989fb415501bf9b Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 20:30:54 +1200
Subject: [PATCH 058/333] Bump build numbers for the next 10.6.1 staging build

versionCode 377 -> 378, CURRENT_PROJECT_VERSION 258 -> 259. MARKETING_VERSION
and versionName stay at 10.6.1 so the next real release is not pre-bumped.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 5b70226b8a..6aef96ef80 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 377
+        versionCode = 378
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index ff24f0ff1b..82925b2c59 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "258"
+    CURRENT_PROJECT_VERSION: "259"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From a2738606e4f42aa475e685de3bcae589f5a0a296 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 21:21:56 +1200
Subject: [PATCH 059/333] Stop a cycle re-evaluate blanking the body clock, and
 report the rhythm in bpm (#1729)

Two follow-ups from reading a real strap log, whose new diagnostic printed abundant data (328 buckets, 24/24 hours, 15 days) with a single failing gate: amplitude 7.3% of mesor against a 10% bar.

STALE BINS. Only the collector refreshed lastCircadianBins. The two cycle-tracking paths - setCycleTrackingEnabled and reloadPeriodStartsAndCycle - reused whatever was cached, which starts as `emptyList() to 0` and returns to empty whenever the store read fails (circadianActivityBins swallows that to an empty list). Either way the re-evaluate then handed V5HealthSignals no bins, fell under its six-bin floor, and nulled bodyClock - the Health card vanishing on a device whose data is fine. Both sites now go through freshCircadianBins(), which re-reads ONLY when the cache is empty.

Those sites moved inside viewModelScope.launch to have somewhere to read from, which is less of a change than it looks: on Dispatchers.Main.immediate a body that never suspends runs INLINE, and freshCircadianBins only suspends when the cache is empty, so the common path stays as immediate as the plain call it replaced. The neighbouring comment called that re-evaluate SYNCHRONOUS with no coroutine; it now says what the code does.

RHYTHM IN BPM. The verdict's ratio is not interpretable alone - "7.3% of mesor" says nothing about whether a rhythm is genuinely flat or the bar is set high for this wearer. The diagnostic now prints amplitude, mesor and acrophase in bpm, which is what minRelativeAmplitude's own note asks for.

Re-review passes then fixed, in order: the new floats pinned to Locale.US (Kotlin's "%.1f".format uses the DEFAULT locale, so a comma-decimal device would have logged "4,7 bpm" beside the US-formatted timestamps this same file already pins); the section labelled "recomputed from the store, not the live snapshot", since it reports what estimatePhase WOULD return and could otherwise print a confident verdict beside a missing card - misleading exactly as the silence it replaced did; a duplicated hour floor replaced by a REFERENCE to V5HealthSignals.MIN_CIRCADIAN_BINS, because a diagnostic that names the wrong threshold sends its reader after the wrong thing; and a test asserting that reference removed once it became X == X and could never fail.

The bucket floor keeps its test - it is a bare literal inside circadianBinsFrom that genuinely can drift, so it is pinned against the real boundary.

No threshold is changed. Which gate to revisit, and by how much, is what the bpm numbers are for. Android 4767 pass, checks 4/4.
---
 .../com/noop/testcentre/AndroidDiagnostics.kt | 52 ++++++++++++++---
 .../src/main/java/com/noop/ui/AppViewModel.kt | 56 ++++++++++++++-----
 .../noop/testcentre/CircadianVerdictTest.kt   | 15 +++++
 3 files changed, 100 insertions(+), 23 deletions(-)

diff --git a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
index c1edf42b07..0ebfe73259 100644
--- a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
@@ -419,15 +419,33 @@ object AndroidDiagnostics {
                 dailyDataLines(context) + alarmLines(context) + circadianLines(context)
         }
 
+    /**
+     * One-decimal float, always with a DOT.
+     *
+     * This file already pins `Locale.US` for its dates, for the same reason: the strap log is pasted into
+     * issues and read by whoever picks them up, so a device in a comma-decimal locale must not emit
+     * "4,7 bpm" beside US-formatted timestamps. Kotlin's `"%.1f".format(x)` uses the default locale and
+     * would do exactly that.
+     */
+    private fun fmt1(v: Double): String = String.format(java.util.Locale.US, "%.1f", v)
+
     /** Hourly HR buckets over the 14-day window below which the profile is not pooled at all. Mirrors
      *  `circadianBinsFrom`'s own floor — kept here so the diagnostic names the real number, not a guess. */
     internal const val CIRCADIAN_MIN_BUCKETS = 24
-    /** Distinct populated local hours below which no estimate is attempted. Mirrors
-     *  `V5HealthSignals.MIN_CIRCADIAN_BINS`. */
-    internal const val CIRCADIAN_MIN_HOURS = 6
+    /** Distinct populated local hours below which no estimate is attempted.
+     *
+     *  REFERENCES the engine's own constant rather than repeating its value. A diagnostic that prints
+     *  "needs 6" while the code requires 8 would send whoever reads the log after the wrong thing —
+     *  the one failure mode this section exists to prevent. */
+    internal val CIRCADIAN_MIN_HOURS get() = com.noop.analytics.V5HealthSignals.MIN_CIRCADIAN_BINS
 
     /**
-     * Which gate the body clock is failing, in the order the pipeline applies them.
+     * Which gate the body clock is failing.
+     *
+     * The first two are sequential gates and are reported in the order they run. The last two are a
+     * SINGLE condition in the engine (`daysObserved < minDaysForFit || relativeAmplitude <
+     * minRelativeAmplitude`), split apart here because "unreadable" on its own does not say whether to
+     * keep wearing the strap or to question the threshold — and those lead somewhere different.
      *
      * The card vanishes for two DIFFERENT reasons that look identical on screen: below the bucket floor
      * or the hour floor there is NO estimate at all (`V5HealthSignals` returns null and the card's `?.let`
@@ -450,8 +468,8 @@ object AndroidDiagnostics {
             "no estimate — HR lands in $populatedHours of 24 local hours, needs $CIRCADIAN_MIN_HOURS"
         relativeAmplitude != null &&
             relativeAmplitude < com.noop.analytics.CircadianEngine.minRelativeAmplitude ->
-            "unreadable — rhythm too flat (amplitude ${"%.1f".format(relativeAmplitude * 100)}% of mesor, " +
-                "needs ${"%.0f".format(com.noop.analytics.CircadianEngine.minRelativeAmplitude * 100)}%)"
+            "unreadable — rhythm too flat (amplitude ${fmt1(relativeAmplitude * 100)}% of mesor, " +
+                "needs ${fmt1(com.noop.analytics.CircadianEngine.minRelativeAmplitude * 100)}%)"
         daysObserved < com.noop.analytics.CircadianEngine.minDaysForFit ->
             "unreadable — $daysObserved days observed, needs " +
                 "${com.noop.analytics.CircadianEngine.minDaysForFit}"
@@ -461,7 +479,13 @@ object AndroidDiagnostics {
     }
 
     /**
-     * The body clock's three inputs, read fresh from the store.
+     * The body clock's three inputs, RECOMPUTED from the store.
+     *
+     * It reports what `estimatePhase` WOULD return for the data on disk — not what `_v5Signals.bodyClock`
+     * is currently holding. Those can diverge: a cached-bins staleness once nulled the live estimate on a
+     * device whose store was fine, and against that failure this section would have printed a confident
+     * verdict beside a missing card, misleading exactly as the silence it replaced did. So a verdict here
+     * that disagrees with the screen is itself the finding — it means the snapshot, not the data, is wrong.
      *
      * Hours and days are counted from the RAW buckets rather than from `circadianBinsFrom`, which
      * short-circuits to empty below the bucket floor — reporting its zeros would hide the very numbers
@@ -469,7 +493,7 @@ object AndroidDiagnostics {
      */
     suspend fun circadianLines(context: Context): List<String> = buildList {
         add("─".repeat(40))
-        add("Body clock inputs")
+        add("Body clock inputs (recomputed from the store, not the live snapshot)")
         runCatching {
             val repo = com.noop.data.WhoopRepository.from(context)
             val active = runCatching {
@@ -483,13 +507,23 @@ object AndroidDiagnostics {
                 .distinct().size
             val days = buckets.map { (it.bucket + tz) / 86_400L }.distinct().size
             val bins = com.noop.ui.circadianBinsFrom(buckets, tz).first
-            val amp = com.noop.analytics.CircadianEngine.cosinor(bins)?.let { f ->
+            val fit = com.noop.analytics.CircadianEngine.cosinor(bins)
+            val amp = fit?.let { f ->
                 if (f.mesor != 0.0) f.amplitude / kotlin.math.abs(f.mesor) else 0.0
             }
             add("Source: $active (+ imported)  window: last 14d")
             add("Buckets: ${buckets.size} (floor $CIRCADIAN_MIN_BUCKETS)  " +
                 "hours: $hours/24 (need $CIRCADIAN_MIN_HOURS)  days: $days " +
                 "(need ${com.noop.analytics.CircadianEngine.minDaysForFit})")
+            // The ratio alone is not interpretable — "7.3% of mesor" says nothing about whether the
+            // rhythm is genuinely flat or the bar is simply set high for this wearer. The absolute pair is
+            // what makes the threshold arguable, and it is what `minRelativeAmplitude`'s own note asks for
+            // ("it needs a wearer whose amplitude is disproportionately small for their mesor").
+            if (fit != null) {
+                add("Rhythm: amplitude ${fmt1(fit.amplitude)} bpm on a " +
+                    "${fmt1(fit.mesor)} bpm mesor  (acrophase " +
+                    "${fmt1(fit.acrophaseHours)}h)")
+            }
             add("Verdict: " + circadianVerdict(buckets.size, hours, days, amp))
         }.onFailure { add("  (unavailable: ${it.message})") }
     }
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index 9be92ab20f..2b9623082b 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -432,16 +432,38 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
      *  recordings under a read pinned to the literal "my-whoop" (#814 twin of the Workouts screen). */
     val deviceId = noopApp.activeDeviceId
 
-    /** Last (bins, daysObserved) computed on the collector pass. Reused by the SYNCHRONOUS settings
-     *  re-evaluate below, which has no coroutine to read the store from — without this, flipping the
+    /** Last (bins, daysObserved) computed on the collector pass. Reused by the cycle-tracking
+     *  re-evaluates below so they need no store read of their own — without this, flipping the
      *  cycle-tracking toggle would blank the body clock until the next collector tick.
      *
+     *  Those sites now go through [freshCircadianBins], which reads the store ONLY when this cache is
+     *  empty, and they sit inside `viewModelScope.launch`. On `Dispatchers.Main.immediate` a body that
+     *  never suspends runs inline, so the populated-cache path is as immediate as the plain call it
+     *  replaced; only the empty-cache case actually defers. (This comment previously said the
+     *  re-evaluate was SYNCHRONOUS and had no coroutine — true before that change, not after.)
+     *
      *  Not volatile and not synchronised, deliberately: the write resumes on `viewModelScope`
      *  (Dispatchers.Main.immediate) and the read is a UI-thread settings callback, so both touch it on
      *  the main thread. The Swift twin gets the same guarantee from `@MainActor` on AppModel. */
     private var lastCircadianBins: Pair<List<CircadianEngine.ActivityBin>, Int> =
         emptyList<CircadianEngine.ActivityBin>() to 0
 
+    /**
+     * The circadian bins, re-read first if the cache is empty.
+     *
+     * Only the main collect path refreshed [lastCircadianBins]; the cycle-tracking paths reused whatever
+     * was cached, which starts as `emptyList() to 0` and returns to empty whenever a store read fails
+     * (`circadianActivityBins` swallows that to an empty list). Either way a cycle re-evaluation would
+     * then hand `V5HealthSignals` no bins, drop below its six-bin floor, and null out `bodyClock` — the
+     * Health card disappearing on a device whose data is fine, which is exactly the symptom that started
+     * this. Refreshing only when EMPTY keeps the cheap path cheap: a populated cache is left alone and
+     * the collector stays the thing that keeps it current.
+     */
+    private suspend fun freshCircadianBins(): Pair<List<CircadianEngine.ActivityBin>, Int> {
+        if (lastCircadianBins.first.isEmpty()) lastCircadianBins = circadianActivityBins()
+        return lastCircadianBins
+    }
+
     /**
      * Per-hour activity profile for the body clock (#852), from the last ~14 days of hourly HR buckets.
      * HR amplitude is a usable rest/activity rhythm proxy when raw motion is not to hand.
@@ -2524,16 +2546,21 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
     fun setCycleTrackingEnabled(enabled: Boolean) {
         _cycleTrackingEnabled.value = enabled
         NoopPrefs.setCycleTracking(appContext, enabled)
-        val days = recentDays.value
-        runCatching {
-            _v5Signals.value = V5HealthSignals.evaluate(
-                days = days,
-                cycleOptedIn = enabled,
-                loggedPeriodStarts = _periodStarts.value,
-                journalContext = illnessJournalContext(days),
-                activityBins = lastCircadianBins.first,
-                daysObserved = lastCircadianBins.second,
-            )
+        // Launched, like the sibling toggles, because the bins may need a store read before this snapshot
+        // is safe to publish — evaluating straight off an empty cache is what erased `bodyClock`.
+        viewModelScope.launch {
+            val days = recentDays.value
+            val bins = freshCircadianBins()
+            runCatching {
+                _v5Signals.value = V5HealthSignals.evaluate(
+                    days = days,
+                    cycleOptedIn = enabled,
+                    loggedPeriodStarts = _periodStarts.value,
+                    journalContext = illnessJournalContext(days),
+                    activityBins = bins.first,
+                    daysObserved = bins.second,
+                )
+            }
         }
     }
 
@@ -2585,13 +2612,14 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
         val starts = store.starts()
         _periodStarts.value = starts
         val days = recentDays.value
+        val bins = freshCircadianBins()
         _v5Signals.value = V5HealthSignals.evaluate(
             days = days,
             cycleOptedIn = _cycleTrackingEnabled.value,
             loggedPeriodStarts = starts,
             journalContext = illnessJournalContext(days),
-            activityBins = lastCircadianBins.first,
-            daysObserved = lastCircadianBins.second,
+            activityBins = bins.first,
+            daysObserved = bins.second,
         )
     }
 
diff --git a/android/app/src/test/java/com/noop/testcentre/CircadianVerdictTest.kt b/android/app/src/test/java/com/noop/testcentre/CircadianVerdictTest.kt
index b5005e1996..65ce9a5828 100644
--- a/android/app/src/test/java/com/noop/testcentre/CircadianVerdictTest.kt
+++ b/android/app/src/test/java/com/noop/testcentre/CircadianVerdictTest.kt
@@ -51,4 +51,19 @@ class CircadianVerdictTest {
         val v = verdict(buckets = 300, hours = 20, days = 20, amp = null)
         assertTrue(v, v.startsWith("solid"))
     }
+
+    /**
+     * The bucket floor is a bare literal inside `circadianBinsFrom`, so it cannot be referenced the way
+     * the hour floor now is. Pin it against the real behaviour instead of trusting a comment to keep the
+     * two in step — a diagnostic that names the wrong threshold sends its reader after the wrong thing.
+     */
+    @Test fun theReportedBucketFloorIsTheOneCircadianBinsFromActuallyApplies() {
+        fun binsFor(n: Int) = com.noop.ui.circadianBinsFrom(
+            (0 until n).map { com.noop.data.HrBucket(bucket = it * 3600L, avgBpm = 60.0) }, 0L,
+        ).first
+        val floor = AndroidDiagnostics.CIRCADIAN_MIN_BUCKETS
+        assertTrue("one under the reported floor must still be refused", binsFor(floor - 1).isEmpty())
+        assertTrue("the reported floor must be enough", binsFor(floor).isNotEmpty())
+    }
+
 }

From 611c97743a21d0a28e40c6a66f1849d16a167206 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 21:29:18 +1200
Subject: [PATCH 060/333] Bump build numbers for the next 10.6.1 staging build

versionCode 378 -> 379, CURRENT_PROJECT_VERSION 259 -> 260. MARKETING_VERSION
and versionName stay at 10.6.1 so the next real release is not pre-bumped.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 6aef96ef80..08cf811065 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 378
+        versionCode = 379
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 82925b2c59..c0282788d0 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "259"
+    CURRENT_PROJECT_VERSION: "260"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 2418c86049b5a2ddb51534c49cc54fbed1122504 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 22:13:53 +1200
Subject: [PATCH 061/333] Accept a rhythm that is large enough in bpm, whatever
 the mesor (#1731)

minRelativeAmplitude gates on amplitude / |mesor|, scaling the requirement WITH resting HR. In the engine's own fixtures the SAME 5 bpm swing read arrhythmic at a 65 bpm mesor and rhythmic at 45 - one rhythm, two verdicts, decided by the baseline rather than by the rhythm.

A measured wearer sat exactly there. From a strap log: 328 buckets, 24/24 hours, 15 days, and "amplitude 5.5 bpm on a 74.7 bpm mesor (acrophase 16.1h)" refused at 7.3% against the 10% bar. Every count gate cleared, and an acrophase of 16.1 h implies a CBTmin near 04:06 - a textbook phase, not noise. At that mesor the bar is 7.47 bpm; the same 5.5 bpm passes at 55.

estimatePhase now accepts EITHER measure: relativeAmplitude >= 0.10 OR amplitude >= minAbsoluteAmplitudeBpm. 4.5 bpm is not a new tuning constant - it is the absolute amplitude the relative gate ALREADY accepts at the bottom of the ~45-75 bpm mesor range its own note describes. The rule encoded is internal consistency: an amplitude good enough for some wearer is good enough for all. The 10% value itself is untouched, since every candidate for it remains unvalidated, and the new UNREADABLE set is a strict subset of the old, so nobody who reads rhythmic today stops.

SOLID now requires BOTH enough days and a proportional swing. A rhythm admitted by the absolute floor alone stays WIDE, because a smaller swing pins its acrophase less tightly and WIDE is what withholds chronotype(), which names a category off exactly that acrophase. Widening the readable gate should give more people a body clock, not give a thinner fit a firmer label.

minRelativeAmplitude's note asked for "a wearer whose amplitude is disproportionately small for their mesor - an n=1 observation" and said "nobody is currently silenced by it". Both are corrected in place rather than deleted: the first arrived, the second was true when written and is no longer.

The Test Centre verdict mirrors the engine's OR, so the diagnostic cannot report "too flat" for a rhythm the engine accepts. The two fixtures that pinned the old split are rewritten rather than removed, and the floor's own boundary is pinned relative to the constant with a 0.1 bpm margin - the cosinor recovers amplitude to ~1e-9, so a case sitting exactly on >= would pin float recovery rather than the threshold.

Parity checked mechanically: the constant, the rhythmic OR, the unreadable gate and the SOLID tier all normalise to identical expressions across the two engines, and both test files carry 26 cases.

Android 4773 pass, checks 15/15 including test (StrandAnalytics) on macOS.
---
 .../StrandAnalytics/CircadianEngine.swift     | 39 ++++++++++---
 .../CircadianEngineTests.swift                | 57 +++++++++++++++----
 .../com/noop/analytics/CircadianEngine.kt     | 40 ++++++++++++-
 .../com/noop/testcentre/AndroidDiagnostics.kt | 11 +++-
 .../com/noop/analytics/CircadianEngineTest.kt | 57 ++++++++++++++++---
 .../noop/testcentre/CircadianVerdictTest.kt   | 20 ++++++-
 6 files changed, 190 insertions(+), 34 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/CircadianEngine.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/CircadianEngine.swift
index de115ec721..1e9e90e450 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/CircadianEngine.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/CircadianEngine.swift
@@ -34,12 +34,28 @@ public enum CircadianEngine {
     /// so a low-resting wearer faces a LOWER absolute bar, not a higher one — the opposite of the concern
     /// raised in #982, which assumed the gate penalises the fittest.
     ///
-    /// Deliberately NOT re-tuned to an absolute bpm floor. The shape is arguably wrong for this domain,
-    /// but every candidate value is unvalidated, nobody is currently silenced by it, and the direction of
-    /// the harm is not established (it needs a wearer whose amplitude is disproportionately small for
-    /// their mesor — an n=1 observation). `CircadianEngineTests` pins what the gate costs at each mesor so
-    /// the trade is visible to whoever does have the data to change it.
+    /// The VALUE is still not re-tuned — every candidate remains unvalidated. What changed is the SHAPE:
+    /// `minAbsoluteAmplitudeBpm` now passes a swing large enough in bpm regardless of mesor. This note
+    /// asked for "a wearer whose amplitude is disproportionately small for their mesor — an n=1
+    /// observation" before that could happen, and one arrived: 5.5 bpm on a 74.7 bpm mesor with a coherent
+    /// acrophase. "Nobody is currently silenced by it" was true when written and is no longer.
+    /// `CircadianEngineTests` pins what the gate costs at each mesor so the trade stays visible.
     public static let minRelativeAmplitude: Double = 0.10
+    /// Absolute amplitude (bpm) that reads as rhythmic whatever the mesor — the relative bar's escape hatch.
+    ///
+    /// The relative test scales the requirement WITH resting HR, so the identical swing is accepted on one
+    /// body and refused on another: 5.5 bpm passes at a 55 bpm mesor and fails at 74.7. That is not a
+    /// judgement about the rhythm, it is a judgement about the baseline, and a measured wearer sat exactly
+    /// there — 5.5 bpm on a 74.7 bpm mesor, acrophase 16.1 h implying a CBTmin near 04:06, which is a
+    /// textbook phase rather than noise. `minRelativeAmplitude`'s own note called for precisely that
+    /// observation ("a wearer whose amplitude is disproportionately small for their mesor") before the
+    /// shape could be revisited.
+    ///
+    /// 4.5 bpm is NOT a new tuning constant: it is the absolute amplitude the relative gate ALREADY
+    /// accepts at the bottom of the ~45-75 bpm mesor range it was described against. The rule this
+    /// encodes is internal consistency — an amplitude good enough for some wearer is good enough for all
+    /// — so the change is strictly more permissive and no one who reads rhythmic today stops.
+    public static let minAbsoluteAmplitudeBpm: Double = 4.5
     /// Max clock-shift the planner steps per day (hours) — the well-established ~1 h/day re-entrainment rate.
     public static let maxShiftPerDayHours: Double = 1.0
     /// CBTmin sits roughly this many hours before habitual wake; used to translate the activity acrophase
@@ -194,7 +210,10 @@ public enum CircadianEngine {
         guard let fit = cosinor(bins) else { return nil }
 
         let relativeAmplitude = fit.mesor != 0 ? fit.amplitude / abs(fit.mesor) : 0
-        if daysObserved < minDaysForFit || relativeAmplitude < minRelativeAmplitude {
+        // Rhythmic on EITHER measure: a proportional swing, or an absolute one large enough to read on
+        // any baseline. See `minAbsoluteAmplitudeBpm` for why the relative test alone was self-inconsistent.
+        let rhythmic = relativeAmplitude >= minRelativeAmplitude || fit.amplitude >= minAbsoluteAmplitudeBpm
+        if daysObserved < minDaysForFit || !rhythmic {
             // A reading is returned, but flagged unreadable so the surface says "hard to read right now."
             let tmin = observedTempMinHour ?? wrap24(fit.acrophaseHours - acrophaseAfterCbtMinHours)
             return PhaseEstimate(tempMinHour: tmin, acrophaseHours: fit.acrophaseHours,
@@ -212,7 +231,13 @@ public enum CircadianEngine {
         let offsetHours = signedHourDelta(from: idealTempMin, to: tempMinHour)
         let offsetMinutes = offsetHours * 60.0
 
-        let confidence: PhaseConfidence = daysObserved >= goodDaysForFit ? .solid : .wide
+        // SOLID means strong on BOTH axes, not just enough days. A rhythm admitted by
+        // `minAbsoluteAmplitudeBpm` alone is real but modest, and a smaller swing pins its acrophase less
+        // tightly — so it stays `.wide`. That matters because `.wide` is what withholds `chronotype`,
+        // which names a category off exactly that acrophase: widening the readable gate should give more
+        // people a body clock, not give a thinner fit a firmer label.
+        let confidence: PhaseConfidence =
+            (daysObserved >= goodDaysForFit && relativeAmplitude >= minRelativeAmplitude) ? .solid : .wide
         let lean: String
         if offsetMinutes > 20 { lean = "later (a night-owl lean)" }
         else if offsetMinutes < -20 { lean = "earlier (a morning-lark lean)" }
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CircadianEngineTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CircadianEngineTests.swift
index adf3378a2e..88cb32be18 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CircadianEngineTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CircadianEngineTests.swift
@@ -129,27 +129,60 @@ final class CircadianEngineTests: XCTestCase {
     /// `minRelativeAmplitude` gates on `amplitude / |mesor|`. Against a signal carrying a ~45-75 bpm DC
     /// offset that makes the real bar an ABSOLUTE `0.10 x mesor` bpm — which these pin.
     ///
-    /// The pair that matters is the last two: the SAME 5 bpm swing is arrhythmic at a 65 bpm mesor and
-    /// readable at 45. The bar scales WITH the mesor, so a low-resting wearer faces a LOWER absolute
-    /// requirement, not a higher one. #982 raised the opposite concern — that the gate penalises the
-    /// fittest — and that only holds for someone whose amplitude is disproportionately small for their
-    /// mesor. Pinned here so the direction is a fact rather than an argument, for whoever re-tunes it.
+    /// These USED to pin the relative bar alone, including that the SAME 5 bpm swing was arrhythmic at a
+    /// 65 bpm mesor and readable at 45 — the same rhythm judged by the baseline rather than by itself.
+    /// `minAbsoluteAmplitudeBpm` removed that split; what remains pinned is that a proportional swing
+    /// still passes, a genuinely flat one still fails, and the verdict no longer moves with the mesor.
     private func confidence(mesor: Double, amp: Double) -> CircadianEngine.PhaseConfidence {
         CircadianEngine.estimatePhase(bins: profile(mesor: mesor, amp: amp, acrophase: 16),
                                       daysObserved: CircadianEngine.goodDaysForFit,
                                       habitualWakeHour: 7)!.confidence
     }
 
-    func testTypicalMesorNeedsAboutSixAndAHalfBpmOfSwing() {
+    func testAProportionalSwingStillPasses() {
         XCTAssertNotEqual(confidence(mesor: 65, amp: 8), .unreadable)   // 0.123 - clears 0.10
-        XCTAssertEqual(confidence(mesor: 65, amp: 5), .unreadable)      // 0.077 - does not
     }
 
-    func testTheSameSwingIsReadableAtALowerMesor() {
-        // 5 bpm: arrhythmic at 65, rhythmic at 45. The gate favours the low-resting wearer.
-        XCTAssertEqual(confidence(mesor: 65, amp: 5), .unreadable)
-        XCTAssertNotEqual(confidence(mesor: 45, amp: 5), .unreadable)   // 0.111
-        XCTAssertEqual(confidence(mesor: 45, amp: 4), .unreadable)      // 0.089
+    /// The inconsistency the absolute floor removes: one rhythm, three baselines, one verdict.
+    func testTheSameSwingNoLongerDependsOnTheBaseline() {
+        XCTAssertNotEqual(confidence(mesor: 45, amp: 5), .unreadable)
+        XCTAssertNotEqual(confidence(mesor: 65, amp: 5), .unreadable)
+        XCTAssertNotEqual(confidence(mesor: 80, amp: 5), .unreadable)
+    }
+
+    /// A genuinely flat rhythm is still refused — the floor widens the gate, it does not remove it.
+    func testAFlatRhythmIsStillArrhythmicOnBothMeasures() {
+        XCTAssertEqual(confidence(mesor: 45, amp: 4), .unreadable)      // 0.089, 4.0 bpm
+        XCTAssertEqual(confidence(mesor: 65, amp: 4), .unreadable)      // 0.062, 4.0 bpm
+        XCTAssertEqual(confidence(mesor: 74.7, amp: 3), .unreadable)
+    }
+
+    /// The absolute floor's own boundary, isolated: at a 74.7 bpm mesor the relative test cannot pass
+    /// either value, so only `minAbsoluteAmplitudeBpm` decides. Expressed RELATIVE to the constant, with a
+    /// 0.1 bpm margin rather than the exact value — the cosinor recovers amplitude to ~1e-9, and sitting
+    /// exactly on `>=` would pin float recovery rather than the threshold.
+    func testTheAbsoluteFloorIsWhereItSays() {
+        let floor = CircadianEngine.minAbsoluteAmplitudeBpm
+        XCTAssertNotEqual(confidence(mesor: 74.7, amp: floor + 0.1), .unreadable)
+        XCTAssertEqual(confidence(mesor: 74.7, amp: floor - 0.1), .unreadable)
+    }
+
+    /// The widening must not hand a thinner fit a FIRMER label. A rhythm admitted only by the absolute
+    /// floor caps at `.wide`, which withholds `chronotype` — that names a category off an acrophase a
+    /// small swing pins loosely. A proportional rhythm still reaches `.solid`.
+    func testAnAbsoluteOnlyRhythmIsReadableButNotSolid() {
+        XCTAssertEqual(confidence(mesor: 74.7, amp: 5.5), .wide)    // 0.073 - floor only
+        XCTAssertEqual(confidence(mesor: 65, amp: 8), .solid)       // 0.123 - proportional
+        let wide = CircadianEngine.estimatePhase(bins: profile(mesor: 74.7, amp: 5.5, acrophase: 16),
+                                                 daysObserved: CircadianEngine.goodDaysForFit,
+                                                 habitualWakeHour: 7)!
+        XCTAssertNil(CircadianEngine.chronotype(wide), "a floor-only fit must not name a chronotype")
+    }
+
+    /// The measured wearer this change exists for: 5.5 bpm on a 74.7 bpm mesor, refused at 7.3% against
+    /// the 10% bar while its acrophase implied a textbook CBTmin near 04:06.
+    func testTheMeasuredWearerIsNoLongerSilenced() {
+        XCTAssertNotEqual(confidence(mesor: 74.7, amp: 5.5), .unreadable)
     }
 
     // MARK: - chronotype lean (absolute phase, not schedule-relative)
diff --git a/android/app/src/main/java/com/noop/analytics/CircadianEngine.kt b/android/app/src/main/java/com/noop/analytics/CircadianEngine.kt
index df7214e0a5..73eaab83cb 100644
--- a/android/app/src/main/java/com/noop/analytics/CircadianEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/CircadianEngine.kt
@@ -31,10 +31,31 @@ object CircadianEngine {
      * #982 — RELATIVE, applied to mean HR (mesor ~45-75 bpm), not to a near-zero-mesor motion volume. The
      * effective bar is `0.10 x mesor`: ~6.5 bpm at a 65 bpm mesor, ~4.5 bpm at 45. It scales WITH the
      * mesor, so a low-resting wearer faces a LOWER absolute bar — the opposite of the concern in #982.
-     * Deliberately NOT re-tuned: every candidate value is unvalidated and nobody is currently silenced.
+     * The VALUE is still not re-tuned — every candidate remains unvalidated. What changed is the SHAPE:
+     * [minAbsoluteAmplitudeBpm] now passes a swing that is large enough in bpm regardless of mesor,
+     * because a measured wearer showed the relative test refusing a coherent rhythm purely for having a
+     * high baseline. "Nobody is currently silenced by it" was true when written and is no longer.
      * `CircadianEngineTest` pins what it costs at each mesor. Mirrors the Swift twin exactly.
      */
     const val minRelativeAmplitude: Double = 0.10
+    /**
+     * Absolute amplitude (bpm) that reads as rhythmic whatever the mesor — the relative bar's escape hatch.
+     *
+     * The relative test scales the requirement WITH resting HR, so the identical swing is accepted on one
+     * body and refused on another: 5.5 bpm passes at a 55 bpm mesor and fails at 74.7. That is not a
+     * judgement about the rhythm, it is a judgement about the baseline, and a measured wearer sat exactly
+     * there — 5.5 bpm on a 74.7 bpm mesor, acrophase 16.1 h implying a CBTmin near 04:06, a textbook phase
+     * rather than noise. [minRelativeAmplitude]'s own note called for precisely that observation ("a
+     * wearer whose amplitude is disproportionately small for their mesor") before the shape could be
+     * revisited.
+     *
+     * 4.5 bpm is NOT a new tuning constant: it is the absolute amplitude the relative gate ALREADY accepts
+     * at the bottom of the ~45-75 bpm mesor range it was described against. The rule this encodes is
+     * internal consistency — an amplitude good enough for some wearer is good enough for all — so the
+     * change is strictly more permissive and no one who reads rhythmic today stops.
+     * Mirrors the Swift twin exactly.
+     */
+    const val minAbsoluteAmplitudeBpm: Double = 4.5
     const val maxShiftPerDayHours: Double = 1.0
     const val cbtMinBeforeWakeHours: Double = 2.5
     const val acrophaseAfterCbtMinHours: Double = 12.0
@@ -152,7 +173,11 @@ object CircadianEngine {
         val fit = cosinor(bins) ?: return null
 
         val relativeAmplitude = if (fit.mesor != 0.0) fit.amplitude / abs(fit.mesor) else 0.0
-        if (daysObserved < minDaysForFit || relativeAmplitude < minRelativeAmplitude) {
+        // Rhythmic on EITHER measure: a proportional swing, or an absolute one large enough to read on any
+        // baseline. See [minAbsoluteAmplitudeBpm] for why the relative test alone was self-inconsistent.
+        val rhythmic =
+            relativeAmplitude >= minRelativeAmplitude || fit.amplitude >= minAbsoluteAmplitudeBpm
+        if (daysObserved < minDaysForFit || !rhythmic) {
             val tmin = observedTempMinHour ?: wrap24(fit.acrophaseHours - acrophaseAfterCbtMinHours)
             return PhaseEstimate(tmin, fit.acrophaseHours, 0.0, PhaseConfidence.UNREADABLE,
                 "Your rhythm is hard to read right now - keep wearing it for a clearer picture.")
@@ -165,7 +190,16 @@ object CircadianEngine {
         val offsetHours = signedHourDelta(idealTempMin, tempMinHour)
         val offsetMinutes = offsetHours * 60.0
 
-        val confidence = if (daysObserved >= goodDaysForFit) PhaseConfidence.SOLID else PhaseConfidence.WIDE
+        // SOLID means strong on BOTH axes, not just enough days. A rhythm admitted by
+        // [minAbsoluteAmplitudeBpm] alone is real but modest, and a smaller swing pins its acrophase less
+        // tightly — so it stays WIDE. That matters because WIDE is what withholds [chronotype], which
+        // names a category off exactly that acrophase: widening the readable gate should give more people
+        // a body clock, not give a thinner fit a firmer label.
+        val confidence = if (daysObserved >= goodDaysForFit && relativeAmplitude >= minRelativeAmplitude) {
+            PhaseConfidence.SOLID
+        } else {
+            PhaseConfidence.WIDE
+        }
         val lean = when {
             offsetMinutes > 20 -> "later (a night-owl lean)"
             offsetMinutes < -20 -> "earlier (a morning-lark lean)"
diff --git a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
index 0ebfe73259..8ac501f5ea 100644
--- a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
@@ -461,15 +461,20 @@ object AndroidDiagnostics {
         populatedHours: Int,
         daysObserved: Int,
         relativeAmplitude: Double?,
+        amplitudeBpm: Double? = null,
     ): String = when {
         buckets < CIRCADIAN_MIN_BUCKETS ->
             "no estimate — $buckets hourly HR buckets in 14d, needs $CIRCADIAN_MIN_BUCKETS"
         populatedHours < CIRCADIAN_MIN_HOURS ->
             "no estimate — HR lands in $populatedHours of 24 local hours, needs $CIRCADIAN_MIN_HOURS"
+        // Mirrors the engine's OR: a swing passes on the proportional test or on the absolute one. Read
+        // the two apart and this line starts reporting "too flat" for rhythms the engine accepts.
         relativeAmplitude != null &&
-            relativeAmplitude < com.noop.analytics.CircadianEngine.minRelativeAmplitude ->
+            relativeAmplitude < com.noop.analytics.CircadianEngine.minRelativeAmplitude &&
+            (amplitudeBpm ?: 0.0) < com.noop.analytics.CircadianEngine.minAbsoluteAmplitudeBpm ->
             "unreadable — rhythm too flat (amplitude ${fmt1(relativeAmplitude * 100)}% of mesor, " +
-                "needs ${fmt1(com.noop.analytics.CircadianEngine.minRelativeAmplitude * 100)}%)"
+                "needs ${fmt1(com.noop.analytics.CircadianEngine.minRelativeAmplitude * 100)}% or " +
+                "${fmt1(com.noop.analytics.CircadianEngine.minAbsoluteAmplitudeBpm)} bpm)"
         daysObserved < com.noop.analytics.CircadianEngine.minDaysForFit ->
             "unreadable — $daysObserved days observed, needs " +
                 "${com.noop.analytics.CircadianEngine.minDaysForFit}"
@@ -524,7 +529,7 @@ object AndroidDiagnostics {
                     "${fmt1(fit.mesor)} bpm mesor  (acrophase " +
                     "${fmt1(fit.acrophaseHours)}h)")
             }
-            add("Verdict: " + circadianVerdict(buckets.size, hours, days, amp))
+            add("Verdict: " + circadianVerdict(buckets.size, hours, days, amp, fit?.amplitude))
         }.onFailure { add("  (unavailable: ${it.message})") }
     }
 
diff --git a/android/app/src/test/java/com/noop/analytics/CircadianEngineTest.kt b/android/app/src/test/java/com/noop/analytics/CircadianEngineTest.kt
index af18708618..47eac3dea4 100644
--- a/android/app/src/test/java/com/noop/analytics/CircadianEngineTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/CircadianEngineTest.kt
@@ -127,16 +127,59 @@ class CircadianEngineTest {
             7.0,
         )!!.confidence
 
-    @Test fun typicalMesorNeedsAboutSixAndAHalfBpmOfSwing() {
+    @Test fun aProportionalSwingStillPasses() {
         assertTrue(confidence(65.0, 8.0) != CircadianEngine.PhaseConfidence.UNREADABLE)   // 0.123
-        assertEquals(CircadianEngine.PhaseConfidence.UNREADABLE, confidence(65.0, 5.0))   // 0.077
     }
 
-    @Test fun theSameSwingIsReadableAtALowerMesor() {
-        // 5 bpm: arrhythmic at 65, rhythmic at 45. The gate favours the low-resting wearer.
-        assertEquals(CircadianEngine.PhaseConfidence.UNREADABLE, confidence(65.0, 5.0))
-        assertTrue(confidence(45.0, 5.0) != CircadianEngine.PhaseConfidence.UNREADABLE)   // 0.111
-        assertEquals(CircadianEngine.PhaseConfidence.UNREADABLE, confidence(45.0, 4.0))   // 0.089
+    /**
+     * The inconsistency the absolute floor removes. This pair USED to assert that 5 bpm was arrhythmic at
+     * a 65 bpm mesor and rhythmic at 45 — the same swing, opposite verdicts, decided by the baseline
+     * rather than by the rhythm. Both now read rhythmic.
+     */
+    @Test fun theSameSwingNoLongerDependsOnTheBaseline() {
+        assertTrue(confidence(45.0, 5.0) != CircadianEngine.PhaseConfidence.UNREADABLE)
+        assertTrue(confidence(65.0, 5.0) != CircadianEngine.PhaseConfidence.UNREADABLE)
+        assertTrue(confidence(80.0, 5.0) != CircadianEngine.PhaseConfidence.UNREADABLE)
+    }
+
+    /** A genuinely flat rhythm is still refused — the floor widens the gate, it does not remove it. */
+    @Test fun aFlatRhythmIsStillArrhythmicOnBothMeasures() {
+        assertEquals(CircadianEngine.PhaseConfidence.UNREADABLE, confidence(45.0, 4.0))   // 0.089, 4.0 bpm
+        assertEquals(CircadianEngine.PhaseConfidence.UNREADABLE, confidence(65.0, 4.0))   // 0.062, 4.0 bpm
+        assertEquals(CircadianEngine.PhaseConfidence.UNREADABLE, confidence(74.7, 3.0))
+    }
+
+    /**
+     * The absolute floor's own boundary, isolated: at a 74.7 bpm mesor the relative test cannot pass
+     * either value (0.061 and 0.059 against 0.10), so only [CircadianEngine.minAbsoluteAmplitudeBpm]
+     * decides. Expressed RELATIVE to the constant so the test follows it, and with a 0.1 bpm margin
+     * either side rather than testing the exact value — the cosinor recovers amplitude to ~1e-9, and a
+     * test sitting exactly on `>=` would be pinning float recovery rather than the threshold.
+     */
+    @Test fun theAbsoluteFloorIsWhereItSays() {
+        val floor = CircadianEngine.minAbsoluteAmplitudeBpm
+        assertTrue(confidence(74.7, floor + 0.1) != CircadianEngine.PhaseConfidence.UNREADABLE)
+        assertEquals(CircadianEngine.PhaseConfidence.UNREADABLE, confidence(74.7, floor - 0.1))
+    }
+
+    /**
+     * The widening must not hand a thinner fit a FIRMER label. A rhythm admitted only by the absolute
+     * floor caps at WIDE, which is what withholds [CircadianEngine.chronotype] — that names a category
+     * off an acrophase a small swing pins loosely. A proportional rhythm still reaches SOLID.
+     */
+    @Test fun anAbsoluteOnlyRhythmIsReadableButNotSolid() {
+        assertEquals(CircadianEngine.PhaseConfidence.WIDE, confidence(74.7, 5.5))   // 0.073 - floor only
+        assertEquals(CircadianEngine.PhaseConfidence.SOLID, confidence(65.0, 8.0))  // 0.123 - proportional
+        val wide = CircadianEngine.estimatePhase(profile(74.7, 5.5, 16.0), CircadianEngine.goodDaysForFit, 7.0)!!
+        assertNull("a floor-only fit must not name a chronotype", CircadianEngine.chronotype(wide))
+    }
+
+    /**
+     * The measured wearer this change exists for: 5.5 bpm on a 74.7 bpm mesor, which the relative test
+     * refused at 7.3% against its 10% bar while the acrophase implied a textbook CBTmin near 04:06.
+     */
+    @Test fun theMeasuredWearerIsNoLongerSilenced() {
+        assertTrue(confidence(74.7, 5.5) != CircadianEngine.PhaseConfidence.UNREADABLE)
     }
 
     // ---- chronotype lean (absolute phase, not schedule-relative) ----
diff --git a/android/app/src/test/java/com/noop/testcentre/CircadianVerdictTest.kt b/android/app/src/test/java/com/noop/testcentre/CircadianVerdictTest.kt
index 65ce9a5828..77760db3b5 100644
--- a/android/app/src/test/java/com/noop/testcentre/CircadianVerdictTest.kt
+++ b/android/app/src/test/java/com/noop/testcentre/CircadianVerdictTest.kt
@@ -11,8 +11,8 @@ import org.junit.Test
  */
 class CircadianVerdictTest {
 
-    private fun verdict(buckets: Int, hours: Int, days: Int, amp: Double? = 0.5) =
-        AndroidDiagnostics.circadianVerdict(buckets, hours, days, amp)
+    private fun verdict(buckets: Int, hours: Int, days: Int, amp: Double? = 0.5, bpm: Double? = null) =
+        AndroidDiagnostics.circadianVerdict(buckets, hours, days, amp, bpm)
 
     /** Gates are reported in the order the pipeline applies them: the bucket floor short-circuits first. */
     @Test fun theBucketFloorIsReportedBeforeAnythingElse() {
@@ -66,4 +66,20 @@ class CircadianVerdictTest {
         assertTrue("the reported floor must be enough", binsFor(floor).isNotEmpty())
     }
 
+    /**
+     * The diagnostic must mirror the engine's OR, not just its relative half. The measured wearer -
+     * 7.3% of mesor but 5.5 bpm of swing - is rhythmic to the engine, so a line still calling that "too
+     * flat" would send its reader after a threshold that is no longer the reason for anything.
+     */
+    @Test fun anAbsoluteSwingClearsTheGateInTheVerdictToo() {
+        val v = verdict(buckets = 328, hours = 24, days = 15, amp = 0.073, bpm = 5.5)
+        assertTrue(v, !v.contains("too flat"))
+        assertTrue(v, v.startsWith("solid"))
+    }
+
+    /** Below BOTH measures it is still reported as flat. */
+    @Test fun belowBothMeasuresIsStillFlat() {
+        val v = verdict(buckets = 328, hours = 24, days = 15, amp = 0.05, bpm = 3.0)
+        assertTrue(v, v.startsWith("unreadable") && v.contains("too flat"))
+    }
 }

From 05da4297eca5c364ac755c1d3cc859d74fd58c08 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 22:14:12 +1200
Subject: [PATCH 062/333] Bump build numbers for the next 10.6.1 staging build

versionCode 379 -> 380, CURRENT_PROJECT_VERSION 260 -> 261. MARKETING_VERSION
and versionName stay at 10.6.1 so the next real release is not pre-bumped.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 08cf811065..8a8879835c 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 379
+        versionCode = 380
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index c0282788d0..f79519c96c 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "260"
+    CURRENT_PROJECT_VERSION: "261"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 22523222ae2a8de4779598a12b3a2015d982c7bb Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 23:03:25 +1200
Subject: [PATCH 063/333] Mirror the SOLID rule in the diagnostic verdict
 (#1732)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mirror the SOLID rule in the diagnostic verdict

Caught on a device. The strap log read:

  Rhythm: amplitude 5.5 bpm on a 74.7 bpm mesor  (acrophase 16.1h)
  Verdict: solid — 15 days observed

while estimatePhase had assigned that wearer WIDE: SOLID now needs enough days
AND a proportional swing, and 5.5/74.7 = 7.4% is short of the 10% bar. The
verdict's tier branches were still days-only, so the diagnostic contradicted the
screen it exists to explain - the one thing that section must never do, and the
reason it is labelled "recomputed from the store, not the live snapshot".

The engine's OR was mirrored when the absolute floor landed; its TIER was not.
Both halves of a rule have to cross together.

Worse, the test written to prevent exactly this asserted `startsWith("solid")`
for a floor-only swing, so it PINNED the divergence rather than catching it. It
now asserts WIDE and that the line names why ("the swing clears only the
absolute floor"), with a companion case for the only combination that reads
solid.

Rather than add more hand-written cases, the re-review added a structural guard:
theVerdictNeverDisagreesWithTheEngine drives the REAL estimatePhase and the REAL
verdict over a 60-point grid of days x mesor x amplitude and requires the two to
agree. Case-by-case assertions have now failed to prevent this drift twice; a
cross-check fails the moment only one side of a rule is updated.

The guard was verified by mutation, not assumed: disabling the new tier branch
made it fail with "mesor=65.0 amp=4.6 days=15 -> engine says wide, verdict says
solid - 15 days observed", which is precisely the divergence the device log
showed. A guard that cannot fail would have been worse than none.

A later pass corrected what the guard feeds it. It passed the NOMINAL amp/mesor
where production passes the values read off the recovered cosinor fit, so it was
checking a pairing the app never makes - and the nearest grid point sits 0.0022
from the 10% threshold, close enough that a future point plus recovery error
would fail the test for a reason unrelated to the rule it guards. It now derives
both from the fit, exactly as circadianLines does, and was re-verified by
mutation after the change rather than assumed to still catch.

Android 4775 pass.
---
 .../com/noop/testcentre/AndroidDiagnostics.kt |  7 +++
 .../noop/testcentre/CircadianVerdictTest.kt   | 54 +++++++++++++++++++
 2 files changed, 61 insertions(+)

diff --git a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
index 8ac501f5ea..60a3e99c69 100644
--- a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
@@ -478,8 +478,15 @@ object AndroidDiagnostics {
         daysObserved < com.noop.analytics.CircadianEngine.minDaysForFit ->
             "unreadable — $daysObserved days observed, needs " +
                 "${com.noop.analytics.CircadianEngine.minDaysForFit}"
+        // SOLID needs BOTH axes, exactly as estimatePhase assigns it. Reading only the days here printed
+        // "solid" for a wearer the engine had marked WIDE — the diagnostic contradicting the very screen
+        // it exists to explain, which is the one thing this section must never do.
         daysObserved < com.noop.analytics.CircadianEngine.goodDaysForFit ->
             "wide — $daysObserved days observed"
+        relativeAmplitude != null &&
+            relativeAmplitude < com.noop.analytics.CircadianEngine.minRelativeAmplitude ->
+            "wide — $daysObserved days observed, but the swing clears only the absolute floor " +
+                "(${fmt1(relativeAmplitude * 100)}% of mesor)"
         else -> "solid — $daysObserved days observed"
     }
 
diff --git a/android/app/src/test/java/com/noop/testcentre/CircadianVerdictTest.kt b/android/app/src/test/java/com/noop/testcentre/CircadianVerdictTest.kt
index 77760db3b5..c27aa29ef0 100644
--- a/android/app/src/test/java/com/noop/testcentre/CircadianVerdictTest.kt
+++ b/android/app/src/test/java/com/noop/testcentre/CircadianVerdictTest.kt
@@ -74,6 +74,17 @@ class CircadianVerdictTest {
     @Test fun anAbsoluteSwingClearsTheGateInTheVerdictToo() {
         val v = verdict(buckets = 328, hours = 24, days = 15, amp = 0.073, bpm = 5.5)
         assertTrue(v, !v.contains("too flat"))
+        // WIDE, not solid: readable on the absolute floor but short of the proportional bar, which is
+        // exactly how estimatePhase tiers it. This assertion said "solid" and so PINNED a divergence
+        // between the diagnostic and the engine instead of catching it — the wearer it was written from
+        // had a log reading "solid" beside a card the engine had marked wide.
+        assertTrue(v, v.startsWith("wide"))
+        assertTrue(v, v.contains("absolute floor"))
+    }
+
+    /** A proportional swing with the days behind it is the only thing that reads solid. */
+    @Test fun onlyBothAxesReadSolid() {
+        val v = verdict(buckets = 328, hours = 24, days = 15, amp = 0.15, bpm = 9.0)
         assertTrue(v, v.startsWith("solid"))
     }
 
@@ -82,4 +93,47 @@ class CircadianVerdictTest {
         val v = verdict(buckets = 328, hours = 24, days = 15, amp = 0.05, bpm = 3.0)
         assertTrue(v, v.startsWith("unreadable") && v.contains("too flat"))
     }
+
+    /**
+     * The structural guard. This line has drifted from the engine TWICE — once when the absolute floor
+     * added an OR, once when SOLID started needing both axes — and each time a hand-written case either
+     * missed it or pinned it. So rather than assert more cases, drive the REAL engine and the REAL
+     * verdict over a grid and require they agree, which makes a future rule change fail here the moment
+     * only one side is updated.
+     */
+    @Test fun theVerdictNeverDisagreesWithTheEngine() {
+        fun bins(mesor: Double, amp: Double) = (0 until 24).map { h ->
+            CircadianEngine.ActivityBin(
+                h.toDouble(),
+                mesor + amp * kotlin.math.cos(2.0 * Math.PI * (h - 16.0) / 24.0),
+            )
+        }
+        for (days in listOf(5, 10, 15, 20)) {
+            for (mesor in listOf(45.0, 65.0, 74.7)) {
+                for (amp in listOf(3.0, 4.6, 5.5, 8.0, 12.0)) {
+                    val b = bins(mesor, amp)
+                    val est = CircadianEngine.estimatePhase(b, days, 7.0)
+                    // Feed the verdict what the ENGINE saw — the recovered fit — not the nominal inputs,
+                    // exactly as circadianLines does. Passing amp/mesor would test a pairing production
+                    // never uses, and would go flaky the moment a grid point sat within the cosinor's
+                    // recovery error of a threshold.
+                    val fit = CircadianEngine.cosinor(b)!!
+                    val rel = fit.amplitude / kotlin.math.abs(fit.mesor)
+                    val expected = when (est?.confidence) {
+                        CircadianEngine.PhaseConfidence.SOLID -> "solid"
+                        CircadianEngine.PhaseConfidence.WIDE -> "wide"
+                        CircadianEngine.PhaseConfidence.UNREADABLE -> "unreadable"
+                        null -> "no estimate"
+                    }
+                    // The counts are deliberately generous: this isolates the amplitude/days rules, which
+                    // are the halves that have drifted.
+                    val v = AndroidDiagnostics.circadianVerdict(328, 24, days, rel, fit.amplitude)
+                    assertTrue(
+                        "mesor=$mesor amp=$amp days=$days -> engine says $expected, verdict says \"$v\"",
+                        v.startsWith(expected),
+                    )
+                }
+            }
+        }
+    }
 }

From 3f872d06decf9fbd0246d5379f2b70cd84f37dbe Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 29 Aug 2026 23:03:29 +1200
Subject: [PATCH 064/333] Bump build numbers for the next 10.6.1 staging build

versionCode 380 -> 381, CURRENT_PROJECT_VERSION 261 -> 262. MARKETING_VERSION
and versionName stay at 10.6.1 so the next real release is not pre-bumped.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 8a8879835c..32e661f24a 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 380
+        versionCode = 381
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index f79519c96c..e25ac6b321 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "261"
+    CURRENT_PROJECT_VERSION: "262"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 95dd22aaa878c69637a987b62d3c8f2eadbee4c1 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 00:56:58 +1200
Subject: [PATCH 065/333] Make the body-clock dial readable on a real screen
 (#1733)

Make the body-clock dial readable on a real screen

Two problems a device screenshot showed that no test could. The geometry was
correct throughout - the arcs sat exactly where the data put them, 47 degrees
apart for a 3.1 h offset - but the picture did not communicate.

CONTRAST. The reference arc was drawn at 0.35 alpha of the same tint as the
actual one. That was calibrated against a plain card; with a custom background
image the card is translucent and the busy image shows through, washing the
reference arc out to near-invisible. Half of a comparison card was effectively
missing, which is the whole point of it.

The two arcs now differ by PATTERN as well as tint: the night slept is a solid
9 dp stroke in the Rest colour, where the clock wanted it is a 7 dp DASHED
stroke in restBright. Dashing reads without relying on colour or opacity at all,
so it survives translucency, either palette, and a reader who cannot separate
the two hues.

LEGEND. The card showed two bands with nothing saying which was which. "Outer
means ideal" is an arbitrary choice, not something a reader can infer. A compact
legend now labels them - "Last night" and "Your clock" - and its swatches are
drawn with the SAME stroke styles as the arcs, so the key cannot drift away from
the drawing. It is marked accessibilityHidden: the caption below already states
the comparison in words, and VoiceOver reading a colour key adds nothing.

Both platforms, visual parity. "Last night" reuses the string both catalogues
already carry; "Your clock" is new in all seven Android locale files and all
nine iOS locales.

Re-review caught the dash rendering SOLID. Round caps add width/2 at EACH end of
EVERY dash, so at a 7 dp stroke the first cut's [2, 7] dash produced 9 dp of ink
with a 0 dp gap - a line that looks solid while claiming to be dashed, which is
exactly the outcome this change exists to prevent. The legend swatch was as bad:
1 dp of gap at a 3 dp stroke. Dashed strokes now use BUTT caps, where the dash
numbers mean what they say (arc 3 on / 5 off, swatch 2 on / 3 off); the solid arc
keeps round caps for its ends. Worth knowing this cannot be caught by a test -
it renders green and wrong.

ORIENTATION. The four six-hourly ticks were drawn identically, and a comment
claimed they were "enough to orient the eye". They were not: four identical
marks at 90 degrees leave the ring symmetric under rotation as far as a reader
is concerned, so midnight and noon are indistinguishable and the arcs cannot be
placed on a clock at all. Midnight is now longer and brighter, which anchors the
whole dial - and does it without text, keeping the card clear of a 12-versus-24
hour clock-format question and its localization.

COLOUR. A new `restLine` token picks the Rest family's legible line colour per
palette. This is not a new value - it selects an existing one - and it is needed
because the families are NOT parallel: classic's restBright is a PURPLE accent
while modern's is the blue, and classic's restColor is the blue where modern's
is a muted steel. A card naming either token directly gets the right colour in
one palette and the wrong one in the other. Both arcs now use that one hue, told
apart by dash and weight rather than by a second colour, since two competing
blues were part of what made the card muddy over a background image.

RING WEIGHT. The dial's circle was a 1 dp hairline, which reads as a wireframe
against a busy surface. It is now a full-circle TRACK in surfaceInset at the
night arc's own width - the idiom RecoveryRing already uses - so the ring has
presence and the highlighted segment reads as a portion of a whole day. A
hairline remains at the reference radius so the dashed arc has a circle to
belong to.

ONSET MARKER. A bed now sits at sleep onset, the one element of the reference
design in #1680 that was missing. Without it the night arc has two
indistinguishable ends and the reader must work out which way round the day runs
before the picture means anything; the marker turns "somewhere in this band"
into "it started here". It rides on the arc it marks, so it moves with the night
rather than needing a placement rule of its own.

Re-review caught two parity breaks in that marker, neither visible to a test.
The first cut drew bed.double.fill on Apple and Icons.Filled.Bedtime on Android
- a MOON with zzz, not a bed at all - so the two platforms showed different
symbols for the same thing; Android now uses KingBed, the double-bed glyph. And
the Apple side used draw(_:at:), which renders an SF Symbol at its intrinsic
size from the environment font, against Kotlin's fixed 14 dp; it now draws into
an explicit 14 pt box so both platforms pin the same marker size.

TYPE-CHECK BUDGET. app-build then failed the macOS leg outright: "the compiler
is unable to type-check this expression in reasonable time". The Canvas body had
grown to 84 lines of inferred CGFloat arithmetic - track, rim, ticks, a nested
arc function, and a resolved SF Symbol - and Swift gave up on it. Nothing else
catches this: swiftc -parse passes, the iOS leg passed, and only app-build
compiles the app target at all.

Split into a typed DialGeometry plus drawTrack / drawTicks / drawArcs /
drawOnset, with explicit CGFloat and Angle annotations at the arithmetic. The
closure is now ten lines. Same trap the DevicesView gates hit.

Android 4775 pass, lintVitalFullRelease clean, i18n audit and doc lint clean.
Swift is syntax-checked locally; app-target Swift needs an app-build dispatch,
which has not run for this change.
---
 .../Sources/StrandDesign/Palette.swift        |  10 ++
 Strand/Resources/Localizable.xcstrings        |   3 +-
 Strand/Screens/BodyClockDialCard.swift        | 164 ++++++++++++++----
 .../java/com/noop/ui/BodyClockDialCard.kt     | 126 ++++++++++++--
 .../app/src/main/java/com/noop/ui/Theme.kt    |  11 ++
 .../app/src/main/res/values-de/strings.xml    |   2 +
 .../app/src/main/res/values-es/strings.xml    |   2 +
 .../app/src/main/res/values-fr/strings.xml    |   2 +
 .../app/src/main/res/values-pl/strings.xml    |   2 +
 .../src/main/res/values-pt-rPT/strings.xml    |   2 +
 .../app/src/main/res/values-zh/strings.xml    |   2 +
 android/app/src/main/res/values/strings.xml   |   2 +
 12 files changed, 284 insertions(+), 44 deletions(-)

diff --git a/Packages/StrandDesign/Sources/StrandDesign/Palette.swift b/Packages/StrandDesign/Sources/StrandDesign/Palette.swift
index 0e258d579b..c0a2adc2de 100644
--- a/Packages/StrandDesign/Sources/StrandDesign/Palette.swift
+++ b/Packages/StrandDesign/Sources/StrandDesign/Palette.swift
@@ -276,6 +276,16 @@ public enum StrandPalette {
     public static var restDeep: Color      { isClassic ? Color(light: "#203E73", dark: "#2A4C8F") : Color(light: "#234F9E", dark: "#2F6FCB") }
     public static var restBright: Color    { isClassic ? Color(light: "#6A4FC0", dark: "#8E6FD6") : Color(light: "#5790DA", dark: "#6FA8E8") }
     public static var restGlow: Color      { isClassic ? Color(light: "#3A80D6", dark: "#6FA8E8") : Color(light: "#3A80D6", dark: "#4A90E2") }
+    /// The Rest family's most legible LINE colour — for strokes that must read on a busy or translucent
+    /// surface, such as the body-clock dial's arcs over a custom background image.
+    ///
+    /// Introduces no new value: it selects the existing token that is the bright blue in each palette.
+    /// The families are not parallel — classic's `restBright` is a PURPLE accent while modern's is the
+    /// blue, and classic's `restColor` is the blue where modern's is a muted steel — so a card naming
+    /// either token directly gets the right colour in one palette and the wrong one in the other. Both
+    /// resolve to #6FA8E8 in dark.
+    public static var restLine: Color { isClassic ? restColor : restBright }
+
     public static var restGradient: Gradient { Gradient(colors: [restDeep, restBright]) }
 
     /// Stress — blue→gold→orange world / Classic green→amber→red.
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 00925990b9..47959eeaca 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -208232,7 +208232,8 @@
     "Morning type": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Morgentyp"}},"es":{"stringUnit":{"state":"translated","value":"Tipo matutino"}},"fr":{"stringUnit":{"state":"translated","value":"Type matinal"}},"it":{"stringUnit":{"state":"translated","value":"Tipo mattutino"}},"pl":{"stringUnit":{"state":"translated","value":"Typ poranny"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Tipo matutino"}},"ru":{"stringUnit":{"state":"translated","value":"Утренний тип"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"晨型人"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"晨型人"}}}},
     "Intermediate type": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Mischtyp"}},"es":{"stringUnit":{"state":"translated","value":"Tipo intermedio"}},"fr":{"stringUnit":{"state":"translated","value":"Type intermédiaire"}},"it":{"stringUnit":{"state":"translated","value":"Tipo intermedio"}},"pl":{"stringUnit":{"state":"translated","value":"Typ pośredni"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Tipo intermédio"}},"ru":{"stringUnit":{"state":"translated","value":"Промежуточный тип"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"中间型"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"中間型"}}}},
     "Evening type": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Abendtyp"}},"es":{"stringUnit":{"state":"translated","value":"Tipo vespertino"}},"fr":{"stringUnit":{"state":"translated","value":"Type vespéral"}},"it":{"stringUnit":{"state":"translated","value":"Tipo serale"}},"pl":{"stringUnit":{"state":"translated","value":"Typ wieczorny"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Tipo vespertino"}},"ru":{"stringUnit":{"state":"translated","value":"Вечерний тип"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"夜型人"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"夜型人"}}}},
-    "Body clock dial": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Zifferblatt der inneren Uhr"}},"es":{"stringUnit":{"state":"translated","value":"Esfera del reloj interno"}},"fr":{"stringUnit":{"state":"translated","value":"Cadran de l'horloge biologique"}},"it":{"stringUnit":{"state":"translated","value":"Quadrante dell'orologio biologico"}},"pl":{"stringUnit":{"state":"translated","value":"Tarcza zegara biologicznego"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Mostrador do relógio biológico"}},"ru":{"stringUnit":{"state":"translated","value":"Циферблат биологических часов"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"生物钟表盘"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"生理時鐘錶盤"}}}}
+    "Body clock dial": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Zifferblatt der inneren Uhr"}},"es":{"stringUnit":{"state":"translated","value":"Esfera del reloj interno"}},"fr":{"stringUnit":{"state":"translated","value":"Cadran de l'horloge biologique"}},"it":{"stringUnit":{"state":"translated","value":"Quadrante dell'orologio biologico"}},"pl":{"stringUnit":{"state":"translated","value":"Tarcza zegara biologicznego"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Mostrador do relógio biológico"}},"ru":{"stringUnit":{"state":"translated","value":"Циферблат биологических часов"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"生物钟表盘"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"生理時鐘錶盤"}}}},
+    "Your clock": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Deine innere Uhr"}},"es":{"stringUnit":{"state":"translated","value":"Tu reloj interno"}},"fr":{"stringUnit":{"state":"translated","value":"Votre horloge"}},"it":{"stringUnit":{"state":"translated","value":"Il tuo orologio"}},"pl":{"stringUnit":{"state":"translated","value":"Twój zegar"}},"pt-PT":{"stringUnit":{"state":"translated","value":"O seu relógio"}},"ru":{"stringUnit":{"state":"translated","value":"Ваши часы"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"你的生物钟"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"你的生理時鐘"}}}}
   },
   "version": "1.0"
 }
diff --git a/Strand/Screens/BodyClockDialCard.swift b/Strand/Screens/BodyClockDialCard.swift
index 0b05bd8d5e..28e35ebd4d 100644
--- a/Strand/Screens/BodyClockDialCard.swift
+++ b/Strand/Screens/BodyClockDialCard.swift
@@ -22,7 +22,9 @@ struct BodyClockDialCard: View {
     let actualBedHour: Double
     let actualWakeHour: Double
 
-    private var hue: Color { StrandPalette.restColor }
+    // One hue for both arcs, told apart by dash and weight rather than by a second colour. Two blues
+    // competed with the background image; a single legible one plus a dashed, lighter reference does not.
+    private var hue: Color { StrandPalette.restLine }
 
     /// The night's length, taken the long way round the clock when it crosses midnight.
     private var durationHours: Double {
@@ -54,6 +56,7 @@ struct BodyClockDialCard: View {
                         // Label only. The verdict is the caption Text below, a separate element, so giving
                         // the dial the same string as its VALUE made VoiceOver announce it twice.
                         .accessibilityLabel(Text("Body clock dial"))
+                    legend
                     Text(alignmentText)
                         .font(StrandFont.title2)
                         .foregroundStyle(StrandPalette.textPrimary)
@@ -91,43 +94,140 @@ struct BodyClockDialCard: View {
         return d <= 0 ? d + 24 : d
     }
 
+    /// The ring geometry, resolved once. Explicitly typed and hoisted out of the drawing closure: an
+    /// 84-line `Canvas` body of inferred `CGFloat` arithmetic exceeded the Swift type-checker's budget
+    /// and failed the macOS build outright ("unable to type-check this expression in reasonable time"),
+    /// which only app-build compiles — the same trap `DevicesView`'s gates hit.
+    private struct DialGeometry {
+        let centre: CGPoint
+        let outer: CGFloat
+        let inner: CGFloat
+
+        init(size: CGSize) {
+            let side: CGFloat = min(size.width, size.height)
+            centre = CGPoint(x: size.width / 2, y: size.height / 2)
+            outer = side / 2 - 10
+            inner = (side / 2 - 10) - 16
+        }
+    }
+
     private var dial: some View {
         Canvas { ctx, size in
-            let side = min(size.width, size.height)
-            let centre = CGPoint(x: size.width / 2, y: size.height / 2)
-            let outer = side / 2 - 10
-            let inner = outer - 16
-
-            // The bare ring, so an empty dial still reads as a clock rather than a broken chart.
-            ctx.stroke(Path(ellipseIn: CGRect(x: centre.x - outer, y: centre.y - outer,
-                                              width: outer * 2, height: outer * 2)),
-                       with: .color(StrandPalette.hairline), lineWidth: 1)
-
-            // Six-hourly ticks: enough to orient the eye, few enough not to compete with the arcs.
-            for tick in stride(from: 0.0, to: 24.0, by: 6.0) {
-                let a = angle(tick).radians
-                var p = Path()
-                p.move(to: CGPoint(x: centre.x + cos(a) * (outer - 4), y: centre.y + sin(a) * (outer - 4)))
-                p.addLine(to: CGPoint(x: centre.x + cos(a) * outer, y: centre.y + sin(a) * outer))
-                ctx.stroke(p, with: .color(StrandPalette.textTertiary.opacity(0.5)), lineWidth: 1)
-            }
+            let g = DialGeometry(size: size)
+            drawTrack(ctx, g)
+            drawTicks(ctx, g)
+            drawArcs(ctx, g)
+            drawOnset(ctx, g)
+        }
+        .frame(height: 170)
+    }
 
-            func arc(radius: CGFloat, from: Double, to: Double, colour: Color, width: CGFloat) {
-                var p = Path()
-                p.addArc(center: centre, radius: radius,
-                         startAngle: angle(from),
-                         endAngle: .degrees(angle(from).degrees + sweep(from, to) / 24 * 360),
-                         clockwise: false)
-                ctx.stroke(p, with: .color(colour), style: StrokeStyle(lineWidth: width, lineCap: .round))
-            }
+    /// A full-circle TRACK under the night arc, the same idiom `RecoveryRing` uses: a faint
+    /// `surfaceInset` band with the live arc drawn on top. A one-point hairline left the dial reading as
+    /// a thin wireframe against a busy background; a real track gives the ring presence and makes the
+    /// highlighted segment obvious as a portion of a whole day. The hairline stays at the reference
+    /// radius so the dashed arc has a circle to belong to.
+    private func drawTrack(_ ctx: GraphicsContext, _ g: DialGeometry) {
+        let trackRect = CGRect(x: g.centre.x - g.inner, y: g.centre.y - g.inner,
+                               width: g.inner * 2, height: g.inner * 2)
+        ctx.stroke(Path(ellipseIn: trackRect), with: .color(StrandPalette.surfaceInset),
+                   style: StrokeStyle(lineWidth: 9, lineCap: .round))
+        let rimRect = CGRect(x: g.centre.x - g.outer, y: g.centre.y - g.outer,
+                             width: g.outer * 2, height: g.outer * 2)
+        ctx.stroke(Path(ellipseIn: rimRect), with: .color(StrandPalette.hairline), lineWidth: 1)
+    }
+
+    /// Six-hourly ticks, with MIDNIGHT drawn longer and brighter. Four identical marks at 90 degrees
+    /// orient nothing — the ring is symmetric under rotation as far as they are concerned, so a reader
+    /// cannot tell midnight from noon and the arcs become unplaceable. One distinguished mark anchors the
+    /// whole dial, and does it without text, keeping the card clear of a 12-versus-24-hour format question.
+    private func drawTicks(_ ctx: GraphicsContext, _ g: DialGeometry) {
+        for tick in stride(from: 0.0, to: 24.0, by: 6.0) {
+            let isMidnight: Bool = tick == 0
+            let a: Double = angle(tick).radians
+            let len: CGFloat = isMidnight ? 9 : 4
+            let cosA: CGFloat = cos(a)
+            let sinA: CGFloat = sin(a)
+            var p = Path()
+            p.move(to: CGPoint(x: g.centre.x + cosA * (g.outer - len),
+                               y: g.centre.y + sinA * (g.outer - len)))
+            p.addLine(to: CGPoint(x: g.centre.x + cosA * g.outer, y: g.centre.y + sinA * g.outer))
+            let tint: Color = isMidnight ? StrandPalette.textSecondary
+                                         : StrandPalette.textTertiary.opacity(0.5)
+            ctx.stroke(p, with: .color(tint), lineWidth: isMidnight ? 1.5 : 1)
+        }
+    }
+
+    /// The two arcs differ by PATTERN as well as weight. Opacity alone was the first cut and it does not
+    /// survive the card being translucent over a custom background image — the reference arc washed out
+    /// to near-invisible on a real device, losing the comparison the card exists for. BUTT caps on the
+    /// dashed stroke: a round cap adds lineWidth/2 at EACH end of EVERY dash, so at a 7 pt stroke a
+    /// [2, 7] dash renders as 9 pt of ink with a 0 pt gap — a line that looks solid while claiming to be
+    /// dashed, the one outcome this must not produce.
+    private func drawArcs(_ ctx: GraphicsContext, _ g: DialGeometry) {
+        if let ideal {
+            strokeArc(ctx, g, radius: g.outer, from: ideal.bedHour, to: ideal.wakeHour,
+                      colour: hue.opacity(0.55), width: 7, dashed: true)
+        }
+        strokeArc(ctx, g, radius: g.inner, from: actualBedHour, to: actualWakeHour,
+                  colour: hue, width: 9, dashed: false)
+    }
+
+    private func strokeArc(_ ctx: GraphicsContext, _ g: DialGeometry, radius: CGFloat,
+                           from: Double, to: Double, colour: Color, width: CGFloat, dashed: Bool) {
+        let startAngle: Angle = angle(from)
+        let sweepDegrees: Double = sweep(from, to) / 24 * 360
+        var p = Path()
+        p.addArc(center: g.centre, radius: radius, startAngle: startAngle,
+                 endAngle: .degrees(startAngle.degrees + sweepDegrees), clockwise: false)
+        let dash: [CGFloat] = dashed ? [3, 5] : []
+        ctx.stroke(p, with: .color(colour),
+                   style: StrokeStyle(lineWidth: width, lineCap: dashed ? .butt : .round, dash: dash))
+    }
+
+    /// A bed at sleep ONSET. Without it the night arc has two indistinguishable ends and the reader must
+    /// work out which way round the day runs before the picture means anything — the marker turns
+    /// "somewhere in this band" into "it started here". Drawn INTO A RECT, not at a point: `draw(_:at:)`
+    /// renders an SF Symbol at its intrinsic size, which follows the environment font and would not match
+    /// the Kotlin twin's fixed 14 dp glyph.
+    private func drawOnset(_ ctx: GraphicsContext, _ g: DialGeometry) {
+        var bed = ctx.resolve(Image(systemName: "bed.double.fill"))
+        bed.shading = .color(hue)
+        let onset: Double = angle(actualBedHour).radians
+        let glyph: CGFloat = 14
+        let x: CGFloat = g.centre.x + cos(onset) * g.inner - glyph / 2
+        let y: CGFloat = g.centre.y + sin(onset) * g.inner - glyph / 2
+        ctx.draw(bed, in: CGRect(x: x, y: y, width: glyph, height: glyph))
+    }
 
-            if let ideal {
-                arc(radius: outer, from: ideal.bedHour, to: ideal.wakeHour,
-                    colour: hue.opacity(0.35), width: 8)
+    /// Which arc is which. Without this the card shows two bands and no way to tell them apart —
+    /// "outer means ideal" is an arbitrary choice, not something a reader can infer. The swatches are
+    /// drawn with the SAME stroke style as the arcs so the mapping cannot drift apart from the drawing.
+    private var legend: some View {
+        HStack(spacing: 14) {
+            legendItem(colour: hue, dashed: false, label: String(localized: "Last night"))
+            legendItem(colour: hue.opacity(0.55), dashed: true,
+                       label: String(localized: "Your clock"))
+            Spacer()
+        }
+        .accessibilityHidden(true)   // the caption below already states the comparison in words
+    }
+
+    private func legendItem(colour: Color, dashed: Bool, label: String) -> some View {
+        HStack(spacing: 5) {
+            Canvas { ctx, size in
+                var p = Path()
+                p.move(to: CGPoint(x: 0, y: size.height / 2))
+                p.addLine(to: CGPoint(x: size.width, y: size.height / 2))
+                ctx.stroke(p, with: .color(colour),
+                           style: StrokeStyle(lineWidth: 3, lineCap: dashed ? .butt : .round,
+                                              dash: dashed ? [2, 3] : []))
             }
-            arc(radius: inner, from: actualBedHour, to: actualWakeHour, colour: hue, width: 8)
+            .frame(width: 18, height: 4)
+            Text(label)
+                .font(StrandFont.footnote)
+                .foregroundStyle(StrandPalette.textTertiary)
         }
-        .frame(height: 170)
     }
 
     /// Rounded to five minutes: the underlying phase is an activity fit, so a to-the-minute caption would
diff --git a/android/app/src/main/java/com/noop/ui/BodyClockDialCard.kt b/android/app/src/main/java/com/noop/ui/BodyClockDialCard.kt
index dd9b4c3013..6647f3251d 100644
--- a/android/app/src/main/java/com/noop/ui/BodyClockDialCard.kt
+++ b/android/app/src/main/java/com/noop/ui/BodyClockDialCard.kt
@@ -4,16 +4,25 @@ import androidx.compose.foundation.Canvas
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.material3.Text
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Bedtime
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.geometry.Offset
 import androidx.compose.ui.geometry.Size
 import androidx.compose.ui.graphics.drawscope.Stroke
+import androidx.compose.ui.graphics.drawscope.translate
+import androidx.compose.ui.graphics.PathEffect
+import androidx.compose.ui.graphics.ColorFilter
 import androidx.compose.ui.graphics.StrokeCap
+import androidx.compose.ui.graphics.vector.rememberVectorPainter
 import androidx.compose.ui.semantics.contentDescription
 import androidx.compose.ui.semantics.semantics
 import androidx.compose.ui.unit.dp
@@ -49,7 +58,9 @@ fun BodyClockDialCard(
     actualBedHour: Double,
     actualWakeHour: Double,
 ) {
-    val hue = Palette.restColor
+    // One hue for both arcs, told apart by dash and weight rather than by a second colour. Two blues
+    // competed with the background image; a single legible one plus a dashed, lighter reference does not.
+    val hue = Palette.restLine
     // The night's length, taken the long way round the clock when it crosses midnight.
     val durationHours = ((actualWakeHour - actualBedHour) % 24.0).let { if (it <= 0.0) it + 24.0 else it }
     // null exactly when the night's length is non-positive or a full day — the same input that makes
@@ -58,6 +69,9 @@ fun BodyClockDialCard(
     val ideal = CircadianEngine.idealSleepWindow(estimate.tempMinHour, durationHours) ?: return
     val offsetHours = CircadianEngine.sleepWindowOffsetHours(estimate.tempMinHour, actualWakeHour)
     val alignment = alignmentText(offsetHours)
+    // Resolved outside the Canvas: rememberVectorPainter is a composable and cannot be called in a
+    // DrawScope.
+    val bedPainter = rememberVectorPainter(Icons.Filled.Bedtime)
     val dialLabel = uiString(R.string.l10n_body_clock_dial_card_body_clock_dial_03cdbc31)
 
     NoopCard(tint = hue) {
@@ -84,26 +98,45 @@ fun BodyClockDialCard(
                 val outer = side / 2f - 10.dp.toPx()
                 val inner = outer - 16.dp.toPx()
 
-                // The bare ring, so an empty dial still reads as a clock rather than a broken chart.
+                // A full-circle TRACK under the night arc, the same idiom RecoveryRing uses: a faint
+                // surfaceInset band with the live arc drawn on top. A one-dp hairline left the dial
+                // reading as a thin wireframe against a busy background; a real track gives the ring
+                // presence and makes the highlighted segment obvious as a portion of a whole day.
+                drawCircle(color = Palette.surfaceInset, radius = inner, center = centre,
+                    style = Stroke(width = 9.dp.toPx(), cap = StrokeCap.Round))
+                // A hairline at the reference radius so the dashed arc still has a circle to belong to.
                 drawCircle(color = Palette.hairline, radius = outer, center = centre,
                     style = Stroke(width = 1.dp.toPx()))
 
-                // Six-hourly ticks: enough to orient the eye, few enough not to compete with the arcs.
+                // Six-hourly ticks, with MIDNIGHT drawn longer and brighter. Four identical marks at 90
+                // degrees orient nothing — the ring is symmetric under rotation as far as they are
+                // concerned, so a reader cannot tell midnight from noon and the arcs become unplaceable.
+                // One distinguished mark anchors the whole dial, and does it without text, which keeps
+                // the card free of a 12-versus-24-hour clock-format question.
                 var tick = 0.0
                 while (tick < 24.0) {
+                    val isMidnight = tick == 0.0
                     val a = Math.toRadians(hourAngleDegrees(tick))
+                    val len = if (isMidnight) 9.dp.toPx() else 4.dp.toPx()
                     drawLine(
-                        color = Palette.textTertiary.copy(alpha = 0.5f),
-                        start = Offset(centre.x + (cos(a) * (outer - 4.dp.toPx())).toFloat(),
-                            centre.y + (sin(a) * (outer - 4.dp.toPx())).toFloat()),
+                        color = if (isMidnight) Palette.textSecondary else Palette.textTertiary.copy(alpha = 0.5f),
+                        start = Offset(centre.x + (cos(a) * (outer - len)).toFloat(),
+                            centre.y + (sin(a) * (outer - len)).toFloat()),
                         end = Offset(centre.x + (cos(a) * outer).toFloat(),
                             centre.y + (sin(a) * outer).toFloat()),
-                        strokeWidth = 1.dp.toPx(),
+                        strokeWidth = if (isMidnight) 1.5.dp.toPx() else 1.dp.toPx(),
                     )
                     tick += 6.0
                 }
 
-                fun arc(radius: Float, from: Double, to: Double, colour: androidx.compose.ui.graphics.Color, width: Float) {
+                fun arc(
+                    radius: Float,
+                    from: Double,
+                    to: Double,
+                    colour: androidx.compose.ui.graphics.Color,
+                    width: Float,
+                    dashed: Boolean,
+                ) {
                     drawArc(
                         color = colour,
                         startAngle = hourAngleDegrees(from).toFloat(),
@@ -111,16 +144,51 @@ fun BodyClockDialCard(
                         useCenter = false,
                         topLeft = Offset(centre.x - radius, centre.y - radius),
                         size = Size(radius * 2, radius * 2),
-                        style = Stroke(width = width, cap = StrokeCap.Round),
+                        // BUTT caps on the dashed arc, ROUND on the solid one. A round cap adds
+                        // width/2 at EACH end of EVERY dash, so at a 7 dp stroke a [2, 7] dash renders
+                        // as 9 dp of ink with a 0 dp gap — a line that looks solid while claiming to be
+                        // dashed, which is the one outcome this change must not produce. With butt caps
+                        // the numbers mean what they say.
+                        style = Stroke(
+                            width = width,
+                            cap = if (dashed) StrokeCap.Butt else StrokeCap.Round,
+                            pathEffect = if (dashed) {
+                                PathEffect.dashPathEffect(floatArrayOf(3.dp.toPx(), 5.dp.toPx()))
+                            } else {
+                                null
+                            },
+                        ),
                     )
                 }
 
+                // The two arcs differ by PATTERN as well as tint. Opacity alone was the first cut and it
+                // does not survive the card being translucent over a custom background image — the
+                // reference arc washed out to near-invisible on a real device, which loses the comparison
+                // the card exists for. A dash also reads without relying on colour at all.
                 if (ideal != null) {
-                    arc(outer, ideal.bedHour, ideal.wakeHour, hue.copy(alpha = 0.35f), 8.dp.toPx())
+                    arc(outer, ideal.bedHour, ideal.wakeHour,
+                        hue.copy(alpha = 0.55f), 7.dp.toPx(), dashed = true)
+                }
+                arc(inner, actualBedHour, actualWakeHour, hue, 9.dp.toPx(), dashed = false)
+
+                // A marker at sleep ONSET. Without it the night arc has two indistinguishable ends and
+                // the reader has to work out which way round the day runs before the picture means
+                // anything — it turns "somewhere in this band" into "it started here". Sits on the arc
+                // it marks, so it moves with the night rather than needing its own placement rule.
+                val onset = Math.toRadians(hourAngleDegrees(actualBedHour))
+                val glyph = 14.dp.toPx()
+                translate(
+                    left = centre.x + (cos(onset) * inner).toFloat() - glyph / 2f,
+                    top = centre.y + (sin(onset) * inner).toFloat() - glyph / 2f,
+                ) {
+                    with(bedPainter) {
+                        draw(Size(glyph, glyph), colorFilter = ColorFilter.tint(hue))
+                    }
                 }
-                arc(inner, actualBedHour, actualWakeHour, hue, 8.dp.toPx())
             }
 
+            DialLegend(hue)
+
             Text(alignment, style = NoopType.title2, color = Palette.textPrimary)
 
             CircadianEngine.chronotype(estimate)?.let { c ->
@@ -130,6 +198,42 @@ fun BodyClockDialCard(
     }
 }
 
+/**
+ * Which arc is which. Without this the card shows two bands and no way to tell them apart — "outer means
+ * ideal" is an arbitrary choice, not something a reader can infer. The swatches are drawn with the SAME
+ * stroke style as the arcs so the mapping cannot drift apart from the drawing. Twin of Apple `legend`.
+ */
+@Composable
+private fun DialLegend(hue: androidx.compose.ui.graphics.Color) {
+    Row(verticalAlignment = Alignment.CenterVertically) {
+        LegendItem(hue, dashed = false, label = uiString(R.string.l10n_body_clock_dial_card_last_night_6eaba4dd))
+        Spacer(Modifier.width(14.dp))
+        LegendItem(hue.copy(alpha = 0.55f), dashed = true, label = uiString(R.string.l10n_body_clock_dial_card_your_clock_1b91f5ee))
+    }
+}
+
+@Composable
+private fun LegendItem(colour: androidx.compose.ui.graphics.Color, dashed: Boolean, label: String) {
+    Row(verticalAlignment = Alignment.CenterVertically) {
+        Canvas(modifier = Modifier.size(width = 18.dp, height = 4.dp)) {
+            drawLine(
+                color = colour,
+                start = Offset(0f, size.height / 2f),
+                end = Offset(size.width, size.height / 2f),
+                strokeWidth = 3.dp.toPx(),
+                cap = if (dashed) StrokeCap.Butt else StrokeCap.Round,
+                pathEffect = if (dashed) {
+                    PathEffect.dashPathEffect(floatArrayOf(2.dp.toPx(), 3.dp.toPx()))
+                } else {
+                    null
+                },
+            )
+        }
+        Spacer(Modifier.width(5.dp))
+        Text(label, style = NoopType.footnote, color = Palette.textTertiary)
+    }
+}
+
 /** A unix second as a fractional LOCAL clock hour — the dial's only input beyond the phase estimate. */
 internal fun localClockHour(ts: Long): Double {
     val c = java.util.Calendar.getInstance()
diff --git a/android/app/src/main/java/com/noop/ui/Theme.kt b/android/app/src/main/java/com/noop/ui/Theme.kt
index f73379f277..71f685ab02 100644
--- a/android/app/src/main/java/com/noop/ui/Theme.kt
+++ b/android/app/src/main/java/com/noop/ui/Theme.kt
@@ -165,6 +165,17 @@ object Palette {
     val restBright get() = if (isClassic) classic.restBright else active.restBright
     val restGlow get() = if (isClassic) classic.restColor else active.restGlow
 
+    /**
+     * The Rest family's most legible LINE colour — for strokes that must read on a busy or translucent
+     * surface, such as the body-clock dial's arcs over a custom background image.
+     *
+     * Introduces no new value: it selects the existing token that is the bright blue in each palette. The
+     * families are not parallel — classic's restBright is a PURPLE accent while modern's is the blue, and
+     * classic's restColor is the blue where modern's is a muted steel — so a card naming either token
+     * directly gets the right colour in one palette and the wrong one in the other. Mirrors the Swift twin.
+     */
+    val restLine get() = if (isClassic) restColor else restBright
+
     val stressColor get() = if (isClassic) classic.stressColor else active.stressColor
     val stressDeep get() = if (isClassic) classic.stressDeep else active.stressDeep
     val stressBright get() = if (isClassic) classic.stressBright else active.stressBright
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 8cc4d03c77..5ee513b4b9 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2571,4 +2571,6 @@
     <string name="l10n_body_clock_dial_card_intermediate_type_a7b6b74c">Mischtyp</string>
     <string name="l10n_body_clock_dial_card_evening_type_3e1ce111">Abendtyp</string>
     <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Zifferblatt der inneren Uhr</string>
+    <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">Letzte Nacht</string>
+    <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Deine innere Uhr</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index afbb107de8..5a5f2b3d9b 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2557,4 +2557,6 @@
     <string name="l10n_body_clock_dial_card_intermediate_type_a7b6b74c">Tipo intermedio</string>
     <string name="l10n_body_clock_dial_card_evening_type_3e1ce111">Tipo vespertino</string>
     <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Esfera del reloj interno</string>
+    <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">Anoche</string>
+    <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Tu reloj interno</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 183f4000cd..7c485ccfbf 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2556,4 +2556,6 @@
     <string name="l10n_body_clock_dial_card_intermediate_type_a7b6b74c">Type intermédiaire</string>
     <string name="l10n_body_clock_dial_card_evening_type_3e1ce111">Type vespéral</string>
     <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Cadran de l\'horloge biologique</string>
+    <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">La nuit dernière</string>
+    <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Votre horloge</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 46df3c792e..6ccee3f22b 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2562,4 +2562,6 @@
     <string name="l10n_body_clock_dial_card_intermediate_type_a7b6b74c">Typ pośredni</string>
     <string name="l10n_body_clock_dial_card_evening_type_3e1ce111">Typ wieczorny</string>
     <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Tarcza zegara biologicznego</string>
+    <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">Ostatnia noc</string>
+    <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Twój zegar</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 4b45802e62..7650a0f1df 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2550,4 +2550,6 @@
     <string name="l10n_body_clock_dial_card_intermediate_type_a7b6b74c">Tipo intermédio</string>
     <string name="l10n_body_clock_dial_card_evening_type_3e1ce111">Tipo vespertino</string>
     <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Mostrador do relógio biológico</string>
+    <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">A noite passada</string>
+    <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">O seu relógio</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 1fb717cb8f..9748333fb0 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2471,4 +2471,6 @@
     <string name="l10n_body_clock_dial_card_intermediate_type_a7b6b74c">中间型</string>
     <string name="l10n_body_clock_dial_card_evening_type_3e1ce111">夜型人</string>
     <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">生物钟表盘</string>
+    <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">昨夜</string>
+    <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">你的生物钟</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 5d3f7e1c99..6c16dc6413 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2584,4 +2584,6 @@
     <string name="l10n_body_clock_dial_card_intermediate_type_a7b6b74c">Intermediate type</string>
     <string name="l10n_body_clock_dial_card_evening_type_3e1ce111">Evening type</string>
     <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Body clock dial</string>
+    <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">Last night</string>
+    <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Your clock</string>
 </resources>

From 9a91badf47cb6f822226245042bf807310420c02 Mon Sep 17 00:00:00 2001
From: Bernd Helm <bhelm@users.noreply.github.com>
Date: Sat, 29 Aug 2026 15:21:13 +0200
Subject: [PATCH 066/333] Read WHOOP physiology across all registered straps
 (#1730)

Raw physiology was stored under the device id that produced it, and several readers treated that write provenance as the boundary of the user's timeline - querying only the active device or the legacy my-whoop source. Replace, remove, archive or alternate a strap and the data stayed in the database but vanished from Stress, Sleep, AI Coach and the timelines.

Reads now resolve one deterministic source set everywhere: the explicitly active source first, then every registered WHOOP strap in stable registry order including archived ones, then canonical my-whoop last, duplicates removed preserving that precedence. Archived straps are deliberately included - archiving stops future connection attempts and must not orphan retained history. Non-WHOOP devices are not folded in.

Android's ambiguous device-scoped repository names are gone: owner/export/diagnostic reads take explicit *ForDevice APIs while personal timeline consumers use only union APIs, and an architecture test stops the old names returning. A shared JSON oracle pins source ordering, legacy collapse, non-WHOOP handling and R-R identity across both platforms.

KNOWN BOUNDARY, accepted knowingly. R-R feeds DaytimeStress, which buckets beats by hour and takes RMSSD - a root mean square of SUCCESSIVE DIFFERENCES. Where two straps were genuinely worn at the same time their beats interleave, and the differences then carry the inter-device offset rather than real beat-to-beat variability, so stress over such a window is not a doubled number but a different quantity. It stacks on #1008 / #1118, where 4.0 R-R already over-counts. This is merged with that understood: alternating straps, the case the change is aimed at, never interleave, and the history-vanishing bug it removes affects every strap swap. A wear-interval or device-era ownership signal is what would let R-R join the union safely.

app-build was dispatched before merging: both legs green. The two new StrandTests files run only under that workflow, which is disabled by default, so they had not executed on the author's Linux host or in the 15 normal checks.

Android 4788 tests pass, checks 15/15.

Thanks @bhelm.
---
 .../Sources/WhoopProtocol/Streams.swift       |  26 +-
 .../WhoopStore/Sources/WhoopStore/Reads.swift |   4 +-
 Strand/AI/AICoach.swift                       |   6 +-
 Strand/Data/Repository.swift                  | 153 ++++++++---
 Strand/Liquid/LiquidTodayView.swift           |   2 +-
 Strand/Screens/SleepView.swift                |   4 +-
 Strand/Screens/StressView.swift               |   9 +-
 Strand/Screens/TodayView.swift                |   2 +-
 Strand/Screens/V5PillarHosts.swift            |  18 +-
 StrandTests/DeviceRawSourceParityTests.swift  | 118 +++++++++
 StrandTests/RawPhysiologyUnionTests.swift     | 123 +++++++++
 Tools/parity_cases/device_raw_sources.json    |  79 ++++++
 .../app/src/main/java/com/noop/ai/AiCoach.kt  |   7 +-
 .../com/noop/analytics/IntelligenceEngine.kt  |  26 +-
 .../com/noop/analytics/SleepStageHealer.kt    |   8 +-
 .../java/com/noop/ble/SourceCoordinator.kt    |   4 +-
 .../main/java/com/noop/ble/WhoopBleClient.kt  |   8 +-
 .../java/com/noop/data/WhoopRepository.kt     | 144 +++++++---
 .../com/noop/ingest/HealthConnectWriter.kt    |   4 +-
 .../java/com/noop/ingest/RawSensorExport.kt   |   4 +-
 .../com/noop/testcentre/AndroidDiagnostics.kt |   6 +-
 .../java/com/noop/ui/FullDayChartScreen.kt    |   6 +-
 .../src/main/java/com/noop/ui/SleepScreen.kt  |   5 +-
 .../src/main/java/com/noop/ui/StressScreen.kt |  16 +-
 .../main/java/com/noop/ui/TestCentreScreen.kt |   4 +-
 .../IntelligenceEngineJacocoBudgetTest.kt     |   2 +-
 .../noop/data/DeviceRawSourceParityTest.kt    | 107 ++++++++
 .../noop/data/RawTimelineRepositoryDaoTest.kt | 250 ++++++++++++++++++
 .../com/noop/data/RawTimelineUnionTest.kt     |  51 ++++
 .../noop/ui/RawSensorDeviceScopeAuditTest.kt  | 208 +++++++++++++++
 .../com/noop/ui/StressRawReadScopeTest.kt     |  33 +++
 31 files changed, 1283 insertions(+), 154 deletions(-)
 create mode 100644 StrandTests/DeviceRawSourceParityTests.swift
 create mode 100644 StrandTests/RawPhysiologyUnionTests.swift
 create mode 100644 Tools/parity_cases/device_raw_sources.json
 create mode 100644 android/app/src/test/java/com/noop/data/DeviceRawSourceParityTest.kt
 create mode 100644 android/app/src/test/java/com/noop/data/RawTimelineRepositoryDaoTest.kt
 create mode 100644 android/app/src/test/java/com/noop/data/RawTimelineUnionTest.kt
 create mode 100644 android/app/src/test/java/com/noop/ui/RawSensorDeviceScopeAuditTest.kt
 create mode 100644 android/app/src/test/java/com/noop/ui/StressRawReadScopeTest.kt

diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/Streams.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/Streams.swift
index 4a8a30701d..6b83a63e41 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/Streams.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/Streams.swift
@@ -57,8 +57,30 @@ public struct RRInterval: Equatable, Codable {
     /// that second, so the over-count is accumulation across offloads. WHOOP's wire format has no
     /// channel field, so `srcChannel` can never answer this for a strap — `ord` is what is left.
     public let ord: Int?
-    public init(ts: Int, rrMs: Int, srcChannel: RRSourceChannel? = nil, ord: Int? = nil) {
-        self.ts = ts; self.rrMs = rrMs; self.srcChannel = srcChannel; self.ord = ord
+    /// Storage identity for equal beats in the same second. Defaults to zero so wire decoders and
+    /// callers that predate the widened database key remain source- and behaviour-compatible.
+    public let seq: Int
+    public init(ts: Int, rrMs: Int, srcChannel: RRSourceChannel? = nil, ord: Int? = nil, seq: Int = 0) {
+        self.ts = ts; self.rrMs = rrMs; self.srcChannel = srcChannel; self.ord = ord; self.seq = seq
+    }
+
+    private enum CodingKeys: String, CodingKey { case ts, rrMs, srcChannel, ord, seq }
+    public init(from decoder: Decoder) throws {
+        let c = try decoder.container(keyedBy: CodingKeys.self)
+        ts = try c.decode(Int.self, forKey: .ts)
+        rrMs = try c.decode(Int.self, forKey: .rrMs)
+        srcChannel = try c.decodeIfPresent(RRSourceChannel.self, forKey: .srcChannel)
+        ord = try c.decodeIfPresent(Int.self, forKey: .ord)
+        seq = try c.decodeIfPresent(Int.self, forKey: .seq) ?? 0
+    }
+    public func encode(to encoder: Encoder) throws {
+        var c = encoder.container(keyedBy: CodingKeys.self)
+        try c.encode(ts, forKey: .ts)
+        try c.encode(rrMs, forKey: .rrMs)
+        try c.encodeIfPresent(srcChannel, forKey: .srcChannel)
+        try c.encodeIfPresent(ord, forKey: .ord)
+        // Preserve the legacy encoded shape for the overwhelmingly common seq=0 row.
+        if seq != 0 { try c.encode(seq, forKey: .seq) }
     }
 }
 
diff --git a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
index 73a3971387..68341f9b08 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
@@ -216,7 +216,7 @@ extension WhoopStore {
     public func rrIntervals(deviceId: String, from: Int, to: Int, limit: Int) async throws -> [RRInterval] {
         try syncRead { db in
             try Row.fetchAll(db, sql: """
-                SELECT ts, rrMs, srcChannel, ord FROM rrInterval
+                SELECT ts, rrMs, srcChannel, ord, seq FROM rrInterval
                 WHERE deviceId = ? AND ts >= ? AND ts <= ?
                 AND (srcChannel IS NULL OR srcChannel <> ?)
                 AND (tsSuspect IS NULL OR tsSuspect <> 1)   -- #1073: exclude future-stamped beats
@@ -225,7 +225,7 @@ extension WhoopStore {
                 .map { row in
                     RRInterval(ts: row["ts"], rrMs: row["rrMs"],
                                srcChannel: (row["srcChannel"] as Int?).flatMap(RRSourceChannel.init(rawValue:)),
-                               ord: row["ord"] as Int?)
+                               ord: row["ord"] as Int?, seq: row["seq"])
                 }
         }
     }
diff --git a/Strand/AI/AICoach.swift b/Strand/AI/AICoach.swift
index 0677802d8d..afc490242e 100644
--- a/Strand/AI/AICoach.swift
+++ b/Strand/AI/AICoach.swift
@@ -553,7 +553,7 @@ final class AICoachEngine: ObservableObject {
     }
 
     /// One derived stress line for the coach context: the Baevsky Stress Index over TODAY's R-R, read
-    /// via the store exactly as `StressView` does (`storeHandle()` → `rrIntervals(deviceId:from:to:)`),
+    /// via the same device-aware repository R-R union as `StressView`,
     /// then summarised to a single number with `StressIndex.stressIndex(rr:)`. Returns nil when the
     /// store is unavailable or there are too few clean beats (the histogram needs >= 20), so the line is
     /// simply absent, never a fabricated value. Summary-only: the raw R-R never leaves the device.
@@ -561,9 +561,7 @@ final class AICoachEngine: ObservableObject {
         let cal = Calendar.current
         let from = Int(cal.startOfDay(for: Date()).timeIntervalSince1970)
         let to = Int(Date().timeIntervalSince1970)
-        guard let store = await repo.storeHandle() else { return nil }
-        let rr = (try? await store.rrIntervals(
-            deviceId: repo.deviceId, from: from, to: to, limit: 200_000)) ?? []
+        let rr = await repo.rrIntervals(from: from, to: to, limit: 200_000)
         guard let si = StressIndex.stressIndex(rr: rr) else { return nil }
         return Self.stressIndexSummary(si: si)
     }
diff --git a/Strand/Data/Repository.swift b/Strand/Data/Repository.swift
index 5bd913a6b3..07076c60fd 100644
--- a/Strand/Data/Repository.swift
+++ b/Strand/Data/Repository.swift
@@ -266,6 +266,34 @@ final class Repository: ObservableObject {
 
     // MARK: - Union reads (active strap + canonical)
     //
+    /// Raw physiological streams are a worn timeline, not a property of whichever strap is active now.
+    /// Resolve every registered physical WHOOP, active first, and keep the canonical import namespace as
+    /// the final fallback. Archived devices intentionally remain: archive means "stop connecting, keep
+    /// data", and historical timelines must not orphan their retained samples. The active id remains first
+    /// even for a non-WHOOP provider, preserving the pre-multi-strap cross-provider path.
+    private func rawPhysiologyReadIds(store: WhoopStore) -> [String] {
+        let paired = (try? DeviceRegistryStore(dbQueue: store.registryWriter).all()) ?? []
+        let registeredWhoops = paired.filter {
+            $0.brand.caseInsensitiveCompare("WHOOP") == .orderedSame
+        }.map(\.id)
+        return Self.rawWhoopSourceIds(activeDeviceId: deviceId, registeredWhoopIds: registeredWhoops)
+    }
+
+    /// Pure ordering contract shared with Android's parity guard: current active source first, every other
+    /// registered WHOOP in stable registry order, canonical history last; duplicates collapse.
+    nonisolated static func rawWhoopSourceIds(activeDeviceId: String,
+                                             registeredWhoopIds: [String]) -> [String] {
+        let canonical = Self.whoopSource
+        let middle = registeredWhoopIds.filter { $0 != activeDeviceId && $0 != canonical }
+        return ([activeDeviceId] + middle + [canonical]).reduce(into: [String]()) {
+            if !$0.contains($1) { $0.append($1) }
+        }
+    }
+
+    private func rawComputedReadIds(store: WhoopStore) -> [String] {
+        rawPhysiologyReadIds(store: store).map { $0.hasSuffix("-noop") ? $0 : $0 + "-noop" }
+    }
+
     // Each helper reads the SAME store query across `importedReadIds` (active strap + canonical "my-whoop")
     // and concatenates the rows, ACTIVE STRAP FIRST. The callers feed the concatenated rows into the SAME
     // per-day dedup they already used (mergeDaily/mergeSleep key by day; the daily/series facades dedup
@@ -298,7 +326,7 @@ final class Repository: ObservableObject {
     func gravitySamplesUnion(from: Int, to: Int, limit: Int = 200_000) async -> [GravitySample] {
         guard let store = await storeHandle() else { return [] }
         var lists: [[GravitySample]] = []
-        for id in importedReadIds {   // active strap FIRST → it wins any shared timestamp
+        for id in rawPhysiologyReadIds(store: store) {   // active strap FIRST → it wins any shared timestamp
             lists.append((try? await store.gravitySamples(deviceId: id, from: from, to: to, limit: limit)) ?? [])
         }
         return Self.mergeGravityByTs(lists)
@@ -319,6 +347,27 @@ final class Repository: ObservableObject {
         return byTs.values.sorted { $0.ts < $1.ts }
     }
 
+    /// Merge R-R reads without treating a timestamp as a beat identity. Several real beats can share a
+    /// one-second timestamp; only the complete storage identity `(ts, rrMs, seq)` is a duplicate across
+    /// namespaces. The first list is the active strap and therefore wins exact duplicates.
+    nonisolated static func mergeRRByIdentity(_ lists: [[RRInterval]]) -> [RRInterval] {
+        if lists.count == 1 { return lists[0] }
+        struct BeatKey: Hashable { let ts: Int; let rrMs: Int; let seq: Int }
+        var seen = Set<BeatKey>()
+        var out: [RRInterval] = []
+        for list in lists {
+            for beat in list where seen.insert(BeatKey(ts: beat.ts, rrMs: beat.rrMs, seq: beat.seq)).inserted {
+                out.append(beat)
+            }
+        }
+        return out.sorted {
+            if $0.ts != $1.ts { return $0.ts < $1.ts }
+            if $0.seq != $1.seq { return $0.seq < $1.seq }
+            if $0.rrMs != $1.rrMs { return $0.rrMs < $1.rrMs }
+            return ($0.ord ?? Int.min) < ($1.ord ?? Int.min)
+        }
+    }
+
     /// One day held by two source ids in the SAME bucket, folded into `winner`'s row: `winner` keeps every
     /// column it carries (NON-nil — a measured zero is a reading) and `filler` supplies only the ones it
     /// left nil. Whole-row first-wins let a hollow row (steps and nothing else) discard a complete one, and
@@ -370,11 +419,11 @@ final class Repository: ObservableObject {
         return byDay.values.sorted { $0.day < $1.day }
     }
 
-    /// Sleep sessions across the imported union for a ts range, keeping ALL sessions per day (a nap + a main
+    /// Sleep sessions across every registered WHOOP source for a ts range, keeping ALL sessions per day (a nap + a main
     /// night both survive) and dropping only EXACT-duplicate blocks (same start+end) recorded under both
     /// union ids. The downstream `mergeSleep`/`userEditedDays` do the per-day collapse, exactly as before.
     private func unionSleepSessions(store: WhoopStore, from: Int, to: Int, limit: Int = 4000) async -> [CachedSleepSession] {
-        Self.dedupBlocks(await unionRawSleepBlocks(store: store, ids: importedReadIds, from: from, to: to, limit: limit))
+        Self.dedupBlocks(await unionRawSleepBlocks(store: store, ids: rawPhysiologyReadIds(store: store), from: from, to: to, limit: limit))
     }
 
     /// Computed ("-noop") daily-metric rows across the computed union, DEDUPED per day (active strap's
@@ -389,10 +438,10 @@ final class Repository: ObservableObject {
         return byDay.values.sorted { $0.day < $1.day }
     }
 
-    /// Computed ("-noop") sleep sessions across the computed union, keeping ALL sessions per day and dropping
+    /// Computed ("-noop") sleep sessions across every registered WHOOP source, keeping ALL sessions per day and dropping
     /// only EXACT-duplicate blocks recorded under both computed siblings.
     private func unionComputedSleepSessions(store: WhoopStore, from: Int, to: Int, limit: Int = 4000) async -> [CachedSleepSession] {
-        Self.dedupBlocks(await unionRawSleepBlocks(store: store, ids: computedReadIds, from: from, to: to, limit: limit))
+        Self.dedupBlocks(await unionRawSleepBlocks(store: store, ids: rawComputedReadIds(store: store), from: from, to: to, limit: limit))
     }
 
     /// ALL sleep blocks across `ids` for a ts range, concatenated (NOT collapsed to one per day, used by
@@ -1060,11 +1109,12 @@ final class Repository: ObservableObject {
         // UNION the active strap + canonical so the HR trend renders whether the landed day's raw sits under
         // the re-added strap (live) or the canonical history. Deduped by ts (active strap wins) so an overlap
         // never double-counts; sorted ascending. Single-device install reads one id (byte-identical).
-        guard deviceId != canonicalDeviceId else {
+        let ids = rawPhysiologyReadIds(store: store)
+        guard ids.count != 1 else {
             return (try? await store.hrSamples(deviceId: deviceId, from: from, to: to, limit: limit)) ?? []
         }
         var byTs: [Int: HRSample] = [:]
-        for id in importedReadIds {
+        for id in ids {
             for s in (try? await store.hrSamples(deviceId: id, from: from, to: to, limit: limit)) ?? [] where byTs[s.ts] == nil {
                 byTs[s.ts] = s
             }
@@ -1072,6 +1122,21 @@ final class Repository: ObservableObject {
         return byTs.values.sorted { $0.ts < $1.ts }
     }
 
+    /// R-R beats across the active physical WHOOP and canonical history. Exact duplicates are removed
+    /// active-first, while same-timestamp distinct beats remain intact.
+    func rrIntervals(from: Int, to: Int, limit: Int = 8000) async -> [RRInterval] {
+        guard let store = await ensureStore() else { return [] }
+        let ids = rawPhysiologyReadIds(store: store)
+        guard ids.count != 1 else {
+            return (try? await store.rrIntervals(deviceId: deviceId, from: from, to: to, limit: limit)) ?? []
+        }
+        var lists: [[RRInterval]] = []
+        for id in ids {
+            lists.append((try? await store.rrIntervals(deviceId: id, from: from, to: to, limit: limit)) ?? [])
+        }
+        return Self.mergeRRByIdentity(lists)
+    }
+
     /// Logical day-start of the most recent day the active device has HR data for, or nil when the store is
     /// empty. Lets the Deep Timeline open on a day that actually has data instead of a possibly-empty today
     /// right after a history sync , the #597 root cause (the timeline was today-only with no way back).
@@ -1103,19 +1168,11 @@ final class Repository: ObservableObject {
 
     func hrBuckets(from: Int, to: Int, bucketSeconds: Int = 300) async -> [HRBucket] {
         guard let store = await ensureStore() else { return [] }
-        // UNION the active strap + canonical for the trend chart. Per bucket-start the active strap wins; a
+        // UNION all registered WHOOP straps + canonical for the trend chart. Per bucket-start the active strap wins; a
         // raw HR window almost never overlaps between the two namespaces (different time periods), so the
         // per-bucket mean stays faithful. Single-device install reads one id (byte-identical).
-        guard deviceId != canonicalDeviceId else {
-            return (try? await store.hrBuckets(deviceId: deviceId, from: from, to: to, bucketSeconds: bucketSeconds)) ?? []
-        }
-        var byStart: [Int: HRBucket] = [:]
-        for id in importedReadIds {
-            for b in (try? await store.hrBuckets(deviceId: id, from: from, to: to, bucketSeconds: bucketSeconds)) ?? [] where byStart[b.ts] == nil {
-                byStart[b.ts] = b
-            }
-        }
-        return byStart.values.sorted { $0.ts < $1.ts }
+        return await hrBuckets(deviceIds: rawPhysiologyReadIds(store: store), from: from, to: to,
+                               bucketSeconds: bucketSeconds)
     }
 
     /// The latest (greatest-ts) non-nil @63 activity class over `[from, to]`, read across the active strap +
@@ -1199,11 +1256,13 @@ final class Repository: ObservableObject {
         guard let store = await ensureStore() else { return [] }
         let now = Int(Date().timeIntervalSince1970)
         let lo = now - days * 86_400, hi = now + 86_400
+        let rawIds = rawPhysiologyReadIds(store: store)
+        let rawComputedIds = rawComputedReadIds(store: store)
         // UNION the active strap + canonical (imported) and their computed siblings, keeping ALL blocks (not
         // one per day, this view expands split sleeps), but dropping any block that appears under BOTH union
         // ids (same start+end key) so a day present in both namespaces isn't double-listed.
-        let imported = Self.dedupBlocks(await unionRawSleepBlocks(store: store, ids: importedReadIds, from: lo, to: hi))
-        let computed = Self.dedupBlocks(await unionRawSleepBlocks(store: store, ids: computedReadIds, from: lo, to: hi))
+        let imported = Self.dedupBlocks(await unionRawSleepBlocks(store: store, ids: rawIds, from: lo, to: hi))
+        let computed = Self.dedupBlocks(await unionRawSleepBlocks(store: store, ids: rawComputedIds, from: lo, to: hi))
         let cal = Calendar.current
         func endDay(_ s: CachedSleepSession) -> Date {
             cal.startOfDay(for: Date(timeIntervalSince1970: TimeInterval(s.endTs)))
@@ -1221,12 +1280,36 @@ final class Repository: ObservableObject {
     /// already chosen the main-night GROUP (the 6.1.1 bridged group) and passes those blocks' starts; we
     /// only fetch each one's stored series so the Sleep tab can lay them along the hypnogram's timeline.
     /// A start with no stored series is omitted from the result (its key is absent).
-    func sessionMotions(starts: [Int]) async -> [Int: [Double]] {
-        guard !starts.isEmpty, let store = await ensureStore() else { return [:] }
-        // One batched read keyed by startTs, not a single-row SELECT per session start. The store's
-        // batched accessor keeps the exact contract of the old loop: starts with no (or an empty) series
-        // are omitted from the result.
-        return (try? await store.sessionMotions(deviceId: computedDeviceId, sessionStarts: starts)) ?? [:]
+    func sessionMotions(sessions: [CachedSleepSession]) async -> [Int: [Double]] {
+        guard !sessions.isEmpty, let store = await ensureStore() else { return [:] }
+        let rawIds = rawPhysiologyReadIds(store: store)
+        let computedIds = rawComputedReadIds(store: store)
+        var out: [Int: [Double]] = [:]
+        for session in sessions where out[session.startTs] == nil {
+            // CachedSleepSession has no provenance field. Re-resolve the exact visible block using the
+            // same imported-wins order as allSleepSessions, then probe its computed owner first.
+            var owner: String?
+            for id in rawIds + computedIds {
+                let rows = (try? await store.sleepSessions(deviceId: id, from: session.startTs,
+                                                           to: session.startTs, limit: 4)) ?? []
+                if rows.contains(where: { $0.startTs == session.startTs && $0.endTs == session.endTs }) {
+                    owner = id
+                    break
+                }
+            }
+            let ownerComputed = owner.map { $0.hasSuffix("-noop") ? $0 : $0 + "-noop" }
+            let sources = ([ownerComputed].compactMap { $0 } + computedIds).reduce(into: [String]()) {
+                if !$0.contains($1) { $0.append($1) }
+            }
+            for id in sources {
+                if let motion = (try? await store.sessionMotion(deviceId: id, sessionStart: session.startTs)) ?? nil,
+                   !motion.isEmpty {
+                    out[session.startTs] = motion
+                    break
+                }
+            }
+        }
+        return out
     }
 
     /// The user's learned habitual midsleep (local time-of-day seconds), or nil under
@@ -1243,10 +1326,12 @@ final class Repository: ObservableObject {
         guard let store = await ensureStore() else { return nil }
         let now = Int(Date().timeIntervalSince1970)
         let lo = now - days * 86_400, hi = now + 86_400
-        // UNION active strap + canonical (imported) and their computed siblings, de-duplicating identical
-        // blocks recorded under both ids so a day present in both namespaces doesn't double-weight the learner.
-        let imported = Self.dedupBlocks(await unionRawSleepBlocks(store: store, ids: importedReadIds, from: lo, to: hi))
-        let computed = Self.dedupBlocks(await unionRawSleepBlocks(store: store, ids: computedReadIds, from: lo, to: hi))
+        // Use the SAME all-registered-WHOOP source set as allSleepSessions. Otherwise a removed/replaced
+        // strap's visible retained nights would not teach the selector that chooses their main block.
+        let rawIds = rawPhysiologyReadIds(store: store)
+        let rawComputedIds = rawComputedReadIds(store: store)
+        let imported = Self.dedupBlocks(await unionRawSleepBlocks(store: store, ids: rawIds, from: lo, to: hi))
+        let computed = Self.dedupBlocks(await unionRawSleepBlocks(store: store, ids: rawComputedIds, from: lo, to: hi))
         let offsetSec = TimeZone.current.secondsFromGMT()
         let blocks = (imported + computed).compactMap { s -> SleepStageTotals.HistoryBlock? in
             let start = s.effectiveStartTs, end = s.endTs
@@ -1720,11 +1805,9 @@ final class Repository: ObservableObject {
     func timelineSeries(metric: TimelineMetric, from: Int, to: Int,
                         targetPoints: Int = 600, source: String? = nil) async -> TimelineSeries {
         guard to > from, let store = await ensureStore() else { return .empty }
-        // Default (no explicit source) → the user's own strap, UNIONed with the canonical "my-whoop" so the
-        // Deep Timeline renders whether the landed day's raw sits under the re-added strap or the canonical
-        // history. An explicit source (a per-source page) reads that source verbatim. `unionIds` is one id
-        // on a single-device install (byte-identical) and dedups raw by ts (active strap wins).
-        let unionIds: [String] = source.map { [$0] } ?? importedReadIds
+        // Default (no explicit source) → the complete worn WHOOP timeline: active, every registered prior
+        // strap, then canonical history. An explicit per-source page still reads that source verbatim.
+        let unionIds: [String] = source.map { [$0] } ?? rawPhysiologyReadIds(store: store)
         let bucket = Self.timelineBucketSeconds(spanSeconds: to - from, targetPoints: targetPoints)
         let isRaw = bucket <= 1
 
diff --git a/Strand/Liquid/LiquidTodayView.swift b/Strand/Liquid/LiquidTodayView.swift
index 855f678e66..c8607dd3df 100644
--- a/Strand/Liquid/LiquidTodayView.swift
+++ b/Strand/Liquid/LiquidTodayView.swift
@@ -1593,7 +1593,7 @@ struct LiquidTodayView: View {
         if HostedCardPrefs.decodeEnabled(hostedCardsRaw).contains(where: { $0.origin == sleepOrigin }) {
             let hostedSessions = await repo.allSleepSessions()
             let hostedHabitual = await repo.habitualMidsleepSec()
-            let hostedMotion = await repo.sessionMotions(starts: hostedSessions.map { $0.startTs })
+            let hostedMotion = await repo.sessionMotions(sessions: hostedSessions)
             hostedSleepModel = SleepModel.build(SleepModelInputs(
                 days: repo.days,
                 sleeps: repo.sleeps,
diff --git a/Strand/Screens/SleepView.swift b/Strand/Screens/SleepView.swift
index 6d24b89938..3fbbab98b1 100644
--- a/Strand/Screens/SleepView.swift
+++ b/Strand/Screens/SleepView.swift
@@ -75,7 +75,7 @@ struct SleepView: View {
     @State private var habitualMidsleepSec: Int? = nil
 
     /// Persisted per-epoch MOTION series keyed by each session's detected `startTs` (#407). Loaded in the
-    /// same `.task` as `allSessions` from `repo.sessionMotions(starts:)`, then laid along the hypnogram for
+    /// same `.task` as `allSessions` from `repo.sessionMotions(sessions:)`, then laid along the hypnogram for
     /// the SAME main-night GROUP blocks the hero resolved (mergeDay's group) — we do NOT re-resolve the
     /// night, only read the already-chosen group's stored motion. A block with no stored series stays absent
     /// (honest empty state for older rows whose `motionJSON` is NULL). Refreshed with `allSessions`.
@@ -208,7 +208,7 @@ struct SleepView: View {
                 habitualMidsleepSec = await repo.habitualMidsleepSec()
                 // Per-epoch motion for every block (#407), keyed by detected start. mergeDay reads only the
                 // already-resolved group's entries — this just pre-fetches them all so the model build is sync.
-                motionByStart = await repo.sessionMotions(starts: allSessions.map { $0.startTs })
+                motionByStart = await repo.sessionMotions(sessions: allSessions)
                 nightOffset = 0
                 navNight = nil
                 modelKey = dataKey
diff --git a/Strand/Screens/StressView.swift b/Strand/Screens/StressView.swift
index 88413ec444..803abbbf41 100644
--- a/Strand/Screens/StressView.swift
+++ b/Strand/Screens/StressView.swift
@@ -113,13 +113,11 @@ struct StressView: View {
             freqHRV = nil
             return
         }
-        let rr = (try? await repo.storeHandle()?.rrIntervals(
-            deviceId: repo.deviceId, from: from, to: to, limit: 200_000)) ?? []
+        let rr = await repo.rrIntervals(from: from, to: to, limit: 200_000)
         // Wrist accelerometer for the motion gate: an ambulatory hour is EXERTION, not stress, so it
         // is masked rather than scored (DaytimeStress). Same store read as R-R; empty on hardware or
         // imports with no gravity, which is exactly the "no masking, prior behaviour" degradation.
-        let gravity = (try? await repo.storeHandle()?.gravitySamples(
-            deviceId: repo.deviceId, from: from, to: to, limit: 200_000)) ?? []
+        let gravity = await repo.gravitySamplesUnion(from: from, to: to, limit: 200_000)
 
         // Score today's hours against the PERSONAL cross-day daytime baseline ONLY when the user has
         // opted in (Settings → Experimental) AND enough worn history exists (Oura-style
@@ -173,8 +171,7 @@ struct StressView: View {
             let dayTz = TimeZone.current.secondsFromGMT(for: dayStart)
             let dayHR = await repo.hrSamples(from: from, to: to, limit: 200_000)
             guard !dayHR.isEmpty else { continue }   // unworn day — no floor to learn, skip the R-R read
-            let dayRR = (try? await repo.storeHandle()?.rrIntervals(
-                deviceId: repo.deviceId, from: from, to: to, limit: 200_000)) ?? []
+            let dayRR = await repo.rrIntervals(from: from, to: to, limit: 200_000)
             days.append(.init(hr: dayHR, rr: dayRR, tzOffsetSeconds: dayTz))
         }
         return DaytimeStress.scoringMode(history: days)
diff --git a/Strand/Screens/TodayView.swift b/Strand/Screens/TodayView.swift
index cb19affc93..f801a14f63 100644
--- a/Strand/Screens/TodayView.swift
+++ b/Strand/Screens/TodayView.swift
@@ -4295,7 +4295,7 @@ struct TodayView: View {
         }
         let hostedSessions = await repo.allSleepSessions()
         let hostedHabitual = await repo.habitualMidsleepSec()
-        let hostedMotion = await repo.sessionMotions(starts: hostedSessions.map { $0.startTs })
+        let hostedMotion = await repo.sessionMotions(sessions: hostedSessions)
         hostedSleepModel = SleepModel.build(SleepModelInputs(
             days: repo.days,
             sleeps: repo.sleeps,
diff --git a/Strand/Screens/V5PillarHosts.swift b/Strand/Screens/V5PillarHosts.swift
index d96312f653..a049b4193e 100644
--- a/Strand/Screens/V5PillarHosts.swift
+++ b/Strand/Screens/V5PillarHosts.swift
@@ -78,23 +78,15 @@ struct RhythmHost: View {
     /// Read the most recent banked sleep session, pull its R-R + gravity, split into ~5-minute windows,
     /// gate each on stillness + resting rate, and screen it. Descriptive stats only — never a verdict.
     private func load() async {
-        guard let store = await repo.storeHandle(),
-              let lastSleep = (await repo.allSleepSessions(days: 14)).last else { return }
+        guard let lastSleep = (await repo.allSleepSessions(days: 14)).last else { return }
         let lo = lastSleep.effectiveStartTs
         let hi = lastSleep.endTs
         guard hi > lo else { return }
-        let rr = (try? await store.rrIntervals(deviceId: repo.deviceId, from: lo, to: hi, limit: 200_000)) ?? []
-        // BLE-only users have their night under the computed source; fall back to it when the imported
-        // device yields nothing. Gravity MUST be read from the SAME source id as the R-R (#1360): otherwise
-        // a fall-back night reads its stillness from the wrong device and every window fails the motion
-        // gate, which the empty-state diagnosis below would then misread as "no stillness signal at all".
-        let usedFallback = rr.isEmpty
-        let sourceId = usedFallback ? repo.deviceId + "-noop" : repo.deviceId
-        let rrRows = usedFallback
-            ? ((try? await store.rrIntervals(deviceId: sourceId, from: lo, to: hi, limit: 200_000)) ?? [])
-            : rr
+        // The selected night can belong to a previous/archived strap. Resolve the same all-WHOOP worn
+        // timeline used by Sleep rather than pinning its raw physiology to whichever strap is active now.
+        let rrRows = await repo.rrIntervals(from: lo, to: hi, limit: 200_000)
         guard !rrRows.isEmpty else { return }
-        let grav = (try? await store.gravitySamples(deviceId: sourceId, from: lo, to: hi, limit: 200_000)) ?? []
+        let grav = await repo.gravitySamplesUnion(from: lo, to: hi, limit: 200_000)
 
         // Window the night into 5-minute slices; a slice is "still" when its gravity variance is small.
         let windowSec = 5 * 60
diff --git a/StrandTests/DeviceRawSourceParityTests.swift b/StrandTests/DeviceRawSourceParityTests.swift
new file mode 100644
index 0000000000..1230b0761a
--- /dev/null
+++ b/StrandTests/DeviceRawSourceParityTests.swift
@@ -0,0 +1,118 @@
+import Foundation
+import XCTest
+@testable import Strand
+import WhoopStore
+import WhoopProtocol
+
+/// Apple half of the shared Android/Apple raw-source oracle. This tests the repository contract rather
+/// than duplicating expected values in Swift, so source precedence and R-R identity cannot drift quietly.
+final class DeviceRawSourceParityTests: XCTestCase {
+    private struct Fixture: Decodable {
+        struct SourceCase: Decodable {
+            let name: String
+            let activeDeviceId: String
+            let registeredWhoopIds: [String]
+            let imported: [String]
+            let computed: [String]
+        }
+        struct Beat: Decodable {
+            let source: String?
+            let ts: Int
+            let rrMs: Int
+            let seq: Int
+            let ord: Int?
+        }
+        struct BeatSource: Decodable { let id: String; let beats: [Beat] }
+        struct RRCase: Decodable { let name: String; let sources: [BeatSource]; let expected: [Beat] }
+        let sourceCases: [SourceCase]
+        let rrCases: [RRCase]
+    }
+
+    private func fixture() throws -> Fixture {
+        let testFile = URL(fileURLWithPath: #filePath)
+        let url = testFile.deletingLastPathComponent().deletingLastPathComponent()
+            .appendingPathComponent("Tools/parity_cases/device_raw_sources.json")
+        XCTAssertTrue(FileManager.default.fileExists(atPath: url.path),
+                      "Shared device-source parity fixture is missing; parity must fail closed")
+        return try JSONDecoder().decode(Fixture.self, from: Data(contentsOf: url))
+    }
+
+    private func production(_ path: String) throws -> String {
+        let root = URL(fileURLWithPath: #filePath).deletingLastPathComponent().deletingLastPathComponent()
+        let url = root.appendingPathComponent(path)
+        XCTAssertTrue(FileManager.default.fileExists(atPath: url.path),
+                      "Production source missing: \(path); consumer wiring guard must fail closed")
+        return try String(contentsOf: url, encoding: .utf8)
+    }
+
+    func testSourceResolutionMatchesSharedOracle() throws {
+        for vector in try fixture().sourceCases {
+            let actual = Repository.rawWhoopSourceIds(activeDeviceId: vector.activeDeviceId,
+                                                       registeredWhoopIds: vector.registeredWhoopIds)
+            XCTAssertEqual(actual, vector.imported, vector.name)
+            XCTAssertEqual(actual.map { $0 + "-noop" }, vector.computed, vector.name)
+        }
+    }
+
+    func testRRIdentityMergeMatchesSharedOracle() throws {
+        for vector in try fixture().rrCases {
+            let inputs = vector.sources.map { source in
+                source.beats.map { RRInterval(ts: $0.ts, rrMs: $0.rrMs, ord: $0.ord, seq: $0.seq) }
+            }
+            let actual = Repository.mergeRRByIdentity(inputs)
+            XCTAssertEqual(actual.map(\.ts), vector.expected.map(\.ts), vector.name)
+            XCTAssertEqual(actual.map(\.rrMs), vector.expected.map(\.rrMs), vector.name)
+            XCTAssertEqual(actual.map(\.seq), vector.expected.map(\.seq), vector.name)
+            XCTAssertEqual(actual.map(\.ord), vector.expected.map(\.ord), vector.name)
+        }
+    }
+
+    func testStressCannotPinRawReadsToCanonicalNamespace() throws {
+        let root = URL(fileURLWithPath: #filePath).deletingLastPathComponent().deletingLastPathComponent()
+        let source = try String(contentsOf: root.appendingPathComponent("Strand/Screens/StressView.swift"),
+                                encoding: .utf8)
+        let withoutComments = source.replacingOccurrences(of: #"/\*.*?\*/"#, with: "",
+                                                           options: .regularExpression)
+            .split(separator: "\n", omittingEmptySubsequences: false)
+            .map { $0.split(separator: "//", maxSplits: 1).first.map(String.init) ?? "" }
+            .joined(separator: "\n")
+        let directCanonicalRaw = #"(?s)(hrSamples|rrIntervals|gravitySamples)\s*\([^)]*(\"my-whoop\"|Repository\.whoopSource)"#
+        XCTAssertNil(withoutComments.range(of: directCanonicalRaw, options: .regularExpression),
+                     "Stress raw physiology must resolve via the device-aware repository API")
+        for call in ["repo.hrSamples(from:", "repo.rrIntervals(from:", "repo.gravitySamplesUnion(from:"] {
+            XCTAssertTrue(withoutComments.contains(call), "Stress must use device-aware \(call)")
+        }
+    }
+
+    func testCoachTimelineAndRhythmUseDeviceAwareRawFacades() throws {
+        let coach = try production("Strand/AI/AICoach.swift")
+        XCTAssertTrue(coach.contains("repo.rrIntervals(from:"),
+                      "AI Coach stress context must use Repository's all-source R-R facade")
+        XCTAssertFalse(coach.contains("store.rrIntervals(\n            deviceId: repo.deviceId"),
+                       "AI Coach must not pin R-R to the currently active device")
+
+        let repository = try production("Strand/Data/Repository.swift")
+        guard let timelineStart = repository.range(of: "func timelineSeries(")?.lowerBound else {
+            return XCTFail("Repository.timelineSeries is missing")
+        }
+        let timeline = String(repository[timelineStart...].prefix(12_000))
+        XCTAssertTrue(timeline.contains("rawPhysiologyReadIds(store: store)"),
+                      "Default Full Day timelines must resolve every registered raw source")
+        XCTAssertFalse(timeline.contains("source.map { [$0] } ?? importedReadIds"),
+                       "Timeline must not fall back to active-plus-canonical only")
+        XCTAssertTrue(repository.contains("hrBuckets(deviceIds: rawPhysiologyReadIds(store: store)"),
+                      "Coarse HR reads must include every registered WHOOP strap")
+        XCTAssertTrue(repository.contains("ids: rawPhysiologyReadIds(store: store)"),
+                      "Primary sleep reads must include every registered WHOOP strap")
+        XCTAssertTrue(repository.contains("ids: rawComputedReadIds(store: store)"),
+                      "Computed sleep reads must include every registered WHOOP strap")
+
+        let pillars = try production("Strand/Screens/V5PillarHosts.swift")
+        XCTAssertTrue(pillars.contains("repo.rrIntervals(from:"),
+                      "Rhythm must use Repository's all-source R-R facade")
+        XCTAssertTrue(pillars.contains("repo.gravitySamplesUnion(from:"),
+                      "Rhythm must use Repository's all-source gravity facade")
+        XCTAssertFalse(pillars.contains("store.rrIntervals(deviceId: repo.deviceId"),
+                       "Rhythm must not pin R-R to the currently active device")
+    }
+}
diff --git a/StrandTests/RawPhysiologyUnionTests.swift b/StrandTests/RawPhysiologyUnionTests.swift
new file mode 100644
index 0000000000..7188981392
--- /dev/null
+++ b/StrandTests/RawPhysiologyUnionTests.swift
@@ -0,0 +1,123 @@
+import XCTest
+import WhoopProtocol
+import WhoopStore
+import StrandAnalytics
+@testable import Strand
+
+final class RawPhysiologyUnionTests: XCTestCase {
+    func testRRMergePreservesDistinctSameTimestampBeatsAndDedupesExactIdentityActiveFirst() {
+        let active = [RRInterval(ts: 100, rrMs: 800, ord: 8, seq: 0),
+                      RRInterval(ts: 100, rrMs: 800, ord: 9, seq: 1)]
+        let canonical = [RRInterval(ts: 100, rrMs: 800, ord: 1, seq: 0),
+                         RRInterval(ts: 101, rrMs: 810, ord: 2, seq: 0)]
+        let merged = Repository.mergeRRByIdentity([active, canonical])
+        XCTAssertEqual(merged.map { "\($0.ts):\($0.rrMs):\($0.seq)" },
+                       ["100:800:0", "100:800:1", "101:810:0"])
+        XCTAssertEqual(merged.first?.ord, 8, "active source wins only the exact duplicate")
+    }
+
+    func testSingleSourceRRIsReturnedUnchanged() {
+        let rows = [RRInterval(ts: 101, rrMs: 810, ord: 4, seq: 2),
+                    RRInterval(ts: 100, rrMs: 800, ord: 3, seq: 1)]
+        XCTAssertEqual(Repository.mergeRRByIdentity([rows]), rows)
+    }
+
+    func testRRUnionSortsByTimestampThenSequenceBeforeValueAndOrder() {
+        let rows = Repository.mergeRRByIdentity([
+            [RRInterval(ts: 100, rrMs: 700, ord: 0, seq: 1)],
+            [RRInterval(ts: 100, rrMs: 900, ord: 9, seq: 0),
+             RRInterval(ts: 100, rrMs: 800, ord: nil, seq: 0)],
+        ])
+        XCTAssertEqual(rows.map { "\($0.seq):\($0.rrMs):\($0.ord.map(String.init) ?? "nil")" },
+                       ["0:800:nil", "0:900:9", "1:700:0"])
+    }
+
+    @MainActor
+    func testRRFacadeUnionsReAddedStrapAndCanonical() async throws {
+        let store = try await WhoopStore.inMemory()
+        let repo = Repository(deviceId: "my-whoop")
+        repo.setStoreForTesting(store)
+        _ = try await store.insert(Streams(rr: [RRInterval(ts: 100, rrMs: 800)]), deviceId: "my-whoop")
+        _ = try await store.insert(Streams(rr: [RRInterval(ts: 101, rrMs: 810)]), deviceId: "whoop-new")
+        repo.adoptActiveDeviceId("whoop-new")
+        let rows = await repo.rrIntervals(from: 90, to: 110)
+        XCTAssertEqual(rows.map(\.ts), [100, 101])
+    }
+
+    @MainActor
+    func testRawFacadeIncludesAnotherRegisteredWhoopNotCurrentlyActive() async throws {
+        let store = try await WhoopStore.inMemory()
+        let registry = DeviceRegistryStore(dbQueue: store.registryWriter)
+        try registry.add(PairedDevice(id: "whoop-a", brand: "WHOOP", model: "5.0",
+            sourceKind: .liveBLE, capabilities: [.hr], status: .archived, addedAt: 1, lastSeenAt: 1))
+        try registry.add(PairedDevice(id: "whoop-b", brand: "WHOOP", model: "5.0",
+            sourceKind: .liveBLE, capabilities: [.hr], status: .active, addedAt: 2, lastSeenAt: 2))
+        _ = try await store.insert(Streams(hr: [HRSample(ts: 100, bpm: 61)]), deviceId: "whoop-a")
+        _ = try await store.insert(Streams(hr: [HRSample(ts: 200, bpm: 72)]), deviceId: "whoop-b")
+        let repo = Repository(deviceId: "whoop-b")
+        repo.setStoreForTesting(store)
+        let rows = await repo.hrSamples(from: 90, to: 210)
+        XCTAssertEqual(rows.map(\.bpm), [61, 72])
+
+        let timeline = await repo.timelineSeries(metric: .hr, from: 90, to: 210, targetPoints: 600)
+        XCTAssertEqual(timeline.points.map { Int($0.value) }, [61, 72],
+                       "default Deep Timeline must use the same all-WHOOP raw resolver")
+    }
+
+    @MainActor
+    func testSessionMotionUsesHistoricalOwnerBeforeCurrentActiveComputedSource() async throws {
+        let store = try await WhoopStore.inMemory()
+        let session = CachedSleepSession(startTs: 1_000, endTs: 5_000, efficiency: 0.9,
+                                         restingHr: 52, avgHrv: 60, stagesJSON: nil)
+        _ = try await store.upsertSleepSessions([session], deviceId: "my-whoop")
+        _ = try await store.upsertSleepSessions([session], deviceId: "my-whoop-noop")
+        _ = try await store.persistSessionMotion(deviceId: "my-whoop-noop", sessionStart: 1_000,
+                                                 motionEpochs: [0.1, 0.2])
+        _ = try await store.upsertSleepSessions([session], deviceId: "whoop-new-noop")
+        _ = try await store.persistSessionMotion(deviceId: "whoop-new-noop", sessionStart: 1_000,
+                                                 motionEpochs: [9.0])
+        let repo = Repository(deviceId: "whoop-new")
+        repo.setStoreForTesting(store)
+        let motion = await repo.sessionMotions(sessions: [session])
+        XCTAssertEqual(motion[1_000] ?? [], [0.1, 0.2])
+    }
+
+    @MainActor
+    func testArchivedStrapNightsTeachHabitualMidsleep() async throws {
+        let store = try await WhoopStore.inMemory()
+        let registry = DeviceRegistryStore(dbQueue: store.registryWriter)
+        try registry.add(PairedDevice(id: "whoop-old", brand: "WHOOP", model: "4.0",
+            sourceKind: .liveBLE, capabilities: [.sleep], status: .archived, addedAt: 1, lastSeenAt: 1))
+        try registry.add(PairedDevice(id: "whoop-new", brand: "WHOOP", model: "5.0",
+            sourceKind: .liveBLE, capabilities: [.sleep], status: .active, addedAt: 2, lastSeenAt: 2))
+        let firstStart = Int(Date().timeIntervalSince1970) - 20 * 86_400
+        let nights = (0..<SleepStageTotals.habitualMinDays).map { day in
+            let start = firstStart + day * 86_400
+            return CachedSleepSession(startTs: start, endTs: start + 8 * 3600, efficiency: 0.9,
+                                      restingHr: 52, avgHrv: 60, stagesJSON: nil)
+        }
+        _ = try await store.upsertSleepSessions(nights, deviceId: "whoop-old")
+        let repo = Repository(deviceId: "whoop-new")
+        repo.setStoreForTesting(store)
+        let habitual = await repo.habitualMidsleepSec()
+        XCTAssertNotNil(habitual,
+                        "retained nights from an archived strap must remain in the habitual learner")
+    }
+
+    @MainActor
+    func testAICoachStressIndexReadsRRFromNonCurrentRegisteredStrap() async throws {
+        let store = try await WhoopStore.inMemory()
+        let registry = DeviceRegistryStore(dbQueue: store.registryWriter)
+        try registry.add(PairedDevice(id: "whoop-old", brand: "WHOOP", model: "4.0",
+            sourceKind: .liveBLE, capabilities: [.hrv], status: .archived, addedAt: 1, lastSeenAt: 1))
+        try registry.add(PairedDevice(id: "whoop-new", brand: "WHOOP", model: "5.0",
+            sourceKind: .liveBLE, capabilities: [.hrv], status: .active, addedAt: 2, lastSeenAt: 2))
+        let base = Int(Calendar.current.startOfDay(for: Date()).timeIntervalSince1970) + 60
+        let beats = (0..<24).map { RRInterval(ts: base + $0, rrMs: 780 + ($0 % 5) * 10) }
+        _ = try await store.insert(Streams(rr: beats), deviceId: "whoop-old")
+        let repo = Repository(deviceId: "whoop-new")
+        repo.setStoreForTesting(store)
+        let line = await AICoachEngine(repo: repo).stressIndexLine()
+        XCTAssertNotNil(line, "coach stress context must use the same all-WHOOP R-R timeline as Stress")
+    }
+}
diff --git a/Tools/parity_cases/device_raw_sources.json b/Tools/parity_cases/device_raw_sources.json
new file mode 100644
index 0000000000..4a18baafbb
--- /dev/null
+++ b/Tools/parity_cases/device_raw_sources.json
@@ -0,0 +1,79 @@
+{
+  "sourceCases": [
+    {
+      "name": "active wins then paired and archived registered straps keep registry order before canonical",
+      "activeDeviceId": "whoop-new",
+      "registeredWhoopIds": ["whoop-archived", "my-whoop", "whoop-paired", "whoop-new"],
+      "imported": ["whoop-new", "whoop-archived", "whoop-paired", "my-whoop"],
+      "computed": ["whoop-new-noop", "whoop-archived-noop", "whoop-paired-noop", "my-whoop-noop"]
+    },
+    {
+      "name": "legacy source collapses without duplicate reads",
+      "activeDeviceId": "my-whoop",
+      "registeredWhoopIds": ["my-whoop"],
+      "imported": ["my-whoop"],
+      "computed": ["my-whoop-noop"]
+    },
+    {
+      "name": "explicit non-WHOOP active stays first before archived and paired WHOOP history",
+      "activeDeviceId": "polar-h10-live",
+      "registeredWhoopIds": ["whoop-archived", "my-whoop", "whoop-paired", "my-whoop"],
+      "imported": ["polar-h10-live", "whoop-archived", "whoop-paired", "my-whoop"],
+      "computed": ["polar-h10-live-noop", "whoop-archived-noop", "whoop-paired-noop", "my-whoop-noop"]
+    }
+  ],
+  "rrCases": [
+    {
+      "name": "exact identity tie keeps active while same timestamp distinct beats survive",
+      "sources": [
+        {
+          "id": "whoop-new",
+          "beats": [
+            {"ts": 102, "rrMs": 810, "seq": 0},
+            {"ts": 100, "rrMs": 800, "seq": 0, "ord": 10},
+            {"ts": 100, "rrMs": 810, "seq": 1}
+          ]
+        },
+        {
+          "id": "my-whoop",
+          "beats": [
+            {"ts": 99, "rrMs": 790, "seq": 0},
+            {"ts": 100, "rrMs": 800, "seq": 0, "ord": 20},
+            {"ts": 101, "rrMs": 805, "seq": 0}
+          ]
+        }
+      ],
+      "expected": [
+        {"source": "my-whoop", "ts": 99, "rrMs": 790, "seq": 0},
+        {"source": "whoop-new", "ts": 100, "rrMs": 800, "seq": 0, "ord": 10},
+        {"source": "whoop-new", "ts": 100, "rrMs": 810, "seq": 1},
+        {"source": "my-whoop", "ts": 101, "rrMs": 805, "seq": 0},
+        {"source": "whoop-new", "ts": 102, "rrMs": 810, "seq": 0}
+      ]
+    },
+    {
+      "name": "same timestamp orders by seq then rrMs before conflicting and nil ord",
+      "sources": [
+        {
+          "id": "whoop-new",
+          "beats": [
+            {"ts": 200, "rrMs": 700, "seq": 1},
+            {"ts": 200, "rrMs": 900, "seq": 0, "ord": 1},
+            {"ts": 200, "rrMs": 850, "seq": 0, "ord": 99},
+            {"ts": 200, "rrMs": 600, "seq": 2, "ord": 0}
+          ]
+        },
+        {
+          "id": "my-whoop",
+          "beats": []
+        }
+      ],
+      "expected": [
+        {"source": "whoop-new", "ts": 200, "rrMs": 850, "seq": 0, "ord": 99},
+        {"source": "whoop-new", "ts": 200, "rrMs": 900, "seq": 0, "ord": 1},
+        {"source": "whoop-new", "ts": 200, "rrMs": 700, "seq": 1},
+        {"source": "whoop-new", "ts": 200, "rrMs": 600, "seq": 2, "ord": 0}
+      ]
+    }
+  ]
+}
diff --git a/android/app/src/main/java/com/noop/ai/AiCoach.kt b/android/app/src/main/java/com/noop/ai/AiCoach.kt
index 75fa6c9ea0..16b706670d 100644
--- a/android/app/src/main/java/com/noop/ai/AiCoach.kt
+++ b/android/app/src/main/java/com/noop/ai/AiCoach.kt
@@ -151,15 +151,16 @@ class AiCoach(
 
     /**
      * Today's derived stress line for the consent-gated coach context. Reads R-R for the local day
-     * via [WhoopRepository.rrIntervals] (the SAME path StressScreen uses) and summarises it with the
-     * pure [stressIndexLine]. Returns null when there aren't enough clean beats. Summary number only,      * the raw R-R never leaves the device.
+     * via [WhoopRepository.rrIntervalsUnion] (the SAME path StressScreen uses) and summarises it with the
+     * pure [stressIndexLine]. Returns null when there aren't enough clean beats. Summary number only;
+     * the raw R-R never leaves the device.
      */
     private suspend fun stressLineToday(): String? {
         val nowSeconds = System.currentTimeMillis() / 1000L
         val tzOffset = java.util.TimeZone.getDefault().getOffset(nowSeconds * 1_000L) / 1_000L
         val localNow = nowSeconds + tzOffset
         val from = (localNow - Math.floorMod(localNow, 86_400L)) - tzOffset
-        val rr = repo.rrIntervals(activeStrapId(), from, nowSeconds, limit = 200_000)
+        val rr = repo.rrIntervalsUnion(activeStrapId(), from, nowSeconds, limit = 200_000)
         return stressIndexLine(rr)
     }
 
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index bda6e70c23..d20042b702 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -895,7 +895,7 @@ object IntelligenceEngine {
             val respRows = repo.respSamples(owner, from, to, STREAM_LIMIT)
             val resp = OuraRespScale.forScoring(respRows, owner)
             val vendorResp = OuraRespScale.forVendorRate(respRows, owner)
-            val grav = repo.gravitySamples(owner, from, to, STREAM_LIMIT)
+            val grav = repo.gravitySamplesForDevice(owner, from, to, STREAM_LIMIT)
             val steps = repo.stepSamples(owner, from, to, STREAM_LIMIT)
             val skinReads = readDaySkinAndWristOff(
                 repo, owner, from, to, ownerSource, skinFamilyByOwner, skinWornToleranceByOwner,
@@ -926,7 +926,7 @@ object IntelligenceEngine {
             // TODAY (dayEnd past the 18 h cap) and a limit-truncated night read DECLINE (null) → direct
             // read, so the shortcut only ever skips work, never changes data. Twin of Swift's #997.
             val dayHr = AnalyticsEngine.daySliceFromNight(hr, from, to, dayMidnight, dayEnd) { it.ts.toLong() }
-                ?: repo.hrSamples(owner, dayMidnight, dayEnd, STREAM_LIMIT)
+                ?: repo.hrSamplesForDevice(owner, dayMidnight, dayEnd, STREAM_LIMIT)
             val daySteps = AnalyticsEngine.daySliceFromNight(steps, from, to, dayMidnight, dayEnd) { it.ts }
                 ?: repo.stepSamples(owner, dayMidnight, dayEnd, STREAM_LIMIT)
             // Full calendar-day gravity for WORKOUT detection. For a PAST day the night window runs to the
@@ -934,7 +934,7 @@ object IntelligenceEngine {
             // directly, which the slice's `dayHi > nightHi` guard handles — a 5 pm run still shows up the
             // same day.
             val dayGrav = AnalyticsEngine.daySliceFromNight(grav, from, to, dayMidnight, dayEnd) { it.ts }
-                ?: repo.gravitySamples(owner, dayMidnight, dayEnd, STREAM_LIMIT)
+                ?: repo.gravitySamplesForDevice(owner, dayMidnight, dayEnd, STREAM_LIMIT)
 
             // CONSUME (#531 / #175): the strap's OWN band sleep_state for the night window as (ts, state)
             // samples, so the H7 morning-stillness guard can confirm a borderline re-onset against the strap's
@@ -958,7 +958,7 @@ object IntelligenceEngine {
             // import namespace are untouched; analyzeDay still lets a DETECTED session win where they overlap.
             val providedSleep: List<DetectedSleep> =
                 if (owner != importedDeviceId && grav.size < 2) {
-                    repo.sleepSessions(owner, from, to, 4000)
+                    repo.sleepSessionsForDevice(owner, from, to, 4000)
                         .mapNotNull { AnalyticsEngine.sleepSessionFromProvided(it) }
                 } else {
                     emptyList()
@@ -1862,7 +1862,7 @@ object IntelligenceEngine {
         }
         val healDropped = ArrayList<SleepSession>()
         for (healId in healDeviceIds) {
-            val storedSessions = repo.sleepSessions(healId, windowStart, nowSeconds, 4000)
+            val storedSessions = repo.sleepSessionsForDevice(healId, windowStart, nowSeconds, 4000)
             val healable = storedSessions.filter {
                 AnalyticsEngine.dayString(it.endTs, tzOffsetSeconds) in oldestDay..newestDay
             }
@@ -2016,7 +2016,7 @@ object IntelligenceEngine {
             val dayEnd = dayMid + SECONDS_PER_DAY - 1
             val dayKey = AnalyticsEngine.dayString(dayMid, tzOffsetSeconds)
             val owner = resolveDayOwner(repo, ownerSource, candidatePriorities, dayKey, dayMid, dayEnd, importedDeviceId)
-            val grav = repo.gravitySamples(owner, dayMid, dayEnd, STREAM_LIMIT)
+            val grav = repo.gravitySamplesForDevice(owner, dayMid, dayEnd, STREAM_LIMIT)
             val m = StepsEstimateEngine.dayMotionIntensity(grav)
             if (m > 0) motionByDay[dayKey] = m
         }
@@ -2125,7 +2125,7 @@ object IntelligenceEngine {
             // merged-workout case, where kcal is the SUM of inputs so it never looks under-scored yet
             // Effort stays blank forever). improves() then accepts a strain-only gain for the latter.
             if (!ManualWorkoutRescore.looksUnderScored(row.energyKcal) && row.strain != null) continue
-            val samples = runCatching { repo.hrSamples(deviceId, row.startTs, row.endTs, 20_000) }
+            val samples = runCatching { repo.hrSamplesForDevice(deviceId, row.startTs, row.endTs, 20_000) }
                 .getOrNull() ?: continue
             val s = ManualWorkoutRescore.scored(
                 samples, profile, hrMax, restingHR, effortMethod) ?: continue
@@ -2291,7 +2291,7 @@ object IntelligenceEngine {
         // re-banked copy of the night would otherwise feed "asleep" epochs at the OLD times into the H7
         // re-onset guard, letting the stale block keep confirming itself. Read-side only (no bank-recency
         // witness here); the store itself is healed post-upsert in analyzeRecentOnCpu. Mirrors Swift.
-        val sessions = SleepSessionDedup.dedupe(repo.sleepSessions(computedId, from, to, 4000)).kept
+        val sessions = SleepSessionDedup.dedupe(repo.sleepSessionsForDevice(computedId, from, to, 4000)).kept
         val samples = ArrayList<Pair<Long, Int>>()
         for (s in sessions) {
             val states = repo.sessionSleepState(computedId, s.startTs) ?: continue
@@ -2319,8 +2319,8 @@ object IntelligenceEngine {
         windowEnd: Long,
         offsetSec: Long,
     ): Pair<Long?, List<Double>> {
-        val imported = repo.sleepSessions(importedId, windowStart, windowEnd, 4000)
-        val computed = repo.sleepSessions(computedId, windowStart, windowEnd, 4000)
+        val imported = repo.sleepSessionsForDevice(importedId, windowStart, windowEnd, 4000)
+        val computed = repo.sleepSessionsForDevice(computedId, windowStart, windowEnd, 4000)
         // #899: collapse overlapping timebase-shifted duplicates BEFORE the learner sees the history.
         // A stale re-banked copy of a night lands on a DIFFERENT day key, so the per-day longest-block
         // de-dup below never caught it and the learned midsleep drifted toward the stale timing, which
@@ -2599,7 +2599,7 @@ object IntelligenceEngine {
         val candidates = candidatePriorities.map { (id, priority) ->
             // Cheap presence check: a single HR row for this device in the night window marks it a
             // candidate. (LIMIT 1 , not the full pull the caller does once an owner is chosen.)
-            val hasData = repo.hrSamples(id, from, to, 1).isNotEmpty()
+            val hasData = repo.hrSamplesForDevice(id, from, to, 1).isNotEmpty()
             DayOwnerResolver.Candidate(deviceId = id, priority = priority, hasData = hasData)
         }
         return DayOwnerResolver.resolve(day, lockedOwner = null, candidates = candidates) ?: importedDeviceId
@@ -2657,13 +2657,13 @@ object IntelligenceEngine {
      *  extraction next door exists to protect. */
     private fun hrReadWindow(repo: com.noop.data.WhoopRepository) =
         SlidingStreamWindow<com.noop.data.HrSample>({ it.ts }, STREAM_LIMIT) { o, f, t ->
-            repo.hrSamples(o, f, t, STREAM_LIMIT)
+            repo.hrSamplesForDevice(o, f, t, STREAM_LIMIT)
         }
 
     /** The pass-1 R-R sliding read window. Same reason as [hrReadWindow] for living out here. */
     private fun rrReadWindow(repo: com.noop.data.WhoopRepository) =
         SlidingStreamWindow<com.noop.data.RrInterval>({ it.ts }, STREAM_LIMIT) { o, f, t ->
-            repo.rrIntervals(o, f, t, STREAM_LIMIT)
+            repo.rrIntervalsForDevice(o, f, t, STREAM_LIMIT)
         }
 
 
diff --git a/android/app/src/main/java/com/noop/analytics/SleepStageHealer.kt b/android/app/src/main/java/com/noop/analytics/SleepStageHealer.kt
index b7a5698517..188e52415e 100644
--- a/android/app/src/main/java/com/noop/analytics/SleepStageHealer.kt
+++ b/android/app/src/main/java/com/noop/analytics/SleepStageHealer.kt
@@ -69,11 +69,11 @@ object SleepStageHealer {
     ): String? {
         val lo = start - 3_600L
         val hi = end + 3_600L
-        val grav = repo.gravitySamples(deviceId, lo, hi, IntelligenceEngine.STREAM_LIMIT)
+        val grav = repo.gravitySamplesForDevice(deviceId, lo, hi, IntelligenceEngine.STREAM_LIMIT)
         // Cheap density gate FIRST (count only) so a sparse imported night skips the three further reads.
         if (!isDense(grav, start, end)) return null
-        val hr = repo.hrSamples(deviceId, lo, hi, IntelligenceEngine.STREAM_LIMIT)
-        val rr = repo.rrIntervals(deviceId, lo, hi, IntelligenceEngine.STREAM_LIMIT)
+        val hr = repo.hrSamplesForDevice(deviceId, lo, hi, IntelligenceEngine.STREAM_LIMIT)
+        val rr = repo.rrIntervalsForDevice(deviceId, lo, hi, IntelligenceEngine.STREAM_LIMIT)
         // Same provenance refusal as the nightly scan: an Oura ring's respiration rows are its own
         // per-window RATE stored as instrumentation, not the ~1 Hz raw ADC waveform this stager reads,
         // so they never reach a re-stage either. See `OuraRespScale.forScoring`. Mirrors Swift.
@@ -161,7 +161,7 @@ object SleepStageHealer {
         useMotionAwareWake: Boolean = false,
     ): List<SleepSession> {
         suspend fun editedRows(): List<SleepSession> =
-            repo.sleepSessions(computedDeviceId, windowStart, windowEnd).filter { it.userEdited }
+            repo.sleepSessionsForDevice(computedDeviceId, windowStart, windowEnd).filter { it.userEdited }
 
         val edited = editedRows()
         if (edited.isEmpty()) return emptyList()
diff --git a/android/app/src/main/java/com/noop/ble/SourceCoordinator.kt b/android/app/src/main/java/com/noop/ble/SourceCoordinator.kt
index f56d4de32b..a70db1897f 100644
--- a/android/app/src/main/java/com/noop/ble/SourceCoordinator.kt
+++ b/android/app/src/main/java/com/noop/ble/SourceCoordinator.kt
@@ -531,7 +531,7 @@ class SourceCoordinator(
                         runCatching {
                             val from = s.startTs - 16 * 3600 - 3600
                             val to = s.endTs + 3600
-                            repo.sleepSessions(deviceId, from, to, 64)
+                            repo.sleepSessionsForDevice(deviceId, from, to, 64)
                                 .filter { it.startTs != s.startTs && com.noop.analytics.SleepSessionDedup.isDuplicate(session, it) }
                                 .forEach { e ->
                                     straplog("Oura: dup-gen(#1284) persist ${dupGenShape(s.startTs, s.endTs, s.stagesJson)} duplicates stored ${dupGenShape(e.startTs, e.endTs, e.stagesJSON)} startDelta=${s.startTs - e.startTs}s (end-anchor drift) - cross-connection DB read")
@@ -544,7 +544,7 @@ class SourceCoordinator(
                             // candidate (safe default). Mirrors the Swift twin's structure + FAILED log.
                             val from = s.startTs - 16 * 3600 - 3600
                             val to = s.endTs + 3600
-                            val nearby = runCatching { repo.sleepSessions(deviceId, from, to, 64) }.getOrDefault(emptyList())
+                            val nearby = runCatching { repo.sleepSessionsForDevice(deviceId, from, to, 64) }.getOrDefault(emptyList())
                             val plan = com.noop.analytics.SleepSessionDedup.planBank(session, nearby)
                             if (plan.bank) {
                                 // Bank the survivor FIRST, retire what it supersedes only after it lands — so a
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 08e42424f6..f08ac7e84b 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -3687,7 +3687,7 @@ class WhoopBleClient(
             try {
                 val nowSec = System.currentTimeMillis() / 1000L
                 val from = nowSec - INACTIVITY_LOOKBACK_S
-                val grav = repository.gravitySamples(deviceId, from, nowSec)
+                val grav = repository.gravitySamplesForDevice(deviceId, from, nowSec)
                 if (grav.isEmpty()) return@launch
 
                 val decision = SedentaryDetector.evaluate(
@@ -3738,7 +3738,7 @@ class WhoopBleClient(
                 // gravity window, the same primitive SedentaryDetector reuses. Null when there's no
                 // recent gravity — the engine then leans on the resting-HR band gate (spec Q3).
                 val from = nowSec - INACTIVITY_LOOKBACK_S
-                val grav = runCatching { repository.gravitySamples(deviceId, from, nowSec) }.getOrDefault(emptyList())
+                val grav = runCatching { repository.gravitySamplesForDevice(deviceId, from, nowSec) }.getOrDefault(emptyList())
                 val recentMotionG = WorkoutDetector.activitySeries(grav).lastOrNull()?.intensity
 
                 val live = _state.value
@@ -3792,9 +3792,9 @@ class WhoopBleClient(
                 // Look back over the freshly-offloaded daytime window (the same lookback the inactivity /
                 // stress hooks read), so a brief afternoon nap that just landed gets judged.
                 val from = nowSec - INACTIVITY_LOOKBACK_S
-                val grav = runCatching { repository.gravitySamples(deviceId, from, nowSec) }.getOrDefault(emptyList())
+                val grav = runCatching { repository.gravitySamplesForDevice(deviceId, from, nowSec) }.getOrDefault(emptyList())
                 if (grav.isEmpty()) return@launch
-                val hr = runCatching { repository.hrSamples(deviceId, from, nowSec) }.getOrDefault(emptyList())
+                val hr = runCatching { repository.hrSamplesForDevice(deviceId, from, nowSec) }.getOrDefault(emptyList())
                 // Honest resting band: the newest daily metric's resting HR, or null (the engine then
                 // leans on motion alone at lower confidence — it never fabricates a band).
                 val restingHr = runCatching {
diff --git a/android/app/src/main/java/com/noop/data/WhoopRepository.kt b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
index dc062368d5..0d7ae4dea2 100644
--- a/android/app/src/main/java/com/noop/data/WhoopRepository.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
@@ -886,19 +886,31 @@ class WhoopRepository(
     suspend fun sessionMotion(deviceId: String, sessionStart: Long): List<Double>? =
         dao.sessionMotionJson(deviceId, sessionStart)?.let { decodeDoubleArray(it) }
 
-    /** Per-epoch MOTION series for each of [starts] (detected session start keys), keyed by start (#407).
-     *  Motion is written ONLY under the computed ("-noop") source by the engine, so we read there; an
-     *  imported-only night (no computed twin) has no motion (absent stays absent , an honest empty state,
-     *  never a fabricated zero array). Does NOT resolve the night: the caller has already chosen the
-     *  main-night GROUP and passes those blocks' starts. A start with no stored series is omitted. Mirrors
-     *  iOS Repository.sessionMotions. */
-    suspend fun sessionMotions(strapDeviceId: String, starts: List<Long>): Map<Long, List<Double>> {
-        if (starts.isEmpty()) return emptyMap()
-        val computedId = computedDeviceId(strapDeviceId)
+    /** Per-epoch motion for the already-resolved [sessions], keyed by detected start (#407).
+     *
+     * The engine writes motion under a computed ("-noop") namespace. A selected session can belong to
+     * an older strap, however, while [activeStrapId] names the strap worn now. Resolve each start from its
+     * owning computed namespace first, then every registered WHOOP's computed namespace (active first,
+     * canonical last). This keeps old nights attached to their source across repeated strap switches and
+     * still finds a computed twin for an imported canonical session. A missing series remains absent.
+     */
+    suspend fun sessionMotions(
+        activeStrapId: String,
+        sessions: List<SleepSession>,
+    ): Map<Long, List<Double>> {
+        if (sessions.isEmpty()) return emptyMap()
+        val fallbackIds = rawWhoopSourceIds(activeStrapId).map { "$it-noop" }
         val out = HashMap<Long, List<Double>>()
-        for (start in starts) {
-            val m = dao.sessionMotionJson(computedId, start)?.let { decodeDoubleArray(it) }
-            if (!m.isNullOrEmpty()) out[start] = m
+        for (session in sessions) {
+            if (out.containsKey(session.startTs)) continue
+            val ownerComputed = if (session.deviceId.endsWith("-noop")) session.deviceId else "${session.deviceId}-noop"
+            for (sourceId in (listOf(ownerComputed) + fallbackIds).distinct()) {
+                val motion = dao.sessionMotionJson(sourceId, session.startTs)?.let { decodeDoubleArray(it) }
+                if (!motion.isNullOrEmpty()) {
+                    out[session.startTs] = motion
+                    break
+                }
+            }
         }
         return out
     }
@@ -947,7 +959,7 @@ class WhoopRepository(
 
     // MARK: - Reads
 
-    suspend fun hrSamples(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
+    suspend fun hrSamplesForDevice(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
         dao.hrSamples(deviceId, from, to, limit)
 
     /** #856: HR samples over an EXPLICIT id list, deduped by ts with earlier ids winning — the sample
@@ -959,9 +971,8 @@ class WhoopRepository(
         else mergeHrByTs(deviceIds.map { dao.hrSamples(it, from, to, limit) })
 
     /**
-     * HR samples over the read-side UNION of the active strap id AND the canonical "my-whoop" (SPINE /
-     * #814 + HIGH-2), deduped by ts with the active strap winning. This is the Kotlin twin of the Swift
-     * [com.noop] Repository.hrSamples(from:to:) union overload.
+     * HR samples over every registered WHOOP plus canonical "my-whoop", deduped by timestamp with the
+     * active strap winning and archived straps retained for historical windows.
      *
      * #908: a strap re-added through the in-app device manager banks its LIVE raw under its OWN fresh id
      * (e.g. "whoop-<uuid>"), NOT "my-whoop". A Today-curve / live-Effort read pinned to the hardcoded
@@ -970,7 +981,7 @@ class WhoopRepository(
      * A single-WHOOP install resolves [activeDeviceId] to "my-whoop" ⇒ ONE id ⇒ byte-identical read.
      */
     suspend fun hrSamplesUnion(activeDeviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT):
-        List<HrSample> = mergeHrByTs(importedSourceIds(activeDeviceId).map { dao.hrSamples(it, from, to, limit) })
+        List<HrSample> = mergeHrByTs(rawWhoopSourceIds(activeDeviceId).map { dao.hrSamples(it, from, to, limit) })
 
     /** Raw measured HR only (no v26 PPG-derived union) for the raw-sensor diagnostic export. */
     suspend fun rawHrSamples(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
@@ -1022,7 +1033,7 @@ class WhoopRepository(
             .map { it.ts to StreamPersistence.unpackImuColumns(it.samples) }
 
     /** Downsampled HR (mean bpm per [bucketSeconds]) for the strap, for the Today 24h trend chart. */
-    suspend fun hrBuckets(deviceId: String, from: Long, to: Long, bucketSeconds: Long = 300L) =
+    suspend fun hrBucketsForDevice(deviceId: String, from: Long, to: Long, bucketSeconds: Long = 300L) =
         dao.hrBuckets(deviceId, from, to, bucketSeconds)
 
     /** #856: the same dedup over an EXPLICIT id list, so a workout can read its OWN recording strap
@@ -1034,15 +1045,13 @@ class WhoopRepository(
         else mergeHrBucketsByStart(deviceIds.map { dao.hrBuckets(it, from, to, bucketSeconds) })
 
     /**
-     * Downsampled HR buckets over the read-side UNION of the active strap id AND the canonical "my-whoop"
-     * (SPINE / #814 + HIGH-2), deduped by bucket start with the active strap winning. Kotlin twin of the
-     * Swift Repository.hrBuckets(from:to:bucketSeconds:) union overload. #908: keeps the Today HR curve
-     * pointed at whichever id the re-added strap actually banks under. Single-WHOOP install ⇒ one id ⇒
-     * byte-identical read.
+     * Downsampled HR buckets over every registered WHOOP (active first, archived included, canonical
+     * last), deduped by bucket start with the active source winning. Kotlin twin of the raw-sample union.
+     * A legacy canonical-only install remains a single byte-identical DAO read.
      */
     suspend fun hrBucketsUnion(activeDeviceId: String, from: Long, to: Long, bucketSeconds: Long = 300L):
         List<HrBucket> = mergeHrBucketsByStart(
-            importedSourceIds(activeDeviceId).map { dao.hrBuckets(it, from, to, bucketSeconds) },
+            rawWhoopSourceIds(activeDeviceId).map { dao.hrBuckets(it, from, to, bucketSeconds) },
         )
 
     /**
@@ -1147,9 +1156,20 @@ class WhoopRepository(
         }
     }
 
-    suspend fun rrIntervals(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
+    suspend fun rrIntervalsForDevice(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
         dao.rrIntervals(deviceId, from, to, limit)
 
+    /** R-R beats over active strap + canonical history. Exact duplicate beats are removed with the
+     * active source winning; distinct beats sharing a timestamp remain intact. */
+    suspend fun rrIntervalsUnion(
+        activeDeviceId: String,
+        from: Long,
+        to: Long,
+        limit: Int = DEFAULT_LIMIT,
+    ): List<RrInterval> = mergeRrByIdentity(
+        rawWhoopSourceIds(activeDeviceId).map { dao.rrIntervals(it, from, to, limit) },
+    )
+
     suspend fun events(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
         dao.events(deviceId, from, to, limit)
 
@@ -1327,7 +1347,7 @@ class WhoopRepository(
     suspend fun respSamples(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
         dao.respSamples(deviceId, from, to, limit)
 
-    suspend fun gravitySamples(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
+    suspend fun gravitySamplesForDevice(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
         dao.gravitySamples(deviceId, from, to, limit)
 
     /**
@@ -1343,10 +1363,20 @@ class WhoopRepository(
         to: Long,
         limit: Int = DEFAULT_LIMIT,
     ): List<GravitySample> = mergeGravityByTs(
-        importedSourceIds(activeDeviceId).map { dao.gravitySamples(it, from, to, limit) },
+        rawWhoopSourceIds(activeDeviceId).map { dao.gravitySamples(it, from, to, limit) },
     )
 
-    suspend fun sleepSessions(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
+    /** Resolve raw WHOOP telemetry across every registered WHOOP, including archived straps. Registry
+     * order is stable (addedAt ASC); the currently worn strap wins overlaps and canonical imports lose
+     * overlaps. The explicitly active source is preserved even for another brand; unrelated registered
+     * devices from other brands are deliberately excluded from WHOOP-specific fallback reads. */
+    private suspend fun rawWhoopSourceIds(activeDeviceId: String): List<String> =
+        rawWhoopSourceIdsFor(
+            activeDeviceId,
+            dao.pairedDevices().filter { it.brand.equals("WHOOP", ignoreCase = true) }.map { it.id },
+        )
+
+    suspend fun sleepSessionsForDevice(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
         dao.sleepSessions(deviceId, from, to, limit)
 
     /**
@@ -1365,13 +1395,15 @@ class WhoopRepository(
         val now = System.currentTimeMillis() / 1000L
         val lo = now - days * 86_400L
         val hi = now + 86_400L
-        // UNION active strap + canonical "my-whoop" (imported) and their computed siblings (#814/#1008),
+        // UNION every registered WHOOP (active first, including archived, canonical last) and their
+        // computed siblings,
         // de-duplicating identical (startTs, endTs) blocks recorded under both ids so a night present in
         // both namespaces doesn't double-weight the learner. Reading one id narrowed the night set vs iOS
         // after a strap re-add (the learner could cold-start to null where iOS returned a learned value).
         // Mirrors Swift Repository.habitualMidsleepSec (importedReadIds/computedReadIds + dedupBlocks).
-        val imported = dedupSleepBlocks(importedSourceIds(deviceId).flatMap { dao.sleepSessions(it, lo, hi, 4000) })
-        val computed = dedupSleepBlocks(computedSourceIds(deviceId).flatMap { dao.sleepSessions(it, lo, hi, 4000) })
+        val rawIds = rawWhoopSourceIds(deviceId)
+        val imported = dedupSleepBlocks(rawIds.flatMap { dao.sleepSessions(it, lo, hi, 4000) })
+        val computed = dedupSleepBlocks(rawIds.map { "$it-noop" }.flatMap { dao.sleepSessions(it, lo, hi, 4000) })
         val offsetSec = (java.util.TimeZone.getDefault().getOffset(System.currentTimeMillis()) / 1000).toLong()
         val blocks = (imported + computed).mapNotNull { s ->
             val start = s.effectiveStartTs
@@ -1716,7 +1748,8 @@ class WhoopRepository(
         computed = computedSourceIds(deviceId).reversed().flatMap { dao.sleepSessions(it, from, to, limit) },
     )
 
-    /** ALL imported sleep BLOCKS across the active∪canonical union (#814/#1008), keeping every session
+    /** ALL imported sleep BLOCKS across every registered WHOOP (active first, archived included,
+     *  canonical last), keeping every session
      *  per day (a nap + a main night both survive) and dropping only EXACT-duplicate (startTs, endTs)
      *  blocks recorded under both union ids , active strap FIRST so it keeps the surviving copy. The
      *  Sleep tab's chevron walk reads this instead of the single canonical id, so a night recorded under
@@ -1724,14 +1757,16 @@ class WhoopRepository(
      *  caller's, exactly as before). Mirrors Swift Repository.unionSleepSessions. */
     suspend fun sleepSessionsUnion(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT):
         List<SleepSession> =
-        dedupSleepBlocks(importedSourceIds(deviceId).flatMap { dao.sleepSessions(it, from, to, limit) })
+        dedupSleepBlocks(rawWhoopSourceIds(deviceId).flatMap { dao.sleepSessions(it, from, to, limit) })
 
     /** The COMPUTED ("-noop") twin of [sleepSessionsUnion]: all computed sleep blocks across the computed
      *  union ids, exact-duplicate blocks dropped (active's computed sibling first). Mirrors Swift
      *  Repository.unionComputedSleepSessions. */
     suspend fun computedSleepSessionsUnion(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT):
-        List<SleepSession> =
-        dedupSleepBlocks(computedSourceIds(deviceId).flatMap { dao.sleepSessions(it, from, to, limit) })
+        List<SleepSession> {
+        val ids = rawWhoopSourceIds(deviceId).map { "$it-noop" }
+        return dedupSleepBlocks(ids.flatMap { dao.sleepSessions(it, from, to, limit) })
+    }
 
     /** Workouts over the read-side UNION of the active strap id AND the canonical "my-whoop" (#814 twin of
      *  [hrSamplesUnion] / [sleepSessionsUnion]): a re-added / newly-paired strap owns "whoop-<uuid>" while
@@ -2038,10 +2073,10 @@ class WhoopRepository(
          * The IMPORTED daily-source ids to read for an [activeDeviceId]: the UNION of the active strap id
          * AND the canonical legacy "my-whoop", active FIRST (so a per-day pick takes the active/live row).
          * SPINE / #814 + HIGH-2. A re-added strap writes live data under its fresh id while the WHOOP-export
-         * import path ([com.noop.ingest.WhoopCsvImporter]) keeps writing under the canonical "my-whoop"
-         * (never drifting), so reading only the active id orphans the import. A single-WHOOP install resolves
-         * to "my-whoop" only ⇒ one id, byte-identical reads. Companion form so [com.noop.ui.FusionDayAdapter]
-         * (an object) and the instance reads share ONE definition.
+     * import path ([com.noop.ingest.WhoopCsvImporter]) keeps writing under the canonical "my-whoop"
+     * (never drifting), so reading only the active id orphans the import. A single-WHOOP install resolves
+     * to "my-whoop" only ⇒ one id, byte-identical reads. Companion form so [com.noop.ui.FusionDayAdapter]
+     * (an object) and the instance reads share ONE definition.
          */
         fun importedSourceIdsFor(activeDeviceId: String): List<String> =
             if (activeDeviceId == WHOOP_SOURCE) listOf(WHOOP_SOURCE)
@@ -2052,6 +2087,19 @@ class WhoopRepository(
         fun computedSourceIdsFor(activeDeviceId: String): List<String> =
             importedSourceIdsFor(activeDeviceId).map { "$it-noop" }
 
+        /** Pure ordering contract shared with Swift through Tools/parity_cases/device_raw_sources.json. */
+        fun rawWhoopSourceIdsFor(activeDeviceId: String, registeredWhoopIds: List<String>): List<String> =
+            (listOf(activeDeviceId) +
+                registeredWhoopIds.filter { it != activeDeviceId && it != WHOOP_SOURCE } +
+                WHOOP_SOURCE).distinct()
+
+        /** Computed namespaces to probe for a session's motion, owner first and then the current
+         * active + canonical union. [sessionOwnerId] may already be a computed id. */
+        fun motionSourceIdsFor(activeDeviceId: String, sessionOwnerId: String): List<String> {
+            val ownerComputed = if (sessionOwnerId.endsWith("-noop")) sessionOwnerId else "$sessionOwnerId-noop"
+            return (listOf(ownerComputed) + computedSourceIdsFor(activeDeviceId)).distinct()
+        }
+
         /** Pick the winner among per-source LATEST rows ([computedSourceIdsFor] order, active-strap
          *  first): the strictly newest day wins; a shared newest day keeps the FIRST seen (the active
          *  strap) — byte-identical to what `mergeComputedSeriesUnion(...).lastOrNull()` yields on the
@@ -2372,6 +2420,24 @@ class WhoopRepository(
             return byTs.values.sortedBy { it.ts }
         }
 
+        /** Merge R-R lists with source priority matching [mergeHrByTs]. R-R has multiple legitimate
+         * beats at one timestamp, so its identity is the storage key excluding deviceId, not timestamp
+         * alone. The first (active) list wins only an exact duplicate. */
+        internal fun mergeRrByIdentity(lists: List<List<RrInterval>>): List<RrInterval> {
+            if (lists.size == 1) return lists[0]
+            data class BeatKey(val ts: Long, val rrMs: Int, val seq: Int)
+            val byBeat = LinkedHashMap<BeatKey, RrInterval>()
+            for (list in lists) for (beat in list) {
+                byBeat.putIfAbsent(BeatKey(beat.ts, beat.rrMs, beat.seq), beat)
+            }
+            return byBeat.values.sortedWith(
+                compareBy<RrInterval> { it.ts }
+                    .thenBy { it.seq }
+                    .thenBy { it.rrMs }
+                    .thenBy { it.ord },
+            )
+        }
+
         /**
          * Merge gravity sample lists into one time-ordered stream, deduped by timestamp with the FIRST
          * list (the active strap) winning on a tie. A single-id read is returned unchanged, matching the
diff --git a/android/app/src/main/java/com/noop/ingest/HealthConnectWriter.kt b/android/app/src/main/java/com/noop/ingest/HealthConnectWriter.kt
index c1c6cbef98..9cf0cd7c72 100644
--- a/android/app/src/main/java/com/noop/ingest/HealthConnectWriter.kt
+++ b/android/app/src/main/java/com/noop/ingest/HealthConnectWriter.kt
@@ -228,14 +228,14 @@ object HealthConnectWriter {
         val floor = now - WINDOW_DAYS * 86_400
         val frontier = maxOf(NoopPrefs.hcHrFrontier(context), floor)
 
-        val samples = repo.hrSamples(deviceId, from = frontier + 1, to = now, limit = 200_000)
+        val samples = repo.hrSamplesForDevice(deviceId, from = frontier + 1, to = now, limit = 200_000)
             .map { HealthExportPlan.HrPoint(it.ts, it.bpm) }
         if (samples.isEmpty()) return 0
 
         // Workout + sleep windows where the full-resolution series matters; everything else decimates.
         val windows = buildList {
             repo.workouts(deviceId, frontier, now).forEach { add(HealthExportPlan.Window(it.startTs, it.endTs)) }
-            repo.sleepSessions(deviceId, frontier, now).forEach { add(HealthExportPlan.Window(it.startTs, it.endTs)) }
+            repo.sleepSessionsForDevice(deviceId, frontier, now).forEach { add(HealthExportPlan.Window(it.startTs, it.endTs)) }
         }
 
         val plan = HealthExportPlan.heartRate(samples, windows, frontier)
diff --git a/android/app/src/main/java/com/noop/ingest/RawSensorExport.kt b/android/app/src/main/java/com/noop/ingest/RawSensorExport.kt
index 3e9028bc89..df5881b4f6 100644
--- a/android/app/src/main/java/com/noop/ingest/RawSensorExport.kt
+++ b/android/app/src/main/java/com/noop/ingest/RawSensorExport.kt
@@ -75,11 +75,11 @@ object RawSensorExport {
         counts["hr"] = hr.size
         for (s in hr) rows += LineRow(s.ts, line("hr", s.ts, 0 to n(s.bpm)))
 
-        val rr = repo.rrIntervals(deviceId, from, to, limit)
+        val rr = repo.rrIntervalsForDevice(deviceId, from, to, limit)
         counts["rr"] = rr.size
         for (s in rr) rows += LineRow(s.ts, line("rr", s.ts, 1 to n(s.rrMs)))
 
-        val grav = repo.gravitySamples(deviceId, from, to, limit)
+        val grav = repo.gravitySamplesForDevice(deviceId, from, to, limit)
         counts["gravity"] = grav.size
         for (s in grav) rows += LineRow(s.ts, line("gravity", s.ts, 2 to n(s.x), 3 to n(s.y), 4 to n(s.z)))
 
diff --git a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
index 60a3e99c69..3ac726506a 100644
--- a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
@@ -178,9 +178,9 @@ object AndroidDiagnostics {
                     if (sk.isNotEmpty()) { session = s; skin = sk; break }
                 }
             }
-            val grav = repo.gravitySamples(id, session.startTs, session.endTs, Int.MAX_VALUE)
-            val hr = repo.hrSamples(id, session.startTs, session.endTs, Int.MAX_VALUE)
-            val rr = repo.rrIntervals(id, session.startTs, session.endTs, Int.MAX_VALUE)
+            val grav = repo.gravitySamplesForDevice(id, session.startTs, session.endTs, Int.MAX_VALUE)
+            val hr = repo.hrSamplesForDevice(id, session.startTs, session.endTs, Int.MAX_VALUE)
+            val rr = repo.rrIntervalsForDevice(id, session.startTs, session.endTs, Int.MAX_VALUE)
             val resp = repo.respSamples(id, session.startTs, session.endTs, Int.MAX_VALUE)
             add("Night ${dayStamp(session.startTs)}: grav=${grav.size} hr=${hr.size} rr=${rr.size} resp=${resp.size} skin=${skin.size}")
             if (grav.isEmpty() && hr.isEmpty()) {
diff --git a/android/app/src/main/java/com/noop/ui/FullDayChartScreen.kt b/android/app/src/main/java/com/noop/ui/FullDayChartScreen.kt
index dd3e7d3f34..9b3395361d 100644
--- a/android/app/src/main/java/com/noop/ui/FullDayChartScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/FullDayChartScreen.kt
@@ -392,7 +392,9 @@ private suspend fun readTimeline(
             // the chart at day scale (the #575 point-count risk downsampleTimeline handles for the others).
             // #1036 (ryanbr): stepSec closes this Android-only day-scale flood gap.
             val hrvWindow = HrvAnalyzer.DEFAULT_ROLLING_WINDOW_SEC
-            return@withContext runCatching { repo.rrIntervals(deviceId, from, to, 200_000) }.getOrDefault(emptyList())
+            return@withContext runCatching {
+                repo.rrIntervalsUnion(deviceId, from, to, 200_000)
+            }.getOrDefault(emptyList())
                 .let { HrvAnalyzer.rollingRmssd(it, windowSec = hrvWindow, stepSec = maxOf(1, hrvWindow / 8)) }
                 .map { (ts, v) -> TimelinePoint(ts, v) }
         }
@@ -419,7 +421,7 @@ private suspend fun readTimeline(
             runCatching { repo.respSamples(deviceId, from, to, 200_000) }.getOrDefault(emptyList())
                 .map { TimelinePoint(it.ts, OuraRespScale.displayValue(it.raw, deviceId)) }
         TimelineMetric.Motion ->
-            runCatching { repo.gravitySamples(deviceId, from, to, 200_000) }.getOrDefault(emptyList())
+            runCatching { repo.gravitySamplesUnion(deviceId, from, to, 200_000) }.getOrDefault(emptyList())
                 .map { TimelinePoint(it.ts, kotlin.math.sqrt(it.x * it.x + it.y * it.y + it.z * it.z)) }
         TimelineMetric.BandSleepState ->
             // #175: the strap's OWN band sleep_state (0 wake/1 still/2 asleep/3 up) as a stepped track. Read
diff --git a/android/app/src/main/java/com/noop/ui/SleepScreen.kt b/android/app/src/main/java/com/noop/ui/SleepScreen.kt
index 3994e2df6a..6bd3b5ce94 100644
--- a/android/app/src/main/java/com/noop/ui/SleepScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepScreen.kt
@@ -230,9 +230,9 @@ fun SleepScreen(
     // and lays them along the hypnogram's timeline. A block with no stored series stays absent (honest empty
     // state for older rows whose motionJSON is NULL). Mirrors iOS SleepView.motionByStart.
     var motionByStart by remember { mutableStateOf<Map<Long, List<Double>>>(emptyMap()) }
-    LaunchedEffect(sleeps) {
+    LaunchedEffect(sleeps, vm.activeStrapId) {
         motionByStart = runCatching {
-            vm.repo.sessionMotions("my-whoop", sleeps.map { it.startTs })
+            vm.repo.sessionMotions(vm.activeStrapId, sleeps)
         }.getOrDefault(emptyMap())
     }
 
@@ -1988,4 +1988,3 @@ private fun MotionStrip(epochs: List<Double>) {
 // MARK: - Sleep metric cards, debt ledger, stages, trends + chart helpers live in SleepMetricCardsUi.kt
 // MARK: - Sleep metric detail sheet UI lives in SleepMetricDetailSheet.kt
 
-
diff --git a/android/app/src/main/java/com/noop/ui/StressScreen.kt b/android/app/src/main/java/com/noop/ui/StressScreen.kt
index df5e4a4d5f..7ca4467382 100644
--- a/android/app/src/main/java/com/noop/ui/StressScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/StressScreen.kt
@@ -124,7 +124,7 @@ fun StressScreen(vm: AppViewModel, onBreathe: () -> Unit = {}) {
     // span/beat gate is not met. Faithful twin of the iOS StressView readouts.
     var stressIndex by remember { mutableStateOf<StressIndex.Components?>(null) }
     var freqHrv by remember { mutableStateOf<HrvFreqDomain.Bands?>(null) }
-    androidx.compose.runtime.LaunchedEffect(Unit) {
+    androidx.compose.runtime.LaunchedEffect(vm.activeStrapId) {
         val read = runCatching { loadDaytimeStress(vm, NoopPrefs.stressPersonalBaseline(context)) }
             .getOrDefault(DaytimeReadout(DaytimeStress.Result.EMPTY, null, null))
         daytime = read.daytime
@@ -181,15 +181,15 @@ private suspend fun loadDaytimeStress(vm: AppViewModel, personalBaseline: Boolea
     val todayWindow = stressLocalDayWindowContaining(nowSeconds, zone)
     val from = todayWindow.fromEpochSecond
     val tzOffsetSeconds = zone.rules.getOffset(Instant.ofEpochSecond(nowSeconds)).totalSeconds.toLong()
-    val hr = vm.repo.hrSamples("my-whoop", from, nowSeconds, limit = 200_000)
+    val hr = vm.repo.hrSamplesUnion(vm.activeStrapId, from, nowSeconds, limit = 200_000)
     if (hr.size < DaytimeStress.minHourHrSamples) {
         return DaytimeReadout(DaytimeStress.Result.EMPTY, null, null)
     }
-    val rr = vm.repo.rrIntervals("my-whoop", from, nowSeconds, limit = 200_000)
+    val rr = vm.repo.rrIntervalsUnion(vm.activeStrapId, from, nowSeconds, limit = 200_000)
     // Wrist accelerometer for the motion gate: an ambulatory hour is EXERTION, not stress, so it is
     // masked rather than scored (DaytimeStress). Same repo read as R-R; empty on hardware or imports
     // with no gravity, which is exactly the "no masking, prior behaviour" degradation.
-    val gravity = vm.repo.gravitySamples("my-whoop", from, nowSeconds, limit = 200_000)
+    val gravity = vm.repo.gravitySamplesUnion(vm.activeStrapId, from, nowSeconds, limit = 200_000)
     // Score against the PERSONAL cross-day baseline only when the user opted in (#463) AND enough worn
     // history exists (DaytimeBaselines.scoringMode is the degradation gate); else the day's own calm
     // hours (DayRelative, the default). The trailing-history reads happen only past the HR-count guard
@@ -227,15 +227,15 @@ private suspend fun daytimeScoringMode(
     // Oldest → newest so the EWMA fold replays the history in order.
     for (back in baselineHistoryDays downTo 1) {
         val window = stressLocalDayWindow(todayLocalDay.minusDays(back.toLong()), zone)
-        val dayHr = vm.repo.hrSamples(
-            "my-whoop",
+        val dayHr = vm.repo.hrSamplesUnion(
+            vm.activeStrapId,
             window.fromEpochSecond,
             window.toEpochSecondInclusive,
             limit = 200_000,
         )
         if (dayHr.isEmpty()) continue   // unworn day — no floor to learn, skip the R-R read
-        val dayRr = vm.repo.rrIntervals(
-            "my-whoop",
+        val dayRr = vm.repo.rrIntervalsUnion(
+            vm.activeStrapId,
             window.fromEpochSecond,
             window.toEpochSecondInclusive,
             limit = 200_000,
diff --git a/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt b/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
index 77e9480a5a..846e760fc8 100644
--- a/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
@@ -407,10 +407,10 @@ private fun TestCentreLiveReadoutPanel(
         val now = System.currentTimeMillis() / 1_000
         val from = now - 60 * 60
         hrSamples = runCatching {
-            vm.repo.hrSamples(activeStrapId, from, now, limit = 10_000)
+            vm.repo.hrSamplesForDevice(activeStrapId, from, now, limit = 10_000)
         }.getOrDefault(emptyList())
         gravitySamples = runCatching {
-            vm.repo.gravitySamples(activeStrapId, from, now, limit = 10_000)
+            vm.repo.gravitySamplesForDevice(activeStrapId, from, now, limit = 10_000)
         }.getOrDefault(emptyList())
     }
 
diff --git a/android/app/src/test/java/com/noop/analytics/IntelligenceEngineJacocoBudgetTest.kt b/android/app/src/test/java/com/noop/analytics/IntelligenceEngineJacocoBudgetTest.kt
index a7e9502570..c8c2c733ea 100644
--- a/android/app/src/test/java/com/noop/analytics/IntelligenceEngineJacocoBudgetTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/IntelligenceEngineJacocoBudgetTest.kt
@@ -89,7 +89,7 @@ class IntelligenceEngineJacocoBudgetTest {
             "Vitality upsert" to Regex("""\brepo\s*\.\s*upsertMetricSeries\s*\(\s*listOf\s*\("""),
             "Apple Health read" to Regex("""\brepo\s*\.\s*appleDaily\s*\(\s*WhoopRepository\s*\.\s*APPLE_HEALTH_SOURCE\b"""),
             "Health Connect read" to Regex("""\brepo\s*\.\s*appleDaily\s*\(\s*WhoopRepository\s*\.\s*HEALTH_CONNECT_SOURCE\b"""),
-            "gravity samples" to Regex("""\brepo\s*\.\s*gravitySamples\s*\("""),
+            "gravity samples" to Regex("""\brepo\s*\.\s*gravitySamplesForDevice\s*\("""),
             "calibration" to Regex("""\bStepsEstimateEngine\s*\.\s*calibrate\s*\("""),
             "step upsert" to Regex("""\brepo\s*\.\s*upsertMetricSeries\s*\(\s*estRows\s*\)"""),
             "calibration persistence" to Regex("""\bpersistStepsCalibration\s*\("""),
diff --git a/android/app/src/test/java/com/noop/data/DeviceRawSourceParityTest.kt b/android/app/src/test/java/com/noop/data/DeviceRawSourceParityTest.kt
new file mode 100644
index 0000000000..20cf93fc18
--- /dev/null
+++ b/android/app/src/test/java/com/noop/data/DeviceRawSourceParityTest.kt
@@ -0,0 +1,107 @@
+package com.noop.data
+
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.io.File
+
+/**
+ * Android half of the cross-platform raw-source contract. The same JSON oracle is consumed by
+ * `DeviceRawSourceParityTests.swift`; adding a strap-resolution rule on one platform without its twin
+ * therefore breaks one of the two native suites instead of silently changing Stress semantics.
+ */
+class DeviceRawSourceParityTest {
+    private fun repositoryRoot(): File {
+        val cwd = File(System.getProperty("user.dir") ?: ".")
+        return listOf(cwd.parentFile, cwd, cwd.parentFile?.parentFile)
+            .filterNotNull().firstOrNull { File(it, "android/app/src/main/java").isDirectory }
+            ?: error("repository root not found from $cwd; consumer wiring guard must fail closed")
+    }
+
+    private fun production(path: String): String = File(repositoryRoot(), path).also {
+        assertTrue("production source missing: $path", it.isFile)
+    }.readText()
+
+    private fun fixture(): JSONObject {
+        val cwd = File(System.getProperty("user.dir") ?: ".")
+        val file = listOf(
+            File(cwd, "../Tools/parity_cases/device_raw_sources.json"),
+            File(cwd, "Tools/parity_cases/device_raw_sources.json"),
+            File(cwd, "../../Tools/parity_cases/device_raw_sources.json"),
+        ).firstOrNull(File::isFile)
+        assertNotNull("device_raw_sources.json not found from $cwd; parity must fail closed", file)
+        return JSONObject(file!!.readText())
+    }
+
+    @Test
+    fun sourceResolutionMatchesSharedOracle() {
+        val cases = fixture().getJSONArray("sourceCases")
+        repeat(cases.length()) { index ->
+            val case = cases.getJSONObject(index)
+            val active = case.getString("activeDeviceId")
+            val registered = case.getJSONArray("registeredWhoopIds").let { xs ->
+                List(xs.length()) { xs.getString(it) }
+            }
+            val imported = case.getJSONArray("imported").let { xs ->
+                List(xs.length()) { xs.getString(it) }
+            }
+            val computed = case.getJSONArray("computed").let { xs ->
+                List(xs.length()) { xs.getString(it) }
+            }
+            val actual = WhoopRepository.rawWhoopSourceIdsFor(active, registered)
+            assertEquals(case.getString("name"), imported, actual)
+            assertEquals(case.getString("name"), computed, actual.map { "$it-noop" })
+        }
+    }
+
+    @Test
+    fun rrIdentityMergeMatchesSharedOracle() {
+        val cases = fixture().getJSONArray("rrCases")
+        repeat(cases.length()) { index ->
+            val case = cases.getJSONObject(index)
+            val sources = case.getJSONArray("sources")
+            val inputs = List(sources.length()) { sourceIndex ->
+                val source = sources.getJSONObject(sourceIndex)
+                val id = source.getString("id")
+                val beats = source.getJSONArray("beats")
+                List(beats.length()) { beatIndex ->
+                    val beat = beats.getJSONObject(beatIndex)
+                    RrInterval(
+                        id, beat.getLong("ts"), beat.getInt("rrMs"), seq = beat.getInt("seq"),
+                        ord = beat.optInt("ord").takeIf { beat.has("ord") },
+                    )
+                }
+            }
+            val actual = WhoopRepository.mergeRrByIdentity(inputs).map {
+                listOf(it.ts, it.rrMs, it.seq, it.ord)
+            }
+            val expectedJson = case.getJSONArray("expected")
+            val expected = List(expectedJson.length()) {
+                expectedJson.getJSONObject(it).let { beat ->
+                    listOf(
+                        beat.getLong("ts"), beat.getInt("rrMs"), beat.getInt("seq"),
+                        beat.optInt("ord").takeIf { beat.has("ord") },
+                    )
+                }
+            }
+            assertEquals(case.getString("name"), expected, actual)
+        }
+    }
+
+    @Test
+    fun aiCoachAndFullDayTimelineUseAllSourceRawFacades() {
+        val coach = production("android/app/src/main/java/com/noop/ai/AiCoach.kt")
+        assertTrue("AI Coach stress context must union R-R across the worn timeline", coach.contains("repo.rrIntervalsUnion("))
+        assertFalse("AI Coach must not select one R-R owner", coach.contains("repo.rrIntervalsForDevice(activeStrapId()"))
+
+        val timeline = production("android/app/src/main/java/com/noop/ui/FullDayChartScreen.kt")
+        for (call in listOf("repo.hrBucketsUnion(", "repo.rrIntervalsUnion(", "repo.gravitySamplesUnion(")) {
+            assertTrue("Full Day Chart must use $call", timeline.contains(call))
+        }
+        assertFalse("Full Day HRV must not pin R-R to the selected device", timeline.contains("repo.rrIntervalsForDevice(deviceId,"))
+        assertFalse("Full Day motion must not pin gravity to the selected device", timeline.contains("repo.gravitySamplesForDevice(deviceId,"))
+    }
+}
diff --git a/android/app/src/test/java/com/noop/data/RawTimelineRepositoryDaoTest.kt b/android/app/src/test/java/com/noop/data/RawTimelineRepositoryDaoTest.kt
new file mode 100644
index 0000000000..e1e4dda3e6
--- /dev/null
+++ b/android/app/src/test/java/com/noop/data/RawTimelineRepositoryDaoTest.kt
@@ -0,0 +1,250 @@
+package com.noop.data
+
+import java.lang.reflect.Proxy
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertSame
+import org.junit.Test
+
+/** DAO-backed contract tests for the public device-aware repository reads. */
+class RawTimelineRepositoryDaoTest {
+    private fun rr(source: String, ts: Long, ms: Int) =
+        RrInterval(deviceId = source, ts = ts, rrMs = ms)
+
+    private fun device(id: String, status: String, addedAt: Long, brand: String = "WHOOP") =
+        PairedDeviceRow(id, brand, "test", null, null, "whoop", "hr", status, addedAt, addedAt)
+
+    private val allWhoops = listOf(
+        device("whoop-old", "archived", 1),
+        device("my-whoop", "paired", 2),
+        device("polar-ignored", "paired", 3, brand = "Polar"),
+        device("whoop-new", "active", 4),
+    )
+
+    @Test
+    fun rrIntervalsUnionQueriesActiveThenCanonicalAndMergesTheirRows() = runBlocking {
+        val queried = mutableListOf<String>()
+        val active = listOf(rr("whoop-new", 101, 810), rr("whoop-new", 103, 830))
+        val canonical = listOf(rr("my-whoop", 100, 800), rr("my-whoop", 101, 810))
+        val repo = WhoopRepository(proxyDao { method, args ->
+            when (method) {
+                "pairedDevices" -> listOf(
+                    device("my-whoop", "paired", 1),
+                    device("whoop-new", "active", 2),
+                )
+                "rrIntervals" -> {
+                    val id = args[0] as String
+                    queried += id
+                    if (id == "whoop-new") active else canonical
+                }
+                else -> throw UnsupportedOperationException(method)
+            }
+        })
+
+        val rows = repo.rrIntervalsUnion("whoop-new", 10, 20, limit = 50)
+
+        assertEquals(listOf("whoop-new", "my-whoop"), queried)
+        assertEquals(listOf(100L, 101L, 103L), rows.map { it.ts })
+        assertEquals("whoop-new", rows.first { it.ts == 101L }.deviceId)
+    }
+
+    @Test
+    fun rrIntervalsUnionCanonicalActivePerformsOneLegacyReadUnchanged() = runBlocking {
+        val queried = mutableListOf<String>()
+        val canonical = listOf(rr("my-whoop", 100, 800), rr("my-whoop", 101, 810))
+        val repo = WhoopRepository(proxyDao { method, args ->
+            when (method) {
+                "pairedDevices" -> listOf(device("my-whoop", "active", 1))
+                "rrIntervals" -> {
+                    queried += args[0] as String
+                    canonical
+                }
+                else -> throw UnsupportedOperationException(method)
+            }
+        })
+
+        val rows = repo.rrIntervalsUnion("my-whoop", 10, 20, limit = 50)
+
+        assertEquals(listOf("my-whoop"), queried)
+        assertSame("single-source legacy result must pass through unchanged", canonical, rows)
+    }
+
+    @Test
+    fun rawUnionsQueryActiveThenEveryHistoricalWhoopThenCanonical() = runBlocking {
+        val queried = mutableListOf<Pair<String, String>>()
+        val repo = WhoopRepository(proxyDao { method, args ->
+            when (method) {
+                "pairedDevices" -> allWhoops
+                "hrSamples" -> { queried += "hr" to (args[0] as String); emptyList<HrSample>() }
+                "hrBuckets" -> { queried += "hrBucket" to (args[0] as String); emptyList<HrBucket>() }
+                "rrIntervals" -> { queried += "rr" to (args[0] as String); emptyList<RrInterval>() }
+                "gravitySamples" -> { queried += "gravity" to (args[0] as String); emptyList<GravitySample>() }
+                else -> throw UnsupportedOperationException(method)
+            }
+        })
+
+        repo.hrSamplesUnion("whoop-new", 10, 20)
+        repo.hrBucketsUnion("whoop-new", 10, 20)
+        repo.rrIntervalsUnion("whoop-new", 10, 20)
+        repo.gravitySamplesUnion("whoop-new", 10, 20)
+
+        val expected = listOf("whoop-new", "whoop-old", "my-whoop")
+        assertEquals(expected, queried.filter { it.first == "hr" }.map { it.second })
+        assertEquals(expected, queried.filter { it.first == "hrBucket" }.map { it.second })
+        assertEquals(expected, queried.filter { it.first == "rr" }.map { it.second })
+        assertEquals(expected, queried.filter { it.first == "gravity" }.map { it.second })
+    }
+
+    @Test
+    fun rawResolverKeepsActiveNonWhoopButExcludesUnrelatedNonWhoopRegistryRows() = runBlocking {
+        val queried = mutableListOf<String>()
+        val repo = WhoopRepository(proxyDao { method, args ->
+            when (method) {
+                "pairedDevices" -> listOf(
+                    device("whoop-old", "archived", 1),
+                    device("polar-other", "paired", 2, brand = "Polar"),
+                    device("polar-active", "active", 3, brand = "Polar"),
+                    device("my-whoop", "paired", 4),
+                )
+                "hrSamples" -> { queried += args[0] as String; emptyList<HrSample>() }
+                else -> throw UnsupportedOperationException(method)
+            }
+        })
+
+        repo.hrSamplesUnion("polar-active", 10, 20)
+
+        assertEquals(listOf("polar-active", "whoop-old", "my-whoop"), queried)
+        assertEquals(
+            listOf("polar-active", "whoop-old", "my-whoop"),
+            WhoopRepository.rawWhoopSourceIdsFor(
+                activeDeviceId = "polar-active",
+                registeredWhoopIds = listOf("whoop-old", "my-whoop"),
+            ),
+        )
+    }
+
+    @Test
+    fun sessionMotionFallbackIncludesArchivedWhoopButNotOtherBrands() = runBlocking {
+        val queried = mutableListOf<String>()
+        val repo = WhoopRepository(proxyDao { method, args ->
+            when (method) {
+                "pairedDevices" -> allWhoops
+                "sessionMotionJson" -> {
+                    val id = args[0] as String
+                    queried += id
+                    if (id == "whoop-old-noop") "[3,4]" else null
+                }
+                else -> throw UnsupportedOperationException(method)
+            }
+        })
+
+        val result = repo.sessionMotions(
+            "whoop-new",
+            listOf(SleepSession(deviceId = "unknown-owner", startTs = 1_000, endTs = 2_000)),
+        )
+
+        assertEquals(listOf("unknown-owner-noop", "whoop-new-noop", "whoop-old-noop"), queried)
+        assertEquals(listOf(3.0, 4.0), result[1_000L])
+    }
+
+    @Test
+    fun sleepUnionsIncludeArchivedRawAndComputedNights() = runBlocking {
+        val queried = mutableListOf<String>()
+        val rows = mapOf(
+            "whoop-new" to listOf(SleepSession("whoop-new", 3_000, 4_000)),
+            "whoop-old" to listOf(SleepSession("whoop-old", 1_000, 2_000)),
+            "whoop-new-noop" to listOf(SleepSession("whoop-new-noop", 7_000, 8_000)),
+            "whoop-old-noop" to listOf(SleepSession("whoop-old-noop", 5_000, 6_000)),
+        )
+        val repo = WhoopRepository(proxyDao { method, args ->
+            when (method) {
+                "pairedDevices" -> allWhoops
+                "sleepSessions" -> {
+                    val id = args[0] as String
+                    queried += id
+                    rows[id].orEmpty()
+                }
+                else -> throw UnsupportedOperationException(method)
+            }
+        })
+
+        val raw = repo.sleepSessionsUnion("whoop-new", 0, 10_000)
+        val computed = repo.computedSleepSessionsUnion("whoop-new", 0, 10_000)
+
+        assertEquals(
+            listOf("whoop-new", "whoop-old", "my-whoop", "whoop-new-noop", "whoop-old-noop", "my-whoop-noop"),
+            queried,
+        )
+        assertEquals(listOf("whoop-new", "whoop-old"), raw.map { it.deviceId })
+        assertEquals(listOf("whoop-new-noop", "whoop-old-noop"), computed.map { it.deviceId })
+    }
+
+    @Test
+    fun habitualMidsleepLearnsAcrossActiveAndArchivedStrapHistory() = runBlocking {
+        val queried = mutableListOf<String>()
+        val now = System.currentTimeMillis() / 1_000L
+        fun nights(id: String, dayOffset: IntRange) = dayOffset.map { day ->
+            val start = now - day * 86_400L
+            SleepSession(id, start, start + 8 * 3_600L)
+        }
+        val rows = mapOf(
+            "whoop-new" to nights("whoop-new", 1..7),
+            "whoop-old-noop" to nights("whoop-old-noop", 8..14),
+        )
+        val repo = WhoopRepository(proxyDao { method, args ->
+            when (method) {
+                "pairedDevices" -> allWhoops
+                "sleepSessions" -> {
+                    val id = args[0] as String
+                    queried += id
+                    rows[id].orEmpty()
+                }
+                else -> throw UnsupportedOperationException(method)
+            }
+        })
+
+        val habitual = repo.habitualMidsleepSec("whoop-new", days = 30)
+
+        assertEquals(
+            listOf("whoop-new", "whoop-old", "my-whoop", "whoop-new-noop", "whoop-old-noop", "my-whoop-noop"),
+            queried,
+        )
+        org.junit.Assert.assertNotNull(habitual)
+    }
+
+    @Test
+    fun sessionMotionsPrefersOldSessionOwnerOverSameStartFallbacks() = runBlocking {
+        val queried = mutableListOf<Pair<String, Long>>()
+        val start = 1_000L
+        val values = mapOf(
+            "whoop-old-noop" to "[1,2]",
+            "whoop-new-noop" to "[8,8]",
+            "my-whoop-noop" to "[9,9]",
+        )
+        val repo = WhoopRepository(proxyDao { method, args ->
+            when (method) {
+                "pairedDevices" -> allWhoops
+                "sessionMotionJson" -> {
+                    val id = args[0] as String
+                    queried += id to (args[1] as Long)
+                    values[id]
+                }
+                else -> throw UnsupportedOperationException(method)
+            }
+        })
+
+        val result = repo.sessionMotions(
+            activeStrapId = "whoop-new",
+            sessions = listOf(SleepSession(deviceId = "whoop-old", startTs = start, endTs = start + 3600)),
+        )
+
+        assertEquals(listOf("whoop-old-noop" to start), queried)
+        assertEquals(listOf(1.0, 2.0), result[start])
+    }
+
+    private fun proxyDao(call: (String, Array<out Any?>) -> Any?): WhoopDao =
+        Proxy.newProxyInstance(
+            WhoopDao::class.java.classLoader,
+            arrayOf(WhoopDao::class.java),
+        ) { _, method, args -> call(method.name, args ?: emptyArray()) } as WhoopDao
+}
diff --git a/android/app/src/test/java/com/noop/data/RawTimelineUnionTest.kt b/android/app/src/test/java/com/noop/data/RawTimelineUnionTest.kt
new file mode 100644
index 0000000000..a5332a9a16
--- /dev/null
+++ b/android/app/src/test/java/com/noop/data/RawTimelineUnionTest.kt
@@ -0,0 +1,51 @@
+package com.noop.data
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertSame
+import org.junit.Test
+
+class RawTimelineUnionTest {
+    private fun rr(source: String, ts: Long, ms: Int, seq: Int = 0) =
+        RrInterval(deviceId = source, ts = ts, rrMs = ms, seq = seq)
+
+    @Test
+    fun rrUnionIsOrderedAndActiveWinsExactBeatTie() {
+        val active = listOf(rr("whoop-new", 102, 810), rr("whoop-new", 100, 800))
+        val canonical = listOf(rr("my-whoop", 99, 790), rr("my-whoop", 100, 800), rr("my-whoop", 101, 805))
+
+        val merged = WhoopRepository.mergeRrByIdentity(listOf(active, canonical))
+
+        assertEquals(listOf(99L, 100L, 101L, 102L), merged.map { it.ts })
+        assertEquals("whoop-new", merged.first { it.ts == 100L }.deviceId)
+    }
+
+    @Test
+    fun rrUnionKeepsDistinctBeatsAtSameTimestamp() {
+        val merged = WhoopRepository.mergeRrByIdentity(
+            listOf(
+                listOf(rr("whoop-new", 100, 800, seq = 0), rr("whoop-new", 100, 810, seq = 1)),
+                listOf(rr("my-whoop", 100, 800, seq = 0)),
+            ),
+        )
+
+        assertEquals(listOf(800, 810), merged.map { it.rrMs })
+    }
+
+    @Test
+    fun rrSingleCanonicalSourceIsUnchanged() {
+        val only = listOf(rr("my-whoop", 100, 800))
+        assertSame(only, WhoopRepository.mergeRrByIdentity(listOf(only)))
+    }
+
+    @Test
+    fun motionSourcesPreferSessionOwnerThenActiveAndCanonicalComputed() {
+        assertEquals(
+            listOf("whoop-old-noop", "whoop-new-noop", "my-whoop-noop"),
+            WhoopRepository.motionSourceIdsFor("whoop-new", "whoop-old-noop"),
+        )
+        assertEquals(
+            listOf("my-whoop-noop"),
+            WhoopRepository.motionSourceIdsFor("my-whoop", "my-whoop"),
+        )
+    }
+}
diff --git a/android/app/src/test/java/com/noop/ui/RawSensorDeviceScopeAuditTest.kt b/android/app/src/test/java/com/noop/ui/RawSensorDeviceScopeAuditTest.kt
new file mode 100644
index 0000000000..dd7777403d
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/RawSensorDeviceScopeAuditTest.kt
@@ -0,0 +1,208 @@
+package com.noop.ui
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.io.File
+
+/**
+ * Architecture guard for the split between the canonical WHOOP history namespace and physical
+ * sensor ownership.
+ *
+ * `"my-whoop"` is a valid, stable source for imported/daily series. It is not, however, the id of
+ * every physical strap: a re-paired or second strap banks HR, R-R and accelerometer samples under
+ * `whoop-<id>`. A production UI call that passes the canonical literal to a raw-sensor API therefore
+ * silently drops those samples. Stress exposed this failure as a missing intraday chart.
+ *
+ * This deliberately narrow source audit bans only that invalid combination. Dynamic owner reads
+ * (session detail and diagnostics) remain legal, as do canonical `metricSeries` and import uses.
+ * Device-aware repository methods are also legal because their first argument is an active/owning
+ * device id and the repository performs the canonical union.
+ */
+class RawSensorDeviceScopeAuditTest {
+
+    private fun uiSourceDir(): File {
+        val userDir = File(System.getProperty("user.dir") ?: ".")
+        val found = listOf(
+            File(userDir, "src/main/java/com/noop/ui"),
+            File(userDir, "app/src/main/java/com/noop/ui"),
+            File(userDir, "android/app/src/main/java/com/noop/ui"),
+        ).firstOrNull { it.isDirectory }
+        assertNotNull(
+            "com/noop/ui not found from user.dir=$userDir; a source guard must fail closed",
+            found,
+        )
+        return found!!
+    }
+
+    private fun repositorySource(): String {
+        val javaRoot = uiSourceDir().parentFile
+        val repository = File(javaRoot, "data/WhoopRepository.kt")
+        assertTrue("WhoopRepository.kt not found", repository.isFile)
+        return stripComments(repository.readText())
+    }
+
+    /** Removes comments so examples and migration notes do not count as production calls. */
+    private fun stripComments(source: String): String {
+        val withoutBlocks = Regex("/\\*.*?\\*/", RegexOption.DOT_MATCHES_ALL).replace(source, "")
+        return withoutBlocks.lineSequence().joinToString("\n") { line ->
+            var quoted = false
+            var escaped = false
+            var cut = -1
+            var index = 0
+            while (index < line.length - 1) {
+                val char = line[index]
+                if (char == '"' && !escaped) quoted = !quoted
+                if (!quoted && char == '/' && line[index + 1] == '/') {
+                    cut = index
+                    break
+                }
+                escaped = char == '\\' && !escaped
+                if (char != '\\') escaped = false
+                index++
+            }
+            if (cut >= 0) line.substring(0, cut) else line
+        }
+    }
+
+    private val directRawRead = Regex("""\b(hrSamples(?:ForDevice)?|rrIntervals(?:ForDevice)?|gravitySamples(?:ForDevice)?)\s*\(""")
+
+    private data class RawCall(val method: String, val args: String, val offset: Int)
+
+    /** Extract raw calls with balanced parentheses so named arguments can appear in any order. */
+    private fun rawCalls(source: String): List<RawCall> {
+        val clean = stripComments(source)
+        val calls = mutableListOf<RawCall>()
+        directRawRead.findAll(clean).forEach { match ->
+            val open = clean.indexOf('(', match.range.first)
+            var depth = 1
+            var quoted = false
+            var escaped = false
+            var end = open + 1
+            while (end < clean.length && depth > 0) {
+                val char = clean[end]
+                if (char == '"' && !escaped) quoted = !quoted
+                if (!quoted) {
+                    if (char == '(') depth++
+                    if (char == ')') depth--
+                }
+                escaped = char == '\\' && !escaped
+                if (char != '\\') escaped = false
+                end++
+            }
+            if (depth == 0) {
+                calls += RawCall(
+                    method = match.groupValues[1],
+                    args = clean.substring(open + 1, end - 1),
+                    offset = match.range.first,
+                )
+            }
+        }
+        return calls
+    }
+
+    private fun offenders(source: String): List<RawCall> = rawCalls(source).filter { call ->
+        call.args.trimStart().startsWith("\"my-whoop\"") ||
+            Regex("""\bdeviceId\s*=\s*"my-whoop"""").containsMatchIn(call.args)
+    }
+
+    @Test
+    fun scannerRejectsCanonicalRawReadsButAllowsCanonicalMetricsAndDeviceAwareReads() {
+        assertTrue(offenders("repo.hrSamples(\"my-whoop\", from, to)").isNotEmpty())
+        assertTrue(offenders("repo.rrIntervals(\n deviceId = \"my-whoop\", from, to)").isNotEmpty())
+        assertTrue(offenders("repo.gravitySamples(  \"my-whoop\", from, to)").isNotEmpty())
+        assertTrue(offenders("repo.hrSamplesForDevice(\"my-whoop\", from, to)").isNotEmpty())
+        assertTrue(
+            offenders(
+                "repo.hrSamples(from = from, to = to, limit = 5, deviceId = \"my-whoop\")",
+            ).isNotEmpty(),
+        )
+
+        assertTrue(offenders("repo.metricSeries(\"my-whoop\", \"stress\", from, to)").isEmpty())
+        assertTrue(offenders("repo.hrSamplesUnion(activeStrapId, from, to)").isEmpty())
+        assertTrue(offenders("repo.rrIntervals(session.deviceId, from, to)").isEmpty())
+        assertTrue(offenders("// repo.hrSamples(\"my-whoop\", from, to)").isEmpty())
+        assertTrue(offenders("/* repo.gravitySamples(\"my-whoop\", from, to) */").isEmpty())
+    }
+
+    @Test
+    fun repositoryHasNoAmbiguousDeviceScopedRawReaderNames() {
+        val source = repositorySource()
+        for (oldName in listOf("hrSamples", "hrBuckets", "rrIntervals", "gravitySamples", "sleepSessions")) {
+            assertFalse(
+                "Device-scoped repository reads must say ForDevice; ambiguous $oldName can be misused by UI",
+                Regex("""suspend\s+fun\s+$oldName\s*\(""").containsMatchIn(source),
+            )
+        }
+        for (explicitName in listOf(
+            "hrSamplesForDevice", "hrBucketsForDevice", "rrIntervalsForDevice",
+            "gravitySamplesForDevice", "sleepSessionsForDevice",
+        )) {
+            assertTrue("Missing explicit repository API $explicitName", source.contains("fun $explicitName("))
+        }
+    }
+
+    @Test
+    fun productionUiNeverPinsRawSensorReadsToCanonicalWhoop() {
+        val violations = mutableListOf<String>()
+        uiSourceDir().walkTopDown()
+            .filter { it.isFile && it.extension == "kt" }
+            .forEach { file ->
+                val source = file.readText()
+                offenders(source).forEach { call ->
+                    val line = stripComments(source).take(call.offset).count { it == '\n' } + 1
+                    violations += "${file.name}:$line: ${call.method}(${call.args.trim().take(80)})"
+                }
+            }
+
+        assertFalse(
+            "Raw HR/R-R/gravity UI reads must use an owning device or a device-aware repository API; " +
+                "`my-whoop` is only the canonical history/import namespace:\n" +
+                violations.joinToString("\n"),
+            violations.isNotEmpty(),
+        )
+    }
+
+    @Test
+    fun stressUsesAllThreeDeviceAwareRawTimelines() {
+        val stress = File(uiSourceDir(), "StressScreen.kt")
+        assertTrue("StressScreen.kt not found", stress.isFile)
+        val source = stripComments(stress.readText())
+
+        val bypasses = directRawRead.findAll(source).map { it.value }.toList()
+        assertTrue(
+            "Stress must not select a raw device id itself; use the repository unions: $bypasses",
+            bypasses.isEmpty(),
+        )
+        for (api in listOf("hrSamplesUnion(", "rrIntervalsUnion(", "gravitySamplesUnion(")) {
+            assertTrue("Stress must read through $api", source.contains(api))
+        }
+    }
+
+    @Test
+    fun coachStressAndFullDayChartUseDeviceAwareRawTimelines() {
+        val javaRoot = uiSourceDir().parentFile
+        val coach = File(javaRoot, "ai/AiCoach.kt")
+        val chart = File(uiSourceDir(), "FullDayChartScreen.kt")
+        assertTrue("AiCoach.kt not found", coach.isFile)
+        assertTrue("FullDayChartScreen.kt not found", chart.isFile)
+
+        val coachSource = stripComments(coach.readText())
+        assertTrue(
+            "AI Coach derived stress must include archived strap R-R history",
+            coachSource.contains("repo.rrIntervalsUnion(activeStrapId()"),
+        )
+        assertFalse(
+            "AI Coach derived stress must not bypass the device-aware R-R resolver",
+            coachSource.contains("repo.rrIntervalsForDevice(activeStrapId()"),
+        )
+
+        val chartSource = stripComments(chart.readText())
+        for (api in listOf("hrSamplesUnion(", "hrBucketsUnion(", "rrIntervalsUnion(", "gravitySamplesUnion(")) {
+            assertTrue("Full-day chart must read through $api", chartSource.contains(api))
+        }
+        assertFalse(chartSource.contains("repo.rrIntervalsForDevice(deviceId"))
+        assertFalse(chartSource.contains("repo.gravitySamplesForDevice(deviceId"))
+    }
+}
diff --git a/android/app/src/test/java/com/noop/ui/StressRawReadScopeTest.kt b/android/app/src/test/java/com/noop/ui/StressRawReadScopeTest.kt
new file mode 100644
index 0000000000..6005342488
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/StressRawReadScopeTest.kt
@@ -0,0 +1,33 @@
+package com.noop.ui
+
+import java.io.File
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class StressRawReadScopeTest {
+    private fun source(): String {
+        var dir: File? = File(System.getProperty("user.dir"))
+        repeat(5) {
+            val current = dir ?: return@repeat
+            val candidate = File(current, "app/src/main/java/com/noop/ui/StressScreen.kt")
+            if (candidate.isFile) return candidate.readText()
+            dir = current.parentFile
+        }
+        error("StressScreen.kt not found from ${System.getProperty("user.dir")}")
+    }
+
+    @Test
+    fun intradayAndBaselineUseDeviceAwareRawReads() {
+        val text = source().replace(Regex("\\s+"), " ")
+        assertTrue(text.contains("hrSamplesUnion(vm.activeStrapId"))
+        assertTrue(text.contains("rrIntervalsUnion(vm.activeStrapId"))
+        assertTrue(text.contains("gravitySamplesUnion(vm.activeStrapId"))
+        assertFalse(Regex("(hrSamples|rrIntervals|gravitySamples)\\(\\s*\"my-whoop\"").containsMatchIn(text))
+    }
+
+    @Test
+    fun storedDailyStressRemainsCanonical() {
+        assertTrue(source().contains("metricSeries(\"my-whoop\", \"stress\""))
+    }
+}

From f2476f95deec9280fe67bc20d143dd5e44676fe4 Mon Sep 17 00:00:00 2001
From: Zebsi <66969936+Zebsi235@users.noreply.github.com>
Date: Sat, 29 Aug 2026 15:30:36 +0200
Subject: [PATCH 067/333] ecg: correct opcode 124's argument mapping to the
 hardware values (#1727)

Whoop5Ecg.ControlSignal mapped opcode 124's argument as stop=0 / start=1 / restart=2, read off the vendor client's declaration ORDER and shipped explicitly unverified in #896. On a WHOOP MG the mapping is inverted: 0 is refused with FAILURE, 1 STOPS generation, 2 STARTS it.

Each argument was sent on its own while watching the type-43 stream rather than the ack, across two sessions. What settles it is the strap's own firmware: CONSOLE_LOGS emit "MAX86176: Set ECG ON" once per 124 = 2 - eight sends, eight lines - and the gaps match to within 0.2 s on the STRAP's uptime clock, so the correlation does not rest on the reporter's clock. A 10-cycle automated pass scored startFlat=10/10 and restartActive=9/10, and an isolation test with TOGGLE_LABRADOR_FILTERED(139) closed showed 124 = 2 still logging Set ECG ON while no packets arrived - so 139 gates the STREAM, not the front end.

The label was not the load-bearing part. requestsRealtimeData accepted `arg == START.raw || arg == RESTART.raw`, i.e. 1 and 2. Since 1 actually stops generation, a run whose last act was to stop the stream was scored as having asked for data, and Whoop5EcgProbe's "acknowledged and then not honoured" verdict could fire on silence the run itself caused - a false-finding generator inside a diagnostic. It now accepts only START. RESTART is removed rather than renumbered, so nothing can send the refused 0.

Why this survived its tests is worth recording: the old cases asserted through ControlSignal.X.raw, so they moved with the enum and stayed green whatever the byte meant on the wire. The new ones assert LITERAL wire bytes on both platforms, and two of the four fail-then-pass failures are cases that could not have failed before. One fixture was corrected rather than masked - "the data request was refused" was built as sent(124, 1, Failure), which under the corrected mapping requests nothing.

Scope is stated in the doc block rather than implied: one device, one firmware (WS50_r00 / 50.39.1.0). #1100 ran WS50_r03 / 50.40.1.0 and nothing here says the two agree. The trade is hardware-attested on one device against guessed from a declaration order on none.

Checks 15/15 including test (WhoopProtocol) on macOS, which covers the Swift half the author could not compile locally.

Thanks @Zebsi235.
---
 ATTRIBUTION.md                                | 14 ++++++---
 .../Sources/WhoopProtocol/Whoop5Ecg.swift     | 27 +++++++++++++---
 .../WhoopProtocolTests/Whoop5EcgTests.swift   | 31 +++++++++++++------
 .../main/java/com/noop/protocol/Whoop5Ecg.kt  | 28 +++++++++++++++--
 .../com/noop/protocol/Whoop5EcgProbeTest.kt   | 18 ++++++-----
 .../java/com/noop/protocol/Whoop5EcgTest.kt   | 11 ++++---
 docs/PROTOCOL.md                              | 18 ++++++++---
 7 files changed, 107 insertions(+), 40 deletions(-)

diff --git a/ATTRIBUTION.md b/ATTRIBUTION.md
index dbd6f5563c..a84b289370 100644
--- a/ATTRIBUTION.md
+++ b/ATTRIBUTION.md
@@ -57,11 +57,15 @@ This is long-standing practice, not a one-off. Worked examples already in the tr
   field order, widths and enum values for `FilteredLabradorPacket` / `RawLabradorPacket`, plus the
   `{revision, arg, padding}` command payload shape, re-derived from static analysis of the vendor's iOS
   client. The four command NUMBERS were already in our own `CommandNumber` table from the whoomp/goose
-  work above. Everything ships as an **unvalidated candidate**: no strap has yet been asked whether it
-  honours these commands, the decode backs no metric, and the fields nobody can attest (the wrist enum's
-  raw values, the progress "timed out" sentinel, the ECG sample unit, the packet type byte) are carried
-  raw rather than named. The on-strap rhythm classifier's verdict is decoded as a byte and is never
-  presented as a finding — NOOP is not a medical device.
+  work above. Most of it still ships as an **unvalidated candidate**: the decode backs no metric, and the
+  fields nobody can attest (the wrist enum's raw values, the progress "timed out" sentinel, the ECG
+  sample unit, the packet type byte) are carried raw rather than named. **One exception is now attested
+  rather than inferred:** `ControlSignal`'s raw values were also read off the client's enum order, and a
+  WHOOP MG (`WS50_r00`, fw `50.39.1.0`) contradicts that reading — `1` stops generation, `2` starts it,
+  `0` is refused. The enum now carries the hardware values with the device and firmware named. A
+  hardware-observed value is strictly stronger than the inference it replaces, but it is one device.
+  The on-strap rhythm classifier's verdict is decoded as a byte and is never presented as a finding —
+  NOOP is not a medical device.
 
 And the line held from the other side:
 
diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/Whoop5Ecg.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/Whoop5Ecg.swift
index 18f7038c37..0a674be35b 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/Whoop5Ecg.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/Whoop5Ecg.swift
@@ -285,16 +285,31 @@ public enum Whoop5Ecg {
     }
 
     /// The `mainControlECGDataGeneration` argument.
+    ///
+    /// ⚠️ These raw values are ATTESTED ON ONE DEVICE, and they are NOT the vendor client's declaration
+    /// order. The previous `stop = 0 / start = 1 / restart = 2` was read off that order and shipped
+    /// unverified (#896). On a WHOOP MG (`WS50_r00`, fw `50.39.1.0`) each argument was sent on its own
+    /// while watching the type-43 stream rather than the ack:
+    ///
+    ///   - `0` is REFUSED — the strap answers `FAILURE(0)` and generation is unchanged, so there is no
+    ///     case for it here and nothing can send it.
+    ///   - `1` STOPS generation.
+    ///   - `2` STARTS it. The type-43 stream only follows once `TOGGLE_LABRADOR_FILTERED (139)` is on, so
+    ///     the working turn-on order is `139 = 1` then `124 = 2`. 139 gates the STREAM rather than the
+    ///     front end: with 139 closed, `124 = 2` still made the strap's own console log
+    ///     `MAX86176: Set ECG ON` while no packets arrived (8 sends, 8 console lines, #891).
+    ///
+    /// One device, one firmware. #1100 ran `WS50_r03` / `50.40.1.0` and nothing here says the two agree.
+    /// Whether `2` is a plain start or a stop-then-start is NOT distinguishable from a stream that was
+    /// already off, so the case is named for what it achieves rather than for the client's third name.
     public enum ControlSignal: UInt8, Equatable, Sendable, CaseIterable {
-        case stop = 0
-        case start = 1
-        case restart = 2
+        case stop = 1
+        case start = 2
 
         public var token: String {
             switch self {
             case .stop: return "stop"
             case .start: return "start"
-            case .restart: return "restart"
             }
         }
     }
@@ -367,7 +382,9 @@ public enum Whoop5Ecg {
         case toggleRealtimeFilteredEcgCmd:
             return arg != 0
         case mainControlEcgDataGenerationCmd:
-            return arg == ControlSignal.start.rawValue || arg == ControlSignal.restart.rawValue
+            // Only the START value. `ControlSignal.stop` (1) halts generation, so a run whose last act
+            // was that one asked for nothing and its silence is the expected outcome, not a finding.
+            return arg == ControlSignal.start.rawValue
         default:
             return false
         }
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5EcgTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5EcgTests.swift
index 043904808e..f6076bb7f2 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5EcgTests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5EcgTests.swift
@@ -400,9 +400,8 @@ final class Whoop5EcgTests: XCTestCase {
         XCTAssertEqual(Whoop5Ecg.selectWristPayload(.left), [0x01, 0x01])
         XCTAssertEqual(Whoop5Ecg.togglePayload(on: true), [0x01, 0x01])
         XCTAssertEqual(Whoop5Ecg.togglePayload(on: false), [0x01, 0x00])
-        XCTAssertEqual(Whoop5Ecg.controlPayload(.stop), [0x01, 0x00])
-        XCTAssertEqual(Whoop5Ecg.controlPayload(.start), [0x01, 0x01])
-        XCTAssertEqual(Whoop5Ecg.controlPayload(.restart), [0x01, 0x02])
+        XCTAssertEqual(Whoop5Ecg.controlPayload(.stop), [0x01, 0x01])
+        XCTAssertEqual(Whoop5Ecg.controlPayload(.start), [0x01, 0x02])
     }
 
     func testCommandFramesAreExactlyWhatTheSendPathBuilds() {
@@ -415,7 +414,11 @@ final class Whoop5EcgTests: XCTestCase {
                        puffinCommandFrame(cmd: 0x8B, seq: seq, payload: [0x01, 0x01]))
         XCTAssertEqual(Whoop5Ecg.toggleSaveRawEcgFrame(on: false, seq: seq),
                        puffinCommandFrame(cmd: 0x7D, seq: seq, payload: [0x01, 0x00]))
+        // LITERAL wire bytes, not `ControlSignal.start.rawValue`. Asserting through the symbol is what
+        // let the previous mapping stay green through a renumber: the test moved with the enum.
         XCTAssertEqual(Whoop5Ecg.mainControlEcgDataGenerationFrame(.start, seq: seq),
+                       puffinCommandFrame(cmd: 0x7C, seq: seq, payload: [0x01, 0x02]))
+        XCTAssertEqual(Whoop5Ecg.mainControlEcgDataGenerationFrame(.stop, seq: seq),
                        puffinCommandFrame(cmd: 0x7C, seq: seq, payload: [0x01, 0x01]))
     }
 
@@ -442,8 +445,11 @@ final class Whoop5EcgTests: XCTestCase {
     }
 
     func testOffPathIsTheExactInverseOfTheOnPath() {
-        // The UI promises an explicit OFF path; these are the bytes it sends.
-        XCTAssertEqual(Whoop5Ecg.mainControlEcgDataGenerationFrame(.stop, seq: 1)[12], 0)
+        // The UI promises an explicit OFF path; these are the bytes it sends. The two toggles turn off
+        // with arg 0, but the generation stop is arg 1 — on hardware 0 is REFUSED (FAILURE(0)), and 1 is
+        // the verb that halts the stream. See the ControlSignal doc block. The old uniform-zero
+        // expectation here was written from the enum-order mapping this file no longer carries.
+        XCTAssertEqual(Whoop5Ecg.mainControlEcgDataGenerationFrame(.stop, seq: 1)[12], 1)
         XCTAssertEqual(Whoop5Ecg.toggleRealtimeFilteredEcgFrame(on: false, seq: 1)[12], 0)
         XCTAssertEqual(Whoop5Ecg.toggleSaveRawEcgFrame(on: false, seq: 1)[12], 0)
     }
@@ -495,10 +501,14 @@ final class Whoop5EcgTests: XCTestCase {
         XCTAssertFalse(Whoop5Ecg.requestsRealtimeData(cmd: Whoop5Ecg.toggleRealtimeFilteredEcgCmd, arg: 0))
         XCTAssertTrue(Whoop5Ecg.requestsRealtimeData(cmd: Whoop5Ecg.mainControlEcgDataGenerationCmd,
                                                      arg: Whoop5Ecg.ControlSignal.start.rawValue))
-        XCTAssertTrue(Whoop5Ecg.requestsRealtimeData(cmd: Whoop5Ecg.mainControlEcgDataGenerationCmd,
-                                                     arg: Whoop5Ecg.ControlSignal.restart.rawValue))
         XCTAssertFalse(Whoop5Ecg.requestsRealtimeData(cmd: Whoop5Ecg.mainControlEcgDataGenerationCmd,
                                                       arg: Whoop5Ecg.ControlSignal.stop.rawValue))
+        // The same assertions again on LITERAL arguments. Through the symbol alone, a renumber moves
+        // the test with the enum and the predicate stays green whatever it now means on the wire —
+        // which is how `124 = 1` was scored as "asked for data" while it stopped generation.
+        XCTAssertTrue(Whoop5Ecg.requestsRealtimeData(cmd: 124, arg: 2))
+        XCTAssertFalse(Whoop5Ecg.requestsRealtimeData(cmd: 124, arg: 1))
+        XCTAssertFalse(Whoop5Ecg.requestsRealtimeData(cmd: 124, arg: 0))
         // SELECT_WRIST configures which wrist; it starts nothing, on EITHER argument. This is the
         // opcode whose silence was being reported as a firmware block.
         for wrist in Whoop5Ecg.WristSelection.allCases {
@@ -515,21 +525,22 @@ final class Whoop5EcgTests: XCTestCase {
         // The packet count comes from a HEURISTIC that ordinary traffic can trip; the result codes are
         // attested wire semantics. So a firmware FAILURE must not be overridden by candidate frames —
         // the old precedence turned one loose match into an unhedged "not blocked".
-        let failed = [sent(124, arg: 1, .failure)]
+        // arg 2, not 1: on hardware `124 = 2` is the one that asks for generation.
+        let failed = [sent(124, arg: 2, .failure)]
         XCTAssertEqual(Whoop5EcgProbe.verdict(steps: failed, ecgPacketsSeen: 12, windowSeconds: 30),
                        .dataRequestRefused(commands: ["TOGGLE_LABRADOR_DATA_GENERATION(124)"]))
         let unsupported = [sent(139, arg: 1, .unsupported)]
         XCTAssertEqual(Whoop5EcgProbe.verdict(steps: unsupported, ecgPacketsSeen: 12, windowSeconds: 30),
                        .opcodeUnsupported(commands: ["TOGGLE_LABRADOR_FILTERED(139)"]))
         // With no contrary result code, candidates are the verdict — as candidates, not as proof.
-        let ok = [sent(124, arg: 1, .success)]
+        let ok = [sent(124, arg: 2, .success)]
         XCTAssertEqual(Whoop5EcgProbe.verdict(steps: ok, ecgPacketsSeen: 12, windowSeconds: 30),
                        .ecgCandidatesArrived(packets: 12))
     }
 
     func testCandidateVerdictIsHedgedNotAssertedAsProof() {
         let text = Whoop5EcgProbe.report(
-            steps: [sent(124, arg: 1, .success)],
+            steps: [sent(124, arg: 2, .success)],
             ecgPacketsSeen: 3, candidateFrames: ["type=0x28 len=220"], windowSeconds: 30)
         XCTAssertTrue(text.contains("CANDIDATE, not proof"))
         // The old wording asserted the conclusion outright; it must not come back.
diff --git a/android/app/src/main/java/com/noop/protocol/Whoop5Ecg.kt b/android/app/src/main/java/com/noop/protocol/Whoop5Ecg.kt
index f1435a5cf8..f686b088f1 100644
--- a/android/app/src/main/java/com/noop/protocol/Whoop5Ecg.kt
+++ b/android/app/src/main/java/com/noop/protocol/Whoop5Ecg.kt
@@ -166,9 +166,29 @@ object Whoop5Ecg {
         RIGHT(0, "right"), LEFT(1, "left")
     }
 
-    /** The mainControlECGDataGeneration argument. */
+    /**
+     * The mainControlECGDataGeneration argument.
+     *
+     * ⚠️ These raw values are ATTESTED ON ONE DEVICE, and they are NOT the vendor client's declaration
+     * order. The previous `STOP(0) / START(1) / RESTART(2)` was read off that order and shipped
+     * unverified (#896). On a WHOOP MG (`WS50_r00`, fw `50.39.1.0`) each argument was sent on its own
+     * while watching the type-43 stream rather than the ack:
+     *
+     *  - `0` is REFUSED — the strap answers `FAILURE(0)` and generation is unchanged, so there is no
+     *    case for it here and nothing can send it.
+     *  - `1` STOPS generation.
+     *  - `2` STARTS it. The type-43 stream only follows once `TOGGLE_LABRADOR_FILTERED (139)` is on, so
+     *    the working turn-on order is `139 = 1` then `124 = 2`. 139 gates the STREAM rather than the
+     *    front end: with 139 closed, `124 = 2` still made the strap's own console log
+     *    `MAX86176: Set ECG ON` while no packets arrived (8 sends, 8 console lines, #891).
+     *
+     * One device, one firmware. #1100 ran `WS50_r03` / `50.40.1.0` and nothing here says the two agree.
+     * Whether `2` is a plain start or a stop-then-start is NOT distinguishable from a stream that was
+     * already off, so the case is named for what it achieves rather than for the client's third name.
+     * Twin of Swift `ControlSignal`.
+     */
     enum class ControlSignal(val raw: Int, val token: String) {
-        STOP(0, "stop"), START(1, "start"), RESTART(2, "restart")
+        STOP(1, "stop"), START(2, "start")
     }
 
     fun commandPayload(arg: Int): List<Int> = listOf(COMMAND_REVISION, arg)
@@ -229,7 +249,9 @@ object Whoop5Ecg {
     fun requestsRealtimeData(cmd: Int, arg: Int): Boolean = when (cmd) {
         TOGGLE_REALTIME_FILTERED_ECG_CMD -> arg != 0
         MAIN_CONTROL_ECG_DATA_GENERATION_CMD ->
-            arg == ControlSignal.START.raw || arg == ControlSignal.RESTART.raw
+            // Only the START value. `ControlSignal.STOP` (1) halts generation, so a run whose last act
+            // was that one asked for nothing and its silence is the expected outcome, not a finding.
+            arg == ControlSignal.START.raw
         else -> false
     }
 
diff --git a/android/app/src/test/java/com/noop/protocol/Whoop5EcgProbeTest.kt b/android/app/src/test/java/com/noop/protocol/Whoop5EcgProbeTest.kt
index ab1f288dba..6dcdbb844f 100644
--- a/android/app/src/test/java/com/noop/protocol/Whoop5EcgProbeTest.kt
+++ b/android/app/src/test/java/com/noop/protocol/Whoop5EcgProbeTest.kt
@@ -76,18 +76,18 @@ class Whoop5EcgProbeTest {
                 Whoop5Ecg.ControlSignal.START.raw,
             ),
         )
-        assertTrue(
-            Whoop5Ecg.requestsRealtimeData(
-                Whoop5Ecg.MAIN_CONTROL_ECG_DATA_GENERATION_CMD,
-                Whoop5Ecg.ControlSignal.RESTART.raw,
-            ),
-        )
         assertFalse(
             Whoop5Ecg.requestsRealtimeData(
                 Whoop5Ecg.MAIN_CONTROL_ECG_DATA_GENERATION_CMD,
                 Whoop5Ecg.ControlSignal.STOP.raw,
             ),
         )
+        // The same three assertions again on LITERAL arguments. Through the symbol alone, a renumber
+        // moves the test with the enum and the predicate stays green whatever it now means on the wire —
+        // which is how `124 = 1` was scored as "asked for data" while it stopped generation.
+        assertTrue(Whoop5Ecg.requestsRealtimeData(124, 2))
+        assertFalse(Whoop5Ecg.requestsRealtimeData(124, 1))
+        assertFalse(Whoop5Ecg.requestsRealtimeData(124, 0))
         // SELECT_WRIST configures which wrist; it starts nothing, on EITHER argument. This is the opcode
         // whose silence was being reported as a firmware block.
         for (wrist in Whoop5Ecg.WristSelection.entries) {
@@ -102,9 +102,11 @@ class Whoop5EcgProbeTest {
 
     @Test
     fun attestedResultCodesOutrankTheShapeHeuristic() {
+        // arg 2, not 1: on hardware `124 = 2` is the one that asks for generation. Written literally
+        // rather than through `ControlSignal.START.raw` so the fixture states the wire byte it means.
         assertEquals(
             Whoop5EcgProbe.Verdict.DataRequestRefused(listOf("TOGGLE_LABRADOR_DATA_GENERATION(124)")),
-            Whoop5EcgProbe.verdict(listOf(sent(124, 1, Whoop5EcgProbe.CommandOutcome.Failure)), 12, 30),
+            Whoop5EcgProbe.verdict(listOf(sent(124, 2, Whoop5EcgProbe.CommandOutcome.Failure)), 12, 30),
         )
         assertEquals(
             Whoop5EcgProbe.Verdict.OpcodeUnsupported(listOf("TOGGLE_LABRADOR_FILTERED(139)")),
@@ -112,7 +114,7 @@ class Whoop5EcgProbeTest {
         )
         assertEquals(
             Whoop5EcgProbe.Verdict.EcgCandidatesArrived(12),
-            Whoop5EcgProbe.verdict(listOf(sent(124, 1, Whoop5EcgProbe.CommandOutcome.Success)), 12, 30),
+            Whoop5EcgProbe.verdict(listOf(sent(124, 2, Whoop5EcgProbe.CommandOutcome.Success)), 12, 30),
         )
     }
 
diff --git a/android/app/src/test/java/com/noop/protocol/Whoop5EcgTest.kt b/android/app/src/test/java/com/noop/protocol/Whoop5EcgTest.kt
index c8961c0033..faadbfd3ac 100644
--- a/android/app/src/test/java/com/noop/protocol/Whoop5EcgTest.kt
+++ b/android/app/src/test/java/com/noop/protocol/Whoop5EcgTest.kt
@@ -405,9 +405,10 @@ class Whoop5EcgTest {
         assertEquals(listOf(0x01, 0x01), Whoop5Ecg.selectWristPayload(Whoop5Ecg.WristSelection.LEFT))
         assertEquals(listOf(0x01, 0x01), Whoop5Ecg.togglePayload(on = true))
         assertEquals(listOf(0x01, 0x00), Whoop5Ecg.togglePayload(on = false))
-        assertEquals(listOf(0x01, 0x00), Whoop5Ecg.controlPayload(Whoop5Ecg.ControlSignal.STOP))
-        assertEquals(listOf(0x01, 0x01), Whoop5Ecg.controlPayload(Whoop5Ecg.ControlSignal.START))
-        assertEquals(listOf(0x01, 0x02), Whoop5Ecg.controlPayload(Whoop5Ecg.ControlSignal.RESTART))
+        // LITERAL wire bytes, not `ControlSignal.X.raw`. Asserting through the symbol is what let the
+        // previous mapping stay green through a renumber: the test moved with the enum.
+        assertEquals(listOf(0x01, 0x01), Whoop5Ecg.controlPayload(Whoop5Ecg.ControlSignal.STOP))
+        assertEquals(listOf(0x01, 0x02), Whoop5Ecg.controlPayload(Whoop5Ecg.ControlSignal.START))
     }
 
     @Test
@@ -432,8 +433,8 @@ class Whoop5EcgTest {
         val cases = listOf(
             Whoop5Ecg.toggleRealtimeFilteredEcgFrame(on = true, seq = 9) to (0x8B to 1),
             Whoop5Ecg.toggleSaveRawEcgFrame(on = false, seq = 9) to (0x7D to 0),
-            Whoop5Ecg.mainControlEcgDataGenerationFrame(Whoop5Ecg.ControlSignal.START, seq = 9) to (0x7C to 1),
-            Whoop5Ecg.mainControlEcgDataGenerationFrame(Whoop5Ecg.ControlSignal.STOP, seq = 9) to (0x7C to 0),
+            Whoop5Ecg.mainControlEcgDataGenerationFrame(Whoop5Ecg.ControlSignal.START, seq = 9) to (0x7C to 2),
+            Whoop5Ecg.mainControlEcgDataGenerationFrame(Whoop5Ecg.ControlSignal.STOP, seq = 9) to (0x7C to 1),
             Whoop5Ecg.selectWristFrame(Whoop5Ecg.WristSelection.RIGHT, seq = 9) to (0x7B to 0),
         )
         for ((frame, expected) in cases) {
diff --git a/docs/PROTOCOL.md b/docs/PROTOCOL.md
index 2927329ba2..975a09fed4 100644
--- a/docs/PROTOCOL.md
+++ b/docs/PROTOCOL.md
@@ -459,9 +459,19 @@ mapping as unconfirmed — the 5/MG is known to remap opcodes into the high spac
 at 145/146/147 there versus 10/11 on a 4.0), so a code that is accepted is not evidence that it means
 what the name says.
 
-What is confirmed: on a real WHOOP 5 MG (`WS50_r03`), 124, 125 and 139 are all **accepted** — each
-answers `COMMAND_RESPONSE` with result `SUCCESS(1)` — and no ECG-shaped data followed in a 30-second
-window. That is a null result with several live explanations (an open electrode circuit, flash rather
+The turn-on ORDER and the 124 argument are attested on one device. On a WHOOP MG (`WS50_r00`, fw
+`50.39.1.0`), 139 gates the **stream**: with it off nothing arrives, so the working sequence is
+**`139 = 1` then `124 = 2`**, after which type-43 carries a ~100 Hz single-channel i16 waveform,
+present only while both clasp electrodes are held. 139 does not appear to gate the front end itself —
+with 139 closed, `124 = 2` still made the strap's own `CONSOLE_LOGS` report `MAX86176: Set ECG ON`
+while no packets arrived (eight sends, eight console lines, correlated on the strap's own uptime;
+#891). Both directions are reversible (`124 = 1` or `139 = 0` stop the stream, both `SUCCESS`);
+disconnecting also clears it. One device, one firmware — see the ⚠️ on `ControlSignal`.
+
+What is confirmed on the other device: on a real WHOOP 5 MG (`WS50_r03`), 124, 125 and 139 are all
+**accepted** — each answers `COMMAND_RESPONSE` with result `SUCCESS(1)` — and no ECG-shaped data
+followed in a 30-second window. Those runs used `124 = 1` as their start verb, which under the mapping
+above stops generation. That is a null result with several live explanations (an open electrode circuit, flash rather
 than a realtime channel, a wrong opcode mapping, no start verb, a flag block, an entitlement gate); see
 #891. The three reply frames are pinned as decode fixtures in `Whoop5CommandResponseTests` /
 `CommandCatalogueTest`.
@@ -813,7 +823,7 @@ Three reasons the numbers are **not** settled, all of which the on-hardware prob
 | Code | Command | Arg | Reversible? |
 |-----:|---------|-----|---|
 | 123 (0x7B) | `SELECT_WRIST` | `0` right / `1` left — **inferred from enum order, unconfirmed** | **Persistent device config** — survives disconnect; re-writable |
-| 124 (0x7C) | `TOGGLE_LABRADOR_DATA_GENERATION` | `0` stop / `1` start / `2` restart | yes — `stop` is the OFF path |
+| 124 (0x7C) | `TOGGLE_LABRADOR_DATA_GENERATION` | `1` stop / `2` start — `0` is REFUSED (`FAILURE(0)`, generation unchanged). Attested on one MG (`WS50_r00`, fw `50.39.1.0`); the earlier `0`/`1`/`2` reading came from the client's enum order | yes — `124 = 1` is the OFF path, and `139 = 0` also stops it |
 | 125 (0x7D) | `TOGGLE_LABRADOR_RAW_SAVE` | `0`/`1` | yes |
 | 139 (0x8B) | `TOGGLE_LABRADOR_FILTERED` | `0`/`1` | yes |
 

From e56f8a0346413120a046008b76677f8ddc468818 Mon Sep 17 00:00:00 2001
From: Bernd Helm <bhelm@users.noreply.github.com>
Date: Sat, 29 Aug 2026 15:54:04 +0200
Subject: [PATCH 068/333] feat(imu): unlock WHOOP 5/MG 100 Hz capture and
 labeled recording sessions (#1709)

NOOP already decoded the WHOOP 5/MG's 100 Hz 6-axis IMU format but could not reliably start the stream: several plausible commands acknowledged and produced nothing. Hardware work establishes that the producer needs an ordered pair - START_RAW_DATA(81), then TOGGLE_IMU_MODE(106) with [1, 1] - after which a stock 5/MG emits continuous type-43/51 packets. No research firmware, no developer hardware.

On top of that sequence this adds a bounded capture workflow: explicit recording sessions that survive Bluetooth interruptions and absorb packets arriving later via history sync, live connection/coverage readouts, editable start and end times, session comments, timestamped markers with quick types and free text, retention across repeated exports, and a self-contained ZIP export. Markers are what make it useful for labeled datasets - transitions, mistakes and notable moments get recorded without touching the sensor stream.

Two review rounds are worth recording, because both findings were documentation asserting more than the code did.

The parity oracle declared a capability neither platform implemented: raw_data_removed_with_session paired an Apple marker "capturedAt >= ? AND capturedAt <= ?" - a SQLite time-range deletion that exists nowhere in the tree, left over from the abandoned raw-outbox design - with an Android-only export ZIP path. It now declares session_files_removed_with_session and anchors on real code both sides. The dropped ZIP line was checked rather than assumed: macOS exports through NSSavePanel so the user picks the destination and the app keeps no copy, while Android must materialise the archive in cacheDir/logs for FileProvider and therefore must clean it up. That asymmetry is platform-inherent and never belonged in a PARITY oracle.

The migration comments claimed rawImuSample was "known not to contain usable rows" in deployed installations - a claim about other people's devices that nothing here could support. They now describe what is actually true and checkable: a bounded, opt-in, write-only rolling cache with no analytics, UI or export consumer, retired once session-owned IMU moved to the file-backed store. The table has zero readers; the near-miss is ImuFeatureExtractor, which takes a RawImuSample DECODER type fed from live BLE frames, not from the table. Dropping it is backup-safe because a .noopbak is a whole-file SQLite copy classified from sqlite_master, and the table appears in no required-table list.

Verification did not rest on the branch alone. The author's fork app-build ran the exact head, but main had moved five merges, so app-build was dispatched upstream against the PR merged with live main: green on macOS and iOS. That is the job that was RED on the stale marker, so its passing is direct evidence the guard runs rather than merely existing. Alongside 15/15 checks, the Android collector, contract and migration suites were run locally - 17 tests, counts confirmed non-zero so a mistyped filter could not read as a pass.

One comment is corrected in a follow-up: deleteSession promises "evaluate every deletion even if one fails" while the IMU delete returns ahead of the export-ZIP delete. The behaviour is right - the session stays visible and retryable, and deleteFiles is idempotent on both platforms - so it is the comment that was wrong.

Thanks @bhelm.
---
 .../NoopLocalAccessCore/LocalAccessCore.swift |   2 +-
 .../Sources/WhoopProtocol/Whoop5RawImu.swift  |   6 +-
 .../Sources/WhoopStore/Database.swift         |  16 +-
 .../WhoopStore/DeviceRegistryStore.swift      |   1 -
 .../WhoopStore/Sources/WhoopStore/Reads.swift |   2 +-
 .../Sources/WhoopStore/StreamStore.swift      |  33 +-
 .../Sources/WhoopStore/TimestampHeal.swift    |   2 +-
 .../DeepCaptureChannelsTests.swift            |   1 -
 .../Tests/WhoopStoreTests/PruneTests.swift    |   1 +
 .../Tests/WhoopStoreTests/ReadTests.swift     |   9 +-
 .../Resources/schema_oracle.json              |  31 +-
 README.md                                     |   1 +
 Strand/BLE/BLEManager.swift                   |  71 ++-
 Strand/BLE/PuffinDeepBufferLog.swift          |   6 +-
 Strand/Collect/Collector.swift                |  50 +-
 Strand/Collect/ImuSessionFileStore.swift      | 189 +++++++
 Strand/Collect/RawCaptureWindow.swift         |   4 +-
 Strand/Collect/RawDataSessionStore.swift      | 237 +++++++++
 Strand/Data/DeviceRegistry.swift              |   2 +
 Strand/Resources/Localizable.xcstrings        |  66 +++
 Strand/Screens/AddDeviceWizard.swift          |   4 +-
 Strand/Screens/RawDataCollectorView.swift     | 400 ++++++++++++++
 Strand/Screens/SettingsView.swift             |  13 +-
 Strand/Screens/TestCentreView.swift           | 105 ++++
 StrandTests/RawDataCollectorParityTests.swift |  57 ++
 StrandTests/RawDataSessionStoreTests.swift    | 158 ++++++
 .../Resources/raw_data_collector_parity.json  |  69 +++
 .../java/com/noop/ble/PuffinDeepBufferLog.kt  |   4 +-
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 174 +++++-
 .../main/java/com/noop/data/DeviceRegistry.kt |   2 -
 .../java/com/noop/data/DeviceRegistryDao.kt   |   2 -
 .../src/main/java/com/noop/data/Entities.kt   |  37 +-
 .../src/main/java/com/noop/data/WhoopDao.kt   |  23 -
 .../main/java/com/noop/data/WhoopDatabase.kt  |  14 +-
 .../java/com/noop/data/WhoopRepository.kt     |  34 +-
 .../java/com/noop/ingest/RawSensorExport.kt   |   3 +-
 .../src/main/java/com/noop/protocol/Enums.kt  |   4 +
 .../java/com/noop/protocol/Whoop5RawImu.kt    |   6 +-
 .../noop/testcentre/GroundTruthCollector.kt   | 475 +++++++++++++++++
 .../noop/testcentre/ImuSessionFileStore.kt    | 225 ++++++++
 .../main/java/com/noop/ui/AddDeviceWizard.kt  |   2 +-
 .../app/src/main/java/com/noop/ui/AppRoot.kt  |   8 +-
 .../src/main/java/com/noop/ui/AppViewModel.kt |  10 +-
 .../com/noop/ui/GroundTruthCollectorScreen.kt | 497 ++++++++++++++++++
 .../main/java/com/noop/ui/SettingsScreen.kt   |  86 +--
 .../main/java/com/noop/ui/TestCentreScreen.kt | 188 ++++++-
 .../app/src/main/res/values-de/strings.xml    |  73 +++
 .../app/src/main/res/values-es/strings.xml    |  73 +++
 .../app/src/main/res/values-fr/strings.xml    |  73 +++
 .../app/src/main/res/values-pl/strings.xml    |  73 +++
 .../src/main/res/values-pt-rPT/strings.xml    |  73 +++
 .../app/src/main/res/values-zh/strings.xml    |  73 +++
 android/app/src/main/res/values/strings.xml   |  75 ++-
 .../analytics/RegistryDayOwnerSourceTest.kt   |   2 -
 .../com/noop/ble/ConnectionPriorityTest.kt    |   7 +
 .../noop/ble/SourceCoordinatorAdoptionTest.kt |   2 -
 .../com/noop/data/DeepCaptureMigrationTest.kt |   1 -
 .../java/com/noop/data/DeviceRegistryTest.kt  |   4 +-
 .../java/com/noop/data/RawImuMigrationTest.kt |  46 +-
 .../RawCaptureExportContractTest.kt           |  67 +++
 .../testcentre/RawDataCollectorParityTest.kt  |  51 ++
 .../resources/raw_data_collector_parity.json  |  69 +++
 .../app/src/test/resources/schema_oracle.json |  31 +-
 docs/BLE_REVERSE_ENGINEERING.md               |  22 +-
 docs/DATA_MODEL.md                            |   5 +
 docs/PROTOCOL.md                              |   6 +
 docs/RAW_DATA_CAPTURE.md                      | 139 +++++
 docs/WHOOP5_DEEP_DATA.md                      |  20 +-
 68 files changed, 3900 insertions(+), 415 deletions(-)
 create mode 100644 Strand/Collect/ImuSessionFileStore.swift
 create mode 100644 Strand/Collect/RawDataSessionStore.swift
 create mode 100644 Strand/Screens/RawDataCollectorView.swift
 create mode 100644 StrandTests/RawDataCollectorParityTests.swift
 create mode 100644 StrandTests/RawDataSessionStoreTests.swift
 create mode 100644 StrandTests/Resources/raw_data_collector_parity.json
 create mode 100644 android/app/src/main/java/com/noop/testcentre/GroundTruthCollector.kt
 create mode 100644 android/app/src/main/java/com/noop/testcentre/ImuSessionFileStore.kt
 create mode 100644 android/app/src/main/java/com/noop/ui/GroundTruthCollectorScreen.kt
 create mode 100644 android/app/src/test/java/com/noop/testcentre/RawCaptureExportContractTest.kt
 create mode 100644 android/app/src/test/java/com/noop/testcentre/RawDataCollectorParityTest.kt
 create mode 100644 android/app/src/test/resources/raw_data_collector_parity.json
 create mode 100644 docs/RAW_DATA_CAPTURE.md

diff --git a/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/LocalAccessCore.swift b/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/LocalAccessCore.swift
index 632e181a28..2e08b9543f 100644
--- a/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/LocalAccessCore.swift
+++ b/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/LocalAccessCore.swift
@@ -332,7 +332,7 @@ public final class ReadonlyNoopStore {
             let decodedTables = [
                 "hrSample", "rrInterval", "event", "battery", "spo2Sample",
                 "skinTempSample", "respSample", "gravitySample", "ppgHrSample", "stepSample",
-                "sleepStateSample", "ppgWaveformSample", "rawImuSample", "v18AuxSample",
+                "sleepStateSample", "ppgWaveformSample", "v18AuxSample",
             ]
             var decodedRows = 0
             for table in decodedTables where tableNames.contains(table) {
diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/Whoop5RawImu.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/Whoop5RawImu.swift
index bd2230957e..b419231782 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/Whoop5RawImu.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/Whoop5RawImu.swift
@@ -8,9 +8,9 @@ import Foundation
 // app captures (documented in Asherlc/dofek `docs/whoop-ble-protocol.md` as the type-0x2B raw packet)
 // and the same columnar convention as the 4.0's 1917 REALTIME_RAW_DATA variant.
 //
-// IMPORTANT: the 5/MG's *live* raw-IMU stream is firmware-refused (TOGGLE_IMU_MODE / cmd 106 acks but
-// never streams), but the OFFLOAD buffer carries full accel AND gyro — so 100 Hz 6-axis IMU IS
-// obtainable on the 5.0 via the historical path.
+// Hardware validation on a WHOOP 5/MG established that live raw IMU requires START_RAW_DATA (81)
+// followed by TOGGLE_IMU_MODE (106) with payload [1,1]. Opcode 106 on its own acknowledges without
+// starting the producer. The same 1244-byte shape is also banked and later returned by history sync.
 //
 // Frame layout (the reassembled BLE frame = 8-byte puffin envelope + payload; offsets are FRAME-absolute):
 //   @15  u32 LE   strap unix seconds for this 1-second frame
diff --git a/Packages/WhoopStore/Sources/WhoopStore/Database.swift b/Packages/WhoopStore/Sources/WhoopStore/Database.swift
index 88f8ead082..b43dc9cb1f 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/Database.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/Database.swift
@@ -572,16 +572,8 @@ extension WhoopStore {
         // the six wire columns (ax…az,gx…gz). Twin of the Android `rawImuSample` table (MIGRATION_20_21);
         // same column order + PK so a `.noopbak` round-trips byte-for-byte.
         //
-        // CONSUMER STATUS — deliberately none on this platform, in the same shape as the `ppgWaveformSample`
-        // (v27) and `v18AuxSample` (v31) notes. The writer (`Collector.storeRawImu`) is instrument-first: it
-        // fires only with raw capture enabled AND a 5/MG deep-data unlock, and is bounded to
-        // `WhoopStore.rawImuRetentionRows` (3600 one-second buffers, a rolling window — not a corpus). No
-        // analytic, score, gate, UI or export reads a row: the only SQL is the retention DELETE (`StreamStore`)
-        // plus a COUNT in the storage-stats readout (`LocalAccessCore`); `ImuFeatureExtractor` takes the
-        // protocol struct, never this table, so it is not a consumer either. Swift has NO reader yet, on
-        // purpose — a reader lands WITH a validated consumer, not before ("artifact, not one match", CLAUDE.md).
-        // Android keeps a dormant `rawImuSamples` reader (zero callers) for the eventual cross-check; do NOT
-        // "clean up" either side as dead code — the retained rows are the deliverable. Audit: #978.
+        // Historical rolling cache. Its opt-in writer retained at most 3,600 one-second rows, but no analytics,
+        // UI or export consumed them. v41 retires those legacy rows after file-backed capture replaces the cache.
         migrator.registerMigration("v28-raw-imu") { db in
             try db.create(table: "rawImuSample") { t in
                 t.column("deviceId", .text).notNull()
@@ -887,6 +879,10 @@ extension WhoopStore {
                 t.add(column: "skinTempC", .double)
             }
         }
+        // Retire the bounded, write-only legacy cache. Session-owned IMU now lives in the file-backed store.
+        migrator.registerMigration("v41-drop-raw-imu-sample") { db in
+            try db.drop(table: "rawImuSample")
+        }
         return migrator
     }
 }
diff --git a/Packages/WhoopStore/Sources/WhoopStore/DeviceRegistryStore.swift b/Packages/WhoopStore/Sources/WhoopStore/DeviceRegistryStore.swift
index 7788dc3642..0793863242 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/DeviceRegistryStore.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/DeviceRegistryStore.swift
@@ -134,7 +134,6 @@ public struct DeviceRegistryStore: Sendable {
         "ppgWaveformSample",
         // v28-raw-imu (#423): the opt-in 5/MG raw-IMU offload capture is deviceId-keyed too — "delete all
         // of this device's data" must clear it, or the raw inertial samples survive deletion (same defect).
-        "rawImuSample",
         // v31-deep-capture-channels: the banked 5/MG v18 auxiliary fields are deviceId-keyed per-second
         // rows like every stream above, so a "delete all of this device's data" must clear them too.
         "v18AuxSample",
diff --git a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
index 68341f9b08..76446bb471 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
@@ -397,7 +397,7 @@ extension WhoopStore {
             let rawTables = ["hrSample", "rrInterval", "event", "battery",
                              "spo2Sample", "skinTempSample", "respSample", "gravitySample",
                              "stepSample", "ppgHrSample", "sleepStateSample", "ppgWaveformSample",
-                             "rawImuSample", "v18AuxSample"]
+                             "v18AuxSample"]
             var decoded = 0
             for t in rawTables {
                 decoded += try Int.fetchOne(db, sql: "SELECT COUNT(*) FROM \(t)") ?? 0
diff --git a/Packages/WhoopStore/Sources/WhoopStore/StreamStore.swift b/Packages/WhoopStore/Sources/WhoopStore/StreamStore.swift
index 43bf0b7fe4..5d15437044 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/StreamStore.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/StreamStore.swift
@@ -58,14 +58,9 @@ extension WhoopStore {
         return out
     }
 
-    /// #423 rolling retention for the raw-IMU capture table (twin of Kotlin `RAW_IMU_RETENTION_ROWS`):
-    /// ~1 h at 1 row/strap-second (~4 MB) hard-caps the table during a multi-day offload replay.
-    public static let rawImuRetentionRows = 3600
-
     /// v31 rolling retention for the v18 aux-slot table (twin of Kotlin `V18_AUX_RETENTION_ROWS`).
     ///
-    /// `rawImuSample` is the closest precedent — raw instrumentation banked as a blob, capped rather than
-    /// unbounded — and the same reasoning applies here: nothing reads these rows yet, so a cap is far
+    /// Raw instrumentation must be capped rather than unbounded. Nothing reads these rows yet, so a cap is far
     /// cheaper to RELAX later than to impose once users have a year of history. Unbounded, this table is
     /// the one genuinely new source of row growth in v31 (the four named channels only WIDEN rows that
     /// were already being written: ~14 bytes on a `gravitySample`/`skinTempSample`/`sleepStateSample` row
@@ -102,27 +97,6 @@ extension WhoopStore {
         }
     }
 
-    /// #423: persist decoded 5/MG raw-IMU offload buffers (one row per strap-second, packed i16 BLOB),
-    /// then bound the table to the newest `retentionRows` for the device (rolling retention). Written from
-    /// the deep-buffer capture seam, not the normal stream path, so it inserts directly (idempotent by ts).
-    /// Twin of Kotlin `WhoopRepository.insertRawImu`.
-    public func insertRawImu(deviceId: String, rows: [(ts: Int, cols: [Int16])], retentionRows: Int) async throws {
-        guard !rows.isEmpty else { return }
-        try syncWrite { db in
-            let ins = try db.cachedStatement(sql: """
-                INSERT INTO rawImuSample (deviceId, ts, samples) VALUES (?, ?, ?)
-                ON CONFLICT(deviceId, ts) DO NOTHING
-                """)
-            // Pack the raw i16 columns to the LE BLOB HERE (packImuColumns is module-internal), so the
-            // caller passes plain [Int16] and never needs the packer. Mirrors how `insert` packs ppgWaveform.
-            for r in rows { try ins.execute(arguments: [deviceId, r.ts, WhoopStore.packImuColumns(r.cols)]) }
-            try db.execute(sql: """
-                DELETE FROM rawImuSample WHERE deviceId = ? AND ts < (
-                    SELECT MIN(ts) FROM (SELECT ts FROM rawImuSample WHERE deviceId = ? ORDER BY ts DESC LIMIT ?))
-                """, arguments: [deviceId, deviceId, retentionRows])
-        }
-    }
-
     /// Idempotent upsert of decoded streams by natural key. Returns the number of rows
     /// ACTUALLY inserted per stream (0 for rows that already existed).
     ///
@@ -350,9 +324,8 @@ extension WhoopStore {
             return (hr, rr, ev, bat, spo2, skin, resp, grav)
         }
 
-        // Rolling retention (the `insertRawImu` shape, #423) but AMORTISED. The delete finds the
-        // Nth-newest row by rank, so it walks up to `v18AuxRetentionRows` index entries; `insertRawImu`
-        // keeps 3,600 so that is free, this keeps 604,800 and an offload inserts once per chunk. Swept
+        // Rolling retention is amortised. The delete finds the Nth-newest row by rank, so it walks up to
+        // `v18AuxRetentionRows` index entries. The 604,800-row cap is swept
         // once per `v18AuxPruneEveryRows` rows instead, which keeps newest-N-rows exactly (a time window
         // would not — a sporadically-worn strap's rows span far more than a week, and the census wants
         // that). Counter is per device because the delete is.
diff --git a/Packages/WhoopStore/Sources/WhoopStore/TimestampHeal.swift b/Packages/WhoopStore/Sources/WhoopStore/TimestampHeal.swift
index 8093834237..128e9c5401 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/TimestampHeal.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/TimestampHeal.swift
@@ -55,7 +55,7 @@ extension WhoopStore {
             let rawTables = ["hrSample", "rrInterval", "event", "battery",
                              "spo2Sample", "skinTempSample", "respSample",
                              "gravitySample", "stepSample", "ppgHrSample",
-                             "sleepStateSample", "ppgWaveformSample", "rawImuSample", "v18AuxSample"]
+                             "sleepStateSample", "ppgWaveformSample", "v18AuxSample"]
             var rawDeleted = 0
             for table in rawTables {
                 try db.execute(sql: "DELETE FROM \(table) WHERE ts < ? OR ts > ?",
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/DeepCaptureChannelsTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/DeepCaptureChannelsTests.swift
index 2e5d4a9c6b..4d7f0794b6 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/DeepCaptureChannelsTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/DeepCaptureChannelsTests.swift
@@ -347,7 +347,6 @@ final class DeepCaptureChannelsTests: XCTestCase {
     /// The shipped cap is a real bound, and documented in row terms.
     func testShippedRetentionConstant() {
         XCTAssertEqual(WhoopStore.v18AuxRetentionRows, 604_800)   // 7 x 86_400 strap-seconds
-        XCTAssertGreaterThan(WhoopStore.v18AuxRetentionRows, WhoopStore.rawImuRetentionRows)
     }
 
     /// Deleting a device's data must clear the aux rows too — the same privacy rule every other
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/PruneTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/PruneTests.swift
index 1ba9dcf511..4bedfed80f 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/PruneTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/PruneTests.swift
@@ -77,4 +77,5 @@ final class PruneTests: XCTestCase {
                                               maxUnsyncedBytes: 1_000_000)
         XCTAssertEqual(pruned, 0)
     }
+
 }
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
index 5737a694cd..2096439301 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
@@ -275,9 +275,6 @@ final class ReadTests: XCTestCase {
                     ppgWaveform: [PpgWaveformSample(ts: 400, samples: [1, 2, 3])],
                     v18Aux: [V18AuxSample(ts: 400, slotValues: [1, 2])]),
             deviceId: "dev1")
-        _ = try await store.insertRawImu(deviceId: "dev1",
-                                         rows: [(ts: 400, cols: [Int16(1), Int16(2)])],
-                                         retentionRows: 1000)
         try await store.enqueueRawBatch(
             RawBatchMeta(batchId: "b1", deviceId: "dev1",
                          clockRef: ClockRef(device: 0, wall: 0), capturedAt: 1,
@@ -285,9 +282,9 @@ final class ReadTests: XCTestCase {
             frames: [[0xAA, 0x00, 0x01, 0x02]])
         let stats = try await store.storageStats()
         // dev1: 3 hr + 2 rr + 1 event + 1 battery + 1 spo2 + 1 skinTemp + 1 resp + 1 gravity
-        //       + 1 step + 1 sleepState + 1 ppgHr + 1 ppgWaveform + 1 v18Aux + 1 rawImu = 17
-        // other: 1 hr = 1 → 18 decoded rows across all 14 raw tables.
-        XCTAssertEqual(stats.decodedRows, 18)
+        //       + 1 step + 1 sleepState + 1 ppgHr + 1 ppgWaveform + 1 v18Aux = 16
+        // other: 1 hr = 1 → 17 decoded rows.
+        XCTAssertEqual(stats.decodedRows, 17)
         XCTAssertEqual(stats.rawBatches, 1)
         XCTAssertEqual(stats.rawBytes, 4)
     }
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json b/Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json
index 4cb35172f1..64fd84960b 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json
@@ -41,7 +41,8 @@
     "v37-daily-avg-sdnn",
     "v38-apple-step-hour",
     "v39-ppg-burst-index",
-    "v40-daily-skin-temp-absolute"
+    "v40-daily-skin-temp-absolute",
+    "v41-drop-raw-imu-sample"
   ],
   "divergenceReasons": {
     "android-orphan-synced-column": "REAL COLUMN DRIFT: `synced` exists on Android only. GRDB's v10 note is explicit that stepSample gets no `synced` column ('unused; see StreamStore'), and v12's ppgHrSample never had one either; the Room entities copied the flag from the older per-second entities. Nothing reads it on Android — the per-row upload flag belongs to an upload path that does not exist there — so it is dead width, not divergent data. Removing it needs a Room table rebuild.",
@@ -1259,34 +1260,6 @@
       ],
       "indices": []
     },
-    "rawImuSample": {
-      "platform": "both",
-      "columns": [
-        {
-          "name": "deviceId",
-          "affinity": "TEXT",
-          "notNull": true,
-          "default": null
-        },
-        {
-          "name": "ts",
-          "affinity": "INTEGER",
-          "notNull": true,
-          "default": null
-        },
-        {
-          "name": "samples",
-          "affinity": "BLOB",
-          "notNull": true,
-          "default": null
-        }
-      ],
-      "primaryKey": [
-        "deviceId",
-        "ts"
-      ],
-      "indices": []
-    },
     "respSample": {
       "platform": "both",
       "columns": [
diff --git a/README.md b/README.md
index 21385fce50..d4749ec2f9 100644
--- a/README.md
+++ b/README.md
@@ -30,6 +30,7 @@
   <a href="https://www.reddit.com/r/NoopBand/">👽&nbsp;Reddit</a> ·
   <a href="#features">Features</a> ·
   <a href="docs/PROTOCOL.md">Protocol</a> ·
+  <a href="docs/RAW_DATA_CAPTURE.md">Raw data capture</a> ·
 </p>
 
 <p align="center">
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index ee5dc7b6ad..c42a01a8b9 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -847,6 +847,8 @@ public final class BLEManager: NSObject, ObservableObject {
     /// Re-entrancy guard for captureRawAccel: true while a bounded on-demand window is running.
     /// A second tap is a no-op until the active capture's asyncAfter block fires and clears this.
     private var rawCaptureInFlight = false
+    private var rawCaptureStoppedAt = Date.distantPast
+    private var unexpectedImuStopAt = Date.distantPast
     /// Ordered queue of frames awaiting drain through the serial Backfiller task.
     private var backfillFrameQueue: [[UInt8]] = []
     /// True while the drain task is running (prevents a second drain task from launching).
@@ -1840,8 +1842,14 @@ public final class BLEManager: NSObject, ObservableObject {
         rawCaptureInFlight = true
         let secs = RawCaptureWindow.clamp(seconds)
         collector?.beginRawCapture(seconds: secs)
-        send(.startRawData, payload: [0x01])
-        send(.toggleIMUMode, payload: [0x01])
+        // Hardware-verified on WHOOP 5/MG: opcode 106 alone acknowledges but does not start the
+        // producer. START_RAW_DATA must precede the two-byte realtime IMU selector.
+        send(.startRawData, payload: [0x01], writeType: .withResponse)
+        if selectedModel.deviceFamily == .whoop5 {
+            send(.toggleIMUMode, payload: [0x01, 0x01], writeType: .withResponse)
+        } else {
+            send(.toggleIMUMode, payload: [0x01], writeType: .withResponse)
+        }
         log("Raw-accel capture: started for \(secs)s")
         DispatchQueue.main.asyncAfter(deadline: .now() + secs) { [weak self] in
             guard let self else { return }
@@ -1849,7 +1857,10 @@ public final class BLEManager: NSObject, ObservableObject {
             // continuous stream must keep running — we just flush/upload the bounded window we
             // captured without halting the wider session.
             if !UserDefaults.standard.bool(forKey: "enableRawCapture") {
-                self.send(.stopRawData, payload: [0x01])
+                self.send(.stopRawData, payload: [0x01], writeType: .withResponse)
+                if self.selectedModel.deviceFamily == .whoop5 {
+                    self.send(.toggleIMUMode, payload: [0x01, 0x00], writeType: .withResponse)
+                }
             }
             self.rawCaptureInFlight = false
             Task { @MainActor in
@@ -1859,6 +1870,50 @@ public final class BLEManager: NSObject, ObservableObject {
         }
     }
 
+    /// Start a manually stopped 5/MG raw-data session. Returns false when another capture is active.
+    @discardableResult
+    public func startGroundTruthRawCapture(sessionId: String) -> Bool {
+        guard !rawCaptureInFlight else { return false }
+        rawCaptureInFlight = true
+        send(.startRawData, payload: [0x01], writeType: .withResponse)
+        send(.toggleIMUMode,
+             payload: selectedModel.deviceFamily == .whoop5 ? [0x01, 0x01] : [0x01],
+             writeType: .withResponse)
+        log("Raw-data session: started")
+        return true
+    }
+
+    /// Stop and flush the current manually controlled raw-data session.
+    public func stopGroundTruthRawCapture() async {
+        if rawCaptureInFlight && !UserDefaults.standard.bool(forKey: "enableRawCapture") {
+            send(.stopRawData, payload: [0x01], writeType: .withResponse)
+            if selectedModel.deviceFamily == .whoop5 {
+                send(.toggleIMUMode, payload: [0x01, 0x00], writeType: .withResponse)
+            }
+        }
+        rawCaptureInFlight = false
+        rawCaptureStoppedAt = Date()
+        log("Raw-data session: stopped + flushed")
+    }
+
+    /// Stop a realtime IMU producer left armed after a crash, lost stop write, or another client.
+    private func stopUnexpectedRealtimeImu(_ frame: [UInt8], isOffload: Bool, now: Date = Date()) {
+        guard selectedModel.deviceFamily == .whoop5, !isOffload, frame.count > 8,
+              frame[8] == 43 || frame[8] == 51,
+              !rawCaptureInFlight, !UserDefaults.standard.bool(forKey: "enableRawCapture"),
+              now.timeIntervalSince(rawCaptureStoppedAt) >= 3,
+              now.timeIntervalSince(unexpectedImuStopAt) >= 30 else { return }
+        unexpectedImuStopAt = now
+        send(.stopRawData, payload: [0x01], writeType: .withResponse)
+        send(.toggleIMUMode, payload: [0x01, 0x00], writeType: .withResponse)
+        log("Raw IMU fail-safe: unexpected realtime packet type \(frame[8]) while capture was off; stop requested")
+    }
+
+    public func groundTruthHistoryCSV(from: Int, to: Int) async -> Data {
+        await collector?.historySensorsCSV(from: from, to: to)
+            ?? Data("stream,unix_s,v1,v2,v3,v4\n".utf8)
+    }
+
     /// Send a command to the WHOOP strap.
     /// - Parameters:
     ///   - command: The command to send.
@@ -1941,6 +1996,10 @@ public final class BLEManager: NSObject, ObservableObject {
                 || (DeviceConfigReadProbe.isReadOnlyOpcode(command.rawValue) && deviceConfigReport != nil)
                 || command == .sendHistoricalData || command == .historicalDataResult
                 || command == .setClock || command == .getClock
+                // Bounded Raw Data Collector only. These writes remain impossible unless the explicit
+                // user-started capture window is in flight; normal sync never enables this gate.
+                || (rawCaptureInFlight && (command == .startRawData
+                    || command == .stopRawData || command == .toggleIMUMode))
                 // SET_CONFIG / SET_FF_VALUE (120), ENABLE direction — the R22 deep-stream unlock. Allowed
                 // only while the deep-data experiment is opted in, and only for a KEY and a VALUE the gate
                 // recognises: one of the sixteen R22 flags carrying that key's own enable value. The clause
@@ -5275,6 +5334,9 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
         didBond = false
         clientHelloWriteAt = nil   // #1635: no hello survives the link that carried it
         whoop5RealtimeArmed = false
+        // A user capture remains represented by RawDataSessionStore, but its transport must be re-armed
+        // on the next connection. Keeping this true would make that reconnect attempt a silent no-op.
+        rawCaptureInFlight = false
         // The strap forgets the realtime-HR toggle across a disconnect; the post-bond branch re-arms it
         // from `wantsRealtime`. Clear only the "what we last sent" flag — `screenWantsRealtime` /
         // `keepRealtimeForData` (and thus `wantsRealtime`) are intent and must survive a reconnect so the
@@ -6274,9 +6336,8 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                     // reverse-engineering — its own file the bulk-capture eviction never churns.
                     // BEFORE the offload branch so it catches the burst; no-op unless capture is on.
                     puffinDeepBufferLog.appendIfDeepBuffer(frame: frame, char: characteristic.uuid, isOffload: isOffload)
+                    stopUnexpectedRealtimeImu(frame, isOffload: isOffload)
                     // #423: the queryable twin of that diagnostics line — persist the decoded 100 Hz 6-axis
-                    // IMU samples into the rawImuSample table when raw capture is on (same gate, gated inside).
-                    collector?.storeRawImu(frame: frame)
                     if isOffload {
                         // Same policy as WHOOP4: historical offload frames are bulk sync traffic.
                         // Keep them out of the live UI parser during backfill and let Backfiller
diff --git a/Strand/BLE/PuffinDeepBufferLog.swift b/Strand/BLE/PuffinDeepBufferLog.swift
index 56b0dff2e3..07c919da26 100644
--- a/Strand/BLE/PuffinDeepBufferLog.swift
+++ b/Strand/BLE/PuffinDeepBufferLog.swift
@@ -34,9 +34,9 @@ enum PuffinOpticalExperimentPhase: String, CaseIterable, Sendable {
 /// packets that carry tens-of-Hz sensor data (motion + optical) rather than the 1 Hz historical
 /// rollup NOOP already decodes (#423).
 ///
-/// On-strap probing (#423) established that the 5/MG has no live raw-IMU stream, but it DOES bank
-/// high-rate motion (accel content verified: int16-ish triples sphere-fitting to ~1 g at the 1/4096
-/// scale) and ships it inside big type-0x2F buffers during the connect-time offload burst — 124 B
+/// On-strap probing (#423) established that the 5/MG banks high-rate motion and can stream it live
+/// during an explicitly armed raw-data session (accel content verified: int16-ish triples
+/// sphere-fitting to ~1 g at the 1/4096 scale). History also ships it inside big type-0x2F buffers — 124 B
 /// (≈1 Hz record), 1244 B and 2140 B (≈32 and ≈59 sub-records per timestamped second). NOOP's
 /// historical decoder pulls the 1 Hz gravity vector out and DISCARDS the high-rate remainder. Those
 /// bursts are ephemeral and backlog-gated, so a byte-perfect decoder can't be captured on demand — it
diff --git a/Strand/Collect/Collector.swift b/Strand/Collect/Collector.swift
index ad92438137..4b7c56d138 100644
--- a/Strand/Collect/Collector.swift
+++ b/Strand/Collect/Collector.swift
@@ -13,12 +13,6 @@ protocol StoreWriting: AnyObject {
         -> (hr: Int, rr: Int, events: Int, battery: Int,
             spo2: Int, skinTemp: Int, resp: Int, gravity: Int)
     func enqueueRawBatch(_ meta: RawBatchMeta, frames: [[UInt8]]) async throws
-    func insertRawImu(deviceId: String, rows: [(ts: Int, cols: [Int16])], retentionRows: Int) async throws
-}
-extension StoreWriting {
-    /// #423: default no-op so a test SpyStore needn't implement the raw-IMU capture path. WhoopStore's
-    /// real impl (StreamStore.swift) satisfies the requirement and is used in production.
-    func insertRawImu(deviceId: String, rows: [(ts: Int, cols: [Int16])], retentionRows: Int) async throws {}
 }
 extension WhoopStore: StoreWriting {}
 
@@ -118,6 +112,28 @@ final class Collector {
         return try? await s.storageStats()
     }
 
+    /// Decoded history rows in a stable long-form CSV for arbitrary user-selected export windows.
+    func historySensorsCSV(from: Int, to: Int) async -> Data {
+        guard let store = concreteStore, from <= to else { return Data("stream,unix_s,v1,v2,v3,v4\n".utf8) }
+        let limit = min(max(to - from + 1, 1) * 4, 1_000_000)
+        async let hr = try? store.hrSamples(deviceId: deviceId, from: from, to: to, limit: limit)
+        async let battery = try? store.batterySamples(deviceId: deviceId, from: from, to: to, limit: limit)
+        async let spo2 = try? store.spo2Samples(deviceId: deviceId, from: from, to: to, limit: limit)
+        async let temp = try? store.skinTempSamples(deviceId: deviceId, from: from, to: to, limit: limit)
+        async let steps = try? store.stepSamples(deviceId: deviceId, from: from, to: to, limit: limit)
+        async let resp = try? store.respSamples(deviceId: deviceId, from: from, to: to, limit: limit)
+        async let gravity = try? store.gravitySamples(deviceId: deviceId, from: from, to: to, limit: limit)
+        var lines = ["stream,unix_s,v1,v2,v3,v4"]
+        lines += await (hr ?? []).map { "heart_rate,\($0.ts),\($0.bpm),,," }
+        lines += await (battery ?? []).map { "battery,\($0.ts),\($0.soc.map { String($0) } ?? ""),\($0.mv.map { String($0) } ?? ""),," }
+        lines += await (spo2 ?? []).map { "spo2_raw,\($0.ts),\($0.red),\($0.ir),," }
+        lines += await (temp ?? []).map { "skin_temp_raw,\($0.ts),\($0.raw),\($0.aux1Raw.map { String($0) } ?? ""),\($0.aux2Raw.map { String($0) } ?? "")," }
+        lines += await (steps ?? []).map { "steps,\($0.ts),\($0.counter),\($0.activityClass.map { String($0) } ?? ""),," }
+        lines += await (resp ?? []).map { "resp_raw,\($0.ts),\($0.raw),,," }
+        lines += await (gravity ?? []).map { "gravity,\($0.ts),\($0.x),\($0.y),\($0.z),\($0.dynAccel.map { String($0) } ?? "")" }
+        return Data((lines.joined(separator: "\n") + "\n").utf8)
+    }
+
     /// Max persisted HR sample ts (the biometric "data frontier" for the stuck-strap watchdog).
     /// nil if there's no concrete store or nothing persisted yet. Mirrors storageStats().
     func latestHRSampleTs() async -> Int? {
@@ -149,21 +165,6 @@ final class Collector {
         ingest(frame: frame, parsed: parseFrame(frame, family: family))
     }
 
-    /// #423: persist the WHOOP 5/MG raw-IMU offload buffer NOOP already decodes for the deep-buffer log —
-    /// the queryable twin of that (table-less) diagnostics line. Same `noopPuffinCapture` gate; only the
-    /// 1244-B 6-axis buffer decodes (rawColumns nil otherwise). Fire-and-forget into the store, bounded by
-    /// a rolling retention prune. Raw i16, no downstream consumer yet. Twin of Android
-    /// `WhoopBleClient.storeWhoop5RawImuIfBuffer`.
-    func storeRawImu(frame: [UInt8]) {
-        guard UserDefaults.standard.bool(forKey: PuffinFrameRecorder.enabledKey) else { return }
-        guard let cols = Whoop5RawImu.rawColumns(frame), let baseTs = Whoop5RawImu.baseTs(frame) else { return }
-        let dev = deviceId
-        Task { [store] in
-            try? await store.insertRawImu(
-                deviceId: dev, rows: [(ts: baseTs, cols: cols)], retentionRows: WhoopStore.rawImuRetentionRows)
-        }
-    }
-
     /// Buffer one complete frame + its pre-parsed decode (synchronous: preserves delegate arrival order).
     /// Auto-flushes via a detached Task when the cadence threshold is hit (flush is async). (#47)
     func ingest(frame: [UInt8], parsed: ParsedFrame) {
@@ -171,6 +172,7 @@ final class Collector {
         assert(parsed == parseFrame(frame, family: family),
                "Collector.ingest: threaded ParsedFrame != fresh parse (#47 parse-once invariant)")
         #endif
+        recordGroundTruthImu(frame)
         buffer.append((frame, parsed))
         // Pre-clock only: bound memory if GET_CLOCK never lands while data keeps flowing.
         // Drop OLDEST beyond the cap (keep most recent). Post-clock this branch is skipped —
@@ -184,6 +186,7 @@ final class Collector {
         }
     }
 
+
     /// Persist + queue everything buffered. No-op when empty or before a clock ref exists.
     /// Buffer is snapshotted and cleared SYNCHRONOUSLY before the first await so that any
     /// concurrent ingest() calls during persistence accumulate into the NEXT batch cleanly.
@@ -282,6 +285,11 @@ final class Collector {
         rawCapture.open(at: monotonic(), duration: seconds)
     }
 
+    private func recordGroundTruthImu(_ frame: [UInt8]) {
+        _ = ImuSessionFileStore.shared.append(deviceId: deviceId, frame: frame,
+            receivedAtMs: Int64(Date().timeIntervalSince1970 * 1_000))
+    }
+
     /// Flush WHILE the window is still active so the just-captured frames get persisted as raw,
     /// THEN close the window.
     func endRawCapture() async {
diff --git a/Strand/Collect/ImuSessionFileStore.swift b/Strand/Collect/ImuSessionFileStore.swift
new file mode 100644
index 0000000000..26cf0b254f
--- /dev/null
+++ b/Strand/Collect/ImuSessionFileStore.swift
@@ -0,0 +1,189 @@
+import Compression
+import Foundation
+import WhoopProtocol
+
+/// Canonical decoded 100 Hz IMU storage: UTC half-hour files with appendable 30-second zlib blocks.
+@MainActor
+final class ImuSessionFileStore {
+    struct Stats { let bytes: Int64; let coveredSeconds: Int; let firstTs: Int64? }
+    struct ExportSegment { let name: String; let data: Data; let startTs, endTs: Int; let sampleCount: Int }
+    private struct Window: Codable { let id, deviceId: String; let from: Int64; var to: Int64? }
+    private struct Record { let ts, receivedAtMs: Int64; let columns: [Int16] }
+    static let shared = ImuSessionFileStore()
+    static let sampleRate = 100, axes = 6, blockSeconds = 30
+    static let segmentSeconds: Int64 = 30 * 60
+    private static let payloadBytes = sampleRate * axes * 2
+    private static let magic = Data("NOOPIMU2".utf8)
+    private let defaults = UserDefaults.standard
+    private let key = "imu-session-windows-v1"
+    private let directory: URL
+    private var seen: [String: Set<Int64>] = [:]
+    private var pending: [String: [Record]] = [:]
+
+    private init() {
+        let fm = FileManager.default
+        let base = (try? fm.url(for: .applicationSupportDirectory, in: .userDomainMask,
+                                appropriateFor: nil, create: true)) ?? fm.temporaryDirectory
+        directory = base.appendingPathComponent("OpenWhoop/RawImuSessions", isDirectory: true)
+        try? fm.createDirectory(at: directory, withIntermediateDirectories: true)
+    }
+
+    func start(id: String, deviceId: String, fromMs: Int64) {
+        var value = windows().filter { $0.id != id }
+        value.append(Window(id: id, deviceId: deviceId, from: fromMs / 1_000, to: nil)); save(value)
+        try? FileManager.default.createDirectory(at: sessionDirectory(id), withIntermediateDirectories: true)
+    }
+    func complete(id: String, toMs: Int64) {
+        flushSession(id); var value = windows()
+        if let index = value.firstIndex(where: { $0.id == id }) { value[index].to = toMs / 1_000; save(value) }
+    }
+    func register(id: String, deviceId: String, fromMs: Int64, toMs: Int64) {
+        var value = windows().filter { $0.id != id }
+        value.append(Window(id: id, deviceId: deviceId, from: fromMs / 1_000, to: toMs / 1_000)); save(value)
+        try? FileManager.default.createDirectory(at: sessionDirectory(id), withIntermediateDirectories: true)
+    }
+    func remove(id: String) {
+        pending.keys.filter { $0.hasPrefix("\(id)/") }.forEach { pending[$0] = nil }
+        seen.keys.filter { $0.hasPrefix(sessionDirectory(id).path) }.forEach { seen[$0] = nil }
+        save(windows().filter { $0.id != id })
+    }
+    func prepareForRead(_ id: String) { flushSession(id) }
+
+    func deleteFiles(_ id: String, removeItem: (URL) throws -> Void = { try FileManager.default.removeItem(at: $0) }) -> Bool {
+        flushSession(id); let dir = sessionDirectory(id)
+        guard FileManager.default.fileExists(atPath: dir.path) else { return true }
+        do { try removeItem(dir); return true } catch { return false }
+    }
+
+    func deleteDevice(_ deviceId: String) -> Bool {
+        let owned = windows().filter { $0.deviceId == deviceId }.map(\.id)
+        guard owned.allSatisfy({ deleteFiles($0) }) else { return false }
+        owned.forEach { remove(id: $0) }; return true
+    }
+
+    @discardableResult
+    func append(deviceId: String, frame: [UInt8], receivedAtMs: Int64) -> Int {
+        guard let ts = Whoop5RawImu.baseTs(frame), let columns = Whoop5RawImu.rawColumns(frame) else { return 0 }
+        var count = 0
+        for window in windows() where window.deviceId == deviceId && Int64(ts) >= window.from
+            && (window.to == nil || Int64(ts) <= window.to!) {
+            let bucket = Self.bucketStart(Int64(ts)), url = segmentFile(window.id, bucket)
+            var timestamps = seen[url.path] ?? scan(url)
+            guard timestamps.insert(Int64(ts)).inserted else { continue }
+            seen[url.path] = timestamps
+            let pendingKey = "\(window.id)/\(bucket)"
+            pending[pendingKey, default: []].append(Record(ts: Int64(ts), receivedAtMs: receivedAtMs, columns: columns))
+            if pending[pendingKey]!.count >= Self.blockSeconds { flushKey(pendingKey) }
+            count += 1
+        }
+        return count
+    }
+
+    func stats(_ id: String, from: Int, to: Int) -> Stats {
+        let records = readRecords(id, from: from, to: to, includePending: true)
+        let disk = segmentFiles(id).reduce(Int64(0)) { value, url in
+            value + Int64((try? url.resourceValues(forKeys: [.fileSizeKey]).fileSize) ?? 0)
+        }
+        let queued = pending.filter { $0.key.hasPrefix("\(id)/") }.values.flatMap { $0 }
+            .reduce(Int64(0)) { $0 + Int64($1.columns.count * 2 + 20) }
+        return Stats(bytes: disk + queued, coveredSeconds: Set(records.map(\.ts)).count,
+                     firstTs: records.map(\.ts).min())
+    }
+
+    func exportSegments(_ id: String, from: Int, to: Int) -> [ExportSegment] {
+        flushSession(id)
+        let records = Dictionary(grouping: readRecords(id, from: from, to: to, includePending: false), by: \.ts)
+            .compactMap { $0.value.first }.sorted { $0.ts < $1.ts }
+        return Dictionary(grouping: records) { Self.bucketStart($0.ts) }.sorted { $0.key < $1.key }.compactMap { element in
+            let (bucket, rows) = element
+            guard let first = rows.first, let last = rows.last else { return nil }
+            return ExportSegment(name: "imu-\(Self.utcName(bucket)).imus", data: encode(bucket: bucket, records: rows),
+                startTs: Int(first.ts), endTs: Int(last.ts), sampleCount: rows.count * Self.sampleRate)
+        }
+    }
+
+    private func readRecords(_ id: String, from: Int, to: Int, includePending: Bool) -> [Record] {
+        var rows = segmentFiles(id).flatMap { decode((try? Data(contentsOf: $0)) ?? Data()) }
+            .filter { $0.ts >= from && $0.ts <= to }
+        if includePending { rows += pending.filter { $0.key.hasPrefix("\(id)/") }.values.flatMap { $0 }
+            .filter { $0.ts >= from && $0.ts <= to } }
+        return rows
+    }
+
+    private func encode(bucket: Int64, records: [Record]) -> Data {
+        var result = header(bucket)
+        for start in stride(from: 0, to: records.count, by: Self.blockSeconds) {
+            result.append(block(Array(records[start..<min(start + Self.blockSeconds, records.count)])))
+        }
+        return result
+    }
+    private func decode(_ data: Data) -> [Record] {
+        guard data.count >= 24, data.prefix(8) == Self.magic else { return [] }
+        let bytes = [UInt8](data); var offset = 8
+        _ = Int64(bigEndianBytes: bytes, at: offset); offset += 8
+        guard int32(bytes, offset) == Self.sampleRate, int32(bytes, offset + 4) == Self.axes else { return [] }
+        offset += 8; var result: [Record] = []
+        while offset + 12 <= bytes.count {
+            let count = int32(bytes, offset), rawSize = int32(bytes, offset + 4), compressedSize = int32(bytes, offset + 8)
+            offset += 12
+            guard count > 0, count <= Self.blockSeconds, rawSize > 0, compressedSize > 0,
+                  offset + compressedSize <= bytes.count,
+                  let raw = inflate(Data(bytes[offset..<offset + compressedSize]), size: rawSize) else { break }
+            offset += compressedSize; let rawBytes = [UInt8](raw); var rawOffset = 0
+            for _ in 0..<count {
+                guard rawOffset + 20 + Self.payloadBytes <= rawBytes.count else { break }
+                let ts = Int64(bigEndianBytes: rawBytes, at: rawOffset)
+                let received = Int64(bigEndianBytes: rawBytes, at: rawOffset + 8)
+                let length = int32(rawBytes, rawOffset + 16); rawOffset += 20
+                guard length == Self.payloadBytes, rawOffset + length <= rawBytes.count else { break }
+                var columns: [Int16] = []; columns.reserveCapacity(Self.sampleRate * Self.axes)
+                for index in stride(from: rawOffset, to: rawOffset + length, by: 2) {
+                    columns.append(Int16(bitPattern: UInt16(rawBytes[index]) | UInt16(rawBytes[index + 1]) << 8))
+                }
+                rawOffset += length; result.append(Record(ts: ts, receivedAtMs: received, columns: columns))
+            }
+        }
+        return result
+    }
+
+    private func flushSession(_ id: String) { pending.keys.filter { $0.hasPrefix("\(id)/") }.forEach(flushKey) }
+    private func flushKey(_ key: String) {
+        guard let records = pending.removeValue(forKey: key), !records.isEmpty,
+              let tail = key.split(separator: "/").last,
+              let bucket = Int64(String(tail)) else { return }
+        let id = String(key.split(separator: "/")[0]), url = segmentFile(id, bucket)
+        try? FileManager.default.createDirectory(at: sessionDirectory(id), withIntermediateDirectories: true)
+        if !FileManager.default.fileExists(atPath: url.path) { FileManager.default.createFile(atPath: url.path, contents: header(bucket)) }
+        guard let handle = try? FileHandle(forWritingTo: url) else { pending[key] = records; return }
+        do { try handle.seekToEnd(); try handle.write(contentsOf: block(records)); try handle.close() }
+        catch { try? handle.close(); pending[key] = records }
+    }
+    private func header(_ bucket: Int64) -> Data {
+        var data = Self.magic; data.appendBigEndian(bucket); data.appendBigEndian(Int32(Self.sampleRate)); data.appendBigEndian(Int32(Self.axes)); return data
+    }
+    private func block(_ records: [Record]) -> Data {
+        var raw = Data()
+        for record in records {
+            raw.appendBigEndian(record.ts); raw.appendBigEndian(record.receivedAtMs); raw.appendBigEndian(Int32(Self.payloadBytes))
+            for value in record.columns { raw.append(UInt8(truncatingIfNeeded: value)); raw.append(UInt8(truncatingIfNeeded: value >> 8)) }
+        }
+        guard let compressed = deflate(raw) else { return Data() }
+        var data = Data(); data.appendBigEndian(Int32(records.count)); data.appendBigEndian(Int32(raw.count))
+        data.appendBigEndian(Int32(compressed.count)); data.append(compressed); return data
+    }
+
+    private func windows() -> [Window] { defaults.data(forKey: key).flatMap { try? JSONDecoder().decode([Window].self, from: $0) } ?? [] }
+    private func save(_ value: [Window]) { defaults.set(try? JSONEncoder().encode(value), forKey: key) }
+    private func sessionDirectory(_ id: String) -> URL { directory.appendingPathComponent(id, isDirectory: true) }
+    private func segmentFile(_ id: String, _ bucket: Int64) -> URL { sessionDirectory(id).appendingPathComponent("imu-\(Self.utcName(bucket)).imus") }
+    private func segmentFiles(_ id: String) -> [URL] { ((try? FileManager.default.contentsOfDirectory(at: sessionDirectory(id), includingPropertiesForKeys: nil)) ?? []).filter { $0.pathExtension == "imus" }.sorted { $0.lastPathComponent < $1.lastPathComponent } }
+    private func scan(_ url: URL) -> Set<Int64> { Set(decode((try? Data(contentsOf: url)) ?? Data()).map(\.ts)) }
+    private static func bucketStart(_ ts: Int64) -> Int64 { ts >= 0 ? ts / segmentSeconds * segmentSeconds : ((ts - segmentSeconds + 1) / segmentSeconds) * segmentSeconds }
+    private static func utcName(_ ts: Int64) -> String { let f = DateFormatter(); f.locale = Locale(identifier: "en_US_POSIX"); f.timeZone = TimeZone(secondsFromGMT: 0); f.dateFormat = "yyyyMMdd'T'HHmmss'Z'"; return f.string(from: Date(timeIntervalSince1970: TimeInterval(ts))) }
+    private func int32(_ bytes: [UInt8], _ offset: Int) -> Int { Int(bytes[offset]) << 24 | Int(bytes[offset + 1]) << 16 | Int(bytes[offset + 2]) << 8 | Int(bytes[offset + 3]) }
+    private func deflate(_ input: Data) -> Data? { let capacity = input.count + 128; var output = Data(count: capacity); let written = output.withUnsafeMutableBytes { dst in input.withUnsafeBytes { src in compression_encode_buffer(dst.bindMemory(to: UInt8.self).baseAddress!, capacity, src.bindMemory(to: UInt8.self).baseAddress!, input.count, nil, COMPRESSION_ZLIB) } }; guard written > 0 else { return nil }; output.count = written; return output }
+    private func inflate(_ input: Data, size: Int) -> Data? { var output = Data(count: size); let written = output.withUnsafeMutableBytes { dst in input.withUnsafeBytes { src in compression_decode_buffer(dst.bindMemory(to: UInt8.self).baseAddress!, size, src.bindMemory(to: UInt8.self).baseAddress!, input.count, nil, COMPRESSION_ZLIB) } }; return written == size ? output : nil }
+}
+
+private extension Int64 { init(bigEndianBytes bytes: [UInt8], at offset: Int) { self = bytes[offset..<(offset + 8)].reduce(0) { ($0 << 8) | Int64($1) } } }
+private extension Data { mutating func appendBigEndian<T: FixedWidthInteger>(_ value: T) { var value = value.bigEndian; Swift.withUnsafeBytes(of: &value) { append(contentsOf: $0) } } }
diff --git a/Strand/Collect/RawCaptureWindow.swift b/Strand/Collect/RawCaptureWindow.swift
index 336273ff4a..833868f325 100644
--- a/Strand/Collect/RawCaptureWindow.swift
+++ b/Strand/Collect/RawCaptureWindow.swift
@@ -5,7 +5,9 @@ import Foundation
 /// auto-expires the window so a missed stop callback can't leak raw forever.
 struct RawCaptureWindow {
     static let minSeconds: TimeInterval = 1
-    static let maxSeconds: TimeInterval = 300
+    // A manually stopped research session may legitimately last for hours. It is still bounded so an
+    // interrupted UI/process cannot accidentally turn the opt-in capture into permanent 24/7 logging.
+    static let maxSeconds: TimeInterval = 24 * 60 * 60
     static func clamp(_ s: TimeInterval) -> TimeInterval { min(max(s, minSeconds), maxSeconds) }
 
     private var deadline: TimeInterval?       // monotonic deadline; nil = inactive
diff --git a/Strand/Collect/RawDataSessionStore.swift b/Strand/Collect/RawDataSessionStore.swift
new file mode 100644
index 0000000000..5e962858d3
--- /dev/null
+++ b/Strand/Collect/RawDataSessionStore.swift
@@ -0,0 +1,237 @@
+import Combine
+import Foundation
+import WhoopStore
+
+/// Persistent, user-controlled 5/MG capture sessions. This is the iOS/macOS twin of Android's
+/// GroundTruthCollector: it records bounded raw-data windows with optional comments.
+@MainActor
+final class RawDataSessionStore: ObservableObject {
+    struct Event: Codable, Identifiable, Equatable {
+        var id = UUID()
+        var atMs: Int64
+        let kind: String
+        var markerId: String?
+        var markerType: String?
+        var text: String?
+    }
+
+    struct Session: Codable, Identifiable, Equatable {
+        let id: String
+        let deviceId: String
+        let startedAtMs: Int64
+        var endedAtMs: Int64?
+        var capturedStartedAtMs: Int64?
+        var capturedEndedAtMs: Int64?
+        var comment: String
+        var exported: Bool
+        var lastExportedAtMs: Int64?
+        var events: [Event]
+
+        var active: Bool { endedAtMs == nil }
+    }
+
+    @Published private(set) var sessions: [Session] = []
+    var active: Session? { sessions.first(where: \.active) }
+
+    private let directory: URL
+    private let encoder: JSONEncoder
+    private let decoder = JSONDecoder()
+
+    init(directory override: URL? = nil, fileManager: FileManager = .default) {
+        let base = (try? fileManager.url(for: .applicationSupportDirectory, in: .userDomainMask,
+                                         appropriateFor: nil, create: true)) ?? fileManager.temporaryDirectory
+        directory = override ?? base.appendingPathComponent("OpenWhoop/RawDataSessions", isDirectory: true)
+        try? fileManager.createDirectory(at: directory, withIntermediateDirectories: true)
+        encoder = JSONEncoder()
+        encoder.outputFormatting = [.sortedKeys]
+        reload()
+    }
+
+    func reload() {
+        let urls = (try? FileManager.default.contentsOfDirectory(at: directory,
+                    includingPropertiesForKeys: nil)) ?? []
+        sessions = urls.filter { $0.pathExtension == "json" }
+            .compactMap { try? Data(contentsOf: $0) }
+            .compactMap { try? decoder.decode(Session.self, from: $0) }
+            .sorted { $0.startedAtMs > $1.startedAtMs }
+    }
+
+    @discardableResult
+    func start(deviceId: String, now: Date = Date()) -> Session? {
+        guard active == nil else { return nil }
+        let millis = Int64(now.timeIntervalSince1970 * 1_000)
+        let started = Event(atMs: millis, kind: "start")
+        let session = Session(id: String(millis), deviceId: deviceId, startedAtMs: millis,
+                              endedAtMs: nil, capturedStartedAtMs: millis, capturedEndedAtMs: nil,
+                              comment: "", exported: false, lastExportedAtMs: nil, events: [started])
+        sessions.insert(session, at: 0)
+        persist(session)
+        ImuSessionFileStore.shared.start(id: session.id, deviceId: deviceId, fromMs: millis)
+        return session
+    }
+
+    func stop(now: Date = Date()) {
+        let activeId = active?.id
+        mutateActive { session in
+            let millis = Int64(now.timeIntervalSince1970 * 1_000)
+            session.endedAtMs = millis
+            session.capturedEndedAtMs = millis
+            session.events.append(Event(atMs: millis, kind: "stop"))
+        }
+        if let activeId { ImuSessionFileStore.shared.complete(id: activeId, toMs: Int64(now.timeIntervalSince1970 * 1_000)) }
+    }
+
+    @discardableResult
+    func createHistorical(deviceId: String, from: Date, to: Date) -> Session? {
+        let fromMs = Int64(from.timeIntervalSince1970 * 1_000)
+        let toMs = Int64(to.timeIntervalSince1970 * 1_000)
+        guard validRange(fromMs, toMs) else { return nil }
+        let id = String(Int64(Date().timeIntervalSince1970 * 1_000))
+        let events = [Event(atMs: fromMs, kind: "start"), Event(atMs: toMs, kind: "stop")]
+        let session = Session(id: id, deviceId: deviceId, startedAtMs: fromMs, endedAtMs: toMs,
+                              capturedStartedAtMs: nil, capturedEndedAtMs: nil, comment: "",
+                              exported: false, lastExportedAtMs: nil, events: events)
+        sessions.insert(session, at: 0); persist(session)
+        ImuSessionFileStore.shared.register(id: id, deviceId: deviceId, fromMs: fromMs, toMs: toMs)
+        return session
+    }
+
+    func setRange(sessionId: String, from: Date, to: Date) {
+        let fromMs = Int64(from.timeIntervalSince1970 * 1_000)
+        let toMs = Int64(to.timeIntervalSince1970 * 1_000)
+        guard validRange(fromMs, toMs) else { return }
+        mutate(sessionId) { session in
+            guard !session.active else { return }
+            session = Session(id: session.id, deviceId: session.deviceId, startedAtMs: fromMs,
+                              endedAtMs: toMs, capturedStartedAtMs: session.capturedStartedAtMs,
+                              capturedEndedAtMs: session.capturedEndedAtMs, comment: session.comment,
+                              exported: false, lastExportedAtMs: nil, events: session.events)
+        }
+        if let session = sessions.first(where: { $0.id == sessionId }) {
+            ImuSessionFileStore.shared.register(id: sessionId, deviceId: session.deviceId, fromMs: fromMs, toMs: toMs)
+        }
+    }
+
+    func setComment(_ comment: String, sessionId: String) {
+        mutate(sessionId) { $0.comment = String(comment.prefix(4_000)) }
+    }
+
+    @discardableResult
+    func addMarker(sessionId: String, at: Date, type: String, text: String) -> Event? {
+        guard Self.markerTypes.contains(type) else { return nil }
+        var added: Event?
+        mutate(sessionId) { session in
+            let atMs = Self.clamp(Int64(at.timeIntervalSince1970 * 1_000), to: session)
+            let marker = Event(atMs: atMs, kind: "marker", markerId: UUID().uuidString,
+                               markerType: type, text: String(text.prefix(500)))
+            session.events.append(marker)
+            added = marker
+        }
+        return added
+    }
+
+    func updateMarker(sessionId: String, markerId: String, at: Date, type: String, text: String) {
+        guard Self.markerTypes.contains(type) else { return }
+        mutate(sessionId) { session in
+            guard let index = session.events.firstIndex(where: { $0.markerId == markerId }) else { return }
+            session.events[index].atMs = Self.clamp(Int64(at.timeIntervalSince1970 * 1_000), to: session)
+            session.events[index].markerType = type
+            session.events[index].text = String(text.prefix(500))
+        }
+    }
+
+    func deleteMarker(sessionId: String, markerId: String) {
+        mutate(sessionId) { $0.events.removeAll { $0.kind == "marker" && $0.markerId == markerId } }
+    }
+
+    func markExported(_ sessionId: String, now: Date = Date()) {
+        mutate(sessionId) {
+            $0.exported = true
+            $0.lastExportedAtMs = Int64(now.timeIntervalSince1970 * 1_000)
+        }
+    }
+
+    @discardableResult
+    func removeMetadata(_ sessionId: String,
+                        removeItem: (URL) throws -> Void = { try FileManager.default.removeItem(at: $0) }) -> Bool {
+        guard sessions.first(where: { $0.id == sessionId })?.active == false else { return false }
+        guard ImuSessionFileStore.shared.deleteFiles(sessionId, removeItem: removeItem) else { return false }
+        ImuSessionFileStore.shared.remove(id: sessionId)
+        do {
+            let metadata = file(sessionId)
+            if FileManager.default.fileExists(atPath: metadata.path) { try removeItem(metadata) }
+        } catch { return false }
+        sessions.removeAll { $0.id == sessionId }
+        return true
+    }
+
+    private func mutateActive(_ body: (inout Session) -> Void) {
+        guard let index = sessions.firstIndex(where: \.active) else { return }
+        body(&sessions[index])
+        persist(sessions[index])
+    }
+
+    private func mutate(_ id: String, _ body: (inout Session) -> Void) {
+        guard let index = sessions.firstIndex(where: { $0.id == id }) else { return }
+        body(&sessions[index])
+        persist(sessions[index])
+    }
+
+    private func persist(_ session: Session) {
+        guard let data = try? encoder.encode(session) else { return }
+        try? data.write(to: file(session.id), options: .atomic)
+    }
+
+    private func file(_ id: String) -> URL { directory.appendingPathComponent("session-\(id).json") }
+
+    private func validRange(_ from: Int64, _ to: Int64) -> Bool {
+        from > 0 && from <= to && to - from <= 7 * 24 * 60 * 60 * 1_000
+    }
+
+    static let markerTypes = ["moment", "start", "end", "issue"]
+
+    private static func clamp(_ atMs: Int64, to session: Session) -> Int64 {
+        min(max(atMs, session.startedAtMs), session.endedAtMs ?? Int64(Date().timeIntervalSince1970 * 1_000))
+    }
+
+    func exportEntries(for session: Session, sensorAvailable: Bool = false) -> [FileExport.BundleEntry] {
+        var meta: [String: Any] = [
+            "schema_version": 3, "capture_kind": "whoop_5mg_raw_data",
+            "session_id": session.id, "device_id": session.deviceId,
+            "started_at_ms": session.startedAtMs, "ended_at_ms": session.endedAtMs ?? session.startedAtMs,
+            "comment": session.comment,
+            "sensor_export_available": sensorAvailable,
+            "device_family": "iOS",
+            "app_version": Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "?",
+            "markers": session.events.filter {
+                $0.kind == "marker" && $0.atMs >= session.startedAtMs
+                    && $0.atMs <= (session.endedAtMs ?? session.startedAtMs)
+            }.map { marker in
+                ["id": marker.markerId ?? "", "at_ms": marker.atMs,
+                 "type": marker.markerType ?? "moment", "text": marker.text ?? ""] as [String: Any]
+            },
+        ]
+        if let value = session.capturedStartedAtMs { meta["captured_started_at_ms"] = value }
+        if let value = session.capturedEndedAtMs { meta["captured_ended_at_ms"] = value }
+        let metaData = (try? JSONSerialization.data(withJSONObject: meta, options: [.prettyPrinted, .sortedKeys])) ?? Data()
+        let endMs = session.endedAtMs ?? session.startedAtMs
+        let publicEvents = [Event(atMs: session.startedAtMs, kind: "start")]
+            + session.events.filter {
+                $0.kind == "marker" && $0.atMs >= session.startedAtMs && $0.atMs <= endMs
+            }.sorted { $0.atMs < $1.atMs }
+            + [Event(atMs: endMs, kind: "stop")]
+        let eventData = publicEvents.compactMap { event -> Data? in
+            var row: [String: Any] = ["at_ms": event.atMs, "kind": event.kind]
+            if event.kind == "marker" {
+                if let value = event.markerId { row["marker_id"] = value }
+                if let value = event.markerType { row["marker_type"] = value }
+                if let value = event.text { row["text"] = value }
+            }
+            return try? JSONSerialization.data(withJSONObject: row, options: [.sortedKeys])
+        }.reduce(into: Data()) { $0.append($1); $0.append(0x0A) }
+        return [
+            .init(name: "meta.json", data: metaData),
+            .init(name: "events.jsonl", data: eventData),
+        ]
+    }
+}
diff --git a/Strand/Data/DeviceRegistry.swift b/Strand/Data/DeviceRegistry.swift
index 5060fae5d7..032d70a1c3 100644
--- a/Strand/Data/DeviceRegistry.swift
+++ b/Strand/Data/DeviceRegistry.swift
@@ -92,6 +92,7 @@ final class DeviceRegistry: ObservableObject {
     /// Best-effort: a store failure leaves the recordings and published state untouched. Awaits the delete
     /// BEFORE `reload()` so the refreshed device list reflects the emptied recordings.
     func deleteDeviceData(_ id: String, store: WhoopStore) async {
+        guard ImuSessionFileStore.shared.deleteDevice(id) else { return }
         do {
             try await store.deleteAllData(deviceId: id)
         } catch {
@@ -108,6 +109,7 @@ final class DeviceRegistry: ObservableObject {
     /// and refreshes the published list. Best-effort: if the data wipe fails the registry row is left in
     /// place (we never leave orphaned recordings behind a removed row).
     func forget(_ id: String, store: WhoopStore) async {
+        guard ImuSessionFileStore.shared.deleteDevice(id) else { return }
         do {
             try await store.deleteAllData(deviceId: id)
         } catch {
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 47959eeaca..272e7e9ed6 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -208219,6 +208219,72 @@
     "A cardiovascular load from time in heart-rate zones (Edwards TRIMP): each zone is weighted so harder ones count for more, summed into one daily figure. Settings offers an exponential alternative (Banister) that credits short, hard efforts more.": { "localizations": {
       "de": { "stringUnit": { "state": "translated", "value": "Eine kardiovaskuläre Last aus der Zeit in den Herzfrequenzzonen (Edwards-TRIMP): Jede Zone wird gewichtet, sodass härtere Zonen mehr zählen, aufsummiert zu einer Tageszahl. In den Einstellungen gibt es eine exponentielle Alternative (Banister), die kurze, harte Belastungen stärker anrechnet." } }, "en": { "stringUnit": { "state": "translated", "value": "A cardiovascular load from time in heart-rate zones (Edwards TRIMP): each zone is weighted so harder ones count for more, summed into one daily figure. Settings offers an exponential alternative (Banister) that credits short, hard efforts more." } }, "es": { "stringUnit": { "state": "translated", "value": "Una carga cardiovascular a partir del tiempo en las zonas de frecuencia cardíaca (TRIMP de Edwards): cada zona se pondera para que las más duras cuenten más, sumado en una sola cifra diaria. En Ajustes hay una alternativa exponencial (Banister) que valora más los esfuerzos cortos e intensos." } }, "fr": { "stringUnit": { "state": "translated", "value": "Une charge cardiovasculaire issue du temps passé dans les zones de fréquence cardiaque (TRIMP d’Edwards) : chaque zone est pondérée pour que les plus intenses comptent davantage, additionnée en un seul chiffre journalier. Les Réglages proposent une alternative exponentielle (Banister) qui valorise davantage les efforts courts et intenses." } }, "it": { "stringUnit": { "state": "translated", "value": "Un carico cardiovascolare dato dal tempo nelle zone di frequenza cardiaca (TRIMP di Edwards): ogni zona è ponderata in modo che quelle più dure contino di più, sommato in un unico dato giornaliero. Nelle Impostazioni c’è un’alternativa esponenziale (Banister) che premia di più gli sforzi brevi e intensi." } }, "pl": { "stringUnit": { "state": "translated", "value": "Obciążenie układu krążenia wynikające z czasu w strefach tętna (TRIMP Edwardsa): każda strefa jest ważona tak, aby trudniejsze liczyły się bardziej, zsumowane w jedną wartość dzienną. W Ustawieniach jest alternatywa wykładnicza (Banister), która mocniej docenia krótkie, intensywne wysiłki." } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Uma carga cardiovascular a partir do tempo nas zonas de frequência cardíaca (TRIMP de Edwards): cada zona é ponderada para que as mais difíceis contem mais, resumido num valor diário. Nas Definições existe uma alternativa exponencial (Banister) que valoriza mais os esforços curtos e intensos." } }, "ru": { "stringUnit": { "state": "translated", "value": "Сердечно-сосудистая нагрузка по времени в пульсовых зонах (TRIMP Эдвардса): каждая зона взвешивается так, что более тяжёлые учитываются сильнее, и всё суммируется в одно дневное значение. В настройках есть экспоненциальная альтернатива (Banister), которая сильнее засчитывает короткие интенсивные усилия." } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "根据你在各心率区间的时长得出的心血管负荷（Edwards TRIMP）：区间越高权重越大，汇总为一个每日数字。设置中提供指数式替代方案（Banister），会更看重短时高强度的努力。" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "根據你在各心率區間停留時間得出的心血管負荷（Edwards TRIMP）：區間越高權重越大，加總成每日一個數字。設定中提供指數式替代方案（Banister），會更看重短時高強度的努力。" } }
     } },
+    "WHOOP 5.0 / MG supports live data and strap history. Protocol-research tools are available separately in Test Centre.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"WHOOP 5.0/MG unterstützt Live-Daten und Bandverlauf. Protokollwerkzeuge sind separat im Testcenter."}},"es":{"stringUnit":{"state":"translated","value":"WHOOP 5.0/MG admite datos en directo e historial. Las herramientas de protocolo están aparte en el Centro de pruebas."}},"fr":{"stringUnit":{"state":"translated","value":"WHOOP 5.0/MG gère les données en direct et l’historique. Les outils de protocole sont séparés dans le Centre de test."}},"pt-PT":{"stringUnit":{"state":"translated","value":"WHOOP 5.0/MG suporta dados em direto e histórico. As ferramentas de protocolo estão separadas no Centro de testes."}},"it":{"stringUnit":{"state":"translated","value":"WHOOP 5.0/MG supporta i dati in tempo reale e la cronologia della fascia. Gli strumenti di ricerca sul protocollo sono separati nel Centro test."}},"pl":{"stringUnit":{"state":"translated","value":"WHOOP 5.0/MG obsługuje dane na żywo i historię paska. Narzędzia badawcze protokołu są dostępne osobno w Centrum Testowym."}},"ru":{"stringUnit":{"state":"translated","value":"WHOOP 5.0/MG поддерживает данные в реальном времени и историю браслета. Инструменты исследования протокола вынесены в Тестовый центр."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"WHOOP 5.0/MG 支持实时数据和手环历史。协议研究工具单独位于测试中心。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"WHOOP 5.0/MG 支援即時資料與手環歷史。協定研究工具另置於測試中心。"}}}},
+    "Delete this session?": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Diese Session löschen?"}},"es":{"stringUnit":{"state":"translated","value":"¿Eliminar esta sesión?"}},"fr":{"stringUnit":{"state":"translated","value":"Supprimer cette session ?"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Eliminar esta sessão?"}},"it":{"stringUnit":{"state":"translated","value":"Eliminare questa sessione?"}},"pl":{"stringUnit":{"state":"translated","value":"Usunąć tę sesję?"}},"ru":{"stringUnit":{"state":"translated","value":"Удалить эту сессию?"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"要删除此会话吗？"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"要刪除此工作階段嗎？"}}}},
+    "The session %@ and its captured raw data will be deleted permanently.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Die Session %@ und ihre Rohdaten werden dauerhaft gelöscht."}},"es":{"stringUnit":{"state":"translated","value":"La sesión %@ y sus datos se eliminarán permanentemente."}},"fr":{"stringUnit":{"state":"translated","value":"La session %@ et ses données seront définitivement supprimées."}},"pt-PT":{"stringUnit":{"state":"translated","value":"A sessão %@ e os dados serão eliminados permanentemente."}},"it":{"stringUnit":{"state":"translated","value":"La sessione %@ e i suoi dati grezzi verranno eliminati definitivamente."}},"pl":{"stringUnit":{"state":"translated","value":"Sesja %@ i jej surowe dane zostaną trwale usunięte."}},"ru":{"stringUnit":{"state":"translated","value":"Сессия %@ и её сырые данные будут удалены безвозвратно."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"会话 %@ 及其采集的原始数据将被永久删除。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"工作階段 %@ 及其擷取的原始資料將被永久刪除。"}}}},
+    "Delete all sessions?": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Alle Sessions löschen?"}},"es":{"stringUnit":{"state":"translated","value":"¿Eliminar todas las sesiones?"}},"fr":{"stringUnit":{"state":"translated","value":"Supprimer toutes les sessions ?"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Eliminar todas as sessões?"}},"it":{"stringUnit":{"state":"translated","value":"Eliminare tutte le sessioni?"}},"pl":{"stringUnit":{"state":"translated","value":"Usunąć wszystkie sesje?"}},"ru":{"stringUnit":{"state":"translated","value":"Удалить все сессии?"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"要删除所有会话吗？"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"要刪除所有工作階段嗎？"}}}},
+    "All %lld recorded sessions and their captured raw data will be deleted permanently.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Alle %lld Sessions und ihre Rohdaten werden dauerhaft gelöscht."}},"es":{"stringUnit":{"state":"translated","value":"Las %lld sesiones y sus datos se eliminarán permanentemente."}},"fr":{"stringUnit":{"state":"translated","value":"Les %lld sessions et leurs données seront définitivement supprimées."}},"pt-PT":{"stringUnit":{"state":"translated","value":"As %lld sessões e os dados serão eliminados permanentemente."}},"it":{"stringUnit":{"state":"translated","value":"Tutte le %lld sessioni registrate e i loro dati grezzi verranno eliminati definitivamente."}},"pl":{"stringUnit":{"state":"translated","value":"Wszystkie zarejestrowane sesje (%lld) i ich surowe dane zostaną trwale usunięte."}},"ru":{"stringUnit":{"state":"translated","value":"Все записанные сессии (%lld) и их сырые данные будут удалены безвозвратно."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"全部 %lld 个已记录会话及其采集的原始数据将被永久删除。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"全部 %lld 個已記錄工作階段及其擷取的原始資料將被永久刪除。"}}}},
+    "Couldn't export session": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Session konnte nicht exportiert werden"}},"es":{"stringUnit":{"state":"translated","value":"No se pudo exportar la sesión"}},"fr":{"stringUnit":{"state":"translated","value":"Impossible d’exporter la session"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Não foi possível exportar a sessão"}},"it":{"stringUnit":{"state":"translated","value":"Impossibile esportare la sessione"}},"pl":{"stringUnit":{"state":"translated","value":"Nie można wyeksportować sesji"}},"ru":{"stringUnit":{"state":"translated","value":"Не удалось экспортировать сессию"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"无法导出会话"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"無法匯出工作階段"}}}},
+    "Unknown error": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Unbekannter Fehler"}},"es":{"stringUnit":{"state":"translated","value":"Error desconocido"}},"fr":{"stringUnit":{"state":"translated","value":"Erreur inconnue"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Erro desconhecido"}},"it":{"stringUnit":{"state":"translated","value":"Errore sconosciuto"}},"pl":{"stringUnit":{"state":"translated","value":"Nieznany błąd"}},"ru":{"stringUnit":{"state":"translated","value":"Неизвестная ошибка"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"未知错误"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"未知錯誤"}}}},
+    "Capture coverage": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Abdeckung der Aufnahme"}},"es":{"stringUnit":{"state":"translated","value":"Cobertura de la captura"}},"fr":{"stringUnit":{"state":"translated","value":"Couverture de la capture"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Cobertura da captura"}},"it":{"stringUnit":{"state":"translated","value":"Copertura dell'acquisizione"}},"pl":{"stringUnit":{"state":"translated","value":"Pokrycie nagrania"}},"ru":{"stringUnit":{"state":"translated","value":"Покрытие записи"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"采集覆盖率"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"擷取涵蓋率"}}}},
+    "Band: connected%@": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Band: verbunden%@"}},"es":{"stringUnit":{"state":"translated","value":"Pulsera: conectada%@"}},"fr":{"stringUnit":{"state":"translated","value":"Bracelet : connecté%@"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Bracelete: ligada%@"}},"it":{"stringUnit":{"state":"translated","value":"Fascia: collegata%@"}},"pl":{"stringUnit":{"state":"translated","value":"Pasek: połączono%@"}},"ru":{"stringUnit":{"state":"translated","value":"Браслет: подключено%@"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"手环：已连接%@"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"手環：已連接%@"}}}},
+    "Band: disconnected": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Band: getrennt"}},"es":{"stringUnit":{"state":"translated","value":"Pulsera: desconectada"}},"fr":{"stringUnit":{"state":"translated","value":"Bracelet : déconnecté"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Bracelete: desligada"}},"it":{"stringUnit":{"state":"translated","value":"Fascia: disconnessa"}},"pl":{"stringUnit":{"state":"translated","value":"Pasek: rozłączono"}},"ru":{"stringUnit":{"state":"translated","value":"Браслет: отключено"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"手环：已断开"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"手環：已中斷連接"}}}},
+    "History sync: running (%lld chunks)": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Verlaufssynchronisierung läuft (%lld Blöcke)"}},"es":{"stringUnit":{"state":"translated","value":"Sincronizando historial (%lld bloques)"}},"fr":{"stringUnit":{"state":"translated","value":"Synchronisation de l’historique (%lld blocs)"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Sincronização do histórico (%lld blocos)"}},"it":{"stringUnit":{"state":"translated","value":"Sincronizzazione cronologia: in corso (%lld blocchi)"}},"pl":{"stringUnit":{"state":"translated","value":"Synchronizacja historii: w toku (%lld fragmentów)"}},"ru":{"stringUnit":{"state":"translated","value":"Синхронизация истории: выполняется (%lld фрагментов)"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"历史同步：进行中（%lld 个数据块）"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"歷史同步：進行中（%lld 個資料塊）"}}}},
+    "History sync: idle": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Verlaufssynchronisierung inaktiv"}},"es":{"stringUnit":{"state":"translated","value":"Sincronización inactiva"}},"fr":{"stringUnit":{"state":"translated","value":"Synchronisation inactive"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Sincronização inativa"}},"it":{"stringUnit":{"state":"translated","value":"Sincronizzazione cronologia: inattiva"}},"pl":{"stringUnit":{"state":"translated","value":"Synchronizacja historii: bezczynna"}},"ru":{"stringUnit":{"state":"translated","value":"Синхронизация истории: простой"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"历史同步：空闲"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"歷史同步：閒置"}}}},
+    "Realtime IMU: session active since %@": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Echtzeit-IMU: Session aktiv seit %@"}},"es":{"stringUnit":{"state":"translated","value":"IMU en tiempo real: sesión activa desde %@"}},"fr":{"stringUnit":{"state":"translated","value":"IMU en temps réel : session active depuis %@"}},"pt-PT":{"stringUnit":{"state":"translated","value":"IMU em tempo real: sessão ativa desde %@"}},"it":{"stringUnit":{"state":"translated","value":"IMU in tempo reale: sessione attiva da %@"}},"pl":{"stringUnit":{"state":"translated","value":"IMU w czasie rzeczywistym: sesja aktywna od %@"}},"ru":{"stringUnit":{"state":"translated","value":"IMU в реальном времени: сессия активна с %@"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"实时 IMU：会话自 %@ 起活动"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"即時 IMU：工作階段自 %@ 起進行中"}}}},
+    "Historical export window": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Vergangenes Exportzeitfenster"}},"es":{"stringUnit":{"state":"translated","value":"Intervalo histórico de exportación"}},"fr":{"stringUnit":{"state":"translated","value":"Plage d’export historique"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Intervalo histórico de exportação"}},"it":{"stringUnit":{"state":"translated","value":"Finestra di esportazione storica"}},"pl":{"stringUnit":{"state":"translated","value":"Okno eksportu historycznego"}},"ru":{"stringUnit":{"state":"translated","value":"Окно исторического экспорта"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"历史导出时间窗"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"歷史匯出時間範圍"}}}},
+    "Create a session from synchronized history without starting a live capture. 100 Hz coverage is included wherever it still exists in the rolling buffer.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Erstellt eine Session aus dem synchronisierten Verlauf. Noch gepufferte 100-Hz-Daten werden einbezogen."}},"es":{"stringUnit":{"state":"translated","value":"Crea una sesión desde el historial. Incluye los datos de 100 Hz aún disponibles."}},"fr":{"stringUnit":{"state":"translated","value":"Crée une session depuis l’historique. Inclut les données 100 Hz encore disponibles."}},"pt-PT":{"stringUnit":{"state":"translated","value":"Cria uma sessão a partir do histórico. Inclui os dados de 100 Hz ainda disponíveis."}},"it":{"stringUnit":{"state":"translated","value":"Crea una sessione dalla cronologia sincronizzata senza avviare un'acquisizione dal vivo. La copertura a 100 Hz è inclusa dove è ancora presente nel buffer."}},"pl":{"stringUnit":{"state":"translated","value":"Utwórz sesję ze zsynchronizowanej historii bez uruchamiania nagrywania na żywo. Pokrycie 100 Hz jest dołączane tam, gdzie wciąż istnieje w buforze."}},"ru":{"stringUnit":{"state":"translated","value":"Создать сессию из синхронизированной истории без запуска живой записи. Покрытие 100 Гц включается там, где оно ещё есть в буфере."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"从已同步的历史创建会话，无需启动实时采集。滚动缓冲区中仍存在的 100 Hz 数据会一并包含。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"從已同步的歷史建立工作階段，無需啟動即時擷取。輪替緩衝區中仍存在的 100 Hz 資料會一併包含。"}}}},
+    "Recorded sessions": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Aufgezeichnete Sessions"}},"es":{"stringUnit":{"state":"translated","value":"Sesiones grabadas"}},"fr":{"stringUnit":{"state":"translated","value":"Sessions enregistrées"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Sessões gravadas"}},"it":{"stringUnit":{"state":"translated","value":"Sessioni registrate"}},"pl":{"stringUnit":{"state":"translated","value":"Zarejestrowane sesje"}},"ru":{"stringUnit":{"state":"translated","value":"Записанные сессии"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"已记录会话"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"已記錄工作階段"}}}},
+    "No sessions recorded yet.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Noch keine Sessions aufgezeichnet."}},"es":{"stringUnit":{"state":"translated","value":"Aún no hay sesiones grabadas."}},"fr":{"stringUnit":{"state":"translated","value":"Aucune session enregistrée."}},"pt-PT":{"stringUnit":{"state":"translated","value":"Ainda não existem sessões gravadas."}},"it":{"stringUnit":{"state":"translated","value":"Nessuna sessione registrata."}},"pl":{"stringUnit":{"state":"translated","value":"Nie zarejestrowano jeszcze żadnych sesji."}},"ru":{"stringUnit":{"state":"translated","value":"Сессии ещё не записаны."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"尚未记录任何会话。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"尚未記錄任何工作階段。"}}}},
+    "Export status: recording": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Exportstatus: Aufnahme läuft"}},"es":{"stringUnit":{"state":"translated","value":"Estado: grabando"}},"fr":{"stringUnit":{"state":"translated","value":"État : enregistrement"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Estado: a gravar"}},"it":{"stringUnit":{"state":"translated","value":"Stato esportazione: registrazione"}},"pl":{"stringUnit":{"state":"translated","value":"Stan eksportu: nagrywanie"}},"ru":{"stringUnit":{"state":"translated","value":"Состояние экспорта: запись"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"导出状态：正在记录"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"匯出狀態：記錄中"}}}},
+    "IMU: %@": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"IMU: %@"}},"es":{"stringUnit":{"state":"translated","value":"IMU: %@"}},"fr":{"stringUnit":{"state":"translated","value":"IMU : %@"}},"pt-PT":{"stringUnit":{"state":"translated","value":"IMU: %@"}},"it":{"stringUnit":{"state":"translated","value":"IMU: %@"}},"pl":{"stringUnit":{"state":"translated","value":"IMU: %@"}},"ru":{"stringUnit":{"state":"translated","value":"IMU: %@"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"IMU：%@"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"IMU：%@"}}}},
+    "Last exported %@ · export remains available": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Zuletzt exportiert: %@ · Export bleibt verfügbar"}},"es":{"stringUnit":{"state":"translated","value":"Última exportación: %@ · la exportación sigue disponible"}},"fr":{"stringUnit":{"state":"translated","value":"Dernier export : %@ · l’export reste disponible"}},"it":{"stringUnit":{"state":"translated","value":"Ultima esportazione: %@ · l’esportazione resta disponibile"}},"pl":{"stringUnit":{"state":"translated","value":"Ostatnio wyeksportowano: %@ · eksport pozostaje dostępny"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Última exportação: %@ · a exportação continua disponível"}},"ru":{"stringUnit":{"state":"translated","value":"Последний экспорт: %@ · экспорт остаётся доступен"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"上次导出：%@ · 仍可再次导出"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"上次匯出：%@ · 仍可再次匯出"}}}},
+    "Export status: %lld raw batches": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Exportstatus: %lld Rohdatenblöcke"}},"es":{"stringUnit":{"state":"translated","value":"Estado: %lld bloques sin procesar"}},"fr":{"stringUnit":{"state":"translated","value":"État : %lld blocs bruts"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Estado: %lld blocos em bruto"}},"it":{"stringUnit":{"state":"translated","value":"Stato esportazione: %lld blocchi di dati grezzi"}},"pl":{"stringUnit":{"state":"translated","value":"Stan eksportu: %lld partii surowych danych"}},"ru":{"stringUnit":{"state":"translated","value":"Состояние экспорта: %lld пакетов сырых данных"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"导出状态：%lld 批原始数据"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"匯出狀態：%lld 批原始資料"}}}},
+    "Legacy R22 feature-flag experiment. The strap accepts these writes, but NOOP has not observed them enabling a separate live stream. This is not required for normal WHOOP 5/MG support or for the Raw Data Collector. It writes persistent strap settings and may do nothing on your firmware.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Altes R22-Experiment. Für normalen 5/MG-Betrieb und den Rohdaten-Collector ist es nicht erforderlich."}},"es":{"stringUnit":{"state":"translated","value":"Experimento R22 antiguo. No es necesario para el uso normal ni para el recopilador de datos."}},"fr":{"stringUnit":{"state":"translated","value":"Ancienne expérience R22. Elle n’est pas requise pour l’usage normal ni pour le collecteur."}},"pt-PT":{"stringUnit":{"state":"translated","value":"Experiência R22 antiga. Não é necessária para o uso normal nem para o coletor."}},"it":{"stringUnit":{"state":"translated","value":"Vecchio esperimento con i flag R22. La fascia accetta queste scritture, ma NOOP non ha osservato l'attivazione di un flusso dal vivo separato. Non è necessario per il normale supporto WHOOP 5/MG né per il Raccoglitore dati grezzi. Scrive impostazioni persistenti sulla fascia e potrebbe non avere effetto sul tuo firmware."}},"pl":{"stringUnit":{"state":"translated","value":"Dawny eksperyment z flagami R22. Pasek przyjmuje te zapisy, ale NOOP nie zaobserwował uruchomienia osobnego strumienia na żywo. Nie jest to wymagane do normalnej obsługi WHOOP 5/MG ani do Kolektora danych surowych. Zapisuje trwałe ustawienia paska i może nie działać na Twoim oprogramowaniu."}},"ru":{"stringUnit":{"state":"translated","value":"Старый эксперимент с флагами R22. Браслет принимает эти записи, но NOOP не наблюдал включения отдельного живого потока. Для обычной поддержки WHOOP 5/MG и Сборщика сырых данных это не требуется. Записывает постоянные настройки браслета и может ничего не дать на вашей прошивке."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"旧的 R22 功能标记实验。手环会接受这些写入，但 NOOP 未观察到由此启用独立的实时数据流。正常的 WHOOP 5/MG 支持和原始数据采集器都不需要它。它会写入持久的手环设置，在你的固件上可能毫无作用。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"舊的 R22 功能標記實驗。手環會接受這些寫入，但 NOOP 未觀察到因此啟用獨立的即時資料流。正常的 WHOOP 5/MG 支援與原始資料收集器都不需要它。它會寫入持久的手環設定，在你的韌體上可能毫無作用。"}}}},
+    "NOOP estimates your steps from your WHOOP's stored motion, calibrated to your phone's step count. It's an estimate, not a hardware step counter; normal WHOOP 5/MG history sync supplies the motion data.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"NOOP schätzt Schritte aus gespeicherter Bewegung und kalibriert sie mit dem Telefon. Es ist kein Hardware-Schrittzähler."}},"es":{"stringUnit":{"state":"translated","value":"NOOP estima los pasos desde el movimiento y los calibra con el teléfono. No es un contador físico."}},"fr":{"stringUnit":{"state":"translated","value":"NOOP estime les pas depuis le mouvement et les calibre avec le téléphone. Ce n’est pas un compteur matériel."}},"pt-PT":{"stringUnit":{"state":"translated","value":"O NOOP estima os passos a partir do movimento e calibra-os com o telefone. Não é um contador físico."}},"it":{"stringUnit":{"state":"translated","value":"NOOP stima i tuoi passi dal movimento memorizzato dal WHOOP, calibrato sul contapassi del telefono. È una stima, non un contapassi hardware; i dati di movimento arrivano dalla normale sincronizzazione della cronologia WHOOP 5/MG."}},"pl":{"stringUnit":{"state":"translated","value":"NOOP szacuje kroki na podstawie ruchu zapisanego przez WHOOP, kalibrując je licznikiem kroków telefonu. To oszacowanie, a nie sprzętowy krokomierz; dane o ruchu pochodzą ze zwykłej synchronizacji historii WHOOP 5/MG."}},"ru":{"stringUnit":{"state":"translated","value":"NOOP оценивает шаги по сохранённому движению WHOOP, калибруя их по шагомеру телефона. Это оценка, а не аппаратный шагомер; данные о движении приходят из обычной синхронизации истории WHOOP 5/MG."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"NOOP 根据 WHOOP 存储的运动数据估算步数，并以手机步数进行校准。这是估算值，而非硬件计步器；运动数据来自正常的 WHOOP 5/MG 历史同步。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"NOOP 根據 WHOOP 儲存的運動資料估算步數，並以手機步數進行校準。這是估算值，而非硬體計步器；運動資料來自正常的 WHOOP 5/MG 歷史同步。"}}}},
+    "5/MG RAW DATA COLLECTOR": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"5/MG-ROHDATEN-COLLECTOR"}},"es":{"stringUnit":{"state":"translated","value":"RECOPILADOR DE DATOS 5/MG"}},"fr":{"stringUnit":{"state":"translated","value":"COLLECTEUR DE DONNÉES 5/MG"}},"pt-PT":{"stringUnit":{"state":"translated","value":"RECOLHA DE DADOS 5/MG"}},"it":{"stringUnit":{"state":"translated","value":"RACCOGLITORE DATI GREZZI 5/MG"}},"pl":{"stringUnit":{"state":"translated","value":"KOLEKTOR DANYCH SUROWYCH 5/MG"}},"ru":{"stringUnit":{"state":"translated","value":"СБОРЩИК СЫРЫХ ДАННЫХ 5/MG"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"5/MG 原始数据采集器"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"5/MG 原始資料收集器"}}}},
+    "Record, review, export, and delete bounded 100 Hz motion sessions. Normal sync is unchanged.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Begrenzte 100-Hz-Sessions aufnehmen, prüfen, exportieren und löschen. Normale Synchronisierung bleibt unverändert."}},"es":{"stringUnit":{"state":"translated","value":"Graba, revisa, exporta y elimina sesiones limitadas a 100 Hz. La sincronización normal no cambia."}},"fr":{"stringUnit":{"state":"translated","value":"Enregistrez, consultez, exportez et supprimez des sessions limitées à 100 Hz. La synchronisation normale ne change pas."}},"pt-PT":{"stringUnit":{"state":"translated","value":"Grave, reveja, exporte e elimine sessões limitadas a 100 Hz. A sincronização normal não muda."}},"it":{"stringUnit":{"state":"translated","value":"Registra, esamina, esporta ed elimina sessioni di movimento a 100 Hz delimitate. La sincronizzazione normale non cambia."}},"pl":{"stringUnit":{"state":"translated","value":"Nagrywaj, przeglądaj, eksportuj i usuwaj ograniczone sesje ruchu 100 Hz. Zwykła synchronizacja pozostaje bez zmian."}},"ru":{"stringUnit":{"state":"translated","value":"Записывайте, просматривайте, экспортируйте и удаляйте ограниченные сессии движения 100 Гц. Обычная синхронизация не меняется."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"记录、查看、导出和删除有时长限制的 100 Hz 运动会话。正常同步不受影响。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"記錄、檢視、匯出並刪除有時長限制的 100 Hz 運動工作階段。正常同步不受影響。"}}}},
+    "Open raw-data collector": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Rohdaten-Collector öffnen"}},"es":{"stringUnit":{"state":"translated","value":"Abrir recopilador de datos"}},"fr":{"stringUnit":{"state":"translated","value":"Ouvrir le collecteur de données"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Abrir recolha de dados"}},"it":{"stringUnit":{"state":"translated","value":"Apri il raccoglitore dati grezzi"}},"pl":{"stringUnit":{"state":"translated","value":"Otwórz kolektor danych surowych"}},"ru":{"stringUnit":{"state":"translated","value":"Открыть сборщик сырых данных"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"打开原始数据采集器"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"開啟原始資料收集器"}}}},
+    "WHOOP 5/MG connected.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"WHOOP 5/MG verbunden."}},"es":{"stringUnit":{"state":"translated","value":"WHOOP 5/MG conectado."}},"fr":{"stringUnit":{"state":"translated","value":"WHOOP 5/MG connecté."}},"pt-PT":{"stringUnit":{"state":"translated","value":"WHOOP 5/MG ligado."}},"it":{"stringUnit":{"state":"translated","value":"WHOOP 5/MG collegato."}},"pl":{"stringUnit":{"state":"translated","value":"WHOOP 5/MG połączony."}},"ru":{"stringUnit":{"state":"translated","value":"WHOOP 5/MG подключён."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"WHOOP 5/MG 已连接。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"WHOOP 5/MG 已連接。"}}}},
+    "Connect your WHOOP 5/MG to start a capture.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Verbinde dein WHOOP 5/MG, um eine Aufnahme zu starten."}},"es":{"stringUnit":{"state":"translated","value":"Conecta tu WHOOP 5/MG para iniciar una captura."}},"fr":{"stringUnit":{"state":"translated","value":"Connectez votre WHOOP 5/MG pour lancer une capture."}},"pt-PT":{"stringUnit":{"state":"translated","value":"Ligue o WHOOP 5/MG para iniciar uma captura."}},"it":{"stringUnit":{"state":"translated","value":"Collega il tuo WHOOP 5/MG per avviare un'acquisizione."}},"pl":{"stringUnit":{"state":"translated","value":"Połącz WHOOP 5/MG, aby rozpocząć nagrywanie."}},"ru":{"stringUnit":{"state":"translated","value":"Подключите WHOOP 5/MG, чтобы начать запись."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"连接你的 WHOOP 5/MG 以开始采集。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"連接你的 WHOOP 5/MG 以開始擷取。"}}}},
+    "5/MG PROTOCOL DIAGNOSTICS": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"5/MG-PROTOKOLLDIAGNOSE"}},"es":{"stringUnit":{"state":"translated","value":"DIAGNÓSTICO DEL PROTOCOLO 5/MG"}},"fr":{"stringUnit":{"state":"translated","value":"DIAGNOSTICS DU PROTOCOLE 5/MG"}},"pt-PT":{"stringUnit":{"state":"translated","value":"DIAGNÓSTICO DO PROTOCOLO 5/MG"}},"it":{"stringUnit":{"state":"translated","value":"DIAGNOSTICA PROTOCOLLO 5/MG"}},"pl":{"stringUnit":{"state":"translated","value":"DIAGNOSTYKA PROTOKOŁU 5/MG"}},"ru":{"stringUnit":{"state":"translated","value":"ДИАГНОСТИКА ПРОТОКОЛА 5/MG"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"5/MG 协议诊断"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"5/MG 協定診斷"}}}},
+    "Developer tools for unmapped protocol features. None of these are required for normal WHOOP 5/MG recording, history sync, or the bounded Raw Data Collector.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Entwicklerwerkzeuge für nicht zugeordnete Protokollfunktionen. Für normale Aufnahme, Verlauf und Rohdaten-Collector nicht erforderlich."}},"es":{"stringUnit":{"state":"translated","value":"Herramientas para funciones de protocolo sin asignar. No son necesarias para el uso normal."}},"fr":{"stringUnit":{"state":"translated","value":"Outils pour les fonctions de protocole non identifiées. Ils ne sont pas requis pour l’usage normal."}},"pt-PT":{"stringUnit":{"state":"translated","value":"Ferramentas para funções de protocolo não identificadas. Não são necessárias para o uso normal."}},"it":{"stringUnit":{"state":"translated","value":"Strumenti per sviluppatori per funzioni di protocollo non mappate. Nessuno è necessario per la normale registrazione WHOOP 5/MG, la sincronizzazione della cronologia o il Raccoglitore dati grezzi."}},"pl":{"stringUnit":{"state":"translated","value":"Narzędzia deweloperskie do niezmapowanych funkcji protokołu. Żadne z nich nie są wymagane do zwykłego nagrywania WHOOP 5/MG, synchronizacji historii ani Kolektora danych surowych."}},"ru":{"stringUnit":{"state":"translated","value":"Инструменты разработчика для неразобранных функций протокола. Ничего из этого не требуется для обычной записи WHOOP 5/MG, синхронизации истории или Сборщика сырых данных."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"用于未映射协议功能的开发者工具。正常的 WHOOP 5/MG 记录、历史同步和原始数据采集器都不需要这些。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"用於未對應協定功能的開發者工具。正常的 WHOOP 5/MG 記錄、歷史同步與原始資料收集器都不需要這些。"}}}},
+    "Protocol probes": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Protokolltests"}},"es":{"stringUnit":{"state":"translated","value":"Sondas de protocolo"}},"fr":{"stringUnit":{"state":"translated","value":"Sondes de protocole"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Sondas de protocolo"}},"it":{"stringUnit":{"state":"translated","value":"Sonde di protocollo"}},"pl":{"stringUnit":{"state":"translated","value":"Sondy protokołu"}},"ru":{"stringUnit":{"state":"translated","value":"Пробы протокола"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"协议探测"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"協定探測"}}}},
+    "Sends experimental protocol queries and records the replies in the strap log.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Sendet experimentelle Abfragen und protokolliert die Antworten."}},"es":{"stringUnit":{"state":"translated","value":"Envía consultas experimentales y registra las respuestas."}},"fr":{"stringUnit":{"state":"translated","value":"Envoie des requêtes expérimentales et consigne les réponses."}},"pt-PT":{"stringUnit":{"state":"translated","value":"Envia consultas experimentais e regista as respostas."}},"it":{"stringUnit":{"state":"translated","value":"Invia query sperimentali e registra le risposte nel log della fascia."}},"pl":{"stringUnit":{"state":"translated","value":"Wysyła eksperymentalne zapytania protokołu i zapisuje odpowiedzi w dzienniku paska."}},"ru":{"stringUnit":{"state":"translated","value":"Отправляет экспериментальные запросы протокола и записывает ответы в журнал браслета."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"发送实验性协议查询，并将回复记录到手环日志中。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"傳送實驗性協定查詢，並將回覆記錄到手環日誌中。"}}}},
+    "Broadcast heart rate from the strap": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Herzfrequenz vom Band übertragen"}},"es":{"stringUnit":{"state":"translated","value":"Transmitir frecuencia cardíaca desde la pulsera"}},"fr":{"stringUnit":{"state":"translated","value":"Diffuser la fréquence cardiaque du bracelet"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Transmitir frequência cardíaca da bracelete"}},"it":{"stringUnit":{"state":"translated","value":"Trasmetti la frequenza cardiaca dalla fascia"}},"pl":{"stringUnit":{"state":"translated","value":"Nadawaj tętno z paska"}},"ru":{"stringUnit":{"state":"translated","value":"Транслировать пульс с браслета"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"从手环广播心率"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"從手環廣播心率"}}}},
+    "Writes the reversible 5/MG advertising flag for Garmin, Zwift, and compatible gym equipment.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Setzt das umkehrbare 5/MG-Werbe-Flag für kompatible Geräte."}},"es":{"stringUnit":{"state":"translated","value":"Activa el indicador reversible 5/MG para equipos compatibles."}},"fr":{"stringUnit":{"state":"translated","value":"Active l’indicateur réversible 5/MG pour les appareils compatibles."}},"pt-PT":{"stringUnit":{"state":"translated","value":"Ativa o indicador reversível 5/MG para equipamento compatível."}},"it":{"stringUnit":{"state":"translated","value":"Scrive il flag di advertising 5/MG reversibile per Garmin, Zwift e attrezzature da palestra compatibili."}},"pl":{"stringUnit":{"state":"translated","value":"Zapisuje odwracalną flagę rozgłaszania 5/MG dla Garmina, Zwifta i zgodnego sprzętu na siłowni."}},"ru":{"stringUnit":{"state":"translated","value":"Записывает обратимый флаг вещания 5/MG для Garmin, Zwift и совместимых тренажёров."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"写入可撤销的 5/MG 广播标记，供 Garmin、Zwift 及兼容健身器材使用。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"寫入可撤銷的 5/MG 廣播標記，供 Garmin、Zwift 及相容健身器材使用。"}}}},
+    "Legacy R22 feature-flag experiment": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Altes R22-Feature-Flag-Experiment"}},"es":{"stringUnit":{"state":"translated","value":"Experimento antiguo de indicadores R22"}},"fr":{"stringUnit":{"state":"translated","value":"Ancienne expérience d’indicateurs R22"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Experiência antiga de indicadores R22"}},"it":{"stringUnit":{"state":"translated","value":"Vecchio esperimento con i flag R22"}},"pl":{"stringUnit":{"state":"translated","value":"Dawny eksperyment z flagami R22"}},"ru":{"stringUnit":{"state":"translated","value":"Старый эксперимент с флагами R22"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"旧的 R22 功能标记实验"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"舊的 R22 功能標記實驗"}}}},
+    "The strap accepts these writes, but NOOP has not observed them enabling a separate live stream. This is not the Raw Data Collector.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Das Band akzeptiert die Schreibvorgänge, ein eigener Live-Stream wurde aber nicht beobachtet. Dies ist nicht der Rohdaten-Collector."}},"es":{"stringUnit":{"state":"translated","value":"La pulsera acepta estas escrituras, pero no se ha observado otro flujo. Esto no es el recopilador."}},"fr":{"stringUnit":{"state":"translated","value":"Le bracelet accepte ces écritures, mais aucun flux distinct n’a été observé. Ce n’est pas le collecteur."}},"pt-PT":{"stringUnit":{"state":"translated","value":"A bracelete aceita estas escritas, mas não foi observado outro fluxo. Isto não é a recolha de dados."}},"it":{"stringUnit":{"state":"translated","value":"La fascia accetta queste scritture, ma NOOP non ha osservato l'attivazione di un flusso dal vivo separato. Questo non è il Raccoglitore dati grezzi."}},"pl":{"stringUnit":{"state":"translated","value":"Pasek przyjmuje te zapisy, ale NOOP nie zaobserwował uruchomienia osobnego strumienia na żywo. To nie jest Kolektor danych surowych."}},"ru":{"stringUnit":{"state":"translated","value":"Браслет принимает эти записи, но NOOP не наблюдал включения отдельного живого потока. Это не Сборщик сырых данных."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"手环会接受这些写入，但 NOOP 未观察到由此启用独立的实时数据流。这不是原始数据采集器。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"手環會接受這些寫入，但 NOOP 未觀察到因此啟用獨立的即時資料流。這不是原始資料收集器。"}}}},
+    "WHOOP MG ECG raw-data gate": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"WHOOP-MG-Schalter für ECG-Rohdaten"}},"es":{"stringUnit":{"state":"translated","value":"Control de datos ECG de WHOOP MG"}},"fr":{"stringUnit":{"state":"translated","value":"Contrôle des données ECG WHOOP MG"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Controlo de dados ECG WHOOP MG"}},"it":{"stringUnit":{"state":"translated","value":"Interruttore dati grezzi ECG per WHOOP MG"}},"pl":{"stringUnit":{"state":"translated","value":"Przełącznik surowych danych EKG WHOOP MG"}},"ru":{"stringUnit":{"state":"translated","value":"Переключатель сырых данных ЭКГ WHOOP MG"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"WHOOP MG 心电原始数据开关"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"WHOOP MG 心電原始資料開關"}}}},
+    "MG-only protocol instrumentation, not a medical ECG feature.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Nur MG-Protokolltests, keine medizinische ECG-Funktion."}},"es":{"stringUnit":{"state":"translated","value":"Instrumentación solo para MG; no es una función ECG médica."}},"fr":{"stringUnit":{"state":"translated","value":"Instrumentation MG uniquement, pas une fonction ECG médicale."}},"pt-PT":{"stringUnit":{"state":"translated","value":"Instrumentação apenas para MG; não é uma função ECG médica."}},"it":{"stringUnit":{"state":"translated","value":"Strumentazione di protocollo solo per MG, non una funzione ECG medica."}},"pl":{"stringUnit":{"state":"translated","value":"Instrumentacja protokołu tylko dla MG, nie jest to medyczna funkcja EKG."}},"ru":{"stringUnit":{"state":"translated","value":"Протокольная инструментовка только для MG, а не медицинская функция ЭКГ."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"仅限 MG 的协议检测，并非医疗心电功能。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"僅限 MG 的協定檢測，並非醫療心電功能。"}}}},
+    "Passive history/protocol trace": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Passive Verlaufs-/Protokollaufzeichnung"}},"es":{"stringUnit":{"state":"translated","value":"Registro pasivo de historial/protocolo"}},"fr":{"stringUnit":{"state":"translated","value":"Trace passive d’historique/protocole"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Registo passivo de histórico/protocolo"}},"it":{"stringUnit":{"state":"translated","value":"Traccia passiva di cronologia/protocollo"}},"pl":{"stringUnit":{"state":"translated","value":"Pasywny zapis historii/protokołu"}},"ru":{"stringUnit":{"state":"translated","value":"Пассивная трассировка истории/протокола"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"被动历史/协议追踪"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"被動歷史/協定追蹤"}}}},
+    "Records frames that already arrive. It does not start sensors and can create large files. Use the export section below to save the trace with its strap log.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Zeichnet bereits eintreffende Frames auf, startet keine Sensoren und kann große Dateien erzeugen. Der Export unten fügt das Bandprotokoll hinzu."}},"es":{"stringUnit":{"state":"translated","value":"Registra las tramas que ya llegan. No inicia sensores y puede crear archivos grandes. El export inferior incluye el registro."}},"fr":{"stringUnit":{"state":"translated","value":"Enregistre les trames déjà reçues. Ne démarre aucun capteur et peut créer de gros fichiers. L’export ci-dessous joint le journal."}},"pt-PT":{"stringUnit":{"state":"translated","value":"Regista os pacotes que já chegam. Não inicia sensores e pode criar ficheiros grandes. A exportação abaixo inclui o registo."}},"it":{"stringUnit":{"state":"translated","value":"Registra i frame che arrivano già. Non avvia i sensori e può creare file di grandi dimensioni. Usa la sezione di esportazione qui sotto per salvare la traccia con il log della fascia."}},"pl":{"stringUnit":{"state":"translated","value":"Zapisuje ramki, które i tak przychodzą. Nie uruchamia czujników i może tworzyć duże pliki. Użyj sekcji eksportu poniżej, aby zapisać zapis wraz z dziennikiem paska."}},"ru":{"stringUnit":{"state":"translated","value":"Записывает кадры, которые и так приходят. Не запускает датчики и может создавать большие файлы. Используйте раздел экспорта ниже, чтобы сохранить трассировку вместе с журналом браслета."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"记录本就到达的数据帧。它不会启动传感器，并可能生成很大的文件。请使用下方的导出部分，将追踪记录连同手环日志一起保存。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"記錄本就到達的資料框。它不會啟動感測器，並可能產生很大的檔案。請使用下方的匯出區塊，將追蹤記錄連同手環日誌一起儲存。"}}}},
+    "Couldn't delete session": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Session konnte nicht gelöscht werden"}},"es":{"stringUnit":{"state":"translated","value":"No se pudo eliminar la sesión"}},"fr":{"stringUnit":{"state":"translated","value":"Impossible de supprimer la session"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Não foi possível eliminar a sessão"}},"it":{"stringUnit":{"state":"translated","value":"Impossibile eliminare la sessione"}},"pl":{"stringUnit":{"state":"translated","value":"Nie można usunąć sesji"}},"ru":{"stringUnit":{"state":"translated","value":"Не удалось удалить сессию"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"无法删除会话"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"無法刪除工作階段"}}}},
+    "5/MG Raw Data Collector": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"5/MG-Rohdaten-Collector"}},"es":{"stringUnit":{"state":"translated","value":"Recopilador de datos sin procesar 5/MG"}},"fr":{"stringUnit":{"state":"translated","value":"Collecteur de données brutes 5/MG"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Recolha de dados em bruto 5/MG"}},"it":{"stringUnit":{"state":"translated","value":"Raccoglitore dati grezzi 5/MG"}},"pl":{"stringUnit":{"state":"translated","value":"Kolektor danych surowych 5/MG"}},"ru":{"stringUnit":{"state":"translated","value":"Сборщик сырых данных 5/MG"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"5/MG 原始数据采集器"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"5/MG 原始資料收集器"}}}},
+    "Record a bounded 100 Hz motion session and export its complete timeline.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Eine begrenzte 100-Hz-Bewegungssession aufnehmen und vollständig exportieren."}},"es":{"stringUnit":{"state":"translated","value":"Graba una sesión de movimiento limitada a 100 Hz y exporta su cronología completa."}},"fr":{"stringUnit":{"state":"translated","value":"Enregistrez une session de mouvement 100 Hz limitée et exportez sa chronologie complète."}},"pt-PT":{"stringUnit":{"state":"translated","value":"Grave uma sessão de movimento limitada a 100 Hz e exporte a cronologia completa."}},"it":{"stringUnit":{"state":"translated","value":"Registra una sessione di movimento a 100 Hz delimitata ed esportane la cronologia completa."}},"pl":{"stringUnit":{"state":"translated","value":"Nagraj ograniczoną sesję ruchu 100 Hz i wyeksportuj jej pełną oś czasu."}},"ru":{"stringUnit":{"state":"translated","value":"Запишите ограниченную сессию движения 100 Гц и экспортируйте её полную временную шкалу."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"记录一段有时长限制的 100 Hz 运动会话，并导出其完整时间轴。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"記錄一段有時長限制的 100 Hz 運動工作階段，並匯出其完整時間軸。"}}}},
+    "Start raw-data session": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Rohdaten-Session starten"}},"es":{"stringUnit":{"state":"translated","value":"Iniciar sesión de datos sin procesar"}},"fr":{"stringUnit":{"state":"translated","value":"Démarrer la session de données brutes"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Iniciar sessão de dados em bruto"}},"it":{"stringUnit":{"state":"translated","value":"Avvia sessione dati grezzi"}},"pl":{"stringUnit":{"state":"translated","value":"Rozpocznij sesję danych surowych"}},"ru":{"stringUnit":{"state":"translated","value":"Начать сессию сырых данных"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"开始原始数据会话"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"開始原始資料工作階段"}}}},
+    "Add historical session": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Historische Session hinzufügen"}},"es":{"stringUnit":{"state":"translated","value":"Añadir sesión histórica"}},"fr":{"stringUnit":{"state":"translated","value":"Ajouter une session historique"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Adicionar sessão histórica"}},"it":{"stringUnit":{"state":"translated","value":"Aggiungi sessione storica"}},"pl":{"stringUnit":{"state":"translated","value":"Dodaj sesję historyczną"}},"ru":{"stringUnit":{"state":"translated","value":"Добавить историческую сессию"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"添加历史会话"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"加入歷史工作階段"}}}},
+    "Delete all sessions": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Alle Sessions löschen"}},"es":{"stringUnit":{"state":"translated","value":"Eliminar todas las sesiones"}},"fr":{"stringUnit":{"state":"translated","value":"Supprimer toutes les sessions"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Eliminar todas as sessões"}},"it":{"stringUnit":{"state":"translated","value":"Elimina tutte le sessioni"}},"pl":{"stringUnit":{"state":"translated","value":"Usuń wszystkie sesje"}},"ru":{"stringUnit":{"state":"translated","value":"Удалить все сессии"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"删除所有会话"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"刪除所有工作階段"}}}},
+    "Session comment": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Session-Kommentar"}},"es":{"stringUnit":{"state":"translated","value":"Comentario de la sesión"}},"fr":{"stringUnit":{"state":"translated","value":"Commentaire de session"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Comentário da sessão"}},"it":{"stringUnit":{"state":"translated","value":"Commento della sessione"}},"pl":{"stringUnit":{"state":"translated","value":"Komentarz do sesji"}},"ru":{"stringUnit":{"state":"translated","value":"Комментарий к сессии"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"会话备注"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"工作階段備註"}}}},
+    "Building export…": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Export wird erstellt …"}},"es":{"stringUnit":{"state":"translated","value":"Creando exportación…"}},"fr":{"stringUnit":{"state":"translated","value":"Création de l’export…"}},"pt-PT":{"stringUnit":{"state":"translated","value":"A criar exportação…"}},"it":{"stringUnit":{"state":"translated","value":"Creazione esportazione…"}},"pl":{"stringUnit":{"state":"translated","value":"Tworzenie eksportu…"}},"ru":{"stringUnit":{"state":"translated","value":"Формирование экспорта…"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"正在生成导出…"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"正在建立匯出…"}}}},
+    "Export session": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Session exportieren"}},"es":{"stringUnit":{"state":"translated","value":"Exportar sesión"}},"fr":{"stringUnit":{"state":"translated","value":"Exporter la session"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Exportar sessão"}},"it":{"stringUnit":{"state":"translated","value":"Esporta sessione"}},"pl":{"stringUnit":{"state":"translated","value":"Eksportuj sesję"}},"ru":{"stringUnit":{"state":"translated","value":"Экспортировать сессию"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"导出会话"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"匯出工作階段"}}}},
+    "Delete session": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Session löschen"}},"es":{"stringUnit":{"state":"translated","value":"Eliminar sesión"}},"fr":{"stringUnit":{"state":"translated","value":"Supprimer la session"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Eliminar sessão"}},"it":{"stringUnit":{"state":"translated","value":"Elimina sessione"}},"pl":{"stringUnit":{"state":"translated","value":"Usuń sesję"}},"ru":{"stringUnit":{"state":"translated","value":"Удалить сессию"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"删除会话"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"刪除工作階段"}}}},
+    "The export file could not be created or shared.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Die Exportdatei konnte nicht erstellt oder geteilt werden."}},"es":{"stringUnit":{"state":"translated","value":"No se pudo crear ni compartir el archivo de exportación."}},"fr":{"stringUnit":{"state":"translated","value":"Le fichier d’export n’a pas pu être créé ou partagé."}},"pt-PT":{"stringUnit":{"state":"translated","value":"Não foi possível criar ou partilhar o ficheiro de exportação."}},"it":{"stringUnit":{"state":"translated","value":"Impossibile creare o condividere il file di esportazione."}},"pl":{"stringUnit":{"state":"translated","value":"Nie udało się utworzyć ani udostępnić pliku eksportu."}},"ru":{"stringUnit":{"state":"translated","value":"Не удалось создать файл экспорта или поделиться им."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"无法创建或共享导出文件。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"無法建立或分享匯出檔案。"}}}},
+    "To": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Bis"}},"es":{"stringUnit":{"state":"translated","value":"Hasta"}},"fr":{"stringUnit":{"state":"translated","value":"Au"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Até"}},"it":{"stringUnit":{"state":"translated","value":"A"}},"pl":{"stringUnit":{"state":"translated","value":"Do"}},"ru":{"stringUnit":{"state":"translated","value":"До"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"至"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"至"}}}},
+    "0": {"shouldTranslate":false},
+    "Connect your WHOOP 5/MG to start a raw-data session.": {"shouldTranslate":false,"localizations":{"de":{"stringUnit":{"state":"translated","value":"Verbinde dein WHOOP 5/MG, um eine Rohdaten-Session zu starten."}},"es":{"stringUnit":{"state":"translated","value":"Conecta tu WHOOP 5/MG para iniciar una sesión de datos sin procesar."}},"fr":{"stringUnit":{"state":"translated","value":"Connectez votre WHOOP 5/MG pour démarrer une session de données brutes."}},"pt-PT":{"stringUnit":{"state":"translated","value":"Ligue o WHOOP 5/MG para iniciar uma sessão de dados em bruto."}},"it":{"stringUnit":{"state":"translated","value":"Collega il tuo WHOOP 5/MG per avviare una sessione dati grezzi."}},"pl":{"stringUnit":{"state":"translated","value":"Połącz WHOOP 5/MG, aby rozpocząć sesję danych surowych."}},"ru":{"stringUnit":{"state":"translated","value":"Подключите WHOOP 5/MG, чтобы начать сессию сырых данных."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"连接你的 WHOOP 5/MG 以开始原始数据会话。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"連接你的 WHOOP 5/MG 以開始原始資料工作階段。"}}}},
+    "Add marker": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Marker hinzufügen"}},"en":{"stringUnit":{"state":"translated","value":"Add marker"}},"es":{"stringUnit":{"state":"translated","value":"Añadir marcador"}},"fr":{"stringUnit":{"state":"translated","value":"Ajouter un marqueur"}},"it":{"stringUnit":{"state":"translated","value":"Aggiungi indicatore"}},"pl":{"stringUnit":{"state":"translated","value":"Dodaj znacznik"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Adicionar marcador"}},"ru":{"stringUnit":{"state":"translated","value":"Добавить маркер"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"添加标记"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"加入標記"}}}},
+    "Edit marker": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Marker bearbeiten"}},"en":{"stringUnit":{"state":"translated","value":"Edit marker"}},"es":{"stringUnit":{"state":"translated","value":"Editar marcador"}},"fr":{"stringUnit":{"state":"translated","value":"Modifier le marqueur"}},"it":{"stringUnit":{"state":"translated","value":"Modifica indicatore"}},"pl":{"stringUnit":{"state":"translated","value":"Edytuj znacznik"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Editar marcador"}},"ru":{"stringUnit":{"state":"translated","value":"Изменить маркер"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"编辑标记"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"編輯標記"}}}},
+    "Delete marker": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Marker löschen"}},"en":{"stringUnit":{"state":"translated","value":"Delete marker"}},"es":{"stringUnit":{"state":"translated","value":"Eliminar marcador"}},"fr":{"stringUnit":{"state":"translated","value":"Supprimer le marqueur"}},"it":{"stringUnit":{"state":"translated","value":"Elimina indicatore"}},"pl":{"stringUnit":{"state":"translated","value":"Usuń znacznik"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Eliminar marcador"}},"ru":{"stringUnit":{"state":"translated","value":"Удалить маркер"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"删除标记"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"刪除標記"}}}},
+    "Marker type": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Markertyp"}},"en":{"stringUnit":{"state":"translated","value":"Marker type"}},"es":{"stringUnit":{"state":"translated","value":"Tipo de marcador"}},"fr":{"stringUnit":{"state":"translated","value":"Type de marqueur"}},"it":{"stringUnit":{"state":"translated","value":"Tipo di indicatore"}},"pl":{"stringUnit":{"state":"translated","value":"Typ znacznika"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Tipo de marcador"}},"ru":{"stringUnit":{"state":"translated","value":"Тип маркера"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"标记类型"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"標記類型"}}}},
+    "Marker note": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Markernotiz"}},"en":{"stringUnit":{"state":"translated","value":"Marker note"}},"es":{"stringUnit":{"state":"translated","value":"Nota del marcador"}},"fr":{"stringUnit":{"state":"translated","value":"Note du marqueur"}},"it":{"stringUnit":{"state":"translated","value":"Nota indicatore"}},"pl":{"stringUnit":{"state":"translated","value":"Notatka znacznika"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Nota do marcador"}},"ru":{"stringUnit":{"state":"translated","value":"Заметка маркера"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"标记备注"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"標記備註"}}}},
+    "Current time: %@": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Aktuelle Zeit: %@"}},"en":{"stringUnit":{"state":"translated","value":"Current time: %@"}},"es":{"stringUnit":{"state":"translated","value":"Hora actual: %@"}},"fr":{"stringUnit":{"state":"translated","value":"Heure actuelle : %@"}},"it":{"stringUnit":{"state":"translated","value":"Ora attuale: %@"}},"pl":{"stringUnit":{"state":"translated","value":"Bieżący czas: %@"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Hora atual: %@"}},"ru":{"stringUnit":{"state":"translated","value":"Текущее время: %@"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"当前时间：%@"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"目前時間：%@"}}}},
+    "Marker: %@": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Marker: %@"}},"en":{"stringUnit":{"state":"translated","value":"Marker: %@"}},"es":{"stringUnit":{"state":"translated","value":"Marcador: %@"}},"fr":{"stringUnit":{"state":"translated","value":"Marqueur : %@"}},"it":{"stringUnit":{"state":"translated","value":"Indicatore: %@"}},"pl":{"stringUnit":{"state":"translated","value":"Znacznik: %@"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Marcador: %@"}},"ru":{"stringUnit":{"state":"translated","value":"Маркер: %@"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"标记：%@"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"標記：%@"}}}},
+    "Moment": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Moment"}},"en":{"stringUnit":{"state":"translated","value":"Moment"}},"es":{"stringUnit":{"state":"translated","value":"Momento"}},"fr":{"stringUnit":{"state":"translated","value":"Moment"}},"it":{"stringUnit":{"state":"translated","value":"Momento"}},"pl":{"stringUnit":{"state":"translated","value":"Moment"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Momento"}},"ru":{"stringUnit":{"state":"translated","value":"Момент"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"时刻"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"時刻"}}}},
+    "Issue": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Problem"}},"en":{"stringUnit":{"state":"translated","value":"Issue"}},"es":{"stringUnit":{"state":"translated","value":"Problema"}},"fr":{"stringUnit":{"state":"translated","value":"Problème"}},"it":{"stringUnit":{"state":"translated","value":"Problema"}},"pl":{"stringUnit":{"state":"translated","value":"Problem"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Problema"}},"ru":{"stringUnit":{"state":"translated","value":"Проблема"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"问题"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"問題"}}}},
+    "−10 s": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"−10 s"}},"en":{"stringUnit":{"state":"translated","value":"−10 s"}},"es":{"stringUnit":{"state":"translated","value":"−10 s"}},"fr":{"stringUnit":{"state":"translated","value":"−10 s"}},"it":{"stringUnit":{"state":"translated","value":"−10 s"}},"pl":{"stringUnit":{"state":"translated","value":"−10 s"}},"pt-PT":{"stringUnit":{"state":"translated","value":"−10 s"}},"ru":{"stringUnit":{"state":"translated","value":"−10 с"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"−10 秒"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"−10 秒"}}}},
+    "+10 s": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"+10 s"}},"en":{"stringUnit":{"state":"translated","value":"+10 s"}},"es":{"stringUnit":{"state":"translated","value":"+10 s"}},"fr":{"stringUnit":{"state":"translated","value":"+10 s"}},"it":{"stringUnit":{"state":"translated","value":"+10 s"}},"pl":{"stringUnit":{"state":"translated","value":"+10 s"}},"pt-PT":{"stringUnit":{"state":"translated","value":"+10 s"}},"ru":{"stringUnit":{"state":"translated","value":"+10 с"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"+10 秒"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"+10 秒"}}}},
+    " · %@": {"localizations":{"de":{"stringUnit":{"state":"translated","value":" · %@"}},"en":{"stringUnit":{"state":"translated","value":" · %@"}},"es":{"stringUnit":{"state":"translated","value":" · %@"}},"fr":{"stringUnit":{"state":"translated","value":" · %@"}},"it":{"stringUnit":{"state":"translated","value":" · %@"}},"pl":{"stringUnit":{"state":"translated","value":" · %@"}},"pt-PT":{"stringUnit":{"state":"translated","value":" · %@"}},"ru":{"stringUnit":{"state":"translated","value":" · %@"}},"zh-Hans":{"stringUnit":{"state":"translated","value":" · %@"}},"zh-Hant":{"stringUnit":{"state":"translated","value":" · %@"}}}},
     "Check what the strap has stored": { "localizations": {
       "de": { "stringUnit": { "state": "translated", "value": "Prüfen, was das Band gespeichert hat" } }, "en": { "stringUnit": { "state": "translated", "value": "Check what the strap has stored" } }, "es": { "stringUnit": { "state": "translated", "value": "Comprobar qué tiene guardado la correa" } }, "fr": { "stringUnit": { "state": "translated", "value": "Vérifier ce que le bracelet a enregistré" } }, "it": { "stringUnit": { "state": "translated", "value": "Controlla cosa ha memorizzato il braccialetto" } }, "pl": { "stringUnit": { "state": "translated", "value": "Sprawdź, co zapisała opaska" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Verificar o que a pulseira tem guardado" } }, "ru": { "stringUnit": { "state": "translated", "value": "Проверить, что сохранено на ремешке" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "查看手环已存储的闹钟" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "查看手環已儲存的鬧鐘" } }
     } },
diff --git a/Strand/Screens/AddDeviceWizard.swift b/Strand/Screens/AddDeviceWizard.swift
index d885560651..6f70fc91dc 100644
--- a/Strand/Screens/AddDeviceWizard.swift
+++ b/Strand/Screens/AddDeviceWizard.swift
@@ -327,7 +327,7 @@ struct AddDeviceWizard: View {
         VStack(alignment: .leading, spacing: 10) {
             typeRow(.whoop5mg, icon: "applewatch.side.right",
                     title: "WHOOP 5.0 / MG",
-                    subtitle: String(localized: "Newer WHOOP band, experimental in NOOP"))
+                    subtitle: String(localized: "Newer WHOOP band with live data and history sync"))
             typeRow(.whoop4, icon: "applewatch.side.right",
                     title: "WHOOP 4.0",
                     subtitle: String(localized: "NOOP's primary, fully-supported band"))
@@ -1430,7 +1430,7 @@ struct AddDeviceWizard: View {
             Image(systemName: "flask")
                 .foregroundStyle(StrandPalette.statusWarning)
                 .accessibilityHidden(true)
-            Text("WHOOP 5.0 / MG support is newer and still experimental in NOOP.")
+            Text("WHOOP 5.0 / MG supports live data and strap history. Protocol-research tools are available separately in Test Centre.")
                 .font(StrandFont.footnote)
                 .foregroundStyle(StrandPalette.statusWarning)
                 .fixedSize(horizontal: false, vertical: true)
diff --git a/Strand/Screens/RawDataCollectorView.swift b/Strand/Screens/RawDataCollectorView.swift
new file mode 100644
index 0000000000..4cf3785217
--- /dev/null
+++ b/Strand/Screens/RawDataCollectorView.swift
@@ -0,0 +1,400 @@
+import SwiftUI
+import StrandDesign
+import WhoopStore
+
+/// iOS/macOS parity twin of Android's 5/MG Raw Data Collector screen.
+struct RawDataCollectorView: View {
+    @EnvironmentObject private var model: AppModel
+    @EnvironmentObject private var live: LiveState
+    @StateObject private var store = RawDataSessionStore()
+
+    @State private var exportingId: String?
+    @State private var deleteCandidate: RawDataSessionStore.Session?
+    @State private var confirmDeleteAll = false
+    @State private var exportError: String?
+    @State private var deleteError: String?
+    @State private var imuCoverage: [String: String] = [:]
+    @State private var historicalFrom = Date().addingTimeInterval(-3_600)
+    @State private var historicalTo = Date()
+    @State private var markerDraft: MarkerDraft?
+
+    private struct MarkerDraft: Identifiable {
+        let id = UUID()
+        let sessionId: String
+        let markerId: String?
+        var at: Date
+        var type: String
+        var text: String
+    }
+
+    var body: some View {
+        ScreenScaffold(
+            title: "5/MG Raw Data Collector",
+            subtitle: "Record a bounded 100 Hz motion session and export its complete timeline."
+        ) {
+            VStack(alignment: .leading, spacing: NoopMetrics.sectionSpacing) {
+                coverageCard
+                controls
+                historicalRangeCard
+                sessionsSection
+            }
+        }
+        .task {
+            // Restore a session after navigation/process lifecycle changes. The BLE layer rejects a
+            // duplicate arm, so this is safe when capture never stopped.
+            if let active = store.active, live.bonded { _ = model.ble.startGroundTruthRawCapture(sessionId: active.id) }
+            await refreshImuCoverage()
+        }
+        .onChangeCompat(of: live.bonded) { bonded in
+            if bonded, let active = store.active { _ = model.ble.startGroundTruthRawCapture(sessionId: active.id) }
+        }
+        .confirmationDialog("Delete this session?", isPresented: Binding(
+            get: { deleteCandidate != nil }, set: { if !$0 { deleteCandidate = nil } }
+        ), titleVisibility: .visible) {
+            Button("Delete", role: .destructive) {
+                guard let session = deleteCandidate else { return }
+                deleteCandidate = nil
+                Task { await delete(session) }
+            }
+            Button("Cancel", role: .cancel) { deleteCandidate = nil }
+        } message: {
+            if let session = deleteCandidate {
+                Text("The session \(Self.range(session)) and its captured raw data will be deleted permanently.")
+            }
+        }
+        .confirmationDialog("Delete all sessions?", isPresented: $confirmDeleteAll,
+                            titleVisibility: .visible) {
+            Button("Delete all", role: .destructive) { Task { await deleteAll() } }
+            Button("Cancel", role: .cancel) { }
+        } message: {
+            Text("All \(store.sessions.count) recorded sessions and their captured raw data will be deleted permanently.")
+        }
+        .alert("Couldn't export session", isPresented: Binding(
+            get: { exportError != nil }, set: { if !$0 { exportError = nil } }
+        )) {
+            Button("OK", role: .cancel) { exportError = nil }
+        } message: { Text(exportError ?? "Unknown error") }
+        .alert("Couldn't delete session", isPresented: Binding(
+            get: { deleteError != nil }, set: { if !$0 { deleteError = nil } }
+        )) {
+            Button("OK", role: .cancel) { deleteError = nil }
+        } message: { Text(deleteError ?? "Unknown error") }
+        .sheet(item: $markerDraft) { draft in markerSheet(draft) }
+    }
+
+    private var coverageCard: some View {
+        StrandCard {
+            VStack(alignment: .leading, spacing: NoopMetrics.space2) {
+                Text("Capture coverage").font(StrandFont.headline).foregroundStyle(StrandPalette.textPrimary)
+                Text(live.connected ? "Band: connected\(live.bonded ? " + paired" : "; pairing")"
+                                    : "Band: disconnected")
+                    .foregroundStyle(live.connected ? StrandPalette.statusPositive : StrandPalette.statusCritical)
+                Text(live.backfilling
+                     ? "History sync: running (\(live.syncChunksThisSession) chunks)"
+                     : "History sync: idle")
+                    .foregroundStyle(StrandPalette.textSecondary)
+                if let active = store.active {
+                    Text("Realtime IMU: session active since \(Self.time(active.startedAtMs))")
+                        .foregroundStyle(StrandPalette.accent)
+                }
+            }
+            .font(StrandFont.subhead)
+        }
+    }
+
+    @ViewBuilder private var controls: some View {
+        if store.active != nil {
+            NoopButton("Stop session", systemImage: "stop.fill", kind: .destructive,
+                       fullWidth: true) { Task { await stop() } }
+        } else {
+            NoopButton("Start raw-data session", systemImage: "record.circle", kind: .primary,
+                       fullWidth: true) { start() }
+                .disabled(!live.bonded)
+        }
+    }
+
+    private var historicalRangeCard: some View {
+        StrandCard {
+            VStack(alignment: .leading, spacing: NoopMetrics.space3) {
+                Text("Historical export window").font(StrandFont.headline)
+                Text("Create a session from synchronized history without starting a live capture. 100 Hz coverage is included wherever it still exists in the rolling buffer.")
+                    .font(StrandFont.caption).foregroundStyle(StrandPalette.textTertiary)
+                DatePicker("From", selection: $historicalFrom)
+                DatePicker("To", selection: $historicalTo, in: historicalFrom...)
+                NoopButton("Add historical session", systemImage: "clock.arrow.circlepath",
+                           kind: .secondary, fullWidth: true) {
+                    _ = store.createHistorical(deviceId: model.ble.deviceId,
+                                               from: historicalFrom, to: historicalTo)
+                }
+                .disabled(historicalTo <= historicalFrom || historicalTo.timeIntervalSince(historicalFrom) > 7 * 86_400)
+            }
+        }
+    }
+
+    private var sessionsSection: some View {
+        VStack(alignment: .leading, spacing: NoopMetrics.space3) {
+            Text("Recorded sessions").font(StrandFont.title2).foregroundStyle(StrandPalette.textPrimary)
+            if store.sessions.isEmpty {
+                Text("No sessions recorded yet.").font(StrandFont.subhead)
+                    .foregroundStyle(StrandPalette.textSecondary)
+            } else {
+                NoopButton("Delete all sessions", systemImage: "trash", kind: .destructive,
+                           fullWidth: true) { confirmDeleteAll = true }
+                    .disabled(store.active != nil)
+                ForEach(store.sessions) { session in sessionCard(session) }
+            }
+        }
+    }
+
+    private func sessionCard(_ session: RawDataSessionStore.Session) -> some View {
+        let coverageText = imuCoverage[session.id, default: "no complete seconds"]
+        return StrandCard {
+            VStack(alignment: .leading, spacing: NoopMetrics.space3) {
+                Text(Self.range(session)).font(StrandFont.headline).foregroundStyle(StrandPalette.textPrimary)
+                if !session.active, let endMs = session.endedAtMs {
+                    DatePicker("From", selection: Binding(
+                        get: { Date(timeIntervalSince1970: Double(session.startedAtMs) / 1_000) },
+                        set: { store.setRange(sessionId: session.id, from: $0,
+                                              to: Date(timeIntervalSince1970: Double(endMs) / 1_000)) }
+                    ))
+                    DatePicker("To", selection: Binding(
+                        get: { Date(timeIntervalSince1970: Double(endMs) / 1_000) },
+                        set: { store.setRange(sessionId: session.id,
+                                              from: Date(timeIntervalSince1970: Double(session.startedAtMs) / 1_000), to: $0) }
+                    ))
+                }
+                Text(session.active ? String(localized: "Export status: recording")
+                     : String(localized: "IMU: \(coverageText)"))
+                    .font(StrandFont.caption)
+                    .foregroundStyle(session.active ? StrandPalette.statusWarning : StrandPalette.statusPositive)
+                if let exportedAt = session.lastExportedAtMs {
+                    Text(String(localized: "Last exported \(Self.time(exportedAt)) · export remains available"))
+                        .font(StrandFont.caption)
+                        .foregroundStyle(StrandPalette.textSecondary)
+                }
+                TextField("Session comment", text: Binding(
+                    get: { store.sessions.first(where: { $0.id == session.id })?.comment ?? session.comment },
+                    set: { store.setComment($0, sessionId: session.id) }
+                ), axis: .vertical)
+                    .textFieldStyle(.roundedBorder).lineLimit(2...4)
+                NoopButton("Add marker", systemImage: "mappin.and.ellipse", kind: .secondary,
+                           fullWidth: true) { editMarker(nil, in: session) }
+                let markers = session.events.filter { $0.kind == "marker" }.sorted { $0.atMs < $1.atMs }
+                ForEach(markers) { marker in
+                    Button { editMarker(marker, in: session) } label: {
+                        HStack {
+                            VStack(alignment: .leading, spacing: NoopMetrics.space1) {
+                                (Text(Self.markerLabel(marker.markerType))
+                                    + Text(verbatim: " · \(Self.time(marker.atMs))"))
+                                    .font(StrandFont.subhead).foregroundStyle(StrandPalette.textPrimary)
+                                if let text = marker.text, !text.isEmpty {
+                                    Text(text).font(StrandFont.caption).foregroundStyle(StrandPalette.textSecondary)
+                                }
+                            }
+                            Spacer()
+                            Image(systemName: "chevron.right").foregroundStyle(StrandPalette.textTertiary)
+                        }
+                    }
+                    .buttonStyle(.plain)
+                }
+                NoopButton(exportingId == session.id ? "Building export…" : "Export session",
+                           systemImage: "square.and.arrow.up", kind: .secondary, fullWidth: true) {
+                    Task { await export(session) }
+                }
+                .disabled(session.active || exportingId != nil)
+                NoopButton("Delete session", systemImage: "trash", kind: .destructive,
+                           fullWidth: true) { deleteCandidate = session }
+                    .disabled(session.active || exportingId != nil)
+            }
+        }
+    }
+
+    private func markerSheet(_ initial: MarkerDraft) -> some View {
+        NavigationStack {
+            if let binding = Binding($markerDraft) {
+                let session = store.sessions.first(where: { $0.id == binding.wrappedValue.sessionId })
+                Form {
+                    Section {
+                        TimelineView(.periodic(from: .now, by: 1)) { timeline in
+                            let current = Self.markerCurrentTime(session: session, now: timeline.date)
+                            Text("Marker: \(binding.wrappedValue.at.formatted(date: .omitted, time: .standard))")
+                            Text("Current time: \(current.formatted(date: .omitted, time: .standard))")
+                                .foregroundStyle(.secondary)
+                            HStack {
+                                Button { binding.wrappedValue.at.addTimeInterval(-10) } label: { Text(verbatim: "−10 s") }
+                                Spacer()
+                                Button("0") {
+                                    binding.wrappedValue.at = Self.markerCurrentTime(session: session, now: Date())
+                                }
+                                Spacer()
+                                Button { binding.wrappedValue.at.addTimeInterval(10) } label: { Text(verbatim: "+10 s") }
+                            }
+                        }
+                    }
+                    Section("Marker type") {
+                        Picker("Marker type", selection: binding.type) {
+                            ForEach(RawDataSessionStore.markerTypes, id: \.self) { type in
+                                Text(Self.markerLabel(type)).tag(type)
+                            }
+                        }.pickerStyle(.segmented)
+                    }
+                    Section("Marker note") {
+                        TextField("Marker note", text: binding.text, axis: .vertical).lineLimit(2...4)
+                    }
+                    if let markerId = binding.wrappedValue.markerId {
+                        Section {
+                            Button("Delete marker", role: .destructive) {
+                                store.deleteMarker(sessionId: binding.wrappedValue.sessionId, markerId: markerId)
+                                markerDraft = nil
+                            }
+                        }
+                    }
+                }
+                .navigationTitle(initial.markerId == nil ? "Add marker" : "Edit marker")
+                .toolbar {
+                    ToolbarItem(placement: .cancellationAction) { Button("Cancel") { markerDraft = nil } }
+                    ToolbarItem(placement: .confirmationAction) {
+                        Button("Save") { saveMarker(binding.wrappedValue) }
+                    }
+                }
+            }
+        }
+    }
+
+    private func editMarker(_ marker: RawDataSessionStore.Event?, in session: RawDataSessionStore.Session) {
+        let currentMs = session.endedAtMs ?? Int64(Date().timeIntervalSince1970 * 1_000)
+        markerDraft = MarkerDraft(sessionId: session.id, markerId: marker?.markerId,
+                                  at: Date(timeIntervalSince1970: Double(marker?.atMs ?? currentMs) / 1_000),
+                                  type: marker?.markerType ?? "moment", text: marker?.text ?? "")
+    }
+
+    private func saveMarker(_ draft: MarkerDraft) {
+        if let markerId = draft.markerId {
+            store.updateMarker(sessionId: draft.sessionId, markerId: markerId,
+                               at: draft.at, type: draft.type, text: draft.text)
+        } else {
+            store.addMarker(sessionId: draft.sessionId, at: draft.at, type: draft.type, text: draft.text)
+        }
+        markerDraft = nil
+    }
+
+    private func start() {
+        guard let session = store.start(deviceId: model.ble.deviceId) else { return }
+        guard model.ble.startGroundTruthRawCapture(sessionId: session.id) else {
+            store.stop(); store.removeMetadata(session.id); return
+        }
+    }
+
+    private func stop() async {
+        await model.ble.stopGroundTruthRawCapture()
+        store.stop()
+        await refreshImuCoverage()
+    }
+
+    private func export(_ session: RawDataSessionStore.Session) async {
+        guard let end = session.endedAtMs else { return }
+        exportingId = session.id
+        let bounds = Self.fullSecondBounds(fromMs: session.startedAtMs, toMs: end)
+        let from = bounds?.from ?? 1, to = bounds?.to ?? 0
+        let segments = bounds.map {
+            ImuSessionFileStore.shared.exportSegments(session.id, from: $0.from, to: $0.to)
+        } ?? []
+        let history = bounds == nil ? Data("stream,unix_s,v1,v2,v3,v4\n".utf8)
+            : await model.ble.groundTruthHistoryCSV(from: from, to: to)
+        let sensorAvailable = !segments.isEmpty || history.split(separator: 0x0A).count > 1
+        var entries = store.exportEntries(for: session, sensorAvailable: sensorAvailable)
+        entries.append(.init(name: "history-sensors.csv", data: history))
+        // A live capture can only produce its first complete one-second frame after startup.
+        // Historical windows must still cover the exact requested start.
+        let firstImuTs = segments.map(\.startTs).min().flatMap { $0 <= from + 1 ? $0 : nil }
+        let coverageFrom = session.capturedStartedAtMs == nil ? from : max(from, firstImuTs ?? from)
+        let imuComplete = Self.covers(segments, from: coverageFrom, to: to)
+        let coverage: [String: Any] = [
+            "requested_start_ts": from, "requested_end_ts": to,
+            "required_start_ts": coverageFrom,
+            "startup_seconds": max(0, coverageFrom - from),
+            "complete": imuComplete,
+            "segments": segments.map { ["file": $0.name, "start_ts": $0.startTs, "end_ts": $0.endTs,
+                                         "sample_count": $0.sampleCount] }
+        ]
+        if let data = try? JSONSerialization.data(withJSONObject: coverage, options: [.prettyPrinted, .sortedKeys]) {
+            entries.append(.init(name: "imu-coverage.json", data: data))
+        }
+        for segment in segments { entries.append(.init(name: "imu/\(segment.name)", data: segment.data)) }
+        let result = await FileExport.exportBundle(entries: entries,
+                                                    suggestedName: "noop-5mg-raw-\(session.id).zip")
+        if result == nil { exportError = "The export file could not be created or shared." }
+        else {
+            store.markExported(session.id)
+        }
+        exportingId = nil
+    }
+
+    private func delete(_ session: RawDataSessionStore.Session) async {
+        guard session.endedAtMs != nil else { return }
+        guard store.removeMetadata(session.id) else {
+            deleteError = "The captured data could not be deleted. The session was kept so you can retry."
+            return
+        }
+        imuCoverage[session.id] = nil
+    }
+
+    private func deleteAll() async {
+        for session in store.sessions where !session.active { await delete(session) }
+    }
+
+    private func refreshImuCoverage() async {
+        for session in store.sessions {
+            guard let end = session.endedAtMs,
+                  let bounds = Self.fullSecondBounds(fromMs: session.startedAtMs, toMs: end) else { continue }
+            let stats = ImuSessionFileStore.shared.stats(session.id, from: bounds.from, to: bounds.to)
+            let first = stats.firstTs.flatMap { $0 <= Int64(bounds.from + 1) ? Int($0) : nil }
+            let from = session.capturedStartedAtMs == nil ? bounds.from : max(bounds.from, first ?? bounds.from)
+            let expected = max(0, bounds.to - from + 1)
+            let bytes = ByteCountFormatter.string(fromByteCount: stats.bytes, countStyle: .file)
+            let readiness = expected > 0 && stats.coveredSeconds == expected ? "ready" : "incomplete"
+            imuCoverage[session.id] = "\(stats.coveredSeconds)/\(expected) s · \(bytes) · \(readiness)"
+        }
+    }
+
+    private static func time(_ ms: Int64) -> String {
+        Date(timeIntervalSince1970: Double(ms) / 1_000).formatted(date: .omitted, time: .shortened)
+    }
+
+    static func fullSecondBounds(fromMs: Int64, toMs: Int64) -> (from: Int, to: Int)? {
+        let from = Int((fromMs + 999) / 1_000), to = Int(toMs / 1_000) - 1
+        return from <= to ? (from, to) : nil
+    }
+
+    static func markerCurrentTime(session: RawDataSessionStore.Session?, now: Date) -> Date {
+        session?.endedAtMs.map { Date(timeIntervalSince1970: Double($0) / 1_000) } ?? now
+    }
+
+    private static func range(_ session: RawDataSessionStore.Session) -> String {
+        let start = Date(timeIntervalSince1970: Double(session.startedAtMs) / 1_000)
+        let date = start.formatted(date: .numeric, time: .omitted)
+        let end = session.endedAtMs.map(time) ?? "…"
+        return "\(date) · \(time(session.startedAtMs))–\(end)"
+    }
+
+    private static func markerLabel(_ type: String?) -> LocalizedStringKey {
+        switch type {
+        case "start": "Start"
+        case "end": "End"
+        case "issue": "Issue"
+        default: "Moment"
+        }
+    }
+
+    private static func covers(_ chunks: [ImuSessionFileStore.ExportSegment], from: Int, to: Int) -> Bool {
+        var cursor = from
+        for chunk in chunks.sorted(by: { $0.startTs < $1.startTs }) {
+            let start = chunk.startTs, end = chunk.endTs
+            if chunk.sampleCount < (end - start + 1) * ImuSessionFileStore.sampleRate { continue }
+            if start > cursor { return false }
+            if end >= cursor { cursor = end + 1 }
+            if cursor > to { return true }
+        }
+        return cursor > to
+    }
+}
diff --git a/Strand/Screens/SettingsView.swift b/Strand/Screens/SettingsView.swift
index 856d4710f3..aaeab206be 100644
--- a/Strand/Screens/SettingsView.swift
+++ b/Strand/Screens/SettingsView.swift
@@ -1734,7 +1734,8 @@ struct SettingsView: View {
     @ViewBuilder private var experimentalCard: some View {
         liquidTodayCard
         liveSessionsCard
-        if showFiveMGControls { fiveMGCard }
+        // WHOOP 5/MG protocol research now lives in Test Centre. Everyday Settings no longer carries
+        // a second copy; the persisted keys and reversible disable actions remain unchanged there.
         if showFiveMGControls || model.repo.activeDeviceIsOura { spo2CandidateCard }
         sleepStagingCard
         rawSensorDiagnosticsCard
@@ -1891,7 +1892,7 @@ struct SettingsView: View {
         SettingsSection(
             icon: "flask.fill",
             title: "Experimental · WHOOP 5 / MG",
-            blurb: "Live heart rate already works on a WHOOP 5/MG strap. These probes go further and try to coax more out of it. They are guesses, off by default, and only ever touch a 5/MG strap. WHOOP 4.0 is never affected."
+            blurb: "Normal WHOOP 5/MG recording and history sync are supported. These remaining controls are developer experiments for unmapped protocol features and now live in Test Centre."
         ) {
             VStack(alignment: .leading, spacing: NoopMetrics.rowSpacing) {
                 Toggle(isOn: $puffinExperiments) {
@@ -1920,7 +1921,7 @@ struct SettingsView: View {
                 // strap kept every flag the enable sequence set while the UI implied it had been undone.
                 // Now it offers the real undo. Turning it ON still writes nothing until the button is tapped.
                 .onChangeCompat(of: deepDataEnabled) { on in if !on { confirmingDeepDataDisable = true } }
-                Text("WHOOP 5/MG straps hand a fresh app only live heart rate. The official app switches on the deeper streams (high-rate HR + motion + history) by writing a set of feature flags, a sequence two independent projects have documented. With this on, the button below sends that exact sequence to your strap. Unlike everything else here it does write to the strap — and it is reversible: \u{201C}Turn deep data back off\u{201D} writes the off value to the same flags and then reads every one of them back, so you see what the strap actually stores rather than just that it acked. Experimental: it may do nothing on your firmware. iPhone/Android only. A Mac can't write to a 5/MG.")
+                Text("Legacy R22 feature-flag experiment. The strap accepts these writes, but NOOP has not observed them enabling a separate live stream. This is not required for normal WHOOP 5/MG support or for the Raw Data Collector. It writes persistent strap settings and may do nothing on your firmware.")
                     .font(StrandFont.caption)
                     .foregroundStyle(StrandPalette.textTertiary)
                     .fixedSize(horizontal: false, vertical: true)
@@ -3383,7 +3384,7 @@ struct StepsCalibrationSheet: View {
                     .font(StrandFont.headline)
                     .foregroundStyle(StrandPalette.textPrimary)
                 Text(is5MG
-                     ? String(localized: "NOOP estimates your steps from your WHOOP's motion, calibrated to your phone's step count. It's an estimate, not a step counter — a WHOOP 5.0 / MG streams motion (not a step count) only with deep data on.")
+                     ? String(localized: "NOOP estimates your steps from your WHOOP's stored motion, calibrated to your phone's step count. It's an estimate, not a hardware step counter; normal WHOOP 5/MG history sync supplies the motion data.")
                      : String(localized: "NOOP estimates your steps from your WHOOP's motion, calibrated to your phone's step count. It's an estimate, not a step counter. A WHOOP 4.0 doesn't transmit steps."))
                     .font(StrandFont.subhead)
                     .foregroundStyle(StrandPalette.textSecondary)
@@ -3424,7 +3425,7 @@ struct StepsCalibrationSheet: View {
     /// The "why it's empty" line — a 5/MG needs the deep-data unlock before it streams motion at all.
     private var noMotionLead: String {
         if is5MG {
-            return String(localized: "We're not seeing any motion from your WHOOP 5.0 / MG yet. Unlike a 4.0, a 5/MG only streams motion (and history) once the experimental deep-data unlock is on — so until then there's nothing to estimate steps from. Importing history from WHOOP or Apple Health doesn't provide the strap motion this needs.")
+            return String(localized: "We're not seeing motion from your WHOOP 5.0 / MG yet. Keep NOOP connected and let strap history finish syncing; the experimental R22 flags are not required. Account or Apple Health imports do not contain the raw strap motion this estimate needs.")
         }
         return String(localized: "We're not seeing any motion from your strap yet. Steps are estimated from your WHOOP's banked motion history, so your strap needs to sync that history before NOOP has anything to count.")
     }
@@ -3432,7 +3433,7 @@ struct StepsCalibrationSheet: View {
     /// The "what to do" line — 5/MG points at the deep-data toggle (unless it's already on, then just sync).
     private var noMotionAction: String {
         if is5MG && !deepDataEnabled {
-            return String(localized: "Turn on Settings → \u{201C}Unlock WHOOP 5/MG deep data (R22)\u{201D}, reconnect your strap, then open NOOP near it and let a day or two of motion sync. Your step estimate and the calibration below fill in once motion lands.")
+            return String(localized: "Open NOOP near the strap and let WHOOP 5/MG history finish syncing. The step estimate and calibration fill in once enough stored motion has arrived; the legacy R22 experiment is not required.")
         }
         if is5MG {
             return String(localized: "Deep data is on — open NOOP near your strap and let it sync its motion history (a full first-run sync can take a while). Once a day or two of motion lands, your step estimate and the calibration below fill in.")
diff --git a/Strand/Screens/TestCentreView.swift b/Strand/Screens/TestCentreView.swift
index ec5a195605..4d951818c2 100644
--- a/Strand/Screens/TestCentreView.swift
+++ b/Strand/Screens/TestCentreView.swift
@@ -4,6 +4,7 @@ import StrandAnalytics
 import StrandImport
 import PolarProtocol
 import WhoopStore
+import WhoopProtocol
 
 /// Settings -> Test Centre. The single home for every diagnostic, log and test control (spec section 7).
 ///
@@ -36,6 +37,14 @@ struct TestCentreView: View {
     @State private var debugExportKeep = ScheduledDebugExport.keepCount
     @State private var showClearExportsConfirm = false
 
+    // WHOOP 5/MG developer controls. These use the same persisted keys as the former Settings card;
+    // moving the UI does not reset an opt-in or lose the ability to undo a persistent strap write.
+    @AppStorage(PuffinExperiment.defaultsKey) private var puffinExperiments = false
+    @AppStorage(PuffinFrameRecorder.enabledKey) private var puffinCapture = false
+    @AppStorage(PuffinExperiment.deepDataKey) private var deepDataEnabled = false
+    @AppStorage(PuffinExperiment.broadcastHrKey) private var broadcastHrEnabled = false
+    @AppStorage(PuffinExperiment.ecgRawDataKey) private var ecgRawDataEnabled = false
+
     /// The strap model the user last picked, the same key SettingsView's showFiveMGControls gate reads.
     @AppStorage("selectedWhoopModel") private var selectedWhoopModelRaw = WhoopModel.whoop4.rawValue
 
@@ -77,6 +86,8 @@ struct TestCentreView: View {
             VStack(alignment: .leading, spacing: NoopMetrics.sectionSpacing) {
                 domainModesCard.staggeredAppear(index: 0)
                 diagnosticToolsCard.staggeredAppear(index: 1)
+                if is5MG { rawDataCollectorCard.staggeredAppear(index: 2) }
+                if is5MG { fiveMGProtocolDiagnosticsCard.staggeredAppear(index: 3) }
                 exportCard.staggeredAppear(index: 2)
                 experimentalAlgorithmsCard.staggeredAppear(index: 3)
             }
@@ -132,6 +143,100 @@ struct TestCentreView: View {
 
     // MARK: - Section 2: Diagnostic tools (strap log + recalibrate + env dump)
 
+    @ViewBuilder private var rawDataCollectorCard: some View {
+        NoopCard {
+            VStack(alignment: .leading, spacing: NoopMetrics.space3) {
+                Text("5/MG RAW DATA COLLECTOR")
+                    .font(StrandFont.overline).tracking(StrandFont.overlineTracking)
+                    .foregroundStyle(StrandPalette.textSecondary)
+                Text("Record, review, export, and delete bounded 100 Hz motion sessions. Normal sync is unchanged.")
+                    .font(StrandFont.caption).foregroundStyle(StrandPalette.textTertiary)
+                    .fixedSize(horizontal: false, vertical: true)
+                NavigationLink {
+                    RawDataCollectorView()
+                } label: {
+                    Label("Open raw-data collector", systemImage: "waveform.path.ecg")
+                }
+                .buttonStyle(NoopButtonStyle(.primary, fullWidth: true))
+                Text(live.connected ? "WHOOP 5/MG connected." : "Connect your WHOOP 5/MG to start a raw-data session.")
+                    .font(StrandFont.caption)
+                    .foregroundStyle(live.connected ? StrandPalette.textSecondary : StrandPalette.statusWarning)
+            }
+        }
+    }
+
+    @ViewBuilder private var fiveMGProtocolDiagnosticsCard: some View {
+        NoopCard {
+            VStack(alignment: .leading, spacing: NoopMetrics.space3) {
+                Text("5/MG PROTOCOL DIAGNOSTICS")
+                    .font(StrandFont.overline).tracking(StrandFont.overlineTracking)
+                    .foregroundStyle(StrandPalette.textSecondary)
+                Text("Developer tools for unmapped protocol features. None of these are required for normal WHOOP 5/MG recording, history sync, or the bounded Raw Data Collector.")
+                    .font(StrandFont.caption).foregroundStyle(StrandPalette.textTertiary)
+                    .fixedSize(horizontal: false, vertical: true)
+
+                Toggle("Protocol probes", isOn: $puffinExperiments)
+                    .toggleStyle(.switch).tint(StrandPalette.accent)
+                Text("Sends experimental protocol queries and records the replies in the strap log.")
+                    .font(StrandFont.caption).foregroundStyle(StrandPalette.textTertiary)
+
+                Divider().overlay(StrandPalette.hairline)
+                Toggle("Broadcast heart rate from the strap", isOn: $broadcastHrEnabled)
+                    .toggleStyle(.switch).tint(StrandPalette.accent)
+                    .onChangeCompat(of: broadcastHrEnabled) { model.ble.setBroadcastHr($0) }
+                Text("Writes the reversible 5/MG advertising flag for Garmin, Zwift, and compatible gym equipment.")
+                    .font(StrandFont.caption).foregroundStyle(StrandPalette.textTertiary)
+
+                Divider().overlay(StrandPalette.hairline)
+                Toggle("Legacy R22 feature-flag experiment", isOn: $deepDataEnabled)
+                    .toggleStyle(.switch).tint(StrandPalette.accent)
+                Text("The strap accepts these writes, but NOOP has not observed them enabling a separate live stream. This is not the Raw Data Collector.")
+                    .font(StrandFont.caption).foregroundStyle(StrandPalette.textTertiary)
+                if deepDataEnabled {
+                    NoopButton("Send legacy R22 enable sequence", systemImage: "bolt.badge.automatic", kind: .secondary) {
+                        model.ble.enableWhoop5DeepData()
+                    }
+                    .disabled(!live.encryptedBond || !live.worn)
+                }
+                NoopButton("Clear legacy R22 flags on strap", systemImage: "bolt.slash", kind: .secondary) {
+                    model.ble.disableWhoop5DeepData()
+                }
+                .disabled(!live.encryptedBond || live.r22DisableReport == BLEManager.deviceConfigProbeWaiting)
+                if let result = live.r22DisableReport {
+                    Text(result).font(StrandFont.caption).foregroundStyle(StrandPalette.textSecondary)
+                        .fixedSize(horizontal: false, vertical: true)
+                }
+
+                Divider().overlay(StrandPalette.hairline)
+                Toggle("WHOOP MG ECG raw-data gate", isOn: $ecgRawDataEnabled)
+                    .toggleStyle(.switch).tint(StrandPalette.accent)
+                Text("MG-only protocol instrumentation, not a medical ECG feature.")
+                    .font(StrandFont.caption).foregroundStyle(StrandPalette.textTertiary)
+                if ecgRawDataEnabled {
+                    HStack(spacing: NoopMetrics.space3) {
+                        NoopButton("Gate on", systemImage: "waveform.path.ecg", kind: .secondary) {
+                            model.ble.setEcgRawDataGate(true)
+                        }
+                        NoopButton("Gate off", systemImage: "arrow.uturn.backward", kind: .secondary) {
+                            model.ble.setEcgRawDataGate(false)
+                        }
+                    }
+                    .disabled(!live.encryptedBond || live.whoop5Variant != Whoop5Variant.mg.label)
+                    if let result = live.ecgRawDataGate {
+                        Text(result.summary).font(StrandFont.caption).foregroundStyle(StrandPalette.textSecondary)
+                    }
+                }
+
+                Divider().overlay(StrandPalette.hairline)
+                Toggle("Passive history/protocol trace", isOn: $puffinCapture)
+                    .toggleStyle(.switch).tint(StrandPalette.accent)
+                Text("Records frames that already arrive. It does not start sensors and can create large files. Use the export section below to save the trace with its strap log.")
+                    .font(StrandFont.caption).foregroundStyle(StrandPalette.textTertiary)
+                    .fixedSize(horizontal: false, vertical: true)
+            }
+        }
+    }
+
     @ViewBuilder private var diagnosticToolsCard: some View {
         NoopCard {
             VStack(alignment: .leading, spacing: NoopMetrics.space3) {
diff --git a/StrandTests/RawDataCollectorParityTests.swift b/StrandTests/RawDataCollectorParityTests.swift
new file mode 100644
index 0000000000..f00a0703d2
--- /dev/null
+++ b/StrandTests/RawDataCollectorParityTests.swift
@@ -0,0 +1,57 @@
+import XCTest
+@testable import Strand
+
+/// Feature-level parity guard for the Android and Apple raw-data collectors. The shared oracle lists
+/// every user-visible/session-lifecycle capability and source markers on both implementations.
+final class RawDataCollectorParityTests: XCTestCase {
+    private struct Oracle: Decodable {
+        let schemaVersion: Int
+        let capabilities: [String: Capability]
+        enum CodingKeys: String, CodingKey { case schemaVersion = "schema_version", capabilities }
+    }
+    private struct Capability: Decodable { let swift: [String]; let kotlin: [String] }
+
+    private var repoRoot: URL {
+        URL(fileURLWithPath: #filePath).deletingLastPathComponent().deletingLastPathComponent()
+    }
+
+    private func oracleData() throws -> Data {
+        let url = try XCTUnwrap(Bundle(for: Self.self).url(forResource: "raw_data_collector_parity",
+                                                            withExtension: "json"))
+        return try Data(contentsOf: url)
+    }
+
+    func testAppleSurfaceStillImplementsEveryDeclaredCapability() throws {
+        let oracle = try JSONDecoder().decode(Oracle.self, from: oracleData())
+        XCTAssertEqual(oracle.schemaVersion, 1)
+        let paths = [
+            "Strand/Collect/RawDataSessionStore.swift", "Strand/Collect/Collector.swift",
+            "Strand/BLE/BLEManager.swift", "Strand/Screens/RawDataCollectorView.swift",
+            "Strand/Collect/ImuSessionFileStore.swift",
+            "Packages/WhoopStore/Sources/WhoopStore/Database.swift",
+            "Packages/WhoopStore/Sources/WhoopStore/StreamStore.swift",
+            "Packages/WhoopStore/Sources/WhoopStore/RawOutbox.swift",
+        ]
+        let source = try paths.map { try String(contentsOf: repoRoot.appendingPathComponent($0)) }
+            .joined(separator: "\n")
+        for (name, capability) in oracle.capabilities {
+            for marker in capability.swift {
+                XCTAssertTrue(source.contains(marker), "Apple collector lost \(name) marker: \(marker)")
+            }
+        }
+    }
+
+    func testAndroidAndAppleOracleCopiesAreByteIdentical() throws {
+        let android = repoRoot.appendingPathComponent("android/app/src/test/resources/raw_data_collector_parity.json")
+        XCTAssertEqual(try oracleData(), try Data(contentsOf: android),
+                       "Raw-data collector parity oracle copies must change together")
+    }
+
+    func testAppleKeepsTheOffSessionRealtimeImuFailSafe() throws {
+        let source = try String(contentsOf: repoRoot.appendingPathComponent("Strand/BLE/BLEManager.swift"))
+        XCTAssertTrue(source.contains("stopUnexpectedRealtimeImu(frame, isOffload: isOffload)"))
+        XCTAssertTrue(source.contains("frame[8] == 43 || frame[8] == 51"))
+        XCTAssertTrue(source.contains("send(.stopRawData, payload: [0x01]"))
+        XCTAssertTrue(source.contains("send(.toggleIMUMode, payload: [0x01, 0x00]"))
+    }
+}
diff --git a/StrandTests/RawDataSessionStoreTests.swift b/StrandTests/RawDataSessionStoreTests.swift
new file mode 100644
index 0000000000..38c2c54714
--- /dev/null
+++ b/StrandTests/RawDataSessionStoreTests.swift
@@ -0,0 +1,158 @@
+import XCTest
+@testable import Strand
+import WhoopStore
+
+@MainActor
+final class RawDataSessionStoreTests: XCTestCase {
+    private func temporaryDirectory() throws -> URL {
+        let url = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+        try FileManager.default.createDirectory(at: url, withIntermediateDirectories: true)
+        addTeardownBlock { try? FileManager.default.removeItem(at: url) }
+        return url
+    }
+
+    func testRawSessionLifecycleAndReload() throws {
+        let directory = try temporaryDirectory()
+        let store = RawDataSessionStore(directory: directory)
+        XCTAssertNotNil(store.start(deviceId: "strap", now: Date(timeIntervalSince1970: 100)))
+        store.stop(now: Date(timeIntervalSince1970: 106))
+
+        let session = try XCTUnwrap(store.sessions.first)
+        XCTAssertEqual(session.endedAtMs, 106_000)
+        XCTAssertEqual(session.events.map(\.kind), ["start", "stop"])
+
+        let reloaded = RawDataSessionStore(directory: directory)
+        XCTAssertEqual(reloaded.sessions.first, session)
+    }
+
+    func testMarkersCanBeAddedEditedDeletedAndExported() throws {
+        let store = RawDataSessionStore(directory: try temporaryDirectory())
+        let session = try XCTUnwrap(store.start(deviceId: "strap", now: Date(timeIntervalSince1970: 100)))
+        let marker = try XCTUnwrap(store.addMarker(sessionId: session.id,
+            at: Date(timeIntervalSince1970: 102), type: "issue", text: "Bluetooth off"))
+        store.updateMarker(sessionId: session.id, markerId: try XCTUnwrap(marker.markerId),
+                           at: Date(timeIntervalSince1970: 103), type: "moment", text: "Recovered")
+        store.stop(now: Date(timeIntervalSince1970: 106))
+
+        let updated = try XCTUnwrap(store.sessions.first)
+        let saved = try XCTUnwrap(updated.events.first(where: { $0.kind == "marker" }))
+        XCTAssertEqual(saved.atMs, 103_000)
+        XCTAssertEqual(saved.markerType, "moment")
+        XCTAssertEqual(saved.text, "Recovered")
+
+        let events = try XCTUnwrap(store.exportEntries(for: updated)
+            .first(where: { $0.name == "events.jsonl" }))
+        XCTAssertTrue(String(decoding: events.data, as: UTF8.self).contains("\"marker_type\":\"moment\""))
+        let meta = try XCTUnwrap(store.exportEntries(for: updated)
+            .first(where: { $0.name == "meta.json" }))
+        let object = try XCTUnwrap(JSONSerialization.jsonObject(with: meta.data) as? [String: Any])
+        let markers = try XCTUnwrap(object["markers"] as? [[String: Any]])
+        XCTAssertEqual(markers.first?["type"] as? String, "moment")
+
+        store.deleteMarker(sessionId: session.id, markerId: try XCTUnwrap(saved.markerId))
+        XCTAssertFalse(try XCTUnwrap(store.sessions.first).events.contains(where: { $0.kind == "marker" }))
+    }
+
+    func testMarkerTimeIsClampedToSession() throws {
+        let store = RawDataSessionStore(directory: try temporaryDirectory())
+        let session = try XCTUnwrap(store.start(deviceId: "strap", now: Date(timeIntervalSince1970: 100)))
+        store.stop(now: Date(timeIntervalSince1970: 110))
+        let marker = try XCTUnwrap(store.addMarker(sessionId: session.id,
+            at: Date(timeIntervalSince1970: 200), type: "end", text: ""))
+        XCTAssertEqual(marker.atMs, 110_000)
+    }
+
+    func testEditedRangeFiltersExportWithoutDestroyingMarkers() throws {
+        let store = RawDataSessionStore(directory: try temporaryDirectory())
+        let session = try XCTUnwrap(store.start(deviceId: "strap", now: Date(timeIntervalSince1970: 100)))
+        _ = store.addMarker(sessionId: session.id, at: Date(timeIntervalSince1970: 102),
+                            type: "start", text: "outside")
+        _ = store.addMarker(sessionId: session.id, at: Date(timeIntervalSince1970: 105),
+                            type: "moment", text: "inside")
+        store.stop(now: Date(timeIntervalSince1970: 110))
+        store.setRange(sessionId: session.id, from: Date(timeIntervalSince1970: 104),
+                       to: Date(timeIntervalSince1970: 108))
+
+        let edited = try XCTUnwrap(store.sessions.first)
+        XCTAssertEqual(edited.events.filter { $0.kind == "marker" }.count, 2)
+        let events = try XCTUnwrap(store.exportEntries(for: edited)
+            .first(where: { $0.name == "events.jsonl" }))
+        let text = String(decoding: events.data, as: UTF8.self)
+        XCTAssertFalse(text.contains("outside"))
+        XCTAssertTrue(text.contains("inside"))
+    }
+
+    func testExportReportsSensorAvailabilityFromAssembledPayload() throws {
+        let store = RawDataSessionStore(directory: try temporaryDirectory())
+        _ = store.start(deviceId: "strap", now: Date(timeIntervalSince1970: 100))
+        store.stop(now: Date(timeIntervalSince1970: 110))
+        let session = try XCTUnwrap(store.sessions.first)
+        let meta = try XCTUnwrap(store.exportEntries(for: session, sensorAvailable: true)
+            .first(where: { $0.name == "meta.json" }))
+        let object = try XCTUnwrap(JSONSerialization.jsonObject(with: meta.data) as? [String: Any])
+        XCTAssertEqual(object["sensor_export_available"] as? Bool, true)
+        XCTAssertFalse(store.exportEntries(for: session).contains { $0.name == "raw-frames.jsonl" })
+    }
+
+    func testFullSecondBoundsExcludePartialEndpointSeconds() {
+        let bounds = RawDataCollectorView.fullSecondBounds(fromMs: 100_001, toMs: 104_999)
+        XCTAssertEqual(bounds?.from, 101)
+        XCTAssertEqual(bounds?.to, 103)
+        XCTAssertNil(RawDataCollectorView.fullSecondBounds(fromMs: 100_001, toMs: 100_999))
+    }
+
+    func testMarkerCurrentTimeTicksOnlyForActiveSession() throws {
+        let store = RawDataSessionStore(directory: try temporaryDirectory())
+        _ = store.start(deviceId: "strap", now: Date(timeIntervalSince1970: 100))
+        let active = try XCTUnwrap(store.sessions.first)
+        XCTAssertEqual(RawDataCollectorView.markerCurrentTime(session: active,
+            now: Date(timeIntervalSince1970: 105)).timeIntervalSince1970, 105)
+        store.stop(now: Date(timeIntervalSince1970: 110))
+        let stopped = try XCTUnwrap(store.sessions.first)
+        XCTAssertEqual(RawDataCollectorView.markerCurrentTime(session: stopped,
+            now: Date(timeIntervalSince1970: 999)).timeIntervalSince1970, 110)
+    }
+
+    func testActiveSessionCannotBeDeleted() throws {
+        let store = RawDataSessionStore(directory: try temporaryDirectory())
+        let active = try XCTUnwrap(store.start(deviceId: "strap"))
+        store.removeMetadata(active.id)
+        XCTAssertEqual(store.sessions.map(\.id), [active.id])
+    }
+
+    func testLastExportTimePersists() throws {
+        let directory = try temporaryDirectory()
+        let store = RawDataSessionStore(directory: directory)
+        let session = try XCTUnwrap(store.start(deviceId: "strap"))
+        store.stop()
+        store.markExported(session.id, now: Date(timeIntervalSince1970: 123))
+
+        let restored = try XCTUnwrap(RawDataSessionStore(directory: directory).sessions.first)
+        XCTAssertTrue(restored.exported)
+        XCTAssertEqual(restored.lastExportedAtMs, 123_000)
+    }
+
+    func testCompletedSessionCanBeDeleted() throws {
+        let directory = try temporaryDirectory()
+        let store = RawDataSessionStore(directory: directory)
+        let session = try XCTUnwrap(store.start(deviceId: "strap"))
+        store.stop()
+        XCTAssertTrue(store.removeMetadata(session.id))
+        XCTAssertTrue(store.sessions.isEmpty)
+        XCTAssertTrue(RawDataSessionStore(directory: directory).sessions.isEmpty)
+    }
+
+    func testFailedSourceDeletionKeepsSessionRetryable() throws {
+        let directory = try temporaryDirectory()
+        let store = RawDataSessionStore(directory: directory)
+        let session = try XCTUnwrap(store.start(deviceId: "strap"))
+        store.stop()
+
+        XCTAssertFalse(store.removeMetadata(session.id) { _ in
+            throw CocoaError(.fileWriteNoPermission)
+        })
+        XCTAssertEqual(store.sessions.map(\.id), [session.id])
+        XCTAssertEqual(RawDataSessionStore(directory: directory).sessions.map(\.id), [session.id])
+        XCTAssertTrue(store.removeMetadata(session.id))
+    }
+}
diff --git a/StrandTests/Resources/raw_data_collector_parity.json b/StrandTests/Resources/raw_data_collector_parity.json
new file mode 100644
index 0000000000..a843cb951b
--- /dev/null
+++ b/StrandTests/Resources/raw_data_collector_parity.json
@@ -0,0 +1,69 @@
+{
+  "schema_version": 1,
+  "capabilities": {
+    "start_stop": {
+      "swift": ["startGroundTruthRawCapture", "stopGroundTruthRawCapture"],
+      "kotlin": ["startGroundTruthImuCapture", "stopGroundTruthImuCapture"]
+    },
+    "persisted_sessions": {
+      "swift": ["RawDataSessionStore", "persist(session)"],
+      "kotlin": ["GroundTruthCollector", "sessionStartKey"]
+    },
+    "session_comments": {
+      "swift": ["setComment(", "Session comment"],
+      "kotlin": ["setComment(", "ground_truth_comment"]
+    },
+    "session_markers": {
+      "swift": ["addMarker(sessionId:", "updateMarker(sessionId:", "deleteMarker(sessionId:", "Add marker"],
+      "kotlin": ["fun addMarker(", "fun updateMarker(", "fun deleteMarker(", "ground_truth_add_marker"]
+    },
+    "from_to_time": {
+      "swift": ["func range(", "endedAtMs"],
+      "kotlin": ["sessionTimeRange(", "endedAtMs"]
+    },
+    "session_export": {
+      "swift": ["exportEntries(for:", "Export session"],
+      "kotlin": ["suspend fun export(", "ground_truth_export"]
+    },
+    "historical_time_windows": {
+      "swift": ["createHistorical(deviceId:", "Historical export window"],
+      "kotlin": ["createHistoricalSession(", "ground_truth_add_historical"]
+    },
+    "editable_analysis_range": {
+      "swift": ["func setRange(sessionId:", "DatePicker(\"From\""],
+      "kotlin": ["fun setSessionRange(", "ground_truth_edit_start"]
+    },
+    "file_only_imu_storage": {
+      "swift": ["v41-drop-raw-imu-sample"],
+      "kotlin": ["MIGRATION_34_35", "DROP TABLE IF EXISTS `rawImuSample`"]
+    },
+    "session_bound_imu_file": {
+      "swift": ["ImuSessionFileStore", "segmentSeconds: Int64 = 30 * 60", "NOOPIMU2"],
+      "kotlin": ["ImuSessionFileStore", "SEGMENT_SECONDS = 30 * 60L", "NOOPIMU2"]
+    },
+    "decoded_segment_export": {
+      "swift": ["exportSegments", "imu/\\(segment.name)"],
+      "kotlin": ["exportSegments", "imu/${segment.name}"]
+    },
+    "explicit_imu_coverage": {
+      "swift": ["imu-coverage.json", "private static func covers"],
+      "kotlin": ["imu_100hz_complete", "private fun covers"]
+    },
+    "delete_one_and_all_with_confirmation": {
+      "swift": ["Delete this session?", "Delete all sessions?", "removeMetadata(session.id)"],
+      "kotlin": ["ground_truth_delete_session_title", "ground_truth_delete_all_title", "deleteAllSessions"]
+    },
+    "active_session_delete_guard": {
+      "swift": ["guard session.endedAtMs != nil else { return }", ".disabled(store.active != nil)"],
+      "kotlin": ["current.active && current.sessionId == sessionId", "sessions.none { it.active }"]
+    },
+    "bluetooth_reconnect_rearm": {
+      "swift": ["onChangeCompat(of: live.bonded)", "rawCaptureInFlight = false"],
+      "kotlin": ["LaunchedEffect(state.active, state.sessionId, live.connected)", "startGroundTruthImuCapture"]
+    },
+    "session_files_removed_with_session": {
+      "swift": ["deleteFiles(sessionId", "removeItem(metadata)"],
+      "kotlin": ["deleteFiles(sessionId)", "eventFile(sessionId).delete()"]
+    }
+  }
+}
diff --git a/android/app/src/main/java/com/noop/ble/PuffinDeepBufferLog.kt b/android/app/src/main/java/com/noop/ble/PuffinDeepBufferLog.kt
index b55f51a949..510e9de21f 100644
--- a/android/app/src/main/java/com/noop/ble/PuffinDeepBufferLog.kt
+++ b/android/app/src/main/java/com/noop/ble/PuffinDeepBufferLog.kt
@@ -11,8 +11,8 @@ import com.noop.protocol.Whoop5RawImu
  * `PuffinDeepBufferLog` (its pure, unit-testable core); the file I/O + capture-toggle gating live in
  * [WhoopBleClient.writeWhoop5DeepBufferIfBig], mirroring the existing `whoop5-events.jsonl` writer.
  *
- * On-strap probing (#423) established that the 5/MG has no live raw-IMU stream, but it DOES bank
- * high-rate motion and ships it inside big type-0x2F buffers during the connect-time offload burst —
+ * On-strap probing (#423) established that the 5/MG banks high-rate motion and can stream it live
+ * during an explicitly armed raw-data session; history also ships it in big type-0x2F offload buffers —
  * 124 B (~1 Hz record), 1244 B and 2140 B (~32 and ~59 sub-records per timestamped second). NOOP's
  * historical decoder pulls the 1 Hz gravity vector out and DISCARDS the high-rate remainder. Keeping the
  * big (>= [minBufferBytes]) type-0x2F buffers raw, in their own file, lets a byte-perfect decoder be
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index f08ac7e84b..bbb952e9a8 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -28,9 +28,9 @@ import com.noop.NoopApplication
 import com.noop.data.HrRow
 import com.noop.data.RrRow
 import com.noop.data.StreamBatch
-import com.noop.data.RawImuSampleEntity
 import com.noop.data.StreamPersistence
 import com.noop.protocol.Whoop5RawImu
+import com.noop.testcentre.ImuSessionFileStore
 import com.noop.data.WhoopRepository
 import com.noop.protocol.AlarmPayload
 import com.noop.protocol.DYN_ACCEL_STILL_THRESHOLD_G
@@ -90,6 +90,10 @@ import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.flow.update
 import kotlinx.coroutines.launch
 import java.util.UUID
+import java.io.BufferedOutputStream
+import java.io.DataOutputStream
+import java.io.File
+import java.io.FileOutputStream
 import java.util.concurrent.ConcurrentLinkedQueue
 import java.util.concurrent.atomic.AtomicInteger
 
@@ -392,6 +396,16 @@ class RealGattOps(private val gatt: BluetoothGatt) : GattOps {
         gatt.setPreferredPhy(txPhy, rxPhy, phyOptions)
 }
 
+/** Foreground ground-truth diagnostics. Kept separate from [LiveState] so production UI/state stays clean. */
+data class GroundTruthImuStatus(
+    val sessionId: String? = null,
+    val requested: Boolean = false,
+    val packets: Long = 0,
+    val bytes: Long = 0,
+    val lastPacketAtMs: Long? = null,
+    val note: String = "Not started",
+)
+
 class WhoopBleClient(
     private val context: Context,
     /**
@@ -632,6 +646,11 @@ class WhoopBleClient(
             else -> BluetoothGatt.CONNECTION_PRIORITY_BALANCED
         }
 
+        /** Bounded 100 Hz work gets HIGH independently of the global experiment. A completed capture
+         * only holds it while an offload is actively repairing missing seconds. */
+        fun rawCaptureHighPriority(captureActive: Boolean, backfilling: Boolean, needsRepair: Boolean): Boolean =
+            captureActive || (backfilling && needsRepair)
+
         /**
          * The throughput summary for one offload burst (#1007), pure so it is testable without a BLE stack.
          *
@@ -1767,6 +1786,9 @@ class WhoopBleClient(
     )
     val state: StateFlow<LiveState> = _state.asStateFlow()
 
+    private val _groundTruthImuStatus = MutableStateFlow(GroundTruthImuStatus())
+    val groundTruthImuStatus: StateFlow<GroundTruthImuStatus> = _groundTruthImuStatus.asStateFlow()
+
     /** Monotonic event for the in-memory/exportable strap log. Test Centre panels collect it only while
      * active and coalesce bursts, so a new tagged line refreshes its readout without mutating LiveState. */
     private val _logRevision = MutableStateFlow(0L)
@@ -1941,6 +1963,9 @@ class WhoopBleClient(
      *  the drop-risk is confined to when the user actually wants power saving. Set on the main looper via
      *  [setConnectionPriorityManagement]. */
     @Volatile private var connectionPriorityEnabled: Boolean = false
+    /** Android-only transport lease for bounded 100 Hz capture and delayed history repair. CoreBluetooth
+     * chooses connection parameters itself and exposes no equivalent app-side request. */
+    @Volatile private var rawCapturePriorityApplied: Boolean = false
     /** Battery-% at/below which the LOW_POWER idle throttle engages while the STRAP is discharging;
      *  0 = never (safe half only).
      *
@@ -2138,7 +2163,13 @@ class WhoopBleClient(
     /** (Re)apply the GATT connection priority for the current link state (#477). Idempotent + cheap: OFF
      *  or disconnected -> no BLE op. Called on connect-established and whenever offload / live-HR toggles. */
     private fun refreshConnectionPriority() {
-        if (!connectionPriorityEnabled) return
+        val rawCaptureHigh = connectedFamily == DeviceFamily.WHOOP5 && rawCaptureHighPriority(
+            captureActive = groundTruthImuSessionId != null,
+            backfilling = backfilling,
+            needsRepair = ImuSessionFileStore(context).needsHighThroughput(deviceId),
+        )
+        // Preserve the zero-op default path, but release a completed capture's HIGH lease once.
+        if (!connectionPriorityEnabled && !rawCaptureHigh && !rawCapturePriorityApplied) return
         val ops = gattOps ?: return
         // Only read the battery when the RISKY idle throttle is actually armed (threshold > 0); the SAFE
         // HIGH-escalation half doesn't need it, so safe-half-only mode issues no battery read.
@@ -2149,7 +2180,7 @@ class WhoopBleClient(
         // Read the authoritative INTERNAL flags (both set synchronously on this looper), not the
         // published LiveState mirror, which `exitBackfilling` may update a beat later.
         val priority = connectionPriorityFor(
-            offloadActive = backfilling,
+            offloadActive = rawCaptureHigh || (connectionPriorityEnabled && backfilling),
             // #533: gated — the live stream does NOT escalate by default. See [escalateForLiveHr]: the
             // overnight continuous-HRV window keeps this armed for hours, and a 1 Hz stream gains nothing
             // from HIGH. The offload burst below is the case that actually wants the shorter interval.
@@ -2161,6 +2192,7 @@ class WhoopBleClient(
         // binder is handled by the next real op, and skipping a priority request costs nothing. Swallow.
         try {
             ops.requestConnectionPriorityCompat(priority)
+            rawCapturePriorityApplied = rawCaptureHigh
         } catch (t: Throwable) {
             log("connection-priority request failed (${t.javaClass.simpleName}); skipped")
         }
@@ -2169,6 +2201,117 @@ class WhoopBleClient(
      *  thread (user actions) - the barrier makes a main-thread send see the current characteristic. */
     @Volatile private var cmdCharacteristic: BluetoothGattCharacteristic? = null
 
+    @Volatile private var groundTruthImuCommandAllowed = false
+    private var groundTruthImuSessionId: String? = null
+    private var groundTruthImuStoppedAtMs = 0L
+    private var unexpectedImuStopAtMs = 0L
+
+    /** Start the hardware-confirmed WHOOP 5 realtime IMU mode for an explicit ground-truth session. */
+    @Synchronized
+    fun startGroundTruthImuCapture(sessionId: String): Boolean {
+        if (gatt == null || cmdCharacteristic == null) {
+            _groundTruthImuStatus.value = GroundTruthImuStatus(
+                sessionId = sessionId,
+                note = "Band not connected / command channel not ready",
+            )
+            return false
+        }
+        if (connectedFamily != DeviceFamily.WHOOP5) {
+            _groundTruthImuStatus.value = GroundTruthImuStatus(
+                sessionId = sessionId,
+                note = "Realtime IMU unsupported for connected family: $connectedFamily",
+            )
+            return false
+        }
+        groundTruthImuSessionId = sessionId
+        groundTruthImuStoppedAtMs = 0L
+        groundTruthImuCommandAllowed = true
+        refreshConnectionPriority()
+        try {
+            // The verified bounded raw-capture sequence is START_RAW_DATA followed by the
+            // realtime IMU selector. Opcode 106 alone ACKs but does not start the producer.
+            send(CommandNumber.START_RAW_DATA, byteArrayOf(1), withResponse = true)
+            send(CommandNumber.TOGGLE_IMU_MODE, byteArrayOf(1, 1), withResponse = true)
+        } finally {
+            groundTruthImuCommandAllowed = false
+        }
+        log("Ground-truth realtime IMU requested ON (session=$sessionId)")
+        _groundTruthImuStatus.update { it.copy(requested = true, note = "IMU requested; waiting for packets") }
+        return true
+    }
+
+    /** Stop the realtime IMU before closing its lossless length-prefixed frame file. */
+    @Synchronized
+    fun stopGroundTruthImuCapture() {
+        if (connectedFamily == DeviceFamily.WHOOP5 && gatt != null && cmdCharacteristic != null) {
+            groundTruthImuCommandAllowed = true
+            try {
+                send(CommandNumber.STOP_RAW_DATA, byteArrayOf(1), withResponse = true)
+                send(CommandNumber.TOGGLE_IMU_MODE, byteArrayOf(1, 0), withResponse = true)
+            } finally {
+                groundTruthImuCommandAllowed = false
+            }
+        }
+        log("Ground-truth realtime IMU requested OFF (session=${groundTruthImuSessionId ?: "none"})")
+        groundTruthImuSessionId = null
+        groundTruthImuStoppedAtMs = System.currentTimeMillis()
+        _groundTruthImuStatus.update { it.copy(requested = false, note = "Stopped; accepting history repair") }
+        // The collector closes its window before this call. A running history repair keeps HIGH;
+        // otherwise release now and let the next offload acquire a fresh bounded lease.
+        refreshConnectionPriority()
+    }
+
+    @Synchronized
+    fun finishGroundTruthImuCapture(sessionId: String) {
+        if (groundTruthImuSessionId == sessionId) groundTruthImuSessionId = null
+    }
+
+    @Synchronized
+    private fun recordGroundTruthImuFrame(frame: ByteArray) {
+        if (frame.size <= 8) return
+        val packetType = frame[8].toInt() and 0xFF
+        // Decode, not the transport packet type, is authoritative: history replay can wrap the same
+        // 100 Hz payload differently from realtime delivery.
+        runCatching {
+            val routed = ImuSessionFileStore(context).append(deviceId, frame)
+            if (routed > 0) {
+                val now = System.currentTimeMillis()
+                _groundTruthImuStatus.update {
+                    it.copy(
+                        packets = it.packets + 1,
+                        bytes = it.bytes + frame.size,
+                        lastPacketAtMs = now,
+                        note = "Receiving IMU packet type $packetType",
+                    )
+                }
+            }
+        }.onFailure {
+            log("Ground-truth IMU append failed (${it.javaClass.simpleName})")
+            _groundTruthImuStatus.update { status -> status.copy(note = "Write failed: ${it.javaClass.simpleName}") }
+        }
+    }
+
+    /** Fail-safe for a producer left armed by a crash, another client, or a lost stop write. */
+    @Synchronized
+    private fun stopUnexpectedRealtimeImu(frame: ByteArray, replayedOffload: Boolean) {
+        if (connectedFamily != DeviceFamily.WHOOP5 || replayedOffload || frame.size <= 8) return
+        val type = frame[8].toInt() and 0xFF
+        if (type != 43 && type != 51) return
+        if (groundTruthImuSessionId != null || PuffinExperiment.from(context).isCaptureEnabled) return
+        val now = System.currentTimeMillis()
+        if (now - groundTruthImuStoppedAtMs < 3_000L || now - unexpectedImuStopAtMs < 30_000L) return
+        if (gatt == null || cmdCharacteristic == null) return
+        unexpectedImuStopAtMs = now
+        groundTruthImuCommandAllowed = true
+        try {
+            send(CommandNumber.STOP_RAW_DATA, byteArrayOf(1), withResponse = true)
+            send(CommandNumber.TOGGLE_IMU_MODE, byteArrayOf(1, 0), withResponse = true)
+        } finally {
+            groundTruthImuCommandAllowed = false
+        }
+        log("Raw IMU fail-safe: unexpected realtime packet type $type while capture was off; stop requested")
+    }
+
     /** Frame reassembler for the fragmented custom notify chars (port of Reassembler). Reassigned per
      *  connection with the detected family — WHOOP5/MG frames use a different length encoding. */
     private var reassembler = Reassembler()
@@ -3459,7 +3602,13 @@ class WhoopBleClient(
             // 5/MG allow-list: live HR, buzz, and the historical-offload pair (trigger + ack). The
             // offload commands ride the SAME proven puffin COMMAND frame as the Swift path
             // (whoop5HistoricalAckFrame = puffinCommandFrame(23, [0x01]+endData)). (#78)
-            if (cmd != CommandNumber.TOGGLE_REALTIME_HR && cmd != CommandNumber.RUN_HAPTICS_PATTERN &&
+            if (cmd != CommandNumber.TOGGLE_REALTIME_HR &&
+                !(cmd in setOf(
+                    CommandNumber.START_RAW_DATA,
+                    CommandNumber.STOP_RAW_DATA,
+                    CommandNumber.TOGGLE_IMU_MODE,
+                ) && groundTruthImuCommandAllowed) &&
+                cmd != CommandNumber.RUN_HAPTICS_PATTERN &&
                 cmd != CommandNumber.SEND_HISTORICAL_DATA && cmd != CommandNumber.HISTORICAL_DATA_RESULT &&
                 // ABORT_HISTORICAL_TRANSMITS (20) over puffin: stop an offload already in flight. Allowed
                 // ONLY while one actually is, so a default install can never form these bytes on a 5/MG —
@@ -5977,12 +6126,14 @@ class WhoopBleClient(
                     // handleFrame's replayedOffload gate, so evaluating it twice bounds-checked + indexed
                     // every offloaded frame for nothing. (The Swift 5/MG inbound loop already hoists this.)
                     val offloadFrame = backfilling && isOffloadFrame(frame, connectedFamily)
+                    stopUnexpectedRealtimeImu(frame, offloadFrame)
                     noteWhoop5R22Telemetry(frame, offloadFrame)  // #174
                     // #47: decode this frame ONCE and thread it to both consumers (the router below and the
                     // live collector) instead of each re-parsing it — steady-state drops 2→1 parse per live
                     // frame. Family-aware, so it's correct for WHOOP4 and 5/MG alike.
                     val parsed = Framing.parseFrame(frame, connectedFamily)
                     // A frame replayed as part of the historical offload (type 47/48/… during a backfill)
+                    recordGroundTruthImuFrame(frame)
                     // must not drive LIVE-only state (the charging pill). (PR #568 reimpl)
                     //
                     // NOT the same shape as iOS, despite what this said before. THIS side calls the handler
@@ -6166,7 +6317,6 @@ class WhoopBleClient(
                         // BEFORE the offload branch so it catches the burst; no-op unless capture is on.
                         writeWhoop5DeepBufferIfBig(uuid.toString(), frame, isOffloadFrame(frame, connectedFamily))
                         // #423: the queryable twin of that diagnostics line — persist the decoded IMU
-                        // samples (100 Hz 6-axis) into the rawImuSample table when raw capture is on.
                         storeWhoop5RawImuIfBuffer(frame)
                     }
                     // Opt-in raw capture: record EVERY frame of the session (offload AND live flood —
@@ -9320,27 +9470,19 @@ class WhoopBleClient(
      * one previous generation. Cheap for every other frame: a length + single-byte compare BEFORE the
      * pref read; no-op unless the capture toggle is on.
      */
-    /** #423: persist the WHOOP 5/MG raw-IMU offload buffer NOOP already decodes for the deep-buffer log —
-     *  the queryable twin of that (table-less) diagnostics line. Same `isCaptureEnabled` gate; only the
-     *  1244-B 6-axis buffer decodes (rawColumns null otherwise). IO-dispatched so it never blocks the GATT
-     *  thread; bounded by a rolling retention prune. Raw i16, no downstream consumer yet (instrument-first). */
+    /** Debug heartbeat for valid WHOOP 5/MG raw-IMU buffers. Session persistence is file-only. */
     private fun storeWhoop5RawImuIfBuffer(frame: ByteArray) {
+        // This compatibility cache keeps its original opt-in gate. Bounded sessions are file-backed.
         if (!PuffinExperiment.from(context).isCaptureEnabled) return
         val cols = Whoop5RawImu.rawColumns(frame) ?: return
         val baseTs = PuffinDeepBufferLog.strapTs(frame)?.toLong() ?: return
-        val dev = deviceId
         // #423 debug heartbeat: confirm the offload IMU is arriving + decoding on-device without pulling the
         // JSONL. Throttled (first buffer, then every 500) so a large offload can't flood the strap log; the
         // count is a per-connection running total. Off unless raw capture is enabled (gated above).
         rawImuDecodedCount++
         if (rawImuDecodedCount == 1 || rawImuDecodedCount % 500 == 0) {
             log("RAW IMU capture: $rawImuDecodedCount buffer(s) decoded, latest ts=$baseTs " +
-                "(${cols.size / 6} samples/axis) — storing (retain ${WhoopRepository.RAW_IMU_RETENTION_ROWS})")
-        }
-        val row = RawImuSampleEntity(dev, baseTs, StreamPersistence.packImuColumns(cols))
-        ioScope.launch {
-            runCatching { repository.insertRawImu(dev, listOf(row)) }
-                .onFailure { log("RAW IMU capture: store failed (${it.message})") }
+                "(${cols.size / 6} samples/axis) — routed to matching file sessions")
         }
     }
 
diff --git a/android/app/src/main/java/com/noop/data/DeviceRegistry.kt b/android/app/src/main/java/com/noop/data/DeviceRegistry.kt
index 22ec1f9cf2..4343190d1e 100644
--- a/android/app/src/main/java/com/noop/data/DeviceRegistry.kt
+++ b/android/app/src/main/java/com/noop/data/DeviceRegistry.kt
@@ -98,7 +98,6 @@ class DeviceRegistry(
             dao.reKeySteps(activeId, serialId); dao.deleteStepsFor(activeId)
             dao.reKeyPpgHr(activeId, serialId); dao.deletePpgHrFor(activeId)
             dao.reKeyPpgWaveform(activeId, serialId); dao.deletePpgWaveformFor(activeId)
-            dao.reKeyRawImu(activeId, serialId); dao.deleteRawImuFor(activeId)
             dao.reKeyV18Aux(activeId, serialId); dao.deleteV18AuxFor(activeId)
             dao.reKeyEvents(activeId, serialId); dao.deleteEventsFor(activeId)
             dao.reKeyBattery(activeId, serialId); dao.deleteBatteryFor(activeId)
@@ -188,7 +187,6 @@ class DeviceRegistry(
             dao.deleteStepsFor(id)
             dao.deletePpgHrFor(id)
             dao.deletePpgWaveformFor(id)
-            dao.deleteRawImuFor(id)   // #423
             dao.deleteV18AuxFor(id)
             dao.deleteEventsFor(id)
             dao.deleteBatteryFor(id)
diff --git a/android/app/src/main/java/com/noop/data/DeviceRegistryDao.kt b/android/app/src/main/java/com/noop/data/DeviceRegistryDao.kt
index 7275f2839d..099edec1b6 100644
--- a/android/app/src/main/java/com/noop/data/DeviceRegistryDao.kt
+++ b/android/app/src/main/java/com/noop/data/DeviceRegistryDao.kt
@@ -85,7 +85,6 @@ interface DeviceRegistryDao {
     @Query("DELETE FROM stepSample WHERE deviceId = :deviceId") suspend fun deleteStepsFor(deviceId: String)
     @Query("DELETE FROM ppgHrSample WHERE deviceId = :deviceId") suspend fun deletePpgHrFor(deviceId: String)
     @Query("DELETE FROM ppgWaveformSample WHERE deviceId = :deviceId") suspend fun deletePpgWaveformFor(deviceId: String)
-    @Query("DELETE FROM rawImuSample WHERE deviceId = :deviceId") suspend fun deleteRawImuFor(deviceId: String)   // #423
     @Query("DELETE FROM v18AuxSample WHERE deviceId = :deviceId") suspend fun deleteV18AuxFor(deviceId: String)
     @Query("DELETE FROM event WHERE deviceId = :deviceId") suspend fun deleteEventsFor(deviceId: String)
     @Query("DELETE FROM battery WHERE deviceId = :deviceId") suspend fun deleteBatteryFor(deviceId: String)
@@ -126,7 +125,6 @@ interface DeviceRegistryDao {
     @Query("UPDATE OR IGNORE stepSample SET deviceId = :to WHERE deviceId = :from") suspend fun reKeySteps(from: String, to: String)
     @Query("UPDATE OR IGNORE ppgHrSample SET deviceId = :to WHERE deviceId = :from") suspend fun reKeyPpgHr(from: String, to: String)
     @Query("UPDATE OR IGNORE ppgWaveformSample SET deviceId = :to WHERE deviceId = :from") suspend fun reKeyPpgWaveform(from: String, to: String)
-    @Query("UPDATE OR IGNORE rawImuSample SET deviceId = :to WHERE deviceId = :from") suspend fun reKeyRawImu(from: String, to: String)
     @Query("UPDATE OR IGNORE v18AuxSample SET deviceId = :to WHERE deviceId = :from") suspend fun reKeyV18Aux(from: String, to: String)
     @Query("UPDATE OR IGNORE event SET deviceId = :to WHERE deviceId = :from") suspend fun reKeyEvents(from: String, to: String)
     @Query("UPDATE OR IGNORE battery SET deviceId = :to WHERE deviceId = :from") suspend fun reKeyBattery(from: String, to: String)
diff --git a/android/app/src/main/java/com/noop/data/Entities.kt b/android/app/src/main/java/com/noop/data/Entities.kt
index cbfa83259d..9e4bcfad05 100644
--- a/android/app/src/main/java/com/noop/data/Entities.kt
+++ b/android/app/src/main/java/com/noop/data/Entities.kt
@@ -3,6 +3,7 @@ package com.noop.data
 import androidx.room.ColumnInfo
 import androidx.room.Entity
 import androidx.room.Index
+import androidx.room.PrimaryKey
 
 /*
  * Room entities mirroring the verified GRDB schema in
@@ -662,42 +663,6 @@ data class PpgWaveformSampleEntity(
     }
 }
 
-/**
- * One 1-second WHOOP 5/MG raw-IMU offload buffer (#423): 100 Hz 6-axis inertial data. [samples] is a
- * packed little-endian i16 BLOB of the six columns in wire order — ax×100, ay×100, az×100, gx×100, gy×100,
- * gz×100 (1200 bytes) — decoded by [com.noop.protocol.Whoop5RawImu] (scales 1/4096 g/LSB, 2000/32768 dps/
- * LSB). The strap already delivers this in the connect-time offload burst; capturing it needs NO arming.
- * Instrument-first + bounded: written only when raw capture is enabled, and pruned to a rolling recent
- * window ([WhoopRepository.RAW_IMU_RETENTION_ROWS]). Twin of the GRDB `rawImuSample` table. Natural key
- * (deviceId, ts) = one row per strap-second.
- *
- * CONSUMER STATUS (#978): deliberately none yet — instrument-first, the same stance as `v18AuxSample`. The
- * writer runs only with raw capture enabled + a 5/MG deep-data unlock; nothing scores, gates or shows a row.
- * The [WhoopRepository.rawImuSamples] / [WhoopDao.rawImuSamples] reader is intentionally dormant (zero
- * callers) — the eventual cross-check seam, NOT dead code, so do not delete it. The GRDB twin has no reader
- * yet by the same rule: one lands WITH a validated consumer, not before.
- */
-@Entity(tableName = "rawImuSample", primaryKeys = ["deviceId", "ts"])
-data class RawImuSampleEntity(
-    val deviceId: String,
-    val ts: Long,
-    val samples: ByteArray,
-) {
-    // ByteArray needs structural equals/hashCode (the generated identity ones break round-trip asserts).
-    override fun equals(other: Any?): Boolean {
-        if (this === other) return true
-        if (other !is RawImuSampleEntity) return false
-        return deviceId == other.deviceId && ts == other.ts && samples.contentEquals(other.samples)
-    }
-
-    override fun hashCode(): Int {
-        var result = deviceId.hashCode()
-        result = 31 * result + ts.hashCode()
-        result = 31 * result + samples.contentHashCode()
-        return result
-    }
-}
-
 /**
  * One Live Session (silent guardian) record (v22 / MIGRATION_15_16). Natural key (deviceId, startTs).
  * `endTs` is null while the session is still in progress. Fields are declared in the SAME order as the
diff --git a/android/app/src/main/java/com/noop/data/WhoopDao.kt b/android/app/src/main/java/com/noop/data/WhoopDao.kt
index 818d9f7cfd..6579a8634b 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDao.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDao.kt
@@ -124,10 +124,6 @@ interface WhoopDao : DeviceRegistryDao {
     @Insert(onConflict = OnConflictStrategy.IGNORE)
     suspend fun insertPpgWaveform(rows: List<PpgWaveformSampleEntity>): List<Long>
 
-    /** RAW 5/MG IMU offload buffers (packed i16 BLOB). Idempotent by (deviceId, ts). (#423) */
-    @Insert(onConflict = OnConflictStrategy.IGNORE)
-    suspend fun insertRawImu(rows: List<RawImuSampleEntity>): List<Long>
-
     /**
      * The remaining 5/MG v18 per-second fields, one compact blob per strap-second. Idempotent by
      * (deviceId, ts) — IGNORE keeps the FIRST-seen row, matching every other per-second stream, so a
@@ -147,22 +143,6 @@ interface WhoopDao : DeviceRegistryDao {
     )
     suspend fun pruneV18Aux(deviceId: String, keep: Int)
 
-    /** Bound the raw-IMU table to the newest [keep] rows for [deviceId] (rolling retention, #423). */
-    @Query(
-        "DELETE FROM rawImuSample WHERE deviceId = :deviceId AND ts < " +
-            "(SELECT MIN(ts) FROM (SELECT ts FROM rawImuSample WHERE deviceId = :deviceId ORDER BY ts DESC LIMIT :keep))"
-    )
-    suspend fun pruneRawImu(deviceId: String, keep: Int)
-
-    /** RAW 5/MG IMU buffers in [from, to] (ascending), packed i16 BLOB. (#423)
-     *  Intentionally dormant — zero callers, retained for the eventual cross-check (see [RawImuSampleEntity]
-     *  CONSUMER STATUS, #978). Not dead code; do not delete. */
-    @Query(
-        "SELECT * FROM rawImuSample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to " +
-            "ORDER BY ts ASC LIMIT :limit"
-    )
-    suspend fun rawImuSamples(deviceId: String, from: Long, to: Long, limit: Int): List<RawImuSampleEntity>
-
     // MARK: - Server-derived caches (latest value wins)
 
     @Upsert
@@ -960,7 +940,6 @@ interface WhoopDao : DeviceRegistryDao {
     @Query("SELECT COUNT(*) FROM ppgHrSample") suspend fun countPpgHr(): Int
     @Query("SELECT COUNT(*) FROM sleepStateSample") suspend fun countSleepState(): Int
     @Query("SELECT COUNT(*) FROM ppgWaveformSample") suspend fun countPpgWaveform(): Int
-    @Query("SELECT COUNT(*) FROM rawImuSample") suspend fun countRawImu(): Int
     @Query("SELECT COUNT(*) FROM v18AuxSample") suspend fun countV18Aux(): Int
     @Query("SELECT COUNT(*) FROM respSample") suspend fun countResp(): Int
     @Query("SELECT COUNT(*) FROM gravitySample") suspend fun countGravity(): Int
@@ -1023,8 +1002,6 @@ interface WhoopDao : DeviceRegistryDao {
     @Query("DELETE FROM ppgWaveformSample WHERE ts < :minTs OR ts > :maxTs")
     suspend fun prunePpgWaveformByTs(minTs: Long, maxTs: Long): Int
 
-    @Query("DELETE FROM rawImuSample WHERE ts < :minTs OR ts > :maxTs")
-    suspend fun pruneRawImuByTs(minTs: Long, maxTs: Long): Int
 
     @Query("DELETE FROM v18AuxSample WHERE ts < :minTs OR ts > :maxTs")
     suspend fun pruneV18AuxByTs(minTs: Long, maxTs: Long): Int
diff --git a/android/app/src/main/java/com/noop/data/WhoopDatabase.kt b/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
index 895f4bfc35..0792761b26 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
@@ -50,7 +50,6 @@ import androidx.sqlite.db.SupportSQLiteDatabase
         LabMarkerRow::class,
         LiveSessionRow::class,
         PpgWaveformSampleEntity::class,
-        RawImuSampleEntity::class,
         V18AuxSampleEntity::class,
         AppleStepHour::class,
     ],
@@ -74,7 +73,7 @@ abstract class WhoopDatabase : RoomDatabase() {
         const val DB_NAME = "noop_whoop.db"
         /** Room schema version — MUST equal the `@Database(version = …)` above. Surfaced in the backup
          *  manifest (#1410) so an export states its schema. Bump both together on a migration. */
-        const val SCHEMA_VERSION = 34
+        const val SCHEMA_VERSION = 35
 
         @Volatile
         private var instance: WhoopDatabase? = null
@@ -571,9 +570,8 @@ abstract class WhoopDatabase : RoomDatabase() {
             }
         }
 
-        /** #423: the WHOOP 5/MG raw-IMU offload-capture table. Additive; GRDB twin is `v28-raw-imu`
-         *  (Swift's next slot after v27-ppg-waveform), so the migration COUNTS stay aligned. Column order ==
-         *  [RawImuSampleEntity] field order, matching the GRDB schema's t.column(deviceId/ts/samples). */
+        /** Historical #423 rolling cache. Its bounded, write-only rows are retired by MIGRATION_34_35
+         *  after session-owned IMU moves to the file-backed store. */
         internal val RAW_IMU_MIGRATION_SQL: List<String> = listOf(
             "CREATE TABLE IF NOT EXISTS `rawImuSample` (`deviceId` TEXT NOT NULL, " +
                 "`ts` INTEGER NOT NULL, `samples` BLOB NOT NULL, PRIMARY KEY(`deviceId`, `ts`))",
@@ -925,6 +923,10 @@ abstract class WhoopDatabase : RoomDatabase() {
             }
         }
 
+        internal val MIGRATION_34_35 = object : Migration(34, 35) {
+            override fun migrate(db: SupportSQLiteDatabase) { db.execSQL("DROP TABLE IF EXISTS `rawImuSample`") }
+        }
+
         /**
          * Every migration the builder registers, as a VALUE rather than an argument list.
          *
@@ -950,7 +952,7 @@ abstract class WhoopDatabase : RoomDatabase() {
             MIGRATION_18_19, MIGRATION_19_20, MIGRATION_20_21, MIGRATION_21_22,
             MIGRATION_22_23, MIGRATION_23_24, MIGRATION_24_25, MIGRATION_25_26,
             MIGRATION_26_27, MIGRATION_27_28, MIGRATION_28_29, MIGRATION_29_30,
-            MIGRATION_30_31, MIGRATION_31_32, MIGRATION_32_33, MIGRATION_33_34,
+            MIGRATION_30_31, MIGRATION_31_32, MIGRATION_32_33, MIGRATION_33_34, MIGRATION_34_35,
         )
 
 
diff --git a/android/app/src/main/java/com/noop/data/WhoopRepository.kt b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
index 0d7ae4dea2..d139591ffb 100644
--- a/android/app/src/main/java/com/noop/data/WhoopRepository.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
@@ -561,9 +561,8 @@ class WhoopRepository(
             }
             if (rows.isNotEmpty()) {
                 dao.insertV18Aux(rows)
-                // Rolling retention (the insertRawImu shape, #423) but AMORTISED. The delete finds the
-                // Nth-newest row by rank, so it walks up to [V18_AUX_RETENTION_ROWS] index entries;
-                // insertRawImu keeps 3,600 so that is free, this keeps 604,800 and an offload inserts once
+                // Rolling retention is amortised. The delete finds the Nth-newest row by rank, so it walks up
+                // to [V18_AUX_RETENTION_ROWS] index entries; this keeps 604,800 and an offload inserts once
                 // per chunk. Swept once per [V18_AUX_PRUNE_EVERY_ROWS] rows instead, which keeps
                 // newest-N-rows exactly (a time window would not — a sporadically-worn strap's rows span
                 // far more than a week, and the census wants that). Counter is per device because the
@@ -795,7 +794,6 @@ class WhoopRepository(
         // The instrumentation streams, missing from this list since they landed (see the DAO note).
         deleted += dao.pruneSleepStateByTs(minTs, maxTs)
         deleted += dao.prunePpgWaveformByTs(minTs, maxTs)
-        deleted += dao.pruneRawImuByTs(minTs, maxTs)
         deleted += dao.pruneV18AuxByTs(minTs, maxTs)
         deleted += dao.pruneEventByTs(minTs, maxTs)
         deleted += dao.pruneBatteryByTs(minTs, maxTs)
@@ -1015,22 +1013,6 @@ class WhoopRepository(
         dao.v18AuxSamples(deviceId, from, to, limit)
             .map { V18AuxCodec.unpack(it.fields, it.ts) }
 
-    /** #423: persist a batch of decoded 5/MG raw-IMU offload buffers (one row per strap-second, packed i16
-     *  BLOB), then bound the table to the newest [RAW_IMU_RETENTION_ROWS] for the device. Comes from the
-     *  deep-buffer capture seam, not the normal stream path, so it inserts directly (idempotent by ts). */
-    suspend fun insertRawImu(deviceId: String, rows: List<RawImuSampleEntity>) {
-        if (rows.isEmpty()) return
-        dao.insertRawImu(rows)
-        dao.pruneRawImu(deviceId, RAW_IMU_RETENTION_ROWS)
-    }
-
-    /** #423: raw 5/MG IMU buffers in [from, to] as the decoded i16 columns [ax…az,gx…gz] (100/axis).
-     *  Intentionally dormant — zero callers, retained for the eventual cross-check (see [RawImuSampleEntity]
-     *  CONSUMER STATUS, #978). Not dead code; do not delete. */
-    suspend fun rawImuSamples(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT):
-        List<Pair<Long, ShortArray>> =
-        dao.rawImuSamples(deviceId, from, to, limit)
-            .map { it.ts to StreamPersistence.unpackImuColumns(it.samples) }
 
     /** Downsampled HR (mean bpm per [bucketSeconds]) for the strap, for the Today 24h trend chart. */
     suspend fun hrBucketsForDevice(deviceId: String, from: Long, to: Long, bucketSeconds: Long = 300L) =
@@ -1618,9 +1600,9 @@ class WhoopRepository(
             "resp" to dao.countResp(), "gravity" to dao.countGravity(),
             // The rest of the accumulating decoded raw streams, so the Test-Centre footprint counts ALL of
             // them (keep in sync with Swift storageStats / TimestampHeal's raw-table list). ppgHr/ppgWaveform
-            // /rawImu can each be large.
+            // /v18Aux can each be large.
             "ppgHr" to dao.countPpgHr(), "sleepState" to dao.countSleepState(),
-            "ppgWaveform" to dao.countPpgWaveform(), "rawImu" to dao.countRawImu(),
+            "ppgWaveform" to dao.countPpgWaveform(),
             "v18Aux" to dao.countV18Aux(),
         )
     }.getOrDefault(emptyMap())
@@ -2029,16 +2011,10 @@ class WhoopRepository(
         /** Default row cap on range reads. Matches the Swift call sites' bounded scans. */
         const val DEFAULT_LIMIT = 100_000
 
-        /** #423: rolling retention for the raw-IMU capture table (1 row/strap-second, ~1.2 KB each). One
-         *  hour ≈ 3600 rows ≈ 4 MB caps the table hard, so an enabled capture can never balloon the DB
-         *  during a multi-day offload replay. Instrument-first bounded window; nothing consumes it yet. */
-        const val RAW_IMU_RETENTION_ROWS = 3600
-
         /**
          * v31: rolling retention for the v18 aux-slot table (Swift twin `WhoopStore.v18AuxRetentionRows`).
          *
-         * [RAW_IMU_RETENTION_ROWS] is the closest precedent — raw instrumentation banked as a blob, capped
-         * rather than unbounded — and the same reasoning applies: nothing reads these rows yet, so a cap
+         * Raw instrumentation is capped rather than unbounded. Nothing reads these rows yet, so a cap
          * is far cheaper to RELAX later than to impose once users have a year of history. Unbounded, this
          * table is the one genuinely new source of row growth in v31; the four named columns only WIDEN
          * rows that were already being written (~14 B on a gravity/skinTemp/sleepState row that exists
diff --git a/android/app/src/main/java/com/noop/ingest/RawSensorExport.kt b/android/app/src/main/java/com/noop/ingest/RawSensorExport.kt
index df5881b4f6..9ad766e874 100644
--- a/android/app/src/main/java/com/noop/ingest/RawSensorExport.kt
+++ b/android/app/src/main/java/com/noop/ingest/RawSensorExport.kt
@@ -66,6 +66,8 @@ object RawSensorExport {
         to: Long,
         limit: Int = 200_000,
     ): Map<String, Int> {
+        out.write(HEADER); out.write("\n")
+        if (from > to) return emptyMap()
         // index: 0 hr_bpm,1 rr_ms,2 grav_x,3 grav_y,4 grav_z,5 step_counter,6 ppg_bpm,7 ppg_conf,
         //        8 spo2_red,9 spo2_ir,10 skintemp_raw,11 resp_raw,12 band_sleep_state,13 event_kind,14 event_payload
         val rows = ArrayList<LineRow>()
@@ -118,7 +120,6 @@ object RawSensorExport {
 
         // Stable sort by ts asc (a stream's intra-ts order is its query's secondary key).
         rows.sortBy { it.ts }
-        out.write(HEADER); out.write("\n")
         for (r in rows) { out.write(r.line); out.write("\n") }
         return counts
     }
diff --git a/android/app/src/main/java/com/noop/protocol/Enums.kt b/android/app/src/main/java/com/noop/protocol/Enums.kt
index 0e9ef0117c..0339d3b122 100644
--- a/android/app/src/main/java/com/noop/protocol/Enums.kt
+++ b/android/app/src/main/java/com/noop/protocol/Enums.kt
@@ -215,6 +215,10 @@ enum class CommandNumber(val rawValue: Int) {
     SET_DEVICE_CONFIG(119),
     START_RAW_DATA(81),
     STOP_RAW_DATA(82),
+    // WHOOP 5/MG realtime 6-axis IMU. The production WHOOP app sends revision 1 plus an enabled
+    // byte while a Strength Builder workout is active (hardware-captured on a normal WHOOP 5).
+    // NOOP exposes this only through the explicitly user-started Ground Truth collector.
+    TOGGLE_IMU_MODE(106),
     // GET_EXTENDED_BATTERY_INFO (98) — read-only extended battery read (mV etc.). The NUMBER is disputed
     // (#592): an independent APK decompile reads this family 11 lower (87), while whoomp's table says 98 —
     // partially supported by a real WHOOP 5 (fw 50.38.1.0) ANSWERING 98, though with a short stub that
diff --git a/android/app/src/main/java/com/noop/protocol/Whoop5RawImu.kt b/android/app/src/main/java/com/noop/protocol/Whoop5RawImu.kt
index 16d9b05766..7348577004 100644
--- a/android/app/src/main/java/com/noop/protocol/Whoop5RawImu.kt
+++ b/android/app/src/main/java/com/noop/protocol/Whoop5RawImu.kt
@@ -9,9 +9,9 @@ package com.noop.protocol
 // app captures (Asherlc/dofek docs/whoop-ble-protocol.md type-0x2B raw packet) and the same columnar
 // convention as the 4.0's 1917 REALTIME_RAW_DATA variant.
 //
-// IMPORTANT: the 5/MG's *live* raw-IMU stream is firmware-refused (TOGGLE_IMU_MODE / cmd 106 acks but
-// never streams), but the OFFLOAD buffer carries full accel AND gyro — so 100 Hz 6-axis IMU IS
-// obtainable on the 5.0 via the historical path.
+// Hardware validation on a WHOOP 5/MG established that live raw IMU requires START_RAW_DATA (81)
+// followed by TOGGLE_IMU_MODE (106) with payload [1,1]. Opcode 106 on its own acknowledges without
+// starting the producer. The same 1244-byte shape is also banked and later returned by history sync.
 //
 // Frame layout (reassembled BLE frame = 8-byte puffin envelope + payload; offsets are FRAME-absolute):
 //   @15  u32 LE   strap unix seconds for this 1-second frame
diff --git a/android/app/src/main/java/com/noop/testcentre/GroundTruthCollector.kt b/android/app/src/main/java/com/noop/testcentre/GroundTruthCollector.kt
new file mode 100644
index 0000000000..e89ff34a20
--- /dev/null
+++ b/android/app/src/main/java/com/noop/testcentre/GroundTruthCollector.kt
@@ -0,0 +1,475 @@
+package com.noop.testcentre
+
+import android.content.Context
+import android.content.Intent
+import android.os.Build
+import androidx.core.content.FileProvider
+import com.noop.BuildConfig
+import com.noop.data.WhoopRepository
+import com.noop.ingest.RawSensorExport
+import com.noop.protocol.Whoop5RawImu
+import java.io.File
+import java.util.zip.ZipEntry
+import java.util.zip.ZipOutputStream
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import org.json.JSONObject
+import java.util.UUID
+
+/** App-private, explicitly user-started bounded 5/MG raw-data capture with annotations. */
+class GroundTruthCollector private constructor(private val context: Context) {
+    data class Snapshot(
+        val active: Boolean,
+        val sessionId: String?,
+        val deviceId: String?,
+        val startedAtMs: Long,
+        val endedAtMs: Long,
+        val exported: Boolean,
+    )
+
+    data class SessionSummary(
+        val id: String,
+        val deviceId: String?,
+        val startedAtMs: Long,
+        val endedAtMs: Long?,
+        val capturedStartedAtMs: Long?,
+        val capturedEndedAtMs: Long?,
+        val comment: String,
+        val active: Boolean,
+        val exported: Boolean,
+        val lastExportedAtMs: Long?,
+        val markers: List<Marker>,
+    )
+
+    data class Marker(val id: String, val atMs: Long, val type: String, val text: String)
+    data class CaptureStats(
+        val bytes: Long,
+        val coveredSeconds: Int,
+        val expectedSeconds: Int,
+        val startupSeconds: Int,
+    ) {
+        val missingSeconds get() = (expectedSeconds - coveredSeconds).coerceAtLeast(0)
+        val complete get() = expectedSeconds > 0 && missingSeconds == 0
+    }
+
+    private val prefs = context.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+    private val directory = File(context.filesDir, "ground-truth").apply { mkdirs() }
+
+    fun captureStats(session: SessionSummary, nowMs: Long = System.currentTimeMillis()): CaptureStats {
+        val end = session.endedAtMs ?: nowMs
+        val baseFrom = ceilSecond(session.startedAtMs)
+        val to = end / 1_000L - 1L
+        val raw = ImuSessionFileStore(context).stats(session.id, baseFrom, to)
+        val first = raw.firstTs?.takeIf { it <= baseFrom + 1 }
+        val from = if (session.capturedStartedAtMs != null) maxOf(baseFrom, first ?: baseFrom) else baseFrom
+        val adjusted = if (from == baseFrom) raw.coveredSeconds else
+            ImuSessionFileStore(context).stats(session.id, from, to).coveredSeconds
+        return CaptureStats(raw.bytes, adjusted, (to - from + 1).coerceAtLeast(0).toInt(),
+            (from - baseFrom).coerceAtLeast(0).toInt())
+    }
+
+    @Synchronized
+    fun snapshot(): Snapshot = Snapshot(
+        active = prefs.getBoolean("active", false),
+        sessionId = prefs.getString("sessionId", null),
+        deviceId = prefs.getString("deviceId", null),
+        startedAtMs = prefs.getLong("startedAtMs", 0L),
+        endedAtMs = prefs.getLong("endedAtMs", 0L),
+        exported = prefs.getBoolean("exported", false),
+    )
+
+    @Synchronized
+    fun start(deviceId: String, nowMs: Long = System.currentTimeMillis()): Snapshot {
+        val id = nowMs.toString()
+        prefs.edit()
+            .putBoolean("active", true)
+            .putBoolean("exported", false)
+            .putString("sessionId", id)
+            .putString("deviceId", deviceId)
+            .putLong("startedAtMs", nowMs)
+            .putString(sessionDeviceKey(id), deviceId)
+            .putLong(sessionStartKey(id), nowMs)
+            .putBoolean(sessionExportedKey(id), false)
+            .putBoolean(sessionCaptureKey(id), true)
+            .apply()
+        append(id, event(nowMs, "start").put("strap_device_id", deviceId))
+        ImuSessionFileStore(context).start(id, deviceId, nowMs)
+        return snapshot()
+    }
+
+    @Synchronized
+    fun setComment(sessionId: String, comment: String) {
+        prefs.edit().putString(sessionCommentKey(sessionId), comment.take(4_000)).apply()
+    }
+
+    @Synchronized
+    fun sessions(): List<SessionSummary> {
+        val current = snapshot()
+        return directory.listFiles { file -> file.name.startsWith("session-") && file.name.endsWith(".jsonl") }
+            .orEmpty()
+            .mapNotNull { file ->
+                val id = file.name.removePrefix("session-").removeSuffix(".jsonl")
+                val rows = runCatching {
+                    file.useLines { lines ->
+                        lines.filter { it.isNotBlank() }
+                            .mapNotNull { line -> runCatching { JSONObject(line) }.getOrNull() }
+                            .toList()
+                    }
+                }.getOrNull() ?: return@mapNotNull null
+                val first = rows.firstOrNull() ?: return@mapNotNull null
+                val isCurrent = current.sessionId == id
+                val physicalStart = prefs.getLong(sessionStartKey(id), first.optLong("at_ms"))
+                val capturedEnd = rows.lastOrNull { it.optString("kind") == "stop" }?.optLong("at_ms")
+                val hasCapture = prefs.getBoolean(sessionCaptureKey(id), false)
+                SessionSummary(
+                    id = id,
+                    deviceId = prefs.getString(sessionDeviceKey(id), null)
+                        ?: first.optString("strap_device_id").takeIf(String::isNotBlank)
+                        ?: current.deviceId.takeIf { isCurrent },
+                    startedAtMs = prefs.getLong(sessionUsedStartKey(id), physicalStart),
+                    endedAtMs = capturedEnd?.let { prefs.getLong(sessionUsedEndKey(id), it) },
+                    capturedStartedAtMs = physicalStart.takeIf { hasCapture },
+                    capturedEndedAtMs = capturedEnd.takeIf { hasCapture },
+                    comment = prefs.getString(sessionCommentKey(id), "").orEmpty(),
+                    active = isCurrent && current.active,
+                    exported = prefs.getBoolean(sessionExportedKey(id), isCurrent && current.exported),
+                    lastExportedAtMs = prefs.getLong(sessionLastExportKey(id), 0L).takeIf { it > 0 },
+                    markers = rows.filter { it.optString("kind") == KIND_MARKER }.map { row ->
+                        Marker(row.optString("marker_id"), row.optLong("at_ms"),
+                            row.optString("marker_type", "moment"), row.optString("text"))
+                    }.sortedBy(Marker::atMs),
+                )
+            }
+            .sortedByDescending { it.startedAtMs }
+    }
+
+    /** Delete one completed capture and all app-private files and metadata belonging to it. */
+    @Synchronized
+    fun deleteSession(sessionId: String): Boolean {
+        val current = snapshot()
+        if (current.active && current.sessionId == sessionId) return false
+        if (sessions().none { it.id == sessionId }) return false
+
+        val payloadFiles = listOf(File(context.cacheDir, "logs/noop-5mg-raw-$sessionId.zip"))
+        // Evaluate every deletion even if one fails, so a stale export ZIP never survives merely
+        // because an earlier file could not be removed.
+        val imuStore = ImuSessionFileStore(context)
+        if (!imuStore.deleteFiles(sessionId)) return false
+        if (!payloadFiles.all { file -> !file.exists() || file.delete() }) return false
+        imuStore.remove(sessionId)
+        // The event file is also the durable session index. Delete it last so any earlier failure
+        // leaves the session visible and the explicit delete action retryable.
+        if (eventFile(sessionId).exists() && !eventFile(sessionId).delete()) return false
+
+        prefs.edit()
+            .remove(sessionDeviceKey(sessionId))
+            .remove(sessionStartKey(sessionId))
+            .remove(sessionEndKey(sessionId))
+            .remove(sessionCommentKey(sessionId))
+            .remove(sessionExportedKey(sessionId))
+            .remove(sessionLastExportKey(sessionId))
+            .remove(sessionUsedStartKey(sessionId))
+            .remove(sessionUsedEndKey(sessionId))
+            .remove(sessionCaptureKey(sessionId))
+            .apply {
+                if (current.sessionId == sessionId) clearCurrentSession()
+            }
+            .apply()
+        return true
+    }
+
+    /** Trim the analysis/export interval without rewriting the physical capture provenance. */
+    @Synchronized
+    fun setSessionRange(sessionId: String, fromMs: Long, toMs: Long): Boolean {
+        val session = sessions().firstOrNull { it.id == sessionId } ?: return false
+        if (session.active || fromMs <= 0 || fromMs > toMs || toMs - fromMs > MAX_RANGE_MS) return false
+        prefs.edit().putLong(sessionUsedStartKey(sessionId), fromMs)
+            .putLong(sessionUsedEndKey(sessionId), toMs).apply()
+        val deviceId = session.deviceId ?: return false
+        ImuSessionFileStore(context).register(sessionId, deviceId, fromMs, toMs)
+        return true
+    }
+
+    @Synchronized
+    fun createHistoricalSession(deviceId: String, fromMs: Long, toMs: Long): SessionSummary? {
+        if (fromMs <= 0 || fromMs > toMs || toMs - fromMs > MAX_RANGE_MS) return null
+        val id = System.currentTimeMillis().toString()
+        prefs.edit().putString(sessionDeviceKey(id), deviceId).putLong(sessionStartKey(id), fromMs)
+            .putLong(sessionEndKey(id), toMs).putLong(sessionUsedStartKey(id), fromMs)
+            .putLong(sessionUsedEndKey(id), toMs).putBoolean(sessionCaptureKey(id), false).apply()
+        append(id, event(fromMs, "start").put("strap_device_id", deviceId))
+        append(id, event(toMs, "stop"))
+        ImuSessionFileStore(context).register(id, deviceId, fromMs, toMs)
+        return sessions().firstOrNull { it.id == id }
+    }
+
+    @Synchronized
+    fun addMarker(sessionId: String, atMs: Long, type: String, text: String): Marker? {
+        val session = sessions().firstOrNull { it.id == sessionId } ?: return null
+        val end = session.endedAtMs ?: System.currentTimeMillis()
+        val marker = Marker(UUID.randomUUID().toString(), atMs.coerceIn(session.startedAtMs, end),
+            type.take(40), text.take(500))
+        append(sessionId, JSONObject().apply {
+            put("at_ms", marker.atMs); put("kind", KIND_MARKER); put("marker_id", marker.id)
+            put("marker_type", marker.type); put("text", marker.text)
+        })
+        return marker
+    }
+
+    @Synchronized
+    fun updateMarker(sessionId: String, marker: Marker): Boolean {
+        val session = sessions().firstOrNull { it.id == sessionId } ?: return false
+        val end = session.endedAtMs ?: System.currentTimeMillis()
+        return rewriteEvents(sessionId) { rows -> rows.map { row ->
+            if (row.optString("kind") == KIND_MARKER && row.optString("marker_id") == marker.id)
+                JSONObject(row.toString()).apply {
+                    put("at_ms", marker.atMs.coerceIn(session.startedAtMs, end))
+                    put("marker_type", marker.type.take(40)); put("text", marker.text.take(500))
+                } else row
+        }}
+    }
+
+    @Synchronized
+    fun deleteMarker(sessionId: String, markerId: String): Boolean = rewriteEvents(sessionId) { rows ->
+        rows.filterNot { it.optString("kind") == KIND_MARKER && it.optString("marker_id") == markerId }
+    }
+
+    private fun rewriteEvents(sessionId: String, transform: (List<JSONObject>) -> List<JSONObject>): Boolean {
+        val file = eventFile(sessionId); if (!file.isFile) return false
+        val rows = file.useLines { it.filter(String::isNotBlank).map(::JSONObject).toList() }
+        val content = transform(rows).joinToString("\n", postfix = "\n") { it.toString() }
+        val staged = File(file.parentFile, ".${file.name}.tmp")
+        return runCatching {
+            staged.writeText(content)
+            check(staged.renameTo(file)) { "Could not commit marker edit" }
+        }.onFailure { staged.delete() }.isSuccess
+    }
+
+    /** Delete every completed capture. Active captures are deliberately retained. */
+    @Synchronized
+    fun deleteAllSessions(): Int {
+        val completedIds = sessions().filterNot(SessionSummary::active).map(SessionSummary::id)
+        return completedIds.count(::deleteSession)
+    }
+
+    @Synchronized
+    fun stop(nowMs: Long = System.currentTimeMillis()): Snapshot {
+        val before = snapshot()
+        if (!before.active || before.sessionId == null) return before
+        append(before.sessionId, event(nowMs, "stop"))
+        ImuSessionFileStore(context).complete(before.sessionId, nowMs)
+        prefs.edit().putBoolean("active", false).putLong("endedAtMs", nowMs)
+            .putLong(sessionEndKey(before.sessionId), nowMs)
+            .apply()
+        return snapshot()
+    }
+
+    suspend fun export(repo: WhoopRepository, sessionId: String? = null): File = withContext(Dispatchers.IO) {
+        val snap = snapshot()
+        val id = sessionId ?: requireNotNull(snap.sessionId) { "No ground-truth session has been recorded" }
+        val summary = sessions().firstOrNull { it.id == id } ?: error("Ground-truth session is missing")
+        require(!summary.active) { "Stop the session before exporting" }
+        val deviceId = summary.deviceId
+        val source = eventFile(id)
+        require(source.isFile) { "Ground-truth event file is missing" }
+        val events = source.useLines { lines ->
+            lines.filter { it.isNotBlank() }
+                .mapNotNull { line -> runCatching { JSONObject(line) }.getOrNull() }
+                .toList()
+        }
+        val endMs = summary.endedAtMs ?: events.lastOrNull()?.optLong("at_ms") ?: summary.startedAtMs
+        // Export the complete bounded interval; markers are optional annotations.
+        val sensorFrom = ceilSecond(summary.startedAtMs)
+        val sensorTo = endMs / 1_000L - 1L
+        val imuSegments = if (deviceId == null || sensorFrom > sensorTo) emptyList() else
+            ImuSessionFileStore(context).exportSegments(id, sensorFrom, sensorTo)
+        val fullFrom = sensorFrom
+        val fullTo = endMs / 1_000L - 1L
+        // A live capture can only produce its first complete one-second frame after startup.
+        // Historical windows must still cover the exact requested start.
+        val firstImuTs = imuSegments.minOfOrNull { it.startTs }?.takeIf { it <= fullFrom + 1 }
+        val coverageFrom = if (summary.capturedStartedAtMs != null) maxOf(fullFrom, firstImuTs ?: fullFrom)
+            else fullFrom
+        val imuComplete = covers(imuSegments, coverageFrom, fullTo)
+        val outDir = File(context.cacheDir, "logs").apply { mkdirs() }
+        val zip = File(outDir, "noop-5mg-raw-$id.zip")
+        ZipOutputStream(zip.outputStream().buffered()).use { out ->
+            var v18Count = 0
+            out.putNextEntry(ZipEntry("v18-aux.csv"))
+            out.bufferedWriterNoClose().use { writer ->
+                v18Count = writeV18AuxCsv(writer, repo, deviceId.orEmpty(), sensorFrom, sensorTo)
+                writer.flush()
+            }
+            out.closeEntry()
+
+            var rawCounts: Map<String, Int> = emptyMap()
+            out.putNextEntry(ZipEntry("raw-sensors.csv"))
+            out.bufferedWriterNoClose().use { writer ->
+                rawCounts = RawSensorExport.writeCsv(writer, repo, deviceId.orEmpty(), sensorFrom, sensorTo)
+                writer.flush()
+            }
+            out.closeEntry()
+
+            val sensorAvailable = imuSegments.isNotEmpty() || v18Count > 0 || rawCounts.values.any { it > 0 }
+            out.putNextEntry(ZipEntry("meta.json"))
+            out.writerEntry(JSONObject().apply {
+                put("schema_version", 3)
+                put("capture_kind", "whoop_5mg_raw_data")
+                put("session_id", id)
+                if (deviceId != null) put("device_id", deviceId)
+                put("sensor_export_available", sensorAvailable)
+                put("imu_100hz_segment_count", imuSegments.size)
+                put("imu_100hz_complete", imuComplete)
+                put("imu_100hz_required_start_ts", coverageFrom)
+                put("imu_100hz_required_end_ts", fullTo)
+                put("imu_100hz_startup_seconds", (coverageFrom - fullFrom).coerceAtLeast(0))
+                put("imu_100hz_coverage", org.json.JSONArray().apply {
+                    imuSegments.forEach { segment -> put(JSONObject().apply {
+                        put("file", segment.name); put("start_ts", segment.startTs); put("end_ts", segment.endTs)
+                        put("sample_count", segment.sampleCount)
+                    }) }
+                })
+                put("started_at_ms", summary.startedAtMs)
+                put("ended_at_ms", endMs)
+                summary.capturedStartedAtMs?.let { put("captured_started_at_ms", it) }
+                summary.capturedEndedAtMs?.let { put("captured_ended_at_ms", it) }
+                put("comment", summary.comment)
+                put("markers", org.json.JSONArray().apply {
+                    summary.markers.filter { it.atMs in summary.startedAtMs..endMs }.forEach { marker -> put(JSONObject().apply {
+                    put("id", marker.id); put("at_ms", marker.atMs); put("type", marker.type); put("text", marker.text)
+                }) } })
+                put("device_family", "Android")
+                put("app_version", BuildConfig.VERSION_NAME)
+            }.toString(2))
+
+            out.putNextEntry(ZipEntry("events.jsonl"))
+            out.writerEntry(eventsJsonl(publicEvents(events, summary.startedAtMs, endMs, deviceId)))
+
+            out.putNextEntry(ZipEntry("events.csv"))
+            out.writerEntry(eventsCsv(publicEvents(events, summary.startedAtMs, endMs, deviceId)))
+
+            for (segment in imuSegments) {
+                out.putNextEntry(ZipEntry("imu/${segment.name}"))
+                out.write(segment.data)
+                out.closeEntry()
+            }
+        }
+        val exportedAt = System.currentTimeMillis()
+        prefs.edit().putBoolean(sessionExportedKey(id), true).putLong(sessionLastExportKey(id), exportedAt).apply()
+        if (id == snap.sessionId) prefs.edit().putBoolean("exported", true).apply()
+        zip
+    }
+
+    fun share(file: File) {
+        val uri = FileProvider.getUriForFile(context, "${context.packageName}.fileprovider", file)
+        context.startActivity(Intent.createChooser(Intent(Intent.ACTION_SEND).apply {
+            type = "application/zip"
+            putExtra(Intent.EXTRA_STREAM, uri)
+            putExtra(Intent.EXTRA_SUBJECT, "NOOP 5/MG raw-data session")
+            addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
+        }, "Export raw-data session").addFlags(Intent.FLAG_ACTIVITY_NEW_TASK))
+    }
+
+    private fun covers(chunks: List<ImuSessionFileStore.ExportSegment>, from: Long, to: Long): Boolean {
+        if (from > to) return false
+        var cursor = from
+        for (chunk in chunks.sortedBy { it.startTs }) {
+            val start = chunk.startTs; val end = chunk.endTs
+            if (chunk.sampleCount < (end - start + 1) * ImuSessionFileStore.SAMPLE_RATE) continue
+            if (start > cursor) return false
+            if (end >= cursor) cursor = end + 1
+            if (cursor > to) return true
+        }
+        return cursor > to
+    }
+
+    private fun ceilSecond(epochMs: Long): Long = (epochMs + 999L) / 1_000L
+
+    private fun eventFile(id: String) = File(directory, "session-$id.jsonl")
+    private fun append(id: String, value: JSONObject) = eventFile(id).appendText(value.toString() + "\n")
+
+    private fun event(atMs: Long, kind: String) = JSONObject().apply { put("at_ms", atMs); put("kind", kind) }
+
+    private fun publicEvents(events: List<JSONObject>, fromMs: Long, toMs: Long, deviceId: String?): List<JSONObject> =
+        buildList {
+            add(event(fromMs, "start").apply { deviceId?.let { put("strap_device_id", it) } })
+            events.filter { it.optString("kind") == KIND_MARKER && it.optLong("at_ms") in fromMs..toMs }
+                .forEach { source -> add(JSONObject().apply {
+                    put("at_ms", source.optLong("at_ms")); put("kind", KIND_MARKER)
+                    put("marker_id", source.optString("marker_id")); put("marker_type", source.optString("marker_type"))
+                    put("text", source.optString("text"))
+                }) }
+            add(event(toMs, "stop"))
+        }.sortedBy { it.optLong("at_ms") }
+
+    private fun eventsJsonl(events: List<JSONObject>) = events.joinToString("\n", postfix = "\n")
+
+    private fun eventsCsv(events: List<JSONObject>): String = buildString {
+        append("at_ms,unix_s,kind,marker_id,marker_type,text\n")
+        for (e in events) append(listOf(
+            e.optLong("at_ms"), e.optLong("at_ms") / 1_000L, e.optString("kind"),
+            e.optString("marker_id"), e.optString("marker_type"), e.optString("text"),
+        ).joinToString(",") { csv(it.toString()) }).append('\n')
+    }
+
+    private fun csv(value: String): String = if (value.any { it == ',' || it == '"' || it == '\n' })
+        "\"${value.replace("\"", "\"\"")}\"" else value
+
+    private suspend fun writeV18AuxCsv(
+        out: java.io.Writer,
+        repo: WhoopRepository,
+        deviceId: String,
+        from: Long,
+        to: Long,
+    ): Int {
+        out.write(
+            "unix_s,record_index,rr_count,cardiac_flags,hr_quality_flags,heart_rate_alt,rr_packed," +
+                "cardiac_status,step_cadence,status_word,status_word_1,status_word_2,aux_byte_82," +
+                "optical_baseline_a,optical_baseline_b,optical_amp_a,optical_amp_b,unknown_f32_bits\n",
+        )
+        if (from > to || deviceId.isBlank()) return 0
+        val seconds = (to - from + 1L).coerceIn(1L, 86_400L).toInt()
+        val rows = repo.v18AuxSamples(deviceId, from, to, seconds)
+        for (row in rows) {
+            out.write((listOf(row.ts) + row.slotValues.map { it ?: "" }).joinToString(","))
+            out.write("\n")
+        }
+        return rows.size
+    }
+
+    private fun android.content.SharedPreferences.Editor.clearCurrentSession() = apply {
+        remove("active")
+        remove("exported")
+        remove("sessionId")
+        remove("deviceId")
+        remove("startedAtMs")
+        remove("endedAtMs")
+    }
+
+    private fun sessionDeviceKey(id: String) = "session.$id.deviceId"
+    private fun sessionStartKey(id: String) = "session.$id.startedAtMs"
+    private fun sessionEndKey(id: String) = "session.$id.endedAtMs"
+    private fun sessionCommentKey(id: String) = "session.$id.comment"
+    private fun sessionExportedKey(id: String) = "session.$id.exported"
+    private fun sessionLastExportKey(id: String) = "session.$id.lastExportedAtMs"
+    private fun sessionUsedStartKey(id: String) = "session.$id.usedStartedAtMs"
+    private fun sessionUsedEndKey(id: String) = "session.$id.usedEndedAtMs"
+    private fun sessionCaptureKey(id: String) = "session.$id.hasRealtimeCapture"
+
+    private fun ZipOutputStream.writerEntry(text: String) {
+        write(text.toByteArray(Charsets.UTF_8)); closeEntry()
+    }
+
+    /** A Writer whose close only flushes, because closing it must not close the surrounding ZIP. */
+    private fun ZipOutputStream.bufferedWriterNoClose() = object : java.io.OutputStreamWriter(this, Charsets.UTF_8) {
+        override fun close() = flush()
+    }.buffered()
+
+    companion object {
+        private const val KIND_MARKER = "marker"
+        private const val PREFS = "noop_ground_truth_collector"
+        private const val MAX_RANGE_MS = 7L * 24 * 60 * 60 * 1_000
+
+        fun from(context: Context) = GroundTruthCollector(context.applicationContext)
+    }
+}
diff --git a/android/app/src/main/java/com/noop/testcentre/ImuSessionFileStore.kt b/android/app/src/main/java/com/noop/testcentre/ImuSessionFileStore.kt
new file mode 100644
index 0000000000..c7312bf6fc
--- /dev/null
+++ b/android/app/src/main/java/com/noop/testcentre/ImuSessionFileStore.kt
@@ -0,0 +1,225 @@
+package com.noop.testcentre
+
+import android.content.Context
+import com.noop.data.StreamPersistence
+import com.noop.protocol.Whoop5RawImu
+import java.io.ByteArrayInputStream
+import java.io.ByteArrayOutputStream
+import java.io.DataInputStream
+import java.io.DataOutputStream
+import java.io.EOFException
+import java.io.File
+import java.io.FileOutputStream
+import java.util.zip.Deflater
+import java.util.zip.Inflater
+
+/** Stores decoded 100 Hz IMU in fixed UTC half-hour segments owned by one capture session. */
+class ImuSessionFileStore(private val context: Context) {
+    data class Stats(val bytes: Long, val coveredSeconds: Int, val firstTs: Long?)
+    data class ExportSegment(val name: String, val data: ByteArray, val startTs: Long, val endTs: Long,
+                             val sampleCount: Int)
+    private data class Record(val ts: Long, val receivedAtMs: Long, val columns: ShortArray)
+    private val prefs = context.getSharedPreferences("imu-session-windows", Context.MODE_PRIVATE)
+    private val directory = File(context.filesDir, "raw-imu-sessions").apply { mkdirs() }
+
+    fun start(id: String, deviceId: String, fromMs: Long) = synchronized(lock) {
+        prefs.edit().putStringSet("ids", ids() + id).putString("$id.device", deviceId)
+            .putLong("$id.from", fromMs / 1_000L).putLong("$id.fromMs", fromMs)
+            .remove("$id.to").remove("$id.toMs").apply()
+        sessionDir(id).mkdirs()
+    }
+
+    fun complete(id: String, toMs: Long) = synchronized(lock) {
+        flushSession(id)
+        if (id in ids()) prefs.edit().putLong("$id.to", toMs / 1_000L).putLong("$id.toMs", toMs).apply()
+    }
+
+    fun register(id: String, deviceId: String, fromMs: Long, toMs: Long) = synchronized(lock) {
+        start(id, deviceId, fromMs); complete(id, toMs)
+    }
+
+    /** Remove routing only. Files are removed separately so callers can keep deletion retryable. */
+    fun remove(id: String) = synchronized(lock) {
+        pending.keys.filter { it.startsWith("$id/") }.forEach(pending::remove)
+        seen.keys.filter { it.startsWith(sessionDir(id).absolutePath) }.forEach(seen::remove)
+        prefs.edit().putStringSet("ids", ids() - id).remove("$id.device").remove("$id.from")
+            .remove("$id.fromMs").remove("$id.to").remove("$id.toMs").apply()
+    }
+
+    /** True while a bounded capture is active or still missing seconds recoverable from strap history. */
+    fun needsHighThroughput(deviceId: String): Boolean = synchronized(lock) {
+        ids().any { id ->
+            if (prefs.getString("$id.device", null) != deviceId) return@any false
+            if (!prefs.contains("$id.to")) return@any true
+            val fromMs = prefs.getLong("$id.fromMs", prefs.getLong("$id.from", 0L) * 1_000L)
+            val toMs = prefs.getLong("$id.toMs", prefs.getLong("$id.to", 0L) * 1_000L)
+            val baseFrom = (fromMs + 999L) / 1_000L
+            val to = toMs / 1_000L - 1L
+            if (baseFrom > to) return@any false
+            val present = buildSet {
+                segmentFiles(id).forEach { addAll(timestamps(it)) }
+                pending.filterKeys { it.startsWith("$id/") }.values.flatten().forEach { add(it.ts) }
+            }
+            // Match export's one-second producer-start allowance, without hiding any later gap.
+            val first = present.minOrNull()?.takeIf { it <= baseFrom + 1 } ?: baseFrom
+            (first..to).any { it !in present }
+        }
+    }
+
+    fun prepareForRead(id: String) = synchronized(lock) { flushSession(id) }
+
+    fun deleteFiles(id: String): Boolean = synchronized(lock) {
+        flushSession(id)
+        val dir = sessionDir(id)
+        if (dir.listFiles().orEmpty().any { it.isDirectory || !it.delete() }) return@synchronized false
+        !dir.exists() || dir.delete()
+    }
+
+    fun deleteDevice(deviceId: String): Boolean = synchronized(lock) {
+        val owned = ids().filter { prefs.getString("$it.device", null) == deviceId }
+        if (owned.any { !deleteFiles(it) }) return@synchronized false
+        owned.forEach(::remove)
+        true
+    }
+
+    fun stats(id: String, from: Long, to: Long): Stats = synchronized(lock) {
+        // Coverage needs timestamps, not decoded 6-axis payloads. Reuse the per-file timestamp index
+        // instead of inflating every .imus block on each one-second UI refresh.
+        val covered = buildSet {
+            segmentFiles(id).forEach { file -> addAll(timestamps(file).filter { it in from..to }) }
+            pending.filterKeys { it.startsWith("$id/") }.values.flatten()
+                .forEach { record -> if (record.ts in from..to) add(record.ts) }
+        }
+        val disk = segmentFiles(id).sumOf { it.length() }
+        val pendingBytes = pending.filterKeys { it.startsWith("$id/") }.values.flatten()
+            .sumOf { it.columns.size.toLong() * 2 + RECORD_HEADER_BYTES }
+        Stats(disk + pendingBytes, covered.size, covered.minOrNull())
+    }
+
+    fun append(deviceId: String, frame: ByteArray, receivedAtMs: Long = System.currentTimeMillis()): Int = synchronized(lock) {
+        val decoded = Whoop5RawImu.decode(frame) ?: return 0
+        val columns = Whoop5RawImu.rawColumns(frame) ?: return 0
+        val ts = decoded.baseTs
+        var writes = 0
+        for (id in ids()) {
+            if (prefs.getString("$id.device", null) != deviceId) continue
+            val from = prefs.getLong("$id.from", Long.MAX_VALUE)
+            val to = if (prefs.contains("$id.to")) prefs.getLong("$id.to", Long.MIN_VALUE) else Long.MAX_VALUE
+            if (ts !in from..to) continue
+            val bucket = bucketStart(ts); val file = segmentFile(id, bucket)
+            if (!timestamps(file).add(ts)) continue
+            val key = "$id/$bucket"
+            pending.getOrPut(key) { mutableListOf() } += Record(ts, receivedAtMs, columns)
+            if (pending[key]!!.size >= BLOCK_SECONDS) flushKey(key)
+            writes++
+        }
+        writes
+    }
+
+    /** Exact selected interval, still in the canonical decoded .imus format. */
+    fun exportSegments(id: String, from: Long, to: Long): List<ExportSegment> = synchronized(lock) {
+        flushSession(id)
+        readRecords(id, from, to, includePending = false).distinctBy { it.ts }.sortedBy { it.ts }
+            .groupBy { bucketStart(it.ts) }.toSortedMap().map { (bucket, records) ->
+                ExportSegment("imu-${utcName(bucket)}.imus", encodeFile(bucket, records), records.first().ts,
+                    records.last().ts, records.size * SAMPLE_RATE)
+            }
+    }
+
+    private fun readRecords(id: String, from: Long, to: Long, includePending: Boolean): List<Record> {
+        val rows = segmentFiles(id).flatMap { decodeFile(it.readBytes()) }.filter { it.ts in from..to }.toMutableList()
+        if (includePending) rows += pending.filterKeys { it.startsWith("$id/") }.values.flatten().filter { it.ts in from..to }
+        return rows
+    }
+
+    private fun encodeFile(bucket: Long, records: List<Record>): ByteArray {
+        val output = ByteArrayOutputStream()
+        DataOutputStream(output).use { out ->
+            writeHeader(out, bucket); records.chunked(BLOCK_SECONDS).forEach { writeBlock(out, it) }
+        }
+        return output.toByteArray()
+    }
+
+    private fun decodeFile(bytes: ByteArray): List<Record> {
+        if (bytes.size < FILE_HEADER_BYTES || !bytes.copyOfRange(0, MAGIC.size).contentEquals(MAGIC)) return emptyList()
+        val rows = mutableListOf<Record>()
+        DataInputStream(ByteArrayInputStream(bytes)).use { input ->
+            input.skipBytes(MAGIC.size); input.readLong()
+            if (input.readInt() != SAMPLE_RATE || input.readInt() != AXES) return emptyList()
+            while (true) try {
+                val count = input.readInt(); val rawSize = input.readInt(); val compressedSize = input.readInt()
+                if (count !in 1..BLOCK_SECONDS || rawSize !in 1..MAX_BLOCK_BYTES || compressedSize !in 1..MAX_BLOCK_BYTES) break
+                val compressed = ByteArray(compressedSize); input.readFully(compressed)
+                val raw = inflate(compressed, rawSize) ?: break
+                var valid = true
+                DataInputStream(ByteArrayInputStream(raw)).use { block -> for (index in 0 until count) {
+                    val ts = block.readLong(); val received = block.readLong(); val length = block.readInt()
+                    if (length != PAYLOAD_BYTES) { valid = false; break }
+                    val packed = ByteArray(length); block.readFully(packed)
+                    rows += Record(ts, received, unpackColumns(packed))
+                }}
+                if (!valid) break
+            } catch (_: EOFException) { break }
+        }
+        return rows
+    }
+
+    private fun flushSession(id: String) = pending.keys.filter { it.startsWith("$id/") }.toList().forEach(::flushKey)
+    private fun flushKey(key: String) {
+        val records = pending.remove(key).orEmpty(); if (records.isEmpty()) return
+        val id = key.substringBefore('/'); val bucket = key.substringAfter('/').toLong()
+        val file = segmentFile(id, bucket); file.parentFile?.mkdirs(); val newFile = !file.exists()
+        DataOutputStream(FileOutputStream(file, true).buffered()).use { out ->
+            if (newFile) writeHeader(out, bucket)
+            writeBlock(out, records)
+        }
+    }
+
+    private fun writeHeader(out: DataOutputStream, bucket: Long) {
+        out.write(MAGIC); out.writeLong(bucket); out.writeInt(SAMPLE_RATE); out.writeInt(AXES)
+    }
+
+    private fun writeBlock(out: DataOutputStream, records: List<Record>) {
+        val rawBytes = ByteArrayOutputStream()
+        DataOutputStream(rawBytes).use { block -> records.forEach { record ->
+            val packed = StreamPersistence.packImuColumns(record.columns)
+            block.writeLong(record.ts); block.writeLong(record.receivedAtMs); block.writeInt(packed.size); block.write(packed)
+        }}
+        val raw = rawBytes.toByteArray(); val compressed = deflate(raw)
+        out.writeInt(records.size); out.writeInt(raw.size); out.writeInt(compressed.size); out.write(compressed)
+    }
+
+    private fun timestamps(file: File): MutableSet<Long> = seen.getOrPut(file.absolutePath) {
+        decodeFile(file.takeIf(File::isFile)?.readBytes() ?: byteArrayOf()).mapTo(mutableSetOf()) { it.ts }
+    }
+    private fun ids() = prefs.getStringSet("ids", emptySet()).orEmpty()
+    private fun sessionDir(id: String) = File(directory, id)
+    private fun segmentFiles(id: String) = sessionDir(id).listFiles { f -> f.isFile && f.extension == "imus" }
+        .orEmpty().sortedBy { it.name }
+    private fun segmentFile(id: String, bucket: Long) = File(sessionDir(id), "imu-${utcName(bucket)}.imus")
+
+    private fun deflate(raw: ByteArray): ByteArray {
+        val d = Deflater(); d.setInput(raw); d.finish(); val out = ByteArray(raw.size + 128)
+        val size = d.deflate(out); d.end(); return out.copyOf(size)
+    }
+    private fun inflate(compressed: ByteArray, size: Int): ByteArray? {
+        val i = Inflater(); i.setInput(compressed); val out = ByteArray(size)
+        val written = runCatching { i.inflate(out) }.getOrDefault(0); i.end(); return out.takeIf { written == size }
+    }
+    private fun unpackColumns(bytes: ByteArray) = ShortArray(bytes.size / 2) { index ->
+        ((bytes[index * 2].toInt() and 0xff) or (bytes[index * 2 + 1].toInt() shl 8)).toShort()
+    }
+
+    companion object {
+        private val lock = Any(); private val seen = mutableMapOf<String, MutableSet<Long>>()
+        private val pending = mutableMapOf<String, MutableList<Record>>()
+        private val MAGIC = "NOOPIMU2".toByteArray(Charsets.US_ASCII)
+        const val SAMPLE_RATE = 100; const val AXES = 6; const val BLOCK_SECONDS = 30
+        const val SEGMENT_SECONDS = 30 * 60L; const val PAYLOAD_BYTES = SAMPLE_RATE * AXES * 2
+        private const val RECORD_HEADER_BYTES = 20L; private const val FILE_HEADER_BYTES = 24
+        private const val MAX_BLOCK_BYTES = BLOCK_SECONDS * (PAYLOAD_BYTES + 20)
+        internal fun bucketStart(ts: Long) = Math.floorDiv(ts, SEGMENT_SECONDS) * SEGMENT_SECONDS
+        internal fun utcName(ts: Long): String = java.time.format.DateTimeFormatter.ofPattern("yyyyMMdd'T'HHmmss'Z'")
+            .withZone(java.time.ZoneOffset.UTC).format(java.time.Instant.ofEpochSecond(ts))
+    }
+}
diff --git a/android/app/src/main/java/com/noop/ui/AddDeviceWizard.kt b/android/app/src/main/java/com/noop/ui/AddDeviceWizard.kt
index cd97888b81..8253fa1998 100644
--- a/android/app/src/main/java/com/noop/ui/AddDeviceWizard.kt
+++ b/android/app/src/main/java/com/noop/ui/AddDeviceWizard.kt
@@ -700,7 +700,7 @@ private fun ouraHeaderSubtitle(step: OuraStep, advanced: Boolean): String? = whe
 @Composable
 private fun TypeStep(onPick: (DeviceType) -> Unit) {
     Column(verticalArrangement = Arrangement.spacedBy(10.dp)) {
-        TypeRow(Icons.Filled.Watch, DeviceType.Whoop5MG.title, "Newer WHOOP band. Experimental in NOOP") {
+        TypeRow(Icons.Filled.Watch, DeviceType.Whoop5MG.title, "Newer WHOOP band with live data and history sync") {
             onPick(DeviceType.Whoop5MG)
         }
         TypeRow(Icons.Filled.Watch, DeviceType.Whoop4.title, "NOOP's primary, fully-supported band") {
diff --git a/android/app/src/main/java/com/noop/ui/AppRoot.kt b/android/app/src/main/java/com/noop/ui/AppRoot.kt
index c7b4984632..d0b077f9f9 100644
--- a/android/app/src/main/java/com/noop/ui/AppRoot.kt
+++ b/android/app/src/main/java/com/noop/ui/AppRoot.kt
@@ -182,6 +182,7 @@ private enum class Destination(
         Icons.Filled.Tune,
     ),
     TestCentre("test_centre", R.string.nav_test_centre, Icons.Filled.BugReport),
+    GroundTruthCollector("ground_truth_collector", R.string.ground_truth_title, Icons.Filled.Sensors),
 
     // The "More" tab: its own navigated page (mirroring the iOS More tab) that hosts the full
     // grouped destination list. It is NOT itself in any [DrawerGroup] — it's the door to them.
@@ -473,7 +474,12 @@ fun AppRoot(viewModel: AppViewModel = viewModel()) {
                     )
                 }
                 composable(Destination.SelfHostedPush.route) { SelfHostedPushScreen() }
-                composable(Destination.TestCentre.route) { TestCentreScreen(viewModel) }
+                composable(Destination.TestCentre.route) {
+                    TestCentreScreen(viewModel, onOpenGroundTruthCollector = {
+                        nav.navigate(Destination.GroundTruthCollector.route)
+                    })
+                }
+                composable(Destination.GroundTruthCollector.route) { GroundTruthCollectorScreen(viewModel) }
                 // The "More" page — the iOS More tab's twin: a navigated ScreenScaffold page hosting the
                 // full grouped destination list (was a pull-up sheet). A row pushes its destination so
                 // Android Back returns to More instead of skipping straight to Today.
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index 2b9623082b..91a2948cfd 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -254,12 +254,18 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
         noopApp.deviceRegistry.rename(id, nickname)
 
     /** Permanently delete all of a device's recorded data (its registry row is kept). */
-    suspend fun deletePairedDeviceData(id: String) = noopApp.deviceRegistry.deleteDeviceData(id)
+    suspend fun deletePairedDeviceData(id: String) {
+        if (com.noop.testcentre.ImuSessionFileStore(getApplication()).deleteDevice(id))
+            noopApp.deviceRegistry.deleteDeviceData(id)
+    }
 
     /** Permanently forget a device: wipe all its recorded data AND remove its registry entry, so a
      *  duplicate/stale strap disappears from the list entirely (an archived row could otherwise only be
      *  re-activated or data-wiped, never purged — #1193). Twin of Swift `DeviceRegistry.forget`. */
-    suspend fun forgetPairedDevice(id: String) = noopApp.deviceRegistry.forget(id)
+    suspend fun forgetPairedDevice(id: String) {
+        if (com.noop.testcentre.ImuSessionFileStore(getApplication()).deleteDevice(id))
+            noopApp.deviceRegistry.forget(id)
+    }
 
     /**
      * A DISCOVERY-ONLY [StandardHrSource] for the Add-a-strap wizard. It runs its OWN scan and never
diff --git a/android/app/src/main/java/com/noop/ui/GroundTruthCollectorScreen.kt b/android/app/src/main/java/com/noop/ui/GroundTruthCollectorScreen.kt
new file mode 100644
index 0000000000..05bc2cad59
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ui/GroundTruthCollectorScreen.kt
@@ -0,0 +1,497 @@
+package com.noop.ui
+
+import android.app.DatePickerDialog
+import android.app.TimePickerDialog
+import android.content.Context
+import android.widget.Toast
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.material3.Text
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.unit.dp
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.noop.R
+import com.noop.testcentre.GroundTruthCollector
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+
+/** Bounded 5/MG raw-data capture. */
+@Composable
+fun GroundTruthCollectorScreen(vm: AppViewModel) {
+    val context = LocalContext.current
+    val collector = remember { GroundTruthCollector.from(context) }
+    val scope = rememberCoroutineScope()
+    val live by vm.live.collectAsStateWithLifecycle()
+    val imuStatus by vm.ble.groundTruthImuStatus.collectAsStateWithLifecycle()
+    var state by remember { mutableStateOf(collector.snapshot()) }
+    var exportingSessionId by remember { mutableStateOf<String?>(null) }
+    var sessions by remember { mutableStateOf(collector.sessions()) }
+    var latestSensorTs by remember { mutableStateOf<Long?>(null) }
+    var nowMs by remember { mutableStateOf(System.currentTimeMillis()) }
+    var captureStats by remember { mutableStateOf<Map<String, GroundTruthCollector.CaptureStats>>(emptyMap()) }
+    var markerEditor by remember { mutableStateOf<MarkerEditor?>(null) }
+    var sessionPendingDelete by remember { mutableStateOf<GroundTruthCollector.SessionSummary?>(null) }
+    var confirmDeleteAll by remember { mutableStateOf(false) }
+
+    LaunchedEffect(vm.activeStrapId) {
+        while (true) {
+            nowMs = System.currentTimeMillis()
+            latestSensorTs = vm.activeStrapId.takeIf(String::isNotBlank)?.let { vm.repo.latestHrSampleTs(it) }
+            captureStats = withContext(Dispatchers.IO) {
+                sessions.associate { it.id to collector.captureStats(it, nowMs) }
+            }
+            delay(1_000)
+        }
+    }
+
+    // Re-arm after a BLE reconnect or Android process restart while the manual session is still active.
+    LaunchedEffect(state.active, state.sessionId, live.connected) {
+        if (state.active && live.connected) state.sessionId?.let(vm.ble::startGroundTruthImuCapture)
+    }
+
+    ScreenScaffold(
+        title = stringResource(R.string.ground_truth_title),
+        subtitle = stringResource(R.string.ground_truth_subtitle),
+    ) {
+        NoopCard {
+            Column(verticalArrangement = Arrangement.spacedBy(6.dp)) {
+                val activeSession = sessions.firstOrNull { it.active }
+                val activeStats = activeSession?.let { captureStats[it.id] }
+                Text(if (activeSession == null) stringResource(R.string.ground_truth_capture_status)
+                    else stringResource(R.string.ground_truth_recording, formatDuration(nowMs - activeSession.startedAtMs)),
+                    style = NoopType.headline, color = Palette.textPrimary)
+                if (activeStats != null) Text(
+                    stringResource(R.string.ground_truth_imu_coverage, formatBytes(activeStats.bytes), coverageText(activeStats)),
+                    style = NoopType.body,
+                    color = if (activeStats.coveredSeconds > 0) Palette.statusPositive else Palette.textSecondary,
+                )
+                Text(
+                    stringResource(when {
+                        live.connected && live.bonded -> R.string.ground_truth_band_connected_paired
+                        live.connected -> R.string.ground_truth_band_connected_pairing
+                        live.scanning -> R.string.ground_truth_band_searching
+                        else -> R.string.ground_truth_band_disconnected
+                    }),
+                    style = NoopType.body,
+                    color = if (live.connected) Palette.statusPositive else Palette.statusCritical,
+                )
+                Text(
+                    when {
+                        live.backfilling -> stringResource(R.string.ground_truth_history_running, live.syncChunksThisSession)
+                        live.lastSyncAt != null -> stringResource(R.string.ground_truth_history_completed, diagnosticTime(live.lastSyncAt!! * 1000))
+                        else -> stringResource(R.string.ground_truth_history_none)
+                    },
+                    style = NoopType.body,
+                    color = Palette.textSecondary,
+                )
+                Text(
+                    latestSensorTs?.let { stringResource(R.string.ground_truth_sensors_behind, diagnosticAge(it * 1000)) }
+                        ?: stringResource(R.string.ground_truth_sensors_none),
+                    style = NoopType.caption,
+                    color = Palette.textSecondary,
+                )
+                Text(
+                    stringResource(R.string.ground_truth_realtime_imu, imuStatus.note, imuStatus.packets, imuStatus.bytes,
+                        imuStatus.lastPacketAtMs?.let { stringResource(R.string.ground_truth_realtime_last, diagnosticAge(it)) }.orEmpty()),
+                    style = NoopType.body,
+                    color = if (imuStatus.packets > 0) Palette.statusPositive else Palette.textSecondary,
+                )
+            }
+        }
+
+        if (state.active) {
+            NoopButton(
+                text = stringResource(R.string.ground_truth_add_marker),
+                kind = NoopButtonKind.Secondary,
+                fullWidth = true,
+                onClick = { state.sessionId?.let { markerEditor = MarkerEditor(it, null, nowMs, MARKER_MOMENT, "") } },
+            )
+            NoopButton(text = stringResource(R.string.ground_truth_stop), kind = NoopButtonKind.Destructive,
+                fullWidth = true, onClick = {
+                    state = collector.stop(); vm.ble.stopGroundTruthImuCapture(); sessions = collector.sessions()
+                })
+        } else {
+            NoopButton(
+                text = stringResource(R.string.ground_truth_start),
+                fullWidth = true,
+                enabled = vm.activeStrapId.isNotBlank(),
+                onClick = {
+                    state = collector.start(vm.activeStrapId)
+                    sessions = collector.sessions()
+                },
+            )
+        }
+        NoopButton(
+            text = stringResource(R.string.ground_truth_add_historical),
+            kind = NoopButtonKind.Secondary,
+            fullWidth = true,
+            enabled = !state.active && vm.activeStrapId.isNotBlank(),
+            onClick = {
+                val end = System.currentTimeMillis()
+                collector.createHistoricalSession(vm.activeStrapId, end - 60 * 60 * 1_000L, end)
+                sessions = collector.sessions()
+            },
+        )
+        Text(stringResource(R.string.ground_truth_sessions), style = NoopType.title2, color = Palette.textPrimary)
+        if (sessions.isEmpty()) {
+            Text(stringResource(R.string.ground_truth_no_sessions), style = NoopType.body, color = Palette.textSecondary)
+        } else {
+            NoopButton(
+                text = stringResource(R.string.ground_truth_delete_all),
+                kind = NoopButtonKind.Destructive,
+                fullWidth = true,
+                enabled = sessions.none { it.active },
+                onClick = { confirmDeleteAll = true },
+            )
+            sessions.forEach { session ->
+                SessionCard(
+                    session = session,
+                    latestSensorTs = latestSensorTs,
+                    stats = captureStats[session.id],
+                    exporting = exportingSessionId == session.id,
+                    onComment = { comment ->
+                        collector.setComment(session.id, comment)
+                        sessions = sessions.map { if (it.id == session.id) it.copy(comment = comment) else it }
+                    },
+                    onExport = {
+                        exportingSessionId = session.id
+                        scope.launch {
+                            try {
+                                collector.share(collector.export(vm.repo, session.id))
+                                vm.ble.finishGroundTruthImuCapture(session.id)
+                                sessions = collector.sessions()
+                            } catch (failure: Throwable) {
+                                if (failure is kotlinx.coroutines.CancellationException) throw failure
+                                Toast.makeText(context, context.getString(R.string.ground_truth_export_failed,
+                                    "${failure.javaClass.simpleName}: ${failure.message ?: "unknown error"}"), Toast.LENGTH_LONG).show()
+                            } finally {
+                                exportingSessionId = null
+                            }
+                        }
+                    },
+                    onDelete = { sessionPendingDelete = session },
+                    onAddMarker = { markerEditor = MarkerEditor(session.id, null, session.endedAtMs ?: nowMs, MARKER_MOMENT, "") },
+                    onEditMarker = { marker -> markerEditor = MarkerEditor(session.id, marker.id, marker.atMs, marker.type, marker.text) },
+                    onEditStart = {
+                        pickDateTime(context, session.startedAtMs, EARLIEST_EXPORT_MS,
+                            session.endedAtMs ?: session.capturedEndedAtMs ?: session.startedAtMs) { value ->
+                            collector.setSessionRange(session.id, value, requireNotNull(session.endedAtMs))
+                            sessions = collector.sessions()
+                        }
+                    },
+                    onEditEnd = {
+                        pickDateTime(context, requireNotNull(session.endedAtMs), session.startedAtMs,
+                            System.currentTimeMillis()) { value ->
+                            collector.setSessionRange(session.id, session.startedAtMs, value)
+                            sessions = collector.sessions()
+                        }
+                    },
+                )
+            }
+        }
+    }
+
+    sessionPendingDelete?.let { session ->
+        AlertDialog(
+            onDismissRequest = { sessionPendingDelete = null },
+            title = { Text(stringResource(R.string.ground_truth_delete_session_title)) },
+            text = { Text(stringResource(R.string.ground_truth_delete_session_message, sessionTimeRange(session))) },
+            dismissButton = {
+                TextButton(onClick = { sessionPendingDelete = null }) {
+                    Text(stringResource(R.string.ground_truth_cancel))
+                }
+            },
+            confirmButton = {
+                TextButton(onClick = {
+                    vm.ble.finishGroundTruthImuCapture(session.id)
+                    collector.deleteSession(session.id)
+                    sessions = collector.sessions()
+                    state = collector.snapshot()
+                    sessionPendingDelete = null
+                }) {
+                    Text(stringResource(R.string.ground_truth_delete_confirm), color = Palette.statusCritical)
+                }
+            },
+        )
+    }
+
+    if (confirmDeleteAll) {
+        AlertDialog(
+            onDismissRequest = { confirmDeleteAll = false },
+            title = { Text(stringResource(R.string.ground_truth_delete_all_title)) },
+            text = { Text(stringResource(R.string.ground_truth_delete_all_message, sessions.size)) },
+            dismissButton = {
+                TextButton(onClick = { confirmDeleteAll = false }) {
+                    Text(stringResource(R.string.ground_truth_cancel))
+                }
+            },
+            confirmButton = {
+                TextButton(onClick = {
+                    sessions.forEach { vm.ble.finishGroundTruthImuCapture(it.id) }
+                    collector.deleteAllSessions()
+                    sessions = collector.sessions()
+                    state = collector.snapshot()
+                    confirmDeleteAll = false
+                }) {
+                    Text(stringResource(R.string.ground_truth_delete_confirm), color = Palette.statusCritical)
+                }
+            },
+        )
+    }
+
+    markerEditor?.let { editor ->
+        val markerSession = sessions.firstOrNull { it.id == editor.sessionId }
+        val markerNowMs = if (markerSession?.active == true) nowMs else markerSession?.endedAtMs ?: nowMs
+        AlertDialog(
+            onDismissRequest = { markerEditor = null },
+            title = { Text(stringResource(if (editor.markerId == null) R.string.ground_truth_add_marker else R.string.ground_truth_edit_marker)) },
+            text = {
+                Column(verticalArrangement = Arrangement.spacedBy(10.dp)) {
+                    Text(
+                        stringResource(
+                            R.string.ground_truth_marker_times,
+                            diagnosticTime(editor.atMs),
+                            diagnosticTime(markerNowMs),
+                        ),
+                        style = NoopType.headline,
+                    )
+                    Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                        NoopButton("−10 s", kind = NoopButtonKind.Secondary, modifier = Modifier.weight(1f),
+                            onClick = { markerEditor = editor.copy(atMs = editor.atMs - 10_000) })
+                        NoopButton(stringResource(R.string.ground_truth_marker_now_button),
+                            kind = NoopButtonKind.Secondary, modifier = Modifier.weight(1f),
+                            onClick = { markerEditor = editor.copy(atMs = markerNowMs) })
+                        NoopButton("+10 s", kind = NoopButtonKind.Secondary, modifier = Modifier.weight(1f),
+                            onClick = { markerEditor = editor.copy(atMs = editor.atMs + 10_000) })
+                    }
+                    listOf(
+                        listOf(MARKER_MOMENT to R.string.ground_truth_marker_moment, MARKER_START to R.string.ground_truth_marker_start),
+                        listOf(MARKER_END to R.string.ground_truth_marker_end, MARKER_ISSUE to R.string.ground_truth_marker_issue),
+                    ).forEach { row ->
+                        Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                            row.forEach { (type, label) ->
+                                NoopButton(stringResource(label),
+                                    kind = if (editor.type == type) NoopButtonKind.Primary else NoopButtonKind.Secondary,
+                                    modifier = Modifier.weight(1f), onClick = { markerEditor = editor.copy(type = type) })
+                            }
+                        }
+                    }
+                    OutlinedTextField(editor.text, { markerEditor = editor.copy(text = it.take(500)) },
+                        label = { Text(stringResource(R.string.ground_truth_marker_note)) }, modifier = Modifier.fillMaxWidth(), minLines = 2)
+                }
+            },
+            dismissButton = {
+                Row {
+                    if (editor.markerId != null) TextButton(onClick = {
+                        collector.deleteMarker(editor.sessionId, editor.markerId); sessions = collector.sessions(); markerEditor = null
+                    }) { Text(stringResource(R.string.ground_truth_delete_confirm), color = Palette.statusCritical) }
+                    TextButton(onClick = { markerEditor = null }) { Text(stringResource(R.string.ground_truth_cancel)) }
+                }
+            },
+            confirmButton = { TextButton(onClick = {
+                if (editor.markerId == null) collector.addMarker(editor.sessionId, editor.atMs, editor.type, editor.text)
+                else collector.updateMarker(editor.sessionId, GroundTruthCollector.Marker(editor.markerId, editor.atMs, editor.type, editor.text))
+                sessions = collector.sessions(); markerEditor = null
+            }) { Text(stringResource(R.string.ground_truth_save)) } },
+        )
+    }
+}
+
+@Composable
+private fun SessionCard(
+    session: GroundTruthCollector.SessionSummary,
+    latestSensorTs: Long?,
+    stats: GroundTruthCollector.CaptureStats?,
+    exporting: Boolean,
+    onComment: (String) -> Unit,
+    onExport: () -> Unit,
+    onDelete: () -> Unit,
+    onAddMarker: () -> Unit,
+    onEditMarker: (GroundTruthCollector.Marker) -> Unit,
+    onEditStart: () -> Unit,
+    onEditEnd: () -> Unit,
+) {
+    val time = remember(session.startedAtMs, session.endedAtMs) { sessionTimeRange(session) }
+    NoopCard {
+        Column(verticalArrangement = Arrangement.spacedBy(10.dp)) {
+            val sensorCovered = session.endedAtMs?.let { end -> latestSensorTs?.times(1000)?.let { it >= end } } == true
+            val captureReady = stats?.complete == true
+            Text(
+                when {
+                    session.endedAtMs == null -> stringResource(R.string.ground_truth_recording,
+                        stats?.let { coverageText(it) } ?: stringResource(R.string.ground_truth_waiting_imu))
+                    captureReady -> stringResource(R.string.ground_truth_ready_complete)
+                    stats != null && stats.coveredSeconds > 0 -> stringResource(R.string.ground_truth_ready_missing, stats.missingSeconds)
+                    !sensorCovered -> stringResource(R.string.ground_truth_waiting_history, diagnosticTime(requireNotNull(session.endedAtMs)))
+                    else -> stringResource(R.string.ground_truth_ready_no_imu)
+                },
+                style = NoopType.caption,
+                color = if (captureReady) Palette.statusPositive else Palette.statusCritical,
+            )
+            Text(time, style = NoopType.headline, color = Palette.textPrimary)
+            Text(stringResource(R.string.ground_truth_duration_size,
+                formatDuration((session.endedAtMs ?: System.currentTimeMillis()) - session.startedAtMs), formatBytes(stats?.bytes ?: 0)),
+                style = NoopType.caption, color = Palette.textSecondary)
+            session.lastExportedAtMs?.let { Text(stringResource(R.string.ground_truth_last_exported, diagnosticTime(it)),
+                style = NoopType.caption, color = Palette.statusPositive) }
+            if (!session.active) {
+                Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.spacedBy(12.dp)) {
+                    NoopButton(
+                        text = stringResource(R.string.ground_truth_edit_start),
+                        kind = NoopButtonKind.Secondary,
+                        modifier = Modifier.weight(1f),
+                        onClick = onEditStart,
+                    )
+                    NoopButton(
+                        text = stringResource(R.string.ground_truth_edit_end),
+                        kind = NoopButtonKind.Secondary,
+                        modifier = Modifier.weight(1f),
+                        onClick = onEditEnd,
+                    )
+                }
+            }
+            NoopButton(stringResource(R.string.ground_truth_add_marker), kind = NoopButtonKind.Secondary, fullWidth = true, onClick = onAddMarker)
+            session.markers.forEach { marker ->
+                TextButton(onClick = { onEditMarker(marker) }, modifier = Modifier.fillMaxWidth()) {
+                    Text(stringResource(R.string.ground_truth_marker_row, diagnosticTime(marker.atMs),
+                        markerTypeLabel(marker.type), marker.text.takeIf(String::isNotBlank)
+                            ?.let { stringResource(R.string.ground_truth_marker_note_suffix, it) }.orEmpty()))
+                }
+            }
+            OutlinedTextField(
+                value = session.comment,
+                onValueChange = onComment,
+                label = { Text(stringResource(R.string.ground_truth_comment)) },
+                modifier = Modifier.fillMaxWidth(),
+                minLines = 2,
+                maxLines = 4,
+            )
+            if (session.deviceId == null) {
+                Text(stringResource(R.string.ground_truth_legacy_no_sensors), style = NoopType.caption, color = Palette.textSecondary)
+            }
+            NoopButton(
+                text = if (exporting) stringResource(R.string.ground_truth_exporting) else stringResource(R.string.ground_truth_export),
+                kind = NoopButtonKind.Secondary,
+                fullWidth = true,
+                enabled = !session.active && !exporting,
+                onClick = onExport,
+            )
+            NoopButton(
+                text = stringResource(R.string.ground_truth_delete_session),
+                kind = NoopButtonKind.Destructive,
+                fullWidth = true,
+                enabled = !session.active && !exporting,
+                onClick = onDelete,
+            )
+        }
+    }
+}
+
+private fun sessionTimeRange(session: GroundTruthCollector.SessionSummary): String {
+    val date = java.text.DateFormat.getDateInstance(java.text.DateFormat.SHORT)
+    val time = java.text.DateFormat.getTimeInstance(java.text.DateFormat.SHORT)
+    val from = java.util.Date(session.startedAtMs)
+    val to = session.endedAtMs?.let { java.util.Date(it) }
+    return if (to == null) {
+        "${date.format(from)} · ${time.format(from)}–…"
+    } else {
+        "${date.format(from)} · ${time.format(from)}–${time.format(to)}"
+    }
+}
+
+private fun pickDateTime(
+    context: Context,
+    initialMs: Long,
+    minimumMs: Long,
+    maximumMs: Long,
+    onPicked: (Long) -> Unit,
+) {
+    val initial = java.util.Calendar.getInstance().apply { timeInMillis = initialMs }
+    val dateDialog = DatePickerDialog(context, { _, year, month, day ->
+        TimePickerDialog(context, { _, hour, minute ->
+            val picked = java.util.Calendar.getInstance().apply {
+                set(year, month, day, hour, minute, 0)
+                set(java.util.Calendar.MILLISECOND, 0)
+            }.timeInMillis.coerceIn(minimumMs, maximumMs)
+            onPicked(picked)
+        }, initial.get(java.util.Calendar.HOUR_OF_DAY), initial.get(java.util.Calendar.MINUTE),
+            android.text.format.DateFormat.is24HourFormat(context)).show()
+    }, initial.get(java.util.Calendar.YEAR), initial.get(java.util.Calendar.MONTH),
+        initial.get(java.util.Calendar.DAY_OF_MONTH))
+    dateDialog.datePicker.minDate = minimumMs
+    dateDialog.datePicker.maxDate = maximumMs
+    dateDialog.show()
+}
+
+private fun diagnosticTime(epochMs: Long): String =
+    java.text.SimpleDateFormat("HH:mm:ss", java.util.Locale.getDefault()).format(java.util.Date(epochMs))
+
+private fun diagnosticAge(epochMs: Long): String {
+    val seconds = ((System.currentTimeMillis() - epochMs).coerceAtLeast(0L) / 1_000L)
+    return when {
+        seconds < 60 -> "${seconds}s"
+        seconds < 3_600 -> "${seconds / 60}m ${seconds % 60}s"
+        else -> "${seconds / 3_600}h ${(seconds % 3_600) / 60}m"
+    }
+}
+
+private data class MarkerEditor(
+    val sessionId: String,
+    val markerId: String?,
+    val atMs: Long,
+    val type: String,
+    val text: String,
+)
+
+private fun formatDuration(milliseconds: Long): String {
+    val seconds = milliseconds.coerceAtLeast(0) / 1_000
+    val hours = seconds / 3_600
+    val minutes = (seconds % 3_600) / 60
+    val tail = seconds % 60
+    return if (hours > 0) "%d:%02d:%02d".format(hours, minutes, tail) else "%d:%02d".format(minutes, tail)
+}
+
+private fun formatBytes(bytes: Long): String = when {
+    bytes >= 1024L * 1024L -> "%.1f MB".format(bytes / (1024.0 * 1024.0))
+    bytes >= 1024L -> "%.1f KB".format(bytes / 1024.0)
+    else -> "$bytes B"
+}
+
+@Composable
+private fun coverageText(stats: GroundTruthCollector.CaptureStats): String {
+    val percent = if (stats.expectedSeconds == 0) 0.0 else 100.0 * stats.coveredSeconds / stats.expectedSeconds
+    val startup = if (stats.startupSeconds > 0) stringResource(R.string.ground_truth_coverage_startup, stats.startupSeconds) else ""
+    return stringResource(R.string.ground_truth_coverage, stats.coveredSeconds, stats.expectedSeconds,
+        percent, stats.missingSeconds, startup)
+}
+
+@Composable
+private fun markerTypeLabel(type: String): String = stringResource(when (type.lowercase()) {
+    MARKER_START -> R.string.ground_truth_marker_start
+    MARKER_END -> R.string.ground_truth_marker_end
+    MARKER_ISSUE -> R.string.ground_truth_marker_issue
+    else -> R.string.ground_truth_marker_moment
+})
+
+private const val MARKER_MOMENT = "moment"
+private const val MARKER_START = "start"
+private const val MARKER_END = "end"
+private const val MARKER_ISSUE = "issue"
+
+private const val EARLIEST_EXPORT_MS = 946_684_800_000L
diff --git a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
index 225c67ef47..4c886c341a 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
@@ -529,8 +529,6 @@ fun SettingsScreen(
     // callee's error handling - a throw would strand the button disabled behind a spinner that never
     // stops, with no way back short of leaving the screen.
     var strapLogBusy by remember { mutableStateOf(false) }
-    var whoop5CaptureBusy by remember { mutableStateOf(false) }
-    var rawAndLogBusy by remember { mutableStateOf(false) }
 
     // Re-scan must request the runtime Bluetooth permission before scanning — without this the
     // button calls connect() directly and silently no-ops on Android 12+ when the permission was
@@ -573,7 +571,6 @@ fun SettingsScreen(
     // SharedPreferences isn't reactive, so the Switch drives a local mutableState that the store reads.
     val puffinExperiment = remember { PuffinExperiment.from(context) }
     var puffinExperiments by remember(rev) { mutableStateOf(puffinExperiment.isEnabled) }
-    var puffinCapture by remember(rev) { mutableStateOf(puffinExperiment.isCaptureEnabled) }
     var deepData by remember(rev) { mutableStateOf(puffinExperiment.isDeepDataEnabled) }
 
     // #174: set when the deep-data switch is turned OFF, so the app can OFFER to clear the flags on the
@@ -2245,11 +2242,13 @@ fun SettingsScreen(
             )
         }
         // --- Experimental · WHOOP 5 / MG --- (hidden when the user is confidently on a 4.0, #22)
-        if (showFiveMGControls) {
+        // Developer-only 5/MG controls now live in Test Centre. Keep the implementation below during
+        // the compatibility transition, but never render a second copy in everyday Settings.
+        if (false && showFiveMGControls) {
         SettingsCard(
             icon = Icons.Filled.Science,
             title = uiString(R.string.l10n_settings_screen_experimental_whoop_5_mg_41ef7041),
-            blurb = "Live heart rate already works on a WHOOP 5/MG strap. These probes go further and try to coax more out of it. They are guesses, off by default, and only ever touch a 5/MG strap. WHOOP 4.0 is never affected.",
+            blurb = "Normal WHOOP 5/MG recording and history sync are supported. These remaining controls are developer experiments for unmapped protocol features; they are not required for everyday use.",
         ) {
             Column(verticalArrangement = Arrangement.spacedBy(10.dp)) {
                 Row(
@@ -2596,86 +2595,11 @@ fun SettingsScreen(
                     }
                 }
 
-                Row(
-                    modifier = Modifier.fillMaxWidth(),
-                    verticalAlignment = Alignment.CenterVertically,
-                    horizontalArrangement = Arrangement.spacedBy(16.dp),
-                ) {
-                    Text(
-                        uiString(R.string.l10n_settings_screen_record_5_mg_raw_capture_research_1d966bbf),
-                        style = NoopType.subhead,
-                        color = Palette.textPrimary,
-                        modifier = Modifier.weight(1f),
-                    )
-                    Switch(
-                        checked = puffinCapture,
-                        onCheckedChange = {
-                            puffinCapture = it
-                            puffinExperiment.isCaptureEnabled = it
-                        },
-                        colors = SwitchDefaults.colors(
-                            checkedThumbColor = Palette.surfaceBase,
-                            checkedTrackColor = Palette.accent,
-                            uncheckedThumbColor = Palette.textSecondary,
-                            uncheckedTrackColor = Palette.surfaceInset,
-                            uncheckedBorderColor = Palette.hairline,
-                        ),
-                        modifier = Modifier.semantics {
-                            contentDescription = uiString(R.string.l10n_settings_screen_record_5_mg_raw_capture_9354fe89)
-                        },
-                    )
-                }
                 Text(
-                    uiString(R.string.l10n_settings_screen_records_the_raw_frames_of_each_98a284df),
+                    uiString(R.string.raw_diag_moved),
                     style = NoopType.caption,
                     color = Palette.textTertiary,
                 )
-                NoopButton(
-                    text = uiString(R.string.l10n_settings_screen_share_5_mg_capture_for_the_e41ac6bd),
-                    leadingIcon = Icons.Filled.Upload,
-                    kind = NoopButtonKind.Secondary,
-                    fullWidth = true,
-                    enabled = !whoop5CaptureBusy,
-                    onClick = {
-                        whoop5CaptureBusy = true
-                        scope.launch {
-                            // try/finally: the flag must clear on any exit, not just the happy path (#961 follow-up).
-                            try {
-                                LogExport.shareWhoop5Capture(context, live.whoop5Detected, live.encryptedBond)
-                            } finally {
-                                whoop5CaptureBusy = false
-                            }
-                        }
-                    },
-                )
-                if (whoop5CaptureBusy) {
-                    NoopBusyRow()
-                }
-
-                // One-tap "matched pair" export (#510): hands a reporter BOTH the raw capture file and
-                // the strap log together (timestamped, same minute) so a protocol-mapping issue arrives
-                // with the frames AND the context that produced them.
-                NoopButton(
-                    text = uiString(R.string.l10n_settings_screen_export_raw_log_matched_pair_d65390bf),
-                    leadingIcon = Icons.Filled.IosShare,
-                    kind = NoopButtonKind.Secondary,
-                    fullWidth = true,
-                    enabled = !rawAndLogBusy,
-                    onClick = {
-                        rawAndLogBusy = true
-                        scope.launch {
-                            // try/finally: the flag must clear on any exit, not just the happy path (#961 follow-up).
-                            try {
-                                LogExport.shareRawAndLog(context, vm.ble.exportLogText(), live.whoop5Detected, live.encryptedBond)
-                            } finally {
-                                rawAndLogBusy = false
-                            }
-                        }
-                    },
-                )
-                if (rawAndLogBusy) {
-                    NoopBusyRow()
-                }
             }
         }
         } // end if (showFiveMGControls)
diff --git a/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt b/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
index 846e760fc8..00898ebdc1 100644
--- a/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
@@ -18,6 +18,7 @@ import androidx.compose.material.icons.filled.Autorenew
 import androidx.compose.material.icons.filled.BugReport
 import androidx.compose.material.icons.filled.DeleteOutline
 import androidx.compose.material.icons.filled.Info
+import androidx.compose.material.icons.automirrored.filled.DirectionsWalk
 import androidx.compose.material.icons.filled.Science
 import androidx.compose.material.icons.filled.Upload
 import androidx.compose.material3.AlertDialog
@@ -80,7 +81,7 @@ import kotlin.math.roundToInt
  * scheduled-export / experimental controls on the same bindings the Settings cards use. No em-dash.
  */
 @Composable
-fun TestCentreScreen(vm: AppViewModel) {
+fun TestCentreScreen(vm: AppViewModel, onOpenGroundTruthCollector: () -> Unit = {}) {
     val context = LocalContext.current
     val testCentre = remember { TestCentre.from(context) }
     // CAPTURE-D: a UI scope to emit the data-volume line off the toggle-on path (a store read, so it can't
@@ -97,6 +98,18 @@ fun TestCentreScreen(vm: AppViewModel) {
     // Match the Settings `showFiveMGControls` gate exactly: pref OR a live-detected 5/MG this session, so a
     // 5/MG connected before its pref is written still sees the experimental block. (SettingsScreen.kt:346.)
     val is5MG = selectedModelName == WhoopModel.WHOOP5_MG.name || live.whoop5Detected
+    val puffinExperiment = remember { PuffinExperiment.from(context) }
+    var protocolProbes by remember { mutableStateOf(puffinExperiment.isEnabled) }
+    var passiveRawCapture by remember { mutableStateOf(puffinExperiment.isCaptureEnabled) }
+    var deepData by remember { mutableStateOf(puffinExperiment.isDeepDataEnabled) }
+    var broadcastHr by remember { mutableStateOf(puffinExperiment.broadcastHr) }
+    var explicitBond by remember { mutableStateOf(puffinExperiment.explicitBond) }
+    var ecgRawData by remember { mutableStateOf(puffinExperiment.ecgRawData) }
+    val r22DisableReport by vm.ble.r22DisableReport.collectAsStateWithLifecycle()
+    val ecgGateReport by vm.ble.ecgRawDataGate.collectAsStateWithLifecycle()
+    val ecgVariant by vm.ble.whoop5VariantFlow.collectAsStateWithLifecycle()
+    var rawCaptureBusy by remember { mutableStateOf(false) }
+    var rawAndLogBusy by remember { mutableStateOf(false) }
 
     // A report awaiting the mandatory review-before-share gate (spec section 12). Non-null shows the
     // review dialog; confirming runs TestReportFlow.run.
@@ -182,6 +195,159 @@ fun TestCentreScreen(vm: AppViewModel) {
         // --- Section 2: Diagnostic tools ---
         DiagnosticToolsCard(vm)
 
+        SettingsSectionTC(
+            icon = Icons.AutoMirrored.Filled.DirectionsWalk,
+            title = stringResource(R.string.ground_truth_title),
+            blurb = stringResource(R.string.ground_truth_test_centre_desc),
+        ) {
+            NoopButton(
+                text = stringResource(R.string.ground_truth_open),
+                kind = NoopButtonKind.Secondary,
+                fullWidth = true,
+                onClick = onOpenGroundTruthCollector,
+            )
+        }
+
+        if (is5MG) {
+            SettingsSectionTC(
+                icon = Icons.Filled.Science,
+                title = stringResource(R.string.raw_diag_title),
+                blurb = "Developer tools for protocol research. These are separate from the bounded Raw Data Collector above.",
+            ) {
+                Column(verticalArrangement = Arrangement.spacedBy(12.dp)) {
+                    DeveloperToggleRow(
+                        title = stringResource(R.string.raw_diag_protocol_probes),
+                        detail = "Sends experimental protocol queries. It is not needed for normal WHOOP 5/MG sync, sleep, recovery, or steps.",
+                        checked = protocolProbes,
+                        onCheckedChange = {
+                            protocolProbes = it
+                            puffinExperiment.isEnabled = it
+                        },
+                    )
+                    DeveloperToggleRow(
+                        title = stringResource(R.string.raw_diag_broadcast_hr),
+                        detail = "Writes the reversible WHOOP 5/MG advertising flag for Garmin, Zwift, and gym equipment.",
+                        checked = broadcastHr,
+                        onCheckedChange = {
+                            broadcastHr = it
+                            puffinExperiment.broadcastHr = it
+                            vm.ble.setBroadcastHr(it)
+                        },
+                    )
+                    DeveloperToggleRow(
+                        title = stringResource(R.string.raw_diag_pair),
+                        detail = "Experimental explicit Android bonding. Normal 5/MG support does not require this switch.",
+                        checked = explicitBond,
+                        onCheckedChange = {
+                            explicitBond = it
+                            puffinExperiment.explicitBond = it
+                        },
+                    )
+                    DeveloperToggleRow(
+                        title = stringResource(R.string.raw_diag_r22),
+                        detail = "Accepted writes have not been shown to enable a separate live stream. Not required for normal sync or raw capture.",
+                        checked = deepData,
+                        onCheckedChange = {
+                            deepData = it
+                            puffinExperiment.isDeepDataEnabled = it
+                        },
+                    )
+                    if (deepData) {
+                        NoopButton(
+                            text = stringResource(R.string.raw_diag_r22_enable),
+                            kind = NoopButtonKind.Secondary,
+                            fullWidth = true,
+                            enabled = live.encryptedBond && live.worn,
+                            onClick = { vm.ble.enableWhoop5DeepData() },
+                        )
+                    }
+                    NoopButton(
+                        text = stringResource(R.string.raw_diag_r22_clear),
+                        kind = NoopButtonKind.Secondary,
+                        fullWidth = true,
+                        enabled = live.encryptedBond && r22DisableReport != WhoopBleClient.WAITING_DEVICE_CONFIG_PROBE,
+                        onClick = { vm.ble.disableWhoop5DeepData() },
+                    )
+                    r22DisableReport?.let {
+                        Text(it, style = NoopType.caption, color = Palette.textSecondary)
+                    }
+                    DeveloperToggleRow(
+                        title = stringResource(R.string.raw_diag_ecg),
+                        detail = "MG-only protocol research. This is instrumentation, not a medical ECG feature.",
+                        checked = ecgRawData,
+                        onCheckedChange = {
+                            ecgRawData = it
+                            puffinExperiment.ecgRawData = it
+                        },
+                    )
+                    if (ecgRawData) {
+                        Row(horizontalArrangement = Arrangement.spacedBy(12.dp)) {
+                            NoopButton(
+                                text = stringResource(R.string.raw_diag_ecg_on),
+                                kind = NoopButtonKind.Secondary,
+                                enabled = live.bonded && ecgVariant.isMG,
+                                onClick = { vm.ble.setEcgRawDataGate(true) },
+                            )
+                            NoopButton(
+                                text = stringResource(R.string.raw_diag_ecg_off),
+                                kind = NoopButtonKind.Secondary,
+                                enabled = live.bonded && ecgVariant.isMG,
+                                onClick = { vm.ble.setEcgRawDataGate(false) },
+                            )
+                        }
+                        ecgGateReport?.let {
+                            Text(it.summary, style = NoopType.caption, color = Palette.textSecondary)
+                        }
+                    }
+                    DeveloperToggleRow(
+                        title = stringResource(R.string.raw_diag_passive),
+                        detail = "Records frames that already arrive during history sync. It does not start IMU or any other sensor and may create large files.",
+                        checked = passiveRawCapture,
+                        onCheckedChange = {
+                            passiveRawCapture = it
+                            puffinExperiment.isCaptureEnabled = it
+                        },
+                    )
+                    NoopButton(
+                        text = stringResource(R.string.raw_diag_share),
+                        leadingIcon = Icons.Filled.Upload,
+                        kind = NoopButtonKind.Secondary,
+                        fullWidth = true,
+                        enabled = !rawCaptureBusy,
+                        onClick = {
+                            rawCaptureBusy = true
+                            scope.launch {
+                                try {
+                                    LogExport.shareWhoop5Capture(context, live.whoop5Detected, live.encryptedBond)
+                                } finally {
+                                    rawCaptureBusy = false
+                                }
+                            }
+                        },
+                    )
+                    NoopButton(
+                        text = stringResource(R.string.raw_diag_export_log),
+                        leadingIcon = Icons.Filled.Upload,
+                        kind = NoopButtonKind.Secondary,
+                        fullWidth = true,
+                        enabled = !rawAndLogBusy,
+                        onClick = {
+                            rawAndLogBusy = true
+                            scope.launch {
+                                try {
+                                    LogExport.shareRawAndLog(
+                                        context, vm.ble.exportLogText(), live.whoop5Detected, live.encryptedBond,
+                                    )
+                                } finally {
+                                    rawAndLogBusy = false
+                                }
+                            }
+                        },
+                    )
+                }
+            }
+        }
+
         // --- Section 3: Export and auto-export ---
         ExportCard(
             vm = vm,
@@ -230,6 +396,26 @@ fun TestCentreScreen(vm: AppViewModel) {
     }
 }
 
+@Composable
+private fun DeveloperToggleRow(
+    title: String,
+    detail: String,
+    checked: Boolean,
+    onCheckedChange: (Boolean) -> Unit,
+) {
+    Row(
+        modifier = Modifier.fillMaxWidth(),
+        verticalAlignment = Alignment.CenterVertically,
+        horizontalArrangement = Arrangement.spacedBy(16.dp),
+    ) {
+        Column(modifier = Modifier.weight(1f), verticalArrangement = Arrangement.spacedBy(3.dp)) {
+            Text(title, style = NoopType.subhead, color = Palette.textPrimary)
+            Text(detail, style = NoopType.caption, color = Palette.textSecondary)
+        }
+        Switch(checked = checked, onCheckedChange = onCheckedChange)
+    }
+}
+
 /** A report staged for the mandatory review gate: the profile, its title, the already-redacted entries
  *  and the gate built over them. The Kotlin gate keeps its entries private, so we hold them here too to
  *  hand TestReportFlow.run the same list it reviews. [modeInactive] (#1002): the selected profile's test
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 5ee513b4b9..d1d2c32fe2 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2552,6 +2552,79 @@
     <string name="l10n_settings_screen_ask_android_to_pair_experimental_250a81e9">Android um Kopplung bitten (experimentell)</string>
     <string name="l10n_settings_screen_noop_has_always_hoped_that_writing_19967036">NOOP hat bisher darauf gesetzt, dass ein Schreibvorgang an dein 5.0/MG Android zur Kopplung veranlasst. Das passiert nie. Diese Option fragt Android direkt und kann einen System-Kopplungsdialog anzeigen. Die Live-Herzfrequenz funktioniert in beiden Fällen weiter; schalte sie aus, wenn der Dialog stört.</string>
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">Android um Kopplung bitten</string>
+    <string name="ground_truth_title">5/MG-Rohdaten-Collector</string>
+    <string name="ground_truth_subtitle">Zeichnet eine begrenzte Bewegungssession mit 100 Hz auf, ergänzt Bluetooth-Lücken aus dem Strap-Verlauf und exportiert die vollständige Zeitachse.</string>
+    <string name="ground_truth_test_centre_desc">Zeichne eine begrenzte 5/MG-Bewegungsaufnahme mit 100 Hz auf, markiere, vervollständige und exportiere sie.</string>
+    <string name="ground_truth_open">Rohdaten-Collector öffnen</string>
+    <string name="ground_truth_start">Rohdaten-Session starten</string>
+    <string name="ground_truth_add_historical">Vergangenes Zeitfenster hinzufügen</string>
+    <string name="ground_truth_stop">Session beenden</string>
+    <string name="ground_truth_export">Session exportieren</string>
+    <string name="ground_truth_exporting">Export wird erstellt…</string>
+    <string name="ground_truth_export_failed">Session konnte nicht exportiert werden: %1$s</string>
+    <string name="ground_truth_sessions">Aufgezeichnete Sessions</string>
+    <string name="ground_truth_no_sessions">Noch keine Sessions aufgezeichnet.</string>
+    <string name="ground_truth_comment">Kommentar zur Session</string>
+    <string name="ground_truth_delete_session">Session löschen</string>
+    <string name="ground_truth_delete_session_title">Diese Session löschen?</string>
+    <string name="ground_truth_delete_session_message">Die Session %1$s und ihre aufgezeichneten Rohdaten werden dauerhaft gelöscht.</string>
+    <string name="ground_truth_delete_all">Alle Sessions löschen</string>
+    <string name="ground_truth_delete_all_title">Alle Sessions löschen?</string>
+    <string name="ground_truth_delete_all_message">Alle %1$d aufgezeichneten Sessions und ihre Rohdaten werden dauerhaft gelöscht.</string>
+    <string name="ground_truth_delete_confirm">Löschen</string>
+    <string name="ground_truth_cancel">Abbrechen</string>
+    <string name="ground_truth_edit_start">Start ändern</string>
+    <string name="ground_truth_edit_end">Ende ändern</string>
+    <string name="ground_truth_legacy_no_sensors">Ältere Session: Ereignisse können exportiert werden, der zugehörige Strap für Sensordaten ist aber nicht mehr eindeutig.</string>
+    <string name="ground_truth_capture_status">Aufnahmestatus</string>
+    <string name="ground_truth_recording">Aufnahme · %1$s</string>
+    <string name="ground_truth_imu_coverage">IMU %1$s · %2$s</string>
+    <string name="ground_truth_band_connected_paired">Band: verbunden + gekoppelt</string>
+    <string name="ground_truth_band_connected_pairing">Band: verbunden; Kopplung läuft</string>
+    <string name="ground_truth_band_disconnected">Band: getrennt</string>
+    <string name="ground_truth_band_searching">Band: getrennt; Suche läuft</string>
+    <string name="ground_truth_history_running">Verlaufssynchronisierung läuft (%1$d Blöcke)</string>
+    <string name="ground_truth_history_completed">Verlauf synchronisiert: %1$s</string>
+    <string name="ground_truth_history_none">Noch keine abgeschlossene Verlaufssynchronisierung</string>
+    <string name="ground_truth_sensors_behind">Dekodierte 1-Hz-Sensoren: %1$s zurück</string>
+    <string name="ground_truth_sensors_none">Dekodierte 1-Hz-Sensoren: keine</string>
+    <string name="ground_truth_realtime_imu">Echtzeit-IMU: %1$s; %2$d Pakete / %3$d Bytes%4$s</string>
+    <string name="ground_truth_realtime_last">; zuletzt vor %1$s</string>
+    <string name="ground_truth_add_marker">Marker hinzufügen</string>
+    <string name="ground_truth_edit_marker">Marker bearbeiten</string>
+    <string name="ground_truth_marker_moment">Moment</string>
+    <string name="ground_truth_marker_start">Start</string>
+    <string name="ground_truth_marker_end">Ende</string>
+    <string name="ground_truth_marker_issue">Problem</string>
+    <string name="ground_truth_marker_note">Marker-Notiz</string>
+    <string name="ground_truth_save">Speichern</string>
+    <string name="ground_truth_waiting_imu">warte auf IMU</string>
+    <string name="ground_truth_ready_complete">Exportbereit · vollständig</string>
+    <string name="ground_truth_ready_missing">Exportbereit mit %1$d s Lücke · Verlauf kann sie ergänzen</string>
+    <string name="ground_truth_waiting_history">Warte auf Verlauf bis %1$s</string>
+    <string name="ground_truth_ready_no_imu">Exportbereit ohne IMU-Daten</string>
+    <string name="ground_truth_duration_size">%1$s · IMU %2$s</string>
+    <string name="ground_truth_last_exported">Zuletzt exportiert: %1$s · weiterer Export möglich</string>
+    <string name="ground_truth_coverage">%1$d/%2$d s · %3$.1f%% · %4$d s fehlen%5$s</string>
+    <string name="ground_truth_coverage_startup"> · %1$d s Anlauf</string>
+    <string name="ground_truth_marker_row">%1$s · %2$s%3$s</string>
+    <string name="ground_truth_marker_note_suffix"> · %1$s</string>
+    <string name="ground_truth_marker_times">Marker %1$s · Jetzt %2$s</string>
+    <string name="ground_truth_marker_now_button">0</string>
+    <string name="raw_diag_title">5/MG-Protokolldiagnose</string>
+    <string name="raw_diag_protocol_probes">Protokolltests</string>
+    <string name="raw_diag_broadcast_hr">Herzfrequenz vom Band übertragen</string>
+    <string name="raw_diag_pair">Android um Kopplung bitten</string>
+    <string name="raw_diag_r22">Altes R22-Feature-Flag-Experiment</string>
+    <string name="raw_diag_r22_enable">Alte R22-Aktivierungssequenz senden</string>
+    <string name="raw_diag_r22_clear">R22-Flags auf dem Band löschen</string>
+    <string name="raw_diag_ecg">WHOOP-MG-Schalter für ECG-Rohdaten</string>
+    <string name="raw_diag_ecg_on">ECG-Schalter einschalten</string>
+    <string name="raw_diag_ecg_off">ECG-Schalter ausschalten</string>
+    <string name="raw_diag_passive">Passive Verlaufs-/Protokollaufzeichnung</string>
+    <string name="raw_diag_share">Passive Rohaufzeichnung teilen</string>
+    <string name="raw_diag_export_log">Passive Aufzeichnung und Bandprotokoll exportieren</string>
+    <string name="raw_diag_moved">Rohdatenaufnahme und Protokollexporte befinden sich jetzt im Testcenter unter 5/MG-Protokolldiagnose.</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Hello trotz Kopplungsverweigerung senden (experimentell)</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Hello trotz Kopplungsverweigerung senden</string>
     <string name="l10n_settings_screen_check_automatically_7cd229d2">Automatisch prüfen</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 5a5f2b3d9b..9e5bc34f98 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2538,6 +2538,79 @@
     <string name="l10n_settings_screen_ask_android_to_pair_experimental_250a81e9">Pedir a Android que vincule (experimental)</string>
     <string name="l10n_settings_screen_noop_has_always_hoped_that_writing_19967036">NOOP siempre ha confiado en que escribir en tu 5.0/MG hiciera que Android lo vinculara. Nunca ocurre. Esta opción se lo pide a Android directamente, por lo que puede mostrar un diálogo de vinculación del sistema. La frecuencia cardíaca en directo sigue funcionando igualmente; desactívala si el diálogo molesta.</string>
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">Pedir a Android que vincule</string>
+    <string name="ground_truth_title">Recopilador de datos sin procesar 5/MG</string>
+    <string name="ground_truth_subtitle">Graba una sesión de movimiento limitada a 100 Hz, recupera los cortes de Bluetooth del historial de la pulsera y exporta la cronología completa.</string>
+    <string name="ground_truth_test_centre_desc">Graba, anota, recupera y exporta una captura de movimiento 5/MG limitada a 100 Hz.</string>
+    <string name="ground_truth_open">Abrir recopilador de datos</string>
+    <string name="ground_truth_start">Iniciar sesión de datos</string>
+    <string name="ground_truth_add_historical">Añadir intervalo pasado</string>
+    <string name="ground_truth_stop">Detener sesión</string>
+    <string name="ground_truth_export">Exportar sesión</string>
+    <string name="ground_truth_exporting">Creando exportación…</string>
+    <string name="ground_truth_export_failed">No se pudo exportar la sesión: %1$s</string>
+    <string name="ground_truth_sessions">Sesiones grabadas</string>
+    <string name="ground_truth_no_sessions">Aún no hay sesiones grabadas.</string>
+    <string name="ground_truth_comment">Comentario de la sesión</string>
+    <string name="ground_truth_delete_session">Eliminar sesión</string>
+    <string name="ground_truth_delete_session_title">¿Eliminar esta sesión?</string>
+    <string name="ground_truth_delete_session_message">La sesión %1$s y sus datos capturados se eliminarán permanentemente.</string>
+    <string name="ground_truth_delete_all">Eliminar todas las sesiones</string>
+    <string name="ground_truth_delete_all_title">¿Eliminar todas las sesiones?</string>
+    <string name="ground_truth_delete_all_message">Las %1$d sesiones grabadas y sus datos capturados se eliminarán permanentemente.</string>
+    <string name="ground_truth_delete_confirm">Eliminar</string>
+    <string name="ground_truth_cancel">Cancelar</string>
+    <string name="ground_truth_edit_start">Editar inicio</string>
+    <string name="ground_truth_edit_end">Editar fin</string>
+    <string name="ground_truth_legacy_no_sensors">Sesión antigua: se pueden exportar eventos, pero no se puede identificar su pulsera para exportar sensores.</string>
+    <string name="ground_truth_capture_status">Estado de captura</string>
+    <string name="ground_truth_recording">Grabando · %1$s</string>
+    <string name="ground_truth_imu_coverage">IMU %1$s · %2$s</string>
+    <string name="ground_truth_band_connected_paired">Pulsera: conectada y vinculada</string>
+    <string name="ground_truth_band_connected_pairing">Pulsera: conectada; vinculando</string>
+    <string name="ground_truth_band_disconnected">Pulsera: desconectada</string>
+    <string name="ground_truth_band_searching">Pulsera: desconectada; buscando</string>
+    <string name="ground_truth_history_running">Sincronizando historial (%1$d bloques)</string>
+    <string name="ground_truth_history_completed">Historial sincronizado: %1$s</string>
+    <string name="ground_truth_history_none">No hay ninguna sincronización de historial terminada</string>
+    <string name="ground_truth_sensors_behind">Sensores de 1 Hz decodificados: %1$s de retraso</string>
+    <string name="ground_truth_sensors_none">Sensores de 1 Hz decodificados: ninguno</string>
+    <string name="ground_truth_realtime_imu">IMU en tiempo real: %1$s; %2$d paquetes/%3$d bytes%4$s</string>
+    <string name="ground_truth_realtime_last">; último hace %1$s</string>
+    <string name="ground_truth_add_marker">Añadir marcador</string>
+    <string name="ground_truth_edit_marker">Editar marcador</string>
+    <string name="ground_truth_marker_moment">Momento</string>
+    <string name="ground_truth_marker_start">Inicio</string>
+    <string name="ground_truth_marker_end">Fin</string>
+    <string name="ground_truth_marker_issue">Problema</string>
+    <string name="ground_truth_marker_note">Nota del marcador</string>
+    <string name="ground_truth_save">Guardar</string>
+    <string name="ground_truth_waiting_imu">esperando IMU</string>
+    <string name="ground_truth_ready_complete">Lista para exportar · completa</string>
+    <string name="ground_truth_ready_missing">Lista con %1$d s ausentes · el historial puede recuperarlos</string>
+    <string name="ground_truth_waiting_history">Esperando historial hasta %1$s</string>
+    <string name="ground_truth_ready_no_imu">Lista sin datos IMU</string>
+    <string name="ground_truth_duration_size">%1$s · IMU %2$s</string>
+    <string name="ground_truth_last_exported">Última exportación: %1$s · se puede volver a exportar</string>
+    <string name="ground_truth_coverage">%1$d/%2$d s · %3$.1f%% · faltan %4$d s%5$s</string>
+    <string name="ground_truth_coverage_startup"> · %1$d s de inicio</string>
+    <string name="ground_truth_marker_row">%1$s · %2$s%3$s</string>
+    <string name="ground_truth_marker_note_suffix"> · %1$s</string>
+    <string name="raw_diag_title">Diagnóstico del protocolo 5/MG</string>
+    <string name="raw_diag_protocol_probes">Sondas de protocolo</string>
+    <string name="raw_diag_broadcast_hr">Transmitir frecuencia cardíaca desde la pulsera</string>
+    <string name="raw_diag_pair">Pedir a Android que vincule</string>
+    <string name="raw_diag_r22">Experimento antiguo de indicadores R22</string>
+    <string name="raw_diag_r22_enable">Enviar secuencia de activación R22 antigua</string>
+    <string name="raw_diag_r22_clear">Borrar indicadores R22 de la pulsera</string>
+    <string name="raw_diag_ecg">Control de datos ECG sin procesar de WHOOP MG</string>
+    <string name="raw_diag_ecg_on">Activar control ECG</string>
+    <string name="raw_diag_ecg_off">Desactivar control ECG</string>
+    <string name="raw_diag_passive">Registro pasivo de historial/protocolo</string>
+    <string name="raw_diag_share">Compartir registro pasivo</string>
+    <string name="raw_diag_export_log">Exportar registro pasivo y registro de la pulsera</string>
+    <string name="raw_diag_moved">La captura y sus exportaciones de protocolo están ahora en Centro de pruebas → Diagnóstico del protocolo 5/MG.</string>
+    <string name="ground_truth_marker_times">Marcador %1$s · Ahora %2$s</string>
+    <string name="ground_truth_marker_now_button">0</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Enviar hello pese al rechazo de vinculación (experimental)</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Enviar hello pese al rechazo de vinculación</string>
     <string name="l10n_settings_screen_check_automatically_7cd229d2">Comprobar automáticamente</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 7c485ccfbf..5f79dfba30 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2537,6 +2537,79 @@
     <string name="l10n_settings_screen_ask_android_to_pair_experimental_250a81e9">Demander à Android de s\'appairer (expérimental)</string>
     <string name="l10n_settings_screen_noop_has_always_hoped_that_writing_19967036">NOOP a toujours compté sur l\'écriture vers votre 5.0/MG pour qu\'Android s\'appaire. Cela n\'arrive jamais. Cette option le demande directement à Android et peut afficher une boîte de dialogue d\'appairage du système. La fréquence cardiaque en direct continue de fonctionner dans les deux cas ; désactivez-la si la boîte de dialogue vous gêne.</string>
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">Demander à Android de s\'appairer</string>
+    <string name="ground_truth_title">Collecteur de données brutes 5/MG</string>
+    <string name="ground_truth_subtitle">Enregistrez une session de mouvement limitée à 100 Hz, récupérez les coupures Bluetooth depuis l’historique du bracelet et exportez la chronologie complète.</string>
+    <string name="ground_truth_test_centre_desc">Enregistrez, annotez, récupérez et exportez une capture de mouvement 5/MG limitée à 100 Hz.</string>
+    <string name="ground_truth_open">Ouvrir le collecteur de données</string>
+    <string name="ground_truth_start">Démarrer une session de données</string>
+    <string name="ground_truth_add_historical">Ajouter une plage passée</string>
+    <string name="ground_truth_stop">Arrêter la session</string>
+    <string name="ground_truth_export">Exporter la session</string>
+    <string name="ground_truth_exporting">Création de l’export…</string>
+    <string name="ground_truth_export_failed">Impossible d’exporter la session : %1$s</string>
+    <string name="ground_truth_sessions">Sessions enregistrées</string>
+    <string name="ground_truth_no_sessions">Aucune session enregistrée.</string>
+    <string name="ground_truth_comment">Commentaire de session</string>
+    <string name="ground_truth_delete_session">Supprimer la session</string>
+    <string name="ground_truth_delete_session_title">Supprimer cette session ?</string>
+    <string name="ground_truth_delete_session_message">La session %1$s et ses données capturées seront définitivement supprimées.</string>
+    <string name="ground_truth_delete_all">Supprimer toutes les sessions</string>
+    <string name="ground_truth_delete_all_title">Supprimer toutes les sessions ?</string>
+    <string name="ground_truth_delete_all_message">Les %1$d sessions enregistrées et leurs données capturées seront définitivement supprimées.</string>
+    <string name="ground_truth_delete_confirm">Supprimer</string>
+    <string name="ground_truth_cancel">Annuler</string>
+    <string name="ground_truth_edit_start">Modifier le début</string>
+    <string name="ground_truth_edit_end">Modifier la fin</string>
+    <string name="ground_truth_legacy_no_sensors">Ancienne session : les événements sont exportables, mais le bracelet ne peut pas être identifié pour l’export des capteurs.</string>
+    <string name="ground_truth_capture_status">État de la capture</string>
+    <string name="ground_truth_recording">Enregistrement · %1$s</string>
+    <string name="ground_truth_imu_coverage">IMU %1$s · %2$s</string>
+    <string name="ground_truth_band_connected_paired">Bracelet : connecté et appairé</string>
+    <string name="ground_truth_band_connected_pairing">Bracelet : connecté ; appairage</string>
+    <string name="ground_truth_band_disconnected">Bracelet : déconnecté</string>
+    <string name="ground_truth_band_searching">Bracelet : déconnecté ; recherche</string>
+    <string name="ground_truth_history_running">Synchronisation de l’historique (%1$d blocs)</string>
+    <string name="ground_truth_history_completed">Historique synchronisé : %1$s</string>
+    <string name="ground_truth_history_none">Aucune synchronisation d’historique terminée</string>
+    <string name="ground_truth_sensors_behind">Capteurs 1 Hz décodés : retard de %1$s</string>
+    <string name="ground_truth_sensors_none">Capteurs 1 Hz décodés : aucun</string>
+    <string name="ground_truth_realtime_imu">IMU en temps réel : %1$s ; %2$d paquets/%3$d octets%4$s</string>
+    <string name="ground_truth_realtime_last"> ; dernier il y a %1$s</string>
+    <string name="ground_truth_add_marker">Ajouter un repère</string>
+    <string name="ground_truth_edit_marker">Modifier le repère</string>
+    <string name="ground_truth_marker_moment">Moment</string>
+    <string name="ground_truth_marker_start">Début</string>
+    <string name="ground_truth_marker_end">Fin</string>
+    <string name="ground_truth_marker_issue">Problème</string>
+    <string name="ground_truth_marker_note">Note du repère</string>
+    <string name="ground_truth_save">Enregistrer</string>
+    <string name="ground_truth_waiting_imu">en attente de l’IMU</string>
+    <string name="ground_truth_ready_complete">Prêt à exporter · complet</string>
+    <string name="ground_truth_ready_missing">Prêt avec %1$d s manquantes · l’historique peut les récupérer</string>
+    <string name="ground_truth_waiting_history">En attente de l’historique jusqu’à %1$s</string>
+    <string name="ground_truth_ready_no_imu">Prêt sans données IMU</string>
+    <string name="ground_truth_duration_size">%1$s · IMU %2$s</string>
+    <string name="ground_truth_last_exported">Dernier export : %1$s · nouvel export possible</string>
+    <string name="ground_truth_coverage">%1$d/%2$d s · %3$.1f%% · %4$d s manquantes%5$s</string>
+    <string name="ground_truth_coverage_startup"> · %1$d s de démarrage</string>
+    <string name="ground_truth_marker_row">%1$s · %2$s%3$s</string>
+    <string name="ground_truth_marker_note_suffix"> · %1$s</string>
+    <string name="raw_diag_title">Diagnostics du protocole 5/MG</string>
+    <string name="raw_diag_protocol_probes">Sondes de protocole</string>
+    <string name="raw_diag_broadcast_hr">Diffuser la fréquence cardiaque du bracelet</string>
+    <string name="raw_diag_pair">Demander l’appairage à Android</string>
+    <string name="raw_diag_r22">Ancienne expérience d’indicateurs R22</string>
+    <string name="raw_diag_r22_enable">Envoyer l’ancienne séquence d’activation R22</string>
+    <string name="raw_diag_r22_clear">Effacer les indicateurs R22 du bracelet</string>
+    <string name="raw_diag_ecg">Contrôle des données ECG brutes WHOOP MG</string>
+    <string name="raw_diag_ecg_on">Activer le contrôle ECG</string>
+    <string name="raw_diag_ecg_off">Désactiver le contrôle ECG</string>
+    <string name="raw_diag_passive">Trace passive d’historique/protocole</string>
+    <string name="raw_diag_share">Partager la trace passive</string>
+    <string name="raw_diag_export_log">Exporter la trace passive et le journal du bracelet</string>
+    <string name="raw_diag_moved">La capture brute et ses exports de protocole se trouvent maintenant dans Centre de test → Diagnostics du protocole 5/MG.</string>
+    <string name="ground_truth_marker_times">Repère %1$s · Maintenant %2$s</string>
+    <string name="ground_truth_marker_now_button">0</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Envoyer le hello malgré le refus d\'appairage (expérimental)</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Envoyer le hello malgré le refus d\'appairage</string>
     <string name="l10n_settings_screen_check_automatically_7cd229d2">Vérifier automatiquement</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 6ccee3f22b..2e545c2c07 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2543,6 +2543,79 @@
     <string name="l10n_settings_screen_ask_android_to_pair_experimental_250a81e9">Poproś Androida o sparowanie (eksperymentalne)</string>
     <string name="l10n_settings_screen_noop_has_always_hoped_that_writing_19967036">NOOP zawsze liczył na to, że zapis do 5.0/MG skłoni Androida do sparowania. To się nigdy nie dzieje. Ta opcja prosi Androida bezpośrednio, więc może pojawić się systemowe okno parowania. Tętno na żywo działa tak czy inaczej; wyłącz, jeśli okno przeszkadza.</string>
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">Poproś Androida o sparowanie</string>
+    <string name="ground_truth_title">Rejestrator surowych danych 5/MG</string>
+    <string name="ground_truth_subtitle">Rejestruj ograniczoną sesję ruchu 100 Hz, uzupełniaj przerwy Bluetooth z historii opaski i eksportuj pełną oś czasu.</string>
+    <string name="ground_truth_test_centre_desc">Rejestruj, opisuj, uzupełniaj i eksportuj ograniczone nagrania ruchu 5/MG 100 Hz.</string>
+    <string name="ground_truth_open">Otwórz rejestrator danych</string>
+    <string name="ground_truth_start">Rozpocznij sesję danych</string>
+    <string name="ground_truth_add_historical">Dodaj wcześniejszy zakres czasu</string>
+    <string name="ground_truth_stop">Zatrzymaj sesję</string>
+    <string name="ground_truth_export">Eksportuj sesję</string>
+    <string name="ground_truth_exporting">Tworzenie eksportu…</string>
+    <string name="ground_truth_export_failed">Nie udało się wyeksportować sesji: %1$s</string>
+    <string name="ground_truth_sessions">Zarejestrowane sesje</string>
+    <string name="ground_truth_no_sessions">Brak zarejestrowanych sesji.</string>
+    <string name="ground_truth_comment">Komentarz do sesji</string>
+    <string name="ground_truth_delete_session">Usuń sesję</string>
+    <string name="ground_truth_delete_session_title">Usunąć tę sesję?</string>
+    <string name="ground_truth_delete_session_message">Sesja %1$s i zarejestrowane dane zostaną trwale usunięte.</string>
+    <string name="ground_truth_delete_all">Usuń wszystkie sesje</string>
+    <string name="ground_truth_delete_all_title">Usunąć wszystkie sesje?</string>
+    <string name="ground_truth_delete_all_message">Wszystkie zarejestrowane sesje (%1$d) i ich dane zostaną trwale usunięte.</string>
+    <string name="ground_truth_delete_confirm">Usuń</string>
+    <string name="ground_truth_cancel">Anuluj</string>
+    <string name="ground_truth_edit_start">Edytuj początek</string>
+    <string name="ground_truth_edit_end">Edytuj koniec</string>
+    <string name="ground_truth_legacy_no_sensors">Starsza sesja: można wyeksportować zdarzenia, ale nie można wskazać opaski do eksportu czujników.</string>
+    <string name="ground_truth_capture_status">Stan rejestracji</string>
+    <string name="ground_truth_recording">Nagrywanie · %1$s</string>
+    <string name="ground_truth_imu_coverage">IMU %1$s · %2$s</string>
+    <string name="ground_truth_band_connected_paired">Opaska: połączona i sparowana</string>
+    <string name="ground_truth_band_connected_pairing">Opaska: połączona; parowanie</string>
+    <string name="ground_truth_band_disconnected">Opaska: rozłączona</string>
+    <string name="ground_truth_band_searching">Opaska: rozłączona; wyszukiwanie</string>
+    <string name="ground_truth_history_running">Synchronizacja historii (%1$d bloków)</string>
+    <string name="ground_truth_history_completed">Historia zsynchronizowana: %1$s</string>
+    <string name="ground_truth_history_none">Brak ukończonej synchronizacji historii</string>
+    <string name="ground_truth_sensors_behind">Zdekodowane czujniki 1 Hz: opóźnienie %1$s</string>
+    <string name="ground_truth_sensors_none">Zdekodowane czujniki 1 Hz: brak</string>
+    <string name="ground_truth_realtime_imu">IMU w czasie rzeczywistym: %1$s; %2$d pakietów/%3$d bajtów%4$s</string>
+    <string name="ground_truth_realtime_last">; ostatni %1$s temu</string>
+    <string name="ground_truth_add_marker">Dodaj znacznik</string>
+    <string name="ground_truth_edit_marker">Edytuj znacznik</string>
+    <string name="ground_truth_marker_moment">Moment</string>
+    <string name="ground_truth_marker_start">Początek</string>
+    <string name="ground_truth_marker_end">Koniec</string>
+    <string name="ground_truth_marker_issue">Problem</string>
+    <string name="ground_truth_marker_note">Notatka znacznika</string>
+    <string name="ground_truth_save">Zapisz</string>
+    <string name="ground_truth_waiting_imu">oczekiwanie na IMU</string>
+    <string name="ground_truth_ready_complete">Gotowe do eksportu · kompletne</string>
+    <string name="ground_truth_ready_missing">Gotowe, brak %1$d s · historia może je uzupełnić</string>
+    <string name="ground_truth_waiting_history">Oczekiwanie na historię do %1$s</string>
+    <string name="ground_truth_ready_no_imu">Gotowe bez danych IMU</string>
+    <string name="ground_truth_duration_size">%1$s · IMU %2$s</string>
+    <string name="ground_truth_last_exported">Ostatni eksport: %1$s · można eksportować ponownie</string>
+    <string name="ground_truth_coverage">%1$d/%2$d s · %3$.1f%% · brak %4$d s%5$s</string>
+    <string name="ground_truth_coverage_startup"> · rozruch %1$d s</string>
+    <string name="ground_truth_marker_row">%1$s · %2$s%3$s</string>
+    <string name="ground_truth_marker_note_suffix"> · %1$s</string>
+    <string name="raw_diag_title">Diagnostyka protokołu 5/MG</string>
+    <string name="raw_diag_protocol_probes">Testy protokołu</string>
+    <string name="raw_diag_broadcast_hr">Transmituj tętno z opaski</string>
+    <string name="raw_diag_pair">Poproś Androida o sparowanie</string>
+    <string name="raw_diag_r22">Starszy eksperyment flag R22</string>
+    <string name="raw_diag_r22_enable">Wyślij starszą sekwencję włączenia R22</string>
+    <string name="raw_diag_r22_clear">Wyczyść flagi R22 na opasce</string>
+    <string name="raw_diag_ecg">Przełącznik surowych danych ECG WHOOP MG</string>
+    <string name="raw_diag_ecg_on">Włącz ECG</string>
+    <string name="raw_diag_ecg_off">Wyłącz ECG</string>
+    <string name="raw_diag_passive">Pasywny zapis historii/protokołu</string>
+    <string name="raw_diag_share">Udostępnij pasywny zapis</string>
+    <string name="raw_diag_export_log">Eksportuj pasywny zapis i dziennik opaski</string>
+    <string name="raw_diag_moved">Rejestracja surowych danych i eksport protokołu są teraz w Centrum testowym → Diagnostyka protokołu 5/MG.</string>
+    <string name="ground_truth_marker_times">Znacznik %1$s · Teraz %2$s</string>
+    <string name="ground_truth_marker_now_button">0</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Wyślij hello mimo odmowy parowania (eksperymentalne)</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Wyślij hello mimo odmowy parowania</string>
     <string name="l10n_settings_screen_check_automatically_7cd229d2">Sprawdzaj automatycznie</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 7650a0f1df..8b52c47c73 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2531,6 +2531,79 @@
     <string name="l10n_settings_screen_ask_android_to_pair_experimental_250a81e9">Pedir ao Android para emparelhar (experimental)</string>
     <string name="l10n_settings_screen_noop_has_always_hoped_that_writing_19967036">O NOOP sempre contou que escrever na sua 5.0/MG fizesse o Android emparelhar. Isso nunca acontece. Esta opção pede diretamente ao Android, pelo que pode mostrar uma caixa de diálogo de emparelhamento do sistema. A frequência cardíaca em direto continua a funcionar de qualquer forma; desative se a caixa de diálogo incomodar.</string>
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">Pedir ao Android para emparelhar</string>
+    <string name="ground_truth_title">Recolha de dados em bruto 5/MG</string>
+    <string name="ground_truth_subtitle">Grave uma sessão de movimento limitada a 100 Hz, recupere falhas de Bluetooth do histórico da bracelete e exporte a cronologia completa.</string>
+    <string name="ground_truth_test_centre_desc">Grave, anote, recupere e exporte uma captura de movimento 5/MG limitada a 100 Hz.</string>
+    <string name="ground_truth_open">Abrir recolha de dados</string>
+    <string name="ground_truth_start">Iniciar sessão de dados</string>
+    <string name="ground_truth_add_historical">Adicionar intervalo anterior</string>
+    <string name="ground_truth_stop">Parar sessão</string>
+    <string name="ground_truth_export">Exportar sessão</string>
+    <string name="ground_truth_exporting">A criar exportação…</string>
+    <string name="ground_truth_export_failed">Não foi possível exportar a sessão: %1$s</string>
+    <string name="ground_truth_sessions">Sessões gravadas</string>
+    <string name="ground_truth_no_sessions">Ainda não existem sessões gravadas.</string>
+    <string name="ground_truth_comment">Comentário da sessão</string>
+    <string name="ground_truth_delete_session">Eliminar sessão</string>
+    <string name="ground_truth_delete_session_title">Eliminar esta sessão?</string>
+    <string name="ground_truth_delete_session_message">A sessão %1$s e os dados capturados serão eliminados permanentemente.</string>
+    <string name="ground_truth_delete_all">Eliminar todas as sessões</string>
+    <string name="ground_truth_delete_all_title">Eliminar todas as sessões?</string>
+    <string name="ground_truth_delete_all_message">As %1$d sessões gravadas e os respetivos dados serão eliminados permanentemente.</string>
+    <string name="ground_truth_delete_confirm">Eliminar</string>
+    <string name="ground_truth_cancel">Cancelar</string>
+    <string name="ground_truth_edit_start">Editar início</string>
+    <string name="ground_truth_edit_end">Editar fim</string>
+    <string name="ground_truth_legacy_no_sensors">Sessão antiga: os eventos podem ser exportados, mas não é possível identificar a bracelete para exportar sensores.</string>
+    <string name="ground_truth_capture_status">Estado da captura</string>
+    <string name="ground_truth_recording">A gravar · %1$s</string>
+    <string name="ground_truth_imu_coverage">IMU %1$s · %2$s</string>
+    <string name="ground_truth_band_connected_paired">Bracelete: ligada e emparelhada</string>
+    <string name="ground_truth_band_connected_pairing">Bracelete: ligada; a emparelhar</string>
+    <string name="ground_truth_band_disconnected">Bracelete: desligada</string>
+    <string name="ground_truth_band_searching">Bracelete: desligada; a procurar</string>
+    <string name="ground_truth_history_running">Sincronização do histórico (%1$d blocos)</string>
+    <string name="ground_truth_history_completed">Histórico sincronizado: %1$s</string>
+    <string name="ground_truth_history_none">Nenhuma sincronização do histórico concluída</string>
+    <string name="ground_truth_sensors_behind">Sensores de 1 Hz descodificados: atraso de %1$s</string>
+    <string name="ground_truth_sensors_none">Sensores de 1 Hz descodificados: nenhum</string>
+    <string name="ground_truth_realtime_imu">IMU em tempo real: %1$s; %2$d pacotes/%3$d bytes%4$s</string>
+    <string name="ground_truth_realtime_last">; último há %1$s</string>
+    <string name="ground_truth_add_marker">Adicionar marcador</string>
+    <string name="ground_truth_edit_marker">Editar marcador</string>
+    <string name="ground_truth_marker_moment">Momento</string>
+    <string name="ground_truth_marker_start">Início</string>
+    <string name="ground_truth_marker_end">Fim</string>
+    <string name="ground_truth_marker_issue">Problema</string>
+    <string name="ground_truth_marker_note">Nota do marcador</string>
+    <string name="ground_truth_save">Guardar</string>
+    <string name="ground_truth_waiting_imu">a aguardar IMU</string>
+    <string name="ground_truth_ready_complete">Pronta para exportar · completa</string>
+    <string name="ground_truth_ready_missing">Pronta com %1$d s em falta · o histórico pode recuperá-los</string>
+    <string name="ground_truth_waiting_history">A aguardar histórico até %1$s</string>
+    <string name="ground_truth_ready_no_imu">Pronta sem dados IMU</string>
+    <string name="ground_truth_duration_size">%1$s · IMU %2$s</string>
+    <string name="ground_truth_last_exported">Última exportação: %1$s · pode voltar a exportar</string>
+    <string name="ground_truth_coverage">%1$d/%2$d s · %3$.1f%% · faltam %4$d s%5$s</string>
+    <string name="ground_truth_coverage_startup"> · %1$d s de arranque</string>
+    <string name="ground_truth_marker_row">%1$s · %2$s%3$s</string>
+    <string name="ground_truth_marker_note_suffix"> · %1$s</string>
+    <string name="raw_diag_title">Diagnóstico do protocolo 5/MG</string>
+    <string name="raw_diag_protocol_probes">Sondas de protocolo</string>
+    <string name="raw_diag_broadcast_hr">Transmitir frequência cardíaca da bracelete</string>
+    <string name="raw_diag_pair">Pedir ao Android para emparelhar</string>
+    <string name="raw_diag_r22">Experiência antiga de indicadores R22</string>
+    <string name="raw_diag_r22_enable">Enviar sequência antiga de ativação R22</string>
+    <string name="raw_diag_r22_clear">Limpar indicadores R22 da bracelete</string>
+    <string name="raw_diag_ecg">Controlo de dados ECG em bruto WHOOP MG</string>
+    <string name="raw_diag_ecg_on">Ativar controlo ECG</string>
+    <string name="raw_diag_ecg_off">Desativar controlo ECG</string>
+    <string name="raw_diag_passive">Registo passivo de histórico/protocolo</string>
+    <string name="raw_diag_share">Partilhar registo passivo</string>
+    <string name="raw_diag_export_log">Exportar registo passivo e registo da bracelete</string>
+    <string name="raw_diag_moved">A captura em bruto e as exportações de protocolo estão agora em Centro de testes → Diagnóstico do protocolo 5/MG.</string>
+    <string name="ground_truth_marker_times">Marcador %1$s · Agora %2$s</string>
+    <string name="ground_truth_marker_now_button">0</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Enviar hello apesar da recusa de emparelhamento (experimental)</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Enviar hello apesar da recusa de emparelhamento</string>
     <string name="l10n_settings_screen_check_automatically_7cd229d2">Verificar automaticamente</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 9748333fb0..5190ac7b9f 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2452,6 +2452,79 @@
     <string name="l10n_settings_screen_ask_android_to_pair_experimental_250a81e9">请求 Android 配对（实验性）</string>
     <string name="l10n_settings_screen_noop_has_always_hoped_that_writing_19967036">NOOP 一直寄望于向 5.0/MG 写入数据来促使 Android 配对，但这从未发生。此选项会直接请求 Android，因此可能弹出系统配对对话框。无论哪种方式，实时心率都会继续工作；如果对话框造成困扰，请关闭此选项。</string>
     <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">请求 Android 配对</string>
+    <string name="ground_truth_title">5/MG 原始数据采集器</string>
+    <string name="ground_truth_subtitle">记录有限的 100 Hz 运动会话，从手环历史恢复蓝牙缺口，并导出完整时间线。</string>
+    <string name="ground_truth_test_centre_desc">记录、标注、恢复并导出有限的 5/MG 100 Hz 运动捕获。</string>
+    <string name="ground_truth_open">打开原始数据采集器</string>
+    <string name="ground_truth_start">开始原始数据会话</string>
+    <string name="ground_truth_add_historical">添加过去的时间段</string>
+    <string name="ground_truth_stop">停止会话</string>
+    <string name="ground_truth_export">导出会话</string>
+    <string name="ground_truth_exporting">正在创建导出…</string>
+    <string name="ground_truth_export_failed">无法导出会话：%1$s</string>
+    <string name="ground_truth_sessions">已记录的会话</string>
+    <string name="ground_truth_no_sessions">尚无已记录的会话。</string>
+    <string name="ground_truth_comment">会话备注</string>
+    <string name="ground_truth_delete_session">删除会话</string>
+    <string name="ground_truth_delete_session_title">删除此会话？</string>
+    <string name="ground_truth_delete_session_message">会话 %1$s 及其捕获的原始数据将被永久删除。</string>
+    <string name="ground_truth_delete_all">删除所有会话</string>
+    <string name="ground_truth_delete_all_title">删除所有会话？</string>
+    <string name="ground_truth_delete_all_message">%1$d 个已记录会话及其捕获的数据将被永久删除。</string>
+    <string name="ground_truth_delete_confirm">删除</string>
+    <string name="ground_truth_cancel">取消</string>
+    <string name="ground_truth_edit_start">编辑开始时间</string>
+    <string name="ground_truth_edit_end">编辑结束时间</string>
+    <string name="ground_truth_legacy_no_sensors">旧会话：可导出事件，但无法确定用于传感器导出的手环。</string>
+    <string name="ground_truth_capture_status">捕获状态</string>
+    <string name="ground_truth_recording">正在记录 · %1$s</string>
+    <string name="ground_truth_imu_coverage">IMU %1$s · %2$s</string>
+    <string name="ground_truth_band_connected_paired">手环：已连接并配对</string>
+    <string name="ground_truth_band_connected_pairing">手环：已连接；正在配对</string>
+    <string name="ground_truth_band_disconnected">手环：已断开</string>
+    <string name="ground_truth_band_searching">手环：已断开；正在搜索</string>
+    <string name="ground_truth_history_running">正在同步历史（%1$d 个块）</string>
+    <string name="ground_truth_history_completed">历史同步完成：%1$s</string>
+    <string name="ground_truth_history_none">尚无已完成的历史同步</string>
+    <string name="ground_truth_sensors_behind">已解码的 1 Hz 传感器：落后 %1$s</string>
+    <string name="ground_truth_sensors_none">已解码的 1 Hz 传感器：无</string>
+    <string name="ground_truth_realtime_imu">实时 IMU：%1$s；%2$d 个数据包/%3$d 字节%4$s</string>
+    <string name="ground_truth_realtime_last">；上次于 %1$s 前</string>
+    <string name="ground_truth_add_marker">添加标记</string>
+    <string name="ground_truth_edit_marker">编辑标记</string>
+    <string name="ground_truth_marker_moment">时刻</string>
+    <string name="ground_truth_marker_start">开始</string>
+    <string name="ground_truth_marker_end">结束</string>
+    <string name="ground_truth_marker_issue">问题</string>
+    <string name="ground_truth_marker_note">标记备注</string>
+    <string name="ground_truth_save">保存</string>
+    <string name="ground_truth_waiting_imu">正在等待 IMU</string>
+    <string name="ground_truth_ready_complete">可导出 · 完整</string>
+    <string name="ground_truth_ready_missing">可导出，缺少 %1$d 秒 · 历史可能会修复</string>
+    <string name="ground_truth_waiting_history">正在等待截至 %1$s 的历史</string>
+    <string name="ground_truth_ready_no_imu">可导出，但没有 IMU 数据</string>
+    <string name="ground_truth_duration_size">%1$s · IMU %2$s</string>
+    <string name="ground_truth_last_exported">上次导出：%1$s · 仍可再次导出</string>
+    <string name="ground_truth_coverage">%1$d/%2$d 秒 · %3$.1f%% · 缺少 %4$d 秒%5$s</string>
+    <string name="ground_truth_coverage_startup"> · 启动 %1$d 秒</string>
+    <string name="ground_truth_marker_row">%1$s · %2$s%3$s</string>
+    <string name="ground_truth_marker_note_suffix"> · %1$s</string>
+    <string name="raw_diag_title">5/MG 协议诊断</string>
+    <string name="raw_diag_protocol_probes">协议探测</string>
+    <string name="raw_diag_broadcast_hr">从手环广播心率</string>
+    <string name="raw_diag_pair">请求 Android 配对</string>
+    <string name="raw_diag_r22">旧版 R22 功能标志实验</string>
+    <string name="raw_diag_r22_enable">发送旧版 R22 启用序列</string>
+    <string name="raw_diag_r22_clear">清除手环上的 R22 标志</string>
+    <string name="raw_diag_ecg">WHOOP MG ECG 原始数据开关</string>
+    <string name="raw_diag_ecg_on">打开 ECG 开关</string>
+    <string name="raw_diag_ecg_off">关闭 ECG 开关</string>
+    <string name="raw_diag_passive">被动历史/协议记录</string>
+    <string name="raw_diag_share">分享被动原始记录</string>
+    <string name="raw_diag_export_log">导出被动记录和手环日志</string>
+    <string name="raw_diag_moved">原始数据捕获及协议导出现已移至“测试中心 → 5/MG 协议诊断”。</string>
+    <string name="ground_truth_marker_times">标记 %1$s · 当前 %2$s</string>
+    <string name="ground_truth_marker_now_button">0</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">即使拒绝配对也发送 hello（实验性）</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">即使拒绝配对也发送 hello</string>
     <string name="l10n_settings_screen_check_automatically_7cd229d2">自动检查</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 6c16dc6413..0043b2f562 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -1686,7 +1686,7 @@
     <string name="l10n_settings_screen_whole_night_is_noop_s_default_fbfff434">Whole night is NOOP\'s default measure; Deep sleep pools HRV over slow-wave sleep only, reading lower and matching WHOOP. Switching re-scores your recent nights over the new window and takes effect right away once you have a few nights of data.</string>
     <string name="l10n_settings_screen_whoop_4_0_versus_5_0_a54c5504">WHOOP 4.0 versus 5.0: what each can read and why</string>
     <string name="l10n_settings_screen_whoop_4_0_vs_5_0_2babb05a">WHOOP 4.0 vs 5.0/MG</string>
-    <string name="l10n_settings_screen_whoop_5_mg_straps_hand_a_b8b239e6">WHOOP 5/MG straps hand a fresh app only live heart rate. The official app switches on the deeper streams (high-rate HR + motion + history) by writing a set of feature flags, a sequence two independent projects have documented. With this on, the button below sends that exact sequence to your strap. Unlike everything else here it does write to the strap, but it\'s reversible (it only changes which data the strap emits) and is the same thing the official app does. Experimental: it may do nothing on your firmware.</string>
+    <string name="l10n_settings_screen_whoop_5_mg_straps_hand_a_b8b239e6">Legacy R22 feature-flag experiment. The strap accepts these writes, but NOOP has not observed them enabling a separate live stream. This is not required for normal WHOOP 5/MG support or for the Raw Data Collector. It writes persistent strap settings and may do nothing on your firmware.</string>
     <string name="l10n_settings_screen_whoop_a3650379">WHOOP</string>
     <string name="l10n_settings_screen_working_13b7bfca">Working…</string>
     <string name="l10n_settings_screen_you_re_on_the_latest_r_027a82be">You\'re on the latest (%1$s).</string>
@@ -2565,6 +2565,79 @@
     <string name="l10n_health_screen_your_strap_reports_a_blood_oxygen_349fe34a">Your strap reports a blood oxygen estimate, but it is unverified and off by default. Turn on the strap estimate in Settings to see it, or import a WHOOP export in Data Sources for the calibrated value.</string>
     <string name="l10n_health_screen_no_blood_oxygen_percentage_from_a_1d3d383e">No blood oxygen percentage from a WHOOP 4.0</string>
     <string name="l10n_health_screen_your_strap_banks_the_raw_optical_b52a0f80">Your strap banks the raw optical channels, but NOOP does not turn them into a blood oxygen percentage, so this stays empty however long you wear it. Import a WHOOP export in Data Sources to fill it from your account history.</string>
+    <string name="ground_truth_title">5/MG Raw Data Collector</string>
+    <string name="ground_truth_subtitle">Record a bounded 100 Hz motion session, recover Bluetooth gaps from strap history, and export the complete timeline.</string>
+    <string name="ground_truth_test_centre_desc">Record, annotate, recover, and export a bounded 5/MG 100 Hz motion capture.</string>
+    <string name="ground_truth_open">Open raw-data collector</string>
+    <string name="ground_truth_start">Start raw-data session</string>
+    <string name="ground_truth_add_historical">Add past time window</string>
+    <string name="ground_truth_stop">Stop session</string>
+    <string name="ground_truth_export">Export session</string>
+    <string name="ground_truth_exporting">Building export…</string>
+    <string name="ground_truth_export_failed">Couldn’t export session: %1$s</string>
+    <string name="ground_truth_sessions">Recorded sessions</string>
+    <string name="ground_truth_no_sessions">No sessions recorded yet.</string>
+    <string name="ground_truth_comment">Session comment</string>
+    <string name="ground_truth_delete_session">Delete session</string>
+    <string name="ground_truth_delete_session_title">Delete this session?</string>
+    <string name="ground_truth_delete_session_message">The session %1$s and its captured raw data will be deleted permanently.</string>
+    <string name="ground_truth_delete_all">Delete all sessions</string>
+    <string name="ground_truth_delete_all_title">Delete all sessions?</string>
+    <string name="ground_truth_delete_all_message">All %1$d recorded sessions and their captured raw data will be deleted permanently.</string>
+    <string name="ground_truth_delete_confirm">Delete</string>
+    <string name="ground_truth_cancel">Cancel</string>
+    <string name="ground_truth_edit_start">Edit start</string>
+    <string name="ground_truth_edit_end">Edit end</string>
+    <string name="ground_truth_legacy_no_sensors">Legacy session: event export is available, but its strap cannot be identified for sensor export.</string>
+    <string name="ground_truth_capture_status">Capture status</string>
+    <string name="ground_truth_recording">Recording · %1$s</string>
+    <string name="ground_truth_imu_coverage">IMU %1$s · %2$s</string>
+    <string name="ground_truth_band_connected_paired">Band: connected + paired</string>
+    <string name="ground_truth_band_connected_pairing">Band: connected; pairing</string>
+    <string name="ground_truth_band_disconnected">Band: disconnected</string>
+    <string name="ground_truth_band_searching">Band: disconnected; searching</string>
+    <string name="ground_truth_history_running">History sync: running (%1$d chunks)</string>
+    <string name="ground_truth_history_completed">History sync completed: %1$s</string>
+    <string name="ground_truth_history_none">History sync: no completed sync recorded</string>
+    <string name="ground_truth_sensors_behind">Decoded 1 Hz sensors: %1$s behind</string>
+    <string name="ground_truth_sensors_none">Decoded 1 Hz sensors: none</string>
+    <string name="ground_truth_realtime_imu">Realtime IMU: %1$s; %2$d packets / %3$d bytes%4$s</string>
+    <string name="ground_truth_realtime_last">; last %1$s ago</string>
+    <string name="ground_truth_add_marker">Add marker</string>
+    <string name="ground_truth_edit_marker">Edit marker</string>
+    <string name="ground_truth_marker_moment">Moment</string>
+    <string name="ground_truth_marker_start">Start</string>
+    <string name="ground_truth_marker_end">End</string>
+    <string name="ground_truth_marker_issue">Issue</string>
+    <string name="ground_truth_marker_note">Marker note</string>
+    <string name="ground_truth_save">Save</string>
+    <string name="ground_truth_waiting_imu">waiting for IMU</string>
+    <string name="ground_truth_ready_complete">Ready to export · complete</string>
+    <string name="ground_truth_ready_missing">Ready with %1$d s missing · history may repair it</string>
+    <string name="ground_truth_waiting_history">Waiting for history through %1$s</string>
+    <string name="ground_truth_ready_no_imu">Ready without IMU data</string>
+    <string name="ground_truth_duration_size">%1$s · IMU %2$s</string>
+    <string name="ground_truth_last_exported">Last exported %1$s · export remains available</string>
+    <string name="ground_truth_coverage">%1$d/%2$d s · %3$.1f%% · %4$d s missing%5$s</string>
+    <string name="ground_truth_coverage_startup"> · %1$d s startup</string>
+    <string name="ground_truth_marker_row">%1$s · %2$s%3$s</string>
+    <string name="ground_truth_marker_note_suffix"> · %1$s</string>
+    <string name="ground_truth_marker_times">Marker %1$s · Now %2$s</string>
+    <string name="ground_truth_marker_now_button" translatable="false">0</string>
+    <string name="raw_diag_title">5/MG protocol diagnostics</string>
+    <string name="raw_diag_protocol_probes">Protocol probes</string>
+    <string name="raw_diag_broadcast_hr">Broadcast heart rate from the strap</string>
+    <string name="raw_diag_pair">Ask Android to pair</string>
+    <string name="raw_diag_r22">Legacy R22 feature-flag experiment</string>
+    <string name="raw_diag_r22_enable">Send legacy R22 enable sequence</string>
+    <string name="raw_diag_r22_clear">Clear legacy R22 flags on strap</string>
+    <string name="raw_diag_ecg">WHOOP MG ECG raw-data gate</string>
+    <string name="raw_diag_ecg_on">Turn ECG gate on</string>
+    <string name="raw_diag_ecg_off">Turn ECG gate off</string>
+    <string name="raw_diag_passive">Passive history/protocol trace</string>
+    <string name="raw_diag_share">Share passive raw trace</string>
+    <string name="raw_diag_export_log">Export passive trace + strap log</string>
+    <string name="raw_diag_moved">Raw capture and its protocol-trace exports now live in Test Centre → 5/MG protocol diagnostics.</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Send hello despite bond refusal (experimental)</string>
     <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Send hello despite bond refusal</string>
     <string name="l10n_settings_screen_check_automatically_7cd229d2">Check automatically</string>
diff --git a/android/app/src/test/java/com/noop/analytics/RegistryDayOwnerSourceTest.kt b/android/app/src/test/java/com/noop/analytics/RegistryDayOwnerSourceTest.kt
index dc0008b194..78adb90f68 100644
--- a/android/app/src/test/java/com/noop/analytics/RegistryDayOwnerSourceTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/RegistryDayOwnerSourceTest.kt
@@ -66,7 +66,6 @@ class RegistryDayOwnerSourceTest {
         override suspend fun deleteStepsFor(deviceId: String) {}
         override suspend fun deletePpgHrFor(deviceId: String) {}
         override suspend fun deletePpgWaveformFor(deviceId: String) {}
-        override suspend fun deleteRawImuFor(deviceId: String) {}
         override suspend fun deleteV18AuxFor(deviceId: String) {}
         override suspend fun deleteEventsFor(deviceId: String) {}
         override suspend fun deleteBatteryFor(deviceId: String) {}
@@ -97,7 +96,6 @@ class RegistryDayOwnerSourceTest {
         override suspend fun reKeySteps(from: String, to: String) {}
         override suspend fun reKeyPpgHr(from: String, to: String) {}
         override suspend fun reKeyPpgWaveform(from: String, to: String) {}
-        override suspend fun reKeyRawImu(from: String, to: String) {}
         override suspend fun reKeyV18Aux(from: String, to: String) {}
         override suspend fun reKeyEvents(from: String, to: String) {}
         override suspend fun reKeyBattery(from: String, to: String) {}
diff --git a/android/app/src/test/java/com/noop/ble/ConnectionPriorityTest.kt b/android/app/src/test/java/com/noop/ble/ConnectionPriorityTest.kt
index 885a436bfb..a5ae2db449 100644
--- a/android/app/src/test/java/com/noop/ble/ConnectionPriorityTest.kt
+++ b/android/app/src/test/java/com/noop/ble/ConnectionPriorityTest.kt
@@ -16,6 +16,13 @@ import org.junit.Test
  */
 class ConnectionPriorityTest {
 
+    @Test fun rawCapturePriorityIsBoundedToCaptureAndRepairTraffic() {
+        assertTrue(WhoopBleClient.rawCaptureHighPriority(captureActive = true, backfilling = false, needsRepair = false))
+        assertTrue(WhoopBleClient.rawCaptureHighPriority(captureActive = false, backfilling = true, needsRepair = true))
+        assertFalse(WhoopBleClient.rawCaptureHighPriority(captureActive = false, backfilling = false, needsRepair = true))
+        assertFalse(WhoopBleClient.rawCaptureHighPriority(captureActive = false, backfilling = true, needsRepair = false))
+    }
+
     @Test fun activeWorkIsAlwaysHigh() {
         // offload OR live-HR → HIGH, and the idle throttle can't override active work
         assertEquals(
diff --git a/android/app/src/test/java/com/noop/ble/SourceCoordinatorAdoptionTest.kt b/android/app/src/test/java/com/noop/ble/SourceCoordinatorAdoptionTest.kt
index d86a7dba31..573cd4006b 100644
--- a/android/app/src/test/java/com/noop/ble/SourceCoordinatorAdoptionTest.kt
+++ b/android/app/src/test/java/com/noop/ble/SourceCoordinatorAdoptionTest.kt
@@ -81,7 +81,6 @@ class SourceCoordinatorAdoptionTest {
         override suspend fun deleteStepsFor(deviceId: String) {}
         override suspend fun deletePpgHrFor(deviceId: String) {}
         override suspend fun deletePpgWaveformFor(deviceId: String) {}
-        override suspend fun deleteRawImuFor(deviceId: String) {}
         override suspend fun deleteV18AuxFor(deviceId: String) {}
         override suspend fun deleteEventsFor(deviceId: String) {}
         override suspend fun deleteBatteryFor(deviceId: String) {}
@@ -114,7 +113,6 @@ class SourceCoordinatorAdoptionTest {
         override suspend fun reKeySteps(from: String, to: String) {}
         override suspend fun reKeyPpgHr(from: String, to: String) {}
         override suspend fun reKeyPpgWaveform(from: String, to: String) {}
-        override suspend fun reKeyRawImu(from: String, to: String) {}
         override suspend fun reKeyV18Aux(from: String, to: String) {}
         override suspend fun reKeyEvents(from: String, to: String) {}
         override suspend fun reKeyBattery(from: String, to: String) {}
diff --git a/android/app/src/test/java/com/noop/data/DeepCaptureMigrationTest.kt b/android/app/src/test/java/com/noop/data/DeepCaptureMigrationTest.kt
index 845917fe5e..592dca23f0 100644
--- a/android/app/src/test/java/com/noop/data/DeepCaptureMigrationTest.kt
+++ b/android/app/src/test/java/com/noop/data/DeepCaptureMigrationTest.kt
@@ -220,6 +220,5 @@ class DeepCaptureMigrationTest {
     @Test
     fun shippedRetentionConstant() {
         assertEquals(604_800, WhoopRepository.V18_AUX_RETENTION_ROWS)   // 7 x 86_400 strap-seconds
-        assertTrue(WhoopRepository.V18_AUX_RETENTION_ROWS > WhoopRepository.RAW_IMU_RETENTION_ROWS)
     }
 }
diff --git a/android/app/src/test/java/com/noop/data/DeviceRegistryTest.kt b/android/app/src/test/java/com/noop/data/DeviceRegistryTest.kt
index fa9b475580..6c747b8520 100644
--- a/android/app/src/test/java/com/noop/data/DeviceRegistryTest.kt
+++ b/android/app/src/test/java/com/noop/data/DeviceRegistryTest.kt
@@ -97,7 +97,6 @@ class DeviceRegistryTest {
         override suspend fun deleteStepsFor(deviceId: String) { deletedTables += "stepSample" to deviceId }
         override suspend fun deletePpgHrFor(deviceId: String) { deletedTables += "ppgHrSample" to deviceId }
         override suspend fun deletePpgWaveformFor(deviceId: String) { deletedTables += "ppgWaveformSample" to deviceId }
-        override suspend fun deleteRawImuFor(deviceId: String) { deletedTables += "rawImuSample" to deviceId }
         override suspend fun deleteV18AuxFor(deviceId: String) { deletedTables += "v18AuxSample" to deviceId }
         override suspend fun deleteEventsFor(deviceId: String) { deletedTables += "event" to deviceId }
         override suspend fun deleteBatteryFor(deviceId: String) { deletedTables += "battery" to deviceId }
@@ -134,7 +133,6 @@ class DeviceRegistryTest {
         override suspend fun reKeySteps(from: String, to: String) {}
         override suspend fun reKeyPpgHr(from: String, to: String) {}
         override suspend fun reKeyPpgWaveform(from: String, to: String) {}
-        override suspend fun reKeyRawImu(from: String, to: String) {}
         override suspend fun reKeyV18Aux(from: String, to: String) {}
         override suspend fun reKeyEvents(from: String, to: String) {}
         override suspend fun reKeyBattery(from: String, to: String) {}
@@ -312,7 +310,7 @@ class DeviceRegistryTest {
         // were missing, leaving raw sleep-state, lab markers, live sessions and dismissed markers behind.
         val expectedTables = setOf(
             "hrSample", "rrInterval", "spo2Sample", "skinTempSample", "respSample", "gravitySample",
-            "stepSample", "ppgHrSample", "ppgWaveformSample", "rawImuSample", "v18AuxSample",
+            "stepSample", "ppgHrSample", "ppgWaveformSample", "v18AuxSample",
             "event", "battery", "dailyMetric", "sleepSession",
             "journal", "workout", "appleDaily", "metricSeries", "dayOwnership",
             "scoreInputProvenance",
diff --git a/android/app/src/test/java/com/noop/data/RawImuMigrationTest.kt b/android/app/src/test/java/com/noop/data/RawImuMigrationTest.kt
index 57b5075853..62a6e575e4 100644
--- a/android/app/src/test/java/com/noop/data/RawImuMigrationTest.kt
+++ b/android/app/src/test/java/com/noop/data/RawImuMigrationTest.kt
@@ -1,13 +1,11 @@
 package com.noop.data
 
 import com.noop.protocol.Whoop5RawImu
-import kotlinx.coroutines.runBlocking
 import org.junit.Assert.assertArrayEquals
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Test
-import java.lang.reflect.Proxy
 
 /**
  * Guards the additive v20 -> v21 Room migration (the `rawImuSample` table, #423), the Android twin of the
@@ -54,6 +52,11 @@ class RawImuMigrationTest {
         assertEquals(21, WhoopDatabase.MIGRATION_20_21.endVersion)
     }
 
+    @Test fun obsoleteBoundedCache_isDroppedAt35() {
+        assertEquals(34, WhoopDatabase.MIGRATION_34_35.startVersion)
+        assertEquals(35, WhoopDatabase.MIGRATION_34_35.endVersion)
+    }
+
     // MARK: - Packed-BLOB encoding (byte-identical i16 LE)
 
     @Test
@@ -100,45 +103,6 @@ class RawImuMigrationTest {
         assertNull("wrong sample count", Whoop5RawImu.rawColumns(f))
     }
 
-    // MARK: - Store-write plumbing (repository inserts + rolling prune through the DAO)
-
-    @Test
-    fun repositoryInsertRawImu_insertsThenPrunes() = runBlocking {
-        var inserted: List<RawImuSampleEntity>? = null
-        var prunedDevice: String? = null
-        var prunedKeep = -1
-        val dao = Proxy.newProxyInstance(
-            WhoopDao::class.java.classLoader,
-            arrayOf(WhoopDao::class.java),
-        ) { _, method, args ->
-            when (method.name) {
-                "insertRawImu" -> {
-                    @Suppress("UNCHECKED_CAST")
-                    inserted = args[0] as List<RawImuSampleEntity>
-                    listOf(1L)
-                }
-                "pruneRawImu" -> { prunedDevice = args[0] as String; prunedKeep = args[1] as Int; Unit }
-                else -> throw UnsupportedOperationException("raw-imu insert must not call ${method.name}")
-            }
-        } as WhoopDao
-
-        val row = RawImuSampleEntity("my-whoop", 1_780_917_232L, StreamPersistence.packImuColumns(shortArrayOf(1, -1, 100)))
-        WhoopRepository(dao).insertRawImu("my-whoop", listOf(row))
-
-        assertEquals(listOf(row), inserted)
-        assertEquals("my-whoop", prunedDevice)
-        assertEquals(WhoopRepository.RAW_IMU_RETENTION_ROWS, prunedKeep)
-    }
-
-    @Test
-    fun repositoryInsertRawImu_emptyIsNoOp() = runBlocking {
-        val dao = Proxy.newProxyInstance(
-            WhoopDao::class.java.classLoader,
-            arrayOf(WhoopDao::class.java),
-        ) { _, method, _ -> throw AssertionError("empty insert must not touch the DAO (${method.name})") } as WhoopDao
-        WhoopRepository(dao).insertRawImu("my-whoop", emptyList())
-    }
-
     private fun validImuBuffer(): ByteArray {
         val f = ByteArray(Whoop5RawImu.bufferLength)
         putI16(f, 24, 100)   // countA
diff --git a/android/app/src/test/java/com/noop/testcentre/RawCaptureExportContractTest.kt b/android/app/src/test/java/com/noop/testcentre/RawCaptureExportContractTest.kt
new file mode 100644
index 0000000000..28282a4726
--- /dev/null
+++ b/android/app/src/test/java/com/noop/testcentre/RawCaptureExportContractTest.kt
@@ -0,0 +1,67 @@
+package com.noop.testcentre
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.io.File
+
+class RawCaptureExportContractTest {
+    private fun source(name: String): String {
+        var root = File(System.getProperty("user.dir") ?: ".").canonicalFile
+        repeat(4) {
+            val file = File(root, "android/app/src/main/java/com/noop/testcentre/$name")
+            if (file.isFile) return file.readText()
+            root = root.parentFile ?: root
+        }
+        error("repository root not found")
+    }
+
+    @Test fun halfHourBucketsAreStableUtcEpochBuckets() {
+        assertEquals(0, ImuSessionFileStore.bucketStart(1_799))
+        assertEquals(1_800, ImuSessionFileStore.bucketStart(1_800))
+        assertEquals(1_800, ImuSessionFileStore.bucketStart(3_599))
+        assertEquals("19700101T003000Z", ImuSessionFileStore.utcName(1_800))
+    }
+
+    @Test fun collectorExportsCanonicalImusWithoutDerivedImuc() {
+        val collector = source("GroundTruthCollector.kt")
+        val store = source("ImuSessionFileStore.kt")
+        assertTrue(collector.contains("exportSegments(id, sensorFrom, sensorTo)"))
+        assertTrue(collector.contains("ZipEntry(\"imu/\${segment.name}\")"))
+        assertTrue(store.contains("Whoop5RawImu.rawColumns(frame)"))
+        assertTrue(store.contains("SEGMENT_SECONDS = 30 * 60L"))
+        assertFalse(collector.contains(".imuc"))
+        assertFalse(store.contains("frame.copyOf()"))
+    }
+
+    @Test fun liveCoverageUsesTimestampIndexInsteadOfDecodingPayloads() {
+        val store = source("ImuSessionFileStore.kt")
+        val stats = store.substringAfter("fun stats(").substringBefore("fun append(")
+        assertTrue(stats.contains("timestamps(file)"))
+        assertFalse(stats.contains("readRecords("))
+    }
+
+    @Test fun editedWindowOwnsPublicEventsAndImuBounds() {
+        val collector = source("GroundTruthCollector.kt")
+        assertTrue(collector.contains("publicEvents(events, summary.startedAtMs, endMs, deviceId)"))
+        assertTrue(collector.contains("summary.markers.filter { it.atMs in summary.startedAtMs..endMs }"))
+        assertTrue(collector.contains("val sensorFrom = ceilSecond(summary.startedAtMs)"))
+        assertTrue(collector.contains("val sensorTo = endMs / 1_000L - 1L"))
+        assertTrue(collector.contains("summary.capturedStartedAtMs != null"))
+        assertTrue(collector.contains("imuSegments.minOfOrNull { it.startTs }"))
+        assertTrue(collector.contains("val sensorAvailable = imuSegments.isNotEmpty() ||"))
+    }
+
+    @Test fun sessionPayloadDeletionKeepsDiscoveryFileUntilLast() {
+        val collector = source("GroundTruthCollector.kt")
+        assertTrue(collector.contains("if (!imuStore.deleteFiles(sessionId)) return false"))
+        assertTrue(collector.contains("if (eventFile(sessionId).exists() && !eventFile(sessionId).delete()) return false"))
+    }
+
+    @Test fun rawCollectorHasNoStepAlgorithmExport() {
+        val collector = source("GroundTruthCollector.kt")
+        assertFalse(collector.contains("algorithm-signals.csv"))
+        assertFalse(collector.contains("stepSamples("))
+    }
+}
diff --git a/android/app/src/test/java/com/noop/testcentre/RawDataCollectorParityTest.kt b/android/app/src/test/java/com/noop/testcentre/RawDataCollectorParityTest.kt
new file mode 100644
index 0000000000..0fe1afac2e
--- /dev/null
+++ b/android/app/src/test/java/com/noop/testcentre/RawDataCollectorParityTest.kt
@@ -0,0 +1,51 @@
+package com.noop.testcentre
+
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.io.File
+
+/** Android half of the shared feature-level raw-data collector parity guard. */
+class RawDataCollectorParityTest {
+    private val oracleBytes: ByteArray
+        get() = requireNotNull(javaClass.classLoader!!.getResourceAsStream("raw_data_collector_parity.json"))
+            .use { it.readBytes() }
+
+    private fun repoRoot(): File {
+        var cursor = File(System.getProperty("user.dir") ?: ".").canonicalFile
+        repeat(4) {
+            if (File(cursor, "android/app/src/main").isDirectory) return cursor
+            cursor = cursor.parentFile ?: cursor
+        }
+        error("repository root not found from ${System.getProperty("user.dir")}")
+    }
+
+    @Test fun androidSurfaceStillImplementsEveryDeclaredCapability() {
+        val root = repoRoot()
+        val source = listOf(
+            "android/app/src/main/java/com/noop/testcentre/GroundTruthCollector.kt",
+            "android/app/src/main/java/com/noop/testcentre/ImuSessionFileStore.kt",
+            "android/app/src/main/java/com/noop/testcentre/ImuSessionFileStore.kt",
+            "android/app/src/main/java/com/noop/data/WhoopDatabase.kt",
+            "android/app/src/main/java/com/noop/data/Entities.kt",
+            "android/app/src/main/java/com/noop/data/WhoopRepository.kt",
+            "android/app/src/main/java/com/noop/ui/GroundTruthCollectorScreen.kt",
+            "android/app/src/main/java/com/noop/ble/WhoopBleClient.kt",
+            "android/app/src/main/res/values/strings.xml",
+        ).joinToString("\n") { File(root, it).readText() }
+        val capabilities = JSONObject(oracleBytes.toString(Charsets.UTF_8)).getJSONObject("capabilities")
+        for (name in capabilities.keys()) {
+            val markers = capabilities.getJSONObject(name).getJSONArray("kotlin")
+            for (index in 0 until markers.length()) {
+                val marker = markers.getString(index)
+                assertTrue("Android collector lost $name marker: $marker", source.contains(marker))
+            }
+        }
+    }
+
+    @Test fun androidAndAppleOracleCopiesAreByteIdentical() {
+        val apple = File(repoRoot(), "StrandTests/Resources/raw_data_collector_parity.json")
+        assertEquals(oracleBytes.toList(), apple.readBytes().toList())
+    }
+}
diff --git a/android/app/src/test/resources/raw_data_collector_parity.json b/android/app/src/test/resources/raw_data_collector_parity.json
new file mode 100644
index 0000000000..a843cb951b
--- /dev/null
+++ b/android/app/src/test/resources/raw_data_collector_parity.json
@@ -0,0 +1,69 @@
+{
+  "schema_version": 1,
+  "capabilities": {
+    "start_stop": {
+      "swift": ["startGroundTruthRawCapture", "stopGroundTruthRawCapture"],
+      "kotlin": ["startGroundTruthImuCapture", "stopGroundTruthImuCapture"]
+    },
+    "persisted_sessions": {
+      "swift": ["RawDataSessionStore", "persist(session)"],
+      "kotlin": ["GroundTruthCollector", "sessionStartKey"]
+    },
+    "session_comments": {
+      "swift": ["setComment(", "Session comment"],
+      "kotlin": ["setComment(", "ground_truth_comment"]
+    },
+    "session_markers": {
+      "swift": ["addMarker(sessionId:", "updateMarker(sessionId:", "deleteMarker(sessionId:", "Add marker"],
+      "kotlin": ["fun addMarker(", "fun updateMarker(", "fun deleteMarker(", "ground_truth_add_marker"]
+    },
+    "from_to_time": {
+      "swift": ["func range(", "endedAtMs"],
+      "kotlin": ["sessionTimeRange(", "endedAtMs"]
+    },
+    "session_export": {
+      "swift": ["exportEntries(for:", "Export session"],
+      "kotlin": ["suspend fun export(", "ground_truth_export"]
+    },
+    "historical_time_windows": {
+      "swift": ["createHistorical(deviceId:", "Historical export window"],
+      "kotlin": ["createHistoricalSession(", "ground_truth_add_historical"]
+    },
+    "editable_analysis_range": {
+      "swift": ["func setRange(sessionId:", "DatePicker(\"From\""],
+      "kotlin": ["fun setSessionRange(", "ground_truth_edit_start"]
+    },
+    "file_only_imu_storage": {
+      "swift": ["v41-drop-raw-imu-sample"],
+      "kotlin": ["MIGRATION_34_35", "DROP TABLE IF EXISTS `rawImuSample`"]
+    },
+    "session_bound_imu_file": {
+      "swift": ["ImuSessionFileStore", "segmentSeconds: Int64 = 30 * 60", "NOOPIMU2"],
+      "kotlin": ["ImuSessionFileStore", "SEGMENT_SECONDS = 30 * 60L", "NOOPIMU2"]
+    },
+    "decoded_segment_export": {
+      "swift": ["exportSegments", "imu/\\(segment.name)"],
+      "kotlin": ["exportSegments", "imu/${segment.name}"]
+    },
+    "explicit_imu_coverage": {
+      "swift": ["imu-coverage.json", "private static func covers"],
+      "kotlin": ["imu_100hz_complete", "private fun covers"]
+    },
+    "delete_one_and_all_with_confirmation": {
+      "swift": ["Delete this session?", "Delete all sessions?", "removeMetadata(session.id)"],
+      "kotlin": ["ground_truth_delete_session_title", "ground_truth_delete_all_title", "deleteAllSessions"]
+    },
+    "active_session_delete_guard": {
+      "swift": ["guard session.endedAtMs != nil else { return }", ".disabled(store.active != nil)"],
+      "kotlin": ["current.active && current.sessionId == sessionId", "sessions.none { it.active }"]
+    },
+    "bluetooth_reconnect_rearm": {
+      "swift": ["onChangeCompat(of: live.bonded)", "rawCaptureInFlight = false"],
+      "kotlin": ["LaunchedEffect(state.active, state.sessionId, live.connected)", "startGroundTruthImuCapture"]
+    },
+    "session_files_removed_with_session": {
+      "swift": ["deleteFiles(sessionId", "removeItem(metadata)"],
+      "kotlin": ["deleteFiles(sessionId)", "eventFile(sessionId).delete()"]
+    }
+  }
+}
diff --git a/android/app/src/test/resources/schema_oracle.json b/android/app/src/test/resources/schema_oracle.json
index 4cb35172f1..64fd84960b 100644
--- a/android/app/src/test/resources/schema_oracle.json
+++ b/android/app/src/test/resources/schema_oracle.json
@@ -41,7 +41,8 @@
     "v37-daily-avg-sdnn",
     "v38-apple-step-hour",
     "v39-ppg-burst-index",
-    "v40-daily-skin-temp-absolute"
+    "v40-daily-skin-temp-absolute",
+    "v41-drop-raw-imu-sample"
   ],
   "divergenceReasons": {
     "android-orphan-synced-column": "REAL COLUMN DRIFT: `synced` exists on Android only. GRDB's v10 note is explicit that stepSample gets no `synced` column ('unused; see StreamStore'), and v12's ppgHrSample never had one either; the Room entities copied the flag from the older per-second entities. Nothing reads it on Android — the per-row upload flag belongs to an upload path that does not exist there — so it is dead width, not divergent data. Removing it needs a Room table rebuild.",
@@ -1259,34 +1260,6 @@
       ],
       "indices": []
     },
-    "rawImuSample": {
-      "platform": "both",
-      "columns": [
-        {
-          "name": "deviceId",
-          "affinity": "TEXT",
-          "notNull": true,
-          "default": null
-        },
-        {
-          "name": "ts",
-          "affinity": "INTEGER",
-          "notNull": true,
-          "default": null
-        },
-        {
-          "name": "samples",
-          "affinity": "BLOB",
-          "notNull": true,
-          "default": null
-        }
-      ],
-      "primaryKey": [
-        "deviceId",
-        "ts"
-      ],
-      "indices": []
-    },
     "respSample": {
       "platform": "both",
       "columns": [
diff --git a/docs/BLE_REVERSE_ENGINEERING.md b/docs/BLE_REVERSE_ENGINEERING.md
index bf7cb94ac6..289e5b71a4 100644
--- a/docs/BLE_REVERSE_ENGINEERING.md
+++ b/docs/BLE_REVERSE_ENGINEERING.md
@@ -312,9 +312,17 @@ stream off, NOOP's primary metric source becomes the **historical offload** (nex
 ### On-demand raw capture
 
 For research, raw IMU can be captured for a bounded window with `captureRawAccel(seconds:)`, which
-sends `START_RAW_DATA` (81) + `TOGGLE_IMU_MODE` (106), records for the window, then re-issues
-`STOP_RAW_DATA` and disables the stream again. This is opt-in only; the global research toggle
-(`enableRawCapture`) defaults **off** and the app is decoded-only otherwise.
+sends `START_RAW_DATA` (81) followed by `TOGGLE_IMU_MODE` (106), records for the window, then
+re-issues `STOP_RAW_DATA` and disables the stream again. This ordering is hardware-verified on a
+WHOOP 5/MG: opcode 106 alone returns an acknowledgement but does **not** start the producer. The 5/MG
+selector is two bytes (`[0x01, 0x01]` on, `[0x01, 0x00]` off); retaining the older one-byte form here
+was why an apparently successful capture contained no realtime IMU packets.
+
+The manually stopped Raw Data Collector uses the same sequence and accepts delayed historical IMU
+buffers into the session by strap timestamp, so a later offload can repair a Bluetooth gap. This is
+opt-in and bounded; the global research toggle (`enableRawCapture`) defaults **off** and the app is
+decoded-only otherwise. Storage/export details and consumer ordering rules are in
+[5/MG raw data capture](RAW_DATA_CAPTURE.md).
 
 ---
 
@@ -930,9 +938,11 @@ anything, it plausibly gates *those streams* rather than the offload.
 Our exposure to that is limited but not zero, and worth stating precisely. NOOP takes live HR from the
 standard `0x2A37` profile and disables the R10/R11 flood on connect (§4), and it never sends
 `TOGGLE_OPTICAL_MODE` (108) at all. But `captureRawAccel` **does** send `START_RAW_DATA` (81) +
-`TOGGLE_IMU_MODE` (106) — on demand, for a bounded window, never continuously. So the one place this
-could bite is an on-demand raw-accel capture on a 5/MG. Whether that path yields IMU frames today is
-the observation that would settle the narrow claim, and it is not recorded anywhere here.
+`TOGGLE_IMU_MODE` (106) — on demand, for a bounded window, never continuously. That path is now
+hardware-verified to yield decoded 100 Hz six-axis IMU after the two-byte 5/MG selector is used.
+It works without implementing a `LINK_VALID` response, so the proposed handshake is not required for
+this raw-IMU producer on the tested strap/firmware. This does not prove that every firmware treats
+`LINK_VALID` identically or that ignoring it can never affect link stability.
 
 **Two questions are genuinely open**, and a capture answers both without implementing anything:
 
diff --git a/docs/DATA_MODEL.md b/docs/DATA_MODEL.md
index 0306fffdab..43b5d2b134 100644
--- a/docs/DATA_MODEL.md
+++ b/docs/DATA_MODEL.md
@@ -297,6 +297,11 @@ inserts, identical range-read shape).
 
 **Primary key:** `(deviceId, ts)`.
 
+This is the low-rate decoded vector used by normal analytics, not the 100 Hz six-axis capture.
+High-rate IMU deliberately remains outside SQLite. Capture sessions own canonical, decoded `.imus`
+files split into fixed 30-minute UTC segments with independently compressed 30-second blocks. See
+[5/MG raw data capture](RAW_DATA_CAPTURE.md#storage-design).
+
 ---
 
 ## Raw outbox (transient, prunable)
diff --git a/docs/PROTOCOL.md b/docs/PROTOCOL.md
index 975a09fed4..aa85fa7be2 100644
--- a/docs/PROTOCOL.md
+++ b/docs/PROTOCOL.md
@@ -424,6 +424,12 @@ public func frame(seq: UInt8, payload: [UInt8] = [0x00]) -> [UInt8] {
 | 122 | `STOP_HAPTICS` | `[0x00]` | stop an in-progress haptic |
 | 123 | `SELECT_WRIST` | — | set strap wrist |
 
+**5/MG raw-IMU sequence (hardware-verified):** command 106 accepting a write does not mean that the
+producer started. A bounded capture first sends `START_RAW_DATA` (81) `[0x01]`, then command 106 with
+the two-byte selector `[0x01, 0x01]`. Stop uses `STOP_RAW_DATA` (82) `[0x01]`, then command 106
+`[0x01, 0x00]`. The one-byte payload in the table remains the WHOOP 4 form. See
+[5/MG raw data capture](RAW_DATA_CAPTURE.md) for storage, history repair, and export semantics.
+
 **Payload builders** in `WhoopCommand`:
 
 - `setAlarmPayload(epochSec:)` → `[0x01] + epoch u32 LE + [0x00, 0x00]` (7 bytes).
diff --git a/docs/RAW_DATA_CAPTURE.md b/docs/RAW_DATA_CAPTURE.md
new file mode 100644
index 0000000000..e03115f6c4
--- /dev/null
+++ b/docs/RAW_DATA_CAPTURE.md
@@ -0,0 +1,139 @@
+# 5/MG raw data capture
+
+**Status:** experimental, user-initiated, hardware-verified on WHOOP 5/MG. The capture path is a
+research/export facility; it does not feed production health or activity scores.
+
+## What it is for
+
+The Raw Data Collector records a bounded interval of the strap's high-rate six-axis motion data and
+exports it with enough provenance to analyse later. Typical uses are protocol validation, labelled
+activity datasets, offline algorithm development, and checking whether a Bluetooth interruption was
+repaired by a later history sync.
+
+It lives in **Test Centre → 5/MG Raw Data Collector** on Android and Apple platforms. A session may be
+started and stopped live, or created afterwards for an existing time range. Start/end times of a
+completed session can be edited, individual sessions can be deleted, and all completed sessions can
+be deleted after confirmation. Timestamped markers can identify a moment, start, end, or issue; each
+marker may also carry a short note and remains editable after the session stops.
+
+## What was verified on hardware
+
+On WHOOP 5/MG, command 106 by itself can return `SUCCESS` without starting any IMU producer. The
+working bounded sequence is:
+
+1. `START_RAW_DATA` (81), payload `[0x01]`;
+2. `TOGGLE_IMU_MODE` (106), payload `[0x01, 0x01]`;
+3. receive and decode the 100 Hz six-axis buffers;
+4. on stop, send `STOP_RAW_DATA` (82), payload `[0x01]`, then `TOGGLE_IMU_MODE` with
+   `[0x01, 0x00]`.
+
+The writes use the authenticated WHOOP command characteristic and require a connected/bonded strap.
+An accepted command is not evidence that samples arrived, so the collector reports connection state,
+request state, packet/byte counts, the last packet time, and history-sync progress separately.
+
+The decoded IMU buffer contains 100 signed 16-bit samples for each of `ax, ay, az, gx, gy, gz`, keyed
+by a strap Unix timestamp. Accelerometer scale is `1/4096 g/LSB`; gyroscope scale is
+`0.06104 deg/s/LSB`. See [BLE reverse engineering](BLE_REVERSE_ENGINEERING.md#4-the-realtime-r10r11-raw-stream-type-43)
+for the byte layout and validation evidence.
+
+## Live capture and history repair
+
+A live BLE connection is not assumed to be lossless. Each session is a time window tied to one strap,
+and incoming IMU buffers are routed by **strap timestamp**, not by arrival time. If Bluetooth is off or
+the phone is disconnected during part of a recording, matching delayed buffers from a later historical
+offload can still be appended to the session. Duplicate timestamps are discarded.
+
+On Android, an active 100 Hz capture temporarily requests the high-throughput GATT connection
+priority. A later historical offload does the same while it repairs an incomplete capture, then returns
+the link to the balanced priority. This bounded lease is independent of the global experimental
+history-speed preference. Apple's CoreBluetooth chooses connection parameters itself and exposes no
+equivalent app-side priority request, so iOS keeps the same capture and repair lifecycle without a
+non-functional transport toggle.
+
+Consequences for consumers:
+
+- file order is not chronological: repaired older history may be appended after newer live data;
+- strap timestamp is authoritative and readers must sort by it;
+- export metadata reports actual chunk coverage and `imu_100hz_complete`; it must not infer complete
+  capture merely because the user started and stopped a session;
+- history can repair only data the strap actually retained. The design does not promise that every
+  firmware retains every high-rate buffer for later offload.
+
+The historical-range action is therefore useful even when the collector was not running at the time:
+it creates a session window over raw IMU buffers already available locally or delivered by the next
+history sync. A range is currently bounded to seven days to keep an accidental export finite.
+
+## Storage design
+
+High-rate samples do **not** live as one SQLite row per sample. That would add avoidable write
+amplification, database growth, migration burden, and backup cost to data whose main consumer is a
+sequential signal-analysis job.
+
+Instead, storage is split by responsibility:
+
+| Data | Storage | Lifetime |
+|---|---|---|
+| Session window, comments, and markers | Small app-private JSON/JSONL metadata | Until the user deletes the session |
+| Decoded 100 Hz IMU | App-private `.imus` segment files | Until the user explicitly deletes the session |
+
+Each session owns fixed 30-minute UTC `.imus` segments. Late history data is routed by its strap
+timestamp, so reconnecting after a workout does not put old samples into the current file. A segment
+contains decoded, column-major, little-endian signed 16-bit accelerometer and gyroscope samples plus
+the strap timestamp and phone receive time. Up to 30 one-second frames form an independently
+zlib-compressed append block. A truncated final block after a crash does not make earlier blocks
+unreadable.
+
+There is no high-rate SQLite table or separate derived archive format. The time-addressable `.imus`
+segments are both the retained source and the canonical analysis format. Readers must still sort and
+deduplicate by strap timestamp because history frames can arrive late. Exports clip the first and last
+segment to the selected interval without changing the retained source, so the same session can be
+exported repeatedly after its window is edited.
+
+## Session export
+
+The shareable ZIP contains session provenance and all available sensor material for its selected
+interval. Android currently includes `meta.json`, event JSONL and CSV files, decoded one-second
+signals, raw sensor CSV, and `imu/*.imus`. Apple exports equivalent session metadata/events,
+`history-sensors.csv`, `imu-coverage.json`, and IMU segments through its platform export path. Inspect
+`meta.json` plus the platform's IMU coverage object first:
+
+- `started_at_ms` / `ended_at_ms` are the selected analysis interval;
+- `captured_started_at_ms` / `captured_ended_at_ms`, when present, preserve the physical recording
+  interval even after the selected interval is edited;
+- Android's `imu_100hz_coverage` identifies the segments actually present and `imu_100hz_complete` is
+  the conservative coverage result; Apple carries the same facts in `imu-coverage.json`;
+
+Exports stay local until the user invokes the operating system's share sheet. Raw captures are not
+part of routine cloud sync or telemetry, consistent with NOOP's offline-first privacy model. The
+suggested archive name is `noop-5mg-raw-<session-id>.zip`.
+
+## Scope and operational limits
+
+- Capture is deliberately bounded and explicit. One uncontrolled WHOOP 5/MG discharge trace provides
+  a useful order of magnitude, not a benchmark: a 5 h 47 min overnight capture consumed about
+  `0.71 percentage points/hour`, and two later 42–45 minute captures each consumed about
+  `0.57 percentage points/hour`. Nearby non-capture periods in the same discharge averaged about
+  `0.31 percentage points/hour`; a separate 5.6-day pre-capture baseline averaged about
+  `0.46 percentage points/hour`. These single-band observations suggest roughly 1.5–2.3× the normal
+  drain while 100 Hz is active, depending on the chosen baseline. They do **not** establish a general
+  runtime guarantee or isolate producer, BLE, and history-repair costs.
+- The current evidence does **not** establish flash-retention, thermal, or BLE-airtime costs for
+  continuous 24/7 100 Hz operation.
+- A one-hour workout/research capture succeeding does not establish that a 36-hour rolling recorder is
+  safe. Any future rolling buffer needs hardware measurements and an explicit retention policy.
+- The separately enabled protocol trace remains a general diagnostics tool. Starting a Raw Data
+  Collector session does not enable it or duplicate its transport frames into the raw outbox.
+- Session capture has one source of truth for high-rate motion: its file-backed `.imus` segments.
+- Do not use arrival order as time, do not fill gaps silently, and do not claim 100 Hz coverage from
+  packet count alone.
+
+## Implementation map
+
+| Concern | Apple | Android |
+|---|---|---|
+| Collector UI | `Strand/Screens/RawDataCollectorView.swift` | `com.noop.ui.GroundTruthCollectorScreen` |
+| Session metadata | `RawDataSessionStore` | `GroundTruthCollector` |
+| Live command path | `BLEManager.startGroundTruthRawCapture` | `WhoopBleClient.startGroundTruthImuCapture` |
+| Append/recovery window | `ImuSessionFileStore` | `ImuSessionFileStore` |
+| Canonical segmented storage/export | `ImuSessionFileStore` | `ImuSessionFileStore` |
+| Raw decoder | `Whoop5RawImu` in `WhoopProtocol` | `Whoop5RawImu` in `com.noop.protocol` |
diff --git a/docs/WHOOP5_DEEP_DATA.md b/docs/WHOOP5_DEEP_DATA.md
index ade528ec0e..e2f9734d09 100644
--- a/docs/WHOOP5_DEEP_DATA.md
+++ b/docs/WHOOP5_DEEP_DATA.md
@@ -79,6 +79,19 @@ that otherwise reproduced flags 1–15 byte-for-byte in this order.
 - **iOS / Android only on real hardware:** macOS CoreBluetooth can't complete the authenticated SMP bond
   the command characteristic requires, so the write path is unavailable on Mac.
 
+## High-rate IMU capture is a separate switch
+
+The R22 feature flags above govern deep-history products; they are not the missing step for an explicit
+100 Hz motion session. Hardware testing found a separate bounded raw-data sequence: `START_RAW_DATA`
+(81) must precede the two-byte 5/MG `TOGGLE_IMU_MODE` (106) selector. Sending 106 alone can return
+`SUCCESS` while producing no packets. With `[0x01, 0x01]` after command 81, NOOP receives and decodes
+the six-axis 100 Hz buffers; stop uses command 82 followed by `[0x01, 0x00]`.
+
+This establishes an on-demand research/workout capture path, not a safe continuous mode. Battery,
+retention, and BLE-airtime cost over day-scale recording remain unmeasured. The session collector,
+file-backed storage, Bluetooth-gap repair, and export contract are documented in
+[5/MG raw data capture](RAW_DATA_CAPTURE.md).
+
 ## Honest limits
 
 - **No cloud scores.** Recovery/strain/sleep *scores* are computed in WHOOP's cloud and no public
@@ -90,9 +103,10 @@ that otherwise reproduced flags 1–15 byte-for-byte in this order.
   `get_data_range`/`send_historical_data` loop NOOP already runs. If it does, the write path is belt-and-
   suspenders.
 - **The large records are no longer an undifferentiated type-`0x2F` blob.** Layout v21 (1,244 bytes)
-  contains six-axis IMU data; layout v20 (2,140 bytes) contains five repeated optical measurement
-  blocks; layout v26 contains a 24-sample PPG waveform. The v20 blocks are preserved without
-  wavelength labels because the current capture does not prove red/IR identity.
+  contains six-axis IMU data; layout v20 (2,140 bytes) contains five repeated measurement blocks whose
+  sensor identity remains open; layout v26 contains a 24-sample PPG waveform. The v20 blocks are
+  preserved without optical/wavelength labels because the current capture does not prove what produced
+  them, let alone red/IR identity.
 - **SpO₂ is not “one calibration away.”** The current v20 corpus has three active measurement blocks,
   but it has not established two separate red and infrared illumination measurements. See
   [`WHOOP5_OPTICAL_EXPERIMENT.md`](WHOOP5_OPTICAL_EXPERIMENT.md) for the passive controlled experiment

From d8252c8bbbb39f874dc88df140ec9991b5740e5a Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 01:56:44 +1200
Subject: [PATCH 069/333] raw-capture: describe deleteSession's actual failure
 behaviour

The comment promised that every deletion is evaluated "even if one fails, so a
stale export ZIP never survives merely because an earlier file could not be
removed". The IMU delete returns ahead of the ZIP delete, so a failed IMU delete
leaves exactly that ZIP behind - the one case the comment said could not happen.

The behaviour is the right one and is left alone: each step aborts on first
failure, the session stays listed, and the delete action stays retryable. So
whatever survives is still owned by a visible session rather than orphaned, which
is the property actually worth stating. It rests on deleteFiles() being idempotent
on both platforms - Kotlin reads a missing directory as an empty listing, Swift
guards on fileExists and returns true - so the retry re-runs the earlier steps
cleanly instead of wedging on work already done.
---
 .../main/java/com/noop/testcentre/GroundTruthCollector.kt   | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/android/app/src/main/java/com/noop/testcentre/GroundTruthCollector.kt b/android/app/src/main/java/com/noop/testcentre/GroundTruthCollector.kt
index e89ff34a20..064f2cf071 100644
--- a/android/app/src/main/java/com/noop/testcentre/GroundTruthCollector.kt
+++ b/android/app/src/main/java/com/noop/testcentre/GroundTruthCollector.kt
@@ -151,8 +151,10 @@ class GroundTruthCollector private constructor(private val context: Context) {
         if (sessions().none { it.id == sessionId }) return false
 
         val payloadFiles = listOf(File(context.cacheDir, "logs/noop-5mg-raw-$sessionId.zip"))
-        // Evaluate every deletion even if one fails, so a stale export ZIP never survives merely
-        // because an earlier file could not be removed.
+        // Each step aborts on the first failure, so a delete is all-or-nothing from the user's side:
+        // whatever survives is still owned by a session that is still listed, never orphaned. That
+        // relies on deleteFiles() being idempotent - a missing directory reads as success - so the
+        // retry re-runs the earlier steps cleanly.
         val imuStore = ImuSessionFileStore(context)
         if (!imuStore.deleteFiles(sessionId)) return false
         if (!payloadFiles.all { file -> !file.exists() || file.delete() }) return false

From 16835297074a38a89d1cf3c584d3d0c2a8f79e7f Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 02:12:02 +1200
Subject: [PATCH 070/333] raw-capture: guard the export archive's cleanup path

Deleting a session removes the exported ZIP from cacheDir/logs, but nothing
checked that. The line left the parity oracle correctly - it is Android-only, so
it never belonged there - and was never picked up by the source contract, so the
cleanup sat unguarded on both sides of the move.

The risk is not that the delete disappears. The writer builds cacheDir/logs plus
noop-5mg-raw-$id.zip; the deleter builds cacheDir plus the whole relative path in
one string. Two independent expressions for one location, several hundred lines
apart, so moving the writer leaves the deleter pointing at nothing and every
exported archive is orphaned in the cache with no failure anywhere. The test pins
both ends, and the comment says why it cannot be expressed as parity: macOS
exports through NSSavePanel to a user-chosen destination and keeps no app-side
copy, so there is nothing for the Apple half to clean up.

Mutation-verified rather than assumed green: pointing the writer at logs2 fails
this test and only this test.
---
 .../testcentre/RawCaptureExportContractTest.kt    | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/android/app/src/test/java/com/noop/testcentre/RawCaptureExportContractTest.kt b/android/app/src/test/java/com/noop/testcentre/RawCaptureExportContractTest.kt
index 28282a4726..f0bcb29f43 100644
--- a/android/app/src/test/java/com/noop/testcentre/RawCaptureExportContractTest.kt
+++ b/android/app/src/test/java/com/noop/testcentre/RawCaptureExportContractTest.kt
@@ -59,6 +59,21 @@ class RawCaptureExportContractTest {
         assertTrue(collector.contains("if (eventFile(sessionId).exists() && !eventFile(sessionId).delete()) return false"))
     }
 
+    // Android-only, so it cannot live in the raw_data_collector_parity oracle: macOS exports through
+    // NSSavePanel to a destination the user picks and keeps no app-side copy, while Android must
+    // materialise the archive under cacheDir for FileProvider and therefore has to clean it up. The
+    // writer and the deleter build that path from separate expressions, so pin both - moving one
+    // without the other orphans every exported ZIP silently.
+    @Test fun exportArchiveIsDeletedFromThePathTheExportWroteIt() {
+        val collector = source("GroundTruthCollector.kt")
+        assertTrue(collector.contains("val outDir = File(context.cacheDir, \"logs\").apply { mkdirs() }"))
+        assertTrue(collector.contains("val zip = File(outDir, \"noop-5mg-raw-\$id.zip\")"))
+        assertTrue(collector.contains(
+            "val payloadFiles = listOf(File(context.cacheDir, \"logs/noop-5mg-raw-\$sessionId.zip\"))"))
+        assertTrue(collector.contains(
+            "if (!payloadFiles.all { file -> !file.exists() || file.delete() }) return false"))
+    }
+
     @Test fun rawCollectorHasNoStepAlgorithmExport() {
         val collector = source("GroundTruthCollector.kt")
         assertFalse(collector.contains("algorithm-signals.csv"))

From bf26c04cc8c29da27f16f066554d306dfd4de08f Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 02:16:26 +1200
Subject: [PATCH 071/333] staging: build 382/263 for the raw-data collector
 testing build

versionCode 381 -> 382 and CURRENT_PROJECT_VERSION 262 -> 263. MARKETING_VERSION
and versionName stay at 10.6.1 - that is the next unreleased line and v10.6.1 has
not shipped, so the display version holds while only the build numbers move.

382 is +1 on the staging high-water rather than on anything main released, so a
sideload updates in place instead of Android refusing the downgrade.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 32e661f24a..fb95b551ab 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 381
+        versionCode = 382
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index e25ac6b321..eca3f30433 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "262"
+    CURRENT_PROJECT_VERSION: "263"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From b012f07e2066ce564d27d87febd83da0cd08b461 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 02:50:43 +1200
Subject: [PATCH 072/333] db: open at version 35 so existing installs survive
 #1709

Build 382 crashed on launch for anyone with an existing database. #1709 removed
RawImuSampleEntity from the @Database entities list, registered MIGRATION_34_35
and bumped SCHEMA_VERSION to 35, but left @Database(version = 34).

Room hashes the declared entity set into room_master_table and re-checks it on
open, so a changed schema under an unchanged version throws "Room cannot verify
the data integrity" before any UI exists. A FRESH install writes the hash from the
new schema and runs perfectly, which is why 15 checks, 4807 unit tests, the macOS
and iOS app builds and every review pass stayed green: the failure needs a device
that already has data, and CI never has one.

Three numbers have to agree and only two were tied together. WhoopDatabaseMigration
ChainTest asserted chain-end == SCHEMA_VERSION; SchemaOracleTest asserted the
oracle's roomVersion == the exported annotation version. Both passed, because the
annotation agreed with the oracle at 34 while SCHEMA_VERSION sat at 35 and nothing
compared those two. The chain test's own doc block called SCHEMA_VERSION "the
database's declared version", which is the conflation that hid it.

theRoomAnnotationVersionMatchesSchemaVersion closes that third leg, read from
source text because androidx.room.Database is CLASS-retention and a reflective
read would return null and silently assert nothing. Mutation-verified: restoring
version = 34 fails it and only it. The oracle's roomVersion moves to 35 in both
byte-identical copies, and the migration drops with IF EXISTS, so a database that
did reach 34 under the new entity set migrates cleanly either way.
---
 .../Resources/schema_oracle.json              |  2 +-
 .../main/java/com/noop/data/WhoopDatabase.kt  |  2 +-
 .../data/WhoopDatabaseMigrationChainTest.kt   | 43 ++++++++++++++++++-
 .../app/src/test/resources/schema_oracle.json |  2 +-
 4 files changed, 44 insertions(+), 5 deletions(-)

diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json b/Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json
index 64fd84960b..b28e537ed7 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json
@@ -1,6 +1,6 @@
 {
   "_readme": "SHARED Room<->GRDB SCHEMA ORACLE (#775). Two byte-identical copies: Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json and android/app/src/test/resources/schema_oracle.json. SchemaOracleTests.swift compares GRDB's PRAGMA table_info/index_list against it; SchemaOracleTest.kt compares Room's exported schema JSON against it. `columns` is the iOS/GRDB shape in GRDB column order (macOS is the reference implementation); every way Android differs is spelled out in an `android` / `iosAbsent` / `androidColumnOrder` override naming a key in `divergenceReasons`. Adding a column, reordering one, or changing a type/nullability on one platform only fails both suites until it is either fixed or written down here.",
-  "roomVersion": 34,
+  "roomVersion": 35,
   "grdbMigrations": [
     "v1",
     "v2",
diff --git a/android/app/src/main/java/com/noop/data/WhoopDatabase.kt b/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
index 0792761b26..ced37f86e0 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
@@ -53,7 +53,7 @@ import androidx.sqlite.db.SupportSQLiteDatabase
         V18AuxSampleEntity::class,
         AppleStepHour::class,
     ],
-    version = 34,
+    version = 35,
     // #775: ON so Room's KSP processor writes the generated schema (every table's exact `CREATE TABLE`,
     // columns in declaration order with affinity/NOT NULL/default, PK and indices) as JSON. That export
     // is what lets a plain JVM test — no device, no Robolectric — read Android's REAL schema and compare
diff --git a/android/app/src/test/java/com/noop/data/WhoopDatabaseMigrationChainTest.kt b/android/app/src/test/java/com/noop/data/WhoopDatabaseMigrationChainTest.kt
index 7cc2f423c3..e8c4c45fc7 100644
--- a/android/app/src/test/java/com/noop/data/WhoopDatabaseMigrationChainTest.kt
+++ b/android/app/src/test/java/com/noop/data/WhoopDatabaseMigrationChainTest.kt
@@ -56,10 +56,12 @@ class WhoopDatabaseMigrationChainTest {
     }
 
     /**
-     * The chain must end exactly at the database's declared version.
+     * The chain must end exactly at [WhoopDatabase.SCHEMA_VERSION].
      *
      * Catches the other half of the mistake: bumping [WhoopDatabase.SCHEMA_VERSION] and forgetting the
-     * migration, which fails the same way on upgrade.
+     * migration, which fails the same way on upgrade. Note that SCHEMA_VERSION is a hand-maintained
+     * constant, NOT the `@Database(version = ...)` Room actually opens with - the two are tied together
+     * by [theRoomAnnotationVersionMatchesSchemaVersion] below, not here.
      */
     @Test
     fun theChainReachesTheDeclaredSchemaVersion() {
@@ -72,4 +74,41 @@ class WhoopDatabaseMigrationChainTest {
             WhoopDatabase.SCHEMA_VERSION, chain.last().endVersion,
         )
     }
+
+    /**
+     * `@Database(version = ...)` must equal [WhoopDatabase.SCHEMA_VERSION].
+     *
+     * This is the third leg, and the one #1709 fell through: it removed an entity, registered
+     * MIGRATION_34_35 and bumped SCHEMA_VERSION to 35, but left the annotation at 34. Every test above
+     * passed, because the chain agreed with SCHEMA_VERSION and nothing compared either to the number
+     * Room opens the database with.
+     *
+     * The consequence is the worst-shaped kind. Room hashes the declared entity set into
+     * `room_master_table` and re-checks it on open, so a changed schema under an unchanged version
+     * throws "Room cannot verify the data integrity" for every EXISTING install, on launch, before any
+     * UI. A fresh install writes the hash from the new schema and runs perfectly - so emulators, CI and
+     * every test here stay green while the shipped build crashes on exactly the devices that have data.
+     *
+     * Read from source text rather than reflection: androidx.room.Database is CLASS-retention, so it is
+     * absent at runtime and a reflective read would quietly return null and assert nothing.
+     */
+    @Test
+    fun theRoomAnnotationVersionMatchesSchemaVersion() {
+        var root = java.io.File(System.getProperty("user.dir") ?: ".").canonicalFile
+        var source: String? = null
+        repeat(4) {
+            val f = java.io.File(root, "android/app/src/main/java/com/noop/data/WhoopDatabase.kt")
+            if (f.isFile && source == null) source = f.readText()
+            root = root.parentFile ?: root
+        }
+        val text = source ?: error("WhoopDatabase.kt not found - this test must not pass by default")
+        val declared = Regex("""@Database\(.*?\bversion\s*=\s*(\d+)""", RegexOption.DOT_MATCHES_ALL)
+            .find(text)?.groupValues?.get(1)?.toInt()
+            ?: error("could not read @Database(version = ...) - this test must not pass by default")
+        assertEquals(
+            "@Database(version = $declared) but SCHEMA_VERSION is ${WhoopDatabase.SCHEMA_VERSION}. " +
+                "Room opens with the annotation; a mismatch crashes every existing install on launch.",
+            WhoopDatabase.SCHEMA_VERSION, declared,
+        )
+    }
 }
diff --git a/android/app/src/test/resources/schema_oracle.json b/android/app/src/test/resources/schema_oracle.json
index 64fd84960b..b28e537ed7 100644
--- a/android/app/src/test/resources/schema_oracle.json
+++ b/android/app/src/test/resources/schema_oracle.json
@@ -1,6 +1,6 @@
 {
   "_readme": "SHARED Room<->GRDB SCHEMA ORACLE (#775). Two byte-identical copies: Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json and android/app/src/test/resources/schema_oracle.json. SchemaOracleTests.swift compares GRDB's PRAGMA table_info/index_list against it; SchemaOracleTest.kt compares Room's exported schema JSON against it. `columns` is the iOS/GRDB shape in GRDB column order (macOS is the reference implementation); every way Android differs is spelled out in an `android` / `iosAbsent` / `androidColumnOrder` override naming a key in `divergenceReasons`. Adding a column, reordering one, or changing a type/nullability on one platform only fails both suites until it is either fixed or written down here.",
-  "roomVersion": 34,
+  "roomVersion": 35,
   "grdbMigrations": [
     "v1",
     "v2",

From c3031aeaba0f3e718d72c93e947eabe390b3ded8 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 02:50:52 +1200
Subject: [PATCH 073/333] staging: build 383/264 with the Room version fix

versionCode 382 -> 383, CURRENT_PROJECT_VERSION 263 -> 264. Display version holds
at 10.6.1. 383 supersedes the crashing 382 in place.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index fb95b551ab..5cfca67731 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 382
+        versionCode = 383
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index eca3f30433..294a67cb26 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "263"
+    CURRENT_PROJECT_VERSION: "264"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 9e233c9c549247ed6746216212548e5b4f99cc7e Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 14:33:55 +1200
Subject: [PATCH 074/333] ble: say why a 5/MG link streams live HR and banks
 nothing (#1738)

A field log from a 5/MG that had not banked a row in three days carried every fact needed to explain it, and none of them said so. Reading it required knowing that connectHandshakeDone is gated on didBond for WHOOP5 but not WHOOP4, that the handshake tail is what sends SET_CLOCK, and that an un-clocked 5/MG discards its own sensor data.

The hello deferral returned SILENTLY. ExplicitBond documents that the deferral never resolves against a strap answering SMP 0x05 - the next connect requests a bond too and defers again - but nothing said so at runtime, so the hello's absence showed only as a line that never appeared and the promise of a "next connect" read identically on the first deferral and the fiftieth. The count across connections is the distinction, and it is printed now with the override's state beside it, since that is the only thing that breaks the cycle.

The backfill deferral repeated with no state; it now carries family, didBond, whether a hello was ever written on this link, deferrals and time since connect. The live-persist catch swallowed its throwable while re-buffering, so a store failing every insert produced a log full of "rr emit ... offered=N" and no sign that none of it landed - instrumentation that reads like success. Both live transports report now, each naming its own.

Attribution kept honest per CLAUDE.md: SMP 0x05 is not observable from this process, so the line labels what was measured on this link and marks the cited cause as needing an HCI capture to confirm here. A test pins that split.

Two review passes are folded in and both found real defects. The first found five, three of which would have made the lines report the OPPOSITE of the truth on the strap they were written for: the family was read from connectedFamily alone, which is non-null and defaults to WHOOP4, so a guessed WHOOP4 suppressed the explanation on exactly the 5/MG case it exists for; a stack-rejected hello still counted as written; and only one of two live transports was instrumented. The second found the guidance paragraph printing on every deferring connect, on a path documented as looping 57 times in an hour - burying the log the change exists to make readable.

Pure builders, 20 tests, two caller-side invariants pinned against source because WhoopBleClient cannot be constructed in a JVM test, all mutation-verified. No behaviour change: the BLE path is untouched beyond what it now reports.

The same silent catch exists in Swift at Collector.swift:218 and :274 and is NOT fixed here.
---
 .../com/noop/ble/StalledLinkDiagnostics.kt    | 170 +++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 112 ++++++-
 .../noop/ble/StalledLinkDiagnosticsTest.kt    | 284 ++++++++++++++++++
 3 files changed, 564 insertions(+), 2 deletions(-)
 create mode 100644 android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
 create mode 100644 android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt

diff --git a/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt b/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
new file mode 100644
index 0000000000..400164fa16
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
@@ -0,0 +1,170 @@
+package com.noop.ble
+
+/**
+ * Why a 5/MG link reaches "live HR works, nothing ever syncs" — said once, in the log, instead of left
+ * to be reconstructed from four separate lines that each state only part of it.
+ *
+ * The field log that motivated this file contained every fact needed to explain a strap that had not
+ * banked a row in three days, and none of them said so. `Backfill: deferred — connect handshake not done
+ * yet` repeated with no state; the hello's absence was visible only as a line that never appeared; and
+ * the deferral that caused it returned silently. Reading it required knowing that `connectHandshakeDone`
+ * is gated on `didBond` for WHOOP5 and not for WHOOP4, that the handshake tail is what sends SET_CLOCK,
+ * and that an un-clocked 5/MG discards its own sensor data. That is too much reconstruction to ask of a
+ * capture, and it is the reconstruction that has to happen fastest when someone reports lost data.
+ *
+ * These builders are pure so the wording is testable and cannot drift from what the counters mean. The
+ * counters they render live in `WhoopBleClient` and are per app process — the honest limit of an
+ * in-memory bound, and the same one [overrideHelloStillAllowed] documents. The loops these describe run
+ * within one process; a restart is not the failure mode.
+ */
+
+/**
+ * The hello was not written on this link because a `createBond()` was asked for first.
+ *
+ * [ExplicitBond] already explains why that deferral never resolves on a strap answering SMP 0x05: the
+ * next connect requests a bond too, and defers again. What it could not do is say so at runtime — the
+ * deferral branch returns without a word, so a capture shows a hello that simply never happens, with the
+ * reason inferable only from an `explicitBondRequestLine` promising a "next connect" that reads
+ * identically on the first deferral and the fiftieth.
+ *
+ * [consecutive] is what makes it diagnosable. One deferral is the experiment working as designed; a
+ * number climbing across every connect is the permanent state, and the difference between those two is
+ * the entire question. Printing the count converts "why is there no hello" into one line.
+ *
+ * The override's state rides along because it is the only thing that breaks the cycle, and a reader who
+ * sees the deferral will immediately want to know whether the escape hatch is on and whether it has
+ * budget left. Naming a spent override explicitly stops it reading as an untried option.
+ */
+internal fun helloDeferredByExplicitBondLine(
+    consecutive: Int,
+    overrideOptedIn: Boolean,
+    overrideAttempts: Int,
+    full: Boolean = true,
+    cap: Int = HELLO_OVERRIDE_MAX_ATTEMPTS,
+): String {
+    val override = when {
+        !overrideOptedIn -> "override off"
+        overrideHelloStillAllowed(overrideAttempts, cap) -> "override on ($overrideAttempts/$cap used)"
+        else -> "override SPENT ($overrideAttempts/$cap)"
+    }
+    val tail = if (consecutive >= 2 && !full) {
+        // The guidance is a paragraph and this fires once per CONNECT, on a path documented to loop —
+        // HelloSuppression records 57 reconnect cycles in an hour. Printing the paragraph 57 times would
+        // bury the rest of the capture under advice already given, so the full text is one-shot (the
+        // same latch idiom as helloOverrideExhaustedLine) and later occurrences stay countable but terse.
+        " $consecutive consecutive connects deferred, still no bond and no hello written — see the first" +
+            " occurrence above for what to do."
+    } else if (consecutive >= 2) {
+        // Observed here vs cited from elsewhere, kept apart on purpose: the deferral count and the
+        // absent bond ARE measured on this link; SMP 0x05 is not, and cannot be without an HCI capture.
+        // Stating the cited cause as this strap's would be the #1635 mistake of a diagnostic claiming
+        // more than it observed.
+        " Observed on this link: $consecutive consecutive connects deferred, no bond completed, and no" +
+            " hello written on any of them — so the \"next connect\" this waits for is not arriving." +
+            " A 5/MG answering Pairing Request with SMP 0x05 produces exactly this and is the known" +
+            " cause (#1635), but only an HCI capture can confirm it HERE. Either way the consequence is" +
+            " local and certain: didBond stays false, so SET_CLOCK never runs, and an un-clocked 5/MG" +
+            " does not persist its own sensor data to flash. Turn the pairing experiment OFF, or the" +
+            " hello override ON."
+    } else {
+        " Deferred once so far — expected on the connect that asks."
+    }
+    return "WHOOP 5/MG: CLIENT_HELLO deferred by the pairing experiment ($override).$tail (#1635)"
+}
+
+/**
+ * `beginBackfill` declined, with the state that decided it.
+ *
+ * The bare line named the gate and nothing else, so every occurrence looked the same whether the
+ * handshake was seconds from completing or structurally unreachable. These five fields separate those:
+ * a WHOOP5 with `didBond=false` and no hello ever written is the unreachable case, and it reads that way
+ * at a glance rather than after a code trace.
+ *
+ * [helloEverWrittenThisLink] earns its place by distinguishing the two ways to arrive here that need
+ * opposite fixes — a hello that was written and went unanswered (a strap or timing problem) from one that
+ * was never written at all (a local decision, and the one this log's field capture actually hit).
+ */
+internal fun backfillDeferredLine(
+    family: String?,
+    didBond: Boolean,
+    helloEverWrittenThisLink: Boolean,
+    explicitBondRequestedThisLink: Boolean,
+    deferralsThisLink: Int,
+    msSinceConnect: Long,
+): String {
+    val since = if (msSinceConnect >= 0L) "${msSinceConnect / 1000}s" else "?"
+    // NULL means service discovery has not established the family yet. `connectedFamily` defaults to
+    // WHOOP4 and otherwise holds the PREVIOUS link's value, so printing it unconditionally would put a
+    // guess in the log — and a guess of WHOOP4 would suppress the explanation below on exactly the 5/MG
+    // this exists for. The caller reads `familyEstablished` FIRST for the happens-before it carries.
+    val fam = family ?: "unestablished"
+    val why = if (family == "WHOOP5" && !didBond && !helloEverWrittenThisLink) {
+        // A structural claim, not a guess about the strap: didBond is set only by the hello's own ack,
+        // so no hello written means this gate cannot open on this link no matter what the strap does.
+        " No hello was written on this link, so didBond cannot become true and this gate cannot open" +
+            " for the rest of it. SET_CLOCK rides the same handshake tail, and an un-clocked 5/MG is" +
+            " hardware-known not to persist sensor data to flash (#78 fork) — so there may also be" +
+            " nothing banked to offload."
+    } else {
+        ""
+    }
+    return "Backfill: deferred — connect handshake not done yet (family=$fam didBond=$didBond" +
+        " helloWrittenThisLink=$helloEverWrittenThisLink bondRequestedThisLink=" +
+        "$explicitBondRequestedThisLink deferrals=$deferralsThisLink sinceConnect=$since).$why"
+}
+
+/**
+ * A live HR/R-R batch failed to persist and was re-buffered.
+ *
+ * The catch that owns this re-queues the frames and swallows the throwable, so a store that is failing
+ * every insert produces a log full of `rr emit … offered=13` and no indication that none of it landed.
+ * That is the worst shape a diagnostic gap can take: the instrumentation that exists reads like success.
+ *
+ * [transport] is named because there are TWO live paths — the standard 0x2A37 reading and the puffin
+ * REALTIME_DATA batch (#1118) — and they fail independently. A line that did not say which would leave a
+ * reader unable to tell one dead transport from a dead store, which is the first fork in the diagnosis.
+ *
+ * [consecutiveFailures] matters more than any single throwable. One failure is a transient the re-buffer
+ * exists to absorb; a climbing count is a store that is never going to accept these rows, and only the
+ * count separates them. The message is included because the useful cases — a full disk, a corrupted
+ * database, a schema mismatch — are distinguished by it rather than by the class.
+ */
+internal fun liveInsertFailedLine(
+    transport: String,
+    throwableName: String,
+    message: String?,
+    hrFrames: Int,
+    rrFrames: Int,
+    consecutiveFailures: Int,
+): String {
+    val detail = message?.takeIf { it.isNotBlank() }?.let { ": ${it.take(200)}" } ?: ""
+    val run = if (consecutiveFailures >= 2) {
+        " $consecutiveFailures consecutive failures — these rows are not landing and the re-buffer is" +
+            " not recovering them."
+    } else {
+        " Re-buffered for the next cadence."
+    }
+    return "Live persist FAILED on $transport — $throwableName$detail (hr=$hrFrames rr=$rrFrames).$run"
+}
+
+/**
+ * Rate-limit for [liveInsertFailedLine].
+ *
+ * The live cadence is seconds, so an unconditional log would bury the rest of the capture under a
+ * failure it has already reported. The gap is deliberately long: this line exists to establish THAT
+ * inserts are failing and roughly for how long, which one line a minute answers as well as sixty.
+ *
+ * A zero [lastEmitMs] must emit — the first failure is the one most worth having, and treating "never
+ * emitted" as "just emitted" would silence exactly the case this was built for.
+ *
+ * A BACKWARDS clock emits too. `System.currentTimeMillis()` is wall time and can step back — an NTP
+ * correction, a timezone-adjacent settings change, or the strap-clock skew this log family already
+ * tracks. Comparing only forwards would leave `lastEmitMs` stranded in the future and silence the line
+ * until real time caught up, which for a large step is indefinitely. Emitting on the step costs one
+ * extra line and cannot latch.
+ */
+internal fun shouldEmitLiveInsertFailure(
+    lastEmitMs: Long,
+    nowMs: Long,
+    minGapMs: Long = 60_000L,
+): Boolean = lastEmitMs <= 0L || nowMs < lastEmitMs || nowMs - lastEmitMs >= minGapMs
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index bbb952e9a8..6b047656cd 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -2375,6 +2375,44 @@ class WhoopBleClient(
      *  can be reported with an elapsed time. 0 means none is outstanding. Cleared in [reset]. */
     @Volatile private var clientHelloWriteAtMs: Long = 0L
 
+    /** Was a CLIENT_HELLO actually WRITTEN on this link? Distinct from [clientHelloWriteAtMs], which is
+     *  cleared the moment the write completes: this stays true for the rest of the connection so a later
+     *  backfill deferral can say whether the handshake was ever reachable. Cleared in [reset]. */
+    @Volatile private var helloWrittenThisLink = false
+
+    /** Consecutive connects that deferred the hello to the pairing experiment without writing one.
+     *  Deliberately NOT cleared in [reset] — the whole point is that it survives the connection, since
+     *  one deferral is the experiment working and a run of them is the permanent SMP-0x05 state. Reset
+     *  when a hello is written or a genuine bond is reached. Per app process, like the override budget. */
+    @Volatile private var helloDeferredConsecutive = 0
+
+    /** Whether the deferral's full guidance paragraph has been printed for the CURRENT run. The deferral
+     *  fires once per connect on a path documented to loop (57 cycles in an hour, see [HelloSuppression]),
+     *  so the paragraph is one-shot per run and later connects log a terse countable line instead. Same
+     *  latch idiom as [helloOverrideExhaustedLogged]. Cleared wherever [helloDeferredConsecutive] is. */
+    @Volatile private var helloDeferredGuidanceLogged = false
+
+    /** How many times [beginBackfill] has declined on this link, so repeats carry a count instead of
+     *  reading as new information each time. Cleared in [reset]. */
+    @Volatile private var backfillDeferralsThisLink = 0
+
+    /** Consecutive live-persist failures per transport, and when each last reported. The live cadence is
+     *  seconds, so the lines are rate-limited; the COUNT is what separates a transient the re-buffer
+     *  absorbs from a store that is never going to accept these rows.
+     *
+     *  Kept PER TRANSPORT because the standard 0x2A37 path and the puffin REALTIME_DATA path (#1118)
+     *  fail independently — a shared counter would let one path's success reset the other's run and
+     *  report a persistent failure as a string of first-failures.
+     *
+     *  AtomicInteger, unlike the census fields above which are deliberately unsynchronized: those
+     *  tolerate a stale read (one duplicate line), but `+=` on a plain Int can LOSE an increment, and
+     *  the count here is the entire load-bearing distinction between a transient and a run. The two
+     *  flushes can run concurrently on the io scope, so that race is reachable. */
+    private val liveInsertFailuresStd = java.util.concurrent.atomic.AtomicInteger(0)
+    private val liveInsertFailuresRealtime = java.util.concurrent.atomic.AtomicInteger(0)
+    @Volatile private var lastStdInsertFailureLogMs = 0L
+    @Volatile private var lastRealtimeInsertFailureLogMs = 0L
+
     /** #1635: ms since the CLIENT_HELLO write, or null when none is outstanding. Lets the bond-state
      *  observer time a pairing transition against the write that may have triggered it, and report no
      *  elapsed time at all for a transition belonging to some other pairing. */
@@ -5914,6 +5952,8 @@ class WhoopBleClient(
                     // these as REALTIME_DATA — the strap rejected them on the unauthenticated link), then arm
                     // realtime HR with puffin framing. Mirrors the macOS post-bond flow.
                     didBond = true
+                    helloDeferredConsecutive = 0  // the handshake works on this strap; the run is over
+                    helloDeferredGuidanceLogged = false
                     helloOverrideAttempts = 0     // #1635: the strap answered — the override's budget resets
                     helloOverrideExhaustedLogged = false
                     cancelBondWatchdog()          // genuine bond reached — the handshake watchdog stands down (#50)
@@ -7748,7 +7788,14 @@ class WhoopBleClient(
         val ok = safeGatt("writeClientHello") {
             ops.writeCharacteristicCompat(ch, hello, BluetoothGattCharacteristic.WRITE_TYPE_DEFAULT)
         }
-        if (!ok) {
+        if (ok) {
+            // Claimed only once the stack ACCEPTED the write. Setting these before the call left a window
+            // where a concurrent reader saw a hello that had not gone out, and cleared the deferral run
+            // on an attempt that failed — under-reporting the very run the count exists to measure.
+            helloWrittenThisLink = true
+            helloDeferredConsecutive = 0
+            helloDeferredGuidanceLogged = false
+        } else {
             writeInFlight = false
             log("CLIENT_HELLO write rejected by stack")
             clientHelloWriteAtMs = 0L   // never went out; no callback is owed
@@ -7858,6 +7905,18 @@ class WhoopBleClient(
                     log(helloOverrideExhaustedLine(helloOverrideAttempts))
                 }
                 if (explicitBondDefersHello(explicitBondRequestedThisLink, helloOverride = helloOverride)) {
+                    // This branch used to return without a word, so the hello's absence was visible only
+                    // as a line that never appeared — and the deferral reads identically on the first
+                    // connect and the fiftieth. The count is what separates them.
+                    helloDeferredConsecutive += 1
+                    val fullGuidance = !helloDeferredGuidanceLogged
+                    if (helloDeferredConsecutive >= 2) helloDeferredGuidanceLogged = true
+                    log(helloDeferredByExplicitBondLine(
+                        consecutive = helloDeferredConsecutive,
+                        overrideOptedIn = overrideOptedIn,
+                        overrideAttempts = helloOverrideAttempts,
+                        full = fullGuidance,
+                    ))
                     // Same trap as the suppression path below, and worse here. The watchdog was armed at
                     // discovery and bounces the link whenever didBond is false — which deferring the hello
                     // guarantees. Tearing the link down while an OS pairing is in flight is the single
@@ -8068,9 +8127,26 @@ class WhoopBleClient(
         if (!batch.isEmpty) {
             try {
                 repository.insert(batch, deviceId)
+                liveInsertFailuresRealtime.set(0)
             } catch (t: Throwable) {
                 // Re-buffer at the front so these frames retry on the next cadence (port of Collector).
                 synchronized(collectorLock) { liveBuffer.addAll(0, frames) }
+                // The #1118 SECOND transport, silent for the same reason the standard path was: the
+                // census above reports what was OFFERED, so a store rejecting everything still reads
+                // like a healthy stream.
+                val runLength = liveInsertFailuresRealtime.incrementAndGet()
+                val nowMs = System.currentTimeMillis()
+                if (shouldEmitLiveInsertFailure(lastRealtimeInsertFailureLogMs, nowMs)) {
+                    lastRealtimeInsertFailureLogMs = nowMs
+                    log(liveInsertFailedLine(
+                        transport = "live-realtime",
+                        throwableName = t.javaClass.simpleName,
+                        message = t.message,
+                        hrFrames = batch.hr.size,
+                        rrFrames = batch.rr.size,
+                        consecutiveFailures = runLength,
+                    ))
+                }
             }
         }
     }
@@ -8132,8 +8208,24 @@ class WhoopBleClient(
         }
         try {
             repository.insert(StreamBatch(hr = hr, rr = rr), deviceId)
+            liveInsertFailuresStd.set(0)
         } catch (t: Throwable) {
             synchronized(collectorLock) { stdHr.addAll(0, hr); stdRr.addAll(0, rr) }
+            // Swallowing this made the instrumentation above read like success: a store failing every
+            // insert produced a log full of `rr emit ... offered=N` and no sign that none of it landed.
+            val runLength = liveInsertFailuresStd.incrementAndGet()
+            val nowMs = System.currentTimeMillis()
+            if (shouldEmitLiveInsertFailure(lastStdInsertFailureLogMs, nowMs)) {
+                lastStdInsertFailureLogMs = nowMs
+                log(liveInsertFailedLine(
+                    transport = "live-standard",
+                    throwableName = t.javaClass.simpleName,
+                    message = t.message,
+                    hrFrames = hr.size,
+                    rrFrames = rr.size,
+                    consecutiveFailures = runLength,
+                ))
+            }
         }
     }
 
@@ -8151,7 +8243,19 @@ class WhoopBleClient(
      */
     private fun beginBackfill() {
         if (!connectHandshakeDone) {
-            log("Backfill: deferred — connect handshake not done yet")
+            backfillDeferralsThisLink += 1
+            // familyEstablished is read BEFORE connectedFamily on purpose: the happens-before it carries
+            // is what makes the family read safe, and connectedFamily otherwise holds a default or the
+            // previous link's value. Same ordering rule as batterySource(familyEstablished, family).
+            val established = familyEstablished
+            log(backfillDeferredLine(
+                family = if (established) connectedFamily.name else null,
+                didBond = didBond,
+                helloEverWrittenThisLink = helloWrittenThisLink,
+                explicitBondRequestedThisLink = explicitBondRequestedThisLink,
+                deferralsThisLink = backfillDeferralsThisLink,
+                msSinceConnect = if (connectedAtMs > 0L) System.currentTimeMillis() - connectedAtMs else -1L,
+            ))
             return
         }
         if (backfilling) return
@@ -9219,6 +9323,10 @@ class WhoopBleClient(
         // exactly the gap this stopwatch was added to close. It is overwritten by the next request, and a
         // stale value can only ever produce a large elapsed against a label that names what it measures.
         connectHandshakeDone = false
+        helloWrittenThisLink = false
+        backfillDeferralsThisLink = 0
+        // helloDeferredConsecutive is deliberately NOT cleared: it counts ACROSS connections, which is
+        // the only way a permanent deferral is distinguishable from a pending one.
         familyEstablished = false   // the next link re-establishes it at service discovery
         loggedFirmwareGate = null
         clientHelloWriteAtMs = 0L
diff --git a/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt b/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
new file mode 100644
index 0000000000..d611c80d6b
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
@@ -0,0 +1,284 @@
+package com.noop.ble
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * These lines exist to make one specific field state readable — a 5/MG streaming live HR while banking
+ * nothing — so the tests assert the DISTINCTIONS a reader depends on, not the prose around them.
+ *
+ * Android-only, like [ExplicitBond] itself: CoreBluetooth has no explicit pairing API, so there is no
+ * Swift twin to hold a byte-identical oracle against and an audit finding this one-sided should leave it.
+ */
+class StalledLinkDiagnosticsTest {
+
+    // ---- helloDeferredByExplicitBondLine ------------------------------------------------------
+
+    /**
+     * One deferral is the experiment behaving as designed; a run of them is the permanent state. If both
+     * rendered the same, the line would be decoration — this is the distinction it exists to draw.
+     */
+    @Test
+    fun `a single deferral does not claim the permanent state`() {
+        val once = helloDeferredByExplicitBondLine(1, overrideOptedIn = false, overrideAttempts = 0)
+        assertTrue(once.contains("Deferred once so far"))
+        assertFalse("a single deferral must not assert permanence", once.contains("consecutive connects"))
+        assertFalse(once.contains("SMP 0x05"))
+    }
+
+    @Test
+    fun `a run of deferrals names the permanent state and both escapes`() {
+        val many = helloDeferredByExplicitBondLine(47, overrideOptedIn = false, overrideAttempts = 0)
+        assertTrue(many.contains("47 consecutive connects"))
+        assertTrue("the cause must be named, not implied", many.contains("SMP 0x05"))
+        // Both remedies, because either one alone leaves a reader stuck.
+        assertTrue(many.contains("pairing experiment OFF"))
+        assertTrue(many.contains("hello override ON"))
+        // The consequence that actually costs data is the un-clocked strap, not the missing sync.
+        assertTrue(many.contains("does not persist its own sensor data to flash"))
+    }
+
+    /**
+     * The #1635 rule in CLAUDE.md: a diagnostic may only assert what it can attribute. SMP 0x05 is not
+     * observable from this process — it needs an HCI capture — so the line must mark it as the cited
+     * cause and keep the locally measured facts separate. A future edit that collapses the two into a
+     * flat "the strap refuses pairing" fails here, which is the point.
+     */
+    @Test
+    fun `the cited cause is not asserted as observed on this link`() {
+        val many = helloDeferredByExplicitBondLine(47, overrideOptedIn = false, overrideAttempts = 0)
+        assertTrue("what was measured must be labelled as such", many.contains("Observed on this link:"))
+        assertTrue("the cited cause must be hedged", many.contains("only an HCI capture can confirm it HERE"))
+        // The consequence, unlike the cause, IS local and may be stated flatly.
+        assertTrue(many.contains("local and certain"))
+    }
+
+    /**
+     * The paragraph fires once per CONNECT on a path documented to loop (57 cycles in an hour), so the
+     * full text is one-shot and later occurrences must stay countable but terse. If the short form
+     * dropped the count it would be unreadable; if it kept the paragraph it would bury the capture.
+     */
+    @Test
+    fun `the repeat form keeps the count but drops the guidance`() {
+        val terse = helloDeferredByExplicitBondLine(9, overrideOptedIn = false, overrideAttempts = 0,
+                                                    full = false)
+        assertTrue("the count is the point of the repeat", terse.contains("9 consecutive connects"))
+        assertTrue(terse.contains("see the first occurrence above"))
+        assertFalse("advice already given must not repeat", terse.contains("pairing experiment OFF"))
+        assertFalse(terse.contains("SMP 0x05"))
+        // A FIRST occurrence is unaffected by the flag: there is no guidance to suppress yet.
+        val firstShort = helloDeferredByExplicitBondLine(1, false, 0, full = false)
+        assertTrue(firstShort.contains("Deferred once so far"))
+    }
+
+    /**
+     * A spent override must not read as an untried option — that is the `didBond`-reader trap pointed at
+     * the log: a reader who sees "override on" stops looking for why no hello went out.
+     */
+    @Test
+    fun `override state distinguishes off from on from spent`() {
+        val off = helloDeferredByExplicitBondLine(3, overrideOptedIn = false, overrideAttempts = 0)
+        val on = helloDeferredByExplicitBondLine(3, overrideOptedIn = true, overrideAttempts = 2)
+        val spent = helloDeferredByExplicitBondLine(3, overrideOptedIn = true, overrideAttempts = 6)
+        assertTrue(off.contains("override off"))
+        assertTrue(on.contains("override on (2/6 used)"))
+        assertTrue(spent.contains("override SPENT (6/6)"))
+        assertFalse("a spent override must not read as active", spent.contains("override on ("))
+    }
+
+    /** The boundary is the cap itself: the attempt that spends the budget is the last permitted one. */
+    @Test
+    fun `the override reads spent exactly at the cap`() {
+        assertTrue(helloDeferredByExplicitBondLine(3, true, HELLO_OVERRIDE_MAX_ATTEMPTS - 1).contains("override on"))
+        assertTrue(helloDeferredByExplicitBondLine(3, true, HELLO_OVERRIDE_MAX_ATTEMPTS).contains("override SPENT"))
+    }
+
+    // ---- backfillDeferredLine -----------------------------------------------------------------
+
+    /**
+     * The unreachable case — WHOOP5, unbonded, no hello ever written — is the one that needs explaining,
+     * and it must not be claimed for any other combination or the sentence stops meaning anything.
+     */
+    @Test
+    fun `only the structurally unreachable case gets the explanation`() {
+        val unreachable = backfillDeferredLine("WHOOP5", false, false, true, 3, 42_000L)
+        assertTrue(unreachable.contains("No hello was written on this link"))
+        assertTrue(unreachable.contains("didBond cannot become true"))
+        assertTrue(unreachable.contains("SET_CLOCK rides the same handshake tail"))
+
+        // A hello WAS written and went unanswered: a different problem with a different fix.
+        assertFalse(backfillDeferredLine("WHOOP5", false, true, true, 3, 42_000L)
+            .contains("No hello was written"))
+        // WHOOP4 does not gate the handshake on didBond at all.
+        assertFalse(backfillDeferredLine("WHOOP4", false, false, false, 1, 5_000L)
+            .contains("No hello was written"))
+        // Already bonded: the gate is about to open.
+        assertFalse(backfillDeferredLine("WHOOP5", true, true, false, 1, 5_000L)
+            .contains("No hello was written"))
+    }
+
+    @Test
+    fun `the state that decided it is all present`() {
+        val line = backfillDeferredLine("WHOOP5", false, false, true, 3, 42_000L)
+        assertTrue(line.contains("family=WHOOP5"))
+        assertTrue(line.contains("didBond=false"))
+        assertTrue(line.contains("helloWrittenThisLink=false"))
+        assertTrue(line.contains("bondRequestedThisLink=true"))
+        assertTrue(line.contains("deferrals=3"))
+        assertTrue(line.contains("sinceConnect=42s"))
+    }
+
+    /**
+     * `connectedFamily` defaults to WHOOP4 and otherwise holds the PREVIOUS link's value, so before
+     * service discovery it is a guess. Printing a guess would break the same rule the hello line follows
+     * — and a guess of WHOOP4 would suppress the explanation on exactly the 5/MG this was built for.
+     */
+    @Test
+    fun `an unestablished family is not guessed and gets no explanation`() {
+        val line = backfillDeferredLine(null, false, false, true, 1, 5_000L)
+        assertTrue(line.contains("family=unestablished"))
+        assertFalse("a guessed family must not appear", line.contains("family=WHOOP4"))
+        assertFalse("the explanation must not ride on an unknown family",
+                    line.contains("No hello was written"))
+    }
+
+    /** An unknown connect time must render as unknown, never as 0s — which would read as "just now". */
+    @Test
+    fun `an unknown connect time is not reported as zero seconds`() {
+        assertTrue(backfillDeferredLine("WHOOP5", false, false, true, 1, -1L).contains("sinceConnect=?"))
+        assertTrue(backfillDeferredLine("WHOOP5", false, false, true, 1, 0L).contains("sinceConnect=0s"))
+    }
+
+    // ---- liveInsertFailedLine -----------------------------------------------------------------
+
+    /**
+     * Two live transports fail independently (#1118). A line that did not say which would leave a reader
+     * unable to separate one dead transport from a dead store — the first fork in the diagnosis.
+     */
+    @Test
+    fun `the failing transport is named`() {
+        assertTrue(liveInsertFailedLine("live-standard", "E", null, 1, 1, 1).contains("on live-standard"))
+        assertTrue(liveInsertFailedLine("live-realtime", "E", null, 1, 1, 1).contains("on live-realtime"))
+    }
+
+    @Test
+    fun `one failure reads as transient and a run reads as not recovering`() {
+        val once = liveInsertFailedLine("live-standard", "SQLiteFullException", "database or disk is full", 12, 13, 1)
+        assertTrue(once.contains("Re-buffered for the next cadence"))
+        assertFalse(once.contains("consecutive failures"))
+
+        val many = liveInsertFailedLine("live-standard", "SQLiteFullException", "database or disk is full", 12, 13, 9)
+        assertTrue(many.contains("9 consecutive failures"))
+        assertTrue(many.contains("not recovering them"))
+    }
+
+    /** The message distinguishes the useful cases; the class alone rarely does. */
+    @Test
+    fun `the throwable message survives and is bounded`() {
+        val line = liveInsertFailedLine("live-realtime", "IllegalStateException", "x".repeat(500), 1, 2, 1)
+        assertTrue(line.contains("IllegalStateException"))
+        assertTrue(line.contains("x".repeat(200)))
+        assertFalse("an unbounded message would swamp the capture", line.contains("x".repeat(201)))
+    }
+
+    @Test
+    fun `a blank or absent message does not leave a dangling separator`() {
+        assertFalse(liveInsertFailedLine("live-realtime", "IllegalStateException", null, 1, 2, 1).contains(": ("))
+        assertFalse(liveInsertFailedLine("live-realtime", "IllegalStateException", "   ", 1, 2, 1).contains(": ("))
+    }
+
+    // ---- shouldEmitLiveInsertFailure ----------------------------------------------------------
+
+    /**
+     * The first failure is the one most worth having. Treating "never emitted" as "just emitted" would
+     * silence exactly the case this was built for, so the zero case is asserted rather than assumed.
+     */
+    @Test
+    fun `the first failure always emits`() {
+        assertTrue(shouldEmitLiveInsertFailure(lastEmitMs = 0L, nowMs = 1_000L))
+        assertTrue(shouldEmitLiveInsertFailure(lastEmitMs = -5L, nowMs = 1_000L))
+    }
+
+    @Test
+    fun `the gap is honoured at its boundary`() {
+        assertFalse(shouldEmitLiveInsertFailure(lastEmitMs = 1_000L, nowMs = 60_999L))
+        assertTrue(shouldEmitLiveInsertFailure(lastEmitMs = 1_000L, nowMs = 61_000L))
+    }
+
+    /**
+     * A clock that steps backwards must not latch the line off. Comparing only forwards would strand
+     * `lastEmitMs` in the future and silence the line until real time caught up — for a large step,
+     * indefinitely. This is the assertion that forced the guard: the naive version fails it.
+     */
+    @Test
+    fun `a backwards clock emits rather than latching off`() {
+        assertTrue(shouldEmitLiveInsertFailure(lastEmitMs = 10_000L, nowMs = 5_000L))
+        assertTrue(shouldEmitLiveInsertFailure(lastEmitMs = Long.MAX_VALUE / 2, nowMs = 1_000L))
+    }
+
+    // ---- caller-side contract -----------------------------------------------------------------
+
+    /**
+     * The builders above are pure and testable; the two invariants that actually decide whether they
+     * print the truth live in `WhoopBleClient`, which no JVM test can construct. Both were WRONG in the
+     * first version of this change and neither failure would have been caught by anything above, so they
+     * are pinned against the source the way `RawCaptureExportContractTest` pins the collector's.
+     */
+    private fun clientSource(): String {
+        var root = java.io.File(System.getProperty("user.dir") ?: ".").canonicalFile
+        repeat(4) {
+            val f = java.io.File(root, "android/app/src/main/java/com/noop/ble/WhoopBleClient.kt")
+            if (f.isFile) return f.readText()
+            root = root.parentFile ?: root
+        }
+        error("WhoopBleClient.kt not found — this test must not pass by default")
+    }
+
+    /**
+     * `familyEstablished` must be read BEFORE `connectedFamily`, and the family passed as null when it is
+     * false. `connectedFamily` is non-null and defaults to WHOOP4, so the naive read puts a guess in the
+     * log — and a guessed WHOOP4 suppresses the explanation on precisely the 5/MG case this exists for.
+     * The ordering additionally carries the happens-before that makes the family read safe at all, which
+     * is the same rule `batterySource(familyEstablished, connectedFamily)` is documented to follow.
+     */
+    @Test
+    fun `the backfill line never reports a guessed family`() {
+        val src = clientSource()
+        assertTrue("familyEstablished must be latched before the family is read",
+                   src.contains("val established = familyEstablished"))
+        assertTrue("an unestablished family must be passed as null, not guessed",
+                   src.contains("family = if (established) connectedFamily.name else null"))
+    }
+
+    /**
+     * A CLIENT_HELLO the stack REJECTED never went out, so nothing may claim one was written: that would
+     * suppress the "no hello was written" explanation on a link where it is exactly right, since a
+     * rejected write can never be acked and didBond can never become true.
+     *
+     * Asserted as an ORDERING rather than a presence, because the first version of this passed a
+     * presence check while still being wrong — it set the flag before the stack call and cleared it
+     * afterwards, which both opened a window for a concurrent reader and cleared the deferral run on an
+     * attempt that had failed.
+     */
+    @Test
+    fun `a hello is only counted as written after the stack accepts it`() {
+        val fn = clientSource()
+            .substringAfter("private fun writeClientHello(")
+            .substringBefore("\n    }")
+        val call = fn.indexOf("val ok = safeGatt(\"writeClientHello\")")
+        val claim = fn.indexOf("helloWrittenThisLink = true")
+        val run = fn.indexOf("helloDeferredConsecutive = 0")
+        assertTrue("writeClientHello must call safeGatt", call >= 0)
+        assertTrue("the write must be claimed, somewhere", claim >= 0)
+        assertTrue("helloWrittenThisLink must be set AFTER the stack accepts", claim > call)
+        assertTrue("the deferral run must only be cleared AFTER the stack accepts", run > call)
+    }
+
+    @Test
+    fun `the default gap is one minute`() {
+        assertEquals(true, shouldEmitLiveInsertFailure(1L, 60_001L))
+        assertEquals(false, shouldEmitLiveInsertFailure(1L, 30_000L))
+    }
+}

From 4aac31baa8b61b5948780a2f567795b568852107 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 14:34:43 +1200
Subject: [PATCH 075/333] diag: say which workout detector made the rows, and
 when the pipelines last ran (#1739)

Diagnostics for the report in #1735, which is not answerable from the log it arrived with.

WHICH DETECTOR MADE THE ROWS. NOOP has two, deliberately separate per AutoWorkoutDetector's own header. The Settings toggle governs the opt-in SUGGESTION card, which saves nothing until the user taps Save. The IntelligenceEngine separately derives durable sport="detected" rows from the 1 Hz store on every scoring pass and never consulted that toggle. Both are called "detect" in the UI, so rows from the second read as the first ignoring its own switch - the reading #1735 made, and a reasonable one.

Every per-bout line that shows the difference sits behind the Test Centre WORKOUTS domain. That report was filed as "not a test-mode bug" with the domain off, so its log said nothing about workout detection at all. The line added here is always-on and sits in the section a reporter already attaches. It states what is on disk rather than what the code intends, and its reassurance clause is emitted ONLY for the combination that actually misleads - card off with rows present - so it never explains a state it is not looking at.

WHEN THE PIPELINES LAST RAN. The other half of that report, "hours after the ride finished it still does not appear", needed two timestamps nobody recorded. The strap-WRITE path has had this for a while (sync.lastWriteOkAt renders as "Data write: rows last landed 3d ago", which is what makes a stalled offload decidable). The two paths #1735 turns on had no equivalent: the Health Connect importer persisted only a permission signature, and the engine's completion is announced by "re-score: done", which goes to the LIVE log only, so an export written hours later has already rolled it away. The analyze watermark records WHAT was scored and never when. So a report could show per-source row counts and still not separate "Health Connect never brought the ride in" from "it did, and nothing has re-scored since" - which need opposite next steps.

Three details decide whether these lines are worth anything. The importer stamps its EMPTY path too, because "ran and found nothing" and "never ran" are different diagnoses a row count of zero cannot tell apart. Scoring is stamped at BOTH completion sites, because the post-sync pass is the one a "synced but nothing appeared" report is really asking about. The dismissal count is summed over the SAME strap ids whose rows were counted, since a two-strap install banks detected rows under two computed ids and reading one could print "detected=52 dismissed=0" while the dismissals sat under the other; a FAILED read renders n/a, never 0.

NOT included, deliberately: a gate making the toggle suppress the engine's rows. The two detectors are separate by design, the toggle defaults OFF, and the delete at the persistence site is unconditional and precedes the insert - so gating the insert would wipe the Activity history of every user who never opted in, on the first pass after upgrade. That is a data wipe shipped as a bug fix. The confirmed defects in #1735 are the false code doc at MainActivity.kt:1060 ("when off no detection runs") and the toggle's name; neither is touched here.

No behaviour change beyond four SharedPreferences writes. 12 tests; the column alignment is mutation-verified. Apple twin NOT added - iOS has the same two detectors and the same live-log-only scoring announcement.
---
 .../main/java/com/noop/ble/WhoopBleClient.kt  |   7 ++
 .../com/noop/ingest/HealthConnectImporter.kt  |  27 +++++
 .../com/noop/testcentre/AndroidDiagnostics.kt | 105 ++++++++++++++++++
 .../src/main/java/com/noop/ui/AppViewModel.kt |  12 +-
 .../testcentre/AutoDetectStateLineTest.kt     |  69 ++++++++++++
 .../testcentre/PipelineFreshnessLinesTest.kt  |  97 ++++++++++++++++
 6 files changed, 316 insertions(+), 1 deletion(-)
 create mode 100644 android/app/src/test/java/com/noop/testcentre/AutoDetectStateLineTest.kt
 create mode 100644 android/app/src/test/java/com/noop/testcentre/PipelineFreshnessLinesTest.kt

diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 6b047656cd..2133f191e6 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -2809,6 +2809,13 @@ class WhoopBleClient(
                 }.onSuccess {
                     // Advance the shared watermark so the next 15-min tick sees no change and skips (#836).
                     NoopPrefs.setAnalyzeWatermark(context, analyzeFp)
+                    // #1735: stamp the post-sync pass too, not just the idle one in AppViewModel. This is
+                    // the pass that runs right after an offload, so it is the one a "synced but nothing
+                    // appeared" report is actually asking about.
+                    runCatching {
+                        NoopPrefs.of(context).edit()
+                            .putLong("score.lastPassAt", System.currentTimeMillis() / 1000).apply()
+                    }
                     log("Backfill: post-sync scoring pass done")
                     // #277 diagnostic: surface the day-key the dashboard treats as "today" against the
                     // newest banked row, so a UTC-bucket vs local-day split (rows persist but Today
diff --git a/android/app/src/main/java/com/noop/ingest/HealthConnectImporter.kt b/android/app/src/main/java/com/noop/ingest/HealthConnectImporter.kt
index 8d176708ea..1066533fa3 100644
--- a/android/app/src/main/java/com/noop/ingest/HealthConnectImporter.kt
+++ b/android/app/src/main/java/com/noop/ingest/HealthConnectImporter.kt
@@ -158,6 +158,21 @@ object HealthConnectImporter {
     private fun prefs(context: Context) =
         context.getSharedPreferences(NoopPrefs.NAME, Context.MODE_PRIVATE)
 
+    /** #1735: stamp a COMPLETED import run so the diagnostics header can say when data last moved, not
+     *  merely how many rows exist. Raw keys written inline, read back by AndroidDiagnostics - the same
+     *  shape `sync.lastWriteOkAt` uses. Guarded: a stamp is never worth failing an import over. */
+    private fun recordImportRun(context: Context, rows: Int, throughDay: String?) {
+        runCatching {
+            prefs(context).edit()
+                .putLong("hc.lastImportOkAt", System.currentTimeMillis() / 1000)
+                .putInt("hc.lastImportRows", rows)
+                .apply {
+                    if (throughDay != null) putString("hc.lastImportThroughDay", throughDay)
+                }
+                .apply()
+        }
+    }
+
     /**
      * Whether Health Connect is installed/available on this device.
      * One of [HealthConnectClient.SDK_AVAILABLE],
@@ -559,6 +574,13 @@ object HealthConnectImporter {
         }
 
         if (acc.isEmpty() && workouts.isEmpty()) {
+        // #1735: record that an import RAN and what it brought. "Hours after a ride it still is not
+        // there" cannot be told from "Health Connect never imported it" without this: the log had per-source
+        // row counts but nothing about WHEN they last moved. Mirrors the sync.lastWriteOkAt pattern the
+        // strap-write path already uses. Best-effort - a stamp failure must not sink a good import.
+            // Stamped on the EMPTY path too, deliberately: "ran and found nothing" and "never ran" are
+            // different diagnoses and this is the only line that separates them.
+            recordImportRun(context, rows = 0, throughDay = null)
             return ImportSummary(
                 source = SOURCE,
                 counts = emptyMap(),
@@ -704,6 +726,11 @@ object HealthConnectImporter {
         val lastDay = touchedDays.lastOrNull()
 
         val total = counts.values.sum()
+        // #1735: record that an import RAN and what it brought. "Hours after a ride it still is not
+        // there" cannot be told from "Health Connect never imported it" without this: the log had per-source
+        // row counts but nothing about WHEN they last moved. Mirrors the sync.lastWriteOkAt pattern the
+        // strap-write path already uses. Best-effort - a stamp failure must not sink a good import.
+        recordImportRun(context, rows = total, throughDay = lastDay)
         return ImportSummary(
             source = SOURCE,
             counts = counts,
diff --git a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
index 3ac726506a..a67e039941 100644
--- a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
@@ -104,6 +104,20 @@ object AndroidDiagnostics {
                     "(if you restored a backup, fully restart the app — #57)")
             }
             if (restoreAt > 0L) add("Last restore: ${relTime(now - restoreAt * 1000L)}")
+            // #1735: row COUNTS alone cannot separate "Health Connect never brought the ride in" from
+            // "it did, but nothing has re-scored since". Both halves of that need a WHEN, and neither had
+            // one: the importer recorded no run time at all, and the engine's "re-score: done" goes only to
+            // the live log, so an export written hours later has already rolled it away.
+            val hcAt = p.getLong("hc.lastImportOkAt", 0L)
+            add(
+                hcImportLine(
+                    ago = if (hcAt > 0L) relTime(now - hcAt * 1000L) else null,
+                    rows = p.getInt("hc.lastImportRows", 0),
+                    throughDay = p.getString("hc.lastImportThroughDay", null),
+                ),
+            )
+            val scoredAt = p.getLong("score.lastPassAt", 0L)
+            add(scoringPassLine(ago = if (scoredAt > 0L) relTime(now - scoredAt * 1000L) else null))
             add("Timezone:    ${tzLine()}")
             val repo = com.noop.data.WhoopRepository.from(context)
             val days = repo.days("my-whoop")
@@ -284,6 +298,29 @@ object AndroidDiagnostics {
             add("Stored: " + perSource.joinToString("  ") { "${it.first}=${it.second.size}" })
             val latest = perSource.flatMap { it.second }.maxByOrNull { it.startTs }
             add(if (latest != null) "Latest: ${dayStamp(latest.startTs)} · ${latest.sport} (${latest.source})" else "Latest: none")
+            // #1735: "auto-detect is off but workouts keep appearing" is answerable only if the log says
+            // which of the TWO detectors is meant. The Settings toggle governs the opt-in suggestion card
+            // ONLY; the engine derives durable sport="detected" rows on every pass regardless, and all the
+            // per-bout tracing for that sits behind the Test Centre WORKOUTS domain, which a reporter
+            // filing a non-test-mode bug will not have on. Counts read from the store, so this states what
+            // IS, not what the code intends.
+            // Guarded SEPARATELY from the section: this file's contract is that every probe is guarded,
+            // and a throw in here would otherwise be caught by the outer handler and reported as
+            // "(workout sources unavailable)" - blaming the store for a failure in the auto-detect probe,
+            // with the sources sitting right above it having plainly worked.
+            runCatching {
+                autoDetectStateLine(
+                    suggestionCardEnabled = com.noop.ui.NoopPrefs.autoDetectWorkouts(context),
+                    storedDetectedRows = perSource.flatMap { it.second }.count { it.sport == "detected" },
+                    // Summed over the SAME strap ids whose rows were counted above. A two-strap install
+                    // banks detected rows under both "<active>-noop" and "my-whoop-noop", so reading
+                    // dismissals for the active strap alone could print "detected=52 dismissed=0" while
+                    // the dismissals sat under the other id, sending a reader after the #107 mechanism.
+                    dismissedMarkers = runCatching {
+                        listOf(active, "my-whoop").distinct().sumOf { repo.dismissedDetected(it).size }
+                    }.getOrNull(),
+                )
+            }.onSuccess { add(it) }.onFailure { add("(auto-detect state unavailable: ${it.message})") }
         }.onFailure { add("(workout sources unavailable: ${it.message})") }
     }
 
@@ -573,6 +610,74 @@ object AndroidDiagnostics {
         }
     }.getOrDefault("unknown")
 
+    /**
+     * When Health Connect last completed an import, and what it brought.
+     *
+     * The export already listed per-source row counts, which answer "is there data" but never "is it
+     * MOVING". #1735 turns on exactly that difference: a ride that has not appeared is either one Health
+     * Connect never imported or one it imported and nothing re-scored, and a static count cannot tell
+     * those apart. [rows] of 0 with a recent [ago] is a real and useful state - the import ran and found
+     * nothing - which is why the empty path is stamped too.
+     *
+     * A null [ago] means no import has ever completed on this install. Stated plainly rather than dressed
+     * up as a fault: plenty of installs never connect Health Connect at all.
+     */
+    internal fun hcImportLine(ago: String?, rows: Int, throughDay: String?): String {
+        if (ago == null) return "HC import:   never completed on this install"
+        val through = throughDay?.let { " · through $it" } ?: ""
+        return "HC import:   $rows row(s) $ago$through"
+    }
+
+    /**
+     * When the scoring engine last completed a pass.
+     *
+     * The analyze watermark records WHAT was scored (an HR fingerprint) and never WHEN, and the engine's
+     * own "re-score: done" line is live-log only, so an export written hours after the pass has already
+     * rolled it away. Without this, "I synced and nothing appeared" cannot distinguish a pass that ran and
+     * found nothing new from one that never ran - and those need opposite next steps.
+     *
+     * Stamped at BOTH completion sites (the idle pass and the post-sync pass), so the freshest of the two
+     * is what shows.
+     */
+    internal fun scoringPassLine(ago: String?): String =
+        if (ago == null) "Scoring:     no pass has completed on this install"
+        else "Scoring:     last pass $ago"
+
+    /**
+     * Which workout detector produced what, and whether the Settings toggle has anything to do with it.
+     *
+     * NOOP has TWO detectors and they are deliberately separate (see AutoWorkoutDetector's header). The
+     * Settings toggle governs the opt-in SUGGESTION card, which only ever offers a workout and saves
+     * nothing until the user taps Save. The IntelligenceEngine separately derives durable sport="detected"
+     * rows from the 1 Hz store on every scoring pass, and that has never been gated by the toggle.
+     *
+     * Both are called "detect" in the UI, so #1735 read the second one's rows as the first one ignoring
+     * its own switch, which is an entirely reasonable reading. Every per-bout line that would have shown
+     * the difference sits behind the Test Centre WORKOUTS domain, and that report was filed as "not a
+     * test-mode bug" with the domain off, so the log carried nothing about it at all.
+     *
+     * Reads COUNTS from the store rather than describing intent: it states what is on disk, not what the
+     * code believes it does. The reassurance clause is emitted only for the combination that actually
+     * misleads (card off, rows present) so it never claims to explain a state it is not looking at.
+     * [dismissedMarkers] is null when the query failed, and renders "n/a" rather than a wrong zero, which
+     * would read as "your dismissals are not sticking".
+     */
+    internal fun autoDetectStateLine(
+        suggestionCardEnabled: Boolean,
+        storedDetectedRows: Int,
+        dismissedMarkers: Int?,
+    ): String {
+        val card = if (suggestionCardEnabled) "on" else "off"
+        val dismissed = dismissedMarkers?.toString() ?: "n/a"
+        val note = if (!suggestionCardEnabled && storedDetectedRows > 0) {
+            " (rows with the card off are EXPECTED: a different detector makes them)"
+        } else {
+            ""
+        }
+        return "Auto-detect: suggestion card=$card · engine \"Activity\" rows=always on, not gated by " +
+            "that toggle · stored detected=$storedDetectedRows · dismissed markers=$dismissed$note"
+    }
+
     /** A coarse OEM-kill heuristic by manufacturer (the aggressive-background-kill vendors). Pure and
      *  internal so it unit-tests without a Context (the suite stays Robolectric-free). */
     internal fun oemKillHeuristic(manufacturer: String): String =
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index 91a2948cfd..fd51daca61 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -1147,7 +1147,17 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
                     // analyzeRecent now hops to Dispatchers.Default; a scope cancellation surfaces as a
                     // CancellationException that runCatching would otherwise swallow, breaking the loop's
                     // own cancellation — rethrow it so onCleared() actually stops the loop. (#125)
-                }.onSuccess { NoopPrefs.setAnalyzeWatermark(appContext, analyzeFp) }
+                }.onSuccess {
+                    NoopPrefs.setAnalyzeWatermark(appContext, analyzeFp)
+                    // #1735: the watermark says WHAT was scored, never WHEN. "re-score: done" goes only to
+                    // the live log, so hours later the rolling buffer has dropped it and an export cannot
+                    // tell a pass that ran from one that never did - which is half of "my ride still is not
+                    // showing". Stamp the completion; AndroidDiagnostics renders it beside "Data write".
+                    runCatching {
+                        NoopPrefs.of(appContext).edit()
+                            .putLong("score.lastPassAt", System.currentTimeMillis() / 1000).apply()
+                    }
+                }
                     .onFailure { if (it is kotlin.coroutines.cancellation.CancellationException) throw it }
                 // Opt-in writeback: push the freshly computed nights into Health Connect so other
                 // apps see them. Idempotent (clientRecordId per metric+day), so re-running every
diff --git a/android/app/src/test/java/com/noop/testcentre/AutoDetectStateLineTest.kt b/android/app/src/test/java/com/noop/testcentre/AutoDetectStateLineTest.kt
new file mode 100644
index 0000000000..a1744f1657
--- /dev/null
+++ b/android/app/src/test/java/com/noop/testcentre/AutoDetectStateLineTest.kt
@@ -0,0 +1,69 @@
+package com.noop.testcentre
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The line exists to stop a reader drawing #1735's conclusion, so the tests assert the distinctions that
+ * do that job rather than the prose. Pure and Context-free, like the rest of the diagnostics helpers.
+ */
+class AutoDetectStateLineTest {
+
+    /**
+     * The misleading combination, and the only one the reassurance belongs on: the toggle is off and rows
+     * exist anyway. Claiming it in any other state would be explaining something the line is not looking
+     * at, which is how a diagnostic starts asserting more than it observes.
+     */
+    @Test
+    fun `only the misleading combination gets the reassurance`() {
+        val misleading = AndroidDiagnostics.autoDetectStateLine(false, storedDetectedRows = 12, dismissedMarkers = 3)
+        assertTrue(misleading.contains("suggestion card=off"))
+        assertTrue(misleading.contains("are EXPECTED"))
+
+        // Card off and NO rows: nothing to explain.
+        assertFalse(AndroidDiagnostics.autoDetectStateLine(false, 0, 0).contains("are EXPECTED"))
+        // Card ON: rows are unsurprising to a reader who just enabled it.
+        assertFalse(AndroidDiagnostics.autoDetectStateLine(true, 12, 0).contains("are EXPECTED"))
+    }
+
+    /** The load-bearing fact: the engine rows are not governed by the toggle. Always stated. */
+    @Test
+    fun `the ungated engine rows are named in every state`() {
+        for (card in listOf(true, false)) {
+            for (rows in listOf(0, 7)) {
+                val line = AndroidDiagnostics.autoDetectStateLine(card, rows, 0)
+                assertTrue("state card=$card rows=$rows must name the ungated derivation",
+                           line.contains("not gated by that toggle"))
+            }
+        }
+    }
+
+    @Test
+    fun `the counts are reported`() {
+        val line = AndroidDiagnostics.autoDetectStateLine(true, storedDetectedRows = 41, dismissedMarkers = 5)
+        assertTrue(line.contains("suggestion card=on"))
+        assertTrue(line.contains("stored detected=41"))
+        assertTrue(line.contains("dismissed markers=5"))
+    }
+
+    /**
+     * A failed dismissal query must not render as zero. "dismissed markers=0" reads as "your dismissals
+     * are not sticking" and would send a reader after the #107 mechanism for a problem that is a failed
+     * read, which is the exact class of wrong-attribution CLAUDE.md warns about.
+     */
+    @Test
+    fun `an unavailable dismissal count is not reported as zero`() {
+        val unknown = AndroidDiagnostics.autoDetectStateLine(false, 3, dismissedMarkers = null)
+        assertTrue(unknown.contains("dismissed markers=n/a"))
+        assertFalse(unknown.contains("dismissed markers=0"))
+        // A real zero still reads as zero.
+        assertTrue(AndroidDiagnostics.autoDetectStateLine(false, 3, 0).contains("dismissed markers=0"))
+    }
+
+    /** House style for these lines: no em-dashes. */
+    @Test
+    fun `the line carries no em-dash`() {
+        assertFalse(AndroidDiagnostics.autoDetectStateLine(false, 12, 3).contains("—"))
+    }
+}
diff --git a/android/app/src/test/java/com/noop/testcentre/PipelineFreshnessLinesTest.kt b/android/app/src/test/java/com/noop/testcentre/PipelineFreshnessLinesTest.kt
new file mode 100644
index 0000000000..ec1a2b8700
--- /dev/null
+++ b/android/app/src/test/java/com/noop/testcentre/PipelineFreshnessLinesTest.kt
@@ -0,0 +1,97 @@
+package com.noop.testcentre
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #1735's second half: "hours after the ride it still is not there". Answering that needs to separate a
+ * Health Connect import that never ran from one that ran and brought nothing, and a scoring pass that
+ * never happened from one that happened and changed nothing. These lines exist for those four states, so
+ * the tests assert that all four stay distinguishable.
+ */
+class PipelineFreshnessLinesTest {
+
+    // ---- hcImportLine -------------------------------------------------------------------------
+
+    /**
+     * The state a static row count cannot express, and the reason the empty path is stamped at all: the
+     * import RAN and found nothing. If this rendered like "never", the log would say the same thing about
+     * an install that has never connected Health Connect and one whose import is running fine and simply
+     * has nothing new - which is the whole distinction being bought here.
+     */
+    @Test
+    fun `ran and found nothing is not the same as never ran`() {
+        val ranEmpty = AndroidDiagnostics.hcImportLine(ago = "12m ago", rows = 0, throughDay = null)
+        val never = AndroidDiagnostics.hcImportLine(ago = null, rows = 0, throughDay = null)
+        assertTrue(ranEmpty.contains("0 row(s) 12m ago"))
+        assertTrue(never.contains("never completed"))
+        assertFalse("a completed empty import must not read as never", ranEmpty.contains("never"))
+    }
+
+    @Test
+    fun `a productive import reports rows and how far it reached`() {
+        val line = AndroidDiagnostics.hcImportLine(ago = "3m ago", rows = 41, throughDay = "2026-08-30")
+        assertTrue(line.contains("41 row(s) 3m ago"))
+        assertTrue(line.contains("through 2026-08-30"))
+    }
+
+    /** No day recorded must not render a dangling separator or an empty "through". */
+    @Test
+    fun `a missing through-day leaves no dangling clause`() {
+        val line = AndroidDiagnostics.hcImportLine(ago = "3m ago", rows = 41, throughDay = null)
+        assertFalse(line.contains("through"))
+        assertFalse(line.trimEnd().endsWith("·"))
+    }
+
+    /**
+     * "never" must not be phrased as a fault. Plenty of installs never connect Health Connect, and a line
+     * that reads like a problem sends a reader chasing one that does not exist.
+     */
+    @Test
+    fun `never is stated plainly rather than as a failure`() {
+        val never = AndroidDiagnostics.hcImportLine(null, 0, null)
+        assertFalse(never.contains("FAIL"))
+        assertFalse(never.contains("⚠"))
+        assertTrue(never.contains("on this install"))
+    }
+
+    // ---- scoringPassLine ----------------------------------------------------------------------
+
+    @Test
+    fun `a completed pass and no pass are distinguishable`() {
+        assertTrue(AndroidDiagnostics.scoringPassLine("8m ago").contains("last pass 8m ago"))
+        assertTrue(AndroidDiagnostics.scoringPassLine(null).contains("no pass has completed"))
+        assertFalse(AndroidDiagnostics.scoringPassLine("8m ago").contains("no pass"))
+    }
+
+    // ---- shared shape -------------------------------------------------------------------------
+
+    /**
+     * Both join the "Data write:" / "Timezone:" / "Last restore:" block, whose labels are padded so the
+     * VALUES start at a common column. Asserted exactly (content begins at index 13, matching that block)
+     * rather than "somewhere to the right", which a mis-padded line would also satisfy.
+     */
+    @Test
+    fun `the values start at the same column as the block they join`() {
+        val lines = listOf(
+            AndroidDiagnostics.hcImportLine("1m ago", 1, null),
+            AndroidDiagnostics.hcImportLine(null, 0, null),
+            AndroidDiagnostics.scoringPassLine("1m ago"),
+            AndroidDiagnostics.scoringPassLine(null),
+        )
+        for (line in lines) {
+            val afterColon = line.indexOf(':') + 1
+            val valueStart = afterColon + line.drop(afterColon).indexOfFirst { it != ' ' }
+            assertEquals("'$line' must start its value at column 13", 13, valueStart)
+        }
+    }
+
+    /** House style for these lines: no em-dashes. */
+    @Test
+    fun `the lines carry no em-dash`() {
+        assertFalse(AndroidDiagnostics.hcImportLine("1m ago", 1, "2026-08-30").contains("—"))
+        assertFalse(AndroidDiagnostics.scoringPassLine(null).contains("—"))
+    }
+}

From 2083885b5bcfcef3e87b82c7fcff9032cbd9a137 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 16:04:44 +1200
Subject: [PATCH 076/333] vo2max: show the decimal the chart draws, and say why
 the line breaks (#1740)

Two residuals from #1662, reported by @bartmuskala after #1664 landed.

PRECISION. Android formatted vo2max_est with roundToInt while the line was plotted at full precision, so the labels could not move with it: VO2max shifts well under 1 ml/kg between weekly points, so the trend visibly sloped while the scrub read-out, the Min/Avg/Max row and the readings table all printed the same integer. #1664 made those text surfaces agree with EACH OTHER; it could not make them agree with the line, because the precision was too coarse to express what the line draws.

A parity bug rather than a new policy: the iOS MetricCatalog already declares `decimals: 1` for both VO2max keys. Checked and deliberately left rounded are the Today card and the Health StatePill, because iOS's unitText defaults to `decimals: 0` and its card does not override it - summary-integer / detail-decimal is the split iOS already ships. Locale.US matches the chart's own formatLineValue fallback, so no separator changes for anyone.

THE BREAK. The VO2max line is split on purpose wherever the attribution source changes, so two non-adjacent Nes runs are never joined across an incompatible Uth stretch. Nothing said so, and a silent gap in a trend is indistinguishable from a rendering fault - it was reported as "something weird with a broken line". A footnote now appears only when a break exists, derived from vo2MaxTrendSegmentIds rather than recomputed so the caption and the segmentation cannot disagree.

Three review passes, and the last two found things no gate could reach.

The iOS caption was first placed beside the chart, inside a closure ChartCard applies `chart().frame(height:)` to - so the line and the text would have shared one fixed height, the chart shrinking to make room for the sentence explaining it. Valid Swift, and app-build was green on it; only reading the container shows it. It moved to the footer, the one full-height slot under the chart. Android keeps its caption under the plot because its card has no such frame, and the reason is recorded at the site so the asymmetry does not read as an oversight.

The caption then claimed more than it could know. The line splits on attribution SOURCE, and an untagged legacy reading resolves to "estimator:unknown" - vo2MaxAttributionSource says a missing tag must never inherit today's method - so an unknown -> Nes transition breaks the line exactly like a real method change while the method may never have changed. "the estimation method changed" asserted the one thing that data cannot establish; it now reads "changed or was not recorded". vo2MaxTrendHasMethodChange became vo2MaxTrendHasBreak on both platforms: a predicate whose name over-claims is how the caption came to over-claim.

Strings land in all six Android locales including pl and zh, and all ten iOS. Polish is currently 100% complete, so omitting it would have regressed a finished locale. The xcstrings entry was written and later replaced as TEXT, keeping the diff to two lines rather than a re-serialised file.

6 tests on the break predicate, including the untagged case that justifies the wording. 4845 Android tests green, i18n audit and doc-comment lint clean, app-build green on macOS and iOS.
---
 Strand/Resources/Localizable.xcstrings        |  3 +
 Strand/Screens/MetricExplorerView.swift       | 42 +++++++++--
 .../src/main/java/com/noop/ui/HealthScreen.kt | 21 +++++-
 .../com/noop/ui/HealthVitalDetailLogic.kt     | 15 ++++
 .../app/src/main/res/values-de/strings.xml    |  1 +
 .../app/src/main/res/values-es/strings.xml    |  1 +
 .../app/src/main/res/values-fr/strings.xml    |  1 +
 .../app/src/main/res/values-pl/strings.xml    |  1 +
 .../src/main/res/values-pt-rPT/strings.xml    |  1 +
 .../app/src/main/res/values-zh/strings.xml    |  1 +
 android/app/src/main/res/values/strings.xml   |  1 +
 .../com/noop/ui/Vo2MaxTrendCaptionTest.kt     | 71 +++++++++++++++++++
 12 files changed, 153 insertions(+), 6 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ui/Vo2MaxTrendCaptionTest.kt

diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 272e7e9ed6..9a9e179f83 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -54,6 +54,9 @@
       "zh-Hans": { "stringUnit": { "state": "translated", "value": "部分信号升高，但你记录了%@。这更可能是原因。设备端估算，不是诊断。" } },
       "zh-Hant": { "stringUnit": { "state": "translated", "value": "部分訊號升高，但你記錄了%@。這更可能是原因。裝置端估算，不是診斷。" } }
     } },
+    "The line breaks where the estimation method changed or was not recorded.": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Die Linie bricht dort ab, wo sich die Schätzmethode geändert hat oder nicht erfasst wurde." } }, "en": { "stringUnit": { "state": "translated", "value": "The line breaks where the estimation method changed or was not recorded." } }, "es": { "stringUnit": { "state": "translated", "value": "La línea se interrumpe donde el método de estimación cambió o no se registró." } }, "fr": { "stringUnit": { "state": "translated", "value": "La courbe est interrompue là où la méthode d’estimation a changé ou n’a pas été enregistrée." } }, "it": { "stringUnit": { "state": "translated", "value": "La linea si interrompe dove il metodo di stima è cambiato o non è stato registrato." } }, "pl": { "stringUnit": { "state": "translated", "value": "Linia jest przerwana tam, gdzie metoda szacowania zmieniła się lub nie została zapisana." } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "A linha é interrompida onde o método de estimativa mudou ou não foi registado." } }, "ru": { "stringUnit": { "state": "translated", "value": "Линия прерывается там, где метод оценки изменился или не был записан." } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "线条在估算方法发生变化或未记录之处中断。" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "線條在估算方法變更或未記錄之處中斷。" } }
+    } },
     "A few signals are mildly up: %@. Nothing alarming, but a calmer day may help. On-device estimate, not a diagnosis.": { "localizations": {
       "de": { "stringUnit": { "state": "translated", "value": "Einige Signale sind leicht erhöht: %@. Kein Grund zur Sorge, aber ein ruhigerer Tag könnte helfen. Schätzung auf dem Gerät, keine Diagnose." } }, "en": { "stringUnit": { "state": "translated", "value": "A few signals are mildly up: %@. Nothing alarming, but a calmer day may help. On-device estimate, not a diagnosis." } }, "es": { "stringUnit": { "state": "translated", "value": "Algunas señales están ligeramente elevadas: %@. No es alarmante, pero un día más tranquilo podría ayudar. Estimación en el dispositivo, no es un diagnóstico." } }, "fr": { "stringUnit": { "state": "translated", "value": "Quelques signaux sont légèrement élevés : %@. Rien d’alarmant, mais une journée plus calme peut aider. Estimation sur l’appareil, pas un diagnostic." } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Alguns sinais estão ligeiramente elevados: %@. Não é alarmante, mas um dia mais calmo pode ajudar. Estimativa no dispositivo, não é um diagnóstico." } },
       "it": { "stringUnit": { "state": "translated", "value": "Alcuni segnali sono leggermente elevati: %@. Nulla di allarmante, ma una giornata più tranquilla può aiutare. Stima sul dispositivo, non è una diagnosi." } },
diff --git a/Strand/Screens/MetricExplorerView.swift b/Strand/Screens/MetricExplorerView.swift
index fd71b0e2a7..6a1a65d495 100644
--- a/Strand/Screens/MetricExplorerView.swift
+++ b/Strand/Screens/MetricExplorerView.swift
@@ -182,6 +182,18 @@ func vo2MaxAttributionSource(_ estimator: Vo2MaxEstimator?) -> String {
     vo2MaxAttributionPrefix + (estimator?.rawValue ?? "unknown")
 }
 
+/// Will the chart show a visible break in this VO₂max trend?
+///
+/// Derived from `vo2MaxTrendSegmentIds` rather than recomputed, so the caption and the segmentation can
+/// never disagree. A GAP IN DAYS under one estimator is still a single segment and draws no break, so it
+/// correctly gets no caption: a break means the readings were not produced alike, not that the data
+/// paused. Named for the BREAK: an untagged legacy reading resolves to "...estimator:unknown", so an
+/// unknown -> Nes transition splits the line while the method itself may never have changed.
+/// Kotlin twin `vo2MaxTrendHasBreak`.
+func vo2MaxTrendHasBreak(days: [String], sourceByDay: [String: String]) -> Bool {
+    Set(vo2MaxTrendSegmentIds(days: days, sourceByDay: sourceByDay)).count > 1
+}
+
 /// Sequential segment ids for the VO₂max trend. The counter matters when a user changes Nes → Uth → Nes:
 /// using the method name alone would reconnect the two non-adjacent Nes runs across the Uth interval.
 func vo2MaxTrendSegmentIds(days: [String], sourceByDay: [String: String]) -> [String] {
@@ -1074,11 +1086,31 @@ struct MetricDetailView: View {
                 valueFormat: { fmt($0) }
             )
         } footer: {
-            ChartFooter([
-                ("Window", effectiveRange.label),
-                ("Points", "\(windowed.count)"),
-                ("Latest", heroValue),
-            ])
+            // #1662: the VO₂max line is SPLIT on purpose wherever the estimator changes, so two
+            // non-adjacent Nes runs are never joined across an incompatible Uth stretch. Nothing said so,
+            // and a silent gap in a trend is indistinguishable from a rendering fault — it was reported
+            // as "something weird with a broken line". Shown only when a break actually exists, so it
+            // explains the chart in front of the reader rather than a behaviour they cannot see.
+            //
+            // In the FOOTER, not beside the chart: `ChartCard` applies `chart().frame(height:)` to that
+            // whole closure, so a caption in there would be squeezed into the chart's fixed height and
+            // steal space from the line it is explaining. The footer is the only full-height slot under
+            // the chart. Android places it directly under the plot because its card has no such frame -
+            // feature parity, not pixel parity.
+            VStack(alignment: .leading, spacing: 8) {
+                if metric.key == "vo2max_est",
+                   vo2MaxTrendHasBreak(days: windowed.map(\.day), sourceByDay: sourceByDay) {
+                    Text("The line breaks where the estimation method changed or was not recorded.")
+                        .font(StrandFont.footnote)
+                        .foregroundStyle(StrandPalette.textTertiary)
+                        .frame(maxWidth: .infinity, alignment: .leading)
+                }
+                ChartFooter([
+                    ("Window", effectiveRange.label),
+                    ("Points", "\(windowed.count)"),
+                    ("Latest", heroValue),
+                ])
+            }
         }
     }
 
diff --git a/android/app/src/main/java/com/noop/ui/HealthScreen.kt b/android/app/src/main/java/com/noop/ui/HealthScreen.kt
index 7429f1078c..435e38ef72 100644
--- a/android/app/src/main/java/com/noop/ui/HealthScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/HealthScreen.kt
@@ -2079,6 +2079,19 @@ fun VitalDetailScreen(vm: AppViewModel, key: String) {
                     formatValue = { "${detail.format(it)} ${detail.unit}".trim() },
                     segmentIds = if (key == "vo2max_est") vo2MaxTrendSegmentIds(filteredReadings) else null,
                 )
+                // #1662: the VO2max line is SPLIT on purpose wherever the estimator changes, so two
+                // non-adjacent Nes runs are never joined across an incompatible Uth stretch. Nothing said
+                // so, and a silent gap in a trend is indistinguishable from a rendering fault - it was
+                // reported as "something weird with a broken line". Shown only when a break actually
+                // exists, so it explains the chart in front of the reader rather than describing a
+                // behaviour they cannot see.
+                if (key == "vo2max_est" && vo2MaxTrendHasBreak(filteredReadings)) {
+                    Text(
+                        text = uiString(R.string.vo2max_method_change_caption),
+                        style = NoopType.footnote,
+                        color = Palette.textTertiary,
+                    )
+                }
                 Box(
                     modifier = Modifier
                         .fillMaxWidth()
@@ -2351,7 +2364,13 @@ private suspend fun buildSeriesVitalDetail(vm: AppViewModel, key: String): Vital
                 )
                 VitalReading(point.day, point.value, vo2MaxAttributionSource(estimator))
             },
-            format = { it.roundToInt().toString() },
+            // #1662: ONE decimal, matching the iOS catalog's `decimals: 1` for this key. Android rounded
+            // to an integer, so a chart plotted at full precision sat under labels that could not move
+            // with it: VO2max shifts well under 1 ml/kg between weekly points, so the line visibly sloped
+            // while every read-out, the Min/Avg/Max row and the readings table all printed the same
+            // number. #1664 made those text surfaces agree with each other; it could not make them agree
+            // with the LINE, because the precision was too coarse to express what the line draws.
+            format = { String.format(Locale.US, "%.1f", it) },
         )
     }
     "steps_est" -> {
diff --git a/android/app/src/main/java/com/noop/ui/HealthVitalDetailLogic.kt b/android/app/src/main/java/com/noop/ui/HealthVitalDetailLogic.kt
index 20601ddd5d..87fe7b8601 100644
--- a/android/app/src/main/java/com/noop/ui/HealthVitalDetailLogic.kt
+++ b/android/app/src/main/java/com/noop/ui/HealthVitalDetailLogic.kt
@@ -49,6 +49,21 @@ internal fun vo2MaxTrendSegmentIds(readings: List<VitalReading>): List<String> {
     }
 }
 
+/**
+ * Will the chart show a visible break in this VO2max trend?
+ *
+ * Derived from [vo2MaxTrendSegmentIds] rather than recomputed, so the caption and the segmentation can
+ * never disagree: if the ids collapse to one group the line is continuous and there is nothing to
+ * explain. Two readings from the SAME estimator with a gap in days are one segment and correctly get no
+ * caption - a break means the readings were not produced alike, not that the data paused.
+ *
+ * Named for the BREAK, not for a method change: an untagged legacy reading resolves to
+ * "...estimator:unknown" (see [vo2MaxAttributionSource]), so an unknown -> Nes transition also splits the
+ * line while the method itself may never have changed. The caption is worded for both causes.
+ */
+internal fun vo2MaxTrendHasBreak(readings: List<VitalReading>): Boolean =
+    vo2MaxTrendSegmentIds(readings).distinct().size > 1
+
 /** #377: merge the three step stores into one per-day series with the SAME precedence as the Today
  *  Steps tile — a REAL on-device count ([real], WHOOP 5/MG @57 → DailyMetric.steps) wins, else an
  *  [imported] Health Connect / Apple Health count, else the motion-model [est] (`steps_est`). The three
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index d1d2c32fe2..39d82f4d58 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2646,4 +2646,5 @@
     <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Zifferblatt der inneren Uhr</string>
     <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">Letzte Nacht</string>
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Deine innere Uhr</string>
+    <string name="vo2max_method_change_caption">Die Linie bricht dort ab, wo sich die Schätzmethode geändert hat oder nicht erfasst wurde.</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 9e5bc34f98..42e08db122 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2632,4 +2632,5 @@
     <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Esfera del reloj interno</string>
     <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">Anoche</string>
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Tu reloj interno</string>
+    <string name="vo2max_method_change_caption">La línea se interrumpe donde el método de estimación cambió o no se registró.</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 5f79dfba30..fd57104b97 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2631,4 +2631,5 @@
     <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Cadran de l\'horloge biologique</string>
     <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">La nuit dernière</string>
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Votre horloge</string>
+    <string name="vo2max_method_change_caption">La courbe est interrompue là où la méthode d’estimation a changé ou n’a pas été enregistrée.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 2e545c2c07..293a6702c0 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2637,4 +2637,5 @@
     <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Tarcza zegara biologicznego</string>
     <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">Ostatnia noc</string>
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Twój zegar</string>
+    <string name="vo2max_method_change_caption">Linia jest przerwana tam, gdzie metoda szacowania zmieniła się lub nie została zapisana.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 8b52c47c73..b2fb74f123 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2625,4 +2625,5 @@
     <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Mostrador do relógio biológico</string>
     <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">A noite passada</string>
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">O seu relógio</string>
+    <string name="vo2max_method_change_caption">A linha é interrompida onde o método de estimativa mudou ou não foi registado.</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 5190ac7b9f..bd714e7123 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2546,4 +2546,5 @@
     <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">生物钟表盘</string>
     <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">昨夜</string>
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">你的生物钟</string>
+    <string name="vo2max_method_change_caption">线条在估算方法发生变化或未记录之处中断。</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 0043b2f562..7d329fb809 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2659,4 +2659,5 @@
     <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Body clock dial</string>
     <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">Last night</string>
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Your clock</string>
+    <string name="vo2max_method_change_caption">The line breaks where the estimation method changed or was not recorded.</string>
 </resources>
diff --git a/android/app/src/test/java/com/noop/ui/Vo2MaxTrendCaptionTest.kt b/android/app/src/test/java/com/noop/ui/Vo2MaxTrendCaptionTest.kt
new file mode 100644
index 0000000000..7a8aef25fa
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/Vo2MaxTrendCaptionTest.kt
@@ -0,0 +1,71 @@
+package com.noop.ui
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The caption explains a break the reader can see, so it must appear exactly when the chart is actually
+ * split. Deriving it from [vo2MaxTrendSegmentIds] rather than recomputing means the two cannot disagree;
+ * these cases pin the behaviour that matters at the boundary.
+ */
+class Vo2MaxTrendCaptionTest {
+
+    private fun r(day: String, source: String) = VitalReading(day, 42.0, source)
+
+    @Test
+    fun `a single estimator throughout needs no caption`() {
+        val nes = listOf(r("2026-08-01", "nes"), r("2026-08-08", "nes"), r("2026-08-15", "nes"))
+        assertFalse(vo2MaxTrendHasBreak(nes))
+    }
+
+    @Test
+    fun `a method change is captioned`() {
+        assertTrue(vo2MaxTrendHasBreak(listOf(r("2026-08-01", "nes"), r("2026-08-08", "uth"))))
+    }
+
+    /**
+     * The distinction the caption's wording depends on: a GAP IN DAYS under one estimator is still one
+     * segment and draws no break, so captioning it would explain something the reader cannot see and
+     * imply a method change that never happened.
+     */
+    @Test
+    fun `a gap in days under one estimator is not a method change`() {
+        val sparse = listOf(r("2026-01-01", "nes"), r("2026-08-01", "nes"))
+        assertFalse(vo2MaxTrendHasBreak(sparse))
+    }
+
+    /**
+     * Returning to an earlier estimator is a THIRD segment, not a return to the first — that is exactly
+     * why [vo2MaxTrendSegmentIds] carries a sequential group number. The caption must fire here too.
+     */
+    @Test
+    fun `returning to the first estimator still counts as changed`() {
+        val there_and_back = listOf(r("2026-08-01", "nes"), r("2026-08-08", "uth"), r("2026-08-15", "nes"))
+        assertTrue(vo2MaxTrendHasBreak(there_and_back))
+        // Three groups, not two: the non-adjacent Nes runs must not be joined.
+        assertTrue(vo2MaxTrendSegmentIds(there_and_back).distinct().size == 3)
+    }
+
+    /**
+     * The case that decides the caption's WORDING. An untagged legacy reading resolves to
+     * "...estimator:unknown", so it splits the line exactly like a real method change would - but the
+     * method may never have changed, only the record of it is missing. A caption saying "the method
+     * changed" would assert something this data cannot support, which is why it says "changed or was
+     * not recorded" instead.
+     */
+    @Test
+    fun `an unrecorded method also breaks the line`() {
+        val untaggedThenTagged = listOf(
+            r("2026-08-01", "vo2max-estimator:unknown"),
+            r("2026-08-08", "vo2max-estimator:nes"),
+        )
+        assertTrue(vo2MaxTrendHasBreak(untaggedThenTagged))
+    }
+
+    @Test
+    fun `degenerate inputs do not claim a change`() {
+        assertFalse(vo2MaxTrendHasBreak(emptyList()))
+        assertFalse(vo2MaxTrendHasBreak(listOf(r("2026-08-01", "nes"))))
+    }
+}

From add5191ffbedcd90ec20cf29ba0d870da62e3dfb Mon Sep 17 00:00:00 2001
From: Prasad Fadke <fadkeprasad@gmail.com>
Date: Sun, 30 Aug 2026 00:15:36 -0400
Subject: [PATCH 077/333] Fix missed sleep after partial history sync (#1734)

Historical streams do not commit atomically, so HR can land before motion. A scoring pass in that gap sees no usable sleep, and the old HR-only watermark then read the later gravity commit as unchanged and skipped the decisive retry - the first partial answer became sticky until the 15-minute backstop.

The watermark now fingerprints every raw stream that can move a sleep or daily score: HR keeps its count+maxTs, the rest use SQLite's monotonic rowid frontier, so the gate moves for a gravity-only commit without COUNT-scanning millions of dense motion rows. The `v2` prefix changes the persisted value once on upgrade, so every install gets one clean rescore under the complete contract.

Two things about this were easy to get wrong and are right here.

BOTH Android writers were switched. That key is written from AppViewModel's idle tick AND from WhoopBleClient's post-offload pass; converting only one would have left them writing `v2|...` and `count:maxTs` into the same key, mismatching forever and re-running the 21-day pass every 15 minutes. And MAX(rowid) is a safe frontier precisely because every fingerprinted table inserts with OnConflictStrategy.IGNORE - a duplicate offload inserts nothing and the frontier holds, so the empty-offload skip (#1146/#1196) survives. A REPLACE table would have destroyed it.

Android also gains a trailing scoring pass when a later chunk arrives during an in-flight one, plus explicit Sleep states for syncing, calculating, sync-failed, awaiting-sync and not-detected, with the older night kept visible underneath. The queue is Android-only for a reason that was asked and answered: Swift already has the equivalent at the engine boundary in IntelligenceEngine's pendingForcedRescore latch, so a forced call arriving mid-pass re-arms one after the lock releases. Verified at the cited lines rather than taken on trust.

REVIEW ROUND. i18n Coverage was red: the eight new Sleep-status strings reached values/, de, es, fr and pt-rPT but not pl or zh, and Polish is currently 100% complete, so it would have been the first thing to break a finished locale. The ratchet on non-focus locales caught exactly that. Now ported from the Apple translations the same PR already carried, character-for-character.

The Kotlin fingerprint SQL was also verified by nothing: Swift had a real SQLite regression test while the Kotlin side proxied the DAO to return a canned string, so the statement never ran and a transposed key letter would have compiled and shipped. It is now one shared ANALYSIS_FINGERPRINT_SQL constant that Room and a plain-JVM sqlite-jdbc test both execute, asserting the byte-exact v2 result and the gravity-only move. Mutation-checked on merge: transposing 'g' to 'q' fails it. The dependency is nearly free - sqlite-jdbc was already resolved on the KSP classpath, so this adds two configurations at the same pinned version.

Known residual, not blocking: the test creates its own tables, so it proves the SQL against a fabricated schema and a table RENAME would still pass. Asserting the ten table names against the KSP-exported schema SchemaOracleTest already loads would close it.

Verified: all five workflows green, and 4845 Android unit tests pass locally on the repo's pinned JDK 17 - the floating-point failures noted in the checklist are a local JDK 21 artefact, not a repo condition.

Thanks @fadkeprasad.
---
 .../WhoopStore/Sources/WhoopStore/Reads.swift | 36 ++++++++
 .../Tests/WhoopStoreTests/ReadTests.swift     | 14 +++
 Strand/App/AppModel.swift                     |  2 +-
 Strand/Data/IntelligenceEngine.swift          | 23 +++--
 Strand/Resources/Localizable.xcstrings        | 24 +++++
 Strand/Screens/SleepView.swift                | 72 +++++++++++++--
 .../SleepPhantomNightFallbackTests.swift      | 25 +++++
 android/app/build.gradle.kts                  |  1 +
 android/app/gradle.lockfile                   |  2 +-
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 37 +++++++-
 .../src/main/java/com/noop/data/WhoopDao.kt   | 19 ++++
 .../java/com/noop/data/WhoopRepository.kt     |  4 +
 .../src/main/java/com/noop/ui/AppViewModel.kt |  4 +-
 .../src/main/java/com/noop/ui/MainActivity.kt |  6 +-
 .../src/main/java/com/noop/ui/SleepScreen.kt  | 91 ++++++++++++++++++-
 .../app/src/main/res/values-de/strings.xml    |  8 ++
 .../app/src/main/res/values-es/strings.xml    |  9 ++
 .../app/src/main/res/values-fr/strings.xml    |  9 ++
 .../app/src/main/res/values-pl/strings.xml    |  8 ++
 .../src/main/res/values-pt-rPT/strings.xml    |  8 ++
 .../app/src/main/res/values-zh/strings.xml    |  8 ++
 android/app/src/main/res/values/strings.xml   |  8 ++
 .../java/com/noop/data/HrFingerprintTest.kt   | 35 +++++++
 .../com/noop/ui/SleepFreshnessStatusTest.kt   | 44 +++++++++
 24 files changed, 464 insertions(+), 33 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ui/SleepFreshnessStatusTest.kt

diff --git a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
index 76446bb471..d4aff30d91 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
@@ -99,6 +99,42 @@ extension WhoopStore {
         }
     }
 
+    /// Cross-device change detector for every raw stream that can change a daily score or sleep session.
+    ///
+    /// The original analysis watermark covered `hrSample` only. Historical offloads do not commit their
+    /// streams atomically: HR can land first and motion/gravity later. A pass run between those commits sees
+    /// no usable sleep, then the post-offload gate used to skip the decisive retry because HR itself had not
+    /// changed. Fingerprint the complete scoring input instead. HR keeps its established count+timestamp
+    /// fingerprint; the other streams use SQLite's monotonic rowid frontier, which catches old backfills
+    /// without full-table COUNT scans over millions of dense motion/R-R rows.
+    /// `v2` intentionally changes the persisted watermark once on upgrade so every install gets one clean
+    /// rescore under the complete contract.
+    public func analysisFingerprint() async throws -> String {
+        try syncRead { db in
+            guard let row = try Row.fetchOne(db, sql: """
+                SELECT
+                  (SELECT COUNT(*) FROM hrSample) AS hc,
+                  (SELECT COALESCE(MAX(ts), 0) FROM hrSample) AS hm,
+                  (SELECT COALESCE(MAX(rowid), 0) FROM ppgHrSample) AS p,
+                  (SELECT COALESCE(MAX(rowid), 0) FROM rrInterval) AS r,
+                  (SELECT COALESCE(MAX(rowid), 0) FROM respSample) AS x,
+                  (SELECT COALESCE(MAX(rowid), 0) FROM gravitySample) AS g,
+                  (SELECT COALESCE(MAX(rowid), 0) FROM sleepStateSample) AS s,
+                  (SELECT COALESCE(MAX(rowid), 0) FROM event) AS e,
+                  (SELECT COALESCE(MAX(rowid), 0) FROM spo2Sample) AS o,
+                  (SELECT COALESCE(MAX(rowid), 0) FROM skinTempSample) AS t,
+                  (SELECT COALESCE(MAX(rowid), 0) FROM stepSample) AS z
+                """) else { return "" }
+            let hc: Int = row["hc"], hm: Int = row["hm"]
+            let keys = ["p", "r", "x", "g", "s", "e", "o", "t", "z"]
+            let tails = keys.map { key -> String in
+                let frontier: Int = row[key]
+                return key + String(frontier)
+            }
+            return "v2|h\(hc):\(hm)|" + tails.joined(separator: "|")
+        }
+    }
+
     /// Aggregate HR over a window: `(n, avg, max)` computed in SQLite over the same measured-∪-PPG rows
     /// [hrSamples] returns, WITHOUT materialising them and WITHOUT a row limit.
     ///
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
index 2096439301..f906ca75a0 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
@@ -68,6 +68,20 @@ final class ReadTests: XCTestCase {
         XCTAssertEqual(scoped.count, 3)
     }
 
+    /// Regression: motion can arrive after HR in a historical offload. The whole-pass watermark must move
+    /// for that gravity-only commit or the first partial (no-sleep) result becomes sticky.
+    func testAnalysisFingerprintMovesWhenSleepCriticalGravityArrivesAfterHr() async throws {
+        let store = try await seeded()
+        let hrOnly = try await store.analysisFingerprint()
+        _ = try await store.insert(
+            Streams(gravity: [GravitySample(ts: 400, x: 0, y: 0, z: 1)]),
+            deviceId: "dev1"
+        )
+        let withGravity = try await store.analysisFingerprint()
+        XCTAssertNotEqual(hrOnly, withGravity)
+        XCTAssertTrue(withGravity.contains("|g1|"))
+    }
+
     func testHrBucketsAveragePerBucketOrderedAndDeviceScoped() async throws {
         let store = try await seeded()
         // 200s buckets over dev1's ts 100/200/300 (bpm 60/61/62):
diff --git a/Strand/App/AppModel.swift b/Strand/App/AppModel.swift
index 4b154828cd..a7e1d0894b 100644
--- a/Strand/App/AppModel.swift
+++ b/Strand/App/AppModel.swift
@@ -635,7 +635,7 @@ final class AppModel: ObservableObject {
         // analyzeRecent tick , otherwise a just-synced night's Charge / Effort / Rest can take up to
         // 15 minutes to appear on a strap-only (no-import) dashboard. analyzeRecent no-ops if a tick is
         // already running and refreshes the dashboard itself once the new scores persist. (PR #218)
-        // #1196/#1146: `skipIfUnchanged` gates THIS post-offload pass on the HR fingerprint — an empty/
+        // #1196/#1146: `skipIfUnchanged` gates THIS post-offload pass on the complete raw-input fingerprint — an empty/
         // duplicate offload (nothing new banked, common on a flapping link) skips the whole-window rescore
         // instead of churning it, which was surfacing as a Trends/streak "0 days" flicker. Only this
         // post-offload caller opts in; every other analyzeRecent path still forces unconditionally.
diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index ed154ce2e2..ff8019144f 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -539,23 +539,22 @@ final class IntelligenceEngine: ObservableObject {
               let respCfg = Baselines.metricCfg["resp"],
               let skinCfg = Baselines.metricCfg["skin_temp"] else { return }
 
-        // #836 (idle-tick gate): re-scoring a 21-day window re-reads ~21×54 h of raw HR and re-runs
+        // #836 (idle-tick gate): re-scoring a 21-day window re-reads ~21×54 h of raw data and re-runs
         // analyzeDay over it. After a big Apple Health import (a reporter's: 2.1 M rows, ~190 k HR/day) that
         // is multi-second, memory-heavy work, and the 15-minute steady-state tick (AppModel) repeats it
         // every tick even when NOTHING new landed — the ongoing lag/crash in #836. A cheap whole-history HR
-        // fingerprint (count+maxTs, indexed, no rows materialized) lets a NON-forced caller short-circuit
-        // when the raw stream is byte-for-byte unchanged since the last successful run. All-or-nothing: it
+        // fingerprint (HR count+maxTs plus indexed row frontiers, no rows materialized) lets a NON-forced
+        // caller short-circuit when the raw streams are unchanged since the last successful run. All-or-nothing: it
         // never produces a PARTIAL pass, so the window-wide reconciliation (stale-day eviction, detected-
         // workout delete) is untouched and no computed history is dropped. Every real update path (sync
         // backfill, import, sleep/workout edit, baseline recalibrate, timestamp heal) calls with the default
         // `force: true` and always rescores, so a skipped tick can never hide new data.
-        // #1392: fingerprint the raw HR stream ACROSS ALL DEVICES, not the engine's construction-time
+        // #1392: fingerprint raw scoring streams ACROSS ALL DEVICES, not the engine's construction-time
         // `deviceId` (a `let` pinned to "my-whoop", never re-pointed when the active strap changes). On an
         // Oura / Apple Watch / re-added-WHOOP install the per-device read returned 0, so this gate never
         // fired and a night finishing after launch stayed unscored until relaunch. Scoring below still reads
         // the registry's ACTIVE device (`owner`); only this change-detector needed to be cross-device.
-        let wmKey: String = (try? await store.hrFingerprint())
-            .map { "\($0.count):\($0.maxTs)" } ?? ""
+        let wmKey = (try? await store.analysisFingerprint()) ?? ""
         // #1538: read the stored watermark ONCE for both gates and the attribution line below. There is no
         // suspension point between them, so the three reads this replaces could not disagree — but the log
         // line asserting `newData` and the gate deciding whether to run must be the SAME comparison by
@@ -565,7 +564,7 @@ final class IntelligenceEngine: ObservableObject {
             return
         }
         // #1196/#1146: a FORCED post-offload pass can opt into the same fingerprint gate. An empty/duplicate
-        // offload (fingerprint already == the watermark the last successful run advanced) has no new HR to
+        // offload (fingerprint already == the watermark the last successful run advanced) has no new raw data to
         // score, so a re-score would reproduce IDENTICAL rows; skip the whole pass rather than churn the
         // window. Over a flapping-link offload storm that churn made the reactive Trends/streak reads
         // flicker between full and empty — a scare that looked like data loss (#1196). Scoped via
@@ -924,7 +923,7 @@ final class IntelligenceEngine: ObservableObject {
                 // returns nil for a ring/import/unknown, so the cache never treats one as a WHOOP (a ring's
                 // `providedSleep` could change a day without an HR move; a WHOOP always streams gravity, so
                 // its `providedSleep` is empty and the reuse is byte-identical). The per-day key folds the
-                // night's HR fingerprint (the SAME witness the whole-pass gate at the top trusts) and, for a
+                // night's HR fingerprint (a narrower per-day witness than the whole-pass raw-input gate) and, for a
                 // 4.0, the window-wide skin anchor (a re-anchor from another night shifts that night's skin
                 // conversion without moving its HR). A 5/MG banks skin-temp centidegrees directly — no
                 // per-device raw anchor — so its anchor slot stays nil. Pass-global inputs (profile/
@@ -2395,8 +2394,8 @@ final class IntelligenceEngine: ObservableObject {
         // Sleep tab stops showing the removed duplicates right away.
         if !dailies.isEmpty || !healDropped.isEmpty { await repo.refresh() }
 
-        // #836: record the raw-HR fingerprint this run scored against, so a later NON-forced tick can
-        // short-circuit while it's unchanged. Written ONLY here at the end of a completed run (never on an
+        // #836/#sleep-sync: record the complete raw-analysis fingerprint this run scored against, so a later
+        // NON-forced tick can short-circuit while it's unchanged. Written ONLY at the end of a completed run (never on an
         // early guard-return), so an interrupted/failed run can't advance the watermark past unscored data.
         if !wmKey.isEmpty { UserDefaults.standard.set(wmKey, forKey: Self.analyzeWatermarkKey) }
         // #1538: clear the started-mark and bank how long a COMPLETED pass costs on this install. The
@@ -2415,9 +2414,9 @@ final class IntelligenceEngine: ObservableObject {
         }
     }
 
-    /// UserDefaults key for the #836 idle-tick gate: the `(count:maxTs)` HR fingerprint the last completed
+    /// UserDefaults key for the #836 idle-tick gate: the complete raw-analysis fingerprint the last completed
     /// `analyzeRecent` scored against. A non-forced tick whose current fingerprint equals this skips the
-    /// 21-day rescore; cleared implicitly by any HR insert/delete (the fingerprint moves), so it self-heals.
+    /// 21-day rescore; cleared implicitly by any scoring-stream insert (the fingerprint moves), so it self-heals.
     private static let analyzeWatermarkKey = "noop.analyzeWatermark"
 
     /// CAPTURE-B (#814/#799): build the universal `dayOwner …` self-diagnostic line VERBATIM (the Test
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 9a9e179f83..32cac8a3b0 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -1,6 +1,30 @@
 {
   "sourceLanguage": "en",
   "strings": {
+    "Calculating last night's sleep…": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Der Schlaf der letzten Nacht wird berechnet…" } }, "en": { "stringUnit": { "state": "translated", "value": "Calculating last night's sleep…" } }, "es": { "stringUnit": { "state": "translated", "value": "Calculando el sueño de anoche…" } }, "fr": { "stringUnit": { "state": "translated", "value": "Calcul du sommeil de la nuit dernière…" } }, "it": { "stringUnit": { "state": "translated", "value": "Calcolo del sonno della scorsa notte…" } }, "pl": { "stringUnit": { "state": "translated", "value": "Obliczanie snu z ostatniej nocy…" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "A calcular o sono da noite passada…" } }, "ru": { "stringUnit": { "state": "translated", "value": "Рассчитываю сон за прошлую ночь…" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "正在计算昨夜睡眠…" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "正在計算昨夜睡眠…" } }
+    } },
+    "Your strap history is in. NOOP is detecting and staging the night now.": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Dein Strap-Verlauf ist da. NOOP erkennt und analysiert die Nacht jetzt." } }, "en": { "stringUnit": { "state": "translated", "value": "Your strap history is in. NOOP is detecting and staging the night now." } }, "es": { "stringUnit": { "state": "translated", "value": "El historial de tu pulsera ya está disponible. NOOP está detectando y analizando la noche." } }, "fr": { "stringUnit": { "state": "translated", "value": "L’historique de votre bracelet est arrivé. NOOP détecte et analyse maintenant la nuit." } }, "it": { "stringUnit": { "state": "translated", "value": "La cronologia della fascia è arrivata. NOOP sta rilevando e analizzando la notte." } }, "pl": { "stringUnit": { "state": "translated", "value": "Historia z opaski jest już dostępna. NOOP wykrywa i analizuje teraz noc." } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "O histórico da bracelete chegou. A NOOP está agora a detetar e analisar a noite." } }, "ru": { "stringUnit": { "state": "translated", "value": "История с браслета загружена. NOOP сейчас определяет и анализирует ночной сон." } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "手环历史数据已到达。NOOP 正在识别并分析这一夜的睡眠。" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "手環歷史資料已到達。NOOP 正在識別並分析這一夜的睡眠。" } }
+    } },
+    "Last night's sleep hasn't synced": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Der Schlaf der letzten Nacht wurde nicht synchronisiert" } }, "en": { "stringUnit": { "state": "translated", "value": "Last night's sleep hasn't synced" } }, "es": { "stringUnit": { "state": "translated", "value": "El sueño de anoche no se ha sincronizado" } }, "fr": { "stringUnit": { "state": "translated", "value": "Le sommeil de la nuit dernière n’a pas été synchronisé" } }, "it": { "stringUnit": { "state": "translated", "value": "Il sonno della scorsa notte non è stato sincronizzato" } }, "pl": { "stringUnit": { "state": "translated", "value": "Sen z ostatniej nocy nie został zsynchronizowany" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "O sono da noite passada não foi sincronizado" } }, "ru": { "stringUnit": { "state": "translated", "value": "Сон за прошлую ночь не синхронизирован" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "昨夜睡眠尚未同步" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "昨夜睡眠尚未同步" } }
+    } },
+    "The history sync stopped before it finished. Keep the strap nearby and try Sync again.": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Die Verlaufssynchronisierung wurde vorzeitig beendet. Halte den Strap in der Nähe und versuche die Synchronisierung erneut." } }, "en": { "stringUnit": { "state": "translated", "value": "The history sync stopped before it finished. Keep the strap nearby and try Sync again." } }, "es": { "stringUnit": { "state": "translated", "value": "La sincronización del historial se detuvo antes de terminar. Mantén la pulsera cerca e inténtalo de nuevo." } }, "fr": { "stringUnit": { "state": "translated", "value": "La synchronisation de l’historique s’est arrêtée avant la fin. Gardez le bracelet à proximité et réessayez." } }, "it": { "stringUnit": { "state": "translated", "value": "La sincronizzazione della cronologia si è interrotta prima di terminare. Tieni la fascia vicina e riprova." } }, "pl": { "stringUnit": { "state": "translated", "value": "Synchronizacja historii zatrzymała się przed ukończeniem. Trzymaj opaskę w pobliżu i spróbuj ponownie." } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "A sincronização do histórico parou antes de terminar. Mantém a bracelete por perto e tenta novamente." } }, "ru": { "stringUnit": { "state": "translated", "value": "Синхронизация истории остановилась до завершения. Держите браслет рядом и повторите попытку." } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "历史同步未完成就停止了。请将手环放在附近并再次尝试同步。" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "歷史同步未完成就停止了。請將手環放在附近並再次嘗試同步。" } }
+    } },
+    "Waiting for last night's sleep": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Warten auf den Schlaf der letzten Nacht" } }, "en": { "stringUnit": { "state": "translated", "value": "Waiting for last night's sleep" } }, "es": { "stringUnit": { "state": "translated", "value": "Esperando el sueño de anoche" } }, "fr": { "stringUnit": { "state": "translated", "value": "En attente du sommeil de la nuit dernière" } }, "it": { "stringUnit": { "state": "translated", "value": "In attesa del sonno della scorsa notte" } }, "pl": { "stringUnit": { "state": "translated", "value": "Oczekiwanie na sen z ostatniej nocy" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "À espera do sono da noite passada" } }, "ru": { "stringUnit": { "state": "translated", "value": "Ожидание сна за прошлую ночь" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "正在等待昨夜睡眠" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "正在等待昨夜睡眠" } }
+    } },
+    "Connect the strap and sync its history. NOOP will calculate the night when the overnight data arrives.": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Verbinde den Strap und synchronisiere seinen Verlauf. NOOP berechnet die Nacht, sobald die Nachtdaten eintreffen." } }, "en": { "stringUnit": { "state": "translated", "value": "Connect the strap and sync its history. NOOP will calculate the night when the overnight data arrives." } }, "es": { "stringUnit": { "state": "translated", "value": "Conecta la pulsera y sincroniza su historial. NOOP calculará la noche cuando lleguen los datos nocturnos." } }, "fr": { "stringUnit": { "state": "translated", "value": "Connectez le bracelet et synchronisez son historique. NOOP calculera la nuit lorsque les données nocturnes arriveront." } }, "it": { "stringUnit": { "state": "translated", "value": "Collega la fascia e sincronizza la cronologia. NOOP calcolerà la notte quando arriveranno i dati notturni." } }, "pl": { "stringUnit": { "state": "translated", "value": "Połącz opaskę i zsynchronizuj jej historię. NOOP obliczy noc po otrzymaniu danych nocnych." } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Liga a bracelete e sincroniza o histórico. A NOOP calculará a noite quando os dados noturnos chegarem." } }, "ru": { "stringUnit": { "state": "translated", "value": "Подключите браслет и синхронизируйте историю. NOOP рассчитает ночь после получения ночных данных." } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "连接手环并同步历史。收到夜间数据后，NOOP 会计算这一夜的睡眠。" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "連接手環並同步歷史。收到夜間資料後，NOOP 會計算這一夜的睡眠。" } }
+    } },
+    "Last night's sleep wasn't detected": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Der Schlaf der letzten Nacht wurde nicht erkannt" } }, "en": { "stringUnit": { "state": "translated", "value": "Last night's sleep wasn't detected" } }, "es": { "stringUnit": { "state": "translated", "value": "No se detectó el sueño de anoche" } }, "fr": { "stringUnit": { "state": "translated", "value": "Le sommeil de la nuit dernière n’a pas été détecté" } }, "it": { "stringUnit": { "state": "translated", "value": "Il sonno della scorsa notte non è stato rilevato" } }, "pl": { "stringUnit": { "state": "translated", "value": "Nie wykryto snu z ostatniej nocy" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "O sono da noite passada não foi detetado" } }, "ru": { "stringUnit": { "state": "translated", "value": "Сон за прошлую ночь не обнаружен" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "未检测到昨夜睡眠" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "未偵測到昨夜睡眠" } }
+    } },
+    "Sync finished, but NOOP couldn't confidently identify a sleep window. Keep the strap connected and try Sync again; the older night below is still your latest detected sleep.": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Die Synchronisierung ist abgeschlossen, aber NOOP konnte kein Schlafzeitfenster sicher erkennen. Lass den Strap verbunden und synchronisiere erneut; die ältere Nacht unten ist weiterhin dein zuletzt erkannter Schlaf." } }, "en": { "stringUnit": { "state": "translated", "value": "Sync finished, but NOOP couldn't confidently identify a sleep window. Keep the strap connected and try Sync again; the older night below is still your latest detected sleep." } }, "es": { "stringUnit": { "state": "translated", "value": "La sincronización terminó, pero NOOP no pudo identificar con confianza un periodo de sueño. Mantén la pulsera conectada y vuelve a sincronizar; la noche anterior que aparece abajo sigue siendo tu último sueño detectado." } }, "fr": { "stringUnit": { "state": "translated", "value": "La synchronisation est terminée, mais NOOP n’a pas pu identifier avec certitude une période de sommeil. Gardez le bracelet connecté et relancez la synchronisation ; la nuit plus ancienne ci-dessous reste votre dernier sommeil détecté." } }, "it": { "stringUnit": { "state": "translated", "value": "La sincronizzazione è terminata, ma NOOP non ha identificato con certezza un intervallo di sonno. Tieni la fascia collegata e sincronizza di nuovo; la notte precedente qui sotto resta l’ultimo sonno rilevato." } }, "pl": { "stringUnit": { "state": "translated", "value": "Synchronizacja zakończyła się, ale NOOP nie zdołał wiarygodnie określić okna snu. Pozostaw opaskę połączoną i zsynchronizuj ponownie; starsza noc poniżej nadal jest ostatnim wykrytym snem." } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "A sincronização terminou, mas a NOOP não conseguiu identificar com confiança um período de sono. Mantém a bracelete ligada e sincroniza novamente; a noite anterior abaixo continua a ser o teu último sono detetado." } }, "ru": { "stringUnit": { "state": "translated", "value": "Синхронизация завершена, но NOOP не смог уверенно определить окно сна. Оставьте браслет подключённым и повторите синхронизацию; более ранняя ночь ниже остаётся последним обнаруженным сном." } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "同步已完成，但 NOOP 无法可靠识别睡眠时段。请保持手环连接并再次同步；下方较早的一夜仍是最近一次检测到的睡眠。" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "同步已完成，但 NOOP 無法可靠識別睡眠時段。請保持手環連接並再次同步；下方較早的一夜仍是最近一次偵測到的睡眠。" } }
+    } },
     "RHR +%lld": { "localizations": {
       "de": { "stringUnit": { "state": "translated", "value": "Ruhepuls +%lld" } }, "en": { "stringUnit": { "state": "translated", "value": "RHR +%lld" } }, "es": { "stringUnit": { "state": "translated", "value": "FC en reposo +%lld" } }, "fr": { "stringUnit": { "state": "translated", "value": "FC au repos +%lld" } }, "it": { "stringUnit": { "state": "translated", "value": "FC a riposo +%lld" } }, "pl": { "stringUnit": { "state": "translated", "value": "Tętno spocz. +%lld" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "FC em repouso +%lld" } }, "ru": { "stringUnit": { "state": "translated", "value": "Пульс в покое +%lld" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "静息心率 +%lld" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "靜息心率 +%lld" } }
     } },
diff --git a/Strand/Screens/SleepView.swift b/Strand/Screens/SleepView.swift
index 3fbbab98b1..715a909249 100644
--- a/Strand/Screens/SleepView.swift
+++ b/Strand/Screens/SleepView.swift
@@ -154,6 +154,7 @@ struct SleepView: View {
                     // Each top-level section fades + rises in sequence on first appear (Reduce-Motion safe).
                     VStack(alignment: .leading, spacing: NoopMetrics.sectionSpacing) {
                         if let sleepUndo { sleepUndoBanner(sleepUndo) }
+                        SleepFreshnessNote(latestWakeTs: resolved.night.session.endTs)
                         // Bleed past ScreenScaffold's 16/24 gutters so the hero column is edge-to-edge
                         // in the upper band; the night scene itself is the fixed topBackground.
                         // Customize sits at the end of the hero (not floating in a blank band).
@@ -2002,10 +2003,7 @@ struct SleepView: View {
 
     @ViewBuilder
     private var emptyState: some View {
-        // While the strap is mid-offload, say so — "No nights" reads as final otherwise (#77). The note
-        // owns the `LiveState` observation in its own leaf so the chunk count ticks without re-rendering
-        // SleepView (scroll-stutter isolation; identical output to the prior inline check).
-        SleepSyncingNote()
+        SleepFreshnessNote(latestWakeTs: nil)
         if repo.loaded {
             ComingSoon(what: "No nights here yet. Import your WHOOP export in Data Sources to see every night, your sleep stages and trends straight away. Or open Intelligence to see last night computed from the strap after you wear it to bed.")
         } else {
@@ -2508,10 +2506,72 @@ struct SleepMarkCard: View {
 
 /// The "Syncing strap history…" note, shown only while a historical offload is running (#77). Owns the
 /// `LiveState` observation so the chunk count ticks without re-rendering the rest of the Sleep screen.
-private struct SleepSyncingNote: View {
+enum SleepFreshnessStatus: Equatable {
+    case syncing, calculating, syncFailed, awaitingSync, notDetected
+}
+
+/// Pure priority ladder behind the Sleep status banner. "Missing" is deliberately held until morning so
+/// opening Sleep during the night does not claim a still-in-progress night was missed.
+func resolveSleepFreshness(hasCurrentNight: Bool, morningReady: Bool, syncing: Bool,
+                           calculating: Bool, syncedSinceDayStart: Bool,
+                           syncFailed: Bool) -> SleepFreshnessStatus? {
+    if syncing { return .syncing }
+    if calculating { return .calculating }
+    if hasCurrentNight || !morningReady { return nil }
+    if syncFailed { return .syncFailed }
+    return syncedSinceDayStart ? .notDetected : .awaitingSync
+}
+
+/// Explicit state for the expected current night. Older sleep can remain available underneath, but it is
+/// never left to impersonate today's result while a sync, calculation, or failed detection is unresolved.
+private struct SleepFreshnessNote: View {
     @EnvironmentObject private var live: LiveState
+    @EnvironmentObject private var intelligence: IntelligenceEngine
+    let latestWakeTs: Int?
+
     var body: some View {
-        if live.backfilling { SyncingHistoryNote(chunks: live.syncChunksThisSession) }
+        let calendar = Calendar.current
+        let now = Date()
+        let start = calendar.startOfDay(for: now)
+        let current = latestWakeTs.map {
+            calendar.isDate(Date(timeIntervalSince1970: TimeInterval($0)), inSameDayAs: now)
+        } ?? false
+        // AppModel intentionally waits two quiet seconds after HISTORY_COMPLETE before starting the
+        // scoring pass. Treat that debounce as calculation too; otherwise the banner can flash the final
+        // "wasn't detected" verdict between sync completion and `intelligence.computing` becoming true.
+        let calculationQueued = live.lastSyncedAt.map {
+            (0..<5).contains(now.timeIntervalSince1970 - $0)
+        } ?? false
+        let status = resolveSleepFreshness(
+            hasCurrentNight: current,
+            morningReady: calendar.component(.hour, from: now) >= 6,
+            syncing: live.backfilling,
+            calculating: intelligence.computing || calculationQueued,
+            syncedSinceDayStart: (live.lastSyncedAt ?? 0) >= start.timeIntervalSince1970,
+            syncFailed: live.lastSyncError != nil
+        )
+        switch status {
+        case .syncing:
+            SyncingHistoryNote(chunks: live.syncChunksThisSession)
+        case .calculating:
+            DataPendingNote(title: "Calculating last night's sleep…",
+                            message: "Your strap history is in. NOOP is detecting and staging the night now.",
+                            symbol: "waveform.path.ecg")
+        case .syncFailed:
+            DataPendingNote(title: "Last night's sleep hasn't synced",
+                            message: "The history sync stopped before it finished. Keep the strap nearby and try Sync again.",
+                            symbol: "exclamationmark.arrow.triangle.2.circlepath")
+        case .awaitingSync:
+            DataPendingNote(title: "Waiting for last night's sleep",
+                            message: "Connect the strap and sync its history. NOOP will calculate the night when the overnight data arrives.",
+                            symbol: "arrow.triangle.2.circlepath")
+        case .notDetected:
+            DataPendingNote(title: "Last night's sleep wasn't detected",
+                            message: "Sync finished, but NOOP couldn't confidently identify a sleep window. Keep the strap connected and try Sync again; the older night below is still your latest detected sleep.",
+                            symbol: "moon.zzz")
+        case nil:
+            EmptyView()
+        }
     }
 }
 
diff --git a/StrandTests/SleepPhantomNightFallbackTests.swift b/StrandTests/SleepPhantomNightFallbackTests.swift
index 7d0388e1b3..fd0b0a45e5 100644
--- a/StrandTests/SleepPhantomNightFallbackTests.swift
+++ b/StrandTests/SleepPhantomNightFallbackTests.swift
@@ -77,4 +77,29 @@ final class SleepPhantomNightFallbackTests: XCTestCase {
         XCTAssertNil(SleepEditGuard.clampedEditWindow(start: phantomWindow.0, end: phantomWindow.1,
                                                       now: Int(d(2, 5, 3).timeIntervalSince1970)))
     }
+
+    // Missing-night honesty: the newest stored night may stay visible, but the status above it must say
+    // whether today's night is still moving through sync/analysis or finished without a detection.
+    func testFreshnessProgressStatesWinOverStaleHistory() {
+        XCTAssertEqual(resolveSleepFreshness(hasCurrentNight: false, morningReady: true, syncing: true,
+                                              calculating: true, syncedSinceDayStart: false, syncFailed: true), .syncing)
+        XCTAssertEqual(resolveSleepFreshness(hasCurrentNight: false, morningReady: true, syncing: false,
+                                              calculating: true, syncedSinceDayStart: true, syncFailed: true), .calculating)
+    }
+
+    func testFreshnessDoesNotDeclareMissingBeforeMorningOrForCurrentNight() {
+        XCTAssertNil(resolveSleepFreshness(hasCurrentNight: false, morningReady: false, syncing: false,
+                                           calculating: false, syncedSinceDayStart: true, syncFailed: false))
+        XCTAssertNil(resolveSleepFreshness(hasCurrentNight: true, morningReady: true, syncing: false,
+                                           calculating: false, syncedSinceDayStart: true, syncFailed: false))
+    }
+
+    func testFreshnessDistinguishesFinishedFailedAndWaiting() {
+        XCTAssertEqual(resolveSleepFreshness(hasCurrentNight: false, morningReady: true, syncing: false,
+                                              calculating: false, syncedSinceDayStart: true, syncFailed: false), .notDetected)
+        XCTAssertEqual(resolveSleepFreshness(hasCurrentNight: false, morningReady: true, syncing: false,
+                                              calculating: false, syncedSinceDayStart: false, syncFailed: true), .syncFailed)
+        XCTAssertEqual(resolveSleepFreshness(hasCurrentNight: false, morningReady: true, syncing: false,
+                                              calculating: false, syncedSinceDayStart: false, syncFailed: false), .awaitingSync)
+    }
 }
diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 5cfca67731..40abc73020 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -298,6 +298,7 @@ dependencies {
     testImplementation("org.jetbrains.kotlinx:kotlinx-coroutines-test:1.8.1")
     testImplementation("org.json:json:20240303") // real org.json for JVM unit tests (android.jar ships throwing stubs)
     testImplementation("net.sf.kxml:kxml2:2.3.0") // real XmlPullParser for JVM tests (android.util.Xml is a throwing stub)
+    testImplementation("org.xerial:sqlite-jdbc:3.41.2.2") // execute DAO aggregate SQL in plain-JVM tests
     androidTestImplementation("androidx.test.ext:junit:1.1.5")
     androidTestImplementation("androidx.test.espresso:espresso-core:3.5.1")
     androidTestImplementation("androidx.compose.ui:ui-test-junit4")
diff --git a/android/app/gradle.lockfile b/android/app/gradle.lockfile
index ef15d72d51..b60ae7c042 100644
--- a/android/app/gradle.lockfile
+++ b/android/app/gradle.lockfile
@@ -283,5 +283,5 @@ org.json:json:20240303=demoDebugUnitTestCompileClasspath,demoDebugUnitTestRuntim
 org.ow2.asm:asm-commons:9.7=demoDebugUnitTestCompileClasspath,demoDebugUnitTestRuntimeClasspath,demoReleaseUnitTestCompileClasspath,demoReleaseUnitTestRuntimeClasspath,fullDebugUnitTestCompileClasspath,fullDebugUnitTestRuntimeClasspath,fullReleaseUnitTestCompileClasspath,fullReleaseUnitTestRuntimeClasspath,testImplementationDependenciesMetadata
 org.ow2.asm:asm-tree:9.7=demoDebugUnitTestCompileClasspath,demoDebugUnitTestRuntimeClasspath,demoReleaseUnitTestCompileClasspath,demoReleaseUnitTestRuntimeClasspath,fullDebugUnitTestCompileClasspath,fullDebugUnitTestRuntimeClasspath,fullReleaseUnitTestCompileClasspath,fullReleaseUnitTestRuntimeClasspath,testImplementationDependenciesMetadata
 org.ow2.asm:asm:9.7=demoDebugUnitTestCompileClasspath,demoDebugUnitTestRuntimeClasspath,demoReleaseUnitTestCompileClasspath,demoReleaseUnitTestRuntimeClasspath,fullDebugUnitTestCompileClasspath,fullDebugUnitTestRuntimeClasspath,fullReleaseUnitTestCompileClasspath,fullReleaseUnitTestRuntimeClasspath,testImplementationDependenciesMetadata
-org.xerial:sqlite-jdbc:3.41.2.2=_agp_internal_javaPreCompileDemoDebug_kspClasspath,_agp_internal_javaPreCompileDemoRelease_kspClasspath,_agp_internal_javaPreCompileFullDebug_kspClasspath,_agp_internal_javaPreCompileFullRelease_kspClasspath,kspDemoDebugAndroidTestKotlinProcessorClasspath,kspDemoDebugKotlinProcessorClasspath,kspDemoDebugUnitTestKotlinProcessorClasspath,kspDemoReleaseKotlinProcessorClasspath,kspDemoReleaseUnitTestKotlinProcessorClasspath,kspFullDebugAndroidTestKotlinProcessorClasspath,kspFullDebugKotlinProcessorClasspath,kspFullDebugUnitTestKotlinProcessorClasspath,kspFullReleaseKotlinProcessorClasspath,kspFullReleaseUnitTestKotlinProcessorClasspath
+org.xerial:sqlite-jdbc:3.41.2.2=_agp_internal_javaPreCompileDemoDebug_kspClasspath,_agp_internal_javaPreCompileDemoRelease_kspClasspath,_agp_internal_javaPreCompileFullDebug_kspClasspath,_agp_internal_javaPreCompileFullRelease_kspClasspath,fullDebugUnitTestCompileClasspath,fullDebugUnitTestRuntimeClasspath,kspDemoDebugAndroidTestKotlinProcessorClasspath,kspDemoDebugKotlinProcessorClasspath,kspDemoDebugUnitTestKotlinProcessorClasspath,kspDemoReleaseKotlinProcessorClasspath,kspDemoReleaseUnitTestKotlinProcessorClasspath,kspFullDebugAndroidTestKotlinProcessorClasspath,kspFullDebugKotlinProcessorClasspath,kspFullDebugUnitTestKotlinProcessorClasspath,kspFullReleaseKotlinProcessorClasspath,kspFullReleaseUnitTestKotlinProcessorClasspath
 empty=_agp_internal_javaPreCompileDemoDebugAndroidTest_kspClasspath,_agp_internal_javaPreCompileDemoDebugUnitTest_kspClasspath,_agp_internal_javaPreCompileDemoReleaseUnitTest_kspClasspath,_agp_internal_javaPreCompileFullDebugAndroidTest_kspClasspath,_agp_internal_javaPreCompileFullDebugUnitTest_kspClasspath,_agp_internal_javaPreCompileFullReleaseUnitTest_kspClasspath,androidApis,androidJdkImage,androidTestApiDependenciesMetadata,androidTestCompileOnlyDependenciesMetadata,androidTestDebugApiDependenciesMetadata,androidTestDebugCompileOnlyDependenciesMetadata,androidTestDebugImplementationDependenciesMetadata,androidTestDebugIntransitiveDependenciesMetadata,androidTestDemoApiDependenciesMetadata,androidTestDemoCompileOnlyDependenciesMetadata,androidTestDemoDebugApiDependenciesMetadata,androidTestDemoDebugCompileOnlyDependenciesMetadata,androidTestDemoDebugImplementationDependenciesMetadata,androidTestDemoDebugIntransitiveDependenciesMetadata,androidTestDemoImplementationDependenciesMetadata,androidTestDemoIntransitiveDependenciesMetadata,androidTestFullApiDependenciesMetadata,androidTestFullCompileOnlyDependenciesMetadata,androidTestFullDebugApiDependenciesMetadata,androidTestFullDebugCompileOnlyDependenciesMetadata,androidTestFullDebugImplementationDependenciesMetadata,androidTestFullDebugIntransitiveDependenciesMetadata,androidTestFullImplementationDependenciesMetadata,androidTestFullIntransitiveDependenciesMetadata,androidTestIntransitiveDependenciesMetadata,androidTestReleaseApiDependenciesMetadata,androidTestReleaseCompileOnlyDependenciesMetadata,androidTestReleaseImplementationDependenciesMetadata,androidTestReleaseIntransitiveDependenciesMetadata,androidTestUtil,compileOnlyDependenciesMetadata,coreLibraryDesugaring,debugApiDependenciesMetadata,debugCompileOnlyDependenciesMetadata,debugIntransitiveDependenciesMetadata,demoApiDependenciesMetadata,demoCompileOnlyDependenciesMetadata,demoDebugAndroidTestAnnotationProcessorClasspath,demoDebugAndroidTestApiDependenciesMetadata,demoDebugAndroidTestCompileOnlyDependenciesMetadata,demoDebugAndroidTestImplementationDependenciesMetadata,demoDebugAndroidTestIntransitiveDependenciesMetadata,demoDebugAnnotationProcessorClasspath,demoDebugApiDependenciesMetadata,demoDebugCompileOnlyDependenciesMetadata,demoDebugImplementationDependenciesMetadata,demoDebugIntransitiveDependenciesMetadata,demoDebugReverseMetadataValues,demoDebugUnitTestAnnotationProcessorClasspath,demoDebugUnitTestApiDependenciesMetadata,demoDebugUnitTestCompileOnlyDependenciesMetadata,demoDebugUnitTestImplementationDependenciesMetadata,demoDebugUnitTestIntransitiveDependenciesMetadata,demoDebugWearBundling,demoImplementationDependenciesMetadata,demoIntransitiveDependenciesMetadata,demoReleaseAnnotationProcessorClasspath,demoReleaseApiDependenciesMetadata,demoReleaseCompileOnlyDependenciesMetadata,demoReleaseImplementationDependenciesMetadata,demoReleaseIntransitiveDependenciesMetadata,demoReleaseReverseMetadataValues,demoReleaseUnitTestAnnotationProcessorClasspath,demoReleaseUnitTestApiDependenciesMetadata,demoReleaseUnitTestCompileOnlyDependenciesMetadata,demoReleaseUnitTestImplementationDependenciesMetadata,demoReleaseUnitTestIntransitiveDependenciesMetadata,demoReleaseWearBundling,fullApiDependenciesMetadata,fullCompileOnlyDependenciesMetadata,fullDebugAndroidTestAnnotationProcessorClasspath,fullDebugAndroidTestApiDependenciesMetadata,fullDebugAndroidTestCompileOnlyDependenciesMetadata,fullDebugAndroidTestImplementationDependenciesMetadata,fullDebugAndroidTestIntransitiveDependenciesMetadata,fullDebugAnnotationProcessorClasspath,fullDebugApiDependenciesMetadata,fullDebugCompileOnlyDependenciesMetadata,fullDebugImplementationDependenciesMetadata,fullDebugIntransitiveDependenciesMetadata,fullDebugReverseMetadataValues,fullDebugUnitTestAnnotationProcessorClasspath,fullDebugUnitTestApiDependenciesMetadata,fullDebugUnitTestCompileOnlyDependenciesMetadata,fullDebugUnitTestImplementationDependenciesMetadata,fullDebugUnitTestIntransitiveDependenciesMetadata,fullDebugWearBundling,fullImplementationDependenciesMetadata,fullIntransitiveDependenciesMetadata,fullReleaseAnnotationProcessorClasspath,fullReleaseApiDependenciesMetadata,fullReleaseCompileOnlyDependenciesMetadata,fullReleaseImplementationDependenciesMetadata,fullReleaseIntransitiveDependenciesMetadata,fullReleaseReverseMetadataValues,fullReleaseUnitTestAnnotationProcessorClasspath,fullReleaseUnitTestApiDependenciesMetadata,fullReleaseUnitTestCompileOnlyDependenciesMetadata,fullReleaseUnitTestImplementationDependenciesMetadata,fullReleaseUnitTestIntransitiveDependenciesMetadata,fullReleaseWearBundling,intransitiveDependenciesMetadata,kotlinCompilerPluginClasspath,kotlinNativeCompilerPluginClasspath,lintChecks,lintPublish,releaseApiDependenciesMetadata,releaseCompileOnlyDependenciesMetadata,releaseImplementationDependenciesMetadata,releaseIntransitiveDependenciesMetadata,testApiDependenciesMetadata,testCompileOnlyDependenciesMetadata,testDebugApiDependenciesMetadata,testDebugCompileOnlyDependenciesMetadata,testDebugImplementationDependenciesMetadata,testDebugIntransitiveDependenciesMetadata,testDemoApiDependenciesMetadata,testDemoCompileOnlyDependenciesMetadata,testDemoDebugApiDependenciesMetadata,testDemoDebugCompileOnlyDependenciesMetadata,testDemoDebugImplementationDependenciesMetadata,testDemoDebugIntransitiveDependenciesMetadata,testDemoImplementationDependenciesMetadata,testDemoIntransitiveDependenciesMetadata,testDemoReleaseApiDependenciesMetadata,testDemoReleaseCompileOnlyDependenciesMetadata,testDemoReleaseImplementationDependenciesMetadata,testDemoReleaseIntransitiveDependenciesMetadata,testFixturesApiDependenciesMetadata,testFixturesCompileOnlyDependenciesMetadata,testFixturesDebugApiDependenciesMetadata,testFixturesDebugCompileOnlyDependenciesMetadata,testFixturesDebugImplementationDependenciesMetadata,testFixturesDebugIntransitiveDependenciesMetadata,testFixturesDemoApiDependenciesMetadata,testFixturesDemoCompileOnlyDependenciesMetadata,testFixturesDemoImplementationDependenciesMetadata,testFixturesDemoIntransitiveDependenciesMetadata,testFixturesFullApiDependenciesMetadata,testFixturesFullCompileOnlyDependenciesMetadata,testFixturesFullImplementationDependenciesMetadata,testFixturesFullIntransitiveDependenciesMetadata,testFixturesImplementationDependenciesMetadata,testFixturesIntransitiveDependenciesMetadata,testFixturesReleaseApiDependenciesMetadata,testFixturesReleaseCompileOnlyDependenciesMetadata,testFixturesReleaseImplementationDependenciesMetadata,testFixturesReleaseIntransitiveDependenciesMetadata,testFullApiDependenciesMetadata,testFullCompileOnlyDependenciesMetadata,testFullDebugApiDependenciesMetadata,testFullDebugCompileOnlyDependenciesMetadata,testFullDebugImplementationDependenciesMetadata,testFullDebugIntransitiveDependenciesMetadata,testFullImplementationDependenciesMetadata,testFullIntransitiveDependenciesMetadata,testFullReleaseApiDependenciesMetadata,testFullReleaseCompileOnlyDependenciesMetadata,testFullReleaseImplementationDependenciesMetadata,testFullReleaseIntransitiveDependenciesMetadata,testIntransitiveDependenciesMetadata,testReleaseApiDependenciesMetadata,testReleaseCompileOnlyDependenciesMetadata,testReleaseImplementationDependenciesMetadata,testReleaseIntransitiveDependenciesMetadata
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 2133f191e6..2f5a880319 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -187,6 +187,9 @@ data class LiveState(
     /** True while a historical offload session is running, so screens can say "Syncing strap
      *  history…" instead of presenting half-loaded data as final (#77). */
     val backfilling: Boolean = false,
+    /** True while a post-history scoring pass is turning the newly stored raw streams into sleep and
+     * daily metrics. Kept separate from [backfilling] so Sleep can distinguish downloading from calculating. */
+    val analyzingHistory: Boolean = false,
     /** Chunks acked during the current offload session — an honest progress signal (total pending is
      *  unknowable from the protocol, so no percent). Republished every ~10 chunks: the foreground
      *  service re-posts its notification on EVERY LiveState emission, so per-chunk would spam it. */
@@ -2682,7 +2685,20 @@ class WhoopBleClient(
     @Suppress("UNUSED_PARAMETER")
     private fun onBackfillChunkCommitted(batch: StreamBatch) {
         decodedChunksThisSession += 1   // invoked once per non-empty decoded chunk (#77 family tally)
-        if (!analyzeAfterBackfillScheduled.compareAndSet(false, true)) return
+        schedulePostBackfillAnalysis()
+    }
+
+    private fun schedulePostBackfillAnalysis() {
+        if (!analyzeAfterBackfillScheduled.compareAndSet(false, true)) {
+            // A later chunk arrived while the debounce or scoring pass was already active. Remember it:
+            // sleep-critical gravity commonly trails HR, and dropping this signal is how a partial first
+            // pass could become the final answer until the 15-minute backstop.
+            analyzeAfterBackfillPending.set(true)
+            return
+        }
+        // The debounce is part of the calculation lifecycle. Publish this before waiting so Sleep never
+        // flashes a final "not detected" verdict between HISTORY_COMPLETE and the scoring pass starting.
+        _state.update { it.copy(analyzingHistory = true) }
         ioScope.launch {
             try {
                 delay(POST_BACKFILL_ANALYZE_DELAY_MS) // let trailing chunks of the same session land
@@ -2693,17 +2709,17 @@ class WhoopBleClient(
                 val profile = profileStore.toUserProfile()
                 // #836: the post-backfill pass is a real update path, so it ALWAYS re-scores (mirroring the
                 // Swift `analyzeRecent(force: true)` call `refreshAfterCompletedBackfill` makes) — but it must
-                // ADVANCE the shared HR-fingerprint watermark on success, which it previously did NOT. That
+                // ADVANCE the shared raw-analysis watermark on success, which it previously did NOT. That
                 // watermark logic lived only in AppViewModel's 15-min loop, so after this pass the very next
                 // idle tick saw `fp != watermark` and re-ran the IDENTICAL maxDays×~54h re-score — the
                 // double-charge that made every reconnect pay for the multi-day pass twice. Swift already
                 // advances the watermark at the end of EVERY successful analyzeRecent (IntelligenceEngine.swift);
                 // this brings Android into lockstep. Captured before the run, written only on success, so an
                 // interrupted/failed pass can never advance the watermark past unscored data.
-                val analyzeFp = repository.hrFingerprint()
+                val analyzeFp = repository.analysisFingerprint()
                 // Attribute this forced post-offload re-score. A completed offload ALWAYS re-scores (#836),
                 // so an EMPTY/duplicate offload (rows=0, common on a flapping link) still pays for a full
-                // ~18-day pass over the whole raw store (#1146). Compare the pre-run HR fingerprint
+                // ~18-day pass over the whole raw store (#1146). Compare the pre-run raw-input fingerprint
                 // (rowCount:maxTs) to the watermark the last successful run advanced: `newData=no` means
                 // nothing changed since the last run — a re-score driven purely by the reconnect+offload, not
                 // by data. These lines quantify the background battery cost (#1005). Log-only; behaviour is
@@ -2714,7 +2730,7 @@ class WhoopBleClient(
                 // flapping-link offload storm (~186 passes in 7.5h were measured) that churn made the
                 // reactive Trends/streak Flows flicker between full and empty — a scare that looked like
                 // data loss (#1196). Scoped to THIS post-offload trigger only: import/edit/settings/
-                // recalibrate re-scores force regardless of the HR fingerprint and are untouched. Twin of
+                // recalibrate re-scores force regardless of the raw-input fingerprint and are untouched. Twin of
                 // the Swift `analyzeRecent(skipIfUnchanged:)` gate at the refreshAfterCompletedBackfill site.
                 val newData = analyzeFp != NoopPrefs.analyzeWatermark(context)
                 log("re-score: trigger=post-offload newData=" +
@@ -2842,7 +2858,17 @@ class WhoopBleClient(
                         .onSuccess { r -> log("HC writeback: ${r.written} record(s)" + if (r.ok) "" else " (failed: ${r.failures.joinToString()})") }
                 }
             } finally {
+                val retryAlreadyQueued = analyzeAfterBackfillPending.getAndSet(false)
+                if (!retryAlreadyQueued) _state.update { it.copy(analyzingHistory = false) }
                 analyzeAfterBackfillScheduled.set(false)
+                // If anything landed after this pass was scheduled, run once more after the same quiet
+                // grace. The complete analysis fingerprint makes a duplicate retry cheap, while a trailing
+                // gravity/RR/sleep-state chunk now gets the decisive sleep-detection pass immediately.
+                // Check pending again after releasing the scheduled latch so a chunk racing this finally
+                // block cannot strand its retry signal.
+                if (retryAlreadyQueued || analyzeAfterBackfillPending.getAndSet(false)) {
+                    schedulePostBackfillAnalysis()
+                }
             }
         }
     }
@@ -2961,6 +2987,7 @@ class WhoopBleClient(
     private var whoop5HistoryAttempts = 0
     /** One-shot debounce: a post-backfill scoring pass is already scheduled/running. */
     private val analyzeAfterBackfillScheduled = java.util.concurrent.atomic.AtomicBoolean(false)
+    private val analyzeAfterBackfillPending = java.util.concurrent.atomic.AtomicBoolean(false)
 
     /** Guards the once-per-connect initial offload kick (Swift `backfillStarted`). */
     private var backfillStarted = false
diff --git a/android/app/src/main/java/com/noop/data/WhoopDao.kt b/android/app/src/main/java/com/noop/data/WhoopDao.kt
index 6579a8634b..7e9a8c2937 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDao.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDao.kt
@@ -8,6 +8,21 @@ import androidx.room.Transaction
 import androidx.room.Upsert
 import kotlinx.coroutines.flow.Flow
 
+/** Kept as one compile-time constant so Room and the plain-JVM SQLite regression test execute the exact
+ * same statement. Swift's twin lives in WhoopStore.analysisFingerprint(). */
+internal const val ANALYSIS_FINGERPRINT_SQL =
+    "SELECT 'v2|' || " +
+        "'h' || (SELECT COUNT(*) FROM hrSample) || ':' || (SELECT COALESCE(MAX(ts), 0) FROM hrSample) || '|' || " +
+        "'p' || (SELECT COALESCE(MAX(rowid), 0) FROM ppgHrSample) || '|' || " +
+        "'r' || (SELECT COALESCE(MAX(rowid), 0) FROM rrInterval) || '|' || " +
+        "'x' || (SELECT COALESCE(MAX(rowid), 0) FROM respSample) || '|' || " +
+        "'g' || (SELECT COALESCE(MAX(rowid), 0) FROM gravitySample) || '|' || " +
+        "'s' || (SELECT COALESCE(MAX(rowid), 0) FROM sleepStateSample) || '|' || " +
+        "'e' || (SELECT COALESCE(MAX(rowid), 0) FROM event) || '|' || " +
+        "'o' || (SELECT COALESCE(MAX(rowid), 0) FROM spo2Sample) || '|' || " +
+        "'t' || (SELECT COALESCE(MAX(rowid), 0) FROM skinTempSample) || '|' || " +
+        "'z' || (SELECT COALESCE(MAX(rowid), 0) FROM stepSample)"
+
 /**
  * Data-access for the local store. Mirrors the GRDB reads/writes in WhoopStore
  * (StreamStore.swift, Reads.swift, MetricsCache.swift).
@@ -921,6 +936,10 @@ interface WhoopDao : DeviceRegistryDao {
     // #836: max raw-HR timestamp across all devices. Paired with countHr() as a cheap whole-history change
     // fingerprint so the 15-min idle rescore can skip when nothing new has landed (COALESCE → 0 when empty).
     @Query("SELECT COALESCE(MAX(ts), 0) FROM hrSample") suspend fun maxHrTs(): Long
+    /** Complete raw-analysis fingerprint. A sleep offload can add gravity/RR after HR, so the whole-pass
+     * gate must move when any scoring input changes, not only when measured HR changes. */
+    @Query(ANALYSIS_FINGERPRINT_SQL)
+    suspend fun analysisFingerprint(): String
     // #1005: per-day (device + window) HR fingerprint — row count + newest ts — for analyzeRecent's per-day
     // reuse cache. Cheap COUNT/MAX aggregate over the (deviceId, ts) index, never a row fetch; mirrors Swift
     // WhoopStore.hrFingerprint(deviceId:from:to:). COALESCE(MAX) → 0 for an empty window.
diff --git a/android/app/src/main/java/com/noop/data/WhoopRepository.kt b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
index d139591ffb..27511521a5 100644
--- a/android/app/src/main/java/com/noop/data/WhoopRepository.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
@@ -602,6 +602,10 @@ class WhoopRepository(
      *  moves it (count or maxTs), so a real change always rescores; mirrors Swift WhoopStore.hrFingerprint. */
     suspend fun hrFingerprint(): String = "${dao.countHr()}:${dao.maxHrTs()}"
 
+    /** Complete cross-device scoring-input change detector. Unlike [hrFingerprint], this also moves when
+     * a trailing sleep-critical stream (especially gravity) lands after HR in the same history sync. */
+    suspend fun analysisFingerprint(): String = dao.analysisFingerprint()
+
     /** #1005 — per-day (device + window) HR fingerprint as (count, newestTs) for analyzeRecent's per-day
      *  reuse cache. Cheap COUNT/MAX aggregate, never a row fetch; mirrors Swift
      *  WhoopStore.hrFingerprint(deviceId:from:to:). */
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index fd51daca61..9cdb443016 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -1026,10 +1026,10 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
                 }.onFailure { if (it is kotlin.coroutines.cancellation.CancellationException) throw it }
                 // #836 parity (Android): the 15-min tick is a backstop, not a data-driven refresh. Every real
                 // update (sync, import, edit, recalibrate, the #547 heal above) rescores via its own path and
-                // moves the raw-HR fingerprint, so skip the heavy 21-day rescore when the HR stream is unchanged
+                // moves the complete raw-input fingerprint, so skip the heavy 21-day rescore when every scoring stream is unchanged
                 // since the last COMPLETED run. Mirrors the Swift analyzeRecent(force:false) gate; the watermark
                 // advances only on success (below), so an interrupted run can never hide unscored data.
-                val analyzeFp = repository.hrFingerprint()
+                val analyzeFp = repository.analysisFingerprint()
                 // #1538: attribute the tick that is about to run. An idle-tick pass previously emitted NO
                 // trigger line at all — a "re-score: done" with nothing before it — so a strap log could not
                 // be read by pairing trigger->done, and a stalled background pass was easy to misattribute to
diff --git a/android/app/src/main/java/com/noop/ui/MainActivity.kt b/android/app/src/main/java/com/noop/ui/MainActivity.kt
index 4b37e65c8e..3fa2f0ad37 100644
--- a/android/app/src/main/java/com/noop/ui/MainActivity.kt
+++ b/android/app/src/main/java/com/noop/ui/MainActivity.kt
@@ -468,9 +468,9 @@ object NoopPrefs {
         of(context).edit().putBoolean(KEY_FAST_LINK_PHY, enabled).apply()
     }
 
-    /** #836, the raw-HR fingerprint ("count:maxTs") the last COMPLETED idle rescore scored against. The
-     *  15-min backstop tick skips when the current fingerprint equals this; cleared implicitly by any HR
-     *  insert/delete (the fingerprint moves). Mirrors the Swift `analyzeWatermark` UserDefaults key. */
+    /** #836, the complete raw-analysis fingerprint the last COMPLETED idle rescore scored against. The
+     *  15-min backstop tick skips when the current fingerprint equals this; any new scoring-stream row
+     *  moves it. Mirrors the Swift `analyzeWatermark` UserDefaults key. */
     fun analyzeWatermark(context: Context): String? =
         of(context).getString(KEY_ANALYZE_WATERMARK, null)
 
diff --git a/android/app/src/main/java/com/noop/ui/SleepScreen.kt b/android/app/src/main/java/com/noop/ui/SleepScreen.kt
index 6bd3b5ce94..1ffc1ae979 100644
--- a/android/app/src/main/java/com/noop/ui/SleepScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepScreen.kt
@@ -81,6 +81,8 @@ import com.noop.data.SleepSession
 import com.noop.data.WhoopRepository
 import kotlinx.coroutines.launch
 import java.time.LocalDate
+import java.time.Instant
+import java.time.ZoneId
 import java.text.SimpleDateFormat
 import java.util.Calendar
 import java.util.Date
@@ -90,6 +92,59 @@ import kotlin.math.roundToInt
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.setValue
 
+internal enum class SleepFreshnessStatus {
+    SYNCING, CALCULATING, SYNC_FAILED, AWAITING_SYNC, NOT_DETECTED,
+}
+
+private data class SleepFreshnessLiveSnapshot(
+    val backfilling: Boolean,
+    val analyzing: Boolean,
+    val lastSyncAt: Long?,
+    val syncFailed: Boolean,
+)
+
+/** Pure priority ladder for the expected current night. The missing states wait until morning so opening
+ * Sleep at 02:00 does not claim the night still in progress has been missed. Swift twin:
+ * `resolveSleepFreshness`. */
+internal fun resolveSleepFreshness(
+    hasCurrentNight: Boolean,
+    morningReady: Boolean,
+    syncing: Boolean,
+    calculating: Boolean,
+    syncedSinceDayStart: Boolean,
+    syncFailed: Boolean,
+): SleepFreshnessStatus? {
+    if (syncing) return SleepFreshnessStatus.SYNCING
+    if (calculating) return SleepFreshnessStatus.CALCULATING
+    if (hasCurrentNight || !morningReady) return null
+    if (syncFailed) return SleepFreshnessStatus.SYNC_FAILED
+    return if (syncedSinceDayStart) SleepFreshnessStatus.NOT_DETECTED
+    else SleepFreshnessStatus.AWAITING_SYNC
+}
+
+@Composable
+private fun SleepFreshnessNote(status: SleepFreshnessStatus, chunks: Int) {
+    when (status) {
+        SleepFreshnessStatus.SYNCING -> SyncingHistoryNote(chunks)
+        SleepFreshnessStatus.CALCULATING -> DataPendingNote(
+            title = stringResource(R.string.sleep_status_calculating_title),
+            body = stringResource(R.string.sleep_status_calculating_body),
+        )
+        SleepFreshnessStatus.SYNC_FAILED -> DataPendingNote(
+            title = stringResource(R.string.sleep_status_sync_failed_title),
+            body = stringResource(R.string.sleep_status_sync_failed_body),
+        )
+        SleepFreshnessStatus.AWAITING_SYNC -> DataPendingNote(
+            title = stringResource(R.string.sleep_status_waiting_title),
+            body = stringResource(R.string.sleep_status_waiting_body),
+        )
+        SleepFreshnessStatus.NOT_DETECTED -> DataPendingNote(
+            title = stringResource(R.string.sleep_status_not_detected_title),
+            body = stringResource(R.string.sleep_status_not_detected_body),
+        )
+    }
+}
+
 /**
  * Sleep — Whoop-sleep clarity on the locked Noop component system. Mirrors the macOS
  * SleepView (Strand/Screens/SleepView.swift) section-for-section:
@@ -145,6 +200,18 @@ fun SleepScreen(
             if (s.backfilling) s.syncChunksThisSession else null
         }
     }
+    // Like backfillNote, collapse the 1 Hz BLE state to only fields that can change the missing-night
+    // banner. Live HR ticks then remain equality-identical and do not recompose this heavy screen.
+    val freshnessLive by remember {
+        derivedStateOf {
+            SleepFreshnessLiveSnapshot(
+                backfilling = live.backfilling,
+                analyzing = live.analyzingHistory,
+                lastSyncAt = live.lastSyncAt,
+                syncFailed = live.lastSyncError != null,
+            )
+        }
+    }
 
     // Every recorded sleep BLOCK, oldest→newest — the hero's ◀/▶ chevrons walk this whole list,
     // including same-day naps / split sleep that `sleepSessionsMerged` collapses to one-per-night
@@ -442,6 +509,24 @@ fun SleepScreen(
     }
     val display = remember(model, night) { heroDisplay(model, night) }
 
+    val sleepFreshness = remember(sleeps, freshnessLive) {
+        val zone = ZoneId.systemDefault()
+        val now = Instant.now().atZone(zone)
+        val latestWake = sleeps.maxOfOrNull { it.endTs }
+        val current = latestWake?.let {
+            Instant.ofEpochSecond(it).atZone(zone).toLocalDate() == now.toLocalDate()
+        } ?: false
+        val dayStart = now.toLocalDate().atStartOfDay(zone).toEpochSecond()
+        resolveSleepFreshness(
+            hasCurrentNight = current,
+            morningReady = now.hour >= 6,
+            syncing = freshnessLive.backfilling,
+            calculating = freshnessLive.analyzing,
+            syncedSinceDayStart = (freshnessLive.lastSyncAt ?: 0L) >= dayStart,
+            syncFailed = freshnessLive.syncFailed,
+        )
+    }
+
     // #940: ONE stage-less SELECTED day (typically the newest, after an impossible hand-edit staged
     // it all-awake) must not hide the whole tab's history. The tiles / ledger / trends are
     // full-history and independent of the browsed night (matching iOS, where browsing only
@@ -544,13 +629,14 @@ fun SleepScreen(
                 )
             }
         }
+        sleepFreshness?.let { status ->
+            item { SleepFreshnessNote(status, backfillNote ?: 0) }
+        }
         // #940: the empty state is ONLY for a truly empty history. A newest day that merely fails
         // to merge (the phantom-edit shape) keeps the hero (night != null) and the full-history
         // tiles (tilesModel != null), so intact older nights are never hidden behind "no nights".
         if (tilesModel == null && night == null) {
-            // While the strap is mid-offload, say so — "No nights" reads as final otherwise (#77).
             item {
-                if (backfillNote != null) SyncingHistoryNote(chunks = backfillNote!!)
                 SleepEmptyState()
             }
         } else {
@@ -1987,4 +2073,3 @@ private fun MotionStrip(epochs: List<Double>) {
 // MARK: - Sleep window and night navigation UI lives in SleepNightNavUi.kt
 // MARK: - Sleep metric cards, debt ledger, stages, trends + chart helpers live in SleepMetricCardsUi.kt
 // MARK: - Sleep metric detail sheet UI lives in SleepMetricDetailSheet.kt
-
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 39d82f4d58..a0761398e3 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -13,6 +13,14 @@
     <string name="nav_live">Live</string>
     <string name="nav_intervals">Intervalle</string>
     <string name="nav_sleep">Schlaf</string>
+    <string name="sleep_status_calculating_title">Der Schlaf der letzten Nacht wird berechnet…</string>
+    <string name="sleep_status_calculating_body">Dein Strap-Verlauf ist da. NOOP erkennt und analysiert die Nacht jetzt.</string>
+    <string name="sleep_status_sync_failed_title">Der Schlaf der letzten Nacht wurde nicht synchronisiert</string>
+    <string name="sleep_status_sync_failed_body">Die Verlaufssynchronisierung wurde vorzeitig beendet. Halte den Strap in der Nähe und versuche die Synchronisierung erneut.</string>
+    <string name="sleep_status_waiting_title">Warten auf den Schlaf der letzten Nacht</string>
+    <string name="sleep_status_waiting_body">Verbinde den Strap und synchronisiere seinen Verlauf. NOOP berechnet die Nacht, sobald die Nachtdaten eintreffen.</string>
+    <string name="sleep_status_not_detected_title">Der Schlaf der letzten Nacht wurde nicht erkannt</string>
+    <string name="sleep_status_not_detected_body">Die Synchronisierung ist abgeschlossen, aber NOOP konnte kein Schlafzeitfenster sicher erkennen. Lass den Strap verbunden und synchronisiere erneut; die ältere Nacht unten ist weiterhin dein zuletzt erkannter Schlaf.</string>
     <string name="nav_breathe">Atmen</string>
     <string name="nav_stress">Stress</string>
     <string name="nav_workouts">Workouts</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 42e08db122..1ce1f4d192 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -1,6 +1,15 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
 
+    <string name="sleep_status_calculating_title">Calculando el sueño de anoche…</string>
+    <string name="sleep_status_calculating_body">El historial de tu pulsera ya está disponible. NOOP está detectando y analizando la noche.</string>
+    <string name="sleep_status_sync_failed_title">El sueño de anoche no se ha sincronizado</string>
+    <string name="sleep_status_sync_failed_body">La sincronización del historial se detuvo antes de terminar. Mantén la pulsera cerca e inténtalo de nuevo.</string>
+    <string name="sleep_status_waiting_title">Esperando el sueño de anoche</string>
+    <string name="sleep_status_waiting_body">Conecta la pulsera y sincroniza su historial. NOOP calculará la noche cuando lleguen los datos nocturnos.</string>
+    <string name="sleep_status_not_detected_title">No se detectó el sueño de anoche</string>
+    <string name="sleep_status_not_detected_body">La sincronización terminó, pero NOOP no pudo identificar con confianza un periodo de sueño. Mantén la pulsera conectada y vuelve a sincronizar; la noche anterior que aparece abajo sigue siendo tu último sueño detectado.</string>
+
     <!-- #453 generated Compose literal migration -->
     <string name="l10n_add_device_wizard_0123456789abcdef0123456789abcdef_b1775a78">0123456789abcdef0123456789abcdef</string>
     <string name="l10n_add_device_wizard_a_whoop_strap_bonds_to_a_d39bdf4a">Una correa WHOOP se une a un solo dispositivo. Mientras esté conectado a NOOP, no fluirá</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index fd57104b97..50d2ee292e 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -1,6 +1,15 @@
 <?xml version="1.0" encoding="utf-8"?>
 <resources>
 
+    <string name="sleep_status_calculating_title">Calcul du sommeil de la nuit dernière…</string>
+    <string name="sleep_status_calculating_body">L’historique de votre bracelet est arrivé. NOOP détecte et analyse maintenant la nuit.</string>
+    <string name="sleep_status_sync_failed_title">Le sommeil de la nuit dernière n’a pas été synchronisé</string>
+    <string name="sleep_status_sync_failed_body">La synchronisation de l’historique s’est arrêtée avant la fin. Gardez le bracelet à proximité et réessayez.</string>
+    <string name="sleep_status_waiting_title">En attente du sommeil de la nuit dernière</string>
+    <string name="sleep_status_waiting_body">Connectez le bracelet et synchronisez son historique. NOOP calculera la nuit lorsque les données nocturnes arriveront.</string>
+    <string name="sleep_status_not_detected_title">Le sommeil de la nuit dernière n’a pas été détecté</string>
+    <string name="sleep_status_not_detected_body">La synchronisation est terminée, mais NOOP n’a pas pu identifier avec certitude une période de sommeil. Gardez le bracelet connecté et relancez la synchronisation ; la nuit plus ancienne ci-dessous reste votre dernier sommeil détecté.</string>
+
     <!-- #453 generated Compose literal migration -->
     <string name="l10n_add_device_wizard_0123456789abcdef0123456789abcdef_b1775a78">0123456789abcdef0123456789abcdef</string>
     <string name="l10n_add_device_wizard_a_whoop_strap_bonds_to_a_d39bdf4a">Un bracelet WHOOP se lie à un seul appareil. Alors qu\'il est connecté à NOOP il ne va pas diffuser </string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 293a6702c0..513db4221a 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -11,6 +11,14 @@
     <string name="nav_live">Na żywo</string>
     <string name="nav_intervals">Interwały</string>
     <string name="nav_sleep">Sen</string>
+    <string name="sleep_status_calculating_title">Obliczanie snu z ostatniej nocy…</string>
+    <string name="sleep_status_calculating_body">Historia z opaski jest już dostępna. NOOP wykrywa i analizuje teraz noc.</string>
+    <string name="sleep_status_sync_failed_title">Sen z ostatniej nocy nie został zsynchronizowany</string>
+    <string name="sleep_status_sync_failed_body">Synchronizacja historii zatrzymała się przed ukończeniem. Trzymaj opaskę w pobliżu i spróbuj ponownie.</string>
+    <string name="sleep_status_waiting_title">Oczekiwanie na sen z ostatniej nocy</string>
+    <string name="sleep_status_waiting_body">Połącz opaskę i zsynchronizuj jej historię. NOOP obliczy noc po otrzymaniu danych nocnych.</string>
+    <string name="sleep_status_not_detected_title">Nie wykryto snu z ostatniej nocy</string>
+    <string name="sleep_status_not_detected_body">Synchronizacja zakończyła się, ale NOOP nie zdołał wiarygodnie określić okna snu. Pozostaw opaskę połączoną i zsynchronizuj ponownie; starsza noc poniżej nadal jest ostatnim wykrytym snem.</string>
     <string name="nav_breathe">Oddychać</string>
     <string name="nav_stress">Stres</string>
     <string name="nav_workouts">Treningi</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index b2fb74f123..eda3f3afc1 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -13,6 +13,14 @@
     <string name="nav_live">Em direto</string>
     <string name="nav_intervals">Intervalos</string>
     <string name="nav_sleep">Sono</string>
+    <string name="sleep_status_calculating_title">A calcular o sono da noite passada…</string>
+    <string name="sleep_status_calculating_body">O histórico da bracelete chegou. A NOOP está agora a detetar e analisar a noite.</string>
+    <string name="sleep_status_sync_failed_title">O sono da noite passada não foi sincronizado</string>
+    <string name="sleep_status_sync_failed_body">A sincronização do histórico parou antes de terminar. Mantém a bracelete por perto e tenta novamente.</string>
+    <string name="sleep_status_waiting_title">À espera do sono da noite passada</string>
+    <string name="sleep_status_waiting_body">Liga a bracelete e sincroniza o histórico. A NOOP calculará a noite quando os dados noturnos chegarem.</string>
+    <string name="sleep_status_not_detected_title">O sono da noite passada não foi detetado</string>
+    <string name="sleep_status_not_detected_body">A sincronização terminou, mas a NOOP não conseguiu identificar com confiança um período de sono. Mantém a bracelete ligada e sincroniza novamente; a noite anterior abaixo continua a ser o teu último sono detetado.</string>
     <string name="nav_breathe">Respirar</string>
     <string name="nav_stress">Stress</string>
     <string name="nav_workouts">Treinos</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index bd714e7123..0d20b299e7 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -11,6 +11,14 @@
     <string name="nav_live">实时心率</string>
     <string name="nav_intervals">间歇训练</string>
     <string name="nav_sleep">睡眠</string>
+    <string name="sleep_status_calculating_title">正在计算昨夜睡眠…</string>
+    <string name="sleep_status_calculating_body">手环历史数据已到达。NOOP 正在识别并分析这一夜的睡眠。</string>
+    <string name="sleep_status_sync_failed_title">昨夜睡眠尚未同步</string>
+    <string name="sleep_status_sync_failed_body">历史同步未完成就停止了。请将手环放在附近并再次尝试同步。</string>
+    <string name="sleep_status_waiting_title">正在等待昨夜睡眠</string>
+    <string name="sleep_status_waiting_body">连接手环并同步历史。收到夜间数据后，NOOP 会计算这一夜的睡眠。</string>
+    <string name="sleep_status_not_detected_title">未检测到昨夜睡眠</string>
+    <string name="sleep_status_not_detected_body">同步已完成，但 NOOP 无法可靠识别睡眠时段。请保持手环连接并再次同步；下方较早的一夜仍是最近一次检测到的睡眠。</string>
     <string name="nav_breathe">正念呼吸</string>
     <string name="nav_stress">压力</string>
     <string name="nav_workouts">运动</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 7d329fb809..962108936b 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -15,6 +15,14 @@
     <string name="nav_live">Live</string>
     <string name="nav_intervals">Intervals</string>
     <string name="nav_sleep">Sleep</string>
+    <string name="sleep_status_calculating_title">Calculating last night’s sleep…</string>
+    <string name="sleep_status_calculating_body">Your strap history is in. NOOP is detecting and staging the night now.</string>
+    <string name="sleep_status_sync_failed_title">Last night’s sleep hasn’t synced</string>
+    <string name="sleep_status_sync_failed_body">The history sync stopped before it finished. Keep the strap nearby and try Sync again.</string>
+    <string name="sleep_status_waiting_title">Waiting for last night’s sleep</string>
+    <string name="sleep_status_waiting_body">Connect the strap and sync its history. NOOP will calculate the night when the overnight data arrives.</string>
+    <string name="sleep_status_not_detected_title">Last night’s sleep wasn’t detected</string>
+    <string name="sleep_status_not_detected_body">Sync finished, but NOOP couldn’t confidently identify a sleep window. Keep the strap connected and try Sync again; the older night below is still your latest detected sleep.</string>
     <string name="nav_breathe">Breathe</string>
     <string name="nav_stress">Stress</string>
     <string name="nav_workouts">Workouts</string>
diff --git a/android/app/src/test/java/com/noop/data/HrFingerprintTest.kt b/android/app/src/test/java/com/noop/data/HrFingerprintTest.kt
index c9334dc986..2ec6f3be4b 100644
--- a/android/app/src/test/java/com/noop/data/HrFingerprintTest.kt
+++ b/android/app/src/test/java/com/noop/data/HrFingerprintTest.kt
@@ -4,6 +4,8 @@ import kotlinx.coroutines.runBlocking
 import org.junit.Assert.assertEquals
 import org.junit.Test
 import java.lang.reflect.Proxy
+import java.sql.Connection
+import java.sql.DriverManager
 
 /**
  * #836 — [WhoopRepository.hrFingerprint] is the cheap whole-history raw-HR change-detector the 15-min idle
@@ -43,4 +45,37 @@ class HrFingerprintTest {
         assertEquals("10:1000", before)
         assertEquals("11:1060", after)
     }
+
+    @Test fun analysisFingerprintSqlRunsAndMovesForGravityOnlyCommit() {
+        DriverManager.getConnection("jdbc:sqlite::memory:").use { db ->
+            createFingerprintTables(db)
+            assertEquals("v2|h0:0|p0|r0|x0|g0|s0|e0|o0|t0|z0", fingerprint(db))
+
+            db.createStatement().use { sql ->
+                sql.executeUpdate("INSERT INTO hrSample(ts) VALUES (1000)")
+                sql.executeUpdate("INSERT INTO rrInterval DEFAULT VALUES")
+                sql.executeUpdate("INSERT INTO rrInterval DEFAULT VALUES")
+                sql.executeUpdate("INSERT INTO gravitySample DEFAULT VALUES")
+            }
+            assertEquals("v2|h1:1000|p0|r2|x0|g1|s0|e0|o0|t0|z0", fingerprint(db))
+        }
+    }
+
+    private fun createFingerprintTables(db: Connection) {
+        db.createStatement().use { sql ->
+            sql.execute("CREATE TABLE hrSample(ts INTEGER NOT NULL)")
+            listOf(
+                "ppgHrSample", "rrInterval", "respSample", "gravitySample", "sleepStateSample",
+                "event", "spo2Sample", "skinTempSample", "stepSample",
+            ).forEach { table -> sql.execute("CREATE TABLE $table(value INTEGER)") }
+        }
+    }
+
+    private fun fingerprint(db: Connection): String =
+        db.createStatement().use { sql ->
+            sql.executeQuery(ANALYSIS_FINGERPRINT_SQL).use { rows ->
+                rows.next()
+                rows.getString(1)
+            }
+        }
 }
diff --git a/android/app/src/test/java/com/noop/ui/SleepFreshnessStatusTest.kt b/android/app/src/test/java/com/noop/ui/SleepFreshnessStatusTest.kt
new file mode 100644
index 0000000000..da9e575b19
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/SleepFreshnessStatusTest.kt
@@ -0,0 +1,44 @@
+package com.noop.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+class SleepFreshnessStatusTest {
+    @Test fun currentNightNeedsNoBanner() {
+        assertNull(resolveSleepFreshness(true, true, false, false, true, false))
+    }
+
+    @Test fun doesNotDeclareMissingBeforeMorning() {
+        assertNull(resolveSleepFreshness(false, false, false, false, true, false))
+    }
+
+    @Test fun progressStatesWinOverStaleHistory() {
+        assertEquals(
+            SleepFreshnessStatus.SYNCING,
+            resolveSleepFreshness(false, true, true, true, false, true),
+        )
+        assertEquals(
+            SleepFreshnessStatus.CALCULATING,
+            resolveSleepFreshness(false, true, false, true, true, true),
+        )
+    }
+
+    @Test fun completedSyncWithoutNightIsExplicitlyNotDetected() {
+        assertEquals(
+            SleepFreshnessStatus.NOT_DETECTED,
+            resolveSleepFreshness(false, true, false, false, true, false),
+        )
+    }
+
+    @Test fun distinguishesFailedAndNotYetRunSyncs() {
+        assertEquals(
+            SleepFreshnessStatus.SYNC_FAILED,
+            resolveSleepFreshness(false, true, false, false, false, true),
+        )
+        assertEquals(
+            SleepFreshnessStatus.AWAITING_SYNC,
+            resolveSleepFreshness(false, true, false, false, false, false),
+        )
+    }
+}

From a8e852d5195a9f2204205aa199bfbb1cf3c16a02 Mon Sep 17 00:00:00 2001
From: Bernd Helm <bhelm@users.noreply.github.com>
Date: Sun, 30 Aug 2026 06:25:36 +0200
Subject: [PATCH 078/333] Enable StrandAnalytics SwiftPM tests on Linux (#1529)

StrandAnalytics could not be built or tested on Linux at all - CLAUDE.md's "Local walls" documents it as a hard limit, so every analytics change had to wait for a macOS runner or a reviewer with a Mac. This makes the platform-neutral suite runnable on Linux without changing a byte of Darwin behaviour.

Four narrow changes. RawOutbox and its tests are gated on canImport(Compression), since that framework is Apple-only. The #977 expected-failure contract is skipped where corelibs XCTest has no XCTExpectFailure, rather than deleted - the contract survives on Darwin, which is where it was asserting something. BackupSettings.isBoolean gets a corelibs branch. And docs/BUILD.md documents the snapshot-enabled SQLite build GRDB needs, with a pinned SHA-256 for the amalgamation.

isBoolean is the only SHIPPING-code change here and it sits on the .noopbak whitelist, which this repo treats as a byte-identical contract, so it earned the closest look. The Darwin path is untouched behind canImport(Darwin). The Linux branch is not merely asserted either: a round-trip test now decodes a payload mixing JSON booleans and numerics and fails if a boolean is accepted as numeric 1 or 0. That test came out of the earlier review round, along with the Compression guard on RawOutboxTests.

VERIFIED INDEPENDENTLY, not taken on trust, on a clean Linux box following the documented procedure exactly:

- the pinned amalgamation checksum verifies against the real download
- patched: Executed 1523 tests, with 1 test skipped and 0 failures - matching the reported figure
- unpatched main, identical setup: RawOutbox.swift:2: error: no such module 'Compression' - so the patch is what enables this rather than the environment
- BackupSettingsLinuxTests passes and the #977 contract skips with the intended reason, checked individually rather than inferred from the total

Residual worth naming: NOTHING RUNS THIS. swift-packages.yml is macos-15 on both jobs, so the next change to WhoopStore can break Linux silently and these #if branches will bit-rot unexercised. The PR says so plainly rather than implying coverage it does not add. An ubuntu job would keep it honest - the suite itself is about twelve seconds once built, so the cost is the SQLite compile, not the tests.

Thanks @bhelm.
---
 .../BackupSettingsLinuxTests.swift            | 23 +++++++++++++++++++
 .../Live5RestFrozenTests.swift                |  6 ++++-
 .../Sources/WhoopStore/BackupSettings.swift   |  5 ++++
 .../Sources/WhoopStore/RawOutbox.swift        |  2 ++
 .../WhoopStoreTests/RawOutboxTests.swift      |  2 ++
 docs/BUILD.md                                 | 22 ++++++++++++++++++
 6 files changed, 59 insertions(+), 1 deletion(-)
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/BackupSettingsLinuxTests.swift

diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/BackupSettingsLinuxTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/BackupSettingsLinuxTests.swift
new file mode 100644
index 0000000000..f88a0cc873
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/BackupSettingsLinuxTests.swift
@@ -0,0 +1,23 @@
+import XCTest
+import WhoopStore
+
+/// Exercises the Corelibs Foundation NSNumber distinction used by BackupSettings on Linux.
+final class BackupSettingsLinuxTests: XCTestCase {
+    func testBooleanAndNumericJSONValuesKeepDistinctContracts() throws {
+        let payload = Data(#"{"profile.age":true,"profile.hrMax":1,"profile.weightKg":false,"profile.heightCm":1}"#.utf8)
+
+        let decoded = BackupSettings.decode(payload)
+
+        XCTAssertNil(decoded["profile.age"], "A JSON boolean must not be accepted as numeric 1")
+        XCTAssertNil(decoded["profile.weightKg"], "A JSON boolean must not be accepted as numeric 0")
+        XCTAssertEqual(decoded["profile.hrMax"] as? Int, 1)
+        XCTAssertEqual(decoded["profile.heightCm"] as? Double, 1.0)
+
+        let roundTrip = try XCTUnwrap(BackupSettings.encode(decoded))
+        let json = try XCTUnwrap(JSONSerialization.jsonObject(with: roundTrip) as? [String: Any])
+        XCTAssertEqual((json["profile.hrMax"] as? NSNumber)?.intValue, 1)
+        XCTAssertEqual((json["profile.heightCm"] as? NSNumber)?.doubleValue, 1.0)
+        XCTAssertNil(json["profile.age"])
+        XCTAssertNil(json["profile.weightKg"])
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/Live5RestFrozenTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/Live5RestFrozenTests.swift
index 31131e97d9..996cbbad79 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/Live5RestFrozenTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/Live5RestFrozenTests.swift
@@ -88,12 +88,16 @@ final class Live5RestFrozenTests: XCTestCase {
     ///
     /// This intentionally FAILS against today's code (Rest.composite(daily:) returns nil for such a
     /// day). Delete the XCTExpectFailure wrapper when the fix lands.
-    func testChargeableDayShouldYieldAdvancingRestSignal_FIX() {
+    func testChargeableDayShouldYieldAdvancingRestSignal_FIX() throws {
+#if canImport(Darwin)
         XCTExpectFailure("#977 not yet fixed: a chargeable-but-unslept live-5.0 day yields a nil Rest signal") {
             let daily = chargeableButUnsleptDaily(day: "2026-07-02")
             XCTAssertNotNil(AnalyticsEngine.Rest.composite(daily: daily),
                             "A day that can score Charge must also surface SOME Rest signal, not freeze")
         }
+#else
+        throw XCTSkip("XCTExpectFailure is unavailable in corelibs XCTest")
+#endif
     }
 
     func testTodayRestFreezesOnTailFallbackWhenNoNewPointWritten() {
diff --git a/Packages/WhoopStore/Sources/WhoopStore/BackupSettings.swift b/Packages/WhoopStore/Sources/WhoopStore/BackupSettings.swift
index e71786af04..df5b7afe67 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/BackupSettings.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/BackupSettings.swift
@@ -177,6 +177,11 @@ public enum BackupSettings {
     }
 
     private static func isBoolean(_ n: NSNumber) -> Bool {
+#if canImport(Darwin)
         CFGetTypeID(n) == CFBooleanGetTypeID()
+#else
+        // corelibs Foundation boxes JSON booleans with the Objective-C `c` type encoding.
+        String(cString: n.objCType) == "c"
+#endif
     }
 }
diff --git a/Packages/WhoopStore/Sources/WhoopStore/RawOutbox.swift b/Packages/WhoopStore/Sources/WhoopStore/RawOutbox.swift
index a08a53a9aa..4b2955f8db 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/RawOutbox.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/RawOutbox.swift
@@ -1,3 +1,4 @@
+#if canImport(Compression)
 import Foundation
 import Compression
 import GRDB
@@ -252,3 +253,4 @@ extension WhoopStore {
         }
     }
 }
+#endif
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/RawOutboxTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/RawOutboxTests.swift
index 848c79a08b..0f7105cb05 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/RawOutboxTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/RawOutboxTests.swift
@@ -1,3 +1,4 @@
+#if canImport(Compression)
 import XCTest
 import WhoopProtocol
 @testable import WhoopStore
@@ -85,3 +86,4 @@ final class RawOutboxTests: XCTestCase {
         XCTAssertEqual(gotZeros, zeros)
     }
 }
+#endif
diff --git a/docs/BUILD.md b/docs/BUILD.md
index c71dcbc6fe..a72233bf2a 100644
--- a/docs/BUILD.md
+++ b/docs/BUILD.md
@@ -86,6 +86,28 @@ brew install xcodegen
 The packages themselves only need a Swift toolchain — they build and test with plain `swift build`
 / `swift test`, no Xcode project required.
 
+### StrandAnalytics tests on Linux
+
+Install Swift 6 or newer plus a C compiler, `curl`, and `unzip`. GRDB uses SQLite's snapshot API,
+which distribution builds commonly omit, so build a private snapshot-enabled library:
+
+```bash
+SQLITE_SNAPSHOT_DIR="$(mktemp -d)"
+curl -fsSLo "$SQLITE_SNAPSHOT_DIR/sqlite.zip" https://sqlite.org/2026/sqlite-amalgamation-3530400.zip
+unzip -p "$SQLITE_SNAPSHOT_DIR/sqlite.zip" sqlite-amalgamation-3530400/sqlite3.c > "$SQLITE_SNAPSHOT_DIR/sqlite3.c"
+unzip -p "$SQLITE_SNAPSHOT_DIR/sqlite.zip" sqlite-amalgamation-3530400/sqlite3.h > "$SQLITE_SNAPSHOT_DIR/sqlite3.h"
+echo "b1dd5d74ec7f29055a6684fa06fb3c2f6821c87dd38f9a458dfd2e8a1db28189  $SQLITE_SNAPSHOT_DIR/sqlite3.c" | sha256sum --check
+cc -shared -fPIC -DSQLITE_ENABLE_SNAPSHOT=1 "$SQLITE_SNAPSHOT_DIR/sqlite3.c" -o "$SQLITE_SNAPSHOT_DIR/libsqlite3.so.0"
+ln -s libsqlite3.so.0 "$SQLITE_SNAPSHOT_DIR/libsqlite3.so"
+cd Packages/StrandAnalytics
+LD_LIBRARY_PATH="$SQLITE_SNAPSHOT_DIR${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" \
+  swift test -Xcc -I"$SQLITE_SNAPSHOT_DIR" -Xlinker -L"$SQLITE_SNAPSHOT_DIR"
+```
+
+This currently runs 1,523 platform-neutral package tests with one intentional skip. It does not run
+iOS simulator/UI tests, Darwin's Compression-backed raw outbox, or the standalone `WhoopStore`
+test target. The existing package CI remains macOS-only.
+
 ---
 
 ## macOS build & run (reference implementation)

From cabf1ded1b92f4b5cba42225e0373748bf68d407 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 16:26:41 +1200
Subject: [PATCH 079/333] staging: build 384/265 for the diagnostics and
 sleep-sync work

versionCode 383 -> 384, CURRENT_PROJECT_VERSION 264 -> 265. Display version holds
at 10.6.1: v10.6.0 is still the latest release, so that is the next unreleased
line and only the build numbers move.

384 is +1 on the staging high-water rather than anything main released, so a
sideload updates in place instead of Android refusing the downgrade.

Carries five merges over 383: the 5/MG stalled-link diagnostics, the workout
detector provenance and pipeline-freshness lines, the VO2max precision and
method-break caption, the partial-history-sync sleep fix, and Linux StrandAnalytics
tests.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 40abc73020..2d866bf8dd 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 383
+        versionCode = 384
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 294a67cb26..ae2ee2904e 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "264"
+    CURRENT_PROJECT_VERSION: "265"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 9a7fcfb40f1297d188243ff38588169977f89f75 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 16:49:44 +1200
Subject: [PATCH 080/333] android: clear every main-source Kotlin warning

Eleven warnings, none of which turned out to hide a functional bug - but two were
worth more than the silence they were kept in.

sleepNeedNights was vestigial AND its doc was wrong. The comment claimed it
"Drives the Rest confidence tier ONLY"; ScoreConfidence.forRest takes hasSession,
hasStagedSleep, asleepSeconds, restorativeSeconds, efficiency, gravitySparse and
stageCoverage, and the Swift twin takes the identical set. Neither platform has
ever read a nights count, no caller passed one, and Swift has no such parameter at
all. Removed rather than suppressed.

Its @Suppress was ALSO attached to the wrong declaration: it sat immediately above
the doc block for VENDOR_RESP_MIN_SPAN_S, so it annotated a constant while naming a
parameter three hundred lines away, and suppressed nothing. Deleting it exposed two
doc blocks the linter had been counting as one grandfathered site: analyzeDay's doc
stranded at 227 with the function at 274, and subScoreLine's at 1481 with the
function at 1533 - both the "inserted a declaration between a doc and the thing it
documents" trap CLAUDE.md names. Each doc is reunited with its function, and the
baseline drops from 1 to 0 rather than being raised.

The BodyClockDialCard guard was mine from this week: line 69 already does
`?: return`, so `if (ideal != null)` could never be false. A guard that cannot fail
implies an optional case that does not exist.

buildGpx accepted a distanceM it ignored. That is correct behaviour - GPX 1.1 has
no track-level distance element, a reader derives it from the trackpoints - but the
signature promised otherwise, and a test passed 1234.5 into it while asserting
nothing about distance. FIT genuinely carries one and keeps its parameter.

Checked and left alone: the other `!!` sites in synthesisDetail. Each tier tests
`== null` before its `!!` branch, so short-circuit ordering guarantees non-null;
only the last tier's null check is unconditional, which is exactly the one the
compiler flagged. lockedBpm is honoured everywhere it matters and was unused only
in a label and a copy dialog.

Remainder mechanical: redundant initializers, the typed getParcelableExtra on API
33+ matching the existing house idiom, and Icons.AutoMirrored for the wheelchair
glyph.

android/app/src/main is now at ZERO Kotlin warnings. 4851 tests green, doc lint and
i18n audit clean.
---
 Tools/doc_comment_lint_baseline.txt           |  1 -
 .../com/noop/analytics/AnalyticsEngine.kt     | 42 +++++++++----------
 .../com/noop/ble/WhoopConnectionService.kt    |  8 +++-
 .../main/java/com/noop/ingest/RouteExport.kt  |  7 ++--
 .../noop/testcentre/GroundTruthCollector.kt   |  4 +-
 .../java/com/noop/ui/BodyClockDialCard.kt     |  6 +--
 .../main/java/com/noop/ui/BreatheScreen.kt    |  8 ++--
 .../src/main/java/com/noop/ui/TodayScreen.kt  |  2 +-
 .../main/java/com/noop/ui/WorkoutsScreen.kt   |  6 +--
 .../AnalyticsEngineProvidedSleepTest.kt       |  1 -
 .../java/com/noop/ingest/RouteExportTest.kt   |  2 +-
 11 files changed, 42 insertions(+), 45 deletions(-)

diff --git a/Tools/doc_comment_lint_baseline.txt b/Tools/doc_comment_lint_baseline.txt
index 1a6ea29e44..87dffc43b9 100644
--- a/Tools/doc_comment_lint_baseline.txt
+++ b/Tools/doc_comment_lint_baseline.txt
@@ -3,7 +3,6 @@
 # file not listed here has any. Ratchet DOWN as they are fixed — never up.
 # Generated at the time Tools/doc_comment_lint.py landed; see #846 for the pattern.
 
-android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt 1
 android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt 5
 android/app/src/main/java/com/noop/ble/WhoopBleClient.kt 8
 android/app/src/main/java/com/noop/ble/WhoopConnectionService.kt 1
diff --git a/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt b/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
index f9b9d97935..a191180afb 100644
--- a/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
@@ -224,19 +224,6 @@ object AnalyticsEngine {
         )
     }
 
-    /**
-     * Analyze one day's streams into a [DayResult].
-     *
-     * @param day the calendar day (UTC) this metric is for; a sleep session is
-     *   attributed to the day its `end` falls on (a night ending that morning).
-     * @param hr/rr/resp/gravity the day's raw streams (the wider window around the
-     *   night may be passed; sleep detection finds the in-bed span itself).
-     * @param profile user profile (age/sex/weight/height) for HRmax + calories.
-     * @param baselines personal baselines for recovery normalization.
-     * @param maxHROverride explicit HRmax (bpm) to use for strain/zones; null →
-     *   Tanaka from profile.age.
-     */
-    @Suppress("UNUSED_PARAMETER") // sleepNeedNights kept for signature stability (unused in the current body)
     /**
      * Minimum span (seconds) a night's vendor respiration rows must cover before their median is taken
      * as the night's rate. One hour: enough that the value describes the night rather than a fragment,
@@ -272,6 +259,18 @@ object AnalyticsEngine {
         return if (median in SleepStager.respPlausibleRangeBpm) median else null
     }
 
+    /**
+     * Analyze one day's streams into a [DayResult].
+     *
+     * @param day the calendar day (UTC) this metric is for; a sleep session is
+     *   attributed to the day its `end` falls on (a night ending that morning).
+     * @param hr/rr/resp/gravity the day's raw streams (the wider window around the
+     *   night may be passed; sleep detection finds the in-bed span itself).
+     * @param profile user profile (age/sex/weight/height) for HRmax + calories.
+     * @param baselines personal baselines for recovery normalization.
+     * @param maxHROverride explicit HRmax (bpm) to use for strain/zones; null →
+     *   Tanaka from profile.age.
+     */
     fun analyzeDay(
         day: String,
         hr: List<HrSample> = emptyList(),
@@ -341,9 +340,6 @@ object AnalyticsEngine {
         // Personal sleep need (hours) for the Rest "duration vs need" component. null → 8 h default.
         // IntelligenceEngine refines it from the user's recent average asleep hours. (Charge/Effort/Rest)
         sleepNeedHours: Double? = null,
-        // How many recent nights informed [sleepNeedHours] (0 = still on the 8 h default). Drives the
-        // Rest confidence tier ONLY; does not affect the score. (Charge/Effort/Rest)
-        sleepNeedNights: Int = 0,
         // Sleep/wake regularity in [0,1] (1 = perfectly regular) for the Rest "consistency" component.
         // null (single-day / pure callers with no history) → the term drops and its weight
         // renormalizes, exactly like the recovery driver-drop discipline. (Charge/Effort/Rest)
@@ -1482,13 +1478,6 @@ object RestScorer {
         return (weighted * 100.0).roundToInt() / 100.0
     }
 
-    /**
-     * Sleep & Rest test-mode (E11) diagnostic line for the Rest composite. Recomputes the four weighted
-     * sub-scores from the SAME inputs `rest()` reads (on the 0..1 scale, byte-aligned with the Swift
-     * `Rest.subScoreLine`), and reuses `rest()` for the final `composite=` value so the trace can never
-     * disagree with the score. `groupFragments` / `groupInBedSeconds` describe the main-night GROUP
-     * composition (#525/#561). Pure, side-effect-free, no em-dashes. Mirrors Swift exactly.
-     */
     /**
      * #319 diagnostic (Sleep & Rest test mode): the motion-coverage + staging context behind the Rest
      * number, so a high score on a poor night can be explained straight from an export. `grav`/`hr` are the
@@ -1533,6 +1522,13 @@ object RestScorer {
         return "sleep-onset onsetTs=$onsetTs hrAtOnset=$hrAtOnsetBpm baselineHr=$baselineHrBpm hrRatio=$r2"
     }
 
+    /**
+     * Sleep & Rest test-mode (E11) diagnostic line for the Rest composite. Recomputes the four weighted
+     * sub-scores from the SAME inputs `rest()` reads (on the 0..1 scale, byte-aligned with the Swift
+     * `Rest.subScoreLine`), and reuses `rest()` for the final `composite=` value so the trace can never
+     * disagree with the score. `groupFragments` / `groupInBedSeconds` describe the main-night GROUP
+     * composition (#525/#561). Pure, side-effect-free, no em-dashes. Mirrors Swift exactly.
+     */
     @Suppress("UNUSED_PARAMETER") // inBedSeconds mirrors the Swift subScoreLine signature (parity)
     fun subScoreLine(
         tstSeconds: Double, inBedSeconds: Double, efficiency: Double, restorativeSeconds: Double,
diff --git a/android/app/src/main/java/com/noop/ble/WhoopConnectionService.kt b/android/app/src/main/java/com/noop/ble/WhoopConnectionService.kt
index 196e6f3d0c..f5d9e3db80 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopConnectionService.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopConnectionService.kt
@@ -223,7 +223,13 @@ class WhoopConnectionService : Service() {
     private val bondStateReceiver = object : BroadcastReceiver() {
         override fun onReceive(context: Context?, intent: Intent?) {
             if (intent?.action != BluetoothDevice.ACTION_BOND_STATE_CHANGED) return
-            val dev: BluetoothDevice? = intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE)
+            val dev: BluetoothDevice? =
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+                    intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE, BluetoothDevice::class.java)
+                } else {
+                    @Suppress("DEPRECATION")
+                    intent.getParcelableExtra(BluetoothDevice.EXTRA_DEVICE)
+                }
             val cur = intent.getIntExtra(BluetoothDevice.EXTRA_BOND_STATE, BluetoothDevice.ERROR)
             val prev = intent.getIntExtra(BluetoothDevice.EXTRA_PREVIOUS_BOND_STATE, BluetoothDevice.ERROR)
             runCatching { ble.onBondStateChanged(prev, cur, dev?.address) }
diff --git a/android/app/src/main/java/com/noop/ingest/RouteExport.kt b/android/app/src/main/java/com/noop/ingest/RouteExport.kt
index 75c9c5625a..cb131a25e6 100644
--- a/android/app/src/main/java/com/noop/ingest/RouteExport.kt
+++ b/android/app/src/main/java/com/noop/ingest/RouteExport.kt
@@ -47,17 +47,18 @@ object RouteExport {
         avgHr: Int? = null,
         maxHr: Int? = null,
     ): ByteArray = when (format) {
-        Format.GPX -> buildGpx(points, startTs, endTs, sport, distanceM).toByteArray(Charsets.UTF_8)
+        Format.GPX -> buildGpx(points, startTs, endTs, sport).toByteArray(Charsets.UTF_8)
         Format.FIT -> buildFit(points, startTs, endTs, sport, distanceM, energyKcal, avgHr, maxHr)
     }
 
-    /** GPX 1.1 track. Each `trkpt` carries lat/lon + an interpolated `time`; no `ele`/HR (none stored). */
+    /** GPX 1.1 track. Each `trkpt` carries lat/lon + an interpolated `time`; no `ele`/HR (none stored).
+     *  Takes no distance: GPX 1.1 has no track-level distance element, so a reader derives it from the
+     *  trackpoints. FIT does carry one, which is why [buildFit] still takes it. */
     fun buildGpx(
         points: List<Point>,
         startTs: Long,
         endTs: Long,
         sport: String?,
-        distanceM: Double? = null,
     ): String {
         val canon = canonicalSport(sport)
         val times = interpolatedTimes(points.size, startTs, endTs)
diff --git a/android/app/src/main/java/com/noop/testcentre/GroundTruthCollector.kt b/android/app/src/main/java/com/noop/testcentre/GroundTruthCollector.kt
index 064f2cf071..1055a9bc17 100644
--- a/android/app/src/main/java/com/noop/testcentre/GroundTruthCollector.kt
+++ b/android/app/src/main/java/com/noop/testcentre/GroundTruthCollector.kt
@@ -296,7 +296,7 @@ class GroundTruthCollector private constructor(private val context: Context) {
         val outDir = File(context.cacheDir, "logs").apply { mkdirs() }
         val zip = File(outDir, "noop-5mg-raw-$id.zip")
         ZipOutputStream(zip.outputStream().buffered()).use { out ->
-            var v18Count = 0
+            var v18Count: Int
             out.putNextEntry(ZipEntry("v18-aux.csv"))
             out.bufferedWriterNoClose().use { writer ->
                 v18Count = writeV18AuxCsv(writer, repo, deviceId.orEmpty(), sensorFrom, sensorTo)
@@ -304,7 +304,7 @@ class GroundTruthCollector private constructor(private val context: Context) {
             }
             out.closeEntry()
 
-            var rawCounts: Map<String, Int> = emptyMap()
+            var rawCounts: Map<String, Int>
             out.putNextEntry(ZipEntry("raw-sensors.csv"))
             out.bufferedWriterNoClose().use { writer ->
                 rawCounts = RawSensorExport.writeCsv(writer, repo, deviceId.orEmpty(), sensorFrom, sensorTo)
diff --git a/android/app/src/main/java/com/noop/ui/BodyClockDialCard.kt b/android/app/src/main/java/com/noop/ui/BodyClockDialCard.kt
index 6647f3251d..12234120e5 100644
--- a/android/app/src/main/java/com/noop/ui/BodyClockDialCard.kt
+++ b/android/app/src/main/java/com/noop/ui/BodyClockDialCard.kt
@@ -165,10 +165,8 @@ fun BodyClockDialCard(
                 // does not survive the card being translucent over a custom background image — the
                 // reference arc washed out to near-invisible on a real device, which loses the comparison
                 // the card exists for. A dash also reads without relying on colour at all.
-                if (ideal != null) {
-                    arc(outer, ideal.bedHour, ideal.wakeHour,
-                        hue.copy(alpha = 0.55f), 7.dp.toPx(), dashed = true)
-                }
+                arc(outer, ideal.bedHour, ideal.wakeHour,
+                    hue.copy(alpha = 0.55f), 7.dp.toPx(), dashed = true)
                 arc(inner, actualBedHour, actualWakeHour, hue, 9.dp.toPx(), dashed = false)
 
                 // A marker at sleep ONSET. Without it the night arc has two indistinguishable ends and
diff --git a/android/app/src/main/java/com/noop/ui/BreatheScreen.kt b/android/app/src/main/java/com/noop/ui/BreatheScreen.kt
index 22f3147c4d..890da28dd8 100644
--- a/android/app/src/main/java/com/noop/ui/BreatheScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/BreatheScreen.kt
@@ -156,7 +156,7 @@ private fun currentStages(pace: PaceSelection, lockedBpm: Double?): List<BreathS
     is PaceSelection.Catalog -> selectedProtocol(pace)?.stages?.filter { it.durationMs > 0 }.orEmpty()
 }
 
-private fun paceSelectionLabel(pace: PaceSelection, lockedBpm: Double?): String = when (pace) {
+private fun paceSelectionLabel(pace: PaceSelection): String = when (pace) {
     is PaceSelection.Catalog -> localizedBreathTitle(pace.id)
     PaceSelection.Resonance -> uiString(R.string.l10n_breathe_screen_resonance_k1l2m3n4)
 }
@@ -446,7 +446,6 @@ fun BreatheScreen(viewModel: AppViewModel) {
     if (showEdu) {
         ProtocolEduDialog(
             pace = pace,
-            lockedBpm = lockedBpm,
             onDismiss = { showEdu = false },
         )
     }
@@ -553,7 +552,7 @@ fun BreatheScreen(viewModel: AppViewModel) {
                 verticalArrangement = Arrangement.spacedBy(18.dp),
             ) {
                 Row(modifier = Modifier.fillMaxWidth(), verticalAlignment = Alignment.CenterVertically) {
-                    Overline(paceSelectionLabel(pace, lockedBpm))
+                    Overline(paceSelectionLabel(pace))
                     Spacer(Modifier.weight(1f))
                     IconButton(
                         onClick = { showEdu = true },
@@ -629,7 +628,7 @@ fun BreatheScreen(viewModel: AppViewModel) {
                     SegmentedPillControl(
                         items = availablePaces,
                         selection = pace,
-                        label = { paceSelectionLabel(it, lockedBpm) },
+                        label = { paceSelectionLabel(it) },
                         onSelect = { newPace ->
                             if (running) stopSession()
                             pace = newPace
@@ -945,7 +944,6 @@ private fun phaseWord(phase: UiPhase, label: String?): String {
 @Composable
 private fun ProtocolEduDialog(
     pace: PaceSelection,
-    lockedBpm: Double?,
     onDismiss: () -> Unit,
 ) {
     val proto = selectedProtocol(pace)
diff --git a/android/app/src/main/java/com/noop/ui/TodayScreen.kt b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
index feccff58f1..9165438be0 100644
--- a/android/app/src/main/java/com/noop/ui/TodayScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
@@ -6868,7 +6868,7 @@ private fun synthesisDetail(d: DailyMetric?): String {
         rec < 70 && d.totalSleepMin!! / 60.0 >= 7 -> R.string.today_synthesis_charge_steady_sleep_consistent
         rec < 70 -> R.string.today_synthesis_charge_steady_sleep_short
         d.totalSleepMin == null -> R.string.today_synthesis_charge_strong
-        d.totalSleepMin!! / 60.0 >= 7 -> R.string.today_synthesis_charge_strong_sleep_consistent
+        d.totalSleepMin / 60.0 >= 7 -> R.string.today_synthesis_charge_strong_sleep_consistent
         else -> R.string.today_synthesis_charge_strong_sleep_short
     }
     return uiString(res)
diff --git a/android/app/src/main/java/com/noop/ui/WorkoutsScreen.kt b/android/app/src/main/java/com/noop/ui/WorkoutsScreen.kt
index a8fd9f0125..f781308971 100644
--- a/android/app/src/main/java/com/noop/ui/WorkoutsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/WorkoutsScreen.kt
@@ -24,9 +24,9 @@ import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.automirrored.filled.Accessible
 import android.app.DatePickerDialog
 import android.app.TimePickerDialog
-import androidx.compose.material.icons.filled.Accessible
 import androidx.compose.material.icons.filled.Hiking
 import androidx.compose.material.icons.filled.IceSkating
 import androidx.compose.material.icons.filled.Kayaking
@@ -2570,7 +2570,7 @@ internal fun sportIcon(sport: String): ImageVector = when (sport.lowercase().tri
     "volleyball", "sand volleyball", "spikeball" -> Icons.Filled.SportsVolleyball
     "golf" -> Icons.Filled.SportsGolf
     "climbing" -> Icons.Filled.Terrain
-    "wheelchair" -> Icons.Filled.Accessible
+    "wheelchair" -> Icons.AutoMirrored.Filled.Accessible
     "gaming" -> Icons.Filled.SportsEsports
     "motor racing" -> Icons.Filled.SportsMotorsports
     else -> sportIconFuzzy(sport)
@@ -2610,7 +2610,7 @@ private fun sportIconFuzzy(sport: String): ImageVector {
         s.contains("basketball") || s.contains("netball") -> Icons.Filled.SportsBasketball
         s.contains("gaming") || s.contains("esport") -> Icons.Filled.SportsEsports
         s.contains("motor") || s.contains("racing") -> Icons.Filled.SportsMotorsports
-        s.contains("wheelchair") -> Icons.Filled.Accessible
+        s.contains("wheelchair") -> Icons.AutoMirrored.Filled.Accessible
         else -> Icons.Filled.FitnessCenter
     }
 }
\ No newline at end of file
diff --git a/android/app/src/test/java/com/noop/analytics/AnalyticsEngineProvidedSleepTest.kt b/android/app/src/test/java/com/noop/analytics/AnalyticsEngineProvidedSleepTest.kt
index 8bbf1d4e20..103590bb04 100644
--- a/android/app/src/test/java/com/noop/analytics/AnalyticsEngineProvidedSleepTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/AnalyticsEngineProvidedSleepTest.kt
@@ -118,7 +118,6 @@ class AnalyticsEngineProvidedSleepTest {
             tzOffsetSeconds = 0,
             wristOff = emptyList(),
             sleepNeedHours = RestScorer.defaultSleepNeedHours,
-            sleepNeedNights = 0,
             sleepConsistency = null,
             habitualMidsleepSec = null,
             bandSleepState = emptyList(),
diff --git a/android/app/src/test/java/com/noop/ingest/RouteExportTest.kt b/android/app/src/test/java/com/noop/ingest/RouteExportTest.kt
index 57818801e1..3238e030de 100644
--- a/android/app/src/test/java/com/noop/ingest/RouteExportTest.kt
+++ b/android/app/src/test/java/com/noop/ingest/RouteExportTest.kt
@@ -37,7 +37,7 @@ class RouteExportTest {
     private val endTs = 1_723_001_800L // +30 min
 
     @Test fun gpxRoundTripsThroughTheImporter() {
-        val bytes = RouteExport.buildGpx(route, startTs, endTs, "running", distanceM = 1234.5)
+        val bytes = RouteExport.buildGpx(route, startTs, endTs, "running")
             .toByteArray(Charsets.UTF_8)
         assertEquals(ActivityFileImporter.Format.GPX, ActivityFileImporter.detectFormat(bytes))
         val a = ActivityFileImporter.parse(bytes, "route.gpx").activity

From 43f9a53ae317aefd94f37df4be8ba1fd1dfc5308 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 17:01:22 +1200
Subject: [PATCH 081/333] route export: drop the ignored distanceM from the
 Swift GPX builder too

Re-reading 9a7fcfb40: I cleaned the Kotlin buildGpx of a distanceM it never read
and left the Swift twin still taking one. Swift's body emits metadata, trk, name,
type, trkseg and trkpts - it ignores the parameter exactly as Kotlin did - so the
OUTPUT was never divergent, but the signatures now were, and a one-sided cleanup
is how a future reader concludes one platform lost a feature.

Both sides now say the same thing in the same place: GPX 1.1 has no track-level
distance element, so a reader derives it from the trackpoints. buildFit keeps its
parameter on both platforms because FIT genuinely carries one.

Verified as far as this machine allows: the file parses, and it is the sole caller
of buildGpx on either platform. StrandImport still cannot BUILD on Linux - it uses
XMLParser, which corelibs moved to the FoundationXML module - so the type-check
falls to macOS `test (StrandImport)`. That gap is unrelated to this change and is
the obvious next extension of the Linux work #1529 started.
---
 .../StrandImport/Sources/StrandImport/RouteExporter.swift | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Packages/StrandImport/Sources/StrandImport/RouteExporter.swift b/Packages/StrandImport/Sources/StrandImport/RouteExporter.swift
index 0e0ade92d9..8563821d9f 100644
--- a/Packages/StrandImport/Sources/StrandImport/RouteExporter.swift
+++ b/Packages/StrandImport/Sources/StrandImport/RouteExporter.swift
@@ -39,8 +39,7 @@ public enum RouteExporter {
     ) -> Data {
         switch format {
         case .gpx:
-            return Data(buildGpx(route: route, startTs: startTs, endTs: endTs, sport: sport,
-                                 distanceM: distanceM).utf8)
+            return Data(buildGpx(route: route, startTs: startTs, endTs: endTs, sport: sport).utf8)
         case .fit:
             return buildFit(route: route, startTs: startTs, endTs: endTs, sport: sport,
                             distanceM: distanceM, energyKcal: energyKcal, avgHr: avgHr, maxHr: maxHr)
@@ -48,12 +47,13 @@ public enum RouteExporter {
     }
 
     /// GPX 1.1 track. Each `trkpt` carries lat/lon + an interpolated `time`; no `ele`/HR (none stored).
+    /// Takes no distance: GPX 1.1 has no track-level distance element, so a reader derives it from the
+    /// trackpoints. FIT does carry one, which is why ``buildFit`` still takes it. Kotlin twin matches.
     public static func buildGpx(
         route: [RoutePoint],
         startTs: Int,
         endTs: Int,
-        sport: String?,
-        distanceM: Double? = nil
+        sport: String?
     ) -> String {
         let canon = canonicalSport(sport)
         let times = interpolatedTimes(route.count, startTs, endTs)

From 0eb3d072984d0028a31972d5c2ca9b8ccc3557de Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 17:24:26 +1200
Subject: [PATCH 082/333] StrandImport: build and test on Linux

#1529 opened StrandAnalytics to Linux; StrandImport stayed shut behind two
Darwin-isms, both of which are absences rather than behaviour differences.

XMLParser lives in Foundation on Apple platforms and in the separate FoundationXML
module under corelibs. A conditional import at the top of the three files that use
it - the GPX, TCX and Apple Health parsers - serves both, with no #if at any use
site.

autoreleasepool needs an Objective-C runtime that corelibs does not have. There is
exactly one first-party call, draining per XML element because a multi-year
export.xml bridges tens of millions of attribute dictionaries. That drain is
load-bearing ON DARWIN and untouched there; with no Objective-C runtime there are
no autoreleased temporaries, so running the body directly is the exact equivalent
rather than an approximation. The shim mirrors the one GRDB already ships in this
same dependency tree, so the two agree on the spelling.

Verified on Linux, not assumed: 249 tests, one skip, zero failures - and the GPX,
TCX and Apple Health suites specifically, 48 tests, which is what proves the
FoundationXML swap works behaviourally rather than merely compiling.

While measuring for the docs I checked the rest rather than guessing. WhoopStore
and NoopLocalAccess also BUILD with the same flags, and NoopLocalAccess tests
clean. WhoopStore's test target does NOT compile: ReadTests reaches for ClockRef,
a public type that happens to be declared inside RawOutbox.swift, which #1529
wrapped whole in `#if canImport(Compression)`. ClockRef is a clock-correlation
type with nothing to do with compression - the file-level guard took it along.
Left alone here, since it belongs to WhoopStore rather than this change.

CLAUDE.md's "Local walls" said every GRDB-linked package fails on Linux. That was
true when written and is now false for three of the four, so it states the
measured position per package instead - including that none of it is CI-enforced,
so a green Linux run is a convenience and not a guarantee.
---
 CLAUDE.md                                     | 13 +++++++++----
 .../StrandImport/AppleHealthImporter.swift    |  5 +++++
 .../Sources/StrandImport/CorelibsCompat.swift | 19 +++++++++++++++++++
 .../Sources/StrandImport/GpxParser.swift      |  5 +++++
 .../Sources/StrandImport/TcxParser.swift      |  5 +++++
 .../AppleHealthImporterTests.swift            |  4 ++++
 docs/BUILD.md                                 | 18 +++++++++++++++---
 7 files changed, 62 insertions(+), 7 deletions(-)
 create mode 100644 Packages/StrandImport/Sources/StrandImport/CorelibsCompat.swift

diff --git a/CLAUDE.md b/CLAUDE.md
index c39986bb52..816b1f1e26 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -136,10 +136,15 @@ properties are initialized`) will pass every green check and still be broken. If
 Swift, you MUST build the app yourself: `xcodebuild … build` locally, or run `app-build.yml` on demand.
 
 ### Local walls (things that will *not* build where you expect)
-- **On Linux:** only `WhoopProtocol` / `OuraProtocol` (pure) build & test. Every GRDB-linked package —
-  `WhoopStore`, `StrandImport`, `StrandAnalytics` (via `WhoopStore`), and `NoopLocalAccess` — fails with
-  `sqlite3.h not found` (GRDB's CSQLite), and `StrandDesign` needs SwiftUI — all need **macOS**. Android
-  JVM unit tests **do** run on Linux.
+- **On Linux:** `WhoopProtocol` / `OuraProtocol` (pure) build & test with a bare toolchain. The
+  GRDB-linked packages need the snapshot-enabled SQLite build in [`docs/BUILD.md`](docs/BUILD.md) — with
+  it, `StrandAnalytics` (1523 tests), `StrandImport` (249) and `NoopLocalAccess` build AND test;
+  `WhoopStore` builds but its TEST target does not compile (`ReadTests` reaches for `ClockRef`, which is
+  declared inside the `#if canImport(Compression)` block in `RawOutbox.swift` and so does not exist off
+  Darwin). Without those flags all four fail with `sqlite3.h not found` (GRDB's CSQLite). `StrandDesign`
+  needs SwiftUI and is macOS-only. Android JVM unit tests **do** run on Linux.
+  **None of this is CI-enforced** — `swift-packages.yml` is macOS-only, so Linux support is honour-system
+  and a change can break it silently.
 - **App targets** (`Strand`, `NOOPiOS`) need **Xcode on macOS**; `StrandTests` runs only under
   `xcodebuild … test` on macOS — locally, or via `app-build.yml`, which does run it on the `Strand` leg.
   Since that workflow is **disabled by default**, app-target tests are only as validated as your last
diff --git a/Packages/StrandImport/Sources/StrandImport/AppleHealthImporter.swift b/Packages/StrandImport/Sources/StrandImport/AppleHealthImporter.swift
index 5c23641340..00bf923510 100644
--- a/Packages/StrandImport/Sources/StrandImport/AppleHealthImporter.swift
+++ b/Packages/StrandImport/Sources/StrandImport/AppleHealthImporter.swift
@@ -1,4 +1,9 @@
 import Foundation
+#if canImport(FoundationXML)
+// corelibs Foundation moved the event-driven XML parser into its own module; Darwin keeps it in
+// Foundation. Conditional so one import serves both, with no #if at the use sites.
+import FoundationXML
+#endif
 import ZIPFoundation
 
 /// Parses an Apple Health export (`export.xml`, possibly inside `export.zip`)
diff --git a/Packages/StrandImport/Sources/StrandImport/CorelibsCompat.swift b/Packages/StrandImport/Sources/StrandImport/CorelibsCompat.swift
new file mode 100644
index 0000000000..4867b5f83e
--- /dev/null
+++ b/Packages/StrandImport/Sources/StrandImport/CorelibsCompat.swift
@@ -0,0 +1,19 @@
+import Foundation
+
+// Small corelibs shims so the package builds on Linux as well as Darwin. Each one exists because a
+// Foundation facility this package uses is Objective-C-runtime-backed on Apple platforms and simply
+// absent elsewhere — never because behaviour should differ.
+
+#if !canImport(ObjectiveC)
+/// No-op stand-in for Apple's `autoreleasepool`.
+///
+/// Without an Objective-C runtime there are no autoreleased temporaries to drain, so running the body
+/// directly is the exact equivalent rather than an approximation. The Darwin call sites keep their real
+/// pool, which is load-bearing there: the Apple Health importer drains per XML element because a
+/// multi-year `export.xml` bridges tens of millions of attribute dictionaries.
+///
+/// Mirrors the shim GRDB already ships for the same reason, so the two agree on the spelling.
+@inlinable func autoreleasepool<Result>(invoking body: () throws -> Result) rethrows -> Result {
+    try body()
+}
+#endif
diff --git a/Packages/StrandImport/Sources/StrandImport/GpxParser.swift b/Packages/StrandImport/Sources/StrandImport/GpxParser.swift
index 2623001ecf..29b1ab9806 100644
--- a/Packages/StrandImport/Sources/StrandImport/GpxParser.swift
+++ b/Packages/StrandImport/Sources/StrandImport/GpxParser.swift
@@ -1,4 +1,9 @@
 import Foundation
+#if canImport(FoundationXML)
+// corelibs Foundation moved the event-driven XML parser into its own module; Darwin keeps it in
+// Foundation. Conditional so one import serves both, with no #if at the use sites.
+import FoundationXML
+#endif
 
 // MARK: - GPX parser (the universal GPS-track format)
 //
diff --git a/Packages/StrandImport/Sources/StrandImport/TcxParser.swift b/Packages/StrandImport/Sources/StrandImport/TcxParser.swift
index 6a393c492f..40d9040afa 100644
--- a/Packages/StrandImport/Sources/StrandImport/TcxParser.swift
+++ b/Packages/StrandImport/Sources/StrandImport/TcxParser.swift
@@ -1,4 +1,9 @@
 import Foundation
+#if canImport(FoundationXML)
+// corelibs Foundation moved the event-driven XML parser into its own module; Darwin keeps it in
+// Foundation. Conditional so one import serves both, with no #if at the use sites.
+import FoundationXML
+#endif
 
 // MARK: - TCX parser (Garmin Training Center XML)
 //
diff --git a/Packages/StrandImport/Tests/StrandImportTests/AppleHealthImporterTests.swift b/Packages/StrandImport/Tests/StrandImportTests/AppleHealthImporterTests.swift
index c420275835..13d50e5452 100644
--- a/Packages/StrandImport/Tests/StrandImportTests/AppleHealthImporterTests.swift
+++ b/Packages/StrandImport/Tests/StrandImportTests/AppleHealthImporterTests.swift
@@ -1,4 +1,8 @@
 import XCTest
+#if canImport(FoundationXML)
+// See the source files: corelibs keeps XMLParser in its own module.
+import FoundationXML
+#endif
 @testable import StrandImport
 
 final class AppleHealthImporterTests: XCTestCase {
diff --git a/docs/BUILD.md b/docs/BUILD.md
index a72233bf2a..41efbd040c 100644
--- a/docs/BUILD.md
+++ b/docs/BUILD.md
@@ -86,7 +86,7 @@ brew install xcodegen
 The packages themselves only need a Swift toolchain — they build and test with plain `swift build`
 / `swift test`, no Xcode project required.
 
-### StrandAnalytics tests on Linux
+### Swift package tests on Linux
 
 Install Swift 6 or newer plus a C compiler, `curl`, and `unzip`. GRDB uses SQLite's snapshot API,
 which distribution builds commonly omit, so build a private snapshot-enabled library:
@@ -105,8 +105,20 @@ LD_LIBRARY_PATH="$SQLITE_SNAPSHOT_DIR${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}" \
 ```
 
 This currently runs 1,523 platform-neutral package tests with one intentional skip. It does not run
-iOS simulator/UI tests, Darwin's Compression-backed raw outbox, or the standalone `WhoopStore`
-test target. The existing package CI remains macOS-only.
+iOS simulator/UI tests or Darwin's Compression-backed raw outbox. The existing package CI remains
+macOS-only.
+
+The same two flags work for the other GRDB-linked packages — swap the `cd` and repeat:
+
+| Package | Linux status |
+|---|---|
+| `StrandAnalytics` | builds + tests (1,523, one skip) |
+| `StrandImport` | builds + tests (249, one skip) |
+| `NoopLocalAccess` | builds + tests |
+| `WhoopStore` | **builds**, but its test target does not compile: `ReadTests` uses `ClockRef`, declared inside the `#if canImport(Compression)` block in `RawOutbox.swift`, so it is absent off Darwin |
+| `StrandDesign` | macOS only (SwiftUI) |
+
+Because none of this runs in CI, treat a green Linux run as a convenience rather than a guarantee.
 
 ---
 

From eb5fadcc2a9fc5472fdb3c16077f2d3bace126d6 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 17:36:44 +1200
Subject: [PATCH 083/333] WhoopStore: ClockRef is not a compression type, and
 its tests run on Linux

#1529 wrapped RawOutbox.swift whole in `#if canImport(Compression)` so the
zlib-backed outbox compiles only where Compression exists. The guard was right; its
REACH was not. ClockRef happened to be declared in that file, so it vanished off
Darwin along with it - and ClockRef is not a raw-outbox type at all. It is the
strap-clock/wall-clock correlation the LIVE and BACKFILL paths carry: Collector,
Backfiller, a whole ClockCorrelation.swift built to produce one, and BLEManager in
three places. It reached the outbox only because RawBatchMeta stores the same pair.
It now lives in its own file, outside the guard, where its independence is
structural rather than a comment.

That alone did not make the tests compile, and the remaining failures were honest
ones: enqueueRawBatch, pruneRaw and allBatchIdsForTest genuinely need Compression.
All five PruneTests drive the outbox - including the one that proves pruning does
NOT touch decoded tables, which needs a raw batch to prove it - so that file is
guarded whole, the same treatment RawOutboxTests already gets. In ReadTests only
testStorageStats reaches the outbox, so only the raw seeding and the two raw
assertions are gated; its decoded-row count is platform-neutral and still asserts
on Linux rather than being lost with them.

Verified: 439 tests, zero failures on Linux, and testStorageStats passes there with
its decoded half intact. Darwin is unchanged - every guarded test still compiles and
runs in the macOS job, which is what must stay true.

All four GRDB-linked packages now build and test on Linux. The docs said WhoopStore
could not, which was true when I wrote it an hour ago and is not now.
---
 CLAUDE.md                                      |  6 ++----
 .../Sources/WhoopStore/ClockRef.swift          | 18 ++++++++++++++++++
 .../Sources/WhoopStore/RawOutbox.swift         |  6 ------
 .../Tests/WhoopStoreTests/PruneTests.swift     |  4 ++++
 .../Tests/WhoopStoreTests/ReadTests.swift      |  6 ++++++
 docs/BUILD.md                                  |  8 ++++++--
 6 files changed, 36 insertions(+), 12 deletions(-)
 create mode 100644 Packages/WhoopStore/Sources/WhoopStore/ClockRef.swift

diff --git a/CLAUDE.md b/CLAUDE.md
index 816b1f1e26..532c7d577b 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -138,10 +138,8 @@ Swift, you MUST build the app yourself: `xcodebuild … build` locally, or run `
 ### Local walls (things that will *not* build where you expect)
 - **On Linux:** `WhoopProtocol` / `OuraProtocol` (pure) build & test with a bare toolchain. The
   GRDB-linked packages need the snapshot-enabled SQLite build in [`docs/BUILD.md`](docs/BUILD.md) — with
-  it, `StrandAnalytics` (1523 tests), `StrandImport` (249) and `NoopLocalAccess` build AND test;
-  `WhoopStore` builds but its TEST target does not compile (`ReadTests` reaches for `ClockRef`, which is
-  declared inside the `#if canImport(Compression)` block in `RawOutbox.swift` and so does not exist off
-  Darwin). Without those flags all four fail with `sqlite3.h not found` (GRDB's CSQLite). `StrandDesign`
+  it, all four build AND test: `StrandAnalytics` (1523), `WhoopStore` (439), `StrandImport` (249) and
+  `NoopLocalAccess` (9). Without those flags they fail with `sqlite3.h not found` (GRDB's CSQLite). `StrandDesign`
   needs SwiftUI and is macOS-only. Android JVM unit tests **do** run on Linux.
   **None of this is CI-enforced** — `swift-packages.yml` is macOS-only, so Linux support is honour-system
   and a change can break it silently.
diff --git a/Packages/WhoopStore/Sources/WhoopStore/ClockRef.swift b/Packages/WhoopStore/Sources/WhoopStore/ClockRef.swift
new file mode 100644
index 0000000000..4553bb7a10
--- /dev/null
+++ b/Packages/WhoopStore/Sources/WhoopStore/ClockRef.swift
@@ -0,0 +1,18 @@
+import Foundation
+
+/// The strap-clock ↔ wall-clock correlation captured at the start of a session.
+///
+/// Declared here rather than beside the raw outbox because it has nothing to do with it. This is the
+/// type the LIVE and BACKFILL paths carry — `Collector`, `Backfiller`, `ClockCorrelation` and
+/// `BLEManager` all hold one, and every historical decode is offset by it. It reached the raw outbox
+/// only because `RawBatchMeta` stores the same pair alongside a batch.
+///
+/// It previously lived inside `RawOutbox.swift`, which is wrapped whole in `#if canImport(Compression)`
+/// so the zlib-backed outbox compiles only on Apple platforms. That guard took this type with it, so on
+/// a platform without Compression the entire clock-correlation vocabulary vanished from the module's
+/// public API — a file-level guard reaching well past the surface it was meant to gate.
+public struct ClockRef: Equatable, Codable {
+    public let device: Int
+    public let wall: Int
+    public init(device: Int, wall: Int) { self.device = device; self.wall = wall }
+}
diff --git a/Packages/WhoopStore/Sources/WhoopStore/RawOutbox.swift b/Packages/WhoopStore/Sources/WhoopStore/RawOutbox.swift
index 4b2955f8db..c717bac61e 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/RawOutbox.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/RawOutbox.swift
@@ -4,12 +4,6 @@ import Compression
 import GRDB
 import WhoopProtocol
 
-public struct ClockRef: Equatable, Codable {
-    public let device: Int
-    public let wall: Int
-    public init(device: Int, wall: Int) { self.device = device; self.wall = wall }
-}
-
 public struct RawBatchMeta: Equatable {
     public let batchId: String
     public let deviceId: String
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/PruneTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/PruneTests.swift
index 4bedfed80f..97b624e0a9 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/PruneTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/PruneTests.swift
@@ -1,3 +1,6 @@
+#if canImport(Compression)
+// Every test here drives the zlib-backed raw outbox (pruneRaw / RawBatchMeta), which exists only
+// where Compression does. Same treatment RawOutboxTests gets, for the same reason.
 import XCTest
 import WhoopProtocol
 @testable import WhoopStore
@@ -79,3 +82,4 @@ final class PruneTests: XCTestCase {
     }
 
 }
+#endif
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
index f906ca75a0..597411d1fd 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
@@ -289,17 +289,23 @@ final class ReadTests: XCTestCase {
                     ppgWaveform: [PpgWaveformSample(ts: 400, samples: [1, 2, 3])],
                     v18Aux: [V18AuxSample(ts: 400, slotValues: [1, 2])]),
             deviceId: "dev1")
+        // The raw outbox is Compression-backed and absent off Darwin; the DECODED half of this count is
+        // platform-neutral and still worth asserting there, so only the raw seeding is gated.
+#if canImport(Compression)
         try await store.enqueueRawBatch(
             RawBatchMeta(batchId: "b1", deviceId: "dev1",
                          clockRef: ClockRef(device: 0, wall: 0), capturedAt: 1,
                          startTs: 0, endTs: 0, frameCount: 1, byteSize: 4),
             frames: [[0xAA, 0x00, 0x01, 0x02]])
+#endif
         let stats = try await store.storageStats()
         // dev1: 3 hr + 2 rr + 1 event + 1 battery + 1 spo2 + 1 skinTemp + 1 resp + 1 gravity
         //       + 1 step + 1 sleepState + 1 ppgHr + 1 ppgWaveform + 1 v18Aux = 16
         // other: 1 hr = 1 → 17 decoded rows.
         XCTAssertEqual(stats.decodedRows, 17)
+#if canImport(Compression)
         XCTAssertEqual(stats.rawBatches, 1)
         XCTAssertEqual(stats.rawBytes, 4)
+#endif
     }
 }
diff --git a/docs/BUILD.md b/docs/BUILD.md
index 41efbd040c..8d4cc2d07c 100644
--- a/docs/BUILD.md
+++ b/docs/BUILD.md
@@ -113,11 +113,15 @@ The same two flags work for the other GRDB-linked packages — swap the `cd` and
 | Package | Linux status |
 |---|---|
 | `StrandAnalytics` | builds + tests (1,523, one skip) |
+| `WhoopStore` | builds + tests (439) |
 | `StrandImport` | builds + tests (249, one skip) |
-| `NoopLocalAccess` | builds + tests |
-| `WhoopStore` | **builds**, but its test target does not compile: `ReadTests` uses `ClockRef`, declared inside the `#if canImport(Compression)` block in `RawOutbox.swift`, so it is absent off Darwin |
+| `NoopLocalAccess` | builds + tests (9) |
 | `StrandDesign` | macOS only (SwiftUI) |
 
+The Compression-backed raw outbox is Darwin-only, so the tests that drive it (`RawOutboxTests`,
+`PruneTests`, and the raw half of `ReadTests.testStorageStats`) compile out off Darwin. Everything they
+cover still runs in the macOS CI job.
+
 Because none of this runs in CI, treat a green Linux run as a convenience rather than a guarantee.
 
 ---

From aaaea35660282e5d1ea3b7c0a88eb93b669aaccf Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 18:02:02 +1200
Subject: [PATCH 084/333] ble: persist the hello-deferral run across process
 restarts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Field log from build 384 read "Deferred once so far — expected on the connect that
asks" for a strap that has never completed a handshake. The count was per app
process, and the app had restarted; a log is usually exported well AFTER the
restart that hid the run. So the one line meant to distinguish "the experiment is
working" from "this has never once worked" was stating the former about the latter.

The run moves to SharedPreferences. Reads are guarded and fall back to 0, which
under-states rather than inventing a history. Cleared exactly where the run
genuinely ends - a hello the stack accepted, and a genuine bond - and NOT in
reset(), which runs on every disconnect and would defeat the point.

The guidance latch stays per-process on purpose: a new process should state the
full paragraph once more, because whoever just restarted the app is the reader
most likely to need it.

Two things this caught on the way through. The rename broke the ordering contract
test that pins "the run is only cleared AFTER the stack accepts the write" - it
had pinned the old spelling, so it failed loudly rather than silently passing over
a moved invariant, which is what a source contract is for. And the old field's doc
block was left stacked above the new one, still claiming "per app process, like
the override budget" - true when written, false the moment the value was
persisted, and exactly the stale-comment shape this file has been cleaning up all
week. Removed rather than reworded, since the new block says it.

4852 tests green, doc lint clean, no new warnings.
---
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 40 +++++++++++++------
 .../noop/ble/StalledLinkDiagnosticsTest.kt    | 24 ++++++++++-
 2 files changed, 50 insertions(+), 14 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 2f5a880319..4d59593bdb 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -2383,16 +2383,28 @@ class WhoopBleClient(
      *  backfill deferral can say whether the handshake was ever reachable. Cleared in [reset]. */
     @Volatile private var helloWrittenThisLink = false
 
-    /** Consecutive connects that deferred the hello to the pairing experiment without writing one.
-     *  Deliberately NOT cleared in [reset] — the whole point is that it survives the connection, since
-     *  one deferral is the experiment working and a run of them is the permanent SMP-0x05 state. Reset
-     *  when a hello is written or a genuine bond is reached. Per app process, like the override budget. */
-    @Volatile private var helloDeferredConsecutive = 0
+    /** Key for the persisted deferral run. In SharedPreferences rather than memory because the run is the
+     *  whole point: one deferral is the experiment working, a long run is the permanent SMP-0x05 state,
+     *  and a process restart used to reset the count to 1 and print "expected on the connect that asks"
+     *  over a strap that had never once completed a handshake. A field log is usually taken well after
+     *  the restart that hid it. */
+    private val helloDeferredKey = "ble.helloDeferredConsecutive"
+
+    /** The run so far. Guarded: a prefs failure must never break a connect, and 0 reads as "no run", which
+     *  is the safe direction - it under-states rather than inventing a history. */
+    private fun helloDeferredRun(): Int =
+        runCatching { NoopPrefs.of(context).getInt(helloDeferredKey, 0) }.getOrDefault(0)
+
+    private fun setHelloDeferredRun(value: Int) {
+        runCatching { NoopPrefs.of(context).edit().putInt(helloDeferredKey, value).apply() }
+    }
 
     /** Whether the deferral's full guidance paragraph has been printed for the CURRENT run. The deferral
      *  fires once per connect on a path documented to loop (57 cycles in an hour, see [HelloSuppression]),
      *  so the paragraph is one-shot per run and later connects log a terse countable line instead. Same
-     *  latch idiom as [helloOverrideExhaustedLogged]. Cleared wherever [helloDeferredConsecutive] is. */
+     *  latch idiom as [helloOverrideExhaustedLogged]. Deliberately NOT persisted alongside the run: a new
+     *  process should state the guidance once more, because whoever restarted the app is the reader most
+     *  likely to need it. */
     @Volatile private var helloDeferredGuidanceLogged = false
 
     /** How many times [beginBackfill] has declined on this link, so repeats carry a count instead of
@@ -5986,7 +5998,7 @@ class WhoopBleClient(
                     // these as REALTIME_DATA — the strap rejected them on the unauthenticated link), then arm
                     // realtime HR with puffin framing. Mirrors the macOS post-bond flow.
                     didBond = true
-                    helloDeferredConsecutive = 0  // the handshake works on this strap; the run is over
+                    setHelloDeferredRun(0)        // the handshake works on this strap; the run is over
                     helloDeferredGuidanceLogged = false
                     helloOverrideAttempts = 0     // #1635: the strap answered — the override's budget resets
                     helloOverrideExhaustedLogged = false
@@ -7827,7 +7839,7 @@ class WhoopBleClient(
             // where a concurrent reader saw a hello that had not gone out, and cleared the deferral run
             // on an attempt that failed — under-reporting the very run the count exists to measure.
             helloWrittenThisLink = true
-            helloDeferredConsecutive = 0
+            setHelloDeferredRun(0)
             helloDeferredGuidanceLogged = false
         } else {
             writeInFlight = false
@@ -7942,11 +7954,12 @@ class WhoopBleClient(
                     // This branch used to return without a word, so the hello's absence was visible only
                     // as a line that never appeared — and the deferral reads identically on the first
                     // connect and the fiftieth. The count is what separates them.
-                    helloDeferredConsecutive += 1
+                    val deferralRun = helloDeferredRun() + 1
+                    setHelloDeferredRun(deferralRun)
                     val fullGuidance = !helloDeferredGuidanceLogged
-                    if (helloDeferredConsecutive >= 2) helloDeferredGuidanceLogged = true
+                    if (deferralRun >= 2) helloDeferredGuidanceLogged = true
                     log(helloDeferredByExplicitBondLine(
-                        consecutive = helloDeferredConsecutive,
+                        consecutive = deferralRun,
                         overrideOptedIn = overrideOptedIn,
                         overrideAttempts = helloOverrideAttempts,
                         full = fullGuidance,
@@ -9359,8 +9372,9 @@ class WhoopBleClient(
         connectHandshakeDone = false
         helloWrittenThisLink = false
         backfillDeferralsThisLink = 0
-        // helloDeferredConsecutive is deliberately NOT cleared: it counts ACROSS connections, which is
-        // the only way a permanent deferral is distinguishable from a pending one.
+        // The deferral run is deliberately NOT cleared: it counts ACROSS connections AND across process
+        // restarts (it lives in SharedPreferences), which is the only way a permanent deferral is
+        // distinguishable from a pending one.
         familyEstablished = false   // the next link re-establishes it at service discovery
         loggedFirmwareGate = null
         clientHelloWriteAtMs = 0L
diff --git a/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt b/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
index d611c80d6b..ea5b0c2777 100644
--- a/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
+++ b/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
@@ -269,13 +269,35 @@ class StalledLinkDiagnosticsTest {
             .substringBefore("\n    }")
         val call = fn.indexOf("val ok = safeGatt(\"writeClientHello\")")
         val claim = fn.indexOf("helloWrittenThisLink = true")
-        val run = fn.indexOf("helloDeferredConsecutive = 0")
+        val run = fn.indexOf("setHelloDeferredRun(0)")
         assertTrue("writeClientHello must call safeGatt", call >= 0)
         assertTrue("the write must be claimed, somewhere", claim >= 0)
         assertTrue("helloWrittenThisLink must be set AFTER the stack accepts", claim > call)
         assertTrue("the deferral run must only be cleared AFTER the stack accepts", run > call)
     }
 
+    /**
+     * The deferral run must SURVIVE a process restart, which is the only reason it is in
+     * SharedPreferences rather than a field. A field log is usually exported well after the restart that
+     * would have reset it, and a run of 1 prints "expected on the connect that asks" - the opposite of
+     * the truth for a strap that has never once completed a handshake. Field-backed, that read is exactly
+     * what the first version of this got wrong.
+     */
+    @Test
+    fun `the deferral run is persisted rather than held in memory`() {
+        val src = clientSource()
+        assertTrue("the run must be READ from prefs at the deferral site",
+                   src.contains("val deferralRun = helloDeferredRun() + 1"))
+        assertTrue("and written straight back", src.contains("setHelloDeferredRun(deferralRun)"))
+        assertTrue("the line must report the persisted value", src.contains("consecutive = deferralRun,"))
+        // Cleared exactly where the run genuinely ends: a hello that went out, and a genuine bond.
+        assertTrue(src.contains("setHelloDeferredRun(0)        // the handshake works on this strap"))
+        // ...and NOT in reset(), which runs on every disconnect and would defeat the whole point.
+        val resetBody = src.substringAfter("private fun reset() {").substringBefore("\n    }")
+        assertFalse("reset() must not clear the cross-connection run",
+                    resetBody.contains("setHelloDeferredRun"))
+    }
+
     @Test
     fun `the default gap is one minute`() {
         assertEquals(true, shouldEmitLiveInsertFailure(1L, 60_001L))

From 7939bbb75263b3015c330f19aef395cb8fc4233c Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 18:11:49 +1200
Subject: [PATCH 085/333] collect: the Swift live-persist catches were silent
 too

#1738 gave the Android live-persist catches a voice and said plainly that the Swift
twins at Collector.swift:218 and :274 were NOT fixed. They still swallowed the
error while re-buffering, so a store rejecting every insert produced a log full of
`rr emit ... offered=N` and no sign that none of it landed - instrumentation that
reads like success, which is the worst shape a diagnostic gap can take.

Both paths report now, each naming its transport, rate-limited to a minute, with a
consecutive-failure count. Per-transport because the standard 0x2A37 path and the
puffin REALTIME_DATA path (#1118) fail independently: a shared counter would let
one path's success reset the other's run and report a persistent failure as a
string of first-failures. @MainActor isolation makes the counters safe without a
lock, unlike the Kotlin twin's AtomicInteger, whose two flushes can genuinely run
concurrently - the asymmetry is deliberate and recorded at the site.

The line builder lives in StrandAnalytics rather than beside its caller, because
Collector is app-target Swift with no default CI, and the package is where the
other emitted-line builders already sit and get tested.

Byte-identical to the Kotlin rendering, and now provably so. Both suites assert the
SAME whole-line literal rather than `contains` fragments - every fragment check
would still pass with a stray space or a moved clause, so equality is the assertion
that actually holds the two platforms together. The Kotlin side gained that
assertion here too; it had only fragments before.

Verified on Linux: 1656 StrandAnalytics tests and 4853 Android tests, zero
failures. Collector itself is app-target, so its type-check needs app-build.
---
 .../StrandAnalytics/LivePersistTrace.swift    | 64 +++++++++++++
 .../LivePersistTraceTests.swift               | 89 +++++++++++++++++++
 Strand/Collect/Collector.swift                | 36 ++++++++
 .../noop/ble/StalledLinkDiagnosticsTest.kt    | 23 +++++
 4 files changed, 212 insertions(+)
 create mode 100644 Packages/StrandAnalytics/Sources/StrandAnalytics/LivePersistTrace.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LivePersistTraceTests.swift

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/LivePersistTrace.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/LivePersistTrace.swift
new file mode 100644
index 0000000000..f06b501bc2
--- /dev/null
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/LivePersistTrace.swift
@@ -0,0 +1,64 @@
+import Foundation
+
+/// A live HR/R-R batch failed to persist and was re-buffered.
+///
+/// `Collector` re-queues the frames and swallows the error, so a store rejecting every insert produces a
+/// log full of `rr emit … offered=N` and no indication that none of it landed. That is the worst shape a
+/// diagnostic gap can take: the instrumentation that exists reads like success.
+///
+/// Byte-identical twin of the Kotlin `liveInsertFailedLine` in `com.noop.ble.StalledLinkDiagnostics`, so
+/// an Android and an Apple log of the same failure compare directly. The Kotlin side lives beside its
+/// caller in the BLE package; this one lives here because `Collector` is app-target Swift with no default
+/// CI, and the package is where the other emitted-line builders (`Spo2ReTrace`, `SleepStager+Trace`,
+/// `ConnectionReadout`) already sit and get tested.
+public enum LivePersistTrace {
+
+    /// - Parameters:
+    ///   - transport: which live path failed. There are TWO — the standard 0x2A37 reading and the puffin
+    ///     REALTIME_DATA batch (#1118) — and they fail independently. A line that did not say which would
+    ///     leave a reader unable to tell one dead transport from a dead store, the first fork in the
+    ///     diagnosis.
+    ///   - errorName: the error's type name. Spelled `throwableName` in the Kotlin twin; the rendered
+    ///     line is identical.
+    ///   - consecutiveFailures: matters more than any single error. One failure is the transient the
+    ///     re-buffer exists to absorb; a climbing count is a store that will never accept these rows, and
+    ///     only the count separates them.
+    public static func liveInsertFailedLine(
+        transport: String,
+        errorName: String,
+        message: String?,
+        hrFrames: Int,
+        rrFrames: Int,
+        consecutiveFailures: Int
+    ) -> String {
+        // Bounded like the Kotlin `take(200)`: a full error description can be enormous, and the useful
+        // cases (a full disk, a corrupted database, a schema mismatch) are distinguished well inside it.
+        let detail = message.flatMap { m -> String? in
+            let trimmed = m.trimmingCharacters(in: .whitespacesAndNewlines)
+            return trimmed.isEmpty ? nil : ": " + String(m.prefix(200))
+        } ?? ""
+        let run = consecutiveFailures >= 2
+            ? " \(consecutiveFailures) consecutive failures — these rows are not landing and the re-buffer is"
+                + " not recovering them."
+            : " Re-buffered for the next cadence."
+        return "Live persist FAILED on \(transport) — \(errorName)\(detail) (hr=\(hrFrames) rr=\(rrFrames))."
+            + run
+    }
+
+    /// Rate limit for ``liveInsertFailedLine(transport:errorName:message:hrFrames:rrFrames:consecutiveFailures:)``.
+    ///
+    /// The live cadence is seconds, so an unconditional log would bury the rest of the capture under a
+    /// failure it has already reported. The gap is deliberately long: this line establishes THAT inserts
+    /// are failing and roughly for how long, which one line a minute answers as well as sixty.
+    ///
+    /// A zero `lastEmitMs` must emit — the first failure is the one most worth having. A BACKWARDS clock
+    /// emits too: wall time can step back, and comparing only forwards would strand `lastEmitMs` in the
+    /// future and silence the line until real time caught up. Byte-identical rule to the Kotlin twin.
+    public static func shouldEmitLiveInsertFailure(
+        lastEmitMs: Int64,
+        nowMs: Int64,
+        minGapMs: Int64 = 60_000
+    ) -> Bool {
+        lastEmitMs <= 0 || nowMs < lastEmitMs || nowMs - lastEmitMs >= minGapMs
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LivePersistTraceTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LivePersistTraceTests.swift
new file mode 100644
index 0000000000..25d6f8db2f
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LivePersistTraceTests.swift
@@ -0,0 +1,89 @@
+import XCTest
+@testable import StrandAnalytics
+
+/// Byte-identical oracle against the Kotlin `liveInsertFailedLine`. The expected strings are the exact
+/// ones `StalledLinkDiagnosticsTest` pins on the Android side, so a one-sided wording change fails here
+/// rather than drifting apart in the two field logs these are meant to be read beside each other.
+final class LivePersistTraceTests: XCTestCase {
+
+    /// Two live transports fail independently (#1118), so the line must say which.
+    func testNamesTheFailingTransport() {
+        XCTAssertTrue(LivePersistTrace.liveInsertFailedLine(
+            transport: "live-standard", errorName: "E", message: nil,
+            hrFrames: 1, rrFrames: 1, consecutiveFailures: 1).contains("on live-standard"))
+        XCTAssertTrue(LivePersistTrace.liveInsertFailedLine(
+            transport: "live-realtime", errorName: "E", message: nil,
+            hrFrames: 1, rrFrames: 1, consecutiveFailures: 1).contains("on live-realtime"))
+    }
+
+    /// One failure is the transient the re-buffer absorbs; a run is a store that will not take these rows.
+    /// If both rendered the same the count would be decoration.
+    func testOneFailureReadsTransientAndARunReadsAsNotRecovering() {
+        let once = LivePersistTrace.liveInsertFailedLine(
+            transport: "live-standard", errorName: "SQLiteFullException",
+            message: "database or disk is full", hrFrames: 12, rrFrames: 13, consecutiveFailures: 1)
+        XCTAssertTrue(once.contains("Re-buffered for the next cadence."))
+        XCTAssertFalse(once.contains("consecutive failures"))
+
+        let many = LivePersistTrace.liveInsertFailedLine(
+            transport: "live-standard", errorName: "SQLiteFullException",
+            message: "database or disk is full", hrFrames: 12, rrFrames: 13, consecutiveFailures: 9)
+        XCTAssertTrue(many.contains("9 consecutive failures"))
+        XCTAssertTrue(many.contains("not recovering them."))
+    }
+
+    /// Whole-line equality, not `contains`: this is the assertion that actually holds the two platforms
+    /// together, since a stray space or a moved clause would still satisfy every check above.
+    func testWholeLineMatchesTheKotlinRendering() {
+        XCTAssertEqual(
+            LivePersistTrace.liveInsertFailedLine(
+                transport: "live-standard", errorName: "SQLiteFullException",
+                message: "database or disk is full", hrFrames: 12, rrFrames: 13, consecutiveFailures: 9),
+            "Live persist FAILED on live-standard — SQLiteFullException: database or disk is full"
+                + " (hr=12 rr=13). 9 consecutive failures — these rows are not landing and the re-buffer"
+                + " is not recovering them.")
+        XCTAssertEqual(
+            LivePersistTrace.liveInsertFailedLine(
+                transport: "live-realtime", errorName: "IllegalStateException", message: nil,
+                hrFrames: 0, rrFrames: 4, consecutiveFailures: 1),
+            "Live persist FAILED on live-realtime — IllegalStateException (hr=0 rr=4)."
+                + " Re-buffered for the next cadence.")
+    }
+
+    func testMessageSurvivesAndIsBounded() {
+        let line = LivePersistTrace.liveInsertFailedLine(
+            transport: "live-standard", errorName: "IllegalStateException",
+            message: String(repeating: "x", count: 500), hrFrames: 1, rrFrames: 2, consecutiveFailures: 1)
+        XCTAssertTrue(line.contains(String(repeating: "x", count: 200)))
+        XCTAssertFalse(line.contains(String(repeating: "x", count: 201)))
+    }
+
+    func testBlankOrAbsentMessageLeavesNoDanglingSeparator() {
+        for message in [nil, "   "] as [String?] {
+            let line = LivePersistTrace.liveInsertFailedLine(
+                transport: "live-standard", errorName: "IllegalStateException", message: message,
+                hrFrames: 1, rrFrames: 2, consecutiveFailures: 1)
+            XCTAssertFalse(line.contains(": ("), "a blank message must not leave a dangling colon")
+        }
+    }
+
+    // MARK: - rate limit
+
+    /// The first failure is the one most worth having, so "never emitted" must not read as "just emitted".
+    func testFirstFailureAlwaysEmits() {
+        XCTAssertTrue(LivePersistTrace.shouldEmitLiveInsertFailure(lastEmitMs: 0, nowMs: 1_000))
+        XCTAssertTrue(LivePersistTrace.shouldEmitLiveInsertFailure(lastEmitMs: -5, nowMs: 1_000))
+    }
+
+    func testGapIsHonouredAtItsBoundary() {
+        XCTAssertFalse(LivePersistTrace.shouldEmitLiveInsertFailure(lastEmitMs: 1_000, nowMs: 60_999))
+        XCTAssertTrue(LivePersistTrace.shouldEmitLiveInsertFailure(lastEmitMs: 1_000, nowMs: 61_000))
+    }
+
+    /// A clock that steps backwards must not latch the line off until real time catches up.
+    func testBackwardsClockEmitsRatherThanLatchingOff() {
+        XCTAssertTrue(LivePersistTrace.shouldEmitLiveInsertFailure(lastEmitMs: 10_000, nowMs: 5_000))
+        XCTAssertTrue(LivePersistTrace.shouldEmitLiveInsertFailure(
+            lastEmitMs: Int64.max / 2, nowMs: 1_000))
+    }
+}
diff --git a/Strand/Collect/Collector.swift b/Strand/Collect/Collector.swift
index 4b7c56d138..e1931a7e68 100644
--- a/Strand/Collect/Collector.swift
+++ b/Strand/Collect/Collector.swift
@@ -85,6 +85,18 @@ final class Collector {
     private var lastStdRrCensusSec: Int = 0
     private var lastRealtimeRrCensusSec: Int = 0
 
+    /// Consecutive live-persist failures per transport, and when each last reported.
+    ///
+    /// Kept PER TRANSPORT because the standard 0x2A37 path and the puffin REALTIME_DATA path (#1118) fail
+    /// independently — a shared counter would let one path's success reset the other's run and report a
+    /// persistent failure as a string of first-failures. @MainActor isolation makes these safe without a
+    /// lock; the Kotlin twin uses AtomicInteger because its two flushes can run concurrently on the io
+    /// scope, and there the count is the load-bearing distinction between a transient and a run.
+    private var stdInsertFailures = 0
+    private var realtimeInsertFailures = 0
+    private var lastStdInsertFailureLogMs: Int64 = 0
+    private var lastRealtimeInsertFailureLogMs: Int64 = 0
+
     /// Standard 0x2A37 HR/RR buffer — the reliable, always-on stream, recorded continuously
     /// (independent of the custom realtime stream or which screen is open).
     private var stdHR: [HRSample] = []
@@ -215,9 +227,22 @@ final class Collector {
         }
         do {
             try await store.insert(streams, deviceId: deviceId)   // DECODED FIRST (durable)
+            realtimeInsertFailures = 0
         } catch {
             // Re-buffer at the front so these frames (and their parses) are retried on the next cadence.
             buffer.insert(contentsOf: batch, at: 0)
+            // Swallowing this made the census above read like success: a store rejecting everything still
+            // reported what was OFFERED, with nothing to say none of it landed.
+            realtimeInsertFailures += 1
+            let nowMs = Int64(Date().timeIntervalSince1970 * 1000)
+            if LivePersistTrace.shouldEmitLiveInsertFailure(lastEmitMs: lastRealtimeInsertFailureLogMs,
+                                                            nowMs: nowMs) {
+                lastRealtimeInsertFailureLogMs = nowMs
+                log?(LivePersistTrace.liveInsertFailedLine(
+                    transport: "live-realtime", errorName: String(describing: type(of: error)),
+                    message: error.localizedDescription, hrFrames: streams.hr.count,
+                    rrFrames: streams.rr.count, consecutiveFailures: realtimeInsertFailures))
+            }
             return
         }
         // Reset only after a successful insert so the interval trigger keeps firing if
@@ -271,9 +296,20 @@ final class Collector {
         }
         do {
             try await store.insert(Streams(hr: hr, rr: rr), deviceId: deviceId)
+            stdInsertFailures = 0
         } catch {
             stdHR.insert(contentsOf: hr, at: 0)
             stdRR.insert(contentsOf: rr, at: 0)
+            stdInsertFailures += 1
+            let nowMs = Int64(Date().timeIntervalSince1970 * 1000)
+            if LivePersistTrace.shouldEmitLiveInsertFailure(lastEmitMs: lastStdInsertFailureLogMs,
+                                                            nowMs: nowMs) {
+                lastStdInsertFailureLogMs = nowMs
+                log?(LivePersistTrace.liveInsertFailedLine(
+                    transport: "live-standard", errorName: String(describing: type(of: error)),
+                    message: error.localizedDescription, hrFrames: hr.count, rrFrames: rr.count,
+                    consecutiveFailures: stdInsertFailures))
+            }
         }
     }
 
diff --git a/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt b/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
index ea5b0c2777..3a8463cf24 100644
--- a/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
+++ b/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
@@ -174,6 +174,29 @@ class StalledLinkDiagnosticsTest {
         assertTrue(many.contains("not recovering them"))
     }
 
+    /**
+     * Whole-line equality against the SAME literal the Swift `LivePersistTraceTests` pins, not `contains`.
+     * The two platforms emit this line into logs meant to be read beside each other, and every
+     * `contains` check above would still pass with a stray space or a moved clause. This is the
+     * assertion that actually holds them together.
+     */
+    @Test
+    fun `the whole line matches the Swift rendering byte for byte`() {
+        assertEquals(
+            "Live persist FAILED on live-standard — SQLiteFullException: database or disk is full" +
+                " (hr=12 rr=13). 9 consecutive failures — these rows are not landing and the re-buffer" +
+                " is not recovering them.",
+            liveInsertFailedLine("live-standard", "SQLiteFullException", "database or disk is full",
+                                 hrFrames = 12, rrFrames = 13, consecutiveFailures = 9),
+        )
+        assertEquals(
+            "Live persist FAILED on live-realtime — IllegalStateException (hr=0 rr=4)." +
+                " Re-buffered for the next cadence.",
+            liveInsertFailedLine("live-realtime", "IllegalStateException", null,
+                                 hrFrames = 0, rrFrames = 4, consecutiveFailures = 1),
+        )
+    }
+
     /** The message distinguishes the useful cases; the class alone rarely does. */
     @Test
     fun `the throwable message survives and is bounded`() {

From 97734cc5133adcf522abf2d9aab56245eb839200 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 18:27:05 +1200
Subject: [PATCH 086/333] staging: build 385/266 for the persisted deferral run
 and the Swift twins

versionCode 384 -> 385, CURRENT_PROJECT_VERSION 265 -> 266. Display version holds
at 10.6.1: v10.6.0 is still the latest release, so only the build numbers move.
385 is +1 on the staging high-water, so a sideload updates in place.

Carries six commits over 384. The one that changes what a strap log SAYS is the
persisted hello-deferral run: 384 reported "Deferred once so far" for a strap that
has never completed a handshake, because the count reset with the process. The
rest are the Swift live-persist twin, the Linux package work, and the Kotlin
warning cleanup - none of which alter behaviour on the phone.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 2d866bf8dd..ad9fea1bf4 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 384
+        versionCode = 385
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index ae2ee2904e..e1c91953df 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "265"
+    CURRENT_PROJECT_VERSION: "266"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 97881d983dedb7c3531ae2b98188f75705946639 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 19:36:32 +1200
Subject: [PATCH 087/333] staging: build 387/268 to put testing-latest back on
 the main line
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A testing build cut from the #1455 branch took the staging high-water to 386, and
testing-latest with it. Restoring main means clearing that high-water, not
re-cutting 385: 385 is a DOWNGRADE against an installed 386, which Android refuses
outright with "app not installed" — the #1303-era trap where staging and main
counters leapfrog.

So versionCode 385 -> 387 and CURRENT_PROJECT_VERSION 266 -> 268, skipping the
numbers the PR build consumed. Display version holds at 10.6.1.

Contains no PR content: the serial-identity work stays unmerged on its own branch,
and its disposable version bump never touched main.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index ad9fea1bf4..0d4c064206 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 385
+        versionCode = 387
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index e1c91953df..b229f463b6 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "266"
+    CURRENT_PROJECT_VERSION: "268"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From ac068c158a32c319e3f46686673e19e53e005ffc Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 20:16:26 +1200
Subject: [PATCH 088/333] feat(ble): adopt a stable whoop-<serial> identity for
 5.0/MG (#1455)

WHOOP identity is otherwise a TRANSIENT CoreBluetooth UUID or Bluetooth address, so a re-pair or factory reset mints a fresh one and the same physical strap forks into a second registry row, orphaning its history (#1193). The 5/MG already reads its own serial from DIS 0x2A25 at connect for MG-vs-5.0 discrimination, so this consumes a value already in hand and adds no BLE traffic. A 4.0 is untouched: it exposes no DIS serial and the 4.0 serial's source on the wire is still unidentified, so there is nothing honest to adopt onto.

The refusals are the feature. Adoption migrates every device-scoped row onto whatever id is returned, so a blank, truncated or descriptive-prose read yields nil and leaves the strap where it is - moving a history onto a garbage key is worse than not adopting. Serials are upper-cased so one strap read twice cannot become two ids, and the legacy `my-whoop` seed is deliberately EXCLUDED from adoption until #1304 retires the ~47 literals that still assume it.

THREE DEFECTS WERE FOUND BEFORE THIS LANDED, and the last one is why the hardware gate existed.

Review found that the migration re-keyed by exact match on the pairing id, which never equals its COMPUTED sibling `<deviceId>-noop` - the scored days, detected workouts and metric series the engine derives. That half stayed behind while the next scoring pass wrote under the new sibling, stranding the computed history under an id nothing reads again: the orphaned history this exists to prevent, displaced onto the derived side. The "already proven, already shipped" reasoning did not cover it because a RING has no computed sibling to strand.

Review also found that once a device id IS the serial, the strap log prints it everywhere - the Devices list, every dayOwner line, the per-source counts - and neither redaction rule caught that shape. The PR's own privacy test passed throughout, because it covered the deliberate three-character truncation on the adoption line and not the id flowing into every other line.

HARDWARE found the third. On a real 5/MG the registry re-pointed and all 25 computed days migrated correctly, but `NoopApplication.activeDeviceId` was a `by lazy`, frozen for the life of the process, so the scoring pass went on deriving days under the PRE-adoption id and the computed history split across both until the phone was restarted. No code reading could have surfaced that; it needed a strap adopting a real serial.

VALIDATED: one Android 5/MG, fresh-adoption path, one serial format. Adoption fired two seconds after the DIS read on an UNBONDED link, all 25 computed days arrived under the new id, the paired 4.0 was untouched, and the redaction held - the serial appears nowhere in the resulting logs.

ACCEPTED, KNOWINGLY: the Apple path is NOT hardware-validated. It defers off the CoreBluetooth callback with different timing, uses GRDB, and re-keys every device-scoped row, and neither platform is behind a feature flag - so this reaches iOS and macOS users on their next connect. The re-pair merge branch and other serial formats are unit-tested only. What bounds the downside is the refusal path: an unexpected serial yields nil and the strap keeps its existing id, so the failure mode for an unfamiliar shape is no adoption rather than corrupted ids.
---
 .../WhoopStore/DeviceRegistryStore.swift      |  21 +++-
 .../WhoopStore/WhoopSerialIdentity.swift      |  69 +++++++++++
 .../DeviceRegistryStoreTests.swift            |  46 ++++++++
 .../WhoopSerialIdentityTests.swift            |  66 +++++++++++
 Strand/App/AppModel.swift                     |   6 +
 Strand/BLE/BLEManager.swift                   |  49 ++++++++
 Strand/BLE/LiveState.swift                    |  14 +++
 StrandTests/HeaderRedactionTests.swift        |  21 ++++
 .../src/main/java/com/noop/NoopApplication.kt |  40 +++++--
 .../main/java/com/noop/ble/WhoopBleClient.kt  |  45 +++++++
 .../main/java/com/noop/data/DeviceRegistry.kt |  69 +++++++----
 .../java/com/noop/data/WhoopSerialIdentity.kt |  83 +++++++++++++
 .../src/main/java/com/noop/ui/AppViewModel.kt |  38 ++++++
 .../java/com/noop/ble/PiiRedactionTest.kt     |  42 +++++++
 .../com/noop/data/WhoopSerialIdentityTest.kt  | 111 ++++++++++++++++++
 15 files changed, 684 insertions(+), 36 deletions(-)
 create mode 100644 Packages/WhoopStore/Sources/WhoopStore/WhoopSerialIdentity.swift
 create mode 100644 Packages/WhoopStore/Tests/WhoopStoreTests/WhoopSerialIdentityTests.swift
 create mode 100644 android/app/src/main/java/com/noop/data/WhoopSerialIdentity.kt
 create mode 100644 android/app/src/test/java/com/noop/data/WhoopSerialIdentityTest.kt

diff --git a/Packages/WhoopStore/Sources/WhoopStore/DeviceRegistryStore.swift b/Packages/WhoopStore/Sources/WhoopStore/DeviceRegistryStore.swift
index 0793863242..1c38d097a3 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/DeviceRegistryStore.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/DeviceRegistryStore.swift
@@ -108,6 +108,11 @@ public struct DeviceRegistryStore: Sendable {
         }
     }
 
+    /// Suffix of the COMPUTED sibling every device id owns — the engine writes its derived days, detected
+    /// workouts and metric series under `<deviceId>-noop`. Spelled here so the adoption can carry it with
+    /// the pairing; the Kotlin twin is `WhoopRepository.computedDeviceId`.
+    public static let computedSuffix = "-noop"
+
     /// Every table whose rows are keyed by `deviceId` (the per-device sample/derived tables). This is
     /// the authoritative list `deleteAllData` clears — kept in sync with the `deviceId`-keyed tables in
     /// `Database.swift`. The `pairedDevice` registry row itself is NOT here (a delete-data operation
@@ -198,9 +203,19 @@ public struct DeviceRegistryStore: Sendable {
                 """, arguments: [serialId, activeId])
             }
             // Move the active id's recordings onto the serial id (canonical wins a PK clash), then clear it.
-            for table in Self.deviceScopedTables {
-                try db.execute(sql: "UPDATE OR IGNORE \(table) SET deviceId = ? WHERE deviceId = ?", arguments: [serialId, activeId])
-                try db.execute(sql: "DELETE FROM \(table) WHERE deviceId = ?", arguments: [activeId])
+            //
+            // BOTH id shapes, not just the pairing's own. Every strap also owns a COMPUTED sibling keyed
+            // `<deviceId>-noop` — the scored days, detected workouts and metric series the engine derives
+            // — and that id is never equal to `activeId`, so an exact-match re-key silently left it behind.
+            // The next scoring pass then writes under `<serialId>-noop`, stranding the old computed
+            // history under an id nothing reads again: the orphaned-history failure this adoption exists
+            // to PREVENT, displaced onto the computed half. The ring path never hit it because a ring has
+            // no computed sibling to strand, which is why the shipped migration looked proven.
+            for (from, to) in [(activeId, serialId), (activeId + Self.computedSuffix, serialId + Self.computedSuffix)] {
+                for table in Self.deviceScopedTables {
+                    try db.execute(sql: "UPDATE OR IGNORE \(table) SET deviceId = ? WHERE deviceId = ?", arguments: [to, from])
+                    try db.execute(sql: "DELETE FROM \(table) WHERE deviceId = ?", arguments: [from])
+                }
             }
             // Drop ONLY the provisional CB-UUID registry rows; other oura-* pairings are left as-is.
             try db.execute(sql: "DELETE FROM pairedDevice WHERE id = ?", arguments: [activeId])
diff --git a/Packages/WhoopStore/Sources/WhoopStore/WhoopSerialIdentity.swift b/Packages/WhoopStore/Sources/WhoopStore/WhoopSerialIdentity.swift
new file mode 100644
index 0000000000..ec221112e9
--- /dev/null
+++ b/Packages/WhoopStore/Sources/WhoopStore/WhoopSerialIdentity.swift
@@ -0,0 +1,69 @@
+import Foundation
+
+/// The stable WHOOP device id derived from the strap's own serial (#1303).
+///
+/// WHOOP strap identity is otherwise a TRANSIENT CoreBluetooth UUID: a re-pair or factory reset mints a
+/// fresh one, so the same physical strap forks into a second registry row and orphans its history (#1193).
+/// The ring path already solved this — `DeviceRegistryStore.adoptSerialIdentity` re-points a provisional id
+/// onto a serial id and migrates every device-scoped row — and this is the WHOOP half of the same idea.
+///
+/// Pure and store-free so both platforms can pin the composition and, more importantly, the REFUSALS: a
+/// blank or implausible serial must yield nil and leave the existing id alone. Adopting onto a junk id
+/// would be worse than not adopting at all, because the migration moves every row onto it.
+///
+/// Kotlin twin: `WhoopSerialIdentity`.
+public enum WhoopSerialIdentity {
+
+    /// The one place the WHOOP id namespace is spelled. `AddDeviceWizard` mints `whoop-<CB-UUID>` and
+    /// `DeviceRegistryStore` classifies on the same prefix; a serial id joins the same namespace so every
+    /// existing prefix check keeps working unchanged.
+    public static let idPrefix = "whoop"
+
+    /// Shortest serial worth adopting. A 5.0/MG DIS serial is far longer; this only rejects a truncated or
+    /// placeholder read, which a partial GATT response can produce.
+    public static let minSerialLength = 6
+
+    /// The `whoop-<serial>` id for a strap serial, or nil when the serial cannot be trusted to identify it.
+    ///
+    /// Refuses blank/whitespace, anything under `minSerialLength`, and any serial carrying a character
+    /// outside `[A-Z0-9-]` after upper-casing — a DIS read that returns a descriptive string rather than a
+    /// serial should never become a device id. Upper-cased so the same strap read twice, in either case,
+    /// resolves to ONE id rather than two.
+    public static func adoptedId(serial: String?) -> String? {
+        guard let raw = serial?.trimmingCharacters(in: .whitespacesAndNewlines), !raw.isEmpty else { return nil }
+        let up = raw.uppercased()
+        guard up.count >= minSerialLength else { return nil }
+        let allowed = Set("ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-")
+        guard up.allSatisfy({ allowed.contains($0) }) else { return nil }
+        return "\(idPrefix)-\(up)"
+    }
+
+    /// Whether this pairing's id may be re-pointed onto a serial id at all.
+    ///
+    /// ONLY a provisional `whoop-<CB-UUID>` id qualifies. The legacy `my-whoop` seed is deliberately
+    /// EXCLUDED, and that exclusion is what makes this safe to ship before #1304: every existing
+    /// single-WHOOP install is still on that seed, ~47 code paths still read the literal `"my-whoop"`
+    /// directly, and `WhoopBleClient.deviceId` documents that the single-WHOOP path never reassigns it.
+    /// Adopting it would migrate the whole history onto `whoop-<serial>` while new samples kept being
+    /// written under `my-whoop` — a split history that reads as data loss.
+    ///
+    /// The legacy seed joins this path as part of #1304, once the literals no longer assume it.
+    public static func mayAdopt(currentId: String) -> Bool {
+        currentId.hasPrefix("\(idPrefix)-")
+    }
+
+    /// True when `id` is already the serial id for `serial` — the steady state on every reconnect after the
+    /// first adoption, and the cheap early-out that keeps re-adoption from doing database work per connect.
+    public static func isAlreadyAdopted(id: String, serial: String?) -> Bool {
+        guard let target = adoptedId(serial: serial) else { return false }
+        return id == target
+    }
+
+    /// What may be written to a SHAREABLE strap log. The serial identifies the device, so only its leading
+    /// characters are ever logged — the same rule `noteWhoop5VariantFromDIS` already applies to the variant
+    /// line. Never log `adoptedId`'s result directly.
+    public static func logSafe(serial: String?) -> String {
+        guard let raw = serial?.trimmingCharacters(in: .whitespacesAndNewlines), !raw.isEmpty else { return "?" }
+        return String(raw.uppercased().prefix(3)) + "…"
+    }
+}
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/DeviceRegistryStoreTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/DeviceRegistryStoreTests.swift
index 25dd08f32a..51ae1bfbc4 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/DeviceRegistryStoreTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/DeviceRegistryStoreTests.swift
@@ -222,6 +222,52 @@ final class DeviceRegistryStoreTests: XCTestCase {
         XCTAssertEqual(row?.model, "Oura Ring 3")
     }
 
+    /// The computed sibling must travel with the pairing.
+    ///
+    /// Every strap owns a second id, `<deviceId>-noop`, holding the days/workouts/series the engine
+    /// DERIVES. It never equals `activeId`, so an exact-match re-key left it behind while the next scoring
+    /// pass wrote under `<serialId>-noop` — stranding the computed history under an id nothing reads
+    /// again, which is the orphaned-history failure adoption exists to prevent. A ring has no computed
+    /// sibling, so the shipped Oura path could never surface this.
+    func testAdoptSerialCarriesTheComputedSibling() throws {
+        let dbq = try makeDB(); let store = DeviceRegistryStore(dbQueue: dbq)
+        let cbuuid = "whoop-4DD70E24", serial = "whoop-MGB1234567"
+        try addOura(store, cbuuid, peripheralId: "4DD70E24", status: .paired, addedAt: 100)
+        try store.setActive(cbuuid)
+        try dbq.write { db in
+            try db.execute(sql: "INSERT INTO hrSample (deviceId, ts, bpm) VALUES ('whoop-4DD70E24', 10, 55)")
+            // the DERIVED half, under the computed sibling
+            try db.execute(sql: "INSERT INTO hrSample (deviceId, ts, bpm) VALUES ('whoop-4DD70E24-noop', 11, 56)")
+        }
+
+        XCTAssertTrue(try store.adoptSerialIdentity(from: cbuuid, to: serial))
+
+        XCTAssertEqual(try hrCount(dbq, serial), 1)
+        XCTAssertEqual(try hrCount(dbq, cbuuid), 0)
+        XCTAssertEqual(try hrCount(dbq, serial + "-noop"), 1, "computed rows must follow the pairing")
+        XCTAssertEqual(try hrCount(dbq, cbuuid + "-noop"), 0, "and must not be left behind")
+    }
+
+    /// A PK clash on the COMPUTED side resolves the same way as on the real id: canonical wins, source is
+    /// cleared, nothing is duplicated. Worth pinning separately because the clash is reachable only after
+    /// a re-pair that already scored days under the serial's own computed sibling.
+    func testAdoptSerialMergesComputedSiblingsOnClash() throws {
+        let dbq = try makeDB(); let store = DeviceRegistryStore(dbQueue: dbq)
+        let cbuuid = "whoop-0102A826", serial = "whoop-MGB7654321"
+        try addOura(store, serial, peripheralId: "OLDPID", status: .paired, addedAt: 100)
+        try addOura(store, cbuuid, peripheralId: "0102A826", status: .paired, addedAt: 200)
+        try store.setActive(cbuuid)
+        try dbq.write { db in
+            try db.execute(sql: "INSERT INTO hrSample (deviceId, ts, bpm) VALUES ('whoop-MGB7654321-noop', 10, 50)")
+            try db.execute(sql: "INSERT INTO hrSample (deviceId, ts, bpm) VALUES ('whoop-0102A826-noop', 20, 60)")
+        }
+
+        try store.adoptSerialIdentity(from: cbuuid, to: serial)
+
+        XCTAssertEqual(try hrCount(dbq, serial + "-noop"), 2)
+        XCTAssertEqual(try hrCount(dbq, cbuuid + "-noop"), 0)
+    }
+
     func testAdoptSerialMergesWhenSerialAlreadyExists() throws {
         let dbq = try makeDB(); let store = DeviceRegistryStore(dbQueue: dbq)
         let serial = "oura-2H3B2405003655", cbuuid2 = "oura-0102A826"
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/WhoopSerialIdentityTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/WhoopSerialIdentityTests.swift
new file mode 100644
index 0000000000..4c8b0d68ce
--- /dev/null
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/WhoopSerialIdentityTests.swift
@@ -0,0 +1,66 @@
+import XCTest
+@testable import WhoopStore
+
+/// The REFUSALS matter more than the composition: adoption migrates every device-scoped row onto the id
+/// this returns, so a junk serial must yield nil and leave the strap on its existing id rather than move a
+/// history onto a garbage key (#1303). Kotlin twin: `WhoopSerialIdentityTest`.
+final class WhoopSerialIdentityTests: XCTestCase {
+
+    func testComposesTheSerialId() {
+        XCTAssertEqual(WhoopSerialIdentity.adoptedId(serial: "5AG12345678"), "whoop-5AG12345678")
+    }
+
+    func testUpperCasesSoOneStrapCannotBecomeTwoIds() {
+        XCTAssertEqual(WhoopSerialIdentity.adoptedId(serial: "5ag12345678"),
+                       WhoopSerialIdentity.adoptedId(serial: "5AG12345678"))
+    }
+
+    func testTrimsSurroundingWhitespaceFromTheGattString() {
+        XCTAssertEqual(WhoopSerialIdentity.adoptedId(serial: "  5AG12345678\n"), "whoop-5AG12345678")
+    }
+
+    func testRefusesBlankOrMissing() {
+        XCTAssertNil(WhoopSerialIdentity.adoptedId(serial: nil))
+        XCTAssertNil(WhoopSerialIdentity.adoptedId(serial: ""))
+        XCTAssertNil(WhoopSerialIdentity.adoptedId(serial: "   \n "))
+    }
+
+    func testRefusesATruncatedRead() {
+        // A partial GATT response must not become an id: it would collide across straps.
+        XCTAssertNil(WhoopSerialIdentity.adoptedId(serial: "5AG"))
+    }
+
+    func testRefusesADescriptiveStringThatIsNotASerial() {
+        // Some peripherals answer DIS with prose. Never let that become a device id.
+        XCTAssertNil(WhoopSerialIdentity.adoptedId(serial: "Not Available"))
+        XCTAssertNil(WhoopSerialIdentity.adoptedId(serial: "serial#1234"))
+    }
+
+    func testAlreadyAdoptedIsTheReconnectEarlyOut() {
+        XCTAssertTrue(WhoopSerialIdentity.isAlreadyAdopted(id: "whoop-5AG12345678", serial: "5AG12345678"))
+        XCTAssertFalse(WhoopSerialIdentity.isAlreadyAdopted(id: "whoop-ABCDEF-0123", serial: "5AG12345678"))
+        // An unusable serial is never "already adopted" — otherwise a junk read would silently suppress a
+        // later good one.
+        XCTAssertFalse(WhoopSerialIdentity.isAlreadyAdopted(id: "whoop-5AG12345678", serial: "  "))
+    }
+
+    /// The guard that makes this safe to ship before #1304. Every existing single-WHOOP install is on the
+    /// legacy `my-whoop` seed, ~47 code paths read that literal directly, and `WhoopBleClient` never
+    /// reassigns its deviceId on the single-WHOOP path — so adopting it would migrate the history onto
+    /// `whoop-<serial>` while new samples kept landing under `my-whoop`. A split history reads as data loss.
+    func testRefusesToAdoptTheLegacySingleWhoopSeed() {
+        XCTAssertFalse(WhoopSerialIdentity.mayAdopt(currentId: "my-whoop"))
+        // A provisional pairing id IS adoptable — that is the multi-strap case this ships for.
+        XCTAssertTrue(WhoopSerialIdentity.mayAdopt(currentId: "whoop-6B9F2C11-0000-4000-8000-0000000000AA"))
+        // An already-adopted serial id stays adoptable; the equality check upstream stops the re-migration.
+        XCTAssertTrue(WhoopSerialIdentity.mayAdopt(currentId: "whoop-5AG12345678"))
+        // Another brand's id is never touched by the WHOOP path.
+        XCTAssertFalse(WhoopSerialIdentity.mayAdopt(currentId: "oura-2H3B2405003655"))
+    }
+
+    func testLogSafeNeverLeaksTheFullSerial() {
+        XCTAssertEqual(WhoopSerialIdentity.logSafe(serial: "5AG12345678"), "5AG…")
+        XCTAssertEqual(WhoopSerialIdentity.logSafe(serial: nil), "?")
+        XCTAssertFalse(WhoopSerialIdentity.logSafe(serial: "5AG12345678").contains("12345678"))
+    }
+}
diff --git a/Strand/App/AppModel.swift b/Strand/App/AppModel.swift
index a7e1d0894b..7cfcebd92a 100644
--- a/Strand/App/AppModel.swift
+++ b/Strand/App/AppModel.swift
@@ -560,6 +560,12 @@ final class AppModel: ObservableObject {
             })
         coordinator.start()
         self.deviceRegistry = registry
+        // #1303: adoption re-points the strap onto its stable `whoop-<serial>` id inside BLEManager (which
+        // holds only the non-observable store), so mirror it onto the OBSERVABLE registry here or the
+        // Devices screen and the source coordinator keep watching an id that no longer exists.
+        self.ble.onSerialIdentityAdopted = { [weak registry] serialId in
+            registry?.setActive(serialId)
+        }
         self.sourceCoordinator = coordinator
         // #814 READ SPINE (HIGH-1): drive the read side off the registry's `activeDeviceId` for the WHOLE
         // session, exactly as SourceCoordinator drives the WRITE side off the SAME publisher. A Devices-
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index c42a01a8b9..e40ff37521 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -561,6 +561,11 @@ public final class BLEManager: NSObject, ObservableObject {
     private let router: FrameRouter
     private var collector: Collector?
     /// #716: stored on bootstrap so the scan callback can fix the seeded "WHOOP" model label.
+    /// #1303: fired after the strap's history has been re-pointed onto its stable `whoop-<serial>` id.
+    /// The live persist paths are already re-pointed inline by then; this exists so the OBSERVABLE spine
+    /// (`DeviceRegistry`, and the coordinator that watches it) follows too — the store write above is not
+    /// observable, so without this the UI would keep showing the old id until relaunch.
+    var onSerialIdentityAdopted: ((String) -> Void)?
     private var registryStore: DeviceRegistryStore?
     /// #716: true once the seeded "WHOOP" model has been stamped to the correct family.
     private var modelStamped = false
@@ -4563,6 +4568,50 @@ public final class BLEManager: NSObject, ObservableObject {
         // existing consumer — nothing about framing or decode reads this.
         state.whoop5Variant = variant.label
         reconcileModelFromAttestation(variant)
+        adoptWhoopSerialIdentity()
+    }
+
+    /// #1303: the 5/MG DIS read hands us the strap's OWN serial, so re-point this pairing from its
+    /// transient CoreBluetooth-UUID id onto a stable `whoop-<serial>` id — through the SAME generic
+    /// migration the ring already uses (`adoptSerialIdentity`, #771), so a re-pair or factory reset stops
+    /// forking one physical strap into a second row and orphaning its history (#1193).
+    ///
+    /// A WHOOP 4.0 is deliberately untouched: it does not expose a DIS serial (the read above is gated
+    /// `!= .whoop4`) and the 4.0 serial's source on the wire is not yet identified, so there is nothing
+    /// honest to adopt onto here.
+    ///
+    /// Deferred to the next main-loop turn, mirroring `adoptOuraSerial`: adoption re-points the ACTIVE
+    /// device, and the observers that react tear down and rebuild the very connection this callback is
+    /// running inside, so the current BLE callback must return first. Idempotent — after the first
+    /// adoption the id already equals the serial id, so every later reconnect costs one string compare and
+    /// touches no database. A serial `WhoopSerialIdentity` refuses (blank, truncated, non-serial prose)
+    /// leaves the strap on its existing id: adopting onto a junk id would migrate every device-scoped row
+    /// onto a garbage key, which is worse than not adopting.
+    private func adoptWhoopSerialIdentity() {
+        guard let rs = registryStore,
+              let serialId = WhoopSerialIdentity.adoptedId(serial: disSerial),
+              let active = try? rs.all().first(where: { $0.status == .active }),
+              WhoopSerialIdentity.mayAdopt(currentId: active.id),
+              active.id != serialId
+        else { return }
+        let currentId = active.id
+        Task { @MainActor [weak self] in
+            guard let self, let rs = self.registryStore,
+                  (try? rs.all().first(where: { $0.status == .active }))?.id == currentId
+            else { return }
+            guard (try? rs.adoptSerialIdentity(from: currentId, to: serialId)) == true else { return }
+            try? rs.setActive(serialId)
+            // The rows have MOVED to the serial id and the old registry row is gone, so the live persist
+            // paths must follow in the same turn: `deviceId`, the Collector and the Backfiller all stamp
+            // rows at write time, and leaving them on the now-deleted id would write new samples into a
+            // second, orphaned history — the same split this phase exists to prevent, just on the
+            // provisional path instead of the legacy one. Kotlin reaches the identical call through
+            // `SourceCoordinator.pointWhoop`, which re-points any non-legacy id.
+            self.setActiveDeviceId(serialId)
+            // Prefix only. `serialId` embeds the full serial, which must never reach a shareable log.
+            self.log("Adopted stable serial identity (serialPrefix=\(WhoopSerialIdentity.logSafe(serial: self.disSerial))) - history re-pointed off the transient pairing id (#1303)")
+            self.onSerialIdentityAdopted?(serialId)
+        }
     }
 
     /// The strap's own DIS attestation is ground truth (a WHOOP 4.0 never attests a 5AM/5AG serial). When
diff --git a/Strand/BLE/LiveState.swift b/Strand/BLE/LiveState.swift
index bb324fc052..8b876eaa1d 100644
--- a/Strand/BLE/LiveState.swift
+++ b/Strand/BLE/LiveState.swift
@@ -776,6 +776,20 @@ public final class LiveState: ObservableObject {
         out = out.replacingOccurrences(
             of: "(?![0-9A-Fa-f]{8}-(?:0000-1000-8000-00805f9b34fb|8d6d-82b8-614a-1c8cb0f8dcc6))[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}",
             with: "<device>", options: [.regularExpression, .caseInsensitive])
+        // #1303: an ADOPTED device id (`whoop-<SERIAL>`) is a device identifier in every line that prints
+        // an id. Neither rule above catches it — the MAC rule wants MAC shape and the serial rule wants the
+        // literal "WHOOP " then a DIGIT, while an adopted id is `whoop-` + a serial commonly starting with
+        // a letter. Keeps three characters, matching `WhoopSerialIdentity.logSafe`, so two straps stay
+        // distinguishable; PRESERVES the `-noop` computed-sibling suffix, which is not identifying and is
+        // what lets a reader tell derived rows from measured ones. Six-character minimum matches
+        // `minSerialLength`, so `my-whoop` and `my-whoop-noop` are untouched. Kotlin twin in
+        // `redactStrapLogPii`.
+        out = out.replacingOccurrences(
+            of: "whoop-([A-Za-z0-9]{3})[A-Za-z0-9-]{3,}(-noop)",
+            with: "whoop-$1…$2", options: .regularExpression)
+        out = out.replacingOccurrences(
+            of: "whoop-([A-Za-z0-9]{3})[A-Za-z0-9-]{3,}",
+            with: "whoop-$1…", options: .regularExpression)
         return out
     }
 
diff --git a/StrandTests/HeaderRedactionTests.swift b/StrandTests/HeaderRedactionTests.swift
index f1c4784050..cdb306207f 100644
--- a/StrandTests/HeaderRedactionTests.swift
+++ b/StrandTests/HeaderRedactionTests.swift
@@ -29,6 +29,27 @@ final class HeaderRedactionTests: XCTestCase {
         XCTAssertFalse(containsRawMac(LiveState.redactPii(line)))
     }
 
+    /// #1303: once a strap ADOPTS its serial the device id IS the serial, and this header enumerates every
+    /// paired device. Neither older rule covers that shape — the MAC rule wants MAC form, the serial rule
+    /// wants the literal "WHOOP " then a digit — so before this the header leaked it verbatim.
+    func testAnAdoptedSerialIdIsMasked() {
+        let line = "  device id=whoop-MGB1234567 status=ACTIVE brand=WHOOP model=5.0 MG lastSeen=1h ago"
+        let safe = LiveState.redactPii(line)
+        XCTAssertFalse(safe.contains("1234567"), "serial survived: \(safe)")
+        XCTAssertTrue(safe.contains("whoop-MGB…"), "three-character prefix should remain: \(safe)")
+    }
+
+    /// The `-noop` suffix is not identifying and is what separates derived rows from measured ones in the
+    /// per-source counts, so it must survive the mask that hides the serial in front of it.
+    func testTheComputedSiblingMarkerSurvives() {
+        XCTAssertEqual(LiveState.redactPii("Days: whoop-MGB1234567-noop=25"), "Days: whoop-MGB…-noop=25")
+    }
+
+    /// Anything too short to be accepted as a serial upstream must not be masked as one here either.
+    func testAnIdTooShortToBeASerialIsUntouched() {
+        XCTAssertEqual(LiveState.redactPii("id=whoop-ABCDE"), "id=whoop-ABCDE")
+    }
+
     func testAnIdWithNoAddressIsUntouched() {
         let line = "  device id=my-whoop status=ACTIVE brand=WHOOP model=WHOOP 4.0 lastSeen=3h 10m ago"
         XCTAssertEqual(LiveState.redactPii(line), line)
diff --git a/android/app/src/main/java/com/noop/NoopApplication.kt b/android/app/src/main/java/com/noop/NoopApplication.kt
index e9266a514e..8955a99bc8 100644
--- a/android/app/src/main/java/com/noop/NoopApplication.kt
+++ b/android/app/src/main/java/com/noop/NoopApplication.kt
@@ -60,15 +60,39 @@ class NoopApplication : Application() {
     val deviceRegistry: DeviceRegistry by lazy { DeviceRegistry(WhoopDatabase.get(this)) }
 
     /**
-     * Active device id resolved once at startup from the registry, falling back to the legacy
-     * "my-whoop" if the registry has none yet (so behaviour is unchanged today). Read with a guarded
-     * blocking call — a one-off indexed `LIMIT 1` query at composition time. Any failure (e.g. an early
-     * read before migration) is swallowed and falls back, so startup can never be broken by this.
+     * Active device id, resolved once at startup from the registry and falling back to the legacy
+     * "my-whoop" if the registry has none yet. Read with a guarded blocking call — a one-off indexed
+     * `LIMIT 1` query at composition time. Any failure (e.g. an early read before migration) is swallowed
+     * and falls back, so startup can never be broken by this.
+     *
+     * #1303: NOT a `by lazy`. Serial adoption re-points the ACTIVE device mid-process, and a lazy is
+     * frozen for the life of the process — so every consumer below kept the pre-adoption id until the next
+     * cold start, and the engine went on deriving days under it. Field-confirmed on a 5/MG: the registry
+     * read `whoop-<serial>` while the diagnostics export, and the scoring pass, still used the old
+     * address-based id, splitting the computed history across both until the phone was restarted. Adoption
+     * now calls [onActiveDeviceAdopted] and the handle follows within the process.
+     */
+    @Volatile
+    var activeDeviceId: String = ""
+        get() {
+            if (field.isEmpty()) {
+                field = runCatching { runBlocking { deviceRegistry.activeDeviceId() } }
+                    .onFailure { Log.w("NoopApplication", "activeDeviceId resolve failed; using fallback", it) }
+                    .getOrNull() ?: WhoopBleClient.DEFAULT_DEVICE_ID
+            }
+            return field
+        }
+        private set
+
+    /**
+     * Point this process at the id a strap just adopted (#1303).
+     *
+     * Only the handle moves: the registry write and the row migration have already happened inside
+     * `adoptSerialIdentity`, and the BLE client is re-pointed by its own caller. Kept narrow and
+     * idempotent so a reconnect that re-adopts the same id costs nothing.
      */
-    val activeDeviceId: String by lazy {
-        runCatching { runBlocking { deviceRegistry.activeDeviceId() } }
-            .onFailure { Log.w("NoopApplication", "activeDeviceId resolve failed; using fallback", it) }
-            .getOrNull() ?: WhoopBleClient.DEFAULT_DEVICE_ID
+    fun onActiveDeviceAdopted(newId: String) {
+        if (newId.isNotEmpty() && newId != activeDeviceId) activeDeviceId = newId
     }
 
     /** Process-wide BLE client. Owns the GATT connection and outlives any single Activity/ViewModel. */
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 4d59593bdb..1edf981691 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -3007,6 +3007,17 @@ class WhoopBleClient(
     // #520 DIS identity — read ONCE per connection, post-handshake, 5/MG only. Serial and hardware
     // revision are immutable, so they are never re-polled (unlike the battery). Reset on disconnect.
     private var disRead = false
+    /**
+     * #1303: the strap's DIS serial, once read (5.0/MG only — a 4.0 does not expose one).
+     *
+     * KNOWN ASYMMETRY with the Swift twin, which adopts inline in BLEManager and uses its closure only
+     * to notify. Here the adoption itself lives in the observer (AppViewModel owns the registry handle
+     * and a scope; SourceCoordinator is inert on the WHOOP path by design), so a connect that completes
+     * before any observer is wired emits into a null callback and does not adopt. It is deferred, not
+     * lost: DIS is read on every connect, so the next one with an observer alive adopts. Worth knowing
+     * when reading a capture where iOS shows the adoption line and Android does not.
+     */
+    var onSerial: ((String) -> Unit)? = null
     private var disSerial: String? = null
     private var disHwRev: String? = null
     /** DIS 0x2A24, the strap's own model number — the authoritative variant signal (#520). */
@@ -4675,6 +4686,10 @@ class WhoopBleClient(
         val prefix = disSerial?.trim()?.uppercase()?.take(3) ?: "?"
         log("DIS: serialPrefix=$prefix hwRev=${disHwRev ?: "?"} -> variant=${variant.label}")
         reconcileModelFromAttestation(variant)
+        // #1303: hand the strap's OWN serial up so the coordinator can re-point this pairing onto a stable
+        // `whoop-<serial>` id. Emitted, not acted on here, mirroring how the Oura source reports its serial:
+        // adoption re-points the ACTIVE device and tears down the very connection this callback runs inside.
+        disSerial?.let { onSerial?.invoke(it) }
     }
 
     /** The strap's own DIS attestation is ground truth (a WHOOP 4.0 never attests a 5AM/5AG serial). When
@@ -9684,6 +9699,13 @@ class WhoopBleClient(
         }
     }
 
+    /**
+     * #1303: let the identity owner write one line into the SAME strap log the connection uses, so an
+     * adoption is visible in the capture beside the DIS line that triggered it. Deliberately narrow —
+     * the general [log] stays private. Callers must pass a serial PREFIX, never a full serial.
+     */
+    fun logIdentity(line: String) = log(line)
+
     private fun log(s: String, domain: com.noop.testcentre.TestDomain? = null) {
         // A diagnostic log line must NEVER be able to crash the app. log() runs on the GATT binder
         // thread and from the background reconnect service, so an uncaught throw here takes the WHOLE
@@ -9943,6 +9965,25 @@ class WhoopBleClient(
 private val PII_MAC_RE = Regex("([0-9A-Fa-f]{2}):[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:([0-9A-Fa-f]{2})")
 private val PII_WHOOP_SERIAL_RE = Regex("WHOOP (\\d[0-9A-Za-z]{5,})")
 
+/**
+ * #1303: a device id that has ADOPTED its strap serial (`whoop-<SERIAL>`) is a device identifier in every
+ * line that prints an id — the Devices list, each `dayOwner`, the per-source counts. Neither existing rule
+ * catches it: [PII_MAC_RE] wants MAC shape, and [PII_WHOOP_SERIAL_RE] wants the literal word "WHOOP "
+ * followed by a DIGIT, while an adopted id is `whoop-` + a serial that commonly starts with a letter.
+ * Before adoption existed no device id could contain a serial, so this was not a gap; it is one now.
+ *
+ * Keeps the leading three characters, the same rule `WhoopSerialIdentity.logSafe` already applies to the
+ * adoption line, so two straps stay distinguishable in a log. The `-noop` computed-sibling suffix is
+ * PRESERVED: it is not identifying, and it is what lets a reader tell derived rows from measured ones —
+ * the distinction the "Days:"/"Stored:" lines are read for.
+ *
+ * The six-character minimum is not arbitrary: it matches `WhoopSerialIdentity.minSerialLength`, so
+ * anything short enough to be refused as a serial is also too short to be mistaken for one here. That
+ * also leaves `my-whoop`, `my-whoop-noop` and the MAC form (already masked to `whoop-FD:••…`) untouched.
+ */
+private val PII_ADOPTED_ID_NOOP_RE = Regex("whoop-([A-Za-z0-9]{3})[A-Za-z0-9-]{3,}(-noop)")
+private val PII_ADOPTED_ID_RE = Regex("whoop-([A-Za-z0-9]{3})[A-Za-z0-9-]{3,}")
+
 /**
  * Builds the 9-byte WHOOP 4.0 SET_ALARM_TIME (cmd 66) payload.
  * Layout: `[0x01] + u32 LE epoch + [0x00, 0x00]` subseconds + `[0x00, 0x00]` haptic-mode field.
@@ -10088,6 +10129,10 @@ internal fun alarmReadbackLocalTime(epochSec: Long): String =
 internal fun redactStrapLogPii(s: String): String = try {
     s.replace(PII_MAC_RE, "$1:••:••:••:••:$2")
         .replace(PII_WHOOP_SERIAL_RE, "WHOOP <serial>")
+        // MAC first, deliberately: `whoop-<MAC>` is already `whoop-FD:••…` by now and cannot be mistaken
+        // for an adopted id. The -noop form runs before the general one so the sibling suffix survives.
+        .replace(PII_ADOPTED_ID_NOOP_RE, "whoop-$1…$2")
+        .replace(PII_ADOPTED_ID_RE, "whoop-$1…")
 } catch (t: Throwable) {
     "[redaction error - line withheld]"
 }
diff --git a/android/app/src/main/java/com/noop/data/DeviceRegistry.kt b/android/app/src/main/java/com/noop/data/DeviceRegistry.kt
index 4343190d1e..33d5f7a350 100644
--- a/android/app/src/main/java/com/noop/data/DeviceRegistry.kt
+++ b/android/app/src/main/java/com/noop/data/DeviceRegistry.kt
@@ -89,31 +89,15 @@ class DeviceRegistry(
             } else {
                 dao.upsertPairedDevice(active.copy(id = serialId))
             }
-            dao.reKeyHr(activeId, serialId); dao.deleteHrFor(activeId)
-            dao.reKeyRr(activeId, serialId); dao.deleteRrFor(activeId)
-            dao.reKeySpo2(activeId, serialId); dao.deleteSpo2For(activeId)
-            dao.reKeySkinTemp(activeId, serialId); dao.deleteSkinTempFor(activeId)
-            dao.reKeyResp(activeId, serialId); dao.deleteRespFor(activeId)
-            dao.reKeyGravity(activeId, serialId); dao.deleteGravityFor(activeId)
-            dao.reKeySteps(activeId, serialId); dao.deleteStepsFor(activeId)
-            dao.reKeyPpgHr(activeId, serialId); dao.deletePpgHrFor(activeId)
-            dao.reKeyPpgWaveform(activeId, serialId); dao.deletePpgWaveformFor(activeId)
-            dao.reKeyV18Aux(activeId, serialId); dao.deleteV18AuxFor(activeId)
-            dao.reKeyEvents(activeId, serialId); dao.deleteEventsFor(activeId)
-            dao.reKeyBattery(activeId, serialId); dao.deleteBatteryFor(activeId)
-            dao.reKeyDailyMetrics(activeId, serialId); dao.deleteDailyMetricsFor(activeId)
-            dao.reKeySleepSessions(activeId, serialId); dao.deleteSleepSessionsFor(activeId)
-            dao.reKeyJournal(activeId, serialId); dao.deleteJournalFor(activeId)
-            dao.reKeyWorkouts(activeId, serialId); dao.deleteWorkoutsFor(activeId)
-            dao.reKeyAppleDaily(activeId, serialId); dao.deleteAppleDailyFor(activeId)
-            dao.reKeyAppleStepHour(activeId, serialId); dao.deleteAppleStepHoursFor(activeId)
-            dao.reKeyMetricSeries(activeId, serialId); dao.deleteMetricSeriesFor(activeId)
-            dao.reKeyDayOwnership(activeId, serialId); dao.deleteDayOwnershipFor(activeId)
-            dao.reKeySleepStates(activeId, serialId); dao.deleteSleepStatesFor(activeId)
-            dao.reKeyLabMarkers(activeId, serialId); dao.deleteLabMarkersFor(activeId)
-            dao.reKeyLiveSessions(activeId, serialId); dao.deleteLiveSessionsFor(activeId)
-            dao.reKeyDismissedWorkouts(activeId, serialId); dao.deleteDismissedWorkoutsFor(activeId)
-            dao.reKeyDismissedSleeps(activeId, serialId); dao.deleteDismissedSleepsFor(activeId)
+            // BOTH id shapes. Every strap also owns a COMPUTED sibling keyed `<deviceId>-noop` (see
+            // WhoopRepository.computedDeviceId) holding the scored days, detected workouts and metric
+            // series the engine derives. That id never equals activeId, so re-keying only the pairing's
+            // own id left the computed history stranded under an id nothing reads again while the next
+            // scoring pass wrote under `<serialId>-noop` — the orphaned history this adoption exists to
+            // prevent, displaced onto the computed half. A ring has no computed sibling, which is why the
+            // shipped Oura path never surfaced it.
+            reKeyDeviceScopedRows(activeId, serialId)
+            reKeyDeviceScopedRows(activeId + COMPUTED_SUFFIX, serialId + COMPUTED_SUFFIX)
             dao.deletePairedDeviceRow(activeId)
             dao.deleteDeviceRow(activeId)
             true
@@ -125,6 +109,41 @@ class DeviceRegistry(
     suspend fun touchLastSeen(id: String, now: Long = System.currentTimeMillis() / 1000) =
         dao.touchLastSeen(id, now)
 
+    /** Suffix of the COMPUTED sibling every device id owns; twin of `WhoopRepository.computedDeviceId`
+     *  and the Swift `DeviceRegistryStore.computedSuffix`. */
+    private val COMPUTED_SUFFIX = "-noop"
+
+    /** Move every device-scoped row from [from] onto [to], canonical winning a PK clash, then clear the
+     *  source. Registry rows are deliberately NOT touched here: a computed sibling has none, so the
+     *  pairedDevice/device deletions stay with the caller and run once, for the real pairing only. */
+    private suspend fun reKeyDeviceScopedRows(from: String, to: String) {
+        dao.reKeyHr(from, to); dao.deleteHrFor(from)
+        dao.reKeyRr(from, to); dao.deleteRrFor(from)
+        dao.reKeySpo2(from, to); dao.deleteSpo2For(from)
+        dao.reKeySkinTemp(from, to); dao.deleteSkinTempFor(from)
+        dao.reKeyResp(from, to); dao.deleteRespFor(from)
+        dao.reKeyGravity(from, to); dao.deleteGravityFor(from)
+        dao.reKeySteps(from, to); dao.deleteStepsFor(from)
+        dao.reKeyPpgHr(from, to); dao.deletePpgHrFor(from)
+        dao.reKeyPpgWaveform(from, to); dao.deletePpgWaveformFor(from)
+        dao.reKeyV18Aux(from, to); dao.deleteV18AuxFor(from)
+        dao.reKeyEvents(from, to); dao.deleteEventsFor(from)
+        dao.reKeyBattery(from, to); dao.deleteBatteryFor(from)
+        dao.reKeyDailyMetrics(from, to); dao.deleteDailyMetricsFor(from)
+        dao.reKeySleepSessions(from, to); dao.deleteSleepSessionsFor(from)
+        dao.reKeyJournal(from, to); dao.deleteJournalFor(from)
+        dao.reKeyWorkouts(from, to); dao.deleteWorkoutsFor(from)
+        dao.reKeyAppleDaily(from, to); dao.deleteAppleDailyFor(from)
+        dao.reKeyAppleStepHour(from, to); dao.deleteAppleStepHoursFor(from)
+        dao.reKeyMetricSeries(from, to); dao.deleteMetricSeriesFor(from)
+        dao.reKeyDayOwnership(from, to); dao.deleteDayOwnershipFor(from)
+        dao.reKeySleepStates(from, to); dao.deleteSleepStatesFor(from)
+        dao.reKeyLabMarkers(from, to); dao.deleteLabMarkersFor(from)
+        dao.reKeyLiveSessions(from, to); dao.deleteLiveSessionsFor(from)
+        dao.reKeyDismissedWorkouts(from, to); dao.deleteDismissedWorkoutsFor(from)
+        dao.reKeyDismissedSleeps(from, to); dao.deleteDismissedSleepsFor(from)
+    }
+
     /** Archive a device — keeps its row and samples (invariant I4). */
     suspend fun archive(id: String) = dao.archiveDevice(id)
 
diff --git a/android/app/src/main/java/com/noop/data/WhoopSerialIdentity.kt b/android/app/src/main/java/com/noop/data/WhoopSerialIdentity.kt
new file mode 100644
index 0000000000..9622ccd25b
--- /dev/null
+++ b/android/app/src/main/java/com/noop/data/WhoopSerialIdentity.kt
@@ -0,0 +1,83 @@
+package com.noop.data
+
+/**
+ * The stable WHOOP device id derived from the strap's own serial (#1303). Byte-parity twin of Swift
+ * `WhoopSerialIdentity`.
+ *
+ * WHOOP strap identity is otherwise a TRANSIENT Bluetooth address/UUID: a re-pair or factory reset mints a
+ * fresh one, so the same physical strap forks into a second registry row and orphans its history (#1193).
+ * The ring path already solved this — `DeviceRegistry.adoptSerialIdentity` re-points a provisional id onto
+ * a serial id and migrates every device-scoped row — and this is the WHOOP half of the same idea.
+ *
+ * Pure and store-free so both platforms can pin the composition and, more importantly, the REFUSALS: a
+ * blank or implausible serial must yield null and leave the existing id alone. Adopting onto a junk id
+ * would be worse than not adopting at all, because the migration moves every row onto it.
+ */
+object WhoopSerialIdentity {
+
+    /**
+     * The one place the WHOOP id namespace is spelled. The add-device flow mints `whoop-<address>` and the
+     * registry classifies on the same prefix; a serial id joins the same namespace so every existing prefix
+     * check keeps working unchanged.
+     */
+    const val ID_PREFIX = "whoop"
+
+    /**
+     * Shortest serial worth adopting. A 5.0/MG DIS serial is far longer; this only rejects a truncated or
+     * placeholder read, which a partial GATT response can produce.
+     */
+    const val MIN_SERIAL_LENGTH = 6
+
+    private val ALLOWED = ('A'..'Z').toSet() + ('0'..'9').toSet() + '-'
+
+    /**
+     * The `whoop-<serial>` id for a strap serial, or null when the serial cannot be trusted to identify it.
+     *
+     * Refuses blank/whitespace, anything under [MIN_SERIAL_LENGTH], and any serial carrying a character
+     * outside `[A-Z0-9-]` after upper-casing — a DIS read that returns a descriptive string rather than a
+     * serial should never become a device id. Upper-cased so the same strap read twice, in either case,
+     * resolves to ONE id rather than two.
+     */
+    fun adoptedId(serial: String?): String? {
+        val raw = serial?.trim().orEmpty()
+        if (raw.isEmpty()) return null
+        val up = raw.uppercase()
+        if (up.length < MIN_SERIAL_LENGTH) return null
+        if (!up.all { it in ALLOWED }) return null
+        return "$ID_PREFIX-$up"
+    }
+
+    /**
+     * Whether this pairing's id may be re-pointed onto a serial id at all.
+     *
+     * ONLY a provisional `whoop-<address>` id qualifies. The legacy `my-whoop` seed is deliberately
+     * EXCLUDED, and that exclusion is what makes this safe to ship before #1304: every existing
+     * single-WHOOP install is still on that seed, ~47 code paths still read the literal "my-whoop"
+     * directly, and [com.noop.ble.WhoopBleClient] documents that the single-WHOOP path never reassigns its
+     * deviceId. Adopting it would migrate the whole history onto `whoop-<serial>` while new samples kept
+     * being written under "my-whoop" - a split history that reads as data loss.
+     *
+     * The legacy seed joins this path as part of #1304, once the literals no longer assume it.
+     */
+    fun mayAdopt(currentId: String): Boolean = currentId.startsWith("$ID_PREFIX-")
+
+    /**
+     * True when [id] is already the serial id for [serial] — the steady state on every reconnect after the
+     * first adoption, and the cheap early-out that keeps re-adoption from doing database work per connect.
+     */
+    fun isAlreadyAdopted(id: String, serial: String?): Boolean {
+        val target = adoptedId(serial) ?: return false
+        return id == target
+    }
+
+    /**
+     * What may be written to a SHAREABLE strap log. The serial identifies the device, so only its leading
+     * characters are ever logged — the same rule `noteWhoop5VariantFromDis` already applies to the variant
+     * line. Never log [adoptedId]'s result directly.
+     */
+    fun logSafe(serial: String?): String {
+        val raw = serial?.trim().orEmpty()
+        if (raw.isEmpty()) return "?"
+        return raw.uppercase().take(3) + "…"
+    }
+}
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index 9cdb443016..ff8a75359b 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -839,6 +839,44 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
             ble.connectedPeripheralAddress
                 .collect { addr -> noopApp.sourceCoordinator.connectedPeripheralChanged(addr) }
         }
+        // #1303: the 5/MG DIS read hands up the strap's OWN serial, so re-point this pairing from its
+        // transient address-based id onto a stable `whoop-<serial>` id, through the SAME migration the ring
+        // already uses (#771) — a re-pair or factory reset then stops forking one physical strap into a
+        // second row and orphaning its history (#1193). Lives here rather than in SourceCoordinator, which
+        // is deliberately inert on the WHOOP path and never touches WhoopBleClient internals; this class
+        // already owns the registry handle and a scope. Twin of Swift `BLEManager.adoptWhoopSerialIdentity`.
+        //
+        // A WHOOP 4.0 never reaches here: it exposes no DIS serial, and the 4.0 serial's source on the wire
+        // is not yet identified, so there is nothing honest to adopt onto.
+        ble.onSerial = { serial ->
+            viewModelScope.launch {
+                val serialId = com.noop.data.WhoopSerialIdentity.adoptedId(serial)
+                val currentId = deviceRegistry.activeDeviceId()
+                // Idempotent: once adopted the id already equals the serial id, so a reconnect costs one
+                // string compare and no database work. A serial WhoopSerialIdentity refuses (blank,
+                // truncated, non-serial prose) leaves the strap on its existing id — adopting onto a junk id
+                // would migrate every device-scoped row onto a garbage key, worse than not adopting at all.
+                if (serialId != null && currentId != null && currentId != serialId &&
+                    com.noop.data.WhoopSerialIdentity.mayAdopt(currentId) &&
+                    deviceRegistry.adoptSerialIdentity(currentId, serialId)
+                ) {
+                    // Prefix only. `serialId` embeds the full serial, which must never reach a shared log.
+                    ble.logIdentity(
+                        "WHOOP: adopted stable serial identity (serialPrefix=" +
+                            com.noop.data.WhoopSerialIdentity.logSafe(serial) +
+                            ") - history re-pointed off the transient pairing id (#1303)",
+                    )
+                    deviceRegistry.setActive(serialId)
+                    // The process-wide handle too, not just the registry and the coordinator. It is read
+                    // by the diagnostics export and threaded into the BLE client and the source
+                    // coordinator at startup; leaving it behind meant the engine kept deriving days under
+                    // the PRE-adoption id until the next cold start, splitting the computed history across
+                    // both ids (field-confirmed on a 5/MG before this line existed).
+                    noopApp.onActiveDeviceAdopted(serialId)
+                    noopApp.sourceCoordinator.onActiveDeviceChanged(serialId)
+                }
+            }
+        }
         // Re-arm the strap's firmware alarm once per process-alive day. The firmware alarm is a single
         // absolute instant with NO recurrence and was previously re-armed ONLY on the bond edge — so a
         // strap that stays continuously bonded (a phone in range overnight) would fire once and then
diff --git a/android/app/src/test/java/com/noop/ble/PiiRedactionTest.kt b/android/app/src/test/java/com/noop/ble/PiiRedactionTest.kt
index 2819d45f17..05a1c5dd64 100644
--- a/android/app/src/test/java/com/noop/ble/PiiRedactionTest.kt
+++ b/android/app/src/test/java/com/noop/ble/PiiRedactionTest.kt
@@ -35,6 +35,48 @@ class PiiRedactionTest {
             redactStrapLogPii("Discovered WHOOP 4C1594026 (rssi -63)"))
     }
 
+    /**
+     * #1303: once a strap ADOPTS its serial, its device id IS the serial, and the strap log prints device
+     * ids in the Devices list, every `dayOwner` line and the per-source counts. Before adoption existed no
+     * id could contain a serial, so neither older rule covers this shape.
+     */
+    @Test fun masksAnAdoptedSerialDeviceId() {
+        val out = redactStrapLogPii("device id=whoop-MGB1234567 status=ACTIVE brand=WHOOP")
+        assertEquals("device id=whoop-MGB… status=ACTIVE brand=WHOOP", out)
+        assertFalse("the serial must not survive anywhere", out.contains("1234567"))
+    }
+
+    /**
+     * The `-noop` suffix is NOT identifying and is load-bearing for reading a log: it is what separates
+     * derived rows from measured ones in the "Days:"/"Stored:" lines. Masking it away would take a
+     * diagnostic with it.
+     */
+    @Test fun keepsTheComputedSiblingMarker() {
+        assertEquals("Days: whoop-MGB…-noop=25",
+                     redactStrapLogPii("Days: whoop-MGB1234567-noop=25"))
+    }
+
+    /**
+     * The forms that must survive untouched: the legacy seed and its computed sibling are not serials, and
+     * the provisional MAC id is already masked by the MAC rule before this one sees it.
+     */
+    @Test fun leavesTheLegacySeedAndMaskedMacFormAlone() {
+        assertEquals("readId=my-whoop writeActiveId=my-whoop-noop",
+                     redactStrapLogPii("readId=my-whoop writeActiveId=my-whoop-noop"))
+        // A raw MAC id goes through the MAC rule first and must not then be re-mangled.
+        assertEquals("device id=whoop-FD:••:••:••:••:4A",
+                     redactStrapLogPii("device id=whoop-FD:A1:B2:C3:D4:4A"))
+    }
+
+    /**
+     * Six characters is the floor, matching WhoopSerialIdentity.minSerialLength: anything shorter is
+     * refused as a serial upstream, so it must not be mistaken for one here either.
+     */
+    @Test fun ignoresIdsTooShortToBeASerial() {
+        assertEquals("id=whoop-ABCDE", redactStrapLogPii("id=whoop-ABCDE"))
+        assertEquals("id=whoop-ABC…", redactStrapLogPii("id=whoop-ABCDEF"))
+    }
+
     @Test fun leavesModelNamesAndPlainTextAlone() {
         // "WHOOP 4.0" is a dotted model name, not a serial — must not be scrubbed.
         assertEquals("Auto-reconnecting to your saved WHOOP 4.0…",
diff --git a/android/app/src/test/java/com/noop/data/WhoopSerialIdentityTest.kt b/android/app/src/test/java/com/noop/data/WhoopSerialIdentityTest.kt
new file mode 100644
index 0000000000..22b931de4f
--- /dev/null
+++ b/android/app/src/test/java/com/noop/data/WhoopSerialIdentityTest.kt
@@ -0,0 +1,111 @@
+package com.noop.data
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * Twin of the Swift WhoopSerialIdentityTests. The REFUSALS matter more than the composition: adoption
+ * migrates every device-scoped row onto the id this returns, so a junk serial must yield null and leave
+ * the strap on its existing id rather than move a history onto a garbage key (#1303).
+ */
+class WhoopSerialIdentityTest {
+
+    @Test fun composesTheSerialId() {
+        assertEquals("whoop-5AG12345678", WhoopSerialIdentity.adoptedId("5AG12345678"))
+    }
+
+    @Test fun upperCasesSoOneStrapCannotBecomeTwoIds() {
+        assertEquals(
+            WhoopSerialIdentity.adoptedId("5ag12345678"),
+            WhoopSerialIdentity.adoptedId("5AG12345678"),
+        )
+    }
+
+    @Test fun trimsSurroundingWhitespaceFromTheGattString() {
+        assertEquals("whoop-5AG12345678", WhoopSerialIdentity.adoptedId("  5AG12345678\n"))
+    }
+
+    @Test fun refusesBlankOrMissing() {
+        assertNull(WhoopSerialIdentity.adoptedId(null))
+        assertNull(WhoopSerialIdentity.adoptedId(""))
+        assertNull(WhoopSerialIdentity.adoptedId("   \n "))
+    }
+
+    @Test fun refusesATruncatedRead() {
+        // A partial GATT response must not become an id: it would collide across straps.
+        assertNull(WhoopSerialIdentity.adoptedId("5AG"))
+    }
+
+    @Test fun refusesADescriptiveStringThatIsNotASerial() {
+        // Some peripherals answer DIS with prose. Never let that become a device id.
+        assertNull(WhoopSerialIdentity.adoptedId("Not Available"))
+        assertNull(WhoopSerialIdentity.adoptedId("serial#1234"))
+    }
+
+    @Test fun alreadyAdoptedIsTheReconnectEarlyOut() {
+        assertTrue(WhoopSerialIdentity.isAlreadyAdopted("whoop-5AG12345678", "5AG12345678"))
+        assertFalse(WhoopSerialIdentity.isAlreadyAdopted("whoop-ABCDEF-0123", "5AG12345678"))
+        // An unusable serial is never "already adopted" — otherwise a junk read would silently
+        // suppress a later good one.
+        assertFalse(WhoopSerialIdentity.isAlreadyAdopted("whoop-5AG12345678", "  "))
+    }
+
+    /**
+     * The guard that makes this safe to ship before #1304. Every existing single-WHOOP install is on the
+     * legacy "my-whoop" seed, ~47 code paths read that literal directly, and WhoopBleClient never
+     * reassigns its deviceId on the single-WHOOP path — so adopting it would migrate the history onto
+     * whoop-<serial> while new samples kept landing under "my-whoop". A split history reads as data loss.
+     */
+    @Test fun refusesToAdoptTheLegacySingleWhoopSeed() {
+        assertFalse(WhoopSerialIdentity.mayAdopt("my-whoop"))
+        // A provisional pairing id IS adoptable — that is the multi-strap case this ships for.
+        assertTrue(WhoopSerialIdentity.mayAdopt("whoop-6B9F2C11-0000-4000-8000-0000000000AA"))
+        // An already-adopted serial id stays adoptable; the equality check upstream stops the re-migration.
+        assertTrue(WhoopSerialIdentity.mayAdopt("whoop-5AG12345678"))
+        // Another brand's id is never touched by the WHOOP path.
+        assertFalse(WhoopSerialIdentity.mayAdopt("oura-2H3B2405003655"))
+    }
+
+    /**
+     * The process-wide handle must follow adoption, not wait for a cold start.
+     *
+     * `NoopApplication.activeDeviceId` was a `by lazy`, frozen for the life of the process. Adoption
+     * re-pointed the registry while every consumer of that handle kept the OLD id, so the scoring engine
+     * went on deriving days under the pre-adoption id and the computed history split across both until the
+     * phone was restarted. Confirmed on a real 5/MG: the registry read the serial id while the export
+     * still printed the address id and the old computed bucket kept growing.
+     *
+     * `NoopApplication` needs a Context, so the invariant is pinned against the source the way the other
+     * un-constructable callers are.
+     */
+    @Test fun adoptionRePointsTheProcessWideActiveIdHandle() {
+        var root = java.io.File(System.getProperty("user.dir") ?: ".").canonicalFile
+        var app: String? = null
+        var vm: String? = null
+        repeat(4) {
+            val a = java.io.File(root, "android/app/src/main/java/com/noop/NoopApplication.kt")
+            val v = java.io.File(root, "android/app/src/main/java/com/noop/ui/AppViewModel.kt")
+            if (a.isFile && app == null) app = a.readText()
+            if (v.isFile && vm == null) vm = v.readText()
+            root = root.parentFile ?: root
+        }
+        val application = app ?: error("NoopApplication.kt not found - this test must not pass by default")
+        val viewModel = vm ?: error("AppViewModel.kt not found - this test must not pass by default")
+
+        assertFalse("activeDeviceId must not be a frozen `by lazy` again",
+                    application.contains("val activeDeviceId: String by lazy"))
+        assertTrue("it must expose a way to follow an adoption",
+                   application.contains("fun onActiveDeviceAdopted(newId: String)"))
+        assertTrue("and adoption must actually call it",
+                   viewModel.contains("noopApp.onActiveDeviceAdopted(serialId)"))
+    }
+
+    @Test fun logSafeNeverLeaksTheFullSerial() {
+        assertEquals("5AG…", WhoopSerialIdentity.logSafe("5AG12345678"))
+        assertEquals("?", WhoopSerialIdentity.logSafe(null))
+        assertFalse(WhoopSerialIdentity.logSafe("5AG12345678").contains("12345678"))
+    }
+}

From c6c0c1d2f1a4011db8530dc2bf5d8ad50a346696 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 20:33:17 +1200
Subject: [PATCH 089/333] ble: the pairing experiment must not cost a user
 their history sync

Field regression, dated. #1646 landed the opt-in pairing experiment on 2026-08-26;
a 5/MG stopped syncing that same day and had not synced since. The mechanism is
the one ExplicitBond already documents: a strap answering SMP 0x05 defers its
CLIENT_HELLO to a "next connect" that requests a bond and defers again. No hello
means no bond, no bond means no SET_CLOCK, and an un-clocked 5/MG does not bank to
flash at all - so there is nothing to offload even while the link is healthy. Live
HR streamed the whole time, which is what made it look fine.

Deferring ONCE is the honest form of the original reasoning: give the pairing the
connect it asked for. Deferring again is not caution, it is repeating an experiment
whose answer is already in. The threshold is settled by what each error costs. One
deferral too many costs a user their entire history sync, silently and
permanently - four days here, thirteen backfill deferrals in one session, not one
hello written. One hello too early costs at worst a link drop and reconnect, which
the bond watchdog already handles.

The escape hatch was a SECOND opt-in switch, so avoiding the outage required
discovering and enabling the hello override as well. Nobody would infer that.

Two pieces of copy did real damage and are fixed here too.

The live Test Centre description said the switch "does not require" - true, and
silent about the consequence. It now says a refusing strap defers its handshake
while this is on. (The Settings copy of this card is dead code behind
`if (false && ...)`; the live control moved to Test Centre, and I nearly fixed the
dead one.)

The deferral line I added today printed "(override off)" one clause after the words
"the pairing experiment", and it was read - correctly, on the plain text - as the
EXPERIMENT being off. It was on the whole time. A parenthetical reporting one
setting's state while the sentence names another has to say which is which; it now
names both.

4871 tests, i18n and doc lint clean. BLE behaviour change: needs a strap to confirm
the hello actually goes out on the second connect.
---
 .../main/java/com/noop/ble/ExplicitBond.kt    | 16 ++++++++-
 .../com/noop/ble/StalledLinkDiagnostics.kt    | 10 ++++--
 .../main/java/com/noop/ble/WhoopBleClient.kt  |  6 +++-
 .../main/java/com/noop/ui/TestCentreScreen.kt |  4 ++-
 .../java/com/noop/ble/ExplicitBondTest.kt     | 34 +++++++++++++++++++
 .../noop/ble/StalledLinkDiagnosticsTest.kt    | 10 ++++--
 6 files changed, 71 insertions(+), 9 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ble/ExplicitBond.kt b/android/app/src/main/java/com/noop/ble/ExplicitBond.kt
index 11548ef966..b55b5d44cb 100644
--- a/android/app/src/main/java/com/noop/ble/ExplicitBond.kt
+++ b/android/app/src/main/java/com/noop/ble/ExplicitBond.kt
@@ -68,11 +68,25 @@ internal fun shouldRequestExplicitBond(
  * who has explicitly opted into "send hello despite bond refusal" is asking for exactly this write, and
  * silently swallowing it because a doomed pairing was requested first would make that switch a no-op for
  * everyone running the pairing experiment — which is precisely who would turn it on.
+ *
+ * [priorDeferrals] ends the cycle for everyone else, and is why the override is no longer the only way
+ * out. Deferring ONCE is the honest form of the original reasoning: give the pairing the one connect it
+ * asked for. Deferring again is not caution, it is repeating an experiment whose answer is already in —
+ * this link has now seen a bond requested and not achieved, so the next connect writes the hello.
+ *
+ * The cost of being wrong in each direction is what settles the threshold. Deferring one connect too many
+ * costs a user their entire history sync, silently and permanently: no hello means no bond, no bond means
+ * no SET_CLOCK, and an un-clocked 5/MG does not bank to flash at all, so there is nothing to offload even
+ * once the link is healthy. Writing one hello too early costs, at worst, the link dropping and
+ * reconnecting — the failure this deferral was added to avoid, which the bond watchdog already handles.
+ * Field-confirmed on a 5/MG: four days without a sync, thirteen backfill deferrals in one session, and
+ * not a single hello written since the experiment was enabled.
  */
 internal fun explicitBondDefersHello(
     requestedThisLink: Boolean,
     helloOverride: Boolean = false,
-): Boolean = requestedThisLink && !helloOverride
+    priorDeferrals: Int = 0,
+): Boolean = requestedThisLink && !helloOverride && priorDeferrals < 1
 
 /**
  * The outcome line when `createBond()` THREW rather than returning.
diff --git a/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt b/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
index 400164fa16..a3ba2c70d4 100644
--- a/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
@@ -42,10 +42,14 @@ internal fun helloDeferredByExplicitBondLine(
     full: Boolean = true,
     cap: Int = HELLO_OVERRIDE_MAX_ATTEMPTS,
 ): String {
+    // Both switches named explicitly. The first cut printed a bare "(override off)" one clause after the
+    // words "the pairing experiment", and a reader reasonably took it to mean the EXPERIMENT was off -
+    // costing a real debugging session, because the experiment was on the whole time. A parenthetical
+    // reporting one setting's state while the sentence names a different setting has to say which is which.
     val override = when {
-        !overrideOptedIn -> "override off"
-        overrideHelloStillAllowed(overrideAttempts, cap) -> "override on ($overrideAttempts/$cap used)"
-        else -> "override SPENT ($overrideAttempts/$cap)"
+        !overrideOptedIn -> "experiment ON, hello override off"
+        overrideHelloStillAllowed(overrideAttempts, cap) -> "experiment ON, hello override on ($overrideAttempts/$cap used)"
+        else -> "experiment ON, hello override SPENT ($overrideAttempts/$cap)"
     }
     val tail = if (consecutive >= 2 && !full) {
         // The guidance is a paragraph and this fires once per CONNECT, on a path documented to loop —
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 1edf981691..909fec3908 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -7965,7 +7965,11 @@ class WhoopBleClient(
                     helloOverrideExhaustedLogged = true
                     log(helloOverrideExhaustedLine(helloOverrideAttempts))
                 }
-                if (explicitBondDefersHello(explicitBondRequestedThisLink, helloOverride = helloOverride)) {
+                // priorDeferrals ends the permanent cycle: the pairing got its one connect and did not
+                // bond, so this one writes the hello rather than deferring to a "next connect" that never
+                // resolves on a strap answering SMP 0x05.
+                if (explicitBondDefersHello(explicitBondRequestedThisLink, helloOverride = helloOverride,
+                                            priorDeferrals = helloDeferredRun())) {
                     // This branch used to return without a word, so the hello's absence was visible only
                     // as a line that never appeared — and the deferral reads identically on the first
                     // connect and the fiftieth. The count is what separates them.
diff --git a/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt b/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
index 00898ebdc1..d58992ff60 100644
--- a/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
@@ -236,7 +236,9 @@ fun TestCentreScreen(vm: AppViewModel, onOpenGroundTruthCollector: () -> Unit =
                     )
                     DeveloperToggleRow(
                         title = stringResource(R.string.raw_diag_pair),
-                        detail = "Experimental explicit Android bonding. Normal 5/MG support does not require this switch.",
+                        detail = "Experimental explicit Android bonding. Normal 5/MG support does not " +
+                            "require this switch. A strap that refuses pairing defers its handshake for one " +
+                            "connect while this is on, so leave it off unless you are testing #1635.",
                         checked = explicitBond,
                         onCheckedChange = {
                             explicitBond = it
diff --git a/android/app/src/test/java/com/noop/ble/ExplicitBondTest.kt b/android/app/src/test/java/com/noop/ble/ExplicitBondTest.kt
index 46e5153e6a..45fd495370 100644
--- a/android/app/src/test/java/com/noop/ble/ExplicitBondTest.kt
+++ b/android/app/src/test/java/com/noop/ble/ExplicitBondTest.kt
@@ -105,4 +105,38 @@ class ExplicitBondTest {
         assertFalse(explicitBondDefersHello(requestedThisLink = false))
         assertFalse(explicitBondDefersHello(requestedThisLink = false, helloOverride = true))
     }
+
+    /**
+     * The regression this exists to end. Before [priorDeferrals], a strap that refuses SMP deferred the
+     * hello on EVERY connect: no hello, no bond, no SET_CLOCK, and an un-clocked 5/MG banks nothing to
+     * flash, so history sync stopped entirely and silently. Field-confirmed - four days without a sync and
+     * not one hello written after the experiment was enabled.
+     */
+    @Test fun stopsDeferringOnceThePairingHasHadItsConnect() {
+        // First connect after the bond request: defer, exactly as before.
+        assertTrue(explicitBondDefersHello(requestedThisLink = true, priorDeferrals = 0))
+        // Every connect after that: the answer is already in, so write the hello.
+        assertFalse(explicitBondDefersHello(requestedThisLink = true, priorDeferrals = 1))
+        assertFalse(explicitBondDefersHello(requestedThisLink = true, priorDeferrals = 13))
+    }
+
+    /** No bond requested on this link means there was never anything to defer around. */
+    @Test fun neverDefersWhenNoBondWasRequested() {
+        assertFalse(explicitBondDefersHello(requestedThisLink = false, priorDeferrals = 0))
+        assertFalse(explicitBondDefersHello(requestedThisLink = false, priorDeferrals = 5))
+    }
+
+    /** The override still short-circuits the very first deferral, which is the whole point of that switch. */
+    @Test fun theOverrideStillWinsOnTheFirstConnect() {
+        assertFalse(explicitBondDefersHello(requestedThisLink = true, helloOverride = true, priorDeferrals = 0))
+    }
+
+    /**
+     * The default keeps every existing caller honest: omitting priorDeferrals must behave like a FIRST
+     * connect (defer), not like a strap that has already exhausted its chance. A default of 1 would have
+     * silently disabled the deferral everywhere.
+     */
+    @Test fun theDefaultBehavesLikeAFirstConnect() {
+        assertTrue(explicitBondDefersHello(requestedThisLink = true))
+    }
 }
diff --git a/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt b/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
index 3a8463cf24..c623b5cda2 100644
--- a/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
+++ b/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
@@ -82,10 +82,14 @@ class StalledLinkDiagnosticsTest {
         val off = helloDeferredByExplicitBondLine(3, overrideOptedIn = false, overrideAttempts = 0)
         val on = helloDeferredByExplicitBondLine(3, overrideOptedIn = true, overrideAttempts = 2)
         val spent = helloDeferredByExplicitBondLine(3, overrideOptedIn = true, overrideAttempts = 6)
-        assertTrue(off.contains("override off"))
-        assertTrue(on.contains("override on (2/6 used)"))
-        assertTrue(spent.contains("override SPENT (6/6)"))
+        assertTrue(off.contains("experiment ON, hello override off"))
+        assertTrue(on.contains("experiment ON, hello override on (2/6 used)"))
+        assertTrue(spent.contains("experiment ON, hello override SPENT (6/6)"))
         assertFalse("a spent override must not read as active", spent.contains("override on ("))
+        // The sentence names the EXPERIMENT; the parenthetical must not report only the OTHER switch.
+        for (line in listOf(off, on, spent)) {
+            assertTrue("both switches must be named: $line", line.contains("experiment ON"))
+        }
     }
 
     /** The boundary is the cap itself: the attempt that spends the budget is the last permitted one. */

From b343f75cb974b8bbd326b9c67e81fc30c63f5d44 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 20:42:10 +1200
Subject: [PATCH 090/333] staging: build 388/269 for the pairing-experiment
 sync fix

versionCode 387 -> 388, CURRENT_PROJECT_VERSION 268 -> 269. Display version holds
at 10.6.1. 388 is +1 on the staging high-water, so it installs over both the
main-line 387 and the PR-branch 386 without Android refusing a downgrade.

The change to test on hardware: with the pairing experiment ON, the CLIENT_HELLO is
deferred for ONE connect instead of forever. On an install whose deferral run is
already non-zero the hello should go out on the FIRST connect after installing.
The line "writing CLIENT_HELLO" has been absent from every field log so far; that
line appearing is the result to look for.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 0d4c064206..71ac609024 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 387
+        versionCode = 388
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index b229f463b6..9a84b374a8 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "268"
+    CURRENT_PROJECT_VERSION: "269"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 39692d4a21004d43d910164dc01dc4fe8ad3a9de Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 21:09:10 +1200
Subject: [PATCH 091/333] ble: a written hello is not a working handshake

Field-caught on build 388, in the log that proved the deferral fix worked.

The hello finally went out at 21:00:47 - first time in the whole #1635 thread. It
was never acked, the bond watchdog bounced the link seven seconds later, and the
reconnect deferred again: the run had been reset the moment the hello was WRITTEN,
so the strap alternated defer, write, bounce, defer forever. That is the
five-second loop #1642 removed, reintroduced through a different door.

Clearing the run on the write encoded "we sent one, so the deferral is over". The
run means attempts, and only a genuine bond ends it. With the reset gone, the
deferral costs one connect as intended and the #1635 suppression latch bounds the
attempts after that, settling the link into the "Live HR, not fully paired" state
the app already models - the designed end state for a strap that answers SMP 0x05,
rather than an indefinite bounce.

The contract test that guarded this now pins the OPPOSITE invariant: writeClientHello
must not clear the run at all. It previously asserted the clear happened after the
stack accepted, which was the right question one revision ago and the wrong one now.

Worth recording what this log settled beyond the fix. The strap has never bonded -
seventeen unacked hellos across the thread - and "Last sync: 4d ago" was never its
own: KEY_LAST_SYNC_AT is a single global key, and that timestamp belonged to the
4.0, which had not been worn for three days. The MG's own buckets read zero rows
throughout, before any change today. There was no sync regression to find on this
strap; there was a strap that has never offloaded, and a global label that read
like it had.

4871 tests, doc lint clean.
---
 .../src/main/java/com/noop/ble/WhoopBleClient.kt  | 15 ++++++++++-----
 .../com/noop/ble/StalledLinkDiagnosticsTest.kt    |  8 ++++++--
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 909fec3908..ab4825b863 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -7850,12 +7850,17 @@ class WhoopBleClient(
             ops.writeCharacteristicCompat(ch, hello, BluetoothGattCharacteristic.WRITE_TYPE_DEFAULT)
         }
         if (ok) {
-            // Claimed only once the stack ACCEPTED the write. Setting these before the call left a window
-            // where a concurrent reader saw a hello that had not gone out, and cleared the deferral run
-            // on an attempt that failed — under-reporting the very run the count exists to measure.
+            // Claimed only once the stack ACCEPTED the write: setting it before the call left a window
+            // where a concurrent reader saw a hello that had not gone out.
+            //
+            // The deferral run is deliberately NOT cleared here. A written hello is not a working
+            // handshake - on a strap answering SMP 0x05 the write is never acked and the bond watchdog
+            // bounces the link seconds later. Clearing on the WRITE reset the run on every bounce, so the
+            // next connect deferred again and the strap alternated defer/write/bounce forever, which is
+            // exactly the loop #1642 removed. The run records ATTEMPTS and only a genuine bond ends it;
+            // the #1635 suppression latch is what bounds the attempts and settles the link into the
+            // "Live HR, not fully paired" state the app already models.
             helloWrittenThisLink = true
-            setHelloDeferredRun(0)
-            helloDeferredGuidanceLogged = false
         } else {
             writeInFlight = false
             log("CLIENT_HELLO write rejected by stack")
diff --git a/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt b/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
index c623b5cda2..76ef5f476f 100644
--- a/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
+++ b/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
@@ -296,11 +296,15 @@ class StalledLinkDiagnosticsTest {
             .substringBefore("\n    }")
         val call = fn.indexOf("val ok = safeGatt(\"writeClientHello\")")
         val claim = fn.indexOf("helloWrittenThisLink = true")
-        val run = fn.indexOf("setHelloDeferredRun(0)")
+        val run = fn.indexOf("setHelloDeferredRun(0)")   // -1 once the write no longer clears it
         assertTrue("writeClientHello must call safeGatt", call >= 0)
         assertTrue("the write must be claimed, somewhere", claim >= 0)
         assertTrue("helloWrittenThisLink must be set AFTER the stack accepts", claim > call)
-        assertTrue("the deferral run must only be cleared AFTER the stack accepts", run > call)
+        // The run must NOT be cleared here at all any more. A written-but-unacked hello is not a working
+        // handshake, and clearing on the write reset the count on every watchdog bounce - so the strap
+        // alternated defer/write/bounce indefinitely instead of letting the #1635 suppression latch bound
+        // the attempts. Only a genuine bond ends the run.
+        assertEquals("writeClientHello must not clear the deferral run", -1, run)
     }
 
     /**

From fe7277e6d718b596df929c74ec52f42376215cf3 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 22:09:17 +1200
Subject: [PATCH 092/333] WHOOP 5/MG: probe whether the historical offload
 actually needs a bond (#1742)

The 5/MG historical offload has never been attempted on a strap that does not
bond, and the blocker turns out to be ours rather than the strap's: beginBackfill
refuses while connectHandshakeDone is false, and for a 5/MG that flag is set in
exactly one place, behind the CLIENT_HELLO ack. On a strap answering SMP "Pairing
Not Supported" that ack can never arrive. requestSync's own bonded check already
passes on these links, so that single line is the whole gate.

The link underneath is not the broken thing it was taken for - it holds for tens of
minutes with the hello suppressed, live HR streams throughout, the unbonded DIS
read succeeds, and puffin commands go out without the stack objecting. What is
genuinely unknown is narrower: those writes go out WITHOUT response, so their
GATT_SUCCESS is Android describing its own controller, and the offload arrives on
notify chars this app has never once subscribed on a healthy unbonded link. The
belief that it cannot work is a comment carried from iOS, not a measurement taken
here.

So this asks in stages, each falsifying the next: subscribe the puffin notify
chars (an insufficient-authentication status is the whole answer), then a
read-only GET_CLOCK (a COMMAND_RESPONSE is the first hard evidence the strap acts
on puffin commands unbonded), then the clock and the ordinary offload. Default
off, its own switch, a refusal latched per device and silence bounded by a small
per-process budget.

It never sets didBond - that flag is the record of an acked hello and every reader
of it is reasoning about a handshake, so setting it to unlock the offload is the
false-bond bug arrived at deliberately. Its own writes go out without response,
because a with-response write to fd4b0002 is exactly what the hello does and what
leaves the write queue starved behind a callback that never comes.

Four review passes. The last one caught the one that mattered: the 8s verdict timer
was an anonymous lambda on a link that reconnects in about 3, so an old link's timer
could conclude a new link's probe early with a verdict it never waited for and spend
the silence budget on it. Three of those retire the experiment - the instrumentation
would have answered #1635 the wrong way by itself. Named runnables cancelled in
reset() now, the #314 pattern this file already uses.

Not hardware-validated, which is the entire point of it.

Android only, matching the explicit-bond experiment. A Swift twin is worth writing
if and only if Android's answer is yes.

4889 tests, lintVital, doc-comment lint and the i18n gate clean. Six locales.
---
 .../java/com/noop/ble/PuffinExperiment.kt     |  38 ++-
 .../java/com/noop/ble/UnbondedOffloadProbe.kt | 232 ++++++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 300 ++++++++++++++++++
 .../java/com/noop/ui/DataSourcesScreen.kt     |   6 +
 .../main/java/com/noop/ui/SettingsScreen.kt   |  36 +++
 .../main/java/com/noop/ui/TestCentreScreen.kt |  14 +
 .../app/src/main/res/values-de/strings.xml    |   3 +
 .../app/src/main/res/values-es/strings.xml    |   3 +
 .../app/src/main/res/values-fr/strings.xml    |   3 +
 .../app/src/main/res/values-pl/strings.xml    |   3 +
 .../src/main/res/values-pt-rPT/strings.xml    |   3 +
 .../app/src/main/res/values-zh/strings.xml    |   3 +
 android/app/src/main/res/values/strings.xml   |   3 +
 .../com/noop/ble/UnbondedOffloadProbeTest.kt  | 240 ++++++++++++++
 14 files changed, 880 insertions(+), 7 deletions(-)
 create mode 100644 android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
 create mode 100644 android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt

diff --git a/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt b/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt
index 0d0e5b7013..d2d234fdc5 100644
--- a/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt
+++ b/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt
@@ -130,6 +130,24 @@ class PuffinExperiment(private val prefs: SharedPreferences) {
         get() = prefs.getBoolean(KEY_HELLO_DESPITE_REFUSAL, false)
         set(v) = prefs.edit().putBoolean(KEY_HELLO_DESPITE_REFUSAL, v).apply()
 
+    /**
+     * Try the historical offload on a link that never bonded (#1635, default false).
+     *
+     * `beginBackfill` is gated on `connectHandshakeDone`, which for a 5/MG is set only behind the
+     * CLIENT_HELLO ack — so on a strap answering SMP `Pairing Not Supported` the offload is never even
+     * attempted. That gate is ours, and the assumption underneath it (that the puffin notify chars need an
+     * encrypted link) has never been measured on Android: the one attempt rode a false bond and the link
+     * died before any answer came back. See [shouldProbeUnbondedOffload] for the staged form.
+     *
+     * Its own switch because it SENDS to the strap and, if the strap answers, writes its clock — the same
+     * line every other state-changing probe here sits behind ([isDeepDataEnabled], [broadcastHr],
+     * [ecgRawData]). Nothing is written until the strap has proved it answers a read-only GET_CLOCK, and a
+     * refusal is latched per device, so opting in costs one link and not a loop.
+     */
+    var unbondedOffload: Boolean
+        get() = prefs.getBoolean(KEY_UNBONDED_OFFLOAD, false)
+        set(v) = prefs.edit().putBoolean(KEY_UNBONDED_OFFLOAD, v).apply()
+
     /** True if the user opted in to "Ask Android to pair" (#1635, default false): NOOP calls
      *  `BluetoothDevice.createBond()` explicitly instead of relying on a write to the encrypted
      *  characteristic to provoke pairing — which the #1639 bond-state trace showed never happens at all.
@@ -141,13 +159,14 @@ class PuffinExperiment(private val prefs: SharedPreferences) {
         set(v) = prefs.edit().putBoolean(KEY_EXPLICIT_BOND, v).apply()
 
     /**
-     * Turn OFF every 5/MG-only experimental probe: protocol probes ([isEnabled]), raw capture
-     * ([isCaptureEnabled]), the R22 deep-data strap write ([isDeepDataEnabled]) and broadcast-HR
-     * ([broadcastHr]). Called on a strap FAMILY switch (WHOOP 4.0 ↔ 5/MG) so a 5/MG-only option can
-     * never linger enabled and get applied to a strap it doesn't belong to. One atomic edit.
+     * Turn OFF every 5/MG-only experimental probe — exactly the switches in [FIVE_MG_GATED_KEYS], which is
+     * the one list rather than a prose copy of it that drifts (this doc named four while the list already
+     * held six). Called on a strap FAMILY switch (WHOOP 4.0 ↔ 5/MG) so a 5/MG-only option can never linger
+     * enabled and get applied to a strap it doesn't belong to. One atomic edit.
      *
-     * The line is "does it SEND something to the strap": these four arm probes, raw-capture writes, the
-     * R22 deep-data write and the broadcast-HR write, all of which target hardware that may not support
+     * The line is "does it SEND something to the strap": these arm probes, raw-capture writes, the R22
+     * deep-data write, the broadcast-HR write, the ECG gate, an explicit pairing and the unbonded offload
+     * probe, all of which target hardware that may not support
      * them. Pure analysis flags are deliberately left alone even when they only do anything on one
      * family — [ppgHrSubLagInterp] only affects v26 optical records, which a 4.0 never sends, so it is
      * inert rather than misapplied. [experimentalSleepV2], [hrvReadiness] and [motionAwareWake] are
@@ -183,13 +202,18 @@ class PuffinExperiment(private val prefs: SharedPreferences) {
          *  so no macOS key to mirror. */
         const val KEY_EXPLICIT_BOND = "noopWhoop5ExplicitBond"
 
+        /** "Try history sync without pairing" opt-in — the unbonded offload probe (#1635). Android-only,
+         *  so no macOS key to mirror. */
+        const val KEY_UNBONDED_OFFLOAD = "noopWhoop5UnbondedOffload"
+
         /** #1635: send the CLIENT_HELLO even when the suppression latch is set. Default OFF. */
         const val KEY_HELLO_DESPITE_REFUSAL = "noopWhoop5HelloDespiteRefusal"
 
         /** The 5/MG-only probe keys, in ONE place: [resetFiveMGGatedProbes] clears exactly these, and
          *  SettingsScreen watches exactly these for external writes. Two lists would drift. */
         internal val FIVE_MG_GATED_KEYS =
-            listOf(KEY, KEY_CAPTURE, KEY_DEEP_DATA, KEY_BROADCAST_HR, KEY_ECG_RAW_DATA, KEY_EXPLICIT_BOND)
+            listOf(KEY, KEY_CAPTURE, KEY_DEEP_DATA, KEY_BROADCAST_HR, KEY_ECG_RAW_DATA, KEY_EXPLICIT_BOND,
+                   KEY_UNBONDED_OFFLOAD)
 
         /** "Experimental sleep staging (V2)" opt-in (mirrors macOS `PuffinExperiment.experimentalSleepV2Key`). */
         const val KEY_EXPERIMENTAL_SLEEP_V2 = "noopExperimentalSleepV2"
diff --git a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
new file mode 100644
index 0000000000..a425f8cd40
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
@@ -0,0 +1,232 @@
+package com.noop.ble
+
+/**
+ * Should NOOP try the historical offload on a WHOOP 5/MG that has NOT bonded?
+ *
+ * The offload has always been gated on the CLIENT_HELLO ack — `beginBackfill` refuses while
+ * `connectHandshakeDone` is false, and for a 5/MG that flag is set in exactly one place, behind `didBond`.
+ * On a strap that answers SMP with `Pairing Not Supported` (#1635) the ack can never arrive, so the gate
+ * can never open, and the app never asks the strap for history at all.
+ *
+ * What makes that worth re-examining is that the gate is OURS, not the strap's, and the link underneath it
+ * is not the broken thing it was assumed to be. With the hello suppressed the link is stable for tens of
+ * minutes (a field capture holds one up for 2431s), live HR streams over the standard profile the whole
+ * time, the unbonded DIS identity read succeeds (#490/#1455), and puffin commands — DISABLE_ALARM,
+ * TOGGLE_REALTIME_HR — are written to fd4b0002 without the stack objecting. Every bounce in the capture
+ * traces to the bond watchdog after an unanswered hello, never to the link itself.
+ *
+ * What is NOT established is the part that matters, and it is important to be exact about why. Those
+ * puffin writes go out WITHOUT response, so their `GATT_SUCCESS` is Android reporting a Write Command
+ * handed to the controller — a local fact that says nothing about whether the strap parsed it. And the
+ * offload does not arrive on fd4b0002 at all: it arrives on the puffin NOTIFY characteristics
+ * (fd4b0003/4/5/7), which this app has never once subscribed on a healthy unbonded link. The single
+ * attempt on record (28 Aug, 13:25:00) rode a FALSE bond — a DISABLE_ALARM completion misread as a hello
+ * ack, the bug #1635 fixed — and produced `writeDescriptor busy; retry 1/8`, an Android queue error,
+ * before the link died 4s later with the hello still outstanding. No answer was ever obtained.
+ *
+ * The belief that it cannot work is a comment, not a measurement: `BLEManager.swift` records that the
+ * strap rejects those subscriptions with "Authentication is insufficient", from a 5/MG that was still
+ * bonded to the official WHOOP app (issue #17). That may well be right. It has never been tested against
+ * a strap in this state, on a link that stays up long enough to hear the answer.
+ *
+ * So this probe asks, in stages, each one falsifying the next:
+ *
+ *  1. subscribe the four puffin notify characteristics. An insufficient-authentication status here is the
+ *     whole answer — the offload needs an encrypted link, and #1635 is a wall rather than a gate.
+ *  2. if they subscribe, send GET_CLOCK. Read-only on purpose: it changes nothing on the strap, and a
+ *     COMMAND_RESPONSE to it is the first hard evidence that puffin commands are acted on unbonded.
+ *  3. only then SET_CLOCK and the ordinary offload, which is the existing hardware-proven sequence.
+ *
+ * Self-limiting the same way [shouldReadDisUnbonded] is: opt-in, once per link, and never again after a
+ * refusal is latched for that device. This area has a habit of producing "keeps retrying something that
+ * cannot work", and the point of a probe is to stop being one after it has its answer.
+ *
+ * A refusal is a RESULT. Either outcome closes the last open question on #1635.
+ */
+internal fun shouldProbeUnbondedOffload(
+    isWhoop5: Boolean,
+    optedIn: Boolean,
+    bonded: Boolean,
+    helloWrittenThisLink: Boolean,
+    alreadyProbedThisLink: Boolean,
+    previouslyRefused: Boolean,
+    silentLinksSoFar: Int = 0,
+): Boolean {
+    if (!isWhoop5) return false
+    if (!optedIn) return false
+    // A bonded strap reaches the offload through the proven post-hello handshake; this exists only for the
+    // straps that path never reaches.
+    if (bonded) return false
+    // The hello is what drops the link. On a link carrying one, the bond watchdog has ~5s to bounce us, so
+    // a refusal here would be unattributable — exactly the ambiguity that made the hello unreadable for
+    // eleven weeks. Only the stable no-hello link can answer this question.
+    if (helloWrittenThisLink) return false
+    if (alreadyProbedThisLink) return false
+    if (previouslyRefused) return false
+    return unbondedProbeStillWorthAsking(silentLinksSoFar)
+}
+
+/**
+ * How many links may end in SILENCE before the probe retires itself.
+ *
+ * A refusal latches per device; silence deliberately does not, because the subscriptions were accepted and
+ * one quiet link is not the strap's verdict. But "not latched" cannot mean "forever": the probe re-runs on
+ * every reconnect, and a strap that reconnects often would re-ask a question already answered the same way
+ * three times, which is the exact shape of the unbounded retry this whole area keeps producing.
+ *
+ * Counted per app process, like [HELLO_OVERRIDE_MAX_ATTEMPTS], and reset by a genuine answer. A process
+ * restart resets it too — the honest limit of an in-memory bound, and the loop it exists to stop runs
+ * within one process.
+ */
+internal const val UNBONDED_PROBE_MAX_SILENT_LINKS = 3
+
+/** Has the probe any budget left after [silentLinksSoFar] links that subscribed but drew no reply? */
+internal fun unbondedProbeStillWorthAsking(
+    silentLinksSoFar: Int,
+    cap: Int = UNBONDED_PROBE_MAX_SILENT_LINKS,
+): Boolean = silentLinksSoFar < cap
+
+/**
+ * The line printed when the probe retires on repeated silence, so the log says why it stopped rather than
+ * leaving a reader to notice its absence — the same failure the CLIENT_HELLO's silent suppression caused.
+ */
+internal fun unbondedProbeGaveUpLine(silentLinks: Int): String =
+    "Unbonded offload probe: $silentLinks links have subscribed the puffin chars and drawn no" +
+        " COMMAND_RESPONSE — this strap serves those characteristics unbonded but does not act on commands" +
+        " written to them. Not asking again this session. History offload is unavailable until the strap" +
+        " completes a handshake (#1635)."
+
+/** Persisted key for "this strap refused the unbonded puffin subscriptions". Per device and lowercased,
+ *  for the same reason [firmwarePrefKey] is. */
+internal fun unbondedOffloadRefusedPrefKey(peripheralId: String?): String? =
+    peripheralId?.trim()?.takeIf { it.isNotEmpty() }?.let { "noop.unbondedOffloadRefused.${it.lowercase()}" }
+
+/**
+ * What a frame arriving on a puffin notify characteristic proves about an unbonded link.
+ *
+ * The distinction is the whole point of the probe and is easy to lose. A frame — any frame — proves the
+ * strap SERVES those characteristics without encryption, which is what the offload transport needs. It
+ * does not prove the strap ACTED on anything we wrote, because a stream it would have sent anyway looks
+ * identical from here. Only a reply to a command we issued shows the command channel is live, and that is
+ * the finding the offload actually depends on.
+ *
+ * Treating the weaker evidence as the stronger one is how the false bond of 28 Aug happened: an unrelated
+ * completion on a shared characteristic was read as an answer to a question nobody had been asked.
+ */
+internal enum class UnbondedProbeEvidence {
+    /** Nothing decodable has arrived. */
+    NONE,
+
+    /** A valid frame arrived on a puffin notify characteristic: the strap serves them unbonded. */
+    SERVES_NOTIFICATIONS,
+
+    /** A COMMAND_RESPONSE arrived: the strap parsed a puffin command written over an unencrypted link and
+     *  answered it. This is the evidence the offload needs. */
+    ANSWERS_COMMANDS,
+}
+
+/** The COMMAND_RESPONSE type name as `Framing.parseFrame` reports it. */
+internal const val COMMAND_RESPONSE_TYPE_NAME = "COMMAND_RESPONSE"
+
+/**
+ * Classify one parsed puffin frame as probe evidence.
+ *
+ * CRC-gated, and deliberately strict about it. A frame whose CRC does not verify is noise on a link we are
+ * testing precisely because we do not know whether it is allowed to carry this traffic, and counting noise
+ * as proof would let the probe conclude the opposite of the truth. `crcOk == null` (no CRC to check) is
+ * not a pass either — [ok] alone is an envelope check.
+ */
+internal fun unbondedProbeEvidenceOf(
+    ok: Boolean,
+    crcOk: Boolean?,
+    typeName: String?,
+): UnbondedProbeEvidence = when {
+    !ok || crcOk != true || typeName.isNullOrBlank() -> UnbondedProbeEvidence.NONE
+    typeName == COMMAND_RESPONSE_TYPE_NAME -> UnbondedProbeEvidence.ANSWERS_COMMANDS
+    else -> UnbondedProbeEvidence.SERVES_NOTIFICATIONS
+}
+
+/**
+ * Keep the strongest evidence seen on this link.
+ *
+ * The probe's verdict must not depend on which frame happened to arrive last. A REALTIME_DATA burst
+ * following the COMMAND_RESPONSE would otherwise walk the conclusion back down to the weaker finding.
+ */
+internal fun strongerProbeEvidence(
+    a: UnbondedProbeEvidence,
+    b: UnbondedProbeEvidence,
+): UnbondedProbeEvidence = if (b.ordinal > a.ordinal) b else a
+
+/** Announced before stage 1 so a capture shows the probe starting, not just its outcome. */
+internal fun unbondedProbeStartLine(): String =
+    "Unbonded offload probe: subscribing the puffin notify chars (fd4b0003/4/5/7) on a link with no" +
+        " CLIENT_HELLO. Never attempted on a healthy link before — an insufficient-authentication status" +
+        " here means the offload requires an encrypted bond and #1635 ends it (experimental, #1635)."
+
+/**
+ * Stage 1's refusal — the answer the probe exists to get.
+ *
+ * Named as a finding rather than an error: it settles for Android what only a comment has claimed, and it
+ * is latched per device so the strap says it once instead of on every reconnect.
+ */
+internal fun puffinSubscribeRefusedLine(uuid: String, status: String): String =
+    "Unbonded offload probe: subscribe of $uuid failed $status. If this is an insufficient-authentication" +
+        " or -encryption status, the puffin notify chars need an encrypted link, the historical offload" +
+        " cannot be reached without a bond, and a 5/MG that refuses SMP can never sync history (#1635)."
+
+/**
+ * Stage 2's question, logged so the wait that follows is attributable to it.
+ *
+ * Carries the CONFIRMED count, not the attempted one. A CCCD write can also end by being abandoned after
+ * its busy retries, which reaches the same completion path as four clean subscribes — so a line that said
+ * "subscribed" flatly would overstate a partial result in the one log this experiment exists to produce.
+ */
+internal fun unbondedProbeAskingLine(subscribed: Int, total: Int, waitMs: Long): String =
+    "Unbonded offload probe: $subscribed of $total puffin notify chars subscribed — the strap serves them" +
+        " on an unencrypted link. Sending GET_CLOCK (read-only, changes nothing on the strap) and" +
+        " listening ${waitMs}ms for a COMMAND_RESPONSE, which would be the first proof it acts on puffin" +
+        " commands unbonded (#1635)."
+
+/**
+ * Stage 1 ended with nothing confirmed and no refusal to name.
+ *
+ * Distinct from both other stage-1 outcomes on purpose. A refusal is the strap's answer; this is the
+ * absence of one — every write was abandoned by our own stack before the strap ever ruled — and reporting
+ * it as either a refusal or a success would put a fact in the capture that was never established.
+ */
+internal fun unbondedProbeNoSubscriptionsLine(total: Int): String =
+    "Unbonded offload probe: none of the $total puffin notify chars completed their subscribe, and none" +
+        " was refused either — the writes were abandoned locally, so the strap never ruled on them. No" +
+        " question asked; this link proves nothing either way (#1635)."
+
+/**
+ * Stage 2's silence.
+ *
+ * Distinguished from a refusal on purpose: the subscriptions landed, so the transport is open and the
+ * strap simply did not answer. That is a different fact about the strap than "it declined the link", and a
+ * capture that conflated them would send the next reader after the wrong thing.
+ */
+internal fun unbondedProbeSilentLine(waitedMs: Long, sawNotifications: Boolean): String =
+    "Unbonded offload probe: no COMMAND_RESPONSE after ${waitedMs}ms. The subscriptions were accepted" +
+        (if (sawNotifications) " and frames did arrive on them," else " but nothing arrived on them,") +
+        " so the transport is open and the strap is not answering commands on an unencrypted link." +
+        " Not retrying on this strap (#1635)."
+
+/** Stage 2's success — the finding that unlocks the rest. */
+internal fun unbondedProbeAnsweredLine(): String =
+    "Unbonded offload probe: COMMAND_RESPONSE received — the strap ACTS on puffin commands over an" +
+        " unencrypted link. Clocking the strap and requesting the historical offload (#1635)."
+
+/**
+ * The expectation to set the moment the probe succeeds, not after the offload returns empty.
+ *
+ * An un-clocked 5/MG is hardware-known not to persist sensor data to flash at all ("RTC timestamp … is
+ * invalid; not saving data to flash", #78 fork). A strap that has never completed a handshake has never
+ * been clocked by NOOP, so the honest expectation is that an offload which finally runs may find little or
+ * nothing banked — and that this buys FUTURE syncing rather than recovering the backlog. GET_DATA_RANGE
+ * answers it directly, which is why it is the stage before the transfer rather than after it.
+ */
+internal fun unbondedProbeBacklogCaveatLine(): String =
+    "Unbonded offload probe: note that this strap has never been clocked by NOOP, and an un-clocked 5/MG" +
+        " does not save sensor data to flash — so GET_DATA_RANGE may legitimately report little or nothing" +
+        " banked. That would mean history works from now on, not that the probe failed (#1635)."
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index ab4825b863..433b4cfbe1 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -868,6 +868,13 @@ class WhoopBleClient(
         /** 5/MG fail-open gate: how long to wait for a GET_DATA_RANGE SUCCESS before requesting
          *  history anyway (real hardware sometimes swallows the first range query, #78 fork). */
         private const val DATA_RANGE_GATE_MS = 2_000L
+
+        /** #1635: how long the unbonded probe listens for a COMMAND_RESPONSE to its GET_CLOCK.
+         *  Generous next to [DATA_RANGE_GATE_MS] on purpose — a strap that has never held a session may be
+         *  slower than one mid-sync, and the cost of waiting is a few seconds on a link that is already
+         *  stable, while the cost of asking too early is a false "does not answer" that closes #1635 the
+         *  wrong way. */
+        private const val UNBONDED_PROBE_REPLY_WAIT_MS = 8_000L
         /** 5/MG zero-frame retry: pause before re-requesting history when a session timed out having
          *  produced nothing (the first request after connect can go entirely unanswered). */
         private const val WHOOP5_HISTORY_RETRY_DELAY_MS = 700L
@@ -2336,6 +2343,59 @@ class WhoopBleClient(
     @Volatile
     private var connectHandshakeDone = false
 
+    /** #1635 unbonded offload probe: stage 1 (the puffin CCCD writes) is in flight. @Volatile — set on the
+     *  main looper, read in onDescriptorWrite on the binder thread. */
+    @Volatile
+    private var unbondedProbeSubscribing = false
+
+    /** #1635: stage 2 is in flight — GET_CLOCK is out and we are listening for a COMMAND_RESPONSE.
+     *  @Volatile: cleared on the main looper, read in the notify handler on the binder thread. */
+    @Volatile
+    private var unbondedProbeAwaitingReply = false
+
+    /** #1635: the probe has run on THIS link. Separate from [unbondedProbeAwaitingReply] because the
+     *  keep-alive drains the same CCCD queue every 30s and would otherwise re-enter the probe's own
+     *  completion branch for the life of the connection. */
+    private var unbondedProbeStartedThisLink = false
+
+    /** #1635: the strongest evidence seen this link, never the most recent — REALTIME_DATA follows a
+     *  COMMAND_RESPONSE continuously once realtime is armed, and last-one-wins would report "not
+     *  answering" about a strap that had just answered. @Volatile: written in the notify handler. */
+    @Volatile
+    private var unbondedProbeEvidence = UnbondedProbeEvidence.NONE
+
+    /** #1635: when stage 2's GET_CLOCK went out, so the verdict line can state the wait it actually
+     *  waited rather than the one it intended to. */
+    private var unbondedProbeAskedAtMs = 0L
+
+    /** #1635: puffin CCCD writes the stack CONFIRMED this link. A subscribe can also end by being
+     *  abandoned after its busy retries, which reaches the same drain-empty branch as a clean one — so the
+     *  count, not the branch, is what says the transport is open. @Volatile: incremented in
+     *  onDescriptorWrite on the binder thread, read on the main looper. */
+    @Volatile
+    private var unbondedProbeSubscribed = 0
+
+    /**
+     * #1635: the probe's two scheduled steps as NAMED runnables, so [reset] can cancel them.
+     *
+     * Anonymous lambdas here were a real race, not a style point. The verdict is posted 8s out and a
+     * bouncing link reconnects in about 3 — so an OLD link's timer could fire while a NEW link's probe was
+     * mid-question, concluding it early with a "no reply" verdict it never waited for and charging the
+     * silence budget for a link that had answered nothing yet. Same instance for the early-success post, so
+     * one removeCallbacks cancels every path.
+     */
+    private val unbondedProbeVerdictRunnable = Runnable { concludeUnbondedProbe() }
+
+    /** #1635: the deferred probe start. Cancellable for the same reason — a stale start would arrive on a
+     *  link that never scheduled it. Its own gates would still hold, but a timer that outlives its link is
+     *  how surprises get in. */
+    private val unbondedProbeStartRunnable = Runnable { gatt?.let { beginUnbondedOffloadProbe(it) } }
+
+    /** #1635: links that subscribed the puffin chars and drew no reply. Per PROCESS, deliberately NOT
+     *  cleared by [reset] — its whole job is to bound a retry that spans reconnects. A refusal latches per
+     *  device instead; silence is weaker evidence and gets a budget rather than a verdict. */
+    private var unbondedProbeSilentLinks = 0
+
     /** True when the user asked to disconnect; suppresses the auto-rescan (Swift `intentionalDisconnect`).
      *  Written on the main looper (connect/disconnect/keep-alive bounce) and read on the GATT binder
      *  thread (handleDisconnect), so it must be @Volatile for cross-thread visibility. */
@@ -4615,6 +4675,206 @@ class WhoopBleClient(
         readDisIdentity()
     }
 
+    /**
+     * Schedule the unbonded offload probe on a link that will carry NO CLIENT_HELLO (#1635).
+     *
+     * Called from BOTH no-hello paths for the same reason [scheduleUnbondedDisRead] is: the deferral path
+     * returns early, so scheduling it in the suppression path alone would skip exactly the people testing.
+     *
+     * Staggered AFTER the DIS chain rather than beside it. Both ride one serialized GATT queue, and the DIS
+     * reads are the cheaper, already-proven operation — letting four CCCD writes contend with them would
+     * make a failure in either unattributable to the one that caused it.
+     */
+    private fun scheduleUnbondedOffloadProbe() {
+        handler.removeCallbacks(unbondedProbeStartRunnable)
+        handler.postDelayed(unbondedProbeStartRunnable, BATTERY_ON_CONNECT_DELAY_MS * 4)
+    }
+
+    /**
+     * Stage 1: subscribe the puffin notify characteristics on an unbonded link.
+     *
+     * This is the operation nothing on record has ever completed. The offload arrives on fd4b0003/4/5/7,
+     * and those are subscribed in exactly one place — the post-CLIENT_HELLO branch — so a strap that never
+     * bonds never has them enabled and could not receive history even if it offered it. See
+     * [shouldProbeUnbondedOffload] for why the assumption that they need encryption has never been tested
+     * here.
+     */
+    @SuppressLint("MissingPermission")
+    private fun beginUnbondedOffloadProbe(g: BluetoothGatt) {
+        val refused = runCatching {
+            unbondedOffloadRefusedPrefKey(g.device.address)?.let {
+                context.getSharedPreferences(com.noop.ui.NoopPrefs.NAME, android.content.Context.MODE_PRIVATE)
+                    .getBoolean(it, false)
+            } ?: false
+        }.getOrDefault(false)
+        if (!shouldProbeUnbondedOffload(
+                isWhoop5 = connectedFamily == DeviceFamily.WHOOP5,
+                optedIn = PuffinExperiment.from(context).unbondedOffload,
+                bonded = didBond,
+                helloWrittenThisLink = helloWrittenThisLink,
+                alreadyProbedThisLink = unbondedProbeStartedThisLink,
+                previouslyRefused = refused,
+                silentLinksSoFar = unbondedProbeSilentLinks,
+            )
+        ) return
+        val svc = g.getService(WHOOP5_SERVICE) ?: return
+        // Claim the link BEFORE queueing, so a keep-alive drain landing between the two cannot start a
+        // second probe against the same four characteristics.
+        unbondedProbeStartedThisLink = true
+        var queued = 0
+        for (u in WHOOP5_NOTIFY_CHARS) svc.getCharacteristic(u)?.let { cccdQueue.add(it); queued++ }
+        // An empty queue drains INSTANTLY to the probe's own completion branch, which would announce
+        // "puffin chars subscribed — the strap serves them on an unencrypted link" having subscribed
+        // nothing at all. That is a fabricated finding in the one log this experiment exists to produce,
+        // so the claim is made only once there is something behind it.
+        if (queued == 0) {
+            log("Unbonded offload probe: the strap exposes none of the puffin notify chars on this link" +
+                " — nothing to subscribe, so there is no question to ask (#1635)")
+            return
+        }
+        unbondedProbeSubscribing = true
+        unbondedProbeSubscribed = 0
+        unbondedProbeEvidence = UnbondedProbeEvidence.NONE
+        log(unbondedProbeStartLine())
+        drainCccdQueue(g)
+    }
+
+    /**
+     * Stage 1 came back refused — the answer the probe exists to obtain.
+     *
+     * Latched per device so the strap declines once rather than on every reconnect, with the same carve-out
+     * [noteReadFailure] makes: a link with an OS pairing in flight can fail a descriptor write for reasons
+     * that are ours, not the strap's, and latching that would blame the strap for our own timing forever.
+     */
+    private fun noteUnbondedProbeRefused(uuid: java.util.UUID, status: Int) {
+        unbondedProbeSubscribing = false
+        unbondedProbeAwaitingReply = false
+        log(puffinSubscribeRefusedLine(uuid.toString(), gattWriteStatusLabel(status)))
+        if (explicitBondRequestedThisLink) {
+            log("Unbonded offload probe: not latching that refusal — a pairing was requested on this link," +
+                " so the failure is not attributable to the strap (#1635)")
+            return
+        }
+        runCatching {
+            unbondedOffloadRefusedPrefKey(lastDeviceAddress)?.let {
+                context.getSharedPreferences(com.noop.ui.NoopPrefs.NAME, android.content.Context.MODE_PRIVATE)
+                    .edit().putBoolean(it, true).apply()
+            }
+        }
+    }
+
+    /**
+     * Stage 2: the subscriptions landed, so ask the strap a read-only question.
+     *
+     * GET_CLOCK and not GET_DATA_RANGE, and certainly not SET_CLOCK. It changes nothing on the strap, so a
+     * strap that turns out not to be listening has had nothing done to it — and a COMMAND_RESPONSE to it is
+     * the first evidence in this whole thread that a puffin command written over an unencrypted link is
+     * parsed and answered rather than merely handed to the controller.
+     */
+    private fun askUnbondedProbeQuestion() {
+        unbondedProbeAwaitingReply = true
+        unbondedProbeAskedAtMs = System.currentTimeMillis()
+        log(unbondedProbeAskingLine(
+            subscribed = unbondedProbeSubscribed,
+            total = WHOOP5_NOTIFY_CHARS.size,
+            waitMs = UNBONDED_PROBE_REPLY_WAIT_MS,
+        ))
+        // WITHOUT response, and that is not a detail. A with-response write to fd4b0002 is precisely what
+        // the CLIENT_HELLO does, and on this strap it never completes - leaving writeInFlight set and the
+        // whole write queue starved behind a callback that is never coming. Using it here would risk the
+        // working live-HR state to ask a question that does not need it: the evidence this probe wants is
+        // the strap's own COMMAND_RESPONSE arriving on the notify chars, not an ATT acknowledgement of the
+        // write. DISABLE_ALARM and TOGGLE_REALTIME_HR already go out this way on exactly these links.
+        send(CommandNumber.GET_CLOCK, byteArrayOf())
+        handler.removeCallbacks(unbondedProbeVerdictRunnable)
+        handler.postDelayed(unbondedProbeVerdictRunnable, UNBONDED_PROBE_REPLY_WAIT_MS)
+    }
+
+    /**
+     * Stage 2's verdict, and the handover to the ordinary offload if it passed.
+     *
+     * Runs on the timeout OR early on the first COMMAND_RESPONSE; [unbondedProbeAwaitingReply] makes it
+     * once-only, so the timer firing after an early success is a no-op rather than a second verdict.
+     *
+     * On success this sets [connectHandshakeDone] and NOTHING else about the bond state. `didBond` stays
+     * false deliberately: it is the record of an acked CLIENT_HELLO, which did not happen, and every one of
+     * its readers — the bond watchdog, the never-bonded self-drop counter, the stale-pairing guide — is
+     * reasoning about a handshake, not about whether history can flow. Setting it to unlock the offload is
+     * exactly the false-bond bug of 28 Aug, arrived at deliberately instead of by accident.
+     */
+    private fun concludeUnbondedProbe() {
+        if (!unbondedProbeAwaitingReply) return
+        unbondedProbeAwaitingReply = false
+        val waited = System.currentTimeMillis() - unbondedProbeAskedAtMs
+        if (unbondedProbeEvidence != UnbondedProbeEvidence.ANSWERS_COMMANDS) {
+            log(unbondedProbeSilentLine(
+                waitedMs = waited,
+                sawNotifications = unbondedProbeEvidence == UnbondedProbeEvidence.SERVES_NOTIFICATIONS,
+            ))
+            // Not latched per device: the subscriptions were accepted, so this says the strap did not
+            // answer THIS time, and the carve-out the refusal path makes for a pairing in flight would
+            // apply here with less certainty, not more. Once-per-LINK does not bound it, though — the
+            // probe re-runs on every reconnect — so silence spends a per-process budget instead of writing
+            // a permanent verdict from an ambiguous result.
+            unbondedProbeSilentLinks++
+            if (!unbondedProbeStillWorthAsking(unbondedProbeSilentLinks)) {
+                log(unbondedProbeGaveUpLine(unbondedProbeSilentLinks))
+            }
+            return
+        }
+        log(unbondedProbeAnsweredLine())
+        log(unbondedProbeBacklogCaveatLine())
+        // A genuine answer clears the silence budget: whatever the quiet links were, they were not this
+        // strap declining to talk, and a later reconnect must not inherit their count.
+        unbondedProbeSilentLinks = 0
+        // The proven 5/MG handshake tail, minus the hello that cannot happen: clock the strap, then offload.
+        // Clock-before-history is mandatory — an un-clocked 5/MG discards sensor data rather than banking it
+        // — and it is only reached here because the strap has just demonstrated it answers commands.
+        connectHandshakeDone = true
+        // requestSync ALSO gates on state.bonded, and for a 5/MG that flag is set by the live-HR path -
+        // the first plausible reading over the standard profile. A strap sitting on a charger streams no
+        // HR, so without this the probe would succeed, announce it, and then be refused by a second gate
+        // in silence - on exactly the strap you would reach for history sync on. Same flag and same
+        // meaning the live-HR path sets ("the link is established"), NOT encryptedBond, which remains the
+        // record of a genuine handshake and stays false because none happened.
+        _state.update { it.copy(bonded = true) }
+        // Deliberately NOT startKeepAlive(), which the live-HR path pairs with this same flag. The
+        // keep-alive bounces a link that has been quiet for 120s, and a strap on a charger with no offload
+        // yet running is exactly that - so arming it here would tear down the stable link this probe spent
+        // three stages establishing. The link needs no keep-alive to be probed; it needs to be left alone.
+        noteRebootReconnectIfNeeded()
+        // Also without response, for the reason above. The bonded tail uses with-response here, but it
+        // runs on a link that completed a handshake; this one has proved only that the strap ANSWERS, not
+        // that it acknowledges. The offload that follows still writes GET_DATA_RANGE and
+        // SEND_HISTORICAL_DATA with response through the ordinary path, so if with-response is the thing
+        // this strap will not do, the log separates that cleanly from the stages above rather than
+        // wedging the queue before any of them can be read.
+        send(CommandNumber.SET_CLOCK, setClockPayload())
+        send(CommandNumber.GET_CLOCK, byteArrayOf())
+        if (!backfillStarted) {
+            backfillStarted = true
+            handler.postDelayed({ requestSync(BackfillTrigger.CONNECT) }, INITIAL_BACKFILL_DELAY_MS)
+            startBackfillTimer()
+        }
+    }
+
+    /**
+     * Record what a puffin frame proves while the probe is listening.
+     *
+     * Called from the notify handler on the binder thread, which is why the conclusion hops to the main
+     * looper: [concludeUnbondedProbe] queues GATT writes and touches handler-scoped timers.
+     */
+    private fun noteUnbondedProbeFrame(parsed: com.noop.protocol.ParsedFrame) {
+        if (!unbondedProbeAwaitingReply) return
+        unbondedProbeEvidence = strongerProbeEvidence(
+            unbondedProbeEvidence,
+            unbondedProbeEvidenceOf(ok = parsed.ok, crcOk = parsed.crcOk, typeName = parsed.typeName),
+        )
+        if (unbondedProbeEvidence == UnbondedProbeEvidence.ANSWERS_COMMANDS) {
+            handler.post(unbondedProbeVerdictRunnable)
+        }
+    }
+
     /** Chained second half of [readDisIdentity] — issued only after the serial read has landed. */
     private fun readDisHardwareRevision() {
         val g = gatt ?: return
@@ -6094,8 +6354,19 @@ class WhoopBleClient(
         ) {
             if (status != BluetoothGatt.GATT_SUCCESS) {
                 log("Notify enable failed for ${descriptor.characteristic?.uuid}: status=$status")
+                // #1635: on the puffin notify chars during the unbonded probe, this IS the result — the
+                // generic line above cannot say so, because it is written for a transient stack failure
+                // and this is a verdict about whether the offload needs an encrypted link at all.
+                descriptor.characteristic?.uuid?.let { u ->
+                    if (unbondedProbeSubscribing && u in WHOOP5_NOTIFY_CHARS) noteUnbondedProbeRefused(u, status)
+                }
             } else {
                 log("Subscribed ${descriptor.characteristic?.uuid}")
+                // #1635: only a CONFIRMED puffin subscribe counts toward the probe's claim that the strap
+                // serves these chars unbonded.
+                descriptor.characteristic?.uuid?.let { u ->
+                    if (unbondedProbeSubscribing && u in WHOOP5_NOTIFY_CHARS) unbondedProbeSubscribed++
+                }
                 // A subscribe landed — replenish the shared BUSY-retry budget so a transient stall on
                 // one characteristic can't starve the others' retries (the counter is global).
                 cccdRetries = 0
@@ -6233,6 +6504,9 @@ class WhoopBleClient(
                     // live collector) instead of each re-parsing it — steady-state drops 2→1 parse per live
                     // frame. Family-aware, so it's correct for WHOOP4 and 5/MG alike.
                     val parsed = Framing.parseFrame(frame, connectedFamily)
+                    // #1635: while the unbonded probe is listening, this frame is the measurement. Gated
+                    // inside the call so a normal link pays one boolean read per frame.
+                    noteUnbondedProbeFrame(parsed)
                     // A frame replayed as part of the historical offload (type 47/48/… during a backfill)
                     recordGroundTruthImuFrame(frame)
                     // must not drive LIVE-only state (the charging pill). (PR #568 reimpl)
@@ -7998,6 +8272,7 @@ class WhoopBleClient(
                     // path uses — and without this the DIS read never runs for anyone with the pairing
                     // experiment on, which is precisely who is testing.
                     scheduleUnbondedDisRead()
+                    scheduleUnbondedOffloadProbe()
                     return
                 }
 
@@ -8044,6 +8319,7 @@ class WhoopBleClient(
                     // both harder to read. If the read is what tears a stable link down, that is
                     // unambiguous — and it latches, so it costs one link and not a loop.
                     scheduleUnbondedDisRead()
+                    scheduleUnbondedOffloadProbe()
                 }
             }
         }
@@ -8060,6 +8336,18 @@ class WhoopBleClient(
         if (cccdInFlight) return
         val ch = cccdQueue.poll()
         if (ch == null) {
+            // #1635: the unbonded probe's own drain. BEFORE the bonded branch because that one requires
+            // didBond, which the probe deliberately never sets — and this must not fall through to
+            // startSession, which would re-enter the hello decision on a link that already made it.
+            if (connectedFamily == DeviceFamily.WHOOP5 && unbondedProbeSubscribing) {
+                unbondedProbeSubscribing = false
+                if (unbondedProbeSubscribed == 0) {
+                    log(unbondedProbeNoSubscriptionsLine(WHOOP5_NOTIFY_CHARS.size))
+                    return
+                }
+                askUnbondedProbeQuestion()
+                return
+            }
             // 5/MG handshake tail: after the PUFFIN notify chars are subscribed (the post-CLIENT_HELLO
             // drain — didBond is true by then), clock the strap and only then kick the offload. An
             // un-clocked WHOOP 5 discards sensor data ("RTC timestamp … is invalid; not saving data to
@@ -9394,6 +9682,18 @@ class WhoopBleClient(
         // exactly the gap this stopwatch was added to close. It is overwritten by the next request, and a
         // stale value can only ever produce a large elapsed against a label that names what it measures.
         connectHandshakeDone = false
+        // #1635: the probe is per LINK — its whole basis is one stable link's behaviour, and carrying the
+        // "already asked" flag across a reconnect would let one silent link retire the experiment. The
+        // REFUSAL, by contrast, is persisted per device: that one is the strap's answer, not the link's.
+        // Cancel BEFORE clearing the flags: a runnable already dequeued and waiting to run would otherwise
+        // see the cleared state, which is harmless, but one still queued must not reach the next link.
+        handler.removeCallbacks(unbondedProbeStartRunnable)
+        handler.removeCallbacks(unbondedProbeVerdictRunnable)
+        unbondedProbeStartedThisLink = false
+        unbondedProbeSubscribed = 0
+        unbondedProbeSubscribing = false
+        unbondedProbeAwaitingReply = false
+        unbondedProbeEvidence = UnbondedProbeEvidence.NONE
         helloWrittenThisLink = false
         backfillDeferralsThisLink = 0
         // The deferral run is deliberately NOT cleared: it counts ACROSS connections AND across process
diff --git a/android/app/src/main/java/com/noop/ui/DataSourcesScreen.kt b/android/app/src/main/java/com/noop/ui/DataSourcesScreen.kt
index b9b49425e1..aa5e602b52 100644
--- a/android/app/src/main/java/com/noop/ui/DataSourcesScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/DataSourcesScreen.kt
@@ -870,6 +870,12 @@ fun DataSourcesScreen(vm: AppViewModel) {
                 // encryptedBond, not bonded — see strapStatusTitle. A 5/MG streaming over the open
                 // profile has bonded == true with no pairing at all, and after #1635 hello suppression it
                 // stays there for good rather than passing through.
+                //
+                // "Live HR" reads a little wide here: bonded means REACHABLE, not currently streaming. It
+                // survives the stream stopping (take the strap off mid-link and it stays true), and the
+                // unbonded offload probe is a second way in — it sets bonded on a strap that answered a
+                // command without ever having sent an HR reading. Both are the same state: reachable over
+                // the open profile, never encrypted.
                 live.encryptedBond -> "Bonded, streaming." to StrandTone.Positive
                 live.bonded -> "Live HR (not fully paired)" to StrandTone.Warning
                 live.connected -> "Connected, pairing…" to StrandTone.Warning
diff --git a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
index 4c886c341a..0f0efdd104 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
@@ -585,6 +585,7 @@ fun SettingsScreen(
     val r22FlagCount = Whoop5Config.enableR22Sequence.size
     var broadcastHr by remember(rev) { mutableStateOf(puffinExperiment.broadcastHr) }
     var explicitBond by remember(rev) { mutableStateOf(puffinExperiment.explicitBond) }
+    var unbondedOffload by remember(rev) { mutableStateOf(puffinExperiment.unbondedOffload) }
     var helloDespiteRefusal by remember(rev) { mutableStateOf(puffinExperiment.helloDespiteBondRefusal) }
     // ECG raw-data gate (#891): the opt-in, the write result, and the attested-MG gate the buttons need.
     var ecgRawData by remember(rev) { mutableStateOf(puffinExperiment.ecgRawData) }
@@ -2354,6 +2355,41 @@ fun SettingsScreen(
                     )
                 }
 
+                // --- Try the historical offload on a link that never bonded. (#1635) ---
+                // The offload is gated on the CLIENT_HELLO ack, which a strap answering SMP "Pairing Not
+                // Supported" can never give — so the gate is ours, not the strap's, and the assumption it
+                // rests on has never been measured. This asks, read-only first.
+                Row(
+                    modifier = Modifier.fillMaxWidth(),
+                    verticalAlignment = Alignment.CenterVertically,
+                    horizontalArrangement = Arrangement.spacedBy(16.dp),
+                ) {
+                    Text(
+                        uiString(R.string.l10n_settings_screen_try_history_sync_without_pairing_experimental_54c31ea2),
+                        style = NoopType.subhead,
+                        color = Palette.textPrimary,
+                        modifier = Modifier.weight(1f),
+                    )
+                    Switch(
+                        checked = unbondedOffload,
+                        onCheckedChange = {
+                            unbondedOffload = it
+                            puffinExperiment.unbondedOffload = it
+                        },
+                        colors = SwitchDefaults.colors(
+                            checkedThumbColor = Palette.surfaceBase,
+                            checkedTrackColor = Palette.accent,
+                            uncheckedThumbColor = Palette.textSecondary,
+                            uncheckedTrackColor = Palette.surfaceInset,
+                            uncheckedBorderColor = Palette.hairline,
+                        ),
+                        modifier = Modifier.semantics {
+                            contentDescription =
+                                uiString(R.string.l10n_settings_screen_try_history_sync_without_pairing_33ae8594)
+                        },
+                    )
+                }
+
                 // --- Send the hello even when the suppression latch is set. (#1635) ---
                 // An HCI capture shows the strap answers createBond with SMP "Pairing Not Supported", so
                 // the bond the hello waits behind can never arrive — and with the hello suppressed the app
diff --git a/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt b/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
index d58992ff60..84595a09e9 100644
--- a/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
@@ -104,6 +104,7 @@ fun TestCentreScreen(vm: AppViewModel, onOpenGroundTruthCollector: () -> Unit =
     var deepData by remember { mutableStateOf(puffinExperiment.isDeepDataEnabled) }
     var broadcastHr by remember { mutableStateOf(puffinExperiment.broadcastHr) }
     var explicitBond by remember { mutableStateOf(puffinExperiment.explicitBond) }
+    var unbondedOffload by remember { mutableStateOf(puffinExperiment.unbondedOffload) }
     var ecgRawData by remember { mutableStateOf(puffinExperiment.ecgRawData) }
     val r22DisableReport by vm.ble.r22DisableReport.collectAsStateWithLifecycle()
     val ecgGateReport by vm.ble.ecgRawDataGate.collectAsStateWithLifecycle()
@@ -245,6 +246,19 @@ fun TestCentreScreen(vm: AppViewModel, onOpenGroundTruthCollector: () -> Unit =
                             puffinExperiment.explicitBond = it
                         },
                     )
+                    DeveloperToggleRow(
+                        title = stringResource(R.string.raw_diag_unbonded_offload),
+                        detail = "Subscribes the puffin notify characteristics on a link with no " +
+                            "CLIENT_HELLO, then asks the strap a read-only GET_CLOCK. If it answers, the " +
+                            "clock is set and history is requested. Once per link, and never again on a " +
+                            "strap that refuses. Takes effect on the next connect, not this one. " +
+                            "Leave it off unless you are testing #1635.",
+                        checked = unbondedOffload,
+                        onCheckedChange = {
+                            unbondedOffload = it
+                            puffinExperiment.unbondedOffload = it
+                        },
+                    )
                     DeveloperToggleRow(
                         title = stringResource(R.string.raw_diag_r22),
                         detail = "Accepted writes have not been shown to enable a separate live stream. Not required for normal sync or raw capture.",
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index a0761398e3..c091f7a3ad 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -1585,6 +1585,8 @@
     <string name="l10n_settings_screen_this_is_a_plain_unencrypted_archive_b0dfe63d">Das ist ein einfaches, unverschlüsseltes Archiv — wer die Datei bekommt, kann sie mit jedem Zip-Programm öffnen. Bewahren Sie sie an einem Ort auf, dem Sie vertrauen.</string>
     <string name="l10n_settings_screen_this_restarts_the_roughly_4_night_c610a93d">Das startet den etwa 4-nächtigen Aufbau für Ladung und deine HRV-Basislinie neu. Dein Verlauf bleibt. Nutze es, wenn eine schlechte erste Woche, etwa krank getragen, deine Basislinie verzerrt hat.</string>
     <string name="l10n_settings_screen_trend_charts_19085c81">Trenddiagramme</string>
+    <string name="l10n_settings_screen_try_history_sync_without_pairing_experimental_54c31ea2">Verlaufssynchronisierung ohne Kopplung versuchen (experimentell)</string>
+    <string name="l10n_settings_screen_try_history_sync_without_pairing_33ae8594">Verlaufssynchronisierung ohne Kopplung versuchen</string>
     <string name="l10n_settings_screen_try_whoop_5_mg_protocol_probes_1d584653">WHOOP 5/MG-Protokolltests ausprobieren</string>
     <string name="l10n_settings_screen_units_12748281">Einheiten</string>
     <string name="l10n_settings_screen_unlock_whoop_5_mg_deep_data_2f2bd226">WHOOP-5/MG-Tiefendaten freischalten (R22)</string>
@@ -2623,6 +2625,7 @@
     <string name="raw_diag_protocol_probes">Protokolltests</string>
     <string name="raw_diag_broadcast_hr">Herzfrequenz vom Band übertragen</string>
     <string name="raw_diag_pair">Android um Kopplung bitten</string>
+    <string name="raw_diag_unbonded_offload">Verlaufssynchronisierung ohne Kopplung versuchen</string>
     <string name="raw_diag_r22">Altes R22-Feature-Flag-Experiment</string>
     <string name="raw_diag_r22_enable">Alte R22-Aktivierungssequenz senden</string>
     <string name="raw_diag_r22_clear">R22-Flags auf dem Band löschen</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 1ce1f4d192..8eb747e708 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -1385,6 +1385,8 @@
     <string name="l10n_settings_screen_this_is_a_plain_unencrypted_archive_b0dfe63d">Es un archivo sencillo y sin cifrar: cualquiera que consiga el archivo puede abrirlo con cualquier herramienta zip. Guárdelo en un lugar de confianza.</string>
     <string name="l10n_settings_screen_this_restarts_the_roughly_4_night_c610a93d">Esto reinicia el período de unas 4 noches de construcción de la Carga y tu línea base de VFC. Tu historial se conserva. Úsalo si una mala primera semana, como usarla estando enfermo, desvió tu línea base.</string>
     <string name="l10n_settings_screen_trend_charts_19085c81">Gráficos de tendencias</string>
+    <string name="l10n_settings_screen_try_history_sync_without_pairing_experimental_54c31ea2">Probar la sincronización del historial sin vinculación (experimental)</string>
+    <string name="l10n_settings_screen_try_history_sync_without_pairing_33ae8594">Probar la sincronización del historial sin vinculación</string>
     <string name="l10n_settings_screen_try_whoop_5_mg_protocol_probes_1d584653">Prueba las sondas del protocolo WHOOP 5/MG</string>
     <string name="l10n_settings_screen_units_12748281">Unidades</string>
     <string name="l10n_settings_screen_unlock_whoop_5_mg_deep_data_2f2bd226">Desbloquear datos profundos de WHOOP 5/MG (R22)</string>
@@ -2608,6 +2610,7 @@
     <string name="raw_diag_protocol_probes">Sondas de protocolo</string>
     <string name="raw_diag_broadcast_hr">Transmitir frecuencia cardíaca desde la pulsera</string>
     <string name="raw_diag_pair">Pedir a Android que vincule</string>
+    <string name="raw_diag_unbonded_offload">Probar la sincronización del historial sin vinculación</string>
     <string name="raw_diag_r22">Experimento antiguo de indicadores R22</string>
     <string name="raw_diag_r22_enable">Enviar secuencia de activación R22 antigua</string>
     <string name="raw_diag_r22_clear">Borrar indicadores R22 de la pulsera</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 50d2ee292e..befe1387f4 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -1403,6 +1403,8 @@
     <string name="l10n_settings_screen_this_is_a_plain_unencrypted_archive_b0dfe63d">C\'est une archive simple, non chiffrée : quiconque récupère le fichier peut l\'ouvrir avec n\'importe quel outil zip. Conservez-le dans un endroit de confiance.</string>
     <string name="l10n_settings_screen_this_restarts_the_roughly_4_night_c610a93d">Cela relance la montée en puissance d\'environ 4 nuits pour la charge et votre référence VFC. Votre historique reste. Utilisez-la si une mauvaise première semaine, comme le porter en étant malade, a faussé votre référence.</string>
     <string name="l10n_settings_screen_trend_charts_19085c81">Tableaux de tendances</string>
+    <string name="l10n_settings_screen_try_history_sync_without_pairing_experimental_54c31ea2">Essayer la synchronisation de l\'historique sans appairage (expérimental)</string>
+    <string name="l10n_settings_screen_try_history_sync_without_pairing_33ae8594">Essayer la synchronisation de l\'historique sans appairage</string>
     <string name="l10n_settings_screen_try_whoop_5_mg_protocol_probes_1d584653">Essayer les sondes de protocole WHOOP 5/MG</string>
     <string name="l10n_settings_screen_units_12748281">Unités</string>
     <string name="l10n_settings_screen_unlock_whoop_5_mg_deep_data_2f2bd226">Débloquer les données approfondies WHOOP 5/MG (R22)</string>
@@ -2607,6 +2609,7 @@
     <string name="raw_diag_protocol_probes">Sondes de protocole</string>
     <string name="raw_diag_broadcast_hr">Diffuser la fréquence cardiaque du bracelet</string>
     <string name="raw_diag_pair">Demander l’appairage à Android</string>
+    <string name="raw_diag_unbonded_offload">Essayer la synchronisation de l\'historique sans appairage</string>
     <string name="raw_diag_r22">Ancienne expérience d’indicateurs R22</string>
     <string name="raw_diag_r22_enable">Envoyer l’ancienne séquence d’activation R22</string>
     <string name="raw_diag_r22_clear">Effacer les indicateurs R22 du bracelet</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 513db4221a..05131fdbfa 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -1542,6 +1542,8 @@
     <string name="l10n_settings_screen_this_is_a_plain_unencrypted_archive_b0dfe63d">Jest to zwykłe, niezaszyfrowane archiwum — każdy, kto otrzyma plik, może go otworzyć za pomocą dowolnego narzędzia zip. Przechowuj go w zaufanym miejscu.</string>
     <string name="l10n_settings_screen_this_restarts_the_roughly_4_night_c610a93d">Spowoduje to ponowne uruchomienie trwającego około 4 dni tworzenia Energia i linii bazowej HRV. Twoja historia zostaje. Użyj go, jeśli zły pierwszy tydzień, np. noszenie go podczas choroby, zaburzy Twoją linię bazową.</string>
     <string name="l10n_settings_screen_trend_charts_19085c81">Wykresy trendów</string>
+    <string name="l10n_settings_screen_try_history_sync_without_pairing_experimental_54c31ea2">Spróbuj synchronizacji historii bez parowania (eksperymentalne)</string>
+    <string name="l10n_settings_screen_try_history_sync_without_pairing_33ae8594">Spróbuj synchronizacji historii bez parowania</string>
     <string name="l10n_settings_screen_try_whoop_5_mg_protocol_probes_1d584653">Wypróbuj sondy protokołu WHOOP 5/MG</string>
     <string name="l10n_settings_screen_units_12748281">Jednostki</string>
     <string name="l10n_settings_screen_unlock_whoop_5_mg_deep_data_2f2bd226">Odblokuj głębokie dane WHOOP 5/MG (R22)</string>
@@ -2612,6 +2614,7 @@
     <string name="raw_diag_protocol_probes">Testy protokołu</string>
     <string name="raw_diag_broadcast_hr">Transmituj tętno z opaski</string>
     <string name="raw_diag_pair">Poproś Androida o sparowanie</string>
+    <string name="raw_diag_unbonded_offload">Spróbuj synchronizacji historii bez parowania</string>
     <string name="raw_diag_r22">Starszy eksperyment flag R22</string>
     <string name="raw_diag_r22_enable">Wyślij starszą sekwencję włączenia R22</string>
     <string name="raw_diag_r22_clear">Wyczyść flagi R22 na opasce</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index eda3f3afc1..1541360f99 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -1548,6 +1548,8 @@
     <string name="l10n_settings_screen_this_is_a_plain_unencrypted_archive_b0dfe63d">É um arquivo simples, não encriptado — quem tiver o ficheiro pode abri-lo com qualquer ferramenta zip. Guarda-o num sítio de confiança.</string>
     <string name="l10n_settings_screen_this_restarts_the_roughly_4_night_c610a93d">Isto reinicia a acumulação de aproximadamente 4 noites para a Carga e a tua linha de base de HRV. A tua histórico permanece. Usa-o se uma má primeira semana, como usá-lo durante uma doença, definir a tua linha de base.</string>
     <string name="l10n_settings_screen_trend_charts_19085c81">Gráficos de tendências</string>
+    <string name="l10n_settings_screen_try_history_sync_without_pairing_experimental_54c31ea2">Tentar sincronizar o histórico sem emparelhamento (experimental)</string>
+    <string name="l10n_settings_screen_try_history_sync_without_pairing_33ae8594">Tentar sincronizar o histórico sem emparelhamento</string>
     <string name="l10n_settings_screen_try_whoop_5_mg_protocol_probes_1d584653">Experimente as sondagens de protocolo WHOOP 5/MG</string>
     <string name="l10n_settings_screen_units_12748281">Unidades</string>
     <string name="l10n_settings_screen_unlock_whoop_5_mg_deep_data_2f2bd226">Desbloquear dados profundos do WHOOP 5/MG (R22)</string>
@@ -2600,6 +2602,7 @@
     <string name="raw_diag_protocol_probes">Sondas de protocolo</string>
     <string name="raw_diag_broadcast_hr">Transmitir frequência cardíaca da bracelete</string>
     <string name="raw_diag_pair">Pedir ao Android para emparelhar</string>
+    <string name="raw_diag_unbonded_offload">Tentar sincronizar o histórico sem emparelhamento</string>
     <string name="raw_diag_r22">Experiência antiga de indicadores R22</string>
     <string name="raw_diag_r22_enable">Enviar sequência antiga de ativação R22</string>
     <string name="raw_diag_r22_clear">Limpar indicadores R22 da bracelete</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 0d20b299e7..94bd75d28a 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -1528,6 +1528,8 @@
     <string name="l10n_settings_screen_this_is_a_plain_unencrypted_archive_b0dfe63d">这是一个未加密的普通压缩包——任何拿到文件的人都能用任意压缩工具打开它。请把它存放在你信任的地方。</string>
     <string name="l10n_settings_screen_this_restarts_the_roughly_4_night_c610a93d">这将重新启动大约需要 4 个晚上的充能(Charge)与 HRV 基准建立过程。您的历史数据都会被保留下来。如果因为您第一周佩戴时状态不佳（比如生病），导致基线严重偏离了正常水平，请使用此功能。</string>
     <string name="l10n_settings_screen_trend_charts_19085c81">趋势图表</string>
+    <string name="l10n_settings_screen_try_history_sync_without_pairing_experimental_54c31ea2">尝试在未配对状态下同步历史数据（实验性）</string>
+    <string name="l10n_settings_screen_try_history_sync_without_pairing_33ae8594">尝试在未配对状态下同步历史数据</string>
     <string name="l10n_settings_screen_try_whoop_5_mg_protocol_probes_1d584653">尝试触发 WHOOP 5.0/MG 协议探针</string>
     <string name="l10n_settings_screen_units_12748281">度量单位</string>
     <string name="l10n_settings_screen_unlock_whoop_5_mg_deep_data_2f2bd226">解锁 WHOOP 5.0/MG 的深层数据 (R22协议)</string>
@@ -2521,6 +2523,7 @@
     <string name="raw_diag_protocol_probes">协议探测</string>
     <string name="raw_diag_broadcast_hr">从手环广播心率</string>
     <string name="raw_diag_pair">请求 Android 配对</string>
+    <string name="raw_diag_unbonded_offload">尝试在未配对状态下同步历史数据</string>
     <string name="raw_diag_r22">旧版 R22 功能标志实验</string>
     <string name="raw_diag_r22_enable">发送旧版 R22 启用序列</string>
     <string name="raw_diag_r22_clear">清除手环上的 R22 标志</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 962108936b..de5fd59809 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -1681,6 +1681,8 @@
     <string name="l10n_settings_screen_this_is_a_plain_unencrypted_archive_b0dfe63d">This is a plain, unencrypted archive — anyone who gets the file can open it with any zip tool. Store it somewhere you trust.</string>
     <string name="l10n_settings_screen_this_restarts_the_roughly_4_night_c610a93d">This restarts the roughly 4-night build-up for Charge and your HRV baseline. Your history stays. Use it if a bad first week, like wearing it while sick, set your baseline off.</string>
     <string name="l10n_settings_screen_trend_charts_19085c81">Trend charts</string>
+    <string name="l10n_settings_screen_try_history_sync_without_pairing_experimental_54c31ea2">Try history sync without pairing (experimental)</string>
+    <string name="l10n_settings_screen_try_history_sync_without_pairing_33ae8594">Try history sync without pairing</string>
     <string name="l10n_settings_screen_try_whoop_5_mg_protocol_probes_1d584653">Try WHOOP 5/MG protocol probes</string>
     <string name="l10n_settings_screen_units_12748281">Units</string>
     <string name="l10n_settings_screen_unlock_whoop_5_mg_deep_data_2f2bd226">Unlock WHOOP 5/MG deep data (R22)</string>
@@ -2636,6 +2638,7 @@
     <string name="raw_diag_protocol_probes">Protocol probes</string>
     <string name="raw_diag_broadcast_hr">Broadcast heart rate from the strap</string>
     <string name="raw_diag_pair">Ask Android to pair</string>
+    <string name="raw_diag_unbonded_offload">Try history sync without pairing</string>
     <string name="raw_diag_r22">Legacy R22 feature-flag experiment</string>
     <string name="raw_diag_r22_enable">Send legacy R22 enable sequence</string>
     <string name="raw_diag_r22_clear">Clear legacy R22 flags on strap</string>
diff --git a/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt b/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
new file mode 100644
index 0000000000..e82c6060d2
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
@@ -0,0 +1,240 @@
+package com.noop.ble
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The probe's whole value is that it stops. Every gate below is one of the ways this area has previously
+ * produced a loop that retries something which cannot work, so they are pinned individually rather than
+ * through one happy-path case.
+ */
+class UnbondedOffloadProbeTest {
+
+    private fun probe(
+        isWhoop5: Boolean = true,
+        optedIn: Boolean = true,
+        bonded: Boolean = false,
+        helloWrittenThisLink: Boolean = false,
+        alreadyProbedThisLink: Boolean = false,
+        previouslyRefused: Boolean = false,
+        silentLinksSoFar: Int = 0,
+    ) = shouldProbeUnbondedOffload(
+        isWhoop5 = isWhoop5,
+        optedIn = optedIn,
+        bonded = bonded,
+        helloWrittenThisLink = helloWrittenThisLink,
+        alreadyProbedThisLink = alreadyProbedThisLink,
+        previouslyRefused = previouslyRefused,
+        silentLinksSoFar = silentLinksSoFar,
+    )
+
+    @Test
+    fun `an opted-in 5MG on a stable unbonded link is exactly the case this exists for`() {
+        assertTrue(probe())
+    }
+
+    @Test
+    fun `a WHOOP4 is never probed`() {
+        // 4.0 bonds normally and reaches the offload through the proven path; there is nothing to ask it.
+        assertFalse(probe(isWhoop5 = false))
+    }
+
+    @Test
+    fun `it is off unless the user opted in`() {
+        assertFalse(probe(optedIn = false))
+    }
+
+    @Test
+    fun `a bonded strap uses the proven handshake instead`() {
+        assertFalse(probe(bonded = true))
+    }
+
+    /**
+     * The gate that keeps the ANSWER attributable. On a link carrying a hello the bond watchdog has about
+     * five seconds before it bounces us, so a subscribe failure there could be the strap's policy or could
+     * be our own teardown landing mid-write — indistinguishable, which is precisely the ambiguity that made
+     * the CLIENT_HELLO unreadable for eleven weeks. The one attempt on record (28 Aug 13:25:00) failed this
+     * way and proved nothing.
+     */
+    @Test
+    fun `a link that carries a hello cannot answer this question`() {
+        assertFalse(probe(helloWrittenThisLink = true))
+    }
+
+    @Test
+    fun `it runs once per link, not once per keep-alive tick`() {
+        // enableLiveNotifications drains the same CCCD queue every 30s, so without this the probe would
+        // re-enter its own completion branch on every keep-alive for the life of the connection.
+        assertFalse(probe(alreadyProbedThisLink = true))
+    }
+
+    @Test
+    fun `a refusal is remembered, so the strap says no once`() {
+        assertFalse(probe(previouslyRefused = true))
+    }
+
+    /**
+     * Silence is not latched per device, so once-per-link does NOT bound it — the probe re-runs on every
+     * reconnect, and a strap that reconnects often would re-ask a question already answered the same way.
+     * That is the unbounded retry this whole area keeps producing, so silence spends a per-process budget.
+     */
+    @Test
+    fun `repeated silence retires the probe`() {
+        assertTrue(probe(silentLinksSoFar = UNBONDED_PROBE_MAX_SILENT_LINKS - 1))
+        assertFalse(probe(silentLinksSoFar = UNBONDED_PROBE_MAX_SILENT_LINKS))
+        assertFalse(probe(silentLinksSoFar = UNBONDED_PROBE_MAX_SILENT_LINKS + 5))
+    }
+
+    @Test
+    fun `the give-up line says why it stopped, not merely that it did`() {
+        // The CLIENT_HELLO's suppression stopped silently and cost eleven weeks of unreadable captures.
+        val line = unbondedProbeGaveUpLine(3)
+        assertTrue(line.contains("serves those characteristics unbonded"))
+        assertTrue(line.contains("does not act on commands"))
+    }
+
+    @Test
+    fun `the refusal key is per device and case-insensitive`() {
+        // The same strap presents its address in different cases across sessions; a case-sensitive key
+        // would latch a second time under a second name and re-ask a strap that already refused.
+        assertEquals(
+            unbondedOffloadRefusedPrefKey("AA:BB:CC:DD:EE:FF"),
+            unbondedOffloadRefusedPrefKey("aa:bb:cc:dd:ee:ff"),
+        )
+        assertNull(unbondedOffloadRefusedPrefKey(null))
+        assertNull(unbondedOffloadRefusedPrefKey("   "))
+    }
+
+    /**
+     * The distinction the whole probe turns on. A frame proves the strap SERVES the puffin characteristics
+     * unbonded; only a reply proves it ACTS on what we write. Collapsing the two is how the false bond of
+     * 28 Aug read an unrelated DISABLE_ALARM completion as an answer to the hello.
+     */
+    @Test
+    fun `only a command response proves the command channel`() {
+        assertEquals(
+            UnbondedProbeEvidence.ANSWERS_COMMANDS,
+            unbondedProbeEvidenceOf(ok = true, crcOk = true, typeName = "COMMAND_RESPONSE"),
+        )
+        assertEquals(
+            UnbondedProbeEvidence.SERVES_NOTIFICATIONS,
+            unbondedProbeEvidenceOf(ok = true, crcOk = true, typeName = "REALTIME_DATA"),
+        )
+    }
+
+    /**
+     * Noise must never be read as proof. The probe runs on a link whose right to carry this traffic is the
+     * open question, so a frame that fails its CRC could as easily be the stack handing us a fragment as
+     * the strap answering — and counting it would let the probe conclude the opposite of the truth.
+     */
+    @Test
+    fun `an unverified frame is not evidence of anything`() {
+        assertEquals(
+            UnbondedProbeEvidence.NONE,
+            unbondedProbeEvidenceOf(ok = true, crcOk = false, typeName = "COMMAND_RESPONSE"),
+        )
+        // No CRC to check is not a pass either: `ok` alone is only an envelope check.
+        assertEquals(
+            UnbondedProbeEvidence.NONE,
+            unbondedProbeEvidenceOf(ok = true, crcOk = null, typeName = "COMMAND_RESPONSE"),
+        )
+        assertEquals(
+            UnbondedProbeEvidence.NONE,
+            unbondedProbeEvidenceOf(ok = false, crcOk = true, typeName = "COMMAND_RESPONSE"),
+        )
+        assertEquals(
+            UnbondedProbeEvidence.NONE,
+            unbondedProbeEvidenceOf(ok = true, crcOk = true, typeName = "   "),
+        )
+    }
+
+    /**
+     * The verdict must not depend on arrival order. Once realtime HR is streaming, REALTIME_DATA frames
+     * follow the COMMAND_RESPONSE continuously, and a last-one-wins reading would walk the conclusion back
+     * down to the weaker finding and report "not answering" on a strap that had just answered.
+     */
+    @Test
+    fun `the strongest evidence on the link is what stands`() {
+        val answered = strongerProbeEvidence(
+            UnbondedProbeEvidence.ANSWERS_COMMANDS,
+            UnbondedProbeEvidence.SERVES_NOTIFICATIONS,
+        )
+        assertEquals(UnbondedProbeEvidence.ANSWERS_COMMANDS, answered)
+        assertEquals(
+            UnbondedProbeEvidence.ANSWERS_COMMANDS,
+            strongerProbeEvidence(UnbondedProbeEvidence.NONE, UnbondedProbeEvidence.ANSWERS_COMMANDS),
+        )
+        assertEquals(
+            UnbondedProbeEvidence.SERVES_NOTIFICATIONS,
+            strongerProbeEvidence(UnbondedProbeEvidence.SERVES_NOTIFICATIONS, UnbondedProbeEvidence.NONE),
+        )
+    }
+
+    /**
+     * The silence line has to say which of the two silences this was. "Subscribed but nothing arrived" and
+     * "subscribed and frames arrived, but no reply" are different facts about the strap, and a capture that
+     * blurred them would send the next reader after the wrong thing.
+     */
+    @Test
+    fun `the silent verdict distinguishes an idle transport from an unanswering strap`() {
+        assertTrue(unbondedProbeSilentLine(5_000L, sawNotifications = true).contains("frames did arrive"))
+        assertTrue(unbondedProbeSilentLine(5_000L, sawNotifications = false).contains("nothing arrived"))
+        // Both must carry the wait, or the line cannot be judged against the capture's timestamps.
+        assertTrue(unbondedProbeSilentLine(5_000L, sawNotifications = true).contains("5000ms"))
+    }
+
+    /**
+     * The asking line must report what was CONFIRMED, not what was attempted. A CCCD write abandoned after
+     * its busy retries reaches the same completion path as four clean subscribes, so a flat "subscribed"
+     * would put a partial result in the capture as a whole one.
+     */
+    @Test
+    fun `the asking line reports the confirmed count, not the attempted one`() {
+        assertTrue(unbondedProbeAskingLine(3, 4, 8_000L).contains("3 of 4"))
+        assertTrue(unbondedProbeAskingLine(4, 4, 8_000L).contains("4 of 4"))
+    }
+
+    /**
+     * The third stage-1 outcome, and the one easiest to mis-file. Nothing confirmed AND nothing refused is
+     * the absence of an answer, not an answer — reporting it as either would put a fact in the capture that
+     * the link never established.
+     */
+    @Test
+    fun `nothing confirmed and nothing refused is neither a yes nor a no`() {
+        val line = unbondedProbeNoSubscriptionsLine(4)
+        assertTrue(line.contains("none was refused"))
+        assertTrue(line.contains("proves nothing"))
+    }
+
+    /**
+     * The expectation has to be set BEFORE the transfer, not after an empty one comes back. A strap that
+     * has never been clocked has never been told to persist to flash, so "nothing banked" is a plausible
+     * SUCCESS of the probe, and a reader who has not been told that will read it as a failure.
+     */
+    @Test
+    fun `the backlog caveat names the un-clocked strap, not a broken probe`() {
+        val line = unbondedProbeBacklogCaveatLine()
+        assertTrue(line.contains("never been clocked"))
+        assertTrue(line.contains("from now on"))
+    }
+
+    @Test
+    fun `every probe line names the issue it belongs to`() {
+        // A capture line without its issue number costs the next reader the search that this whole thread
+        // has already paid for repeatedly.
+        val lines = listOf(
+            unbondedProbeStartLine(),
+            puffinSubscribeRefusedLine("fd4b0003", "GATT_INSUFFICIENT_AUTHENTICATION(5)"),
+            unbondedProbeAskingLine(subscribed = 4, total = 4, waitMs = 5_000L),
+            unbondedProbeNoSubscriptionsLine(4),
+            unbondedProbeGaveUpLine(3),
+            unbondedProbeSilentLine(5_000L, sawNotifications = false),
+            unbondedProbeAnsweredLine(),
+            unbondedProbeBacklogCaveatLine(),
+        )
+        for (line in lines) assertTrue(line, line.contains("#1635"))
+    }
+}

From 7452b9c061de3ff73b5c46fe1d386e9b3938811b Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 22:10:07 +1200
Subject: [PATCH 093/333] staging: build 389 / iOS 270 for the unbonded offload
 probe

Build numbers only - 10.6.1 stays the unreleased line. 389 clears the staging
high-water so the APK installs over 388 rather than being refused.

Carries the #1635 unbonded offload probe, which is DEFAULT OFF: nothing changes for
anyone who does not turn it on under Settings -> Experimental ("Try history sync
without pairing"), or Test Centre -> 5/MG protocol diagnostics.

What to expect once it is on, in the strap log, on a link with no CLIENT_HELLO:

  "Unbonded offload probe: subscribing the puffin notify chars" - stage 1 started.
  Then one of:
   - "subscribe of fd4b0003... failed GATT_INSUFFICIENT_AUTHENTICATION" - the whole
     answer. The offload needs an encrypted link and a strap refusing SMP can never
     sync history. Latched, so it says this once.
   - "N of 4 puffin notify chars subscribed... Sending GET_CLOCK" - stage 2. Then
     either "COMMAND_RESPONSE received", which clocks the strap and requests the
     offload, or "no COMMAND_RESPONSE after 8000ms", which spends one of three
     silence attempts.

If it does reach the offload, expect the log to say so up front: this strap has
never been clocked by NOOP, and an un-clocked 5/MG does not save sensor data to
flash, so GET_DATA_RANGE may report little or nothing banked. That would mean
history works from now on, not that the probe failed.

Live HR is untouched either way. The probe's own writes go out without response
precisely so a strap that ignores them cannot wedge the write queue the way the
CLIENT_HELLO does.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 71ac609024..c18afe38fe 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 388
+        versionCode = 389
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 9a84b374a8..2ce44c7d80 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "269"
+    CURRENT_PROJECT_VERSION: "270"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 4280efa0455a9c8bcdbdc3c26ea4b3ceed618bb5 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 22:34:54 +1200
Subject: [PATCH 094/333] WHOOP 5/MG: let the offload probe supersede the
 handshake, or it never runs (#1743)

Follow-up to #1742, caught on the first field capture taken with any of it in mind:
the probe as merged would essentially never have run.

shouldProbeUnbondedOffload requires a link carrying no CLIENT_HELLO, and that gate
is right - a subscribe refusal on a link the bond watchdog is about to bounce is
unattributable, which is the ambiguity this thread has been paying for since June.
But the probe is only SCHEDULED from the two no-hello branches, and on this strap
neither is reached. Across 41 captures the suppression latch fired in three, all on
26 Aug, and never since; the explicit-bond deferral yields after its first connect
by design (#1642), so every link after that writes a hello. The 22:21 capture shows
the pull-to-refresh reaching the offload and being turned away by exactly this gate
twice in three seconds, with helloWrittenThisLink=true both times.

The resolution is not to loosen attributability. It is that these are mutually
exclusive experiments: "does the hello work" and "is the hello needed at all"
cannot both be asked of one link, because asking the first is what destroys the
second's link. Opting in now supersedes the handshake for that connect - the
explicit pairing request as well as the hello - placed ahead of both, since the
deferral branch returns early and a probe scheduled after it never runs.

Pressing Connect still gets the handshake, exactly as it overrides the suppression
latch. An explicit request for one experiment must not be answered with another.

The line says the hello is absent BY CHOICE, because an absent hello reads
identically to one that failed silently, and it names the explicit-bond switch when
that is also on - a pairing in flight makes a refusal unattributable, so the probe
declines to latch it and the capture is weaker for nothing.

Also puts versionCode in the strap-log header. Build identity has been ambiguous
three times in two days; dating the 22:21 capture depended on noticing that probe
lines were absent.

Staging 390 / iOS 271. 4893 tests, lintVital, doc lint and i18n clean.
---
 android/app/build.gradle.kts                  |  2 +-
 .../java/com/noop/ble/UnbondedOffloadProbe.kt | 48 +++++++++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 21 ++++++++
 .../noop/testcentre/TestBundleAssembler.kt    |  2 +-
 .../src/main/java/com/noop/ui/LogExport.kt    |  4 +-
 .../com/noop/ble/UnbondedOffloadProbeTest.kt  | 52 +++++++++++++++++++
 project.yml                                   |  2 +-
 7 files changed, 126 insertions(+), 5 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index c18afe38fe..a0f9b30e27 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 389
+        versionCode = 390
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
index a425f8cd40..6b3ddfbcd9 100644
--- a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
+++ b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
@@ -96,6 +96,54 @@ internal fun unbondedProbeGaveUpLine(silentLinks: Int): String =
         " written to them. Not asking again this session. History offload is unavailable until the strap" +
         " completes a handshake (#1635)."
 
+/**
+ * Does opting into the unbonded offload probe replace the handshake attempt on this connect?
+ *
+ * Found in the field, and it is the difference between the probe running and never running at all.
+ * [shouldProbeUnbondedOffload] requires a link carrying NO hello, because a refusal on a link the bond
+ * watchdog is about to bounce is unattributable. But the probe is only SCHEDULED from the two no-hello
+ * branches, and on this strap neither is reached in practice: across 41 captures the suppression latch
+ * fired in three, all on one day, and never since — while the explicit-bond deferral yields after its
+ * first connect by design (#1642), so every subsequent link writes a hello. The probe would have sat
+ * behind a state the app almost never enters.
+ *
+ * The resolution is not to loosen the attributability gate, which is what makes the answer worth having.
+ * It is to notice that these are MUTUALLY EXCLUSIVE experiments: "does the hello work" and "is the hello
+ * needed at all" cannot both be asked of one link, because asking the first is what destroys the second's
+ * link. Turning this switch on is choosing the second question, so it supersedes the handshake for that
+ * connect — both the explicit pairing request and the hello itself.
+ *
+ * [userInitiated] still wins, exactly as it does for the suppression latch. Pressing Connect is an
+ * explicit request for the handshake, and it must never be answered with a different experiment.
+ *
+ * Narrow on purpose: 5/MG only, never on a strap that has already bonded (that one reaches the offload the
+ * proven way and has nothing to prove), and default off, so no one who has not asked for this is affected.
+ */
+internal fun unbondedProbeSupersedesHandshake(
+    optedIn: Boolean,
+    isWhoop5: Boolean,
+    appLevelBonded: Boolean,
+    userInitiated: Boolean,
+): Boolean = optedIn && isWhoop5 && !appLevelBonded && !userInitiated
+
+/**
+ * Said once per superseded connect, because a hello that is absent looks identical to one that failed
+ * silently — the ambiguity that made #1635 unreadable for eleven weeks.
+ *
+ * Names the explicit-bond switch when it is also on. The two do not conflict fatally, but a pairing in
+ * flight makes a subscribe refusal unattributable to the strap, so the probe declines to latch it and the
+ * capture is weaker for no gain.
+ */
+internal fun unbondedProbeSupersedesLine(explicitBondOptedIn: Boolean): String =
+    "WHOOP 5/MG: handshake skipped for this connect — \"try history sync without pairing\" is on, and it" +
+        " asks whether the offload needs a bond at all. That question needs a link with no CLIENT_HELLO on" +
+        " it, so the hello is not written here (press Connect to try the handshake instead)." +
+        (if (explicitBondOptedIn)
+            " NOTE: \"Ask Android to pair\" is also on. A pairing in flight makes a refusal unattributable" +
+                " to the strap, so turn it off for a clean answer."
+        else "") +
+        " (#1635, experimental)"
+
 /** Persisted key for "this strap refused the unbonded puffin subscriptions". Per device and lowercased,
  *  for the same reason [firmwarePrefKey] is. */
 internal fun unbondedOffloadRefusedPrefKey(peripheralId: String?): String? =
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 433b4cfbe1..0de06dc557 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -8186,6 +8186,27 @@ class WhoopBleClient(
                     log(bondStateAtConnectLine(g.device.bondState, g.device.address),
                         com.noop.testcentre.TestDomain.CONNECTION)
                 }
+                // #1635: the unbonded offload probe replaces the handshake on this connect, and it must
+                // run BEFORE the pairing request as well as before the hello — its question needs a link
+                // with neither on it. Placed here rather than beside the hello decision because the
+                // deferral branch below returns early, and a probe scheduled after that never runs.
+                if (unbondedProbeSupersedesHandshake(
+                        optedIn = puffinExperiment.unbondedOffload,
+                        isWhoop5 = true,
+                        appLevelBonded = didBond,
+                        userInitiated = helloRetryRequested,
+                    )
+                ) {
+                    log(unbondedProbeSupersedesLine(explicitBondOptedIn = puffinExperiment.explicitBond))
+                    // The watchdog was armed at discovery and bounces the link whenever didBond is false,
+                    // which skipping the handshake guarantees. Same reasoning as the suppression path: with
+                    // no handshake outstanding there is nothing left for it to time out, and leaving it
+                    // armed would tear down the stable link the probe needs.
+                    cancelBondWatchdog()
+                    scheduleUnbondedDisRead()
+                    scheduleUnbondedOffloadProbe()
+                    return
+                }
                 if (shouldRequestExplicitBond(
                         optedIn = puffinExperiment.explicitBond,
                         isWhoop5 = true,
diff --git a/android/app/src/main/java/com/noop/testcentre/TestBundleAssembler.kt b/android/app/src/main/java/com/noop/testcentre/TestBundleAssembler.kt
index c9a6e728c0..7460c372eb 100644
--- a/android/app/src/main/java/com/noop/testcentre/TestBundleAssembler.kt
+++ b/android/app/src/main/java/com/noop/testcentre/TestBundleAssembler.kt
@@ -105,7 +105,7 @@ object TestBundleAssembler {
         //    strap-log share writes. Already scrubbed by the log() sink; the redactEntries pass re-scrubs.
         val header = buildString {
             appendLine("NOOP strap log")
-            appendLine("App:     ${BuildConfig.VERSION_NAME} (${BuildConfig.TIER})")
+            appendLine("App:     ${BuildConfig.VERSION_NAME} (${BuildConfig.TIER}) build ${BuildConfig.VERSION_CODE}")
             for (line in AndroidDiagnostics.summaryLines(context)) appendLine(line)
             appendLine("-".repeat(40))
         }
diff --git a/android/app/src/main/java/com/noop/ui/LogExport.kt b/android/app/src/main/java/com/noop/ui/LogExport.kt
index 54279fc084..393bf062b2 100644
--- a/android/app/src/main/java/com/noop/ui/LogExport.kt
+++ b/android/app/src/main/java/com/noop/ui/LogExport.kt
@@ -137,7 +137,7 @@ object LogExport {
             val dynamic = com.noop.testcentre.AndroidDiagnostics.dynamicLines(context)
             val header = buildString {
                 appendLine("NOOP strap log (scheduled debug export)")
-                appendLine("App:     ${BuildConfig.VERSION_NAME} (${BuildConfig.TIER})")
+                appendLine("App:     ${BuildConfig.VERSION_NAME} (${BuildConfig.TIER}) build ${BuildConfig.VERSION_CODE}")
                 // #453: the rolling BODY is scrubbed by WhoopBleClient.log(), but these HEADER lines never pass
                 // through it - and they carry device ids, which embed a BLE address for a re-added or second
                 // strap. Same redactor, so one export cannot be safe while the other leaks.
@@ -252,7 +252,7 @@ object LogExport {
         val dynamic = com.noop.testcentre.AndroidDiagnostics.dynamicLines(context)
         val header = buildString {
             appendLine("NOOP strap log")
-            appendLine("App:     ${BuildConfig.VERSION_NAME} (${BuildConfig.TIER})")
+            appendLine("App:     ${BuildConfig.VERSION_NAME} (${BuildConfig.TIER}) build ${BuildConfig.VERSION_CODE}")
             // #453: the rolling BODY is scrubbed by WhoopBleClient.log(), but these HEADER lines never pass
             // through it - and they carry device ids, which embed a BLE address for a re-added or second
             // strap. Same redactor, so one export cannot be safe while the other leaks.
diff --git a/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt b/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
index e82c6060d2..ceebb95e33 100644
--- a/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
+++ b/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
@@ -209,6 +209,58 @@ class UnbondedOffloadProbeTest {
         assertTrue(line.contains("proves nothing"))
     }
 
+    /**
+     * The gap that would have made the whole probe dead code. It needs a link with no hello on it, but the
+     * two branches that schedule it are barely reached on the strap this is for: across 41 field captures
+     * the suppression latch fired in three, all on one day, and the explicit-bond deferral yields after
+     * its first connect by design — so every later link writes a hello. Opting in has to supersede the
+     * handshake, or the probe waits for a state the app almost never enters.
+     */
+    @Test
+    fun `opting in replaces the handshake for that connect`() {
+        assertTrue(unbondedProbeSupersedesHandshake(
+            optedIn = true, isWhoop5 = true, appLevelBonded = false, userInitiated = false))
+        assertFalse(unbondedProbeSupersedesHandshake(
+            optedIn = false, isWhoop5 = true, appLevelBonded = false, userInitiated = false))
+        assertFalse(unbondedProbeSupersedesHandshake(
+            optedIn = true, isWhoop5 = false, appLevelBonded = false, userInitiated = false))
+    }
+
+    /**
+     * Pressing Connect is an explicit request for the HANDSHAKE, and must never be answered with a
+     * different experiment — the same rule the suppression latch already follows.
+     */
+    @Test
+    fun `pressing Connect still gets the handshake`() {
+        assertFalse(unbondedProbeSupersedesHandshake(
+            optedIn = true, isWhoop5 = true, appLevelBonded = false, userInitiated = true))
+    }
+
+    @Test
+    fun `a strap that already bonded has nothing to prove`() {
+        assertFalse(unbondedProbeSupersedesHandshake(
+            optedIn = true, isWhoop5 = true, appLevelBonded = true, userInitiated = false))
+    }
+
+    /**
+     * The supersede line must say the hello is absent BY CHOICE. An absent hello looks identical to one
+     * that failed silently, which is the ambiguity that made #1635 unreadable for eleven weeks — and it
+     * must name the explicit-bond clash, because a pairing in flight costs the probe its ability to
+     * attribute a refusal to the strap.
+     */
+    @Test
+    fun `the supersede line explains the absence and flags the clash`() {
+        val clean = unbondedProbeSupersedesLine(explicitBondOptedIn = false)
+        assertTrue(clean.contains("handshake skipped"))
+        assertTrue(clean.contains("press Connect"))
+        assertFalse(clean.contains("Ask Android to pair"))
+        assertTrue(clean.contains("#1635"))
+
+        val clash = unbondedProbeSupersedesLine(explicitBondOptedIn = true)
+        assertTrue(clash.contains("Ask Android to pair"))
+        assertTrue(clash.contains("unattributable"))
+    }
+
     /**
      * The expectation has to be set BEFORE the transfer, not after an empty one comes back. A strap that
      * has never been clocked has never been told to persist to flash, so "nothing banked" is a plausible
diff --git a/project.yml b/project.yml
index 2ce44c7d80..a741b8cc0e 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "270"
+    CURRENT_PROJECT_VERSION: "271"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From b2a4049676e9917ceb78bdc81b6006c91df6b819 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 30 Aug 2026 23:03:24 +1200
Subject: [PATCH 095/333] WHOOP 5/MG: a completed CLIENT_HELLO write is not an
 encrypted link (#1744)

The second false bond, from the 30 Aug 22:47 capture. Unlike the first this is not a
mis-attributed completion - the completion really is the hello's. The error is what
was concluded from it.

  22:46:31  CLIENT_HELLO outcome: acked by fd4b0002 after 5ms status=GATT_SUCCESS(0)
  22:46:31  [connection] bondState encryptedBond family=whoop5 (CLIENT_HELLO acked)
  22:46:33  bond state poll: BOND_NONE

One link, two seconds. The app showed "Bonded, streaming." for it, on a strap an HCI
capture already shows answering SMP "Pairing Not Supported" - where an encrypted bond
is not merely absent but impossible.

A write completion says the STACK finished the write. Encryption is a property of the
LINK, and on Android only the OS bond state attests it. Those are now separate:
encryptedBond waits for the OS bond state or the strap's own BLE_BONDED event, while
the completion still drives the HANDSHAKE - subscribe the puffin chars, clock the
strap, offload - all of which need the strap to be listening, not the link encrypted.
That split keeps the only path that has ever plausibly led to history on this strap
and drops the claim that was false.

Everything else in the branch asserting the strap's WILLINGNESS to bond is gated on
real encryption too: noteGenuineBond, clearPairingHint, staleDirectFailures, the
deferral run and the override budget. Clearing those on an unencrypted completion is
how a strap that has never bonded gets recorded as one that bonds fine - and it
retires the very counters that exist to notice it never did, so the more it fires the
less evidence survives that it fired.

Timing is diagnostic, never a gate. Across 41 captures every hello either "completed"
in 0, 4, 5 or 7ms or produced no callback at all about 3150ms later; nothing in
between, and 0ms cannot be a round trip. The line says so when the elapsed is under
one connection interval. It decides nothing - a peripheral may answer inside the same
connection event, so a strap that genuinely bonds must never lose its bond for being
quick.

Android-only on purpose: CoreBluetooth exposes no bond or link-encryption state, so a
shared helper would be handed a constant false and would suppress genuine bonds there.

Staging 391 / iOS 272. 4898 tests, lintVital, doc lint and i18n clean.
---
 android/app/build.gradle.kts                  |  2 +-
 .../java/com/noop/ble/ClientHelloOutcome.kt   | 56 +++++++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 44 +++++++++---
 .../ble/ClientHelloEncryptionSplitTest.kt     | 69 +++++++++++++++++++
 project.yml                                   |  2 +-
 5 files changed, 160 insertions(+), 13 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ble/ClientHelloEncryptionSplitTest.kt

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index a0f9b30e27..bc50f28b36 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 390
+        versionCode = 391
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/android/app/src/main/java/com/noop/ble/ClientHelloOutcome.kt b/android/app/src/main/java/com/noop/ble/ClientHelloOutcome.kt
index 44d2786c7a..32695f64c9 100644
--- a/android/app/src/main/java/com/noop/ble/ClientHelloOutcome.kt
+++ b/android/app/src/main/java/com/noop/ble/ClientHelloOutcome.kt
@@ -111,6 +111,62 @@ internal fun completionIsClientHelloAck(
     return isHelloChar && helloOutstanding
 }
 
+/**
+ * The shortest an ATT round trip can plausibly take, in milliseconds.
+ *
+ * BLE's minimum connection interval is 7.5ms. A peripheral may answer inside the same connection event,
+ * so this is not a hard floor and is NOT used to reject anything - it decides only whether the log points
+ * the reader at the timing. It earns its place from the field distribution, which is starkly bimodal:
+ * across 41 captures every hello either "completed" in 0, 4, 5 or 7ms, or produced no callback at all
+ * about 3150ms later. Nothing in between, and 0ms cannot be a round trip at all.
+ */
+internal const val MIN_PLAUSIBLE_ATT_ROUND_TRIP_MS = 8L
+
+/**
+ * Does a completed CLIENT_HELLO write prove the link is ENCRYPTED?
+ *
+ * No, and conflating the two is the second false bond. [completionIsClientHelloAck] answers a narrower
+ * question - "is this completion the hello's?" - and the ack branch then took a yes as proof of an
+ * encrypted just-works bond. Those are different facts. A write completion says the stack considers the
+ * write finished. Encryption is a property of the LINK, and on Android the only thing that attests it is
+ * the OS bond state.
+ *
+ * The field capture shows them disagreeing outright: "CLIENT_HELLO acked after 5ms", "encryptedBond
+ * family=whoop5", and then two seconds later "bond state poll: BOND_NONE" on the same link - with an HCI
+ * capture already showing this strap answers SMP `Pairing Not Supported`, so an encrypted bond is not
+ * merely absent but impossible. The app displayed "Bonded, streaming." for it.
+ *
+ * So the completion still drives the HANDSHAKE - subscribe the puffin chars, clock the strap, offload,
+ * all of which only need the strap to be listening - while `encryptedBond` waits for something that
+ * actually attests encryption: the OS bond state, or the strap's own BLE_BONDED event.
+ *
+ * ANDROID-ONLY, deliberately, and this one has no Swift twin. CoreBluetooth exposes no link-encryption
+ * or bond state at all, so Apple has nothing to supply for [osBonded] — a twin taking it would be handed
+ * a constant `false` and would suppress bonds that are genuine there. The gap is real on Apple too; it
+ * simply cannot be closed the same way, and pretending otherwise in a shared helper would be worse than
+ * leaving it Android-only and saying so.
+ */
+internal fun helloCompletionProvesEncryptedBond(osBonded: Boolean): Boolean = osBonded
+
+/**
+ * The line for a hello completion that did NOT come with encryption.
+ *
+ * Without it the split is invisible: the log would show the handshake proceeding and no bond claim, and a
+ * reader would have to infer why. It also carries the elapsed time, because on a completion faster than a
+ * connection interval the timing is itself the evidence that the callback came from the local stack rather
+ * than the strap - and a 0ms "round trip" is the clearest thing in the whole #1635 capture set.
+ */
+internal fun helloAckedWithoutEncryptionLine(elapsedMs: Long, osBondState: String): String =
+    "CLIENT_HELLO outcome: the write completed after ${elapsedMs}ms, but the OS bond state is" +
+        " $osBondState — a completed write says the stack finished it, NOT that the link is encrypted," +
+        " so this is not a bond." +
+        (if (elapsedMs < MIN_PLAUSIBLE_ATT_ROUND_TRIP_MS)
+            " ${elapsedMs}ms is under one BLE connection interval, so the callback most likely came from" +
+                " the local stack rather than the strap."
+        else "") +
+        " Continuing the handshake anyway — subscribing, clocking and offloading need the strap to be" +
+        " listening, not the link to be encrypted (#1635)."
+
 /**
  * A pre-bond write completion on a 5/MG link that arrived with NO CLIENT_HELLO outstanding.
  *
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 0de06dc557..689b522c01 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -6272,20 +6272,42 @@ class WhoopBleClient(
                     // just-works bonding completed. Now subscribe the puffin notify chars (realtime HR rides
                     // these as REALTIME_DATA — the strap rejected them on the unauthenticated link), then arm
                     // realtime HR with puffin framing. Mirrors the macOS post-bond flow.
+                    // A completed write means the STACK finished it. Encryption is a property of the
+                    // link, and on Android only the OS bond state attests it — so the two are split here
+                    // rather than inferred from one another. See [helloCompletionProvesEncryptedBond]:
+                    // the field capture has "acked after 5ms" and "BOND_NONE" two seconds apart on the
+                    // same link, for a strap an HCI capture shows refusing SMP outright.
+                    val encrypted = helloCompletionProvesEncryptedBond(
+                        osBonded = g.device.bondState == BluetoothDevice.BOND_BONDED,
+                    )
                     didBond = true
-                    setHelloDeferredRun(0)        // the handshake works on this strap; the run is over
-                    helloDeferredGuidanceLogged = false
-                    helloOverrideAttempts = 0     // #1635: the strap answered — the override's budget resets
-                    helloOverrideExhaustedLogged = false
-                    cancelBondWatchdog()          // genuine bond reached — the handshake watchdog stands down (#50)
-                    noteGenuineBond(g.device.address)   // #52: this strap bonds fine; clears any pin-refusal streak
-                    clearPairingHint()            // #78: a genuine bond means the pairing guidance no longer applies
+                    cancelBondWatchdog()          // the hello is answered either way — nothing left to time out (#50)
                     bondedDirectAttempt = false   // fast-path connect reached a real session (#78 fork)
-                    staleDirectFailures = 0       // genuine bond — clear the wiped-bond counter (#84 parity)
-                    _state.update { it.copy(bonded = true, encryptedBond = true) }   // genuine bond (#69)
+                    // Everything below claims something about the STRAP'S WILLINGNESS TO BOND, and a write
+                    // completion is not evidence of that. Clearing them on an unencrypted completion is how
+                    // a strap that never bonds gets recorded as one that bonds fine — and it retires the
+                    // very counters that exist to notice it never did.
+                    if (encrypted) {
+                        setHelloDeferredRun(0)        // the handshake works on this strap; the run is over
+                        helloDeferredGuidanceLogged = false
+                        helloOverrideAttempts = 0     // #1635: the strap answered — the override's budget resets
+                        helloOverrideExhaustedLogged = false
+                        noteGenuineBond(g.device.address)   // #52: this strap bonds fine; clears any pin-refusal streak
+                        clearPairingHint()            // #78: a genuine bond means the pairing guidance no longer applies
+                        staleDirectFailures = 0       // genuine bond — clear the wiped-bond counter (#84 parity)
+                    }
+                    _state.update { it.copy(bonded = true, encryptedBond = encrypted) }
                     bondedAtMs = System.currentTimeMillis()   // #617: stamp the bond so handleDisconnect can spot a bond-then-quick-timeout loop
-                    emitConnectionBondState("encryptedBond family=whoop5 (CLIENT_HELLO acked)")
-                    log("WHOOP 5/MG: CLIENT_HELLO acked — link established; subscribing notify chars (experimental).")
+                    if (encrypted) {
+                        emitConnectionBondState("encryptedBond family=whoop5 (CLIENT_HELLO acked)")
+                        log("WHOOP 5/MG: CLIENT_HELLO acked — link established; subscribing notify chars (experimental).")
+                    } else {
+                        log(helloAckedWithoutEncryptionLine(
+                            elapsedMs = if (clientHelloWriteAtMs > 0L)
+                                System.currentTimeMillis() - clientHelloWriteAtMs else -1L,
+                            osBondState = bondStateName(g.device.bondState),
+                        ))
+                    }
                     g.getService(WHOOP5_SERVICE)?.let { svc ->
                         for (u in WHOOP5_NOTIFY_CHARS) svc.getCharacteristic(u)?.let { cccdQueue.add(it) }
                     }
diff --git a/android/app/src/test/java/com/noop/ble/ClientHelloEncryptionSplitTest.kt b/android/app/src/test/java/com/noop/ble/ClientHelloEncryptionSplitTest.kt
new file mode 100644
index 0000000000..b98a415bd0
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ble/ClientHelloEncryptionSplitTest.kt
@@ -0,0 +1,69 @@
+package com.noop.ble
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The second false bond, found in the 30 Aug 22:47 capture.
+ *
+ * The ack branch took "the CLIENT_HELLO write completed" as proof of an encrypted just-works bond and set
+ * `encryptedBond`, so the app showed "Bonded, streaming." on a link whose OS bond state read BOND_NONE two
+ * seconds later — for a strap an HCI capture already showed answering SMP `Pairing Not Supported`, where an
+ * encrypted bond is not merely absent but impossible.
+ */
+class ClientHelloEncryptionSplitTest {
+
+    @Test
+    fun `a completed write is not proof of encryption`() {
+        assertFalse(helloCompletionProvesEncryptedBond(osBonded = false))
+    }
+
+    @Test
+    fun `the OS bond state is what attests it`() {
+        assertTrue(helloCompletionProvesEncryptedBond(osBonded = true))
+    }
+
+    /**
+     * The line must say the handshake CONTINUES. The split would otherwise read as a refusal, and the
+     * whole point is that subscribing, clocking and offloading need the strap to be listening — not the
+     * link to be encrypted.
+     */
+    @Test
+    fun `the line separates the two facts and says the handshake goes on`() {
+        val line = helloAckedWithoutEncryptionLine(elapsedMs = 5L, osBondState = "BOND_NONE")
+        assertTrue(line.contains("NOT that the link is encrypted"))
+        assertTrue(line.contains("BOND_NONE"))
+        assertTrue(line.contains("Continuing the handshake"))
+        assertTrue(line.contains("#1635"))
+    }
+
+    /**
+     * A completion faster than one connection interval is itself evidence the callback came from the local
+     * stack. Across 41 captures every hello either "completed" in 0-7ms or produced no callback at all
+     * ~3150ms later — nothing in between, and 0ms cannot be a round trip. The line points at that only
+     * when it applies; it must not editorialise about a plausible latency.
+     */
+    @Test
+    fun `an impossibly fast completion is called out, a plausible one is not`() {
+        assertTrue(helloAckedWithoutEncryptionLine(0L, "BOND_NONE").contains("under one BLE connection interval"))
+        assertTrue(helloAckedWithoutEncryptionLine(5L, "BOND_NONE").contains("under one BLE connection interval"))
+        assertFalse(helloAckedWithoutEncryptionLine(40L, "BOND_NONE").contains("under one BLE connection interval"))
+        // The boundary is the physical floor, not a round number pulled from the observed values.
+        assertFalse(
+            helloAckedWithoutEncryptionLine(MIN_PLAUSIBLE_ATT_ROUND_TRIP_MS, "BOND_NONE")
+                .contains("under one BLE connection interval"),
+        )
+    }
+
+    /**
+     * Timing is diagnostic, never a gate. A strap that genuinely bonds must not have its bond rejected for
+     * answering quickly — a peripheral may reply inside the same connection event, so a fast round trip is
+     * unusual, not impossible.
+     */
+    @Test
+    fun `timing never decides the bond`() {
+        assertTrue(helloCompletionProvesEncryptedBond(osBonded = true))
+        assertFalse(helloCompletionProvesEncryptedBond(osBonded = false))
+    }
+}
diff --git a/project.yml b/project.yml
index a741b8cc0e..b7914baa1e 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "271"
+    CURRENT_PROJECT_VERSION: "272"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From a82e7f6d82ea02bfb86c5f31a04e1021d2f3d597 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 00:09:24 +1200
Subject: [PATCH 096/333] Last sync belongs to a strap, not to the install
 (#1745)

Reported three times before it was believed, which is the part worth keeping: the
number was plausible, so the reading was treated as mistaken rather than the label.

`noop.lastSyncAtSec` is ONE key, stamped on any strap's HISTORY_COMPLETE and read
back for whichever strap is active. On a single-strap install those are the same
strap, which is why it survived this long. With two paired it reports the other
one's - the capture shows "Last sync: 4d ago" beside "Days: whoop-MGB...=0" and a
4.0 last seen three days earlier. The 5/MG had never banked a row. The timestamp on
its screen was the 4.0's.

Wrong in the reassuring direction, which is what made it expensive: a strap that had
never synced read as recently synced, so a pull-to-refresh that could not possibly
change the number looked broken rather than inapplicable - and it sent an entire
investigation after a sync regression that never existed.

Same defect resolveFirmware fixed for firmware strings, so it takes the same shape:
stamped per BLE address, read per strap, and the legacy global honoured ONLY when
exactly one strap is paired - the one case where it cannot be ambiguous, which keeps
single-strap installs reading correctly across the upgrade. Deliberately NOT migrated
by writing the global onto the active strap: that is the same guess in a different
place, and on a multi-strap install it would bake the wrong attribution in
permanently instead of self-correcting at the next real sync.

The #57 write-health pair had it too, one line below in the same capture: "Data
write: rows last landed 4d ago" against a strap whose own row count was zero. Both
halves are scoped, not just the noticed one - they are read as a pair ("stalled more
recently than ok" is the alarm), so scoping one would compare a strap's own stall
against another strap's success.

The second commit is the same bug surviving inside the fix for it, caught by a
question about what the screen would actually show. The constructor seeded from
NoopPrefs.lastDevice, which records the last strap to BOND - and `bonded` is set for
a 5/MG by the live-HR path, so on a two-strap install that is whichever strap was
worn most recently, not the one the screens are scoped to. Wear the 4.0 for an
evening and its sync time would appear on the 5/MG's Today screen at the next launch.
Seeded from the registry's ACTIVE row now; that read is suspend, so the constructor
seeds nothing and the value arrives a moment later. A blank moment is honest, and
there is no cheap synchronous guess that is not the bug in miniature.

For the strap in the capture the answer is now "never (this strap)". Not a degraded
answer - the correct one, and the one nobody had been given.

No Swift twin needed: the Apple side has no persisted global equivalent.

Staging 392 / iOS 273. 4907 tests, lintVital, doc lint and i18n clean.
---
 android/app/build.gradle.kts                  |   2 +-
 .../java/com/noop/ble/LastSyncAttribution.kt  |  68 +++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  |  58 +++++++++-
 .../com/noop/testcentre/AndroidDiagnostics.kt |  29 ++++-
 .../src/main/java/com/noop/ui/MainActivity.kt |  14 ++-
 .../com/noop/ble/LastSyncAttributionTest.kt   | 106 ++++++++++++++++++
 project.yml                                   |   2 +-
 7 files changed, 265 insertions(+), 14 deletions(-)
 create mode 100644 android/app/src/main/java/com/noop/ble/LastSyncAttribution.kt
 create mode 100644 android/app/src/test/java/com/noop/ble/LastSyncAttributionTest.kt

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index bc50f28b36..89100c11fc 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 391
+        versionCode = 392
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/android/app/src/main/java/com/noop/ble/LastSyncAttribution.kt b/android/app/src/main/java/com/noop/ble/LastSyncAttribution.kt
new file mode 100644
index 0000000000..d1369b98e1
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ble/LastSyncAttribution.kt
@@ -0,0 +1,68 @@
+package com.noop.ble
+
+/**
+ * Which "last sync" timestamp belongs to a strap, given what is known about it.
+ *
+ * The same bug [resolveFirmware] fixed for firmware, in the field again and reported three times before
+ * it was believed. `noop.lastSyncAtSec` is ONE global key, stamped on any strap's HISTORY_COMPLETE and
+ * read back for whichever strap is active. On a single-strap install those are the same strap, which is
+ * why it went unnoticed. With two paired it reports the OTHER strap's sync: a capture showing
+ * "Last sync: 4d ago" beside `Days: whoop-MGB…=0` and a 4.0 last seen 3 days earlier — the 5/MG had never
+ * banked a single row, and the number on its screen was the 4.0's.
+ *
+ * Worse than merely wrong: it is wrong in the reassuring direction. A strap that has never synced reads
+ * as recently synced, and the pull-to-refresh that cannot possibly change it looks broken rather than
+ * inapplicable. It sent this investigation after a "sync regression" that never existed.
+ *
+ * The rule, in order:
+ *  - [perDevice] wins: this strap's own stamp, from its own completed offload.
+ *  - [legacyGlobal] ONLY when [pairedCount] is 1. The old key cannot say which strap it belongs to, so
+ *    it is trustworthy exactly when there is only one strap it could have come from — which keeps a
+ *    single-strap install reading correctly across the upgrade instead of resetting to "never".
+ *  - otherwise null, meaning "this strap has never synced". For the strap in the capture that is not a
+ *    degraded answer, it is the correct one, and it is what the whole thread was missing.
+ *
+ * Deliberately NOT migrated by writing the global onto the active device at upgrade. That is the same
+ * guess in a different place, and on a multi-strap install it would bake the wrong attribution in
+ * permanently instead of leaving it to self-correct at the next real sync.
+ *
+ * Pure so the attribution is unit-tested without prefs, a strap, or a registry.
+ */
+internal fun resolveLastSync(
+    perDevice: Long,
+    legacyGlobal: Long,
+    pairedCount: Int,
+): Long? = perDevice.takeIf { it > 0L }
+    ?: legacyGlobal.takeIf { it > 0L && pairedCount == 1 }
+
+/**
+ * The per-device preference key for a persisted last-sync timestamp.
+ *
+ * Keyed on the BLE peripheral address for the same reason [firmwarePrefKey] is: HISTORY_COMPLETE arrives
+ * on a connection whose address is known, and resolving it to a registry id there would repeat the
+ * mis-mapping #1527 fixed for `lastSeen` — stamping "the active row" records a sync for a strap that was
+ * never connected, which is precisely the class of error being removed here.
+ *
+ * Lowercased, because the same strap presents its address in different cases across sessions and a
+ * case-sensitive key would strand the earlier stamp under a second name. Returns null for a blank
+ * address, so a caller with no address writes nothing rather than writing to a key that belongs to no
+ * device.
+ */
+internal fun lastSyncPrefKey(peripheralId: String?): String? =
+    peripheralId?.trim()?.takeIf { it.isNotEmpty() }?.let { "noop.lastSyncAt.${it.lowercase()}" }
+
+/**
+ * The per-device preference key for the #57 write-health stamps ("rows last landed", "offload stalled").
+ *
+ * Same defect as [lastSyncPrefKey] and found in the same capture, one line below it: `Data write: rows
+ * last landed 4d ago` printed against a strap whose own row count was zero, because the stamp was global
+ * and the 4.0 had written it. Two lines that both looked like evidence the 5/MG had been syncing, and
+ * neither was about the 5/MG.
+ *
+ * [kind] separates "ok" from "stalled" so both keep the per-device scoping rather than only the one that
+ * happened to be noticed — they are read as a PAIR ("stalled more recently than ok" is the alarm), and
+ * scoping one without the other would compare a strap's own stall against another strap's success.
+ */
+internal fun writeHealthPrefKey(peripheralId: String?, kind: String): String? =
+    peripheralId?.trim()?.takeIf { it.isNotEmpty() }
+        ?.let { "sync.$kind.${it.lowercase()}" }
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 689b522c01..ae74638093 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -1791,9 +1791,17 @@ class WhoopBleClient(
     // MARK: Published state — the single source of truth the UI observes. Seeded with the PERSISTED
     // last-sync time (PR #556 reimpl) so a freshly-recreated client doesn't show "Never" when this
     // install has actually synced before; a 0 (never) leaves it null, unchanged.
-    private val _state = MutableStateFlow(
-        LiveState(lastSyncAt = NoopPrefs.lastSyncAt(context).takeIf { it > 0L }),
-    )
+    //
+    // Deliberately seeded with NOTHING. The value belongs to the ACTIVE strap, and resolving which strap
+    // that is needs the registry, which is suspend — so [seedLastSyncFromActiveStrap] fills it in a moment
+    // later and the screens show no last-sync until it does.
+    //
+    // The obvious cheap seed, NoopPrefs.lastDevice, is the trap: it records the last strap to BOND, which
+    // on a two-strap install is whichever one was worn most recently, not the one the screens are scoped
+    // to. Seeding from it would put the 4.0's sync time on a 5/MG's Today screen — the exact bug this
+    // change exists to remove, surviving inside the fix for it. A blank moment is honest; another strap's
+    // timestamp is not.
+    private val _state = MutableStateFlow(LiveState())
     val state: StateFlow<LiveState> = _state.asStateFlow()
 
     private val _groundTruthImuStatus = MutableStateFlow(GroundTruthImuStatus())
@@ -2689,6 +2697,35 @@ class WhoopBleClient(
      */
     private val ioScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
 
+    /**
+     * Seed the last-sync display from the ACTIVE strap's own stamp — PR #556's intent, correctly attributed.
+     *
+     * Resolved against the registry's active row, exactly as the strap-log header resolves firmware and
+     * last-sync. NOT against `NoopPrefs.lastDevice`, which records the last strap to BOND: on a two-strap
+     * install that is whichever was worn most recently, not the one the screens are scoped to, so seeding
+     * from it would put one strap's sync time on the other's Today screen.
+     *
+     * The legacy global still applies when exactly one strap is paired, because only then can it not be
+     * ambiguous (see [resolveLastSync]). On the install that produced the capture — two straps, the active
+     * one having never synced — this correctly leaves the display empty and the 5/MG reads "never".
+     */
+    private fun seedLastSyncFromActiveStrap() {
+        val registry = (context.applicationContext as? com.noop.NoopApplication)?.deviceRegistry ?: return
+        ioScope.launch {
+            val rows = runCatching { registry.all() }.getOrDefault(emptyList())
+            val activeId = runCatching { registry.activeDeviceId() }.getOrNull()
+            val activeAddr = rows.firstOrNull { it.id == activeId }?.peripheralId
+            val seed = resolveLastSync(
+                perDevice = runCatching { NoopPrefs.lastSyncAtFor(context, activeAddr) }.getOrDefault(0L),
+                legacyGlobal = runCatching { NoopPrefs.lastSyncAt(context) }.getOrDefault(0L),
+                pairedCount = rows.size,
+            ) ?: return@launch
+            // Never overwrite a value this session earned: a HISTORY_COMPLETE landing while the registry
+            // read is in flight is newer than anything persisted, and must win.
+            _state.update { st -> if (st.lastSyncAt == null) st.copy(lastSyncAt = seed) else st }
+        }
+    }
+
     /**
      * Durable archive for undecodable history record frames (#77/#91). Written BEFORE the strap is
      * acked, so an unrecognised firmware layout can't cost the user their only copy: the ack frees
@@ -2697,6 +2734,7 @@ class WhoopBleClient(
     private val rawHistoryArchive = RawHistoryArchive(context)
 
     init {
+        seedLastSyncFromActiveStrap()
         // Retro-decode (#151): when the decoder gains a historical layout (WHOOP 4.0 v25), re-run every
         // archived undecodable frame through it and insert whatever now decodes — the only path by
         // which already-acked, strap-freed history backfills after an update. Runs once per APP version
@@ -9040,15 +9078,23 @@ class WhoopBleClient(
         }
         // PR #556 reimpl: persist the HISTORY_COMPLETE instant so "Last synced N ago" survives a BLE-client
         // recreation / process restart and stops reverting to "Never".
-        if (reason == "HISTORY_COMPLETE") NoopPrefs.setLastSyncAt(context, nowSec)
+        // Stamped against the strap that actually completed this offload, never globally. The old single
+        // key reported one strap's sync on another's screen — a 5/MG with zero banked rows reading
+        // "Last sync: 4d ago" from its paired 4.0, which is what sent this whole investigation after a
+        // regression that never existed.
+        if (reason == "HISTORY_COMPLETE") NoopPrefs.setLastSyncAtFor(context, lastDeviceAddress, nowSec)
         // #57 debug: write-health signal for the export. "Last sync" fires even on an empty/failed offload,
         // so it can't distinguish "0 rows because the strap was empty" from "0 rows because writes FAILED".
         // Record the last time rows actually landed, and the last time an offload STALLED on a persist
         // failure (the closed-DB-after-restore class) — so a future "sync stuck at 0" report is decidable.
         runCatching {
+            // Per strap, for the same reason the last-sync stamp above is: these two lines sat together
+            // in the capture, both global, both reporting the 4.0's activity on the 5/MG's screen.
             val p = NoopPrefs.of(context).edit()
-            if (backfiller.sessionRowsPersisted > 0) p.putLong("sync.lastWriteOkAt", nowSec)
-            if (backfiller.persistStalled) p.putLong("sync.lastWriteStalledAt", nowSec)
+            val okKey = writeHealthPrefKey(lastDeviceAddress, "lastWriteOkAt")
+            val stalledKey = writeHealthPrefKey(lastDeviceAddress, "lastWriteStalledAt")
+            if (backfiller.sessionRowsPersisted > 0 && okKey != null) p.putLong(okKey, nowSec)
+            if (backfiller.persistStalled && stalledKey != null) p.putLong(stalledKey, nowSec)
             p.apply()
         }
         // #580: a WHOOP 5/MG whose firmware serves no history offload (acks SEND_HISTORICAL_DATA but emits
diff --git a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
index a67e039941..1636945af9 100644
--- a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
@@ -88,14 +88,35 @@ object AndroidDiagnostics {
                 pairedCount = fwRows.size,
             )
             add("Firmware:    ${fw ?: "unknown (connect to record)"}")
-            val syncSec = com.noop.ui.NoopPrefs.lastSyncAt(context)
-            add("Last sync:   ${if (syncSec > 0L) relTime(System.currentTimeMillis() - syncSec * 1000L) else "never"}")
+            // THIS strap's own sync, attributed the same way the firmware above is. The old global key
+            // reported whichever strap synced last, so a 5/MG that had never banked a row showed its
+            // paired 4.0's timestamp — the line that made a non-existent sync regression look real.
+            val syncSec = com.noop.ble.resolveLastSync(
+                perDevice = com.noop.ui.NoopPrefs.lastSyncAtFor(context, fwRow?.peripheralId),
+                legacyGlobal = com.noop.ui.NoopPrefs.lastSyncAt(context),
+                pairedCount = fwRows.size,
+            ) ?: 0L
+            add("Last sync:   ${if (syncSec > 0L) relTime(System.currentTimeMillis() - syncSec * 1000L)
+                else "never (this strap)"}")
             // #57: write-health. "Last sync" fires even on an empty/failed offload, so distinguish "rows
             // actually landed" from "an offload STALLED on a persist failure" (history won't persist —
             // usually a backup restored without an app restart, the closed-DB class).
             val p = com.noop.ui.NoopPrefs.of(context)
-            val okAt = p.getLong("sync.lastWriteOkAt", 0L)
-            val stalledAt = p.getLong("sync.lastWriteStalledAt", 0L)
+            // Attributed exactly like "Last sync" above — the legacy global counts only when a single
+            // strap could have written it, so the pair can never mix one strap's stall with another's
+            // success. Read together: "stalled more recently than ok" is the alarm.
+            val okAt = com.noop.ble.resolveLastSync(
+                perDevice = com.noop.ble.writeHealthPrefKey(fwRow?.peripheralId, "lastWriteOkAt")
+                    ?.let { p.getLong(it, 0L) } ?: 0L,
+                legacyGlobal = p.getLong("sync.lastWriteOkAt", 0L),
+                pairedCount = fwRows.size,
+            ) ?: 0L
+            val stalledAt = com.noop.ble.resolveLastSync(
+                perDevice = com.noop.ble.writeHealthPrefKey(fwRow?.peripheralId, "lastWriteStalledAt")
+                    ?.let { p.getLong(it, 0L) } ?: 0L,
+                legacyGlobal = p.getLong("sync.lastWriteStalledAt", 0L),
+                pairedCount = fwRows.size,
+            ) ?: 0L
             val restoreAt = p.getLong("backup.lastRestoreAt", 0L)
             val now = System.currentTimeMillis()
             add("Data write:  ${if (okAt > 0L) "rows last landed ${relTime(now - okAt * 1000L)}" else "no rows ever persisted"}")
diff --git a/android/app/src/main/java/com/noop/ui/MainActivity.kt b/android/app/src/main/java/com/noop/ui/MainActivity.kt
index 3fa2f0ad37..ce1fd50ecb 100644
--- a/android/app/src/main/java/com/noop/ui/MainActivity.kt
+++ b/android/app/src/main/java/com/noop/ui/MainActivity.kt
@@ -1317,10 +1317,20 @@ object NoopPrefs {
      *  recreation / process restart and stops reverting to "Never". 0 = never synced on this install. */
     const val KEY_LAST_SYNC_AT = "noop.lastSyncAtSec"
 
+    /** LEGACY global reader. Kept only as [com.noop.ble.resolveLastSync]'s single-strap fallback, so an
+     *  install that has one strap keeps its timestamp across the upgrade. No longer written. */
     fun lastSyncAt(context: Context): Long = of(context).getLong(KEY_LAST_SYNC_AT, 0L)
 
-    fun setLastSyncAt(context: Context, epochSec: Long) {
-        of(context).edit().putLong(KEY_LAST_SYNC_AT, epochSec).apply()
+    /** This strap's own last completed offload, keyed by BLE address — see
+     *  [com.noop.ble.lastSyncPrefKey]. 0 when this strap has never synced. */
+    fun lastSyncAtFor(context: Context, peripheralId: String?): Long =
+        com.noop.ble.lastSyncPrefKey(peripheralId)?.let { of(context).getLong(it, 0L) } ?: 0L
+
+    /** Stamp a completed offload against the strap it came from. A blank address writes nothing rather
+     *  than writing to a key that belongs to no device. */
+    fun setLastSyncAtFor(context: Context, peripheralId: String?, epochSec: Long) {
+        val key = com.noop.ble.lastSyncPrefKey(peripheralId) ?: return
+        of(context).edit().putLong(key, epochSec).apply()
     }
 
     /** Last-known strap firmware string, persisted on connect so the debug export can name it OFFLINE
diff --git a/android/app/src/test/java/com/noop/ble/LastSyncAttributionTest.kt b/android/app/src/test/java/com/noop/ble/LastSyncAttributionTest.kt
new file mode 100644
index 0000000000..84faf29dd4
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ble/LastSyncAttributionTest.kt
@@ -0,0 +1,106 @@
+package com.noop.ble
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/**
+ * Reported three times before it was believed, which is the part worth remembering: the number was
+ * plausible, so the user was told their reading was wrong rather than the label.
+ *
+ * The field capture had `Last sync: 4d ago` beside `Days: whoop-MGB…=0` and a 4.0 last seen three days
+ * earlier. The 5/MG had never banked a row; the timestamp on its screen belonged to the other strap.
+ */
+class LastSyncAttributionTest {
+
+    @Test
+    fun `a strap's own stamp always wins`() {
+        assertEquals(500L, resolveLastSync(perDevice = 500L, legacyGlobal = 900L, pairedCount = 1))
+        assertEquals(500L, resolveLastSync(perDevice = 500L, legacyGlobal = 900L, pairedCount = 3))
+    }
+
+    /**
+     * The single-strap upgrade path. The global key is unattributed, but with one strap paired there is
+     * only one strap it can have come from — so it reads correctly across the upgrade instead of
+     * resetting to "never" for everyone.
+     */
+    @Test
+    fun `the legacy global is trustworthy only when one strap could have written it`() {
+        assertEquals(900L, resolveLastSync(perDevice = 0L, legacyGlobal = 900L, pairedCount = 1))
+        assertNull(resolveLastSync(perDevice = 0L, legacyGlobal = 900L, pairedCount = 2))
+    }
+
+    /**
+     * THE case from the capture. Two straps, and the active one has never synced: the honest answer is
+     * "never", not the other strap's timestamp. Not a degraded answer — the correct one, and the one the
+     * whole investigation was missing.
+     */
+    @Test
+    fun `a strap that has never synced says so, even when another strap has`() {
+        assertNull(resolveLastSync(perDevice = 0L, legacyGlobal = 1_787_000_000L, pairedCount = 2))
+    }
+
+    @Test
+    fun `nothing recorded anywhere is never`() {
+        assertNull(resolveLastSync(perDevice = 0L, legacyGlobal = 0L, pairedCount = 1))
+        assertNull(resolveLastSync(perDevice = 0L, legacyGlobal = 0L, pairedCount = 0))
+    }
+
+    /**
+     * A zero-paired registry must not license the global. The count is the evidence that exactly one
+     * strap could have written it; "no straps" is not that evidence, and treating it as such would let a
+     * mid-migration or failed registry read resurrect the bug.
+     */
+    @Test
+    fun `an unknown or empty registry does not license the global`() {
+        assertNull(resolveLastSync(perDevice = 0L, legacyGlobal = 900L, pairedCount = 0))
+    }
+
+    @Test
+    fun `the key is per device and case-insensitive`() {
+        // The same strap presents its address in different cases across sessions; a case-sensitive key
+        // would strand the earlier stamp under a second name and report "never" on a strap that had synced.
+        assertEquals(lastSyncPrefKey("AA:BB:CC:DD:EE:FF"), lastSyncPrefKey("aa:bb:cc:dd:ee:ff"))
+        assertNull(lastSyncPrefKey(null))
+        assertNull(lastSyncPrefKey("   "))
+    }
+
+    /**
+     * The #57 write-health pair had the identical defect one line below in the same capture: "rows last
+     * landed 4d ago" printed for a strap whose own row count was zero. Both halves are scoped, because
+     * they are read as a pair — "stalled more recently than ok" is the alarm, and scoping only one would
+     * compare this strap's stall against another strap's success.
+     */
+    @Test
+    fun `the write-health pair is scoped per strap and the two halves stay distinct`() {
+        val addr = "aa:bb:cc:dd:ee:ff"
+        val ok = writeHealthPrefKey(addr, "lastWriteOkAt")
+        val stalled = writeHealthPrefKey(addr, "lastWriteStalledAt")
+        assertEquals(false, ok == stalled)
+        assertEquals(ok, writeHealthPrefKey("AA:BB:CC:DD:EE:FF", "lastWriteOkAt"))
+        assertNull(writeHealthPrefKey(null, "lastWriteOkAt"))
+        assertNull(writeHealthPrefKey("  ", "lastWriteOkAt"))
+    }
+
+    /**
+     * Different straps must never share a write-health key, or one strap's successful offload would clear
+     * the alarm raised by another strap's stall.
+     */
+    @Test
+    fun `two straps get different write-health keys`() {
+        assertEquals(
+            false,
+            writeHealthPrefKey("aa:bb:cc:dd:ee:ff", "lastWriteOkAt") ==
+                writeHealthPrefKey("ff:ee:dd:cc:bb:aa", "lastWriteOkAt"),
+        )
+    }
+
+    /**
+     * It must not collide with the firmware key, which is built the same way from the same address.
+     */
+    @Test
+    fun `it does not collide with the firmware key for the same strap`() {
+        val addr = "aa:bb:cc:dd:ee:ff"
+        assertEquals(false, lastSyncPrefKey(addr) == firmwarePrefKey(addr))
+    }
+}
diff --git a/project.yml b/project.yml
index b7914baa1e..fb905fec84 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "272"
+    CURRENT_PROJECT_VERSION: "273"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 7378c97b2c1ee023954c23acae42de9595eb4bf0 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 01:15:19 +1200
Subject: [PATCH 097/333] Sync controls follow what the strap can actually do
 (#1748)

"Refresh doesn't work" - reported four times. It worked. It was silent.

Every manual-sync control gated on `bonded`, and `bonded` is not the condition: the
live-HR path sets it for a 5/MG that has never completed a handshake, so the control
was offered, accepted, and then declined by beginBackfill's own connectHandshakeDone
gate with nothing shown anywhere. The field log has the pull landing twice in three
seconds and being turned away both times, into the log and nowhere else.

LiveState now carries `historyReady`, published at exactly the three sites that set
connectHandshakeDone and cleared at the one that clears it, so the two cannot drift.
The Today gesture, the Live "Sync now" button and the Health sync card gate on it.

This cannot withhold a sync that would have run: connectHandshakeDone is already a
precondition of beginBackfill, so the controls disappear exactly where the offload
would have been refused regardless. reset() runs on connectToDevice as well as
handleDisconnect, so a stale true is cleared before any new link sets connected, and
canRequestSync's own `connected` check covers the gap either way. On a WHOOP 4.0 that
has bonded nothing changes at all - both flags are set in the same callback eleven
lines apart - and a 5/MG that completes its handshake keeps every control it had. It
also catches a case a strap-family check could not: a 4.0 whose bond has not landed
has an equally dead sync button, and that goes away too.

The re-review is what earned the second commit. Gating the button alone made the
Health card contradict itself on exactly the strap the gate is for: title "Ready to
sync", not pulsing, and a helper line promising an immediate sync, all sitting above
a DISABLED button. Before the gate the three agreed - wrongly, but consistently - and
gating one of them is what split them.

The helper line turned out to be the prize. Its `!bonded` branch already said the
right thing ("Finishing the pairing handshake. Sync now becomes available once the
strap is paired.") and simply never fired on the strap that needed it. So the
explanation this gate was missing was already written and translated; it needed the
correct flag, not a new string in six locales.

Swept every live.bonded in the UI while checking. The rest are correctly about the
LINK rather than history - haptics, buzz, alarm arming, "Live HR (not fully paired)",
onboarding - all of which work on an unbonded 5/MG and must keep working. None moved.

NOT gated: the three syncNow() calls in Settings and Test Centre. Those are
re-analysis nudges after an HRV-window or baseline change, not sync controls; gating
them would stop a re-score for a reason unrelated to re-scoring.

Staging 393 / iOS 274. 4909 tests, lintVital, doc lint and i18n clean.
---
 android/app/build.gradle.kts                  |  2 +-
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 14 ++++++
 .../src/main/java/com/noop/ui/HealthScreen.kt | 19 ++++++--
 .../src/main/java/com/noop/ui/LiveScreen.kt   | 13 ++++--
 .../main/java/com/noop/ui/TodayProvenance.kt  | 20 +++++++--
 .../src/main/java/com/noop/ui/TodayScreen.kt  | 13 +++++-
 .../com/noop/ui/TodayExplainabilityTest.kt    | 44 ++++++++++++++++---
 project.yml                                   |  2 +-
 8 files changed, 107 insertions(+), 20 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 89100c11fc..3d06a39a54 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 392
+        versionCode = 393
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index ae74638093..369cb3d547 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -201,6 +201,14 @@ data class LiveState(
     /** Set when an offload ended abnormally (strap went quiet mid-sync / idle-watchdog fired), so a
      *  stalled history download isn't silent. Cleared on the next successful HISTORY_COMPLETE. (PR #85) */
     val lastSyncError: String? = null,
+    /** True once this strap can actually hand over history — the UI mirror of the client's
+     *  `connectHandshakeDone`, which [beginBackfill] already requires before it will request an offload.
+     *
+     *  Exposed because [bonded] is NOT that condition and reads true too early: the live-HR path sets it
+     *  for a 5/MG that has never completed a handshake, so Today offered a pull-to-sync that was accepted
+     *  by the gesture and then refused deeper down, silently. Gating on this makes the control unavailable
+     *  exactly when the sync would have been declined anyway — never when it would have run. */
+    val historyReady: Boolean = false,
     /** Set when a connect attempt fails because the strap wiped its Bluetooth bond — a firmware reset,
      *  or the official WHOOP app re-bonding it. The OS still holds a now-stale bond, so retrying the
      *  direct connect just re-fails. Carries an actionable forget+re-pair guide; cleared on the next
@@ -4869,6 +4877,7 @@ class WhoopBleClient(
         // Clock-before-history is mandatory — an un-clocked 5/MG discards sensor data rather than banking it
         // — and it is only reached here because the strap has just demonstrated it answers commands.
         connectHandshakeDone = true
+        _state.update { it.copy(historyReady = true) }
         // requestSync ALSO gates on state.bonded, and for a 5/MG that flag is set by the live-HR path -
         // the first plausible reading over the standard profile. A strap sitting on a charger streams no
         // HR, so without this the probe would succeed, announce it, and then be refused by a second gate
@@ -6380,6 +6389,7 @@ class WhoopBleClient(
             // WHOOP 5.0/MG uses CLIENT_HELLO, not this WHOOP4 command sequence, so it is skipped for it.
             if (!connectHandshakeDone && connectedFamily == DeviceFamily.WHOOP4) {
                 connectHandshakeDone = true
+                _state.update { it.copy(historyReady = true) }
                 noteRebootReconnectIfNeeded()
                 runConnectHandshake()
             }
@@ -8437,6 +8447,7 @@ class WhoopBleClient(
             // once-per-connection (keep-alive resubscribes also land here). (#78 fork, hardware-proven)
             if (connectedFamily == DeviceFamily.WHOOP5 && didBond && !connectHandshakeDone) {
                 connectHandshakeDone = true
+                _state.update { it.copy(historyReady = true) }
                 noteRebootReconnectIfNeeded()
                 send(CommandNumber.SET_CLOCK, setClockPayload(), withResponse = true)
                 send(CommandNumber.GET_CLOCK, byteArrayOf(), withResponse = true)
@@ -9771,6 +9782,9 @@ class WhoopBleClient(
         // exactly the gap this stopwatch was added to close. It is overwritten by the next request, and a
         // stale value can only ever produce a large elapsed against a label that names what it measures.
         connectHandshakeDone = false
+        // Mirrors the flag above: a new link has not done the handshake, so it cannot hand over history
+        // until it does. Cleared HERE and nowhere else, so the two can never disagree.
+        _state.update { it.copy(historyReady = false) }
         // #1635: the probe is per LINK — its whole basis is one stable link's behaviour, and carrying the
         // "already asked" flag across a reconnect would let one silent link retire the experiment. The
         // REFUSAL, by contrast, is persisted per device: that one is the strap's answer, not the link's.
diff --git a/android/app/src/main/java/com/noop/ui/HealthScreen.kt b/android/app/src/main/java/com/noop/ui/HealthScreen.kt
index 435e38ef72..04b5cbd23d 100644
--- a/android/app/src/main/java/com/noop/ui/HealthScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/HealthScreen.kt
@@ -278,7 +278,9 @@ private fun SyncStatusSection(vm: AppViewModel, onSyncNow: () -> Unit) {
     // leaf re-runs per tick. Appearance + behaviour identical.
     val live by vm.live.collectAsStateWithLifecycle()
     // The strap link is usable for a manual offload kick (matches WhoopBleClient.syncNow's own gate).
-    val canSync = live.connected && live.bonded && !live.backfilling
+    // historyReady, not `bonded`: on a 5/MG the live-HR path sets `bonded` for a strap that has never
+    // completed a handshake, so this button enabled itself and beginBackfill then declined it silently.
+    val canSync = live.connected && live.bonded && live.historyReady && !live.backfilling
     Column(verticalArrangement = Arrangement.spacedBy(Metrics.gap)) {
         SectionHeader(
             "Sync",
@@ -309,10 +311,14 @@ private fun SyncStatusSection(vm: AppViewModel, onSyncNow: () -> Unit) {
                         )
                     }
                     else -> StatePill(
-                        title = if (live.bonded) "Ready to sync" else "Pairing…",
+                        // Same condition as the button below it. Keyed on `bonded` this said "Ready to
+                        // sync", not pulsing, directly above a DISABLED Sync now — on exactly the strap
+                        // that cannot sync. Before the button was gated the two agreed (both wrong);
+                        // gating one without the other is what made them contradict.
+                        title = if (live.historyReady) "Ready to sync" else "Pairing…",
                         tone = StrandTone.Accent,
                         showsDot = true,
-                        pulsing = !live.bonded,
+                        pulsing = !live.historyReady,
                     )
                 }
 
@@ -357,7 +363,12 @@ private fun syncHelperText(live: LiveState): String = when {
         "now continues automatically across passes instead of waiting between syncs."
     !live.connected -> "Connect your strap to sync its stored history. Until then, only imported data " +
         "shows here."
-    !live.bonded -> "Finishing the pairing handshake. Sync now becomes available once the strap is paired."
+    // historyReady, not `bonded`. This branch already said the right thing and simply never fired on the
+    // strap that needed it: `bonded` is set by the live-HR path, so a 5/MG that never completed a
+    // handshake fell through to the "syncs right away" line, directly under a Sync-now button that had
+    // just been disabled. Same condition as the button and the card title, so all three agree.
+    !live.historyReady ->
+        "Finishing the pairing handshake. Sync now becomes available once the strap is paired."
     else -> "Syncs your strap's stored history right away, instead of waiting for the next automatic sync."
 }
 
diff --git a/android/app/src/main/java/com/noop/ui/LiveScreen.kt b/android/app/src/main/java/com/noop/ui/LiveScreen.kt
index c1ba271e97..333ae53af9 100644
--- a/android/app/src/main/java/com/noop/ui/LiveScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/LiveScreen.kt
@@ -640,12 +640,17 @@ fun LiveScreen(viewModel: AppViewModel, onManageDevices: () -> Unit = {}) {
         }
 
         // Manual "Sync now" — kick a historical offload on demand instead of waiting for the 15-min
-        // periodic timer (#93). Only meaningful once bonded (the offload needs the command channel), and
-        // disabled mid-session so a double-tap can't fight the in-flight offload — viewModel.syncNow()
-        // also no-ops in that case, this is just the matching UI state. While syncing, the button shows
+        // periodic timer (#93). Needs a strap that can actually hand over history, and disabled
+        // mid-session so a double-tap can't fight the in-flight offload — viewModel.syncNow() also
+        // no-ops in that case, this is just the matching UI state.
+        //
+        // `bonded` alone was NOT that condition and this comment used to say it was: the live-HR path
+        // sets it for a 5/MG that has never completed a handshake, so the button appeared, was pressed,
+        // and beginBackfill declined it in silence. historyReady is the client's own precondition, so
+        // the button can only vanish where the offload would have been refused anyway. While syncing, the button shows
         // an INDETERMINATE spinner (NEVER a percent — total pending records are unknowable from the
         // protocol); the "Syncing your strap history… N chunks pulled" line above carries the live count.
-        if (live.bonded) {
+        if (live.bonded && live.historyReady) {
             item {
             OutlinedButton(
                 onClick = { viewModel.syncNow() },
diff --git a/android/app/src/main/java/com/noop/ui/TodayProvenance.kt b/android/app/src/main/java/com/noop/ui/TodayProvenance.kt
index 0e81e786a2..a9a9ad7ece 100644
--- a/android/app/src/main/java/com/noop/ui/TodayProvenance.kt
+++ b/android/app/src/main/java/com/noop/ui/TodayProvenance.kt
@@ -161,13 +161,27 @@ internal fun scoreHeroSourceLabel(
     )
 }
 
-/** Today pull-to-sync mirrors the BLE client's manual-sync guard, so the gesture never starts a sync while
- *  disconnected, still bonding, or already offloading. Kept pure for the UI-specific contract test. */
+/**
+ * Today pull-to-sync mirrors the BLE client's manual-sync guard, so the gesture never starts a sync while
+ * disconnected, still bonding, or already offloading. Kept pure for the UI-specific contract test.
+ *
+ * [historyReady] is the second half of that mirror and was missing. `canRequestSync` checks `bonded`,
+ * which on a 5/MG is set by the live-HR path — true on a strap that has never completed a handshake. So
+ * the gesture was offered, accepted, and then refused by `beginBackfill`'s own `connectHandshakeDone`
+ * gate with nothing shown: a control that ran and did nothing, reported four times as "refresh doesn't
+ * work". It was working; it was silent.
+ *
+ * Adding the client's OWN precondition cannot disable a sync that would have run, because
+ * `beginBackfill` already requires exactly this flag before it will request an offload. The gesture now
+ * goes away precisely when the sync would have been declined anyway — including on a WHOOP 4.0 whose
+ * bond has not landed yet, which a strap-family check would have missed.
+ */
 internal fun todayPullToSyncEnabled(
     connected: Boolean,
     bonded: Boolean,
     backfilling: Boolean,
-): Boolean = WhoopBleClient.canRequestSync(connected, bonded, backfilling)
+    historyReady: Boolean,
+): Boolean = WhoopBleClient.canRequestSync(connected, bonded, backfilling) && historyReady
 
 /** The tint for a per-metric provenance badge, keyed on the resolved LABEL, gold for Whoop, cyan for
  *  Apple Health, the positive status hue for on-device (and anything else). Matches the Data Sources
diff --git a/android/app/src/main/java/com/noop/ui/TodayScreen.kt b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
index 9165438be0..795040e2dd 100644
--- a/android/app/src/main/java/com/noop/ui/TodayScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
@@ -252,6 +252,9 @@ private data class TodayLiveSnapshot(
     val lastSyncAt: Long?,
     val backfilling: Boolean,
     val syncChunksThisSession: Int,
+    /** Mirrors `LiveState.historyReady` — whether this strap can actually hand over history. Flips at
+     *  most once per connection, so it costs the snapshot nothing. */
+    val historyReady: Boolean,
     val historySyncExperimental: Boolean,
     val batteryPct: Double?,
     /** True once a WHOOP 5/MG strap has been seen this session, picks the 5/MG rated-life fallback for the
@@ -332,6 +335,7 @@ fun TodayScreen(
                 lastSyncAt = s.lastSyncAt,
                 backfilling = s.backfilling,
                 syncChunksThisSession = s.syncChunksThisSession,
+                historyReady = s.historyReady,
                 historySyncExperimental = s.historySyncExperimental,
                 batteryPct = s.batteryPct,
                 whoop5 = s.whoop5Detected,
@@ -1152,7 +1156,8 @@ fun TodayScreen(
             onHorizontalDrag = { _, dragAmount -> accumulatedX += dragAmount },
         )
     }
-    val canPullToSync = todayPullToSyncEnabled(liveSnap.connected, liveSnap.bonded, liveSnap.backfilling)
+    val canPullToSync =
+        todayPullToSyncEnabled(liveSnap.connected, liveSnap.bonded, liveSnap.backfilling, liveSnap.historyReady)
     // material3 1.2.1's rememberPullToRefreshState CAPTURES the `enabled` lambda ONCE (rememberSaveable,
     // no rememberUpdatedState), so `{ canPullToSync }` would freeze the plain Boolean from the FIRST
     // composition — and Today usually first composes before the strap has (re)connected, leaving the
@@ -1160,7 +1165,11 @@ fun TodayScreen(
     // instead, so each gesture check sees the current connected/bonded/backfilling. (syncNow is triple-gated
     // anyway; this just makes the gesture actually enable once the strap is ready.)
     val pullToSyncState = rememberPullToRefreshState(
-        enabled = { todayPullToSyncEnabled(liveSnap.connected, liveSnap.bonded, liveSnap.backfilling) },
+        enabled = {
+            todayPullToSyncEnabled(
+                liveSnap.connected, liveSnap.bonded, liveSnap.backfilling, liveSnap.historyReady,
+            )
+        },
     )
     LaunchedEffect(pullToSyncState.isRefreshing, canPullToSync) {
         if (pullToSyncState.isRefreshing) {
diff --git a/android/app/src/test/java/com/noop/ui/TodayExplainabilityTest.kt b/android/app/src/test/java/com/noop/ui/TodayExplainabilityTest.kt
index c9c9bd8fff..d08512ce78 100644
--- a/android/app/src/test/java/com/noop/ui/TodayExplainabilityTest.kt
+++ b/android/app/src/test/java/com/noop/ui/TodayExplainabilityTest.kt
@@ -422,10 +422,44 @@ class TodayExplainabilityTest {
 
     @Test
     fun pullToSync_onlyEnabledWhenConnectedBondedAndIdle() {
-        assertTrue(todayPullToSyncEnabled(connected = true, bonded = true, backfilling = false))
-
-        assertFalse(todayPullToSyncEnabled(connected = false, bonded = true, backfilling = false))
-        assertFalse(todayPullToSyncEnabled(connected = true, bonded = false, backfilling = false))
-        assertFalse(todayPullToSyncEnabled(connected = true, bonded = true, backfilling = true))
+        assertTrue(todayPullToSyncEnabled(
+            connected = true, bonded = true, backfilling = false, historyReady = true))
+
+        assertFalse(todayPullToSyncEnabled(
+            connected = false, bonded = true, backfilling = false, historyReady = true))
+        assertFalse(todayPullToSyncEnabled(
+            connected = true, bonded = false, backfilling = false, historyReady = true))
+        assertFalse(todayPullToSyncEnabled(
+            connected = true, bonded = true, backfilling = true, historyReady = true))
+    }
+
+    /**
+     * THE case this argument exists for, from the field: a WHOOP 5/MG that has never completed a
+     * handshake. `bonded` is true — the live-HR path sets it — so every other condition passes and the
+     * gesture was offered, accepted, and then refused by `beginBackfill`'s own `connectHandshakeDone`
+     * gate with nothing shown. Reported four times as "refresh doesn't work"; it worked, it was silent.
+     */
+    @Test
+    fun `a strap that cannot hand over history does not offer the gesture`() {
+        assertFalse(todayPullToSyncEnabled(
+            connected = true, bonded = true, backfilling = false, historyReady = false))
+    }
+
+    /**
+     * The no-regression contract, and the reason this is safe to add: the new argument mirrors a
+     * precondition `beginBackfill` ALREADY enforces, so the gesture can only disappear where the sync
+     * would have been declined regardless. It can never withhold a refresh that would have run — which
+     * is exactly what a strap-family check could not promise.
+     */
+    @Test
+    fun `it never withholds a sync that would have run`() {
+        // Every combination the old three-argument gate allowed still passes, provided the client would
+        // actually have accepted it. historyReady=true is that condition, not an extra hurdle.
+        assertTrue(todayPullToSyncEnabled(
+            connected = true, bonded = true, backfilling = false, historyReady = true))
+        // And it catches a case a family check would miss entirely: a WHOOP 4.0 whose bond has not landed
+        // is just as unable to sync as an unpaired 5/MG, and its gesture is just as dead.
+        assertFalse(todayPullToSyncEnabled(
+            connected = true, bonded = false, backfilling = false, historyReady = false))
     }
 }
diff --git a/project.yml b/project.yml
index fb905fec84..b4ecdc5dea 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "273"
+    CURRENT_PROJECT_VERSION: "274"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 331eccc08c946e6186defea5db2cea27347e268d Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 12:09:46 +1200
Subject: [PATCH 098/333] The offload probe has to report when the link is what
 ends it (#1749)

First field run of the unbonded offload probe. It got its answer and exposed two
defects in itself doing it.

The capture: 16 probe starts, ZERO verdicts of any kind, zero confirmed subscribes,
zero refusals, every link dying 10.8s into the connect - about three seconds after
the CCCD writes went out. Stage 1 ended with the LINK, an exit the probe had no
branch for, so it concluded nothing, the silence budget never advanced, and it
re-ran on every reconnect indefinitely. That is precisely the unbounded retry
shouldProbeUnbondedOffload's own doc claims the design prevents, reintroduced
through an unhandled exit - and it cost a strap bouncing every 17 seconds all night.

That exit is now a verdict, charged to the silence budget, because "the link will
not survive being asked" is a stronger reason to stop asking than a strap that
merely stayed quiet.

It is also a FINDING and the line says so. No callback AND no ATT error, then a
teardown about three seconds later, is the CLIENT_HELLO's own signature on the same
service. It does not prove the puffin characteristics require encryption, but it is
what that would look like from here, and it says plainly that the offload is not
reachable on this strap without a bond. The probe was built to answer that question
either way, and this is the answer.

Second defect, in the line the capture is read through: the supersede message warned
that "Ask Android to pair" being on makes a refusal unattributable - while the very
same branch returns BEFORE the pairing request, so no SMP can be in flight. The
capture confirms it: not one probe connect carries a createBond. A caveat that could
not apply, printed on every probe connect, and it briefly cast doubt on a clean
result while reading the log.

The re-review then found the identical hole one stage lower: a link lost during the
GET_CLOCK wait also reported nothing and spent no attempt. Both stages report now,
with DIFFERENT lines - stage 1's loss carries the signature above, stage 2's carries
no finding at all, since the subscribes had landed and the strap was still inside
its window. Conflating them would manufacture evidence from an inconclusive link.

The test pinning the old supersede wording asserted "unattributable" and had to be
repinned - the same shape as the writeClientHello contract test earlier in this
thread. A test can be correct and then quietly become a guard on the wrong
behaviour.

Staging 394 / iOS 275. 4913 tests, lintVital, doc lint and i18n clean.
---
 android/app/build.gradle.kts                  |  2 +-
 .../java/com/noop/ble/UnbondedOffloadProbe.kt | 51 ++++++++++++-
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 29 ++++++++
 .../com/noop/ble/UnbondedOffloadProbeTest.kt  | 72 +++++++++++++++++--
 project.yml                                   |  2 +-
 5 files changed, 148 insertions(+), 8 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 3d06a39a54..cf5c6bad50 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 393
+        versionCode = 394
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
index 6b3ddfbcd9..cc7a06343b 100644
--- a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
+++ b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
@@ -139,8 +139,9 @@ internal fun unbondedProbeSupersedesLine(explicitBondOptedIn: Boolean): String =
         " asks whether the offload needs a bond at all. That question needs a link with no CLIENT_HELLO on" +
         " it, so the hello is not written here (press Connect to try the handshake instead)." +
         (if (explicitBondOptedIn)
-            " NOTE: \"Ask Android to pair\" is also on. A pairing in flight makes a refusal unattributable" +
-                " to the strap, so turn it off for a clean answer."
+            " \"Ask Android to pair\" is on but is ALSO skipped on this connect — this branch returns" +
+                " before the pairing request, so no SMP is in flight and a refusal here is attributable" +
+                " to the strap."
         else "") +
         " (#1635, experimental)"
 
@@ -222,6 +223,52 @@ internal fun puffinSubscribeRefusedLine(uuid: String, status: String): String =
         " or -encryption status, the puffin notify chars need an encrypted link, the historical offload" +
         " cannot be reached without a bond, and a 5/MG that refuses SMP can never sync history (#1635)."
 
+/**
+ * Stage 1 ended because the LINK did, before any subscribe was confirmed or refused.
+ *
+ * The outcome the probe had no verdict for, and the field capture is unambiguous about how much that
+ * matters: 16 probe starts, 0 verdicts of any kind, 0 confirmed subscribes, 0 refusals, and the link
+ * dying 10.8s into every connect — roughly three seconds after the CCCD writes went out. With no verdict
+ * the silence budget never advanced, so the probe re-ran on every reconnect indefinitely. That is exactly
+ * the unbounded retry [shouldProbeUnbondedOffload]'s own doc claims this design prevents, reintroduced by
+ * an unhandled exit.
+ *
+ * It is also a FINDING, not just a gap. No callback and no ATT error, then a teardown about three seconds
+ * later, is the CLIENT_HELLO's signature — the same silent elevate-and-drop, on the same service. It does
+ * not prove the puffin characteristics require encryption, but it is what that would look like from here,
+ * and it says plainly that the offload is not reachable on this strap without a bond.
+ *
+ * Charged to the silence budget, because "the link will not survive being asked" is a stronger reason to
+ * stop asking than a strap that merely stayed quiet.
+ */
+internal fun unbondedProbeLinkLostLine(
+    uptimeMs: Long,
+    confirmedSubscribes: Int,
+    total: Int,
+): String =
+    "Unbonded offload probe: the link dropped ${uptimeMs}ms into this connect with $confirmedSubscribes" +
+        " of $total puffin subscribes confirmed and no refusal — no callback and no ATT error, then a" +
+        " teardown. That is the CLIENT_HELLO's own signature on the same service, so the offload is not" +
+        " reachable on this strap without a bond (#1635)."
+
+/**
+ * Stage 2 ended because the link did, with GET_CLOCK already on the wire.
+ *
+ * Deliberately NOT the same line as [unbondedProbeLinkLostLine], and that distinction is the whole point.
+ * A stage-1 link loss carries a finding — the subscribes drew no callback and no ATT error before the drop,
+ * which is the CLIENT_HELLO's signature. A stage-2 link loss carries none: the subscribes LANDED, the
+ * transport was open, and the strap was still within its window to answer when the link went. Reporting
+ * that as evidence the strap will not answer would be the same conflation this probe keeps having to
+ * unpick.
+ *
+ * It still spends a budget attempt, because an inconclusive link is not a reason to retry forever — that
+ * is the hole this exists to close, and leaving stage 2 uncounted would reopen it one stage later.
+ */
+internal fun unbondedProbeLinkLostAskingLine(uptimeMs: Long, waitedMs: Long): String =
+    "Unbonded offload probe: the link dropped ${uptimeMs}ms into this connect, ${waitedMs}ms after" +
+        " GET_CLOCK went out. The subscribes had landed, so the transport was open and the strap was still" +
+        " inside its window to answer — this link settles nothing either way (#1635)."
+
 /**
  * Stage 2's question, logged so the wait that follows is attributable to it.
  *
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 369cb3d547..8f2f86d1c0 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -9792,6 +9792,35 @@ class WhoopBleClient(
         // see the cleared state, which is harmless, but one still queued must not reach the next link.
         handler.removeCallbacks(unbondedProbeStartRunnable)
         handler.removeCallbacks(unbondedProbeVerdictRunnable)
+        // A probe still mid-subscribe when the link goes is stage 1 ending with the LINK, and it is a
+        // verdict rather than an absence — see [unbondedProbeLinkLostLine]. Without this the probe
+        // reported nothing at all and its silence budget never advanced, so it re-ran on every reconnect:
+        // 16 starts and 0 verdicts in one capture. Charged to the budget, because "the link will not
+        // survive being asked" is a stronger reason to stop asking than a strap that merely stayed quiet.
+        //
+        // BOTH stages, because stage 2 has the identical hole: the verdict timer is cancelled just above,
+        // so a link lost during the GET_CLOCK wait would also report nothing and also fail to spend a
+        // budget attempt. The two get DIFFERENT lines — stage 1's loss carries the CLIENT_HELLO signature,
+        // stage 2's carries no finding at all — because conflating them is the mistake this probe keeps
+        // having to unpick.
+        if (unbondedProbeSubscribing || unbondedProbeAwaitingReply) {
+            val uptime = if (connectedAtMs > 0L) System.currentTimeMillis() - connectedAtMs else -1L
+            log(
+                if (unbondedProbeSubscribing) unbondedProbeLinkLostLine(
+                    uptimeMs = uptime,
+                    confirmedSubscribes = unbondedProbeSubscribed,
+                    total = WHOOP5_NOTIFY_CHARS.size,
+                ) else unbondedProbeLinkLostAskingLine(
+                    uptimeMs = uptime,
+                    waitedMs = if (unbondedProbeAskedAtMs > 0L)
+                        System.currentTimeMillis() - unbondedProbeAskedAtMs else -1L,
+                ),
+            )
+            unbondedProbeSilentLinks++
+            if (!unbondedProbeStillWorthAsking(unbondedProbeSilentLinks)) {
+                log(unbondedProbeGaveUpLine(unbondedProbeSilentLinks))
+            }
+        }
         unbondedProbeStartedThisLink = false
         unbondedProbeSubscribed = 0
         unbondedProbeSubscribing = false
diff --git a/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt b/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
index ceebb95e33..d31e25e60f 100644
--- a/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
+++ b/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
@@ -88,6 +88,70 @@ class UnbondedOffloadProbeTest {
         assertFalse(probe(silentLinksSoFar = UNBONDED_PROBE_MAX_SILENT_LINKS + 5))
     }
 
+    /**
+     * The exit that had no verdict, and it cost the probe its bound. Field capture: 16 probe starts, 0
+     * verdicts of any kind, 0 confirmed subscribes, 0 refusals, every link dying 10.8s in — about three
+     * seconds after the CCCD writes. With nothing concluded the silence budget never advanced, so it
+     * re-ran on every reconnect forever: the unbounded retry this file's own doc claims to prevent.
+     */
+    @Test
+    fun `a link lost mid-subscribe is a verdict, not an absence`() {
+        val line = unbondedProbeLinkLostLine(uptimeMs = 10_800L, confirmedSubscribes = 0, total = 4)
+        assertTrue(line.contains("10800ms"))
+        assertTrue(line.contains("0 of 4"))
+        // It must name the signature rather than just the failure: no callback AND no error, then a drop,
+        // is what the CLIENT_HELLO does on the same service — that is the finding, not the silence.
+        assertTrue(line.contains("no ATT error"))
+        assertTrue(line.contains("CLIENT_HELLO"))
+        assertTrue(line.contains("not\n        reachable") || line.contains("not reachable"))
+        assertTrue(line.contains("#1635"))
+    }
+
+    /**
+     * The same hole, one stage later. The verdict timer is cancelled on teardown, so a link lost during
+     * the GET_CLOCK wait would also report nothing and also fail to spend a budget attempt — reopening the
+     * unbounded retry immediately below where it was closed.
+     *
+     * It must NOT reuse stage 1's line. Stage 1's loss carries a finding (no callback, no ATT error, then
+     * a drop — the CLIENT_HELLO's signature). Stage 2's carries none: the subscribes landed, so the
+     * transport was open and the strap was still inside its window. Conflating them would manufacture
+     * evidence out of an inconclusive link.
+     */
+    @Test
+    fun `a link lost while asking settles nothing, and says so`() {
+        val line = unbondedProbeLinkLostAskingLine(uptimeMs = 9_000L, waitedMs = 2_500L)
+        assertTrue(line.contains("9000ms"))
+        assertTrue(line.contains("2500ms"))
+        assertTrue(line.contains("settles nothing"))
+        assertTrue(line.contains("#1635"))
+        // The stage-1 finding must not leak into it.
+        assertFalse(line.contains("CLIENT_HELLO"))
+        assertFalse(line.contains("no ATT error"))
+    }
+
+    /**
+     * A partial subscribe must report honestly rather than rounding to zero — it is a different fact about
+     * the strap than "none of them landed".
+     */
+    @Test
+    fun `a partial subscribe is reported as partial`() {
+        assertTrue(unbondedProbeLinkLostLine(9_000L, confirmedSubscribes = 2, total = 4).contains("2 of 4"))
+    }
+
+    /**
+     * The supersede line must not warn about a pairing the SAME branch prevents. It said "a pairing in
+     * flight makes a refusal unattributable" while returning before the pairing request — so the one
+     * capture this exists to produce carried a caveat that could not apply, and it briefly cast doubt on
+     * a clean result.
+     */
+    @Test
+    fun `the supersede line does not warn about a pairing it prevents`() {
+        val clash = unbondedProbeSupersedesLine(explicitBondOptedIn = true)
+        assertTrue(clash.contains("ALSO skipped"))
+        assertTrue(clash.contains("attributable to the strap"))
+        assertFalse(clash.contains("in flight makes a refusal unattributable"))
+    }
+
     @Test
     fun `the give-up line says why it stopped, not merely that it did`() {
         // The CLIENT_HELLO's suppression stopped silently and cost eleven weeks of unreadable captures.
@@ -249,16 +313,16 @@ class UnbondedOffloadProbeTest {
      * attribute a refusal to the strap.
      */
     @Test
-    fun `the supersede line explains the absence and flags the clash`() {
+    fun `the supersede line explains the absence and names the other switch`() {
         val clean = unbondedProbeSupersedesLine(explicitBondOptedIn = false)
         assertTrue(clean.contains("handshake skipped"))
         assertTrue(clean.contains("press Connect"))
         assertFalse(clean.contains("Ask Android to pair"))
         assertTrue(clean.contains("#1635"))
 
-        val clash = unbondedProbeSupersedesLine(explicitBondOptedIn = true)
-        assertTrue(clash.contains("Ask Android to pair"))
-        assertTrue(clash.contains("unattributable"))
+        // Mentioned so a reader knows it is on, but as SKIPPED rather than as interference — the
+        // attributability claim it used to make is asserted in its own case below.
+        assertTrue(unbondedProbeSupersedesLine(explicitBondOptedIn = true).contains("Ask Android to pair"))
     }
 
     /**
diff --git a/project.yml b/project.yml
index b4ecdc5dea..fa4e5a3af9 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "274"
+    CURRENT_PROJECT_VERSION: "275"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 555778ed711e47a54ae58c48a4d103fcd13ed68f Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 12:10:16 +1200
Subject: [PATCH 099/333] Apple parity: last sync belongs to a strap, and sync
 controls follow what it can do (#1753)

Both defects Android fixed today were already present here, in the same shapes, and
one of them sat eighty lines from its own fix.

LAST SYNC. `lastSyncedAt` is ONE defaults key, stamped on any strap's
HISTORY_COMPLETE and read back for whichever strap is active. Single-strap installs
never notice; with two paired it reports the other one's. DebugDataDiagnostics
already called FirmwareAttribution.resolve for firmware and then read last-sync
globally eighty lines above it - the pattern was in the file, last-sync just never
got it.

LastSyncAttribution mirrors FirmwareAttribution one for one: per-BLE-identifier
keys, and the legacy global honoured ONLY when exactly one strap is paired, the one
case it cannot be ambiguous. The #57 write-health pair is scoped too, both halves,
because they are read together ("stalled more recently than ok" is the alarm) and
scoping one would compare a strap's own stall against another's success.

Both initialisers now seed NOTHING. The obvious cheap seed is the global key, which
belongs to whichever strap synced last - on a two-strap install not the one the
screens are scoped to. seedLastSyncFromActiveStrap resolves it from the registry's
ACTIVE row at bootstrapStore, the first point the registry exists.

HISTORY READY. Every manual-sync control gated on `bonded`, which the live-HR path
sets for a 5/MG that has never completed a handshake - so the control was offered,
accepted, then declined by beginBackfill's connectHandshakeDone guard in silence.
HealthView's own comment conceded the gate it was matching. This cannot withhold a
sync that would have run: connectHandshakeDone is already that precondition. The
card's pill, pulsing and helper line move WITH the button, or gating one of the
three makes them contradict - "Ready to sync" above a disabled button.

Three review passes, each finding something.

One: Today's gate was on the pull's RELEASE, which would have left refreshArmed
stuck true for the rest of the gesture since that branch is the only thing clearing
it - a worse failure than the silent one being fixed. It gates the ARM now, which
also withholds the haptic, reading honestly as unavailable rather than unresponsive.

Two: moving the stamps to per-device keys removed their only writers and left three
readers behind. The prefs-only debug header would not have become per-device, it
would have frozen at its pre-upgrade value and then read "never" and "no rows ever
persisted" forever, for everyone. The firmware precedent had this right and it was
missed: FrameRouter still writes noop.lastFirmware globally beside #1634's
per-device write. Both stamps dual-write now; every reader that CAN attribute still
prefers the per-device key.

Three: LastSyncAttribution shipped without tests while its Kotlin twin had a full
set, next to an existing FirmwareAttributionTests. Parity is not just the helper.

NOT ported: the unbonded offload probe, whose answer on the strap that motivated it
is no - a twin would port a dead end. The write-completion-is-not-encryption split
has no twin either: CoreBluetooth exposes no bond state, so the Apple fix needs the
strap's own BLE_BONDED event instead.

app-build green on both legs, and its Strand leg RUNS StrandTests. No new copy, so
no xcstrings churn. NOT hardware-validated on Apple.
---
 Strand/BLE/BLEManager.swift                | 83 ++++++++++++++++++++--
 Strand/BLE/LastSyncAttribution.swift       | 70 ++++++++++++++++++
 Strand/BLE/LiveState.swift                 |  8 +++
 Strand/Liquid/LiquidTodayView.swift        | 11 ++-
 Strand/Screens/HealthView.swift            | 17 +++--
 Strand/System/DebugDataDiagnostics.swift   |  7 ++
 StrandTests/LastSyncAttributionTests.swift | 83 ++++++++++++++++++++++
 7 files changed, 270 insertions(+), 9 deletions(-)
 create mode 100644 Strand/BLE/LastSyncAttribution.swift
 create mode 100644 StrandTests/LastSyncAttributionTests.swift

diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index e40ff37521..2e3adb5a9d 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -1230,7 +1230,10 @@ public final class BLEManager: NSObject, ObservableObject {
         // before any BLE data arrives.
         self.collector = nil
         super.init()
-        state.lastSyncedAt = UserDefaults.standard.object(forKey: "lastSyncedAt") as? Double
+        // Deliberately NOT seeded from the global key here. It belongs to whichever strap synced last,
+        // which on a two-strap install is not the one the screens are scoped to — the misattribution this
+        // whole change removes. `seedLastSyncFromActiveStrap` fills it from the ACTIVE strap once the
+        // registry exists (bootstrapStore); a blank moment is honest, another strap's timestamp is not.
         // Restore identifier + background-capable central (foundation for M3 state restoration).
         #if os(iOS)
         // iOS background state preservation/restoration: the restore identifier is what makes
@@ -1250,6 +1253,40 @@ public final class BLEManager: NSObject, ObservableObject {
 
     /// Build the WhoopStore + Collector + Backfiller asynchronously. Safe to call multiple
     /// times — bails out early if the collector is already initialised.
+    /// Seed the last-sync display from the ACTIVE strap's own stamp — PR #556's intent, correctly attributed.
+    ///
+    /// Resolved against the registry's active row, exactly as the debug export resolves firmware. NOT from
+    /// the legacy global key, which belongs to whichever strap synced last: on a two-strap install that is
+    /// not the strap the screens are scoped to, and seeding from it would put one strap's sync time on the
+    /// other's Today screen — the defect this change exists to remove.
+    ///
+    /// The legacy global still applies when exactly one strap is paired, because only then can it not be
+    /// ambiguous (see `LastSyncAttribution.resolve`). Called from `bootstrapStore` because that is the
+    /// first point the registry exists; the initialisers deliberately seed nothing.
+    ///
+    /// Never overwrites a value this session has already earned: a HISTORY_COMPLETE landing while this
+    /// runs is newer than anything persisted and must win.
+    private func seedLastSyncFromActiveStrap(registry: DeviceRegistryStore) {
+        // Registry + defaults resolved off-actor, then a single hop to publish. The `lastSyncedAt == nil`
+        // check lives INSIDE that hop and nowhere else: checking it out here as well would be a
+        // check-then-act across an await, and the value it guards is exactly the one a HISTORY_COMPLETE
+        // can set while this runs.
+        let rows = (try? registry.all()) ?? []
+        let activeId = (try? registry.activeDeviceId()) ?? nil
+        let activeAddr = rows.first(where: { $0.id == activeId })?.peripheralId
+        let d = UserDefaults.standard
+        guard let seed = LastSyncAttribution.resolve(
+            perDevice: LastSyncAttribution.prefKey(peripheralId: activeAddr)
+                .flatMap { d.object(forKey: $0) as? Double },
+            legacyGlobal: d.object(forKey: "lastSyncedAt") as? Double,
+            pairedCount: rows.count) else { return }
+        Task { @MainActor [state] in
+            // Never overwrite a value this session earned: a HISTORY_COMPLETE landing while the registry
+            // read was in flight is newer than anything persisted, and must win.
+            if state.lastSyncedAt == nil { state.lastSyncedAt = seed }
+        }
+    }
+
     func bootstrapStore() async {
         guard collector == nil else { return }
         // Surface store-open failures instead of swallowing them with `try?` (#222): a silent failure
@@ -1279,6 +1316,7 @@ public final class BLEManager: NSObject, ObservableObject {
         // its own concurrency).
         let registry = DeviceRegistryStore(dbQueue: store.registryWriter)
         self.registryStore = registry
+        seedLastSyncFromActiveStrap(registry: registry)
         if let activeId = try? registry.activeDeviceId(),
            !activeId.isEmpty {
             self.deviceId = activeId
@@ -1367,7 +1405,10 @@ public final class BLEManager: NSObject, ObservableObject {
         self.router = FrameRouter(state: state)
         self.collector = collector
         super.init()
-        state.lastSyncedAt = UserDefaults.standard.object(forKey: "lastSyncedAt") as? Double
+        // Deliberately NOT seeded from the global key here. It belongs to whichever strap synced last,
+        // which on a two-strap install is not the one the screens are scoped to — the misattribution this
+        // whole change removes. `seedLastSyncFromActiveStrap` fills it from the ACTIVE strap once the
+        // registry exists (bootstrapStore); a blank moment is honest, another strap's timestamp is not.
         // Restore identifier + background-capable central (mirrors the production initializer
         // so a restored manager matches by identifier; only exercised by tests/previews).
         #if os(iOS)
@@ -2488,8 +2529,27 @@ public final class BLEManager: NSObject, ObservableObject {
             // STALLED on a persist failure" — the latter (usually a restore without a restart) is otherwise
             // invisible in a report that just shows "0 synced".
             let du = UserDefaults.standard
-            if (backfiller?.sessionRowsPersisted ?? 0) > 0 { du.set(Date().timeIntervalSince1970, forKey: "sync.lastWriteOkAt") }
-            if backfiller?.persistStalled == true { du.set(Date().timeIntervalSince1970, forKey: "sync.lastWriteStalledAt") }
+            // Per strap, not per install. The global keys reported one strap's write health on another's
+            // screen — see LastSyncAttribution. This site has the peripheral, so it is the one place that
+            // can attribute them honestly (same argument as #1634's firmware write).
+            let whoOk = LastSyncAttribution.writeHealthPrefKey(peripheralId: peripheral?.identifier.uuidString,
+                                                               kind: "lastWriteOkAt")
+            let whoStalled = LastSyncAttribution.writeHealthPrefKey(peripheralId: peripheral?.identifier.uuidString,
+                                                                    kind: "lastWriteStalledAt")
+            // The global keys are STILL written, deliberately, exactly as `noop.lastFirmware` still is
+            // (FrameRouter). DebugDataDiagnostics.strapStateLines is sync and prefs-only by contract, so it
+            // cannot resolve per device — and dropping the global write would not make that line
+            // per-device, it would freeze it at whatever it held before the upgrade and then read "no rows
+            // ever persisted" forever, for everyone. A stale global is the smaller lie than a dead one, and
+            // every reader that CAN attribute prefers the per-device key.
+            if (backfiller?.sessionRowsPersisted ?? 0) > 0 {
+                du.set(Date().timeIntervalSince1970, forKey: "sync.lastWriteOkAt")
+                if let k = whoOk { du.set(Date().timeIntervalSince1970, forKey: k) }
+            }
+            if backfiller?.persistStalled == true {
+                du.set(Date().timeIntervalSince1970, forKey: "sync.lastWriteStalledAt")
+                if let k = whoStalled { du.set(Date().timeIntervalSince1970, forKey: k) }
+            }
             if unarchived > 0 {
                 state.lastSyncError = "Synced, but \(archived + unarchived) record(s) couldn't be decoded (unrecognised strap firmware layout), and the on-device archive is full - the \(unarchived) newest weren't preserved. Please share a strap log so the layout can be mapped."
             } else if archived > 0 {
@@ -2546,6 +2606,16 @@ public final class BLEManager: NSObject, ObservableObject {
                 whoop5EmptyOffload.reset()
                 state.historySyncExperimental = false
             }
+            // Stamped against the strap that actually completed this offload, never globally: the single
+            // key reported one strap's sync on another's screen, and it read as reassuring rather than
+            // wrong — see LastSyncAttribution. Kotlin twin: NoopPrefs.setLastSyncAtFor.
+            if let key = LastSyncAttribution.prefKey(peripheralId: peripheral?.identifier.uuidString) {
+                UserDefaults.standard.set(state.lastSyncedAt, forKey: key)
+            }
+            // Global kept for the same reason as the write-health pair above: the prefs-only debug header
+            // is its only remaining reader and cannot resolve per device, so dropping this write would
+            // freeze that line rather than fix it. It is also what `seedLastSyncFromActiveStrap`'s
+            // single-strap fallback reads across the upgrade.
             UserDefaults.standard.set(state.lastSyncedAt, forKey: "lastSyncedAt")
             // NOTE: the auto-continue streak is NOT reset here. A HISTORY_COMPLETE is no longer assumed to
             // mean "caught up" (#25): a strap whose firmware segments a deep offload into many small
@@ -5395,6 +5465,9 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
         clockRequested = false
         clockRetries = 0
         connectHandshakeDone = false
+        // Mirrors the flag above: a new link has not done the handshake, so it cannot hand over history
+        // until it does. Cleared HERE and nowhere else, so the two can never disagree.
+        state.historyReady = false
         cmdNotifyConfirmedActive = false   // #34: a fresh connection needs its own notify-confirm + settle
         connectSettledSignaled = false
         restoreNeedsResubscribe = false    // #613: a real reconnect isn't a restore — never force-toggle here
@@ -5943,6 +6016,7 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
             if !whoop5SessionStarted {
                 whoop5SessionStarted = true
                 connectHandshakeDone = true     // unblocks beginBackfill()'s guard
+                state.historyReady = true       // and the sync controls, which must not offer what it declines
                 log("WHOOP 5/MG: connect handshake done — backfill unblocked")
                 noteRebootReconnectIfNeeded()
                 // Re-apply the Broadcast-HR device-config flag if the user opted in (#181).
@@ -5992,6 +6066,7 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
         // type-47 fine because it runs the sequence once on a stable connection; the app stormed it.
         guard !connectHandshakeDone else { return }
         connectHandshakeDone = true
+        state.historyReady = true
         noteRebootReconnectIfNeeded()
         backfillStarted = true
 
diff --git a/Strand/BLE/LastSyncAttribution.swift b/Strand/BLE/LastSyncAttribution.swift
new file mode 100644
index 0000000000..9af8316d2a
--- /dev/null
+++ b/Strand/BLE/LastSyncAttribution.swift
@@ -0,0 +1,70 @@
+import Foundation
+
+/// Which "last sync" timestamp belongs to a strap, given what is known about it.
+///
+/// The same defect `FirmwareAttribution` fixed for firmware strings, in the same file's other line.
+/// `lastSyncedAt` is ONE defaults key, stamped on any strap's HISTORY_COMPLETE and read back for
+/// whichever strap is active. On a single-strap install those are the same strap, which is why it went
+/// unnoticed. With two paired it reports the other one's: an Android capture showed "Last sync: 4d ago"
+/// beside zero banked rows for the active 5/MG, the timestamp belonging to a 4.0 last worn three days
+/// earlier.
+///
+/// Worse than merely wrong: it is wrong in the reassuring direction. A strap that has never synced reads
+/// as recently synced, and the pull-to-refresh that cannot possibly change it looks broken rather than
+/// inapplicable. On Android that sent an investigation after a sync regression that never existed.
+///
+/// The rule, in order:
+///  - `perDevice` wins: this strap's own stamp, from its own completed offload.
+///  - `legacyGlobal` ONLY when `pairedCount` is 1. The old key cannot say which strap it belongs to, so
+///    it is trustworthy exactly when there is only one strap it could have come from — which keeps a
+///    single-strap install reading correctly across the upgrade instead of resetting to "never".
+///  - otherwise nil, meaning "this strap has never synced". For a strap in that state it is not a
+///    degraded answer, it is the correct one.
+///
+/// Deliberately NOT migrated by writing the global onto the active device at upgrade: that is the same
+/// guess in a different place, and on a multi-strap install it would bake the wrong attribution in
+/// permanently instead of leaving it to self-correct at the next real sync.
+///
+/// Pure so the attribution is unit-tested without defaults, a strap, or a registry. Kotlin twin:
+/// `com.noop.ble.resolveLastSync`.
+enum LastSyncAttribution {
+
+    static func resolve(perDevice: Double?,
+                        legacyGlobal: Double?,
+                        pairedCount: Int) -> Double? {
+        if let perDevice, perDevice > 0 { return perDevice }
+        if let legacyGlobal, legacyGlobal > 0, pairedCount == 1 { return legacyGlobal }
+        return nil
+    }
+
+    /// The per-device defaults key for a persisted last-sync timestamp.
+    ///
+    /// Keyed on the BLE peripheral identifier for the same reason `FirmwareAttribution.prefKey` is:
+    /// HISTORY_COMPLETE arrives on a connection whose peripheral is known, and resolving it to a registry
+    /// id there would repeat the mis-mapping #1527 fixed for `lastSeen` — stamping "the active row"
+    /// records a sync for a strap that was never connected, which is the class of error being removed.
+    ///
+    /// Lowercased, because the same strap can present its identifier in different cases across sessions
+    /// and a case-sensitive key would strand the earlier stamp under a second name. Returns nil for a
+    /// blank identifier, so a caller with none writes nothing rather than writing to a key that belongs
+    /// to no device.
+    static func prefKey(peripheralId: String?) -> String? {
+        guard let p = peripheralId?.trimmingCharacters(in: .whitespaces), !p.isEmpty else { return nil }
+        return "noop.lastSyncAt.\(p.lowercased())"
+    }
+
+    /// The per-device defaults key for the #57 write-health stamps ("rows last landed", "offload stalled").
+    ///
+    /// Same defect as `prefKey` and found in the same capture, one line below it: "Data write: rows last
+    /// landed 4d ago" printed against a strap whose own row count was zero, because the stamp was global
+    /// and the other strap had written it.
+    ///
+    /// `kind` separates "ok" from "stalled" so both keep the per-device scoping rather than only the one
+    /// that happened to be noticed — they are read as a PAIR ("stalled more recently than ok" is the
+    /// alarm), and scoping one without the other would compare a strap's own stall against another
+    /// strap's success. Kotlin twin: `com.noop.ble.writeHealthPrefKey`.
+    static func writeHealthPrefKey(peripheralId: String?, kind: String) -> String? {
+        guard let p = peripheralId?.trimmingCharacters(in: .whitespaces), !p.isEmpty else { return nil }
+        return "sync.\(kind).\(p.lowercased())"
+    }
+}
diff --git a/Strand/BLE/LiveState.swift b/Strand/BLE/LiveState.swift
index 8b876eaa1d..730a95c960 100644
--- a/Strand/BLE/LiveState.swift
+++ b/Strand/BLE/LiveState.swift
@@ -24,6 +24,14 @@ public final class LiveState: ObservableObject {
     /// connect/disconnect. Drives the Live pill's two-state distinction; the encrypted channel (buzz,
     /// alarm, double-tap, history offload) only works when this is true.
     @Published public var encryptedBond: Bool = false
+    /// True once this strap can actually hand over history — the UI mirror of `BLEManager`'s
+    /// `connectHandshakeDone`, which `beginBackfill` already requires before it will request an offload.
+    ///
+    /// Exposed because `bonded` is NOT that condition and reads true too early: the live-HR path sets it
+    /// for a 5/MG that has never completed a handshake, so the sync controls were offered, accepted, and
+    /// then refused deeper down in silence. Gating on this makes them unavailable exactly when the sync
+    /// would have been declined anyway — never when it would have run. Kotlin twin: `LiveState.historyReady`.
+    @Published public var historyReady: Bool = false
     /// #34: bumped by BLEManager once a WHOOP 4.0 connection has BOTH run its connect handshake (hello +
     /// SET_CLOCK, exactly once — `connectHandshakeDone`) AND had the cmd-notify characteristic confirm
     /// subscribed (`didUpdateNotificationStateFor` for it fired with `isNotifying == true`) — whichever of
diff --git a/Strand/Liquid/LiquidTodayView.swift b/Strand/Liquid/LiquidTodayView.swift
index c8607dd3df..302b59b96c 100644
--- a/Strand/Liquid/LiquidTodayView.swift
+++ b/Strand/Liquid/LiquidTodayView.swift
@@ -453,7 +453,16 @@ struct LiquidTodayView: View {
     private func handlePull(_ y: CGFloat) {
         pullY = max(0, y)
         guard !refreshing else { return }
-        if pullY >= pullThreshold, !refreshArmed {
+        // #1748 twin: gate the ARM, not the release. `syncNow()`'s own gate checks connected + bonded, and
+        // `bonded` is set by the live-HR path for a 5/MG that has never completed a handshake — so the pull
+        // was accepted and then declined in silence. `historyReady` is the client's OWN precondition, so
+        // this cannot withhold a sync that would have run.
+        //
+        // On the ARM specifically: gating the RELEASE below would leave `refreshArmed` stuck true for the
+        // rest of the gesture, since that branch is the only thing that clears it — a worse failure than
+        // the silent one being fixed. Not arming also withholds the haptic, which is the honest signal
+        // that the gesture is unavailable rather than unresponsive.
+        if pullY >= pullThreshold, !refreshArmed, ble.state.historyReady {
             refreshArmed = true
             pullHaptic &+= 1
         }
diff --git a/Strand/Screens/HealthView.swift b/Strand/Screens/HealthView.swift
index e9b30c1bbb..a01a2b9643 100644
--- a/Strand/Screens/HealthView.swift
+++ b/Strand/Screens/HealthView.swift
@@ -135,7 +135,10 @@ private struct SyncStatusSection: View {
     @EnvironmentObject var model: AppModel
 
     /// The strap link is usable for a manual offload kick (matches BLEManager.syncNow's own gate).
-    private var canSync: Bool { live.connected && live.bonded && !live.backfilling }
+    ///
+    /// `historyReady`, not `bonded` alone: the live-HR path sets `bonded` for a 5/MG that has never
+    /// completed a handshake, so this enabled itself and beginBackfill then declined it silently.
+    private var canSync: Bool { live.connected && live.bonded && live.historyReady && !live.backfilling }
 
     var body: some View {
         VStack(alignment: .leading, spacing: NoopMetrics.gap) {
@@ -187,8 +190,10 @@ private struct SyncStatusSection: View {
                     .foregroundStyle(StrandPalette.textSecondary)
             }
         } else {
-            StatePill(live.bonded ? "Ready to sync" : "Pairing…",
-                      tone: .accent, showsDot: true, pulsing: !live.bonded)
+            // Same condition as the button below it. Keyed on `bonded` this said "Ready to sync" directly
+            // above a DISABLED Sync now, on exactly the strap that cannot sync.
+            StatePill(live.historyReady ? "Ready to sync" : "Pairing…",
+                      tone: .accent, showsDot: true, pulsing: !live.historyReady)
         }
     }
 
@@ -199,7 +204,11 @@ private struct SyncStatusSection: View {
         if !live.connected {
             return String(localized: "Connect your strap to sync its stored history. Until then, only imported data shows here.")
         }
-        if !live.bonded {
+        // historyReady, not `bonded`. This branch already said the right thing and simply never fired on
+        // the strap that needed it: `bonded` is set by the live-HR path, so a 5/MG that never completed a
+        // handshake fell through to the "syncs right away" line, under a Sync-now button that had just
+        // been disabled. Same condition as the button and the pill, so all three agree.
+        if !live.historyReady {
             return String(localized: "Finishing the pairing handshake. Sync now becomes available once the strap is paired.")
         }
         return String(localized: "Syncs your strap's stored history right away, instead of waiting for the next automatic sync.")
diff --git a/Strand/System/DebugDataDiagnostics.swift b/Strand/System/DebugDataDiagnostics.swift
index bda7d73f51..7858b86c7d 100644
--- a/Strand/System/DebugDataDiagnostics.swift
+++ b/Strand/System/DebugDataDiagnostics.swift
@@ -44,6 +44,13 @@ enum DebugDataDiagnostics {
         // per-device value there; this line is superseded by it and wants the same follow-up as the Apple
         // write site, which has no peripheral identity to key on today.
         lines.append("Firmware:    \(d.string(forKey: "noop.lastFirmware") ?? "unknown (connect to record)")")
+        // NOTE: still the legacy GLOBAL key, for the same reason the firmware line above is — strapStateLines
+        // is sync and prefs-only by contract, and the per-device rule needs a registry read for pairedCount.
+        // The BLE layer therefore keeps writing the global alongside the per-device one; without that this
+        // line would not become per-device, it would simply freeze at its pre-upgrade value. Unlike
+        // firmware there is no per-device block further down to supersede it, so on a multi-strap install
+        // it can still name the OTHER strap's sync — the Kotlin twin resolves it because its export has the
+        // registry in hand. Tracked with the same follow-up.
         let syncSec = d.double(forKey: "lastSyncedAt")
         lines.append("Last sync:   \(syncSec > 0 ? relTime(Date().timeIntervalSince1970 - syncSec) : "never")")
         // #57: write-health. "Last sync" fires even on an empty/failed offload, so distinguish "rows
diff --git a/StrandTests/LastSyncAttributionTests.swift b/StrandTests/LastSyncAttributionTests.swift
new file mode 100644
index 0000000000..df4add5e28
--- /dev/null
+++ b/StrandTests/LastSyncAttributionTests.swift
@@ -0,0 +1,83 @@
+import XCTest
+@testable import Strand
+
+/// Pins last-sync attribution. Kotlin twin: `LastSyncAttributionTest`.
+///
+/// Reported three times before it was believed, which is the part worth keeping: the number was
+/// plausible, so the reading was treated as mistaken rather than the label. The capture had
+/// "Last sync: 4d ago" beside zero banked rows for the active 5/MG, and a 4.0 last seen three days
+/// earlier — the timestamp on the 5/MG's screen belonged to the other strap.
+final class LastSyncAttributionTests: XCTestCase {
+
+    func testThisStrapsOwnStampAlwaysWins() {
+        XCTAssertEqual(LastSyncAttribution.resolve(perDevice: 500, legacyGlobal: 900, pairedCount: 1), 500)
+        XCTAssertEqual(LastSyncAttribution.resolve(perDevice: 500, legacyGlobal: 900, pairedCount: 3), 500)
+    }
+
+    /// The single-strap upgrade path. The global key is unattributed, but with one strap paired there is
+    /// only one strap it can have come from — so it reads correctly across the upgrade instead of
+    /// resetting to "never" for everyone.
+    func testTheLegacyGlobalIsHonouredOnlyWhenOneStrapCouldHaveWrittenIt() {
+        XCTAssertEqual(LastSyncAttribution.resolve(perDevice: nil, legacyGlobal: 900, pairedCount: 1), 900)
+        XCTAssertNil(LastSyncAttribution.resolve(perDevice: nil, legacyGlobal: 900, pairedCount: 2))
+    }
+
+    /// THE case from the capture. Two straps, and the active one has never synced: the honest answer is
+    /// "never", not the other strap's timestamp. Not a degraded answer — the correct one.
+    func testAStrapThatHasNeverSyncedSaysSoEvenWhenAnotherHas() {
+        XCTAssertNil(LastSyncAttribution.resolve(perDevice: nil, legacyGlobal: 1_787_000_000, pairedCount: 2))
+    }
+
+    /// Zero is "never recorded", not a timestamp — the defaults API returns 0.0 for a missing Double, so
+    /// treating it as a value would date every strap to 1970.
+    func testZeroAndNilAreBothAbsent() {
+        XCTAssertNil(LastSyncAttribution.resolve(perDevice: 0, legacyGlobal: 0, pairedCount: 1))
+        XCTAssertNil(LastSyncAttribution.resolve(perDevice: nil, legacyGlobal: nil, pairedCount: 1))
+        XCTAssertEqual(LastSyncAttribution.resolve(perDevice: 0, legacyGlobal: 900, pairedCount: 1), 900)
+    }
+
+    /// A zero-paired registry must not license the global. The count is the evidence that exactly one
+    /// strap could have written it; "no straps" is not that evidence, and treating it as such would let a
+    /// failed registry read resurrect the bug.
+    func testAnEmptyRegistryDoesNotLicenseTheGlobal() {
+        XCTAssertNil(LastSyncAttribution.resolve(perDevice: nil, legacyGlobal: 900, pairedCount: 0))
+    }
+
+    func testThePrefKeyIsPerDeviceAndCaseInsensitive() {
+        XCTAssertEqual(LastSyncAttribution.prefKey(peripheralId: "F1:D4:F7:24:53:DE"),
+                       "noop.lastSyncAt.f1:d4:f7:24:53:de")
+        XCTAssertEqual(LastSyncAttribution.prefKey(peripheralId: "f1:d4:f7:24:53:de"),
+                       LastSyncAttribution.prefKey(peripheralId: "F1:D4:F7:24:53:DE"))
+        XCTAssertNil(LastSyncAttribution.prefKey(peripheralId: nil))
+        XCTAssertNil(LastSyncAttribution.prefKey(peripheralId: "   "))
+    }
+
+    /// It must not collide with the firmware key, which is built the same way from the same identifier.
+    func testItDoesNotCollideWithTheFirmwareKeyForTheSameStrap() {
+        let id = "f1:d4:f7:24:53:de"
+        XCTAssertNotEqual(LastSyncAttribution.prefKey(peripheralId: id),
+                          FirmwareAttribution.prefKey(peripheralId: id))
+    }
+
+    /// The #57 write-health pair had the identical defect one line below in the same capture: "rows last
+    /// landed 4d ago" against a strap whose own row count was zero. Both halves are scoped, because they
+    /// are read as a pair — "stalled more recently than ok" is the alarm — and scoping only one would
+    /// compare this strap's stall against another strap's success.
+    func testTheWriteHealthPairIsScopedAndItsHalvesStayDistinct() {
+        let id = "f1:d4:f7:24:53:de"
+        XCTAssertEqual(LastSyncAttribution.writeHealthPrefKey(peripheralId: id, kind: "lastWriteOkAt"),
+                       "sync.lastWriteOkAt.f1:d4:f7:24:53:de")
+        XCTAssertNotEqual(LastSyncAttribution.writeHealthPrefKey(peripheralId: id, kind: "lastWriteOkAt"),
+                          LastSyncAttribution.writeHealthPrefKey(peripheralId: id, kind: "lastWriteStalledAt"))
+        XCTAssertNil(LastSyncAttribution.writeHealthPrefKey(peripheralId: nil, kind: "lastWriteOkAt"))
+        XCTAssertNil(LastSyncAttribution.writeHealthPrefKey(peripheralId: "  ", kind: "lastWriteOkAt"))
+    }
+
+    /// Two straps must never share a write-health key, or one strap's successful offload would clear the
+    /// alarm raised by another strap's stall.
+    func testTwoStrapsGetDifferentWriteHealthKeys() {
+        XCTAssertNotEqual(
+            LastSyncAttribution.writeHealthPrefKey(peripheralId: "aa:bb:cc:dd:ee:ff", kind: "lastWriteOkAt"),
+            LastSyncAttribution.writeHealthPrefKey(peripheralId: "ff:ee:dd:cc:bb:aa", kind: "lastWriteOkAt"))
+    }
+}

From 8cfb2bcebc4f4e0b53832617a5758997c30b4284 Mon Sep 17 00:00:00 2001
From: Bernd Helm <bhelm@users.noreply.github.com>
Date: Mon, 31 Aug 2026 02:24:37 +0200
Subject: [PATCH 100/333] sleep: make debt an actionable next-night target
 (#1741)

Replaces the flat 14-night sum with a bounded, repayable next-night target on both
platforms:

  currentNeed = personalizedBaseNeed + currentDebt
  nextDebt    = 0.55 x max(0, currentNeed - creditedSleep)

The old ledger gave all fourteen nights full weight, so a repeated shortfall grew
into balances like eleven hours that cannot answer the only question the number is
for: how much should I add to tonight's target. The recurrence is self-limiting
because yesterday's debt is already part of today's need - meet the full current
need and the displayed debt clears - and a calculated debt under ten minutes reads
as balanced.

Verified rather than taken on trust. The recurrence was reimplemented independently
and run against both suites' vectors, which agree: [360, 546, 540] clears, and the
9.9 / 10.0 deadband boundary lands either side as documented. Fifteen tests on each
platform, one-to-one by name. Every caption and colour boundary on both sides goes
through the named constant - no hardcoded tens anywhere in the touched UI. The full
Android suite passes on the branch, and all fifteen CI checks are green.

The rounding parity is the detail worth calling out: Swift rounds -debt and Kotlin
negates round1(debt), which agree only because both are half-away-from-zero - and
Kotlin's is hand-written with a sign branch precisely because Math.round is half-UP.
That is the class of divergence parity work usually ships without noticing.

The 0.55 coefficient is calibrated against one contributor's 853 consecutive
exported WHOOP nights (93.0% within 15 minutes, 94.5% within 20), and the PR says
so plainly - including that the sleep-restriction literature it cites does NOT
derive the constant. Single-user interoperability approximation, one constant, and
trivially retuned later.

Also collapses the competing UI debt calculations into one series per platform, so
card, trend, night detail and Android's tapped detail can no longer disagree.

One thing for release notes rather than review: this materially changes a
user-visible number. Someone carrying an eleven-hour balance will open the app to
something under an hour. Correct, and the whole point, but it wants a What's New
line or it reads as data loss.

Thanks @bhelm - the test parity, the constant discipline and the honesty about what
the coefficient is and is not are all well above the bar.
---
 .../Sources/StrandAnalytics/SleepDebt.swift   |  75 ++++++++---
 .../StrandAnalyticsTests/SleepDebtTests.swift | 114 +++++++++++++----
 Strand/Screens/NightDetailCard.swift          |  37 +++---
 Strand/Screens/SleepDebtLedgerCard.swift      |  25 ++--
 Strand/Screens/SleepModel.swift               |  30 ++---
 .../NightDetailDebtFormattingTests.swift      |  33 +++++
 StrandTests/SleepModelDebtTests.swift         |  29 +++++
 .../main/java/com/noop/analytics/SleepDebt.kt |  66 +++++++---
 .../main/java/com/noop/ui/SleepFormatting.kt  |  16 +--
 .../java/com/noop/ui/SleepMetricCardsUi.kt    |  14 +--
 .../com/noop/ui/SleepMetricDetailLogic.kt     |  24 +++-
 .../com/noop/ui/SleepMetricDetailSheet.kt     |  12 +-
 .../main/java/com/noop/ui/SleepModelLogic.kt  |  18 +--
 .../src/main/java/com/noop/ui/SleepScreen.kt  |  21 ++--
 .../java/com/noop/analytics/SleepDebtTest.kt  | 116 ++++++++++++++----
 .../com/noop/ui/SleepDebtFormattingTest.kt    |  22 ++++
 .../com/noop/ui/SleepImportedFiguresTest.kt   |  15 +--
 .../com/noop/ui/SleepMetricDetailDebtTest.kt  |  50 ++++++++
 docs/ANALYTICS.md                             |  43 +++++++
 docs/FEATURES.md                              |   4 +-
 20 files changed, 590 insertions(+), 174 deletions(-)
 create mode 100644 StrandTests/NightDetailDebtFormattingTests.swift
 create mode 100644 StrandTests/SleepModelDebtTests.swift
 create mode 100644 android/app/src/test/java/com/noop/ui/SleepDebtFormattingTest.kt
 create mode 100644 android/app/src/test/java/com/noop/ui/SleepMetricDetailDebtTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepDebt.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepDebt.swift
index 6d711dca63..d4dbae179d 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepDebt.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepDebt.swift
@@ -1,17 +1,16 @@
 import Foundation
 
-// SleepDebt.swift — a rolling sleep-debt ledger over the last N nights.
+// SleepDebt.swift — a recency-weighted sleep-debt estimate over the last N nights.
 //
 // Pure, deterministic, DB-free. Given a chronological series of per-night total
 // sleep (minutes) and a personal sleep need (hours), it accumulates a running
-// balance of (actual − need) per night across a capped trailing window (14 nights
-// by default) and reports the net balance plus the per-night deltas that make it
-// up.
+// debt estimate across a capped trailing window (14 nights by default). The
+// previous estimate is part of the following night's need; 55% of any unmet need
+// carries forward. Tiny, non-actionable results below ten minutes are cleared.
 //
 // HONEST by construction:
-//   - It is a plain debt accumulator — sum of nightly (slept − need) — NOT a
-//     physiological model. A surplus night (slept > need) genuinely offsets a
-//     deficit one, the same way a checking balance nets credits and debits.
+//   - It is a planning estimate, not a physiological claim. Meeting base need plus
+//     the current estimate clears the debt; extra sleep never creates a surplus.
 //   - The window is capped (default 14) so "debt" never compounds indefinitely
 //     across months of history — only the recent fortnight is in scope.
 //   - Nights with no usable sleep total are SKIPPED entirely (no zero-fill), so a
@@ -38,10 +37,10 @@ public struct SleepDebtNight: Equatable, Sendable {
     }
 }
 
-/// The rolling sleep-debt ledger over the capped trailing window.
+/// The sleep-debt estimate over the capped trailing window.
 public struct SleepDebtLedger: Equatable, Sendable {
-    /// Net running balance (minutes) across the window: Σ(slept − need). Negative =
-    /// net DEBT (under-slept overall), positive = net SURPLUS, 0 = on target.
+    /// Current estimate in the existing signed UI convention: negative = debt,
+    /// zero = on target. This model never reports a positive surplus.
     public let balanceMin: Double
     /// Per-night contributions, oldest → newest, one per counted night (skipped
     /// nights are absent). The `deltaMin` values are the per-night bar/spark.
@@ -67,9 +66,15 @@ public enum SleepDebt {
     /// short enough that one rough patch doesn't read as months of compounding debt.
     public static let defaultWindowNights: Int = 14
 
+    /// Share of the complete unmet need carried into the following night.
+    public static let debtCarryFactor: Double = 0.55
+
+    /// Calculated debts smaller than this are too small to be actionable.
+    public static let minimumDebtMin: Double = 10.0
+
     /// "On target" deadband (minutes): a |balance| under this reads as balanced rather
     /// than as a debt/surplus, so a few stray minutes don't flip the headline.
-    public static let onTargetBandMin: Double = 30.0
+    public static let onTargetBandMin: Double = minimumDebtMin
 
     /// Sleep credited toward debt for one day. `mainSleepMin` remains the canonical
     /// main-night total used by Rest and the sleep headline; separately-recorded naps
@@ -84,6 +89,41 @@ public enum SleepDebt {
         return mainSleepMin + max(napSleepMin, 0)
     }
 
+    /// Debt values oldest → newest for local fallback surfaces. The returned history is
+    /// not capped: each usable day's local value is independently recomputed from the
+    /// trailing `window` usable nights. An imported value wins verbatim for that day's
+    /// output only; it never seeds or replaces the local recurrence. Imported-only rows
+    /// are emitted but do not consume a usable-night slot. Rows with neither usable sleep
+    /// nor an imported value have no debt observation and are omitted.
+    public static func debtSeries(
+        series: [(day: String, totalSleepMin: Double?)],
+        needHours: Double = AnalyticsEngine.Rest.defaultNeedHours,
+        importedDebtMin: [String: Double] = [:],
+        window: Int = defaultWindowNights
+    ) -> [(day: String, value: Double)] {
+        let cap = max(window, 1)
+        var usableHistory: [(day: String, totalSleepMin: Double?)] = []
+        usableHistory.reserveCapacity(cap)
+        var result: [(day: String, value: Double)] = []
+        result.reserveCapacity(series.count)
+
+        for row in series {
+            let sleptMin = row.totalSleepMin.flatMap { $0 > 0 ? $0 : nil }
+            if let sleptMin {
+                usableHistory.append((row.day, sleptMin))
+                if usableHistory.count > cap { usableHistory.removeFirst() }
+            }
+
+            if let imported = importedDebtMin[row.day] {
+                result.append((row.day, imported))
+            } else if sleptMin != nil {
+                let debt = ledger(series: usableHistory, needHours: needHours, window: cap).magnitudeMin
+                result.append((row.day, debt))
+            }
+        }
+        return result
+    }
+
     /// Build the ledger from a chronological `[(day, totalSleepMin?)]` series.
     ///
     /// - Parameters:
@@ -97,9 +137,9 @@ public enum SleepDebt {
     ///   - window: how many of the most-recent COUNTED nights to include. Defaults to
     ///     `defaultWindowNights` (14). Clamped to ≥ 1.
     ///
-    /// The balance is Σ over the window of (sleptMin − needMin): a surplus night
-    /// offsets a deficit one. Returns an empty ledger (balance 0, no nights) when no
-    /// night has usable data.
+    /// For each retained night, `nextDebt = 0.55 × max(0, need + debt − slept)`.
+    /// Results below ten minutes clear to zero. `SleepDebtNight.deltaMin` deliberately
+    /// remains the raw `slept − base need` value used by the per-night bars.
     public static func ledger(series: [(day: String, totalSleepMin: Double?)],
                               needHours: Double = AnalyticsEngine.Rest.defaultNeedHours,
                               window: Int = defaultWindowNights) -> SleepDebtLedger {
@@ -113,14 +153,15 @@ public enum SleepDebt {
 
         var nights: [SleepDebtNight] = []
         nights.reserveCapacity(windowed.count)
-        var balance = 0.0
+        var debt = 0.0
         for row in windowed {
             let slept = row.totalSleepMin ?? 0
             let delta = slept - needMin
-            balance += delta
+            let calculatedDebt = debtCarryFactor * max(0, needMin + debt - slept)
+            debt = calculatedDebt < minimumDebtMin ? 0 : calculatedDebt
             nights.append(SleepDebtNight(day: row.day, sleptMin: slept, deltaMin: delta))
         }
-        return SleepDebtLedger(balanceMin: round1(balance), nights: nights, needMin: needMin)
+        return SleepDebtLedger(balanceMin: round1(-debt), nights: nights, needMin: needMin)
     }
 
     /// Round to 1 decimal place (the ledger is reported in whole/near-whole minutes;
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepDebtTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepDebtTests.swift
index 1a2eebd690..b1720de223 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepDebtTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepDebtTests.swift
@@ -15,19 +15,18 @@ final class SleepDebtTests: XCTestCase {
         XCTAssertEqual(l.needMin, 480.0, accuracy: 1e-9)
     }
 
-    /// A surplus night offsets a deficit one (ledger nets credits and debits).
-    func testSurplusOffsetsDeficit() {
+    /// Debt carries forward as part of the following night's need; a night that meets
+    /// that complete need clears it instead of producing a positive surplus.
+    func testDebtRecursAndMeetingNeedClearsIt() {
         let series: [(day: String, totalSleepMin: Double?)] = [
             ("2026-06-01", 360),   // −120
-            ("2026-06-02", 540),   // +60
-            ("2026-06-03", 420),   // −60
+            ("2026-06-02", 546),   // base 480 + prior debt 66
+            ("2026-06-03", 540),   // raw bar remains +60
         ]
-        // need 8 h = 480. Σ = −120 + 60 − 60 = −120.
         let l = SleepDebt.ledger(series: series, needHours: 8.0)
-        XCTAssertEqual(l.balanceMin, -120.0, accuracy: 1e-9)
-        XCTAssertTrue(l.isDebt)
-        XCTAssertEqual(l.magnitudeMin, 120.0, accuracy: 1e-9)
-        XCTAssertEqual(l.nights.map { $0.deltaMin }, [-120, 60, -60])
+        XCTAssertEqual(l.balanceMin, 0.0, accuracy: 1e-9)
+        XCTAssertFalse(l.isDebt)
+        XCTAssertEqual(l.nights.map { $0.deltaMin }, [-120, 66, 60])
     }
 
     /// Nights with no usable sleep are skipped entirely (never zero-filled as debt).
@@ -40,19 +39,20 @@ final class SleepDebtTests: XCTestCase {
         ]
         let l = SleepDebt.ledger(series: series, needHours: 8.0)
         XCTAssertEqual(l.nightCount, 2)
-        XCTAssertEqual(l.balanceMin, -60.0, accuracy: 1e-9)
+        XCTAssertEqual(l.balanceMin, -33.0, accuracy: 1e-9)
         XCTAssertEqual(l.nights.map { $0.day }, ["2026-06-01", "2026-06-04"])
     }
 
     /// Only the most-recent `window` COUNTED nights are in scope.
     func testWindowCapKeepsMostRecent() {
-        // 16 nights, each 60 min UNDER need → each delta −60.
+        // 16 nights, each 60 min UNDER base need. The recurrence is computed only
+        // across the retained 14 counted nights, preserving the existing window.
         let series: [(day: String, totalSleepMin: Double?)] = (1...16).map {
             (String(format: "2026-06-%02d", $0), Double(420))
         }
         let l = SleepDebt.ledger(series: series, needHours: 8.0, window: 14)
         XCTAssertEqual(l.nightCount, 14)               // capped
-        XCTAssertEqual(l.balanceMin, -840.0, accuracy: 1e-9)   // 14 × −60
+        XCTAssertEqual(l.balanceMin, -73.3, accuracy: 1e-9)
         XCTAssertEqual(l.nights.first?.day, "2026-06-03")      // oldest kept
         XCTAssertEqual(l.nights.last?.day, "2026-06-16")       // newest kept
     }
@@ -72,7 +72,7 @@ final class SleepDebtTests: XCTestCase {
     func testDefaultNeedIsEightHours() {
         let l = SleepDebt.ledger(series: [("2026-06-01", 420)])
         XCTAssertEqual(l.needMin, AnalyticsEngine.Rest.defaultNeedHours * 60.0, accuracy: 1e-9)
-        XCTAssertEqual(l.balanceMin, -60.0, accuracy: 1e-9)
+        XCTAssertEqual(l.balanceMin, -33.0, accuracy: 1e-9)
     }
 
     /// Main sleep remains the canonical nightly figure, while a separately-recorded nap
@@ -81,7 +81,7 @@ final class SleepDebtTests: XCTestCase {
         let credited = try XCTUnwrap(SleepDebt.creditedSleepMin(mainSleepMin: 392, napSleepMin: 48))
         XCTAssertEqual(credited, 440, accuracy: 1e-9)
         let l = SleepDebt.ledger(series: [("2026-06-01", credited)], needHours: 8.0)
-        XCTAssertEqual(l.balanceMin, -40, accuracy: 1e-9)
+        XCTAssertEqual(l.balanceMin, -22, accuracy: 1e-9)
     }
 
     func testNapCreditRequiresMainSleepAndIgnoresNegativeNapMinutes() {
@@ -90,20 +90,82 @@ final class SleepDebtTests: XCTestCase {
         XCTAssertEqual(SleepDebt.creditedSleepMin(mainSleepMin: 392, napSleepMin: -10), 392.0)
     }
 
-    /// A NEGATIVE EXACT half-tie balance rounds AWAY from zero (−0.05 → −0.1), the documented
-    /// `round1` contract the Kotlin mirror must match (audit #6). needMin = 0.1, slept 0.05 →
-    /// delta −0.05 exactly → balance −0.1. Kotlin's old `roundToInt()` (half toward +∞) gave
-    /// 0.0 on this exact tie — the real divergence this pins shut.
-    func testNegativeHalfTieRoundsAwayFromZero() {
-        let l = SleepDebt.ledger(series: [("2026-06-01", 0.05)], needHours: 0.1 / 60.0)
-        XCTAssertEqual(l.balanceMin, -0.1, accuracy: 1e-9)   // away-from-zero, not 0.0
+    func testDebtBelowTenMinutesClearsButExactlyTenRemains() {
+        XCTAssertEqual(SleepDebt.onTargetBandMin, 10, accuracy: 1e-9)
+        // 18 min shortfall × 0.55 = 9.9 min -> cleared.
+        XCTAssertEqual(
+            SleepDebt.ledger(series: [("2026-06-01", 462)], needHours: 8).balanceMin,
+            0,
+            accuracy: 1e-9)
+        // A deliberately exact 10 min calculated debt remains debt.
+        let slept = 480.0 - (10.0 / 0.55)
+        XCTAssertEqual(
+            SleepDebt.ledger(series: [("2026-06-01", slept)], needHours: 8).balanceMin,
+            -10,
+            accuracy: 1e-9)
+    }
+
+    func testSurplusNeverCreatesPositiveBalanceAndRawBarsStayUnchanged() {
+        let l = SleepDebt.ledger(series: [
+            ("2026-06-01", 600),
+            ("2026-06-02", 420),
+        ], needHours: 8)
+        XCTAssertEqual(l.balanceMin, -33, accuracy: 1e-9)
+        XCTAssertEqual(l.nights.map(\.deltaMin), [120, -60])
+    }
+
+    func testImportedDebtIsVerbatimButDoesNotSeedFollowingFallback() {
+        let values = SleepDebt.debtSeries(
+            series: [("2026-06-01", 420), ("2026-06-02", 480)],
+            needHours: 8,
+            importedDebtMin: ["2026-06-01": 61.25])
+        XCTAssertEqual(values[0].value, 61.25, accuracy: 1e-9)
+        XCTAssertEqual(values[1].value, 18.2, accuracy: 1e-9)
+    }
+
+    func testDebtSeriesRoundsLocalOutputsToLedgerPrecision() {
+        let input: [(day: String, totalSleepMin: Double?)] = [
+            ("2026-06-01", 420), ("2026-06-02", 410),
+        ]
+        let values = SleepDebt.debtSeries(series: input, needHours: 8)
+        let ledger = SleepDebt.ledger(series: input, needHours: 8)
+        XCTAssertEqual(values.last?.value ?? -1, 56.7, accuracy: 1e-9)
+        XCTAssertEqual(values.last?.value ?? -1, ledger.magnitudeMin, accuracy: 1e-9)
+    }
+
+    func testImportedOnlyGapDoesNotConsumeOneOfFourteenUsableNights() {
+        let usable: [(day: String, totalSleepMin: Double?)] = (1...14).map {
+            (String(format: "2026-06-%02d", $0), 420)
+        }
+        let input = Array(usable.prefix(13))
+            + [(day: "2026-06-14-imported-only", totalSleepMin: nil)]
+            + Array(usable.suffix(1))
+        let values = SleepDebt.debtSeries(
+            series: input,
+            needHours: 8,
+            importedDebtMin: ["2026-06-14-imported-only": 91.25])
+
+        XCTAssertEqual(values.count, 15)
+        XCTAssertEqual(values[13].value, 91.25, accuracy: 1e-9)
+        XCTAssertEqual(values.last?.value ?? -1,
+                       SleepDebt.ledger(series: usable, needHours: 8, window: 14).magnitudeMin,
+                       accuracy: 1e-9)
     }
 
-    /// The symmetric POSITIVE exact half-tie (+0.05 → +0.1), pinned so the sign-aware Kotlin
-    /// rounding can't silently regress one direction. needMin = 0, slept 0.05 → delta +0.05.
-    func testPositiveHalfTieRoundsAwayFromZero() {
-        let l = SleepDebt.ledger(series: [("2026-06-01", 0.05)], needHours: 0.0)
-        XCTAssertEqual(l.balanceMin, 0.1, accuracy: 1e-9)
+    func testDebtSeriesKeepsFullHistoryWithPerDayTrailingLedgerParity() {
+        let input: [(day: String, totalSleepMin: Double?)] = (1...16).map {
+            (String(format: "2026-06-%02d", $0), 390 + Double($0))
+        }
+        let values = SleepDebt.debtSeries(series: input, needHours: 8, window: 14)
+
+        XCTAssertEqual(values.count, 16)
+        for index in values.indices {
+            let expected = SleepDebt.ledger(
+                series: Array(input.prefix(index + 1)), needHours: 8, window: 14).magnitudeMin
+            XCTAssertEqual(values[index].day, input[index].day)
+            XCTAssertEqual(values[index].value, expected, accuracy: 1e-9,
+                           "per-day parity at \(values[index].day)")
+        }
     }
 
     /// round1 is exercised on the directly-constructed value too, so the rounding mode is
diff --git a/Strand/Screens/NightDetailCard.swift b/Strand/Screens/NightDetailCard.swift
index 57dafb5eca..60fbde7308 100644
--- a/Strand/Screens/NightDetailCard.swift
+++ b/Strand/Screens/NightDetailCard.swift
@@ -1,4 +1,5 @@
 import SwiftUI
+import StrandAnalytics
 import StrandDesign
 import WhoopStore
 
@@ -40,8 +41,8 @@ struct NightDetailCard: View {
             StatTile(
                 label: "Sleep Debt",
                 value: debt.latest.map { durationText($0) } ?? "—",
-                caption: debtCaption(debt.latest),
-                accent: debtColor(debt.latest),
+                caption: nightDetailDebtCaption(debt.latest),
+                accent: nightDetailDebtColor(debt.latest),
                 sparkline: spark(debt.series),
                 sparkColor: StrandPalette.metricRose)
                 .frame(maxWidth: .infinity)
@@ -103,8 +104,8 @@ struct NightDetailCard: View {
                 StatTile(
                     label: "Sleep Debt",
                     value: debt.latest.map { durationText($0) } ?? "—",
-                    caption: debtCaption(debt.latest),
-                    accent: debtColor(debt.latest),
+                    caption: nightDetailDebtCaption(debt.latest),
+                    accent: nightDetailDebtColor(debt.latest),
                     sparkline: spark(debt.series),
                     sparkColor: StrandPalette.metricRose)
                 #endif
@@ -132,20 +133,6 @@ struct NightDetailCard: View {
         return String(localized: "\(sign)\(num)\(suffix) vs typical")
     }
 
-    private func debtCaption(_ debt: Double?) -> String {
-        guard let debt else { return String(localized: "vs need") }
-        return debt < 15 ? String(localized: "On target") : String(localized: "Below need")
-    }
-
-    private func debtColor(_ debt: Double?) -> Color {
-        guard let debt else { return StrandPalette.textPrimary }
-        switch debt {
-        case ..<15:  return StrandPalette.statusPositive
-        case ..<60:  return StrandPalette.statusWarning
-        default:     return StrandPalette.statusCritical
-        }
-    }
-
     /// A sparkline needs at least two points; otherwise return nil so the tile stays clean.
     private func spark(_ series: [Double]) -> [Double]? {
         let tail = Array(series.suffix(30))
@@ -160,3 +147,17 @@ struct NightDetailCard: View {
         return String(localized: "\(m / 60)h \(m % 60)m")
     }
 }
+
+func nightDetailDebtCaption(_ debt: Double?) -> String {
+    guard let debt else { return String(localized: "vs need") }
+    return debt < SleepDebt.onTargetBandMin ? String(localized: "On target") : String(localized: "Below need")
+}
+
+func nightDetailDebtColor(_ debt: Double?) -> Color {
+    guard let debt else { return StrandPalette.textPrimary }
+    switch debt {
+    case ..<SleepDebt.onTargetBandMin: return StrandPalette.statusPositive
+    case ..<60: return StrandPalette.statusWarning
+    default: return StrandPalette.statusCritical
+    }
+}
diff --git a/Strand/Screens/SleepDebtLedgerCard.swift b/Strand/Screens/SleepDebtLedgerCard.swift
index 6301394dd8..e53f99069a 100644
--- a/Strand/Screens/SleepDebtLedgerCard.swift
+++ b/Strand/Screens/SleepDebtLedgerCard.swift
@@ -7,14 +7,14 @@ import WhoopStore
 //
 // The Sleep tab's "Sleep-debt ledger" card, extracted into a standalone view so it can ALSO be hosted in
 // the Today tab. Both the Sleep tab and the Today host render THIS view from the SAME `SleepModel`, so the
-// rolling 14-night running balance can never diverge between the two surfaces (the parity contract). The
+// recency-weighted estimate can never diverge between the two surfaces (the parity contract). The
 // card body + its `debtDeltaBars` strip and the debt-only formatting helpers (`debtHeadline` /
 // `debtTag` / `debtRead` / `debtBalanceColor` / `debtSigned`) are a verbatim lift of the former
 // `SleepView.sleepDebtLedger` (and the helpers only it used); the nap-credited ledger is computed once in
 // `SleepModel.build` (the shared builder) and read here — it is NOT recomputed.
 
-/// The "Sleep-debt ledger" card. A running balance of (slept − personal need) across the recent
-/// fortnight — the net debt/surplus headline, a plain-English read, and a diverging per-night delta bar —
+/// The "Sleep-debt ledger" card. A recency-weighted estimate across the recent fortnight — the
+/// current debt headline, a plain-English read, and a diverging raw per-night delta bar —
 /// rendered from the shared [SleepModel]'s `sleepDebtLedger`. (#242)
 struct SleepDebtLedgerCard: View {
     let model: SleepModel
@@ -52,7 +52,8 @@ struct SleepDebtLedgerCard: View {
                             .font(StrandFont.subhead)
                             .foregroundStyle(StrandPalette.textSecondary)
                             .fixedSize(horizontal: false, vertical: true)
-                        // Per-night diverging delta bars (surplus up, deficit down).
+                        // Raw per-night delta bars (above/below base need), intentionally separate
+                        // from the recurrence's current debt estimate.
                         debtDeltaBars(ledger)
                         Divider().overlay(StrandPalette.hairline)
                         ChartFooter([
@@ -112,30 +113,30 @@ struct SleepDebtLedgerCard: View {
         return "≈\(durationText(m))"
     }
 
-    /// Short tag under/beside the headline: DEBT / SURPLUS / ON TARGET.
+    /// Short tag under/beside the headline: DEBT / ON TARGET.
     private func debtTag(_ ledger: SleepDebtLedger) -> String {
         if ledger.magnitudeMin < SleepDebt.onTargetBandMin { return String(localized: "balanced") }
-        return ledger.isDebt ? String(localized: "sleep debt") : String(localized: "surplus")
+        return ledger.isDebt ? String(localized: "sleep debt") : String(localized: "balanced")
     }
 
-    /// Plain-English read of the running balance over the window.
+    /// Plain-English read of the current actionable estimate.
     private func debtRead(_ ledger: SleepDebtLedger) -> String {
         let nights = ledger.nightCount
         let span = nights == 1
             ? String(localized: "the last night")
             : String(localized: "the last \(nights) nights")
         if ledger.magnitudeMin < SleepDebt.onTargetBandMin {
-            return String(localized: "You're roughly on top of your sleep across \(span). Slept minutes balance out against your need.")
+            return String(localized: "You've effectively met your current sleep need across \(span).")
         }
         let mag = durationText(ledger.magnitudeMin)
         if ledger.isDebt {
-            return String(localized: "You've banked about \(mag) of sleep debt over \(span). Surplus nights count back against it. An earlier night or two would clear it.")
+            return String(localized: "Add about \(mag) to your base sleep target tonight. Meeting that complete sleep need clears the displayed debt; recent shortfalls carry forward at a reduced weight.")
         }
-        return String(localized: "You're carrying about \(mag) of surplus over \(span). You've slept past your need on balance. Nicely ahead.")
+        return String(localized: "You've effectively met your current sleep need across \(span).")
     }
 
-    /// Color the balance by sign + size: surplus/within-band → positive green, modest
-    /// debt → warning, heavier debt → critical.
+    /// Color the balance by size: balanced → positive green, modest debt → warning,
+    /// heavier debt → critical.
     private func debtBalanceColor(_ ledger: SleepDebtLedger) -> Color {
         if ledger.magnitudeMin < SleepDebt.onTargetBandMin || !ledger.isDebt {
             return StrandPalette.statusPositive
diff --git a/Strand/Screens/SleepModel.swift b/Strand/Screens/SleepModel.swift
index 493b3f56c7..566236ac7e 100644
--- a/Strand/Screens/SleepModel.swift
+++ b/Strand/Screens/SleepModel.swift
@@ -169,8 +169,8 @@ struct SleepModel {
 
     let trendPoints: [TrendPoint]
 
-    /// Rolling 14-night sleep-debt ledger: Σ(slept − personal need) across the recent
-    /// fortnight, with the per-night deltas behind it. Computed once per data change.
+    /// Recency-weighted sleep-debt estimate across the latest 14 usable nights, with
+    /// raw per-night deltas for context. Computed once per data change.
     let sleepDebtLedger: SleepDebtLedger
 }
 
@@ -443,19 +443,22 @@ extension SleepModel {
         metric(days: days) { $0.respRateBpm }
     }
 
-    /// Sleep debt (minutes): the imported sleep_debt_min when the export carried it; else the
-    /// APPROXIMATE per-night need − (main sleep + nap sleep), floored at 0.
+    /// Sleep debt (minutes): imported `sleep_debt_min` remains export-verbatim. Otherwise use
+    /// the same recency-weighted ledger as the card, including nap credit and its 14-night window.
     static func sleepDebtSeries(days: [DailyMetric], importedSleep: [String: ImportedSleepFigures],
                                 napSleepMinByDay: [String: Double]) -> Metric {
-        let imported = importedSleep
         let need = debtNeedMin(days: days)   // #242: normative need, not the self-referential mean
-        let series = days.compactMap { d -> Double? in
-            if let debt = imported[d.day]?.debtMin { return debt }   // minutes, export-verbatim
-            guard let asleep = SleepDebt.creditedSleepMin(
+        let credited = days.map { d in
+            (day: d.day, totalSleepMin: SleepDebt.creditedSleepMin(
                 mainSleepMin: d.totalSleepMin,
-                napSleepMin: napSleepMinByDay[d.day] ?? 0), need > 0 else { return nil }
-            return Swift.max(0, need - asleep)   // APPROXIMATE fallback
+                napSleepMin: napSleepMinByDay[d.day] ?? 0))
         }
+        let importedDebt = importedSleep.compactMapValues(\.debtMin)
+        let series = SleepDebt.debtSeries(
+            series: credited,
+            needHours: need / 60.0,
+            importedDebtMin: importedDebt
+        ).map(\.value)
         return (series.last, mean(series), series)
     }
 
@@ -469,10 +472,9 @@ extension SleepModel {
 
     // MARK: Sleep-debt ledger
 
-    /// The rolling 14-night sleep-debt ledger from the cached daily metrics. Measures against the
-    /// normative `debtNeedMin` (the engine's `personalizedNeedHours`) — the SAME need the per-night
-    /// "Sleep Debt" tile uses, so the running-balance card and the tile agree — over each main night's
-    /// `totalSleepMin` plus actual asleep minutes from separately-recorded naps. (#242)
+    /// The 14-night recency-weighted estimate from cached daily metrics. It measures against the
+    /// normative `debtNeedMin` (the engine's `personalizedNeedHours`) — the SAME need and recurrence
+    /// the local "Sleep Debt" tile uses — and credits actual asleep minutes from separate naps. (#242)
     static func debtLedger(days: [DailyMetric], napSleepMinByDay: [String: Double]) -> SleepDebtLedger {
         SleepDebt.ledger(
             series: days.map { day in
diff --git a/StrandTests/NightDetailDebtFormattingTests.swift b/StrandTests/NightDetailDebtFormattingTests.swift
new file mode 100644
index 0000000000..f7612ca5fc
--- /dev/null
+++ b/StrandTests/NightDetailDebtFormattingTests.swift
@@ -0,0 +1,33 @@
+import XCTest
+import SwiftUI
+@testable import StrandDesign
+@testable import Strand
+
+final class NightDetailDebtFormattingTests: XCTestCase {
+    func testTenMinuteDebtBoundary() {
+        XCTAssertEqual(nightDetailDebtCaption(9.9), String(localized: "On target"))
+        assertSameResolvedColor(nightDetailDebtColor(9.9), StrandPalette.statusPositive)
+
+        XCTAssertEqual(nightDetailDebtCaption(10.0), String(localized: "Below need"))
+        assertSameResolvedColor(nightDetailDebtColor(10.0), StrandPalette.statusWarning)
+    }
+
+    func testImportedDebtAboveBoundaryRemainsDebt() {
+        XCTAssertEqual(nightDetailDebtCaption(12.5), String(localized: "Below need"))
+        assertSameResolvedColor(nightDetailDebtColor(12.5), StrandPalette.statusWarning)
+    }
+
+    private func assertSameResolvedColor(
+        _ actual: SwiftUI.Color,
+        _ expected: SwiftUI.Color,
+        file: StaticString = #filePath,
+        line: UInt = #line
+    ) {
+        let actualRGBA = actual.rgbaComponents
+        let expectedRGBA = expected.rgbaComponents
+        XCTAssertEqual(actualRGBA.r, expectedRGBA.r, accuracy: 0.001, file: file, line: line)
+        XCTAssertEqual(actualRGBA.g, expectedRGBA.g, accuracy: 0.001, file: file, line: line)
+        XCTAssertEqual(actualRGBA.b, expectedRGBA.b, accuracy: 0.001, file: file, line: line)
+        XCTAssertEqual(actualRGBA.a, expectedRGBA.a, accuracy: 0.001, file: file, line: line)
+    }
+}
diff --git a/StrandTests/SleepModelDebtTests.swift b/StrandTests/SleepModelDebtTests.swift
new file mode 100644
index 0000000000..ba33402ae4
--- /dev/null
+++ b/StrandTests/SleepModelDebtTests.swift
@@ -0,0 +1,29 @@
+import XCTest
+import WhoopStore
+@testable import Strand
+
+final class SleepModelDebtTests: XCTestCase {
+    private func day(_ value: String, sleep: Double?) -> DailyMetric {
+        DailyMetric(day: value, totalSleepMin: sleep, efficiency: nil,
+                    deepMin: nil, remMin: nil, lightMin: nil, disturbances: nil,
+                    restingHr: nil, avgHrv: nil, recovery: nil, strain: nil,
+                    exerciseCount: nil, spo2Pct: nil, skinTempDevC: nil, respRateBpm: nil)
+    }
+
+    func testLocalFallbackLatestAgreesWithLedger() {
+        let days = [day("2026-06-01", sleep: 360), day("2026-06-02", sleep: 480)]
+        let metric = SleepModel.sleepDebtSeries(
+            days: days, importedSleep: [:], napSleepMinByDay: [:])
+        let ledger = SleepModel.debtLedger(days: days, napSleepMinByDay: [:])
+        XCTAssertEqual(metric.latest ?? -1, ledger.magnitudeMin, accuracy: 1e-9)
+    }
+
+    func testImportedWhoopDebtRemainsVerbatim() {
+        let days = [day("2026-06-01", sleep: 480)]
+        let imported = ["2026-06-01": ImportedSleepFigures(
+            performancePct: nil, consistencyPct: nil, needMin: nil, debtMin: 17.25)]
+        let metric = SleepModel.sleepDebtSeries(
+            days: days, importedSleep: imported, napSleepMinByDay: [:])
+        XCTAssertEqual(metric.latest ?? -1, 17.25, accuracy: 1e-9)
+    }
+}
diff --git a/android/app/src/main/java/com/noop/analytics/SleepDebt.kt b/android/app/src/main/java/com/noop/analytics/SleepDebt.kt
index 7e8ae2966b..6ed915e9a8 100644
--- a/android/app/src/main/java/com/noop/analytics/SleepDebt.kt
+++ b/android/app/src/main/java/com/noop/analytics/SleepDebt.kt
@@ -5,21 +5,20 @@ import kotlin.math.ceil
 import kotlin.math.floor
 
 /*
- * SleepDebt.kt — a rolling sleep-debt ledger over the last N nights.
+ * SleepDebt.kt — an actionable next-night sleep-debt estimate over the last N nights.
  *
  * Faithful Kotlin mirror of StrandAnalytics/SleepDebt.swift. Keep the window cap,
- * the skip-no-data rule, and the Σ(slept − need) accumulation byte-identical to
+ * the skip-no-data rule, and the debt recurrence byte-identical to
  * Swift — the two clients must report the same balance for the same nights.
  *
  * Pure, deterministic, DB-free. Given a chronological series of per-night total
  * sleep (minutes) and a personal sleep need (hours), it accumulates a running
- * balance of (actual − need) per night across a capped trailing window (14 nights
- * by default) and reports the net balance plus the per-night deltas behind it.
+ * debt from unmet current need across a capped trailing window (14 nights by
+ * default) and reports that debt plus the raw per-night deltas behind it.
  *
  * HONEST by construction:
- *   - A plain debt accumulator — sum of nightly (slept − need) — NOT a physiological
- *     model. A surplus night genuinely offsets a deficit one, like a balance nets
- *     credits and debits.
+ *   - Debt is 55% of the current unmet need. Meeting need (including carried debt)
+ *     clears it; extra sleep never creates a positive bank.
  *   - The window is capped (default 14) so debt never compounds across months of
  *     history — only the recent fortnight is in scope.
  *   - Nights with no usable sleep total are SKIPPED (no zero-fill), so a gap in wear
@@ -48,7 +47,7 @@ data class SleepDebtNight(
  * `SleepDebtLedger`.
  */
 data class SleepDebtLedger(
-    /** Net running balance (minutes): Σ(slept − need). Negative = net DEBT, positive = net SURPLUS. */
+    /** Current debt as a negative balance in minutes; never positive. */
     val balanceMin: Double,
     /** Per-night contributions, oldest → newest (skipped nights absent); the per-night bar/spark. */
     val nights: List<SleepDebtNight>,
@@ -74,10 +73,12 @@ object SleepDebt {
     const val DEFAULT_WINDOW_NIGHTS: Int = 14
 
     /**
-     * "On target" deadband (minutes): a |balance| under this reads as balanced rather than
-     * a debt/surplus, so a few stray minutes don't flip the headline.
+     * Calculated debts below this threshold are treated as balanced. Exactly ten minutes remains debt.
      */
-    const val ON_TARGET_BAND_MIN: Double = 30.0
+    const val ON_TARGET_BAND_MIN: Double = 10.0
+
+    /** Fraction of current unmet need carried into the next night's target. */
+    const val DEBT_CARRY: Double = 0.55
 
     /**
      * Sleep credited toward debt for one day. [mainSleepMin] remains the canonical
@@ -94,6 +95,34 @@ object SleepDebt {
         return main + napSleepMin.coerceAtLeast(0.0)
     }
 
+    /**
+     * Debt values oldest → newest for local fallback surfaces. An imported value wins verbatim
+     * for its day's output, while the independent local recurrence continues from credited sleep.
+     */
+    fun debtSeries(
+        series: List<Pair<String, Double?>>,
+        needHours: Double = RestScorer.defaultSleepNeedHours,
+        importedDebtMin: Map<String, Double> = emptyMap(),
+        window: Int = DEFAULT_WINDOW_NIGHTS,
+    ): List<Pair<String, Double>> {
+        val cap = window.coerceAtLeast(1)
+        val usableHistory = ArrayList<Pair<String, Double?>>(cap)
+        val result = ArrayList<Pair<String, Double>>(series.size)
+        for ((day, slept) in series) {
+            val imported = importedDebtMin[day]
+            val sleptMin = slept?.takeIf { it > 0.0 }
+            if (sleptMin != null) {
+                usableHistory.add(day to sleptMin)
+                if (usableHistory.size > cap) usableHistory.removeAt(0)
+            }
+            if (imported != null) result.add(day to imported)
+            else if (sleptMin != null) {
+                result.add(day to ledger(usableHistory, needHours = needHours, window = cap).magnitudeMin)
+            }
+        }
+        return result
+    }
+
     /**
      * Build the ledger from a chronological `List<Pair<day, totalSleepMin?>>` series.
      *
@@ -105,8 +134,8 @@ object SleepDebt {
      * @param window how many of the most-recent COUNTED nights to include. Defaults to
      *   [DEFAULT_WINDOW_NIGHTS] (14). Clamped to ≥ 1.
      *
-     * The balance is Σ over the window of (sleptMin − needMin): a surplus night offsets a
-     * deficit one. Returns an empty ledger (balance 0, no nights) when no night has data.
+     * Each night applies `nextDebt = 0.55 * max(0, need + currentDebt - slept)`.
+     * Calculated debt below ten minutes is cleared. Returns an empty ledger when no night has data.
      */
     fun ledger(
         series: List<Pair<String, Double?>>,
@@ -122,14 +151,19 @@ object SleepDebt {
         val windowed = usable.takeLast(cap)
 
         val nights = ArrayList<SleepDebtNight>(windowed.size)
-        var balance = 0.0
+        var debt = 0.0
         for ((day, slept) in windowed) {
             val sleptMin = slept ?: 0.0
             val delta = sleptMin - needMin
-            balance += delta
+            debt = nextDebt(needMin, debt, sleptMin)
             nights.add(SleepDebtNight(day = day, sleptMin = sleptMin, deltaMin = delta))
         }
-        return SleepDebtLedger(balanceMin = round1(balance), nights = nights, needMin = needMin)
+        return SleepDebtLedger(balanceMin = -round1(debt), nights = nights, needMin = needMin)
+    }
+
+    private fun nextDebt(needMin: Double, currentDebt: Double, sleptMin: Double): Double {
+        val calculatedDebt = DEBT_CARRY * (needMin + currentDebt - sleptMin).coerceAtLeast(0.0)
+        return if (calculatedDebt < ON_TARGET_BAND_MIN) 0.0 else calculatedDebt
     }
 
     /**
diff --git a/android/app/src/main/java/com/noop/ui/SleepFormatting.kt b/android/app/src/main/java/com/noop/ui/SleepFormatting.kt
index 4ea4275843..cd14e2f48a 100644
--- a/android/app/src/main/java/com/noop/ui/SleepFormatting.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepFormatting.kt
@@ -26,12 +26,12 @@ internal fun vsTypical(latest: Double?, typical: Double?, suffix: String, decima
 
 internal fun debtCaption(debt: Double?): String {
     if (debt == null) return "vs need"
-    return if (debt < 15.0) "On target" else "Below need"
+    return if (debt < SleepDebt.ON_TARGET_BAND_MIN) "On target" else "Below need"
 }
 
 internal fun debtColor(debt: Double?): Color = when {
     debt == null -> Palette.textPrimary
-    debt < 15.0 -> Palette.statusPositive
+    debt < SleepDebt.ON_TARGET_BAND_MIN -> Palette.statusPositive
     debt < 60.0 -> Palette.statusWarning
     else -> Palette.statusCritical
 }
@@ -46,30 +46,30 @@ internal fun debtHeadline(ledger: SleepDebtLedger): String =
     if (ledger.magnitudeMin < SleepDebt.ON_TARGET_BAND_MIN) "On target"
     else "≈${durationText(ledger.magnitudeMin)}"
 
-/** Short tag beside the headline: sleep debt / surplus / balanced. */
+/** Short tag beside the headline: the recurrence never creates a positive surplus. */
 internal fun debtTag(ledger: SleepDebtLedger): String = when {
     ledger.magnitudeMin < SleepDebt.ON_TARGET_BAND_MIN -> "balanced"
     ledger.isDebt -> "sleep debt"
-    else -> "surplus"
+    else -> "balanced"
 }
 
-/** Plain-English read of the running balance over the window. */
+/** Plain-English read of the actionable addition to the next night's target. */
 internal fun debtRead(ledger: SleepDebtLedger): String {
     val nights = ledger.nightCount
     val span = "the last $nights night${if (nights == 1) "" else "s"}"
     if (ledger.magnitudeMin < SleepDebt.ON_TARGET_BAND_MIN) {
-        return "You're roughly on top of your sleep across $span. Slept minutes balance out against your need."
+        return "You've met your current sleep target across $span. No extra debt needs carrying into tonight."
     }
     val mag = durationText(ledger.magnitudeMin)
     return if (ledger.isDebt) {
-        "You've banked about $mag of sleep debt over $span. Surplus nights count back against it. An earlier night or two would clear it."
+        "Aim for about $mag beyond your base need tonight. Meeting that target clears the displayed sleep debt."
     } else {
         "You're carrying about $mag of surplus over $span. You've slept past your need on balance. Nicely ahead."
     }
 }
 
 /**
- * Color the balance by sign + size: surplus/within-band → positive green, modest debt →
+ * Color the balance by size: within-band → positive green, modest debt →
  * warning, heavier debt → critical.
  */
 internal fun debtBalanceColor(ledger: SleepDebtLedger): Color = when {
diff --git a/android/app/src/main/java/com/noop/ui/SleepMetricCardsUi.kt b/android/app/src/main/java/com/noop/ui/SleepMetricCardsUi.kt
index 8ead30b153..41d7953f79 100644
--- a/android/app/src/main/java/com/noop/ui/SleepMetricCardsUi.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepMetricCardsUi.kt
@@ -157,13 +157,12 @@ private fun MetricGrid(m: SleepModel, onMetricClick: (String) -> Unit = {}) {
     }
 }
 
-// MARK: - 2b. Sleep-debt ledger (rolling 14-night running balance)
+// MARK: - 2b. Sleep-debt ledger (actionable next-night target)
 
 /**
- * A running balance of (slept − personal need) across the recent fortnight, surfaced as one
- * card: the net debt/surplus headline, a plain-English read, and a diverging bar of each
- * night's delta (surplus above the centre line, deficit below). Honest: a simple accumulator
- * — a surplus night offsets a deficit one — capped at 14 nights, no-data nights skipped.
+ * A recency-weighted estimate of unmet current need, surfaced with the raw per-night deltas.
+ * Meeting base need plus displayed debt clears it; extra sleep does not create a positive bank.
+ * History stays capped at 14 counted nights and no-data nights remain skipped.
  * Mirrors the macOS SleepDebtLedgerCard section-for-section. `internal` and keyed on the shared
  * [SleepModel] so the Today host (TodayScreen) can render the SAME view the Sleep tab does (a mirror,
  * not a copy); the nap-credited ledger is read from `m.sleepDebtLedger`, never recomputed here. Twin of
@@ -173,7 +172,7 @@ private fun MetricGrid(m: SleepModel, onMetricClick: (String) -> Unit = {}) {
 internal fun SleepDebtLedgerHostCard(m: SleepModel) {
     val ledger = m.sleepDebtLedger
     Column(verticalArrangement = Arrangement.spacedBy(Metrics.gap)) {
-        SectionHeader("Sleep-debt ledger", overline = "Last 14 nights", trailing = "running balance")
+        SectionHeader("Sleep-debt ledger", overline = "Last 14 nights", trailing = "tonight's target")
         NoopCard(padding = Metrics.cardPadding, tint = Palette.restColor) {
             if (ledger.nightCount == 0) {
                 Text(
@@ -183,7 +182,7 @@ internal fun SleepDebtLedgerHostCard(m: SleepModel) {
                 )
             } else {
                 Column(verticalArrangement = Arrangement.spacedBy(Metrics.space14)) {
-                    // Headline: net balance + the short tag (sleep debt / surplus / balanced).
+                    // Headline: current debt or balanced.
                     Row(verticalAlignment = Alignment.CenterVertically) {
                         Text(
                             debtHeadline(ledger),
@@ -1130,4 +1129,3 @@ internal fun SleepConsistencyCard(
         }
     }
 }
-
diff --git a/android/app/src/main/java/com/noop/ui/SleepMetricDetailLogic.kt b/android/app/src/main/java/com/noop/ui/SleepMetricDetailLogic.kt
index 04ad84db79..3f576e1b5c 100644
--- a/android/app/src/main/java/com/noop/ui/SleepMetricDetailLogic.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepMetricDetailLogic.kt
@@ -2,6 +2,7 @@ package com.noop.ui
 
 import androidx.compose.ui.graphics.Color
 import com.noop.analytics.RestScorer
+import com.noop.analytics.SleepDebt
 import com.noop.data.DailyMetric
 import java.time.LocalDate
 import java.util.Locale
@@ -31,8 +32,28 @@ internal fun sleepMetricSpec(key: String): SleepMetricSpec = when (key) {
     else              -> SleepMetricSpec(key, "", Palette.accent) { "${it.roundToInt()}" }
 }
 
-internal fun buildSleepMetricPoints(days: List<DailyMetric>, key: String): List<Pair<String, Double>> {
+internal fun buildSleepMetricPoints(
+    days: List<DailyMetric>,
+    key: String,
+    imported: ImportedSleepSeries = ImportedSleepSeries(),
+    napSleepMinByDay: Map<String, Double> = emptyMap(),
+): List<Pair<String, Double>> {
     val needMin = max(450.0, days.mapNotNull { it.totalSleepMin?.takeIf { m -> m > 0.0 } }.average().let { if (it.isNaN()) 480.0 else it })
+    if (key == "sleep_debt") {
+        val debtNeedMin = RestScorer.personalizedNeedHours(
+            days.mapNotNull { it.totalSleepMin?.let { minutes -> minutes / 60.0 } }, null,
+        ) * 60.0
+        return SleepDebt.debtSeries(
+            series = days.map { day ->
+                day.day to SleepDebt.creditedSleepMin(
+                    day.totalSleepMin,
+                    napSleepMinByDay[day.day] ?: 0.0,
+                )
+            },
+            needHours = debtNeedMin / 60.0,
+            importedDebtMin = imported.debtMin,
+        )
+    }
     return days.mapNotNull { d ->
         val v: Double? = when (key) {
             // The Rest detail graph reads the REAL resolved Rest composite per day — the same single
@@ -59,7 +80,6 @@ internal fun buildSleepMetricPoints(days: List<DailyMetric>, key: String): List<
                 if (sl > 0.0) (dp + rm) / sl * 100.0 else null
             }
             "respiratory" -> d.respRateBpm
-            "sleep_debt"  -> d.totalSleepMin?.let { max(0.0, needMin - it) }   // #691: minutes (spec unit "min")
             else          -> null
         }
         v?.takeIf { it.isFinite() }?.let { d.day to it }
diff --git a/android/app/src/main/java/com/noop/ui/SleepMetricDetailSheet.kt b/android/app/src/main/java/com/noop/ui/SleepMetricDetailSheet.kt
index d27df55a4e..893daa0503 100644
--- a/android/app/src/main/java/com/noop/ui/SleepMetricDetailSheet.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepMetricDetailSheet.kt
@@ -32,11 +32,18 @@ import androidx.compose.runtime.setValue
 // MARK: - Sleep metric detail sheet
 
 @Composable
-internal fun SleepMetricDetailSheetContent(vm: AppViewModel, key: String) {
+internal fun SleepMetricDetailSheetContent(
+    vm: AppViewModel,
+    key: String,
+    imported: ImportedSleepSeries = ImportedSleepSeries(),
+    napSleepMinByDay: Map<String, Double> = emptyMap(),
+) {
     val days by vm.recentDays.collectAsStateWithLifecycle()
     var range by remember { mutableStateOf(SleepMetricRange.MONTH) }
     val spec = remember(key) { sleepMetricSpec(key) }
-    val allPoints = remember(days, key) { buildSleepMetricPoints(days, key) }
+    val allPoints = remember(days, key, imported, napSleepMinByDay) {
+        buildSleepMetricPoints(days, key, imported, napSleepMinByDay)
+    }
     val filteredPoints = remember(allPoints, range) { filterSleepMetricPoints(allPoints, range) }
 
     Column(
@@ -141,4 +148,3 @@ internal fun SleepMetricDetailSheetContent(vm: AppViewModel, key: String) {
         }
     }
 }
-
diff --git a/android/app/src/main/java/com/noop/ui/SleepModelLogic.kt b/android/app/src/main/java/com/noop/ui/SleepModelLogic.kt
index 27124fcad3..7329fd57d4 100644
--- a/android/app/src/main/java/com/noop/ui/SleepModelLogic.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepModelLogic.kt
@@ -227,13 +227,15 @@ internal fun buildSleepModel(
         if (dp != null && rm != null && sl != null && sl > 0.0) (dp + rm) / sl * 100.0 else null
     }
     val respiratory = metric(days, todayKey) { it.respRateBpm }
+    val localDebtByDay = SleepDebt.debtSeries(
+        series = days.map { d ->
+            d.day to SleepDebt.creditedSleepMin(d.totalSleepMin, napSleepMinByDay[d.day] ?: 0.0)
+        },
+        needHours = debtNeedMin / 60.0,
+        importedDebtMin = imported.debtMin, // export-verbatim for that day; never seeds local state
+    ).toMap()
     val sleepDebt = run {
-        val series = days.mapNotNull { d ->
-            imported.debtMin[d.day]   // minutes, export-verbatim
-                ?: SleepDebt.creditedSleepMin(d.totalSleepMin, napSleepMinByDay[d.day] ?: 0.0)
-                    ?.takeIf { debtNeedMin > 0.0 }
-                    ?.let { max(0.0, debtNeedMin - it) }   // #242: normative need, not the self-referential mean
-        }
+        val series = days.mapNotNull { localDebtByDay[it.day] }
         Metric(series.lastOrNull(), mean(series), series)
     }
 
@@ -243,9 +245,7 @@ internal fun buildSleepModel(
     val trendHours = trendRows.mapNotNull { it.totalSleepMin?.let { minutes -> minutes / 60.0 } }
     val trendNeedHours = trendRows.map { row -> ((imported.needMin[row.day] ?: debtNeedMin) / 60.0) }
     val trendDebtHours = trendRows.map { row ->
-        val sleptMin = SleepDebt.creditedSleepMin(row.totalSleepMin, napSleepMinByDay[row.day] ?: 0.0) ?: 0.0
-        val neededMin = imported.needMin[row.day] ?: debtNeedMin   // #242: normative need, not the mean
-        ((imported.debtMin[row.day] ?: max(0.0, neededMin - sleptMin)) / 60.0)
+        (localDebtByDay[row.day] ?: 0.0) / 60.0
     }
     val trendDates = trendRows.map { it.day }
 
diff --git a/android/app/src/main/java/com/noop/ui/SleepScreen.kt b/android/app/src/main/java/com/noop/ui/SleepScreen.kt
index 1ffc1ae979..c9f3c572ee 100644
--- a/android/app/src/main/java/com/noop/ui/SleepScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepScreen.kt
@@ -450,6 +450,13 @@ fun SleepScreen(
         )
     }
 
+    // Debt credit is the canonical main-night DailyMetric total PLUS actual asleep minutes from blocks
+    // outside that main-night group. Keep the nap sum separate: Rest, the hero and daily total deliberately
+    // remain main-night-only. Stage-less naps add no guessed in-bed time. Mirrors Swift SleepView. (#525)
+    val napSleepMinByDay = remember(sleeps, habitualMidsleep) {
+        napSleepMinutesByDay(sleeps, habitualMidsleep)
+    }
+
     // Tapping a metric tile opens a full-history detail sheet for that one metric. (PR #260)
     val metricSheetState = rememberModalBottomSheetState(skipPartiallyExpanded = true)
     var detailMetricKey by remember { mutableStateOf<String?>(null) }
@@ -461,7 +468,12 @@ fun SleepScreen(
             containerColor = Palette.surfaceRaised,
             contentColor = Palette.textPrimary,
         ) {
-            SleepMetricDetailSheetContent(vm = vm, key = currentDetailKey)
+            SleepMetricDetailSheetContent(
+                vm = vm,
+                key = currentDetailKey,
+                imported = imported,
+                napSleepMinByDay = napSleepMinByDay,
+            )
         }
     }
 
@@ -476,13 +488,6 @@ fun SleepScreen(
             .map { (_, blocks) -> blocks.sortedBy { it.effectiveStartTs } }
     }
 
-    // Debt credit is the canonical main-night DailyMetric total PLUS actual asleep minutes from blocks
-    // outside that main-night group. Keep the nap sum separate: Rest, the hero and daily total deliberately
-    // remain main-night-only. Stage-less naps add no guessed in-bed time. Mirrors Swift SleepView. (#525)
-    val napSleepMinByDay = remember(sleeps, habitualMidsleep) {
-        napSleepMinutesByDay(sleeps, habitualMidsleep)
-    }
-
     // The navigated night, decoded once per (offset, data) change — chevron taps re-pick
     // instantly without re-parsing stagesJSON on every recomposition. The offset now indexes
     // DAYS (navDays), so a day with a detected night always resolves to that night. (#160, #59)
diff --git a/android/app/src/test/java/com/noop/analytics/SleepDebtTest.kt b/android/app/src/test/java/com/noop/analytics/SleepDebtTest.kt
index 4dbfadbfa1..e14f1ff90c 100644
--- a/android/app/src/test/java/com/noop/analytics/SleepDebtTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/SleepDebtTest.kt
@@ -22,16 +22,17 @@ class SleepDebtTest {
     }
 
     @Test
-    fun surplus_offsetsDeficit() {
+    fun debtCarriesAtFiftyFivePercentAndSurplusDoesNotBank() {
         val series = listOf(
             "2026-06-01" to 360.0,   // −120
             "2026-06-02" to 540.0,   // +60
             "2026-06-03" to 420.0,   // −60
         )
         val l = SleepDebt.ledger(series, needHours = 8.0)
-        assertEquals(-120.0, l.balanceMin, 1e-9)
+        // debt: 66 after night 1; the target-met second night clears it; night 3 leaves 33.
+        assertEquals(-33.0, l.balanceMin, 1e-9)
         assertTrue(l.isDebt)
-        assertEquals(120.0, l.magnitudeMin, 1e-9)
+        assertEquals(33.0, l.magnitudeMin, 1e-9)
         assertEquals(listOf(-120.0, 60.0, -60.0), l.nights.map { it.deltaMin })
     }
 
@@ -45,7 +46,7 @@ class SleepDebtTest {
         )
         val l = SleepDebt.ledger(series, needHours = 8.0)
         assertEquals(2, l.nightCount)
-        assertEquals(-60.0, l.balanceMin, 1e-9)
+        assertEquals(-33.0, l.balanceMin, 1e-9)
         assertEquals(listOf("2026-06-01", "2026-06-04"), l.nights.map { it.day })
     }
 
@@ -54,7 +55,7 @@ class SleepDebtTest {
         val series = (1..16).map { String.format("2026-06-%02d", it) to (420.0 as Double?) }
         val l = SleepDebt.ledger(series, needHours = 8.0, window = 14)
         assertEquals(14, l.nightCount)
-        assertEquals(-840.0, l.balanceMin, 1e-9)   // 14 × −60
+        assertEquals(-73.3, l.balanceMin, 1e-9) // converges instead of stacking 14 × −60
         assertEquals("2026-06-03", l.nights.first().day)
         assertEquals("2026-06-16", l.nights.last().day)
     }
@@ -74,7 +75,7 @@ class SleepDebtTest {
     fun defaultNeed_isEightHours() {
         val l = SleepDebt.ledger(listOf("2026-06-01" to 420.0))
         assertEquals(RestScorer.defaultSleepNeedHours * 60.0, l.needMin, 1e-9)
-        assertEquals(-60.0, l.balanceMin, 1e-9)
+        assertEquals(-33.0, l.balanceMin, 1e-9)
     }
 
     /** Main sleep stays canonical; separately-recorded nap sleep adds debt repayment credit. */
@@ -83,34 +84,99 @@ class SleepDebtTest {
         val credited = SleepDebt.creditedSleepMin(mainSleepMin = 392.0, napSleepMin = 48.0)
         assertEquals(440.0, credited!!, 1e-9)
         val l = SleepDebt.ledger(listOf("2026-06-01" to credited), needHours = 8.0)
-        assertEquals(-40.0, l.balanceMin, 1e-9)
+        assertEquals(-22.0, l.balanceMin, 1e-9)
     }
 
     @Test
-    fun napCredit_requiresMainSleepAndIgnoresNegativeNapMinutes() {
-        assertNull(SleepDebt.creditedSleepMin(mainSleepMin = null, napSleepMin = 48.0))
-        assertNull(SleepDebt.creditedSleepMin(mainSleepMin = 0.0, napSleepMin = 48.0))
-        assertEquals(392.0, SleepDebt.creditedSleepMin(mainSleepMin = 392.0, napSleepMin = -10.0)!!, 1e-9)
+    fun calculatedDebtBelowTenMinutesClearsButExactlyTenRemains() {
+        val below = SleepDebt.ledger(listOf("2026-06-01" to (480.0 - 9.9 / 0.55)), needHours = 8.0)
+        val exact = SleepDebt.ledger(listOf("2026-06-01" to (480.0 - 10.0 / 0.55)), needHours = 8.0)
+        assertEquals(0.0, below.balanceMin, 1e-9)
+        assertEquals(-10.0, exact.balanceMin, 1e-9)
+    }
+
+    @Test
+    fun meetingNeedIncludingCurrentDebtClearsItCompletely() {
+        val l = SleepDebt.ledger(
+            listOf("2026-06-01" to 360.0, "2026-06-02" to 546.0),
+            needHours = 8.0,
+        )
+        assertEquals(0.0, l.balanceMin, 1e-9)
+        assertFalse(l.isDebt)
+    }
+
+    @Test
+    fun importedDebtIsVerbatimButDoesNotSeedFollowingFallback() {
+        val values = SleepDebt.debtSeries(
+            series = listOf("2026-06-01" to 420.0, "2026-06-02" to 480.0),
+            needHours = 8.0,
+            importedDebtMin = mapOf("2026-06-01" to 61.25),
+        )
+        assertEquals(61.25, values[0].second, 1e-9)
+        assertEquals(18.2, SleepDebt.round1(values[1].second), 1e-9)
+    }
+
+    @Test
+    fun debtSeriesRoundsLocalOutputsToTheLedgerSurfacePrecision() {
+        val values = SleepDebt.debtSeries(
+            series = listOf("2026-06-01" to 420.0, "2026-06-02" to 410.0),
+            needHours = 8.0,
+        )
+        val ledger = SleepDebt.ledger(
+            series = listOf("2026-06-01" to 420.0, "2026-06-02" to 410.0),
+            needHours = 8.0,
+        )
+        assertEquals(56.7, values.last().second, 1e-9)
+        assertEquals(ledger.magnitudeMin, values.last().second, 1e-9)
     }
 
-    /**
-     * A NEGATIVE EXACT half-tie balance must round AWAY from zero (−0.05 → −0.1) to match
-     * Swift's `round1`. Kotlin's old `roundToInt()` rounded half toward +∞ and produced 0.0 on
-     * this exact tie — the cross-platform divergence audit #6 called out. needMin = 0.1, slept
-     * 0.05 → delta −0.05 exactly → balance −0.1.
-     */
     @Test
-    fun negativeHalfTie_roundsAwayFromZero() {
-        val l = SleepDebt.ledger(listOf("2026-06-01" to 0.05), needHours = 0.1 / 60.0)
-        assertEquals(-0.1, l.balanceMin, 1e-9)   // away-from-zero, not 0.0
+    fun importedOnlyGapDoesNotConsumeOneOfFourteenUsableNights() {
+        val usable = (1..14).map { index ->
+            String.format("2026-06-%02d", index) to (420.0 as Double?)
+        }
+        val series = usable.take(13) +
+            listOf("2026-06-14-imported-only" to null) +
+            usable.drop(13)
+        val values = SleepDebt.debtSeries(
+            series = series,
+            needHours = 8.0,
+            importedDebtMin = mapOf("2026-06-14-imported-only" to 91.25),
+        )
+
+        assertEquals(15, values.size)
+        assertEquals(91.25, values[13].second, 1e-9)
+        assertEquals(
+            SleepDebt.ledger(usable, needHours = 8.0, window = 14).magnitudeMin,
+            values.last().second,
+            1e-9,
+        )
     }
 
-    /** The symmetric positive half-tie (+0.05 → +0.1), pinned so the sign-aware rounding holds.
-     *  needMin = 0, slept 0.05 → delta +0.05. */
     @Test
-    fun positiveHalfTie_roundsAwayFromZero() {
-        val l = SleepDebt.ledger(listOf("2026-06-01" to 0.05), needHours = 0.0)
-        assertEquals(0.1, l.balanceMin, 1e-9)
+    fun debtSeriesKeepsFullOutputHistoryAndRecomputesEachDayFromTrailingUsableWindow() {
+        val series = (1..16).map { index ->
+            String.format("2026-06-%02d", index) to ((390.0 + index) as Double?)
+        }
+        val values = SleepDebt.debtSeries(series, needHours = 8.0, window = 14)
+
+        assertEquals(16, values.size)
+        values.forEachIndexed { index, (day, debt) ->
+            val expected = SleepDebt.ledger(
+                series = series.take(index + 1),
+                needHours = 8.0,
+                window = 14,
+            ).magnitudeMin
+            assertEquals(day, series[index].first)
+            assertEquals("per-day parity at $day", expected, debt, 1e-9)
+        }
+    }
+
+    @Test
+    fun napCredit_requiresMainSleepAndIgnoresNegativeNapMinutes() {
+        assertNull(SleepDebt.creditedSleepMin(mainSleepMin = null, napSleepMin = 48.0))
+        assertNull(SleepDebt.creditedSleepMin(mainSleepMin = 0.0, napSleepMin = 48.0))
+        assertEquals(392.0, SleepDebt.creditedSleepMin(mainSleepMin = 392.0, napSleepMin = -10.0)!!, 1e-9)
     }
 
     /** round1 pinned directly (both signs + a non-tie + a larger tie), parity with Swift's
diff --git a/android/app/src/test/java/com/noop/ui/SleepDebtFormattingTest.kt b/android/app/src/test/java/com/noop/ui/SleepDebtFormattingTest.kt
new file mode 100644
index 0000000000..4ab2b83534
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/SleepDebtFormattingTest.kt
@@ -0,0 +1,22 @@
+package com.noop.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class SleepDebtFormattingTest {
+
+    @Test
+    fun nightDetailUsesTenMinuteDebtBoundary() {
+        assertEquals("On target", debtCaption(9.9))
+        assertEquals(Palette.statusPositive, debtColor(9.9))
+
+        assertEquals("Below need", debtCaption(10.0))
+        assertEquals(Palette.statusWarning, debtColor(10.0))
+    }
+
+    @Test
+    fun importedDebtAboveBoundaryRemainsDebt() {
+        assertEquals("Below need", debtCaption(12.5))
+        assertEquals(Palette.statusWarning, debtColor(12.5))
+    }
+}
diff --git a/android/app/src/test/java/com/noop/ui/SleepImportedFiguresTest.kt b/android/app/src/test/java/com/noop/ui/SleepImportedFiguresTest.kt
index 9986951a7e..148c118f3f 100644
--- a/android/app/src/test/java/com/noop/ui/SleepImportedFiguresTest.kt
+++ b/android/app/src/test/java/com/noop/ui/SleepImportedFiguresTest.kt
@@ -139,10 +139,11 @@ class SleepImportedFiguresTest {
         assertEquals(410.0 / 450.0 * 100.0, m.hoursVsNeeded.latest!!, 1e-9)
         // Debt tile reads ASLEEP too, but against the NORMATIVE need now (#242): only 2 nights < the
         // 7-night minimum, so personalizedNeedHours cold-starts to the 8 h population target = 480, and
-        // debt = max(0, 480 − 410) = 70, never max(0, 480 − 600) = 0.
-        assertEquals(70.0, m.sleepDebt.latest!!, 1e-9)
-        // The debt TILE and the LEDGER agree (both asleep over the full history) — the #5 symptom.
-        assertEquals(m.sleepDebt.latest, -m.sleepDebtLedger.nights.last().deltaMin, 1e-9)
+        // The carried target is 0.55 × (480 + 33 − 410) = 56.65, surfaced at the shared
+        // one-decimal ledger precision as 56.7, never 0 from in-bed time.
+        assertEquals(56.7, m.sleepDebt.latest!!, 1e-9)
+        // The debt TILE and the LEDGER use the same recurrence.
+        assertEquals(56.7, -m.sleepDebtLedger.balanceMin, 1e-9)
     }
 
     /** A passed session must give the SAME tiles/ledger as no session — there is no display-time
@@ -181,15 +182,15 @@ class SleepImportedFiguresTest {
         assertEquals(48.0, napCredit["2026-06-02"]!!, 1e-9)
 
         // Mean main-night sleep is exactly 480 min, so personal need is 480. The latest day is
-        // 392 main + 48 nap = 440 credited: 40 min debt rather than the old 88 min.
+        // 392 main + 48 nap = 440 credited: 22 min carried debt rather than the old 88 min.
         val m = buildSleepModel(
             days = listOf(day("2026-06-01", 568.0), day("2026-06-02", 392.0)),
             session = night,
             napSleepMinByDay = napCredit,
             todayKey = pinnedToday,
         )!!
-        assertEquals(40.0, m.sleepDebt.latest!!, 1e-9)
-        assertEquals(40.0 / 60.0, m.trendDebtHours.last(), 1e-9)
+        assertEquals(22.0, m.sleepDebt.latest!!, 1e-9)
+        assertEquals(22.0 / 60.0, m.trendDebtHours.last(), 1e-9)
         assertEquals(440.0, m.sleepDebtLedger.nights.last().sleptMin, 1e-9)
         assertEquals(-40.0, m.sleepDebtLedger.nights.last().deltaMin, 1e-9)
         assertEquals(392.0 / 480.0 * 100.0, m.hoursVsNeeded.latest!!, 1e-9)
diff --git a/android/app/src/test/java/com/noop/ui/SleepMetricDetailDebtTest.kt b/android/app/src/test/java/com/noop/ui/SleepMetricDetailDebtTest.kt
new file mode 100644
index 0000000000..e3e5138296
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/SleepMetricDetailDebtTest.kt
@@ -0,0 +1,50 @@
+package com.noop.ui
+
+import com.noop.data.DailyMetric
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class SleepMetricDetailDebtTest {
+    private fun day(key: String, asleepMin: Double?) = DailyMetric(
+        deviceId = "my-whoop",
+        day = key,
+        totalSleepMin = asleepMin,
+        deepMin = 80.0,
+        remMin = 90.0,
+        lightMin = 190.0,
+        efficiency = 0.9,
+    )
+
+    @Test
+    fun detailDebtUsesTheSameCarryRecurrenceAsTheCard() {
+        val days = listOf(day("2026-06-01", 360.0), day("2026-06-02", 480.0))
+
+        val card = buildSleepModel(days, session = null, todayKey = "2026-06-03")!!
+        val detail = buildSleepMetricPoints(days, "sleep_debt")
+
+        assertEquals(36.3, card.sleepDebt.latest!!, 1e-9)
+        assertEquals(card.sleepDebt.latest!!, detail.last().second, 1e-9)
+    }
+
+    @Test
+    fun detailDebtPreservesImportedValueAndCreditsNaps() {
+        val days = listOf(day("2026-06-01", 360.0), day("2026-06-02", 400.0))
+        val imported = ImportedSleepSeries(debtMin = mapOf("2026-06-02" to 61.25))
+
+        val importedPoints = buildSleepMetricPoints(days, "sleep_debt", imported = imported)
+        assertEquals(61.25, importedPoints.last().second, 1e-9)
+
+        val card = buildSleepModel(
+            days,
+            session = null,
+            napSleepMinByDay = mapOf("2026-06-02" to 80.0),
+            todayKey = "2026-06-03",
+        )!!
+        val napPoints = buildSleepMetricPoints(
+            days,
+            "sleep_debt",
+            napSleepMinByDay = mapOf("2026-06-02" to 80.0),
+        )
+        assertEquals(card.sleepDebt.latest!!, napPoints.last().second, 1e-9)
+    }
+}
diff --git a/docs/ANALYTICS.md b/docs/ANALYTICS.md
index 81e7d8a821..a755945ea5 100644
--- a/docs/ANALYTICS.md
+++ b/docs/ANALYTICS.md
@@ -236,6 +236,49 @@ Given `(TRIMP, reference_strain)` pairs, fits `D` via a through-origin least-squ
 
 ---
 
+## `SleepDebt` — actionable next-night sleep target
+
+The displayed debt is a planning estimate, not an hour-for-hour bank of every
+minute missed over the last fortnight. For each usable night, NOOP carries 55%
+of the complete unmet need into the following night's target:
+
+```text
+currentNeed = personalizedBaseNeed + currentDebt
+nextDebt    = 0.55 × max(0, currentNeed − creditedSleep)
+```
+
+`creditedSleep` is the main night's asleep time plus separately recorded nap
+sleep. A calculated debt below 10 minutes is treated as balanced; exactly 10
+minutes remains debt. Meeting the complete current need clears the displayed
+debt, and extra sleep never creates a positive bank. The chart bars remain the
+raw nightly difference from base need so the underlying nights stay visible.
+
+The coefficient is an interoperability approximation, not a physiological
+constant. It was selected against one contributor's 853 consecutive exported
+WHOOP nights: the 0.55 recurrence was within 15 minutes of WHOOP's following-day
+debt on 93.0% of pairs and within 20 minutes on 94.5%. That contributor also used
+WHOOP's sleep-debt target for daily sleep planning for approximately 800 days.
+This is useful longitudinal field evidence, but it is single-user validation,
+not a population study or clinical claim.
+
+A bounded, recency-weighted planning estimate is also more honest than treating
+sleep loss as interchangeable hours. Controlled restriction studies find that
+sleep physiology, subjective sleepiness, and cognitive performance accumulate
+and recover on different timescales; recovery depends on sleep dose and intensity,
+and some performance effects can remain after extended recovery sleep:
+
+- Van Dongen et al. (2003), chronic restriction dose-response:
+  <https://pubmed.ncbi.nlm.nih.gov/12683469/>
+- Banks et al. (2010), recovery-sleep dose response:
+  <https://pmc.ncbi.nlm.nih.gov/articles/PMC2910531/>
+- Doty et al. (2020), differential recovery across neurobehavioral measures:
+  <https://pubmed.ncbi.nlm.nih.gov/33274389/>
+
+The estimate therefore answers the narrow product question “how much should I
+add to tonight's base sleep target?”, not “have all physiological and cognitive
+effects of prior sleep restriction disappeared?”. Swift and Kotlin implement the
+same constants, recurrence, deadband, nap credit, and 14-usable-night bound.
+
 ## `SleepStager` — sleep/wake detection + approximate 4-class staging (feeds **Rest**)
 
 Source: `SleepStager.swift`. Detects in-bed sessions from gravity/HR/RR/respiration and produces a 30-second hypnogram of `{wake, light, deep, rem}`. These stages and the AASM roll-up below are the raw material the **Rest** score composite consumes (see *The Rest score composite* immediately after this section).
diff --git a/docs/FEATURES.md b/docs/FEATURES.md
index 8a0c0768ec..1cdf92489b 100644
--- a/docs/FEATURES.md
+++ b/docs/FEATURES.md
@@ -267,7 +267,9 @@ just the most recent (step through earlier nights to compare):
   each as "Xh Ym · NN%", with time-in-bed, efficiency, and onset–wake times.
 - **Night detail** — a uniform tile grid, each with a sparkline and a "vs typical" caption: Sleep
   Performance, Efficiency, Consistency, Hours vs Needed, Restorative (deep + REM share),
-  Respiratory, and Sleep Debt (vs your personal sleep need, floored at 7.5 h).
+  Respiratory, and Sleep Debt. Debt is 55% of the current unmet personalized need, carried into the
+  next night's target; values below 10 minutes read as balanced instead of stacking into an
+  unrepayable 14-night hours bank.
 - **Stages vs typical** — Deep / REM / Light as horizontal bars, last-night minutes with a marker
   at your personal mean, so highs and lows pop.
 - **Asleep duration** — a trailing-30-night hours trend with avg / min / max.

From c6dcef4efdb508ba6cdbaa148c3758ddbe530b47 Mon Sep 17 00:00:00 2001
From: Zebsi <66969936+Zebsi235@users.noreply.github.com>
Date: Mon, 31 Aug 2026 02:35:20 +0200
Subject: [PATCH 101/333] sync: skip the #689 backlog decode on the
 GET_DATA_RANGE PENDING ack (#1746)

GET_DATA_RANGE answers twice - a short PENDING(2) acknowledgement, then the payload
with SUCCESS(1) - and the #689 backlog decode ran on both. The ack carries no ring
pointers by construction, so it decoded to null and logged "offsets may have moved"
once per sync on healthy hardware, pointing every reader at an alignment bug that
was not there.

The tree already knew: Framing's own result-code table records "2=PENDING precedes
SUCCESS on GET_DATA_RANGE (hardware-confirmed, #78 fork)". The decode site simply
had no way to act on it, because a too-short frame and a misaligned one look the
same to pagesBehind.

A pure isPendingResponse(frame, cmdOff) on both platforms reads the result byte at
cmdOff+2 and gates the decode at the two call sites. The SUCCESS frame that will
not parse still logs exactly as loudly as before - that is the case #818's comment
protects, and it is untouched. The #451 raw dump stays unconditional above it.

Verified against the captured bytes rather than the description. On the PENDING
frame, index 10 is 0x22 (34, GET_DATA_RANGE), 11 is the origin sequence, 12 is 0x02
- the cmdOff+2 claim is exact. That fixture is a whole frame: declLen 12, +8, and
it is 20 bytes. The SUCCESS fixture is trimmed from its declared 84 bytes to 40,
which is deliberate rather than damaged: pagesBehind reads to index 37, so the trim
keeps precisely what the decoder needs, and decoding it by hand gives w=48833,
u=48820, t=131072 -> 13, matching the log excerpt in the PR.

The two predicates are exact twins, including the detail that Kotlin masks the
signed Byte where Swift's UInt8 does not need it. Five new cases per platform,
one-to-one.

Merged onto a main that had moved a long way under it - WhoopBleClient.kt was
rewritten substantially by #1744, #1748 and #1749 after this branch was cut - so it
was merged locally and run rather than trusted: 4,926 tests, 0 failures,
DataRangeScanTest 17/17, doc lint and i18n clean, all fifteen CI checks green.

One thing left on the table for later, since the fixture already supports it:
nothing asserts pagesBehind == 13 on that SUCCESS frame. The pair currently pins
only that the two are distinguishable; asserting the value would pin that the pair
behaves exactly as the log shows, for free, on both platforms.

The PR body was edited before merge to remove a closing verb adjacent to an issue
number. It was a denial - the contributor was explicitly saying the issue should
stay open - but GitHub matches those keywords literally and does not read
negations, so it would have been actioned on merge. Harmless this time only
because that issue was already closed.

Thanks @Zebsi235 - real captured frames rather than synthetic ones, the failing
stub run to prove the tests actually catch the regression, and the Swift gap stated
up front rather than left to be found.
---
 .../Sources/WhoopProtocol/DataRange.swift     | 15 +++++++
 .../WhoopProtocolTests/DataRangeTests.swift   | 35 ++++++++++++++++
 Strand/BLE/BLEManager.swift                   | 18 ++++++---
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 25 ++++++++----
 .../main/java/com/noop/protocol/DataRange.kt  | 17 ++++++++
 .../java/com/noop/ble/DataRangeScanTest.kt    | 40 +++++++++++++++++++
 6 files changed, 137 insertions(+), 13 deletions(-)

diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/DataRange.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/DataRange.swift
index 78c1ec358e..ca2ee57e94 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/DataRange.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/DataRange.swift
@@ -87,4 +87,19 @@ public enum DataRange {
         guard behind >= 0, behind <= t else { return nil }
         return behind
     }
+
+    /// True when a GET_DATA_RANGE COMMAND_RESPONSE is the `PENDING(2)` acknowledgement rather than the
+    /// answer. The strap replies twice: a short PENDING ack, then the payload with `SUCCESS(1)`. Framing's
+    /// own result-code table already states it — "2=PENDING precedes SUCCESS on GET_DATA_RANGE
+    /// (hardware-confirmed, #78 fork)" — but `pagesBehind` had no way to tell the two apart, so the ack
+    /// (which carries no ring pointers by construction) decoded to nil and logged as a decode FAILURE once
+    /// per sync.
+    ///
+    /// The result byte sits at `cmdOff + 2`, after the echoed opcode and the origin sequence. A frame too
+    /// short to hold one is not a PENDING ack, so it stays false and the caller keeps its existing
+    /// too-short handling.
+    public static func isPendingResponse(_ frame: [UInt8], cmdOff: Int) -> Bool {
+        guard cmdOff >= 0, cmdOff + 2 < frame.count else { return false }
+        return frame[cmdOff + 2] == 2
+    }
 }
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/DataRangeTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/DataRangeTests.swift
index 18a7058c38..c70ce4d53f 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/DataRangeTests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/DataRangeTests.swift
@@ -126,4 +126,39 @@ final class DataRangeTests: XCTestCase {
                            "pagesBehind for \(h) at cmdOff \(cmdOff) should be \(expected)")
         }
     }
+
+    // MARK: - #689 PENDING ack. Byte-parity twin of the Kotlin DataRangeScanTest cases.
+    //
+    // GET_DATA_RANGE answers twice and only the second carries the ring pointers. Both frames below are
+    // real, captured on a WHOOP MG (WS50_r00, fw 50.39.1.0) on 2026-08-28, and they are one request's
+    // two replies.
+
+    /// The PENDING(2) ack: 20 bytes, result byte at cmdOff+2 is 0x02, no ring pointers in it at all.
+    func testIsPendingResponse_trueForPendingAck() {
+        XCTAssertTrue(DataRange.isPendingResponse(hex("aa010c000100271124e8220402000000c391bc3d"), cmdOff: 10))
+    }
+
+    /// The SUCCESS(1) answer to that same request. Must NOT be skipped.
+    func testIsPendingResponse_falseForSuccessAnswer() {
+        let h = "aa014c00010032d124e92204010100bf0000b4be0000c1be0000b4be00000c000000000002008f00"
+        XCTAssertFalse(DataRange.isPendingResponse(hex(h), cmdOff: 10))
+    }
+
+    /// The reason this pair matters: the ack decodes to nil, so before the guard it logged as a decode
+    /// failure once per sync while the real answer decoded fine two lines later.
+    func testPendingAckIsExactlyTheFramePagesBehindCannotDecode() {
+        let pending = hex("aa010c000100271124e8220402000000c391bc3d")
+        XCTAssertNil(DataRange.pagesBehind(from: pending, cmdOff: 10))
+        XCTAssertTrue(DataRange.isPendingResponse(pending, cmdOff: 10))
+    }
+
+    /// A frame too short to hold a result byte is not a PENDING ack; the caller keeps its own handling.
+    func testIsPendingResponse_falseWhenTooShortForResultByte() {
+        XCTAssertFalse(DataRange.isPendingResponse([UInt8](repeating: 0, count: 11), cmdOff: 10))
+    }
+
+    /// A negative cmdOff is rejected rather than indexing backwards.
+    func testIsPendingResponse_falseForNegativeCmdOff() {
+        XCTAssertFalse(DataRange.isPendingResponse([UInt8](repeating: 0, count: 40), cmdOff: -1))
+    }
 }
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index 2e3adb5a9d..5064503dee 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -6236,11 +6236,19 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
         // log was indistinguishable from one where the strap never answered, which is why a broken decode
         // survived unnoticed. The raw-frame dump above is unconditional for the same reason. If a firmware
         // revision ever shifts these fields again, the rejection must be visible rather than silent.
-        if let pages = DataRange.pagesBehind(from: frame, cmdOff: cmdOff) {
-            log("Strap backlog pages behind: \(pages) (#689 — GET_DATA_RANGE ring backlog, diagnostic only)")
-        } else {
-            log("Strap backlog pages behind: not decodable from this frame (#689 — offsets may have moved; "
-                + "the raw frame above is the input). Diagnostic only, sync is unaffected.")
+        // ...but NOT on the PENDING(2) ack. GET_DATA_RANGE answers twice — a short ack, then the payload —
+        // which Framing's result-code table already records ("2=PENDING precedes SUCCESS on
+        // GET_DATA_RANGE"). The ack carries no ring pointers at all, so decoding it failed every time and
+        // reported a decode problem that did not exist: one "offsets may have moved" per sync, on healthy
+        // hardware, pointing the reader at an alignment bug rather than at the ack. Skip it here; the
+        // SUCCESS frame still logs its failure loudly, which is the case the paragraph above protects.
+        if !DataRange.isPendingResponse(frame, cmdOff: cmdOff) {
+            if let pages = DataRange.pagesBehind(from: frame, cmdOff: cmdOff) {
+                log("Strap backlog pages behind: \(pages) (#689 — GET_DATA_RANGE ring backlog, diagnostic only)")
+            } else {
+                log("Strap backlog pages behind: not decodable from this frame (#689 — offsets may have moved; "
+                    + "the raw frame above is the input). Diagnostic only, sync is unaffected.")
+            }
         }
         if let newest = BLEManager.dataRangeNewestUnix(from: frame) {
             // #695: the sync-affecting side-effects (strapNewestTs, backfill window, LiveState range) only
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 8f2f86d1c0..f56b7850f8 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -6688,14 +6688,23 @@ class WhoopBleClient(
                         // logged NOTHING — a strap log was indistinguishable from one where the strap never
                         // answered, which is why a broken decode survived unnoticed. The raw-frame dump above
                         // is unconditional for the same reason. Twin of the Swift branch.
-                        val pagesBehind = com.noop.protocol.DataRange.pagesBehind(frame, cmdOff)
-                        if (pagesBehind != null) {
-                            log("Strap backlog pages behind: $pagesBehind (#689 — GET_DATA_RANGE ring backlog, diagnostic only)")
-                        } else {
-                            log(
-                                "Strap backlog pages behind: not decodable from this frame (#689 — offsets may " +
-                                    "have moved; the raw frame above is the input). Diagnostic only, sync is unaffected.",
-                            )
+                        // ...but NOT on the PENDING(2) ack. GET_DATA_RANGE answers twice — a short ack, then
+                        // the payload — which Framing's result-code table already records ("2=PENDING
+                        // precedes SUCCESS on GET_DATA_RANGE"). The ack carries no ring pointers at all, so
+                        // decoding it failed every time and reported a decode problem that did not exist:
+                        // one "offsets may have moved" per sync on healthy hardware, pointing the reader at
+                        // an alignment bug rather than at the ack. Skip it here; a SUCCESS frame that will
+                        // not decode still logs loudly, which is the case the paragraph above protects.
+                        if (!com.noop.protocol.DataRange.isPendingResponse(frame, cmdOff)) {
+                            val pagesBehind = com.noop.protocol.DataRange.pagesBehind(frame, cmdOff)
+                            if (pagesBehind != null) {
+                                log("Strap backlog pages behind: $pagesBehind (#689 — GET_DATA_RANGE ring backlog, diagnostic only)")
+                            } else {
+                                log(
+                                    "Strap backlog pages behind: not decodable from this frame (#689 — offsets may " +
+                                        "have moved; the raw frame above is the input). Diagnostic only, sync is unaffected.",
+                                )
+                            }
                         }
                         dataRangeNewestUnix(frame)?.let {
                             strapNewestTs = it
diff --git a/android/app/src/main/java/com/noop/protocol/DataRange.kt b/android/app/src/main/java/com/noop/protocol/DataRange.kt
index cefd9ccf3e..a322926531 100644
--- a/android/app/src/main/java/com/noop/protocol/DataRange.kt
+++ b/android/app/src/main/java/com/noop/protocol/DataRange.kt
@@ -97,4 +97,21 @@ object DataRange {
         if (behind < 0L || behind > t) return null
         return behind
     }
+
+    /**
+     * True when a GET_DATA_RANGE COMMAND_RESPONSE is the `PENDING(2)` acknowledgement rather than the
+     * answer. The strap replies twice: a short PENDING ack, then the payload with `SUCCESS(1)`. Framing's
+     * own result-code table already states it — "2=PENDING precedes SUCCESS on GET_DATA_RANGE
+     * (hardware-confirmed, #78 fork)" — but [pagesBehind] had no way to tell the two apart, so the ack
+     * (which carries no ring pointers by construction) decoded to null and logged as a decode FAILURE once
+     * per sync.
+     *
+     * The result byte sits at `cmdOff + 2`, after the echoed opcode and the origin sequence. A frame too
+     * short to hold one is not a PENDING ack, so it stays false and the caller keeps its existing
+     * too-short handling. Twin of the Swift `DataRange.isPendingResponse`.
+     */
+    fun isPendingResponse(frame: ByteArray, cmdOff: Int): Boolean {
+        if (cmdOff < 0 || cmdOff + 2 >= frame.size) return false
+        return (frame[cmdOff + 2].toInt() and 0xFF) == 2
+    }
 }
diff --git a/android/app/src/test/java/com/noop/ble/DataRangeScanTest.kt b/android/app/src/test/java/com/noop/ble/DataRangeScanTest.kt
index 674ac299ec..3f26a4224e 100644
--- a/android/app/src/test/java/com/noop/ble/DataRangeScanTest.kt
+++ b/android/app/src/test/java/com/noop/ble/DataRangeScanTest.kt
@@ -2,7 +2,9 @@ package com.noop.ble
 
 import com.noop.protocol.DataRange
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
 import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
 import org.junit.Test
 
 /**
@@ -156,4 +158,42 @@ class DataRangeScanTest {
             )
         }
     }
+
+    // #689 PENDING ack: GET_DATA_RANGE answers twice and only the second carries the ring pointers.
+    // Byte-parity twin of the Swift DataRangeTests cases. Both frames are real, captured on a WHOOP MG
+    // (WS50_r00, fw 50.39.1.0) on 2026-08-28; the pair below is one request's two replies.
+
+    /** The PENDING(2) ack: 20 bytes, result byte at cmdOff+2 is 0x02, no ring pointers in it at all. */
+    @Test fun `isPendingResponse true for the PENDING ack`() =
+        assertTrue(DataRange.isPendingResponse(hex("aa010c000100271124e8220402000000c391bc3d"), 10))
+
+    /** The SUCCESS(1) answer to that same request. Must NOT be skipped. */
+    @Test fun `isPendingResponse false for the SUCCESS answer`() =
+        assertFalse(
+            DataRange.isPendingResponse(
+                hex(
+                    "aa014c00010032d124e92204010100bf0000b4be0000c1be0000b4be00000c00000000" +
+                        "0002008f00",
+                ),
+                10,
+            ),
+        )
+
+    /**
+     * The reason this pair matters: the ack decodes to null, so before the guard it logged as a decode
+     * failure once per sync while the real answer decoded fine two lines later.
+     */
+    @Test fun `the PENDING ack is exactly the frame pagesBehind cannot decode`() {
+        val pending = hex("aa010c000100271124e8220402000000c391bc3d")
+        assertNull(DataRange.pagesBehind(pending, 10))
+        assertTrue(DataRange.isPendingResponse(pending, 10))
+    }
+
+    /** A frame too short to hold a result byte is not a PENDING ack; the caller keeps its own handling. */
+    @Test fun `isPendingResponse false when too short for a result byte`() =
+        assertFalse(DataRange.isPendingResponse(ByteArray(11), 10))
+
+    /** A negative cmdOff is rejected rather than indexing backwards. */
+    @Test fun `isPendingResponse false for a negative cmdOff`() =
+        assertFalse(DataRange.isPendingResponse(ByteArray(40), -1))
 }

From 6bd877a06e4dc241bb193195b663e56a83451ec2 Mon Sep 17 00:00:00 2001
From: Zebsi <66969936+Zebsi235@users.noreply.github.com>
Date: Mon, 31 Aug 2026 02:56:21 +0200
Subject: [PATCH 102/333] tooling: i18n_audit keys its baselines on OS-native
 paths, so it fails on a clean tree on Windows (#1747)

Every baseline in Tools/ stores forward slashes, and six sites keyed their lookups
on str(path.relative_to(ROOT)) - OS-native, so on Windows every lookup missed. On a
clean checkout that reported 236 + 63 NEW literals and eleven failing locale
allowances, while the same run printed STALE for the very entries it was failing
against. Two messages pointing opposite ways, and the natural conclusion - the
baselines are stale, regenerate them - would have wiped the ratchet. CI runs on
ubuntu, so only a contributor running the repo's own gate locally on Windows ever
saw it, and then went hunting 299 regressions they did not cause.

Verified rather than taken on description. The baseline really is forward-slashed
(sampled: android/app/src/main/java/com/noop/ui/AppRoot.kt). The change really is a
no-op on POSIX: the audit run on main and on this branch in place produces
byte-identical output, exit 0 both, and the tool's own suite passes.

The six converted sites are exactly the behaviour-affecting ones. All thirteen
relative_to(ROOT) sites were classified: the six changed build lookup or dict keys,
and the seven untouched are pure print() - including 1227's `line`, which only feeds
the human-readable summary. A principled split, not a partial job. Those seven will
still render backslashes on Windows, which is cosmetic and worth folding in later.

Worth doing next, and it is the more valuable half: this is the SECOND tool with
this exact bug (doc_comment_lint was #1691), and the fix is six inlined as_posix()
calls. Six sites is six chances for a seventh to be added wrong, which is how it
happened twice. A one-line helper - rel(p) returning p.relative_to(ROOT).as_posix()
- collapses them to one, makes the rule impossible for the next reader to miss, and
makes it TESTABLE, which it is not today because the conversion is inlined at every
call site. Neither this PR nor #1691 carries a regression test, and there is
currently nothing to assert against.

Merged as-is because the fix is correct and a Windows contributor is blocked by it
today; the helper is a follow-up rather than a condition.

Thanks @Zebsi235 - the before/after on a clean tree, and stating plainly that Linux
and macOS were reasoned about rather than run, are both exactly right.
---
 Tools/i18n_audit.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/Tools/i18n_audit.py b/Tools/i18n_audit.py
index 85a2fe94e9..1efce7e058 100644
--- a/Tools/i18n_audit.py
+++ b/Tools/i18n_audit.py
@@ -435,7 +435,7 @@ def record(span_start: int, span_end: int) -> None:
                         continue
                     seen.add(offset)
                     line_no = text.count("\n", 0, offset) + 1
-                    findings.append((str(path.relative_to(ROOT)), line_no, literal))
+                    findings.append((path.relative_to(ROOT).as_posix(), line_no, literal))
 
             # The call's own first (content) argument only — catches
             # `Text(if (x) "a" else "b")` — never the whole call span, which
@@ -856,7 +856,7 @@ def scan_ios() -> tuple[list[tuple[str, int, str]], dict[str, list[str]]]:
                         continue
                     entry = swift_catalog_lookup(cat, literal)
                     line_no = text.count("\n", 0, offset) + 1
-                    rel = str(path.relative_to(ROOT))
+                    rel = path.relative_to(ROOT).as_posix()
                     if entry is None:
                         hardcoded.append((rel, line_no, literal))
                         continue
@@ -864,7 +864,7 @@ def scan_ios() -> tuple[list[tuple[str, int, str]], dict[str, list[str]]]:
                         continue
                     for lang in LANGS:
                         if not _is_translated(entry, lang):
-                            lang_gaps[lang].append(f"{catalog_path.relative_to(ROOT)} :: {literal!r}")
+                            lang_gaps[lang].append(f"{catalog_path.relative_to(ROOT).as_posix()} :: {literal!r}")
     for lang in lang_gaps:
         lang_gaps[lang] = sorted(set(lang_gaps[lang]))
     return hardcoded, lang_gaps
@@ -948,7 +948,7 @@ def _ios_echoed_counts() -> dict[str, int]:
             cat = json.loads(catalog_path.read_text(encoding="utf-8"))
         except (OSError, json.JSONDecodeError):
             continue
-        rel = str(catalog_path.relative_to(ROOT))
+        rel = catalog_path.relative_to(ROOT).as_posix()
         for key, entry in (cat.get("strings") or {}).items():
             if not _has_translatable_words(key):
                 continue
@@ -984,7 +984,7 @@ def _android_echoed_counts() -> dict[str, int]:
             loc = {n.attrib["name"]: (n.text or "") for n in ET.parse(path).getroot().findall("string")}
         except ET.ParseError:
             continue
-        rel = str(path.relative_to(ROOT))
+        rel = path.relative_to(ROOT).as_posix()
         n = sum(1 for k, base_val in translatable.items() if loc.get(k) == base_val)
         if n:
             counts[f"{rel} {lang}"] = n
@@ -1126,7 +1126,7 @@ def ci_check(base_ref: str) -> int:
         # and gate them below. Reloading each catalog for a second pass wasted a full re-parse of a
         # 3255-string file.
         for extra in sorted(shipped_apple_langs(cat) - set(LANGS)):
-            extra_apple_gaps[f"{catalog_path.relative_to(ROOT)}:{extra}"] = sum(
+            extra_apple_gaps[f"{catalog_path.relative_to(ROOT).as_posix()}:{extra}"] = sum(
                 1 for v in cat.get("strings", {}).values()
                 if v.get("shouldTranslate") is not False and not _is_translated(v, extra)
             )

From 4e75d459e7c9d0da742b9d928e3acdb9e42ffcf0 Mon Sep 17 00:00:00 2001
From: Kevin Rajan <7121943+kvnloo@users.noreply.github.com>
Date: Sun, 30 Aug 2026 20:04:29 -0500
Subject: [PATCH 103/333] Add a JSON query CLI for local read tools (#1752)

Adds `noop-local-access query <tool> [--flags]` for the five existing local read
tools, and routes MCP and the CLI through one read-only dispatcher so the two can
no longer drift.

The refactor is faithful. The 55 lines leaving MCPServer move verbatim into
NoopToolDispatcher - the switch bodies were diffed statement by statement. The one
behavioural change is the resource path, which used to call
`data().healthSnapshot(days: 14)` directly and now goes through
`dispatch(name:arguments:)`; that routes 14 through
`boundedDays(.int(14), default: 14, max: 120)` = min(max(14,1),120) = 14. Inert.

Run rather than reasoned about. The contributor could not execute Swift locally and
said so plainly, so this was built and exercised here with the Linux
snapshot-SQLite setup from docs/BUILD.md - 14 tests pass, matching the reported CI,
and then the binary itself:

  query bogus_tool                 -> exit 64, "unknown query tool"
  query metric_series              -> exit 64, "metric_series requires --key"
  query health_snapshot --nope 5   -> exit 64, "unknown query flag"
  query data_freshness --days 5    -> exit 64, "--days is not supported for data_freshness"
  query ... --db-path /tmp/SECRET-PATH-abc/whoop.sqlite
                                   -> exit 1,  "NOOP database is unavailable"

That last one is the one that mattered: LocalAccessError.databaseUnavailable carries
the path inside its message, and main.swift replaces it with a constant, so the path
does not reach stderr. Usage errors do not echo unvalidated input either, and stdout
stays empty on every error path, so a caller piping JSON never receives a malformed
value. `codex-config` and `mcp` both still work after the refactor - tools/list
returns a valid JSON-RPC result.

The parser is properly allow-listed: tool names, flags, per-tool flag validity,
duplicate detection, no trailing positionals, required-value checks. `--days -5`
clamps to 1 rather than doing anything surprising. And the strongest test is the
right one - testAllFiveQueriesDispatchThroughTheSamePayloadAsMCP asserts CLI output
equals MCP output for all five tools, which is exactly the guard this refactor needs.

Two things noted rather than changed. Sanitisation is now asymmetric: the CLI hides
databaseUnavailable while MCP still returns it, path and all, in the JSON-RPC error -
pre-existing and untouched here, but the gap widened. And requiredValue rejects any
value beginning with `--`, so a db path starting with dashes is unreachable;
vanishingly unlikely, worth knowing.

The PR body was edited before merge to remove a closing keyword next to an issue
number, so #1751 stays open for a deliberate decision rather than being actioned by
the merge.

Thanks @kvnloo - one dispatcher instead of two switch statements is the right shape,
and stating that local Swift execution was not performed, rather than implying it,
is exactly the disclosure that makes a review efficient.
---
 Packages/NoopLocalAccess/README.md            |  30 +++++
 .../NoopLocalAccessCore/CLIQuery.swift        | 118 ++++++++++++++++
 .../NoopLocalAccessCore/MCPServer.swift       |  59 +-------
 .../NoopLocalAccessCore/ToolDispatcher.swift  |  74 ++++++++++
 .../Sources/noop-local-access/main.swift      |  40 ++++++
 .../CLIQueryTests.swift                       | 126 ++++++++++++++++++
 6 files changed, 392 insertions(+), 55 deletions(-)
 create mode 100644 Packages/NoopLocalAccess/README.md
 create mode 100644 Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/CLIQuery.swift
 create mode 100644 Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/ToolDispatcher.swift
 create mode 100644 Packages/NoopLocalAccess/Tests/NoopLocalAccessCoreTests/CLIQueryTests.swift

diff --git a/Packages/NoopLocalAccess/README.md b/Packages/NoopLocalAccess/README.md
new file mode 100644
index 0000000000..82fef2efc7
--- /dev/null
+++ b/Packages/NoopLocalAccess/README.md
@@ -0,0 +1,30 @@
+# NoopLocalAccess
+
+`noop-local-access` exposes bounded, read-only NOOP health data locally. It has no network or
+write/control path.
+
+Use MCP over stdio with `noop-local-access mcp`, or query one tool directly as JSON:
+
+```sh
+noop-local-access query health_snapshot --days 14
+noop-local-access query metric_series --key hrv --days 90
+noop-local-access query data_freshness
+noop-local-access query sleep_summary --days 30
+noop-local-access query workout_summary --days 90
+```
+
+Set `NOOP_DB_PATH` to select a database, or pass `--db-path PATH`. Query results are written to
+stdout; diagnostics are written to stderr. Query usage errors exit 64 and runtime/database errors
+exit 1.
+
+Arguments reuse the MCP defaults and bounds:
+
+- `health_snapshot`: optional `--days` (default 14, clamped to 1...120).
+- `metric_series`: required `--key`; optional `--source` (default `my-whoop`), `--days` (default 90,
+  clamped to 1...4000), `--from-day`, `--to-day`, and `--limit` (default 500, clamped to 1...2000).
+- `data_freshness`: no tool arguments.
+- `sleep_summary`: optional `--days` (default 30, clamped to 1...4000).
+- `workout_summary`: optional `--days` (default 90, clamped to 1...4000).
+
+Dates use the existing `YYYY-MM-DD` tool contract. The CLI does not add a separate validation or
+interpretation layer; it passes accepted arguments to the same bounded read-only dispatcher as MCP.
diff --git a/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/CLIQuery.swift b/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/CLIQuery.swift
new file mode 100644
index 0000000000..36ac3d69a5
--- /dev/null
+++ b/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/CLIQuery.swift
@@ -0,0 +1,118 @@
+import Foundation
+
+public struct NoopCLIQueryRequest: Equatable, Sendable {
+    public let toolName: String
+    public let arguments: [String: JSONValue]
+    public let configuration: LocalAccessConfiguration
+
+    public init(
+        toolName: String,
+        arguments: [String: JSONValue],
+        configuration: LocalAccessConfiguration = .environment()
+    ) {
+        self.toolName = toolName
+        self.arguments = arguments
+        self.configuration = configuration
+    }
+}
+
+public enum NoopCLIQueryError: Error, CustomStringConvertible, Equatable {
+    case usage(String)
+
+    public var description: String {
+        switch self {
+        case .usage(let message): return message
+        }
+    }
+
+    public var exitCode: Int32 { 64 }
+}
+
+public enum NoopCLIQuery {
+    public static func parse(arguments: [String]) throws -> NoopCLIQueryRequest {
+        guard let toolName = arguments.first, !toolName.hasPrefix("-") else {
+            throw NoopCLIQueryError.usage("query requires one tool name")
+        }
+        guard NoopToolDispatcher.toolNames.contains(toolName) else {
+            throw NoopCLIQueryError.usage("unknown query tool")
+        }
+
+        var toolArguments: [String: JSONValue] = [:]
+        var configuration = LocalAccessConfiguration.environment()
+        var seenFlags = Set<String>()
+        var index = 1
+
+        while index < arguments.count {
+            let flag = arguments[index]
+            guard flag.hasPrefix("--") else {
+                throw NoopCLIQueryError.usage("query does not accept additional positional arguments")
+            }
+            guard seenFlags.insert(flag).inserted else {
+                throw NoopCLIQueryError.usage("duplicate query flag: \(flag)")
+            }
+            index += 1
+
+            switch flag {
+            case "--db-path":
+                configuration.databasePath = try requiredValue(flag, arguments: arguments, index: &index)
+            case "--days":
+                guard toolName != "data_freshness" else { throw unsupported(flag, toolName: toolName) }
+                toolArguments["days"] = try integerValue(flag, arguments: arguments, index: &index)
+            case "--key":
+                guard toolName == "metric_series" else { throw unsupported(flag, toolName: toolName) }
+                toolArguments["key"] = .string(try requiredValue(flag, arguments: arguments, index: &index))
+            case "--source":
+                guard toolName == "metric_series" else { throw unsupported(flag, toolName: toolName) }
+                toolArguments["source"] = .string(try requiredValue(flag, arguments: arguments, index: &index))
+            case "--from-day":
+                guard toolName == "metric_series" else { throw unsupported(flag, toolName: toolName) }
+                toolArguments["from_day"] = .string(try requiredValue(flag, arguments: arguments, index: &index))
+            case "--to-day":
+                guard toolName == "metric_series" else { throw unsupported(flag, toolName: toolName) }
+                toolArguments["to_day"] = .string(try requiredValue(flag, arguments: arguments, index: &index))
+            case "--limit":
+                guard toolName == "metric_series" else { throw unsupported(flag, toolName: toolName) }
+                toolArguments["limit"] = try integerValue(flag, arguments: arguments, index: &index)
+            default:
+                throw NoopCLIQueryError.usage("unknown query flag")
+            }
+        }
+
+        if toolName == "metric_series", toolArguments["key"] == nil {
+            throw NoopCLIQueryError.usage("metric_series requires --key")
+        }
+
+        return NoopCLIQueryRequest(toolName: toolName, arguments: toolArguments, configuration: configuration)
+    }
+
+    public static func dispatch(_ request: NoopCLIQueryRequest) throws -> JSONValue {
+        try NoopToolDispatcher(configuration: request.configuration)
+            .dispatch(name: request.toolName, arguments: request.arguments)
+    }
+
+    public static func encodeLine(_ value: JSONValue) throws -> Data {
+        var data = try JSONEncoder().encode(value)
+        data.append(0x0A)
+        return data
+    }
+
+    private static func requiredValue(_ flag: String, arguments: [String], index: inout Int) throws -> String {
+        guard index < arguments.count, !arguments[index].hasPrefix("--") else {
+            throw NoopCLIQueryError.usage("missing value for \(flag)")
+        }
+        defer { index += 1 }
+        return arguments[index]
+    }
+
+    private static func integerValue(_ flag: String, arguments: [String], index: inout Int) throws -> JSONValue {
+        let raw = try requiredValue(flag, arguments: arguments, index: &index)
+        guard let value = Int(raw) else {
+            throw NoopCLIQueryError.usage("value for \(flag) must be an integer")
+        }
+        return .int(value)
+    }
+
+    private static func unsupported(_ flag: String, toolName: String) -> NoopCLIQueryError {
+        .usage("\(flag) is not supported for \(toolName)")
+    }
+}
diff --git a/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/MCPServer.swift b/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/MCPServer.swift
index a5d34a5557..8509f0cd21 100644
--- a/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/MCPServer.swift
+++ b/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/MCPServer.swift
@@ -17,11 +17,10 @@ public struct RPCRequest: Decodable, Equatable {
 }
 
 public final class NoopMCPServer {
-    private let configuration: LocalAccessConfiguration
-    private var dataAccess: NoopDataAccess?
+    private let dispatcher: NoopToolDispatcher
 
     public init(configuration: LocalAccessConfiguration = .environment()) {
-        self.configuration = configuration
+        dispatcher = NoopToolDispatcher(configuration: configuration)
     }
 
     public func handleLine(_ line: String) -> JSONValue {
@@ -113,19 +112,6 @@ public final class NoopMCPServer {
     NOOP local access is read-only and returns personal health context from the user's on-device SQLite store. Use bounded tools, check data_freshness before stale-data claims, separate facts from inference, and do not diagnose medical conditions. No tool writes data or calls a network service.
     """
 
-    private func data() throws -> NoopDataAccess {
-        if let dataAccess { return dataAccess }
-        do {
-            let access = try NoopDataAccess.open(configuration: configuration)
-            dataAccess = access
-            return access
-        } catch let error as LocalAccessError {
-            throw error
-        } catch {
-            throw LocalAccessError.databaseUnavailable("NOOP database is not available: \(error)")
-        }
-    }
-
     private func callTool(params: JSONValue?) throws -> JSONValue {
         guard let object = params?.objectValue,
               let name = object["name"]?.stringValue
@@ -133,51 +119,14 @@ public final class NoopMCPServer {
             throw LocalAccessError.invalidParams("tools/call requires a tool name")
         }
         let arguments = object["arguments"]?.objectValue ?? [:]
-        let payload: JSONValue
-        switch name {
-        case "health_snapshot":
-            payload = try data().healthSnapshot(days: boundedDays(arguments["days"], default: 14, max: 120))
-        case "metric_series":
-            guard let key = arguments["key"]?.stringValue else {
-                throw LocalAccessError.invalidParams("metric_series requires key")
-            }
-            payload = try data().metricSeries(
-                key: key,
-                source: arguments["source"]?.stringValue ?? "my-whoop",
-                days: boundedDays(arguments["days"], default: 90, max: 4000),
-                fromDay: arguments["from_day"]?.stringValue,
-                toDay: arguments["to_day"]?.stringValue,
-                limit: boundedLimit(arguments["limit"], default: 500, max: 2000)
-            )
-        case "data_freshness":
-            payload = try data().freshness()
-        case "sleep_summary":
-            payload = try data().sleepSummary(days: boundedDays(arguments["days"], default: 30, max: 4000))
-        case "workout_summary":
-            payload = try data().workoutSummary(days: boundedDays(arguments["days"], default: 90, max: 4000))
-        default:
-            throw LocalAccessError.toolNotFound(name)
-        }
-        return toolResult(payload)
+        return toolResult(try dispatcher.dispatch(name: name, arguments: arguments))
     }
 
     private func readResource(params: JSONValue?) throws -> JSONValue {
         guard let uri = params?.objectValue?["uri"]?.stringValue else {
             throw LocalAccessError.invalidParams("resources/read requires uri")
         }
-        let payload: JSONValue
-        switch uri {
-        case "noop://health/snapshot":
-            payload = try data().healthSnapshot(days: 14)
-        case "noop://data/freshness":
-            payload = try data().freshness()
-        case "noop://metrics/catalog":
-            payload = NoopDataAccess.metricCatalog()
-        case "noop://sources":
-            payload = NoopDataAccess.sources()
-        default:
-            throw LocalAccessError.resourceNotFound(uri)
-        }
+        let payload = try dispatcher.resourcePayload(uri: uri)
         return .object([
             "contents": .array([
                 .object([
diff --git a/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/ToolDispatcher.swift b/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/ToolDispatcher.swift
new file mode 100644
index 0000000000..634ebaeaad
--- /dev/null
+++ b/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/ToolDispatcher.swift
@@ -0,0 +1,74 @@
+import Foundation
+
+/// The single read-only dispatch surface shared by MCP and the direct CLI transport.
+public final class NoopToolDispatcher {
+    private let configuration: LocalAccessConfiguration
+    private var dataAccess: NoopDataAccess?
+
+    public init(configuration: LocalAccessConfiguration = .environment()) {
+        self.configuration = configuration
+    }
+
+    public static let toolNames = [
+        "health_snapshot",
+        "metric_series",
+        "data_freshness",
+        "sleep_summary",
+        "workout_summary",
+    ]
+
+    public func dispatch(name: String, arguments: [String: JSONValue] = [:]) throws -> JSONValue {
+        switch name {
+        case "health_snapshot":
+            return try data().healthSnapshot(days: boundedDays(arguments["days"], default: 14, max: 120))
+        case "metric_series":
+            guard let key = arguments["key"]?.stringValue else {
+                throw LocalAccessError.invalidParams("metric_series requires key")
+            }
+            return try data().metricSeries(
+                key: key,
+                source: arguments["source"]?.stringValue ?? "my-whoop",
+                days: boundedDays(arguments["days"], default: 90, max: 4000),
+                fromDay: arguments["from_day"]?.stringValue,
+                toDay: arguments["to_day"]?.stringValue,
+                limit: boundedLimit(arguments["limit"], default: 500, max: 2000)
+            )
+        case "data_freshness":
+            return try data().freshness()
+        case "sleep_summary":
+            return try data().sleepSummary(days: boundedDays(arguments["days"], default: 30, max: 4000))
+        case "workout_summary":
+            return try data().workoutSummary(days: boundedDays(arguments["days"], default: 90, max: 4000))
+        default:
+            throw LocalAccessError.toolNotFound(name)
+        }
+    }
+
+    public func resourcePayload(uri: String) throws -> JSONValue {
+        switch uri {
+        case "noop://health/snapshot":
+            return try dispatch(name: "health_snapshot", arguments: ["days": .int(14)])
+        case "noop://data/freshness":
+            return try dispatch(name: "data_freshness")
+        case "noop://metrics/catalog":
+            return NoopDataAccess.metricCatalog()
+        case "noop://sources":
+            return NoopDataAccess.sources()
+        default:
+            throw LocalAccessError.resourceNotFound(uri)
+        }
+    }
+
+    private func data() throws -> NoopDataAccess {
+        if let dataAccess { return dataAccess }
+        do {
+            let access = try NoopDataAccess.open(configuration: configuration)
+            dataAccess = access
+            return access
+        } catch let error as LocalAccessError {
+            throw error
+        } catch {
+            throw LocalAccessError.databaseUnavailable("NOOP database is not available: \(error)")
+        }
+    }
+}
diff --git a/Packages/NoopLocalAccess/Sources/noop-local-access/main.swift b/Packages/NoopLocalAccess/Sources/noop-local-access/main.swift
index 5f95ed2f44..94730f6423 100644
--- a/Packages/NoopLocalAccess/Sources/noop-local-access/main.swift
+++ b/Packages/NoopLocalAccess/Sources/noop-local-access/main.swift
@@ -11,6 +11,8 @@ enum NoopLocalAccessMain {
         switch command {
         case "mcp":
             runMCP(configuration: .environment())
+        case "query":
+            runQuery(arguments: args)
         case "codex-config":
             print(codexConfig(arguments: args))
         case "--help", "-h", "help":
@@ -21,6 +23,33 @@ enum NoopLocalAccessMain {
         }
     }
 
+    private static func runQuery(arguments: [String]) {
+        if arguments == ["--help"] || arguments == ["-h"] {
+            print(helpText)
+            return
+        }
+        do {
+            let request = try NoopCLIQuery.parse(arguments: arguments)
+            let payload = try NoopCLIQuery.dispatch(request)
+            FileHandle.standardOutput.write(try NoopCLIQuery.encodeLine(payload))
+        } catch let error as NoopCLIQueryError {
+            fputs("[noop-local-access] \(error)\n", stderr)
+            Foundation.exit(error.exitCode)
+        } catch let error as LocalAccessError {
+            let message: String
+            if case .databaseUnavailable = error {
+                message = "NOOP database is unavailable"
+            } else {
+                message = error.description
+            }
+            fputs("[noop-local-access] \(message)\n", stderr)
+            Foundation.exit(1)
+        } catch {
+            fputs("[noop-local-access] runtime error\n", stderr)
+            Foundation.exit(1)
+        }
+    }
+
     private static func runMCP(configuration: LocalAccessConfiguration) {
         let server = NoopMCPServer(configuration: configuration)
         while let line = readLine(strippingNewline: true) {
@@ -77,8 +106,19 @@ enum NoopLocalAccessMain {
     private static let helpText = """
     Usage:
       noop-local-access mcp
+      noop-local-access query <tool> [flags]
       noop-local-access codex-config [--db-path /absolute/path/to/whoop.sqlite]
 
+    Query tools:
+      health_snapshot [--days N]
+      metric_series --key KEY [--source SOURCE] [--days N] [--from-day YYYY-MM-DD] [--to-day YYYY-MM-DD] [--limit N]
+      data_freshness
+      sleep_summary [--days N]
+      workout_summary [--days N]
+
+    Query options:
+      --db-path PATH    Explicit NOOP SQLite path. Otherwise NOOP_DB_PATH or the official app container is used.
+
     Environment:
       NOOP_DB_PATH    Explicit NOOP SQLite path. Optional; otherwise the official macOS app container is used.
       NOOP_BUNDLE_ID  Optional non-default bundle id. Not needed for the official app.
diff --git a/Packages/NoopLocalAccess/Tests/NoopLocalAccessCoreTests/CLIQueryTests.swift b/Packages/NoopLocalAccess/Tests/NoopLocalAccessCoreTests/CLIQueryTests.swift
new file mode 100644
index 0000000000..0e2ea7d628
--- /dev/null
+++ b/Packages/NoopLocalAccess/Tests/NoopLocalAccessCoreTests/CLIQueryTests.swift
@@ -0,0 +1,126 @@
+import XCTest
+@testable import NoopLocalAccessCore
+
+final class CLIQueryTests: XCTestCase {
+    func testAllFiveQueriesDispatchThroughTheSamePayloadAsMCP() throws {
+        let url = try TemporaryDatabase.seeded()
+        let configuration = LocalAccessConfiguration(databasePath: url.path)
+        let queries: [(String, [String])] = [
+            ("health_snapshot", ["--days", "14"]),
+            ("metric_series", ["--key", "hrv", "--from-day", "2026-06-10", "--to-day", "2026-06-11"]),
+            ("data_freshness", []),
+            ("sleep_summary", ["--days", "30"]),
+            ("workout_summary", ["--days", "90"]),
+        ]
+
+        for (tool, flags) in queries {
+            let parsed = try NoopCLIQuery.parse(arguments: [tool] + flags)
+            let request = NoopCLIQueryRequest(
+                toolName: parsed.toolName,
+                arguments: parsed.arguments,
+                configuration: configuration
+            )
+            let cliPayload = try NoopCLIQuery.dispatch(request)
+            let response = try XCTUnwrap(try NoopMCPServer(configuration: configuration).handle(RPCRequest(
+                id: .int(1),
+                method: "tools/call",
+                params: .object([
+                    "name": .string(tool),
+                    "arguments": .object(parsed.arguments),
+                ])
+            )))
+            let mcpPayload = try XCTUnwrap(response.objectValue?["result"]?.objectValue?["structuredContent"])
+
+            XCTAssertEqual(
+                withoutVolatileFields(mcpPayload),
+                withoutVolatileFields(cliPayload),
+                "CLI/MCP payload mismatch for \(tool)"
+            )
+        }
+    }
+
+    func testMetricSeriesRequiresKeyAndRejectsUnknownOrMissingFlags() {
+        assertUsageError([])
+        assertUsageError(["metric_series"])
+        assertUsageError(["metric_series", "--unknown", "x"])
+        assertUsageError(["metric_series", "--key=hrv"])
+        assertUsageError(["metric_series", "--key"])
+        assertUsageError(["metric_series", "--key", "hrv", "--limit"])
+        assertUsageError(["metric_series", "--key", "hrv", "--key", "rhr"])
+        assertUsageError(["metric_series", "--key", "hrv", "extra"])
+        assertUsageError(["health_snapshot", "--db-path"])
+        assertUsageError(["data_freshness", "--days", "7"])
+        assertUsageError(["health_snapshot", "--days", "not-an-integer"])
+    }
+
+    func testMetricSeriesParsesTheCompleteFlagContract() throws {
+        let parsed = try NoopCLIQuery.parse(arguments: [
+            "metric_series",
+            "--key", "hrv",
+            "--source", "apple-health",
+            "--days", "30",
+            "--from-day", "2026-06-01",
+            "--to-day", "2026-06-30",
+            "--limit", "42",
+            "--db-path", "/tmp/noop.sqlite",
+        ])
+
+        XCTAssertEqual(parsed.toolName, "metric_series")
+        XCTAssertEqual(parsed.arguments, [
+            "key": .string("hrv"),
+            "source": .string("apple-health"),
+            "days": .int(30),
+            "from_day": .string("2026-06-01"),
+            "to_day": .string("2026-06-30"),
+            "limit": .int(42),
+        ])
+        XCTAssertEqual(parsed.configuration.databasePath, "/tmp/noop.sqlite")
+    }
+
+    func testCLIValuesArePassedToTheExistingBounds() throws {
+        let parsed = try NoopCLIQuery.parse(arguments: ["sleep_summary", "--days", "0"])
+        XCTAssertEqual(parsed.arguments["days"], .int(0))
+
+        let request = NoopCLIQueryRequest(
+            toolName: parsed.toolName,
+            arguments: parsed.arguments,
+            configuration: LocalAccessConfiguration(databasePath: try TemporaryDatabase.seeded().path)
+        )
+        let payload = try NoopCLIQuery.dispatch(request)
+        XCTAssertEqual(payload.objectValue?["range"]?.objectValue?["days"], .int(1))
+    }
+
+    func testSuccessfulOutputIsOneJSONValueAndEncodingFailuresPropagate() throws {
+        let value: JSONValue = .object(["ok": .bool(true)])
+        let line = try NoopCLIQuery.encodeLine(value)
+
+        XCTAssertEqual(line.last, 0x0A)
+        XCTAssertEqual(try JSONDecoder().decode(JSONValue.self, from: Data(line.dropLast())), value)
+        XCTAssertThrowsError(try NoopCLIQuery.encodeLine(.double(.infinity)))
+    }
+
+    private func assertUsageError(_ arguments: [String], file: StaticString = #filePath, line: UInt = #line) {
+        XCTAssertThrowsError(try NoopCLIQuery.parse(arguments: arguments), file: file, line: line) { error in
+            guard let error = error as? NoopCLIQueryError else {
+                return XCTFail("Expected usage error, got \(error)", file: file, line: line)
+            }
+            XCTAssertEqual(error.exitCode, 64, file: file, line: line)
+        }
+    }
+
+    private func withoutVolatileFields(_ value: JSONValue) -> JSONValue {
+        switch value {
+        case .array(let values):
+            return .array(values.map(withoutVolatileFields))
+        case .object(let object):
+            let volatile = Set(["generatedAt", "ageSeconds", "fromTs", "toTs"])
+            var normalized: [String: JSONValue] = [:]
+            for (key, value) in object where !volatile.contains(key) {
+                normalized[key] = withoutVolatileFields(value)
+            }
+            return .object(normalized)
+        default:
+            return value
+        }
+    }
+}

From 1a8195cb24b509c86acf97ecaec9c4a5aefe89b3 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 15:10:15 +1200
Subject: [PATCH 104/333] sleep: let the sparse bridge cross one short active
 run (#1755)

A brief wake ended the night. Reported in #1657: up once for the bathroom, straight
back to sleep, and a 6h40m night scored 150 minutes at eff=0.96 - a confident, clean,
wrong answer that then fed the 21-day baseline every later night is judged against.

THE BRIDGE COULD NEVER REACH THE CASE IT WAS BUILT FOR. bridgeSparseSleep merged only
runs already adjacent in its own output, so an intervening active run was appended
first and made the next pair unreachable. A bathroom trip is definitionally an active
run. The reporter's trace put a number on it: the bridge merged NOTHING on 14 of 14
sparse nights, and the pieces then died at the 60-minute session floor. One active run
up to sparseBridgeActiveMaxMin is now absorbed, still subject to sparseBridgeGapMin
and to the HR band; two or more consecutive active runs are not.

THE HR GATE USED THE WRONG STATISTIC. hrSleepBandAcross judged on the MEAN, which a
single arousal spike drags out of band - the exact statistic confirmSleepWithHR
documents as wrong twelve lines below and uses the median for instead. Median now. It
still rejects a SUSTAINED elevation, which is the discrimination the gate exists to
make, and without it removing the active-run blocker would not have helped anyway.

Four review passes, each earning its place.

The bound started at maxGapMin (20), argued as principled reuse rather than an
invented number. Every unit case passed. An end-to-end test through detectSleep did
not: a FIFTEEN-minute interruption produces a TWENTY-ONE minute active run, because
classifyStill smears the still/moving boundary and buildRuns closes at sample edges.
The detected run is systematically longer than the interruption it represents, so a
bound reasoned from how long someone is actually out of bed will always be too tight.
30 now, stated as a judgement rather than dressed as derived, and the end-to-end pair
exists on BOTH platforms - that pair is what found this, and the smear is a property
of the implementation, so a Swift-only divergence would otherwise leave the bound
silently wrong on Apple.

Swift's shadow tracer is gone. It kept a second copy of the bridge loop purely to emit
trace lines, which would have had to be edited in step with this change; merge and
trace are one pass now. Android had none of that machinery at all - the line that made
this diagnosable was iOS-only, which is the only reason we know any of it.

Two comments corrected rather than left: the bridge's own doc claimed intervening
active runs were absorbed (they were not, and that sentence is much of why this went
unnoticed), and the empty-attempts line no longer names a cause that has just been
removed. One existing Swift test asserted "an intervening active run is never a
considered pair" - true when written, and it WAS the bug; repinned to the same shape.

An honest limit, in the PR body too: the absorbed minutes land in TST. Both stagers
call wake primarily off HR, not motion, so an interruption the bridge absorbed had
sleep-band HR by construction and will generally stage as light sleep rather than
wake. The HR gate is what decides - movement with sleep-band HR is a stir scored as
sleep; movement with elevated HR never reaches the bridge. Trading four lost hours for
about fifteen generously-scored minutes is a far smaller error pointed the right way,
but it is an error, not a clean win. An earlier draft of this branch claimed the span
staged awake with no inflation. That was wrong and is corrected here.

The parity pass found the trace lines byte-identical - and nothing keeping them so.
Neither suite asserted the rendered line, only the fields behind it, so a format
change on one platform would have diverged in silence. Both now pin the same whole
string.

NOT changed: minSleepMin stays at 60. The 45-57 minute runs it drops are real, but
that is a separate judgement about what counts as a session and deserves its own
evidence. With the bridge working, fewer runs reach that floor fragmented.

Android 4,938 and StrandAnalytics 1,672 (one skip), zero failures. Doc lint and i18n
clean. NOT validated on a real interrupted night - the reporter has not caught one
with the trace on yet, so the end-to-end fixtures stand in for it.
---
 .../Sources/StrandAnalytics/SleepStager.swift | 172 +++++++++----
 .../SleepStagerActiveBridgeTests.swift        | 203 ++++++++++++++++
 .../SparseBridgeAttemptTests.swift            |  33 ++-
 .../java/com/noop/analytics/SleepStager.kt    | 170 +++++++++++--
 .../analytics/SleepStagerActiveBridgeTest.kt  | 230 ++++++++++++++++++
 5 files changed, 725 insertions(+), 83 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerActiveBridgeTests.swift
 create mode 100644 android/app/src/test/java/com/noop/analytics/SleepStagerActiveBridgeTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
index 7be4760a44..a38d70b5c0 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
@@ -224,6 +224,27 @@ public enum SleepStager {
     /// floor (a real continuous night never has a true >90 min wake bridge mid-sleep).
     public static let sparseBridgeGapMin: Int = 90
 
+    /// A single intervening ACTIVE run up to this long may be absorbed when bridging two sleep runs
+    /// (#1657).
+    ///
+    /// This started as `maxGapMin` (20), on the reasoning that the file already had a threshold for
+    /// "a discontinuity this long is decisive". An end-to-end test through `detectSleep` showed that was
+    /// too tight to reach the case the issue is about: a FIFTEEN-minute interruption produced a
+    /// TWENTY-ONE-minute active run, because `classifyStill` smears the still/moving boundary by roughly
+    /// its rolling window and `buildRuns` closes runs at sample edges. The detected run is systematically
+    /// longer than the interruption it represents, so a bound set from the interruption's true length
+    /// rejects it.
+    ///
+    /// 30 is a judgement, and stated as one rather than dressed up as derived: a realistic trip out of
+    /// bed of up to about a quarter of an hour, plus the ~6 minutes of smear that measurement showed,
+    /// with a little headroom. It is deliberately well under `minSleepMin` — an interruption long enough
+    /// to be a session in its own right is a genuine awakening and should split the night.
+    ///
+    /// The bound is the cheap half of the guard. The real one is the HR band across the whole span: a
+    /// wearer who is actually up keeps HR elevated for the duration and fails it, while a brief stir does
+    /// not. `mergeMin` (15) already absorbs shorter active runs upstream in `mergePeriods`.
+    public static let sparseBridgeActiveMaxMin: Int = 30
+
     // MARK: - Stage 1–3 constants (sleep_features.py)
 
     public static let epochS: Double = 30.0
@@ -358,8 +379,15 @@ public enum SleepStager {
         guard let baseline = baseline else { return false }
         let seg = hr.filter { $0.ts > a && $0.ts <= b }
         if seg.isEmpty { return false }
-        let meanHR = Double(seg.reduce(0) { $0 + $1.bpm }) / Double(seg.count)
-        return meanHR <= baseline * hrSleepBandMult
+        // MEDIAN, not mean (#1657). `confirmSleepWithHR` below already documents why the mean is the
+        // wrong statistic here — "a real sleep night carries brief arousal / wake HR spikes (observed to
+        // ~190 bpm)" that drag it above the band — and uses the median for exactly that reason. This gate
+        // answers the same question over a SHORTER window, where a single spike dominates the mean even
+        // harder: a two-minute stir inside a fifteen-minute interval can put the mean out of band while
+        // the wearer was asleep for thirteen of those minutes. The median rejects a SUSTAINED elevation
+        // just as firmly, which is the discrimination this gate exists to make.
+        let medianHR = HRVAnalyzer.median(seg.map { Double($0.bpm) })
+        return medianHR <= baseline * hrSleepBandMult
     }
 
     /// Per-record sleep flags from a rolling fraction of "still" samples.
@@ -472,11 +500,13 @@ public enum SleepStager {
     struct SparseBridgeAttempt: Equatable, Sendable {
         /// Gap between the two runs, in whole minutes (negative when they overlap).
         let gapMin: Int
+        /// Minutes of intervening ACTIVE run, or 0 when the pair was only separated by a gap (#1657).
+        let activeMin: Int
         /// Whether the intervening HR stayed in the sleep band (the bridge's second condition).
         let hrInSleepBand: Bool
         /// Whether this pair was merged.
         let bridged: Bool
-        /// Stable token for the log: bridged / gapTooLong / hrOutOfBand / overlap.
+        /// Stable token for the log: bridged / gapTooLong / hrOutOfBand / overlap / activeTooLong.
         let reason: String
     }
 
@@ -485,57 +515,90 @@ public enum SleepStager {
     /// actually happened rather than an approximation. Only pairs the bridge itself CONSIDERS (two
     /// adjacent sleep runs) produce an attempt; a pair separated by an active run is never considered,
     /// which is itself the answer when no attempts are reported. Pure — no I/O, no side effects.
-    static func sparseBridgeAttempts(_ periods: [Period], sparse: Bool,
-                                     hr: [HRSample], baseline: Double?) -> [SparseBridgeAttempt] {
-        guard sparse, !periods.isEmpty else { return [] }
+    /// The bridge, plus what it considered. See `bridgeSparseSleep` for the merge rule.
+    ///
+    /// #1657: an intervening ACTIVE run no longer blocks the merge permanently. The original loop could
+    /// only join runs already adjacent in its own output, so any active run between two sleep runs was
+    /// appended first and made the next pair unreachable — and a field trace found the bridge merging
+    /// NOTHING on 14 of 14 sparse nights for exactly that reason. Since a bathroom trip is definitionally
+    /// an active run, the rescue built for fragmentation was unavailable in the case that needs it most.
+    ///
+    /// A single active run up to `sparseBridgeActiveMaxMin` is now absorbed, with the whole span still
+    /// subject to `sparseBridgeGapMin` and to the HR band. Two or more consecutive active runs are not:
+    /// that is a night with real structure in it, not one interruption.
+    ///
+    /// This USED to be a shadow copy of the loop kept only for tracing, which had to be edited in step
+    /// with the real one — a trace that quietly disagrees with the behaviour it describes is worse than
+    /// no trace. Merge and trace are one pass now. Kotlin twin: `bridgeSparseSleepTraced`.
+    static func bridgeSparseSleepTraced(_ periods: [Period], sparse: Bool, hr: [HRSample],
+                                        baseline: Double?) -> ([Period], [SparseBridgeAttempt]) {
+        if !sparse || periods.isEmpty { return (periods, []) }
         let bridgeGapS = sparseBridgeGapMin * 60
-        var attempts: [SparseBridgeAttempt] = []
+        let activeMaxS = sparseBridgeActiveMaxMin * 60
         var out: [Period] = []
+        var attempts: [SparseBridgeAttempt] = []
+
+        /// Judge one candidate pair, record it, and merge when it passes.
+        ///
+        /// The order of the checks fixes which reason a failing pair reports, and it is deliberate:
+        /// overlap and gap are properties of the pair, activeTooLong is a property of what sits between
+        /// them, and hrOutOfBand is last because it is the only one that needed the HR series to decide.
+        func consider(_ left: Period, _ right: Period, activeS: Int,
+                      dropTrailing: Bool, activeMaxS: Int) -> Bool {
+            let gap = right.start - left.end
+            let inBand = hrSleepBandAcross(left.end, right.start, hr: hr, baseline: baseline)
+            let reason: String
+            if gap < 0 { reason = "overlap" }
+            else if gap > bridgeGapS { reason = "gapTooLong" }
+            else if activeS > activeMaxS { reason = "activeTooLong" }
+            else if !inBand { reason = "hrOutOfBand" }
+            else { reason = "bridged" }
+            let bridged = reason == "bridged"
+            attempts.append(SparseBridgeAttempt(gapMin: gap / 60, activeMin: activeS / 60,
+                                                hrInSleepBand: inBand, bridged: bridged, reason: reason))
+            guard bridged else { return false }
+            if dropTrailing { out.removeLast() }
+            out[out.count - 1] = Period(stage: "sleep", start: left.start, end: right.end)
+            return true
+        }
+
         for p in periods {
-            if let last = out.last, last.stage == "sleep", p.stage == "sleep" {
-                let gap = p.start - last.end
-                let inBand = hrSleepBandAcross(last.end, p.start, hr: hr, baseline: baseline)
-                let bridged = gap >= 0 && gap <= bridgeGapS && inBand
-                let reason: String
-                if bridged { reason = "bridged" }
-                else if gap < 0 { reason = "overlap" }
-                else if gap > bridgeGapS { reason = "gapTooLong" }
-                else { reason = "hrOutOfBand" }
-                attempts.append(SparseBridgeAttempt(gapMin: gap / 60, hrInSleepBand: inBand,
-                                                    bridged: bridged, reason: reason))
-                if bridged {
-                    out[out.count - 1] = Period(stage: "sleep", start: last.start, end: p.end)
-                    continue
+            if p.stage == "sleep" {
+                // Case 1: the previous run is sleep — the original adjacent-pair merge.
+                if let last = out.last, last.stage == "sleep" {
+                    if consider(last, p, activeS: 0, dropTrailing: false, activeMaxS: 0) { continue }
+                }
+                // Case 2: exactly one active run sits between two sleep runs. Absorbed when short
+                // enough, which is the #1657 case the original loop could never reach.
+                if out.count >= 2, let last = out.last, last.stage == "active",
+                   out[out.count - 2].stage == "sleep" {
+                    let prev = out[out.count - 2]
+                    if consider(prev, p, activeS: last.end - last.start,
+                                dropTrailing: true, activeMaxS: activeMaxS) { continue }
                 }
             }
             out.append(p)
         }
-        return attempts
+        return (out, attempts)
     }
 
-    /// Sparse-gravity bridge (#308): merge two adjacent SLEEP runs separated ONLY by a gap up to
-    /// sparseBridgeGapMin minutes when the intervening HR stays in the sleep band — so a real night
-    /// fragmented by gravity dropouts is re-stitched into one continuous in-bed span BEFORE the
-    /// minSleepMin gate drops the pieces. Active runs and over-threshold gaps are left untouched;
-    /// the span between two bridged sleep runs (an "active"/gap run, if present) is absorbed.
-    /// A no-op when `sparse == false`, so the dense 4.0 path is unchanged.
+    /// Sparse-gravity bridge (#308): merge two SLEEP runs when the intervening HR stays in the sleep
+    /// band — so a real night fragmented by gravity dropouts is re-stitched into one continuous in-bed
+    /// span BEFORE the minSleepMin gate drops the pieces. A no-op when `sparse == false`, so the dense
+    /// 4.0 path is unchanged.
+    ///
+    /// What sits between the two runs may be a bare gap (up to `sparseBridgeGapMin`) or ONE active run
+    /// (additionally up to `sparseBridgeActiveMaxMin`). Over-threshold gaps, longer active runs and two
+    /// consecutive active runs are all left untouched.
+    ///
+    /// The previous wording here — "Active runs … are left untouched; the span between two bridged sleep
+    /// runs (an "active"/gap run, if present) is absorbed" — read as though an intervening active run was
+    /// already handled. It was not: only a bare gap was, and that sentence is a large part of why #1657
+    /// went unnoticed. Kept in the history rather than quietly deleted, because the next person to widen
+    /// this function will read this comment first.
     static func bridgeSparseSleep(_ periods: [Period], sparse: Bool,
                                   hr: [HRSample], baseline: Double?) -> [Period] {
-        if !sparse || periods.isEmpty { return periods }
-        let bridgeGapS = sparseBridgeGapMin * 60
-        var out: [Period] = []
-        for p in periods {
-            if let last = out.last, last.stage == "sleep", p.stage == "sleep" {
-                let gap = p.start - last.end
-                if gap >= 0 && gap <= bridgeGapS
-                    && hrSleepBandAcross(last.end, p.start, hr: hr, baseline: baseline) {
-                    out[out.count - 1] = Period(stage: "sleep", start: last.start, end: p.end)
-                    continue
-                }
-            }
-            out.append(p)
-        }
-        return out
+        bridgeSparseSleepTraced(periods, sparse: sparse, hr: hr, baseline: baseline).0
     }
 
     // MARK: - HR refinement
@@ -1048,9 +1111,9 @@ public enum SleepStager {
         let runsBeforeBridge = traceSink == nil ? 0 : runs.filter { $0.stage == "sleep" }.count
         // #737: capture the per-pair reasons BEFORE the merge mutates `runs`, so a bridge that changed
         // nothing still says why (gapTooLong / hrOutOfBand / overlap) instead of only before==after.
-        let bridgeAttempts = traceSink == nil ? [] : sparseBridgeAttempts(runs, sparse: sparse, hr: hrS,
-                                                                         baseline: baseline)
-        runs = bridgeSparseSleep(runs, sparse: sparse, hr: hrS, baseline: baseline)
+        let bridgeResult = bridgeSparseSleepTraced(runs, sparse: sparse, hr: hrS, baseline: baseline)
+        let bridgeAttempts = bridgeResult.1
+        runs = bridgeResult.0
         // Sleep & Rest test mode (E3): record the sparse-gravity bridge result, so a sparse 5.0 night
         // rescued from fragmentation is visible. Only emitted when gravity is sparse (the only case the
         // bridge can act) and only when tracing. Side-effect-only.
@@ -1059,19 +1122,24 @@ public enum SleepStager {
             traceSink(GateTrace.runLine(index: -1, startTs: 0, endTs: 0,
                 verdict: runsAfterBridge < runsBeforeBridge ? .kept : .dropped, gate: "sparseBridge",
                 detail: "sparse=true gapMin=\(sparseBridgeGapMin) runsBefore=\(runsBeforeBridge) runsAfter=\(runsAfterBridge)"))
-            // #737: one line per pair the bridge CONSIDERED. No lines at all means no two adjacent sleep
-            // runs were ever seen — i.e. the fragments are separated by active runs, which the bridge
-            // deliberately never crosses. That absence is itself the diagnosis.
+            // #737: one line per pair the bridge CONSIDERED, each naming what it decided.
+            //
+            // #1657 changed what an empty list MEANS, so the wording changed with it. It used to mean
+            // "the fragments are separated by active runs", because such a pair could never be reached —
+            // that absence was the diagnosis. A single short active run is now a considered pair, so an
+            // empty list can only mean there was no candidate at all: one sleep run, or fragments split
+            // by two or more consecutive active runs. Leaving the old text would have pointed the next
+            // reader at a cause that had just been removed.
             if bridgeAttempts.isEmpty {
                 traceSink(GateTrace.runLine(index: -1, startTs: 0, endTs: 0, verdict: .dropped,
                     gate: "sparseBridge",
-                    detail: "no adjacent sleep pairs considered (fragments separated by active runs)"))
+                    detail: "no candidate pairs (one sleep run, or fragments split by consecutive active runs)"))
             }
             for (i, a) in bridgeAttempts.enumerated() {
                 traceSink(GateTrace.runLine(index: -1, startTs: 0, endTs: 0,
                     verdict: a.bridged ? .kept : .dropped, gate: "sparseBridgePair",
-                    detail: "pair=\(i) gapMin=\(a.gapMin) hrInSleepBand=\(a.hrInSleepBand) "
-                        + "reason=\(a.reason)"))
+                    detail: "pair=\(i) gapMin=\(a.gapMin) activeMin=\(a.activeMin) "
+                        + "hrInSleepBand=\(a.hrInSleepBand) reason=\(a.reason)"))
             }
         }
 
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerActiveBridgeTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerActiveBridgeTests.swift
new file mode 100644
index 0000000000..561e177b7f
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerActiveBridgeTests.swift
@@ -0,0 +1,203 @@
+import XCTest
+@testable import StrandAnalytics
+import WhoopProtocol
+
+/// #1657 twin of `SleepStagerActiveBridgeTest`. The sparse-gravity bridge could only ever join sleep
+/// runs already adjacent in its own output, so ANY active run between two sleep runs blocked the merge
+/// permanently. A field trace found it merging nothing on 14 of 14 sparse nights for exactly that reason
+/// — and since a bathroom trip is definitionally an active run, the rescue built for fragmentation was
+/// unavailable in the case that needs it most. The pieces then died at the 60-minute session floor,
+/// which is how a 6h40m night scored 150 minutes.
+final class SleepStagerActiveBridgeTests: XCTestCase {
+
+    private func sleep(_ start: Int, _ end: Int) -> SleepStager.Period {
+        SleepStager.Period(stage: "sleep", start: start, end: end)
+    }
+    private func active(_ start: Int, _ end: Int) -> SleepStager.Period {
+        SleepStager.Period(stage: "active", start: start, end: end)
+    }
+    /// Flat HR well under the band, so the HR gate is never the thing under test.
+    private func calmHr(_ from: Int, _ to: Int, bpm: Int = 50) -> [HRSample] {
+        stride(from: from, through: to, by: 60).map { HRSample(ts: $0, bpm: bpm) }
+    }
+    private let baseline = 60.0
+
+    /// THE reported shape: asleep, a short trip, asleep again. Each piece is under the 60-minute session
+    /// floor on its own; together they are a night.
+    func testAShortActiveInterruptionBetweenTwoSleepRunsIsAbsorbed() {
+        let out = SleepStager.bridgeSparseSleep(
+            [sleep(0, 3000), active(3000, 3900), sleep(3900, 9000)],
+            sparse: true, hr: calmHr(0, 9000), baseline: baseline)
+        XCTAssertEqual(out.count, 1)
+        XCTAssertEqual(out.first?.stage, "sleep")
+        XCTAssertEqual(out.first?.start, 0)
+        XCTAssertEqual(out.first?.end, 9000)
+    }
+
+    /// The guard that keeps this honest. A long active run is a real break in the night, not a stir, and
+    /// absorbing it would score wakefulness as sleep — wrong in a new direction and harder to notice than
+    /// the truncation being fixed.
+    func testAnActiveRunLongerThanTheBoundIsLeftAlone() {
+        let tooLong = SleepStager.sparseBridgeActiveMaxMin * 60 + 60
+        let out = SleepStager.bridgeSparseSleep(
+            [sleep(0, 3000), active(3000, 3000 + tooLong), sleep(3000 + tooLong, 9000)],
+            sparse: true, hr: calmHr(0, 9000), baseline: baseline)
+        XCTAssertEqual(out.count, 3)
+    }
+
+    /// HR is the real gate, not the duration bound. A wearer who is genuinely up keeps HR elevated for
+    /// the whole interruption, and that must still block the merge even when it is short.
+    func testAShortInterruptionWithElevatedHRIsNotAbsorbed() {
+        let hot = calmHr(0, 3000) + calmHr(3001, 3900, bpm: 110) + calmHr(3901, 9000)
+        let out = SleepStager.bridgeSparseSleep(
+            [sleep(0, 3000), active(3000, 3900), sleep(3900, 9000)],
+            sparse: true, hr: hot, baseline: baseline)
+        XCTAssertEqual(out.count, 3)
+    }
+
+    /// Two consecutive active runs are a night with structure in it, not one interruption.
+    func testTwoConsecutiveActiveRunsAreNotAbsorbed() {
+        let out = SleepStager.bridgeSparseSleep(
+            [sleep(0, 3000), active(3000, 3300), active(3300, 3900), sleep(3900, 9000)],
+            sparse: true, hr: calmHr(0, 9000), baseline: baseline)
+        XCTAssertEqual(out.count, 4)
+    }
+
+    /// A dense 4.0 night must be byte-identical: the bridge is sparse-only and always has been.
+    /// `Period` is not Equatable in production, so the fields are compared rather than widening a
+    /// production type for a test's convenience.
+    func testADenseNightIsUntouched() {
+        let periods = [sleep(0, 3000), active(3000, 3900), sleep(3900, 9000)]
+        let out = SleepStager.bridgeSparseSleep(periods, sparse: false, hr: calmHr(0, 9000),
+                                                baseline: baseline)
+        XCTAssertEqual(out.map(\.stage), periods.map(\.stage))
+        XCTAssertEqual(out.map(\.start), periods.map(\.start))
+        XCTAssertEqual(out.map(\.end), periods.map(\.end))
+    }
+
+    /// The pre-existing behaviour — a bare gap between two sleep runs — still merges.
+    func testTheOriginalAdjacentPairMergeStillWorks() {
+        let out = SleepStager.bridgeSparseSleep(
+            [sleep(0, 3000), sleep(3600, 9000)],
+            sparse: true, hr: calmHr(0, 9000), baseline: baseline)
+        XCTAssertEqual(out.count, 1)
+        XCTAssertEqual(out.first?.end, 9000)
+    }
+
+    /// The trace has to say WHY, and the blocking length is the number a reader needs. The old trace could
+    /// only report runsBefore == runsAfter, which says the bridge did nothing and not what stopped it.
+    func testABlockedPairReportsTheBoundThatBlockedItWithTheActiveLength() {
+        let tooLong = SleepStager.sparseBridgeActiveMaxMin * 60 + 60
+        let (_, attempts) = SleepStager.bridgeSparseSleepTraced(
+            [sleep(0, 3000), active(3000, 3000 + tooLong), sleep(3000 + tooLong, 9000)],
+            sparse: true, hr: calmHr(0, 9000), baseline: baseline)
+        XCTAssertEqual(attempts.count, 1)
+        XCTAssertEqual(attempts.first?.reason, "activeTooLong")
+        XCTAssertEqual(attempts.first?.bridged, false)
+        XCTAssertEqual(attempts.first?.activeMin, SleepStager.sparseBridgeActiveMaxMin + 1)
+    }
+
+    /// The tracer and the merge are ONE pass now. This file used to keep a shadow copy of the loop purely
+    /// to trace it, which had to be edited in step with the real one — a trace that quietly disagrees
+    /// with the behaviour it describes is worse than no trace at all.
+    func testTheTracedPassReturnsExactlyWhatThePlainOneDoes() {
+        let periods = [sleep(0, 3000), active(3000, 3900), sleep(3900, 9000)]
+        let hr = calmHr(0, 9000)
+        let plain = SleepStager.bridgeSparseSleep(periods, sparse: true, hr: hr, baseline: baseline)
+        let traced = SleepStager.bridgeSparseSleepTraced(periods, sparse: true, hr: hr,
+                                                         baseline: baseline).0
+        XCTAssertEqual(plain.map(\.stage), traced.map(\.stage))
+        XCTAssertEqual(plain.map(\.start), traced.map(\.start))
+        XCTAssertEqual(plain.map(\.end), traced.map(\.end))
+    }
+
+    /// #1657, the other half: `hrSleepBandAcross` judged on the MEAN, which a single arousal spike drags
+    /// out of band — the exact statistic `confirmSleepWithHR` documents as wrong for this, and uses the
+    /// median for instead. A sustained elevation must still be rejected.
+    func testABriefSpikeNoLongerPutsTheWholeIntervalOutOfBandButASustainedOneDoes() {
+        let spiky = calmHr(0, 3540) + calmHr(3541, 3660, bpm: 190)
+        XCTAssertTrue(SleepStager.hrSleepBandAcross(0, 3660, hr: spiky, baseline: baseline))
+        XCTAssertFalse(SleepStager.hrSleepBandAcross(0, 3660, hr: calmHr(0, 3660, bpm: 110),
+                                                     baseline: baseline))
+    }
+
+    // MARK: - End to end, through detectSleep
+    //
+    // The unit cases above pin the bridge. These pin the thing the reporter actually saw: a night with
+    // one interruption arriving as ONE session instead of a truncated fragment.
+    //
+    // This twin is not optional. The Kotlin version of exactly this test is what found the bound wrong —
+    // every unit case passed at 20 while the real pipeline still returned two sessions, because
+    // classifyStill smears the still/moving boundary and buildRuns closes at sample edges, so a 15-minute
+    // interruption becomes a 21-minute run. That smear is a property of THIS implementation, so without
+    // the twin a divergence in Swift's windowing would leave the bound silently wrong on Apple only.
+
+    /// 2025-06-10 00:00:00 UTC.
+    private var refMidnight: Int { 1_749_513_600 }
+    private func at(_ hour: Int, _ minute: Int = 0) -> Int { refMidnight + hour * 3_600 + minute * 60 }
+
+    /// Still gravity at 1/min — constant orientation, so every delta is 0.
+    private func stillG(_ from: Int, _ toExclusive: Int) -> [GravitySample] {
+        stride(from: from, to: toExclusive, by: 60).map { GravitySample(ts: $0, x: 0, y: 0, z: 1.0) }
+    }
+
+    /// Moving gravity at 1/min — orientation swings every sample, so deltas are large.
+    private func movingG(_ from: Int, _ toExclusive: Int) -> [GravitySample] {
+        stride(from: from, to: toExclusive, by: 60).enumerated().map { i, t in
+            i % 2 == 0 ? GravitySample(ts: t, x: 1.0, y: 0, z: 0)
+                       : GravitySample(ts: t, x: 0, y: 1.0, z: 0)
+        }
+    }
+
+    private func hr1Hz(_ from: Int, _ toExclusive: Int, _ bpm: Int) -> [HRSample] {
+        (from ..< toExclusive).map { HRSample(ts: $0, bpm: bpm) }
+    }
+
+    /// A night with a 30-minute gravity dropout early (so it reads sparse, as a 5/MG's does) and a
+    /// 15-minute up-and-about in the middle.
+    private func interruptedNight(tripBpm: Int) -> ([HRSample], [GravitySample]) {
+        let grav = stillG(at(0), at(0, 30))
+            + stillG(at(1), at(2))
+            + movingG(at(2), at(2, 15))
+            + stillG(at(2, 15), at(6))
+        let hr = hr1Hz(at(0), at(2), 50)
+            + hr1Hz(at(2), at(2, 15), tripBpm)
+            + hr1Hz(at(2, 15), at(6), 50)
+        return (hr, grav)
+    }
+
+    func testANightWithOneShortInterruptionIsDetectedAsASingleSession() {
+        let (hr, grav) = interruptedNight(tripBpm: 52)
+        XCTAssertTrue(SleepStager.isGravitySparse(grav, hr: hr), "the fixture must read as sparse")
+        let sessions = SleepStager.detectSleep(hr: hr, gravity: grav)
+        XCTAssertEqual(sessions.count, 1, "the interruption must not end the night")
+        let spanMin = Double((sessions[0].end - sessions[0].start)) / 60.0
+        XCTAssertGreaterThan(spanMin, 5 * 60, "the whole night should survive, got \(spanMin) min")
+    }
+
+    /// The same night with the wearer genuinely up — HR elevated for the whole quarter hour. Absorbing
+    /// that would score wakefulness as sleep: wrong in a new direction and harder to notice than the
+    /// truncation being fixed.
+    func testTheSameNightWithAGenuinelyAwakeInterruptionIsNotBridgedIntoOne() {
+        let (hr, grav) = interruptedNight(tripBpm: 110)
+        let sessions = SleepStager.detectSleep(hr: hr, gravity: grav)
+        let spanMin = sessions.reduce(0.0) { $0 + Double($1.end - $1.start) / 60.0 }
+        XCTAssertTrue(sessions.count != 1 || spanMin < 5 * 60,
+                      "an awake interruption must not be absorbed (\(sessions.count) sessions, \(spanMin) min)")
+    }
+
+    /// The RENDERED line, not just the fields — and deliberately the whole string, byte for byte.
+    ///
+    /// The Kotlin twin asserts this identical literal. Nothing in the tree compares the two languages'
+    /// trace output automatically, so a format change on one side would otherwise diverge in silence and
+    /// only surface when someone tried to read a capture from the other platform.
+    func testThePairLineRendersExactlyAsItsKotlinTwinDoes() {
+        let line = SleepStager.GateTrace.runLine(
+            index: -1, startTs: 0, endTs: 0, verdict: SleepStager.GateVerdict.dropped, gate: "sparseBridgePair",
+            detail: "pair=0 gapMin=23 activeMin=21 hrInSleepBand=true reason=activeTooLong")
+        XCTAssertEqual(
+            line,
+            "gate run=-1 spanS=0 DROPPED gate=sparseBridgePair "
+                + "pair=0 gapMin=23 activeMin=21 hrInSleepBand=true reason=activeTooLong")
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SparseBridgeAttemptTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SparseBridgeAttemptTests.swift
index 2a5f5f73ae..b42ddd4edc 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SparseBridgeAttemptTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SparseBridgeAttemptTests.swift
@@ -23,7 +23,7 @@ final class SparseBridgeAttemptTests: XCTestCase {
     /// must equal the reduction in sleep-run count the REAL bridge produces.
     private func assertAgreesWithBridge(_ periods: [SleepStager.Period], hr: [HRSample],
                                         baseline: Double?, file: StaticString = #filePath, line: UInt = #line) {
-        let attempts = SleepStager.sparseBridgeAttempts(periods, sparse: true, hr: hr, baseline: baseline)
+        let attempts = SleepStager.bridgeSparseSleepTraced(periods, sparse: true, hr: hr, baseline: baseline).1
         let before = periods.filter { $0.stage == "sleep" }.count
         let after = SleepStager.bridgeSparseSleep(periods, sparse: true, hr: hr, baseline: baseline)
             .filter { $0.stage == "sleep" }.count
@@ -35,7 +35,7 @@ final class SparseBridgeAttemptTests: XCTestCase {
         // Two sleep runs 10 min apart, HR asleep across the gap → bridged.
         let periods = [sleep(0, 3_600), sleep(4_200, 8_000)]
         let hr = sleepHR(from: 0, to: 8_000)
-        let a = SleepStager.sparseBridgeAttempts(periods, sparse: true, hr: hr, baseline: 70)
+        let a = SleepStager.bridgeSparseSleepTraced(periods, sparse: true, hr: hr, baseline: 70).1
         XCTAssertEqual(a.count, 1)
         XCTAssertEqual(a[0].gapMin, 10)
         XCTAssertTrue(a[0].bridged)
@@ -48,7 +48,7 @@ final class SparseBridgeAttemptTests: XCTestCase {
         let gap = (SleepStager.sparseBridgeGapMin + 30) * 60
         let periods = [sleep(0, 3_600), sleep(3_600 + gap, 3_600 + gap + 3_600)]
         let hr = sleepHR(from: 0, to: 3_600 + gap + 3_600)
-        let a = SleepStager.sparseBridgeAttempts(periods, sparse: true, hr: hr, baseline: 70)
+        let a = SleepStager.bridgeSparseSleepTraced(periods, sparse: true, hr: hr, baseline: 70).1
         XCTAssertEqual(a.count, 1)
         XCTAssertFalse(a[0].bridged)
         XCTAssertEqual(a[0].reason, "gapTooLong")
@@ -60,7 +60,7 @@ final class SparseBridgeAttemptTests: XCTestCase {
         // Gap is short enough, but HR across it is clearly awake → the HR condition is what refused.
         let periods = [sleep(0, 3_600), sleep(4_200, 8_000)]
         let hr = sleepHR(from: 0, to: 8_000, bpm: 110)
-        let a = SleepStager.sparseBridgeAttempts(periods, sparse: true, hr: hr, baseline: 60)
+        let a = SleepStager.bridgeSparseSleepTraced(periods, sparse: true, hr: hr, baseline: 60).1
         XCTAssertEqual(a.count, 1)
         XCTAssertFalse(a[0].bridged)
         XCTAssertFalse(a[0].hrInSleepBand)
@@ -68,21 +68,28 @@ final class SparseBridgeAttemptTests: XCTestCase {
         assertAgreesWithBridge(periods, hr: hr, baseline: 60)
     }
 
-    /// The reporter's shape (#737): fragments separated by ACTIVE runs are never adjacent sleep pairs, so
-    /// the bridge considers nothing — which is exactly why their log showed runsBefore == runsAfter with
-    /// no explanation. An EMPTY attempt list is the diagnosis, and the emitter says so in words.
-    func testFragmentsSeparatedByActiveRunsProduceNoAttempts() {
+    /// REPINNED for #1657. This used to assert the opposite — "an intervening active run is never a
+    /// considered pair" — which was true, and was the bug: the shape it describes is the reporter's
+    /// bathroom break, and the bridge built to rescue fragmentation was structurally unable to reach it.
+    /// A field trace then found the bridge merging nothing on 14 of 14 sparse nights for this reason.
+    ///
+    /// The test was correct when written and quietly became a guard on the wrong behaviour. Kept pointing
+    /// at the same shape so the history reads straight.
+    func testAShortActiveRunBetweenFragmentsIsNowConsideredAndBridged() {
         let periods = [sleep(0, 3_000), active(3_000, 3_300), sleep(3_300, 6_000)]
         let hr = sleepHR(from: 0, to: 6_000)
-        let a = SleepStager.sparseBridgeAttempts(periods, sparse: true, hr: hr, baseline: 70)
-        XCTAssertTrue(a.isEmpty, "an intervening active run is never a considered pair")
-        assertAgreesWithBridge(periods, hr: hr, baseline: 70)   // and the real bridge merges nothing
+        let (out, a) = SleepStager.bridgeSparseSleepTraced(periods, sparse: true, hr: hr, baseline: 70)
+        XCTAssertEqual(a.count, 1, "the pair is now considered")
+        XCTAssertEqual(a.first?.reason, "bridged")
+        XCTAssertEqual(a.first?.activeMin, 5)
+        XCTAssertEqual(out.count, 1, "and the night is one run again")
+        XCTAssertEqual(out.first?.end, 6_000)
     }
 
     func testNoOpWhenNotSparse() {
         let periods = [sleep(0, 3_600), sleep(4_200, 8_000)]
         let hr = sleepHR(from: 0, to: 8_000)
-        XCTAssertTrue(SleepStager.sparseBridgeAttempts(periods, sparse: false, hr: hr, baseline: 70).isEmpty,
+        XCTAssertTrue(SleepStager.bridgeSparseSleepTraced(periods, sparse: false, hr: hr, baseline: 70).1.isEmpty,
                       "the dense 4.0 path is untouched, so there is nothing to explain")
     }
 
@@ -91,7 +98,7 @@ final class SparseBridgeAttemptTests: XCTestCase {
     func testChainOfThreeReportsTwoPairsAndAgrees() {
         let periods = [sleep(0, 3_600), sleep(4_200, 8_000), sleep(8_600, 12_000)]
         let hr = sleepHR(from: 0, to: 12_000)
-        let a = SleepStager.sparseBridgeAttempts(periods, sparse: true, hr: hr, baseline: 70)
+        let a = SleepStager.bridgeSparseSleepTraced(periods, sparse: true, hr: hr, baseline: 70).1
         XCTAssertEqual(a.count, 2)
         XCTAssertTrue(a.allSatisfy { $0.bridged })
         assertAgreesWithBridge(periods, hr: hr, baseline: 70)
diff --git a/android/app/src/main/java/com/noop/analytics/SleepStager.kt b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
index 5a2067fbe6..7016c12c55 100644
--- a/android/app/src/main/java/com/noop/analytics/SleepStager.kt
+++ b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
@@ -320,6 +320,29 @@ object SleepStager {
      */
     const val sparseBridgeGapMin: Int = 90
 
+    /**
+     * A single intervening ACTIVE run up to this long may be absorbed when bridging two sleep runs
+     * (#1657).
+     *
+     * This started as [maxGapMin] (20), on the reasoning that the file already had a threshold for
+     * "a discontinuity this long is decisive". An end-to-end test through [detectSleep] showed that was
+     * too tight to reach the case the issue is about: a FIFTEEN-minute interruption produced a
+     * TWENTY-ONE-minute active run, because [classifyStill] smears the still/moving boundary by roughly
+     * its rolling window and [buildRuns] closes runs at sample edges. The detected run is systematically
+     * longer than the interruption it represents, so a bound set from the interruption's true length
+     * rejects it.
+     *
+     * 30 is a judgement, and stated as one rather than dressed up as derived: a realistic trip out of
+     * bed of up to about a quarter of an hour, plus the ~6 minutes of smear that measurement showed,
+     * with a little headroom. It is deliberately well under [minSleepMin] — an interruption long enough
+     * to be a session in its own right is a genuine awakening and should split the night.
+     *
+     * The bound is the cheap half of the guard. The real one is the HR band across the whole span: a
+     * wearer who is actually up keeps HR elevated for the duration and fails it, while a brief stir does
+     * not. [mergeMin] (15) already absorbs shorter active runs upstream in [mergePeriods].
+     */
+    const val sparseBridgeActiveMaxMin: Int = 30
+
     // ── Stage 1–3 constants (sleep_features.py) ──────────────────────────────
 
     const val epochS: Double = 30.0
@@ -471,8 +494,15 @@ object SleepStager {
         if (baseline == null) return false
         val seg = hr.filter { it.ts > a && it.ts <= b }
         if (seg.isEmpty()) return false
-        val meanHR = seg.sumOf { it.bpm }.toDouble() / seg.size.toDouble()
-        return meanHR <= baseline * hrSleepBandMult
+        // MEDIAN, not mean (#1657). [confirmSleepWithHR] twelve lines below already documents why the
+        // mean is the wrong statistic here — "a real sleep night carries brief arousal / wake HR spikes
+        // (observed to ~190 bpm)" that drag it above the band — and uses the median for exactly that
+        // reason. This gate answers the same question over a SHORTER window, where a single spike
+        // dominates the mean even harder: a two-minute stir inside a fifteen-minute interval can put the
+        // mean out of band while the wearer was asleep for thirteen of those minutes. The median rejects
+        // a SUSTAINED elevation just as firmly, which is the discrimination this gate exists to make.
+        val medianHR = HrvAnalyzer.median(seg.map { it.bpm.toDouble() })
+        return medianHR <= baseline * hrSleepBandMult
     }
 
     /** Per-record sleep flags from a rolling fraction of "still" samples. */
@@ -594,31 +624,116 @@ object SleepStager {
     }
 
     /**
-     * Sparse-gravity bridge (#308): merge two adjacent SLEEP runs separated ONLY by a gap up to
-     * sparseBridgeGapMin minutes when the intervening HR stays in the sleep band — so a real night
-     * fragmented by gravity dropouts is re-stitched into one continuous in-bed span BEFORE the
-     * minSleepMin gate drops the pieces. Active runs and over-threshold gaps are left untouched; the
-     * span between two bridged sleep runs (an "active"/gap run, if present) is absorbed. A no-op when
-     * [sparse] == false, so the dense 4.0 path is unchanged. Mirrors Swift.
+     * Sparse-gravity bridge (#308): merge two SLEEP runs when the intervening HR stays in the sleep
+     * band — so a real night fragmented by gravity dropouts is re-stitched into one continuous in-bed
+     * span BEFORE the minSleepMin gate drops the pieces. A no-op when [sparse] == false, so the dense
+     * 4.0 path is unchanged. Mirrors Swift.
+     *
+     * What sits between the two runs may be a bare gap (up to [sparseBridgeGapMin]) or ONE active run
+     * (additionally up to [sparseBridgeActiveMaxMin]). Over-threshold gaps, longer active runs and two
+     * consecutive active runs are all left untouched.
+     *
+     * The previous wording here — "Active runs … are left untouched; the span between two bridged sleep
+     * runs (an "active"/gap run, if present) is absorbed" — read as though an intervening active run was
+     * already handled. It was not: only a bare gap was, and that sentence is a large part of why #1657
+     * went unnoticed. Kept in the history rather than quietly deleted, because the next person to widen
+     * this function will read this comment first.
      */
     internal fun bridgeSparseSleep(
         periods: List<Period>, sparse: Boolean, hr: List<HrSample>, baseline: Double?,
-    ): List<Period> {
-        if (!sparse || periods.isEmpty()) return periods
+    ): List<Period> = bridgeSparseSleepTraced(periods, sparse, hr, baseline).first
+
+    /**
+     * One pair the bridge looked at, for the Sleep & Rest trace. Kept beside the merge itself rather
+     * than recomputed by a shadow pass: a second implementation of this loop would have to be edited in
+     * step with the first, and a trace that silently disagrees with the behaviour it describes is worse
+     * than no trace. Mirrors Swift `SparseBridgeAttempt`.
+     */
+    internal data class SparseBridgeAttempt(
+        /** Gap between the two sleep runs, whole minutes (negative when they overlap). */
+        val gapMin: Long,
+        /** Minutes of intervening ACTIVE run, or 0 when the pair was only separated by a gap. */
+        val activeMin: Long,
+        /** Whether the intervening HR stayed in the sleep band. */
+        val hrInSleepBand: Boolean,
+        /** Whether this pair was merged. */
+        val bridged: Boolean,
+        /** Stable token: bridged / gapTooLong / hrOutOfBand / overlap / activeTooLong. */
+        val reason: String,
+    )
+
+    /**
+     * The bridge, plus what it considered. See [bridgeSparseSleep] for the merge rule.
+     *
+     * #1657: an intervening ACTIVE run no longer blocks the merge permanently. The original loop could
+     * only join runs already adjacent in its own output, so any active run between two sleep runs was
+     * appended first and made the next pair unreachable — and a field trace found the bridge merging
+     * NOTHING on 14 of 14 sparse nights for exactly that reason. Since a bathroom trip is definitionally
+     * an active run, the rescue built for fragmentation was unavailable in the case that needs it most.
+     *
+     * A single active run up to [sparseBridgeActiveMaxMin] is now absorbed, with the whole span still
+     * subject to [sparseBridgeGapMin] and to the HR band. Two or more consecutive active runs are not:
+     * that is a night with real structure in it, not one interruption.
+     */
+    internal fun bridgeSparseSleepTraced(
+        periods: List<Period>, sparse: Boolean, hr: List<HrSample>, baseline: Double?,
+    ): Pair<List<Period>, List<SparseBridgeAttempt>> {
+        if (!sparse || periods.isEmpty()) return periods to emptyList()
         val bridgeGapS = (sparseBridgeGapMin * 60).toLong()
+        val activeMaxS = (sparseBridgeActiveMaxMin * 60).toLong()
         val out = ArrayList<Period>()
+        val attempts = ArrayList<SparseBridgeAttempt>()
         for (p in periods) {
-            val last = out.lastOrNull()
-            if (last != null && last.stage == "sleep" && p.stage == "sleep") {
-                val gap = p.start - last.end
-                if (gap in 0..bridgeGapS && hrSleepBandAcross(last.end, p.start, hr, baseline)) {
-                    out[out.size - 1] = Period(stage = "sleep", start = last.start, end = p.end)
-                    continue
+            if (p.stage == "sleep") {
+                val last = out.lastOrNull()
+                // Case 1: the previous run is sleep — the original adjacent-pair merge.
+                if (last != null && last.stage == "sleep") {
+                    if (considerBridge(out, attempts, last, p, activeS = 0L, bridgeGapS, hr, baseline)) continue
+                }
+                // Case 2: exactly one active run sits between two sleep runs. Absorbed when short
+                // enough, which is the #1657 case the original loop could never reach.
+                val prev = if (out.size >= 2) out[out.size - 2] else null
+                if (last != null && last.stage == "active" && prev != null && prev.stage == "sleep") {
+                    val activeS = last.end - last.start
+                    if (considerBridge(out, attempts, prev, p, activeS, bridgeGapS, hr, baseline,
+                                       dropTrailing = true, activeMaxS = activeMaxS)) continue
                 }
             }
             out.add(p)
         }
-        return out
+        return out to attempts
+    }
+
+    /**
+     * Judge one candidate pair, record it, and merge when it passes. Returns true when [p] was absorbed.
+     *
+     * [dropTrailing] removes the intervening active run from [out] before merging — the whole point of
+     * case 2. The order of the checks fixes which reason a failing pair reports, and it is deliberate:
+     * overlap and gap are properties of the pair, activeTooLong is a property of what sits between them,
+     * and hrOutOfBand is last because it is the only one that needed the HR series to decide.
+     */
+    private fun considerBridge(
+        out: ArrayList<Period>, attempts: ArrayList<SparseBridgeAttempt>,
+        left: Period, right: Period, activeS: Long, bridgeGapS: Long,
+        hr: List<HrSample>, baseline: Double?,
+        dropTrailing: Boolean = false, activeMaxS: Long = 0L,
+    ): Boolean {
+        val gap = right.start - left.end
+        val inBand = hrSleepBandAcross(left.end, right.start, hr, baseline)
+        val reason = when {
+            gap < 0 -> "overlap"
+            gap > bridgeGapS -> "gapTooLong"
+            activeS > activeMaxS -> "activeTooLong"
+            !inBand -> "hrOutOfBand"
+            else -> "bridged"
+        }
+        val bridged = reason == "bridged"
+        attempts.add(SparseBridgeAttempt(gapMin = gap / 60, activeMin = activeS / 60,
+                                         hrInSleepBand = inBand, bridged = bridged, reason = reason))
+        if (!bridged) return false
+        if (dropTrailing) out.removeAt(out.size - 1)
+        out[out.size - 1] = Period(stage = "sleep", start = left.start, end = right.end)
+        return true
     }
 
     // ── HR refinement ────────────────────────────────────────────────────────
@@ -1148,7 +1263,8 @@ object SleepStager {
         runs = mergePeriods(runs)
         // Re-stitch sleep runs fragmented by pure gravity dropouts (sparse only) before minSleepMin.
         val runsBeforeBridge = if (traceSink == null) 0 else runs.count { it.stage == "sleep" }
-        runs = bridgeSparseSleep(runs, sparse = sparse, hr = hrS, baseline = baseline)
+        val bridged = bridgeSparseSleepTraced(runs, sparse = sparse, hr = hrS, baseline = baseline)
+        runs = bridged.first
         // Sleep & Rest test mode (E10): record the sparse-gravity bridge result, so a sparse 5.0 night
         // rescued from fragmentation is visible. Only when gravity is sparse and only when tracing.
         if (traceSink != null && sparse) {
@@ -1156,6 +1272,24 @@ object SleepStager {
             traceSink(SleepStagerTrace.runLine(-1, 0, 0,
                 if (runsAfterBridge < runsBeforeBridge) SleepStagerTrace.Verdict.KEPT else SleepStagerTrace.Verdict.DROPPED,
                 "sparseBridge", "sparse=true gapMin=$sparseBridgeGapMin runsBefore=$runsBeforeBridge runsAfter=$runsAfterBridge"))
+            // #1657: one line per pair the bridge CONSIDERED, ported from Swift and extended with the
+            // intervening active run's length. No lines at all still means no candidate pair existed;
+            // an activeTooLong line names the bound that blocked one, which is the number a future
+            // reader needs and the old trace could not supply. Android had NONE of this before — the
+            // line that made #1657 diagnosable was iOS-only, so an Android reporter saw runsBefore ==
+            // runsAfter and no reason at all.
+            if (bridged.second.isEmpty()) {
+                traceSink(SleepStagerTrace.runLine(-1, 0, 0, SleepStagerTrace.Verdict.DROPPED,
+                    "sparseBridge",
+                    "no candidate pairs (one sleep run, or fragments split by consecutive active runs)"))
+            }
+            for ((i, a) in bridged.second.withIndex()) {
+                traceSink(SleepStagerTrace.runLine(-1, 0, 0,
+                    if (a.bridged) SleepStagerTrace.Verdict.KEPT else SleepStagerTrace.Verdict.DROPPED,
+                    "sparseBridgePair",
+                    "pair=$i gapMin=${a.gapMin} activeMin=${a.activeMin} " +
+                        "hrInSleepBand=${a.hrInSleepBand} reason=${a.reason}"))
+            }
         }
 
         val minSleepS = (minSleepMin * 60).toLong()
diff --git a/android/app/src/test/java/com/noop/analytics/SleepStagerActiveBridgeTest.kt b/android/app/src/test/java/com/noop/analytics/SleepStagerActiveBridgeTest.kt
new file mode 100644
index 0000000000..e4bacdfe5d
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/SleepStagerActiveBridgeTest.kt
@@ -0,0 +1,230 @@
+package com.noop.analytics
+
+import com.noop.data.HrSample
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #1657: the sparse-gravity bridge could only ever join sleep runs already adjacent in its own output,
+ * so ANY active run between two sleep runs blocked the merge permanently. A field trace found it merging
+ * nothing on 14 of 14 sparse nights for exactly that reason — and since a bathroom trip is definitionally
+ * an active run, the rescue built for fragmentation was unavailable in the case that needs it most.
+ *
+ * The pieces then died at the 60-minute session floor, which is how a 6h40m night scored 150 minutes.
+ */
+class SleepStagerActiveBridgeTest {
+
+    private fun sleep(start: Long, end: Long) = SleepStager.Period("sleep", start, end)
+    private fun active(start: Long, end: Long) = SleepStager.Period("active", start, end)
+
+    /** Flat HR well under the band, so the HR gate is never the thing under test. */
+    private fun calmHr(from: Long, to: Long, bpm: Int = 50): List<HrSample> =
+        (from..to step 60).map { HrSample(deviceId = "dev", ts = it, bpm = bpm) }
+
+    private val baseline = 60.0
+
+    /**
+     * THE reported shape: asleep, a short trip, asleep again. Each piece is under the 60-minute session
+     * floor on its own; together they are a night.
+     */
+    @Test
+    fun `a short active interruption between two sleep runs is absorbed`() {
+        val periods = listOf(sleep(0, 3000), active(3000, 3900), sleep(3900, 9000))
+        val out = SleepStager.bridgeSparseSleep(periods, sparse = true, hr = calmHr(0, 9000), baseline = baseline)
+        assertEquals(1, out.size)
+        assertEquals("sleep", out[0].stage)
+        assertEquals(0L, out[0].start)
+        assertEquals(9000L, out[0].end)
+    }
+
+    /**
+     * The guard that keeps this honest. A long active run is a real break in the night, not a stir, and
+     * absorbing it would score wakefulness as sleep — wrong in a new direction and harder to notice than
+     * the truncation being fixed.
+     */
+    @Test
+    fun `an active run longer than the bound is left alone`() {
+        val tooLong = (SleepStager.sparseBridgeActiveMaxMin * 60L) + 60L
+        val periods = listOf(sleep(0, 3000), active(3000, 3000 + tooLong), sleep(3000 + tooLong, 9000))
+        val out = SleepStager.bridgeSparseSleep(periods, sparse = true, hr = calmHr(0, 9000), baseline = baseline)
+        assertEquals(3, out.size)
+    }
+
+    /**
+     * HR is the real gate, not the duration bound. A wearer who is genuinely up keeps HR elevated for the
+     * whole interruption, and that must still block the merge even when it is short.
+     */
+    @Test
+    fun `a short interruption with elevated HR is not absorbed`() {
+        val periods = listOf(sleep(0, 3000), active(3000, 3900), sleep(3900, 9000))
+        val hot = calmHr(0, 3000) + calmHr(3001, 3900, bpm = 110) + calmHr(3901, 9000)
+        val out = SleepStager.bridgeSparseSleep(periods, sparse = true, hr = hot, baseline = baseline)
+        assertEquals(3, out.size)
+    }
+
+    /**
+     * Two consecutive active runs are a night with structure in it, not one interruption. Only a single
+     * intervening run is absorbed, or the bridge would walk across an arbitrarily fragmented evening.
+     */
+    @Test
+    fun `two consecutive active runs are not absorbed`() {
+        val periods = listOf(
+            sleep(0, 3000), active(3000, 3300), active(3300, 3900), sleep(3900, 9000),
+        )
+        val out = SleepStager.bridgeSparseSleep(periods, sparse = true, hr = calmHr(0, 9000), baseline = baseline)
+        assertEquals(4, out.size)
+    }
+
+    /** A dense 4.0 night must be byte-identical: the bridge is sparse-only and always has been. */
+    @Test
+    fun `a dense night is untouched`() {
+        val periods = listOf(sleep(0, 3000), active(3000, 3900), sleep(3900, 9000))
+        val out = SleepStager.bridgeSparseSleep(periods, sparse = false, hr = calmHr(0, 9000), baseline = baseline)
+        assertEquals(periods, out)
+    }
+
+    /** The pre-existing behaviour — a bare gap between two sleep runs — still merges. */
+    @Test
+    fun `the original adjacent-pair merge still works`() {
+        val periods = listOf(sleep(0, 3000), sleep(3600, 9000))
+        val out = SleepStager.bridgeSparseSleep(periods, sparse = true, hr = calmHr(0, 9000), baseline = baseline)
+        assertEquals(1, out.size)
+        assertEquals(9000L, out[0].end)
+    }
+
+    /**
+     * The trace has to say WHY, and the blocking length is the number a reader needs. The old trace could
+     * only report runsBefore == runsAfter, which says the bridge did nothing and not what stopped it.
+     */
+    @Test
+    fun `a blocked pair reports the bound that blocked it, with the active length`() {
+        val tooLong = (SleepStager.sparseBridgeActiveMaxMin * 60L) + 60L
+        val periods = listOf(sleep(0, 3000), active(3000, 3000 + tooLong), sleep(3000 + tooLong, 9000))
+        val (_, attempts) = SleepStager.bridgeSparseSleepTraced(
+            periods, sparse = true, hr = calmHr(0, 9000), baseline = baseline,
+        )
+        assertEquals(1, attempts.size)
+        assertEquals("activeTooLong", attempts[0].reason)
+        assertFalse(attempts[0].bridged)
+        assertEquals(SleepStager.sparseBridgeActiveMaxMin + 1L, attempts[0].activeMin)
+    }
+
+    /**
+     * The tracer and the merge are ONE pass. Swift kept a shadow copy of the loop purely to trace it,
+     * which has to be edited in step with the real one — a trace that quietly disagrees with the
+     * behaviour it describes is worse than no trace at all.
+     */
+    @Test
+    fun `the traced pass returns exactly what the plain one does`() {
+        val periods = listOf(sleep(0, 3000), active(3000, 3900), sleep(3900, 9000))
+        val hr = calmHr(0, 9000)
+        assertEquals(
+            SleepStager.bridgeSparseSleep(periods, sparse = true, hr = hr, baseline = baseline),
+            SleepStager.bridgeSparseSleepTraced(periods, sparse = true, hr = hr, baseline = baseline).first,
+        )
+    }
+
+    /**
+     * #1657, the other half: hrSleepBandAcross judged on the MEAN, which a single arousal spike drags out
+     * of band — the exact statistic confirmSleepWithHR documents as wrong for this, and uses the median
+     * for instead. A sustained elevation must still be rejected, or the gate stops discriminating.
+     */
+    @Test
+    fun `a brief spike no longer puts the whole interval out of band, a sustained one still does`() {
+        val spiky = calmHr(0, 3540) + calmHr(3541, 3660, bpm = 190)
+        assertTrue(SleepStager.hrSleepBandAcross(0, 3660, spiky, baseline))
+        val sustained = calmHr(0, 3660, bpm = 110)
+        assertFalse(SleepStager.hrSleepBandAcross(0, 3660, sustained, baseline))
+    }
+
+    // ── End to end, through detectSleep ──────────────────────────────────────────────────────────
+    //
+    // The unit cases above pin the bridge. These pin the thing the reporter actually saw: a night with
+    // one interruption in it arriving as ONE session instead of a truncated fragment.
+
+    private val dev = "test"
+    /** 2025-06-10 00:00:00 UTC. */
+    private val refMidnight = 1_749_513_600L
+    private fun at(hour: Int, min: Int = 0) = refMidnight + hour * 3_600L + min * 60L
+
+    /** Still gravity at 1/min — constant orientation, so every delta is 0. */
+    private fun still(from: Long, toExclusive: Long) =
+        (from until toExclusive step 60).map {
+            com.noop.data.GravitySample(deviceId = dev, ts = it, x = 0.0, y = 0.0, z = 1.0)
+        }
+
+    /** Moving gravity at 1/min — orientation swings every sample, so deltas are large. */
+    private fun moving(from: Long, toExclusive: Long) =
+        (from until toExclusive step 60).mapIndexed { i, _ -> i }.map { i ->
+            val t = from + i * 60L
+            if (i % 2 == 0) com.noop.data.GravitySample(deviceId = dev, ts = t, x = 1.0, y = 0.0, z = 0.0)
+            else com.noop.data.GravitySample(deviceId = dev, ts = t, x = 0.0, y = 1.0, z = 0.0)
+        }
+
+    private fun hr1Hz(from: Long, toExclusive: Long, bpm: Int) =
+        (from until toExclusive).map { HrSample(deviceId = dev, ts = it, bpm = bpm) }
+
+    /**
+     * A night with a 30-minute gravity dropout early (so the night reads sparse, as a 5/MG's does) and a
+     * 15-minute up-and-about in the middle. Before #1657 the active run made the two sleep halves
+     * unreachable to the bridge and each half faced the 60-minute floor alone.
+     */
+    private fun interruptedNight(tripBpm: Int): Pair<List<HrSample>, List<com.noop.data.GravitySample>> {
+        val grav = still(at(0), at(0, 30)) +           // 00:00-00:30 asleep
+            still(at(1), at(2)) +                       // 00:30-01:00 DROPOUT, then 01:00-02:00 asleep
+            moving(at(2), at(2, 15)) +                  // 02:00-02:15 up
+            still(at(2, 15), at(6))                     // 02:15-06:00 asleep again
+        val hr = hr1Hz(at(0), at(2), 50) +
+            hr1Hz(at(2), at(2, 15), tripBpm) +
+            hr1Hz(at(2, 15), at(6), 50)
+        return hr to grav
+    }
+
+    @Test
+    fun `a night with one short interruption is detected as a single session`() {
+        val (hr, grav) = interruptedNight(tripBpm = 52)
+        assertTrue("the fixture must read as sparse", SleepStager.isGravitySparse(grav, hr))
+        val sessions = SleepStager.detectSleep(hr = hr, gravity = grav)
+        assertEquals("the interruption must not end the night", 1, sessions.size)
+        val spanMin = (sessions[0].end - sessions[0].start) / 60.0
+        assertTrue("the whole night should survive, got $spanMin min", spanMin > 5 * 60)
+    }
+
+    /**
+     * The same night with the wearer genuinely up — HR elevated for the whole quarter hour. The bridge
+     * must decline, because absorbing that would score wakefulness as sleep: wrong in a new direction and
+     * harder to notice than the truncation being fixed.
+     */
+    @Test
+    fun `the same night with a genuinely awake interruption is not bridged into one`() {
+        val (hr, grav) = interruptedNight(tripBpm = 110)
+        val sessions = SleepStager.detectSleep(hr = hr, gravity = grav)
+        val spanMin = sessions.sumOf { (it.end - it.start) / 60.0 }
+        assertTrue("an awake interruption must not be absorbed (got ${sessions.size} sessions, $spanMin min)",
+            sessions.size != 1 || spanMin < 5 * 60)
+    }
+
+    /**
+     * The RENDERED line, not just the fields — and deliberately the whole string, byte for byte.
+     *
+     * The Swift twin asserts this identical literal. Nothing in the tree compares the two languages'
+     * trace output automatically (Tools/parity_cases holds one unrelated fixture), so a format change on
+     * one side would otherwise diverge in silence and only surface when someone tried to read a capture
+     * from the other platform. Pinning the same literal both sides turns that into a failing test on
+     * whichever side moved.
+     */
+    @Test
+    fun `the pair line renders exactly as its Swift twin does`() {
+        val line = SleepStagerTrace.runLine(
+            -1, 0, 0, SleepStagerTrace.Verdict.DROPPED, "sparseBridgePair",
+            "pair=0 gapMin=23 activeMin=21 hrInSleepBand=true reason=activeTooLong",
+        )
+        assertEquals(
+            "gate run=-1 spanS=0 DROPPED gate=sparseBridgePair " +
+                "pair=0 gapMin=23 activeMin=21 hrInSleepBand=true reason=activeTooLong",
+            line,
+        )
+    }
+}

From 1253ce2e99157063a438d62126f7cc3a6e650551 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 15:10:38 +1200
Subject: [PATCH 105/333] staging: build 395 / iOS 276 for the sleep-bridge
 work

Build numbers only - 10.6.1 stays the unreleased line, and 395 clears the staging
high-water so the APK installs over 394.

Carries the sparse-bridge change: a night interrupted by one short trip out of bed
is no longer ended at the interruption. Anyone whose nights were being truncated
that way should see fuller totals; the honest caveat is that the absorbed minutes
land in sleep rather than wake, because both stagers call wake off HR and the bridge
only absorbs spans whose HR was already in the sleep band.

Also the #1746 PENDING-ack change, so one "offsets may have moved" line per sync
stops appearing on healthy 4.0 hardware, and the per-strap Last sync / Data write
attribution from #1745.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index cf5c6bad50..0ff3147710 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 394
+        versionCode = 395
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index fa4e5a3af9..29422abae3 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "275"
+    CURRENT_PROJECT_VERSION: "276"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 7960c0cefbde947074188b915a29a4b3b124a970 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 16:15:27 +1200
Subject: [PATCH 106/333] The unbonded offload probe must not start on top of
 the DIS chain (#1756)

Found in the 13:17 capture, and it was my own scheduling rather than the strap.

DIS reads and CCCD writes share ONE serialized GATT queue. The probe was posted on a
fixed 6s delay, chosen on the reasoning that the DIS chain - posted at 3s - would be
done by then. On one link it was still running at 7s:

  07:57:06  writeDescriptor busy for fd4b0003 ... retry 1/8
  07:57:06  ... 8 busy retries across the four chars, shared budget exhausted
  07:57:06  writeDescriptor rejected for fd4b0003/4/5/7 (gave up after 8 retries)
  07:57:06  Unbonded offload probe: none of the 4 ... completed their subscribe, and
            none was refused either ... proves nothing either way
  07:57:07  DIS: modelNumber=MG            <- the chain, still going

Not one descriptor write reached the air. Reasoning about a delay lost to measuring
one. The probe now waits on the actual signal, checked once a second and bounded at
eight checks, then goes anyway and says which happened.

The same log also handed over a control case that #1749 asserted without one. Every
link whose CCCD writes reached the air died at 10.8s - 4.8s after the probe, by
localTerminate, the CLIENT_HELLO's own signature. The ONE link where all four writes
were abandoned locally lived 31.3s and died of an ordinary connectionTimeout. The
teardown tracks the write reaching the strap, not the probe running.

Three review passes, and all three found the same shape of defect: a flag claiming
something that had not happened.

  1. the contention itself
  2. disChainInFlight was set BEFORE readDisIdentity, which has five early returns
     above the read it issues plus an unavailable-characteristic branch - so on any of
     those the probe stood aside for a chain that never started. readDisIdentity now
     reports whether it ISSUED a read, and the flag is set from that answer rather
     than from the intention to ask.
  3. readNextDisExtra is only reached from the SUCCESS path, so a REFUSED read ended
     the chain while the flag stayed set - and #490's whole subject is a strap that
     refuses DIS, so that was the case the probe most wanted a clear queue for.

All three were survivable because the cap bounds them, which is exactly why they
would have gone unnoticed: a wrong wait that self-corrects looks like a working wait.

The wait decision also moved into a pure helper beside the rest of this file's
judgements. It was inline in the client - argued for in a comment and asserted
nowhere - which is precisely how #1755 shipped a bound every unit test agreed with
and the real pipeline rejected.

Parity checked rather than assumed: the DisUnbondedRead pure twin pair is untouched,
four functions each side, and Swift performs its DIS read inline with no
readDisIdentity counterpart, so the Bool return has no twin to keep in step. That
structural difference predates this work. Everything else is the probe, Android-only
by design.

Staging 396 / iOS 277. 4,941 tests, zero failures. Doc lint and i18n clean. The next
capture is what confirms the probe now starts on a clear queue.
---
 android/app/build.gradle.kts                  |  2 +-
 .../java/com/noop/ble/UnbondedOffloadProbe.kt | 46 +++++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 67 ++++++++++++++++---
 .../com/noop/ble/UnbondedOffloadProbeTest.kt  | 48 +++++++++++++
 project.yml                                   |  2 +-
 5 files changed, 152 insertions(+), 13 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 0ff3147710..f646b82987 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 395
+        versionCode = 396
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
index cc7a06343b..c200376117 100644
--- a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
+++ b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
@@ -269,6 +269,52 @@ internal fun unbondedProbeLinkLostAskingLine(uptimeMs: Long, waitedMs: Long): St
         " GET_CLOCK went out. The subscribes had landed, so the transport was open and the strap was still" +
         " inside its window to answer — this link settles nothing either way (#1635)."
 
+/**
+ * How many times the probe may stand aside for the DIS chain before going anyway.
+ *
+ * A cap rather than an open wait, because the chain has exits that never reach its terminal — a refused
+ * read, or a strap that stops answering part-way — and a probe waiting on a flag nobody will clear would
+ * simply never run. Eight checks at a second each, then it takes its chances and the trace says which
+ * happened.
+ */
+internal const val UNBONDED_PROBE_MAX_DEFERRALS = 8
+
+/**
+ * Should the probe wait rather than start?
+ *
+ * Pure so the decision is testable without a GATT stack, like every other judgement in this file. It was
+ * briefly inline in the client, which is how the same class of gap reached #1755: the behaviour was
+ * argued for in a comment and asserted nowhere.
+ */
+internal fun unbondedProbeShouldWaitForDis(
+    disChainInFlight: Boolean,
+    deferralsSoFar: Int,
+    cap: Int = UNBONDED_PROBE_MAX_DEFERRALS,
+): Boolean = disChainInFlight && deferralsSoFar < cap
+
+/**
+ * The probe is holding off because the unbonded DIS chain still has the GATT queue.
+ *
+ * Logged once per link rather than per deferral: the useful fact is that it waited at all, and a line a
+ * second for eight seconds would bury it. Without this the probe simply appears late in a capture with
+ * no reason given, which is the shape of problem this whole area keeps producing.
+ */
+internal fun unbondedProbeWaitingForDisLine(): String =
+    "Unbonded offload probe: waiting for the DIS read chain to finish — they share one GATT queue, and" +
+        " starting on top of it makes every CCCD write come back busy (#1635)."
+
+/**
+ * The wait ran out and the probe went anyway.
+ *
+ * Not a failure. The DIS chain has exits that never reach its terminal — a refused read, or a strap that
+ * stops answering part-way — so a probe that waited on the flag forever would never run at all. Saying
+ * which of the two happened is the point: a probe that waited the full budget and then found a busy queue
+ * is a different capture from one that started cleanly.
+ */
+internal fun unbondedProbeStoppedWaitingLine(deferrals: Int): String =
+    "Unbonded offload probe: the DIS chain has not finished after $deferrals checks — starting anyway." +
+        " If the subscribes come back busy, that queue is why, not the strap (#1635)."
+
 /**
  * Stage 2's question, logged so the wait that follows is attributable to it.
  *
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index f56b7850f8..6d0ff0392c 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -883,6 +883,10 @@ class WhoopBleClient(
          *  stable, while the cost of asking too early is a false "does not answer" that closes #1635 the
          *  wrong way. */
         private const val UNBONDED_PROBE_REPLY_WAIT_MS = 8_000L
+
+        /** #1635: how long the probe waits between checks while the unbonded DIS chain is still running. */
+        private const val UNBONDED_PROBE_DEFER_MS = 1_000L
+
         /** 5/MG zero-frame retry: pause before re-requesting history when a session timed out having
          *  produced nothing (the first request after connect can go entirely unanswered). */
         private const val WHOOP5_HISTORY_RETRY_DELAY_MS = 700L
@@ -2407,6 +2411,20 @@ class WhoopBleClient(
      *  how surprises get in. */
     private val unbondedProbeStartRunnable = Runnable { gatt?.let { beginUnbondedOffloadProbe(it) } }
 
+    /**
+     * #1635: the unbonded DIS read chain is mid-flight.
+     *
+     * DIS reads and CCCD writes share ONE serialized GATT queue, and a field capture showed why that
+     * matters: the probe fired while the chain was still running, every descriptor write came back
+     * `writeDescriptor busy`, all four gave up after the shared 8-retry budget, and the link produced no
+     * answer at all. The probe had been scheduled on a fixed delay chosen on the reasoning that three
+     * seconds was enough separation — on that link the chain was still going at seven.
+     */
+    private var disChainInFlight = false
+
+    /** #1635: how many times the probe has stood aside for the DIS chain on this link. */
+    private var unbondedProbeDeferrals = 0
+
     /** #1635: links that subscribed the puffin chars and drew no reply. Per PROCESS, deliberately NOT
      *  cleared by [reset] — its whole job is to bound a retry that spans reconnects. A refusal latches per
      *  device instead; silence is weaker evidence and gets a budget rather than a verdict. */
@@ -4637,18 +4655,23 @@ class WhoopBleClient(
      * hardware-revision read is issued from [onInbound] once the serial lands. Firing both here would
      * silently drop the second. Read-only and non-fatal: any failure just leaves the variant UNKNOWN.
      */
-    fun readDisIdentity() {
-        if (disRead) return
-        val g = gatt ?: return
-        if (connectedFamily == DeviceFamily.WHOOP4) return
-        val ops = gattOps ?: return
+    fun readDisIdentity(): Boolean {
+        // Returns whether a read was actually ISSUED, so a caller can tell "the chain is running" from
+        // "the chain never started". Every branch above the read is an exit that leaves nothing in
+        // flight, and the unbonded offload probe waits on this answer — told `true` unconditionally it
+        // would stand aside for a chain that does not exist and burn its whole budget for nothing.
+        if (disRead) return false
+        val g = gatt ?: return false
+        if (connectedFamily == DeviceFamily.WHOOP4) return false
+        val ops = gattOps ?: return false
         val ch = g.getService(DIS_SERVICE)?.getCharacteristic(DIS_SERIAL_CHAR)
         if (ch != null && (ch.properties and BluetoothGattCharacteristic.PROPERTY_READ) != 0) {
             disRead = true
             safeGatt("readCharacteristic(dis-serial)") { ops.readCharacteristicCompat(ch) }
-        } else {
-            log("DIS: serial characteristic unavailable — hardware variant stays unknown")
+            return true
         }
+        log("DIS: serial characteristic unavailable — hardware variant stays unknown")
+        return false
     }
 
     /**
@@ -4664,6 +4687,11 @@ class WhoopBleClient(
      */
     private fun noteReadFailure(uuid: java.util.UUID, status: Int) {
         if (uuid !in DIS_CHARS) return
+        // The chain is over. readNextDisExtra is only reached from the SUCCESS path, so a refused read
+        // ends it with nothing further in flight — and #490's whole subject is a strap that refuses. Left
+        // set, the unbonded offload probe would stand aside for its full budget waiting on a chain that
+        // had already died, in exactly the case the probe most wants a clear queue for.
+        disChainInFlight = false
         log(disReadFailureLine(uuid.toString(), gattWriteStatusLabel(status)))
         // Report it, but do NOT latch it when WE put a pairing in flight on this link. The latch is
         // persisted per device and permanent, and a read issued into a link that is mid-encryption
@@ -4718,7 +4746,7 @@ class WhoopBleClient(
         ) return
         log("DIS: trying the identity read on an UNbonded link — unproven, and a refusal is itself the" +
             " answer to whether DIS needs an encrypted bond (#490)")
-        readDisIdentity()
+        disChainInFlight = readDisIdentity()
     }
 
     /**
@@ -4763,6 +4791,19 @@ class WhoopBleClient(
                 silentLinksSoFar = unbondedProbeSilentLinks,
             )
         ) return
+        // Stand aside while the DIS chain still holds the one serialized GATT queue. The fixed 6s delay
+        // this used to rely on was chosen by reasoning and was wrong: a capture caught the chain still
+        // running at 7s, every CCCD write returning busy, all four abandoned after the shared retry
+        // budget, and the link yielding no answer. Waiting on the actual signal costs a second and
+        // removes the guess.
+        if (unbondedProbeShouldWaitForDis(disChainInFlight, unbondedProbeDeferrals)) {
+            unbondedProbeDeferrals++
+            if (unbondedProbeDeferrals == 1) log(unbondedProbeWaitingForDisLine())
+            handler.removeCallbacks(unbondedProbeStartRunnable)
+            handler.postDelayed(unbondedProbeStartRunnable, UNBONDED_PROBE_DEFER_MS)
+            return
+        }
+        if (disChainInFlight) log(unbondedProbeStoppedWaitingLine(unbondedProbeDeferrals))
         val svc = g.getService(WHOOP5_SERVICE) ?: return
         // Claim the link BEFORE queueing, so a keep-alive drain landing between the two cannot start a
         // second probe against the same four characteristics.
@@ -4967,10 +5008,12 @@ class WhoopBleClient(
             DIS_FW_REV_CHAR -> DIS_MANUFACTURER_CHAR
             DIS_MANUFACTURER_CHAR -> DIS_MODEL_NUMBER_CHAR
             DIS_MODEL_NUMBER_CHAR -> DIS_SW_REV_CHAR
-            else -> return
+            // Chain complete. Releasing the queue here is what lets the unbonded offload probe start
+            // without contending with it (#1635).
+            else -> { disChainInFlight = false; return }
         }
-        val g = gatt ?: return
-        val ops = gattOps ?: return
+        val g = gatt ?: run { disChainInFlight = false; return }
+        val ops = gattOps ?: run { disChainInFlight = false; return }
         val ch = g.getService(DIS_SERVICE)?.getCharacteristic(next)
         if (ch == null || (ch.properties and BluetoothGattCharacteristic.PROPERTY_READ) == 0) {
             // Not present on this strap: skip it and carry on down the chain rather than stopping.
@@ -9831,6 +9874,8 @@ class WhoopBleClient(
             }
         }
         unbondedProbeStartedThisLink = false
+        unbondedProbeDeferrals = 0
+        disChainInFlight = false
         unbondedProbeSubscribed = 0
         unbondedProbeSubscribing = false
         unbondedProbeAwaitingReply = false
diff --git a/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt b/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
index d31e25e60f..d01075f7c3 100644
--- a/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
+++ b/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
@@ -353,4 +353,52 @@ class UnbondedOffloadProbeTest {
         )
         for (line in lines) assertTrue(line, line.contains("#1635"))
     }
+
+    /**
+     * #1635, from the field. The probe used to start on a fixed 6-second delay, chosen on the reasoning
+     * that the DIS chain (scheduled at 3s) would be done by then. A capture caught the chain still
+     * running at 7s: every CCCD write returned busy, all four were abandoned after the shared 8-retry
+     * budget, and the link produced no answer at all. Reasoning about a delay lost to measuring one.
+     */
+    @Test
+    fun `the waiting line says why the probe is late, and names the shared queue`() {
+        val line = unbondedProbeWaitingForDisLine()
+        assertTrue(line.contains("DIS read chain"))
+        assertTrue(line.contains("one GATT queue"))
+        assertTrue(line.contains("busy"))
+        assertTrue(line.contains("#1635"))
+    }
+
+    /**
+     * The wait must end. The DIS chain has exits that never reach its terminal — a refused read, or a
+     * strap that stops answering part-way — so a probe that waited on the flag would never run at all.
+     * The line has to distinguish "started cleanly" from "gave up waiting", because a busy queue after
+     * the full budget is a different capture from a busy queue at second one.
+     */
+    @Test
+    fun `giving up waiting is reported as a choice, not a failure`() {
+        val line = unbondedProbeStoppedWaitingLine(8)
+        assertTrue(line.contains("after 8 checks"))
+        assertTrue(line.contains("starting anyway"))
+        assertTrue(line.contains("not the strap"))
+        assertTrue(line.contains("#1635"))
+    }
+
+    /**
+     * The decision itself, not just the line that describes it. It was briefly inline in the client,
+     * argued for in a comment and asserted nowhere — which is exactly how #1755 shipped a bound that
+     * every unit test agreed with and the real pipeline rejected.
+     */
+    @Test
+    fun `the probe waits only while the DIS chain is actually running, and only so long`() {
+        assertTrue(unbondedProbeShouldWaitForDis(disChainInFlight = true, deferralsSoFar = 0))
+        assertTrue(unbondedProbeShouldWaitForDis(true, UNBONDED_PROBE_MAX_DEFERRALS - 1))
+        // The cap must end the wait: the chain has exits that never reach its terminal, so a probe
+        // waiting on a flag nobody clears would never run at all.
+        assertFalse(unbondedProbeShouldWaitForDis(true, UNBONDED_PROBE_MAX_DEFERRALS))
+        assertFalse(unbondedProbeShouldWaitForDis(true, UNBONDED_PROBE_MAX_DEFERRALS + 5))
+        // And no chain means no waiting — the whole point of readDisIdentity reporting whether it
+        // actually issued a read rather than being assumed to have.
+        assertFalse(unbondedProbeShouldWaitForDis(disChainInFlight = false, deferralsSoFar = 0))
+    }
 }
diff --git a/project.yml b/project.yml
index 29422abae3..182679f829 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "276"
+    CURRENT_PROJECT_VERSION: "277"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 2fe3a5c92cb46ec338a798c9b7d097022f202814 Mon Sep 17 00:00:00 2001
From: Dennis Wehrmann <d.wehrmann@bureau-wehrmann.eu>
Date: Mon, 31 Aug 2026 06:30:16 +0200
Subject: [PATCH 107/333] Coach: retire the transcript on a new local day
 (#1542)

The Coach kept answering today's question inside yesterday's conversation.

CoachViewModel._messages is in-memory and only reset by clearing the API key or
switching provider, and the ViewModel outlives a night - Android keeps the process
around for days. The DATA was never stale: buildContext() re-reads the store on every
send. It is the assistant's own earlier turns stating yesterday's figures, and the
model staying consistent with them, which reads as "the coach only talks about my
imported data" after a night of fresh strap data. Force-quitting was the only cure.
MAX_STORED_MESSAGES already bounded the transcript's SIZE for the same
long-lived-session reason; this bounds its AGE.

isStaleConversation is strictly forward (`>`, never `!=`), so a clock moving BACKWARDS
- flying west, a timezone change, an NTP correction - cannot wipe a conversation the
user is mid-way through. @dwehrmann mutation-verified that: relaxing it to `!=` fails
two of the six cases, so the test has teeth on the subtle part rather than pinning a
tautology.

Better than the PR claims, and worth recording. injectContext prepends to
indexOfFirst { role == "user" }, so after the clear the new turn IS that first turn and
the context lands at the top of a fresh conversation. Previously it sat in yesterday's
opener, buried under a night of turns. This improves where context goes, not only how
recent it is.

Checked as a stale PR rather than trusted: opened 22 August, main 226 commits ahead,
and its CI ran when only three checks existed. Merged locally onto current main -
clean, 4,947 tests, zero failures, CoachConversationDayTest 6/6, doc lint and i18n
clean.

One inconsistency left alone: conversationDay is not reset at the two existing
_messages.value = emptyList() sites. Harmless - a stale day just clears an already
empty list - but the field outlives what it describes.

Thanks @dwehrmann. The parity gap was flagged rather than papered over, with the
reason - app-target Swift needs Xcode, and a compile error there passes every green
check. That is the right call, and the Swift twin follows separately now that it can
be compiled and run.
---
 .../main/java/com/noop/ui/CoachViewModel.kt   | 33 +++++++++++
 .../com/noop/ui/CoachConversationDayTest.kt   | 58 +++++++++++++++++++
 2 files changed, 91 insertions(+)
 create mode 100644 android/app/src/test/java/com/noop/ui/CoachConversationDayTest.kt

diff --git a/android/app/src/main/java/com/noop/ui/CoachViewModel.kt b/android/app/src/main/java/com/noop/ui/CoachViewModel.kt
index 2a3de8fcf4..448c1e6f91 100644
--- a/android/app/src/main/java/com/noop/ui/CoachViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/CoachViewModel.kt
@@ -16,6 +16,7 @@ import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.launch
+import java.time.LocalDate
 
 /**
  * View model for the AI Coach screen.
@@ -275,6 +276,10 @@ class CoachViewModel(app: Application) : AndroidViewModel(app) {
 
     // MARK: - Send
 
+    /** Local day ([LocalDate.toEpochDay]) the current transcript was last written on; null while it is
+     *  empty. Drives the day boundary in [send] — see [isStaleConversation]. */
+    private var conversationDay: Long? = null
+
     /** Append [msg] to the transcript, trimming to the newest [MAX_STORED_MESSAGES] so the in-memory list
      *  (and the Compose transcript) stays bounded over a long-lived session. (parity with Swift) */
     private fun appendMessage(msg: ChatMsg) {
@@ -289,6 +294,20 @@ class CoachViewModel(app: Application) : AndroidViewModel(app) {
         val question = text.trim()
         if (question.isEmpty() || _sending.value) return
 
+        // A transcript from an earlier local day is retired before the new turn is appended. The
+        // ViewModel outlives a night (Android keeps the process around for days), so without this the
+        // coach answers TODAY's question inside YESTERDAY's conversation: buildContext() re-reads the
+        // store on every send, so the numbers are current, but the assistant's own earlier turns state
+        // yesterday's figures and the model stays consistent with them. Reported as "the coach only
+        // talks about my imported data" after a night of fresh strap data — force-quitting the app
+        // (which destroys the ViewModel) was the only cure. MAX_STORED_MESSAGES bounds the transcript's
+        // SIZE; this bounds its AGE.
+        val today = LocalDate.now().toEpochDay()
+        if (isStaleConversation(conversationDay, today)) {
+            _messages.value = emptyList()
+        }
+        conversationDay = today
+
         val appCtx = ctx.applicationContext
         _error.value = null
         appendMessage(ChatMsg(role = "user", text = question))
@@ -333,6 +352,20 @@ class CoachViewModel(app: Application) : AndroidViewModel(app) {
          */
         private const val MAX_STORED_MESSAGES = 40
 
+        /**
+         * True when a transcript last written on [lastEpochDay] should be retired before a question
+         * asked on [todayEpochDay] — i.e. the conversation crossed into a new local day.
+         *
+         * STRICTLY forward (`>`), never `!=`: a clock that moves BACKWARDS — the user flying west, a
+         * timezone change, an NTP correction — must not wipe a conversation the user is in the middle
+         * of. Only real elapsed days retire a transcript; going back in time leaves it alone.
+         *
+         * Null [lastEpochDay] (nothing sent yet this session) is never stale. Pure companion so the
+         * rule is pinned by [com.noop.ui.CoachConversationDayTest] without a ViewModel or a framework.
+         */
+        internal fun isStaleConversation(lastEpochDay: Long?, todayEpochDay: Long): Boolean =
+            lastEpochDay != null && todayEpochDay > lastEpochDay
+
         /**
          * Initial model list for [provider]: its curated ids, plus [selected] appended if it's a
          * custom id not already in that list (so a previously-saved custom model still shows).
diff --git a/android/app/src/test/java/com/noop/ui/CoachConversationDayTest.kt b/android/app/src/test/java/com/noop/ui/CoachConversationDayTest.kt
new file mode 100644
index 0000000000..a5b014bcb6
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/CoachConversationDayTest.kt
@@ -0,0 +1,58 @@
+package com.noop.ui
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.time.LocalDate
+
+/**
+ * Pins [CoachViewModel.isStaleConversation] — the day boundary that retires the coach transcript.
+ *
+ * The bug it guards: the ViewModel outlives a night (Android keeps the process alive for days), so a
+ * question asked today was answered inside yesterday's conversation. The data context is rebuilt from
+ * the store on every send, so the numbers were current, but the assistant's own earlier turns state
+ * yesterday's figures and the model stays consistent with them — the coach "only talks about the
+ * imported data" even after a night of fresh strap data. Force-quitting was the only cure.
+ */
+class CoachConversationDayTest {
+
+    private fun day(y: Int, m: Int, d: Int) = LocalDate.of(y, m, d).toEpochDay()
+
+    @Test
+    fun freshSessionIsNeverStale() {
+        // Nothing sent yet this session: there is no transcript to retire.
+        assertFalse(CoachViewModel.isStaleConversation(null, day(2026, 8, 22)))
+    }
+
+    @Test
+    fun sameDayKeepsTheConversation() {
+        val today = day(2026, 8, 22)
+        assertFalse(CoachViewModel.isStaleConversation(today, today))
+    }
+
+    @Test
+    fun overnightRetiresTheConversation() {
+        // The reported case: last turn yesterday evening, next question this morning.
+        assertFalse(CoachViewModel.isStaleConversation(day(2026, 8, 21), day(2026, 8, 21)))
+        assertTrue(CoachViewModel.isStaleConversation(day(2026, 8, 21), day(2026, 8, 22)))
+    }
+
+    @Test
+    fun longGapRetiresTheConversation() {
+        assertTrue(CoachViewModel.isStaleConversation(day(2026, 6, 11), day(2026, 8, 22)))
+    }
+
+    @Test
+    fun clockMovingBackwardsKeepsTheConversation() {
+        // Flying west, a timezone change or an NTP correction can move the local day BACKWARDS
+        // mid-conversation. That must not wipe a transcript the user is in the middle of, which is
+        // why the rule is strictly forward (`>`) and not `!=`.
+        assertFalse(CoachViewModel.isStaleConversation(day(2026, 8, 22), day(2026, 8, 21)))
+    }
+
+    @Test
+    fun yearBoundaryIsJustAnotherDay() {
+        assertTrue(CoachViewModel.isStaleConversation(day(2025, 12, 31), day(2026, 1, 1)))
+        assertFalse(CoachViewModel.isStaleConversation(day(2026, 1, 1), day(2025, 12, 31)))
+    }
+}

From c09838cb54bee975e5c74e4ef1c88134cab10708 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 17:22:13 +1200
Subject: [PATCH 108/333] Coach: twin the day-boundary retirement on Apple
 (#1757)

The Apple half of #1542, which @dwehrmann deliberately left out rather than ship Swift
they could not compile. That was the right call, and this is the evidence: it did NOT
compile on the first attempt, and nothing in default CI would have said so.

  error: call to main actor-isolated static method
         'isStaleConversation(lastEpochDay:todayEpochDay:)' in a synchronous
         nonisolated context

AICoachEngine is @MainActor so its @Published mutations stay on the main thread, and
the statics inherited that isolation. Marked nonisolated rather than pushing @MainActor
onto the tests: they are pure functions of their arguments, touch no published state,
and the Kotlin twin is a plain companion object for the same reason. The iOS leg had
passed on the broken commit - only the macOS leg compiles StrandTests - so a
compile-only check would have called it green.

Same bug, same rule. messages is @Published and held for the app's lifetime, so the
coach answered today's question inside yesterday's conversation; the data was never
stale, it is the assistant's own earlier turns stating yesterday's figures.
isStaleConversation is strictly forward (`>`, never `!=`) so a clock moving BACKWARDS
cannot wipe a conversation mid-use, and the check sits after the guards so a send that
never happens leaves the transcript alone.

One thing is Swift-only because Swift-only needs it. Kotlin gets its epoch day from
LocalDate.toEpochDay(); this side computes one, and the obvious way - dividing a
startOfDay interval by 86,400 - is wrong, because a day is not always 86,400 seconds.
localEpochDay uses calendar day arithmetic. The re-review then caught that the DST case
written first was spring-forward, which is the obvious one and not the dangerous one: a
25-hour autumn day is where truncating whole days from a non-midnight origin could put
two local midnights in one bucket, and a transcript would then survive a night once a
year. Both directions pinned now, plus a zone west of UTC where the epoch instant falls
on the previous local day.

Also folded in, on request, and checking it corrected the claim that prompted it. I had
said Android wipes the transcript on a PROVIDER SWITCH and Apple does not. Wrong -
neither does, so that is shared behaviour rather than a divergence, and whether provider
A's history should reach provider B is a real question but the same one on both
platforms. The actual divergence was narrower: Kotlin's clearKey and disconnect have
always emptied the transcript and the Swift twins never did, so on Apple "clear my key"
removed the credential and kept the conversation, and disconnecting returned the user to
the setup screen with the whole conversation behind it. Both retire it now, and
conversationDay goes with the transcript on BOTH sides - Kotlin was not resetting it,
which is harmless but is a field claiming something untrue.

Nine Swift cases: six mirroring the Kotlin suite one-to-one, three Swift-only. app-build
green on both legs and its Strand leg RUNS StrandTests, so they execute rather than
merely compile. Android 4,947 tests, zero failures. Doc lint clean.

Staging 397 / iOS 278.
---
 Strand/AI/AICoach.swift                       |  59 +++++++++
 StrandTests/CoachConversationDayTests.swift   | 120 ++++++++++++++++++
 android/app/build.gradle.kts                  |   2 +-
 .../main/java/com/noop/ui/CoachViewModel.kt   |   4 +
 project.yml                                   |   2 +-
 5 files changed, 185 insertions(+), 2 deletions(-)
 create mode 100644 StrandTests/CoachConversationDayTests.swift

diff --git a/Strand/AI/AICoach.swift b/Strand/AI/AICoach.swift
index afc490242e..fb002d8f4b 100644
--- a/Strand/AI/AICoach.swift
+++ b/Strand/AI/AICoach.swift
@@ -156,6 +156,10 @@ final class AICoachEngine: ObservableObject {
 
     // Published state the UI binds to.
     @Published var messages: [ChatMessage] = []
+
+    /// Local day the current transcript was last written on; nil while it is empty. Drives the day
+    /// boundary in `send` — see `isStaleConversation`. Kotlin twin: `CoachViewModel.conversationDay`.
+    private var conversationDay: Int?
     @Published var sending = false
     @Published var errorText: String?
     @Published var provider: AIProvider {
@@ -361,6 +365,12 @@ final class AICoachEngine: ObservableObject {
     func disconnect() {
         AIKeyStore.clear()
         customConnected = false
+        // Retire the transcript with the connection. Kotlin has done this since the method existed
+        // (CoachViewModel.disconnect) and this side never did, so returning to the setup screen on Apple
+        // left the whole conversation sitting behind it — including whatever the user had told a coach
+        // they were in the middle of disconnecting from.
+        messages = []
+        conversationDay = nil
         objectWillChange.send()
     }
 
@@ -384,6 +394,11 @@ final class AICoachEngine: ObservableObject {
     /// Forget the stored key.
     func clearKey() {
         AIKeyStore.clear()
+        // Same reasoning as `disconnect`: clearing the key returns the user to the setup screen, and
+        // Kotlin empties the transcript when it does. Leaving it meant a "clear my key" on Apple removed
+        // the credential and kept the conversation.
+        messages = []
+        conversationDay = nil
         objectWillChange.send()
     }
 
@@ -482,6 +497,21 @@ final class AICoachEngine: ObservableObject {
         guard !trimmed.isEmpty else { errorText = AICoachError.emptyQuestion.errorDescription; return }
         guard let key = resolvedKey else { errorText = AICoachError.noKey.errorDescription; return }
 
+        // A transcript from an earlier local day is retired before the new turn is appended (#1542,
+        // Kotlin twin merged first). `messages` outlives a night — the engine is held for the app's
+        // lifetime — so without this the coach answers TODAY's question inside YESTERDAY's
+        // conversation. The DATA was never stale: buildFullContext() re-reads on every send. It is the
+        // assistant's own earlier turns stating yesterday's figures, and the model staying consistent
+        // with them, which reads as "the coach only talks about my imported data" after a night of
+        // fresh strap data.
+        //
+        // Placed AFTER the guards on purpose: a send that never happens must not wipe a transcript.
+        let today = Self.localEpochDay()
+        if Self.isStaleConversation(lastEpochDay: conversationDay, todayEpochDay: today) {
+            messages = []
+        }
+        conversationDay = today
+
         errorText = nil
         appendMessage(ChatMessage(role: .user, text: trimmed))
         sending = true
@@ -635,6 +665,35 @@ final class AICoachEngine: ObservableObject {
     /// recent `maxHistoryMessages`, dropping the middle. Sending the whole growing history crowds out the
     /// reply on small-context local servers (Ollama defaults to a 2048-token window, the Custom
     /// provider's main use case) and balloons token cost/latency on cloud providers. (parity with Android)
+    /// True when a transcript last written on `lastEpochDay` should be retired before a question asked
+    /// on `todayEpochDay` — i.e. the conversation crossed into a new local day.
+    ///
+    /// STRICTLY forward (`>`, never `!=`): a clock that moves BACKWARDS — the user flying west, a
+    /// timezone change, an NTP correction — must not wipe a conversation they are in the middle of.
+    /// Only real elapsed days retire a transcript. A nil `lastEpochDay` (nothing sent yet) is never
+    /// stale. Kotlin twin: `CoachViewModel.isStaleConversation`.
+    ///
+    /// `nonisolated` because it is a pure function of its arguments. AICoachEngine is @MainActor, so
+    /// without this the rule inherits that isolation and cannot be called from a synchronous test —
+    /// which is exactly how the first attempt at this twin failed to compile. Isolating a function
+    /// that touches no state buys nothing and costs its testability.
+    nonisolated static func isStaleConversation(lastEpochDay: Int?, todayEpochDay: Int) -> Bool {
+        guard let lastEpochDay else { return false }
+        return todayEpochDay > lastEpochDay
+    }
+
+    /// Days since the epoch in the LOCAL calendar — the twin of Kotlin's `LocalDate.now().toEpochDay()`.
+    ///
+    /// Counted with calendar day arithmetic from `startOfDay`, not by dividing an interval by 86,400:
+    /// a day is not always 86,400 seconds (DST), and the rule only needs a value that increments
+    /// exactly once per local midnight and orders correctly. Injectable so the tests never depend on
+    /// the machine's clock or zone.
+    nonisolated static func localEpochDay(_ date: Date = Date(), calendar: Calendar = .current) -> Int {
+        let start = calendar.startOfDay(for: date)
+        let epoch = Date(timeIntervalSince1970: 0)
+        return calendar.dateComponents([.day], from: epoch, to: start).day ?? 0
+    }
+
     private static let maxHistoryMessages = 10
     private func windowedMessages() -> [ChatMessage] {
         guard messages.count > Self.maxHistoryMessages + 1,
diff --git a/StrandTests/CoachConversationDayTests.swift b/StrandTests/CoachConversationDayTests.swift
new file mode 100644
index 0000000000..f0fb455e8d
--- /dev/null
+++ b/StrandTests/CoachConversationDayTests.swift
@@ -0,0 +1,120 @@
+import XCTest
+@testable import Strand
+
+/// #1542 twin of `CoachConversationDayTest`. The Coach kept answering today's question inside
+/// yesterday's conversation: `messages` outlives a night, so the assistant's own earlier turns state
+/// yesterday's figures and the model stays consistent with them. The data was never stale —
+/// `buildFullContext()` re-reads on every send — which is why it reads as "the coach only talks about my
+/// imported data" rather than as stale numbers.
+final class CoachConversationDayTests: XCTestCase {
+
+    /// A fixed UTC calendar, so no case depends on the machine's zone or clock.
+    private var utc: Calendar = {
+        var c = Calendar(identifier: .gregorian)
+        c.timeZone = TimeZone(secondsFromGMT: 0)!
+        return c
+    }()
+
+    private func day(_ y: Int, _ m: Int, _ d: Int) -> Int {
+        var comps = DateComponents()
+        comps.year = y; comps.month = m; comps.day = d
+        let date = utc.date(from: comps)!
+        return AICoachEngine.localEpochDay(date, calendar: utc)
+    }
+
+    func testFreshSessionIsNeverStale() {
+        // Nothing sent yet this session: there is no transcript to retire.
+        XCTAssertFalse(AICoachEngine.isStaleConversation(lastEpochDay: nil,
+                                                         todayEpochDay: day(2026, 8, 22)))
+    }
+
+    func testSameDayKeepsTheConversation() {
+        let today = day(2026, 8, 22)
+        XCTAssertFalse(AICoachEngine.isStaleConversation(lastEpochDay: today, todayEpochDay: today))
+    }
+
+    func testOvernightRetiresTheConversation() {
+        // The reported case: last turn yesterday evening, next question this morning.
+        XCTAssertFalse(AICoachEngine.isStaleConversation(lastEpochDay: day(2026, 8, 21),
+                                                         todayEpochDay: day(2026, 8, 21)))
+        XCTAssertTrue(AICoachEngine.isStaleConversation(lastEpochDay: day(2026, 8, 21),
+                                                        todayEpochDay: day(2026, 8, 22)))
+    }
+
+    func testLongGapRetiresTheConversation() {
+        XCTAssertTrue(AICoachEngine.isStaleConversation(lastEpochDay: day(2026, 6, 11),
+                                                        todayEpochDay: day(2026, 8, 22)))
+    }
+
+    /// Flying west, a timezone change or an NTP correction can move the local day BACKWARDS
+    /// mid-conversation. That must not wipe a transcript the user is in the middle of, which is why the
+    /// rule is strictly forward (`>`) and not `!=`. Relaxing it to `!=` fails this case and the year
+    /// boundary below — the two that give the test teeth.
+    func testClockMovingBackwardsKeepsTheConversation() {
+        XCTAssertFalse(AICoachEngine.isStaleConversation(lastEpochDay: day(2026, 8, 22),
+                                                         todayEpochDay: day(2026, 8, 21)))
+    }
+
+    func testYearBoundaryIsJustAnotherDay() {
+        XCTAssertTrue(AICoachEngine.isStaleConversation(lastEpochDay: day(2025, 12, 31),
+                                                        todayEpochDay: day(2026, 1, 1)))
+        XCTAssertFalse(AICoachEngine.isStaleConversation(lastEpochDay: day(2026, 1, 1),
+                                                         todayEpochDay: day(2025, 12, 31)))
+    }
+
+    /// Swift-only, because Swift-only needs it: Kotlin gets its epoch day from `LocalDate`, while this
+    /// side computes one. Counted with calendar day arithmetic rather than by dividing an interval by
+    /// 86,400 — a day is not always 86,400 seconds. Across a DST spring-forward the count must still
+    /// advance by exactly one, or a transcript would survive a night twice a year.
+    func testLocalEpochDayAdvancesByOneAcrossADSTBoundary() {
+        var london = Calendar(identifier: .gregorian)
+        london.timeZone = TimeZone(identifier: "Europe/London")!
+        var before = DateComponents()
+        before.year = 2026; before.month = 3; before.day = 28; before.hour = 12
+        var after = DateComponents()
+        after.year = 2026; after.month = 3; after.day = 29; after.hour = 12   // clocks go forward
+        let d0 = AICoachEngine.localEpochDay(london.date(from: before)!, calendar: london)
+        let d1 = AICoachEngine.localEpochDay(london.date(from: after)!, calendar: london)
+        XCTAssertEqual(d1 - d0, 1, "a 23-hour day must still be one day")
+        XCTAssertTrue(AICoachEngine.isStaleConversation(lastEpochDay: d0, todayEpochDay: d1))
+    }
+
+    /// The symmetric DST case, and the one that actually threatens this implementation. `localEpochDay`
+    /// counts whole days from the epoch INSTANT to a local midnight, so the count truncates — and on a
+    /// 25-hour autumn day the extra hour is exactly the kind of slack that could make two local midnights
+    /// land in the same whole-day bucket. If that happened, a transcript would survive a night once a
+    /// year and the bug this whole change fixes would come back, seasonally.
+    ///
+    /// Spring-forward was tested first because it is the obvious one. It is not the dangerous one.
+    func testLocalEpochDayAdvancesByOneAcrossTheAutumnFallBack() {
+        var london = Calendar(identifier: .gregorian)
+        london.timeZone = TimeZone(identifier: "Europe/London")!
+        var before = DateComponents()
+        before.year = 2026; before.month = 10; before.day = 24; before.hour = 12
+        var after = DateComponents()
+        after.year = 2026; after.month = 10; after.day = 25; after.hour = 12   // clocks go back
+        let d0 = AICoachEngine.localEpochDay(london.date(from: before)!, calendar: london)
+        let d1 = AICoachEngine.localEpochDay(london.date(from: after)!, calendar: london)
+        XCTAssertEqual(d1 - d0, 1, "a 25-hour day must still be one day")
+        XCTAssertTrue(AICoachEngine.isStaleConversation(lastEpochDay: d0, todayEpochDay: d1))
+    }
+
+    /// A zone far west of UTC, where the epoch instant itself falls on the PREVIOUS local day. The origin
+    /// this counts from is not local midnight, so the arithmetic has to stay monotonic anyway — ordering
+    /// is the only property the rule depends on.
+    func testLocalEpochDayIsMonotonicWestOfUTC() {
+        var la = Calendar(identifier: .gregorian)
+        la.timeZone = TimeZone(identifier: "America/Los_Angeles")!
+        var comps = DateComponents()
+        comps.year = 2026; comps.month = 8; comps.day = 21; comps.hour = 23; comps.minute = 30
+        let lateEvening = la.date(from: comps)!
+        let nextMorning = lateEvening.addingTimeInterval(3_600)   // 00:30 the next local day
+        let d0 = AICoachEngine.localEpochDay(lateEvening, calendar: la)
+        let d1 = AICoachEngine.localEpochDay(nextMorning, calendar: la)
+        XCTAssertEqual(d1 - d0, 1, "crossing local midnight is one day, whatever the UTC offset")
+        XCTAssertTrue(AICoachEngine.isStaleConversation(lastEpochDay: d0, todayEpochDay: d1))
+        // And the hour before midnight is emphatically the same day.
+        let earlier = lateEvening.addingTimeInterval(-3_600)
+        XCTAssertEqual(AICoachEngine.localEpochDay(earlier, calendar: la), d0)
+    }
+}
diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index f646b82987..aa441f3f85 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 396
+        versionCode = 397
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/android/app/src/main/java/com/noop/ui/CoachViewModel.kt b/android/app/src/main/java/com/noop/ui/CoachViewModel.kt
index 448c1e6f91..4685835142 100644
--- a/android/app/src/main/java/com/noop/ui/CoachViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/CoachViewModel.kt
@@ -257,6 +257,9 @@ class CoachViewModel(app: Application) : AndroidViewModel(app) {
     fun clearKey(ctx: Context) {
         AiKeyStore.clear(ctx)
         _messages.value = emptyList()
+        // The day belongs to the transcript, so it goes with it. Harmless if left (a stale day only ever
+        // clears an already-empty list) but it would be a field claiming something untrue.
+        conversationDay = null
         _error.value = null
         _keyVersion.value += 1
     }
@@ -270,6 +273,7 @@ class CoachViewModel(app: Application) : AndroidViewModel(app) {
         _customConnected.value = false
         AiKeyStore.saveCustomConnected(ctx, false)
         _messages.value = emptyList()
+        conversationDay = null
         _error.value = null
         _keyVersion.value += 1
     }
diff --git a/project.yml b/project.yml
index 182679f829..33dbf7f09a 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "277"
+    CURRENT_PROJECT_VERSION: "278"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 712c02046003851ffaf39a96c2713ce8f524f596 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 18:07:49 +1200
Subject: [PATCH 109/333] The unbonded offload probe's silence budget must
 outlive the process (#1635)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A field capture on 31 Aug (build 393, whoop-MGB…, fw 50.41.1.0) shows the
unbonded offload probe starting 18 times across 24 connects, each start
writing the puffin CCCDs and each link dying ~4.8s later — an endless
reconnect loop and a permanent "Reconnecting to your WHOOP" notification.
The control case sits in the same log: the one link whose four CCCD writes
were all abandoned locally lived 31.3s and ended in connectionTimeout,
while every link whose writes reached the air died at 10.8s, locally
terminated.

UNBONDED_PROBE_MAX_SILENT_LINKS exists for exactly this, and it worked —
within one process. Nothing bounded the processes. The foreground service
restarts, the counter went back to zero, and the probe bought three more
link-killing attempts on a strap that had already answered the same way
three times. The file's own doc admitted this ("the honest limit of an
in-memory bound") without following the admission anywhere.

The budget is now persisted per device, and lives on PuffinExperiment
rather than beside the refusal latch in NoopPrefs. That placement is
load-bearing: turning the switch on has to hand the budget back, the
setter has no device in hand so it clears by prefix, and a
SharedPreferences sweep can only reach its own file. Written to NoopPrefs
and swept from noop_experiments, re-enabling the switch would have cleared
nothing and done it silently, the give-up line having already latched.
Keeping the budget on the object that owns the switch makes that drift
unrepresentable rather than merely documented; a test pins the key against
the prefix as well.

The re-arm is sampled in the setter and not at connect, deliberately: once
the probe retires the link is stable, a stable link produces no connects,
and a switch flipped off and on while idle would never be seen. It fires
on the off->on edge and not on any write of true, so a caller rewriting
the current value cannot hand back three more link-killing attempts
through the mechanism meant to bound them.

Both charge sites — "asked and heard nothing" and "link died mid-probe" —
now share one path. A quiet link and a link torn down by the very
subscriptions we wrote are the same evidence about this strap, and
counting only the first is how 18 starts fit into 24 connects.

Two review passes also corrected the retirement line, which claimed the
strap "serves those characteristics unbonded". That holds only for links
that subscribed and then stayed quiet; a link lost mid-probe confirms no
subscribes at all, so on this capture — where every charge was a lost link
— the line would have recorded the opposite of what the strap
demonstrated. It now names both ways the budget can be spent and asserts
neither, the per-link lines still carrying the detail. Docs that described
the superseded design were corrected with it, including the switch's own
promise that opting in "costs one link and not a loop" while it cost 18.

Behaviour: three links per strap ever, rather than three per process;
nothing after a service restart; another try by switching off and on
instead of clearing app data.

UnbondedOffloadProbeTest 33 tests, whole com.noop.ble suite 604, zero
failures on a forced clean run. compileFullDebugKotlin, doc_comment_lint
and i18n_audit clean.

Android only; there is no Swift probe to twin. Refs #1635.
---
 .../java/com/noop/ble/PuffinExperiment.kt     | 49 +++++++++++-
 .../java/com/noop/ble/UnbondedOffloadProbe.kt | 75 ++++++++++++++----
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 60 +++++++++-----
 .../com/noop/ble/UnbondedOffloadProbeTest.kt  | 79 +++++++++++++++++--
 4 files changed, 224 insertions(+), 39 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt b/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt
index d2d234fdc5..24184f29d6 100644
--- a/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt
+++ b/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt
@@ -142,11 +142,56 @@ class PuffinExperiment(private val prefs: SharedPreferences) {
      * Its own switch because it SENDS to the strap and, if the strap answers, writes its clock — the same
      * line every other state-changing probe here sits behind ([isDeepDataEnabled], [broadcastHr],
      * [ecgRawData]). Nothing is written until the strap has proved it answers a read-only GET_CLOCK, and a
-     * refusal is latched per device, so opting in costs one link and not a loop.
+     * refusal is latched per device and silence spends a bounded, persisted budget, so opting in costs at
+     * most [UNBONDED_PROBE_MAX_SILENT_LINKS] links on a strap and not a loop. It said "one link and not a
+     * loop" while costing 18 across 24 connects, which is the correction this doc exists to record.
+     *
+     * Turning it ON also clears every strap's silence budget ([unbondedProbeSilentLinksPrefKey]). That
+     * budget is now persisted, so without this a strap that spent it would never probe again — and
+     * silently, the give-up line having latched on a run the user may never have seen. This setter is the
+     * one place the intent is unambiguous: sampling the switch at connect cannot see it flipped off and
+     * on while the link sits idle, which is exactly what a user does after being told to turn it off.
      */
     var unbondedOffload: Boolean
         get() = prefs.getBoolean(KEY_UNBONDED_OFFLOAD, false)
-        set(v) = prefs.edit().putBoolean(KEY_UNBONDED_OFFLOAD, v).apply()
+        set(v) {
+            val rearms = unbondedProbeBudgetRearms(v, prefs.getBoolean(KEY_UNBONDED_OFFLOAD, false))
+            val e = prefs.edit().putBoolean(KEY_UNBONDED_OFFLOAD, v)
+            // Every strap, not just the connected one: the switch is global, so "try again" is too, and
+            // this setter is the only path that runs with no device in hand.
+            if (rearms) {
+                prefs.all.keys
+                    .filter { it.startsWith(UNBONDED_PROBE_SILENT_LINKS_KEY_PREFIX) }
+                    .forEach { e.remove(it) }
+            }
+            e.apply()
+        }
+
+    /**
+     * The probe's persisted silence budget for one strap — links that subscribed the puffin
+     * characteristics and drew no answer, capped by [UNBONDED_PROBE_MAX_SILENT_LINKS].
+     *
+     * It lives HERE, and not beside the refusal latch in `NoopPrefs`, on purpose. The setter above clears
+     * these by prefix because it has no device in hand, and a sweep can only reach its own prefs file:
+     * written to `NoopPrefs` and swept from `noop_experiments`, re-enabling the switch would clear nothing
+     * and the probe would stay retired forever, silently. Keeping the budget on the object that owns the
+     * switch makes that drift unrepresentable rather than merely documented.
+     *
+     * Unreadable prefs read as 0 — the probe's other gates bound it, and a prefs failure must not be the
+     * thing that keeps a spent budget spent.
+     */
+    fun unbondedProbeSilentLinks(peripheralId: String?): Int = runCatching {
+        unbondedProbeSilentLinksPrefKey(peripheralId)?.let { prefs.getInt(it, 0) } ?: 0
+    }.getOrDefault(0)
+
+    /** Record that budget. A null address (no device in hand) is a no-op, as the read is. */
+    fun setUnbondedProbeSilentLinks(peripheralId: String?, value: Int) {
+        runCatching {
+            unbondedProbeSilentLinksPrefKey(peripheralId)?.let {
+                prefs.edit().putInt(it, value).apply()
+            }
+        }
+    }
 
     /** True if the user opted in to "Ask Android to pair" (#1635, default false): NOOP calls
      *  `BluetoothDevice.createBond()` explicitly instead of relying on a write to the encrypted
diff --git a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
index c200376117..7950557fb3 100644
--- a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
+++ b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
@@ -50,7 +50,7 @@ internal fun shouldProbeUnbondedOffload(
     helloWrittenThisLink: Boolean,
     alreadyProbedThisLink: Boolean,
     previouslyRefused: Boolean,
-    silentLinksSoFar: Int = 0,
+    silentLinksSoFar: Int,
 ): Boolean {
     if (!isWhoop5) return false
     if (!optedIn) return false
@@ -69,31 +69,49 @@ internal fun shouldProbeUnbondedOffload(
 /**
  * How many links may end in SILENCE before the probe retires itself.
  *
- * A refusal latches per device; silence deliberately does not, because the subscriptions were accepted and
- * one quiet link is not the strap's verdict. But "not latched" cannot mean "forever": the probe re-runs on
- * every reconnect, and a strap that reconnects often would re-ask a question already answered the same way
- * three times, which is the exact shape of the unbounded retry this whole area keeps producing.
+ * A refusal is the strap's verdict and latches outright; silence is weaker evidence — the subscriptions
+ * were accepted, and one quiet link says little — so it spends a budget instead. But weaker evidence
+ * cannot mean unbounded: the probe re-runs on every reconnect, and a strap that reconnects often would
+ * re-ask a question already answered the same way three times, which is the exact shape of the retry this
+ * whole area keeps producing.
+ *
+ * Counted PER DEVICE and persisted ([unbondedProbeSilentLinksPrefKey]), not per process. It was per
+ * process, and that was wrong in the field: the foreground service restarts often, every restart re-armed
+ * three more links, and each of those links is torn down ~4.8s after the subscriptions reach the air. One
+ * capture caught 18 probe starts across 24 connects — the unbounded retry this budget exists to prevent,
+ * surviving it by outliving the only thing that bounded it. Bounded within a process and endless across
+ * them is not bounded.
  *
- * Counted per app process, like [HELLO_OVERRIDE_MAX_ATTEMPTS], and reset by a genuine answer. A process
- * restart resets it too — the honest limit of an in-memory bound, and the loop it exists to stop runs
- * within one process.
+ * Cleared by a genuine answer, and by turning the experiment off and on — see [PuffinExperiment].
  */
 internal const val UNBONDED_PROBE_MAX_SILENT_LINKS = 3
 
-/** Has the probe any budget left after [silentLinksSoFar] links that subscribed but drew no reply? */
+/** Has the probe any budget left after [silentLinksSoFar] links that ended without an answer — whether
+ *  they subscribed and stayed quiet, or were torn down while being asked? */
 internal fun unbondedProbeStillWorthAsking(
     silentLinksSoFar: Int,
     cap: Int = UNBONDED_PROBE_MAX_SILENT_LINKS,
 ): Boolean = silentLinksSoFar < cap
 
 /**
- * The line printed when the probe retires on repeated silence, so the log says why it stopped rather than
- * leaving a reader to notice its absence — the same failure the CLIENT_HELLO's silent suppression caused.
+ * The line printed when the probe retires, so the log says why it stopped rather than leaving a reader to
+ * notice its absence — the same failure the CLIENT_HELLO's silent suppression caused.
+ *
+ * It must NOT claim the strap served the subscriptions. It said so, and that was only ever true of the
+ * links that subscribed and then stayed quiet. Since #1749 a link LOST mid-probe charges the same budget,
+ * and those links confirm no subscribes at all — so on the 31 Aug capture, where every charge was a lost
+ * link, this line would have recorded "serves those characteristics unbonded" about a strap that had
+ * demonstrated the opposite. Overclaiming from the weaker evidence is the mistake this file is built to
+ * avoid, and the retirement line is exactly where a future reader goes looking. The per-link lines
+ * ([unbondedProbeLinkLostLine], [unbondedProbeSilentLine]) already say which happened each time; this one
+ * states only what holds either way.
  */
 internal fun unbondedProbeGaveUpLine(silentLinks: Int): String =
-    "Unbonded offload probe: $silentLinks links have subscribed the puffin chars and drawn no" +
-        " COMMAND_RESPONSE — this strap serves those characteristics unbonded but does not act on commands" +
-        " written to them. Not asking again this session. History offload is unavailable until the strap" +
+    "Unbonded offload probe: $silentLinks links have ended with no COMMAND_RESPONSE — this strap either" +
+        " does not act on puffin commands written over an unencrypted link, or does not hold the link up" +
+        " long enough to answer one; the per-link lines above say which happened each time." +
+        " Not asking this strap again — turn the experiment off and on to retry." +
+        " History offload is unavailable until the strap" +
         " completes a handshake (#1635)."
 
 /**
@@ -150,6 +168,35 @@ internal fun unbondedProbeSupersedesLine(explicitBondOptedIn: Boolean): String =
 internal fun unbondedOffloadRefusedPrefKey(peripheralId: String?): String? =
     peripheralId?.trim()?.takeIf { it.isNotEmpty() }?.let { "noop.unbondedOffloadRefused.${it.lowercase()}" }
 
+/**
+ * Does writing [PuffinExperiment.unbondedOffload] hand every strap's silence budget back?
+ *
+ * The off->ON EDGE, and not merely "on". A setter that cleared on every true would return the budget to
+ * any caller that rewrites the current value, and the budget's whole job is to stop a retry that takes the
+ * link down with it. Only the two switches write it today; making this the setter's property rather than
+ * its callers' is what keeps that true.
+ */
+internal fun unbondedProbeBudgetRearms(optedInNow: Boolean, optedInBefore: Boolean): Boolean =
+    optedInNow && !optedInBefore
+
+/** Prefix of every persisted silence budget, so opting back in can clear them all without knowing which
+ *  straps have one. Sole reason it is a constant rather than an inlined string. */
+internal const val UNBONDED_PROBE_SILENT_LINKS_KEY_PREFIX = "noop.unbondedOffloadSilentLinks."
+
+/**
+ * Persisted key for "how many links on this strap subscribed the puffin characteristics and drew no
+ * answer" — the silence budget of [UNBONDED_PROBE_MAX_SILENT_LINKS], per device and lowercased for the
+ * same reason [firmwarePrefKey] is.
+ *
+ * Deliberately NOT [unbondedOffloadRefusedPrefKey], though a spent budget stops the probe just as a
+ * refusal does. A refusal is the strap's answer and is final; a spent budget is ours — we stopped asking —
+ * and the user can hand it back. Sharing one key would have the log report a refusal that never happened,
+ * which is precisely the conflation [UnbondedProbeEvidence] exists to prevent.
+ */
+internal fun unbondedProbeSilentLinksPrefKey(peripheralId: String?): String? =
+    peripheralId?.trim()?.takeIf { it.isNotEmpty() }
+        ?.let { UNBONDED_PROBE_SILENT_LINKS_KEY_PREFIX + it.lowercase() }
+
 /**
  * What a frame arriving on a puffin notify characteristic proves about an unbonded link.
  *
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 6d0ff0392c..66f3fbe75c 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -2425,10 +2425,24 @@ class WhoopBleClient(
     /** #1635: how many times the probe has stood aside for the DIS chain on this link. */
     private var unbondedProbeDeferrals = 0
 
-    /** #1635: links that subscribed the puffin chars and drew no reply. Per PROCESS, deliberately NOT
-     *  cleared by [reset] — its whole job is to bound a retry that spans reconnects. A refusal latches per
-     *  device instead; silence is weaker evidence and gets a budget rather than a verdict. */
-    private var unbondedProbeSilentLinks = 0
+    /** #1635: links that subscribed the puffin chars and drew no reply — the silence budget for the
+     *  connected strap, read through prefs on every use.
+     *
+     *  Was a field, and the field was the bug: the foreground service restarts, the count went back to
+     *  zero, and the probe bought three more link-killing attempts on a strap that had already answered
+     *  the same way three times (18 starts across 24 connects, 31 Aug). Reading it through prefs is a
+     *  handful of cheap lookups per link and leaves exactly one source of truth.
+     *
+     *  Held by [PuffinExperiment] rather than `NoopPrefs`, unlike the refusal latch beside it: the switch's
+     *  setter clears these budgets by prefix and can only sweep its own prefs file. */
+    private val unbondedProbeSilentLinks: Int
+        get() = runCatching {
+            PuffinExperiment.from(context).unbondedProbeSilentLinks(lastDeviceAddress)
+        }.getOrDefault(0)
+
+    private fun setUnbondedProbeSilentLinks(value: Int) {
+        runCatching { PuffinExperiment.from(context).setUnbondedProbeSilentLinks(lastDeviceAddress, value) }
+    }
 
     /** True when the user asked to disconnect; suppresses the auto-rescan (Swift `intentionalDisconnect`).
      *  Written on the main looper (connect/disconnect/keep-alive bounce) and read on the GATT binder
@@ -4850,6 +4864,21 @@ class WhoopBleClient(
         }
     }
 
+    /**
+     * Charge one link that subscribed the puffin characteristics and produced no answer, retiring the
+     * probe for this strap when the budget runs out.
+     *
+     * Both the "asked and heard nothing" path and the "link died mid-probe" path end here, and they must:
+     * a quiet link and a link torn down by the very subscriptions we wrote are the same evidence about
+     * this strap. Counting only the first is how the probe kept re-running across 24 connects.
+     */
+    private fun chargeUnbondedProbeSilence() {
+        val spent = unbondedProbeSilentLinks + 1
+        setUnbondedProbeSilentLinks(spent)
+        if (unbondedProbeStillWorthAsking(spent)) return
+        log(unbondedProbeGaveUpLine(spent))
+    }
+
     /**
      * Stage 2: the subscriptions landed, so ask the strap a read-only question.
      *
@@ -4898,22 +4927,20 @@ class WhoopBleClient(
                 waitedMs = waited,
                 sawNotifications = unbondedProbeEvidence == UnbondedProbeEvidence.SERVES_NOTIFICATIONS,
             ))
-            // Not latched per device: the subscriptions were accepted, so this says the strap did not
+            // Not the refusal latch: the subscriptions were accepted, so this says the strap did not
             // answer THIS time, and the carve-out the refusal path makes for a pairing in flight would
-            // apply here with less certainty, not more. Once-per-LINK does not bound it, though — the
-            // probe re-runs on every reconnect — so silence spends a per-process budget instead of writing
-            // a permanent verdict from an ambiguous result.
-            unbondedProbeSilentLinks++
-            if (!unbondedProbeStillWorthAsking(unbondedProbeSilentLinks)) {
-                log(unbondedProbeGaveUpLine(unbondedProbeSilentLinks))
-            }
+            // apply here with less certainty, not more. Once-per-LINK does not bound it either — the probe
+            // re-runs on every reconnect — so silence spends a budget rather than writing a verdict from
+            // an ambiguous result. The budget is persisted, because the process is not a bound.
+            chargeUnbondedProbeSilence()
             return
         }
         log(unbondedProbeAnsweredLine())
         log(unbondedProbeBacklogCaveatLine())
         // A genuine answer clears the silence budget: whatever the quiet links were, they were not this
-        // strap declining to talk, and a later reconnect must not inherit their count.
-        unbondedProbeSilentLinks = 0
+        // strap declining to talk, and a later reconnect — or a later app launch — must not inherit
+        // their count.
+        setUnbondedProbeSilentLinks(0)
         // The proven 5/MG handshake tail, minus the hello that cannot happen: clock the strap, then offload.
         // Clock-before-history is mandatory — an un-clocked 5/MG discards sensor data rather than banking it
         // — and it is only reached here because the strap has just demonstrated it answers commands.
@@ -9868,10 +9895,7 @@ class WhoopBleClient(
                         System.currentTimeMillis() - unbondedProbeAskedAtMs else -1L,
                 ),
             )
-            unbondedProbeSilentLinks++
-            if (!unbondedProbeStillWorthAsking(unbondedProbeSilentLinks)) {
-                log(unbondedProbeGaveUpLine(unbondedProbeSilentLinks))
-            }
+            chargeUnbondedProbeSilence()
         }
         unbondedProbeStartedThisLink = false
         unbondedProbeDeferrals = 0
diff --git a/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt b/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
index d01075f7c3..092a23971f 100644
--- a/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
+++ b/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
@@ -2,6 +2,8 @@ package com.noop.ble
 
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertNotNull
 import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Test
@@ -77,9 +79,14 @@ class UnbondedOffloadProbeTest {
     }
 
     /**
-     * Silence is not latched per device, so once-per-link does NOT bound it — the probe re-runs on every
-     * reconnect, and a strap that reconnects often would re-ask a question already answered the same way.
-     * That is the unbounded retry this whole area keeps producing, so silence spends a per-process budget.
+     * Silence does not latch the way a refusal does, so once-per-link cannot bound it — the probe re-runs
+     * on every reconnect, and a strap that reconnects often would re-ask a question already answered the
+     * same way. Silence therefore spends a budget.
+     *
+     * That budget is PERSISTED, which is the whole of the 31 Aug loop: 18 probe starts across 24 connects.
+     * It bounded the retry within a process; nothing bounded the processes, the foreground service
+     * restarts, and every restart re-armed three more links — each torn down ~4.8s after the subscriptions
+     * reach the air, which the user sees as an endless "Reconnecting to your WHOOP".
      */
     @Test
     fun `repeated silence retires the probe`() {
@@ -156,8 +163,70 @@ class UnbondedOffloadProbeTest {
     fun `the give-up line says why it stopped, not merely that it did`() {
         // The CLIENT_HELLO's suppression stopped silently and cost eleven weeks of unreadable captures.
         val line = unbondedProbeGaveUpLine(3)
-        assertTrue(line.contains("serves those characteristics unbonded"))
-        assertTrue(line.contains("does not act on commands"))
+        // Both ways the budget can be spent are named...
+        assertTrue(line.contains("does not act on puffin commands"))
+        assertTrue(line.contains("does not hold the link up"))
+        // ...and neither is asserted as established. This line USED to claim the strap "serves those
+        // characteristics unbonded", which only ever held for links that subscribed and then stayed
+        // quiet. Since a link lost mid-probe charges the same budget, a budget spent entirely by lost
+        // links — every charge in the 31 Aug capture — confirms no subscribes at all, and the retirement
+        // line would have recorded the opposite of what that strap demonstrated.
+        assertFalse(line.contains("serves those characteristics"))
+        // And it no longer promises only a session: the retirement is persisted, and the line has to say
+        // the one thing that undoes it, or the switch looks broken to whoever turns it back on.
+        assertFalse(line.contains("this session"))
+        assertTrue(line.contains("off and on"))
+    }
+
+    /**
+     * The budget outlives the process, so the sweep that hands it back has to find it.
+     *
+     * [PuffinExperiment.unbondedOffload]'s setter clears the budgets by PREFIX, having no device in hand.
+     * If the key the probe writes and the prefix that setter sweeps ever drift apart, the sweep matches
+     * nothing, re-enabling the switch does nothing, and it does it silently — the give-up line having
+     * already latched. That is the same shape as every other dead gate in this file's history, so it is
+     * pinned rather than left to inspection.
+     */
+    @Test
+    fun `the key the probe writes is the key opting back in sweeps`() {
+        val key = unbondedProbeSilentLinksPrefKey("AA:BB:CC:DD:EE:FF")
+        assertNotNull(key)
+        assertTrue(key!!.startsWith(UNBONDED_PROBE_SILENT_LINKS_KEY_PREFIX))
+    }
+
+    @Test
+    fun `only the off-to-on edge hands the budget back`() {
+        assertTrue(unbondedProbeBudgetRearms(optedInNow = true, optedInBefore = false))
+        // Rewriting "on" while already on is not the user asking for anything. If this cleared, any
+        // caller that re-set the current value would re-arm three more link-killing attempts — the loop
+        // the budget exists to end, restored by the mechanism meant to bound it.
+        assertFalse(unbondedProbeBudgetRearms(optedInNow = true, optedInBefore = true))
+        assertFalse(unbondedProbeBudgetRearms(optedInNow = false, optedInBefore = true))
+        assertFalse(unbondedProbeBudgetRearms(optedInNow = false, optedInBefore = false))
+    }
+
+    @Test
+    fun `the silence budget is not the refusal latch`() {
+        // Both stop the probe; only one is the strap's answer. One key for the two would have the log
+        // report a refusal that never happened.
+        assertNotEquals(
+            unbondedProbeSilentLinksPrefKey("AA:BB:CC:DD:EE:FF"),
+            unbondedOffloadRefusedPrefKey("AA:BB:CC:DD:EE:FF"),
+        )
+    }
+
+    @Test
+    fun `the budget key is per device and case-insensitive, like the refusal key`() {
+        assertEquals(
+            unbondedProbeSilentLinksPrefKey("AA:BB:CC:DD:EE:FF"),
+            unbondedProbeSilentLinksPrefKey(" aa:bb:cc:dd:ee:ff "),
+        )
+        assertNotEquals(
+            unbondedProbeSilentLinksPrefKey("AA:BB:CC:DD:EE:FF"),
+            unbondedProbeSilentLinksPrefKey("11:22:33:44:55:66"),
+        )
+        assertNull(unbondedProbeSilentLinksPrefKey(null))
+        assertNull(unbondedProbeSilentLinksPrefKey("   "))
     }
 
     @Test

From 6f290d4c9e54d959185d627e4908cf079101ef85 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 18:33:35 +1200
Subject: [PATCH 110/333] Asking Android to pair must not clear the hello
 give-up every link (#1635)

A capture on 31 Aug (build 397, 5/MG, fw 50.41.1.0) has two disconnect bursts
sixteen hours apart, and the gap between them is the point: the link was
perfectly stable all night, so the strap is not what is unstable.

  00:39:38 -> 00:41:20    7 links, all ~10.8s   the unbonded offload probe
  00:41    -> 17:21      16 hours, zero disconnects
  17:32:05 -> 17:39:44   18 links, all   4.8s   the CLIENT_HELLO

The second burst should have ended itself. At 17:32:48 the give-up fired
exactly as designed - "never acknowledged the secure handshake 5x in a row,
leaving the handshake off so live heart rate keeps streaming" - and then 13
more CLIENT_HELLOs went out. The line printed when a hello is actually
skipped appears zero times in the whole log.

With "Ask Android to pair" on, the explicit-bond request cleared the
suppression latch. The comment there argued this was safe because it happened
"ONCE, here", as against being re-armed by "an OS pairing exists", a condition
that never goes away. It guarded the wrong recurrence: shouldRequestExplicitBond
is bounded only by alreadyRequestedThisLink, a per-LINK flag, and on a strap
answering SMP "Pairing Not Supported" neither bond condition ever becomes true.
So createBond runs on every connect and the clear ran with it. The capture holds
18 pairing requests and 18 hellos - one of each on every link, which is exactly
the pairing helloDeferredByExplicitBond exists to forbid.

Nor could it recover. recordRefusal() reports the crossing exactly once and
stays gaveUp until reset, so the latch is written once per session; a clear on a
recurring event does not cost one link, it costs the latch permanently. The
designed end state - live HR, handshake off, link stable - was unreachable while
that switch was on.

The clear is removed. Recovery is the explicit Connect the epitaph already names.
The encrypted-bond clear is deliberately not offered as an automatic alternative:
it lives inside the hello write-completion callback, so a suppressed hello cannot
reach it, and three separate review passes were needed to stop that overclaim
reappearing - once in the production comment, once in the test comment written to
correct it. All three clears are now named with the one suppression puts out of
reach marked as such.

The pairing experiment is untouched: createBond still runs on every link, it just
no longer drags the hello along with it.

Parity checked rather than assumed. Swift has the same give-up mirror and the same
latch; its three writes are the release path, the give-up write, and one clear
gated on ClientHelloOutcome.isAck - an outcome, not a request. No twin exists, and
could not: CoreBluetooth has no createBond.

Tests pin the contradiction from both sides. ExplicitBondTest: the permanent state
of a refusing strap still returns true and the only input that returns false is the
per-link flag, so nothing may hang a once-only side effect off this request.
HelloSuppressionTest: the give-up reports its crossing once, so the latch is
written once and a recurring clear is permanent. 606 tests in com.noop.ble, zero
failures on a forced clean run; compileFullDebugKotlin, doc_comment_lint and
i18n_audit clean.

What this does not settle: with the hello suppressed, createBond still runs once
per link on a strap that refuses SMP. Nothing in this capture says whether that
alone keeps a link up, because the sixteen stable hours contained no connects at
all. If a loop survives this, that is the remaining cause and it will be readable
for the first time.

Android only. Refs #1635.
---
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 43 +++++++++++++++----
 .../java/com/noop/ble/ExplicitBondTest.kt     | 18 ++++++++
 .../java/com/noop/ble/HelloSuppressionTest.kt | 29 ++++++++++++-
 3 files changed, 80 insertions(+), 10 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 66f3fbe75c..2f07aa91d6 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -8373,15 +8373,42 @@ class WhoopBleClient(
                     runCatching { g.device.createBond() }.fold(
                         onSuccess = { initiated ->
                             log(explicitBondRequestLine(initiated, where))
-                            // Asking for a pairing voids the previous verdict: suppression latched because
-                            // the write never completed on an UNENCRYPTED link, and that premise is exactly
-                            // what this is trying to change. Cleared ONCE, here, rather than re-armed by
-                            // "an OS pairing exists" — that condition never goes away, so it would bypass
-                            // the latch on every connect and restore the unbounded loop for good.
+                            // The suppression latch is NOT cleared here, and this is the correction to the
+                            // comment that used to stand in its place. That comment reasoned the clear was
+                            // safe because it happened "ONCE, here", as opposed to being re-armed by "an OS
+                            // pairing exists" — a condition that never goes away. It guarded the wrong
+                            // recurrence. [shouldRequestExplicitBond] is bounded only by
+                            // `alreadyRequestedThisLink`, a per-LINK flag, and on a strap that answers SMP
+                            // "Pairing Not Supported" neither bond condition ever becomes true — so
+                            // createBond fires on EVERY connect, and clearing here fired on every connect
+                            // with it. The 31 Aug capture: 18 pairing requests and 18 hellos — one of each
+                            // on every link, which is the pairing [helloDeferredByExplicitBond] forbids —
+                            // with the latch written once at 17:32:48, the "CLIENT_HELLO suppressed" line
+                            // zero times, and 13 of those hellos landing after the give-up, each dropping
+                            // the link ~4.8s in.
+                            //
+                            // It could not recover, either: BondRefusalGiveUp.recordRefusal() reports the
+                            // crossing exactly once and stays gaveUp until reset, so the latch is written
+                            // once per session. Anything recurring that clears it does not cost one link —
+                            // it costs the latch permanently.
+                            //
+                            // What replaces it is the explicit Connect, which clears the latch through
+                            // clearPairingHintForUserConnect() — precisely what the epitaph tells the user
+                            // to do, and pinned by HelloSuppressionTest's "suppression is never
+                            // permanent". Be exact about the alternative: the encrypted-bond clear at
+                            // clearPairingHint() lives inside the hello WRITE-COMPLETION callback, so a
+                            // suppressed hello cannot reach it. Claiming it as an automatic route would be
+                            // the same overclaim the give-up line just had to be corrected for.
+                            //
+                            // That costs nothing real. The latch is only set after five consecutive
+                            // refusals, so "latched, and pairing now works" needs something to have
+                            // CHANGED — new firmware, the strap put into pairing mode (@Zebsi235's MG) —
+                            // and a user who has changed something taps Connect. Voiding the verdict on
+                            // the mere REQUEST voided it on a hope this strap never fulfils, every eleven
+                            // seconds. The pairing experiment itself is untouched: createBond still runs
+                            // on every link, it just no longer drags the hello back with it, which is what
+                            // [helloDeferredByExplicitBond] says must never share a link.
                             if (initiated) {
-                                runCatching {
-                                    com.noop.ui.NoopPrefs.setHelloSuppressed(context, g.device.address, false)
-                                }
                                 // Ask the device directly rather than waiting on our own broadcast
                                 // receiver, which is a suspect in exactly the silence being investigated.
                                 handler.postDelayed({
diff --git a/android/app/src/test/java/com/noop/ble/ExplicitBondTest.kt b/android/app/src/test/java/com/noop/ble/ExplicitBondTest.kt
index 45fd495370..1514dfb578 100644
--- a/android/app/src/test/java/com/noop/ble/ExplicitBondTest.kt
+++ b/android/app/src/test/java/com/noop/ble/ExplicitBondTest.kt
@@ -30,6 +30,24 @@ class ExplicitBondTest {
         assertTrue(ask())
     }
 
+    /**
+     * The recurrence, stated so nothing downstream may treat this request as one-shot.
+     *
+     * The two assertions belong together: the first is the PERMANENT state of a strap that answers SMP
+     * "Pairing Not Supported" — never OS-bonded, never app-bonded — and the gate still says yes; the
+     * second is the only thing left that says no, and it is per LINK, so every new link clears it. With
+     * the switch on, this therefore fires on every connect, forever.
+     *
+     * Code that hangs a once-only side effect off "we asked to pair" is doing it on every connect. On
+     * 31 Aug that was clearing the hello-suppression latch — 18 requests, 18 hellos, one of each per
+     * link — which left the latch unable to end the loop it exists to end.
+     */
+    @Test
+    fun `asking recurs on every link, so it is not a once-only event`() {
+        assertTrue(ask(osBonded = false, appBonded = false, already = false))
+        assertFalse(ask(already = true))
+    }
+
     @Test
     fun `an OS-level pairing already exists, so we do not ask again`() {
         assertFalse(ask(osBonded = true))
diff --git a/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt b/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
index 2393b340fd..b2d0a390e1 100644
--- a/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
+++ b/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
@@ -58,11 +58,36 @@ class HelloSuppressionTest {
     fun `an existing OS pairing does NOT permanently bypass the latch`() {
         // Tempting, and wrong: "a pairing exists" never goes away, so re-arming on it would rewrite the
         // hello on every connect for good - drop at ~4.8s, reconnect, forever - with the give-up powerless.
-        // That is the unbounded loop suppression exists to end. The experiment clears the latch ONCE when
-        // it asks for a pairing instead, which is self-limiting.
+        // That is the unbounded loop suppression exists to end.
+        //
+        // Asking for a pairing was treated as the self-limiting alternative, and it is not: the REQUEST
+        // recurs on every link too (see ExplicitBondTest), so clearing the latch there produced the very
+        // loop described above. Nothing clears the latch on a recurring event now. Three things clear it,
+        // all of them events rather than intentions: an explicit Connect, forgetting the device, and a
+        // genuine bond - and be exact about that last one, because it is the easy overclaim here. It is
+        // reached through the hello WRITE-COMPLETION callback, so a suppressed hello cannot reach it. The
+        // live route out of suppression is the Connect tap the epitaph names.
         assertFalse(shouldSendClientHello(suppressedForDevice = true, userInitiated = false))
     }
 
+    /**
+     * Why no recurring event may clear the latch: it is written exactly once.
+     *
+     * recordRefusal() reports the crossing on the refusal that reaches the threshold and then stays
+     * gaveUp until reset(), so the suppression is latched once per session. A clear that fires repeatedly
+     * therefore does not cost one link and self-correct - it costs the latch permanently, and the give-up
+     * has no second chance to re-arm it. That is what the 31 Aug capture shows: one latch, zero skips, 13
+     * further hellos.
+     */
+    @Test
+    fun `the give-up reports its crossing once, so the latch is written once`() {
+        val g = BondRefusalGiveUp(giveUpThreshold = 5)
+        assertEquals(1, (1..12).count { g.recordRefusal() })
+        // And only an explicit reset - a genuine bond, or the user tapping Connect - earns another.
+        g.reset()
+        assertEquals(1, (1..12).count { g.recordRefusal() })
+    }
+
     // #1635: the opt-in override, after the HCI capture changed the premise
 
     /**

From 9991f7b2391577e128d55a017a0ff4b3bfa5949f Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 18:33:57 +1200
Subject: [PATCH 111/333] staging: build 398 / iOS 279 for the #1635
 reconnect-loop work

Build numbers only - 10.6.1 stays the unreleased line, and 398 clears the
staging high-water so the APK installs over 397.

Carries both loop repairs. The unbonded offload probe's silence budget now
survives a service restart, so a strap that has answered three times the
same way is not asked again on the next launch; and asking Android to pair
no longer clears the hello give-up on every link, which is what kept the
handshake going out after the app had decided to stop.

For a 5/MG that refuses SMP the expected end state on this build is a
stable link with live HR and the handshake off, rather than a reconnect
every ten seconds. Tapping Connect still retries the handshake, and
turning the offload experiment off and on hands the probe a fresh budget.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index aa441f3f85..65fc2f7b83 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 397
+        versionCode = 398
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 33dbf7f09a..0c6fb34326 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "278"
+    CURRENT_PROJECT_VERSION: "279"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From f1b4eb2bf476125c7bf72e4452cc8bcbdd49629a Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 19:17:01 +1200
Subject: [PATCH 112/333] Stop asking Android to pair once the strap has
 refused the bond (#1635)

Asking Android to pair was the only probe in this area with no bound at all. The
CLIENT_HELLO has a give-up after five refusals, the unbonded offload probe has a
persisted three-link silence budget, and this one had nothing: gated only by
optedIn, family, the two bond flags, and alreadyRequestedThisLink - a per-LINK
flag. On a strap answering SMP "Pairing Not Supported" neither bond flag ever
becomes true, so it fired on every connect indefinitely.

That is worse than a quiet loop. Every declined request surfaces a system
"Pairing rejected" notice, so the cost lands on the user rather than in a log
nobody reads, and it was reported from the field as exactly that.

The request now stands down once the bond give-up has latched for the device.
The signal is the PERSISTED suppression latch rather than BondRefusalGiveUp.gaveUp,
which lives in one process - a bound that dies with the process is the same defect
corrected twice already this week, in #1761 and #1762.

Gating one experiment on the other is deliberate. BondRefusalGiveUp does not track
the hello; it tracks whether this strap will form an encrypted bond, which is the
single thing both routes are trying to achieve and neither has. By the time it
latches, the pairing request has had its five links and returned BOND_NONE every
time, with an HCI capture showing SMP 0x05 underneath. The experiment concludes; it
is not cut short.

It ends the loop, not the experiment. Both things that clear the latch are user
actions that could have changed the answer - tapping Connect, and forgetting the
device - and putting a 5/MG into pairing mode then tapping Connect is the one flow
known to have worked on real hardware. The trade is that a user who enters pairing
mode and waits is no longer asked automatically; with the link now stable after
#1762 that path was already unreliable, since it only fired when a new link
happened to form.

Nothing here touches connecting. The give-up this rides is the suppress branch,
which stays connected and keeps live HR streaming; the pause branch belongs to an
auth refusal and is untouched. The diff contains no connect, reconnect, scan or
pause line.

The latch is read once, above both decisions that consult it, because the pairing
request is made before the hello is considered. That single read is only correct
while nothing between the two writes the latch - true since #1762 - and the code
now says so, with what to do instead.

A one-shot line reports the stand-down: a switch that is on and silently doing
nothing reads as a broken switch, and the user has just been reading Android's
rejections. The line claims the retirement rather than a per-connect skip, matching
its two siblings, and the branch that emits it asks the gate itself whether the
give-up was the reason rather than restating half the gate's conditions - which
would drift into blaming the give-up for some later check's decision. Forgetting a
device re-arms it, as clearPairingHint already did.

Field evidence, build 398, same strap, after the two earlier repairs: refusals climb
1 to 5 across five links, the give-up latches at 18:45:23, the hello is suppressed
eight seconds later, and afterwards there are zero hellos and zero disconnects - one
further pairing request, which is what this removes. The UI reached "Live HR (not
fully paired)", the #1635 end state.

ExplicitBondTest +2, 608 tests in com.noop.ble, zero failures on a forced clean run.
compileFullDebugKotlin, doc_comment_lint and i18n_audit clean.

Parity: none owed, and checked rather than assumed. All three #1635 bond experiments
- noopWhoop5ExplicitBond, noopWhoop5UnbondedOffload, noopWhoop5HelloDespiteRefusal -
exist only on Android, and Swift has a single consumer of the suppression latch, so
there is no second decision to hoist a read for and no gate to add. CoreBluetooth
exposes no explicit pairing API, which is why this is permanently one-sided.

Refs #1635.
---
 .../main/java/com/noop/ble/ExplicitBond.kt    | 45 ++++++++++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 46 +++++++++++++++++--
 .../java/com/noop/ble/ExplicitBondTest.kt     | 37 ++++++++++++++-
 3 files changed, 124 insertions(+), 4 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ble/ExplicitBond.kt b/android/app/src/main/java/com/noop/ble/ExplicitBond.kt
index b55b5d44cb..f2dad72418 100644
--- a/android/app/src/main/java/com/noop/ble/ExplicitBond.kt
+++ b/android/app/src/main/java/com/noop/ble/ExplicitBond.kt
@@ -32,6 +32,26 @@ package com.noop.ble
  * pairing API at all — on Apple platforms pairing happens only as a side effect of touching an encrypted
  * characteristic, which is the very mechanism this file exists because it does not work. There is nothing
  * to mirror, so an audit finding this one-sided should leave it rather than delete it as untwinned.
+ *
+ * ## Why the bond give-up reaches this request, having been built for the CLIENT_HELLO
+ *
+ * The two are separate experiments, and gating one on the other is deliberate rather than sloppy.
+ * [BondRefusalGiveUp] does not track the hello; it tracks whether this strap will form an encrypted bond,
+ * which is the single thing both routes are trying to achieve and neither has. Its threshold is reached on
+ * the strap's own refusals, so by the time it latches the pairing request has had its five links and
+ * returned the same answer every time — BOND_NONE, with an HCI capture showing SMP "Pairing Not Supported"
+ * underneath. That is the experiment concluding, not being cut short.
+ *
+ * Every other probe here is bounded and this one was not. The hello has a give-up, the unbonded offload
+ * probe has a silence budget, and asking Android to pair had nothing at all: it fired once per link,
+ * forever, on a strap that had definitively said no. The 31 Aug capture caught the consequence — repeated
+ * system "Pairing rejected" notices, which is worse than a quiet loop because the user has to read them.
+ *
+ * `bondGivenUpForDevice` is the PERSISTED suppression latch and not [BondRefusalGiveUp.gaveUp], which
+ * lives in one process; a bound that dies with the process is the bug this area has now had to fix twice.
+ * Both things that clear the latch are user actions that could have changed the answer — tapping Connect
+ * (`clearPairingHintForUserConnect`) and forgetting the device. Putting a 5/MG into pairing mode and
+ * tapping Connect is the one flow known to have worked on real hardware, and it still asks.
  */
 internal fun shouldRequestExplicitBond(
     optedIn: Boolean,
@@ -39,11 +59,15 @@ internal fun shouldRequestExplicitBond(
     alreadyBondedAtOsLevel: Boolean,
     appLevelBonded: Boolean,
     alreadyRequestedThisLink: Boolean,
+    bondGivenUpForDevice: Boolean,
 ): Boolean {
     if (!optedIn) return false
     if (!isWhoop5) return false
     if (alreadyBondedAtOsLevel) return false
     if (appLevelBonded) return false
+    // The strap has refused the bond by every route the app has, and Android says so out loud: each
+    // request it declines surfaces a system "Pairing rejected" notice the user did not ask for. Stop.
+    if (bondGivenUpForDevice) return false
     return !alreadyRequestedThisLink
 }
 
@@ -101,6 +125,27 @@ internal fun explicitBondThrewLine(throwableName: String, bondStateName: String)
         " This is a local problem (usually a missing Bluetooth permission), NOT the strap refusing" +
         " (#1635, experimental)"
 
+/**
+ * The line printed when the pairing request retires, so the log says why the requests stopped.
+ *
+ * The give-up lines in this area all exist because something stopped silently and cost weeks of
+ * unreadable captures. This one has a second job: the user has been watching Android say "Pairing
+ * rejected", so the log should be able to tell them the app heard it and stopped asking, and what would
+ * make it ask again.
+ *
+ * It claims the RETIREMENT, not a skip — "on this strap again", matching [helloOverrideExhaustedLine]'s
+ * "stopping" and the offload probe's "Not asking this strap again". It is printed once per process while
+ * governing every connect after it, so wording it as a one-connect decision would leave a reader looking
+ * at twenty later connects to conclude the line was stale or the gate was per-connect. Both wrong, and
+ * both cost more than the two words it takes to be accurate.
+ */
+internal fun explicitBondGivenUpLine(): String =
+    "WHOOP 5/MG: not asking Android to pair on this strap again — it has refused the encrypted bond" +
+        " enough times for the handshake to be latched off, and every further request only produces" +
+        " another system \"Pairing rejected\" notice. Press Connect to ask again (put the strap in" +
+        " pairing mode first if you want the pairing itself to have a chance), or turn \"Ask Android to" +
+        " pair\" off (#1635, experimental)."
+
 /** The outcome line for a `createBond()` call that returned. [initiated] is the API's own return value:
  *  false means the stack refused to even start, which is a different answer from a pairing that starts and
  *  then fails, and the two must not read the same in a capture. A throw is a third answer again — see
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 2f07aa91d6..c0897bb276 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -2422,6 +2422,11 @@ class WhoopBleClient(
      */
     private var disChainInFlight = false
 
+    /** #1635: has the "stopped asking Android to pair" line been printed this process? Same one-shot
+     *  latch idiom as [helloOverrideExhaustedLogged] — the reason does not change between links, and the
+     *  give-up it reports is persisted, so repeating it every connect would be noise. */
+    private var explicitBondGiveUpLogged = false
+
     /** #1635: how many times the probe has stood aside for the DIS chain on this link. */
     private var unbondedProbeDeferrals = 0
 
@@ -3680,6 +3685,11 @@ class WhoopBleClient(
             // handshake on a re-add and leaving a stale pref behind for a strap the user removed.
             // Re-latching costs the same five refusals it always did. Twin of the Swift `forgetDevice`.
             runCatching { com.noop.ui.NoopPrefs.setHelloSuppressed(context, releasedAddress, false) }
+            // #1635: clearing the latch means the pairing request is asked again, so its one-shot line has
+            // to be able to report the next retirement. Twin of the reset in [clearPairingHint]; without
+            // it a re-added strap stops asking with nothing in the log saying why, which is the silent
+            // stop this whole area exists to stop repeating.
+            explicitBondGiveUpLogged = false
             autoReconnectPausedForBondLoop = false
             bondLoopPausedAtMs = null
             // Drop the persisted last-device pin so a relaunch / radio-on doesn't auto-reconnect to it (#67).
@@ -5896,6 +5906,9 @@ class WhoopBleClient(
         // #1635: a genuine bond proves the handshake works on this strap — drop the suppression latch so a
         // later transient failure starts from a clean slate rather than inheriting an old verdict.
         runCatching { com.noop.ui.NoopPrefs.setHelloSuppressed(context, lastDeviceAddress, false) }
+        // #1635: the pairing request is asked again from here too, so its one-shot line must be able to
+        // report a SECOND retirement. Without this the switch would go quiet for good after one round.
+        explicitBondGiveUpLogged = false
         // #747/#750: a genuine bond or a fresh user connect re-arms auto-reconnect and clears the give-up.
         bondGiveUp.reset()
         // #971: a genuine bond or a fresh user connect also clears the bond-watchdog bounce streak, so the
@@ -8356,12 +8369,24 @@ class WhoopBleClient(
                     scheduleUnbondedOffloadProbe()
                     return
                 }
+                // Read ONCE, here, above both decisions that consult it. The pairing request is made
+                // before the hello is considered, so a latch read only at the hello would leave the
+                // request unable to see the verdict it is supposed to respect.
+                //
+                // This is only safe because NOTHING between here and the hello writes the latch, and that
+                // became true when the pairing request stopped clearing it. Anything reintroducing a write
+                // in that window silently hands the hello a stale verdict — so put the write before this
+                // read, or take a second one, rather than leaving the two decisions disagreeing.
+                val suppressed = runCatching {
+                    com.noop.ui.NoopPrefs.helloSuppressed(context, g.device.address)
+                }.getOrDefault(false)
                 if (shouldRequestExplicitBond(
                         optedIn = puffinExperiment.explicitBond,
                         isWhoop5 = true,
                         alreadyBondedAtOsLevel = osBonded,
                         appLevelBonded = didBond,
                         alreadyRequestedThisLink = explicitBondRequestedThisLink,
+                        bondGivenUpForDevice = suppressed,
                     )
                 ) {
                     explicitBondRequestedThisLink = true
@@ -8420,6 +8445,24 @@ class WhoopBleClient(
                         },
                         onFailure = { log(explicitBondThrewLine(it.javaClass.simpleName, where)) },
                     )
+                } else if (suppressed && !explicitBondGiveUpLogged && shouldRequestExplicitBond(
+                        optedIn = puffinExperiment.explicitBond,
+                        isWhoop5 = true,
+                        alreadyBondedAtOsLevel = osBonded,
+                        appLevelBonded = didBond,
+                        alreadyRequestedThisLink = explicitBondRequestedThisLink,
+                        // The question this branch is actually asking: would we be asking to pair if the
+                        // give-up were not latched? Restating the gate's other conditions here instead
+                        // would drift the moment a sixth one is added — and drift silently, into a line
+                        // that blames the give-up for a decision some other check made.
+                        bondGivenUpForDevice = false,
+                    )
+                ) {
+                    // Say it, once. The switch is on and doing nothing, which without a line looks exactly
+                    // like the switch being broken — and the user has just been reading Android's pairing
+                    // rejections, so they are owed the app's side of it.
+                    explicitBondGiveUpLogged = true
+                    log(explicitBondGivenUpLine())
                 }
                 // #1635: read once, before the deferral gate — the override has to reach BOTH, or a
                 // deferred hello returns early and the switch below is never evaluated at all.
@@ -8481,9 +8524,6 @@ class WhoopBleClient(
                 // restart the loop the suppression exists to end.
                 val userAsked = helloRetryRequested
                 helloRetryRequested = false
-                val suppressed = runCatching {
-                    com.noop.ui.NoopPrefs.helloSuppressed(context, g.device.address)
-                }.getOrDefault(false)
                 if (shouldSendClientHello(suppressed, userInitiated = userAsked, overrideSuppression = helloOverride)) {
                     // Charge the budget only when the override is what put this hello on the wire: a
                     // strap that is neither suppressed nor deferring would have sent it anyway, and
diff --git a/android/app/src/test/java/com/noop/ble/ExplicitBondTest.kt b/android/app/src/test/java/com/noop/ble/ExplicitBondTest.kt
index 1514dfb578..6cf9965422 100644
--- a/android/app/src/test/java/com/noop/ble/ExplicitBondTest.kt
+++ b/android/app/src/test/java/com/noop/ble/ExplicitBondTest.kt
@@ -13,7 +13,8 @@ class ExplicitBondTest {
         osBonded: Boolean = false,
         appBonded: Boolean = false,
         already: Boolean = false,
-    ) = shouldRequestExplicitBond(optedIn, isWhoop5, osBonded, appBonded, already)
+        gaveUp: Boolean = false,
+    ) = shouldRequestExplicitBond(optedIn, isWhoop5, osBonded, appBonded, already, gaveUp)
 
     @Test
     fun `off by default - nothing happens without opt-in`() {
@@ -48,6 +49,40 @@ class ExplicitBondTest {
         assertFalse(ask(already = true))
     }
 
+    /**
+     * The bound this request never had.
+     *
+     * The hello has a give-up and the unbonded offload probe has a silence budget; asking Android to pair
+     * had nothing, so on a strap that answers SMP "Pairing Not Supported" it fired once per link forever.
+     * That is not a quiet loop: every declined request surfaces a system "Pairing rejected" notice, so the
+     * cost lands on the user rather than in a log nobody reads.
+     */
+    @Test
+    fun `a strap that has refused the bond is not asked again, until the user asks`() {
+        assertFalse(ask(gaveUp = true))
+        // The contrast is the test: the give-up ends the LOOP, not the experiment. Both things that clear
+        // the latch are user actions that could have changed the answer - tapping Connect, and forgetting
+        // the device - and putting a 5/MG into pairing mode then tapping Connect is the one flow known to
+        // have worked on real hardware. A cleared latch must ask again on the very next link.
+        assertTrue(ask(gaveUp = false))
+    }
+
+    @Test
+    fun `the retirement line names both ways out and blames neither the app nor the user`() {
+        val line = explicitBondGivenUpLine()
+        assertTrue(line.contains("Press Connect"))
+        assertTrue(line.contains("pairing mode"))
+        assertTrue(line.contains("off"))
+        // The system notice is what the user has been looking at; the line has to connect the two or it
+        // reads as unrelated.
+        assertTrue(line.contains("Pairing rejected"))
+        // And it claims the retirement rather than a one-connect skip. It prints once while governing
+        // every connect after it, so "on this connect" would have a reader seeing twenty later connects
+        // conclude the line was stale - the same shape as every other misleading line in this area.
+        assertTrue(line.contains("again"))
+        assertFalse(line.contains("on this connect"))
+    }
+
     @Test
     fun `an OS-level pairing already exists, so we do not ask again`() {
         assertFalse(ask(osBonded = true))

From 9e4fe34c21ab9be0c91ab471a15cfb9516d5fe26 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 19:17:19 +1200
Subject: [PATCH 113/333] staging: build 399 / iOS 280 for the pairing-request
 stand-down

Build numbers only - 10.6.1 stays the unreleased line, and 399 clears the
staging high-water so the APK installs over 398.

Carries the last of the three unbounded #1635 experiments. Asking Android
to pair now stands down once the strap has refused the encrypted bond
enough times for the handshake to be latched off, so a 5/MG that answers
SMP "Pairing Not Supported" stops producing system "Pairing rejected"
notices the user did not ask for.

Nothing about connecting changes: the give-up this rides keeps the link up
and live HR streaming. Tapping Connect asks again on the next link, so
putting a strap into pairing mode and reconnecting still works; only the
automatic retry on every link is gone, and with links stable since 398
that path fired only when a new link happened to form.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 65fc2f7b83..f2cd012443 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 398
+        versionCode = 399
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 0c6fb34326..4792320866 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "279"
+    CURRENT_PROJECT_VERSION: "280"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From c9a4802e95b3406be5791e1cf7bfa3418a9a3721 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 20:07:09 +1200
Subject: [PATCH 114/333] The Devices card told the truth once, then went green
 again (#221)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A 5/MG that has never persisted a single row, showing a green "Active · Live"
pill beside a feature list reading Heart rate · HRV · Skin temp · Resp rate ·
Steps · Sleep · Strain · Battery, and "Powers Charge, Effort, Rest, Sleep +
Health Monitor". Everywhere else in the app already told the truth about that
strap - the Live screen says "Live HR (not fully paired)", the log says the
handshake is off. Only the Devices card claimed it was working.

The card already had the right state and was not reaching it. devicePillState
puts "Connected · not paired" above "Active · Live", but bondRefused reads
pairingHint, and the hint is written only where a refusal FRESHLY crosses the
give-up. The latch recording that give-up is persisted; the hint was not. So the
launch that gave up showed the pill correctly and every launch after it fell
through to green.

It was masked until the pairing request stopped wiping the latch on every link:
the give-up used to re-cross constantly and keep the hint fresh by accident.
Removing that wipe was right, and it left this standing alone - the same shape as
the three before it, state derived once in the process where the event happened,
describing a fact that outlives it.

Parity is the point here, and unlike the previous three this was a genuine gap
with Swift on the correct side. BLEManager.swift already republishes the hint in
its suppression branch. This closes the gap in the same place, beside the Kotlin
line reporting the same fact, rather than inventing a second placement. Verified
at every layer: the bondRefused derivation is identical on both sides
(status == active && live.connected && pairingHint != nil/null), the pill
priority order is identical and mirror-tested on both, and both subtitles return
"Connected, but not paired". After this the two agree exactly, and no Swift
change is owed.

Assigned rather than seeded, which a review pass corrected. The first version
kept any hint already published, on the reasoning that a live observation beats a
remembered one; that was a silent semantic divergence in code documented as
mirroring Swift exactly, and wrong on its own terms - the only hint that can be
present at that point came from a PREVIOUS link, since refusals are detected on
teardown and this runs during setup. A stale hint about a condition that may no
longer hold is not the fresher fact.

Side effect worth having: the card's how-to-fix guidance is gated on bondRefused
&& pairingHint != null, so it returns too. A user who relaunched the app was
losing both the honest pill and the instructions for fixing it.

The comment on the bondRefused call site claimed the hint is set "never during a
normal connect", which this makes untrue. It now describes both routes and why
the conclusion still holds: a 4.0 never latches and is not on this code path at
all, and a fresh 5/MG has no latch to read.

The whole functional change is one line writing a UI state string. No GATT calls,
no writes, no subscribes, no timers, no connect or disconnect logic - it cannot
affect a link. pairingHint has exactly two consumers, the card pill and the card
footnote, so nothing else is switched on by it.

Considered and rejected: driving bondRefused off bonded && !encryptedBond, which
is what the Live screen uses and needs no persistence. It would flash "Connected
· not paired" during every healthy 5/MG handshake, in the window between the
live-HR shortcut setting bonded and the hello acking. Accurate, but a warning
pill that appears and clears on every normal connect trains people to ignore it.

Tests: HelloSuppressionTest +1, pinning the coupling that outlives the
implementation - the card pill keys on pairingHint being non-null, so a hint that
ever came back blank would take the card silently back to green. 609 tests in
com.noop.ble and 863 in com.noop.ui, zero failures on a forced clean run.
compileFullDebugKotlin, doc_comment_lint and i18n_audit clean.

Known and left alone: Swift localizes the "Connected, but not paired" subtitle
via String(localized:) and Kotlin uses a bare literal. Pre-existing, affects all
of lastSeenLine's strings, and sits in the i18n audit's known blind spot for
literals in non-@Composable functions. Its own change.

Refs #1635, #221.
---
 .../src/main/java/com/noop/ble/WhoopBleClient.kt | 16 ++++++++++++++++
 .../src/main/java/com/noop/ui/DevicesScreen.kt   |  9 ++++++---
 .../java/com/noop/ble/HelloSuppressionTest.kt    | 13 +++++++++++++
 3 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index c0897bb276..f52e66400e 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -8549,6 +8549,22 @@ class WhoopBleClient(
                     log("WHOOP 5/MG: CLIENT_HELLO suppressed for this strap — it was never acknowledged and" +
                         " the write is what drops the link. Staying on live HR (not fully paired); press" +
                         " Connect to try the handshake again (#1635).")
+                    // #221: republish the pairing hint, which the Devices card's "Connected · not paired"
+                    // pill reads. It is otherwise written only where a refusal FRESHLY crosses the give-up,
+                    // and the latch that records the give-up outlives the process while the hint did not —
+                    // so every launch after the one that gave up showed a green "Active · Live" beside a
+                    // feature list naming Sleep, Strain and HRV, on a strap that has never banked a row.
+                    // Placed HERE, next to the line reporting the same fact, because Swift already does
+                    // exactly this (BLEManager.swift, the matching suppression branch): the gap was
+                    // one-sided, and this closes it rather than inventing a second placement.
+                    //
+                    // Assigned, not seeded. A first attempt kept any hint already published, on the
+                    // reasoning that a live observation beats a remembered one — but the only hint that can
+                    // be present here came from a PREVIOUS link, since refusals are detected on teardown
+                    // and this runs during setup. A stale hint about a condition that may no longer hold
+                    // is not the fresher fact; the state of the link in hand is. Swift assigns for the
+                    // same reason, and mirrored code diverging quietly is worse than either choice.
+                    _state.update { it.copy(pairingHint = BondRefusalGiveUp.helloSuppressedHint()) }
                     // The unbonded DIS attempt rides HERE, on the suppressed link, and nowhere else. This
                     // is the only 5/MG state known to be stable: the handshake is off, the watchdog is
                     // cancelled, and the link holds. During the reconnect loop it would have ~4.8s and
diff --git a/android/app/src/main/java/com/noop/ui/DevicesScreen.kt b/android/app/src/main/java/com/noop/ui/DevicesScreen.kt
index f499f3c0b0..91bead4e38 100644
--- a/android/app/src/main/java/com/noop/ui/DevicesScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/DevicesScreen.kt
@@ -235,9 +235,12 @@ fun DevicesScreen(
                 isLiveConnected = device.status == DeviceStatus.active.name && live.connected,
                 // #221: a WHOOP 5/MG can be BLE-connected yet have its ENCRYPTED bond refused (the WHOOP
                 // app, or a stale pairing, holds the single-app bond) — no HR/biometric data flows even
-                // though the link is up, so "Active · Live" overstates it. pairingHint is set only once
-                // that refusal is genuinely detected (#78), never during a normal connect, so this can't
-                // false-alarm a working 4.0 (its pairingHint stays null) or a fresh 5/MG connect.
+                // though the link is up, so "Active · Live" overstates it. pairingHint is raised either by
+                // a refusal detected on this link (#78) or, on connect, by the persisted give-up latch for
+                // a strap already known to be unpaired ([seededPairingHint]) — the latter because the
+                // latch outlives the process and the hint did not, so every launch after the one that gave
+                // up came back green. Neither route false-alarms a working 4.0, which never latches and is
+                // not on this code path at all, nor a fresh 5/MG, which has no latch to read.
                 bondRefused = device.status == DeviceStatus.active.name && live.connected && live.pairingHint != null,
                 // The full #78 how-to-fix guidance, surfaced on the card itself when bondRefused so the
                 // fix is self-service instead of buried in the strap log.
diff --git a/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt b/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
index b2d0a390e1..681c71123d 100644
--- a/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
+++ b/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
@@ -1,6 +1,8 @@
 package com.noop.ble
 
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Test
@@ -41,6 +43,17 @@ class HelloSuppressionTest {
         assertEquals(null, helloSuppressionPrefKey(null))
     }
 
+    /**
+     * The Devices card's "Connected · not paired" pill keys on `pairingHint != null`, and the suppressed
+     * connect publishes exactly this hint (WhoopBleClient's suppression branch, mirroring Swift's). A hint
+     * that ever came back blank would take the card silently back to a green "Active · Live" on a strap
+     * that has never banked a row - which is the state this whole path exists to stop misreporting.
+     */
+    @Test
+    fun `the suppression hint is non-blank, because a card pill depends on it`() {
+        assertTrue(BondRefusalGiveUp.helloSuppressedHint().isNotBlank())
+    }
+
     @Test
     fun `the suppression hint never claims a pause or a cause`() {
         val hint = BondRefusalGiveUp.helloSuppressedHint()

From 0504a3116bb21292444e4e55ec059d08133cf9ee Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 20:49:43 +1200
Subject: [PATCH 115/333] A day you never logged is not a day you answered No
 (#322)

Reported by a user on Reddit, in these terms: "if I didn't track something for
100 days, NOOP takes that as a NO for 100 days, whereas it simply was not logged
at all." They were right, and it was not a WHOOP 5 limitation as they suspected -
the journal effect engine is device-independent.

Every with/without split partitioned on the Yes set alone:

    if (behaviorDays.contains(day)) with else without

so every day carrying an outcome became a control, whether the user had answered
No or had never opened the journal. Four separate homes: Kotlin EffectRanker,
Swift BehaviorInsights, the rank/bestLag threading on both, and a hand-rolled
copy inside Android's InsightsScreen that never called the ranker at all. A
search for EffectRanker. would not have found the fourth; a caller audit did.

The journal already distinguished the three states - a No writes a row with
answeredYes = false, and only Clear deletes the row - so nothing but the split
was conflating them. No schema change, no migration. Controls are now the days
answered NO, passed explicitly, and a day in neither set takes part in no
comparison.

That fourth copy turned out to be a second problem. Android's Insights screen
carried its own pooled-SD Cohen's d and its own significance rule, described in
the code as "crude significance: an honest stand-in for a t-test" (|d| >= 0.5
with >= 3 days a side), where iOS's same screen ran a Welch p at p < 0.05 with
min(nWith, nWithout) >= 5. One journal could flag different behaviours as
significant depending on platform, with no test able to notice. EffectRanker
gains rankNoLag - the byte-identical twin of Swift's BehaviorInsights.rank, lag 0,
same gate, same ordering - and the screen's private BehaviorEffect, cohensD and
variance are deleted.

Consequences, stated rather than discovered:

Expect FEWER findings. Unlogged days inflated nWithout, which shrinks the Welch p
and helps clear the min(nWith, nWithout) gate, so some existing correlations will
stop appearing - they were confidence drawn from days that said nothing.

Surviving findings will show LOWER CONFIDENCE. bestLag sets
pairs = min(nWith, nWithout) and feeds the ladder (calibratingBelow 5, solidPairs
10), so rows move down from SOLID toward BUILDING. That is the correction, not a
symptom of one.

A behaviour never logged No yields nothing at all - the honest answer when there
are no controls. Numeric journal items write answeredYes = true and are cleared
by deleting the row, so they have no No days and lose their binary effect; the
dose-response series is the analysis that fits them, and the binary one was
precisely the reported bug.

Android's Insights screen will mark FEWER items significant, a Welch p at min >= 5
being stricter than |d| >= 0.5 at >= 3, and will include thinner pairs its old
>= 2-a-side gate dropped, shown as exploratory. Both are the iOS behaviour.

Both rank entry points fail CLOSED: a behaviour absent from the controls map has
no control group and yields nothing, so a caller that forgets loses the insight
rather than getting a wrong one. Pinned on both, on both platforms.

No new copy needed - both platforms' empty state already reads "Effects need days
both with and without each behaviour", written for the model the code should have
had.

Degenerate cases checked rather than assumed, since the screen's gate relaxed from
>= 2 a side to the engine's >= 1: sampleVariance returns 0 below n=2, cohensD
returns 0 when df <= 0 or the pooled SD is 0, and welchP short-circuits on
se2 <= 0. No NaN can reach the UI.

Existing fixtures predate the split and test the LAG math, so they were repinned
by declaring the complement explicitly rather than deleted - every prior assertion
still holds for the same reason it did before.

Android 4962 unit tests and Swift 1675, zero failures. Parity is byte-identical on
both sides, as the ranker contract requires.

Refs #322.
---
 .../StrandAnalytics/BehaviorInsights.swift    |  32 +++-
 .../StrandAnalytics/EffectRanker.swift        |   9 +-
 .../BehaviorInsightsTests.swift               |  75 ++++++++-
 .../EffectRankerTests.swift                   |   6 +-
 Strand/AI/AICoach.swift                       |  11 +-
 Strand/Screens/InsightsHubView.swift          |  12 +-
 Strand/Screens/InsightsView.swift             |  17 +-
 .../app/src/main/java/com/noop/ai/AiCoach.kt  |  21 ++-
 .../java/com/noop/analytics/EffectRanker.kt   |  74 ++++++++-
 .../java/com/noop/ui/InsightsHubScreen.kt     |  17 +-
 .../main/java/com/noop/ui/InsightsScreen.kt   |  88 +++-------
 .../com/noop/analytics/EffectRankerTest.kt    | 156 +++++++++++++++++-
 12 files changed, 420 insertions(+), 98 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/BehaviorInsights.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/BehaviorInsights.swift
index 8c37816ff0..71ef1bedd0 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/BehaviorInsights.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/BehaviorInsights.swift
@@ -77,13 +77,27 @@ public enum BehaviorInsights {
 
     // MARK: - Single behavior effect
 
-    /// Compute the effect of `behavior` on `outcome`. Days are partitioned into
-    /// "with" (day ∈ behaviorDays) and "without" (day ∉ behaviorDays), restricted
-    /// to days that have an outcome value in `outcomeByDay`.
+    /// Compute the effect of `behavior` on `outcome`. "With" is day ∈ `behaviorDays`; "without" is
+    /// day ∈ `controlDays`. Days in NEITHER are dropped, and that is the point of the second set.
+    ///
+    /// The split used to be `if behaviorDays.contains(day) { with } else { without }`, which made every
+    /// day carrying an outcome a control — so a behaviour logged Yes on 20 days and never logged at all
+    /// on the other 100 was measured against those 100 as though the user had answered No. Reported by a
+    /// user on Reddit, in those terms: "if I didn't track something for 100 days, NOOP takes that as a
+    /// NO for 100 days, whereas it simply was not logged at all."
+    ///
+    /// The journal already distinguishes the three states — a No writes a row with `answeredYes = false`,
+    /// and only Clear deletes the row — so nothing but this split was conflating them.
+    ///
+    /// Expect FEWER findings, not better-looking ones. Unlogged days inflated nWithout, which shrinks the
+    /// Welch p and helps clear the min(nWith, nWithout) gate; dropping them removes confidence that was
+    /// never earned. A behaviour with no No days now yields nothing, which is the honest answer: with no
+    /// controls there is no comparison to make.
     ///
     /// Returns nil unless BOTH groups are non-empty AND the total is large enough
     /// to form a variance estimate (at least 1 value per side and ≥ 3 total).
     public static func effect(behaviorDays: Set<String>,
+                              controlDays: Set<String>,
                               outcomeByDay: [String: Double],
                               behavior: String,
                               outcome: String) -> BehaviorEffect? {
@@ -91,7 +105,10 @@ public enum BehaviorInsights {
         var withoutVals: [Double] = []
         for (day, value) in outcomeByDay {
             if behaviorDays.contains(day) { withVals.append(value) }
-            else { withoutVals.append(value) }
+            else if controlDays.contains(day) { withoutVals.append(value) }
+            // Neither: the behaviour was not logged that day. Not a control — no information.
+            // A day in BOTH would count as "with"; callers merge imported ∪ native before building
+            // these, so one question cannot hold two answers for one day.
         }
 
         let n1 = withVals.count
@@ -125,11 +142,16 @@ public enum BehaviorInsights {
     /// return them sorted by |cohensD| descending, with significant effects first.
     /// Behaviors that don't yield a computable effect are dropped.
     public static func rank(behaviors: [String: Set<String>],
+                            controls: [String: Set<String>],
                             outcomeByDay: [String: Double],
                             outcome: String) -> [BehaviorEffect] {
         var effects: [BehaviorEffect] = []
         for (name, days) in behaviors {
-            if let e = effect(behaviorDays: days, outcomeByDay: outcomeByDay,
+            // A behaviour absent from `controls` has no controls and yields nothing — failing CLOSED, so
+            // a caller that forgets loses the insight rather than getting a wrong one measured against
+            // every day the user never opened the journal.
+            if let e = effect(behaviorDays: days, controlDays: controls[name] ?? [],
+                              outcomeByDay: outcomeByDay,
                               behavior: name, outcome: outcome) {
                 effects.append(e)
             }
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/EffectRanker.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/EffectRanker.swift
index 0ff4645c04..aad7f5068b 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/EffectRanker.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/EffectRanker.swift
@@ -104,13 +104,18 @@ public enum EffectRanker {
     ///   significant-first, |cohensD| desc, then behaviour name asc. Behaviours with no
     ///   computable lag are dropped.
     public static func rank(behaviors: [String: Set<String>],
+                            controls: [String: Set<String>],
                             outcomeByDay: [String: Double],
                             outcome: String) -> [RankedEffect] {
         var rows: [RankedEffect] = []
         // Sort behaviour names so the build order is deterministic regardless of dict order.
         for name in behaviors.keys.sorted() {
             let days = behaviors[name]!
-            if let row = bestLag(behaviorDays: days, outcomeByDay: outcomeByDay,
+            // Absent from `controls` means no control group, which yields nothing — see
+            // BehaviorInsights.effect. Failing closed is deliberate: a caller that forgets loses the
+            // insight rather than getting one measured against every unlogged day.
+            if let row = bestLag(behaviorDays: days, controlDays: controls[name] ?? [],
+                                 outcomeByDay: outcomeByDay,
                                  behavior: name, outcome: outcome) {
                 rows.append(row)
             }
@@ -121,6 +126,7 @@ public enum EffectRanker {
     /// Find the best-lag RankedEffect for ONE behaviour against ONE outcome, or nil when no
     /// lag in `lagSet` yields a computable effect that clears the group gate.
     public static func bestLag(behaviorDays: Set<String>,
+                               controlDays: Set<String>,
                                outcomeByDay: [String: Double],
                                behavior: String,
                                outcome: String) -> RankedEffect? {
@@ -128,6 +134,7 @@ public enum EffectRanker {
         for lag in lagSet {
             let shifted = shiftedOutcome(outcomeByDay, byLag: lag)
             guard let e = BehaviorInsights.effect(behaviorDays: behaviorDays,
+                                                  controlDays: controlDays,
                                                   outcomeByDay: shifted,
                                                   behavior: behavior,
                                                   outcome: outcome) else { continue }
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/BehaviorInsightsTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/BehaviorInsightsTests.swift
index 434cd453c2..a2fa1c77ab 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/BehaviorInsightsTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/BehaviorInsightsTests.swift
@@ -14,7 +14,7 @@ final class BehaviorInsightsTests: XCTestCase {
             "d13": 70, "d14": 68,
         ]
         let behaviorDays: Set<String> = ["d01", "d02", "d03", "d04", "d05", "d06"]
-        let e = BehaviorInsights.effect(behaviorDays: behaviorDays, outcomeByDay: outcome,
+        let e = BehaviorInsights.effect(behaviorDays: behaviorDays, controlDays: Set(outcome.keys).subtracting(behaviorDays), outcomeByDay: outcome,
                                         behavior: "Alcohol", outcome: "Recovery")!
         XCTAssertEqual(e.nWith, 6)
         XCTAssertEqual(e.nWithout, 8)
@@ -34,6 +34,7 @@ final class BehaviorInsightsTests: XCTestCase {
             "f": 70, "g": 72, "h": 68, "i": 71, "j": 69,   // without (mean 70)
         ]
         let e = BehaviorInsights.effect(behaviorDays: ["a", "b", "c", "d", "e"],
+                                        controlDays: Set(outcome.keys).subtracting(["a", "b", "c", "d", "e"]),
                                         outcomeByDay: outcome,
                                         behavior: "Meditation", outcome: "Recovery")!
         XCTAssertEqual(e.delta, 10.0, accuracy: 1e-9)
@@ -46,10 +47,12 @@ final class BehaviorInsightsTests: XCTestCase {
         // Behavior logged every day → no "without" group.
         let outcome: [String: Double] = ["a": 60, "b": 61, "c": 62]
         XCTAssertNil(BehaviorInsights.effect(behaviorDays: ["a", "b", "c"],
+                                             controlDays: Set(outcome.keys).subtracting(["a", "b", "c"]),
                                              outcomeByDay: outcome,
                                              behavior: "X", outcome: "Recovery"))
         // Behavior never logged → no "with" group.
         XCTAssertNil(BehaviorInsights.effect(behaviorDays: [],
+                                             controlDays: Set(outcome.keys).subtracting([]),
                                              outcomeByDay: outcome,
                                              behavior: "X", outcome: "Recovery"))
     }
@@ -58,6 +61,7 @@ final class BehaviorInsightsTests: XCTestCase {
         // "z" is in behaviorDays but has no outcome value → not counted in nWith.
         let outcome: [String: Double] = ["a": 60, "b": 62, "c": 70, "d": 72]
         let e = BehaviorInsights.effect(behaviorDays: ["a", "b", "z"],
+                                        controlDays: Set(outcome.keys).subtracting(["a", "b", "z"]),
                                         outcomeByDay: outcome,
                                         behavior: "X", outcome: "Recovery")!
         XCTAssertEqual(e.nWith, 2)        // a, b only
@@ -74,6 +78,7 @@ final class BehaviorInsightsTests: XCTestCase {
             "o1": 70, "o2": 71, "o3": 69, "o4": 70,
         ]
         let small = BehaviorInsights.effect(behaviorDays: ["w1", "w2", "w3", "w4"],
+                                            controlDays: Set(smallOutcome.keys).subtracting(["w1", "w2", "w3", "w4"]),
                                             outcomeByDay: smallOutcome,
                                             behavior: "X", outcome: "Recovery")!
         XCTAssertLessThan(small.pApprox, 0.05)       // strong evidence numerically…
@@ -86,6 +91,7 @@ final class BehaviorInsightsTests: XCTestCase {
             "o1": 70, "o2": 71, "o3": 69, "o4": 70, "o5": 70,
         ]
         let big = BehaviorInsights.effect(behaviorDays: ["w1", "w2", "w3", "w4", "w5"],
+                                          controlDays: Set(bigOutcome.keys).subtracting(["w1", "w2", "w3", "w4", "w5"]),
                                           outcomeByDay: bigOutcome,
                                           behavior: "X", outcome: "Recovery")!
         XCTAssertEqual(Swift.min(big.nWith, big.nWithout), 5)
@@ -99,6 +105,7 @@ final class BehaviorInsightsTests: XCTestCase {
             "o1": 64, "o2": 72, "o3": 61, "o4": 74, "o5": 67, "o6": 69,
         ]
         let e = BehaviorInsights.effect(behaviorDays: ["w1", "w2", "w3", "w4", "w5", "w6"],
+                                        controlDays: Set(outcome.keys).subtracting(["w1", "w2", "w3", "w4", "w5", "w6"]),
                                         outcomeByDay: outcome,
                                         behavior: "X", outcome: "Recovery")!
         XCTAssertGreaterThan(e.pApprox, 0.05)    // no separation → weak evidence
@@ -120,7 +127,13 @@ final class BehaviorInsightsTests: XCTestCase {
         // Tiny-but-significant-impossible: 2 days only.
         let tiny: Set<String> = ["d3", "d9"]
 
+        // Predates the Yes/No split and tests the ranking math, so it keeps its original partition
+        // by declaring the complement as controls explicitly.
+        let all = Set(outcome.keys)
         let ranked = BehaviorInsights.rank(behaviors: ["Strong": strong, "Weak": weak, "Tiny": tiny],
+                                           controls: ["Strong": all.subtracting(strong),
+                                                      "Weak": all.subtracting(weak),
+                                                      "Tiny": all.subtracting(tiny)],
                                            outcomeByDay: outcome, outcome: "Recovery")
         XCTAssertEqual(ranked.count, 3)
         XCTAssertEqual(ranked.first?.behavior, "Strong")   // significant + largest |d|
@@ -135,9 +148,15 @@ final class BehaviorInsightsTests: XCTestCase {
     func testRankDropsUncomputableBehaviors() {
         let outcome: [String: Double] = ["a": 60, "b": 62, "c": 70, "d": 72]
         // "AllDays" covers every day → no without group → dropped.
+        // Predates the Yes/No split and tests the ranking math, so it keeps its original partition
+        // by declaring the complement as controls explicitly.
+        let all = Set(outcome.keys)
         let ranked = BehaviorInsights.rank(behaviors: [
             "AllDays": ["a", "b", "c", "d"],
             "Half": ["a", "b"],
+        ], controls: [
+            "AllDays": all.subtracting(["a", "b", "c", "d"]),
+            "Half": all.subtracting(["a", "b"]),
         ], outcomeByDay: outcome, outcome: "Recovery")
         XCTAssertEqual(ranked.count, 1)
         XCTAssertEqual(ranked.first?.behavior, "Half")
@@ -153,6 +172,7 @@ final class BehaviorInsightsTests: XCTestCase {
             "o1": 78, "o2": 82, "o3": 80, "o4": 79, "o5": 81,   // mean 80
         ]
         let e = BehaviorInsights.effect(behaviorDays: ["w1", "w2", "w3", "w4", "w5"],
+                                        controlDays: Set(outcome.keys).subtracting(["w1", "w2", "w3", "w4", "w5"]),
                                         outcomeByDay: outcome,
                                         behavior: "Alcohol", outcome: "Recovery")!
         let s = BehaviorInsights.sentence(e)
@@ -165,6 +185,7 @@ final class BehaviorInsightsTests: XCTestCase {
             "o1": 49, "o2": 51, "o3": 50,    // mean 50
         ]
         let e = BehaviorInsights.effect(behaviorDays: ["w1", "w2", "w3"],
+                                        controlDays: Set(outcome.keys).subtracting(["w1", "w2", "w3"]),
                                         outcomeByDay: outcome,
                                         behavior: "Meditation", outcome: "Recovery")!
         let s = BehaviorInsights.sentence(e)
@@ -179,10 +200,62 @@ final class BehaviorInsightsTests: XCTestCase {
             "o1": 0, "o2": 0, "o3": 0,
         ]
         let e = BehaviorInsights.effect(behaviorDays: ["w1", "w2", "w3"],
+                                        controlDays: Set(outcome.keys).subtracting(["w1", "w2", "w3"]),
                                         outcomeByDay: outcome,
                                         behavior: "X", outcome: "HRV")!
         XCTAssertNil(e.pctChange)
         let s = BehaviorInsights.sentence(e)
         XCTAssertEqual(s, "On days you logged ‘X’, HRV was 5.0 higher (avg 5 vs 0, n=3 vs 3).")
     }
+    // MARK: - Unlogged days are not answers (the Reddit report)
+
+    /// "If I didn't track something for 100 days, NOOP takes that as a NO for 100 days, whereas it simply
+    /// was not logged at all." Reported by a user on Reddit, and it was exactly what the split did.
+    ///
+    /// Twin of Kotlin `EffectRankerTest.daysWithNoJournalRowAreNotControls`.
+    func testDaysWithNoJournalRowAreNotControls() {
+        var outcome: [String: Double] = [:]
+        var yes: Set<String> = []
+        var no: Set<String> = []
+        for d in 1...6 { let k = "y\(d)"; yes.insert(k); outcome[k] = Double(58 + d) }
+        for d in 1...6 { let k = "n\(d)"; no.insert(k); outcome[k] = Double(68 + d) }
+        // Never opened the journal on these, and their values sit far from BOTH answered groups.
+        for d in 1...40 { outcome["u\(d)"] = Double(20 + (d % 3)) }
+
+        let e = BehaviorInsights.effect(behaviorDays: yes, controlDays: no,
+                                        outcomeByDay: outcome,
+                                        behavior: "Alcohol", outcome: "Recovery")!
+        // Controls are the six NO days only. Were the 40 unlogged days leaking in, nWithout would be 46
+        // and meanWithout would be dragged towards 20.
+        XCTAssertEqual(e.nWith, 6)
+        XCTAssertEqual(e.nWithout, 6)
+        XCTAssertGreaterThan(e.meanWithout, 60.0)
+    }
+
+    /// A behaviour the user only ever ticks Yes has no control group, so there is no comparison to make
+    /// and the honest answer is none. Twin of Kotlin `aBehaviourNeverLoggedNoYieldsNothing`.
+    func testBehaviourNeverLoggedNoYieldsNothing() {
+        var outcome: [String: Double] = [:]
+        var yes: Set<String> = []
+        for d in 1...10 { let k = "y\(d)"; yes.insert(k); outcome[k] = Double(50 + d) }
+        for d in 1...10 { outcome["u\(d)"] = Double(80 + d) }
+
+        XCTAssertNil(BehaviorInsights.effect(behaviorDays: yes, controlDays: [],
+                                             outcomeByDay: outcome,
+                                             behavior: "Alcohol", outcome: "Recovery"))
+    }
+
+    /// rank() fails CLOSED on a caller that forgets the controls: no insight, rather than a wrong one
+    /// measured against every day the user never opened the journal. Twin of Kotlin
+    /// `rankWithoutControlsProducesNothingRatherThanGuessing`.
+    func testRankWithoutControlsProducesNothingRatherThanGuessing() {
+        var outcome: [String: Double] = [:]
+        var yes: Set<String> = []
+        for d in 1...10 { let k = "y\(d)"; yes.insert(k); outcome[k] = Double(50 + d) }
+        for d in 1...20 { outcome["u\(d)"] = Double(75 + (d % 4)) }
+
+        XCTAssertTrue(BehaviorInsights.rank(behaviors: ["Alcohol": yes], controls: [:],
+                                            outcomeByDay: outcome, outcome: "Recovery").isEmpty)
+    }
+
 }
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/EffectRankerTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/EffectRankerTests.swift
index c3c3d63ce0..7c704ae5d5 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/EffectRankerTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/EffectRankerTests.swift
@@ -38,6 +38,7 @@ final class EffectRankerTests: XCTestCase {
         }
 
         let out = EffectRanker.rank(behaviors: ["Alcohol": behaviorDays],
+                                    controls: ["Alcohol": Set(outcome.keys).subtracting(behaviorDays)],
                                     outcomeByDay: outcome, outcome: "Charge")
         let r = row(out, "Alcohol")
         XCTAssertNotNil(r)
@@ -62,7 +63,7 @@ final class EffectRankerTests: XCTestCase {
     private func effectAtLag(_ behaviorDays: Set<String>, _ outcome: [String: Double],
                              _ lag: Int) -> BehaviorEffect? {
         let shifted = EffectRanker.shiftedOutcome(outcome, byLag: lag)
-        return BehaviorInsights.effect(behaviorDays: behaviorDays, outcomeByDay: shifted,
+        return BehaviorInsights.effect(behaviorDays: behaviorDays, controlDays: Set(shifted.keys).subtracting(behaviorDays), outcomeByDay: shifted,
                                        behavior: "Alcohol", outcome: "Charge")
     }
 
@@ -82,6 +83,7 @@ final class EffectRankerTests: XCTestCase {
         for d in 1...8 { outcome[ymd(2026, 7, d)] = 70 + jitter(d) }   // plenty of "without"
 
         let out = EffectRanker.rank(behaviors: ["Sparse": thin],
+                                    controls: ["Sparse": Set(outcome.keys).subtracting(thin)],
                                     outcomeByDay: outcome, outcome: "Charge")
         XCTAssertTrue(out.isEmpty)
     }
@@ -110,6 +112,8 @@ final class EffectRankerTests: XCTestCase {
         for d in 10...20 { outcome[ymd(2026, 5, d)] = 70 + jitter(d) }
 
         let out = EffectRanker.rank(behaviors: ["Big": big, "Small": small],
+                                    controls: ["Big": Set(outcome.keys).subtracting(big),
+                                               "Small": Set(outcome.keys).subtracting(small)],
                                     outcomeByDay: outcome, outcome: "Charge")
         XCTAssertEqual(out.map { $0.behavior }, ["Big", "Small"])   // |d| Big > Small
         XCTAssertEqual(row(out, "Big")!.lag, 0)                     // both are same-day effects
diff --git a/Strand/AI/AICoach.swift b/Strand/AI/AICoach.swift
index fb002d8f4b..9046711e4b 100644
--- a/Strand/AI/AICoach.swift
+++ b/Strand/AI/AICoach.swift
@@ -611,13 +611,20 @@ final class AICoachEngine: ObservableObject {
 
         // 1. Strongest behaviour→outcome associations (EffectRanker over the journal × Charge).
         let entries = await repo.journalEntries()
+        // Yes days and NO days, kept apart. A day with no journal row for the question lands in
+        // neither, so an unanswered day is never counted as a No (BehaviorInsights.effect).
         var byBehaviour: [String: Set<String>] = [:]
-        for e in entries where e.answeredYes { byBehaviour[e.question, default: []].insert(e.day) }
+        var controls: [String: Set<String>] = [:]
+        for e in entries {
+            if e.answeredYes { byBehaviour[e.question, default: []].insert(e.day) }
+            else { controls[e.question, default: []].insert(e.day) }
+        }
         if !byBehaviour.isEmpty {
             let outcomeByDay = Dictionary(
                 repo.days.compactMap { d in d.recovery.map { (d.day, $0) } },
                 uniquingKeysWith: { _, last in last })
-            let ranked = EffectRanker.rank(behaviors: byBehaviour, outcomeByDay: outcomeByDay, outcome: "Charge")
+            let ranked = EffectRanker.rank(behaviors: byBehaviour, controls: controls,
+                                           outcomeByDay: outcomeByDay, outcome: "Charge")
                 .filter { $0.effect.significant }
                 .prefix(3)
             if !ranked.isEmpty {
diff --git a/Strand/Screens/InsightsHubView.swift b/Strand/Screens/InsightsHubView.swift
index 9bfca37e78..a5fe185a22 100644
--- a/Strand/Screens/InsightsHubView.swift
+++ b/Strand/Screens/InsightsHubView.swift
@@ -546,6 +546,8 @@ final class InsightsHubViewModel: ObservableObject {
     // MARK: Loaded inputs (kept so the outcome segmented control can re-rank cheaply)
 
     private var behaviours: [String: Set<String>] = [:]
+    /// Per behaviour, the days it was logged NO — the only legitimate control group.
+    private var controls: [String: Set<String>] = [:]
     private var outcomeByKey: [String: [String: Double]] = [:]
     private var currentOutcome: Outcome = .recovery
 
@@ -559,9 +561,13 @@ final class InsightsHubViewModel: ObservableObject {
     func load(repo: Repository) async {
         // Journal → behaviour → days (only "yes" answers count as the behaviour occurring).
         let entries = await repo.journalEntries()
+        // Yes days and NO days, kept apart. A day with no journal row for the question lands in
+        // neither, so an unanswered day is never counted as a No (BehaviorInsights.effect).
         var byBehaviour: [String: Set<String>] = [:]
-        for e in entries where e.answeredYes {
-            byBehaviour[e.question, default: []].insert(e.day)
+        var controlsByBehaviour: [String: Set<String>] = [:]
+        for e in entries {
+            if e.answeredYes { byBehaviour[e.question, default: []].insert(e.day) }
+            else { controlsByBehaviour[e.question, default: []].insert(e.day) }
         }
 
         // Outcome series: imported metricSeries ∪ the DailyMetric column fallback so an
@@ -611,6 +617,7 @@ final class InsightsHubViewModel: ObservableObject {
         }
 
         self.behaviours = byBehaviour
+        self.controls = controlsByBehaviour
         self.outcomeByKey = byKey
         self.doseCards = cards
         self.loaded = true
@@ -622,6 +629,7 @@ final class InsightsHubViewModel: ObservableObject {
         currentOutcome = outcome
         let outcomeDays = outcomeByKey[outcome.key] ?? [:]
         ranked = EffectRanker.rank(behaviors: behaviours,
+                                   controls: controls,
                                    outcomeByDay: outcomeDays,
                                    outcome: outcome.outcomeName)
     }
diff --git a/Strand/Screens/InsightsView.swift b/Strand/Screens/InsightsView.swift
index af2c34b2d6..7d455bdcce 100644
--- a/Strand/Screens/InsightsView.swift
+++ b/Strand/Screens/InsightsView.swift
@@ -40,6 +40,9 @@ private struct InsightsLoadKey: Equatable {
 /// the seq AND the dayKey still match (see `Repository.insightsLoadedSeq` / `insightsLoadedDayKey`).
 struct InsightsLoadCache {
     let behaviours: [String: Set<String>]
+    /// Per behaviour, the days it was logged NO. Cached alongside `behaviours` because a restore that
+    /// dropped it would leave the ranker with no controls and silently produce no insights at all.
+    let controls: [String: Set<String>]
     let importedQuestions: [String]
     let dayAnswers: [String: Bool]
     /// The journal day offset the `dayAnswers` were read for (0 = today, 1 = yesterday, -1 = tomorrow). The
@@ -152,6 +155,8 @@ struct InsightsView: View {
 
     /// behaviour question → set of days where it was answered yes.
     @State private var behaviours: [String: Set<String>] = [:]
+    /// Per behaviour, the days it was logged NO — the only legitimate control group.
+    @State private var controls: [String: Set<String>] = [:]
     /// outcome key → [day: value].
     @State private var outcomeByKey: [String: [String: Double]] = [:]
     /// outcome key → ordered (day, value) series for correlations.
@@ -351,10 +356,14 @@ struct InsightsView: View {
         // log writes answeredYes=true too (#322), so a numeric item lands in the with/without split
         // here unchanged, on top of the numeric series read below.
         let entries = await repo.journalEntries()
+        // Yes days and NO days, kept apart. A day with no journal row for the question lands in
+        // neither, so an unanswered day is never counted as a No (BehaviorInsights.effect).
         var byBehaviour: [String: Set<String>] = [:]
+        var controlsByBehaviour: [String: Set<String>] = [:]
         var numericByBehaviour: [String: [String: Double]] = [:]
-        for e in entries where e.answeredYes {
-            byBehaviour[e.question, default: []].insert(e.day)
+        for e in entries {
+            if e.answeredYes { byBehaviour[e.question, default: []].insert(e.day) }
+            else { controlsByBehaviour[e.question, default: []].insert(e.day) }
         }
         // #322: per-question numeric series (question → [day: value]) for numeric journal items. A
         // numeric series is the same [day: value] shape a metric outcome is, so the effect ranker can
@@ -415,6 +424,7 @@ struct InsightsView: View {
 
         await MainActor.run {
             self.behaviours = byBehaviour
+            self.controls = controlsByBehaviour
             self.importedQuestions = importedQs
             self.dayAnswers = nativeAnswers
             self.dayNumeric = nativeNumeric
@@ -432,6 +442,7 @@ struct InsightsView: View {
             // freshest read, a subsequent re-mount never restores stale data behind a journal toggle.
             self.repo.insightsCache = InsightsLoadCache(
                 behaviours: byBehaviour,
+                controls: controlsByBehaviour,
                 importedQuestions: importedQs,
                 dayAnswers: nativeAnswers,
                 journalDayOffset: self.journalDayOffset,
@@ -450,6 +461,7 @@ struct InsightsView: View {
     @MainActor
     private func restoreFromCache(_ c: InsightsLoadCache) {
         behaviours = c.behaviours
+        controls = c.controls
         importedQuestions = c.importedQuestions
         dayAnswers = c.dayAnswers
         // Numeric journal rows are native-only (imported WHOOP rows never carry a numericValue), so the
@@ -516,6 +528,7 @@ struct InsightsView: View {
         let outcomeDays = outcomeByKey[outcome.key] ?? [:]
         ranked = BehaviorInsights.rank(
             behaviors: behaviours,
+            controls: controls,
             outcomeByDay: outcomeDays,
             outcome: outcome.outcomeName
         )
diff --git a/android/app/src/main/java/com/noop/ai/AiCoach.kt b/android/app/src/main/java/com/noop/ai/AiCoach.kt
index 16b706670d..07f6e87acc 100644
--- a/android/app/src/main/java/com/noop/ai/AiCoach.kt
+++ b/android/app/src/main/java/com/noop/ai/AiCoach.kt
@@ -308,11 +308,12 @@ class AiCoach(
         val sb = StringBuilder()
 
         // --- Strongest associations on the user's own logged days (recovery as the outcome) ---
-        val behaviours = runCatching { journalBehaviours() }.getOrDefault(emptyMap())
+        val (behaviours, controls) = runCatching { journalBehaviours() }
+            .getOrDefault(emptyMap<String, Set<String>>() to emptyMap())
         val days = runCatching { repo.daysMerged(activeStrapId()) }.getOrDefault(emptyList())
         if (behaviours.isNotEmpty() && days.isNotEmpty()) {
             val recoveryByDay = days.mapNotNull { d -> d.recovery?.let { d.day to it } }.toMap()
-            val ranked = runCatching { EffectRanker.rank(behaviours, recoveryByDay, "Charge") }
+            val ranked = runCatching { EffectRanker.rank(behaviours, controls, recoveryByDay, "Charge") }
                 .getOrDefault(emptyList())
                 .take(3)
             if (ranked.isNotEmpty()) {
@@ -341,16 +342,22 @@ class AiCoach(
         return sb.toString().trim().takeIf { it.isNotEmpty() }
     }
 
-    /** Behaviour → set of "yyyy-MM-dd" days it was logged "yes" (imported ∪ native), for EffectRanker. */
-    private suspend fun journalBehaviours(): Map<String, Set<String>> {
+    /** Behaviour → the days it was logged YES and the days it was logged NO (imported ∪ native), for
+     *  EffectRanker. Kept apart: a day with no journal row for a question belongs to neither, so an
+     *  unanswered day is never counted as a No — see [EffectRanker.effect]. */
+    private suspend fun journalBehaviours(): Pair<Map<String, Set<String>>, Map<String, Set<String>>> {
         val imported = repo.journal(deviceId, "0000-01-01", "9999-12-31")
         val native = repo.journal(journalDeviceId, "0000-01-01", "9999-12-31")
         val byKey = LinkedHashMap<Pair<String, String>, JournalEntry>()
         for (e in imported) byKey[e.day to e.question] = e
         for (e in native) byKey[e.day to e.question] = e   // native wins on a collision
-        val out = HashMap<String, MutableSet<String>>()
-        for (e in byKey.values) if (e.answeredYes) out.getOrPut(e.question) { mutableSetOf() }.add(e.day)
-        return out.mapValues { it.value.toSet() }
+        val yes = HashMap<String, MutableSet<String>>()
+        val no = HashMap<String, MutableSet<String>>()
+        for (e in byKey.values) {
+            val bucket = if (e.answeredYes) yes else no
+            bucket.getOrPut(e.question) { mutableSetOf() }.add(e.day)
+        }
+        return yes.mapValues { it.value.toSet() } to no.mapValues { it.value.toSet() }
     }
 
     /** The latest reading per Lab Book marker key (stored under the ACTIVE strap deviceId). #1304/#512:
diff --git a/android/app/src/main/java/com/noop/analytics/EffectRanker.kt b/android/app/src/main/java/com/noop/analytics/EffectRanker.kt
index 41431a94d7..6085da1d9b 100644
--- a/android/app/src/main/java/com/noop/analytics/EffectRanker.kt
+++ b/android/app/src/main/java/com/noop/analytics/EffectRanker.kt
@@ -113,27 +113,65 @@ object EffectRanker {
      * Rank every behaviour against one outcome across the lag set, keeping each behaviour's
      * best lag. Mirrors Swift's ordering on the surviving rows.
      *
-     * @param behaviors per behaviour name, the SET of "yyyy-MM-dd" days it was logged (dose ≥ 1).
+     * @param behaviors per behaviour name, the SET of "yyyy-MM-dd" days it was logged YES (dose ≥ 1).
+     * @param controls per behaviour name, the days it was logged NO. Required, and separate from
+     *   [behaviors] on purpose: a behaviour missing from this map has no controls and yields nothing,
+     *   which fails CLOSED. A caller that forgets it loses the insight rather than getting a wrong one
+     *   measured against every day the user never opened the journal.
      * @param outcomeByDay the daily outcome series keyed "yyyy-MM-dd".
      * @param outcome the outcome label carried onto each RankedEffect.
      */
     fun rank(
         behaviors: Map<String, Set<String>>,
+        controls: Map<String, Set<String>>,
         outcomeByDay: Map<String, Double>,
         outcome: String,
     ): List<RankedEffect> {
         val rows = ArrayList<RankedEffect>()
         for (name in behaviors.keys.sorted()) {
             val days = behaviors.getValue(name)
-            val r = bestLag(days, outcomeByDay, name, outcome)
+            val r = bestLag(days, controls[name].orEmpty(), outcomeByDay, name, outcome)
             if (r != null) rows.add(r)
         }
         return sorted(rows)
     }
 
+    /**
+     * Rank every behaviour against one outcome at lag 0 only — the Kotlin twin of Swift's
+     * `BehaviorInsights.rank`, ordering included.
+     *
+     * Exists because the Insights screen ranks at lag 0 while the Insights Hub searches the lag set, and
+     * Android had been doing the lag-0 version with its OWN copy of the math: a "crude significance"
+     * (|d| ≥ 0.5 with ≥ 3 a side, self-described as a stand-in for a t-test) against iOS's Welch p on the
+     * same screen. Two platforms flagged different behaviours as significant from identical journals.
+     * Routing it here retires that copy; the parity contract wants one implementation, not two that agree
+     * on a good day.
+     *
+     * Sort mirrors Swift exactly: significant first, then larger |Cohen's d|, then behaviour name — the
+     * last one so a dictionary-ordered walk still produces a stable list.
+     */
+    fun rankNoLag(
+        behaviors: Map<String, Set<String>>,
+        controls: Map<String, Set<String>>,
+        outcomeByDay: Map<String, Double>,
+        outcome: String,
+    ): List<BehaviorEffect> {
+        val effects = ArrayList<BehaviorEffect>()
+        for ((name, days) in behaviors) {
+            val e = effect(days, controls[name].orEmpty(), outcomeByDay, name, outcome)
+            if (e != null) effects.add(e)
+        }
+        return effects.sortedWith(
+            compareByDescending<BehaviorEffect> { it.significant }
+                .thenByDescending { abs(it.cohensD) }
+                .thenBy { it.behavior },
+        )
+    }
+
     /** Find the best-lag RankedEffect for ONE behaviour against ONE outcome, or null. */
     fun bestLag(
         behaviorDays: Set<String>,
+        controlDays: Set<String>,
         outcomeByDay: Map<String, Double>,
         behavior: String,
         outcome: String,
@@ -142,7 +180,7 @@ object EffectRanker {
         var bestEffect: BehaviorEffect? = null
         for (lag in lagSet) {
             val shifted = shiftedOutcome(outcomeByDay, lag)
-            val e = effect(behaviorDays, shifted, behavior, outcome) ?: continue
+            val e = effect(behaviorDays, controlDays, shifted, behavior, outcome) ?: continue
             if (minOf(e.nWith, e.nWithout) < minGroupForSignificance) continue
 
             val cur = bestEffect
@@ -182,12 +220,28 @@ object EffectRanker {
     // Effect (byte-identical port of Swift BehaviorInsights.effect + helpers).
 
     /**
-     * Compute the effect of [behavior] on [outcome]. Days are partitioned into "with"
-     * (day ∈ behaviorDays) and "without", restricted to days with an outcome value. Returns
-     * null unless both groups are non-empty AND there are ≥ 3 points total.
+     * Compute the effect of [behavior] on [outcome]. "With" is day ∈ [behaviorDays]; "without" is
+     * day ∈ [controlDays]. Days in NEITHER are dropped, and that is the point of the second set.
+     *
+     * The split used to be `if (behaviorDays.contains(day)) with else without`, which made every day
+     * carrying an outcome a control — so a behaviour logged Yes on 20 days and never logged at all on
+     * the other 100 was measured against those 100 as though the user had answered No. Reported by a
+     * user on Reddit, in those terms: "if I didn't track something for 100 days, NOOP takes that as a
+     * NO for 100 days, whereas it simply was not logged at all."
+     *
+     * The journal already distinguishes the three states — a No writes a row with answeredYes = false,
+     * and only Clear deletes the row — so nothing but this split was conflating them.
+     *
+     * Expect FEWER findings, not better-looking ones. Unlogged days inflated nWithout, which shrinks the
+     * Welch p and helps clear the min(nWith, nWithout) gate; dropping them removes confidence that was
+     * never earned. A behaviour with no No days now yields nothing, which is the honest answer: with no
+     * controls there is no comparison to make.
+     *
+     * Returns null unless both groups are non-empty AND there are ≥ 3 points total.
      */
     internal fun effect(
         behaviorDays: Set<String>,
+        controlDays: Set<String>,
         outcomeByDay: Map<String, Double>,
         behavior: String,
         outcome: String,
@@ -195,7 +249,13 @@ object EffectRanker {
         val withVals = ArrayList<Double>()
         val withoutVals = ArrayList<Double>()
         for ((day, value) in outcomeByDay) {
-            if (behaviorDays.contains(day)) withVals.add(value) else withoutVals.add(value)
+            when {
+                behaviorDays.contains(day) -> withVals.add(value)
+                controlDays.contains(day) -> withoutVals.add(value)
+                // Neither: the behaviour was not logged that day. Not a control — no information.
+                // A day in BOTH would count as "with"; callers merge imported ∪ native before building
+                // these, so one question cannot hold two answers for one day.
+            }
         }
 
         val n1 = withVals.size
diff --git a/android/app/src/main/java/com/noop/ui/InsightsHubScreen.kt b/android/app/src/main/java/com/noop/ui/InsightsHubScreen.kt
index d93b1599c6..4e9d200aca 100644
--- a/android/app/src/main/java/com/noop/ui/InsightsHubScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/InsightsHubScreen.kt
@@ -546,6 +546,8 @@ internal class InsightsHubViewModel {
     data class Snapshot(
         val loaded: Boolean = false,
         val behaviours: Map<String, Set<String>> = emptyMap(),
+        /** Per behaviour, the days it was logged NO — the only legitimate control group. */
+        val controls: Map<String, Set<String>> = emptyMap(),
         val outcomeByKey: Map<String, Map<String, Double>> = emptyMap(),
         val doseCards: List<DoseCardData> = emptyList(),
     )
@@ -577,13 +579,21 @@ internal class InsightsHubViewModel {
     }
 
     suspend fun load(vm: AppViewModel, days: List<DailyMetric>) {
-        // Journal → behaviour → days (imported ∪ native, native wins; only "yes" counts).
+        // Journal → behaviour → days (imported ∪ native, native wins). BOTH answers count now, kept in
+        // separate maps; the merge is what guarantees a day cannot be Yes and No for one question.
         val imported = vm.repo.journal("my-whoop", "0000-01-01", "9999-12-31")
         val native = vm.repo.journal(JOURNAL_DEVICE_ID, "0000-01-01", "9999-12-31")
         val entries = mergeJournalEntries(imported, native)
         val byBehaviour = HashMap<String, MutableSet<String>>()
-        for (e in entries) if (e.answeredYes) byBehaviour.getOrPut(e.question) { mutableSetOf() }.add(e.day)
+        val controlsByBehaviour = HashMap<String, MutableSet<String>>()
+        // Yes days and NO days, kept apart. A day with no journal row for the question appears in
+        // neither, so the ranker cannot mistake "never logged" for "logged No" (#EffectRanker.effect).
+        for (e in entries) {
+            val bucket = if (e.answeredYes) byBehaviour else controlsByBehaviour
+            bucket.getOrPut(e.question) { mutableSetOf() }.add(e.day)
+        }
         val behaviours = byBehaviour.mapValues { it.value.toSet() }
+        val controls = controlsByBehaviour.mapValues { it.value.toSet() }
 
         // Outcome series straight off the cached DailyMetric rows (the guaranteed Android source).
         val outcomeByKey = HashMap<String, Map<String, Double>>()
@@ -615,6 +625,7 @@ internal class InsightsHubViewModel {
         _state.value = Snapshot(
             loaded = true,
             behaviours = behaviours,
+            controls = controls,
             outcomeByKey = outcomeByKey,
             doseCards = doseCards,
         )
@@ -624,7 +635,7 @@ internal class InsightsHubViewModel {
     fun rankFor(snapshot: Snapshot, outcome: InsightsOutcome): List<RankedEffect> {
         if (!snapshot.loaded) return emptyList()
         val outcomeDays = snapshot.outcomeByKey[outcome.key] ?: emptyMap()
-        return EffectRanker.rank(snapshot.behaviours, outcomeDays, outcome.outcomeName)
+        return EffectRanker.rank(snapshot.behaviours, snapshot.controls, outcomeDays, outcome.outcomeName)
     }
 }
 
diff --git a/android/app/src/main/java/com/noop/ui/InsightsScreen.kt b/android/app/src/main/java/com/noop/ui/InsightsScreen.kt
index c32e1ca5ee..263fac2824 100644
--- a/android/app/src/main/java/com/noop/ui/InsightsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/InsightsScreen.kt
@@ -60,14 +60,17 @@ import java.util.Locale
 import kotlin.math.abs
 import kotlin.math.roundToInt
 import kotlin.math.sqrt
+import com.noop.analytics.BehaviorEffect
+import com.noop.analytics.EffectRanker
 
 // MARK: - Insights
 //
 // The "interrogate what affects what" screen, ported from the macOS InsightsView.
 // Two halves:
 //
-//  1. BEHAVIOUR EFFECTS, split logged journal answers (the days each behaviour WAS
-//     logged "yes" vs NOT) and compare a chosen outcome metric (Charge / HRV /
+//  1. BEHAVIOUR EFFECTS, split logged journal answers (the days each behaviour was
+//     logged "yes" vs the days it was logged "no" — a day it was not logged at all
+//     is in neither group) and compare a chosen outcome metric (Charge / HRV /
 //     Rest / RHR) between the two groups. Ranked by effect size (Cohen's d), with
 //     significant effects first. Each card carries a plain-English sentence, the
 //     with/without means, group counts, a significance pill, and the magnitude word.
@@ -119,23 +122,7 @@ private enum class Outcome(
     ),
 }
 
-// MARK: - Computed shapes (plain data, no analytics package dependency)
-
-/** One behaviour's effect on the selected outcome: with/without means, counts,
- *  Cohen's d and a crude significance flag. */
-private data class BehaviorEffect(
-    val behavior: String,
-    val meanWith: Double,
-    val meanWithout: Double,
-    val nWith: Int,
-    val nWithout: Int,
-    val cohensD: Double,
-) {
-    val delta: Double get() = meanWith - meanWithout
-    /** Crude significance: a non-trivial effect with enough days on both sides.
-     *  Honest stand-in for a t-test, |d| ≥ 0.5 ("moderate") with ≥3 days each side. */
-    val significant: Boolean get() = abs(cohensD) >= 0.5 && nWith >= 3 && nWithout >= 3
-}
+// MARK: - Computed shapes (plain data; behaviour effects come from the analytics package)
 
 /** A curated metric relationship plus its computed Pearson correlation. */
 private data class Relationship(
@@ -153,6 +140,9 @@ private data class Relationship(
 private data class InsightModel(
     /** behaviour question → set of days it was answered "yes". */
     val behaviours: Map<String, Set<String>>,
+    /** Per behaviour, the days it was logged NO — the only legitimate control group. A day with no
+     *  journal row for the question is in neither map and takes part in no comparison. */
+    val controls: Map<String, Set<String>>,
     /** day → value, per outcome. */
     val outcomeByDay: Map<Outcome, Map<String, Double>>,
     /** ordered (day, value) per outcome for correlations. */
@@ -184,6 +174,7 @@ fun InsightsScreen(vm: AppViewModel, onOpenInsightsHub: () -> Unit = {}) {
     // rows (native wins per (day, question)). Keyed on journalSeq so the logging card's saves and
     // clears refresh the effects immediately; re-loaded too when the cached days change underneath.
     var behaviours by remember { mutableStateOf<Map<String, Set<String>>>(emptyMap()) }
+    var controls by remember { mutableStateOf<Map<String, Set<String>>>(emptyMap()) }
     // #322: numeric journal item (question) -> [day: value]. A numeric journal series is a daily series
     // the effect ranker consumes exactly like a metric series (EffectRanker.effect already takes a
     // Map<String, Double> outcome), so "caffeine mg" / "alcohol units" can rank as a numeric outcome.
@@ -233,15 +224,18 @@ fun InsightsScreen(vm: AppViewModel, onOpenInsightsHub: () -> Unit = {}) {
         val native = vm.repo.journal(JOURNAL_DEVICE_ID, "0000-01-01", "9999-12-31")
         val entries = mergeJournalEntries(imported, native)
         val byBehaviour = mutableMapOf<String, MutableSet<String>>()
+        val controlsByBehaviour = mutableMapOf<String, MutableSet<String>>()
         // #322: a numeric log writes answeredYes=true too, so a numeric item lands in the with/without
         // split here unchanged; its per-day value is captured separately for a numeric series the effect
         // ranker can consume like any metric outcome (dose-response lands in the v5 hub). Additive.
         val numericByBehaviour = mutableMapOf<String, MutableMap<String, Double>>()
         for (e in entries) {
-            if (e.answeredYes) byBehaviour.getOrPut(e.question) { mutableSetOf() }.add(e.day)
+            val bucket = if (e.answeredYes) byBehaviour else controlsByBehaviour
+            bucket.getOrPut(e.question) { mutableSetOf() }.add(e.day)
             e.numericValue?.let { v -> numericByBehaviour.getOrPut(e.question) { mutableMapOf() }[e.day] = v }
         }
         behaviours = byBehaviour.mapValues { it.value.toSet() }
+        controls = controlsByBehaviour.mapValues { it.value.toSet() }
         numericJournalSeries = numericByBehaviour.mapValues { it.value.toMap() }
         importedQuestions = imported.map { it.question }.distinct()
         val key = journalDayKey(dayOffset)
@@ -290,7 +284,9 @@ fun InsightsScreen(vm: AppViewModel, onOpenInsightsHub: () -> Unit = {}) {
 
     // Build outcome day-maps + ordered series off the cached daily metrics. Cheap and
     // recomputed only when `days` changes (not on every recomposition).
-    val model = remember(days, behaviours, numericJournalSeries) { buildModel(days, behaviours, numericJournalSeries) }
+    val model = remember(days, behaviours, controls, numericJournalSeries) {
+        buildModel(days, behaviours, controls, numericJournalSeries)
+    }
 
     // Ranked behaviour effects for the current outcome (recomputed when outcome/data change).
     val ranked = remember(model, outcome) { rankEffects(model, outcome) }
@@ -1584,6 +1580,7 @@ private fun RBar(r: Double, color: Color) {
 private fun buildModel(
     days: List<DailyMetric>,
     behaviours: Map<String, Set<String>>,
+    controls: Map<String, Set<String>>,
     numericJournalSeries: Map<String, Map<String, Double>> = emptyMap(),
 ): InsightModel {
     val outcomeByDay = mutableMapOf<Outcome, Map<String, Double>>()
@@ -1594,35 +1591,19 @@ private fun buildModel(
         seriesByOutcome[o] = series
         outcomeByDay[o] = series.toMap()
     }
-    return InsightModel(behaviours, outcomeByDay, seriesByOutcome, numericJournalSeries)
+    return InsightModel(behaviours, controls, outcomeByDay, seriesByOutcome, numericJournalSeries)
 }
 
 /** Rank behaviour effects for one outcome by |Cohen's d|, significant first. */
 private fun rankEffects(model: InsightModel, outcome: Outcome): List<BehaviorEffect> {
     val outcomeDays = model.outcomeByDay[outcome] ?: emptyMap()
     if (outcomeDays.isEmpty()) return emptyList()
-
-    val effects = model.behaviours.mapNotNull { (behaviour, yesDays) ->
-        val with = mutableListOf<Double>()
-        val without = mutableListOf<Double>()
-        for ((day, value) in outcomeDays) {
-            if (day in yesDays) with.add(value) else without.add(value)
-        }
-        // Need both groups to compare; require ≥2 each so a mean/SD is meaningful.
-        if (with.size < 2 || without.size < 2) return@mapNotNull null
-        BehaviorEffect(
-            behavior = behaviour,
-            meanWith = with.average(),
-            meanWithout = without.average(),
-            nWith = with.size,
-            nWithout = without.size,
-            cohensD = cohensD(with, without),
-        )
-    }
-    return effects.sortedWith(
-        compareByDescending<BehaviorEffect> { it.significant }
-            .thenByDescending { abs(it.cohensD) },
-    )
+    // Through the shared engine, not a local copy. This screen used to carry its own with/without split,
+    // its own pooled-SD Cohen's d and a "crude significance" (|d| >= 0.5 with >= 3 a side) where iOS's
+    // same screen ran a Welch p — so identical journals could flag different behaviours on the two
+    // platforms. EffectRanker.rankNoLag is the byte-identical twin of Swift's BehaviorInsights.rank,
+    // which is what iOS calls here.
+    return EffectRanker.rankNoLag(model.behaviours, model.controls, outcomeDays, outcome.outcomeName)
 }
 
 /** The curated metric relationships, computed via Pearson r over aligned day pairs. */
@@ -1668,25 +1649,6 @@ private fun computeRelationships(model: InsightModel): List<Relationship> {
 
 // MARK: - Statistics (pooled-SD Cohen's d, Pearson r)
 
-/** Cohen's d using pooled standard deviation. 0 when either side lacks spread. */
-private fun cohensD(a: List<Double>, b: List<Double>): Double {
-    if (a.size < 2 || b.size < 2) return 0.0
-    val ma = a.average()
-    val mb = b.average()
-    val va = variance(a, ma)
-    val vb = variance(b, mb)
-    val pooled = sqrt(((a.size - 1) * va + (b.size - 1) * vb) / (a.size + b.size - 2).toDouble())
-    if (pooled <= 0.0 || !pooled.isFinite()) return 0.0
-    return (ma - mb) / pooled
-}
-
-/** Sample variance (n-1 denominator) about a known mean. */
-private fun variance(xs: List<Double>, mean: Double): Double {
-    if (xs.size < 2) return 0.0
-    val ss = xs.sumOf { val d = it - mean; d * d }
-    return ss / (xs.size - 1).toDouble()
-}
-
 /** Pearson r over two (day,value) series aligned on shared days. Returns (r, n) or
  *  null if fewer than 3 overlapping pairs or no variance. */
 private fun pearsonAligned(
diff --git a/android/app/src/test/java/com/noop/analytics/EffectRankerTest.kt b/android/app/src/test/java/com/noop/analytics/EffectRankerTest.kt
index 2574cdfee0..1c3bef56b2 100644
--- a/android/app/src/test/java/com/noop/analytics/EffectRankerTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/EffectRankerTest.kt
@@ -1,6 +1,7 @@
 package com.noop.analytics
 
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
 import org.junit.Assert.assertNotNull
 import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
@@ -23,9 +24,19 @@ class EffectRankerTest {
      *  with/without groups carry real spread (a constant group yields pooled SD 0 / d 0). */
     private fun jitter(dayOfMonth: Int): Double = ((dayOfMonth * 7) % 5 - 2).toDouble()
 
+    /** Every outcome day the behaviour was not logged on. These fixtures predate the Yes/No split and
+     *  test the LAG math, so they keep their original partition by declaring the complement explicitly —
+     *  the engine no longer assumes it, and a test that quietly lost its control group would still pass
+     *  by returning nothing. */
+    private fun controlsFor(outcome: Map<String, Double>, behaviorDays: Set<String>): Set<String> =
+        outcome.keys - behaviorDays
+
     /** Test-only: the BehaviorEffect at a specific lag, via the engine's own shift alignment. */
     private fun effectAtLag(behaviorDays: Set<String>, outcome: Map<String, Double>, lag: Int) =
-        EffectRanker.effect(behaviorDays, EffectRanker.shiftedOutcome(outcome, lag), "Alcohol", "Charge")
+        EffectRanker.effect(
+            behaviorDays, controlsFor(outcome, behaviorDays),
+            EffectRanker.shiftedOutcome(outcome, lag), "Alcohol", "Charge",
+        )
 
     // Planted lag-1 effect is found at L=1 and beats L=0/L=2
 
@@ -43,7 +54,10 @@ class EffectRankerTest {
             outcome[ymd(2026, 6, dip)] = 50.0 + jitter(dip)
         }
 
-        val out = EffectRanker.rank(mapOf("Alcohol" to behaviorDays), outcome, "Charge")
+        val out = EffectRanker.rank(
+            mapOf("Alcohol" to behaviorDays), mapOf("Alcohol" to controlsFor(outcome, behaviorDays)),
+            outcome, "Charge",
+        )
         val r = row(out, "Alcohol")
         assertNotNull(r)
         assertEquals(1, r!!.lag)
@@ -74,7 +88,9 @@ class EffectRankerTest {
         }
         for (d in 1..8) outcome[ymd(2026, 7, d)] = 70.0 + jitter(d)
 
-        val out = EffectRanker.rank(mapOf("Sparse" to thin), outcome, "Charge")
+        val out = EffectRanker.rank(
+            mapOf("Sparse" to thin), mapOf("Sparse" to controlsFor(outcome, thin)), outcome, "Charge",
+        )
         assertTrue(out.isEmpty())
     }
 
@@ -97,7 +113,11 @@ class EffectRankerTest {
         }
         for (d in 10..20) outcome[ymd(2026, 5, d)] = 70.0 + jitter(d)
 
-        val out = EffectRanker.rank(mapOf("Big" to big, "Small" to small), outcome, "Charge")
+        val out = EffectRanker.rank(
+            mapOf("Big" to big, "Small" to small),
+            mapOf("Big" to controlsFor(outcome, big), "Small" to controlsFor(outcome, small)),
+            outcome, "Charge",
+        )
         assertEquals(listOf("Big", "Small"), out.map { it.behavior })
         assertEquals(0, row(out, "Big")!!.lag)
         assertEquals(0, row(out, "Small")!!.lag)
@@ -138,4 +158,132 @@ class EffectRankerTest {
         val r = RankedEffect("Alcohol", "Charge", 1, e, ScoreConfidence.BUILDING)
         assertTrue(r.sentence().endsWith("(next morning)."))
     }
+    // The Reddit report: unlogged days are not answers.
+
+    /**
+     * "If I didn't track something for 100 days, NOOP takes that as a NO for 100 days, whereas it simply
+     * was not logged at all." Reported by a user on Reddit, and it was exactly what the split did.
+     *
+     * The fixture is that report: 8 days logged Yes with a real dip, 6 days logged No, and 60 days with
+     * an outcome and no journal row at all. Those 60 must not reach the control group, because nothing
+     * about them says the user did not do the thing.
+     */
+    @Test
+    fun daysWithNoJournalRowAreNotControls() {
+        val outcome = HashMap<String, Double>()
+        val yes = HashSet<String>()
+        val no = HashSet<String>()
+        for (d in 1..8) { yes.add(ymd(2026, 6, d)); outcome[ymd(2026, 6, d)] = 50.0 + jitter(d) }
+        for (d in 9..14) { no.add(ymd(2026, 6, d)); outcome[ymd(2026, 6, d)] = 70.0 + jitter(d) }
+        // Never opened the journal on these, and their values sit far from BOTH answered groups.
+        for (d in 15..30) outcome[ymd(2026, 6, d)] = 20.0 + jitter(d)
+        for (d in 1..31) outcome[ymd(2026, 7, d)] = 20.0 + jitter(d)
+        for (d in 1..13) outcome[ymd(2026, 8, d)] = 20.0 + jitter(d)
+
+        val e = EffectRanker.effect(yes, no, outcome, "Alcohol", "Charge")
+        assertNotNull(e)
+        // Controls are the six NO days only. If the 60 unlogged days leaked in, nWithout would be 66 and
+        // meanWithout would be dragged towards 20.
+        assertEquals(6, e!!.nWithout)
+        assertEquals(8, e.nWith)
+        assertTrue("controls must average near the NO days, not the unlogged ones", e.meanWithout > 60.0)
+    }
+
+    /**
+     * A behaviour the user only ever ticks Yes has no control group, so there is no comparison to make
+     * and the honest answer is none. Previously it got one, built from every day the journal was never
+     * opened - the most confident-looking findings in the app came from the least evidence.
+     */
+    @Test
+    fun aBehaviourNeverLoggedNoYieldsNothing() {
+        val outcome = HashMap<String, Double>()
+        val yes = HashSet<String>()
+        for (d in 1..20) { yes.add(ymd(2026, 6, d)); outcome[ymd(2026, 6, d)] = 50.0 + jitter(d) }
+        for (d in 21..30) outcome[ymd(2026, 6, d)] = 80.0 + jitter(d)
+
+        assertNull(EffectRanker.effect(yes, emptySet(), outcome, "Alcohol", "Charge"))
+        assertTrue(
+            EffectRanker.rank(mapOf("Alcohol" to yes), emptyMap(), outcome, "Charge").isEmpty(),
+        )
+    }
+
+    /**
+     * rank() fails CLOSED on a caller that forgets the controls: no insight, rather than a wrong one
+     * measured against every day the user never opened the journal. There are two production callers and
+     * this is what stops a third from reintroducing the bug silently.
+     */
+    @Test
+    fun rankWithoutControlsProducesNothingRatherThanGuessing() {
+        val outcome = HashMap<String, Double>()
+        val yes = HashSet<String>()
+        for (d in 1..10) { yes.add(ymd(2026, 6, d)); outcome[ymd(2026, 6, d)] = 50.0 + jitter(d) }
+        for (d in 11..30) outcome[ymd(2026, 6, d)] = 75.0 + jitter(d)
+        assertTrue(EffectRanker.rank(mapOf("Alcohol" to yes), emptyMap(), outcome, "Charge").isEmpty())
+    }
+
+    // rankNoLag: the Kotlin twin of Swift BehaviorInsights.rank, which the Insights screen now uses.
+
+    /**
+     * Twin of Swift `testRankOrdersByEffectSizeSignificantFirst`, same fixture and same expectations.
+     *
+     * The Insights screen used to rank with its own copy of this — a "crude significance" of |d| >= 0.5
+     * with >= 3 a side, where iOS ran a Welch p on the same screen. Identical journals could flag
+     * different behaviours per platform. Pinning the ordering here is what stops that reopening.
+     */
+    @Test
+    fun rankNoLagOrdersByEffectSizeSignificantFirst() {
+        val outcome = mapOf(
+            "d1" to 50.0, "d2" to 52.0, "d3" to 48.0, "d4" to 51.0, "d5" to 49.0, "d6" to 53.0,
+            "d7" to 70.0, "d8" to 72.0, "d9" to 68.0, "d10" to 71.0, "d11" to 69.0, "d12" to 73.0,
+        )
+        val strong = setOf("d1", "d2", "d3", "d4", "d5", "d6")
+        val weak = setOf("d1", "d7", "d2")
+        val tiny = setOf("d3", "d9")
+        val all = outcome.keys
+        val ranked = EffectRanker.rankNoLag(
+            mapOf("Strong" to strong, "Weak" to weak, "Tiny" to tiny),
+            mapOf("Strong" to (all - strong), "Weak" to (all - weak), "Tiny" to (all - tiny)),
+            outcome, "Recovery",
+        )
+        assertEquals(3, ranked.size)
+        assertEquals("Strong", ranked.first().behavior)
+        assertTrue(ranked.first().significant)
+        assertFalse(ranked[1].significant)
+        assertFalse(ranked[2].significant)
+        assertTrue(abs(ranked[1].cohensD) >= abs(ranked[2].cohensD))
+    }
+
+    /**
+     * rankNoLag fails CLOSED too, not only rank().
+     *
+     * It is a second public entry point into the same split, and this PR exists because that split had
+     * four separate homes. A new door into it gets the same lock: no controls means no comparison, so a
+     * caller that forgets loses the insight rather than getting one measured against unlogged days.
+     */
+    @Test
+    fun rankNoLagWithoutControlsProducesNothing() {
+        val outcome = HashMap<String, Double>()
+        val yes = HashSet<String>()
+        for (d in 1..10) { yes.add(ymd(2026, 6, d)); outcome[ymd(2026, 6, d)] = 50.0 + jitter(d) }
+        for (d in 11..30) outcome[ymd(2026, 6, d)] = 75.0 + jitter(d)
+        assertTrue(EffectRanker.rankNoLag(mapOf("Alcohol" to yes), emptyMap(), outcome, "Charge").isEmpty())
+    }
+
+    /** Twin of Swift `testRankDropsUncomputableBehaviors`: a behaviour covering every day has no
+     *  without-group and is dropped rather than ranked at zero. */
+    @Test
+    fun rankNoLagDropsUncomputableBehaviours() {
+        val outcome = mapOf("a" to 60.0, "b" to 62.0, "c" to 70.0, "d" to 72.0)
+        val allDays = setOf("a", "b", "c", "d")
+        val half = setOf("a", "b")
+        val all = outcome.keys
+        val ranked = EffectRanker.rankNoLag(
+            mapOf("AllDays" to allDays, "Half" to half),
+            mapOf("AllDays" to (all - allDays), "Half" to (all - half)),
+            outcome, "Recovery",
+        )
+        assertEquals(1, ranked.size)
+        assertEquals("Half", ranked.first().behavior)
+    }
+
 }

From c40287f6572ad2bc81992507a394cc768675635e Mon Sep 17 00:00:00 2001
From: Zebsi <66969936+Zebsi235@users.noreply.github.com>
Date: Mon, 31 Aug 2026 11:01:04 +0200
Subject: [PATCH 116/333] protocol(mg): decode the type-43 REALTIME_RAW_DATA
 record on both platforms (#1765)

Adds a decoder for the 240-byte type-43 REALTIME_RAW_DATA record the MG streams
once the turn-on order has opened the stream. Pure protocol on both platforms: no
transport, no UI, no storage, no enum changes, nothing sent to a strap.

Observed layout, across 315 records in one session on a WHOOP MG (WS50_r00, fw
50.39.1.0): an 8-byte frame header whose [8] is the inner record's type byte, a
constant 5x i16 sub-header at 24-33 that is NOT waveform, 101 i16-LE samples at
34-235, and a CRC32 trailer at 236-239. The arithmetic is internally consistent -
10 bytes is 5 x i16, 202 bytes is 101 x i16, and the three spans plus the trailer
total 240.

It belongs in the protocol layer because three consumers need it - a live view, a
signal classifier, a waveform export - and each had grown its own copy with magic
offsets and a bare 43, two of them having already drifted to DIFFERENT definitions
of "signal present". One definition here, unit-testable without a strap. None of
those consumers is in this diff.

Verified rather than taken on trust: samplesPerRawRecord is (236-34)/2 = 101, the
loop bound i+1 < 236 yields exactly 101 iterations with frame[234..235] read last,
and the sign conversion is correct two's complement on both sides. Parity is real -
same constants, same bounds, same threshold, six tests per platform mirrored by
name. Ran the Kotlin suite locally against the PR head: 6 tests, 0 failures. All 15
CI checks green.

Two observations, neither blocking. Swift hardcodes rawRecordType 43 where Kotlin
uses PacketType.REALTIME_RAW_DATA.rawValue - but Swift has no PacketType enum at
all, so the literal is the only option and the asymmetry is pre-existing. And
rawBodyActiveNonZeroBytes = 20, out of 212 body bytes, is an unexplained threshold
from one session; it is honestly labelled as observational, sits in exactly one
place, and has no consumer yet.

One structural note for whoever touches this next: Kotlin pre-sizes IntArray(101)
and fills through an independently bounded loop while Swift appends. Identical
today because the span is even. If an offset ever made it odd, Kotlin would keep a
trailing zero and Swift would return a shorter array - the one place these two can
drift.

Thanks to @Zebsi235, whose full-mode HCI snoop on #1635 is the reason that
investigation moved at all: it established that the 5/MG's SMP refusal is a strap
STATE rather than a permanent property, and that pairing mode flips it. That
overturned a conclusion the maintainers had already drawn from their own capture,
and it is a far harder thing to contribute than a patch.

Refs #891, #1100, #1727.
---
 .../Sources/WhoopProtocol/Whoop5Ecg.swift     |  78 ++++++++++++++
 .../Whoop5EcgRawRecordTests.swift             |  82 ++++++++++++++
 .../main/java/com/noop/protocol/Whoop5Ecg.kt  |  84 +++++++++++++++
 .../noop/protocol/Whoop5EcgRawRecordTest.kt   | 100 ++++++++++++++++++
 4 files changed, 344 insertions(+)
 create mode 100644 Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5EcgRawRecordTests.swift
 create mode 100644 android/app/src/test/java/com/noop/protocol/Whoop5EcgRawRecordTest.kt

diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/Whoop5Ecg.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/Whoop5Ecg.swift
index 0a674be35b..68fb8d068b 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/Whoop5Ecg.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/Whoop5Ecg.swift
@@ -525,6 +525,84 @@ public enum Whoop5Ecg {
         return end <= payload.count && payload.count - end <= maxPadding
     }
 
+    // MARK: - The type-43 REALTIME_RAW_DATA record: the live ECG sample carrier (#891/#1100)
+    //
+    // OBSERVED on one WHOOP MG (WS50_r00, fw 50.39.1.0), not attested by any vendor document: once
+    // TOGGLE_LABRADOR_FILTERED(139)=1 has opened the master gate, the strap emits fixed-size 240-byte
+    // REALTIME_RAW_DATA (type 43) records whose body carries an i16-LE series.
+    //
+    // Twin of the Kotlin `Whoop5Ecg` helpers of the same names. Android grew the ECG app layer that consumes
+    // these first; the decode is a PROTOCOL fact, so it lands on both platforms together rather than living
+    // only where it happens to be called today. Nothing here decodes a status field, an HR, or a rhythm
+    // classification — only the sample series and a byte-fill count. Callers gate on the frame's CRC first.
+
+    /// Every REALTIME_RAW_DATA record OBSERVED on the MG was exactly this long.
+    public static let rawRecordLength = 240
+
+    /// Frame offset of the inner record's type byte on 5/MG (`[8]type [9]seq [10]cmd`).
+    public static let rawTypeOffset = 8
+
+    /// The inner record type byte for REALTIME_RAW_DATA.
+    public static let rawRecordType: UInt8 = 43
+
+    /// First body byte considered by `realtimeRawBodyNonZeroBytes` — excludes the constant sub-header.
+    public static let rawBodyStart = 24
+
+    /// First waveform byte. Bytes 24..33 are a constant 5x i16 sub-header that is NOT waveform.
+    public static let rawWaveformStart = 34
+
+    /// One past the last body byte; the remaining 4 bytes are the frame's CRC32 trailer.
+    public static let rawBodyEnd = 236
+
+    /// Samples one record carries: 101. Load-bearing beyond arithmetic — a fixed sample count per record is
+    /// exactly the shape that makes autocorrelation manufacture a peak at the record period, so anything
+    /// estimating a rate from these samples must exclude this lag. See the #194 withdrawal for what
+    /// happens when that is not done.
+    public static let samplesPerRawRecord = (rawBodyEnd - rawWaveformStart) / 2
+
+    /// Non-zero body bytes above which a record is treated as carrying a waveform rather than baseline.
+    public static let rawBodyActiveNonZeroBytes = 20
+
+    /// True for a frame shaped like a REALTIME_RAW_DATA record. Shape only — says nothing about CRC.
+    public static func isRealtimeRawRecord(_ frame: [UInt8]) -> Bool {
+        frame.count == rawRecordLength && frame[rawTypeOffset] == rawRecordType
+    }
+
+    /// The record's i16-LE sample series, or nil when `frame` is not a REALTIME_RAW_DATA record.
+    ///
+    /// Signed two's-complement, little-endian, exactly `samplesPerRawRecord` values. Zero samples are
+    /// returned as zeros and never trimmed: for a research artifact a trailing run of zeros is evidence
+    /// about the record, not padding to be tidied away.
+    public static func realtimeRawSamples(_ frame: [UInt8]) -> [Int]? {
+        guard isRealtimeRawRecord(frame) else { return nil }
+        var out = [Int]()
+        out.reserveCapacity(samplesPerRawRecord)
+        var i = rawWaveformStart
+        while i + 1 < rawBodyEnd {
+            let raw = Int(frame[i]) | (Int(frame[i + 1]) << 8)
+            out.append(raw >= 0x8000 ? raw - 0x10000 : raw)
+            i += 2
+        }
+        return out
+    }
+
+    /// Non-zero bytes in the body region, or nil when `frame` is not a REALTIME_RAW_DATA record.
+    public static func realtimeRawBodyNonZeroBytes(_ frame: [UInt8]) -> Int? {
+        guard isRealtimeRawRecord(frame) else { return nil }
+        var n = 0
+        for i in rawBodyStart..<rawBodyEnd where frame[i] != 0 { n += 1 }
+        return n
+    }
+
+    /// ONE definition of "this record carries a waveform", so every consumer agrees about the same record.
+    ///
+    /// What it cannot tell you: a flat record means the electrode circuit is open OR generation is off. It is
+    /// a byte-fill observation, never a statement about the wearer.
+    public static func realtimeRawSignalPresent(_ frame: [UInt8]) -> Bool? {
+        guard let n = realtimeRawBodyNonZeroBytes(frame) else { return nil }
+        return n > rawBodyActiveNonZeroBytes
+    }
+
     /// The frame-level form of `plausibleFilteredPayload`, CRC-gated. This is what the app layer runs
     /// over unclassified 5/MG frames while an ECG probe is armed.
     public static func plausibleFilteredFrame(_ frame: [UInt8],
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5EcgRawRecordTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5EcgRawRecordTests.swift
new file mode 100644
index 0000000000..55ff493be8
--- /dev/null
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5EcgRawRecordTests.swift
@@ -0,0 +1,82 @@
+import XCTest
+@testable import WhoopProtocol
+
+/// #891/#1100: the type-43 REALTIME_RAW_DATA sample decoder, Swift side.
+///
+/// Twin of the Kotlin `Whoop5EcgRawRecordTest`. The offsets are a protocol fact, so both platforms carry the
+/// decode and both pin it — the parity contract is that these two cannot drift, and a test only on the side
+/// that happens to call it today would not stop Swift drifting.
+final class Whoop5EcgRawRecordTests: XCTestCase {
+
+    /// A 240-byte record with `samples` written i16-LE from the waveform offset.
+    private func rawRecord(samples: [Int] = [], type: UInt8 = Whoop5Ecg.rawRecordType) -> [UInt8] {
+        var f = [UInt8](repeating: 0, count: Whoop5Ecg.rawRecordLength)
+        f[Whoop5Ecg.rawTypeOffset] = type
+        var i = Whoop5Ecg.rawWaveformStart
+        for v in samples {
+            if i + 1 >= Whoop5Ecg.rawBodyEnd { break }
+            let u = UInt16(bitPattern: Int16(truncatingIfNeeded: v))
+            f[i] = UInt8(u & 0xFF)
+            f[i + 1] = UInt8((u >> 8) & 0xFF)
+            i += 2
+        }
+        return f
+    }
+
+    func testTheRecordCarriesExactly101Samples() {
+        // Load-bearing beyond arithmetic: this is the lag the BPM estimator has to refuse.
+        XCTAssertEqual(Whoop5Ecg.samplesPerRawRecord, 101)
+        XCTAssertEqual(Whoop5Ecg.realtimeRawSamples(rawRecord())?.count, 101)
+    }
+
+    func testOnlyA240ByteType43FrameIsARawRecord() {
+        XCTAssertTrue(Whoop5Ecg.isRealtimeRawRecord(rawRecord()))
+        XCTAssertFalse(Whoop5Ecg.isRealtimeRawRecord(rawRecord(type: 0x2F)))
+        XCTAssertFalse(Whoop5Ecg.isRealtimeRawRecord(Array(rawRecord().prefix(200))))
+        XCTAssertNil(Whoop5Ecg.realtimeRawSamples(rawRecord(type: 0x2F)))
+        XCTAssertNil(Whoop5Ecg.realtimeRawBodyNonZeroBytes([0, 0, 0, 0]))
+        XCTAssertNil(Whoop5Ecg.realtimeRawSignalPresent([]))
+    }
+
+    func testSamplesAreSignedLittleEndian() {
+        let injected = [0, 1, -1, 32767, -32768, 258, -258]
+        let got = Whoop5Ecg.realtimeRawSamples(rawRecord(samples: injected))!
+        XCTAssertEqual(Array(got.prefix(injected.count)), injected)
+        // Everything past what was written stays zero rather than being trimmed away.
+        XCTAssertEqual(got[injected.count], 0)
+    }
+
+    func testZeroSamplesAreKeptNotTrimmed() {
+        let got = Whoop5Ecg.realtimeRawSamples(rawRecord(samples: [50, 0, 0, 0]))!
+        XCTAssertEqual(got.count, 101)
+        XCTAssertEqual(got[0], 50)
+        XCTAssertTrue(got.dropFirst().allSatisfy { $0 == 0 })
+    }
+
+    func testSignalPresentIsOneRuleSharedByEveryConsumer() {
+        XCTAssertEqual(Whoop5Ecg.realtimeRawBodyNonZeroBytes(rawRecord()), 0)
+        XCTAssertEqual(Whoop5Ecg.realtimeRawSignalPresent(rawRecord()), false)
+
+        // Just AT the threshold is still not "present" — the rule is strictly greater.
+        var atThreshold = rawRecord()
+        for i in 0..<Whoop5Ecg.rawBodyActiveNonZeroBytes { atThreshold[Whoop5Ecg.rawBodyStart + i] = 7 }
+        XCTAssertEqual(Whoop5Ecg.realtimeRawBodyNonZeroBytes(atThreshold), Whoop5Ecg.rawBodyActiveNonZeroBytes)
+        XCTAssertEqual(Whoop5Ecg.realtimeRawSignalPresent(atThreshold), false)
+
+        var over = atThreshold
+        over[Whoop5Ecg.rawBodyStart + Whoop5Ecg.rawBodyActiveNonZeroBytes] = 7
+        XCTAssertEqual(Whoop5Ecg.realtimeRawSignalPresent(over), true)
+    }
+
+    func testTheSubHeaderIsCountedForFillButNeverDecodedAsWaveform() {
+        // Bytes 24..33 are a constant sub-header: they count toward "is this record filled" but must not
+        // appear in the sample series, or the trace opens with five bogus spikes every record.
+        var f = rawRecord()
+        for i in Whoop5Ecg.rawBodyStart..<Whoop5Ecg.rawWaveformStart { f[i] = 0x7F }
+        XCTAssertEqual(
+            Whoop5Ecg.realtimeRawBodyNonZeroBytes(f),
+            Whoop5Ecg.rawWaveformStart - Whoop5Ecg.rawBodyStart
+        )
+        XCTAssertTrue(Whoop5Ecg.realtimeRawSamples(f)!.allSatisfy { $0 == 0 })
+    }
+}
diff --git a/android/app/src/main/java/com/noop/protocol/Whoop5Ecg.kt b/android/app/src/main/java/com/noop/protocol/Whoop5Ecg.kt
index f686b088f1..4d6b4947b6 100644
--- a/android/app/src/main/java/com/noop/protocol/Whoop5Ecg.kt
+++ b/android/app/src/main/java/com/noop/protocol/Whoop5Ecg.kt
@@ -380,6 +380,90 @@ object Whoop5Ecg {
     fun decodeRawFrame(frame: ByteArray, bytesPerSample: Int, payloadStart: Int = PUFFIN_PAYLOAD_START): RawLabradorPacket? =
         innerPayload(frame, payloadStart)?.let { decodeRaw(it, bytesPerSample) }
 
+    // ---- The type-43 REALTIME_RAW_DATA record: the live ECG sample carrier (#891/#1100) -----------
+    //
+    // OBSERVED on one WHOOP MG (WS50_r00, fw 50.39.1.0), not attested by any vendor document: once
+    // TOGGLE_LABRADOR_FILTERED(139)=1 has opened the master gate, the strap emits fixed-size 240-byte
+    // REALTIME_RAW_DATA (type 43) records whose body carries an i16-LE series. The offsets below are the
+    // OBSERVED layout, and they live here — with the other Labrador protocol facts — rather than in the app
+    // layer, so the three consumers (live view, signal classifier, waveform export) cannot drift apart and
+    // so the decode is unit-testable without a strap.
+    //
+    // What this layout is NOT: the documented 17-byte status header ([HEADER_LENGTH]) is the FILTERED
+    // packet's, and it is a separate question whether it also sits inside this record (see #891 §7). Nothing
+    // here decodes a status field, an HR, or a rhythm classification — only the sample series and a byte-fill
+    // count. A record that fails CRC must never reach these helpers: callers gate on the frame's CRC first.
+
+    /** Every REALTIME_RAW_DATA record OBSERVED on the MG was exactly this long. */
+    const val RAW_RECORD_LENGTH = 240
+
+    /** Frame offset of the inner record's type byte on 5/MG (`[8]type [9]seq [10]cmd`). */
+    const val RAW_TYPE_OFFSET = 8
+
+    /** First body byte considered by [realtimeRawBodyNonZeroBytes] — excludes the constant sub-header. */
+    const val RAW_BODY_START = 24
+
+    /** First waveform byte. Bytes 24..33 are a constant 5x i16 sub-header that is NOT waveform. */
+    const val RAW_WAVEFORM_START = 34
+
+    /** One past the last body byte; the remaining 4 bytes are the frame's CRC32 trailer. */
+    const val RAW_BODY_END = 236
+
+    /**
+     * Samples one record carries: 101. Load-bearing beyond arithmetic — a fixed sample count per record is
+     * exactly the shape that makes autocorrelation manufacture a peak at the record period, so anything
+     * estimating a rate from these samples must exclude this lag. See the #194 withdrawal.
+     */
+    const val SAMPLES_PER_RAW_RECORD = (RAW_BODY_END - RAW_WAVEFORM_START) / 2
+
+    /** Non-zero body bytes above which a record is treated as carrying a waveform rather than baseline. */
+    const val RAW_BODY_ACTIVE_NONZERO_BYTES = 20
+
+    /** True for a frame shaped like a REALTIME_RAW_DATA record. Shape only — says nothing about CRC. */
+    fun isRealtimeRawRecord(frame: ByteArray): Boolean =
+        frame.size == RAW_RECORD_LENGTH &&
+            (frame[RAW_TYPE_OFFSET].toInt() and 0xFF) == PacketType.REALTIME_RAW_DATA.rawValue
+
+    /**
+     * The record's i16-LE sample series, or null when [frame] is not a REALTIME_RAW_DATA record.
+     *
+     * Signed two's-complement, little-endian, exactly [SAMPLES_PER_RAW_RECORD] values. Zero samples are
+     * returned as zeros and never trimmed: for a research artifact a trailing run of zeros is evidence
+     * about the record, not padding to be tidied away.
+     */
+    fun realtimeRawSamples(frame: ByteArray): IntArray? {
+        if (!isRealtimeRawRecord(frame)) return null
+        val out = IntArray(SAMPLES_PER_RAW_RECORD)
+        var i = RAW_WAVEFORM_START
+        var n = 0
+        while (i + 1 < RAW_BODY_END) {
+            var v = (frame[i].toInt() and 0xFF) or ((frame[i + 1].toInt() and 0xFF) shl 8)
+            if (v >= 0x8000) v -= 0x10000
+            out[n] = v
+            n += 1
+            i += 2
+        }
+        return out
+    }
+
+    /** Non-zero bytes in the body region, or null when [frame] is not a REALTIME_RAW_DATA record. */
+    fun realtimeRawBodyNonZeroBytes(frame: ByteArray): Int? {
+        if (!isRealtimeRawRecord(frame)) return null
+        var n = 0
+        for (i in RAW_BODY_START until RAW_BODY_END) if (frame[i].toInt() != 0) n += 1
+        return n
+    }
+
+    /**
+     * ONE definition of "this record carries a waveform", so the live view, the command-lab signal line and
+     * the reliability scorer cannot disagree about the same record. Null when not such a record.
+     *
+     * What it cannot tell you: a flat record means the electrode circuit is open OR generation is off. It is
+     * a byte-fill observation, never a statement about the wearer.
+     */
+    fun realtimeRawSignalPresent(frame: ByteArray): Boolean? =
+        realtimeRawBodyNonZeroBytes(frame)?.let { it > RAW_BODY_ACTIVE_NONZERO_BYTES }
+
     // Discovery
 
     /**
diff --git a/android/app/src/test/java/com/noop/protocol/Whoop5EcgRawRecordTest.kt b/android/app/src/test/java/com/noop/protocol/Whoop5EcgRawRecordTest.kt
new file mode 100644
index 0000000000..b8d3c86af8
--- /dev/null
+++ b/android/app/src/test/java/com/noop/protocol/Whoop5EcgRawRecordTest.kt
@@ -0,0 +1,100 @@
+package com.noop.protocol
+
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #891/#1100: the type-43 REALTIME_RAW_DATA sample decoder.
+ *
+ * These offsets used to be written out three times in the app layer — live view, signal classifier, waveform
+ * export — so the three could disagree about the same record and none of them was testable without a strap.
+ * They now live in [Whoop5Ecg]; this pins the layout, the sign handling, and the ONE signal-present rule.
+ */
+class Whoop5EcgRawRecordTest {
+
+    /** A 240-byte record with [samples] written i16-LE from the waveform offset. */
+    private fun rawRecord(samples: IntArray = IntArray(0), type: Int = PacketType.REALTIME_RAW_DATA.rawValue): ByteArray {
+        val f = ByteArray(Whoop5Ecg.RAW_RECORD_LENGTH)
+        f[Whoop5Ecg.RAW_TYPE_OFFSET] = type.toByte()
+        var i = Whoop5Ecg.RAW_WAVEFORM_START
+        for (v in samples) {
+            if (i + 1 >= Whoop5Ecg.RAW_BODY_END) break
+            f[i] = (v and 0xFF).toByte()
+            f[i + 1] = ((v shr 8) and 0xFF).toByte()
+            i += 2
+        }
+        return f
+    }
+
+    @Test
+    fun theRecordCarriesExactly101Samples() {
+        // Load-bearing beyond arithmetic: this is the lag the BPM estimator has to refuse.
+        assertEquals(101, Whoop5Ecg.SAMPLES_PER_RAW_RECORD)
+        assertEquals(101, Whoop5Ecg.realtimeRawSamples(rawRecord())!!.size)
+    }
+
+    @Test
+    fun onlyA240ByteType43FrameIsARawRecord() {
+        assertTrue(Whoop5Ecg.isRealtimeRawRecord(rawRecord()))
+        // Wrong type byte, right length.
+        assertFalse(Whoop5Ecg.isRealtimeRawRecord(rawRecord(type = 0x2F)))
+        // Right type byte, wrong length.
+        assertFalse(Whoop5Ecg.isRealtimeRawRecord(rawRecord().copyOf(200)))
+        assertNull(Whoop5Ecg.realtimeRawSamples(rawRecord(type = 0x2F)))
+        assertNull(Whoop5Ecg.realtimeRawBodyNonZeroBytes(ByteArray(4)))
+        assertNull(Whoop5Ecg.realtimeRawSignalPresent(ByteArray(0)))
+    }
+
+    @Test
+    fun samplesAreSignedLittleEndian() {
+        val injected = intArrayOf(0, 1, -1, 32767, -32768, 258, -258)
+        val got = Whoop5Ecg.realtimeRawSamples(rawRecord(injected))!!
+        assertArrayEquals(injected, got.copyOf(injected.size))
+        // Everything past what was written stays zero rather than being trimmed away.
+        assertEquals(0, got[injected.size])
+    }
+
+    @Test
+    fun zeroSamplesAreKeptNotTrimmed() {
+        // A trailing run of zeros in a real record is evidence about the record. The export used to strip
+        // it, which silently edited the artifact.
+        val got = Whoop5Ecg.realtimeRawSamples(rawRecord(intArrayOf(50, 0, 0, 0)))!!
+        assertEquals(101, got.size)
+        assertEquals(50, got[0])
+        assertTrue(got.drop(1).all { it == 0 })
+    }
+
+    @Test
+    fun signalPresentIsOneRuleSharedByEveryConsumer() {
+        // A record of pure baseline: no body bytes set at all.
+        assertEquals(0, Whoop5Ecg.realtimeRawBodyNonZeroBytes(rawRecord()))
+        assertFalse(Whoop5Ecg.realtimeRawSignalPresent(rawRecord())!!)
+
+        // Just AT the threshold is still not "present" — the rule is strictly greater.
+        val atThreshold = rawRecord()
+        for (i in 0 until Whoop5Ecg.RAW_BODY_ACTIVE_NONZERO_BYTES) atThreshold[Whoop5Ecg.RAW_BODY_START + i] = 7
+        assertEquals(Whoop5Ecg.RAW_BODY_ACTIVE_NONZERO_BYTES, Whoop5Ecg.realtimeRawBodyNonZeroBytes(atThreshold))
+        assertFalse(Whoop5Ecg.realtimeRawSignalPresent(atThreshold)!!)
+
+        val overThreshold = atThreshold.copyOf()
+        overThreshold[Whoop5Ecg.RAW_BODY_START + Whoop5Ecg.RAW_BODY_ACTIVE_NONZERO_BYTES] = 7
+        assertTrue(Whoop5Ecg.realtimeRawSignalPresent(overThreshold)!!)
+    }
+
+    @Test
+    fun theSubHeaderIsCountedForFillButNeverDecodedAsWaveform() {
+        // Bytes 24..33 are a constant sub-header: they count toward "is this record filled" but must not
+        // appear in the sample series, or the trace opens with five bogus spikes every record.
+        val f = rawRecord()
+        for (i in Whoop5Ecg.RAW_BODY_START until Whoop5Ecg.RAW_WAVEFORM_START) f[i] = 0x7F
+        assertEquals(
+            Whoop5Ecg.RAW_WAVEFORM_START - Whoop5Ecg.RAW_BODY_START,
+            Whoop5Ecg.realtimeRawBodyNonZeroBytes(f),
+        )
+        assertTrue(Whoop5Ecg.realtimeRawSamples(f)!!.all { it == 0 })
+    }
+}

From aa5312d3e3f2bd166cee2eb76808ede99fc79924 Mon Sep 17 00:00:00 2001
From: Kevin Rajan <7121943+kvnloo@users.noreply.github.com>
Date: Mon, 31 Aug 2026 04:11:14 -0500
Subject: [PATCH 117/333] Make standard-HR ingestion timing and durability
 observable (#1767)

Makes the standard-HR collector path auditable, and closes a durability hole while
it is there.

BLE Heart Rate Measurement (0x2A37) carries no sensor-origin timestamp, so the
trace reports only host-observed facts: receipt time recorded after a measurement
is accepted, and accepted/rejected/pending/persisted/retried counts taken from the
store's actual inserted-row counts rather than the offered counts. Timer flushes
are labelled apart from lifecycle flushes.

The durability part is worth stating plainly, because the PR describes itself as
"host-side observability only" and it is more than that. flushStandardHR
previously ran on cadence and on disconnect. iOS suspends a connected strap
WITHOUT a disconnect edge, and the cadence timer does not run while suspended, so
a sub-cadence batch of buffered 0x2A37 rows could sit in the Collector and die
with the app. Two new edges - scenePhase .background and willTerminate - route
through the same tested seam and give that batch a real store attempt. That is a
behaviour change, and a good one.

Verified rather than taken on trust: liveInsertFailedLine and
shouldEmitLiveInsertFailure are byte-identical to their Kotlin twins in
StalledLinkDiagnostics - same em dash, same spacing, same >= 2 branch wording, and
the same lastEmitMs <= 0 || nowMs < lastEmitMs || nowMs - lastEmitMs >= minGapMs
rule. 14 CI checks green; build-and-test is absent because the PR touches no
Android sources, not because it was skipped.

Known and tracked rather than silently accepted:

The four NEW standard-HR trace lines are Swift-only, in the byte-identical
package, and Android's StandardHrSource buffers the same way (30 samples /
30_000ms, flushed at teardown) - so "did these rows land?" is exactly as
unanswerable there. A follow-up covers the Kotlin twin.

Kotlin's take(200) counts UTF-16 code units where Swift's prefix(200) counts
grapheme clusters, so the "byte-identical" claim holds for ASCII, which error
descriptions effectively always are. Same follow-up.

StrandTests/StandardHRLifecyclePersistenceTests.swift is app-target, so it runs
only in the app-build workflow, which is disabled_manually. None of the 14 green
checks exercised it; that needs an app-build dispatch to actually run.

Thanks to @kvnloo. The RED-first validation - showing each new test failing
against the base before the wiring existed - is the part that made this reviewable
without a strap.

Progresses #1759.
---
 .../StrandAnalytics/LivePersistTrace.swift    | 70 +++++++++++++++++++
 .../LivePersistTraceTests.swift               | 51 ++++++++++++++
 Strand/BLE/BLEManager.swift                   |  8 ++-
 Strand/Collect/Collector.swift                | 26 +++++--
 .../StandardHRLifecyclePersistenceTests.swift | 55 +++++++++++++++
 StrandiOS/App/StrandiOSApp.swift              | 18 +++++
 6 files changed, 222 insertions(+), 6 deletions(-)
 create mode 100644 StrandTests/StandardHRLifecyclePersistenceTests.swift

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/LivePersistTrace.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/LivePersistTrace.swift
index f06b501bc2..1704c067b3 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/LivePersistTrace.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/LivePersistTrace.swift
@@ -1,5 +1,26 @@
 import Foundation
 
+/// Maps the app's persistence-relevant lifecycle edges onto the reason carried through Collector logs.
+/// The app and tests call this same seam, so lifecycle routing is exercised without UIKit on Linux.
+public enum StandardHRLifecycleFlush {
+    public enum Event {
+        case background
+        case termination
+    }
+
+    public static func run(
+        event: Event,
+        flush: (LivePersistTrace.StandardHRFlushReason) async -> Void
+    ) async {
+        switch event {
+        case .background:
+            await flush(.background)
+        case .termination:
+            await flush(.termination)
+        }
+    }
+}
+
 /// A live HR/R-R batch failed to persist and was re-buffered.
 ///
 /// `Collector` re-queues the frames and swallows the error, so a store rejecting every insert produces a
@@ -13,6 +34,55 @@ import Foundation
 /// `ConnectionReadout`) already sit and get tested.
 public enum LivePersistTrace {
 
+    public enum StandardHRFlushReason: String {
+        case cadence
+        case disconnect
+        case background
+        case termination
+        case explicit
+    }
+
+    /// Bounded standard-HR transport-state diagnostics. These lines describe host observation and
+    /// buffer/persistence state only; they carry no physiological measurements and make no claim
+    /// about sensor-origin time or unobserved loss.
+    public static func standardHRHostReceivedLine(
+        hostUnixSeconds: Int,
+        acceptedHRRows: Int, acceptedRRRows: Int,
+        rejectedHRRows: Int, rejectedRRRows: Int,
+        pendingHRRows: Int, pendingRRRows: Int
+    ) -> String {
+        "standard-hr transport host-received hostUnixSec=\(hostUnixSeconds)"
+            + " acceptedHRRows=\(acceptedHRRows) acceptedRRRows=\(acceptedRRRows)"
+            + " rejectedHRRows=\(rejectedHRRows) rejectedRRRows=\(rejectedRRRows)"
+            + " pendingHRRows=\(pendingHRRows) pendingRRRows=\(pendingRRRows)"
+    }
+
+    public static func standardHRFlushAttemptLine(
+        reason: StandardHRFlushReason, offeredHRRows: Int, offeredRRRows: Int
+    ) -> String {
+        "standard-hr transport flush-attempt reason=\(reason.rawValue)"
+            + " offeredHRRows=\(offeredHRRows) offeredRRRows=\(offeredRRRows)"
+    }
+
+    public static func standardHRFlushSucceededLine(
+        reason: StandardHRFlushReason, offeredHRRows: Int, offeredRRRows: Int,
+        insertedHRRows: Int, insertedRRRows: Int
+    ) -> String {
+        "standard-hr transport flush-succeeded reason=\(reason.rawValue)"
+            + " offeredHRRows=\(offeredHRRows) offeredRRRows=\(offeredRRRows)"
+            + " insertedHRRows=\(insertedHRRows) insertedRRRows=\(insertedRRRows)"
+    }
+
+    public static func standardHRRebufferedForRetryLine(
+        reason: StandardHRFlushReason, attemptedHRRows: Int, attemptedRRRows: Int,
+        pendingHRRows: Int, pendingRRRows: Int, consecutiveFailures: Int
+    ) -> String {
+        "standard-hr transport rebuffered-for-retry reason=\(reason.rawValue)"
+            + " attemptedHRRows=\(attemptedHRRows) attemptedRRRows=\(attemptedRRRows)"
+            + " pendingHRRows=\(pendingHRRows) pendingRRRows=\(pendingRRRows)"
+            + " consecutiveFailures=\(consecutiveFailures)"
+    }
+
     /// - Parameters:
     ///   - transport: which live path failed. There are TWO — the standard 0x2A37 reading and the puffin
     ///     REALTIME_DATA batch (#1118) — and they fail independently. A line that did not say which would
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LivePersistTraceTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LivePersistTraceTests.swift
index 25d6f8db2f..6c28f59a2f 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LivePersistTraceTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LivePersistTraceTests.swift
@@ -5,6 +5,57 @@ import XCTest
 /// ones `StalledLinkDiagnosticsTest` pins on the Android side, so a one-sided wording change fails here
 /// rather than drifting apart in the two field logs these are meant to be read beside each other.
 final class LivePersistTraceTests: XCTestCase {
+    func testStandardHRHostReceiptSeparatesAcceptedAndRejectedRows() {
+        XCTAssertEqual(
+            LivePersistTrace.standardHRHostReceivedLine(
+                hostUnixSeconds: 1_750_000_000,
+                acceptedHRRows: 1, acceptedRRRows: 2,
+                rejectedHRRows: 0, rejectedRRRows: 1,
+                pendingHRRows: 4, pendingRRRows: 5
+            ),
+            "standard-hr transport host-received hostUnixSec=1750000000"
+                + " acceptedHRRows=1 acceptedRRRows=2 rejectedHRRows=0 rejectedRRRows=1"
+                + " pendingHRRows=4 pendingRRRows=5"
+        )
+    }
+
+    func testStandardHRFlushSuccessSeparatesOfferedFromActuallyInsertedRows() {
+        XCTAssertEqual(
+            LivePersistTrace.standardHRFlushAttemptLine(
+                reason: .cadence, offeredHRRows: 4, offeredRRRows: 5
+            ),
+            "standard-hr transport flush-attempt reason=cadence offeredHRRows=4 offeredRRRows=5"
+        )
+        XCTAssertEqual(
+            LivePersistTrace.standardHRFlushSucceededLine(
+                reason: .cadence, offeredHRRows: 4, offeredRRRows: 5,
+                insertedHRRows: 1, insertedRRRows: 2
+            ),
+            "standard-hr transport flush-succeeded reason=cadence offeredHRRows=4 offeredRRRows=5"
+                + " insertedHRRows=1 insertedRRRows=2"
+        )
+    }
+
+    func testStandardHRRetryNamesLifecycleReasonAndTotalPendingRows() {
+        XCTAssertEqual(
+            LivePersistTrace.standardHRRebufferedForRetryLine(
+                reason: .disconnect, attemptedHRRows: 1, attemptedRRRows: 2,
+                pendingHRRows: 3, pendingRRRows: 4, consecutiveFailures: 1
+            ),
+            "standard-hr transport rebuffered-for-retry reason=disconnect"
+                + " attemptedHRRows=1 attemptedRRRows=2 pendingHRRows=3 pendingRRRows=4"
+                + " consecutiveFailures=1"
+        )
+    }
+
+    func testStandardHRLifecycleRouteFlushesBackgroundAndTermination() async {
+        var reasons: [LivePersistTrace.StandardHRFlushReason] = []
+
+        await StandardHRLifecycleFlush.run(event: .background) { reasons.append($0) }
+        await StandardHRLifecycleFlush.run(event: .termination) { reasons.append($0) }
+
+        XCTAssertEqual(reasons.map(\.rawValue), ["background", "termination"])
+    }
 
     /// Two live transports fail independently (#1118), so the line must say which.
     func testNamesTheFailingTransport() {
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index 5064503dee..2d5c1689ec 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -1426,6 +1426,12 @@ public final class BLEManager: NSObject, ObservableObject {
 
     // MARK: Public API
 
+    /// Give buffered standard-HR rows a persistence attempt before app suspension/termination.
+    /// Kept on BLEManager so the app lifecycle reaches the live Collector owned by this connection.
+    func flushStandardHRForLifecycle(reason: LivePersistTrace.StandardHRFlushReason) async {
+        await collector?.flushStandardHR(reason: reason)
+    }
+
     /// USER-initiated connect (the Connect button, the scan flow, Add-a-WHOOP). The ONLY entry that
     /// re-arms a bond-loop give-up: a user gesture is an explicit "try again", so the streak + pause
     /// clear and auto-reconnect works again if it bonds. System-initiated paths (Bluetooth poweredOn,
@@ -5517,7 +5523,7 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
         Task { @MainActor in await puffinRecorder.flush() }   // persist any buffered puffin capture frames
         puffinEventLog.close()   // release the event-log handle so the file is safe to export
         puffinDeepBufferLog.close()   // same for the high-rate deep-buffer log (#423)
-        Task { @MainActor in await collector?.flushStandardHR() }   // persist any buffered 0x2A37 HR
+        Task { @MainActor in await collector?.flushStandardHR(reason: .disconnect) }   // persist any buffered 0x2A37 HR
         if autoReconnectPausedForBondLoop {
             // #747: the bond keeps being refused, so auto-reconnect is paused: we stop hammering a strap that
             // can't bond (the epitaph + paused hint were already surfaced when the give-up tripped). The user
diff --git a/Strand/Collect/Collector.swift b/Strand/Collect/Collector.swift
index e1931a7e68..e07115f35d 100644
--- a/Strand/Collect/Collector.swift
+++ b/Strand/Collect/Collector.swift
@@ -266,19 +266,28 @@ final class Collector {
     /// Buffer one standard Heart-Rate-Measurement reading. No clock correlation needed —
     /// these carry a wall-clock `ts` directly. Auto-flushes ~every 30 readings (~30s).
     func ingestStandardHR(hr: Int, rr: [Int], at ts: Int) {
-        if hr >= 30, hr <= 220 { stdHR.append(HRSample(ts: ts, bpm: hr)) }
-        for r in rr where r >= 250 && r <= 3000 { stdRR.append(RRInterval(ts: ts, rrMs: r)) }
+        let acceptedHR = (30...220).contains(hr) ? 1 : 0
+        let acceptedRR = rr.filter { (250...3000).contains($0) }
+        if acceptedHR == 1 { stdHR.append(HRSample(ts: ts, bpm: hr)) }
+        stdRR.append(contentsOf: acceptedRR.map { RRInterval(ts: ts, rrMs: $0) })
+        log?(LivePersistTrace.standardHRHostReceivedLine(
+            hostUnixSeconds: ts,
+            acceptedHRRows: acceptedHR, acceptedRRRows: acceptedRR.count,
+            rejectedHRRows: 1 - acceptedHR, rejectedRRRows: rr.count - acceptedRR.count,
+            pendingHRRows: stdHR.count, pendingRRRows: stdRR.count))
         if stdHR.count + stdRR.count >= 30 {
-            Task { @MainActor in await self.flushStandardHR() }
+            Task { @MainActor in await self.flushStandardHR(reason: .cadence) }
         }
     }
 
     /// Persist the buffered standard HR/RR. Re-buffers on failure so nothing is lost.
-    func flushStandardHR() async {
+    func flushStandardHR(reason: LivePersistTrace.StandardHRFlushReason = .explicit) async {
         guard !stdHR.isEmpty || !stdRR.isEmpty else { return }
         let hr = stdHR, rr = stdRR
         stdHR.removeAll(keepingCapacity: true)
         stdRR.removeAll(keepingCapacity: true)
+        log?(LivePersistTrace.standardHRFlushAttemptLine(
+            reason: reason, offeredHRRows: hr.count, offeredRRRows: rr.count))
         // #1118: census this batch BEFORE it is stored, exactly as the historical path does, so a strap
         // log carries one `ratioRep` per transport. If each transport reports ~1.0 while the stored night
         // reads 2.77, the over-count is the UNION of the transports and no single decoder is at fault —
@@ -295,12 +304,19 @@ final class Collector {
             }
         }
         do {
-            try await store.insert(Streams(hr: hr, rr: rr), deviceId: deviceId)
+            let inserted = try await store.insert(Streams(hr: hr, rr: rr), deviceId: deviceId)
             stdInsertFailures = 0
+            log?(LivePersistTrace.standardHRFlushSucceededLine(
+                reason: reason, offeredHRRows: hr.count, offeredRRRows: rr.count,
+                insertedHRRows: inserted.hr, insertedRRRows: inserted.rr))
         } catch {
             stdHR.insert(contentsOf: hr, at: 0)
             stdRR.insert(contentsOf: rr, at: 0)
             stdInsertFailures += 1
+            log?(LivePersistTrace.standardHRRebufferedForRetryLine(
+                reason: reason, attemptedHRRows: hr.count, attemptedRRRows: rr.count,
+                pendingHRRows: stdHR.count, pendingRRRows: stdRR.count,
+                consecutiveFailures: stdInsertFailures))
             let nowMs = Int64(Date().timeIntervalSince1970 * 1000)
             if LivePersistTrace.shouldEmitLiveInsertFailure(lastEmitMs: lastStdInsertFailureLogMs,
                                                             nowMs: nowMs) {
diff --git a/StrandTests/StandardHRLifecyclePersistenceTests.swift b/StrandTests/StandardHRLifecyclePersistenceTests.swift
new file mode 100644
index 0000000000..acb4dd2c89
--- /dev/null
+++ b/StrandTests/StandardHRLifecyclePersistenceTests.swift
@@ -0,0 +1,55 @@
+import XCTest
+import StrandAnalytics
+import WhoopProtocol
+import WhoopStore
+@testable import Strand
+
+@MainActor
+final class StandardHRLifecyclePersistenceTests: XCTestCase {
+    private final class CountingStore: StoreWriting {
+        private(set) var offeredHRRows = 0
+        private(set) var offeredRRRows = 0
+
+        func insert(_ streams: Streams, deviceId: String) async throws
+            -> (hr: Int, rr: Int, events: Int, battery: Int,
+                spo2: Int, skinTemp: Int, resp: Int, gravity: Int) {
+            offeredHRRows = streams.hr.count
+            offeredRRRows = streams.rr.count
+            // Deliberately differ from the offered counts: this is the store's conflict/dedup result.
+            return (0, 1, 0, 0, 0, 0, 0, 0)
+        }
+
+        func enqueueRawBatch(_ meta: RawBatchMeta, frames: [[UInt8]]) async throws {}
+    }
+
+    func testBackgroundLifecycleFlushesSubThresholdStandardHRAndLogsStoreCounts() async {
+        let store = CountingStore()
+        var lines: [String] = []
+        let collector = Collector(
+            store: store,
+            deviceId: "test-strap",
+            log: { lines.append($0) },
+            now: { 1_750_000_000 }
+        )
+        let manager = BLEManager(state: LiveState(), collector: collector)
+
+        // Three accepted rows are intentionally below the 30-row cadence threshold. The invalid values
+        // prove that the host-receipt line reports Collector's accepted/rejected split, not input totals.
+        collector.ingestStandardHR(hr: 72, rr: [800, 100, 900], at: 1_750_000_000)
+        XCTAssertEqual(store.offeredHRRows + store.offeredRRRows, 0)
+
+        await manager.flushStandardHRForLifecycle(reason: .background)
+
+        XCTAssertEqual(store.offeredHRRows, 1)
+        XCTAssertEqual(store.offeredRRRows, 2)
+        XCTAssertTrue(lines.contains(
+            "standard-hr transport host-received hostUnixSec=1750000000"
+                + " acceptedHRRows=1 acceptedRRRows=2 rejectedHRRows=0 rejectedRRRows=1"
+                + " pendingHRRows=1 pendingRRRows=2"
+        ))
+        XCTAssertTrue(lines.contains(
+            "standard-hr transport flush-succeeded reason=background"
+                + " offeredHRRows=1 offeredRRRows=2 insertedHRRows=0 insertedRRRows=1"
+        ))
+    }
+}
diff --git a/StrandiOS/App/StrandiOSApp.swift b/StrandiOS/App/StrandiOSApp.swift
index 8ede93a008..2658f97d23 100644
--- a/StrandiOS/App/StrandiOSApp.swift
+++ b/StrandiOS/App/StrandiOSApp.swift
@@ -1,6 +1,7 @@
 #if os(iOS)
 import SwiftUI
 import StrandDesign
+import StrandAnalytics
 import UserNotifications
 
 /// iOS entry point. Unlike the macOS app (which adds a `MenuBarExtra` scene), iOS uses a single
@@ -297,6 +298,14 @@ struct StrandiOSApp: App {
                     await watch.pushLatest(from: model)
                 }
             } else if phase == .background {
+                // A connected strap does not emit a disconnect edge when iOS suspends the app. Route the
+                // lifecycle edge through the same tested seam as termination so a sub-cadence 0x2A37 batch
+                // gets a real store attempt and an accepted/rejected + inserted-count outcome before sleep.
+                Task {
+                    await StandardHRLifecycleFlush.run(event: .background) { reason in
+                        await model.ble.flushStandardHRForLifecycle(reason: reason)
+                    }
+                }
                 // Re-submit on every transition because iOS may discard an old best-effort request.
                 HealthWritebackBackgroundScheduler.updateSchedule(
                     isAuthorized: health.auth == .authorized)
@@ -317,6 +326,15 @@ struct StrandiOSApp: App {
                 Task { await ShortcutHealthExport.writeIfEnabled(repo: model.repo) }
             }
         }
+        .onReceive(NotificationCenter.default.publisher(for: UIApplication.willTerminateNotification)) { _ in
+            // Usually background already drained this buffer. This is the final retry edge for a foreground
+            // termination or a failed background attempt; an empty Collector is a cheap no-op.
+            Task {
+                await StandardHRLifecycleFlush.run(event: .termination) { reason in
+                    await model.ble.flushStandardHRForLifecycle(reason: reason)
+                }
+            }
+        }
     }
 }
 

From eef14cb441178496341a172c47106efeed2d5817 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 21:40:03 +1200
Subject: [PATCH 118/333] Android standard-HR: stop losing a rejected batch in
 silence (#1770)

Item 1 of #1770, and it did not stay a log-line port.

Looking for where the four Apple lines from #1767 would attach on Android found
that the behaviour they describe is missing. StandardHrSource.flush() snapshots the
buffer and CLEARS it, then calls a persist seam the app wired as
`runCatching { repo.insert(batch, deviceId) }` with no onFailure. The rows were
already out of the buffer, so a store that rejected the batch lost it entirely and
the surrounding log read exactly like a healthy stream. The Swift Collector
re-buffers and retries; this could not, because the seam returned Unit and never
told it anything. That is the failure shape #1767's own doc names as the worst
kind: the instrumentation that exists reads like success.

The seam now reports Result<InsertCounts>, and the source re-buffers the snapshot
at the FRONT on failure - Swift's insert(contentsOf:at:0), so a retry keeps order.
InsertCounts rather than a success flag because a batch offered in full and
inserted as zero is the failure that most looks like success, and only the store's
own count separates them. Android already had that plumbing; the standard-HR seam
was discarding it.

With the behaviour in place the lines have something true to say:
standardHrFlushAttemptLine, standardHrFlushSucceededLine and
standardHrRebufferedForRetryLine are byte-identical twins of Swift's, and the
failure itself reuses liveInsertFailedLine and its one-a-minute rate limit, which
Kotlin already had and the WHOOP live path already uses.

Deliberately not twinned: standardHRHostReceivedLine. Apple filters at INGEST and
buffers only accepted rows; Android buffers raw samples and range-gates at FLUSH,
so accepted/rejected/pending at ingest do not exist here without moving the filter
- which would change when the 30-sample trigger fires. A behaviour decision, not a
logging one, and it belongs in its own change.

StandardHrFlushReason carries background and termination with no Android emitter,
because the foreground service gives no suspension edge. They exist so the two
enums cannot drift before one grows a caller, and the RAW VALUES are pinned against
Swift's, since the raw value is what the log carries.

Review passes caught two things worth recording. The retry line was being called
with buffer.size for BOTH pending counts - a count of raw samples, which equals
neither: 12 samples carrying four R-R each is 12 pending HR rows and 48 pending R-R
rows, and the line said 12 and 12. A diagnostic reporting one number as two, inside
a change arguing that offered and inserted must be separable, is the error this
work exists to stop. Both counts now come from one rowsOf() helper so the offered
count and the pending count cannot apply different gates.

And the re-buffer is only as good as the callback being invoked: the live wiring
launches on a scope, and a scope cancelled before the body runs drops the batch
with no line. Not a regression - it is the old silent loss narrowed from every
rejected insert to a cancelled teardown - but it is recorded on the seam rather
than left to be discovered from an empty log.

Known and shared with Apple: repeated failure grows the buffer without bound, since
every failure re-adds. Bounding it on one platform alone would be a new divergence.

The parity tests assert strings copied from LivePersistTraceTests rather than
regenerated from the Kotlin - a twin checked against its own implementation proves
only self-consistency.

Android 4971 unit tests, zero failures. compileFullDebugKotlin, doc_comment_lint
and i18n_audit clean by exit code. Not run against a live strap.

Refs #1770, #1767.
---
 .../java/com/noop/ble/SourceCoordinator.kt    |   7 +-
 .../com/noop/ble/StalledLinkDiagnostics.kt    |  63 +++++++++++
 .../java/com/noop/ble/StandardHrSource.kt     | 105 +++++++++++++++---
 .../src/main/java/com/noop/ui/AppViewModel.kt |   3 +-
 .../noop/ble/StalledLinkDiagnosticsTest.kt    |  46 ++++++++
 5 files changed, 205 insertions(+), 19 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ble/SourceCoordinator.kt b/android/app/src/main/java/com/noop/ble/SourceCoordinator.kt
index a70db1897f..6fdac40bad 100644
--- a/android/app/src/main/java/com/noop/ble/SourceCoordinator.kt
+++ b/android/app/src/main/java/com/noop/ble/SourceCoordinator.kt
@@ -438,8 +438,11 @@ class SourceCoordinator(
                     context = ctx,
                     deviceId = id,
                     liveSink = liveSink,
-                    persist = { batch: StreamBatch, deviceId: String ->
-                        scope.launch { runCatching { repo.insert(batch, deviceId) } }
+                    // Hand the OUTCOME back. This was `runCatching { ... }` with no onFailure while the
+                    // source had already cleared its buffer, so a rejected batch vanished with the
+                    // surrounding log still reading like a healthy stream.
+                    persist = { batch: StreamBatch, deviceId: String, done ->
+                        scope.launch { done(runCatching { repo.insert(batch, deviceId) }) }
                     },
                     log = straplog,   // generic-HR lifecycle → the SAME exported strap log (issue #421)
                     onBattery = batterySink,  // strap battery → the same live state the WHOOP strap battery uses
diff --git a/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt b/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
index a3ba2c70d4..c1c679e82b 100644
--- a/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
@@ -117,6 +117,69 @@ internal fun backfillDeferredLine(
         "$explicitBondRequestedThisLink deferrals=$deferralsThisLink sinceConnect=$since).$why"
 }
 
+/**
+ * Standard-HR (0x2A37) transport-state lines — the Kotlin twins of Swift's `LivePersistTrace`
+ * (`Packages/StrandAnalytics`), byte-identical so an Android and an Apple log of the same stall compare
+ * directly. They live here, beside their caller, for the same reason [liveInsertFailedLine] does.
+ *
+ * They describe host observation and buffer/persistence state only. Nothing here carries a physiological
+ * measurement, and nothing claims a sensor-origin time: the BLE Heart Rate Measurement characteristic
+ * does not provide one, so a receipt time is the host's observation and is labelled as such.
+ *
+ * The pair that matters is offered vs inserted. [standardHrFlushAttemptLine] reports what was handed to
+ * the store and [standardHrFlushSucceededLine] what the store actually took, because a batch that is
+ * offered in full and inserted as zero is precisely the failure that otherwise reads like success.
+ */
+internal fun standardHrFlushAttemptLine(
+    reason: String,
+    offeredHrRows: Int,
+    offeredRrRows: Int,
+): String =
+    "standard-hr transport flush-attempt reason=$reason" +
+        " offeredHRRows=$offeredHrRows offeredRRRows=$offeredRrRows"
+
+/** Twin of Swift `LivePersistTrace.standardHRFlushSucceededLine`. */
+internal fun standardHrFlushSucceededLine(
+    reason: String,
+    offeredHrRows: Int,
+    offeredRrRows: Int,
+    insertedHrRows: Int,
+    insertedRrRows: Int,
+): String =
+    "standard-hr transport flush-succeeded reason=$reason" +
+        " offeredHRRows=$offeredHrRows offeredRRRows=$offeredRrRows" +
+        " insertedHRRows=$insertedHrRows insertedRRRows=$insertedRrRows"
+
+/** Twin of Swift `LivePersistTrace.standardHRRebufferedForRetryLine`. */
+internal fun standardHrRebufferedForRetryLine(
+    reason: String,
+    attemptedHrRows: Int,
+    attemptedRrRows: Int,
+    pendingHrRows: Int,
+    pendingRrRows: Int,
+    consecutiveFailures: Int,
+): String =
+    "standard-hr transport rebuffered-for-retry reason=$reason" +
+        " attemptedHRRows=$attemptedHrRows attemptedRRRows=$attemptedRrRows" +
+        " pendingHRRows=$pendingHrRows pendingRRRows=$pendingRrRows" +
+        " consecutiveFailures=$consecutiveFailures"
+
+/**
+ * Why a standard-HR flush ran. Twin of Swift's `LivePersistTrace.StandardHRFlushReason`, and the raw
+ * values must stay identical because they are what the log line carries.
+ *
+ * `background` and `termination` are Apple-only today: iOS suspends a connected strap without a
+ * disconnect edge, which Android's foreground service does not do. They exist here so the two enums do
+ * not drift, and so an Android answer to "should an OEM kill flush this buffer?" has a name already.
+ */
+internal enum class StandardHrFlushReason(val raw: String) {
+    CADENCE("cadence"),
+    DISCONNECT("disconnect"),
+    BACKGROUND("background"),
+    TERMINATION("termination"),
+    EXPLICIT("explicit"),
+}
+
 /**
  * A live HR/R-R batch failed to persist and was re-buffered.
  *
diff --git a/android/app/src/main/java/com/noop/ble/StandardHrSource.kt b/android/app/src/main/java/com/noop/ble/StandardHrSource.kt
index e2e26bace3..db0408b44e 100644
--- a/android/app/src/main/java/com/noop/ble/StandardHrSource.kt
+++ b/android/app/src/main/java/com/noop/ble/StandardHrSource.kt
@@ -20,6 +20,7 @@ import android.os.Handler
 import android.os.Looper
 import android.os.ParcelUuid
 import com.noop.data.HrRow
+import com.noop.data.InsertCounts
 import com.noop.data.RrRow
 import com.noop.data.StreamBatch
 import com.noop.polar.PolarModel
@@ -57,9 +58,25 @@ class StandardHrSource(
     private val deviceId: String,
     /** Push live HR (bpm) + R-R (ms) into whatever the UI observes. Called on the main looper. */
     private val liveSink: (hr: Int, rr: List<Int>) -> Unit,
-    /** Persist a batch under [deviceId] — wired to `repository.insert`. Called off the main looper is
-     *  fine; the implementation hops to its own IO scope (see [SourceCoordinator]). */
-    private val persist: (StreamBatch, String) -> Unit,
+    /**
+     * Persist a batch under [deviceId] — wired to `repository.insert`. Called off the main looper is
+     * fine; the implementation hops to its own IO scope (see [SourceCoordinator]).
+     *
+     * Reports its OUTCOME through [done], and that is the point of the third parameter. The seam used to
+     * return Unit and the app wired it as `runCatching { repo.insert(...) }` with no onFailure, while
+     * [flush] had already cleared the buffer — so a store that rejected the batch lost those rows in
+     * silence, with the surrounding log reading exactly like a healthy stream. The Swift Collector
+     * re-buffers and retries; this could not, because it was never told.
+     *
+     * [InsertCounts] rather than a bare success flag: a batch offered in full and inserted as zero is
+     * the failure that most looks like success, and only the store's own count distinguishes it.
+     *
+     * The re-buffer is only as good as [done] being called. The live wiring launches on a scope, and a
+     * scope cancelled before the body runs drops the batch with no line — the same loss the old
+     * `runCatching`-with-no-onFailure had, now narrowed to a cancelled teardown rather than every
+     * rejected insert. An implementation that can fail to answer should answer with a failure.
+     */
+    private val persist: (StreamBatch, String, (Result<InsertCounts>) -> Unit) -> Unit,
     /** Diagnostic sink for the connect lifecycle. Wired (via [SourceCoordinator]) to the SAME in-app strap
      *  log the user exports, so the generic-HR path is no longer invisible in a bug report (issue #421).
      *  Every line is prefixed "HR-strap: " so it's distinguishable from WHOOP lines in the shared log.
@@ -152,6 +169,13 @@ class StandardHrSource(
     private val bufferLock = Any()
     private val buffer = ArrayList<Sample>()
     private var lastFlushMs = System.currentTimeMillis()
+    /** Consecutive failed inserts, for the run-length the rate-limited failure line reports. Reset by a
+     *  success, exactly like the WHOOP path's counter. */
+    private val insertFailures = java.util.concurrent.atomic.AtomicInteger(0)
+
+    /** Last emission of [liveInsertFailedLine], for [shouldEmitLiveInsertFailure]'s one-a-minute gap. */
+    @Volatile private var lastInsertFailureLogMs = 0L
+
     private val flushCount = 30
     private val flushIntervalMs = 30_000L
 
@@ -229,7 +253,7 @@ class StandardHrSource(
         loggedFirstHr = false   // a later reconnect should log its first sample again
         loggedFirstSensor = false
         _batteryPct.value = null // a stale charge must not outlive the link
-        flush()
+        flush(StandardHrFlushReason.DISCONNECT)
         clearSensorState()       // a stale speed/cadence/power panel must not outlive the link
     }
 
@@ -252,22 +276,71 @@ class StandardHrSource(
         if (shouldFlush) flush()
     }
 
-    private fun flush() {
-        val snapshot = synchronized(bufferLock) {
-            lastFlushMs = System.currentTimeMillis()
-            if (buffer.isEmpty()) return
-            val s = ArrayList(buffer); buffer.clear(); s
-        }
-        // Mirror StandardHRMapping: HrRow + RrRow only. HR is range-gated (off-wrist 0/garbage dropped);
-        // R-R is gated to physiologically plausible beat-to-beat ms, matching ingestStandardHr.
+    /**
+     * The rows a set of buffered samples would offer, applying the SAME gates in one place.
+     *
+     * Mirrors `StandardHRMapping`: HrRow + RrRow only, HR range-gated so an off-wrist 0 is dropped, R-R
+     * gated to plausible beat-to-beat ms — matching `ingestStandardHr`. Shared with the re-buffer path
+     * deliberately: a pending count that applied different gates from the offered count would report two
+     * numbers that cannot be compared, in the one line whose job is comparing them.
+     */
+    private fun rowsOf(samples: List<Sample>): Pair<List<HrRow>, List<RrRow>> {
         val hrRows = ArrayList<HrRow>()
         val rrRows = ArrayList<RrRow>()
-        for (s in snapshot) {
+        for (s in samples) {
             if (s.hr in 30..220) hrRows.add(HrRow(s.ts, s.hr))
             for (r in s.rr) if (r in 250..3000) rrRows.add(RrRow(s.ts, r))
         }
-        if (hrRows.isNotEmpty() || rrRows.isNotEmpty()) {
-            persist(StreamBatch(hr = hrRows, rr = rrRows), deviceId)
+        return hrRows to rrRows
+    }
+
+    private fun flush(reason: StandardHrFlushReason = StandardHrFlushReason.CADENCE) {
+        val snapshot = synchronized(bufferLock) {
+            lastFlushMs = System.currentTimeMillis()
+            if (buffer.isEmpty()) return
+            val s = ArrayList(buffer); buffer.clear(); s
+        }
+        val (hrRows, rrRows) = rowsOf(snapshot)
+        if (hrRows.isEmpty() && rrRows.isEmpty()) return
+        log(standardHrFlushAttemptLine(reason.raw, hrRows.size, rrRows.size))
+        persist(StreamBatch(hr = hrRows, rr = rrRows), deviceId) { result ->
+            result.fold(
+                onSuccess = { counts ->
+                    insertFailures.set(0)
+                    log(standardHrFlushSucceededLine(reason.raw, hrRows.size, rrRows.size, counts.hr, counts.rr))
+                },
+                onFailure = { t ->
+                    // Put the batch BACK, at the front, so the next flush retries it in order — the Swift
+                    // Collector's `insert(contentsOf:at:0)`. Without this the rows were already gone the
+                    // moment the snapshot was taken.
+                    val (pendingHr, pendingRr) = synchronized(bufferLock) {
+                        buffer.addAll(0, snapshot)
+                        val (h, r) = rowsOf(buffer)
+                        h.size to r.size
+                    }
+                    val runLength = insertFailures.incrementAndGet()
+                    log(standardHrRebufferedForRetryLine(
+                        reason = reason.raw,
+                        attemptedHrRows = hrRows.size, attemptedRrRows = rrRows.size,
+                        pendingHrRows = pendingHr, pendingRrRows = pendingRr,
+                        consecutiveFailures = runLength,
+                    ))
+                    // Rate-limited, and the SAME helper the WHOOP live path uses, so one strap log carries
+                    // one shape of insert failure however it arrived.
+                    val nowMs = System.currentTimeMillis()
+                    if (shouldEmitLiveInsertFailure(lastInsertFailureLogMs, nowMs)) {
+                        lastInsertFailureLogMs = nowMs
+                        log(liveInsertFailedLine(
+                            transport = "standard-hr",
+                            throwableName = t.javaClass.simpleName,
+                            message = t.message,
+                            hrFrames = hrRows.size,
+                            rrFrames = rrRows.size,
+                            consecutiveFailures = runLength,
+                        ))
+                    }
+                },
+            )
         }
     }
 
@@ -324,7 +397,7 @@ class StandardHrSource(
                     loggedPolarIdentity = false
                     loggedFirstSensor = false
                     _batteryPct.value = null // a stale charge must not outlive the link
-                    flush()
+                    flush(StandardHrFlushReason.DISCONNECT)
                     clearSensorState()
                     if (gatt === g) { runCatching { g.close() }; gatt = null }
                     // Hardening: status 133 is Android's infamous generic GATT_ERROR on connect — almost
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index ff8a75359b..9e60658031 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -278,7 +278,8 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
             context = appContext,
             deviceId = "scan-preview",
             liveSink = { _, _ -> },
-            persist = { _, _ -> },
+            // Discovery-only scanner: nothing is persisted, so the outcome callback never fires.
+            persist = { _, _, _ -> },
             // Route the throwaway scanner's diagnostics into the SAME exported strap log the active path
             // uses (issue #421 parity), so a tester's wizard scan is captured. The source self-prefixes
             // "HR-strap: "; [externalLog] redacts addresses. Privacy-safe: statuses / counts only.
diff --git a/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt b/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
index 76ef5f476f..4fc299f901 100644
--- a/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
+++ b/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
@@ -334,4 +334,50 @@ class StalledLinkDiagnosticsTest {
         assertEquals(true, shouldEmitLiveInsertFailure(1L, 60_001L))
         assertEquals(false, shouldEmitLiveInsertFailure(1L, 30_000L))
     }
+    // Standard-HR transport lines — byte-identical twins of Swift's LivePersistTrace.
+
+    /**
+     * The expected strings are copied from the Swift `LivePersistTraceTests`, not regenerated from the
+     * Kotlin. That is the point: a twin asserted against its own implementation proves only that the
+     * implementation is self-consistent, and these two lines exist so an Android and an Apple log of the
+     * same stall compare directly.
+     */
+    @Test
+    fun `flush success separates offered from actually inserted rows`() {
+        assertEquals(
+            "standard-hr transport flush-attempt reason=cadence offeredHRRows=4 offeredRRRows=5",
+            standardHrFlushAttemptLine(StandardHrFlushReason.CADENCE.raw, 4, 5),
+        )
+        // Offered 4/5 and inserted 1/2 is the failure that reads like success: the batch was accepted by
+        // the call and mostly discarded by the store. Only the store's own count shows it.
+        assertEquals(
+            "standard-hr transport flush-succeeded reason=cadence offeredHRRows=4 offeredRRRows=5" +
+                " insertedHRRows=1 insertedRRRows=2",
+            standardHrFlushSucceededLine(StandardHrFlushReason.CADENCE.raw, 4, 5, 1, 2),
+        )
+    }
+
+    @Test
+    fun `retry names the lifecycle reason and the total pending rows`() {
+        assertEquals(
+            "standard-hr transport rebuffered-for-retry reason=disconnect" +
+                " attemptedHRRows=1 attemptedRRRows=2 pendingHRRows=3 pendingRRRows=4" +
+                " consecutiveFailures=1",
+            standardHrRebufferedForRetryLine(StandardHrFlushReason.DISCONNECT.raw, 1, 2, 3, 4, 1),
+        )
+    }
+
+    /**
+     * The raw values are what the log line carries, so they are the parity surface — not the enum's
+     * Kotlin spelling. background and termination have no Android emitter today (the foreground service
+     * gives no suspension edge); they exist so the two enums cannot drift apart before one does.
+     */
+    @Test
+    fun `the flush reasons match the Swift raw values exactly`() {
+        assertEquals(
+            listOf("cadence", "disconnect", "background", "termination", "explicit"),
+            StandardHrFlushReason.entries.map { it.raw },
+        )
+    }
+
 }

From bb0e61630eebe834bd3fe91a87fc78cc34820a06 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 21:40:28 +1200
Subject: [PATCH 119/333] staging: build 400 / iOS 281 for the standard-HR
 persistence work

Build numbers only - 10.6.1 stays the unreleased line, and 400 clears the
staging high-water so the APK installs over 399.

Carries the standard-HR durability work on both platforms. On Apple, two
new lifecycle flush edges: iOS suspends a connected strap without a
disconnect edge and the cadence timer does not run while suspended, so a
sub-cadence batch of buffered 0x2A37 rows could die with the app. On
Android, the persist seam now reports its outcome, so a batch a store
rejects is re-buffered and retried instead of vanishing with the log still
reading like a healthy stream.

Also carries the type-43 REALTIME_RAW_DATA decoder from @Zebsi235.

Affects generic HR straps rather than WHOOP - the WHOOP live path already
reported and retried its insert failures. Nothing here touches the strap
link, the handshake, or scoring.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index f2cd012443..569efac9ba 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 399
+        versionCode = 400
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 4792320866..a41db047df 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "280"
+    CURRENT_PROJECT_VERSION: "281"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From bd24995accb00c9eb985a589bd34b8d92b5bd0fb Mon Sep 17 00:00:00 2001
From: Pipiche <8291674+pipiche38@users.noreply.github.com>
Date: Mon, 31 Aug 2026 11:53:28 +0200
Subject: [PATCH 120/333] sleep: say when a night's hypnogram only covers part
 of its window (#1764)

Tells the user when a night's hypnogram only covers part of its window, on both
platforms, rather than presenting a partial stage record as a whole one.

The interesting part is the group accumulation. A night is not one row - the engine
bridges the day's main-sleep fragments - so the question becomes what an
UNMEASURABLE fragment does to the group. A minute-dict payload (imported totals,
no timestamps) or a Health Connect stage array carries no bounds to measure, and
this contributes zero covered seconds while still contributing its full span. So a
night that is 28800s of real hypnogram plus 7200s of totals reads 80% and is
flagged.

That is a deliberate departure from the single-session rule, where an unmeasurable
payload returns null and the gate stays fail-OPEN, and it is the right one for what
this feature says. A fragment with no per-stage timing genuinely has no hypnogram
over its window, so "only 80% of this night's window has stage data" is true rather
than a guess. Both readings are pinned.

The verification is the part worth copying. The oracle is the VERBATIM stdout of
the shipped Swift implementation - linked as a package dependency and RUN, not
retyped - so the Kotlin is checked against what Apple actually does rather than
against a transcription of it. It also pins 0.94999999999999996, the exact double
the threshold literal denotes, which is where a reimplementation drifts in the
direction nobody notices.

Checked rather than trusted before merge: all six Android locale directories plus
the default carry the new strings, Tools/i18n_audit.py --ci main exits clean, and
the two new iOS strings omit an explicit "en" exactly as 78% of the existing 3693
do, the key being the English value. HypnogramCoverageTest 10/10 locally, 15/15 CI.

One small loss: a prose comment explaining the historic [{seg},5] Swift/Kotlin
divergence goes with the refactor. It is replaced by an executable oracle row
(non-object-bails), which holds the same knowledge in a form that fails when it
stops being true.

Thanks @pipiche38.
---
 .../WhoopStore/HypnogramCoverage.swift        |  60 +++++++-
 .../HypnogramCoverageTests.swift              |  74 ++++++++++
 Strand/Resources/Localizable.xcstrings        | 116 ++++++++++++++++
 Strand/Screens/SleepView.swift                |  48 +++++++
 Strand/Screens/StagesCard.swift               |  32 +++++
 .../com/noop/analytics/HypnogramCoverage.kt   | 106 ++++++++++----
 .../src/main/java/com/noop/ui/SleepScreen.kt  |  48 +++++++
 .../app/src/main/res/values-de/strings.xml    |   2 +
 .../app/src/main/res/values-es/strings.xml    |   2 +
 .../app/src/main/res/values-fr/strings.xml    |   2 +
 .../app/src/main/res/values-pl/strings.xml    |   2 +
 .../src/main/res/values-pt-rPT/strings.xml    |   2 +
 .../app/src/main/res/values-zh/strings.xml    |   2 +
 android/app/src/main/res/values/strings.xml   |   2 +
 .../noop/analytics/HypnogramCoverageTest.kt   | 130 ++++++++++++++++++
 15 files changed, 601 insertions(+), 27 deletions(-)

diff --git a/Packages/WhoopStore/Sources/WhoopStore/HypnogramCoverage.swift b/Packages/WhoopStore/Sources/WhoopStore/HypnogramCoverage.swift
index 5b848ce22c..d955bf361e 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/HypnogramCoverage.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/HypnogramCoverage.swift
@@ -67,18 +67,74 @@ public enum HypnogramCoverage {
     /// that importer, unvalidated against a Xiaomi export, and it is pinned by test rather than left to
     /// be discovered.
     public static func fraction(stagesJSON: String?, spanSeconds: Double) -> Double? {
+        fraction(coveredSeconds: coveredSeconds(stagesJSON: stagesJSON), spanSeconds: spanSeconds)
+    }
+
+    /// Seconds of `stagesJSON` accounted for by timestamped segments, or 0 when the payload carries no
+    /// measurable ones.
+    ///
+    /// Zero, not nil, because this is a SUMMABLE quantity: a caller accumulating several fragments needs
+    /// "this one contributed nothing" to add cleanly, and the "is coverage even a meaningful question"
+    /// decision belongs to `fraction`, which turns a zero total back into nil. Callers that want the
+    /// unknown/known distinction for a SINGLE session must therefore keep using `fraction`, not this.
+    ///
+    /// Returns 0 for every shape `fraction(stagesJSON:spanSeconds:)` documents as unmeasurable — a
+    /// nil/blank/`"[]"` payload, the imported minute-dict `{light,deep,rem,awake}`, Health Connect's
+    /// `{stage,min}` array, and an array holding any non-object element (the whole payload bails rather
+    /// than measuring the remainder). Splitting it out is behaviour-preserving for that function: a 0
+    /// total fails `fraction`'s `coveredSeconds > 0` guard and still yields nil.
+    public static func coveredSeconds(stagesJSON: String?) -> Double {
         guard let json = stagesJSON?.trimmingCharacters(in: .whitespacesAndNewlines),
               !json.isEmpty, json != "[]",
               let data = json.data(using: .utf8),
               let segs = (try? JSONSerialization.jsonObject(with: data)) as? [[String: Any]]
-        else { return nil }
+        else { return 0 }
         var covered = 0.0
         for seg in segs {
             guard let s = (seg["start"] as? NSNumber)?.doubleValue,
                   let e = (seg["end"] as? NSNumber)?.doubleValue, e > s else { continue }
             covered += e - s
         }
-        return fraction(coveredSeconds: covered, spanSeconds: spanSeconds)
+        return covered
+    }
+
+    /// Coverage summed across a bridged main-night GROUP — the quantity a night is actually judged on.
+    ///
+    /// A night is not one row. `AnalyticsEngine.analyzeDay` bridges the day's main-sleep fragments into a
+    /// group (#561) and accumulates coverage over ALL of them before testing the gate, so a per-row answer
+    /// is the wrong question for anything presenting a night: two fragments that are individually 90% and
+    /// 99% covered are one night at neither figure. This exists so a UI can ask the same question the
+    /// engine asked without restating the accumulation, which is where a twin rule would drift.
+    ///
+    /// PARITY WITH THE ENGINE, exactly. Every fragment contributes its full `[startTs, endTs)` to the
+    /// denominator whether or not its payload is measurable, and contributes cover only from timestamped
+    /// segments — which reproduces `analyzeDay`'s decoded-segment accumulation term for term, including
+    /// the mixed-source case it calls out (a timestamp-free fragment adds span and no cover, so a group
+    /// mixing one with a timestamped fragment reads as holed). A group whose fragments are ALL
+    /// timestamp-free totals 0 covered seconds and comes back nil — unknown, not holed.
+    /// The accumulation itself, over `(payload, span)` fragments. This is the shape the Kotlin twin
+    /// implements — entity-free, because `HypnogramCoverage` sits in `com.noop.analytics` over there and
+    /// must not reach into `com.noop.data` for a row type. The session overload below is a thin adapter,
+    /// so both platforms run the identical arithmetic and only the packaging differs.
+    public static func groupFraction(_ fragments: [(stagesJSON: String?, spanSeconds: Double)]) -> Double? {
+        var covered = 0.0, span = 0.0
+        for f in fragments {
+            span += f.spanSeconds
+            covered += coveredSeconds(stagesJSON: f.stagesJSON)
+        }
+        return fraction(coveredSeconds: covered, spanSeconds: span)
+    }
+
+    public static func groupFraction(_ sessions: [CachedSleepSession]) -> Double? {
+        groupFraction(sessions.map { (stagesJSON: $0.stagesJSON,
+                                      spanSeconds: Double($0.endTs - $0.startTs)) })
+    }
+
+    /// `isHoled` for a bridged main-night GROUP. Unknown coverage (nil) is NOT holed — same fail-open
+    /// contract as every other guard here.
+    public static func isHoledGroup(_ sessions: [CachedSleepSession]) -> Bool {
+        guard let f = groupFraction(sessions) else { return false }
+        return f < minCoverage
     }
 
     /// True when the timeline is known to cover less than `minCoverage` of its span — i.e. the session
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/HypnogramCoverageTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/HypnogramCoverageTests.swift
index e00cfdfcce..c6682befe3 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/HypnogramCoverageTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/HypnogramCoverageTests.swift
@@ -176,4 +176,78 @@ final class HypnogramCoverageTests: XCTestCase {
         XCTAssertNil(HypnogramCoverage.fraction(stagesJSON: #"[{"start":null,"end":100,"stage":"deep"}]"#,
                                                 spanSeconds: 1000))
     }
+
+    // MARK: - the GROUP accumulation (what a night is actually judged on)
+
+    private func sess(_ start: Int, _ end: Int, _ stagesJSON: String?) -> CachedSleepSession {
+        CachedSleepSession(startTs: start, endTs: end, efficiency: nil, restingHr: nil,
+                           avgHrv: nil, stagesJSON: stagesJSON)
+    }
+
+    /// A night is not one row. Two bridged fragments that are individually 90% and 100% covered are ONE
+    /// night at neither figure, and the group answer is what the engine gates on — so the per-row reading
+    /// is the wrong question for anything presenting a night.
+    func testGroupFractionSumsAcrossBridgedFragments() {
+        let a = sess(0, 1000, segs([(0, 900, "light")]))          // 90% of its own span
+        let b = sess(1200, 2200, segs([(1200, 2200, "deep")]))    // 100% of its own span
+        XCTAssertEqual(HypnogramCoverage.groupFraction([a, b])!, 1900.0 / 2000.0, accuracy: 1e-12)
+        XCTAssertEqual(HypnogramCoverage.fraction(stagesJSON: a.stagesJSON, spanSeconds: 1000)!,
+                       0.9, accuracy: 1e-12)
+        XCTAssertFalse(HypnogramCoverage.isHoledGroup([a, b]))
+        XCTAssertTrue(HypnogramCoverage.isHoled(a))               // and the fragment alone still is
+    }
+
+    /// The inter-fragment GAP is not in the denominator. It belongs to no fragment's `[startTs, endTs)`,
+    /// and it is known-awake out-of-bed time (#777/#705) rather than time we failed to observe — folding
+    /// it in would report a correctly-recorded biphasic night as partly missing.
+    func testGroupFractionExcludesTheInterFragmentGap() {
+        let a = sess(0, 1000, segs([(0, 1000, "light")]))
+        let b = sess(5000, 6000, segs([(5000, 6000, "deep")]))    // 4000 s gap between them
+        XCTAssertEqual(HypnogramCoverage.groupFraction([a, b])!, 1.0, accuracy: 1e-12)
+    }
+
+    /// `testMixedSourceGroupReadsAsHoled`'s arithmetic, now asserted through the accumulation itself
+    /// rather than restated as two literals: a timestamp-free fragment contributes span and no cover.
+    func testGroupFractionMixedSourceReadsAsHoled() {
+        let staged = sess(0, 8 * 3600, segs([(0, 8 * 3600, "light")]))
+        let minuteDict = sess(8 * 3600, 10 * 3600, #"{"light":60,"deep":30,"rem":20,"awake":10}"#)
+        XCTAssertEqual(HypnogramCoverage.groupFraction([staged, minuteDict])!, 0.8, accuracy: 1e-12)
+        XCTAssertTrue(HypnogramCoverage.isHoledGroup([staged, minuteDict]))
+    }
+
+    /// All-timestamp-free: zero cover over a real span is UNKNOWN, not bad. This is what keeps the gate
+    /// off the WHOOP CSV / Apple / Health Connect imports at the group level too.
+    func testGroupFractionAllTimestampFreeIsUnmeasurable() {
+        let a = sess(0, 4 * 3600, #"{"light":60,"deep":30,"rem":20,"awake":10}"#)
+        let b = sess(4 * 3600, 8 * 3600, nil)
+        XCTAssertNil(HypnogramCoverage.groupFraction([a, b]))
+        XCTAssertFalse(HypnogramCoverage.isHoledGroup([a, b]))
+        XCTAssertFalse(HypnogramCoverage.isHoledGroup([]))
+    }
+
+    /// The REAL night this guard's UI was built against — 2026-08-28/29 on an Oura ring: a 470.5-minute
+    /// window whose 96 stage segments account for 440.0 minutes. It renders as a complete night and is
+    /// not; at 93.5% it is the case the Sleep tab's "Partly recorded" note exists to state. Pinned with
+    /// the boundary night from the same 31-night run (08-26, 95.2%) so the gate is shown to separate
+    /// them rather than to flag everything nearby.
+    func testGroupFractionMatchesTheObservedHoledNight() {
+        let holed = sess(0, Int(470.5 * 60), segs([(0, Int(440.0 * 60), "light")]))
+        let f = HypnogramCoverage.groupFraction([holed])!
+        XCTAssertEqual(f, 440.0 / 470.5, accuracy: 1e-12)
+        XCTAssertEqual(Int((f * 100).rounded(.down)), 93)   // the percentage the note prints
+        XCTAssertTrue(HypnogramCoverage.isHoledGroup([holed]))
+
+        let boundary = sess(0, 100_000, segs([(0, 95_200, "light")]))
+        XCTAssertFalse(HypnogramCoverage.isHoledGroup([boundary]))
+    }
+
+    /// The note floors its percentage rather than rounding it: 94.8% must never print as "95%" beside a
+    /// badge raised because coverage fell BELOW 95%. Pinned here because the rule is a property of the
+    /// gate, not of one screen, and both hosts that print it must agree.
+    func testPrintedPercentageNeverContradictsTheGate() {
+        let s = sess(0, 100_000, segs([(0, 94_800, "light")]))
+        let f = HypnogramCoverage.groupFraction([s])!
+        XCTAssertTrue(f < HypnogramCoverage.minCoverage)
+        XCTAssertEqual(Int((f * 100).rounded(.down)), 94)
+    }
 }
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 32cac8a3b0..ca19d8b54d 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -195837,6 +195837,122 @@
         }
       }
     },
+    "Only %lld%% of this night's window has stage data. The stage totals cover only that part of the night.": {
+      "localizations": {
+        "de": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Nur %lld%% des Zeitfensters dieser Nacht enthält Schlafphasendaten. Die Phasenwerte decken nur diesen Teil der Nacht ab."
+          }
+        },
+        "es": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Solo el %lld%% de la ventana de esta noche tiene datos de fases. Los totales de fases cubren solo esa parte de la noche."
+          }
+        },
+        "fr": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Seuls %lld%% de la fenêtre de cette nuit comportent des données de phases. Les totaux de phases ne couvrent que cette partie de la nuit."
+          }
+        },
+        "it": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Solo il %lld%% della finestra di questa notte ha dati sulle fasi. I totali delle fasi coprono solo quella parte della notte."
+          }
+        },
+        "pt-PT": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Apenas %lld%% da janela desta noite tem dados de fases. Os totais de fases cobrem apenas essa parte da noite."
+          }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Только %lld%% окна этой ночи содержит данные о фазах. Итоги по фазам охватывают только эту часть ночи."
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "这一夜的时间窗口中只有 %lld%% 有睡眠阶段数据。阶段合计仅涵盖该部分时间。"
+          }
+        },
+        "zh-Hant": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "這一夜的時間視窗中只有 %lld%% 有睡眠階段資料。階段合計僅涵蓋該部分時間。"
+          }
+        },
+        "pl": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Tylko %lld%% okna tej nocy ma dane o fazach. Sumy faz obejmują tylko tę część nocy."
+          }
+        }
+      }
+    },
+    "Partly recorded": {
+      "localizations": {
+        "de": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Teilweise aufgezeichnet"
+          }
+        },
+        "es": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Registro parcial"
+          }
+        },
+        "fr": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Enregistrement partiel"
+          }
+        },
+        "it": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Registrazione parziale"
+          }
+        },
+        "pt-PT": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Registo parcial"
+          }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Записано частично"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "部分记录"
+          }
+        },
+        "zh-Hant": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "部分記錄"
+          }
+        },
+        "pl": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Częściowo zarejestrowane"
+          }
+        }
+      }
+    },
     "Customize": {
       "localizations": {
         "de": {
diff --git a/Strand/Screens/SleepView.swift b/Strand/Screens/SleepView.swift
index 715a909249..421ce7c963 100644
--- a/Strand/Screens/SleepView.swift
+++ b/Strand/Screens/SleepView.swift
@@ -820,6 +820,14 @@ struct SleepView: View {
             if stageStagingIsSparse(night) {
                 stageIncompleteNote
             }
+            // #1716 — a device-provided hypnogram assembled from records that never all arrived leaves a
+            // HOLE in the timeline while the session still spans the whole night, so a night we saw a
+            // fraction of renders as a complete one. Say which fraction. This is the only place the
+            // coverage guard becomes visible: the engine's matching Rest downgrade lands in a transient
+            // `DayResult` field no screen reads, so the gate was otherwise correct and inert.
+            if let coverage = stageCoverage(night), coverage < HypnogramCoverage.minCoverage {
+                stagePartialNote(coverage)
+            }
             // For an Oura-provided night, say plainly that this split is the ring's RAW on-device
             // classification — so the larger Awake / smaller Deep+REM here isn't misread as the polished
             // numbers the Oura app shows for the same night (the app post-processes the same stream).
@@ -945,6 +953,17 @@ struct SleepView: View {
         night.sourceBlocks.contains { $0.stagingSparse == true }
     }
 
+    /// How much of this night's window its stage timeline actually accounts for, or nil when coverage is
+    /// not a measurable question for the payloads it was built from (#1716). Asked of the bridged main-night
+    /// GROUP via the SAME shared accumulation `analyzeDay` uses, threading the same learned habitual so the
+    /// group resolves identically to the hero's — a per-row answer would be the wrong question for a
+    /// fragmented night. Mirror in Kotlin.
+    private func stageCoverage(_ night: Night) -> Double? {
+        let group = SleepView.mainNightGroup(night.sourceBlocks,
+                                             habitualMidsleepSec: night.habitualMidsleepSec)
+        return HypnogramCoverage.groupFraction(group.isEmpty ? night.sourceBlocks : group)
+    }
+
     /// Pure H9 gate (unit-testable without a live view) — true when a night's staging is low-confidence:
     /// a high-efficiency night whose deep+REM share is below the restorative floor. Built on the engine's
     /// own `ScoreConfidence.rest(...)` so the UI flag and the persisted Rest confidence agree. `asleepMin`,
@@ -1004,6 +1023,35 @@ struct SleepView: View {
         .accessibilityElement(children: .combine)
     }
 
+    /// The PARTIAL-TIMELINE caveat (#1716): this night's stage segments account for less than
+    /// `HypnogramCoverage.minCoverage` of the window the session claims, so the stage totals describe only
+    /// the part of the night the timeline accounts for. Distinct from BOTH notes above — H9 doubts the
+    /// deep/REM SPLIT of a fully-described night, #345 doubts a night staged on thin motion, and this one
+    /// says plainly that some of the night is MISSING rather than doubted. It is the visible half of the
+    /// engine-side guard: `analyzeDay` already downgrades Rest to `.building` on exactly this condition,
+    /// but that tier is transient engine output no screen reads, so without this the gate was inert.
+    ///
+    /// HONEST-DATA: it reports only what was observed and changes no number. The percentage is floored,
+    /// never rounded — 94.8% must not print as "95%" and appear to contradict the gate that flagged it.
+    /// The copy names NO cause and offers NO remedy, deliberately: on the 08-29/30 and 08-30/31 captures the
+    /// missing codes DID reach NOOP — the ring reported them unwritten (0xFF), the persist log trimmed
+    /// exactly as many as the hole is wide — and re-persisting the same night 5 and 8 times left the hole
+    /// intact. "The rest never reached NOOP" and "syncing again can fill in" were both wrong. Nor does the
+    /// copy point at the totals by DIRECTION: both hosts render this note below the stage-breakdown card
+    /// that carries them, so "the totals below" pointed the wrong way on every screen that shipped it.
+    private func stagePartialNote(_ coverage: Double) -> some View {
+        let pct = Int((coverage * 100).rounded(.down))
+        return HStack(alignment: .top, spacing: 8) {
+            SourceBadge("Partly recorded", tint: StrandPalette.statusWarning)
+            Text("Only \(pct)% of this night's window has stage data. The stage totals cover only that part of the night.")
+                .font(StrandFont.footnote)
+                .foregroundStyle(StrandPalette.textTertiary)
+                .fixedSize(horizontal: false, vertical: true)
+        }
+        .padding(.horizontal, 2)
+        .accessibilityElement(children: .combine)
+    }
+
     /// Honest caveat for an Oura-provided night: the stage split shown here is the ring's RAW on-device
     /// SleepNet classification, read straight off the BLE phase stream — NOT the adjusted stages the Oura
     /// app displays. The app post-processes the same night, so its Deep/REM run higher and its Awake lower;
diff --git a/Strand/Screens/StagesCard.swift b/Strand/Screens/StagesCard.swift
index 8c50f77a91..e3af83c922 100644
--- a/Strand/Screens/StagesCard.swift
+++ b/Strand/Screens/StagesCard.swift
@@ -123,6 +123,12 @@ struct StageDetailView: View {
             if stageStagingIsSparse(night) {
                 stageIncompleteNote
             }
+            // #1716 — a device-provided hypnogram whose records never all arrived leaves a HOLE in the
+            // timeline while the session still spans the whole night, so a night we saw a fraction of
+            // renders as a complete one. Say which fraction, exactly as the Sleep tab does.
+            if let coverage = stageCoverage(night), coverage < HypnogramCoverage.minCoverage {
+                stagePartialNote(coverage)
+            }
             // For an Oura-provided night, say plainly that this split is the ring's RAW on-device
             // classification — so the larger Awake / smaller Deep+REM here isn't misread as the polished
             // numbers the Oura app shows for the same night (the app post-processes the same stream).
@@ -246,6 +252,16 @@ struct StageDetailView: View {
         night.sourceBlocks.contains { $0.stagingSparse == true }
     }
 
+    /// How much of this night's window its stage timeline actually accounts for, or nil when coverage is not
+    /// a measurable question for the payloads it was built from (#1716). Same shared group accumulation as
+    /// `SleepView.stageCoverage(_:)` — this host renders the same night and must not reach a different
+    /// verdict about it. Mirror in Kotlin.
+    private func stageCoverage(_ night: Night) -> Double? {
+        let group = SleepView.mainNightGroup(night.sourceBlocks,
+                                             habitualMidsleepSec: night.habitualMidsleepSec)
+        return HypnogramCoverage.groupFraction(group.isEmpty ? night.sourceBlocks : group)
+    }
+
     /// The H9 low-confidence note shown beneath the stage breakdown — a warning-tinted badge plus a
     /// one-line honest explanation. No faked stages, no tanked score; just a clear "treat this split with
     /// care" so a user doesn't read a likely staging miss as a real deep/REM drought. (#H9)
@@ -278,6 +294,22 @@ struct StageDetailView: View {
         .accessibilityElement(children: .combine)
     }
 
+    /// The PARTIAL-TIMELINE caveat (#1716) — twin of `SleepView.stagePartialNote(_:)`, same copy and same
+    /// floored percentage. Says that part of the night is MISSING, which is a different claim from the two
+    /// notes above (a doubted split, and a night staged on thin motion). Changes no number.
+    private func stagePartialNote(_ coverage: Double) -> some View {
+        let pct = Int((coverage * 100).rounded(.down))
+        return HStack(alignment: .top, spacing: 8) {
+            SourceBadge("Partly recorded", tint: StrandPalette.statusWarning)
+            Text("Only \(pct)% of this night's window has stage data. The stage totals cover only that part of the night.")
+                .font(StrandFont.footnote)
+                .foregroundStyle(StrandPalette.textTertiary)
+                .fixedSize(horizontal: false, vertical: true)
+        }
+        .padding(.horizontal, 2)
+        .accessibilityElement(children: .combine)
+    }
+
     /// Honest caveat for an Oura-provided night: the stage split shown here is the ring's RAW on-device
     /// SleepNet classification, read straight off the BLE phase stream — NOT the adjusted stages the Oura
     /// app displays. The app post-processes the same night, so its Deep/REM run higher and its Awake lower;
diff --git a/android/app/src/main/java/com/noop/analytics/HypnogramCoverage.kt b/android/app/src/main/java/com/noop/analytics/HypnogramCoverage.kt
index 9c9f072022..695d3c606e 100644
--- a/android/app/src/main/java/com/noop/analytics/HypnogramCoverage.kt
+++ b/android/app/src/main/java/com/noop/analytics/HypnogramCoverage.kt
@@ -77,31 +77,8 @@ object HypnogramCoverage {
      * that importer, unvalidated against a Xiaomi export, and it is pinned by test rather than left to
      * be discovered.
      */
-    fun fraction(stagesJson: String?, spanSeconds: Double): Double? {
-        val json = stagesJson?.trim() ?: return null
-        if (json.isEmpty() || json == "[]") return null
-        // The minute-dict shape (imported totals) throws here and falls through to null — deliberately,
-        // since it carries no timestamps to measure. Same try/catch idiom as SleepStageTotals.minutes.
-        // Health Connect's `{stage,min}` array does NOT throw: it parses, reaches the loop, and every
-        // segment is skipped for want of bounds, so it exits with zero cover — unmeasurable by the same
-        // rule, along a different path. Both are pinned in the oracle.
-        val arr = try { JSONArray(json) } catch (_: Throwable) { return null }
-        var covered = 0.0
-        for (i in 0 until arr.length()) {
-            // The Swift twin decodes the array as a WHOLE (`as? [[String: Any]]`), so ONE non-object
-            // element makes the entire payload unmeasurable there. Bail identically rather than
-            // measuring the remainder. Measured on the shipped pair, `[{seg},5]` and `[{seg},null]`
-            // read nil/not-holed on Swift and 0.1/HOLED here — and since this gate can only downgrade
-            // a night, refusing to judge a payload we do not fully understand is the safe half of that
-            // disagreement, and the one the module's fail-OPEN rule already commits to.
-            val seg = arr.optJSONObject(i) ?: return null
-            val s = num(seg.opt("start")) ?: continue
-            val e = num(seg.opt("end")) ?: continue
-            if (e <= s) continue
-            covered += e - s
-        }
-        return fraction(covered, spanSeconds)
-    }
+    fun fraction(stagesJson: String?, spanSeconds: Double): Double? =
+        fraction(coveredSeconds(stagesJson), spanSeconds)
 
     /**
      * A JSON scalar read the way Swift's `(seg["start"] as? NSNumber)?.doubleValue` reads it.
@@ -130,4 +107,83 @@ object HypnogramCoverage {
         val f = fraction(stagesJson, spanSeconds) ?: return false
         return f < minCoverage
     }
+
+    /**
+     * Seconds of [stagesJson] accounted for by timestamped segments, or 0 when the payload carries no
+     * measurable ones.
+     *
+     * Zero, not null, because this is a SUMMABLE quantity: a caller accumulating several fragments needs
+     * "this one contributed nothing" to add cleanly, and the "is coverage even a meaningful question"
+     * decision belongs to [fraction], which turns a zero total back into null. Callers wanting the
+     * unknown/known distinction for a SINGLE session must therefore keep using [fraction], not this.
+     *
+     * Returns 0 for every shape [fraction] documents as unmeasurable, by the same paths and in the same
+     * order — including the whole-payload bail on a non-object element, which must stay a bail here too
+     * (returning a PARTIAL sum for such a payload would resurrect exactly the Swift/Kotlin disagreement
+     * the `optJSONObject` bail above was added to close). Mirrors Swift `coveredSeconds(stagesJSON:)`.
+     */
+    fun coveredSeconds(stagesJson: String?): Double {
+        val json = stagesJson?.trim() ?: return 0.0
+        if (json.isEmpty() || json == "[]") return 0.0
+        // The minute-dict shape (imported totals) throws here and falls through to zero — deliberately,
+        // since it carries no timestamps to measure. Same try/catch idiom as SleepStageTotals.minutes.
+        // Health Connect's `{stage,min}` array does NOT throw: it parses, reaches the loop, and every
+        // segment is skipped for want of bounds, so it exits with zero cover — unmeasurable by the same
+        // rule, along a different path. Both are pinned in the oracle.
+        val arr = try { JSONArray(json) } catch (_: Throwable) { return 0.0 }
+        var covered = 0.0
+        for (i in 0 until arr.length()) {
+            // The Swift twin decodes the array as a WHOLE (`as? [[String: Any]]`), so ONE non-object
+            // element makes the entire payload unmeasurable there. Bail identically — DISCARDING the
+            // partial sum, which is what the Swift cast does — rather than measuring the remainder.
+            // Measured on the shipped pair, `[{seg},5]` and `[{seg},null]` read nil/not-holed on Swift
+            // and 0.1/HOLED here — and since this gate can only downgrade a night, refusing to judge a
+            // payload we do not fully understand is the safe half of that disagreement, and the one the
+            // module's fail-OPEN rule already commits to.
+            val seg = arr.optJSONObject(i) ?: return 0.0
+            val s = num(seg.opt("start")) ?: continue
+            val e = num(seg.opt("end")) ?: continue
+            if (e <= s) continue
+            covered += e - s
+        }
+        return covered
+    }
+
+    /** One fragment of a bridged main-night group: its stored payload and its own `[start, end)` span. */
+    data class Fragment(val stagesJson: String?, val spanSeconds: Double)
+
+    /**
+     * Coverage summed across a bridged main-night GROUP — the quantity a night is actually judged on.
+     *
+     * A night is not one row. `AnalyticsEngine.analyzeDay` bridges the day's main-sleep fragments into a
+     * group (#561) and accumulates coverage over ALL of them before testing the gate, so a per-row answer
+     * is the wrong question for anything presenting a night: two fragments that are individually 90% and
+     * 99% covered are one night at neither figure. This exists so a UI can ask the same question the
+     * engine asked without restating the accumulation, which is where a twin rule would drift.
+     *
+     * PARITY WITH THE ENGINE, exactly. Every fragment contributes its full span to the denominator whether
+     * or not its payload is measurable, and contributes cover only from timestamped segments — which
+     * reproduces the engine's decoded-segment accumulation term for term, including the mixed-source case
+     * (a timestamp-free fragment adds span and no cover, so a group mixing one with a timestamped fragment
+     * reads as holed). A group whose fragments are ALL timestamp-free totals 0 covered seconds and comes
+     * back null — unknown, not holed. Mirrors Swift `groupFraction(_:)`.
+     */
+    fun groupFraction(fragments: List<Fragment>): Double? {
+        var covered = 0.0
+        var span = 0.0
+        for (f in fragments) {
+            span += f.spanSeconds
+            covered += coveredSeconds(f.stagesJson)
+        }
+        return fraction(covered, span)
+    }
+
+    /**
+     * [isHoled] for a bridged main-night GROUP. Unknown coverage (null) is NOT holed — same fail-open
+     * contract as every other guard here.
+     */
+    fun isHoledGroup(fragments: List<Fragment>): Boolean {
+        val f = groupFraction(fragments) ?: return false
+        return f < minCoverage
+    }
 }
diff --git a/android/app/src/main/java/com/noop/ui/SleepScreen.kt b/android/app/src/main/java/com/noop/ui/SleepScreen.kt
index c9f3c572ee..f852f2b531 100644
--- a/android/app/src/main/java/com/noop/ui/SleepScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepScreen.kt
@@ -72,6 +72,7 @@ import androidx.compose.ui.unit.dp
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import com.noop.analytics.AnalyticsEngine
 import com.noop.analytics.CircadianEngine
+import com.noop.analytics.HypnogramCoverage
 import com.noop.analytics.SleepEditGuard
 import com.noop.analytics.SleepGroupEdit
 import com.noop.analytics.SleepStageTotals
@@ -87,6 +88,7 @@ import java.text.SimpleDateFormat
 import java.util.Calendar
 import java.util.Date
 import java.util.Locale
+import kotlin.math.floor
 import kotlin.math.max
 import kotlin.math.roundToInt
 import androidx.compose.runtime.getValue
@@ -1445,6 +1447,21 @@ private fun Hero(
             // anchor), so it carries the flag; nil (imported / pre-migration) is never flagged. Mirrors iOS
             // SleepView.stageIncompleteNote.
             if (session?.stagingSparse == true) SleepIncompleteNote()
+            // #1716 — a device-provided hypnogram assembled from records that never all arrived leaves a
+            // HOLE in the timeline while the session still spans the whole night, so a night we saw a
+            // fraction of renders as a complete one. Asked of the bridged main-night GROUP (the quantity
+            // analyzeDay gates on), never of one fragment. This is the only place the coverage guard
+            // becomes visible: the engine's matching Rest downgrade lands in a transient DayResult field
+            // no screen reads. Mirrors iOS SleepView.stagePartialNote.
+            val coverageGroup = heroGroup.ifEmpty { listOfNotNull(session) }
+            val stageCoverage = HypnogramCoverage.groupFraction(
+                coverageGroup.map {
+                    HypnogramCoverage.Fragment(it.stagesJSON, (it.endTs - it.startTs).toDouble())
+                }
+            )
+            if (stageCoverage != null && stageCoverage < HypnogramCoverage.minCoverage) {
+                SleepPartialNote(stageCoverage)
+            }
         }
         // Naps card (#508/#518): the day's blocks OTHER than the main night, each editable / deletable
         // with the SAME mechanism main sleep uses, plus a Main / Nap(s) / Total split so what drives the
@@ -1577,6 +1594,37 @@ private fun SleepIncompleteNote() {
     }
 }
 
+/**
+ * The PARTIAL-TIMELINE caveat (#1716): this night's stage segments account for less than
+ * [HypnogramCoverage.minCoverage] of the window the session claims, so the stage totals describe only the
+ * part of the night the timeline accounts for. Distinct from BOTH notes above — #H9 doubts the deep/REM SPLIT
+ * of a fully-described night, #345 doubts a night staged on thin motion, and this one says plainly that
+ * some of the night is MISSING rather than doubted.
+ *
+ * HONEST-DATA: reports only what was observed and changes no number. The percentage is FLOORED, never
+ * rounded — 94.8% must not print as "95%" beside a badge raised because coverage fell below 95% — which is
+ * why this takes the fraction and floors it here rather than accepting a pre-rounded Int from the caller.
+ * The copy names NO cause and offers NO remedy: the captures behind this note show the missing codes DID
+ * reach the phone (the ring reported them unwritten, 0xFF) and that re-persisting the night does not fill
+ * the hole. Mirrors iOS SleepView.stagePartialNote.
+ */
+@Composable
+private fun SleepPartialNote(coverage: Double) {
+    Row(
+        horizontalArrangement = Arrangement.spacedBy(8.dp),
+        verticalAlignment = Alignment.Top,
+        modifier = Modifier.padding(horizontal = 2.dp),
+    ) {
+        SourceBadge(text = uiString(R.string.l10n_sleep_screen_partly_recorded_f43509ab), tint = Palette.statusWarning)
+        Text(
+            uiString(R.string.l10n_sleep_screen_only_of_this_night_s_window_9660332a,
+                     floor(coverage * 100.0).toInt()),
+            style = NoopType.caption,
+            color = Palette.textTertiary,
+        )
+    }
+}
+
 /**
  * The Naps card footer: the night's provenance badge (the REAL per-day merge winner) next to a tappable
  * "Why this sleep?" affordance that reveals the foundation [SleepStageTotals.MainNightReason] copy inline,
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index c091f7a3ad..29cf15fda3 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -1955,6 +1955,8 @@
     <string name="l10n_app_changelog_widgets_stop_inventing_numbers_naps_count_4f7491bb">Widgets erfinden keine Zahlen mehr, Nickerchen zählen für die Schlafschuld, und die Android-Statusanzeigen sprechen deine Sprache</string>
     <string name="l10n_sleep_screen_may_be_incomplete_7230dc27">Möglicherweise unvollständig</string>
     <string name="l10n_sleep_screen_little_motion_was_recorded_over_f061b7e4">Über Nacht wurde wenig Bewegung aufgezeichnet, daher wurde diese Nacht möglicherweise nicht vollständig erfasst und die Schlafdauer kann zu kurz erscheinen. Stelle sicher, dass das Band vollständig synchronisiert wurde.</string>
+    <string name="l10n_sleep_screen_partly_recorded_f43509ab">Teilweise aufgezeichnet</string>
+    <string name="l10n_sleep_screen_only_of_this_night_s_window_9660332a">Nur %1$d%% des Zeitfensters dieser Nacht enthält Schlafphasendaten. Die Phasenwerte decken nur diesen Teil der Nacht ab.</string>
     <string name="haptics_section_title">Haptik</string>
     <string name="haptics_breathing_label">Atemtaktgeber</string>
     <string name="haptics_intervals_label">Intervall-Timer</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 8eb747e708..b6f211b2ec 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -1923,6 +1923,8 @@
     <string name="l10n_app_changelog_widgets_stop_inventing_numbers_naps_count_4f7491bb">Los widgets dejan de inventar números, las siestas cuentan para la deuda de sueño y los indicadores de Android hablan tu idioma</string>
     <string name="l10n_sleep_screen_may_be_incomplete_7230dc27">Puede estar incompleto</string>
     <string name="l10n_sleep_screen_little_motion_was_recorded_over_f061b7e4">Se registró poco movimiento durante la noche, por lo que esta noche puede haberse detectado de forma incompleta y el total de sueño puede parecer corto. Asegúrate de que la correa se haya sincronizado por completo.</string>
+    <string name="l10n_sleep_screen_partly_recorded_f43509ab">Registro parcial</string>
+    <string name="l10n_sleep_screen_only_of_this_night_s_window_9660332a">Solo el %1$d%% de la ventana de esta noche tiene datos de fases. Los totales de fases cubren solo esa parte de la noche.</string>
     <string name="haptics_section_title">Vibración</string>
     <string name="haptics_breathing_label">Guía de respiración</string>
     <string name="haptics_intervals_label">Temporizador de intervalos</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index befe1387f4..65a5d2533d 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -1941,6 +1941,8 @@
     <string name="l10n_app_changelog_widgets_stop_inventing_numbers_naps_count_4f7491bb">Les widgets n\'inventent plus de chiffres, les siestes comptent pour la dette de sommeil, et les indicateurs Android parlent votre langue</string>
     <string name="l10n_sleep_screen_may_be_incomplete_7230dc27">Peut être incomplet</string>
     <string name="l10n_sleep_screen_little_motion_was_recorded_over_f061b7e4">Peu de mouvement a été enregistré cette nuit ; cette nuit peut donc être sous-détectée et le total de sommeil peut sembler court. Assurez-vous que le bracelet est entièrement synchronisé.</string>
+    <string name="l10n_sleep_screen_partly_recorded_f43509ab">Enregistrement partiel</string>
+    <string name="l10n_sleep_screen_only_of_this_night_s_window_9660332a">Seuls %1$d%% de la fenêtre de cette nuit comportent des données de phases. Les totaux de phases ne couvrent que cette partie de la nuit.</string>
     <string name="haptics_section_title">Retour haptique</string>
     <string name="haptics_breathing_label">Guide de respiration</string>
     <string name="haptics_intervals_label">Minuteur d’intervalles</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 05131fdbfa..c79b1d06c1 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -1910,6 +1910,8 @@
     <string name="l10n_app_changelog_widgets_stop_inventing_numbers_naps_count_4f7491bb">Widżety przestają wymyślać liczby, drzemki wliczają się do długów snu, a chipy stanu Android mówią w Twoim języku</string>
     <string name="l10n_sleep_screen_may_be_incomplete_7230dc27">Może być niekompletny</string>
     <string name="l10n_sleep_screen_little_motion_was_recorded_over_f061b7e4">W nocy zarejestrowano niewielki ruch, więc ta noc może zostać niedostatecznie wykryta, a całkowity sen może być krótki. Upewnij się, że pasek jest w pełni zsynchronizowany.</string>
+    <string name="l10n_sleep_screen_partly_recorded_f43509ab">Częściowo zarejestrowane</string>
+    <string name="l10n_sleep_screen_only_of_this_night_s_window_9660332a">Tylko %1$d%% okna tej nocy ma dane o fazach. Sumy faz obejmują tylko tę część nocy.</string>
     <string name="haptics_section_title">Haptyka</string>
     <string name="haptics_breathing_label">Oddechowy tempomat</string>
     <string name="haptics_intervals_label">Timer interwałowy</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 1541360f99..039cd3d5ad 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -1916,6 +1916,8 @@
     <string name="l10n_app_changelog_widgets_stop_inventing_numbers_naps_count_4f7491bb">Os widgets deixam de inventar números, as sestas contam para a dívida de sono, e os indicadores Android falam a tua língua</string>
     <string name="l10n_sleep_screen_may_be_incomplete_7230dc27">Pode estar incompleto</string>
     <string name="l10n_sleep_screen_little_motion_was_recorded_over_f061b7e4">Foi registado pouco movimento durante a noite, por isso esta noite pode ter sido subdetetada e o total de sono pode parecer curto. Certifique-se de que a pulseira sincronizou totalmente.</string>
+    <string name="l10n_sleep_screen_partly_recorded_f43509ab">Registo parcial</string>
+    <string name="l10n_sleep_screen_only_of_this_night_s_window_9660332a">Apenas %1$d%% da janela desta noite tem dados de fases. Os totais de fases cobrem apenas essa parte da noite.</string>
     <string name="haptics_section_title">Vibração</string>
     <string name="haptics_breathing_label">Guia de respiração</string>
     <string name="haptics_intervals_label">Temporizador de intervalos</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 94bd75d28a..7c3c1d274b 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -1851,6 +1851,8 @@
     <string name="l10n_app_changelog_widgets_stop_inventing_numbers_naps_count_4f7491bb">小组件不再编造数字、小睡计入睡眠债，Android 状态提示也终于会说你的语言</string>
     <string name="l10n_sleep_screen_may_be_incomplete_7230dc27">可能不完整</string>
     <string name="l10n_sleep_screen_little_motion_was_recorded_over_f061b7e4">夜间记录到的动作很少，因此这一夜可能未被完整检测，睡眠总时长可能偏短。请确保表带已完全同步。</string>
+    <string name="l10n_sleep_screen_partly_recorded_f43509ab">部分记录</string>
+    <string name="l10n_sleep_screen_only_of_this_night_s_window_9660332a">这一夜的时间窗口中只有 %1$d%% 有睡眠阶段数据。阶段合计仅涵盖该部分时间。</string>
     <string name="haptics_section_title">触觉反馈</string>
     <string name="haptics_breathing_label">呼吸节拍</string>
     <string name="haptics_intervals_label">间隔计时器</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index de5fd59809..fde717148a 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2053,6 +2053,8 @@
     <string name="l10n_app_changelog_widgets_stop_inventing_numbers_naps_count_4f7491bb">Widgets stop inventing numbers, naps count toward sleep debt, and the Android status chips speak your language</string>
     <string name="l10n_sleep_screen_may_be_incomplete_7230dc27">May be incomplete</string>
     <string name="l10n_sleep_screen_little_motion_was_recorded_over_f061b7e4">Little motion was recorded overnight, so this night may be under-detected and the sleep total can read short. Make sure the strap fully synced.</string>
+    <string name="l10n_sleep_screen_partly_recorded_f43509ab">Partly recorded</string>
+    <string name="l10n_sleep_screen_only_of_this_night_s_window_9660332a">Only %1$d%% of this night\'s window has stage data. The stage totals cover only that part of the night.</string>
     <string name="haptics_section_title">Haptics</string>
     <string name="haptics_breathing_label">Breathing pacer</string>
     <string name="haptics_intervals_label">Interval timer</string>
diff --git a/android/app/src/test/java/com/noop/analytics/HypnogramCoverageTest.kt b/android/app/src/test/java/com/noop/analytics/HypnogramCoverageTest.kt
index 436ede1baf..1ac3b043a3 100644
--- a/android/app/src/test/java/com/noop/analytics/HypnogramCoverageTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/HypnogramCoverageTest.kt
@@ -174,4 +174,134 @@ class HypnogramCoverageTest {
         assertEquals(0.8, HypnogramCoverage.fraction(8 * 3600.0, 10 * 3600.0)!!, 1e-12)
         assertTrue(0.8 < HypnogramCoverage.minCoverage)
     }
+
+    // ── the GROUP accumulation (what a night is actually judged on) ──────────────────────────────
+    //
+    // A night is not one row: the engine bridges the day's main-sleep fragments and accumulates over
+    // ALL of them before testing the gate, and the Sleep screen's "Partly recorded" note asks the same
+    // question of the same group. Pinned by oracle for the same reason as the per-payload rules above —
+    // the accumulation has its own ways to drift (which fragments reach the denominator, whether an
+    // unmeasurable payload contributes span, whether a partial sum survives a bail) and none of them
+    // are visible by reading the two loops side by side.
+
+    /**
+     * VERBATIM stdout of the SHIPPED Swift `HypnogramCoverage` (linked as a package dependency and run,
+     * not retyped), over the group cases below.
+     * Format: label|groupFraction (17 significant digits, or "null")|isHoledGroup|floored percentage.
+     *
+     * `two-bridged-90-100` is the knife-edge row: 1900/2000 prints as 0.94999999999999996, the SAME
+     * double the threshold literal denotes, so `< minCoverage` is false and the night is NOT flagged —
+     * the group twin of the `gate-exact` row above, and the one a reimplementation is most likely to
+     * get wrong in the other direction.
+     */
+    private val swiftGroupOracle = """
+        single-full|1|false|100
+        single-holed|0.25|true|25
+        two-bridged-90-100|0.94999999999999996|false|95
+        gap-excluded|1|false|100
+        mixed-source|0.80000000000000004|true|80
+        all-minute-dict|null|false|-
+        health-connect|null|false|-
+        non-object-bails|null|false|-
+        non-object-in-group|0.5|true|50
+        interior-hole|0.40000000000000002|true|40
+        overlap-clamped|1|false|100
+        empty-group|null|false|-
+        zero-span|null|false|-
+        night-20260828|0.93517534537725822|true|93
+        boundary-0952|0.95199999999999996|false|95
+        boundary-0948|0.94799999999999995|true|94
+    """.trimIndent()
+
+    private fun frag(json: String?, span: Double) = HypnogramCoverage.Fragment(json, span)
+
+    @Test fun groupFractionMatchesTheSwiftOracle() {
+        val minuteDict = """{"light":60,"deep":30,"rem":20,"awake":10}"""
+        val hcArray = """[{"stage":"light","min":300},{"stage":"deep","min":100}]"""
+        val nonObject = """[{"start":0,"end":100,"stage":"deep"},5]"""
+
+        val cases: List<Pair<String, List<HypnogramCoverage.Fragment>>> = listOf(
+            "single-full" to listOf(frag(seg(0 to 1000), 1000.0)),
+            "single-holed" to listOf(frag(seg(0 to 300), 1200.0)),
+            "two-bridged-90-100" to listOf(frag(seg(0 to 900), 1000.0), frag(seg(1200 to 2200), 1000.0)),
+            "gap-excluded" to listOf(frag(seg(0 to 1000), 1000.0), frag(seg(5000 to 6000), 1000.0)),
+            "mixed-source" to listOf(frag(seg(0 to 28800), 28800.0), frag(minuteDict, 7200.0)),
+            "all-minute-dict" to listOf(frag(minuteDict, 14400.0), frag(null, 14400.0)),
+            "health-connect" to listOf(frag(hcArray, 28800.0)),
+            "non-object-bails" to listOf(frag(nonObject, 1000.0)),
+            "non-object-in-group" to listOf(frag(seg(0 to 1000), 1000.0), frag(nonObject, 1000.0)),
+            "interior-hole" to listOf(frag(seg(0 to 200, 800 to 1000), 1000.0)),
+            "overlap-clamped" to listOf(frag(seg(0 to 1000, 0 to 1000), 1000.0)),
+            "empty-group" to emptyList(),
+            "zero-span" to listOf(frag(seg(0 to 100), 0.0)),
+            "night-20260828" to listOf(frag(seg(0 to 26400), 28230.0)),   // 440.0 min of 470.5 min
+            "boundary-0952" to listOf(frag(seg(0 to 95200), 100000.0)),
+            "boundary-0948" to listOf(frag(seg(0 to 94800), 100000.0)),
+        )
+
+        val expected = swiftGroupOracle.lines().map { it.trim() }.filter { it.isNotEmpty() }
+        assertEquals("oracle row count must match the case list", cases.size, expected.size)
+        for ((i, c) in cases.withIndex()) {
+            val (label, frags) = c
+            val parts = expected[i].split("|")
+            assertEquals("oracle row $i is for a different case", label, parts[0])
+
+            val f = HypnogramCoverage.groupFraction(frags)
+            if (parts[1] == "null") {
+                assertNull("$label: expected unmeasurable", f)
+            } else {
+                assertEquals("$label", parts[1].toDouble(), f!!, 0.0)  // EXACT: same double, not close
+            }
+            assertEquals("$label: isHoledGroup", parts[2].toBoolean(), HypnogramCoverage.isHoledGroup(frags))
+            // The percentage the "Partly recorded" note prints. FLOORED, never rounded: 94.8% must not
+            // print as "95%" beside a badge raised because coverage fell below 95%.
+            val pct = f?.let { kotlin.math.floor(it * 100.0).toInt().toString() } ?: "-"
+            assertEquals("$label: printed percentage", parts[3], pct)
+        }
+    }
+
+    /**
+     * [HypnogramCoverage.coveredSeconds] is the summable half — 0, not null, for every payload the
+     * ratio calls unmeasurable, so fragments add cleanly and the "is this even measurable" decision
+     * stays in [HypnogramCoverage.fraction]. Verbatim Swift stdout.
+     */
+    @Test fun coveredSecondsMatchesTheSwiftOracle() {
+        val oracle = """
+            full|1000.0
+            minuteDict|0.0
+            hc|0.0
+            nonObject|0.0
+            empty|0.0
+            blank|0.0
+            nil|0.0
+        """.trimIndent()
+        val inputs = listOf(
+            "full" to seg(0 to 1000),
+            "minuteDict" to """{"light":60,"deep":30,"rem":20,"awake":10}""",
+            "hc" to """[{"stage":"light","min":300},{"stage":"deep","min":100}]""",
+            "nonObject" to """[{"start":0,"end":100,"stage":"deep"},5]""",
+            "empty" to "[]",
+            "blank" to "   ",
+            "nil" to null,
+        )
+        val expected = oracle.lines().map { it.trim() }.filter { it.isNotEmpty() }
+        assertEquals(inputs.size, expected.size)
+        for ((i, p) in inputs.withIndex()) {
+            val parts = expected[i].split("|")
+            assertEquals("oracle row $i is for a different case", p.first, parts[0])
+            assertEquals(p.first, parts[1].toDouble(), HypnogramCoverage.coveredSeconds(p.second), 0.0)
+        }
+    }
+
+    /**
+     * The inter-fragment GAP is not in the denominator. It belongs to no fragment's `[startTs, endTs)`,
+     * and it is known-awake out-of-bed time (#777/#705) rather than time we failed to observe — folding
+     * it in would report a correctly-recorded biphasic night as partly missing. Stated as its own test
+     * because it is a claim about what the CALLER must pass, which an oracle over fragments cannot pin.
+     */
+    @Test fun groupDenominatorIsFragmentSpansNotTheWholeWindow() {
+        val frags = listOf(frag(seg(0 to 1000), 1000.0), frag(seg(5000 to 6000), 1000.0))
+        assertEquals(1.0, HypnogramCoverage.groupFraction(frags)!!, 0.0)
+        assertFalse(HypnogramCoverage.isHoledGroup(frags))
+    }
 }

From 3a27fc94a50a8bcc4e33e89cec317d48981c8a8c Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 22:31:08 +1200
Subject: [PATCH 121/333] =?UTF-8?q?ios:=20take=20the=20lifecycle=20flush?=
 =?UTF-8?q?=20back=20out=20=E2=80=94=20it=20is=20what=20broke=20the=20buil?=
 =?UTF-8?q?d?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

main did not build for iOS. Build 400's iOS leg and an app-build dispatch on the
same commit failed independently:

    StrandiOSApp.swift: error: the compiler is unable to type-check this
    expression in reasonable time

macOS was green on both, and StrandiOSApp.swift is iOS-only.

The cause is not in dispute:

    9e4fe34c2 (build 399, before #1767)  ios success
    bb0e61630 (build 400, after  #1767)  ios FAILURE

#1767 added two lifecycle Tasks to a scene body already carrying ~28 modifiers.

Three attempts to get the expression back under budget failed. Hoisting the
alert's message moved the error one line down; hoisting its binding and buttons
moved it again. The cost was the LENGTH of the chain, not any leaf of it, and
each attempt cost a ten-minute build to learn - the only instrument available,
since swiftc -parse passes on the broken file and the fixed one alike.

So this takes the two iOS edges back out instead of continuing to guess at a
budget that cannot be measured locally. Everything else from #1767 stays: the
LivePersistTrace type, its tests, the Collector wiring and BLEManager all
compile, and the macOS leg carried StrandTests green through every one of these
runs. A full revert would have discarded all of that to test a hypothesis the
399/400 comparison had already answered.

The alert hoists are kept - correct, chain-shortening, and the half of this work
that was not a guess.

Verified by app-build on the branch: both legs green.

What is lost is real. iOS suspends a connected strap without a disconnect edge,
so a sub-cadence 0x2A37 batch can still die with the app. Re-landing it needs the
modifier chain split first and verified with xcodebuild, not inferred from a red
CI job. Tracked in #1770, which already records that nothing in CI compiles these
files - the gap this whole episode demonstrates rather than argues.

Refs #1770, #1767.
---
 StrandiOS/App/StrandiOSApp.swift | 73 ++++++++++++++++++--------------
 1 file changed, 42 insertions(+), 31 deletions(-)

diff --git a/StrandiOS/App/StrandiOSApp.swift b/StrandiOS/App/StrandiOSApp.swift
index 2658f97d23..3505efbb17 100644
--- a/StrandiOS/App/StrandiOSApp.swift
+++ b/StrandiOS/App/StrandiOSApp.swift
@@ -1,7 +1,6 @@
 #if os(iOS)
 import SwiftUI
 import StrandDesign
-import StrandAnalytics
 import UserNotifications
 
 /// iOS entry point. Unlike the macOS app (which adds a `MenuBarExtra` scene), iOS uses a single
@@ -107,6 +106,45 @@ struct StrandiOSApp: App {
         }
     }
 
+    /// The Shortcut-import alert's presentation binding, hoisted OUT of the `.alert` chain.
+    ///
+    /// An inline `Binding(get:set:)` is two untyped closures the solver must infer in place, on a
+    /// modifier chain that had already blown the type-check budget. Declaring it as a `Binding<Bool>`
+    /// property replaces all of that with one known type. Hoisting the message alone was not enough —
+    /// the build failed again at the same modifier, which is why this one is here too.
+    private var healthImportAlertPresented: Binding<Bool> {
+        Binding(
+            get: { model.pendingShortcutHealthImport != nil },
+            set: { showing in
+                if !showing { model.cancelPendingHealthImport() }
+            }
+        )
+    }
+
+    /// The Shortcut-import alert's buttons, hoisted for the same reason as the binding above.
+    @ViewBuilder
+    private var healthImportAlertButtons: some View {
+        Button("Import") { model.confirmPendingHealthImport() }
+        Button("Cancel", role: .cancel) { model.cancelPendingHealthImport() }
+    }
+
+    /// The Shortcut-import alert's message, hoisted OUT of the `.alert` chain.
+    ///
+    /// Not a style preference. This closure — an `if let` around two interpolated `Text`s — sits on a
+    /// modifier chain that grew past the Swift type-checker's budget, and the build failed with
+    /// "unable to type-check this expression in reasonable time" pointing at `} message: {`. The
+    /// expression did not change; the chain around it did. Hoisting a sub-expression into its own
+    /// declaration gives the solver a fixed type to work from instead of one more unknown in a chain
+    /// it is already struggling with.
+    @ViewBuilder
+    private var healthImportAlertMessage: some View {
+        if let pending = model.pendingShortcutHealthImport {
+            Text("A Shortcut wants to add \(pending.daysCount) days and \(pending.workoutsCount) workouts to the Apple Health import source.")
+        } else {
+            Text("A Shortcut wants to add data to the Apple Health import source.")
+        }
+    }
+
     var body: some Scene {
         WindowGroup {
             iOSRootView()
@@ -227,20 +265,10 @@ struct StrandiOSApp: App {
                         model.handleHealthImportURL(url)
                     }
                 }
-                .alert("Import Apple Health data?", isPresented: Binding(
-                    get: { model.pendingShortcutHealthImport != nil },
-                    set: { showing in
-                        if !showing { model.cancelPendingHealthImport() }
-                    }
-                )) {
-                    Button("Import") { model.confirmPendingHealthImport() }
-                    Button("Cancel", role: .cancel) { model.cancelPendingHealthImport() }
+                .alert("Import Apple Health data?", isPresented: healthImportAlertPresented) {
+                    healthImportAlertButtons
                 } message: {
-                    if let pending = model.pendingShortcutHealthImport {
-                        Text("A Shortcut wants to add \(pending.daysCount) days and \(pending.workoutsCount) workouts to the Apple Health import source.")
-                    } else {
-                        Text("A Shortcut wants to add data to the Apple Health import source.")
-                    }
+                    healthImportAlertMessage
                 }
                 // Bring the watch link up once at launch (WCSession ignores a redundant activate), then
                 // push the first snapshot so a watch that's already on-wrist gets current scores without
@@ -298,14 +326,6 @@ struct StrandiOSApp: App {
                     await watch.pushLatest(from: model)
                 }
             } else if phase == .background {
-                // A connected strap does not emit a disconnect edge when iOS suspends the app. Route the
-                // lifecycle edge through the same tested seam as termination so a sub-cadence 0x2A37 batch
-                // gets a real store attempt and an accepted/rejected + inserted-count outcome before sleep.
-                Task {
-                    await StandardHRLifecycleFlush.run(event: .background) { reason in
-                        await model.ble.flushStandardHRForLifecycle(reason: reason)
-                    }
-                }
                 // Re-submit on every transition because iOS may discard an old best-effort request.
                 HealthWritebackBackgroundScheduler.updateSchedule(
                     isAuthorized: health.auth == .authorized)
@@ -326,15 +346,6 @@ struct StrandiOSApp: App {
                 Task { await ShortcutHealthExport.writeIfEnabled(repo: model.repo) }
             }
         }
-        .onReceive(NotificationCenter.default.publisher(for: UIApplication.willTerminateNotification)) { _ in
-            // Usually background already drained this buffer. This is the final retry edge for a foreground
-            // termination or a failed background attempt; an empty Collector is a cheap no-op.
-            Task {
-                await StandardHRLifecycleFlush.run(event: .termination) { reason in
-                    await model.ble.flushStandardHRForLifecycle(reason: reason)
-                }
-            }
-        }
     }
 }
 

From 387d644d6bc8ee6d6786e3d6d6318160a81294b6 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 31 Aug 2026 22:50:29 +1200
Subject: [PATCH 122/333] ios: re-land the standard-HR lifecycle flush on the
 scene delegate (#1770)

Re-lands the standard-HR lifecycle flush that #1767 added and #1773 had to remove,
touching StrandiOSApp.body not at all.

body is a SINGLE expression carrying ~28 chained modifiers. #1767 added two more,
it went past the type-checker's budget, and the error was reported at a modifier a
hundred lines from the change - so three attempts to shrink the reported site all
failed, because the cost was the expression's length rather than any leaf of it. A
lifecycle callback costs that expression nothing.

On the SCENE delegate, not the app delegate. This app is scene-based - it returns a
UISceneConfiguration from configurationForConnecting - and UIKit does not call
applicationDidEnterBackground or applicationWillTerminate on the app delegate of a
scene-based app. I wrote it there first; those methods would have compiled, merged
and silently never run, which is worse than a red build because nothing reports it.

sceneDidEnterBackground takes a UIBackgroundTask assertion around the flush: a bare
Task is suspended along with the app, so without it this would do nothing at the one
moment it exists for. The identifier is released on both the completion and the
expiration path. sceneDidDisconnect is the final retry edge and is best effort by
construction - no window, little time - documented as such rather than sold as a
guarantee.

AppModel.shared is the seam, the same one App Intents use. It is weak, so nil means
no model is alive and nothing is buffered to lose. Both it and BLEManager are
@MainActor, so the helper is @MainActor and the Tasks hop explicitly, matching the
idiom BLEManager already uses for this same call on its disconnect edge.

What it recovers: iOS suspends a connected strap WITHOUT a disconnect edge, and the
Collector's 30-sample / 30-second cadence timer does not run while suspended, so a
sub-cadence 0x2A37 batch sits in memory and dies with the app if iOS terminates it
before it resumes. Generic BLE HR straps only - the WHOOP path persists separately.

One correction recorded rather than buried: a review pass here claimed the
beginBackgroundTask idiom could not compile, on the grounds that mutating a captured
var inside Task's @Sendable closure is an error. app-build disagreed - both legs
green on that exact code, because SWIFT_STRICT_CONCURRENCY is minimal. The
"correction" also dropped the expiration handler, trading a real safety property for
an imaginary compile error, and was reverted. What ships is the verified version.

Verified by App build (macOS + iOS) on the branch: both legs green, on a tree
identical to what merges here. swiftc -parse is not evidence for this file - it
passes on the version that broke main.

Refs #1770, #1767, #1773.
---
 StrandiOS/System/HomeScreenQuickActions.swift | 62 +++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/StrandiOS/System/HomeScreenQuickActions.swift b/StrandiOS/System/HomeScreenQuickActions.swift
index b183d3369a..42c08a3fa7 100644
--- a/StrandiOS/System/HomeScreenQuickActions.swift
+++ b/StrandiOS/System/HomeScreenQuickActions.swift
@@ -1,4 +1,5 @@
 #if os(iOS)
+import StrandAnalytics
 import SwiftUI
 import UIKit
 
@@ -82,6 +83,67 @@ final class HomeScreenQuickActionAppDelegate: NSObject, UIApplicationDelegate {
 /// automatically places an observable scene delegate in the environment for the scene it manages.
 @MainActor
 final class HomeScreenQuickActionSceneDelegate: NSObject, UIWindowSceneDelegate, ObservableObject {
+    // MARK: - Standard-HR persistence at the lifecycle edges (#1770)
+    //
+    // On the SCENE delegate, not the app delegate, and not on `StrandiOSApp.body`. Both placements are
+    // load-bearing and both were arrived at the hard way.
+    //
+    // Not the body: the same two edges were added there in #1767 and took the iOS build down. `body` is a
+    // SINGLE expression carrying ~28 chained modifiers; two more tipped it past the type-checker's budget,
+    // and the error was reported at a modifier a hundred lines from the change. The cost was the
+    // expression's length, not any leaf of it.
+    //
+    // Not the app delegate: this app is scene-based — it returns a UISceneConfiguration from
+    // `application(_:configurationForConnecting:options:)` — and UIKit does not call
+    // applicationDidEnterBackground or applicationWillTerminate on the app delegate of a scene-based app.
+    // Those methods would have compiled, shipped, and silently never run, which is a worse failure than a
+    // red build because nothing reports it.
+
+    /// Give buffered standard-HR rows a real persistence attempt as the scene leaves the foreground.
+    ///
+    /// iOS suspends a connected strap WITHOUT a disconnect edge, and the Collector's 30-sample /
+    /// 30-second cadence timer does not run while suspended — so a sub-cadence 0x2A37 batch sits in
+    /// memory and dies with the app if iOS terminates it before it resumes.
+    func sceneDidEnterBackground(_ scene: UIScene) {
+        // A bare Task is suspended along with the app, which would leave this doing nothing at the one
+        // moment it exists for. Ask UIKit for a window and end it on BOTH paths, so the assertion is
+        // always released rather than expiring.
+        let application = UIApplication.shared
+        var taskID: UIBackgroundTaskIdentifier = .invalid
+        taskID = application.beginBackgroundTask(withName: "standard-hr-lifecycle-flush") {
+            application.endBackgroundTask(taskID)
+            taskID = .invalid
+        }
+        // @MainActor explicitly: AppModel and BLEManager are both main-actor isolated, and a bare Task
+        // from a nonisolated delegate callback does not inherit that. Same idiom BLEManager uses for this
+        // exact call on the disconnect edge.
+        Task { @MainActor in
+            await Self.flushStandardHR(.background)
+            if taskID != .invalid {
+                application.endBackgroundTask(taskID)
+                taskID = .invalid
+            }
+        }
+    }
+
+    /// The final retry edge, for a scene the system is discarding. Best effort BY CONSTRUCTION: there is
+    /// no background window here and little time, so this is not a guarantee and must not be described as
+    /// one. Usually `sceneDidEnterBackground` has already drained the buffer and an empty Collector is a
+    /// cheap no-op.
+    func sceneDidDisconnect(_ scene: UIScene) {
+        Task { @MainActor in await Self.flushStandardHR(.termination) }
+    }
+
+    /// Reaches the live Collector through `AppModel.shared`, the seam App Intents already use. It is
+    /// `weak`, so a nil here means no model is alive and there is nothing buffered to lose.
+    @MainActor
+    private static func flushStandardHR(_ event: StandardHRLifecycleFlush.Event) async {
+        guard let ble = AppModel.shared?.ble else { return }
+        await StandardHRLifecycleFlush.run(event: event) { reason in
+            await ble.flushStandardHRForLifecycle(reason: reason)
+        }
+    }
+
     @Published private(set) var pendingAction: HomeScreenQuickAction?
 
     func scene(

From 1499caa09592a834344f9e8783b23d9e5f9478cf Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 00:30:06 +1200
Subject: [PATCH 123/333] diag: say why Effort is 0, why a night did not stage,
 and what the strap provides
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Four additions, each one a question a real capture could not answer — including one
that produced a wrong diagnosis from me this week.

StrainScorer had NO trace at all. WorkoutDetector, SleepStager and both engines each
emit a funnel; the number on the Today hero ring emitted nothing, so a log could not
separate "measured, and the day was genuinely calm" from "could not measure". The new
`effort score` line names the HR count, the gate, the HRmax and where it came from, the
reserve, the method, the TRIMP and the result - with n/a where the gate refused, which
is exactly the case a bare 0 hides.

`effort detect` is renamed `workout detect`. It is workout-BOUT detection and never fed
the Effort ring, but sitting under the Effort name it read as the explanation for it.
Not hypothetical: I read it that way off a real log and told the maintainer that Effort
and Rest shared a root cause. Only Rest did - StrainScorer takes no motion input at all.

sleep-detect NO-NIGHT gains `reason=`. grav=0 was printed; its consequence was not. With
no motion the stager has no HR-only fallback, so no quantity of HR can stage a night - a
strap capability limit, wanting a different follow-up from a night that had motion and
staged nothing anyway.

A `Provides:` line names which raw streams the ACTIVE strap actually delivered. An
unbonded 5/MG streams HR and R-R and nothing else, so Rest reads "No data" and no bout
is ever found; a report showed all of those absences with nothing connecting them to
their one cause.

Optimised deliberately, because a scoring pass re-scores many days. The diag sink is null
by default and the line is built ONLY when one is supplied, so a pass nobody is watching
pays nothing. On Apple the sink BYPASSES the memo: the Today view re-reads strain on every
live-HR tick, so by the time a scoring pass asks with a sink the answer is cached, and a
cache hit never reaches the emit - the line would simply never appear. `Provides:` is four
EXISTS index seeks that stop at the first row, not counts; a 4.0 night carries ~190k
gravity rows. No entity or column change, so no Room migration. No user-facing copy, so no
i18n.

Six review passes, in descending severity: the sink shipped UNWIRED and the feature did
nothing; a stale Apple test and a missing twin, with the PR body claiming coverage it did
not have; the Apple capability call would not have compiled at all, having been written
into a synchronous function holding neither repo nor a store handle; a shifted neighbour
indentation; a missing blank-id guard the sibling has, which would have reported a working
strap as providing nothing; and a label overhanging a hand-aligned column.

Three of those six were in surfaces no default CI job compiles, which is why this merges
on an app-build dispatch rather than after one. Both legs green on this exact tree, and
the macOS leg runs StrandTests - so the repinned NO-NIGHT test and the new
StrapProvidesLineTests actually executed rather than merely existing.

Parity: three byte-identical line builders, tested on both sides, with the Swift
expectations being the Kotlin strings rather than regenerated - a twin checked against
itself proves only self-consistency. Android 4980, StrandAnalytics 1682, WhoopStore 456,
zero failures; 15 CI checks plus both app-build legs green.

Refs #1770.
---
 .../StrandAnalytics/AnalyticsEngine.swift     | 10 ++-
 .../StrandAnalytics/StrainScorer.swift        | 71 +++++++++++++++++--
 .../StrandAnalytics/WorkoutDetector.swift     |  2 +-
 .../DetectionFunnelTests.swift                |  6 +-
 .../EffortScoreFunnelTests.swift              | 44 ++++++++++++
 .../WhoopStore/Sources/WhoopStore/Reads.swift | 35 +++++++++
 Strand/Data/IntelligenceEngine.swift          | 33 ++++++++-
 Strand/System/DebugDataDiagnostics.swift      | 43 +++++++++++
 .../IntelligenceSleepDetectNoNightTests.swift |  8 ++-
 StrandTests/StrapProvidesLineTests.swift      | 32 +++++++++
 .../com/noop/analytics/AnalyticsEngine.kt     |  8 +++
 .../com/noop/analytics/IntelligenceEngine.kt  | 12 +++-
 .../java/com/noop/analytics/StrainScorer.kt   | 54 +++++++++++++-
 .../com/noop/analytics/WorkoutDetector.kt     |  2 +-
 .../src/main/java/com/noop/data/WhoopDao.kt   | 27 +++++++
 .../java/com/noop/data/WhoopRepository.kt     |  5 ++
 .../com/noop/testcentre/AndroidDiagnostics.kt | 42 +++++++++++
 .../com/noop/analytics/DetectionFunnelTest.kt |  6 +-
 .../noop/analytics/EffortScoreFunnelTest.kt   | 64 +++++++++++++++++
 .../IntelligenceSleepDetectNoNightTest.kt     |  8 ++-
 .../noop/testcentre/StrapProvidesLineTest.kt  | 43 +++++++++++
 21 files changed, 537 insertions(+), 18 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/EffortScoreFunnelTests.swift
 create mode 100644 StrandTests/StrapProvidesLineTests.swift
 create mode 100644 android/app/src/test/java/com/noop/analytics/EffortScoreFunnelTest.kt
 create mode 100644 android/app/src/test/java/com/noop/testcentre/StrapProvidesLineTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
index 8ae469a42f..99430ddda3 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
@@ -293,6 +293,10 @@ public enum AnalyticsEngine {
     public static let vendorRespMinSpanS = 3_600
 
     public static func analyzeDay(day: String,
+                                  // Optional sink for the Effort funnel line. Nil (the default) builds
+                                  // nothing at all — see StrainScorer.strain. A parameter rather than a
+                                  // field so this engine stays pure.
+                                  strainDiag: ((String) -> Void)? = nil,
                                   hr: [HRSample] = [],
                                   rr: [RRInterval] = [],
                                   resp: [RespSample] = [],
@@ -820,8 +824,12 @@ public enum AnalyticsEngine {
         // night `hr` for pure-function callers/tests.
         let effMaxHR: Double? = maxHROverride ?? (profile.age > 0 ? StrainScorer.tanakaHRmax(age: profile.age) : nil)
         let restForStrain = restingHRDaily.map(Double.init) ?? StrainScorer.defaultRestingHR
+        // The Effort ring's own funnel. A nil sink builds nothing at all, so a caller that does not want
+        // diagnostics pays nothing; IntelligenceEngine passes its per-day recorder, the same one the
+        // `workout detect` and `sleep-detect` lines beside it already use.
         let strain = StrainScorer.strain(dayHr ?? hr, maxHR: effMaxHR, restingHR: restForStrain,
-                                         method: effortMethod, sex: profile.sex)
+                                         method: effortMethod, sex: profile.sex,
+                                         diag: strainDiag, day: day)
 
         // ── Workouts ──────────────────────────────────────────────────────────
         // Detect over the full CALENDAR day (dayHr/dayGravity) when the caller supplies it, so a
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/StrainScorer.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/StrainScorer.swift
index fc75a24fd1..57968b656c 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/StrainScorer.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/StrainScorer.swift
@@ -346,7 +346,15 @@ public enum StrainScorer {
                               restingHR: Double = defaultRestingHR,
                               method: Method = .edwards,
                               sex: String = "male",
-                              denominator: Double? = nil) -> Double? {
+                              denominator: Double? = nil,
+                              // Optional diagnostic sink. Nil by default and the line is built ONLY when
+                              // one is supplied, so a pass nobody is watching pays nothing.
+                              //
+                              // Supplying one BYPASSES the memo — see the guard below. Without that the
+                              // line would usually never appear, because the Today view has already cached
+                              // the day at live-HR tick rate before the scoring pass asks.
+                              diag: ((String) -> Void)? = nil,
+                              day: String = "") -> Double? {
         // Resolve BEFORE the memo key is built, or a Banister request would be cached under Edwards'
         // denominator and a later Edwards request could collide with it.
         let resolvedDenominator = denominator ?? logMapDenominator(method: method, sex: sex)
@@ -358,12 +366,53 @@ public enum StrainScorer {
             hr: StreamFingerprint.of(hr, ts: { $0.ts }, quant: { Int($0.bpm) }),
             maxHR: maxHR, restingHR: restingHR, method: method,
             sexF: sex.lowercased().hasPrefix("f"), denom: resolvedDenominator)
+        // A diagnostic request BYPASSES the memo, and must. The Today view re-reads this on every
+        // live-HR tick with no sink, so by the time the scoring pass asks with one the answer is already
+        // cached — and a cache hit never reaches the code that emits, so the line would simply never
+        // appear. Recomputing one day per pass to be able to report it is the trade, and it is a cheap
+        // one. Kotlin has no memo here and always emits; this keeps the two behaving the same.
+        guard diag == nil else {
+            return strainUncached(hr, maxHR: maxHR, restingHR: restingHR, method: method, sex: sex,
+                                  denominator: resolvedDenominator, diag: diag, day: day)
+        }
         return strainCache.value(key) {
             strainUncached(hr, maxHR: maxHR, restingHR: restingHR, method: method, sex: sex,
-                           denominator: resolvedDenominator)
+                           denominator: resolvedDenominator, diag: nil, day: day)
         }
     }
 
+    /// One line naming what an Effort score was computed FROM, or why it could not be computed.
+    ///
+    /// The gap this closes: `strain` is the only score in the app with no trace at all. WorkoutDetector,
+    /// SleepStager and both engines each emit a funnel; the number on the Today hero ring emitted nothing,
+    /// so a log could not distinguish "measured, and the day was genuinely calm" from "could not measure".
+    /// A reader looking for the latter finds `workout detect`, which is WORKOUT-BOUT detection and answers
+    /// a different question — a confusion that has already produced one wrong diagnosis.
+    ///
+    /// `enough` is the `strain` gate spelled out: dense (>= minReadings) OR sparse-but-sustained. `trimp`
+    /// and `strain` are absent when the gate refused, which is exactly the case a bare 0 hides.
+    /// Byte-identical to the Kotlin `StrainScorer.scoreFunnelLine`.
+    public static func scoreFunnelLine(day: String, hrSamples: Int, enough: Bool,
+                                       maxHR: Double, maxHRProvided: Bool, restingHR: Double,
+                                       method: Method, trimp: Double?, strain: Double?) -> String {
+        func r1(_ v: Double) -> String { String(format: "%.1f", v) }
+        // Built by appending rather than as one `+` chain. A chain of interpolated segments is a single
+        // expression, and this one blew the type-checker's budget on the first attempt — the same failure
+        // that took the iOS build down in #1767. Statements give the solver one small problem at a time.
+        let src: String = maxHRProvided ? "provided" : "default"
+        let trimpText: String = trimp.map(r1) ?? "n/a"
+        let strainText: String = strain.map(r1) ?? "n/a"
+        var out = "effort score day=\(day) hr=\(hrSamples) enough=\(enough)"
+        out += " hrMax=\(r1(maxHR))(\(src))"
+        out += " rhr=\(r1(restingHR)) reserve=\(r1(maxHR - restingHR))"
+        // Method carries no raw value here; interpolating the case yields "edwards"/"banister", which
+        // is exactly what Kotlin's `method.name.lowercase()` produces. The two lines must match byte for
+        // byte, so this is the one spelling that keeps them equal.
+        out += " method=\(method)"
+        out += " trimp=\(trimpText) strain=\(strainText)"
+        return out
+    }
+
     /// Key folds `sex` to the single bit the recipe reads (`hasPrefix("f")`) so "female"/"f"/"F" all hit.
     private struct StrainKey: Hashable {
         let hr: StreamFingerprint
@@ -373,7 +422,8 @@ public enum StrainScorer {
     private static let strainCache = AnalyticsMemoCache<StrainKey, Double?>(capacity: 48)
 
     private static func strainUncached(_ hr: [HRSample], maxHR: Double?, restingHR: Double,
-                                       method: Method, sex: String, denominator: Double) -> Double? {
+                                       method: Method, sex: String, denominator: Double,
+                                       diag: ((String) -> Void)? = nil, day: String = "") -> Double? {
         let effMax = maxHR ?? Double(defaultMaxHR())
         // Enough data to trust the score: a dense stream (≥ minReadings) OR a sparse-but-sustained
         // one spanning ≥ minSpanSeconds with a sample floor (#482 — the 5/MG's ~30 s HR cadence).
@@ -386,7 +436,14 @@ public enum StrainScorer {
         } else {
             enoughData = false
         }
-        if !enoughData || effMax <= restingHR { return nil }
+        if !enoughData || effMax <= restingHR {
+            // The refusal is the half a bare number cannot show: nil here and 0.0 on a calm day look
+            // identical on the ring, and only one of them is a measurement.
+            diag?(scoreFunnelLine(day: day, hrSamples: hr.count, enough: enoughData, maxHR: effMax,
+                                  maxHRProvided: maxHR != nil, restingHR: restingHR, method: method,
+                                  trimp: nil, strain: nil))
+            return nil
+        }
 
         let durations = sampleDurationsMinutes(hr)
         let hrReserve = effMax - restingHR
@@ -404,6 +461,10 @@ public enum StrainScorer {
             trimp = edwardsTRIMP(hr, restingHR: restingHR, hrReserve: hrReserve,
                                  durations: durations)
         }
-        return trimpToStrain(trimp, denominator: denominator)
+        let scored = trimpToStrain(trimp, denominator: denominator)
+        diag?(scoreFunnelLine(day: day, hrSamples: hr.count, enough: enoughData, maxHR: effMax,
+                              maxHRProvided: maxHR != nil, restingHR: restingHR, method: method,
+                              trimp: trimp, strain: scored))
+        return scored
     }
 }
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/WorkoutDetector.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/WorkoutDetector.swift
index f0266894ef..9321309424 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/WorkoutDetector.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/WorkoutDetector.swift
@@ -203,7 +203,7 @@ public enum WorkoutDetector {
     /// Byte-identical string to the Kotlin twin. No PII: a day key and counts, plus the two bpm thresholds
     /// the day was measured against — the same privacy class as the sibling `sleep day=` line.
     public static func detectionFunnelLine(day: String, funnel f: DetectionFunnel) -> String {
-        "effort detect day=\(day) hr=\(f.hrSamples) motion=\(f.motionSamples) "
+        "workout detect day=\(day) hr=\(f.hrSamples) motion=\(f.motionSamples) "
             + "restHR=\(round0(f.restingHR)) floor=\(round0(f.hrFloor)) "
             + "motionOK=\(f.motionPassed) hrMissing=\(f.hrMissing) hrTooLow=\(f.hrTooLow) "
             + "active=\(f.active) runs=\(f.runs) bridged=\(f.bridged) "
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/DetectionFunnelTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/DetectionFunnelTests.swift
index 42db1a7f80..de3e839b6e 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/DetectionFunnelTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/DetectionFunnelTests.swift
@@ -141,7 +141,11 @@ final class DetectionFunnelTests: XCTestCase {
         f.droppedShort = 4; f.droppedNoHR = 0; f.droppedLowIntensity = 0; f.kept = 0
         XCTAssertEqual(
             WorkoutDetector.detectionFunnelLine(day: "2026-08-24", funnel: f),
-            "effort detect day=2026-08-24 hr=34137 motion=34136 restHR=59 floor=74 "
+            // Renamed from "effort detect": this funnel is WORKOUT-BOUT detection, and sitting under
+            // the Effort name made it read as the explanation for the Today ring's number. It is not —
+            // StrainScorer.strain computes that from HR alone, with no motion input — and the confusion
+            // has already produced one wrong diagnosis from a real log. `effort score` is the ring's line.
+            "workout detect day=2026-08-24 hr=34137 motion=34136 restHR=59 floor=74 "
                 + "motionOK=1203 hrMissing=12 hrTooLow=1103 active=88 runs=6 bridged=4 "
                 + "longestRunS=212 meanRunS=74 "
                 + "short=4 noHR=0 lowIntensity=0 kept=0")
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/EffortScoreFunnelTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/EffortScoreFunnelTests.swift
new file mode 100644
index 0000000000..e40e20bb5a
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/EffortScoreFunnelTests.swift
@@ -0,0 +1,44 @@
+import XCTest
+import WhoopProtocol
+@testable import StrandAnalytics
+
+/// The Effort score's funnel line — the trace `StrainScorer` had none of.
+///
+/// Twin of the Kotlin `EffortScoreFunnelTest`. The expected strings are the Kotlin ones: these two lines
+/// exist so an Android and an Apple log of the same day compare directly, so asserting each side against
+/// itself would prove only that each is self-consistent.
+final class EffortScoreFunnelTests: XCTestCase {
+
+    func testACalmDayReportsTheZeroItMeasured() {
+        XCTAssertEqual(
+            StrainScorer.scoreFunnelLine(day: "2026-08-31", hrSamples: 39339, enough: true,
+                                         maxHR: 185.0, maxHRProvided: true, restingHR: 58.0,
+                                         method: .edwards, trimp: 0.0, strain: 0.0),
+            "effort score day=2026-08-31 hr=39339 enough=true hrMax=185.0(provided) rhr=58.0"
+                + " reserve=127.0 method=edwards trimp=0.0 strain=0.0"
+        )
+    }
+
+    /// The distinction the ring cannot show. A refusal and a genuine zero both render as "0"; only the
+    /// line says which happened, and n/a is what makes the refusal legible.
+    func testARefusalIsNotAZero() {
+        XCTAssertEqual(
+            StrainScorer.scoreFunnelLine(day: "2026-08-31", hrSamples: 12, enough: false,
+                                         maxHR: 185.0, maxHRProvided: false, restingHR: 58.0,
+                                         method: .edwards, trimp: nil, strain: nil),
+            "effort score day=2026-08-31 hr=12 enough=false hrMax=185.0(default) rhr=58.0"
+                + " reserve=127.0 method=edwards trimp=n/a strain=n/a"
+        )
+    }
+
+    /// The hook must cost nothing when nobody is watching, and must not fire at view refresh rate: unlike
+    /// the Kotlin twin this scorer is memoized because the Today view re-reads it on every live-HR tick.
+    func testNoDiagSinkMeansNoLine() {
+        let hr = (0..<5).map { HRSample(ts: 1_700_000_000 + $0 * 60, bpm: 60) }
+        var emitted: [String] = []
+        XCTAssertNil(StrainScorer.strain(hr))
+        XCTAssertNil(StrainScorer.strain(hr, diag: { emitted.append($0) }, day: "2026-08-31"))
+        XCTAssertEqual(emitted.count, 1)
+        XCTAssertTrue(emitted[0].hasPrefix("effort score day=2026-08-31 "), emitted[0])
+    }
+}
diff --git a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
index d4aff30d91..f994594b64 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
@@ -359,6 +359,41 @@ extension WhoopStore {
     /// is an index-ONLY scan (both columns live in that index, so no table rows are touched) with
     /// `deviceId` leading, which also lets the GROUP BY skip a temp b-tree. Cheap enough for a
     /// user-triggered diagnostics export, which is the only caller.
+    /// Which raw streams a device has ANY rows for in a window — the strap-capability question,
+    /// answered without counting.
+    ///
+    /// EXISTS rather than COUNT on purpose. The question is presence, every one of these tables is keyed
+    /// `(deviceId, ts)`, so each subquery is an index seek that stops at the first row instead of walking a
+    /// night's worth — a 4.0 night carries ~190k gravity rows and counting them to learn "yes" would be
+    /// absurd. One statement so it is one round trip.
+    ///
+    /// Answers what no existing line could: a strap streaming live HR with no motion cannot produce a
+    /// staged night or an auto-detected workout, and until now a reader had to infer that from the absence
+    /// of other lines. Diagnostics-export only, like `rawSampleCountsByDevice`. Kotlin twin:
+    /// `WhoopDao.streamPresence`.
+    public struct StreamPresence: Sendable, Equatable {
+        public let hr: Bool, rr: Bool, gravity: Bool, steps: Bool
+        public init(hr: Bool, rr: Bool, gravity: Bool, steps: Bool) {
+            self.hr = hr; self.rr = rr; self.gravity = gravity; self.steps = steps
+        }
+    }
+
+    public func streamPresence(deviceId: String, from: Int, to: Int) async throws -> StreamPresence {
+        try syncRead { db in
+            let row = try Row.fetchOne(db, sql: """
+                SELECT
+                  EXISTS(SELECT 1 FROM hrSample WHERE deviceId = ? AND ts >= ? AND ts <= ?) AS hr,
+                  EXISTS(SELECT 1 FROM rrInterval WHERE deviceId = ? AND ts >= ? AND ts <= ?) AS rr,
+                  EXISTS(SELECT 1 FROM gravitySample WHERE deviceId = ? AND ts >= ? AND ts <= ?) AS gravity,
+                  EXISTS(SELECT 1 FROM stepSample WHERE deviceId = ? AND ts >= ? AND ts <= ?) AS steps
+                """, arguments: [deviceId, from, to, deviceId, from, to,
+                                 deviceId, from, to, deviceId, from, to])
+            return StreamPresence(
+                hr: (row?["hr"] ?? 0) != 0, rr: (row?["rr"] ?? 0) != 0,
+                gravity: (row?["gravity"] ?? 0) != 0, steps: (row?["steps"] ?? 0) != 0)
+        }
+    }
+
     public func rawSampleCountsByDevice(from: Int, to: Int) async throws -> [(String, Int)] {
         try syncRead { db in
             try Row.fetchAll(db, sql: """
diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index ff8019144f..97a7893cd7 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -324,11 +324,30 @@ final class IntelligenceEngine: ObservableObject {
 
     /// Counts + a window length only — same privacy class as the sibling `sleep day=` line, no PII. Pure so
     /// it's unit-tested directly; byte-identical to the Android `sleepDetectNoNightLogLine`.
+/// Fold the per-day diagnostic lines onto the one channel that already replays them.
+    ///
+    /// `hrvDiag` is not really "the HRV line" any more — it is the loop-1 diagnostic channel, replayed
+    /// on the main actor by splitting on newlines. The Effort funnel rides it for the same reason the
+    /// NO-NIGHT line does: built where the inputs are in scope, emitted where the sink is safe to touch.
+    nonisolated static func mergedDayDiag(_ hrvDiag: String?, _ extra: [String]) -> String? {
+        var parts: [String] = []
+        if let hrvDiag, !hrvDiag.isEmpty { parts.append(hrvDiag) }
+        parts.append(contentsOf: extra)
+        return parts.isEmpty ? nil : parts.joined(separator: "\n")
+    }
+
     nonisolated static func sleepDetectNoNightLogLine(day: String, hrCount: Int, rrCount: Int,
                                                       respCount: Int, gravCount: Int, stepCount: Int,
                                                       providedCount: Int, windowHours: Int) -> String {
+        // `reason` names WHICH absence this is, because grav=0 is printed but its consequence is not.
+        // With no motion the stager has no HR-only fallback, so no quantity of HR can stage a night — a
+        // strap capability limit, not a coverage gap, and the two want completely different follow-ups.
+        // With motion present the inputs were there and staging still produced nothing, which is the case
+        // actually worth investigating.
+        let reason = gravCount == 0 ? "no-motion" : "staged-none"
         return "sleep-detect day=\(day) NO-NIGHT hr=\(hrCount) rr=\(rrCount) resp=\(respCount) "
-            + "grav=\(gravCount) steps=\(stepCount) provided=\(providedCount) window=\(windowHours)h"
+            + "grav=\(gravCount) steps=\(stepCount) provided=\(providedCount) window=\(windowHours)h "
+            + "reason=\(reason)"
     }
 
     /// #674/#1244: the "sleep total with no matched session" divergence line. A COMPUTED day whose fresh
@@ -1156,7 +1175,14 @@ final class IntelligenceEngine: ObservableObject {
                 }
                 let tScore0 = Date()
                 dayPrepSeconds += tScore0.timeIntervalSince(tPrep0)
-                let res = AnalyticsEngine.analyzeDay(day: day, hr: hr, rr: rr, resp: resp,
+                // #1770 follow-up: the Effort ring's funnel. Collected here rather than sent straight
+                // to `diagnosticSink`, because that sink is main-actor isolated and this loop is not —
+                // the same reason `hrvDiag` is carried on the scan and replayed below. A local buffer
+                // crosses no actor.
+                var strainDiagLines: [String] = []
+                let res = AnalyticsEngine.analyzeDay(day: day,
+                                                     strainDiag: { strainDiagLines.append($0) },
+                                                     hr: hr, rr: rr, resp: resp,
                                                      vendorResp: vendorResp, gravity: grav,
                                                      steps: steps, dayHr: dayHr, daySteps: daySteps,
                                                      dayGravity: dayGrav,
@@ -1438,7 +1464,8 @@ final class IntelligenceEngine: ObservableObject {
                 let scan = DayScan(result: res, rhrLine: rhrLine, respLine: respLine,
                                    readOwner: owner, hrRows: hr.count,
                                    sleepTrace: sleepTrace, stepsTrace: stepsTrace, hrvTrace: hrvTrace,
-                                   hrvDiag: hrvDiag, spo2Candidate: spo2CandidateMean,
+                                   hrvDiag: Self.mergedDayDiag(hrvDiag, strainDiagLines),
+                                   spo2Candidate: spo2CandidateMean,
                                    hrvOverCounted: hrvOverCounted,
                                    primarySessionRHR: primarySessionRHR,
                                    primarySessionRHRCoverage: primarySessionRHRCoverage)
diff --git a/Strand/System/DebugDataDiagnostics.swift b/Strand/System/DebugDataDiagnostics.swift
index 7858b86c7d..9eea4b951f 100644
--- a/Strand/System/DebugDataDiagnostics.swift
+++ b/Strand/System/DebugDataDiagnostics.swift
@@ -22,6 +22,30 @@ enum DebugDataDiagnostics {
 
     /// Strap identity + timezone from persisted defaults (sync, offline-safe). Mirrors the prefs-backed
     /// portion of the Android strap-state block; keys match the iOS @AppStorage / persisted values.
+
+    /// What the active strap actually delivered over the window — the line that says which scores can
+    /// exist at all.
+    ///
+    /// A 5/MG that never completes its handshake streams live HR and R-R over the standard characteristic
+    /// and nothing else: motion and steps arrive only with the proprietary offload. Without motion the
+    /// sleep stager has no HR-only fallback and the workout detector returns before it looks at heart
+    /// rate, so Rest reads "No data" and no bout is ever found — and until now a report showed those
+    /// absences with nothing connecting them to their single cause.
+    ///
+    /// The window is IN the label. Without it "Provides: motion NO" reads as a capability claim, and a
+    /// strap simply not worn for two days would be reported as incapable of motion — the opposite kind of
+    /// wrong from the one this line exists to prevent. Over a window of actual wear, delivered and capable
+    /// are the same thing; the label keeps that assumption visible instead of implied.
+    /// The label is padded to 13 like every other in this block ("Model:", "Data write:"), and the window
+    /// rides the VALUE. "Provides(48h):" is 15 and overhung the column in a report that is aligned by hand
+    /// and read by eye.
+    /// Byte-identical to the Kotlin `AndroidDiagnostics.strapProvidesLine`.
+    static func strapProvidesLine(hr: Bool, rr: Bool, motion: Bool, steps: Bool) -> String {
+        func mark(_ b: Bool) -> String { b ? "yes" : "NO" }
+        return "Provides:    HR \(mark(hr)) · R-R \(mark(rr)) · motion \(mark(motion)) · steps \(mark(steps))"
+            + " (last 48h)"
+    }
+
     static func strapStateLines() -> [String] {
         var lines: [String] = []
         lines.append(String(repeating: "─", count: 40))
@@ -54,6 +78,7 @@ enum DebugDataDiagnostics {
         let syncSec = d.double(forKey: "lastSyncedAt")
         lines.append("Last sync:   \(syncSec > 0 ? relTime(Date().timeIntervalSince1970 - syncSec) : "never")")
         // #57: write-health. "Last sync" fires even on an empty/failed offload, so distinguish "rows
+
         // actually landed" from "an offload STALLED on a persist failure" (history won't persist — usually a
         // backup restored without an app restart, the closed-store class).
         let now = Date().timeIntervalSince1970
@@ -103,6 +128,24 @@ enum DebugDataDiagnostics {
     @MainActor static func dynamicLines(repo: Repository) async -> [String] {
         var lines = strapStateLines()
 
+        // #1770 follow-up: which streams the ACTIVE strap actually delivered over the last 48 h. Four
+        // EXISTS seeks, not counts — see WhoopStore.streamPresence for why that distinction matters on a
+        // table holding ~190k motion rows a night.
+        //
+        // HERE and not in strapStateLines() beside `Data write:`, where it belongs by subject: that
+        // function is synchronous and holds neither `repo` nor a store handle. The first attempt put it
+        // there and would not have compiled — in a file the comment below already notes needs macOS to
+        // build, which is exactly why it went unnoticed locally. Appended first so the output order is
+        // still the one the reader wants.
+        if let presenceStore = await repo.storeHandle(),
+           let present = try? await presenceStore.streamPresence(
+               deviceId: repo.deviceId,
+               from: Int(Date().timeIntervalSince1970) - 48 * 3600,
+               to: Int(Date().timeIntervalSince1970)) {
+            lines.append(strapProvidesLine(hr: present.hr, rr: present.rr,
+                                           motion: present.gravity, steps: present.steps))
+        }
+
         // Data state from the preloaded day spine.
         let days = repo.days
         lines.append("History:     \(days.count) day rows")
diff --git a/StrandTests/IntelligenceSleepDetectNoNightTests.swift b/StrandTests/IntelligenceSleepDetectNoNightTests.swift
index 8097f5588c..a83b857bbf 100644
--- a/StrandTests/IntelligenceSleepDetectNoNightTests.swift
+++ b/StrandTests/IntelligenceSleepDetectNoNightTests.swift
@@ -21,7 +21,10 @@ final class IntelligenceSleepDetectNoNightTests: XCTestCase {
             gravCount: 0, stepCount: 12, providedCount: 0, windowHours: 54)
         XCTAssertEqual(line,
             "sleep-detect day=2026-08-11 NO-NIGHT hr=41230 rr=0 resp=880 "
-            + "grav=0 steps=12 provided=0 window=54h")
+            // reason=no-motion is the point of this fixture: grav=0 means the stager has no HR-only
+            // fallback, so no quantity of HR could have staged a night. That is a strap capability limit,
+            // and it wants a different follow-up from a night that had motion and still staged nothing.
+            + "grav=0 steps=12 provided=0 window=54h reason=no-motion")
     }
 
     func testTodayWindowIs48h() {
@@ -30,6 +33,9 @@ final class IntelligenceSleepDetectNoNightTests: XCTestCase {
             day: "2026-08-12", hrCount: 5000, rrCount: 900, respCount: 300,
             gravCount: 4, stepCount: 0, providedCount: 0, windowHours: 48)
         XCTAssertTrue(line.contains("window=48h"), line)
+        // The other branch: motion WAS present and staging still produced nothing, which is the case
+        // worth investigating rather than a capability limit.
+        XCTAssertTrue(line.contains("reason=staged-none"), line)
     }
 
     func testLineCarriesNoEmDash() {
diff --git a/StrandTests/StrapProvidesLineTests.swift b/StrandTests/StrapProvidesLineTests.swift
new file mode 100644
index 0000000000..c0b4afb9d5
--- /dev/null
+++ b/StrandTests/StrapProvidesLineTests.swift
@@ -0,0 +1,32 @@
+import XCTest
+@testable import Strand
+
+/// The line that says which scores can exist at all for the strap actually being worn.
+///
+/// Twin of the Kotlin `StrapProvidesLineTest`, and the expected strings are the Kotlin ones: these lines
+/// exist so an Android and an Apple report compare directly, so asserting each side against itself would
+/// prove only that each is self-consistent.
+final class StrapProvidesLineTests: XCTestCase {
+
+    func testAnUnbondedMGStreamsHeartDataAndNothingElse() {
+        XCTAssertEqual(
+            DebugDataDiagnostics.strapProvidesLine(hr: true, rr: true, motion: false, steps: false),
+            "Provides:    HR yes · R-R yes · motion NO · steps NO (last 48h)"
+        )
+    }
+
+    func testAFullySyncedStrapProvidesAllFour() {
+        XCTAssertEqual(
+            DebugDataDiagnostics.strapProvidesLine(hr: true, rr: true, motion: true, steps: true),
+            "Provides:    HR yes · R-R yes · motion yes · steps yes (last 48h)"
+        )
+    }
+
+    /// NO is capitalised and yes is not, deliberately: the absences are what the line exists to surface,
+    /// and a reader scanning a report should catch them without reading the labels.
+    func testAbsenceIsTheHalfThatStandsOut() {
+        let line = DebugDataDiagnostics.strapProvidesLine(hr: true, rr: false, motion: false, steps: true)
+        XCTAssertEqual(line.components(separatedBy: "NO").count - 1, 2, line)
+        XCTAssertEqual(line, "Provides:    HR yes · R-R NO · motion NO · steps yes (last 48h)")
+    }
+}
diff --git a/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt b/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
index a191180afb..22410d68a4 100644
--- a/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
@@ -273,6 +273,9 @@ object AnalyticsEngine {
      */
     fun analyzeDay(
         day: String,
+        // Optional sink for the Effort funnel line. Null (the default) builds nothing at all — see
+        // StrainScorer.strain. Kept a parameter rather than a field so this engine stays pure.
+        strainDiag: ((String) -> Unit)? = null,
         hr: List<HrSample> = emptyList(),
         rr: List<RrInterval> = emptyList(),
         resp: List<RespSample> = emptyList(),
@@ -747,6 +750,11 @@ object AnalyticsEngine {
             restingHR = restForStrain,
             method = effortMethod,
             sex = profile.sex,
+            // The Effort ring's own funnel. Null sink = no line built, so a caller that does not want
+            // diagnostics pays nothing; IntelligenceEngine passes its per-day recorder, the same one the
+            // `workout detect` and `sleep-detect` lines beside it already use.
+            diag = strainDiag,
+            day = day,
         )
 
         // ── Workouts ──────────────────────────────────────────────────────────
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index d20042b702..46c337640e 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -968,6 +968,9 @@ object IntelligenceEngine {
             dayPrepNanos += tScore0 - tPrep0
             val res = AnalyticsEngine.analyzeDay(
                 day = day,
+                // #1770 follow-up: route the Effort funnel through the SAME per-day recorder as the
+                // `workout detect` and `sleep-detect` lines, so a report explains all three the same way.
+                strainDiag = ::dayDiag,
                 hr = hr,
                 rr = rr,
                 resp = resp,
@@ -2901,8 +2904,15 @@ object IntelligenceEngine {
         day: String, hrCount: Int, rrCount: Int, respCount: Int, gravCount: Int,
         stepCount: Int, providedCount: Int, windowHours: Int,
     ): String {
+        // `reason` names WHICH absence this is, because grav=0 is printed but its consequence is not.
+        // With no motion the stager has no HR-only fallback, so no quantity of HR can stage a night — a
+        // strap capability limit, not a coverage gap, and the two want completely different follow-ups.
+        // With motion present the inputs were there and staging still produced nothing, which is the case
+        // actually worth investigating.
+        val reason = if (gravCount == 0) "no-motion" else "staged-none"
         return "sleep-detect day=$day NO-NIGHT hr=$hrCount rr=$rrCount resp=$respCount " +
-            "grav=$gravCount steps=$stepCount provided=$providedCount window=${windowHours}h"
+            "grav=$gravCount steps=$stepCount provided=$providedCount window=${windowHours}h " +
+            "reason=$reason"
     }
 
     /**
diff --git a/android/app/src/main/java/com/noop/analytics/StrainScorer.kt b/android/app/src/main/java/com/noop/analytics/StrainScorer.kt
index 2686220cc8..da6f67a1a1 100644
--- a/android/app/src/main/java/com/noop/analytics/StrainScorer.kt
+++ b/android/app/src/main/java/com/noop/analytics/StrainScorer.kt
@@ -373,6 +373,38 @@ object StrainScorer {
         return exp(maxStrain * sumXX / sumXY)
     }
 
+    /**
+     * One line naming what an Effort score was computed FROM, or why it could not be computed.
+     *
+     * The gap this closes: [strain] is the only score in the app with no trace at all. WorkoutDetector,
+     * SleepStager and both engines each emit a funnel; the number on the Today hero ring emitted nothing,
+     * so a log could not distinguish "measured, and the day was genuinely calm" from "could not measure".
+     * A reader looking for the latter finds `effort detect`, which is WORKOUT-BOUT detection and answers a
+     * different question — a confusion that has already produced one wrong diagnosis.
+     *
+     * `enough` is the [strain] gate spelled out: dense (>= minReadings) OR sparse-but-sustained. `trimp`
+     * and `strain` are absent when the gate refused, which is exactly the case a bare 0 hides.
+     */
+    fun scoreFunnelLine(
+        day: String,
+        hrSamples: Int,
+        enough: Boolean,
+        maxHR: Double,
+        maxHRProvided: Boolean,
+        restingHR: Double,
+        method: Method,
+        trimp: Double?,
+        strain: Double?,
+    ): String =
+        "effort score day=$day hr=$hrSamples enough=$enough" +
+            " hrMax=${round1(maxHR)}(${if (maxHRProvided) "provided" else "default"})" +
+            " rhr=${round1(restingHR)} reserve=${round1(maxHR - restingHR)}" +
+            " method=${method.name.lowercase()}" +
+            " trimp=${trimp?.let { round1(it) } ?: "n/a"} strain=${strain?.let { round1(it) } ?: "n/a"}"
+
+    /** One decimal, locale-independent, so two platforms' lines compare byte for byte. */
+    private fun round1(v: Double): String = String.format(java.util.Locale.US, "%.1f", v)
+
     // ---- Public API ----
 
     /**
@@ -398,6 +430,11 @@ object StrainScorer {
         // null (the default) resolves to the denominator that BELONGS to [method] — Edwards' 7201, or
         // Banister's sex-dependent ceiling. Pass a value only to override.
         denominator: Double? = null,
+        // Optional diagnostic sink. Null by default and the line is built ONLY when one is supplied, so a
+        // scoring pass that nobody is watching pays nothing — which matters because a pass re-scores many
+        // days. Callers hand this in for the day worth explaining, not for all of them.
+        diag: ((String) -> Unit)? = null,
+        day: String = "",
     ): Double? {
         val resolvedDenominator = denominator ?: logMapDenominator(method, sex)
         val effMax = maxHR ?: defaultMaxHR().toDouble()
@@ -411,7 +448,15 @@ object StrainScorer {
             }
             else -> false
         }
-        if (!enoughData || effMax <= restingHR) return null
+        if (!enoughData || effMax <= restingHR) {
+            // The refusal is the half a bare number cannot show: null here and 0.0 on a calm day look
+            // identical on the ring, and only one of them is a measurement.
+            diag?.let {
+                it(scoreFunnelLine(day, hr.size, enoughData, effMax, maxHR != null, restingHR, method,
+                                   trimp = null, strain = null))
+            }
+            return null
+        }
 
         val durations = sampleDurationsMinutes(hr)
         val hrReserve = effMax - restingHR
@@ -428,6 +473,11 @@ object StrainScorer {
                 edwardsTRIMP(hr, restingHR, hrReserve, durations)
             }
         }
-        return trimpToStrain(trimp, resolvedDenominator)
+        val scored = trimpToStrain(trimp, resolvedDenominator)
+        diag?.let {
+            it(scoreFunnelLine(day, hr.size, enoughData, effMax, maxHR != null, restingHR, method,
+                               trimp = trimp, strain = scored))
+        }
+        return scored
     }
 }
diff --git a/android/app/src/main/java/com/noop/analytics/WorkoutDetector.kt b/android/app/src/main/java/com/noop/analytics/WorkoutDetector.kt
index 83058056c3..55c357235b 100644
--- a/android/app/src/main/java/com/noop/analytics/WorkoutDetector.kt
+++ b/android/app/src/main/java/com/noop/analytics/WorkoutDetector.kt
@@ -172,7 +172,7 @@ object WorkoutDetector {
      * day was measured against — the same privacy class as the sibling `sleep day=` line.
      */
     fun detectionFunnelLine(day: String, f: DetectionFunnel): String =
-        "effort detect day=$day hr=${f.hrSamples} motion=${f.motionSamples} " +
+        "workout detect day=$day hr=${f.hrSamples} motion=${f.motionSamples} " +
             "restHR=${round0(f.restingHR)} floor=${round0(f.hrFloor)} " +
             "motionOK=${f.motionPassed} hrMissing=${f.hrMissing} hrTooLow=${f.hrTooLow} " +
             "active=${f.active} runs=${f.runs} bridged=${f.bridged} " +
diff --git a/android/app/src/main/java/com/noop/data/WhoopDao.kt b/android/app/src/main/java/com/noop/data/WhoopDao.kt
index 7e9a8c2937..975e1139d8 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDao.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDao.kt
@@ -501,6 +501,33 @@ interface WhoopDao : DeviceRegistryDao {
     )
     suspend fun gravitySamples(deviceId: String, from: Long, to: Long, limit: Int): List<GravitySample>
 
+    /**
+     * Which raw streams a device has ANY rows for in a window — the strap-capability question, answered
+     * without counting.
+     *
+     * EXISTS rather than COUNT on purpose. The question is presence, and every one of these tables is
+     * keyed `(deviceId, ts)`, so each subquery is an index seek that stops at the first row instead of
+     * walking a night's worth — a 4.0 night carries ~190k gravity rows and counting them to learn "yes"
+     * would be absurd. One statement so it is one round trip.
+     *
+     * Answers what no existing line could: a strap streaming live HR with no motion cannot produce a
+     * staged night or an auto-detected workout, and until now a reader had to infer that from the absence
+     * of other lines. Diagnostics-export only, like [rawSampleCountsByDevice]. Swift twin:
+     * `WhoopStore.streamPresence`.
+     */
+    data class StreamPresence(
+        val hr: Boolean, val rr: Boolean, val gravity: Boolean, val steps: Boolean,
+    )
+
+    @Query(
+        "SELECT " +
+            "EXISTS(SELECT 1 FROM hrSample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) AS hr, " +
+            "EXISTS(SELECT 1 FROM rrInterval WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) AS rr, " +
+            "EXISTS(SELECT 1 FROM gravitySample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) AS gravity, " +
+            "EXISTS(SELECT 1 FROM stepSample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) AS steps"
+    )
+    suspend fun streamPresence(deviceId: String, from: Long, to: Long): StreamPresence
+
     /** Raw biometric sample counts per device id in a window - see [rawSampleCountsByDevice]. */
     data class DeviceSampleCount(val deviceId: String, val total: Int)
 
diff --git a/android/app/src/main/java/com/noop/data/WhoopRepository.kt b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
index 27511521a5..0037e7e8d8 100644
--- a/android/app/src/main/java/com/noop/data/WhoopRepository.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
@@ -1336,6 +1336,11 @@ class WhoopRepository(
     suspend fun gravitySamplesForDevice(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
         dao.gravitySamples(deviceId, from, to, limit)
 
+    /** Which raw streams this device has any rows for — see [WhoopDao.streamPresence]. Presence, not
+     *  counts, so it is four index seeks that stop at the first row. Diagnostics-export only. */
+    suspend fun streamPresence(deviceId: String, from: Long, to: Long) =
+        dao.streamPresence(deviceId, from, to)
+
     /**
      * Gravity samples over the read-side union of the active strap id and canonical "my-whoop",
      * deduped by timestamp with the active strap winning. A re-added strap banks live motion under its
diff --git a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
index 1636945af9..5ccc9761b2 100644
--- a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
@@ -54,6 +54,31 @@ object AndroidDiagnostics {
             ?.let { runCatching { com.noop.ble.WhoopModel.valueOf(it) }.getOrNull() }
     }
 
+    /**
+     * What the active strap actually delivered over the window — the line that says which scores can
+     * exist at all.
+     *
+     * A 5/MG that never completes its handshake streams live HR and R-R over the standard characteristic
+     * and nothing else: motion and steps arrive only with the proprietary offload. Without motion the
+     * sleep stager has no HR-only fallback and the workout detector returns before it looks at heart rate,
+     * so Rest reads "No data" and no bout is ever found — and until now a report showed those absences
+     * with nothing connecting them to their single cause. A reader had to know the pipeline to infer it.
+     *
+     * The window is IN the label. Without it "Provides: motion NO" reads as a capability claim, and a
+     * strap simply not worn for two days would be reported as incapable of motion — the opposite kind of
+     * wrong from the one this line exists to prevent. Over a window of actual wear, delivered and capable
+     * are the same thing; the label keeps that assumption visible instead of implied.
+     * The label is padded to 13 like every other in this block ("Model:", "Data write:"), and the window
+     * rides the VALUE. "Provides(48h):" is 15 and overhung the column in a report that is aligned by hand
+     * and read by eye.
+     * Pure so it is unit-tested directly; byte-identical to the Swift twin.
+     */
+    internal fun strapProvidesLine(hr: Boolean, rr: Boolean, motion: Boolean, steps: Boolean): String {
+        fun mark(b: Boolean) = if (b) "yes" else "NO"
+        return "Provides:    HR ${mark(hr)} · R-R ${mark(rr)} · motion ${mark(motion)} · steps ${mark(steps)}" +
+            " (last 48h)"
+    }
+
     /**
      * Strap identity + data-state lines for the debug export. Offline-safe: reads persisted prefs and the
      * canonical "my-whoop" daily spine, so it works from the scheduled background export too. Model,
@@ -125,6 +150,23 @@ object AndroidDiagnostics {
                     "(if you restored a backup, fully restart the app — #57)")
             }
             if (restoreAt > 0L) add("Last restore: ${relTime(now - restoreAt * 1000L)}")
+            // #1770 follow-up: which streams the ACTIVE strap actually delivered over the last 48 h. Four
+            // EXISTS seeks, not counts — see WhoopDao.streamPresence for why that distinction matters on a
+            // table holding ~190k motion rows a night.
+            runCatching {
+                // Same resolution funnelLines uses, blank guard included: the registry's ACTIVE id, not
+                // the canonical label, so a two-strap install reports the strap actually being worn. A
+                // BLANK id must fall back rather than be queried — it matches no rows, so every stream
+                // would read NO and the line would report a working strap as providing nothing, which is
+                // the exact misreading it exists to prevent.
+                val activeId = runCatching {
+                    (context.applicationContext as? com.noop.NoopApplication)?.deviceRegistry?.activeDeviceId()
+                }.getOrNull()?.takeIf { it.isNotBlank() } ?: "my-whoop"
+                val nowSec = now / 1000L
+                val present = com.noop.data.WhoopRepository.from(context)
+                    .streamPresence(activeId, nowSec - 48L * 3600L, nowSec)
+                add(strapProvidesLine(present.hr, present.rr, present.gravity, present.steps))
+            }
             // #1735: row COUNTS alone cannot separate "Health Connect never brought the ride in" from
             // "it did, but nothing has re-scored since". Both halves of that need a WHEN, and neither had
             // one: the importer recorded no run time at all, and the engine's "re-score: done" goes only to
diff --git a/android/app/src/test/java/com/noop/analytics/DetectionFunnelTest.kt b/android/app/src/test/java/com/noop/analytics/DetectionFunnelTest.kt
index 1674419d0a..e46525f618 100644
--- a/android/app/src/test/java/com/noop/analytics/DetectionFunnelTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/DetectionFunnelTest.kt
@@ -166,7 +166,11 @@ class DetectionFunnelTest {
             droppedShort = 4, droppedNoHR = 0, droppedLowIntensity = 0, kept = 0,
         )
         assertEquals(
-            "effort detect day=2026-08-24 hr=34137 motion=34136 restHR=59 floor=74 " +
+            // Renamed from "effort detect": this funnel is WORKOUT-BOUT detection, and sitting under
+            // the Effort name made it read as the explanation for the Today ring's number. It is not -
+            // StrainScorer.strain computes that from HR alone, with no motion input - and the confusion
+            // has already produced one wrong diagnosis from a real log. `effort score` is the ring's line.
+            "workout detect day=2026-08-24 hr=34137 motion=34136 restHR=59 floor=74 " +
                 "motionOK=1203 hrMissing=12 hrTooLow=1103 active=88 runs=6 bridged=4 " +
                 "longestRunS=212 meanRunS=74 " +
                 "short=4 noHR=0 lowIntensity=0 kept=0",
diff --git a/android/app/src/test/java/com/noop/analytics/EffortScoreFunnelTest.kt b/android/app/src/test/java/com/noop/analytics/EffortScoreFunnelTest.kt
new file mode 100644
index 0000000000..c403d5fae0
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/EffortScoreFunnelTest.kt
@@ -0,0 +1,64 @@
+package com.noop.analytics
+
+import com.noop.data.HrSample
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/**
+ * The Effort score's funnel line — the trace [StrainScorer] had none of.
+ *
+ * Every other engine emits one: WorkoutDetector, SleepStager, and both analytics engines. The number on
+ * the Today hero ring emitted nothing, so a log could not separate "measured, and the day was genuinely
+ * calm" from "could not measure". A reader looking for the second finds `workout detect`, which answers a
+ * different question, and that confusion has already produced one wrong diagnosis from a real capture.
+ */
+class EffortScoreFunnelTest {
+
+    @Test
+    fun `a calm day reports the zero it measured`() {
+        assertEquals(
+            "effort score day=2026-08-31 hr=39339 enough=true hrMax=185.0(provided) rhr=58.0" +
+                " reserve=127.0 method=edwards trimp=0.0 strain=0.0",
+            StrainScorer.scoreFunnelLine(
+                day = "2026-08-31", hrSamples = 39339, enough = true,
+                maxHR = 185.0, maxHRProvided = true, restingHR = 58.0,
+                method = StrainScorer.Method.EDWARDS, trimp = 0.0, strain = 0.0,
+            ),
+        )
+    }
+
+    /**
+     * The distinction the ring cannot show. A refusal and a genuine zero both render as "0"; only the
+     * line says which happened, and n/a is what makes the refusal legible.
+     */
+    @Test
+    fun `a refusal is not a zero`() {
+        val line = StrainScorer.scoreFunnelLine(
+            day = "2026-08-31", hrSamples = 12, enough = false,
+            maxHR = 185.0, maxHRProvided = false, restingHR = 58.0,
+            method = StrainScorer.Method.EDWARDS, trimp = null, strain = null,
+        )
+        assertEquals(
+            "effort score day=2026-08-31 hr=12 enough=false hrMax=185.0(default) rhr=58.0" +
+                " reserve=127.0 method=edwards trimp=n/a strain=n/a",
+            line,
+        )
+    }
+
+    /**
+     * The hook must cost nothing when nobody is watching. A scoring pass re-scores many days, so a line
+     * built unconditionally would be built for every one of them on every pass; `diag` defaults to null
+     * and the string is only assembled when a sink is supplied.
+     */
+    @Test
+    fun `no diag sink means no line and no behaviour change`() {
+        val hr = (0 until 5).map { HrSample(deviceId = "d", ts = 1_700_000_000L + it * 60L, bpm = 60) }
+        val emitted = ArrayList<String>()
+        // Too little data either way, so the scores match; the point is that one emits and one does not.
+        assertNull(StrainScorer.strain(hr))
+        assertNull(StrainScorer.strain(hr, diag = { emitted.add(it) }, day = "2026-08-31"))
+        assertEquals(1, emitted.size)
+        assertEquals(true, emitted[0].startsWith("effort score day=2026-08-31 "))
+    }
+}
diff --git a/android/app/src/test/java/com/noop/analytics/IntelligenceSleepDetectNoNightTest.kt b/android/app/src/test/java/com/noop/analytics/IntelligenceSleepDetectNoNightTest.kt
index f53a269d75..89890bbe1b 100644
--- a/android/app/src/test/java/com/noop/analytics/IntelligenceSleepDetectNoNightTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/IntelligenceSleepDetectNoNightTest.kt
@@ -25,8 +25,11 @@ class IntelligenceSleepDetectNoNightTest {
             gravCount = 0, stepCount = 12, providedCount = 0, windowHours = 54,
         )
         assertEquals(
+            // reason=no-motion is the point of this fixture: grav=0 means the stager has no HR-only
+            // fallback, so no quantity of HR could have staged a night. That is a strap capability limit,
+            // and it wants a different follow-up from a night that had motion and still staged nothing.
             "sleep-detect day=2026-08-11 NO-NIGHT hr=41230 rr=0 resp=880 " +
-                "grav=0 steps=12 provided=0 window=54h",
+                "grav=0 steps=12 provided=0 window=54h reason=no-motion",
             line,
         )
     }
@@ -39,6 +42,9 @@ class IntelligenceSleepDetectNoNightTest {
             gravCount = 4, stepCount = 0, providedCount = 0, windowHours = 48,
         )
         assertTrue(line, line.contains("window=48h"))
+        // The other branch: motion WAS present and staging still produced nothing, which is the case
+        // worth investigating rather than a capability limit.
+        assertTrue(line, line.contains("reason=staged-none"))
     }
 
     @Test
diff --git a/android/app/src/test/java/com/noop/testcentre/StrapProvidesLineTest.kt b/android/app/src/test/java/com/noop/testcentre/StrapProvidesLineTest.kt
new file mode 100644
index 0000000000..7e35356f08
--- /dev/null
+++ b/android/app/src/test/java/com/noop/testcentre/StrapProvidesLineTest.kt
@@ -0,0 +1,43 @@
+package com.noop.testcentre
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+/**
+ * The line that says which scores can exist at all for the strap actually being worn.
+ *
+ * A 5/MG that never completes its handshake streams live HR and R-R over the standard characteristic and
+ * nothing else — motion and steps ride the proprietary offload. Without motion the sleep stager has no
+ * HR-only fallback and the workout detector returns before it looks at heart rate, so Rest reads
+ * "No data" and no bout is ever found. A report showed all of those absences with nothing tying them to
+ * their single cause, leaving a reader to infer the pipeline. This states it.
+ */
+class StrapProvidesLineTest {
+
+    @Test
+    fun `an unbonded 5MG streams heart data and nothing else`() {
+        assertEquals(
+            "Provides:    HR yes · R-R yes · motion NO · steps NO (last 48h)",
+            AndroidDiagnostics.strapProvidesLine(hr = true, rr = true, motion = false, steps = false),
+        )
+    }
+
+    @Test
+    fun `a fully synced strap provides all four`() {
+        assertEquals(
+            "Provides:    HR yes · R-R yes · motion yes · steps yes (last 48h)",
+            AndroidDiagnostics.strapProvidesLine(hr = true, rr = true, motion = true, steps = true),
+        )
+    }
+
+    /**
+     * NO is capitalised and yes is not, deliberately: the absences are what the line exists to surface,
+     * and a reader scanning a report should catch them without reading the labels.
+     */
+    @Test
+    fun `absence is the half that stands out`() {
+        val line = AndroidDiagnostics.strapProvidesLine(hr = true, rr = false, motion = false, steps = true)
+        assertEquals(2, Regex("NO").findAll(line).count())
+        assertEquals("Provides:    HR yes · R-R NO · motion NO · steps yes (last 48h)", line)
+    }
+}

From 963dd17e1052acd3535991f523cceb09f4680f54 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 00:31:15 +1200
Subject: [PATCH 124/333] =?UTF-8?q?staging:=20build=20401=20/=20iOS=20282?=
 =?UTF-8?q?=20=E2=80=94=20the=20first=20complete=20set=20since=20iOS=20bro?=
 =?UTF-8?q?ke?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Build numbers only - 10.6.1 stays the unreleased line, and 401 clears the
staging high-water so the APK installs over 400.

400 shipped without an .ipa: its iOS leg failed on the type-check budget
that #1767 pushed StrandiOSApp.body past. Both halves of that are now
behind us — #1773 removed the wiring to get main building again, and #1774
re-landed it on the scene delegate, where it costs that expression
nothing. So this is the first build with all four artefacts since.

Carries the diagnostics work: an `effort score` line for the number on the
Today ring, which had no trace at all; `workout detect` renamed off the
Effort name it was being misread under; a `reason=` on sleep-detect
NO-NIGHT separating "no motion to stage from" from "motion present and
staged nothing"; and a `Provides:` line naming which raw streams the
active strap actually delivered.

For a 5/MG that streams live HR and no motion, those four lines tie the
blank Rest, the missing workouts and the missing steps to one cause
instead of leaving three unexplained absences in a report.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 569efac9ba..1722238934 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 400
+        versionCode = 401
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index a41db047df..f7959262dd 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "281"
+    CURRENT_PROJECT_VERSION: "282"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 5254cccb391ca0003e9160bb7ce62de7a7b2a665 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 01:54:40 +1200
Subject: [PATCH 125/333] ble: keep the hello-suppression latch across a user
 Connect (#1778)

A tap on Connect threw away the #1635 give-up and re-paid its whole cost.

clearPairingHintForUserConnect() dropped the persisted hello-suppression latch
along with the hint and the streak. The latch was never what granted the retry
- helloRetryRequested is, and shouldSendClientHello() takes userInitiated for
exactly that. Clearing it only un-suppressed every AUTOMATIC reconnect behind
the tap, so the give-up had to re-earn itself over five more refusals.

Field log 260901-0121, a WHOOP 5/MG on fw 50.41.1.0: latched 01:02:31, stable
18m 32s with live HR and not one disconnect, one tap at 01:21:09, straight back
into the loop. ~55s of churn and five dropped links per tap, to re-derive a
verdict about firmware that had not changed in between.

Apple never had this. BLEManager drops the latch on a genuine hello ack and in
forgetDevice, nowhere else; this is the Kotlin side saying the same thing.

The tap keeps its fresh attempt, so "suppression is never permanent" still
holds - one connect's worth of hello and nothing more. What it no longer does
is re-arm createBond, which it only ever did as a side effect of wiping the
latch. That is the better half to lose: each request this strap declines raises
a system "Pairing rejected" notice the user never asked for, and the hello is
itself the implicit pairing trigger, so a strap put into pairing mode still has
a route. A full pairing retry stays Forget + re-add.

614 BLE tests green. Two pure tests pin it. Doc blocks on both platforms that
claimed the tap cleared the latch are corrected, including one that read
"createBond still runs on every link" - true only because every tap was wiping
the latch out from under the gate.
---
 Strand/BLE/BLEManager.swift                   |  9 ++-
 Strand/BLE/HelloSuppression.swift             |  7 ++-
 .../java/com/noop/ble/HelloSuppression.kt     | 25 +++++++-
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 61 ++++++++++++++-----
 .../java/com/noop/ble/HelloSuppressionTest.kt | 17 ++++++
 5 files changed, 99 insertions(+), 20 deletions(-)

diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index 2d5c1689ec..53ea5142e8 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -1449,8 +1449,13 @@ public final class BLEManager: NSObject, ObservableObject {
         }
         // #1635: the suppression path pauses NOTHING, so the reset above never fires for it. An explicit
         // Connect is exactly the signal that the user has acted (pairing mode, closed the WHOOP app), so
-        // it must grant a fresh handshake regardless — that is also the only way to clear the latch short
-        // of a genuine bond. Deliberately NOT in connectCore: a system-initiated reconnect must not.
+        // it must grant a fresh handshake regardless. Be exact about what that does and does not do: it
+        // grants ONE connect's worth of hello and leaves the latch standing, so if the strap still will
+        // not answer, the automatic reconnects behind this attempt stay suppressed. The latch is cleared
+        // by the attempt SUCCEEDING (didWriteValueFor's genuine ack) or by forgetDevice, never by the tap
+        // itself — Kotlin `pairingHintClearDropsSuppressionLatch` is the twin of that rule, and it had to
+        // be made one: clearing on the tap there re-paid the whole give-up on every press.
+        // Deliberately NOT in connectCore: a system-initiated reconnect must not.
         helloRetryRequested = true
         bondGiveUp.reset()
         connectCore(model: model)
diff --git a/Strand/BLE/HelloSuppression.swift b/Strand/BLE/HelloSuppression.swift
index 96ff7b3c94..9815867f31 100644
--- a/Strand/BLE/HelloSuppression.swift
+++ b/Strand/BLE/HelloSuppression.swift
@@ -18,8 +18,11 @@ import WhoopProtocol
 /// the app already models (#69), reached deliberately instead of never at all.
 ///
 /// [userInitiated] always re-attempts: suppression is a fallback for automatic reconnects, never a
-/// permanent verdict. Someone who puts the strap in pairing mode and presses Connect must get a fresh try,
-/// and that is also how the suppression is cleared.
+/// permanent verdict. Someone who puts the strap in pairing mode and presses Connect must get a fresh try.
+/// That try is ONE connect's worth and nothing more — the latch itself survives the tap, so if the strap
+/// still will not answer, the automatic reconnects behind it stay suppressed instead of re-earning the
+/// give-up over five more refusals. The latch is dropped by a genuine bond (it demonstrably works now) or
+/// by forgetting the strap, which are the two events that are actually evidence about this device.
 ///
 /// Kotlin twin: `com.noop.ble.shouldSendClientHello`.
 func shouldSendClientHello(suppressedForDevice: Bool, userInitiated: Bool) -> Bool {
diff --git a/android/app/src/main/java/com/noop/ble/HelloSuppression.kt b/android/app/src/main/java/com/noop/ble/HelloSuppression.kt
index 6ba6ccbe4a..b60d57b43d 100644
--- a/android/app/src/main/java/com/noop/ble/HelloSuppression.kt
+++ b/android/app/src/main/java/com/noop/ble/HelloSuppression.kt
@@ -24,8 +24,11 @@ package com.noop.ble
  * never at all.
  *
  * [userInitiated] always re-attempts: suppression is a fallback for automatic reconnects, never a
- * permanent verdict. Someone who puts the strap in pairing mode and presses Connect must get a fresh try,
- * and that is also how the suppression is cleared.
+ * permanent verdict. Someone who puts the strap in pairing mode and presses Connect must get a fresh try.
+ * That try is ONE connect's worth and nothing more — the latch itself survives the tap, so if the strap
+ * still will not answer, the automatic reconnects behind it stay suppressed instead of re-earning the
+ * give-up over five more refusals. The latch is dropped by a genuine bond (it demonstrably works now) or
+ * by forgetting the strap, which are the two events that are actually evidence about this device.
  *
  * Deliberately NOT re-armed by "an OS pairing exists". That looks right — a pairing is new evidence the
  * handshake might work — but the condition never goes away, so a strap that pairs and STILL will not
@@ -112,6 +115,24 @@ internal fun helloOverrideExhaustedLine(attempts: Int): String =
         " handshake cannot complete; continuing would only loop the link. Turn the switch off to return to" +
         " the stable live-HR state (#1635)."
 
+/**
+ * May a pairing-hint clear also drop the PERSISTED hello-suppression latch?
+ *
+ * Only a genuine bond. A bond is proof the handshake works on this strap NOW, so the old verdict is stale
+ * and must go. A user Connect is not proof of anything: it already gets its one fresh attempt from the
+ * retry flag ([shouldSendClientHello]'s `userInitiated`), and dropping the latch on top of that un-
+ * suppressed every AUTOMATIC reconnect behind the attempt — so a single tap cost five more refusals and
+ * ~55s of link churn to re-earn a verdict about firmware that had not changed. Field log 260901-0121:
+ * latched 01:02:31, stable for 18 minutes, one tap at 01:21:09, straight back into the loop.
+ *
+ * Forgetting the strap clears it too, but writes the pref directly — the strap is being released, so there
+ * is no hint left to clear and nothing to route through here.
+ *
+ * Apple has only ever cleared the latch on a genuine bond or a forget; this predicate is what makes the
+ * Android side say the same thing.
+ */
+internal fun pairingHintClearDropsSuppressionLatch(genuineBond: Boolean): Boolean = genuineBond
+
 /**
  * Should the give-up latch suppress the hello, rather than pause auto-reconnect?
  *
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index f52e66400e..ddd1b6d361 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -5602,8 +5602,14 @@ class WhoopBleClient(
      *  off the involuntary-reconnect path on purpose: the streak must SURVIVE automatic reconnects (like
      *  the #52 pinnedBondRefusals counter) so it can accumulate to the threshold across the strap dropping
      *  and re-bonding. Only an explicit user tap (AppViewModel.connect) starts it over. Public so the
-     *  ViewModel can call it; a thin wrapper over the private [clearPairingHint]. */
-    fun clearPairingHintForUserConnect() = clearPairingHint()
+     *  ViewModel can call it; a thin wrapper over the private [clearPairingHint].
+     *
+     *  #1635: does NOT drop the hello-suppression latch. The fresh handshake attempt a Connect grants is
+     *  carried by [helloRetryRequested], not by clearing the latch, so keeping it costs the user nothing —
+     *  and clearing it un-suppressed every AUTOMATIC reconnect that followed, which is what re-paid the
+     *  full five refusals on every tap. Apple has always cleared it on a genuine bond and on forget only;
+     *  this is the twin of that. */
+    fun clearPairingHintForUserConnect() = clearPairingHint(genuineBond = false)
 
     /** Bonded-handshake watchdog (#50): every other connect phase has a timeout (scan; MTU settle delay;
      *  keep-alive) but the post-discovery bond/CCCD handshake had none — so a WHOOP 4.0 that wedges
@@ -5901,11 +5907,18 @@ class WhoopBleClient(
 
     /** Clear the pairing-hint streak + published hint after a genuine bond or a fresh connect. Also clears
      *  the mirrored [statusNote] only when it still carries the hint, so we never wipe an unrelated note. */
-    private fun clearPairingHint() {
+    private fun clearPairingHint(genuineBond: Boolean = true) {
         bondRefusalStreak = 0
         // #1635: a genuine bond proves the handshake works on this strap — drop the suppression latch so a
         // later transient failure starts from a clean slate rather than inheriting an old verdict.
-        runCatching { com.noop.ui.NoopPrefs.setHelloSuppressed(context, lastDeviceAddress, false) }
+        //
+        // Only a genuine bond. A user Connect passes false: it already gets its fresh attempt from
+        // [helloRetryRequested], and dropping the latch as well left every automatic reconnect after that
+        // attempt un-suppressed, so the give-up had to re-earn itself over five more refusals — ~55s of
+        // link churn per tap, on a strap whose firmware cannot answer the handshake either way.
+        if (pairingHintClearDropsSuppressionLatch(genuineBond)) {
+            runCatching { com.noop.ui.NoopPrefs.setHelloSuppressed(context, lastDeviceAddress, false) }
+        }
         // #1635: the pairing request is asked again from here too, so its one-shot line must be able to
         // report a SECOND retirement. Without this the switch would go quiet for good after one round.
         explicitBondGiveUpLogged = false
@@ -8386,6 +8399,18 @@ class WhoopBleClient(
                         alreadyBondedAtOsLevel = osBonded,
                         appLevelBonded = didBond,
                         alreadyRequestedThisLink = explicitBondRequestedThisLink,
+                        // #1635: deliberately the raw latch, with no `userInitiated` escape hatch beside
+                        // the hello's. A Connect used to re-fire createBond only as a side effect of
+                        // clearing the latch; now that the latch survives the tap, the pairing request
+                        // stays retired and the tap's one fresh attempt is the HELLO. That is the right
+                        // half to keep — the hello is the implicit pairing trigger, so a strap put into
+                        // pairing mode still has a route, while each createBond this strap declines
+                        // raises a system "Pairing rejected" notice the user never asked for.
+                        //
+                        // Do NOT "fix" this by passing `suppressed && !helloRetryRequested`. The deferral
+                        // branch below returns BEFORE the hello consumes that flag, so a re-armed request
+                        // would defer the hello, leave the retry set, and re-arm itself on the next link.
+                        // A full pairing retry is Forget + re-add, which clears the latch outright.
                         bondGivenUpForDevice = suppressed,
                     )
                 ) {
@@ -8417,22 +8442,30 @@ class WhoopBleClient(
                             // once per session. Anything recurring that clears it does not cost one link —
                             // it costs the latch permanently.
                             //
-                            // What replaces it is the explicit Connect, which clears the latch through
-                            // clearPairingHintForUserConnect() — precisely what the epitaph tells the user
-                            // to do, and pinned by HelloSuppressionTest's "suppression is never
-                            // permanent". Be exact about the alternative: the encrypted-bond clear at
-                            // clearPairingHint() lives inside the hello WRITE-COMPLETION callback, so a
-                            // suppressed hello cannot reach it. Claiming it as an automatic route would be
-                            // the same overclaim the give-up line just had to be corrected for.
+                            // What replaces it is the explicit Connect, which grants ONE fresh handshake
+                            // attempt through [helloRetryRequested] — precisely what the epitaph tells the
+                            // user to do, and pinned by HelloSuppressionTest's "suppression is never
+                            // permanent". Note it is the retry flag that carries this, NOT a clear of the
+                            // latch: clearPairingHintForUserConnect() deliberately leaves the latch set so
+                            // the automatic reconnects AFTER that attempt stay suppressed. Be exact about
+                            // the alternative: the encrypted-bond clear at clearPairingHint() lives inside
+                            // the hello WRITE-COMPLETION callback, so a suppressed hello cannot reach it.
+                            // Claiming it as an automatic route would be the same overclaim the give-up
+                            // line just had to be corrected for.
                             //
                             // That costs nothing real. The latch is only set after five consecutive
                             // refusals, so "latched, and pairing now works" needs something to have
                             // CHANGED — new firmware, the strap put into pairing mode (@Zebsi235's MG) —
                             // and a user who has changed something taps Connect. Voiding the verdict on
                             // the mere REQUEST voided it on a hope this strap never fulfils, every eleven
-                            // seconds. The pairing experiment itself is untouched: createBond still runs
-                            // on every link, it just no longer drags the hello back with it, which is what
-                            // [helloDeferredByExplicitBond] says must never share a link.
+                            // seconds. The pairing experiment itself is untouched in the window that
+                            // matters: createBond runs on every link until the latch is set, and it no
+                            // longer drags the hello back with it, which is what
+                            // [helloDeferredByExplicitBond] says must never share a link. Be precise
+                            // about after: `bondGivenUpForDevice = suppressed` retires the request for as
+                            // long as the latch stands, and since the latch now survives a Connect, the
+                            // way back is a genuine bond or Forget + re-add — not a tap. The field log
+                            // read as "createBond on every link" only because every tap wiped the latch.
                             if (initiated) {
                                 // Ask the device directly rather than waiting on our own broadcast
                                 // receiver, which is a suspect in exactly the silence being investigated.
diff --git a/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt b/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
index 681c71123d..7381edaaad 100644
--- a/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
+++ b/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
@@ -26,6 +26,23 @@ class HelloSuppressionTest {
         assertTrue(shouldSendClientHello(suppressedForDevice = true, userInitiated = true))
     }
 
+    @Test
+    fun `a user Connect spends one attempt and leaves the latch standing`() {
+        // The tap's own connect re-attempts — that is what makes suppression non-permanent...
+        assertTrue(shouldSendClientHello(suppressedForDevice = true, userInitiated = true))
+        // ...but the tap is not evidence about the firmware, so it must not drop the latch.
+        assertFalse(pairingHintClearDropsSuppressionLatch(genuineBond = false))
+        // Which is the whole point: the AUTOMATIC reconnect behind that attempt is still suppressed.
+        // The regression cleared the latch on the tap, so this read false for every reconnect that
+        // followed and the give-up had to re-earn itself over five more refusals (~55s of churn).
+        assertFalse(shouldSendClientHello(suppressedForDevice = true, userInitiated = false))
+    }
+
+    @Test
+    fun `a genuine bond drops the latch - it is the one event that proves the handshake works`() {
+        assertTrue(pairingHintClearDropsSuppressionLatch(genuineBond = true))
+    }
+
     @Test
     fun `only an unanswered handshake suppresses - an auth refusal still pauses`() {
         // An auth refusal is evidence the strap actively declined and reconnecting cannot help, so the

From d07051283974ac80de3985fbae8f47aba5205805 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 01:55:03 +1200
Subject: [PATCH 126/333] staging: build 402 / iOS 283 for the
 suppression-latch fix

Build numbers only - 10.6.1 stays the unreleased line, and 402 clears the
staging high-water so the APK installs over 401.

Carries one behavioural change: the hello-suppression latch now survives a
user Connect. On a 5/MG that never answers the handshake, tapping Connect used
to wipe the latch, which un-suppressed every automatic reconnect behind the tap
and made the give-up re-earn itself over five more refusals - ~55s of churn and
five dropped links per press. The tap still gets its one fresh handshake
attempt; what follows it stays suppressed, so the link settles after one cycle.

What to watch on this build: press Connect on the 5/MG and expect ONE ~4.8s
drop, then "CLIENT_HELLO suppressed for this strap" on the very next
reconnect, then a link that holds. Previously that was five drops over ~55s.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 1722238934..f705557deb 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 401
+        versionCode = 402
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index f7959262dd..4f27d5a820 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "282"
+    CURRENT_PROJECT_VERSION: "283"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 907c9cdd57319e835f45da0e851a60d6e0aae695 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 02:44:59 +1200
Subject: [PATCH 127/333] ble: spend fewer links learning what the strap
 already told us (#1779)

Two changes against the same complaint - manual reconnects cost too much.

1. The give-up threshold follows the CAUSE. The flat 5 was argued for the
auth-refusal branch and only holds there: the pairing hint shows at 2, it asks
the user to close the official app or free a stale pairing, and the extra
cycles are the time to do it. An unanswered handshake asks nothing of them, so
that branch stops at 3 - not 2, where the hint fires and a PERSISTED verdict
would have no margin against a transient. ~40% off the first latch.
giveUpThresholdFor keys on the same authRefusal as giveUpSuppressesHello, so
patience and treatment can never disagree about which refusal this is.

2. A Connect tap no longer rebuilds a link it already holds.
getConnectedWhoopDevice() answers "the OS has this device connected", which is
true of our own live GATT too. Field log 260901-0121: gen=6 had been up 18m 32s
streaming HR when a tap replaced it with gen=7. Narrow on purpose - only the
genuinely-bonded case, where a reconnect can achieve nothing. A suppressed
strap still reconnects, because there the tap IS the handshake retry and the
hello can only be written on a new link's discovery.

Re-review caught two bugs in that guard before merge. It returned above the
selectedModel pin, leaving a stale family selection uncorrected; and it trusted
`connected` alone, which a silently dead GATT reports right up until the
watchdog bounces it - the exact state someone taps Connect in. Keeping the link
there would have made the button inert in the one situation it exists for. It
now requires the link to be live by the watchdog's OWN fuse, extracted to
liveLinkStallFuseMs() and shared with keepAliveFire so the two cannot disagree.

Apple's connectCore already reuses a held peripheral, so this is Android
catching up rather than a new idea - though Apple's guard is broader (no
didBond) and has no liveness fuse, which is worth its own look.

621 BLE tests green. app-build green on both legs. Swift carries the threshold
twins and now its own tests for them: StrandTests has no default CI, so the
twin nobody runs is also the twin nobody notices drifting.
---
 Strand/BLE/BLEManager.swift                   | 17 ++++--
 Strand/BLE/HelloSuppression.swift             | 27 ++++++++++
 StrandTests/BondRefusalGiveUpTests.swift      | 21 ++++++++
 StrandTests/HelloSuppressionTests.swift       | 24 ++++++++-
 .../java/com/noop/ble/BondRefusalGiveUp.kt    | 16 ++++--
 .../java/com/noop/ble/HelloSuppression.kt     | 51 ++++++++++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 52 +++++++++++++++++--
 .../com/noop/ble/BondRefusalGiveUpTest.kt     | 20 +++++++
 .../java/com/noop/ble/HelloSuppressionTest.kt | 49 +++++++++++++++++
 9 files changed, 265 insertions(+), 12 deletions(-)

diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index 53ea5142e8..6d06b7ab18 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -148,9 +148,13 @@ struct PostBondTimeoutLoopDetector {
 /// The streak accumulates across the reconnect loop (a disconnect does NOT reset it) and is cleared only by
 /// a genuine bond or an explicit user reconnect, exactly like BLEManager's existing `bondRefusalStreak`.
 struct BondRefusalGiveUp {
-    /// Consecutive bond refusals before we pause auto-reconnect + write the epitaph. 5 (not 2, where the
+    /// Consecutive bond refusals before we PAUSE auto-reconnect + write the epitaph. 5 (not 2, where the
     /// pairing HINT already shows): the hint asks the user to act; we give them several reconnect cycles to
     /// do it before we stop hammering. A genuinely held/stale strap reaches 5 within a couple of minutes.
+    ///
+    /// This is the AUTH-REFUSAL number specifically, and `recordRefusal` takes a per-refusal override for
+    /// that reason: an unanswered handshake asks the user for nothing, so waiting five cycles for a decision
+    /// they cannot make just buys ~4.8s link drops. See `giveUpThresholdFor`.
     let giveUpThreshold: Int
 
     private(set) var refusals = 0
@@ -162,9 +166,9 @@ struct BondRefusalGiveUp {
 
     /// Record one bond refusal. Returns true if THIS refusal freshly crossed the give-up threshold (so the
     /// caller pauses the reconnect + writes the epitaph exactly once).
-    mutating func recordRefusal() -> Bool {
+    mutating func recordRefusal(threshold: Int? = nil) -> Bool {
         refusals += 1
-        if !gaveUp && refusals >= giveUpThreshold {
+        if !gaveUp && refusals >= (threshold ?? giveUpThreshold) {
             gaveUp = true
             return true
         }
@@ -5300,7 +5304,12 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
     /// Shared by both call sites so the split cannot drift: the auth path (a write error) and the
     /// unanswered path (a disconnect with a hello still outstanding) reach the same decision.
     private func recordWhoop5BondRefusal(authRefusal: Bool, peripheralUUID: String) {
-        guard bondGiveUp.recordRefusal() else { return }
+        // #1635: the two causes want different patience, for the same reason they want different
+        // outcomes - see `giveUpThresholdFor`. Keyed on the same authRefusal as the branch below, so the
+        // threshold and the treatment can never disagree about which kind of refusal this is.
+        guard bondGiveUp.recordRefusal(
+            threshold: giveUpThresholdFor(authRefusal: authRefusal, pauseThreshold: bondGiveUp.giveUpThreshold)
+        ) else { return }
         let opaque = BondRefusalGiveUp.opaqueId(fromLocalUUID: peripheralUUID)
         let suppress = giveUpSuppressesHello(authRefusal: authRefusal)
         if suppress {
diff --git a/Strand/BLE/HelloSuppression.swift b/Strand/BLE/HelloSuppression.swift
index 9815867f31..0e1dd4b1d2 100644
--- a/Strand/BLE/HelloSuppression.swift
+++ b/Strand/BLE/HelloSuppression.swift
@@ -29,6 +29,33 @@ func shouldSendClientHello(suppressedForDevice: Bool, userInitiated: Bool) -> Bo
     !suppressedForDevice || userInitiated
 }
 
+/// How many consecutive refusals this cause needs before the give-up latches.
+///
+/// The flat 5 was argued for the AUTH-REFUSAL branch and only makes sense there: the pairing hint shows at
+/// 2, the hint asks the user to do something (close the official app, free a stale phone pairing), and the
+/// extra cycles are the time to do it before NOOP stops hammering.
+///
+/// An unanswered handshake gives the user nothing to act on. The write vanishes, the strap is not refusing
+/// anything it could be talked out of, and the outcome — suppress the hello and keep streaming live HR —
+/// needs no permission and costs no capability that was reachable anyway. Every cycle spent waiting is a
+/// ~4.8s link drop bought for nothing, so this branch stops at 3.
+///
+/// Not 2, which is exactly where the pairing hint fires: a strap whose hello is unanswered twice by some
+/// transient would latch a PERSISTED verdict with no margin at all. 3 keeps one cycle of margin and still
+/// takes roughly 40% off the churn.
+///
+/// Kotlin twin: `com.noop.ble.UNANSWERED_GIVE_UP_THRESHOLD`.
+let unansweredGiveUpThreshold = 3
+
+/// The give-up threshold for the refusal in hand. Keyed on the same `authRefusal` that decides whether the
+/// give-up suppresses or pauses (`giveUpSuppressesHello`), so the two can never disagree about which branch
+/// a refusal belongs to.
+///
+/// Kotlin twin: `com.noop.ble.giveUpThresholdFor`.
+func giveUpThresholdFor(authRefusal: Bool, pauseThreshold: Int) -> Int {
+    authRefusal ? pauseThreshold : unansweredGiveUpThreshold
+}
+
 /// Should the give-up latch suppress the hello, rather than pause auto-reconnect?
 ///
 /// The two give-up causes want opposite treatment, which is why they are split here rather than sharing
diff --git a/StrandTests/BondRefusalGiveUpTests.swift b/StrandTests/BondRefusalGiveUpTests.swift
index 2f4e16da7e..184d4aca3e 100644
--- a/StrandTests/BondRefusalGiveUpTests.swift
+++ b/StrandTests/BondRefusalGiveUpTests.swift
@@ -68,4 +68,25 @@ final class BondRefusalGiveUpTests: XCTestCase {
         XCTAssertTrue(hint.contains("Forget This Device"))
         XCTAssertFalse(hint.contains("\u{2014}"))
     }
+
+    /// A per-refusal threshold moves the crossing without duplicating it. Kotlin twin:
+    /// `BondRefusalGiveUpTest."a lower threshold latches sooner, and the latch still reports once"`.
+    func testPerRefusalThresholdLatchesSoonerAndStillReportsOnce() {
+        var g = BondRefusalGiveUp()          // pause threshold 5
+        XCTAssertFalse(g.recordRefusal(threshold: 3))
+        XCTAssertFalse(g.recordRefusal(threshold: 3))
+        XCTAssertTrue(g.recordRefusal(threshold: 3), "crossed at 3, not 5")
+        XCTAssertTrue(g.gaveUp)
+        XCTAssertFalse(g.recordRefusal(threshold: 3), "the latch reports exactly once")
+        XCTAssertEqual(4, g.refusals)
+    }
+
+    /// Omitting it keeps the constructed threshold, so every existing caller is unchanged.
+    func testOmittingTheThresholdKeepsTheConstructedOne() {
+        var g = BondRefusalGiveUp()
+        XCTAssertEqual(5, g.giveUpThreshold)
+        for _ in 1...4 { XCTAssertFalse(g.recordRefusal()) }
+        XCTAssertTrue(g.recordRefusal())
+    }
+
 }
diff --git a/StrandTests/HelloSuppressionTests.swift b/StrandTests/HelloSuppressionTests.swift
index 662059e744..34525b0283 100644
--- a/StrandTests/HelloSuppressionTests.swift
+++ b/StrandTests/HelloSuppressionTests.swift
@@ -170,5 +170,27 @@ final class HelloSuppressionTests: XCTestCase {
             XCTAssertFalse(keepAliveMayRun(connected: false, didBond: true, bonded: true, family: family))
         }
     }
-}
 
+    // MARK: - giveUpThresholdFor
+
+    /// The Kotlin twin is `HelloSuppressionTest."an unanswered handshake gives up sooner than an auth
+    /// refusal"`. Both numbers matter: 5 keeps the auth branch's patience, 3 is the unanswered branch.
+    func testUnansweredHandshakeGivesUpSoonerThanAuthRefusal() {
+        XCTAssertEqual(5, giveUpThresholdFor(authRefusal: true, pauseThreshold: 5))
+        XCTAssertEqual(3, giveUpThresholdFor(authRefusal: false, pauseThreshold: 5))
+        // Above the hint threshold, so a PERSISTED verdict still keeps a cycle of margin.
+        XCTAssertGreaterThan(unansweredGiveUpThreshold, 2)
+    }
+
+    /// Patience and treatment read the SAME refusal. Keyed apart they could disagree — pausing on a branch
+    /// that waited the suppression count, or vice versa. Kotlin twin: "the threshold and the treatment
+    /// read the same refusal".
+    func testThresholdAndTreatmentReadTheSameRefusal() {
+        for auth in [true, false] {
+            let suppresses = giveUpSuppressesHello(authRefusal: auth)
+            let threshold = giveUpThresholdFor(authRefusal: auth, pauseThreshold: 5)
+            XCTAssertEqual(suppresses, threshold == unansweredGiveUpThreshold)
+        }
+    }
+
+}
diff --git a/android/app/src/main/java/com/noop/ble/BondRefusalGiveUp.kt b/android/app/src/main/java/com/noop/ble/BondRefusalGiveUp.kt
index f8e1ecbb38..874b8e600d 100644
--- a/android/app/src/main/java/com/noop/ble/BondRefusalGiveUp.kt
+++ b/android/app/src/main/java/com/noop/ble/BondRefusalGiveUp.kt
@@ -20,11 +20,15 @@ package com.noop.ble
  */
 class BondRefusalGiveUp(
     /**
-     * Consecutive bond refusals before we pause auto-reconnect + write the epitaph. 5 (not 2, where the
+     * Consecutive bond refusals before we PAUSE auto-reconnect + write the epitaph. 5 (not 2, where the
      * pairing HINT already shows): the hint asks the user to act; we give them several reconnect cycles to
      * do it before we stop hammering. A genuinely held/stale strap reaches 5 within a couple of minutes.
+     *
+     * This is the AUTH-REFUSAL number specifically, and [recordRefusal] takes a per-refusal override for
+     * that reason: an unanswered handshake asks the user for nothing, so waiting five cycles for a decision
+     * they cannot make just buys ~4.8s link drops. See [giveUpThresholdFor].
      */
-    private val giveUpThreshold: Int = 5,
+    val giveUpThreshold: Int = 5,
 ) {
     var refusals = 0
         private set
@@ -39,10 +43,14 @@ class BondRefusalGiveUp(
     /**
      * Record one bond refusal. Returns true if THIS refusal freshly crossed the give-up threshold (so the
      * caller pauses the reconnect + writes the epitaph exactly once).
+     *
+     * [threshold] defaults to the constructed [giveUpThreshold]; callers that can tell the two give-up
+     * CAUSES apart pass the one for the refusal in hand ([giveUpThresholdFor]). The latch is still reported
+     * exactly once whatever the threshold, so a lower one moves the crossing without duplicating it.
      */
-    fun recordRefusal(): Boolean {
+    fun recordRefusal(threshold: Int = giveUpThreshold): Boolean {
         refusals += 1
-        if (!gaveUp && refusals >= giveUpThreshold) {
+        if (!gaveUp && refusals >= threshold) {
             gaveUp = true
             return true
         }
diff --git a/android/app/src/main/java/com/noop/ble/HelloSuppression.kt b/android/app/src/main/java/com/noop/ble/HelloSuppression.kt
index b60d57b43d..cfcccfb922 100644
--- a/android/app/src/main/java/com/noop/ble/HelloSuppression.kt
+++ b/android/app/src/main/java/com/noop/ble/HelloSuppression.kt
@@ -115,6 +115,57 @@ internal fun helloOverrideExhaustedLine(attempts: Int): String =
         " handshake cannot complete; continuing would only loop the link. Turn the switch off to return to" +
         " the stable live-HR state (#1635)."
 
+/**
+ * Should an explicit Connect keep the link it already holds, instead of rebuilding it?
+ *
+ * `getConnectedWhoopDevice()` answers "the OS has this device connected", which is true of our own live
+ * GATT too — so the Easy-connect path re-attached over a link that was already working. Field log
+ * 260901-0121: a link up 18m 32s and streaming was replaced on a tap.
+ *
+ * Every clause is load-bearing:
+ *  - [genuinelyBonded]: the ONLY state where a reconnect can achieve nothing. A suppressed strap is
+ *    deliberately excluded — there the tap IS the handshake retry, and the hello can only be written on a
+ *    new link's discovery, so it has to reconnect.
+ *  - [sameDevice]: a tap meant for a different strap must not be swallowed by the one in hand.
+ *  - [silentMs] < [stallFuseMs]: `connected` alone is not evidence the link WORKS. A silently dead GATT
+ *    reports connected until the watchdog bounces it, and that is exactly when someone taps Connect —
+ *    keeping the link there would make the button inert in the one state it exists for. The fuse is the
+ *    watchdog's own, so the two can never disagree about whether this link is alive.
+ */
+internal fun connectKeepsExistingLink(
+    genuinelyBonded: Boolean,
+    connected: Boolean,
+    sameDevice: Boolean,
+    silentMs: Long,
+    stallFuseMs: Long,
+): Boolean = genuinelyBonded && connected && sameDevice && silentMs < stallFuseMs
+
+/**
+ * How many consecutive refusals this cause needs before the give-up latches.
+ *
+ * The flat 5 was argued for the AUTH-REFUSAL branch and only makes sense there: the pairing hint shows at
+ * 2, the hint asks the user to do something (close the official app, free a stale phone pairing), and the
+ * extra cycles are the time to do it before NOOP stops hammering.
+ *
+ * An unanswered handshake gives the user nothing to act on. The write vanishes, the strap is not refusing
+ * anything it could be talked out of, and the outcome — suppress the hello and keep streaming live HR —
+ * needs no permission and costs no capability that was reachable anyway. Every cycle spent waiting is a
+ * ~4.8s link drop bought for nothing, so this branch stops at 3.
+ *
+ * Not 2, which is exactly where the pairing hint fires: a strap whose hello is unanswered twice by some
+ * transient would latch a PERSISTED verdict with no margin at all. 3 keeps one cycle of margin and still
+ * takes roughly 40% off the churn.
+ */
+internal const val UNANSWERED_GIVE_UP_THRESHOLD = 3
+
+/**
+ * The give-up threshold for the refusal in hand. Keyed on the same [authRefusal] that decides whether the
+ * give-up suppresses or pauses ([giveUpSuppressesHello]), so the two can never disagree about which branch
+ * a refusal belongs to.
+ */
+internal fun giveUpThresholdFor(authRefusal: Boolean, pauseThreshold: Int): Int =
+    if (authRefusal) pauseThreshold else UNANSWERED_GIVE_UP_THRESHOLD
+
 /**
  * May a pairing-hint clear also drop the PERSISTED hello-suppression latch?
  *
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index ddd1b6d361..b71df62a38 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -3391,7 +3391,40 @@ class WhoopBleClient(
         // pipeline consistent. A stale connection or bond falls back to a scan via handleDisconnect.
         val direct = getConnectedWhoopDevice() ?: bondedWhoopDevice()
         if (direct != null) {
+            // #1635: we may already HOLD this link. getConnectedWhoopDevice() answers "the OS has this
+            // device connected", which is true of our own live GATT too — so without this, a Connect tap
+            // tore down a working link and rebuilt it. Field log 260901-0121: gen=6 had been up 18m 32s
+            // streaming HR when a tap replaced it with gen=7.
+            //
+            // Only when a reconnect could achieve NOTHING, which is exactly the genuinely-bonded case:
+            // the handshake is done, so there is no retry to spend and no state a fresh link would fix.
+            // A suppressed strap is deliberately NOT covered — there the tap IS the handshake retry, and
+            // the hello can only be written on a new link's discovery, so it must still reconnect.
+            //
+            // AFTER the selectedModel pin, not before: both helpers match only a 5/MG, so this branch is
+            // also where a stale selection gets corrected. Returning above it would leave the picker and
+            // any later rescan on the wrong family.
             selectedModel = WhoopModel.WHOOP5_MG
+            // `connected` alone is not evidence the link WORKS — a silently dead GATT reports connected
+            // until the watchdog bounces it, and that is precisely when someone taps Connect. Declining
+            // to act there would turn the button inert in the one state it exists for, so require the
+            // link to be live by the watchdog's own measure.
+            val silentMs = System.currentTimeMillis() - lastDataAtMs
+            if (connectKeepsExistingLink(
+                    genuinelyBonded = didBond,
+                    connected = _state.value.connected,
+                    sameDevice = gatt?.device?.address == direct.address,
+                    silentMs = silentMs,
+                    stallFuseMs = liveLinkStallFuseMs(),
+                )
+            ) {
+                // Consume it. The retry belongs to the tap that asked, and leaving it set would hand a
+                // stale one to a later AUTOMATIC reconnect - the same leak the deferral branch warns of.
+                helloRetryRequested = false
+                log("Connect: already connected and bonded to ${direct.name ?: "WHOOP"}, last data" +
+                    " ${silentMs / 1000}s ago — keeping the link rather than rebuilding it (#1635).")
+                return
+            }
             log("Easy-connect: attaching directly to ${direct.name ?: "WHOOP"} (no scan needed)")
             _state.update { it.copy(
                 scanning = false, whoop5Detected = false,
@@ -5871,7 +5904,10 @@ class WhoopBleClient(
         // (the pairing hint has had several cycles to be acted on), pause auto-reconnect so we stop hammering
         // a strap that can't bond, write the one-line epitaph (opaque hashed id only, no PII), and surface
         // the honest paused hint. A genuine bond or a manual reconnect re-arms it.
-        if (bondGiveUp.recordRefusal()) {
+        // #1635: the two causes want different patience, for the same reason they want different
+        // outcomes — see [giveUpThresholdFor]. Keyed on the same authRefusal as the branch below, so the
+        // threshold and the treatment can never disagree about which kind of refusal this is.
+        if (bondGiveUp.recordRefusal(giveUpThresholdFor(authRefusal, bondGiveUp.giveUpThreshold))) {
             // #1635: an unanswered handshake and an auth refusal want opposite treatment — see
             // [giveUpSuppressesHello]. Suppressing keeps a link that is streaming live HR; pausing is for a
             // strap that actively declined and cannot be helped by reconnecting.
@@ -7479,6 +7515,17 @@ class WhoopBleClient(
     // MARK: Live-stream keep-alive  (port of BLEManager.startKeepAlive / keepAliveFire)
     // ====================================================================================
 
+    /**
+     * How long this family's live link may go silent before the app stops calling it healthy.
+     *
+     * Shared by the keep-alive's bounce decision and the Connect no-op below, deliberately: the no-op
+     * says "a reconnect would achieve nothing", and the only honest measure of that is the same one the
+     * watchdog uses to decide a reconnect IS needed. Two numbers here could disagree, and the way they
+     * would fail is a Connect button that declines to act on a link the watchdog has already given up on.
+     */
+    private fun liveLinkStallFuseMs(): Long =
+        if (connectedFamily == DeviceFamily.WHOOP5) KEEPALIVE_STALL_5MG_EMPTY_MS else KEEPALIVE_STALL_MS
+
     /** (Re)start the 30s keep-alive. Called from the connect handshake; cancelled in [reset]. */
     private fun startKeepAlive() {
         handler.removeCallbacks(keepAliveRunnable)
@@ -7517,8 +7564,7 @@ class WhoopBleClient(
             // data — #580 mistakenly gated the wide fuse on `historyEmpty`, so a 5/MG that DID serve history
             // still thrashed on the 120s fuse (#1414). Widen to the whole 5/MG family; WHOOP 4 keeps 120s.
             // (`historyEmpty` still gates the battery-backfill interval — a separate concern, left as-is.)
-            val bounceFuse = if (connectedFamily == DeviceFamily.WHOOP5)
-                KEEPALIVE_STALL_5MG_EMPTY_MS else KEEPALIVE_STALL_MS
+            val bounceFuse = liveLinkStallFuseMs()
             if (silentMs > bounceFuse) {
                 // Nothing for the fuse window — the live stream/link stalled. Bounce it: the auto-rescan on
                 // disconnect re-bonds and resumes streaming (the automatic version of the manual fix).
diff --git a/android/app/src/test/java/com/noop/ble/BondRefusalGiveUpTest.kt b/android/app/src/test/java/com/noop/ble/BondRefusalGiveUpTest.kt
index d340fd4a79..f970477a8c 100644
--- a/android/app/src/test/java/com/noop/ble/BondRefusalGiveUpTest.kt
+++ b/android/app/src/test/java/com/noop/ble/BondRefusalGiveUpTest.kt
@@ -81,4 +81,24 @@ class BondRefusalGiveUpTest {
         assertTrue(hint.contains("Forget This Device"))
         assertFalse(hint.contains("\u2014"))
     }
+
+    @Test
+    fun `a lower threshold latches sooner, and the latch still reports once`() {
+        var g = BondRefusalGiveUp()          // pause threshold 5
+        assertFalse(g.recordRefusal(threshold = 3))
+        assertFalse(g.recordRefusal(threshold = 3))
+        assertTrue(g.recordRefusal(threshold = 3))   // crossed at 3, not 5
+        assertTrue(g.gaveUp)
+        // Still exactly one crossing: the epitaph and the latch write are once-per-give-up.
+        assertFalse(g.recordRefusal(threshold = 3))
+        assertEquals(4, g.refusals)
+    }
+
+    @Test
+    fun `omitting the threshold keeps the constructed one`() {
+        val g = BondRefusalGiveUp()
+        assertEquals(5, g.giveUpThreshold)
+        repeat(4) { assertFalse(g.recordRefusal()) }
+        assertTrue(g.recordRefusal())
+    }
 }
diff --git a/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt b/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
index 7381edaaad..c3fbdb3c79 100644
--- a/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
+++ b/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
@@ -43,6 +43,55 @@ class HelloSuppressionTest {
         assertTrue(pairingHintClearDropsSuppressionLatch(genuineBond = true))
     }
 
+    @Test
+    fun `a Connect keeps a live bonded link it already holds`() {
+        assertTrue(connectKeepsExistingLink(genuinelyBonded = true, connected = true, sameDevice = true,
+                                            silentMs = 5_000, stallFuseMs = 600_000))
+    }
+
+    @Test
+    fun `a Connect rebuilds when a reconnect could still achieve something`() {
+        // Suppressed / never bonded: the tap IS the handshake retry, and that needs a new link.
+        assertFalse(connectKeepsExistingLink(genuinelyBonded = false, connected = true, sameDevice = true,
+                                             silentMs = 5_000, stallFuseMs = 600_000))
+        // A tap aimed at a different strap must not be swallowed by the one in hand.
+        assertFalse(connectKeepsExistingLink(genuinelyBonded = true, connected = true, sameDevice = false,
+                                             silentMs = 5_000, stallFuseMs = 600_000))
+        assertFalse(connectKeepsExistingLink(genuinelyBonded = true, connected = false, sameDevice = true,
+                                             silentMs = 5_000, stallFuseMs = 600_000))
+    }
+
+    @Test
+    fun `a silently dead link does NOT keep the button inert`() {
+        // The regression this clause exists for: GATT still says connected, nothing has arrived, and the
+        // watchdog is about to bounce it. That is exactly when Connect is tapped, so it must act.
+        assertFalse(connectKeepsExistingLink(genuinelyBonded = true, connected = true, sameDevice = true,
+                                             silentMs = 600_000, stallFuseMs = 600_000))
+        assertFalse(connectKeepsExistingLink(genuinelyBonded = true, connected = true, sameDevice = true,
+                                             silentMs = 900_000, stallFuseMs = 600_000))
+    }
+
+    @Test
+    fun `an unanswered handshake gives up sooner than an auth refusal`() {
+        // The auth refusal keeps the full patience: the hint asks the user to act, and 5 is the time
+        // to act in. An unanswered handshake asks nothing of them, so waiting only buys link drops.
+        assertEquals(5, giveUpThresholdFor(authRefusal = true, pauseThreshold = 5))
+        assertEquals(3, giveUpThresholdFor(authRefusal = false, pauseThreshold = 5))
+        // Above the hint threshold, so a latched PERSISTED verdict still needs a cycle of margin.
+        assertTrue(UNANSWERED_GIVE_UP_THRESHOLD > 2)
+    }
+
+    @Test
+    fun `the threshold and the treatment read the same refusal`() {
+        // These two decide patience and outcome for one refusal. Keyed apart they could disagree -
+        // pausing on a branch that waited the suppression count, or vice versa.
+        for (auth in listOf(true, false)) {
+            val suppresses = giveUpSuppressesHello(authRefusal = auth)
+            val threshold = giveUpThresholdFor(authRefusal = auth, pauseThreshold = 5)
+            assertEquals(suppresses, threshold == UNANSWERED_GIVE_UP_THRESHOLD)
+        }
+    }
+
     @Test
     fun `only an unanswered handshake suppresses - an auth refusal still pauses`() {
         // An auth refusal is evidence the strap actively declined and reconnecting cannot help, so the

From 820a2b6ec2ebd9c8669901291c492e25dc32af1e Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 02:45:19 +1200
Subject: [PATCH 128/333] staging: build 403 / iOS 284 for the reconnect-cost
 work

Build numbers only - 10.6.1 stays the unreleased line, and 403 clears the
staging high-water so the APK installs over 402.

Carries the second half of the manual-reconnect work. 402 stopped a Connect tap
wiping the hello-suppression latch; this one stops the tap rebuilding a link it
already holds, and gives up sooner on the branch the user cannot act on - 3
refusals for an unanswered handshake, still 5 for an auth refusal.

What to watch: on the 5/MG, a Connect tap while it is already streaming should
now keep the link rather than bouncing it, and the FIRST time a strap latches
should cost 3 drops instead of 5. A tap on a suppressed strap still bounces
once by design - that tap is the handshake retry.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index f705557deb..5bf9f46e88 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 402
+        versionCode = 403
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 4f27d5a820..0d6ed9f79e 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "283"
+    CURRENT_PROJECT_VERSION: "284"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From faa1fd41b6b997fe287f4681c45dac072f294892 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 11:21:06 +1200
Subject: [PATCH 129/333] ble: a timer firing is not the user asking to retry
 the handshake (#1781)

Android had one connect entry point. Four system-initiated paths used it - the
radio-on rescan, the bond-loop salvage probe, and both deferred reconnect
timers - so each was handed the #1635 one-shot CLIENT_HELLO retry that only a
user gesture should get.

Field log 260901-1022, build 403. The link held 7h 29m suppressed and silent.
One tap at 10:21:50 spent its retry, correctly, and the strap dropped it 4.7s
later. Then the stale-OS-bond fallback scheduled a rescan through connect(),
re-granting the retry, so the AUTOMATIC reconnect at 10:22:00 wrote a second
unanswered hello and paid a second 4.8s drop. Suppression only took hold on the
third link: two drops per manual reconnect where the design says one.

connectFromSystem() is now the entry for those four, identical except that it
never grants the retry. Apple has had this split since #78 hole-2 and its
connect() doc already stated the rule Android was missing. It also makes
onBluetoothRadioOn coherent: its fast path never granted the retry, only its
rescan fallback did, so radio-on behaved differently depending on whether
lastDevice happened to be set.

The gate reads source, because the rule is about which entry a caller picks:
there is no return value to assert on, the client needs a radio, and every line
the wrong path produces is identical to a real user tap. It asserts that NO
internal caller uses the user entry - not that the system entry appears N times,
which would fail on a correct fifth path and teach people to edit the number.
Both failure modes were verified by reintroducing the bug, at a timer and at
the radio-on site, and watching the right assertion fail.

It fails rather than skips when the source is not found. An Assume that misses
passes, so the gate would report green having never run, and CI does not log
the names of tests that pass.

624 BLE tests green, 0 skipped. Android-only.
---
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 38 ++++++--
 .../noop/ble/SystemInitiatedConnectTest.kt    | 87 +++++++++++++++++++
 2 files changed, 117 insertions(+), 8 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ble/SystemInitiatedConnectTest.kt

diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index b71df62a38..36dd3acc42 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -3340,15 +3340,37 @@ class WhoopBleClient(
     // ====================================================================================
 
     /**
-     * Begin scanning for the WHOOP custom service, then connect to the first match.
+     * USER-initiated connect (the Connect button, the scan flow, Add-a-WHOOP). Begin scanning for the
+     * WHOOP custom service, then connect to the first match.
      * Port of `BLEManager.connect()` → `central.scanForPeripherals(withServices:[customService])`.
+     *
+     * The ONLY entry that grants the #1635 one-shot handshake retry. System-initiated paths — the
+     * radio-on rescan, the bond-loop salvage probe, both deferred reconnect timers — MUST use
+     * [connectFromSystem]. Field log 260901-1022: the stale-OS-bond fallback routed a SCAN-driven
+     * reconnect through here, so a suppressed strap wrote a second unanswered hello and paid a second
+     * ~4.8s drop that no user had asked for. Apple has kept these two entries apart since #78 hole-2.
+     */
+    @SuppressLint("MissingPermission")
+    fun connect(model: WhoopModel = WhoopModel.WHOOP4) = connectInternal(model, userInitiated = true)
+
+    /**
+     * SYSTEM-initiated connect: identical to [connect] except it never grants the handshake retry.
+     *
+     * A timer firing is not the user saying "try again". Suppression exists precisely so the automatic
+     * reconnects behind a failed attempt stop writing the hello; handing them the retry re-opens the loop
+     * one link at a time, and does it invisibly, because every line it produces looks exactly like the
+     * user having tapped Connect. Kotlin twin of `BLEManager.connectFromSystem`.
      */
     @SuppressLint("MissingPermission")
-    fun connect(model: WhoopModel = WhoopModel.WHOOP4) {
+    fun connectFromSystem(model: WhoopModel = WhoopModel.WHOOP4) = connectInternal(model, userInitiated = false)
+
+    @SuppressLint("MissingPermission")
+    private fun connectInternal(model: WhoopModel, userInitiated: Boolean) {
         intentionalDisconnect = false
         // #1635: an explicit Connect is the user saying "try the handshake again" — the documented way out
-        // of hello suppression, and the reason suppression is never a permanent verdict.
-        helloRetryRequested = true
+        // of hello suppression, and the reason suppression is never a permanent verdict. Consumed by the
+        // first connect that reaches the hello decision, so it is granted here and nowhere else.
+        if (userInitiated) helloRetryRequested = true
         // PR #588: an explicit user-driven Connect is never an out-of-range retry — clear the involuntary-
         // reconnect streak so this scan (and any reconnects it spawns) starts back at the snappy
         // LOW_LATENCY scan mode + the 3s backoff base, never inheriting a backed-off lower-power scan.
@@ -3589,7 +3611,7 @@ class WhoopBleClient(
                 connectToDevice(dev, autoConnect = true)
             } else {
                 log("Bluetooth radio back on — rescanning for your ${selectedModel.displayName}")
-                connect(selectedModel)
+                connectFromSystem(selectedModel)
             }
         }
     }
@@ -3616,7 +3638,7 @@ class WhoopBleClient(
             intentionalDisconnect = false
             val dev = lastDevice
             if (dev != null && isPreferred(dev)) connectToDevice(dev, autoConnect = true)
-            else connect(selectedModel)
+            else connectFromSystem(selectedModel)
         }
     }
 
@@ -9963,7 +9985,7 @@ class WhoopBleClient(
                 }
                 // #1030 (ryanbr): route through scheduleReconnect so this backoff timer is cancellable
                 // and can't tear down a link that returns before it fires.
-                scheduleReconnect(RECONNECT_DELAY_MS) { connect(selectedModel) }
+                scheduleReconnect(RECONNECT_DELAY_MS) { connectFromSystem(selectedModel) }
                 return
             }
             val dev = lastDevice
@@ -9999,7 +10021,7 @@ class WhoopBleClient(
                 val rescanDelay = nextReconnectDelayMs()
                 log("Disconnected (status=$status); rescanning in ${rescanDelay / 1000}s (attempt $failedReconnectAttempts$heldSuffix)")
                 // #1030 (ryanbr): cancellable backoff timer (see scheduleReconnect).
-                scheduleReconnect(rescanDelay) { connect(selectedModel) }
+                scheduleReconnect(rescanDelay) { connectFromSystem(selectedModel) }
             }
         } else {
             log("Disconnected (intentional)")
diff --git a/android/app/src/test/java/com/noop/ble/SystemInitiatedConnectTest.kt b/android/app/src/test/java/com/noop/ble/SystemInitiatedConnectTest.kt
new file mode 100644
index 0000000000..f74a81eea4
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ble/SystemInitiatedConnectTest.kt
@@ -0,0 +1,87 @@
+package com.noop.ble
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.io.File
+
+/**
+ * #1635: only a USER gesture may grant the one-shot CLIENT_HELLO retry.
+ *
+ * This reads the source rather than calling the client, because the rule is about which ENTRY POINT a
+ * caller picks — there is no return value to assert on, and the client needs a radio. The regression it
+ * exists for already happened once: the stale-OS-bond fallback scheduled its reconnect through the
+ * user-facing `connect()`, so on a suppressed strap a scan-driven retry wrote a second unanswered hello
+ * and paid a second ~4.8s drop nobody asked for (field log 260901-1022, gen=3).
+ *
+ * Nothing else would have caught it. Every line that path produces is identical to a real user tap, the
+ * BLE path has no CI, and a unit test of the client cannot reach it. Apple has kept the two entries apart
+ * since #78 hole-2 and says so in `BLEManager.connect`'s doc; this is Android's version of that rule
+ * being enforced rather than remembered.
+ */
+class SystemInitiatedConnectTest {
+
+    /**
+     * Deliberately FAILS rather than skipping when the source cannot be found.
+     *
+     * The nearby [com.noop.protocol.CommandCatalogueTest] uses `Assume` for its schema, and that is right
+     * there: it reads a file from a SIBLING Swift package that a stripped checkout may genuinely not have.
+     * This one reads the file its own module is compiled from, so "not found" means the search is wrong,
+     * not that the environment is thin — and a regression gate that quietly declines to run is worse than
+     * no gate, because the green tick then means nothing. Walk the parents so any working directory
+     * resolves, and if none does, say so loudly.
+     */
+    private fun clientSource(): String {
+        val rel = "android/app/src/main/java/com/noop/ble/WhoopBleClient.kt"
+        val start = File(System.getProperty("user.dir") ?: ".").absoluteFile
+        val f = generateSequence(start) { it.parentFile }
+            .map { File(it, rel) }
+            .firstOrNull { it.isFile }
+        assertTrue(
+            "WhoopBleClient.kt not found walking up from user.dir=$start — this gate cannot run, and a " +
+                "gate that silently skips is worse than none. Fix the path, do not re-add an Assume.",
+            f != null,
+        )
+        return f!!.readText()
+    }
+
+    @Test
+    fun `a deferred reconnect never routes through the user-facing connect`() {
+        val offenders = Regex("""scheduleReconnect\([^)]*\)\s*\{\s*connect\(""")
+            .findAll(clientSource()).map { it.value }.toList()
+        assertEquals(
+            "a timer firing is not the user asking to retry the handshake — use connectFromSystem(...): " +
+                offenders,
+            0, offenders.size,
+        )
+    }
+
+    /**
+     * Deliberately "no internal caller uses the user entry" rather than "the system entry is used N
+     * times". A count would fail the day someone adds a FIFTH system path correctly, which trains people
+     * to edit the number instead of thinking; this phrasing passes for any correct addition and fails for
+     * any incorrect one. The client never needs to call its own public user entry — every internal path
+     * is by definition system-initiated.
+     */
+    @Test
+    fun `no internal path calls the user-facing connect`() {
+        val src = clientSource()
+        assertTrue("connectFromSystem must exist as the system-initiated entry",
+                   src.contains("fun connectFromSystem("))
+        val offenders = Regex("""(?<![A-Za-z])connect\((selectedModel|model|persistedWhoopModel\(\))\)""")
+            .findAll(src).map { it.value }.toList()
+        assertEquals(
+            "an internal caller is by definition not the user — use connectFromSystem(...): $offenders",
+            0, offenders.size,
+        )
+    }
+
+    @Test
+    fun `only the user entry grants the hello retry`() {
+        val src = clientSource()
+        val grants = Regex("""helloRetryRequested\s*=\s*true""").findAll(src).count()
+        assertEquals("the retry is granted in exactly one place, behind the userInitiated flag", 1, grants)
+        assertTrue("that one place must be gated on userInitiated",
+                   src.contains("if (userInitiated) helloRetryRequested = true"))
+    }
+}

From 2f32852ada509fe006926549391954022df28188 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 11:21:27 +1200
Subject: [PATCH 130/333] staging: build 404 / iOS 285 for the system-initiated
 connect split

Build numbers only - 10.6.1 stays the unreleased line, and 404 clears the
staging high-water so the APK installs over 403.

Carries the fix the 403 field log turned up: four system-initiated paths were
routing through the user-facing connect() and being handed the one-shot
handshake retry with it, so an automatic reconnect wrote a second unanswered
hello and cost a second ~4.8s drop after every manual reconnect.

What to watch on the 5/MG: tap Connect and expect ONE ~4.8s drop, then
"CLIENT_HELLO suppressed for this strap" on the very next link, then a link
that holds. On 403 that same tap cost two drops - gen=2 and gen=3 both wrote a
hello, and only gen=4 settled.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 5bf9f46e88..dd6b09b135 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 403
+        versionCode = 404
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 0d6ed9f79e..77868a32d7 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "284"
+    CURRENT_PROJECT_VERSION: "285"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 7bbef7a14a19eb4cf8a9aa38aae30eac617ac30d Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 12:13:22 +1200
Subject: [PATCH 131/333] sleep: let the HR band widen the sparse bridge's
 active bound, not be vetoed by it (#1782)

sparseBridgeActiveMaxMin's own doc calls the 30-minute bound "the cheap half of
the guard" and the HR band "the real one". The check order meant the cheap half
vetoed first, so the real one never got to speak for a run over 30 minutes: a
42-minute active run with hrInSleepBand=true was rejected exactly like one with
the wearer plainly up.

That is the wrong way round on a strap whose "active" verdict comes from MOTION,
which is the sparse and unreliable signal on the hardware this fires for. Field
log 260901-1022, night of 2026-08-27 - 20,647 gravity samples across 54 hours
against 109,868 HR:

  pair=1  gap=42m  active=42m  inBand=true  activeTooLong   <-- 12m over
  run=0   52 min -> DROPPED minSleepMin(60)

Had that pair bridged, the 52-minute run would have cleared the 60-minute floor
and the night would have staged. One threshold stood between a night and No Data.

sparseBridgeActiveMaxInBandMin = 60, applied as a MAXIMUM against the existing
bound so in-band can only ever be more permissive and an out-of-band span keeps
30 exactly. 60 because it is minSleepMin: an interruption long enough to be a
session in its own right is a genuine awakening whatever HR says.

Scope and exposure, stated rather than buried. The bridge does not merely span
the interruption - dropTrailing removes the active run and the merged period
covers it, so those minutes convert from active to sleep. This raises that
ceiling from 30 to 60 per bridge, and bridges chain (the same night shows
runsBefore=5 runsAfter=3), so worst-case sleep inflation per night roughly
doubles. It helps nights that HAVE motion; it does nothing for a 5/MG on the
live path, where grav=0 and reason=no-motion is the binding constraint.

No accuracy validation has run. The Tools/ sleep jobs are bitrot guards - the
workflow says the check needs no dataset - and the bridge is not in SleepPSG's
ported path. A SleepBench before/after on a real database is still owed.

Two tests pinned the old bound with calm HR and are repinned to the same shape
against the bound that now applies. Re-review caught a parity bug in the first
cut: Swift computed the cap from a captured local, so case 1 reported
activeCapMin=60 where Kotlin reported 0 - same behaviour, divergent trace. Both
platforms now pin that case.

Android 1792 analytics tests green; Swift 1686 green; 16 CI checks green.
---
 .../Sources/StrandAnalytics/SleepStager.swift | 38 +++++++++-
 .../SleepStagerActiveBridgeTests.swift        | 59 ++++++++++++++-
 .../java/com/noop/analytics/SleepStager.kt    | 36 ++++++++-
 .../analytics/SleepStagerActiveBridgeTest.kt  | 73 ++++++++++++++++++-
 4 files changed, 192 insertions(+), 14 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
index a38d70b5c0..4a30728dcb 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
@@ -245,6 +245,23 @@ public enum SleepStager {
     /// not. `mergeMin` (15) already absorbs shorter active runs upstream in `mergePeriods`.
     public static let sparseBridgeActiveMaxMin: Int = 30
 
+    /// The same bound when HR across the whole span stays in the sleep band.
+    ///
+    /// `sparseBridgeActiveMaxMin`'s own doc calls the minute bound "the cheap half of the guard" and the
+    /// HR band "the real one" — but the check order meant the cheap half vetoed first, so the real one
+    /// never got to speak for a run over 30 minutes. A 42-minute active run with sleep-band HR was
+    /// rejected identically to one with a wearer plainly up and about.
+    ///
+    /// That is the wrong way round on a strap whose "active" verdict comes from MOTION, which is the
+    /// sparse and unreliable signal on the hardware this fires for (field log 260901-1022: 20,647 gravity
+    /// samples across a 54-hour window, against 109,868 HR). HR is the better witness there, and it is
+    /// already computed. 60 rather than something larger because it is `minSleepMin`: an interruption
+    /// long enough to be a session in its own right is a genuine awakening whatever HR says.
+    ///
+    /// Applied as a MAXIMUM against `sparseBridgeActiveMaxMin`, never a replacement, so the in-band path
+    /// can only ever be more permissive — an out-of-band span keeps the 30-minute bound exactly.
+    public static let sparseBridgeActiveMaxInBandMin: Int = 60
+
     // MARK: - Stage 1–3 constants (sleep_features.py)
 
     public static let epochS: Double = 30.0
@@ -502,6 +519,8 @@ public enum SleepStager {
         let gapMin: Int
         /// Minutes of intervening ACTIVE run, or 0 when the pair was only separated by a gap (#1657).
         let activeMin: Int
+        /// The bound this pair was actually judged against — 30, or 60 when HR stayed in the sleep band.
+        let activeCapMin: Int
         /// Whether the intervening HR stayed in the sleep band (the bridge's second condition).
         let hrInSleepBand: Bool
         /// Whether this pair was merged.
@@ -535,6 +554,7 @@ public enum SleepStager {
         if !sparse || periods.isEmpty { return (periods, []) }
         let bridgeGapS = sparseBridgeGapMin * 60
         let activeMaxS = sparseBridgeActiveMaxMin * 60
+        let activeMaxInBandS = sparseBridgeActiveMaxInBandMin * 60
         var out: [Period] = []
         var attempts: [SparseBridgeAttempt] = []
 
@@ -543,18 +563,27 @@ public enum SleepStager {
         /// The order of the checks fixes which reason a failing pair reports, and it is deliberate:
         /// overlap and gap are properties of the pair, activeTooLong is a property of what sits between
         /// them, and hrOutOfBand is last because it is the only one that needed the HR series to decide.
+        /// `activeMaxInBandS` is a PARAMETER rather than a capture, mirroring the Kotlin default of 0.
+        /// Captured, case 1 (adjacent sleep runs, no intervening active run) would report activeCapMin=60
+        /// on Apple and 0 on Android for the identical decision — same behaviour, divergent trace, which
+        /// is exactly the byte-for-byte comparison these lines exist to allow.
         func consider(_ left: Period, _ right: Period, activeS: Int,
-                      dropTrailing: Bool, activeMaxS: Int) -> Bool {
+                      dropTrailing: Bool, activeMaxS: Int, activeMaxInBandS: Int = 0) -> Bool {
             let gap = right.start - left.end
             let inBand = hrSleepBandAcross(left.end, right.start, hr: hr, baseline: baseline)
+            // The HR band is the real guard, so let it widen the minute bound rather than be vetoed by
+            // it. max, not a swap: in-band can only ever be MORE permissive, and case 1 (activeMaxS = 0,
+            // no intervening run) is untouched because activeS is 0 there too.
+            let activeCapS = inBand ? max(activeMaxS, activeMaxInBandS) : activeMaxS
             let reason: String
             if gap < 0 { reason = "overlap" }
             else if gap > bridgeGapS { reason = "gapTooLong" }
-            else if activeS > activeMaxS { reason = "activeTooLong" }
+            else if activeS > activeCapS { reason = "activeTooLong" }
             else if !inBand { reason = "hrOutOfBand" }
             else { reason = "bridged" }
             let bridged = reason == "bridged"
             attempts.append(SparseBridgeAttempt(gapMin: gap / 60, activeMin: activeS / 60,
+                                                activeCapMin: activeCapS / 60,
                                                 hrInSleepBand: inBand, bridged: bridged, reason: reason))
             guard bridged else { return false }
             if dropTrailing { out.removeLast() }
@@ -574,7 +603,8 @@ public enum SleepStager {
                    out[out.count - 2].stage == "sleep" {
                     let prev = out[out.count - 2]
                     if consider(prev, p, activeS: last.end - last.start,
-                                dropTrailing: true, activeMaxS: activeMaxS) { continue }
+                                dropTrailing: true, activeMaxS: activeMaxS,
+                                activeMaxInBandS: activeMaxInBandS) { continue }
                 }
             }
             out.append(p)
@@ -1138,7 +1168,7 @@ public enum SleepStager {
             for (i, a) in bridgeAttempts.enumerated() {
                 traceSink(GateTrace.runLine(index: -1, startTs: 0, endTs: 0,
                     verdict: a.bridged ? .kept : .dropped, gate: "sparseBridgePair",
-                    detail: "pair=\(i) gapMin=\(a.gapMin) activeMin=\(a.activeMin) "
+                    detail: "pair=\(i) gapMin=\(a.gapMin) activeMin=\(a.activeMin) activeCapMin=\(a.activeCapMin) "
                         + "hrInSleepBand=\(a.hrInSleepBand) reason=\(a.reason)"))
             }
         }
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerActiveBridgeTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerActiveBridgeTests.swift
index 561e177b7f..ac82c1831d 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerActiveBridgeTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerActiveBridgeTests.swift
@@ -38,7 +38,8 @@ final class SleepStagerActiveBridgeTests: XCTestCase {
     /// absorbing it would score wakefulness as sleep — wrong in a new direction and harder to notice than
     /// the truncation being fixed.
     func testAnActiveRunLongerThanTheBoundIsLeftAlone() {
-        let tooLong = SleepStager.sparseBridgeActiveMaxMin * 60 + 60
+        // Repinned past the IN-BAND bound: this HR is calm, so that is the bound in force.
+        let tooLong = SleepStager.sparseBridgeActiveMaxInBandMin * 60 + 60
         let out = SleepStager.bridgeSparseSleep(
             [sleep(0, 3000), active(3000, 3000 + tooLong), sleep(3000 + tooLong, 9000)],
             sparse: true, hr: calmHr(0, 9000), baseline: baseline)
@@ -87,14 +88,17 @@ final class SleepStagerActiveBridgeTests: XCTestCase {
     /// The trace has to say WHY, and the blocking length is the number a reader needs. The old trace could
     /// only report runsBefore == runsAfter, which says the bridge did nothing and not what stopped it.
     func testABlockedPairReportsTheBoundThatBlockedItWithTheActiveLength() {
-        let tooLong = SleepStager.sparseBridgeActiveMaxMin * 60 + 60
+        // Repinned past the IN-BAND bound: this HR is calm, so that is the bound in force.
+        let tooLong = SleepStager.sparseBridgeActiveMaxInBandMin * 60 + 60
         let (_, attempts) = SleepStager.bridgeSparseSleepTraced(
             [sleep(0, 3000), active(3000, 3000 + tooLong), sleep(3000 + tooLong, 9000)],
             sparse: true, hr: calmHr(0, 9000), baseline: baseline)
         XCTAssertEqual(attempts.count, 1)
         XCTAssertEqual(attempts.first?.reason, "activeTooLong")
         XCTAssertEqual(attempts.first?.bridged, false)
-        XCTAssertEqual(attempts.first?.activeMin, SleepStager.sparseBridgeActiveMaxMin + 1)
+        XCTAssertEqual(attempts.first?.activeMin, SleepStager.sparseBridgeActiveMaxInBandMin + 1)
+        // And it names WHICH bound, or the same activeMin reads blocked in one log, merged in another.
+        XCTAssertEqual(attempts.first?.activeCapMin, SleepStager.sparseBridgeActiveMaxInBandMin)
     }
 
     /// The tracer and the merge are ONE pass now. This file used to keep a shadow copy of the loop purely
@@ -200,4 +204,53 @@ final class SleepStagerActiveBridgeTests: XCTestCase {
             "gate run=-1 spanS=0 DROPPED gate=sparseBridgePair "
                 + "pair=0 gapMin=23 activeMin=21 hrInSleepBand=true reason=activeTooLong")
     }
+
+    /// The change this constant exists for. A 45-minute interruption sits between the two bounds: over
+    /// the 30-minute default, under the 60-minute in-band one. With HR in the sleep band the whole way it
+    /// is now absorbed, where before the minute bound vetoed before HR was ever consulted.
+    ///
+    /// Field shape, not invented: log 260901-1022 had a 42-minute active run with hrInSleepBand=true
+    /// dropped as activeTooLong, and the 52-minute sleep run it would have joined then died on the
+    /// 60-minute minimum. Kotlin twin: "an active run past the default bound is absorbed when HR stays
+    /// in the sleep band".
+    func testActiveRunPastTheDefaultBoundIsAbsorbedWhenHRStaysInTheSleepBand() {
+        let mid = SleepStager.sparseBridgeActiveMaxMin * 60 + 15 * 60   // 45 min
+        let periods = [sleep(0, 3000), active(3000, 3000 + mid), sleep(3000 + mid, 9000)]
+        let out = SleepStager.bridgeSparseSleep(periods, sparse: true, hr: calmHr(0, 9000), baseline: baseline)
+        XCTAssertEqual(out.count, 1)
+        XCTAssertEqual(out.first?.stage, "sleep")
+        XCTAssertEqual(out.first?.start, 0)
+        XCTAssertEqual(out.first?.end, 9000)
+    }
+
+    /// ...and the widened bound is not a licence. The same 45 minutes with the wearer plainly up still
+    /// fails, because in-band is the CONDITION for the wider bound, not a separate escape from it.
+    func testTheWiderBoundDoesNotApplyWhenHRIsElevated() {
+        let mid = SleepStager.sparseBridgeActiveMaxMin * 60 + 15 * 60
+        let periods = [sleep(0, 3000), active(3000, 3000 + mid), sleep(3000 + mid, 9000)]
+        let hot = calmHr(0, 3000) + calmHr(3001, 3000 + mid, bpm: 110) + calmHr(3001 + mid, 9000)
+        let out = SleepStager.bridgeSparseSleep(periods, sparse: true, hr: hot, baseline: baseline)
+        XCTAssertEqual(out.count, 3)
+    }
+
+    /// The in-band bound may only ever widen, and it stops at `minSleepMin`.
+    func testTheInBandBoundIsAMaximumNeverAReplacement() {
+        XCTAssertGreaterThanOrEqual(SleepStager.sparseBridgeActiveMaxInBandMin,
+                                    SleepStager.sparseBridgeActiveMaxMin)
+        XCTAssertEqual(SleepStager.sparseBridgeActiveMaxInBandMin, SleepStager.minSleepMin)
+    }
+
+    /// Case 1 (two adjacent sleep runs, nothing between) has NO active run, so the bound it reports must
+    /// be 0 on both platforms — not the in-band 60. Computing the cap from a captured local rather than a
+    /// parameter made this report 60 for the identical decision: same behaviour, divergent trace.
+    /// Kotlin twin: "an adjacent-pair merge reports no active bound".
+    func testAnAdjacentPairMergeReportsNoActiveBound() {
+        let (_, attempts) = SleepStager.bridgeSparseSleepTraced(
+            [sleep(0, 3000), sleep(3600, 9000)],
+            sparse: true, hr: calmHr(0, 9000), baseline: baseline)
+        XCTAssertEqual(attempts.count, 1)
+        XCTAssertEqual(attempts.first?.reason, "bridged")
+        XCTAssertEqual(attempts.first?.activeMin, 0)
+        XCTAssertEqual(attempts.first?.activeCapMin, 0)
+    }
 }
diff --git a/android/app/src/main/java/com/noop/analytics/SleepStager.kt b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
index 7016c12c55..9b3fd068fc 100644
--- a/android/app/src/main/java/com/noop/analytics/SleepStager.kt
+++ b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
@@ -343,6 +343,25 @@ object SleepStager {
      */
     const val sparseBridgeActiveMaxMin: Int = 30
 
+    /**
+     * The same bound when HR across the whole span stays in the sleep band.
+     *
+     * [sparseBridgeActiveMaxMin]'s own doc calls the minute bound "the cheap half of the guard" and the HR
+     * band "the real one" — but the check order meant the cheap half vetoed first, so the real one never
+     * got to speak for a run over 30 minutes. A 42-minute active run with sleep-band HR was rejected
+     * identically to one with a wearer plainly up and about.
+     *
+     * That is the wrong way round on a strap whose "active" verdict comes from MOTION, which is the sparse
+     * and unreliable signal on the hardware this fires for (field log 260901-1022: 20,647 gravity samples
+     * across a 54-hour window, against 109,868 HR). HR is the better witness there, and it is already
+     * computed. 60 rather than something larger because it is [minSleepMin]: an interruption long enough
+     * to be a session in its own right is a genuine awakening whatever HR says, and must still split.
+     *
+     * Applied as a MAXIMUM against [sparseBridgeActiveMaxMin], never a replacement, so the in-band path
+     * can only ever be more permissive — an out-of-band span keeps the 30-minute bound exactly.
+     */
+    const val sparseBridgeActiveMaxInBandMin: Int = 60
+
     // ── Stage 1–3 constants (sleep_features.py) ──────────────────────────────
 
     const val epochS: Double = 30.0
@@ -654,6 +673,8 @@ object SleepStager {
         val gapMin: Long,
         /** Minutes of intervening ACTIVE run, or 0 when the pair was only separated by a gap. */
         val activeMin: Long,
+        /** The bound this pair was actually judged against — 30, or 60 when HR stayed in the sleep band. */
+        val activeCapMin: Long,
         /** Whether the intervening HR stayed in the sleep band. */
         val hrInSleepBand: Boolean,
         /** Whether this pair was merged. */
@@ -681,6 +702,7 @@ object SleepStager {
         if (!sparse || periods.isEmpty()) return periods to emptyList()
         val bridgeGapS = (sparseBridgeGapMin * 60).toLong()
         val activeMaxS = (sparseBridgeActiveMaxMin * 60).toLong()
+        val activeMaxInBandS = (sparseBridgeActiveMaxInBandMin * 60).toLong()
         val out = ArrayList<Period>()
         val attempts = ArrayList<SparseBridgeAttempt>()
         for (p in periods) {
@@ -696,7 +718,8 @@ object SleepStager {
                 if (last != null && last.stage == "active" && prev != null && prev.stage == "sleep") {
                     val activeS = last.end - last.start
                     if (considerBridge(out, attempts, prev, p, activeS, bridgeGapS, hr, baseline,
-                                       dropTrailing = true, activeMaxS = activeMaxS)) continue
+                                       dropTrailing = true, activeMaxS = activeMaxS,
+                                       activeMaxInBandS = activeMaxInBandS)) continue
                 }
             }
             out.add(p)
@@ -716,19 +739,24 @@ object SleepStager {
         out: ArrayList<Period>, attempts: ArrayList<SparseBridgeAttempt>,
         left: Period, right: Period, activeS: Long, bridgeGapS: Long,
         hr: List<HrSample>, baseline: Double?,
-        dropTrailing: Boolean = false, activeMaxS: Long = 0L,
+        dropTrailing: Boolean = false, activeMaxS: Long = 0L, activeMaxInBandS: Long = 0L,
     ): Boolean {
         val gap = right.start - left.end
         val inBand = hrSleepBandAcross(left.end, right.start, hr, baseline)
+        // The HR band is the real guard, so let it widen the minute bound rather than be vetoed by it.
+        // maxOf, not a swap: in-band can only ever be MORE permissive, and case 1 (activeMaxS = 0, no
+        // intervening run) is untouched because activeS is 0 there too.
+        val activeCapS = if (inBand) maxOf(activeMaxS, activeMaxInBandS) else activeMaxS
         val reason = when {
             gap < 0 -> "overlap"
             gap > bridgeGapS -> "gapTooLong"
-            activeS > activeMaxS -> "activeTooLong"
+            activeS > activeCapS -> "activeTooLong"
             !inBand -> "hrOutOfBand"
             else -> "bridged"
         }
         val bridged = reason == "bridged"
         attempts.add(SparseBridgeAttempt(gapMin = gap / 60, activeMin = activeS / 60,
+                                         activeCapMin = activeCapS / 60,
                                          hrInSleepBand = inBand, bridged = bridged, reason = reason))
         if (!bridged) return false
         if (dropTrailing) out.removeAt(out.size - 1)
@@ -1287,7 +1315,7 @@ object SleepStager {
                 traceSink(SleepStagerTrace.runLine(-1, 0, 0,
                     if (a.bridged) SleepStagerTrace.Verdict.KEPT else SleepStagerTrace.Verdict.DROPPED,
                     "sparseBridgePair",
-                    "pair=$i gapMin=${a.gapMin} activeMin=${a.activeMin} " +
+                    "pair=$i gapMin=${a.gapMin} activeMin=${a.activeMin} activeCapMin=${a.activeCapMin} " +
                         "hrInSleepBand=${a.hrInSleepBand} reason=${a.reason}"))
             }
         }
diff --git a/android/app/src/test/java/com/noop/analytics/SleepStagerActiveBridgeTest.kt b/android/app/src/test/java/com/noop/analytics/SleepStagerActiveBridgeTest.kt
index e4bacdfe5d..ce54d48771 100644
--- a/android/app/src/test/java/com/noop/analytics/SleepStagerActiveBridgeTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/SleepStagerActiveBridgeTest.kt
@@ -46,7 +46,10 @@ class SleepStagerActiveBridgeTest {
      */
     @Test
     fun `an active run longer than the bound is left alone`() {
-        val tooLong = (SleepStager.sparseBridgeActiveMaxMin * 60L) + 60L
+        // Repinned, same shape: with calm HR the applicable bound is the IN-BAND one, so "longer than
+        // the bound" has to be measured against that. Using the 30-minute figure here would now be
+        // asserting the old behaviour rather than the invariant, which is still "past the bound, no merge".
+        val tooLong = (SleepStager.sparseBridgeActiveMaxInBandMin * 60L) + 60L
         val periods = listOf(sleep(0, 3000), active(3000, 3000 + tooLong), sleep(3000 + tooLong, 9000))
         val out = SleepStager.bridgeSparseSleep(periods, sparse = true, hr = calmHr(0, 9000), baseline = baseline)
         assertEquals(3, out.size)
@@ -100,7 +103,10 @@ class SleepStagerActiveBridgeTest {
      */
     @Test
     fun `a blocked pair reports the bound that blocked it, with the active length`() {
-        val tooLong = (SleepStager.sparseBridgeActiveMaxMin * 60L) + 60L
+        // Repinned past the IN-BAND bound: this HR is calm, so that is the bound in force. Same
+        // invariant — a pair blocked on length says so and reports the length — measured against the
+        // rule that actually applied rather than the one that used to.
+        val tooLong = (SleepStager.sparseBridgeActiveMaxInBandMin * 60L) + 60L
         val periods = listOf(sleep(0, 3000), active(3000, 3000 + tooLong), sleep(3000 + tooLong, 9000))
         val (_, attempts) = SleepStager.bridgeSparseSleepTraced(
             periods, sparse = true, hr = calmHr(0, 9000), baseline = baseline,
@@ -108,7 +114,9 @@ class SleepStagerActiveBridgeTest {
         assertEquals(1, attempts.size)
         assertEquals("activeTooLong", attempts[0].reason)
         assertFalse(attempts[0].bridged)
-        assertEquals(SleepStager.sparseBridgeActiveMaxMin + 1L, attempts[0].activeMin)
+        assertEquals(SleepStager.sparseBridgeActiveMaxInBandMin + 1L, attempts[0].activeMin)
+        // And it names WHICH bound, or the same activeMin looks blocked in one log and merged in another.
+        assertEquals(SleepStager.sparseBridgeActiveMaxInBandMin.toLong(), attempts[0].activeCapMin)
     }
 
     /**
@@ -227,4 +235,63 @@ class SleepStagerActiveBridgeTest {
             line,
         )
     }
+
+    /**
+     * The change this constant exists for. A 45-minute interruption sits between the two bounds: over the
+     * 30-minute default, under the 60-minute in-band one. With HR in the sleep band the whole way it is
+     * now absorbed, where before the minute bound vetoed before HR was ever consulted.
+     *
+     * Field shape, not invented: log 260901-1022 had a 42-minute active run with hrInSleepBand=true
+     * dropped as activeTooLong, and the 52-minute sleep run it would have joined then died on the
+     * 60-minute minimum. One threshold stood between a staged night and No Data.
+     */
+    @Test
+    fun `an active run past the default bound is absorbed when HR stays in the sleep band`() {
+        val mid = (SleepStager.sparseBridgeActiveMaxMin * 60L) + (15 * 60L)   // 45 min
+        val periods = listOf(sleep(0, 3000), active(3000, 3000 + mid), sleep(3000 + mid, 9000))
+        val out = SleepStager.bridgeSparseSleep(periods, sparse = true, hr = calmHr(0, 9000), baseline = baseline)
+        assertEquals(1, out.size)
+        assertEquals("sleep", out[0].stage)
+        assertEquals(0L, out[0].start)
+        assertEquals(9000L, out[0].end)
+    }
+
+    /**
+     * ...and the widened bound is not a licence. The same 45 minutes with the wearer plainly up still
+     * fails, because in-band is the CONDITION for the wider bound, not a separate escape from it.
+     */
+    @Test
+    fun `the wider bound does not apply when HR is elevated`() {
+        val mid = (SleepStager.sparseBridgeActiveMaxMin * 60L) + (15 * 60L)
+        val periods = listOf(sleep(0, 3000), active(3000, 3000 + mid), sleep(3000 + mid, 9000))
+        val hot = calmHr(0, 3000) + calmHr(3001, 3000 + mid, bpm = 110) + calmHr(3001 + mid, 9000)
+        val out = SleepStager.bridgeSparseSleep(periods, sparse = true, hr = hot, baseline = baseline)
+        assertEquals(3, out.size)
+    }
+
+    /** The in-band bound may only ever widen: an out-of-band span keeps the 30-minute one exactly. */
+    @Test
+    fun `the in-band bound is a maximum, never a replacement`() {
+        assertTrue(SleepStager.sparseBridgeActiveMaxInBandMin >= SleepStager.sparseBridgeActiveMaxMin)
+        // And it stops at minSleepMin: past that an interruption is a session of its own, whatever HR says.
+        assertEquals(SleepStager.minSleepMin, SleepStager.sparseBridgeActiveMaxInBandMin)
+    }
+
+    /**
+     * Case 1 (two adjacent sleep runs, nothing between) has NO active run, so the bound it reports must
+     * be 0 on both platforms — not the in-band 60. Swift computed the cap from a captured local rather
+     * than a parameter, which made it report 60 here for the identical decision: same behaviour, divergent
+     * trace, defeating the byte-for-byte comparison these lines exist to allow.
+     */
+    @Test
+    fun `an adjacent-pair merge reports no active bound`() {
+        val (_, attempts) = SleepStager.bridgeSparseSleepTraced(
+            listOf(sleep(0, 3000), sleep(3600, 9000)),
+            sparse = true, hr = calmHr(0, 9000), baseline = baseline,
+        )
+        assertEquals(1, attempts.size)
+        assertEquals("bridged", attempts[0].reason)
+        assertEquals(0L, attempts[0].activeMin)
+        assertEquals(0L, attempts[0].activeCapMin)
+    }
 }

From efc9894431a13af528f50ddd0d107ec35fe2551a Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 12:13:46 +1200
Subject: [PATCH 132/333] staging: build 405 / iOS 286 for the sparse-bridge
 in-band bound

Build numbers only - 10.6.1 stays the unreleased line, and 405 clears the
staging high-water so the APK installs over 404.

Carries a SCORING change, so it is worth saying what to expect rather than
just what to test. On sparse nights the bridge may now absorb an interruption
of up to 60 minutes when HR stayed in the sleep band, where the bound was 30
regardless of HR. Those minutes convert from active to sleep, and bridges chain,
so nights that previously staged as nothing may now stage and nights that staged
may stage longer. Re-scoring moves history: past nights can change without the
wearer doing anything.

What to watch: the new activeCapMin= field on the sparseBridgePair trace lines
says which bound each pair was judged against, 30 or 60, so a merged pair can be
told from a blocked one at a glance.

This does NOT change a 5/MG on the live path - grav=0 there and the stager needs
motion, so reason=no-motion still ends every night before the bridge is reached.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index dd6b09b135..ddf5d30fb7 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 404
+        versionCode = 405
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 77868a32d7..f096a42278 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "285"
+    CURRENT_PROJECT_VERSION: "286"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 7b566f578c232e49954cfc5dc9d8b77718cd8433 Mon Sep 17 00:00:00 2001
From: Pipiche <8291674+pipiche38@users.noreply.github.com>
Date: Tue, 1 Sep 2026 02:38:59 +0200
Subject: [PATCH 133/333] fix(oura): list a bonded ring that advertises no
 local name (#1776)

The scan callback dropped every result whose advertised name did not recognise
as an Oura ring. DeviceBrandCatalog.specForAdvertisedName matches by SUBSTRING,
so recognise("") is null - no brand token is a substring of the empty string -
and a ring advertising no local name was rejected.

That is the ring the user most wants. A bonded ring commonly stops advertising a
local name, and Android's device.name bond-cache fallback is also empty when the
bond lives on another phone or another install, so the Add-Device wizard could
not show the one ring being reconnected to.

Removing the check is safe because it was never the gate. startScan pins
SERVICE_UUID (98ED0001-A541-11E4-..., vendor-specific 128-bit) in a hardware
ScanFilter, so discovery does not widen to unrelated peripherals.

It also closes a cross-platform divergence rather than opening one: Apple's
callback has always appended unconditionally, with no name or generation drop.
The Swift change here is comment-only, recording why neither side may re-add it.

The new test says outright that its assertions hold both before and after - the
fix is live BLE discovery and is validated on hardware, not in JVM tests. That
is the honest framing, and the assertions still earn their place: anyone
reinstating a name gate sees headlessly that a blank name recognises as nothing.

Verified before merge: the substring premise, the ScanFilter as the real gate,
the Apple parity claim read from its callback, and 811 tests across 90 Oura/BLE
suites green on the PR head.

Follow-up, not a blocker: neither platform blank-guards the name it now
surfaces, so a nameless ring lists with an empty title line. Apple already does
exactly that guard for WHOOP in AddDeviceWizard.swift; Oura does not.

Thanks @pipiche38.
---
 Strand/BLE/OuraLiveSource.swift               |  9 +++-
 .../main/java/com/noop/ble/OuraLiveSource.kt  | 20 +++++---
 .../noop/ble/OuraNamelessRingDiscoveryTest.kt | 46 +++++++++++++++++++
 3 files changed, 66 insertions(+), 9 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ble/OuraNamelessRingDiscoveryTest.kt

diff --git a/Strand/BLE/OuraLiveSource.swift b/Strand/BLE/OuraLiveSource.swift
index 106ece6ac4..1083799a43 100644
--- a/Strand/BLE/OuraLiveSource.swift
+++ b/Strand/BLE/OuraLiveSource.swift
@@ -2201,8 +2201,13 @@ extension OuraLiveSource: @preconcurrency CBCentralManagerDelegate {
                                rssi RSSI: NSNumber) {
         let advName = advertisementData[CBAdvertisementDataLocalNameKey] as? String
         let name = advName ?? peripheral.name ?? ""
-        // The scan already filters on the Oura service, but re-check the name through the gen recogniser
-        // so a coincidental service match without an Oura-shaped name is dropped (best-effort).
+        // Best-effort generation guess from the advertised name — a LABEL only (the wizard falls back to
+        // .gen3 when it is nil). Nothing is dropped here: the scan's service filter is the only gate, so a
+        // ring is listed even when it advertises no local name at all. That is deliberate — a BONDED ring
+        // often stops advertising one, and treating the empty name as a miss is the bug the Android twin
+        // carried (`ExperimentalBrand.recognise(name) != OURA` in `ble/OuraLiveSource.kt`, where
+        // `recognise("")` is nil) until it was brought in line with this side. Do not "restore" a
+        // name-based drop on either platform.
         let detectedGen = OuraRingGen.recognise(advertisedName: name)
         let id = peripheral.identifier
         let firstSight = seenPeripherals[id] == nil
diff --git a/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt b/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt
index 1d5f797f39..fb56ab533a 100644
--- a/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt
+++ b/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt
@@ -870,8 +870,9 @@ class OuraLiveSource(
             log("Oura: Bluetooth adapter is off - cannot scan")
             return
         }
-        // Filter by the ring's base service so a broad scan does not surface unrelated peripherals; the
-        // callback further confirms the advertised name reads as an Oura ring.
+        // Filter by the ring's base service so a broad scan does not surface unrelated peripherals. This
+        // ScanFilter is the ONLY discovery gate — the callback does not re-filter on the advertised name,
+        // because a bonded ring often advertises none; see the note in `scanCallback`.
         val filter = ScanFilter.Builder()
             .setServiceUuid(ParcelUuid(SERVICE_UUID))
             .build()
@@ -1099,12 +1100,17 @@ class OuraLiveSource(
             val device = result.device ?: return
             val address = device.address ?: return
             val name = result.scanRecord?.deviceName ?: runCatching { device.name }.getOrNull() ?: ""
-            // Confirm the advertised name reads as an Oura ring (the service filter is the primary gate;
-            // this rejects anything that slipped through advertising the same base service).
-            if (ExperimentalBrand.recognise(name) != ExperimentalBrand.OURA) return
             val firstSight = seen.put(address, device) == null   // null → not seen before this scan
-            if (firstSight) log("Oura: found $name ($address) rssi ${result.rssi}")
-            // Best-effort generation guess from the advertised name (confirmed by the model the user picks).
+            if (firstSight) log("Oura: found ${name.ifBlank { "Oura ring" }} ($address) rssi ${result.rssi}")
+            // Best-effort generation guess from the advertised name — a LABEL only (the wizard falls back
+            // to GEN3 when it is null). Nothing is dropped here: startScan's ScanFilter pins SERVICE_UUID in
+            // the BT stack, so that is the gate, and a ring is listed even when it advertises no local name
+            // at all. This callback USED TO drop a nameless device (`ExperimentalBrand.recognise(name) !=
+            // OURA`, and `recognise("")` is null because no brand token is a substring of ""), so a BONDED
+            // ring — which often stops advertising a local name, and whose Android `device.name` bond-cache
+            // fallback is empty when the bond lives elsewhere — was the one ring the wizard could not show.
+            // Twin of the Apple side (Strand/BLE/OuraLiveSource.swift), which has always listed on the
+            // service filter alone. Do not re-add a name-based drop here.
             val detectedGen = OuraRingGen.recognise(name)
             val ring = DiscoveredRing(
                 address = address,
diff --git a/android/app/src/test/java/com/noop/ble/OuraNamelessRingDiscoveryTest.kt b/android/app/src/test/java/com/noop/ble/OuraNamelessRingDiscoveryTest.kt
new file mode 100644
index 0000000000..f5da17eb26
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ble/OuraNamelessRingDiscoveryTest.kt
@@ -0,0 +1,46 @@
+package com.noop.ble
+
+import com.noop.data.DeviceBrandCatalog
+import com.noop.oura.OuraRingGen
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/**
+ * Pins why the Oura scan callback must NOT gate discovery on the advertised name (open_oura issue #13).
+ *
+ * The measured bug: `OuraLiveSource.scanCallback` dropped every result whose name did not recognise as
+ * Oura (`ExperimentalBrand.recognise(name) != OURA`). A BONDED ring often stops advertising a local name,
+ * and Android's `device.name` bond-cache fallback is empty when the bond lives elsewhere, so `name` is
+ * `""` — and no brand token is a substring of `""`, so the gate rejected the one ring the user most wanted
+ * to reconnect to. It still advertised SERVICE_UUID, so `startScan`'s ScanFilter had already accepted it.
+ *
+ * These assertions are the trap itself, not the fix: they hold both before and after. They exist so that
+ * anyone reinstating a name-based drop sees, headlessly, that a blank name recognises as nothing. The fix
+ * (no name gate in the callback; the ScanFilter is the only gate) is a live BLE discovery behaviour and
+ * cannot be asserted here — it is validated on hardware. Apple has always behaved this way
+ * (Strand/BLE/OuraLiveSource.swift), so this also closes a cross-platform divergence.
+ */
+class OuraNamelessRingDiscoveryTest {
+
+    @Test
+    fun `a blank advertised name recognises as no brand - the whole bug`() {
+        assertNull("no brand token is a substring of \"\"",
+                   DeviceBrandCatalog.specForAdvertisedName(""))
+        assertNull("so the old callback gate dropped a nameless bonded ring",
+                   ExperimentalBrand.recognise(""))
+    }
+
+    @Test
+    fun `a named ring recognises fine, so the bug was specific to the nameless case`() {
+        assertEquals(ExperimentalBrand.OURA, ExperimentalBrand.recognise("Oura Ring 4"))
+        assertEquals(ExperimentalBrand.OURA, ExperimentalBrand.recognise("oura 2h3b2405003655"))
+    }
+
+    @Test
+    fun `a nameless ring also has no detectable generation, so the wizard must default`() {
+        // `AddDeviceWizard` reads `ring.detectedGen ?: OuraRingGen.GEN3` and labels it "Oura ring";
+        // the Apple twin does the same. Listing a nameless ring therefore needs no further wiring.
+        assertNull(OuraRingGen.recognise(""))
+    }
+}

From 708d1f1a3421e34ea3ab01277eedcef1827e0e30 Mon Sep 17 00:00:00 2001
From: Pipiche <8291674+pipiche38@users.noreply.github.com>
Date: Tue, 1 Sep 2026 02:39:16 +0200
Subject: [PATCH 134/333] doc(oura): record the 0x6A motion_count guard
 discrepancy vs open_oura (#1777)

NOOP's two 0x6A decoders and OURA_PROTOCOL.md 6.12 reject a body with
motion_count >= 121; open_oura's decode_sleep_period_info rejects >= 120. Both
cite the same RepNumericRangeError throw in the native
parse_api_sleep_period_info, so one of the two clean-room re-derivations is off
by one, and only the binary can settle it - not more nights.

Measured impact is none. Across the 0x6A capture corpus motion_count maxes at
55, with nothing above 100 and no record at 120, while sleep_state is only ever
0 or 1. Neither guard has ever fired on real data and no record has landed in
the disputed slot.

So this changes no code. It records the discrepancy in the doc's established
warning convention, with the explicit instruction not to "correct" NOOP into
agreement and call that a fix - which is exactly the mistake an unrecorded
difference invites from the next reader.

Worth stating for the record: both of its measurements are external to this
repo. The capture corpus is not tracked here and the open_oura reading has no
link in the doc, so accepting them is a trust call on the contributor's numbers
rather than something CI or a reviewer can re-run. The bounded blast radius -
documentation only, recommending no change - is what makes that acceptable.

Thanks @pipiche38.
---
 docs/OURA_PROTOCOL.md | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/docs/OURA_PROTOCOL.md b/docs/OURA_PROTOCOL.md
index 62444c91c6..2efce02a17 100644
--- a/docs/OURA_PROTOCOL.md
+++ b/docs/OURA_PROTOCOL.md
@@ -738,6 +738,20 @@ like its sibling banked streams (`.hrv`/`.temp`/`.spo2`/`.sleepPhase`) — the f
   | 7 | `sleep_state` | u8 | — | source's parser THROWS if ∉ {0,1,2} |
   | 8–9 | `cv` | u16 LE | / 65536 | ⇒ [0,1) |
 
+  ⚠️ **The `motion_count` guard differs by ONE between the two independent re-derivations of the same
+  native function, and our corpus cannot settle it.** NOOP (the table above and both platform decoders)
+  rejects a body with `motion_count ≥ 121`; [open_oura]'s `decode_sleep_period_info` (PR #15, merged
+  2026-08-31) rejects `≥ 120`. Both cite the same `RepNumericRangeError` throw in
+  `parse_api_sleep_period_info`, so one of the two readings is off by one — settling it needs the binary,
+  not more nights. **Measured impact: none.** Across **8 075** distinct `0x6A` records in NOOP's capture
+  corpus (every `oura-resp.jsonl` held under `worklog/artifacts/Sleep Nights/`, de-duplicated by `ringTs`)
+  `motion_count` maxes at **55** — modal value 0, *nothing* ≥ 100, and **no record at 120** — while
+  `sleep_state` is only ever 0 or 1. Neither guard has ever fired on real data and no record has ever
+  landed in the disputed slot. ⇒ **Leave NOOP's `< 121` as it stands: this is a documented open
+  discrepancy, not a bug to "fix" into agreement with upstream.** (Weak physical argument for `< 121`, not
+  evidence: at a ~296 s cadence a bounded per-window tally with an *inclusive* upper bound throws at
+  ≥ 121, not ≥ 120.)
+
   **CORRECTION to this line's previous revision**, which read *"bytes6–9 four int8 metrics; bytes10–11
   `uint8/8.0`; byte12 motion-seconds; byte13 sleep-state int8; bytes14–15 uint16 LE/65536"* [ringverse]:
   the OFFSETS were right and the `/8.0` was right, but there were **no names** — so the tag looked like

From 8c9fca0f961df096e99a24092464394740bc2f80 Mon Sep 17 00:00:00 2001
From: Kevin Rajan <7121943+kvnloo@users.noreply.github.com>
Date: Mon, 31 Aug 2026 19:47:08 -0500
Subject: [PATCH 135/333] Add an opt-in pre-sleep heart-rate feedback contract
 (#1772)

A pure StrandAnalytics slice: select a half-open window before the longest
supplied sleep session, compare its mean against a personal rolling baseline
built from strictly prior days, and report why a reading is or is not available.
It neither diagnoses nor recommends; Journal answers come back as same-day facts
with no causal claim attached.

The care shows in the places that usually go wrong. Session duration and window
start both use subtractingReportingOverflow, so an extreme session fails closed
instead of trapping. Day canonicalisation validates by ROUND-TRIP through
Calendar, which is what actually rejects 2026-02-31 where a shape check would
not. The baseline takes strictly prior days, deduplicated to one reading per day
and sorted oldest-to-newest because rollingMeanSD requires that order - the PR's
own RED notes show that ordering was wrong first and a test caught it. And it
invents no scoring model: MetricCfg, Baselines.rollingMeanSD, BaselineState,
computeStatus and the existing HR plausibility range are all reused.

Two facts recorded here rather than left to be rediscovered.

It has NO caller. That is deliberate and stated - the integration is #1760 - but
it means 534 lines ship unreachable, and this repo shipped an unwired diagnostic
sink three days ago that did nothing until it was wired.

It has no Kotlin twin, and would be the first analytics type without one: 82 of
97 non-extension StrandAnalytics sources have a same-named .kt, and the
exceptions still carry Kotlin symbols elsewhere. Searched three ways - filename,
concept, and each distinctive member - Android implements none of this under any
name. Unlike ExplicitBond or BondStateTrace, which are Android-only and say so
with a PARITY note giving a CoreBluetooth reason, there is no platform barrier
here: Android already has Baselines, MetricCfg, BaselineState and journal
entries. The twin is cheapest now, while the type is pure and uncalled and its
tests port mechanically; once iOS UI depends on its exact numbers a later Kotlin
version has to reproduce them rather than be derived alongside them.

A follow-up issue tracks the twin and two nits found in review.

Verified before merge: 11 tests green locally on Linux with the snapshot-SQLite
harness, all 16 CI checks green, and #1760 is a real open issue.

Thanks @kvnloo.
---
 .../PreSleepHeartRateFeedback.swift           | 275 ++++++++++++++++++
 .../PreSleepHeartRateFeedbackTests.swift      | 259 +++++++++++++++++
 2 files changed, 534 insertions(+)
 create mode 100644 Packages/StrandAnalytics/Sources/StrandAnalytics/PreSleepHeartRateFeedback.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/PreSleepHeartRateFeedbackTests.swift

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/PreSleepHeartRateFeedback.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/PreSleepHeartRateFeedback.swift
new file mode 100644
index 0000000000..7db990e18c
--- /dev/null
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/PreSleepHeartRateFeedback.swift
@@ -0,0 +1,275 @@
+import Foundation
+import WhoopProtocol
+import WhoopStore
+
+/// An opt-in, descriptive pre-sleep heart-rate reading for the following morning.
+///
+/// The caller supplies a timestamp-coalesced HR timeline: Repository's existing HR reads already
+/// coalesce measured and PPG-derived samples, with measured data taking precedence. This type selects
+/// the longest supplied sleep session, reads the declared half-open window immediately before it, and
+/// compares that observation with a personal rolling baseline. It neither diagnoses nor recommends an
+/// action. Journal answers are returned only as facts from the same day; one night cannot establish an
+/// association, so they never alter the reading or become an insight.
+public enum PreSleepHeartRateFeedback {
+    /// Baseline configuration deliberately shares the existing HR plausibility range while keeping a
+    /// small floor spread for transparent personal comparison. `rollingMeanSD` is the existing auditable
+    /// baseline primitive; this is not a new scoring model.
+    public static let baselineCfg = MetricCfg(minVal: SleepHeartRateContrast.validMinBpm,
+                                              maxVal: SleepHeartRateContrast.validMaxBpm,
+                                              floorSpread: 2,
+                                              halfLifeB: 14,
+                                              halfLifeS: 21)
+    public static let defaultPreSleepWindowSeconds = 30 * 60
+    public static let defaultMinimumValidSamples = 10
+    public static let minimumBaselineNights = Baselines.minNightsSeed
+
+    /// A prior eligible pre-sleep observation. Callers persist/assemble history; this pure slice does
+    /// not write, schedule a prompt, or penalize a missing night.
+    public struct HistoricalReading: Equatable, Sendable {
+        public let day: String
+        public let meanBpm: Double
+
+        public init(day: String, meanBpm: Double) {
+            self.day = day
+            self.meanBpm = meanBpm
+        }
+    }
+
+    /// Why a morning reading is or is not available. Every non-eligible state is recoverable on a
+    /// later, sufficiently covered night; none creates a streak, goal, or obligation.
+    public enum Eligibility: Equatable, Sendable {
+        case disabled
+        case invalidDay
+        case invalidWindow
+        case missingPrimarySleep
+        case insufficientPreSleepSamples(valid: Int, required: Int)
+        case insufficientBaseline(validNights: Int, required: Int)
+        case staleBaseline(daysSinceUpdate: Int)
+        case eligible
+    }
+
+    /// The observed, un-imputed pre-sleep data. Completeness is stated as a sample count because raw
+    /// HR cadence can vary; this slice does not pretend a count is a percentage of time covered.
+    public struct Observation: Equatable, Sendable {
+        public let primarySleepStartTs: Int
+        public let primarySleepEndTs: Int
+        public let windowStartTs: Int
+        public let windowEndTs: Int
+        public let meanBpm: Double
+        public let validSamples: Int
+        public let totalTimestampSamples: Int
+
+        public init(primarySleepStartTs: Int, primarySleepEndTs: Int,
+                    windowStartTs: Int, windowEndTs: Int, meanBpm: Double,
+                    validSamples: Int, totalTimestampSamples: Int) {
+            self.primarySleepStartTs = primarySleepStartTs
+            self.primarySleepEndTs = primarySleepEndTs
+            self.windowStartTs = windowStartTs
+            self.windowEndTs = windowEndTs
+            self.meanBpm = meanBpm
+            self.validSamples = validSamples
+            self.totalTimestampSamples = totalTimestampSamples
+        }
+    }
+
+    /// A personal comparison only, never a population norm or a health classification.
+    public struct Comparison: Equatable, Sendable {
+        public let baselineBpm: Double
+        public let deltaBpm: Double
+        public let baselineNights: Int
+        public let baselineStatus: BaselineStatus
+
+        public init(baselineBpm: Double, deltaBpm: Double, baselineNights: Int,
+                    baselineStatus: BaselineStatus) {
+            self.baselineBpm = baselineBpm
+            self.deltaBpm = deltaBpm
+            self.baselineNights = baselineNights
+            self.baselineStatus = baselineStatus
+        }
+    }
+
+    /// Explicit limits that a presentation layer must keep visible rather than turning into certainty.
+    public enum Uncertainty: Equatable, Sendable {
+        /// The first eligible personal baseline is usable but not yet trusted by `Baselines`.
+        case provisionalBaseline
+        /// There are not yet enough valid historical nights to make any personal comparison.
+        case noPersonalComparison
+        /// A mature personal baseline has not received a plausible value recently enough to compare.
+        case staleBaseline(daysSinceUpdate: Int)
+    }
+
+    /// This slice intentionally makes no causal inference from a single observation or its journal facts.
+    public enum Inference: Equatable, Sendable { case notEstablished }
+    /// This slice intentionally cannot support a behavior, treatment, or other recommendation.
+    public enum Recommendation: Equatable, Sendable { case unsupported }
+
+    /// A projection of a same-day `JournalEntry`. It preserves what was logged without exposing notes or
+    /// claiming that the entry explains this reading.
+    public struct JournalFact: Equatable, Sendable {
+        public let day: String
+        public let question: String
+        public let answeredYes: Bool
+        public let numericValue: Double?
+
+        public init(day: String, question: String, answeredYes: Bool, numericValue: Double?) {
+            self.day = day
+            self.question = question
+            self.answeredYes = answeredYes
+            self.numericValue = numericValue
+        }
+    }
+
+    public struct Feedback: Equatable, Sendable {
+        public let eligibility: Eligibility
+        public let observation: Observation?
+        public let comparison: Comparison?
+        public let uncertainty: [Uncertainty]
+        public let inference: Inference
+        public let recommendation: Recommendation
+        /// Same-day journal facts only. They are deliberately not treated as a causal insight.
+        public let journalContext: [JournalFact]
+
+        public init(eligibility: Eligibility, observation: Observation?, comparison: Comparison?,
+                    uncertainty: [Uncertainty], inference: Inference,
+                    recommendation: Recommendation, journalContext: [JournalFact]) {
+            self.eligibility = eligibility
+            self.observation = observation
+            self.comparison = comparison
+            self.uncertainty = uncertainty
+            self.inference = inference
+            self.recommendation = recommendation
+            self.journalContext = journalContext
+        }
+    }
+
+    /// Produce the next-morning reading from existing timestamped HR and sleep primitives.
+    ///
+    /// `hr` is expected to be the repository's measured/PPG-coalesced timeline. To remain safe for other
+    /// callers, duplicate timestamps are also ignored after the first element, preserving the caller's
+    /// precedence order. Both window bounds are transparent and half-open: `[sleep.start - window, sleep.start)`.
+    public static func evaluate(enabled: Bool, sessions: [SleepSession], hr: [HRSample],
+                                history: [HistoricalReading], journalEntries: [JournalEntry], day: String,
+                                minimumValidSamples: Int = defaultMinimumValidSamples,
+                                preSleepWindowSeconds: Int = defaultPreSleepWindowSeconds) -> Feedback {
+        let unsupported = Recommendation.unsupported
+        let noInference = Inference.notEstablished
+        guard enabled else {
+            return Feedback(eligibility: .disabled, observation: nil, comparison: nil, uncertainty: [],
+                            inference: noInference, recommendation: unsupported, journalContext: [])
+        }
+        guard let evaluationDate = canonicalDay(day) else {
+            return Feedback(eligibility: .invalidDay, observation: nil, comparison: nil, uncertainty: [],
+                            inference: noInference, recommendation: unsupported, journalContext: [])
+        }
+        guard minimumValidSamples > 0, preSleepWindowSeconds > 0 else {
+            return Feedback(eligibility: .invalidWindow, observation: nil, comparison: nil, uncertainty: [],
+                            inference: noInference, recommendation: unsupported, journalContext: [])
+        }
+        let sessionsWithDuration = sessions.compactMap { session -> (session: SleepSession, duration: Int)? in
+            let (duration, overflow) = session.end.subtractingReportingOverflow(session.start)
+            return !overflow && duration > 0 ? (session, duration) : nil
+        }
+        guard let primary = sessionsWithDuration.max(by: { $0.duration < $1.duration })?.session else {
+            return Feedback(eligibility: .missingPrimarySleep, observation: nil, comparison: nil, uncertainty: [],
+                            inference: noInference, recommendation: unsupported, journalContext: [])
+        }
+
+        let (start, windowOverflow) = primary.start.subtractingReportingOverflow(preSleepWindowSeconds)
+        guard !windowOverflow else {
+            return Feedback(eligibility: .invalidWindow, observation: nil, comparison: nil, uncertainty: [],
+                            inference: noInference, recommendation: unsupported, journalContext: [])
+        }
+        let inWindow = deduplicated(hr).filter { $0.ts >= start && $0.ts < primary.start }
+        let valid = inWindow.filter { baselineCfg.minVal <= Double($0.bpm) && Double($0.bpm) <= baselineCfg.maxVal }
+        guard valid.count >= minimumValidSamples else {
+            return Feedback(eligibility: .insufficientPreSleepSamples(valid: valid.count, required: minimumValidSamples),
+                            observation: nil, comparison: nil, uncertainty: [], inference: noInference,
+                            recommendation: unsupported, journalContext: [])
+        }
+        let mean = Double(valid.reduce(0) { $0 + $1.bpm }) / Double(valid.count)
+        let observation = Observation(primarySleepStartTs: primary.start, primarySleepEndTs: primary.end,
+                                      windowStartTs: start, windowEndTs: primary.start, meanBpm: mean,
+                                      validSamples: valid.count, totalTimestampSamples: inWindow.count)
+        // Baselines use prior nights only and
+        // `rollingMeanSD` requires oldest-to-newest input. Retain the first caller-supplied reading
+        // for a repeated canonical day; one day contributes at most one night and no synthetic average
+        // is invented.
+        var seenDays = Set<String>()
+        let priorHistory = history
+            .compactMap { reading -> (reading: HistoricalReading, date: Date)? in
+                guard let date = canonicalDay(reading.day), date < evaluationDate,
+                      seenDays.insert(reading.day).inserted else { return nil }
+                return (reading, date)
+            }
+            .sorted { $0.date < $1.date }
+        let rollingBaseline = Baselines.rollingMeanSD(priorHistory.map(\.reading.meanBpm), cfg: baselineCfg)
+        let latestContributingDate = priorHistory.last {
+            baselineCfg.minVal <= $0.reading.meanBpm && $0.reading.meanBpm <= baselineCfg.maxVal
+        }?.date
+        let nightsSinceUpdate = latestContributingDate.flatMap {
+            gregorianUTC.dateComponents([.day], from: $0, to: evaluationDate).day
+        }.map { max(0, $0) } ?? 0
+        let baseline = BaselineState(
+            baseline: rollingBaseline.baseline,
+            spread: rollingBaseline.spread,
+            nValid: rollingBaseline.nValid,
+            nightsSinceUpdate: nightsSinceUpdate,
+            status: Baselines.computeStatus(nValid: rollingBaseline.nValid,
+                                            nightsSinceUpdate: nightsSinceUpdate)
+        )
+        let context = journalEntries.filter { $0.day == day }.map {
+            JournalFact(day: $0.day, question: $0.question, answeredYes: $0.answeredYes,
+                        numericValue: $0.numericValue)
+        }
+        guard baseline.nValid >= minimumBaselineNights else {
+            return Feedback(eligibility: .insufficientBaseline(validNights: baseline.nValid,
+                                                                 required: minimumBaselineNights),
+                            observation: observation, comparison: nil, uncertainty: [.noPersonalComparison],
+                            inference: noInference, recommendation: unsupported, journalContext: context)
+        }
+        guard baseline.usable else {
+            return Feedback(eligibility: .staleBaseline(daysSinceUpdate: baseline.nightsSinceUpdate),
+                            observation: observation, comparison: nil,
+                            uncertainty: [.staleBaseline(daysSinceUpdate: baseline.nightsSinceUpdate)],
+                            inference: noInference, recommendation: unsupported, journalContext: context)
+        }
+
+        let comparison = Comparison(baselineBpm: baseline.baseline, deltaBpm: mean - baseline.baseline,
+                                    baselineNights: baseline.nValid, baselineStatus: baseline.status)
+        let uncertainty: [Uncertainty] = baseline.status == .trusted ? [] : [.provisionalBaseline]
+        return Feedback(eligibility: .eligible, observation: observation, comparison: comparison,
+                        uncertainty: uncertainty, inference: noInference, recommendation: unsupported,
+                        journalContext: context)
+    }
+
+    private static var gregorianUTC: Calendar {
+        var calendar = Calendar(identifier: .gregorian)
+        calendar.timeZone = TimeZone(secondsFromGMT: 0)!
+        return calendar
+    }
+
+    private static func canonicalDay(_ day: String) -> Date? {
+        let bytes = Array(day.utf8)
+        guard bytes.count == 10, bytes[4] == 45, bytes[7] == 45 else { return nil }
+        let digitPositions = [0, 1, 2, 3, 5, 6, 8, 9]
+        guard digitPositions.allSatisfy({ (48...57).contains(bytes[$0]) }) else { return nil }
+
+        let year = Int(bytes[0] - 48) * 1_000 + Int(bytes[1] - 48) * 100
+            + Int(bytes[2] - 48) * 10 + Int(bytes[3] - 48)
+        let month = Int(bytes[5] - 48) * 10 + Int(bytes[6] - 48)
+        let dayOfMonth = Int(bytes[8] - 48) * 10 + Int(bytes[9] - 48)
+        let calendar = gregorianUTC
+        guard let date = calendar.date(from: DateComponents(year: year, month: month, day: dayOfMonth)) else {
+            return nil
+        }
+        let roundTrip = calendar.dateComponents([.era, .year, .month, .day], from: date)
+        guard roundTrip.era == 1 && roundTrip.year == year && roundTrip.month == month
+            && roundTrip.day == dayOfMonth else { return nil }
+        return date
+    }
+
+    private static func deduplicated(_ hr: [HRSample]) -> [HRSample] {
+        var seen = Set<Int>()
+        return hr.filter { seen.insert($0.ts).inserted }
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/PreSleepHeartRateFeedbackTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/PreSleepHeartRateFeedbackTests.swift
new file mode 100644
index 0000000000..0dd4ad071a
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/PreSleepHeartRateFeedbackTests.swift
@@ -0,0 +1,259 @@
+import XCTest
+@testable import StrandAnalytics
+import WhoopProtocol
+import WhoopStore
+
+final class PreSleepHeartRateFeedbackTests: XCTestCase {
+    private func samples(_ start: Int, bpm: Int, count: Int) -> [HRSample] {
+        (0..<count).map { HRSample(ts: start + $0 * 60, bpm: bpm) }
+    }
+
+    func testEligibleFeedbackSeparatesObservationComparisonUncertaintyAndUnsupportedRecommendation() {
+        let sleep = SleepSession(start: 10_000, end: 36_000, efficiency: 0.9,
+                                 stages: [], restingHR: nil, avgHRV: nil)
+        let history = [60.0, 61.0, 62.0, 63.0].enumerated().map {
+            PreSleepHeartRateFeedback.HistoricalReading(day: "2026-08-0\($0.offset + 1)", meanBpm: $0.element)
+        }
+        let journal = JournalEntry(day: "2026-08-05", question: "Late meal", answeredYes: true, notes: nil)
+        let feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled: true,
+            sessions: [sleep],
+            hr: samples(8_800, bpm: 70, count: 12) + samples(10_000, bpm: 55, count: 12),
+            history: history,
+            journalEntries: [journal],
+            day: "2026-08-05",
+            minimumValidSamples: 10,
+            preSleepWindowSeconds: 1_800
+        )
+
+        XCTAssertEqual(feedback.eligibility, .eligible)
+        XCTAssertEqual(feedback.observation?.windowStartTs, 8_200)
+        XCTAssertEqual(feedback.observation?.windowEndTs, 10_000)
+        XCTAssertEqual(feedback.observation?.meanBpm, 70)
+        XCTAssertEqual(feedback.observation?.validSamples, 12)
+        XCTAssertEqual(feedback.comparison?.baselineBpm, 61.5)
+        XCTAssertEqual(feedback.comparison?.deltaBpm, 8.5)
+        XCTAssertEqual(feedback.comparison?.baselineStatus, .provisional)
+        XCTAssertEqual(feedback.uncertainty, [.provisionalBaseline])
+        XCTAssertEqual(feedback.inference, .notEstablished)
+        XCTAssertEqual(feedback.recommendation, .unsupported)
+        XCTAssertEqual(feedback.journalContext, [
+            PreSleepHeartRateFeedback.JournalFact(day: "2026-08-05", question: "Late meal",
+                                                   answeredYes: true, numericValue: nil)
+        ])
+    }
+
+    func testBaselineUsesOnlySortedPriorNights() {
+        let sleep = SleepSession(start: 10_000, end: 36_000, efficiency: 0.9,
+                                 stages: [], restingHR: nil, avgHRV: nil)
+        let history = [
+            PreSleepHeartRateFeedback.HistoricalReading(day: "2026-08-01", meanBpm: 60),
+            PreSleepHeartRateFeedback.HistoricalReading(day: "2026-08-04", meanBpm: 63),
+            PreSleepHeartRateFeedback.HistoricalReading(day: "2026-08-02", meanBpm: 61),
+            PreSleepHeartRateFeedback.HistoricalReading(day: "2026-08-03", meanBpm: 62),
+            PreSleepHeartRateFeedback.HistoricalReading(day: "2026-08-05", meanBpm: 90),
+            PreSleepHeartRateFeedback.HistoricalReading(day: "2026-08-06", meanBpm: 100),
+        ]
+
+        let feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled: true, sessions: [sleep], hr: samples(8_800, bpm: 70, count: 12),
+            history: history, journalEntries: [], day: "2026-08-05",
+            minimumValidSamples: 10, preSleepWindowSeconds: 1_800
+        )
+
+        XCTAssertEqual(feedback.comparison?.baselineBpm, 61.5)
+        XCTAssertEqual(feedback.comparison?.baselineNights, 4)
+    }
+
+    func testRecentImplausibleHistoryDoesNotRefreshMatureStaleBaseline() {
+        let sleep = SleepSession(start: 10_000, end: 36_000, efficiency: 0.9,
+                                 stages: [], restingHR: nil, avgHRV: nil)
+        var history = (1...14).map {
+            PreSleepHeartRateFeedback.HistoricalReading(
+                day: String(format: "2024-02-%02d", $0), meanBpm: 60
+            )
+        }
+        history += [
+            .init(day: "2024-02-28", meanBpm: .nan),
+            .init(day: "2024-02-28", meanBpm: 70),
+            .init(day: "2024-02-29", meanBpm: PreSleepHeartRateFeedback.baselineCfg.maxVal + 1),
+        ]
+
+        let journal = JournalEntry(day: "2024-03-01", question: "Late meal",
+                                   answeredYes: true, notes: nil)
+        let feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled: true, sessions: [sleep], hr: samples(8_800, bpm: 70, count: 12),
+            history: history, journalEntries: [journal], day: "2024-03-01",
+            minimumValidSamples: 10, preSleepWindowSeconds: 1_800
+        )
+
+        XCTAssertEqual(feedback.eligibility, .staleBaseline(daysSinceUpdate: 16))
+        XCTAssertEqual(feedback.observation?.meanBpm, 70)
+        XCTAssertNil(feedback.comparison)
+        XCTAssertEqual(feedback.uncertainty, [.staleBaseline(daysSinceUpdate: 16)])
+        XCTAssertEqual(feedback.journalContext, [
+            .init(day: "2024-03-01", question: "Late meal", answeredYes: true, numericValue: nil)
+        ])
+    }
+
+    func testBaselineAtExactStaleDaysBoundaryRemainsTrustedAcrossYearBoundary() {
+        let sleep = SleepSession(start: 10_000, end: 36_000, efficiency: 0.9,
+                                 stages: [], restingHR: nil, avgHRV: nil)
+        let history = (1...13).map {
+            PreSleepHeartRateFeedback.HistoricalReading(
+                day: String(format: "2023-01-%02d", $0), meanBpm: 60
+            )
+        } + [.init(day: "2023-12-18", meanBpm: 60)]
+
+        let feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled: true, sessions: [sleep], hr: samples(8_800, bpm: 70, count: 12),
+            history: history, journalEntries: [], day: "2024-01-01",
+            minimumValidSamples: 10, preSleepWindowSeconds: 1_800
+        )
+
+        XCTAssertEqual(feedback.eligibility, .eligible)
+        XCTAssertEqual(feedback.comparison?.baselineStatus, .trusted)
+        XCTAssertTrue(feedback.uncertainty.isEmpty)
+    }
+
+    func testBaselineOneDayPastStaleBoundaryIsExplicitlyStaleAcrossLeapDay() {
+        let sleep = SleepSession(start: 10_000, end: 36_000, efficiency: 0.9,
+                                 stages: [], restingHR: nil, avgHRV: nil)
+        let history = (1...13).map {
+            PreSleepHeartRateFeedback.HistoricalReading(
+                day: String(format: "2024-01-%02d", $0), meanBpm: 60
+            )
+        } + [.init(day: "2024-02-15", meanBpm: 60)]
+
+        let feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled: true, sessions: [sleep], hr: samples(8_800, bpm: 70, count: 12),
+            history: history, journalEntries: [], day: "2024-03-01",
+            minimumValidSamples: 10, preSleepWindowSeconds: 1_800
+        )
+
+        XCTAssertEqual(feedback.eligibility, .staleBaseline(daysSinceUpdate: 15))
+        XCTAssertNotNil(feedback.observation)
+        XCTAssertNil(feedback.comparison)
+        XCTAssertEqual(feedback.uncertainty, [.staleBaseline(daysSinceUpdate: 15)])
+    }
+
+    func testRepeatedPriorDayCannotSatisfyMinimumBaselineNights() {
+        let sleep = SleepSession(start: 10_000, end: 36_000, efficiency: 0.9,
+                                 stages: [], restingHR: nil, avgHRV: nil)
+        let history = [60.0, 61.0, 62.0, 63.0].map {
+            PreSleepHeartRateFeedback.HistoricalReading(day: "2026-08-04", meanBpm: $0)
+        }
+
+        let feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled: true, sessions: [sleep], hr: samples(8_800, bpm: 70, count: 12),
+            history: history, journalEntries: [], day: "2026-08-05",
+            minimumValidSamples: 10, preSleepWindowSeconds: 1_800
+        )
+
+        XCTAssertEqual(feedback.eligibility, .insufficientBaseline(validNights: 1, required: 4))
+        XCTAssertNil(feedback.comparison)
+    }
+
+    func testNoncanonicalAndImpossibleDaysCannotSatisfyMinimumBaselineNights() {
+        let sleep = SleepSession(start: 10_000, end: 36_000, efficiency: 0.9,
+                                 stages: [], restingHR: nil, avgHRV: nil)
+        let history = [
+            PreSleepHeartRateFeedback.HistoricalReading(day: "2026-08-01", meanBpm: 60),
+            PreSleepHeartRateFeedback.HistoricalReading(day: "2026-08-02", meanBpm: 61),
+            PreSleepHeartRateFeedback.HistoricalReading(day: "2026-08-04Z", meanBpm: 62),
+            PreSleepHeartRateFeedback.HistoricalReading(day: "2026-02-31", meanBpm: 63),
+        ]
+
+        let feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled: true, sessions: [sleep], hr: samples(8_800, bpm: 70, count: 12),
+            history: history, journalEntries: [], day: "2026-08-05",
+            minimumValidSamples: 10, preSleepWindowSeconds: 1_800
+        )
+
+        XCTAssertEqual(feedback.eligibility, .insufficientBaseline(validNights: 2, required: 4))
+        XCTAssertNil(feedback.comparison)
+    }
+
+    func testInvalidEvaluationDaysCannotProduceFeedback() {
+        let sleep = SleepSession(start: 10_000, end: 36_000, efficiency: 0.9,
+                                 stages: [], restingHR: nil, avgHRV: nil)
+        let cases = [
+            (day: "2026-08-05Z", historyDays: ["2026-08-02", "2026-08-03", "2026-08-04", "2026-08-05"]),
+            (day: "2026-02-31", historyDays: ["2026-02-27", "2026-02-28", "2026-03-01", "2026-03-02"]),
+        ]
+
+        for testCase in cases {
+            let history = testCase.historyDays.map {
+                PreSleepHeartRateFeedback.HistoricalReading(day: $0, meanBpm: 60)
+            }
+            let journal = JournalEntry(day: testCase.day, question: "Late meal", answeredYes: true, notes: nil)
+            let feedback = PreSleepHeartRateFeedback.evaluate(
+                enabled: true, sessions: [sleep], hr: samples(8_800, bpm: 70, count: 12),
+                history: history, journalEntries: [journal], day: testCase.day,
+                minimumValidSamples: 10, preSleepWindowSeconds: 1_800
+            )
+
+            XCTAssertEqual(feedback.eligibility, .invalidDay)
+            XCTAssertNil(feedback.observation)
+            XCTAssertNil(feedback.comparison)
+            XCTAssertTrue(feedback.uncertainty.isEmpty)
+            XCTAssertTrue(feedback.journalContext.isEmpty)
+        }
+    }
+
+    func testExtremeSleepSessionDurationFailsClosedWithoutTrapping() {
+        let sleep = SleepSession(start: Int.min, end: Int.max, efficiency: 0.9,
+                                 stages: [], restingHR: nil, avgHRV: nil)
+        let otherSleep = SleepSession(start: Int.min, end: Int.max - 1, efficiency: 0.9,
+                                      stages: [], restingHR: nil, avgHRV: nil)
+
+        let feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled: true, sessions: [sleep, otherSleep], hr: [], history: [], journalEntries: [],
+            day: "2026-08-05", minimumValidSamples: 1, preSleepWindowSeconds: 1
+        )
+
+        XCTAssertEqual(feedback.eligibility, .missingPrimarySleep)
+        XCTAssertNil(feedback.observation)
+    }
+
+    func testExtremePreSleepWindowFailsClosedWithoutTrapping() {
+        let sleep = SleepSession(start: Int.min + 1, end: Int.min + 2, efficiency: 0.9,
+                                 stages: [], restingHR: nil, avgHRV: nil)
+
+        let feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled: true, sessions: [sleep], hr: [], history: [], journalEntries: [],
+            day: "2026-08-05", minimumValidSamples: 1, preSleepWindowSeconds: Int.max
+        )
+
+        XCTAssertEqual(feedback.eligibility, .invalidWindow)
+        XCTAssertNil(feedback.observation)
+    }
+
+    func testOptOutAndLapseFailClosedWithoutCreatingFeedbackOrPunishment() {
+        let sleep = SleepSession(start: 10_000, end: 36_000, efficiency: 0.9,
+                                 stages: [], restingHR: nil, avgHRV: nil)
+        let disabled = PreSleepHeartRateFeedback.evaluate(enabled: false, sessions: [sleep],
+                                                           hr: samples(8_800, bpm: 70, count: 12),
+                                                           history: [], journalEntries: [], day: "2026-08-05",
+                                                           minimumValidSamples: 10, preSleepWindowSeconds: 1_800)
+        XCTAssertEqual(disabled.eligibility, .disabled)
+        XCTAssertNil(disabled.observation)
+        XCTAssertNil(disabled.comparison)
+
+        let lapsed = PreSleepHeartRateFeedback.evaluate(enabled: true, sessions: [sleep], hr: [],
+                                                         history: [], journalEntries: [], day: "2026-08-05",
+                                                         minimumValidSamples: 10, preSleepWindowSeconds: 1_800)
+        XCTAssertEqual(lapsed.eligibility, .insufficientPreSleepSamples(valid: 0, required: 10))
+        XCTAssertEqual(lapsed.recommendation, .unsupported)
+
+        let building = PreSleepHeartRateFeedback.evaluate(
+            enabled: true, sessions: [sleep], hr: samples(8_800, bpm: 70, count: 12),
+            history: [.init(day: "2026-08-04", meanBpm: 60)], journalEntries: [], day: "2026-08-05",
+            minimumValidSamples: 10, preSleepWindowSeconds: 1_800
+        )
+        XCTAssertEqual(building.eligibility, .insufficientBaseline(validNights: 1, required: 4))
+        XCTAssertEqual(building.observation?.validSamples, 12)
+        XCTAssertNil(building.comparison)
+        XCTAssertEqual(building.uncertainty, [.noPersonalComparison])
+    }
+}

From d4fa26d6913132cf24b83c97efb8f30d87e8bddb Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 14:33:57 +1200
Subject: [PATCH 136/333] test(push): pin the clock, so the suite stops
 asserting the calendar (#1786)

main was red, and nothing in main caused it. PushCoordinator defaults
`today = { LocalDate.now() }` and PushWindow spans `today.minusDays(13)`, so
every coordinator built without a clock asserted against the wall clock. The
journal fixtures are dated 2026-08-18, which sat inside that 14-day window until
2026-08-31 and fell out of it on 2026-09-01.

The CI history dates it exactly: 2f32852 green at 23:21Z on 31 Aug, efc98944 red
at 00:13Z on 1 Sep. Nothing between those runs goes near push - a build-number
bump and an Oura scan fix - and the failure is `expected:<[journal]> but was:<[]>`,
which is what a row falling out of the push window looks like.

Worth recording why it hid: it failed on a UTC+12 machine twelve hours before it
failed in CI, so it looked like a local environment quirk at exactly the moment
it was a real bug with a deadline. That shape gets waved through.

Re-review of the first pass caught it being incomplete: only the constructions
written `MemoryProgress(), SOURCE_A)` were pinned, missing ten that pass a local
`progress` variable - including the replace_window journal case, the same shape
that broke. Every construction in the test sources now passes an explicit clock,
PushCursorTest's four included, verified by grep rather than by eye.

Swept for the class: PushCoordinator is the only production type with an
injectable clock defaulting to now(), and no other test pairs a real-clock read
with a fixed 2026-08/09 fixture. This was the only instance.

No production code changes. The durable fix - removing the silent default so
omission is a compile error, which one production caller would absorb - is left
for its own change rather than attached to an urgent red-CI fix.

4999 Android unit tests green, 0 failures.
---
 .../java/com/noop/push/PushCoordinatorTest.kt | 48 ++++++++++++-------
 .../test/java/com/noop/push/PushCursorTest.kt | 18 +++++--
 2 files changed, 44 insertions(+), 22 deletions(-)

diff --git a/android/app/src/test/java/com/noop/push/PushCoordinatorTest.kt b/android/app/src/test/java/com/noop/push/PushCoordinatorTest.kt
index a4327fa37f..0c42f8b2b3 100644
--- a/android/app/src/test/java/com/noop/push/PushCoordinatorTest.kt
+++ b/android/app/src/test/java/com/noop/push/PushCoordinatorTest.kt
@@ -10,6 +10,18 @@ import java.time.LocalDate
 import java.time.ZoneId
 
 class PushCoordinatorTest {
+    /**
+     * A PINNED "today" for every coordinator built in this file.
+     *
+     * `PushCoordinator` defaults to `LocalDate.now()` and `PushWindow` spans `today.minusDays(13)`, so a
+     * test that omits it silently depends on the wall clock. The journal fixtures here are dated
+     * 2026-08-18, which sat inside that window until 2026-09-01 and then fell out: CI was green at
+     * 23:21Z on 31 Aug and red at 00:13Z on 1 Sep, with `expected:<[journal]> but was:<[]>`. Nothing had
+     * changed but the date. Pin it, and the suite asserts the coordinator's behaviour rather than the
+     * calendar's.
+     */
+    private val pinnedToday = { LocalDate.of(2026, 8, 18) }
+
     @Test
     fun endpointChangeFencesRemainingPostsToCapturedDestination() = runBlocking {
         val settings = SelfHostedPushSettings.forTest(
@@ -62,7 +74,7 @@ class PushCoordinatorTest {
         val progress = MemoryProgress()
         val partial = AckingTransport { batch -> PushAck.fromBatch(batch).copy(acceptedRows = 0) }
 
-        val result = PushCoordinator(source, partial, progress, SOURCE_A).pushAppend(PushAppendTable.HR_SAMPLE, "a")
+        val result = PushCoordinator(source, partial, progress, SOURCE_A, pinnedToday, ZoneId.of("UTC")).pushAppend(PushAppendTable.HR_SAMPLE, "a")
 
         assertTrue(result is PushResult.Rejected)
         assertTrue(progress.cursors.isEmpty())
@@ -75,7 +87,7 @@ class PushCoordinatorTest {
         val progress = MemoryProgress()
         val wrongStatus = AckingTransport { batch -> PushAck.fromBatch(batch).copy(status = "partial") }
 
-        val result = PushCoordinator(source, wrongStatus, progress, SOURCE_A)
+        val result = PushCoordinator(source, wrongStatus, progress, SOURCE_A, pinnedToday, ZoneId.of("UTC"))
             .pushAppend(PushAppendTable.HR_SAMPLE, "a")
 
         assertTrue(result is PushResult.Rejected)
@@ -95,7 +107,7 @@ class PushCoordinatorTest {
                 return PushTransportResponse(200, "{not-json".toByteArray())
             }
         }
-        val coordinator = PushCoordinator(source, malformed, progress, SOURCE_A)
+        val coordinator = PushCoordinator(source, malformed, progress, SOURCE_A, pinnedToday, ZoneId.of("UTC"))
 
         coordinator.pushAppend(PushAppendTable.HR_SAMPLE, "a")
         coordinator.pushAppend(PushAppendTable.HR_SAMPLE, "a")
@@ -117,7 +129,7 @@ class PushCoordinatorTest {
             )
         }
 
-        val result = PushCoordinator(source, transport, progress, SOURCE_A).pushAppend(PushAppendTable.HR_SAMPLE, "a")
+        val result = PushCoordinator(source, transport, progress, SOURCE_A, pinnedToday, ZoneId.of("UTC")).pushAppend(PushAppendTable.HR_SAMPLE, "a")
 
         assertTrue(result is PushResult.Rejected)
         assertTrue(progress.cursors.isEmpty())
@@ -137,7 +149,7 @@ class PushCoordinatorTest {
             }
         }
 
-        val result = PushCoordinator(source, transport, progress, SOURCE_A)
+        val result = PushCoordinator(source, transport, progress, SOURCE_A, pinnedToday, ZoneId.of("UTC"))
             .pushAppend(PushAppendTable.HR_SAMPLE, "a")
 
         assertTrue(result is PushResult.Rejected)
@@ -156,7 +168,7 @@ class PushCoordinatorTest {
                 override suspend fun post(batch: PushBatch) = PushTransportResponse(status, ByteArray(0))
             }
 
-            val result = PushCoordinator(source, transport, progress, SOURCE_A)
+            val result = PushCoordinator(source, transport, progress, SOURCE_A, pinnedToday, ZoneId.of("UTC"))
                 .pushAppend(PushAppendTable.HR_SAMPLE, "a")
 
             assertTrue("HTTP $status", result is PushResult.Rejected && result.retryable == retryable)
@@ -360,7 +372,7 @@ class PushCoordinatorTest {
             }
         }
 
-        PushCoordinator(source, transport, MemoryProgress(), SOURCE_A)
+        PushCoordinator(source, transport, MemoryProgress(), SOURCE_A, pinnedToday, ZoneId.of("UTC"))
             .pushAppend(PushAppendTable.HR_SAMPLE, "a")
         Unit
     }
@@ -380,7 +392,7 @@ class PushCoordinatorTest {
         )
         val transport = AckingTransport()
 
-        val result = PushCoordinator(source, transport, MemoryProgress(), SOURCE_A)
+        val result = PushCoordinator(source, transport, MemoryProgress(), SOURCE_A, pinnedToday, ZoneId.of("UTC"))
             .pushMutable(PushMutableTable.JOURNAL, "a")
 
         assertTrue(result is PushResult.Rejected && !result.retryable)
@@ -394,7 +406,7 @@ class PushCoordinatorTest {
         }
         val transport = AckingTransport()
 
-        val result = PushCoordinator(source, transport, MemoryProgress(), SOURCE_A)
+        val result = PushCoordinator(source, transport, MemoryProgress(), SOURCE_A, pinnedToday, ZoneId.of("UTC"))
             .pushAppend(PushAppendTable.EVENT, "a")
 
         assertTrue(result is PushResult.Rejected && !result.retryable)
@@ -408,7 +420,7 @@ class PushCoordinatorTest {
         }
         val transport = AckingTransport()
 
-        val result = PushCoordinator(source, transport, MemoryProgress(), SOURCE_A)
+        val result = PushCoordinator(source, transport, MemoryProgress(), SOURCE_A, pinnedToday, ZoneId.of("UTC"))
             .pushMutable(PushMutableTable.JOURNAL, "a")
 
         assertTrue(result is PushResult.Rejected && !result.retryable)
@@ -425,7 +437,7 @@ class PushCoordinatorTest {
         )
         val progress = MemoryProgress()
         val firstTransport = AckingTransport()
-        val first = PushCoordinator(source, firstTransport, progress, SOURCE_A)
+        val first = PushCoordinator(source, firstTransport, progress, SOURCE_A, pinnedToday, ZoneId.of("UTC"))
             .pushKnownDevices(startDeviceIndex = 0, maxDevices = 1)
 
         assertTrue(first.hasMoreDevices)
@@ -435,7 +447,7 @@ class PushCoordinatorTest {
         assertTrue(firstTransport.batches.all { it.deviceId == "a" })
 
         val secondTransport = AckingTransport()
-        val second = PushCoordinator(source, secondTransport, progress, SOURCE_A)
+        val second = PushCoordinator(source, secondTransport, progress, SOURCE_A, pinnedToday, ZoneId.of("UTC"))
             .pushKnownDevices(startDeviceIndex = first.nextDeviceIndex, maxDevices = 1)
 
         assertEquals(0, second.nextDeviceIndex)
@@ -456,12 +468,12 @@ class PushCoordinatorTest {
             ),
         )
         val progress = MemoryProgress()
-        PushCoordinator(source, AckingTransport(), progress, SOURCE_A)
+        PushCoordinator(source, AckingTransport(), progress, SOURCE_A, pinnedToday, ZoneId.of("UTC"))
             .pushKnownDevices()
         source.mutable.remove(key(PushMutableTable.JOURNAL, "noop-journal"))
 
         val afterDelete = AckingTransport()
-        PushCoordinator(source, afterDelete, progress, SOURCE_A)
+        PushCoordinator(source, afterDelete, progress, SOURCE_A, pinnedToday, ZoneId.of("UTC"))
             .pushKnownDevices()
 
         val journal = afterDelete.batches.single {
@@ -490,7 +502,7 @@ class PushCoordinatorTest {
             mutableTables = setOf(PushMutableTable.JOURNAL),
         )
 
-        PushCoordinator(source, transport, MemoryProgress(), SOURCE_A)
+        PushCoordinator(source, transport, MemoryProgress(), SOURCE_A, pinnedToday, ZoneId.of("UTC"))
             .pushKnownDevices(capabilities = capabilities)
 
         assertEquals(emptyList<PushAppendTable>(), source.appendTablesRead)
@@ -503,7 +515,7 @@ class PushCoordinatorTest {
     fun emptyCapabilitiesAvoidEvenDeviceDiscovery() = runBlocking {
         val source = FakePushSource().apply { knownDeviceIdsFailure = AssertionError("Room must stay unopened") }
 
-        val result = PushCoordinator(source, AckingTransport(), MemoryProgress(), SOURCE_A)
+        val result = PushCoordinator(source, AckingTransport(), MemoryProgress(), SOURCE_A, pinnedToday, ZoneId.of("UTC"))
             .pushKnownDevices(capabilities = PushCapabilities(emptySet(), emptySet()))
 
         assertEquals(0, result.acceptedBatches)
@@ -521,7 +533,7 @@ class PushCoordinatorTest {
             }
         }
 
-        val result = PushCoordinator(source, transport, MemoryProgress(), SOURCE_A)
+        val result = PushCoordinator(source, transport, MemoryProgress(), SOURCE_A, pinnedToday, ZoneId.of("UTC"))
             .pushKnownDevices(
                 capabilities = PushCapabilities(setOf(PushAppendTable.HR_SAMPLE), emptySet()),
             )
@@ -543,7 +555,7 @@ class PushCoordinatorTest {
             )
         }
 
-        val result = PushCoordinator(source, transport, MemoryProgress(), SOURCE_A)
+        val result = PushCoordinator(source, transport, MemoryProgress(), SOURCE_A, pinnedToday, ZoneId.of("UTC"))
             .pushKnownDevices(capabilities = PushCapabilities(setOf(PushAppendTable.HR_SAMPLE), emptySet()))
 
         assertEquals("registry_mismatch", result.failure?.receiverCode)
diff --git a/android/app/src/test/java/com/noop/push/PushCursorTest.kt b/android/app/src/test/java/com/noop/push/PushCursorTest.kt
index 7fbeb55721..f30b7a1f22 100644
--- a/android/app/src/test/java/com/noop/push/PushCursorTest.kt
+++ b/android/app/src/test/java/com/noop/push/PushCursorTest.kt
@@ -4,9 +4,19 @@ import kotlinx.coroutines.runBlocking
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertNotEquals
 import org.junit.Assert.assertTrue
+import java.time.LocalDate
+import java.time.ZoneId
 import org.junit.Test
 
 class PushCursorTest {
+    /**
+     * Pinned for the same reason as `PushCoordinatorTest`: `PushCoordinator` defaults to
+     * `LocalDate.now()`, so an omitted clock makes a test depend on the date it runs. These cases
+     * exercise cursor-based append tables rather than the day window, so they were not the ones that
+     * broke on 2026-09-01 — but they are the same latent shape, and pinning costs nothing.
+     */
+    private val pinnedToday = { LocalDate.of(2026, 8, 18) }
+
     @Test
     fun olderTimestampWithHigherRowidIsNotStranded() = runBlocking {
         val old = hr(10, 200)
@@ -19,7 +29,7 @@ class PushCursorTest {
             )
         }
         val transport = AckingTransport()
-        val coordinator = PushCoordinator(source, transport, progress, SOURCE_A)
+        val coordinator = PushCoordinator(source, transport, progress, SOURCE_A, pinnedToday, ZoneId.of("UTC"))
 
         val result = coordinator.pushAppend(PushAppendTable.HR_SAMPLE, "a")
 
@@ -43,7 +53,7 @@ class PushCursorTest {
         }
         val transport = AckingTransport()
 
-        PushCoordinator(source, transport, progress, SOURCE_A).pushAppend(PushAppendTable.HR_SAMPLE, "a")
+        PushCoordinator(source, transport, progress, SOURCE_A, pinnedToday, ZoneId.of("UTC")).pushAppend(PushAppendTable.HR_SAMPLE, "a")
 
         assertEquals(0L, source.afterCursors.single())
         assertTrue(transport.bodies.single().toString(Charsets.UTF_8).contains("\"ts\":50"))
@@ -90,7 +100,7 @@ class PushCursorTest {
         )
         val progress = MemoryProgress()
         val transport = AckingTransport()
-        val coordinator = PushCoordinator(source, transport, progress, SOURCE_A)
+        val coordinator = PushCoordinator(source, transport, progress, SOURCE_A, pinnedToday, ZoneId.of("UTC"))
 
         val first = coordinator.pushAppend(PushAppendTable.RR_INTERVAL, "a")
         val second = coordinator.pushAppend(PushAppendTable.RR_INTERVAL, "a")
@@ -110,7 +120,7 @@ class PushCursorTest {
             ),
         )
         val progress = MemoryProgress()
-        val coordinator = PushCoordinator(source, AckingTransport(), progress, SOURCE_A)
+        val coordinator = PushCoordinator(source, AckingTransport(), progress, SOURCE_A, pinnedToday, ZoneId.of("UTC"))
 
         coordinator.pushAppend(PushAppendTable.HR_SAMPLE, "a")
 

From 63a013316b7d59b41007c83bcd549590b9b4e379 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 14:39:55 +1200
Subject: [PATCH 137/333] analytics: give the pre-sleep HR feedback its Kotlin
 twin (#1785)

#1772 landed the Swift slice; it was the only analytics type in the repo with no
Android counterpart. 82 of 97 non-extension StrandAnalytics sources have a
same-named .kt, and the two that do not still carry their Kotlin symbols
elsewhere - so this was a genuine first, and unlike ExplicitBond or
BondStateTrace there was no platform reason for it: Android already had
Baselines, MetricCfg, BaselineState, computeStatus and journal entries.

Everything that produces a NUMBER is shared rather than re-derived: the same
MetricCfg, the same rollingMeanSD (both call sites take its default window of
30), the same computeStatus, the same HR plausibility range. The test twin
asserts the Swift suite's expected values unchanged - baseline 61.5, delta 8.5,
window [8200,10000), and the stale case that is only 15 if 2024-02-29 is counted
- so a divergence shows up as a failure instead of two platforms quietly
disagreeing about the same night.

Two places it deliberately reads differently, both recorded in the file:

  - Apple's SleepSession is this side's DetectedSleep. Same shape, the naming
    divergence the two analytics layers already had.
  - DetectedSleep carries Long timestamps where Apple carries Int, so the
    overflow guard is Math.subtractExact rather than subtractingReportingOverflow.
    Same contract - fail closed, never trap - in each language's idiom.

Also the two nits from the issue. gregorianUTC was a COMPUTED property, so
canonicalDay built a fresh Calendar for every prior night; stored now, Calendar
being a Sendable value type. And deduplicated keeps the FIRST sample for a
repeated timestamp - the caller's precedence order, since the repository
coalesces measured over PPG before this runs - which was stated on evaluate but
not at the helper, where the rule is invisible and last-wins would silently
invert it. Documented on both platforms and pinned by a Kotlin test.

Re-review found one more, in the port rather than the original: sumOf { it.bpm }
accumulates in Int and WRAPS silently where Apple's reduce accumulates in 64-bit.
Unreachable with a real window, but a wrapped sum yields a plausible wrong mean
rather than an error, and it was the only unguarded arithmetic in a file that
reaches for subtractExact everywhere else.

Both halves remain uncalled by design; the integration is #1760. What this
changes is that Android will not silently lack the feature when that lands, and
that the Kotlin numbers were derived alongside the Swift ones rather than having
to reproduce them afterwards.

Android 1803 analytics tests green; Swift 1697 green; all 16 checks green.
---
 .../PreSleepHeartRateFeedback.swift           |  14 +-
 .../analytics/PreSleepHeartRateFeedback.kt    | 273 ++++++++++++++++++
 .../PreSleepHeartRateFeedbackTest.kt          | 216 ++++++++++++++
 3 files changed, 501 insertions(+), 2 deletions(-)
 create mode 100644 android/app/src/main/java/com/noop/analytics/PreSleepHeartRateFeedback.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/PreSleepHeartRateFeedbackTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/PreSleepHeartRateFeedback.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/PreSleepHeartRateFeedback.swift
index 7db990e18c..a486d021d6 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/PreSleepHeartRateFeedback.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/PreSleepHeartRateFeedback.swift
@@ -242,11 +242,14 @@ public enum PreSleepHeartRateFeedback {
                         journalContext: context)
     }
 
-    private static var gregorianUTC: Calendar {
+    /// Stored, not computed (#1784). `canonicalDay` reads this once per history row, so a computed
+    /// property built a fresh `Calendar` for every prior night. `Calendar` is a `Sendable` value type,
+    /// so one shared instance is safe and the construction happens once.
+    private static let gregorianUTC: Calendar = {
         var calendar = Calendar(identifier: .gregorian)
         calendar.timeZone = TimeZone(secondsFromGMT: 0)!
         return calendar
-    }
+    }()
 
     private static func canonicalDay(_ day: String) -> Date? {
         let bytes = Array(day.utf8)
@@ -268,6 +271,13 @@ public enum PreSleepHeartRateFeedback {
         return date
     }
 
+    /// One sample per timestamp, FIRST occurrence wins.
+    ///
+    /// First-wins is the caller's precedence order, not an arbitrary pick: `evaluate`'s contract is an
+    /// already-coalesced timeline where measured data outranks PPG-derived, so the first element for a
+    /// timestamp is the one the repository chose. Stated here as well as on `evaluate` because the rule
+    /// is invisible at this call site, and a later reader changing it to last-wins would silently invert
+    /// that precedence (#1784).
     private static func deduplicated(_ hr: [HRSample]) -> [HRSample] {
         var seen = Set<Int>()
         return hr.filter { seen.insert($0.ts).inserted }
diff --git a/android/app/src/main/java/com/noop/analytics/PreSleepHeartRateFeedback.kt b/android/app/src/main/java/com/noop/analytics/PreSleepHeartRateFeedback.kt
new file mode 100644
index 0000000000..bf97270fe0
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/PreSleepHeartRateFeedback.kt
@@ -0,0 +1,273 @@
+package com.noop.analytics
+
+import com.noop.data.JournalEntry
+import com.noop.protocol.HrSample
+import java.time.LocalDate
+import java.time.temporal.ChronoUnit
+
+/**
+ * An opt-in, descriptive pre-sleep heart-rate reading for the following morning.
+ *
+ * Kotlin twin of `StrandAnalytics.PreSleepHeartRateFeedback` (#1784). The caller supplies a
+ * timestamp-coalesced HR timeline: the repository's existing HR reads already coalesce measured and
+ * PPG-derived samples, with measured data taking precedence. This object selects the longest supplied
+ * sleep session, reads the declared half-open window immediately before it, and compares that
+ * observation with a personal rolling baseline. It neither diagnoses nor recommends an action. Journal
+ * answers are returned only as facts from the same day; one night cannot establish an association, so
+ * they never alter the reading or become an insight.
+ *
+ * PARITY, and the two places this deliberately differs from the Swift original:
+ *
+ *  - Apple's `SleepSession` is this side's [DetectedSleep] — same shape, the naming divergence that
+ *    already exists between the two analytics layers.
+ *  - Apple carries session timestamps as `Int`; [DetectedSleep] carries `Long`, so the window
+ *    arithmetic here is `Long` and sample timestamps widen at the comparison. The overflow guard is
+ *    therefore `Math.subtractExact` rather than `subtractingReportingOverflow`, which is the same
+ *    contract — fail closed, never trap — expressed in the idiom each language actually has.
+ *
+ * Everything that produces a NUMBER is byte-identical by construction: the same [MetricCfg], the same
+ * [Baselines.rollingMeanSD], the same [Baselines.computeStatus], and the same HR plausibility range.
+ */
+object PreSleepHeartRateFeedback {
+
+    /**
+     * Baseline configuration deliberately shares the existing HR plausibility range while keeping a
+     * small floor spread for transparent personal comparison. `rollingMeanSD` is the existing auditable
+     * baseline primitive; this is not a new scoring model.
+     */
+    val baselineCfg = MetricCfg(
+        minVal = SleepHeartRateContrast.VALID_MIN_BPM,
+        maxVal = SleepHeartRateContrast.VALID_MAX_BPM,
+        floorSpread = 2.0,
+        halfLifeB = 14.0,
+        halfLifeS = 21.0,
+    )
+    const val DEFAULT_PRE_SLEEP_WINDOW_SECONDS: Int = 30 * 60
+    const val DEFAULT_MINIMUM_VALID_SAMPLES: Int = 10
+    val minimumBaselineNights: Int = Baselines.minNightsSeed
+
+    /**
+     * A prior eligible pre-sleep observation. Callers persist/assemble history; this pure slice does
+     * not write, schedule a prompt, or penalize a missing night.
+     */
+    data class HistoricalReading(val day: String, val meanBpm: Double)
+
+    /**
+     * Why a morning reading is or is not available. Every non-eligible state is recoverable on a
+     * later, sufficiently covered night; none creates a streak, goal, or obligation.
+     */
+    sealed class Eligibility {
+        object Disabled : Eligibility()
+        object InvalidDay : Eligibility()
+        object InvalidWindow : Eligibility()
+        object MissingPrimarySleep : Eligibility()
+        data class InsufficientPreSleepSamples(val valid: Int, val required: Int) : Eligibility()
+        data class InsufficientBaseline(val validNights: Int, val required: Int) : Eligibility()
+        data class StaleBaseline(val daysSinceUpdate: Int) : Eligibility()
+        object Eligible : Eligibility()
+    }
+
+    /**
+     * The observed, un-imputed pre-sleep data. Completeness is stated as a sample count because raw
+     * HR cadence can vary; this slice does not pretend a count is a percentage of time covered.
+     */
+    data class Observation(
+        val primarySleepStartTs: Long,
+        val primarySleepEndTs: Long,
+        val windowStartTs: Long,
+        val windowEndTs: Long,
+        val meanBpm: Double,
+        val validSamples: Int,
+        val totalTimestampSamples: Int,
+    )
+
+    /** A personal comparison only, never a population norm or a health classification. */
+    data class Comparison(
+        val baselineBpm: Double,
+        val deltaBpm: Double,
+        val baselineNights: Int,
+        val baselineStatus: BaselineStatus,
+    )
+
+    /** Explicit limits that a presentation layer must keep visible rather than turning into certainty. */
+    sealed class Uncertainty {
+        /** The first eligible personal baseline is usable but not yet trusted by [Baselines]. */
+        object ProvisionalBaseline : Uncertainty()
+        /** There are not yet enough valid historical nights to make any personal comparison. */
+        object NoPersonalComparison : Uncertainty()
+        /** A mature personal baseline has not received a plausible value recently enough to compare. */
+        data class StaleBaseline(val daysSinceUpdate: Int) : Uncertainty()
+    }
+
+    /** This slice intentionally makes no causal inference from a single observation or its journal facts. */
+    enum class Inference { NOT_ESTABLISHED }
+
+    /** This slice intentionally cannot support a behavior, treatment, or other recommendation. */
+    enum class Recommendation { UNSUPPORTED }
+
+    /**
+     * A projection of a same-day [JournalEntry]. It preserves what was logged without exposing notes or
+     * claiming that the entry explains this reading.
+     */
+    data class JournalFact(
+        val day: String,
+        val question: String,
+        val answeredYes: Boolean,
+        val numericValue: Double?,
+    )
+
+    data class Feedback(
+        val eligibility: Eligibility,
+        val observation: Observation?,
+        val comparison: Comparison?,
+        val uncertainty: List<Uncertainty>,
+        val inference: Inference,
+        val recommendation: Recommendation,
+        /** Same-day journal facts only. They are deliberately not treated as a causal insight. */
+        val journalContext: List<JournalFact>,
+    )
+
+    /**
+     * Produce the next-morning reading from existing timestamped HR and sleep primitives.
+     *
+     * [hr] is expected to be the repository's measured/PPG-coalesced timeline. To remain safe for other
+     * callers, duplicate timestamps are also ignored after the first element, preserving the caller's
+     * precedence order. Both window bounds are transparent and half-open:
+     * `[sleep.start - window, sleep.start)`.
+     */
+    fun evaluate(
+        enabled: Boolean,
+        sessions: List<DetectedSleep>,
+        hr: List<HrSample>,
+        history: List<HistoricalReading>,
+        journalEntries: List<JournalEntry>,
+        day: String,
+        minimumValidSamples: Int = DEFAULT_MINIMUM_VALID_SAMPLES,
+        preSleepWindowSeconds: Int = DEFAULT_PRE_SLEEP_WINDOW_SECONDS,
+    ): Feedback {
+        fun closed(e: Eligibility, obs: Observation? = null, unc: List<Uncertainty> = emptyList(),
+                   ctx: List<JournalFact> = emptyList()) =
+            Feedback(e, obs, null, unc, Inference.NOT_ESTABLISHED, Recommendation.UNSUPPORTED, ctx)
+
+        if (!enabled) return closed(Eligibility.Disabled)
+        val evaluationDate = canonicalDay(day) ?: return closed(Eligibility.InvalidDay)
+        if (minimumValidSamples <= 0 || preSleepWindowSeconds <= 0) return closed(Eligibility.InvalidWindow)
+
+        val sessionsWithDuration = sessions.mapNotNull { session ->
+            val duration = subtractOrNull(session.end, session.start)
+            if (duration != null && duration > 0L) session to duration else null
+        }
+        val primary = sessionsWithDuration.maxByOrNull { it.second }?.first
+            ?: return closed(Eligibility.MissingPrimarySleep)
+
+        val start = subtractOrNull(primary.start, preSleepWindowSeconds.toLong())
+            ?: return closed(Eligibility.InvalidWindow)
+        val inWindow = deduplicated(hr).filter { it.ts.toLong() >= start && it.ts.toLong() < primary.start }
+        val valid = inWindow.filter {
+            baselineCfg.minVal <= it.bpm.toDouble() && it.bpm.toDouble() <= baselineCfg.maxVal
+        }
+        if (valid.size < minimumValidSamples) {
+            return closed(Eligibility.InsufficientPreSleepSamples(valid.size, minimumValidSamples))
+        }
+        // `toLong()` before summing, not after: `sumOf { it.bpm }` accumulates in Int and would WRAP
+        // silently, where Apple's `reduce` accumulates in 64-bit and cannot. Unreachable with a real
+        // window — 220 bpm needs ~9.7M samples to overflow — but a wrapped sum produces a plausible
+        // wrong mean rather than a failure, and this file guards its other arithmetic explicitly
+        // (`subtractOrNull`). Exact integer sum then divide, which is Apple's order too.
+        val mean = valid.sumOf { it.bpm.toLong() }.toDouble() / valid.size.toDouble()
+        val observation = Observation(
+            primarySleepStartTs = primary.start, primarySleepEndTs = primary.end,
+            windowStartTs = start, windowEndTs = primary.start, meanBpm = mean,
+            validSamples = valid.size, totalTimestampSamples = inWindow.size,
+        )
+        // Baselines use prior nights only and `rollingMeanSD` requires oldest-to-newest input. Retain the
+        // first caller-supplied reading for a repeated canonical day; one day contributes at most one
+        // night and no synthetic average is invented.
+        val seenDays = mutableSetOf<String>()
+        val priorHistory = history
+            .mapNotNull { reading ->
+                val date = canonicalDay(reading.day)
+                if (date != null && date.isBefore(evaluationDate) && seenDays.add(reading.day)) {
+                    reading to date
+                } else {
+                    null
+                }
+            }
+            .sortedBy { it.second }
+        val rollingBaseline = Baselines.rollingMeanSD(priorHistory.map { it.first.meanBpm }, baselineCfg)
+        val latestContributingDate = priorHistory.lastOrNull {
+            baselineCfg.minVal <= it.first.meanBpm && it.first.meanBpm <= baselineCfg.maxVal
+        }?.second
+        val nightsSinceUpdate = latestContributingDate
+            ?.let { maxOf(0L, ChronoUnit.DAYS.between(it, evaluationDate)).toInt() } ?: 0
+        val baseline = BaselineState(
+            baseline = rollingBaseline.baseline,
+            spread = rollingBaseline.spread,
+            nValid = rollingBaseline.nValid,
+            nightsSinceUpdate = nightsSinceUpdate,
+            status = Baselines.computeStatus(rollingBaseline.nValid, nightsSinceUpdate),
+        )
+        val context = journalEntries.filter { it.day == day }.map {
+            JournalFact(it.day, it.question, it.answeredYes, it.numericValue)
+        }
+        if (baseline.nValid < minimumBaselineNights) {
+            return closed(
+                Eligibility.InsufficientBaseline(baseline.nValid, minimumBaselineNights),
+                obs = observation, unc = listOf(Uncertainty.NoPersonalComparison), ctx = context,
+            )
+        }
+        if (!baseline.usable) {
+            return closed(
+                Eligibility.StaleBaseline(baseline.nightsSinceUpdate), obs = observation,
+                unc = listOf(Uncertainty.StaleBaseline(baseline.nightsSinceUpdate)), ctx = context,
+            )
+        }
+        val comparison = Comparison(
+            baselineBpm = baseline.baseline, deltaBpm = mean - baseline.baseline,
+            baselineNights = baseline.nValid, baselineStatus = baseline.status,
+        )
+        val uncertainty =
+            if (baseline.status == BaselineStatus.TRUSTED) emptyList()
+            else listOf(Uncertainty.ProvisionalBaseline)
+        return Feedback(
+            eligibility = Eligibility.Eligible, observation = observation, comparison = comparison,
+            uncertainty = uncertainty, inference = Inference.NOT_ESTABLISHED,
+            recommendation = Recommendation.UNSUPPORTED, journalContext = context,
+        )
+    }
+
+    /** `a - b`, or null when it would overflow. The Long twin of Swift's `subtractingReportingOverflow`. */
+    private fun subtractOrNull(a: Long, b: Long): Long? =
+        try { Math.subtractExact(a, b) } catch (_: ArithmeticException) { null }
+
+    /**
+     * A calendar day, or null when the string is not a canonical `YYYY-MM-DD`.
+     *
+     * The shape check alone is not enough: it accepts `2026-02-31`. [LocalDate.of] rejects an impossible
+     * day, which is what the Swift twin's round-trip through `Calendar` is doing.
+     */
+    private fun canonicalDay(day: String): LocalDate? {
+        val bytes = day.toByteArray(Charsets.UTF_8)
+        if (bytes.size != 10 || bytes[4] != '-'.code.toByte() || bytes[7] != '-'.code.toByte()) return null
+        val digitPositions = intArrayOf(0, 1, 2, 3, 5, 6, 8, 9)
+        if (!digitPositions.all { bytes[it] in 48..57 }) return null
+        val year = (bytes[0] - 48) * 1_000 + (bytes[1] - 48) * 100 + (bytes[2] - 48) * 10 + (bytes[3] - 48)
+        val month = (bytes[5] - 48) * 10 + (bytes[6] - 48)
+        val dayOfMonth = (bytes[8] - 48) * 10 + (bytes[9] - 48)
+        return try { LocalDate.of(year, month, dayOfMonth) } catch (_: java.time.DateTimeException) { null }
+    }
+
+    /**
+     * One sample per timestamp, FIRST occurrence wins.
+     *
+     * First-wins is the caller's precedence order, not an arbitrary pick: [evaluate]'s contract is an
+     * already-coalesced timeline where measured data outranks PPG-derived, so the first element for a
+     * timestamp is the one the repository chose. Stated here as well as on [evaluate] because the rule
+     * is invisible at this call site, and a later reader changing it to last-wins would silently invert
+     * that precedence (#1784).
+     */
+    private fun deduplicated(hr: List<HrSample>): List<HrSample> {
+        val seen = mutableSetOf<Int>()
+        return hr.filter { seen.add(it.ts) }
+    }
+}
diff --git a/android/app/src/test/java/com/noop/analytics/PreSleepHeartRateFeedbackTest.kt b/android/app/src/test/java/com/noop/analytics/PreSleepHeartRateFeedbackTest.kt
new file mode 100644
index 0000000000..d4dfe86d32
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/PreSleepHeartRateFeedbackTest.kt
@@ -0,0 +1,216 @@
+package com.noop.analytics
+
+import com.noop.data.JournalEntry
+import com.noop.protocol.HrSample
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * Kotlin twin of `PreSleepHeartRateFeedbackTests` (#1784), assertion for assertion.
+ *
+ * The numbers are the point: every expected value here was taken from the Swift suite unchanged, so a
+ * divergence in [Baselines.rollingMeanSD], [Baselines.computeStatus] or the day arithmetic shows up as a
+ * failure rather than as two platforms quietly disagreeing about the same night.
+ */
+class PreSleepHeartRateFeedbackTest {
+
+    private fun samples(start: Int, bpm: Int, count: Int): List<HrSample> =
+        (0 until count).map { HrSample(ts = start + it * 60, bpm = bpm) }
+
+    private fun sleep(start: Long = 10_000, end: Long = 36_000) =
+        DetectedSleep(start = start, end = end, efficiency = 0.9, stages = emptyList(),
+                      restingHR = null, avgHRV = null)
+
+    private fun reading(day: String, bpm: Double) =
+        PreSleepHeartRateFeedback.HistoricalReading(day = day, meanBpm = bpm)
+
+    @Test
+    fun `eligible feedback separates observation, comparison, uncertainty and unsupported recommendation`() {
+        val history = listOf(60.0, 61.0, 62.0, 63.0).mapIndexed { i, bpm ->
+            reading("2026-08-0${i + 1}", bpm)
+        }
+        val journal = JournalEntry(deviceId = "d", day = "2026-08-05", question = "Late meal",
+                                   answeredYes = true)
+        val feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled = true, sessions = listOf(sleep()),
+            hr = samples(8_800, 70, 12) + samples(10_000, 55, 12),
+            history = history, journalEntries = listOf(journal), day = "2026-08-05",
+            minimumValidSamples = 10, preSleepWindowSeconds = 1_800,
+        )
+
+        assertEquals(PreSleepHeartRateFeedback.Eligibility.Eligible, feedback.eligibility)
+        assertEquals(8_200L, feedback.observation?.windowStartTs)
+        assertEquals(10_000L, feedback.observation?.windowEndTs)
+        assertEquals(70.0, feedback.observation!!.meanBpm, 1e-9)
+        assertEquals(12, feedback.observation?.validSamples)
+        assertEquals(61.5, feedback.comparison!!.baselineBpm, 1e-9)
+        assertEquals(8.5, feedback.comparison!!.deltaBpm, 1e-9)
+        assertEquals(BaselineStatus.PROVISIONAL, feedback.comparison?.baselineStatus)
+        assertEquals(listOf(PreSleepHeartRateFeedback.Uncertainty.ProvisionalBaseline), feedback.uncertainty)
+        assertEquals(PreSleepHeartRateFeedback.Inference.NOT_ESTABLISHED, feedback.inference)
+        assertEquals(PreSleepHeartRateFeedback.Recommendation.UNSUPPORTED, feedback.recommendation)
+        assertEquals(
+            listOf(PreSleepHeartRateFeedback.JournalFact("2026-08-05", "Late meal", true, null)),
+            feedback.journalContext,
+        )
+    }
+
+    @Test
+    fun `the baseline uses only sorted prior nights`() {
+        val history = listOf(
+            reading("2026-08-01", 60.0), reading("2026-08-04", 63.0), reading("2026-08-02", 61.0),
+            reading("2026-08-03", 62.0), reading("2026-08-05", 90.0), reading("2026-08-06", 100.0),
+        )
+        val feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled = true, sessions = listOf(sleep()), hr = samples(8_800, 70, 12),
+            history = history, journalEntries = emptyList(), day = "2026-08-05",
+            minimumValidSamples = 10, preSleepWindowSeconds = 1_800,
+        )
+        // Current and future days must not leak in, and unsorted input must not change the answer.
+        assertEquals(61.5, feedback.comparison!!.baselineBpm, 1e-9)
+        assertEquals(4, feedback.comparison?.baselineNights)
+    }
+
+    @Test
+    fun `a repeated prior day cannot satisfy the minimum baseline nights`() {
+        val history = List(4) { reading("2026-08-01", 60.0) }
+        val feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled = true, sessions = listOf(sleep()), hr = samples(8_800, 70, 12),
+            history = history, journalEntries = emptyList(), day = "2026-08-05",
+            minimumValidSamples = 10, preSleepWindowSeconds = 1_800,
+        )
+        assertEquals(
+            PreSleepHeartRateFeedback.Eligibility.InsufficientBaseline(
+                1, PreSleepHeartRateFeedback.minimumBaselineNights),
+            feedback.eligibility,
+        )
+        assertNull(feedback.comparison)
+        assertEquals(listOf(PreSleepHeartRateFeedback.Uncertainty.NoPersonalComparison), feedback.uncertainty)
+    }
+
+    @Test
+    fun `noncanonical and impossible days cannot satisfy the minimum baseline nights`() {
+        // "2026-08-04Z" is the wrong length; 2026-02-31 passes a shape check and fails a real calendar.
+        val history = listOf(
+            reading("2026-08-01", 60.0), reading("2026-08-04Z", 61.0),
+            reading("2026-02-31", 62.0), reading("2026-08-03", 63.0),
+        )
+        val feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled = true, sessions = listOf(sleep()), hr = samples(8_800, 70, 12),
+            history = history, journalEntries = emptyList(), day = "2026-08-05",
+            minimumValidSamples = 10, preSleepWindowSeconds = 1_800,
+        )
+        assertEquals(
+            PreSleepHeartRateFeedback.Eligibility.InsufficientBaseline(
+                2, PreSleepHeartRateFeedback.minimumBaselineNights),
+            feedback.eligibility,
+        )
+    }
+
+    @Test
+    fun `invalid evaluation days cannot produce feedback`() {
+        for (day in listOf("2026-8-05", "2026-02-31", "not-a-day", "", "2026-08-05Z")) {
+            val feedback = PreSleepHeartRateFeedback.evaluate(
+                enabled = true, sessions = listOf(sleep()), hr = samples(8_800, 70, 12),
+                history = emptyList(), journalEntries = emptyList(), day = day,
+                minimumValidSamples = 10, preSleepWindowSeconds = 1_800,
+            )
+            assertEquals("day=$day", PreSleepHeartRateFeedback.Eligibility.InvalidDay, feedback.eligibility)
+            assertNull(feedback.observation)
+        }
+    }
+
+    @Test
+    fun `a baseline at the exact stale boundary stays trusted across a year boundary`() {
+        val history = (1..13).map { reading(String.format("2023-01-%02d", it), 60.0) } +
+            reading("2023-12-18", 60.0)
+        val feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled = true, sessions = listOf(sleep()), hr = samples(8_800, 70, 12),
+            history = history, journalEntries = emptyList(), day = "2024-01-01",
+            minimumValidSamples = 10, preSleepWindowSeconds = 1_800,
+        )
+        assertEquals(PreSleepHeartRateFeedback.Eligibility.Eligible, feedback.eligibility)
+        assertEquals(BaselineStatus.TRUSTED, feedback.comparison?.baselineStatus)
+        assertTrue(feedback.uncertainty.isEmpty())
+    }
+
+    @Test
+    fun `one day past the stale boundary is explicitly stale across a leap day`() {
+        val history = (1..13).map { reading(String.format("2024-01-%02d", it), 60.0) } +
+            reading("2024-02-15", 60.0)
+        val feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled = true, sessions = listOf(sleep()), hr = samples(8_800, 70, 12),
+            history = history, journalEntries = emptyList(), day = "2024-03-01",
+            minimumValidSamples = 10, preSleepWindowSeconds = 1_800,
+        )
+        // 15 only if 2024-02-29 is counted: the leap day is the assertion.
+        assertEquals(PreSleepHeartRateFeedback.Eligibility.StaleBaseline(15), feedback.eligibility)
+        assertNotNull(feedback.observation)
+        assertNull(feedback.comparison)
+        assertEquals(listOf(PreSleepHeartRateFeedback.Uncertainty.StaleBaseline(15)), feedback.uncertainty)
+    }
+
+    @Test
+    fun `an extreme sleep session duration fails closed without trapping`() {
+        val feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled = true, sessions = listOf(sleep(start = Long.MIN_VALUE, end = Long.MAX_VALUE)),
+            hr = samples(8_800, 70, 12), history = emptyList(), journalEntries = emptyList(),
+            day = "2026-08-05", minimumValidSamples = 10, preSleepWindowSeconds = 1_800,
+        )
+        assertEquals(PreSleepHeartRateFeedback.Eligibility.MissingPrimarySleep, feedback.eligibility)
+    }
+
+    @Test
+    fun `an extreme pre-sleep window fails closed without trapping`() {
+        val feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled = true, sessions = listOf(sleep(start = Long.MIN_VALUE + 1, end = Long.MIN_VALUE + 2)),
+            hr = samples(8_800, 70, 12), history = emptyList(), journalEntries = emptyList(),
+            day = "2026-08-05", minimumValidSamples = 10, preSleepWindowSeconds = 1_800,
+        )
+        assertEquals(PreSleepHeartRateFeedback.Eligibility.InvalidWindow, feedback.eligibility)
+    }
+
+    @Test
+    fun `opting out and lapsing fail closed without creating feedback or punishment`() {
+        val off = PreSleepHeartRateFeedback.evaluate(
+            enabled = false, sessions = listOf(sleep()), hr = samples(8_800, 70, 12),
+            history = emptyList(), journalEntries = emptyList(), day = "2026-08-05",
+        )
+        assertEquals(PreSleepHeartRateFeedback.Eligibility.Disabled, off.eligibility)
+        assertNull(off.observation)
+        assertTrue(off.journalContext.isEmpty())
+
+        val noSleep = PreSleepHeartRateFeedback.evaluate(
+            enabled = true, sessions = emptyList(), hr = samples(8_800, 70, 12),
+            history = emptyList(), journalEntries = emptyList(), day = "2026-08-05",
+        )
+        assertEquals(PreSleepHeartRateFeedback.Eligibility.MissingPrimarySleep, noSleep.eligibility)
+
+        val thin = PreSleepHeartRateFeedback.evaluate(
+            enabled = true, sessions = listOf(sleep()), hr = samples(8_800, 70, 3),
+            history = emptyList(), journalEntries = emptyList(), day = "2026-08-05",
+            minimumValidSamples = 10, preSleepWindowSeconds = 1_800,
+        )
+        assertEquals(
+            PreSleepHeartRateFeedback.Eligibility.InsufficientPreSleepSamples(3, 10), thin.eligibility)
+        // Every one of these is recoverable on a later night: no streak, no goal, no obligation.
+        assertEquals(PreSleepHeartRateFeedback.Recommendation.UNSUPPORTED, thin.recommendation)
+    }
+
+    @Test
+    fun `duplicate timestamps keep the caller's first sample, which is its precedence order`() {
+        // The repository coalesces measured over PPG before this runs, so first-wins preserves that
+        // choice. Last-wins would silently invert it.
+        val hr = samples(8_800, 70, 12) + samples(8_800, 200, 12)
+        val feedback = PreSleepHeartRateFeedback.evaluate(
+            enabled = true, sessions = listOf(sleep()), hr = hr, history = emptyList(),
+            journalEntries = emptyList(), day = "2026-08-05",
+            minimumValidSamples = 10, preSleepWindowSeconds = 1_800,
+        )
+        assertEquals(70.0, feedback.observation!!.meanBpm, 1e-9)
+        assertEquals(12, feedback.observation?.totalTimestampSamples)
+    }
+}

From 82f8cb9c8ec6fa447c2fd8fb306beb547b106166 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 16:41:58 +1200
Subject: [PATCH 138/333] push: make an omitted clock a compile error, not a
 green test (#1788)

#1786 stopped main being red by pinning every construction it could find. This
removes the reason one can be written unpinned at all.

    private val today: () -> LocalDate = { LocalDate.now() },
    private val zoneId: ZoneId = ZoneId.systemDefault(),

Both were silent defaults: omitting them compiled, read as deliberate, and
usually passed - until the calendar moved. PushWindow spans today.minusDays(13),
the journal fixtures are dated 2026-08-18, and the row sat inside that window
until it did not.

zoneId is the worse of the two. LocalDate.now() at least fails everywhere at
once; ZoneId.systemDefault() makes the answer depend on the MACHINE, so a test
can pass in CI and fail on a laptop for a reason neither surface shows.

The change earned itself on the first compile. Removing the defaults produced
errors at PushCoordinatorTest:56 and :188 - two constructions that SURVIVED
#1786 and were still wall-clock-dependent. Both are multi-line, so the greps
#1786 was verified with could not match them: one ends in a comma rather than
`SOURCE_A)`, the other puts every argument on its own line. That verification
claimed every construction passed an explicit clock. It did not, and grep is the
reason - the compiler found in one run what two rounds of manual checking missed.

Production cost is one call site: SelfHostedPushWorker now names the real clock
and zone itself. That is the point rather than a concession - the two facts that
decide the push window live at the caller that wants them, instead of being
inherited by 35 constructions that do not.

No behaviour change: the production path resolves to exactly what the defaults
produced. 5010 Android unit tests green, 0 failures.

Recorded on #1787: the sweep claim that PushCoordinator was the only class of
this shape was wrong - OuraDriver.nowMsProvider and LiveSessionRunner.nowEpochSec
are identical - but neither drifts in the direction that breaks a passing test,
and OuraDriver's two now-dependent tests already pin it.
---
 android/app/src/main/java/com/noop/push/PushCoordinator.kt  | 4 ++--
 .../app/src/main/java/com/noop/push/SelfHostedPushWorker.kt | 6 ++++++
 .../app/src/test/java/com/noop/push/PushCoordinatorTest.kt  | 4 +++-
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/android/app/src/main/java/com/noop/push/PushCoordinator.kt b/android/app/src/main/java/com/noop/push/PushCoordinator.kt
index 9d5ad72d8a..9d7dce4281 100644
--- a/android/app/src/main/java/com/noop/push/PushCoordinator.kt
+++ b/android/app/src/main/java/com/noop/push/PushCoordinator.kt
@@ -11,8 +11,8 @@ class PushCoordinator(
     private val transport: PushTransport,
     private val progress: PushProgressStore,
     private val sourceId: String,
-    private val today: () -> LocalDate = { LocalDate.now() },
-    private val zoneId: ZoneId = ZoneId.systemDefault(),
+    private val today: () -> LocalDate,
+    private val zoneId: ZoneId,
     private val destinationStillCurrent: () -> Boolean = { true },
 ) {
     suspend fun pushAppend(table: PushAppendTable, deviceId: String): PushResult {
diff --git a/android/app/src/main/java/com/noop/push/SelfHostedPushWorker.kt b/android/app/src/main/java/com/noop/push/SelfHostedPushWorker.kt
index 9e6e03d770..d1a97537f3 100644
--- a/android/app/src/main/java/com/noop/push/SelfHostedPushWorker.kt
+++ b/android/app/src/main/java/com/noop/push/SelfHostedPushWorker.kt
@@ -8,6 +8,8 @@ import androidx.work.ListenableWorker
 import androidx.work.WorkerParameters
 import com.noop.R
 import com.noop.data.WhoopDatabase
+import java.time.LocalDate
+import java.time.ZoneId
 import kotlinx.coroutines.CancellationException
 
 internal fun persistedDeviceIndex(startDeviceIndex: Int, nextDeviceIndex: Int, retryableFailure: Boolean): Int =
@@ -223,6 +225,10 @@ class SelfHostedPushWorker(
             transport = transport,
             progress = progress,
             sourceId = sourceId,
+            // The real clock and zone live HERE, at the one caller that wants them, rather than as
+            // defaults 35 test constructions could inherit without saying so (#1787).
+            today = { LocalDate.now() },
+            zoneId = ZoneId.systemDefault(),
             destinationStillCurrent = { settings.enabledEndpoint() == endpoint },
         ).pushKnownDevices(startDeviceIndex, MAX_DEVICES_PER_RUN, capabilities)
         settings.recordAcceptedBatches(
diff --git a/android/app/src/test/java/com/noop/push/PushCoordinatorTest.kt b/android/app/src/test/java/com/noop/push/PushCoordinatorTest.kt
index 0c42f8b2b3..c0f2f499fb 100644
--- a/android/app/src/test/java/com/noop/push/PushCoordinatorTest.kt
+++ b/android/app/src/test/java/com/noop/push/PushCoordinatorTest.kt
@@ -52,7 +52,7 @@ class PushCoordinatorTest {
 
         try {
             PushCoordinator(
-                source, transport, MemoryProgress(), SOURCE_A,
+                source, transport, MemoryProgress(), SOURCE_A, pinnedToday, ZoneId.of("UTC"),
                 destinationStillCurrent = { settings.enabledEndpoint() == first },
             ).pushKnownDevices(
                 capabilities = PushCapabilities(
@@ -186,6 +186,8 @@ class PushCoordinatorTest {
             throwing,
             progress,
             SOURCE_A,
+            pinnedToday,
+            ZoneId.of("UTC"),
         ).pushAppend(PushAppendTable.HR_SAMPLE, "a")
         assertTrue(result is PushResult.Rejected && result.retryable)
         assertTrue(progress.cursors.isEmpty())

From 8b30786cc267e91869da64d50d63a5862004479f Mon Sep 17 00:00:00 2001
From: Kevin Rajan <7121943+kvnloo@users.noreply.github.com>
Date: Tue, 1 Sep 2026 00:21:23 -0500
Subject: [PATCH 139/333] Preserve sensor-contact state from standard BLE
 heart-rate measurements (#1769)

The standard Heart Rate Measurement flags carry sensor contact, and NOOP was
discarding it. This decodes and persists it on both platforms.

The decode is right where it is easy to be wrong. Bit 2 is "supported", bit 1 is
"detected", and `unsupported` wins whenever bit 2 is clear regardless of bit 1 -
so it is modelled as a TRI-STATE rather than a Bool, because a peripheral that
cannot detect contact has not told us contact is absent. The storage strings are
byte-identical across platforms, so a row written by one reads on the other.

No Room migration: contact rides the existing `event` table as a kind, and the
DAO change is @Query-only, so the identity hash is untouched.

Merged with one known issue, fixed in the commit that follows this one: the
write is per-reading with no change detection, so a ~1 Hz stream produces ~86,400
event rows a day per device for a value that changes when you put the strap on
and take it off. The read side has no consumer yet, so that is currently pure
write amplification into a local-first database. Change-only emission is the
same series, several orders of magnitude smaller, and is what the read API's
"last value at or before ts" semantics wants anyway.

Also noted for later: Swift types `contact` as optional with a nil default where
Kotlin is non-optional, and nil means no event row at all. The one Swift caller
passes a real value so they agree today, but the types permit a silent
divergence. And CollectorStandardHRContactTests / StandardHeartRateTests live in
StrandTests, which only runs in the on-demand app-build - so those 118 lines are
not covered by the checks on this PR.

Thanks @kvnloo.
---
 .../Sources/WhoopProtocol/Streams.swift       | 24 +++++
 .../StandardHRContactTests.swift              | 22 +++++
 .../WhoopStore/Sources/WhoopStore/Reads.swift | 17 ++++
 .../WhoopStore/StandardHRMapping.swift        | 48 ++++++++--
 .../StandardHRMappingTests.swift              | 52 +++++++++++
 Strand/BLE/BLEManager.swift                   |  3 +-
 Strand/BLE/StandardHRSource.swift             | 13 +--
 Strand/BLE/StandardHeartRate.swift            |  8 +-
 Strand/Collect/Collector.swift                | 20 +++--
 .../CollectorStandardHRContactTests.swift     | 87 +++++++++++++++++++
 StrandTests/StandardHeartRateTests.swift      | 31 +++++++
 .../java/com/noop/ble/StandardHeartRate.kt    |  7 +-
 .../java/com/noop/ble/StandardHrSource.kt     | 20 +++--
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 35 +++++---
 .../java/com/noop/data/StandardHrMapping.kt   | 29 +++++++
 .../src/main/java/com/noop/data/WhoopDao.kt   | 12 +++
 .../java/com/noop/data/WhoopRepository.kt     | 10 +++
 .../main/java/com/noop/protocol/Streams.kt    | 21 +++++
 .../com/noop/ble/StandardHeartRateTest.kt     | 25 ++++++
 .../com/noop/data/StandardHrMappingTest.kt    | 60 +++++++++++++
 20 files changed, 504 insertions(+), 40 deletions(-)
 create mode 100644 Packages/WhoopProtocol/Tests/WhoopProtocolTests/StandardHRContactTests.swift
 create mode 100644 StrandTests/CollectorStandardHRContactTests.swift
 create mode 100644 StrandTests/StandardHeartRateTests.swift
 create mode 100644 android/app/src/main/java/com/noop/data/StandardHrMapping.kt
 create mode 100644 android/app/src/test/java/com/noop/data/StandardHrMappingTest.kt

diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/Streams.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/Streams.swift
index 6b83a63e41..a556bf99ed 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/Streams.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/Streams.swift
@@ -10,6 +10,30 @@ public struct HRSample: Equatable, Codable {
     public init(ts: Int, bpm: Int) { self.ts = ts; self.bpm = bpm }
 }
 
+/// Sensor-contact state carried by the standard BLE Heart Rate Measurement flags.
+///
+/// This is deliberately a tri-state rather than a Bool: a peripheral that does not support contact
+/// detection has not said that contact is absent. `unsupported` is also the only valid result whenever
+/// flag bit 2 is clear, irrespective of the value in detected bit 1.
+public enum StandardHRContact: String, Equatable, Codable, Sendable {
+    case unsupported
+    case supportedNotDetected = "supported_not_detected"
+    case supportedDetected = "supported_detected"
+
+    /// Decode the BLE Heart Rate Measurement flags: bit 2 = supported, bit 1 = detected.
+    /// `unsupported` wins whenever bit 2 is clear, irrespective of detected bit 1.
+    /// Twin of Kotlin `StandardHrContact.fromMeasurementFlags`.
+    public static func fromMeasurementFlags(_ flags: UInt8) -> StandardHRContact {
+        if flags & 0x04 == 0 {
+            return .unsupported
+        } else if flags & 0x02 == 0 {
+            return .supportedNotDetected
+        } else {
+            return .supportedDetected
+        }
+    }
+}
+
 /// WHICH sensor channel produced an R-R interval (#1071).
 ///
 /// A WHOOP strap has ONE beat source, so its rows carry no channel (nil) and nothing here changes for
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/StandardHRContactTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/StandardHRContactTests.swift
new file mode 100644
index 0000000000..d73a64f99a
--- /dev/null
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/StandardHRContactTests.swift
@@ -0,0 +1,22 @@
+import XCTest
+@testable import WhoopProtocol
+
+/// The BLE Heart Rate Measurement flags decode must live on the protocol type so Swift and Kotlin
+/// stay aligned: bit 2 = supported, bit 1 = detected, unsupported whenever bit 2 is clear.
+final class StandardHRContactTests: XCTestCase {
+    func testFromMeasurementFlagsCoversAllCombinations() {
+        let cases: [(flags: UInt8, expected: StandardHRContact)] = [
+            (0x00, .unsupported),
+            (0x02, .unsupported),
+            (0x04, .supportedNotDetected),
+            (0x06, .supportedDetected),
+        ]
+        for test in cases {
+            XCTAssertEqual(
+                StandardHRContact.fromMeasurementFlags(test.flags),
+                test.expected,
+                "flags 0x\(String(test.flags, radix: 16))"
+            )
+        }
+    }
+}
diff --git a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
index f994594b64..f8bb74b12a 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
@@ -60,6 +60,23 @@ extension WhoopStore {
         }
     }
 
+    /// Standard-BLE sensor-contact readings recorded alongside generic HR samples. Rows before this
+    /// feature have no contact event, so this intentionally returns no invented legacy values.
+    public func standardHRContacts(deviceId: String, from: Int, to: Int,
+                                   limit: Int) async throws -> [StandardHRContactSample] {
+        try syncRead { db in
+            try Row.fetchAll(db, sql: """
+                SELECT ts, payloadJSON FROM event
+                WHERE deviceId = ? AND kind = ? AND ts >= ? AND ts <= ?
+                ORDER BY ts ASC LIMIT ?
+                """, arguments: [deviceId, StandardHRMapping.contactEventKind, from, to, limit])
+                .map { row in
+                    let json: String = row["payloadJSON"]
+                    return try StandardHRMapping.contactSample(ts: row["ts"], payloadJSON: json)
+                }
+        }
+    }
+
     /// Cheap change-detector for the raw HR stream: `(count, maxTs)` over `[from, to]`, computed in
     /// SQLite over the `(deviceId, ts)` index WITHOUT materializing any rows (#836). Lets a caller decide
     /// "nothing was inserted since last time, skip the expensive re-read" for pennies, `COUNT(*)` moves on
diff --git a/Packages/WhoopStore/Sources/WhoopStore/StandardHRMapping.swift b/Packages/WhoopStore/Sources/WhoopStore/StandardHRMapping.swift
index 229d03ed57..3165ecb5ce 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/StandardHRMapping.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/StandardHRMapping.swift
@@ -8,15 +8,53 @@ import WhoopProtocol
 /// can't be unit-tested.
 ///
 /// A chest strap (Polar / Wahoo / Coospo / Garmin HRM / Amazfit Helio broadcast) only ever
-/// reports HR and (optionally) R-R intervals over 0x2A37; every other stream (spo2, skin temp,
-/// resp, gravity, steps, ppgHr, events, battery) is left empty.
+/// reports HR, (optionally) R-R intervals, and its standard contact flags over 0x2A37; every other
+/// stream (spo2, skin temp, resp, gravity, steps, ppgHr, battery) is left empty.
 public enum StandardHRMapping {
+    /// `event.kind` used for a standard BLE sensor-contact reading. The generic event table is the
+    /// established durable stream for additive decoded signals, so this needs no schema migration.
+    public static let contactEventKind = "STANDARD_HR_CONTACT"
+
     /// Build a `Streams` carrying one HR sample and zero-or-more R-R intervals, all stamped at the
     /// same wall-clock `ts` (unix seconds). Pure → unit-testable.
-    public static func samples(fromHR hr: Int, rr: [Int], at ts: Int) -> Streams {
-        Streams(
+    public static func samples(fromHR hr: Int, rr: [Int], contact: StandardHRContact? = nil,
+                               at ts: Int) -> Streams {
+        let events = contact.map { [
+            WhoopEvent(ts: ts, kind: contactEventKind, payload: ["contact": .string($0.rawValue)])
+        ] } ?? []
+        return Streams(
             hr: [HRSample(ts: ts, bpm: hr)],
-            rr: rr.map { RRInterval(ts: ts, rrMs: $0) }
+            rr: rr.map { RRInterval(ts: ts, rrMs: $0) },
+            events: events
         )
     }
+
+    /// Parse a persisted `STANDARD_HR_CONTACT` `payloadJSON`. Throws on malformed JSON or a missing /
+    /// unknown `contact` field so a parse failure is not the same as "no contact event".
+    public static func contactSample(ts: Int, payloadJSON: String) throws -> StandardHRContactSample {
+        let payload = try JSONDecoder().decode([String: ParsedValue].self, from: Data(payloadJSON.utf8))
+        guard case let .string(raw)? = payload["contact"] else {
+            throw ContactSampleError.missingContact
+        }
+        guard let contact = StandardHRContact(rawValue: raw) else {
+            throw ContactSampleError.unknownContact(raw)
+        }
+        return StandardHRContactSample(ts: ts, contact: contact)
+    }
+
+    public enum ContactSampleError: Error, Equatable {
+        case missingContact
+        case unknownContact(String)
+    }
+}
+
+/// One persisted standard-BLE sensor-contact reading. Legacy HR rows have no companion event and are
+/// therefore absent from this stream instead of being guessed as any contact state.
+public struct StandardHRContactSample: Equatable, Sendable {
+    public let ts: Int
+    public let contact: StandardHRContact
+    public init(ts: Int, contact: StandardHRContact) {
+        self.ts = ts
+        self.contact = contact
+    }
 }
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/StandardHRMappingTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/StandardHRMappingTests.swift
index 018ef3218f..f82d760f5f 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/StandardHRMappingTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/StandardHRMappingTests.swift
@@ -17,6 +17,47 @@ final class StandardHRMappingTests: XCTestCase {
         XCTAssertTrue(s.rr.isEmpty)
     }
 
+    func testStandardHRContactIsMappedAsAStableEvent() throws {
+        let s = StandardHRMapping.samples(
+            fromHR: 72,
+            rr: [],
+            contact: .supportedDetected,
+            at: 1_750_000_000
+        )
+        XCTAssertEqual(s.events, [
+            WhoopEvent(
+                ts: 1_750_000_000,
+                kind: StandardHRMapping.contactEventKind,
+                payload: ["contact": .string("supported_detected")]
+            )
+        ])
+    }
+
+    func testLegacyMappingDoesNotFabricateContact() throws {
+        let s = StandardHRMapping.samples(fromHR: 72, rr: [], at: 1_750_000_000)
+        XCTAssertTrue(s.events.isEmpty)
+    }
+
+    func testContactSurvivesInsertAndReadWhileLegacyRowsStayAbsent() async throws {
+        let store = try await WhoopStore.inMemory()
+        try await store.upsertDevice(id: "standard-strap", mac: nil, name: nil)
+        _ = try await store.insert(
+            StandardHRMapping.samples(fromHR: 72, rr: [], contact: .supportedNotDetected, at: 100),
+            deviceId: "standard-strap"
+        )
+        _ = try await store.insert(
+            StandardHRMapping.samples(fromHR: 73, rr: [], at: 101),
+            deviceId: "standard-strap"
+        )
+
+        let contacts = try await store.standardHRContacts(
+            deviceId: "standard-strap", from: 0, to: 200, limit: 10
+        )
+        XCTAssertEqual(contacts, [
+            StandardHRContactSample(ts: 100, contact: .supportedNotDetected)
+        ])
+    }
+
     func testOnlyHRandRRStreamsArePopulated() throws {
         // A chest strap reports nothing else — every other stream must stay empty.
         let s = StandardHRMapping.samples(fromHR: 88, rr: [700], at: 42)
@@ -29,4 +70,15 @@ final class StandardHRMappingTests: XCTestCase {
         XCTAssertTrue(s.events.isEmpty)
         XCTAssertTrue(s.battery.isEmpty)
     }
+
+    func testContactSampleParsesPayloadJSONAndDoesNotTreatParseFailureAsAbsence() throws {
+        let detected = try StandardHRMapping.contactSample(
+            ts: 100,
+            payloadJSON: #"{"extra":true,"contact":"supported_detected"}"#
+        )
+        XCTAssertEqual(detected, StandardHRContactSample(ts: 100, contact: .supportedDetected))
+
+        XCTAssertThrowsError(try StandardHRMapping.contactSample(ts: 101, payloadJSON: "not-json"))
+        XCTAssertThrowsError(try StandardHRMapping.contactSample(ts: 102, payloadJSON: "{}"))
+    }
 }
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index 6d06b7ab18..fc9c528bc6 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -5028,7 +5028,8 @@ public final class BLEManager: NSObject, ObservableObject {
         // change so a steady resting HR doesn't re-render the whole Live console every second.
         if m.hr >= 30 && m.hr <= 220, state.heartRate != m.hr { state.heartRate = m.hr }
         // Record it continuously — independent of the realtime stream or the open screen.
-        collector?.ingestStandardHR(hr: m.hr, rr: m.rr, at: Int(Date().timeIntervalSince1970))
+        collector?.ingestStandardHR(hr: m.hr, rr: m.rr, contact: m.contact,
+                                    at: Int(Date().timeIntervalSince1970))
     }
 }
 
diff --git a/Strand/BLE/StandardHRSource.swift b/Strand/BLE/StandardHRSource.swift
index 424f7c0c04..11778601e7 100644
--- a/Strand/BLE/StandardHRSource.swift
+++ b/Strand/BLE/StandardHRSource.swift
@@ -126,9 +126,9 @@ public final class StandardHRSource: NSObject, ObservableObject {
 
     // MARK: - Sample buffer
 
-    /// Buffered (hr, rr, ts) readings, flushed to `persist` in batches to keep the write path off
+    /// Buffered (hr, rr, contact, ts) readings, flushed to `persist` in batches to keep the write path off
     /// the per-notification hot loop.
-    private var buffer: [(hr: Int, rr: [Int], ts: Int)] = []
+    private var buffer: [(hr: Int, rr: [Int], contact: StandardHRContact, ts: Int)] = []
     private var lastFlush: Date = .init()
     /// Flush thresholds — whichever trips first.
     private let flushCount = 30
@@ -230,8 +230,8 @@ public final class StandardHRSource: NSObject, ObservableObject {
 
     // MARK: - Buffer / persistence
 
-    private func enqueue(hr: Int, rr: [Int]) {
-        buffer.append((hr: hr, rr: rr, ts: Int(Date().timeIntervalSince1970)))
+    private func enqueue(hr: Int, rr: [Int], contact: StandardHRContact) {
+        buffer.append((hr: hr, rr: rr, contact: contact, ts: Int(Date().timeIntervalSince1970)))
         if buffer.count >= flushCount || Date().timeIntervalSince(lastFlush) >= flushInterval {
             flush()
         }
@@ -240,7 +240,8 @@ public final class StandardHRSource: NSObject, ObservableObject {
     private func flush() {
         guard !buffer.isEmpty else { lastFlush = Date(); return }
         for sample in buffer {
-            persist(StandardHRMapping.samples(fromHR: sample.hr, rr: sample.rr, at: sample.ts))
+            persist(StandardHRMapping.samples(fromHR: sample.hr, rr: sample.rr,
+                                               contact: sample.contact, at: sample.ts))
         }
         buffer.removeAll()
         lastFlush = Date()
@@ -478,6 +479,6 @@ extension StandardHRSource: @preconcurrency CBPeripheralDelegate {
         live.heartRate = parsed.hr
         live.setRRIntervals(parsed.rr)
         live.connected = true
-        enqueue(hr: parsed.hr, rr: parsed.rr)
+        enqueue(hr: parsed.hr, rr: parsed.rr, contact: parsed.contact)
     }
 }
diff --git a/Strand/BLE/StandardHeartRate.swift b/Strand/BLE/StandardHeartRate.swift
index c1badb8bf6..5feb063dd0 100644
--- a/Strand/BLE/StandardHeartRate.swift
+++ b/Strand/BLE/StandardHeartRate.swift
@@ -1,11 +1,13 @@
 import Foundation
+import WhoopProtocol
 
 /// Pure parser for the standard BLE Heart Rate Measurement characteristic (0x2A37).
-/// Returns the heart rate (bpm) and any R-R intervals (ms). Pure → unit-testable.
+/// Returns the heart rate (bpm), R-R intervals (ms), and the contact state. Pure → unit-testable.
 public enum StandardHeartRate {
-    public static func parse(_ data: [UInt8]) -> (hr: Int, rr: [Int])? {
+    public static func parse(_ data: [UInt8]) -> (hr: Int, rr: [Int], contact: StandardHRContact)? {
         guard !data.isEmpty else { return nil }
         let flags = data[0]
+        let contact = StandardHRContact.fromMeasurementFlags(flags)
         var idx = 1
         let hr: Int
         if flags & 0x01 != 0 {                       // 16-bit HR
@@ -24,6 +26,6 @@ public enum StandardHeartRate {
                 idx += 2
             }
         }
-        return (hr, rr)
+        return (hr, rr, contact)
     }
 }
diff --git a/Strand/Collect/Collector.swift b/Strand/Collect/Collector.swift
index e07115f35d..b6250a06ae 100644
--- a/Strand/Collect/Collector.swift
+++ b/Strand/Collect/Collector.swift
@@ -97,10 +97,11 @@ final class Collector {
     private var lastStdInsertFailureLogMs: Int64 = 0
     private var lastRealtimeInsertFailureLogMs: Int64 = 0
 
-    /// Standard 0x2A37 HR/RR buffer — the reliable, always-on stream, recorded continuously
+    /// Standard 0x2A37 HR/RR/contact buffer — the reliable, always-on stream, recorded continuously
     /// (independent of the custom realtime stream or which screen is open).
     private var stdHR: [HRSample] = []
     private var stdRR: [RRInterval] = []
+    private var stdContact: [WhoopEvent] = []
     private var batchStartedAt: TimeInterval
     var bufferedCount: Int { buffer.count }
 
@@ -265,27 +266,31 @@ final class Collector {
 
     /// Buffer one standard Heart-Rate-Measurement reading. No clock correlation needed —
     /// these carry a wall-clock `ts` directly. Auto-flushes ~every 30 readings (~30s).
-    func ingestStandardHR(hr: Int, rr: [Int], at ts: Int) {
+    func ingestStandardHR(hr: Int, rr: [Int], contact: StandardHRContact? = nil, at ts: Int) {
         let acceptedHR = (30...220).contains(hr) ? 1 : 0
         let acceptedRR = rr.filter { (250...3000).contains($0) }
         if acceptedHR == 1 { stdHR.append(HRSample(ts: ts, bpm: hr)) }
         stdRR.append(contentsOf: acceptedRR.map { RRInterval(ts: ts, rrMs: $0) })
+        stdContact.append(contentsOf: StandardHRMapping.samples(
+            fromHR: hr, rr: [], contact: contact, at: ts
+        ).events)
         log?(LivePersistTrace.standardHRHostReceivedLine(
             hostUnixSeconds: ts,
             acceptedHRRows: acceptedHR, acceptedRRRows: acceptedRR.count,
             rejectedHRRows: 1 - acceptedHR, rejectedRRRows: rr.count - acceptedRR.count,
             pendingHRRows: stdHR.count, pendingRRRows: stdRR.count))
-        if stdHR.count + stdRR.count >= 30 {
+        if stdHR.count + stdRR.count + stdContact.count >= 30 {
             Task { @MainActor in await self.flushStandardHR(reason: .cadence) }
         }
     }
 
-    /// Persist the buffered standard HR/RR. Re-buffers on failure so nothing is lost.
+    /// Persist the buffered standard HR/RR/contact. Re-buffers on failure so nothing is lost.
     func flushStandardHR(reason: LivePersistTrace.StandardHRFlushReason = .explicit) async {
-        guard !stdHR.isEmpty || !stdRR.isEmpty else { return }
-        let hr = stdHR, rr = stdRR
+        guard !stdHR.isEmpty || !stdRR.isEmpty || !stdContact.isEmpty else { return }
+        let hr = stdHR, rr = stdRR, contact = stdContact
         stdHR.removeAll(keepingCapacity: true)
         stdRR.removeAll(keepingCapacity: true)
+        stdContact.removeAll(keepingCapacity: true)
         log?(LivePersistTrace.standardHRFlushAttemptLine(
             reason: reason, offeredHRRows: hr.count, offeredRRRows: rr.count))
         // #1118: census this batch BEFORE it is stored, exactly as the historical path does, so a strap
@@ -304,7 +309,7 @@ final class Collector {
             }
         }
         do {
-            let inserted = try await store.insert(Streams(hr: hr, rr: rr), deviceId: deviceId)
+            let inserted = try await store.insert(Streams(hr: hr, rr: rr, events: contact), deviceId: deviceId)
             stdInsertFailures = 0
             log?(LivePersistTrace.standardHRFlushSucceededLine(
                 reason: reason, offeredHRRows: hr.count, offeredRRRows: rr.count,
@@ -312,6 +317,7 @@ final class Collector {
         } catch {
             stdHR.insert(contentsOf: hr, at: 0)
             stdRR.insert(contentsOf: rr, at: 0)
+            stdContact.insert(contentsOf: contact, at: 0)
             stdInsertFailures += 1
             log?(LivePersistTrace.standardHRRebufferedForRetryLine(
                 reason: reason, attemptedHRRows: hr.count, attemptedRRRows: rr.count,
diff --git a/StrandTests/CollectorStandardHRContactTests.swift b/StrandTests/CollectorStandardHRContactTests.swift
new file mode 100644
index 0000000000..9137aacf8a
--- /dev/null
+++ b/StrandTests/CollectorStandardHRContactTests.swift
@@ -0,0 +1,87 @@
+import XCTest
+import WhoopProtocol
+import WhoopStore
+@testable import Strand
+
+@MainActor
+final class CollectorStandardHRContactTests: XCTestCase {
+    private final class CaptureStore: StoreWriting {
+        enum Failure: Error { case requested }
+
+        var inserted: [Streams] = []
+        var failNextInsert = false
+
+        func insert(_ streams: Streams, deviceId: String) async throws
+            -> (hr: Int, rr: Int, events: Int, battery: Int,
+                spo2: Int, skinTemp: Int, resp: Int, gravity: Int) {
+            if failNextInsert {
+                failNextInsert = false
+                throw Failure.requested
+            }
+            inserted.append(streams)
+            return (streams.hr.count, streams.rr.count, streams.events.count,
+                    streams.battery.count, streams.spo2.count, streams.skinTemp.count,
+                    streams.resp.count, streams.gravity.count)
+        }
+
+        func enqueueRawBatch(_ meta: RawBatchMeta, frames: [[UInt8]]) async throws {}
+    }
+
+    func testContactOnlyBatchAutoFlushesAtThreshold() async {
+        let store = CaptureStore()
+        let collector = Collector(store: store, deviceId: "whoop-5")
+
+        for ts in 1_750_000_000..<1_750_000_030 {
+            collector.ingestStandardHR(
+                hr: 0, rr: [], contact: .supportedNotDetected, at: ts
+            )
+        }
+        for _ in 0..<10 where store.inserted.isEmpty { await Task.yield() }
+
+        XCTAssertEqual(store.inserted.count, 1)
+        guard let inserted = store.inserted.first else { return }
+        XCTAssertTrue(inserted.hr.isEmpty)
+        XCTAssertTrue(inserted.rr.isEmpty)
+        XCTAssertEqual(inserted.events.count, 30)
+    }
+
+    func testWhoopStandardHRCollectorPersistsParsedContact() async {
+        let store = CaptureStore()
+        let collector = Collector(store: store, deviceId: "whoop-5")
+
+        collector.ingestStandardHR(
+            hr: 72, rr: [1_000], contact: .supportedNotDetected, at: 1_750_000_000
+        )
+        await collector.flushStandardHR()
+
+        XCTAssertEqual(store.inserted, [
+            StandardHRMapping.samples(
+                fromHR: 72,
+                rr: [1_000],
+                contact: .supportedNotDetected,
+                at: 1_750_000_000
+            )
+        ])
+    }
+
+    func testWhoopStandardHRCollectorRebuffersContactAfterInsertFailure() async {
+        let store = CaptureStore()
+        store.failNextInsert = true
+        let collector = Collector(store: store, deviceId: "whoop-5")
+
+        collector.ingestStandardHR(
+            hr: 73, rr: [], contact: .supportedDetected, at: 1_750_000_001
+        )
+        await collector.flushStandardHR()
+        XCTAssertTrue(store.inserted.isEmpty)
+
+        await collector.flushStandardHR()
+        XCTAssertEqual(store.inserted.first?.events, [
+            WhoopEvent(
+                ts: 1_750_000_001,
+                kind: StandardHRMapping.contactEventKind,
+                payload: ["contact": .string("supported_detected")]
+            )
+        ])
+    }
+}
diff --git a/StrandTests/StandardHeartRateTests.swift b/StrandTests/StandardHeartRateTests.swift
new file mode 100644
index 0000000000..948fb2f104
--- /dev/null
+++ b/StrandTests/StandardHeartRateTests.swift
@@ -0,0 +1,31 @@
+import XCTest
+import WhoopProtocol
+@testable import Strand
+
+final class StandardHeartRateTests: XCTestCase {
+    func testContactFlagsCoverAllCombinations() {
+        let cases: [(flags: UInt8, expected: StandardHRContact)] = [
+            (0x00, .unsupported),
+            (0x02, .unsupported),
+            (0x04, .supportedNotDetected),
+            (0x06, .supportedDetected),
+        ]
+
+        for test in cases {
+            XCTAssertEqual(
+                StandardHRContact.fromMeasurementFlags(test.flags),
+                test.expected,
+                "flags 0x\(String(test.flags, radix: 16))"
+            )
+            let parsed = StandardHeartRate.parse([test.flags, 72])
+            XCTAssertEqual(parsed?.contact, test.expected, "flags 0x\(String(test.flags, radix: 16))")
+        }
+    }
+
+    func testContactFlagsDoNotChangeExistingHeartRateOrRRParsing() {
+        let parsed = StandardHeartRate.parse([0x16, 72, 0x00, 0x04])
+        XCTAssertEqual(parsed?.hr, 72)
+        XCTAssertEqual(parsed?.rr, [1000])
+        XCTAssertEqual(parsed?.contact, .supportedDetected)
+    }
+}
diff --git a/android/app/src/main/java/com/noop/ble/StandardHeartRate.kt b/android/app/src/main/java/com/noop/ble/StandardHeartRate.kt
index 25c85fd0d2..4a5a7c96aa 100644
--- a/android/app/src/main/java/com/noop/ble/StandardHeartRate.kt
+++ b/android/app/src/main/java/com/noop/ble/StandardHeartRate.kt
@@ -1,5 +1,7 @@
 package com.noop.ble
 
+import com.noop.protocol.StandardHrContact
+
 /**
  * Pure parser for the standard BLE Heart Rate Measurement characteristic (0x2A37).
  *
@@ -20,7 +22,7 @@ package com.noop.ble
 object StandardHeartRate {
 
     /** The parsed reading: heart rate (bpm) and the R-R intervals (ms), in arrival order. */
-    data class Reading(val hr: Int, val rr: List<Int>)
+    data class Reading(val hr: Int, val rr: List<Int>, val contact: StandardHrContact)
 
     /**
      * Parse one 0x2A37 notification payload. Returns null on an empty or truncated packet (a packet
@@ -29,6 +31,7 @@ object StandardHeartRate {
     fun parse(data: ByteArray): Reading? {
         if (data.isEmpty()) return null
         val flags = data[0].toInt() and 0xFF
+        val contact = StandardHrContact.fromMeasurementFlags(flags)
         var idx = 1
 
         val hr: Int
@@ -52,6 +55,6 @@ object StandardHeartRate {
                 idx += 2
             }
         }
-        return Reading(hr, rr)
+        return Reading(hr, rr, contact)
     }
 }
diff --git a/android/app/src/main/java/com/noop/ble/StandardHrSource.kt b/android/app/src/main/java/com/noop/ble/StandardHrSource.kt
index db0408b44e..d56eab17e5 100644
--- a/android/app/src/main/java/com/noop/ble/StandardHrSource.kt
+++ b/android/app/src/main/java/com/noop/ble/StandardHrSource.kt
@@ -22,8 +22,10 @@ import android.os.ParcelUuid
 import com.noop.data.HrRow
 import com.noop.data.InsertCounts
 import com.noop.data.RrRow
+import com.noop.data.StandardHrMapping
 import com.noop.data.StreamBatch
 import com.noop.polar.PolarModel
+import com.noop.protocol.StandardHrContact
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
@@ -165,7 +167,12 @@ class StandardHrSource(
 
     // MARK: - Sample buffer (flushed in batches off the per-notification hot loop)
 
-    private data class Sample(val hr: Int, val rr: List<Int>, val ts: Long)
+    private data class Sample(
+        val hr: Int,
+        val rr: List<Int>,
+        val contact: StandardHrContact,
+        val ts: Long,
+    )
     private val bufferLock = Any()
     private val buffer = ArrayList<Sample>()
     private var lastFlushMs = System.currentTimeMillis()
@@ -267,9 +274,9 @@ class StandardHrSource(
 
     // MARK: - Buffer / persistence
 
-    private fun enqueue(hr: Int, rr: List<Int>) {
+    private fun enqueue(hr: Int, rr: List<Int>, contact: StandardHrContact) {
         val shouldFlush = synchronized(bufferLock) {
-            buffer.add(Sample(hr, rr, System.currentTimeMillis() / 1000L))
+            buffer.add(Sample(hr, rr, contact, System.currentTimeMillis() / 1000L))
             buffer.size >= flushCount ||
                 System.currentTimeMillis() - lastFlushMs >= flushIntervalMs
         }
@@ -301,9 +308,10 @@ class StandardHrSource(
             val s = ArrayList(buffer); buffer.clear(); s
         }
         val (hrRows, rrRows) = rowsOf(snapshot)
-        if (hrRows.isEmpty() && rrRows.isEmpty()) return
+        val contactEvents = snapshot.map { StandardHrMapping.contactEvent(it.ts, it.contact) }
+        if (hrRows.isEmpty() && rrRows.isEmpty() && contactEvents.isEmpty()) return
         log(standardHrFlushAttemptLine(reason.raw, hrRows.size, rrRows.size))
-        persist(StreamBatch(hr = hrRows, rr = rrRows), deviceId) { result ->
+        persist(StreamBatch(hr = hrRows, rr = rrRows, events = contactEvents), deviceId) { result ->
             result.fold(
                 onSuccess = { counts ->
                     insertFailures.set(0)
@@ -602,7 +610,7 @@ class StandardHrSource(
         }
         // Surface live HR on the main looper (the UI's StateFlow expects main-thread updates).
         handler.post { guardedCallback("live-sink") { liveSink(parsed.hr, parsed.rr) } }
-        enqueue(parsed.hr, parsed.rr)
+        enqueue(parsed.hr, parsed.rr, parsed.contact)
     }
 
     companion object {
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 36dd3acc42..15d73b2a50 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -27,6 +27,8 @@ import android.util.Log
 import com.noop.NoopApplication
 import com.noop.data.HrRow
 import com.noop.data.RrRow
+import com.noop.data.EventEntry
+import com.noop.data.StandardHrMapping
 import com.noop.data.StreamBatch
 import com.noop.data.StreamPersistence
 import com.noop.protocol.Whoop5RawImu
@@ -54,6 +56,7 @@ import com.noop.protocol.Reassembler
 import com.noop.protocol.Whoop5Variant
 import com.noop.protocol.RebootProbeVariant
 import com.noop.protocol.Streams
+import com.noop.protocol.StandardHrContact
 import com.noop.protocol.Whoop5Config
 import com.noop.protocol.extractStreams
 import com.noop.protocol.WhoopGattServiceFamily
@@ -417,6 +420,12 @@ data class GroundTruthImuStatus(
     val note: String = "Not started",
 )
 
+internal fun standardHrBufferReachedFlushThreshold(
+    hrCount: Int,
+    rrCount: Int,
+    contactCount: Int,
+): Boolean = hrCount + rrCount + contactCount >= 30
+
 class WhoopBleClient(
     private val context: Context,
     /**
@@ -3214,9 +3223,10 @@ class WhoopBleClient(
     private val liveBuffer = ArrayList<Pair<ByteArray, com.noop.protocol.ParsedFrame>>()
     private var batchStartedAtMs = System.currentTimeMillis()
 
-    /** Standard 0x2A37 HR/RR buffer — the reliable, always-on stream (port of Collector.stdHR/stdRR). */
+    /** Standard 0x2A37 HR/RR/contact buffer — the reliable, always-on stream. */
     private val stdHr = ArrayList<HrRow>()
     private val stdRr = ArrayList<RrRow>()
+    private val stdContact = ArrayList<EventEntry>()
 
     // --- Offload frame drain (preserves START/data/END arrival order; port of routeBackfillFrame) ---
 
@@ -7407,6 +7417,7 @@ class WhoopBleClient(
         val flags = data[0].toInt() and 0xFF
         val hr16 = (flags and 0x01) != 0
         val rrPresent = (flags and 0x10) != 0
+        val contact = StandardHrContact.fromMeasurementFlags(flags)
 
         var idx = 1
         val hr: Int
@@ -7460,7 +7471,7 @@ class WhoopBleClient(
 
         // Record it continuously — independent of the realtime stream or which screen is open.
         // Port of BLEManager.parseStandardHR -> collector.ingestStandardHR(hr:rr:at:).
-        ingestStandardHr(hr, rr, (System.currentTimeMillis() / 1000L))
+        ingestStandardHr(hr, rr, contact, (System.currentTimeMillis() / 1000L))
     }
 
     /** The Test Centre gate, bound once to the app's single "noop_testcentre" prefs file. Lazily built so
@@ -8889,22 +8900,24 @@ class WhoopBleClient(
      * Buffer one standard 0x2A37 reading (carries a wall-clock ts directly, no clock ref needed).
      * Auto-flushes ~every 30 readings. Port of `Collector.ingestStandardHR`.
      */
-    private fun ingestStandardHr(hr: Int, rr: List<Int>, ts: Long) {
+    private fun ingestStandardHr(hr: Int, rr: List<Int>, contact: StandardHrContact, ts: Long) {
         val shouldFlush = synchronized(collectorLock) {
             if (hr in 30..220) stdHr.add(HrRow(ts, hr))
             for (r in rr) if (r in 250..3000) stdRr.add(RrRow(ts, r))
-            stdHr.size + stdRr.size >= 30
+            stdContact.add(StandardHrMapping.contactEvent(ts, contact))
+            standardHrBufferReachedFlushThreshold(stdHr.size, stdRr.size, stdContact.size)
         }
         if (shouldFlush) ioScope.launch { flushStandardHr() }
     }
 
     /** Persist the buffered standard HR/RR. Re-buffers on failure. Port of `Collector.flushStandardHR`. */
     private suspend fun flushStandardHr() {
-        val (hr, rr) = synchronized(collectorLock) {
-            if (stdHr.isEmpty() && stdRr.isEmpty()) return
+        val (hr, rr, contact) = synchronized(collectorLock) {
+            if (stdHr.isEmpty() && stdRr.isEmpty() && stdContact.isEmpty()) return
             val h = ArrayList(stdHr); val r = ArrayList(stdRr)
-            stdHr.clear(); stdRr.clear()
-            h to r
+            val c = ArrayList(stdContact)
+            stdHr.clear(); stdRr.clear(); stdContact.clear()
+            Triple(h, r, c)
         }
         // #1118: census this batch BEFORE it is stored, exactly as the historical path does, so a
         // strap log carries one `ratioRep` per transport. If each transport reports ~1.0 while the
@@ -8921,10 +8934,12 @@ class WhoopBleClient(
             }
         }
         try {
-            repository.insert(StreamBatch(hr = hr, rr = rr), deviceId)
+            repository.insert(StreamBatch(hr = hr, rr = rr, events = contact), deviceId)
             liveInsertFailuresStd.set(0)
         } catch (t: Throwable) {
-            synchronized(collectorLock) { stdHr.addAll(0, hr); stdRr.addAll(0, rr) }
+            synchronized(collectorLock) {
+                stdHr.addAll(0, hr); stdRr.addAll(0, rr); stdContact.addAll(0, contact)
+            }
             // Swallowing this made the instrumentation above read like success: a store failing every
             // insert produced a log full of `rr emit ... offered=N` and no sign that none of it landed.
             val runLength = liveInsertFailuresStd.incrementAndGet()
diff --git a/android/app/src/main/java/com/noop/data/StandardHrMapping.kt b/android/app/src/main/java/com/noop/data/StandardHrMapping.kt
new file mode 100644
index 0000000000..2a0d6c277e
--- /dev/null
+++ b/android/app/src/main/java/com/noop/data/StandardHrMapping.kt
@@ -0,0 +1,29 @@
+package com.noop.data
+
+import com.noop.protocol.StandardHrContact
+import org.json.JSONObject
+
+/** Durable mapping for standard-BLE contact readings; legacy HR rows have no companion event. */
+object StandardHrMapping {
+    const val CONTACT_EVENT_KIND = "STANDARD_HR_CONTACT"
+
+    fun contactEvent(ts: Long, contact: StandardHrContact): EventEntry = EventEntry(
+        ts = ts,
+        kind = CONTACT_EVENT_KIND,
+        payloadJSON = "{\"contact\":\"${contact.storageValue}\"}",
+    )
+
+    /**
+     * Parse a persisted [CONTACT_EVENT_KIND] [EventRow.payloadJSON]. Throws [org.json.JSONException]
+     * (or [IllegalArgumentException] for an unknown value) so a parse failure is not the same as
+     * "no contact event" — absence is an empty query, not a skipped row.
+     */
+    fun contactSample(row: EventRow): StandardHrContactSample {
+        val raw = JSONObject(row.payloadJSON).getString("contact")
+        val contact = StandardHrContact.fromStorageValue(raw)
+            ?: throw IllegalArgumentException("unknown STANDARD_HR_CONTACT value: $raw")
+        return StandardHrContactSample(row.ts, contact)
+    }
+}
+
+data class StandardHrContactSample(val ts: Long, val contact: StandardHrContact)
diff --git a/android/app/src/main/java/com/noop/data/WhoopDao.kt b/android/app/src/main/java/com/noop/data/WhoopDao.kt
index 975e1139d8..f0aaa38755 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDao.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDao.kt
@@ -457,6 +457,18 @@ interface WhoopDao : DeviceRegistryDao {
     )
     suspend fun events(deviceId: String, from: Long, to: Long, limit: Int): List<EventRow>
 
+    @Query(
+        "SELECT * FROM event WHERE deviceId = :deviceId AND kind = :kind " +
+            "AND ts >= :from AND ts <= :to ORDER BY ts ASC LIMIT :limit"
+    )
+    suspend fun eventsByKind(
+        deviceId: String,
+        kind: String,
+        from: Long,
+        to: Long,
+        limit: Int,
+    ): List<EventRow>
+
     @Query(
         "SELECT * FROM battery WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to " +
             "ORDER BY ts ASC LIMIT :limit"
diff --git a/android/app/src/main/java/com/noop/data/WhoopRepository.kt b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
index 0037e7e8d8..3e7af70938 100644
--- a/android/app/src/main/java/com/noop/data/WhoopRepository.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
@@ -1159,6 +1159,16 @@ class WhoopRepository(
     suspend fun events(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
         dao.events(deviceId, from, to, limit)
 
+    /** Standard-BLE contact readings only; legacy HR rows have no companion event and stay absent. */
+    suspend fun standardHrContacts(
+        deviceId: String,
+        from: Long,
+        to: Long,
+        limit: Int = DEFAULT_LIMIT,
+    ): List<StandardHrContactSample> = dao.eventsByKind(
+        deviceId, StandardHrMapping.CONTACT_EVENT_KIND, from, to, limit,
+    ).map(StandardHrMapping::contactSample)
+
     suspend fun batterySamples(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
         dao.batterySamples(deviceId, from, to, limit)
 
diff --git a/android/app/src/main/java/com/noop/protocol/Streams.kt b/android/app/src/main/java/com/noop/protocol/Streams.kt
index fda1162025..f591bb8b35 100644
--- a/android/app/src/main/java/com/noop/protocol/Streams.kt
+++ b/android/app/src/main/java/com/noop/protocol/Streams.kt
@@ -1,5 +1,26 @@
 package com.noop.protocol
 
+/** Sensor-contact state carried by the standard BLE Heart Rate Measurement flags. */
+enum class StandardHrContact(val storageValue: String) {
+    UNSUPPORTED("unsupported"),
+    SUPPORTED_NOT_DETECTED("supported_not_detected"),
+    SUPPORTED_DETECTED("supported_detected"),
+
+    ;
+
+    companion object {
+        fun fromMeasurementFlags(flags: Int): StandardHrContact = when {
+            flags and 0x04 == 0 -> UNSUPPORTED
+            flags and 0x02 == 0 -> SUPPORTED_NOT_DETECTED
+            else -> SUPPORTED_DETECTED
+        }
+
+        fun fromStorageValue(value: String): StandardHrContact? = entries.firstOrNull {
+            it.storageValue == value
+        }
+    }
+}
+
 /**
  * Decoded stream rows — the durable, compact local record produced from parsed frames.
  *
diff --git a/android/app/src/test/java/com/noop/ble/StandardHeartRateTest.kt b/android/app/src/test/java/com/noop/ble/StandardHeartRateTest.kt
index 7890a08c2a..1a05ae20bc 100644
--- a/android/app/src/test/java/com/noop/ble/StandardHeartRateTest.kt
+++ b/android/app/src/test/java/com/noop/ble/StandardHeartRateTest.kt
@@ -1,5 +1,6 @@
 package com.noop.ble
 
+import com.noop.protocol.StandardHrContact
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
@@ -16,6 +17,30 @@ class StandardHeartRateTest {
 
     private fun bytes(vararg v: Int): ByteArray = ByteArray(v.size) { v[it].toByte() }
 
+    @Test
+    fun contactOnlyBufferReachesFlushThreshold() {
+        assertTrue(standardHrBufferReachedFlushThreshold(
+            hrCount = 0,
+            rrCount = 0,
+            contactCount = 30,
+        ))
+    }
+
+    @Test
+    fun contactFlagsCoverAllCombinations() {
+        val cases = listOf(
+            0x00 to StandardHrContact.UNSUPPORTED,
+            0x02 to StandardHrContact.UNSUPPORTED,
+            0x04 to StandardHrContact.SUPPORTED_NOT_DETECTED,
+            0x06 to StandardHrContact.SUPPORTED_DETECTED,
+        )
+
+        for ((flags, expected) in cases) {
+            assertEquals("flags 0x${flags.toString(16)}", expected,
+                StandardHeartRate.parse(bytes(flags, 72))!!.contact)
+        }
+    }
+
     @Test
     fun eightBitHrNoRr() {
         // flags=0x00 (8-bit HR, no R-R), HR=72.
diff --git a/android/app/src/test/java/com/noop/data/StandardHrMappingTest.kt b/android/app/src/test/java/com/noop/data/StandardHrMappingTest.kt
new file mode 100644
index 0000000000..5e23874992
--- /dev/null
+++ b/android/app/src/test/java/com/noop/data/StandardHrMappingTest.kt
@@ -0,0 +1,60 @@
+package com.noop.data
+
+import com.noop.protocol.StandardHrContact
+import org.json.JSONException
+import org.junit.Assert.assertEquals
+import org.junit.Assert.fail
+import org.junit.Test
+
+class StandardHrMappingTest {
+    @Test
+    fun contactUsesSwiftParityEventShape() {
+        assertEquals(
+            EventEntry(
+                ts = 1_750_000_000L,
+                kind = "STANDARD_HR_CONTACT",
+                payloadJSON = "{\"contact\":\"supported_not_detected\"}",
+            ),
+            StandardHrMapping.contactEvent(
+                1_750_000_000L,
+                StandardHrContact.SUPPORTED_NOT_DETECTED,
+            ),
+        )
+    }
+
+    @Test
+    fun contactReadParsesPayloadJsonRegardlessOfKeyOrder() {
+        val row = EventRow(
+            deviceId = "whoop-5",
+            ts = 1_750_000_001L,
+            kind = StandardHrMapping.CONTACT_EVENT_KIND,
+            payloadJSON = "{\"extra\":true,\"contact\":\"supported_detected\"}",
+        )
+        assertEquals(
+            StandardHrContactSample(1_750_000_001L, StandardHrContact.SUPPORTED_DETECTED),
+            StandardHrMapping.contactSample(row),
+        )
+    }
+
+    @Test
+    fun invalidPayloadJsonIsParseFailureNotAbsence() {
+        val row = EventRow(
+            deviceId = "whoop-5",
+            ts = 1_750_000_001L,
+            kind = StandardHrMapping.CONTACT_EVENT_KIND,
+            payloadJSON = "{\"contact\":\"supported_detected\"}",
+        )
+        try {
+            StandardHrMapping.contactSample(row.copy(payloadJSON = "not-json"))
+            fail("expected parse failure")
+        } catch (e: JSONException) {
+            // parse failure must not collapse into "no contact event"
+        }
+        try {
+            StandardHrMapping.contactSample(row.copy(payloadJSON = "{}"))
+            fail("expected parse failure")
+        } catch (e: JSONException) {
+            // missing contact key is a parse failure, not legacy absence
+        }
+    }
+}

From 270a84f8e3fd0aa6e012b20e9b765a038165e7ae Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 17:29:15 +1200
Subject: [PATCH 140/333] standard-HR: record contact changes, not every
 reading

#1769 wrote one STANDARD_HR_CONTACT event per reading. The standard 0x2A37
stream arrives at ~1 Hz - the source's own comment says "auto-flushes ~every 30
readings (~30s)" - so that is ~86,400 rows a day per connected device, into a
local-first database, to say the same thing 86,390 times.

Contact is a STATE, not a measurement. It changes when the strap goes on or
comes off, a handful of times a day. The read side reconstructs "the value at or
before ts", so it only ever needed the transitions; the dense encoding was cost
with no corresponding read. A full 1500-reading session now stores three rows -
the opening state and two changes - instead of 1500.

Deduped at INGEST on both platforms, not at flush, and that placement is the
whole correctness argument. A failed insert re-buffers: Kotlin puts the samples
back at the front, Swift re-inserts the events at index 0. Because the change
point travels in the buffer until it persists, advancing `last` at ingest is
safe and nothing has to be unwound on failure. Advancing it at flush instead
would drop the transition permanently the first time an insert failed - and a
lost transition is not a lost sample, it is a state that stays wrong for every
read after it.

The first reading always records, so a session opens with its starting state and
a reader never has to assume one.

Both tests assert over a SEQUENCE rather than on the predicate: the number that
matters is how many rows a run of readings produces, and a predicate-only test
would pass just as happily if the caller stopped consulting it.

Android 5017 unit tests green; WhoopStore 462; WhoopProtocol 12.
---
 .../WhoopStore/StandardHRMapping.swift        | 15 ++++++++
 .../StandardHRMappingTests.swift              | 30 ++++++++++++++++
 Strand/Collect/Collector.swift                | 13 +++++--
 .../java/com/noop/ble/StandardHrSource.kt     | 15 ++++++--
 .../java/com/noop/data/StandardHrMapping.kt   | 14 ++++++++
 .../com/noop/data/StandardHrMappingTest.kt    | 34 +++++++++++++++++++
 6 files changed, 115 insertions(+), 6 deletions(-)

diff --git a/Packages/WhoopStore/Sources/WhoopStore/StandardHRMapping.swift b/Packages/WhoopStore/Sources/WhoopStore/StandardHRMapping.swift
index 3165ecb5ce..287035c07a 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/StandardHRMapping.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/StandardHRMapping.swift
@@ -15,6 +15,21 @@ public enum StandardHRMapping {
     /// established durable stream for additive decoded signals, so this needs no schema migration.
     public static let contactEventKind = "STANDARD_HR_CONTACT"
 
+    /// Should this reading record a contact event, given the last one recorded?
+    ///
+    /// Contact is a STATE, not a measurement: it changes when the strap goes on or comes off, a handful
+    /// of times a day, while the standard 0x2A37 stream arrives at ~1 Hz. Writing one row per reading
+    /// stored ~86,400 rows a day per device to say the same thing 86,390 times, into a local-first
+    /// database, for a read side that reconstructs "the value at or before ts" and therefore only ever
+    /// needed the changes.
+    ///
+    /// `previous == nil` records, so every session opens with its starting state and a reader never has
+    /// to assume one. Twin of Kotlin `StandardHrMapping.shouldRecordContact`.
+    public static func shouldRecordContact(previous: StandardHRContact?,
+                                           current: StandardHRContact) -> Bool {
+        previous != current
+    }
+
     /// Build a `Streams` carrying one HR sample and zero-or-more R-R intervals, all stamped at the
     /// same wall-clock `ts` (unix seconds). Pure → unit-testable.
     public static func samples(fromHR hr: Int, rr: [Int], contact: StandardHRContact? = nil,
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/StandardHRMappingTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/StandardHRMappingTests.swift
index f82d760f5f..1777250208 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/StandardHRMappingTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/StandardHRMappingTests.swift
@@ -81,4 +81,34 @@ final class StandardHRMappingTests: XCTestCase {
         XCTAssertThrowsError(try StandardHRMapping.contactSample(ts: 101, payloadJSON: "not-json"))
         XCTAssertThrowsError(try StandardHRMapping.contactSample(ts: 102, payloadJSON: "{}"))
     }
+
+    /// Contact is a state, not a measurement. A ~1 Hz stream that recorded every reading wrote ~86,400
+    /// rows a day per device to say the same thing, for a read side that only ever needed the changes.
+    ///
+    /// Asserted over a SEQUENCE rather than on the predicate alone: the number that matters is how many
+    /// rows a run of readings produces, and a predicate test would pass just as happily if the caller
+    /// stopped consulting it. Kotlin twin: "a run of identical readings records one row, and each change
+    /// records one more".
+    func testARunOfIdenticalReadingsRecordsOneRowAndEachChangeRecordsOneMore() {
+        let readings = Array(repeating: StandardHRContact.supportedDetected, count: 600)
+            + Array(repeating: StandardHRContact.supportedNotDetected, count: 300)
+            + Array(repeating: StandardHRContact.supportedDetected, count: 600)
+
+        var previous: StandardHRContact?
+        var recorded = 0
+        for c in readings where StandardHRMapping.shouldRecordContact(previous: previous, current: c) {
+            recorded += 1
+            previous = c
+        }
+        // 1500 readings — a full session — become three rows: the opening state and two transitions.
+        XCTAssertEqual(recorded, 3)
+    }
+
+    /// The first reading always records, so a session never opens with an assumed state.
+    func testTheFirstReadingAlwaysRecords() {
+        XCTAssertTrue(StandardHRMapping.shouldRecordContact(previous: nil, current: .unsupported))
+        XCTAssertTrue(StandardHRMapping.shouldRecordContact(previous: nil, current: .supportedDetected))
+        XCTAssertFalse(StandardHRMapping.shouldRecordContact(previous: .supportedDetected,
+                                                             current: .supportedDetected))
+    }
 }
diff --git a/Strand/Collect/Collector.swift b/Strand/Collect/Collector.swift
index b6250a06ae..df46534630 100644
--- a/Strand/Collect/Collector.swift
+++ b/Strand/Collect/Collector.swift
@@ -102,6 +102,8 @@ final class Collector {
     private var stdHR: [HRSample] = []
     private var stdRR: [RRInterval] = []
     private var stdContact: [WhoopEvent] = []
+    /// Last contact state buffered, so only transitions are recorded. See `shouldRecordContact`.
+    private var lastStdContact: StandardHRContact?
     private var batchStartedAt: TimeInterval
     var bufferedCount: Int { buffer.count }
 
@@ -271,9 +273,14 @@ final class Collector {
         let acceptedRR = rr.filter { (250...3000).contains($0) }
         if acceptedHR == 1 { stdHR.append(HRSample(ts: ts, bpm: hr)) }
         stdRR.append(contentsOf: acceptedRR.map { RRInterval(ts: ts, rrMs: $0) })
-        stdContact.append(contentsOf: StandardHRMapping.samples(
-            fromHR: hr, rr: [], contact: contact, at: ts
-        ).events)
+        // Only the CHANGES. Advanced here rather than at flush because the event travels in the buffer
+        // until it persists: a failed insert re-inserts it at the front, so nothing has to be unwound.
+        if let contact, StandardHRMapping.shouldRecordContact(previous: lastStdContact, current: contact) {
+            lastStdContact = contact
+            stdContact.append(contentsOf: StandardHRMapping.samples(
+                fromHR: hr, rr: [], contact: contact, at: ts
+            ).events)
+        }
         log?(LivePersistTrace.standardHRHostReceivedLine(
             hostUnixSeconds: ts,
             acceptedHRRows: acceptedHR, acceptedRRRows: acceptedRR.count,
diff --git a/android/app/src/main/java/com/noop/ble/StandardHrSource.kt b/android/app/src/main/java/com/noop/ble/StandardHrSource.kt
index d56eab17e5..e8498242d1 100644
--- a/android/app/src/main/java/com/noop/ble/StandardHrSource.kt
+++ b/android/app/src/main/java/com/noop/ble/StandardHrSource.kt
@@ -170,7 +170,8 @@ class StandardHrSource(
     private data class Sample(
         val hr: Int,
         val rr: List<Int>,
-        val contact: StandardHrContact,
+        /** Non-null ONLY when this reading changed the contact state — see [StandardHrMapping.shouldRecordContact]. */
+        val contact: StandardHrContact?,
         val ts: Long,
     )
     private val bufferLock = Any()
@@ -274,9 +275,15 @@ class StandardHrSource(
 
     // MARK: - Buffer / persistence
 
+    /** Last contact state put in the buffer. Advanced at ENQUEUE, which is safe because the change point
+     *  travels in the buffer until it persists: a failed flush re-buffers the sample carrying it. */
+    private var lastEnqueuedContact: StandardHrContact? = null
+
     private fun enqueue(hr: Int, rr: List<Int>, contact: StandardHrContact) {
         val shouldFlush = synchronized(bufferLock) {
-            buffer.add(Sample(hr, rr, contact, System.currentTimeMillis() / 1000L))
+            val record = StandardHrMapping.shouldRecordContact(lastEnqueuedContact, contact)
+            if (record) lastEnqueuedContact = contact
+            buffer.add(Sample(hr, rr, if (record) contact else null, System.currentTimeMillis() / 1000L))
             buffer.size >= flushCount ||
                 System.currentTimeMillis() - lastFlushMs >= flushIntervalMs
         }
@@ -308,7 +315,9 @@ class StandardHrSource(
             val s = ArrayList(buffer); buffer.clear(); s
         }
         val (hrRows, rrRows) = rowsOf(snapshot)
-        val contactEvents = snapshot.map { StandardHrMapping.contactEvent(it.ts, it.contact) }
+        val contactEvents = snapshot.mapNotNull { s ->
+            s.contact?.let { StandardHrMapping.contactEvent(s.ts, it) }
+        }
         if (hrRows.isEmpty() && rrRows.isEmpty() && contactEvents.isEmpty()) return
         log(standardHrFlushAttemptLine(reason.raw, hrRows.size, rrRows.size))
         persist(StreamBatch(hr = hrRows, rr = rrRows, events = contactEvents), deviceId) { result ->
diff --git a/android/app/src/main/java/com/noop/data/StandardHrMapping.kt b/android/app/src/main/java/com/noop/data/StandardHrMapping.kt
index 2a0d6c277e..7db4f87542 100644
--- a/android/app/src/main/java/com/noop/data/StandardHrMapping.kt
+++ b/android/app/src/main/java/com/noop/data/StandardHrMapping.kt
@@ -7,6 +7,20 @@ import org.json.JSONObject
 object StandardHrMapping {
     const val CONTACT_EVENT_KIND = "STANDARD_HR_CONTACT"
 
+    /**
+     * Should this reading record a contact event, given the last one recorded?
+     *
+     * Contact is a STATE, not a measurement: it changes when the strap goes on or comes off, a handful of
+     * times a day, while the standard 0x2A37 stream arrives at ~1 Hz. Writing one row per reading stored
+     * ~86,400 rows a day per device to say the same thing 86,390 times, into a local-first database, for a
+     * read side that reconstructs "the value at or before ts" and therefore only ever needed the changes.
+     *
+     * `previous == null` records, so every session opens with its starting state and a reader never has to
+     * assume one. Twin of Swift `StandardHRMapping.shouldRecordContact`.
+     */
+    fun shouldRecordContact(previous: StandardHrContact?, current: StandardHrContact): Boolean =
+        previous != current
+
     fun contactEvent(ts: Long, contact: StandardHrContact): EventEntry = EventEntry(
         ts = ts,
         kind = CONTACT_EVENT_KIND,
diff --git a/android/app/src/test/java/com/noop/data/StandardHrMappingTest.kt b/android/app/src/test/java/com/noop/data/StandardHrMappingTest.kt
index 5e23874992..bb1e9a147e 100644
--- a/android/app/src/test/java/com/noop/data/StandardHrMappingTest.kt
+++ b/android/app/src/test/java/com/noop/data/StandardHrMappingTest.kt
@@ -3,6 +3,8 @@ package com.noop.data
 import com.noop.protocol.StandardHrContact
 import org.json.JSONException
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
 import org.junit.Assert.fail
 import org.junit.Test
 
@@ -57,4 +59,36 @@ class StandardHrMappingTest {
             // missing contact key is a parse failure, not legacy absence
         }
     }
+
+    /**
+     * Contact is a state, not a measurement. A ~1 Hz stream that recorded every reading wrote ~86,400
+     * rows a day per device to say the same thing, for a read side that only ever needed the changes.
+     *
+     * Asserted over a SEQUENCE rather than on the predicate alone: the number that matters is how many
+     * rows a run of readings produces, and a predicate test would pass just as happily if the caller
+     * stopped consulting it.
+     */
+    @Test
+    fun `a run of identical readings records one row, and each change records one more`() {
+        val readings = List(600) { StandardHrContact.SUPPORTED_DETECTED } +
+            List(300) { StandardHrContact.SUPPORTED_NOT_DETECTED } +
+            List(600) { StandardHrContact.SUPPORTED_DETECTED }
+
+        var previous: StandardHrContact? = null
+        var recorded = 0
+        for (c in readings) {
+            if (StandardHrMapping.shouldRecordContact(previous, c)) { recorded++; previous = c }
+        }
+        // 1500 readings — a full session — become three rows: the opening state and two transitions.
+        assertEquals(3, recorded)
+    }
+
+    @Test
+    fun `the first reading always records, so a session never opens with an assumed state`() {
+        assertTrue(StandardHrMapping.shouldRecordContact(null, StandardHrContact.UNSUPPORTED))
+        assertTrue(StandardHrMapping.shouldRecordContact(null, StandardHrContact.SUPPORTED_DETECTED))
+        // ...and an unchanged repeat does not.
+        assertFalse(StandardHrMapping.shouldRecordContact(
+            StandardHrContact.SUPPORTED_DETECTED, StandardHrContact.SUPPORTED_DETECTED))
+    }
 }

From d9a5c7a5d27ae94e12b763fb751a0d3d9bae2854 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 17:37:19 +1200
Subject: [PATCH 141/333] staging: build 406 / iOS 287 for the standard-HR
 contact work

Build numbers only - 10.6.1 stays the unreleased line, and 406 clears the
staging high-water so the APK installs over 405.

Eight commits since 405, and two of them are the reason to cut now.

A bonded Oura ring that advertises no local name is listed again. That is the
ring a user is most likely to be reconnecting to, and the Add-Device wizard
could not show it: a bonded ring often stops advertising a name, and no brand
token is a substring of the empty string. Watch for it appearing in the scan
list - with a BLANK title above the "Oura ring" subtitle, which is #1783 and
not fixed here.

Standard BLE heart-rate now preserves sensor contact, so an off-wrist sample is
distinguishable from an ordinary one. Only the CHANGES are stored: the first
reading of a session and each transition after it, rather than one row per
reading at ~1 Hz.

Also carries the pre-sleep HR feedback slice and its Kotlin twin (uncalled by
design, integration is #1760), and two test-only correctness fixes for a suite
that had started asserting the calendar.

This is the first build compiling the app-target Swift that #1769 and the
contact fix touched - Strand/BLE and Strand/Collect are not covered by the
default checks.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index ddf5d30fb7..29443585a2 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 405
+        versionCode = 406
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index f096a42278..5ce6e3a45b 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "286"
+    CURRENT_PROJECT_VERSION: "287"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 4972e51a1289779f370ca9f4bec9cdac7f089fd6 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 18:00:24 +1200
Subject: [PATCH 142/333] test(standard-HR): repin the contact auto-flush for
 change-only recording

app-build on d9a5c7a: 1470 StrandTests, one failure -
testContactOnlyBatchAutoFlushesAtThreshold. It fed thirty IDENTICAL contact
readings and asserted thirty events, so it had encoded the per-reading write as
the intended behaviour. Change-only recording produces one event from that run,
the 30-item threshold is never reached, and nothing flushes.

Repinned to the same shape rather than deleted. The invariant it protects is
real and still holds: contact events alone can drive the auto-flush threshold,
with no HR or R-R rows at all. It just has to be measured with readings that
change, which is what a strap going on and off the wrist produces - so the loop
now alternates and still reaches thirty.

Added the other half of the rule, which is what made the repin necessary: a run
of identical readings records ONCE, does not reach the threshold, and yields a
single event stamped at the FIRST reading.

These are app-target tests, so they run only in app-build and cannot be verified
from Linux. This commit is dispatched there rather than assumed.
---
 .../CollectorStandardHRContactTests.swift     | 29 +++++++++++++++++--
 1 file changed, 26 insertions(+), 3 deletions(-)

diff --git a/StrandTests/CollectorStandardHRContactTests.swift b/StrandTests/CollectorStandardHRContactTests.swift
index 9137aacf8a..fe68fd33d3 100644
--- a/StrandTests/CollectorStandardHRContactTests.swift
+++ b/StrandTests/CollectorStandardHRContactTests.swift
@@ -27,14 +27,18 @@ final class CollectorStandardHRContactTests: XCTestCase {
         func enqueueRawBatch(_ meta: RawBatchMeta, frames: [[UInt8]]) async throws {}
     }
 
+    /// Repinned for change-only contact recording: only TRANSITIONS record, so thirty identical
+    /// readings now produce one event rather than thirty. The invariant is unchanged — contact events
+    /// alone can drive the auto-flush threshold, without a single HR or R-R row — but it has to be
+    /// measured with readings that actually change, which is what a strap going on and off produces.
     func testContactOnlyBatchAutoFlushesAtThreshold() async {
         let store = CaptureStore()
         let collector = Collector(store: store, deviceId: "whoop-5")
 
+        var contact = StandardHRContact.supportedNotDetected
         for ts in 1_750_000_000..<1_750_000_030 {
-            collector.ingestStandardHR(
-                hr: 0, rr: [], contact: .supportedNotDetected, at: ts
-            )
+            collector.ingestStandardHR(hr: 0, rr: [], contact: contact, at: ts)
+            contact = contact == .supportedNotDetected ? .supportedDetected : .supportedNotDetected
         }
         for _ in 0..<10 where store.inserted.isEmpty { await Task.yield() }
 
@@ -45,6 +49,25 @@ final class CollectorStandardHRContactTests: XCTestCase {
         XCTAssertEqual(inserted.events.count, 30)
     }
 
+    /// The other half of the same rule, and the one that made the repin necessary: a run of identical
+    /// readings records ONCE. At the ~1 Hz the standard profile actually arrives at, the old
+    /// per-reading write was ~86,400 rows a day per device saying the same thing.
+    func testARunOfIdenticalReadingsRecordsOnlyTheFirst() async {
+        let store = CaptureStore()
+        let collector = Collector(store: store, deviceId: "whoop-5")
+
+        for ts in 1_750_000_000..<1_750_000_030 {
+            collector.ingestStandardHR(hr: 0, rr: [], contact: .supportedNotDetected, at: ts)
+        }
+        // One event never reaches the 30-item auto-flush threshold, so nothing has been written yet.
+        XCTAssertTrue(store.inserted.isEmpty)
+
+        await collector.flushStandardHR()
+        XCTAssertEqual(store.inserted.count, 1)
+        XCTAssertEqual(store.inserted.first?.events.count, 1)
+        XCTAssertEqual(store.inserted.first?.events.first?.ts, 1_750_000_000)
+    }
+
     func testWhoopStandardHRCollectorPersistsParsedContact() async {
         let store = CaptureStore()
         let collector = Collector(store: store, deviceId: "whoop-5")

From 1d9f1f339b9fc3891691753a82f59857c42090f1 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 18:11:47 +1200
Subject: [PATCH 143/333] staging: build 407 / iOS 288 on a fully verified tree

Build numbers only - 10.6.1 stays the unreleased line, and 407 clears the
staging high-water so the APK installs over 406.

406 was cut from d9a5c7a, which had a failing app-target test. The shipped
behaviour was right - the test was the thing that was wrong, having encoded the
per-reading contact write as the intended shape - but the artefacts came off a
tree nothing had fully checked. This is the same code with the repin, on a tree
where every gate has now run green.

What that took is worth recording. Build 406 and every default check were green
while a StrandTest was failing, because nothing in the normal pipeline runs
them: StrandTests is hosted in the macOS app and executes only in the on-demand
app-build. The 118 lines that came in with #1769 had never once run, and the
first time they did they disagreed with a change already on main.

app-build on 4972e51: 1471 tests, 0 failures, both legs green - including
testWhoopStandardHRCollectorRebuffersContactAfterInsertFailure, which is the one
that independently confirms deduping at ingest rather than at flush. Advancing
the last-contact state at flush would have lost a transition permanently the
first time an insert failed, and that test is what would have caught it.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 29443585a2..289be82dcb 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 406
+        versionCode = 407
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 5ce6e3a45b..a23f074025 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "287"
+    CURRENT_PROJECT_VERSION: "288"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 7ab0588909091a2d16440302c97d6f801f9b9f31 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 19:14:25 +1200
Subject: [PATCH 144/333] ble: offer to clear a stale phone pairing, once,
 after asking first (#1790)

NOOP has always DETECTED the stale bond - a bonded fast-path connect that drops
before it ever reaches a session means the OS holds a pairing the strap no
longer honours - and from the second failure it shows the forget-and-re-pair
guide. Step 2 of that guide is "Open Settings > Bluetooth, find your WHOOP, and
Forget". This does that step for the user when asking did not work. Field
evidence it is reachable: log 260901-1022 shows `stale OS bond (attempt 1)` and
`(attempt 2)` on a real strap.

OFF by default, behind its own switch, per the rule every strap-affecting probe
in PuffinExperiment follows. removeBond() DELETES a pairing from the phone's
Bluetooth settings - at least as consequential as createBond() forming one,
which shouldRequestExplicitBond already gates the same way. The key joins
FIVE_MG_GATED_KEYS, whose doc says two lists would drift.

Five failures, not the two where the guide appears: the guide asks the user to
act and they deserve cycles to do it before the app acts for them. Once per
streak, cleared only by a genuine bond. Self-limiting either way - once the bond
is gone, bondedWhoopDevice() stops matching, so the direct path is not retried
and the counter cannot climb for a cause the removal already addressed.

removeBond() is not public API, so it goes through reflection and a refusal is a
normal outcome: the log says whether Android ACCEPTED or REFUSED, because "we
asked" and "it happened" are different facts. No MAC, no serial.

Two things re-review caught, both mine.

The switch was UNREACHABLE. It went into SettingsScreen inside
`if (false && showFiveMGControls)`, a block whose own comment says developer
5/MG controls moved to Test Centre and that it must never render. Every test
passed and every check was green with a toggle no user could turn on. It looked
right because the sibling "Ask Android to pair" row sits in the same dead block
and only appears to work because its pref persists from before that block was
disabled. Moved to TestCentreScreen beside the two switches it escalates from,
and the title moved to the raw_diag_* namespace those rows use.

Then: nothing in the suite could have caught that. A UI switch has no assertion
saying a user can reach it. There is now a source-reading gate that pins the
wiring, refuses a disabled block in Test Centre, and keeps the dead Settings
copy from gaining it back - verified by unwiring the toggle and watching it go
red.

Threshold and once-only shape taken as a FACT from OpenStrap/edge's gen5
bootstrap, which removes the platform bond once at five consecutive exchange
failures. edge is Dart and none of its code is here.

Android-only and permanently so: CoreBluetooth exposes no bond-removal API, the
same situation ExplicitBond and BondStateTrace document with PARITY notes.

5026 unit tests green; release lintVital, i18n audit and doc lint clean; the
switch label is localized in all six Android locales.
---
 .../java/com/noop/ble/PuffinExperiment.kt     |  14 +-
 .../java/com/noop/ble/StaleBondRemoval.kt     |  77 +++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  |  34 +++++
 .../main/java/com/noop/ui/TestCentreScreen.kt |  15 +++
 .../app/src/main/res/values-de/strings.xml    |   1 +
 .../app/src/main/res/values-es/strings.xml    |   1 +
 .../app/src/main/res/values-fr/strings.xml    |   1 +
 .../app/src/main/res/values-pl/strings.xml    |   1 +
 .../src/main/res/values-pt-rPT/strings.xml    |   1 +
 .../app/src/main/res/values-zh/strings.xml    |   1 +
 android/app/src/main/res/values/strings.xml   |   1 +
 .../java/com/noop/ble/StaleBondRemovalTest.kt | 120 ++++++++++++++++++
 12 files changed, 266 insertions(+), 1 deletion(-)
 create mode 100644 android/app/src/main/java/com/noop/ble/StaleBondRemoval.kt
 create mode 100644 android/app/src/test/java/com/noop/ble/StaleBondRemovalTest.kt

diff --git a/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt b/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt
index 24184f29d6..8144480562 100644
--- a/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt
+++ b/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt
@@ -223,6 +223,15 @@ class PuffinExperiment(private val prefs: SharedPreferences) {
         editor.apply()
     }
 
+    /**
+     * "Clear a stale phone pairing" - may NOOP call removeBond() when the OS holds a pairing the strap
+     * no longer honours? Default OFF, like every other switch here that changes hardware or OS state.
+     * See [shouldRemoveStaleBond] for the gate and why the threshold is above the guide's.
+     */
+    var clearStaleBond: Boolean
+        get() = prefs.getBoolean(KEY_CLEAR_STALE_BOND, false)
+        set(v) { prefs.edit().putBoolean(KEY_CLEAR_STALE_BOND, v).apply() }
+
     companion object {
         /** Persisted preferences file. Internal so a UI screen can observe external writes to it. */
         internal const val PREFS = "noop_experiments"
@@ -247,6 +256,9 @@ class PuffinExperiment(private val prefs: SharedPreferences) {
          *  so no macOS key to mirror. */
         const val KEY_EXPLICIT_BOND = "noopWhoop5ExplicitBond"
 
+        /** "Clear a stale phone pairing" opt-in — see [shouldRemoveStaleBond]. */
+        const val KEY_CLEAR_STALE_BOND = "noopWhoop5ClearStaleBond"
+
         /** "Try history sync without pairing" opt-in — the unbonded offload probe (#1635). Android-only,
          *  so no macOS key to mirror. */
         const val KEY_UNBONDED_OFFLOAD = "noopWhoop5UnbondedOffload"
@@ -258,7 +270,7 @@ class PuffinExperiment(private val prefs: SharedPreferences) {
          *  SettingsScreen watches exactly these for external writes. Two lists would drift. */
         internal val FIVE_MG_GATED_KEYS =
             listOf(KEY, KEY_CAPTURE, KEY_DEEP_DATA, KEY_BROADCAST_HR, KEY_ECG_RAW_DATA, KEY_EXPLICIT_BOND,
-                   KEY_UNBONDED_OFFLOAD)
+                   KEY_UNBONDED_OFFLOAD, KEY_CLEAR_STALE_BOND)
 
         /** "Experimental sleep staging (V2)" opt-in (mirrors macOS `PuffinExperiment.experimentalSleepV2Key`). */
         const val KEY_EXPERIMENTAL_SLEEP_V2 = "noopExperimentalSleepV2"
diff --git a/android/app/src/main/java/com/noop/ble/StaleBondRemoval.kt b/android/app/src/main/java/com/noop/ble/StaleBondRemoval.kt
new file mode 100644
index 0000000000..e39f38d8ef
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ble/StaleBondRemoval.kt
@@ -0,0 +1,77 @@
+package com.noop.ble
+
+/**
+ * When the app may clear a STALE platform pairing on the user's behalf.
+ *
+ * A bonded fast-path connect that drops before it ever reaches a session means the OS is holding a bond
+ * the strap no longer honours — a firmware update, or the official WHOOP app re-bonding, leaves Android
+ * with a pairing the band has forgotten. NOOP has always detected this ([WhoopBleClient] logs "stale OS
+ * bond") and, from the second failure, shown the forget-and-re-pair guide. Asking is the right first
+ * move, and it stays: this is what happens when asking did not work.
+ *
+ * OFF by default and behind its own switch, per the rule every strap-affecting probe in
+ * [PuffinExperiment] follows. `removeBond()` deletes a pairing from the phone's Bluetooth settings —
+ * at least as consequential as `createBond()` forming one, which [shouldRequestExplicitBond] already
+ * gates the same way — so it must not ride in on consent given for something else.
+ *
+ * Independently arrived at by OpenStrap/edge, whose gen5 bootstrap removes the platform bond once after
+ * five consecutive exchange failures and clears the counter only when a connect reaches READY. The
+ * threshold and the once-only shape are taken from that behaviour as a fact; none of its code is.
+ */
+
+/**
+ * Consecutive stale-bond failures before the pairing is cleared automatically.
+ *
+ * Five, not the two at which the guide appears: the guide asks the user to do this themselves, and they
+ * deserve several reconnect cycles to act before the app does it for them. A strap whose pairing really
+ * is stale reaches five within a couple of minutes, and every one of those cycles is a failed connect.
+ */
+internal const val STALE_BOND_REMOVAL_THRESHOLD = 5
+
+/**
+ * Should this disconnect clear the platform pairing?
+ *
+ * Every clause is load-bearing:
+ *  - [optedIn]: default-off, see the file note. No switch, no bond removal, ever.
+ *  - [isWhoop5]: a 4.0 bonds by the route it always has. This failure mode is the 5/MG fast-path one,
+ *    and removing a WHOOP 4 pairing would break a link that works.
+ *  - [osBonded]: nothing to remove otherwise, and calling it anyway would log a failure that means
+ *    nothing.
+ *  - [consecutiveStaleFailures]: the streak, not a single drop — one stale-looking disconnect is a
+ *    transient, and this is not an action to take on a transient.
+ *  - [alreadyRemovedThisRun]: exactly ONCE per streak. Removing a bond and immediately failing again
+ *    means the bond was not the problem, and repeating it would delete a pairing per reconnect for a
+ *    cause it cannot fix. Cleared only by a genuine bond, which is the event that proves the strap and
+ *    the phone agree again.
+ */
+internal fun shouldRemoveStaleBond(
+    optedIn: Boolean,
+    isWhoop5: Boolean,
+    osBonded: Boolean,
+    consecutiveStaleFailures: Int,
+    alreadyRemovedThisRun: Boolean,
+    threshold: Int = STALE_BOND_REMOVAL_THRESHOLD,
+): Boolean {
+    if (!optedIn) return false
+    if (!isWhoop5) return false
+    if (!osBonded) return false
+    if (alreadyRemovedThisRun) return false
+    return consecutiveStaleFailures >= threshold
+}
+
+/**
+ * The one line that says what was done and whether the OS accepted it.
+ *
+ * `removeBond()` is not public API and is reached by reflection, so "we asked" and "it happened" are
+ * genuinely different outcomes and the log must not conflate them. No PII: no MAC, no serial.
+ */
+internal fun staleBondRemovalLine(failures: Int, accepted: Boolean): String =
+    if (accepted) {
+        "Stale pairing: cleared the phone's Bluetooth pairing for this strap after $failures failed " +
+            "bonded connects. Android accepted the request; the next connect starts from an unpaired " +
+            "state, which is what the re-pair guide was asking you to do by hand (#1635)."
+    } else {
+        "Stale pairing: asked Android to clear this strap's pairing after $failures failed bonded " +
+            "connects and it REFUSED (removeBond is not public API and can be denied). Nothing has " +
+            "changed - clear it yourself in Settings > Bluetooth, as the re-pair guide describes."
+    }
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 15d73b2a50..f687c0e40a 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -5533,6 +5533,10 @@ class WhoopBleClient(
      *  nag the user. Reset to 0 on any genuine bond. (5/MG firmware reset parity, 2026-06) */
     private var staleDirectFailures = 0
 
+    /** #1635: the stale-pairing clear is once per streak. Cleared by a genuine bond, the event that
+     *  proves the phone and the strap agree again. */
+    private var staleBondRemoved = false
+
     /**
      * Which of OUR OWN paths last tore the link down, and when the current session started (#1020).
      *
@@ -6506,6 +6510,7 @@ class WhoopBleClient(
                         noteGenuineBond(g.device.address)   // #52: this strap bonds fine; clears any pin-refusal streak
                         clearPairingHint()            // #78: a genuine bond means the pairing guidance no longer applies
                         staleDirectFailures = 0       // genuine bond — clear the wiped-bond counter (#84 parity)
+                        staleBondRemoved = false      // ...and re-arm the one-shot stale-pairing clear
                     }
                     _state.update { it.copy(bonded = true, encryptedBond = encrypted) }
                     bondedAtMs = System.currentTimeMillis()   // #617: stamp the bond so handleDisconnect can spot a bond-then-quick-timeout loop
@@ -9730,6 +9735,15 @@ class WhoopBleClient(
     // MARK: Disconnect / teardown  (port of didDisconnectPeripheral)
     // ====================================================================================
 
+    /**
+     * Ask Android to delete this device's pairing. Reflection because `removeBond()` is not public API;
+     * a throw or a `false` is a REFUSAL, not a crash, and the caller reports which happened.
+     */
+    @SuppressLint("MissingPermission")
+    private fun removeOsBond(device: BluetoothDevice): Boolean = runCatching {
+        device.javaClass.getMethod("removeBond").invoke(device) as? Boolean ?: false
+    }.getOrDefault(false)
+
     @SuppressLint("MissingPermission")
     private fun handleDisconnect(status: Int) {
         val helloWasUnacked = clientHelloWriteAtMs > 0L
@@ -9980,6 +9994,26 @@ class WhoopBleClient(
             }
             if (staleDirectBond) {
                 staleDirectFailures++
+                // Before `lastDevice = null` below: that handle is the only device left to act on here.
+                val staleDevice = lastDevice
+                if (staleDevice != null && shouldRemoveStaleBond(
+                        optedIn = puffinExperiment.clearStaleBond,
+                        // Belt and braces. `staleDirectBond` can only be set by the Easy-connect path,
+                        // whose helpers match a 5/MG and which pins selectedModel to it — so this is
+                        // already implied. Kept because `connectedFamily` fails CLOSED when it is stale
+                        // (it holds the previous link's value), and the direction that matters is never
+                        // removing a pairing we should not.
+                        isWhoop5 = connectedFamily == DeviceFamily.WHOOP5,
+                        osBonded = runCatching {
+                            staleDevice.bondState == BluetoothDevice.BOND_BONDED
+                        }.getOrDefault(false),
+                        consecutiveStaleFailures = staleDirectFailures,
+                        alreadyRemovedThisRun = staleBondRemoved,
+                    )
+                ) {
+                    staleBondRemoved = true
+                    log(staleBondRemovalLine(staleDirectFailures, removeOsBond(staleDevice)))
+                }
                 log("Disconnected (status=$status) before the bonded fast-path reached a session — stale OS bond (attempt $staleDirectFailures); falling back to a scan")
                 lastDevice = null
                 // Two consecutive wiped-bond failures = the strap really reset its pairing (firmware
diff --git a/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt b/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
index 84595a09e9..3b17c54cf8 100644
--- a/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
@@ -105,6 +105,7 @@ fun TestCentreScreen(vm: AppViewModel, onOpenGroundTruthCollector: () -> Unit =
     var broadcastHr by remember { mutableStateOf(puffinExperiment.broadcastHr) }
     var explicitBond by remember { mutableStateOf(puffinExperiment.explicitBond) }
     var unbondedOffload by remember { mutableStateOf(puffinExperiment.unbondedOffload) }
+    var clearStaleBond by remember { mutableStateOf(puffinExperiment.clearStaleBond) }
     var ecgRawData by remember { mutableStateOf(puffinExperiment.ecgRawData) }
     val r22DisableReport by vm.ble.r22DisableReport.collectAsStateWithLifecycle()
     val ecgGateReport by vm.ble.ecgRawDataGate.collectAsStateWithLifecycle()
@@ -259,6 +260,20 @@ fun TestCentreScreen(vm: AppViewModel, onOpenGroundTruthCollector: () -> Unit =
                             puffinExperiment.unbondedOffload = it
                         },
                     )
+                    DeveloperToggleRow(
+                        title = stringResource(R.string.raw_diag_clear_stale_bond),
+                        detail = "When a bonded fast-path connect keeps dropping before it reaches a " +
+                            "session, the phone is holding a pairing the strap no longer honours. NOOP " +
+                            "already shows the forget-and-re-pair guide at two failures; with this on it " +
+                            "does that step for you at five, once, and only until the strap bonds again. " +
+                            "It cannot make a strap that refuses pairing pair. Leave it off unless you " +
+                            "are testing #1635.",
+                        checked = clearStaleBond,
+                        onCheckedChange = {
+                            clearStaleBond = it
+                            puffinExperiment.clearStaleBond = it
+                        },
+                    )
                     DeveloperToggleRow(
                         title = stringResource(R.string.raw_diag_r22),
                         detail = "Accepted writes have not been shown to enable a separate live stream. Not required for normal sync or raw capture.",
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 29cf15fda3..1006182fd1 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2628,6 +2628,7 @@
     <string name="raw_diag_broadcast_hr">Herzfrequenz vom Band übertragen</string>
     <string name="raw_diag_pair">Android um Kopplung bitten</string>
     <string name="raw_diag_unbonded_offload">Verlaufssynchronisierung ohne Kopplung versuchen</string>
+    <string name="raw_diag_clear_stale_bond">Veraltete Kopplung entfernen</string>
     <string name="raw_diag_r22">Altes R22-Feature-Flag-Experiment</string>
     <string name="raw_diag_r22_enable">Alte R22-Aktivierungssequenz senden</string>
     <string name="raw_diag_r22_clear">R22-Flags auf dem Band löschen</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index b6f211b2ec..2abd505303 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2613,6 +2613,7 @@
     <string name="raw_diag_broadcast_hr">Transmitir frecuencia cardíaca desde la pulsera</string>
     <string name="raw_diag_pair">Pedir a Android que vincule</string>
     <string name="raw_diag_unbonded_offload">Probar la sincronización del historial sin vinculación</string>
+    <string name="raw_diag_clear_stale_bond">Borrar vinculación obsoleta</string>
     <string name="raw_diag_r22">Experimento antiguo de indicadores R22</string>
     <string name="raw_diag_r22_enable">Enviar secuencia de activación R22 antigua</string>
     <string name="raw_diag_r22_clear">Borrar indicadores R22 de la pulsera</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 65a5d2533d..bc0790e792 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2612,6 +2612,7 @@
     <string name="raw_diag_broadcast_hr">Diffuser la fréquence cardiaque du bracelet</string>
     <string name="raw_diag_pair">Demander l’appairage à Android</string>
     <string name="raw_diag_unbonded_offload">Essayer la synchronisation de l\'historique sans appairage</string>
+    <string name="raw_diag_clear_stale_bond">Supprimer un appairage obsolète</string>
     <string name="raw_diag_r22">Ancienne expérience d’indicateurs R22</string>
     <string name="raw_diag_r22_enable">Envoyer l’ancienne séquence d’activation R22</string>
     <string name="raw_diag_r22_clear">Effacer les indicateurs R22 du bracelet</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index c79b1d06c1..134280a652 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2617,6 +2617,7 @@
     <string name="raw_diag_broadcast_hr">Transmituj tętno z opaski</string>
     <string name="raw_diag_pair">Poproś Androida o sparowanie</string>
     <string name="raw_diag_unbonded_offload">Spróbuj synchronizacji historii bez parowania</string>
+    <string name="raw_diag_clear_stale_bond">Usuń nieaktualne parowanie</string>
     <string name="raw_diag_r22">Starszy eksperyment flag R22</string>
     <string name="raw_diag_r22_enable">Wyślij starszą sekwencję włączenia R22</string>
     <string name="raw_diag_r22_clear">Wyczyść flagi R22 na opasce</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 039cd3d5ad..00da9bb722 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2605,6 +2605,7 @@
     <string name="raw_diag_broadcast_hr">Transmitir frequência cardíaca da bracelete</string>
     <string name="raw_diag_pair">Pedir ao Android para emparelhar</string>
     <string name="raw_diag_unbonded_offload">Tentar sincronizar o histórico sem emparelhamento</string>
+    <string name="raw_diag_clear_stale_bond">Limpar emparelhamento obsoleto</string>
     <string name="raw_diag_r22">Experiência antiga de indicadores R22</string>
     <string name="raw_diag_r22_enable">Enviar sequência antiga de ativação R22</string>
     <string name="raw_diag_r22_clear">Limpar indicadores R22 da bracelete</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 7c3c1d274b..a98ee0e47b 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2526,6 +2526,7 @@
     <string name="raw_diag_broadcast_hr">从手环广播心率</string>
     <string name="raw_diag_pair">请求 Android 配对</string>
     <string name="raw_diag_unbonded_offload">尝试在未配对状态下同步历史数据</string>
+    <string name="raw_diag_clear_stale_bond">清除过期配对</string>
     <string name="raw_diag_r22">旧版 R22 功能标志实验</string>
     <string name="raw_diag_r22_enable">发送旧版 R22 启用序列</string>
     <string name="raw_diag_r22_clear">清除手环上的 R22 标志</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index fde717148a..d32df2df16 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2641,6 +2641,7 @@
     <string name="raw_diag_broadcast_hr">Broadcast heart rate from the strap</string>
     <string name="raw_diag_pair">Ask Android to pair</string>
     <string name="raw_diag_unbonded_offload">Try history sync without pairing</string>
+    <string name="raw_diag_clear_stale_bond">Clear a stale phone pairing</string>
     <string name="raw_diag_r22">Legacy R22 feature-flag experiment</string>
     <string name="raw_diag_r22_enable">Send legacy R22 enable sequence</string>
     <string name="raw_diag_r22_clear">Clear legacy R22 flags on strap</string>
diff --git a/android/app/src/test/java/com/noop/ble/StaleBondRemovalTest.kt b/android/app/src/test/java/com/noop/ble/StaleBondRemovalTest.kt
new file mode 100644
index 0000000000..e62b94970e
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ble/StaleBondRemovalTest.kt
@@ -0,0 +1,120 @@
+package com.noop.ble
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #1635: when NOOP may delete a pairing from the user's phone.
+ *
+ * Every clause is a separate way to get this wrong, and getting it wrong means removing a working
+ * pairing rather than a stale one — so each is pinned on its own rather than trusting one happy path.
+ */
+class StaleBondRemovalTest {
+
+    private fun ok(
+        optedIn: Boolean = true,
+        isWhoop5: Boolean = true,
+        osBonded: Boolean = true,
+        failures: Int = STALE_BOND_REMOVAL_THRESHOLD,
+        already: Boolean = false,
+    ) = shouldRemoveStaleBond(optedIn, isWhoop5, osBonded, failures, already)
+
+    @Test
+    fun `the streak at threshold, opted in, on a bonded 5MG, clears the pairing`() {
+        assertTrue(ok())
+    }
+
+    @Test
+    fun `no switch, no bond removal - deleting a pairing never rides in on other consent`() {
+        assertFalse(ok(optedIn = false))
+        // ...not even far past the threshold.
+        assertFalse(ok(optedIn = false, failures = 500))
+    }
+
+    @Test
+    fun `a WHOOP 4 is never touched - it bonds by the route it always has`() {
+        assertFalse(ok(isWhoop5 = false))
+    }
+
+    @Test
+    fun `nothing to remove when the OS holds no bond`() {
+        assertFalse(ok(osBonded = false))
+    }
+
+    @Test
+    fun `one drop is a transient, not a stale pairing`() {
+        for (n in 0 until STALE_BOND_REMOVAL_THRESHOLD) {
+            assertFalse("failures=$n must not remove", ok(failures = n))
+        }
+        assertTrue(ok(failures = STALE_BOND_REMOVAL_THRESHOLD))
+    }
+
+    @Test
+    fun `exactly once per streak - a second failure does not delete a second pairing`() {
+        assertFalse(ok(already = true))
+        assertFalse(ok(already = true, failures = 500))
+    }
+
+    @Test
+    fun `it waits longer than the guide, which asks the user first`() {
+        // The re-pair guide appears at 2. Acting before the user has had cycles to act themselves would
+        // take the choice away from them; this is what happens when asking did not work.
+        assertTrue(STALE_BOND_REMOVAL_THRESHOLD > 2)
+    }
+
+    @Test
+    fun `the line separates asking from happening, and carries no PII`() {
+        val accepted = staleBondRemovalLine(5, accepted = true)
+        val refused = staleBondRemovalLine(5, accepted = false)
+        assertTrue(accepted.contains("Android accepted"))
+        assertTrue(refused.contains("REFUSED"))
+        assertTrue("a refusal must say nothing changed", refused.contains("Nothing has changed"))
+        assertEquals(2, listOf(accepted, refused).count { it.contains("5 failed") })
+        // A bare ":" is prose punctuation here, so match the SHAPE of a MAC rather than the character.
+        val macLike = Regex("[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}")
+        for (line in listOf(accepted, refused)) {
+            assertFalse("no MAC in a shared log: $line", macLike.containsMatchIn(line))
+            assertFalse("no serial prefix", line.contains("MGB"))
+        }
+    }
+
+    /**
+     * The switch has to be REACHABLE, and nothing else in this suite can tell you that.
+     *
+     * The first cut of this feature put its row in SettingsScreen inside `if (false && ...)` — a block
+     * whose own comment says developer 5/MG controls moved to Test Centre and that it must never render.
+     * Every test passed and CI was green with a toggle no user could turn on. It looked right because
+     * the sibling "Ask Android to pair" row sits in the same dead block and appears to work only
+     * because its pref persists from before that block was disabled.
+     *
+     * So this reads the source: the switch must be wired in Test Centre, and Test Centre must not have
+     * grown a disabled block of its own.
+     */
+    @Test
+    fun `the toggle is wired somewhere a user can actually reach`() {
+        val testCentre = uiSource("TestCentreScreen.kt")
+        assertTrue("the toggle must be wired in Test Centre, which is where 5/MG switches live",
+                   testCentre.contains("R.string.raw_diag_clear_stale_bond"))
+        assertTrue("and bound to the experiment it gates",
+                   testCentre.contains("puffinExperiment.clearStaleBond = it"))
+        assertFalse("Test Centre must not grow a disabled block the way Settings did",
+                    testCentre.contains("if (false"))
+
+        // And it must NOT have been added to the retained-but-dead Settings copy: a row that never
+        // shipped there needs no compatibility copy, and one would only be more to delete later.
+        assertFalse("the dead Settings block must not gain new switches",
+                    uiSource("SettingsScreen.kt").contains("clearStaleBond"))
+    }
+
+    private fun uiSource(name: String): String {
+        val rel = "android/app/src/main/java/com/noop/ui/$name"
+        val start = java.io.File(System.getProperty("user.dir") ?: ".").absoluteFile
+        val f = generateSequence(start) { it.parentFile }.map { java.io.File(it, rel) }
+            .firstOrNull { it.isFile }
+        assertTrue("$name not found walking up from $start — this check cannot run, and one that " +
+                   "silently skips is worse than none", f != null)
+        return f!!.readText()
+    }
+}

From caa9d37d6f096fd3b81dc335364ef25a02448ccf Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 19:14:51 +1200
Subject: [PATCH 145/333] staging: build 408 / iOS 289 for the stale-pairing
 clear

Build numbers only - 10.6.1 stays the unreleased line, and 408 clears the
staging high-water so the APK installs over 407.

One change, and it needs turning on: Test Centre gains "Clear a stale phone
pairing", default OFF like every switch beside it. With it on, a bonded
fast-path connect that keeps dropping before it reaches a session will, at the
fifth failure and once only, ask Android to delete the pairing the strap no
longer honours - the step the re-pair guide has been asking users to do by hand
since the second failure.

What to watch on the 5/MG, which shows `stale OS bond (attempt N)` in the field:
turn it on in Test Centre, and after five such failures expect one line saying
whether Android ACCEPTED or REFUSED the request. removeBond() is not public API,
so a refusal is a normal outcome and the log distinguishes the two - nothing has
changed if it says REFUSED.

It cannot make a strap that refuses SMP pair. What it clears is the phone side,
so the failing bonded fast-path stops being attempted; the #1635 live-HR end
state is unchanged.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 289be82dcb..5073091e01 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 407
+        versionCode = 408
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index a23f074025..f70edaa98c 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "288"
+    CURRENT_PROJECT_VERSION: "289"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 1a9d6c409aa39b93e913583795c0a57f6cb773bc Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 20:01:43 +1200
Subject: [PATCH 146/333] ble: record why the stale-pairing clear stays
 Android-only (#1791)

A mirror of #1790 is not safely buildable. This records why, and corrects a
claim I made in that PR's merge body.

#1790 said "Android-only and permanently so: CoreBluetooth exposes no
bond-removal API." True, and not the whole blocker - stated that way it reads as
settled and invites the next reader to go hunting for a way round.

The real obstacle is IDENTITY. IOBluetooth, whatever it can or cannot do to a
BLE pairing, addresses devices by MAC, and Apple's side never has one:
BLEManager.epitaphLine's own doc already says the peripheral UUID is
"per-install, not the hardware address". Grepped BLEManager unfiltered to be
sure - the only address mentions are that doc line and the new note. The one
bridge left is matching IOBluetoothDevice.pairedDevices() by NAME, and deleting
a pairing on a name match removes the wrong device the moment a user has two
straps or has renamed one. That is exactly the mistake shouldRemoveStaleBond's
guards exist to prevent, so closing the gap that way is worse than leaving it
open.

Worth writing down because Apple is not unaware of the condition:
didFailToConnect already handles CBError.peerRemovedPairingInformation and
publishes the same forget-and-re-pair guide, naming the strap. Both platforms
detect it, both give the same advice, only one can take the step.

Three re-review passes, all on this note's own prose rather than the conclusion.
It asserted an Apple SDK capability inside a correction about unverified
assertions; it re-derived a fact the codebase already stated; and it held iOS to
a looser standard than macOS, including a claim about Apple's design intent.
Each is gone. The technical conclusion never moved.

Notes only, one per platform, cross-referencing. 638 BLE tests green.

Left open deliberately: Apple's stale-bond branch sets the guide and returns,
scheduling nothing, where Android schedules a reconnect - so a user who clears
the pairing in System Settings while the app is open is not picked up until they
reconnect by hand. That may well be deliberate, and it is not a change to make
on one reading of it.
---
 Strand/BLE/BLEManager.swift                   | 16 ++++++++++++++
 .../java/com/noop/ble/StaleBondRemoval.kt     | 22 +++++++++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index fc9c528bc6..5f6ea5074a 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -5603,6 +5603,22 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
             }
             state.append(log: "reconnect n=\(connReconnectCount) failedConnect reason=\(reason)", domain: .connection)
         }
+        // PARITY (#1790): Android can now CLEAR this pairing itself, behind a default-off Test Centre
+        // switch, once, after five of these failures — the step guide-line 2 asks the user to take. This
+        // side deliberately cannot, and the blocker is identity rather than a missing call:
+        //
+        //  - iOS: the same identity problem, with nothing else to reach for. The guide below already
+        //    tells the user to do it themselves, which is the honest answer rather than a claim about
+        //    Apple's intent.
+        //  - macOS ships IOBluetooth, a separate classic-Bluetooth framework, and whether its device
+        //    removal works on a BLE pairing is a question that never arises for us: it addresses devices
+        //    by MAC, and we never have one. `epitaphLine`'s doc already says why — the peripheral UUID is
+        //    "per-install, not the hardware address". The only bridge left is matching
+        //    `IOBluetoothDevice.pairedDevices()` by NAME, and deleting a pairing on a name match removes
+        //    the wrong device the moment there are two straps or one has been renamed.
+        //
+        // So both platforms detect this and both give the same advice; only Android can act on it. Do not
+        // close the gap with a name match. Kotlin twin: `StaleBondRemoval.kt`.
         if let cbErr = error as? CBError, cbErr.code == .peerRemovedPairingInformation {
             state.reconnectGuide = """
             Your strap's Bluetooth pairing was reset - usually by a WHOOP firmware update, or the official WHOOP app reconnecting. NOOP works fine on the new firmware; you just need to re-pair:
diff --git a/android/app/src/main/java/com/noop/ble/StaleBondRemoval.kt b/android/app/src/main/java/com/noop/ble/StaleBondRemoval.kt
index e39f38d8ef..fbab12a515 100644
--- a/android/app/src/main/java/com/noop/ble/StaleBondRemoval.kt
+++ b/android/app/src/main/java/com/noop/ble/StaleBondRemoval.kt
@@ -17,6 +17,28 @@ package com.noop.ble
  * Independently arrived at by OpenStrap/edge, whose gen5 bootstrap removes the platform bond once after
  * five consecutive exchange failures and clears the counter only when a connect reaches READY. The
  * threshold and the once-only shape are taken from that behaviour as a fact; none of its code is.
+ *
+ * PARITY: Android-only, and the reason is IDENTITY rather than a missing API — worth stating precisely,
+ * because "CoreBluetooth has no bond-removal call" is true but is not the whole blocker and invites
+ * someone to go looking for a way round it.
+ *
+ * Apple DETECTS the same condition and gives the same advice: `BLEManager`'s `didFailToConnect` handles
+ * `CBError.peerRemovedPairingInformation` and publishes a forget-and-re-pair guide naming the strap. It
+ * simply cannot perform the step.
+ *
+ *  - iOS: the same identity problem, with nothing else to reach for. The app's own guide already tells
+ *    the user to do it in Settings, which is the honest answer rather than a claim about Apple's intent.
+ *  - macOS ships `IOBluetooth`, a separate classic-Bluetooth framework. Whether its device removal
+ *    works on a BLE pairing is a question that never arises: it addresses devices by MAC, and Apple's
+ *    side never has one — `BLEManager.epitaphLine`'s doc already states it, the peripheral UUID being
+ *    "per-install, not the hardware address". The only bridge left is matching
+ *    `IOBluetoothDevice.pairedDevices()` by NAME, and deleting a pairing on a name match is precisely the
+ *    mistake this file's guards exist to prevent: two straps, or a renamed device, and it removes the
+ *    wrong one.
+ *
+ * So the gap is real and stays: both platforms detect and ask, only this one can act. If CoreBluetooth
+ * ever exposes the hardware address, or grows a removal call of its own, revisit it — do not close it
+ * with a name match.
  */
 
 /**

From 8918f53d68387d6c1ccfdde7732d74f2df67f857 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 20:02:02 +1200
Subject: [PATCH 147/333] staging: build 409 / iOS 290 on the parity record

Build numbers only - 10.6.1 stays the unreleased line, and 409 clears the
staging high-water so the APK installs over 408.

No behaviour change since 408: the only commit is the note recording why the
stale-pairing clear stays Android-only, on both platforms and cross-referenced.
Cut so the artefacts match a tree where that decision is written down rather
than sitting in a merged PR description.

What to test is unchanged from 408. "Clear a stale phone pairing" is in Test
Centre, default OFF. With it on, a bonded fast-path connect that keeps dropping
before it reaches a session will, at the fifth failure and once only, ask
Android to delete the pairing - and the log will say whether Android ACCEPTED or
REFUSED, because removeBond() is not public API and a refusal is a normal
outcome that changes nothing.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 5073091e01..6153f26b50 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 408
+        versionCode = 409
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index f70edaa98c..2de86e6cfe 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "289"
+    CURRENT_PROJECT_VERSION: "290"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From ebcb0cd2e36da301a3ca112b00da91a2a21d371b Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 21:32:11 +1200
Subject: [PATCH 148/333] docs: describe the CI that actually runs (#1793)

Reported by @kvnloo in #1789. Verifying the report turned up a second, worse
error in the other file.

Root CONTRIBUTING.md said "Two GitHub Actions workflows run on every PR" and
named Swift Packages CI and Android CI. Those are the only two that ARE
path-filtered; the three with no path filter - Source Hygiene, Tools Python CI,
i18n Coverage - were missing entirely.

docs/CONTRIBUTING.md said app-build.yml "and android.yml (Android app build) are
off". android.yml is ACTIVE, and its build-and-test job ran on every Android PR
merged that day. Only app-build is disabled_manually. That is worse than an
undercount: telling someone the check most likely to catch their mistake does
not run invites them to skip testing locally and be surprised by a red PR they
were told to expect green. The same section listed swift-packages under "on
every PR" when it is path-filtered.

The addition neither file had, and the thing that actually traps a first-time
reader: the checks GitHub shows are JOB names that do not resemble the workflow
names. `check` is i18n Coverage, `doc-comments` is Source Hygiene,
`linux-capture` is Tools Python CI. Nothing on the PR page connects them, so an
Android-only PR reads as though almost nothing ran when all three always-on
workflows did.

The two files disagreed with each other as well as with reality, which is how
this drifted, so they now own different things: root has the enumeration and the
job-name mapping a first-time contributor needs to read their own PR;
docs/CONTRIBUTING.md has the rationale and what is deliberately gated at release
instead, and points at the root table rather than restating it.

Re-review caught the rewrite opening with "Five workflows" and "four checks" -
correct when written, and the same shape as the sentence being replaced. A count
in prose goes stale while the table under it still looks fine, which is how the
original survived. The lead now names the categories and defers to the table.

Every trigger, path filter, workflow state and job name was read from
.github/workflows/ and `gh workflow list`, with the job names re-derived by
parsing each jobs: block rather than by indentation.
---
 CONTRIBUTING.md      | 29 ++++++++++++++++++++++++-----
 docs/CONTRIBUTING.md | 19 ++++++++++++-------
 2 files changed, 36 insertions(+), 12 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 5c4355bd42..863f24dbca 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -60,13 +60,32 @@ cd android
 
 ## What CI checks
 
-Two GitHub Actions workflows run on every PR and push to `main`. They compile and
-run unit tests only — no code signing, no secrets, no release.
+Some GitHub Actions workflows run on *every* PR; others are path-filtered and only run when
+you touch what they cover. All of them compile and run unit tests only — no code signing, no
+secrets, no release. The table is the source of truth, deliberately — the section this
+replaced led with a count, and a count in prose is what goes stale while the list below it
+looks fine.
 
-| Workflow | Trigger | What it does |
+The check names GitHub shows you are **job** names, which do not resemble the workflow
+names. That column is why this table exists:
+
+| Check you see | Workflow | Runs when |
 |---|---|---|
-| **Swift Packages CI** (`.github/workflows/swift-packages.yml`) | changes under `Packages/**` | `swift build` + `swift test` for each package |
-| **Android CI** (`.github/workflows/android.yml`) | changes under `android/**` | `assembleFullDebug` + `testFullDebugUnitTest` (JDK 17) |
+| `check` | **i18n Coverage** (`i18n-coverage.yml`) | every PR |
+| `doc-comments` | **Source Hygiene** (`source-hygiene.yml`) | every PR |
+| `linux-capture` | **Tools Python CI** (`tools-python.yml`) | every PR |
+| `build-and-test` | **Android CI** (`android.yml`) | `android/**`, the protocol/store test resources, `Strand/Resources/Localizable.xcstrings` |
+| `test (…)`, `tools (…)` | **Swift Packages CI** (`swift-packages.yml`) | `Packages/**`, the `Tools/SleepBench`, `Tools/SleepPSG` and `Tools/Backfill` packages, `android/app/src/test/resources/**`, `Strand/Liquid/LiquidCore.swift` |
+
+Read that as a worked example: an Android-only PR runs Android CI plus the three that always
+run, so a short list of checks does not mean little was checked.
+
+**App build** (`app-build.yml`, app-target compile + the `StrandTests` macOS suite) is
+`disabled_manually` and is **not** in that list. App-target code — SwiftUI views,
+`BLEManager`, `Repository`, Compose screens — is compiled by **nothing** on a normal PR, so
+build it locally before you push, or ask a maintainer to dispatch `app-build.yml`. See
+[docs/CONTRIBUTING.md](docs/CONTRIBUTING.md#what-ci-gates--and-what-it-deliberately-doesnt)
+for why the lean setup is deliberate and what else is gated at release time instead.
 
 If CI fails on your PR, fix the cause rather than working around it. Never commit
 generated output (`Strand.xcodeproj/`) or any secrets, keystores, or `local.properties`.
diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index 894ef7c365..76894547ec 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -254,14 +254,19 @@ NOOP runs a **deliberately lean CI**: fast, no-hardware checks guard the point o
 and hardware-dependent verification runs at release time or on demand. This is a choice for an
 anonymous, offline, sideloaded project — not a gap to fill with more gates.
 
-- **On every PR (required):** `swift-packages` runs `swift test` for `Packages/**`; `i18n-coverage`
-  runs the string audit. These catch the regressions that matter most (protocol/analytics math,
-  storage, i18n) without a device or an Xcode/Gradle app build.
+- **On every PR (required):** `source-hygiene`, `tools-python` and `i18n-coverage` have no path
+  filter, so all three run on everything. `swift-packages` (`swift test` for `Packages/**`) and
+  `android` (`assembleFullDebug` + `testFullDebugUnitTest`) are **path-filtered** — they run when you
+  touch what they cover, which is most substantive PRs. Between them these catch the regressions that
+  matter most (protocol/analytics math, storage, i18n) without a device or an app build. The check
+  names you see are JOB names and do not resemble the workflow names; the table in the root
+  [CONTRIBUTING.md](../CONTRIBUTING.md#what-ci-checks) maps them.
 - **Disabled by design — you build the app yourself:** `app-build.yml` (app-target compile, iOS needs
-  `macos-26`) and `android.yml` (Android app build) are **off**. So a compile error in **app-target**
-  code (SwiftUI Views, `BLEManager`, `Repository`, a Compose screen) passes every default check.
-  Before you push app-layer changes, compile locally — `xcodebuild … build` /
-  `./gradlew compileFullDebugKotlin` — or dispatch `app-build.yml` on demand.
+  `macos-26`) is **off**. So a compile error in **app-target** code (SwiftUI Views, `BLEManager`,
+  `Repository`, a Compose screen) passes every default check — `android.yml` builds and unit-tests the
+  Android app but nothing compiles the Apple app target. Before you push app-layer changes, compile
+  locally — `xcodebuild … build` / `./gradlew compileFullDebugKotlin` — or dispatch `app-build.yml`
+  on demand.
 - **Gated at release, not per PR:** Android release lint (`lintVitalFullRelease`) runs inside
   `assembleFullRelease` in the staging/release builds, so lint-fatal issues (e.g. an
   `ExtraTranslation` in a `values-<lang>` file) surface there. Run `./gradlew lintVitalFullRelease`

From 08c0f82b7c703324b253806903c1a888410f64ee Mon Sep 17 00:00:00 2001
From: Bernd Helm <bhelm@users.noreply.github.com>
Date: Tue, 1 Sep 2026 11:47:52 +0200
Subject: [PATCH 149/333] Canonicalize signed zero in effective effort (#1792)

Swift.max and Kotlin's max disagree on signed zero, and effectiveEffort sat
right on top of that difference.

Measured on both toolchains rather than assumed:

  operands        Swift.max   Math.max (Kotlin)
  ( 0.0, -0.0)      -0.0          +0.0        <-- diverges
  (-0.0,  0.0)      +0.0          +0.0
  (-0.0, -0.0)      -0.0          -0.0

Swift's max is `y >= x ? y : x`, so it returns whichever operand landed second
when the two compare equal. Java's Math.max special-cases signed zero and always
returns +0.0 for mixed signs. Identical inputs, differently signed zeros - which
is precisely what the byte-identical rule for this package forbids. The guard
canonicalizes all four combinations to +0.0 on both sides.

The tests are the strongest part. They assert on bitPattern / toRawBits, the
only way to tell +0.0 from -0.0 at all: `==` says they are equal, so a plain
assertEquals passes on the bug. All four combinations, passthrough pinned
bit-for-bit including -0.0 and a NaN with a specific payload, and - the
thoughtful one - a test that nonzero, infinity and NaN operand-order behaviour
is UNCHANGED, so the canonicalization cannot quietly broaden into a general max
replacement. Kotlin mirrors it name for name.

Worth recording honestly: -0.0 is not reachable through the scorer today.
trimpToStrain returns a literal 0.0 for trimp <= 0 and its computed path cannot
go negative, so `live` is never -0.0, and `stored` comes from rows written by
that same scorer. All three production callers are Today-screen display paths,
so the symptom would have been an Effort reading of "-0.0" differing between
platforms. This hardens a shared public seam rather than fixing a live bug, and
the PR describes it that way rather than overselling it.

One behaviour change to note: Kotlin's (-0.0, -0.0) was -0.0 and is now +0.0.
Intended, and covered.

Verified before merge: both max behaviours compiled and run on this machine, 10
tests each side, and no regression in the wider suites - 1700 Swift, 1806 Kotlin
analytics, 0 failures.

Thanks @bhelm.
---
 .../StrandAnalytics/StrainScorer.swift        |  1 +
 .../EffectiveEffortTests.swift                | 57 +++++++++++++++++++
 .../java/com/noop/analytics/StrainScorer.kt   |  1 +
 .../com/noop/analytics/EffectiveEffortTest.kt | 57 +++++++++++++++++++
 4 files changed, 116 insertions(+)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/StrainScorer.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/StrainScorer.swift
index 57968b656c..1151d99de5 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/StrainScorer.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/StrainScorer.swift
@@ -212,6 +212,7 @@ public enum StrainScorer {
     public static func effectiveEffort(live: Double?, stored: Double?) -> Double? {
         guard let live else { return stored }
         guard let stored else { return live }
+        if live == 0.0 && stored == 0.0 { return 0.0 }
         return Swift.max(live, stored)
     }
 
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/EffectiveEffortTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/EffectiveEffortTests.swift
index 01116e9626..3981684681 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/EffectiveEffortTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/EffectiveEffortTests.swift
@@ -47,4 +47,61 @@ final class EffectiveEffortTests: XCTestCase {
     func testEqualSourcesResolveToThatValue() {
         XCTAssertEqual(StrainScorer.effectiveEffort(live: 7.25, stored: 7.25)!, 7.25, accuracy: 1e-9)
     }
+
+    /// #37: when both sources are zero, every sign pairing has the canonical positive-zero bits.
+    func testBothPresentZerosCanonicalizePositiveZero() {
+        let cases: [(label: String, live: Double, stored: Double)] = [
+            ("positive/positive", 0.0, 0.0),
+            ("positive/negative", 0.0, -0.0),
+            ("negative/positive", -0.0, 0.0),
+            ("negative/negative", -0.0, -0.0),
+        ]
+
+        for testCase in cases {
+            let result = StrainScorer.effectiveEffort(live: testCase.live, stored: testCase.stored)!
+            XCTAssertEqual(result.bitPattern, 0.0.bitPattern, testCase.label)
+        }
+    }
+
+    /// A missing source is passthrough, including its exact signed-zero and NaN representation.
+    func testSingleSourcePassesThroughBitForBit() {
+        let values = [
+            0.0,
+            -0.0,
+            7.25,
+            -7.25,
+            Double.infinity,
+            -Double.infinity,
+            Double(bitPattern: 0x7ff8_0000_0000_0042),
+        ]
+
+        for value in values {
+            XCTAssertEqual(StrainScorer.effectiveEffort(live: value, stored: nil)!.bitPattern,
+                           value.bitPattern)
+            XCTAssertEqual(StrainScorer.effectiveEffort(live: nil, stored: value)!.bitPattern,
+                           value.bitPattern)
+        }
+    }
+
+    /// The zero canonicalization must not broaden into a replacement for Swift's MAX semantics.
+    func testBothPresentNonzeroAndNaNBehaviorIsUnchanged() {
+        let nanA = Double(bitPattern: 0x7ff8_0000_0000_0042)
+        let nanB = Double(bitPattern: 0x7ff8_0000_0000_0024)
+        let cases: [(live: Double, stored: Double, expected: Double)] = [
+            (2.3, 0.5, 2.3),
+            (7.25, 7.25, 7.25),
+            (Double.infinity, 12.0, Double.infinity),
+            (12.0, Double.infinity, Double.infinity),
+            (-Double.infinity, -Double.infinity, -Double.infinity),
+            (nanA, 1.0, nanA),
+            (1.0, nanA, 1.0),
+            (nanA, nanB, nanA),
+            (nanB, nanA, nanB),
+        ]
+
+        for testCase in cases {
+            let result = StrainScorer.effectiveEffort(live: testCase.live, stored: testCase.stored)!
+            XCTAssertEqual(result.bitPattern, testCase.expected.bitPattern)
+        }
+    }
 }
diff --git a/android/app/src/main/java/com/noop/analytics/StrainScorer.kt b/android/app/src/main/java/com/noop/analytics/StrainScorer.kt
index da6f67a1a1..99bb9d37af 100644
--- a/android/app/src/main/java/com/noop/analytics/StrainScorer.kt
+++ b/android/app/src/main/java/com/noop/analytics/StrainScorer.kt
@@ -250,6 +250,7 @@ object StrainScorer {
     fun effectiveEffort(live: Double?, stored: Double?): Double? {
         if (live == null) return stored
         if (stored == null) return live
+        if (live == 0.0 && stored == 0.0) return 0.0
         return kotlin.math.max(live, stored)
     }
 
diff --git a/android/app/src/test/java/com/noop/analytics/EffectiveEffortTest.kt b/android/app/src/test/java/com/noop/analytics/EffectiveEffortTest.kt
index b0c4b145a3..ae1c6b703e 100644
--- a/android/app/src/test/java/com/noop/analytics/EffectiveEffortTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/EffectiveEffortTest.kt
@@ -54,4 +54,61 @@ class EffectiveEffortTest {
     @Test fun equalSourcesResolveToThatValue() {
         assertEquals(7.25, StrainScorer.effectiveEffort(live = 7.25, stored = 7.25)!!, 1e-9)
     }
+
+    /** #37: when both sources are zero, every sign pairing has the canonical positive-zero bits. */
+    @Test fun bothPresentZerosCanonicalizePositiveZero() {
+        val cases = listOf(
+            Triple("positive/positive", 0.0, 0.0),
+            Triple("positive/negative", 0.0, -0.0),
+            Triple("negative/positive", -0.0, 0.0),
+            Triple("negative/negative", -0.0, -0.0),
+        )
+
+        for ((label, live, stored) in cases) {
+            val result = StrainScorer.effectiveEffort(live = live, stored = stored)!!
+            assertEquals(label, 0.0.toRawBits(), result.toRawBits())
+        }
+    }
+
+    /** A missing source is passthrough, including its exact signed-zero and NaN representation. */
+    @Test fun singleSourcePassesThroughBitForBit() {
+        val values = listOf(
+            0.0,
+            -0.0,
+            7.25,
+            -7.25,
+            Double.POSITIVE_INFINITY,
+            Double.NEGATIVE_INFINITY,
+            Double.fromBits(0x7ff8_0000_0000_0042L),
+        )
+
+        for (value in values) {
+            assertEquals(value.toRawBits(),
+                StrainScorer.effectiveEffort(live = value, stored = null)!!.toRawBits())
+            assertEquals(value.toRawBits(),
+                StrainScorer.effectiveEffort(live = null, stored = value)!!.toRawBits())
+        }
+    }
+
+    /** The zero canonicalization must not broaden into a replacement for Kotlin's MAX semantics. */
+    @Test fun bothPresentNonzeroAndNaNBehaviorIsUnchanged() {
+        val nanA = Double.fromBits(0x7ff8_0000_0000_0042L)
+        val nanB = Double.fromBits(0x7ff8_0000_0000_0024L)
+        val cases = listOf(
+            Triple(2.3, 0.5, 2.3),
+            Triple(7.25, 7.25, 7.25),
+            Triple(Double.POSITIVE_INFINITY, 12.0, Double.POSITIVE_INFINITY),
+            Triple(12.0, Double.POSITIVE_INFINITY, Double.POSITIVE_INFINITY),
+            Triple(Double.NEGATIVE_INFINITY, Double.NEGATIVE_INFINITY, Double.NEGATIVE_INFINITY),
+            Triple(nanA, 1.0, nanA),
+            Triple(1.0, nanA, nanA),
+            Triple(nanA, nanB, nanA),
+            Triple(nanB, nanA, nanB),
+        )
+
+        for ((live, stored, expected) in cases) {
+            val result = StrainScorer.effectiveEffort(live = live, stored = stored)!!
+            assertEquals(expected.toRawBits(), result.toRawBits())
+        }
+    }
 }

From 73e4831a31a6c24645bdfb29a01ab3d5a5706966 Mon Sep 17 00:00:00 2001
From: Kaveman <66108693+kavemang@users.noreply.github.com>
Date: Tue, 1 Sep 2026 05:05:19 -0500
Subject: [PATCH 150/333] Split Health Connect import permissions by category
 (#1509)

Health Connect asked for everything at once. It now asks per category - Recovery
and wellness, Activity, Body composition - chosen in onboarding or Data Sources
BEFORE Android prompts, so the system dialog explains what is being granted
rather than presenting one undifferentiated list.

The parts most likely to be wrong are right.

Existing users keep everything. categoriesFromStoredKeys falls back to
`hadLegacyPermissionSignature ? ALL_CATEGORIES : DEFAULT_CATEGORIES`, so someone
prompted under the old all-at-once flow is unchanged and only new installs get
the narrow default. A privacy split that silently narrowed existing users would
be data loss wearing a privacy hat.

It fails safe twice over. migrateSelectionFromGrants guards
`if (inferred.isNotEmpty())`, so an empty grant set cannot reach
setSelectedCategories' non-empty require and crash. And when stored keys exist
but none are recognised, `if (restored.isNotEmpty())` falls through to the
legacy path rather than returning an empty selection.

Re-prompting is handled with care: hasUnaskedPermissions stores the union of
permissions previously PRESENTED, not the last selection, so narrowing never
re-prompts and a decline stays remembered.

Verified rather than assumed, because this branch is 286 commits behind main and
its green checks predate that drift. Merged it locally against current main:
clean, and #1735's recordImportRun stamps survive on both "ran" paths - the new
early exit is a failure(), consistent with main's other failure paths, so the
"never ran" versus "ran and found nothing" distinction is preserved. The merged
tree compiles and passes 5039 unit tests, 0 failures, including the 10 new
permission-category tests. Every new string is present in all seven locale
files; i18n audit exits 0.

Issue 645 is deliberately NOT closed here. PR #959 targets the same issue and
carries the HealthKit half, and closing it on the Android half alone would leave
that PR pointing at a closed issue and reading as redundant when it is the only
one covering Apple. The closing keyword was removed from this PR's description
before merge for that reason.

Thanks @kavemang.
---
 .../com/noop/ingest/HealthConnectImporter.kt  | 270 +++++++++++++-----
 .../src/main/java/com/noop/ui/AppViewModel.kt |   5 +-
 .../java/com/noop/ui/DataSourcesScreen.kt     |  27 +-
 .../noop/ui/HealthConnectCategorySelector.kt  |  96 +++++++
 .../main/java/com/noop/ui/OnboardingScreen.kt |  29 +-
 .../app/src/main/res/values-de/strings.xml    |   8 +
 .../app/src/main/res/values-es/strings.xml    |   8 +
 .../app/src/main/res/values-fr/strings.xml    |   8 +
 .../app/src/main/res/values-pl/strings.xml    |   8 +
 .../src/main/res/values-pt-rPT/strings.xml    |   8 +
 .../app/src/main/res/values-zh/strings.xml    |   8 +
 android/app/src/main/res/values/strings.xml   |   8 +
 .../HealthConnectPermissionCategoryTest.kt    | 133 +++++++++
 13 files changed, 537 insertions(+), 79 deletions(-)
 create mode 100644 android/app/src/main/java/com/noop/ui/HealthConnectCategorySelector.kt
 create mode 100644 android/app/src/test/java/com/noop/ingest/HealthConnectPermissionCategoryTest.kt

diff --git a/android/app/src/main/java/com/noop/ingest/HealthConnectImporter.kt b/android/app/src/main/java/com/noop/ingest/HealthConnectImporter.kt
index 1066533fa3..8698f3ac8a 100644
--- a/android/app/src/main/java/com/noop/ingest/HealthConnectImporter.kt
+++ b/android/app/src/main/java/com/noop/ingest/HealthConnectImporter.kt
@@ -42,7 +42,7 @@ import kotlin.reflect.KClass
 /**
  * Native Android Health Connect importer.
  *
- * Reads a fixed set of record types out of the on-device Health Connect store via
+ * Reads a user-selected subset of supported record types out of the on-device Health Connect store via
  * `androidx.health.connect:connect-client`, aggregates them **per LOCAL calendar day**
  * (the device's default zone), and upserts them into the same Room store the WHOOP/Apple
  * importers write to (see [WhoopRepository]). All timestamps written are wall-clock UNIX
@@ -59,9 +59,10 @@ import kotlin.reflect.KClass
  *     user has NO raw "my-whoop" rows, so the computed source is what marks their days as owned.
  *   - Exercise sessions -> [WorkoutRow] with source "health-connect".
  *
- * Permissions are assumed to have been granted by the UI (via the Health Connect permission
- * flow) BEFORE [import] is called. If Health Connect is unavailable, or the required
- * read permissions are not in fact granted, [import] returns [ImportSummary.failure].
+ * The UI requests only the selected categories before [import] is called. Partial grants are valid:
+ * the importer reads granted types inside those categories and skips everything else. If Health
+ * Connect is unavailable or none of the selected permissions is granted, it returns
+ * [ImportSummary.failure].
  */
 object HealthConnectImporter {
 
@@ -92,25 +93,67 @@ object HealthConnectImporter {
      *  clipping keeps a neighbouring activity inside this window from over-counting. */
     private const val DISTANCE_MATCH_BUFFER_S = 300L
 
-    /** The record types this importer reads, in one place so PERMISSIONS stays in sync. */
-    private val READ_RECORDS: List<KClass<out Record>> = listOf(
-        StepsRecord::class,
-        TotalCaloriesBurnedRecord::class,
-        ActiveCaloriesBurnedRecord::class,
-        HeartRateRecord::class,
-        RestingHeartRateRecord::class,
-        HeartRateVariabilityRmssdRecord::class,
-        SleepSessionRecord::class,
-        OxygenSaturationRecord::class,
-        RespiratoryRateRecord::class,
-        Vo2MaxRecord::class,
-        WeightRecord::class,
-        BodyFatRecord::class,
-        LeanBodyMassRecord::class,
-        ExerciseSessionRecord::class,
-        DistanceRecord::class,
-        HydrationRecord::class,
-    )
+    /**
+     * User-selectable Health Connect read scopes (#645). Each record type belongs to exactly one
+     * category so the permission prompt can explain what the user is granting and the importer can
+     * skip a deselected category even when Android still holds an older grant for it.
+     */
+    enum class ImportCategory(
+        val storageKey: String,
+        internal val recordTypes: Set<KClass<out Record>>,
+    ) {
+        RECOVERY(
+            "recovery",
+            setOf(
+                HeartRateRecord::class,
+                RestingHeartRateRecord::class,
+                HeartRateVariabilityRmssdRecord::class,
+                SleepSessionRecord::class,
+                OxygenSaturationRecord::class,
+                RespiratoryRateRecord::class,
+                HydrationRecord::class,
+            ),
+        ),
+        ACTIVITY(
+            "activity",
+            setOf(
+                StepsRecord::class,
+                TotalCaloriesBurnedRecord::class,
+                ActiveCaloriesBurnedRecord::class,
+                Vo2MaxRecord::class,
+                ExerciseSessionRecord::class,
+                DistanceRecord::class,
+            ),
+        ),
+        BODY_COMPOSITION(
+            "body-composition",
+            setOf(
+                WeightRecord::class,
+                BodyFatRecord::class,
+                LeanBodyMassRecord::class,
+            ),
+        ),
+    }
+
+    internal val ALL_CATEGORIES: Set<ImportCategory> = ImportCategory.entries.toSet()
+    internal val DEFAULT_CATEGORIES: Set<ImportCategory> = setOf(ImportCategory.RECOVERY)
+
+    /** Every supported read permission. Kept as the compatibility/all-capabilities view. */
+    val PERMISSIONS: Set<String> = permissionsFor(ALL_CATEGORIES)
+
+    /** The permissions represented by exactly [categories], with no implicit broadening. */
+    fun permissionsFor(categories: Set<ImportCategory>): Set<String> =
+        recordTypesFor(categories).mapTo(linkedSetOf()) { HealthPermission.getReadPermission(it) }
+
+    internal fun recordTypesFor(categories: Set<ImportCategory>): Set<KClass<out Record>> =
+        categories.flatMapTo(linkedSetOf()) { it.recordTypes }
+
+    internal fun readableRecordTypes(
+        categories: Set<ImportCategory>,
+        grantedPermissions: Set<String>,
+    ): Set<KClass<out Record>> = recordTypesFor(categories).filterTo(linkedSetOf()) {
+        HealthPermission.getReadPermission(it) in grantedPermissions
+    }
 
     /**
      * Hydration import window, in days (#949) — deliberately much shorter than [WINDOW_YEARS].
@@ -124,36 +167,101 @@ object HealthConnectImporter {
     private const val HYDRATION_WINDOW_DAYS = 30L
 
     /**
-     * The set of Health Connect read-permission strings the UI must request before calling
-     * [import]. One `READ_*` permission per record type in [READ_RECORDS].
+     * The selected categories. New installs start with the narrow recovery/wellness group; an
+     * existing install that was already prompted under the old all-at-once flow keeps all categories
+     * enabled so an update never silently stops importing data it imported before (#645).
      */
-    val PERMISSIONS: Set<String> =
-        READ_RECORDS.map { HealthPermission.getReadPermission(it) }.toSet()
+    fun selectedCategories(context: Context): Set<ImportCategory> {
+        val preferences = prefs(context)
+        return categoriesFromStoredKeys(
+            preferences.getStringSet(CATEGORY_SELECTION_KEY, null)?.toSet(),
+            preferences.contains(PERMISSION_SIGNATURE_KEY),
+        )
+    }
+
+    fun setSelectedCategories(context: Context, categories: Set<ImportCategory>) {
+        require(categories.isNotEmpty()) { "At least one Health Connect category must be selected" }
+        prefs(context).edit()
+            .putStringSet(CATEGORY_SELECTION_KEY, categories.mapTo(linkedSetOf()) { it.storageKey })
+            .apply()
+    }
 
     /**
-     * Whether the user has been asked about the CURRENT permission set (#949).
+     * The categories implied by grants Android already holds.
      *
-     * The import gate is `granted.any { ... }` by design (#150): partial grants are legitimate, so
-     * having any one permission is enough to import. But that also means a permission ADDED in an
-     * update is never requested — an existing user goes straight to importing and the new type reads
-     * as empty forever, indistinguishable from "you have no water logged". Water would have done
-     * nothing at all for every existing Android user.
+     * A user who granted Health Connect before #645 existed has no stored selection, and — if they
+     * onboarded before #949 added it — no permission signature either. The importer has shipped since
+     * 2026-06-07 and that key only since 2026-07-30, so there is a real cohort with neither. Falling back
+     * to [DEFAULT_CATEGORIES] for them would silently stop importing Activity and Body composition while
+     * Android still shows those permissions as granted: nothing on screen would say why steps stopped.
+     *
+     * Their grants are the honest record of what they agreed to, so read the scope back off those.
+     */
+    internal fun categoriesFromGrantedPermissions(granted: Set<String>): Set<ImportCategory> =
+        ImportCategory.entries.filterTo(linkedSetOf()) { category ->
+            permissionsFor(setOf(category)).any { it in granted }
+        }
+
+    /**
+     * One-time backfill of the selection for a user who predates it, from what Android has granted.
      *
-     * Comparing a stored fingerprint of [PERMISSIONS] catches that: when the set grows, the caller
-     * launches the request once so the user is asked about the new type, then marks it asked. It is
-     * asked ONCE — declining is remembered, so this never becomes a nag.
+     * Only ever writes when NOTHING is stored, so a user who deliberately narrows to Recovery is never
+     * re-broadened, and it is safe to call from every entry point that can be the first one reached.
      */
-    fun hasUnaskedPermissions(context: Context): Boolean =
-        prefs(context).getString(PERMISSION_SIGNATURE_KEY, null) != permissionSignature
+    fun migrateSelectionFromGrants(context: Context, granted: Set<String>) {
+        if (prefs(context).getStringSet(CATEGORY_SELECTION_KEY, null) != null) return
+        val inferred = categoriesFromGrantedPermissions(granted)
+        if (inferred.isNotEmpty()) setSelectedCategories(context, inferred)
+    }
 
-    /** Record that the user has now been asked about the current [PERMISSIONS] set. */
-    fun markPermissionsAsked(context: Context) {
-        prefs(context).edit().putString(PERMISSION_SIGNATURE_KEY, permissionSignature).apply()
+    internal fun categoriesFromStoredKeys(
+        storedKeys: Set<String>?,
+        hadLegacyPermissionSignature: Boolean,
+    ): Set<ImportCategory> {
+        if (storedKeys != null) {
+            val restored = ImportCategory.entries.filterTo(linkedSetOf()) { it.storageKey in storedKeys }
+            if (restored.isNotEmpty()) return restored
+        }
+        return if (hadLegacyPermissionSignature) ALL_CATEGORIES else DEFAULT_CATEGORIES
     }
 
-    private const val PERMISSION_SIGNATURE_KEY = "noop.hc.permissionSignature"
+    /**
+     * Whether the user has been asked about every permission in the selected categories (#949/#645).
+     *
+     * The stored value is the union of permissions previously presented, not just the last selected
+     * set. Narrowing a selection therefore never causes another prompt; adding a category or adding a
+     * record type to an enabled category prompts once. Declining is still remembered.
+     *
+     * The old implementation stored all permissions as the same comma-separated signature. Parsing
+     * it as an asked set makes this migration backward-compatible without a preference rewrite.
+     */
+    fun hasUnaskedPermissions(
+        context: Context,
+        categories: Set<ImportCategory> = selectedCategories(context),
+    ): Boolean = unaskedPermissions(askedPermissions(context), categories).isNotEmpty()
+
+    /** Record that the user has now been asked about the selected categories' permissions. */
+    fun markPermissionsAsked(
+        context: Context,
+        categories: Set<ImportCategory> = selectedCategories(context),
+    ) {
+        val asked = askedPermissions(context) + permissionsFor(categories)
+        prefs(context).edit().putString(PERMISSION_SIGNATURE_KEY, asked.sorted().joinToString(",")).apply()
+    }
+
+    internal fun unaskedPermissions(
+        asked: Set<String>,
+        categories: Set<ImportCategory>,
+    ): Set<String> = permissionsFor(categories) - asked
 
-    private val permissionSignature: String get() = PERMISSIONS.sorted().joinToString(",")
+    private fun askedPermissions(context: Context): Set<String> =
+        prefs(context).getString(PERMISSION_SIGNATURE_KEY, null)
+            ?.split(',')
+            ?.filterTo(linkedSetOf()) { it.isNotBlank() }
+            .orEmpty()
+
+    private const val PERMISSION_SIGNATURE_KEY = "noop.hc.permissionSignature"
+    private const val CATEGORY_SELECTION_KEY = "noop.hc.importCategories"
 
     private fun prefs(context: Context) =
         context.getSharedPreferences(NoopPrefs.NAME, Context.MODE_PRIVATE)
@@ -192,7 +300,14 @@ object HealthConnectImporter {
      * [heightCm] is the user's profile height, used ONLY to derive BMI on days that carry a weight
      * (Health Connect has no BMI record, unlike Apple Health). Pass 0.0 to skip BMI derivation.
      */
-    suspend fun import(context: Context, repo: WhoopRepository, heightCm: Double = 0.0): ImportSummary {
+    suspend fun import(
+        context: Context,
+        repo: WhoopRepository,
+        heightCm: Double = 0.0,
+        // Null means "whatever the user has selected", resolved AFTER the grant-based migration below. A
+        // non-lazy default is evaluated at CALL time, before the migration could widen it.
+        categories: Set<ImportCategory>? = null,
+    ): ImportSummary {
         if (sdkStatus(context) != HealthConnectClient.SDK_AVAILABLE) {
             return ImportSummary.failure(SOURCE, "Health Connect is not available on this device.")
         }
@@ -215,15 +330,22 @@ object HealthConnectImporter {
         } catch (e: Exception) {
             return ImportSummary.failure(SOURCE, "Could not read Health Connect permissions: ${e.message}")
         }
+        // #645 follow-up: a user who predates the category selector has nothing stored — recover their
+        // real scope from the grants before deciding what to read, or the first import after the update
+        // would quietly narrow them to Recovery.
+        migrateSelectionFromGrants(context, granted)
+        val effectiveCategories = categories ?: selectedCategories(context)
+
         // Partial permissions are fine (#150): import the record types the user DID grant and skip the
         // rest, instead of refusing the whole import when any single type is missing. Each per-type read
         // below is already independently fault-tolerant — a type whose read permission was revoked throws
         // and is caught/skipped in [readAll] (same path as #34) — so we only need to bail when NOTHING is
         // granted. The user choosing exactly what NOOP can see is the intended behaviour.
-        if (granted.none { it in PERMISSIONS }) {
+        val selectedPermissions = permissionsFor(effectiveCategories)
+        if (granted.none { it in selectedPermissions }) {
             return ImportSummary.failure(
                 SOURCE,
-                "No Health Connect data types are granted. Allow at least one type for NOOP in Health Connect, then import.",
+                "No selected Health Connect data types are granted. Allow at least one selected type, then import.",
             )
         }
 
@@ -233,6 +355,19 @@ object HealthConnectImporter {
         val filter = TimeRangeFilter.between(start, end)
         // #528: skip our own writes on import (see readAll / isSelfWritten).
         val selfPackage = context.packageName
+        val selectedRecordTypes = readableRecordTypes(effectiveCategories, granted)
+
+        // A granted permission can outlive the category selection that originally requested it. Gate
+        // on BOTH here so switching a category off stops its reads immediately without requiring the
+        // user to visit Android's Health Connect settings and revoke the old grant manually (#645).
+        suspend fun <T : Record> readSelected(
+            type: KClass<T>,
+            range: TimeRangeFilter = filter,
+            onRecord: (T) -> Unit,
+        ): Boolean {
+            if (type !in selectedRecordTypes) return false
+            return readAll(client, type, range, selfPackage, onRecord)
+        }
 
         // Per-day accumulators. Keyed by "YYYY-MM-DD" (local).
         val acc = HashMap<String, DayAcc>()
@@ -274,14 +409,14 @@ object HealthConnectImporter {
             // walk, so summing across sources double-counts (~2x). Sum WITHIN a source (keyed by the record's
             // dataOrigin package), then take the MAX source per day at write-out, mirroring the de-overlap
             // already shipped on iOS/macOS and the Android XML importer.
-            readAll(client, StepsRecord::class, filter, selfPackage) { r ->
+            readSelected(StepsRecord::class) { r ->
                 val b = bucket(dayOf(r.startTime, r.startZoneOffset))
                 val src = r.metadata.dataOrigin.packageName
                 b.stepsBySource[src] = (b.stepsBySource[src] ?: 0L) + r.count
             }
             // --- Total calories burned (basal + active) ---
             // #589: per-SOURCE sums, max-across-sources at write-out (same overlap reasoning as steps).
-            readAll(client, TotalCaloriesBurnedRecord::class, filter, selfPackage) { r ->
+            readSelected(TotalCaloriesBurnedRecord::class) { r ->
                 val b = bucket(dayOf(r.startTime, r.startZoneOffset))
                 val src = r.metadata.dataOrigin.packageName
                 b.totalKcalBySource[src] = (b.totalKcalBySource[src] ?: 0.0) + r.energy.inKilocalories
@@ -293,7 +428,7 @@ object HealthConnectImporter {
             // per-record window list below gets EVERY record, tagged with its source: the per-workout credit
             // de-overlaps by source ITSELF (#835 — it used to cross-source SUM, roughly doubling a ride that
             // two apps both logged), so the per-source map here only governs the day total.
-            readAll(client, ActiveCaloriesBurnedRecord::class, filter, selfPackage) { r ->
+            readSelected(ActiveCaloriesBurnedRecord::class) { r ->
                 val b = bucket(dayOf(r.startTime, r.startZoneOffset))
                 val src = r.metadata.dataOrigin.packageName
                 b.activeKcalBySource[src] = (b.activeKcalBySource[src] ?: 0.0) + r.energy.inKilocalories
@@ -301,7 +436,7 @@ object HealthConnectImporter {
                 KcalRecord(r.startTime.epochSecond, r.endTime.epochSecond, r.energy.inKilocalories, src))
             }
             // --- Heart rate (instantaneous samples) -> per-day average ---
-            readAll(client, HeartRateRecord::class, filter, selfPackage) { r ->
+            readSelected(HeartRateRecord::class) { r ->
                 for (s in r.samples) {
                     val b = bucket(dayOf(s.time, r.startZoneOffset))
                     b.hrSum += s.beatsPerMinute
@@ -309,19 +444,19 @@ object HealthConnectImporter {
                 }
             }
             // --- Resting heart rate -> per-day average (rounded to Int) ---
-            readAll(client, RestingHeartRateRecord::class, filter, selfPackage) { r ->
+            readSelected(RestingHeartRateRecord::class) { r ->
                 val b = bucket(dayOf(r.time, r.zoneOffset))
                 b.rhrSum += r.beatsPerMinute
                 b.rhrCount += 1
             }
             // --- HRV (RMSSD, ms) -> per-day average ---
-            readAll(client, HeartRateVariabilityRmssdRecord::class, filter, selfPackage) { r ->
+            readSelected(HeartRateVariabilityRmssdRecord::class) { r ->
                 val b = bucket(dayOf(r.time, r.zoneOffset))
                 b.hrvSum += r.heartRateVariabilityMillis
                 b.hrvCount += 1
             }
             // --- Sleep sessions -> per-day total sleep minutes, assigned to the WAKE day ---
-            readAll(client, SleepSessionRecord::class, filter, selfPackage) { r ->
+            readSelected(SleepSessionRecord::class) { r ->
                 // Wake-day keyed, so the END offset is the right one — but a writer that sets only the
                 // start offset is common, and the start is far better evidence of the sleeper's zone than
                 // the phone's zone at import time. Fall through start before giving up.
@@ -345,19 +480,19 @@ object HealthConnectImporter {
                 ))
             }
             // --- SpO2 (%) -> per-day average ---
-            readAll(client, OxygenSaturationRecord::class, filter, selfPackage) { r ->
+            readSelected(OxygenSaturationRecord::class) { r ->
                 val b = bucket(dayOf(r.time, r.zoneOffset))
                 b.spo2Sum += r.percentage.value
                 b.spo2Count += 1
             }
             // --- Respiratory rate (breaths/min) -> per-day average ---
-            readAll(client, RespiratoryRateRecord::class, filter, selfPackage) { r ->
+            readSelected(RespiratoryRateRecord::class) { r ->
                 val b = bucket(dayOf(r.time, r.zoneOffset))
                 b.respSum += r.rate
                 b.respCount += 1
             }
             // --- VO2 max (ml/kg/min) -> latest value of the day wins ---
-            readAll(client, Vo2MaxRecord::class, filter, selfPackage) { r ->
+            readSelected(Vo2MaxRecord::class) { r ->
                 val b = bucket(dayOf(r.time, r.zoneOffset))
                 if (r.time.epochSecond >= b.vo2maxTs) {
                     b.vo2max = r.vo2MillilitersPerMinuteKilogram
@@ -365,7 +500,7 @@ object HealthConnectImporter {
                 }
             }
             // --- Weight (kg) -> latest value of the day wins ---
-            readAll(client, WeightRecord::class, filter, selfPackage) { r ->
+            readSelected(WeightRecord::class) { r ->
                 val b = bucket(dayOf(r.time, r.zoneOffset))
                 if (r.time.epochSecond >= b.weightTs) {
                     b.weightKg = r.weight.inKilograms
@@ -375,7 +510,7 @@ object HealthConnectImporter {
             // --- Body fat (%) -> latest value of the day wins. Health Connect's Percentage.value is
             // already 0-100 (unlike Apple's 0..1 fraction), so it stores as-is and matches the iOS
             // "body_fat" key. ---
-            readAll(client, BodyFatRecord::class, filter, selfPackage) { r ->
+            readSelected(BodyFatRecord::class) { r ->
                 val b = bucket(dayOf(r.time, r.zoneOffset))
                 if (r.time.epochSecond >= b.bodyFatTs) {
                     b.bodyFatPct = r.percentage.value
@@ -383,7 +518,7 @@ object HealthConnectImporter {
                 }
             }
             // --- Lean body mass (kg) -> latest value of the day wins (iOS "lean_mass" twin). ---
-            readAll(client, LeanBodyMassRecord::class, filter, selfPackage) { r ->
+            readSelected(LeanBodyMassRecord::class) { r ->
                 val b = bucket(dayOf(r.time, r.zoneOffset))
                 if (r.time.epochSecond >= b.leanMassTs) {
                     b.leanMassKg = r.mass.inKilograms
@@ -391,7 +526,7 @@ object HealthConnectImporter {
                 }
             }
             // --- Exercise sessions -> WorkoutRow(source="health-connect") ---
-            readAll(client, ExerciseSessionRecord::class, filter, selfPackage) { r ->
+            readSelected(ExerciseSessionRecord::class) { r ->
                 val startS = r.startTime.epochSecond
                 val endS = r.endTime.epochSecond
                 workouts.add(
@@ -460,12 +595,11 @@ object HealthConnectImporter {
                 var sum = 0L
                 var n = 0L
                 var max = 0L
-                readAll(
-                    client, HeartRateRecord::class,
+                readSelected(
+                    HeartRateRecord::class,
                     TimeRangeFilter.between(
                         Instant.ofEpochSecond(w.startTs), Instant.ofEpochSecond(w.endTs)
                     ),
-                    selfPackage,
                 ) { hr ->
                     for (s in hr.samples) {
                         sum += s.beatsPerMinute
@@ -499,13 +633,12 @@ object HealthConnectImporter {
                 // so a neighbouring activity's record inside the buffer can't over-count.
                 val ws = w.startTs
                 val we = w.endTs
-                readAll(
-                    client, DistanceRecord::class,
+                readSelected(
+                    DistanceRecord::class,
                     TimeRangeFilter.between(
                         Instant.ofEpochSecond(ws - DISTANCE_MATCH_BUFFER_S),
                         Instant.ofEpochSecond(we + DISTANCE_MATCH_BUFFER_S),
                     ),
-                    selfPackage,
                 ) { d ->
                     val rs = d.startTime.epochSecond
                     val re = d.endTime.epochSecond
@@ -531,8 +664,8 @@ object HealthConnectImporter {
             // twice. Taking the max here would silently drop whichever app logged less.
             val hydrationStart = LocalDate.now(zone).minusDays(HYDRATION_WINDOW_DAYS - 1)
                 .atStartOfDay(zone).toInstant()
-            hydrationReadOk = readAll(
-                client, HydrationRecord::class, TimeRangeFilter.between(hydrationStart, end), selfPackage,
+            hydrationReadOk = readSelected(
+                HydrationRecord::class, TimeRangeFilter.between(hydrationStart, end),
             ) { r ->
                 // #1002: hydration deliberately keeps the PHONE's zone, unlike every other record here.
                 // Its write is a windowed REPLACE: `windowDays` below is built from LocalDate.now(zone),
@@ -755,6 +888,7 @@ object HealthConnectImporter {
      */
     suspend fun refreshTodaySteps(context: Context, repo: WhoopRepository): Int? {
         if (sdkStatus(context) != HealthConnectClient.SDK_AVAILABLE) return null
+        if (ImportCategory.ACTIVITY !in selectedCategories(context)) return null
         val client = client(context)
         val granted = try {
             client.permissionController.getGrantedPermissions()
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index 9e60658031..1da04890bc 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -2407,8 +2407,11 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
                 val granted = runCatching {
                     HealthConnectImporter.client(appContext).permissionController.getGrantedPermissions()
                 }.getOrDefault(emptySet())
+                val selectedPermissions = HealthConnectImporter.permissionsFor(
+                    HealthConnectImporter.selectedCategories(appContext),
+                )
                 // Partial permissions are fine (#150): auto-import as long as at least one type is granted.
-                if (granted.none { it in HealthConnectImporter.PERMISSIONS }) return@withContext false
+                if (granted.none { it in selectedPermissions }) return@withContext false
                 // Pass the profile height so the importer can derive BMI (Health Connect has no BMI record).
                 runCatching { HealthConnectImporter.import(appContext, repository, profileStore.heightCm) }.isSuccess
             }
diff --git a/android/app/src/main/java/com/noop/ui/DataSourcesScreen.kt b/android/app/src/main/java/com/noop/ui/DataSourcesScreen.kt
index aa5e602b52..590bfeee5c 100644
--- a/android/app/src/main/java/com/noop/ui/DataSourcesScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/DataSourcesScreen.kt
@@ -118,6 +118,9 @@ fun DataSourcesScreen(vm: AppViewModel) {
     val hcLastSync by vm.hcLastSync.collectAsStateWithLifecycle()
     val hcWriteback by vm.hcWriteback.collectAsStateWithLifecycle()
     val hcWbStatus by vm.hcWritebackStatus.collectAsStateWithLifecycle()
+    var hcReadCategories by remember {
+        mutableStateOf(HealthConnectImporter.selectedCategories(context))
+    }
     // A background (BLE-path) writeback updates prefs, not the VM's flow — re-read on entry so the
     // status line reflects the latest attempt whenever this screen is opened (#660).
     LaunchedEffect(Unit) { vm.refreshHcWritebackStatus() }
@@ -285,7 +288,8 @@ fun DataSourcesScreen(vm: AppViewModel) {
     val hcPermissionLauncher = rememberLauncherForActivityResult(
         PermissionController.createRequestPermissionResultContract(),
     ) { granted ->
-        if (granted.any { it in HealthConnectImporter.PERMISSIONS }) {
+        val selectedPermissions = HealthConnectImporter.permissionsFor(hcReadCategories)
+        if (granted.any { it in selectedPermissions }) {
             runImport { HealthConnectImporter.import(context, vm.repo, ProfileStore.from(context).heightCm) }
         } else {
             Toast.makeText(context, "Health Connect access not granted.", Toast.LENGTH_LONG).show()
@@ -307,16 +311,22 @@ fun DataSourcesScreen(vm: AppViewModel) {
             val granted = runCatching {
                 HealthConnectImporter.client(context).permissionController.getGrantedPermissions()
             }.getOrDefault(emptySet())
+            // #645: a user who predates the selector has nothing stored. Recover their real scope from
+            // what Android already grants BEFORE the checkboxes are read back, or a first visit would
+            // show Recovery-only and saving it would lock in the narrowing.
+            HealthConnectImporter.migrateSelectionFromGrants(context, granted)
+            hcReadCategories = HealthConnectImporter.selectedCategories(context)
+            val selectedPermissions = HealthConnectImporter.permissionsFor(hcReadCategories)
             // `any` (not `all`) is deliberate — partial grants are supported (#150). But that alone
             // would never ASK about a permission added in an update, so a newly-read type would come
             // back empty forever (#949). Route through the request once when the set has grown.
-            if (granted.any { it in HealthConnectImporter.PERMISSIONS } &&
-                !HealthConnectImporter.hasUnaskedPermissions(context)
+            if (granted.any { it in selectedPermissions } &&
+                !HealthConnectImporter.hasUnaskedPermissions(context, hcReadCategories)
             ) {
                 runImport { HealthConnectImporter.import(context, vm.repo, ProfileStore.from(context).heightCm) }
             } else {
-                HealthConnectImporter.markPermissionsAsked(context)
-                hcPermissionLauncher.launch(HealthConnectImporter.PERMISSIONS)
+                HealthConnectImporter.markPermissionsAsked(context, hcReadCategories)
+                hcPermissionLauncher.launch(selectedPermissions)
             }
         }
     }
@@ -483,6 +493,13 @@ fun DataSourcesScreen(vm: AppViewModel) {
                 )
             }
             if (healthConnectAvailable) {
+                HealthConnectCategorySelector(
+                    selected = hcReadCategories,
+                    onSelectionChange = { categories ->
+                        hcReadCategories = categories
+                        HealthConnectImporter.setSelectedCategories(context, categories)
+                    },
+                )
                 BackupButton(
                     label = uiString(R.string.l10n_data_sources_screen_import_from_health_connect_35d55e21),
                     icon = Icons.Filled.FileUpload,
diff --git a/android/app/src/main/java/com/noop/ui/HealthConnectCategorySelector.kt b/android/app/src/main/java/com/noop/ui/HealthConnectCategorySelector.kt
new file mode 100644
index 0000000000..7bb996af8a
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ui/HealthConnectCategorySelector.kt
@@ -0,0 +1,96 @@
+package com.noop.ui
+
+import androidx.annotation.StringRes
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.material3.Switch
+import androidx.compose.material3.SwitchDefaults
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.unit.dp
+import com.noop.R
+import com.noop.ingest.HealthConnectImporter.ImportCategory
+
+/**
+ * Shared category consent surface for onboarding and Data Sources (#645). Keeping the same selector
+ * in both entry points prevents onboarding from quietly requesting a broader permission set than the
+ * settings flow. The last enabled category cannot be switched off because an empty import request has
+ * no useful or explainable result.
+ */
+@Composable
+internal fun HealthConnectCategorySelector(
+    selected: Set<ImportCategory>,
+    onSelectionChange: (Set<ImportCategory>) -> Unit,
+) {
+    Column(
+        modifier = Modifier.fillMaxWidth(),
+        verticalArrangement = Arrangement.spacedBy(12.dp),
+    ) {
+        Text(
+            uiString(R.string.health_connect_categories_title),
+            style = NoopType.subhead,
+            color = Palette.textPrimary,
+        )
+        Text(
+            uiString(R.string.health_connect_categories_detail),
+            style = NoopType.footnote,
+            color = Palette.textTertiary,
+        )
+
+        ImportCategory.entries.forEach { category ->
+            val checked = category in selected
+            val canToggle = !checked || selected.size > 1
+            Row(
+                modifier = Modifier.fillMaxWidth(),
+                verticalAlignment = Alignment.CenterVertically,
+                horizontalArrangement = Arrangement.spacedBy(16.dp),
+            ) {
+                Column(modifier = Modifier.weight(1f)) {
+                    Text(
+                        uiString(category.titleRes()),
+                        style = NoopType.subhead,
+                        color = Palette.textPrimary,
+                    )
+                    Text(
+                        uiString(category.detailRes()),
+                        style = NoopType.footnote,
+                        color = Palette.textTertiary,
+                    )
+                }
+                Switch(
+                    checked = checked,
+                    enabled = canToggle,
+                    onCheckedChange = { enabled ->
+                        val next = if (enabled) selected + category else selected - category
+                        if (next.isNotEmpty()) onSelectionChange(next)
+                    },
+                    colors = SwitchDefaults.colors(
+                        checkedThumbColor = Palette.surfaceBase,
+                        checkedTrackColor = Palette.accent,
+                        uncheckedThumbColor = Palette.textSecondary,
+                        uncheckedTrackColor = Palette.surfaceInset,
+                        uncheckedBorderColor = Palette.hairline,
+                    ),
+                )
+            }
+        }
+    }
+}
+
+@StringRes
+private fun ImportCategory.titleRes(): Int = when (this) {
+    ImportCategory.RECOVERY -> R.string.health_connect_category_recovery
+    ImportCategory.ACTIVITY -> R.string.health_connect_category_activity
+    ImportCategory.BODY_COMPOSITION -> R.string.health_connect_category_body_composition
+}
+
+@StringRes
+private fun ImportCategory.detailRes(): Int = when (this) {
+    ImportCategory.RECOVERY -> R.string.health_connect_category_recovery_detail
+    ImportCategory.ACTIVITY -> R.string.health_connect_category_activity_detail
+    ImportCategory.BODY_COMPOSITION -> R.string.health_connect_category_body_composition_detail
+}
diff --git a/android/app/src/main/java/com/noop/ui/OnboardingScreen.kt b/android/app/src/main/java/com/noop/ui/OnboardingScreen.kt
index 3f17c00dd9..b65058268a 100644
--- a/android/app/src/main/java/com/noop/ui/OnboardingScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/OnboardingScreen.kt
@@ -778,6 +778,9 @@ private fun ImportStep(viewModel: AppViewModel) {
     // so a persisted busy=true would strand the buttons disabled with nothing running.
     var busy by remember { mutableStateOf(false) }
     var status by rememberSaveable { mutableStateOf<String?>(null) }
+    var hcReadCategories by remember {
+        mutableStateOf(HealthConnectImporter.selectedCategories(context))
+    }
     val importingText = uiString(R.string.onboarding_importing)
     val importLabel = uiString(R.string.onboarding_import_label)
     val importFailed = uiString(R.string.onboarding_failed)
@@ -810,7 +813,8 @@ private fun ImportStep(viewModel: AppViewModel) {
     val hcPermissionLauncher = rememberLauncherForActivityResult(
         PermissionController.createRequestPermissionResultContract(),
     ) { granted ->
-        if (granted.any { it in HealthConnectImporter.PERMISSIONS }) {
+        val selectedPermissions = HealthConnectImporter.permissionsFor(hcReadCategories)
+        if (granted.any { it in selectedPermissions }) {
             runImport { HealthConnectImporter.import(context, viewModel.repo, ProfileStore.from(context).heightCm) }
         } else {
             val message = healthConnectDenied
@@ -828,15 +832,21 @@ private fun ImportStep(viewModel: AppViewModel) {
             val granted = runCatching {
                 HealthConnectImporter.client(context).permissionController.getGrantedPermissions()
             }.getOrDefault(emptySet())
-            if (granted.any { it in HealthConnectImporter.PERMISSIONS } &&
-                !HealthConnectImporter.hasUnaskedPermissions(context)
+            // #645: a user who predates the selector has nothing stored. Recover their real scope from
+            // what Android already grants BEFORE the checkboxes are read back, or a first visit would
+            // show Recovery-only and saving it would lock in the narrowing.
+            HealthConnectImporter.migrateSelectionFromGrants(context, granted)
+            hcReadCategories = HealthConnectImporter.selectedCategories(context)
+            val selectedPermissions = HealthConnectImporter.permissionsFor(hcReadCategories)
+            if (granted.any { it in selectedPermissions } &&
+                !HealthConnectImporter.hasUnaskedPermissions(context, hcReadCategories)
             ) {
                 runImport { HealthConnectImporter.import(context, viewModel.repo, ProfileStore.from(context).heightCm) }
             } else {
                 // Marked before launching so the request is made ONCE per permission set: a user who
                 // declines is not asked again on every visit (#949).
-                HealthConnectImporter.markPermissionsAsked(context)
-                hcPermissionLauncher.launch(HealthConnectImporter.PERMISSIONS)
+                HealthConnectImporter.markPermissionsAsked(context, hcReadCategories)
+                hcPermissionLauncher.launch(selectedPermissions)
             }
         }
     }
@@ -870,6 +880,15 @@ private fun ImportStep(viewModel: AppViewModel) {
                         icon = Icons.Filled.MonitorHeart,
                         enabled = !busy && healthConnectAvailable,
                     ) { startHealthConnect() }
+                    if (healthConnectAvailable) {
+                        HealthConnectCategorySelector(
+                            selected = hcReadCategories,
+                            onSelectionChange = { categories ->
+                                hcReadCategories = categories
+                                HealthConnectImporter.setSelectedCategories(context, categories)
+                            },
+                        )
+                    }
                     OnboardingActionButton(
                         label = uiString(R.string.l10n_onboarding_screen_import_apple_health_export_077b5624),
                         icon = Icons.Filled.FavoriteBorder,
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 1006182fd1..a32391617e 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -408,6 +408,14 @@
     <string name="l10n_data_sources_screen_data_sources_5e43d6bb">Datenquellen</string>
     <string name="l10n_data_sources_screen_every_3560d90b">Alle</string>
     <string name="l10n_data_sources_screen_health_connect_be6bca3e">Gesundheit Connect</string>
+    <string name="health_connect_categories_title">Wähle aus, was NOOP lesen darf</string>
+    <string name="health_connect_categories_detail">Wähle die Health-Connect-Kategorien aus, die importiert werden sollen. Du kannst dies später ändern.</string>
+    <string name="health_connect_category_recovery">Erholung &amp; Wohlbefinden</string>
+    <string name="health_connect_category_recovery_detail">Herzfrequenz, HRV, Schlaf, SpO₂, Atmung und Flüssigkeitszufuhr</string>
+    <string name="health_connect_category_activity">Aktivität</string>
+    <string name="health_connect_category_activity_detail">Schritte, Kalorien, Trainingseinheiten, Distanz und VO₂max</string>
+    <string name="health_connect_category_body_composition">Körperzusammensetzung</string>
+    <string name="health_connect_category_body_composition_detail">Gewicht, Körperfett und fettfreie Masse</string>
     <string name="l10n_data_sources_screen_import_apple_health_export_533fca27">Importieren Sie Apple Health Export ...</string>
     <string name="l10n_data_sources_screen_import_from_health_connect_35d55e21">Import von Health Connect</string>
     <string name="l10n_data_sources_screen_import_lifting_log_8fac7b68">Lifting Log ...</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 2abd505303..0e7ea14ed6 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -208,6 +208,14 @@
     <string name="l10n_data_sources_screen_data_sources_5e43d6bb">Fuentes de datos</string>
     <string name="l10n_data_sources_screen_every_3560d90b">Cada uno</string>
     <string name="l10n_data_sources_screen_health_connect_be6bca3e">Health Connect</string>
+    <string name="health_connect_categories_title">Elige qué puede leer NOOP</string>
+    <string name="health_connect_categories_detail">Selecciona las categorías de Health Connect que quieres importar. Puedes cambiarlo más tarde.</string>
+    <string name="health_connect_category_recovery">Recuperación y bienestar</string>
+    <string name="health_connect_category_recovery_detail">Frecuencia cardíaca, VFC, sueño, SpO₂, respiración e hidratación</string>
+    <string name="health_connect_category_activity">Actividad</string>
+    <string name="health_connect_category_activity_detail">Pasos, calorías, entrenamientos, distancia y VO₂ máx.</string>
+    <string name="health_connect_category_body_composition">Composición corporal</string>
+    <string name="health_connect_category_body_composition_detail">Peso, grasa corporal y masa magra</string>
     <string name="l10n_data_sources_screen_import_apple_health_export_533fca27">Importar la exportación de Apple Health...</string>
     <string name="l10n_data_sources_screen_import_from_health_connect_35d55e21">Importación de Health Connect</string>
     <string name="l10n_data_sources_screen_import_lifting_log_8fac7b68">Registro de elevación de importación...</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index bc0790e792..d615817318 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -226,6 +226,14 @@
     <string name="l10n_data_sources_screen_data_sources_5e43d6bb">Sources de données</string>
     <string name="l10n_data_sources_screen_every_3560d90b">Chaque</string>
     <string name="l10n_data_sources_screen_health_connect_be6bca3e">Connexion santé</string>
+    <string name="health_connect_categories_title">Choisissez ce que NOOP peut lire</string>
+    <string name="health_connect_categories_detail">Sélectionnez les catégories Health Connect à importer. Vous pourrez modifier ce choix plus tard.</string>
+    <string name="health_connect_category_recovery">Récupération et bien-être</string>
+    <string name="health_connect_category_recovery_detail">Fréquence cardiaque, VFC, sommeil, SpO₂, respiration et hydratation</string>
+    <string name="health_connect_category_activity">Activité</string>
+    <string name="health_connect_category_activity_detail">Pas, calories, entraînements, distance et VO₂ max</string>
+    <string name="health_connect_category_body_composition">Composition corporelle</string>
+    <string name="health_connect_category_body_composition_detail">Poids, masse grasse et masse maigre</string>
     <string name="l10n_data_sources_screen_import_apple_health_export_533fca27">Importation Apple Health exportation...</string>
     <string name="l10n_data_sources_screen_import_from_health_connect_35d55e21">Importation depuis Health Connect</string>
     <string name="l10n_data_sources_screen_import_lifting_log_8fac7b68">Importer le log...</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 134280a652..82d89edc75 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -373,6 +373,14 @@
     <string name="l10n_data_sources_screen_data_sources_5e43d6bb">Źródła danych</string>
     <string name="l10n_data_sources_screen_every_3560d90b">Każdy</string>
     <string name="l10n_data_sources_screen_health_connect_be6bca3e">Połączenie zdrowotne</string>
+    <string name="health_connect_categories_title">Wybierz dane, które NOOP może odczytywać</string>
+    <string name="health_connect_categories_detail">Wybierz kategorie Health Connect do zaimportowania. Możesz zmienić ten wybór później.</string>
+    <string name="health_connect_category_recovery">Regeneracja i zdrowie</string>
+    <string name="health_connect_category_recovery_detail">Tętno, HRV, sen, SpO₂, oddech i nawodnienie</string>
+    <string name="health_connect_category_activity">Aktywność</string>
+    <string name="health_connect_category_activity_detail">Kroki, kalorie, treningi, dystans i VO₂ max</string>
+    <string name="health_connect_category_body_composition">Skład ciała</string>
+    <string name="health_connect_category_body_composition_detail">Masa ciała, tkanka tłuszczowa i beztłuszczowa masa ciała</string>
     <string name="l10n_data_sources_screen_import_apple_health_export_533fca27">Importuj eksport Apple Health…</string>
     <string name="l10n_data_sources_screen_import_from_health_connect_35d55e21">Importuj z Health Connect</string>
     <string name="l10n_data_sources_screen_import_lifting_log_8fac7b68">Importuj dziennik podnoszenia…</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 00da9bb722..535d73e1b7 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -373,6 +373,14 @@
     <string name="l10n_data_sources_screen_data_sources_5e43d6bb">Fontes de dados</string>
     <string name="l10n_data_sources_screen_every_3560d90b">Cada</string>
     <string name="l10n_data_sources_screen_health_connect_be6bca3e">Health Connect</string>
+    <string name="health_connect_categories_title">Escolha o que o NOOP pode ler</string>
+    <string name="health_connect_categories_detail">Selecione as categorias do Health Connect a importar. Pode alterar esta escolha mais tarde.</string>
+    <string name="health_connect_category_recovery">Recuperação e bem-estar</string>
+    <string name="health_connect_category_recovery_detail">Frequência cardíaca, VFC, sono, SpO₂, respiração e hidratação</string>
+    <string name="health_connect_category_activity">Atividade</string>
+    <string name="health_connect_category_activity_detail">Passos, calorias, treinos, distância e VO₂ máx.</string>
+    <string name="health_connect_category_body_composition">Composição corporal</string>
+    <string name="health_connect_category_body_composition_detail">Peso, gordura corporal e massa magra</string>
     <string name="l10n_data_sources_screen_import_apple_health_export_533fca27">Importar exportação do Apple Health…</string>
     <string name="l10n_data_sources_screen_import_from_health_connect_35d55e21">Importar do Health Connect</string>
     <string name="l10n_data_sources_screen_import_lifting_log_8fac7b68">Importar registo de levantamento…</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index a98ee0e47b..9843721ae9 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -370,6 +370,14 @@
     <string name="l10n_data_sources_screen_data_sources_5e43d6bb">数据源</string>
     <string name="l10n_data_sources_screen_every_3560d90b">每隔</string>
     <string name="l10n_data_sources_screen_health_connect_be6bca3e">Health Connect</string>
+    <string name="health_connect_categories_title">选择 NOOP 可读取的内容</string>
+    <string name="health_connect_categories_detail">选择要导入的 Health Connect 类别。稍后可随时更改。</string>
+    <string name="health_connect_category_recovery">恢复与健康</string>
+    <string name="health_connect_category_recovery_detail">心率、HRV、睡眠、SpO₂、呼吸和饮水</string>
+    <string name="health_connect_category_activity">活动</string>
+    <string name="health_connect_category_activity_detail">步数、卡路里、锻炼、距离和最大摄氧量</string>
+    <string name="health_connect_category_body_composition">身体成分</string>
+    <string name="health_connect_category_body_composition_detail">体重、体脂和瘦体重</string>
     <string name="l10n_data_sources_screen_import_apple_health_export_533fca27">导入 Apple Health 数据包…</string>
     <string name="l10n_data_sources_screen_import_from_health_connect_35d55e21">从 Health Connect 导入</string>
     <string name="l10n_data_sources_screen_import_lifting_log_8fac7b68">导入举重记录…</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index d32df2df16..597acfa3c0 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -501,6 +501,14 @@
     <string name="l10n_data_sources_screen_data_sources_5e43d6bb">Data Sources</string>
     <string name="l10n_data_sources_screen_every_3560d90b">Every</string>
     <string name="l10n_data_sources_screen_health_connect_be6bca3e">Health Connect</string>
+    <string name="health_connect_categories_title">Choose what NOOP can read</string>
+    <string name="health_connect_categories_detail">Select the Health Connect categories to import. You can change this later.</string>
+    <string name="health_connect_category_recovery">Recovery &amp; wellness</string>
+    <string name="health_connect_category_recovery_detail">Heart rate, HRV, sleep, SpO₂, breathing, and hydration</string>
+    <string name="health_connect_category_activity">Activity</string>
+    <string name="health_connect_category_activity_detail">Steps, calories, workouts, distance, and VO₂ max</string>
+    <string name="health_connect_category_body_composition">Body composition</string>
+    <string name="health_connect_category_body_composition_detail">Weight, body fat, and lean mass</string>
     <string name="l10n_data_sources_screen_import_apple_health_export_533fca27">Import Apple Health export…</string>
     <string name="l10n_data_sources_screen_import_from_health_connect_35d55e21">Import from Health Connect</string>
     <string name="l10n_data_sources_screen_import_lifting_log_8fac7b68">Import lifting log…</string>
diff --git a/android/app/src/test/java/com/noop/ingest/HealthConnectPermissionCategoryTest.kt b/android/app/src/test/java/com/noop/ingest/HealthConnectPermissionCategoryTest.kt
new file mode 100644
index 0000000000..ca13b21f0e
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ingest/HealthConnectPermissionCategoryTest.kt
@@ -0,0 +1,133 @@
+package com.noop.ingest
+
+import androidx.health.connect.client.permission.HealthPermission
+import androidx.health.connect.client.records.HeartRateRecord
+import androidx.health.connect.client.records.StepsRecord
+import androidx.health.connect.client.records.WeightRecord
+import com.noop.ingest.HealthConnectImporter.ImportCategory
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/** Pure coverage for the category consent contract in issue #645. */
+class HealthConnectPermissionCategoryTest {
+    private val recovery = setOf(ImportCategory.RECOVERY)
+    private val activity = setOf(ImportCategory.ACTIVITY)
+    private val body = setOf(ImportCategory.BODY_COMPOSITION)
+
+    @Test
+    fun categoriesPartitionEverySupportedPermissionExactlyOnce() {
+        val perCategory = ImportCategory.entries.map { HealthConnectImporter.permissionsFor(setOf(it)) }
+
+        assertEquals(perCategory.sumOf { it.size }, perCategory.flatten().toSet().size)
+        assertEquals(HealthConnectImporter.PERMISSIONS, perCategory.flatten().toSet())
+    }
+
+    @Test
+    fun recoveryDoesNotRequestActivityOrBodyComposition() {
+        val permissions = HealthConnectImporter.permissionsFor(recovery)
+
+        assertTrue(HealthPermission.getReadPermission(HeartRateRecord::class) in permissions)
+        assertFalse(HealthPermission.getReadPermission(StepsRecord::class) in permissions)
+        assertFalse(HealthPermission.getReadPermission(WeightRecord::class) in permissions)
+    }
+
+    @Test
+    fun newInstallsDefaultNarrowWhileLegacyInstallsKeepExistingImports() {
+        assertEquals(
+            recovery,
+            HealthConnectImporter.categoriesFromStoredKeys(null, hadLegacyPermissionSignature = false),
+        )
+        assertEquals(
+            HealthConnectImporter.ALL_CATEGORIES,
+            HealthConnectImporter.categoriesFromStoredKeys(null, hadLegacyPermissionSignature = true),
+        )
+    }
+
+    @Test
+    fun storedSelectionWinsOverLegacyFallback() {
+        assertEquals(
+            activity + body,
+            HealthConnectImporter.categoriesFromStoredKeys(
+                setOf(ImportCategory.ACTIVITY.storageKey, ImportCategory.BODY_COMPOSITION.storageKey),
+                hadLegacyPermissionSignature = true,
+            ),
+        )
+    }
+
+    @Test
+    fun narrowingNeverRepromptsAndExpandingRequestsOnlyNewCategory() {
+        val recoveryPermissions = HealthConnectImporter.permissionsFor(recovery)
+
+        assertTrue(HealthConnectImporter.unaskedPermissions(recoveryPermissions, recovery).isEmpty())
+        assertEquals(
+            HealthConnectImporter.permissionsFor(body),
+            HealthConnectImporter.unaskedPermissions(recoveryPermissions, recovery + body),
+        )
+    }
+
+    @Test
+    fun partialGrantReadsOnlyGrantedTypesInsideSelectedCategories() {
+        val heartRate = HealthPermission.getReadPermission(HeartRateRecord::class)
+        val steps = HealthPermission.getReadPermission(StepsRecord::class)
+        val readable = HealthConnectImporter.readableRecordTypes(
+            categories = recovery + activity,
+            grantedPermissions = setOf(heartRate, steps),
+        )
+
+        assertEquals(setOf(HeartRateRecord::class, StepsRecord::class), readable)
+        assertFalse(WeightRecord::class in readable)
+    }
+
+    @Test
+    fun grantFromDeselectedCategoryIsNotRead() {
+        val readable = HealthConnectImporter.readableRecordTypes(
+            categories = recovery,
+            grantedPermissions = setOf(
+                HealthPermission.getReadPermission(HeartRateRecord::class),
+                HealthPermission.getReadPermission(StepsRecord::class),
+            ),
+        )
+
+        assertEquals(setOf(HeartRateRecord::class), readable)
+    }
+
+    /**
+     * #645 migration: a user who granted Health Connect before the selector existed has no stored
+     * selection, and if they onboarded before #949 no permission signature either — the importer has
+     * shipped since 2026-06-07 and that key only since 2026-07-30. Their Android grants are the only
+     * honest record of what they agreed to, so the scope is read back off those rather than defaulted.
+     *
+     * Without this they would silently stop importing Activity and Body composition while Android still
+     * showed those permissions as granted, with nothing on screen saying why steps had stopped.
+     */
+    @Test
+    fun grantsFromBeforeTheSelectorRecoverTheirCategories() {
+        val granted = setOf(
+            HealthPermission.getReadPermission(HeartRateRecord::class),
+            HealthPermission.getReadPermission(StepsRecord::class),
+        )
+        assertEquals(
+            setOf(ImportCategory.RECOVERY, ImportCategory.ACTIVITY),
+            HealthConnectImporter.categoriesFromGrantedPermissions(granted),
+        )
+    }
+
+    /** A fresh install grants nothing, so there is nothing to recover and the caller keeps its default. */
+    @Test
+    fun noGrantsRecoversNothing() {
+        assertTrue(HealthConnectImporter.categoriesFromGrantedPermissions(emptySet()).isEmpty())
+    }
+
+    /** One granted type is enough to claim its whole category — partial grants stay supported (#150). */
+    @Test
+    fun oneGrantedTypeClaimsItsCategory() {
+        assertEquals(
+            setOf(ImportCategory.BODY_COMPOSITION),
+            HealthConnectImporter.categoriesFromGrantedPermissions(
+                setOf(HealthPermission.getReadPermission(WeightRecord::class)),
+            ),
+        )
+    }
+}

From f4813779cbe53631a3bba0fc591d7f07ccfe64cc Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 22:17:57 +1200
Subject: [PATCH 151/333] staging: build 410 / iOS 291 for the Health Connect
 permission split

Build numbers only - 10.6.1 stays the unreleased line, and 410 clears the
staging high-water so the APK installs over 409.

The one user-visible change is Android-side privacy. Health Connect used to ask
for everything in a single undifferentiated prompt; it now asks per category -
Recovery and wellness, Activity, Body composition - and the choice is made in
onboarding or Data Sources BEFORE Android's dialog, so the system prompt is
already scoped to what was picked.

Existing installs are unchanged: a legacy permission signature means all three
categories stay selected, and only NEW installs get the narrow default. That
asymmetry is the point - a privacy split that quietly narrowed people who had
already granted would be data loss wearing a privacy hat. Partial grants are
preserved and only newly selected permissions are requested.

What to watch: an upgrade should import exactly what it imported on 409. A fresh
install, or a new category ticked in Data Sources, should produce a system
prompt covering only that category. If an upgrade suddenly stops importing steps
or body composition, the legacy-signature migration is the thing that failed.

Also carries a signed-zero canonicalization in effective effort - Swift.max and
Kotlin's max disagree on max(0.0, -0.0), which is the byte-identical analytics
contract broken in one operand order - and the CONTRIBUTING correction for what
CI actually runs. Neither is user-visible.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 6153f26b50..0500e99eee 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 409
+        versionCode = 410
         versionName = "10.6.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 2de86e6cfe..58c4c2302a 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "290"
+    CURRENT_PROJECT_VERSION: "291"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From a1470cff5cd0433204c35fa4fa48d32fb34c3aca Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 00:07:06 +1200
Subject: [PATCH 152/333] analytics: do not claim a twin with a Swift stdlib
 method (#1794)

I wrote this in #1785:

    /** `a - b`, or null when it would overflow. The Long twin of Swift's
        `subtractingReportingOverflow`. */

subtractingReportingOverflow is Swift STDLIB on FixedWidthInteger, not a
declaration in this repository, so the reference resolves to nothing. A reader
chasing it finds no such function here, and neither does an audit.

Found by the parity ledger in #1534, which reported it as a dead-twin-reference
within minutes of being run against a merged tree - and that same PR fixes the
identical mistake in AICoach.swift, where "the twin of Kotlin's
LocalDate.now().toEpochDay()" became "Kotlin computes the same value with".
Two of us reached for that phrasing independently, which says it is easy to
reach for rather than a one-off slip.

Reworded to say what is true: Apple expresses the same contract with that
method, and it is stdlib rather than a twin. The file's PARITY note a few lines
up already had this right - it contrasts Math.subtractExact with
subtractingReportingOverflow without claiming a pairing - so this brings one
line into line with the rest of the file.

Fixed rather than baselined, deliberately. Accepting it as known debt would
launder a defect I introduced into the accepted set, which is the opposite of
what a ledger is for.

Verified against #1534's ledger that this specific finding is gone: two findings
on PreSleepHeartRateFeedback.kt:239 before, none after. It also unblocks that
PR's rebase - the ledger halts on scan errors before it ever evaluates the
baseline, so while this line stood, its baseline state could not be seen at all.

Comment only; no behaviour change.
---
 .../java/com/noop/analytics/PreSleepHeartRateFeedback.kt | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/android/app/src/main/java/com/noop/analytics/PreSleepHeartRateFeedback.kt b/android/app/src/main/java/com/noop/analytics/PreSleepHeartRateFeedback.kt
index bf97270fe0..d120d3fdb2 100644
--- a/android/app/src/main/java/com/noop/analytics/PreSleepHeartRateFeedback.kt
+++ b/android/app/src/main/java/com/noop/analytics/PreSleepHeartRateFeedback.kt
@@ -236,7 +236,14 @@ object PreSleepHeartRateFeedback {
         )
     }
 
-    /** `a - b`, or null when it would overflow. The Long twin of Swift's `subtractingReportingOverflow`. */
+    /**
+     * `a - b`, or null when it would overflow.
+     *
+     * NOT a twin claim, though it reads like one and originally said so. Apple expresses the same
+     * contract with `subtractingReportingOverflow`, which is Swift STDLIB on `FixedWidthInteger` and
+     * therefore not a declaration in this repository at all — so a reader chasing the reference finds
+     * nothing, and a parity audit resolves it to nothing either.
+     */
     private fun subtractOrNull(a: Long, b: Long): Long? =
         try { Math.subtractExact(a, b) } catch (_: ArithmeticException) { null }
 

From 527e7976b45ee07c80015e561cbe25c74cc17c26 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 00:28:37 +1200
Subject: [PATCH 153/333] Release 11.0.0: notes, What's New, and the version
 bump

195 commits since v10.6.0, and the major number is about one of them above all:
the WHOOP 5.0 and MG hold a connection now. A CLIENT_HELLO the strap never
answers was taking the link down roughly every five seconds, all day; NOOP
recognises that strap, stops writing the handshake, and keeps the link. A field
capture held for over seven hours where it previously lasted five.

@Zebsi235's HCI capture is what settled it: the strap answers the pairing
request with Pairing Not Supported. A refusal, not a timing problem, and it
ended weeks of guessing.

Alongside it: a 24-hour body-clock dial and chronotype on the Sleep screen,
nights that stop being scored as whole when only part of the hypnogram arrived,
fragmented nights stitched back together when heart rate says you stayed asleep,
Journal insights that no longer count an untracked day as a No, update
notification on both platforms, and Health Connect asking one permission
category at a time.

Generated locally rather than in CI, deliberately. fork-release runs
appchangelog-gen inside its `NEW != CUR` guard, so a pre-bumped tree skips it and
ships no What's New at all. Running it here also means title_locales does the
localization up front - the generator wrote the title into all seven Android
locale files - instead of leaving a raw English literal on main for the i18n
gate to catch afterwards.

Dispatch with bump=none: CUR and NEW both read 11.0.0, so the bump block is
skipped and the release is still created from docs/releases/v11.0.0.md, which
sits outside that guard.

Gates run before pushing: compile, swiftc -parse on AppChangelog, i18n audit,
doc_comment_lint, lintVitalFullRelease (the ExtraTranslation gate that only
fires on a release build, and this touched seven strings.xml files), and the
full unit suite - 5039 tests, 0 failures.
---
 Strand/System/AppChangelog.swift              |  15 ++-
 android/app/build.gradle.kts                  |   4 +-
 .../src/main/java/com/noop/ui/AppChangelog.kt |  15 ++-
 .../app/src/main/res/values-de/strings.xml    |   1 +
 .../app/src/main/res/values-es/strings.xml    |   1 +
 .../app/src/main/res/values-fr/strings.xml    |   1 +
 .../app/src/main/res/values-pl/strings.xml    |   1 +
 .../src/main/res/values-pt-rPT/strings.xml    |   1 +
 .../app/src/main/res/values-zh/strings.xml    |   1 +
 android/app/src/main/res/values/strings.xml   |   1 +
 docs/releases/v11.0.0.md                      | 123 ++++++++++++++++++
 project.yml                                   |   4 +-
 12 files changed, 162 insertions(+), 6 deletions(-)
 create mode 100644 docs/releases/v11.0.0.md

diff --git a/Strand/System/AppChangelog.swift b/Strand/System/AppChangelog.swift
index 28202c47c9..5ca09f8520 100644
--- a/Strand/System/AppChangelog.swift
+++ b/Strand/System/AppChangelog.swift
@@ -7,7 +7,7 @@ enum AppChangelog {
 
     /// Bump this when you add a release below. The "What's New" sheet shows automatically when the
     /// stored last-seen version is behind this. (Decoupled from the bundle version on purpose.)
-    static let currentVersion = "10.6.0"
+    static let currentVersion = "11.0.0"
 
     struct Release: Identifiable {
         let version: String
@@ -19,6 +19,19 @@ enum AppChangelog {
 
     /// Newest first.
     static let releases: [Release] = [
+        Release(
+            version: "11.0.0",
+            title: "A WHOOP 5 that stays connected, your body clock on the Sleep screen, and a Journal that knows No from nothing",
+            date: "September 2026",
+            items: [
+                "**The WHOOP 5.0 and MG stop dropping every few seconds (#1635, thanks @Zebsi235).** A handshake the strap never answers was knocking a perfectly good link down about every five seconds, all day. NOOP now recognises a strap that will not complete that handshake, stops attempting it, and holds the link instead — live heart rate keeps streaming rather than restarting forever. Tapping Connect costs one reconnect now, not five.",
+                "**Your body clock, on the Sleep screen (#1722, #1723, #1729, #1733).** A 24-hour dial showing when your body actually wants to sleep, and a chronotype read from your own nights rather than a questionnaire. It says what it used and refuses to guess when it cannot see enough.",
+                "**Nights read straighter (#1717, #1734, #1741, #1755, #1782).** A night that only partly downloaded is no longer scored as if it were whole. Sleep that arrives in fragments is stitched back together when your heart rate says you stayed asleep through the gap. And sleep debt is now a number you can act on tonight.",
+                "**A day you never logged is not a day you answered No (#322).** Journal insights compared days you ticked against every other day — including the ones you simply did not open the app. They now compare Yes days against No days only, so an untracked week stops quietly counting against you.",
+                "**NOOP tells you when there is a new version (#1674, #1675).** Both platforms now notice a release and say so, on by default, checked directly against the release feed with nothing else sent.",
+                "**Health Connect asks for one category at a time (#1509, thanks @kavemang).** Recovery, Activity and Body composition are chosen before Android's prompt appears, so you grant what you meant to. Existing installs keep exactly what they already had.",
+            ]
+        ),
         Release(
             version: "10.6.0",
             title: "An Effort scale you choose, a ring that gets to sleep, and far fewer wasted re-scores",
diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 0500e99eee..aa680b28a8 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,8 +26,8 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 410
-        versionName = "10.6.1"
+        versionCode = 411
+        versionName = "11.0.0"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
         vectorDrawables {
diff --git a/android/app/src/main/java/com/noop/ui/AppChangelog.kt b/android/app/src/main/java/com/noop/ui/AppChangelog.kt
index 70b4938dd8..13334add53 100644
--- a/android/app/src/main/java/com/noop/ui/AppChangelog.kt
+++ b/android/app/src/main/java/com/noop/ui/AppChangelog.kt
@@ -26,7 +26,7 @@ object AppChangelog {
      * Bump this when you add a release below. The "What's New" sheet shows automatically when the
      * stored last-seen version is behind this. (Decoupled from the bundle version on purpose.)
      */
-    const val CURRENT_VERSION = "10.6.0"
+    const val CURRENT_VERSION = "11.0.0"
 
     data class Release(
         val version: String,
@@ -37,6 +37,19 @@ object AppChangelog {
 
     /** Newest first. */
     val releases: List<Release> = listOf(
+        Release(
+            version = "11.0.0",
+            title = uiString(R.string.l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee),
+            date = "September 2026",
+            items = listOf(
+                "**The WHOOP 5.0 and MG stop dropping every few seconds (#1635, thanks @Zebsi235).** A handshake the strap never answers was knocking a perfectly good link down about every five seconds, all day. NOOP now recognises a strap that will not complete that handshake, stops attempting it, and holds the link instead — live heart rate keeps streaming rather than restarting forever. Tapping Connect costs one reconnect now, not five.",
+                "**Your body clock, on the Sleep screen (#1722, #1723, #1729, #1733).** A 24-hour dial showing when your body actually wants to sleep, and a chronotype read from your own nights rather than a questionnaire. It says what it used and refuses to guess when it cannot see enough.",
+                "**Nights read straighter (#1717, #1734, #1741, #1755, #1782).** A night that only partly downloaded is no longer scored as if it were whole. Sleep that arrives in fragments is stitched back together when your heart rate says you stayed asleep through the gap. And sleep debt is now a number you can act on tonight.",
+                "**A day you never logged is not a day you answered No (#322).** Journal insights compared days you ticked against every other day — including the ones you simply did not open the app. They now compare Yes days against No days only, so an untracked week stops quietly counting against you.",
+                "**NOOP tells you when there is a new version (#1674, #1675).** Both platforms now notice a release and say so, on by default, checked directly against the release feed with nothing else sent.",
+                "**Health Connect asks for one category at a time (#1509, thanks @kavemang).** Recovery, Activity and Body composition are chosen before Android's prompt appears, so you grant what you meant to. Existing installs keep exactly what they already had.",
+            ),
+        ),
         Release(
             version = "10.6.0",
             title = uiString(R.string.l10n_app_changelog_an_effort_scale_you_choose_a_a7c2478d),
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index a32391617e..eb200800d6 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2669,4 +2669,5 @@
     <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">Letzte Nacht</string>
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Deine innere Uhr</string>
     <string name="vo2max_method_change_caption">Die Linie bricht dort ab, wo sich die Schätzmethode geändert hat oder nicht erfasst wurde.</string>
+    <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">Eine WHOOP 5, die verbunden bleibt, deine innere Uhr im Schlaf-Screen und ein Journal, das Nein von gar nichts unterscheidet</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 0e7ea14ed6..deeb1a15b2 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2656,4 +2656,5 @@
     <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">Anoche</string>
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Tu reloj interno</string>
     <string name="vo2max_method_change_caption">La línea se interrumpe donde el método de estimación cambió o no se registró.</string>
+    <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">Una WHOOP 5 que no se desconecta, tu reloj interno en la pantalla de Sueño y un diario que distingue No de nada</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index d615817318..b534e5c189 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2655,4 +2655,5 @@
     <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">La nuit dernière</string>
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Votre horloge</string>
     <string name="vo2max_method_change_caption">La courbe est interrompue là où la méthode d’estimation a changé ou n’a pas été enregistrée.</string>
+    <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">Une WHOOP 5 qui reste connectée, votre horloge interne sur l\'écran Sommeil, et un journal qui distingue Non de rien</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 82d89edc75..09d5d0551c 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2660,4 +2660,5 @@
     <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">Ostatnia noc</string>
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Twój zegar</string>
     <string name="vo2max_method_change_caption">Linia jest przerwana tam, gdzie metoda szacowania zmieniła się lub nie została zapisana.</string>
+    <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">WHOOP 5, który nie traci połączenia, zegar biologiczny na ekranie snu i dziennik odróżniający Nie od braku wpisu</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 535d73e1b7..56ca2bcde3 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2648,4 +2648,5 @@
     <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">A noite passada</string>
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">O seu relógio</string>
     <string name="vo2max_method_change_caption">A linha é interrompida onde o método de estimativa mudou ou não foi registado.</string>
+    <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">Uma WHOOP 5 que se mantém ligada, o seu relógio interno no ecrã de Sono e um diário que distingue Não de nada</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 9843721ae9..2049989e1b 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2569,4 +2569,5 @@
     <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">昨夜</string>
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">你的生物钟</string>
     <string name="vo2max_method_change_caption">线条在估算方法发生变化或未记录之处中断。</string>
+    <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">不再频繁掉线的 WHOOP 5、睡眠页上的生物钟，以及能分清「否」与「未记录」的日志</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 597acfa3c0..1f804c5765 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2682,4 +2682,5 @@
     <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">Last night</string>
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Your clock</string>
     <string name="vo2max_method_change_caption">The line breaks where the estimation method changed or was not recorded.</string>
+    <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">A WHOOP 5 that stays connected, your body clock on the Sleep screen, and a Journal that knows No from nothing</string>
 </resources>
diff --git a/docs/releases/v11.0.0.md b/docs/releases/v11.0.0.md
new file mode 100644
index 0000000000..0a8820e907
--- /dev/null
+++ b/docs/releases/v11.0.0.md
@@ -0,0 +1,123 @@
+---
+whatsnew:
+  title: "A WHOOP 5 that stays connected, your body clock on the Sleep screen, and a Journal that knows No from nothing"
+  date: "September 2026"
+  items:
+    - "**The WHOOP 5.0 and MG stop dropping every few seconds (#1635, thanks @Zebsi235).** A handshake the strap never answers was knocking a perfectly good link down about every five seconds, all day. NOOP now recognises a strap that will not complete that handshake, stops attempting it, and holds the link instead — live heart rate keeps streaming rather than restarting forever. Tapping Connect costs one reconnect now, not five."
+    - "**Your body clock, on the Sleep screen (#1722, #1723, #1729, #1733).** A 24-hour dial showing when your body actually wants to sleep, and a chronotype read from your own nights rather than a questionnaire. It says what it used and refuses to guess when it cannot see enough."
+    - "**Nights read straighter (#1717, #1734, #1741, #1755, #1782).** A night that only partly downloaded is no longer scored as if it were whole. Sleep that arrives in fragments is stitched back together when your heart rate says you stayed asleep through the gap. And sleep debt is now a number you can act on tonight."
+    - "**A day you never logged is not a day you answered No (#322).** Journal insights compared days you ticked against every other day — including the ones you simply did not open the app. They now compare Yes days against No days only, so an untracked week stops quietly counting against you."
+    - "**NOOP tells you when there is a new version (#1674, #1675).** Both platforms now notice a release and say so, on by default, checked directly against the release feed with nothing else sent."
+    - "**Health Connect asks for one category at a time (#1509, thanks @kavemang).** Recovery, Activity and Body composition are chosen before Android's prompt appears, so you grant what you meant to. Existing installs keep exactly what they already had."
+  title_locales:
+    de: "Eine WHOOP 5, die verbunden bleibt, deine innere Uhr im Schlaf-Screen und ein Journal, das Nein von gar nichts unterscheidet"
+    es: "Una WHOOP 5 que no se desconecta, tu reloj interno en la pantalla de Sueño y un diario que distingue No de nada"
+    fr: "Une WHOOP 5 qui reste connectée, votre horloge interne sur l'écran Sommeil, et un journal qui distingue Non de rien"
+    pt-PT: "Uma WHOOP 5 que se mantém ligada, o seu relógio interno no ecrã de Sono e um diário que distingue Não de nada"
+    zh: "不再频繁掉线的 WHOOP 5、睡眠页上的生物钟，以及能分清「否」与「未记录」的日志"
+    pl: "WHOOP 5, który nie traci połączenia, zegar biologiczny na ekranie snu i dziennik odróżniający Nie od braku wpisu"
+---
+# NOOP v11.0.0
+
+A major release, and the version number is about one thing above all: the WHOOP 5.0 and MG finally hold
+a connection. Everything else — a body clock on the Sleep screen, nights that read straighter, a Journal
+that stops counting silence against you — arrived alongside it.
+
+## The WHOOP 5.0 / MG connection
+
+**A handshake the strap never answers no longer takes the link with it (#1635, #1642, thanks
+@Zebsi235).** NOOP wrote a CLIENT_HELLO on every connect and the 5/MG never acknowledged it; roughly
+4.8 seconds later the link dropped, and the cycle repeated all day. NOOP now recognises the pattern,
+stops writing the handshake for that strap, and keeps the link — the "Live HR, not fully paired" state
+the app already modelled, reached deliberately instead of never. A field capture confirmed a link held
+for over seven hours where it previously lasted five seconds.
+
+An HCI capture contributed by @Zebsi235 settled what the strap is actually doing: it answers the
+pairing request with `Pairing Not Supported`. That is a refusal, not a timing problem, and it ended
+weeks of guessing.
+
+**Reconnecting costs what it should (#1778, #1779, #1781).** Tapping Connect used to throw away
+everything NOOP had learned and re-earn it over five more dropped links. It now keeps that knowledge,
+gives the handshake exactly one fresh attempt, and settles after a single reconnect. A timer firing is
+no longer treated as you asking to try again.
+
+**The strap is asked properly, and says so in the log (#1639, #1646, #1648, #1652, #1653, #1656,
+#1668).** NOOP now observes the OS pairing flow rather than inferring it, reads the Device Information
+Service on a strap that never bonds, enumerates what a strap actually offers once per device, and lets
+a 5/MG identify itself instead of being guessed at from its serial.
+
+**Clearing a stale phone pairing (#1790).** When the phone holds a pairing the strap no longer honours,
+NOOP can now clear it for you — off by default, in Test Centre, once per streak, and only after the
+guide has already asked you to do it by hand.
+
+## Sleep
+
+**Your body clock (#1722, #1723, #1726, #1729, #1731, #1733).** A 24-hour dial on the Sleep screen
+showing your circadian phase, with an absolute chronotype bucketed from it. The diagnostics report the
+inputs it used, and a rhythm too small to be real is refused rather than drawn.
+
+**A partial night is not a whole one (#1717, #1721, #1734).** A hypnogram that only partly downloaded
+was scored as though complete, which quietly shortened nights after an interrupted sync. Both readers
+of that coverage now agree on what "complete" means.
+
+**Fragmented nights are stitched back together (#1755, #1782).** When data is sparse, NOOP bridges
+short gaps between sleep runs — and now allows a longer interruption when your heart rate stayed in the
+sleep band throughout, because on a strap with no motion data heart rate is the better witness.
+
+**Sleep debt you can act on (#1741).** Debt is now expressed as a target for tonight rather than an
+abstract ledger.
+
+## Journal, workouts and metrics
+
+**Yes days are compared against No days (#322).** Previously an insight weighed the days you logged
+against every day you did not — so a week you never opened the app counted as a week of No.
+
+**Pause and resume a live workout (#1690).** The controls are on the active-workout card, and the five
+clocks that used to ignore a pause now honour it.
+
+**Latest Workouts opens a session (#1701, #1703).** Tapping a row goes to its detail, and iOS uses the
+same 14-day window Android already did.
+
+**Skin temperature leads with the absolute (#1663, #1665, #1671, #1708).** The nightly absolute is
+stored and shown first, deviation beneath it, in your own units throughout.
+
+**VO₂max says why a line breaks (#1740).** The chart shows the decimal it draws, and explains a gap
+rather than leaving one.
+
+## Straps, sync and privacy
+
+**Multiple straps are kept apart (#1455, #1634, #1730, #1745).** Physiology is read across every
+registered strap, firmware is attributed to the strap it came from rather than the last to connect,
+last-sync belongs to a strap rather than the install, and a 5/MG carries a stable identity derived from
+its serial.
+
+**Health Connect permissions by category (#1509, thanks @kavemang).** Recovery and wellness, Activity,
+and Body composition are picked before Android's prompt. Existing installs are detected and keep every
+category they already had.
+
+**A crash you can report (#1718, #1720, #1724).** Android shows a copyable recovery screen after a
+crash, redacted everywhere it leaves the device — and an upgrade no longer greets you with a crash from
+the build it replaced.
+
+**Update checking, on by default (#1674, #1675).** Both platforms notice a new release. The privacy
+documentation now describes what actually happens.
+
+**Experimental self-hosted push (#1631, #1700).** One-way push to your own endpoint, off by default,
+with the destination errors localized.
+
+## Oura
+
+**A bonded ring with no advertised name is listed again (#1776, thanks @pipiche38).** A bonded ring
+often stops advertising a name, and that was exactly the ring the Add-Device screen could not show.
+
+**Skin Temp as a Key Metrics tile (#1678), and protocol corrections (#1629, #1687, #1777).**
+
+## Under the hood
+
+Raw 100 Hz IMU capture and labeled recording sessions for the 5/MG (#1709). A JSON query CLI for the
+local read tools (#1752). Analysis reads each row once instead of 2.25 times (#1695, #1696). Swift
+analytics tests run on Linux (#1529). Several diagnostics now say which gate refused a metric, rather
+than leaving a blank.
+
+Thanks to @bhelm, @pipiche38, @kvnloo, @Zebsi235, @kavemang, @fadkeprasad, @Meriquium and @dwehrmann
+for contributions in this release.
diff --git a/project.yml b/project.yml
index 58c4c2302a..c612811398 100644
--- a/project.yml
+++ b/project.yml
@@ -17,11 +17,11 @@ configFiles:
   Release: Config/BundleId.xcconfig
 settings:
   base:
-    MARKETING_VERSION: "10.6.1"
+    MARKETING_VERSION: "11.0.0"
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "291"
+    CURRENT_PROJECT_VERSION: "292"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From d6d84cc5220df1f1e89da77c4259de79fe532996 Mon Sep 17 00:00:00 2001
From: ryanbr <mp3geek@gmail.com>
Date: Tue, 1 Sep 2026 12:57:24 +0000
Subject: [PATCH 154/333] Release 11.0.0: add to AltStore source

---
 altstore-source.json | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/altstore-source.json b/altstore-source.json
index b581bd3a28..f3eb116872 100644
--- a/altstore-source.json
+++ b/altstore-source.json
@@ -19,6 +19,15 @@
       "category": "healthcare-fitness",
       "screenshotURLs": [],
       "versions": [
+        {
+          "version": "11.0.0",
+          "buildVersion": "292",
+          "date": "2026-09-01",
+          "localizedDescription": "NOOP 11.0.0. See the release notes for what changed.",
+          "downloadURL": "https://github.com/ryanbr/noop/releases/download/v11.0.0/NOOP-ios-unsigned-v11.0.0.ipa",
+          "size": 19362325,
+          "minOSVersion": "17.0"
+        },
         {
           "version": "10.6.0",
           "buildVersion": "241",
@@ -1393,12 +1402,12 @@
           "NSMotionUsageDescription": "NOOP reads your iPhone's step count for a walking or running workout to show steps in the activity summary. It stays on your device. Nothing leaves it."
         }
       },
-      "version": "10.6.0",
-      "buildVersion": "241",
-      "versionDate": "2026-08-25",
-      "versionDescription": "NOOP 10.6.0. See the release notes for what changed.",
-      "downloadURL": "https://github.com/ryanbr/noop/releases/download/v10.6.0/NOOP-ios-unsigned-v10.6.0.ipa",
-      "size": 19019520,
+      "version": "11.0.0",
+      "buildVersion": "292",
+      "versionDate": "2026-09-01",
+      "versionDescription": "NOOP 11.0.0. See the release notes for what changed.",
+      "downloadURL": "https://github.com/ryanbr/noop/releases/download/v11.0.0/NOOP-ios-unsigned-v11.0.0.ipa",
+      "size": 19362325,
       "minOSVersion": "17.0"
     }
   ],

From 1413363d787a4394cca435f5643ca8223fb8f7ad Mon Sep 17 00:00:00 2001
From: Pipiche <8291674+pipiche38@users.noreply.github.com>
Date: Wed, 2 Sep 2026 01:06:03 +0200
Subject: [PATCH 155/333] fix(oura): make the nameless-ring label rule one
 tested twin, not two (#1797)

A bonded Oura ring routinely stops advertising a local name, so the nameless case is the
normal case for the ring a user most wants to reconnect to. Both platforms guarded it
ad hoc at the DiscoveredRing construction site with slightly different rules: Swift used
isEmpty, Kotlin used ifBlank, so a ring advertising " " listed as "Oura" on Android and
blank on Apple.

Routes both platforms through a single named helper (ouraAdvertisedLabel) at the one
construction site each, treats whitespace as absent on both sides, and returns the name
untrimmed when present. The Android wizard subtitle fallback now uses the existing
l10n_add_device_wizard_oura_ring_e3431536 key, matching the localisation Apple already had.

Pinned by OuraNamelessRingDiscoveryTest against the Swift twin's own stdout over a 12-case
list, which caught a trim()-based Kotlin draft that returned the trimmed name where Swift
returns the original.

Reported in #1783. No new strings, so nothing owed in any locale.

Thanks to @pipiche38.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 Strand/BLE/OuraLiveSource.swift               | 25 +++++++++++--
 .../main/java/com/noop/ble/OuraLiveSource.kt  | 27 ++++++++++++--
 .../main/java/com/noop/ui/AddDeviceWizard.kt  |  5 ++-
 .../noop/ble/OuraNamelessRingDiscoveryTest.kt | 36 +++++++++++++++++++
 4 files changed, 88 insertions(+), 5 deletions(-)

diff --git a/Strand/BLE/OuraLiveSource.swift b/Strand/BLE/OuraLiveSource.swift
index 1083799a43..69345673d7 100644
--- a/Strand/BLE/OuraLiveSource.swift
+++ b/Strand/BLE/OuraLiveSource.swift
@@ -13,6 +13,27 @@ import UIKit
 import AppKit
 #endif
 
+/// The label a discovered ring is listed under: its advertised local name, or `fallback` when it did
+/// not advertise one.
+///
+/// A BONDED ring routinely stops advertising a local name, so the blank case is the NORMAL case for the
+/// ring a user most wants to reconnect to (#1776), not an error path — the scan's service filter is the
+/// only gate and the name is a label. Callers therefore never see an empty `DiscoveredRing.name`, which
+/// is why the wizard renders it unguarded on both platforms (#1783 reads that as a missing guard; the
+/// guard is here, at the single construction site).
+///
+/// BLANK, not empty. The Kotlin twin is `ouraAdvertisedLabel` in `ble/OuraLiveSource.kt`, built on
+/// `ifBlank`, which treats an all-whitespace name as absent. `isEmpty` does not, so a ring advertising
+/// `" "` would have listed blank here and as "Oura" there — the exact silent Swift/Kotlin divergence the
+/// parity contract calls out. Both sides now treat whitespace as absent and return the name UNTRIMMED
+/// when it is present. Pinned by the Kotlin `OuraNamelessRingDiscoveryTest` against this function's own
+/// output. The two agree over ASCII whitespace and ordinary names; they part only on exotic Unicode
+/// spaces (`.whitespacesAndNewlines` includes U+00A0, Java's `Character.isWhitespace` does not), which
+/// no BLE local name carries — stated rather than silently overclaimed.
+func ouraAdvertisedLabel(_ advertisedName: String, fallback: String) -> String {
+    advertisedName.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty ? fallback : advertisedName
+}
+
 /// EXPERIMENTAL, ISOLATED live-BLE source for the Oura ring (gen 3/4/5), driven by the clean-room
 /// `OuraProtocol.OuraDriver`.
 ///
@@ -2212,9 +2233,9 @@ extension OuraLiveSource: @preconcurrency CBCentralManagerDelegate {
         let id = peripheral.identifier
         let firstSight = seenPeripherals[id] == nil
         seenPeripherals[id] = peripheral
-        if firstSight { log("Oura: found \(name.isEmpty ? "Oura ring" : name) (\(id)) rssi \(RSSI.intValue)") }
+        if firstSight { log("Oura: found \(ouraAdvertisedLabel(name, fallback: "Oura ring")) (\(id)) rssi \(RSSI.intValue)") }
         let ring = DiscoveredRing(id: id,
-                                  name: name.isEmpty ? "Oura" : name,
+                                  name: ouraAdvertisedLabel(name, fallback: "Oura"),
                                   rssi: RSSI.intValue,
                                   detectedGen: detectedGen)
         if let idx = discovered.firstIndex(where: { $0.id == id }) {
diff --git a/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt b/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt
index fb56ab533a..2e941f8937 100644
--- a/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt
+++ b/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt
@@ -51,6 +51,29 @@ import java.security.SecureRandom
 import java.util.UUID
 import java.util.concurrent.ConcurrentHashMap
 
+/**
+ * The label a discovered ring is listed under: its advertised local name, or [fallback] when it did not
+ * advertise one.
+ *
+ * A BONDED ring routinely stops advertising a local name, so the blank case is the NORMAL case for the
+ * ring a user most wants to reconnect to (#1776), not an error path - the scan's ScanFilter is the only
+ * gate and the name is a label. Callers therefore never see a blank `DiscoveredRing.name`, which is why
+ * the wizard renders it unguarded on both platforms (#1783 reads that as a missing guard; the guard is
+ * here, at the single construction site).
+ *
+ * BLANK, not empty. `isBlank` treats an all-whitespace name as absent; the Swift twin
+ * `ouraAdvertisedLabel` in `Strand/BLE/OuraLiveSource.swift` used `isEmpty`, which does not, so a ring
+ * advertising `" "` listed as "Oura" here and blank there - the exact silent Kotlin/Swift divergence the
+ * parity contract calls out. Both sides now treat whitespace as absent and return the name UNTRIMMED
+ * when it is present, and `OuraNamelessRingDiscoveryTest` pins this function against the Swift twin's
+ * own output. The two agree over ASCII whitespace and ordinary names; they part only on exotic Unicode
+ * spaces (Java's `Character.isWhitespace` excludes U+00A0, Swift's `.whitespacesAndNewlines` includes
+ * it), which no BLE local name carries - stated rather than silently overclaimed.
+ */
+internal fun ouraAdvertisedLabel(advertisedName: String, fallback: String): String =
+    advertisedName.ifBlank { fallback }
+
+
 /**
  * EXPERIMENTAL, ISOLATED live-BLE source for the Oura ring (gen3 / gen4 / gen5).
  *
@@ -1101,7 +1124,7 @@ class OuraLiveSource(
             val address = device.address ?: return
             val name = result.scanRecord?.deviceName ?: runCatching { device.name }.getOrNull() ?: ""
             val firstSight = seen.put(address, device) == null   // null → not seen before this scan
-            if (firstSight) log("Oura: found ${name.ifBlank { "Oura ring" }} ($address) rssi ${result.rssi}")
+            if (firstSight) log("Oura: found ${ouraAdvertisedLabel(name, "Oura ring")} ($address) rssi ${result.rssi}")
             // Best-effort generation guess from the advertised name — a LABEL only (the wizard falls back
             // to GEN3 when it is null). Nothing is dropped here: startScan's ScanFilter pins SERVICE_UUID in
             // the BT stack, so that is the gate, and a ring is listed even when it advertises no local name
@@ -1114,7 +1137,7 @@ class OuraLiveSource(
             val detectedGen = OuraRingGen.recognise(name)
             val ring = DiscoveredRing(
                 address = address,
-                name = name.ifBlank { "Oura" },
+                name = ouraAdvertisedLabel(name, "Oura"),
                 rssi = result.rssi,
                 detectedGen = detectedGen,
             )
diff --git a/android/app/src/main/java/com/noop/ui/AddDeviceWizard.kt b/android/app/src/main/java/com/noop/ui/AddDeviceWizard.kt
index 8253fa1998..d3cde96a9a 100644
--- a/android/app/src/main/java/com/noop/ui/AddDeviceWizard.kt
+++ b/android/app/src/main/java/com/noop/ui/AddDeviceWizard.kt
@@ -1338,7 +1338,10 @@ private fun OuraPickStep(
                     DiscoveredRow(
                         name = ring.name,
                         // Subtitle = the detected generation (best-effort); "Oura ring" when undetected.
-                        subtitle = ring.detectedGen?.displayName ?: "Oura ring",
+                        // Localised: a ring that advertises no local name has no detectable generation
+                        // either, so this fallback is exactly what the #1776 bonded-ring case renders.
+                        subtitle = ring.detectedGen?.displayName
+                            ?: uiString(R.string.l10n_add_device_wizard_oura_ring_e3431536),
                         rssi = ring.rssi,
                         onTap = { onPick(ring) },
                     )
diff --git a/android/app/src/test/java/com/noop/ble/OuraNamelessRingDiscoveryTest.kt b/android/app/src/test/java/com/noop/ble/OuraNamelessRingDiscoveryTest.kt
index f5da17eb26..8ee4561b64 100644
--- a/android/app/src/test/java/com/noop/ble/OuraNamelessRingDiscoveryTest.kt
+++ b/android/app/src/test/java/com/noop/ble/OuraNamelessRingDiscoveryTest.kt
@@ -20,6 +20,11 @@ import org.junit.Test
  * (no name gate in the callback; the ScanFilter is the only gate) is a live BLE discovery behaviour and
  * cannot be asserted here — it is validated on hardware. Apple has always behaved this way
  * (Strand/BLE/OuraLiveSource.swift), so this also closes a cross-platform divergence.
+ *
+ * What CAN be asserted headlessly is how the nameless ring is then LABELLED, which is the last test here.
+ * #1783 reports that label arriving blank in the wizard on both platforms; it does not, because
+ * `ouraAdvertisedLabel` substitutes a fallback at the single `DiscoveredRing` construction site on each
+ * platform. That test pins the rule so the guard cannot be dropped as redundant later.
  */
 class OuraNamelessRingDiscoveryTest {
 
@@ -37,6 +42,37 @@ class OuraNamelessRingDiscoveryTest {
         assertEquals(ExperimentalBrand.OURA, ExperimentalBrand.recognise("oura 2h3b2405003655"))
     }
 
+    /**
+     * The label rule itself, pinned against the Swift twin's OWN output.
+     *
+     * Every expected value below is stdout from `ouraAdvertisedLabel` in
+     * `Strand/BLE/OuraLiveSource.swift`, compiled standalone (`swiftc -O twin.swift main.swift`) over this
+     * exact case list and pasted verbatim - not read off the Kotlin implementation, and not eyeballed.
+     * That is what caught the divergence this test exists for: the first draft of the Kotlin helper was
+     * `advertisedName.trim().ifEmpty { fallback }`, which returns the TRIMMED name, while Swift returns
+     * the original. The `" Oura Ring 4 "` case is the one that separates them.
+     *
+     * Whitespace, not emptiness, is the boundary - a ring advertising `" "` used to list as "Oura" here
+     * and blank on Apple. This guards only the ASCII whitespace a BLE local name can realistically carry;
+     * the two stdlib definitions part on exotic Unicode spaces (U+00A0), which is documented at the
+     * helper rather than asserted here.
+     */
+    @Test
+    fun `the label rule matches the Swift twin byte for byte`() {
+        assertEquals("Oura", ouraAdvertisedLabel("", "Oura"))
+        assertEquals("Oura ring", ouraAdvertisedLabel("", "Oura ring"))
+        assertEquals("Oura", ouraAdvertisedLabel(" ", "Oura"))
+        assertEquals("Oura", ouraAdvertisedLabel("   ", "Oura"))
+        assertEquals("Oura", ouraAdvertisedLabel("\t", "Oura"))
+        assertEquals("Oura", ouraAdvertisedLabel("\n", "Oura"))
+        assertEquals("Oura", ouraAdvertisedLabel(" \t\n ", "Oura"))
+        assertEquals("Oura Ring 4", ouraAdvertisedLabel("Oura Ring 4", "Oura"))
+        assertEquals("oura 2h3b2405003655", ouraAdvertisedLabel("oura 2h3b2405003655", "Oura"))
+        assertEquals(" Oura Ring 4 ", ouraAdvertisedLabel(" Oura Ring 4 ", "Oura"))
+        assertEquals("O", ouraAdvertisedLabel("O", "Oura"))
+        assertEquals("Oura ring", ouraAdvertisedLabel("Oura ring", "Oura"))
+    }
+
     @Test
     fun `a nameless ring also has no detectable generation, so the wizard must default`() {
         // `AddDeviceWizard` reads `ring.detectedGen ?: OuraRingGen.GEN3` and labels it "Oura ring";

From 206a6fff9b66eec8531ad8ca73592ec08c2b8621 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 11:07:32 +1200
Subject: [PATCH 156/333] docs(oura): correct the whitespace-divergence note on
 ouraAdvertisedLabel

Both doc blocks claimed the Kotlin and Swift label rules part on U+00A0, citing that
Java's Character.isWhitespace excludes it while Swift's .whitespacesAndNewlines includes
it. The first half is true of Character.isWhitespace in isolation, but ifBlank never
calls it: Kotlin's Char.isWhitespace is

    Character.isWhitespace(c) || Character.isSpaceChar(c)

and isSpaceChar covers exactly the non-breaking spaces (U+00A0, U+2007, U+202F) that
isWhitespace drops. Verified on the JVM. U+00A0 is therefore blank on BOTH sides - the
one case the note picked out is the case they agree on.

The real divergence set is the opposite pair: U+0085, which .whitespacesAndNewlines
includes and Kotlin does not, and U+001C-U+001F, which Kotlin counts and Swift does not.
Neither reaches a BLE local name, so this is a comment correction with no behaviour
change and no test change.

Worth correcting rather than leaving: the parity ledger reads these doc blocks for twin
claims, the wrong claim was duplicated across both files, and it advertised itself as
"stated rather than silently overclaimed".

Follow-up to #1797 by @pipiche38.
---
 Strand/BLE/OuraLiveSource.swift                          | 9 ++++++---
 android/app/src/main/java/com/noop/ble/OuraLiveSource.kt | 9 ++++++---
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/Strand/BLE/OuraLiveSource.swift b/Strand/BLE/OuraLiveSource.swift
index 69345673d7..edefa5dd2d 100644
--- a/Strand/BLE/OuraLiveSource.swift
+++ b/Strand/BLE/OuraLiveSource.swift
@@ -27,9 +27,12 @@ import AppKit
 /// `" "` would have listed blank here and as "Oura" there — the exact silent Swift/Kotlin divergence the
 /// parity contract calls out. Both sides now treat whitespace as absent and return the name UNTRIMMED
 /// when it is present. Pinned by the Kotlin `OuraNamelessRingDiscoveryTest` against this function's own
-/// output. The two agree over ASCII whitespace and ordinary names; they part only on exotic Unicode
-/// spaces (`.whitespacesAndNewlines` includes U+00A0, Java's `Character.isWhitespace` does not), which
-/// no BLE local name carries — stated rather than silently overclaimed.
+/// output. The two agree over ASCII whitespace, ordinary names, and U+00A0. `ifBlank` does NOT test
+/// `Character.isWhitespace`, which would indeed exclude U+00A0; it tests Kotlin's `Char.isWhitespace`,
+/// defined as `Character.isWhitespace(c) || Character.isSpaceChar(c)`, and the second disjunct restores
+/// every non-breaking space the first drops. The pair parts only on U+0085 (blank here, not in Kotlin)
+/// and U+001C–U+001F (blank in Kotlin, not here), which no BLE local name carries — stated rather than
+/// silently overclaimed.
 func ouraAdvertisedLabel(_ advertisedName: String, fallback: String) -> String {
     advertisedName.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty ? fallback : advertisedName
 }
diff --git a/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt b/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt
index 2e941f8937..b68727fb1e 100644
--- a/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt
+++ b/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt
@@ -66,9 +66,12 @@ import java.util.concurrent.ConcurrentHashMap
  * advertising `" "` listed as "Oura" here and blank there - the exact silent Kotlin/Swift divergence the
  * parity contract calls out. Both sides now treat whitespace as absent and return the name UNTRIMMED
  * when it is present, and `OuraNamelessRingDiscoveryTest` pins this function against the Swift twin's
- * own output. The two agree over ASCII whitespace and ordinary names; they part only on exotic Unicode
- * spaces (Java's `Character.isWhitespace` excludes U+00A0, Swift's `.whitespacesAndNewlines` includes
- * it), which no BLE local name carries - stated rather than silently overclaimed.
+ * own output. The two agree over ASCII whitespace, ordinary names, and U+00A0. `ifBlank` does NOT test
+ * `Character.isWhitespace`, which would indeed exclude U+00A0; it tests Kotlin's `Char.isWhitespace`,
+ * defined as `Character.isWhitespace(c) || Character.isSpaceChar(c)`, and the second disjunct restores
+ * every non-breaking space the first drops. The pair parts only on U+0085 (blank on Apple, not here)
+ * and U+001C-U+001F (blank here, not on Apple), which no BLE local name carries - stated rather than
+ * silently overclaimed.
  */
 internal fun ouraAdvertisedLabel(advertisedName: String, fallback: String): String =
     advertisedName.ifBlank { fallback }

From dca0576b84dc8387f2a8541a6711cd8e72c563ef Mon Sep 17 00:00:00 2001
From: Kevin Rajan <7121943+kvnloo@users.noreply.github.com>
Date: Tue, 1 Sep 2026 18:25:08 -0500
Subject: [PATCH 157/333] android: twin standardHRHostReceivedLine and be
 honest about take(200) (#1796)

Apple emits a host-received line on every ingestStandardHR; Android had the flush-attempt,
flush-succeeded and rebuffered twins but not that fourth one, so the two logs could not be
read beside each other from the moment a reading arrives. Adds the Kotlin twin and calls it
from StandardHrSource.enqueue at the same per-reading cadence Apple uses.

The per-sample accept gates match rowsOf and Collector.ingestStandardHR exactly (hr 30..220,
rr 250..3000), and pending counts come from rowsOf(buffer), so the raw Android buffer reports
the same gated contents Apple's already-filtered stdHR/stdRR do. The 30-sample flush trigger
is deliberately left on raw buffer size rather than moved onto accepted rows - Apple trips on
accepted row count and Android on sample count, a real cadence difference, but re-timing
persistence does not belong in a diagnostics change. A test pins the trigger so it cannot
drift.

Also drops an overclaim: liveInsertFailedLine's 200-character bound is not a Unicode-identical
truncation. Kotlin take(200) counts UTF-16 code units, Swift prefix(200) counts grapheme
clusters. They agree on ASCII, which is what store error descriptions are, and the KDoc, the
Swift doc and the test oracle now say exactly that instead of "byte-identical".

Refs #1770 #1767.

Thanks to @kvnloo.
---
 .../StrandAnalytics/LivePersistTrace.swift    | 13 +++---
 .../com/noop/ble/StalledLinkDiagnostics.kt    | 13 ++++++
 .../java/com/noop/ble/StandardHrSource.kt     | 22 ++++++++--
 .../noop/ble/StalledLinkDiagnosticsTest.kt    | 40 +++++++++++++++++++
 4 files changed, 80 insertions(+), 8 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/LivePersistTrace.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/LivePersistTrace.swift
index 1704c067b3..d4e9cc9b38 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/LivePersistTrace.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/LivePersistTrace.swift
@@ -27,11 +27,13 @@ public enum StandardHRLifecycleFlush {
 /// log full of `rr emit … offered=N` and no indication that none of it landed. That is the worst shape a
 /// diagnostic gap can take: the instrumentation that exists reads like success.
 ///
-/// Byte-identical twin of the Kotlin `liveInsertFailedLine` in `com.noop.ble.StalledLinkDiagnostics`, so
-/// an Android and an Apple log of the same failure compare directly. The Kotlin side lives beside its
-/// caller in the BLE package; this one lives here because `Collector` is app-target Swift with no default
-/// CI, and the package is where the other emitted-line builders (`Spo2ReTrace`, `SleepStager+Trace`,
-/// `ConnectionReadout`) already sit and get tested.
+/// Twin of the Kotlin `liveInsertFailedLine` in `com.noop.ble.StalledLinkDiagnostics`, so an Android and
+/// an Apple log of the same failure compare directly. Rendered strings match for ASCII (store errors).
+/// The 200-character bound is not a Unicode-identical truncation: Kotlin `take(200)` counts UTF-16 code
+/// units and Swift `prefix(200)` counts grapheme clusters. Store error descriptions are ASCII, which is
+/// the load-bearing case. The Kotlin side lives beside its caller in the BLE package; this one lives here
+/// because `Collector` is app-target Swift with no default CI, and the package is where the other
+/// emitted-line builders (`Spo2ReTrace`, `SleepStager+Trace`, `ConnectionReadout`) already sit and get tested.
 public enum LivePersistTrace {
 
     public enum StandardHRFlushReason: String {
@@ -103,6 +105,7 @@ public enum LivePersistTrace {
     ) -> String {
         // Bounded like the Kotlin `take(200)`: a full error description can be enormous, and the useful
         // cases (a full disk, a corrupted database, a schema mismatch) are distinguished well inside it.
+        // ASCII-only twin: `take` is UTF-16 code units, `prefix` is grapheme clusters.
         let detail = message.flatMap { m -> String? in
             let trimmed = m.trimmingCharacters(in: .whitespacesAndNewlines)
             return trimmed.isEmpty ? nil : ": " + String(m.prefix(200))
diff --git a/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt b/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
index c1c679e82b..be1e3305da 100644
--- a/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
@@ -130,6 +130,17 @@ internal fun backfillDeferredLine(
  * the store and [standardHrFlushSucceededLine] what the store actually took, because a batch that is
  * offered in full and inserted as zero is precisely the failure that otherwise reads like success.
  */
+internal fun standardHrHostReceivedLine(
+    hostUnixSeconds: Int,
+    acceptedHrRows: Int, acceptedRrRows: Int,
+    rejectedHrRows: Int, rejectedRrRows: Int,
+    pendingHrRows: Int, pendingRrRows: Int,
+): String =
+    "standard-hr transport host-received hostUnixSec=$hostUnixSeconds" +
+        " acceptedHRRows=$acceptedHrRows acceptedRRRows=$acceptedRrRows" +
+        " rejectedHRRows=$rejectedHrRows rejectedRRRows=$rejectedRrRows" +
+        " pendingHRRows=$pendingHrRows pendingRRRows=$pendingRrRows"
+
 internal fun standardHrFlushAttemptLine(
     reason: String,
     offeredHrRows: Int,
@@ -204,6 +215,8 @@ internal fun liveInsertFailedLine(
     rrFrames: Int,
     consecutiveFailures: Int,
 ): String {
+    // Bound is ASCII-only (store errors). Kotlin `take(200)` is UTF-16 code units; Swift `prefix(200)`
+    // is grapheme clusters. They agree on ASCII, which is the load-bearing case — not a Unicode twin.
     val detail = message?.takeIf { it.isNotBlank() }?.let { ": ${it.take(200)}" } ?: ""
     val run = if (consecutiveFailures >= 2) {
         " $consecutiveFailures consecutive failures — these rows are not landing and the re-buffer is" +
diff --git a/android/app/src/main/java/com/noop/ble/StandardHrSource.kt b/android/app/src/main/java/com/noop/ble/StandardHrSource.kt
index e8498242d1..6c3d2abcf3 100644
--- a/android/app/src/main/java/com/noop/ble/StandardHrSource.kt
+++ b/android/app/src/main/java/com/noop/ble/StandardHrSource.kt
@@ -280,13 +280,29 @@ class StandardHrSource(
     private var lastEnqueuedContact: StandardHrContact? = null
 
     private fun enqueue(hr: Int, rr: List<Int>, contact: StandardHrContact) {
-        val shouldFlush = synchronized(bufferLock) {
+        val ts = System.currentTimeMillis() / 1000L
+        val shouldFlush: Boolean
+        val hostLine: String
+        synchronized(bufferLock) {
             val record = StandardHrMapping.shouldRecordContact(lastEnqueuedContact, contact)
             if (record) lastEnqueuedContact = contact
-            buffer.add(Sample(hr, rr, if (record) contact else null, System.currentTimeMillis() / 1000L))
-            buffer.size >= flushCount ||
+            buffer.add(Sample(hr, rr, if (record) contact else null, ts))
+            // Twin of Collector.ingestStandardHR's host-received line. Gates on THIS sample match
+            // rowsOf / Swift ingest; pending is the gated contents of the raw buffer. Cadence still
+            // trips on buffer.size so we do not move the filter (#1770).
+            val acceptedHr = if (hr in 30..220) 1 else 0
+            val acceptedRr = rr.count { it in 250..3000 }
+            val (pendingHr, pendingRr) = rowsOf(buffer)
+            hostLine = standardHrHostReceivedLine(
+                hostUnixSeconds = ts.toInt(),
+                acceptedHrRows = acceptedHr, acceptedRrRows = acceptedRr,
+                rejectedHrRows = 1 - acceptedHr, rejectedRrRows = rr.size - acceptedRr,
+                pendingHrRows = pendingHr.size, pendingRrRows = pendingRr.size,
+            )
+            shouldFlush = buffer.size >= flushCount ||
                 System.currentTimeMillis() - lastFlushMs >= flushIntervalMs
         }
+        log(hostLine)
         if (shouldFlush) flush()
     }
 
diff --git a/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt b/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
index 4fc299f901..c600bb4490 100644
--- a/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
+++ b/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
@@ -183,6 +183,9 @@ class StalledLinkDiagnosticsTest {
      * The two platforms emit this line into logs meant to be read beside each other, and every
      * `contains` check above would still pass with a stray space or a moved clause. This is the
      * assertion that actually holds them together.
+     *
+     * ASCII only: the 200-char bound is Kotlin `take` (UTF-16) vs Swift `prefix` (graphemes). Store
+     * errors are ASCII, which is what this oracle covers. It is not a Unicode truncation twin.
      */
     @Test
     fun `the whole line matches the Swift rendering byte for byte`() {
@@ -342,6 +345,21 @@ class StalledLinkDiagnosticsTest {
      * implementation is self-consistent, and these two lines exist so an Android and an Apple log of the
      * same stall compare directly.
      */
+    @Test
+    fun `host receipt separates accepted and rejected rows`() {
+        assertEquals(
+            "standard-hr transport host-received hostUnixSec=1750000000" +
+                " acceptedHRRows=1 acceptedRRRows=2 rejectedHRRows=0 rejectedRRRows=1" +
+                " pendingHRRows=4 pendingRRRows=5",
+            standardHrHostReceivedLine(
+                hostUnixSeconds = 1_750_000_000,
+                acceptedHrRows = 1, acceptedRrRows = 2,
+                rejectedHrRows = 0, rejectedRrRows = 1,
+                pendingHrRows = 4, pendingRrRows = 5,
+            ),
+        )
+    }
+
     @Test
     fun `flush success separates offered from actually inserted rows`() {
         assertEquals(
@@ -380,4 +398,26 @@ class StalledLinkDiagnosticsTest {
         )
     }
 
+    /**
+     * [standardHrHostReceivedLine] is dead unless enqueue calls it. Apple emits at ingest; Android
+     * buffers raw samples and range-gates at flush, so the line is computed from this sample's gates
+     * plus [rowsOf] pending, WITHOUT moving the 30-sample trigger onto accepted-only rows (#1770).
+     */
+    @Test
+    fun `enqueue emits host-received without moving the flush trigger onto accepted rows`() {
+        var root = java.io.File(System.getProperty("user.dir") ?: ".").canonicalFile
+        val src = run {
+            repeat(4) {
+                val f = java.io.File(root, "android/app/src/main/java/com/noop/ble/StandardHrSource.kt")
+                if (f.isFile) return@run f.readText()
+                root = root.parentFile ?: root
+            }
+            error("StandardHrSource.kt not found — this test must not pass by default")
+        }
+        val enqueue = src.substringAfter("private fun enqueue(").substringBefore("private fun rowsOf(")
+        assertTrue("enqueue must emit the host-received twin", enqueue.contains("standardHrHostReceivedLine("))
+        assertTrue("pending counts must use the gated rowsOf helper", enqueue.contains("rowsOf(buffer)"))
+        assertTrue("cadence must stay on raw buffer size", enqueue.contains("buffer.size >= flushCount"))
+    }
+
 }

From 9e5afbfbd460997423302eec2a7b9fa2ba6c1213 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 11:25:58 +1200
Subject: [PATCH 158/333] docs(ble): give standardHrFlushAttemptLine its doc
 back

#1796 added standardHrHostReceivedLine between the standard-HR family header and
standardHrFlushAttemptLine, so the header attached to the new function and flush-attempt
was left with a blank line above it - the only member of the family without a doc, while
its sibling standardHrFlushSucceededLine still carried one. The header also read wrong in
that position: it names flush-attempt and flush-succeeded as "the pair that matters" while
sitting on neither.

Restores a one-line doc to flush-attempt in the same shape flush-succeeded already uses,
and adds a paragraph to the header naming the declaration it now documents, including why
host-received is emitted per reading on both platforms rather than at a flush boundary.

The header stays first rather than moving below the new declaration: it is a family header,
and a member above it would read worse than the problem being fixed.

doc_comment_lint passes either way - it checks that declarations have docs, not that the
right doc is attached, so this shape is invisible to CI.

Follow-up to #1796 by @kvnloo.
---
 .../app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt b/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
index be1e3305da..8845afd042 100644
--- a/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
@@ -129,6 +129,10 @@ internal fun backfillDeferredLine(
  * The pair that matters is offered vs inserted. [standardHrFlushAttemptLine] reports what was handed to
  * the store and [standardHrFlushSucceededLine] what the store actually took, because a batch that is
  * offered in full and inserted as zero is precisely the failure that otherwise reads like success.
+ *
+ * [standardHrHostReceivedLine], which this block documents, is the earliest of them. Apple emits it
+ * from `Collector.ingestStandardHR` for every reading, so Android emits it from
+ * `StandardHrSource.enqueue` at the same per-reading cadence rather than only at a flush boundary.
  */
 internal fun standardHrHostReceivedLine(
     hostUnixSeconds: Int,
@@ -141,6 +145,7 @@ internal fun standardHrHostReceivedLine(
         " rejectedHRRows=$rejectedHrRows rejectedRRRows=$rejectedRrRows" +
         " pendingHRRows=$pendingHrRows pendingRRRows=$pendingRrRows"
 
+/** Twin of Swift `LivePersistTrace.standardHRFlushAttemptLine`. */
 internal fun standardHrFlushAttemptLine(
     reason: String,
     offeredHrRows: Int,

From 208c44229e37104a378b3f7e3f8788e57f91b253 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 15:10:49 +1200
Subject: [PATCH 159/333] widgets: give the home-screen vitals footer the app's
 own HR/HRV icons (#1798)

The footer under the score rings paired heart rate with waveform.path.ecg and HRV with
heart.fill - the inverse of the pairing every other surface uses. TodayView renders the two as
adjacent rows the other way round, and DashboardCards, TodayCustomizationMetadata, MetricCatalog
and this extension's own Live Activity all agree with TodayView. The footer had been the lone
outlier since #1022. It matters more than a mismatched glyph usually would, because the footer
shows no text labels at all: the icon is the only thing naming each number.

The inversion was an understandable one, and the doc comment now names it so it does not get
"corrected" back. waveform.path.ecg IS the right symbol for Live HR as a feature - RootView,
RootTabView and HomeScreenQuickActions all use it for the Live screen. As a metric icon it is
HRV's, and this footer is the one place that draws both metrics side by side.

Also closes the accessibility gap in the same views. The footer vitals and the large-grid stat
cells were bare numbers with no unit and no metric name, so VoiceOver read "58", "64",
"84 percent", and "64" / "ms" / "HRV" as separate fragments in value-before-label order with the
units spelled out letter by letter. All four labelled graphics in the file now share one shape:
accessibilityElement(children: .ignore), then label, then value. Spoken text is carried
separately from rendered text so the unit reaches a reader who cannot see the glyph, and it falls
back to the rendered value rather than to "No data" so an omission degrades instead of lying.

Literals stay plain rather than String(localized:), for the reason already documented on
accessoryScore: this extension does not carry the app's string catalog.

Verified with an app-build dispatch on the merge result - Strand (macOS, x86_64+arm64) and
NOOPiOS (iOS Simulator) both compile. StrandiOSWidgets is app-target Swift that no default CI
builds, so no green check on the PR itself covered that.

Reported in #1795 by @Sneheth.
---
 StrandiOSWidgets/NOOPWidget.swift | 69 +++++++++++++++++++++++++++----
 1 file changed, 61 insertions(+), 8 deletions(-)

diff --git a/StrandiOSWidgets/NOOPWidget.swift b/StrandiOSWidgets/NOOPWidget.swift
index 50907d89ef..d149ba447f 100644
--- a/StrandiOSWidgets/NOOPWidget.swift
+++ b/StrandiOSWidgets/NOOPWidget.swift
@@ -209,10 +209,18 @@ struct NOOPWidgetView: View {
             scoreRings(diameter: 88, lineWidth: 8, labelFont: .caption)
             Divider()
             HStack(alignment: .top, spacing: 0) {
-                statCell("HRV", value: snap.hrv.map { "\($0)" }, unit: "ms")
-                statCell("Rest HR", value: snap.restingHr.map { "\($0)" }, unit: "bpm")
-                statCell("HR", value: snap.bpm.map { "\($0)" }, unit: "bpm")
-                statCell("Battery", value: snap.batteryPct.map { "\($0)%" })
+                statCell("HRV", value: snap.hrv.map { "\($0)" }, unit: "ms",
+                         name: "Heart rate variability",
+                         spoken: snap.hrv.map { "\($0) milliseconds" })
+                statCell("Rest HR", value: snap.restingHr.map { "\($0)" }, unit: "bpm",
+                         name: "Resting heart rate",
+                         spoken: snap.restingHr.map { "\($0) beats per minute" })
+                statCell("HR", value: snap.bpm.map { "\($0)" }, unit: "bpm",
+                         name: "Heart rate",
+                         spoken: snap.bpm.map { "\($0) beats per minute" })
+                statCell("Battery", value: snap.batteryPct.map { "\($0)%" },
+                         name: "Strap battery",
+                         spoken: snap.batteryPct.map { "\($0) percent" })
             }
             Spacer(minLength: 0)
         }
@@ -273,24 +281,66 @@ struct NOOPWidgetView: View {
         .frame(maxWidth: .infinity)
     }
 
+    /// Home-Screen footer: heart rate, HRV, strap battery, under the score rings.
+    ///
+    /// `heart.fill` is HR and `waveform.path.ecg` is HRV, which is the metric pairing the rest of the app
+    /// uses — `TodayView` renders them as adjacent rows that way, and `DashboardCards`,
+    /// `TodayCustomizationMetadata`, `MetricCatalog` and this extension's own Live Activity all agree.
+    /// The two were inverted here from #1022 until #1795 reported it.
+    ///
+    /// The inversion was an easy one to make and is worth naming so it is not "corrected" back:
+    /// `waveform.path.ecg` IS the right symbol for Live HR as a FEATURE — `RootView`, `RootTabView` and
+    /// `HomeScreenQuickActions` all use it for the Live screen. As a METRIC icon it belongs to HRV, and
+    /// this footer is the one place that renders both metrics side by side, where the collision is the
+    /// entire problem: nothing here carries a text label, so the glyph is the only thing naming a number.
     private func vitalsFooter(compact: Bool) -> some View {
         HStack {
-            Label(snap.bpm.map(String.init) ?? "–", systemImage: "waveform.path.ecg")
+            vital(symbol: "heart.fill", text: snap.bpm.map(String.init),
+                  name: "Heart rate", spoken: snap.bpm.map { "\($0) beats per minute" })
             Spacer()
             if !compact, let hrv = snap.hrv {
-                Label("\(hrv)", systemImage: "heart.fill")
+                vital(symbol: "waveform.path.ecg", text: "\(hrv)",
+                      name: "Heart rate variability", spoken: "\(hrv) milliseconds")
                 Spacer()
             }
-            Label(snap.batteryPct.map { "\($0)%" } ?? "–", systemImage: "battery.50")
+            vital(symbol: "battery.50", text: snap.batteryPct.map { "\($0)%" },
+                  name: "Strap battery", spoken: snap.batteryPct.map { "\($0) percent" })
         }
         .font(.caption2)
         .foregroundStyle(StrandPalette.textSecondary)
         .labelStyle(.titleAndIcon)
     }
 
+    /// One footer vital. `spoken` is carried separately from the rendered `text` because VoiceOver gets
+    /// neither of the two things a sighted reader uses here: the glyph that names the metric, and the
+    /// unit, which the footer shows for none of them. Without this a reader hears "58", "64", "84 percent"
+    /// — three anonymous numbers. Same reasoning as `accessoryScore`, which #1715 fixed for the lock
+    /// screen; this footer predates it.
+    ///
+    /// Plain literals rather than `String(localized:)`, for the reason spelled out on `accessoryScore`:
+    /// this extension does not carry the app's string catalog, so `String(localized:)` would look
+    /// localized and render English anyway.
+    private func vital(symbol: String, text: String?, name: String, spoken: String?) -> some View {
+        Label(text ?? "–", systemImage: symbol)
+            // Collapse first, like `accessoryScore` and `WidgetScoreRing` already do. A `Label` under
+            // `.titleAndIcon` renders an image beside a text, so without this the bare number stays its
+            // own element and whether the label below wins is SwiftUI container semantics rather than
+            // something this file decides. Every other labelled graphic here ignores its children.
+            .accessibilityElement(children: .ignore)
+            .accessibilityLabel(Text(name))
+            .accessibilityValue(Text(spoken ?? "No data"))
+    }
+
     /// One labelled stat in the large grid — value over a caption, equal-width so the columns align.
+    ///
+    /// `name` and `spoken` exist because the on-screen caption is abbreviated for width and the unit is a
+    /// separate view: read as-is, VoiceOver produces "64", "ms", "HRV" — three fragments, value before
+    /// label, with "ms" and "bpm" spelled out letter by letter. Collapsing to one element lets the cell
+    /// speak "Heart rate variability, 64 milliseconds". `spoken` falls back to the rendered value rather
+    /// than to "No data", so a caller that omits it degrades to the old reading instead of lying.
     private func statCell(_ label: String, value: String?, unit: String? = nil,
-                          tint: Color = StrandPalette.textPrimary) -> some View {
+                          tint: Color = StrandPalette.textPrimary,
+                          name: String? = nil, spoken: String? = nil) -> some View {
         VStack(alignment: .leading, spacing: 2) {
             HStack(alignment: .firstTextBaseline, spacing: 2) {
                 Text(value ?? "–")
@@ -303,6 +353,9 @@ struct NOOPWidgetView: View {
             Text(label).font(.caption2).foregroundStyle(StrandPalette.textTertiary)
         }
         .frame(maxWidth: .infinity, alignment: .leading)
+        .accessibilityElement(children: .ignore)
+        .accessibilityLabel(Text(name ?? label))
+        .accessibilityValue(Text(spoken ?? value ?? "No data"))
     }
 }
 

From b9b04c814dab91c18f761965eeff59b468ab1e36 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 18:07:41 +1200
Subject: [PATCH 160/333] widget: let the home-screen HR and battery line say
 what it is (#1800)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both Glance widgets drew live HR and strap battery as "♥ 58" and "⚡ 84%". The glyphs are characters
inside the text, not labelled images, and neither file set any semantics, so TalkBack read whatever
the glyph happens to be called - or skipped it - and both metrics arrived as bare numbers with no
name and no unit.

Adds GlanceModifier.semantics { contentDescription } to both widgets, giving "Heart rate 58 bpm"
and "Strap battery 84%". No visual change: swapping the glyphs for drawables would match the
compact widget's battery treatment more closely, but that is a consistency refactor and this is an
accessibility fix.

The compact widget turned out not to be the accessible counterexample it looked like. Only its
battery Image ever carried a contentDescription; its heart-rate line is the same unlabelled text as
the standard widget's, so both are fixed here rather than one.

A stale heart rate is drawn ONLY by dimming the text - a colour-only channel - so a first pass that
said "Heart rate 58 bpm" either way was worse than the bare "♥ 58" it replaced: it actively
asserted a carried-over value was current. Marked on the LIVE side instead, so a stale reading
carries no claim rather than needing a word for it.

Every string is copied from an existing vetted catalogue entry; none is invented. The three new
keys use the repo's sha1(text)[:8] suffix, so identical English text yields the identical suffix
and the translations come verbatim from the entries already carrying that text. The value formats
and the "live" qualifier reuse existing bare strings, which is why seven locales needed no new
translation.

Verified: compileFullDebugKotlin, com.noop.widget unit tests, i18n_audit --ci, doc_comment_lint,
and lintVitalFullRelease -PstagingRelease (the ExtraTranslation gate a compile and the audit both
miss after a strings.xml change). Not TalkBack-tested - nothing here can verify an announcement
without a device.

Refs #1799.
---
 .../noop/widget/NoopCompactGlanceWidget.kt    | 14 +++++++++
 .../java/com/noop/widget/NoopGlanceWidget.kt  | 30 +++++++++++++++++++
 .../app/src/main/res/values-de/strings.xml    |  3 ++
 .../app/src/main/res/values-es/strings.xml    |  3 ++
 .../app/src/main/res/values-fr/strings.xml    |  3 ++
 .../app/src/main/res/values-pl/strings.xml    |  3 ++
 .../src/main/res/values-pt-rPT/strings.xml    |  3 ++
 .../app/src/main/res/values-zh/strings.xml    |  3 ++
 android/app/src/main/res/values/strings.xml   |  3 ++
 9 files changed, 65 insertions(+)

diff --git a/android/app/src/main/java/com/noop/widget/NoopCompactGlanceWidget.kt b/android/app/src/main/java/com/noop/widget/NoopCompactGlanceWidget.kt
index 77334a12d0..a7325e89c2 100644
--- a/android/app/src/main/java/com/noop/widget/NoopCompactGlanceWidget.kt
+++ b/android/app/src/main/java/com/noop/widget/NoopCompactGlanceWidget.kt
@@ -27,6 +27,8 @@ import androidx.glance.layout.fillMaxWidth
 import androidx.glance.layout.height
 import androidx.glance.layout.padding
 import androidx.glance.layout.width
+import androidx.glance.semantics.contentDescription
+import androidx.glance.semantics.semantics
 import androidx.glance.text.FontWeight
 import androidx.glance.text.Text
 import androidx.glance.text.TextStyle
@@ -128,11 +130,23 @@ private fun CompactWidgetContent(snap: WidgetSnapshot, dark: Boolean) {
             )
         }
         Spacer(modifier = GlanceModifier.height(6.dp))
+        // Same glyph-in-the-text problem as the standard widget: TalkBack gets a bare number with no
+        // name and no unit. The battery Image below has carried a contentDescription all along; this
+        // line never did. (#1799)
+        val hrLabel = uiString(R.string.l10n_noop_compact_glance_widget_heart_rate_410aa15c)
+        // Live-marked, not stale-marked, for the reason spelled out on the standard widget: the dimming
+        // below is colour-only, and "live" already exists in every locale so this needs no new copy.
+        val liveSuffix =
+            if (snap.heartRateStale) "" else " " + uiString(R.string.l10n_today_screen_sync_chip_live_98aadb37)
+        val hrDescription = snap.heartRate
+            ?.let { "$hrLabel ${uiString(R.string.l10n_today_screen_value_bpm_8f3a90c3, it)}$liveSuffix" }
+            ?: hrLabel
         Row(verticalAlignment = Alignment.CenterVertically) {
             Text(
                 text = snap.heartRate?.let { "♥ $it" } ?: "♥ - ",
                 // Dim a carried-over reading so a stale HR can't masquerade as a live one.
                 style = TextStyle(color = if (snap.heartRateStale) textSecondary else textPrimary, fontSize = 13.sp),
+                modifier = GlanceModifier.semantics { contentDescription = hrDescription },
             )
             Spacer(modifier = GlanceModifier.width(10.dp))
             Image(
diff --git a/android/app/src/main/java/com/noop/widget/NoopGlanceWidget.kt b/android/app/src/main/java/com/noop/widget/NoopGlanceWidget.kt
index 684022e940..36443e5117 100644
--- a/android/app/src/main/java/com/noop/widget/NoopGlanceWidget.kt
+++ b/android/app/src/main/java/com/noop/widget/NoopGlanceWidget.kt
@@ -24,6 +24,8 @@ import androidx.glance.layout.fillMaxWidth
 import androidx.glance.layout.height
 import androidx.glance.layout.padding
 import androidx.glance.layout.width
+import androidx.glance.semantics.contentDescription
+import androidx.glance.semantics.semantics
 import androidx.glance.text.FontWeight
 import androidx.glance.text.Text
 import androidx.glance.text.TextStyle
@@ -150,16 +152,44 @@ private fun WidgetContent(snap: WidgetSnapshot, dark: Boolean) {
             )
         }
         Spacer(modifier = GlanceModifier.height(8.dp))
+        // The ♥ and ⚡ are characters inside the text, not labelled images, so TalkBack reads whatever
+        // the glyph happens to be called - or skips it - and the metric arrives as a bare number with no
+        // name and no unit. The compact widget is not the accessible counterexample it looks like: only
+        // its battery IMAGE ever carried a contentDescription, and its heart-rate line is the same
+        // unlabelled text as this one, fixed alongside it here. (#1799)
+        //
+        // Built here rather than inside the semantics lambda. uiString would resolve there too - it is a
+        // plain function over the Application resources, not a composable - but #571 recorded that the
+        // i18n audit cannot see copy assigned inside a semantics {} lambda, so a literal written there
+        // would pass CI and ship English to every locale. Keeping the lookup outside puts it where the
+        // audit can see it.
+        val hrLabel = uiString(R.string.l10n_noop_glance_widget_heart_rate_410aa15c)
+        val batteryLabel = uiString(R.string.l10n_noop_glance_widget_strap_battery_a6c7f09c)
+        // The stale/live distinction is drawn ONLY by dimming the text below, which is a colour-only
+        // channel: TalkBack, and anyone who cannot perceive the dim, was told a carried-over reading was
+        // current. Marked on the LIVE side rather than the stale one, so a stale value simply carries no
+        // claim instead of needing a word for it - and because "live" already exists in all seven
+        // locales as the Today sync chip, so this adds no new copy to translate.
+        val liveSuffix =
+            if (snap.heartRateStale) "" else " " + uiString(R.string.l10n_today_screen_sync_chip_live_98aadb37)
+        val hrDescription = snap.heartRate
+            ?.let { "$hrLabel ${uiString(R.string.l10n_today_screen_value_bpm_8f3a90c3, it)}$liveSuffix" }
+            ?: hrLabel
+        val batteryDescription = snap.batteryPct
+            ?.let { "$batteryLabel ${uiString(R.string.l10n_today_screen_pct_ee63e247, it)}" }
+            ?: batteryLabel
         Row(verticalAlignment = Alignment.CenterVertically) {
             Text(
                 text = snap.heartRate?.let { "♥ $it" } ?: "♥ - ",
                 // Dim a carried-over reading so a stale HR can't masquerade as a live one.
                 style = TextStyle(color = if (snap.heartRateStale) textSecondary else textPrimary, fontSize = 13.sp),
+                modifier = GlanceModifier.semantics { contentDescription = hrDescription },
             )
             Spacer(modifier = GlanceModifier.width(10.dp))
             Text(
                 text = snap.batteryPct?.let { "⚡ $it%" } ?: "⚡ - ",
                 style = TextStyle(color = textPrimary, fontSize = 13.sp),
+                modifier = GlanceModifier.semantics { contentDescription = batteryDescription },
             )
         }
         Spacer(modifier = GlanceModifier.height(2.dp))
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index eb200800d6..3a210bcc52 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -708,11 +708,14 @@
     <string name="l10n_mind_section_reading_your_check_ins_71a100a9">Lesen Sie Ihre Check-ins...</string>
     <string name="l10n_noop_compact_glance_widget_charge_49a8cb83">GEBÜHR</string>
     <string name="l10n_noop_compact_glance_widget_effort_660752e7">ANSTRENGUNG</string>
+    <string name="l10n_noop_compact_glance_widget_heart_rate_410aa15c">Herzfrequenz</string>
     <string name="l10n_noop_compact_glance_widget_rest_cbaaa181">RUHE</string>
     <string name="l10n_noop_compact_glance_widget_strap_battery_a6c7f09c">Strap-Akku</string>
     <string name="l10n_noop_glance_widget_charge_49a8cb83">GEBÜHR</string>
     <string name="l10n_noop_glance_widget_effort_660752e7">ANSTRENGUNG</string>
+    <string name="l10n_noop_glance_widget_heart_rate_410aa15c">Herzfrequenz</string>
     <string name="l10n_noop_glance_widget_rest_cbaaa181">RUHE</string>
+    <string name="l10n_noop_glance_widget_strap_battery_a6c7f09c">Strap-Akku</string>
     <string name="l10n_notifications_settings_screen_02d_02d_ce23a78c">%1$02d:%2$02d</string>
     <string name="l10n_notifications_settings_screen_all_other_apps_51a8af2c">Alle anderen Apps</string>
     <string name="l10n_notifications_settings_screen_app_name_wrist_alerts_dd3540fa">%1$s-Handgelenkwarnungen</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index deeb1a15b2..a361eeda2d 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -508,11 +508,14 @@
     <string name="l10n_mind_section_reading_your_check_ins_71a100a9">Leyendo tus cheques...</string>
     <string name="l10n_noop_compact_glance_widget_charge_49a8cb83">CHARGE</string>
     <string name="l10n_noop_compact_glance_widget_effort_660752e7">ESFUERZO</string>
+    <string name="l10n_noop_compact_glance_widget_heart_rate_410aa15c">Frecuencia cardíaca</string>
     <string name="l10n_noop_compact_glance_widget_rest_cbaaa181">DESCANSO</string>
     <string name="l10n_noop_compact_glance_widget_strap_battery_a6c7f09c">Batería de la pulsera</string>
     <string name="l10n_noop_glance_widget_charge_49a8cb83">CHARGE</string>
     <string name="l10n_noop_glance_widget_effort_660752e7">ESFUERZO</string>
+    <string name="l10n_noop_glance_widget_heart_rate_410aa15c">Frecuencia cardíaca</string>
     <string name="l10n_noop_glance_widget_rest_cbaaa181">DESCANSO</string>
+    <string name="l10n_noop_glance_widget_strap_battery_a6c7f09c">Batería de la pulsera</string>
     <string name="l10n_notifications_settings_screen_02d_02d_ce23a78c">%1$02d:%2$02d</string>
     <string name="l10n_notifications_settings_screen_all_other_apps_51a8af2c">Todas las demás aplicaciones</string>
     <string name="l10n_notifications_settings_screen_app_name_wrist_alerts_dd3540fa">Alertas de muñeca %1$s</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index b534e5c189..bb308f9242 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -526,11 +526,14 @@
     <string name="l10n_mind_section_reading_your_check_ins_71a100a9">Lire vos check-ins...</string>
     <string name="l10n_noop_compact_glance_widget_charge_49a8cb83">CHARGE</string>
     <string name="l10n_noop_compact_glance_widget_effort_660752e7">EFFORT</string>
+    <string name="l10n_noop_compact_glance_widget_heart_rate_410aa15c">Fréquence cardiaque</string>
     <string name="l10n_noop_compact_glance_widget_rest_cbaaa181">REPOS</string>
     <string name="l10n_noop_compact_glance_widget_strap_battery_a6c7f09c">Batterie du bracelet</string>
     <string name="l10n_noop_glance_widget_charge_49a8cb83">CHARGE</string>
     <string name="l10n_noop_glance_widget_effort_660752e7">EFFORT</string>
+    <string name="l10n_noop_glance_widget_heart_rate_410aa15c">Fréquence cardiaque</string>
     <string name="l10n_noop_glance_widget_rest_cbaaa181">REPOS</string>
+    <string name="l10n_noop_glance_widget_strap_battery_a6c7f09c">Batterie du bracelet</string>
     <string name="l10n_notifications_settings_screen_02d_02d_ce23a78c">%1$02d:%2$02d</string>
     <string name="l10n_notifications_settings_screen_all_other_apps_51a8af2c">Toutes les autres applications</string>
     <string name="l10n_notifications_settings_screen_app_name_wrist_alerts_dd3540fa">Alertes aux poignets %1$s</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 09d5d0551c..ba12d8a016 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -665,11 +665,14 @@
     <string name="l10n_mind_section_reading_your_check_ins_71a100a9">Czytanie Twoich meldowań…</string>
     <string name="l10n_noop_compact_glance_widget_charge_49a8cb83">OPŁATA</string>
     <string name="l10n_noop_compact_glance_widget_effort_660752e7">WYSIŁEK</string>
+    <string name="l10n_noop_compact_glance_widget_heart_rate_410aa15c">Tętno</string>
     <string name="l10n_noop_compact_glance_widget_rest_cbaaa181">ODPOCZYNEK</string>
     <string name="l10n_noop_compact_glance_widget_strap_battery_a6c7f09c">Bateria na pasek</string>
     <string name="l10n_noop_glance_widget_charge_49a8cb83">OPŁATA</string>
     <string name="l10n_noop_glance_widget_effort_660752e7">WYSIŁEK</string>
+    <string name="l10n_noop_glance_widget_heart_rate_410aa15c">Tętno</string>
     <string name="l10n_noop_glance_widget_rest_cbaaa181">ODPOCZYNEK</string>
+    <string name="l10n_noop_glance_widget_strap_battery_a6c7f09c">Bateria na pasek</string>
     <string name="l10n_notifications_settings_screen_02d_02d_ce23a78c">%1$02d:%2$02d</string>
     <string name="l10n_notifications_settings_screen_all_other_apps_51a8af2c">Wszystkie inne aplikacje</string>
     <string name="l10n_notifications_settings_screen_app_name_wrist_alerts_dd3540fa">Alerty na nadgarstku %1$s</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 56ca2bcde3..14e60e3807 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -673,11 +673,14 @@
     <string name="l10n_mind_section_reading_your_check_ins_71a100a9">A ler os teus check-ins…</string>
     <string name="l10n_noop_compact_glance_widget_charge_49a8cb83">COBRAR</string>
     <string name="l10n_noop_compact_glance_widget_effort_660752e7">EFFORT</string>
+    <string name="l10n_noop_compact_glance_widget_heart_rate_410aa15c">Frequência cardíaca</string>
     <string name="l10n_noop_compact_glance_widget_rest_cbaaa181">DESCANSO</string>
     <string name="l10n_noop_compact_glance_widget_strap_battery_a6c7f09c">Bateria de pega</string>
     <string name="l10n_noop_glance_widget_charge_49a8cb83">COBRAR</string>
     <string name="l10n_noop_glance_widget_effort_660752e7">EFFORT</string>
+    <string name="l10n_noop_glance_widget_heart_rate_410aa15c">Frequência cardíaca</string>
     <string name="l10n_noop_glance_widget_rest_cbaaa181">DESCANSO</string>
+    <string name="l10n_noop_glance_widget_strap_battery_a6c7f09c">Bateria de pega</string>
     <string name="l10n_notifications_settings_screen_02d_02d_ce23a78c">%1$02d:%2$02d</string>
     <string name="l10n_notifications_settings_screen_all_other_apps_51a8af2c">Todos os outros aplicativos</string>
     <string name="l10n_notifications_settings_screen_app_name_wrist_alerts_dd3540fa">%1$s alertas de pulso</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 2049989e1b..ea3bd99148 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -656,11 +656,14 @@
     <string name="l10n_mind_section_reading_your_check_ins_71a100a9">正在读取您的打卡记录…</string>
     <string name="l10n_noop_compact_glance_widget_charge_49a8cb83">充能</string>
     <string name="l10n_noop_compact_glance_widget_effort_660752e7">负荷</string>
+    <string name="l10n_noop_compact_glance_widget_heart_rate_410aa15c">心率</string>
     <string name="l10n_noop_compact_glance_widget_rest_cbaaa181">恢复</string>
     <string name="l10n_noop_compact_glance_widget_strap_battery_a6c7f09c">手环电量</string>
     <string name="l10n_noop_glance_widget_charge_49a8cb83">充能</string>
     <string name="l10n_noop_glance_widget_effort_660752e7">负荷</string>
+    <string name="l10n_noop_glance_widget_heart_rate_410aa15c">心率</string>
     <string name="l10n_noop_glance_widget_rest_cbaaa181">恢复</string>
+    <string name="l10n_noop_glance_widget_strap_battery_a6c7f09c">手环电量</string>
     <string name="l10n_notifications_settings_screen_02d_02d_ce23a78c">%1$02d:%2$02d</string>
     <string name="l10n_notifications_settings_screen_all_other_apps_51a8af2c">所有其他 App</string>
     <string name="l10n_notifications_settings_screen_app_name_wrist_alerts_dd3540fa">%1$s 手腕震动提醒</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 1f804c5765..c38d6affbe 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -793,11 +793,14 @@
     <string name="l10n_mind_section_reading_your_check_ins_71a100a9">Reading your check-ins…</string>
     <string name="l10n_noop_compact_glance_widget_charge_49a8cb83">CHARGE</string>
     <string name="l10n_noop_compact_glance_widget_effort_660752e7">EFFORT</string>
+    <string name="l10n_noop_compact_glance_widget_heart_rate_410aa15c">Heart rate</string>
     <string name="l10n_noop_compact_glance_widget_rest_cbaaa181">REST</string>
     <string name="l10n_noop_compact_glance_widget_strap_battery_a6c7f09c">Strap battery</string>
     <string name="l10n_noop_glance_widget_charge_49a8cb83">CHARGE</string>
     <string name="l10n_noop_glance_widget_effort_660752e7">EFFORT</string>
+    <string name="l10n_noop_glance_widget_heart_rate_410aa15c">Heart rate</string>
     <string name="l10n_noop_glance_widget_rest_cbaaa181">REST</string>
+    <string name="l10n_noop_glance_widget_strap_battery_a6c7f09c">Strap battery</string>
     <string name="l10n_notifications_settings_screen_02d_02d_ce23a78c">%1$02d:%2$02d</string>
     <string name="l10n_notifications_settings_screen_all_other_apps_51a8af2c">All other apps</string>
     <string name="l10n_notifications_settings_screen_app_name_wrist_alerts_dd3540fa">%1$s wrist alerts</string>

From d2f2c96c7fa040a78d5303730062f1c94db2a0f7 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 19:09:14 +1200
Subject: [PATCH 161/333] sleep: add an HR-only Stage-0 spine for straps that
 bank no motion (#1805)

Stage 0 is a gravity-stillness spine (Cole-Kripke) that heart rate only CONFIRMS, through
hrSleepBandAcross and confirmSleepWithHR. A WHOOP 5/MG that cannot bond never banks motion at all -
SET_CLOCK rides a handshake it never completes - so gravity is empty, there is no spine, and
IntelligenceEngine states the consequence itself: no quantity of HR can stage a night. A field
report on 11.0.0-staging shows ~153k HR rows for a day whose night is plainly visible as a
00:00-07:00 shelf, scored NO-NIGHT reason=no-motion.

hrOnlySleepRuns builds that spine from the one signal such a strap does provide: per-epoch MEDIAN
bpm against baseline * hrSleepBandMult, reusing the rule the confirm path already trusts rather than
introducing a second definition of "in the sleep band". Run construction follows buildRuns, so the
two spines segment alike once flags exist and only the flag SOURCE differs.

One branch is deliberately absent: buildRuns can forgive a gap when hrSleepBandAcross vouches that
HR stayed in band across it, rescuing a night whose GRAVITY dropped out. Here the gap IS in the
heart rate, so there is nothing left to vouch with. A long HR dropout therefore breaks an HR-only
run where it would not break a motion-backed one, and the doc says so.

Two axes, for a reason review found the hard way: a gap and a run's START read epoch starts, while a
run's END is the last SAMPLE seen in its final epoch. Reading the epoch start there - as the first
draft did - reported every run one whole epoch short of the data it covered, silently, and that
understatement would have been weighed against the caller's minimum-duration gate.

PURE AND UNWIRED. No caller, so no behaviour changes on either platform. A night still needs the
detect path to use this when gravity is absent, and DetectedSleep carries no confidence concept
which display-only status needs. Both are follow-ups, kept separate so the algorithm could be
reviewed on its own.

Kotlin expectations are the Swift twin's own stdout from a standalone harness, not a reading of the
Kotlin; the harness exists because the package test binary cannot link GRDB's sqlite3 on Linux. CI
has now run the XCTest twin for real - test (StrandAnalytics) success - which confirms the harness.
8 Kotlin tests, 0 failures.

Refs #1801.
---
 .../Sources/StrandAnalytics/SleepStager.swift |  72 +++++++++++
 .../SleepStagerHrOnlySpineTests.swift         |  81 ++++++++++++
 .../java/com/noop/analytics/SleepStager.kt    |  81 ++++++++++++
 .../analytics/SleepStagerHrOnlySpineTest.kt   | 115 ++++++++++++++++++
 4 files changed, 349 insertions(+)
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerHrOnlySpineTests.swift
 create mode 100644 android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySpineTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
index 4a30728dcb..8a5b5b237a 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
@@ -472,6 +472,78 @@ public enum SleepStager {
         return periods
     }
 
+    /// Epoch for the HR-only spine, in seconds.
+    public static let hrOnlyEpochS: Int = 60
+
+    /// Sleep/active runs built from HEART RATE ALONE, for a strap that streams HR but banks no motion.
+    ///
+    /// Stage 0 is normally a gravity-stillness spine (Cole-Kripke) that HR only CONFIRMS, via
+    /// `hrSleepBandAcross` and `confirmSleepWithHR`. A WHOOP 5/MG that cannot bond never banks motion at
+    /// all — `SET_CLOCK` rides a handshake it never completes — so `grav` is empty, there is no spine, and
+    /// no quantity of HR can stage the night (#1801). This builds the spine from the one signal such a
+    /// strap does provide.
+    ///
+    /// Deliberately the SAME rule the confirm path already trusts: per-epoch MEDIAN bpm against
+    /// `baseline * hrSleepBandMult`, median for the reason `hrSleepBandAcross` spells out. The run
+    /// construction follows `buildRuns` — close on a class change or a gap over `maxGapMin` — so the two
+    /// spines segment alike once flags exist, and only the flag SOURCE differs.
+    ///
+    /// With ONE branch deliberately absent, and it is not an oversight. `buildRuns` can forgive a gap when
+    /// `hrSleepBandAcross` vouches that HR stayed in band across it, which rescues a night whose GRAVITY
+    /// dropped out. Here the gap IS in the heart rate, so there is nothing left to vouch with and no
+    /// analogue to port. A long HR dropout therefore breaks an HR-only run where it would not break a
+    /// motion-backed one, and a night fragmented that way is dropped by the caller's minimum-duration
+    /// gate rather than bridged.
+    ///
+    /// WEAKER THAN THE MOTION SPINE, by construction rather than by tuning. The file already notes that a
+    /// long still daytime stretch is gravity-indistinguishable from a nap and that HR is what saves it;
+    /// with motion gone the inverse is exposed, and a quiet evening at rest can sit in the sleep band. A
+    /// caller must treat these runs as lower-confidence than a motion-backed night and must not let one
+    /// reach a baseline it cannot be unwound from.
+    ///
+    /// Bucket order does not depend on sort stability: samples are grouped by epoch and reduced with a
+    /// median, so their order within an epoch cannot change the result.
+    static func hrOnlySleepRuns(_ hr: [HRSample], baseline: Double?,
+                                epochS: Int = hrOnlyEpochS,
+                                maxGapMinutes: Int = maxGapMin) -> [Period] {
+        guard let baseline = baseline, baseline > 0 else { return [] }
+        if hr.isEmpty || epochS <= 0 { return [] }
+        var byEpoch: [Int: [Double]] = [:]
+        var lastTs: [Int: Int] = [:]
+        for s in hr {
+            let k = s.ts / epochS
+            byEpoch[k, default: []].append(Double(s.bpm))
+            lastTs[k] = max(lastTs[k] ?? Int.min, s.ts)
+        }
+        let keys = byEpoch.keys.sorted()
+        // Two axes, deliberately. A gap and a run's START use the epoch's own start, so a gap is measured
+        // between epochs rather than between whichever samples sat at their edges. A run's END is the last
+        // SAMPLE observed in its final epoch, which is what `buildRuns` means by `end` — reading the epoch
+        // start there would report every run one whole epoch shorter than the data it covers, and that
+        // understatement would then be weighed against the caller's minimum-duration gate.
+        let times = keys.map { $0 * epochS }
+        let ends = keys.map { lastTs[$0]! }
+        let flags = keys.map { HRVAnalyzer.median(byEpoch[$0]!) <= baseline * hrSleepBandMult }
+        let maxGapS = maxGapMinutes * 60
+        var periods: [Period] = []
+        var runStart = 0
+        for i in 1...keys.count {
+            let atEnd = (i == keys.count)
+            let close: Bool
+            if atEnd {
+                close = true
+            } else {
+                close = flags[i] != flags[runStart] || (times[i] - times[i - 1]) > maxGapS
+            }
+            if close {
+                periods.append(Period(stage: flags[runStart] ? "sleep" : "active",
+                                      start: times[runStart], end: ends[i - 1]))
+                runStart = i
+            }
+        }
+        return periods
+    }
+
     /// Absorb runs shorter than mergeMin minutes into their neighbours.
     static func mergePeriods(_ periods: [Period], mergeMinutes: Int = mergeMin) -> [Period] {
         if periods.isEmpty { return [] }
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerHrOnlySpineTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerHrOnlySpineTests.swift
new file mode 100644
index 0000000000..5278d38cdf
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerHrOnlySpineTests.swift
@@ -0,0 +1,81 @@
+import XCTest
+import WhoopProtocol
+@testable import StrandAnalytics
+
+/// The HR-only Stage-0 spine (#1801), for a strap that streams heart rate but banks no motion.
+///
+/// These cases are the ORACLE for the Kotlin twin `SleepStagerHrOnlySpineTest`: the same inputs and the
+/// same expected runs are asserted on both sides, so a divergence in the flag rule, the epoch bucketing
+/// or the run construction fails on one platform and not the other.
+///
+/// Baseline 60 throughout, so the sleep band is `60 * hrSleepBandMult` = 63.0 bpm inclusive. Samples are
+/// laid down every 10 s, six to a 60 s epoch.
+final class SleepStagerHrOnlySpineTests: XCTestCase {
+
+    /// Six samples in each epoch, `bpm` per epoch index.
+    private func hr(from epoch: Int, _ bpms: [Int]) -> [HRSample] {
+        var out: [HRSample] = []
+        for (i, bpm) in bpms.enumerated() {
+            let base = (epoch + i) * 60
+            for k in 0..<6 { out.append(HRSample(ts: base + k * 10, bpm: bpm)) }
+        }
+        return out
+    }
+
+    private func tuples(_ p: [SleepStager.Period]) -> [String] {
+        p.map { "\($0.stage) \($0.start)-\($0.end)" }
+    }
+
+    func testNoBaselineOrNoHrYieldsNothing() {
+        XCTAssertTrue(SleepStager.hrOnlySleepRuns(hr(from: 1000, [55]), baseline: nil).isEmpty)
+        XCTAssertTrue(SleepStager.hrOnlySleepRuns(hr(from: 1000, [55]), baseline: 0).isEmpty)
+        XCTAssertTrue(SleepStager.hrOnlySleepRuns([], baseline: 60).isEmpty)
+    }
+
+    func testAllInBandIsOneSleepRun() {
+        let runs = SleepStager.hrOnlySleepRuns(hr(from: 1000, [55, 55, 55]), baseline: 60)
+        XCTAssertEqual(tuples(runs), ["sleep 60000-60170"])
+    }
+
+    func testAllOutOfBandIsOneActiveRun() {
+        let runs = SleepStager.hrOnlySleepRuns(hr(from: 1000, [90, 90, 90]), baseline: 60)
+        XCTAssertEqual(tuples(runs), ["active 60000-60170"])
+    }
+
+    func testSleepActiveSleepSegmentsIntoThree() {
+        let runs = SleepStager.hrOnlySleepRuns(hr(from: 1000, [55, 55, 90, 55, 55]), baseline: 60)
+        XCTAssertEqual(tuples(runs), ["sleep 60000-60110", "active 60120-60170", "sleep 60180-60290"])
+    }
+
+    /// A gap wider than `maxGapMin` breaks a run even when the class never changes — the same rule
+    /// `buildRuns` applies to a gravity gap.
+    func testGapWiderThanMaxGapBreaksASameClassRun() {
+        let runs = SleepStager.hrOnlySleepRuns(hr(from: 1000, [55]) + hr(from: 1030, [55]), baseline: 60)
+        XCTAssertEqual(tuples(runs), ["sleep 60000-60050", "sleep 61800-61850"])
+    }
+
+    /// The band test is a MEDIAN, so one arousal spike inside an epoch cannot flip it to active — the
+    /// property `hrSleepBandAcross` documents, asserted here on the epoch reduction.
+    func testOneSpikeInAnEpochDoesNotFlipIt() {
+        var samples = hr(from: 1000, [55])
+        samples[5] = HRSample(ts: samples[5].ts, bpm: 190)
+        XCTAssertEqual(tuples(SleepStager.hrOnlySleepRuns(samples, baseline: 60)), ["sleep 60000-60050"])
+    }
+
+    /// A run's `end` is the last SAMPLE seen, not the final epoch's start. Pinned because reading the
+    /// epoch start reports every run one epoch short of the data it covers — silently, and straight into
+    /// the caller's minimum-duration gate. Three 60 s epochs of samples laid every 10 s end at 60170.
+    func testRunEndIsTheLastSampleNotTheEpochStart() {
+        let runs = SleepStager.hrOnlySleepRuns(hr(from: 1000, [55, 55, 55]), baseline: 60)
+        XCTAssertEqual(runs.first?.end, 60170)
+        XCTAssertEqual((runs.first!.end - runs.first!.start), 170)
+    }
+
+    /// The band is inclusive: 63 is `60 * 1.05` exactly.
+    func testBandBoundaryIsInclusive() {
+        XCTAssertEqual(tuples(SleepStager.hrOnlySleepRuns(hr(from: 1000, [63]), baseline: 60)),
+                       ["sleep 60000-60050"])
+        XCTAssertEqual(tuples(SleepStager.hrOnlySleepRuns(hr(from: 1000, [64]), baseline: 60)),
+                       ["active 60000-60050"])
+    }
+}
diff --git a/android/app/src/main/java/com/noop/analytics/SleepStager.kt b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
index 9b3fd068fc..c2c9ff5efe 100644
--- a/android/app/src/main/java/com/noop/analytics/SleepStager.kt
+++ b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
@@ -524,6 +524,87 @@ object SleepStager {
         return medianHR <= baseline * hrSleepBandMult
     }
 
+    /** Epoch for the HR-only spine, in seconds. */
+    const val hrOnlyEpochS: Long = 60
+
+    /**
+     * Sleep/active runs built from HEART RATE ALONE, for a strap that streams HR but banks no motion.
+     *
+     * Stage 0 is normally a gravity-stillness spine (Cole-Kripke) that HR only CONFIRMS, via
+     * [hrSleepBandAcross] and `confirmSleepWithHR`. A WHOOP 5/MG that cannot bond never banks motion at
+     * all — `SET_CLOCK` rides a handshake it never completes — so `grav` is empty, there is no spine, and
+     * no quantity of HR can stage the night (#1801). This builds the spine from the one signal such a
+     * strap does provide.
+     *
+     * Deliberately the SAME rule the confirm path already trusts: per-epoch MEDIAN bpm against
+     * `baseline * `[hrSleepBandMult], median for the reason [hrSleepBandAcross] spells out. The run
+     * construction follows [buildRuns] — close on a class change or a gap over [maxGapMin] — so the two
+     * spines segment alike once flags exist, and only the flag SOURCE differs.
+     *
+     * With ONE branch deliberately absent, and it is not an oversight. [buildRuns] can forgive a gap when
+     * [hrSleepBandAcross] vouches that HR stayed in band across it, which rescues a night whose GRAVITY
+     * dropped out. Here the gap IS in the heart rate, so there is nothing left to vouch with and no
+     * analogue to port. A long HR dropout therefore breaks an HR-only run where it would not break a
+     * motion-backed one, and a night fragmented that way is dropped by the caller's minimum-duration
+     * gate rather than bridged.
+     *
+     * WEAKER THAN THE MOTION SPINE, by construction rather than by tuning. The file already notes that a
+     * long still daytime stretch is gravity-indistinguishable from a nap and that HR is what saves it;
+     * with motion gone the inverse is exposed, and a quiet evening at rest can sit in the sleep band. A
+     * caller must treat these runs as lower-confidence than a motion-backed night and must not let one
+     * reach a baseline it cannot be unwound from.
+     *
+     * Bucket order does not depend on sort stability: samples are grouped by epoch and reduced with a
+     * median, so their order within an epoch cannot change the result.
+     */
+    internal fun hrOnlySleepRuns(
+        hr: List<HrSample>,
+        baseline: Double?,
+        epochS: Long = hrOnlyEpochS,
+        maxGapMinutes: Int = maxGapMin,
+    ): List<Period> {
+        if (baseline == null || baseline <= 0.0) return emptyList()
+        if (hr.isEmpty() || epochS <= 0L) return emptyList()
+        val byEpoch = HashMap<Long, MutableList<Double>>()
+        val lastTs = HashMap<Long, Long>()
+        for (s in hr) {
+            val k = s.ts / epochS
+            byEpoch.getOrPut(k) { ArrayList() }.add(s.bpm.toDouble())
+            lastTs[k] = maxOf(lastTs[k] ?: Long.MIN_VALUE, s.ts)
+        }
+        val keys = byEpoch.keys.sorted()
+        // Two axes, deliberately. A gap and a run's START use the epoch's own start, so a gap is measured
+        // between epochs rather than between whichever samples sat at their edges. A run's END is the last
+        // SAMPLE observed in its final epoch, which is what [buildRuns] means by `end` — reading the epoch
+        // start there would report every run one whole epoch shorter than the data it covers, and that
+        // understatement would then be weighed against the caller's minimum-duration gate.
+        val times = keys.map { it * epochS }
+        val ends = keys.map { lastTs.getValue(it) }
+        val flags = keys.map { HrvAnalyzer.median(byEpoch.getValue(it)) <= baseline * hrSleepBandMult }
+        val maxGapS = (maxGapMinutes * 60).toLong()
+        val periods = ArrayList<Period>()
+        var runStart = 0
+        for (i in 1..keys.size) {
+            val atEnd = (i == keys.size)
+            val close = if (atEnd) {
+                true
+            } else {
+                flags[i] != flags[runStart] || (times[i] - times[i - 1]) > maxGapS
+            }
+            if (close) {
+                periods.add(
+                    Period(
+                        stage = if (flags[runStart]) "sleep" else "active",
+                        start = times[runStart],
+                        end = ends[i - 1],
+                    )
+                )
+                runStart = i
+            }
+        }
+        return periods
+    }
+
     /** Per-record sleep flags from a rolling fraction of "still" samples. */
     internal fun classifyStill(grav: List<GravitySample>, deltas: List<Double>): List<Boolean> {
         val n = grav.size
diff --git a/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySpineTest.kt b/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySpineTest.kt
new file mode 100644
index 0000000000..6c759806ec
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySpineTest.kt
@@ -0,0 +1,115 @@
+package com.noop.analytics
+
+import com.noop.data.HrSample
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The HR-only Stage-0 spine (#1801), for a strap that streams heart rate but banks no motion.
+ *
+ * Every expectation below is the Swift twin's OWN output, produced by compiling
+ * `SleepStager.hrOnlySleepRuns` standalone (`swiftc -O twin.swift main.swift`) over this exact case
+ * list and pasted verbatim — not read off the Kotlin implementation. The package's XCTest twin
+ * `SleepStagerHrOnlySpineTests` asserts the same values on Apple; the harness exists because the test
+ * binary cannot link GRDB's sqlite3 on Linux, so the assertions could not otherwise be run here.
+ *
+ * Baseline 60 throughout, so the band is `60 * hrSleepBandMult` = 63.0 bpm inclusive. Samples land every
+ * 10 s, six to a 60 s epoch.
+ */
+class SleepStagerHrOnlySpineTest {
+
+    private fun hr(epoch: Int, bpms: List<Int>): List<HrSample> {
+        val out = ArrayList<HrSample>()
+        bpms.forEachIndexed { i, bpm ->
+            val base = (epoch + i).toLong() * 60L
+            repeat(6) { k -> out.add(HrSample(deviceId = "d", ts = base + k * 10L, bpm = bpm)) }
+        }
+        return out
+    }
+
+    private fun tuples(p: List<SleepStager.Period>): List<String> =
+        p.map { "${it.stage} ${it.start}-${it.end}" }
+
+    @Test
+    fun `no baseline or no hr yields nothing`() {
+        assertTrue(SleepStager.hrOnlySleepRuns(hr(1000, listOf(55)), null).isEmpty())
+        assertTrue(SleepStager.hrOnlySleepRuns(hr(1000, listOf(55)), 0.0).isEmpty())
+        assertTrue(SleepStager.hrOnlySleepRuns(emptyList(), 60.0).isEmpty())
+    }
+
+    @Test
+    fun `all in band is one sleep run`() {
+        assertEquals(
+            listOf("sleep 60000-60170"),
+            tuples(SleepStager.hrOnlySleepRuns(hr(1000, listOf(55, 55, 55)), 60.0)),
+        )
+    }
+
+    @Test
+    fun `all out of band is one active run`() {
+        assertEquals(
+            listOf("active 60000-60170"),
+            tuples(SleepStager.hrOnlySleepRuns(hr(1000, listOf(90, 90, 90)), 60.0)),
+        )
+    }
+
+    @Test
+    fun `sleep active sleep segments into three`() {
+        assertEquals(
+            listOf("sleep 60000-60110", "active 60120-60170", "sleep 60180-60290"),
+            tuples(SleepStager.hrOnlySleepRuns(hr(1000, listOf(55, 55, 90, 55, 55)), 60.0)),
+        )
+    }
+
+    /**
+     * A gap wider than [SleepStager.maxGapMin] breaks a run even when the class never changes — the same
+     * rule [SleepStager.buildRuns] applies to a gravity gap.
+     */
+    @Test
+    fun `gap wider than maxGap breaks a same-class run`() {
+        assertEquals(
+            listOf("sleep 60000-60050", "sleep 61800-61850"),
+            tuples(SleepStager.hrOnlySleepRuns(hr(1000, listOf(55)) + hr(1030, listOf(55)), 60.0)),
+        )
+    }
+
+    /**
+     * The band test is a MEDIAN, so one arousal spike inside an epoch cannot flip it to active — the
+     * property [SleepStager.hrSleepBandAcross] documents, asserted here on the epoch reduction.
+     */
+    @Test
+    fun `one spike in an epoch does not flip it`() {
+        val samples = hr(1000, listOf(55)).toMutableList()
+        samples[5] = samples[5].copy(bpm = 190)
+        assertEquals(
+            listOf("sleep 60000-60050"),
+            tuples(SleepStager.hrOnlySleepRuns(samples, 60.0)),
+        )
+    }
+
+    /**
+     * A run's `end` is the last SAMPLE seen, not the final epoch's start. Pinned because reading the
+     * epoch start reports every run one epoch short of the data it covers — silently, and straight into
+     * the caller's minimum-duration gate. Three 60 s epochs of samples laid every 10 s end at 60170.
+     */
+    @Test
+    fun `run end is the last sample not the epoch start`() {
+        val runs = SleepStager.hrOnlySleepRuns(hr(1000, listOf(55, 55, 55)), 60.0)
+        assertEquals(60170L, runs.first().end)
+        assertEquals(170L, runs.first().end - runs.first().start)
+    }
+
+    /** The band is inclusive: 63 is `60 * 1.05` exactly. */
+    @Test
+    fun `band boundary is inclusive`() {
+        assertEquals(
+            listOf("sleep 60000-60050"),
+            tuples(SleepStager.hrOnlySleepRuns(hr(1000, listOf(63)), 60.0)),
+        )
+        assertEquals(
+            listOf("active 60000-60050"),
+            tuples(SleepStager.hrOnlySleepRuns(hr(1000, listOf(64)), 60.0)),
+        )
+    }
+}

From db1b81faba13852237967ca128b3d391646a8aab Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 20:13:03 +1200
Subject: [PATCH 162/333] sleep: wire the HR-only spine, on a percentile anchor
 rather than the median (#1806)

Wires hrOnlySessions into the day scan for a strap that streams heart rate but banks no motion, and
fixes a real flaw in the spine merged in #1805 that writing the tests exposed.

THE ANCHOR. hrOnlySleepRuns took its band from hrBaseline, the window MEDIAN, on the reasoning that
reusing the motion path's definition was parity. That was wrong by arithmetic rather than by tuning:
a median splits the samples in half by definition, so a band of median * 1.05 admits strictly more
than half of ANY window. Measured on a realistic 24 h - 16 h awake at 74-96, 8 h night at 59-70 - it
called 14.4 hours sleep against a truth of 8. hrSleepBandMult is correct where it was designed to be
used, as a CONFIRMATION gate on a run gravity stillness already found. A confirmation threshold and a
detection threshold are not the same instrument.

Now anchored on the tenth percentile by nearest rank, which sits in the night's trough and cannot
admit half a window however the day is shaped. Chosen from a sweep against windows with known truth,
taking the conservative corner because the failure directions are not symmetric: over-detection puts
a wrong Rest on screen, under-detection leaves "No data", which is the state this improves on.

MERGE THE RUNS. A run boundary is a threshold crossing and a sleeping heart rate oscillates across
the band all night, so the spine returned the night's minutes shredded into sub-mergeMin fragments,
every one of which then failed the minimum-duration gate - 8 h of detected sleep yielding zero
sessions. mergePeriods first, exactly as the motion path does.

DISPLAY-ONLY, ENFORCED AT THE SET. An HR-only night carries null restingHR/avgHRV, but that only
protects aggregates that READ those fields: the deep-window HRV pool and the SDNN index both
re-derive from rr over each session's own stages, and would have folded one into Charge and the HRV
baseline regardless. deepHrvWindow is a user setting, so that path is reachable. Fixed by naming the
set once - physiologySessions - and routing all four aggregates through it.

A 4.0 IS UNTOUCHED. Nothing in the change keys on model or family; the gate is absent gravity plus
the device having persisted no hypnogram of its own. Every changed line outside the new functions is
a no-op when no session is hrOnly. Pinned by a source-reading test.

Two comments corrected that this change falsified, and two places where Swift's explicit init dropped
a field Kotlin's copy kept.

21 Kotlin tests, 0 failures. Swift twins run on CI. app-build green on both Apple targets - it caught
an internal entry point invisible to the app target that every default job missed.

Refs #1801.
---
 .../StrandAnalytics/AnalyticsEngine.swift     |  29 ++++-
 .../Sources/StrandAnalytics/SleepStager.swift |  98 +++++++++++++++-
 .../WakeMotionRefinement.swift                |   8 +-
 .../SleepStagerHrOnlyAnchorTests.swift        |  53 +++++++++
 Strand/Data/IntelligenceEngine.swift          |  17 ++-
 .../com/noop/analytics/AnalyticsEngine.kt     |  24 +++-
 .../com/noop/analytics/AnalyticsModels.kt     |  10 ++
 .../com/noop/analytics/IntelligenceEngine.kt  |  24 +++-
 .../java/com/noop/analytics/SleepStager.kt    | 101 +++++++++++++++-
 .../HrOnlyPhysiologyIsolationTest.kt          |  74 ++++++++++++
 .../analytics/SleepStagerHrOnlyAnchorTest.kt  | 107 +++++++++++++++++
 .../SleepStagerHrOnlySessionsTest.kt          | 111 ++++++++++++++++++
 12 files changed, 634 insertions(+), 22 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerHrOnlyAnchorTests.swift
 create mode 100644 android/app/src/test/java/com/noop/analytics/HrOnlyPhysiologyIsolationTest.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlyAnchorTest.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySessionsTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
index 99430ddda3..1bb7afc133 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
@@ -506,11 +506,19 @@ public enum AnalyticsEngine {
         } else {
             let rrSorted = rr.sortedByTsStable()
             let enrichedProvided: [SleepSession] = providedSleep.map { s in
+                // #1801: an HR-only night keeps its NIL restingHR/avgHRV. This is the ONE call site that
+                // can undo the display-only guarantee — enriching here would hand Charge and the baselines
+                // exactly the two values that decision withholds, silently and by default.
+                if s.hrOnly { return s }
                 guard s.restingHR == nil || s.avgHRV == nil else { return s }
                 let rhr = s.restingHR ?? SleepStager.sessionRestingHR(start: s.start, end: s.end, hr: hr)
                 let hrv = s.avgHRV ?? SleepStager.sessionAvgHRV(start: s.start, end: s.end, rr: rrSorted)
+                // `hrOnly` carried explicitly: unlike Kotlin's `copy`, this rebuilds the struct field by
+                // field, so a new flag is dropped by DEFAULT unless named here. The guard above means an
+                // HR-only night never reaches this line today; passing it anyway keeps that a belt rather
+                // than the only thing standing between the flag and silent loss.
                 return SleepSession(start: s.start, end: s.end, efficiency: s.efficiency,
-                                    stages: s.stages, restingHR: rhr, avgHRV: hrv)
+                                    stages: s.stages, restingHR: rhr, avgHRV: hrv, hrOnly: s.hrOnly)
             }
             let keptDetected = refinedSessions.filter { d in
                 !enrichedProvided.contains { $0.start < d.end && d.start < $0.end }
@@ -665,7 +673,18 @@ public enum AnalyticsEngine {
         // negligible shift. The Rest/sleep-quality term is main-night; the recovery physiology is
         // day-best-resting, night-dominated. Keep these two definitions distinct on purpose.
         // Daily resting HR = lowest per-session resting HR across matched sessions.
-        let restingHRDaily = matched.compactMap { $0.restingHR }.min()
+        // #1801: the sessions whose PHYSIOLOGY may be folded into the day's aggregates. An HR-only night
+        // is excluded — it may describe its own duration, stages and Rest, but resting HR, HRV and SDNN
+        // are what Charge and the baselines are built from, and a baseline is the one thing a false
+        // positive cannot be unwound from.
+        //
+        // Named once rather than filtered at each use, because the nil restingHR/avgHRV an HR-only
+        // session carries only protects the aggregates that READ those fields. The deep-window HRV pool
+        // and the SDNN index below re-derive from `rr` over the session's own stages and would have
+        // folded one in regardless — which is precisely the "one forgotten call site" a scattered filter
+        // invites.
+        let physiologySessions = matched.filter { !$0.hrOnly }
+        let restingHRDaily = physiologySessions.compactMap { $0.restingHR }.min()
         // Daily avg HRV = in-bed-weighted mean of per-session avg HRV.
         let avgHRVDaily: Double? = {
             if deepHrvWindow {
@@ -675,13 +694,13 @@ public enum AnalyticsEngine {
                 // = successive diffs). nil when no deep sleep is detected (WHOOP-4.0 staging can be sparse) —
                 // the caller shows calibrating, never a fabricated number.
                 let rrSorted = rr.sortedByTsStable()
-                let deep = matched.flatMap { s in
+                let deep = physiologySessions.flatMap { s in
                     SleepStager.sessionHrvWindows(start: s.start, end: s.end, rr: rrSorted, stages: s.stages)
                         .filter { $0.stage == "deep" }.compactMap { $0.rmssd }
                 }
                 return deep.isEmpty ? nil : deep.reduce(0, +) / Double(deep.count)
             }
-            let pairs = matched.compactMap { s -> (Double, Double)? in
+            let pairs = physiologySessions.compactMap { s -> (Double, Double)? in
                 s.avgHRV.map { ($0, Double(s.end - s.start)) }
             }
             guard !pairs.isEmpty else { return nil }
@@ -698,7 +717,7 @@ public enum AnalyticsEngine {
         // against a watch meaningless. The 5-min index is window-comparable to those. nil when no segment has
         // enough clean beats (HRVAnalyzer's own gate). Keeps the R-R timestamps (segmentation needs them).
         let avgSDNNDaily: Double? = {
-            let inBed = rr.filter { r in matched.contains { r.ts >= $0.start && r.ts < $0.end } }
+            let inBed = rr.filter { r in physiologySessions.contains { r.ts >= $0.start && r.ts < $0.end } }
             return inBed.isEmpty ? nil : HRVAnalyzer.sdnnIndex(inBed, segmentSec: 300)
         }()
 
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
index 8a5b5b237a..6432437438 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
@@ -50,11 +50,22 @@ public struct SleepSession: Equatable, Sendable {
     public let restingHR: Int?
     /// Mean RMSSD over 5-min windows across the session (ms), or nil.
     public let avgHRV: Double?
+    /// Staged WITHOUT a motion spine, from heart rate alone (#1801).
+    ///
+    /// True only for a strap that streams HR but banks no motion, where Stage 0's gravity-stillness
+    /// spine has nothing to work with. Such a night is weaker by construction, not by tuning: with
+    /// motion gone a quiet evening at rest can sit in the sleep band. It is allowed to describe itself
+    /// — duration, stages, Rest — and must NOT reach anything it cannot be unwound from, which is why
+    /// `restingHR` and `avgHRV` are left nil on one rather than filtered out downstream.
+    ///
+    /// Kotlin twin: `DetectedSleep.hrOnly` (the model names diverge, `DetectedSleep`/`SleepSession`).
+    public let hrOnly: Bool
 
     public init(start: Int, end: Int, efficiency: Double, stages: [StageSegment],
-                restingHR: Int?, avgHRV: Double?) {
+                restingHR: Int?, avgHRV: Double?, hrOnly: Bool = false) {
         self.start = start; self.end = end; self.efficiency = efficiency
         self.stages = stages; self.restingHR = restingHR; self.avgHRV = avgHRV
+        self.hrOnly = hrOnly
     }
 }
 
@@ -472,6 +483,43 @@ public enum SleepStager {
         return periods
     }
 
+    /// Percentile of the window's bpm that anchors the HR-only sleep band.
+    ///
+    /// NOT `hrBaseline`. That is the window MEDIAN, and it is the right anchor where it is used — as a
+    /// CONFIRMATION gate on a run gravity stillness already found, where being permissive is deliberate.
+    /// As a PRIMARY threshold it is disqualified by arithmetic rather than by tuning: a median splits the
+    /// samples in half by definition, so a band of `median * 1.05` admits strictly more than half of any
+    /// window whatever the data. Measured on a realistic 24 h (16 h awake 74-96, 8 h night 59-70) it
+    /// called 14.4 hours sleep against a truth of 8.
+    ///
+    /// A tenth percentile sits in the night's trough instead, which is what a sleep band should be
+    /// anchored to, and cannot admit half the window however the day is shaped.
+    public static let hrOnlyAnchorPercentile: Double = 0.10
+
+    /// Multiplier above `hrOnlyAnchorPercentile` that still counts as asleep.
+    ///
+    /// Numerically equal to `hrSleepBandMult` today, and deliberately a SEPARATE constant: that one is a
+    /// confirmation gate's tolerance and this one is a detector's, and a future change to either has no
+    /// business silently moving the other.
+    ///
+    /// Chosen conservatively from a sweep over anchor x multiplier against windows with known truth,
+    /// because the two failure directions are not symmetric. Over-detection puts a wrong Rest number on
+    /// screen; under-detection leaves "No data", which is the state this feature is trying to improve on
+    /// and therefore a safe place to fail. p10 x 1.05 measured 8.1 h against a truth of 8 on a
+    /// field-shaped 24 h window, and under-reads a long multi-night window rather than over-reading it
+    /// (8.7 h of 16 h across two nights in 54 h) — pinned in `SleepStagerHrOnlyAnchorTests`.
+    public static let hrOnlyBandMult: Double = 1.05
+
+    /// The `hrOnlyAnchorPercentile` of `hr` by bpm, or nil when empty. Nearest-rank (no interpolation), so
+    /// the value is always one the wearer actually recorded and the two platforms cannot disagree on a
+    /// rounding rule.
+    static func hrOnlyBaseline(_ hr: [HRSample]) -> Double? {
+        if hr.isEmpty { return nil }
+        let sorted = hr.map { Double($0.bpm) }.sorted()
+        let idx = min(max(Int(Double(sorted.count - 1) * hrOnlyAnchorPercentile), 0), sorted.count - 1)
+        return sorted[idx]
+    }
+
     /// Epoch for the HR-only spine, in seconds.
     public static let hrOnlyEpochS: Int = 60
 
@@ -523,7 +571,7 @@ public enum SleepStager {
         // understatement would then be weighed against the caller's minimum-duration gate.
         let times = keys.map { $0 * epochS }
         let ends = keys.map { lastTs[$0]! }
-        let flags = keys.map { HRVAnalyzer.median(byEpoch[$0]!) <= baseline * hrSleepBandMult }
+        let flags = keys.map { HRVAnalyzer.median(byEpoch[$0]!) <= baseline * hrOnlyBandMult }
         let maxGapS = maxGapMinutes * 60
         var periods: [Period] = []
         var runStart = 0
@@ -544,6 +592,52 @@ public enum SleepStager {
         return periods
     }
 
+    /// Whole sleep SESSIONS from heart rate alone, for a strap that banks no motion (#1801).
+    ///
+    /// `hrOnlySleepRuns` supplies the spine this normally gets from gravity stillness; `SleepStagerV2`
+    /// then stages each surviving run from HR and R-R with an EMPTY gravity array. That is not a
+    /// degenerate call: V2's epoch features read HR and R-R directly and only its motion-quiescence terms
+    /// go quiet, so it returns a real hypnogram rather than one flat stage. A stageless session would be
+    /// dropped by `sleepSessionFromProvided` anyway, so a night that fails to stage is correctly omitted
+    /// here rather than passed on hollow.
+    ///
+    /// The anchor is `hrOnlyBaseline` — the `hrOnlyAnchorPercentile` of the window — and NOT the
+    /// `hrBaseline` median the motion path derives. Reusing that median looked like parity and was a bug:
+    /// as a confirmation gate on an already-detected run it is deliberately permissive, but as a primary
+    /// threshold it admits over half of any window by definition. See `hrOnlyAnchorPercentile`.
+    ///
+    /// `restingHR` and `avgHRV` are left NIL deliberately, and that is the whole display-only guarantee.
+    /// An HR-only night may describe itself — duration, stages, Rest — but the resting HR and HRV it
+    /// would contribute are exactly what Charge and the baselines fold in, and a baseline is the one
+    /// thing a false positive cannot be unwound from. Withholding the values is structural; a downstream
+    /// filter would be one forgotten call site away from failing open.
+    /// `public` because the app target calls it: `Strand/Data/IntelligenceEngine.swift` is the day scan,
+    /// and it lives outside this package. The spine and the anchor below it stay `internal` — the tests
+    /// reach them with `@testable`, and nothing outside should be building its own spine.
+    public static func hrOnlySessions(hr: [HRSample], rr: [RRInterval], resp: [RespSample],
+                                      minMinutes: Int = minSleepMin) -> [SleepSession] {
+        let hrS = hr.sorted { $0.ts < $1.ts }
+        guard let baseline = hrOnlyBaseline(hrS) else { return [] }
+        let rrS = rr.sorted { $0.ts < $1.ts }
+        var out: [SleepSession] = []
+        // mergePeriods for the same reason the motion path calls it: a run boundary is a threshold
+        // crossing, and a sleeping heart rate oscillates across the band all night. Without this the
+        // spine returns the night's minutes correctly but shredded into sub-mergeMin fragments, every one
+        // of which then fails the minimum-duration gate below — 8 h of detected sleep yielding zero
+        // sessions. Absorbing the short runs first is what turns a spine into a night.
+        for p in mergePeriods(hrOnlySleepRuns(hrS, baseline: baseline)) {
+            if p.stage != "sleep" { continue }
+            if (p.end - p.start) < minMinutes * 60 { continue }
+            let stages = SleepStagerV2.stageSession(start: p.start, end: p.end, grav: [],
+                                                    hr: hrS, rr: rrS, resp: resp)
+            if stages.isEmpty { continue }
+            out.append(SleepSession(start: p.start, end: p.end,
+                                    efficiency: efficiency(start: p.start, end: p.end, stages: stages),
+                                    stages: stages, restingHR: nil, avgHRV: nil, hrOnly: true))
+        }
+        return out
+    }
+
     /// Absorb runs shorter than mergeMin minutes into their neighbours.
     static func mergePeriods(_ periods: [Period], mergeMinutes: Int = mergeMin) -> [Period] {
         if periods.isEmpty { return [] }
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/WakeMotionRefinement.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/WakeMotionRefinement.swift
index d8703124b0..26c8bcd0c1 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/WakeMotionRefinement.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/WakeMotionRefinement.swift
@@ -135,8 +135,14 @@ public enum WakeMotionRefinement {
         let newStages = refine(session.stages, grav: grav, steps: steps)
         guard newStages != session.stages else { return session }
         let newEfficiency = SleepStager.efficiency(start: session.start, end: session.end, stages: newStages)
+        // `hrOnly` carried explicitly. The Kotlin twin is a `copy`, which preserves a new field for
+        // free; this rebuilds the struct field by field and drops one BY DEFAULT. Refinement only ever
+        // sees motion-detected sessions today, so an HR-only night never reaches here — but the two
+        // platforms would have disagreed silently the moment it did, which is the shape of divergence
+        // the parity contract exists to catch.
         return SleepSession(start: session.start, end: session.end, efficiency: newEfficiency,
-                            stages: newStages, restingHR: session.restingHR, avgHRV: session.avgHRV)
+                            stages: newStages, restingHR: session.restingHR, avgHRV: session.avgHRV,
+                            hrOnly: session.hrOnly)
     }
 
     /// Toggle-shaped convenience for the session-level overload (see `apply(_:grav:steps:enabled:)`).
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerHrOnlyAnchorTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerHrOnlyAnchorTests.swift
new file mode 100644
index 0000000000..68731afed1
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerHrOnlyAnchorTests.swift
@@ -0,0 +1,53 @@
+import XCTest
+import WhoopProtocol
+@testable import StrandAnalytics
+
+/// Twin of the Kotlin `SleepStagerHrOnlyAnchorTest`: what anchors the HR-only band, and why it is not
+/// the median (#1801).
+final class SleepStagerHrOnlyAnchorTests: XCTestCase {
+
+    private func window(_ aC: Int, _ aA: Int, _ aH: Int, _ nC: Int, _ nA: Int, _ nH: Int) -> [HRSample] {
+        let t0 = 1_788_300_000
+        var hr: [HRSample] = []
+        for i in 0..<(aH * 3600) { hr.append(HRSample(ts: t0 + i, bpm: aC + Int(sin(Double(i) / 500.0) * Double(aA)))) }
+        for j in 0..<(nH * 3600) {
+            hr.append(HRSample(ts: t0 + aH * 3600 + j, bpm: nC + Int(sin(Double(j) / 900.0) * Double(nA))))
+        }
+        return hr
+    }
+
+    private func sleepHours(_ hr: [HRSample], _ baseline: Double) -> Double {
+        Double(SleepStager.hrOnlySleepRuns(hr, baseline: baseline)
+            .filter { $0.stage == "sleep" }
+            .reduce(0) { $0 + ($1.end - $1.start) }) / 3600.0
+    }
+
+    func testAnchorIsTenthPercentileNearestRank() {
+        let hr = (1...100).map { HRSample(ts: 1_788_300_000 + $0, bpm: $0) }
+        XCTAssertEqual(SleepStager.hrOnlyAnchorPercentile, 0.10, accuracy: 1e-9)
+        XCTAssertEqual(SleepStager.hrOnlyBaseline(hr)!, 10.0, accuracy: 1e-9)
+    }
+
+    /// The regression this file exists for: the median anchor admits over half of any window by
+    /// definition, and measured 14.4 h against a truth of 8 on a field-shaped day.
+    func testMedianOverDetectsAndPercentileDoesNot() {
+        let hr = window(74, 11, 16, 64, 5, 8)
+        let median = sleepHours(hr, SleepStager.hrBaseline(hr)!)
+        let percentile = sleepHours(hr, SleepStager.hrOnlyBaseline(hr)!)
+        XCTAssertGreaterThan(median, 13.0)
+        XCTAssertTrue((7.0...9.5).contains(percentile), "was \(percentile)")
+        XCTAssertLessThan(percentile, median - 4.0)
+    }
+
+    /// Errs toward UNDER-detection: a missed night leaves "No data", an invented one shows a wrong Rest.
+    func testLongMultiNightWindowIsUnderReadNotOverRead() {
+        let h = sleepHours(window(78, 12, 38, 60, 6, 16), SleepStager.hrOnlyBaseline(window(78, 12, 38, 60, 6, 16))!)
+        XCTAssertLessThanOrEqual(h, 16.0, "was \(h)")
+        XCTAssertGreaterThanOrEqual(h, 6.0, "was \(h)")
+    }
+
+    func testDetectorBandIsASeparateConstantFromTheConfirmationGate() {
+        XCTAssertEqual(SleepStager.hrOnlyBandMult, 1.05, accuracy: 1e-9)
+        XCTAssertEqual(SleepStager.hrSleepBandMult, 1.05, accuracy: 1e-9)
+    }
+}
diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index 97a7893cd7..b7dcbbc8f5 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -940,8 +940,10 @@ final class IntelligenceEngine: ObservableObject {
                 // since we last scored it THIS session, skipping the 7 stream reads + `analyzeDay`. Gated to a
                 // registered WHOOP owner (4.0 or 5/MG) via the UN-coalesced `forRegistryDevice` — which
                 // returns nil for a ring/import/unknown, so the cache never treats one as a WHOOP (a ring's
-                // `providedSleep` could change a day without an HR move; a WHOOP always streams gravity, so
-                // its `providedSleep` is empty and the reuse is byte-identical). The per-day key folds the
+                // `providedSleep` could change a day without an HR move; a WHOOP normally streams gravity, so
+                // its `providedSleep` is empty and the reuse is byte-identical — and since #1801 a WHOOP with
+                // NO gravity gets an HR-only `providedSleep` instead, which is derived from the very HR the
+                // key already fingerprints, so the reuse stays sound by a different route). The per-day key folds the
                 // night's HR fingerprint (a narrower per-day witness than the whole-pass raw-input gate) and, for a
                 // 4.0, the window-wide skin anchor (a re-anchor from another night shifts that night's skin
                 // conversion without moving its HR). A 5/MG banks skin-temp centidegrees directly — no
@@ -1169,7 +1171,16 @@ final class IntelligenceEngine: ObservableObject {
                 if owner != Repository.whoopSource, grav.count < 2 {
                     let persisted = (try? await store.sleepSessions(deviceId: owner, from: from, to: to,
                                                                     limit: 4000)) ?? []
-                    providedSleep = persisted.compactMap { AnalyticsEngine.sleepSession(fromProvided: $0) }
+                    let stored = persisted.compactMap { AnalyticsEngine.sleepSession(fromProvided: $0) }
+                    // #1801: the comment above assumes a WHOOP always streams a gravity vector. A 5/MG that
+                    // cannot bond does not — it is never clocked, so it banks nothing and persists no
+                    // hypnogram either, leaving neither a spine nor a stored night however much HR it holds.
+                    // Fall back to the HR-only spine ONLY when the device supplied nothing of its own: a
+                    // hypnogram the device actually recorded is always better evidence than one inferred
+                    // from heart rate.
+                    providedSleep = stored.isEmpty
+                        ? SleepStager.hrOnlySessions(hr: hr, rr: rr, resp: resp)
+                        : stored
                 } else {
                     providedSleep = []
                 }
diff --git a/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt b/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
index 22410d68a4..9082479b7a 100644
--- a/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
@@ -443,7 +443,10 @@ object AnalyticsEngine {
         } else {
             val rrSorted = rr.sortedBy { it.ts }
             val enrichedProvided = providedSleep.map { s ->
-                if (s.restingHR != null && s.avgHRV != null) s
+                // #1801: an HR-only night keeps its NULL restingHR/avgHRV. This is the ONE call site that
+                // can undo the display-only guarantee — enriching here would hand Charge and the baselines
+                // exactly the two values that decision withholds, silently and by default.
+                if (s.hrOnly || (s.restingHR != null && s.avgHRV != null)) s
                 else s.copy(
                     restingHR = s.restingHR ?: SleepStager.sessionRestingHR(s.start, s.end, hr),
                     avgHRV = s.avgHRV ?: SleepStager.sessionAvgHRV(s.start, s.end, rrSorted),
@@ -547,7 +550,18 @@ object AnalyticsEngine {
         // negligible shift. The Rest/sleep-quality term is main-night; the recovery physiology is
         // day-best-resting, night-dominated. Mirrors the Swift note in AnalyticsEngine.swift.
         // Daily resting HR = lowest per-session resting HR across matched sessions.
-        val restingHRDaily: Int? = matched.mapNotNull { it.restingHR }.minOrNull()
+        // #1801: the sessions whose PHYSIOLOGY may be folded into the day's aggregates. An HR-only night
+        // is excluded — it may describe its own duration, stages and Rest, but resting HR, HRV and SDNN
+        // are what Charge and the baselines are built from, and a baseline is the one thing a false
+        // positive cannot be unwound from.
+        //
+        // Named once rather than filtered at each use, because the null restingHR/avgHRV an HR-only
+        // session carries only protects the aggregates that READ those fields. The deep-window HRV pool
+        // and the SDNN index below re-derive from `rr` over the session's own stages and would have
+        // folded one in regardless — which is precisely the "one forgotten call site" a scattered filter
+        // invites.
+        val physiologySessions = matched.filter { !it.hrOnly }
+        val restingHRDaily: Int? = physiologySessions.mapNotNull { it.restingHR }.minOrNull()
         // Daily avg HRV = in-bed-weighted mean of per-session avg HRV.
         val avgHRVDaily: Double? = if (deepHrvWindow) {
             // #141: WHOOP-style HRV — pool RMSSD over DEEP-stage 5-min windows only (slow-wave sleep),
@@ -556,13 +570,13 @@ object AnalyticsEngine {
             // (RMSSD = successive diffs). null when the night has no detected deep sleep (WHOOP-4.0 staging
             // can be sparse) — the caller then shows calibrating, never a fabricated number.
             val rrSorted = rr.sortedBy { it.ts }
-            val deep = matched.flatMap { s ->
+            val deep = physiologySessions.flatMap { s ->
                 SleepStager.sessionHrvWindows(s.start, s.end, rrSorted, s.stages)
                     .filter { it.stage == "deep" }.mapNotNull { it.rmssd }
             }
             if (deep.isEmpty()) null else deep.sum() / deep.size
         } else run {
-            val pairs = matched.mapNotNull { s ->
+            val pairs = physiologySessions.mapNotNull { s ->
                 s.avgHRV?.let { it to (s.end - s.start).toDouble() }
             }
             if (pairs.isEmpty()) {
@@ -578,7 +592,7 @@ object AnalyticsEngine {
         // timestamps needed for segmentation and stays distinct from avgHrv (RMSSD). The half-open sleep
         // bounds match every other in-bed aggregate; no qualifying 20-clean-beat segment means null.
         val avgSDNNDaily = HrvAnalyzer.sdnnIndex(
-            rr.filter { sample -> matched.any { sample.ts >= it.start && sample.ts < it.end } },
+            rr.filter { sample -> physiologySessions.any { sample.ts >= it.start && sample.ts < it.end } },
             segmentSec = 300,
         )
 
diff --git a/android/app/src/main/java/com/noop/analytics/AnalyticsModels.kt b/android/app/src/main/java/com/noop/analytics/AnalyticsModels.kt
index 04c4587414..f3d7fa5927 100644
--- a/android/app/src/main/java/com/noop/analytics/AnalyticsModels.kt
+++ b/android/app/src/main/java/com/noop/analytics/AnalyticsModels.kt
@@ -87,6 +87,16 @@ data class DetectedSleep(
     val restingHR: Int?,
     /** Mean RMSSD over 5-min windows across the session (ms), or null. */
     val avgHRV: Double?,
+    /**
+     * Staged WITHOUT a motion spine, from heart rate alone (#1801).
+     *
+     * True only for a strap that streams HR but banks no motion, where Stage 0's gravity-stillness spine
+     * has nothing to work with. Such a night is weaker by construction, not by tuning: with motion gone a
+     * quiet evening at rest can sit in the sleep band. It is allowed to describe itself — duration,
+     * stages, Rest — and must NOT reach anything it cannot be unwound from, which is why
+     * [restingHR] and [avgHRV] are left null on one rather than filtered out downstream.
+     */
+    val hrOnly: Boolean = false,
 )
 
 /**
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index 46c337640e..fc091dcc9b 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -958,8 +958,15 @@ object IntelligenceEngine {
             // import namespace are untouched; analyzeDay still lets a DETECTED session win where they overlap.
             val providedSleep: List<DetectedSleep> =
                 if (owner != importedDeviceId && grav.size < 2) {
-                    repo.sleepSessionsForDevice(owner, from, to, 4000)
+                    val stored = repo.sleepSessionsForDevice(owner, from, to, 4000)
                         .mapNotNull { AnalyticsEngine.sleepSessionFromProvided(it) }
+                    // #1801: a ring persists its OWN hypnogram, so `stored` covers it. A 5/MG that cannot
+                    // bond persists nothing (it is never clocked, so it banks nothing) and streams no motion
+                    // either — neither a spine nor a stored night, which is why this day scored blank with
+                    // `reason=no-motion` however much HR it held. Fall back to the HR-only spine ONLY when
+                    // the device supplied nothing of its own: a hypnogram the device actually recorded is
+                    // always better evidence than one inferred from heart rate.
+                    if (stored.isNotEmpty()) stored else SleepStager.hrOnlySessions(hr, rr, resp)
                 } else {
                     emptyList()
                 }
@@ -2905,10 +2912,17 @@ object IntelligenceEngine {
         stepCount: Int, providedCount: Int, windowHours: Int,
     ): String {
         // `reason` names WHICH absence this is, because grav=0 is printed but its consequence is not.
-        // With no motion the stager has no HR-only fallback, so no quantity of HR can stage a night — a
-        // strap capability limit, not a coverage gap, and the two want completely different follow-ups.
-        // With motion present the inputs were there and staging still produced nothing, which is the case
-        // actually worth investigating.
+        //
+        // `no-motion` USED to mean "and therefore nothing further was attempted" — the stager had no
+        // HR-only fallback, so no quantity of HR could stage a night. Since #1801 it does: a day with no
+        // gravity now also runs [SleepStager.hrOnlySessions], so this line printing `no-motion` means the
+        // motion spine was absent AND heart rate alone did not yield a night either — too little of it in
+        // the sleep band, or a run that staged to nothing. That is a stronger statement than it used to
+        // be, and the follow-up it wants is different: no longer "this strap cannot", but "why did the
+        // HR-only spine find nothing here".
+        //
+        // With motion present the inputs were there and staging still produced nothing, which remains the
+        // case most worth investigating.
         val reason = if (gravCount == 0) "no-motion" else "staged-none"
         return "sleep-detect day=$day NO-NIGHT hr=$hrCount rr=$rrCount resp=$respCount " +
             "grav=$gravCount steps=$stepCount provided=$providedCount window=${windowHours}h " +
diff --git a/android/app/src/main/java/com/noop/analytics/SleepStager.kt b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
index c2c9ff5efe..4c78641d16 100644
--- a/android/app/src/main/java/com/noop/analytics/SleepStager.kt
+++ b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
@@ -524,6 +524,49 @@ object SleepStager {
         return medianHR <= baseline * hrSleepBandMult
     }
 
+    /**
+     * Percentile of the window's bpm that anchors the HR-only sleep band.
+     *
+     * NOT [hrBaseline]. That is the window MEDIAN, and it is the right anchor where it is used — as a
+     * CONFIRMATION gate on a run gravity stillness already found, where being permissive is deliberate.
+     * As a PRIMARY threshold it is disqualified by arithmetic rather than by tuning: a median splits the
+     * samples in half by definition, so a band of `median * 1.05` admits strictly more than half of any
+     * window whatever the data. Measured on a realistic 24 h (16 h awake 74-96, 8 h night 59-70) it
+     * called 14.4 hours sleep against a truth of 8.
+     *
+     * A tenth percentile sits in the night's trough instead, which is what a sleep band should be
+     * anchored to, and cannot admit half the window however the day is shaped.
+     */
+    const val hrOnlyAnchorPercentile: Double = 0.10
+
+    /**
+     * Multiplier above [hrOnlyAnchorPercentile] that still counts as asleep.
+     *
+     * Numerically equal to [hrSleepBandMult] today, and deliberately a SEPARATE constant: that one is a
+     * confirmation gate's tolerance and this one is a detector's, and a future change to either has no
+     * business silently moving the other.
+     *
+     * Chosen conservatively from a sweep over anchor x multiplier against windows with known truth,
+     * because the two failure directions are not symmetric. Over-detection puts a wrong Rest number on
+     * screen; under-detection leaves "No data", which is the state this feature is trying to improve on
+     * and therefore a safe place to fail. p10 x 1.05 measured 8.1 h against a truth of 8 on a field-shaped
+     * 24 h window, and under-reads a long multi-night window rather than over-reading it (8.7 h of 16 h
+     * across two nights in 54 h) — pinned in `SleepStagerHrOnlyAnchorTest`.
+     */
+    const val hrOnlyBandMult: Double = 1.05
+
+    /**
+     * The [hrOnlyAnchorPercentile] of `hr` by bpm, or null when empty. Nearest-rank (no interpolation), so
+     * the value is always one the wearer actually recorded and the two platforms cannot disagree on a
+     * rounding rule.
+     */
+    internal fun hrOnlyBaseline(hr: List<HrSample>): Double? {
+        if (hr.isEmpty()) return null
+        val sorted = hr.map { it.bpm.toDouble() }.sorted()
+        val idx = ((sorted.size - 1) * hrOnlyAnchorPercentile).toInt().coerceIn(0, sorted.size - 1)
+        return sorted[idx]
+    }
+
     /** Epoch for the HR-only spine, in seconds. */
     const val hrOnlyEpochS: Long = 60
 
@@ -580,7 +623,7 @@ object SleepStager {
         // understatement would then be weighed against the caller's minimum-duration gate.
         val times = keys.map { it * epochS }
         val ends = keys.map { lastTs.getValue(it) }
-        val flags = keys.map { HrvAnalyzer.median(byEpoch.getValue(it)) <= baseline * hrSleepBandMult }
+        val flags = keys.map { HrvAnalyzer.median(byEpoch.getValue(it)) <= baseline * hrOnlyBandMult }
         val maxGapS = (maxGapMinutes * 60).toLong()
         val periods = ArrayList<Period>()
         var runStart = 0
@@ -605,6 +648,62 @@ object SleepStager {
         return periods
     }
 
+    /**
+     * Whole sleep SESSIONS from heart rate alone, for a strap that banks no motion (#1801).
+     *
+     * [hrOnlySleepRuns] supplies the spine this normally gets from gravity stillness; [SleepStagerV2]
+     * then stages each surviving run from HR and R-R with an EMPTY gravity list. That is not a
+     * degenerate call: V2's epoch features read HR and R-R directly and only its motion-quiescence terms
+     * go quiet, so it returns a real hypnogram rather than one flat stage. A stageless session would be
+     * dropped by `AnalyticsEngine.sleepSessionFromProvided` anyway, so a night that fails to stage is
+     * correctly omitted here rather than passed on hollow.
+     *
+     * The anchor is [hrOnlyBaseline] — the [hrOnlyAnchorPercentile] of the window — and NOT the
+     * [hrBaseline] median the motion path derives. Reusing that median looked like parity and was a bug:
+     * as a confirmation gate on an already-detected run it is deliberately permissive, but as a primary
+     * threshold it admits over half of any window by definition. See [hrOnlyAnchorPercentile].
+     *
+     * [DetectedSleep.restingHR] and [DetectedSleep.avgHRV] are left NULL deliberately, and that is the
+     * whole display-only guarantee. An HR-only night may describe itself — duration, stages, Rest — but
+     * the resting HR and HRV it would contribute are exactly what Charge and the baselines fold in, and
+     * a baseline is the one thing a false positive cannot be unwound from. Withholding the values is
+     * structural; a downstream filter would be one forgotten call site away from failing open.
+     */
+    internal fun hrOnlySessions(
+        hr: List<HrSample>,
+        rr: List<RrInterval>,
+        resp: List<RespSample>,
+        minMinutes: Int = minSleepMin,
+    ): List<DetectedSleep> {
+        val hrS = hr.sortedBy { it.ts }
+        val baseline = hrOnlyBaseline(hrS) ?: return emptyList()
+        val rrS = rr.sortedBy { it.ts }
+        val out = ArrayList<DetectedSleep>()
+        // mergePeriods for the same reason the motion path calls it: a run boundary is a threshold
+        // crossing, and a sleeping heart rate oscillates across the band all night. Without this the
+        // spine returns the night's minutes correctly but shredded into sub-mergeMin fragments, every one
+        // of which then fails the minimum-duration gate below — 8 h of detected sleep yielding zero
+        // sessions. Absorbing the short runs first is what turns a spine into a night.
+        for (p in mergePeriods(hrOnlySleepRuns(hrS, baseline))) {
+            if (p.stage != "sleep") continue
+            if ((p.end - p.start) < minMinutes * 60L) continue
+            val stages = SleepStagerV2.stageSession(p.start, p.end, emptyList(), hrS, rrS, resp)
+            if (stages.isEmpty()) continue
+            out.add(
+                DetectedSleep(
+                    start = p.start,
+                    end = p.end,
+                    efficiency = efficiency(start = p.start, end = p.end, stages = stages),
+                    stages = stages,
+                    restingHR = null,
+                    avgHRV = null,
+                    hrOnly = true,
+                )
+            )
+        }
+        return out
+    }
+
     /** Per-record sleep flags from a rolling fraction of "still" samples. */
     internal fun classifyStill(grav: List<GravitySample>, deltas: List<Double>): List<Boolean> {
         val n = grav.size
diff --git a/android/app/src/test/java/com/noop/analytics/HrOnlyPhysiologyIsolationTest.kt b/android/app/src/test/java/com/noop/analytics/HrOnlyPhysiologyIsolationTest.kt
new file mode 100644
index 0000000000..7acebc9e54
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/HrOnlyPhysiologyIsolationTest.kt
@@ -0,0 +1,74 @@
+package com.noop.analytics
+
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The display-only guarantee for an HR-only night (#1801), guarded at the level it actually fails.
+ *
+ * A null `restingHR`/`avgHRV` only protects an aggregate that READS those fields. Two of the day's
+ * physiological aggregates do not: the deep-window HRV pool and the SDNN index both re-derive from `rr`
+ * over each session's own stages, so an HR-only night — which has stages — would have been folded into
+ * both, and from there into Charge and the HRV baseline. `deepHrvWindow` is a user setting, so that path
+ * is reachable, not theoretical.
+ *
+ * Read from the source because `physiologySessions` is a local inside `analyzeDay` and cannot be
+ * observed directly, and because the failure this guards is a FUTURE aggregate reaching for `matched`
+ * out of habit. A behavioural test on one path would not catch that; this does.
+ */
+class HrOnlyPhysiologyIsolationTest {
+
+    private fun analyzeDayBody(): String {
+        var root = java.io.File(System.getProperty("user.dir") ?: ".").canonicalFile
+        val src = run {
+            repeat(4) {
+                val f = java.io.File(root, "android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt")
+                if (f.isFile) return@run f.readText()
+                root = root.parentFile ?: root
+            }
+            error("AnalyticsEngine.kt not found — this test must not pass by default")
+        }
+        val decl = src.indexOf("val physiologySessions")
+        assertTrue("analyzeDay must name the physiology-session set", decl > 0)
+        // Start AFTER the declaration: that line reads `matched` legitimately, since defining the
+        // filtered set is the one place the unfiltered one belongs.
+        val from = src.indexOf("\n", decl) + 1
+        val to = src.indexOf("val avgSDNNDaily", from)
+        assertTrue("expected the SDNN index to follow the physiology set", to > from)
+        // Through the end of the SDNN call, which is the last of the four aggregates.
+        return src.substring(from, src.indexOf(")", src.indexOf("segmentSec = 300", to)) + 1)
+    }
+
+    @Test
+    fun `the physiology set excludes HR-only nights`() {
+        var root = java.io.File(System.getProperty("user.dir") ?: ".").canonicalFile
+        val src = run {
+            repeat(4) {
+                val f = java.io.File(root, "android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt")
+                if (f.isFile) return@run f.readText()
+                root = root.parentFile ?: root
+            }
+            error("AnalyticsEngine.kt not found — this test must not pass by default")
+        }
+        assertTrue("physiologySessions must filter out hrOnly",
+            src.contains("val physiologySessions = matched.filter { !it.hrOnly }"))
+    }
+
+    /**
+     * The four aggregates built from a night's physiology must read the filtered set. `matched` still
+     * has legitimate uses in `analyzeDay` — duration, stage totals, Rest, the onset — which is exactly
+     * why this checks the physiology region rather than banning the name outright.
+     */
+    @Test
+    fun `no physiological aggregate reads the unfiltered sessions`() {
+        val body = analyzeDayBody()
+        val offenders = Regex("matched\\.[a-zA-Z]").findAll(body).map { it.value }.toList()
+        assertTrue(
+            "physiological aggregates must use physiologySessions, found: $offenders",
+            offenders.isEmpty(),
+        )
+        for (needle in listOf("restingHRDaily", "val deep", "val pairs", "avgSDNNDaily")) {
+            assertTrue("$needle must sit inside the guarded region", body.contains(needle))
+        }
+    }
+}
diff --git a/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlyAnchorTest.kt b/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlyAnchorTest.kt
new file mode 100644
index 0000000000..a421837e3d
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlyAnchorTest.kt
@@ -0,0 +1,107 @@
+package com.noop.analytics
+
+import com.noop.data.HrSample
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * What anchors the HR-only sleep band, and why it is not the median (#1801).
+ *
+ * The windows here are synthetic sinusoids with KNOWN sleep hours. They cannot show that staging is
+ * accurate on a real night — nothing offline can — but they do measure the one property that decides
+ * whether this spine is usable at all: how much of a window it calls sleep.
+ */
+class SleepStagerHrOnlyAnchorTest {
+
+    /** `aH` hours awake around `aC`+/-`aA` bpm, then `nH` hours asleep around `nC`+/-`nA`. */
+    private fun window(aC: Int, aA: Int, aH: Int, nC: Int, nA: Int, nH: Int): List<HrSample> {
+        val t0 = 1_788_300_000L
+        val hr = ArrayList<HrSample>()
+        var i = 0
+        while (i < aH * 3600) { hr.add(HrSample("d", t0 + i, aC + (Math.sin(i / 500.0) * aA).toInt())); i++ }
+        var j = 0
+        while (j < nH * 3600) {
+            hr.add(HrSample("d", t0 + aH * 3600L + j, nC + (Math.sin(j / 900.0) * nA).toInt())); j++
+        }
+        return hr
+    }
+
+    private fun sleepHours(hr: List<HrSample>, baseline: Double): Double =
+        SleepStager.hrOnlySleepRuns(hr, baseline)
+            .filter { it.stage == "sleep" }.sumOf { it.end - it.start } / 3600.0
+
+    /** Nearest-rank, so the anchor is always a bpm the wearer actually recorded. */
+    @Test
+    fun `the anchor is the tenth percentile by nearest rank`() {
+        val hr = (1..100).map { HrSample("d", 1_788_300_000L + it, it) }
+        assertEquals(0.10, SleepStager.hrOnlyAnchorPercentile, 1e-9)
+        // (100-1)*0.10 = 9.9 -> index 9 -> the 10th smallest, bpm 10.
+        assertEquals(10.0, SleepStager.hrOnlyBaseline(hr)!!, 1e-9)
+    }
+
+    /**
+     * The percentile index, pinned against the Swift twin's OWN output across the sizes where a
+     * nearest-rank rule can disagree — n below 1/p, and either side of an exact boundary. Every value
+     * below is stdout from `hrOnlyBaseline` compiled standalone, not read off the Kotlin.
+     */
+    @Test
+    fun `the percentile index matches the Swift twin`() {
+        val cases = listOf(
+            1 to 1.0, 2 to 1.0, 3 to 1.0, 7 to 1.0, 10 to 1.0,
+            11 to 2.0, 99 to 10.0, 100 to 10.0, 101 to 11.0, 1000 to 100.0,
+        )
+        for ((n, expected) in cases) {
+            val hr = (1..n).map { HrSample("d", 1_788_300_000L + it, it) }
+            assertEquals("n=$n", expected, SleepStager.hrOnlyBaseline(hr)!!, 1e-9)
+        }
+    }
+
+    /**
+     * The regression this file exists for. The first draft anchored on [SleepStager.hrBaseline], the
+     * window MEDIAN — which admits over half of any window by definition, because a median splits the
+     * samples in half and the band then adds 5% on top. On a field-shaped day that called 14.4 h sleep
+     * against a truth of 8. The percentile anchor must stay far below it.
+     */
+    @Test
+    fun `the median anchor over-detects and the percentile anchor does not`() {
+        val hr = window(74, 11, 16, 64, 5, 8)   // 24 h, 8 h of it asleep
+        val median = sleepHours(hr, SleepStager.hrBaseline(hr)!!)
+        val percentile = sleepHours(hr, SleepStager.hrOnlyBaseline(hr)!!)
+        assertTrue("median anchor should over-detect badly, was $median", median > 13.0)
+        assertTrue("percentile anchor should land near the truth of 8, was $percentile",
+            percentile in 7.0..9.5)
+        assertTrue("percentile must be far tighter than median", percentile < median - 4.0)
+    }
+
+    /**
+     * The chosen corner errs toward UNDER-detection, deliberately: a missed night leaves "No data",
+     * which is the state this feature improves on, while an invented night puts a wrong Rest on screen.
+     * Two nights inside one 54 h window are under-read rather than over-read.
+     */
+    @Test
+    fun `a long multi-night window is under-read rather than over-read`() {
+        val hr = window(78, 12, 38, 60, 6, 16)   // 54 h, 16 h of it asleep
+        val h = sleepHours(hr, SleepStager.hrOnlyBaseline(hr)!!)
+        assertTrue("must not exceed the truth of 16 h, was $h", h <= 16.0)
+        assertTrue("must still find a real night, was $h", h >= 6.0)
+    }
+
+    /** A flat sleeper — a small awake/asleep separation — is under-read, never inflated. */
+    @Test
+    fun `a flat sleeper is under-read never inflated`() {
+        val hr = window(70, 6, 16, 58, 3, 8)
+        val h = sleepHours(hr, SleepStager.hrOnlyBaseline(hr)!!)
+        assertTrue("must not exceed the truth of 8 h, was $h", h <= 8.5)
+    }
+
+    /**
+     * The detector's tolerance is its OWN constant, not the confirmation gate's. Equal today; this
+     * pins that a future change to one cannot silently move the other.
+     */
+    @Test
+    fun `the detector band is a separate constant from the confirmation gate`() {
+        assertEquals(1.05, SleepStager.hrOnlyBandMult, 1e-9)
+        assertEquals(1.05, SleepStager.hrSleepBandMult, 1e-9)
+    }
+}
diff --git a/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySessionsTest.kt b/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySessionsTest.kt
new file mode 100644
index 0000000000..0b01999d89
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySessionsTest.kt
@@ -0,0 +1,111 @@
+package com.noop.analytics
+
+import com.noop.data.HrSample
+import com.noop.data.RrInterval
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * Whole HR-only sessions (#1801), and the display-only guarantee that rides on them.
+ *
+ * The night is synthetic: a slow HR drift well under the window median, so the spine puts it in the
+ * sleep band. That is enough to exercise assembly and the null contract; it is NOT a claim that the
+ * staging is accurate on a real night, which no test here can establish.
+ */
+class SleepStagerHrOnlySessionsTest {
+
+    /**
+     * A field-shaped window: `aH` hours awake around 74 +/- 11 bpm, then `nH` hours asleep around
+     * 64 +/- 5 — the shape the #1801 report shows. The same generator the anchor tests use, so the two
+     * files cannot drift into disagreeing about what a detectable night looks like.
+     */
+    private fun window(aH: Int = 16, nH: Int = 8): Pair<List<HrSample>, List<RrInterval>> {
+        val t0 = 1_788_300_000L
+        val hr = ArrayList<HrSample>()
+        val rr = ArrayList<RrInterval>()
+        var i = 0
+        while (i < aH * 3600) {
+            val bpm = 74 + (Math.sin(i / 500.0) * 11).toInt()
+            hr.add(HrSample("d", t0 + i, bpm)); rr.add(RrInterval("d", t0 + i, 60000 / bpm)); i++
+        }
+        var j = 0
+        while (j < nH * 3600) {
+            val bpm = 64 + (Math.sin(j / 900.0) * 5).toInt()
+            val t = t0 + aH * 3600L + j
+            hr.add(HrSample("d", t, bpm)); rr.add(RrInterval("d", t, 60000 / bpm)); j++
+        }
+        return hr to rr
+    }
+
+    @Test
+    fun `a low-HR night becomes at least one staged session`() {
+        val (hr, rr) = window()
+        val out = SleepStager.hrOnlySessions(hr, rr, emptyList())
+        assertTrue("expected at least one night, got ${out.size}", out.isNotEmpty())
+        assertTrue("every session must carry stages", out.all { it.stages.isNotEmpty() })
+        assertTrue("every session must span at least minSleepMin",
+            out.all { (it.end - it.start) >= SleepStager.minSleepMin * 60L })
+        // Conservative by design: it may under-read a night, but must never invent more sleep than the
+        // window holds.
+        assertTrue("total must not exceed the 8 h actually asleep",
+            out.sumOf { it.end - it.start } <= 8 * 3600L)
+    }
+
+    /**
+     * The display-only guarantee at its source. restingHR and avgHRV are the two values Charge and the
+     * baselines fold in, and a baseline is the one thing a false positive cannot be unwound from.
+     */
+    @Test
+    fun `an HR-only session withholds resting HR and HRV and marks itself`() {
+        val (hr, rr) = window()
+        val s = SleepStager.hrOnlySessions(hr, rr, emptyList()).first()
+        assertTrue("must be flagged hrOnly", s.hrOnly)
+        assertNull("restingHR must stay null", s.restingHR)
+        assertNull("avgHRV must stay null", s.avgHRV)
+    }
+
+    /** A stretch below the minimum-duration gate is not a night. */
+    @Test
+    fun `a short low-HR stretch is not a night`() {
+        val (hr, rr) = window(aH = 16, nH = 8)
+        val cut = 1_788_300_000L + 16 * 3600L + 1500L   // ~25 min of night, well under minSleepMin
+        assertTrue(
+            SleepStager.hrOnlySessions(hr.filter { it.ts < cut }, rr.filter { it.ts < cut }, emptyList())
+                .isEmpty()
+        )
+    }
+
+    /**
+     * A strap that DOES bank motion must never reach this path. A WHOOP 4.0 streams a gravity vector and
+     * stages its nights from the motion spine — it is reported working — so the HR-only fallback exists
+     * only for the case where that spine has nothing. Read from the source because the gate lives at the
+     * call site in IntelligenceEngine, and a fallback that quietly widened to every strap would replace a
+     * working detector with a weaker one.
+     */
+    @Test
+    fun `the fallback is reachable only when gravity is absent`() {
+        var root = java.io.File(System.getProperty("user.dir") ?: ".").canonicalFile
+        val src = run {
+            repeat(4) {
+                val f = java.io.File(root, "android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt")
+                if (f.isFile) return@run f.readText()
+                root = root.parentFile ?: root
+            }
+            error("IntelligenceEngine.kt not found — this test must not pass by default")
+        }
+        val idx = src.indexOf("SleepStager.hrOnlySessions(")
+        assertTrue("IntelligenceEngine must call the HR-only fallback", idx > 0)
+        val guard = src.substring(maxOf(0, idx - 1200), idx)
+        assertTrue("the fallback must sit behind the absent-gravity gate", guard.contains("grav.size < 2"))
+        assertTrue("and must only run when the device supplied no hypnogram of its own",
+            guard.contains("stored.isNotEmpty()"))
+    }
+
+    /** No HR at all cannot produce a night, and must not throw. */
+    @Test
+    fun `no hr yields nothing`() {
+        assertTrue(SleepStager.hrOnlySessions(emptyList(), emptyList(), emptyList()).isEmpty())
+    }
+}

From 5cc1e288dd836afebd00d80c011031344b036fa7 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 20:14:20 +1200
Subject: [PATCH 163/333] Bump to 11.1.0 for a testing build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Staging bump, so all three numbers move together: MARKETING_VERSION and versionName to 11.1.0, and
the build numbers past the staging high-water — versionCode 411 -> 412 and CURRENT_PROJECT_VERSION
292 -> 293. 411 was taken by the 11.0.0 release, so 412 is the first free code a side-installed
staging build can carry without the installer refusing it as a downgrade.

fork-testing-build.yml reads MARKETING_VERSION out of project.yml for the asset names and the
release title, so the testing artefacts will read v11.1.0.

Carries the HR-only sleep spine (#1805) and its wiring (#1806): a strap that streams heart rate but
banks no motion can now stage a night from HR alone, marked lower-confidence and kept out of Charge
and the baselines. No schema change, so no migration.
---
 android/app/build.gradle.kts | 4 ++--
 project.yml                  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index aa680b28a8..d4710158e0 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,8 +26,8 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 411
-        versionName = "11.0.0"
+        versionCode = 412
+        versionName = "11.1.0"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
         vectorDrawables {
diff --git a/project.yml b/project.yml
index c612811398..15e14a344c 100644
--- a/project.yml
+++ b/project.yml
@@ -17,11 +17,11 @@ configFiles:
   Release: Config/BundleId.xcconfig
 settings:
   base:
-    MARKETING_VERSION: "11.0.0"
+    MARKETING_VERSION: "11.1.0"
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "292"
+    CURRENT_PROJECT_VERSION: "293"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 33ce50365483add5ac617da26cab6e64d345b507 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 20:39:11 +1200
Subject: [PATCH 164/333] backup: warn at export when a database is past the
 restore ceiling, and let a user restore it anyway (#1808)

Apple half of #1807. Both platforms cap the SQLite entry at 2 GiB and enforce it ONLY while
restoring, so NOOP writes archives it later refuses to read. The user finds out at restore, which is
the one moment the original is already gone. A backup that silently is not one is worse than none,
because it displaces the habit of keeping another. Reachable now: a field diagnostic reports a
1.63 GB database, 76% of the ceiling, with nothing pruning the raw streams.

Export returns .exportedOversize when the database is past the cap, naming the size and the ceiling.
The file is still written - it is valid, and with the override below it is restorable - so this is a
warning, not a refusal; refusing would take away the user's only lossless artefact. Measured on the
DATABASE rather than the finished archive: the archive is deflated and the cap counts the
DECOMPRESSED stream, so the zip's own size says nothing about whether it can be read back. That is
also why compressing harder cannot help anyone past it - the guard is a zip-bomb defence, and a cap
on compressed size would be trivially defeated.

Restore surfaces entryTooLarge as its own case rather than a generic failure, and the caller offers
to go ahead. The cap defends against a hostile archive expanding to fill the device; a backup the
user just picked out of their own files is not that threat, and a hard refusal there strands real
history for a risk they are not exposed to.

BackupResult is matched in three places, not one. FolderBackup.backupNow treats an oversize write as
success - it did write the file, and the folder sync has nowhere to surface a warning. BackupSyncView
has no confirm step to hang the override on, so it names the limit and points at the import path that
does. CsvExport.ExportResult is a separate enum and is untouched.

The confirm alert reuses "Backup problem", "Restore" and "Cancel", which already carry all nine
locales. The i18n gate caught the first draft minting two new strings that would have shipped English
everywhere until someone translated them.

Android is deliberately not in this change: the same bug exists there, but exportTo returns Unit so
the warning needs a signature change, and the override needs a new ImportResult variant plus Compose
UI. Kept separate rather than half-done, so #1807 stays open.

Verified by app-build on both Apple targets - none of these files is built by any default CI job.
One risk only a device settles: the confirm alert presents the document picker while dismissing, and
a presentation started from an alert action can be dropped if the dismissal has not finished.

Refs #1807.
---
 Strand/Data/BackupSync.swift        |  8 ++++-
 Strand/Data/DataBackup.swift        | 56 +++++++++++++++++++++++------
 Strand/Screens/BackupSyncView.swift |  9 ++++-
 Strand/Screens/SettingsView.swift   | 30 ++++++++++++++--
 4 files changed, 89 insertions(+), 14 deletions(-)

diff --git a/Strand/Data/BackupSync.swift b/Strand/Data/BackupSync.swift
index b485d7caee..af7b118340 100644
--- a/Strand/Data/BackupSync.swift
+++ b/Strand/Data/BackupSync.swift
@@ -265,7 +265,13 @@ enum FolderBackup {
 
         let nowMs = Int(Date().timeIntervalSince1970 * 1000.0)
         let dest = folder.appendingPathComponent(BackupSync.snapshotName(nowMs))
-        guard case .exported = await DataBackup.writeBackup(checkpoint: checkpoint, to: dest) else { return false }
+        // #1807: an oversize write still WROTE the file, so it is a success here. The folder sync has
+        // nowhere to surface a warning and must not report failure for a backup that exists — the
+        // interactive export is where the user is told, because that is where they can act on it.
+        switch await DataBackup.writeBackup(checkpoint: checkpoint, to: dest) {
+        case .exported, .exportedOversize: break
+        default: return false
+        }
 
         UserDefaults.standard.set(nowMs, forKey: lastKey)
         prune(in: folder)
diff --git a/Strand/Data/DataBackup.swift b/Strand/Data/DataBackup.swift
index a37bfada2c..8b56e96aa4 100644
--- a/Strand/Data/DataBackup.swift
+++ b/Strand/Data/DataBackup.swift
@@ -27,7 +27,12 @@ import ZIPFoundation
 /// security-scoped access on the panel-returned URLs. Every path is best-effort — failures surface
 /// as a `.failure` result and never crash.
 enum DataBackup {
-    private static let maxBackupSQLiteBytes: Int64 = 2_147_483_648
+    /// Uncompressed ceiling for the SQLite entry, enforced while EXTRACTING (see `extractBackupZip`).
+    /// Deliberately measured on the decompressed stream: this is a zip-bomb guard, and a zip bomb is by
+    /// definition small compressed and enormous expanded, so a cap on the archive's own size would be
+    /// trivially defeated. Compressing harder cannot help a user past it — the backup is already
+    /// `.deflate`d and the count is of bytes landing on disk. (#1807)
+    static let maxBackupSQLiteBytes: Int64 = 2_147_483_648
     private static let maxBackupSettingsBytes: Int64 = 1_048_576
 
     // MARK: - Result
@@ -35,11 +40,21 @@ enum DataBackup {
     enum BackupResult {
         /// Export wrote the backup to `url`.
         case exported(URL)
+        /// Export wrote the backup, but the database is larger than [maxBackupSQLiteBytes], the ceiling
+        /// the restore path enforces. The file is valid and worth keeping — restoring it just needs the
+        /// user to confirm once. Reported at EXPORT time because the alternative is finding out during a
+        /// restore, which is exactly when the original is gone. (#1807)
+        case exportedOversize(URL, bytes: Int64, limit: Int64)
         /// Import succeeded; a relaunch is required for it to take effect. `sidecar` is where the
         /// previous database was preserved, in case the user wants to roll back.
         case imported(sidecar: URL)
         /// The user dismissed the save/open panel — nothing happened, show nothing loud.
         case cancelled
+        /// The restore stopped ONLY because an entry exceeds the size ceiling. Distinct from `failure`
+        /// so the caller can offer to go ahead anyway: the cap is a decompression guard against a hostile
+        /// archive, and a backup the user just picked out of their own files is a different threat model
+        /// than the one it defends against. (#1807)
+        case restoreTooLarge(name: String, limit: Int64)
         /// Something went wrong; `message` is user-facing.
         case failure(String)
     }
@@ -94,7 +109,7 @@ enum DataBackup {
             try await Task.detached(priority: .utility) {
                 try writeVerifiedBackupZip(dbURL: dbURL, to: dest, settingsJSON: currentSettingsJSON())
             }.value
-            return .exported(dest)
+            return exportOutcome(dest, dbURL: dbURL)
         } catch {
             return .failure(String(localized: "Export failed: \(error.localizedDescription)"))
         }
@@ -113,7 +128,7 @@ enum DataBackup {
             return .failure(String(localized: "Export failed: \(error.localizedDescription)"))
         }
         guard let dest = await DocumentPicker.export(staged) else { return .cancelled }
-        return .exported(dest)
+        return exportOutcome(dest, dbURL: dbURL)
         #endif
     }
 
@@ -144,6 +159,17 @@ enum DataBackup {
     /// when the original data may be long gone; failing loudly NOW is the honest move. The read-only
     /// probe sits safely beside the app's open GRDB pool (WAL allows concurrent readers).
     /// `writeBackupForTesting` deliberately bypasses this so tests can build damaged containers.
+    /// `.exported`, or `.exportedOversize` when the database is past the ceiling the restore path
+    /// enforces. Measured on the DATABASE, not the finished archive: the archive is `.deflate`d and the
+    /// cap the restore checks counts the DECOMPRESSED stream, so the zip's own size says nothing about
+    /// whether it can be read back. (#1807)
+    private static func exportOutcome(_ dest: URL, dbURL: URL) -> BackupResult {
+        let attrs = try? FileManager.default.attributesOfItem(atPath: dbURL.path)
+        guard let bytes = (attrs?[.size] as? NSNumber)?.int64Value,
+              bytes > maxBackupSQLiteBytes else { return .exported(dest) }
+        return .exportedOversize(dest, bytes: bytes, limit: maxBackupSQLiteBytes)
+    }
+
     private static func writeVerifiedBackupZip(dbURL: URL, to dest: URL, settingsJSON: Data?) throws {
         if let complaint = DatabaseIntegrity.quickCheckFailure(atPath: dbURL.path) {
             throw ExportIntegrityFailure(complaint: complaint)
@@ -246,7 +272,7 @@ enum DataBackup {
             let fm = FileManager.default
             if fm.fileExists(atPath: dest.path) { try fm.removeItem(at: dest) }
             try writeVerifiedBackupZip(dbURL: dbURL, to: dest, settingsJSON: currentSettingsJSON())
-            return .exported(dest)
+            return exportOutcome(dest, dbURL: dbURL)
         } catch {
             return .failure(String(localized: "Backup failed: \(error.localizedDescription)"))
         }
@@ -273,7 +299,7 @@ enum DataBackup {
     /// siblings). The store stays open, so the swapped-in file only takes effect after a relaunch —
     /// the caller informs the user.
     @MainActor
-    static func runImport() async -> BackupResult {
+    static func runImport(allowOversize: Bool = false) async -> BackupResult {
         let dbPath: String
         do { dbPath = try StorePaths.defaultDatabasePath() }
         catch { return .failure(String(localized: "Couldn't locate the NOOP database. \(error.localizedDescription)")) }
@@ -305,7 +331,7 @@ enum DataBackup {
         // stays valid because the surrounding function is still awaiting here. Only Sendable value
         // types (URL, String) cross the hop; the result hops back to main for handleBackup.
         return await Task.detached(priority: .utility) {
-            restore(from: pickedSource, toDatabaseAt: dbPath)
+            restore(from: pickedSource, toDatabaseAt: dbPath, allowOversize: allowOversize)
         }.value
     }
 
@@ -330,7 +356,8 @@ enum DataBackup {
     /// `settingsDefaults` is where a `settings.json` entry (#1000) is re-applied — injected for the
     /// same reason as `dbPath` (tests use a suite-scoped UserDefaults, never the runner's real domain).
     static func restore(from pickedSource: URL, toDatabaseAt dbPath: String,
-                        settingsDefaults: UserDefaults = .standard) -> BackupResult {
+                        settingsDefaults: UserDefaults = .standard,
+                        allowOversize: Bool = false) -> BackupResult {
         // If the picked file is a .noopbak ZIP, extract the SQLite entry to a temp dir first.
         // Legacy plain-SQLite files fall straight through. The extracted dir is cleaned up below.
         let fm = FileManager.default
@@ -343,7 +370,15 @@ enum DataBackup {
             do {
                 if fm.fileExists(atPath: tmpExtract.path) { try fm.removeItem(at: tmpExtract) }
                 try fm.createDirectory(at: tmpExtract, withIntermediateDirectories: true)
-                try extractBackupZip(at: pickedSource, into: tmpExtract)
+                try extractBackupZip(at: pickedSource, into: tmpExtract, allowOversize: allowOversize)
+            } catch let err as BackupArchiveError {
+                try? fm.removeItem(at: tmpExtract)
+                // Reported as its own case, not a generic failure: this one is RECOVERABLE, and the caller
+                // is the only layer that can ask the user whether to go ahead. (#1807)
+                switch err {
+                case .entryTooLarge(let name):
+                    return .restoreTooLarge(name: name, limit: maxBackupSQLiteBytes)
+                }
             } catch {
                 try? fm.removeItem(at: tmpExtract)
                 return .failure(String(localized: "Couldn't open the backup archive: \(error.localizedDescription)"))
@@ -591,14 +626,15 @@ enum DataBackup {
     /// Extract only the canonical entries from a `.noopbak` ZIP at `zipURL` into `destDir`.
     /// Unknown files are ignored, and each accepted entry is streamed through an uncompressed-size cap
     /// before it lands on disk.
-    private static func extractBackupZip(at zipURL: URL, into destDir: URL) throws {
+    private static func extractBackupZip(at zipURL: URL, into destDir: URL,
+                                         allowOversize: Bool = false) throws {
         let archive = try Archive(url: zipURL, accessMode: .read)
         for entry in archive where entry.type == .file {
             let name = (entry.path as NSString).lastPathComponent
             let limit: Int64
             switch name {
             case backupEntryName:
-                limit = maxBackupSQLiteBytes
+                limit = allowOversize ? Int64.max : maxBackupSQLiteBytes
             case BackupSettings.entryName:
                 limit = maxBackupSettingsBytes
             default:
diff --git a/Strand/Screens/BackupSyncView.swift b/Strand/Screens/BackupSyncView.swift
index 599aa35942..1c246ce5fa 100644
--- a/Strand/Screens/BackupSyncView.swift
+++ b/Strand/Screens/BackupSyncView.swift
@@ -270,7 +270,14 @@ struct BackupSyncView: View {
                     alertMessage = String(localized: "Fully quit and reopen NOOP to load it.")
                 case .failure(let m):
                     alertTitle = String(localized: "Restore problem"); alertMessage = m
-                case .cancelled, .exported:
+                case .restoreTooLarge(let name, let limit):
+                    // #1807: recoverable, but not from here — this view restores a snapshot directly and
+                    // has no confirm step to hang the override on. Point at the path that does, rather
+                    // than leaving the user with a refusal and nowhere to go.
+                    let cap = ByteCountFormatter.string(fromByteCount: limit, countStyle: .file)
+                    alertTitle = String(localized: "Backup problem")
+                    alertMessage = String(localized: "\(name) is larger than the \(cap) NOOP restores without asking. You can still restore it from Settings → Backup & restore → Import, which will ask you to confirm.")
+                case .cancelled, .exported, .exportedOversize:
                     alertTitle = String(localized: "Restore problem"); alertMessage = String(localized: "Couldn't restore that backup.")
                 }
                 showAlert = true
diff --git a/Strand/Screens/SettingsView.swift b/Strand/Screens/SettingsView.swift
index aaeab206be..78971c7554 100644
--- a/Strand/Screens/SettingsView.swift
+++ b/Strand/Screens/SettingsView.swift
@@ -35,6 +35,10 @@ struct SettingsView: View {
     @State private var backupAlertTitle = ""
     @State private var backupAlertMessage = ""
     @State private var showBackupAlert = false
+    /// #1807: a restore refused ONLY for size is recoverable, so it gets its own two-button alert rather
+    /// than the shared single-OK one every other backup outcome uses.
+    @State private var showOversizeRestoreConfirm = false
+    @State private var oversizeRestoreMessage = ""
 
     /// Opt-in WHOOP 5/MG protocol experiments (off by default). See [PuffinExperiment].
     @AppStorage(PuffinExperiment.defaultsKey) private var puffinExperiments = false
@@ -348,6 +352,15 @@ struct SettingsView: View {
         } message: {
             Text(backupAlertMessage)
         }
+        // Title and buttons reuse catalogue strings that already carry all nine locales, rather than
+        // minting new copy that would ship English everywhere until someone translated it. The message
+        // below is where the specifics live. (#1807)
+        .alert("Backup problem", isPresented: $showOversizeRestoreConfirm) {
+            Button("Restore") { runImport(allowOversize: true) }
+            Button("Cancel", role: .cancel) { }
+        } message: {
+            Text(oversizeRestoreMessage)
+        }
         .confirmationDialog("Recalibrate your Charge baseline?",
                             isPresented: $showRecalibrateConfirm, titleVisibility: .visible) {
             Button("Recalibrate") { recalibrateHrvBaseline() }
@@ -2576,10 +2589,10 @@ struct SettingsView: View {
         }
     }
 
-    private func runImport() {
+    private func runImport(allowOversize: Bool = false) {
         backupBusy = true
         Task {
-            let result = await DataBackup.runImport()
+            let result = await DataBackup.runImport(allowOversize: allowOversize)
             handleBackup(result)
         }
     }
@@ -2614,6 +2627,19 @@ struct SettingsView: View {
             backupAlertTitle = String(localized: "Backup exported")
             backupAlertMessage = String(localized: "Saved to \(url.lastPathComponent). Copy this file to your other \(Platform.deviceNoun) and use Import there to restore everything.")
             showBackupAlert = true
+        case .exportedOversize(let url, let bytes, let limit):
+            // #1807: the file is written and worth keeping — say so first, then say what restoring it
+            // will ask for. The old behaviour said nothing here and refused at restore, which is the
+            // one moment the original is already gone.
+            let size = ByteCountFormatter.string(fromByteCount: bytes, countStyle: .file)
+            let cap = ByteCountFormatter.string(fromByteCount: limit, countStyle: .file)
+            backupAlertTitle = String(localized: "Backup exported")
+            backupAlertMessage = String(localized: "Saved to \(url.lastPathComponent). Your database is \(size), over the \(cap) NOOP restores without asking — the backup is complete and valid, and restoring it will ask you to confirm once.")
+            showBackupAlert = true
+        case .restoreTooLarge(let name, let limit):
+            let cap = ByteCountFormatter.string(fromByteCount: limit, countStyle: .file)
+            oversizeRestoreMessage = String(localized: "\(name) is larger than the \(cap) NOOP restores without asking. That limit guards against a malicious archive expanding to fill this \(Platform.deviceNoun) — a backup you exported yourself is not that. Restoring it needs the space the database will take. You'll be asked to choose the file again.")
+            showOversizeRestoreConfirm = true
         case .imported:
             backupAlertTitle = String(localized: "Backup imported")
             backupAlertMessage = String(localized: "Your data has been restored. Quit and reopen NOOP for it to take effect.")

From 1e3e75a7c86cfeac54ce01b7de54a43245ecb72a Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 21:13:51 +1200
Subject: [PATCH 165/333] =?UTF-8?q?backup:=20Android=20half=20=E2=80=94=20?=
 =?UTF-8?q?warn=20at=20export,=20and=20let=20a=20user=20restore=20an=20ove?=
 =?UTF-8?q?rsize=20backup=20(#1810)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Android half of #1807, matching #1808 on Apple. The 2 GiB cap on the SQLite entry is enforced only
while restoring, so NOOP writes archives it later refuses to read, and the user finds out at the one
moment the original is gone.

exportTo returns ExportOutcome instead of Unit, so the interactive export says when the database is
past the ceiling. The staging refusal surfaces as ImportResult.TooLarge rather than Failed, and
Settings offers to go ahead - retrying the SAME file, since Android keeps a usable uri across the
dialog where Apple has to send the user back through the picker. BackupSyncScreen has no confirm step
to hang the override on, so it shows the same sentence and points at Settings.

No new untranslated copy, which shaped the design: the i18n ratchet refused an English-only body in
six locales, so TooLarge carries the sentence the old Failed branch already showed and the buttons
reuse existing keys.

Three things review caught before this landed. The reported size was dbFile.length() read AFTER the
transaction that writes the entry, so it could disagree with the entry the cap actually measures -
now taken from copyTo's own return. The export test was tautological, asserting a boolean it had
computed itself - now it calls the decision, which pinned that a database exactly AT the cap still
restores. And the new dialog landed below a comment about something else, leaving that comment
documenting it and its own block undocumented fifty lines down.

One more, worth its own issue (#1811): the Restore string is copied verbatim per locale to avoid
inventing translations, and in pt-PT it faithfully copied a corrupt one - "Descansoaurar", which is
"Restaurar" with Rest replaced by Descanso by a find/replace localising the Rest metric. Mine reads
Restaurar; the four pre-existing corrupted entries are filed rather than folded in here. No gate
catches that class: it is present, non-empty and not English, so the audit passes it.

32 backup tests, 0 failures. compileFullDebugKotlin, i18n_audit --ci, doc_comment_lint and
lintVitalFullRelease all clean. No app-build needed - this touches none of its paths.

Refs #1807.
---
 .../src/main/java/com/noop/data/DataBackup.kt | 73 +++++++++++++++++--
 .../main/java/com/noop/ui/BackupSyncScreen.kt |  5 ++
 .../main/java/com/noop/ui/SettingsScreen.kt   | 73 +++++++++++++++++--
 .../app/src/main/res/values-de/strings.xml    |  1 +
 .../app/src/main/res/values-es/strings.xml    |  1 +
 .../app/src/main/res/values-fr/strings.xml    |  1 +
 .../app/src/main/res/values-pl/strings.xml    |  1 +
 .../src/main/res/values-pt-rPT/strings.xml    |  1 +
 .../app/src/main/res/values-zh/strings.xml    |  1 +
 android/app/src/main/res/values/strings.xml   |  1 +
 .../noop/data/BackupOversizeOverrideTest.kt   | 60 +++++++++++++++
 11 files changed, 204 insertions(+), 14 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/data/BackupOversizeOverrideTest.kt

diff --git a/android/app/src/main/java/com/noop/data/DataBackup.kt b/android/app/src/main/java/com/noop/data/DataBackup.kt
index 32d74b871e..20cc912522 100644
--- a/android/app/src/main/java/com/noop/data/DataBackup.kt
+++ b/android/app/src/main/java/com/noop/data/DataBackup.kt
@@ -50,7 +50,7 @@ object DataBackup {
     // restored). Written LAST so older importers that stop at the first .sqlite entry are unaffected.
     private const val MANIFEST_ENTRY_NAME = BackupManifest.ENTRY_NAME
 
-    private const val MAX_BACKUP_SQLITE_BYTES = 2_147_483_648L
+    internal const val MAX_BACKUP_SQLITE_BYTES = 2_147_483_648L
     private const val MAX_BACKUP_SETTINGS_BYTES = 1_048_576L
 
     /** First 16 bytes of every SQLite 3 file: "SQLite format 3\0". */
@@ -101,8 +101,27 @@ object DataBackup {
 
         /** Import failed and the original database is untouched. */
         data class Failed(val message: String) : ImportResult
+
+        /**
+         * The restore stopped ONLY because an entry exceeds [MAX_BACKUP_SQLITE_BYTES]. Distinct from
+         * [Failed] so the caller can offer to go ahead: the cap is a decompression guard against a
+         * hostile archive, and a backup the user just picked out of their own files is a different
+         * threat model than the one it defends against. (#1807)
+         */
+        data class TooLarge(val message: String, val limitBytes: Long) : ImportResult
     }
 
+    /**
+     * What an export produced. [overRestoreCeiling] is true when the database is past the ceiling the
+     * RESTORE path enforces, so the caller can say so while the user still has their data — the
+     * alternative is finding out during a restore, which is the one moment the original is gone.
+     *
+     * Measured on the DATABASE, not the finished archive: the archive is deflated and the cap counts the
+     * DECOMPRESSED stream, so the zip's own size says nothing about whether it can be read back. That is
+     * also why compressing harder cannot help anyone past it. (#1807)
+     */
+    data class ExportOutcome(val bytes: Long, val overRestoreCeiling: Boolean, val limitBytes: Long)
+
     /**
      * Export the live database to [uri] as a compressed `.noopbak` (single-entry ZIP).
      *
@@ -111,7 +130,7 @@ object DataBackup {
      * Throws on failure so the caller can surface the message in a toast/snackbar.
      */
     @Throws(IOException::class)
-    fun exportTo(context: Context, uri: Uri) {
+    fun exportTo(context: Context, uri: Uri): ExportOutcome {
         val appContext = context.applicationContext
 
         // Fold the WAL back into the main file so the snapshot is complete.
@@ -155,6 +174,8 @@ object DataBackup {
         val resolver = appContext.contentResolver
         val output = resolver.openOutputStream(uri)
             ?: throw IOException("Could not open the chosen file for writing.")
+        // Assigned inside the transaction below, where the entry is actually written.
+        var entryBytes = 0L
         output.use { out ->
             // #1014: copy the file while HOLDING Room's write transaction. In WAL mode the main
             // file is only rewritten by a checkpoint, and a checkpoint only runs on a commit — so
@@ -166,7 +187,12 @@ object DataBackup {
             db.runInTransaction {
                 ZipOutputStream(out).use { zip ->
                     zip.putNextEntry(ZipEntry(ZIP_ENTRY_NAME))
-                    dbFile.inputStream().use { input -> input.copyTo(zip) }
+                    // #1807: count what actually LANDS in the entry, rather than reading dbFile.length()
+                    // afterwards. The copy runs inside this transaction against a snapshot; once it
+                    // commits, Room can checkpoint again and the main file's length can move, so a later
+                    // read is a different number from the one the restore path will meet. The cap is
+                    // enforced on this entry, so this is the only measurement that answers the question.
+                    dbFile.inputStream().use { input -> entryBytes = input.copyTo(zip) }
                     zip.closeEntry()
                     if (settingsJson != null) {
                         zip.putNextEntry(ZipEntry(SETTINGS_ENTRY_NAME))
@@ -179,6 +205,13 @@ object DataBackup {
                 }
             }
         }
+        // #1807: the file is written and valid either way — this only reports whether restoring it will
+        // need the user to confirm.
+        return ExportOutcome(
+            bytes = entryBytes,
+            overRestoreCeiling = overRestoreCeiling(entryBytes),
+            limitBytes = MAX_BACKUP_SQLITE_BYTES,
+        )
     }
 
     /**
@@ -190,7 +223,7 @@ object DataBackup {
      * On any error the current database is left exactly as it was. On success the caller
      * MUST instruct the user to fully restart the app.
      */
-    fun importFrom(context: Context, uri: Uri): ImportResult {
+    fun importFrom(context: Context, uri: Uri, allowOversize: Boolean = false): ImportResult {
         val appContext = context.applicationContext
         val resolver = appContext.contentResolver
 
@@ -214,7 +247,8 @@ object DataBackup {
         val tempSettings = File(appContext.cacheDir, "import-settings.json")
         tempSettings.delete()
         try {
-            when (stageBackupSqlite(resolver.openInputStream(uri), header, tempSqlite, tempSettings)) {
+            when (stageBackupSqlite(resolver.openInputStream(uri), header, tempSqlite, tempSettings,
+                                    allowOversize = allowOversize)) {
                 StageResult.OK -> Unit
                 StageResult.CANNOT_OPEN -> return ImportResult.Failed("Could not open the chosen file.")
                 StageResult.NO_DB_IN_ZIP -> {
@@ -224,7 +258,14 @@ object DataBackup {
                 StageResult.ENTRY_TOO_LARGE -> {
                     tempSqlite.delete()
                     tempSettings.delete()
-                    return ImportResult.Failed("The backup archive is too large to restore safely.")
+                    // #1807: recoverable, so the caller gets a case it can offer to override rather than
+                    // a dead-end message.
+                    // Carries the SAME sentence the old Failed branch showed, deliberately: it is already
+                    // in the audit baseline, so surfacing the override needs no new untranslated copy.
+                    return ImportResult.TooLarge(
+                        "The backup archive is too large to restore safely.",
+                        MAX_BACKUP_SQLITE_BYTES,
+                    )
                 }
                 StageResult.NOT_A_BACKUP -> return ImportResult.Failed(
                     "That file is not a NOOP backup - it doesn't look like a .noopbak archive or a SQLite database."
@@ -405,6 +446,8 @@ object DataBackup {
         header: ByteArray,
         dest: File,
         settingsDest: File? = null,
+        /** #1807: lift the SQLite cap for a file the USER chose. See [ImportResult.TooLarge]. */
+        allowOversize: Boolean = false,
     ): StageResult {
         if (input == null) return StageResult.CANNOT_OPEN
         input.use { stream ->
@@ -419,7 +462,7 @@ object DataBackup {
                                 !entry.isDirectory && !foundDb &&
                                     entry.name.substringAfterLast('/') == ZIP_ENTRY_NAME -> {
                                     FileOutputStream(dest).use { out ->
-                                        if (!copyBounded(zip, out, MAX_BACKUP_SQLITE_BYTES)) {
+                                        if (!copyBounded(zip, out, sqliteCap(allowOversize))) {
                                             dest.delete()
                                             return StageResult.ENTRY_TOO_LARGE
                                         }
@@ -446,7 +489,7 @@ object DataBackup {
                 }
                 header.startsWith(SQLITE_MAGIC) -> {
                     FileOutputStream(dest).use { out ->
-                        if (!copyBounded(stream, out, MAX_BACKUP_SQLITE_BYTES)) {
+                        if (!copyBounded(stream, out, sqliteCap(allowOversize))) {
                             dest.delete()
                             return StageResult.ENTRY_TOO_LARGE
                         }
@@ -458,6 +501,20 @@ object DataBackup {
         }
     }
 
+    /**
+     * Whether a database of [entryBytes] is past the ceiling the RESTORE path enforces (#1807).
+     *
+     * Strictly greater: a database exactly at the cap still restores, because `copyBounded` refuses only
+     * when a write would take it OVER. Extracted so the boundary is testable — proving it end to end
+     * would need a >2 GiB fixture, and a test that recomputes the comparison and asserts its own
+     * arithmetic proves nothing.
+     */
+    internal fun overRestoreCeiling(entryBytes: Long): Boolean = entryBytes > MAX_BACKUP_SQLITE_BYTES
+
+    /** The SQLite cap, lifted when the user has chosen to go ahead for a file they picked. (#1807) */
+    internal fun sqliteCap(allowOversize: Boolean): Long =
+        if (allowOversize) Long.MAX_VALUE else MAX_BACKUP_SQLITE_BYTES
+
     private fun copyBounded(input: java.io.InputStream, out: java.io.OutputStream, cap: Long): Boolean {
         val buffer = ByteArray(DEFAULT_BUFFER_SIZE)
         var total = 0L
diff --git a/android/app/src/main/java/com/noop/ui/BackupSyncScreen.kt b/android/app/src/main/java/com/noop/ui/BackupSyncScreen.kt
index 9a0fcbeeba..1c01b78856 100644
--- a/android/app/src/main/java/com/noop/ui/BackupSyncScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/BackupSyncScreen.kt
@@ -112,6 +112,11 @@ fun BackupSyncScreen() {
                 }
                 is DataBackup.ImportResult.Failed ->
                     Toast.makeText(context, r.message, Toast.LENGTH_LONG).show()
+                // #1807: recoverable, but not from here — this screen restores a folder snapshot
+                // directly and has no confirm step to hang the override on. Settings → Backup & restore
+                // → Import does, and shows the same sentence with a way through.
+                is DataBackup.ImportResult.TooLarge ->
+                    Toast.makeText(context, r.message, Toast.LENGTH_LONG).show()
             }
         }
     }
diff --git a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
index 0f0efdd104..6da2e4ffe3 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
@@ -519,6 +519,12 @@ fun SettingsScreen(
     }
 
     var backupBusy by remember { mutableStateOf(false) }
+    /**
+     * #1807: a restore refused ONLY for size, held with the uri that produced it so confirming can
+     * retry the SAME file. Android keeps a usable uri across the dialog, so unlike Apple there is no
+     * need to send the user back through the picker.
+     */
+    var oversizeRestore by remember { mutableStateOf<Pair<android.net.Uri, String>?>(null) }
 
     // #646/#651: LogExport's zip build + file read now run on Dispatchers.IO instead of blocking the
     // caller, so these buttons no longer freeze the UI — but nothing else stopped a second tap mid-export
@@ -713,12 +719,18 @@ fun SettingsScreen(
             }
             backupBusy = false
             result.fold(
-                onSuccess = {
-                    Toast.makeText(
-                        context,
-                        "Backup exported. Copy this file to your new phone and use Import there to restore everything.",
-                        Toast.LENGTH_LONG,
-                    ).show()
+                onSuccess = { outcome ->
+                    // #1807: the file is written and valid either way. When the database is past the
+                    // ceiling the RESTORE path enforces, say so NOW — the alternative is finding out
+                    // during a restore, which is the one moment the original is gone. The second
+                    // sentence is the refusal's own wording, reused so this adds no untranslated copy.
+                    val note = if (outcome.overRestoreCeiling) {
+                        "Backup exported. The backup archive is too large to restore safely — " +
+                            "restoring it will ask you to confirm."
+                    } else {
+                        "Backup exported. Copy this file to your new phone and use Import there to restore everything."
+                    }
+                    Toast.makeText(context, note, Toast.LENGTH_LONG).show()
                 },
                 onFailure = { e ->
                     Toast.makeText(context, "Backup problem: ${e.message}", Toast.LENGTH_LONG).show()
@@ -772,6 +784,11 @@ fun SettingsScreen(
                 is DataBackup.ImportResult.Failed -> Toast.makeText(
                     context, result.message, Toast.LENGTH_LONG,
                 ).show()
+                // #1807: refused ONLY for size, which is recoverable — offer to go ahead rather than
+                // ending on a Toast the user can do nothing about. The cap is a decompression guard
+                // against a hostile archive; a backup they just picked out of their own files is not
+                // that threat, and refusing outright strands real history.
+                is DataBackup.ImportResult.TooLarge -> oversizeRestore = uri to result.message
             }
         }
     }
@@ -3071,6 +3088,50 @@ fun SettingsScreen(
             }
         }
 
+        oversizeRestore?.let { (pendingUri, pendingMessage) ->
+            AlertDialog(
+                onDismissRequest = { oversizeRestore = null },
+                containerColor = Palette.surfaceOverlay,
+                // The message is the sentence the refusal already carried — reused rather than replaced,
+                // so surfacing the override adds no untranslated copy. Buttons reuse existing keys.
+                text = {
+                    Text(pendingMessage, style = NoopType.subhead, color = Palette.textSecondary)
+                },
+                confirmButton = {
+                    TextButton(onClick = {
+                        oversizeRestore = null
+                        backupBusy = true
+                        scope.launch {
+                            val again = withContext(Dispatchers.IO) {
+                                DataBackup.importFrom(context, pendingUri, allowOversize = true)
+                            }
+                            backupBusy = false
+                            val note = when (again) {
+                                is DataBackup.ImportResult.NeedsRestart ->
+                                    "Backup imported. Fully close and reopen NOOP for it to take effect."
+                                is DataBackup.ImportResult.Failed -> again.message
+                                is DataBackup.ImportResult.TooLarge -> again.message
+                            }
+                            Toast.makeText(context, note, Toast.LENGTH_LONG).show()
+                        }
+                    }) {
+                        Text(
+                            uiString(R.string.l10n_settings_screen_restore_3cbe6d6b),
+                            color = Palette.accent,
+                        )
+                    }
+                },
+                dismissButton = {
+                    TextButton(onClick = { oversizeRestore = null }) {
+                        Text(
+                            uiString(R.string.l10n_settings_screen_cancel_77dfd213),
+                            color = Palette.textSecondary,
+                        )
+                    }
+                },
+            )
+        }
+
         // #174: the switch going OFF is the moment to offer the undo. Declining leaves the flags set and
         // says so — still an improvement on the old behaviour, where the same tap silently left them set
         // with no indication either way.
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 3a210bcc52..661c5cc3b7 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -1493,6 +1493,7 @@
     <string name="l10n_settings_screen_broadcast_strap_hr_garmin_ant_a39d0654">Sendeband HR (Garmin/ANT)</string>
     <string name="l10n_settings_screen_buzz_the_time_on_your_strap_06fc879d">Buzz die Zeit auf Ihrem Gurt</string>
     <string name="l10n_settings_screen_cancel_77dfd213">Abbrechen</string>
+    <string name="l10n_settings_screen_restore_3cbe6d6b">Wiederherstellen</string>
     <string name="l10n_settings_screen_card_transparency_c5c7b4f3">Kartentransparenz</string>
     <string name="l10n_settings_screen_charge_d4e1aee4">Ladung</string>
     <string name="l10n_settings_screen_charge_effort_and_rest_and_how_d2c423a4">Ladung, Anstrengung und Ruhe und wie sie sich von WHOOP unterscheiden</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index a361eeda2d..e0fb193176 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -1293,6 +1293,7 @@
     <string name="l10n_settings_screen_broadcast_strap_hr_garmin_ant_a39d0654">Correa de radio HR (Garmin/ANT)</string>
     <string name="l10n_settings_screen_buzz_the_time_on_your_strap_06fc879d">Buzz el tiempo en tu correa</string>
     <string name="l10n_settings_screen_cancel_77dfd213">Cancelar</string>
+    <string name="l10n_settings_screen_restore_3cbe6d6b">Restaurar</string>
     <string name="l10n_settings_screen_card_transparency_c5c7b4f3">Transparencia de las tarjetas</string>
     <string name="l10n_settings_screen_charge_d4e1aee4">Carga</string>
     <string name="l10n_settings_screen_charge_effort_and_rest_and_how_d2c423a4">Carga, esfuerzo y descanso, y cómo difieren de WHOOP</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index bb308f9242..2e332e0cd6 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -1311,6 +1311,7 @@
     <string name="l10n_settings_screen_broadcast_strap_hr_garmin_ant_a39d0654">Diffusion de la FC du bracelet (Garmin/ANT)</string>
     <string name="l10n_settings_screen_buzz_the_time_on_your_strap_06fc879d">Buzz l\'heure sur votre bracelet</string>
     <string name="l10n_settings_screen_cancel_77dfd213">Annuler</string>
+    <string name="l10n_settings_screen_restore_3cbe6d6b">Restaurer</string>
     <string name="l10n_settings_screen_card_transparency_c5c7b4f3">Transparence des cartes</string>
     <string name="l10n_settings_screen_charge_d4e1aee4">Charge</string>
     <string name="l10n_settings_screen_charge_effort_and_rest_and_how_d2c423a4">Charge, effort et repos, et comment ils diffèrent de WHOOP</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index ba12d8a016..a50c1fef05 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -1450,6 +1450,7 @@
     <string name="l10n_settings_screen_broadcast_strap_hr_garmin_ant_a39d0654">Pasek nadawczy HR (Garmin/ANT)</string>
     <string name="l10n_settings_screen_buzz_the_time_on_your_strap_06fc879d">Zasygnalizuj godzinę na pasku</string>
     <string name="l10n_settings_screen_cancel_77dfd213">Anuluj</string>
+    <string name="l10n_settings_screen_restore_3cbe6d6b">Przywrócić</string>
     <string name="l10n_settings_screen_card_transparency_c5c7b4f3">Przejrzystość karty</string>
     <string name="l10n_settings_screen_charge_d4e1aee4">Energia</string>
     <string name="l10n_settings_screen_charge_effort_and_rest_and_how_d2c423a4">Energia, Wysiłek i Odpoczynek oraz czym różnią się od WHOOP</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 14e60e3807..b9b97f7af2 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -1456,6 +1456,7 @@
     <string name="l10n_settings_screen_broadcast_strap_hr_garmin_ant_a39d0654">Pega de transmissão HR (Garmin/ANT)</string>
     <string name="l10n_settings_screen_buzz_the_time_on_your_strap_06fc879d">Avise a hora na tua bracelete</string>
     <string name="l10n_settings_screen_cancel_77dfd213">Cancelar</string>
+    <string name="l10n_settings_screen_restore_3cbe6d6b">Restaurar</string>
     <string name="l10n_settings_screen_card_transparency_c5c7b4f3">Transparência do cartão</string>
     <string name="l10n_settings_screen_charge_d4e1aee4">Carga</string>
     <string name="l10n_settings_screen_charge_effort_and_rest_and_how_d2c423a4">Carga, Esforço e Descanso, e como diferem do WHOOP</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index ea3bd99148..a16e0affb4 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -1436,6 +1436,7 @@
     <string name="l10n_settings_screen_broadcast_strap_hr_garmin_ant_a39d0654">广播手环心率 (适配 Garmin/ANT)</string>
     <string name="l10n_settings_screen_buzz_the_time_on_your_strap_06fc879d">在手环上通过震动播报时间</string>
     <string name="l10n_settings_screen_cancel_77dfd213">取消</string>
+    <string name="l10n_settings_screen_restore_3cbe6d6b">恢复</string>
     <string name="l10n_settings_screen_card_transparency_c5c7b4f3">卡片透明度</string>
     <string name="l10n_settings_screen_charge_d4e1aee4">充能(Charge)</string>
     <string name="l10n_settings_screen_charge_effort_and_rest_and_how_d2c423a4">充能(Charge)、负荷(Effort)与恢复(Rest)，以及它们与官方 WHOOP 指标的区别</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index c38d6affbe..68f052e8e5 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -1589,6 +1589,7 @@
     <string name="l10n_settings_screen_broadcast_strap_hr_garmin_ant_a39d0654">Broadcast strap HR (Garmin/ANT)</string>
     <string name="l10n_settings_screen_buzz_the_time_on_your_strap_06fc879d">Buzz the time on your strap</string>
     <string name="l10n_settings_screen_cancel_77dfd213">Cancel</string>
+    <string name="l10n_settings_screen_restore_3cbe6d6b">Restore</string>
     <string name="l10n_settings_screen_card_transparency_c5c7b4f3">Card transparency</string>
     <string name="l10n_settings_screen_charge_d4e1aee4">Charge</string>
     <string name="l10n_settings_screen_charge_effort_and_rest_and_how_d2c423a4">Charge, Effort and Rest, and how they differ from WHOOP</string>
diff --git a/android/app/src/test/java/com/noop/data/BackupOversizeOverrideTest.kt b/android/app/src/test/java/com/noop/data/BackupOversizeOverrideTest.kt
new file mode 100644
index 0000000000..b2432a82f7
--- /dev/null
+++ b/android/app/src/test/java/com/noop/data/BackupOversizeOverrideTest.kt
@@ -0,0 +1,60 @@
+package com.noop.data
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The oversize restore override (#1807).
+ *
+ * The cap itself cannot be exercised end-to-end here — proving it needs a >2 GiB fixture — so what is
+ * pinned is the decision that governs it, plus the shape of the result the UI keys on. The behaviour
+ * these guard is not cosmetic: NOOP wrote archives it then refused to read, and the refusal arrived at
+ * the one moment the original was already gone.
+ */
+class BackupOversizeOverrideTest {
+
+    /** Default enforces the guard; the override lifts it entirely, for a file the user chose. */
+    @Test
+    fun `the cap is enforced by default and lifted only on request`() {
+        assertEquals(DataBackup.MAX_BACKUP_SQLITE_BYTES, DataBackup.sqliteCap(false))
+        assertEquals(Long.MAX_VALUE, DataBackup.sqliteCap(true))
+    }
+
+    /** 2 GiB exactly. Pinned because it is `2^31`, so moving it may not be free. */
+    @Test
+    fun `the ceiling is two gibibytes`() {
+        assertEquals(2_147_483_648L, DataBackup.MAX_BACKUP_SQLITE_BYTES)
+    }
+
+    /**
+     * `TooLarge` is a separate result from `Failed` so the caller can offer a way through rather than
+     * ending on a message the user can do nothing about, and it carries the limit so the caller never
+     * has to restate the number.
+     */
+    @Test
+    fun `a size refusal is its own result and carries the limit`() {
+        val r: DataBackup.ImportResult =
+            DataBackup.ImportResult.TooLarge("too large", DataBackup.MAX_BACKUP_SQLITE_BYTES)
+        assertTrue("must not be indistinguishable from a generic failure",
+            r !is DataBackup.ImportResult.Failed)
+        assertEquals(DataBackup.MAX_BACKUP_SQLITE_BYTES, (r as DataBackup.ImportResult.TooLarge).limitBytes)
+    }
+
+    /**
+     * The export-side decision, at its boundary. The earlier version of this test built an
+     * `ExportOutcome` with the comparison already evaluated and then asserted that boolean back — it
+     * proved its own arithmetic and nothing about the code. This calls the decision itself.
+     *
+     * Strictly greater is the correct boundary: a database exactly at the cap still restores, because
+     * `copyBounded` refuses only when a write would take it OVER.
+     */
+    @Test
+    fun `only a database past the ceiling is flagged`() {
+        val cap = DataBackup.MAX_BACKUP_SQLITE_BYTES
+        assertTrue("one byte over must be flagged", DataBackup.overRestoreCeiling(cap + 1))
+        assertTrue("exactly at the cap still restores", !DataBackup.overRestoreCeiling(cap))
+        assertTrue("well under must not be flagged", !DataBackup.overRestoreCeiling(cap - 1))
+        assertTrue("an empty database is not oversize", !DataBackup.overRestoreCeiling(0L))
+    }
+}

From b6cb5f7aa8eb15fe9195b892edb8ac341b34a8f3 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 22:05:27 +1200
Subject: [PATCH 166/333] sleep: give the HR-only spine a funnel line, because
 it shipped silent (#1812)

#1801 landed a whole detection path that emits nothing. A field log on 11.1.0 build 412 then showed
NO-NIGHT reason=no-motion with provided=0 and no way to tell whether the spine had run and found
nothing or never ran at all - zero mentions of it in 3,702 lines. Wrong shape for a file whose entire
sleep story is a funnel, and the no-motion comment had been reworded to claim heart rate was tried
while leaving nothing to show for it.

Two lines now. The spine's own funnel names what it derived and where the candidates went - anchor
and band, the wearer's p50/p90 spread, epochs, raw runs, merged, sleep runs, longest candidate,
staged and kept. anchorBpm and bandBpm are printed because they are DERIVED, not configured: the
anchor is a percentile of the wearer's own window, so the same code hands every wearer a different
threshold. sleepRuns against longestMin separates the two failures that actually happen, a band too
tight from a duration gate eating real runs.

And a gate line, because the funnel only exists when the spine is CALLED - so its absence carried the
same ambiguity one layer up. Every day with no motion now states the decision: attempted, or skipped
for a stored hypnogram, or for an imported owner. A day WITH motion prints nothing.

Six passes of review, each finding something the last had introduced. The rounding diverged: round1
used String.format against String(format:), which are not twins - Java rounds HALF_UP on the decimal
expansion, Swift half-to-even on the binary value, so 64.05 gave Kotlin 64.1 and Swift 64.0 on a line
whose whole purpose is side-by-side comparison. Both now multiply and round, verified across ten
values on both toolchains. The Apple sink was ungated and would have collected on every scored day.
The line was Kotlin-only on a twinned path. epochs reported the SAMPLE count. Three percentiles meant
three full sorts of ~160k samples per scored day, and the epoch count boxed every sample to find a few
thousand keys - both the allocation shape #707 names under the OOM, now one sort and no set.

A guard test caught its own brittleness: it asserted the gate within 1200 characters of the call,
measuring proximity, and broke when two diagnostic lines were inserted while the gate still held. Now
scoped to the expression and asserting containment.

Both platforms. 26 HR-only tests, 0 failures; CI ran the Swift twins for real.

Refs #1801.
---
 .../StrandAnalytics/SleepStager+Trace.swift   |  48 +++++++++
 .../Sources/StrandAnalytics/SleepStager.swift |  73 +++++++++++--
 .../SleepStagerHrOnlyTraceTests.swift         |  57 ++++++++++
 Strand/Data/IntelligenceEngine.swift          |  28 ++++-
 .../com/noop/analytics/IntelligenceEngine.kt  |  26 ++++-
 .../java/com/noop/analytics/SleepStager.kt    |  90 ++++++++++++++--
 .../com/noop/analytics/SleepStagerTrace.kt    |  56 ++++++++++
 .../analytics/SleepStagerHrOnlyAnchorTest.kt  |  19 ++++
 .../SleepStagerHrOnlySessionsTest.kt          |  18 +++-
 .../analytics/SleepStagerHrOnlyTraceTest.kt   | 101 ++++++++++++++++++
 10 files changed, 495 insertions(+), 21 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerHrOnlyTraceTests.swift
 create mode 100644 android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlyTraceTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager+Trace.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager+Trace.swift
index 659b9dabac..36118ee2e2 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager+Trace.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager+Trace.swift
@@ -15,6 +15,54 @@ extension SleepStager {
     /// The gate-trace line formatters. Compact, parseable, no em-dashes.
     public enum GateTrace {
 
+        /// Why the HR-only spine did or did not run (#1801). Twin of the Kotlin `hrOnlyGateLine`.
+        ///
+        /// The funnel line below only exists when the spine is CALLED, so its absence was ambiguous in
+        /// exactly the way that made the first field report unreadable: it could mean the gate never
+        /// opened, or that the sink was never wired. This says which, on any day with no motion — the
+        /// only days where the question arises.
+        public static func hrOnlyGateLine(attempted: Bool, reason: String,
+                                          gravRows: Int, storedNights: Int) -> String {
+            "[sleep] hr-only gate attempted=\(attempted) reason=\(reason) "
+                + "grav=\(gravRows) stored=\(storedNights)"
+        }
+
+        /// The HR-only spine's own funnel line (#1801). Byte-identical twin of the Kotlin
+        /// `SleepStagerTrace.hrOnlyLine`, so an Android and an Apple log of the same night compare
+        /// directly — which is the entire reason these formatters are twinned at all.
+        ///
+        /// The path shipped SILENT on both platforms, and a field log then showed `reason=no-motion`
+        /// with no way to tell whether the spine had run and found nothing or never ran. Every number
+        /// separates the two failures that actually happen: a band too tight (`sleepRuns` near zero)
+        /// from a duration gate eating real runs (`sleepRuns` high, `longestMin` under `minSleepMin`).
+        ///
+        /// `anchorBpm` and `bandBpm` are printed because they are DERIVED, not configured: the anchor is
+        /// a percentile of THIS window, so the same code gives every wearer a different threshold.
+        public static func hrOnlyLine(anchorBpm: Double?, bandBpm: Double?,
+                                      hrP50: Double?, hrP90: Double?, epochs: Int,
+                                      runs: Int, mergedRuns: Int, sleepRuns: Int,
+                                      longestSleepMin: Int, staged: Int, kept: Int,
+                                      minSleepMin: Int) -> String {
+            "[sleep] hr-only spine anchorBpm=\(round1(anchorBpm)) bandBpm=\(round1(bandBpm)) "
+                + "hrP50=\(round1(hrP50)) hrP90=\(round1(hrP90)) "
+                + "epochs=\(epochs) runs=\(runs) merged=\(mergedRuns) sleepRuns=\(sleepRuns) "
+                + "longestMin=\(longestSleepMin) staged=\(staged) kept=\(kept) minSleepMin=\(minSleepMin)"
+        }
+
+        /// One decimal, by ARITHMETIC rather than `String(format:)`. Twin of the Kotlin `round1`, and
+        /// see its note: `printf` rounds half-to-even on the binary value while Java's `String.format`
+        /// rounds HALF_UP on the decimal expansion, so the two disagreed on 64.05. This does the same
+        /// IEEE arithmetic on both platforms and cannot.
+        ///
+        /// NON-NEGATIVE ONLY, same as the Kotlin twin: `-0.5` would print "0.5", because the integer
+        /// division truncates toward zero and the sign is then lost to `abs`. Every current caller is a
+        /// bpm, which cannot be negative.
+        private static func round1(_ v: Double?) -> String {
+            guard let v else { return "nil" }
+            let tenths = Int((v * 10.0).rounded())
+            return "\(tenths / 10).\(abs(tenths % 10))"
+        }
+
         /// One verdict line for a candidate run. `gate` names the constant that decided it
         /// (minSleepMin, maxMainSleepSpanS, offWrist, daytimeGuard, morningStillness, hrConfirm,
         /// sparseBridge, accepted); `detail` carries that gate's numbers. `startTs`/`endTs` give the
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
index 6432437438..e4ec29ee61 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
@@ -514,12 +514,40 @@ public enum SleepStager {
     /// the value is always one the wearer actually recorded and the two platforms cannot disagree on a
     /// rounding rule.
     static func hrOnlyBaseline(_ hr: [HRSample]) -> Double? {
-        if hr.isEmpty { return nil }
-        let sorted = hr.map { Double($0.bpm) }.sorted()
-        let idx = min(max(Int(Double(sorted.count - 1) * hrOnlyAnchorPercentile), 0), sorted.count - 1)
+        hrPercentile(hr, hrOnlyAnchorPercentile)
+    }
+
+    /// The `p` percentile of `hr` by bpm, nearest-rank. Shared with `hrOnlyBaseline` so the spread the
+    /// trace reports is measured by the SAME rule as the anchor it is meant to be judged against.
+    static func hrPercentile(_ hr: [HRSample], _ p: Double) -> Double? {
+        percentileOfSorted(hr.map { Double($0.bpm) }.sorted(), p)
+    }
+
+    /// The `p` percentile of an ALREADY-SORTED bpm list, nearest-rank. Split out because the caller
+    /// needs three percentiles from the same window, and the obvious spelling sorts once per
+    /// percentile — ~160k samples sorted three times per scored day across a 21-day rescore.
+    static func percentileOfSorted(_ sorted: [Double], _ p: Double) -> Double? {
+        if sorted.isEmpty { return nil }
+        let idx = min(max(Int(Double(sorted.count - 1) * p), 0), sorted.count - 1)
         return sorted[idx]
     }
 
+    /// How many distinct `hrOnlyEpochS` buckets `sortedByTs` spans.
+    ///
+    /// A single pass rather than a Set, because `hrS` is already sorted by timestamp so the bucket key
+    /// is non-decreasing. The obvious spelling (`Set(hrS.map { … })`) builds a full intermediate array
+    /// AND a set over every sample to end up with a few thousand distinct keys — per scored day, across
+    /// the 21-day rescore. A diagnostic must not cost what it is measuring.
+    static func distinctEpochs(_ sortedByTs: [HRSample]) -> Int {
+        var count = 0
+        var last = Int.min
+        for s in sortedByTs {
+            let key = s.ts / hrOnlyEpochS
+            if key != last { count += 1; last = key }
+        }
+        return count
+    }
+
     /// Epoch for the HR-only spine, in seconds.
     public static let hrOnlyEpochS: Int = 60
 
@@ -615,9 +643,18 @@ public enum SleepStager {
     /// and it lives outside this package. The spine and the anchor below it stay `internal` — the tests
     /// reach them with `@testable`, and nothing outside should be building its own spine.
     public static func hrOnlySessions(hr: [HRSample], rr: [RRInterval], resp: [RespSample],
-                                      minMinutes: Int = minSleepMin) -> [SleepSession] {
+                                      minMinutes: Int = minSleepMin,
+                                      traceSink: ((String) -> Void)? = nil) -> [SleepSession] {
         let hrS = hr.sorted { $0.ts < $1.ts }
-        guard let baseline = hrOnlyBaseline(hrS) else { return [] }
+        // ONE sort of the bpm axis, reused for the anchor and for the spread the trace reports.
+        let sortedBpm = hrS.map { Double($0.bpm) }.sorted()
+        guard let baseline = percentileOfSorted(sortedBpm, hrOnlyAnchorPercentile) else {
+            traceSink?(GateTrace.hrOnlyLine(anchorBpm: nil, bandBpm: nil, hrP50: nil, hrP90: nil,
+                                            epochs: 0, runs: 0,
+                                            mergedRuns: 0, sleepRuns: 0, longestSleepMin: 0,
+                                            staged: 0, kept: 0, minSleepMin: minMinutes))
+            return []
+        }
         let rrS = rr.sorted { $0.ts < $1.ts }
         var out: [SleepSession] = []
         // mergePeriods for the same reason the motion path calls it: a run boundary is a threshold
@@ -625,16 +662,40 @@ public enum SleepStager {
         // spine returns the night's minutes correctly but shredded into sub-mergeMin fragments, every one
         // of which then fails the minimum-duration gate below — 8 h of detected sleep yielding zero
         // sessions. Absorbing the short runs first is what turns a spine into a night.
-        for p in mergePeriods(hrOnlySleepRuns(hrS, baseline: baseline)) {
+        let rawRuns = hrOnlySleepRuns(hrS, baseline: baseline)
+        let merged = mergePeriods(rawRuns)
+        var staged = 0
+        var longestSleepS = 0
+        for p in merged {
             if p.stage != "sleep" { continue }
+            longestSleepS = max(longestSleepS, p.end - p.start)
             if (p.end - p.start) < minMinutes * 60 { continue }
             let stages = SleepStagerV2.stageSession(start: p.start, end: p.end, grav: [],
                                                     hr: hrS, rr: rrS, resp: resp)
+            staged += 1
             if stages.isEmpty { continue }
             out.append(SleepSession(start: p.start, end: p.end,
                                     efficiency: efficiency(start: p.start, end: p.end, stages: stages),
                                     stages: stages, restingHR: nil, avgHRV: nil, hrOnly: true))
         }
+        traceSink?(GateTrace.hrOnlyLine(
+            anchorBpm: baseline,
+            bandBpm: baseline * hrOnlyBandMult,
+            // The wearer's own spread. An anchor alone cannot be judged: p10 of 60 means one thing when
+            // the median is 63 and quite another when it is 74, and only the second leaves a night the
+            // band can separate.
+            hrP50: percentileOfSorted(sortedBpm, 0.50),
+            hrP90: percentileOfSorted(sortedBpm, 0.90),
+            // The real epoch count, not the sample count: the spine buckets by `hrOnlyEpochS` before it
+            // decides anything, so this is the axis every other number here is measured on.
+            epochs: distinctEpochs(hrS),
+            runs: rawRuns.count,
+            mergedRuns: merged.count,
+            sleepRuns: merged.filter { $0.stage == "sleep" }.count,
+            longestSleepMin: longestSleepS / 60,
+            staged: staged,
+            kept: out.count,
+            minSleepMin: minMinutes))
         return out
     }
 
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerHrOnlyTraceTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerHrOnlyTraceTests.swift
new file mode 100644
index 0000000000..a219d301b8
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerHrOnlyTraceTests.swift
@@ -0,0 +1,57 @@
+import XCTest
+import WhoopProtocol
+@testable import StrandAnalytics
+
+/// Twin of the Kotlin `SleepStagerHrOnlyTraceTest`. The expected strings are byte-identical on both
+/// platforms on purpose — these lines exist to be read side by side.
+final class SleepStagerHrOnlyTraceTests: XCTestCase {
+
+    func testLineNamesTheDerivedThresholdAndLongestCandidate() {
+        XCTAssertEqual(
+            SleepStager.GateTrace.hrOnlyLine(anchorBpm: 61.0, bandBpm: 64.05, hrP50: 74.0, hrP90: 88.0, epochs: 3021, runs: 48,
+                                             mergedRuns: 12, sleepRuns: 7, longestSleepMin: 41,
+                                             staged: 0, kept: 0, minSleepMin: 60),
+            "[sleep] hr-only spine anchorBpm=61.0 bandBpm=64.1 hrP50=74.0 hrP90=88.0 "
+                + "epochs=3021 runs=48 merged=12 "
+                + "sleepRuns=7 longestMin=41 staged=0 kept=0 minSleepMin=60"
+        )
+    }
+
+    func testAbsentAnchorPrintsNilRatherThanZero() {
+        let line = SleepStager.GateTrace.hrOnlyLine(anchorBpm: nil, bandBpm: nil, hrP50: nil, hrP90: nil, epochs: 0, runs: 0,
+                                                    mergedRuns: 0, sleepRuns: 0, longestSleepMin: 0,
+                                                    staged: 0, kept: 0, minSleepMin: 60)
+        XCTAssertTrue(line.contains("anchorBpm=nil bandBpm=nil"))
+    }
+
+    /// `epochs` counts EPOCHS, not samples — the axis every other number is measured on. Twin of the
+    /// Kotlin test, which guards a bug I actually made: the first version reported the HR sample count.
+    func testEpochsCountsEpochsNotSamples() {
+        var lines: [String] = []
+        // 10 epochs x 6 samples = 60 samples.
+        var hr: [HRSample] = []
+        for i in 0..<10 {
+            let base = (1000 + i) * 60
+            for k in 0..<6 { hr.append(HRSample(ts: base + k * 10, bpm: 120)) }
+        }
+        _ = SleepStager.hrOnlySessions(hr: hr, rr: [], resp: [], traceSink: { lines.append($0) })
+        XCTAssertEqual(lines.count, 1, "exactly one funnel line per call")
+        XCTAssertTrue(lines[0].contains("epochs=10 "), "got: \(lines[0])")
+    }
+
+    /// The rounding is ARITHMETIC, not `printf`. A harness caught `String(format: "%.1f", 64.05)`
+    /// giving 64.0 on Apple against Java's 64.1 — a divergence that `anchor * 1.05` would have hit
+    /// constantly. These are the values that harness compared.
+    func testOneDecimalRoundingMatchesTheKotlinTwin() {
+        let cases: [(Double, String)] = [
+            (64.05, "64.1"), (61.0, "61.0"), (77.7, "77.7"), (66.15, "66.2"),
+            (71.4, "71.4"), (1.05, "1.1"), (0.0, "0.0"), (120.0, "120.0"),
+        ]
+        for (v, expected) in cases {
+            let line = SleepStager.GateTrace.hrOnlyLine(anchorBpm: v, bandBpm: nil, hrP50: nil, hrP90: nil, epochs: 0, runs: 0,
+                                                        mergedRuns: 0, sleepRuns: 0, longestSleepMin: 0,
+                                                        staged: 0, kept: 0, minSleepMin: 60)
+            XCTAssertTrue(line.contains("anchorBpm=\(expected) "), "\(v) -> expected \(expected), got: \(line)")
+        }
+    }
+}
diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index b7dcbbc8f5..9de476ebcf 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -1178,10 +1178,32 @@ final class IntelligenceEngine: ObservableObject {
                     // Fall back to the HR-only spine ONLY when the device supplied nothing of its own: a
                     // hypnogram the device actually recorded is always better evidence than one inferred
                     // from heart rate.
-                    providedSleep = stored.isEmpty
-                        ? SleepStager.hrOnlySessions(hr: hr, rr: rr, resp: resp)
-                        : stored
+                    // Route the spine's funnel through the SAME `traceSink` the gate lines use, so one
+                    // report explains both halves rather than one going quiet — which is exactly what
+                    // shipping it silent cost on Android (#1801). That sink is nil unless Sleep test mode
+                    // is active, so this collects nothing on a normal pass; passing a closure of my own
+                    // here would have appended on every scored day regardless.
+                    if stored.isEmpty {
+                        traceSink?(SleepStager.GateTrace.hrOnlyGateLine(
+                            attempted: true, reason: "no-motion-no-hypnogram",
+                            gravRows: grav.count, storedNights: 0))
+                        providedSleep = SleepStager.hrOnlySessions(hr: hr, rr: rr, resp: resp,
+                                                                   traceSink: traceSink)
+                    } else {
+                        traceSink?(SleepStager.GateTrace.hrOnlyGateLine(
+                            attempted: false, reason: "stored-hypnogram",
+                            gravRows: grav.count, storedNights: stored.count))
+                        providedSleep = stored
+                    }
                 } else {
+                    // Only worth saying on a day with NO motion: there the spine was the remaining option
+                    // and something declined it, which a silent absence could not distinguish. A day WITH
+                    // motion skips this — the motion spine is the answer there.
+                    if grav.count < 2 {
+                        traceSink?(SleepStager.GateTrace.hrOnlyGateLine(
+                            attempted: false, reason: "imported-owner",
+                            gravRows: grav.count, storedNights: 0))
+                    }
                     providedSleep = []
                 }
                 let tScore0 = Date()
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index fc091dcc9b..876ffec253 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -966,8 +966,32 @@ object IntelligenceEngine {
                     // `reason=no-motion` however much HR it held. Fall back to the HR-only spine ONLY when
                     // the device supplied nothing of its own: a hypnogram the device actually recorded is
                     // always better evidence than one inferred from heart rate.
-                    if (stored.isNotEmpty()) stored else SleepStager.hrOnlySessions(hr, rr, resp)
+                    if (stored.isNotEmpty()) {
+                        dayDiag(SleepStagerTrace.hrOnlyGateLine(
+                            attempted = false, reason = "stored-hypnogram",
+                            gravRows = grav.size, storedNights = stored.size,
+                        ))
+                        stored
+                    } else {
+                        dayDiag(SleepStagerTrace.hrOnlyGateLine(
+                            attempted = true, reason = "no-motion-no-hypnogram",
+                            gravRows = grav.size, storedNights = 0,
+                        ))
+                        // Route the spine's funnel through the SAME per-day recorder as `sleep-detect`,
+                        // so one report explains both halves rather than one of them going quiet.
+                        SleepStager.hrOnlySessions(hr, rr, resp, traceSink = ::dayDiag)
+                    }
                 } else {
+                    // Only worth saying on a day with NO motion: there the spine was the remaining
+                    // option and something declined it, which is precisely what a silent absence could
+                    // not distinguish. A day WITH motion skips this — the motion spine is the answer
+                    // there and nothing was passed over.
+                    if (grav.size < 2) {
+                        dayDiag(SleepStagerTrace.hrOnlyGateLine(
+                            attempted = false, reason = "imported-owner",
+                            gravRows = grav.size, storedNights = 0,
+                        ))
+                    }
                     emptyList()
                 }
 
diff --git a/android/app/src/main/java/com/noop/analytics/SleepStager.kt b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
index 4c78641d16..5e23b3387b 100644
--- a/android/app/src/main/java/com/noop/analytics/SleepStager.kt
+++ b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
@@ -560,13 +560,50 @@ object SleepStager {
      * the value is always one the wearer actually recorded and the two platforms cannot disagree on a
      * rounding rule.
      */
-    internal fun hrOnlyBaseline(hr: List<HrSample>): Double? {
-        if (hr.isEmpty()) return null
-        val sorted = hr.map { it.bpm.toDouble() }.sorted()
-        val idx = ((sorted.size - 1) * hrOnlyAnchorPercentile).toInt().coerceIn(0, sorted.size - 1)
+    internal fun hrOnlyBaseline(hr: List<HrSample>): Double? = hrPercentile(hr, hrOnlyAnchorPercentile)
+
+    /**
+     * The `p` percentile of `hr` by bpm, nearest-rank. Shared with [hrOnlyBaseline] so the spread the
+     * trace reports is measured by the SAME rule as the anchor it is meant to be judged against — a
+     * diagnostic computed a different way would invite exactly the wrong conclusion.
+     */
+    internal fun hrPercentile(hr: List<HrSample>, p: Double): Double? =
+        percentileOfSorted(hr.map { it.bpm.toDouble() }.sorted(), p)
+
+    /**
+     * The `p` percentile of an ALREADY-SORTED bpm list, nearest-rank.
+     *
+     * Split out because the caller needs three percentiles from the same window, and the obvious
+     * spelling sorts once per percentile. On a 5/MG day that is ~160k samples sorted three times, on
+     * every scored day, across the 21-day rescore window - a cost this file has been burned by before
+     * (#836, #841). One sort, three reads.
+     */
+    internal fun percentileOfSorted(sorted: List<Double>, p: Double): Double? {
+        if (sorted.isEmpty()) return null
+        val idx = ((sorted.size - 1) * p).toInt().coerceIn(0, sorted.size - 1)
         return sorted[idx]
     }
 
+    /**
+     * How many distinct [hrOnlyEpochS] buckets `sortedByTs` spans.
+     *
+     * A single pass rather than a set, because `hrS` is already sorted by timestamp so the bucket key
+     * is non-decreasing and a running comparison is enough. The obvious spelling
+     * (`mapTo(HashSet()) { it.ts / hrOnlyEpochS }`) boxes EVERY sample to end up with a few thousand
+     * distinct keys - ~160k boxed longs per scored day across the 21-day rescore, which is the exact
+     * allocation shape #707 names as the heap-churn source under the OOM. A diagnostic must not cost
+     * what it is measuring.
+     */
+    internal fun distinctEpochs(sortedByTs: List<HrSample>): Int {
+        var count = 0
+        var last = Long.MIN_VALUE
+        for (s in sortedByTs) {
+            val key = s.ts / hrOnlyEpochS
+            if (key != last) { count++; last = key }
+        }
+        return count
+    }
+
     /** Epoch for the HR-only spine, in seconds. */
     const val hrOnlyEpochS: Long = 60
 
@@ -674,9 +711,25 @@ object SleepStager {
         rr: List<RrInterval>,
         resp: List<RespSample>,
         minMinutes: Int = minSleepMin,
+        /**
+         * #1801 follow-up: this path shipped SILENT, and the first field log then showed
+         * `reason=no-motion` with no way to tell whether the spine ran and found nothing or never ran.
+         * Everything it decides is derived from the wearer's own window, so a report is unreadable
+         * without it. Optional, so pure-function callers and tests stay free of a sink.
+         */
+        traceSink: ((String) -> Unit)? = null,
     ): List<DetectedSleep> {
         val hrS = hr.sortedBy { it.ts }
-        val baseline = hrOnlyBaseline(hrS) ?: return emptyList()
+        // ONE sort of the bpm axis, reused for the anchor and for the spread the trace reports.
+        val sortedBpm = hrS.map { it.bpm.toDouble() }.sorted()
+        val baseline = percentileOfSorted(sortedBpm, hrOnlyAnchorPercentile)
+        if (baseline == null) {
+            traceSink?.invoke(SleepStagerTrace.hrOnlyLine(
+                anchorBpm = null, bandBpm = null, hrP50 = null, hrP90 = null, epochs = 0, runs = 0, mergedRuns = 0,
+                sleepRuns = 0, longestSleepMin = 0, staged = 0, kept = 0, minSleepMin = minMinutes,
+            ))
+            return emptyList()
+        }
         val rrS = rr.sortedBy { it.ts }
         val out = ArrayList<DetectedSleep>()
         // mergePeriods for the same reason the motion path calls it: a run boundary is a threshold
@@ -684,10 +737,16 @@ object SleepStager {
         // spine returns the night's minutes correctly but shredded into sub-mergeMin fragments, every one
         // of which then fails the minimum-duration gate below — 8 h of detected sleep yielding zero
         // sessions. Absorbing the short runs first is what turns a spine into a night.
-        for (p in mergePeriods(hrOnlySleepRuns(hrS, baseline))) {
+        val rawRuns = hrOnlySleepRuns(hrS, baseline)
+        val merged = mergePeriods(rawRuns)
+        var staged = 0
+        var longestSleepS = 0L
+        for (p in merged) {
             if (p.stage != "sleep") continue
+            longestSleepS = maxOf(longestSleepS, p.end - p.start)
             if ((p.end - p.start) < minMinutes * 60L) continue
             val stages = SleepStagerV2.stageSession(p.start, p.end, emptyList(), hrS, rrS, resp)
+            staged++
             if (stages.isEmpty()) continue
             out.add(
                 DetectedSleep(
@@ -701,6 +760,25 @@ object SleepStager {
                 )
             )
         }
+        traceSink?.invoke(SleepStagerTrace.hrOnlyLine(
+            anchorBpm = baseline,
+            bandBpm = baseline * hrOnlyBandMult,
+            // The wearer's own spread. An anchor alone cannot be judged: p10 of 60 means one thing when
+            // the median is 63 and quite another when it is 74, and only the second leaves a night the
+            // band can separate.
+            hrP50 = percentileOfSorted(sortedBpm, 0.50),
+            hrP90 = percentileOfSorted(sortedBpm, 0.90),
+            // The real epoch count, not the sample count: the spine buckets by [hrOnlyEpochS] before it
+            // decides anything, so this is the axis every other number here is measured on.
+            epochs = distinctEpochs(hrS),
+            runs = rawRuns.size,
+            mergedRuns = merged.size,
+            sleepRuns = merged.count { it.stage == "sleep" },
+            longestSleepMin = (longestSleepS / 60L).toInt(),
+            staged = staged,
+            kept = out.size,
+            minSleepMin = minMinutes,
+        ))
         return out
     }
 
diff --git a/android/app/src/main/java/com/noop/analytics/SleepStagerTrace.kt b/android/app/src/main/java/com/noop/analytics/SleepStagerTrace.kt
index af8f0a9f52..dd1cff7e6d 100644
--- a/android/app/src/main/java/com/noop/analytics/SleepStagerTrace.kt
+++ b/android/app/src/main/java/com/noop/analytics/SleepStagerTrace.kt
@@ -7,6 +7,62 @@ package com.noop.analytics
 object SleepStagerTrace {
     enum class Verdict(val tag: String) { KEPT("KEPT"), DROPPED("DROPPED") }
 
+    /**
+     * Why the HR-only spine did or did not run (#1801).
+     *
+     * The funnel line below only exists when the spine is CALLED, so its absence was ambiguous in
+     * exactly the way that made the first field report unreadable: it could mean the gate never
+     * opened, or that the sink was never wired. This says which, on any day with no motion — the only
+     * days where the question arises. A day that HAS motion never prints it, because the motion spine
+     * is the answer there and nothing was skipped.
+     */
+    fun hrOnlyGateLine(attempted: Boolean, reason: String, gravRows: Int, storedNights: Int): String =
+        "[sleep] hr-only gate attempted=$attempted reason=$reason grav=$gravRows stored=$storedNights"
+
+    /**
+     * The HR-only spine's own funnel line (#1801).
+     *
+     * The path shipped silent, and a field log then showed `reason=no-motion` with no way to tell
+     * whether the spine had run and found nothing or never ran at all — in a file whose entire sleep
+     * story is a funnel. Every number here exists to separate the two failures that actually happen:
+     * a band too tight (`sleepRuns` near zero) from a duration gate eating real runs (`sleepRuns` high,
+     * `longestMin` under `minSleepMin`).
+     *
+     * `anchorBpm` and `bandBpm` are printed because they are derived, not configured: the anchor is a
+     * percentile of THIS window, so the same code gives a different threshold to every wearer, and a
+     * complaint is unreadable without knowing which one they got.
+     */
+    fun hrOnlyLine(
+        anchorBpm: Double?, bandBpm: Double?, hrP50: Double?, hrP90: Double?, epochs: Int,
+        runs: Int, mergedRuns: Int, sleepRuns: Int,
+        longestSleepMin: Int, staged: Int, kept: Int, minSleepMin: Int,
+    ): String =
+        "[sleep] hr-only spine anchorBpm=${round1(anchorBpm)} bandBpm=${round1(bandBpm)} " +
+            "hrP50=${round1(hrP50)} hrP90=${round1(hrP90)} " +
+            "epochs=$epochs runs=$runs merged=$mergedRuns sleepRuns=$sleepRuns " +
+            "longestMin=$longestSleepMin staged=$staged kept=$kept minSleepMin=$minSleepMin"
+
+    /**
+     * One decimal, by ARITHMETIC rather than `printf`.
+     *
+     * `String.format("%.1f", …)` is not a twin: Java rounds HALF_UP on the decimal expansion while
+     * Swift's `String(format:)` goes through C `printf`, which rounds half-to-even on the actual
+     * binary value. A harness caught them disagreeing on 64.05 — Kotlin 64.1, Swift 64.0 — and a band
+     * of `anchor * 1.05` produces trailing decimals constantly, so that would have diverged on most
+     * real values. Multiplying and rounding is IEEE-deterministic, so both platforms do the same
+     * arithmetic to the same bits and cannot disagree, whichever side of .5 the product lands on.
+     * Same reasoning as [round2] one line down, which was already arithmetic.
+     *
+     * NON-NEGATIVE ONLY. `-0.5` would print "0.5", because the integer division truncates toward zero
+     * and the sign is then lost to `abs`. Every current caller is a bpm, which cannot be negative;
+     * a caller that could be would need the sign carried separately.
+     */
+    private fun round1(v: Double?): String {
+        if (v == null) return "nil"
+        val tenths = Math.round(v * 10.0)
+        return "${tenths / 10}.${Math.abs(tenths % 10)}"
+    }
+
     fun runLine(index: Int, startTs: Long, endTs: Long, verdict: Verdict, gate: String, detail: String): String {
         val spanS = maxOf(0L, endTs - startTs)
         return "gate run=$index spanS=$spanS ${verdict.tag} gate=$gate $detail"
diff --git a/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlyAnchorTest.kt b/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlyAnchorTest.kt
index a421837e3d..a6667c74b7 100644
--- a/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlyAnchorTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlyAnchorTest.kt
@@ -57,6 +57,25 @@ class SleepStagerHrOnlyAnchorTest {
         }
     }
 
+    /**
+     * One sort, three reads. The anchor and the trace's spread come from the SAME sorted axis, so a
+     * refactor that sorts per percentile - ~160k samples three times per scored day across a 21-day
+     * rescore - shows up here as a disagreement rather than only as a slower pass.
+     */
+    @Test
+    fun `the shared percentile helper agrees with the anchor`() {
+        val hr = (1..100).map { HrSample("d", 1_788_300_000L + it, it) }
+        val sorted = hr.map { it.bpm.toDouble() }.sorted()
+        assertEquals(
+            SleepStager.hrOnlyBaseline(hr)!!,
+            SleepStager.percentileOfSorted(sorted, SleepStager.hrOnlyAnchorPercentile)!!,
+            1e-9,
+        )
+        assertEquals(50.0, SleepStager.percentileOfSorted(sorted, 0.50)!!, 1e-9)
+        assertEquals(90.0, SleepStager.percentileOfSorted(sorted, 0.90)!!, 1e-9)
+        assertTrue(SleepStager.percentileOfSorted(emptyList(), 0.5) == null)
+    }
+
     /**
      * The regression this file exists for. The first draft anchored on [SleepStager.hrBaseline], the
      * window MEDIAN — which admits over half of any window by definition, because a median splits the
diff --git a/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySessionsTest.kt b/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySessionsTest.kt
index 0b01999d89..06a7d981da 100644
--- a/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySessionsTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySessionsTest.kt
@@ -95,12 +95,20 @@ class SleepStagerHrOnlySessionsTest {
             }
             error("IntelligenceEngine.kt not found — this test must not pass by default")
         }
-        val idx = src.indexOf("SleepStager.hrOnlySessions(")
-        assertTrue("IntelligenceEngine must call the HR-only fallback", idx > 0)
-        val guard = src.substring(maxOf(0, idx - 1200), idx)
-        assertTrue("the fallback must sit behind the absent-gravity gate", guard.contains("grav.size < 2"))
+        // Scoped to the `providedSleep` expression rather than a fixed window of characters before the
+        // call. The first version measured PROXIMITY — 1200 chars back — and broke the moment a couple
+        // of diagnostic lines were inserted between the gate and the call, even though the gate still
+        // held. Containment is the actual invariant; distance never was.
+        val from = src.indexOf("val providedSleep: List<DetectedSleep> =")
+        assertTrue("IntelligenceEngine must build providedSleep", from > 0)
+        val to = src.indexOf("val tScore0", from)
+        assertTrue("expected the scoring call to follow providedSleep", to > from)
+        val expr = src.substring(from, to)
+        assertTrue("the fallback must sit inside the absent-gravity gate", expr.contains("grav.size < 2"))
+        assertTrue("IntelligenceEngine must call the HR-only fallback",
+            expr.contains("SleepStager.hrOnlySessions("))
         assertTrue("and must only run when the device supplied no hypnogram of its own",
-            guard.contains("stored.isNotEmpty()"))
+            expr.contains("stored.isNotEmpty()"))
     }
 
     /** No HR at all cannot produce a night, and must not throw. */
diff --git a/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlyTraceTest.kt b/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlyTraceTest.kt
new file mode 100644
index 0000000000..b6b5c9150f
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlyTraceTest.kt
@@ -0,0 +1,101 @@
+package com.noop.analytics
+
+import com.noop.data.HrSample
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The HR-only spine's funnel line (#1801 follow-up).
+ *
+ * The path shipped silent. A field log on 11.1.0 then showed `reason=no-motion` with `provided=0` and
+ * no way to tell whether the spine had run and found nothing, or never ran — so the report could not
+ * be acted on at all. These pin the line that answers it.
+ */
+class SleepStagerHrOnlyTraceTest {
+
+    private fun hr(from: Int, bpms: List<Int>): List<HrSample> {
+        val out = ArrayList<HrSample>()
+        bpms.forEachIndexed { i, bpm ->
+            val base = (from + i).toLong() * 60L
+            repeat(6) { k -> out.add(HrSample("d", base + k * 10L, bpm)) }
+        }
+        return out
+    }
+
+    /** The two numbers that separate a too-tight band from a duration gate eating real runs. */
+    @Test
+    fun `the line names the derived threshold and the longest candidate`() {
+        val line = SleepStagerTrace.hrOnlyLine(
+            anchorBpm = 61.0, bandBpm = 64.05, hrP50 = 74.0, hrP90 = 88.0, epochs = 3021, runs = 48, mergedRuns = 12,
+            sleepRuns = 7, longestSleepMin = 41, staged = 0, kept = 0, minSleepMin = 60,
+        )
+        assertEquals(
+            "[sleep] hr-only spine anchorBpm=61.0 bandBpm=64.1 hrP50=74.0 hrP90=88.0 " +
+                "epochs=3021 runs=48 merged=12 " +
+                "sleepRuns=7 longestMin=41 staged=0 kept=0 minSleepMin=60",
+            line,
+        )
+    }
+
+    /** No HR at all still emits, with the anchor absent rather than a fabricated zero. */
+    @Test
+    fun `an absent anchor prints nil rather than zero`() {
+        val line = SleepStagerTrace.hrOnlyLine(
+            anchorBpm = null, bandBpm = null, hrP50 = null, hrP90 = null, epochs = 0, runs = 0, mergedRuns = 0,
+            sleepRuns = 0, longestSleepMin = 0, staged = 0, kept = 0, minSleepMin = 60,
+        )
+        assertTrue("must not claim an anchor of 0.0", line.contains("anchorBpm=nil bandBpm=nil"))
+    }
+
+    /** The spine emits exactly once per call — that silence was the whole defect. */
+    @Test
+    fun `every call traces exactly once and names the anchor it used`() {
+        val lines = ArrayList<String>()
+        SleepStager.hrOnlySessions(hr(1000, List(200) { 120 }), emptyList(), emptyList(),
+                                   traceSink = { lines.add(it) })
+        assertEquals("exactly one funnel line per call", 1, lines.size)
+        assertTrue("must name the anchor it used", lines[0].contains("anchorBpm=120.0"))
+    }
+
+    /**
+     * A FLAT window is entirely "sleep", and that is by construction rather than a bug.
+     *
+     * The anchor is a percentile of the SAME window it then classifies, so with a constant heart rate
+     * the tenth percentile equals the reading, the band sits 5% above it, and every epoch qualifies.
+     * The spine measures a rate against that wearer's own spread; given no spread it cannot separate
+     * rest from anything else. Pinned because the first draft of the test above assumed the opposite —
+     * that a uniformly high heart rate would be rejected — and asserted `kept=0` on that reasoning.
+     */
+    @Test
+    fun `a flat window is entirely in band because the anchor comes from it`() {
+        val lines = ArrayList<String>()
+        val kept = SleepStager.hrOnlySessions(hr(1000, List(200) { 120 }), emptyList(), emptyList(),
+                                              traceSink = { lines.add(it) })
+        assertTrue("a flat window yields one long run, not none", kept.isNotEmpty())
+        assertTrue("and the trace says so: ${lines[0]}", lines[0].contains("sleepRuns=1"))
+    }
+
+    /**
+     * The single-pass epoch count relies on `hrS` being sorted by timestamp, which `hrOnlySessions`
+     * guarantees. Pinned because the zero-allocation version trades a set for that assumption, and an
+     * unsorted input would silently over-count rather than fail.
+     */
+    @Test
+    fun `distinctEpochs counts buckets in one pass over sorted input`() {
+        // 10 epochs x 6 samples, already ts-ordered.
+        assertEquals(10, SleepStager.distinctEpochs(hr(1000, List(10) { 60 })))
+        assertEquals(1, SleepStager.distinctEpochs(hr(1000, listOf(60))))
+        assertEquals(0, SleepStager.distinctEpochs(emptyList()))
+    }
+
+    /** `epochs` counts EPOCHS, not samples — the axis every other number is measured on. */
+    @Test
+    fun `epochs counts epochs not samples`() {
+        val lines = ArrayList<String>()
+        // 10 epochs x 6 samples = 60 samples.
+        SleepStager.hrOnlySessions(hr(1000, List(10) { 120 }), emptyList(), emptyList(),
+                                   traceSink = { lines.add(it) })
+        assertTrue("expected epochs=10, got: ${lines[0]}", lines[0].contains("epochs=10 "))
+    }
+}

From 67d75124fd9fc755920128bed676ed7add7818bf Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 22:06:30 +1200
Subject: [PATCH 167/333] Bump build to 413 for a testing build

Build numbers only: versionCode 412 -> 413 and CURRENT_PROJECT_VERSION 293 -> 294. MARKETING_VERSION
and versionName stay 11.1.0, because 11.1.0 has not been released - only cut as a testing build - so
the artefacts stay v11.1.0 and 413 simply beats the staging high-water an installer would otherwise
refuse as a downgrade.

Carries the HR-only spine's funnel and gate lines (#1812), which is the point of this build: the
first log from it will say whether the p10 band is too tight for the wearer or the minimum-duration
gate is eating real runs, instead of leaving reason=no-motion to mean either.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index d4710158e0..a920a724c7 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 412
+        versionCode = 413
         versionName = "11.1.0"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 15e14a344c..c4d3114c94 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "293"
+    CURRENT_PROJECT_VERSION: "294"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From e4b27fba55e20a99a02bf063976a85c4a54f3acd Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 22:38:26 +1200
Subject: [PATCH 168/333] sleep: stop the HR-only fallback inheriting an
 exclusion written to keep WHOOP out (#1813)

The spine had never once run. The gate line from #1812 said so on the first build that carried it:

  [sleep] hr-only gate attempted=false reason=imported-owner grav=0 stored=0

on a day holding 165,980 HR rows - skipped before any heart rate was looked at. Neither of the two
failures the funnel was built to separate; it never got that far.

#1806 took its condition verbatim from #804 Fix A, whose comment says it exists "so WHOOP straps and
the my-whoop import namespace are untouched". #804 is about Oura RINGS and deliberately excludes
WHOOP. The HR-only fallback is FOR a WHOOP strap, so it inherited a condition whose entire purpose was
to exclude the case it was built for. resolveDayOwner returns importedDeviceId whenever the owner
source is absent or the candidates collapse to it, which on a live 5/MG install is every day - so the
p10 anchor tuned in #1806 was never reached either. Two owner concepts disagree, which is why older
logs could not show this: the [universal] dayOwner line reports the strap id while resolveDayOwner
returns the imported one.

Split by question rather than by gate. #804's stored-hypnogram branch keeps the owner exclusion. The
heart-rate fallback drops it. Between them a new branch leaves any day alone that already has stored
sessions, whoever owns it, because inferring a night from heart rate when the device recorded a real
one replaces better evidence with worse. The stored lookup now runs for every no-motion day, so
"nothing else knows about this night" is checked rather than assumed - one indexed read, and only on
days that were already scoring blank, since a normal WHOOP day short-circuits at grav.size >= 2.

Re-review recorded what dropping the exclusion widens: the branch is now reachable for ANY owner,
including a WHOOP 4.0 day that banked nothing at all. A normal 4.0 day never reaches the gate, and an
empty one has too little to clear minSleepMin - but "too little" is not "none", and I had described a
4.0 as untouched more broadly than was true.

Both platforms. 26 HR-only tests, 0 failures. The Apple half is app-target Swift that no default CI
job builds; the testing build's iOS and macOS legs are what compile it.

Refs #1801.
---
 Strand/Data/IntelligenceEngine.swift          | 55 ++++++++--------
 .../com/noop/analytics/IntelligenceEngine.kt  | 66 ++++++++++++-------
 .../SleepStagerHrOnlySessionsTest.kt          | 11 ++++
 3 files changed, 81 insertions(+), 51 deletions(-)

diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index 9de476ebcf..495e6e43ca 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -1167,45 +1167,48 @@ final class IntelligenceEngine: ObservableObject {
                 // untouched; analyzeDay still lets a DETECTED session win where the two overlap. Reconstruct the
                 // pure SleepSession from each stored CachedSleepSession (a minute-dict import row decodes to
                 // nothing and is skipped, so only real stage timelines are injected).
+                // #804 Fix A + #1801. Two different questions share the "this day has no motion" gate.
+                //
+                // #804 hands over a device's OWN persisted hypnogram (an Oura ring's SleepNet night) and is
+                // deliberately not applied to the import namespace. #1801 stages from heart rate when there
+                // is no hypnogram at all — and must NOT inherit #804's owner exclusion, which is the bug
+                // this replaces: `resolveDayOwner` returns the imported id whenever the owner source is
+                // absent or the candidates collapse to it, so on a live 5/MG install the whole branch was
+                // skipped before any heart rate was looked at.
+                //
+                // The stored lookup now runs for every no-motion day, so "nothing else knows about this
+                // night" is checked rather than assumed. A day that HAS stored sessions is left alone
+                // whoever owns it.
                 let providedSleep: [SleepSession]
-                if owner != Repository.whoopSource, grav.count < 2 {
+                if grav.count < 2 {
                     let persisted = (try? await store.sleepSessions(deviceId: owner, from: from, to: to,
                                                                     limit: 4000)) ?? []
                     let stored = persisted.compactMap { AnalyticsEngine.sleepSession(fromProvided: $0) }
-                    // #1801: the comment above assumes a WHOOP always streams a gravity vector. A 5/MG that
-                    // cannot bond does not — it is never clocked, so it banks nothing and persists no
-                    // hypnogram either, leaving neither a spine nor a stored night however much HR it holds.
-                    // Fall back to the HR-only spine ONLY when the device supplied nothing of its own: a
-                    // hypnogram the device actually recorded is always better evidence than one inferred
-                    // from heart rate.
-                    // Route the spine's funnel through the SAME `traceSink` the gate lines use, so one
-                    // report explains both halves rather than one going quiet — which is exactly what
-                    // shipping it silent cost on Android (#1801). That sink is nil unless Sleep test mode
-                    // is active, so this collects nothing on a normal pass; passing a closure of my own
-                    // here would have appended on every scored day regardless.
-                    if stored.isEmpty {
-                        traceSink?(SleepStager.GateTrace.hrOnlyGateLine(
-                            attempted: true, reason: "no-motion-no-hypnogram",
-                            gravRows: grav.count, storedNights: 0))
-                        providedSleep = SleepStager.hrOnlySessions(hr: hr, rr: rr, resp: resp,
-                                                                   traceSink: traceSink)
-                    } else {
+                    if owner != Repository.whoopSource, !stored.isEmpty {
                         traceSink?(SleepStager.GateTrace.hrOnlyGateLine(
                             attempted: false, reason: "stored-hypnogram",
                             gravRows: grav.count, storedNights: stored.count))
                         providedSleep = stored
-                    }
-                } else {
-                    // Only worth saying on a day with NO motion: there the spine was the remaining option
-                    // and something declined it, which a silent absence could not distinguish. A day WITH
-                    // motion skips this — the motion spine is the answer there.
-                    if grav.count < 2 {
+                    } else if !stored.isEmpty {
                         traceSink?(SleepStager.GateTrace.hrOnlyGateLine(
-                            attempted: false, reason: "imported-owner",
+                            attempted: false, reason: "stored-sessions-exist",
+                            gravRows: grav.count, storedNights: stored.count))
+                        providedSleep = []
+                    } else {
+                        // Reachable for ANY owner now, which widens this past the 5/MG it was built for:
+                        // a WHOOP 4.0 day that banked nothing at all also lands here, where the owner
+                        // check previously blocked it. A normal 4.0 day is untouched — it streams
+                        // gravity, so it never reaches this gate.
+                        traceSink?(SleepStager.GateTrace.hrOnlyGateLine(
+                            attempted: true, reason: "no-motion-no-hypnogram",
                             gravRows: grav.count, storedNights: 0))
+                        providedSleep = SleepStager.hrOnlySessions(hr: hr, rr: rr, resp: resp,
+                                                                   traceSink: traceSink)
                     }
+                } else {
                     providedSleep = []
                 }
+
                 let tScore0 = Date()
                 dayPrepSeconds += tScore0.timeIntervalSince(tPrep0)
                 // #1770 follow-up: the Effort ring's funnel. Collected here rather than sent straight
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index 876ffec253..24bf3e974a 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -956,44 +956,60 @@ object IntelligenceEngine {
             // scores. Gated on absent gravity (`grav.size < 2` — a ring streams zero; a WHOOP always streams a
             // gravity vector) plus a non-canonical-WHOOP-import owner, so WHOOP straps and the "my-whoop"
             // import namespace are untouched; analyzeDay still lets a DETECTED session win where they overlap.
-            val providedSleep: List<DetectedSleep> =
-                if (owner != importedDeviceId && grav.size < 2) {
-                    val stored = repo.sleepSessionsForDevice(owner, from, to, 4000)
-                        .mapNotNull { AnalyticsEngine.sleepSessionFromProvided(it) }
-                    // #1801: a ring persists its OWN hypnogram, so `stored` covers it. A 5/MG that cannot
-                    // bond persists nothing (it is never clocked, so it banks nothing) and streams no motion
-                    // either — neither a spine nor a stored night, which is why this day scored blank with
-                    // `reason=no-motion` however much HR it held. Fall back to the HR-only spine ONLY when
-                    // the device supplied nothing of its own: a hypnogram the device actually recorded is
-                    // always better evidence than one inferred from heart rate.
-                    if (stored.isNotEmpty()) {
+            // #804 Fix A + #1801. Two different questions share the "this day has no motion" gate.
+            //
+            // #804 hands over a device's OWN persisted hypnogram (an Oura ring's SleepNet night), and is
+            // deliberately not applied to the import namespace. #1801 stages from heart rate when there is
+            // no hypnogram at all — and that one must NOT inherit #804's owner exclusion, which is the bug
+            // this replaces: `resolveDayOwner` returns [importedDeviceId] whenever the owner source is
+            // absent or the candidates collapse to it, so on a live 5/MG install the whole branch was
+            // skipped before any heart rate was looked at. The field log said so outright once the gate
+            // line existed: `attempted=false reason=imported-owner grav=0`, on a day holding 165,980 HR
+            // rows. A condition written to exclude WHOOP straps was guarding a fallback FOR one.
+            //
+            // The stored lookup now runs for every no-motion day, so "nothing else knows about this
+            // night" is checked rather than assumed. A day that HAS stored sessions is left alone whoever
+            // owns it: inferring a night from heart rate when the device recorded a real one would be
+            // strictly worse evidence replacing better.
+            val providedSleep: List<DetectedSleep> = if (grav.size < 2) {
+                val stored = repo.sleepSessionsForDevice(owner, from, to, 4000)
+                    .mapNotNull { AnalyticsEngine.sleepSessionFromProvided(it) }
+                when {
+                    owner != importedDeviceId && stored.isNotEmpty() -> {
                         dayDiag(SleepStagerTrace.hrOnlyGateLine(
                             attempted = false, reason = "stored-hypnogram",
                             gravRows = grav.size, storedNights = stored.size,
                         ))
                         stored
-                    } else {
+                    }
+                    stored.isNotEmpty() -> {
+                        // The import namespace keeps #804's exclusion — its rows are not handed to
+                        // analyzeDay as "provided" — but they still mean this night is already known,
+                        // so the heart-rate fallback stays out of it.
                         dayDiag(SleepStagerTrace.hrOnlyGateLine(
-                            attempted = true, reason = "no-motion-no-hypnogram",
-                            gravRows = grav.size, storedNights = 0,
+                            attempted = false, reason = "stored-sessions-exist",
+                            gravRows = grav.size, storedNights = stored.size,
                         ))
-                        // Route the spine's funnel through the SAME per-day recorder as `sleep-detect`,
-                        // so one report explains both halves rather than one of them going quiet.
-                        SleepStager.hrOnlySessions(hr, rr, resp, traceSink = ::dayDiag)
+                        emptyList()
                     }
-                } else {
-                    // Only worth saying on a day with NO motion: there the spine was the remaining
-                    // option and something declined it, which is precisely what a silent absence could
-                    // not distinguish. A day WITH motion skips this — the motion spine is the answer
-                    // there and nothing was passed over.
-                    if (grav.size < 2) {
+                    else -> {
+                        // Reachable for ANY owner now, which widens this past the 5/MG it was built for:
+                        // a WHOOP 4.0 day that banked nothing at all (`grav.size < 2`, no stored night)
+                        // also lands here, where the owner check previously blocked it. A normal 4.0 day
+                        // is untouched — it streams gravity, so it never reaches this gate — and a day
+                        // with no motion has too little of anything to clear `minSleepMin`, but "too
+                        // little" is not "none", so the night it could produce is display-only and
+                        // marked [DetectedSleep.hrOnly] like every other.
                         dayDiag(SleepStagerTrace.hrOnlyGateLine(
-                            attempted = false, reason = "imported-owner",
+                            attempted = true, reason = "no-motion-no-hypnogram",
                             gravRows = grav.size, storedNights = 0,
                         ))
+                        SleepStager.hrOnlySessions(hr, rr, resp, traceSink = ::dayDiag)
                     }
-                    emptyList()
                 }
+            } else {
+                emptyList()
+            }
 
             val tScore0 = System.nanoTime()
             dayPrepNanos += tScore0 - tPrep0
diff --git a/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySessionsTest.kt b/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySessionsTest.kt
index 06a7d981da..e8f317771d 100644
--- a/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySessionsTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySessionsTest.kt
@@ -109,6 +109,17 @@ class SleepStagerHrOnlySessionsTest {
             expr.contains("SleepStager.hrOnlySessions("))
         assertTrue("and must only run when the device supplied no hypnogram of its own",
             expr.contains("stored.isNotEmpty()"))
+        // The bug this replaced: the fallback inherited #804's `owner != importedDeviceId` exclusion,
+        // written to keep WHOOP straps OUT of a ring's hypnogram path — and so it never fired on the
+        // WHOOP strap it exists for. `resolveDayOwner` returns importedDeviceId whenever the owner
+        // source is absent, which on a live 5/MG install is every day. Pinned by asserting the owner
+        // check does not stand between the gravity gate and the call: it may still scope the STORED
+        // branch, but not the heart-rate one.
+        val hrOnlyBranch = expr.substring(expr.indexOf("else ->"))
+        assertTrue("the HR-only branch must not be gated on the day's owner",
+            !hrOnlyBranch.contains("importedDeviceId"))
+        assertTrue("but the stored-hypnogram branch keeps #804's exclusion",
+            expr.substring(0, expr.indexOf("else ->")).contains("owner != importedDeviceId"))
     }
 
     /** No HR at all cannot produce a night, and must not throw. */

From 671b265ed93cd187c9afce7b4a828af6560b0255 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 22:38:43 +1200
Subject: [PATCH 169/333] Bump build to 414 for a testing build

Build numbers only: versionCode 413 -> 414, CURRENT_PROJECT_VERSION 294 -> 295. MARKETING_VERSION and
versionName stay 11.1.0, which has only ever been cut as a testing build and never released, so the
artefacts stay v11.1.0 and 414 simply beats the staging high-water.

Carries the gate fix (#1813). Build 413's log showed the HR-only spine had never run at all -
attempted=false reason=imported-owner - so this is the first build where it can be reached. Its iOS
and macOS legs are also the first compile of the Apple half, which no default CI job builds.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index a920a724c7..4382263706 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 413
+        versionCode = 414
         versionName = "11.1.0"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index c4d3114c94..71fe899c92 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "294"
+    CURRENT_PROJECT_VERSION: "295"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 92ce02582fcf7cbf6268ea1e743960ae18688d75 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 23:19:29 +1200
Subject: [PATCH 170/333] live workout: stop the bottom timer sitting under the
 pause button (#1814)

A user asked why their workout screen has two timers. It has one big TIME readout and one in the
floating capsule below - the second is intended, but it was half-hidden behind the pause button, so
the visible fragment read as a broken duplicate.

#1068 built the capsule as a ZStack with the timer centred independently of the buttons, deliberately
"so uneven label widths cannot pull the time off-center". That held while the bar carried one circle
per side. #1533 added the discard and pause controls to the LEFT group, and a centred 40pt timer then
begins exactly where two 56pt circles plus their spacing end: "0:02" merely touched the pause button
and anything wider went under it. Nothing in a ZStack prevents that; the layout assumed no button
would be in the middle. allowsHitTesting(false) on the timer was already a tell that it sat beneath
something tappable.

One HStack now, so overlapping is not expressible. The timer sits centred in the space the buttons
leave rather than in the bar, reading slightly right of true centre because the left chrome is
heavier. The buttons keep the positions they have shipped with - moving pause would centre the timer
better and would also move a control under the thumb of everyone already using this screen.

Two review passes each caught a claim rather than a defect. The first commit asserted the layout
"keeps full width for a 1:30:00" without checking: three circles leave the timer about 161pt inside a
353pt capsule against roughly 144pt for that clock, which fits on a 393pt screen and does not on a
375pt one - so it scales rather than overflows. The second added layoutPriority(1), which inverted
which element gives way: the circles are fixed 56pt frames, so they clip rather than shrink, and
sizing the Text first would have amputated a button instead of shrinking a clock. The priority is
gone rather than reversed.

No Android twin: that screen renders the clock once, and its controls are a Row, so the overlap is
not expressible there either.

NOT COMPILED AND NOT SEEN - app-target Swift with no local build and no default CI job. swiftc -parse
is syntax only. The testing build's iOS leg compiles it; a screenshot is what should be allowed to
contradict the layout reasoning above.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RupifTqaTTytpPjfpMvJuj
---
 Strand/Screens/LiveWorkoutView.swift | 60 +++++++++++++++++++++-------
 1 file changed, 46 insertions(+), 14 deletions(-)

diff --git a/Strand/Screens/LiveWorkoutView.swift b/Strand/Screens/LiveWorkoutView.swift
index 6bbb741300..eb57288846 100644
--- a/Strand/Screens/LiveWorkoutView.swift
+++ b/Strand/Screens/LiveWorkoutView.swift
@@ -318,27 +318,59 @@ struct LiveWorkoutView: View {
 
     // MARK: - Bottom floating controls
 
-    /// Diameter shared by the exit and workout-type Liquid Glass circles so the centered timer stays
-    /// optically balanced against equal side chrome.
+    /// Diameter shared by every Liquid Glass circle in the bottom capsule, so the row reads as one
+    /// set of controls rather than a mix of sizes.
+    ///
+    /// It used to justify itself as keeping "the centered timer optically balanced against equal side
+    /// chrome". The side chrome has not been equal since #1533 put two circles on the left and one on
+    /// the right, and the timer is no longer centred against them — see `bottomControlRow`.
     private static let bottomControlDiameter: CGFloat = 56
     /// Tight inset so the glass circles nest into the capsule ends (stopwatch-bar proportions).
     private static let bottomBarInset: CGFloat = 4
 
-    /// One shared dark floating capsule: Liquid Glass exit · elapsed · Liquid Glass workout-type.
-    /// The timer is centered in the bar via ZStack; the glass circles sit in a separate HStack so
-    /// uneven label widths cannot pull the time off-center. The capsule itself is solid elevated
-    /// chrome — not Liquid Glass.
+    /// One shared dark floating capsule: discard · pause · elapsed · end.
+    ///
+    /// Laid out in ONE HStack, so the timer and the controls cannot overlap. #1068 built this as a
+    /// ZStack with the timer centred independently — deliberately, "so uneven label widths cannot pull
+    /// the time off-center" — and that held while the bar carried one circle per side. #1533 added the
+    /// discard and pause controls to the left group, and a centred 40pt timer then began where two
+    /// 56pt circles plus their spacing end: `0:02` merely touched the pause button, and anything wider
+    /// went under it. A field report of "two timers" was this one half-occluded, read as a duplicate of
+    /// the big TIME readout above. `.allowsHitTesting(false)` on the timer was already a tell that it
+    /// sat beneath something tappable.
+    ///
+    /// The trade is deliberate: the timer now sits centred in the space the buttons leave rather than
+    /// in the bar, so it reads slightly right of true centre because the left chrome is heavier. That
+    /// is the cost of the layout being unable to collide at all. The buttons keep the positions they
+    /// have shipped with — moving pause to the right would centre the timer better and would also move
+    /// a control under the thumb of everyone already using this screen, which is a worse trade than an
+    /// off-centre clock.
+    ///
+    /// It can still run out of ROOM, and the arithmetic is tighter than it looks: three 56pt circles
+    /// and their gaps leave the timer roughly 161pt on a 393pt screen, against about 144pt for a
+    /// `1:30:00` at 40pt monospaced. On a 375pt device, or at a larger Dynamic Type, that does not fit,
+    /// so the timer scales rather than overflowing the capsule. The alternative considered — padding
+    /// the timer clear of the widest group to keep true centring — left it barely 105pt and would have
+    /// truncated the same clock outright.
     private var bottomControlRow: some View {
-        ZStack {
+        HStack(spacing: NoopMetrics.space2) {
+            deleteWorkoutGlassButton
+            pauseWorkoutGlassButton
+            Spacer(minLength: NoopMetrics.space2)
             bottomElapsedTimer
                 .allowsHitTesting(false)
-
-            HStack(spacing: NoopMetrics.space2) {
-                deleteWorkoutGlassButton
-                pauseWorkoutGlassButton
-                Spacer(minLength: 0)
-                endWorkoutGlassButton
-            }
+                // Scaling down is the honest failure when the room runs out: truncating a clock to
+                // "1:30:0" would be worse than a smaller one. Same idiom the rest of this file uses.
+                .lineLimit(1)
+                .minimumScaleFactor(0.6)
+                // NO layoutPriority here, deliberately. Raising the timer's priority sizes it BEFORE
+                // the three circles, and those are fixed 56pt frames — inflexible, so when the space
+                // runs out they do not shrink, they clip. That inverts which element gives way: a
+                // half-drawn pause button is worse than a smaller clock, and a clipped control is the
+                // failure this whole change exists to remove. At equal priority the inflexible frames
+                // are satisfied first and the Text scales into what is left, which is the order wanted.
+            Spacer(minLength: NoopMetrics.space2)
+            endWorkoutGlassButton
         }
         .padding(Self.bottomBarInset)
         .background {

From b43b8f0ff0206c1e5d7c1deea5e0a2d12891448d Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 23:30:13 +1200
Subject: [PATCH 171/333] steps: stop the calibration card asking for the half
 the user already has (#1815)

A WHOOP 4.0 user with no synced motion asked whether entering their Apple Health steps by hand would
start NOOP counting and calibrating. It would not, and the sheet is why they thought it might.

With no banked motion the card still showed "Need 1 more day where your phone also counted steps",
naming phone-step days as the blocker. They are not. A step estimate is motion * coefficient
(StepsEstimateEngine.estimate returns nil below minMotionForFit) and a calibration point is the ratio
steps / motion, so both halves are required: with the motion half missing neither the estimate nor
the fit moves however many days the phone counts, and setting the coefficient by hand does not help
because the thing being multiplied is what is absent.

So the countdown pointed at the one input the user could supply while the input they needed went
unmentioned in that card, competing with the no-motion banner directly above it - and the user
believed the countdown. The countdown and its explanatory line now render only when motion exists.

Deliberately no new copy: the banner already says the right thing, so the fix is to stop
contradicting it rather than add a third message. The comparison card is untouched for the same
reason - "no days yet where both counted" is true in this state. Net diff is two lines and the
comment explaining them.

Re-review caught the guard testing sampleMotion == nil alone, which is also true DURING the load, so
the countdown vanished in a window where the banner had not appeared and the card explained nothing.
The banner's condition is didLoad && sampleMotion == nil; both now read one named strapHasNoMotion so
they cannot drift apart again.

Not a fix for the underlying no-motion case - on a 4.0 that is a history sync that has not completed,
and #1149 covers the harder version. The same misdirection on the Today tile and its Kotlin twin is
filed as #1816; neither Today screen has a motion signal to gate on, so that one is a design decision
rather than a guard.

NOT COMPILED AND NOT SEEN: app-target Swift, no local build, no default CI job.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RupifTqaTTytpPjfpMvJuj
---
 Strand/Screens/SettingsView.swift | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/Strand/Screens/SettingsView.swift b/Strand/Screens/SettingsView.swift
index 78971c7554..070e0cae75 100644
--- a/Strand/Screens/SettingsView.swift
+++ b/Strand/Screens/SettingsView.swift
@@ -3319,6 +3319,15 @@ struct StepsCalibrationSheet: View {
     @State private var draftManual: Double = 0
     @State private var didLoad = false
 
+    /// The strap has banked no motion, and we have looked.
+    ///
+    /// Named once because two places depend on it and they must stay exactly complementary: the
+    /// no-motion banner appears, and the calibration countdown does NOT. Written as two separate
+    /// expressions they drifted immediately — the guard's first draft tested `sampleMotion == nil`
+    /// alone, which is also true during the load, so the countdown vanished in a window where the
+    /// banner had not appeared yet and the card explained nothing at all.
+    private var strapHasNoMotion: Bool { didLoad && sampleMotion == nil }
+
     /// #107: the sheet's guidance depends on the strap family. A WHOOP 4.0 streams motion automatically, so
     /// "let it sync" is right; a 5/MG only streams motion once the experimental deep-data unlock is on, so
     /// the 4.0 advice is futile there and the empty state must say so instead.
@@ -3339,7 +3348,7 @@ struct StepsCalibrationSheet: View {
             ScrollView {
                 VStack(alignment: .leading, spacing: NoopMetrics.sectionSpacing) {
                     explainerCard
-                    if didLoad && sampleMotion == nil { noMotionNote }
+                    if strapHasNoMotion { noMotionNote }
                     currentFitCard
                     comparisonCard
                     manualAdjustCard
@@ -3497,6 +3506,18 @@ struct StepsCalibrationSheet: View {
                     Text("Not calibrated yet")
                         .font(StrandFont.bodyNumber)
                         .foregroundStyle(StrandPalette.textPrimary)
+                    // Only ask for phone-step days when phone-step days are what is actually missing.
+                    //
+                    // A step estimate is `motion * coefficient` (`StepsEstimateEngine.estimate`) and a
+                    // calibration point is the ratio `steps / motion`, so BOTH halves are required. With no
+                    // banked strap motion neither the estimate nor the fit can move however many days the
+                    // phone counts. The countdown below then names the half the user already has and hides
+                    // the half they do not — a field report asked whether entering Apple Health steps by
+                    // hand would start the calibration, which is exactly the conclusion it invites.
+                    //
+                    // The no-motion banner at the top of this sheet already explains the real blocker, so
+                    // the honest move is to stop competing with it rather than to add more copy.
+                    if !strapHasNoMotion {
                     // #589: a concrete countdown instead of a vague "a few days". Headline comes straight
                     // from the engine's needsMoreDays state so the wording matches the Today steps tile.
                     // #693: drive `have` off `profile.stepsCalibrationSampleDays` — the value the engine
@@ -3514,6 +3535,7 @@ struct StepsCalibrationSheet: View {
                         .font(StrandFont.footnote)
                         .foregroundStyle(StrandPalette.textTertiary)
                         .fixedSize(horizontal: false, vertical: true)
+                    }
                 }
             }
         }

From a741dbc4ec81746eccc9ac589b23d4921ef49f08 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 23:31:06 +1200
Subject: [PATCH 172/333] Bump build to 415 for a testing build

Build numbers only: versionCode 414 -> 415, CURRENT_PROJECT_VERSION 295 -> 296. MARKETING_VERSION and
versionName stay 11.1.0, which has only ever been cut as a testing build.

Carries two Apple-only UI fixes that no default CI job compiles - the live-workout capsule timer no
longer sitting under the pause button (#1814) and the steps calibration card no longer asking for
phone-step days when the missing half is strap motion (#1815). This build's iOS and macOS legs are
their first compile, and a screenshot is what confirms either of them actually looks right.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RupifTqaTTytpPjfpMvJuj
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 4382263706..8d7b7252b8 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 414
+        versionCode = 415
         versionName = "11.1.0"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 71fe899c92..de398af06f 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "295"
+    CURRENT_PROJECT_VERSION: "296"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 9d709813e418ad7535988e1c928452bfe4a30717 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 00:04:44 +1200
Subject: [PATCH 173/333] Coach: send sleep stage breakdown and normalised
 efficiency (#1817)

The coach context now carries deep/REM/light minutes and sleep efficiency on
both platforms, so it stops answering that it cannot see sleep stages.

Efficiency is normalised before formatting (some import paths deliver it as a
percent already, others as a fraction), avoiding a nonsensical "eff 9400%".

Reported on #1816.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RupifTqaTTytpPjfpMvJuj
---
 Strand/AI/AICoach.swift                       | 52 +++++++++++++++--
 StrandTests/AICoachSleepContextTests.swift    | 52 +++++++++++++++++
 .../app/src/main/java/com/noop/ai/AiCoach.kt  | 37 +++++++++++-
 .../java/com/noop/ai/AiCoachContextTest.kt    | 57 ++++++++++++++++++-
 4 files changed, 191 insertions(+), 7 deletions(-)
 create mode 100644 StrandTests/AICoachSleepContextTests.swift

diff --git a/Strand/AI/AICoach.swift b/Strand/AI/AICoach.swift
index 9046711e4b..54099c89c4 100644
--- a/Strand/AI/AICoach.swift
+++ b/Strand/AI/AICoach.swift
@@ -225,8 +225,10 @@ final class AICoachEngine: ObservableObject {
     static let defaultSystemPrompt = """
     You are an elite, supportive recovery and performance coach with a real training methodology. \
     You may be given a summary of the user's own wearable data (charge 0-100, effort 0-100, rest 0-100, \
-    HRV, resting heart rate) and recent workouts. Charge is the daily recovery/readiness score, effort \
-    is the daily cardiovascular load score, and rest is the nightly sleep-quality score. \
+    sleep duration and its deep/REM/light breakdown, sleep efficiency, HRV, resting heart rate) and \
+    recent workouts. Charge is the daily recovery/readiness score, effort is the daily cardiovascular \
+    load score, and rest is the nightly sleep-quality score. A dash in the data means that value was \
+    NOT MEASURED that day — say so rather than treating it as a zero. \
     Coach using autoregulation:
     • Readiness → prescription: charge 67-100 = green light to build/push, higher effort is fine; \
     34-66 = maintain, quality over volume, keep it controlled; 0-33 = active recovery only \
@@ -746,7 +748,8 @@ final class AICoachEngine: ObservableObject {
         // Last ~14 days, newest first for readability.
         let recent = Array(days.suffix(14)).reversed()
         lines.append("")
-        lines.append("Recent days (newest first) — charge(0-100), effort(0-100), rest/sleep(h), HRV(ms), RHR(bpm):")
+        lines.append("Recent days (newest first) — charge(0-100), effort(0-100), rest/sleep(h), "
+                     + "deep/REM/light(h), eff(%), HRV(ms), RHR(bpm). A dash means NOT MEASURED, not zero:")
         for d in recent {
             lines.append("  " + dayLine(d))
         }
@@ -791,16 +794,57 @@ final class AICoachEngine: ObservableObject {
 
     // MARK: Formatting helpers
 
-    private func dayLine(_ d: DailyMetric) -> String {
+    /// `internal`, not private, so `AICoachSleepContextTests` can assert the emitted line directly.
+    /// Swift's `buildContext()` takes no arguments (it reads the repo), unlike the Kotlin twin which is
+    /// handed the day list — so without this the formatter has no seam and the Swift half of a change
+    /// with fifteen Kotlin tests would ship untested.
+    func dayLine(_ d: DailyMetric) -> String {
         var parts: [String] = [d.day + ":"]
         parts.append("charge " + (d.recovery.map { "\(Int($0.rounded()))" } ?? "—"))
         parts.append("effort " + (d.strain.map { String(format: "%.1f", $0) } ?? "—"))
         parts.append("rest " + (d.totalSleepMin.map { String(format: "%.1fh", $0 / 60) } ?? "—"))
+        // The stage breakdown and efficiency, which the coach could not see at all: a user asked why it
+        // said it had no access to sleep stages, and it was answering honestly — `rest 7.8h` was every
+        // word it got about a night. These four sit on the SAME DailyMetric the line already reads, so
+        // nothing new is plumbed; they were simply never included. (#124 widened this context once
+        // before, for the same reason.)
+        //
+        // Always emitted, "—" when absent, like every other field here. A night with no staging then
+        // says so rather than going quiet, which matters more than line length: the alternative — only
+        // appending stages when present — gives the model a schema that changes shape between days and
+        // invites it to read a missing field as a zero.
+        parts.append("deep " + hoursOrDash(d.deepMin))
+        parts.append("REM " + hoursOrDash(d.remMin))
+        parts.append("light " + hoursOrDash(d.lightMin))
+        parts.append("eff " + efficiencyPercentOrDash(d.efficiency))
         parts.append("HRV " + (d.avgHrv.map { "\(Int($0.rounded()))ms" } ?? "—"))
         parts.append("RHR " + (d.restingHr.map { "\($0)bpm" } ?? "—"))
         return parts.joined(separator: ", ")
     }
 
+    /// Minutes as "1.4h", or "—" when the night has no value. Matches the `rest` field's format so a
+    /// stage total and the total it is part of read on the same scale.
+    private func hoursOrDash(_ minutes: Double?) -> String {
+        minutes.map { String(format: "%.1fh", $0 / 60) } ?? "—"
+    }
+
+    /// Efficiency as a percentage, NORMALISING the stored value first.
+    ///
+    /// `DailyMetric.efficiency` is not reliably a 0–1 fraction: it "arrives as % on some import paths",
+    /// which `SleepView` and `StagesCard` each guard against inline with this same `> 1.5` test. A bare
+    /// `* 100` would therefore hand the coach "eff 9400%" for an imported night — and a model given a
+    /// nonsense number reasons about it confidently rather than ignoring it.
+    ///
+    /// 1.5 rather than 1.0 because a genuine fraction can exceed 1.0 only by floating-point noise, while
+    /// a genuine percentage is 30–100 and nowhere near the threshold. Android's two copies of this guard
+    /// split at 1.0 instead, which is a pre-existing divergence and not this change's to settle.
+    func efficiencyPercentOrDash(_ raw: Double?) -> String {
+        guard var e = raw, e > 0 else { return "—" }
+        if e > 1.5 { e /= 100 }
+        guard e > 0, e <= 1 else { return "—" }
+        return "\(Int((e * 100).rounded()))%"
+    }
+
     private func avgOne(_ xs: [Double]) -> String {
         guard !xs.isEmpty else { return "—" }
         return String(format: "%.1f", xs.reduce(0, +) / Double(xs.count))
diff --git a/StrandTests/AICoachSleepContextTests.swift b/StrandTests/AICoachSleepContextTests.swift
new file mode 100644
index 0000000000..47197c8c8c
--- /dev/null
+++ b/StrandTests/AICoachSleepContextTests.swift
@@ -0,0 +1,52 @@
+import XCTest
+@testable import Strand
+import WhoopStore
+
+/// The sleep detail the coach could not see (#1817), and the normalisation that stops it reading
+/// nonsense. Twin of the Kotlin `AiCoachContextTest` cases; the formatters are pure, so this runs
+/// headlessly with no repo reads.
+@MainActor
+final class AICoachSleepContextTests: XCTestCase {
+
+    private func engine() -> AICoachEngine {
+        AICoachEngine(repo: Repository(deviceId: "test-aicoach-sleep"))
+    }
+
+    private func day(deep: Double? = nil, rem: Double? = nil,
+                     light: Double? = nil, efficiency: Double? = nil) -> DailyMetric {
+        DailyMetric(day: "2026-06-01", totalSleepMin: 450, efficiency: efficiency,
+                    deepMin: deep, remMin: rem, lightMin: light, disturbances: nil,
+                    restingHr: 52, avgHrv: 65, recovery: 67, strain: 12.3, exerciseCount: nil)
+    }
+
+    /// `rest 7.5h` used to be every word the coach got about a night.
+    func testStagesReachTheContextLine() {
+        let line = engine().dayLine(day(deep: 84, rem: 114, light: 252, efficiency: 0.94))
+        XCTAssertTrue(line.contains("deep 1.4h"), line)
+        XCTAssertTrue(line.contains("REM 1.9h"), line)
+        XCTAssertTrue(line.contains("light 4.2h"), line)
+        XCTAssertTrue(line.contains("eff 94%"), line)
+    }
+
+    /// A night with no staging says so rather than the field vanishing, so the model cannot read a
+    /// missing stage as a zero.
+    func testUnstagedNightReportsDashesNotSilence() {
+        let line = engine().dayLine(day())
+        XCTAssertTrue(line.contains("deep —"), line)
+        XCTAssertTrue(line.contains("REM —"), line)
+        XCTAssertTrue(line.contains("light —"), line)
+        XCTAssertTrue(line.contains("eff —"), line)
+    }
+
+    /// Efficiency arrives as a PERCENTAGE on some import paths, which `SleepView` and `StagesCard`
+    /// each guard against inline. Without the same guard a bare `* 100` sends "eff 9400%".
+    func testEfficiencyStoredAsPercentageIsNotMultipliedAgain() {
+        let e = engine()
+        XCTAssertEqual(e.efficiencyPercentOrDash(0.94), "94%")
+        XCTAssertEqual(e.efficiencyPercentOrDash(94.0), "94%")
+        XCTAssertEqual(e.efficiencyPercentOrDash(nil), "—")
+        XCTAssertEqual(e.efficiencyPercentOrDash(0), "—")
+        // Above a fraction but below the percentage split: not a value this can honestly render.
+        XCTAssertEqual(e.efficiencyPercentOrDash(1.2), "—")
+    }
+}
diff --git a/android/app/src/main/java/com/noop/ai/AiCoach.kt b/android/app/src/main/java/com/noop/ai/AiCoach.kt
index 07f6e87acc..86b0c3cc5f 100644
--- a/android/app/src/main/java/com/noop/ai/AiCoach.kt
+++ b/android/app/src/main/java/com/noop/ai/AiCoach.kt
@@ -255,8 +255,19 @@ class AiCoach(
             val sleepH = d.totalSleepMin?.let { fmt1(it / 60.0) + "h" } ?: "-"
             val hrv = d.avgHrv?.let { "${it.roundToInt()}ms" } ?: "-"
             val rhr = d.restingHr?.let { "${it}bpm" } ?: "-"
+            // The stage breakdown and efficiency, which the coach could not see at all: a user asked why
+            // it said it had no access to sleep stages, and it was answering honestly — `rest 7.8h` was
+            // every word it got about a night. These sit on the SAME DailyMetric this line already reads.
+            // Always emitted, "-" when absent, like every other field: a night with no staging then says
+            // so, rather than the schema changing shape between days and inviting the model to read a
+            // missing field as a zero. Twin of the Swift `AICoach.dayLine`.
+            val deep = d.deepMin?.let { fmt1(it / 60.0) + "h" } ?: "-"
+            val rem = d.remMin?.let { fmt1(it / 60.0) + "h" } ?: "-"
+            val light = d.lightMin?.let { fmt1(it / 60.0) + "h" } ?: "-"
+            val eff = effPctOrDash(d.efficiency)
             sb.append(
-                "  ${d.day}: charge $recovery, effort $strain, rest $sleepH, HRV $hrv, RHR $rhr\n"
+                "  ${d.day}: charge $recovery, effort $strain, rest $sleepH, " +
+                    "deep $deep, REM $rem, light $light, eff $eff, HRV $hrv, RHR $rhr\n"
             )
         }
 
@@ -720,6 +731,27 @@ class AiCoach(
     // Small numeric formatting helpers
     // ---------------------------------------------------------------------------------------
 
+    /**
+     * Efficiency as a percentage, NORMALISING the stored value first.
+     *
+     * `DailyMetric.efficiency` is not reliably a 0-1 fraction - it arrives as a percentage on some
+     * import paths, which SleepMetricDetailLogic and SleepModelLogic each guard against inline. A bare
+     * `* 100` would hand the coach "eff 9400%" for an imported night, and a model given a nonsense
+     * number reasons about it confidently rather than ignoring it.
+     *
+     * 1.5 rather than 1.0 because a genuine fraction can exceed 1.0 only by floating-point noise, while
+     * a genuine percentage is 30-100. The two existing Kotlin copies split at 1.0; matching the Swift
+     * twin here keeps the COACH line consistent across platforms, and the wider divergence between
+     * those thresholds is pre-existing and not this change's to settle.
+     */
+    private fun effPctOrDash(raw: Double?): String {
+        var e = raw ?: return "-"
+        if (e <= 0.0) return "-"
+        if (e > 1.5) e /= 100.0
+        if (e <= 0.0 || e > 1.0) return "-"
+        return "${(e * 100).roundToInt()}%"
+    }
+
     private fun fmt1(v: Double): String =
         if (v == v.roundToInt().toDouble()) v.roundToInt().toString()
         else String.format("%.1f", v)
@@ -905,7 +937,8 @@ class AiCoach(
         const val DEFAULT_SYSTEM_PROMPT =
             "You are an elite, supportive recovery and performance coach with a real training " +
                 "methodology. You may be given a summary of the user's own wearable data (charge " +
-                "0-100, effort 0-100, rest/sleep, HRV, resting heart rate) and recent workouts. " +
+                "0-100, effort 0-100, rest/sleep and its deep/REM/light breakdown, sleep " +
+                "efficiency, HRV, resting heart rate) and recent workouts. " +
                 "Charge is the daily recovery/readiness score; effort is the day's cardiovascular " +
                 "load. Coach using autoregulation: charge 67-100 = green light to build/push, " +
                 "higher effort is fine; 34-66 = maintain, quality over volume, keep it controlled; " +
diff --git a/android/app/src/test/java/com/noop/ai/AiCoachContextTest.kt b/android/app/src/test/java/com/noop/ai/AiCoachContextTest.kt
index 38c15eb6de..7fb625963f 100644
--- a/android/app/src/test/java/com/noop/ai/AiCoachContextTest.kt
+++ b/android/app/src/test/java/com/noop/ai/AiCoachContextTest.kt
@@ -43,6 +43,55 @@ class AiCoachContextTest {
         strain = 12.3,
     )
 
+    /**
+     * The sleep detail the coach could not see. A user asked why it said it had no access to sleep
+     * stages, and it was answering honestly: `rest 7.5h` was every word the context carried about a
+     * night, while `deepMin`/`remMin`/`lightMin`/`efficiency` sat unread on the SAME row.
+     *
+     * Absence is asserted too, in the same shape as every other field: a night with no staging must
+     * say "-" rather than go quiet, so the model cannot read a missing stage as a zero.
+     */
+    @Test
+    fun sleepStagesAndEfficiencyReachTheCoach() {
+        val withStages = computedRow(june(1)).copy(
+            deepMin = 84.0,      // 1.4h
+            remMin = 114.0,      // 1.9h
+            lightMin = 252.0,    // 4.2h
+            efficiency = 0.94,
+        )
+        val ctx = coach().buildContext(listOf(withStages))
+        assertTrue("deep", ctx.contains("deep 1.4h"))
+        assertTrue("REM", ctx.contains("REM 1.9h"))
+        assertTrue("light", ctx.contains("light 4.2h"))
+        assertTrue("efficiency", ctx.contains("eff 94%"))
+        assertTrue("the prompt must claim what it now sends",
+            AiCoach.DEFAULT_SYSTEM_PROMPT.contains("deep/REM/light"))
+    }
+
+    /**
+     * Efficiency arrives as a PERCENTAGE on some import paths, not a 0-1 fraction — SleepMetricDetail
+     * and SleepModel each guard against that inline. Without the same guard here a bare `* 100` sends
+     * the coach "eff 9400%", and a model handed a nonsense number reasons about it confidently.
+     */
+    @Test
+    fun anEfficiencyStoredAsAPercentageIsNotMultipliedAgain() {
+        val asFraction = coach().buildContext(listOf(computedRow(june(1)).copy(efficiency = 0.94)))
+        val asPercent = coach().buildContext(listOf(computedRow(june(1)).copy(efficiency = 94.0)))
+        assertTrue("fraction", asFraction.contains("eff 94%"))
+        assertTrue("percentage", asPercent.contains("eff 94%"))
+        assertFalse("never multiplied twice", asPercent.contains("9400%"))
+    }
+
+    /** A night with no staging says so, rather than the field vanishing from the line. */
+    @Test
+    fun anUnstagedNightReportsDashesNotSilence() {
+        val ctx = coach().buildContext(listOf(computedRow(june(1))))
+        assertTrue("deep", ctx.contains("deep -"))
+        assertTrue("REM", ctx.contains("REM -"))
+        assertTrue("light", ctx.contains("light -"))
+        assertTrue("efficiency", ctx.contains("eff -"))
+    }
+
     /** Consecutive June days, oldest first (lexicographic = chronological for YYYY-MM-DD). */
     private fun june(dayOfMonth: Int) = "2026-06-%02d".format(dayOfMonth)
 
@@ -91,7 +140,13 @@ class AiCoachContextTest {
         val ctx = coach().buildContext(merged)
 
         // Sleep is real; everything unrecorded is a dash on every daily line.
-        assertTrue("daily dashes", ctx.contains("charge -, effort -, rest 7h, HRV -, RHR -"))
+        // Repinned for the stage fields (#1817), NOT weakened: still one contiguous line asserting that
+        // every unrecorded value is a dash, now including deep/REM/light/eff. Keeping it contiguous is
+        // the point — it is what catches a field silently dropping out of the line.
+        assertTrue(
+            "daily dashes",
+            ctx.contains("charge -, effort -, rest 7h, deep -, REM -, light -, eff -, HRV -, RHR -"),
+        )
         assertTrue("latest snapshot n/a", ctx.contains("charge n/a, effort n/a"))
         // Never an invented score: no digit ever follows "recovery " or "HRV ".
         assertFalse("invented charge", Regex("charge \\d").containsMatchIn(ctx))

From edb6e993ed9bb2b96c0b03f7335e7a287ceebd27 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 00:36:02 +1200
Subject: [PATCH 174/333] rtc: stop telling an already-charged strap to charge
 it (#1819)

Splits the 1970/71 clock remedy on battery, so an already-charged strap is no longer told
to charge to 100% - the advice a WHOOP 4.0 reporter had already followed twice.

The battery term reads the per-link sample buffer, not the last-known charge that
deliberately outlives the link, so a strap that ran flat still gets the charge advice.
The charged copy states only what holds for every strap and asks for a strap log; it makes
no claim about SET_CLOCK, which is unconditional on WHOOP4 but gated behind didBond on a
5/MG (#1635). Threshold value and copy are pinned identical on both platforms.

User-visible on Apple only - the Kotlin twin has no Android caller today.

Reported on #1818.
---
 .../StrandAnalytics/ConnectionReadout.swift   | 32 ++++++++++++--
 .../ConnectionReadoutTests.swift              | 42 +++++++++++++++++++
 Strand/Screens/DevicesView.swift              | 10 ++++-
 Strand/Screens/TestCentreView.swift           |  3 +-
 .../com/noop/analytics/ConnectionReadout.kt   | 33 +++++++++++++--
 .../noop/analytics/ConnectionReadoutTest.kt   | 33 +++++++++++++++
 6 files changed, 144 insertions(+), 9 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift
index 91d554dc5e..44b91fc140 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift
@@ -233,17 +233,43 @@ public enum ConnectionReadout {
         return "no (waiting for the strap clock)"
     }
 
+    /// #1818: at or above this charge the "charge it" remedy is already satisfied, so repeating it is
+    /// noise. Twin of the Kotlin constant - the two must move together or the platforms give
+    /// different advice for the same strap.
+    public static let rtcAlreadyChargedPct: Double = 95
+
     /// #987: a plain-words warning when the strap RTC reads epoch-era (~1970/71), from EITHER signal we
     /// hold: the correlated device clock or the strap's newest banked-record timestamp. nil when both
     /// look sane (or neither was seen yet - we never fabricate a fault). One string, shown verbatim on
     /// the Devices / Test Centre connection readout, naming the consequence and the fix.
-    public static func rtcWarning(deviceClockUnix: Int?, strapNewestUnix: Int?) -> String? {
+    ///
+    /// #1818: the remedy is battery-dependent. A flat battery resets the RTC, so on a low strap
+    /// "charge it" is real advice. On an ALREADY-charged strap it is not, and the old copy sent users
+    /// at 100% round a loop they had already run.
+    ///
+    /// The charged branch deliberately states only what holds for EVERY strap - that charging again
+    /// will not change it - and asks for a log. It must NOT claim NOOP re-sends the clock on every
+    /// connect: that is true on WHOOP4 (`runConnectHandshake` calls SET_CLOCK unconditionally, both
+    /// payload forms, #120) but FALSE on a 5/MG, where the clock write is gated behind `didBond`, and
+    /// an unbondable 5/MG (#1635) is never clocked at all - precisely the strap most likely to be
+    /// showing this warning. Explaining the mechanism in the sentence is how the original bug happened.
+    /// `batteryPct` nil (not yet read) keeps the charge advice - we only withdraw it on evidence.
+    /// Callers MUST pass a reading from the CURRENT link (iOS: `batterySamples.last?.soc`, which is
+    /// cleared on disconnect) and not a last-known charge that outlives it - a stale 100% would
+    /// suppress the advice in the one case it is right, a strap that ran flat and reset its RTC.
+    public static func rtcWarning(deviceClockUnix: Int?, strapNewestUnix: Int?,
+                                  batteryPct: Double? = nil) -> String? {
         let ceiling = ConnectionTrace.rtcEpochCeilingUnix
         let clockBad = deviceClockUnix.map { $0 > 0 && $0 < ceiling } ?? false
         let newestBad = strapNewestUnix.map { $0 > 0 && $0 < ceiling } ?? false
         guard clockBad || newestBad else { return nil }
-        return "Strap clock reads 1970/71 (never set since its last reset), so it is not banking history. "
-            + "Charge the strap to 100% and reconnect so the clock latches."
+        let lead = "Strap clock reads 1970/71 (never set since its last reset), so it is not banking history. "
+        if let batteryPct, batteryPct >= rtcAlreadyChargedPct {
+            return lead
+                + "The strap is already charged, so charging again will not change this. Export a strap "
+                + "log from Test Centre so the clock exchange can be read."
+        }
+        return lead + "Charge the strap to 100% and reconnect so the clock latches."
     }
 
     /// #987: freshness label for the "last frame" readout row: how long ago the most recent strap frame
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ConnectionReadoutTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ConnectionReadoutTests.swift
index fac6073f3a..5dcdfdb051 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ConnectionReadoutTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ConnectionReadoutTests.swift
@@ -224,6 +224,48 @@ final class ConnectionReadoutTests: XCTestCase {
                      "no signal seen yet must not fabricate a fault")
     }
 
+    /// #1818: the remedy must track the battery. A charged strap told to "charge to 100%" is the bug
+    /// the field report hit - the user had already done it, twice.
+    func testRtcWarningRemedyTracksBattery() {
+        let flat = ConnectionReadout.rtcWarning(deviceClockUnix: 40_000_000, strapNewestUnix: nil,
+                                                batteryPct: 40)
+        XCTAssertEqual(flat?.contains("Charge the strap to 100%"), true,
+                       "a low strap keeps the charge advice - a flat battery really does reset the RTC")
+
+        let charged = ConnectionReadout.rtcWarning(deviceClockUnix: 40_000_000, strapNewestUnix: nil,
+                                                   batteryPct: 100)
+        XCTAssertEqual(charged?.contains("Charge the strap to 100%"), false,
+                       "an already-charged strap must not be sent round the loop it just ran")
+        XCTAssertEqual(charged?.contains("already charged"), true)
+        XCTAssertEqual(charged?.contains("strap log"), true, "it must name the next actionable step")
+        // The charged copy must stay true for EVERY strap. "NOOP re-sends the clock on every connect"
+        // holds on WHOOP4 but not on a 5/MG, where the write is gated behind didBond and an unbondable
+        // strap (#1635) is never clocked at all - the strap most likely to be showing this warning.
+        XCTAssertEqual(charged?.contains("every connect"), false,
+                       "no model-specific mechanism claim in copy shown to every model")
+
+        // Pin the VALUE, not just the symbol: feeding the constant back into the function under test
+        // can never catch a wrong threshold, and nothing else would catch it drifting away from the
+        // Kotlin twin - the two platforms would each keep passing while giving different advice.
+        XCTAssertEqual(ConnectionReadout.rtcAlreadyChargedPct, 95)
+
+        // Boundary, from both sides, with literals: inclusive at 95, charge advice at 94.
+        let atThreshold = ConnectionReadout.rtcWarning(deviceClockUnix: 40_000_000,
+                                                       strapNewestUnix: nil, batteryPct: 95)
+        XCTAssertEqual(atThreshold?.contains("already charged"), true)
+        let justBelow = ConnectionReadout.rtcWarning(deviceClockUnix: 40_000_000,
+                                                     strapNewestUnix: nil, batteryPct: 94)
+        XCTAssertEqual(justBelow?.contains("Charge the strap to 100%"), true)
+
+        // Battery not read yet: we only withdraw advice on evidence, so the default stands.
+        let unknown = ConnectionReadout.rtcWarning(deviceClockUnix: 40_000_000, strapNewestUnix: nil)
+        XCTAssertEqual(unknown?.contains("Charge the strap to 100%"), true)
+
+        // A sane clock stays silent no matter how full the battery is.
+        XCTAssertNil(ConnectionReadout.rtcWarning(deviceClockUnix: 1_782_475_600,
+                                                  strapNewestUnix: 1_782_475_000, batteryPct: 100))
+    }
+
     func testLastFrameLabel() {
         XCTAssertEqual(ConnectionReadout.lastFrameLabel(lastFrameUnix: 990, nowUnix: 1_002), "12s ago")
         XCTAssertEqual(ConnectionReadout.lastFrameLabel(lastFrameUnix: nil, nowUnix: 1_002), "no frames yet")
diff --git a/Strand/Screens/DevicesView.swift b/Strand/Screens/DevicesView.swift
index d00f23aab2..5c5d57346d 100644
--- a/Strand/Screens/DevicesView.swift
+++ b/Strand/Screens/DevicesView.swift
@@ -91,6 +91,13 @@ private struct DevicesContent: View {
     /// has produced any clock signal - a routed frame, a clock correlation, or a data-range reply - so a
     /// generic HR strap or an idle card never shows a fabricated "waiting" state. One computation for
     /// both the line and the warning (the log scan is the cost worth paying once, not twice).
+    ///
+    /// #1818: the battery term reads `batterySamples.last`, NOT `batteryPct`. `batteryPct` deliberately
+    /// outlives the link (`clearBiometrics` leaves it) so Today/the widget can show a last-known charge,
+    /// and a 21 h old reading is indistinguishable from a fresh one there (#530). Withdrawing the "charge
+    /// it" advice on a stale 100% would suppress it in exactly the case it is right - a strap that ran
+    /// flat, which is what reset the RTC, reconnecting before its first battery event. `batterySamples`
+    /// is cleared on disconnect, so `.last` is a reading from THIS link or nothing.
     private var strapClockState: (line: String, warning: String?)? {
         guard live.connected else { return nil }
         let deviceClock = ConnectionReadout.clockCorrelatedDevice(logLines: live.log)
@@ -100,7 +107,8 @@ private struct DevicesContent: View {
         let frame = ConnectionReadout.lastFrameLabel(lastFrameUnix: live.lastFrameAtUnix,
                                                      nowUnix: Int(Date().timeIntervalSince1970))
         let warning = ConnectionReadout.rtcWarning(deviceClockUnix: deviceClock,
-                                                   strapNewestUnix: live.strapRange?.newestUnix)
+                                                   strapNewestUnix: live.strapRange?.newestUnix,
+                                                   batteryPct: live.batterySamples.last?.soc)
         return (String(localized: "Clock latched: \(latched) · last frame \(frame)"), warning)
     }
 
diff --git a/Strand/Screens/TestCentreView.swift b/Strand/Screens/TestCentreView.swift
index 4d951818c2..941ee50d07 100644
--- a/Strand/Screens/TestCentreView.swift
+++ b/Strand/Screens/TestCentreView.swift
@@ -748,7 +748,8 @@ private struct ConnectionReadoutPanel: View {
         // LiveState field FrameRouter writes.
         let deviceClock = ConnectionReadout.clockCorrelatedDevice(logLines: live.log)
         let rtcWarning = ConnectionReadout.rtcWarning(deviceClockUnix: deviceClock,
-                                                      strapNewestUnix: live.strapRange?.newestUnix)
+                                                      strapNewestUnix: live.strapRange?.newestUnix,
+                                                      batteryPct: live.batterySamples.last?.soc)
         VStack(alignment: .leading, spacing: 4) {
             ReadoutRow(label: String(localized: "Connection uptime"), value: uptime)
             ReadoutRow(label: String(localized: "Reconnects this run"), value: String(reconnects))
diff --git a/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt b/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt
index c9b413dd2a..731e99b6f4 100644
--- a/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt
+++ b/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt
@@ -215,16 +215,41 @@ object ConnectionReadout {
         return "no (waiting for the strap clock)"
     }
 
+    /** #1818: at or above this charge the "charge it" remedy is already satisfied, so repeating it is
+     *  noise. Twin of the Swift constant - the two must move together or the platforms give different
+     *  advice for the same strap. */
+    const val RTC_ALREADY_CHARGED_PCT: Double = 95.0
+
     /** #987: a plain-words warning when the strap RTC reads epoch-era (~1970/71), from EITHER signal we
      *  hold (the correlated device clock or the strap's newest banked-record timestamp). null when both
-     *  look sane or neither was seen yet - we never fabricate a fault. Twin of the Swift warning. */
-    fun rtcWarning(deviceClockUnix: Long?, strapNewestUnix: Long?): String? {
+     *  look sane or neither was seen yet - we never fabricate a fault. Twin of the Swift warning.
+     *
+     *  #1818: the remedy is battery-dependent. A flat battery resets the RTC, so on a low strap
+     *  "charge it" is real advice. On an ALREADY-charged strap it is not, and the old copy sent users
+     *  at 100% round a loop they had already run.
+     *
+     *  The charged branch deliberately states only what holds for EVERY strap - that charging again
+     *  will not change it - and asks for a log. It must NOT claim NOOP re-sends the clock on every
+     *  connect: that is true on WHOOP4 (runConnectHandshake calls SET_CLOCK unconditionally, both
+     *  payload forms, #120) but FALSE on a 5/MG, where the clock write is gated behind didBond, and an
+     *  unbondable 5/MG (#1635) is never clocked at all - precisely the strap most likely to be showing
+     *  this warning. Explaining the mechanism in the sentence is how the original bug happened.
+     *  [batteryPct] null (not yet read) keeps the charge advice - we only withdraw it on evidence.
+     *  Callers MUST pass a reading from the CURRENT link and not a last-known charge that outlives it -
+     *  a stale 100% would suppress the advice in the one case it is right, a strap that ran flat and
+     *  reset its RTC. */
+    fun rtcWarning(deviceClockUnix: Long?, strapNewestUnix: Long?, batteryPct: Double? = null): String? {
         val ceiling = ConnectionTrace.RTC_EPOCH_CEILING_UNIX
         val clockBad = deviceClockUnix != null && deviceClockUnix > 0L && deviceClockUnix < ceiling
         val newestBad = strapNewestUnix != null && strapNewestUnix > 0L && strapNewestUnix < ceiling
         if (!clockBad && !newestBad) return null
-        return "Strap clock reads 1970/71 (never set since its last reset), so it is not banking history. " +
-            "Charge the strap to 100% and reconnect so the clock latches."
+        val lead = "Strap clock reads 1970/71 (never set since its last reset), so it is not banking history. "
+        if (batteryPct != null && batteryPct >= RTC_ALREADY_CHARGED_PCT) {
+            return lead +
+                "The strap is already charged, so charging again will not change this. Export a strap " +
+                "log from Test Centre so the clock exchange can be read."
+        }
+        return lead + "Charge the strap to 100% and reconnect so the clock latches."
     }
 
     /** #987: freshness label for the "last frame" readout row ("12s ago" / "no frames yet"). [nowUnix]
diff --git a/android/app/src/test/java/com/noop/analytics/ConnectionReadoutTest.kt b/android/app/src/test/java/com/noop/analytics/ConnectionReadoutTest.kt
index 325098a19c..1df2e8f859 100644
--- a/android/app/src/test/java/com/noop/analytics/ConnectionReadoutTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/ConnectionReadoutTest.kt
@@ -227,6 +227,39 @@ class ConnectionReadoutTest {
         assertNull(ConnectionReadout.rtcWarning(null, null))
     }
 
+    /** #1818: the remedy must track the battery. A charged strap told to "charge to 100%" is the bug
+     *  the field report hit - the user had already done it, twice. Twin of the Swift test. */
+    @Test fun rtcWarningRemedyTracksBattery() {
+        val flat = ConnectionReadout.rtcWarning(40_000_000L, null, batteryPct = 40.0)
+        assertTrue(flat!!.contains("Charge the strap to 100%"))
+
+        val charged = ConnectionReadout.rtcWarning(40_000_000L, null, batteryPct = 100.0)!!
+        assertFalse(charged.contains("Charge the strap to 100%"))
+        assertTrue(charged.contains("already charged"))
+        assertTrue(charged.contains("strap log"))
+        // The charged copy must stay true for EVERY strap. "NOOP re-sends the clock on every connect"
+        // holds on WHOOP4 but not on a 5/MG, where the write is gated behind didBond and an unbondable
+        // strap (#1635) is never clocked at all - the strap most likely to be showing this warning.
+        assertFalse(charged.contains("every connect"))
+
+        // Pin the VALUE, not just the symbol: feeding the constant back into the function under test
+        // can never catch a wrong threshold, and nothing else would catch it drifting away from the
+        // Swift twin - the two platforms would each keep passing while giving different advice.
+        assertEquals(95.0, ConnectionReadout.RTC_ALREADY_CHARGED_PCT, 0.0)
+
+        // Boundary, from both sides, with literals: inclusive at 95, charge advice at 94.
+        val atThreshold = ConnectionReadout.rtcWarning(40_000_000L, null, batteryPct = 95.0)!!
+        assertTrue(atThreshold.contains("already charged"))
+        val justBelow = ConnectionReadout.rtcWarning(40_000_000L, null, batteryPct = 94.0)!!
+        assertTrue(justBelow.contains("Charge the strap to 100%"))
+
+        // Battery not read yet: we only withdraw advice on evidence, so the default stands.
+        assertTrue(ConnectionReadout.rtcWarning(40_000_000L, null)!!.contains("Charge the strap to 100%"))
+
+        // A sane clock stays silent no matter how full the battery is.
+        assertNull(ConnectionReadout.rtcWarning(1_782_475_600L, 1_782_475_000L, batteryPct = 100.0))
+    }
+
     @Test fun lastFrameLabel() {
         assertEquals("12s ago", ConnectionReadout.lastFrameLabel(990L, nowUnix = 1_002L))
         assertEquals("no frames yet", ConnectionReadout.lastFrameLabel(null, nowUnix = 1_002L))

From 7831d348fc8a254060895fa9fcde323c36faa75a Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 01:01:33 +1200
Subject: [PATCH 175/333] diag(ble): log a link epitaph on every disconnect
 (#1820)

Adds per-connection inbound accounting and a one-line link epitaph on every disconnect, so a strap
log can state whether the strap transmitted anything instead of leaving it to be inferred from the
fact that every logged line happened to be outgoing.

Emitted only for a link that actually reached connected, so a failed connect attempt cannot report
the previous link's counters and fabricate the silence it exists to detect. The armed flag is a
per-link latch on both platforms rather than persistent edge state.

Diagnostics only, no behaviour change. Raised on #1809.
---
 .../StrandAnalytics/ConnectionReadout.swift   | 25 +++++++++
 .../ConnectionReadoutTests.swift              | 27 ++++++++++
 Strand/BLE/BLEManager.swift                   | 42 +++++++++++++++
 .../com/noop/analytics/ConnectionReadout.kt   | 27 ++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 54 +++++++++++++++++--
 .../noop/analytics/ConnectionReadoutTest.kt   | 34 ++++++++++++
 6 files changed, 206 insertions(+), 3 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift
index 44b91fc140..2fa70a07f8 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift
@@ -272,6 +272,31 @@ public enum ConnectionReadout {
         return lead + "Charge the strap to 100% and reconnect so the clock latches."
     }
 
+    /// #1809: one-line account of a finished BLE link, logged on every disconnect.
+    ///
+    /// A strap log could not previously answer "did the strap send anything?". Inbound notifications only
+    /// stamped a liveness timestamp that was then discarded, and the disconnect error reached the log as
+    /// the OS `localizedDescription` while the `CBError` code the #617 branch computes was thrown away. A
+    /// reporter chasing a silent strap had to infer silence from the fact that every LOGGED line happened
+    /// to be outgoing - which measures NOOP's logging, not the strap. This measures the strap.
+    ///
+    /// `armed` matters because the #80 marginal-radio fallback only counts a drop when the R10/R11 burst
+    /// was actually armed; `armed=no` says up front that the detector cannot trip for this link, however
+    /// many times the loop repeats.
+    ///
+    /// Milliseconds are printed raw: no float formatting, so the two platforms cannot round apart.
+    public static func linkEpitaph(upMillis: Int, inboundFrames: Int, inboundBytes: Int,
+                                   cmdChannelFrames: Int, realtimeArmed: Bool, ended: String) -> String {
+        let armed = realtimeArmed ? "yes" : "no"
+        var line = "Link epitaph: up \(max(0, upMillis))ms, inbound \(max(0, inboundFrames)) frames / "
+            + "\(max(0, inboundBytes)) bytes (cmd-channel \(max(0, cmdChannelFrames))), "
+            + "realtime armed=\(armed), ended=\(ended)"
+        if inboundFrames <= 0 {
+            line += " - the strap sent NOTHING on this link"
+        }
+        return line
+    }
+
     /// #987: freshness label for the "last frame" readout row: how long ago the most recent strap frame
     /// was routed ("12s ago"), or "no frames yet" before the first one. `nowUnix` injected for testability.
     public static func lastFrameLabel(lastFrameUnix: Int?, nowUnix: Int) -> String {
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ConnectionReadoutTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ConnectionReadoutTests.swift
index 5dcdfdb051..d330569ad7 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ConnectionReadoutTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ConnectionReadoutTests.swift
@@ -266,6 +266,33 @@ final class ConnectionReadoutTests: XCTestCase {
                                                   strapNewestUnix: 1_782_475_000, batteryPct: 100))
     }
 
+    /// #1809: the epitaph exists so a strap log can STATE that nothing arrived, rather than a reporter
+    /// inferring it from the fact that every logged line happened to be outgoing.
+    func testLinkEpitaph() {
+        let silent = ConnectionReadout.linkEpitaph(upMillis: 4_123, inboundFrames: 0, inboundBytes: 0,
+                                                   cmdChannelFrames: 0, realtimeArmed: false,
+                                                   ended: "CBError.connectionTimeout(6)")
+        XCTAssertEqual(silent,
+                       "Link epitaph: up 4123ms, inbound 0 frames / 0 bytes (cmd-channel 0), "
+                       + "realtime armed=no, ended=CBError.connectionTimeout(6)"
+                       + " - the strap sent NOTHING on this link")
+
+        // A link that carried traffic must NOT claim silence.
+        let alive = ConnectionReadout.linkEpitaph(upMillis: 61_000, inboundFrames: 812,
+                                                  inboundBytes: 40_990, cmdChannelFrames: 9,
+                                                  realtimeArmed: true, ended: "intentional")
+        XCTAssertEqual(alive,
+                       "Link epitaph: up 61000ms, inbound 812 frames / 40990 bytes (cmd-channel 9), "
+                       + "realtime armed=yes, ended=intentional")
+        XCTAssertFalse(alive.contains("NOTHING"))
+
+        // Negatives are clamped rather than printed: a monotonic-clock hiccup must not emit "up -3ms".
+        XCTAssertTrue(ConnectionReadout.linkEpitaph(upMillis: -3, inboundFrames: -1, inboundBytes: -9,
+                                                    cmdChannelFrames: -2, realtimeArmed: false,
+                                                    ended: "x")
+                        .hasPrefix("Link epitaph: up 0ms, inbound 0 frames / 0 bytes (cmd-channel 0)"))
+    }
+
     func testLastFrameLabel() {
         XCTAssertEqual(ConnectionReadout.lastFrameLabel(lastFrameUnix: 990, nowUnix: 1_002), "12s ago")
         XCTAssertEqual(ConnectionReadout.lastFrameLabel(lastFrameUnix: nil, nowUnix: 1_002), "no frames yet")
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index 5f6ea5074a..0f3959f8c9 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -726,6 +726,14 @@ public final class BLEManager: NSObject, ObservableObject {
     /// DIAGNOSTIC ONLY — it never cancels or retries; recovery is separate work.
     private var pendingConnectProbe: DispatchWorkItem?
     static let pendingConnectProbeSeconds: TimeInterval = 15
+    /// #1809: per-connection inbound accounting for the link epitaph. A strap log could not say whether
+    /// the strap transmitted anything; these three make it a measurement. Reset in `didConnect`, so they
+    /// describe THIS link and never carry a previous session's traffic into its epitaph.
+    private var inboundFrames = 0
+    private var inboundBytes = 0
+    private var cmdChannelFrames = 0
+    /// Uptime clock for the epitaph. Monotonic, so a wall-clock change mid-link cannot make it negative.
+    private var linkUpSince: DispatchTime?
     /// Last time ANY notification arrived — drives the liveness watchdog.
     private var lastDataAt = Date()
     /// True while a Live/Health screen is on-screen and wants the realtime stream. One of the two
@@ -5230,6 +5238,10 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
         cancelScanFallback()
         cancelPendingConnectProbe()   // #730: the connect resolved; no pending-connect log needed
         failedConnectAttempts = 0   // a successful connect clears the reconnect backoff (#414)
+        // #1809: this link's inbound tally starts empty; the epitaph on disconnect reports exactly what
+        // arrived between here and there.
+        inboundFrames = 0; inboundBytes = 0; cmdChannelFrames = 0
+        linkUpSince = DispatchTime.now()
         standingConnectAt = nil     // #1413: a live link means no standing connect is outstanding
         restoredPeripheral = nil
         preparePeripheral(peripheral)
@@ -5367,6 +5379,31 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
         // arm timestamp. A drop that is unintentional, error-bearing, and lands shortly after we armed
         // the R10/R11 burst is the marginal-radio tell. Feed the detector; if it trips, the NEXT connect
         // skips the heavy arm (the flag is intentionally NOT reset on disconnect so it survives rescan).
+        // #1809: the epitaph goes out BEFORE the resets below, for the same reason the two detectors read
+        // their state here - `realtimeArmedAt` is about to be cleared. `ended` carries the CBError CASE, not
+        // just the OS sentence: the #617 branch already computes that code and the strap log never saw it.
+        let endedReason: String
+        if intentionalDisconnect {
+            endedReason = "intentional"
+        } else if let cb = error as? CBError {
+            endedReason = "CBError.\(cb.code)(\(cb.code.rawValue))"
+        } else if let error {
+            endedReason = "\(error)"
+        } else {
+            endedReason = "no error reported"
+        }
+        // Only for a link we actually held. Emitting without one would report "the strap sent NOTHING on
+        // this link" using the PREVIOUS link's counters, fabricating the very symptom #1809 is about.
+        if let since = linkUpSince {
+            let upMs = Int(Double(DispatchTime.now().uptimeNanoseconds &- since.uptimeNanoseconds) / 1_000_000)
+            log(ConnectionReadout.linkEpitaph(upMillis: upMs, inboundFrames: inboundFrames,
+                                              inboundBytes: inboundBytes, cmdChannelFrames: cmdChannelFrames,
+                                              realtimeArmed: realtimeArmedAt != nil, ended: endedReason))
+        }
+        // Clear the tally with the link, so a second teardown for the same drop cannot re-report it.
+        inboundFrames = 0; inboundBytes = 0; cmdChannelFrames = 0
+        linkUpSince = nil
+
         let timedOut = !intentionalDisconnect && error != nil
         let sinceArm = realtimeArmedAt.map { Date().timeIntervalSince($0) }
         if marginalRadio.connectionEnded(wasArmed: realtimeArmedAt != nil,
@@ -6341,6 +6378,11 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
         guard let data = characteristic.value else { return }
         let bytes = [UInt8](data)
         lastDataAt = Date()   // feed the liveness watchdog on every notification
+        // #1809: count BEFORE the per-characteristic switch below, so the tally covers every inbound
+        // frame including ones no branch consumes - the epitaph must answer "did anything arrive at all".
+        inboundFrames += 1
+        inboundBytes += bytes.count
+        if characteristic.uuid == BLEManager.cmdNotifyChar { cmdChannelFrames += 1 }
 
         switch characteristic.uuid {
         case BLEManager.heartRateChar:
diff --git a/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt b/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt
index 731e99b6f4..8d181addd4 100644
--- a/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt
+++ b/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt
@@ -252,6 +252,33 @@ object ConnectionReadout {
         return lead + "Charge the strap to 100% and reconnect so the clock latches."
     }
 
+    /** #1809: one-line account of a finished BLE link, logged on every disconnect. Twin of the Swift
+     *  formatter.
+     *
+     *  A strap log could not previously answer "did the strap send anything?". Inbound notifications only
+     *  stamped a liveness timestamp that was then discarded, so a reporter chasing a silent strap had to
+     *  infer silence from the fact that every LOGGED line happened to be outgoing - which measures NOOP's
+     *  logging, not the strap. This measures the strap.
+     *
+     *  [realtimeArmed] matters because the #80 marginal-radio fallback only counts a drop when the R10/R11
+     *  burst was actually armed; armed=no says up front that the detector cannot trip for this link,
+     *  however many times the loop repeats.
+     *
+     *  Milliseconds are printed raw: no float formatting, so the two platforms cannot round apart.
+     *  [upMillis] is Long, not Int: Swift's Int is 64-bit, so an Int here would be the NARROWER type and
+     *  a link held past ~24.8 days would wrap negative and print "up 0ms" - a dead-looking link that was
+     *  in fact the healthiest one we ever had. Rare, silent, and exactly backwards, so use the real twin. */
+    fun linkEpitaph(upMillis: Long, inboundFrames: Int, inboundBytes: Int, cmdChannelFrames: Int,
+                    realtimeArmed: Boolean, ended: String): String {
+        var line = "Link epitaph: up ${maxOf(0L, upMillis)}ms, inbound ${maxOf(0, inboundFrames)} frames / " +
+            "${maxOf(0, inboundBytes)} bytes (cmd-channel ${maxOf(0, cmdChannelFrames)}), " +
+            "realtime armed=${if (realtimeArmed) "yes" else "no"}, ended=$ended"
+        if (inboundFrames <= 0) {
+            line += " - the strap sent NOTHING on this link"
+        }
+        return line
+    }
+
     /** #987: freshness label for the "last frame" readout row ("12s ago" / "no frames yet"). [nowUnix]
      *  injected for testability. Twin of the Swift labeller. */
     fun lastFrameLabel(lastFrameUnix: Long?, nowUnix: Long): String {
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index f687c0e40a..9e29bd650e 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -63,6 +63,7 @@ import com.noop.protocol.WhoopGattServiceFamily
 import com.noop.protocol.whoopGattScanDecision
 import com.noop.analytics.Baselines
 import com.noop.analytics.BatterySocLine
+import com.noop.analytics.ConnectionReadout
 import com.noop.analytics.IntelligenceEngine
 import com.noop.analytics.NapDetector
 import com.noop.analytics.NapPrefs
@@ -6141,6 +6142,10 @@ class WhoopBleClient(
                     // exactly what distinguishes a healthy connection from the flapping loop that keeps
                     // the reconnect streak — and so the scan mode — pinned at its most power-hungry.
                     linkUpSinceMs = System.currentTimeMillis()
+                    // #1809: this link's inbound tally starts empty, so the epitaph on disconnect reports
+                    // exactly what arrived on THIS link and never a previous session's traffic.
+                    inboundFrames = 0; inboundBytes = 0; cmdChannelFrames = 0
+                    realtimeArmedThisLink = false
                     // A connect succeeded → clear the stale-bond re-pair guide UNLESS we are in a known
                     // bond-loop (#617). In that loop the strap "connects" every ~3 s before timing out
                     // again, so clearing here wiped the guide on EVERY cycle: it flashed for ~1 s and
@@ -6539,7 +6544,7 @@ class WhoopBleClient(
                     // window would re-arm the stream from it and stay armed until the next tick.
                     val realtimeWantNow = screenWantsRealtime || continuousCaptureWantsNow()
                     wantsRealtime = realtimeWantNow
-                    if (realtimeWantNow) { realtimeArmed = true; send(CommandNumber.TOGGLE_REALTIME_HR, byteArrayOf(1)) }
+                    if (realtimeWantNow) { realtimeArmed = true; realtimeArmedThisLink = true; send(CommandNumber.TOGGLE_REALTIME_HR, byteArrayOf(1)) }
                 }
             } else if (!didBond && connectedFamily == DeviceFamily.WHOOP4) {
                 didBond = true
@@ -6662,7 +6667,29 @@ class WhoopBleClient(
     // MARK: Inbound routing  (port of didUpdateValueFor + FrameRouter.handle)
     // ====================================================================================
 
+    /** #1809: per-connection inbound accounting for the link epitaph - the strap log could not previously
+     *  say whether the strap transmitted anything at all. Twin of the Swift counters. */
+    private var inboundFrames = 0
+    private var inboundBytes = 0
+    private var cmdChannelFrames = 0
+    /** #1809: was realtime armed at ANY point on THIS link. Not the same thing as [realtimeArmed], which
+     *  is persistent edge state: it can carry true in from a previous link, or read false at the drop
+     *  after a mid-link disarm. The epitaph needs the per-link fact, which is what the Apple twin's
+     *  `realtimeArmedAt` gives (it is cleared on every disconnect). Reset with the counters on connect.
+     *
+     *  @Volatile for the same reason [realtimeArmed] is: the arm sites include the reconcile path, which
+     *  does not run on the GATT callback thread that reads this at the drop. A stale read here would print
+     *  "armed=no" for a link that WAS armed, and that word is what a reader uses to decide whether #80
+     *  applies. The frame/byte counters above are deliberately plain - ++ is not atomic whatever we
+     *  annotate them with, and an approximate count still answers "did anything arrive at all". */
+    @Volatile private var realtimeArmedThisLink = false
+
     private fun onInbound(uuid: UUID, bytes: ByteArray) {
+        // Count BEFORE any routing below, so the tally covers every inbound frame including ones no branch
+        // consumes - the epitaph must answer "did anything arrive at all".
+        inboundFrames++
+        inboundBytes += bytes.size
+        if (uuid == CMD_NOTIFY_CHAR) cmdChannelFrames++
         lastDataAtMs = System.currentTimeMillis()   // feeds the keep-alive liveness watchdog
         resubscribedSinceData = false               // data is flowing again — re-arm the one-shot resubscribe
         when {
@@ -7546,7 +7573,7 @@ class WhoopBleClient(
         // outside the overnight window must not arm the stream from a stale precomputed [wantsRealtime].
         val realtimeWantNow = screenWantsRealtime || continuousCaptureWantsNow()
         wantsRealtime = realtimeWantNow
-        if (realtimeWantNow) { realtimeArmed = true; send(CommandNumber.TOGGLE_REALTIME_HR, byteArrayOf(1)) }
+        if (realtimeWantNow) { realtimeArmed = true; realtimeArmedThisLink = true; send(CommandNumber.TOGGLE_REALTIME_HR, byteArrayOf(1)) }
     }
 
     // ====================================================================================
@@ -7656,7 +7683,7 @@ class WhoopBleClient(
                     flushCaptureLog()
                 }
                 if (connectedFamily == DeviceFamily.WHOOP4) {
-                    if (wantsRealtime) { realtimeArmed = true; send(CommandNumber.TOGGLE_REALTIME_HR, byteArrayOf(1)) }
+                    if (wantsRealtime) { realtimeArmed = true; realtimeArmedThisLink = true; send(CommandNumber.TOGGLE_REALTIME_HR, byteArrayOf(1)) }
                     // #battery: ~60 s normally, ~30 s while charging (see [batteryPollDue]).
                     if (batteryPollDue(keepAliveTick, s.charging == true)) send(CommandNumber.GET_BATTERY_LEVEL)
                 } else if (connectedFamily == DeviceFamily.WHOOP5 &&
@@ -7782,6 +7809,7 @@ class WhoopBleClient(
         if (want == realtimeArmed) return                          // no edge — nothing to send
         if (connectedFamily != DeviceFamily.WHOOP4 && !_state.value.bonded) return   // can't reach the strap yet
         realtimeArmed = want
+        if (want) realtimeArmedThisLink = true   // #1809: latch the per-link fact
         // Both families arm/disarm via TOGGLE_REALTIME_HR; send() frames it correctly per family (puffin
         // for 5/MG). A screen re-entry blanks its own smoothing window in the view-model, not here.
         send(CommandNumber.TOGGLE_REALTIME_HR, byteArrayOf(if (want) 1.toByte() else 0.toByte()))
@@ -8308,6 +8336,7 @@ class WhoopBleClient(
                 // cadence, not this drop path, so a persistently-busy stack retries once per tick, never in a loop.
                 if (shouldReArmRealtimeAfterDrop(item.cmd)) {
                     realtimeArmed = !realtimeArmed
+                    if (realtimeArmed) realtimeArmedThisLink = true   // #1809: per-link latch
                     log("realtime toggle dropped — reconciling on the next keep-alive tick (#312)")
                 }
                 writeRetries = 0
@@ -9772,6 +9801,25 @@ class WhoopBleClient(
         // Snapshot the hold time and clear it IMMEDIATELY: every drop log below reads the snapshot, and a
         // stale `linkUpSinceMs` surviving into the next drop would report a hold time for a link that never
         // reached STATE_CONNECTED — the diagnostic would then invent exactly the evidence it exists to find.
+        // #1809: the epitaph reads linkUpSinceMs BEFORE the snapshot below clears it, and realtimeArmed
+        // before the state reset further down. Twin of the Apple disconnect epitaph: it answers "did the
+        // strap send anything on this link", which no strap log could previously state as a measurement.
+        // Only for a link that actually reached STATE_CONNECTED. handleDisconnect also runs for a FAILED
+        // connect attempt and for the radio-off teardown, where linkUpSinceMs is null and the counters
+        // still hold the PREVIOUS link's traffic - emitting there would report "the strap sent NOTHING on
+        // this link" about a link that never existed, fabricating the very symptom #1809 is about. Same
+        // hazard the hold-time snapshot below already guards.
+        linkUpSinceMs?.let { since ->
+            log(ConnectionReadout.linkEpitaph(
+                upMillis = System.currentTimeMillis() - since,
+                inboundFrames = inboundFrames, inboundBytes = inboundBytes,
+                cmdChannelFrames = cmdChannelFrames, realtimeArmed = realtimeArmedThisLink,
+                ended = "status=$status",
+            ))
+        }
+        // Clear the tally with the link, so a second teardown for the same drop cannot re-report it.
+        inboundFrames = 0; inboundBytes = 0; cmdChannelFrames = 0
+
         val heldSuffix = heldForLogSuffix()
         linkUpSinceMs = null
         // Reboot trail: if a user reboot is in flight, this drop is the strap acting on it. Log how long the
diff --git a/android/app/src/test/java/com/noop/analytics/ConnectionReadoutTest.kt b/android/app/src/test/java/com/noop/analytics/ConnectionReadoutTest.kt
index 1df2e8f859..be2baf3d84 100644
--- a/android/app/src/test/java/com/noop/analytics/ConnectionReadoutTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/ConnectionReadoutTest.kt
@@ -260,6 +260,40 @@ class ConnectionReadoutTest {
         assertNull(ConnectionReadout.rtcWarning(1_782_475_600L, 1_782_475_000L, batteryPct = 100.0))
     }
 
+    /** #1809: the epitaph exists so a strap log can STATE that nothing arrived, rather than a reporter
+     *  inferring it from the fact that every logged line happened to be outgoing. Twin of the Swift test -
+     *  the two strings must match byte for byte or one platform's report reads differently. */
+    @Test fun linkEpitaph() {
+        val silent = ConnectionReadout.linkEpitaph(
+            upMillis = 4_123L, inboundFrames = 0, inboundBytes = 0, cmdChannelFrames = 0,
+            realtimeArmed = false, ended = "CBError.connectionTimeout(6)",
+        )
+        assertEquals(
+            "Link epitaph: up 4123ms, inbound 0 frames / 0 bytes (cmd-channel 0), " +
+                "realtime armed=no, ended=CBError.connectionTimeout(6)" +
+                " - the strap sent NOTHING on this link",
+            silent,
+        )
+
+        // A link that carried traffic must NOT claim silence.
+        val alive = ConnectionReadout.linkEpitaph(
+            upMillis = 61_000L, inboundFrames = 812, inboundBytes = 40_990, cmdChannelFrames = 9,
+            realtimeArmed = true, ended = "intentional",
+        )
+        assertEquals(
+            "Link epitaph: up 61000ms, inbound 812 frames / 40990 bytes (cmd-channel 9), " +
+                "realtime armed=yes, ended=intentional",
+            alive,
+        )
+        assertFalse(alive.contains("NOTHING"))
+
+        // Negatives are clamped rather than printed: a clock hiccup must not emit "up -3ms".
+        assertTrue(
+            ConnectionReadout.linkEpitaph(-3L, -1, -9, -2, false, "x")
+                .startsWith("Link epitaph: up 0ms, inbound 0 frames / 0 bytes (cmd-channel 0)"),
+        )
+    }
+
     @Test fun lastFrameLabel() {
         assertEquals("12s ago", ConnectionReadout.lastFrameLabel(990L, nowUnix = 1_002L))
         assertEquals("no frames yet", ConnectionReadout.lastFrameLabel(null, nowUnix = 1_002L))

From 13ffb8276c1e6a4673b9f3ec50438b4a0b050f3b Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 01:53:45 +1200
Subject: [PATCH 176/333] Clock format setting: System / 12-hour / 24-hour
 (#1822)

Adds a Clock format setting - System / 12-hour / 24-hour, defaulting to System - so times can be
shown on a 12-hour clock. Previously the clock was decided by the device REGION, which discards the
user's own 24-Hour Time switch, leaving no way to ask for 12-hour at all.

Carried into every time label on both platforms by forcing the hour cycle on the formatting locale,
so localized date order and AM/PM wording are preserved. A macOS test asserts against a real
DateFormatter, because a bad locale identifier would silently no-op and look like it worked.

Log lines stay 24-hour: evidence for bug reports, not display.

Raised on #1821.
---
 .../Sources/StrandAnalytics/ClockFormat.swift |  71 +++++++
 .../ClockFormatLocaleTests.swift              |  52 +++++
 .../ClockFormatTests.swift                    |  48 +++++
 Strand/App/AppClock.swift                     |  73 +++++++
 Strand/Data/SleepMark.swift                   |   9 +-
 Strand/Resources/Localizable.xcstrings        | 192 ++++++++++++++++++
 Strand/Screens/AutoWorkoutCard.swift          |  10 +-
 Strand/Screens/BackupSyncView.swift           |   5 +
 Strand/Screens/CaffeineLogCard.swift          |  18 +-
 Strand/Screens/CoupledView.swift              |   9 +-
 Strand/Screens/HydrationView.swift            |   6 +-
 Strand/Screens/RawDataCollectorView.swift     |   4 +-
 Strand/Screens/SettingsView.swift             |  19 ++
 Strand/Screens/SkinTempCardsView.swift        |   6 +-
 Strand/Screens/SleepModel.swift               |  12 +-
 Strand/Screens/SleepView.swift                |   9 +-
 Strand/Screens/StagesCard.swift               |   6 +-
 Strand/Screens/TodayView.swift                |   9 +-
 Strand/Screens/WorkoutDetailView.swift        |  18 +-
 Strand/Screens/WorkoutsView.swift             |   9 +-
 .../java/com/noop/analytics/ClockFormat.kt    |  65 ++++++
 .../java/com/noop/ui/AutomationsScreen.kt     |   6 +-
 .../src/main/java/com/noop/ui/CaffeineLog.kt  |   7 +-
 .../src/main/java/com/noop/ui/ClockPrefs.kt   |  32 +++
 .../main/java/com/noop/ui/CoupledScreen.kt    |   7 +-
 .../src/main/java/com/noop/ui/MainActivity.kt |   4 +
 .../main/java/com/noop/ui/SettingsScreen.kt   |  33 ++-
 .../main/java/com/noop/ui/SleepModelLogic.kt  |   9 +-
 .../main/java/com/noop/ui/SleepNightNavUi.kt  |  12 +-
 .../java/com/noop/ui/SleepNightSelection.kt   |   5 +-
 .../src/main/java/com/noop/ui/SleepScreen.kt  |  19 +-
 .../java/com/noop/ui/SleepStageBreakdownUi.kt |  11 +-
 .../main/java/com/noop/ui/SleepTimeLabels.kt  |  25 ++-
 .../noop/widget/NoopCompactGlanceWidget.kt    |   7 +-
 .../java/com/noop/widget/NoopGlanceWidget.kt  |   7 +-
 .../app/src/main/res/values-de/strings.xml    |   3 +
 .../app/src/main/res/values-es/strings.xml    |   3 +
 .../app/src/main/res/values-fr/strings.xml    |   3 +
 .../app/src/main/res/values-pl/strings.xml    |   3 +
 .../src/main/res/values-pt-rPT/strings.xml    |   3 +
 .../app/src/main/res/values-zh/strings.xml    |   3 +
 android/app/src/main/res/values/strings.xml   |   3 +
 .../com/noop/analytics/ClockFormatTest.kt     |  55 +++++
 43 files changed, 798 insertions(+), 112 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Sources/StrandAnalytics/ClockFormat.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ClockFormatLocaleTests.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ClockFormatTests.swift
 create mode 100644 Strand/App/AppClock.swift
 create mode 100644 android/app/src/main/java/com/noop/analytics/ClockFormat.kt
 create mode 100644 android/app/src/main/java/com/noop/ui/ClockPrefs.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/ClockFormatTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/ClockFormat.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/ClockFormat.swift
new file mode 100644
index 0000000000..07e1ef1457
--- /dev/null
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/ClockFormat.swift
@@ -0,0 +1,71 @@
+import Foundation
+
+/// #1821: which clock the UI shows times in. Twin of the Kotlin `ClockFormatPreference`.
+///
+/// NOOP had no such setting: every user-facing time came from the device REGION's convention. On Apple
+/// `AppLanguage.activeLocale` builds `language_REGION` deliberately, to keep regional date order and
+/// clock style - but constructing a locale from a region identifier DISCARDS the user's explicit
+/// "24-Hour Time" switch, because that override lives on `Locale.autoupdatingCurrent`, not on the region
+/// default. A reader in a 24-hour region who prefers 12-hour had no way to say so, which is the report
+/// this exists to answer.
+public enum ClockFormatPreference: String, CaseIterable, Sendable {
+    /// Follow the device's own clock switch. The default, so nobody's display changes on upgrade.
+    case system
+    case twelveHour
+    case twentyFourHour
+
+    /// Persistence key, shared by the Apple `@AppStorage` binding and the Android preference so the two
+    /// platforms cannot drift apart on the name of the thing they store.
+    public static let defaultsKey = "clockFormatPreference"
+
+    /// Unknown/absent stored values fall back to `.system` rather than to a hardcoded clock: a value we
+    /// cannot parse must not silently pin every reader to one format.
+    public static func from(stored: String?) -> ClockFormatPreference {
+        guard let stored, let parsed = ClockFormatPreference(rawValue: stored) else { return .system }
+        return parsed
+    }
+}
+
+public enum ClockFormat {
+    /// Resolve the preference against what the device reports. `systemUses24Hour` is injected rather than
+    /// read here so this stays pure and identically testable on both platforms - Apple derives it from
+    /// `Locale.autoupdatingCurrent` (which DOES carry the 24-Hour Time switch), Android from
+    /// `DateFormat.is24HourFormat(context)`.
+    public static func uses24Hour(preference: ClockFormatPreference, systemUses24Hour: Bool) -> Bool {
+        switch preference {
+        case .system:         return systemUses24Hour
+        case .twelveHour:     return false
+        case .twentyFourHour: return true
+        }
+    }
+
+    /// Literal wall-clock pattern at minute precision, for formatters driven by an explicit pattern.
+    /// Used by Android, whose existing time labels already build `SimpleDateFormat` from a literal.
+    public static func hourMinutePattern(uses24Hour: Bool) -> String {
+        uses24Hour ? "HH:mm" : "h:mm a"
+    }
+
+    /// A locale identifier carrying an explicit HOUR CYCLE, so a formatter driven by `timeStyle` or by a
+    /// `j`-bearing template resolves the clock the reader chose instead of the region default.
+    ///
+    /// This is what lets the setting reach the ~17 Apple formatters that never mention "HH:mm" at all -
+    /// they say `timeStyle = .short` or template `"jmm"`, and both ask the LOCALE for the hour. Rewriting
+    /// each into an explicit pattern would have thrown away localized date order, separators and AM/PM
+    /// wording; setting the hour cycle keeps all of it and changes only the part the reader asked for.
+    ///
+    /// `h23`/`h12` are the ICU `hours` keyword values. A malformed identifier would silently fall back to
+    /// the base locale - a no-op that looks like a working setting - so `ClockFormatLocaleTests` asserts
+    /// against a real `DateFormatter` on macOS rather than trusting the string.
+    public static func hourCycleLocaleIdentifier(base: String, uses24Hour: Bool) -> String {
+        "\(base)@hours=\(uses24Hour ? "h23" : "h12")"
+    }
+
+    /// SKELETON template for the same time, for `setLocalizedDateFormatFromTemplate`. Apple uses this
+    /// rather than the literal above so the locale still decides ordering, separator and AM/PM wording,
+    /// while the H-vs-h choice - the only part the reader asked to control - stays ours. Note this is
+    /// deliberately NOT the `j` template the buggy path used: `j` resolves the hour from the locale, which
+    /// is exactly how a reader's explicit preference got discarded.
+    public static func hourMinuteTemplate(uses24Hour: Bool) -> String {
+        uses24Hour ? "Hmm" : "hmm"
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ClockFormatLocaleTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ClockFormatLocaleTests.swift
new file mode 100644
index 0000000000..84f157b066
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ClockFormatLocaleTests.swift
@@ -0,0 +1,52 @@
+import XCTest
+@testable import StrandAnalytics
+
+/// #1821: these assert against a REAL `DateFormatter`, not against the identifier string.
+///
+/// The hour-cycle locale is the mechanism that carries the setting into every formatter that never says
+/// "HH:mm" - the ones using `timeStyle = .short` or a `"jmm"` template. If the identifier syntax were
+/// wrong, Foundation would quietly fall back to the base locale and every one of those sites would keep
+/// showing the region default while the setting appeared to be applied. That failure is silent, so it has
+/// to be caught by exercising Foundation itself.
+final class ClockFormatLocaleTests: XCTestCase {
+    private func shortTime(_ base: String, uses24Hour: Bool) -> String {
+        let id = ClockFormat.hourCycleLocaleIdentifier(base: base, uses24Hour: uses24Hour)
+        let f = DateFormatter()
+        f.locale = Locale(identifier: id)
+        f.timeZone = TimeZone(identifier: "UTC")
+        f.timeStyle = .short
+        f.dateStyle = .none
+        // 2026-01-02 22:57 UTC — the reported "22:57" / "10:57 PM".
+        return f.string(from: Date(timeIntervalSince1970: 1_767_394_620))
+    }
+
+    func testTimeStyleShortHonoursTheForcedHourCycle() {
+        // en_GB is a 24-hour region: asking for 12-hour must actually change it.
+        XCTAssertTrue(shortTime("en_GB", uses24Hour: false).contains("10"),
+                      "12-hour was requested on a 24-hour region and did not take effect")
+        XCTAssertTrue(shortTime("en_GB", uses24Hour: true).contains("22"))
+        // en_US is a 12-hour region: the reverse must work too, or the setting is one-directional.
+        XCTAssertTrue(shortTime("en_US", uses24Hour: true).contains("22"),
+                      "24-hour was requested on a 12-hour region and did not take effect")
+        XCTAssertTrue(shortTime("en_US", uses24Hour: false).contains("10"))
+    }
+
+    /// The other half of the surface: templates containing `j`, which resolve the hour from the locale.
+    func testJTemplateHonoursTheForcedHourCycle() {
+        func viaTemplate(_ base: String, uses24Hour: Bool) -> String {
+            let id = ClockFormat.hourCycleLocaleIdentifier(base: base, uses24Hour: uses24Hour)
+            let f = DateFormatter()
+            f.locale = Locale(identifier: id)
+            f.timeZone = TimeZone(identifier: "UTC")
+            f.setLocalizedDateFormatFromTemplate("jmm")
+            return f.string(from: Date(timeIntervalSince1970: 1_767_394_620))
+        }
+        XCTAssertTrue(viaTemplate("en_GB", uses24Hour: false).contains("10"))
+        XCTAssertTrue(viaTemplate("en_US", uses24Hour: true).contains("22"))
+    }
+
+    func testIdentifierShape() {
+        XCTAssertEqual(ClockFormat.hourCycleLocaleIdentifier(base: "en_GB", uses24Hour: true), "en_GB@hours=h23")
+        XCTAssertEqual(ClockFormat.hourCycleLocaleIdentifier(base: "fr_FR", uses24Hour: false), "fr_FR@hours=h12")
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ClockFormatTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ClockFormatTests.swift
new file mode 100644
index 0000000000..3388e14882
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ClockFormatTests.swift
@@ -0,0 +1,48 @@
+import XCTest
+@testable import StrandAnalytics
+
+final class ClockFormatTests: XCTestCase {
+    func testSystemDefersToTheDevice() {
+        XCTAssertTrue(ClockFormat.uses24Hour(preference: .system, systemUses24Hour: true))
+        XCTAssertFalse(ClockFormat.uses24Hour(preference: .system, systemUses24Hour: false))
+    }
+
+    func testAnExplicitChoiceOverridesTheDevice() {
+        // The whole point of the setting: a reader in a 24-hour region can ask for 12-hour and get it.
+        XCTAssertFalse(ClockFormat.uses24Hour(preference: .twelveHour, systemUses24Hour: true))
+        XCTAssertTrue(ClockFormat.uses24Hour(preference: .twentyFourHour, systemUses24Hour: false))
+    }
+
+    func testUnknownStoredValuesFallBackToSystemNotToAClock() {
+        XCTAssertEqual(ClockFormatPreference.from(stored: nil), .system)
+        XCTAssertEqual(ClockFormatPreference.from(stored: ""), .system)
+        XCTAssertEqual(ClockFormatPreference.from(stored: "24h"), .system,
+                       "an unparseable value must not pin every reader to one clock")
+        XCTAssertEqual(ClockFormatPreference.from(stored: "twelveHour"), .twelveHour)
+        XCTAssertEqual(ClockFormatPreference.from(stored: "twentyFourHour"), .twentyFourHour)
+    }
+
+    /// The stored vocabulary is shared with Android, which writes these exact strings. Pinning the
+    /// literals here means renaming a case cannot silently make the two platforms disagree about what a
+    /// user's saved preference means.
+    func testStoredVocabularyIsPinned() {
+        XCTAssertEqual(ClockFormatPreference.system.rawValue, "system")
+        XCTAssertEqual(ClockFormatPreference.twelveHour.rawValue, "twelveHour")
+        XCTAssertEqual(ClockFormatPreference.twentyFourHour.rawValue, "twentyFourHour")
+        XCTAssertEqual(ClockFormatPreference.defaultsKey, "clockFormatPreference")
+    }
+
+    func testHourMinutePattern() {
+        XCTAssertEqual(ClockFormat.hourMinutePattern(uses24Hour: true), "HH:mm")
+        XCTAssertEqual(ClockFormat.hourMinutePattern(uses24Hour: false), "h:mm a")
+    }
+
+    /// The template must never be `j`: that is the locale-resolved hour, and routing the reader's choice
+    /// back through it is the bug this setting exists to fix.
+    func testHourMinuteTemplateNeverDefersToTheLocaleHour() {
+        XCTAssertEqual(ClockFormat.hourMinuteTemplate(uses24Hour: true), "Hmm")
+        XCTAssertEqual(ClockFormat.hourMinuteTemplate(uses24Hour: false), "hmm")
+        XCTAssertFalse(ClockFormat.hourMinuteTemplate(uses24Hour: true).contains("j"))
+        XCTAssertFalse(ClockFormat.hourMinuteTemplate(uses24Hour: false).contains("j"))
+    }
+}
diff --git a/Strand/App/AppClock.swift b/Strand/App/AppClock.swift
new file mode 100644
index 0000000000..7e769e69f1
--- /dev/null
+++ b/Strand/App/AppClock.swift
@@ -0,0 +1,73 @@
+import Foundation
+import StrandAnalytics
+
+/// #1821: the app-side reader for the Clock format setting. Sits next to `AppLanguage` because it
+/// answers the same shape of question - what conventions do we render in - and because the bug it fixes
+/// lives in `AppLanguage.activeLocale`.
+///
+/// `activeLocale` builds `language_REGION` on purpose, to keep the device's regional date order and
+/// clock style. But a locale built from a REGION identifier carries that region's DEFAULT hour cycle,
+/// and the user's explicit Settings > General > Date & Time > 24-Hour Time switch is not part of it -
+/// that override lives on `Locale.autoupdatingCurrent`. So the switch was silently discarded, and a
+/// reader in a 24-hour region could not get a 12-hour clock by any means at all.
+enum AppClock {
+    /// The stored preference, defaulting to `.system` so an upgrade changes nobody's display.
+    static var preference: ClockFormatPreference {
+        ClockFormatPreference.from(stored: UserDefaults.standard.string(forKey: ClockFormatPreference.defaultsKey))
+    }
+
+    /// What the DEVICE is set to, read from `autoupdatingCurrent` precisely because that is the locale
+    /// the 24-Hour Time switch modifies. A 12-hour locale's `j` template contains the AM/PM symbol.
+    static var systemUses24Hour: Bool {
+        let template = DateFormatter.dateFormat(fromTemplate: "j", options: 0,
+                                                locale: Locale.autoupdatingCurrent) ?? "H"
+        return !template.contains("a")
+    }
+
+    static var uses24Hour: Bool {
+        ClockFormat.uses24Hour(preference: preference, systemUses24Hour: systemUses24Hour)
+    }
+
+    /// The locale to hand any time-rendering `DateFormatter`. Carries an explicit hour cycle, so the
+    /// setting also reaches the formatters that never name a pattern - the ones using `timeStyle = .short`
+    /// or a `"jmm"` template, which ask the LOCALE for the hour and were therefore getting the region
+    /// default. Everything else about the locale (date order, separators, AM/PM wording, month names)
+    /// still comes from `AppLanguage.activeLocale`, exactly as before.
+    static var formattingLocale: Locale {
+        Locale(identifier: ClockFormat.hourCycleLocaleIdentifier(
+            base: AppLanguage.activeLocale.identifier, uses24Hour: uses24Hour))
+    }
+
+    /// Cached by resolved template: building a `DateFormatter` is expensive and these are read per row in
+    /// scrolling lists, but the cache MUST key on the template rather than being a plain `static let`, or
+    /// changing the setting would not take effect until the app restarted.
+    private static var cached: (template: String, locale: String, formatter: DateFormatter)?
+    /// The cache is mutable global state and `onsetText` is read from whatever thread builds a
+    /// `SleepModel`, so the read-modify-write below is serialised. SWIFT_VERSION is 5.0 here, so the
+    /// compiler would not have objected - a torn read would just have been a rare, baffling crash.
+    private static let cacheLock = NSLock()
+
+    /// Wall-clock time at minute precision, honouring the setting. The locale still supplies ordering,
+    /// separator and AM/PM wording; only the hour cycle is ours.
+    static func hourMinuteFormatter() -> DateFormatter {
+        let template = ClockFormat.hourMinuteTemplate(uses24Hour: uses24Hour)
+        let locale = AppLanguage.activeLocale
+        cacheLock.lock()
+        defer { cacheLock.unlock() }
+        if let cached, cached.template == template, cached.locale == locale.identifier {
+            return cached.formatter
+        }
+        let f = DateFormatter()
+        f.locale = locale
+        f.setLocalizedDateFormatFromTemplate(template)
+        cached = (template, locale.identifier, f)
+        return f
+    }
+
+    /// Convenience for the many call sites that just want the string.
+    static func hourMinute(_ date: Date) -> String { hourMinuteFormatter().string(from: date) }
+
+    static func hourMinute(unix ts: Int) -> String {
+        hourMinute(Date(timeIntervalSince1970: TimeInterval(ts)))
+    }
+}
diff --git a/Strand/Data/SleepMark.swift b/Strand/Data/SleepMark.swift
index 0dc79a9e61..9ad460c965 100644
--- a/Strand/Data/SleepMark.swift
+++ b/Strand/Data/SleepMark.swift
@@ -107,10 +107,7 @@ struct SleepMark: Equatable, Sendable {
 
     /// Device-locale clock for the log line ("11:42 PM" / "23:42") — follows the 12-/24-hour setting,
     /// matching the Sleep screen's Asleep/Woke row.
-    private static let clockFormatter: DateFormatter = {
-        let f = DateFormatter()
-        f.locale = AppLanguage.activeLocale
-        f.setLocalizedDateFormatFromTemplate("jmm")
-        return f
-    }()
+    /// #1821: routed through AppClock so the Clock format setting reaches this label. Was a `static
+    /// let`, which would have frozen the reader's choice at first use until the app relaunched.
+    private static var clockFormatter: DateFormatter { AppClock.hourMinuteFormatter() }
 }
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index ca19d8b54d..26bed25672 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -195361,6 +195361,198 @@
         }
       }
     },
+    "12-hour": {
+      "localizations": {
+        "de": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "12 Stunden"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "12-hour"
+          }
+        },
+        "es": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "12 horas"
+          }
+        },
+        "fr": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "12 heures"
+          }
+        },
+        "it": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "12 ore"
+          }
+        },
+        "pl": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "12-godzinny"
+          }
+        },
+        "pt-PT": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "12 horas"
+          }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "12-часовой"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "12 小时制"
+          }
+        },
+        "zh-Hant": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "12 小時制"
+          }
+        }
+      }
+    },
+    "24-hour": {
+      "localizations": {
+        "de": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "24 Stunden"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "24-hour"
+          }
+        },
+        "es": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "24 horas"
+          }
+        },
+        "fr": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "24 heures"
+          }
+        },
+        "it": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "24 ore"
+          }
+        },
+        "pl": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "24-godzinny"
+          }
+        },
+        "pt-PT": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "24 horas"
+          }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "24-часовой"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "24 小时制"
+          }
+        },
+        "zh-Hant": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "24 小時制"
+          }
+        }
+      }
+    },
+    "Clock": {
+      "localizations": {
+        "de": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Uhr"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Clock"
+          }
+        },
+        "es": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Reloj"
+          }
+        },
+        "fr": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Horloge"
+          }
+        },
+        "it": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Orologio"
+          }
+        },
+        "pl": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Zegar"
+          }
+        },
+        "pt-PT": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Relógio"
+          }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Часы"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "时钟"
+          }
+        },
+        "zh-Hant": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "時鐘"
+          }
+        }
+      }
+    },
     "System default": {
       "localizations": {
         "de": {
diff --git a/Strand/Screens/AutoWorkoutCard.swift b/Strand/Screens/AutoWorkoutCard.swift
index 1f885a9053..8938320204 100644
--- a/Strand/Screens/AutoWorkoutCard.swift
+++ b/Strand/Screens/AutoWorkoutCard.swift
@@ -131,13 +131,9 @@ struct AutoWorkoutCard: View {
     }
 
     /// HH:mm in the user's locale/timezone.
-    private static let timeFmt: DateFormatter = {
-        let f = DateFormatter()
-        f.locale = AppLanguage.activeLocale
-        f.timeStyle = .short
-        f.dateStyle = .none
-        return f
-    }()
+    /// #1821: routed through AppClock so the Clock format setting reaches this label. Was a `static
+    /// let`, which would have frozen the reader's choice at first use until the app relaunched.
+    private static var timeFmt: DateFormatter { AppClock.hourMinuteFormatter() }
 
     /// Localized medium date ("Jun 23, 2026") for a bout older than yesterday.
     private static let dateFmt: DateFormatter = {
diff --git a/Strand/Screens/BackupSyncView.swift b/Strand/Screens/BackupSyncView.swift
index 1c246ce5fa..9abcd24bfb 100644
--- a/Strand/Screens/BackupSyncView.swift
+++ b/Strand/Screens/BackupSyncView.swift
@@ -294,6 +294,8 @@ struct BackupSyncView: View {
 
     private func absoluteTime(_ ms: Int) -> String {
         let f = DateFormatter()
+        // #1821: localized DATE style untouched; only the hour cycle is the reader's.
+        f.locale = AppClock.formattingLocale
         f.dateStyle = .medium
         f.timeStyle = .short
         return f.string(from: Date(timeIntervalSince1970: Double(ms) / 1000.0))
@@ -362,6 +364,9 @@ private struct RestorePickerSheet: View {
 
     private func absoluteTime(_ ms: Int) -> String {
         let f = DateFormatter()
+        // #1821: localized DATE style untouched; only the hour cycle is the reader's. Second copy of
+        // this helper in the file - a single-shot replace fixed only the first, which the sweep caught.
+        f.locale = AppClock.formattingLocale
         f.dateStyle = .medium
         f.timeStyle = .short
         return f.string(from: Date(timeIntervalSince1970: Double(ms) / 1000.0))
diff --git a/Strand/Screens/CaffeineLogCard.swift b/Strand/Screens/CaffeineLogCard.swift
index 4cdd835796..383728f2a6 100644
--- a/Strand/Screens/CaffeineLogCard.swift
+++ b/Strand/Screens/CaffeineLogCard.swift
@@ -201,12 +201,9 @@ struct CaffeineLogCard: View {
         return Self.cutoffTimeFormatter.string(from: date)
     }
 
-    private static let cutoffTimeFormatter: DateFormatter = {
-        let f = DateFormatter()
-        f.timeStyle = .short
-        f.dateStyle = .none
-        return f
-    }()
+    /// #1821: routed through AppClock so the Clock format setting reaches this label. Was a `static
+    /// let`, which would have frozen the reader's choice at first use until the app relaunched.
+    private static var cutoffTimeFormatter: DateFormatter { AppClock.hourMinuteFormatter() }
 
     // MARK: - Active hint
 
@@ -335,10 +332,7 @@ struct CaffeineLogCard: View {
         .buttonStyle(.plain)
     }
 
-    private static let timeFormatter: DateFormatter = {
-        let f = DateFormatter()
-        f.timeStyle = .short
-        f.dateStyle = .none
-        return f
-    }()
+    /// #1821: routed through AppClock so the Clock format setting reaches this label. Was a `static
+    /// let`, which would have frozen the reader's choice at first use until the app relaunched.
+    private static var timeFormatter: DateFormatter { AppClock.hourMinuteFormatter() }
 }
diff --git a/Strand/Screens/CoupledView.swift b/Strand/Screens/CoupledView.swift
index 317483417c..cd02804ba4 100644
--- a/Strand/Screens/CoupledView.swift
+++ b/Strand/Screens/CoupledView.swift
@@ -705,12 +705,9 @@ struct CoupledView: View {
         Self.clockFmt.string(from: Date(timeIntervalSince1970: TimeInterval(ts)))
     }
 
-    private static let clockFmt: DateFormatter = {
-        let f = DateFormatter()
-        f.locale = AppLanguage.activeLocale
-        f.setLocalizedDateFormatFromTemplate("jmm")
-        return f
-    }()
+    /// #1821: routed through AppClock so the Clock format setting reaches this label. Was a `static
+    /// let`, which would have frozen the reader's choice at first use until the app relaunched.
+    private static var clockFmt: DateFormatter { AppClock.hourMinuteFormatter() }
 
     /// "6h 42m" from a minutes count, for the slept-vs-needed read. Mirror EXACTLY in Kotlin.
     static func hoursMinutes(_ minutes: Double) -> String {
diff --git a/Strand/Screens/HydrationView.swift b/Strand/Screens/HydrationView.swift
index d5f865ec10..dc67d012df 100644
--- a/Strand/Screens/HydrationView.swift
+++ b/Strand/Screens/HydrationView.swift
@@ -274,9 +274,9 @@ struct HydrationView: View {
         }
     }
 
-    private static let entryTimeFmt: DateFormatter = {
-        let f = DateFormatter(); f.timeStyle = .short; f.dateStyle = .none; return f
-    }()
+    /// #1821: routed through AppClock so the Clock format setting reaches this label. Was a `static
+    /// let`, which would have frozen the reader's choice at first use until the app relaunched.
+    private static var entryTimeFmt: DateFormatter { AppClock.hourMinuteFormatter() }
 
     // MARK: - 7-day mini history (flat bars, today on the right)
 
diff --git a/Strand/Screens/RawDataCollectorView.swift b/Strand/Screens/RawDataCollectorView.swift
index 4cf3785217..f2a378f073 100644
--- a/Strand/Screens/RawDataCollectorView.swift
+++ b/Strand/Screens/RawDataCollectorView.swift
@@ -358,7 +358,9 @@ struct RawDataCollectorView: View {
     }
 
     private static func time(_ ms: Int64) -> String {
-        Date(timeIntervalSince1970: Double(ms) / 1_000).formatted(date: .omitted, time: .shortened)
+        Date(timeIntervalSince1970: Double(ms) / 1_000)
+            .formatted(Date.FormatStyle(date: .omitted, time: .shortened)
+                .locale(AppClock.formattingLocale))   // #1821
     }
 
     static func fullSecondBounds(fromMs: Int64, toMs: Int64) -> (from: Int, to: Int)? {
diff --git a/Strand/Screens/SettingsView.swift b/Strand/Screens/SettingsView.swift
index 070e0cae75..d6cb082d58 100644
--- a/Strand/Screens/SettingsView.swift
+++ b/Strand/Screens/SettingsView.swift
@@ -173,6 +173,9 @@ struct SettingsView: View {
     // Imperial/Metric display preference (D#103). Stored data is always SI; this only changes how
     // distances/weights/heights/temperatures are SHOWN — and lets the profile fields below take
     // imperial entry. Temperature has a separate override so °C/°F can be picked independently.
+    /// #1821: Clock format. Defaults to `.system`, so upgrading changes nobody's displayed times.
+    @AppStorage(ClockFormatPreference.defaultsKey)
+    private var clockFormatRaw = ClockFormatPreference.system.rawValue
     @AppStorage(UnitPrefs.systemKey) private var unitSystemRaw = UnitSystem.metric.rawValue
     @AppStorage(UnitPrefs.temperatureKey) private var temperatureRaw = ""
     // Effort display scale (#268). Display-only — Effort stays stored 0–100, this only chooses whether
@@ -1123,6 +1126,22 @@ struct SettingsView: View {
                     .frame(maxWidth: .infinity, alignment: .leading)
                     .padding(.top, NoopMetrics.space1)
                 rowDivider
+                // #1821: sits with Language rather than in Units because it is an app-owned display
+                // CONVENTION, not a unit of measurement — and like Language it offers "System default",
+                // which here means the device's own 24-Hour Time switch rather than the region default.
+                // Unlike Language this needs no relaunch: the formatter caches per resolved template.
+                FormRow(label: "Clock") {
+                    Picker("Clock", selection: $clockFormatRaw) {
+                        Text("System default").tag(ClockFormatPreference.system.rawValue)
+                        Text("12-hour").tag(ClockFormatPreference.twelveHour.rawValue)
+                        Text("24-hour").tag(ClockFormatPreference.twentyFourHour.rawValue)
+                    }
+                    .labelsHidden()
+                    .pickerStyle(.menu)
+                    .tint(StrandPalette.accent)
+                    .accessibilityLabel("Clock")
+                }
+                rowDivider
                 // Theme presets — one-tap bundles coordinating accent + chart world + backdrop + card
                 // opacity. Derived (no stored value): tweaking any control below flips this to Custom.
                 FormRow(label: "Preset") {
diff --git a/Strand/Screens/SkinTempCardsView.swift b/Strand/Screens/SkinTempCardsView.swift
index 9c1c886264..7852ad3ca0 100644
--- a/Strand/Screens/SkinTempCardsView.swift
+++ b/Strand/Screens/SkinTempCardsView.swift
@@ -759,11 +759,7 @@ struct BodyClockCard: View {
         components.hour = hh
         components.minute = mm
         guard let date = components.date else { return "\(hh):\(String(format: "%02d", mm))" }
-        let formatter = DateFormatter()
-        formatter.locale = AppLanguage.activeLocale
-        formatter.dateStyle = .none
-        formatter.timeStyle = .short
-        return formatter.string(from: date)
+        return AppClock.hourMinute(date)   // #1821
     }
 }
 
diff --git a/Strand/Screens/SleepModel.swift b/Strand/Screens/SleepModel.swift
index 566236ac7e..6a224dfa52 100644
--- a/Strand/Screens/SleepModel.swift
+++ b/Strand/Screens/SleepModel.swift
@@ -118,12 +118,12 @@ struct Night {
     // Clock for the Asleep/Woke row — the times people read at a glance. The "jmm" skeleton
     // follows the device's 12-/24-hour setting ("11:42 PM" or "23:42") instead of forcing one
     // on everyone, matching the HR-tooltip / workout times (#337).
-    private static let timeFmt: DateFormatter = {
-        let f = DateFormatter()
-        f.locale = AppLanguage.activeLocale
-        f.setLocalizedDateFormatFromTemplate("jmm")
-        return f
-    }()
+    /// #1821: routed through `AppClock` so the Clock format setting reaches every night time on screen -
+    /// this is the formatter behind the sleep card's ASLEEP/WOKE values in the report. It used the `jmm`
+    /// template, whose `j` resolves the hour from the locale, which is how a reader's explicit 12-hour
+    /// choice was being discarded. `AppClock` caches per resolved template, so this is no more expensive
+    /// than the `static let` it replaces and it responds when the setting changes.
+    private static var timeFmt: DateFormatter { AppClock.hourMinuteFormatter() }
     private static let dateFmt: DateFormatter = {
         let f = DateFormatter(); f.dateFormat = "EEE d MMM"; return f
     }()
diff --git a/Strand/Screens/SleepView.swift b/Strand/Screens/SleepView.swift
index 421ce7c963..a6e1fbce94 100644
--- a/Strand/Screens/SleepView.swift
+++ b/Strand/Screens/SleepView.swift
@@ -310,7 +310,8 @@ struct SleepView: View {
     /// Locale-formatted clock time (no date) for the banner's window range.
     private func clockTime(_ ts: Int) -> String {
         Date(timeIntervalSince1970: TimeInterval(ts))
-            .formatted(date: .omitted, time: .shortened)
+            .formatted(Date.FormatStyle(date: .omitted, time: .shortened)
+                .locale(AppClock.formattingLocale))   // #1821
     }
 
     /// The transient undo strip: a Rest-tinted frosted banner with the suppressed window and a real Undo
@@ -1340,9 +1341,9 @@ struct SleepView: View {
     // MARK: - WHOOP stage-timeline rows (the sleep-details reference design, ryanAtriumAi #988)
 
     /// Clock labels for the timeline axis; "jmm" respects the device 12/24-hour setting.
-    private static let stageAxisFormatter: DateFormatter = {
-        let f = DateFormatter(); f.locale = AppLanguage.activeLocale; f.setLocalizedDateFormatFromTemplate("jmm"); return f
-    }()
+    /// #1821: routed through AppClock so the Clock format setting reaches this label. Was a `static
+    /// let`, which would have frozen the reader's choice at first use until the app relaunched.
+    private static var stageAxisFormatter: DateFormatter { AppClock.hourMinuteFormatter() }
 
     /// The WHOOP sleep-stages chart: a stack of four per-stage timeline rows (AWAKE · LIGHT ·
     /// DEEP · REM, WHOOP's order) over a shared onset→wake time axis. Each row is independently
diff --git a/Strand/Screens/StagesCard.swift b/Strand/Screens/StagesCard.swift
index e3af83c922..f22b284cbb 100644
--- a/Strand/Screens/StagesCard.swift
+++ b/Strand/Screens/StagesCard.swift
@@ -453,9 +453,9 @@ struct StageDetailView: View {
     }
 
     /// Clock labels for the timeline axis; "jmm" respects the device 12/24-hour setting.
-    private static let stageAxisFormatter: DateFormatter = {
-        let f = DateFormatter(); f.locale = AppLanguage.activeLocale; f.setLocalizedDateFormatFromTemplate("jmm"); return f
-    }()
+    /// #1821: routed through AppClock so the Clock format setting reaches this label. Was a `static
+    /// let`, which would have frozen the reader's choice at first use until the app relaunched.
+    private static var stageAxisFormatter: DateFormatter { AppClock.hourMinuteFormatter() }
 
     /// The WHOOP sleep-stages chart: a stack of four per-stage timeline rows (AWAKE · LIGHT ·
     /// DEEP · REM, WHOOP's order) over a shared onset→wake time axis. Each row is independently
diff --git a/Strand/Screens/TodayView.swift b/Strand/Screens/TodayView.swift
index f801a14f63..8e67539e9f 100644
--- a/Strand/Screens/TodayView.swift
+++ b/Strand/Screens/TodayView.swift
@@ -5035,12 +5035,9 @@ struct TodayView: View {
     /// show times, not the day-granularity default ("EEE d MMM"). Also formats the workout-tile caption's
     /// time range (#157). The "jmm" skeleton respects the device's 12-/24-hour setting (#337): "7:10 AM"
     /// where 12-hour is preferred, "19:10" where 24-hour is, instead of forcing one on everyone.
-    static let hrTimeFmt: DateFormatter = {
-        let f = DateFormatter()
-        f.locale = AppLanguage.activeLocale
-        f.setLocalizedDateFormatFromTemplate("jmm")
-        return f
-    }()
+    /// #1821: routed through AppClock so the Clock format setting reaches this label. Was a `static
+    /// let`, which would have frozen the reader's choice at first use until the app relaunched.
+    static var hrTimeFmt: DateFormatter { AppClock.hourMinuteFormatter() }
 }
 
 /// `.task(id:)` key combining the data refresh sequence with the selected day so a reload runs on
diff --git a/Strand/Screens/WorkoutDetailView.swift b/Strand/Screens/WorkoutDetailView.swift
index 7a7bb1550a..3f7c90278b 100644
--- a/Strand/Screens/WorkoutDetailView.swift
+++ b/Strand/Screens/WorkoutDetailView.swift
@@ -573,18 +573,12 @@ struct WorkoutDetailView: View {
         f.dateFormat = "EEEE d MMM yyyy"
         return f
     }()
-    private static let timeFmt: DateFormatter = {
-        let f = DateFormatter()
-        f.locale = AppLanguage.activeLocale
-        f.setLocalizedDateFormatFromTemplate("jmm")
-        return f
-    }()
-    private static let tooltipTime: DateFormatter = {
-        let f = DateFormatter()
-        f.locale = AppLanguage.activeLocale
-        f.setLocalizedDateFormatFromTemplate("jmm")
-        return f
-    }()
+    /// #1821: routed through AppClock so the Clock format setting reaches this label. Was a `static
+    /// let`, which would have frozen the reader's choice at first use until the app relaunched.
+    private static var timeFmt: DateFormatter { AppClock.hourMinuteFormatter() }
+    /// #1821: routed through AppClock so the Clock format setting reaches this label. Was a `static
+    /// let`, which would have frozen the reader's choice at first use until the app relaunched.
+    private static var tooltipTime: DateFormatter { AppClock.hourMinuteFormatter() }
 
     private func dateLabel(_ ts: Int) -> String {
         Self.dateFmt.string(from: Date(timeIntervalSince1970: TimeInterval(ts)))
diff --git a/Strand/Screens/WorkoutsView.swift b/Strand/Screens/WorkoutsView.swift
index 84f3bbd289..90fe7a3031 100644
--- a/Strand/Screens/WorkoutsView.swift
+++ b/Strand/Screens/WorkoutsView.swift
@@ -1735,12 +1735,9 @@ struct WorkoutsView: View {
 
     // The "jmm" skeleton respects the device's 12-/24-hour setting (#337): "4:34 PM" where 12-hour is
     // preferred, "16:34" where 24-hour is — instead of forcing 24-hour on everyone (matches TodayView).
-    private static let timeFmt: DateFormatter = {
-        let f = DateFormatter()
-        f.locale = AppLanguage.activeLocale
-        f.setLocalizedDateFormatFromTemplate("jmm")
-        return f
-    }()
+    /// #1821: routed through AppClock so the Clock format setting reaches this label. Was a `static
+    /// let`, which would have frozen the reader's choice at first use until the app relaunched.
+    private static var timeFmt: DateFormatter { AppClock.hourMinuteFormatter() }
 
     private func dateLabel(_ ts: Int) -> String {
         Self.dateFmt.string(from: Date(timeIntervalSince1970: TimeInterval(ts)))
diff --git a/android/app/src/main/java/com/noop/analytics/ClockFormat.kt b/android/app/src/main/java/com/noop/analytics/ClockFormat.kt
new file mode 100644
index 0000000000..821f524c1c
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/ClockFormat.kt
@@ -0,0 +1,65 @@
+package com.noop.analytics
+
+/**
+ * #1821: which clock the UI shows times in. Twin of the Apple `ClockFormatPreference`.
+ *
+ * NOOP had no such setting: every user-facing time came from the device region's convention, and on
+ * Apple the region identifier discards the user's explicit "24-Hour Time" switch entirely. A reader in a
+ * 24-hour region who prefers 12-hour had no way to say so, which is the report this exists to answer.
+ */
+enum class ClockFormatPreference {
+    /** Follow the device's own clock switch. The default, so nobody's display changes on upgrade. */
+    SYSTEM,
+    TWELVE_HOUR,
+    TWENTY_FOUR_HOUR,
+    ;
+
+    companion object {
+        /** Persistence key, shared with the Apple @AppStorage binding so the two cannot drift apart. */
+        const val PREFS_KEY = "clockFormatPreference"
+
+        /** Stored as the Apple rawValue strings, so one documented vocabulary spans both platforms. */
+        fun from(stored: String?): ClockFormatPreference = when (stored) {
+            "twelveHour" -> TWELVE_HOUR
+            "twentyFourHour" -> TWENTY_FOUR_HOUR
+            // Unknown/absent must not silently pin every reader to one clock.
+            else -> SYSTEM
+        }
+    }
+
+    /** The value written to storage - the Apple rawValue, not the Kotlin enum name. */
+    fun stored(): String = when (this) {
+        SYSTEM -> "system"
+        TWELVE_HOUR -> "twelveHour"
+        TWENTY_FOUR_HOUR -> "twentyFourHour"
+    }
+}
+
+object ClockFormat {
+    /**
+     * Resolve the preference against what the device reports. [systemUses24Hour] is injected rather than
+     * read here so this stays pure and identically testable on both platforms - Android supplies
+     * `DateFormat.is24HourFormat(context)`, Apple `Locale.autoupdatingCurrent`.
+     */
+    fun uses24Hour(preference: ClockFormatPreference, systemUses24Hour: Boolean): Boolean =
+        when (preference) {
+            ClockFormatPreference.SYSTEM -> systemUses24Hour
+            ClockFormatPreference.TWELVE_HOUR -> false
+            ClockFormatPreference.TWENTY_FOUR_HOUR -> true
+        }
+
+    /**
+     * The SimpleDateFormat pattern for a wall-clock time at minute precision. Explicit patterns, not a
+     * localised template: once the reader has CHOSEN a clock, a template would hand the decision back to
+     * the locale and quietly ignore them.
+     */
+    fun hourMinutePattern(uses24Hour: Boolean): String = if (uses24Hour) "HH:mm" else "h:mm a"
+
+    /**
+     * SKELETON template for the same time, the twin of the Apple accessor. Apple feeds this to
+     * `setLocalizedDateFormatFromTemplate` so the locale still decides ordering and AM/PM wording while
+     * the H-vs-h choice stays ours. Deliberately NOT `j`, which resolves the hour from the locale - the
+     * precise mechanism by which a reader's explicit preference was being discarded.
+     */
+    fun hourMinuteTemplate(uses24Hour: Boolean): String = if (uses24Hour) "Hmm" else "hmm"
+}
diff --git a/android/app/src/main/java/com/noop/ui/AutomationsScreen.kt b/android/app/src/main/java/com/noop/ui/AutomationsScreen.kt
index 7df721ed99..401beb9e92 100644
--- a/android/app/src/main/java/com/noop/ui/AutomationsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/AutomationsScreen.kt
@@ -56,6 +56,7 @@ import com.noop.analytics.HrZones
 import com.noop.analytics.NapCandidate
 import kotlinx.coroutines.launch
 import kotlin.math.roundToInt
+import com.noop.analytics.ClockFormat
 
 /**
  * Automations — turn the strap's physical inputs (double-tap, wrist on/off) and live
@@ -458,7 +459,10 @@ private fun NapActionButton(icon: ImageVector, contentDescription: String, tint:
 
 /** "HH:mm–HH:mm · ~N min", local time. Pure-ish (reads the device clock format only). */
 private fun napWindowLabel(nap: NapCandidate, ctx: android.content.Context): String {
-    val fmt = android.text.format.DateFormat.getTimeFormat(ctx)
+    // #1821: the reader's chosen clock, not the raw device format.
+    val fmt = java.text.SimpleDateFormat(
+        ClockFormat.hourMinutePattern(ClockPrefs.uses24Hour(ctx)), java.util.Locale.getDefault(),
+    )
     val start = fmt.format(java.util.Date(nap.start * 1000L))
     val end = fmt.format(java.util.Date(nap.end * 1000L))
     val mins = nap.durationS / 60
diff --git a/android/app/src/main/java/com/noop/ui/CaffeineLog.kt b/android/app/src/main/java/com/noop/ui/CaffeineLog.kt
index cfeb74e555..75a677c354 100644
--- a/android/app/src/main/java/com/noop/ui/CaffeineLog.kt
+++ b/android/app/src/main/java/com/noop/ui/CaffeineLog.kt
@@ -44,6 +44,7 @@ import org.json.JSONObject
 import java.util.Calendar
 import java.util.UUID
 import kotlin.math.roundToInt
+import com.noop.analytics.ClockFormat
 
 // MARK: - Caffeine window (#526) — pure persistence helpers + the Insights logging card.
 //
@@ -326,8 +327,10 @@ private fun caffeineHoursLabel(hrs: Double): String {
 }
 
 private fun caffeineIntakeLabel(intake: CaffeineIntake, context: Context): String {
-    val time = android.text.format.DateFormat.getTimeFormat(context)
-        .format(java.util.Date(intake.atEpochSec * 1000L))
+    // #1821: the reader's chosen clock, not the raw device format.
+    val time = java.text.SimpleDateFormat(
+        ClockFormat.hourMinutePattern(ClockPrefs.uses24Hour(context)), java.util.Locale.getDefault(),
+    ).format(java.util.Date(intake.atEpochSec * 1000L))
     return if (intake.mg != null) "$time · ${intake.mg.roundToInt()} mg" else "$time · amount not logged"
 }
 
diff --git a/android/app/src/main/java/com/noop/ui/ClockPrefs.kt b/android/app/src/main/java/com/noop/ui/ClockPrefs.kt
new file mode 100644
index 0000000000..e6263db597
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ui/ClockPrefs.kt
@@ -0,0 +1,32 @@
+package com.noop.ui
+
+import android.content.Context
+import android.text.format.DateFormat
+import com.noop.analytics.ClockFormat
+import com.noop.analytics.ClockFormatPreference
+
+/**
+ * #1821: the app-side reader for the Clock format setting - the Android twin of Apple's `AppClock`.
+ *
+ * The label helpers in `SleepTimeLabels` take an `is24h` flag rather than a `Context`, deliberately, so
+ * they stay pure and unit-testable (`axisEdgeLabel` already worked that way). This is the one place that
+ * turns a Context into that flag, so no caller has to know how the preference is stored or that "system"
+ * means the device switch rather than the region default.
+ */
+object ClockPrefs {
+    /** The stored preference, defaulting to SYSTEM so an upgrade changes nobody's displayed times. */
+    fun preference(context: Context): ClockFormatPreference =
+        ClockFormatPreference.from(
+            NoopPrefs.of(context).getString(NoopPrefs.KEY_CLOCK_FORMAT, null),
+        )
+
+    fun setPreference(context: Context, preference: ClockFormatPreference) {
+        NoopPrefs.of(context).edit()
+            .putString(NoopPrefs.KEY_CLOCK_FORMAT, preference.stored())
+            .apply()
+    }
+
+    /** Resolved: the reader's explicit choice, or the device's own 12/24h switch when they said SYSTEM. */
+    fun uses24Hour(context: Context): Boolean =
+        ClockFormat.uses24Hour(preference(context), DateFormat.is24HourFormat(context))
+}
diff --git a/android/app/src/main/java/com/noop/ui/CoupledScreen.kt b/android/app/src/main/java/com/noop/ui/CoupledScreen.kt
index 600a943a45..4ff41ccbd0 100644
--- a/android/app/src/main/java/com/noop/ui/CoupledScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/CoupledScreen.kt
@@ -53,6 +53,7 @@ import java.text.SimpleDateFormat
 import java.util.Date
 import java.util.Locale
 import kotlin.math.roundToInt
+import com.noop.analytics.ClockFormat
 
 // MARK: - Coupled view (task #43) — Kotlin twin of CoupledView.swift
 //
@@ -244,7 +245,7 @@ fun CoupledScreen(
             sleepPerformance = sleepPerformance,
             asleepMin = todayRow?.totalSleepMin,
             needMin = sleepNeedForDay(todayRow, days, importedNeed),
-            bedWakeSpan = bedWakeSpan(sleeps, habitualMidsleepSec),
+            bedWakeSpan = bedWakeSpan(sleeps, habitualMidsleepSec, ClockPrefs.uses24Hour(LocalContext.current)),
             onOpenSleep = onOpenSleep,
         )
         Text(
@@ -636,11 +637,11 @@ private fun sleepNeedForDay(day: DailyMetric?, days: List<DailyMetric>, imported
  * session" pick, which could name a different block -- and so a different span -- than the Sleep tab and
  * Today's HR graph for a night stored as more than one block (#294).
  */
-private fun bedWakeSpan(sleeps: List<SleepSession>, habitualMidsleepSec: Long?): String? {
+private fun bedWakeSpan(sleeps: List<SleepSession>, habitualMidsleepSec: Long?, is24h: Boolean): String? {
     val windowStart = System.currentTimeMillis() / 1000L - 36 * 3600L // within the last 36h counts as last night
     val candidates = sleeps.filter { it.endTs > windowStart }
     val span = mainSleepSpan(candidates, habitualMidsleepSec) ?: return null
-    val fmt = SimpleDateFormat("HH:mm", Locale.getDefault())
+    val fmt = SimpleDateFormat(ClockFormat.hourMinutePattern(is24h), Locale.getDefault())   // #1821
     return "${fmt.format(Date(span.first * 1000L))} - ${fmt.format(Date(span.second * 1000L))}"
 }
 
diff --git a/android/app/src/main/java/com/noop/ui/MainActivity.kt b/android/app/src/main/java/com/noop/ui/MainActivity.kt
index ce1fd50ecb..5646940cfa 100644
--- a/android/app/src/main/java/com/noop/ui/MainActivity.kt
+++ b/android/app/src/main/java/com/noop/ui/MainActivity.kt
@@ -700,6 +700,10 @@ object NoopPrefs {
         of(context).edit().putBoolean(KEY_APP_ICON_NAVY, navy).apply()
     }
 
+    /** #1821: Clock format ("system" / "twelveHour" / "twentyFourHour"). Shares its stored vocabulary
+     *  with the Apple @AppStorage binding via [com.noop.analytics.ClockFormatPreference]. */
+    const val KEY_CLOCK_FORMAT = com.noop.analytics.ClockFormatPreference.PREFS_KEY
+
     /** Imperial/Metric display preference (D#103). Display-only, stored data stays SI. The length/mass
      *  system is read by [UnitPrefs.system]; the temperature override (empty = "match the system") by
      *  [UnitPrefs.temperature]. Mirrors macOS @AppStorage("units.system" / "units.temperature"). */
diff --git a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
index 6da2e4ffe3..6ec41d7951 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
@@ -140,6 +140,7 @@ import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 import kotlin.math.roundToInt
+import com.noop.analytics.ClockFormatPreference
 
 // MARK: - Settings (ported from Strand/Screens/SettingsView.swift)
 //
@@ -666,6 +667,7 @@ fun SettingsScreen(
     // `temperatureRaw` is "" (match the system) or a TemperatureUnit raw value. SharedPreferences isn't
     // reactive, so these mirror into local state like the toggles above.
     var unitSystem by remember { mutableStateOf(UnitPrefs.system(context)) }
+    var clockFormat by remember { mutableStateOf(ClockPrefs.preference(context)) }   // #1821
     var temperatureRaw by remember {
         mutableStateOf(NoopPrefs.of(context).getString(NoopPrefs.KEY_TEMPERATURE_UNIT, "") ?: "")
     }
@@ -1306,6 +1308,33 @@ fun SettingsScreen(
                 )
             }
             SettingsRowDivider()
+            // #1821: Clock format. Sits with Language because it is an app-owned display CONVENTION, and
+            // like Language it offers "System default" - which here means the device's own 12/24h switch,
+            // not the region default that was silently deciding this for everyone. Twin of the Apple row.
+            SettingsFormRow(label = uiString(R.string.l10n_settings_screen_clock_04f6b3ea)) {
+                SegmentedPillControl(
+                    items = listOf(
+                        ClockFormatPreference.SYSTEM,
+                        ClockFormatPreference.TWELVE_HOUR,
+                        ClockFormatPreference.TWENTY_FOUR_HOUR,
+                    ),
+                    selection = clockFormat,
+                    label = {
+                        when (it) {
+                            ClockFormatPreference.TWELVE_HOUR ->
+                                uiString(R.string.l10n_settings_screen_12_hour_41c18ba0)
+                            ClockFormatPreference.TWENTY_FOUR_HOUR ->
+                                uiString(R.string.l10n_settings_screen_24_hour_18e86819)
+                            else -> uiString(R.string.settings_language_system)
+                        }
+                    },
+                    onSelect = {
+                        clockFormat = it
+                        ClockPrefs.setPreference(context, it)
+                    },
+                )
+            }
+            SettingsRowDivider()
             // Theme presets — one-tap bundles coordinating accent + chart world + backdrop + card opacity.
             // Derived (no stored value): tweaking any control below flips this to Custom.
             SettingsFormRow(label = uiString(R.string.l10n_settings_screen_preset)) {
@@ -2866,7 +2895,9 @@ fun SettingsScreen(
                     kind = NoopButtonKind.Secondary,
                     fullWidth = true,
                     onClick = {
-                        vm.ble.buzzTimeNow(is24h = android.text.format.DateFormat.is24HourFormat(context))
+                        // #1821: buzzTimeNow's doc asked for "a Settings toggle" to supply this.
+                        // Now there is one, so the pulses read the clock the user chose.
+                        vm.ble.buzzTimeNow(is24h = ClockPrefs.uses24Hour(context))
                     },
                 )
                 Text(
diff --git a/android/app/src/main/java/com/noop/ui/SleepModelLogic.kt b/android/app/src/main/java/com/noop/ui/SleepModelLogic.kt
index 7329fd57d4..8a058097d0 100644
--- a/android/app/src/main/java/com/noop/ui/SleepModelLogic.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepModelLogic.kt
@@ -131,6 +131,10 @@ internal fun buildSleepModel(
     // Today's logical-day key, the anchor for each tile's staleness bound (see [metric]). Injectable so
     // tests can pin the clock instead of depending on the day they happen to run.
     todayKey: String = logicalDayKeyNow(),
+    // #1821: the reader's chosen clock. Defaults to 24h, which is what every one of these labels was
+    // hardcoded to before the setting existed, so tests and any caller not yet updated keep their old
+    // output rather than silently flipping.
+    is24h: Boolean = true,
 ): SleepModel? {
     val effectiveDay = selectedDay ?: days.lastOrNull()?.day ?: return null
     // The HERO night = the selected day's stage-bearing row. The TILE / debt / need / trend
@@ -279,7 +283,7 @@ internal fun buildSleepModel(
 
     return SleepModel(
         stages = stages,
-        clockLabel = clockLabel(latest, session),
+        clockLabel = clockLabel(latest, session, is24h),
         efficiencyText = efficiency.latest?.let { "${it.roundToInt()}%" } ?: "—",
         performance = performance,
         efficiency = efficiency,
@@ -316,12 +320,13 @@ internal fun fallbackSleepModel(
     napSleepMinByDay: Map<String, Double> = emptyMap(),
     sessions: List<SleepSession> = emptyList(),
     todayKey: String = logicalDayKeyNow(),
+    is24h: Boolean = true,   // #1821, threaded to the hero's clock label
 ): SleepModel? {
     val anchorDay = days.lastOrNull {
         (it.deepMin ?: 0.0) + (it.remMin ?: 0.0) + (it.lightMin ?: 0.0) > 0.0
     }?.day ?: return null
     return buildSleepModel(days, null, imported, selectedDay = anchorDay,
-        napSleepMinByDay = napSleepMinByDay, sessions = sessions, todayKey = todayKey)
+        napSleepMinByDay = napSleepMinByDay, sessions = sessions, todayKey = todayKey, is24h = is24h)
 }
 
 /**
diff --git a/android/app/src/main/java/com/noop/ui/SleepNightNavUi.kt b/android/app/src/main/java/com/noop/ui/SleepNightNavUi.kt
index 6fb9d5c954..ec351a3719 100644
--- a/android/app/src/main/java/com/noop/ui/SleepNightNavUi.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepNightNavUi.kt
@@ -53,6 +53,7 @@ import java.util.Date
 import java.util.Locale
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.setValue
+import com.noop.analytics.ClockFormat
 
 // Sleep window row + night navigation / edit / delete controls.
 // Extracted from SleepScreen.kt (behavioral no-op; pure UI code-motion).
@@ -66,8 +67,11 @@ import androidx.compose.runtime.setValue
  */
 @Composable
 internal fun SleepWindowRow(onsetTs: Long, wakeTs: Long) {
-    val asleep = clockTimeLabel(onsetTs)
-    val woke = clockTimeLabel(wakeTs)
+    // #1821: the reader's chosen clock. Read here rather than threaded, because this is a composable and
+    // LocalContext is the idiomatic source; the label helpers stay pure.
+    val is24h = ClockPrefs.uses24Hour(LocalContext.current)
+    val asleep = clockTimeLabel(onsetTs, is24h)
+    val woke = clockTimeLabel(wakeTs, is24h)
     // A frosted Rest-tinted card (was a flat surfaceRaised block) so the window row sits in the
     // same colour world as the rest of the screen. Bevel treatment — content unchanged.
     NoopCard(
@@ -180,7 +184,9 @@ internal fun NightNavHeader(
     // once; Cancel discards it. This mirrors Apple SleepTimeEditor's single start+end save funnel.
     val currentDraft = sleepEditDraft
     if (showTimeChoice && session != null && currentDraft != null) {
-        val timeFmt = SimpleDateFormat("HH:mm", Locale.US)
+        val timeFmt = SimpleDateFormat(                               // #1821
+            ClockFormat.hourMinutePattern(ClockPrefs.uses24Hour(LocalContext.current)), Locale.US,
+        )
         val bedText = timeFmt.format(Date(currentDraft.startTs * 1000L))
         val wakeText = timeFmt.format(Date(currentDraft.endTs * 1000L))
         val validated = currentDraft.validatedWindow(System.currentTimeMillis() / 1000L)
diff --git a/android/app/src/main/java/com/noop/ui/SleepNightSelection.kt b/android/app/src/main/java/com/noop/ui/SleepNightSelection.kt
index 2df0615887..5d3a978020 100644
--- a/android/app/src/main/java/com/noop/ui/SleepNightSelection.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepNightSelection.kt
@@ -34,6 +34,9 @@ internal fun selectNight(
     // group order onto HeroNight.groupMotion. Empty/absent → honest empty state. Default empty so existing
     // callers/tests compile unchanged.
     motionByStart: Map<Long, List<Double>> = emptyMap(),
+    // #1821: the reader's chosen clock, for the hero's onset-wake label. Defaults to the 24h the label
+    // was hardcoded to, so existing callers and tests are unchanged until they opt in.
+    is24h: Boolean = true,
 ): HeroNight? {
     if (navDays.isEmpty()) return null
     val dayIdx = offset.coerceIn(0, navDays.size - 1)
@@ -114,7 +117,7 @@ internal fun selectNight(
     val groupInBedMin = if (heroGroup.size > 1) {
         heroGroup.sumOf { (it.endTs - it.effectiveStartTs).coerceAtLeast(0L) } / 60.0
     } else null
-    return HeroNight(session, dayKey, segments, clockLabelFor(heroOnsetTs, heroWakeTs), napBlocks, groupStages,
+    return HeroNight(session, dayKey, segments, clockLabelFor(heroOnsetTs, heroWakeTs, is24h), napBlocks, groupStages,
         groupSegments, groupMotion, groupInBedMin, heroOnsetTs, heroWakeTs, heroGroup)
 }
 
diff --git a/android/app/src/main/java/com/noop/ui/SleepScreen.kt b/android/app/src/main/java/com/noop/ui/SleepScreen.kt
index f852f2b531..75da1cb5ca 100644
--- a/android/app/src/main/java/com/noop/ui/SleepScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepScreen.kt
@@ -93,6 +93,7 @@ import kotlin.math.max
 import kotlin.math.roundToInt
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.setValue
+import com.noop.analytics.ClockFormat
 
 internal enum class SleepFreshnessStatus {
     SYNCING, CALCULATING, SYNC_FAILED, AWAITING_SYNC, NOT_DETECTED,
@@ -493,8 +494,11 @@ fun SleepScreen(
     // The navigated night, decoded once per (offset, data) change — chevron taps re-pick
     // instantly without re-parsing stagesJSON on every recomposition. The offset now indexes
     // DAYS (navDays), so a day with a detected night always resolves to that night. (#160, #59)
-    val night = remember(nightOffset, navDays, days, habitualMidsleep, motionByStart) {
-        selectNight(navDays, days, nightOffset, habitualMidsleep, motionByStart)
+    // #1821: the reader's chosen clock, resolved once for this screen. It is a remember KEY below so
+    // changing the setting re-derives the labels instead of leaving the old clock on screen.
+    val is24h = ClockPrefs.uses24Hour(LocalContext.current)
+    val night = remember(nightOffset, navDays, days, habitualMidsleep, motionByStart, is24h) {
+        selectNight(navDays, days, nightOffset, habitualMidsleep, motionByStart, is24h = is24h)
     }
 
     // #1311: label the carousel by CALENDAR nights, not the flat recorded-night index — a night with no
@@ -509,10 +513,10 @@ fun SleepScreen(
     // at-a-glance TILES, the debt ledger, the personal need and the trend stay full-history /
     // latest-anchored, matching iOS SleepView. `selectedDay` re-points only the hero. Model is null
     // when the selected day has no stage minutes. (#5)
-    val model = remember(days, night, imported, napSleepMinByDay, sleeps) {
+    val model = remember(days, night, imported, napSleepMinByDay, sleeps, is24h) {
         buildSleepModel(days, night?.session, imported, selectedDay = night?.dayKey,
             heroStages = night?.groupStages, heroSegments = night?.groupSegments,
-            napSleepMinByDay = napSleepMinByDay, sessions = sleeps)
+            napSleepMinByDay = napSleepMinByDay, sessions = sleeps, is24h = is24h)
     }
     val display = remember(model, night) { heroDisplay(model, night) }
 
@@ -1018,7 +1022,9 @@ private fun SleepUndoBanner(undo: SleepUndoState, onUndo: () -> Unit) {
     // it retired something), but `first()` on an empty list would take the whole Sleep tab down — too
     // steep a price for a strip that is only ever informational. Render nothing instead.
     val session = undo.sessions.firstOrNull() ?: return
-    val timeFmt = SimpleDateFormat("HH:mm", Locale.US)
+    val timeFmt = SimpleDateFormat(                                   // #1821
+        ClockFormat.hourMinutePattern(ClockPrefs.uses24Hour(LocalContext.current)), Locale.US,
+    )
     // effectiveStartTs is the displayed onset (a userEdited night's corrected bed time), matching iOS.
     val startText = timeFmt.format(java.util.Date(session.effectiveStartTs * 1000L))
     val endText = timeFmt.format(java.util.Date(session.endTs * 1000L))
@@ -1733,7 +1739,8 @@ private fun NapRow(
     // with the Edit next-step. Inline disclosure (Compose has no anchored popover here); the COPY matches
     // iOS SleepView.whyPopover(napSuffix:) exactly. (spec 2026-06-20)
     var showWhy by remember(nap.startTs) { mutableStateOf(false) }
-    val window = "${clockTimeLabel(nap.effectiveStartTs)} - ${clockTimeLabel(nap.endTs)}"
+    val napIs24h = ClockPrefs.uses24Hour(LocalContext.current)   // #1821
+    val window = "${clockTimeLabel(nap.effectiveStartTs, napIs24h)} - ${clockTimeLabel(nap.endTs, napIs24h)}"
     val durMin = (nap.endTs - nap.effectiveStartTs) / 60.0
     Column(verticalArrangement = Arrangement.spacedBy(Metrics.space10)) {
         Row(
diff --git a/android/app/src/main/java/com/noop/ui/SleepStageBreakdownUi.kt b/android/app/src/main/java/com/noop/ui/SleepStageBreakdownUi.kt
index 82b38692f1..ffeecb76b7 100644
--- a/android/app/src/main/java/com/noop/ui/SleepStageBreakdownUi.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepStageBreakdownUi.kt
@@ -238,7 +238,9 @@ internal fun FilledHypnogram(
     // stranding the axis at just onset/mid/wake; a tablet fans out to the 8-label ceiling. Floor 4 keeps a
     // narrow phone from collapsing back to bare edges.
     val maxAxisLabels = (LocalConfiguration.current.screenWidthDp / 60).coerceIn(4, 8)
-    val is24h = DateFormat.is24HourFormat(LocalContext.current)
+    // #1821: the reader's CHOSEN clock, not the raw device switch. Reading the device here would have
+    // left the hypnogram axis in 24h while the sleep card above it changed - the setting half-applied.
+    val is24h = ClockPrefs.uses24Hour(LocalContext.current)
     val axisTicks = if (showsAxis) hypnogramAxisTicks(onsetTs!!, wakeTs!!, maxAxisLabels, is24h) else emptyList()
     Column(verticalArrangement = Arrangement.spacedBy(Metrics.space6)) {
         Canvas(
@@ -436,9 +438,10 @@ private fun hypnogramSummaryFor(intervals: List<StageInterval>): String =
  */
 @Composable
 internal fun ClockLabelRow(onsetTs: Long, wakeTs: Long) {
-    val onset = clockTimeLabel(onsetTs)
-    val mid = clockTimeLabel((onsetTs + wakeTs) / 2L)
-    val wake = clockTimeLabel(wakeTs)
+    val is24h = ClockPrefs.uses24Hour(LocalContext.current)   // #1821
+    val onset = clockTimeLabel(onsetTs, is24h)
+    val mid = clockTimeLabel((onsetTs + wakeTs) / 2L, is24h)
+    val wake = clockTimeLabel(wakeTs, is24h)
     Row(modifier = Modifier.fillMaxWidth()) {
         Text(
             onset,
diff --git a/android/app/src/main/java/com/noop/ui/SleepTimeLabels.kt b/android/app/src/main/java/com/noop/ui/SleepTimeLabels.kt
index fa92c9b703..39df48b15f 100644
--- a/android/app/src/main/java/com/noop/ui/SleepTimeLabels.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepTimeLabels.kt
@@ -2,6 +2,7 @@ package com.noop.ui
 
 import com.noop.data.DailyMetric
 import com.noop.data.SleepSession
+import com.noop.analytics.ClockFormat
 import java.text.SimpleDateFormat
 import java.time.LocalDate
 import java.time.format.DateTimeFormatter
@@ -15,8 +16,8 @@ internal fun shortDayLabel(day: String): String =
         LocalDate.parse(day).format(DateTimeFormatter.ofPattern("d MMM", Locale.US))
     }.getOrDefault(day)
 
-internal fun clockLabel(latest: DailyMetric, session: SleepSession?): String {
-    if (session != null) return sessionClockLabel(session)
+internal fun clockLabel(latest: DailyMetric, session: SleepSession?, is24h: Boolean): String {
+    if (session != null) return sessionClockLabel(session, is24h)
     // Fall back to the daily metric's day string (YYYY-MM-DD), formatted to "EEE d MMM".
     val dateFmt = SimpleDateFormat("EEE d MMM", Locale.US)
     return runCatching {
@@ -26,12 +27,12 @@ internal fun clockLabel(latest: DailyMetric, session: SleepSession?): String {
 }
 
 /** "Wed 4 Jun · 22:50–06:48" — the night-nav header's date · onset–wake line. (#160) */
-internal fun sessionClockLabel(session: SleepSession): String =
-    clockLabelFor(session.effectiveStartTs, session.endTs) // EFFECTIVE onset so an edited bedtime shows (PR #395)
+internal fun sessionClockLabel(session: SleepSession, is24h: Boolean): String =
+    clockLabelFor(session.effectiveStartTs, session.endTs, is24h) // EFFECTIVE onset so an edited bedtime shows (PR #395)
 
 /** Same date · onset–wake line from explicit unix-second bounds (the #736 group-aligned bedtime). */
-internal fun clockLabelFor(onsetTs: Long, wakeTs: Long): String {
-    val timeFmt = SimpleDateFormat("HH:mm", Locale.US)
+internal fun clockLabelFor(onsetTs: Long, wakeTs: Long, is24h: Boolean): String {
+    val timeFmt = SimpleDateFormat(ClockFormat.hourMinutePattern(is24h), Locale.US)
     val dateFmt = SimpleDateFormat("EEE d MMM", Locale.US)
     val onset = Date(onsetTs * 1000L)
     val wake = Date(wakeTs * 1000L)
@@ -42,9 +43,13 @@ internal fun clockLabelFor(onsetTs: Long, wakeTs: Long): String {
 internal fun localDayString(ts: Long): String =
     SimpleDateFormat("yyyy-MM-dd", Locale.US).format(Date(ts * 1000L))
 
-/** Unix seconds → a local wall-clock "HH:mm" (same 24h formatting the nav-header span uses). */
-internal fun clockTimeLabel(ts: Long): String =
-    SimpleDateFormat("HH:mm", Locale.US).format(Date(ts * 1000L))
+/**
+ * Unix seconds → a local wall-clock time, in the reader's chosen clock (#1821). [is24h] comes from
+ * `ClockPrefs.uses24Hour(context)` at the call site, keeping this pure and unit-testable - the same
+ * shape [axisEdgeLabel] already used.
+ */
+internal fun clockTimeLabel(ts: Long, is24h: Boolean): String =
+    SimpleDateFormat(ClockFormat.hourMinutePattern(is24h), Locale.US).format(Date(ts * 1000L))
 
 /**
  * Hypnogram-axis EDGE label (onset / wake) at minute precision, honouring the device 12/24h setting:
@@ -52,7 +57,7 @@ internal fun clockTimeLabel(ts: Long): String =
  * `DateFormat.is24HourFormat(context)` at the call site so this stays pure/unit-testable.
  */
 internal fun axisEdgeLabel(ts: Long, is24h: Boolean): String =
-    SimpleDateFormat(if (is24h) "HH:mm" else "h:mm a", Locale.US).format(Date(ts * 1000L))
+    SimpleDateFormat(ClockFormat.hourMinutePattern(is24h), Locale.US).format(Date(ts * 1000L))
 
 /**
  * Hypnogram-axis INTERIOR round-hour mark — the label is always on the hour, so it drops the minutes and
diff --git a/android/app/src/main/java/com/noop/widget/NoopCompactGlanceWidget.kt b/android/app/src/main/java/com/noop/widget/NoopCompactGlanceWidget.kt
index a7325e89c2..a05a784949 100644
--- a/android/app/src/main/java/com/noop/widget/NoopCompactGlanceWidget.kt
+++ b/android/app/src/main/java/com/noop/widget/NoopCompactGlanceWidget.kt
@@ -37,6 +37,8 @@ import com.noop.R
 import com.noop.ui.MainActivity
 import java.text.DateFormat
 import java.util.Date
+import com.noop.analytics.ClockFormat
+import com.noop.ui.ClockPrefs
 
 /** Compact home-screen widget: Rest, Charge and Effort icon cells plus live HR and strap battery. */
 class NoopCompactGlanceWidget : GlanceAppWidget() {
@@ -166,7 +168,10 @@ private fun CompactWidgetContent(snap: WidgetSnapshot, dark: Boolean) {
             text = when {
                 snap.connected -> "Connected"
                 snap.updatedAtMs > 0L ->
-                    DateFormat.getTimeInstance(DateFormat.SHORT).format(Date(snap.updatedAtMs))
+                    java.text.SimpleDateFormat(   // #1821: the reader's chosen clock
+                        ClockFormat.hourMinutePattern(ClockPrefs.uses24Hour(androidx.glance.LocalContext.current)),
+                        java.util.Locale.getDefault(),
+                    ).format(Date(snap.updatedAtMs))
                 else -> "Open NOOP to connect"
             },
             style = TextStyle(color = textSecondary, fontSize = 11.sp),
diff --git a/android/app/src/main/java/com/noop/widget/NoopGlanceWidget.kt b/android/app/src/main/java/com/noop/widget/NoopGlanceWidget.kt
index 36443e5117..80ce8979d3 100644
--- a/android/app/src/main/java/com/noop/widget/NoopGlanceWidget.kt
+++ b/android/app/src/main/java/com/noop/widget/NoopGlanceWidget.kt
@@ -34,6 +34,8 @@ import com.noop.R
 import com.noop.ui.MainActivity
 import java.text.DateFormat
 import java.util.Date
+import com.noop.analytics.ClockFormat
+import com.noop.ui.ClockPrefs
 
 /**
  * Home-screen widget: today's three top scores (Rest · Charge · Effort, Charge centred), with live HR
@@ -197,7 +199,10 @@ private fun WidgetContent(snap: WidgetSnapshot, dark: Boolean) {
             text = when {
                 snap.connected -> "Connected"
                 snap.updatedAtMs > 0L ->
-                    DateFormat.getTimeInstance(DateFormat.SHORT).format(Date(snap.updatedAtMs))
+                    java.text.SimpleDateFormat(   // #1821: the reader's chosen clock
+                        ClockFormat.hourMinutePattern(ClockPrefs.uses24Hour(androidx.glance.LocalContext.current)),
+                        java.util.Locale.getDefault(),
+                    ).format(Date(snap.updatedAtMs))
                 else -> "Open NOOP to connect"
             },
             style = TextStyle(color = textSecondary, fontSize = 11.sp),
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 661c5cc3b7..284a845e68 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -807,7 +807,10 @@
     <string name="l10n_scoring_guide_screen_scorecardhighlight_4af6985c">scoreCardHighlight</string>
     <string name="l10n_scoring_guide_screen_these_are_independent_approximations_from_a_301457ed">Das sind unabhängige Näherungen von einem Consumer-Strap, gebaut auf offener Wissenschaft: kein medizinischer Rat und nicht WHOOPs offizielle Werte.</string>
     <string name="l10n_scoring_guide_screen_vs_whoop_9a8126a7">VS WHOOP</string>
+    <string name="l10n_settings_screen_12_hour_41c18ba0">12 Stunden</string>
+    <string name="l10n_settings_screen_24_hour_18e86819">24 Stunden</string>
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">AdvancedChevron</string>
+    <string name="l10n_settings_screen_clock_04f6b3ea">Uhr</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
     <string name="l10n_skin_temp_cards_screen_cycle_awareness_ffb94783">Zyklusbewusstsein</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index e0fb193176..3f050ae301 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -607,7 +607,10 @@
     <string name="l10n_scoring_guide_screen_scorecardhighlight_4af6985c">puntuaciónCardHighlight</string>
     <string name="l10n_scoring_guide_screen_these_are_independent_approximations_from_a_301457ed">Son aproximaciones independientes de una pulsera de consumo, construidas sobre ciencia abierta: no son consejo médico ni las puntuaciones oficiales de WHOOP.</string>
     <string name="l10n_scoring_guide_screen_vs_whoop_9a8126a7">VS WHOOP</string>
+    <string name="l10n_settings_screen_12_hour_41c18ba0">12 horas</string>
+    <string name="l10n_settings_screen_24_hour_18e86819">24 horas</string>
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">avanzadoChevron</string>
+    <string name="l10n_settings_screen_clock_04f6b3ea">Reloj</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
     <string name="l10n_skin_temp_cards_screen_cycle_awareness_ffb94783">Conciencia del ciclo</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 2e332e0cd6..ccfa2b3b81 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -625,7 +625,10 @@
     <string name="l10n_scoring_guide_screen_scorecardhighlight_4af6985c">scoreCardHighlight</string>
     <string name="l10n_scoring_guide_screen_these_are_independent_approximations_from_a_301457ed">Ce sont des approximations indépendantes issues d\'un bracelet grand public, fondées sur la science ouverte : ni un conseil médical, ni les scores officiels de WHOOP.</string>
     <string name="l10n_scoring_guide_screen_vs_whoop_9a8126a7">VS WHOOP</string>
+    <string name="l10n_settings_screen_12_hour_41c18ba0">12 heures</string>
+    <string name="l10n_settings_screen_24_hour_18e86819">24 heures</string>
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">avancéChevron</string>
+    <string name="l10n_settings_screen_clock_04f6b3ea">Horloge</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
     <string name="l10n_skin_temp_cards_screen_cycle_awareness_ffb94783">Conscience du cycle</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index a50c1fef05..e2e8bb7b37 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -764,7 +764,10 @@
     <string name="l10n_scoring_guide_screen_scorecardhighlight_4af6985c">Podświetlenie karty wyników</string>
     <string name="l10n_scoring_guide_screen_these_are_independent_approximations_from_a_301457ed">Są to niezależne przybliżenia z paska konsumenckiego, oparte na otwartej nauce: a nie porady medyczne ani oficjalne wyniki WHOOP.</string>
     <string name="l10n_scoring_guide_screen_vs_whoop_9a8126a7">VS WHOOP</string>
+    <string name="l10n_settings_screen_12_hour_41c18ba0">12-godzinny</string>
+    <string name="l10n_settings_screen_24_hour_18e86819">24-godzinny</string>
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">zaawansowanyChevron</string>
+    <string name="l10n_settings_screen_clock_04f6b3ea">Zegar</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
     <string name="l10n_skin_temp_cards_screen_cycle_awareness_ffb94783">Świadomość rowerowa</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index b9b97f7af2..553794d0ee 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -772,7 +772,10 @@
     <string name="l10n_scoring_guide_screen_scorecardhighlight_4af6985c">pontuaçãoCardHighlight</string>
     <string name="l10n_scoring_guide_screen_these_are_independent_approximations_from_a_301457ed">Trata-se de aproximações independentes de um intervalo de consumo, construídas com base na ciência aberta: não nos conselhos médicos, nem nas pontuações oficiais do WHOOP.</string>
     <string name="l10n_scoring_guide_screen_vs_whoop_9a8126a7">VS GRUPO</string>
+    <string name="l10n_settings_screen_12_hour_41c18ba0">12 horas</string>
+    <string name="l10n_settings_screen_24_hour_18e86819">24 horas</string>
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">avançadoChevron</string>
+    <string name="l10n_settings_screen_clock_04f6b3ea">Relógio</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
     <string name="l10n_skin_temp_cards_screen_cycle_awareness_ffb94783">Consciência do ciclo</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index a16e0affb4..f2d549ae88 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -754,7 +754,10 @@
     <string name="l10n_scoring_guide_screen_scorecardhighlight_4af6985c">评分卡高亮色</string>
     <string name="l10n_scoring_guide_screen_these_are_independent_approximations_from_a_301457ed">这些是来自消费级手环的独立近似值，基于开放科学构建，并非医疗建议，也不是 WHOOP 的官方评分。</string>
     <string name="l10n_scoring_guide_screen_vs_whoop_9a8126a7">对比 WHOOP</string>
+    <string name="l10n_settings_screen_12_hour_41c18ba0">12 小时制</string>
+    <string name="l10n_settings_screen_24_hour_18e86819">24 小时制</string>
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">高级选项</string>
+    <string name="l10n_settings_screen_clock_04f6b3ea">时钟</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
     <string name="l10n_skin_temp_cards_screen_cycle_awareness_ffb94783">生理周期推断</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 68f052e8e5..d9911b4ed2 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -892,7 +892,10 @@
     <string name="l10n_scoring_guide_screen_scorecardhighlight_4af6985c">scoreCardHighlight</string>
     <string name="l10n_scoring_guide_screen_these_are_independent_approximations_from_a_301457ed">These are independent approximations from a consumer strap, built on open science: not medical advice, and not WHOOP\'s official scores.</string>
     <string name="l10n_scoring_guide_screen_vs_whoop_9a8126a7">VS WHOOP</string>
+    <string name="l10n_settings_screen_12_hour_41c18ba0">12-hour</string>
+    <string name="l10n_settings_screen_24_hour_18e86819">24-hour</string>
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">advancedChevron</string>
+    <string name="l10n_settings_screen_clock_04f6b3ea">Clock</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
     <string name="l10n_skin_temp_cards_screen_cycle_awareness_ffb94783">Cycle awareness</string>
diff --git a/android/app/src/test/java/com/noop/analytics/ClockFormatTest.kt b/android/app/src/test/java/com/noop/analytics/ClockFormatTest.kt
new file mode 100644
index 0000000000..b43feb87f2
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/ClockFormatTest.kt
@@ -0,0 +1,55 @@
+package com.noop.analytics
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/** Twin of the Apple ClockFormatTests - same cases, same expectations. */
+class ClockFormatTest {
+    @Test fun systemDefersToTheDevice() {
+        assertTrue(ClockFormat.uses24Hour(ClockFormatPreference.SYSTEM, systemUses24Hour = true))
+        assertFalse(ClockFormat.uses24Hour(ClockFormatPreference.SYSTEM, systemUses24Hour = false))
+    }
+
+    @Test fun anExplicitChoiceOverridesTheDevice() {
+        // The whole point of the setting: a reader in a 24-hour region can ask for 12-hour and get it.
+        assertFalse(ClockFormat.uses24Hour(ClockFormatPreference.TWELVE_HOUR, systemUses24Hour = true))
+        assertTrue(ClockFormat.uses24Hour(ClockFormatPreference.TWENTY_FOUR_HOUR, systemUses24Hour = false))
+    }
+
+    @Test fun unknownStoredValuesFallBackToSystemNotToAClock() {
+        assertEquals(ClockFormatPreference.SYSTEM, ClockFormatPreference.from(null))
+        assertEquals(ClockFormatPreference.SYSTEM, ClockFormatPreference.from(""))
+        assertEquals(ClockFormatPreference.SYSTEM, ClockFormatPreference.from("24h"))
+        assertEquals(ClockFormatPreference.TWELVE_HOUR, ClockFormatPreference.from("twelveHour"))
+        assertEquals(ClockFormatPreference.TWENTY_FOUR_HOUR, ClockFormatPreference.from("twentyFourHour"))
+    }
+
+    /**
+     * The stored vocabulary is the APPLE rawValue set, not the Kotlin enum names. Pinning the literals
+     * means renaming a case cannot silently make the two platforms disagree about a saved preference -
+     * and it is why `stored()` exists rather than `name`.
+     */
+    @Test fun storedVocabularyIsPinned() {
+        assertEquals("system", ClockFormatPreference.SYSTEM.stored())
+        assertEquals("twelveHour", ClockFormatPreference.TWELVE_HOUR.stored())
+        assertEquals("twentyFourHour", ClockFormatPreference.TWENTY_FOUR_HOUR.stored())
+        assertEquals("clockFormatPreference", ClockFormatPreference.PREFS_KEY)
+        // Round-trip: what we write must be what we read back.
+        for (p in ClockFormatPreference.entries) assertEquals(p, ClockFormatPreference.from(p.stored()))
+    }
+
+    @Test fun hourMinutePattern() {
+        assertEquals("HH:mm", ClockFormat.hourMinutePattern(true))
+        assertEquals("h:mm a", ClockFormat.hourMinutePattern(false))
+    }
+
+    /** The template must never be `j` - the locale-resolved hour is the bug this setting fixes. */
+    @Test fun hourMinuteTemplateNeverDefersToTheLocaleHour() {
+        assertEquals("Hmm", ClockFormat.hourMinuteTemplate(true))
+        assertEquals("hmm", ClockFormat.hourMinuteTemplate(false))
+        assertFalse(ClockFormat.hourMinuteTemplate(true).contains("j"))
+        assertFalse(ClockFormat.hourMinuteTemplate(false).contains("j"))
+    }
+}

From b254e702a8aca26fa3f13c3b5b2ede3cddb45cd9 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 01:53:48 +1200
Subject: [PATCH 177/333] Bump build to 416 for a testing build

versionCode 415 -> 416 and CURRENT_PROJECT_VERSION 296 -> 297. MARKETING_VERSION and versionName
stay at 11.1.0 - this is a testing build, not a version bump.

Carries the #1822 clock-format setting for on-device checking: the Appearance picker, and whether
the 12-hour choice actually reaches every time label rather than only the ones I could grep for.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 8d7b7252b8..1a61cde01a 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 415
+        versionCode = 416
         versionName = "11.1.0"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index de398af06f..67a2574ece 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "296"
+    CURRENT_PROJECT_VERSION: "297"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From b2288babcdced0ed4a82366400ad3d50eda232eb Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 02:37:57 +1200
Subject: [PATCH 178/333] diag(clock): read the strap's answer instead of
 asserting it (#1824)

Makes the strap's answer to the clock exchange readable instead of assumed.

Both platforms logged "clock synced - strap can persist history now" the instant they queued the
writes, so a strap log asserted the clock was set while the readout said 1970/71. The send line now
says what it sent, and the reply is logged with what each platform can honestly read - Apple the byte
at the family's result offset, Android the decoded result name - plus the whole frame in hex, and no
verdict on either, because nothing establishes what a result means for the clock.

The readout's 5/MG branch also said "RTC reads 1970/71" when no clock had been read; on that family
the evidence is how the strap dated its banked records, so it now says that.

Diagnostics and wording only. Raised on #1823; the WHOOP 4.0 report on #1818 has the same shape.
---
 .../StrandAnalytics/ConnectionReadout.swift   |  7 +++-
 .../ConnectionReadoutTests.swift              |  4 ++-
 Strand/BLE/BLEManager.swift                   |  6 +++-
 Strand/BLE/FrameRouter.swift                  | 36 +++++++++++++++++--
 .../com/noop/analytics/ConnectionReadout.kt   |  5 ++-
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 19 +++++++++-
 .../noop/analytics/ConnectionReadoutTest.kt   |  3 +-
 7 files changed, 72 insertions(+), 8 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift
index 2fa70a07f8..2d1b583e7c 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift
@@ -227,8 +227,13 @@ public enum ConnectionReadout {
         if let d = deviceClockUnix {
             return d < ConnectionTrace.rtcEpochCeilingUnix ? "no (RTC reads 1970/71)" : "yes"
         }
+        // #1823: this branch has NOT read a clock. It is reached when no clock correlation exists - which
+        // is every 5/MG, whose GET_CLOCK reply rides the puffin notify chars and never touches the WHOOP4
+        // correlation path - so the only evidence is how the strap DATED its banked records. Saying "RTC
+        // reads 1970/71" there claimed a reading we never took, in the one readout a reporter quotes when
+        // asking why nothing syncs. Report the evidence we actually have.
         if let n = strapNewestUnix {
-            return n < ConnectionTrace.rtcEpochCeilingUnix ? "no (RTC reads 1970/71)" : "yes"
+            return n < ConnectionTrace.rtcEpochCeilingUnix ? "no (records dated 1970/71)" : "yes"
         }
         return "no (waiting for the strap clock)"
     }
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ConnectionReadoutTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ConnectionReadoutTests.swift
index d330569ad7..27eb5df6fb 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ConnectionReadoutTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/ConnectionReadoutTests.swift
@@ -204,9 +204,11 @@ final class ConnectionReadoutTests: XCTestCase {
         XCTAssertEqual(
             ConnectionReadout.clockLatchedLabel(deviceClockUnix: nil, strapNewestUnix: 1_782_475_600),
             "yes")
+        // #1823: no clock was READ on this path - it is the 5/MG fallback, where the only evidence is
+        // how the strap dated its records. The wording must not claim a clock reading.
         XCTAssertEqual(
             ConnectionReadout.clockLatchedLabel(deviceClockUnix: nil, strapNewestUnix: 40_000_000),
-            "no (RTC reads 1970/71)")
+            "no (records dated 1970/71)")
         XCTAssertEqual(
             ConnectionReadout.clockLatchedLabel(deviceClockUnix: nil, strapNewestUnix: nil),
             "no (waiting for the strap clock)")
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index 0f3959f8c9..795c6cf472 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -6103,7 +6103,11 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                 // Hardware-validated ordering (#78 fork).
                 send(.setClock, payload: BLEManager.setClockPayload())
                 send(.getClock, payload: [])
-                log("WHOOP 5/MG: clock synced (set/get) — strap can persist history now")
+                // #1823: say what was SENT, not what resulted. This previously read "clock synced —
+                // strap can persist history now", logged before any reply had arrived, so a log could
+                // assert the clock was set while the Devices readout said 1970/71. The strap's actual
+                // answer now arrives as the "clock: …" ack line from FrameRouter.
+                log("WHOOP 5/MG: SET_CLOCK + GET_CLOCK sent — awaiting the strap's answer")
                 log("WHOOP 5/MG: scheduling first historical offload (connect)")
                 // Deferred ~1.5s so the puffin notify subscriptions settle before SEND_HISTORICAL_DATA,
                 // mirroring the WHOOP4 kick. requestSync → beginBackfill is itself gated on
diff --git a/Strand/BLE/FrameRouter.swift b/Strand/BLE/FrameRouter.swift
index 95f2caf328..9b11a6d238 100644
--- a/Strand/BLE/FrameRouter.swift
+++ b/Strand/BLE/FrameRouter.swift
@@ -156,6 +156,32 @@ public final class FrameRouter {
                 let verdict = r == nil ? "no result byte" : (accepted ? "accepted" : "REJECTED")
                 state.append(log: "reboot: strap acked result=\(rhex) (\(verdict))")
             }
+            // #1823: the clock exchange, on BOTH families. NOOP wrote "clock synced" the instant it queued
+            // the writes and never read the answer, so a strap log asserted the clock was set while the
+            // readout said 1970/71 — two contradictory lines with nothing to separate them. Same
+            // accept/reject shape REBOOT_STRAP already uses: the family's own result offset and polarity
+            // (5/MG 1=SUCCESS, 4.0 0=SUCCESS). LOG-ONLY; it never gates behaviour.
+            if let cmd = parsed.cmdName, cmd.hasPrefix("SET_CLOCK") || cmd.hasPrefix("GET_CLOCK") {
+                // NO accept/reject verdict here, on EITHER family, and that is deliberate.
+                //
+                // 4.0's 0=accepted is the reboot probe's own explicitly UNVERIFIED reading. And on 5/MG
+                // the result byte may not exist at all for this command: the captured-frame fixture builds
+                // a puffin COMMAND_RESPONSE as [36, seq, cmd] + payload at offset 8, so @11 is already
+                // PAYLOAD and the @12 that `commandResultByte` reads is a payload byte, not a result code.
+                // REBOOT_STRAP's use of it was validated against reboot's own frames; nothing establishes
+                // it for the clock.
+                //
+                // Inventing a verdict from that is precisely the fault this line was added to fix - the
+                // old "clock synced" log asserted an outcome nobody had checked. So quote the evidence
+                // and let a maintainer decode it: the byte at the family's result offset, and the WHOLE
+                // frame (#900's format), uncapped. A truncated clock frame answers nothing, and the full
+                // frame is what makes a wrong offset assumption visible instead of silently misleading.
+                let r = Self.commandResultByte(in: frame, family: family)
+                let rhex = r.map { String(format: "0x%02x", UInt8(truncatingIfNeeded: $0)) } ?? "none"
+                state.append(log: "clock: \(cmd) reply byte@resultOffset=\(rhex) "
+                                + "frame=\(Self.fullFrameHex(frame))",
+                             domain: .connection)
+            }
             if family == .whoop4, let cmd = parsed.cmdName {
                 if cmd.hasPrefix("GET_ADVERTISING_NAME_HARVARD") {
                     if let name = Self.advertisingName(in: frame), !name.isEmpty {
@@ -462,8 +488,14 @@ public final class FrameRouter {
 
     /// Space-separated lowercase hex of a COMMAND_RESPONSE payload, for the raw-hex diagnostic fallback
     /// when a readback payload doesn't decode. nil when the frame carries no payload.
-    nonisolated static func commandResponsePayloadHex(in frame: [UInt8]) -> String? {
-        guard let payload = commandResponsePayload(in: frame), !payload.isEmpty else { return nil }
+    /// #1823: takes `family` because `commandResponsePayload` slices at a family-specific inner offset
+    /// (5/MG 8, 4.0 its own). This wrapper used to drop the argument and always slice at the 4.0 offset,
+    /// so a 5/MG payload came back shifted - the same fixed-offset mistake the REBOOT_STRAP comment
+    /// records, and it would have mis-read the clock payload on the family the clock diagnostic is for.
+    /// Defaulted to `.whoop4` so the existing WHOOP4-gated alarm caller is unchanged.
+    nonisolated static func commandResponsePayloadHex(in frame: [UInt8],
+                                                      family: DeviceFamily = .whoop4) -> String? {
+        guard let payload = commandResponsePayload(in: frame, family: family), !payload.isEmpty else { return nil }
         return payload.map { String(format: "%02x", $0) }.joined(separator: " ")
     }
 
diff --git a/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt b/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt
index 8d181addd4..98747dc1a9 100644
--- a/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt
+++ b/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt
@@ -211,7 +211,10 @@ object ConnectionReadout {
     fun clockLatchedLabel(deviceClockUnix: Long?, strapNewestUnix: Long? = null): String {
         val ceiling = ConnectionTrace.RTC_EPOCH_CEILING_UNIX
         if (deviceClockUnix != null) return if (deviceClockUnix < ceiling) "no (RTC reads 1970/71)" else "yes"
-        if (strapNewestUnix != null) return if (strapNewestUnix < ceiling) "no (RTC reads 1970/71)" else "yes"
+        // #1823: this branch has NOT read a clock - it is reached when no correlation exists, which is
+        // every 5/MG. The only evidence is how the strap DATED its records, so say that rather than
+        // claiming a clock reading we never took. Twin of the Swift wording.
+        if (strapNewestUnix != null) return if (strapNewestUnix < ceiling) "no (records dated 1970/71)" else "yes"
         return "no (waiting for the strap clock)"
     }
 
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 9e29bd650e..dc5678cd27 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -7209,6 +7209,19 @@ class WhoopBleClient(
                     }
                     log("reboot: strap acked result=${result ?: "none"} ($verdict)")
                 }
+                // #1823: the clock exchange, on BOTH families. NOOP wrote "clock synced" the moment it
+                // queued the writes and never read the answer, so a strap log asserted the clock was set
+                // while the readout said 1970/71. Android has the DECODED result name here - the richer
+                // twin of the Apple raw byte, and the reason the reboot verdict was correct on this side -
+                // but for the clock nothing establishes what a result means, so this states no verdict
+                // either. It quotes the decoded name when there is one and the WHOLE frame in hex, which
+                // is what makes a wrong assumption visible instead of silently misleading. Log-only.
+                if (respCmd?.startsWith("SET_CLOCK") == true || respCmd?.startsWith("GET_CLOCK") == true) {
+                    log(
+                        "clock: $respCmd reply result=${result ?: "none"} " +
+                            "frame=${frame.joinToString("") { "%02x".format(it) }}",
+                    )
+                }
                 // 5/MG range-query gate: a GET_DATA_RANGE SUCCESS releases the history request
                 // (PENDING precedes it; the 2s fail-open fallback covers a swallowed reply). (#78 fork)
                 if (connectedFamily == DeviceFamily.WHOOP5 && backfilling && !historicalKickSent &&
@@ -8765,7 +8778,11 @@ class WhoopBleClient(
                 // #520: read the DIS identity on the same post-handshake schedule, staggered after the
                 // battery read so the two do not contend for the serialized GATT queue.
                 handler.postDelayed({ readDisIdentity() }, BATTERY_ON_CONNECT_DELAY_MS * 2)
-                log("WHOOP 5/MG: clock synced (set/get) — strap can persist history now")
+                // #1823: say what was SENT, not what resulted. This read "clock synced — strap can
+                // persist history now", logged before any reply existed, so a log could assert the clock
+                // was set while the Devices readout said 1970/71. The strap's own answer now arrives as
+                // the "clock: …" line above. Twin of the Apple wording.
+                log("WHOOP 5/MG: SET_CLOCK + GET_CLOCK sent — awaiting the strap's answer")
                 if (!backfillStarted) {
                     backfillStarted = true
                     handler.postDelayed({ requestSync(BackfillTrigger.CONNECT) }, INITIAL_BACKFILL_DELAY_MS)
diff --git a/android/app/src/test/java/com/noop/analytics/ConnectionReadoutTest.kt b/android/app/src/test/java/com/noop/analytics/ConnectionReadoutTest.kt
index be2baf3d84..04a5085e0f 100644
--- a/android/app/src/test/java/com/noop/analytics/ConnectionReadoutTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/ConnectionReadoutTest.kt
@@ -213,7 +213,8 @@ class ConnectionReadoutTest {
     // "waiting" forever on a strap that's actually fine.
     @Test fun clockLatchedLabelFallsBackToStrapNewestForFiveMG() {
         assertEquals("yes", ConnectionReadout.clockLatchedLabel(null, 1_782_475_600L))
-        assertEquals("no (RTC reads 1970/71)", ConnectionReadout.clockLatchedLabel(null, 40_000_000L))
+        // #1823: no clock was READ on this path - the wording must not claim one.
+        assertEquals("no (records dated 1970/71)", ConnectionReadout.clockLatchedLabel(null, 40_000_000L))
         assertEquals("no (waiting for the strap clock)", ConnectionReadout.clockLatchedLabel(null, null))
         // deviceClockUnix wins when BOTH signals are present (the WHOOP4 correlation is the more direct one).
         assertEquals("yes", ConnectionReadout.clockLatchedLabel(1_782_475_600L, 40_000_000L))

From b11a8a5ed372bda2b096e1f9e19003dcbe7ae77c Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 02:38:48 +1200
Subject: [PATCH 179/333] Bump build to 417 for a testing build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

versionCode 416 -> 417, CURRENT_PROJECT_VERSION 297 -> 298. MARKETING_VERSION
and versionName stay at 11.1.0 — a testing build, not a version bump.

Carries the #1824 clock diagnostics, so a strap log from a 5/MG or a 4.0 that
will not latch its clock now records what the strap actually answered instead
of NOOP asserting it did. That is what #1823 and #1818 both need next.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 1a61cde01a..e08ad5c00a 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 416
+        versionCode = 417
         versionName = "11.1.0"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 67a2574ece..be27528e8f 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "297"
+    CURRENT_PROJECT_VERSION: "298"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From f685632a33d9808bd8ce9aee1090ab7d1ccd4fc1 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 02:54:58 +1200
Subject: [PATCH 180/333] ble: report an intentional teardown as intentional in
 the Android epitaph
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Field log from testing build 417 showed:

  Link epitaph: up 14938ms, inbound 13 frames / 26 bytes (cmd-channel 0),
  realtime armed=no, ended=status=0

for a disconnect the very next line calls "(intentional)". Apple's epitaph
prints "intentional" for that case; Android printed the GATT status, so two
reports of the same event read differently — which defeats the point of a
line whose value is being comparable across straps and platforms.

The flag is set before handleDisconnect runs and is not reassigned above the
epitaph, so it is valid where it is read. The non-intentional branch keeps
the status code: Android has a GATT status where Apple has a CBError, and
inventing a shared vocabulary for those would be worse than reporting each
platform's own.

First field confirmation of the #1820 epitaph, incidentally: two disconnects
since 417 was installed, two epitaphs, each immediately before its connect-down
line.
---
 android/app/src/main/java/com/noop/ble/WhoopBleClient.kt | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index dc5678cd27..32ce2e2981 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -9831,7 +9831,11 @@ class WhoopBleClient(
                 upMillis = System.currentTimeMillis() - since,
                 inboundFrames = inboundFrames, inboundBytes = inboundBytes,
                 cmdChannelFrames = cmdChannelFrames, realtimeArmed = realtimeArmedThisLink,
-                ended = "status=$status",
+                // #1820 parity: Apple's epitaph reports "intentional" for a deliberate teardown rather
+                // than an error code, and a field log showed Android printing "ended=status=0" for the
+                // same event. Two reports of the same drop should not read differently. The flag is set
+                // before handleDisconnect runs and is not reassigned above, so it is valid here.
+                ended = if (intentionalDisconnect) "intentional" else "status=$status",
             ))
         }
         // Clear the tally with the link, so a second teardown for the same drop cannot re-report it.

From 7df472261af11fb8be24a5cd9bc0c11b2f285629 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 03:03:14 +1200
Subject: [PATCH 181/333] Release 11.1.0: notes, changelog, in-app What's New,
 build numbers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The version was already 11.1.0 in source from the testing builds, so the
release is dispatched with bump=none. That matters: fork-release runs
appchangelog-gen INSIDE `if [ "$NEW" != "$CUR" ]`, so a pre-bumped version
skips the in-app "What's New" generation entirely and ships a release whose
changelog card never appears. Generated here instead, with the title
localized into all six locales rather than left as an English echo.

Build numbers go to versionCode 418 / CURRENT_PROJECT_VERSION 299 rather than
staying at 417. bump=none leaves them untouched, and 417 is the last TESTING
build — Android refuses to install a package over an equal versionCode, so a
release stamped 417 could not replace the staging build it supersedes.

Release notes and changelog cover everything since v11.0.0: the clock-format
setting, the HR-only sleep spine, the battery-aware RTC advice, sleep stages
reaching the coach, oversize backups, the widget and interface corrections,
and the two diagnostics that make an unanswerable strap log answerable.

External reporters credited by handle. Gates run: i18n audit, doc-comment
lint, compileFullDebugKotlin, lintVitalFullRelease -PstagingRelease.
---
 CHANGELOG.md                                  | 60 +++++++++++++
 Strand/System/AppChangelog.swift              | 18 +++-
 android/app/build.gradle.kts                  |  2 +-
 .../src/main/java/com/noop/ui/AppChangelog.kt | 18 +++-
 .../app/src/main/res/values-de/strings.xml    |  1 +
 .../app/src/main/res/values-es/strings.xml    |  1 +
 .../app/src/main/res/values-fr/strings.xml    |  1 +
 .../app/src/main/res/values-pl/strings.xml    |  1 +
 .../src/main/res/values-pt-rPT/strings.xml    |  1 +
 .../app/src/main/res/values-zh/strings.xml    |  1 +
 android/app/src/main/res/values/strings.xml   |  1 +
 docs/releases/v11.1.0.md                      | 86 +++++++++++++++++++
 project.yml                                   |  2 +-
 13 files changed, 189 insertions(+), 4 deletions(-)
 create mode 100644 docs/releases/v11.1.0.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f939edfde5..7bd0c5740d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,6 +17,66 @@ approximate; downloads are on the [Releases](https://github.com/NoopApp/noop/rel
 
 ---
 
+## 11.1.0: A clock you choose, sleep without motion, and logs that report instead of assuming (all platforms)
+
+**Choose how you read times**
+
+- **Clock format: System / 12-hour / 24-hour (#1821).** Times were decided by your device's *region*, not
+  by you. On Apple that is deliberate — it preserves regional date order and clock style — but building a
+  locale from a region identifier discards the explicit **24-Hour Time** switch in iOS Settings, so
+  someone in a 24-hour country who preferred a 12-hour clock had no way to ask for one. Settings →
+  Appearance now offers the choice, defaulting to System, and System now follows your phone's own switch.
+  It applies to the Asleep/Woke row, workout and nap times, caffeine and hydration entries, backup
+  timestamps, sleep-stage timelines and the home-screen widgets. Chart axis ticks stay 24-hour for now:
+  12-hour labels are wider and the axis spacing needs checking on a device first.
+
+**Sleep**
+
+- **A night can be found from heart rate alone (#1801).** Sleep detection is built on stillness, so a
+  strap that banks no movement scored no nights at all — the everyday reality of a WHOOP 5/MG that will
+  not complete pairing. NOOP can now detect and stage such a night from heart rate. It is display-only by
+  design: an HR-only night never feeds resting heart rate, HRV or SDNN baselines, because it was not
+  established with the evidence those depend on.
+- **The AI coach receives your sleep stages (#1816).** It had been answering that it could not see them,
+  because deep, REM and light minutes were never included in its context. They are now, with efficiency
+  normalised so it cannot arrive as a nonsensical percentage.
+
+**Straps, logs and honesty**
+
+- **The 1970/71 clock warning takes battery into account (#1818).** It previously offered one remedy at
+  any charge level, so people already at 100% were told to charge to 100% and reconnect — advice that was
+  not backed by any precondition in the code.
+- **Every disconnect records what actually happened (#1809, thanks @supremesynergy).** How long the link
+  held, how many frames and bytes arrived, whether the realtime stream was armed, and how it ended. A
+  strap log could not previously state whether a strap had transmitted anything; you had to infer it from
+  every logged line happening to be outgoing, which measures NOOP's logging rather than the strap.
+- **The clock exchange quotes the strap's reply (#1823).** NOOP wrote "clock synced" the moment it queued
+  the write, before any answer existed, so a log could assert the clock was set while the connection
+  readout said 1970/71. It now says what it *sent* and records the reply frame. On a WHOOP 5/MG the
+  readout also claimed "RTC reads 1970/71" when no clock had ever been read on that family; it now
+  reports the evidence it has, which is how the strap dated its records.
+
+**Backup, widgets and interface**
+
+- **Oversize backups (#1807).** Export warns when an archive exceeds the 2 GiB restore ceiling instead of
+  writing one that cannot be restored, and an oversize restore can be allowed through rather than refused.
+- **Home-screen widgets (#1795, thanks @Sneheth; #1799).** Heart-rate and HRV values had swapped icons on
+  Apple. Both platforms' widgets now also read aloud properly, speaking the value rather than a bare
+  number.
+- **Live workout no longer shows two overlapping timers (#1814),** and the steps calibration card stops
+  asking for data already provided (#1815).
+- **Oura rings that advertise no name (#1797, thanks @pipiche38)** label consistently across platforms,
+  and Android's standard heart-rate logging is honest about how much it captured (#1796, thanks @kvnloo).
+
+**Still open**
+
+WHOOP 5/MG history remains unsolved. A strap that will not complete the pairing handshake is never given
+a clock, and an un-clocked 5/MG does not persist sensor data to flash, so its offloads complete empty.
+The diagnostics above exist to separate that from a strap that *was* clocked and still refuses — a
+different fault seen on the same firmware.
+
+---
+
 ## 9.3.0: Water and caffeine import, honest Effort, and an Oura resting-heart-rate fix (all platforms)
 
 A release about the numbers being right, on top of 9.2.1.
diff --git a/Strand/System/AppChangelog.swift b/Strand/System/AppChangelog.swift
index 5ca09f8520..7b42f96893 100644
--- a/Strand/System/AppChangelog.swift
+++ b/Strand/System/AppChangelog.swift
@@ -7,7 +7,7 @@ enum AppChangelog {
 
     /// Bump this when you add a release below. The "What's New" sheet shows automatically when the
     /// stored last-seen version is behind this. (Decoupled from the bundle version on purpose.)
-    static let currentVersion = "11.0.0"
+    static let currentVersion = "11.1.0"
 
     struct Release: Identifiable {
         let version: String
@@ -19,6 +19,22 @@ enum AppChangelog {
 
     /// Newest first.
     static let releases: [Release] = [
+        Release(
+            version: "11.1.0",
+            title: "Choose a 12-hour clock, sleep from straps that bank no motion, and a strap log that stops guessing",
+            date: "September 2026",
+            items: [
+                "**Pick the clock you read times in (#1821).** Settings → Appearance now offers System, 12-hour or 24-hour. It defaults to System, so nothing changes unless you ask — and System now means your phone's own 24-hour switch, which NOOP was previously ignoring in favour of your region's default. A reader in a 24-hour country who prefers 12-hour had no way to say so.",
+                "**Sleep from a strap that records no motion (#1801).** A WHOOP 5/MG that never pairs banks no movement data, and sleep detection is built on stillness — so those nights scored as nothing at all. NOOP can now find a night from heart rate alone and stage it. It is display-only by design: an HR-only night never feeds your resting heart rate or HRV baselines, because it has not earned that.",
+                "**A charged strap is no longer told to charge (#1818).** The 1970/71 clock warning offered one remedy regardless of battery, so people at 100% were sent round a loop they had already run. It now says something true for a strap that is already charged, and asks for the log that can actually explain it.",
+                "**The coach can see your sleep stages (#1816).** It was answering that it had no access to them, because deep, REM and light minutes were never in what it was given. They are now, along with sleep efficiency.",
+                "**Back up a database larger than NOOP would restore (#1807).** Export warns when an archive is past the 2 GiB restore ceiling instead of writing it silently, and a restore can be allowed through rather than refused outright.",
+                "**Home-screen widget corrections (#1795, thanks @Sneheth; #1799).** The heart-rate and HRV values sat under each other's icons on Apple. Both platforms' widgets now also read properly aloud, with the value spoken rather than the raw number.",
+                "**Live workout no longer stacks two timers (#1814), and the steps card stops asking for the half you already gave it (#1815).**",
+                "**A strap log that reports rather than assumes (#1809, thanks @supremesynergy; #1823).** Every disconnect now records how long the link held and whether the strap sent anything at all, and the clock exchange quotes what the strap actually answered. NOOP used to write \"clock synced\" the moment it queued the write, before any reply existed — so a log could insist the clock was set while the screen said 1970/71.",
+                "**Oura rings with no name, and Android's heart-rate logging (#1797, thanks @pipiche38; #1796, thanks @kvnloo).**",
+            ]
+        ),
         Release(
             version: "11.0.0",
             title: "A WHOOP 5 that stays connected, your body clock on the Sleep screen, and a Journal that knows No from nothing",
diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index e08ad5c00a..37ab465434 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 417
+        versionCode = 418
         versionName = "11.1.0"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/android/app/src/main/java/com/noop/ui/AppChangelog.kt b/android/app/src/main/java/com/noop/ui/AppChangelog.kt
index 13334add53..b6c14bd9ab 100644
--- a/android/app/src/main/java/com/noop/ui/AppChangelog.kt
+++ b/android/app/src/main/java/com/noop/ui/AppChangelog.kt
@@ -26,7 +26,7 @@ object AppChangelog {
      * Bump this when you add a release below. The "What's New" sheet shows automatically when the
      * stored last-seen version is behind this. (Decoupled from the bundle version on purpose.)
      */
-    const val CURRENT_VERSION = "11.0.0"
+    const val CURRENT_VERSION = "11.1.0"
 
     data class Release(
         val version: String,
@@ -37,6 +37,22 @@ object AppChangelog {
 
     /** Newest first. */
     val releases: List<Release> = listOf(
+        Release(
+            version = "11.1.0",
+            title = uiString(R.string.l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c),
+            date = "September 2026",
+            items = listOf(
+                "**Pick the clock you read times in (#1821).** Settings → Appearance now offers System, 12-hour or 24-hour. It defaults to System, so nothing changes unless you ask — and System now means your phone's own 24-hour switch, which NOOP was previously ignoring in favour of your region's default. A reader in a 24-hour country who prefers 12-hour had no way to say so.",
+                "**Sleep from a strap that records no motion (#1801).** A WHOOP 5/MG that never pairs banks no movement data, and sleep detection is built on stillness — so those nights scored as nothing at all. NOOP can now find a night from heart rate alone and stage it. It is display-only by design: an HR-only night never feeds your resting heart rate or HRV baselines, because it has not earned that.",
+                "**A charged strap is no longer told to charge (#1818).** The 1970/71 clock warning offered one remedy regardless of battery, so people at 100% were sent round a loop they had already run. It now says something true for a strap that is already charged, and asks for the log that can actually explain it.",
+                "**The coach can see your sleep stages (#1816).** It was answering that it had no access to them, because deep, REM and light minutes were never in what it was given. They are now, along with sleep efficiency.",
+                "**Back up a database larger than NOOP would restore (#1807).** Export warns when an archive is past the 2 GiB restore ceiling instead of writing it silently, and a restore can be allowed through rather than refused outright.",
+                "**Home-screen widget corrections (#1795, thanks @Sneheth; #1799).** The heart-rate and HRV values sat under each other's icons on Apple. Both platforms' widgets now also read properly aloud, with the value spoken rather than the raw number.",
+                "**Live workout no longer stacks two timers (#1814), and the steps card stops asking for the half you already gave it (#1815).**",
+                "**A strap log that reports rather than assumes (#1809, thanks @supremesynergy; #1823).** Every disconnect now records how long the link held and whether the strap sent anything at all, and the clock exchange quotes what the strap actually answered. NOOP used to write \"clock synced\" the moment it queued the write, before any reply existed — so a log could insist the clock was set while the screen said 1970/71.",
+                "**Oura rings with no name, and Android's heart-rate logging (#1797, thanks @pipiche38; #1796, thanks @kvnloo).**",
+            ),
+        ),
         Release(
             version = "11.0.0",
             title = uiString(R.string.l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee),
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 284a845e68..58f8ddaadc 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2677,4 +2677,5 @@
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Deine innere Uhr</string>
     <string name="vo2max_method_change_caption">Die Linie bricht dort ab, wo sich die Schätzmethode geändert hat oder nicht erfasst wurde.</string>
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">Eine WHOOP 5, die verbunden bleibt, deine innere Uhr im Schlaf-Screen und ein Journal, das Nein von gar nichts unterscheidet</string>
+    <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Wähle dein Zeitformat, Schlaf von Straps ohne Bewegungsdaten und ein Strap-Log, das nicht mehr rät</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 3f050ae301..def4ba0474 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2664,4 +2664,5 @@
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Tu reloj interno</string>
     <string name="vo2max_method_change_caption">La línea se interrumpe donde el método de estimación cambió o no se registró.</string>
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">Una WHOOP 5 que no se desconecta, tu reloj interno en la pantalla de Sueño y un diario que distingue No de nada</string>
+    <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Elige el reloj de 12 horas, sueño desde correas que no registran movimiento y un registro que deja de suponer</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index ccfa2b3b81..532dbf0891 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2663,4 +2663,5 @@
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Votre horloge</string>
     <string name="vo2max_method_change_caption">La courbe est interrompue là où la méthode d’estimation a changé ou n’a pas été enregistrée.</string>
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">Une WHOOP 5 qui reste connectée, votre horloge interne sur l\'écran Sommeil, et un journal qui distingue Non de rien</string>
+    <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Choisissez l\'horloge 12 heures, le sommeil depuis des bracelets sans données de mouvement, et un journal qui cesse de deviner</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index e2e8bb7b37..20687e1f7a 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2668,4 +2668,5 @@
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Twój zegar</string>
     <string name="vo2max_method_change_caption">Linia jest przerwana tam, gdzie metoda szacowania zmieniła się lub nie została zapisana.</string>
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">WHOOP 5, który nie traci połączenia, zegar biologiczny na ekranie snu i dziennik odróżniający Nie od braku wpisu</string>
+    <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Wybierz zegar 12-godzinny, sen z opasek bez danych o ruchu i dziennik, który przestaje zgadywać</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 553794d0ee..bcde97d715 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2656,4 +2656,5 @@
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">O seu relógio</string>
     <string name="vo2max_method_change_caption">A linha é interrompida onde o método de estimativa mudou ou não foi registado.</string>
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">Uma WHOOP 5 que se mantém ligada, o seu relógio interno no ecrã de Sono e um diário que distingue Não de nada</string>
+    <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Escolha o relógio de 12 horas, sono a partir de pulseiras sem dados de movimento e um registo que deixa de adivinhar</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index f2d549ae88..6f0a29da72 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2577,4 +2577,5 @@
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">你的生物钟</string>
     <string name="vo2max_method_change_caption">线条在估算方法发生变化或未记录之处中断。</string>
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">不再频繁掉线的 WHOOP 5、睡眠页上的生物钟，以及能分清「否」与「未记录」的日志</string>
+    <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">自选 12 小时制、从无运动数据的手环读取睡眠，以及不再靠猜测的手环日志</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index d9911b4ed2..c6d84ee420 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2690,4 +2690,5 @@
     <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Your clock</string>
     <string name="vo2max_method_change_caption">The line breaks where the estimation method changed or was not recorded.</string>
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">A WHOOP 5 that stays connected, your body clock on the Sleep screen, and a Journal that knows No from nothing</string>
+    <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Choose a 12-hour clock, sleep from straps that bank no motion, and a strap log that stops guessing</string>
 </resources>
diff --git a/docs/releases/v11.1.0.md b/docs/releases/v11.1.0.md
new file mode 100644
index 0000000000..185ff00264
--- /dev/null
+++ b/docs/releases/v11.1.0.md
@@ -0,0 +1,86 @@
+---
+whatsnew:
+  title: "Choose a 12-hour clock, sleep from straps that bank no motion, and a strap log that stops guessing"
+  date: "September 2026"
+  items:
+    - "**Pick the clock you read times in (#1821).** Settings → Appearance now offers System, 12-hour or 24-hour. It defaults to System, so nothing changes unless you ask — and System now means your phone's own 24-hour switch, which NOOP was previously ignoring in favour of your region's default. A reader in a 24-hour country who prefers 12-hour had no way to say so."
+    - "**Sleep from a strap that records no motion (#1801).** A WHOOP 5/MG that never pairs banks no movement data, and sleep detection is built on stillness — so those nights scored as nothing at all. NOOP can now find a night from heart rate alone and stage it. It is display-only by design: an HR-only night never feeds your resting heart rate or HRV baselines, because it has not earned that."
+    - "**A charged strap is no longer told to charge (#1818).** The 1970/71 clock warning offered one remedy regardless of battery, so people at 100% were sent round a loop they had already run. It now says something true for a strap that is already charged, and asks for the log that can actually explain it."
+    - "**The coach can see your sleep stages (#1816).** It was answering that it had no access to them, because deep, REM and light minutes were never in what it was given. They are now, along with sleep efficiency."
+    - "**Back up a database larger than NOOP would restore (#1807).** Export warns when an archive is past the 2 GiB restore ceiling instead of writing it silently, and a restore can be allowed through rather than refused outright."
+    - "**Home-screen widget corrections (#1795, thanks @Sneheth; #1799).** The heart-rate and HRV values sat under each other's icons on Apple. Both platforms' widgets now also read properly aloud, with the value spoken rather than the raw number."
+    - "**Live workout no longer stacks two timers (#1814), and the steps card stops asking for the half you already gave it (#1815).**"
+    - "**A strap log that reports rather than assumes (#1809, thanks @supremesynergy; #1823).** Every disconnect now records how long the link held and whether the strap sent anything at all, and the clock exchange quotes what the strap actually answered. NOOP used to write \"clock synced\" the moment it queued the write, before any reply existed — so a log could insist the clock was set while the screen said 1970/71."
+    - "**Oura rings with no name, and Android's heart-rate logging (#1797, thanks @pipiche38; #1796, thanks @kvnloo).**"
+  title_locales:
+    de: "Wähle dein Zeitformat, Schlaf von Straps ohne Bewegungsdaten und ein Strap-Log, das nicht mehr rät"
+    es: "Elige el reloj de 12 horas, sueño desde correas que no registran movimiento y un registro que deja de suponer"
+    fr: "Choisissez l'horloge 12 heures, le sommeil depuis des bracelets sans données de mouvement, et un journal qui cesse de deviner"
+    pt-PT: "Escolha o relógio de 12 horas, sono a partir de pulseiras sem dados de movimento e um registo que deixa de adivinhar"
+    zh: "自选 12 小时制、从无运动数据的手环读取睡眠，以及不再靠猜测的手环日志"
+    pl: "Wybierz zegar 12-godzinny, sen z opasek bez danych o ruchu i dziennik, który przestaje zgadywać"
+---
+# NOOP v11.1.0
+
+A release about NOOP saying what is true, and letting you choose how you read it.
+
+## Choose your clock
+
+Times were decided by your device's **region**, not by you. On Apple that is deliberate — it keeps your
+region's date order and clock style — but building a locale from a region identifier throws away the
+explicit **24-Hour Time** switch in iOS Settings. Someone in a 24-hour country who preferred a 12-hour
+clock had no way to get one.
+
+Settings → Appearance now has **Clock: System / 12-hour / 24-hour**. It defaults to System, so no
+existing display changes unless you ask, and System now follows your phone's own switch.
+
+It reaches the times you actually read: the Asleep/Woke row, workout and nap times, caffeine and
+hydration entries, backup timestamps, sleep-stage timelines, and the home-screen widgets. Chart axis
+ticks deliberately stay 24-hour for now — 12-hour labels are wider and the axis spacing needs looking at
+on a real device before that changes.
+
+## Sleep without motion
+
+Sleep detection is built on stillness, so a strap that banks no movement produced no nights at all. That
+is the everyday reality of a WHOOP 5/MG that will not complete pairing: live heart rate streams fine and
+nothing is ever recorded.
+
+NOOP can now find and stage a night from heart rate alone. It is **display-only on purpose**: an HR-only
+night never contributes to your resting heart rate, HRV or SDNN baselines. Those describe your
+physiology, and a night detected without the usual evidence has not earned a place in them.
+
+## Logs that report instead of asserting
+
+Two diagnostics landed because two different reports could not be answered from a log.
+
+Every disconnect now writes one line saying how long the link held, how many frames and bytes arrived,
+whether the realtime stream was armed, and how it ended. Previously a log could not state whether a strap
+had transmitted anything — you had to infer it from the fact that every logged line happened to be
+outgoing, which measures NOOP's logging rather than the strap.
+
+The clock exchange now quotes the strap's own reply. NOOP wrote "clock synced — strap can persist history
+now" the instant it queued the write, before any answer existed, so a log could assert the clock was set
+while the connection readout said 1970/71 — two contradictory statements with nothing to tell them apart.
+It now says what it **sent**, and logs the reply frame verbatim. On a 5/MG the readout also said "RTC
+reads 1970/71" when no clock had ever been read on that family; it now reports what it actually has,
+which is how the strap dated its records.
+
+## Everything else
+
+- The 1970/71 warning takes battery into account, so an already-charged strap is not told to charge (#1818).
+- The AI coach receives deep, REM and light minutes plus sleep efficiency (#1816).
+- Export warns when a backup exceeds the 2 GiB restore ceiling, and an oversize restore can be allowed
+  through instead of refused (#1807).
+- Widget heart-rate and HRV values match their icons again, and both platforms' widgets read aloud
+  properly (#1795, thanks @Sneheth; #1799).
+- The live-workout timer no longer sits under the pause button (#1814), and the steps calibration card
+  stops asking for data you have already provided (#1815).
+- Oura rings that advertise no name label consistently across platforms (#1797, thanks @pipiche38), and
+  Android's standard heart-rate logging is honest about how much it captured (#1796, thanks @kvnloo).
+
+## Still open
+
+WHOOP 5/MG history remains the hard problem. A strap that will not complete the pairing handshake is
+never given a clock, and an un-clocked 5/MG does not persist sensor data to flash — so its offloads
+complete with nothing in them. The diagnostics above exist to tell that case apart from a strap that was
+clocked and still refuses, which is a different fault reported on the same firmware.
diff --git a/project.yml b/project.yml
index be27528e8f..55a47ac797 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "298"
+    CURRENT_PROJECT_VERSION: "299"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 2787d4653ed0039a09cd80c4b63de761d9af044f Mon Sep 17 00:00:00 2001
From: ryanbr <mp3geek@gmail.com>
Date: Wed, 2 Sep 2026 15:17:00 +0000
Subject: [PATCH 182/333] Release 11.1.0: add to AltStore source

---
 altstore-source.json | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/altstore-source.json b/altstore-source.json
index f3eb116872..f16c7334cc 100644
--- a/altstore-source.json
+++ b/altstore-source.json
@@ -19,6 +19,15 @@
       "category": "healthcare-fitness",
       "screenshotURLs": [],
       "versions": [
+        {
+          "version": "11.1.0",
+          "buildVersion": "299",
+          "date": "2026-09-02",
+          "localizedDescription": "NOOP 11.1.0. See the release notes for what changed.",
+          "downloadURL": "https://github.com/ryanbr/noop/releases/download/v11.1.0/NOOP-ios-unsigned-v11.1.0.ipa",
+          "size": 19387496,
+          "minOSVersion": "17.0"
+        },
         {
           "version": "11.0.0",
           "buildVersion": "292",
@@ -1402,12 +1411,12 @@
           "NSMotionUsageDescription": "NOOP reads your iPhone's step count for a walking or running workout to show steps in the activity summary. It stays on your device. Nothing leaves it."
         }
       },
-      "version": "11.0.0",
-      "buildVersion": "292",
-      "versionDate": "2026-09-01",
-      "versionDescription": "NOOP 11.0.0. See the release notes for what changed.",
-      "downloadURL": "https://github.com/ryanbr/noop/releases/download/v11.0.0/NOOP-ios-unsigned-v11.0.0.ipa",
-      "size": 19362325,
+      "version": "11.1.0",
+      "buildVersion": "299",
+      "versionDate": "2026-09-02",
+      "versionDescription": "NOOP 11.1.0. See the release notes for what changed.",
+      "downloadURL": "https://github.com/ryanbr/noop/releases/download/v11.1.0/NOOP-ios-unsigned-v11.1.0.ipa",
+      "size": 19387496,
       "minOSVersion": "17.0"
     }
   ],

From ab9420ebd3eff3a888d8cd4b08137c76ef6610b0 Mon Sep 17 00:00:00 2001
From: Zebsi <66969936+Zebsi235@users.noreply.github.com>
Date: Thu, 3 Sep 2026 00:52:32 +0200
Subject: [PATCH 183/333] ble: light the charging pill on a 5/MG from the
 pack-attach events (#1826)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From @Zebsi235.

BATTERY_PACK_CONNECTED(21) and BATTERY_PACK_REMOVED(22) were declared in EventNumber and handled
nowhere. On a 5/MG they fire on every attach and detach and lead the CHARGING_ON/OFF edges, so the
charging pill now responds when a pack goes on rather than waiting to catch a later edge — with no new
opcode, no polling and no extra wire traffic.

The new branch sits inside the existing shouldApplyChargingFromBatteryEvent(replayedOffload) gate, which
is load-bearing: the capture in the PR shows the strap replaying those same edges during the next
historical offload with byte-identical payloads, so an ungated version would relight the pill minutes
after the pack came off.

Scope note beyond the pill: `charging` also feeds idleThrottleActive via batteryPctAndCharging(), which
gates GATT connection priority and pausing background capture. A strap on a pack now stops throttling
sooner. That is the direction the throttle's own comment intends ("a charging strap never throttles"),
but it is behaviour outside the Live screen and worth recording.

Apple still handles only CHARGING_ON/OFF, so the twin is a follow-up.
---
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 32ce2e2981..c39b10977f 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -7400,6 +7400,32 @@ class WhoopBleClient(
                             } else if (ev.startsWith("CHARGING_OFF")) {
                                 _state.update { s -> s.copy(charging = false) }
                             }
+                            // BATTERY_PACK_CONNECTED(21) / BATTERY_PACK_REMOVED(22) are defined in
+                            // EventNumber and handled NOWHERE. On a 5/MG they fire reliably on every
+                            // attach and detach, and they LEAD the 7/8 edges above, so handling them here
+                            // is what makes the pill respond the moment a pack goes on or comes off.
+                            //
+                            // Measured on WHOOP MG fw 50.39.1.0 over two attach/detach cycles, with every
+                            // pushed event logged:
+                            //
+                            //   01:40:51  BATTERY_PACK_CONNECTED(21)      <- attach
+                            //   01:40:51  CHARGING_ON(7)
+                            //   01:41:06  CHARGING_OFF(8)
+                            //   01:41:11  BATTERY_PACK_REMOVED(22)        <- detach
+                            //
+                            // Both families fire; 21/22 are simply the ones nothing was listening to. The
+                            // 7/8 branch above is kept exactly as it is -- this adds a second source for
+                            // the same flag, it does not replace one.
+                            //
+                            // Same replayedOffload gate as the branch above, and it is load-bearing: the
+                            // strap REPLAYS these edges during the next historical offload with identical
+                            // payloads, so an accepted replay would switch the pill back on minutes after
+                            // the pack was physically removed.
+                            if (ev.startsWith("BATTERY_PACK_CONNECTED")) {
+                                _state.update { s -> s.copy(charging = true) }
+                            } else if (ev.startsWith("BATTERY_PACK_REMOVED")) {
+                                _state.update { s -> s.copy(charging = false) }
+                            }
                         }
                         // PR #577: the strap fired its firmware smart alarm (STRAP_DRIVEN_ALARM_EXECUTED,
                         // event 57) → re-arm the next day's instant (single absolute time, no recurrence).

From 7ff64d6e16ac20d50ddd4e47be9b1f4a81603fbe Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 11:59:59 +1200
Subject: [PATCH 184/333] docs(ios): explain the AltServer sign-in failure that
 stops the install at step 1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A user hit "AltServer could not sign in with your Apple ID. The data is not in
the correct format." — NSCocoaErrorDomain 3840, "Encountered unknown tag html
on line 1". The install docs said nothing, because the failure is in
AltStore's own one-time setup rather than anywhere NOOP reaches.

It is the same shape as the source-URL note already a few lines below:
something expected structured data and got an HTML page. AltServer asked
Apple's ID service for a property list and received a web page, so the parser
hit `<html>` on line 1; the "invalid hex" line under it is the same failure
reported by the older-style parser, not a second fault.

Written down with the three causes that actually produce it — a DNS filter,
content blocker or VPN serving a block page for Apple's auth domain; an
out-of-date AltServer calling a moved endpoint; or something waiting on
Apple's side, all of which are served as HTML — and the order worth trying
them in.

Not NOOP's bug, but it is the first step of the iOS install, and "the data is
not in the correct format" tells a reader nothing about what to do next.
---
 docs/IOS.md | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/docs/IOS.md b/docs/IOS.md
index 5877afb7de..eda64350ec 100644
--- a/docs/IOS.md
+++ b/docs/IOS.md
@@ -27,6 +27,35 @@ ID**. Nothing about this touches NOOP's identity or Apple's servers on our side.
    and installs NOOP. First launch may need **Settings → General → VPN & Device Management → trust
    your Apple ID**.
 
+### If AltServer can't sign in with your Apple ID
+
+A failure at **step 1** — before NOOP is involved at all — usually looks like this:
+
+> **AltServer could not sign in with your Apple ID. The data is not in the correct format.**
+>
+> `NSCocoaErrorDomain 3840` · *Encountered unknown tag html on line 1*
+
+That is the same shape as the source-URL note below: something expected **structured data** and received an
+**HTML page**. AltServer asked Apple's ID service for a property list and got a web page back, so the
+parser hit `<html>` on the first line. The "malformed data byte group / invalid hex" line underneath is
+the same failure reported by the older-style parser, not a second problem.
+
+Nothing in the response reached Apple's auth service as intended, so the usual causes are between you and
+Apple rather than in your account:
+
+- **A DNS filter, content blocker or VPN** returning a block page for Apple's auth domain. The most common
+  cause, and the easiest to miss if the filtering is network-wide rather than on the machine.
+- **An out-of-date AltServer**, calling an endpoint Apple has since moved and receiving a redirect or
+  error page.
+- **Something waiting on Apple's side** — terms to accept, a rate limit, or a locked account. All of those
+  are served as HTML.
+
+Worth trying in this order: sign in at [appleid.apple.com](https://appleid.apple.com) in a browser to
+clear anything pending, retry with filtering and any VPN off, then update AltServer.
+
+This is AltStore's own setup rather than anything NOOP controls — but it is the first step of the install,
+so it is written down here rather than left as a dead end.
+
 ### Add NOOP as a source (recommended — auto-updates)
 
 So you never have to manually re-download, add NOOP's **source** to AltStore/SideStore once — new

From 7b1c49c4ab00830f0b99463e14de23e60103df14 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 12:06:51 +1200
Subject: [PATCH 185/333] ble: handle the pack-attach events on Apple too
 (#1831)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Apple twin of @Zebsi235's Android change in #1826.

BATTERY_PACK_CONNECTED(21) and BATTERY_PACK_REMOVED(22) are declared in the shared protocol schema and
were handled on neither platform. On a 5/MG they fire on every attach and detach and lead the
CHARGING_ON/OFF edges, so the charging pill responds when a pack goes on rather than waiting to catch a
later edge. A WHOOP 4.0 never sends them.

No replay guard here, deliberately: this router is live-only — Backfiller holds no reference to it — which
is why the CHARGING_ON/OFF branch above carries none either. Android's EVENT routing does see replays, so
its gate is load-bearing there and would guard nothing here.

Recorded on #1832: event 21 means a pack was ATTACHED, not that charging began, and `charging` also
disables the low-battery throttle. A pack that never starts charging holds that off until it is removed.
Unchanged here because both platforms now share that shape.
---
 Strand/BLE/FrameRouter.swift | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/Strand/BLE/FrameRouter.swift b/Strand/BLE/FrameRouter.swift
index 9b11a6d238..a4e723f23b 100644
--- a/Strand/BLE/FrameRouter.swift
+++ b/Strand/BLE/FrameRouter.swift
@@ -407,6 +407,22 @@ public final class FrameRouter {
                 } else if ev.hasPrefix("CHARGING_OFF") {
                     state.charging = false
                 }
+                // #1826: BATTERY_PACK_CONNECTED(21) / BATTERY_PACK_REMOVED(22), declared in the shared
+                // schema and handled on neither platform until @Zebsi235 measured them. On a 5/MG they
+                // fire on every attach and detach and LEAD the 7/8 edges above, so the pill responds when
+                // a pack goes on instead of waiting to catch a later edge. A WHOOP 4.0 never sends them.
+                //
+                // NO replay guard here, unlike the Kotlin twin. That is deliberate and not an omission:
+                // this router is live-only — the Backfiller holds no reference to it, so a replayed
+                // offload event never reaches this code, which is the same reason the CHARGING_ON/OFF
+                // branch above carries none. Android's EVENT routing does see replays, and its capture
+                // showed the strap re-sending these edges with byte-identical payloads, so the gate is
+                // load-bearing THERE. Copying it here would guard against something that cannot happen.
+                if ev.hasPrefix("BATTERY_PACK_CONNECTED") {
+                    state.charging = true
+                } else if ev.hasPrefix("BATTERY_PACK_REMOVED") {
+                    state.charging = false
+                }
                 // Physical inputs the strap exposes — live only (this path never sees historical
                 // replay, which goes through the Backfiller). Event strings are "NAME(rawValue)".
                 if ev.hasPrefix("DOUBLE_TAP") {

From 1aeae00624591b91c519499f85701fff3a7baadb Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 12:08:33 +1200
Subject: [PATCH 186/333] perf(clock): memoise the resolved clock instead of
 rebuilding it per label (#1830)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Restores the one-time cost the clock formatters had in 11.0.0.

#1822 turned ~13 `static let` DateFormatters into computed properties so the Clock setting would apply
without a relaunch, but the cache added with them guarded the wrong half: an ICU pattern build
(DateFormatter.dateFormat(fromTemplate:)) and a Bundle lookup plus Locale construction
(AppLanguage.activeLocale) both ran ahead of it on every access. Each time label paid them where 11.0.0
paid a dictionary read.

The resolved system clock, active locale and formatting locale are memoised and invalidated on
NSLocale.currentLocaleDidChangeNotification and on the settings write — so a memo can never pin a stale
clock, which would be the very failure the setting exists to avoid. The invalidator arms in
systemUses24Hour rather than the formatter, because four call sites reach AppClock only through
formattingLocale and would otherwise never have registered it.

Apple-only, because the regression is: Android's label helpers always built their formatter per call, so
nothing there was downgraded from a cached path.

Raised on #1829. Not established as the cause of the 11.1.0 startup report, which stays open.
---
 Strand/App/AppClock.swift         | 87 ++++++++++++++++++++++++-------
 Strand/Screens/SettingsView.swift |  3 ++
 2 files changed, 71 insertions(+), 19 deletions(-)

diff --git a/Strand/App/AppClock.swift b/Strand/App/AppClock.swift
index 7e769e69f1..371ae251c7 100644
--- a/Strand/App/AppClock.swift
+++ b/Strand/App/AppClock.swift
@@ -17,43 +17,92 @@ enum AppClock {
     }
 
     /// What the DEVICE is set to, read from `autoupdatingCurrent` precisely because that is the locale
-    /// the 24-Hour Time switch modifies. A 12-hour locale's `j` template contains the AM/PM symbol.
+    /// the 24-Hour Time switch modifies.
+    ///
+    /// #1829: MEMOISED. This calls `DateFormatter.dateFormat(fromTemplate:options:locale:)`, which builds
+    /// an ICU pattern generator - one of the more expensive things Foundation offers - and the first cut
+    /// of this ran it on EVERY access, ahead of the formatter cache. Since ~17 call sites had just been
+    /// converted from `static let` to computed properties, that put an ICU build behind every time label
+    /// on screen. The cache saved the cheap allocation and missed the expensive call entirely.
     static var systemUses24Hour: Bool {
+        // Arm the invalidator HERE, not in hourMinuteFormatter(): four call sites reach AppClock only
+        // through `formattingLocale` and would never have registered it, leaving their memo pinned to a
+        // stale clock for the life of the process. Every path lands here — Swift evaluates both arguments
+        // of ClockFormat.uses24Hour(preference:systemUses24Hour:) eagerly — so this is the one chokepoint.
+        // Touched before the lock: registration does not need it, and taking it twice would not nest.
+        _ = localeObserver
+        cacheLock.lock(); defer { cacheLock.unlock() }
+        if let cachedSystem24 { return cachedSystem24 }
         let template = DateFormatter.dateFormat(fromTemplate: "j", options: 0,
                                                 locale: Locale.autoupdatingCurrent) ?? "H"
-        return !template.contains("a")
+        let v = !template.contains("a")
+        cachedSystem24 = v
+        return v
     }
 
     static var uses24Hour: Bool {
         ClockFormat.uses24Hour(preference: preference, systemUses24Hour: systemUses24Hour)
     }
 
+    /// #1829: memoised for the same reason - `AppLanguage.activeLocale` reads
+    /// `Bundle.main.preferredLocalizations` and then CONSTRUCTS a `Locale`, per access.
+    static var activeLocale: Locale {
+        cacheLock.lock(); defer { cacheLock.unlock() }
+        if let cachedActiveLocale { return cachedActiveLocale }
+        let l = AppLanguage.activeLocale
+        cachedActiveLocale = l
+        return l
+    }
+
     /// The locale to hand any time-rendering `DateFormatter`. Carries an explicit hour cycle, so the
-    /// setting also reaches the formatters that never name a pattern - the ones using `timeStyle = .short`
-    /// or a `"jmm"` template, which ask the LOCALE for the hour and were therefore getting the region
-    /// default. Everything else about the locale (date order, separators, AM/PM wording, month names)
-    /// still comes from `AppLanguage.activeLocale`, exactly as before.
+    /// setting also reaches formatters that never name a pattern (`timeStyle`, a `"jmm"` template).
     static var formattingLocale: Locale {
-        Locale(identifier: ClockFormat.hourCycleLocaleIdentifier(
-            base: AppLanguage.activeLocale.identifier, uses24Hour: uses24Hour))
+        let id = ClockFormat.hourCycleLocaleIdentifier(base: activeLocale.identifier,
+                                                       uses24Hour: uses24Hour)
+        cacheLock.lock(); defer { cacheLock.unlock() }
+        if let cachedFormattingLocale, cachedFormattingLocaleID == id { return cachedFormattingLocale }
+        let l = Locale(identifier: id)
+        cachedFormattingLocale = l
+        cachedFormattingLocaleID = id
+        return l
     }
 
-    /// Cached by resolved template: building a `DateFormatter` is expensive and these are read per row in
-    /// scrolling lists, but the cache MUST key on the template rather than being a plain `static let`, or
-    /// changing the setting would not take effect until the app restarted.
     private static var cached: (template: String, locale: String, formatter: DateFormatter)?
-    /// The cache is mutable global state and `onsetText` is read from whatever thread builds a
-    /// `SleepModel`, so the read-modify-write below is serialised. SWIFT_VERSION is 5.0 here, so the
-    /// compiler would not have objected - a torn read would just have been a rare, baffling crash.
+    private static var cachedSystem24: Bool?
+    private static var cachedActiveLocale: Locale?
+    private static var cachedFormattingLocale: Locale?
+    private static var cachedFormattingLocaleID: String?
+    /// One lock for every cache here. Each accessor takes it around its own read-modify-write and
+    /// releases before returning, so none of them nest - NSLock is not recursive and a nested take would
+    /// deadlock the main thread, which is a far worse failure than the cost this exists to avoid.
     private static let cacheLock = NSLock()
 
-    /// Wall-clock time at minute precision, honouring the setting. The locale still supplies ordering,
-    /// separator and AM/PM wording; only the hour cycle is ours.
+    /// Drop every memo. Called when the reader changes the setting, and when the SYSTEM clock or locale
+    /// changes underneath us - `systemUses24Hour` can flip with no write of our own, so without this the
+    /// memo would pin a stale answer for the life of the process.
+    static func invalidate() {
+        cacheLock.lock()
+        cached = nil
+        cachedSystem24 = nil
+        cachedActiveLocale = nil
+        cachedFormattingLocale = nil
+        cachedFormattingLocaleID = nil
+        cacheLock.unlock()
+    }
+
+    /// #1829: registers exactly once, on first use — a `static let` is lazy and thread-safe in Swift, so
+    /// touching it below is the whole registration. The system 24-hour switch and the device locale can
+    /// both change with no write from us; without this the memo above would serve a stale answer for the
+    /// rest of the process, which is worse than the per-access cost it replaced.
+    private static let localeObserver: NSObjectProtocol = NotificationCenter.default.addObserver(
+        forName: NSLocale.currentLocaleDidChangeNotification, object: nil, queue: nil
+    ) { _ in AppClock.invalidate() }
+
+    /// Wall-clock time at minute precision, honouring the setting.
     static func hourMinuteFormatter() -> DateFormatter {
         let template = ClockFormat.hourMinuteTemplate(uses24Hour: uses24Hour)
-        let locale = AppLanguage.activeLocale
-        cacheLock.lock()
-        defer { cacheLock.unlock() }
+        let locale = activeLocale
+        cacheLock.lock(); defer { cacheLock.unlock() }
         if let cached, cached.template == template, cached.locale == locale.identifier {
             return cached.formatter
         }
diff --git a/Strand/Screens/SettingsView.swift b/Strand/Screens/SettingsView.swift
index d6cb082d58..398f080c78 100644
--- a/Strand/Screens/SettingsView.swift
+++ b/Strand/Screens/SettingsView.swift
@@ -1140,6 +1140,9 @@ struct SettingsView: View {
                     .pickerStyle(.menu)
                     .tint(StrandPalette.accent)
                     .accessibilityLabel("Clock")
+                    // #1829: the resolved clock is memoised, so the write has to drop the memo or the
+                    // picker would appear to do nothing until the app restarted.
+                    .onChangeCompat(of: clockFormatRaw) { _ in AppClock.invalidate() }
                 }
                 rowDivider
                 // Theme presets — one-tap bundles coordinating accent + chart world + backdrop + card

From dfa217581e26f157ad6d2e1ca80176895e805f8b Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 12:43:41 +1200
Subject: [PATCH 187/333] ble: redact a hex-hidden serial on Apple too (#1834)

Apple twin of the redaction change landing alongside #1825.

Every rule in LiveState.redactPii matches an identifier written as characters, so none can see one
encoded as hex. On a 5/MG, event 109 carries the strap serial as plain ASCII inside its payload, and
this side dumps hex four different ways - frame= from the clock diagnostic, [raw ...] and (raw ...)
from the alarm readback, and the #900 whole-frame dump with no label at all. Any of them put the
serial into the log people are asked to attach to public issues, while the MAC rule kept firing so
the line still looked redacted.

Matches the hex itself rather than a label, masking only bytes inside a serial-shaped ASCII run. The
hex pass runs before the text rules so it cannot mangle a match they own, and a service UUID's
longest hex run is 12 characters - under the 16 required - so UUIDs are untouched.

Raised on #1833. The exposure was widened two merges ago by adding frame= hex, and found while
reviewing a contributor's dump that carried a live serial.
---
 Strand/BLE/LiveState.swift                 | 76 ++++++++++++++++++++
 StrandTests/HexPayloadRedactionTests.swift | 84 ++++++++++++++++++++++
 2 files changed, 160 insertions(+)
 create mode 100644 StrandTests/HexPayloadRedactionTests.swift

diff --git a/Strand/BLE/LiveState.swift b/Strand/BLE/LiveState.swift
index 730a95c960..51c0a4e40e 100644
--- a/Strand/BLE/LiveState.swift
+++ b/Strand/BLE/LiveState.swift
@@ -773,8 +773,84 @@ public final class LiveState: ObservableObject {
     /// service base (…-8d6d-82b8-614a-1c8cb0f8dcc6) — those are public, identical on every strap, and
     /// are exactly the GATT diagnostics a shared log needs to be useful (#421). Thanks @ujix (#447) for
     /// catching the peripheral-UUID leak; this is a targeted form so we don't redact the service UUIDs.
+    /// #1833: mask a WHOOP serial that arrives as HEX rather than as text.
+    ///
+    /// Every rule in `redactPii` matches an identifier written as characters. None can see one encoded
+    /// as hex, because they are reading hex digits and not the ASCII those bytes decode to. On a 5/MG,
+    /// event 109 carries the strap serial as plain ASCII inside its payload, so any diagnostic that dumps
+    /// a frame or payload puts the serial into the log we ask people to attach to public issues — while
+    /// the MAC rule keeps firing, so the line still LOOKS redacted.
+    ///
+    /// Deliberately NOT keyed on a label. This side writes hex as `frame=…` (the clock diagnostic),
+    /// `[raw …]` and `(raw …)` (the alarm readback), and the #900 whole-frame dump carries none. A rule
+    /// enumerating today's phrasings is one the next diagnostic slips past. Matching the hex itself needs
+    /// no maintenance and covers dumps not yet written.
+    ///
+    /// Only bytes inside a serial-shaped ASCII run are masked; the rest of the dump survives, because the
+    /// payload is exactly where an undocumented field would be found. Twin of `redactHexDumpPii`.
+    nonisolated static func redactHexDump(_ hex: String) -> String {
+        let chars = Array(hex)
+        // NO even-length requirement, deliberately. The run regex matches consecutive hex characters, so
+        // a dump abutting other hex-valid text yields an ODD-length match — and bailing on that returned
+        // the serial UNREDACTED, while the Kotlin twin processed the even prefix and masked it. Swift was
+        // the weaker half of a pair that has to behave identically. Process what pairs up, ignore a
+        // trailing half-byte.
+        guard chars.count >= 16 else { return hex }
+        var bytes = [UInt8](); bytes.reserveCapacity(chars.count / 2)
+        var i = 0
+        while i + 1 < chars.count {
+            guard let b = UInt8(String(chars[i...(i + 1)]), radix: 16) else { return hex }
+            bytes.append(b); i += 2
+        }
+        var out = chars
+        var runStart = -1
+        func closeRun(_ end: Int) {
+            defer { runStart = -1 }
+            guard runStart >= 0 else { return }
+            // Anchor on the first LETTER with enough run left after it, mirroring the Kotlin regex
+            // `[A-Za-z][0-9A-Za-z]{8,}` — which finds a serial ANYWHERE inside an alphanumeric run, not
+            // only at its start. Testing just the run's first byte left the serial exposed whenever a
+            // digit happened to precede it with no separator, and Kotlin masked the same bytes. Two
+            // halves of one rule disagreeing about which payloads are safe is the failure to avoid.
+            var i = runStart
+            while i < end {
+                let b = bytes[i]
+                let isLetter = (b >= 65 && b <= 90) || (b >= 97 && b <= 122)
+                if isLetter, end - i >= 9 {
+                    for k in i..<end { out[k * 2] = "•"; out[k * 2 + 1] = "•" }
+                    return
+                }
+                i += 1
+            }
+        }
+        for (idx, b) in bytes.enumerated() {
+            let alnum = (b >= 48 && b <= 57) || (b >= 65 && b <= 90) || (b >= 97 && b <= 122)
+            if alnum { if runStart < 0 { runStart = idx } } else { closeRun(idx) }
+        }
+        closeRun(bytes.count)
+        return String(out)
+    }
+
+    private static let hexRunRegex = try? NSRegularExpression(pattern: "[0-9a-fA-F]{16,}")
+
     nonisolated static func redactPii(_ s: String) -> String {
         var out = s
+        // Hex first: the text rules below must not see (or mangle) a run we are about to mask.
+        if let re = Self.hexRunRegex {
+            let ns = out as NSString
+            let matches = re.matches(in: out, range: NSRange(location: 0, length: ns.length))
+            if !matches.isEmpty {
+                var rebuilt = ""
+                var last = 0
+                for m in matches {
+                    rebuilt += ns.substring(with: NSRange(location: last, length: m.range.location - last))
+                    rebuilt += Self.redactHexDump(ns.substring(with: m.range))
+                    last = m.range.location + m.range.length
+                }
+                rebuilt += ns.substring(from: last)
+                out = rebuilt
+            }
+        }
         out = out.replacingOccurrences(
             of: "([0-9A-Fa-f]{2}):[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:([0-9A-Fa-f]{2})",
             with: "$1:••:••:••:••:$2", options: .regularExpression)
diff --git a/StrandTests/HexPayloadRedactionTests.swift b/StrandTests/HexPayloadRedactionTests.swift
new file mode 100644
index 0000000000..788ca799c2
--- /dev/null
+++ b/StrandTests/HexPayloadRedactionTests.swift
@@ -0,0 +1,84 @@
+import XCTest
+@testable import Strand
+
+/// #1833: a WHOOP serial that arrives as HEX rather than as text.
+///
+/// Every rule in `LiveState.redactPii` matches an identifier written as characters, so none of them can
+/// see one encoded as hex. On a 5/MG, event 109 carries the strap serial as plain ASCII inside its
+/// payload, and this side dumps hex in several places — `frame=` (the clock diagnostic), `[raw …]` and
+/// `(raw …)` (the alarm readback), and the #900 whole-frame dump. The serial went into the log we ask
+/// people to attach to public issues while the MAC rule kept firing, so the line still looked redacted.
+///
+/// Twin of the Kotlin `PiiRedactionTest` cases; the payload below is the real one from the capture on
+/// #1825, which is how the leak was found.
+final class HexPayloadRedactionTests: XCTestCase {
+
+    /// `…WBB5AP0539852…` — a real serial, ASCII inside the payload bytes.
+    private let payloadWithSerial = "142e1c0001d36e3d1c12a3574242354150303533393835320000"
+    private let serialAsHex = "4242354150303533393835"
+
+    func testSerialInsideAHexPayloadIsMasked() {
+        let out = LiveState.redactPii("[event] 0x6D(109) payload=\(payloadWithSerial)")
+        XCTAssertFalse(out.contains(serialAsHex), "serial must not survive as hex: \(out)")
+        XCTAssertTrue(out.contains("142e1c0001d36e3d1c12a3"),
+                      "the non-serial bytes are the reason the dump exists: \(out)")
+    }
+
+    /// Not keyed on a label: this side writes the same dumps four different ways.
+    func testMaskedUnderEveryLabelThisSideUses() {
+        for line in ["frame=\(payloadWithSerial)",
+                     "[raw \(payloadWithSerial)]",
+                     "(raw \(payloadWithSerial))",
+                     "raw frame (#900) \(payloadWithSerial)",
+                     payloadWithSerial] {
+            XCTAssertFalse(LiveState.redactPii(line).contains(serialAsHex),
+                           "serial survived under this label: \(line)")
+        }
+    }
+
+    /// The run regex matches consecutive hex characters, so a dump abutting other hex-valid text gives
+    /// an ODD-length match. Bailing on that returned the serial unredacted while Kotlin masked it — the
+    /// two halves of one rule must not disagree about which lines are safe.
+    func testOddLengthRunStillMasksTheSerial() {
+        let out = LiveState.redactPii("payload=\(payloadWithSerial)f")   // 1 trailing half-byte
+        XCTAssertFalse(out.contains(serialAsHex), "odd-length run left the serial exposed: \(out)")
+    }
+
+    /// The Kotlin rule is a regex over the printable projection (`[A-Za-z][0-9A-Za-z]{8,}`), so it finds
+    /// a serial ANYWHERE inside an alphanumeric run. Testing only the run's first byte left the serial
+    /// exposed when a digit preceded it with no separator — masked on Android, printed on Apple.
+    func testSerialIsMaskedEvenWhenDigitsPrecedeItInTheSameRun() {
+        // "0123" + "WBB5AP0539852" as one unbroken alphanumeric run, then a NUL to close it.
+        let hex = "3031323357424235415030353339383532" + "00" + "0000000000000000"
+        let out = LiveState.redactPii("payload=\(hex)")
+        XCTAssertFalse(out.contains(serialAsHex), "digit-prefixed run left the serial exposed: \(out)")
+        XCTAssertTrue(out.contains("30313233"), "the non-serial digits must survive: \(out)")
+    }
+
+    func testPayloadWithNoAsciiRunIsUntouched() {
+        // The charging payloads from the same capture carry no ASCII run — they must pass through whole.
+        for p in ["707d0000707d0000", "b87e0000b87e0000", "0000000000000000"] {
+            XCTAssertEqual(LiveState.redactPii("payload=\(p)"), "payload=\(p)")
+        }
+    }
+
+    /// The existing text rules must keep working — the hex pass runs first and must not eat them.
+    func testTextRulesStillApply() {
+        XCTAssertEqual(LiveState.redactPii("connecting to A1:B2:C3:D4:E5:F6"),
+                       "connecting to A1:••:••:••:••:F6")
+        XCTAssertTrue(LiveState.redactPii("Discovered WHOOP 4A2B9C1D").contains("<serial>"))
+    }
+
+    /// A vendor/service UUID's longest contiguous hex run is 12 characters, below the 16 the rule needs,
+    /// so a UUID cannot be partially masked into something unreadable.
+    func testServiceUuidIsNotTouched() {
+        let uuid = "61080003-8d6d-82b8-614a-1c8cb0f8dcc6"
+        XCTAssertTrue(LiveState.redactPii("Notify active \(uuid)").contains("8d6d"))
+    }
+
+    /// Odd-length or non-hex content returns unchanged rather than throwing: a redactor that throws
+    /// withholds the entire line.
+    func testMalformedHexIsLeftAlone() {
+        XCTAssertEqual(LiveState.redactPii("payload=zzzzzzzzzzzzzzzzzz"), "payload=zzzzzzzzzzzzzzzzzz")
+    }
+}

From ddb5a2dd9b090bc6d6552a8d70a22c873d17d23a Mon Sep 17 00:00:00 2001
From: Zebsi <66969936+Zebsi235@users.noreply.github.com>
Date: Thu, 3 Sep 2026 02:55:52 +0200
Subject: [PATCH 188/333] test centre: log every pushed strap EVENT under the
 Connection domain (#1825)

From @Zebsi235.

Nothing logged event names, so a strap log could not answer whether a strap emits a given event -
the absence of a line was never evidence, because no line was written for ANY event. That blind spot
is how "a WHOOP MG never emits CHARGING_ON" survived as a belief; it trails BATTERY_PACK_CONNECTED
by about 17 seconds, long enough for one capture cycle to miss it.

While Test Centre > Connection is armed, each pushed EVENT now logs the name as rendered (so an
uncatalogued event appears as 0x6D(109) rather than vanishing), whether the frame is a replayed
offload record, and the 5/MG payload hex. Read-only, and the domain gate is read before the string is
built, so it costs one boolean when off.

Carries the redaction that dump made necessary: on a 5/MG, event 109 holds the strap serial as plain
ASCII inside its payload, and the existing rules match identifiers written as TEXT - they cannot see
one encoded as hex. Any long hex run is now decoded and only serial-shaped ASCII bytes are masked,
keyed on the hex itself rather than a label, since the same dumps are written as payload=, frame=,
[raw ...] and with no label at all. Tracked on #1833; the Apple twin is already on main.
---
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 57 ++++++++++++++++++-
 .../java/com/noop/ble/PiiRedactionTest.kt     | 40 +++++++++++++
 2 files changed, 96 insertions(+), 1 deletion(-)

diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index c39b10977f..44c849a79f 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -7349,6 +7349,19 @@ class WhoopBleClient(
 
             "EVENT" -> {
                 (parsed.parsed["event"] as? String)?.let { ev ->
+                    // Test-Centre-gated census of EVERY event the strap pushes. Nothing logs event names
+                    // today, so a strap log cannot answer "does this strap emit CHARGING_ON?" or
+                    // "does it emit BATTERY_PACK_CONNECTED?" — the absence of a line proves nothing,
+                    // because no line was ever written. That blind spot is what made the charging-pill
+                    // bug and the cmd-151 dead end hard to reason about. Logs the name, whether the frame
+                    // is a replayed offload record (so a historical event is never mistaken for a live
+                    // one), and the 5/MG opaque payload hex — which is where a pack charge would live if
+                    // any event carries one. Read-only; sends nothing and decodes nothing into state.
+                    if (testCentre.active(com.noop.testcentre.TestDomain.CONNECTION)) {
+                        val payHex = parsed.parsed["event_payload_hex"] as? String
+                        log("[event] $ev${if (replayedOffload) " (replayed offload)" else ""}" +
+                            (payHex?.let { " payload=$it" } ?: ""))
+                    }
                     // Event strings are "NAME(rawValue)", e.g. "WRIST_ON(9)" (see Schema.enumName).
                     // Pure [isGestureEvent] so the gesture-vs-non-gesture routing is unit-testable (PR #577).
                     val isGesture = isGestureEvent(ev)
@@ -10969,12 +10982,54 @@ internal fun alarmReadbackLocalTime(epochSec: Long): String =
     java.text.SimpleDateFormat("EEE HH:mm zzz", java.util.Locale.US)
         .format(java.util.Date(epochSec * 1000L))
 
+/**
+ * #1833: a serial hidden inside a HEX payload. The text rules below scrub a serial that is written as
+ * text; they cannot see one that arrives as `payload=…5742423541503035…`, because the redactor is
+ * looking at hex digits, not at the ASCII those bytes decode to. Event 109 on a 5/MG carries the strap
+ * serial in plain ASCII inside its payload, so a hex dump of it walks straight past every rule here —
+ * into the log a reporter pastes into a public issue.
+ *
+ * Decode ANY long hex run, find printable ASCII stretches inside it, and if one looks like a WHOOP
+ * serial, mask THOSE BYTES back in the hex. Everything else survives untouched, which is the point: the
+ * payload is exactly where an undocumented field would be found, so blanket-truncating it would remove
+ * the reason the dump exists.
+ *
+ * Deliberately NOT keyed on `payload=` / `frame=`. Both platforms label hex differently and
+ * inconsistently — `payload=`, `frame=`, `[raw …]`, `(raw …)`, the #900 whole-frame dump — and a rule
+ * that enumerates today's labels is a rule the next diagnostic slips past. Matching the hex itself
+ * needs no maintenance. The false-positive cost is negligible: masking requires nine consecutive
+ * alphanumeric ASCII bytes, which random binary produces about once in a million runs.
+ */
+private val PII_HEX_DUMP_RE = Regex("[0-9a-fA-F]{16,}")
+/** A WHOOP serial as it appears in a payload: a leading letter then 8+ alphanumerics (e.g. WBB5AP0539852). */
+private val PII_SERIAL_IN_ASCII_RE = Regex("[A-Za-z][0-9A-Za-z]{8,}")
+
+internal fun redactHexDumpPii(hex: String): String {
+    val bytes = ArrayList<Int>(hex.length / 2)
+    var i = 0
+    while (i + 1 < hex.length) {
+        bytes.add(hex.substring(i, i + 2).toIntOrNull(16) ?: return hex)
+        i += 2
+    }
+    val ascii = StringBuilder(bytes.size)
+    for (b in bytes) ascii.append(if (b in 32..126) b.toChar() else '.')
+    var out = hex
+    for (m in PII_SERIAL_IN_ASCII_RE.findAll(ascii.toString())) {
+        // Two hex chars per byte: mask exactly the run's bytes, leaving the rest of the dump intact.
+        val start = m.range.first * 2
+        val end = (m.range.last + 1) * 2
+        out = out.substring(0, start) + "••".repeat(m.value.length) + out.substring(end)
+    }
+    return out
+}
+
 /** Mask MAC addresses and WHOOP serials in a strap-log line before it's shown/exported.
  *  TOTAL — never throws: a redaction failure returns a safe placeholder rather than leaking the raw
  *  line or crashing the caller (#453). The MAC regex captures exactly two groups (first + last octet),
  *  so the replacement references $1/$2 only. */
 internal fun redactStrapLogPii(s: String): String = try {
-    s.replace(PII_MAC_RE, "$1:••:••:••:••:$2")
+    s.replace(PII_HEX_DUMP_RE) { m -> redactHexDumpPii(m.value) }
+        .replace(PII_MAC_RE, "$1:••:••:••:••:$2")
         .replace(PII_WHOOP_SERIAL_RE, "WHOOP <serial>")
         // MAC first, deliberately: `whoop-<MAC>` is already `whoop-FD:••…` by now and cannot be mistaken
         // for an adopted id. The -noop form runs before the general one so the sibling suffix survives.
diff --git a/android/app/src/test/java/com/noop/ble/PiiRedactionTest.kt b/android/app/src/test/java/com/noop/ble/PiiRedactionTest.kt
index 05a1c5dd64..f8bcec3db8 100644
--- a/android/app/src/test/java/com/noop/ble/PiiRedactionTest.kt
+++ b/android/app/src/test/java/com/noop/ble/PiiRedactionTest.kt
@@ -16,6 +16,46 @@ import org.junit.Test
  */
 class PiiRedactionTest {
 
+    /**
+     * #1833: the serial that arrives as HEX. The event census (#1825) dumps `payload=<hex>` for every
+     * pushed event, and event 109 on a 5/MG carries the strap serial as plain ASCII inside that payload.
+     * The text rules cannot see it — they are reading hex digits — so it walked past every one of them
+     * into the log people paste into public issues. This is the exact payload from that PR's own sample.
+     */
+    @Test fun masksAWhoopSerialHiddenInsideAHexPayload() {
+        val line = "[event] 0x6D(109) payload=142e1c0001d36e3d1c12a3574242354150303533393835320000"
+        val out = redactStrapLogPii(line)
+        // "WBB5AP0539852" as hex is 5742423541503035333938353 2 — none of it may survive.
+        assertFalse("serial must not survive as hex: $out", out.contains("4242354150303533393835"))
+        assertTrue("the dump must still be recognisable", out.startsWith("[event] 0x6D(109) payload="))
+        // The non-serial bytes are the reason the dump exists — they must be untouched.
+        assertTrue("leading bytes must survive: $out", out.contains("142e1c0001d36e3d1c12a3"))
+    }
+
+    /** The rule is deliberately not keyed on `payload=`: Apple labels the same dumps `[raw …]` and the
+     *  #900 whole-frame dump has no label at all. A serial must not survive by arriving under a
+     *  different word. */
+    @Test fun masksASerialUnderAnyLabelIncludingNone() {
+        val hex = "142e1c0001d36e3d1c12a3574242354150303533393835320000"
+        for (line in listOf("[raw $hex]", "(raw $hex)", "raw frame (#900) $hex", hex)) {
+            val out = redactStrapLogPii(line)
+            assertFalse("serial survived under this label: $out", out.contains("4242354150303533393835"))
+        }
+    }
+
+    @Test fun leavesAHexPayloadWithNoSerialAlone() {
+        // The charging payloads from the same capture carry no ASCII run — they must pass through whole.
+        for (p in listOf("707d0000", "b87e0000", "00000000")) {
+            assertEquals("payload=$p", redactStrapLogPii("payload=$p"))
+        }
+    }
+
+    /** Odd-length or non-hex content must return unchanged rather than throwing — redaction failing
+     *  open would withhold the whole line ("[redaction error - line withheld]"). */
+    @Test fun malformedHexIsLeftAloneRatherThanThrowing() {
+        assertEquals("payload=zzzzzzzzz", redactStrapLogPii("payload=zzzzzzzzz"))
+    }
+
     @Test fun masksMacKeepingFirstAndLastOctet() {
         // The exact line that triggered #421 (a generic-HR strap's address being logged).
         val out = redactStrapLogPii("HR-strap: connecting to A1:B2:C3:D4:E5:F6")

From 21fb7123eff7da22c06b9f68ade72a4c4b8aa238 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 12:59:20 +1200
Subject: [PATCH 189/333] Bump to 11.1.1 for a testing build

versionName/MARKETING_VERSION 11.1.0 -> 11.1.1, versionCode 418 -> 419,
CURRENT_PROJECT_VERSION 299 -> 300. 418 was the 11.1.0 RELEASE, so 419 clears
that high-water and the testing build can install over it.

Carries everything merged since the release, none of which has reached a
user yet:

- the clock perf regression from #1822, where ~13 one-time DateFormatters
  became computed properties running an ICU pattern build and a Bundle
  lookup per access (#1830)
- pack-attach events lighting the charging pill on a 5/MG, both platforms
  (#1826, #1831)
- the Test Centre event census (#1825)
- redaction for a strap serial that arrives as HEX inside a payload dump,
  both platforms (#1833). 11.1.0 can still print one through the alarm
  readback or the clock frame= dump, so this build is the first where
  "send me a strap log" is safe to ask again

The 11.1.0 startup report is NOT known to be addressed by any of this. The
clock fix is a real regression but was never established as its cause, and
this build changes nothing about that question - it just stops shipping the
regression.
---
 android/app/build.gradle.kts | 4 ++--
 project.yml                  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 37ab465434..8989caf0b8 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,8 +26,8 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 418
-        versionName = "11.1.0"
+        versionCode = 419
+        versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
         vectorDrawables {
diff --git a/project.yml b/project.yml
index 55a47ac797..3c138fb57d 100644
--- a/project.yml
+++ b/project.yml
@@ -17,11 +17,11 @@ configFiles:
   Release: Config/BundleId.xcconfig
 settings:
   base:
-    MARKETING_VERSION: "11.1.0"
+    MARKETING_VERSION: "11.1.1"
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "299"
+    CURRENT_PROJECT_VERSION: "300"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 60e5d41f889c0be26ab7c50c47229efb5baa62f4 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 13:47:59 +1200
Subject: [PATCH 190/333] docs(ios): the AltServer sign-in failure is an
 upstream bug, not your network
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Correcting the note added in 7ff64d6e1. It led with "a DNS filter, content
blocker or VPN" as the most common cause, which sent readers to disable
things that were never the problem and put the fault on their setup.

A second user hit the identical error within hours, on a different machine.
Two independent people with network filtering on the same night is a stretch,
and that repeat is what prompted actually checking: it is reported upstream
in altstoreio/AltStore#1695 and #1699, on macOS Tahoe 26.2 with iOS/iPadOS
26.2, open since January 2026 with no maintainer fix or workaround.

The mechanism described was right — AltServer receives HTML where it expects
a plist — but the ranking of causes was backwards, which is the part a reader
acts on.

Now leads with the upstream bug and links both issues, and gives the answer
that actually works today: SideStore, which does not use AltServer's sign-in
path and takes the same source URL with the same auto-updates. Local
filtering is kept as a footnote because it CAN produce an identical error,
but it is named as the uncommon case rather than the first thing to blame.
---
 docs/IOS.md | 37 +++++++++++++++++++++----------------
 1 file changed, 21 insertions(+), 16 deletions(-)

diff --git a/docs/IOS.md b/docs/IOS.md
index eda64350ec..f844872f3b 100644
--- a/docs/IOS.md
+++ b/docs/IOS.md
@@ -29,31 +29,36 @@ ID**. Nothing about this touches NOOP's identity or Apple's servers on our side.
 
 ### If AltServer can't sign in with your Apple ID
 
-A failure at **step 1** — before NOOP is involved at all — usually looks like this:
+A failure at **step 1** — before NOOP is involved at all — looks like this:
 
 > **AltServer could not sign in with your Apple ID. The data is not in the correct format.**
 >
 > `NSCocoaErrorDomain 3840` · *Encountered unknown tag html on line 1*
 
-That is the same shape as the source-URL note below: something expected **structured data** and received an
-**HTML page**. AltServer asked Apple's ID service for a property list and got a web page back, so the
-parser hit `<html>` on the first line. The "malformed data byte group / invalid hex" line underneath is
-the same failure reported by the older-style parser, not a second problem.
+**This is a known AltStore bug on OS 26.2, not a problem with your setup.** It is reported upstream in
+[altstoreio/AltStore#1695](https://github.com/altstoreio/AltStore/issues/1695) and
+[#1699](https://github.com/altstoreio/AltStore/issues/1699), on macOS Tahoe 26.2 with iOS/iPadOS 26.2, and
+at the time of writing there is no maintainer fix or workaround. Nothing you can change on your machine
+resolves it.
 
-Nothing in the response reached Apple's auth service as intended, so the usual causes are between you and
-Apple rather than in your account:
+What the error means, for the record: AltServer asked Apple's ID service for a property list and received
+an **HTML page**, so the parser hit `<html>` on the first line. The "malformed data byte group / invalid
+hex" line beneath it is the same failure reported by the older-style parser, not a second fault.
 
-- **A DNS filter, content blocker or VPN** returning a block page for Apple's auth domain. The most common
-  cause, and the easiest to miss if the filtering is network-wide rather than on the machine.
-- **An out-of-date AltServer**, calling an endpoint Apple has since moved and receiving a redirect or
-  error page.
-- **Something waiting on Apple's side** — terms to accept, a rate limit, or a locked account. All of those
-  are served as HTML.
+**What actually works today:**
 
-Worth trying in this order: sign in at [appleid.apple.com](https://appleid.apple.com) in a browser to
-clear anything pending, retry with filtering and any VPN off, then update AltServer.
+- **Use [SideStore](https://sidestore.io) instead.** It is a separate implementation that does not go
+  through AltServer's Apple ID sign-in, and NOOP's source works there identically — the same URL, the same
+  auto-updates. This is the practical answer while the upstream bug is open.
+- **Install the `.ipa` directly** with any sideloader that signs on-device, if you prefer not to add a
+  source at all.
+- **Watch the issues above** if you would rather wait for AltStore itself.
 
-This is AltStore's own setup rather than anything NOOP controls — but it is the first step of the install,
+Local network filtering — a DNS blocker, a VPN, a captive portal — can produce an identical-looking error
+by returning a block page, so it is worth ruling out if you have any. But it is **not** the usual cause,
+and the two reports that prompted this note were both the upstream bug.
+
+This is AltStore's own setup rather than anything NOOP controls, but it is the first step of the install,
 so it is written down here rather than left as a dead end.
 
 ### Add NOOP as a source (recommended — auto-updates)

From 52bf64fa9ee95906c959c00e0d27fbd7976e3b2d Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 14:45:51 +1200
Subject: [PATCH 191/333] android: optional overlay bottom bar so its glass has
 a backdrop (#1837)

Adds an overlay layout for the Android bottom bar, behind a setting that defaults to OFF.

The bar was already built to float - pill, insets, hairline, 0.80 alpha - but sat in the Scaffold's
bottomBar slot, OUTSIDE screen content. Each screen paints its own backdrop, so that backdrop stopped
where the bar began and the glass had only surfaceBase behind it. Translucency over a flat colour is a
flat colour, which is why it read as a slab against a custom background.

Settings > Appearance > Bottom bar overlay draws it as a sibling over the Scaffold instead, so it
floats on whatever the screen painted. Default off: the off-path is the shipped slot layout unchanged,
so nothing moves until someone turns it on.

Two inset bugs were found and fixed while writing it - a hardcoded height replacing a measured one,
then double-counting the navigation-bar inset - both invisible without a device. That is why it ships
switchable and should be called experimental until someone reports back.

Raised on #1836. Not blur parity: Compose has no cheap backdrop blur, and iOS looks native because it
IS - RootTabView uses SwiftUI's TabView.
---
 .../app/src/main/java/com/noop/ui/AppRoot.kt  | 95 +++++++++++++++++--
 .../src/main/java/com/noop/ui/MainActivity.kt |  5 +
 .../main/java/com/noop/ui/SettingsScreen.kt   | 10 ++
 .../app/src/main/res/values-de/strings.xml    |  1 +
 .../app/src/main/res/values-es/strings.xml    |  1 +
 .../app/src/main/res/values-fr/strings.xml    |  1 +
 .../app/src/main/res/values-pl/strings.xml    |  1 +
 .../src/main/res/values-pt-rPT/strings.xml    |  1 +
 .../app/src/main/res/values-zh/strings.xml    |  1 +
 android/app/src/main/res/values/strings.xml   |  1 +
 10 files changed, 108 insertions(+), 9 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ui/AppRoot.kt b/android/app/src/main/java/com/noop/ui/AppRoot.kt
index d0b077f9f9..291bbac999 100644
--- a/android/app/src/main/java/com/noop/ui/AppRoot.kt
+++ b/android/app/src/main/java/com/noop/ui/AppRoot.kt
@@ -1,5 +1,6 @@
 package com.noop.ui
 
+import android.content.Context
 import androidx.annotation.StringRes
 import androidx.compose.animation.core.CubicBezierEasing
 import androidx.compose.animation.core.animateFloatAsState
@@ -97,6 +98,12 @@ import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.unit.Dp
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
+import androidx.compose.ui.layout.onSizeChanged
+import androidx.compose.ui.platform.LocalDensity
+import androidx.compose.runtime.mutableIntStateOf
+import androidx.compose.foundation.layout.calculateStartPadding
+import androidx.compose.foundation.layout.calculateEndPadding
+import androidx.compose.ui.platform.LocalLayoutDirection
 import androidx.lifecycle.viewmodel.compose.viewModel
 import androidx.navigation.NavGraph.Companion.findStartDestination
 import androidx.navigation.NavHostController
@@ -269,6 +276,31 @@ internal object MoreSectionPrefs {
         raw.split(",").map { it.trim() }.filter { it.isNotEmpty() }.toSet()
 }
 
+/**
+ * #1836: which bottom-bar layout to use, snapshot-backed so the Settings toggle applies without a
+ * relaunch (the same shape as `BackgroundImageStore.enabled`).
+ *
+ * Default OFF — the shipped slot layout. The overlay is the better-looking one and the reason this change
+ * exists, but it is app-shell layout no test can judge, so it ships behind a switch people can turn off if
+ * a screen misbehaves rather than as the only option.
+ */
+object BottomBarStyleStore {
+    /** True = the overlay bar (glass over the screen's own backdrop). False = the reserved slot. */
+    var overlay by mutableStateOf(false)
+        private set
+
+    fun load(ctx: Context) {
+        overlay = NoopPrefs.of(ctx.applicationContext)
+            .getBoolean(NoopPrefs.KEY_OVERLAY_BOTTOM_BAR, false)
+    }
+
+    fun set(ctx: Context, value: Boolean) {
+        overlay = value
+        NoopPrefs.of(ctx.applicationContext).edit()
+            .putBoolean(NoopPrefs.KEY_OVERLAY_BOTTOM_BAR, value).apply()
+    }
+}
+
 /**
  * App shell: a single [Scaffold] with a floating [GlassBottomBar] (Today · Trends · Sleep · More)
  * driving one [NavHost], mirroring the iOS RootTabView. There is NO global toolbar and no nav drawer
@@ -294,7 +326,19 @@ fun AppRoot(viewModel: AppViewModel = viewModel()) {
     // survives the inbox sheet closing — the tap dismisses the inbox and presents this over the app.
     var showWhatsNewFromInbox by remember { mutableStateOf(false) }
 
-    run {
+    // #1836: an overlay container, not a bottomBar slot. The slot sat OUTSIDE the screen content, so a
+    // screen's own backdrop (LiquidScreenSky / BackgroundImageBackdrop) stopped where the bar began and
+    // the bar's 0.80 "glass" had nothing behind it but surfaceBase — a bar built to float rendered as a
+    // dark strip cut out of the background. As a sibling drawn OVER the Scaffold it sits on the screen's
+    // own sky, which is what the translucency was written for.
+    // #1836: the inset MEASURED, never assumed. The bar's height includes navigationBarsPadding(), which
+    // differs by roughly 24dp between gesture navigation and 3-button navigation, and changes on rotation
+    // and on a foldable unfolding. The Scaffold slot used to measure it for us; a constant here would put
+    // content behind the bar on exactly the devices the report came from. One extra layout pass at
+    // startup, then stable.
+    var barHeightPx by remember { mutableIntStateOf(0) }
+    val barHeight = with(LocalDensity.current) { barHeightPx.toDp() }
+    Box(Modifier.fillMaxSize()) {
         Scaffold(
             containerColor = Palette.surfaceBase,
             bottomBar = {
@@ -303,18 +347,38 @@ fun AppRoot(viewModel: AppViewModel = viewModel()) {
                 // top-right (balancing the avatar), so the bar is clean tabs only. "More" navigates to
                 // its own page (mirroring the iOS More tab) that reaches every grouped destination, so no
                 // destination is lost without the drawer.
-                GlassBottomBar(
-                    current = current,
-                    onTabSelected = { dest ->
-                        if (dest.route != currentRoute) nav.navigateTopLevel(dest.route)
-                    },
-                )
+                // DEFAULT path: the shipped reserved slot, unchanged. Empty only when the overlay is
+                // on, where the bar is drawn below as a sibling and the slot must reserve nothing.
+                if (!BottomBarStyleStore.overlay) {
+                    GlassBottomBar(
+                        current = current,
+                        onTabSelected = { dest ->
+                            if (dest.route != currentRoute) nav.navigateTopLevel(dest.route)
+                        },
+                    )
+                }
             },
         ) { inner ->
             NavHost(
                 navController = nav,
                 startDestination = Destination.Today.route,
-                modifier = Modifier.padding(inner),
+                // The empty slot reserves nothing, so the bar's height is added here — the one place the
+                // inset used to come from. A scrollable that later wants content to pass UNDER the glass
+                // adds this measured height to its own contentPadding instead; no shared modifier can.
+                // Slot layout: the Scaffold measured the bar into `inner`, so use it as-is.
+                // Overlay layout: the slot reserves nothing, so the bottom comes from the measured bar.
+                modifier = if (!BottomBarStyleStore.overlay) Modifier.padding(inner) else Modifier.padding(
+                    // Take the top and sides from the Scaffold, but REPLACE its bottom rather than adding
+                    // to it. Scaffold's default contentWindowInsets is WindowInsets.systemBars, so
+                    // `inner.bottom` already carries the navigation-bar inset — and the bar's measured
+                    // height carries it too, via its own navigationBarsPadding(). Adding both counted that
+                    // inset twice and left roughly a nav-bar's worth of dead space above the bar, widest
+                    // on 3-button navigation. The bar owns that inset; content just clears the bar.
+                    top = inner.calculateTopPadding(),
+                    start = inner.calculateStartPadding(LocalLayoutDirection.current),
+                    end = inner.calculateEndPadding(LocalLayoutDirection.current),
+                    bottom = barHeight,
+                ),
                 // README motion: top-level destinations crossfade (~240ms) on the calm,
                 // decelerating global easing — nothing slides or bounces between tabs. The
                 // same fade is used for back (pop) so the bar never feels jerky. Drill-ins
@@ -614,6 +678,18 @@ fun AppRoot(viewModel: AppViewModel = viewModel()) {
                 }
             }
         }
+
+        // Drawn OVER the Scaffold, so it floats on whatever backdrop the current screen painted rather
+        // than on the shell's own container colour. Same composable, same insets — only its parent moved.
+        if (BottomBarStyleStore.overlay) GlassBottomBar(
+            current = current,
+            onTabSelected = { dest ->
+                if (dest.route != currentRoute) nav.navigateTopLevel(dest.route)
+            },
+            modifier = Modifier
+                .align(Alignment.BottomCenter)
+                .onSizeChanged { barHeightPx = it.height },
+        )
     }
 }
 
@@ -777,10 +853,11 @@ private val barTrailingTabs = listOf(
 private fun GlassBottomBar(
     current: Destination,
     onTabSelected: (Destination) -> Unit,
+    modifier: Modifier = Modifier,
 ) {
     val barShape = RoundedCornerShape(50)
     Box(
-        modifier = Modifier
+        modifier = modifier
             .fillMaxWidth()
             // Clear the gesture-nav bar (home indicator) first, then add breathing room so the capsule
             // floats free of the bottom edge rather than jamming against it — iOS clears the home-indicator
diff --git a/android/app/src/main/java/com/noop/ui/MainActivity.kt b/android/app/src/main/java/com/noop/ui/MainActivity.kt
index 5646940cfa..27ad3eff70 100644
--- a/android/app/src/main/java/com/noop/ui/MainActivity.kt
+++ b/android/app/src/main/java/com/noop/ui/MainActivity.kt
@@ -146,6 +146,7 @@ class MainActivity : ComponentActivity() {
         // Decode the optional custom background image (if set) + its toggles before first composition so
         // the backdrop is right from the first frame on every tab. No-op when no image is set.
         BackgroundImageStore.load(this)
+        BottomBarStyleStore.load(this)   // #1836: bottom-bar layout choice, default the shipped slot
 
         setContent {
             NoopTheme {
@@ -700,6 +701,10 @@ object NoopPrefs {
         of(context).edit().putBoolean(KEY_APP_ICON_NAVY, navy).apply()
     }
 
+    /** #1836: draw the bottom bar as an overlay (glass over the screen's backdrop) instead of a reserved
+     *  Scaffold slot. Default false — the shipped layout — until the overlay has been seen on a device. */
+    const val KEY_OVERLAY_BOTTOM_BAR = "noop.overlayBottomBar"
+
     /** #1821: Clock format ("system" / "twelveHour" / "twentyFourHour"). Shares its stored vocabulary
      *  with the Apple @AppStorage binding via [com.noop.analytics.ClockFormatPreference]. */
     const val KEY_CLOCK_FORMAT = com.noop.analytics.ClockFormatPreference.PREFS_KEY
diff --git a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
index 6ec41d7951..2bc6e21df0 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
@@ -1308,6 +1308,16 @@ fun SettingsScreen(
                 )
             }
             SettingsRowDivider()
+            // #1836: which bottom-bar layout to draw. Default OFF — the shipped reserved slot. The
+            // overlay lets a screen's own backdrop show through the bar's glass, which is what it was
+            // built for, but it is app-shell layout no test can judge, so it ships switchable.
+            SettingsFormRow(label = uiString(R.string.l10n_settings_screen_bottom_bar_overlay_f257c96f)) {
+                Switch(
+                    checked = BottomBarStyleStore.overlay,
+                    onCheckedChange = { BottomBarStyleStore.set(context, it) },
+                )
+            }
+            SettingsRowDivider()
             // #1821: Clock format. Sits with Language because it is an app-owned display CONVENTION, and
             // like Language it offers "System default" - which here means the device's own 12/24h switch,
             // not the region default that was silently deciding this for everyone. Twin of the Apple row.
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 58f8ddaadc..7b370ef26c 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -810,6 +810,7 @@
     <string name="l10n_settings_screen_12_hour_41c18ba0">12 Stunden</string>
     <string name="l10n_settings_screen_24_hour_18e86819">24 Stunden</string>
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">AdvancedChevron</string>
+    <string name="l10n_settings_screen_bottom_bar_overlay_f257c96f">Overlay der unteren Leiste</string>
     <string name="l10n_settings_screen_clock_04f6b3ea">Uhr</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index def4ba0474..7fc45efd3c 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -610,6 +610,7 @@
     <string name="l10n_settings_screen_12_hour_41c18ba0">12 horas</string>
     <string name="l10n_settings_screen_24_hour_18e86819">24 horas</string>
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">avanzadoChevron</string>
+    <string name="l10n_settings_screen_bottom_bar_overlay_f257c96f">Superposición de la barra inferior</string>
     <string name="l10n_settings_screen_clock_04f6b3ea">Reloj</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 532dbf0891..5044897f5b 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -628,6 +628,7 @@
     <string name="l10n_settings_screen_12_hour_41c18ba0">12 heures</string>
     <string name="l10n_settings_screen_24_hour_18e86819">24 heures</string>
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">avancéChevron</string>
+    <string name="l10n_settings_screen_bottom_bar_overlay_f257c96f">Barre inférieure en surimpression</string>
     <string name="l10n_settings_screen_clock_04f6b3ea">Horloge</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 20687e1f7a..96944e68c6 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -767,6 +767,7 @@
     <string name="l10n_settings_screen_12_hour_41c18ba0">12-godzinny</string>
     <string name="l10n_settings_screen_24_hour_18e86819">24-godzinny</string>
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">zaawansowanyChevron</string>
+    <string name="l10n_settings_screen_bottom_bar_overlay_f257c96f">Nakładkowy pasek dolny</string>
     <string name="l10n_settings_screen_clock_04f6b3ea">Zegar</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index bcde97d715..6329f192d5 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -775,6 +775,7 @@
     <string name="l10n_settings_screen_12_hour_41c18ba0">12 horas</string>
     <string name="l10n_settings_screen_24_hour_18e86819">24 horas</string>
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">avançadoChevron</string>
+    <string name="l10n_settings_screen_bottom_bar_overlay_f257c96f">Sobreposição da barra inferior</string>
     <string name="l10n_settings_screen_clock_04f6b3ea">Relógio</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 6f0a29da72..38f7a8167d 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -757,6 +757,7 @@
     <string name="l10n_settings_screen_12_hour_41c18ba0">12 小时制</string>
     <string name="l10n_settings_screen_24_hour_18e86819">24 小时制</string>
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">高级选项</string>
+    <string name="l10n_settings_screen_bottom_bar_overlay_f257c96f">底部栏叠加显示</string>
     <string name="l10n_settings_screen_clock_04f6b3ea">时钟</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index c6d84ee420..de367b6398 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -895,6 +895,7 @@
     <string name="l10n_settings_screen_12_hour_41c18ba0">12-hour</string>
     <string name="l10n_settings_screen_24_hour_18e86819">24-hour</string>
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">advancedChevron</string>
+    <string name="l10n_settings_screen_bottom_bar_overlay_f257c96f">Bottom bar overlay</string>
     <string name="l10n_settings_screen_clock_04f6b3ea">Clock</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>

From 42367d4677b081fa73f21e9796e2544a44c133a7 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 14:46:08 +1200
Subject: [PATCH 192/333] Bump build to 420 for a testing build

versionCode 419 -> 420, CURRENT_PROJECT_VERSION 300 -> 301. versionName and MARKETING_VERSION stay
at 11.1.1 - a testing build, not a version bump.

Adds the optional overlay bottom bar (#1837) on top of what 419 carried. It is OFF by default, so
this build looks identical until Settings > Appearance > Bottom bar overlay is turned on - which is
the point of cutting it: the switch makes an unverified layout reachable without a special build.

Still open on this build: the 11.1.0 startup report remains undiagnosed, and the overlay bar has
never been seen on a device.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 8989caf0b8..dd53c428c3 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 419
+        versionCode = 420
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 3c138fb57d..61d415c0d9 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "300"
+    CURRENT_PROJECT_VERSION: "301"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 0839ca96fb1f7d1dd7e5bb57099eea18bd2f55c2 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 15:16:41 +1200
Subject: [PATCH 193/333] android: make the overlay bar actually overlay
 something (#1838)

#1837 shipped a toggle that changed nothing on screen. Moving the bar out of the Scaffold slot was
not enough on its own: a screen's backdrop is painted INSIDE the screen, and the overlay path still
inset the NavHost by the bar height, so the screen and its backdrop stopped exactly where they had
before. The bar floated over a strip of the shell's container colour - identical layout, and a dark
band where the background should have continued.

The screen now reaches the bottom edge so its full-bleed backdrop paints behind and around the glass,
and ScreenScaffold adds the bar's height to the scrolling CONTENT's bottom padding instead. That
padding sits inside the scroll viewport, so content passes under the bar while scrolling and the last
row still comes to rest clear of it.

One change rather than four: every top-level screen routes through ScreenScaffold. StepsCalibration
is the one NavHost destination that scrolls without it and is handled directly.

Still behind Settings > Appearance > Bottom bar overlay, default off. Raised on #1836.
---
 .../app/src/main/java/com/noop/ui/AppRoot.kt  | 33 +++++++++++++++++--
 .../src/main/java/com/noop/ui/Components.kt   | 11 ++++++-
 .../com/noop/ui/StepsCalibrationScreen.kt     |  7 +++-
 3 files changed, 46 insertions(+), 5 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ui/AppRoot.kt b/android/app/src/main/java/com/noop/ui/AppRoot.kt
index 291bbac999..f40a4bb073 100644
--- a/android/app/src/main/java/com/noop/ui/AppRoot.kt
+++ b/android/app/src/main/java/com/noop/ui/AppRoot.kt
@@ -289,6 +289,25 @@ object BottomBarStyleStore {
     var overlay by mutableStateOf(false)
         private set
 
+    /**
+     * The bar's MEASURED height, published so [ScreenScaffold] can clear it.
+     *
+     * This is the half that makes the overlay actually do something. Moving the bar out of the slot is not
+     * enough on its own: a screen's backdrop is painted INSIDE the screen, so while the screen is inset
+     * above the bar the backdrop stops there too and the glass has nothing behind it but the shell's
+     * container colour. The screen has to reach the bottom edge, with its scrolling CONTENT clearing the
+     * bar instead — which is what this height is for.
+     */
+    var barHeight by mutableStateOf(0.dp)
+        internal set
+
+    /**
+     * The inset a screen's CONTENT should add, which is the bar height only while the overlay is on.
+     * A single accessor so callers cannot forget the `overlay` half and inset content in the slot
+     * layout, where the Scaffold has already reserved that space.
+     */
+    fun barHeightForContent(): Dp = if (overlay) barHeight else 0.dp
+
     fun load(ctx: Context) {
         overlay = NoopPrefs.of(ctx.applicationContext)
             .getBoolean(NoopPrefs.KEY_OVERLAY_BOTTOM_BAR, false)
@@ -337,7 +356,8 @@ fun AppRoot(viewModel: AppViewModel = viewModel()) {
     // content behind the bar on exactly the devices the report came from. One extra layout pass at
     // startup, then stable.
     var barHeightPx by remember { mutableIntStateOf(0) }
-    val barHeight = with(LocalDensity.current) { barHeightPx.toDp() }
+    val density = LocalDensity.current
+    val barHeight = with(density) { barHeightPx.toDp() }
     Box(Modifier.fillMaxSize()) {
         Scaffold(
             containerColor = Palette.surfaceBase,
@@ -377,7 +397,11 @@ fun AppRoot(viewModel: AppViewModel = viewModel()) {
                     top = inner.calculateTopPadding(),
                     start = inner.calculateStartPadding(LocalLayoutDirection.current),
                     end = inner.calculateEndPadding(LocalLayoutDirection.current),
-                    bottom = barHeight,
+                    // Bottom is ZERO on purpose: the screen must reach the bottom edge so its own backdrop
+                    // paints behind the glass. ScreenScaffold clears the bar from the scrolling CONTENT
+                    // instead, using BottomBarStyleStore.barHeight. Insetting here is what made the first
+                    // version of this change invisible — the bar moved, the backdrop did not follow.
+                    bottom = 0.dp,
                 ),
                 // README motion: top-level destinations crossfade (~240ms) on the calm,
                 // decelerating global easing — nothing slides or bounces between tabs. The
@@ -688,7 +712,10 @@ fun AppRoot(viewModel: AppViewModel = viewModel()) {
             },
             modifier = Modifier
                 .align(Alignment.BottomCenter)
-                .onSizeChanged { barHeightPx = it.height },
+                .onSizeChanged {
+                    barHeightPx = it.height
+                    BottomBarStyleStore.barHeight = with(density) { it.height.toDp() }
+                },
         )
     }
 }
diff --git a/android/app/src/main/java/com/noop/ui/Components.kt b/android/app/src/main/java/com/noop/ui/Components.kt
index a32227395e..02afefea56 100644
--- a/android/app/src/main/java/com/noop/ui/Components.kt
+++ b/android/app/src/main/java/com/noop/ui/Components.kt
@@ -1209,7 +1209,16 @@ fun ScreenScaffold(
         Column(
             modifier = columnModifier
                 .verticalScroll(rememberScrollState())
-                .padding(start = 28.dp, end = 28.dp, top = topPadding, bottom = 28.dp),
+                // #1836: the bar's height is added to the CONTENT's bottom padding, not to the screen's
+                // layout. That distinction is the whole overlay: the screen reaches the bottom edge so its
+                // backdrop paints behind and around the glass, while the scrolling content still stops
+                // clear of the bar. Zero when the overlay is off, so the slot layout is untouched.
+                .padding(
+                    start = 28.dp,
+                    end = 28.dp,
+                    top = topPadding,
+                    bottom = 28.dp + BottomBarStyleStore.barHeightForContent(),
+                ),
             // #765: one shared inter-card spacing token (was a bare `20.dp`), so the eager + lazy scaffolds
             // and every screen through them keep the SAME uniform gap between top-level cards.
             verticalArrangement = Arrangement.spacedBy(Metrics.screenRowSpacing),
diff --git a/android/app/src/main/java/com/noop/ui/StepsCalibrationScreen.kt b/android/app/src/main/java/com/noop/ui/StepsCalibrationScreen.kt
index ee7f55d45b..2519eb994c 100644
--- a/android/app/src/main/java/com/noop/ui/StepsCalibrationScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/StepsCalibrationScreen.kt
@@ -157,7 +157,12 @@ fun StepsCalibrationScreen(
                     .weight(1f)
                     .fillMaxWidth()
                     .verticalScroll(scroll)
-                    .padding(20.dp),
+                    // #1836: this is a NavHost destination that scrolls WITHOUT ScreenScaffold, so it does
+                    // not inherit the scaffold's bar clearance. In the overlay layout the screen reaches the
+                    // bottom edge, so without this the last rows sit behind the bar. Zero when the overlay
+                    // is off. Any future destination that scrolls outside ScreenScaffold needs the same.
+                    .padding(20.dp)
+                    .padding(bottom = BottomBarStyleStore.barHeightForContent()),
                 verticalArrangement = Arrangement.spacedBy(Metrics.sectionGap),
             ) {
                 ExplainerCard()

From 936902d30c6cf89de0849054f043b99d280da715 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 15:16:49 +1200
Subject: [PATCH 194/333] Bump build to 421 for a testing build

versionCode 420 -> 421, CURRENT_PROJECT_VERSION 301 -> 302. Version stays 11.1.1.

421 is the first build where the overlay bottom bar does anything. In 420 the toggle was inert - the
bar moved out of the Scaffold slot but the screen was still inset above it, so the backdrop stopped
where it always had. #1838 lets the screen reach the bottom edge and clears the bar from the scrolling
content instead.

Settings > Appearance > Bottom bar overlay, still default OFF. With it on, the background should
continue around and behind the bar and content should pass beneath the glass while scrolling.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index dd53c428c3..e18d229dac 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 420
+        versionCode = 421
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 61d415c0d9..39edb7cde9 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "301"
+    CURRENT_PROJECT_VERSION: "302"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 8fd764e8c167aa1e3d153f115161256d42b11b77 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 15:57:21 +1200
Subject: [PATCH 195/333] android: hide the bottom bar while scrolling down
 (#1840)

Settings > Appearance > Hide bar when scrolling. Default off, and unavailable unless the overlay bar
is on - in the slot layout the Scaffold has reserved the bar's space, so hiding it would leave an
empty band rather than give the space back.

One NestedScrollConnection on the shell, so every screen inherits the behaviour with no per-screen
wiring. The bar moves by graphicsLayer only - GPU, no relayout - and the animating float is read
inside the layer block rather than in composition, so the shell is not recomposed sixty times a
second while the bar moves. Presence is a derivedStateOf, so the bar leaves the tree once hidden and
cannot be focused by TalkBack or catch a tap it should not.

Reduce Motion keeps the bar visible rather than snapping it away, and the toggle greys out to say so
instead of accepting a tap it cannot act on. A route change resets it, so a screen never opens with
its navigation hidden.

The shape is from the #90 prototype - one connection, transform-only, decision in tested plain
functions. Raised on #1839.
---
 .../app/src/main/java/com/noop/ui/AppRoot.kt  | 100 +++++++++++++++++-
 .../src/main/java/com/noop/ui/MainActivity.kt |   4 +
 .../main/java/com/noop/ui/SettingsScreen.kt   |  16 +++
 .../app/src/main/res/values-de/strings.xml    |   1 +
 .../app/src/main/res/values-es/strings.xml    |   1 +
 .../app/src/main/res/values-fr/strings.xml    |   1 +
 .../app/src/main/res/values-pl/strings.xml    |   1 +
 .../src/main/res/values-pt-rPT/strings.xml    |   1 +
 .../app/src/main/res/values-zh/strings.xml    |   1 +
 android/app/src/main/res/values/strings.xml   |   1 +
 .../java/com/noop/ui/BottomBarAutoHideTest.kt |  51 +++++++++
 11 files changed, 176 insertions(+), 2 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ui/BottomBarAutoHideTest.kt

diff --git a/android/app/src/main/java/com/noop/ui/AppRoot.kt b/android/app/src/main/java/com/noop/ui/AppRoot.kt
index f40a4bb073..7d42308256 100644
--- a/android/app/src/main/java/com/noop/ui/AppRoot.kt
+++ b/android/app/src/main/java/com/noop/ui/AppRoot.kt
@@ -101,9 +101,14 @@ import androidx.compose.ui.unit.sp
 import androidx.compose.ui.layout.onSizeChanged
 import androidx.compose.ui.platform.LocalDensity
 import androidx.compose.runtime.mutableIntStateOf
+import androidx.compose.runtime.derivedStateOf
 import androidx.compose.foundation.layout.calculateStartPadding
 import androidx.compose.foundation.layout.calculateEndPadding
 import androidx.compose.ui.platform.LocalLayoutDirection
+import androidx.compose.ui.graphics.graphicsLayer
+import androidx.compose.ui.input.nestedscroll.NestedScrollConnection
+import androidx.compose.ui.input.nestedscroll.NestedScrollSource
+import androidx.compose.ui.input.nestedscroll.nestedScroll
 import androidx.lifecycle.viewmodel.compose.viewModel
 import androidx.navigation.NavGraph.Companion.findStartDestination
 import androidx.navigation.NavHostController
@@ -276,6 +281,41 @@ internal object MoreSectionPrefs {
         raw.split(",").map { it.trim() }.filter { it.isNotEmpty() }.toSet()
 }
 
+/**
+ * #1839: should the overlay bar be hidden right now?
+ *
+ * Pure so the decision is testable without Compose — the separation the #90 prototype got right.
+ *
+ * Gated on [overlay] deliberately. In the slot layout the Scaffold has RESERVED the bar's space, so
+ * translating the bar away would leave an empty band rather than handing the space back to content —
+ * visibly worse than not hiding at all. Auto-hide only makes sense over content.
+ */
+internal fun shouldHideBar(autoHide: Boolean, overlay: Boolean, scrollingDown: Boolean): Boolean =
+    autoHide && overlay && scrollingDown
+
+/**
+ * #1839: does this scroll delta change the direction, or is it noise?
+ *
+ * Returns true for "scrolling down into the page", false for up, and null when the movement is under
+ * [threshold] and should be ignored — without that, a fingertip tremor flickers the bar continuously.
+ * A NEGATIVE delta means content moved up, which is the user scrolling down.
+ */
+internal fun scrollDirectionChange(delta: Float, threshold: Float): Boolean? = when {
+    delta <= -threshold -> true
+    delta >= threshold -> false
+    else -> null
+}
+
+/**
+ * #1839: the 0..1 collapse fraction the bar's transform rides.
+ *
+ * Reduce Motion pins it to 0 — VISIBLE — rather than snapping between hidden and shown. A bar that
+ * teleports away without animation reads as a glitch, and someone who has asked for less motion is the
+ * last person who should get that. #90 snapped to 0/1 instead; keeping the bar put is the kinder reading.
+ */
+internal fun barCollapseFraction(hidden: Boolean, reduceMotion: Boolean): Float =
+    if (reduceMotion) 0f else if (hidden) 1f else 0f
+
 /**
  * #1836: which bottom-bar layout to use, snapshot-backed so the Settings toggle applies without a
  * relaunch (the same shape as `BackgroundImageStore.enabled`).
@@ -308,9 +348,21 @@ object BottomBarStyleStore {
      */
     fun barHeightForContent(): Dp = if (overlay) barHeight else 0.dp
 
+    /** #1839: hide the overlay bar while scrolling down, bring it back on scrolling up. Default off. */
+    var autoHide by mutableStateOf(false)
+        private set
+
+    fun setAutoHide(ctx: Context, value: Boolean) {
+        autoHide = value
+        NoopPrefs.of(ctx.applicationContext).edit()
+            .putBoolean(NoopPrefs.KEY_BOTTOM_BAR_AUTO_HIDE, value).apply()
+    }
+
     fun load(ctx: Context) {
         overlay = NoopPrefs.of(ctx.applicationContext)
             .getBoolean(NoopPrefs.KEY_OVERLAY_BOTTOM_BAR, false)
+        autoHide = NoopPrefs.of(ctx.applicationContext)
+            .getBoolean(NoopPrefs.KEY_BOTTOM_BAR_AUTO_HIDE, false)
     }
 
     fun set(ctx: Context, value: Boolean) {
@@ -358,7 +410,40 @@ fun AppRoot(viewModel: AppViewModel = viewModel()) {
     var barHeightPx by remember { mutableIntStateOf(0) }
     val density = LocalDensity.current
     val barHeight = with(density) { barHeightPx.toDp() }
-    Box(Modifier.fillMaxSize()) {
+    // #1839: auto-hide. ONE NestedScrollConnection on the shell means every screen gets the behaviour with
+    // no per-screen wiring — scrollable children dispatch their deltas up to it. onPreScroll only flips a
+    // Boolean, and only on a movement past the threshold, so a fingertip tremor cannot flicker the bar.
+    var scrollingDown by remember { mutableStateOf(false) }
+    val reduceMotion = rememberReduceMotion()
+    val hidden = shouldHideBar(BottomBarStyleStore.autoHide, BottomBarStyleStore.overlay, scrollingDown)
+    val collapseTarget = barCollapseFraction(hidden, reduceMotion)
+    // The transform is a graphicsLayer only — GPU, per frame, NO relayout — so content never reflows as
+    // the bar comes and goes and scrolling stays smooth. (The approach #90 got right.)
+    // Held as the State, not unwrapped with `by`, ON PURPOSE. Reading a `Float` in composition would
+    // recompose this whole shell — Scaffold and NavHost included — on EVERY animation frame, which is the
+    // exact jank the graphicsLayer-only approach exists to avoid. Instead:
+    //   - the transform reads `.value` INSIDE graphicsLayer, a deferred read that updates the layer with
+    //     no recomposition at all;
+    //   - presence is a derivedStateOf, so composition is invalidated once when the bar appears or
+    //     disappears, not sixty times a second while it moves.
+    val collapseState = animateFloatAsState(
+        targetValue = collapseTarget,
+        animationSpec = tween(durationMillis = 220),
+    )
+    val barPresent by remember { derivedStateOf { collapseState.value < 1f } }
+    // Landing on a new screen with no visible way to navigate is disorienting, and the bar cannot be
+    // tapped to fix it because it is the thing that is hidden. Reset on every route change so a screen
+    // always opens with its navigation present; scrolling down again hides it as before.
+    LaunchedEffect(currentRoute) { scrollingDown = false }
+    val autoHideScroll = remember {
+        object : NestedScrollConnection {
+            override fun onPreScroll(available: Offset, source: NestedScrollSource): Offset {
+                scrollDirectionChange(available.y, threshold = 3f)?.let { scrollingDown = it }
+                return Offset.Zero
+            }
+        }
+    }
+    Box(Modifier.fillMaxSize().nestedScroll(autoHideScroll)) {
         Scaffold(
             containerColor = Palette.surfaceBase,
             bottomBar = {
@@ -705,13 +790,24 @@ fun AppRoot(viewModel: AppViewModel = viewModel()) {
 
         // Drawn OVER the Scaffold, so it floats on whatever backdrop the current screen painted rather
         // than on the shell's own container colour. Same composable, same insets — only its parent moved.
-        if (BottomBarStyleStore.overlay) GlassBottomBar(
+        // `collapse < 1f` and not just `overlay`: at alpha 0 the bar is invisible but still COMPOSED, so
+        // TalkBack could focus a bar nobody can see and a tap could land on a control that is not there.
+        // Dropping it at the end of the animation removes both. Safe precisely because it is an overlay —
+        // it reserves no space, so composing or not composing it never reflows content.
+        if (BottomBarStyleStore.overlay && barPresent) GlassBottomBar(
             current = current,
             onTabSelected = { dest ->
                 if (dest.route != currentRoute) nav.navigateTopLevel(dest.route)
             },
             modifier = Modifier
                 .align(Alignment.BottomCenter)
+                .graphicsLayer {
+                    // Slide it out past its own height so the whole capsule clears the edge, and fade so
+                    // it does not read as a bar stuck half off-screen mid-animation.
+                    val c = collapseState.value      // deferred read: layer only, no recomposition
+                    translationY = c * (barHeightPx.toFloat())
+                    alpha = 1f - c
+                }
                 .onSizeChanged {
                     barHeightPx = it.height
                     BottomBarStyleStore.barHeight = with(density) { it.height.toDp() }
diff --git a/android/app/src/main/java/com/noop/ui/MainActivity.kt b/android/app/src/main/java/com/noop/ui/MainActivity.kt
index 27ad3eff70..b6ede27695 100644
--- a/android/app/src/main/java/com/noop/ui/MainActivity.kt
+++ b/android/app/src/main/java/com/noop/ui/MainActivity.kt
@@ -701,6 +701,10 @@ object NoopPrefs {
         of(context).edit().putBoolean(KEY_APP_ICON_NAVY, navy).apply()
     }
 
+    /** #1839: hide the overlay bottom bar while scrolling down, restore it on scrolling up. Default
+     *  false. Only meaningful with the overlay layout, where the bar sits over content. */
+    const val KEY_BOTTOM_BAR_AUTO_HIDE = "noop.bottomBarAutoHide"
+
     /** #1836: draw the bottom bar as an overlay (glass over the screen's backdrop) instead of a reserved
      *  Scaffold slot. Default false — the shipped layout — until the overlay has been seen on a device. */
     const val KEY_OVERLAY_BOTTOM_BAR = "noop.overlayBottomBar"
diff --git a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
index 2bc6e21df0..e08c72f1b3 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
@@ -1318,6 +1318,22 @@ fun SettingsScreen(
                 )
             }
             SettingsRowDivider()
+            // #1839: hide the bar while scrolling down, bring it back on scrolling up. Only does anything
+            // with the overlay on, because in the slot layout the space is reserved and hiding the bar
+            // would leave an empty band — so the row is disabled rather than silently inert.
+            // Reduce Motion pins the bar visible (a bar that vanishes without animation reads as a
+            // glitch), so with it on the toggle would flip and change nothing. A switch that silently
+            // does nothing is worse than one that is plainly unavailable, so it greys out for the same
+            // reason it does without the overlay.
+            val autoHideAvailable = BottomBarStyleStore.overlay && !rememberReduceMotion()
+            SettingsFormRow(label = uiString(R.string.l10n_settings_screen_hide_bar_when_scrolling_b077d9f3)) {
+                Switch(
+                    checked = BottomBarStyleStore.autoHide,
+                    enabled = autoHideAvailable,
+                    onCheckedChange = { BottomBarStyleStore.setAutoHide(context, it) },
+                )
+            }
+            SettingsRowDivider()
             // #1821: Clock format. Sits with Language because it is an app-owned display CONVENTION, and
             // like Language it offers "System default" - which here means the device's own 12/24h switch,
             // not the region default that was silently deciding this for everyone. Twin of the Apple row.
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 7b370ef26c..7389a288cb 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -812,6 +812,7 @@
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">AdvancedChevron</string>
     <string name="l10n_settings_screen_bottom_bar_overlay_f257c96f">Overlay der unteren Leiste</string>
     <string name="l10n_settings_screen_clock_04f6b3ea">Uhr</string>
+    <string name="l10n_settings_screen_hide_bar_when_scrolling_b077d9f3">Leiste beim Scrollen ausblenden</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
     <string name="l10n_skin_temp_cards_screen_cycle_awareness_ffb94783">Zyklusbewusstsein</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 7fc45efd3c..92def5767b 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -612,6 +612,7 @@
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">avanzadoChevron</string>
     <string name="l10n_settings_screen_bottom_bar_overlay_f257c96f">Superposición de la barra inferior</string>
     <string name="l10n_settings_screen_clock_04f6b3ea">Reloj</string>
+    <string name="l10n_settings_screen_hide_bar_when_scrolling_b077d9f3">Ocultar la barra al desplazarse</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
     <string name="l10n_skin_temp_cards_screen_cycle_awareness_ffb94783">Conciencia del ciclo</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 5044897f5b..5dc979b9c9 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -630,6 +630,7 @@
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">avancéChevron</string>
     <string name="l10n_settings_screen_bottom_bar_overlay_f257c96f">Barre inférieure en surimpression</string>
     <string name="l10n_settings_screen_clock_04f6b3ea">Horloge</string>
+    <string name="l10n_settings_screen_hide_bar_when_scrolling_b077d9f3">Masquer la barre pendant le défilement</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
     <string name="l10n_skin_temp_cards_screen_cycle_awareness_ffb94783">Conscience du cycle</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 96944e68c6..3f4d5de228 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -769,6 +769,7 @@
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">zaawansowanyChevron</string>
     <string name="l10n_settings_screen_bottom_bar_overlay_f257c96f">Nakładkowy pasek dolny</string>
     <string name="l10n_settings_screen_clock_04f6b3ea">Zegar</string>
+    <string name="l10n_settings_screen_hide_bar_when_scrolling_b077d9f3">Ukryj pasek podczas przewijania</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
     <string name="l10n_skin_temp_cards_screen_cycle_awareness_ffb94783">Świadomość rowerowa</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 6329f192d5..47c0b8942d 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -777,6 +777,7 @@
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">avançadoChevron</string>
     <string name="l10n_settings_screen_bottom_bar_overlay_f257c96f">Sobreposição da barra inferior</string>
     <string name="l10n_settings_screen_clock_04f6b3ea">Relógio</string>
+    <string name="l10n_settings_screen_hide_bar_when_scrolling_b077d9f3">Ocultar a barra ao deslocar</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
     <string name="l10n_skin_temp_cards_screen_cycle_awareness_ffb94783">Consciência do ciclo</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 38f7a8167d..9413c0e090 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -759,6 +759,7 @@
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">高级选项</string>
     <string name="l10n_settings_screen_bottom_bar_overlay_f257c96f">底部栏叠加显示</string>
     <string name="l10n_settings_screen_clock_04f6b3ea">时钟</string>
+    <string name="l10n_settings_screen_hide_bar_when_scrolling_b077d9f3">滚动时隐藏底部栏</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
     <string name="l10n_skin_temp_cards_screen_cycle_awareness_ffb94783">生理周期推断</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index de367b6398..03bbfe3950 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -897,6 +897,7 @@
     <string name="l10n_settings_screen_advancedchevron_f22dfa01">advancedChevron</string>
     <string name="l10n_settings_screen_bottom_bar_overlay_f257c96f">Bottom bar overlay</string>
     <string name="l10n_settings_screen_clock_04f6b3ea">Clock</string>
+    <string name="l10n_settings_screen_hide_bar_when_scrolling_b077d9f3">Hide bar when scrolling</string>
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
     <string name="l10n_skin_temp_cards_screen_cycle_awareness_ffb94783">Cycle awareness</string>
diff --git a/android/app/src/test/java/com/noop/ui/BottomBarAutoHideTest.kt b/android/app/src/test/java/com/noop/ui/BottomBarAutoHideTest.kt
new file mode 100644
index 0000000000..42f1b6ede6
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/BottomBarAutoHideTest.kt
@@ -0,0 +1,51 @@
+package com.noop.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #1839: the auto-hide state machine, kept pure so it is testable without Compose.
+ *
+ * Design borrowed from the #90 prototype, which separated the same decision into plain functions with
+ * their own test rather than burying it in composition. That is the part of #90 worth keeping.
+ */
+class BottomBarAutoHideTest {
+
+    @Test fun hiddenOnlyWhileScrollingDownAndOnlyWhenEnabled() {
+        // The feature does nothing unless it is switched on.
+        assertFalse(shouldHideBar(autoHide = false, overlay = true, scrollingDown = true))
+        // Enabled and scrolling down: hidden.
+        assertTrue(shouldHideBar(autoHide = true, overlay = true, scrollingDown = true))
+        // Enabled but scrolling up: shown again.
+        assertFalse(shouldHideBar(autoHide = true, overlay = true, scrollingDown = false))
+    }
+
+    /**
+     * The bar can only be hidden when it OVERLAYS content. In the slot layout the Scaffold has reserved
+     * its space, so translating it away would leave an empty band rather than giving the space back —
+     * worse than not hiding at all.
+     */
+    @Test fun neverHidesInTheSlotLayout() {
+        assertFalse(shouldHideBar(autoHide = true, overlay = false, scrollingDown = true))
+        assertFalse(shouldHideBar(autoHide = true, overlay = false, scrollingDown = false))
+    }
+
+    /** A drag has to exceed the threshold before it counts, or a fingertip tremor flickers the bar. */
+    @Test fun tinyScrollsDoNotFlipTheDirection() {
+        assertEquals(null, scrollDirectionChange(delta = -0.5f, threshold = 3f))
+        assertEquals(null, scrollDirectionChange(delta = 2.9f, threshold = 3f))
+        // Content moving UP (negative delta) is the user scrolling DOWN into the page.
+        assertEquals(true, scrollDirectionChange(delta = -8f, threshold = 3f))
+        assertEquals(false, scrollDirectionChange(delta = 8f, threshold = 3f))
+    }
+
+    /** Reduce Motion keeps the bar put: a bar that vanishes without animation reads as a glitch. */
+    @Test fun reduceMotionPinsTheBarVisible() {
+        assertEquals(0f, barCollapseFraction(hidden = true, reduceMotion = true), 0f)
+        assertEquals(0f, barCollapseFraction(hidden = false, reduceMotion = true), 0f)
+        assertEquals(1f, barCollapseFraction(hidden = true, reduceMotion = false), 0f)
+        assertEquals(0f, barCollapseFraction(hidden = false, reduceMotion = false), 0f)
+    }
+}

From b7d87432656684967333619368caef3c590de1a5 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 15:57:29 +1200
Subject: [PATCH 196/333] Bump build to 422 for a testing build

versionCode 421 -> 422, CURRENT_PROJECT_VERSION 302 -> 303. Version stays 11.1.1.

Adds the auto-hiding bottom bar (#1840) on top of the overlay that 421 made real. Both are off by
default and both live in Settings > Appearance:

  Bottom bar overlay      - glass over the screen's own backdrop, content passing beneath
  Hide bar when scrolling - needs the overlay on; hides going down, returns going up

Worth judging on feel: whether 220ms is right, whether it returns quickly enough on an upward flick,
and whether it fights pull-to-sync on Today. None of that is answerable without a device.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index e18d229dac..9678718ee3 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 421
+        versionCode = 422
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 39edb7cde9..0899886ffd 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "302"
+    CURRENT_PROJECT_VERSION: "303"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From c7b629f75fe74ce414da5333108629c905843375 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 16:12:39 +1200
Subject: [PATCH 197/333] android: default the overlay bottom bar and auto-hide
 ON
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both ship enabled now. They went out switchable and default-off so they could
be tried without being imposed, and the overlay has since been confirmed on a
device.

An explicit choice survives: getBoolean(key, true) returns a stored `false`
for anyone who turned either off, so only an install that never touched the
setting picks up the new default. The switches stay, so a screen that
misbehaves is one toggle away from the reserved-slot layout.

Also corrected both pref-key docs and the store's own doc, which still said
"Default OFF" and would now have been describing the opposite of the code —
the kind of comment that outlives the behaviour it describes and misleads the
next reader.

WORTH RECORDING: auto-hide has NOT been seen on a device. The overlay was
confirmed on 421; auto-hide only shipped in 422 and is being defaulted on the
strength of the mechanism rather than of anyone watching it move. The tuning
knobs if it feels wrong are the 220ms tween, the 3px direction threshold, and
the reset-on-navigation.

Kotlin: full suite 5093/0; compile and doc-comment gate clean.
---
 .../app/src/main/java/com/noop/ui/AppRoot.kt  | 19 +++++++++++--------
 .../src/main/java/com/noop/ui/MainActivity.kt |  4 ++--
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ui/AppRoot.kt b/android/app/src/main/java/com/noop/ui/AppRoot.kt
index 7d42308256..cad437d7d2 100644
--- a/android/app/src/main/java/com/noop/ui/AppRoot.kt
+++ b/android/app/src/main/java/com/noop/ui/AppRoot.kt
@@ -320,13 +320,16 @@ internal fun barCollapseFraction(hidden: Boolean, reduceMotion: Boolean): Float
  * #1836: which bottom-bar layout to use, snapshot-backed so the Settings toggle applies without a
  * relaunch (the same shape as `BackgroundImageStore.enabled`).
  *
- * Default OFF — the shipped slot layout. The overlay is the better-looking one and the reason this change
- * exists, but it is app-shell layout no test can judge, so it ships behind a switch people can turn off if
- * a screen misbehaves rather than as the only option.
+ * Default ON as of #1841. It shipped switchable and default-off first so it could be tried without being
+ * imposed; the overlay was then confirmed on a device. The switch stays, so anyone who dislikes it — or
+ * hits a screen that misbehaves — can put the reserved-slot layout back.
+ *
+ * An explicit choice is preserved either way: `getBoolean(key, true)` returns a stored `false` for someone
+ * who turned it off, and only an install that never touched the setting picks up the new default.
  */
 object BottomBarStyleStore {
     /** True = the overlay bar (glass over the screen's own backdrop). False = the reserved slot. */
-    var overlay by mutableStateOf(false)
+    var overlay by mutableStateOf(true)
         private set
 
     /**
@@ -348,8 +351,8 @@ object BottomBarStyleStore {
      */
     fun barHeightForContent(): Dp = if (overlay) barHeight else 0.dp
 
-    /** #1839: hide the overlay bar while scrolling down, bring it back on scrolling up. Default off. */
-    var autoHide by mutableStateOf(false)
+    /** #1839: hide the overlay bar while scrolling down, bring it back on scrolling up. Default ON. */
+    var autoHide by mutableStateOf(true)
         private set
 
     fun setAutoHide(ctx: Context, value: Boolean) {
@@ -360,9 +363,9 @@ object BottomBarStyleStore {
 
     fun load(ctx: Context) {
         overlay = NoopPrefs.of(ctx.applicationContext)
-            .getBoolean(NoopPrefs.KEY_OVERLAY_BOTTOM_BAR, false)
+            .getBoolean(NoopPrefs.KEY_OVERLAY_BOTTOM_BAR, true)
         autoHide = NoopPrefs.of(ctx.applicationContext)
-            .getBoolean(NoopPrefs.KEY_BOTTOM_BAR_AUTO_HIDE, false)
+            .getBoolean(NoopPrefs.KEY_BOTTOM_BAR_AUTO_HIDE, true)
     }
 
     fun set(ctx: Context, value: Boolean) {
diff --git a/android/app/src/main/java/com/noop/ui/MainActivity.kt b/android/app/src/main/java/com/noop/ui/MainActivity.kt
index b6ede27695..42c86f1392 100644
--- a/android/app/src/main/java/com/noop/ui/MainActivity.kt
+++ b/android/app/src/main/java/com/noop/ui/MainActivity.kt
@@ -702,11 +702,11 @@ object NoopPrefs {
     }
 
     /** #1839: hide the overlay bottom bar while scrolling down, restore it on scrolling up. Default
-     *  false. Only meaningful with the overlay layout, where the bar sits over content. */
+     *  ON (#1841). Only meaningful with the overlay layout, where the bar sits over content. */
     const val KEY_BOTTOM_BAR_AUTO_HIDE = "noop.bottomBarAutoHide"
 
     /** #1836: draw the bottom bar as an overlay (glass over the screen's backdrop) instead of a reserved
-     *  Scaffold slot. Default false — the shipped layout — until the overlay has been seen on a device. */
+     *  Scaffold slot. Default ON (#1841), after the overlay was confirmed on a device. */
     const val KEY_OVERLAY_BOTTOM_BAR = "noop.overlayBottomBar"
 
     /** #1821: Clock format ("system" / "twelveHour" / "twentyFourHour"). Shares its stored vocabulary

From b6df4d87d0fb6bf00822fdef710649a670092e73 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 16:35:12 +1200
Subject: [PATCH 198/333] ios: hide the tab bar on scroll, from the same
 setting Android uses (#1841)

iOS uses the system TabView, so iOS 26 already has this behaviour - it was simply not being asked
for. .tabBarMinimizeBehavior(.onScrollDown) when the setting is on, .never when off, driven by the
same preference name and meaning Android uses, with each platform keeping its own store.

DEFAULT OFF here while Android defaults on. Apple's forums report the behaviour failing to trigger
in tabs built on NavigationStack(path:), which is every primary tab in RootTabView - bound that way
deliberately. So it may be inert on this structure, and defaulting on would advertise something that
never happens. Off until someone confirms it on an iOS 26 device.

The preference selects the modifier's ARGUMENT, never a branch: RootTabView documents that a
runtime-toggling condition around this TabView rebuilds the subtree and resets @State in the tab
roots (#519). The only branch is the availability check, fixed for the process.

Raised on #1839. Honest difference from Android: iOS minimises the bar to a pill, Android slides it
away - the platform's reading of the same intent.
---
 Strand/Resources/Localizable.xcstrings | 64 ++++++++++++++++++++++++++
 Strand/Screens/SettingsView.swift      | 20 ++++++++
 StrandiOS/App/RootTabView.swift        | 36 +++++++++++++++
 3 files changed, 120 insertions(+)

diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 26bed25672..5f947529f9 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -195553,6 +195553,70 @@
         }
       }
     },
+    "Hide bar when scrolling": {
+      "localizations": {
+        "de": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Leiste beim Scrollen ausblenden"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Hide bar when scrolling"
+          }
+        },
+        "es": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Ocultar la barra al desplazarse"
+          }
+        },
+        "fr": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Masquer la barre pendant le défilement"
+          }
+        },
+        "it": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Nascondi la barra durante lo scorrimento"
+          }
+        },
+        "pl": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Ukryj pasek podczas przewijania"
+          }
+        },
+        "pt-PT": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Ocultar a barra ao deslocar"
+          }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Скрывать панель при прокрутке"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "滚动时隐藏底部栏"
+          }
+        },
+        "zh-Hant": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "捲動時隱藏底部列"
+          }
+        }
+      }
+    },
     "System default": {
       "localizations": {
         "de": {
diff --git a/Strand/Screens/SettingsView.swift b/Strand/Screens/SettingsView.swift
index 398f080c78..645a994301 100644
--- a/Strand/Screens/SettingsView.swift
+++ b/Strand/Screens/SettingsView.swift
@@ -174,6 +174,10 @@ struct SettingsView: View {
     // distances/weights/heights/temperatures are SHOWN — and lets the profile fields below take
     // imperial entry. Temperature has a separate override so °C/°F can be picked independently.
     /// #1821: Clock format. Defaults to `.system`, so upgrading changes nobody's displayed times.
+    /// #1841: shared with Android by name and meaning; each platform keeps its own store. Default FALSE
+    /// on Apple (Android defaults true) because the system behaviour may not fire on our
+    /// `NavigationStack(path:)` tabs — see RootTabView.
+    @AppStorage("noop.bottomBarAutoHide") private var bottomBarAutoHide = false
     @AppStorage(ClockFormatPreference.defaultsKey)
     private var clockFormatRaw = ClockFormatPreference.system.rawValue
     @AppStorage(UnitPrefs.systemKey) private var unitSystemRaw = UnitSystem.metric.rawValue
@@ -1144,6 +1148,22 @@ struct SettingsView: View {
                     // picker would appear to do nothing until the app restarted.
                     .onChangeCompat(of: clockFormatRaw) { _ in AppClock.invalidate() }
                 }
+                #if os(iOS)
+                rowDivider
+                // #1841: the same preference Android drives its own bar with, by name and meaning. Here
+                // the SYSTEM owns the behaviour — iOS 26 minimises the tab bar to a pill on scroll rather
+                // than sliding it away — so this asks for the platform's reading of the intent rather
+                // than reproducing ours. Below iOS 26 the modifier is inert and the row simply does
+                // nothing, which is why it is not offered there.
+                if #available(iOS 26.0, *) {
+                    FormRow(label: "Hide bar when scrolling") {
+                        Toggle("", isOn: $bottomBarAutoHide)
+                            .labelsHidden()
+                            .tint(StrandPalette.accent)
+                            .accessibilityLabel("Hide bar when scrolling")
+                    }
+                }
+                #endif
                 rowDivider
                 // Theme presets — one-tap bundles coordinating accent + chart world + backdrop + card
                 // opacity. Derived (no stored value): tweaking any control below flips this to Custom.
diff --git a/StrandiOS/App/RootTabView.swift b/StrandiOS/App/RootTabView.swift
index 52b15fadbd..f4d34b0afb 100644
--- a/StrandiOS/App/RootTabView.swift
+++ b/StrandiOS/App/RootTabView.swift
@@ -6,6 +6,16 @@ import StrandDesign
 /// natural analogue is a `TabView` with the most-used screens as tabs and everything else under a
 /// "More" list. Every screen is the same `StrandDesign`-built view the macOS app uses.
 struct RootTabView: View {
+    /// #1841: shared with Android by NAME and meaning, not by storage — the two platforms keep their own
+    /// stores, exactly as the Clock format setting does.
+    ///
+    /// Default FALSE here while Android defaults true, and the divergence is deliberate. Apple's forums
+    /// report `.tabBarMinimizeBehavior(.onScrollDown)` failing to trigger in tabs built on
+    /// `NavigationStack(path:)` — which is every primary tab in this file, bound deliberately so a tab
+    /// root can pop and re-scroll. So this may well be inert on our structure, and defaulting ON would
+    /// advertise a behaviour that never happens. Off until someone confirms it on an iOS 26 device.
+    @AppStorage("noop.bottomBarAutoHide") private var bottomBarAutoHide = false
+
     /// External entry points must wait until the mandatory first-run gates have completed. The root owns
     /// that state; keeping it explicit here prevents this shell's window-level sheet from covering a gate.
     let homeScreenQuickActionsEnabled: Bool
@@ -113,6 +123,10 @@ struct RootTabView: View {
             moreTab(path: $tabPaths[3], scrollSignal: scrollTop[3]).tag(3)
         }
         .tint(StrandPalette.accent)
+        // #1841: the same "Hide bar when scrolling" preference Android drives its own bar with. Here the
+        // system owns the behaviour — iOS 26's tab bar MINIMISES to a pill on scroll down rather than
+        // sliding away entirely, so this is the platform's read of the same intent, not a copy of ours.
+        .noopTabBarAutoHide(bottomBarAutoHide)
             // Tab crossfade — README §Motion: ~240ms opacity swap between tab roots, global calm
             // easing cubic-bezier(0.22,1,0.36,1).
             .animation(.timingCurve(0.22, 1, 0.36, 1, duration: 0.24), value: selectedTab)
@@ -686,3 +700,25 @@ private struct QuickActionSheet: View {
 }
 
 #endif
+
+/// #1841: apply the iOS 26 tab-bar minimise behaviour, doing nothing on older systems.
+///
+/// The availability branch is deliberately the ONLY branch. `RootTabView` already documents what happens
+/// when a condition that flips at runtime wraps this `TabView`: #519 put two states in separate
+/// `_ConditionalContent` branches, and every navigation rebuilt the whole subtree, resetting `@State`
+/// inside the tab roots — scroll offsets, chart ranges, expanded sections.
+///
+/// So the preference must NOT select between branches. It selects the modifier's ARGUMENT, while the
+/// availability check — fixed for the life of the process — is what picks a branch. Toggling the setting
+/// changes a value, never the view's identity.
+extension View {
+    @ViewBuilder
+    func noopTabBarAutoHide(_ enabled: Bool) -> some View {
+        if #available(iOS 26.0, *) {
+            // `.onScrollDown` minimises to a pill on downward scroll; `.never` pins it fully visible.
+            self.tabBarMinimizeBehavior(enabled ? .onScrollDown : .never)
+        } else {
+            self
+        }
+    }
+}

From b8da10c01f0ed963c0f7cbf8a00a8c46ceb45fe1 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 17:58:57 +1200
Subject: [PATCH 199/333] today: per-field HRV / Resting HR carry on both
 platforms, and stop printing -0.0 (#1843)

Reported on #1842: the HRV and Resting HR cards read "No data" while tapping through to the same metric graphed a value, and Skin Temp showed -0.0 dC.

Cause is one level below the cards. The vitals carry predicate is an OR across HRV / resting-HR / respiratory, so it resolves the freshest row holding ANY of the three -- including a respiratory-only row whose HRV is null. The card reads that null and blanks while a tile carrying a different row shows a value on the same screen. Same failure the SpO2 and skin-temp per-field rows were split out to correct; HRV and resting HR were the two fields still on the shared predicate.

Adds lastHrvRow / lastRestingHrRow (Kotlin) and lastHrvDay / lastRestingHrDay (Swift) as the fourth and fifth per-field twins, same shape and same future-clock bound.

Apple needed more than a straight port. TodayView.dashboardValue's .hrv and .restingHr had no carry at all -- today's row or an em-dash -- while .respiratory, .bloodOxygen and .skinTemp beside them all carried, and the Key Metrics tile had carried via carriedVital(perField:) throughout. Same symptom, different cause. Liquid's recoveryVitalsSection and keyMetricsSection had the OR-predicate form.

Two judgement calls, both documented in place: the new carries are deliberately NOT staleness-bounded (respiratory took a hard bound because one CSV import's value read as today's for a fortnight, #1331; HRV/RHR disclose age through the caption's "Latest sleep" relabel instead, #779), and the single card-level provenance footnote now stamps the OLDEST row any shown carried vital came from, since vitals can come from different rows and erring old is the only safe direction for a caption meant to stop a stale read passing as today's.

Skin Temp's -0.0 was a signed zero: a deviation rounding to zero from below kept its minus through %+.1f. Both platforms re-read the formatted string and drop the sign at zero magnitude, so it renders 0.0 -- unsigned, not a fake positive.

Tests pin the bug as well as the fix: each asserts the shared predicate picks the respiratory-only row and yields no HRV, so a future simplification back onto it fails in CI rather than in the field. Kotlin full suite 5098/0; Swift package tests green in CI; app-build green on both legs.
---
 .../StrandAnalytics/SkinTempDisplay.swift     |  8 ++-
 .../SkinTempDisplayTests.swift                | 12 ++++
 .../Sources/WhoopStore/MetricsCache.swift     | 22 +++++++
 .../DailyMetricLastVitalsDayTests.swift       | 43 ++++++++++++++
 Strand/Data/Repository.swift                  | 11 ++++
 Strand/Liquid/LiquidTodayView.swift           | 37 ++++++++----
 Strand/Screens/TodayView.swift                | 46 ++++++++++++---
 .../com/noop/analytics/SkinTempDisplay.kt     | 12 ++--
 .../src/main/java/com/noop/ui/LogicalDay.kt   | 13 +++++
 .../src/main/java/com/noop/ui/TodayScreen.kt  | 29 +++++++++-
 .../com/noop/analytics/SkinTempDisplayTest.kt | 16 +++++
 .../test/java/com/noop/ui/LastHrvRowTest.kt   | 58 +++++++++++++++++++
 12 files changed, 282 insertions(+), 25 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ui/LastHrvRowTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SkinTempDisplay.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SkinTempDisplay.swift
index 5b8f2aa018..18b6222ea3 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/SkinTempDisplay.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SkinTempDisplay.swift
@@ -68,7 +68,13 @@ public enum SkinTempDisplay {
         if kind == .absolute {
             return String(format: "%.\(decimals)f", display)
         }
-        return String(format: "%+.\(decimals)f", display)
+        let signed = String(format: "%+.\(decimals)f", display)
+        // #1842: a deviation that ROUNDS to zero must not keep its sign. `%+` prints "-0.0" for anything
+        // in (-0.05, 0), and "-0.0 Δ°C" on a card reads as a fault rather than as "no change from your
+        // baseline" — which is what it means. Drop the sign only when the rounded value is zero; a real
+        // -0.1 keeps it. Twin of the Kotlin numberString.
+        if Double(signed.dropFirst()) == 0 { return String(signed.dropFirst()) }
+        return signed
     }
 
     /// Full `"34.2 °C"` / `"+0.1 Δ°C"` string for one-shot call sites (Today cards, explorers).
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SkinTempDisplayTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SkinTempDisplayTests.swift
index 2793cd2859..69a6e977b7 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SkinTempDisplayTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SkinTempDisplayTests.swift
@@ -99,4 +99,16 @@ final class SkinTempDisplayTests: XCTestCase {
         let filteredMean = kept.reduce(0, +) / Double(kept.count)
         XCTAssertLessThan(abs(filteredMean), 0.3)
     }
+
+    /// #1842: a deviation that rounds to zero must not carry a sign. `%+` prints "-0.0" for anything in
+    /// (-0.05, 0), and the Today card showed "-0.0 Δ°C" — which reads as a fault rather than as "no
+    /// change from your baseline". A real -0.1 must still keep its sign. Twin of the Kotlin test.
+    func testADeviationRoundingToZeroLosesItsSign() {
+        XCTAssertEqual(SkinTempDisplay.numberString(-0.04, kind: .deviation, fahrenheit: false), "0.0")
+        XCTAssertEqual(SkinTempDisplay.numberString(0.0, kind: .deviation, fahrenheit: false), "0.0")
+        XCTAssertEqual(SkinTempDisplay.numberString(0.04, kind: .deviation, fahrenheit: false), "0.0")
+        XCTAssertEqual(SkinTempDisplay.numberString(-0.1, kind: .deviation, fahrenheit: false), "-0.1")
+        XCTAssertEqual(SkinTempDisplay.numberString(0.1, kind: .deviation, fahrenheit: false), "+0.1")
+        XCTAssertEqual(SkinTempDisplay.numberString(34.2, kind: .absolute, fahrenheit: false), "34.2")
+    }
 }
diff --git a/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift b/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift
index c3ed5fecc4..5927df6788 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift
@@ -152,6 +152,28 @@ public struct DailyMetric: Equatable, Codable {
     public nonisolated static func lastSkinTempDay(days: [DailyMetric], todayKey: String) -> DailyMetric? {
         days.last(where: { $0.skinTempDevC != nil && $0.day < todayKey })
     }
+
+    /// PER-FIELD HRV carry — the twin of `lastSpo2Day` for a field `lastVitalsDay` DOES check, which is
+    /// precisely why it needs one. That predicate is an OR across HRV / resting-HR / respiratory, so it
+    /// resolves the freshest row carrying ANY of the three — including a respiratory-only row whose
+    /// `avgHrv` is nil. The HRV card then reads that nil and renders "—" while a tile carrying a different
+    /// row shows a real number on the same screen (#1842). Resolving per field picks the freshest row that
+    /// actually holds an HRV, the same correction `lastSpo2Day` and `lastSkinTempDay` already make.
+    ///
+    /// Deliberately NOT staleness-bounded, unlike `Repository.lastRespDay`: an old HRV/RHR carry is
+    /// disclosed rather than suppressed — the call sites stamp the row's own date and `carriedCaption`
+    /// relabels a weeks-old one to "Latest sleep" (#779). Respiratory took a hard bound instead because a
+    /// single CSV import's value was reading as today's for a fortnight (#1331). Same `$0.day < todayKey`
+    /// future-clock guard; `days` is oldest→newest. Byte-twin of the Android `lastHrvRow`.
+    public nonisolated static func lastHrvDay(days: [DailyMetric], todayKey: String) -> DailyMetric? {
+        days.last(where: { $0.avgHrv != nil && $0.day < todayKey })
+    }
+
+    /// PER-FIELD resting-HR carry — twin of `lastHrvDay`, same OR-predicate cause and same unbounded-by-
+    /// design carry (#1842). Byte-twin of the Android `lastRestingHrRow`.
+    public nonisolated static func lastRestingHrDay(days: [DailyMetric], todayKey: String) -> DailyMetric? {
+        days.last(where: { $0.restingHr != nil && $0.day < todayKey })
+    }
 }
 
 extension WhoopStore {
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/DailyMetricLastVitalsDayTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/DailyMetricLastVitalsDayTests.swift
index adfef47ac8..6f5554d876 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/DailyMetricLastVitalsDayTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/DailyMetricLastVitalsDayTests.swift
@@ -151,4 +151,47 @@ final class DailyMetricLastVitalsDayTests: XCTestCase {
                     fieldDay("2999-01-01", skinTemp: 2.1)]
         XCTAssertEqual(DailyMetric.lastSkinTempDay(days: days, todayKey: "2026-06-19")?.day, "2026-06-16")
     }
+
+    // MARK: PER-FIELD HRV / resting HR — the OR predicate's blind spot (#1842)
+
+    /// The reported shape: the freshest row carries respiratory ONLY, so the OR predicate selects it and its
+    /// nil `avgHrv` renders "—" on the card while a tile carrying a different row shows a number on the same
+    /// screen. Pins the BUG as well as the fix, so a future simplification back onto `lastVitalsDay` fails
+    /// here rather than in the field.
+    func testSharedPredicateSelectsARowWithNoHrv_perFieldDoesNot() {
+        let days = [day("2026-09-01", hrv: 35, rhr: 58),
+                    day("2026-09-02", resp: 14.2),
+                    day("2026-09-03")]   // today, nothing yet
+        let shared = DailyMetric.lastVitalsDay(days: days, todayKey: "2026-09-03")
+        XCTAssertEqual(shared?.day, "2026-09-02", "the OR predicate takes the respiratory-only row")
+        XCTAssertNil(shared?.avgHrv, "...and that row has no HRV — the blank the card was rendering")
+
+        XCTAssertEqual(DailyMetric.lastHrvDay(days: days, todayKey: "2026-09-03")?.avgHrv, 35)
+        XCTAssertEqual(DailyMetric.lastRestingHrDay(days: days, todayKey: "2026-09-03")?.restingHr, 58)
+    }
+
+    /// Freshest wins when several prior rows carry the field.
+    func testPerFieldCarriesTheFreshestRowHoldingTheField() {
+        let days = [day("2026-09-01", hrv: 30, rhr: 62),
+                    day("2026-09-02", hrv: 41, rhr: 55),
+                    day("2026-09-03")]
+        XCTAssertEqual(DailyMetric.lastHrvDay(days: days, todayKey: "2026-09-03")?.avgHrv, 41)
+        XCTAssertEqual(DailyMetric.lastRestingHrDay(days: days, todayKey: "2026-09-03")?.restingHr, 55)
+    }
+
+    /// Same future-clock bound as every sibling: strictly prior to today's key, so today's own still-forming
+    /// row and a bad-clock strap's future-dated row can never be carried as "last night's".
+    func testPerFieldNeverCarriesTodayOrLater() {
+        let days = [day("2026-09-03", hrv: 44, rhr: 50), day("2026-09-04", hrv: 45, rhr: 49)]
+        XCTAssertNil(DailyMetric.lastHrvDay(days: days, todayKey: "2026-09-03"))
+        XCTAssertNil(DailyMetric.lastRestingHrDay(days: days, todayKey: "2026-09-03"))
+    }
+
+    /// Nothing anywhere stays "—": the carry must never invent a value.
+    func testPerFieldCarriesNothingWhenNoRowHasTheField() {
+        let days = [day("2026-09-01", resp: 15.0), day("2026-09-02", resp: 14.0)]
+        XCTAssertNil(DailyMetric.lastHrvDay(days: days, todayKey: "2026-09-03"))
+        XCTAssertNil(DailyMetric.lastRestingHrDay(days: days, todayKey: "2026-09-03"))
+    }
+
 }
diff --git a/Strand/Data/Repository.swift b/Strand/Data/Repository.swift
index 07076c60fd..620aec87a8 100644
--- a/Strand/Data/Repository.swift
+++ b/Strand/Data/Repository.swift
@@ -608,6 +608,17 @@ final class Repository: ObservableObject {
         DailyMetric.lastSkinTempDay(days: days, todayKey: todayKey)
     }
 
+    /// PER-FIELD HRV carry — twin of the above, for a field `lastVitalsDay`'s OR predicate DOES check but
+    /// can still resolve nil on (#1842). See `DailyMetric.lastHrvDay`.
+    nonisolated static func lastHrvDay(days: [DailyMetric], todayKey: String) -> DailyMetric? {
+        DailyMetric.lastHrvDay(days: days, todayKey: todayKey)
+    }
+
+    /// PER-FIELD resting-HR carry — twin of `lastHrvDay`. See `DailyMetric.lastRestingHrDay`.
+    nonisolated static func lastRestingHrDay(days: [DailyMetric], todayKey: String) -> DailyMetric? {
+        DailyMetric.lastRestingHrDay(days: days, todayKey: todayKey)
+    }
+
     /// PER-FIELD respiratory carry — twin of `lastSpo2Day`, but STALENESS-BOUNDED to `Baselines.vitalCarryDays`.
     /// SpO₂/skin-temp are sparse/imported so last-known-of-any-age is expected; respiratory is nightly, so a
     /// weeks-old value shown as the current number is the "Respiratory 15.6 a fortnight later" bug that
diff --git a/Strand/Liquid/LiquidTodayView.swift b/Strand/Liquid/LiquidTodayView.swift
index 302b59b96c..e63b8469d3 100644
--- a/Strand/Liquid/LiquidTodayView.swift
+++ b/Strand/Liquid/LiquidTodayView.swift
@@ -114,6 +114,8 @@ struct LiquidTodayView: View {
     /// resolved in body — body rescans repo.days ~23× per pass, and this cache keeps that read O(1).
     @State private var cachedVitalsDay: DailyMetric?
     @State private var cachedRespDay: DailyMetric?
+    @State private var cachedHrvDay: DailyMetric?
+    @State private var cachedRestingHrDay: DailyMetric?
     /// The Charge hero's resolved state (#543 carry + the honest label), resolved ONCE in load() alongside
     /// the other caches. It composes `TodayView.lastScoredRecoveryDay`, which is O(days) — exactly the scan
     /// this cache exists to keep out of body. Never resolved in body.
@@ -178,6 +180,14 @@ struct LiquidTodayView: View {
     /// The prior-day RESPIRATORY carry (#1331): staleness-bounded, so a recent missed night reads the last
     /// real value while a weeks-old one honestly shows "No Data". Non-nil only at offset 0.
     private var respDay: DailyMetric? { cachedRespDay }
+
+    /// PER-FIELD HRV / resting-HR carries (#1842), read O(1) from the cache like `vitalsDay`. `vitalsDay`'s
+    /// predicate is an OR across HRV / resting-HR / respiratory, so it resolves the freshest row with ANY of
+    /// them — a respiratory-only row blanks HRV and Resting HR on both the vitals card and the Key Metrics
+    /// tiles. Twins of `DailyMetric.lastHrvDay` / `lastRestingHrDay`; mirror the Android per-field rows.
+    private var hrvDay: DailyMetric? { cachedHrvDay }
+
+    private var restingHrDay: DailyMetric? { cachedRestingHrDay }
     /// The Charge hero's resolved state (see `cachedChargeDisplay`), read O(1) from the cache.
     private var chargeDisplay: ChargeDisplay { cachedChargeDisplay }
 
@@ -1078,9 +1088,10 @@ struct LiquidTodayView: View {
 
     private var recoveryVitalsSection: some View {
         // PER-FIELD, today-first carry: each vital reads today's own value, else falls back to the prior
-        // day that recorded it (`vitalsDay`). Coalesce ONCE so the number and its fill fraction agree.
-        let hrv = displayDay?.avgHrv ?? vitalsDay?.avgHrv
-        let rhr = (displayDay?.restingHr ?? vitalsDay?.restingHr).map(Double.init)
+        // day that recorded THAT vital (#1842 — `vitalsDay` is the freshest row with ANY of the three, so it
+        // blanks one the row lacks). Coalesce ONCE so the number and its fill fraction agree.
+        let hrv = displayDay?.avgHrv ?? hrvDay?.avgHrv
+        let rhr = (displayDay?.restingHr ?? restingHrDay?.restingHr).map(Double.init)
         let resp = displayDay?.respRateBpm ?? vitalsDay?.respRateBpm
         return card {
             VStack(alignment: .leading, spacing: 12) {
@@ -1142,8 +1153,8 @@ struct LiquidTodayView: View {
         // HRV / Rest HR (+ Blood Oxygen / Respiratory) tiles share the recovery vitals' per-field
         // today-first carry so they don't blank at the rollover while Recovery/Strain/Rest stay strictly
         // today's own (they are scored surfaces).
-        let hrv = displayDay?.avgHrv ?? vitalsDay?.avgHrv
-        let rhr = (displayDay?.restingHr ?? vitalsDay?.restingHr).map(Double.init)
+        let hrv = displayDay?.avgHrv ?? hrvDay?.avgHrv
+        let rhr = (displayDay?.restingHr ?? restingHrDay?.restingHr).map(Double.init)
         return VStack(spacing: 8) {
             HStack(alignment: .firstTextBaseline, spacing: 8) {
                 sectionHead("KEY METRICS", trailing: trendWindowLabel)
@@ -1434,6 +1445,8 @@ struct LiquidTodayView: View {
         let tkey = cachedDisplayDay?.day ?? selectedDayKey
         cachedVitalsDay = (selectedDayOffset == 0) ? Repository.lastVitalsDay(days: repo.days, todayKey: tkey) : nil
         cachedRespDay = (selectedDayOffset == 0) ? Repository.lastRespDay(days: repo.days, todayKey: tkey) : nil
+        cachedHrvDay = (selectedDayOffset == 0) ? Repository.lastHrvDay(days: repo.days, todayKey: tkey) : nil
+        cachedRestingHrDay = (selectedDayOffset == 0) ? Repository.lastRestingHrDay(days: repo.days, todayKey: tkey) : nil
         // Charge carry (#543) + the honest label, resolved here for the same reason as the two above: the
         // selector below scans repo.days. Calibration nights come from the SAME `RecoveryScorer` helper the
         // classic Today reads, so the two screens agree on when a wearer is genuinely mid-calibration
@@ -1794,11 +1807,15 @@ struct LiquidTodayView: View {
     /// "Latest sleep · <date>" (#779) instead of a false "Last night". When every shown vital is today's
     /// own (or there's nothing to carry), it returns nil — the card must not claim "Last night" at all.
     private var vitalsProvenanceLine: String? {
-        guard let carried = vitalsDay else { return nil }
-        let carriedHrv = displayDay?.avgHrv == nil && carried.avgHrv != nil
-        let carriedRhr = displayDay?.restingHr == nil && carried.restingHr != nil
-        let carriedResp = displayDay?.respRateBpm == nil && carried.respRateBpm != nil
-        guard carriedHrv || carriedRhr || carriedResp else { return nil }
+        // Each vital can carry from a DIFFERENT row (#1842), so the one card-level footnote stamps the
+        // OLDEST row any SHOWN carried vital came from — erring old is the only safe direction for a caption
+        // whose job is to stop a stale read passing as today's, and it keeps the "Latest sleep" relabel
+        // (#779) firing on the value that actually is weeks old. A row counts only if it SUPPLIED the value.
+        let fromHrv: DailyMetric? = (displayDay?.avgHrv == nil && hrvDay?.avgHrv != nil) ? hrvDay : nil
+        let fromRhr: DailyMetric? = (displayDay?.restingHr == nil && restingHrDay?.restingHr != nil) ? restingHrDay : nil
+        let fromResp: DailyMetric? = (displayDay?.respRateBpm == nil && vitalsDay?.respRateBpm != nil) ? vitalsDay : nil
+        let sources: [DailyMetric] = [fromHrv, fromRhr, fromResp].compactMap { $0 }
+        guard let carried = sources.min(by: { $0.day < $1.day }) else { return nil }
         return TodayView.carriedCaption(priorDayKey: carried.day,
                                         todayKey: displayDay?.day ?? selectedDayKey)
     }
diff --git a/Strand/Screens/TodayView.swift b/Strand/Screens/TodayView.swift
index 8e67539e9f..74a4ee121d 100644
--- a/Strand/Screens/TodayView.swift
+++ b/Strand/Screens/TodayView.swift
@@ -590,6 +590,20 @@ struct TodayView: View {
         return Repository.lastSpo2Day(days: repo.days, todayKey: displayDay?.day ?? selectedDayKey)
     }
 
+    /// PER-FIELD HRV carry — twin of `lastSpo2Day` for a field `lastVitalsDay`'s OR predicate checks but can
+    /// still resolve nil on: it picks the freshest row with ANY vital, so a respiratory-only row blanks HRV
+    /// (#1842). Mirrors the Android `lastHrvRow`.
+    private var lastHrvDay: DailyMetric? {
+        guard selectedDayOffset == 0 else { return nil }
+        return Repository.lastHrvDay(days: repo.days, todayKey: displayDay?.day ?? selectedDayKey)
+    }
+
+    /// PER-FIELD resting-HR carry — twin of `lastHrvDay`. Mirrors the Android `lastRestingHrRow`.
+    private var lastRestingHrDay: DailyMetric? {
+        guard selectedDayOffset == 0 else { return nil }
+        return Repository.lastRestingHrDay(days: repo.days, todayKey: displayDay?.day ?? selectedDayKey)
+    }
+
     /// PER-FIELD skin-temperature-deviation carry — twin of `lastSpo2Day`; mirrors the Android `lastSkinTempRow`.
     private var lastSkinTempDay: DailyMetric? {
         guard selectedDayOffset == 0 else { return nil }
@@ -2574,12 +2588,18 @@ struct TodayView: View {
             #if DEBUG
             if let f = DemoDayHarness.active { return withUnit("\(f.hrvMs)") }
             #endif
-            return withUnit(d?.avgHrv.map { "\(Int($0.rounded()))" } ?? "—")
+            // PER-FIELD carry: today → the freshest prior row that actually HAS an HRV (#1842). Was
+            // today-only, so this card blanked to "—" every rollover while the Key Metrics tile — which
+            // has carried via `carriedVital(perField:)` all along — showed a number on the same screen.
+            // Not the whole-row `lastVitalsDay`: its OR predicate resolves nil HRV on a respiratory-only
+            // row. Mirrors the Android dashboardCardValue.
+            return withUnit((d?.avgHrv ?? lastHrvDay?.avgHrv).map { "\(Int($0.rounded()))" } ?? "—")
         case .restingHr:
             #if DEBUG
             if let f = DemoDayHarness.active { return withUnit("\(f.rhrBpm)") }
             #endif
-            return withUnit(d?.restingHr.map { "\($0)" } ?? "—")
+            // PER-FIELD carry — twin of `.hrv` above (#1842).
+            return withUnit((d?.restingHr ?? lastRestingHrDay?.restingHr).map { "\($0)" } ?? "—")
         case .respiratory:
             // PER-FIELD carry: today → the STALENESS-BOUNDED prior night (`lastRespDay`). Recovery-
             // independent, so a night with real R-R but a null recovery still carries.
@@ -2793,16 +2813,26 @@ struct TodayView: View {
         // falls back to the last night that recorded THAT vital (`lastVitalsDay`, recovery-INDEPENDENT — a
         // night with real HRV/RHR but a null recovery is a valid source, which the old `lastScoredRecoveryDay`
         // row-swap skipped). Today's own value always wins the instant it lands.
+        // ...and PER FIELD means per field: `lastVitalsDay`'s predicate is an OR across the three, so it
+        // resolves the freshest row with ANY of them and blanks a vital that row happens to lack (#1842).
+        let hd = lastHrvDay
+        let rd = lastRestingHrDay
         let vd = lastVitalsDay
-        let hrv = d?.avgHrv ?? vd?.avgHrv
-        let rhr = d?.restingHr ?? vd?.restingHr
+        let hrv = d?.avgHrv ?? hd?.avgHrv
+        let rhr = d?.restingHr ?? rd?.restingHr
         let resp = d?.respRateBpm ?? vd?.respRateBpm
         // The provenance row a shown vital fell back to (nil when every shown vital is today's own): stamps
         // that row's own date, so the footnote can't claim "Last night" for a value that IS today's.
-        let carriedFromHrv = d?.avgHrv == nil && vd?.avgHrv != nil
-        let carriedFromRhr = d?.restingHr == nil && vd?.restingHr != nil
-        let carriedFromResp = d?.respRateBpm == nil && vd?.respRateBpm != nil
-        let provenance: DailyMetric? = (carriedFromHrv || carriedFromRhr || carriedFromResp) ? vd : nil
+        // Each vital can now carry from a DIFFERENT row, so the one card-level footnote stamps the OLDEST
+        // row any SHOWN carried vital came from. Erring old is the only safe direction for a caption whose
+        // job is to stop a stale read passing as today's, and it keeps `carriedCaption`'s "Latest sleep"
+        // relabel (#779) firing on the value that actually is weeks old. A row is only a source if it
+        // SUPPLIED the value — `vd` can hold a nil respiratory, which carries nothing and stamps nothing.
+        let carriedFromHrv: DailyMetric? = (d?.avgHrv == nil && hd?.avgHrv != nil) ? hd : nil
+        let carriedFromRhr: DailyMetric? = (d?.restingHr == nil && rd?.restingHr != nil) ? rd : nil
+        let carriedFromResp: DailyMetric? = (d?.respRateBpm == nil && vd?.respRateBpm != nil) ? vd : nil
+        let sources: [DailyMetric] = [carriedFromHrv, carriedFromRhr, carriedFromResp].compactMap { $0 }
+        let provenance: DailyMetric? = sources.min(by: { $0.day < $1.day })
         NoopCard(tint: StrandPalette.chargeColor) {
             VStack(spacing: 0) {
                 // DEBUG promo harness: pin HRV / Resting HR to the active frame's values. No-op otherwise.
diff --git a/android/app/src/main/java/com/noop/analytics/SkinTempDisplay.kt b/android/app/src/main/java/com/noop/analytics/SkinTempDisplay.kt
index 8d222d02de..0f9052a7ed 100644
--- a/android/app/src/main/java/com/noop/analytics/SkinTempDisplay.kt
+++ b/android/app/src/main/java/com/noop/analytics/SkinTempDisplay.kt
@@ -64,11 +64,15 @@ object SkinTempDisplay {
         } else {
             value
         }
-        return if (kind == Kind.ABSOLUTE) {
-            String.format(java.util.Locale.US, "%.${decimals}f", display)
-        } else {
-            String.format(java.util.Locale.US, "%+.${decimals}f", display)
+        if (kind == Kind.ABSOLUTE) {
+            return String.format(java.util.Locale.US, "%.${decimals}f", display)
         }
+        val signed = String.format(java.util.Locale.US, "%+.${decimals}f", display)
+        // #1842: a deviation that ROUNDS to zero must not keep its sign. `%+` prints "-0.0" for anything
+        // in (-0.05, 0), and "-0.0 Δ°C" on a card reads as a fault rather than as "no change from your
+        // baseline" — which is exactly what it means. Drop the sign only when the rounded value is zero;
+        // a real -0.1 keeps it.
+        return if (signed.drop(1).toDoubleOrNull() == 0.0) signed.drop(1) else signed
     }
 
     /** Full `"34.2 °C"` / `"+0.1 Δ°C"` string for one-shot call sites (Today cards, explorers). */
diff --git a/android/app/src/main/java/com/noop/ui/LogicalDay.kt b/android/app/src/main/java/com/noop/ui/LogicalDay.kt
index 261e98e5fb..fafe7e4fc2 100644
--- a/android/app/src/main/java/com/noop/ui/LogicalDay.kt
+++ b/android/app/src/main/java/com/noop/ui/LogicalDay.kt
@@ -117,6 +117,19 @@ internal fun lastVitalsRow(days: List<DailyMetric>, todayKey: String): DailyMetr
 internal fun lastSpo2Row(days: List<DailyMetric>, todayKey: String): DailyMetric? =
     days.lastOrNull { it.spo2Pct != null && it.day < todayKey }
 
+/**
+ * PER-FIELD twin of [lastVitalsRow] for HRV. [lastVitalsRow]'s predicate is an OR across HRV /
+ * resting-HR / respiratory, so it can select a row that has respRateBpm and a NULL avgHrv while an older
+ * row holds a real HRV — the card then reads null and prints "No Data" beside a tile showing a value
+ * (#1842). Same `it.day < todayKey` future-clock guard as its siblings.
+ */
+internal fun lastHrvRow(days: List<DailyMetric>, todayKey: String): DailyMetric? =
+    days.lastOrNull { it.avgHrv != null && it.day < todayKey }
+
+/** PER-FIELD twin of [lastVitalsRow] for resting heart rate. See [lastHrvRow]. */
+internal fun lastRestingHrRow(days: List<DailyMetric>, todayKey: String): DailyMetric? =
+    days.lastOrNull { it.restingHr != null && it.day < todayKey }
+
 /** PER-FIELD twin of [lastVitalsRow] for skin temperature deviation. See [lastSpo2Row]. */
 internal fun lastSkinTempRow(days: List<DailyMetric>, todayKey: String): DailyMetric? =
     days.lastOrNull { it.skinTempDevC != null && it.day < todayKey }
diff --git a/android/app/src/main/java/com/noop/ui/TodayScreen.kt b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
index 795040e2dd..ad4f47926c 100644
--- a/android/app/src/main/java/com/noop/ui/TodayScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
@@ -1021,6 +1021,14 @@ fun TodayScreen(
     val lastSkinTempDay: DailyMetric? = remember(days, carryOverTodayKey, selectedDayOffset, displayMetric) {
         if (selectedDayOffset == 0) lastSkinTempRow(days, maxOf(displayMetric?.day ?: "", carryOverTodayKey)) else null
     }
+    // #1842: per-field HRV / resting-HR carries, the twins of the SpO₂ and skin-temp rows above. Same
+    // shape, same future-clock bound; see lastHrvRow for why the shared lastVitalsRow is not enough.
+    val lastHrvDay: DailyMetric? = remember(days, carryOverTodayKey, selectedDayOffset, displayMetric) {
+        if (selectedDayOffset == 0) lastHrvRow(days, maxOf(displayMetric?.day ?: "", carryOverTodayKey)) else null
+    }
+    val lastRestingHrDay: DailyMetric? = remember(days, carryOverTodayKey, selectedDayOffset, displayMetric) {
+        if (selectedDayOffset == 0) lastRestingHrRow(days, maxOf(displayMetric?.day ?: "", carryOverTodayKey)) else null
+    }
     // PER-FIELD respiratory carry (#1331): the freshest strictly-prior row that actually HAS a breaths/min,
     // since lastVitalsDay can land on a night with HRV/RHR but no respiratory. Twin of lastSpo2Day.
     val lastRespDay: DailyMetric? = remember(days, carryOverTodayKey, selectedDayOffset, displayMetric) {
@@ -1619,6 +1627,8 @@ fun TodayScreen(
                             vitalsDay = lastVitalsDay,
                             spo2Day = lastSpo2Day,
                             skinTempDay = lastSkinTempDay,
+                            hrvDay = lastHrvDay,
+                            rhrDay = lastRestingHrDay,
                             respDay = lastRespDay,
                             stress = stressToday,
                             fitnessAge = fitnessAgeToday,
@@ -3295,6 +3305,8 @@ private fun YourCardsSection(
     vitalsDay: DailyMetric?,
     spo2Day: DailyMetric?,
     skinTempDay: DailyMetric?,
+    hrvDay: DailyMetric?,
+    rhrDay: DailyMetric?,
     respDay: DailyMetric?,
     stress: Double?,
     fitnessAge: Double?,
@@ -3337,6 +3349,8 @@ private fun YourCardsSection(
                         vitalsDay = vitalsDay,
                         spo2Day = spo2Day,
                         skinTempDay = skinTempDay,
+                        hrvDay = hrvDay,
+                        rhrDay = rhrDay,
                         respDay = respDay,
                         fahrenheit = fahrenheit,
                         stress = stress,
@@ -3542,6 +3556,8 @@ private fun dashboardCardValue(
     vitalsDay: DailyMetric?,
     spo2Day: DailyMetric?,
     skinTempDay: DailyMetric?,
+    hrvDay: DailyMetric?,
+    rhrDay: DailyMetric?,
     respDay: DailyMetric?,
     stress: Double?,
     fitnessAge: Double?,
@@ -3562,10 +3578,19 @@ private fun dashboardCardValue(
     val vd = carriedDay ?: day
 
     return when (card) {
+        // #1842: PER-FIELD carry, the fourth of these. `lastVitalsRow`'s predicate is an OR across
+        // HRV / resting-HR / respiratory, so it can select a row that has respRateBpm and a NULL avgHrv —
+        // and the card then reads null and prints "No data" while the tile, carrying a different row,
+        // shows a value. That is the same failure `lastSpo2Row` and `lastSkinTempRow` were split out to
+        // fix ("can select a row whose spo2Pct is null … while an OLDER row has a real reading"); HRV and
+        // resting HR were the two left on the shared predicate.
+        //
+        // Deliberately NOT the recovery-scored carry: the comment on `lastVitalsDay` is explicit that
+        // vitals must not fall back to an older recovery-scored day.
         DashboardCard.HRV ->
-            withUnit((day?.avgHrv ?: vitalsDay?.avgHrv)?.let { it.roundToInt().toString() } ?: NO_DATA)
+            withUnit((day?.avgHrv ?: hrvDay?.avgHrv)?.let { it.roundToInt().toString() } ?: NO_DATA)
         DashboardCard.RESTING_HR ->
-            withUnit((day?.restingHr ?: vitalsDay?.restingHr)?.toString() ?: NO_DATA)
+            withUnit((day?.restingHr ?: rhrDay?.restingHr)?.toString() ?: NO_DATA)
         DashboardCard.RESPIRATORY ->
             // PER-FIELD carry: today → the STALENESS-BOUNDED `respDay` (lastRespRow). The unbounded
             // `vitalsDay?.respRateBpm` is dropped on purpose (see the gauge site + Swift `lastRespDay`):
diff --git a/android/app/src/test/java/com/noop/analytics/SkinTempDisplayTest.kt b/android/app/src/test/java/com/noop/analytics/SkinTempDisplayTest.kt
index 450ec4e40a..e70dde2034 100644
--- a/android/app/src/test/java/com/noop/analytics/SkinTempDisplayTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/SkinTempDisplayTest.kt
@@ -106,4 +106,20 @@ class SkinTempDisplayTest {
         assertEquals(SkinTempDisplay.Kind.DEVIATION, SkinTempDisplay.kind(unfilteredMean))
         assertTrue(kotlin.math.abs(kept.average()) < 0.3)
     }
+
+    /**
+     * #1842: a deviation that rounds to zero must not carry a sign. `%+` prints "-0.0" for anything in
+     * (-0.05, 0), and the Today card showed "-0.0 Δ°C" — which reads as a fault rather than as "no change
+     * from your baseline". A real -0.1 must still keep its sign.
+     */
+    @Test fun aDeviationRoundingToZeroLosesItsSign() {
+        assertEquals("0.0", SkinTempDisplay.numberString(-0.04, SkinTempDisplay.Kind.DEVIATION, false))
+        assertEquals("0.0", SkinTempDisplay.numberString(0.0, SkinTempDisplay.Kind.DEVIATION, false))
+        assertEquals("0.0", SkinTempDisplay.numberString(0.04, SkinTempDisplay.Kind.DEVIATION, false))
+        // Real deviations keep theirs.
+        assertEquals("-0.1", SkinTempDisplay.numberString(-0.1, SkinTempDisplay.Kind.DEVIATION, false))
+        assertEquals("+0.1", SkinTempDisplay.numberString(0.1, SkinTempDisplay.Kind.DEVIATION, false))
+        // Absolute readings were never signed and must be untouched.
+        assertEquals("34.2", SkinTempDisplay.numberString(34.2, SkinTempDisplay.Kind.ABSOLUTE, false))
+    }
 }
\ No newline at end of file
diff --git a/android/app/src/test/java/com/noop/ui/LastHrvRowTest.kt b/android/app/src/test/java/com/noop/ui/LastHrvRowTest.kt
new file mode 100644
index 0000000000..1ef4a5d9f2
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/LastHrvRowTest.kt
@@ -0,0 +1,58 @@
+package com.noop.ui
+
+import com.noop.data.DailyMetric
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/**
+ * #1842: per-field HRV / resting-HR carries, the twins of [lastSpo2Row] and [lastSkinTempRow].
+ *
+ * [lastVitalsRow]'s predicate is an OR across HRV / resting-HR / respiratory, so it selects the freshest
+ * row having ANY of them — which can be a row whose `avgHrv` is null. The HRV card then read null and
+ * printed "No data" while the Key Metrics tile, carrying a different row, showed a value on the same
+ * screen. Same failure the SpO₂ and skin-temp twins were split out to fix.
+ */
+class LastHrvRowTest {
+
+    private fun day(d: String, hrv: Double? = null, rhr: Int? = null, resp: Double? = null) =
+        DailyMetric(deviceId = "my-whoop", day = d, restingHr = rhr, avgHrv = hrv, respRateBpm = resp)
+
+    /** The reported shape: the freshest row has respiratory only, so the shared predicate picks it and
+     *  its null avgHrv becomes "No data" — while a real HRV sits one row back. */
+    @Test
+    fun sharedPredicatePicksARowWithNoHrv() {
+        val days = listOf(day("2026-09-01", hrv = 35.0, rhr = 58), day("2026-09-02", resp = 14.2))
+
+        // The bug, pinned: lastVitalsRow selects the respiratory-only row and yields no HRV.
+        assertEquals("2026-09-02", lastVitalsRow(days, todayKey = "2026-09-03")?.day)
+        assertNull(lastVitalsRow(days, todayKey = "2026-09-03")?.avgHrv)
+
+        // The per-field resolvers find the row that actually holds each value.
+        assertEquals(35.0, lastHrvRow(days, todayKey = "2026-09-03")?.avgHrv)
+        assertEquals(58, lastRestingHrRow(days, todayKey = "2026-09-03")?.restingHr)
+    }
+
+    /** Freshest wins when several rows carry the field. */
+    @Test
+    fun theFreshestRowWithTheFieldIsChosen() {
+        val days = listOf(day("2026-09-01", hrv = 30.0), day("2026-09-02", hrv = 41.0))
+        assertEquals(41.0, lastHrvRow(days, todayKey = "2026-09-03")?.avgHrv)
+    }
+
+    /** Same future-clock guard as its siblings: strictly prior to today's key, never today or later. */
+    @Test
+    fun todayAndLaterRowsAreNeverCarried() {
+        val days = listOf(day("2026-09-03", hrv = 44.0), day("2026-09-04", hrv = 45.0))
+        assertNull(lastHrvRow(days, todayKey = "2026-09-03"))
+        assertNull(lastRestingHrRow(days, todayKey = "2026-09-03"))
+    }
+
+    /** Nothing anywhere stays "No data" — the carry must never invent a value. */
+    @Test
+    fun noRowWithTheFieldCarriesNothing() {
+        val days = listOf(day("2026-09-01", resp = 15.0), day("2026-09-02", resp = 14.0))
+        assertNull(lastHrvRow(days, todayKey = "2026-09-03"))
+        assertNull(lastRestingHrRow(days, todayKey = "2026-09-03"))
+    }
+}

From 152f4a824f55bb85fa6698694c5f31be5cef5e4b Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 17:59:23 +1200
Subject: [PATCH 200/333] build: staging 423 / iOS 304 for the next testing
 build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Carries the per-field HRV / Resting HR carry and the Skin Temp signed-zero fix
(#1843). MARKETING_VERSION and versionName stay at 11.1.1 — this is a build
bump, not a version bump.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 9678718ee3..9358887f05 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 422
+        versionCode = 423
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 0899886ffd..33c273887e 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "303"
+    CURRENT_PROJECT_VERSION: "304"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 28d57b1a1bc39cbcd1372331de1967cbd6b0adbf Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 19:17:57 +1200
Subject: [PATCH 201/333] today: lead skin temp with the measured temperature,
 with a Settings choice (#1845)

Reported on #1842: skin temp read as "0.0 dC" -- a deviation against a baseline neither screen names, where a temperature reading should say a temperature.

The Health tile already solved this. #1663 stored the nightly ABSOLUTE (dailyMetric.skinTempC) and #1665 made that tile lead with it, because a deviation with no anchor cannot be read: "+0.9" is a fever or a warm bedroom and nothing on a card says which. Three surfaces never came onto the pattern -- Today's Your Cards row, the Key Metrics tile, and the HealthScreen detail (title, unit, chart and every readings row) -- plus both Apple Today layouts. TodayView.dashboardValue was worse still: .hrv, .restingHr and .skinTemp had no carry at all while their neighbours carried.

The delta unit is NOT the defect and stays wherever a deviation is genuinely what is shown (#622). What changed is leading with a deviation on a night that measured a real temperature.

The carry moved with it. lastSkinTempRow selects on skinTempDevC, so it walked past a CALIBRATING night -- deviation null until the baseline is usable (~4 nights), absolute measured from night one -- leaving those wearers an empty card with a real temperature behind it. lastSkinTempReadingRow takes a row holding either number, and both selectors document why that OR is correct here and is not the #1842 defect: the value IS "whichever of the two this night has", and both fields are read off that ONE row, so an absolute is never paired with another night's deviation.

#1846 adds the choice, since the baseline move is the more sensitive illness signal: Settings > Units > Skin temperature, Temperature (default) or vs baseline, on both platforms. A preference and not a filter -- leadReading's prefer argument picks which number is tried first, the other stays the fallback, and the unit always names the scale actually shown rather than the one asked for.

Persisted-token parity was caught before shipping: Kotlin wrote Kind.name while Swift wrote rawValue under the same units.skinTempDisplay key. Kotlin's Kind gains a raw matching Swift byte for byte, with a test pinning both tokens.

Four re-review findings, all wired-looking code that did nothing: the Health tile ignored the setting on both platforms; six latestVital calls took the new parameter's default and none passed it; that row's predicate still walked past a calibrating night; and the backup whitelist entry was inert because export and import are explicit per key. Also unified the two Kotlin Today chains, which disagreed while the iOS twin's comment claimed they could not -- Your Cards read carriedDay-first, hiding a temperature measured today that todaysOwnReadingWinsOverEitherCarry has asserted against all along.

Kotlin full suite 5113/0 with 19 new cases; app-build green on both legs; i18n and doc-comment gates clean. One new Android string across 6 locales, one Apple a11y label spliced across 9 (58 insertions, 0 deletions).

Note for testing: skinTempC landed 2026-08-27 and refills on the next scoring pass from raw samples still on disk (analyzeRecent re-scores a 21-night window), so on an install whose newest reading predates that date this is correctly invisible until a rescore.
---
 .../StrandAnalytics/SkinTempDisplay.swift     |  44 +++++++
 .../Sources/WhoopStore/MetricsCache.swift     |  13 ++
 .../DailyMetricLastVitalsDayTests.swift       |  38 ++++++
 Strand/Data/Repository.swift                  |   6 +
 Strand/Data/Units.swift                       |   5 +
 Strand/Liquid/LiquidTodayView.swift           |  26 +++-
 Strand/Resources/Localizable.xcstrings        |  58 +++++++++
 Strand/Screens/HealthView.swift               |   4 +-
 Strand/Screens/SettingsView.swift             |  15 +++
 Strand/Screens/TodayView.swift                |  45 +++++--
 Strand/Screens/VitalSignsSummary.swift        |  15 ++-
 .../com/noop/analytics/SkinTempDisplay.kt     |  56 +++++++-
 .../main/java/com/noop/data/BackupSettings.kt |  12 ++
 .../src/main/java/com/noop/ui/HealthScreen.kt |  45 +++++--
 .../java/com/noop/ui/HealthVitalsLogic.kt     |  30 ++++-
 .../src/main/java/com/noop/ui/LogicalDay.kt   |  16 +++
 .../src/main/java/com/noop/ui/MainActivity.kt |  14 ++
 .../main/java/com/noop/ui/SettingsScreen.kt   |  27 ++++
 .../src/main/java/com/noop/ui/TodayScreen.kt  |  57 ++++++---
 .../app/src/main/java/com/noop/ui/Units.kt    |  11 ++
 .../app/src/main/res/values-de/strings.xml    |   1 +
 .../app/src/main/res/values-es/strings.xml    |   1 +
 .../app/src/main/res/values-fr/strings.xml    |   1 +
 .../app/src/main/res/values-pl/strings.xml    |   1 +
 .../src/main/res/values-pt-rPT/strings.xml    |   1 +
 .../app/src/main/res/values-zh/strings.xml    |   1 +
 android/app/src/main/res/values/strings.xml   |   1 +
 .../noop/analytics/SkinTempLeadReadingTest.kt | 120 ++++++++++++++++++
 .../java/com/noop/ui/KeyMetricSkinTempTest.kt |  17 ++-
 .../com/noop/ui/LastSkinTempReadingRowTest.kt |  45 +++++++
 30 files changed, 669 insertions(+), 57 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/analytics/SkinTempLeadReadingTest.kt
 create mode 100644 android/app/src/test/java/com/noop/ui/LastSkinTempReadingRowTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SkinTempDisplay.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SkinTempDisplay.swift
index 18b6222ea3..965e0a2943 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/SkinTempDisplay.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SkinTempDisplay.swift
@@ -42,6 +42,50 @@ public enum SkinTempDisplay {
         values.last.map(kind(of:))
     }
 
+    /// A resolved reading: the number to show and the scale it is on.
+    public struct Reading: Sendable, Equatable {
+        public let value: Double
+        public let kind: Kind
+        public init(value: Double, kind: Kind) { self.value = value; self.kind = kind }
+    }
+
+    /// Which of a night's two skin-temp numbers a surface should LEAD with (#1844), the pure form of the
+    /// rule the Health tile has applied since #1665.
+    ///
+    /// The absolute wins whenever the night measured one, because a deviation with no anchor cannot be
+    /// read — "+0.9" is a fever or a warm bedroom and nothing on a card says which. The deviation is the
+    /// fallback, not the default, and keeps its Δ unit so it is never mistaken for a wrist temperature
+    /// (#622).
+    ///
+    /// Two shapes make this more than a preference, both real rows:
+    ///  - a night scored before `skinTempC` shipped (2026-08-27) has only a deviation, and keeps exactly
+    ///    the display that shipped before until a scoring pass refills it;
+    ///  - a CALIBRATING night is the reverse — the deviation is nil until the baseline is usable
+    ///    (~4 nights) while the absolute is measured from night one, so those wearers otherwise see an
+    ///    empty card with a real temperature sitting behind it.
+    ///
+    /// `prefer` is the user's Settings choice (#1846): `.absolute` — the default, a temperature — or
+    /// `.deviation` for wearers who read the ±baseline move, which is the more sensitive illness signal. It
+    /// picks which number is tried FIRST; the other is still the fallback, so choosing one never blanks a
+    /// card whose night only measured the other, and the unit always names the scale actually shown.
+    ///
+    /// Both values must come from the SAME row; see `DailyMetric.lastSkinTempReadingDay`. Twin of the
+    /// Kotlin `SkinTempDisplay.leadReading`.
+    public static func leadReading(absC: Double?, devC: Double?, prefer: Kind = .absolute) -> Reading? {
+        let first = prefer == .absolute ? absC : devC
+        if let f = first { return Reading(value: f, kind: prefer) }
+        let other = prefer == .absolute ? devC : absC
+        let otherKind: Kind = prefer == .absolute ? .deviation : .absolute
+        if let o = other { return Reading(value: o, kind: otherKind) }
+        return nil
+    }
+
+    /// Formats whichever number `leadReading` chose, with the unit for THAT scale.
+    public static func formatReading(_ reading: Reading, fahrenheit: Bool, decimals: Int = 1) -> String {
+        let n = numberString(reading.value, kind: reading.kind, fahrenheit: fahrenheit, decimals: decimals)
+        return "\(n) \(unitSymbol(kind: reading.kind, fahrenheit: fahrenheit))"
+    }
+
     /// Trailing unit chip: `"°C"` / `"°F"` for absolute, `"Δ°C"` / `"Δ°F"` for deviation.
     public static func unitSymbol(kind: Kind, fahrenheit: Bool) -> String {
         let base = fahrenheit ? "°F" : "°C"
diff --git a/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift b/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift
index 5927df6788..96da2d1c62 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift
@@ -153,6 +153,19 @@ public struct DailyMetric: Equatable, Codable {
         days.last(where: { $0.skinTempDevC != nil && $0.day < todayKey })
     }
 
+    /// The freshest strictly-prior row carrying EITHER skin-temp number (#1844), so a surface can lead
+    /// with the absolute and fall back to the deviation from ONE night rather than mixing two.
+    ///
+    /// The OR here is deliberate and is NOT the #1842 defect. That bug read field X off a row selected on
+    /// (X or Y), so a row holding only Y blanked X. This selects a row for a value that is "whichever of
+    /// the two this night has", and the caller reads both fields off THAT row and lets
+    /// `SkinTempDisplay.leadReading` pick — so the chosen row always supplies the number shown, and an
+    /// absolute is never paired with another night's deviation. `lastSkinTempDay` stays as-is for the
+    /// deviation-only surfaces. Byte-twin of the Android `lastSkinTempReadingRow`.
+    public nonisolated static func lastSkinTempReadingDay(days: [DailyMetric], todayKey: String) -> DailyMetric? {
+        days.last(where: { ($0.skinTempC != nil || $0.skinTempDevC != nil) && $0.day < todayKey })
+    }
+
     /// PER-FIELD HRV carry — the twin of `lastSpo2Day` for a field `lastVitalsDay` DOES check, which is
     /// precisely why it needs one. That predicate is an OR across HRV / resting-HR / respiratory, so it
     /// resolves the freshest row carrying ANY of the three — including a respiratory-only row whose
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/DailyMetricLastVitalsDayTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/DailyMetricLastVitalsDayTests.swift
index 6f5554d876..752601e119 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/DailyMetricLastVitalsDayTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/DailyMetricLastVitalsDayTests.swift
@@ -194,4 +194,42 @@ final class DailyMetricLastVitalsDayTests: XCTestCase {
         XCTAssertNil(DailyMetric.lastRestingHrDay(days: days, todayKey: "2026-09-03"))
     }
 
+
+    // MARK: skin-temp reading row — EITHER number, one night (#1844)
+
+    private func skinDay(_ key: String, abs: Double? = nil, dev: Double? = nil) -> DailyMetric {
+        DailyMetric(day: key, totalSleepMin: nil, efficiency: nil, deepMin: nil, remMin: nil,
+                    lightMin: nil, disturbances: nil, restingHr: nil, avgHrv: nil, recovery: nil,
+                    strain: nil, exerciseCount: nil, spo2Pct: nil, skinTempDevC: dev,
+                    respRateBpm: nil, skinTempC: abs)
+    }
+
+    /// The calibrating night the deviation-only selector skipped: a real temperature, no deviation yet.
+    func testFindsANightWithOnlyAnAbsolute() {
+        let days = [skinDay("2026-09-01", dev: -0.3), skinDay("2026-09-02", abs: 34.1)]
+        XCTAssertEqual(DailyMetric.lastSkinTempReadingDay(days: days, todayKey: "2026-09-03")?.day, "2026-09-02")
+        // The deviation-only row reaches back past it, which is what left the card empty.
+        XCTAssertEqual(DailyMetric.lastSkinTempDay(days: days, todayKey: "2026-09-03")?.day, "2026-09-01")
+    }
+
+    /// Both numbers come off ONE row, so an absolute is never paired with another night's deviation.
+    func testBothSkinNumbersComeFromOneNight() {
+        let days = [skinDay("2026-09-01", abs: 33.0, dev: -0.9), skinDay("2026-09-02", abs: 34.1, dev: 0.2)]
+        let row = DailyMetric.lastSkinTempReadingDay(days: days, todayKey: "2026-09-03")
+        XCTAssertEqual(row?.skinTempC, 34.1)
+        XCTAssertEqual(row?.skinTempDevC, 0.2)
+    }
+
+    /// Same future-clock bound as every sibling carry.
+    func testSkinReadingRowNeverCarriesTodayOrLater() {
+        let days = [skinDay("2026-09-03", abs: 34.0), skinDay("2026-09-04", abs: 34.2)]
+        XCTAssertNil(DailyMetric.lastSkinTempReadingDay(days: days, todayKey: "2026-09-03"))
+    }
+
+    /// A row with neither number is not a reading.
+    func testSkinRowsWithNeitherNumberAreSkipped() {
+        let days = [skinDay("2026-09-01", abs: 33.5), skinDay("2026-09-02")]
+        XCTAssertEqual(DailyMetric.lastSkinTempReadingDay(days: days, todayKey: "2026-09-03")?.day, "2026-09-01")
+    }
+
 }
diff --git a/Strand/Data/Repository.swift b/Strand/Data/Repository.swift
index 620aec87a8..56a5de5612 100644
--- a/Strand/Data/Repository.swift
+++ b/Strand/Data/Repository.swift
@@ -608,6 +608,12 @@ final class Repository: ObservableObject {
         DailyMetric.lastSkinTempDay(days: days, todayKey: todayKey)
     }
 
+    /// The freshest strictly-prior row with EITHER skin-temp number (#1844), for the surfaces that lead
+    /// with the absolute. See `DailyMetric.lastSkinTempReadingDay`.
+    nonisolated static func lastSkinTempReadingDay(days: [DailyMetric], todayKey: String) -> DailyMetric? {
+        DailyMetric.lastSkinTempReadingDay(days: days, todayKey: todayKey)
+    }
+
     /// PER-FIELD HRV carry — twin of the above, for a field `lastVitalsDay`'s OR predicate DOES check but
     /// can still resolve nil on (#1842). See `DailyMetric.lastHrvDay`.
     nonisolated static func lastHrvDay(days: [DailyMetric], todayKey: String) -> DailyMetric? {
diff --git a/Strand/Data/Units.swift b/Strand/Data/Units.swift
index a6ff53544e..3cb050a09a 100644
--- a/Strand/Data/Units.swift
+++ b/Strand/Data/Units.swift
@@ -85,6 +85,11 @@ enum UnitPrefs {
     static let systemKey = "units.system"
     /// Temperature override. Empty string = "match the length/mass system" (the default).
     static let temperatureKey = "units.temperature"
+
+    /// #1846: which skin-temp number the cards lead with — absent/`""` = a temperature (the default), or
+    /// `SkinTempDisplay.Kind.deviation.rawValue` to lead with the ±baseline move. Display-only; nothing
+    /// stored ever changes. Same key string as the Android `units.skinTempDisplay` pref.
+    static let skinTempDisplayKey = "units.skinTempDisplay"
     /// Effort display scale (#268). Stored raw is an `EffortScale` rawValue; an unset/unknown value
     /// resolves to `.hundred` (NOOP's native axis). Mirrored on Android by NoopPrefs("effort.scale").
     static let effortScaleKey = "effort.scale"
diff --git a/Strand/Liquid/LiquidTodayView.swift b/Strand/Liquid/LiquidTodayView.swift
index e63b8469d3..0e88485115 100644
--- a/Strand/Liquid/LiquidTodayView.swift
+++ b/Strand/Liquid/LiquidTodayView.swift
@@ -116,6 +116,7 @@ struct LiquidTodayView: View {
     @State private var cachedRespDay: DailyMetric?
     @State private var cachedHrvDay: DailyMetric?
     @State private var cachedRestingHrDay: DailyMetric?
+    @State private var cachedSkinTempReadingDay: DailyMetric?
     /// The Charge hero's resolved state (#543 carry + the honest label), resolved ONCE in load() alongside
     /// the other caches. It composes `TodayView.lastScoredRecoveryDay`, which is O(days) — exactly the scan
     /// this cache exists to keep out of body. Never resolved in body.
@@ -188,6 +189,17 @@ struct LiquidTodayView: View {
     private var hrvDay: DailyMetric? { cachedHrvDay }
 
     private var restingHrDay: DailyMetric? { cachedRestingHrDay }
+
+    /// The skin-temp reading these cards LEAD with (#1844): today's row if it holds either number, else the
+    /// vitals carry, else the freshest prior row with either. Both numbers come off the SAME row, so an
+    /// absolute is never paired with another night's deviation. Twin of `TodayView.skinTempLeadReading`.
+    private var skinTempLeadReading: SkinTempDisplay.Reading? {
+        let row = [displayDay, vitalsDay, cachedSkinTempReadingDay]
+            .compactMap { $0 }
+            .first { $0.skinTempC != nil || $0.skinTempDevC != nil }
+        return SkinTempDisplay.leadReading(absC: row?.skinTempC, devC: row?.skinTempDevC,
+                                           prefer: SkinTempDisplay.Kind(rawValue: skinTempDisplayRaw) ?? .absolute)
+    }
     /// The Charge hero's resolved state (see `cachedChargeDisplay`), read O(1) from the cache.
     private var chargeDisplay: ChargeDisplay { cachedChargeDisplay }
 
@@ -941,9 +953,10 @@ struct LiquidTodayView: View {
             //
             // frac stays nil deliberately. A signed deviation has no natural 0–100 fill, and a ring drawn
             // from one would imply a magnitude the number does not carry.
-            let skin = displayDay?.skinTempDevC ?? vitalsDay?.skinTempDevC
+            // #1844: lead with the night's measured ABSOLUTE when it has one; deviation nights unchanged.
+            let skin = skinTempLeadReading
             cardLink(.metric("skin_temp"), title: card.title, sub: card.subtitle,
-                     value: TodayView.skinTempCardValue(skin, fahrenheit: temperatureUnit == .fahrenheit),
+                     value: TodayView.skinTempCardValue(reading: skin, fahrenheit: temperatureUnit == .fahrenheit),
                      tint: StrandPalette.metricAmber, frac: nil)
         case .calories:
             // #616: show the resolved imported-first value and route to the matching detail source, like
@@ -1245,10 +1258,9 @@ struct LiquidTodayView: View {
             // and the SAME `SkinTempDisplay` formatter every other skin-temp surface uses so a deviation
             // reads "+0.1 Δ°C" here exactly as it does on "Your Cards"/the Deep Timeline, never the plain
             // `%+.1f°` that read a fabricated absolute value for a signed deviation (#622).
-            let skinValue = displayDay?.skinTempDevC ?? vitalsDay?.skinTempDevC
-            let skinText = skinValue.map {
-                SkinTempDisplay.format($0, fahrenheit: temperatureUnit == .fahrenheit)
-            } ?? "—"
+            // #1844: same lead-with-the-absolute resolution as "Your Cards" above, so the two agree.
+            let skinText = TodayView.skinTempCardValue(reading: skinTempLeadReading,
+                                                       fahrenheit: temperatureUnit == .fahrenheit)
             // The card's own unit is deliberately empty — the value carries "°C"/"Δ°F" itself, same as
             // the classic TodayView Skin Temp card.
             ktile(String(localized: "Skin Temp"), icon: keyMetricIcon(metric), skinText, "", StrandPalette.metricAmber, nil, key: "skin_temp")
@@ -1447,6 +1459,7 @@ struct LiquidTodayView: View {
         cachedRespDay = (selectedDayOffset == 0) ? Repository.lastRespDay(days: repo.days, todayKey: tkey) : nil
         cachedHrvDay = (selectedDayOffset == 0) ? Repository.lastHrvDay(days: repo.days, todayKey: tkey) : nil
         cachedRestingHrDay = (selectedDayOffset == 0) ? Repository.lastRestingHrDay(days: repo.days, todayKey: tkey) : nil
+        cachedSkinTempReadingDay = (selectedDayOffset == 0) ? Repository.lastSkinTempReadingDay(days: repo.days, todayKey: tkey) : nil
         // Charge carry (#543) + the honest label, resolved here for the same reason as the two above: the
         // selector below scans repo.days. Calibration nights come from the SAME `RecoveryScorer` helper the
         // classic Today reads, so the two screens agree on when a wearer is genuinely mid-calibration
@@ -1767,6 +1780,7 @@ struct LiquidTodayView: View {
     @AppStorage(UnitPrefs.systemKey) private var unitSystemRaw = UnitSystem.metric.rawValue
     private var unitSystem: UnitSystem { UnitSystem(rawValue: unitSystemRaw) ?? .metric }
     @AppStorage(UnitPrefs.temperatureKey) private var temperatureRaw = ""
+    @AppStorage(UnitPrefs.skinTempDisplayKey) private var skinTempDisplayRaw = ""   // #1846
     private var temperatureUnit: TemperatureUnit {
         UnitPrefs.resolveTemperature(system: unitSystem, override: temperatureRaw)
     }
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 5f947529f9..7af9492720 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -156400,6 +156400,64 @@
         }
       }
     },
+    "Skin temperature display": {
+      "localizations": {
+        "de": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Hauttemperatur-Anzeige"
+          }
+        },
+        "es": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Visualización de temperatura cutánea"
+          }
+        },
+        "fr": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Affichage de la température cutanée"
+          }
+        },
+        "it": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Visualizzazione temperatura cutanea"
+          }
+        },
+        "pl": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Wyświetlanie temperatury skóry"
+          }
+        },
+        "pt-PT": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Apresentação da temperatura da pele"
+          }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Отображение температуры кожи"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "皮肤温度显示"
+          }
+        },
+        "zh-Hant": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "皮膚溫度顯示"
+          }
+        }
+      }
+    },
     "Temperature unit": {
       "localizations": {
         "de": {
diff --git a/Strand/Screens/HealthView.swift b/Strand/Screens/HealthView.swift
index a01a2b9643..b168717dae 100644
--- a/Strand/Screens/HealthView.swift
+++ b/Strand/Screens/HealthView.swift
@@ -1236,6 +1236,7 @@ private struct VitalsSection: View {
     // Temperature display preference (D#103). Skin temp is stored in °C (absolute or a ±deviation); the
     // toggle re-labels it to °F. Display-only — banding still runs on the stored °C value.
     @AppStorage(UnitPrefs.systemKey) private var unitSystemRaw = UnitSystem.metric.rawValue
+    @AppStorage(UnitPrefs.skinTempDisplayKey) private var skinTempDisplayRaw = ""   // #1846
     @AppStorage(UnitPrefs.temperatureKey) private var temperatureRaw = ""
     private var temperatureUnit: TemperatureUnit {
         let system = UnitSystem(rawValue: unitSystemRaw) ?? .metric
@@ -1253,7 +1254,8 @@ private struct VitalsSection: View {
             sourceRows: repo.vitalMetricRows,
             temperatureUnit: temperatureUnit,
             spo2CandidateByDay: spo2CandidateByDay,
-            hrvOverCountByDay: hrvOverCountByDay
+            hrvOverCountByDay: hrvOverCountByDay,
+            skinTempPreferred: SkinTempDisplay.Kind(rawValue: skinTempDisplayRaw) ?? .absolute   // #1846
         )
         VStack(alignment: .leading, spacing: NoopMetrics.gap) {
             SectionHeader("Vital Signs", overline: "Latest", trailing: BodyVitalSigns.latestDayLabel(readings))
diff --git a/Strand/Screens/SettingsView.swift b/Strand/Screens/SettingsView.swift
index 645a994301..da168d6676 100644
--- a/Strand/Screens/SettingsView.swift
+++ b/Strand/Screens/SettingsView.swift
@@ -182,6 +182,7 @@ struct SettingsView: View {
     private var clockFormatRaw = ClockFormatPreference.system.rawValue
     @AppStorage(UnitPrefs.systemKey) private var unitSystemRaw = UnitSystem.metric.rawValue
     @AppStorage(UnitPrefs.temperatureKey) private var temperatureRaw = ""
+    @AppStorage(UnitPrefs.skinTempDisplayKey) private var skinTempDisplayRaw = ""   // #1846
     // Effort display scale (#268). Display-only — Effort stays stored 0–100, this only chooses whether
     // it's shown on NOOP's 0–100 axis or WHOOP's 0–21 Day Strain axis.
     @AppStorage(UnitPrefs.effortScaleKey) private var effortScaleRaw = EffortScale.hundred.rawValue
@@ -995,6 +996,20 @@ struct SettingsView: View {
                     .accessibilityLabel("Temperature unit")
                 }
                 rowDivider
+                FormRow(label: "Skin temperature") {
+                    // #1846: lead with a temperature ("33.5 °C") or with the move from your own baseline
+                    // ("-0.1 Δ°C"). Only a PREFERENCE — a night that measured just one of the two still
+                    // shows that one, so the choice can never blank a card.
+                    Picker("Skin temperature", selection: $skinTempDisplayRaw) {
+                        Text("Temperature").tag("")
+                        Text("vs baseline").tag(SkinTempDisplay.Kind.deviation.rawValue)
+                    }
+                    .labelsHidden()
+                    .pickerStyle(.menu)
+                    .tint(StrandPalette.accent)
+                    .accessibilityLabel("Skin temperature display")
+                }
+                rowDivider
                 // Effort scale (#268) — show NOOP's native 0–100 Effort or WHOOP's 0–21 Day Strain axis.
                 // Display-only; the stored value never changes, so a flip just re-labels every Effort read-out.
                 FormRow(label: "Effort scale") {
diff --git a/Strand/Screens/TodayView.swift b/Strand/Screens/TodayView.swift
index 74a4ee121d..a54cc24d19 100644
--- a/Strand/Screens/TodayView.swift
+++ b/Strand/Screens/TodayView.swift
@@ -227,6 +227,7 @@ struct TodayView: View {
     /// `MetricExplorerView`, Liquid Today): the explicit override when set, else derived from the unit
     /// system. This screen used to print a bare `%+.1f°` and was the last one ignoring the preference.
     @AppStorage(UnitPrefs.temperatureKey) private var temperatureRaw = ""
+    @AppStorage(UnitPrefs.skinTempDisplayKey) private var skinTempDisplayRaw = ""   // #1846
     private var temperatureUnit: TemperatureUnit {
         UnitPrefs.resolveTemperature(system: unitSystem, override: temperatureRaw)
     }
@@ -604,10 +605,29 @@ struct TodayView: View {
         return Repository.lastRestingHrDay(days: repo.days, todayKey: displayDay?.day ?? selectedDayKey)
     }
 
-    /// PER-FIELD skin-temperature-deviation carry — twin of `lastSpo2Day`; mirrors the Android `lastSkinTempRow`.
-    private var lastSkinTempDay: DailyMetric? {
+    /// The carry for the surfaces that LEAD WITH THE ABSOLUTE (#1844): the freshest strictly-prior row
+    /// holding EITHER skin-temp number, so a calibrating night — real temperature, no deviation yet — is
+    /// found instead of being skipped for an older deviation. Mirrors the Android `lastSkinTempReadingRow`.
+    private var lastSkinTempReadingDay: DailyMetric? {
         guard selectedDayOffset == 0 else { return nil }
-        return Repository.lastSkinTempDay(days: repo.days, todayKey: displayDay?.day ?? selectedDayKey)
+        return Repository.lastSkinTempReadingDay(days: repo.days, todayKey: displayDay?.day ?? selectedDayKey)
+    }
+
+    /// The skin-temp reading a Today surface leads with: today's row if it has either number, else the
+    /// carry. Both numbers always come off the SAME row, so an absolute is never paired with another
+    /// night's deviation.
+    private var skinTempLeadReading: SkinTempDisplay.Reading? {
+        let row = [displayDay, lastVitalsDay, lastSkinTempReadingDay]
+            .compactMap { $0 }
+            .first { $0.skinTempC != nil || $0.skinTempDevC != nil }
+        return SkinTempDisplay.leadReading(absC: row?.skinTempC, devC: row?.skinTempDevC,
+                                           prefer: skinTempPreferred)
+    }
+
+    /// The user's Settings choice (#1846), resolved from the stored raw. Absent/unrecognised reads as
+    /// `.absolute`, so an install that never opens Settings behaves exactly as before the setting existed.
+    private var skinTempPreferred: SkinTempDisplay.Kind {
+        SkinTempDisplay.Kind(rawValue: skinTempDisplayRaw) ?? .absolute
     }
 
     /// PER-FIELD respiratory carry, and the only one of these that is STALENESS-BOUNDED
@@ -2638,9 +2658,9 @@ struct TodayView: View {
             // deviation, and converts a DELTA by the scale factor alone rather than the absolute formula.
             // The card's own unit is deliberately empty — the value carries "°C" / "Δ°F" itself.
             // Same per-field carry as Blood Oxygen; both are sparse enough that an old reading is honest.
-            return Self.skinTempCardValue(
-                d?.skinTempDevC ?? lastVitalsDay?.skinTempDevC ?? lastSkinTempDay?.skinTempDevC,
-                fahrenheit: temperatureUnit == .fahrenheit)
+            // #1844: lead with the night's measured ABSOLUTE when it has one (the #1665 rule, applied
+            // here too) — a deviation with no anchor cannot be read. Deviation-only nights are unchanged.
+            return Self.skinTempCardValue(reading: skinTempLeadReading, fahrenheit: temperatureUnit == .fahrenheit)
         case .sleep:
             return sleepValue(d)
         case .steps:
@@ -3883,10 +3903,10 @@ struct TodayView: View {
             // already a "Your Cards" tile (`DashboardCard.skinTemp`), never a Key Metrics one. Reuses the
             // SAME value chain and `skinTempCardValue` formatter the "Your Cards" case above already
             // uses, so the two tiles can never disagree.
-            let skinTempValue = d?.skinTempDevC ?? lastVitalsDay?.skinTempDevC ?? lastSkinTempDay?.skinTempDevC
+            let skinTempValue = skinTempLeadReading
             StatTile(
                 label: "Skin Temp",
-                value: Self.skinTempCardValue(skinTempValue, fahrenheit: temperatureUnit == .fahrenheit),
+                value: Self.skinTempCardValue(reading: skinTempValue, fahrenheit: temperatureUnit == .fahrenheit),
                 caption: skinTempValue == nil ? Self.needsStrapCaption : "",
                 accent: skinTempValue == nil ? StrandPalette.textPrimary : StrandPalette.metricAmber,
                 sparkline: sparks["skin_temp"],
@@ -4994,6 +5014,15 @@ struct TodayView: View {
 
     /// The Skin Temp card's value, extracted so the bimodal-column decision can be unit-tested without a
     /// live view. Nil (no reading anywhere in the carry chain) reads as an em-dash rather than a number.
+    /// The Skin Temp card's value when the surface LEADS WITH THE ABSOLUTE (#1844) — the row supplies both
+    /// numbers and `SkinTempDisplay.leadReading` picks, so a night that measured a real temperature shows
+    /// one and only a night without falls back to the signed deviation. Nil (neither number anywhere in the
+    /// carry chain) reads as an em-dash. The `Double?` sibling below stays for the deviation-only callers.
+    static func skinTempCardValue(reading: SkinTempDisplay.Reading?, fahrenheit: Bool) -> String {
+        guard let reading else { return "—" }
+        return SkinTempDisplay.formatReading(reading, fahrenheit: fahrenheit)
+    }
+
     static func skinTempCardValue(_ value: Double?, fahrenheit: Bool) -> String {
         guard let value else { return "—" }
         return SkinTempDisplay.format(value, fahrenheit: fahrenheit)
diff --git a/Strand/Screens/VitalSignsSummary.swift b/Strand/Screens/VitalSignsSummary.swift
index 9756aa5f63..a56dc67a84 100644
--- a/Strand/Screens/VitalSignsSummary.swift
+++ b/Strand/Screens/VitalSignsSummary.swift
@@ -133,7 +133,10 @@ enum BodyVitalSigns {
                          temperatureUnit: TemperatureUnit,
                          now: Date = Date(),
                          spo2CandidateByDay: [String: Double] = [:],
-                         hrvOverCountByDay: [String: Double] = [:]) -> [BodyVitalReading] {
+                         hrvOverCountByDay: [String: Double] = [:],
+                         // #1846: the Settings lead-with choice, so this tile agrees with Today and the
+                         // detail screen. A setting that reaches two of three surfaces is worse than none.
+                         skinTempPreferred: SkinTempDisplay.Kind = .absolute) -> [BodyVitalReading] {
         let logicalDay = logicalDayKey(now)
 
         // Resolve one metric to a per-day series, taking the FIRST source (by precedence) that carries
@@ -238,8 +241,14 @@ enum BodyVitalSigns {
         // sitting unshown behind it).
         let skinAbsCandidate = latest(skinAbsPoints)
         let skinRowDay: String? = [skinRowDeviation?.day, skinAbsCandidate?.day].compactMap { $0 }.max()
-        let skinAbsRow = skinAbsCandidate.flatMap { $0.day == skinRowDay ? $0 : nil }
-        let skinRow = skinAbsRow ?? skinRowDeviation
+        let skinAbsCandidateOnDay = skinAbsCandidate.flatMap { $0.day == skinRowDay ? $0 : nil }
+        // #1846: the same `leadReading` rule the other surfaces use — the preference picks which number is
+        // tried first, the other stays the fallback, so choosing one never empties the tile.
+        let skinLeadsAbsolute = SkinTempDisplay.leadReading(absC: skinAbsCandidateOnDay?.value,
+                                                            devC: skinRowDeviation?.value,
+                                                            prefer: skinTempPreferred)?.kind == .absolute
+        let skinAbsRow = skinLeadsAbsolute ? skinAbsCandidateOnDay : nil
+        let skinRow = skinAbsRow ?? skinRowDeviation ?? skinAbsCandidateOnDay
         let skin = skinRow?.value
         let skinIsAbsolute = skinAbsRow != nil || (skin.map(VitalBands.isAbsoluteSkinTemp) ?? true)
         // The series the tile is actually showing — banding and the sparkline must both read from it, or
diff --git a/android/app/src/main/java/com/noop/analytics/SkinTempDisplay.kt b/android/app/src/main/java/com/noop/analytics/SkinTempDisplay.kt
index 0f9052a7ed..4789a8b016 100644
--- a/android/app/src/main/java/com/noop/analytics/SkinTempDisplay.kt
+++ b/android/app/src/main/java/com/noop/analytics/SkinTempDisplay.kt
@@ -12,11 +12,22 @@ package com.noop.analytics
  */
 object SkinTempDisplay {
 
-    enum class Kind {
+    /**
+     * [raw] is the PERSISTED form of the #1846 setting and is byte-identical to the Swift `Kind.rawValue`
+     * — lower-case, so `name` ("DEVIATION") must never be written to prefs. Same reasoning as
+     * `KeyMetric.raw`: two independent implementations must not drift on how they spell a stored token,
+     * and this one shares the `units.skinTempDisplay` key with Apple.
+     */
+    enum class Kind(val raw: String) {
         /** Absolute wrist temperature (°C scale, typically ~30–35 worn). */
-        ABSOLUTE,
+        ABSOLUTE("absolute"),
         /** Signed deviation from the personal nightly baseline (±°C). */
-        DEVIATION,
+        DEVIATION("deviation"),
+        ;
+
+        companion object {
+            fun fromRaw(raw: String?): Kind? = entries.firstOrNull { it.raw == raw }
+        }
     }
 
     /**
@@ -43,6 +54,45 @@ object SkinTempDisplay {
     fun kind(value: Double): Kind =
         if (VitalBands.isAbsoluteSkinTemp(value)) Kind.ABSOLUTE else Kind.DEVIATION
 
+    /** A resolved reading: the number to show and the scale it is on. */
+    data class Reading(val value: Double, val kind: Kind)
+
+    /**
+     * Which of a night's two skin-temp numbers a surface should LEAD with (#1844), the pure form of the
+     * rule `HealthVitalsLogic.skinTempLeadsWithAbsolute` has applied since #1665.
+     *
+     * The absolute wins whenever the night measured one, because a deviation with no anchor cannot be
+     * read — "+0.9" is a fever or a warm bedroom and nothing on a card says which. The deviation is the
+     * fallback, not the default, and it still carries its Δ unit so it is never mistaken for a wrist
+     * temperature (#622).
+     *
+     * Two shapes make this more than a preference, and both are real rows rather than hypotheticals:
+     *  - a night scored before `skinTempC` shipped (2026-08-27) has only a deviation, and keeps exactly
+     *    the display that shipped before until a scoring pass refills it;
+     *  - a CALIBRATING night is the reverse — `recomputeSkinTempDev` returns null until the baseline is
+     *    usable (~4 nights) while the absolute is measured from night one, so those wearers otherwise see
+     *    an empty card with a real temperature sitting behind it.
+     *
+     * [prefer] is the user's Settings choice (#1846): ABSOLUTE — the default, a temperature — or DEVIATION
+     * for wearers who read the ±baseline move, which is the more sensitive illness signal. It picks which
+     * number is tried FIRST; the other is still the fallback, so choosing one never blanks a card whose
+     * night only measured the other, and the unit always names the scale actually shown.
+     *
+     * Both values must come from the SAME row; see `lastSkinTempReadingRow`. Twin of the Swift
+     * `SkinTempDisplay.leadReading`.
+     */
+    fun leadReading(absC: Double?, devC: Double?, prefer: Kind = Kind.ABSOLUTE): Reading? {
+        val first = if (prefer == Kind.ABSOLUTE) absC else devC
+        first?.let { return Reading(it, prefer) }
+        val other = if (prefer == Kind.ABSOLUTE) devC else absC
+        val otherKind = if (prefer == Kind.ABSOLUTE) Kind.DEVIATION else Kind.ABSOLUTE
+        return other?.let { Reading(it, otherKind) }
+    }
+
+    /** Formats whichever number [leadReading] chose, with the unit for THAT scale. */
+    fun formatReading(reading: Reading, fahrenheit: Boolean, decimals: Int = 1): String =
+        "${numberString(reading.value, reading.kind, fahrenheit, decimals)} ${unitSymbol(reading.kind, fahrenheit)}"
+
     /** Trailing unit chip: `"°C"` / `"°F"` for absolute, `"Δ°C"` / `"Δ°F"` for deviation. */
     fun unitSymbol(kind: Kind, fahrenheit: Boolean): String {
         val base = if (fahrenheit) "°F" else "°C"
diff --git a/android/app/src/main/java/com/noop/data/BackupSettings.kt b/android/app/src/main/java/com/noop/data/BackupSettings.kt
index ed8b0de398..c7972cc7bd 100644
--- a/android/app/src/main/java/com/noop/data/BackupSettings.kt
+++ b/android/app/src/main/java/com/noop/data/BackupSettings.kt
@@ -55,6 +55,7 @@ object BackupSettingsCodec {
         "profile.hrZoneThresholds" to Kind.STRING,
         "units.system" to Kind.STRING,
         "units.temperature" to Kind.STRING,
+        "units.skinTempDisplay" to Kind.STRING,   // #1846, carried like the other display units
         "effort.scale" to Kind.STRING,
         // The ONE layout pref carried (#today-hosted-cards): the Trends/Sleep cards the user chose to host
         // in Today, a JSON [String] of ids. Unlike section order, this is a deliberate composition the user
@@ -145,6 +146,11 @@ object BackupSettingsBridge {
         if (noop.contains(NoopPrefs.KEY_TEMPERATURE_UNIT)) {
             noop.getString(NoopPrefs.KEY_TEMPERATURE_UNIT, null)?.let { values["units.temperature"] = it }
         }
+        // #1846: carried like the other display units. The whitelist entry alone does NOTHING — export and
+        // import are both explicit per key here, so a whitelisted-but-unwired pref silently never restores.
+        if (noop.contains(NoopPrefs.KEY_SKIN_TEMP_DISPLAY)) {
+            noop.getString(NoopPrefs.KEY_SKIN_TEMP_DISPLAY, null)?.let { values["units.skinTempDisplay"] = it }
+        }
         if (noop.contains(UnitPrefs.KEY_EFFORT_SCALE)) {
             noop.getString(UnitPrefs.KEY_EFFORT_SCALE, null)?.let { values["effort.scale"] = it }
         }
@@ -185,6 +191,12 @@ object BackupSettingsBridge {
             if (raw.isEmpty()) editor.remove(NoopPrefs.KEY_TEMPERATURE_UNIT)
             else editor.putString(NoopPrefs.KEY_TEMPERATURE_UNIT, raw)
         }
+        (values["units.skinTempDisplay"] as? String)?.let { raw ->
+            // Absent/"" is "lead with a temperature", stored as key-absent — same convention as the
+            // temperature override above, and what an older backup without this key restores to.
+            if (raw.isEmpty()) editor.remove(NoopPrefs.KEY_SKIN_TEMP_DISPLAY)
+            else editor.putString(NoopPrefs.KEY_SKIN_TEMP_DISPLAY, raw)
+        }
         (values["effort.scale"] as? String)?.let { editor.putString(UnitPrefs.KEY_EFFORT_SCALE, it) }
         (values[HostedCardPrefs.KEY_SELECTION] as? String)?.let { editor.putString(HostedCardPrefs.KEY_SELECTION, it) }
         // #1361: restore custom behaviours — write the names to the legacy custom key, clear stale hidden,
diff --git a/android/app/src/main/java/com/noop/ui/HealthScreen.kt b/android/app/src/main/java/com/noop/ui/HealthScreen.kt
index 04b5cbd23d..03a5063b21 100644
--- a/android/app/src/main/java/com/noop/ui/HealthScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/HealthScreen.kt
@@ -1219,8 +1219,13 @@ fun VitalSignsScreen(vm: AppViewModel, onVitalClick: (String) -> Unit = {}) {
     // Read the toggle here in the composable body, NOT inside remember{} — LocalContext.current is a
     // @Composable read and is illegal inside the calculation lambda; pass the resolved value in + key on it.
     val spo2CandidateDisplay = NoopPrefs.spo2CandidateDisplay(LocalContext.current)
-    val vitals = remember(selectedMetric, days, tempUnit, spo2CandidateByDay, spo2CandidateDisplay, hrvOverCountByDay) {
-        selectedMetric?.let { vitalsFor(it, days, tempUnit, spo2CandidateByDay, spo2CandidateDisplay, hrvOverCountByDay) }.orEmpty()
+    val skinTempPreferred = UnitPrefs.skinTempPreferred(LocalContext.current)   // #1846, same rule
+    val vitals = remember(selectedMetric, days, tempUnit, spo2CandidateByDay, spo2CandidateDisplay,
+                          hrvOverCountByDay, skinTempPreferred) {
+        selectedMetric?.let {
+            vitalsFor(it, days, tempUnit, spo2CandidateByDay, spo2CandidateDisplay, hrvOverCountByDay,
+                      skinTempPreferred)   // #1846
+        }.orEmpty()
     }
 
     ScreenScaffold(
@@ -1898,9 +1903,12 @@ fun VitalDetailScreen(vm: AppViewModel, key: String) {
             seriesLoaded = true
         }
     }
+    // #1846: read the preference OUTSIDE remember (a Composable call is not allowed in its calculation)
+    // and make it a KEY, so flipping the setting rebuilds the model instead of serving a cached one.
+    val skinTempPreferred = UnitPrefs.skinTempPreferred(LocalContext.current)
     val detail = if (isSeriesBacked) seriesDetail
-    else remember(days, key, tempUnit, effortScale, spo2CandidateByDay) {
-        buildVitalDetail(days, key, tempUnit, effortScale, spo2CandidateByDay)
+    else remember(days, key, tempUnit, effortScale, spo2CandidateByDay, skinTempPreferred) {
+        buildVitalDetail(days, key, tempUnit, effortScale, spo2CandidateByDay, skinTempPreferred)
     }
     var range by remember { mutableStateOf(VitalDetailRange.MONTH) }
 
@@ -2226,6 +2234,9 @@ private fun buildVitalDetail(
     tempUnit: TemperatureUnit,
     effortScale: EffortScale = EffortScale.HUNDRED,
     spo2CandidateByDay: Map<String, Double> = emptyMap(),
+    // #1846: travels like tempUnit — read from prefs by the caller, never defaulted quietly here, so the
+    // setting cannot look wired while doing nothing.
+    skinTempPreferred: SkinTempDisplay.Kind = SkinTempDisplay.Kind.ABSOLUTE,
 ): VitalDetailModel? {
     return when (key) {
     // The Today Key-Metrics Recovery tile's drill-in: the Recovery (Charge) trend timeline, matching the
@@ -2292,9 +2303,19 @@ private fun buildVitalDetail(
         format = { it.roundToInt().toString() },
     )
     "skin" -> {
-        val latest = days.asReversed().asSequence().mapNotNull { it.skinTempDevC }.firstOrNull() ?: return null
-        val kind = SkinTempDisplay.kind(latest)
         val fahrenheit = tempUnit == TemperatureUnit.FAHRENHEIT
+        // #1844: the newest reading decides the whole screen — title, unit, chart and every row — and it
+        // leads with the measured ABSOLUTE when that night has one (the #1665 rule, applied here too).
+        // The series must follow the same choice: an absolute plotted against a history of deviations is
+        // arithmetic on two scales, so the readings come from the matching column only.
+        val newest = days.asReversed().asSequence()
+            .firstOrNull { it.skinTempC != null || it.skinTempDevC != null } ?: return null
+        val lead = SkinTempDisplay.leadReading(newest.skinTempC, newest.skinTempDevC, skinTempPreferred)
+            ?: return null
+        val leadsAbsolute = lead.kind == SkinTempDisplay.Kind.ABSOLUTE && newest.skinTempC != null
+        // Deviation-led keeps the #622 bimodal read: a CSV import writes an absolute INTO skinTempDevC, so
+        // the kind is re-derived from the value and the series partitioned to it.
+        val kind = if (leadsAbsolute) SkinTempDisplay.Kind.ABSOLUTE else SkinTempDisplay.kind(lead.value)
         val unit = SkinTempDisplay.unitSymbol(kind, fahrenheit)
         val title = if (kind == SkinTempDisplay.Kind.ABSOLUTE) {
             uiString(R.string.l10n_health_screen_skin_temperature_f59127f6)
@@ -2306,10 +2327,14 @@ private fun buildVitalDetail(
             title = title,
             unit = unit,
             color = Palette.metricAmber,
-            readings = days.mapNotNull { row ->
-                row.skinTempDevC
-                    ?.takeIf { VitalBands.isAbsoluteSkinTemp(it) == (kind == SkinTempDisplay.Kind.ABSOLUTE) }
-                    ?.let { value -> VitalReading(row.day, value, row.deviceId) }
+            readings = if (leadsAbsolute) {
+                days.mapNotNull { row -> row.skinTempC?.let { VitalReading(row.day, it, row.deviceId) } }
+            } else {
+                days.mapNotNull { row ->
+                    row.skinTempDevC
+                        ?.takeIf { VitalBands.isAbsoluteSkinTemp(it) == (kind == SkinTempDisplay.Kind.ABSOLUTE) }
+                        ?.let { value -> VitalReading(row.day, value, row.deviceId) }
+                }
             },
             format = { c -> SkinTempDisplay.numberString(c, kind, fahrenheit, decimals = 1) },
         )
diff --git a/android/app/src/main/java/com/noop/ui/HealthVitalsLogic.kt b/android/app/src/main/java/com/noop/ui/HealthVitalsLogic.kt
index 3e3da2a8e9..8f358d01eb 100644
--- a/android/app/src/main/java/com/noop/ui/HealthVitalsLogic.kt
+++ b/android/app/src/main/java/com/noop/ui/HealthVitalsLogic.kt
@@ -114,7 +114,11 @@ internal data class Vital(
  *
  * Twin of the Swift tile's `skinAbsRow != nil` branch.
  */
-internal fun skinTempLeadsWithAbsolute(absC: Double?): Boolean = absC != null
+internal fun skinTempLeadsWithAbsolute(
+    absC: Double?,
+    devC: Double? = null,
+    prefer: SkinTempDisplay.Kind = SkinTempDisplay.Kind.ABSOLUTE,
+): Boolean = SkinTempDisplay.leadReading(absC, devC, prefer)?.kind == SkinTempDisplay.Kind.ABSOLUTE
 
 /**
  * The deviation note shown beneath an absolute skin temperature — "+0.2 Δ°F" (#1636).
@@ -170,6 +174,9 @@ internal fun vitalsFor(
     spo2CandidateByDay: Map<String, Double> = emptyMap(),
     spo2ToggleOn: Boolean = false,
     hrvOverCountByDay: Map<String, Double> = emptyMap(),   // #1118
+    // #1846: the Settings lead-with choice. Travels like tempUnit so the Health tile agrees with Today
+    // and the detail screen — a setting that reaches two of three surfaces is worse than none.
+    skinTempPreferred: SkinTempDisplay.Kind = SkinTempDisplay.Kind.ABSOLUTE,
 ): List<Vital> {
     val todayKey = d?.day
     // History strictly before the displayed day, oldest→newest (recentDays is already
@@ -208,7 +215,7 @@ internal fun vitalsFor(
     // display that shipped before, unchanged. `leadsAbsolute` also decides which SERIES backs the
     // banding and the trail below — an absolute scored against a history of deviations would be
     // nonsense, so the two must move together.
-    val leadsAbsolute = skinTempLeadsWithAbsolute(d?.skinTempC)
+    val leadsAbsolute = skinTempLeadsWithAbsolute(d?.skinTempC, d?.skinTempDevC, skinTempPreferred)
     val skin = if (leadsAbsolute) d?.skinTempC else d?.skinTempDevC
     // Track which kind the value is so the temperature converter picks the right rule: an ABSOLUTE
     // reading uses the full C→F formula (×9/5 + 32); a ±DEVIATION must omit the offset.
@@ -385,8 +392,12 @@ internal fun latestVitals(
     spo2CandidateByDay: Map<String, Double> = emptyMap(),
     spo2ToggleOn: Boolean = false,
     hrvOverCountByDay: Map<String, Double> = emptyMap(),   // #1118
+    // #1846: the Settings lead-with choice. Travels like tempUnit so the Health tile agrees with Today
+    // and the detail screen — a setting that reaches two of three surfaces is worse than none.
+    skinTempPreferred: SkinTempDisplay.Kind = SkinTempDisplay.Kind.ABSOLUTE,
 ): List<Vital> {
-    val emptyByKey = vitalsFor(null, days, tempUnit, spo2CandidateByDay, spo2ToggleOn, hrvOverCountByDay).associateBy { it.key }
+    val emptyByKey = vitalsFor(null, days, tempUnit, spo2CandidateByDay, spo2ToggleOn, hrvOverCountByDay,
+                               skinTempPreferred).associateBy { it.key }
     return listOf(
         latestVital("resp", days, tempUnit, emptyByKey, spo2CandidateByDay, spo2ToggleOn) { it.respRateBpm != null },
         latestVital("spo2", days, tempUnit, emptyByKey, spo2CandidateByDay, spo2ToggleOn) {
@@ -395,7 +406,12 @@ internal fun latestVitals(
         latestVital("spo2raw", days, tempUnit, emptyByKey, spo2CandidateByDay, spo2ToggleOn) { it.spo2Red != null && it.spo2Ir != null },
         latestVital("rhr", days, tempUnit, emptyByKey, spo2CandidateByDay, spo2ToggleOn) { it.restingHr != null },
         latestVital("hrv", days, tempUnit, emptyByKey, hrvOverCountByDay = hrvOverCountByDay) { it.avgHrv != null },
-        latestVital("skin", days, tempUnit, emptyByKey) { it.skinTempDevC != null },
+        // #1846: pass the preference (the other keys' rows don't read it). The predicate takes EITHER
+        // number for the same reason `lastSkinTempReadingRow` does — a calibrating night has a measured
+        // absolute and no deviation yet, and a deviation-only test walks straight past it.
+        latestVital("skin", days, tempUnit, emptyByKey, skinTempPreferred = skinTempPreferred) {
+            it.skinTempC != null || it.skinTempDevC != null
+        },
     )
 }
 
@@ -416,6 +432,7 @@ private fun latestVital(
     spo2ToggleOn: Boolean = false,
     hrvOverCountByDay: Map<String, Double> = emptyMap(),   // #1118
     todayKey: String = logicalDayKeyNow(),
+    skinTempPreferred: SkinTempDisplay.Kind = SkinTempDisplay.Kind.ABSOLUTE,   // #1846
     hasValue: (DailyMetric) -> Boolean,
 ): Vital {
     val row = Baselines.freshestCarried(
@@ -423,7 +440,10 @@ private fun latestVital(
         todayKey,
     )?.second
     return row
-        ?.let { latestRow -> vitalsFor(latestRow, days, tempUnit, spo2CandidateByDay, spo2ToggleOn, hrvOverCountByDay).firstOrNull { it.key == key } }
+        ?.let { latestRow ->
+            vitalsFor(latestRow, days, tempUnit, spo2CandidateByDay, spo2ToggleOn, hrvOverCountByDay,
+                      skinTempPreferred).firstOrNull { it.key == key }
+        }
         ?.copy(asOfLabel = asOfLabel(row.day))
         ?: emptyByKey.getValue(key)
 }
diff --git a/android/app/src/main/java/com/noop/ui/LogicalDay.kt b/android/app/src/main/java/com/noop/ui/LogicalDay.kt
index fafe7e4fc2..42bc4dcb88 100644
--- a/android/app/src/main/java/com/noop/ui/LogicalDay.kt
+++ b/android/app/src/main/java/com/noop/ui/LogicalDay.kt
@@ -130,6 +130,22 @@ internal fun lastHrvRow(days: List<DailyMetric>, todayKey: String): DailyMetric?
 internal fun lastRestingHrRow(days: List<DailyMetric>, todayKey: String): DailyMetric? =
     days.lastOrNull { it.restingHr != null && it.day < todayKey }
 
+/**
+ * The freshest strictly-prior row carrying EITHER skin-temp number (#1844), so a surface can lead with
+ * the absolute and fall back to the deviation from ONE night rather than mixing two.
+ *
+ * The OR here is deliberate and is NOT the #1842 defect. That bug read field X off a row selected on
+ * (X or Y), so a row holding only Y blanked X. This selects a row for a value that is "whichever of the
+ * two this night has", and the caller reads both fields off THAT row and lets
+ * [com.noop.analytics.SkinTempDisplay.leadReading] pick — so the chosen row always supplies the number
+ * shown, and the absolute and its deviation note always describe the same night.
+ *
+ * [lastSkinTempRow] stays as-is for the deviation-only surfaces. Twin of the Swift
+ * `DailyMetric.lastSkinTempReadingDay`.
+ */
+internal fun lastSkinTempReadingRow(days: List<DailyMetric>, todayKey: String): DailyMetric? =
+    days.lastOrNull { (it.skinTempC != null || it.skinTempDevC != null) && it.day < todayKey }
+
 /** PER-FIELD twin of [lastVitalsRow] for skin temperature deviation. See [lastSpo2Row]. */
 internal fun lastSkinTempRow(days: List<DailyMetric>, todayKey: String): DailyMetric? =
     days.lastOrNull { it.skinTempDevC != null && it.day < todayKey }
diff --git a/android/app/src/main/java/com/noop/ui/MainActivity.kt b/android/app/src/main/java/com/noop/ui/MainActivity.kt
index 42c86f1392..19c5515e5d 100644
--- a/android/app/src/main/java/com/noop/ui/MainActivity.kt
+++ b/android/app/src/main/java/com/noop/ui/MainActivity.kt
@@ -719,11 +719,25 @@ object NoopPrefs {
     const val KEY_UNIT_SYSTEM = "units.system"
     const val KEY_TEMPERATURE_UNIT = "units.temperature"
 
+    /** #1846: which skin-temp number the cards lead with — "" / absent = a temperature (default), or the
+     *  DEVIATION raw to lead with the ±baseline move. Display-only; nothing stored ever changes. */
+    const val KEY_SKIN_TEMP_DISPLAY = "units.skinTempDisplay"
+
     fun setUnitSystem(context: Context, system: UnitSystem) {
         of(context).edit().putString(KEY_UNIT_SYSTEM, system.raw).apply()
     }
 
     /** Persist the temperature override, or pass null to clear it back to "match the system". */
+    fun setSkinTempDisplay(context: Context, kind: com.noop.analytics.SkinTempDisplay.Kind?) {
+        of(context).edit().apply {
+            if (kind == null || kind == com.noop.analytics.SkinTempDisplay.Kind.ABSOLUTE) {
+                remove(KEY_SKIN_TEMP_DISPLAY)
+            } else {
+                putString(KEY_SKIN_TEMP_DISPLAY, kind.raw)
+            }
+        }.apply()
+    }
+
     fun setTemperatureUnit(context: Context, unit: TemperatureUnit?) {
         of(context).edit().apply {
             if (unit == null) remove(KEY_TEMPERATURE_UNIT) else putString(KEY_TEMPERATURE_UNIT, unit.raw)
diff --git a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
index e08c72f1b3..1c02d04579 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
@@ -671,6 +671,9 @@ fun SettingsScreen(
     var temperatureRaw by remember {
         mutableStateOf(NoopPrefs.of(context).getString(NoopPrefs.KEY_TEMPERATURE_UNIT, "") ?: "")
     }
+    // #1846: which skin-temp number the cards lead with. Display-only, like the row above — the stored
+    // value never changes, so flipping it just re-reads the same night on the other scale.
+    var skinTempKind by remember { mutableStateOf(UnitPrefs.skinTempPreferred(context)) }
     // Effort display scale (#268) — show NOOP's native 0–100 Effort or WHOOP's 0–21 Day Strain axis.
     // Display-only; the stored value never changes. Mirrors into local state like the toggles above.
     var effortScale by remember { mutableStateOf(UnitPrefs.effortScale(context)) }
@@ -1218,6 +1221,30 @@ fun SettingsScreen(
                     )
                 }
                 SettingsRowDivider()
+                SettingsFormRow(label = uiString(R.string.l10n_settings_screen_skin_temperature_fc103030)) {
+                    // #1846: lead with a temperature ("33.5 °C") or with the move from your own baseline
+                    // ("-0.1 Δ°C"). Only a PREFERENCE — a night that measured just one of the two still
+                    // shows that one, so the choice can never blank a card.
+                    SegmentedPillControl(
+                        items = listOf(
+                            com.noop.analytics.SkinTempDisplay.Kind.ABSOLUTE,
+                            com.noop.analytics.SkinTempDisplay.Kind.DEVIATION,
+                        ),
+                        selection = skinTempKind,
+                        label = {
+                            if (it == com.noop.analytics.SkinTempDisplay.Kind.ABSOLUTE) {
+                                uiString(R.string.l10n_settings_screen_temperature_0a9062a9)
+                            } else {
+                                uiString(R.string.skin_temp_vs_baseline)
+                            }
+                        },
+                        onSelect = {
+                            skinTempKind = it
+                            NoopPrefs.setSkinTempDisplay(context, it)
+                        },
+                    )
+                }
+                SettingsRowDivider()
                 // Effort scale (#268) — NOOP's native 0–100 Effort or WHOOP's 0–21 Day Strain axis.
                 // Display-only; the stored value never changes, so a flip just re-labels every read-out.
                 SettingsFormRow(label = uiString(R.string.l10n_settings_screen_effort_scale_81afa9ef)) {
diff --git a/android/app/src/main/java/com/noop/ui/TodayScreen.kt b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
index ad4f47926c..8d19c888b0 100644
--- a/android/app/src/main/java/com/noop/ui/TodayScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
@@ -1018,8 +1018,11 @@ fun TodayScreen(
     val lastSpo2Day: DailyMetric? = remember(days, carryOverTodayKey, selectedDayOffset, displayMetric) {
         if (selectedDayOffset == 0) lastSpo2Row(days, maxOf(displayMetric?.day ?: "", carryOverTodayKey)) else null
     }
+    // #1844: the carry must find a night with EITHER number now that these surfaces lead with the
+    // absolute — a calibrating night has a real temperature and no deviation yet, and lastSkinTempRow
+    // (deviation-only) would skip straight past it. Both Today consumers below want that row.
     val lastSkinTempDay: DailyMetric? = remember(days, carryOverTodayKey, selectedDayOffset, displayMetric) {
-        if (selectedDayOffset == 0) lastSkinTempRow(days, maxOf(displayMetric?.day ?: "", carryOverTodayKey)) else null
+        if (selectedDayOffset == 0) lastSkinTempReadingRow(days, maxOf(displayMetric?.day ?: "", carryOverTodayKey)) else null
     }
     // #1842: per-field HRV / resting-HR carries, the twins of the SpO₂ and skin-temp rows above. Same
     // shape, same future-clock bound; see lastHrvRow for why the shared lastVitalsRow is not enough.
@@ -3353,6 +3356,9 @@ private fun YourCardsSection(
                         rhrDay = rhrDay,
                         respDay = respDay,
                         fahrenheit = fahrenheit,
+                        // #1846: the user's lead-with choice. Read at the call site, not defaulted inside —
+                        // a defaulted parameter no caller passes is a setting that silently does nothing.
+                        skinTempPreferred = com.noop.ui.UnitPrefs.skinTempPreferred(LocalContext.current),
                         stress = stress,
                         fitnessAge = fitnessAge,
                         vo2max = vo2max,
@@ -3570,6 +3576,8 @@ private fun dashboardCardValue(
     hydrationGoalMl: Int,
     spo2CandidateByDay: Map<String, Double> = emptyMap(),
     fahrenheit: Boolean = false,
+    skinTempPreferred: com.noop.analytics.SkinTempDisplay.Kind =
+        com.noop.analytics.SkinTempDisplay.Kind.ABSOLUTE,
 ): String {
     fun withUnit(s: String): String =
         if (s == NO_DATA) NO_DATA else if (card.unit.isEmpty()) s else "$s ${card.unit}"
@@ -3607,13 +3615,20 @@ private fun dashboardCardValue(
             (vd?.spo2Pct ?: spo2Day?.spo2Pct)?.let { String.format(Locale.getDefault(), "%.0f%%", it) }
                 ?: (vd?.day ?: day?.day)?.let { spo2CandidateByDay[it] }?.let { String.format(Locale.getDefault(), "%.0f%%", it) }
                 ?: NO_DATA
-        DashboardCard.SKIN_TEMP -> {
-            // #622: bimodal field — absolute °C (import) vs signed Δ°C vs baseline (live).
-            // Always label the scale; bare "−0.1°" next to a 34° deep-timeline chart looked broken.
-            val v = vd?.skinTempDevC ?: skinTempDay?.skinTempDevC
-            if (v == null) NO_DATA
-            else com.noop.analytics.SkinTempDisplay.format(v, fahrenheit = fahrenheit)
-        }
+            DashboardCard.SKIN_TEMP -> {
+                // #1844: LEAD WITH THE ABSOLUTE when the night measured one, the rule the Health tile has
+                // used since #1665 — a deviation with no anchor cannot be read ("+0.9" is a fever or a warm
+                // bedroom). Both numbers come off the SAME row so the scale shown is that night's own.
+                // #622 still applies to the fallback: a deviation keeps its Δ unit so "−0.1 °C" is never
+                // read as a wrist temperature.
+                // Same resolver as the Key Metrics tile, so the two can never disagree — the claim the iOS
+                // twin already made in a comment and that now actually holds on both platforms. It also puts
+                // today's own reading FIRST: `vd` is `carriedDay ?: day`, so a live carry hid a temperature
+                // measured today, which `todaysOwnReadingWinsOverEitherCarry` has asserted all along.
+                resolveSkinTempReading(day, carriedDay, skinTempDay, skinTempPreferred)
+                    ?.let { com.noop.analytics.SkinTempDisplay.formatReading(it, fahrenheit = fahrenheit) }
+                    ?: NO_DATA
+            }
         DashboardCard.SLEEP -> sleepValue(vd)
         DashboardCard.STEPS -> {
             val real = day?.steps?.let { intStringGrouped(it.toDouble()) }
@@ -4925,16 +4940,23 @@ private fun RecordingStatusChip(state: RecordingState, onConnect: () -> Unit) {
 // `provenanceBadgeLabel` By-Day mappers are kept (Intelligence/Trends + tests still use that vocabulary).
 
 /**
- * The Key Metrics Skin Temp tile's 3-way fallback: today's row, then the whole-row recovery carry,
- * then the per-field skin-temp carry (mirrors spo2CarryDay/respCarryDay's reasoning — carriedDay can
- * land on a row with null skinTempDevC even when a genuine reading exists further back). Extracted so
- * the carry regression ryanbr's PR #1589 review flagged is testable without Compose/Robolectric.
+ * The skin-temp reading a Today surface should LEAD with (#1844): the first of today / the recovery carry
+ * / the per-field carry that holds EITHER number, resolved to absolute-or-deviation by
+ * [com.noop.analytics.SkinTempDisplay.leadReading].
+ *
+ * Both numbers are read off the SAME row, so an absolute is never paired with another night's deviation.
+ * Replaces `resolveSkinTempDevC`, which had no caller left once both Today surfaces moved onto
+ * this one; its carry-order tests were repinned here rather than dropped.
  */
-internal fun resolveSkinTempDevC(
+internal fun resolveSkinTempReading(
     d: DailyMetric?,
     carriedDay: DailyMetric?,
     skinTempCarryDay: DailyMetric?,
-): Double? = d?.skinTempDevC ?: carriedDay?.skinTempDevC ?: skinTempCarryDay?.skinTempDevC
+    prefer: com.noop.analytics.SkinTempDisplay.Kind = com.noop.analytics.SkinTempDisplay.Kind.ABSOLUTE,
+): com.noop.analytics.SkinTempDisplay.Reading? =
+    listOfNotNull(d, carriedDay, skinTempCarryDay)
+        .firstOrNull { it.skinTempC != null || it.skinTempDevC != null }
+        ?.let { com.noop.analytics.SkinTempDisplay.leadReading(it.skinTempC, it.skinTempDevC, prefer) }
 
 /**
  * The full 14-day metric grid, mirroring the macOS LazyVGrid order:
@@ -5171,13 +5193,16 @@ private fun MetricGrid(
             // `d ?: carriedDay` idiom every other simple tile above uses (HRV/RESTING_HR), and the SAME
             // `SkinTempDisplay` formatter the DashboardCard.SKIN_TEMP branch uses so a deviation reads
             // "+0.1 Δ°C" identically on both surfaces (#622: bimodal absolute-vs-deviation field).
-            val v = resolveSkinTempDevC(d, carriedDay, skinTempCarryDay)
+            val reading = resolveSkinTempReading(
+                d, carriedDay, skinTempCarryDay,
+                com.noop.ui.UnitPrefs.skinTempPreferred(LocalContext.current),
+            )
             val fahrenheit = UnitPrefs.temperature(LocalContext.current) == TemperatureUnit.FAHRENHEIT
             KeyTileData(
                 label = uiString(R.string.today_card_skin_temp),
                 // The value carries its own "°C"/"Δ°F" (SkinTempDisplay.format), so unit stays empty —
                 // same as the DashboardCard.SKIN_TEMP card and the classic TodayView Skin Temp tile.
-                value = v?.let { com.noop.analytics.SkinTempDisplay.format(it, fahrenheit = fahrenheit) } ?: NO_DATA,
+                value = reading?.let { com.noop.analytics.SkinTempDisplay.formatReading(it, fahrenheit = fahrenheit) } ?: NO_DATA,
                 unit = "",
                 tint = Palette.metricAmber,
                 frac = null,
diff --git a/android/app/src/main/java/com/noop/ui/Units.kt b/android/app/src/main/java/com/noop/ui/Units.kt
index 141adb1afd..9f2ae53f97 100644
--- a/android/app/src/main/java/com/noop/ui/Units.kt
+++ b/android/app/src/main/java/com/noop/ui/Units.kt
@@ -157,6 +157,17 @@ object UnitPrefs {
     fun system(context: Context): UnitSystem =
         UnitSystem.fromRaw(NoopPrefs.of(context).getString(NoopPrefs.KEY_UNIT_SYSTEM, null))
 
+    /**
+     * Which skin-temp number the cards LEAD with (#1846). Absolute by default — a temperature is what a
+     * temperature reading should say — with DEVIATION for wearers who track the ±baseline move. Only a
+     * preference: [com.noop.analytics.SkinTempDisplay.leadReading] still falls back to the other number,
+     * so a night that measured only one is never blanked by this choice.
+     */
+    fun skinTempPreferred(context: Context): com.noop.analytics.SkinTempDisplay.Kind =
+        com.noop.analytics.SkinTempDisplay.Kind.fromRaw(
+            NoopPrefs.of(context).getString(NoopPrefs.KEY_SKIN_TEMP_DISPLAY, null),
+        ) ?: com.noop.analytics.SkinTempDisplay.Kind.ABSOLUTE
+
     /** The resolved temperature unit, applying the "match the length/mass system" default. */
     fun temperature(context: Context): TemperatureUnit {
         val override = TemperatureUnit.fromRaw(
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 7389a288cb..ef2dc3f998 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2680,4 +2680,5 @@
     <string name="vo2max_method_change_caption">Die Linie bricht dort ab, wo sich die Schätzmethode geändert hat oder nicht erfasst wurde.</string>
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">Eine WHOOP 5, die verbunden bleibt, deine innere Uhr im Schlaf-Screen und ein Journal, das Nein von gar nichts unterscheidet</string>
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Wähle dein Zeitformat, Schlaf von Straps ohne Bewegungsdaten und ein Strap-Log, das nicht mehr rät</string>
+    <string name="l10n_settings_screen_skin_temperature_fc103030">Hauttemperatur</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 92def5767b..7c34bf8098 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2667,4 +2667,5 @@
     <string name="vo2max_method_change_caption">La línea se interrumpe donde el método de estimación cambió o no se registró.</string>
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">Una WHOOP 5 que no se desconecta, tu reloj interno en la pantalla de Sueño y un diario que distingue No de nada</string>
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Elige el reloj de 12 horas, sueño desde correas que no registran movimiento y un registro que deja de suponer</string>
+    <string name="l10n_settings_screen_skin_temperature_fc103030">Temperatura cutánea</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 5dc979b9c9..fd5509e3a1 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2666,4 +2666,5 @@
     <string name="vo2max_method_change_caption">La courbe est interrompue là où la méthode d’estimation a changé ou n’a pas été enregistrée.</string>
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">Une WHOOP 5 qui reste connectée, votre horloge interne sur l\'écran Sommeil, et un journal qui distingue Non de rien</string>
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Choisissez l\'horloge 12 heures, le sommeil depuis des bracelets sans données de mouvement, et un journal qui cesse de deviner</string>
+    <string name="l10n_settings_screen_skin_temperature_fc103030">Température cutanée</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 3f4d5de228..5ec2aa964d 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2671,4 +2671,5 @@
     <string name="vo2max_method_change_caption">Linia jest przerwana tam, gdzie metoda szacowania zmieniła się lub nie została zapisana.</string>
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">WHOOP 5, który nie traci połączenia, zegar biologiczny na ekranie snu i dziennik odróżniający Nie od braku wpisu</string>
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Wybierz zegar 12-godzinny, sen z opasek bez danych o ruchu i dziennik, który przestaje zgadywać</string>
+    <string name="l10n_settings_screen_skin_temperature_fc103030">Temperatura skóry</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 47c0b8942d..46ed5422fe 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2659,4 +2659,5 @@
     <string name="vo2max_method_change_caption">A linha é interrompida onde o método de estimativa mudou ou não foi registado.</string>
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">Uma WHOOP 5 que se mantém ligada, o seu relógio interno no ecrã de Sono e um diário que distingue Não de nada</string>
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Escolha o relógio de 12 horas, sono a partir de pulseiras sem dados de movimento e um registo que deixa de adivinhar</string>
+    <string name="l10n_settings_screen_skin_temperature_fc103030">Temperatura da pele</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 9413c0e090..abd54562c2 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2580,4 +2580,5 @@
     <string name="vo2max_method_change_caption">线条在估算方法发生变化或未记录之处中断。</string>
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">不再频繁掉线的 WHOOP 5、睡眠页上的生物钟，以及能分清「否」与「未记录」的日志</string>
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">自选 12 小时制、从无运动数据的手环读取睡眠，以及不再靠猜测的手环日志</string>
+    <string name="l10n_settings_screen_skin_temperature_fc103030">皮肤温度</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 03bbfe3950..2a92c900bd 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2693,4 +2693,5 @@
     <string name="vo2max_method_change_caption">The line breaks where the estimation method changed or was not recorded.</string>
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">A WHOOP 5 that stays connected, your body clock on the Sleep screen, and a Journal that knows No from nothing</string>
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Choose a 12-hour clock, sleep from straps that bank no motion, and a strap log that stops guessing</string>
+    <string name="l10n_settings_screen_skin_temperature_fc103030">Skin temperature</string>
 </resources>
diff --git a/android/app/src/test/java/com/noop/analytics/SkinTempLeadReadingTest.kt b/android/app/src/test/java/com/noop/analytics/SkinTempLeadReadingTest.kt
new file mode 100644
index 0000000000..1b0b923d33
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/SkinTempLeadReadingTest.kt
@@ -0,0 +1,120 @@
+package com.noop.analytics
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/**
+ * #1844: which of a night's two skin-temp numbers a surface leads with, and how it reads once formatted.
+ *
+ * The rule the Health tile has used since #1665, made pure so Today and the detail screen can share it:
+ * a deviation with no anchor cannot be read, so a measured absolute wins whenever the night has one.
+ */
+class SkinTempLeadReadingTest {
+
+    /** The everyday case: the night measured a real temperature, so that is what shows. */
+    @Test
+    fun absoluteWinsWhenTheNightMeasuredOne() {
+        val r = SkinTempDisplay.leadReading(absC = 33.8, devC = -0.1)!!
+        assertEquals(SkinTempDisplay.Kind.ABSOLUTE, r.kind)
+        assertEquals(33.8, r.value, 1e-9)
+        assertEquals("33.8 °C", SkinTempDisplay.formatReading(r, fahrenheit = false))
+    }
+
+    /** A night scored before skinTempC shipped (2026-08-27) keeps EXACTLY the display that shipped before. */
+    @Test
+    fun deviationLedNightIsUnchanged() {
+        val r = SkinTempDisplay.leadReading(absC = null, devC = -0.1)!!
+        assertEquals(SkinTempDisplay.Kind.DEVIATION, r.kind)
+        assertEquals("-0.1 Δ°C", SkinTempDisplay.formatReading(r, fahrenheit = false))
+    }
+
+    /** A CALIBRATING night is the reverse — measured absolute, no usable baseline yet, so no deviation.
+     *  This is the case that previously showed an empty card with a real temperature behind it. */
+    @Test
+    fun calibratingNightStillShowsItsTemperature() {
+        val r = SkinTempDisplay.leadReading(absC = 34.1, devC = null)!!
+        assertEquals(SkinTempDisplay.Kind.ABSOLUTE, r.kind)
+        assertEquals("34.1 °C", SkinTempDisplay.formatReading(r, fahrenheit = false))
+    }
+
+    /** Nothing measured stays nothing: the carry must never invent a reading. */
+    @Test
+    fun noNumbersCarryNothing() {
+        assertNull(SkinTempDisplay.leadReading(absC = null, devC = null))
+    }
+
+    /** °F uses the full conversion for an absolute and the offset-free one for a deviation — the whole
+     *  reason the kind has to travel with the value rather than being re-guessed at the format call. */
+    @Test
+    fun fahrenheitConvertsEachKindByItsOwnRule() {
+        val abs = SkinTempDisplay.leadReading(absC = 35.0, devC = null)!!
+        assertEquals("95.0 °F", SkinTempDisplay.formatReading(abs, fahrenheit = true))
+        val dev = SkinTempDisplay.leadReading(absC = null, devC = 1.0)!!
+        assertEquals("+1.8 Δ°F", SkinTempDisplay.formatReading(dev, fahrenheit = true))
+    }
+
+    /** #1842 still holds through the new path: a deviation that rounds to zero drops its sign. */
+    @Test
+    fun signedZeroStaysFixedThroughLeadReading() {
+        val r = SkinTempDisplay.leadReading(absC = null, devC = -0.02)!!
+        assertEquals("0.0 Δ°C", SkinTempDisplay.formatReading(r, fahrenheit = false))
+    }
+
+    // MARK: the Settings choice (#1846)
+
+    /** Choosing the deviation leads with it even on a night that measured a real temperature. */
+    @Test
+    fun deviationPreferenceLeadsWithTheDelta() {
+        val r = SkinTempDisplay.leadReading(absC = 33.8, devC = -0.1,
+                                            prefer = SkinTempDisplay.Kind.DEVIATION)!!
+        assertEquals(SkinTempDisplay.Kind.DEVIATION, r.kind)
+        assertEquals("-0.1 Δ°C", SkinTempDisplay.formatReading(r, fahrenheit = false))
+    }
+
+    /** The choice is a PREFERENCE, not a filter: a night with only the other number still shows it,
+     *  so flipping the setting can never blank a card. Both directions. */
+    @Test
+    fun eitherPreferenceFallsBackToTheNumberTheNightHas() {
+        val devOnly = SkinTempDisplay.leadReading(absC = null, devC = -0.4,
+                                                   prefer = SkinTempDisplay.Kind.ABSOLUTE)!!
+        assertEquals("-0.4 Δ°C", SkinTempDisplay.formatReading(devOnly, fahrenheit = false))
+
+        val absOnly = SkinTempDisplay.leadReading(absC = 34.2, devC = null,
+                                                   prefer = SkinTempDisplay.Kind.DEVIATION)!!
+        assertEquals("34.2 °C", SkinTempDisplay.formatReading(absOnly, fahrenheit = false))
+    }
+
+    /** The unit always names the scale ACTUALLY shown, never the one that was asked for — otherwise a
+     *  fallback would print a temperature under a Δ label, or a delta as a wrist temperature. */
+    @Test
+    fun theUnitFollowsTheValueNotThePreference() {
+        val r = SkinTempDisplay.leadReading(absC = 34.2, devC = null,
+                                            prefer = SkinTempDisplay.Kind.DEVIATION)!!
+        assertEquals(SkinTempDisplay.Kind.ABSOLUTE, r.kind)
+        assertEquals("°C", SkinTempDisplay.unitSymbol(r.kind, fahrenheit = false))
+    }
+
+    /** Default is unchanged, so an install that never opens Settings behaves exactly as #1844 shipped. */
+    @Test
+    fun defaultIsAbsolute() {
+        assertEquals(SkinTempDisplay.Kind.ABSOLUTE,
+                     SkinTempDisplay.leadReading(absC = 33.0, devC = 0.5)!!.kind)
+    }
+
+
+    /** The PERSISTED token, byte-identical to the Swift `Kind.rawValue` — both platforms share the
+     *  `units.skinTempDisplay` key, so a drift here (e.g. writing `Kind.name`) would make one platform
+     *  unable to read the other's stored choice. Same contract `KeyMetric.raw` already pins. */
+    @Test
+    fun rawTokensMatchTheSwiftRawValues() {
+        assertEquals("absolute", SkinTempDisplay.Kind.ABSOLUTE.raw)
+        assertEquals("deviation", SkinTempDisplay.Kind.DEVIATION.raw)
+        assertEquals(SkinTempDisplay.Kind.DEVIATION, SkinTempDisplay.Kind.fromRaw("deviation"))
+        assertEquals(SkinTempDisplay.Kind.ABSOLUTE, SkinTempDisplay.Kind.fromRaw("absolute"))
+        // Anything unrecognised (including the old uppercase spelling) falls back at the read site.
+        assertNull(SkinTempDisplay.Kind.fromRaw("DEVIATION"))
+        assertNull(SkinTempDisplay.Kind.fromRaw(null))
+    }
+
+}
diff --git a/android/app/src/test/java/com/noop/ui/KeyMetricSkinTempTest.kt b/android/app/src/test/java/com/noop/ui/KeyMetricSkinTempTest.kt
index 3066e2144b..7bb7c9efad 100644
--- a/android/app/src/test/java/com/noop/ui/KeyMetricSkinTempTest.kt
+++ b/android/app/src/test/java/com/noop/ui/KeyMetricSkinTempTest.kt
@@ -42,17 +42,24 @@ class KeyMetricSkinTempTest {
     private fun day(skinTempDevC: Double?) =
         DailyMetric(deviceId = "my-whoop-noop", day = "2026-08-25", skinTempDevC = skinTempDevC)
 
+    private fun value(d: DailyMetric?, carriedDay: DailyMetric?, skinTempCarryDay: DailyMetric?) =
+        resolveSkinTempReading(d, carriedDay, skinTempCarryDay)?.value
+
     /**
      * Regression for ryanbr's PR #1589 review: carriedDay (lastScoredRecoveryDay) is a whole-row
      * carry that lands on a row with null skinTempDevC even when a genuine reading exists further
      * back, so the tile must fall through to the per-field skinTempCarryDay — exactly like
-     * spo2CarryDay/respCarryDay, and matching iOS TodayView's lastSkinTempDay chain.
+     * spo2CarryDay/respCarryDay, and matching the iOS `skinTempLeadReading` chain.
+     *
+     * Repinned onto `resolveSkinTempReading` (#1844) when both Today surfaces moved onto it: same carry
+     * ORDER, same fixtures, now reading `.value` off the resolved reading. The order is the part worth
+     * guarding, and it did not change.
      */
     @Test fun nullSkinTempDevCFallsThroughToPerFieldCarry() {
         val perFieldCarry = day(skinTempDevC = 0.4)
         assertEquals(
             0.4,
-            resolveSkinTempDevC(d = null, carriedDay = day(skinTempDevC = null), skinTempCarryDay = perFieldCarry)!!,
+            value(d = null, carriedDay = day(skinTempDevC = null), skinTempCarryDay = perFieldCarry)!!,
             0.0,
         )
     }
@@ -60,7 +67,7 @@ class KeyMetricSkinTempTest {
     @Test fun todaysOwnReadingWinsOverEitherCarry() {
         assertEquals(
             0.2,
-            resolveSkinTempDevC(
+            value(
                 d = day(skinTempDevC = 0.2),
                 carriedDay = day(skinTempDevC = -0.1),
                 skinTempCarryDay = day(skinTempDevC = 0.4),
@@ -72,7 +79,7 @@ class KeyMetricSkinTempTest {
     @Test fun wholeRowCarryWinsOverPerFieldCarryWhenBothPresent() {
         assertEquals(
             -0.1,
-            resolveSkinTempDevC(
+            value(
                 d = null,
                 carriedDay = day(skinTempDevC = -0.1),
                 skinTempCarryDay = day(skinTempDevC = 0.4),
@@ -82,6 +89,6 @@ class KeyMetricSkinTempTest {
     }
 
     @Test fun noRowAnywhereYieldsNull() {
-        assertNull(resolveSkinTempDevC(d = null, carriedDay = null, skinTempCarryDay = null))
+        assertNull(value(d = null, carriedDay = null, skinTempCarryDay = null))
     }
 }
diff --git a/android/app/src/test/java/com/noop/ui/LastSkinTempReadingRowTest.kt b/android/app/src/test/java/com/noop/ui/LastSkinTempReadingRowTest.kt
new file mode 100644
index 0000000000..073ae4a45e
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/LastSkinTempReadingRowTest.kt
@@ -0,0 +1,45 @@
+package com.noop.ui
+
+import com.noop.data.DailyMetric
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/** #1844: the carry must find a night holding EITHER skin-temp number, and read both off that ONE row. */
+class LastSkinTempReadingRowTest {
+
+    private fun day(d: String, abs: Double? = null, dev: Double? = null) =
+        DailyMetric(deviceId = "my-whoop", day = d, skinTempC = abs, skinTempDevC = dev)
+
+    /** The calibrating night the deviation-only selector skipped: real temperature, no deviation yet. */
+    @Test
+    fun findsANightWithOnlyAnAbsolute() {
+        val days = listOf(day("2026-09-01", dev = -0.3), day("2026-09-02", abs = 34.1))
+        assertEquals("2026-09-02", lastSkinTempReadingRow(days, todayKey = "2026-09-03")?.day)
+        // The old deviation-only row would reach back past it to the older night.
+        assertEquals("2026-09-01", lastSkinTempRow(days, todayKey = "2026-09-03")?.day)
+    }
+
+    /** Both numbers come off the SAME row, so an absolute is never paired with another night's deviation. */
+    @Test
+    fun bothNumbersComeFromOneNight() {
+        val days = listOf(day("2026-09-01", abs = 33.0, dev = -0.9), day("2026-09-02", abs = 34.1, dev = 0.2))
+        val row = lastSkinTempReadingRow(days, todayKey = "2026-09-03")!!
+        assertEquals(34.1, row.skinTempC!!, 1e-9)
+        assertEquals(0.2, row.skinTempDevC!!, 1e-9)
+    }
+
+    /** Same future-clock bound as every sibling carry. */
+    @Test
+    fun neverCarriesTodayOrLater() {
+        val days = listOf(day("2026-09-03", abs = 34.0), day("2026-09-04", abs = 34.2))
+        assertNull(lastSkinTempReadingRow(days, todayKey = "2026-09-03"))
+    }
+
+    /** A row with neither number is not a reading. */
+    @Test
+    fun rowsWithNeitherNumberAreSkipped() {
+        val days = listOf(day("2026-09-01", abs = 33.5), day("2026-09-02"))
+        assertEquals("2026-09-01", lastSkinTempReadingRow(days, todayKey = "2026-09-03")?.day)
+    }
+}

From 5b4bf3162e882543c29d6766a3b2105d6aff62aa Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 19:18:21 +1200
Subject: [PATCH 202/333] build: staging 424 / iOS 305 for the next testing
 build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Carries the skin-temp work from #1845: the cards lead with the measured
temperature, and Settings > Units > Skin temperature switches between that and
the baseline delta. MARKETING_VERSION and versionName stay at 11.1.1 — a build
bump, not a version bump.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 9358887f05..b1cb44e060 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 423
+        versionCode = 424
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 33c273887e..b4482391a5 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "304"
+    CURRENT_PROJECT_VERSION: "305"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 8905f8f14aa0300085affd303f100f62771a0188 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 20:18:11 +1200
Subject: [PATCH 203/333] health: say when skin temp could not honour the
 Settings choice (#1847)

Setting Skin temperature to Temperature and getting the same "0.0 dC" back is indistinguishable from a broken toggle. It is not broken: leadReading falls back rather than blanking, so a night that only ever recorded a deviation shows its deviation. Right behaviour, completely invisible.

The detail screen now says so under the reading -- "No measured temperature for these nights, showing the difference from your baseline. A sync re-scores recent nights and fills it in." -- and a second sentence covers the case a sync creates: once the 21-night analyzeRecent window refills, the series switches to the absolute column and older deviation-only nights drop out, so the reading count falls with nothing saying why.

Why those nights have no temperature, since it is not obvious: the deviation is DERIVED from the absolute, so every night showing a delta had a real temperature at scoring time. It was computed, used, and discarded, because those nights were scored before #1663 added the column on 2026-08-27. A scoring pass re-derives it from raw samples still on disk, which is what the note points at.

Three re-review passes found three defects in the notes themselves, all of them copy that could describe the wrong thing -- worse than the silence they were added to fix:

The shortened-series note had no leadsAbsolute guard, so it also fired on the deviation-led branch, where the dropped rows are the OPPOSITE kind and the sentence was precisely backwards. Reachable the moment a wearer picks "vs baseline" with one calibrating night in the window.

The fallback note fired whenever the NEWEST night lacked an absolute, but its sentence is false if an older night has one. It now requires that none in the window does; that case shows nothing instead.

A WHOOP CSV import writes absolute degrees C straight into skinTempDevC (the #622 bimodal field), so an absolute-led series reading skinTempC alone dropped every imported night from a TEMPERATURE chart, then called those real measured temperatures "a baseline difference only". The branch now takes skinTempC ?: skinTempDevC.takeIf(isAbsoluteSkinTemp): mixing is only unsound across scales, and these are the same scale.

Both rules are pure and gated inside themselves rather than at the call site, and every case is pinned from the failing direction, so a simplification that drops a guard fails in CI rather than in a screenshot. A test also pins the 20.0 absolute/deviation discriminator directly.

Android only, deliberately: Apple's twin is MetricExplorerView, which sources skin temp through the shared Repository.dailyColumn (also feeding Trends and the catalog availability check), so it needs its own branch rather than a change to that mapper. Tracked separately, along with a Fahrenheit import bug found while verifying the degrees F path.

Full suite 5124/0, 11 cases in this file. Both notes translated across all 6 locales. Doc-comment and i18n gates clean.
---
 .../src/main/java/com/noop/ui/HealthScreen.kt |  55 ++++++--
 .../java/com/noop/ui/HealthVitalsLogic.kt     |  41 ++++++
 .../app/src/main/res/values-de/strings.xml    |   2 +
 .../app/src/main/res/values-es/strings.xml    |   2 +
 .../app/src/main/res/values-fr/strings.xml    |   2 +
 .../app/src/main/res/values-pl/strings.xml    |   2 +
 .../src/main/res/values-pt-rPT/strings.xml    |   2 +
 .../app/src/main/res/values-zh/strings.xml    |   2 +
 android/app/src/main/res/values/strings.xml   |   2 +
 .../com/noop/ui/SkinTempFallbackNoteTest.kt   | 123 ++++++++++++++++++
 10 files changed, 224 insertions(+), 9 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ui/SkinTempFallbackNoteTest.kt

diff --git a/android/app/src/main/java/com/noop/ui/HealthScreen.kt b/android/app/src/main/java/com/noop/ui/HealthScreen.kt
index 03a5063b21..9dfe2c6f7b 100644
--- a/android/app/src/main/java/com/noop/ui/HealthScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/HealthScreen.kt
@@ -1747,6 +1747,8 @@ private data class VitalDetailModel(
     val color: Color,
     val readings: List<VitalReading>,
     val format: (Double) -> String,
+    /** #1847: why the screen is not showing what Settings asked for. Null when it is. */
+    val fallbackNote: String? = null,
 ) {
     /** (day, value) projection the trend chart + range helpers consume — SAME order as [readings], so the
      *  chart, the header count, and the table can never drift apart. */
@@ -2059,6 +2061,14 @@ fun VitalDetailScreen(vm: AppViewModel, key: String) {
                             style = NoopType.footnote,
                             color = Palette.textTertiary,
                         )
+                        detail.fallbackNote?.let { note ->
+                            Text(
+                                text = note,
+                                style = NoopType.footnote,
+                                color = Palette.textTertiary,
+                                modifier = Modifier.padding(top = 6.dp),
+                            )
+                        }
                     }
                 }
                 SegmentedPillControl(
@@ -2317,6 +2327,23 @@ private fun buildVitalDetail(
         // the kind is re-derived from the value and the series partitioned to it.
         val kind = if (leadsAbsolute) SkinTempDisplay.Kind.ABSOLUTE else SkinTempDisplay.kind(lead.value)
         val unit = SkinTempDisplay.unitSymbol(kind, fahrenheit)
+        val skinReadings = if (leadsAbsolute) {
+            // An absolute-led series takes EVERY absolute reading, whichever column holds it. A WHOOP CSV
+            // import writes absolute °C straight into skinTempDevC (`skin_temp_celsius`, #622 bimodal), so
+            // reading skinTempC alone hid a wearer's imported temperatures from a temperature chart — and
+            // made the shortened-series note call them "a baseline difference only", which they are not.
+            // Mixing is only unsound ACROSS scales; these are the same scale.
+            days.mapNotNull { row ->
+                (row.skinTempC ?: row.skinTempDevC?.takeIf { VitalBands.isAbsoluteSkinTemp(it) })
+                    ?.let { VitalReading(row.day, it, row.deviceId) }
+            }
+        } else {
+            days.mapNotNull { row ->
+                row.skinTempDevC
+                    ?.takeIf { VitalBands.isAbsoluteSkinTemp(it) == (kind == SkinTempDisplay.Kind.ABSOLUTE) }
+                    ?.let { value -> VitalReading(row.day, value, row.deviceId) }
+            }
+        }
         val title = if (kind == SkinTempDisplay.Kind.ABSOLUTE) {
             uiString(R.string.l10n_health_screen_skin_temperature_f59127f6)
         } else {
@@ -2327,16 +2354,26 @@ private fun buildVitalDetail(
             title = title,
             unit = unit,
             color = Palette.metricAmber,
-            readings = if (leadsAbsolute) {
-                days.mapNotNull { row -> row.skinTempC?.let { VitalReading(row.day, it, row.deviceId) } }
-            } else {
-                days.mapNotNull { row ->
-                    row.skinTempDevC
-                        ?.takeIf { VitalBands.isAbsoluteSkinTemp(it) == (kind == SkinTempDisplay.Kind.ABSOLUTE) }
-                        ?.let { value -> VitalReading(row.day, value, row.deviceId) }
-                }
-            },
+            readings = skinReadings,
             format = { c -> SkinTempDisplay.numberString(c, kind, fahrenheit, decimals = 1) },
+            // #1847: Settings asked for a temperature and none of these nights has one, so the screen shows
+            // the deviation instead. Say so — silently falling back is why the setting reads as broken.
+            // Nights scored before skinTempC shipped kept only the deviation; a scoring pass refills them.
+            fallbackNote = when {
+                shouldExplainSkinTempFallback(
+                    skinTempPreferred, leadsAbsolute,
+                    anyAbsoluteInWindow = days.any { it.skinTempC != null },
+                ) ->
+                    uiString(R.string.l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae)
+                // Leading with the absolute drops deviation-only nights from the series, so the reading
+                // count falls. Say why rather than letting history look like it vanished.
+                shouldExplainShortenedSkinTempSeries(
+                    leadsAbsolute = leadsAbsolute,
+                    shownReadings = skinReadings.size,
+                    rowsWithEitherNumber = days.count { it.skinTempC != null || it.skinTempDevC != null },
+                ) -> uiString(R.string.l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_earlier_ni_a45140da)
+                else -> null
+            },
         )
     }
     else -> null
diff --git a/android/app/src/main/java/com/noop/ui/HealthVitalsLogic.kt b/android/app/src/main/java/com/noop/ui/HealthVitalsLogic.kt
index 8f358d01eb..dbb580b946 100644
--- a/android/app/src/main/java/com/noop/ui/HealthVitalsLogic.kt
+++ b/android/app/src/main/java/com/noop/ui/HealthVitalsLogic.kt
@@ -98,6 +98,47 @@ internal data class Vital(
         } ?: "$label: no data"
 }
 
+/**
+ * Whether the skin-temp screen must explain a SHORTENED series (#1847).
+ *
+ * Leading with the absolute means the chart and table must read the absolute column, because an absolute
+ * plotted against a history of deviations is arithmetic on two scales. Nights that only ever recorded a
+ * deviation therefore drop out — and after a sync refills the 21-night `analyzeRecent` window on an install
+ * with older history, the reading count visibly falls with nothing on screen saying why.
+ *
+ * ONLY when leading with the absolute. The deviation-led branch also drops rows — calibrating nights that
+ * have only an absolute, and the #622 bimodal partition — but they are the OPPOSITE kind, so this note's
+ * sentence would be precisely backwards there. Gated inside the rule rather than at the call site, because
+ * the function name promises the whole rule.
+ *
+ * True only when rows were actually dropped, so a complete series stays silent.
+ */
+internal fun shouldExplainShortenedSkinTempSeries(
+    leadsAbsolute: Boolean,
+    shownReadings: Int,
+    rowsWithEitherNumber: Int,
+): Boolean = leadsAbsolute && shownReadings < rowsWithEitherNumber
+
+/**
+ * Whether the skin-temp screen must EXPLAIN itself (#1847).
+ *
+ * `leadReading` deliberately falls back: asking for a temperature on a night that only ever recorded a
+ * deviation shows the deviation rather than blanking. That is right, but silent — the setting then looks
+ * broken, because both choices render the same Δ°C.
+ *
+ * Requires that NO night in the window has an absolute, not merely that the newest lacks one. When the
+ * newest night has no absolute but an older one does, the sentence "no measured temperature for these
+ * nights" is false for those older nights — so that case shows nothing. Saying nothing is a gap; saying
+ * something untrue about the user's own data is worse.
+ *
+ * Pure so the decision is testable without Compose.
+ */
+internal fun shouldExplainSkinTempFallback(
+    prefer: SkinTempDisplay.Kind,
+    leadsAbsolute: Boolean,
+    anyAbsoluteInWindow: Boolean,
+): Boolean = prefer == SkinTempDisplay.Kind.ABSOLUTE && !leadsAbsolute && !anyAbsoluteInWindow
+
 /**
  * Whether the skin-temp tile leads with the night's ABSOLUTE (#1636).
  *
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index ef2dc3f998..712d17d9ff 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2681,4 +2681,6 @@
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">Eine WHOOP 5, die verbunden bleibt, deine innere Uhr im Schlaf-Screen und ein Journal, das Nein von gar nichts unterscheidet</string>
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Wähle dein Zeitformat, Schlaf von Straps ohne Bewegungsdaten und ein Strap-Log, das nicht mehr rät</string>
     <string name="l10n_settings_screen_skin_temperature_fc103030">Hauttemperatur</string>
+    <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Für diese Nächte liegt keine gemessene Temperatur vor — angezeigt wird die Abweichung von deinem Basiswert. Eine Synchronisierung bewertet die letzten Nächte neu und ergänzt sie.</string>
+    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_earlier_ni_a45140da">Es werden nur Nächte mit gemessener Temperatur angezeigt. Für frühere Nächte wurde nur eine Abweichung vom Basiswert erfasst.</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 7c34bf8098..f028825f0b 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2668,4 +2668,6 @@
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">Una WHOOP 5 que no se desconecta, tu reloj interno en la pantalla de Sueño y un diario que distingue No de nada</string>
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Elige el reloj de 12 horas, sueño desde correas que no registran movimiento y un registro que deja de suponer</string>
     <string name="l10n_settings_screen_skin_temperature_fc103030">Temperatura cutánea</string>
+    <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">No hay temperatura medida para estas noches: se muestra la diferencia respecto a tu referencia. Una sincronización vuelve a analizar las noches recientes y la completa.</string>
+    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_earlier_ni_a45140da">Solo se muestran las noches con temperatura medida. En las noches anteriores solo se registró la diferencia respecto a la referencia.</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index fd5509e3a1..c960ce18df 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2667,4 +2667,6 @@
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">Une WHOOP 5 qui reste connectée, votre horloge interne sur l\'écran Sommeil, et un journal qui distingue Non de rien</string>
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Choisissez l\'horloge 12 heures, le sommeil depuis des bracelets sans données de mouvement, et un journal qui cesse de deviner</string>
     <string name="l10n_settings_screen_skin_temperature_fc103030">Température cutanée</string>
+    <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Aucune température mesurée pour ces nuits — l\'écart par rapport à votre référence est affiché. Une synchronisation réévalue les nuits récentes et le complète.</string>
+    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_earlier_ni_a45140da">Seules les nuits avec une température mesurée sont affichées. Les nuits précédentes n\'ont enregistré qu\'un écart par rapport à la référence.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 5ec2aa964d..56545ea6c7 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2672,4 +2672,6 @@
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">WHOOP 5, który nie traci połączenia, zegar biologiczny na ekranie snu i dziennik odróżniający Nie od braku wpisu</string>
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Wybierz zegar 12-godzinny, sen z opasek bez danych o ruchu i dziennik, który przestaje zgadywać</string>
     <string name="l10n_settings_screen_skin_temperature_fc103030">Temperatura skóry</string>
+    <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Brak zmierzonej temperatury dla tych nocy — pokazano różnicę względem Twojej wartości bazowej. Synchronizacja ponownie przelicza ostatnie noce i ją uzupełnia.</string>
+    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_earlier_ni_a45140da">Pokazywane są tylko noce ze zmierzoną temperaturą. We wcześniejszych nocach zapisano jedynie różnicę względem wartości bazowej.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 46ed5422fe..1bd0fbed31 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2660,4 +2660,6 @@
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">Uma WHOOP 5 que se mantém ligada, o seu relógio interno no ecrã de Sono e um diário que distingue Não de nada</string>
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Escolha o relógio de 12 horas, sono a partir de pulseiras sem dados de movimento e um registo que deixa de adivinhar</string>
     <string name="l10n_settings_screen_skin_temperature_fc103030">Temperatura da pele</string>
+    <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Sem temperatura medida para estas noites — a mostrar a diferença em relação à sua referência. Uma sincronização reavalia as noites recentes e preenche-a.</string>
+    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_earlier_ni_a45140da">Só são mostradas as noites com temperatura medida. As noites anteriores registaram apenas a diferença em relação à referência.</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index abd54562c2..31a99b2d64 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2581,4 +2581,6 @@
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">不再频繁掉线的 WHOOP 5、睡眠页上的生物钟，以及能分清「否」与「未记录」的日志</string>
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">自选 12 小时制、从无运动数据的手环读取睡眠，以及不再靠猜测的手环日志</string>
     <string name="l10n_settings_screen_skin_temperature_fc103030">皮肤温度</string>
+    <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">这些夜晚没有实测温度，显示的是与基线的差值。同步后会重新计算近期夜晚并补上。</string>
+    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_earlier_ni_a45140da">仅显示有实测温度的夜晚。更早的夜晚只记录了与基线的差值。</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 2a92c900bd..833d97f475 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2694,4 +2694,6 @@
     <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">A WHOOP 5 that stays connected, your body clock on the Sleep screen, and a Journal that knows No from nothing</string>
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Choose a 12-hour clock, sleep from straps that bank no motion, and a strap log that stops guessing</string>
     <string name="l10n_settings_screen_skin_temperature_fc103030">Skin temperature</string>
+    <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">No measured temperature for these nights — showing the difference from your baseline. A sync re-scores recent nights and fills it in.</string>
+    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_earlier_ni_a45140da">Only nights with a measured temperature are shown. Earlier nights recorded a baseline difference only.</string>
 </resources>
diff --git a/android/app/src/test/java/com/noop/ui/SkinTempFallbackNoteTest.kt b/android/app/src/test/java/com/noop/ui/SkinTempFallbackNoteTest.kt
new file mode 100644
index 0000000000..149b139ec0
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/SkinTempFallbackNoteTest.kt
@@ -0,0 +1,123 @@
+package com.noop.ui
+
+import com.noop.analytics.SkinTempDisplay
+import com.noop.analytics.VitalBands
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #1847: the skin-temp screen has to say when it could not honour the Settings choice.
+ *
+ * `leadReading` falls back rather than blanking, which is right but invisible — both settings then render
+ * the same Δ°C and the toggle reads as broken. The note fires in exactly one case.
+ */
+class SkinTempFallbackNoteTest {
+
+    /** Asked for a temperature, no night has one — the reported case, and the only one that explains. */
+    @Test
+    fun explainsWhenTemperatureWasAskedForAndNoneExists() {
+        assertTrue(shouldExplainSkinTempFallback(SkinTempDisplay.Kind.ABSOLUTE, leadsAbsolute = false,
+                                                  anyAbsoluteInWindow = false))
+    }
+
+    /** Asked for a temperature and got one: nothing to explain. */
+    @Test
+    fun silentWhenTheChoiceWasHonoured() {
+        assertFalse(shouldExplainSkinTempFallback(SkinTempDisplay.Kind.ABSOLUTE, leadsAbsolute = true,
+                                                   anyAbsoluteInWindow = true))
+    }
+
+    /** Asked for the baseline delta and got it. */
+    @Test
+    fun silentWhenTheDeviationWasChosen() {
+        assertFalse(shouldExplainSkinTempFallback(SkinTempDisplay.Kind.DEVIATION, leadsAbsolute = false,
+                                                   anyAbsoluteInWindow = false))
+    }
+
+    /** Chose the delta but only an absolute exists: the reverse fallback. It shows a temperature under a
+     *  plain °C unit, which is self-describing, so it does not need a sentence. Pinned so the asymmetry is
+     *  deliberate rather than an oversight. */
+    @Test
+    fun silentOnTheReverseFallback() {
+        assertFalse(shouldExplainSkinTempFallback(SkinTempDisplay.Kind.DEVIATION, leadsAbsolute = true,
+                                                   anyAbsoluteInWindow = true))
+    }
+
+    // MARK: the shortened series (#1847, found in re-review)
+
+    /** After a sync refills the 21-night window on an install with older history, the absolute-led series
+     *  drops the deviation-only nights and the reading count visibly falls. Say why. */
+    @Test
+    fun explainsWhenNightsWereDroppedFromTheSeries() {
+        assertTrue(shouldExplainShortenedSkinTempSeries(leadsAbsolute = true, shownReadings = 21,
+                                                        rowsWithEitherNumber = 40))
+    }
+
+    /** A complete series says nothing — the note must not appear on a healthy screen. */
+    @Test
+    fun silentWhenEveryNightIsShown() {
+        assertFalse(shouldExplainShortenedSkinTempSeries(leadsAbsolute = true, shownReadings = 23,
+                                                         rowsWithEitherNumber = 23))
+    }
+
+    /** No data at all is the empty state's job, not this note's. */
+    @Test
+    fun silentWhenThereIsNothingToShow() {
+        assertFalse(shouldExplainShortenedSkinTempSeries(leadsAbsolute = true, shownReadings = 0,
+                                                         rowsWithEitherNumber = 0))
+    }
+
+
+    // MARK: what the second re-review caught — the note must never say the opposite of what happened
+
+    /**
+     * The deviation-led branch ALSO drops rows: calibrating nights that have only an absolute, and the #622
+     * bimodal partition. Those are the OPPOSITE kind, so "only nights with a measured temperature are
+     * shown" would be precisely backwards. Ungated, this fired the moment a wearer picked "vs baseline"
+     * with any calibrating night in the window.
+     */
+    @Test
+    fun neverExplainsAShortenedSeriesWhenLeadingWithTheDeviation() {
+        assertFalse(shouldExplainShortenedSkinTempSeries(leadsAbsolute = false, shownReadings = 21,
+                                                         rowsWithEitherNumber = 40))
+    }
+
+    /**
+     * The newest night has no absolute but an older one does. "No measured temperature for these nights" is
+     * false for those older nights, so the screen says nothing rather than something untrue.
+     */
+    @Test
+    fun silentWhenSomeOlderNightDoesHaveATemperature() {
+        assertFalse(shouldExplainSkinTempFallback(SkinTempDisplay.Kind.ABSOLUTE, leadsAbsolute = false,
+                                                  anyAbsoluteInWindow = true))
+    }
+
+
+    // MARK: third re-review — an absolute is an absolute, whichever column holds it
+
+    /**
+     * A WHOOP CSV import writes absolute °C into skinTempDevC (`skin_temp_celsius`, the #622 bimodal
+     * field). Those nights belong in an absolute-led series — same scale — and counting them as dropped
+     * made the note describe real temperatures as "a baseline difference only".
+     *
+     * Pins the discriminator the series selection leans on, so a change to the 20.0 threshold surfaces
+     * here rather than as a mislabelled chart.
+     */
+    @Test
+    fun anImportedAbsoluteIsRecognisedAsAbsolute() {
+        assertTrue(VitalBands.isAbsoluteSkinTemp(34.0))    // WHOOP export, stored in skinTempDevC
+        assertTrue(VitalBands.isAbsoluteSkinTemp(20.0))    // boundary is inclusive
+        assertFalse(VitalBands.isAbsoluteSkinTemp(0.5))    // a real deviation
+        assertFalse(VitalBands.isAbsoluteSkinTemp(-0.6))
+    }
+
+    /** With imported absolutes now IN the series, only genuine deviations count as dropped — so a window
+     *  holding nothing but absolutes (however stored) shows no note. */
+    @Test
+    fun silentWhenEveryDroppedRowWasActuallyAnAbsolute() {
+        assertFalse(shouldExplainShortenedSkinTempSeries(leadsAbsolute = true, shownReadings = 12,
+                                                         rowsWithEitherNumber = 12))
+    }
+
+}

From a624071b5f7819b496470c60298138ff1216ed32 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 20:18:31 +1200
Subject: [PATCH 204/333] build: staging 425 / iOS 306 for the next testing
 build

Carries #1847: the skin-temp detail screen now explains when it could not honour
the Settings choice, and an absolute-led series keeps imported temperatures
instead of dropping them. MARKETING_VERSION and versionName stay at 11.1.1.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index b1cb44e060..1e40a3ec34 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 424
+        versionCode = 425
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index b4482391a5..09e7ea379b 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "305"
+    CURRENT_PROJECT_VERSION: "306"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 82d15293435902b6f503e95c86b263298d5c187d Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 21:03:09 +1200
Subject: [PATCH 205/333] health: apply the skin-temp preference across the
 window, not just the newest night (#1850)

Reported from a real install: Skin temperature set to Temperature, deltas on screen, no explanation.

The first attempt added the missing sentence. Re-review found that was treating a symptom.

The defect is one level up: leadsAbsolute keyed off the NEWEST row alone, so a wearer with twenty stored temperatures and one recent night without one got twenty-three deltas. The setting says Temperature and the app has temperatures; no sentence makes that acceptable.

leadReading's rule, lifted from the row to the window: the chosen kind wins whenever ANY night carries it, the other stays the fallback, so a choice can never empty the screen. An absolute counts from either column, since a WHOOP CSV import writes absolute degrees C into skinTempDevC (#622).

That makes the mixed case a note was just added for unreachable -- one stored temperature anywhere now leads with temperatures instead of explaining why it will not. Note and helper deleted, and the fallback note is reserved for a window that genuinely holds none, which is its only honest use.

Fallout handled rather than left behind: the shortened-series note is reworded, because the dropped nights can now include the most recent one and "Earlier nights recorded a baseline difference only" would be wrong; both superseded strings are removed from all 7 locale files instead of lingering as dead entries; and kind no longer needs deriving from the newest value, since leading absolute means absolute and the deviation branch takes genuine deviations only.

Three passes treated the display rule as fixed and argued about the copy explaining it. The rule was the bug. The grid test is rewritten around the new rule, asserting the fallback note fires exactly when the window holds no temperature and never otherwise.

Full suite 5127/0. Doc-comment and i18n gates clean. Android only, as with the note it supersedes.
---
 .../src/main/java/com/noop/ui/HealthScreen.kt | 45 +++++++++++--------
 .../java/com/noop/ui/HealthVitalsLogic.kt     |  7 ++-
 .../app/src/main/res/values-de/strings.xml    |  2 +-
 .../app/src/main/res/values-es/strings.xml    |  2 +-
 .../app/src/main/res/values-fr/strings.xml    |  2 +-
 .../app/src/main/res/values-pl/strings.xml    |  2 +-
 .../src/main/res/values-pt-rPT/strings.xml    |  2 +-
 .../app/src/main/res/values-zh/strings.xml    |  2 +-
 android/app/src/main/res/values/strings.xml   |  2 +-
 .../com/noop/ui/SkinTempFallbackNoteTest.kt   | 36 +++++++++++++++
 10 files changed, 73 insertions(+), 29 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ui/HealthScreen.kt b/android/app/src/main/java/com/noop/ui/HealthScreen.kt
index 9dfe2c6f7b..89590e6165 100644
--- a/android/app/src/main/java/com/noop/ui/HealthScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/HealthScreen.kt
@@ -2314,18 +2314,26 @@ private fun buildVitalDetail(
     )
     "skin" -> {
         val fahrenheit = tempUnit == TemperatureUnit.FAHRENHEIT
-        // #1844: the newest reading decides the whole screen — title, unit, chart and every row — and it
-        // leads with the measured ABSOLUTE when that night has one (the #1665 rule, applied here too).
-        // The series must follow the same choice: an absolute plotted against a history of deviations is
-        // arithmetic on two scales, so the readings come from the matching column only.
-        val newest = days.asReversed().asSequence()
-            .firstOrNull { it.skinTempC != null || it.skinTempDevC != null } ?: return null
-        val lead = SkinTempDisplay.leadReading(newest.skinTempC, newest.skinTempDevC, skinTempPreferred)
-            ?: return null
-        val leadsAbsolute = lead.kind == SkinTempDisplay.Kind.ABSOLUTE && newest.skinTempC != null
-        // Deviation-led keeps the #622 bimodal read: a CSV import writes an absolute INTO skinTempDevC, so
-        // the kind is re-derived from the value and the series partitioned to it.
-        val kind = if (leadsAbsolute) SkinTempDisplay.Kind.ABSOLUTE else SkinTempDisplay.kind(lead.value)
+        // #1850: the preference applies across the WINDOW, not just the newest row. Keying the whole
+        // screen off the newest night meant a wearer with twenty stored temperatures and one recent night
+        // without saw twenty-three deltas — the setting says Temperature and the app HAS temperatures.
+        // `leadReading`'s rule lifted to the window: the chosen kind wins whenever any night carries it,
+        // the other is still the fallback, so a choice can never empty the screen.
+        //
+        // An absolute may live in EITHER column (#622: a WHOOP CSV import writes absolute °C into
+        // skinTempDevC), so both count here and in the series below.
+        val anyAbsolute = days.any { row ->
+            row.skinTempC != null || row.skinTempDevC?.let { VitalBands.isAbsoluteSkinTemp(it) } == true
+        }
+        val anyDeviation = days.any { row ->
+            row.skinTempDevC?.let { !VitalBands.isAbsoluteSkinTemp(it) } == true
+        }
+        if (!anyAbsolute && !anyDeviation) return null
+        val leadsAbsolute = when (skinTempPreferred) {
+            SkinTempDisplay.Kind.ABSOLUTE -> anyAbsolute
+            SkinTempDisplay.Kind.DEVIATION -> !anyDeviation && anyAbsolute
+        }
+        val kind = if (leadsAbsolute) SkinTempDisplay.Kind.ABSOLUTE else SkinTempDisplay.Kind.DEVIATION
         val unit = SkinTempDisplay.unitSymbol(kind, fahrenheit)
         val skinReadings = if (leadsAbsolute) {
             // An absolute-led series takes EVERY absolute reading, whichever column holds it. A WHOOP CSV
@@ -2338,9 +2346,11 @@ private fun buildVitalDetail(
                     ?.let { VitalReading(row.day, it, row.deviceId) }
             }
         } else {
+            // Genuine deviations only — an imported absolute sitting in this column belongs to the other
+            // scale and is excluded, exactly as before.
             days.mapNotNull { row ->
                 row.skinTempDevC
-                    ?.takeIf { VitalBands.isAbsoluteSkinTemp(it) == (kind == SkinTempDisplay.Kind.ABSOLUTE) }
+                    ?.takeIf { !VitalBands.isAbsoluteSkinTemp(it) }
                     ?.let { value -> VitalReading(row.day, value, row.deviceId) }
             }
         }
@@ -2361,17 +2371,16 @@ private fun buildVitalDetail(
             // Nights scored before skinTempC shipped kept only the deviation; a scoring pass refills them.
             fallbackNote = when {
                 shouldExplainSkinTempFallback(
-                    skinTempPreferred, leadsAbsolute,
-                    anyAbsoluteInWindow = days.any { it.skinTempC != null },
+                    skinTempPreferred, leadsAbsolute, anyAbsolute,
                 ) ->
                     uiString(R.string.l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae)
-                // Leading with the absolute drops deviation-only nights from the series, so the reading
-                // count falls. Say why rather than letting history look like it vanished.
+                // Leading with the absolute drops deviation-only nights from the series — which can now
+                // include the most recent one. Say why rather than letting history look like it vanished.
                 shouldExplainShortenedSkinTempSeries(
                     leadsAbsolute = leadsAbsolute,
                     shownReadings = skinReadings.size,
                     rowsWithEitherNumber = days.count { it.skinTempC != null || it.skinTempDevC != null },
-                ) -> uiString(R.string.l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_earlier_ni_a45140da)
+                ) -> uiString(R.string.l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b)
                 else -> null
             },
         )
diff --git a/android/app/src/main/java/com/noop/ui/HealthVitalsLogic.kt b/android/app/src/main/java/com/noop/ui/HealthVitalsLogic.kt
index dbb580b946..23126aacbc 100644
--- a/android/app/src/main/java/com/noop/ui/HealthVitalsLogic.kt
+++ b/android/app/src/main/java/com/noop/ui/HealthVitalsLogic.kt
@@ -126,10 +126,9 @@ internal fun shouldExplainShortenedSkinTempSeries(
  * deviation shows the deviation rather than blanking. That is right, but silent — the setting then looks
  * broken, because both choices render the same Δ°C.
  *
- * Requires that NO night in the window has an absolute, not merely that the newest lacks one. When the
- * newest night has no absolute but an older one does, the sentence "no measured temperature for these
- * nights" is false for those older nights — so that case shows nothing. Saying nothing is a gap; saying
- * something untrue about the user's own data is worse.
+ * Requires that NO night in the window carries a temperature. #1850 removed the other case entirely:
+ * the preference now applies across the window, so a single stored temperature anywhere means the screen
+ * leads with temperatures rather than falling back and needing to explain itself.
  *
  * Pure so the decision is testable without Compose.
  */
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 712d17d9ff..b4402c5015 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2682,5 +2682,5 @@
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Wähle dein Zeitformat, Schlaf von Straps ohne Bewegungsdaten und ein Strap-Log, das nicht mehr rät</string>
     <string name="l10n_settings_screen_skin_temperature_fc103030">Hauttemperatur</string>
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Für diese Nächte liegt keine gemessene Temperatur vor — angezeigt wird die Abweichung von deinem Basiswert. Eine Synchronisierung bewertet die letzten Nächte neu und ergänzt sie.</string>
-    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_earlier_ni_a45140da">Es werden nur Nächte mit gemessener Temperatur angezeigt. Für frühere Nächte wurde nur eine Abweichung vom Basiswert erfasst.</string>
+    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Es werden nur Nächte mit gemessener Temperatur angezeigt; für die übrigen wurde nur eine Abweichung vom Basiswert erfasst.</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index f028825f0b..fb9903a627 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2669,5 +2669,5 @@
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Elige el reloj de 12 horas, sueño desde correas que no registran movimiento y un registro que deja de suponer</string>
     <string name="l10n_settings_screen_skin_temperature_fc103030">Temperatura cutánea</string>
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">No hay temperatura medida para estas noches: se muestra la diferencia respecto a tu referencia. Una sincronización vuelve a analizar las noches recientes y la completa.</string>
-    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_earlier_ni_a45140da">Solo se muestran las noches con temperatura medida. En las noches anteriores solo se registró la diferencia respecto a la referencia.</string>
+    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Solo se muestran las noches con temperatura medida; en las demás solo se registró la diferencia respecto a la referencia.</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index c960ce18df..8e915dad5e 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2668,5 +2668,5 @@
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Choisissez l\'horloge 12 heures, le sommeil depuis des bracelets sans données de mouvement, et un journal qui cesse de deviner</string>
     <string name="l10n_settings_screen_skin_temperature_fc103030">Température cutanée</string>
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Aucune température mesurée pour ces nuits — l\'écart par rapport à votre référence est affiché. Une synchronisation réévalue les nuits récentes et le complète.</string>
-    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_earlier_ni_a45140da">Seules les nuits avec une température mesurée sont affichées. Les nuits précédentes n\'ont enregistré qu\'un écart par rapport à la référence.</string>
+    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Seules les nuits avec une température mesurée sont affichées ; les autres n\'ont enregistré qu\'un écart par rapport à la référence.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 56545ea6c7..17d9e3fcc1 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2673,5 +2673,5 @@
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Wybierz zegar 12-godzinny, sen z opasek bez danych o ruchu i dziennik, który przestaje zgadywać</string>
     <string name="l10n_settings_screen_skin_temperature_fc103030">Temperatura skóry</string>
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Brak zmierzonej temperatury dla tych nocy — pokazano różnicę względem Twojej wartości bazowej. Synchronizacja ponownie przelicza ostatnie noce i ją uzupełnia.</string>
-    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_earlier_ni_a45140da">Pokazywane są tylko noce ze zmierzoną temperaturą. We wcześniejszych nocach zapisano jedynie różnicę względem wartości bazowej.</string>
+    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Pokazywane są tylko noce ze zmierzoną temperaturą; w pozostałych zapisano jedynie różnicę względem wartości bazowej.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 1bd0fbed31..ef8de37131 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2661,5 +2661,5 @@
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Escolha o relógio de 12 horas, sono a partir de pulseiras sem dados de movimento e um registo que deixa de adivinhar</string>
     <string name="l10n_settings_screen_skin_temperature_fc103030">Temperatura da pele</string>
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Sem temperatura medida para estas noites — a mostrar a diferença em relação à sua referência. Uma sincronização reavalia as noites recentes e preenche-a.</string>
-    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_earlier_ni_a45140da">Só são mostradas as noites com temperatura medida. As noites anteriores registaram apenas a diferença em relação à referência.</string>
+    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Só são mostradas as noites com temperatura medida; as restantes registaram apenas a diferença em relação à referência.</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 31a99b2d64..792e5ddd40 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2582,5 +2582,5 @@
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">自选 12 小时制、从无运动数据的手环读取睡眠，以及不再靠猜测的手环日志</string>
     <string name="l10n_settings_screen_skin_temperature_fc103030">皮肤温度</string>
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">这些夜晚没有实测温度，显示的是与基线的差值。同步后会重新计算近期夜晚并补上。</string>
-    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_earlier_ni_a45140da">仅显示有实测温度的夜晚。更早的夜晚只记录了与基线的差值。</string>
+    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">仅显示有实测温度的夜晚；其余夜晚只记录了与基线的差值。</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 833d97f475..7fe57612a4 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2695,5 +2695,5 @@
     <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Choose a 12-hour clock, sleep from straps that bank no motion, and a strap log that stops guessing</string>
     <string name="l10n_settings_screen_skin_temperature_fc103030">Skin temperature</string>
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">No measured temperature for these nights — showing the difference from your baseline. A sync re-scores recent nights and fills it in.</string>
-    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_earlier_ni_a45140da">Only nights with a measured temperature are shown. Earlier nights recorded a baseline difference only.</string>
+    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Only nights with a measured temperature are shown; the others recorded a baseline difference only.</string>
 </resources>
diff --git a/android/app/src/test/java/com/noop/ui/SkinTempFallbackNoteTest.kt b/android/app/src/test/java/com/noop/ui/SkinTempFallbackNoteTest.kt
index 149b139ec0..7094af4c96 100644
--- a/android/app/src/test/java/com/noop/ui/SkinTempFallbackNoteTest.kt
+++ b/android/app/src/test/java/com/noop/ui/SkinTempFallbackNoteTest.kt
@@ -2,6 +2,7 @@ package com.noop.ui
 
 import com.noop.analytics.SkinTempDisplay
 import com.noop.analytics.VitalBands
+import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Test
@@ -120,4 +121,39 @@ class SkinTempFallbackNoteTest {
                                                          rowsWithEitherNumber = 12))
     }
 
+
+    // MARK: #1850 — the preference now applies across the WINDOW
+
+    /**
+     * The reported install: Temperature selected, deltas on screen, no explanation. The cause was not the
+     * missing sentence I first added — it was that the whole screen keyed off the NEWEST row, so twenty
+     * stored temperatures lost to one recent night without. The window-wide rule is what fixes it, and
+     * the fallback note is now reserved for a window that genuinely holds none.
+     */
+    @Test
+    fun oneStoredTemperatureAnywhereMeansNoFallbackNote() {
+        assertFalse(shouldExplainSkinTempFallback(SkinTempDisplay.Kind.ABSOLUTE, leadsAbsolute = true,
+                                                  anyAbsoluteInWindow = true))
+    }
+
+    /** Only a window with NO temperature at all still explains itself. */
+    @Test
+    fun anEmptyWindowStillExplains() {
+        assertTrue(shouldExplainSkinTempFallback(SkinTempDisplay.Kind.ABSOLUTE, leadsAbsolute = false,
+                                                 anyAbsoluteInWindow = false))
+    }
+
+    /**
+     * The whole grid for the ABSOLUTE preference, so no quadrant can fall silent again. With the
+     * window-wide rule, `leadsAbsolute == anyAbsolute`, and the only speaking case is neither.
+     */
+    @Test
+    fun everyAbsolutePreferenceCaseIsAccountedFor() {
+        for (anyAbsolute in listOf(false, true)) {
+            val leads = anyAbsolute      // the window-wide rule, stated as the test's own model
+            val explains = shouldExplainSkinTempFallback(SkinTempDisplay.Kind.ABSOLUTE, leads, anyAbsolute)
+            assertEquals("leads=$leads any=$anyAbsolute", !anyAbsolute, explains)
+        }
+    }
+
 }

From 2ec745898ed860c218e774d05b700886fdc2ae91 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 21:03:34 +1200
Subject: [PATCH 206/333] build: staging 426 / iOS 307 for the next testing
 build

Carries #1850: the skin-temp preference now applies across the window, so a
single stored temperature anywhere leads with temperatures instead of falling
back to deltas because the newest night lacks one.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 1e40a3ec34..84e3bc05ec 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 425
+        versionCode = 426
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 09e7ea379b..630d4d527c 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "306"
+    CURRENT_PROJECT_VERSION: "307"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 73be4814315be936856691cacb7218637b4831b2 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 21:57:12 +1200
Subject: [PATCH 207/333] health: backfill the skin-temp absolutes the 21-night
 window never reaches (#1852)

skinTempC is written by the scoring pass, which walks a rolling 21-night window, so nights already outside it when the column landed (2026-08-27, #1663) were never revisited. An install can hold weeks of deviations and a handful of temperatures -- which is what the Temperature setting then has to work with, and on the reporting install left five nights spanning four days against twenty-three deviations spanning three weeks.

The raw material is still there. skinTempSample has NO age-based retention; the only DELETE is the #547 plausibility quarantine, which removes rows outside a valid timestamp window rather than old ones.

RE-DERIVES, NEVER RECONSTRUCTS. absolute = baseline + deviation is available arithmetic and is wrong: the baseline drifts over weeks, so applying one night's baseline to another night's delta manufactures numbers that read as measurements. This re-runs AnalyticsEngine.skinTempFunnel, the same function over the same night window, so a backfilled night and a scored night come from one code path and cannot disagree.

CANNOT DESTROY DATA, which matters because these rows cannot be regenerated: a single-column UPDATE, never an entity upsert that would blank columns it did not carry, and the statement carries AND skinTempC IS NULL so it can only fill a hole. Nothing nulls anything; a night yielding no mean is left alone.

Runs after a successful scoring pass and independently of the display preference, so the data is there whichever way the setting is left and switching between Temperature and vs baseline is instant rather than starting work. One page per pass, so a deep history drains over successive passes rather than becoming the #836/#841 battery shape; nights with no skin samples are skipped before their expensive HR read.

Three re-review passes each found a real defect in the first cut, and all three are the same mistake at different levels -- reusing a piece of the engine while missing the rule around it:

Attribution. The night window is 54 h wide because a night belonging to day D starts on the evening of D-1, so it also contains D-1's night. Handing the funnel everything the window returned averaged TWO nights into one temperature and stored it as D's. The engine attributes by END (#277); sessionsEndingOnDay now does the same, and the reads narrowed to the matched sessions' span as a result.

Paging. The candidate query was a plain "oldest N", returning the same nights every pass -- and the oldest are the ones most likely to have lost their raw samples, so the sweep latched on page one and never reached the newer nights that could fill. It now pages on a cursor, a short page signals the sweep saw everything, and the fruitless watermark is recorded only when a WHOLE sweep filled nothing. That watermark keys on the uncapped outstanding count, since the capped one was constant at the page size and could never notice a newly imported night.

The 4.0 anchor. It is learned window-wide, and the engine's note says that is safe because the offset cancels in the deviation -- true for a delta, not for an absolute. Re-learning from the old window would put backfilled nights on a different offset from the stored ones and plot two scales as one line. The anchor is passed in from the CURRENT scan window, and a 4.0 without one is declined rather than written on the global default, which maps a second real strap's worn band to 47-72 C.

Full suite 5143/0, 16 new cases. Doc-comment and i18n gates clean. Android only; the Apple twin is tracked with its ordering (#1848 first, then #1853).
---
 .../com/noop/analytics/SkinTempBackfill.kt    | 248 ++++++++++++++++++
 .../src/main/java/com/noop/data/WhoopDao.kt   |  41 +++
 .../java/com/noop/data/WhoopRepository.kt     |  16 ++
 .../src/main/java/com/noop/ui/AppViewModel.kt | 105 ++++++++
 .../noop/analytics/SkinTempBackfillTest.kt    | 220 ++++++++++++++++
 5 files changed, 630 insertions(+)
 create mode 100644 android/app/src/main/java/com/noop/analytics/SkinTempBackfill.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/SkinTempBackfillTest.kt

diff --git a/android/app/src/main/java/com/noop/analytics/SkinTempBackfill.kt b/android/app/src/main/java/com/noop/analytics/SkinTempBackfill.kt
new file mode 100644
index 0000000000..82900efc15
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/SkinTempBackfill.kt
@@ -0,0 +1,248 @@
+package com.noop.analytics
+
+import com.noop.data.WhoopRepository
+import com.noop.protocol.DeviceFamily
+import com.noop.data.HrSample
+import com.noop.data.SkinTempSample
+import com.noop.protocol.Whoop4SkinTemp
+
+/**
+ * #1851: fill in the nightly ABSOLUTE skin temperature for nights that only ever stored a deviation.
+ *
+ * `skinTempC` shipped on 2026-08-27 (#1663) and is written by the scoring pass, which walks a rolling
+ * 21-night window. Nights already outside that window when the column landed were never revisited, so an
+ * install can hold weeks of deviations and only a handful of temperatures — which is what the Temperature
+ * setting (#1846) then has to work with.
+ *
+ * The raw material is still there: `skinTempSample` has no age-based retention, and the only DELETE is the
+ * #547 plausibility quarantine, which removes rows OUTSIDE a valid timestamp window rather than old ones.
+ *
+ * ## This RE-DERIVES, it does not reconstruct
+ *
+ * `absolute = baseline + deviation` is available arithmetic and is wrong: the baseline is a rolling value
+ * that drifts over weeks, so applying one night's baseline to another night's delta manufactures numbers
+ * that read as measurements. This instead re-runs [AnalyticsEngine.skinTempFunnel] — the SAME function the
+ * engine uses, over the same night window — so a backfilled night and a scored night are computed by one
+ * code path and cannot disagree.
+ *
+ * ## It cannot destroy data
+ *
+ * Two independent guarantees, because this writes to rows the user cannot regenerate:
+ *  - the write is a single-column UPDATE (`fillSkinTempAbsolute`), never an entity upsert that would blank
+ *    columns it did not carry;
+ *  - that statement carries `AND skinTempC IS NULL`, so it can only fill a hole. A value the engine or an
+ *    import already wrote is never overwritten, and no other column is touched.
+ *
+ * Nothing here nulls anything, and a night that yields no mean is simply left alone.
+ *
+ * ## The WHOOP 4.0 anchor
+ *
+ * On a 4.0 the raw→°C conversion is anchored per device (#938), and that anchor is learned window-wide.
+ * The engine's own note says the offset is safe because it "cancels in the deviation" — true for a delta,
+ * NOT for an absolute. Re-learning an anchor from the old window being filled would put those nights on a
+ * different offset from the ones already stored, and the chart would plot two scales as one line: both
+ * labelled °C, both plausible, silently wrong.
+ *
+ * So the caller passes the anchor the engine is currently using. When a 4.0 has none resolvable, the
+ * backfill declines that device rather than writing on a guessed offset. WHOOP 5/MG carries no anchor
+ * (`raw / 100`) and is unaffected.
+ */
+object SkinTempBackfill {
+
+    /**
+     * Nights per run — deliberately small.
+     *
+     * Each fillable night costs an HR read, and the engine's own note calls those "the big ~86k-row ones".
+     * A years-deep history in one pass would be exactly the #836/#841 battery shape this feature exists
+     * beside, so the work drains across successive scoring passes instead. Nights with no skin samples are
+     * skipped BEFORE their HR read, so the unfillable ones stay cheap.
+     */
+    const val DEFAULT_MAX_NIGHTS = 60
+
+    /**
+     * What a run did. `filled` is nights given a temperature; `noMean` is nights whose raw samples exist
+     * but did not survive the worn gate or the minimum-sample floor; `noSamples` is nights with nothing to
+     * re-derive from. The three are reported separately because they need different answers — the last one
+     * is unrecoverable and should not be presented as "try again".
+     */
+    data class Report(
+        val candidates: Int = 0,
+        val filled: Int = 0,
+        val noMean: Int = 0,
+        val noSamples: Int = 0,
+        /** Nights with no stored sleep session ending on them — nothing to compute a nightly mean over. */
+        val noSessions: Int = 0,
+        /** The newest day this page examined; the caller's cursor for the next page. Empty when none. */
+        val lastDay: String = "",
+        /** True when the page came back short — every outstanding night has now been visited this sweep. */
+        val sweepComplete: Boolean = false,
+        val declinedNoAnchor: Boolean = false,
+    ) {
+        val examined: Int get() = filled + noMean + noSamples + noSessions
+    }
+
+    /**
+     * Whether this device can be backfilled at all, and on what anchor.
+     *
+     * Returns null when a WHOOP 4.0 has no resolved anchor — see the anchor note above. A null result is a
+     * DECLINE, never "use the global default": the global 826 anchor maps a second real strap's worn band
+     * to 47–72 °C, so writing on it would bank temperatures that are not just imprecise but outside human
+     * range, into a column nothing downstream re-checks.
+     */
+    fun anchorFor(family: DeviceFamily, currentAnchorRaw: Double?): Double? = when (family) {
+        DeviceFamily.WHOOP5 -> Whoop4SkinTemp.ANCHOR_RAW   // ignored by the 5/MG conversion; any value is inert
+        DeviceFamily.WHOOP4 -> currentAnchorRaw
+    }
+
+    /** True when [family] needs a per-device anchor before any absolute may be written. */
+    fun requiresAnchor(family: DeviceFamily): Boolean = family == DeviceFamily.WHOOP4
+
+    /**
+     * The night window for a day, byte-identical to the engine's: 30 h before local midnight (a night that
+     * began the previous evening) through [readWindowEnd]. Taking the same bounds is what keeps a
+     * backfilled night's sample set the same one the scoring pass would have used.
+     */
+    fun nightWindow(dayStartLocal: Long, readWindowEnd: Long): LongRange =
+        (dayStartLocal - NIGHT_LOOKBACK_SECONDS)..readWindowEnd
+
+    /** 30 h, matching `IntelligenceEngine`'s `from = dayStart - 30 * 3_600L`. */
+    const val NIGHT_LOOKBACK_SECONDS: Long = 30 * 3_600L
+
+    /**
+     * Re-derive one night's absolute from its raw samples, or null when the funnel keeps nothing.
+     *
+     * Sessions come from the STORED `sleepSession` rows rather than fresh detection — they are that
+     * detection's own persisted output, so the same nights are covered without paying to re-detect them.
+     * A night edited or deleted since is the one case where the two could differ, and there the stored row
+     * is the more truthful input anyway: it is what the rest of the app already shows.
+     */
+    fun nightlyAbsolute(
+        sessions: List<DetectedSleep>,
+        hr: List<HrSample>,
+        skinTemp: List<SkinTempSample>,
+        family: DeviceFamily,
+        anchorRaw: Double?,
+        wornToleranceSec: Long,
+    ): Double? = AnalyticsEngine.skinTempFunnel(
+        sessions = sessions,
+        hr = hr,
+        skinTemp = skinTemp,
+        family = family,
+        anchorRaw = anchorRaw,
+        wornToleranceSec = wornToleranceSec,
+    ).mean
+
+    /**
+     * The sessions belonging to a day, by the engine's own rule (#277):
+     *
+     *     val matched = allSessions.filter { tsInDay(it.end) }
+     *     // Sessions attributed to `day` = those whose end falls on `day` (LOCAL day)
+     *
+     * The night window is 54 h wide — 30 h before local midnight through the next one — because a night
+     * belonging to day D starts on the evening of D-1. That width also catches the night belonging to
+     * D-1, so handing the funnel everything the window returned would average two nights into one
+     * temperature and store it as D's. Attribute by END, exactly as the engine does, or the backfill
+     * writes numbers that are wrong rather than merely absent.
+     */
+    fun sessionsEndingOnDay(
+        sessions: List<Pair<Long, Long>>,
+        dayStartLocal: Long,
+        dayEndExclusive: Long,
+    ): List<DetectedSleep> =
+        sessions.filter { (_, end) -> end >= dayStartLocal && end < dayEndExclusive }
+            .map { (start, end) -> sessionOf(start, end) }
+
+    /** A stored sleep row as the funnel's session type. Only `start`/`end` are read; the rest is inert. */
+    fun sessionOf(startTs: Long, endTs: Long): DetectedSleep =
+        DetectedSleep(
+            start = startTs,
+            end = endTs,
+            efficiency = 0.0,
+            stages = emptyList(),
+            restingHR = null,
+            avgHRV = null,
+        )
+
+    /** One PAGE of candidate day keys, strictly after [afterDay]. See the DAO's note on why this pages. */
+    suspend fun candidates(
+        repo: WhoopRepository,
+        deviceId: String,
+        afterDay: String,
+        max: Int = DEFAULT_MAX_NIGHTS,
+    ): List<String> = repo.daysMissingSkinTempAbsolute(deviceId, afterDay, max)
+
+    /**
+     * Walk the candidate nights and fill what can be re-derived.
+     *
+     * [currentAnchorRaw] must be the anchor the engine is using NOW, not one learned from the window being
+     * filled — see the anchor note on this object. A 4.0 without one is declined outright.
+     *
+     * Reads one night at a time rather than one big span: the deep-history case is exactly where a single
+     * unbounded read would be worst, and a per-night read is also what lets a cancelled run leave every
+     * night it already filled correctly filled.
+     */
+    suspend fun run(
+        repo: WhoopRepository,
+        deviceId: String,
+        family: DeviceFamily,
+        currentAnchorRaw: Double?,
+        wornToleranceSec: Long,
+        zone: java.time.ZoneId = java.time.ZoneId.systemDefault(),
+        nowSeconds: Long = System.currentTimeMillis() / 1000,
+        afterDay: String = "",
+        max: Int = DEFAULT_MAX_NIGHTS,
+        limit: Int = STREAM_LIMIT,
+    ): Report {
+        if (requiresAnchor(family) && currentAnchorRaw == null) {
+            return Report(declinedNoAnchor = true)
+        }
+        val anchor = anchorFor(family, currentAnchorRaw)
+        val days = candidates(repo, deviceId, afterDay, max)
+        if (days.isEmpty()) return Report(sweepComplete = true)
+
+        val nowLocalMidnight = java.time.Instant.ofEpochSecond(nowSeconds)
+            .atZone(zone).toLocalDate().atStartOfDay(zone).toEpochSecond()
+        var filled = 0
+        var noMean = 0
+        var noSamples = 0
+        var noSessions = 0
+        for (day in days) {
+            val dayStart = runCatching {
+                java.time.LocalDate.parse(day).atStartOfDay(zone).toEpochSecond()
+            }.getOrNull() ?: continue
+            val window = nightWindow(dayStart, IntelligenceEngine.sleepReadWindowEnd(dayStart, nowLocalMidnight, nowSeconds))
+            // Sessions FIRST, and attributed to this day, so the reads below cover one night rather than
+            // the 54 h window — which also shrinks the HR read, the expensive one, from ~54 h to ~8 h.
+            val sessions = sessionsEndingOnDay(
+                repo.sleepSessionsForDevice(deviceId, window.first, window.last, limit)
+                    // Honour a user-edited start the same way every other surface does.
+                    .map { (it.startTsAdjusted ?: it.startTs) to it.endTs },
+                dayStartLocal = dayStart,
+                dayEndExclusive = dayStart + SECONDS_PER_DAY,
+            )
+            if (sessions.isEmpty()) { noSessions++; continue }
+            val readFrom = sessions.minOf { it.start }
+            val readTo = sessions.maxOf { it.end }
+            val skin = repo.skinTempSamples(deviceId, readFrom, readTo, limit)
+            if (skin.isEmpty()) { noSamples++; continue }
+            val hr = repo.hrSamplesForDevice(deviceId, readFrom, readTo, limit)
+            val mean = nightlyAbsolute(sessions, hr, skin, family, anchor, wornToleranceSec)
+            if (mean == null) { noMean++; continue }
+            // Fill-only by construction; a row that gained an absolute meanwhile reports 0 and is left be.
+            if (repo.fillSkinTempAbsolute(deviceId, day, mean) > 0) filled++ else noMean++
+        }
+        return Report(
+            candidates = days.size, filled = filled, noMean = noMean,
+            noSamples = noSamples, noSessions = noSessions,
+            lastDay = days.last(),
+            // A short page means this sweep has seen every outstanding night.
+            sweepComplete = days.size < max,
+        )
+    }
+
+    /** Per-night read cap, matching the engine's stream limit. */
+    const val STREAM_LIMIT = 200_000
+
+    /** Seconds in a local day, for the end-of-day bound the engine attributes sessions by. */
+    const val SECONDS_PER_DAY: Long = 86_400L
+}
diff --git a/android/app/src/main/java/com/noop/data/WhoopDao.kt b/android/app/src/main/java/com/noop/data/WhoopDao.kt
index f0aaa38755..c08ceb2b4d 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDao.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDao.kt
@@ -163,6 +163,47 @@ interface WhoopDao : DeviceRegistryDao {
     @Upsert
     suspend fun upsertDailyMetrics(rows: List<DailyMetric>)
 
+    /**
+     * #1851: the day keys that have a skin-temp DEVIATION but no ABSOLUTE beside it — the nights the
+     * 21-night `analyzeRecent` window never revisited after `skinTempC` shipped (2026-08-27).
+     *
+     * PAGED on [afterDay], not just capped. A plain "oldest N" returns the SAME nights every pass, so a
+     * run whose first page cannot fill — and the oldest nights are exactly the ones most likely to have
+     * lost their raw samples — would latch on that page and never reach the newer nights that CAN fill.
+     * The caller advances a cursor, so one sweep visits every candidate exactly once.
+     */
+    @Query(
+        "SELECT day FROM dailyMetric WHERE deviceId = :deviceId " +
+            "AND skinTempC IS NULL AND skinTempDevC IS NOT NULL AND day > :afterDay " +
+            "ORDER BY day ASC LIMIT :limit"
+    )
+    suspend fun daysMissingSkinTempAbsolute(deviceId: String, afterDay: String, limit: Int): List<String>
+
+    /** #1851: how many nights are outstanding in total — the uncapped count the "nothing left to try"
+     *  watermark keys on, so a newly imported night re-arms the sweep. */
+    @Query(
+        "SELECT COUNT(*) FROM dailyMetric WHERE deviceId = :deviceId " +
+            "AND skinTempC IS NULL AND skinTempDevC IS NOT NULL"
+    )
+    suspend fun countDaysMissingSkinTempAbsolute(deviceId: String): Int
+
+    /**
+     * #1851: fill ONE night's absolute, and only when it is absent.
+     *
+     * A targeted UPDATE, deliberately not an `@Upsert` of a rebuilt entity: an upsert writes every column,
+     * so a row assembled from partial data would silently blank whatever it did not carry. This touches
+     * exactly one column on one row.
+     *
+     * `AND skinTempC IS NULL` is the second half of that guarantee — the statement can only ever fill a
+     * hole, never overwrite a value the engine or an import already wrote. Returns rows changed, so a
+     * caller can tell "filled" from "already had one" without reading first.
+     */
+    @Query(
+        "UPDATE dailyMetric SET skinTempC = :celsius " +
+            "WHERE deviceId = :deviceId AND day = :day AND skinTempC IS NULL"
+    )
+    suspend fun fillSkinTempAbsolute(deviceId: String, day: String, celsius: Double): Int
+
     @Upsert
     suspend fun upsertSleepSessions(rows: List<SleepSession>)
 
diff --git a/android/app/src/main/java/com/noop/data/WhoopRepository.kt b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
index 3e7af70938..a9a5b53d8b 100644
--- a/android/app/src/main/java/com/noop/data/WhoopRepository.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
@@ -1175,6 +1175,22 @@ class WhoopRepository(
     suspend fun spo2Samples(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
         dao.spo2Samples(deviceId, from, to, limit)
 
+    /** #1851: nights holding a skin-temp deviation but no absolute, oldest first. See [SkinTempBackfill]. */
+    suspend fun daysMissingSkinTempAbsolute(deviceId: String, afterDay: String, limit: Int): List<String> =
+        dao.daysMissingSkinTempAbsolute(deviceId, afterDay, limit)
+
+    /** #1851: total outstanding nights, uncapped. See [daysMissingSkinTempAbsolute]. */
+    suspend fun countDaysMissingSkinTempAbsolute(deviceId: String): Int =
+        dao.countDaysMissingSkinTempAbsolute(deviceId)
+
+    /**
+     * #1851: fill ONE night's absolute, only where none exists. Returns rows changed (0 = already had one).
+     * The statement itself carries the guarantee — a single-column UPDATE with `AND skinTempC IS NULL`, so
+     * this can never overwrite a value or blank a neighbouring column.
+     */
+    suspend fun fillSkinTempAbsolute(deviceId: String, day: String, celsius: Double): Int =
+        dao.fillSkinTempAbsolute(deviceId, day, celsius)
+
     suspend fun skinTempSamples(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
         dao.skinTempSamples(deviceId, from, to, limit)
 
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index 1da04890bc..add701864c 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -698,6 +698,99 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
     var todayVitalityCache: Double? = null
     var todayVo2maxCache: Double? = null
 
+    /**
+     * #1851 sweep state. A CURSOR, not a "done" flag.
+     *
+     * The candidate query is paged, because a plain "oldest N" returns the same nights every pass — and
+     * the oldest nights are exactly the ones most likely to have lost their raw samples. A page that
+     * cannot fill would otherwise latch, and every newer night that CAN fill would never be reached.
+     */
+    private val skinTempBackfillCursorKey = "skinTemp.backfillCursor"
+
+    /**
+     * The outstanding count at which a COMPLETE sweep filled nothing, so later passes can stop paying for
+     * reads that have already been proved fruitless. Keyed on the uncapped count, so a night arriving
+     * later — an import brings in old history — changes it and re-arms the sweep.
+     */
+    private val skinTempBackfillStuckKey = "skinTemp.backfillStuckAt"
+
+    /** Fills accumulated across the CURRENT sweep, so "the whole sweep found nothing" is distinguishable
+     *  from "this page found nothing". */
+    private val skinTempBackfillSweepFillsKey = "skinTemp.backfillSweepFills"
+
+    /**
+     * #1851: re-derive the nightly ABSOLUTE skin temperature for nights that only ever stored a deviation.
+     *
+     * Runs after a successful scoring pass and independently of the #1846 display preference — the data
+     * must be there whichever way the setting is left, so switching between Temperature and vs baseline is
+     * instant rather than kicking off work.
+     *
+     * One PAGE per pass ([SkinTempBackfill.DEFAULT_MAX_NIGHTS]), advancing a cursor, so a deep history
+     * drains over successive passes instead of turning one pass into the #836/#841 battery shape. When a
+     * page comes back short the sweep has seen everything: the cursor resets, and if the whole sweep filled
+     * nothing the outstanding count is recorded so identical counts are skipped thereafter.
+     *
+     * The WHOOP 4.0 anchor is resolved from the CURRENT scan window, the same span the engine learns its
+     * own anchor over — never from the old window being filled. An absolute is offset-sensitive, so nights
+     * written on a re-learned anchor would sit on a different scale from the ones already stored and the
+     * chart would plot two scales as one line. A 4.0 with no resolvable anchor is declined by the runner,
+     * and a decline records no progress, so it retries once an anchor exists.
+     */
+    private suspend fun backfillSkinTempAbsolutes(deviceId: String) {
+        val prefs = NoopPrefs.of(appContext)
+        val outstanding = repository.countDaysMissingSkinTempAbsolute(deviceId)
+        if (outstanding == 0) return
+        if (prefs.getInt(skinTempBackfillStuckKey, -1) == outstanding) return
+
+        val ownerSource = RegistryDayOwnerSource(noopApp.deviceRegistry)
+        val family = ownerSource.skinTempFamily(deviceId)
+        val tolerance = ownerSource.skinTempWornToleranceSec(deviceId)
+        val now = System.currentTimeMillis() / 1000
+        val anchor = if (family == com.noop.protocol.DeviceFamily.WHOOP4) {
+            // Same span the engine learns its anchor over, NOT the window being filled.
+            val scanFrom = now - 21L * 24 * 3_600
+            val windowSkin = repository.skinTempSamples(
+                deviceId, scanFrom, now, com.noop.analytics.SkinTempBackfill.STREAM_LIMIT,
+            )
+            com.noop.protocol.Whoop4SkinTemp.deviceAnchorRaw(windowSkin.map { it.raw })
+        } else {
+            null
+        }
+        val cursor = prefs.getString(skinTempBackfillCursorKey, "") ?: ""
+        val report = com.noop.analytics.SkinTempBackfill.run(
+            repo = repository,
+            deviceId = deviceId,
+            family = family,
+            currentAnchorRaw = anchor,
+            wornToleranceSec = tolerance,
+            nowSeconds = now,
+            afterDay = cursor,
+        )
+        // A decline records nothing: a 4.0 whose anchor resolves later must still get its backfill.
+        if (!report.declinedNoAnchor) {
+            val sweepFills = prefs.getInt(skinTempBackfillSweepFillsKey, 0) + report.filled
+            val edit = prefs.edit()
+            if (report.sweepComplete) {
+                // Every outstanding night has been visited. Start the next sweep from the top, and only
+                // stop paying for reads when the WHOLE sweep — not just its last page — found nothing.
+                edit.remove(skinTempBackfillCursorKey).remove(skinTempBackfillSweepFillsKey)
+                if (sweepFills == 0) edit.putInt(skinTempBackfillStuckKey, outstanding)
+            } else {
+                edit.putString(skinTempBackfillCursorKey, report.lastDay)
+                    .putInt(skinTempBackfillSweepFillsKey, sweepFills)
+            }
+            if (report.filled > 0) edit.remove(skinTempBackfillStuckKey)
+            edit.apply()
+        }
+        ble.externalLog(
+            "skinTempBackfill: page=${report.candidates} filled=${report.filled} noMean=${report.noMean} " +
+                "noSamples=${report.noSamples} noSessions=${report.noSessions} " +
+                "outstanding=$outstanding sweepComplete=${report.sweepComplete} " +
+                "declined=${report.declinedNoAnchor}",
+            com.noop.testcentre.TestDomain.UNIVERSAL,
+        )
+    }
+
     /**
      * Recent daily metrics (newest last), backing the Today grid + illness watch.
      * MERGED: imported "my-whoop" rows win per day; on-device computed "my-whoop-noop"
@@ -1188,6 +1281,15 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
                     // own cancellation — rethrow it so onCleared() actually stops the loop. (#125)
                 }.onSuccess {
                     NoopPrefs.setAnalyzeWatermark(appContext, analyzeFp)
+                    // #1851: fill the skin-temp absolutes the 21-night window never reaches. Runs AFTER a
+                    // successful pass so it never competes with scoring, and independently of the #1846
+                    // display preference — the data must be there whichever way the setting is left, so
+                    // flipping it is instant rather than kicking off work.
+                    //
+                    // Once per install (a prefs flag), because the nights it fills stay filled; a later
+                    // night that misses out is picked up by the scoring pass that owns it.
+                    runCatching { backfillSkinTempAbsolutes(deviceId) }
+                        .onFailure { if (it is kotlin.coroutines.cancellation.CancellationException) throw it }
                     // #1735: the watermark says WHAT was scored, never WHEN. "re-score: done" goes only to
                     // the live log, so hours later the rolling buffer has dropped it and an export cannot
                     // tell a pass that ran from one that never did - which is half of "my ride still is not
@@ -2961,6 +3063,9 @@ enum class DoubleTapAction {
         }
 
     companion object {
+        /** #1851 one-shot guard: the absolutes backfill has completed for this install. */
+        const val skinTempBackfillDoneKey = "skinTemp.backfillDone"
+
         /** Decode a persisted name back to an action; tolerant of an unknown/blank value (→ [NONE]). */
         fun fromRaw(raw: String?): DoubleTapAction =
             entries.firstOrNull { it.name == raw } ?: NONE
diff --git a/android/app/src/test/java/com/noop/analytics/SkinTempBackfillTest.kt b/android/app/src/test/java/com/noop/analytics/SkinTempBackfillTest.kt
new file mode 100644
index 0000000000..5e8058ee4c
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/SkinTempBackfillTest.kt
@@ -0,0 +1,220 @@
+package com.noop.analytics
+
+import com.noop.protocol.DeviceFamily
+import com.noop.protocol.Whoop4SkinTemp
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #1851: re-deriving a night's absolute skin temperature from raw samples the app still holds.
+ *
+ * The parts worth pinning are the ones that could corrupt data rather than merely fail: the WHOOP 4.0
+ * anchor decline, and that the night window matches the engine's.
+ */
+class SkinTempBackfillTest {
+
+    /**
+     * A 4.0 with no resolved anchor must be DECLINED, never written on the global default.
+     *
+     * That default (826) maps a second real strap's worn band to 47-72 °C — outside human range, into a
+     * column nothing downstream re-checks. Declining leaves the nights as deviations, which is the honest
+     * state; writing would bank fiction that looks like a reading.
+     */
+    @Test
+    fun aWhoop4WithoutAnAnchorIsDeclined() {
+        assertTrue(SkinTempBackfill.requiresAnchor(DeviceFamily.WHOOP4))
+        assertNull(SkinTempBackfill.anchorFor(DeviceFamily.WHOOP4, currentAnchorRaw = null))
+    }
+
+    /** A 4.0 WITH a resolved anchor uses exactly that one — never re-learned from the window being filled,
+     *  which would put backfilled nights on a different offset from the ones already stored. */
+    @Test
+    fun aWhoop4UsesTheAnchorItIsGiven() {
+        assertEquals(1290.0, SkinTempBackfill.anchorFor(DeviceFamily.WHOOP4, 1290.0))
+        // Notably NOT the global default, which is what a re-learn would have fallen back to.
+        assertTrue(1290.0 != Whoop4SkinTemp.ANCHOR_RAW)
+    }
+
+    /** 5/MG converts with raw/100 and carries no anchor, so it is never gated on one. */
+    @Test
+    fun whoop5NeedsNoAnchor() {
+        assertFalse(SkinTempBackfill.requiresAnchor(DeviceFamily.WHOOP5))
+        assertNotNull(SkinTempBackfill.anchorFor(DeviceFamily.WHOOP5, currentAnchorRaw = null))
+    }
+
+    /** The night window must match the engine's `from = dayStart - 30h`, or a backfilled night would be
+     *  computed over a different sample set from the one the scoring pass would have used. */
+    @Test
+    fun theNightWindowMatchesTheEngines() {
+        val dayStart = 1_760_000_000L
+        val end = dayStart + 86_400
+        val w = SkinTempBackfill.nightWindow(dayStart, end)
+        assertEquals(dayStart - 30 * 3_600L, w.first)
+        assertEquals(end, w.last)
+        assertEquals(30 * 3_600L, SkinTempBackfill.NIGHT_LOOKBACK_SECONDS)
+    }
+
+    /** A stored sleep row becomes a session carrying only its bounds — the funnel reads nothing else, and
+     *  inventing efficiency/stages here would be fabricating inputs the backfill does not have. */
+    @Test
+    fun aStoredRowBecomesABoundsOnlySession() {
+        val s = SkinTempBackfill.sessionOf(startTs = 100L, endTs = 200L)
+        assertEquals(100L, s.start)
+        assertEquals(200L, s.end)
+        assertTrue(s.stages.isEmpty())
+        assertNull(s.restingHR)
+        assertNull(s.avgHRV)
+    }
+
+    /** No samples means no temperature — the backfill must never synthesise one from the deviation. */
+    @Test
+    fun noSamplesYieldsNoAbsolute() {
+        val mean = SkinTempBackfill.nightlyAbsolute(
+            sessions = listOf(SkinTempBackfill.sessionOf(0L, 1_000L)),
+            hr = emptyList(),
+            skinTemp = emptyList(),
+            family = DeviceFamily.WHOOP5,
+            anchorRaw = null,
+            wornToleranceSec = 0,
+        )
+        assertNull(mean)
+    }
+
+    /** The report separates recoverable from unrecoverable, because they need different answers: a night
+     *  with no banked samples will never fill, however many times the backfill is re-run. */
+    @Test
+    fun theReportDistinguishesWhyANightDidNotFill() {
+        val r = SkinTempBackfill.Report(candidates = 10, filled = 4, noMean = 2, noSamples = 4)
+        assertEquals(10, r.examined)
+        val declined = SkinTempBackfill.Report(declinedNoAnchor = true)
+        assertEquals(0, declined.examined)
+        assertTrue(declined.declinedNoAnchor)
+    }
+
+    // MARK: re-review — the run must drain, and must never strand nights that arrive later
+
+    /**
+     * The per-run cap is small on purpose: each FILLABLE night costs a large HR read, so a years-deep
+     * history in one pass is the #836/#841 battery shape. The work drains across scoring passes instead.
+     */
+    @Test
+    fun theRunIsCappedSmallEnoughToDrainAcrossPasses() {
+        assertTrue("a cap this large would be a one-pass battery event",
+                   SkinTempBackfill.DEFAULT_MAX_NIGHTS <= 100)
+        assertTrue(SkinTempBackfill.DEFAULT_MAX_NIGHTS > 0)
+    }
+
+    /**
+     * A decline must not look like progress. The caller only records a "fruitless" watermark when the run
+     * actually examined nights and filled none — a 4.0 declined for a missing anchor examined nothing, so
+     * it must retry once an anchor exists rather than being written off.
+     */
+    @Test
+    fun aDeclineIsDistinguishableFromAFruitlessRun() {
+        val declined = SkinTempBackfill.Report(declinedNoAnchor = true)
+        val fruitless = SkinTempBackfill.Report(candidates = 5, noSamples = 5)
+        assertTrue(declined.declinedNoAnchor)
+        assertFalse(fruitless.declinedNoAnchor)
+        assertEquals(0, declined.filled)
+        assertEquals(0, fruitless.filled)
+        // The two differ in whether anything was looked at, which is what the caller keys on.
+        assertEquals(0, declined.examined)
+        assertEquals(5, fruitless.examined)
+    }
+
+    // MARK: re-review 2 — the 54 h window holds TWO nights, and only one belongs to the day
+
+    /**
+     * The bug this pins would have written WRONG temperatures rather than none.
+     *
+     * The night window runs 30 h before local midnight to the next one, because a night belonging to day D
+     * starts on the evening of D-1. At 54 h wide it also contains the night belonging to D-1, so handing
+     * the funnel everything the window returned averaged two nights into one value and stored it as D's.
+     *
+     * The engine attributes by END (#277): `matched = allSessions.filter { tsInDay(it.end) }`.
+     */
+    @Test
+    fun onlyTheNightEndingOnThatDayIsUsed() {
+        val dayStart = 1_760_000_000L
+        val dayEnd = dayStart + SkinTempBackfill.SECONDS_PER_DAY
+        val previousNight = (dayStart - 26 * 3_600L) to (dayStart - 18 * 3_600L)   // ends on D-1
+        val thisNight = (dayStart - 2 * 3_600L) to (dayStart + 6 * 3_600L)         // ends on D
+        val nextNight = (dayEnd - 2 * 3_600L) to (dayEnd + 6 * 3_600L)             // ends on D+1
+
+        val matched = SkinTempBackfill.sessionsEndingOnDay(
+            listOf(previousNight, thisNight, nextNight), dayStart, dayEnd,
+        )
+        assertEquals(1, matched.size)
+        assertEquals(thisNight.first, matched.single().start)
+        assertEquals(thisNight.second, matched.single().end)
+    }
+
+    /** A daytime nap ending on the same day counts too — the engine keeps both in `matched`. */
+    @Test
+    fun aNapEndingOnTheSameDayIsIncluded() {
+        val dayStart = 1_760_000_000L
+        val dayEnd = dayStart + SkinTempBackfill.SECONDS_PER_DAY
+        val night = (dayStart - 2 * 3_600L) to (dayStart + 6 * 3_600L)
+        val nap = (dayStart + 14 * 3_600L) to (dayStart + 15 * 3_600L)
+        assertEquals(2, SkinTempBackfill.sessionsEndingOnDay(listOf(night, nap), dayStart, dayEnd).size)
+    }
+
+    /** The day bound is [start, end) — a session ending exactly at the next midnight belongs to the NEXT
+     *  day, matching a local-day bucket that cannot claim the same instant twice. */
+    @Test
+    fun theDayBoundIsHalfOpen() {
+        val dayStart = 1_760_000_000L
+        val dayEnd = dayStart + SkinTempBackfill.SECONDS_PER_DAY
+        assertEquals(1, SkinTempBackfill.sessionsEndingOnDay(listOf(0L to dayStart), dayStart, dayEnd).size)
+        assertEquals(0, SkinTempBackfill.sessionsEndingOnDay(listOf(0L to dayEnd), dayStart, dayEnd).size)
+    }
+
+    /** "No session for this night" is not "no samples" — they are different answers to the user, so the
+     *  report keeps them apart. */
+    @Test
+    fun theReportSeparatesMissingSessionsFromMissingSamples() {
+        val r = SkinTempBackfill.Report(candidates = 6, filled = 1, noMean = 1, noSamples = 2, noSessions = 2)
+        assertEquals(6, r.examined)
+    }
+
+    // MARK: re-review 3 — a sweep must reach every night, not re-try the same page forever
+
+    /**
+     * The bug this pins is silent and permanent.
+     *
+     * The candidate query used to be a plain "oldest N", so every pass got the SAME nights — and the
+     * oldest nights are precisely the ones most likely to have lost their raw samples. A first page that
+     * could not fill latched the fruitless watermark, and every NEWER night that could have filled was
+     * never reached. The user would see a handful of temperatures and no reason why.
+     *
+     * Paging means a short page — fewer than the cap — is the signal that the sweep has seen everything.
+     */
+    @Test
+    fun aShortPageMeansTheSweepHasSeenEverything() {
+        val full = SkinTempBackfill.Report(candidates = SkinTempBackfill.DEFAULT_MAX_NIGHTS, sweepComplete = false)
+        assertFalse("a full page cannot be the end of a sweep", full.sweepComplete)
+        val short = SkinTempBackfill.Report(candidates = 3, sweepComplete = true)
+        assertTrue(short.sweepComplete)
+    }
+
+    /** An empty page ends the sweep too — nothing outstanding after the cursor. */
+    @Test
+    fun anEmptyPageEndsTheSweep() {
+        val empty = SkinTempBackfill.Report(sweepComplete = true)
+        assertTrue(empty.sweepComplete)
+        assertEquals("", empty.lastDay)
+        assertEquals(0, empty.examined)
+    }
+
+    /** The cursor is the newest day the page examined, so the next page starts strictly after it and no
+     *  night is visited twice within one sweep. */
+    @Test
+    fun theCursorIsThePagesNewestDay() {
+        val r = SkinTempBackfill.Report(candidates = 2, filled = 1, lastDay = "2026-08-11")
+        assertEquals("2026-08-11", r.lastDay)
+    }
+}
\ No newline at end of file

From 4078180a8a6c367f7203ab0022d12c546ce1d3b1 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 21:57:32 +1200
Subject: [PATCH 208/333] build: staging 427 / iOS 308 for the next testing
 build

Carries #1852: the skin-temp absolutes backfill, so nights the 21-night scoring
window never reached get their measured temperature re-derived from raw samples
still on disk. Android-only change; the iOS leg is unaffected but rides the same
build.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 84e3bc05ec..7087bfd447 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 426
+        versionCode = 427
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 630d4d527c..1936eb5ba4 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "307"
+    CURRENT_PROJECT_VERSION: "308"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 0c88047d872cceceb960a31f24958102a2e0a6bc Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 22:43:10 +1200
Subject: [PATCH 209/333] health: the absolutes backfill never ran on the
 installs that need it (#1854)

Field report on testing build 427: same five nights, same locked ranges, no change. TWO independent silent no-ops, either one sufficient to make the feature invisible -- and neither in the computation.

FIRST, the gate. The backfill sat inside the scoring pass's onSuccess, under `if (analyzeHasNewData)` -- the #836 gate that skips the heavy 21-day rescore when no scoring stream has moved. So a feature whose entire job is reprocessing OLD nights only ran when NEW data arrived. A strap that has not synced has no new data, so no pass, so no backfill; and an install whose newest reading is weeks old is precisely the one the backfill exists for. It could not have worked for the person who asked for it.

Moved outside the gate into the same tick body, which runs about six seconds after launch and then on a 15-minute timeout, so it now runs on app start with no sync required. Safe to run unconditionally: with nothing outstanding it costs one COUNT and returns, and the fruitless watermark stops it paying for reads once a whole sweep comes back empty.

SECOND, the namespace, found by auditing the seams rather than the logic once the first defect showed where to look. The engine writes scored rows under `computedId = importedDeviceId + "-noop"` -- dailyMetric AND sleepSession -- while raw skinTempSample / hrSample rows are banked under the STRAP id. I used the strap id for all four, so the candidate query and the session read looked in a namespace holding neither, found nothing, and the sweep reported zero outstanding, indistinguishable from "already done". Even with the gating fix this would have run every tick and filled nothing, forever.

Split explicitly so the seam is visible rather than implied: rows (candidates, sessions, the fill) go through computedIdFor(deviceId), raw sample reads keep the strap id. computedIdFor is idempotent on an already-computed id, mirroring the repository's own ownerComputed idiom, or a re-entry would look for "-noop-noop" and again find nothing.

Both defects share a shape worth recording: sixteen tests covered the maths and none could see either, because both live at the boundary where this code meets code someone else wrote -- one inherited a gate, one assumed a namespace. The parts written fresh were fine; the parts attached to existing machinery took that machinery's assumptions with them.

Full suite 5145/0. Doc-comment and i18n gates clean.
---
 .../com/noop/analytics/SkinTempBackfill.kt    | 22 ++++++++++++---
 .../src/main/java/com/noop/ui/AppViewModel.kt | 27 ++++++++++++-------
 .../noop/analytics/SkinTempBackfillTest.kt    | 22 +++++++++++++++
 3 files changed, 58 insertions(+), 13 deletions(-)

diff --git a/android/app/src/main/java/com/noop/analytics/SkinTempBackfill.kt b/android/app/src/main/java/com/noop/analytics/SkinTempBackfill.kt
index 82900efc15..1facb7f3e2 100644
--- a/android/app/src/main/java/com/noop/analytics/SkinTempBackfill.kt
+++ b/android/app/src/main/java/com/noop/analytics/SkinTempBackfill.kt
@@ -163,6 +163,20 @@ object SkinTempBackfill {
             avgHRV = null,
         )
 
+    /**
+     * The COMPUTED namespace a scored row lives in — `<strap>-noop`, matching the engine's
+     * `computedId = importedDeviceId + "-noop"`.
+     *
+     * This backfill straddles two namespaces and querying one for both finds nothing at all:
+     *  - dailyMetric rows and sleepSession rows are written by the engine under the COMPUTED id;
+     *  - raw skinTempSample / hrSample rows are banked under the STRAP id ("raw rows sit under the strap
+     *    id and the ... computed rows under the -noop id").
+     *
+     * Idempotent on an id that is already computed, mirroring the repository's own `ownerComputed` idiom.
+     */
+    fun computedIdFor(deviceId: String): String =
+        if (deviceId.endsWith("-noop")) deviceId else "$deviceId-noop"
+
     /** One PAGE of candidate day keys, strictly after [afterDay]. See the DAO's note on why this pages. */
     suspend fun candidates(
         repo: WhoopRepository,
@@ -183,6 +197,7 @@ object SkinTempBackfill {
      */
     suspend fun run(
         repo: WhoopRepository,
+        /** The STRAP id. Row reads/writes use its computed twin; raw sample reads use it directly. */
         deviceId: String,
         family: DeviceFamily,
         currentAnchorRaw: Double?,
@@ -197,7 +212,8 @@ object SkinTempBackfill {
             return Report(declinedNoAnchor = true)
         }
         val anchor = anchorFor(family, currentAnchorRaw)
-        val days = candidates(repo, deviceId, afterDay, max)
+        val rowId = computedIdFor(deviceId)
+        val days = candidates(repo, rowId, afterDay, max)
         if (days.isEmpty()) return Report(sweepComplete = true)
 
         val nowLocalMidnight = java.time.Instant.ofEpochSecond(nowSeconds)
@@ -214,7 +230,7 @@ object SkinTempBackfill {
             // Sessions FIRST, and attributed to this day, so the reads below cover one night rather than
             // the 54 h window — which also shrinks the HR read, the expensive one, from ~54 h to ~8 h.
             val sessions = sessionsEndingOnDay(
-                repo.sleepSessionsForDevice(deviceId, window.first, window.last, limit)
+                repo.sleepSessionsForDevice(rowId, window.first, window.last, limit)
                     // Honour a user-edited start the same way every other surface does.
                     .map { (it.startTsAdjusted ?: it.startTs) to it.endTs },
                 dayStartLocal = dayStart,
@@ -229,7 +245,7 @@ object SkinTempBackfill {
             val mean = nightlyAbsolute(sessions, hr, skin, family, anchor, wornToleranceSec)
             if (mean == null) { noMean++; continue }
             // Fill-only by construction; a row that gained an absolute meanwhile reports 0 and is left be.
-            if (repo.fillSkinTempAbsolute(deviceId, day, mean) > 0) filled++ else noMean++
+            if (repo.fillSkinTempAbsolute(rowId, day, mean) > 0) filled++ else noMean++
         }
         return Report(
             candidates = days.size, filled = filled, noMean = noMean,
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index add701864c..c4cc6ebf67 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -738,7 +738,11 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
      */
     private suspend fun backfillSkinTempAbsolutes(deviceId: String) {
         val prefs = NoopPrefs.of(appContext)
-        val outstanding = repository.countDaysMissingSkinTempAbsolute(deviceId)
+        // Scored rows live in the COMPUTED namespace; raw samples under the strap id. Counting the strap
+        // id here found nothing at all, so the sweep looked finished before it began.
+        val outstanding = repository.countDaysMissingSkinTempAbsolute(
+            com.noop.analytics.SkinTempBackfill.computedIdFor(deviceId),
+        )
         if (outstanding == 0) return
         if (prefs.getInt(skinTempBackfillStuckKey, -1) == outstanding) return
 
@@ -1281,15 +1285,6 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
                     // own cancellation — rethrow it so onCleared() actually stops the loop. (#125)
                 }.onSuccess {
                     NoopPrefs.setAnalyzeWatermark(appContext, analyzeFp)
-                    // #1851: fill the skin-temp absolutes the 21-night window never reaches. Runs AFTER a
-                    // successful pass so it never competes with scoring, and independently of the #1846
-                    // display preference — the data must be there whichever way the setting is left, so
-                    // flipping it is instant rather than kicking off work.
-                    //
-                    // Once per install (a prefs flag), because the nights it fills stay filled; a later
-                    // night that misses out is picked up by the scoring pass that owns it.
-                    runCatching { backfillSkinTempAbsolutes(deviceId) }
-                        .onFailure { if (it is kotlin.coroutines.cancellation.CancellationException) throw it }
                     // #1735: the watermark says WHAT was scored, never WHEN. "re-score: done" goes only to
                     // the live log, so hours later the rolling buffer has dropped it and an export cannot
                     // tell a pass that ran from one that never did - which is half of "my ride still is not
@@ -1300,6 +1295,18 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
                     }
                 }
                     .onFailure { if (it is kotlin.coroutines.cancellation.CancellationException) throw it }
+                // #1854: OUTSIDE the `analyzeHasNewData` gate on purpose.
+                //
+                // This was inside the scoring pass's onSuccess, which only runs when the fingerprint moved
+                // — so a feature whose entire job is reprocessing OLD nights never ran on the installs that
+                // need it most: a strap that has not synced has no new data, so no pass, so no backfill.
+                // The one install this was built for sat with five temperatures and never attempted the
+                // rest.
+                //
+                // Safe to run on every tick: it costs one COUNT when there is nothing outstanding, and the
+                // fruitless watermark stops it paying for reads once a whole sweep has come back empty.
+                runCatching { backfillSkinTempAbsolutes(deviceId) }
+                    .onFailure { if (it is kotlin.coroutines.cancellation.CancellationException) throw it }
                 // Opt-in writeback: push the freshly computed nights into Health Connect so other
                 // apps see them. Idempotent (clientRecordId per metric+day), so re-running every
                 // cycle just upserts. Never let an HC hiccup (perm revoked mid-flight, provider
diff --git a/android/app/src/test/java/com/noop/analytics/SkinTempBackfillTest.kt b/android/app/src/test/java/com/noop/analytics/SkinTempBackfillTest.kt
index 5e8058ee4c..b97ff028c0 100644
--- a/android/app/src/test/java/com/noop/analytics/SkinTempBackfillTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/SkinTempBackfillTest.kt
@@ -217,4 +217,26 @@ class SkinTempBackfillTest {
         val r = SkinTempBackfill.Report(candidates = 2, filled = 1, lastDay = "2026-08-11")
         assertEquals("2026-08-11", r.lastDay)
     }
+
+    // MARK: re-review 4 — the backfill straddles TWO device namespaces
+
+    /**
+     * Querying one namespace for both finds nothing at all, and silently: the sweep reports zero
+     * outstanding and looks finished before it has begun.
+     *
+     * The engine writes scored rows under `computedId = importedDeviceId + "-noop"` — dailyMetric AND
+     * sleepSession — while raw skinTempSample / hrSample rows are banked under the STRAP id. The first cut
+     * used the strap id for all four, so it found no candidates and no sessions.
+     */
+    @Test
+    fun scoredRowsLiveInTheComputedNamespace() {
+        assertEquals("my-whoop-noop", SkinTempBackfill.computedIdFor("my-whoop"))
+    }
+
+    /** Idempotent on an id that is already computed, mirroring the repository's own ownerComputed idiom —
+     *  otherwise a re-entry would look for "…-noop-noop" and, again, find nothing. */
+    @Test
+    fun theComputedIdIsIdempotent() {
+        assertEquals("my-whoop-noop", SkinTempBackfill.computedIdFor("my-whoop-noop"))
+    }
 }
\ No newline at end of file

From f0a32fa033a096ecc9944bbfa5aaa5ddedf9c61d Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 22:43:30 +1200
Subject: [PATCH 210/333] build: staging 428 / iOS 309 for the next testing
 build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Carries #1854: the skin-temp absolutes backfill actually runs now. It was behind
the scoring pass's new-data gate, and it queried the strap id for rows the engine
writes under the computed -noop namespace — two independent reasons it did
nothing on 427.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 7087bfd447..9e83514233 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 427
+        versionCode = 428
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 1936eb5ba4..2caa63f810 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "308"
+    CURRENT_PROJECT_VERSION: "309"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 47bad5d06e59df8ef79af6972f8ab475c43a5171 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 23:37:25 +1200
Subject: [PATCH 211/333] =?UTF-8?q?health:=20stop=20predicting=20which=20d?=
 =?UTF-8?q?evice=20a=20night=20belongs=20to=20=E2=80=94=20read=20it=20off?=
 =?UTF-8?q?=20the=20row=20(#1856)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Third field report of "still five days", on the third build. Two releases of this backfill found nothing, and both failures were the same mistake with different values: they PREDICTED the device id a scored row carries.

#1852 used the strap id, for rows the engine writes under the computed "-noop" namespace. #1854 fixed that by deriving <active>-noop -- still a prediction, and the active device is not reliably the one a row belongs to: #1303's serial adoption moves the strap id, a second strap owns its own rows, an imported history carries whatever id it arrived under.

Both find NOTHING rather than something wrong, which is the worst failure available here: zero outstanding is indistinguishable from "already done", so the feature reports success and does nothing. Three builds shipped that way.

The query no longer filters by device. It returns (deviceId, day) and every id is taken FROM THE ROW: the row's own id for the fill and the session read, and its id with the computed suffix removed for the raw sample reads. There is no id left to get wrong.

The same assumption was hiding one level up. Family, anchor and worn tolerance were resolved ONCE from the active device and applied to every row -- on a two-strap install that is not a missing number but a wrong one, one strap's raw register converted on another strap's scale. `run` now takes a deviceContext resolver, called per strap and cached, and a strap it declines is declined alone rather than stalling the sweep.

Re-review then caught three consequences of dropping that filter, each an old assumption surviving in a corner the change had invalidated:

A declined strap froze the sweep. declinedNoAnchor used to mean "the whole run declined"; it now means "some strap was declined", but the caller still read it as "record nothing" and skipped the cursor advance. One un-anchored 4.0 anywhere in the history would pin the sweep on page one and re-read it every tick, forever. The cursor now always advances; a decline withholds only the stuck watermark.

The cursor was a day, and days are no longer unique. Without a device filter one day can hold rows for several devices, so a page boundary between two same-day rows skipped the far side for the whole sweep. The cursor is composite (day|deviceId), the query orders by both, and that comparison is only sound because the day key is fixed-width ISO -- now written down rather than implied.

The diagnostic did not reconcile. Declined nights were counted locally and never reported, so a page of un-anchored nights logged candidates=60 examined=0 with no category covering them. declined is now a Report field inside examined, declinedNoAnchor is derived from it so the two cannot drift, and a test asserts candidates == examined.

Full suite 5149/0. Doc-comment and i18n gates clean.
---
 .../com/noop/analytics/SkinTempBackfill.kt    | 103 +++++++++++++-----
 .../src/main/java/com/noop/data/Entities.kt   |  13 +++
 .../src/main/java/com/noop/data/WhoopDao.kt   |  25 +++--
 .../java/com/noop/data/WhoopRepository.kt     |  10 +-
 .../src/main/java/com/noop/ui/AppViewModel.kt |  83 +++++++-------
 .../noop/analytics/SkinTempBackfillTest.kt    |  88 +++++++++++++--
 6 files changed, 234 insertions(+), 88 deletions(-)

diff --git a/android/app/src/main/java/com/noop/analytics/SkinTempBackfill.kt b/android/app/src/main/java/com/noop/analytics/SkinTempBackfill.kt
index 1facb7f3e2..cbdf8a273b 100644
--- a/android/app/src/main/java/com/noop/analytics/SkinTempBackfill.kt
+++ b/android/app/src/main/java/com/noop/analytics/SkinTempBackfill.kt
@@ -72,13 +72,22 @@ object SkinTempBackfill {
         val noSamples: Int = 0,
         /** Nights with no stored sleep session ending on them — nothing to compute a nightly mean over. */
         val noSessions: Int = 0,
-        /** The newest day this page examined; the caller's cursor for the next page. Empty when none. */
-        val lastDay: String = "",
+        /** COMPOSITE cursor (`day|deviceId`) for the next page — a day alone would skip a same-day row on
+         *  the far side of a page boundary. Empty when the page was empty. */
+        val lastCursor: String = "",
         /** True when the page came back short — every outstanding night has now been visited this sweep. */
         val sweepComplete: Boolean = false,
-        val declinedNoAnchor: Boolean = false,
+        /**
+         * Nights skipped because their strap could not be converted — a WHOOP 4.0 with no resolvable
+         * anchor. Counted, not silent: this log line exists to answer "why did nothing fill?", and a
+         * candidates/examined pair that does not reconcile sends the reader looking in the wrong place.
+         */
+        val declined: Int = 0,
     ) {
-        val examined: Int get() = filled + noMean + noSamples + noSessions
+        val examined: Int get() = filled + noMean + noSamples + noSessions + declined
+
+        /** Whether ANY strap was declined this page. Derived, so it cannot drift from [declined]. */
+        val declinedNoAnchor: Boolean get() = declined > 0
     }
 
     /**
@@ -177,19 +186,37 @@ object SkinTempBackfill {
     fun computedIdFor(deviceId: String): String =
         if (deviceId.endsWith("-noop")) deviceId else "$deviceId-noop"
 
+    /**
+     * The STRAP id a scored row's raw samples are banked under — its own id with the computed suffix
+     * removed. Derived from the row rather than from whatever device happens to be active, because the
+     * two are not reliably the same (#1303 serial adoption, a second strap, an imported history).
+     */
+    fun sampleIdFor(rowDeviceId: String): String = rowDeviceId.removeSuffix("-noop")
+
     /** One PAGE of candidate day keys, strictly after [afterDay]. See the DAO's note on why this pages. */
     suspend fun candidates(
         repo: WhoopRepository,
-        deviceId: String,
-        afterDay: String,
+        afterCursor: String,
         max: Int = DEFAULT_MAX_NIGHTS,
-    ): List<String> = repo.daysMissingSkinTempAbsolute(deviceId, afterDay, max)
+    ): List<com.noop.data.SkinTempBackfillRow> = repo.daysMissingSkinTempAbsolute(afterCursor, max)
+
+    /**
+     * Everything a strap's nights need to convert raw to °C. Null from the resolver DECLINES that strap —
+     * used when a WHOOP 4.0 has no anchor, where writing on the global default would bank temperatures
+     * outside human range.
+     */
+    data class DeviceContext(
+        val family: DeviceFamily,
+        val anchorRaw: Double?,
+        val wornToleranceSec: Long,
+    )
 
     /**
      * Walk the candidate nights and fill what can be re-derived.
      *
-     * [currentAnchorRaw] must be the anchor the engine is using NOW, not one learned from the window being
-     * filled — see the anchor note on this object. A 4.0 without one is declined outright.
+     * Every id comes off the ROW, and every conversion context off [deviceContext] for that row's strap —
+     * nothing here predicts which device a night belongs to. A 4.0 whose anchor will not resolve is
+     * declined for that strap alone, so one unusable device cannot stall the rest.
      *
      * Reads one night at a time rather than one big span: the deep-history case is exactly where a single
      * unbounded read would be worst, and a per-night read is also what lets a cancelled run leave every
@@ -197,23 +224,23 @@ object SkinTempBackfill {
      */
     suspend fun run(
         repo: WhoopRepository,
-        /** The STRAP id. Row reads/writes use its computed twin; raw sample reads use it directly. */
-        deviceId: String,
-        family: DeviceFamily,
-        currentAnchorRaw: Double?,
-        wornToleranceSec: Long,
+        /**
+         * Resolves a STRAP id to its conversion context, or null to decline it.
+         *
+         * A lambda rather than three fixed values because rows can belong to ANY device — a second strap,
+         * an imported history, an id #1303's serial adoption has moved. Resolving once from whatever
+         * device is "active" and applying it to every row is the same predicted-id mistake that made two
+         * earlier releases of this find nothing, just one level up: here it would not find nothing, it
+         * would convert one strap's raw register on another strap's scale.
+         */
+        deviceContext: suspend (String) -> DeviceContext?,
         zone: java.time.ZoneId = java.time.ZoneId.systemDefault(),
         nowSeconds: Long = System.currentTimeMillis() / 1000,
-        afterDay: String = "",
+        afterCursor: String = "",
         max: Int = DEFAULT_MAX_NIGHTS,
         limit: Int = STREAM_LIMIT,
     ): Report {
-        if (requiresAnchor(family) && currentAnchorRaw == null) {
-            return Report(declinedNoAnchor = true)
-        }
-        val anchor = anchorFor(family, currentAnchorRaw)
-        val rowId = computedIdFor(deviceId)
-        val days = candidates(repo, rowId, afterDay, max)
+        val days = candidates(repo, afterCursor, max)
         if (days.isEmpty()) return Report(sweepComplete = true)
 
         val nowLocalMidnight = java.time.Instant.ofEpochSecond(nowSeconds)
@@ -222,7 +249,19 @@ object SkinTempBackfill {
         var noMean = 0
         var noSamples = 0
         var noSessions = 0
-        for (day in days) {
+        var declined = 0
+        // One resolve per strap, not per night.
+        val contexts = HashMap<String, DeviceContext?>()
+        for (row in days) {
+            val day = row.day
+            // Both namespaces come FROM THE ROW: the scored row's own id, and the strap id its raw
+            // samples sit under. Nothing here predicts an id.
+            val rowId = row.deviceId
+            val sampleId = sampleIdFor(rowId)
+            val ctx = contexts.getOrPut(sampleId) { deviceContext(sampleId) }
+            if (ctx == null) { declined++; continue }
+            if (requiresAnchor(ctx.family) && ctx.anchorRaw == null) { declined++; continue }
+            val anchor = anchorFor(ctx.family, ctx.anchorRaw)
             val dayStart = runCatching {
                 java.time.LocalDate.parse(day).atStartOfDay(zone).toEpochSecond()
             }.getOrNull() ?: continue
@@ -239,18 +278,18 @@ object SkinTempBackfill {
             if (sessions.isEmpty()) { noSessions++; continue }
             val readFrom = sessions.minOf { it.start }
             val readTo = sessions.maxOf { it.end }
-            val skin = repo.skinTempSamples(deviceId, readFrom, readTo, limit)
+            val skin = repo.skinTempSamples(sampleId, readFrom, readTo, limit)
             if (skin.isEmpty()) { noSamples++; continue }
-            val hr = repo.hrSamplesForDevice(deviceId, readFrom, readTo, limit)
-            val mean = nightlyAbsolute(sessions, hr, skin, family, anchor, wornToleranceSec)
+            val hr = repo.hrSamplesForDevice(sampleId, readFrom, readTo, limit)
+            val mean = nightlyAbsolute(sessions, hr, skin, ctx.family, anchor, ctx.wornToleranceSec)
             if (mean == null) { noMean++; continue }
             // Fill-only by construction; a row that gained an absolute meanwhile reports 0 and is left be.
             if (repo.fillSkinTempAbsolute(rowId, day, mean) > 0) filled++ else noMean++
         }
         return Report(
             candidates = days.size, filled = filled, noMean = noMean,
-            noSamples = noSamples, noSessions = noSessions,
-            lastDay = days.last(),
+            noSamples = noSamples, noSessions = noSessions, declined = declined,
+            lastCursor = cursorOf(days.last()),
             // A short page means this sweep has seen every outstanding night.
             sweepComplete = days.size < max,
         )
@@ -259,6 +298,16 @@ object SkinTempBackfill {
     /** Per-night read cap, matching the engine's stream limit. */
     const val STREAM_LIMIT = 200_000
 
+    /**
+     * The composite paging cursor for a row — see [Report.lastCursor].
+     *
+     * Safe as a plain string comparison because [com.noop.data.DailyMetric.day] is FIXED-WIDTH ISO
+     * (`yyyy-MM-dd`): the separator always lands at the same offset, so comparing the concatenation is
+     * exactly comparing `(day, deviceId)`, which is the order the query pages in. A variable-width key
+     * here would silently reorder the sweep.
+     */
+    fun cursorOf(row: com.noop.data.SkinTempBackfillRow): String = "${row.day}|${row.deviceId}"
+
     /** Seconds in a local day, for the end-of-day bound the engine attributes sessions by. */
     const val SECONDS_PER_DAY: Long = 86_400L
 }
diff --git a/android/app/src/main/java/com/noop/data/Entities.kt b/android/app/src/main/java/com/noop/data/Entities.kt
index 9e4bcfad05..0a8249c631 100644
--- a/android/app/src/main/java/com/noop/data/Entities.kt
+++ b/android/app/src/main/java/com/noop/data/Entities.kt
@@ -745,3 +745,16 @@ data class V18AuxSampleEntity(
         return result
     }
 }
+
+/**
+ * #1855: one candidate row for the skin-temp absolutes backfill — the day AND the device namespace it
+ * actually lives in.
+ *
+ * The id is READ, never assumed. Scored rows sit under the engine's `<strap>-noop` namespace while raw
+ * samples sit under the strap id, and #1303's serial adoption can move the strap id underneath both. Two
+ * separate releases of this backfill found nothing because they predicted the id instead of reading it.
+ */
+data class SkinTempBackfillRow(
+    val deviceId: String,
+    val day: String,
+)
diff --git a/android/app/src/main/java/com/noop/data/WhoopDao.kt b/android/app/src/main/java/com/noop/data/WhoopDao.kt
index c08ceb2b4d..ffbe725e09 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDao.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDao.kt
@@ -167,25 +167,34 @@ interface WhoopDao : DeviceRegistryDao {
      * #1851: the day keys that have a skin-temp DEVIATION but no ABSOLUTE beside it — the nights the
      * 21-night `analyzeRecent` window never revisited after `skinTempC` shipped (2026-08-27).
      *
-     * PAGED on [afterDay], not just capped. A plain "oldest N" returns the SAME nights every pass, so a
+     * NOT filtered by device, deliberately. The id a scored row carries is not something a caller can
+     * safely predict: the engine writes under `<strap>-noop`, and #1303's serial adoption can move the
+     * strap id itself. Guessing it wrong finds nothing and is indistinguishable from "already done" —
+     * which is exactly how this shipped twice. The row carries its own id; take it from there.
+     *
+     * The cursor is COMPOSITE (`day|deviceId`), not the day alone. Without a device filter a single day
+     * can hold rows for several devices, and a page boundary falling between them would skip the row on
+     * the far side for the whole sweep — a night silently never attempted.
+     *
+     * PAGED, not just capped. A plain "oldest N" returns the SAME nights every pass, so a
      * run whose first page cannot fill — and the oldest nights are exactly the ones most likely to have
      * lost their raw samples — would latch on that page and never reach the newer nights that CAN fill.
      * The caller advances a cursor, so one sweep visits every candidate exactly once.
      */
     @Query(
-        "SELECT day FROM dailyMetric WHERE deviceId = :deviceId " +
-            "AND skinTempC IS NULL AND skinTempDevC IS NOT NULL AND day > :afterDay " +
-            "ORDER BY day ASC LIMIT :limit"
+        "SELECT deviceId, day FROM dailyMetric " +
+            "WHERE skinTempC IS NULL AND skinTempDevC IS NOT NULL " +
+            "AND (day || '|' || deviceId) > :afterCursor " +
+            "ORDER BY day ASC, deviceId ASC LIMIT :limit"
     )
-    suspend fun daysMissingSkinTempAbsolute(deviceId: String, afterDay: String, limit: Int): List<String>
+    suspend fun daysMissingSkinTempAbsolute(afterCursor: String, limit: Int): List<SkinTempBackfillRow>
 
     /** #1851: how many nights are outstanding in total — the uncapped count the "nothing left to try"
      *  watermark keys on, so a newly imported night re-arms the sweep. */
     @Query(
-        "SELECT COUNT(*) FROM dailyMetric WHERE deviceId = :deviceId " +
-            "AND skinTempC IS NULL AND skinTempDevC IS NOT NULL"
+        "SELECT COUNT(*) FROM dailyMetric WHERE skinTempC IS NULL AND skinTempDevC IS NOT NULL"
     )
-    suspend fun countDaysMissingSkinTempAbsolute(deviceId: String): Int
+    suspend fun countDaysMissingSkinTempAbsolute(): Int
 
     /**
      * #1851: fill ONE night's absolute, and only when it is absent.
diff --git a/android/app/src/main/java/com/noop/data/WhoopRepository.kt b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
index a9a5b53d8b..b0574a85c0 100644
--- a/android/app/src/main/java/com/noop/data/WhoopRepository.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
@@ -1176,12 +1176,12 @@ class WhoopRepository(
         dao.spo2Samples(deviceId, from, to, limit)
 
     /** #1851: nights holding a skin-temp deviation but no absolute, oldest first. See [SkinTempBackfill]. */
-    suspend fun daysMissingSkinTempAbsolute(deviceId: String, afterDay: String, limit: Int): List<String> =
-        dao.daysMissingSkinTempAbsolute(deviceId, afterDay, limit)
+    suspend fun daysMissingSkinTempAbsolute(afterCursor: String, limit: Int): List<SkinTempBackfillRow> =
+        dao.daysMissingSkinTempAbsolute(afterCursor, limit)
 
-    /** #1851: total outstanding nights, uncapped. See [daysMissingSkinTempAbsolute]. */
-    suspend fun countDaysMissingSkinTempAbsolute(deviceId: String): Int =
-        dao.countDaysMissingSkinTempAbsolute(deviceId)
+    /** #1851: total outstanding nights, uncapped and across every device. See the DAO's note on why this
+     *  is not filtered by id. */
+    suspend fun countDaysMissingSkinTempAbsolute(): Int = dao.countDaysMissingSkinTempAbsolute()
 
     /**
      * #1851: fill ONE night's absolute, only where none exists. Returns rows changed (0 = already had one).
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index c4cc6ebf67..fdcedabcac 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -738,59 +738,68 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
      */
     private suspend fun backfillSkinTempAbsolutes(deviceId: String) {
         val prefs = NoopPrefs.of(appContext)
-        // Scored rows live in the COMPUTED namespace; raw samples under the strap id. Counting the strap
-        // id here found nothing at all, so the sweep looked finished before it began.
-        val outstanding = repository.countDaysMissingSkinTempAbsolute(
-            com.noop.analytics.SkinTempBackfill.computedIdFor(deviceId),
-        )
+        // #1855: not filtered by device. Two releases of this found nothing because they PREDICTED the id
+        // a scored row carries — the engine's "-noop" namespace, and a strap id that #1303's serial
+        // adoption can move underneath it. Each row now carries the id it actually lives under.
+        val outstanding = repository.countDaysMissingSkinTempAbsolute()
         if (outstanding == 0) return
         if (prefs.getInt(skinTempBackfillStuckKey, -1) == outstanding) return
 
         val ownerSource = RegistryDayOwnerSource(noopApp.deviceRegistry)
-        val family = ownerSource.skinTempFamily(deviceId)
-        val tolerance = ownerSource.skinTempWornToleranceSec(deviceId)
         val now = System.currentTimeMillis() / 1000
-        val anchor = if (family == com.noop.protocol.DeviceFamily.WHOOP4) {
-            // Same span the engine learns its anchor over, NOT the window being filled.
-            val scanFrom = now - 21L * 24 * 3_600
-            val windowSkin = repository.skinTempSamples(
-                deviceId, scanFrom, now, com.noop.analytics.SkinTempBackfill.STREAM_LIMIT,
-            )
-            com.noop.protocol.Whoop4SkinTemp.deviceAnchorRaw(windowSkin.map { it.raw })
-        } else {
-            null
-        }
         val cursor = prefs.getString(skinTempBackfillCursorKey, "") ?: ""
         val report = com.noop.analytics.SkinTempBackfill.run(
             repo = repository,
-            deviceId = deviceId,
-            family = family,
-            currentAnchorRaw = anchor,
-            wornToleranceSec = tolerance,
+            // Resolved per STRAP the rows actually belong to, not once from whatever device is active —
+            // converting one strap's raw register on another strap's scale is a wrong number, not a
+            // missing one.
+            deviceContext = { strapId ->
+                val family = ownerSource.skinTempFamily(strapId)
+                val anchor = if (family == com.noop.protocol.DeviceFamily.WHOOP4) {
+                    // The span the engine learns its anchor over, NOT the window being filled.
+                    val windowSkin = repository.skinTempSamples(
+                        strapId, now - 21L * 24 * 3_600, now,
+                        com.noop.analytics.SkinTempBackfill.STREAM_LIMIT,
+                    )
+                    com.noop.protocol.Whoop4SkinTemp.deviceAnchorRaw(windowSkin.map { it.raw })
+                } else {
+                    null
+                }
+                com.noop.analytics.SkinTempBackfill.DeviceContext(
+                    family = family,
+                    anchorRaw = anchor,
+                    wornToleranceSec = ownerSource.skinTempWornToleranceSec(strapId),
+                )
+            },
             nowSeconds = now,
-            afterDay = cursor,
+            afterCursor = cursor,
         )
-        // A decline records nothing: a 4.0 whose anchor resolves later must still get its backfill.
-        if (!report.declinedNoAnchor) {
-            val sweepFills = prefs.getInt(skinTempBackfillSweepFillsKey, 0) + report.filled
-            val edit = prefs.edit()
-            if (report.sweepComplete) {
-                // Every outstanding night has been visited. Start the next sweep from the top, and only
-                // stop paying for reads when the WHOLE sweep — not just its last page — found nothing.
-                edit.remove(skinTempBackfillCursorKey).remove(skinTempBackfillSweepFillsKey)
-                if (sweepFills == 0) edit.putInt(skinTempBackfillStuckKey, outstanding)
-            } else {
-                edit.putString(skinTempBackfillCursorKey, report.lastDay)
-                    .putInt(skinTempBackfillSweepFillsKey, sweepFills)
+        // The cursor ALWAYS advances. `declinedNoAnchor` now means "some strap was declined", not "the run
+        // did nothing" — withholding the bookkeeping on it would freeze the cursor and re-process page one
+        // on every tick, forever, for any install holding one un-anchored 4.0. A decline only withholds
+        // the STUCK watermark, so the sweep retries once that strap's anchor resolves.
+        val sweepFills = prefs.getInt(skinTempBackfillSweepFillsKey, 0) + report.filled
+        val edit = prefs.edit()
+        if (report.sweepComplete) {
+            // Every outstanding night has been visited. Start the next sweep from the top, and only stop
+            // paying for reads when the WHOLE sweep — not just its last page — found nothing AND nothing
+            // was declined.
+            edit.remove(skinTempBackfillCursorKey).remove(skinTempBackfillSweepFillsKey)
+            if (sweepFills == 0 && !report.declinedNoAnchor) {
+                edit.putInt(skinTempBackfillStuckKey, outstanding)
             }
-            if (report.filled > 0) edit.remove(skinTempBackfillStuckKey)
-            edit.apply()
+        } else {
+            edit.putString(skinTempBackfillCursorKey, report.lastCursor)
+                .putInt(skinTempBackfillSweepFillsKey, sweepFills)
         }
+        if (report.filled > 0) edit.remove(skinTempBackfillStuckKey)
+        edit.apply()
         ble.externalLog(
             "skinTempBackfill: page=${report.candidates} filled=${report.filled} noMean=${report.noMean} " +
                 "noSamples=${report.noSamples} noSessions=${report.noSessions} " +
+                "declined=${report.declined} " +
                 "outstanding=$outstanding sweepComplete=${report.sweepComplete} " +
-                "declined=${report.declinedNoAnchor}",
+                "sweepFills=$sweepFills",
             com.noop.testcentre.TestDomain.UNIVERSAL,
         )
     }
diff --git a/android/app/src/test/java/com/noop/analytics/SkinTempBackfillTest.kt b/android/app/src/test/java/com/noop/analytics/SkinTempBackfillTest.kt
index b97ff028c0..7973db003e 100644
--- a/android/app/src/test/java/com/noop/analytics/SkinTempBackfillTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/SkinTempBackfillTest.kt
@@ -90,8 +90,8 @@ class SkinTempBackfillTest {
     fun theReportDistinguishesWhyANightDidNotFill() {
         val r = SkinTempBackfill.Report(candidates = 10, filled = 4, noMean = 2, noSamples = 4)
         assertEquals(10, r.examined)
-        val declined = SkinTempBackfill.Report(declinedNoAnchor = true)
-        assertEquals(0, declined.examined)
+        val declined = SkinTempBackfill.Report(candidates = 2, declined = 2)
+        assertEquals(2, declined.examined)
         assertTrue(declined.declinedNoAnchor)
     }
 
@@ -115,14 +115,14 @@ class SkinTempBackfillTest {
      */
     @Test
     fun aDeclineIsDistinguishableFromAFruitlessRun() {
-        val declined = SkinTempBackfill.Report(declinedNoAnchor = true)
+        val declined = SkinTempBackfill.Report(candidates = 3, declined = 3)
         val fruitless = SkinTempBackfill.Report(candidates = 5, noSamples = 5)
         assertTrue(declined.declinedNoAnchor)
         assertFalse(fruitless.declinedNoAnchor)
         assertEquals(0, declined.filled)
         assertEquals(0, fruitless.filled)
-        // The two differ in whether anything was looked at, which is what the caller keys on.
-        assertEquals(0, declined.examined)
+        // Both examined their nights; they differ in WHY nothing filled, which is what the log must say.
+        assertEquals(3, declined.examined)
         assertEquals(5, fruitless.examined)
     }
 
@@ -206,16 +206,65 @@ class SkinTempBackfillTest {
     fun anEmptyPageEndsTheSweep() {
         val empty = SkinTempBackfill.Report(sweepComplete = true)
         assertTrue(empty.sweepComplete)
-        assertEquals("", empty.lastDay)
+        assertEquals("", empty.lastCursor)
         assertEquals(0, empty.examined)
     }
 
-    /** The cursor is the newest day the page examined, so the next page starts strictly after it and no
-     *  night is visited twice within one sweep. */
+    /**
+     * Every candidate on a page must be accounted for by exactly one outcome.
+     *
+     * The run's log line exists to answer "why did nothing fill?". A candidates/examined pair that does
+     * not reconcile sends the reader hunting for a missing category — and declined nights were counted
+     * locally but never surfaced, so a page of un-anchored 4.0 nights reported candidates=60, examined=0
+     * and no reason at all.
+     */
+    @Test
+    fun everyCandidateIsAccountedFor() {
+        val r = SkinTempBackfill.Report(
+            candidates = 10, filled = 2, noMean = 1, noSamples = 3, noSessions = 1, declined = 3,
+        )
+        assertEquals("candidates must reconcile with the outcomes", r.candidates, r.examined)
+    }
+
+    /** The flag is DERIVED from the count, so the two cannot drift apart. */
+    @Test
+    fun theDeclineFlagFollowsTheCount() {
+        assertFalse(SkinTempBackfill.Report(declined = 0).declinedNoAnchor)
+        assertTrue(SkinTempBackfill.Report(declined = 1).declinedNoAnchor)
+    }
+
+    /**
+     * The cursor is COMPOSITE (`day|deviceId`), not the day alone.
+     *
+     * With no device filter a single day can hold rows for several devices. A day-only cursor would skip
+     * whichever same-day row fell on the far side of a page boundary — a night silently never attempted,
+     * which is the failure mode this whole feature keeps producing.
+     */
     @Test
-    fun theCursorIsThePagesNewestDay() {
-        val r = SkinTempBackfill.Report(candidates = 2, filled = 1, lastDay = "2026-08-11")
-        assertEquals("2026-08-11", r.lastDay)
+    fun theCursorCarriesTheDeviceToo() {
+        val row = com.noop.data.SkinTempBackfillRow(deviceId = "my-whoop-noop", day = "2026-08-11")
+        assertEquals("2026-08-11|my-whoop-noop", SkinTempBackfill.cursorOf(row))
+        // Two rows sharing a day produce DIFFERENT cursors, which is the whole point.
+        val other = com.noop.data.SkinTempBackfillRow(deviceId = "my-whoop", day = "2026-08-11")
+        assertTrue(SkinTempBackfill.cursorOf(row) != SkinTempBackfill.cursorOf(other))
+    }
+
+    /**
+     * A decline must not look like "the run did nothing".
+     *
+     * `declinedNoAnchor` now means SOME strap was declined, not that the run examined nothing. The caller
+     * must still advance its cursor on it — withholding the bookkeeping would freeze the sweep on page one
+     * and re-read it every tick, forever, on any install holding one un-anchored 4.0.
+     */
+    @Test
+    fun aDeclinedStrapStillLeavesUsableProgress() {
+        val r = SkinTempBackfill.Report(
+            candidates = 60, filled = 3, noSamples = 40, declined = 17,
+            lastCursor = "2026-08-11|my-whoop-noop",
+        )
+        assertTrue(r.declinedNoAnchor)
+        assertTrue("a declining run can still fill other straps' nights", r.filled > 0)
+        assertTrue("and must still hand back a cursor", r.lastCursor.isNotEmpty())
     }
 
     // MARK: re-review 4 — the backfill straddles TWO device namespaces
@@ -233,6 +282,23 @@ class SkinTempBackfillTest {
         assertEquals("my-whoop-noop", SkinTempBackfill.computedIdFor("my-whoop"))
     }
 
+    /**
+     * #1855: the STRAP id a row's raw samples sit under is DERIVED FROM THE ROW, never predicted.
+     *
+     * Two releases of this backfill found nothing because they guessed the id — first the strap id for
+     * rows the engine writes under "-noop", then the active device's id for rows that may belong to
+     * another strap entirely (#1303 serial adoption, a second strap, an imported history). Both failures
+     * were silent and read as "already done".
+     */
+    @Test
+    fun theSampleIdComesOffTheRowsOwnId() {
+        assertEquals("my-whoop", SkinTempBackfill.sampleIdFor("my-whoop-noop"))
+        // An id that never carried the suffix is already a strap id.
+        assertEquals("whoop-4A2B", SkinTempBackfill.sampleIdFor("whoop-4A2B"))
+        // Round-trips with computedIdFor, so the pair cannot drift apart.
+        assertEquals("whoop-4A2B", SkinTempBackfill.sampleIdFor(SkinTempBackfill.computedIdFor("whoop-4A2B")))
+    }
+
     /** Idempotent on an id that is already computed, mirroring the repository's own ownerComputed idiom —
      *  otherwise a re-entry would look for "…-noop-noop" and, again, find nothing. */
     @Test

From 15060dd3c280f56b0cced0320630ec63d1e37575 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Thu, 3 Sep 2026 23:37:46 +1200
Subject: [PATCH 212/333] build: staging 429 / iOS 310 for the next testing
 build

Carries #1856: the skin-temp backfill takes every device id off the row instead
of predicting it, which is why the previous two builds filled nothing. The run
also logs a reconciling per-night breakdown now, so an export says whether the
remaining nights have banked raw samples rather than leaving it to inference.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 9e83514233..bf6c1b00ff 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 428
+        versionCode = 429
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 2caa63f810..351296c30b 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "309"
+    CURRENT_PROJECT_VERSION: "310"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 7ec3dbc37d350cc88358265c67b54270f2c6260e Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 00:00:04 +1200
Subject: [PATCH 213/333] Revert the skin-temp absolutes backfill (#1857)

Four builds shipped this and none worked on the install it was written for. Each failure was a different piece of wiring, each found only after a person tested it, and none were in the computation:

#1852 queried the strap id for rows the engine writes under the computed "-noop" namespace. #1854 ran it inside the scoring pass's new-data gate, so a feature for reprocessing OLD nights only ran when NEW data arrived. #1856 stopped predicting the id altogether, and still did not fill on the reporting install.

Every one of those fails to NOTHING rather than to something wrong, which is why each kept reading as "already done" and kept costing another round-trip. The remaining unknown -- whether those nights have banked raw samples at all -- was never settled, so the third fix is unverified rather than known-good.

Reverting rather than leaving it merged: on an install where it finds nothing it still walks the tick, and carrying an unverified background job with a standing read cost is worse than not having the feature.

The revert is exact: 821 deletions, no insertions, no surviving references, and no schema to unwind -- the backfill only ever added queries and a plain data class, never an entity or a column.

Untouched, because none of it depended on the backfill: skin temp leading with the measured temperature, the Settings choice between temperature and baseline, the fallback notes, the per-field HRV / resting-HR carries and the signed-zero fix. skinTempC itself came from #1663 and stays; it is what the display reads.

The tracking issue stays open with the design constraints that were genuinely learned: re-derive rather than reconstruct from baseline + deviation, take every device id off the row, attribute sessions by END, page the sweep on a composite cursor, and on a WHOOP 4.0 use the current anchor or decline.

Full suite 5127/0 (5149 minus the 22 tests that went with it). Doc-comment and i18n gates clean.
---
 .../com/noop/analytics/SkinTempBackfill.kt    | 313 ------------------
 .../src/main/java/com/noop/data/Entities.kt   |  13 -
 .../src/main/java/com/noop/data/WhoopDao.kt   |  50 ---
 .../java/com/noop/data/WhoopRepository.kt     |  16 -
 .../src/main/java/com/noop/ui/AppViewModel.kt | 121 -------
 .../noop/analytics/SkinTempBackfillTest.kt    | 308 -----------------
 6 files changed, 821 deletions(-)
 delete mode 100644 android/app/src/main/java/com/noop/analytics/SkinTempBackfill.kt
 delete mode 100644 android/app/src/test/java/com/noop/analytics/SkinTempBackfillTest.kt

diff --git a/android/app/src/main/java/com/noop/analytics/SkinTempBackfill.kt b/android/app/src/main/java/com/noop/analytics/SkinTempBackfill.kt
deleted file mode 100644
index cbdf8a273b..0000000000
--- a/android/app/src/main/java/com/noop/analytics/SkinTempBackfill.kt
+++ /dev/null
@@ -1,313 +0,0 @@
-package com.noop.analytics
-
-import com.noop.data.WhoopRepository
-import com.noop.protocol.DeviceFamily
-import com.noop.data.HrSample
-import com.noop.data.SkinTempSample
-import com.noop.protocol.Whoop4SkinTemp
-
-/**
- * #1851: fill in the nightly ABSOLUTE skin temperature for nights that only ever stored a deviation.
- *
- * `skinTempC` shipped on 2026-08-27 (#1663) and is written by the scoring pass, which walks a rolling
- * 21-night window. Nights already outside that window when the column landed were never revisited, so an
- * install can hold weeks of deviations and only a handful of temperatures — which is what the Temperature
- * setting (#1846) then has to work with.
- *
- * The raw material is still there: `skinTempSample` has no age-based retention, and the only DELETE is the
- * #547 plausibility quarantine, which removes rows OUTSIDE a valid timestamp window rather than old ones.
- *
- * ## This RE-DERIVES, it does not reconstruct
- *
- * `absolute = baseline + deviation` is available arithmetic and is wrong: the baseline is a rolling value
- * that drifts over weeks, so applying one night's baseline to another night's delta manufactures numbers
- * that read as measurements. This instead re-runs [AnalyticsEngine.skinTempFunnel] — the SAME function the
- * engine uses, over the same night window — so a backfilled night and a scored night are computed by one
- * code path and cannot disagree.
- *
- * ## It cannot destroy data
- *
- * Two independent guarantees, because this writes to rows the user cannot regenerate:
- *  - the write is a single-column UPDATE (`fillSkinTempAbsolute`), never an entity upsert that would blank
- *    columns it did not carry;
- *  - that statement carries `AND skinTempC IS NULL`, so it can only fill a hole. A value the engine or an
- *    import already wrote is never overwritten, and no other column is touched.
- *
- * Nothing here nulls anything, and a night that yields no mean is simply left alone.
- *
- * ## The WHOOP 4.0 anchor
- *
- * On a 4.0 the raw→°C conversion is anchored per device (#938), and that anchor is learned window-wide.
- * The engine's own note says the offset is safe because it "cancels in the deviation" — true for a delta,
- * NOT for an absolute. Re-learning an anchor from the old window being filled would put those nights on a
- * different offset from the ones already stored, and the chart would plot two scales as one line: both
- * labelled °C, both plausible, silently wrong.
- *
- * So the caller passes the anchor the engine is currently using. When a 4.0 has none resolvable, the
- * backfill declines that device rather than writing on a guessed offset. WHOOP 5/MG carries no anchor
- * (`raw / 100`) and is unaffected.
- */
-object SkinTempBackfill {
-
-    /**
-     * Nights per run — deliberately small.
-     *
-     * Each fillable night costs an HR read, and the engine's own note calls those "the big ~86k-row ones".
-     * A years-deep history in one pass would be exactly the #836/#841 battery shape this feature exists
-     * beside, so the work drains across successive scoring passes instead. Nights with no skin samples are
-     * skipped BEFORE their HR read, so the unfillable ones stay cheap.
-     */
-    const val DEFAULT_MAX_NIGHTS = 60
-
-    /**
-     * What a run did. `filled` is nights given a temperature; `noMean` is nights whose raw samples exist
-     * but did not survive the worn gate or the minimum-sample floor; `noSamples` is nights with nothing to
-     * re-derive from. The three are reported separately because they need different answers — the last one
-     * is unrecoverable and should not be presented as "try again".
-     */
-    data class Report(
-        val candidates: Int = 0,
-        val filled: Int = 0,
-        val noMean: Int = 0,
-        val noSamples: Int = 0,
-        /** Nights with no stored sleep session ending on them — nothing to compute a nightly mean over. */
-        val noSessions: Int = 0,
-        /** COMPOSITE cursor (`day|deviceId`) for the next page — a day alone would skip a same-day row on
-         *  the far side of a page boundary. Empty when the page was empty. */
-        val lastCursor: String = "",
-        /** True when the page came back short — every outstanding night has now been visited this sweep. */
-        val sweepComplete: Boolean = false,
-        /**
-         * Nights skipped because their strap could not be converted — a WHOOP 4.0 with no resolvable
-         * anchor. Counted, not silent: this log line exists to answer "why did nothing fill?", and a
-         * candidates/examined pair that does not reconcile sends the reader looking in the wrong place.
-         */
-        val declined: Int = 0,
-    ) {
-        val examined: Int get() = filled + noMean + noSamples + noSessions + declined
-
-        /** Whether ANY strap was declined this page. Derived, so it cannot drift from [declined]. */
-        val declinedNoAnchor: Boolean get() = declined > 0
-    }
-
-    /**
-     * Whether this device can be backfilled at all, and on what anchor.
-     *
-     * Returns null when a WHOOP 4.0 has no resolved anchor — see the anchor note above. A null result is a
-     * DECLINE, never "use the global default": the global 826 anchor maps a second real strap's worn band
-     * to 47–72 °C, so writing on it would bank temperatures that are not just imprecise but outside human
-     * range, into a column nothing downstream re-checks.
-     */
-    fun anchorFor(family: DeviceFamily, currentAnchorRaw: Double?): Double? = when (family) {
-        DeviceFamily.WHOOP5 -> Whoop4SkinTemp.ANCHOR_RAW   // ignored by the 5/MG conversion; any value is inert
-        DeviceFamily.WHOOP4 -> currentAnchorRaw
-    }
-
-    /** True when [family] needs a per-device anchor before any absolute may be written. */
-    fun requiresAnchor(family: DeviceFamily): Boolean = family == DeviceFamily.WHOOP4
-
-    /**
-     * The night window for a day, byte-identical to the engine's: 30 h before local midnight (a night that
-     * began the previous evening) through [readWindowEnd]. Taking the same bounds is what keeps a
-     * backfilled night's sample set the same one the scoring pass would have used.
-     */
-    fun nightWindow(dayStartLocal: Long, readWindowEnd: Long): LongRange =
-        (dayStartLocal - NIGHT_LOOKBACK_SECONDS)..readWindowEnd
-
-    /** 30 h, matching `IntelligenceEngine`'s `from = dayStart - 30 * 3_600L`. */
-    const val NIGHT_LOOKBACK_SECONDS: Long = 30 * 3_600L
-
-    /**
-     * Re-derive one night's absolute from its raw samples, or null when the funnel keeps nothing.
-     *
-     * Sessions come from the STORED `sleepSession` rows rather than fresh detection — they are that
-     * detection's own persisted output, so the same nights are covered without paying to re-detect them.
-     * A night edited or deleted since is the one case where the two could differ, and there the stored row
-     * is the more truthful input anyway: it is what the rest of the app already shows.
-     */
-    fun nightlyAbsolute(
-        sessions: List<DetectedSleep>,
-        hr: List<HrSample>,
-        skinTemp: List<SkinTempSample>,
-        family: DeviceFamily,
-        anchorRaw: Double?,
-        wornToleranceSec: Long,
-    ): Double? = AnalyticsEngine.skinTempFunnel(
-        sessions = sessions,
-        hr = hr,
-        skinTemp = skinTemp,
-        family = family,
-        anchorRaw = anchorRaw,
-        wornToleranceSec = wornToleranceSec,
-    ).mean
-
-    /**
-     * The sessions belonging to a day, by the engine's own rule (#277):
-     *
-     *     val matched = allSessions.filter { tsInDay(it.end) }
-     *     // Sessions attributed to `day` = those whose end falls on `day` (LOCAL day)
-     *
-     * The night window is 54 h wide — 30 h before local midnight through the next one — because a night
-     * belonging to day D starts on the evening of D-1. That width also catches the night belonging to
-     * D-1, so handing the funnel everything the window returned would average two nights into one
-     * temperature and store it as D's. Attribute by END, exactly as the engine does, or the backfill
-     * writes numbers that are wrong rather than merely absent.
-     */
-    fun sessionsEndingOnDay(
-        sessions: List<Pair<Long, Long>>,
-        dayStartLocal: Long,
-        dayEndExclusive: Long,
-    ): List<DetectedSleep> =
-        sessions.filter { (_, end) -> end >= dayStartLocal && end < dayEndExclusive }
-            .map { (start, end) -> sessionOf(start, end) }
-
-    /** A stored sleep row as the funnel's session type. Only `start`/`end` are read; the rest is inert. */
-    fun sessionOf(startTs: Long, endTs: Long): DetectedSleep =
-        DetectedSleep(
-            start = startTs,
-            end = endTs,
-            efficiency = 0.0,
-            stages = emptyList(),
-            restingHR = null,
-            avgHRV = null,
-        )
-
-    /**
-     * The COMPUTED namespace a scored row lives in — `<strap>-noop`, matching the engine's
-     * `computedId = importedDeviceId + "-noop"`.
-     *
-     * This backfill straddles two namespaces and querying one for both finds nothing at all:
-     *  - dailyMetric rows and sleepSession rows are written by the engine under the COMPUTED id;
-     *  - raw skinTempSample / hrSample rows are banked under the STRAP id ("raw rows sit under the strap
-     *    id and the ... computed rows under the -noop id").
-     *
-     * Idempotent on an id that is already computed, mirroring the repository's own `ownerComputed` idiom.
-     */
-    fun computedIdFor(deviceId: String): String =
-        if (deviceId.endsWith("-noop")) deviceId else "$deviceId-noop"
-
-    /**
-     * The STRAP id a scored row's raw samples are banked under — its own id with the computed suffix
-     * removed. Derived from the row rather than from whatever device happens to be active, because the
-     * two are not reliably the same (#1303 serial adoption, a second strap, an imported history).
-     */
-    fun sampleIdFor(rowDeviceId: String): String = rowDeviceId.removeSuffix("-noop")
-
-    /** One PAGE of candidate day keys, strictly after [afterDay]. See the DAO's note on why this pages. */
-    suspend fun candidates(
-        repo: WhoopRepository,
-        afterCursor: String,
-        max: Int = DEFAULT_MAX_NIGHTS,
-    ): List<com.noop.data.SkinTempBackfillRow> = repo.daysMissingSkinTempAbsolute(afterCursor, max)
-
-    /**
-     * Everything a strap's nights need to convert raw to °C. Null from the resolver DECLINES that strap —
-     * used when a WHOOP 4.0 has no anchor, where writing on the global default would bank temperatures
-     * outside human range.
-     */
-    data class DeviceContext(
-        val family: DeviceFamily,
-        val anchorRaw: Double?,
-        val wornToleranceSec: Long,
-    )
-
-    /**
-     * Walk the candidate nights and fill what can be re-derived.
-     *
-     * Every id comes off the ROW, and every conversion context off [deviceContext] for that row's strap —
-     * nothing here predicts which device a night belongs to. A 4.0 whose anchor will not resolve is
-     * declined for that strap alone, so one unusable device cannot stall the rest.
-     *
-     * Reads one night at a time rather than one big span: the deep-history case is exactly where a single
-     * unbounded read would be worst, and a per-night read is also what lets a cancelled run leave every
-     * night it already filled correctly filled.
-     */
-    suspend fun run(
-        repo: WhoopRepository,
-        /**
-         * Resolves a STRAP id to its conversion context, or null to decline it.
-         *
-         * A lambda rather than three fixed values because rows can belong to ANY device — a second strap,
-         * an imported history, an id #1303's serial adoption has moved. Resolving once from whatever
-         * device is "active" and applying it to every row is the same predicted-id mistake that made two
-         * earlier releases of this find nothing, just one level up: here it would not find nothing, it
-         * would convert one strap's raw register on another strap's scale.
-         */
-        deviceContext: suspend (String) -> DeviceContext?,
-        zone: java.time.ZoneId = java.time.ZoneId.systemDefault(),
-        nowSeconds: Long = System.currentTimeMillis() / 1000,
-        afterCursor: String = "",
-        max: Int = DEFAULT_MAX_NIGHTS,
-        limit: Int = STREAM_LIMIT,
-    ): Report {
-        val days = candidates(repo, afterCursor, max)
-        if (days.isEmpty()) return Report(sweepComplete = true)
-
-        val nowLocalMidnight = java.time.Instant.ofEpochSecond(nowSeconds)
-            .atZone(zone).toLocalDate().atStartOfDay(zone).toEpochSecond()
-        var filled = 0
-        var noMean = 0
-        var noSamples = 0
-        var noSessions = 0
-        var declined = 0
-        // One resolve per strap, not per night.
-        val contexts = HashMap<String, DeviceContext?>()
-        for (row in days) {
-            val day = row.day
-            // Both namespaces come FROM THE ROW: the scored row's own id, and the strap id its raw
-            // samples sit under. Nothing here predicts an id.
-            val rowId = row.deviceId
-            val sampleId = sampleIdFor(rowId)
-            val ctx = contexts.getOrPut(sampleId) { deviceContext(sampleId) }
-            if (ctx == null) { declined++; continue }
-            if (requiresAnchor(ctx.family) && ctx.anchorRaw == null) { declined++; continue }
-            val anchor = anchorFor(ctx.family, ctx.anchorRaw)
-            val dayStart = runCatching {
-                java.time.LocalDate.parse(day).atStartOfDay(zone).toEpochSecond()
-            }.getOrNull() ?: continue
-            val window = nightWindow(dayStart, IntelligenceEngine.sleepReadWindowEnd(dayStart, nowLocalMidnight, nowSeconds))
-            // Sessions FIRST, and attributed to this day, so the reads below cover one night rather than
-            // the 54 h window — which also shrinks the HR read, the expensive one, from ~54 h to ~8 h.
-            val sessions = sessionsEndingOnDay(
-                repo.sleepSessionsForDevice(rowId, window.first, window.last, limit)
-                    // Honour a user-edited start the same way every other surface does.
-                    .map { (it.startTsAdjusted ?: it.startTs) to it.endTs },
-                dayStartLocal = dayStart,
-                dayEndExclusive = dayStart + SECONDS_PER_DAY,
-            )
-            if (sessions.isEmpty()) { noSessions++; continue }
-            val readFrom = sessions.minOf { it.start }
-            val readTo = sessions.maxOf { it.end }
-            val skin = repo.skinTempSamples(sampleId, readFrom, readTo, limit)
-            if (skin.isEmpty()) { noSamples++; continue }
-            val hr = repo.hrSamplesForDevice(sampleId, readFrom, readTo, limit)
-            val mean = nightlyAbsolute(sessions, hr, skin, ctx.family, anchor, ctx.wornToleranceSec)
-            if (mean == null) { noMean++; continue }
-            // Fill-only by construction; a row that gained an absolute meanwhile reports 0 and is left be.
-            if (repo.fillSkinTempAbsolute(rowId, day, mean) > 0) filled++ else noMean++
-        }
-        return Report(
-            candidates = days.size, filled = filled, noMean = noMean,
-            noSamples = noSamples, noSessions = noSessions, declined = declined,
-            lastCursor = cursorOf(days.last()),
-            // A short page means this sweep has seen every outstanding night.
-            sweepComplete = days.size < max,
-        )
-    }
-
-    /** Per-night read cap, matching the engine's stream limit. */
-    const val STREAM_LIMIT = 200_000
-
-    /**
-     * The composite paging cursor for a row — see [Report.lastCursor].
-     *
-     * Safe as a plain string comparison because [com.noop.data.DailyMetric.day] is FIXED-WIDTH ISO
-     * (`yyyy-MM-dd`): the separator always lands at the same offset, so comparing the concatenation is
-     * exactly comparing `(day, deviceId)`, which is the order the query pages in. A variable-width key
-     * here would silently reorder the sweep.
-     */
-    fun cursorOf(row: com.noop.data.SkinTempBackfillRow): String = "${row.day}|${row.deviceId}"
-
-    /** Seconds in a local day, for the end-of-day bound the engine attributes sessions by. */
-    const val SECONDS_PER_DAY: Long = 86_400L
-}
diff --git a/android/app/src/main/java/com/noop/data/Entities.kt b/android/app/src/main/java/com/noop/data/Entities.kt
index 0a8249c631..9e4bcfad05 100644
--- a/android/app/src/main/java/com/noop/data/Entities.kt
+++ b/android/app/src/main/java/com/noop/data/Entities.kt
@@ -745,16 +745,3 @@ data class V18AuxSampleEntity(
         return result
     }
 }
-
-/**
- * #1855: one candidate row for the skin-temp absolutes backfill — the day AND the device namespace it
- * actually lives in.
- *
- * The id is READ, never assumed. Scored rows sit under the engine's `<strap>-noop` namespace while raw
- * samples sit under the strap id, and #1303's serial adoption can move the strap id underneath both. Two
- * separate releases of this backfill found nothing because they predicted the id instead of reading it.
- */
-data class SkinTempBackfillRow(
-    val deviceId: String,
-    val day: String,
-)
diff --git a/android/app/src/main/java/com/noop/data/WhoopDao.kt b/android/app/src/main/java/com/noop/data/WhoopDao.kt
index ffbe725e09..f0aaa38755 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDao.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDao.kt
@@ -163,56 +163,6 @@ interface WhoopDao : DeviceRegistryDao {
     @Upsert
     suspend fun upsertDailyMetrics(rows: List<DailyMetric>)
 
-    /**
-     * #1851: the day keys that have a skin-temp DEVIATION but no ABSOLUTE beside it — the nights the
-     * 21-night `analyzeRecent` window never revisited after `skinTempC` shipped (2026-08-27).
-     *
-     * NOT filtered by device, deliberately. The id a scored row carries is not something a caller can
-     * safely predict: the engine writes under `<strap>-noop`, and #1303's serial adoption can move the
-     * strap id itself. Guessing it wrong finds nothing and is indistinguishable from "already done" —
-     * which is exactly how this shipped twice. The row carries its own id; take it from there.
-     *
-     * The cursor is COMPOSITE (`day|deviceId`), not the day alone. Without a device filter a single day
-     * can hold rows for several devices, and a page boundary falling between them would skip the row on
-     * the far side for the whole sweep — a night silently never attempted.
-     *
-     * PAGED, not just capped. A plain "oldest N" returns the SAME nights every pass, so a
-     * run whose first page cannot fill — and the oldest nights are exactly the ones most likely to have
-     * lost their raw samples — would latch on that page and never reach the newer nights that CAN fill.
-     * The caller advances a cursor, so one sweep visits every candidate exactly once.
-     */
-    @Query(
-        "SELECT deviceId, day FROM dailyMetric " +
-            "WHERE skinTempC IS NULL AND skinTempDevC IS NOT NULL " +
-            "AND (day || '|' || deviceId) > :afterCursor " +
-            "ORDER BY day ASC, deviceId ASC LIMIT :limit"
-    )
-    suspend fun daysMissingSkinTempAbsolute(afterCursor: String, limit: Int): List<SkinTempBackfillRow>
-
-    /** #1851: how many nights are outstanding in total — the uncapped count the "nothing left to try"
-     *  watermark keys on, so a newly imported night re-arms the sweep. */
-    @Query(
-        "SELECT COUNT(*) FROM dailyMetric WHERE skinTempC IS NULL AND skinTempDevC IS NOT NULL"
-    )
-    suspend fun countDaysMissingSkinTempAbsolute(): Int
-
-    /**
-     * #1851: fill ONE night's absolute, and only when it is absent.
-     *
-     * A targeted UPDATE, deliberately not an `@Upsert` of a rebuilt entity: an upsert writes every column,
-     * so a row assembled from partial data would silently blank whatever it did not carry. This touches
-     * exactly one column on one row.
-     *
-     * `AND skinTempC IS NULL` is the second half of that guarantee — the statement can only ever fill a
-     * hole, never overwrite a value the engine or an import already wrote. Returns rows changed, so a
-     * caller can tell "filled" from "already had one" without reading first.
-     */
-    @Query(
-        "UPDATE dailyMetric SET skinTempC = :celsius " +
-            "WHERE deviceId = :deviceId AND day = :day AND skinTempC IS NULL"
-    )
-    suspend fun fillSkinTempAbsolute(deviceId: String, day: String, celsius: Double): Int
-
     @Upsert
     suspend fun upsertSleepSessions(rows: List<SleepSession>)
 
diff --git a/android/app/src/main/java/com/noop/data/WhoopRepository.kt b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
index b0574a85c0..3e7af70938 100644
--- a/android/app/src/main/java/com/noop/data/WhoopRepository.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
@@ -1175,22 +1175,6 @@ class WhoopRepository(
     suspend fun spo2Samples(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
         dao.spo2Samples(deviceId, from, to, limit)
 
-    /** #1851: nights holding a skin-temp deviation but no absolute, oldest first. See [SkinTempBackfill]. */
-    suspend fun daysMissingSkinTempAbsolute(afterCursor: String, limit: Int): List<SkinTempBackfillRow> =
-        dao.daysMissingSkinTempAbsolute(afterCursor, limit)
-
-    /** #1851: total outstanding nights, uncapped and across every device. See the DAO's note on why this
-     *  is not filtered by id. */
-    suspend fun countDaysMissingSkinTempAbsolute(): Int = dao.countDaysMissingSkinTempAbsolute()
-
-    /**
-     * #1851: fill ONE night's absolute, only where none exists. Returns rows changed (0 = already had one).
-     * The statement itself carries the guarantee — a single-column UPDATE with `AND skinTempC IS NULL`, so
-     * this can never overwrite a value or blank a neighbouring column.
-     */
-    suspend fun fillSkinTempAbsolute(deviceId: String, day: String, celsius: Double): Int =
-        dao.fillSkinTempAbsolute(deviceId, day, celsius)
-
     suspend fun skinTempSamples(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
         dao.skinTempSamples(deviceId, from, to, limit)
 
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index fdcedabcac..1da04890bc 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -698,112 +698,6 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
     var todayVitalityCache: Double? = null
     var todayVo2maxCache: Double? = null
 
-    /**
-     * #1851 sweep state. A CURSOR, not a "done" flag.
-     *
-     * The candidate query is paged, because a plain "oldest N" returns the same nights every pass — and
-     * the oldest nights are exactly the ones most likely to have lost their raw samples. A page that
-     * cannot fill would otherwise latch, and every newer night that CAN fill would never be reached.
-     */
-    private val skinTempBackfillCursorKey = "skinTemp.backfillCursor"
-
-    /**
-     * The outstanding count at which a COMPLETE sweep filled nothing, so later passes can stop paying for
-     * reads that have already been proved fruitless. Keyed on the uncapped count, so a night arriving
-     * later — an import brings in old history — changes it and re-arms the sweep.
-     */
-    private val skinTempBackfillStuckKey = "skinTemp.backfillStuckAt"
-
-    /** Fills accumulated across the CURRENT sweep, so "the whole sweep found nothing" is distinguishable
-     *  from "this page found nothing". */
-    private val skinTempBackfillSweepFillsKey = "skinTemp.backfillSweepFills"
-
-    /**
-     * #1851: re-derive the nightly ABSOLUTE skin temperature for nights that only ever stored a deviation.
-     *
-     * Runs after a successful scoring pass and independently of the #1846 display preference — the data
-     * must be there whichever way the setting is left, so switching between Temperature and vs baseline is
-     * instant rather than kicking off work.
-     *
-     * One PAGE per pass ([SkinTempBackfill.DEFAULT_MAX_NIGHTS]), advancing a cursor, so a deep history
-     * drains over successive passes instead of turning one pass into the #836/#841 battery shape. When a
-     * page comes back short the sweep has seen everything: the cursor resets, and if the whole sweep filled
-     * nothing the outstanding count is recorded so identical counts are skipped thereafter.
-     *
-     * The WHOOP 4.0 anchor is resolved from the CURRENT scan window, the same span the engine learns its
-     * own anchor over — never from the old window being filled. An absolute is offset-sensitive, so nights
-     * written on a re-learned anchor would sit on a different scale from the ones already stored and the
-     * chart would plot two scales as one line. A 4.0 with no resolvable anchor is declined by the runner,
-     * and a decline records no progress, so it retries once an anchor exists.
-     */
-    private suspend fun backfillSkinTempAbsolutes(deviceId: String) {
-        val prefs = NoopPrefs.of(appContext)
-        // #1855: not filtered by device. Two releases of this found nothing because they PREDICTED the id
-        // a scored row carries — the engine's "-noop" namespace, and a strap id that #1303's serial
-        // adoption can move underneath it. Each row now carries the id it actually lives under.
-        val outstanding = repository.countDaysMissingSkinTempAbsolute()
-        if (outstanding == 0) return
-        if (prefs.getInt(skinTempBackfillStuckKey, -1) == outstanding) return
-
-        val ownerSource = RegistryDayOwnerSource(noopApp.deviceRegistry)
-        val now = System.currentTimeMillis() / 1000
-        val cursor = prefs.getString(skinTempBackfillCursorKey, "") ?: ""
-        val report = com.noop.analytics.SkinTempBackfill.run(
-            repo = repository,
-            // Resolved per STRAP the rows actually belong to, not once from whatever device is active —
-            // converting one strap's raw register on another strap's scale is a wrong number, not a
-            // missing one.
-            deviceContext = { strapId ->
-                val family = ownerSource.skinTempFamily(strapId)
-                val anchor = if (family == com.noop.protocol.DeviceFamily.WHOOP4) {
-                    // The span the engine learns its anchor over, NOT the window being filled.
-                    val windowSkin = repository.skinTempSamples(
-                        strapId, now - 21L * 24 * 3_600, now,
-                        com.noop.analytics.SkinTempBackfill.STREAM_LIMIT,
-                    )
-                    com.noop.protocol.Whoop4SkinTemp.deviceAnchorRaw(windowSkin.map { it.raw })
-                } else {
-                    null
-                }
-                com.noop.analytics.SkinTempBackfill.DeviceContext(
-                    family = family,
-                    anchorRaw = anchor,
-                    wornToleranceSec = ownerSource.skinTempWornToleranceSec(strapId),
-                )
-            },
-            nowSeconds = now,
-            afterCursor = cursor,
-        )
-        // The cursor ALWAYS advances. `declinedNoAnchor` now means "some strap was declined", not "the run
-        // did nothing" — withholding the bookkeeping on it would freeze the cursor and re-process page one
-        // on every tick, forever, for any install holding one un-anchored 4.0. A decline only withholds
-        // the STUCK watermark, so the sweep retries once that strap's anchor resolves.
-        val sweepFills = prefs.getInt(skinTempBackfillSweepFillsKey, 0) + report.filled
-        val edit = prefs.edit()
-        if (report.sweepComplete) {
-            // Every outstanding night has been visited. Start the next sweep from the top, and only stop
-            // paying for reads when the WHOLE sweep — not just its last page — found nothing AND nothing
-            // was declined.
-            edit.remove(skinTempBackfillCursorKey).remove(skinTempBackfillSweepFillsKey)
-            if (sweepFills == 0 && !report.declinedNoAnchor) {
-                edit.putInt(skinTempBackfillStuckKey, outstanding)
-            }
-        } else {
-            edit.putString(skinTempBackfillCursorKey, report.lastCursor)
-                .putInt(skinTempBackfillSweepFillsKey, sweepFills)
-        }
-        if (report.filled > 0) edit.remove(skinTempBackfillStuckKey)
-        edit.apply()
-        ble.externalLog(
-            "skinTempBackfill: page=${report.candidates} filled=${report.filled} noMean=${report.noMean} " +
-                "noSamples=${report.noSamples} noSessions=${report.noSessions} " +
-                "declined=${report.declined} " +
-                "outstanding=$outstanding sweepComplete=${report.sweepComplete} " +
-                "sweepFills=$sweepFills",
-            com.noop.testcentre.TestDomain.UNIVERSAL,
-        )
-    }
-
     /**
      * Recent daily metrics (newest last), backing the Today grid + illness watch.
      * MERGED: imported "my-whoop" rows win per day; on-device computed "my-whoop-noop"
@@ -1304,18 +1198,6 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
                     }
                 }
                     .onFailure { if (it is kotlin.coroutines.cancellation.CancellationException) throw it }
-                // #1854: OUTSIDE the `analyzeHasNewData` gate on purpose.
-                //
-                // This was inside the scoring pass's onSuccess, which only runs when the fingerprint moved
-                // — so a feature whose entire job is reprocessing OLD nights never ran on the installs that
-                // need it most: a strap that has not synced has no new data, so no pass, so no backfill.
-                // The one install this was built for sat with five temperatures and never attempted the
-                // rest.
-                //
-                // Safe to run on every tick: it costs one COUNT when there is nothing outstanding, and the
-                // fruitless watermark stops it paying for reads once a whole sweep has come back empty.
-                runCatching { backfillSkinTempAbsolutes(deviceId) }
-                    .onFailure { if (it is kotlin.coroutines.cancellation.CancellationException) throw it }
                 // Opt-in writeback: push the freshly computed nights into Health Connect so other
                 // apps see them. Idempotent (clientRecordId per metric+day), so re-running every
                 // cycle just upserts. Never let an HC hiccup (perm revoked mid-flight, provider
@@ -3079,9 +2961,6 @@ enum class DoubleTapAction {
         }
 
     companion object {
-        /** #1851 one-shot guard: the absolutes backfill has completed for this install. */
-        const val skinTempBackfillDoneKey = "skinTemp.backfillDone"
-
         /** Decode a persisted name back to an action; tolerant of an unknown/blank value (→ [NONE]). */
         fun fromRaw(raw: String?): DoubleTapAction =
             entries.firstOrNull { it.name == raw } ?: NONE
diff --git a/android/app/src/test/java/com/noop/analytics/SkinTempBackfillTest.kt b/android/app/src/test/java/com/noop/analytics/SkinTempBackfillTest.kt
deleted file mode 100644
index 7973db003e..0000000000
--- a/android/app/src/test/java/com/noop/analytics/SkinTempBackfillTest.kt
+++ /dev/null
@@ -1,308 +0,0 @@
-package com.noop.analytics
-
-import com.noop.protocol.DeviceFamily
-import com.noop.protocol.Whoop4SkinTemp
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertNotNull
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertTrue
-import org.junit.Test
-
-/**
- * #1851: re-deriving a night's absolute skin temperature from raw samples the app still holds.
- *
- * The parts worth pinning are the ones that could corrupt data rather than merely fail: the WHOOP 4.0
- * anchor decline, and that the night window matches the engine's.
- */
-class SkinTempBackfillTest {
-
-    /**
-     * A 4.0 with no resolved anchor must be DECLINED, never written on the global default.
-     *
-     * That default (826) maps a second real strap's worn band to 47-72 °C — outside human range, into a
-     * column nothing downstream re-checks. Declining leaves the nights as deviations, which is the honest
-     * state; writing would bank fiction that looks like a reading.
-     */
-    @Test
-    fun aWhoop4WithoutAnAnchorIsDeclined() {
-        assertTrue(SkinTempBackfill.requiresAnchor(DeviceFamily.WHOOP4))
-        assertNull(SkinTempBackfill.anchorFor(DeviceFamily.WHOOP4, currentAnchorRaw = null))
-    }
-
-    /** A 4.0 WITH a resolved anchor uses exactly that one — never re-learned from the window being filled,
-     *  which would put backfilled nights on a different offset from the ones already stored. */
-    @Test
-    fun aWhoop4UsesTheAnchorItIsGiven() {
-        assertEquals(1290.0, SkinTempBackfill.anchorFor(DeviceFamily.WHOOP4, 1290.0))
-        // Notably NOT the global default, which is what a re-learn would have fallen back to.
-        assertTrue(1290.0 != Whoop4SkinTemp.ANCHOR_RAW)
-    }
-
-    /** 5/MG converts with raw/100 and carries no anchor, so it is never gated on one. */
-    @Test
-    fun whoop5NeedsNoAnchor() {
-        assertFalse(SkinTempBackfill.requiresAnchor(DeviceFamily.WHOOP5))
-        assertNotNull(SkinTempBackfill.anchorFor(DeviceFamily.WHOOP5, currentAnchorRaw = null))
-    }
-
-    /** The night window must match the engine's `from = dayStart - 30h`, or a backfilled night would be
-     *  computed over a different sample set from the one the scoring pass would have used. */
-    @Test
-    fun theNightWindowMatchesTheEngines() {
-        val dayStart = 1_760_000_000L
-        val end = dayStart + 86_400
-        val w = SkinTempBackfill.nightWindow(dayStart, end)
-        assertEquals(dayStart - 30 * 3_600L, w.first)
-        assertEquals(end, w.last)
-        assertEquals(30 * 3_600L, SkinTempBackfill.NIGHT_LOOKBACK_SECONDS)
-    }
-
-    /** A stored sleep row becomes a session carrying only its bounds — the funnel reads nothing else, and
-     *  inventing efficiency/stages here would be fabricating inputs the backfill does not have. */
-    @Test
-    fun aStoredRowBecomesABoundsOnlySession() {
-        val s = SkinTempBackfill.sessionOf(startTs = 100L, endTs = 200L)
-        assertEquals(100L, s.start)
-        assertEquals(200L, s.end)
-        assertTrue(s.stages.isEmpty())
-        assertNull(s.restingHR)
-        assertNull(s.avgHRV)
-    }
-
-    /** No samples means no temperature — the backfill must never synthesise one from the deviation. */
-    @Test
-    fun noSamplesYieldsNoAbsolute() {
-        val mean = SkinTempBackfill.nightlyAbsolute(
-            sessions = listOf(SkinTempBackfill.sessionOf(0L, 1_000L)),
-            hr = emptyList(),
-            skinTemp = emptyList(),
-            family = DeviceFamily.WHOOP5,
-            anchorRaw = null,
-            wornToleranceSec = 0,
-        )
-        assertNull(mean)
-    }
-
-    /** The report separates recoverable from unrecoverable, because they need different answers: a night
-     *  with no banked samples will never fill, however many times the backfill is re-run. */
-    @Test
-    fun theReportDistinguishesWhyANightDidNotFill() {
-        val r = SkinTempBackfill.Report(candidates = 10, filled = 4, noMean = 2, noSamples = 4)
-        assertEquals(10, r.examined)
-        val declined = SkinTempBackfill.Report(candidates = 2, declined = 2)
-        assertEquals(2, declined.examined)
-        assertTrue(declined.declinedNoAnchor)
-    }
-
-    // MARK: re-review — the run must drain, and must never strand nights that arrive later
-
-    /**
-     * The per-run cap is small on purpose: each FILLABLE night costs a large HR read, so a years-deep
-     * history in one pass is the #836/#841 battery shape. The work drains across scoring passes instead.
-     */
-    @Test
-    fun theRunIsCappedSmallEnoughToDrainAcrossPasses() {
-        assertTrue("a cap this large would be a one-pass battery event",
-                   SkinTempBackfill.DEFAULT_MAX_NIGHTS <= 100)
-        assertTrue(SkinTempBackfill.DEFAULT_MAX_NIGHTS > 0)
-    }
-
-    /**
-     * A decline must not look like progress. The caller only records a "fruitless" watermark when the run
-     * actually examined nights and filled none — a 4.0 declined for a missing anchor examined nothing, so
-     * it must retry once an anchor exists rather than being written off.
-     */
-    @Test
-    fun aDeclineIsDistinguishableFromAFruitlessRun() {
-        val declined = SkinTempBackfill.Report(candidates = 3, declined = 3)
-        val fruitless = SkinTempBackfill.Report(candidates = 5, noSamples = 5)
-        assertTrue(declined.declinedNoAnchor)
-        assertFalse(fruitless.declinedNoAnchor)
-        assertEquals(0, declined.filled)
-        assertEquals(0, fruitless.filled)
-        // Both examined their nights; they differ in WHY nothing filled, which is what the log must say.
-        assertEquals(3, declined.examined)
-        assertEquals(5, fruitless.examined)
-    }
-
-    // MARK: re-review 2 — the 54 h window holds TWO nights, and only one belongs to the day
-
-    /**
-     * The bug this pins would have written WRONG temperatures rather than none.
-     *
-     * The night window runs 30 h before local midnight to the next one, because a night belonging to day D
-     * starts on the evening of D-1. At 54 h wide it also contains the night belonging to D-1, so handing
-     * the funnel everything the window returned averaged two nights into one value and stored it as D's.
-     *
-     * The engine attributes by END (#277): `matched = allSessions.filter { tsInDay(it.end) }`.
-     */
-    @Test
-    fun onlyTheNightEndingOnThatDayIsUsed() {
-        val dayStart = 1_760_000_000L
-        val dayEnd = dayStart + SkinTempBackfill.SECONDS_PER_DAY
-        val previousNight = (dayStart - 26 * 3_600L) to (dayStart - 18 * 3_600L)   // ends on D-1
-        val thisNight = (dayStart - 2 * 3_600L) to (dayStart + 6 * 3_600L)         // ends on D
-        val nextNight = (dayEnd - 2 * 3_600L) to (dayEnd + 6 * 3_600L)             // ends on D+1
-
-        val matched = SkinTempBackfill.sessionsEndingOnDay(
-            listOf(previousNight, thisNight, nextNight), dayStart, dayEnd,
-        )
-        assertEquals(1, matched.size)
-        assertEquals(thisNight.first, matched.single().start)
-        assertEquals(thisNight.second, matched.single().end)
-    }
-
-    /** A daytime nap ending on the same day counts too — the engine keeps both in `matched`. */
-    @Test
-    fun aNapEndingOnTheSameDayIsIncluded() {
-        val dayStart = 1_760_000_000L
-        val dayEnd = dayStart + SkinTempBackfill.SECONDS_PER_DAY
-        val night = (dayStart - 2 * 3_600L) to (dayStart + 6 * 3_600L)
-        val nap = (dayStart + 14 * 3_600L) to (dayStart + 15 * 3_600L)
-        assertEquals(2, SkinTempBackfill.sessionsEndingOnDay(listOf(night, nap), dayStart, dayEnd).size)
-    }
-
-    /** The day bound is [start, end) — a session ending exactly at the next midnight belongs to the NEXT
-     *  day, matching a local-day bucket that cannot claim the same instant twice. */
-    @Test
-    fun theDayBoundIsHalfOpen() {
-        val dayStart = 1_760_000_000L
-        val dayEnd = dayStart + SkinTempBackfill.SECONDS_PER_DAY
-        assertEquals(1, SkinTempBackfill.sessionsEndingOnDay(listOf(0L to dayStart), dayStart, dayEnd).size)
-        assertEquals(0, SkinTempBackfill.sessionsEndingOnDay(listOf(0L to dayEnd), dayStart, dayEnd).size)
-    }
-
-    /** "No session for this night" is not "no samples" — they are different answers to the user, so the
-     *  report keeps them apart. */
-    @Test
-    fun theReportSeparatesMissingSessionsFromMissingSamples() {
-        val r = SkinTempBackfill.Report(candidates = 6, filled = 1, noMean = 1, noSamples = 2, noSessions = 2)
-        assertEquals(6, r.examined)
-    }
-
-    // MARK: re-review 3 — a sweep must reach every night, not re-try the same page forever
-
-    /**
-     * The bug this pins is silent and permanent.
-     *
-     * The candidate query used to be a plain "oldest N", so every pass got the SAME nights — and the
-     * oldest nights are precisely the ones most likely to have lost their raw samples. A first page that
-     * could not fill latched the fruitless watermark, and every NEWER night that could have filled was
-     * never reached. The user would see a handful of temperatures and no reason why.
-     *
-     * Paging means a short page — fewer than the cap — is the signal that the sweep has seen everything.
-     */
-    @Test
-    fun aShortPageMeansTheSweepHasSeenEverything() {
-        val full = SkinTempBackfill.Report(candidates = SkinTempBackfill.DEFAULT_MAX_NIGHTS, sweepComplete = false)
-        assertFalse("a full page cannot be the end of a sweep", full.sweepComplete)
-        val short = SkinTempBackfill.Report(candidates = 3, sweepComplete = true)
-        assertTrue(short.sweepComplete)
-    }
-
-    /** An empty page ends the sweep too — nothing outstanding after the cursor. */
-    @Test
-    fun anEmptyPageEndsTheSweep() {
-        val empty = SkinTempBackfill.Report(sweepComplete = true)
-        assertTrue(empty.sweepComplete)
-        assertEquals("", empty.lastCursor)
-        assertEquals(0, empty.examined)
-    }
-
-    /**
-     * Every candidate on a page must be accounted for by exactly one outcome.
-     *
-     * The run's log line exists to answer "why did nothing fill?". A candidates/examined pair that does
-     * not reconcile sends the reader hunting for a missing category — and declined nights were counted
-     * locally but never surfaced, so a page of un-anchored 4.0 nights reported candidates=60, examined=0
-     * and no reason at all.
-     */
-    @Test
-    fun everyCandidateIsAccountedFor() {
-        val r = SkinTempBackfill.Report(
-            candidates = 10, filled = 2, noMean = 1, noSamples = 3, noSessions = 1, declined = 3,
-        )
-        assertEquals("candidates must reconcile with the outcomes", r.candidates, r.examined)
-    }
-
-    /** The flag is DERIVED from the count, so the two cannot drift apart. */
-    @Test
-    fun theDeclineFlagFollowsTheCount() {
-        assertFalse(SkinTempBackfill.Report(declined = 0).declinedNoAnchor)
-        assertTrue(SkinTempBackfill.Report(declined = 1).declinedNoAnchor)
-    }
-
-    /**
-     * The cursor is COMPOSITE (`day|deviceId`), not the day alone.
-     *
-     * With no device filter a single day can hold rows for several devices. A day-only cursor would skip
-     * whichever same-day row fell on the far side of a page boundary — a night silently never attempted,
-     * which is the failure mode this whole feature keeps producing.
-     */
-    @Test
-    fun theCursorCarriesTheDeviceToo() {
-        val row = com.noop.data.SkinTempBackfillRow(deviceId = "my-whoop-noop", day = "2026-08-11")
-        assertEquals("2026-08-11|my-whoop-noop", SkinTempBackfill.cursorOf(row))
-        // Two rows sharing a day produce DIFFERENT cursors, which is the whole point.
-        val other = com.noop.data.SkinTempBackfillRow(deviceId = "my-whoop", day = "2026-08-11")
-        assertTrue(SkinTempBackfill.cursorOf(row) != SkinTempBackfill.cursorOf(other))
-    }
-
-    /**
-     * A decline must not look like "the run did nothing".
-     *
-     * `declinedNoAnchor` now means SOME strap was declined, not that the run examined nothing. The caller
-     * must still advance its cursor on it — withholding the bookkeeping would freeze the sweep on page one
-     * and re-read it every tick, forever, on any install holding one un-anchored 4.0.
-     */
-    @Test
-    fun aDeclinedStrapStillLeavesUsableProgress() {
-        val r = SkinTempBackfill.Report(
-            candidates = 60, filled = 3, noSamples = 40, declined = 17,
-            lastCursor = "2026-08-11|my-whoop-noop",
-        )
-        assertTrue(r.declinedNoAnchor)
-        assertTrue("a declining run can still fill other straps' nights", r.filled > 0)
-        assertTrue("and must still hand back a cursor", r.lastCursor.isNotEmpty())
-    }
-
-    // MARK: re-review 4 — the backfill straddles TWO device namespaces
-
-    /**
-     * Querying one namespace for both finds nothing at all, and silently: the sweep reports zero
-     * outstanding and looks finished before it has begun.
-     *
-     * The engine writes scored rows under `computedId = importedDeviceId + "-noop"` — dailyMetric AND
-     * sleepSession — while raw skinTempSample / hrSample rows are banked under the STRAP id. The first cut
-     * used the strap id for all four, so it found no candidates and no sessions.
-     */
-    @Test
-    fun scoredRowsLiveInTheComputedNamespace() {
-        assertEquals("my-whoop-noop", SkinTempBackfill.computedIdFor("my-whoop"))
-    }
-
-    /**
-     * #1855: the STRAP id a row's raw samples sit under is DERIVED FROM THE ROW, never predicted.
-     *
-     * Two releases of this backfill found nothing because they guessed the id — first the strap id for
-     * rows the engine writes under "-noop", then the active device's id for rows that may belong to
-     * another strap entirely (#1303 serial adoption, a second strap, an imported history). Both failures
-     * were silent and read as "already done".
-     */
-    @Test
-    fun theSampleIdComesOffTheRowsOwnId() {
-        assertEquals("my-whoop", SkinTempBackfill.sampleIdFor("my-whoop-noop"))
-        // An id that never carried the suffix is already a strap id.
-        assertEquals("whoop-4A2B", SkinTempBackfill.sampleIdFor("whoop-4A2B"))
-        // Round-trips with computedIdFor, so the pair cannot drift apart.
-        assertEquals("whoop-4A2B", SkinTempBackfill.sampleIdFor(SkinTempBackfill.computedIdFor("whoop-4A2B")))
-    }
-
-    /** Idempotent on an id that is already computed, mirroring the repository's own ownerComputed idiom —
-     *  otherwise a re-entry would look for "…-noop-noop" and, again, find nothing. */
-    @Test
-    fun theComputedIdIsIdempotent() {
-        assertEquals("my-whoop-noop", SkinTempBackfill.computedIdFor("my-whoop-noop"))
-    }
-}
\ No newline at end of file

From 002608f2738e562e7383ef37aaa36c75d2b37035 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 13:06:04 +1200
Subject: [PATCH 214/333] alarm: per-day wake times for the phone alarm (#1859)

Reported as "I want it to go off at around 4:45 on three days of the week and at 3:30 on two other days... the smart alarm basically never works". The first half is not a misunderstanding: the phone alarm held ONE targetMinutes for every selected day, so that schedule was not expressible at all.

The strap alarm on the SAME SCREEN has had per-day times since #554. Two alarms sitting together with near-identical controls, one supporting a different time on different days and the other not - reading that as "the feature is broken" is the correct reading of what is in front of you.

So this reuses #554's model rather than inventing a second one: the same AlarmDayOverridePicker, and a targetOverrides map encoded exactly like NoopPrefs.smartAlarmDayOverrides. Sparse overrides over the single time, so an install that sets none behaves as before and there is nothing to migrate.

Scheduling changed shape rather than gaining a lookup. With per-day targets the deadline minute is no longer a single number, so the old "find the next occurrence of one minute-of-day, then roll to an enabled day" cannot work: the day must be chosen FIRST and its own target read from it. nextDeadline walks candidate days and takes the first enabled day whose own target + window is still ahead, which also folds the after-fire re-arm in as "skip today" rather than a post-hoc date adjustment. nextOccurrence/advanceToEnabledDay are deleted and PhoneAlarmWeekdayTest is repinned onto nextDeadline, so the day-selection tests run against live code rather than a helper kept alive by its own test.

FOUR other surfaces derived a wake time independently and each would have gone stale. The strap-buzz companion passed no overrides under a comment reading "the phone alarm has none" - true when written, false the moment it got them. The guarantee card names a specific time and would have promised the wrong one, so it now shows the NEXT window, derived from nextDeadline rather than recomputed. The wind-down nudge was anchored to the default wake. And the boot re-schedule, the only one that runs without a user action, silently collapsed seven weekday nudges back to one daily nudge after a reboot and stayed that way until the next settings edit.

The wind-down fan-out is Apple parity, not new design: WindDownNudge has fanned out to seven weekday-pinned triggers since #554. Android's equivalent is seven weekly repeats on distinct request codes, and cancel now clears BOTH shapes - switching between them changes how many alarms exist, so cancelling only the shape about to be re-scheduled would strand the other's.

One real bug found in that parity work, present on BOTH platforms. nudgeMinuteOfDay wraps a negative result into [0,1440), which is right for the minute and silently loses which DAY it belongs to. A 03:30 wake with an 8 h need and a 30 min lead puts the nudge at 19:00 the PREVIOUS evening; pinning it to the wake's own weekday fires it eight hours after the wake it exists to precede. Only reachable once the nudge is weekday-pinned, and 03:30 is half the reported schedule - per-day times exist for early wakes, so the wrap is the common case here. Android pins to the day it fires on via nudgeDayShift/shiftWeekday; the Swift fix is filed rather than mirrored, since mirroring would ship a reminder known to arrive after the thing it reminds you about.

An unschedulable weekday set also used to leave the persisted wake window behind. Those two fields are what the connection service reads to decide it is inside a window, so a stale pair is a phantom window that keeps feeding HR to the detector. It now clears them - deliberately unlike the canScheduleExact bail above it, where the intent stands and the edges must survive for rearmPersisted to retry.

Full suite 5142/0; PhoneAlarmWeekdayTest at 22 cases covering per-day selection, the nearest-deadline-across-different-times case, the after-fire skip honouring enabled days, a window crossing midnight, the weekly nudge anchor and the day shift. No new strings - the picker and its copy already exist. Doc-comment and i18n gates clean.

NOT addressed here and tracked on the issue: the smart wake never firing early (needs instrumentation - the alarm package has zero logging, so no report can distinguish "no HR arrived" from "the detector declined") and ringing while already awake (needs a decision about what "guaranteed" should mean). Apple scope questions are #1863 and #1864.
---
 .../com/noop/alarm/SmartAlarmBootReceiver.kt  |   8 +-
 .../com/noop/alarm/SmartAlarmScheduler.kt     | 136 ++++++---
 .../java/com/noop/alarm/SmartAlarmStore.kt    |  41 +++
 .../java/com/noop/alarm/WindDownScheduler.kt  | 102 ++++++-
 .../main/java/com/noop/alarm/WindDownStore.kt |  21 ++
 .../src/main/java/com/noop/ui/AppViewModel.kt |  60 +++-
 .../main/java/com/noop/ui/SmartAlarmScreen.kt |  31 +-
 .../com/noop/alarm/PhoneAlarmWeekdayTest.kt   | 271 +++++++++++++++---
 8 files changed, 557 insertions(+), 113 deletions(-)

diff --git a/android/app/src/main/java/com/noop/alarm/SmartAlarmBootReceiver.kt b/android/app/src/main/java/com/noop/alarm/SmartAlarmBootReceiver.kt
index 01ce1fa9e4..08066c0c01 100644
--- a/android/app/src/main/java/com/noop/alarm/SmartAlarmBootReceiver.kt
+++ b/android/app/src/main/java/com/noop/alarm/SmartAlarmBootReceiver.kt
@@ -27,8 +27,12 @@ class SmartAlarmBootReceiver : BroadcastReceiver() {
                 runCatching {
                     val wind = WindDownStore.from(context)
                     if (wind.enabled) {
-                        val wake = SmartAlarmStore.from(context).targetMinutes
-                        WindDownScheduler.schedule(context, wind, wake)
+                        val alarm = SmartAlarmStore.from(context)
+                        // #1858: the per-day overrides go through here too. This is the ONE call site that
+                        // reschedules without a user action, so dropping them here does not fail loudly —
+                        // it quietly collapses seven weekday nudges back to one daily nudge on the default
+                        // wake time, and stays that way until the user next edits a setting.
+                        WindDownScheduler.schedule(context, wind, alarm.targetMinutes, alarm.targetOverrides)
                     }
                 }
             }
diff --git a/android/app/src/main/java/com/noop/alarm/SmartAlarmScheduler.kt b/android/app/src/main/java/com/noop/alarm/SmartAlarmScheduler.kt
index 41f970f2c5..cd1a3926f9 100644
--- a/android/app/src/main/java/com/noop/alarm/SmartAlarmScheduler.kt
+++ b/android/app/src/main/java/com/noop/alarm/SmartAlarmScheduler.kt
@@ -50,28 +50,29 @@ object SmartAlarmScheduler {
     fun arm(context: Context, store: SmartAlarmStore, afterFire: Boolean = false): Long? {
         if (!canScheduleExact(context)) return null
 
-        val deadlineMin = (store.targetMinutes + store.windowMinutes)
-        // The window's hard edge can roll past midnight (e.g. 23:50 + 30). Compute the next wall-clock
-        // occurrence of that absolute minute-of-day, then derive the window-start from it so the two
-        // edges stay on the same night even across the midnight boundary.
+        // #1858: the deadline minute is per-day now, so the DAY is chosen first and its own target read
+        // from it. The window start is still derived from the deadline, so the two edges stay on the same
+        // night even when the window opens the previous evening.
         val weekdays = store.weekdays
-        val deadline = nextOccurrence(deadlineMin % SmartAlarmStore.MINUTES_PER_DAY, weekdays)
-        // Re-arm after a fire (audit): when the smart alarm fires EARLY on a light-sleep phase (e.g. 06:35
-        // for a 07:00 deadline), the deadline's next occurrence is still TODAY 07:00 — so a plain re-arm
-        // scheduled a second guaranteed wake the SAME morning, waking the user again. We just woke them
-        // today, so the next wake must be tomorrow: push a same-day deadline forward one day.
-        if (afterFire) {
-            val now = Calendar.getInstance()
-            val sameDay = deadline.get(Calendar.YEAR) == now.get(Calendar.YEAR) &&
-                deadline.get(Calendar.DAY_OF_YEAR) == now.get(Calendar.DAY_OF_YEAR)
-            if (sameDay) {
-                deadline.add(Calendar.DAY_OF_YEAR, 1)
-                // …and that push can land on a day the alarm is switched off, so re-apply the weekday
-                // filter. Without this, re-arming after a Saturday fire would schedule Sunday even with
-                // Sunday deselected — the one path that reaches a disabled day, because it moves the
-                // deadline AFTER nextOccurrence already filtered it.
-                advanceToEnabledDay(deadline, weekdays)
-            }
+        val deadline = nextDeadline(
+            now = Calendar.getInstance(),
+            weekdays = weekdays,
+            windowMinutes = store.windowMinutes,
+            afterFire = afterFire,
+        ) { store.targetFor(it) } ?: run {
+            // No day is reachable, so there IS no next wake — clear the persisted edges rather than
+            // leaving the previous ones behind. The watcher reads exactly those two fields to decide it is
+            // inside a wake window, so a stale pair is a phantom window: it would keep feeding HR to the
+            // detector and could advance an alarm that no longer exists.
+            //
+            // Deliberately NOT the same as the `canScheduleExact` bail above. There the intent still
+            // stands and the OS is only refusing right now, so the stored edges must survive for
+            // `rearmPersisted` to retry. Here there is nothing to retry.
+            //
+            // `SmartAlarmStore.weekdays` filters to 1..7, so this is unreachable through the store today;
+            // the guard is for the caller that forgets, on a path where the failure is silent.
+            cancel(context, store)
+            return null
         }
         val windowStartMs = deadline.timeInMillis - store.windowMinutes.toLong() * 60_000L
 
@@ -155,35 +156,80 @@ object SmartAlarmScheduler {
         )
     }
 
-    /** The next wall-clock occurrence (today or tomorrow) of an absolute minute-of-day. */
-    private fun nextOccurrence(minuteOfDay: Int, weekdays: Set<Int> = emptySet()): Calendar =
-        Calendar.getInstance().apply {
-            set(Calendar.HOUR_OF_DAY, minuteOfDay / 60)
-            set(Calendar.MINUTE, minuteOfDay % 60)
-            set(Calendar.SECOND, 0)
-            set(Calendar.MILLISECOND, 0)
-            if (timeInMillis <= System.currentTimeMillis()) add(Calendar.DAY_OF_YEAR, 1)
-            advanceToEnabledDay(this, weekdays)
-        }
+    /**
+     * The EARLIEST-wake minute of the next scheduled window (#1858) — what the guarantee card names.
+     *
+     * The card promises a specific time ("a backup alarm is set for 04:45"), so once wake times vary by
+     * day it has to show the next one rather than the default; on a moved day the default is simply the
+     * wrong number. DERIVED from [nextDeadline] rather than recomputed, so the card and the alarm cannot
+     * disagree — two independent time computations drifting apart is the failure this change already had
+     * to fix in two other places.
+     *
+     * Falls back to [defaultTarget] when no day is reachable, so the card degrades to the previous
+     * behaviour rather than blanking. Pure but for the clock, so it is testable without Compose.
+     */
+    internal fun nextWindowStartMinutes(
+        now: Calendar,
+        weekdays: Set<Int>,
+        windowMinutes: Int,
+        defaultTarget: Int,
+        targetForDay: (Int) -> Int,
+    ): Int {
+        val deadline = nextDeadline(now, weekdays, windowMinutes, afterFire = false, targetForDay)
+            ?: return defaultTarget
+        val deadlineMin = deadline.get(Calendar.HOUR_OF_DAY) * 60 + deadline.get(Calendar.MINUTE)
+        return (deadlineMin - windowMinutes + SmartAlarmStore.MINUTES_PER_DAY) %
+            SmartAlarmStore.MINUTES_PER_DAY
+    }
 
     /**
-     * Roll `cal` forward until it lands on a day the alarm is allowed to fire on.
+     * The next hard-deadline instant, honouring PER-DAY wake times (#1858).
+     *
+     * Replaces the old "find the next occurrence of one minute-of-day, then roll to an enabled day":
+     * with per-day targets the deadline minute is no longer a single number, so the day must be chosen
+     * FIRST and its own target read from it.
+     *
+     * Walks candidate days forward from today. For each day the alarm is allowed to fire on, the deadline
+     * is that day's own `target + window`, and the first such instant strictly in the future wins. The
+     * weekday tested is therefore still the day the DEADLINE lands on — the morning you are actually
+     * woken — which is what [SmartAlarmStore.weekdays] has always meant and what a person means by
+     * "Monday at 04:45".
      *
-     * EMPTY [weekdays] means every day, so this is a no-op — that is the pre-weekday behaviour and the
-     * default for every existing install, which is why the whole feature can ship without a migration.
+     * `target + window` can roll past midnight (23:50 + 30). Taking it modulo the day places the deadline
+     * on the enabled day itself and lets the WINDOW START fall on the previous evening, which is the same
+     * relationship the single-time version produced.
      *
-     * The 7-iteration bound is a guard, not an expectation: [SmartAlarmStore.weekdays] already filters
-     * to 1..7, so a non-empty set always contains a reachable day and the loop exits in at most six
-     * steps. If a future caller ever passes an unreachable set, this returns the unshifted day rather
-     * than spinning — a wrong-day alarm is recoverable, a hung scheduler on the safety-critical path is
-     * not. Kept `internal` so the day-selection can be unit-tested without an AlarmManager.
+     * [afterFire] skips today outright. When the smart logic fires early — 04:35 for an 04:45 deadline —
+     * today's deadline is still ahead, and re-arming onto it would wake the user a second time the same
+     * morning. Skipping the day is a cleaner statement of that than adjusting a date afterwards, and it
+     * cannot land on a disabled day because the loop only ever considers enabled ones.
+     *
+     * Pure but for the clock passed in, so every one of those cases is unit-testable without an
+     * AlarmManager. Returns null only if no day is reachable, which [SmartAlarmStore.weekdays]'s 1..7
+     * filter already prevents.
      */
-    internal fun advanceToEnabledDay(cal: Calendar, weekdays: Set<Int>) {
-        if (weekdays.isEmpty()) return
-        var guard = 0
-        while (cal.get(Calendar.DAY_OF_WEEK) !in weekdays && guard < 7) {
-            cal.add(Calendar.DAY_OF_YEAR, 1)
-            guard++
+    internal fun nextDeadline(
+        now: Calendar,
+        weekdays: Set<Int>,
+        windowMinutes: Int,
+        afterFire: Boolean = false,
+        targetForDay: (Int) -> Int,
+    ): Calendar? {
+        for (offset in 0..7) {
+            if (afterFire && offset == 0) continue
+            val candidate = (now.clone() as Calendar).apply {
+                add(Calendar.DAY_OF_YEAR, offset)
+            }
+            val dow = candidate.get(Calendar.DAY_OF_WEEK)
+            if (weekdays.isNotEmpty() && dow !in weekdays) continue
+            val deadlineMin =
+                (targetForDay(dow) + windowMinutes) % SmartAlarmStore.MINUTES_PER_DAY
+            candidate.set(Calendar.HOUR_OF_DAY, deadlineMin / 60)
+            candidate.set(Calendar.MINUTE, deadlineMin % 60)
+            candidate.set(Calendar.SECOND, 0)
+            candidate.set(Calendar.MILLISECOND, 0)
+            if (candidate.timeInMillis > now.timeInMillis) return candidate
         }
+        return null
     }
 }
diff --git a/android/app/src/main/java/com/noop/alarm/SmartAlarmStore.kt b/android/app/src/main/java/com/noop/alarm/SmartAlarmStore.kt
index c340fc47d8..8174a2e1a0 100644
--- a/android/app/src/main/java/com/noop/alarm/SmartAlarmStore.kt
+++ b/android/app/src/main/java/com/noop/alarm/SmartAlarmStore.kt
@@ -56,6 +56,46 @@ class SmartAlarmStore(private val prefs: SharedPreferences) {
             .putStringSet(KEY_WEEKDAYS, v.filter { it in 1..7 }.map { it.toString() }.toSet())
             .apply()
 
+    /**
+     * PER-DAY wake times (#1858): `Calendar.DAY_OF_WEEK` → earliest-wake minutes, for the days that
+     * differ from [targetMinutes].
+     *
+     * A sparse OVERRIDE map, not a full schedule: absent days fall back to [targetMinutes], so an install
+     * that never sets one behaves exactly as before and there is nothing to migrate. Reported as
+     * "04:45 three days a week and 03:30 on two others" — a shape the single-time model could not express
+     * at all, so the honest answer to that user was "the app cannot do this", not "you set it up wrong".
+     *
+     * Keyed on the day the HARD DEADLINE lands on — the morning you are actually woken — matching
+     * [weekdays] and what a person means by "Monday at 04:45". Stored as `day:minutes` strings so the
+     * whole map lives in one SharedPreferences key with no serialiser; entries outside 1..7 or outside a
+     * valid minute-of-day are dropped on read, so a corrupted value can never schedule a bogus time.
+     */
+    var targetOverrides: Map<Int, Int>
+        get() = prefs.getStringSet(KEY_TARGET_OVERRIDES, emptySet())
+            .orEmpty()
+            .mapNotNull { entry ->
+                val parts = entry.split(':')
+                val day = parts.getOrNull(0)?.toIntOrNull()
+                val minutes = parts.getOrNull(1)?.toIntOrNull()
+                if (day != null && minutes != null && day in 1..7 && minutes in 0 until MINUTES_PER_DAY) {
+                    day to minutes
+                } else {
+                    null
+                }
+            }
+            .toMap()
+        set(v) = prefs.edit()
+            .putStringSet(
+                KEY_TARGET_OVERRIDES,
+                v.filter { (d, m) -> d in 1..7 && m in 0 until MINUTES_PER_DAY }
+                    .map { (d, m) -> "$d:$m" }
+                    .toSet(),
+            )
+            .apply()
+
+    /** The earliest-wake minute for [dayOfWeek] — its override, else the single [targetMinutes]. */
+    fun targetFor(dayOfWeek: Int): Int = targetOverrides[dayOfWeek] ?: targetMinutes
+
     /** The wall-clock epoch (ms) of the currently-scheduled HARD deadline, or 0 if none. Persisted so
      *  the boot receiver can re-arm the exact alarm after a restart without recomputing intent. */
     var scheduledDeadlineMs: Long
@@ -73,6 +113,7 @@ class SmartAlarmStore(private val prefs: SharedPreferences) {
         private const val KEY_TARGET = "alarm.targetMinutes"
         private const val KEY_WINDOW = "alarm.windowMinutes"
         private const val KEY_WEEKDAYS = "alarm.weekdays"
+        private const val KEY_TARGET_OVERRIDES = "alarm.targetOverrides"
         private const val KEY_DEADLINE_MS = "alarm.scheduledDeadlineMs"
         private const val KEY_WINDOW_START_MS = "alarm.scheduledWindowStartMs"
 
diff --git a/android/app/src/main/java/com/noop/alarm/WindDownScheduler.kt b/android/app/src/main/java/com/noop/alarm/WindDownScheduler.kt
index e1651d4116..8505367bb7 100644
--- a/android/app/src/main/java/com/noop/alarm/WindDownScheduler.kt
+++ b/android/app/src/main/java/com/noop/alarm/WindDownScheduler.kt
@@ -35,24 +35,59 @@ object WindDownScheduler {
      * prior schedule first so a settings change doesn't stack two nudges. No-op'd by the caller when
      * the nudge is disabled (it calls [cancel] instead).
      */
-    fun schedule(context: Context, store: WindDownStore, wakeMinutes: Int) {
+    fun schedule(
+        context: Context,
+        store: WindDownStore,
+        wakeMinutes: Int,
+        perDayWake: Map<Int, Int> = emptyMap(),
+    ) {
         val am = context.getSystemService(Context.ALARM_SERVICE) as AlarmManager
-        val pi = nudgePendingIntent(context)
-        am.cancel(pi)
-        val minuteOfDay = store.nudgeMinuteOfDay(wakeMinutes)
-        val first = nextOccurrence(minuteOfDay)
-        // Inexact, repeating, NOT wakeup — a wind-down reminder doesn't need to punch through Doze.
-        am.setInexactRepeating(
-            AlarmManager.RTC,
-            first.timeInMillis,
-            AlarmManager.INTERVAL_DAY,
-            pi,
-        )
+        // Cancel BOTH shapes first. Switching between them changes how many alarms exist, so cancelling
+        // only the one about to be re-scheduled would strand the other's — seven weekly nudges left
+        // running after a switch back to daily, or a stale daily one firing beside the seven.
+        cancel(context)
+
+        if (perDayWake.isEmpty()) {
+            val first = nextOccurrence(store.nudgeMinuteOfDay(wakeMinutes))
+            // Inexact, repeating, NOT wakeup — a wind-down reminder doesn't need to punch through Doze.
+            am.setInexactRepeating(
+                AlarmManager.RTC,
+                first.timeInMillis,
+                AlarmManager.INTERVAL_DAY,
+                nudgePendingIntent(context),
+            )
+            return
+        }
+
+        // #1858 (Apple parity): with per-day wake times set, fan out to seven weekday-pinned nudges each
+        // at that day's own time. Mirrors `WindDownNudge`'s #554 fan-out, which does exactly this with
+        // seven UNCalendarNotificationTriggers — the nudge exists to be an hour before YOUR wake, so on a
+        // day whose wake moved it has to move with it.
+        //
+        // A weekly repeat is a daily interval times seven; each day carries its own request code so the
+        // seven PendingIntents are distinct rather than overwriting one another.
+        for (weekday in 1..7) {
+            val wake = perDayWake[weekday] ?: wakeMinutes
+            // The nudge is pinned to the day it FIRES on, which is not always the day you wake on: an
+            // early wake pushes it back over midnight. See [WindDownStore.nudgeDayShift].
+            val nudgeWeekday = shiftWeekday(weekday, store.nudgeDayShift(wake))
+            val first = nextWeeklyOccurrence(store.nudgeMinuteOfDay(wake), nudgeWeekday)
+            am.setInexactRepeating(
+                AlarmManager.RTC,
+                first.timeInMillis,
+                AlarmManager.INTERVAL_DAY * 7,
+                nudgePendingIntent(context, weekday),
+            )
+        }
     }
 
+    /** Cancel every shape the nudge can be scheduled in — the single daily one AND all seven weekday
+     *  pins. Unconditional on purpose: the caller does not always know which shape is live, and a
+     *  cancel that misses one leaves a reminder firing at a time the user has already changed. */
     fun cancel(context: Context) {
         val am = context.getSystemService(Context.ALARM_SERVICE) as AlarmManager
         am.cancel(nudgePendingIntent(context))
+        for (weekday in 1..7) am.cancel(nudgePendingIntent(context, weekday))
     }
 
     /** Raise the low-key nudge notification. Called from [WindDownReceiver]. */
@@ -78,10 +113,12 @@ object WindDownScheduler {
         }
     }
 
-    private fun nudgePendingIntent(context: Context): PendingIntent {
+    /** [weekday] null = the single daily nudge; 1..7 = that weekday's own pin, on its own request code
+     *  so the seven do not collide with each other or with the daily one. */
+    private fun nudgePendingIntent(context: Context, weekday: Int? = null): PendingIntent {
         val intent = Intent(context, WindDownReceiver::class.java).setAction(ACTION_NUDGE)
         return PendingIntent.getBroadcast(
-            context, REQUEST_CODE, intent,
+            context, REQUEST_CODE + (weekday ?: 0), intent,
             PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
         )
     }
@@ -100,6 +137,43 @@ object WindDownScheduler {
         }
     }
 
+    /**
+     * Move a `Calendar.DAY_OF_WEEK` by [shift] days, wrapping through the week end (1=Sun…7=Sat).
+     *
+     * [shift] is normally 0 or -1 — an early wake puts its wind-down on the previous evening — but the
+     * arithmetic is general so a long sleep-need plus lead cannot produce an out-of-range weekday.
+     */
+    internal fun shiftWeekday(weekday: Int, shift: Int): Int =
+        Math.floorMod(weekday - 1 + shift, 7) + 1
+
+    /**
+     * The next time [minuteOfDay] falls on [weekday] (Calendar 1=Sun…7=Sat) — the anchor for a weekly
+     * repeat. Walks forward at most seven days, so today counts only if the minute is still ahead.
+     *
+     * `internal` so the day/time arithmetic is unit-testable without an AlarmManager, which is the whole
+     * of what could go wrong here.
+     */
+    internal fun nextWeeklyOccurrence(
+        minuteOfDay: Int,
+        weekday: Int,
+        now: Calendar = Calendar.getInstance(),
+    ): Calendar {
+        val cal = (now.clone() as Calendar).apply {
+            set(Calendar.HOUR_OF_DAY, minuteOfDay / 60)
+            set(Calendar.MINUTE, minuteOfDay % 60)
+            set(Calendar.SECOND, 0)
+            set(Calendar.MILLISECOND, 0)
+        }
+        var guard = 0
+        while ((cal.get(Calendar.DAY_OF_WEEK) != weekday || cal.timeInMillis <= now.timeInMillis) &&
+            guard < 8
+        ) {
+            cal.add(Calendar.DAY_OF_YEAR, 1)
+            guard++
+        }
+        return cal
+    }
+
     private fun nextOccurrence(minuteOfDay: Int): Calendar =
         Calendar.getInstance().apply {
             set(Calendar.HOUR_OF_DAY, minuteOfDay / 60)
diff --git a/android/app/src/main/java/com/noop/alarm/WindDownStore.kt b/android/app/src/main/java/com/noop/alarm/WindDownStore.kt
index 804ba00141..330ec97933 100644
--- a/android/app/src/main/java/com/noop/alarm/WindDownStore.kt
+++ b/android/app/src/main/java/com/noop/alarm/WindDownStore.kt
@@ -28,9 +28,26 @@ class WindDownStore(private val prefs: SharedPreferences) {
         get() = prefs.getInt(KEY_LEAD, DEFAULT_LEAD).coerceIn(LEAD_MIN, LEAD_MAX)
         set(v) = prefs.edit().putInt(KEY_LEAD, v.coerceIn(LEAD_MIN, LEAD_MAX)).apply()
 
+    /**
+     * How many days BEFORE the wake day the nudge falls: 0 for the same day, -1 for the evening before.
+     *
+     * Only matters once the nudge is pinned to a WEEKDAY (#1858's per-day fan-out). The single daily
+     * schedule never needed it — it fires at a minute-of-day every day, so which day "owns" it is not a
+     * question anyone asks.
+     *
+     * It matters now because per-day wake times exist precisely to support EARLY wakes: a 03:30 wake with
+     * an 8 h need and a 30 min lead puts the nudge at 19:00 the PREVIOUS evening. Pinning that to the
+     * wake's own weekday would fire it eight hours AFTER the wake it is meant to precede — and it would be
+     * pointing at the next day's wake, which may be a different time entirely.
+     */
+    fun nudgeDayShift(wakeMinutes: Int): Int =
+        nudgeDayShift(wakeMinutes, sleepNeedMinutes, leadMinutes)
+
     /**
      * Minute-of-day the nudge should fire, derived from a wake time: wake − sleepNeed − lead,
      * wrapped into [0, 1440). With an 06:30 wake, 8 h need and 30 min lead this is 22:00.
+     *
+     * The wrap loses WHICH day that minute belongs to, which is why [nudgeDayShift] exists beside it.
      */
     fun nudgeMinuteOfDay(wakeMinutes: Int): Int {
         val raw = wakeMinutes - sleepNeedMinutes - leadMinutes
@@ -39,6 +56,10 @@ class WindDownStore(private val prefs: SharedPreferences) {
     }
 
     companion object {
+        /** Pure form of [nudgeDayShift], so the day arithmetic is testable without a Context. */
+        fun nudgeDayShift(wakeMinutes: Int, sleepNeedMinutes: Int, leadMinutes: Int): Int =
+            Math.floorDiv(wakeMinutes - sleepNeedMinutes - leadMinutes, 24 * 60)
+
         private const val PREFS = "noop_wind_down"
         private const val KEY_ENABLED = "windDown.enabled"
         private const val KEY_SLEEP_NEED = "windDown.sleepNeedMinutes"
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index 1da04890bc..615b844c6b 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -634,6 +634,11 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
     private val _phoneAlarmEnabled = MutableStateFlow(phoneAlarmStore.enabled)
     /** Whether the phone smart alarm is armed (a guaranteed OS alarm is scheduled). */
     val phoneAlarmEnabled: StateFlow<Boolean> = _phoneAlarmEnabled.asStateFlow()
+    /** #1858: per-weekday wake-time overrides for the PHONE alarm — the strap alarm's #554 feature,
+     *  which this screen has shown beside it since then. Empty = every enabled day uses the single time. */
+    private val _phoneAlarmDayOverrides = MutableStateFlow(phoneAlarmStore.targetOverrides)
+    val phoneAlarmDayOverrides: StateFlow<Map<Int, Int>> = _phoneAlarmDayOverrides.asStateFlow()
+
     private val _phoneAlarmTargetMinutes = MutableStateFlow(phoneAlarmStore.targetMinutes)
     /** Earliest acceptable wake time, minutes since midnight. */
     val phoneAlarmTargetMinutes: StateFlow<Int> = _phoneAlarmTargetMinutes.asStateFlow()
@@ -2533,12 +2538,43 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
         _phoneAlarmTargetMinutes.value = phoneAlarmStore.targetMinutes
         if (phoneAlarmStore.enabled) SmartAlarmScheduler.arm(appContext, phoneAlarmStore)
         // The wind-down nudge is derived from the wake time, so keep it in step.
-        if (windDownStore.enabled) WindDownScheduler.schedule(appContext, windDownStore, phoneAlarmStore.targetMinutes)
+        if (windDownStore.enabled) WindDownScheduler.schedule(
+            appContext, windDownStore, phoneAlarmStore.targetMinutes, phoneAlarmStore.targetOverrides,
+        )
         // #536: re-arm the strap at the new earliest time when "Buzz WHOOP 4" is on. Routed through the
         // single reconciler so it can't clobber a smart-alarm the user still has on (#5).
         reconcileStrapAlarm()
     }
 
+    /**
+     * #1858: set or clear ONE weekday's wake-time override for the phone alarm.
+     *
+     * `null` clears, so a day can go back to following the single time without a second control. Re-arms
+     * afterwards for the same reason every other alarm edit does: the scheduled deadline is computed from
+     * these values, so leaving it stale would keep waking the user at the old time until something else
+     * happened to re-arm. Mirrors `setSmartAlarmDayOverride` for the strap.
+     */
+    fun setPhoneAlarmDayOverride(dayOfWeek: Int, minutes: Int?) {
+        val next = phoneAlarmStore.targetOverrides.toMutableMap()
+        if (minutes == null) next.remove(dayOfWeek) else next[dayOfWeek] = minutes
+        phoneAlarmStore.targetOverrides = next
+        _phoneAlarmDayOverrides.value = phoneAlarmStore.targetOverrides
+        if (phoneAlarmStore.enabled) SmartAlarmScheduler.arm(appContext, phoneAlarmStore)
+        // The strap-buzz companion derives its buzz time FROM the phone alarm, so an override that moves a
+        // wake time has to move the buzz with it. `setPhoneAlarmWeekdays` already reconciles for exactly
+        // this reason; omitting it here would leave the strap armed for the old time until some unrelated
+        // edit happened to reconcile — a strap buzzing at the wrong hour being worse than one not buzzing.
+        reconcileStrapAlarm()
+        // The wind-down nudge is anchored to the wake time this just moved, so it has to move too —
+        // Apple's WindDownNudge has fanned out per-day since #554. Without this the reminder keeps
+        // pointing at the old wake on exactly the day the user changed.
+        if (windDownStore.enabled) {
+            WindDownScheduler.schedule(
+                appContext, windDownStore, phoneAlarmStore.targetMinutes, phoneAlarmStore.targetOverrides,
+            )
+        }
+    }
+
     /** Set the days the phone alarm fires on. EMPTY = every day (see [SmartAlarmStore.weekdays]).
      *
      *  Re-arms while enabled so deselecting today's day moves the alarm to the next selected one
@@ -2577,7 +2613,9 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
     fun setWindDownEnabled(enabled: Boolean) {
         windDownStore.enabled = enabled
         _windDownEnabled.value = enabled
-        if (enabled) WindDownScheduler.schedule(appContext, windDownStore, phoneAlarmStore.targetMinutes)
+        if (enabled) WindDownScheduler.schedule(
+            appContext, windDownStore, phoneAlarmStore.targetMinutes, phoneAlarmStore.targetOverrides,
+        )
         else WindDownScheduler.cancel(appContext)
     }
 
@@ -2741,12 +2779,20 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
         } else null
         // Buzz-WHOOP-4 companion's requested time: the phone alarm's EARLIEST wake time, next occurrence
         // ON A DAY THAT ALARM ACTUALLY FIRES. This routes through the same weekday-aware resolver the
-        // smart alarm uses (with no per-day overrides — the phone alarm has none) rather than
-        // nextDailyEpochSec, which is unconditionally daily: leaving it daily would buzz the strap on a
-        // morning the phone alarm is switched off, which is precisely the day the user asked to sleep in.
-        // An empty weekday set still means every day, so the default behaviour is unchanged.
+        // smart alarm uses rather than nextDailyEpochSec, which is unconditionally daily: leaving it daily
+        // would buzz the strap on a morning the phone alarm is switched off, which is precisely the day the
+        // user asked to sleep in. An empty weekday set still means every day.
+        //
+        // #1858: the per-day overrides go through TOO. This companion exists to buzz the strap at the phone
+        // alarm's earliest wake time, so a day whose wake time was moved must move the buzz with it — the
+        // comment here used to say "the phone alarm has none", which stopped being true the moment it got
+        // them, and a strap buzzing at the old time is worse than one not buzzing at all.
         val buzzEpoch = if (_buzzWhoop4Enabled.value) {
-            nextSmartAlarmEpochSec(phoneAlarmStore.targetMinutes, phoneAlarmStore.weekdays)
+            nextSmartAlarmEpochSec(
+                phoneAlarmStore.targetMinutes,
+                phoneAlarmStore.weekdays,
+                dayOverrides = phoneAlarmStore.targetOverrides,
+            )
         } else null
 
         val epochSec = earliestStrapAlarmEpochSec(smartEpoch, buzzEpoch)
diff --git a/android/app/src/main/java/com/noop/ui/SmartAlarmScreen.kt b/android/app/src/main/java/com/noop/ui/SmartAlarmScreen.kt
index 660ab8bc37..f0f375b518 100644
--- a/android/app/src/main/java/com/noop/ui/SmartAlarmScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SmartAlarmScreen.kt
@@ -61,6 +61,7 @@ fun SmartAlarmScreen(vm: AppViewModel) {
     val targetMinutes by vm.phoneAlarmTargetMinutes.collectAsStateWithLifecycle()
     val windowMinutes by vm.phoneAlarmWindowMinutes.collectAsStateWithLifecycle()
     val phoneAlarmWeekdays by vm.phoneAlarmWeekdays.collectAsStateWithLifecycle()
+    val phoneAlarmDayOverrides by vm.phoneAlarmDayOverrides.collectAsStateWithLifecycle()
     val buzzWhoop4 by vm.buzzWhoop4Enabled.collectAsStateWithLifecycle()
     // #536: the hint adapts to bond state — the strap can only be armed when a WHOOP 4.0 is connected.
     val liveState = vm.live.collectAsStateWithLifecycle().value
@@ -84,7 +85,23 @@ fun SmartAlarmScreen(vm: AppViewModel) {
         subtitle = "Your wake window, the strap wake-alarm, and the evening wind-down reminder, in one place.",
     ) {
         // The guaranteed-wake card always shows so the safety promise is the first thing read.
-        item { WindowCard(enabled = enabled, targetMinutes = targetMinutes, windowMinutes = windowMinutes) }
+        item {
+            // #1858: the card names a specific time ("a backup alarm is set for 04:45"), so with per-day
+            // wake times it has to show the NEXT one rather than the default — on a day whose time was
+            // moved, the default is simply the wrong number, and this card is the one thing on the screen
+            // that makes a promise. Falls back to the default when no day is reachable.
+            val nextTargetMinutes = remember(
+                targetMinutes, windowMinutes, phoneAlarmWeekdays, phoneAlarmDayOverrides,
+            ) {
+                com.noop.alarm.SmartAlarmScheduler.nextWindowStartMinutes(
+                    now = java.util.Calendar.getInstance(),
+                    weekdays = phoneAlarmWeekdays,
+                    windowMinutes = windowMinutes,
+                    defaultTarget = targetMinutes,
+                ) { phoneAlarmDayOverrides[it] ?: targetMinutes }
+            }
+            WindowCard(enabled = enabled, targetMinutes = nextTargetMinutes, windowMinutes = windowMinutes)
+        }
 
         item {
         AlarmSettingsCard {
@@ -164,6 +181,18 @@ fun SmartAlarmScreen(vm: AppViewModel) {
                         vm.setPhoneAlarmWeekdays(toggledSmartAlarmWeekday(dow, phoneAlarmWeekdays))
                     },
                 )
+                RowDividerLocal()
+                // #1858: per-day wake times, the SAME picker and the same contract the strap alarm below
+                // has had since #554. Both alarms sit on this one screen, so one of them supporting a
+                // different time on different days and the other not is read as the feature being broken —
+                // which is exactly how it was reported ("I want 04:45 on three days and 03:30 on two
+                // others… the smart alarm basically never works").
+                AlarmDayOverridePicker(
+                    defaultMinutes = targetMinutes,
+                    enabledDays = phoneAlarmWeekdays,
+                    overrides = phoneAlarmDayOverrides,
+                    onSetOverride = { dow, minutes -> vm.setPhoneAlarmDayOverride(dow, minutes) },
+                )
             }
 
             // #536: companion strap-buzz, always visible so it's discoverable. Arms the strap's own firmware
diff --git a/android/app/src/test/java/com/noop/alarm/PhoneAlarmWeekdayTest.kt b/android/app/src/test/java/com/noop/alarm/PhoneAlarmWeekdayTest.kt
index 934346356f..4d075254a2 100644
--- a/android/app/src/test/java/com/noop/alarm/PhoneAlarmWeekdayTest.kt
+++ b/android/app/src/test/java/com/noop/alarm/PhoneAlarmWeekdayTest.kt
@@ -1,85 +1,268 @@
 package com.noop.alarm
 
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
 import org.junit.Test
 import java.util.Calendar
 
 /**
- * Per-day scheduling for the PHONE smart alarm (distinct from com.noop.ui.SmartAlarmWeekdayTest,
- * which covers the STRAP alarm): the Mon…Sun circles that let a day be switched off
- * without disabling the alarm and having to remember to switch it back on.
+ * Day and time selection for the PHONE smart alarm (distinct from com.noop.ui.SmartAlarmWeekdayTest,
+ * which covers the STRAP alarm).
  *
- * Covers [SmartAlarmScheduler.advanceToEnabledDay], which is the whole of the day-selection logic —
- * `arm` wraps it around an AlarmManager call that a JVM test cannot exercise, so the decision is
- * factored out and pinned here instead. Fixtures use a fixed date so a Sunday case stays a Sunday case
- * whatever day the suite runs on.
+ * Covers [SmartAlarmScheduler.nextDeadline], which is the whole of the scheduling decision — `arm` wraps
+ * it around an AlarmManager call a JVM test cannot exercise, so the decision is factored out and pinned
+ * here. Repinned from `advanceToEnabledDay` when #1858 made the deadline minute per-day: the day can no
+ * longer be chosen first and the time applied afterwards, because the time is a property OF the day.
+ *
+ * Fixtures use a fixed date so a Sunday case stays a Sunday case whatever day the suite runs on.
  */
 class PhoneAlarmWeekdayTest {
 
     /** 2026-08-24 is a Monday. Calendar.DAY_OF_WEEK: 1=Sun … 7=Sat. */
-    private fun mondayAt(hour: Int = 7): Calendar = Calendar.getInstance().apply {
+    private fun mondayAt(hour: Int = 5): Calendar = Calendar.getInstance().apply {
         set(2026, Calendar.AUGUST, 24, hour, 0, 0)
         set(Calendar.MILLISECOND, 0)
     }
 
+    /** 06:30 earliest + 30 min window = a 07:00 deadline, the shipped defaults. */
+    private fun deadline(
+        now: Calendar,
+        weekdays: Set<Int> = emptySet(),
+        target: Int = 6 * 60 + 30,
+        window: Int = 30,
+        afterFire: Boolean = false,
+        perDay: Map<Int, Int> = emptyMap(),
+    ): Calendar? = SmartAlarmScheduler.nextDeadline(now, weekdays, window, afterFire) {
+        perDay[it] ?: target
+    }
+
     /** The fixture must actually be the day the tests below assume. */
     @Test fun fixtureIsAMonday() {
         assertEquals(Calendar.MONDAY, mondayAt().get(Calendar.DAY_OF_WEEK))
     }
 
     /**
-     * EMPTY = every day. This is the backward-compatible default: every existing install has no weekday
-     * key set, so an empty set must leave the day exactly as computed or the feature would silently
-     * re-schedule everyone's alarm on upgrade.
+     * EMPTY = every day, the backward-compatible default: every existing install has no weekday key set,
+     * so an empty set must schedule today's own deadline rather than shifting anyone on upgrade.
      */
-    @Test fun emptySetMeansEveryDayAndDoesNotMoveTheDay() {
-        val cal = mondayAt()
-        SmartAlarmScheduler.advanceToEnabledDay(cal, emptySet())
-        assertEquals(Calendar.MONDAY, cal.get(Calendar.DAY_OF_WEEK))
-        assertEquals(24, cal.get(Calendar.DAY_OF_MONTH))
+    @Test fun emptySetMeansEveryDay() {
+        val d = deadline(mondayAt())!!
+        assertEquals(Calendar.MONDAY, d.get(Calendar.DAY_OF_WEEK))
+        assertEquals(24, d.get(Calendar.DAY_OF_MONTH))
+        assertEquals(7, d.get(Calendar.HOUR_OF_DAY))
+        assertEquals(0, d.get(Calendar.MINUTE))
     }
 
-    /** A day that IS selected is left alone — no gratuitous shifting. */
+    /** A day that IS selected is used as-is — no gratuitous shifting. */
     @Test fun anEnabledDayIsNotMoved() {
-        val cal = mondayAt()
-        SmartAlarmScheduler.advanceToEnabledDay(cal, setOf(Calendar.MONDAY, Calendar.FRIDAY))
-        assertEquals(Calendar.MONDAY, cal.get(Calendar.DAY_OF_WEEK))
-        assertEquals(24, cal.get(Calendar.DAY_OF_MONTH))
+        val d = deadline(mondayAt(), weekdays = setOf(Calendar.MONDAY, Calendar.FRIDAY))!!
+        assertEquals(Calendar.MONDAY, d.get(Calendar.DAY_OF_WEEK))
+        assertEquals(24, d.get(Calendar.DAY_OF_MONTH))
     }
 
-    /** A disabled day rolls forward to the next selected one, and to the NEAREST such day. */
+    /** A disabled day rolls forward to the NEAREST selected one. */
     @Test fun aDisabledDayAdvancesToTheNextSelectedDay() {
-        val cal = mondayAt()
-        SmartAlarmScheduler.advanceToEnabledDay(cal, setOf(Calendar.WEDNESDAY, Calendar.SATURDAY))
-        assertEquals(Calendar.WEDNESDAY, cal.get(Calendar.DAY_OF_WEEK))
-        assertEquals(26, cal.get(Calendar.DAY_OF_MONTH))   // Mon 24 → Wed 26, not Sat
+        val d = deadline(mondayAt(), weekdays = setOf(Calendar.WEDNESDAY, Calendar.SATURDAY))!!
+        assertEquals(Calendar.WEDNESDAY, d.get(Calendar.DAY_OF_WEEK))
+        assertEquals(26, d.get(Calendar.DAY_OF_MONTH))   // Mon 24 → Wed 26, not Sat
     }
 
     /** Wrapping the week end: from Monday, a Sunday-only alarm lands six days out, not never. */
     @Test fun itWrapsAroundTheWeekEnd() {
-        val cal = mondayAt()
-        SmartAlarmScheduler.advanceToEnabledDay(cal, setOf(Calendar.SUNDAY))
-        assertEquals(Calendar.SUNDAY, cal.get(Calendar.DAY_OF_WEEK))
-        assertEquals(30, cal.get(Calendar.DAY_OF_MONTH))   // Mon 24 → Sun 30
+        val d = deadline(mondayAt(), weekdays = setOf(Calendar.SUNDAY))!!
+        assertEquals(Calendar.SUNDAY, d.get(Calendar.DAY_OF_WEEK))
+        assertEquals(30, d.get(Calendar.DAY_OF_MONTH))   // Mon 24 → Sun 30
+    }
+
+    /** Today's deadline already gone ⇒ tomorrow, not a wake in the past. */
+    @Test fun aPastDeadlineRollsToTheNextDay() {
+        val d = deadline(mondayAt(hour = 9))!!   // 07:00 already behind us
+        assertEquals(25, d.get(Calendar.DAY_OF_MONTH))
+    }
+
+    // MARK: #1858 — a different wake time on different days
+
+    /**
+     * The reported shape: 04:45 on three days, 03:30 on two others — impossible to express before, since
+     * one target applied to every selected day.
+     *
+     * Each day's deadline is its OWN target plus the window, so Tuesday here wakes at 03:30 while the
+     * default days wake at 04:45.
+     */
+    @Test fun aDayWithAnOverrideUsesItsOwnTime() {
+        val d = deadline(
+            mondayAt(),
+            weekdays = setOf(Calendar.TUESDAY),
+            target = 4 * 60 + 15,                                   // default 04:15 + 30 = 04:45
+            perDay = mapOf(Calendar.TUESDAY to 3 * 60),             // Tue 03:00 + 30 = 03:30
+        )!!
+        assertEquals(Calendar.TUESDAY, d.get(Calendar.DAY_OF_WEEK))
+        assertEquals(3, d.get(Calendar.HOUR_OF_DAY))
+        assertEquals(30, d.get(Calendar.MINUTE))
+    }
+
+    /** A day with no override falls back to the single target, so setting one day never moves another. */
+    @Test fun daysWithoutAnOverrideKeepTheDefault() {
+        val d = deadline(
+            mondayAt(),
+            weekdays = setOf(Calendar.MONDAY),
+            target = 4 * 60 + 15,
+            perDay = mapOf(Calendar.TUESDAY to 3 * 60),   // an override for a DIFFERENT day
+        )!!
+        assertEquals(Calendar.MONDAY, d.get(Calendar.DAY_OF_WEEK))
+        assertEquals(4, d.get(Calendar.HOUR_OF_DAY))
+        assertEquals(45, d.get(Calendar.MINUTE))
+    }
+
+    /**
+     * The nearest day wins on TIME, not on day order alone: with per-day targets an earlier day can now
+     * hold a later deadline, so "next" has to be decided by the instant.
+     */
+    @Test fun theNearestDeadlineWinsAcrossDifferentPerDayTimes() {
+        val d = deadline(
+            mondayAt(hour = 5),                                   // Monday 05:00; Monday's own 04:45 is gone
+            weekdays = setOf(Calendar.MONDAY, Calendar.TUESDAY),
+            target = 4 * 60 + 15,
+            perDay = mapOf(Calendar.TUESDAY to 3 * 60),
+        )!!
+        assertEquals(Calendar.TUESDAY, d.get(Calendar.DAY_OF_WEEK))
+        assertEquals(25, d.get(Calendar.DAY_OF_MONTH))
+        assertEquals(3, d.get(Calendar.HOUR_OF_DAY))
+    }
+
+    // MARK: re-arming and edges
+
+    /**
+     * After an EARLY fire the same morning's deadline is still ahead — re-arming onto it would wake the
+     * user a second time. `afterFire` skips today, and because the skip happens inside the day loop it
+     * can never land on a day the alarm is switched off.
+     */
+    @Test fun afterFiringEarlyTheNextWakeIsNotToday() {
+        val d = deadline(mondayAt(hour = 4), afterFire = true)!!   // 07:00 today still ahead
+        assertEquals(25, d.get(Calendar.DAY_OF_MONTH))
+    }
+
+    /** …and the skip respects the weekday set rather than blindly taking tomorrow. */
+    @Test fun afterFiringTheSkipStillHonoursTheEnabledDays() {
+        val d = deadline(
+            mondayAt(hour = 4), weekdays = setOf(Calendar.MONDAY, Calendar.THURSDAY), afterFire = true,
+        )!!
+        assertEquals(Calendar.THURSDAY, d.get(Calendar.DAY_OF_WEEK))
+    }
+
+    /**
+     * `target + window` can roll past midnight. The deadline stays on the ENABLED day and the window
+     * opens the previous evening — the same relationship the single-time version produced.
+     */
+    @Test fun aWindowCrossingMidnightKeepsTheDeadlineOnTheEnabledDay() {
+        val d = deadline(mondayAt(), weekdays = setOf(Calendar.MONDAY), target = 23 * 60 + 50, window = 30)!!
+        assertEquals(Calendar.MONDAY, d.get(Calendar.DAY_OF_WEEK))
+        assertEquals(0, d.get(Calendar.HOUR_OF_DAY))
+        assertEquals(20, d.get(Calendar.MINUTE))
     }
 
-    /** The time of day survives a day shift — only the DATE moves. */
-    @Test fun advancingPreservesTheWakeTime() {
-        val cal = mondayAt(hour = 6).apply { set(Calendar.MINUTE, 45) }
-        SmartAlarmScheduler.advanceToEnabledDay(cal, setOf(Calendar.THURSDAY))
-        assertEquals(Calendar.THURSDAY, cal.get(Calendar.DAY_OF_WEEK))
-        assertEquals(6, cal.get(Calendar.HOUR_OF_DAY))
-        assertEquals(45, cal.get(Calendar.MINUTE))
+    /** An unreachable set yields null rather than spinning — a missed alarm is recoverable, a hung
+     *  scheduler on the safety-critical path is not. The store's 1..7 filter makes this unreachable in
+     *  practice; the guard is for the day a caller forgets that. */
+    @Test fun anUnreachableSetYieldsNothingInsteadOfSpinning() {
+        assertNull(deadline(mondayAt(), weekdays = setOf(99)))
     }
 
+    // MARK: what the guarantee card shows
+
     /**
-     * An unreachable set returns the unshifted day rather than spinning. [SmartAlarmStore.weekdays]
-     * filters to 1..7 so this is unreachable through the store, but the guard is on the
-     * safety-critical scheduling path: a wrong-day alarm is recoverable, a hung scheduler is not.
+     * The card names a specific time, so it must name the NEXT one. Derived from the same
+     * [SmartAlarmScheduler.nextDeadline] the alarm uses, so the promise on screen and the alarm that
+     * actually fires cannot drift apart — two independent time computations going stale is the failure
+     * this change had to fix in the Buzz-WHOOP companion as well.
      */
-    @Test fun anUnreachableSetTerminatesInsteadOfSpinning() {
-        val cal = mondayAt()
-        SmartAlarmScheduler.advanceToEnabledDay(cal, setOf(99))
-        assertEquals(24 + 7, cal.get(Calendar.DAY_OF_MONTH))   // bounded at 7 hops, then gives up
+    @Test fun theCardShowsTheNextWindowNotTheDefault() {
+        val start = SmartAlarmScheduler.nextWindowStartMinutes(
+            now = mondayAt(),
+            weekdays = setOf(Calendar.TUESDAY),
+            windowMinutes = 30,
+            defaultTarget = 4 * 60 + 15,
+        ) { mapOf(Calendar.TUESDAY to 3 * 60)[it] ?: (4 * 60 + 15) }
+        assertEquals(3 * 60, start)   // Tuesday's own 03:00, not the 04:15 default
+    }
+
+    /** With no overrides it is the default, so the card is unchanged for every existing install. */
+    @Test fun theCardKeepsTheDefaultWhenNothingIsOverridden() {
+        val start = SmartAlarmScheduler.nextWindowStartMinutes(
+            now = mondayAt(), weekdays = emptySet(), windowMinutes = 30, defaultTarget = 6 * 60 + 30,
+        ) { 6 * 60 + 30 }
+        assertEquals(6 * 60 + 30, start)
+    }
+
+    /** A window opening the previous evening still reports its own start, not a negative minute. */
+    @Test fun theCardHandlesAWindowThatOpensBeforeMidnight() {
+        val start = SmartAlarmScheduler.nextWindowStartMinutes(
+            now = mondayAt(), weekdays = setOf(Calendar.MONDAY), windowMinutes = 30,
+            defaultTarget = 23 * 60 + 50,
+        ) { 23 * 60 + 50 }
+        assertEquals(23 * 60 + 50, start)
+    }
+
+    /** Nothing schedulable degrades to the default rather than blanking the promise. */
+    @Test fun theCardFallsBackWhenNoDayIsReachable() {
+        val start = SmartAlarmScheduler.nextWindowStartMinutes(
+            now = mondayAt(), weekdays = setOf(99), windowMinutes = 30, defaultTarget = 5 * 60,
+        ) { 5 * 60 }
+        assertEquals(5 * 60, start)
+    }
+
+
+    // MARK: wind-down fan-out (Apple parity — WindDownNudge has done this since #554)
+
+    /** The weekly anchor lands on the requested weekday at the requested minute. */
+    @Test fun theWeeklyNudgeAnchorLandsOnItsWeekday() {
+        val at = WindDownScheduler.nextWeeklyOccurrence(21 * 60 + 15, Calendar.THURSDAY, mondayAt())
+        assertEquals(Calendar.THURSDAY, at.get(Calendar.DAY_OF_WEEK))
+        assertEquals(21, at.get(Calendar.HOUR_OF_DAY))
+        assertEquals(15, at.get(Calendar.MINUTE))
+        assertEquals(27, at.get(Calendar.DAY_OF_MONTH))   // Mon 24 → Thu 27
     }
+
+    /** Today counts only while its minute is still ahead. */
+    @Test fun todayCountsWhenItsMinuteHasNotPassed() {
+        val at = WindDownScheduler.nextWeeklyOccurrence(21 * 60, Calendar.MONDAY, mondayAt(hour = 5))
+        assertEquals(24, at.get(Calendar.DAY_OF_MONTH))
+    }
+
+    /** …and rolls a full week once it has, rather than scheduling a nudge in the past. */
+    @Test fun aPassedMinuteRollsAWholeWeek() {
+        val at = WindDownScheduler.nextWeeklyOccurrence(4 * 60, Calendar.MONDAY, mondayAt(hour = 9))
+        assertEquals(31, at.get(Calendar.DAY_OF_MONTH))   // Mon 24 → Mon 31
+    }
+
+
+    /**
+     * An EARLY wake puts its wind-down on the previous EVENING, so the nudge must be pinned to that day —
+     * not to the day you wake on.
+     *
+     * The reported schedule is exactly this shape: a 03:30 wake with an 8 h need and a 30 min lead puts
+     * the nudge at 19:00 the night before. Pinning it to the wake's own weekday would fire it eight hours
+     * AFTER the wake it exists to precede, pointing at the next day's wake — which per-day times mean may
+     * be a different hour entirely.
+     *
+     * Only reachable once the nudge is weekday-pinned: the single daily schedule fires at a minute-of-day
+     * every day, so which day owns it was never a question.
+     */
+    @Test fun anEarlyWakePinsTheNudgeToThePreviousEvening() {
+        val need = WindDownStore.DEFAULT_SLEEP_NEED   // 8 h
+        val lead = WindDownStore.DEFAULT_LEAD         // 30 min
+        // 03:30 wake ⇒ 19:00 the previous evening.
+        assertEquals(-1, WindDownStore.nudgeDayShift(3 * 60 + 30, need, lead))
+        // A late-morning wake keeps its nudge on the same day.
+        assertEquals(0, WindDownStore.nudgeDayShift(21 * 60, need, lead))
+    }
+
+    /** Shifting a weekday wraps through the week end in both directions. */
+    @Test fun theWeekdayShiftWrapsAtBothEnds() {
+        assertEquals(Calendar.SATURDAY, WindDownScheduler.shiftWeekday(Calendar.SUNDAY, -1))
+        assertEquals(Calendar.SUNDAY, WindDownScheduler.shiftWeekday(Calendar.MONDAY, -1))
+        assertEquals(Calendar.MONDAY, WindDownScheduler.shiftWeekday(Calendar.MONDAY, 0))
+        assertEquals(Calendar.SUNDAY, WindDownScheduler.shiftWeekday(Calendar.SATURDAY, 1))
+    }
+
 }

From 6d256880fb8a0bd445b770cd99c27be09e2e8326 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 13:52:07 +1200
Subject: [PATCH 215/333] ble: re-arm a WHOOP 5/MG realtime stream that has
 lapsed (#1866)

Reported as "Live doesn't work - initially it shows real data but now it doesn't", on a strap reading Bonded / FULL BOND, worn, battery 33%, "History synced just now", and no bpm.

That combination is the bug rather than a confusing coincidence. The WHOOP 4.0 keep-alive re-sends TOGGLE_REALTIME_HR every 30 s tick and states why - "re-arm realtime HR so the firmware can't let it lapse". A 5/MG is skipped on the reasoning that it "rejects WHOOP4-framed commands", a premise that no longer holds for this command: reconcileRealtime twenty lines above sends the toggle to BOTH families because send() routes the 5/MG one with puffin framing.

Nothing else can see the state. reconcileRealtime is edge-triggered, so while we believe the stream is armed it sends nothing. The one-shot re-subscribe recovers a dropped CCCD, not a lapsed stream. And the stall bounce keys on lastDataAtMs, which any inbound frame refreshes - battery polls and history offload keep the link looking perfectly healthy, and #1414 widened the 5/MG fuse to ten minutes because HR lulls are a family trait. So every other signal being fine is precisely what stops the one path that could recover it, which is why this needed its own HR-specific clock rather than reusing the existing one.

The change adds lastLiveHrAtMs plus a one-shot cleared when a sample lands, armed on connect so the first tick cannot fire spuriously, and one re-arm per stall episode after five minutes of HR silence while the stream is believed armed. The decision is extracted as a pure shouldReArmLapsedRealtime, following the shouldReArmRealtimeAfterDrop precedent next door, because keepAliveFire needs a live GATT link and extraction is the only way this logic gets a test.

Re-review caught the fix defeating itself: the stall clock counted REPLAYED offload frames as live HR. Replayed frames reach the REALTIME_DATA branch - handleFrame takes replayedOffload and stopUnexpectedRealtimeImu gates on it for exactly that reason - so a strap syncing history would keep stamping the clock and the re-arm would never fire. That is the same shape as the bug itself, healthy-looking traffic hiding the absence of live HR, one level down. Now gated on !replayedOffload. parseStandardHr is reached only from onInbound on the live 0x2A37 characteristic and has no replay path, so it needed no gate - checked rather than assumed.

Safety, verified rather than asserted: the re-arm sits inside the !backfilling guard so it can never write during an offload that owns the link; TOGGLE_REALTIME_HR is already sent from five existing sites including the 4.0 keep-alive every 30 s, so this is not new hardware surface and fires strictly less often; it mutates no reconciler state, so a dropped write is recovered by the existing #312 flip rather than corrupting the model; and it is gated on wantsRealtime, so nothing is sent with Live closed. WHOOP 4.0 is untouched.

Full suite 5149/0, 7 new cases including the threshold sitting between the 45 s quiet mark and the 600 s bounce fuse. Gates clean.

NOT hardware-validated - BLE cannot be CI-tested, and that the 5/MG firmware lapses the way the 4.0's does is inferred from the code paths plus the reported state. The added log line says plainly whether the condition ever triggers. Apple's BLEManager has the identical whoop4-only guard and is left alone rather than changed blind; tracked on the issue.
---
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 106 +++++++++++++++-
 .../com/noop/ble/LapsedRealtimeReArmTest.kt   | 116 ++++++++++++++++++
 2 files changed, 218 insertions(+), 4 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ble/LapsedRealtimeReArmTest.kt

diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 44c849a79f..8b6642f28d 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -1080,6 +1080,17 @@ class WhoopBleClient(
         /** Stream gone quiet this long (but not yet stall) ⇒ re-subscribe in case a CCCD silently dropped. */
         private const val KEEPALIVE_QUIET_MS = 45_000L
 
+        /**
+         * #1865: how long live HR may be absent, while we believe the stream is armed, before a 5/MG gets
+         * one re-arm.
+         *
+         * Sits between the 45 s quiet threshold and the 600 s bounce fuse on purpose. The 0x2A37 profile
+         * genuinely lulls at rest — that lull is why #1414 widened the fuse to 10 minutes — so a shorter
+         * value would re-arm a perfectly healthy stream, while waiting for the fuse means never recovering
+         * at all: the fuse watches ANY inbound data, and a strap answering battery polls never trips it.
+         */
+        private const val REALTIME_HR_STALL_MS = 300_000L
+
         /** A CCCD write can transiently return BUSY if the stack slot hasn't freed yet; retry the same
          *  subscribe a few times (short backoff) before giving up, rather than dropping the stream. */
         private const val CCCD_RETRY_DELAY_MS = 60L
@@ -1239,6 +1250,28 @@ class WhoopBleClient(
             else -> "status=$status"
         }
 
+        /**
+         * #1865: whether a 5/MG's realtime stream looks LAPSED and should get its one re-arm.
+         *
+         * Pure so the decision is testable — `keepAliveFire` itself needs a live GATT link, which is why
+         * the drop-recovery decision next door was extracted the same way.
+         *
+         * Every clause earns its place:
+         *  - `wantsRealtime`: never arm a stream nobody asked for.
+         *  - `realtimeArmed`: if we do NOT believe it is armed, `reconcileRealtime` has a real edge and
+         *    sends the toggle itself. This path exists only for the case it cannot see.
+         *  - `!reArmedSinceHr`: one write per stall episode, not one per 30 s tick.
+         *  - the threshold: the 0x2A37 profile legitimately lulls at rest, so this must sit well past a
+         *    normal quiet spell.
+         */
+        fun shouldReArmLapsedRealtime(
+            wantsRealtime: Boolean,
+            realtimeArmed: Boolean,
+            reArmedSinceHr: Boolean,
+            hrSilentMs: Long,
+            stallMs: Long = REALTIME_HR_STALL_MS,
+        ): Boolean = wantsRealtime && realtimeArmed && !reArmedSinceHr && hrSilentMs > stallMs
+
         fun shouldReArmRealtimeAfterDrop(droppedCmd: CommandNumber?): Boolean =
             droppedCmd == CommandNumber.TOGGLE_REALTIME_HR
 
@@ -3269,6 +3302,21 @@ class WhoopBleClient(
     @Volatile private var realtimeArmed = false
     /** Wall-clock of the last inbound notification — drives the keep-alive liveness watchdog. */
     @Volatile private var lastDataAtMs = 0L
+
+    /**
+     * #1865: when a LIVE HR sample last arrived — distinct from [lastDataAtMs], which any inbound frame
+     * refreshes.
+     *
+     * That distinction is the whole bug. A 5/MG whose realtime stream has lapsed still answers battery
+     * polls and still serves history, so [lastDataAtMs] keeps the link looking perfectly healthy and the
+     * stall bounce never fires. Only an HR-specific clock can see "the stream is dead while the link is
+     * fine", which is exactly the state reported: bonded, worn, history synced just now, no bpm.
+     */
+    @Volatile private var lastLiveHrAtMs = 0L
+
+    /** #1865: one re-arm per stall episode, cleared when live HR resumes. Same shape as
+     *  [resubscribedSinceData] — recovering costs one write, repeating it every tick would not. */
+    @Volatile private var realtimeReArmedSinceHr = false
     /** True once we've re-subscribed during the CURRENT quiet episode, so the keep-alive re-subscribes
      *  at most once between data arrivals instead of flooding descriptor writes every 30s tick (#77).
      *  Reset to false in [onInbound] when fresh data lands. */
@@ -7106,6 +7154,12 @@ class WhoopBleClient(
                     // Only republish when the value actually changed: a same-HR frame's it.copy() allocates a
                     // whole throwaway LiveState that StateFlow drops as equal anyway — pure GC churn at ~1 Hz,
                     // every frame. Matches the Swift FrameRouter guard (`state.heartRate != hr`).
+                    // #1865: only a LIVE sample restarts the stall clock. Replayed offload frames reach
+                    // this branch too (handleFrame carries `replayedOffload`, and stopUnexpectedRealtimeImu
+                    // gates on it for exactly that reason), so counting them would let a history sync mask
+                    // a dead realtime stream — which is the very shape of the bug this recovers from:
+                    // healthy-looking traffic hiding the absence of HR.
+                    if (hr in 30..220 && !replayedOffload) noteLiveHr()
                     if (hr in 30..220 && _state.value.heartRate != hr) _state.update { it.copy(heartRate = hr) }
                 }
                 // The realtime stream usually reports rr_count=0; only update R-R when this frame
@@ -7538,6 +7592,7 @@ class WhoopBleClient(
             // Skip the redundant it.copy() when HR is unchanged — StateFlow drops an equal state anyway, so
             // this only avoids the per-frame throwaway LiveState allocation (matches FrameRouter). The bonded
             // transition below stays UNCONDITIONAL: it must still fire once even while HR sits steady.
+            noteLiveHr()
             if (_state.value.heartRate != hr) _state.update { it.copy(heartRate = hr) }
             // EXPERIMENTAL WHOOP 5.0/MG: there is no confirmed-write bond for a 5/MG strap, so once
             // live HR actually streams over the standard profile we treat the link as established —
@@ -7632,6 +7687,12 @@ class WhoopBleClient(
     // MARK: Live-stream keep-alive  (port of BLEManager.startKeepAlive / keepAliveFire)
     // ====================================================================================
 
+    /** #1865: a live HR sample arrived — restart the stall clock and re-arm the one-shot recovery. */
+    private fun noteLiveHr() {
+        lastLiveHrAtMs = System.currentTimeMillis()
+        realtimeReArmedSinceHr = false
+    }
+
     /**
      * How long this family's live link may go silent before the app stops calling it healthy.
      *
@@ -7639,6 +7700,9 @@ class WhoopBleClient(
      * says "a reconnect would achieve nothing", and the only honest measure of that is the same one the
      * watchdog uses to decide a reconnect IS needed. Two numbers here could disagree, and the way they
      * would fail is a Connect button that declines to act on a link the watchdog has already given up on.
+     *
+     * Note it measures ANY inbound data, not live HR — which is why #1865 needed its own clock: a strap
+     * answering battery polls keeps this fuse from ever tripping while the HR stream is dead.
      */
     private fun liveLinkStallFuseMs(): Long =
         if (connectedFamily == DeviceFamily.WHOOP5) KEEPALIVE_STALL_5MG_EMPTY_MS else KEEPALIVE_STALL_MS
@@ -7648,6 +7712,10 @@ class WhoopBleClient(
         handler.removeCallbacks(keepAliveRunnable)
         keepAliveTick = 0
         lastDataAtMs = System.currentTimeMillis()   // arm the watchdog from "now", not 1970
+        // #1865: same reasoning for the HR clock — a fresh link has not missed anything yet, so the stall
+        // check must not fire on the first tick just because no sample has landed in the first 30 seconds.
+        lastLiveHrAtMs = System.currentTimeMillis()
+        realtimeReArmedSinceHr = false
         handler.postDelayed(keepAliveRunnable, KEEPALIVE_INTERVAL_MS)
     }
 
@@ -7738,14 +7806,44 @@ class WhoopBleClient(
                     if (wantsRealtime) { realtimeArmed = true; realtimeArmedThisLink = true; send(CommandNumber.TOGGLE_REALTIME_HR, byteArrayOf(1)) }
                     // #battery: ~60 s normally, ~30 s while charging (see [batteryPollDue]).
                     if (batteryPollDue(keepAliveTick, s.charging == true)) send(CommandNumber.GET_BATTERY_LEVEL)
-                } else if (connectedFamily == DeviceFamily.WHOOP5 &&
-                    batteryPollDue(keepAliveTick, s.charging == true)
-                ) {
+                } else if (connectedFamily == DeviceFamily.WHOOP5) {
+                    // #1865: re-arm a LAPSED realtime stream. The WHOOP4 branch above re-sends
+                    // TOGGLE_REALTIME_HR every tick precisely because "the firmware lets the realtime HR
+                    // stream lapse if it isn't re-armed" — a 5/MG got none of that, on the reasoning that it
+                    // "rejects WHOOP4-framed commands". That premise no longer holds for this command:
+                    // `reconcileRealtime` above sends the toggle to BOTH families because send() routes the
+                    // 5/MG one with puffin framing.
+                    //
+                    // Nothing else recovers it. reconcileRealtime is edge-triggered, so while we believe the
+                    // stream is armed it sends nothing; the one-shot re-subscribe fixes a dropped CCCD, not a
+                    // lapsed stream; and the stall bounce keys on [lastDataAtMs], which battery polls and
+                    // history offload keep fresh. Reported exactly that way: bonded, worn, "history synced
+                    // just now", and no bpm — every other signal healthy, which is what kept the one path
+                    // that could have helped from firing.
+                    //
+                    // Gated on an HR-SPECIFIC stall rather than sent every tick: a healthy 5/MG stream costs
+                    // nothing, and the 0x2A37 profile legitimately lulls at rest (why #1414 widened the bounce
+                    // fuse to 10 min), so the threshold sits well past a normal lull. One re-arm per stall
+                    // episode, cleared when a sample lands.
+                    val hrSilentMs = System.currentTimeMillis() - lastLiveHrAtMs
+                    if (shouldReArmLapsedRealtime(
+                            wantsRealtime = wantsRealtime,
+                            realtimeArmed = realtimeArmed,
+                            reArmedSinceHr = realtimeReArmedSinceHr,
+                            hrSilentMs = hrSilentMs,
+                        )
+                    ) {
+                        realtimeReArmedSinceHr = true
+                        log("No live HR for ${hrSilentMs / 1000}s while armed — re-arming the 5/MG realtime stream (#1865)")
+                        send(CommandNumber.TOGGLE_REALTIME_HR, byteArrayOf(1))
+                    }
+                    if (batteryPollDue(keepAliveTick, s.charging == true)) {
                     // 5/MG battery comes only from a 0x2A19 read and the strap sends no unsolicited battery
                     // notification, so poll it here (about every 60s) rather than only while the Live screen
                     // is open. The ring then stays current on any screen without a manual sync, and the read
                     // keeps the link warm.
-                    refreshBattery()
+                        refreshBattery()
+                    }
                 }
             }
         }
diff --git a/android/app/src/test/java/com/noop/ble/LapsedRealtimeReArmTest.kt b/android/app/src/test/java/com/noop/ble/LapsedRealtimeReArmTest.kt
new file mode 100644
index 0000000000..8b8bd93a31
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ble/LapsedRealtimeReArmTest.kt
@@ -0,0 +1,116 @@
+package com.noop.ble
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #1865: recovering a WHOOP 5/MG realtime stream that lapsed while the link stayed healthy.
+ *
+ * Reported as "Live doesn't work — initially it shows real data but now it doesn't", on a strap showing
+ * Bonded / FULL BOND, worn, battery fine, "history synced just now", and no bpm.
+ *
+ * That combination is the bug. A WHOOP 4.0 re-sends TOGGLE_REALTIME_HR on every 30 s keep-alive tick,
+ * documented as being because "the firmware lets the realtime HR stream lapse if it isn't re-armed". A
+ * 5/MG got none of it, and none of the other recovery paths can see this state:
+ *
+ *  - `reconcileRealtime` is edge-triggered, so while we believe the stream is armed it sends nothing;
+ *  - the one-shot re-subscribe recovers a dropped CCCD, not a stream the firmware let lapse;
+ *  - the stall bounce keys on ANY inbound data, and a strap answering battery polls and serving history
+ *    never trips it.
+ */
+class LapsedRealtimeReArmTest {
+
+    private val stall = 300_000L
+
+    /** The reported state: we think it is armed, someone wants it, and no sample has arrived in ages. */
+    @Test
+    fun aLongHrSilenceWhileArmedEarnsOneReArm() {
+        assertTrue(
+            WhoopBleClient.shouldReArmLapsedRealtime(
+                wantsRealtime = true, realtimeArmed = true, reArmedSinceHr = false,
+                hrSilentMs = stall + 1, stallMs = stall,
+            ),
+        )
+    }
+
+    /**
+     * A resting wearer's 0x2A37 stream legitimately lulls — that lull is why #1414 widened the bounce fuse
+     * to ten minutes. A normal quiet spell must not provoke a write.
+     */
+    @Test
+    fun anOrdinaryLullDoesNotReArm() {
+        assertFalse(
+            WhoopBleClient.shouldReArmLapsedRealtime(
+                wantsRealtime = true, realtimeArmed = true, reArmedSinceHr = false,
+                hrSilentMs = 60_000, stallMs = stall,
+            ),
+        )
+    }
+
+    /** One write per stall episode, not one per 30 s tick — the same discipline the re-subscribe uses. */
+    @Test
+    fun itOnlyReArmsOncePerEpisode() {
+        assertFalse(
+            WhoopBleClient.shouldReArmLapsedRealtime(
+                wantsRealtime = true, realtimeArmed = true, reArmedSinceHr = true,
+                hrSilentMs = stall * 10, stallMs = stall,
+            ),
+        )
+    }
+
+    /** Nobody wants the stream: arming it would cost battery for a screen that is closed. */
+    @Test
+    fun anUnwantedStreamIsNeverArmed() {
+        assertFalse(
+            WhoopBleClient.shouldReArmLapsedRealtime(
+                wantsRealtime = false, realtimeArmed = true, reArmedSinceHr = false,
+                hrSilentMs = stall * 10, stallMs = stall,
+            ),
+        )
+    }
+
+    /**
+     * If we do NOT believe it is armed, `reconcileRealtime` has a genuine false→true edge and sends the
+     * toggle itself. This path exists only for the state that reconciler cannot see, so it must stay out
+     * of the way rather than racing it with a second write.
+     */
+    @Test
+    fun anUnarmedStreamIsLeftToTheReconciler() {
+        assertFalse(
+            WhoopBleClient.shouldReArmLapsedRealtime(
+                wantsRealtime = true, realtimeArmed = false, reArmedSinceHr = false,
+                hrSilentMs = stall * 10, stallMs = stall,
+            ),
+        )
+    }
+
+    /** The threshold is exclusive, so exactly-at-the-boundary waits one more tick rather than firing early. */
+    @Test
+    fun theThresholdIsExclusive() {
+        assertFalse(
+            WhoopBleClient.shouldReArmLapsedRealtime(
+                wantsRealtime = true, realtimeArmed = true, reArmedSinceHr = false,
+                hrSilentMs = stall, stallMs = stall,
+            ),
+        )
+    }
+
+    /**
+     * The threshold is the only thing standing between "recovers a dead stream" and "writes to a healthy
+     * one every five minutes", so it is pinned rather than left to a constant nobody re-reads.
+     *
+     * It must sit ABOVE the 45 s quiet threshold (an ordinary gap between samples) and BELOW the 600 s
+     * bounce fuse — not because the fuse would rescue this case (it cannot; it watches any inbound data,
+     * which is the bug) but because a threshold beyond it would mean the app had given up on the link
+     * before it ever tried the cheaper fix.
+     */
+    @Test
+    fun theThresholdSitsBetweenTheQuietMarkAndTheBounceFuse() {
+        val quietMs = 45_000L
+        val bounceFuse5mgMs = 600_000L
+        assertTrue("must not fire during an ordinary quiet spell", stall > quietMs)
+        assertTrue("must act before the app would give up on the link", stall < bounceFuse5mgMs)
+    }
+
+}

From 559f7fd4240254a86f02face965188d01da08eef Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 13:52:32 +1200
Subject: [PATCH 216/333] build: staging 430 / iOS 311 for the next testing
 build

Carries the alarm and Live work: per-day wake times for the phone alarm with the
wind-down fan-out (#1859), and the 5/MG realtime re-arm for a stream that lapsed
while the link stayed healthy (#1866). Also the skin-temp backfill revert (#1857).
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index bf6c1b00ff..420f194405 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 429
+        versionCode = 430
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 351296c30b..c928e40995 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "310"
+    CURRENT_PROJECT_VERSION: "311"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 17a28f0e9ca7734e952a2f73421949e0cf832214 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 14:30:47 +1200
Subject: [PATCH 217/333] ble: stop skipping the handshake once the unbonded
 probe has retired (#1868)

A field strap log showed a WHOOP 5/MG that could neither bond nor sync, indefinitely: the hello skipped on every connect, no probe lines at all, didBond=false nine times and "Backfill: deferred" nine times across sixteen hours.

The two gates were asymmetric. The probe retires itself correctly - on a latched refusal, or once UNBONDED_PROBE_MAX_SILENT_LINKS is spent - which is exactly what its own doc promises, since "the point of a probe is to stop being one after it has its answer". But the handshake skip that exists TO SERVE it checked neither condition:

    supersedes = optedIn && isWhoop5 && !appLevelBonded && !userInitiated

So once the probe stopped asking, the opt-in silently became a permanent "never write CLIENT_HELLO" switch. With no hello, didBond can never become true, so the ordinary offload gate can never open either - the log's own defer line spells it out: "No hello was written on this link, so didBond cannot become true and this gate cannot open for the rest of it." Suppressing a handshake is only defensible while something is using the link it creates, and nothing was.

unbondedProbeRetired(previouslyRefused, silentLinksSoFar) is now the single place that answers "has the probe stopped asking", read by BOTH the probe and the skip so they cannot drift. The latched refusal likewise moves behind one helper rather than being inlined at one call site and re-derived at the other.

Reasoning that the two gates agreed is what produced the bug, so the test does not reason: it walks the entire refused x silentLinks space and asserts the probe's decision and the skip's decision match at every point.

What happens to an affected strap, since "it starts writing helloes again" deserves an answer: it resumes the ordinary handshake, a #1635 strap refuses it, and BondRefusalGiveUp latches helloSuppressed after its 5-refusal threshold - settling at the designed "Live HR, not fully paired" end state. Bounded, and strictly better than the state it replaces, which had no bond, no offload AND no probe.

Deliberately unchanged: pressing Connect still wins, a bonded strap still skips nothing, and the skip still applies normally while the probe has budget.

Full suite 5153/0; UnbondedOffloadProbeTest at 37 cases. Doc-comment and i18n gates clean. Blast radius checked - one production caller. Android only: Apple has no unbonded-offload probe at all, so there is no twin to fix.

NOT hardware-validated - BLE cannot be CI-tested. The behavioural effect is that a retired-probe strap resumes the pre-experiment handshake path, so the failure mode if the diagnosis is wrong is the status quo rather than something new.
---
 .../java/com/noop/ble/UnbondedOffloadProbe.kt | 33 +++++++++-
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 24 +++++--
 .../com/noop/ble/UnbondedOffloadProbeTest.kt  | 66 +++++++++++++++++--
 3 files changed, 109 insertions(+), 14 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
index 7950557fb3..2625748515 100644
--- a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
+++ b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
@@ -62,10 +62,31 @@ internal fun shouldProbeUnbondedOffload(
     // eleven weeks. Only the stable no-hello link can answer this question.
     if (helloWrittenThisLink) return false
     if (alreadyProbedThisLink) return false
-    if (previouslyRefused) return false
-    return unbondedProbeStillWorthAsking(silentLinksSoFar)
+    return !unbondedProbeRetired(previouslyRefused, silentLinksSoFar)
 }
 
+/**
+ * Has the probe stopped asking — for good, on this device?
+ *
+ * True on a latched refusal (the strap's verdict) or once the silent-link budget is spent. Extracted
+ * because TWO decisions depend on it and they were only wired to one: the probe retires itself correctly,
+ * while the handshake skip that exists TO SERVE it kept applying forever.
+ *
+ * What happens to a stranded strap once this is fixed, since "it starts writing helloes again" deserves an
+ * answer rather than a shrug: it resumes the ordinary handshake, a #1635 strap refuses it, and
+ * [BondRefusalGiveUp] latches `helloSuppressed` after its 5-refusal threshold — settling at the designed
+ * "Live HR, not fully paired" end state. Bounded, and strictly better than the state it replaces, which
+ * had no bond, no offload AND no probe.
+ *
+ * That asymmetry strands the strap. With the hello skipped `didBond` can never become true, so the
+ * ordinary offload gate can never open — and once the probe has retired there is nothing left the skip is
+ * buying. A field log shows the end state plainly: the hello skipped on every connect, no probe lines at
+ * all, `didBond=false` and `Backfill: deferred` nine times across sixteen hours. The strap could neither
+ * bond nor sync, in service of a question that had already stopped being asked.
+ */
+internal fun unbondedProbeRetired(previouslyRefused: Boolean, silentLinksSoFar: Int): Boolean =
+    previouslyRefused || !unbondedProbeStillWorthAsking(silentLinksSoFar)
+
 /**
  * How many links may end in SILENCE before the probe retires itself.
  *
@@ -142,7 +163,13 @@ internal fun unbondedProbeSupersedesHandshake(
     isWhoop5: Boolean,
     appLevelBonded: Boolean,
     userInitiated: Boolean,
-): Boolean = optedIn && isWhoop5 && !appLevelBonded && !userInitiated
+    /**
+     * The probe has stopped asking ([unbondedProbeRetired]) — so skipping the hello now buys nothing and
+     * costs the strap its bond and its offload. Suppressing the handshake is only defensible while
+     * something is using the link it creates.
+     */
+    probeRetired: Boolean,
+): Boolean = optedIn && isWhoop5 && !appLevelBonded && !userInitiated && !probeRetired
 
 /**
  * Said once per superseded connect, because a hello that is absent looks identical to one that failed
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 8b6642f28d..1e004d85cc 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -4912,13 +4912,17 @@ class WhoopBleClient(
      * here.
      */
     @SuppressLint("MissingPermission")
+    /** #1867: the latched per-device refusal, read the same way by the probe and by the handshake skip
+     *  that serves it — two readers of one fact, so neither can drift from the other. */
+    private fun unbondedOffloadPreviouslyRefused(address: String?): Boolean = runCatching {
+        unbondedOffloadRefusedPrefKey(address)?.let {
+            context.getSharedPreferences(com.noop.ui.NoopPrefs.NAME, android.content.Context.MODE_PRIVATE)
+                .getBoolean(it, false)
+        } ?: false
+    }.getOrDefault(false)
+
     private fun beginUnbondedOffloadProbe(g: BluetoothGatt) {
-        val refused = runCatching {
-            unbondedOffloadRefusedPrefKey(g.device.address)?.let {
-                context.getSharedPreferences(com.noop.ui.NoopPrefs.NAME, android.content.Context.MODE_PRIVATE)
-                    .getBoolean(it, false)
-            } ?: false
-        }.getOrDefault(false)
+        val refused = unbondedOffloadPreviouslyRefused(g.device.address)
         if (!shouldProbeUnbondedOffload(
                 isWhoop5 = connectedFamily == DeviceFamily.WHOOP5,
                 optedIn = PuffinExperiment.from(context).unbondedOffload,
@@ -8633,6 +8637,14 @@ class WhoopBleClient(
                         isWhoop5 = true,
                         appLevelBonded = didBond,
                         userInitiated = helloRetryRequested,
+                        // Same retirement the probe applies to itself — read here rather than assumed, so
+                        // the skip stops the moment the thing it serves does. The two inputs address the
+                        // same strap: `lastDevice` is set at connect, long before this runs post-discovery,
+                        // and `beginUnbondedOffloadProbe` already pairs these two sources the same way.
+                        probeRetired = unbondedProbeRetired(
+                            previouslyRefused = unbondedOffloadPreviouslyRefused(g.device.address),
+                            silentLinksSoFar = unbondedProbeSilentLinks,
+                        ),
                     )
                 ) {
                     log(unbondedProbeSupersedesLine(explicitBondOptedIn = puffinExperiment.explicitBond))
diff --git a/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt b/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
index 092a23971f..a89984568b 100644
--- a/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
+++ b/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
@@ -352,11 +352,11 @@ class UnbondedOffloadProbeTest {
     @Test
     fun `opting in replaces the handshake for that connect`() {
         assertTrue(unbondedProbeSupersedesHandshake(
-            optedIn = true, isWhoop5 = true, appLevelBonded = false, userInitiated = false))
+            optedIn = true, isWhoop5 = true, appLevelBonded = false, userInitiated = false, probeRetired = false))
         assertFalse(unbondedProbeSupersedesHandshake(
-            optedIn = false, isWhoop5 = true, appLevelBonded = false, userInitiated = false))
+            optedIn = false, isWhoop5 = true, appLevelBonded = false, userInitiated = false, probeRetired = false))
         assertFalse(unbondedProbeSupersedesHandshake(
-            optedIn = true, isWhoop5 = false, appLevelBonded = false, userInitiated = false))
+            optedIn = true, isWhoop5 = false, appLevelBonded = false, userInitiated = false, probeRetired = false))
     }
 
     /**
@@ -366,13 +366,13 @@ class UnbondedOffloadProbeTest {
     @Test
     fun `pressing Connect still gets the handshake`() {
         assertFalse(unbondedProbeSupersedesHandshake(
-            optedIn = true, isWhoop5 = true, appLevelBonded = false, userInitiated = true))
+            optedIn = true, isWhoop5 = true, appLevelBonded = false, userInitiated = true, probeRetired = false))
     }
 
     @Test
     fun `a strap that already bonded has nothing to prove`() {
         assertFalse(unbondedProbeSupersedesHandshake(
-            optedIn = true, isWhoop5 = true, appLevelBonded = true, userInitiated = false))
+            optedIn = true, isWhoop5 = true, appLevelBonded = true, userInitiated = false, probeRetired = false))
     }
 
     /**
@@ -470,4 +470,60 @@ class UnbondedOffloadProbeTest {
         // actually issued a read rather than being assumed to have.
         assertFalse(unbondedProbeShouldWaitForDis(disChainInFlight = false, deferralsSoFar = 0))
     }
+
+    // MARK: #1867 — the skip must retire when the probe does
+
+    /**
+     * Found in a field log: the hello skipped on every connect, NO probe lines at all, `didBond=false` and
+     * `Backfill: deferred` nine times across sixteen hours.
+     *
+     * The probe retires itself correctly — on a latched refusal, or once the silent-link budget is spent —
+     * but the handshake skip that exists to serve it kept applying regardless. With no hello, `didBond` can
+     * never become true, so the ordinary offload gate can never open either. The strap could neither bond
+     * nor sync, in service of a question that had already stopped being asked.
+     */
+    @Test
+    fun `a retired probe stops superseding the handshake`() {
+        assertFalse(unbondedProbeSupersedesHandshake(
+            optedIn = true, isWhoop5 = true, appLevelBonded = false, userInitiated = false,
+            probeRetired = true))
+    }
+
+    /** A latched refusal is the strap's verdict — it retires the probe, so the handshake must resume. */
+    @Test
+    fun `a latched refusal retires the probe`() {
+        assertTrue(unbondedProbeRetired(previouslyRefused = true, silentLinksSoFar = 0))
+    }
+
+    /** Silence spends a budget rather than latching, so the probe stays live while it has one. */
+    @Test
+    fun `silence retires the probe only once its budget is spent`() {
+        assertFalse(unbondedProbeRetired(previouslyRefused = false, silentLinksSoFar = 0))
+        assertFalse(unbondedProbeRetired(
+            previouslyRefused = false, silentLinksSoFar = UNBONDED_PROBE_MAX_SILENT_LINKS - 1))
+        assertTrue(unbondedProbeRetired(
+            previouslyRefused = false, silentLinksSoFar = UNBONDED_PROBE_MAX_SILENT_LINKS))
+    }
+
+    /**
+     * The two gates must agree by construction, not by both being edited together. Whenever the probe
+     * declines for a RETIREMENT reason, the skip must decline too — otherwise the strap is stranded with a
+     * suppressed handshake and nothing using the link it creates.
+     */
+    @Test
+    fun `the skip and the probe retire on exactly the same conditions`() {
+        for (refused in listOf(false, true)) {
+            for (silent in 0..UNBONDED_PROBE_MAX_SILENT_LINKS + 1) {
+                val retired = unbondedProbeRetired(refused, silent)
+                val probeWouldRun = shouldProbeUnbondedOffload(
+                    isWhoop5 = true, optedIn = true, bonded = false, helloWrittenThisLink = false,
+                    alreadyProbedThisLink = false, previouslyRefused = refused, silentLinksSoFar = silent)
+                val skips = unbondedProbeSupersedesHandshake(
+                    optedIn = true, isWhoop5 = true, appLevelBonded = false, userInitiated = false,
+                    probeRetired = retired)
+                assertEquals("refused=$refused silent=$silent", probeWouldRun, skips)
+            }
+        }
+    }
+
 }

From ba6eba9428bb9bb4551d0fd1d14dd519e64e40ac Mon Sep 17 00:00:00 2001
From: Kevin Rajan <7121943+kvnloo@users.noreply.github.com>
Date: Thu, 3 Sep 2026 21:32:02 -0500
Subject: [PATCH 218/333] =?UTF-8?q?fix(l10n):=20restore=20pt-PT=20Restaura?=
 =?UTF-8?q?r=20corrupted=20by=20a=20Rest=E2=86=92Descanso=20find/replace?=
 =?UTF-8?q?=20(#1861)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Thanks to @kvnloo.

Four pt-PT entries had "Restaurar" / "Restauração" mangled into "Descansoaurar" / "Descansoauração" — the leading "Rest" replaced by "Descanso", the Portuguese for the Rest metric, by a find/replace that ran over the whole file and hit every word merely STARTING with "Rest". Reported in #1811.

Restores the four named keys only. No key renames, no other locale, no re-run of the replacement.

Verified complete rather than taken on trust, since a find/replace hits every word containing the token: scanning pt-PT for "Descanso" followed by a lowercase continuation finds exactly these four and nothing else ("descansos" is a legitimate plural), and es/fr/pl/zh carry no analogous damage. The German hits are all real compounds (Ruheherzfrequenz, Ruhepuls, Erholungswerte), not corruption. XML still parses at 2594 strings.

Worth recording, because it explains how this survived: the i18n gate cannot see this class. The strings are present, non-empty, and differ from the English source, so "Descansoaurar" passes every check the audit makes — it verifies that a translation EXISTS, not that it is a word.
---
 android/app/src/main/res/values-pt-rPT/strings.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index ef8de37131..13163dcfa0 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -265,8 +265,8 @@
     <string name="l10n_backup_sync_screen_replace_all_current_data_e9244799">Substituir todos os dados atuais?</string>
     <string name="l10n_backup_sync_screen_replace_all_current_data_with_label_b7799a16">Substitua todos os dados atuais por %1$s? Isto não pode ser desfeito.</string>
     <string name="l10n_backup_sync_screen_replace_this_device_s_data_with_b8679c51">Substitua os dados deste dispositivo por um dos teus cópia de seguranças. Este substitui os dados atuais, </string>
-    <string name="l10n_backup_sync_screen_restore_3cbe6d6b">Descansoaurar</string>
-    <string name="l10n_backup_sync_screen_restore_from_a_backup_c28917c6">Descansoaurar a partir de um cópia de segurança…</string>
+    <string name="l10n_backup_sync_screen_restore_3cbe6d6b">Restaurar</string>
+    <string name="l10n_backup_sync_screen_restore_from_a_backup_c28917c6">Restaurar a partir de um cópia de segurança…</string>
     <string name="l10n_backup_sync_screen_roughly_when_the_daily_backup_runs_71de04e1">Aproximadamente quando o cópia de segurança diário é executado (melhor esforço - o sistema pode deslizar um pouco).</string>
     <string name="l10n_backup_sync_screen_these_backups_are_unencrypted_too_if_53e70fe8">Estas cópias de segurança também não estão encriptadas. Se esta pasta sincronizar com o Drive, o Dropbox ou o iCloud, o ficheiro legível também vai parar lá — aponta apenas para um serviço de confiança.</string>
     <string name="l10n_backup_sync_screen_tip_a_desktop_drive_dropbox_app_2eaff1e3">Dica: uma aplicação Drive/Dropbox para desktop sincroniza automaticamente uma pasta escolhida. No telefone, guarde num </string>
@@ -979,7 +979,7 @@
     <string name="l10n_updates_inbox_screen_mark_read_3bf98fa6">Marcar como lido</string>
     <string name="l10n_updates_inbox_screen_new_6403f2b7">Novo</string>
     <string name="l10n_updates_inbox_screen_new_release_notes_and_fresh_data_1632c576">Novas notas de lançamento e novos dados chegarão aqui.</string>
-    <string name="l10n_updates_inbox_screen_restore_to_today_77c7c8e5">Descansoaurar para hoje</string>
+    <string name="l10n_updates_inbox_screen_restore_to_today_77c7c8e5">Restaurar para hoje</string>
     <string name="l10n_updates_inbox_screen_updates_c76d1807">Atualizações</string>
     <string name="l10n_updates_inbox_screen_you_re_all_caught_up_3d39c469">Está todo atualizado.</string>
     <string name="l10n_weekly_digest_card_no_readings_this_week_yet_0745a2df">Ainda não há leitura esta semana</string>
@@ -1099,7 +1099,7 @@
     <string name="l10n_app_changelog_auto_sync_health_connect_android_698f0129">Sincronização automática do Health Connect (Android)</string>
     <string name="l10n_app_changelog_background_gps_sleep_time_editing_log_7baa5d7a">GPS em segundo plano, edição durante o sono, registo antecipado e um bloco de descanso mais nítido</string>
     <string name="l10n_app_changelog_backup_controls_and_a_lighter_app_a08f0fe4">Controlos de cópia de segurança e uma aplicação mais leve</string>
-    <string name="l10n_app_changelog_backup_restore_fixed_plus_appearance_controls_d0b9c0fe">Descansoauração de cópia de segurança corrigida, além de controlos de aparência</string>
+    <string name="l10n_app_changelog_backup_restore_fixed_plus_appearance_controls_d0b9c0fe">Restauração de cópia de segurança corrigida, além de controlos de aparência</string>
     <string name="l10n_app_changelog_backup_restore_the_wrong_day_fix_ecbfd90d">Cópia de segurança e restauro, a solução para o dia errado e um centro de testes mais inteligente</string>
     <string name="l10n_app_changelog_battery_refresh_on_whoop_5_0_0304ac74">Atualização da bateria no WHOOP 5.0/MG (Mac + Android)</string>
     <string name="l10n_app_changelog_battery_responsiveness_smarter_sync_lighter_notification_e6949f3c">Bateria + capacidade de resposta: sincronização mais inteligente, notificação mais leve</string>

From e3822b724c14cd72d16e8a83f82f0b6fd7e78543 Mon Sep 17 00:00:00 2001
From: Pipiche <8291674+pipiche38@users.noreply.github.com>
Date: Fri, 4 Sep 2026 04:44:10 +0200
Subject: [PATCH 219/333] fix(oura): break the resume-cursor <-> time-anchor
 deadlock that re-serves the same history forever (#1846)

Thanks to @pipiche38.

Two gates in the Oura 0x13 SyncTime path could leave a ring permanently unable to advance its persisted GetEvents cursor: commitResumeCursor only banks a cursor that resolves under the current anchor, and the anchor could only be disambiguated against the cursor itself. No anchor -> no cursor advance -> staler cursor -> still no anchor. Diagnosed from two iOS captures 11 h apart in which every launch re-drains from the identical cursor and the anchor line never appears once.

Two changes, both load-bearing. The unit-disambiguation window widens from 7 to 45 days, so a bound trailing the ring's clock by the whole banked depth is still recognised. And a reply that nothing can yet disambiguate is parked rather than discarded, then retried against OuraHistoryDrain.maxSeenRingTime as the first batch lands - that counter tracks every history record's envelope time and needs no anchor to read, so it is a reference the cursor cannot be. The original receipt wall-clock is carried to the retry rather than re-stamped, so the anchor is not skewed by the drain's latency. Ambiguity and "no reference at all" still adopt nothing.

Verified rather than taken on trust. The parity claim was reproduced independently: the shipped Swift twin compiled standalone and its 24-row stdout diffed against the committed Kotlin table - identical - and every row recomputed from the spec separately. The two implementations match line for line including the UInt32 ceiling and the 64-bit intermediates, the retry fires at the same point on both platforms (after maxSeenRingTime updates, before events are emitted), and the parked reply is cleared on the same three disconnect paths each side. Kotlin FramingTest runs 23 tests, 0 failures locally on this head, with all four anchor tests genuinely matched by the filter.

One correction to the record, which the doc comments in both drivers currently get wrong. Widening the window also widens the band in which both readings fit, since that happens exactly when window >= 9 x lowerBound: a ring whose clock is under 5.00 days now resolves to nothing, where the old window's dead zone stopped at 0.78 days. The claim that such a case "still resolves to nil, exactly as before" does not hold - the oracle's own (4_320_000, 4_320_000) row returned a value under the old window and returns null now. This is not hypothetical: the pre-existing capture vector in the shipped test clears the new ceiling by 13 hours of ring clock, ring clocks do reset (sawPreResumeData exists for that), and the anchor is session state re-derived on every connect. The trade is still clearly worth taking - it fails to nothing rather than to a wrong anchor, and swaps a permanent deadlock for one that heals itself in under five days - but it is a trade, not a free widening.

Still needs a real ring to confirm the anchor is adopted and the cursor moves across consecutive launches; a BLE path cannot be proven by a compiler.
---
 .../Sources/OuraProtocol/OuraDriver.swift     | 31 +++++--
 .../OuraProtocolTests/FramingTests.swift      | 56 +++++++++---
 Strand/BLE/OuraLiveSource.swift               | 76 ++++++++++++----
 .../main/java/com/noop/ble/OuraLiveSource.kt  | 91 +++++++++++++++----
 .../src/main/java/com/noop/oura/OuraDriver.kt | 36 ++++++--
 .../test/java/com/noop/oura/FramingTest.kt    | 89 +++++++++++++++---
 6 files changed, 305 insertions(+), 74 deletions(-)

diff --git a/Packages/OuraProtocol/Sources/OuraProtocol/OuraDriver.swift b/Packages/OuraProtocol/Sources/OuraProtocol/OuraDriver.swift
index dd1b13a018..10e6258e7d 100644
--- a/Packages/OuraProtocol/Sources/OuraProtocol/OuraDriver.swift
+++ b/Packages/OuraProtocol/Sources/OuraProtocol/OuraDriver.swift
@@ -246,17 +246,34 @@ public final class OuraDriver {
         return Int(seconds)
     }
 
+    /// How far the ring's clock may run AHEAD of `lowerBoundTicks` and still be recognised. The bound is a
+    /// stale resume cursor or the oldest ring-time a drain has seen, either of which can trail the ring's
+    /// clock by the ring's whole banked depth (~14 days) plus however long the cursor has been stuck — the
+    /// original 7-day window silently excluded exactly that case: in the 2026-09-02/03 iOS captures an
+    /// 8.2-day-stale cursor could never be re-anchored, so it could never advance, so the staleness only
+    /// grew — one full re-serve of the same window per launch, forever. Widening costs no
+    /// honesty: both readings fit the window only when `window >= 9 × lowerBound`, i.e. a ring under ~5
+    /// days of clock — and that case still resolves to nil below, exactly as before.
+    public static let syncTimeAnchorWindowTicks: Int64 = 38_880_000   // 45 days of 100 ms ticks
+
     /// Resolve the 0x13 SyncTime-response device timestamp into ring TICKS, or nil when no unambiguous
     /// reading exists. ringverse BLE.md labels the field "seconds" but the ring's record clock runs in
     /// 100 ms ticks, so both readings are tried: the raw value (already ticks) and value×10 (seconds→
-    /// ticks). The ring's clock at connect must sit shortly AFTER where the last drain ended, so a
-    /// candidate is plausible iff it falls in `[historyCursor, historyCursor + 7 days]`; exactly one
-    /// must fit (ambiguity or a fresh/reset cursor → nil → the caller logs raw instead of guessing).
+    /// ticks). The ring's clock at connect must sit AFTER any ring-time we already know about, so a
+    /// candidate is plausible iff it falls in `[lowerBoundTicks, lowerBoundTicks +
+    /// syncTimeAnchorWindowTicks]`; exactly one must fit (ambiguity or no reference at all → nil → the
+    /// caller logs raw instead of guessing).
+    ///
+    /// `lowerBoundTicks` is any ring-time known to precede the ring's clock NOW: the persisted resume
+    /// cursor at connect, or — when that is 0 (fresh pair / post-reboot reset) or too stale — the largest
+    /// envelope ring-time the drain has actually seen (`OuraHistoryDrain.maxSeenRingTime`), which needs no
+    /// anchor to read and so breaks the cursor↔anchor deadlock (2026-09-02/03 captures).
+    ///
     /// Pure and testable; the honest-data invariant is "no anchor beats a wrong anchor".
-    public static func syncTimeAnchorCandidate(responseValue: UInt32, historyCursor: UInt32) -> UInt32? {
-        guard historyCursor > 0 else { return nil }
-        let lower = Int64(historyCursor)
-        let upper = lower + 6_048_000   // 7 days of 100 ms ticks
+    public static func syncTimeAnchorCandidate(responseValue: UInt32, lowerBoundTicks: UInt32) -> UInt32? {
+        guard lowerBoundTicks > 0 else { return nil }
+        let lower = Int64(lowerBoundTicks)
+        let upper = lower + syncTimeAnchorWindowTicks
         let readings = [Int64(responseValue), Int64(responseValue) * 10]
         let fits = readings.filter { $0 >= lower && $0 <= upper && $0 <= Int64(UInt32.max) }
         guard fits.count == 1 else { return nil }
diff --git a/Packages/OuraProtocol/Tests/OuraProtocolTests/FramingTests.swift b/Packages/OuraProtocol/Tests/OuraProtocolTests/FramingTests.swift
index d6858928e8..7187c5772f 100644
--- a/Packages/OuraProtocol/Tests/OuraProtocolTests/FramingTests.swift
+++ b/Packages/OuraProtocol/Tests/OuraProtocolTests/FramingTests.swift
@@ -219,22 +219,54 @@ final class FramingTests: XCTestCase {
     // MARK: - 0x13 -> anchor tick disambiguation (OuraDriver.syncTimeAnchorCandidate)
 
     func testSyncTimeAnchorCandidateResolvesUnit() {
-        // The 2026-07-13 shape: cursor banked at 4_413_933 (last night's log end); ~11 h later the
-        // ring's clock is ~4.81M ticks. A raw-ticks response fits the [cursor, cursor+7d] window and
+        // The 2026-07-13 shape: floor banked at 4_413_933 (last night's log end); ~11 h later the
+        // ring's clock is ~4.81M ticks. A raw-ticks response fits the [floor, floor+45d] window and
         // the seconds x10 reading does not -> unambiguous ticks.
-        XCTAssertEqual(OuraDriver.syncTimeAnchorCandidate(responseValue: 4_810_000, historyCursor: 4_413_933),
+        XCTAssertEqual(OuraDriver.syncTimeAnchorCandidate(responseValue: 4_810_000, lowerBoundTicks: 4_413_933),
                        4_810_000)
         // A seconds-unit response (481_000 s = 4.81M ticks) only fits when multiplied x10.
-        XCTAssertEqual(OuraDriver.syncTimeAnchorCandidate(responseValue: 481_000, historyCursor: 4_413_933),
+        XCTAssertEqual(OuraDriver.syncTimeAnchorCandidate(responseValue: 481_000, lowerBoundTicks: 4_413_933),
                        4_810_000)
-        // Below the cursor in both readings (ring reboot / stale value) -> nil.
-        XCTAssertNil(OuraDriver.syncTimeAnchorCandidate(responseValue: 100_000, historyCursor: 4_413_933))
-        // Beyond cursor+7d in both readings -> nil.
-        XCTAssertNil(OuraDriver.syncTimeAnchorCandidate(responseValue: 40_000_000, historyCursor: 4_413_933))
-        // A fresh/reset cursor gives no reference -> nil (never guess on a full pull).
-        XCTAssertNil(OuraDriver.syncTimeAnchorCandidate(responseValue: 4_810_000, historyCursor: 0))
-        // Ambiguity guard: BOTH readings inside the window -> nil.
-        XCTAssertNil(OuraDriver.syncTimeAnchorCandidate(responseValue: 150_000, historyCursor: 140_000))
+        // Below the floor in both readings (ring reboot / stale value) -> nil.
+        XCTAssertNil(OuraDriver.syncTimeAnchorCandidate(responseValue: 100_000, lowerBoundTicks: 4_413_933))
+        // Beyond floor+45d in both readings -> nil.
+        XCTAssertNil(OuraDriver.syncTimeAnchorCandidate(responseValue: 50_000_000, lowerBoundTicks: 4_413_933))
+        // No reference at all -> nil (never guess).
+        XCTAssertNil(OuraDriver.syncTimeAnchorCandidate(responseValue: 4_810_000, lowerBoundTicks: 0))
+        // Ambiguity guard: BOTH readings inside the window -> nil. Reachable only while the floor is
+        // under window/9 (~5 days of ring clock), i.e. a barely-run ring.
+        XCTAssertNil(OuraDriver.syncTimeAnchorCandidate(responseValue: 150_000, lowerBoundTicks: 140_000))
+    }
+
+    /// Regression from the 2026-09-02/03 iOS captures. The ring's 0x13 reply reads 0x0218767f =
+    /// 35_157_631 ticks while the persisted resume cursor sits at 28_073_725 — 8.20 days behind. Under the
+    /// old 7-day window neither reading fit, so no anchor was adopted; with no anchor the drain-end commit
+    /// could not advance the cursor (`resumeCursorAtDrainEnd(resolvesUnderAnchor: false)` returns it
+    /// unchanged), so the cursor stayed stale and the gap only grew — a permanent loop, one full re-serve
+    /// of the same window per launch. The widened window resolves it, unambiguously.
+    func testSyncTimeAnchorCandidateAcceptsAStaleCursorFromTheCaptures() {
+        let staleCursor: UInt32 = 28_073_725          // banked 2026-08-26 02:49:56 by the 300 s guard
+        for reply: UInt32 in [0x0218767f, 0x02187ce8, 0x02189fce] {   // the three 09-03 launches
+            XCTAssertEqual(OuraDriver.syncTimeAnchorCandidate(responseValue: reply,
+                                                              lowerBoundTicks: staleCursor),
+                           reply, "0x\(String(reply, radix: 16)) must resolve as raw ticks")
+        }
+        // The old 7-day window is what excluded it: 28_073_725 + 6_048_000 = 34_121_725 < 35_157_631.
+        XCTAssertGreaterThan(OuraDriver.syncTimeAnchorWindowTicks, 35_157_631 - Int64(staleCursor),
+                             "the window must cover the observed 8.2-day staleness")
+    }
+
+    /// The other half of the deadlock: on a fresh pair / post-reboot reset the cursor is 0, so it
+    /// can never be the reference. The drain's `maxSeenRingTime` can — it counts EVERY history record's
+    /// envelope time and needs no anchor to read — so the caller retries the parked reply against it.
+    func testSyncTimeAnchorCandidateResolvesAgainstSeenRingTimeWhenCursorIsZero() {
+        let reply: UInt32 = 0x0211dbd0                // 34_724_816 — the 2026-09-02 capture, cursor 0
+        XCTAssertNil(OuraDriver.syncTimeAnchorCandidate(responseValue: reply, lowerBoundTicks: 0))
+        // First batch of a full pull lands the ring's OLDEST banked record (~14 days back).
+        let oldestBanked: UInt32 = 34_724_816 - 12_096_000
+        XCTAssertEqual(OuraDriver.syncTimeAnchorCandidate(responseValue: reply,
+                                                          lowerBoundTicks: oldestBanked),
+                       reply)
     }
 
     func testAdoptSyncTimeAnchorResolvesHistoryTimes() {
diff --git a/Strand/BLE/OuraLiveSource.swift b/Strand/BLE/OuraLiveSource.swift
index edefa5dd2d..b0fd228409 100644
--- a/Strand/BLE/OuraLiveSource.swift
+++ b/Strand/BLE/OuraLiveSource.swift
@@ -245,6 +245,13 @@ public final class OuraLiveSource: NSObject, ObservableObject {
     private var loggedFirstTemp = false
     /// Logs the FIRST SpO2 sample decoded this session only. Twin of `loggedFirstTemp`.
     private var loggedFirstSpo2 = false
+    /// The 0x13 SyncTime reply parked because nothing yet available could disambiguate its unit (ticks vs
+    /// seconds x10): the resume cursor was 0 (fresh pair / post-reboot full pull) or so stale the ring's
+    /// clock had run past the window. Retried against the drain's `maxSeenRingTime` as the first batch
+    /// lands (2026-09-02/03 captures). The ORIGINAL receipt wall-clock is carried along, because THAT is the instant the
+    /// ring's counter pairs with - re-stamping at retry time would skew the anchor by the drain's latency.
+    private var pendingSyncTime: (deviceTimestamp: UInt32, status: UInt8, receivedAt: Int64)?
+
     /// Logs the FIRST ring-time -> UTC anchor of this session only (s5.5); reset on stop/disconnect.
     private var loggedAnchor = false
     /// Tier-B (UNVERIFIED) kinds ("activity" / "real_steps" / "sleep_summary" / "spo2_smoothed") already
@@ -1328,6 +1335,7 @@ public final class OuraLiveSource: NSObject, ObservableObject {
         loggedFirstTemp = false
         loggedFirstSpo2 = false
         loggedAnchor = false
+        pendingSyncTime = nil
         loggedTierBKinds.removeAll()
         loggedFeatureStatuses.removeAll()
         loggedProductInfo.removeAll()
@@ -1565,6 +1573,10 @@ public final class OuraLiveSource: NSObject, ObservableObject {
                 drain.noteSeenRingTime(rt)
             }
         }
+        // The drain now has a ring-time reference that needs no anchor, so a 0x13 reply parked at connect
+        // may be resolvable. Retry BEFORE `ingest`, so this batch anchors straight away instead of parking
+        // into `pendingAnchorEvents` and being drained a moment later (2026-09-02/03 captures).
+        retryPendingSyncTimeAnchor()
         if pendingContinuation { restartBatchQuietTimer() }
         ingest(events)
     }
@@ -2277,6 +2289,7 @@ extension OuraLiveSource: @preconcurrency CBCentralManagerDelegate {
         loggedFirstTemp = false
         loggedFirstSpo2 = false
         loggedAnchor = false
+        pendingSyncTime = nil
         loggedTierBKinds.removeAll()
         loggedFeatureStatuses.removeAll()
         loggedProductInfo.removeAll()
@@ -2362,6 +2375,7 @@ extension OuraLiveSource: @preconcurrency CBCentralManagerDelegate {
         loggedFirstTemp = false
         loggedFirstSpo2 = false
         loggedAnchor = false
+        pendingSyncTime = nil
         loggedTierBKinds.removeAll()
         loggedFeatureStatuses.removeAll()
         loggedProductInfo.removeAll()
@@ -2547,28 +2561,56 @@ extension OuraLiveSource: @preconcurrency CBPeripheralDelegate {
         ingestHistory(driver.ingest(notification: bytes, reassembler: reassembler))
     }
 
+    /// The ring-time floor the 0x13 unit test disambiguates against: the persisted resume cursor, or the
+    /// largest envelope ring-time this drain has seen when that is further along. `maxSeenRingTime` is the
+    /// half that breaks the deadlock (2026-09-02/03 captures) — it counts EVERY history record, anchored or not, so it is
+    /// readable with no anchor, whereas the cursor can only advance once an anchor exists.
+    private var syncTimeAnchorLowerBound: UInt32 {
+        max(historyCursor, drain.maxSeenRingTime)
+    }
+
+    /// Try to turn a 0x13 SyncTime reply into this session's UTC anchor, returning whether it stuck.
+    /// `receivedAt` is the host wall-clock at the moment the reply ARRIVED (not now), since that is the
+    /// instant the ring's counter pairs with. Shared by the at-connect attempt and the retry.
+    private func adoptSyncTimeAnchor(deviceTimestamp: UInt32, status: UInt8, receivedAt: Int64, source: String) -> Bool {
+        guard let driver else { return false }
+        guard let rt = OuraDriver.syncTimeAnchorCandidate(responseValue: deviceTimestamp,
+                                                          lowerBoundTicks: syncTimeAnchorLowerBound),
+              driver.adoptSyncTimeAnchor(ringTimestamp: rt, unixSeconds: receivedAt) else { return false }
+        let unit = rt == deviceTimestamp ? "ticks" : "seconds x10"
+        let raw = String(format: "0x%08x", deviceTimestamp)
+        if !loggedAnchor {
+            loggedAnchor = true
+            log("Oura: UTC anchor from SyncTime response (0x13) \(source) - device rt \(rt) [\(unit), raw \(raw), status \(status)] = its receipt time; no 0x42 needed this session")
+        }
+        drainPendingAnchorEvents()
+        drainPendingHypnogramBursts()
+        return true
+    }
+
     /// Anchor from the 0x13 SyncTime response (ringverse BLE.md `13 05 <device_ts:4LE> <status:1>`):
     /// the ring's clock counter at the moment it processed our SyncTime, paired with the host wall-clock
-    /// at receipt. The tick unit is disambiguated against the persisted resume cursor
-    /// (OuraDriver.syncTimeAnchorCandidate — raw ticks vs seconds×10, exactly one must be plausible);
-    /// no unambiguous reading → log the raw value for investigation and adopt NOTHING (an honest missing
-    /// anchor beats a guessed one). On success everything parked while unanchored resolves immediately.
+    /// at receipt. The tick unit is disambiguated against a known-earlier ring-time
+    /// (OuraDriver.syncTimeAnchorCandidate — raw ticks vs seconds×10, exactly one must be plausible).
+    /// At connect the only reference is the resume cursor, which is 0 on a fresh pair and may be far
+    /// staler than the ring's clock; rather than discard the reply, PARK it and retry once history starts
+    /// landing (2026-09-02/03 captures). Still adopts NOTHING on ambiguity — an honest missing anchor beats a guessed one.
     private func handleSyncTimeResponse(_ resp: (deviceTimestamp: UInt32, status: UInt8)) {
-        guard let driver else { return }
         let now = Int64(Date().timeIntervalSince1970)
+        if adoptSyncTimeAnchor(deviceTimestamp: resp.deviceTimestamp, status: resp.status,
+                               receivedAt: now, source: "at connect") { return }
+        pendingSyncTime = (resp.deviceTimestamp, resp.status, now)
         let raw = String(format: "0x%08x", resp.deviceTimestamp)
-        if let rt = OuraDriver.syncTimeAnchorCandidate(responseValue: resp.deviceTimestamp,
-                                                       historyCursor: historyCursor),
-           driver.adoptSyncTimeAnchor(ringTimestamp: rt, unixSeconds: now) {
-            let unit = rt == resp.deviceTimestamp ? "ticks" : "seconds x10"
-            if !loggedAnchor {
-                loggedAnchor = true
-                log("Oura: UTC anchor from SyncTime response (0x13) - device rt \(rt) [\(unit), raw \(raw), status \(resp.status)] = now; no 0x42 needed this session")
-            }
-            drainPendingAnchorEvents()
-            drainPendingHypnogramBursts()
-        } else {
-            log("Oura: SyncTime response (0x13) raw \(raw) status \(resp.status) - no unambiguous tick reading vs cursor \(historyCursor); anchor NOT adopted (investigation)")
+        log("Oura: SyncTime response (0x13) raw \(raw) status \(resp.status) - no unambiguous tick reading vs ring-time floor \(syncTimeAnchorLowerBound); parked, retrying as history lands (investigation)")
+    }
+
+    /// Retry a parked 0x13 reply now that the drain has seen real ring-times. Silent on failure (the
+    /// parked reply simply waits for a better floor); one line on success, from `adoptSyncTimeAnchor`.
+    private func retryPendingSyncTimeAnchor() {
+        guard let parked = pendingSyncTime, drain.maxSeenRingTime > 0 else { return }
+        if adoptSyncTimeAnchor(deviceTimestamp: parked.deviceTimestamp, status: parked.status,
+                               receivedAt: parked.receivedAt, source: "resolved against history") {
+            pendingSyncTime = nil
         }
     }
 
diff --git a/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt b/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt
index b68727fb1e..988bd20896 100644
--- a/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt
+++ b/android/app/src/main/java/com/noop/ble/OuraLiveSource.kt
@@ -311,6 +311,14 @@ class OuraLiveSource(
     private var loggedFirstTemp = false
     /** Logs the FIRST SpO2 sample decoded this session only. Twin of [loggedFirstTemp]. */
     private var loggedFirstSpo2 = false
+    /** The 0x13 SyncTime reply parked because nothing yet available could disambiguate its unit (ticks vs
+     *  seconds x10): the resume cursor was 0 (fresh pair / post-reboot full pull) or so stale the ring's
+     *  clock had run past the window. Retried against the drain's maxSeenRingTime as the first batch lands
+     *  (2026-09-02/03 captures). The ORIGINAL receipt wall-clock is carried along, because THAT is the instant the ring's
+     *  counter pairs with - re-stamping at retry time would skew the anchor by the drain's latency.
+     *  Twin of Swift's pendingSyncTime. */
+    private var pendingSyncTime: Triple<Long, Int, Long>? = null
+
     /** Logs the FIRST ring-time -> UTC anchor of this session only (s5.5); reset on stop/disconnect. */
     private var loggedAnchor = false
     /** Tier-B (UNVERIFIED) kinds ("activity" / "real_steps" / "sleep_summary" / "spo2_smoothed") already
@@ -834,28 +842,72 @@ class OuraLiveSource(
         pendingUnanchoredBursts.clear()
     }
 
+    /**
+     * The ring-time floor the 0x13 unit test disambiguates against: the persisted resume cursor, or the
+     * largest envelope ring-time this drain has seen when that is further along. maxSeenRingTime is the
+     * half that breaks the deadlock (2026-09-02/03 captures) — it counts EVERY history record, anchored or not, so it is
+     * readable with no anchor, whereas the cursor can only advance once an anchor exists.
+     * Twin of Swift's syncTimeAnchorLowerBound.
+     */
+    private val syncTimeAnchorLowerBound: Long
+        get() = maxOf(historyCursor, drain.maxSeenRingTime)
+
+    /**
+     * Try to turn a 0x13 SyncTime reply into this session's UTC anchor, returning whether it stuck.
+     * [receivedAt] is the host wall-clock at the moment the reply ARRIVED (not now), since that is the
+     * instant the ring's counter pairs with. Shared by the at-connect attempt and the retry.
+     * Twin of Swift's adoptSyncTimeAnchor.
+     */
+    private fun adoptSyncTimeAnchor(
+        d: OuraDriver,
+        deviceTimestamp: Long,
+        status: Int,
+        receivedAt: Long,
+        source: String,
+    ): Boolean {
+        val rt = OuraDriver.syncTimeAnchorCandidate(deviceTimestamp, syncTimeAnchorLowerBound)
+            ?: return false
+        if (!d.adoptSyncTimeAnchor(ringTimestamp = rt, unixSeconds = receivedAt)) return false
+        val unit = if (rt == deviceTimestamp) "ticks" else "seconds x10"
+        val raw = "0x%08x".format(deviceTimestamp)
+        if (!loggedAnchor) {
+            loggedAnchor = true
+            log("Oura: UTC anchor from SyncTime response (0x13) $source - device rt $rt [$unit, " +
+                "raw $raw, status $status] = its receipt time; no 0x42 needed this session")
+        }
+        drainPendingAnchorEvents()
+        drainPendingHypnogramBursts()
+        return true
+    }
+
     /**
      * Anchor from the 0x13 SyncTime response (ringverse: the ring's clock counter when it processed
-     * our SyncTime, paired with host wall-clock at receipt). The tick unit is disambiguated against
-     * the persisted resume cursor; no unambiguous reading → log the raw value and adopt NOTHING (an
-     * honest missing anchor beats a guessed one). Kotlin twin of Swift's handleSyncTimeResponse.
+     * our SyncTime, paired with host wall-clock at receipt). The tick unit is disambiguated against a
+     * known-earlier ring-time. At connect the only reference is the resume cursor, which is 0 on a fresh
+     * pair and may be far staler than the ring's clock; rather than discard the reply, PARK it and retry
+     * once history starts landing (2026-09-02/03 captures). Still adopts NOTHING on ambiguity — an honest missing anchor
+     * beats a guessed one. Kotlin twin of Swift's handleSyncTimeResponse.
      */
     private fun handleSyncTimeResponse(d: OuraDriver, resp: com.noop.oura.SyncTimeResponse) {
         val now = System.currentTimeMillis() / 1000L
+        if (adoptSyncTimeAnchor(d, resp.deviceTimestamp, resp.status, now, "at connect")) return
+        pendingSyncTime = Triple(resp.deviceTimestamp, resp.status, now)
         val raw = "0x%08x".format(resp.deviceTimestamp)
-        val rt = OuraDriver.syncTimeAnchorCandidate(resp.deviceTimestamp, historyCursor)
-        if (rt != null && d.adoptSyncTimeAnchor(ringTimestamp = rt, unixSeconds = now)) {
-            val unit = if (rt == resp.deviceTimestamp) "ticks" else "seconds x10"
-            if (!loggedAnchor) {
-                loggedAnchor = true
-                log("Oura: UTC anchor from SyncTime response (0x13) - device rt $rt [$unit, raw $raw, " +
-                    "status ${resp.status}] = now; no 0x42 needed this session")
-            }
-            drainPendingAnchorEvents()
-            drainPendingHypnogramBursts()
-        } else {
-            log("Oura: SyncTime response (0x13) raw $raw status ${resp.status} - no unambiguous tick " +
-                "reading vs cursor $historyCursor; anchor NOT adopted (investigation)")
+        log("Oura: SyncTime response (0x13) raw $raw status ${resp.status} - no unambiguous tick " +
+            "reading vs ring-time floor $syncTimeAnchorLowerBound; parked, retrying as history lands " +
+            "(investigation)")
+    }
+
+    /**
+     * Retry a parked 0x13 reply now that the drain has seen real ring-times. Silent on failure (the
+     * parked reply simply waits for a better floor); one line on success, from [adoptSyncTimeAnchor].
+     * Twin of Swift's retryPendingSyncTimeAnchor.
+     */
+    private fun retryPendingSyncTimeAnchor(d: OuraDriver) {
+        val parked = pendingSyncTime ?: return
+        if (drain.maxSeenRingTime <= 0) return
+        if (adoptSyncTimeAnchor(d, parked.first, parked.second, parked.third, "resolved against history")) {
+            pendingSyncTime = null
         }
     }
 
@@ -954,6 +1006,7 @@ class OuraLiveSource(
         loggedFirstTemp = false
         loggedFirstSpo2 = false
         loggedAnchor = false
+        pendingSyncTime = null
         loggedTierBKinds.clear()
         loggedFeatureStatuses.clear()
         loggedProductInfo.clear()
@@ -1046,6 +1099,7 @@ class OuraLiveSource(
         loggedFirstTemp = false
         loggedFirstSpo2 = false
         loggedAnchor = false
+        pendingSyncTime = null
         loggedTierBKinds.clear()
         loggedFeatureStatuses.clear()
         loggedProductInfo.clear()
@@ -1191,6 +1245,7 @@ class OuraLiveSource(
                     loggedFirstTemp = false
                     loggedFirstSpo2 = false
                     loggedAnchor = false
+                    pendingSyncTime = null
                     loggedTierBKinds.clear()
         loggedFeatureStatuses.clear()
         loggedProductInfo.clear()
@@ -1574,6 +1629,10 @@ class OuraLiveSource(
                 for (e in events) {
                     e.envelopeRingTimestamp?.let { drain.noteSeenRingTime(it) }
                 }
+                // The drain now has a ring-time reference that needs no anchor, so a 0x13 reply parked at
+                // connect may be resolvable. Retry BEFORE emit, so this batch anchors straight away
+                // instead of parking into pendingAnchorEvents and being drained a moment later (2026-09-02/03 captures).
+                retryPendingSyncTimeAnchor(d)
                 if (pendingContinuation && events.isNotEmpty()) {
                     handler.removeCallbacks(batchQuietRunnable)
                     handler.postDelayed(batchQuietRunnable, batchQuietMs)
diff --git a/android/app/src/main/java/com/noop/oura/OuraDriver.kt b/android/app/src/main/java/com/noop/oura/OuraDriver.kt
index 665570b856..8faa443682 100644
--- a/android/app/src/main/java/com/noop/oura/OuraDriver.kt
+++ b/android/app/src/main/java/com/noop/oura/OuraDriver.kt
@@ -648,19 +648,39 @@ class OuraDriver(
          */
         private const val SAMPLE_FUTURE_TOLERANCE_SECONDS = 300L
 
+        /**
+         * How far the ring's clock may run AHEAD of [lowerBoundTicks] and still be recognised. The bound
+         * is a stale resume cursor or the oldest ring-time a drain has seen, either of which can trail
+         * the ring's clock by the ring's whole banked depth (~14 days) plus however long the cursor has
+         * been stuck — the original 7-day window silently excluded exactly that case: in the 2026-09-02/03
+         * iOS captures an 8.2-day-stale cursor could never be re-anchored, so it could never advance, so
+         * the staleness only grew — one full re-serve of the same window per launch, forever. Widening
+         * costs no honesty: both readings fit the window only when
+         * `window >= 9 × lowerBound`, i.e. a ring under ~5 days of clock — and that case still resolves
+         * to null below, exactly as before. Byte-identical twin of Swift's syncTimeAnchorWindowTicks.
+         */
+        const val SYNC_TIME_ANCHOR_WINDOW_TICKS = 38_880_000L   // 45 days of 100 ms ticks
+
         /**
          * Resolve the 0x13 SyncTime-response device timestamp into ring TICKS, or null when no
          * unambiguous reading exists. ringverse BLE.md labels the field "seconds" but the ring's record
          * clock runs in 100 ms ticks, so both readings are tried: the raw value (already ticks) and
-         * value×10 (seconds→ticks). The ring's clock at connect must sit shortly AFTER where the last
-         * drain ended, so a candidate is plausible iff it falls in `[historyCursor, historyCursor +
-         * 7 days]`; exactly one must fit (ambiguity or a fresh/reset cursor → null → the caller logs
-         * raw instead of guessing). Pure. Byte-identical twin of Swift's syncTimeAnchorCandidate.
+         * value×10 (seconds→ticks). The ring's clock at connect must sit AFTER any ring-time we already
+         * know about, so a candidate is plausible iff it falls in `[lowerBoundTicks, lowerBoundTicks +
+         * SYNC_TIME_ANCHOR_WINDOW_TICKS]`; exactly one must fit (ambiguity or no reference at all → null
+         * → the caller logs raw instead of guessing).
+         *
+         * [lowerBoundTicks] is any ring-time known to precede the ring's clock NOW: the persisted resume
+         * cursor at connect, or — when that is 0 (fresh pair / post-reboot reset) or too stale — the
+         * largest envelope ring-time the drain has actually seen ([OuraHistoryDrain.maxSeenRingTime]),
+         * which needs no anchor to read and so breaks the cursor↔anchor deadlock (2026-09-02/03 captures).
+         *
+         * Pure. Byte-identical twin of Swift's syncTimeAnchorCandidate.
          */
-        fun syncTimeAnchorCandidate(responseValue: Long, historyCursor: Long): Long? {
-            if (historyCursor <= 0) return null
-            val lower = historyCursor
-            val upper = lower + 6_048_000L   // 7 days of 100 ms ticks
+        fun syncTimeAnchorCandidate(responseValue: Long, lowerBoundTicks: Long): Long? {
+            if (lowerBoundTicks <= 0) return null
+            val lower = lowerBoundTicks
+            val upper = lower + SYNC_TIME_ANCHOR_WINDOW_TICKS
             val readings = listOf(responseValue, responseValue * 10)
             val fits = readings.filter { it in lower..upper && it <= 0xFFFF_FFFFL }
             if (fits.size != 1) return null
diff --git a/android/app/src/test/java/com/noop/oura/FramingTest.kt b/android/app/src/test/java/com/noop/oura/FramingTest.kt
index 2f41a7fdb0..8b9edfdbb7 100644
--- a/android/app/src/test/java/com/noop/oura/FramingTest.kt
+++ b/android/app/src/test/java/com/noop/oura/FramingTest.kt
@@ -100,21 +100,82 @@ class FramingTest {
         assertNull(OuraFraming.parseSyncTimeResponse(bytes("4beda900")))
     }
 
+    /**
+     * Parity oracle for [OuraDriver.syncTimeAnchorCandidate] (2026-09-02/03 captures). Expected values are the VERBATIM
+     * stdout of the shipped Swift twin compiled standalone (`swiftc -O twin.swift main.swift`), one
+     * `responseValue / lowerBoundTicks / result` row per line — not values read off the Kotlin. The
+     * spread covers the shipped unit cases, the 2026-09-02/03 capture values behind this fix, both halves
+     * of the cursor↔anchor deadlock, the exact window edges, the ambiguity band around the 9× boundary,
+     * and the UInt32 ceiling. Guards the Kotlin direction only; the Swift test in FramingTests.swift is
+     * what stops Swift drifting.
+     */
     @Test
-    fun testSyncTimeAnchorCandidateResolvesUnit() {
-        // The 2026-07-13 shape: cursor banked at 4_413_933; ~11 h later the ring's clock is ~4.81M
-        // ticks. A raw-ticks response fits [cursor, cursor+7d] and the seconds x10 reading does not.
-        assertEquals(4_810_000L, OuraDriver.syncTimeAnchorCandidate(4_810_000L, 4_413_933L))
-        // A seconds-unit response (481_000 s = 4.81M ticks) only fits when multiplied x10.
-        assertEquals(4_810_000L, OuraDriver.syncTimeAnchorCandidate(481_000L, 4_413_933L))
-        // Below the cursor in both readings (ring reboot / stale value) -> null.
-        assertNull(OuraDriver.syncTimeAnchorCandidate(100_000L, 4_413_933L))
-        // Beyond cursor+7d in both readings -> null.
-        assertNull(OuraDriver.syncTimeAnchorCandidate(40_000_000L, 4_413_933L))
-        // A fresh/reset cursor gives no reference -> null (never guess on a full pull).
-        assertNull(OuraDriver.syncTimeAnchorCandidate(4_810_000L, 0L))
-        // Ambiguity guard: BOTH readings inside the window -> null.
-        assertNull(OuraDriver.syncTimeAnchorCandidate(150_000L, 140_000L))
+    fun testSyncTimeAnchorCandidateMatchesTheSwiftOracle() {
+        // responseValue, lowerBoundTicks, expected (null = no unambiguous reading)
+        val oracle: List<Triple<Long, Long, Long?>> = listOf(
+            Triple(4_810_000L, 4_413_933L, 4_810_000L),
+            Triple(481_000L, 4_413_933L, 4_810_000L),
+            Triple(100_000L, 4_413_933L, null),
+            Triple(50_000_000L, 4_413_933L, null),
+            Triple(4_810_000L, 0L, null),
+            Triple(150_000L, 140_000L, null),
+            Triple(35_157_631L, 28_073_725L, 35_157_631L),
+            Triple(35_159_272L, 28_073_725L, 35_159_272L),
+            Triple(35_168_206L, 28_073_725L, 35_168_206L),
+            Triple(34_724_816L, 0L, null),
+            Triple(34_749_048L, 0L, null),
+            Triple(34_776_653L, 0L, null),
+            Triple(34_724_816L, 22_628_816L, 34_724_816L),
+            Triple(34_749_048L, 22_628_816L, 34_749_048L),
+            Triple(34_776_653L, 22_628_816L, 34_776_653L),
+            Triple(28_073_725L, 28_073_725L, 28_073_725L),
+            Triple(66_953_725L, 28_073_725L, 66_953_725L),
+            Triple(66_953_726L, 28_073_725L, null),
+            Triple(28_073_724L, 28_073_725L, null),
+            Triple(500_000L, 400_000L, null),
+            Triple(4_320_000L, 4_320_000L, null),
+            Triple(4_320_001L, 4_320_001L, 4_320_001L),
+            Triple(4_294_967_295L, 4_294_000_000L, 4_294_967_295L),
+            Triple(500_000_000L, 100_000_000L, null),
+        )
+        for ((value, lowerBound, expected) in oracle) {
+            assertEquals(
+                "syncTimeAnchorCandidate($value, $lowerBound)",
+                expected,
+                OuraDriver.syncTimeAnchorCandidate(value, lowerBound),
+            )
+        }
+    }
+
+    /**
+     * Stated as the behaviour rather than the table: the 2026-09-03 capture's 0x13 reply
+     * (0x0218767f = 35_157_631) against the frozen resume cursor 28_073_725, which trails it by 8.20
+     * days. Under the old 7-day window neither reading fit, so no anchor was adopted; with no anchor the
+     * drain-end commit could not advance the cursor, so the cursor stayed stale and the gap only grew —
+     * a permanent loop, one full re-serve of the same window per launch.
+     */
+    @Test
+    fun testSyncTimeAnchorCandidateAcceptsAStaleCursor() {
+        val staleCursor = 28_073_725L
+        assertEquals(35_157_631L, OuraDriver.syncTimeAnchorCandidate(0x0218767fL, staleCursor))
+        // The old 7-day window is what excluded it: 28_073_725 + 6_048_000 = 34_121_725 < 35_157_631.
+        assertTrue(
+            "the window must cover the observed 8.2-day staleness",
+            OuraDriver.SYNC_TIME_ANCHOR_WINDOW_TICKS > 35_157_631L - staleCursor,
+        )
+    }
+
+    /**
+     * The other half of the deadlock: on a fresh pair / post-reboot reset the cursor is 0, so it
+     * can never be the reference. The drain's maxSeenRingTime can — it counts EVERY history record's
+     * envelope time and needs no anchor to read — so the caller retries the parked reply against it.
+     */
+    @Test
+    fun testSyncTimeAnchorCandidateResolvesAgainstSeenRingTimeWhenCursorIsZero() {
+        val reply = 0x0211dbd0L                 // 34_724_816 — the 2026-09-02 capture, cursor 0
+        assertNull(OuraDriver.syncTimeAnchorCandidate(reply, 0L))
+        // First batch of a full pull lands the ring's OLDEST banked record (~14 days back).
+        assertEquals(reply, OuraDriver.syncTimeAnchorCandidate(reply, 34_724_816L - 12_096_000L))
     }
 
     @Test

From 8789c410aedbd0638bd3e8a1fe90d8e85a17fc35 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 15:59:34 +1200
Subject: [PATCH 220/333] alarm: log what the smart-alarm detector actually saw
 (#1870)

The alarm package had no logging at all, so a report of "the smart alarm never works" could not be told apart from "nothing was streaming all night" - and those two need opposite fixes. Three lines, all diagnostics, no decision changed.

Reading an exported log takes both the window line and the end line, because the end line carries the sample count and only that separates a detector that declined to fire from a stream that stopped underneath it: window plus advance worked; window plus end with no fire means HR flowed all window and it still never fired, which is the detector's own defect; a window line with no end line means the stream stopped before the window ended; no window line with an end line reporting zero samples means nothing streamed inside the window at all; neither line means the collector never ran in-window.

Every window that opens also closes with a line. SmartAlarmReceiver zeroes the scheduled edges before re-arming and an explicit disable zeroes them for good, so the disarmed path emits the end line too - otherwise it would vanish silently and leave the window line looking like a stream that stopped, which is a different fault with a different fix.

Each line asserts only what it can attribute. advanceTo returns silently when the OS will not honour an exact alarm - the API 31+ permission can be revoked after the alarm was armed, leaving a deadline that can never be moved - so the line names the request and appends that it was ignored when the OS will refuse it. That is precisely the case someone reading the log would be hunting, and a line claiming "advancing" would have hidden it. For the same reason the end line reports what the DETECTOR did rather than that the alarm moved: hasFired knows the first and not the second.

SleepWindowWatcher gains trough, samples and hasFired as read-only accessors over state it already held. A null trough is the interesting one: it means no reading was ever below troughCeilingBpm, which is what happens when the user is awake for the whole window, and is the state shouldWake refuses to fire on.

Deliberately no behaviour change, and that is checked rather than asserted: stripping the added log lines and diffing against the shipped file leaves all nine decision statements identical, the only structural edit being a single-statement if becoming a braced block.

Calibrating the detector needs a real night's data. An earlier attempt tuned it from estimates instead and was worse than the bug - it made the alarm fire on the first in-window sample for a normal sleeper. These lines are what a corrected margin should be fitted to.

Analysis on #1858. Android only; there is no Swift twin of this detector and Apple has no wake window at all, noted on #1613. Nothing here improves the alarm for the reporter - it makes the next report answerable, and it needs a night on a strap before any line has been emitted in anger.
---
 .../java/com/noop/alarm/SleepWindowWatcher.kt | 17 +++++
 .../com/noop/ble/WhoopConnectionService.kt    | 62 ++++++++++++++++++-
 .../com/noop/alarm/SleepWindowWatcherTest.kt  | 25 ++++++++
 3 files changed, 103 insertions(+), 1 deletion(-)

diff --git a/android/app/src/main/java/com/noop/alarm/SleepWindowWatcher.kt b/android/app/src/main/java/com/noop/alarm/SleepWindowWatcher.kt
index 7ebd04ccf8..1529e11873 100644
--- a/android/app/src/main/java/com/noop/alarm/SleepWindowWatcher.kt
+++ b/android/app/src/main/java/com/noop/alarm/SleepWindowWatcher.kt
@@ -30,6 +30,23 @@ class SleepWindowWatcher(
     /** Set once we've advanced the alarm so we don't keep re-advancing every sample. */
     private var fired: Boolean = false
 
+    /**
+     * The trough established so far, or null while no reading has qualified as a candidate. READ-ONLY
+     * diagnostics (#1858) — the detector's own decisions do not consult it.
+     *
+     * Null is the interesting value: it means no reading has ever been BELOW [troughCeilingBpm], which
+     * is what happens when the user is awake for the whole window, and it is the state [shouldWake]
+     * treats as "no reference yet" and refuses to fire on.
+     */
+    val trough: Int? get() = if (troughBpm == Int.MAX_VALUE) null else troughBpm
+
+    /** Readings folded in since [reset]. READ-ONLY diagnostics: distinguishes "no live HR" from
+     *  "HR arrived but the heuristic never fired". */
+    val samples: Int get() = sampleCount
+
+    /** Whether the alarm has already been advanced this window. READ-ONLY diagnostics. */
+    val hasFired: Boolean get() = fired
+
     /** Reset for a fresh night (called when the watcher (re)enters a window). */
     fun reset() {
         troughBpm = Int.MAX_VALUE
diff --git a/android/app/src/main/java/com/noop/ble/WhoopConnectionService.kt b/android/app/src/main/java/com/noop/ble/WhoopConnectionService.kt
index f5d9e3db80..0f0b8ce962 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopConnectionService.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopConnectionService.kt
@@ -206,6 +206,10 @@ class WhoopConnectionService : Service() {
      *  The detector is reset each time we (re)enter a window. */
     private val sleepWatcher = SleepWindowWatcher()
     private var inAlarmWindow = false
+    /** Whether this window has already logged a live-HR reading (#1858). The window-open line is worth
+     *  one line a night, and it must report a REAL reading: `heartRate ?: 0` means the collector also
+     *  runs when nothing is streaming, which is the very case the line exists to rule out. */
+    private var loggedAlarmWindowHr = false
 
     /** The smart-alarm HR collector, alive for the life of the service. */
     private var alarmJob: Job? = null
@@ -518,15 +522,71 @@ class WhoopConnectionService : Service() {
                 .conflate()
                 .collect { hr ->
                     if (!store.enabled || store.scheduledDeadlineMs <= 0L) {
+                        // Disarmed while we were inside the window. SmartAlarmReceiver zeroes the
+                        // edges before re-arming, and an explicit disable zeroes them for good, so
+                        // without this the end-of-window line is simply lost — and a window line with
+                        // no end line is documented to mean the HR stream stopped, which would be the
+                        // wrong reading. Log it here so every opened window closes with a line.
+                        if (inAlarmWindow) {
+                            ble.externalLog(
+                                "Smart alarm: wake window ended (alarm no longer armed), detector " +
+                                    "${if (sleepWatcher.hasFired) "fired" else "never fired"} - " +
+                                    "${sleepWatcher.trough?.let { "trough $it bpm" } ?: "trough never established"} " +
+                                    "from ${sleepWatcher.samples} readings",
+                            )
+                        }
                         inAlarmWindow = false
                         return@collect
                     }
                     val now = System.currentTimeMillis()
                     val inWindow = now in store.scheduledWindowStartMs until store.scheduledDeadlineMs
-                    if (inWindow && !inAlarmWindow) sleepWatcher.reset()   // fresh night
+                    if (inWindow && !inAlarmWindow) {
+                        sleepWatcher.reset()   // fresh night
+                        loggedAlarmWindowHr = false
+                    }
+                    // #1858: the alarm package had no logging at all, so "the smart alarm never works"
+                    // could not be told apart from "nothing was streaming all night" — the two need
+                    // opposite fixes. These lines are diagnostics ONLY; every decision below is
+                    // unchanged.
+                    //
+                    // Reading an exported log. It takes BOTH the window line and the end line, because
+                    // the end line carries the sample count and only that separates a detector that
+                    // declined to fire from a stream that stopped underneath it:
+                    //
+                    //   window + advance                  -> worked
+                    //   window + end (no fire, samples n) -> HR flowed all window and it still never
+                    //                                        fired: the detector's own defect
+                    //   window, NO end line               -> the stream stopped before the window ended
+                    //                                        (no post-deadline sample to log on)
+                    //   no window + end (samples 0)       -> nothing streamed inside the window at all
+                    //   neither line                      -> the collector never ran in-window: the
+                    //                                        service was down, or the alarm was off
+                    if (!inWindow && inAlarmWindow) {
+                        ble.externalLog(
+                            "Smart alarm: wake window ended, detector ${if (sleepWatcher.hasFired) "fired" else "never fired"} " +
+                                "- ${sleepWatcher.trough?.let { "trough $it bpm" } ?: "trough never established"} " +
+                                "from ${sleepWatcher.samples} readings",
+                        )
+                    }
                     inAlarmWindow = inWindow
                     if (!inWindow) return@collect
+                    if (hr > 0 && !loggedAlarmWindowHr) {
+                        loggedAlarmWindowHr = true
+                        val mins = (store.scheduledDeadlineMs - now) / 60_000L
+                        ble.externalLog("Smart alarm: in wake window with live HR $hr bpm, deadline in $mins min")
+                    }
                     if (sleepWatcher.shouldWake(hr)) {
+                        // advanceTo() returns silently when the OS will not honour an exact alarm (the
+                        // API 31+ permission can be revoked AFTER the alarm was armed, leaving a
+                        // deadline that can never be moved). Claiming "advancing" would then assert
+                        // something this line cannot attribute - and that is precisely the case someone
+                        // reading the log would be hunting. State the request and the permission apart.
+                        val permitted = SmartAlarmScheduler.canScheduleExact(this@WhoopConnectionService)
+                        ble.externalLog(
+                            "Smart alarm: detector fired, asking to advance the wake - HR $hr bpm vs " +
+                                "trough ${sleepWatcher.trough} after ${sleepWatcher.samples} readings" +
+                                if (permitted) "" else " - IGNORED, exact alarms are not permitted",
+                        )
                         SmartAlarmScheduler.advanceTo(this@WhoopConnectionService, store, now)
                     }
                 }
diff --git a/android/app/src/test/java/com/noop/alarm/SleepWindowWatcherTest.kt b/android/app/src/test/java/com/noop/alarm/SleepWindowWatcherTest.kt
index ad28dd5c11..b1bc9d5e0a 100644
--- a/android/app/src/test/java/com/noop/alarm/SleepWindowWatcherTest.kt
+++ b/android/app/src/test/java/com/noop/alarm/SleepWindowWatcherTest.kt
@@ -2,6 +2,7 @@ package com.noop.alarm
 
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Test
 
@@ -57,6 +58,30 @@ class SleepWindowWatcherTest {
         assertTrue(w.shouldWake(55))   // 55 is +7 over the real trough of 48
     }
 
+    @Test fun diagnosticsReportWhatTheDetectorActuallySaw() {
+        // #1858: these accessors exist so an exported strap log can tell "no live HR all night" apart
+        // from "HR arrived and the heuristic still never fired". They must REPORT state, never change
+        // a decision — so the assertions here pin the reported values against a known feed.
+        val w = watcher()
+        assertNull(w.trough)
+        assertEquals(0, w.samples)
+        assertFalse(w.hasFired)
+
+        // The reported failure shape: awake for the whole window, every reading above the ceiling.
+        // No trough is ever established, which is exactly what shouldWake refuses to fire on.
+        repeat(6) { assertFalse(w.shouldWake(110)) }
+        assertNull(w.trough)
+        assertEquals(6, w.samples)      // HR WAS arriving - the log must be able to say so
+        assertFalse(w.hasFired)
+
+        // A sleeping feed establishes a trough and fires; the accessors follow.
+        val w2 = watcher()
+        repeat(6) { w2.shouldWake(50) }
+        assertEquals(50, w2.trough)
+        assertTrue(w2.shouldWake(58))
+        assertTrue(w2.hasFired)
+    }
+
     @Test fun resetClearsState() {
         val w = watcher()
         repeat(6) { w.shouldWake(50) }

From b24f776f5673bca145d14e1f69e569f2728e3f3e Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 16:08:41 +1200
Subject: [PATCH 221/333] docs(ios): name the on-device AltStore Error Log
 shape, not just the desktop one (#1860)

AltStore reports the same underlying decode failure against whatever it happened to be doing at that minute, so a user sees "Install NOOP Failed - NSCocoaErrorDomain 3840" on the phone and reasonably reads it as NOOP's fault. The docs covered the desktop AltServer sign-in shape but never the on-device Error Log, which is where the NOOP-named line actually appears.

The tell is in the same log: "Refresh AltStore Failed" with the identical error means AltStore could not refresh its OWN app, which nothing about NOOP's ipa or NOOP's source can cause. The section leads with that, because it is the one line that settles attribution, and names 3840 as a parse error - AltStore expected structured data and got an HTML page - pointing at the existing desktop section as the same underlying problem reported from the phone.

Documentation only. No code, no strings, no schema.
---
 docs/IOS.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/docs/IOS.md b/docs/IOS.md
index f844872f3b..7686398b0f 100644
--- a/docs/IOS.md
+++ b/docs/IOS.md
@@ -27,6 +27,27 @@ ID**. Nothing about this touches NOOP's identity or Apple's servers on our side.
    and installs NOOP. First launch may need **Settings → General → VPN & Device Management → trust
    your Apple ID**.
 
+### If AltStore's Error Log says "Install NOOP Failed"
+
+The same failure also shows up **on the phone**, in AltStore's own Error Log, where it names NOOP and so
+looks like NOOP's fault:
+
+> **Install NOOP Failed** — `NSCocoaErrorDomain 3840`
+> *The data couldn't be read because it isn't in the correct format.*
+
+**Read the whole log before concluding anything.** If it also contains:
+
+> **Refresh AltStore Failed** — `NSCocoaErrorDomain 3840`
+
+then AltStore could not refresh **its own app**, which nothing about NOOP's `.ipa` or NOOP's source can
+cause. Every "… Failed" line is the same decode failure hitting whatever AltStore happened to be doing at
+that minute — installing NOOP, refreshing NOOP, refreshing itself. The NOOP-named lines are the symptom,
+not the cause.
+
+`NSCocoaErrorDomain 3840` is a parse error: AltStore expected structured data and got something else back
+(usually an HTML page). See the section below — it is the same underlying problem as the desktop sign-in
+failure, just reported from the phone instead of AltServer.
+
 ### If AltServer can't sign in with your Apple ID
 
 A failure at **step 1** — before NOOP is involved at all — looks like this:

From 8954b44056fff9fff5180cd99b3c7db79f8bc5bc Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 16:55:35 +1200
Subject: [PATCH 222/333] coupled: show the optimal strain band as a tube on
 Android, matching Apple (#1871)

Apple has drawn the #43 optimal band as a liquid tube beside the OPTIMAL stat since the coupled layout shipped; Android printed "14 to 18" and nothing else. It was the one coupled stat with a shape to show and no shape shown - a range is the only value in that stack occupying part of an axis rather than sitting at a point on it.

Nothing new is computed. optimalStrainRange was already there and already byte-identical to the Swift twin; this adds optimalUpperFraction over it - band.high / 21, clamped, which is the Swift expression - and an OptimalStat composable mirroring Swift's optimalStat. Android's LiquidTube already existed and already mirrors the iOS one, so the tube is a call rather than a new primitive, and animated = false matches both the Swift call site and the existing Android idiom in SleepStageBreakdownUi.

An unknown recovery gives 0.0, so a calibrating or unscored day shows the no-data token over an EMPTY tube. The tube must never fabricate a band the text beside it is refusing to name, which is the honesty rule the range text already follows.

OptimalStat takes its title as a parameter and uppercases it exactly as HeroStat does, rather than inlining the word. The four stat titles on this screen are unlocalized literals the i18n gate cannot see as HeroStat arguments, so inlining one into a Text() makes that ONE of the four visible and fails the gate. Localising a single stat title while its three siblings stay hardcoded is the wrong fix for a parity change - the four are one pre-existing gap and belong to one change of their own.

Visible effect, stated plainly: the OPTIMAL stat grows by about 14dp (4dp spacing rather than 2, plus the 8dp tube), so Calories and Workouts shift down and the strain card grows with them. Nothing clips - the left column is a fixed 168dp and the stat stack already exceeded it - and no other screen is touched, OptimalStat being private to this file.

What this is NOT: a user asked for the optimal zone marked on the strain circle. There is no strain circle - strain is a LiquidVessel on both platforms and the circular StrainGauge is unreferenced outside Swift previews. Marking the band on the vessel is the real request and is a larger change needing a design call. This closes the parity gap underneath it, since Android could not overlay a band it had no way to draw. Note too that the tube fills to the band's UPPER bound on both platforms, so it draws a ceiling rather than a zone; matching Apple is the point here, but after this neither platform marks a zone.

testFullDebugUnitTest com.noop.ui.CoupledScreenTest: 10 tests, 0 failures - 3 new, the 7 existing untouched. The new expectations are the Swift expression evaluated on the approved bands, including both inclusive edges, not values read back off the Kotlin. compileFullDebugKotlin clean, i18n audit clean, doc_comment_lint.py OK.

Not verified: this is a visual change and nobody has seen it rendered. The 14dp is arithmetic from the composables, not a measured layout.
---
 .../main/java/com/noop/ui/CoupledScreen.kt    | 56 ++++++++++++++++++-
 .../java/com/noop/ui/CoupledScreenTest.kt     | 33 +++++++++++
 2 files changed, 88 insertions(+), 1 deletion(-)

diff --git a/android/app/src/main/java/com/noop/ui/CoupledScreen.kt b/android/app/src/main/java/com/noop/ui/CoupledScreen.kt
index 4ff41ccbd0..888df02d04 100644
--- a/android/app/src/main/java/com/noop/ui/CoupledScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/CoupledScreen.kt
@@ -497,7 +497,7 @@ private fun StrainCard(dayStrain21: Double?, recovery: Double?, calories: Double
                 verticalArrangement = Arrangement.spacedBy(14.dp),
             ) {
                 HeroStat("Day Strain", dayStrain21?.let { String.format(Locale.US, "%.1f", it) } ?: COUPLED_NO_DATA, Palette.effortColor)
-                HeroStat("Optimal", optimalStrainRangeText(recovery), Palette.chargeColor)
+                OptimalStat("Optimal", recovery)
                 HeroStat("Calories", calories?.let { "${it.roundToInt()} kcal" } ?: COUPLED_NO_DATA, Palette.metricAmber)
                 HeroStat("Workouts", workouts.toString(), Palette.textPrimary)
             }
@@ -505,6 +505,47 @@ private fun StrainCard(dayStrain21: Double?, recovery: Double?, calories: Double
     }
 }
 
+/**
+ * The OPTIMAL strain band stat: the heroStat idiom plus a liquid tube visualising where the suggested band
+ * sits on the 0-21 axis. Twin of Swift CoupledView.optimalStat, which has had the tube since the coupled
+ * layout shipped while Android printed the range alone - the band was the one coupled stat with a shape to
+ * show and no shape shown.
+ *
+ * Not folded into [HeroStat]: Swift keeps optimalStat separate for the same reasons (4dp spacing rather
+ * than 2, and the tube), and every other stat here is a bare number with nothing to plot.
+ *
+ * A calibrating / unscored day shows the no-data token over an EMPTY tube, never a guessed band.
+ */
+@Composable
+private fun OptimalStat(title: String, recovery: Double?) {
+    Column(
+        modifier = Modifier.fillMaxWidth(),
+        verticalArrangement = Arrangement.spacedBy(4.dp),
+    ) {
+        // Takes the title as a parameter and uppercases it here, exactly as [HeroStat] does, rather than
+        // inlining "OPTIMAL". Not cosmetic: the four stat titles on this screen are unlocalized literals
+        // that the i18n gate cannot see as HeroStat arguments, and inlining one into a Text() makes that
+        // ONE of the four visible and fails the gate. Localising a single stat title while its three
+        // siblings stay hardcoded would be the wrong fix for a parity PR; the four of them are one
+        // pre-existing gap and belong to one change.
+        Text(title.uppercase(), style = NoopType.overline, color = Palette.textSecondary)
+        // Deliberately the same bare Text as [HeroStat]'s value, with no maxLines. Swift shrinks this
+        // (lineLimit(1).minimumScaleFactor(0.6)) but so does its heroStat, and Android's HeroStat does
+        // neither - so that divergence belongs to all four coupled stats, not to this one. Adding a
+        // maxLines here alone would truncate where the siblings wrap and where Swift shrinks: different
+        // from both.
+        Text(optimalStrainRangeText(recovery), style = NoopType.number(20f), color = Palette.chargeColor)
+        // animated = false matches the Swift call: the stat stack is a read-out, not an instrument, and a
+        // posed tube costs nothing per frame.
+        LiquidTube(
+            frac = optimalUpperFraction(recovery),
+            tint = Palette.chargeColor,
+            height = 8.dp,
+            animated = false,
+        )
+    }
+}
+
 /** The heroStat idiom (an UPPERCASE overline over a big tinted number), mirroring WorkoutsScreen/iOS heroStat. */
 @Composable
 private fun HeroStat(title: String, value: String, tint: Color) {
@@ -668,6 +709,19 @@ internal fun optimalStrainRange(recovery: Double?): OptimalStrainRange? {
     }
 }
 
+/**
+ * The optimal band's UPPER bound as a 0..1 fraction of the 0-21 axis, for the tube fill. 0 (an empty tube)
+ * when recovery is unknown, so the tube never fabricates a band the text is refusing to name.
+ *
+ * Twin of Swift CoupledView.optimalUpperFraction. Reads the upper bound rather than the midpoint because
+ * the tube shows how far up the axis the suggested band REACHES, which is what pairs with "14 to 18"
+ * printed above it.
+ */
+internal fun optimalUpperFraction(recovery: Double?): Double {
+    val band = optimalStrainRange(recovery) ?: return 0.0
+    return (band.high.toDouble() / 21.0).coerceIn(0.0, 1.0)
+}
+
 /** The optimal band as display text ("14 to 18" / the no-data token). Byte-identical to the Swift twin. */
 internal fun optimalStrainRangeText(recovery: Double?): String {
     val band = optimalStrainRange(recovery) ?: return COUPLED_NO_DATA
diff --git a/android/app/src/test/java/com/noop/ui/CoupledScreenTest.kt b/android/app/src/test/java/com/noop/ui/CoupledScreenTest.kt
index 90f6b39540..f60e4eec98 100644
--- a/android/app/src/test/java/com/noop/ui/CoupledScreenTest.kt
+++ b/android/app/src/test/java/com/noop/ui/CoupledScreenTest.kt
@@ -1,6 +1,7 @@
 package com.noop.ui
 
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
 import org.junit.Assert.assertNull
 import org.junit.Test
 
@@ -62,4 +63,36 @@ class CoupledScreenTest {
         assertEquals("0h 5m", hoursMinutes(5.0))
         assertEquals("8h 0m", hoursMinutes(480.0))
     }
+
+    /**
+     * The tube fill beside the OPTIMAL range (#43). Twin of Swift CoupledView.optimalUpperFraction, which
+     * is `max(0, min(1, Double(band.upperBound) / 21))` - so these expectations are the Swift expression
+     * evaluated on the approved bands, not values read back off the Kotlin.
+     */
+    @Test
+    fun optimalUpperFractionMatchesTheSwiftTwin() {
+        assertEquals(18.0 / 21.0, optimalUpperFraction(90.0), 1e-12)
+        assertEquals(18.0 / 21.0, optimalUpperFraction(67.0), 1e-12)   // green, inclusive lower edge
+        assertEquals(14.0 / 21.0, optimalUpperFraction(66.9), 1e-12)
+        assertEquals(14.0 / 21.0, optimalUpperFraction(34.0), 1e-12)   // yellow, inclusive lower edge
+        assertEquals(10.0 / 21.0, optimalUpperFraction(33.9), 1e-12)
+        assertEquals(10.0 / 21.0, optimalUpperFraction(0.0), 1e-12)
+    }
+
+    @Test
+    fun optimalUpperFractionIsEmptyWhenRecoveryIsUnknown() {
+        // A calibrating / unscored day prints the no-data token, so the tube must be EMPTY rather than
+        // fabricate a band the text alongside it is refusing to name.
+        assertEquals(0.0, optimalUpperFraction(null), 1e-12)
+    }
+
+    @Test
+    fun optimalUpperFractionNeverLeavesTheAxis() {
+        // Every approved band is inside 0..21, so the clamp is defensive - but it is the reason a future
+        // band change cannot push the tube past full.
+        for (r in listOf(null, -50.0, 0.0, 33.9, 34.0, 66.9, 67.0, 100.0, 1000.0)) {
+            val f = optimalUpperFraction(r)
+            assertTrue("fraction out of range for recovery=$r: $f", f in 0.0..1.0)
+        }
+    }
 }

From e12dff51d440a6f10e37267c901aec1f7be3466a Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 17:35:49 +1200
Subject: [PATCH 223/333] build: staging 431 / iOS 312 for the next testing
 build

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 420f194405..4855a5b903 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 430
+        versionCode = 431
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index c928e40995..5c51e1524f 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "311"
+    CURRENT_PROJECT_VERSION: "312"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 2809c16ef93bd16bb525413951bbc64503e082a4 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 18:40:46 +1200
Subject: [PATCH 224/333] i18n: add a Russian locale to Android, and backfill
 Apple's from it (#1872)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Apple had shipped Russian since #844; Android had none at all. This adds one, and brings Apple's to 99.6% in the same pass, because each platform's Russian could be read across to the other: Apple's xcstrings keys ARE the English source text, so a shared English string is a lookup rather than a translation.

  Android values-ru        none  ->  2459 strings + 15 plurals   (95.3%, ZERO echoes)
  Apple Strand        95.7%  ->  99.9%
  Apple StrandDesign  48.6%  ->  90.5%
  Apple total         94.5%  ->  99.6%

Provenance, four ways: 1248 strings joined from Apple's existing Russian onto Android keys; 1222 translated for Android where Apple had no counterpart; 68 joined BACK from those onto Apple keys; 131 translated for Apple where Android had none. The glossary was taken from the existing translations rather than invented, so all four agree - Заряд, Усилие, Отдых, Восстановление, Нагрузка, ВСР, уд/мин, Браслет, Норма.

THREE STRINGS ARE DELIBERATELY LEFT IN ENGLISH. They carry shouldTranslate=false and a comment that says why: "MEDICAL SAFETY COPY - needs a native speaker, not a machine translation. Deliberately left untranslated: a disclaimer that drifts in meaning is worse than one shown in English." They are the ECG and unvalidated-instrumentation disclaimers. A first pass had machine-translated all three before the flag was read; they are excluded, and 57 flagged strings across the catalogs are untouched. The audit already knew - it counts Strand as 1 short rather than 5.

Russian plurals carry all FOUR quantity forms (one/few/many/other). English has two, and an Android locale shipping only those renders English for 2-4 and 5+, which is most of the number line. Every other Android locale here carries two forms; Apple's Russian was already correct.

Verified mechanically, which is the part the gate cannot do - #1811 accepted "Descansoaurar" because the string merely existed and differed from English:
- format specifiers compared by CONVERSION TYPE, not token, because Apple translations legitimately rewrite "%@ ... %lld" as "%1$@ ... %2$lld" when word order changes: 0 mismatches across 2459 Android strings, 60 plural forms and 199 Apple additions;
- literal %% and bare % counts match English exactly - one string had been written "%%" where English writes a bare "%", which would have rendered "%%" in the changelog since that string is never formatted;
- terminology reconciled ACROSS the two provenances, a failure a two-source locale is uniquely exposed to and no gate looks for: Lab Book had acquired THREE Russian names, Live Session two, Apple Health two, and the Coach had lost its prefix once. All unified on whichever form the screen title uses;
- 0 strings identical to English, 0 stray characters, 0 unescaped ampersands;
- the catalogs are text-spliced into the "localizations" object, never JSON round-tripped, and emitted at each entry's own indentation so the diff is pure additions - 199 ru localizations added, 0 lost, 0 modified, 0 duplicate keys, every comment and shouldTranslate flag preserved;
- assembleFullDebug succeeds and the Russian is present in the built APK's resources.arsc, so the locale genuinely ships rather than merely parsing.

Coverage counted honestly. values-ru is 95.3% by key, and the 121 absent keys are format-only strings, brand names and internal identifiers whose translation would be an echo. Every other Android locale counts echoes toward its total: de is 2580 present but 184 of those are still English, so 2396 real against Russian's 2459. Russian ships with more genuinely translated copy than any other language in the app.

NOT VERIFIED: nobody has read this as a Russian speaker. The mechanical classes are closed; fluency and terminology are not, and that is exactly the class #1811 was. 73 short Android labels grow more than 70% in Russian, which only rendering can settle. The three disclaimers above are the project's own statement of where machine translation stops being acceptable, and the rest of this locale sits on the other side of that line without a human having looked.
---
 .../Resources/Localizable.xcstrings           |  264 ++
 Strand/Resources/Localizable.xcstrings        |  930 ++++++
 Tools/i18n_extra_locale_baseline.txt          |    5 +-
 .../app/src/main/res/values-ru/strings.xml    | 2557 +++++++++++++++++
 4 files changed, 3754 insertions(+), 2 deletions(-)
 create mode 100644 android/app/src/main/res/values-ru/strings.xml

diff --git a/Packages/StrandDesign/Sources/StrandDesign/Resources/Localizable.xcstrings b/Packages/StrandDesign/Sources/StrandDesign/Resources/Localizable.xcstrings
index df894b30cd..5af055cf65 100644
--- a/Packages/StrandDesign/Sources/StrandDesign/Resources/Localizable.xcstrings
+++ b/Packages/StrandDesign/Sources/StrandDesign/Resources/Localizable.xcstrings
@@ -2308,6 +2308,12 @@
             "state": "translated",
             "value": "51 bpm"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "51 уд/мин"
+          }
         }
       }
     },
@@ -2342,6 +2348,12 @@
             "state": "translated",
             "value": "7h 42m śpi · 92% ewydajność"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "7 ч 42 мин сна · эффективность 92%"
+          }
         }
       }
     },
@@ -2376,6 +2388,12 @@
             "state": "translated",
             "value": "87% · streaming"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "87% · передача"
+          }
         }
       }
     },
@@ -2399,6 +2417,12 @@
             "value": "Ajouter"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Добавить"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -2450,6 +2474,12 @@
             "state": "translated",
             "value": "Przyjęte przez NoopButtonStyle"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Применяется через NoopButtonStyle"
+          }
         }
       }
     },
@@ -2484,6 +2514,12 @@
             "state": "translated",
             "value": "Tylko bar"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Только полоса"
+          }
         }
       }
     },
@@ -2518,6 +2554,12 @@
             "state": "translated",
             "value": "Body / Regular 15 — wątek o Tobie, przeczytaj w całości."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Body / Regular 15 — нить о вас, прочитанная целиком."
+          }
         }
       }
     },
@@ -2552,6 +2594,12 @@
             "state": "translated",
             "value": "PODLICZANIE WYNIKÓW"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "ОЦЕНКА С ОТСЧЁТОМ"
+          }
         }
       }
     },
@@ -2586,6 +2634,12 @@
             "state": "translated",
             "value": "Spokojna noc"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Спокойная ночь"
+          }
         }
       }
     },
@@ -2654,6 +2708,12 @@
             "state": "translated",
             "value": "Karta %lld"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Карточка %lld"
+          }
         }
       }
     },
@@ -2677,6 +2737,12 @@
             "value": "Terminé"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Готово"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -2762,6 +2828,12 @@
             "state": "translated",
             "value": "HRV (ms) — 30 dni"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "ВСР (мс) — 30 дней"
+          }
         }
       }
     },
@@ -2830,6 +2902,12 @@
             "state": "translated",
             "value": "Tętno, 24 godziny"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Пульс, 24 часа"
+          }
         }
       }
     },
@@ -2864,6 +2942,12 @@
             "state": "translated",
             "value": "Najedź kursorem na zespół: nazwa sceny, początek i koniec zegara oraz czas trwania."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Наведите на полосу: название стадии, время начала и конца и длительность."
+          }
         }
       }
     },
@@ -2898,6 +2982,12 @@
             "state": "translated",
             "value": "Najedź kursorem na komórkę: pierścień + data, wynik i podpowiedź dotycząca stanu odzyskiwania."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Наведите на ячейку: кольцо и дата, оценка и подсказка о состоянии восстановления."
+          }
         }
       }
     },
@@ -2932,6 +3022,12 @@
             "state": "translated",
             "value": "Najedź kursorem na wskaźnik obciążenia i podpowiedzi dotyczącego słowa ładowania."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Наведите на индикатор, чтобы увидеть подсказку с нагрузкой и её словесной оценкой."
+          }
         }
       }
     },
@@ -2966,6 +3062,12 @@
             "state": "translated",
             "value": "Najedź kursorem na pierścień, aby odzyskać + podpowiedź ze słowem stanu."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Наведите на кольцо, чтобы увидеть подсказку с восстановлением и его словесной оценкой."
+          }
         }
       }
     },
@@ -3000,6 +3102,12 @@
             "state": "translated",
             "value": "Najedź kursorem na dowolną linię przebiegu, aby odczytać dokładną próbkę pod kursorem."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Наведите на любой мини-график, чтобы прочитать точное значение под курсором."
+          }
         }
       }
     },
@@ -3034,6 +3142,12 @@
             "state": "translated",
             "value": "Najedź kursorem na karty, aby zobaczyć windę."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Наведите на карточки, чтобы увидеть подъём."
+          }
         }
       }
     },
@@ -3068,6 +3182,12 @@
             "state": "translated",
             "value": "Najedź kursorem na linię: celownik + kropka + podpowiedź z datą/wartością."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Наведите на линию: перекрестие, точка и подсказка с датой и значением."
+          }
         }
       }
     },
@@ -3102,6 +3222,12 @@
             "state": "translated",
             "value": "Najedź kursorem, aby przeczytać HRV każdego dnia w ms."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Наведите, чтобы прочитать ВСР каждого дня в мс."
+          }
         }
       }
     },
@@ -3136,6 +3262,12 @@
             "state": "translated",
             "value": "W karcie"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "В карточке"
+          }
         }
       }
     },
@@ -3170,6 +3302,12 @@
             "state": "translated",
             "value": "Ubiegłej nocy"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Последняя ночь"
+          }
         }
       }
     },
@@ -3204,6 +3342,12 @@
             "state": "translated",
             "value": "Ruch podczas snu"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Движение во сне"
+          }
         }
       }
     },
@@ -3272,6 +3416,12 @@
             "state": "translated",
             "value": "Przegląd HR"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Пульс, обзор"
+          }
         }
       }
     },
@@ -3306,6 +3456,12 @@
             "state": "translated",
             "value": "GRADIDENT ODZYSKU"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "ГРАДИЕНТ ВОССТАНОВЛЕНИЯ"
+          }
         }
       }
     },
@@ -3340,6 +3496,12 @@
             "state": "translated",
             "value": "Regeneracja — 30 dni"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Восстановление — 30 дней"
+          }
         }
       }
     },
@@ -3374,6 +3536,12 @@
             "state": "translated",
             "value": "Regeneracja — ubiegły rok"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Восстановление — за прошлый год"
+          }
         }
       }
     },
@@ -3408,6 +3576,12 @@
             "state": "translated",
             "value": "Zmniejsz ruch renderuje statycznie w ostatniej klatce."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "При включённом «Уменьшении движения» отображается статичный последний кадр."
+          }
         }
       }
     },
@@ -3431,6 +3605,12 @@
             "value": "Supprimer"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Удалить"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -3482,6 +3662,12 @@
             "state": "translated",
             "value": "Odtwórz ponownie"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Повторить появление"
+          }
         }
       }
     },
@@ -3505,6 +3691,12 @@
             "value": "FC au repos"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Пульс в покое"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -3556,6 +3748,12 @@
             "state": "translated",
             "value": "Niespokojna noc"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Беспокойная ночь"
+          }
         }
       }
     },
@@ -3590,6 +3788,12 @@
             "state": "translated",
             "value": "Rzuć numerem"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Прокрутить число"
+          }
         }
       }
     },
@@ -3624,6 +3828,12 @@
             "state": "translated",
             "value": "MIĘKKIE PRZEJŚCIE KARTY"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "МЯГКИЙ ПЕРЕХОД КАРТОЧКИ"
+          }
         }
       }
     },
@@ -3658,6 +3868,12 @@
             "state": "translated",
             "value": "WYGLĄDAJĄ ZNACZNIE"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "ПОСЛЕДОВАТЕЛЬНОЕ ПОЯВЛЕНИЕ"
+          }
         }
       }
     },
@@ -3692,6 +3908,12 @@
             "state": "translated",
             "value": "RAMPA OBCIĄŻENIA"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "НАРАСТАНИЕ НАГРУЗКИ"
+          }
         }
       }
     },
@@ -3715,6 +3937,12 @@
             "value": "Enregistrer"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Сохранить"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -3766,6 +3994,12 @@
             "state": "translated",
             "value": "Liczba segmentów i wysokości"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Количество и высота сегментов"
+          }
         }
       }
     },
@@ -3800,6 +4034,12 @@
             "state": "translated",
             "value": "Wydajność snu"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Качество сна"
+          }
         }
       }
     },
@@ -3834,6 +4074,12 @@
             "state": "translated",
             "value": "Etapy snu"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Стадии сна"
+          }
         }
       }
     },
@@ -3970,6 +4216,12 @@
             "state": "translated",
             "value": "Przełącz delikatną wiosnę"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Переключить мягкую пружину"
+          }
         }
       }
     },
@@ -4004,6 +4256,12 @@
             "state": "translated",
             "value": "Wartości"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Значения"
+          }
         }
       }
     },
@@ -4072,6 +4330,12 @@
             "state": "translated",
             "value": "godzina %lld"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "час %lld"
+          }
         }
       }
     },
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 7af9492720..0bb776273b 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -703,6 +703,12 @@
             "state": "translated",
             "value": "%@ · typowo %@ do %@, %lld."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": " %@ · обычно от %@ до %@, %lld."
+          }
         }
       }
     },
@@ -1033,6 +1039,12 @@
             "state": "translated",
             "value": "%.2f V"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%.2f В"
+          }
         }
       }
     },
@@ -7404,6 +7416,12 @@
             "state": "translated",
             "value": "%@: %@. Za mało historii dla typowego asortymentu."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%@: %@. Пока недостаточно истории для типичного диапазона."
+          }
         }
       }
     },
@@ -8586,6 +8604,12 @@
             "state": "translated",
             "value": "%lld kilka dni temu"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%lld дней назад"
+          }
         }
       }
     },
@@ -13657,6 +13681,12 @@
             "state": "translated",
             "value": "%lld-%lld%@ · krok %lld"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%lld–%lld%@ · шаг %lld"
+          }
         }
       }
     },
@@ -14289,6 +14319,12 @@
             "state": "translated",
             "value": "%lld–%lld bpm"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "%lld–%lld уд/мин"
+          }
         }
       }
     },
@@ -14863,6 +14899,12 @@
             "state": "translated",
             "value": "Skala 0-%lld"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Шкала 0–%lld"
+          }
         }
       }
     },
@@ -15825,6 +15867,12 @@
             "state": "translated",
             "value": "1 minuta"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "1 мин"
+          }
         }
       }
     },
@@ -16973,6 +17021,12 @@
             "state": "translated",
             "value": "1 tydzień"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "1 неделя"
+          }
         }
       }
     },
@@ -17007,6 +17061,12 @@
             "state": "translated",
             "value": "1 trening"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "1 тренировка"
+          }
         }
       }
     },
@@ -17621,6 +17681,12 @@
             "state": "translated",
             "value": "2 dni"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "2 дня"
+          }
         }
       }
     },
@@ -17655,6 +17721,12 @@
             "state": "translated",
             "value": "2 minuty"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "2 мин"
+          }
         }
       }
     },
@@ -17689,6 +17761,12 @@
             "state": "translated",
             "value": "2 tygodnie"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "2 недели"
+          }
         }
       }
     },
@@ -18309,6 +18387,12 @@
             "state": "translated",
             "value": "5 min"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "5 мин"
+          }
         }
       }
     },
@@ -18691,6 +18775,12 @@
             "state": "translated",
             "value": "Wartość bazowa 7 nocy %lld ms, normalna %lld do %lld ms%@"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Норма за 7 ночей %lld мс, обычный диапазон %lld–%lld мс%@"
+          }
         }
       }
     },
@@ -19329,6 +19419,12 @@
             "state": "translated",
             "value": "Skrót chce dodać dni %lld i treningi %lld do źródła importu Apple Health."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Команда хочет добавить %lld дней и %lld тренировок в источник импорта Apple Health."
+          }
         }
       }
     },
@@ -19363,6 +19459,12 @@
             "state": "translated",
             "value": "Skrót chce dodać dane do źródła importu Apple Health."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Команда хочет добавить данные в источник импорта Apple Health."
+          }
         }
       }
     },
@@ -21531,6 +21633,12 @@
             "state": "translated",
             "value": "Szturchnięcie raz dziennie, gdy Twój Wysiłek osiągnie dolną granicę dzisiejszego optymalnego zakresu obciążenia, obliczonego na podstawie Twojego powrotu do zdrowia."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Одно напоминание в день, когда ваше Усилие достигает нижней границы сегодняшнего оптимального диапазона нагрузки, рассчитанного по вашему восстановлению."
+          }
         }
       }
     },
@@ -21868,6 +21976,12 @@
             "state": "translated",
             "value": "Odczyt tylko do odczytu Plews/Altini dotyczący najmniejszej i wartej uwagi zmiany twojego nocnego HRV: pokazuje, czy twoja 7-dniowa linia bazowa HRV znajduje się powyżej, wewnątrz czy poniżej twojego osobistego normalnego pasma. Nie zmienia to niczego innego - pierścień Energia jest identyczny niezależnie od tego, czy jest on włączony, czy wyłączony. Są to przybliżone/wczesne testy, które nie zostały jeszcze zweryfikowane w oparciu o różne rzeczywiste dane (n=1)."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Показатель ночной ВСР по методу наименьшего значимого изменения Plews/Altini, только для чтения: показывает, находится ли ваша 7-ночная норма ВСР выше, внутри или ниже вашего личного нормального диапазона. Больше он ничего не меняет — кольцо Заряда одинаково при включённой и выключенной настройке. Это черновое, раннее тестирование, ещё не проверенное на разнообразных реальных данных (n=1)."
+          }
         }
       }
     },
@@ -22605,6 +22719,12 @@
             "state": "translated",
             "value": "Przejrzysta receptura krążeniowo-oddechowa, która regeneruje głębiej i w fazie REM lepiej niż starsza wersja V1 i jest teraz domyślna. Zmienia się jedynie sposób podziału już wykrytych nocy na etapy (wykrywanie i wyniki pozostają niezmienione); wyłącz go, aby powrócić do wersji V1. Obowiązuje od kolejnych nocy scenicznych."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Прозрачная кардиореспираторная методика, которая восстанавливает глубокий сон и REM лучше прежней разметки V1 и теперь используется по умолчанию. Она меняет только то, как уже определённые ночи делятся на стадии (определение и оценки не меняются); выключите, чтобы вернуться к V1. Вступает в силу для следующих размеченных ночей."
+          }
         }
       }
     },
@@ -25947,6 +26067,12 @@
             "state": "translated",
             "value": "Dodaj poświadczenia aplikacji Oura do pliku OuraSecrets.xcconfig, aby to włączyć."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Добавьте учётные данные приложения Oura в OuraSecrets.xcconfig, чтобы включить это."
+          }
         }
       }
     },
@@ -26677,6 +26803,12 @@
             "state": "translated",
             "value": "Po wysiłku o dużej intensywności"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "После высокоинтенсивной нагрузки"
+          }
         }
       }
     },
@@ -27315,6 +27447,12 @@
             "state": "translated",
             "value": "Wszystkie działania"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Все активности"
+          }
         }
       }
     },
@@ -29757,6 +29895,12 @@
             "state": "translated",
             "value": "Uzbrojony w sam pasek za pomocą eksperymentalnego polecenia 5/MG. Budzenie napędzane paskiem jest nadal niepotwierdzone na 5/MG po naszej stronie (potwierdzone tylko na WHOOP 4.0), więc miej alarm zapasowy na wypadek wszystkiego, czego naprawdę nie możesz przegapić."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Устанавливается на самом браслете экспериментальной командой 5/MG. Пробуждение с браслета на 5/MG у нас пока не подтверждено (подтверждено только на WHOOP 4.0), поэтому оставьте резервный будильник для всего, что действительно нельзя пропустить."
+          }
         }
       }
     },
@@ -29791,6 +29935,12 @@
             "state": "translated",
             "value": "Uzbrojony w sam pasek, dzięki czemu może wibrować, gdy się obudzisz, nawet jeśli Twój telefon jest uśpiony lub NOOP jest zamknięty. Wysyła dokładną komendę alarmową wysyłaną przez oficjalną aplikację, potwierdzone brzęczenie na prawdziwym WHOOP 4.0 (przechwytywanie połączeń społecznościowych + test na urządzeniu, #535). Zachowaj alarm zapasowy na wypadek wszystkiego, czego naprawdę nie możesz przegapić."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Устанавливается на самом браслете, поэтому он может завибрировать в час пробуждения, даже если телефон спит или NOOP закрыт. Отправляет ровно ту команду будильника, что и официальное приложение; вибрация подтверждена на настоящем WHOOP 4.0 (перехват трафика сообществом + проверка на устройстве, #535). Оставьте резервный будильник для всего, что действительно нельзя пропустить."
+          }
         }
       }
     },
@@ -29883,6 +30033,12 @@
             "state": "translated",
             "value": "Uzbraja pasek, aby brzęczał w momencie przebudzenia, nawet jeśli NOOP jest zamknięty. Wysyła dokładną komendę alarmową wysyłaną przez oficjalną aplikację, potwierdzone brzęczenie na prawdziwym WHOOP 4.0 (przechwytywanie połączeń społecznościowych + test na urządzeniu, #535). Zachowaj alarm zapasowy na wypadek wszystkiego, czego naprawdę nie możesz przegapić."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Настраивает браслет на вибрацию в час пробуждения, даже если NOOP закрыт. Отправляет ровно ту команду будильника, что и официальное приложение; вибрация подтверждена на настоящем WHOOP 4.0 (перехват трафика сообществом + проверка на устройстве, #535). Оставьте резервный будильник для всего, что действительно нельзя пропустить."
+          }
         }
       }
     },
@@ -29964,6 +30120,12 @@
             "value": "Organiser Aujourd'hui"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Настроить «Сегодня»"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -34551,6 +34713,12 @@
             "state": "translated",
             "value": "Napięcie akumulatora %.2f w woltach"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Напряжение батареи %.2f вольт"
+          }
         }
       }
     },
@@ -34585,6 +34753,12 @@
             "state": "translated",
             "value": "Sonda informacji o akumulatorze (#592 RE)"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Проба сведений о батарее (#592 RE)"
+          }
         }
       }
     },
@@ -34619,6 +34793,12 @@
             "state": "translated",
             "value": "Sonda informacji o akumulatorze (#592 RE)…"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Проба сведений о батарее (#592 RE)…"
+          }
         }
       }
     },
@@ -34653,6 +34833,12 @@
             "state": "translated",
             "value": "Wynik sondy informacji o akumulatorze (#592)"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Результат пробы батареи (#592)"
+          }
         }
       }
     },
@@ -36579,6 +36765,12 @@
             "state": "translated",
             "value": "Sonda do lokalizacji ciała (#690 RE)"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Проба положения на теле (#690 RE)"
+          }
         }
       }
     },
@@ -36613,6 +36805,12 @@
             "state": "translated",
             "value": "Sonda do lokalizacji ciała (#690 RE)…"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Проба положения на теле (#690 RE)…"
+          }
         }
       }
     },
@@ -36647,6 +36845,12 @@
             "state": "translated",
             "value": "Wynik sondy lokalizacji ciała (#690)"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Результат пробы положения на теле (#690)"
+          }
         }
       }
     },
@@ -37859,6 +38063,12 @@
             "state": "translated",
             "value": "Wprowadź znaczniki CSV (data, znacznik, wartość, jednostka). Nazwy pasujące do katalogu należy złożyć na istniejące znaczniki; wszystko inne pojawia się jako znacznik niestandardowy. Wiersze, których nie można odczytać, są pomijane i liczone, nigdy nie zgadywane. Wszystko, co importujesz, pozostaje w %@."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Загрузите CSV с маркерами (дата, маркер, значение, единица). Названия, совпадающие с каталогом, объединяются с вашими существующими маркерами; всё остальное добавляется как свой маркер. Строки, которые не удалось прочитать, пропускаются и подсчитываются — никогда не угадываются. Всё импортированное остаётся на %@."
+          }
         }
       }
     },
@@ -37940,6 +38150,12 @@
             "value": "Diffusion des ressources humaines de ce téléphone"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Транслировать пульс с этого телефона"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -38212,6 +38428,12 @@
             "value": "Sangle de diffusion HR (Garmin/ANT)"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Транслировать пульс браслета (Garmin/ANT)"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -41359,6 +41581,12 @@
             "state": "translated",
             "value": "Kalibracja (%lld/%lld w nocy)"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Калибровка (%lld из %lld ночей)"
+          }
         }
       }
     },
@@ -43118,6 +43346,12 @@
             "state": "translated",
             "value": "Zmień na numer"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Сменить на число"
+          }
         }
       }
     },
@@ -43152,6 +43386,12 @@
             "state": "translated",
             "value": "Zmień na Tak/Nie"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Сменить на «Да/Нет»"
+          }
         }
       }
     },
@@ -44358,6 +44598,12 @@
             "state": "translated",
             "value": "Energia porównuje Twój HRV z Twoim osobistym poziomem bazowym (~55%%), tętnem spoczynkowym (~20%%), jakością odpoczynku (~15%%), oddychaniem (~5%%) i odchyleniem temperatury skóry (~5%%). Wysiłek to obciążenie układu krążenia 0-%lld od czasu w strefach tętna. Odpoczynek jest inscenizowany na podstawie ruchu i tętna. Wszystko jest tutaj obliczane na podstawie surowych danych paska. Działa każdego dnia NOOP zbiera surowe strumienie."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Заряд сопоставляет вашу ВСР с личной нормой (~55%%), пульс в покое (~20%%), качество отдыха (~15%%), дыхание (~5%%) и отклонение температуры кожи (~5%%). Усилие — это сердечно-сосудистая нагрузка 0–%lld по времени в зонах пульса. Отдых размечается по движению и пульсу. Всё вычисляется здесь по сырым данным браслета. Работает для любого дня, за который NOOP собрал сырые потоки."
+          }
         }
       }
     },
@@ -56090,6 +56336,12 @@
             "state": "translated",
             "value": "Dzień 1: jasne światło %@-%@, wyłączenie świateł wokół %@."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "День 1: яркий свет %@–%@, отбой около %@."
+          }
         }
       }
     },
@@ -57839,6 +58091,12 @@
             "value": "Carreaux détaillés"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Подробные плитки"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -61522,6 +61780,12 @@
             "state": "translated",
             "value": "ALGORYTMY EKSPERYMENTALNE"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Экспериментальные алгоритмы"
+          }
         }
       }
     },
@@ -61858,6 +62122,12 @@
             "state": "translated",
             "value": "Każda linia pokazuje, o ile uderzeń na minutę zmieniło się tętno po wysiłku. Uwzględniane są tylko treningi o wysokiej intensywności z zarejestrowanym tętnem po treningu."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Каждая линия показывает, на сколько ударов в минуту изменился ваш пульс после нагрузки. Учитываются только высокоинтенсивные тренировки с записанным пульсом после тренировки."
+          }
         }
       }
     },
@@ -70633,6 +70903,12 @@
             "state": "translated",
             "value": "Zapomnij o dostępie Oura"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Забыть доступ к Oura"
+          }
         }
       }
     },
@@ -73141,6 +73417,12 @@
             "state": "translated",
             "value": "Grupa"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Группа"
+          }
         }
       }
     },
@@ -73529,6 +73811,12 @@
             "state": "translated",
             "value": "GODZINY SNU"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "ЧАСОВ СНА"
+          }
         }
       }
     },
@@ -74272,6 +74560,12 @@
             "value": "Interpolation du sous-logement HR-from-PPG (v26)"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Пульс из PPG: интерполяция внутри задержки (заполнение пропусков v26)"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -74898,6 +75192,12 @@
             "value": "Préparation à la VFC (Plews/Altini)"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Готовность по ВСР (Plews/Altini)"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -74938,6 +75238,12 @@
             "value": "Préparation à la VFC (expérimental)"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Готовность по ВСР (эксперимент)"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -74989,6 +75295,12 @@
             "state": "translated",
             "value": "Gotowość HRV (eksperymentalna): %@"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Готовность по ВСР (эксперимент): %@"
+          }
         }
       }
     },
@@ -75128,6 +75440,12 @@
             "value": "Fenêtre VFC"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Окно ВСР"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -75598,6 +75916,12 @@
             "state": "translated",
             "value": "Uwaga: ten tryb testowy jest wyłączony, więc raport nie zawiera jego przechwytywania. Aby otrzymać przydatny raport, włącz tryb, odtwórz problem podczas noszenia paska, a następnie zgłoś ponownie."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Внимание: этот тестовый режим выключен, поэтому в отчёте нет соответствующего захвата. Чтобы отчёт был полезен, включите режим, воспроизведите проблему в надетом браслете и отправьте отчёт заново."
+          }
         }
       }
     },
@@ -76120,6 +76444,12 @@
             "state": "translated",
             "value": "Tętno Regeneracja"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Восстановление пульса"
+          }
         }
       }
     },
@@ -76566,6 +76896,12 @@
             "state": "translated",
             "value": "Odzyskiwanie tętna przy %@, %lld uderzeń na minutę"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Восстановление пульса на %@, %lld ударов в минуту"
+          }
         }
       }
     },
@@ -76600,6 +76936,12 @@
             "state": "translated",
             "value": "Odzyskiwanie tętna przy %@, niedostępne"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Восстановление пульса на %@ — нет данных"
+          }
         }
       }
     },
@@ -77046,6 +77388,12 @@
             "state": "translated",
             "value": "Trend odzyskiwania tętna w uderzeniach na minutę"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Тренд восстановления пульса в ударах в минуту"
+          }
         }
       }
     },
@@ -77080,6 +77428,12 @@
             "state": "translated",
             "value": "Odzyskiwanie tętna · %@"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Восстановление пульса · %@"
+          }
         }
       }
     },
@@ -78171,6 +78525,12 @@
             "value": "L'histoire reste sous la question originale donc WHOOP importations toujours en ligne."
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "История остаётся под исходным вопросом, чтобы импорт из WHOOP по-прежнему совпадал."
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -80313,6 +80673,12 @@
             "state": "translated",
             "value": "Jak to odczytać: HRV, tętno spoczynkowe, czas snu, częstość oddechów i temperatura skóry są mierzone za pomocą paska (temperatura skóry jest pokazana jako odchylenie od własnej wartości bazowej). Treningi to liczba zarejestrowanych lub wykrytych aktywności. Regeneracja, Obciążenie i Stres to własne wyniki NOOP na urządzeniu, a nie pomiary kliniczne: Regeneracja to połączenie codziennej gotowości (HRV, tętno spoczynkowe, trend snu i temperatury skóry), Obciążenie to obciążenie układu sercowo-naczyniowego obliczone na podstawie tętna, a Stres to wskaźnik obciążenia autonomicznego wynoszący 0-3 na podstawie tętna spoczynkowego i tętna HRV."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Как это читать: ВСР, пульс в покое, длительность сна, частота дыхания и температура кожи измеряются браслетом (температура кожи показана как отклонение от вашей собственной нормы). «Тренировки» — количество активностей, которые вы записали или которые были определены автоматически. Восстановление, Нагрузка и Стресс — собственные оценки NOOP на устройстве, а не клинические показатели: Восстановление — это суточный сводный показатель готовности (ВСР, пульс в покое, сон и тренд температуры кожи), Нагрузка — сердечно-сосудистая нагрузка, выведенная из пульса, а Стресс — индекс вегетативной нагрузки 0–3 по пульсу в покое и ВСР."
+          }
         }
       }
     },
@@ -82274,6 +82640,12 @@
             "state": "translated",
             "value": "Zaimportować dane Apple Health?"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Импортировать данные Apple Health?"
+          }
         }
       }
     },
@@ -82598,6 +82970,12 @@
             "state": "translated",
             "value": "Zaimportuj ponownie"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Импортировать снова"
+          }
         }
       }
     },
@@ -85694,6 +86072,12 @@
             "value": "Rappel du journal"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Напоминание о журнале"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -86082,6 +86466,12 @@
             "value": "Garder les derniers instantanés"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Хранить последние снимки"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -86592,6 +86982,12 @@
             "value": "Démarrage à (batterie)"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Включать при (заряде браслета)"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -90687,6 +91083,12 @@
             "state": "translated",
             "value": "Liquid Today (prototyp)"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Liquid Today (прототип)"
+          }
         }
       }
     },
@@ -91180,6 +91582,12 @@
             "value": "Sessions en direct (bêta)"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Сессии в реальном времени (бета)"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -93409,6 +93817,12 @@
             "value": "Remplir le journal du jour"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Заполнить журнал за сегодня"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -94099,6 +94513,12 @@
             "value": "Des plages plus longues déverrouillent comme plus d'histoire construit."
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Более длинные диапазоны открываются по мере накопления истории."
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -94156,6 +94576,12 @@
             "state": "translated",
             "value": "Najdłuższy: %lld dni"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Дольше всего: %lld дней"
+          }
         }
       }
     },
@@ -94196,6 +94622,12 @@
             "state": "translated",
             "value": "Najdłuższy: 1 dzień"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Дольше всего: 1 день"
+          }
         }
       }
     },
@@ -99475,6 +99907,12 @@
             "value": "Raffinement de la sillage en mouvement"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Уточнение пробуждения по движению"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -99812,6 +100250,12 @@
             "value": "Bouge de toute façon"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Всё равно перенести"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -99910,6 +100354,12 @@
             "value": "Bouge ce sommeil ?"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Перенести этот сон?"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -100971,6 +101421,12 @@
             "state": "translated",
             "value": "NOOP daje trzy dzienne wyniki (Energia, Wysiłek i Odpoczynek), każdy w skali 0-100. Są one tworzone na podstawie surowych sygnałów Twojego paska na podstawie opublikowanych, recenzowanych wyników badań sportowych i obliczane w całości na Twoim urządzeniu. NIE są to wyniki WHOOP: nie mamy prywatnych algorytmów WHOOP i nie udajemy, że je mamy. Mają na celu te same trzy pytania, korzystając z otwartej nauki, więc zazwyczaj śledzą kierunek WHOOP, ale nie dopasowują liczby do liczby. I o to właśnie chodzi."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "NOOP даёт три ежедневные оценки (Заряд, Усилие и Отдых), каждая по шкале 0–100. Они строятся по сырым сигналам вашего браслета на основе опубликованной, прошедшей рецензирование спортивной науки и вычисляются целиком на вашем устройстве. Это НЕ оценки WHOOP: у нас нет закрытых алгоритмов WHOOP, и мы не притворяемся, что есть. Они отвечают на те же три вопроса средствами открытой науки, поэтому обычно совпадают с оценками WHOOP по направлению, но не сходятся число в число. В этом и смысл."
+          }
         }
       }
     },
@@ -106456,6 +106912,12 @@
             "state": "translated",
             "value": "Brak szczegółów tętna tej nocy"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Нет данных о пульсе за эту ночь"
+          }
         }
       }
     },
@@ -107244,6 +107706,12 @@
             "state": "translated",
             "value": "Żadnych nowych nocy z Twojego paska przez %lld dni. Sprawdź, czy jest podłączony i zapisuje dane."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Нет новых ночей с вашего браслета уже %lld дней. Проверьте, что он подключён и сохраняет данные."
+          }
         }
       }
     },
@@ -107632,6 +108100,12 @@
             "state": "translated",
             "value": "Brak zdjęcia → rezerwowa osoba.przycięcie.koło"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Нет фото → запасной вариант person.crop.circle"
+          }
         }
       }
     },
@@ -112265,6 +112739,12 @@
             "state": "translated",
             "value": "Powiadamiaj, kiedy zostanie osiągnięte optymalne napięcie"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Уведомлять о достижении оптимальной нагрузки"
+          }
         }
       }
     },
@@ -113344,6 +113824,12 @@
             "state": "translated",
             "value": "Starsze kopie zapasowe przekraczające tę liczbę są usuwane w kolejności od najstarszej (≈ tyle dni). Jeśli dane kiedykolwiek ulegną uszkodzeniu, przywróć najnowszą wersję."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Более старые копии сверх этого числа удаляются, начиная с самых старых (≈ столько дней). Если данные когда-нибудь повредятся, восстановите самую свежую."
+          }
         }
       }
     },
@@ -115248,6 +115734,12 @@
             "value": "Ouvrir le journal"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Открыть журнал"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -115892,6 +116384,12 @@
             "state": "translated",
             "value": "Osiągnięto optymalne napięcie"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Достигнута оптимальная нагрузка"
+          }
         }
       }
     },
@@ -118741,6 +119239,12 @@
             "value": "Capture de la VFC en pause"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Приостановить сбор ВСР"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -118920,6 +119424,12 @@
             "state": "translated",
             "value": "Szczyt %lld bpm"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Пик %lld уд/мин"
+          }
         }
       }
     },
@@ -120655,6 +121165,12 @@
             "value": "Veuillez confirmer chacun de ces éléments :"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Пожалуйста, подтвердите каждый пункт:"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -120753,6 +121269,12 @@
             "value": "Veuillez lire les points ci-dessous, puis confirmer chaque déclaration."
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Пожалуйста, прочитайте пункты ниже, затем подтвердите каждое утверждение."
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -120984,6 +121506,12 @@
             "state": "translated",
             "value": "Posty po zsynchronizowaniu paska i zdobyciu punktów NOOP w danym dniu — a nie dokładnie w chwili, gdy go przekroczysz. Najwyżej raz dziennie."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Появляется после синхронизации браслета и подсчёта оценок за день — не в ту самую секунду, когда вы пересекаете порог. Не чаще раза в день."
+          }
         }
       }
     },
@@ -121007,6 +121535,12 @@
             "value": "Mode d'économie d'énergie"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Режим энергосбережения"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -124111,6 +124645,12 @@
             "state": "translated",
             "value": "REGENERUJĄCY SEN"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "ВОССТАНАВЛИВАЮЩИЙ СОН"
+          }
         }
       }
     },
@@ -125608,6 +126148,12 @@
             "state": "translated",
             "value": "Odczytaj tętno, HRV, zawartość tlenu we krwi, częstość oddechów, sen, kroki i energię prosto z Apple Health i zapisz z powrotem dane paska NOOP: sen z pełnymi etapami, ciągłe tętno, treningi i nocne parametry życiowe. Wszystko pozostaje na %@."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Читайте пульс, ВСР, насыщение крови кислородом, частоту дыхания, сон, шаги и энергию прямо из Apple Health и записывайте данные браслета NOOP обратно: сон с полными стадиями, непрерывный пульс, тренировки и ночные показатели. Всё остаётся на %@."
+          }
         }
       }
     },
@@ -126670,6 +127216,12 @@
             "state": "translated",
             "value": "Odczyty"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Измерения"
+          }
         }
       }
     },
@@ -127180,6 +127732,12 @@
             "state": "translated",
             "value": "Zrestartuj sondę (4.0 RE)…"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Проба перезагрузки (4.0 RE)…"
+          }
         }
       }
     },
@@ -128688,6 +129246,12 @@
             "state": "translated",
             "value": "Trend Regeneracja"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Тренд восстановления"
+          }
         }
       }
     },
@@ -129193,6 +129757,12 @@
             "state": "translated",
             "value": "Odśwież wiek fitness"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Обновить фитнес-возраст"
+          }
         }
       }
     },
@@ -130806,6 +131376,12 @@
             "value": "Renommer l'élément"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Переименовать пункт"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -130846,6 +131422,12 @@
             "value": "Renommer..."
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Переименовать…"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -131129,6 +131711,12 @@
             "state": "translated",
             "value": "Zastępuje zakładkę Dzisiaj przeprojektowanym prototypem. Wyłącz tę opcję w dowolnym momencie, aby powrócić do klasycznego pulpitu nawigacyjnego. Odczytuje te same dane w czasie rzeczywistym z Twojego paska."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Заменяет вкладку «Сегодня» прототипом нового дизайна. Выключите в любой момент, чтобы вернуться к классической панели. Читает те же живые данные с вашего браслета."
+          }
         }
       }
     },
@@ -131395,6 +131983,12 @@
             "state": "translated",
             "value": "Alternatywy klasy badawczej / ulepszenia precyzyjne. Możliwość zapisania się, domyślnie wyłączona, niekliniczna."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Исследовательские альтернативы и точная подстройка. По желанию, по умолчанию выключено, не для клинического применения."
+          }
         }
       }
     },
@@ -132923,6 +133517,12 @@
             "state": "translated",
             "value": "Uruchomić ponownie %@? Podczas ponownego uruchamiania rozłącza się na około 30 sekund, po czym samoczynnie łączy się ponownie. Twoje zapisane dane zostaną zachowane."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Перезапустить %@? Он отключится примерно на 30 секунд, пока перезагружается, затем подключится сам. Записанные данные сохраняются."
+          }
         }
       }
     },
@@ -132957,6 +133557,12 @@
             "state": "translated",
             "value": "Uruchom ponownie pasek…"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Перезапустить браслет…"
+          }
         }
       }
     },
@@ -132980,6 +133586,12 @@
             "value": "Redémarrer cette sangle ?"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Перезапустить этот браслет?"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -133037,6 +133649,12 @@
             "state": "translated",
             "value": "Uruchomiony ponownie po ponownej kalibracji %@ — nie trzeba go ponownie dotykać."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Перезапущено, когда вы откалибровали заново %@ — повторно нажимать не нужно."
+          }
         }
       }
     },
@@ -134545,6 +135163,12 @@
             "state": "translated",
             "value": "Przeglądaj każdy punktowany blok budzenia pod kątem rzeczywistych dowodów na wstawanie (rytm chodu, zmiana pozycji ciała), a nie tylko wzrost tętna. Blokada bez ruchu i stabilna postawa – gorąca noc, krótki obrót – ponownie zapada w lekki sen; prawdziwe wstawanie zostaje pozostawione w spokoju. Samoczynnie sprawdza, ile szczegółów ruchu faktycznie zarejestrował Twój pasek, i pozostaje wyłączony w nocy, w której nie można ufać (głównie starsze oprogramowanie WHOOP 4.0). Domyślnie wyłączone; obowiązuje od kolejnych wystawianych nocy."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Проверяет каждый оценённый блок бодрствования на реальные признаки подъёма (ритм шагов, смена положения тела), а не только на рост пульса. Блок бодрствования без перемещения и с устойчивой позой — жаркая ночь, короткий переворот — возвращается в лёгкий сон; настоящий подъём остаётся как есть. Сам проверяет, сколько данных о движении действительно записал браслет, и остаётся выключенным в ночь, где их слишком мало, чтобы доверять (в основном старые прошивки WHOOP 4.0). По умолчанию выключено; вступает в силу для следующих размеченных ночей."
+          }
         }
       }
     },
@@ -135745,6 +136369,12 @@
             "state": "translated",
             "value": "Uruchamia ciągły strumień HRV tylko w godzinach ciszy nocnej (domyślnie 22:00–07:00), co zmniejsza koszt baterii mniej więcej o połowę. Odczyty stresu w ciągu dnia będą rzadsze. Uwaga: ciągłe przechwytywanie HRV w tle (w tym drzemki w ciągu dnia) jest wstrzymywane poza tym oknem. W przypadku odczytów HRV na żądanie w ciągu dnia (w tym drzemek) użyj przycisku „Wykonaj odczyt HRV” na ekranie Na żywo."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Запускает непрерывный поток ВСР только в ваши тихие часы (по умолчанию 22:00–07:00), примерно вдвое снижая расход батареи. Дневные измерения стресса станут реже. Примечание: непрерывный фоновый сбор ВСР (включая дневной сон) вне этого окна приостановлен. Для дневных измерений ВСР по запросу (в том числе во время дневного сна) используйте кнопку «Сделать замер ВСР» на экране «В реальном времени»."
+          }
         }
       }
     },
@@ -140099,6 +140729,12 @@
             "state": "translated",
             "value": "Wyślij sondę (tylko do odczytu)"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Отправить пробу (только чтение)"
+          }
         }
       }
     },
@@ -140133,6 +140769,12 @@
             "state": "translated",
             "value": "Wysyła GET_BODY_LOCATION_AND_STATUS (0x54) tylko do odczytu i pokazuje pełną nieprzetworzoną odpowiedź paska, dekodując zapis lokalizacji ciała (wersja/lokalizacja/pewność/status) w WHOOP 4.0. Nic nie jest zapisane na pasku i nigdy nie zmienia sposobu wykrywania zużycia ani punktacji."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Отправляет команду только для чтения GET_BODY_LOCATION_AND_STATUS (0x54) и показывает полный сырой ответ браслета, декодируя запись о положении на теле (ревизия / положение / достоверность / статус) на WHOOP 4.0. На браслет ничего не записывается, и это никогда не меняет определение ношения или оценки."
+          }
         }
       }
     },
@@ -141997,6 +142639,12 @@
             "value": "Afficher une carte Aujourd'hui vous rappelant de remplir votre journal"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Показывать карточку на «Сегодня» с напоминанием заполнить журнал"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -142802,6 +143450,12 @@
             "state": "translated",
             "value": "Trening pasków polegający na ciszy podczas treningów."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Подсказки браслета во время тренировок — по умолчанию молча."
+          }
         }
       }
     },
@@ -145440,6 +146094,12 @@
             "value": "Stade de sommeil (V2)"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Определение стадий сна (V2)"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -145665,6 +146325,12 @@
             "state": "translated",
             "value": "Tętno podczas snu w nocy"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Пульс во сне в течение ночи"
+          }
         }
       }
     },
@@ -145926,6 +146592,12 @@
             "value": "Lentifie le sangle de fond (toutes les 45 min au lieu de 15) tandis que la batterie de votre sangle est basse. Aucune perte de données — la sangle accumule tout, donc synchronise juste les lots dans des tirages plus grands et moins fréquents."
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Замедляет фоновую синхронизацию с браслетом (каждые 45 минут вместо 15), пока заряд браслета низкий. Потери данных нет — браслет всё накапливает, поэтому синхронизация просто идёт более крупными и редкими порциями."
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -147150,6 +147822,12 @@
             "value": "Tuiles carrées avec un graphique de tendance sous la barre."
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Более квадратные плитки с графиком тренда под полосой."
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -150631,6 +151309,12 @@
             "state": "translated",
             "value": "Cel Obciążenie"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Целевая нагрузка"
+          }
         }
       }
     },
@@ -152035,6 +152719,12 @@
             "state": "translated",
             "value": "Pasemko"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Серия"
+          }
         }
       }
     },
@@ -155899,6 +156589,12 @@
             "state": "translated",
             "value": "Kliknij dzień, aby nadrobić zaległości"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Нажмите на день, чтобы наверстать"
+          }
         }
       }
     },
@@ -155991,6 +156687,12 @@
             "state": "translated",
             "value": "Kliknij etap, aby porównać go z typowym 30-dniowym."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Нажмите на стадию, чтобы сравнить с вашим типичным значением за 30 дней."
+          }
         }
       }
     },
@@ -157087,6 +157789,12 @@
             "state": "translated",
             "value": "Dlatego Energia przeznaczony tylko do oglądania rozpoczyna się od „Kalibracji”. NOOP potrzebuje około siedmiu nocy Twojego HRV, aby dowiedzieć się, jak wygląda normalność w Twoim przypadku. Dopóki ich nie ma, raczej wstrzymuje wynik niż zgaduje. Po ustawieniu linii bazowej Twój Energia pojawi się pewnie, w tej samej skali 0-100, co pasek."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Поэтому Заряд, построенный только по часам, сначала показывает «Калибровку». NOOP нужно около семи ночей вашей ВСР, чтобы понять, что для вас нормально. Пока их нет, он не показывает оценку, вместо того чтобы гадать. Как только норма определена, ваш Заряд появляется вместе с его достоверностью, по той же шкале 0–100, что и у браслета."
+          }
         }
       }
     },
@@ -157237,6 +157945,12 @@
             "state": "translated",
             "value": "Ramka ponownego uruchomienia WHOOP 4.0 nie została potwierdzona — normalne ponowne uruchomienie jest ignorowane (#235). Wyślij każdego kandydata i obejrzyj ZARÓWNO dziennik paska, jak i sam pasek. „brak rozłączenia w ciągu 12 s” oznacza, że ​​pasek zignorował ramę. Linia „opuszczone ogniwo” oznacza, że ​​rama dotarła do paska — ale samo upuszczone ogniwo nie oznacza ponownego uruchomienia: prawdziwe ponowne uruchomienie powoduje również wyłączenie na kilka sekund lampki czujnika paska, zatem jeśli lampka pozostanie włączona, oznacza to po prostu zerwanie połączenia, a nie ponowne uruchomienie. Nieniszczące — Twoje dane są przechowywane. Udostępnij log, abyśmy mogli przypiąć prawdziwą ramkę."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Кадр перезагрузки WHOOP 4.0 не подтверждён — обычный перезапуск игнорируется (#235). Отправляйте каждый вариант и следите И за журналом браслета, И за самим браслетом. «нет отключения за 12 с» означает, что браслет проигнорировал кадр. Строка «связь потеряна» означает, что кадр дошёл до браслета, — но одна лишь потеря связи ещё не перезагрузка: при настоящей перезагрузке датчик браслета также гаснет на несколько секунд, поэтому если подсветка не погасла, это был просто обрыв соединения, а не перезагрузка. Ничего не разрушается — ваши данные сохраняются. Пожалуйста, поделитесь журналом, чтобы мы могли определить настоящий кадр."
+          }
         }
       }
     },
@@ -157503,6 +158217,12 @@
             "state": "translated",
             "value": "Zmiana tętna pod koniec ćwiczeń. Wartości dodatnie oznaczają spadek tętna; myślnik oznacza, że ​​w tej minucie pasek nie zarejestrował wystarczającej ilości danych."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Изменение относительно вашего пульса в конце нагрузки. Положительные значения означают, что пульс снизился; прочерк означает, что браслет не записал достаточно данных около этой минуты."
+          }
         }
       }
     },
@@ -157653,6 +158373,12 @@
             "state": "translated",
             "value": "Linia to przybliżony wskaźnik 0-3 każdej godziny czuwania, porównany z Twoimi dzisiejszymi spokojnymi godzinami. Poniższy pasek dzieli Twój dzień na czas spokoju, umiarkowanego i dużego stresu."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Линия — это показатель 0–3 за каждый час бодрствования, оценённый относительно ваших собственных спокойных часов сегодня. Полоса ниже делит ваш день на время спокойного, умеренного и высокого стресса."
+          }
         }
       }
     },
@@ -158157,6 +158883,12 @@
             "state": "translated",
             "value": "Pasek zgłasza inny czas niż wysyła NOOP, więc alarm oprogramowania sprzętowego nie włączy się o godzinie pobudki — zwykle jest to pasek, którego zegar lub alarm został zresetowany. Zresetuj pasek w oficjalnej aplikacji WHOOP (lub naładuj go do pełna i podłącz ponownie), a budzik w telefonie będzie włączał się do momentu, aż to nastąpi."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Браслет продолжает сообщать время, отличное от отправленного NOOP, поэтому его встроенный будильник не сработает в час вашего пробуждения — обычно это браслет, у которого сбросились часы или будильник. Сбросьте браслет в официальном приложении WHOOP (или полностью зарядите его и подключите заново), а до тех пор используйте будильник в «Часах» телефона."
+          }
         }
       }
     },
@@ -160379,6 +161111,12 @@
             "value": "Cela déplace la nuit à une heure sans données enregistrées. Les étapes ne peuvent pas être dérivées là, donc il peut apparaître comme vide jusqu'à ce que les données le couvrent."
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Это перенесёт ночь на время, где нет записанных данных. Стадии там вывести нельзя, поэтому она может отображаться пустой, пока данные её не покроют."
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -164371,6 +165109,12 @@
             "value": "Tableaux de tendances"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Графики трендов"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -164480,6 +165224,12 @@
             "state": "translated",
             "value": "Okno trendu"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Окно тренда"
+          }
         }
       }
     },
@@ -165350,6 +166100,12 @@
             "state": "translated",
             "value": "Włącz powiadomienia dla NOOP w Ustawieniach, aby otrzymać przypomnienie o odpoczynku."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Включите уведомления для NOOP в Настройках, чтобы получать напоминание о подготовке ко сну."
+          }
         }
       }
     },
@@ -165442,6 +166198,12 @@
             "state": "translated",
             "value": "Dwie niezależne tabele protokołów nie zgadzają się co do kodu operacji o rozszerzonej baterii (98 vs 87). Spowoduje to wysłanie wybranego numeru 98 w trybie tylko do odczytu i wyświetlenie pełnej nieprzetworzonej odpowiedzi paska. Ładunek przypominający baterię potwierdza 98 w oprogramowaniu sprzętowym; krótki odcinek oznacza, że ​​pozostaje niejednoznaczny. Na pasku nic nie jest zapisane."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Две независимые таблицы протокола расходятся в коде расширенных данных о батарее (98 против 87). Здесь отправляется проверенная команда только для чтения 98 и показывается полный сырой ответ браслета. Ответ в формате батареи подтверждает 98 на вашей прошивке; короткая заглушка означает, что вопрос остаётся открытым. На браслет ничего не записывается."
+          }
         }
       }
     },
@@ -165697,6 +166459,12 @@
             "value": "Annuler"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Отменить"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -168499,6 +169267,12 @@
             "value": "Sonde de redémarrage WHOOP 4.0"
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Проба перезагрузки WHOOP 4.0"
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -170297,6 +171071,12 @@
             "state": "translated",
             "value": "Czekam na odpowiedź paska…"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Ожидание ответа браслета…"
+          }
         }
       }
     },
@@ -171439,6 +172219,12 @@
             "state": "translated",
             "value": "Porównujemy dzisiejsze tętno spoczynkowe i HRV z Twoją własną wartością bazową z 30 dni. Wyższe niż zwykle tętno spoczynkowe i niższe niż zwykle HRV podnoszą wynik, co jest klasycznym sygnałem, że organizm jest pobudzony. Połączone przesunięcie jest odwzorowywane na skali 0-3: 0 oznacza spokój, 1,5 znajduje się na poziomie podstawowym, 3 jest wysoce aktywowany."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Мы сравниваем сегодняшние пульс в покое и ВСР с вашей собственной 30-дневной нормой. Более высокий, чем обычно, пульс в покое и более низкая, чем обычно, ВСР — оба повышают оценку: классические признаки активации организма. Совокупный сдвиг отображается на шкалу 0–3: 0 — спокойствие, 1,5 — ваша норма, 3 — сильная активация."
+          }
         }
       }
     },
@@ -174177,6 +174963,12 @@
             "state": "translated",
             "value": "Kiedy NOOP rekonstruuje tętno na podstawie fali optycznej WHOOP 5/MG v26 (sekundy, w których pasek nie zapisuje HR), doprecyzuj pik autokorelacji za pomocą parabolicznego dopasowania z sub-opóźnieniem, aby oszacowanie nie było kwantyzowane do około 16 kroków bpm w pobliżu wysokiego HR. Wypełnia tylko sekundy, o których pasek nigdy nie raportował; nigdy nie zastępuje zapisanego HR. Tylko 5/MG, domyślnie wyłączone."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Когда NOOP восстанавливает пульс по оптическому сигналу v26 WHOOP 5/MG (за секунды, для которых браслет не сохранил пульс), уточнять пик автокорреляции параболической подгонкой внутри задержки, чтобы оценка не квантовалась шагами примерно по 16 уд/мин при высоком пульсе. Заполняются только секунды, которые браслет никогда не передавал; сохранённый пульс никогда не перезаписывается. Только 5/MG, по умолчанию выключено."
+          }
         }
       }
     },
@@ -175031,6 +175823,12 @@
             "value": "Quand la batterie de votre bracelet est basse, arrêtez le flux de VFC en arrière-plan, ce qui sollicite le plus votre bracelet. Un écran Live affiche toujours la fréquence cardiaque, et il recommence automatiquement une fois le bracelet chargé."
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Пока заряд браслета низкий, останавливать постоянный фоновый поток ВСР — самый большой непрерывный расход для браслета. Экран «В реальном времени» по-прежнему показывает пульс, а поток включится сам, как только браслет зарядится."
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -175071,6 +175869,12 @@
             "value": "Toute la nuit est la mesure par défaut de NOOP; Le sommeil profond met en commun la VFC sur le sommeil à ondes lentes uniquement, en lisant plus bas et correspondant à WHOOP. Un changement recalcule vos dernières nuits sur la nouvelle fenêtre et prend effet dès que vous avez quelques nuits de données."
           }
         },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Вся ночь — мера NOOP по умолчанию; «Глубокий сон» собирает ВСР только по медленноволновому сну, даёт более низкие значения и совпадает с WHOOP. Переключение пересчитает ваши недавние ночи по новому окну и вступит в силу сразу, как только накопится несколько ночей данных."
+          }
+        },
         "zh-Hans": {
           "stringUnit": {
             "state": "translated",
@@ -178507,6 +179311,12 @@
             "state": "translated",
             "value": "Osiągnąłeś dzisiejsze optymalne docelowe odkształcenie %lld. Niezła robota – zasłużyłeś na powrót do zdrowia."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Вы достигли сегодняшней цели по нагрузке — %lld. Отличная работа, ваше восстановление это заслужило."
+          }
         }
       }
     },
@@ -181132,6 +181942,12 @@
             "state": "translated",
             "value": "Twój pasek nie akceptuje alarmu"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Ваш браслет не принимает будильник"
+          }
         }
       }
     },
@@ -181654,6 +182470,12 @@
             "state": "translated",
             "value": "Strefa %lld: %lld-%lld bpm (%lld-%lld%% max HR)"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Зона %lld: %lld–%lld уд/мин (%lld–%lld%% от макс. пульса)"
+          }
         }
       }
     },
@@ -184097,6 +184919,12 @@
             "state": "translated",
             "value": "dzień z rzędu"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "день подряд"
+          }
         }
       }
     },
@@ -184137,6 +184965,12 @@
             "state": "translated",
             "value": "dni z rzędu"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "дней подряд"
+          }
         }
       }
     },
@@ -192416,6 +193250,12 @@
             "state": "translated",
             "value": "zazwyczaj %@"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "обычно %@"
+          }
         }
       }
     },
@@ -192920,6 +193760,12 @@
             "state": "translated",
             "value": "Historia v%lld"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "история v%lld"
+          }
         }
       }
     },
@@ -208106,6 +208952,12 @@
             "state": "translated",
             "value": "Obciążenie treningowe"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Тренировочная нагрузка"
+          }
         }
       }
     },
@@ -208140,6 +208992,12 @@
             "state": "translated",
             "value": "CTL · Kondycja"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "CTL · Форма"
+          }
         }
       }
     },
@@ -208174,6 +209032,12 @@
             "state": "translated",
             "value": "ATL · Zmęczenie"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "ATL · Усталость"
+          }
         }
       }
     },
@@ -208208,6 +209072,12 @@
             "state": "translated",
             "value": "Kondycja 42-dniowa vs zmęczenie 7-dniowe"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "42-дневная форма против 7-дневной усталости"
+          }
         }
       }
     },
@@ -208242,6 +209112,12 @@
             "state": "translated",
             "value": "Budowanie — %1$lld z %2$lld dni"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Формируется — %lld из %lld дней"
+          }
         }
       }
     },
@@ -208276,6 +209152,12 @@
             "state": "translated",
             "value": "Obciążenie przewlekłe vs ostre"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Хроническая против острой нагрузки"
+          }
         }
       }
     },
@@ -208310,6 +209192,12 @@
             "state": "translated",
             "value": "Wymaga %1$lld+ kolejnych dni Wysiłku, aby zacząć. Na razie %2$lld."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Нужно %lld+ подряд дней с Усилием, чтобы начать. Пока %lld."
+          }
         }
       }
     },
@@ -208344,6 +209232,12 @@
             "state": "translated",
             "value": "Forma"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Форма"
+          }
         }
       }
     },
@@ -208378,6 +209272,12 @@
             "state": "translated",
             "value": "Obciążenie treningowe: przewlekłe vs ostre"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Тренировочная нагрузка: хроническая против острой"
+          }
         }
       }
     },
@@ -208412,6 +209312,12 @@
             "state": "translated",
             "value": "Rzadsze odświeżanie"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Редкое обновление"
+          }
         }
       }
     },
@@ -208446,6 +209352,12 @@
             "state": "translated",
             "value": "Synchronizuje w tle co godzinę zamiast co 15 minut, niezależnie od poziomu naładowania opaski — mniej ponownych połączeń to największa oszczędność w WHOOP 4.0. Nic nie ginie: opaska zapisuje wszystko i przekazuje w większych paczkach. Ręczna synchronizacja nadal działa od razu, a tętno na żywo pozostaje bez zmian."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Синхронизировать в фоне раз в час вместо каждых 15 минут, независимо от заряда браслета — меньше переподключений даёт наибольшую экономию на WHOOP 4.0. Ничего не теряется: браслет всё накапливает и отдаёт большими порциями. Синхронизация жестом по-прежнему работает сразу, а живой пульс не затрагивается."
+          }
         }
       }
     },
@@ -208480,6 +209392,12 @@
             "state": "translated",
             "value": "Oszczędzanie energii"
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Энергосбережение"
+          }
         }
       }
     },
@@ -208514,6 +209432,12 @@
             "state": "translated",
             "value": "Odciąż opaskę, gdy jej bateria się kończy."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Снизьте нагрузку на браслет, когда его заряд на исходе."
+          }
         }
       }
     },
@@ -208548,6 +209472,12 @@
             "state": "translated",
             "value": "Opaska nadal zapisuje dane samodzielnie, więc nic nie ginie — NOOP po prostu rzadziej się z nią komunikuje, aby wystarczyła do naładowania."
           }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Браслет продолжает накапливать данные сам, поэтому ничего не теряется — NOOP просто реже с ним общается, чтобы тот дожил до зарядки."
+          }
         }
       }
     },
diff --git a/Tools/i18n_extra_locale_baseline.txt b/Tools/i18n_extra_locale_baseline.txt
index d854b49885..6496f6267d 100644
--- a/Tools/i18n_extra_locale_baseline.txt
+++ b/Tools/i18n_extra_locale_baseline.txt
@@ -4,7 +4,7 @@
 # tolerance in LANGS, which is why they are at 100%.
 
 Packages/StrandDesign/Sources/StrandDesign/Resources/Localizable.xcstrings:it 81
-Packages/StrandDesign/Sources/StrandDesign/Resources/Localizable.xcstrings:ru 54
+Packages/StrandDesign/Sources/StrandDesign/Resources/Localizable.xcstrings:ru 10
 Packages/StrandDesign/Sources/StrandDesign/Resources/Localizable.xcstrings:zh-Hans 75
 Packages/StrandDesign/Sources/StrandDesign/Resources/Localizable.xcstrings:zh-Hant 81
 NOOPWatch/Localizable.xcstrings:it 0
@@ -15,7 +15,8 @@ NOOPWatchComplications/Localizable.xcstrings:it 25
 NOOPWatchComplications/Localizable.xcstrings:zh-Hans 25
 NOOPWatchComplications/Localizable.xcstrings:zh-Hant 25
 Strand/Resources/Localizable.xcstrings:it 179
-Strand/Resources/Localizable.xcstrings:ru 156
+Strand/Resources/Localizable.xcstrings:ru 1
 Strand/Resources/Localizable.xcstrings:zh-Hans 129
 Strand/Resources/Localizable.xcstrings:zh-Hant 179
+values-ru/strings.xml 121
 values-zh/strings.xml 49
diff --git a/android/app/src/main/res/values-ru/strings.xml b/android/app/src/main/res/values-ru/strings.xml
new file mode 100644
index 0000000000..a84a383448
--- /dev/null
+++ b/android/app/src/main/res/values-ru/strings.xml
@@ -0,0 +1,2557 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <!-- Russian (ru). App name stays untranslated (brand).
+         Two provenances, deliberately kept in one file: strings joined from the EXISTING Apple
+         Russian translations on their shared English source, and strings translated for Android
+         where Apple had no counterpart. Keys absent here fall back to English - they are internal
+         animation / accessibility identifiers, not user copy. -->
+    <string name="widget_description">Отдых, Заряд и Усилие за сегодня, с живым пульсом и зарядом браслета одним взглядом.</string>
+    <string name="widget_compact_name">NOOP Компактный</string>
+    <string name="widget_compact_description">Компактный виджет Отдыха, Заряда и Усилия с живым пульсом и зарядом браслета.</string>
+    <string name="widget_error">Виджет NOOP не смог отрисоваться — он восстановится при следующем обновлении.</string>
+    <string name="nav_today">Сегодня</string>
+    <string name="nav_intelligence">Аналитика</string>
+    <string name="nav_coupled_view">Совмещённый вид</string>
+    <string name="nav_live">В реальном времени</string>
+    <string name="nav_intervals">Интервалы</string>
+    <string name="nav_sleep">Сон</string>
+    <string name="sleep_status_calculating_title">Рассчитываю сон за прошлую ночь…</string>
+    <string name="sleep_status_calculating_body">История с браслета загружена. NOOP сейчас определяет и анализирует ночной сон.</string>
+    <string name="sleep_status_sync_failed_title">Сон за прошлую ночь не синхронизирован</string>
+    <string name="sleep_status_sync_failed_body">Синхронизация истории остановилась до завершения. Держите браслет рядом и повторите попытку.</string>
+    <string name="sleep_status_waiting_title">Ожидание сна за прошлую ночь</string>
+    <string name="sleep_status_waiting_body">Подключите браслет и синхронизируйте историю. NOOP рассчитает ночь после получения ночных данных.</string>
+    <string name="sleep_status_not_detected_title">Сон за прошлую ночь не обнаружен</string>
+    <string name="sleep_status_not_detected_body">Синхронизация завершена, но NOOP не смог уверенно определить окно сна. Оставьте браслет подключённым и повторите синхронизацию; более ранняя ночь ниже остаётся последним обнаруженным сном.</string>
+    <string name="nav_breathe">Дыхание</string>
+    <string name="nav_stress">Стресс</string>
+    <string name="nav_workouts">Тренировки</string>
+    <string name="nav_trends">Тренды</string>
+    <string name="nav_coach">ИИ-тренер</string>
+    <string name="nav_insights_hub">Что вами движет</string>
+    <string name="nav_insights">Выводы</string>
+    <string name="nav_explore">Обзор</string>
+    <string name="nav_compare">Сравнить</string>
+    <string name="nav_health">Здоровье</string>
+    <string name="nav_hydration">Гидратация</string>
+    <string name="nav_vital_signs">Жизненные показатели</string>
+    <string name="nav_lab_book">Лабораторный журнал</string>
+    <string name="nav_rhythm">Ритм</string>
+    <string name="nav_automations">Автоматизации</string>
+    <string name="nav_alarms">Будильники</string>
+    <string name="nav_devices">Устройства</string>
+    <string name="nav_noop_limitations">Ограничения NOOP</string>
+    <string name="nav_data_sources">Источники данных</string>
+    <string name="nav_backup_sync">Резервное копирование и синхронизация</string>
+    <string name="nav_fused_record">Ваши данные, объединённые</string>
+    <string name="nav_notifications">Уведомления</string>
+    <string name="nav_support">Поддержка</string>
+    <string name="nav_settings">Настройки</string>
+    <string name="nav_test_centre">Тестовый центр</string>
+    <string name="nav_self_hosted_push">Свой сервер push</string>
+    <string name="nav_more">Ещё</string>
+    <string name="push_title">Свой сервер push</string>
+    <string name="push_subtitle">Эксперимент · Android</string>
+    <string name="push_destination_title">Ваш адрес</string>
+    <string name="push_disclosure">Когда включено, NOOP отправляет сырые записи о здоровье с этого телефона на контролируемый вами адрес. Это явная передача данных с устройства.</string>
+    <string name="push_one_way_warning">Только односторонний экспорт. NOOP не может восстановить данные с этого адреса и не предоставляет приёмник.</string>
+    <string name="push_endpoint">URL адреса</string>
+    <string name="push_token">Bearer-токен (скрыт)</string>
+    <string name="push_token_saved">Bearer-токен (сохранён; введите, чтобы заменить)</string>
+    <string name="push_clear_token">Удалить сохранённый токен</string>
+    <string name="push_token_cleared">Сохранённый токен удалён. Отправка выключена.</string>
+    <string name="push_save">Сохранить адрес</string>
+    <string name="push_saved">Адрес сохранён.</string>
+    <string name="push_test_connection">Проверить соединение</string>
+    <string name="push_testing_connection">Проверка соединения…</string>
+    <string name="push_test_connection_detail">Проверяет аутентификацию и поддерживаемые типы данных. Данные о здоровье не отправляются.</string>
+    <string name="push_test_network_required">Подключитесь к сети, разрешённой настройкой «только Wi-Fi», прежде чем проверять приёмник.</string>
+    <string name="push_capabilities_retryable_error">Не удалось связаться с приёмником. Повторите проверку соединения позже.</string>
+    <string name="push_capabilities_invalid_error">Приёмник вернул недопустимые или неподдерживаемые возможности.</string>
+    <string name="push_error_dns">Не удалось разрешить DNS. Проверьте имя хоста и настройку DNS.</string>
+    <string name="push_error_tls_certificate">Не пройдена проверка сертификата TLS. Проверьте имя хоста, цепочку сертификатов и срок действия.</string>
+    <string name="push_error_tls_handshake">Не удалось рукопожатие TLS. Проверьте обратный прокси, версии TLS и настройку шифров.</string>
+    <string name="push_error_network_timeout">Сетевой таймаут до завершения запроса. Проверьте доступность и таймауты прокси.</string>
+    <string name="push_error_connection_refused">Соединение отклонено. Убедитесь, что приёмник запущен и порт прокси или бэкенда слушает.</string>
+    <string name="push_error_network_unreachable">Сетевой маршрут недоступен. Проверьте Wi-Fi, маршрутизацию и правила брандмауэра.</string>
+    <string name="push_error_connection_reset">Соединение сброшено. Проверьте перезапуски приёмника или прокси и таймауты соединения.</string>
+    <string name="push_error_network_io">Сетевой ввод-вывод завершился ошибкой до получения надёжного подтверждения.</string>
+    <string name="push_error_http_auth">HTTP %1$d: аутентификация отклонена. Проверьте bearer-токен и передачу заголовка Authorization через прокси.</string>
+    <string name="push_error_http_not_found">HTTP %1$d: путь адреса не найден. Проверьте полный URL и маршрут обратного прокси.</string>
+    <string name="push_error_http_timeout">HTTP %1$d: приёмник или прокси превысил время обработки запроса.</string>
+    <string name="push_error_http_too_large">HTTP %1$d: запрос слишком велик. Согласуйте ограничения тела у приёмника и обратного прокси с протоколом 1.0.</string>
+    <string name="push_error_http_media_type">HTTP %1$d: приёмник отклонил и gzip, и обычную загрузку NDJSON.</string>
+    <string name="push_error_http_protocol">HTTP %1$d: приёмник отклонил партию протокола. Проверьте его схему v1, список разрешённых потоков и журналы.</string>
+    <string name="push_error_http_rate_limit">HTTP %1$d: достигнут лимит частоты у приёмника. Автоматический повтор использует нарастающую задержку.</string>
+    <string name="push_error_http_server">HTTP %1$d: ошибка сервера приёмника или обратного прокси. Проверьте журналы и состояние сервера.</string>
+    <string name="push_error_http_client">HTTP %1$d: непредвиденная ошибка клиента. Проверьте адрес и настройку обратного прокси.</string>
+    <string name="push_error_capabilities_invalid">Ответ о возможностях некорректен или не соответствует протоколу 1.0.</string>
+    <string name="push_error_ack_invalid">Подтверждение приёмника некорректно или не соответствует отправленной партии. Курсор не был сдвинут.</string>
+    <string name="push_error_local_data">Локальная запись превышает ограничения протокола или не может быть закодирована точно. Курсор не сдвинут.</string>
+    <string name="push_error_local_database">Не удалось прочитать или сохранить локальную базу данных либо состояние прогресса отправки.</string>
+    <string name="push_error_network">Ожидание сети, разрешённой настройкой «только Wi-Fi».</string>
+    <string name="push_error_retrying">%1$s Автоматический повтор запланирован.</string>
+    <string name="push_error_paused">%1$s Автоматические повторы приостановлены; устраните причину, затем нажмите «Экспортировать сейчас» или завершите ещё одну синхронизацию с браслетом.</string>
+    <string name="push_error_missing_token">Сохранённый bearer-токен недоступен. Сохраните его заново.</string>
+    <string name="push_error_start">Не удалось безопасно запустить обработчик экспорта.</string>
+    <string name="push_error_queue">Не удалось поставить в очередь следующий ограниченный шаг экспорта.</string>
+    <string name="push_capabilities_summary">Приёмник поддерживает %1$d из %2$d типов данных</string>
+    <string name="push_capabilities_checked">Последняя проверка: %1$s</string>
+    <string name="push_capabilities_none">Этот приёмник сейчас не принимает данные о здоровье протокола 1.0.</string>
+    <string name="push_capabilities_streams">Принимаемые данные: %1$s</string>
+    <string name="push_enabled">Включить автоматический экспорт</string>
+    <string name="push_enabled_detail">Экспортирует новые и изменённые данные после полной синхронизации с браслетом и догоняет при запуске приложения.</string>
+    <string name="push_wifi_only">Только Wi-Fi</string>
+    <string name="push_wifi_only_detail">Использовать безлимитный Wi-Fi для проверок соединения и экспорта. Выключите, чтобы разрешить мобильные и другие подключённые сети.</string>
+    <string name="push_export_now">Экспортировать сейчас</string>
+    <string name="push_export_now_detail">Запускает догоняющую отправку сейчас. Автоматический экспорт должен быть включён.</string>
+    <string name="push_config_required">Сохраните корректный адрес и токен перед включением.</string>
+    <string name="push_status_title">Статус</string>
+    <string name="push_status_detail">Учётные данные никогда не показываются в статусе или метаданных обработчика.</string>
+    <string name="push_never">Никогда</string>
+    <string name="push_last_success">Последняя полная догоняющая отправка: %1$s</string>
+    <string name="push_last_error">Последняя ошибка: %1$s</string>
+    <string name="push_current_state">Текущее состояние: %1$s</string>
+    <string name="push_progress">Текущий экспорт: %1$d партий · принято записей: %2$d</string>
+    <string name="push_current_stream">Текущий тип данных: %1$s</string>
+    <string name="push_state_idle">Простой</string>
+    <string name="push_state_queued">В очереди</string>
+    <string name="push_state_running">Отправка</string>
+    <string name="push_state_continuing">Найдены новые локальные данные; продолжаем</string>
+    <string name="push_state_retrying">Повтор после ошибки</string>
+    <string name="push_state_complete">Актуально</string>
+    <string name="push_state_failed">Приостановлено после ошибки</string>
+    <string name="push_settings_row_detail">Экспериментальный односторонний экспорт на контролируемый вами адрес. По умолчанию выключено.</string>
+    <string name="push_endpoint_error_malformed">Введите корректный URL.</string>
+    <string name="push_endpoint_error_missing_scheme">В URL нужен http:// или https://.</string>
+    <string name="push_endpoint_error_unsupported_scheme">Поддерживаются только HTTP и HTTPS.</string>
+    <string name="push_endpoint_error_user_info">Имена пользователей и пароли в URL не допускаются.</string>
+    <string name="push_endpoint_error_fragment">Фрагменты URL не допускаются.</string>
+    <string name="push_endpoint_error_missing_host">В URL нужен хост.</string>
+    <string name="push_endpoint_error_invalid_host">Некорректный хост в URL.</string>
+    <string name="push_endpoint_error_invalid_port">Некорректный порт в URL.</string>
+    <string name="push_endpoint_error_http_requires_local">Обычный HTTP требует числовой локальный или частный IP-адрес.</string>
+    <string name="push_error_enqueue_failed">Не удалось поставить отправку в очередь.</string>
+    <string name="more_group_insights">Выводы</string>
+    <string name="more_group_body">Тело</string>
+    <string name="more_group_data">Данные</string>
+    <string name="more_group_app">Приложение</string>
+    <string name="action_live_hr">Пульс в реальном времени</string>
+    <string name="action_start_workout">Начать тренировку</string>
+    <string name="action_log_journal">Запись в журнал</string>
+    <string name="action_breathe">Дыхание</string>
+    <string name="today_latest_workouts">Последние тренировки</string>
+    <string name="today_customize_title">Настроить «Сегодня»</string>
+    <string name="today_customize_action">Настроить</string>
+    <string name="today_customize_description">Измените порядок отображаемого или переместите раздел в «Скрытые», не удаляя его.</string>
+    <string name="today_customize_edit_added_cards">Изменить добавленные карточки</string>
+    <string name="today_hosted_editor_title">Добавленные карточки</string>
+    <string name="today_hosted_editor_desc">Выберите, какие карточки «Тренды» и «Сон» показывать на «Сегодня». Они остаются и на своих вкладках.</string>
+    <string name="sleep_customize_title">Настроить сон</string>
+    <string name="sleep_customize_description">Измените порядок отображаемого или переместите раздел в «Скрытые», не удаляя его.</string>
+    <string name="today_customize_shown">Показано</string>
+    <string name="today_customize_hidden">Скрыто</string>
+    <string name="today_customize_nothing_hidden">Нет скрытых элементов</string>
+    <string name="today_customize_move_up">Переместить %1$s вверх</string>
+    <string name="today_customize_move_down">Переместить %1$s вниз</string>
+    <string name="today_customize_hide">Скрыть %1$s</string>
+    <string name="today_customize_show">Показать %1$s</string>
+    <string name="terms_title">Перед использованием NOOP</string>
+    <string name="terms_subtitle">Пожалуйста, прочитайте пункты ниже, затем подтвердите каждое утверждение.</string>
+    <string name="terms_point_independent_head">Независимый проект: не связан с WHOOP</string>
+    <string name="terms_point_independent_body">NOOP — неофициальный проект: не связан с WHOOP, Inc., не одобрен и не спонсируется ею. «WHOOP» — их товарный знак, используемый только для обозначения оборудования, с которым работает NOOP.</string>
+    <string name="terms_point_tos_head">Использование NOOP может нарушать Условия обслуживания WHOOP</string>
+    <string name="terms_point_tos_body">Используйте это только с устройством, которое принадлежит вам, для чтения ваших собственных данных. Решение об использовании (и любые последствия для вашего аккаунта WHOOP, подписки, устройства или гарантии) — целиком на вашей ответственности.</string>
+    <string name="terms_point_experimental_head">Экспериментально: на ваш страх и риск</string>
+    <string name="terms_point_experimental_body">NOOP общается с прошивкой вашего браслета по неофициальному, самостоятельно изученному протоколу. Существует остаточный риск для устройства, его данных и его связи с официальными сервисами. Вы принимаете этот риск.</string>
+    <string name="terms_point_medical_head">Не медицинское устройство, не медицинская консультация</string>
+    <string name="terms_point_medical_body">Каждая метрика — непроверенное приближение. Не используйте NOOP для диагностики, лечения или принятия любых решений о здоровье. Всегда консультируйтесь с квалифицированным специалистом.</string>
+    <string name="terms_point_warranty_head">Без гарантий; ответственность ограничена</string>
+    <string name="terms_point_warranty_body">NOOP бесплатен и предоставляется «как есть», без каких-либо гарантий. Ответственность ограничена в максимальной степени, допускаемой применимым к вам законом, и ничто здесь не отменяет защиту, которую местное законодательство не позволяет отменить.</string>
+    <string name="terms_footer">Полные условия — в файле TERMS.md, поставляемом вместе с NOOP. Это не является юридической консультацией.</string>
+    <string name="terms_attest_head">Пожалуйста, подтвердите каждый пункт:</string>
+    <string name="terms_attest_not_affiliated">Я не являюсь сотрудником, подрядчиком или аффилированным лицом WHOOP и не использую NOOP от имени WHOOP.</string>
+    <string name="terms_attest_own_device">Я владею устройством WHOOP, которое буду использовать с NOOP, и буду использовать его только для доступа к собственным данным. Это моё решение и мой риск, включая любое влияние на мой аккаунт WHOOP, подписку, устройство или гарантию, и это может нарушать Условия обслуживания WHOOP.</string>
+    <string name="terms_attest_asis">Я понимаю, что NOOP является неофициальным и экспериментальным, предоставляется бесплатно и «как есть» без каких-либо гарантий и не является медицинским изделием или медицинской рекомендацией.</string>
+    <string name="terms_attest_liability">В максимальной степени, допускаемой законом, я не буду возлагать на проект NOOP или его участников ответственность за любые убытки или ущерб, возникшие в результате моего использования.</string>
+    <string name="terms_checkbox">Я прочитал(а) и принимаю эти условия и использую NOOP со своим устройством и своими данными на свой страх и риск.</string>
+    <string name="terms_accept">Принять и продолжить</string>
+    <string name="trends_subtitle">Ваша история во времени.</string>
+    <string name="trends_trailing">Последние</string>
+    <string name="trends_trailing_days">Последние %1$d дней</string>
+    <string name="trends_all_history">Вся история</string>
+    <string name="trends_trend">Тренд</string>
+    <string name="trends_trend_a11y">Тренд: %1$s</string>
+    <string name="trends_charge">Заряд</string>
+    <string name="trends_effort">Усилие</string>
+    <string name="trends_rest">Отдых</string>
+    <string name="trends_hrv_full">Вариабельность сердечного ритма</string>
+    <string name="trends_resting_hr_full">Пульс в покое</string>
+    <string name="trends_no_readings_this_week">На этой неделе показаний нет</string>
+    <string name="trends_no_readings_body">Перейдите к другой неделе с помощью стрелок выше, чтобы увидеть её обзор.</string>
+    <string name="trends_this_week">На этой неделе</string>
+    <string name="trends_last_week">Прошлая неделя</string>
+    <string name="trends_previous_week">Предыдущая неделя</string>
+    <string name="trends_next_week">Следующая неделя</string>
+    <string name="trends_daily_signals">Ежедневные показатели</string>
+    <string name="trends_week_in_review">Итоги недели</string>
+    <string name="trends_charge_effort_rest">Заряд · Усилие · Отдых</string>
+    <string name="trends_calendar">Календарь</string>
+    <string name="trends_avg">Сред.</string>
+    <string name="trends_peak">Пик</string>
+    <string name="trends_low">Низкий</string>
+    <string name="trends_days">Дни</string>
+    <string name="trends_mean">Среднее</string>
+    <string name="trends_min">Мин.</string>
+    <string name="trends_max">Макс.</string>
+    <string name="trends_calendar_footnote">Каждый столбец — Заряд за один день, от низкого к высокому. 53-недельная календарная тепловая сетка есть в настольном приложении.</string>
+    <string name="trends_not_enough_data">Недостаточно данных за выбранный период.</string>
+    <string name="trends_empty_title">Для трендов нужна история</string>
+    <string name="trends_empty_body">Для построения трендов нужна история. Импортируйте данные WHOOP в разделе «Источники данных», чтобы сразу увидеть данные за недели, месяцы и годы.</string>
+    <string name="explore_subtitle">Каждый показатель, в одном касании.</string>
+    <string name="explore_import_title">Сначала импортируйте историю</string>
+    <string name="explore_import_body">Сначала импортируйте историю. Данные WHOOP из раздела «Источники данных» примерно за минуту заполнят все показатели, доступные для анализа здесь.</string>
+    <string name="deep_timeline_title">Подробная шкала времени</string>
+    <string name="explore_deep_timeline_hint">Каждая секунда вашего дня, с масштабированием.</string>
+    <string name="explore_pick_metric">Выберите метрику</string>
+    <string name="explore_average">Среднее</string>
+    <string name="explore_min">Мин.</string>
+    <string name="explore_max">Макс.</string>
+    <string name="explore_latest">Последнее</string>
+    <string name="explore_delta_vs_prev">Δ к пред.</string>
+    <string name="explore_summary">Сводка</string>
+    <string name="explore_over_visible_window">За видимый период</string>
+    <string name="explore_n_pts">%1$d точек</string>
+    <string name="explore_vs_prev_window">против пред. %1$s</string>
+    <string name="explore_all_history">вся история</string>
+    <string name="explore_no_prior_window">нет предыдущего %1$s</string>
+    <string name="explore_empty_metric">%1$s ещё не записан. Синхронизируйте браслет, чтобы заполнить этот тренд.</string>
+    <string name="explore_single_reading">В диапазоне только одно измерение — расширьте окно, чтобы увидеть тренд.</string>
+    <string name="explore_chart_window">Окно</string>
+    <string name="explore_chart_points">Точки</string>
+    <string name="timeline_subtitle">Каждая секунда вашего дня. Прокрутка назад до 3 дней.</string>
+    <string name="timeline_my_whoop">Мой WHOOP</string>
+    <string name="timeline_owned">Во владении</string>
+    <string name="timeline_all">Все</string>
+    <string name="timeline_loading_day">Загружаем день…</string>
+    <string name="timeline_pinch_to_zoom">Сведите пальцы для масштабирования · перетащите для перемещения</string>
+    <string name="timeline_zoomed_in">Увеличено · перетащите для панорамирования</string>
+    <string name="timeline_reset">Сбросить</string>
+    <string name="timeline_min">Мин.</string>
+    <string name="timeline_avg">СРЕД</string>
+    <string name="timeline_max">Макс.</string>
+    <string name="timeline_empty_metric">Здесь нет данных: %1$s</string>
+    <string name="timeline_nothing_offloaded">Для этого периода пока ничего не выгружено.</string>
+    <string name="timeline_other_sources_no_offload">Другие источники не выгружают сырые посекундные данные на устройство.</string>
+    <string name="fast_link_phy">Ускоренное соединение Bluetooth (эксперимент)</string>
+    <string name="fast_link_phy_desc">Запрашивает более быстрый режим радио Bluetooth, пока браслет передаёт сохранённую историю. Те же данные передаются за меньшее время в эфире, поэтому синхронизация может пройти быстрее и немного сэкономить заряд браслета — но браслет должен это поддерживать, и скорость достигается за счёт дальности. Новая и непроверенная функция: если синхронизация станет нестабильной, когда телефон дальше, выключите её.</string>
+    <string name="fast_history_sync">Ускоренная синхронизация истории (эксперимент)</string>
+    <string name="fast_history_sync_desc">Запрашивает у Android более быстрое соединение Bluetooth, пока браслет передаёт сохранённую историю, чтобы большой объём накопленных данных загрузился быстрее. Только на время самой синхронизации — живой пульс и ночная передача не затрагиваются. Новая и непроверенная функция: если она не помогает или расходует больше батареи, чем того стоит, выключите её и сообщите об этом в трекере задач.</string>
+    <string name="keep_alive_needed_vendor">Ваш телефон (%1$s) может останавливать фоновые приложения ради экономии батареи, из-за чего NOOP пропустит ночные данные о сне и восстановлении. Нажмите «Разрешить», чтобы добавить NOOP в исключения.\n\nAndroid спросит «Отключить оптимизацию расхода батареи?» и предупредит, что NOOP может разряжать батарею — это стандартная формулировка для любого приложения, которому разрешено работать в фоне. Нажмите «Разрешить». Батарея расходуется на ночную синхронизацию, которую вы уже включили выше; это лишь не даёт Android прервать её.</string>
+    <string name="power_saving">Энергосбережение</string>
+    <string name="power_saving_blurb">Снизьте нагрузку на браслет, когда его заряд на исходе. Браслет продолжает накапливать данные сам, поэтому ничего не теряется — NOOP просто реже с ним общается, чтобы тот дожил до зарядки.</string>
+    <string name="power_saving_mode">Режим энергосбережения</string>
+    <string name="power_saving_mode_desc">Замедляет фоновую синхронизацию с браслетом (каждые 45 минут вместо 15), пока заряд браслета низкий. Потери данных нет — браслет всё накапливает, поэтому синхронизация просто идёт более крупными и редкими порциями.</string>
+    <string name="power_saving_kick_in">Включать при (заряде браслета)</string>
+    <string name="power_saving_hrv_pause">Приостановить сбор ВСР</string>
+    <string name="power_saving_hrv_pause_desc">Пока заряд браслета низкий, останавливать постоянный фоновый поток ВСР — самый большой непрерывный расход для браслета. Живой экран по-прежнему показывает пульс, а поток включится сам, как только браслет зарядится.</string>
+    <string name="l10n_add_device_wizard_a_whoop_strap_bonds_to_a_d39bdf4a">Браслет WHOOP сопрягается только с одним устройством. Пока он подключён к NOOP, он не будет передавать </string>
+    <string name="l10n_add_device_wizard_add_61cc55aa">Добавить</string>
+    <string name="l10n_add_device_wizard_advanced_i_already_have_my_ring_e87b9b49">Дополнительно: у меня уже есть ключ моего кольца</string>
+    <string name="l10n_add_device_wizard_beta_is_an_on_device_estimate_128563e0">Бета. * — оценка на устройстве. Температура кожи — это тренд относительно вашей нормы, шаги </string>
+    <string name="l10n_add_device_wizard_both_noop_and_the_oura_app_4f219db3">И NOOP, и приложение Oura могут использовать принадлежащее вам кольцо по ключу, но Bluetooth-соединение может держать только одно приложение одновременно.</string>
+    <string name="l10n_add_device_wizard_connect_to_this_ring_02b9442b">Подключиться к этому кольцу</string>
+    <string name="l10n_add_device_wizard_continue_2e026239">Продолжить</string>
+    <string name="l10n_add_device_wizard_device_name_79d7a157">Название устройства</string>
+    <string name="l10n_add_device_wizard_experimental_best_effort_support_we_re_db288aa8">Экспериментальная поддержка по мере возможностей. Мы их ещё тестируем, поэтому подключение может сработать не на каждом устройстве. Они никогда не выдумывают данные и честно скажут, когда живой режим невозможен.</string>
+    <string name="l10n_add_device_wizard_i_understand_this_disconnects_the_ring_66bbb125">Я понимаю, что это отключит кольцо от Oura, и что NOOP не сможет отменить это за меня. Чтобы вернуться к Oura, мне нужно будет снова сбросить кольцо до заводских настроек и настроить его в приложении Oura.</string>
+    <string name="l10n_add_device_wizard_i_understand_this_disconnects_the_ring_ccbb3225">Я понимаю, что это отключит кольцо от Oura, и что NOOP не сможет отменить это за меня.</string>
+    <string name="l10n_add_device_wizard_installing_noop_s_key_and_confirming_aab5cf61">Устанавливаем ключ NOOP и проверяем, что кольцо отвечает только NOOP. Держите кольцо рядом и не открывайте приложение Oura.</string>
+    <string name="l10n_add_device_wizard_keep_the_oura_app_instead_import_60d70411">Оставить приложение Oura (импортировать файл)</string>
+    <string name="l10n_add_device_wizard_make_sure_it_s_awake_and_8c40e59f">Убедитесь, что оно активно и не подключено в другом месте.</string>
+    <string name="l10n_add_device_wizard_name_signal_signalbars_level_rssi_of_6aa514f6">%1$s, сигнал %2$s из 4</string>
+    <string name="l10n_add_device_wizard_noop_stores_this_key_only_on_eae4e63f">NOOP хранит этот ключ только на этом устройстве, там же, где хранит данные сопряжённых браслетов.</string>
+    <string name="l10n_add_device_wizard_not_showing_up_make_sure_you_60a8a61b">Не появляется? Убедитесь, что вы сбросили кольцо в приложении Oura и принудительно закрыли его, затем нажмите «Повторить поиск». Кольцо, которым всё ещё владеет Oura, здесь не отобразится.</string>
+    <string name="l10n_add_device_wizard_one_phone_at_a_time_cff4ff44">По одному телефону за раз</string>
+    <string name="l10n_add_device_wizard_oura_ring_e3431536">Кольцо Oura</string>
+    <string name="l10n_add_device_wizard_rescan_84661f6a">Пересканировать</string>
+    <string name="l10n_add_device_wizard_ring_key_32_hex_characters_28cb7e4a">Ключ кольца, 32 шестнадцатеричных символа</string>
+    <string name="l10n_add_device_wizard_scan_28cba55d">Сканировать</string>
+    <string name="l10n_add_device_wizard_scan_for_type_title_be2c98fb">Поиск %1$s</string>
+    <string name="l10n_add_device_wizard_scan_for_your_ring_e92b3a3b">Сканировать кольцо</string>
+    <string name="l10n_add_device_wizard_searching_1a6a5ba8">Поиск…</string>
+    <string name="l10n_add_device_wizard_take_over_this_ring_f199dc22">Взять управление этим кольцом</string>
+    <string name="l10n_add_device_wizard_taking_over_your_ring_b64a3852">Переход на локальное управление кольцом</string>
+    <string name="l10n_add_device_wizard_that_is_not_a_32_character_d42ca20d">Это не 32-символьный шестнадцатеричный ключ.</string>
+    <string name="l10n_add_device_wizard_the_ring_is_not_bricked_to_5efd1b3d">Кольцо не выведено из строя. Чтобы вернуться к исходному состоянию, снова сбросьте его к заводским настройкам и настройте </string>
+    <string name="l10n_add_device_wizard_try_again_042c862e">Повторить</string>
+    <string name="l10n_add_device_wizard_use_file_import_0e092cb4">Использовать импорт файла</string>
+    <string name="l10n_add_device_wizard_we_could_not_take_over_this_fec1ce93">Не удалось перехватить управление этим кольцом.</string>
+    <string name="l10n_add_device_wizard_whoop_5_0_mg_support_is_e452e686">Поддержка WHOOP 5.0 / MG в NOOP новее и всё ещё экспериментальна.</string>
+    <string name="l10n_add_device_wizard_whoop_is_noop_s_primary_fully_ac6fa33b">WHOOP — основной, полностью поддерживаемый браслет NOOP. Другие пульсометры передают живой пульс и ВСР, но не более глубокие данные WHOOP о сне и восстановлении.</string>
+    <string name="l10n_app_root_more_4bab2d8f">Ещё</string>
+    <string name="l10n_apple_health_screen_no_readings_recorded_05018b26">Пока нет записанных измерений.</string>
+    <string name="l10n_apple_health_screen_nothing_imported_yet_f457cdbe">Пока ничего не импортировано</string>
+    <string name="l10n_apple_health_screen_reading_your_apple_health_history_1a3bf76d">Загружаю историю из Apple Health…</string>
+    <string name="l10n_auto_workout_nudge_dismiss_this_workout_suggestion_52ace8f3">Отклонить это предложение тренировки</string>
+    <string name="l10n_auto_workout_nudge_looks_like_a_workout_e745e403">Похоже на тренировку</string>
+    <string name="l10n_auto_workout_nudge_not_a_workout_15c5f784">Не тренировка</string>
+    <string name="l10n_auto_workout_nudge_save_it_01d23661">Сохранить</string>
+    <string name="l10n_automations_screen_automations_82542d6d">Автоматизации</string>
+    <string name="l10n_automations_screen_battery_alerts_f3679d60">Оповещения о батарее</string>
+    <string name="l10n_automations_screen_buzz_strength_e895f99e">Сила вибрации</string>
+    <string name="l10n_automations_screen_choose_double_tap_action_6ac9a313">Выберите действие двойного касания</string>
+    <string name="l10n_automations_screen_detect_short_naps_bbfd136d">Определять короткий дневной сон</string>
+    <string name="l10n_automations_screen_double_tap_8d2f1646">Двойное нажатие</string>
+    <string name="l10n_automations_screen_each_day_uses_the_time_above_f9bc9ce3">Каждый день использует время выше, если вы не зададите здесь другое.</string>
+    <string name="l10n_automations_screen_enable_inactivity_reminder_468c3017">Включить напоминание о неактивности</string>
+    <string name="l10n_automations_screen_from_3f66052a">С</string>
+    <string name="l10n_automations_screen_haptic_coaching_e2fab286">Тактильные подсказки</string>
+    <string name="l10n_automations_screen_hr_zone_coaching_9306e6e1">Тренерская подсказка по зонам пульса</string>
+    <string name="l10n_automations_screen_illness_early_warning_453ab477">Раннее предупреждение о болезни</string>
+    <string name="l10n_automations_screen_inactivity_reminder_ca49b1ba">Напоминание о неактивности</string>
+    <string name="l10n_automations_screen_nap_detection_ca2dedf5">Определение дневного сна</string>
+    <string name="l10n_automations_screen_no_naps_to_review_detected_naps_2e82e9fc">Нет дневного сна для проверки. Найденный дневной сон появится здесь после синхронизации истории.</string>
+    <string name="l10n_automations_screen_notifications_are_off_so_this_can_b3dba7ee">Уведомления выключены, поэтому это пока не может сработать. Включите главный переключатель в </string>
+    <string name="l10n_automations_screen_notify_on_low_and_full_battery_d1903bb8">Уведомлять о низком заряде и полной зарядке</string>
+    <string name="l10n_automations_screen_only_during_active_hours_29c53fc9">Только в часы активности</string>
+    <string name="l10n_automations_screen_per_day_wake_time_873c81e1">Время подъёма по дням</string>
+    <string name="l10n_automations_screen_predictive_runtime_warning_4d85f5a6">Предупреждение о прогнозируемом времени работы</string>
+    <string name="l10n_automations_screen_re_nudge_every_646023cd">Повторное напоминание каждые</string>
+    <string name="l10n_automations_screen_recovery_buzz_1abc9a51">Вибрация о восстановлении</string>
+    <string name="l10n_automations_screen_reset_44c57abd">Сбросить</string>
+    <string name="l10n_automations_screen_sitting_for_e464c472">Сидите уже</string>
+    <string name="l10n_automations_screen_test_action_266df314">Тестовое действие</string>
+    <string name="l10n_automations_screen_watch_for_early_illness_signs_4c22e127">Следить за ранними признаками болезни</string>
+    <string name="l10n_automations_screen_when_i_double_tap_a1f1e04d">При двойном касании</string>
+    <string name="l10n_backup_sync_screen_backup_folder_2a33df93">Папка резервных копий</string>
+    <string name="l10n_backup_sync_screen_backup_sync_81758ffa">Резервное копирование и синхронизация</string>
+    <string name="l10n_backup_sync_screen_backup_time_81557aaa">Время резервного копирования</string>
+    <string name="l10n_backup_sync_screen_cancel_77dfd213">Отмена</string>
+    <string name="l10n_backup_sync_screen_choose_a_backup_2fbfb0d6">Выбрать резервную копию</string>
+    <string name="l10n_backup_sync_screen_daily_auto_backup_e5627357">Ежедневное автосохранение резервной копии</string>
+    <string name="l10n_backup_sync_screen_keep_last_snapshots_cd5c9ea9">Хранить последние снимки</string>
+    <string name="l10n_backup_sync_screen_newest_first_restoring_replaces_this_device_97dbcd8b">Сначала новые. Восстановление заменяет данные этого устройства.</string>
+    <string name="l10n_backup_sync_screen_older_backups_beyond_this_many_are_00b7daa6">Более старые копии сверх этого числа удаляются, начиная с самых старых (≈ столько дней </string>
+    <string name="l10n_backup_sync_screen_replace_a7cf7b25">Заменить</string>
+    <string name="l10n_backup_sync_screen_replace_all_current_data_e9244799">Заменить все текущие данные?</string>
+    <string name="l10n_backup_sync_screen_replace_all_current_data_with_label_b7799a16">Заменить все текущие данные на %1$s? Это нельзя отменить.</string>
+    <string name="l10n_backup_sync_screen_replace_this_device_s_data_with_b8679c51">Заменить данные этого устройства одной из ваших резервных копий. Это перезапишет текущие данные, </string>
+    <string name="l10n_backup_sync_screen_restore_3cbe6d6b">Восстановить</string>
+    <string name="l10n_backup_sync_screen_restore_from_a_backup_c28917c6">Восстановить из резервной копии…</string>
+    <string name="l10n_backup_sync_screen_roughly_when_the_daily_backup_runs_71de04e1">Примерно когда выполняется ежедневное копирование (по возможности — система может немного сдвинуть его).</string>
+    <string name="l10n_backup_sync_screen_these_backups_are_unencrypted_too_if_53e70fe8">Эти резервные копии тоже не зашифрованы. Если эта папка синхронизируется с Drive, Dropbox или iCloud, читаемый файл попадёт и туда — указывайте только надёжный сервис.</string>
+    <string name="l10n_backup_sync_screen_tip_a_desktop_drive_dropbox_app_2eaff1e3">Совет: настольное приложение Drive / Dropbox само синхронизирует выбранную папку. На телефоне сохраняйте в </string>
+    <string name="l10n_backup_sync_screen_writes_a_fresh_dated_backup_to_bd964fc5">Записывает новую копию с датой в вашу папку раз в день в указанное ниже время, сохраняя </string>
+    <string name="l10n_breathe_screen_a_relaxation_rhythm_not_cardiac_control_5c2f10a8">Это ритм для расслабления, а не управление сердцем. Темп никогда не опускается ниже безопасного, и вы можете остановиться в любой момент. Если пульс не успокоится, мы прямо об этом скажем.</string>
+    <string name="l10n_breathe_screen_audio_cues_74430aec">Звуковые подсказки</string>
+    <string name="l10n_breathe_screen_breathcount_breaths_ce036831">%1$s вдохов</string>
+    <string name="l10n_breathe_screen_breathe_282be568">Дыхание</string>
+    <string name="l10n_breathe_screen_breathe_now_98d6c341">Дышать сейчас</string>
+    <string name="l10n_breathe_screen_calm_me_3_min_11250c77">Успокоить меня · 3 мин</string>
+    <string name="l10n_breathe_screen_connect_your_strap_calm_me_is_71314744">Подключите браслет. Функция «Успокоить меня» — это тактильный ритм на запястье, поэтому нужно привязанное соединение.</string>
+    <string name="l10n_breathe_screen_connect_your_strap_for_haptic_guidance_65660684">Подключите браслет для тактильных подсказок. Вы почувствуете один импульс на вдохе и два на выдохе, чтобы дышать с закрытыми глазами.</string>
+    <string name="l10n_breathe_screen_estimate_from_ppg_derived_r_r_9c92fbae">Оценка на основе R-R, полученных из PPG: подсказка для расслабления, а не клиническое измерение. Ваш темп меняется, поэтому мы указываем дату, и вы можете измерить заново в любой момент.</string>
+    <string name="l10n_breathe_screen_estimate_only_a_higher_rmssd_while_bfd71bb8">Только оценка: более высокий RMSSD при заданном темпе обычно означает включение парасимпатической ветви «отдыха». Это не клиническое измерение; динамика на протяжении сессии важнее любого отдельного числа.</string>
+    <string name="l10n_breathe_screen_everyone_has_a_breathing_pace_usually_ad6ea0b4">У каждого есть темп дыхания (обычно от 4,5 до 7 вдохов в минуту), при котором ритм сердца сильнее всего колеблется с каждым вдохом. Мы проведём вас через несколько вариантов темпа, измерим отклик ВСР и зафиксируем тот, который резонирует лучше всего именно у вас.</string>
+    <string name="l10n_breathe_screen_full_sweep_13_min_08e01d2c">Полный проход · ~13 мин</string>
+    <string name="l10n_breathe_screen_heart_rate_410aa15c">Пульс</string>
+    <string name="l10n_breathe_screen_hrv_rmssd_51014f87">ВСР (RMSSD)</string>
+    <string name="l10n_breathe_screen_locked_formatday_datems_paces_drift_re_8ebec15b">Зафиксировано %1$s · темп меняется, измеряйте заново в любое время.</string>
+    <string name="l10n_breathe_screen_locked_formatday_datems_switch_to_breathe_3efc52c6">Зафиксировано %1$s. Перейдите в «Дыхание», чтобы использовать, или измерьте заново выше.</string>
+    <string name="l10n_breathe_screen_not_enough_clean_beat_data_to_865a1260">Недостаточно чистых данных о пульсе, чтобы зафиксировать темп сегодня. Попробуйте отдохнувшим, сидя неподвижно и плотно надев браслет. Пока будем задавать темп 5,5 вд/мин (когерентность).</string>
+    <string name="l10n_breathe_screen_not_now_e4571490">Не сейчас</string>
+    <string name="l10n_breathe_screen_pace_7a9a6226">Темп</string>
+    <string name="l10n_breathe_screen_quick_sweep_7_min_5d58f88d">Быстрая проверка · ~7 мин</string>
+    <string name="l10n_breathe_screen_relaxation_guidance_from_your_own_numbers_16ee0ba1">Рекомендации по расслаблению на основе ваших собственных показателей: это не медицинское предупреждение и не диагноз. Динамика важнее любого отдельного значения.</string>
+    <string name="l10n_breathe_screen_sign_kotlin_math_abs_trend_hrv_e9362899">%1$s%2$s%% ВСР</string>
+    <string name="l10n_breathe_screen_sit_still_and_breathe_with_the_b7c53c40">Сидите неподвижно и дышите в такт вибрации. Можно остановиться в любой момент; прерванный проход не зафиксирует темп.</string>
+    <string name="l10n_breathe_screen_soft_tone_on_each_phase_honours_2a02c284">Мягкий сигнал на каждой фазе · учитывает беззвучный режим</string>
+    <string name="l10n_breathe_screen_started_at_it_bpm_the_rhythm_dda6a573">Начали с %1$s уд/мин · ритм следует за снижением пульса.</string>
+    <string name="l10n_breathe_screen_stop_9e253470">Стоп</string>
+    <string name="l10n_breathe_screen_stop_sweep_55299cf9">Остановить развёртку</string>
+    <string name="l10n_breathe_screen_test_buzz_deeab5ae">Тест вибрации</string>
+    <string name="l10n_breathe_screen_that_s_normal_a_paced_breath_72e2d011">Это нормально. Дыхание в заданном темпе часто успокаивает там, где один метроном не помогает.</string>
+    <string name="l10n_breathe_screen_the_strap_buzzes_a_gentle_rhythm_eb5c6a65">Браслет вибрирует в мягком ритме чуть ниже вашего текущего пульса — ощутимый метроном, под который можно расслабиться. Он плавно ведёт сердце вниз, а не тянет резко, и останавливается сам.</string>
+    <string name="l10n_breathe_screen_turn_off_8807c2b3">Выключить</string>
+    <string name="l10n_breathe_screen_waiting_for_a_resting_heart_rate_980cedbf">Ожидание пульса в покое. Сначала запустите живое измерение или вернитесь, когда будете неподвижны.</string>
+    <string name="l10n_breathe_screen_your_hrv_dipped_while_you_were_231d3c7a">Ваша ВСР снизилась, пока вы были неподвижны. Хотите минуту подышать?</string>
+    <string name="l10n_breathe_screen_session_length_a1b2c3d4">Длительность сессии</string>
+    <string name="l10n_breathe_screen_session_open_e5f6a7b8">Открыть</string>
+    <string name="l10n_breathe_screen_session_5_min_c9d0e1f2">5 мин</string>
+    <string name="l10n_breathe_screen_session_10_min_a3b4c5d6">10 мин</string>
+    <string name="l10n_breathe_screen_session_15_min_e7f8a9b0">15 мин</string>
+    <string name="l10n_breathe_screen_protocol_info_c1d2e3f4">Инфо о протоколе</string>
+    <string name="l10n_breathe_screen_hold_g5h6i7j8">Задержка…</string>
+    <string name="l10n_breathe_screen_guided_k9l0m1n2">С подсказками</string>
+    <string name="l10n_breathe_screen_about_pace_o3p4q5r6">Об этом темпе</string>
+    <string name="l10n_breathe_screen_done_s7t8u9v0">Готово</string>
+    <string name="l10n_breathe_screen_disclaimer_w1x2y3z4">Только оценка — не медицинский совет. Остановитесь, если плохо.</string>
+    <string name="l10n_breathe_screen_breathe_in_a5b6c7d8">Вдох…</string>
+    <string name="l10n_breathe_screen_breathe_out_e9f0a1b2">Выдох…</string>
+    <string name="l10n_breathe_screen_follow_cue_c3d4e5f6">Следуйте подсказке…</string>
+    <string name="l10n_breathe_screen_guided_timer_g7h8i9j0">Таймер с подсказками</string>
+    <string name="l10n_breathe_screen_resonance_k1l2m3n4">Резонанс</string>
+    <string name="l10n_breathe_screen_locked_pace_o5p6q7r8">Ваш зафиксированный темп · %1$.1f вд/мин</string>
+    <string name="l10n_breathe_screen_resonance_edu_s9t0u1v2">Ваш сохранённый резонансный темп из резонансного прохода.</string>
+    <string name="l10n_caffeine_log_after_your_clocklabel_cutoffminutes_cutoff_may_3c023900">После вашего порога %1$s — может ещё действовать ко сну.</string>
+    <string name="l10n_caffeine_log_amount_in_mg_optional_f0749888">Количество в мг (необязательно)</string>
+    <string name="l10n_caffeine_log_bedtime_e3cb8bd6">Время отхода ко сну</string>
+    <string name="l10n_caffeine_log_caffeine_22859fa3">Кофеин</string>
+    <string name="l10n_caffeine_log_flag_drinks_late_enough_to_still_af311272">Отмечать напитки, выпитые достаточно поздно, чтобы действовать ко сну.</string>
+    <string name="l10n_caffeine_log_had_it_8576ac66">Было</string>
+    <string name="l10n_caffeine_log_have_your_last_caffeine_by_about_16b09033">Последний кофеин примерно до %1$s, чтобы большая часть вывелась </string>
+    <string name="l10n_caffeine_log_late_caffeine_nudge_6b2ff690">Напоминание о позднем кофеине</string>
+    <string name="l10n_caffeine_log_log_a_coffee_tea_or_energy_982bde5b">Отметьте кофе, чай или энергетик, и NOOP покажет примерную оценку того, сколько ещё может действовать. Это ориентир на основе типичного периода полувыведения 5–6 часов, а не измерение.</string>
+    <string name="l10n_caffeine_log_logged_today_0071a46c">Записано сегодня</string>
+    <string name="l10n_caffeine_log_remove_e963907d">Удалить</string>
+    <string name="l10n_coach_screen_api_key_hidden_f3cde531">Ключ API (скрыт)</string>
+    <string name="l10n_coach_screen_ask_anything_about_your_recent_recovery_e6c287ca">Спросите что угодно о вашем недавнем восстановлении, нагрузке, сне или ВСР.</string>
+    <string name="l10n_coach_screen_ask_your_coach_b1577d4c">Спросите тренера…</string>
+    <string name="l10n_coach_screen_cancel_77dfd213">Отмена</string>
+    <string name="l10n_coach_screen_coach_error_error_ad9c8c46">Ошибка ИИ-тренера: %1$s</string>
+    <string name="l10n_coach_screen_coach_instructions_28a07975">Инструкции для ИИ-тренера</string>
+    <string name="l10n_coach_screen_coach_instructions_editor_b8f3ad31">Редактор инструкций для ИИ-тренера</string>
+    <string name="l10n_coach_screen_coach_is_thinking_aaf91547">ИИ-тренер думает</string>
+    <string name="l10n_coach_screen_connect_a_provider_6967f288">Подключите провайдера</string>
+    <string name="l10n_coach_screen_connect_b65463cb">Подключить</string>
+    <string name="l10n_coach_screen_custom_dce04fd3">Пользовательский…</string>
+    <string name="l10n_coach_screen_custom_model_2e3bedea">Своя модель</string>
+    <string name="l10n_coach_screen_custom_model_id_6ffe2740">Пользовательский ID модели</string>
+    <string name="l10n_coach_screen_disconnect_ed28e068">Отключить</string>
+    <string name="l10n_coach_screen_disconnect_provider_fa13625c">Отключить поставщика</string>
+    <string name="l10n_coach_screen_e_g_gpt_4o_1da2e4d2">например, gpt-4o</string>
+    <string name="l10n_coach_screen_enter_any_model_id_the_provider_dce4bbcb">Введите любой идентификатор модели, который принимает провайдер.</string>
+    <string name="l10n_coach_screen_fetch_models_from_provider_6654e1a0">Получить модели у провайдера</string>
+    <string name="l10n_coach_screen_key_header_3f2a9b10">Заголовок ключа</string>
+    <string name="l10n_coach_screen_let_the_coach_use_my_data_405d1188">Разрешить ИИ-тренеру использовать мои данные</string>
+    <string name="l10n_coach_screen_model_selected_tap_to_change_043056c1">Модель: %1$s. Нажмите, чтобы изменить.</string>
+    <string name="l10n_coach_screen_reset_to_default_39c90eb7">Сбросить к значению по умолчанию</string>
+    <string name="l10n_coach_screen_save_key_f5216b3a">Сохранить ключ</string>
+    <string name="l10n_coach_screen_send_message_c70a890d">Отправить сообщение</string>
+    <string name="l10n_coach_screen_server_url_1d5d1eff">URL сервера</string>
+    <string name="l10n_coach_screen_suggested_prompt_prompt_379c0b15">Предлагаемый запрос: %1$s</string>
+    <string name="l10n_coach_screen_thinking_a60d9c9c">Думает…</string>
+    <string name="l10n_coach_screen_use_bearer_for_most_local_servers_4429ab64">Используйте Bearer для большинства локальных серверов; используйте x-api-key для шлюзов, которым нужен ключ в этом заголовке.</string>
+    <string name="l10n_coach_screen_use_model_8d558ce2">Использовать модель</string>
+    <string name="l10n_compare_screen_add_a_metric_to_compare_e6a7c9f1">Добавьте метрику для сравнения</string>
+    <string name="l10n_compare_screen_compare_8d105cf4">Сравнить</string>
+    <string name="l10n_compare_screen_compare_needs_at_least_two_metrics_2bfe1fad">Для сравнения нужны минимум две метрики с историей</string>
+    <string name="l10n_compare_screen_not_enough_overlapping_days_between_these_44563110">Недостаточно совпадающих дней между этими метриками за %1$s. Расширьте диапазон.</string>
+    <string name="l10n_compare_screen_nothing_selected_yet_60968db6">Пока ничего не выбрано.</string>
+    <string name="l10n_compare_screen_p_n_overlapping_days_strengthword_p_8a8f56c7">%1$s совпадающих дней · %2$s %3$s корреляция</string>
+    <string name="l10n_coupled_screen_calibrating_calibrationnights_of_baselines_minnightsseed_nights_1a7e8f8e">Калибровка, %1$s из %2$s ночей</string>
+    <string name="l10n_coupled_screen_hoursminutes_asleepmin_slept_732a5b21">%1$s сна</string>
+    <string name="l10n_coupled_screen_hoursminutes_needmin_needed_7fc1eb15">%1$s нужно</string>
+    <string name="l10n_coupled_screen_no_effort_yet_f622f99d">Усилия пока нет</string>
+    <string name="l10n_coupled_screen_no_sleep_tracked_last_night_cd0dd79e">Прошлой ночью сон не отслеживался</string>
+    <string name="l10n_coupled_screen_recovery_b668d988">ВОССТАНОВЛЕНИЕ</string>
+    <string name="l10n_coupled_screen_sleep_performance_4611539f">Качество сна</string>
+    <string name="l10n_data_sources_screen_acts_as_a_standard_bluetooth_heart_f8d13439">Работает как обычный Bluetooth-пульсометр. Подключите NOOP с беговой дорожки, велотренажёра или приложения, чтобы видеть там пульс с вашего браслета.</string>
+    <string name="l10n_data_sources_screen_auto_sync_health_connect_periodically_6f3f4d92">Периодически автосинхронизировать Health Connect</string>
+    <string name="l10n_data_sources_screen_auto_sync_periodically_5f3041e8">Периодическая автосинхронизация</string>
+    <string name="l10n_data_sources_screen_broadcast_heart_rate_as_a_bluetooth_6a44fdb4">Транслировать пульс как Bluetooth-датчик</string>
+    <string name="l10n_data_sources_screen_broadcast_hr_from_this_phone_10e5605c">Транслировать пульс с этого телефона</string>
+    <string name="l10n_data_sources_screen_broadcast_hr_is_on_your_strap_0ad5368a">Трансляция пульса ВКЛЮЧЕНА. Этот телефон непрерывно передаёт пульс, из-за чего его радиомодуль Bluetooth остаётся активным и батарея садится быстрее. Выключайте, когда не используете с другим устройством.</string>
+    <string name="l10n_data_sources_screen_cancel_77dfd213">Отмена</string>
+    <string name="l10n_data_sources_screen_data_sources_5e43d6bb">Источники данных</string>
+    <string name="l10n_data_sources_screen_every_3560d90b">Каждые</string>
+    <string name="health_connect_categories_title">Выберите, что может читать NOOP</string>
+    <string name="health_connect_categories_detail">Выберите категории Health Connect для импорта. Это можно изменить позже.</string>
+    <string name="health_connect_category_recovery">Восстановление и самочувствие</string>
+    <string name="health_connect_category_recovery_detail">Пульс, ВСР, сон, SpO₂, дыхание и гидратация</string>
+    <string name="health_connect_category_activity">Активность</string>
+    <string name="health_connect_category_activity_detail">Шаги, калории, тренировки, дистанция и VO₂ max</string>
+    <string name="health_connect_category_body_composition">Состав тела</string>
+    <string name="health_connect_category_body_composition_detail">Вес, жировая и сухая масса</string>
+    <string name="l10n_data_sources_screen_import_apple_health_export_533fca27">Импорт выгрузки Apple Health…</string>
+    <string name="l10n_data_sources_screen_import_from_health_connect_35d55e21">Импорт из Health Connect</string>
+    <string name="l10n_data_sources_screen_import_lifting_log_8fac7b68">Импорт журнала силовых…</string>
+    <string name="l10n_data_sources_screen_import_mi_band_export_e587801c">Импорт выгрузки Mi Band…</string>
+    <string name="l10n_data_sources_screen_import_nutrition_csv_2c748273">Импорт питания CSV…</string>
+    <string name="l10n_data_sources_screen_import_wearable_export_0545c430">Импорт выгрузки носимого устройства…</string>
+    <string name="l10n_data_sources_screen_import_whoop_export_zip_16f4176b">Импорт выгрузки WHOOP (.zip)</string>
+    <string name="l10n_data_sources_screen_import_workout_file_a3a28e06">Импорт файла тренировки…</string>
+    <string name="l10n_data_sources_screen_imported_434eb26f">Импортировано</string>
+    <string name="l10n_data_sources_screen_last_sync_b793ffab">Последняя синхронизация: </string>
+    <string name="l10n_data_sources_screen_lifting_log_hevy_liftosaur_11df48df">Журнал силовых тренировок (Hevy / Liftosaur)</string>
+    <string name="l10n_data_sources_screen_nutrition_csv_1c1315d9">Питание (CSV)</string>
+    <string name="l10n_data_sources_screen_off_e3de5ab0">Выкл.</string>
+    <string name="l10n_data_sources_screen_oura_fitbit_garmin_export_7b21682f">Экспорт Oura / Fitbit / Garmin</string>
+    <string name="l10n_data_sources_screen_re_pull_new_health_connect_data_3e9c3914">Повторно забирать новые данные Health Connect (например, Samsung Health → Health Connect) каждые </string>
+    <string name="l10n_data_sources_screen_remove_apple_health_imported_data_5f878502">Удалить данные, импортированные из Apple Health?</string>
+    <string name="l10n_data_sources_screen_remove_e963907d">Удалить</string>
+    <string name="l10n_data_sources_screen_remove_imported_data_813e4695">Удалить импортированные данные</string>
+    <string name="l10n_data_sources_screen_share_back_to_health_connect_1d578f4a">Обратная выгрузка в Health Connect</string>
+    <string name="l10n_data_sources_screen_share_computed_metrics_back_to_health_c11f5d70">Выгружать вычисленные метрики обратно в Health Connect</string>
+    <string name="l10n_data_sources_screen_this_permanently_deletes_everything_imported_from_f42e760e">Это безвозвратно удалит всё, импортированное из Apple Health: пульс, ВСР, сон, шаги, тренировки и другое. Живые данные с браслета не затрагиваются. Отменить нельзя.</string>
+    <string name="l10n_data_sources_screen_whoop_history_db101974">История WHOOP</string>
+    <string name="l10n_data_sources_screen_whoop_strap_live_ble_217f7df6">Браслет WHOOP (Live BLE)</string>
+    <string name="l10n_data_sources_screen_workout_file_gpx_tcx_fit_5469c068">Файл тренировки (GPX / TCX / FIT)</string>
+    <string name="l10n_data_sources_screen_write_the_metrics_noop_computes_from_439940c2">Записывать метрики, которые NOOP вычисляет по вашему браслету (пульс в покое, ВСР, SpO₂, </string>
+    <string name="l10n_devices_screen_add_a_device_f90866b8">Добавить устройство</string>
+    <string name="l10n_devices_screen_battery_4a9be042">Батарея</string>
+    <string name="l10n_devices_screen_battery_clamped_2494c8c9">Батарея %1$s%%</string>
+    <string name="l10n_devices_screen_battery_info_probe_592_re_1dbd4c0f">Проба сведений о батарее (#592 RE)…</string>
+    <string name="l10n_devices_screen_battery_info_probe_result_592_b97c0bb8">Результат пробы батареи (#592)</string>
+    <string name="l10n_devices_screen_body_location_probe_690_re_7def8c39">Проба положения на теле (#690 RE)…</string>
+    <string name="l10n_devices_screen_body_location_probe_result_690_60c5ee79">Результат пробы положения на теле (#690)</string>
+    <string name="l10n_devices_screen_body_location_probe_explainer_a9363239">Отправляет команду положения на теле только для чтения (0x54) и записывает полный сырой ответ браслета в журнал, декодируя запись (ревизия / положение / достоверность / статус) на WHOOP 4.0. На браслет ничего не записывается, и это никогда не меняет определение ношения или оценки.</string>
+    <string name="l10n_devices_screen_feature_flag_probe_761_re_21241d68">Проба флагов функций (#761 RE)…</string>
+    <string name="l10n_devices_screen_stop_sync_4a1f2b6e">Остановить синхронизацию</string>
+    <string name="l10n_devices_screen_feature_flag_probe_result_761_c50ef4d4">Результат пробы флагов функций (#761)</string>
+    <string name="l10n_devices_screen_feature_flag_probe_explainer_58eec30f">Просит браслет перечислить ИМЕНА флагов функций, известных его прошивке: START_FF_KEY_EXCHANGE (0x75), затем SEND_NEXT_FF (0x76), пока браслет не сообщит о завершении. Только чтение — значения флагов не записываются, и команды SET из этой пробы никогда не отправляются. Список показан здесь и записан в журнал браслета.</string>
+    <string name="l10n_devices_screen_device_config_read_probe_103_re_837f46de">Проба чтения конфигурации устройства (#103 RE)…</string>
+    <string name="l10n_devices_screen_device_config_read_probe_result_103_67d02ec9">Результат пробы чтения конфигурации устройства (#103)</string>
+    <string name="l10n_devices_screen_device_config_probe_explainer_dd23169f">Запрашивает у ремешка ЗНАЧЕНИЯ конфигурации: GET_DEVICE_CONFIG_VALUE (0x79) и GET_FF_VALUE (0x80), по одному ключу за обмен. Обеих команд в этой прошивке может просто не быть — выяснить это и есть цель пробы. Только чтение — никакое значение не записывается, а команды SET из этой пробы никогда не отправляются. Результат показан здесь и записан в журнал ремешка.</string>
+    <string name="l10n_devices_screen_battery_probe_explainer_2858bb6a">Две независимые таблицы протокола расходятся в коде расширенных данных о батарее (98 против 87). Здесь отправляется проверенная команда только для чтения 98, а полный сырой ответ браслета записывается в журнал. Ответ в формате батареи подтверждает 98 на вашей прошивке; короткая заглушка означает, что вопрос остаётся открытым. На браслет ничего не записывается. Пожалуйста, экспортируйте и пришлите журнал браслета после этого.</string>
+    <string name="l10n_devices_screen_cancel_77dfd213">Отмена</string>
+    <string name="l10n_devices_screen_close_bbfa773e">Закрыть</string>
+    <string name="l10n_devices_screen_copy_af74f7c5">Копировать</string>
+    <string name="l10n_devices_screen_device_name_79d7a157">Название устройства</string>
+    <string name="l10n_devices_screen_give_device_brand_device_model_a_7a15585c">Дайте %1$s %2$s имя, которое вы узнаете.</string>
+    <string name="l10n_devices_screen_leave_none_active_b5c858cb">Не оставлять ни одного активным</string>
+    <string name="l10n_devices_screen_name_709a2322">Имя</string>
+    <string name="l10n_devices_screen_pack_voltage_9af3c3ff">%1$.2f В</string>
+    <string name="l10n_devices_screen_paired_locally_noop_owns_this_ring_30c16190">Сопряжено локально. NOOP владеет этим кольцом, пока у него есть ключ. Если вы снова сбросите кольцо или настроите его в приложении Oura, NOOP перестанет им владеть, и вам нужно будет добавить его заново, чтобы вернуть управление.</string>
+    <string name="l10n_devices_screen_pick_a_new_active_strap_edd73542">Выберите новый активный браслет</string>
+    <string name="l10n_devices_screen_rename_device_ee233604">Переименовать устройство</string>
+    <string name="l10n_devices_screen_send_probe_read_only_36b318bc">Отправить пробу (только чтение)</string>
+    <string name="l10n_devices_screen_save_efc007a3">Сохранить</string>
+    <string name="l10n_devices_screen_the_whoop_4_0_reboot_frame_690a8ff2">Кадр перезагрузки WHOOP 4.0 не подтверждён — обычный перезапуск игнорируется (#235). </string>
+    <string name="l10n_devices_screen_waiting_for_the_straps_reply_5a06e7ac">Ожидание ответа браслета…</string>
+    <string name="l10n_devices_screen_whoop_4_0_reboot_probe_b51fb50f">Проба перезагрузки WHOOP 4.0</string>
+    <string name="l10n_devices_screen_whoop_is_noop_s_primary_fully_1c9e67fd">WHOOP — основной, полностью поддерживаемый браслет NOOP. Другие пульсометры находятся на раннем, </string>
+    <string name="l10n_devices_screen_you_removed_your_active_strap_choose_2ac91d48">Вы удалили активный браслет. Выберите, какой сопряжённый браслет будет предоставлять данные в реальном времени, или не выбирайте ни один и сопрягите позже.</string>
+    <string name="l10n_fused_record_screen_done_e9b450d1">Готово</string>
+    <string name="l10n_fused_record_screen_fused_on_devicenoun_nothing_leaves_it_8a1e6a3d">Объединено на %1$s. Ничего не покидает устройство: без аккаунта, без облака.</string>
+    <string name="l10n_fused_record_screen_noop_picks_the_best_sourced_number_5e48b86a">NOOP выбирает число из лучшего источника и показывает, откуда взято каждое. Это для здоровья и любопытства. Оно не ставит диагноз и не заменяет консультацию врача.</string>
+    <string name="l10n_fused_record_screen_noop_shows_the_winner_source_displayname_4a3892cc">NOOP показывает данные %1$s, потому что этот источник %2$s для этой метрики: здесь он более надёжен, а не потому, что остальные неверны.</string>
+    <string name="l10n_fused_record_screen_other_source_displayname_agrees_fusionformat_value_78e29c2a">%1$s согласуется: %2$s</string>
+    <string name="l10n_fused_record_screen_your_bands_report_different_numbers_here_03d20d81">Ваши браслеты сообщают разные числа. Вот все источники и тот, который использует NOOP.</string>
+    <string name="l10n_health_screen_5_yr_a_fitness_comparison_not_418aa11d">± 5 лет · сравнение по форме, а не биологический возраст</string>
+    <string name="l10n_health_screen_a_wellness_estimate_from_your_habits_d00f36de">Оценка самочувствия на основе ваших привычек, а не клинический биологический возраст.</string>
+    <string name="l10n_health_screen_as_of_latest_first_726f20bb">по состоянию на %1$s</string>
+    <string name="l10n_health_screen_as_of_one_first_2b409612">по состоянию на %1$s</string>
+    <string name="l10n_health_screen_baselines_learned_on_device_over_14_c107f375">Нормы выучены на устройстве за 14 дней. Полосы показывают каждый сигнал относительно </string>
+    <string name="l10n_health_screen_cycle_phase_body_clock_and_illness_59e2d9a4">Фаза цикла, биологические часы и предупреждение о болезни — это приближения, вычисленные на вашем устройстве по </string>
+    <string name="l10n_health_screen_date_eb9a4bc1">Дата</string>
+    <string name="l10n_health_screen_heart_rate_dde6e8f7">Пульс</string>
+    <string name="l10n_health_screen_helping_most_best_label_edee8773">Помогает больше всего: %1$s</string>
+    <string name="l10n_health_screen_history_synced_8339779d">История синхронизирована</string>
+    <string name="l10n_health_screen_holding_you_back_worst_label_863a1809">Сдерживает: %1$s</string>
+    <string name="l10n_health_screen_how_accurate_is_this_dae653a8">Насколько это точно?</string>
+    <string name="l10n_health_screen_how_accurate_is_this_fitness_age_935c9a6d">Насколько точен этот фитнес-возраст?</string>
+    <string name="l10n_health_screen_lab_book_f966c140">Лабораторный журнал</string>
+    <string name="l10n_health_screen_loading_33ce4174">Загрузка…</string>
+    <string name="l10n_health_screen_longer_ranges_unlock_as_more_history_d7da5fee">Более длинные диапазоны открываются по мере накопления истории.</string>
+    <string name="l10n_health_screen_no_biometrics_yet_7c594a6c">Биометрии пока нет</string>
+    <string name="l10n_health_screen_no_strap_connected_fb37b99e">Браслет не подключён</string>
+    <string name="l10n_health_screen_not_enough_history_in_this_range_2da72f80">Недостаточно истории в этом диапазоне</string>
+    <string name="l10n_health_screen_not_enough_history_yet_0e2f93b6">Пока недостаточно истории</string>
+    <string name="l10n_health_screen_one_reading_so_far_your_trend_eaad57f2">Пока одно измерение — график тренда появится здесь, как только будет второе </string>
+    <string name="l10n_health_screen_out_of_100_da0953a8">из 100</string>
+    <string name="l10n_health_screen_respiratory_1cd8c175">Дыхание</string>
+    <string name="l10n_health_screen_resting_hr_26677094">Пульс в покое</string>
+    <string name="l10n_health_screen_sleep_3cac34e6">Сон</string>
+    <string name="l10n_health_screen_source_6da13add">Источник</string>
+    <string name="l10n_health_screen_value_8dce170d">Значение</string>
+    <string name="l10n_health_screen_your_data_fused_a740fd4a">Ваши данные, объединённые</string>
+    <string name="l10n_how_noop_works_screen_close_bbfa773e">Закрыть</string>
+    <string name="l10n_how_noop_works_screen_got_it_5b8027fa">Понятно</string>
+    <string name="l10n_how_noop_works_screen_how_noop_works_3396b27a">Как работает NOOP</string>
+    <string name="l10n_how_noop_works_screen_noop_never_makes_up_a_number_da29aca5">NOOP никогда не выдумывает число. Когда он не может честно его вычислить, он сообщает, чего не хватает и что делать, вместо того чтобы показать поддельное значение.</string>
+    <string name="l10n_how_noop_works_screen_noop_never_shows_you_a_number_d1db9958">NOOP никогда не показывает число, которое пришлось выдумать. Если оценка не готова, </string>
+    <string name="l10n_how_noop_works_screen_sleep_scores_recording_where_your_numbers_1b3e981f">Сон · оценки · запись · откуда берутся ваши данные</string>
+    <string name="l10n_hrv_snapshot_screen_an_hrv_reading_needs_the_live_11b70bff">Для показания ВСР нужен живой поток R-R. Откройте экран «Прямой эфир», подключите браслет и вернитесь сюда.</string>
+    <string name="l10n_hrv_snapshot_screen_beats_12aafda0">Удары</string>
+    <string name="l10n_hrv_snapshot_screen_mean_hr_6c9272dd">Средний пульс</string>
+    <string name="l10n_hrv_snapshot_screen_not_enough_clean_beats_sit_still_0893e6c2">Недостаточно чистых ударов — сидите неподвижно и попробуйте снова. %1$s из </string>
+    <string name="l10n_hydration_screen_a_simple_goal_that_adjusts_to_723dc08a">Простая цель, которая подстраивается под ваше усилие. Общие рекомендации по самочувствию, а не медицинский совет.</string>
+    <string name="l10n_hydration_screen_bottle_3b8ac6c7">Бутылка</string>
+    <string name="l10n_hydration_screen_cancel_77dfd213">Отмена</string>
+    <string name="l10n_hydration_screen_clear_today_1be870ea">Очистить сегодня</string>
+    <string name="l10n_hydration_screen_cup_04b95071">Чашка</string>
+    <string name="l10n_hydration_screen_custom_amount_f7219236">Своё количество</string>
+    <string name="l10n_hydration_screen_enter_any_amount_from_1_to_a85a639e">Введите любое количество от 1 до %1$s мл.</string>
+    <string name="l10n_hydration_screen_hydration_bdfb040f">Гидратация</string>
+    <string name="l10n_hydration_screen_kotlin_math_min_100_fraction_100_416d2889">%1$s процентов дневной цели</string>
+    <string name="l10n_hydration_screen_kotlin_math_min_100_fraction_100_72f2dfde">%1$s%% дневной цели</string>
+    <string name="l10n_hydration_screen_log_8bf95ea3">Журнал</string>
+    <string name="l10n_hydration_screen_logged_today_0071a46c">Записано сегодня</string>
+    <string name="l10n_hydration_screen_from_health_connect_4ad037a3">Из Health Connect</string>
+    <string name="l10n_hydration_screen_millilitres_ml_0fb0d2a4">Миллилитры (мл)</string>
+    <string name="l10n_hydration_screen_no_drinks_logged_yet_tap_sip_cc0d2f72">Напитки пока не отмечены. Нажмите «Глоток», «Чашка» или «Бутылка», чтобы начать.</string>
+    <string name="l10n_hydration_screen_no_history_yet_933f417e">Истории пока нет.</string>
+    <string name="l10n_hydration_screen_sip_78cca3e8">Глоток</string>
+    <string name="l10n_hydration_screen_sip_hydrationgoal_sip_ml_ml_cup_287647f5">Глоток %1$s мл · Чашка %2$s мл · Бутылка %3$s мл</string>
+    <string name="l10n_hydration_screen_totalml_toint_ml_522b262a">%1$s мл</string>
+    <string name="l10n_hydration_screen_undo_last_last_ml_330befc5">Отменить последнее (%1$s мл)</string>
+    <string name="l10n_insights_hub_screen_dose_here_is_timing_later_in_1b1e9326">«Доза» здесь — это время приёма (чем позже днём, тем сильнее эффект), а не миллиграммы.</string>
+    <string name="l10n_insights_hub_screen_everything_here_is_a_pattern_in_ed2162a6">Всё здесь — закономерность в ваших собственных записанных днях: связь с </string>
+    <string name="l10n_insights_hub_screen_insights_b4510362">Выводы</string>
+    <string name="l10n_insights_hub_screen_log_alcohol_or_late_caffeine_with_dec9dadf">Отмечайте алкоголь или поздний кофеин с количеством, и NOOP построит персональную кривую дозы: </string>
+    <string name="l10n_insights_hub_screen_not_enough_overlap_between_your_journal_0ebdd7a2">Недостаточно пересечений между вашими ответами в журнале и </string>
+    <string name="l10n_insights_hub_screen_per_extra_card_unitnoun_a92a5e91">На каждый дополнительный %1$s</string>
+    <string name="l10n_insights_hub_screen_reading_your_journal_and_outcomes_4a59af69">Анализирую журнал и результаты…</string>
+    <string name="l10n_insights_hub_screen_tomorrow_s_card_outcomename_ad70b7f9">%1$s завтра</string>
+    <string name="l10n_insights_hub_screen_with_564f8c6e">С</string>
+    <string name="l10n_insights_hub_screen_without_cb735356">Без</string>
+    <string name="l10n_insights_screen_baseline_e6ab7982">Норма</string>
+    <string name="l10n_insights_screen_bounce_back_be2d66a4">Быстрое восстановление</string>
+    <string name="l10n_insights_screen_change_64fbd995">Изменить</string>
+    <string name="l10n_insights_screen_compliance_68f0ae49">Соблюдение</string>
+    <string name="l10n_insights_screen_end_a2bb9d34">Завершить</string>
+    <string name="l10n_insights_screen_end_experiment_0ed6d57f">Завершить эксперимент</string>
+    <string name="l10n_insights_screen_experiment_behaviour_selection_bcb29b58">Поведение в эксперименте: %1$s</string>
+    <string name="l10n_insights_screen_experiment_progress_snapshot_dayselapsed_of_snapshot_ff62b228">Прогресс эксперимента: %1$s из %2$s дней</string>
+    <string name="l10n_insights_screen_intervention_e9b90c40">Вмешательство</string>
+    <string name="l10n_insights_screen_log_at_least_one_behaviour_above_cf7c65a6">Прежде чем начать эксперимент, запишите хотя бы одно поведение выше.</string>
+    <string name="l10n_insights_screen_mark_done_0911cce7">Отметить выполненным</string>
+    <string name="l10n_insights_screen_mark_done_today_471eb94a">Отметить выполненным сегодня</string>
+    <string name="l10n_insights_screen_next_morning_61d1ea83">Следующее утро</string>
+    <string name="l10n_insights_screen_not_enough_overlap_between_your_journal_0ebdd7a2">Недостаточно пересечений между вашими ответами в журнале и </string>
+    <string name="l10n_insights_screen_not_enough_overlapping_history_to_correlate_a552dbd4">Пока недостаточно общей истории, чтобы рассчитать связь между показателями.</string>
+    <string name="l10n_insights_screen_pick_one_behaviour_you_log_one_bd34090e">Выберите одно отслеживаемое поведение, один результат и короткий период. NOOP </string>
+    <string name="l10n_insights_screen_ranked_lag_aware_which_of_your_e0e91b39">С учётом рейтинга и задержки: какие из ваших привычек действительно влияют на Заряд, плюс ваша личная реакция на дозу алкоголя и кофеина.</string>
+    <string name="l10n_insights_screen_rest_baseline_b3ac52a5">Норма Отдыха</string>
+    <string name="l10n_insights_screen_run_a_clean_personal_test_4da69781">Провести чистый личный тест</string>
+    <string name="l10n_insights_screen_sessions_e11e37a9">Сессии</string>
+    <string name="l10n_insights_screen_skip_3da47453">Пропустить</string>
+    <string name="l10n_insights_screen_skip_today_ed6a16a5">Пропустить сегодня</string>
+    <string name="l10n_insights_screen_snapshot_dayselapsed_of_snapshot_durationdays_days_9a611f12">%1$s из %2$s дней</string>
+    <string name="l10n_insights_screen_start_experiment_45a4b379">Начать эксперимент</string>
+    <string name="l10n_insights_screen_started_snapshot_startday_testing_snapshot_outcome_1839ef40">Начато %1$s · проверяем %2$s</string>
+    <string name="l10n_insights_screen_tag_a_few_sessions_of_the_97927401">Отметьте несколько тренировок одного вида активности, и NOOP определит их индивидуальную стоимость восстановления.</string>
+    <string name="l10n_insights_screen_what_moves_you_ranked_patterns_in_7d89e628">Что вами движет. Ранжированные закономерности в ваших данных и ваша зависимость «доза-реакция».</string>
+    <string name="l10n_insights_screen_with_564f8c6e">С</string>
+    <string name="l10n_insights_screen_without_cb735356">Без</string>
+    <string name="l10n_intelligence_screen_0_unitformatter_effortscalemax_effortscale_scale_b5c43f56">Шкала 0 – %1$s</string>
+    <string name="l10n_intelligence_screen_by_day_2e5d14ca">По дням</string>
+    <string name="l10n_intelligence_screen_charge_weighs_your_heart_rate_variability_026745e6">Заряд сопоставляет вариабельность вашего сердечного ритма с вашей личной нормой </string>
+    <string name="l10n_intelligence_screen_effort_8c974bc6">Усилие</string>
+    <string name="l10n_intelligence_screen_estimate_from_today_s_effort_your_667d7560">Оценка по сегодняшнему Усилию, вашему обычному сну и вашим %1$s ночам </string>
+    <string name="l10n_intelligence_screen_how_this_works_b895a8c3">Как это работает</string>
+    <string name="l10n_intelligence_screen_intelligence_c698f940">Аналитика</string>
+    <string name="l10n_intelligence_screen_no_scored_days_in_this_window_03f1165b">В этом диапазоне нет дней с рассчитанными показателями. Расширьте диапазон или импортируйте больше истории.</string>
+    <string name="l10n_intelligence_screen_no_scored_days_yet_sync_your_cdd47684">Пока нет оценённых дней. Синхронизируйте браслет, чтобы собрать сырые данные. Усилие и Отдых </string>
+    <string name="l10n_intelligence_screen_you_ll_likely_wake_around_charge_ed3abe2e">Вы, вероятно, проснётесь примерно с %1$s ± %2$s Заряда, если поспите около </string>
+    <string name="l10n_intervals_screen_bond_your_strap_on_the_live_d799cbc2">Подключите браслет на экране «В реальном времени», чтобы ориентироваться по вибросигналам.</string>
+    <string name="l10n_intervals_screen_interval_timer_1d703deb">Интервальный таймер</string>
+    <string name="l10n_intervals_screen_pause_to_change_work_rest_or_f54f9cc5">Поставьте на паузу, чтобы изменить работу, отдых или раунды.</string>
+    <string name="l10n_intervals_screen_reset_44c57abd">Сбросить</string>
+    <string name="l10n_intervals_screen_rest_b79e5f48">Отдых</string>
+    <string name="l10n_intervals_screen_rounds_ceeac4ac">Раунды</string>
+    <string name="l10n_intervals_screen_work_00040bab">Работа</string>
+    <string name="l10n_journal_log_add_a_custom_item_0dbd8f7c">Добавить свой пункт…</string>
+    <string name="l10n_journal_log_cancel_77dfd213">Отмена</string>
+    <string name="l10n_journal_log_display_name_c7874aaa">Отображаемое имя</string>
+    <string name="l10n_journal_log_group_995a11e5">Группа…</string>
+    <string name="l10n_journal_log_group_group_title_1f88621e">Группа: %1$s</string>
+    <string name="l10n_journal_log_history_stays_under_the_original_question_dc91ce89">История остаётся под исходным вопросом, чтобы импорт из WHOOP по-прежнему совпадал.</string>
+    <string name="l10n_journal_log_rename_94ac9a58">Переименовать…</string>
+    <string name="l10n_journal_log_rename_item_3d21d6ca">Переименовать пункт</string>
+    <string name="l10n_journal_log_save_efc007a3">Сохранить</string>
+    <string name="l10n_lab_book_screen_a_private_notebook_not_a_medical_f63242cb">Личный блокнот, а не медицинский сервис.</string>
+    <string name="l10n_lab_book_screen_about_lab_book_37bf2691">О разделе «Лабораторный журнал»</string>
+    <string name="l10n_lab_book_screen_all_stays_on_this_phone_nothing_9a966c1c">Всё остаётся на этом телефоне. Ничего никуда не отправляется.</string>
+    <string name="l10n_lab_book_screen_bring_in_a_markers_csv_date_1090bec2">Загрузите CSV с маркерами (дата, маркер, значение, единица). Названия, совпадающие с каталогом, </string>
+    <string name="l10n_lab_book_screen_choose_a_wearable_signal_to_compare_05a4b2bc">Выберите сигнал носимого устройства для сравнения</string>
+    <string name="l10n_lab_book_screen_clear_719ea396">Сбросить</string>
+    <string name="l10n_lab_book_screen_delete_this_reading_b5c92bda">Удалить это измерение</string>
+    <string name="l10n_lab_book_screen_import_readings_7ad0d28f">Импорт показаний</string>
+    <string name="l10n_lab_book_screen_it_s_a_notebook_not_a_45835e98">Это блокнот, а не лаборатория. NOOP лишь выстраивает введённые вами числа. Он не проводит анализы, не трактует и не оценивает их. Это не медицинская рекомендация.</string>
+    <string name="l10n_lab_book_screen_keep_your_own_numbers_here_1ca6c8ed">Храните свои показатели здесь</string>
+    <string name="l10n_lab_book_screen_lab_book_f966c140">Лабораторный журнал</string>
+    <string name="l10n_lab_book_screen_lab_book_is_a_private_notebook_d07380ca">Лабораторный журнал — это личный блокнот, а не медицинская служба. NOOP хранит и выстраивает числа, </string>
+    <string name="l10n_lab_book_screen_lining_them_up_c59ee297">Сопоставляем…</string>
+    <string name="l10n_lab_book_screen_n_readings_line_up_but_there_27bfb506">%1$s измерений выстроены, но вариации недостаточно, чтобы вычислить связь.</string>
+    <string name="l10n_lab_book_screen_n_readings_used_strengthword_r_directionword_298baf9e">Использовано измерений: %1$s · %2$s %3$s связь. Это ваши собственные данные </string>
+    <string name="l10n_lab_book_screen_pick_a_wearable_signal_resting_hr_8d8b01a2">Выберите сигнал с носимого устройства (пульс в покое, ВСР, сон, Заряд, вес…), чтобы сопоставить его с этим </string>
+    <string name="l10n_lab_book_screen_read_the_full_lab_book_note_3a250750">Читать запись в «Лабораторном журнале» целиком</string>
+    <string name="l10n_lab_book_screen_read_the_full_note_3fd0e4d1">Читать запись целиком</string>
+    <string name="l10n_lab_book_screen_reading_your_logbook_e31992b0">Считываем ваш Logbook…</string>
+    <string name="l10n_lab_book_screen_these_are_your_own_numbers_shown_7667508d">Это ваши собственные числа, показанные вам обратно. NOOP не решает, является ли значение нормальным, высоким или низким.</string>
+    <string name="l10n_lab_book_screen_type_in_a_blood_pressure_reading_c276d418">Введите показатель артериального давления или значение холестерина с последнего приёма. </string>
+    <string name="l10n_lab_book_screen_what_lab_book_is_and_isn_f28686df">Чем является Лабораторный журнал (и чем нет)</string>
+    <string name="l10n_live_screen_manage_devices_e5c277ff">Управление устройствами</string>
+    <string name="l10n_live_screen_max_hr_6acd9e07">Макс. пульс</string>
+    <string name="l10n_live_screen_rmssd_roundtoint_ms_9e6c0887">%1$s мс</string>
+    <string name="l10n_live_screen_scan_and_connect_to_start_a_3e27b47b">Найдите и подключите браслет, чтобы начать живую передачу.</string>
+    <string name="l10n_live_screen_signal_trust_4a91fe00">Достоверность сигнала</string>
+    <string name="l10n_live_screen_start_a_live_stream_419bf5aa">Начать прямую трансляцию</string>
+    <string name="l10n_live_screen_top_zone_282d0f66">Верхняя зона</string>
+    <string name="l10n_live_screen_zone_zone_b8e9c0f9">ЗОНА %1$s</string>
+    <string name="l10n_live_session_screen_above_6370c271">Выше</string>
+    <string name="l10n_live_session_screen_below_5ba07a31">Ниже</string>
+    <string name="l10n_live_session_screen_done_e9b450d1">Готово</string>
+    <string name="l10n_live_session_screen_end_session_8c0f4c33">Завершить сессию</string>
+    <string name="l10n_live_session_screen_guarded_for_elapsedclock_snap_elapsedsec_tolong_a61f2d32">Под наблюдением %1$s</string>
+    <string name="l10n_live_session_screen_in_band_2c23d86e">В диапазоне</string>
+    <string name="l10n_live_session_screen_live_session_73c925a5">Сессия в реальном времени</string>
+    <string name="l10n_live_session_screen_session_ring_statelabel_long_press_to_42ac1b3b">Кольцо сессии. %1$s. Долгое нажатие — показать пульс.</string>
+    <string name="l10n_live_session_screen_session_summary_f9418e16">Итоги сессии</string>
+    <string name="l10n_live_session_screen_the_strap_signal_was_gone_for_57a2fead">Сигнал браслета отсутствовал 10 минут, поэтому сессия завершилась сама.</string>
+    <string name="l10n_live_workout_screen_avg_cdc93143">Сред.</string>
+    <string name="l10n_live_workout_screen_cadence_68af11f0">КАДЕНС</string>
+    <string name="l10n_live_workout_screen_cancel_77dfd213">Отмена</string>
+    <string name="l10n_live_workout_screen_effort_8c974bc6">Усилие</string>
+    <string name="l10n_live_workout_screen_of_c5e92da0">из %1$d</string>
+    <string name="l10n_live_workout_screen_end_this_workout_4869c76a">Завершить эту тренировку?</string>
+    <string name="l10n_live_workout_screen_end_workout_3e8d6238">Завершить тренировку</string>
+    <string name="l10n_live_workout_screen_peak_c83dbbd3">Пик</string>
+    <string name="l10n_live_workout_screen_power_7548ab52">МОЩНОСТЬ</string>
+    <string name="l10n_live_workout_screen_speed_2d2cb022">СКОРОСТЬ</string>
+    <string name="l10n_live_workout_screen_this_stops_recording_and_saves_what_3e17a23e">Это остановит запись и сохранит то, что уже записано. Возобновить нельзя.</string>
+    <string name="l10n_live_workout_screen_z_z_d3991a28">З%1$s</string>
+    <string name="l10n_marker_editor_screen_add_a_reading_ed7708ee">Добавить показание</string>
+    <string name="l10n_marker_editor_screen_date_taken_76edfcab">Дата съёмки</string>
+    <string name="l10n_marker_editor_screen_entered_together_stored_as_two_markers_af8f3ba0">Введены вместе; сохраняются как два маркера, чтобы каждый точно совпадал с вашими сигналами.</string>
+    <string name="l10n_marker_editor_screen_lab_book_keeps_your_own_numbers_9085ce2c">Лабораторный журнал хранит ваши собственные числа — он не проводит анализы, не трактует и не оценивает их, и это не медицинская </string>
+    <string name="l10n_marker_editor_screen_no_match_add_it_as_a_ad5c59ec">Совпадений нет. Добавьте это как собственный маркер ниже.</string>
+    <string name="l10n_marker_editor_screen_noop_never_fills_this_in_it_7be9653b">NOOP никогда не заполняет это сам — он лишь показывает ровно то, что вы ввели из своего отчёта.</string>
+    <string name="l10n_marker_editor_screen_search_markers_103981e0">Поиск маркеров</string>
+    <string name="l10n_marker_editor_screen_search_markers_e_g_ldl_ferritin_66c17802">Поиск маркеров (например, ЛПНП, ферритин)</string>
+    <string name="l10n_marker_editor_screen_stored_as_canonicalunit_0bf7f702">Сохранено как %1$s.</string>
+    <string name="l10n_marker_editor_screen_type_in_a_number_from_your_c2f4ffb8">Введите число из вашего собственного отчёта. Оно останется на этом телефоне.</string>
+    <string name="l10n_mind_section_how_are_you_feeling_today_5667deff">Как вы себя чувствуете сегодня?</string>
+    <string name="l10n_mind_section_logged_today_0071a46c">Записано сегодня</string>
+    <string name="l10n_mind_section_mood_correlations_unlock_after_mind_gate_f0c62abe">Корреляции настроения откроются после %1$s дней </string>
+    <string name="l10n_mind_section_not_enough_overlapping_history_to_correlate_d36b91f9">Недостаточно пересекающейся истории, чтобы связать настроение с вашим </string>
+    <string name="l10n_mind_section_one_check_in_per_day_picking_b103f22e">Одна отметка в день; выбор другого лица перезапишет сегодняшнюю.</string>
+    <string name="l10n_mind_section_reading_your_check_ins_71a100a9">Читаем ваши отметки…</string>
+    <string name="l10n_noop_compact_glance_widget_charge_49a8cb83">Заряд</string>
+    <string name="l10n_noop_compact_glance_widget_effort_660752e7">УСИЛИЕ</string>
+    <string name="l10n_noop_compact_glance_widget_heart_rate_410aa15c">Пульс</string>
+    <string name="l10n_noop_compact_glance_widget_rest_cbaaa181">ОТДЫХ</string>
+    <string name="l10n_noop_compact_glance_widget_strap_battery_a6c7f09c">Батарея браслета</string>
+    <string name="l10n_noop_glance_widget_charge_49a8cb83">Заряд</string>
+    <string name="l10n_noop_glance_widget_effort_660752e7">УСИЛИЕ</string>
+    <string name="l10n_noop_glance_widget_heart_rate_410aa15c">Пульс</string>
+    <string name="l10n_noop_glance_widget_rest_cbaaa181">ОТДЫХ</string>
+    <string name="l10n_noop_glance_widget_strap_battery_a6c7f09c">Батарея браслета</string>
+    <string name="l10n_notifications_settings_screen_all_other_apps_51a8af2c">Все остальные приложения</string>
+    <string name="l10n_notifications_settings_screen_app_name_wrist_alerts_dd3540fa">Оповещения на запястье: %1$s</string>
+    <string name="l10n_notifications_settings_screen_behaviour_171ca038">Поведение</string>
+    <string name="l10n_notifications_settings_screen_buzz_on_incoming_calls_625804a1">Вибрация при входящих звонках</string>
+    <string name="l10n_notifications_settings_screen_buzz_pattern_for_appname_905a31bd">Схема вибрации для %1$s</string>
+    <string name="l10n_notifications_settings_screen_calls_0a19b7e2">Звонки</string>
+    <string name="l10n_notifications_settings_screen_cancel_77dfd213">Отмена</string>
+    <string name="l10n_notifications_settings_screen_daily_reports_c1a22a74">Ежедневные отчёты</string>
+    <string name="l10n_notifications_settings_screen_enable_wrist_alerts_462b9e0f">Включить уведомления на браслете</string>
+    <string name="l10n_notifications_settings_screen_from_3f66052a">С</string>
+    <string name="l10n_notifications_settings_screen_morning_recap_45ec05c5">Утренняя сводка</string>
+    <string name="l10n_notifications_settings_screen_notifications_753a22b2">Уведомления</string>
+    <string name="l10n_notifications_settings_screen_only_buzz_when_worn_6211cee3">Вибрировать, только когда браслет надет</string>
+    <string name="l10n_notifications_settings_screen_open_notification_access_658fd30f">Открыть доступ к уведомлениям</string>
+    <string name="l10n_notifications_settings_screen_open_notification_access_settings_93fcd1bf">Открыть настройки доступа к уведомлениям</string>
+    <string name="l10n_notifications_settings_screen_optimal_strain_reached_2862ec2b">Достигнута оптимальная нагрузка</string>
+    <string name="l10n_notifications_settings_screen_phone_calls_b79420d9">Телефонные звонки</string>
+    <string name="l10n_notifications_settings_screen_phone_permission_was_denied_so_phone_db0ebdd8">Разрешение на телефон отклонено, поэтому вибрация при звонках выключена.</string>
+    <string name="l10n_notifications_settings_screen_post_workout_summary_13e488f5">Сводка после тренировки</string>
+    <string name="l10n_notifications_settings_screen_quiet_hours_706b24d0">Тихие часы</string>
+    <string name="l10n_notifications_settings_screen_set_448ab73b">Задать</string>
+    <string name="l10n_notifications_settings_screen_test_appname_buzz_dbae5be3">Проверить вибрацию %1$s</string>
+    <string name="l10n_notifications_settings_screen_test_buzz_deeab5ae">Тест вибрации</string>
+    <string name="l10n_notifications_settings_screen_uses_the_same_quiet_hours_and_03badcac">Использует те же правила тихих часов и ношения.</string>
+    <string name="l10n_notifications_settings_screen_voip_calls_96c5a102">VoIP-звонки</string>
+    <string name="l10n_notifications_settings_screen_wrist_alerts_75581d51">Уведомления на запястье</string>
+    <string name="l10n_notifications_settings_screen_wrist_delivery_needs_notification_access_so_2a14e784">Для доставки на запястье нужен доступ к уведомлениям, чтобы NOOP мог видеть, какие приложения уведомляют </string>
+    <string name="l10n_onboarding_screen_a_private_window_into_your_recovery_b8dd2ff2">Личное окно в ваше восстановление, сон и нагрузку. Читается прямо с браслета и хранится только на этом телефоне.</string>
+    <string name="l10n_onboarding_screen_a_quick_word_before_you_connect_5a29015a">Пара слов перед подключением</string>
+    <string name="l10n_onboarding_screen_a_quiet_ongoing_status_97bf2a44">Тихий постоянный статус</string>
+    <string name="l10n_onboarding_screen_about_you_5c4698b6">О вас</string>
+    <string name="l10n_onboarding_screen_age_ff9f1ff3">Возраст</string>
+    <string name="l10n_onboarding_screen_all_your_data_none_of_the_6fc6f26d">все ваши данные, никаких облачных сервисов</string>
+    <string name="l10n_onboarding_screen_back_b52b36b7">Назад</string>
+    <string name="l10n_onboarding_screen_bring_your_history_5b8775c9">Перенесите свою историю</string>
+    <string name="l10n_onboarding_screen_dark_ae1ef014">Тёмная</string>
+    <string name="l10n_onboarding_screen_estimated_max_heart_rate_profile_hrmax_06356290">Расчётный максимальный пульс · %1$s уд/мин</string>
+    <string name="l10n_onboarding_screen_estimated_max_heart_rate_profile_hrmax_622da889">Расчётный максимальный пульс %1$s уд/мин</string>
+    <string name="l10n_onboarding_screen_every_beat_every_night_every_day_ab536123">Каждый удар сердца, каждая ночь, каждый день, всё складывается в цельную картину вашего состояния. Добро пожаловать в NOOP!</string>
+    <string name="l10n_onboarding_screen_find_your_strap_fe460461">Найти браслет</string>
+    <string name="l10n_onboarding_screen_health_connect_is_not_available_on_0336b16d">Health Connect недоступен на этом устройстве.</string>
+    <string name="l10n_onboarding_screen_height_3f608b49">Рост</string>
+    <string name="l10n_onboarding_screen_history_fills_the_dashboard_immediately_9728dde5">История сразу же заполняет панель</string>
+    <string name="l10n_onboarding_screen_import_apple_health_export_077b5624">Импорт экспорта Apple Health</string>
+    <string name="l10n_onboarding_screen_import_from_health_connect_35d55e21">Импорт из Health Connect</string>
+    <string name="l10n_onboarding_screen_import_whoop_export_zip_16f4176b">Импорт выгрузки WHOOP (.zip)</string>
+    <string name="l10n_onboarding_screen_light_a36ef8ab">Лёгкий</string>
+    <string name="l10n_onboarding_screen_make_it_yours_54135155">Сделайте это своим</string>
+    <string name="l10n_onboarding_screen_no_whoop_you_can_still_continue_ec58d88d">Нет WHOOP? Вы всё равно можете продолжить. Подключите пульсометр (Polar, Wahoo, Coospo, Garmin HRM…) </string>
+    <string name="l10n_onboarding_screen_nothing_leaves_your_phone_502d5d0c">Ничего не покидает ваш телефон</string>
+    <string name="l10n_onboarding_screen_own_your_data_offline_997fe15e">Ваши данные принадлежат вам, офлайн</string>
+    <string name="l10n_onboarding_screen_put_your_strap_on_031d4807">Наденьте браслет</string>
+    <string name="l10n_onboarding_screen_see_recovery_clearly_d8db34a9">Ясно видеть восстановление</string>
+    <string name="l10n_onboarding_screen_stay_in_the_loop_f54254af">Будьте в курсе</string>
+    <string name="l10n_onboarding_screen_stop_9e253470">Стоп</string>
+    <string name="l10n_onboarding_screen_strap_02b88eeb">Браслет</string>
+    <string name="l10n_onboarding_screen_theme_a797e309">Тема</string>
+    <string name="l10n_onboarding_screen_this_can_run_while_you_finish_cd7ef783">Это может выполняться, пока вы завершаете настройку</string>
+    <string name="l10n_onboarding_screen_watch_your_heart_live_8c9c1267">Следите за пульсом в реальном времени</string>
+    <string name="l10n_onboarding_screen_weight_69c0b815">Вес</string>
+    <string name="l10n_onboarding_screen_what_noop_does_b25b362d">Что делает NOOP</string>
+    <string name="l10n_onboarding_screen_what_to_expect_ed98f851">Чего ожидать</string>
+    <string name="l10n_onboarding_screen_you_re_connected_7e06aee0">Вы подключены.</string>
+    <string name="l10n_onboarding_screen_your_thread_starts_here_acdccf92">Ваша переписка начинается здесь.</string>
+    <string name="l10n_rhythm_screen_beat_to_beat_34a3a652">МЕЖУДАРНЫЙ РИТМ</string>
+    <string name="l10n_rhythm_screen_beats_read_15da45e3">СЧИТАНО УДАРОВ</string>
+    <string name="l10n_rhythm_screen_close_rhythm_e0239fa8">Закрыть ритм</string>
+    <string name="l10n_rhythm_screen_cloud_shape_2a745ff0">ФОРМА ОБЛАКА</string>
+    <string name="l10n_rhythm_screen_during_quiet_still_resting_windows_noop_45488969">В спокойные, неподвижные периоды отдыха NOOP анализирует интервалы между вашими сердцебиениями (R-R интервалы) и строит их диаграмму Пуанкаре. По этому облаку точек вычисляются его короткая и длинная оси (SD1, SD2) и несколько простых показателей регулярности. Периоды с движением и шумом пропускаются, а не отображаются. Это прозрачная, опубликованная описательная статистика: картина вашего ритма, но никогда не клиническое измерение.</string>
+    <string name="l10n_rhythm_screen_each_dot_pairs_one_heartbeat_interval_07a1502c">Каждая точка сопоставляет один интервал между сердцебиениями со следующим. Узкая линия вдоль диагонали означает стабильный ритм; более круглое и разбросанное облако — что интервалы менялись сильнее.</string>
+    <string name="l10n_rhythm_screen_experimental_wellness_visualization_not_a_diagnosis_0745e8b7">Экспериментальная визуализация самочувствия: не диагноз, не ЭКГ и не медицинское устройство. Она не может выявить какое-либо заболевание сердца. Изменчивость от удара к удару имеет много обычных, безобидных причин. Если вы плохо себя чувствуете или обеспокоены, обратитесь к квалифицированному специалисту; в экстренной ситуации — в местную службу спасения. Все вычисления выполняются на вашем устройстве.</string>
+    <string name="l10n_rhythm_screen_extra_skipped_4a153489">ДОПОЛНИТЕЛЬНО / ПРОПУЩЕНО</string>
+    <string name="l10n_rhythm_screen_long_axis_02300830">ДЛИННАЯ ОСЬ</string>
+    <string name="l10n_rhythm_screen_no_clear_reading_yet_92f40443">Чёткого значения пока нет</string>
+    <string name="l10n_rhythm_screen_this_device_can_t_support_a_bb41aada">Это устройство не поддерживает измерение ритма</string>
+    <string name="l10n_rhythm_screen_rhythm_c715bb28">Ритм</string>
+    <string name="l10n_rhythm_screen_short_axis_66a0b7bf">КОРОТКАЯ ОСЬ</string>
+    <string name="l10n_rhythm_screen_the_numbers_7b3cbf64">Цифры</string>
+    <string name="l10n_scoring_guide_screen_charge_effort_rest_f396a530">Заряд · Усилие · Отдых</string>
+    <string name="l10n_scoring_guide_screen_close_bbfa773e">Закрыть</string>
+    <string name="l10n_scoring_guide_screen_every_score_carries_a_small_honesty_e5b722eb">У каждой оценки есть небольшая метка честности. «Калибровка» означает, что NOOP пока </string>
+    <string name="l10n_scoring_guide_screen_got_it_5b8027fa">Понятно</string>
+    <string name="l10n_scoring_guide_screen_how_sure_is_noop_solid_building_c21d86d7">Насколько уверен NOOP?  ·  Уверенно · Накопление данных · Калибровка</string>
+    <string name="l10n_scoring_guide_screen_how_your_scores_work_21a0e2be">Как работают ваши показатели</string>
+    <string name="l10n_scoring_guide_screen_noop_gives_you_three_daily_scores_36244209">NOOP даёт три ежедневные оценки (Заряд, Усилие и Отдых), каждая по шкале 0–100 </string>
+    <string name="l10n_scoring_guide_screen_these_are_independent_approximations_from_a_301457ed">Это независимые приближения по данным потребительского браслета, основанные на открытой науке: не медицинская рекомендация и не официальные оценки WHOOP.</string>
+    <string name="l10n_scoring_guide_screen_vs_whoop_9a8126a7">относительно WHOOP</string>
+    <string name="l10n_settings_screen_12_hour_41c18ba0">12-часовой</string>
+    <string name="l10n_settings_screen_24_hour_18e86819">24-часовой</string>
+    <string name="l10n_settings_screen_bottom_bar_overlay_f257c96f">Наложение нижней панели</string>
+    <string name="l10n_settings_screen_clock_04f6b3ea">Часы</string>
+    <string name="l10n_settings_screen_hide_bar_when_scrolling_b077d9f3">Скрывать панель при прокрутке</string>
+    <string name="l10n_skin_temp_cards_screen_cycle_awareness_ffb94783">Осведомлённость о цикле</string>
+    <string name="l10n_skin_temp_cards_screen_noop_can_read_a_coarse_menstrual_c79e4b85">NOOP может определить приблизительную фазу менструального цикла по ночной температуре кожи, </string>
+    <string name="l10n_skin_temp_cards_screen_turn_on_cycle_awareness_7c2d328f">Включить учёт цикла</string>
+    <string name="l10n_sleep_screen_about_this_nap_e2719b9b">Об этом дневном сне</string>
+    <string name="l10n_sleep_screen_about_your_main_sleep_1da8a640">О вашем основном сне</string>
+    <string name="l10n_sleep_screen_as_of_latest_first_726f20bb">по состоянию на %1$s</string>
+    <string name="l10n_sleep_screen_asleep_b9692bbe">Сон</string>
+    <string name="l10n_sleep_screen_asleep_duration_3638413f">Длительность сна</string>
+    <string name="l10n_sleep_screen_asleep_last_night_b969b068">во сне прошлой ночью</string>
+    <string name="l10n_sleep_screen_bedtime_wake_time_b2a22c32">Время отхода ко сну и подъёма</string>
+    <string name="l10n_sleep_screen_consistency_0ea7b95e">Регулярность</string>
+    <string name="l10n_sleep_screen_delete_this_nap_1adf0a3f">Удалить этот дневной сон</string>
+    <string name="l10n_sleep_screen_fell_asleep_at_asleep_woke_at_80465b2d">Уснули в %1$s, проснулись в %2$s</string>
+    <string name="l10n_sleep_screen_going_to_sleep_9c6c63fd">Отход ко сну</string>
+    <string name="l10n_sleep_screen_hours_asleep_06f68993">Часов сна</string>
+    <string name="l10n_sleep_screen_hours_vs_needed_500a0aca">Часы сна и потребность</string>
+    <string name="l10n_sleep_screen_hours_vs_needed_progress_bar_score_4baad051">Полоса «Часы и потребность», %1$s процентов</string>
+    <string name="l10n_sleep_screen_i_m_awake_2caf0e7f">Я проснулся</string>
+    <string name="l10n_sleep_screen_label_durationtext_minutes_percent_percent_of_6ab7ae87">%1$s: %2$s, %3$s процентов ночи</string>
+    <string name="l10n_sleep_screen_label_minutes_vs_your_typical_bar_b8f6a482">%1$s минут против вашей обычной полосы</string>
+    <string name="l10n_sleep_screen_log_going_to_sleep_6c2b519d">Отметить отход ко сну</string>
+    <string name="l10n_sleep_screen_log_waking_up_2f9c230e">Отметить пробуждение</string>
+    <string name="l10n_sleep_screen_logged_as_a_nap_wrong_tap_4285d23e">Записано как дневной сон. Неверно? Нажмите «Изменить», чтобы скорректировать время сна и пробуждения.</string>
+    <string name="l10n_sleep_screen_nap_window_durationtext_durmin_bbc35167">Дневной сон %1$s, %2$s</string>
+    <string name="l10n_sleep_screen_night_detail_8f271bcf">Подробности ночи</string>
+    <string name="l10n_sleep_screen_no_movement_detail_for_this_night_a6f9736a">Нет данных о движении за эту ночь.</string>
+    <string name="l10n_sleep_screen_no_nights_here_yet_607248f5">Здесь пока нет ночей</string>
+    <string name="l10n_sleep_screen_no_nights_with_sleep_data_yet_fa71b6b3">Ночей с данными о сне пока нет. История будет пополняться по мере того, как вы носите браслет во время сна.</string>
+    <string name="l10n_sleep_screen_not_enough_history_in_this_range_7e2fd640">Недостаточно истории в этом диапазоне. Попробуйте 3М, 6М или ВСЁ.</string>
+    <string name="l10n_sleep_screen_not_enough_history_yet_0e2f93b6">Пока недостаточно истории</string>
+    <string name="l10n_sleep_screen_per_night_sleep_balance_ledger_nightcount_f339d0ab">Баланс сна по ночам: %1$s ночей, итог %2$s</string>
+    <string name="l10n_sleep_screen_sleep_consistency_nightly_bed_and_wake_14526f89">График постоянства сна: время отхода ко сну и подъёма по ночам</string>
+    <string name="l10n_sleep_screen_sleep_debt_3aec7d9c">Недосып</string>
+    <string name="l10n_sleep_screen_sleep_debt_ledger_8cc9a992">Учёт недосыпа</string>
+    <string name="l10n_sleep_screen_sleep_debt_trend_chart_9e178776">График тренда недосыпа</string>
+    <string name="l10n_sleep_screen_sleep_hours_trend_chart_a6fbc46d">График тренда часов сна</string>
+    <string name="l10n_sleep_screen_sleep_heart_rate_chart_8ec47ae1">График пульса во сне</string>
+    <string name="l10n_sleep_screen_sleep_marks_8e9b86f0">Отметки сна</string>
+    <string name="l10n_sleep_screen_sleep_window_over_recent_nights_cc5fd9b8">Окно сна за последние ночи</string>
+    <string name="l10n_sleep_screen_spec_title_trend_chart_3085ac6e">График тренда: %1$s</string>
+    <string name="l10n_sleep_screen_stage_durationtext_minutes_percent_percent_of_477dbf14">%1$s: %2$s, %3$s процентов ночи</string>
+    <string name="l10n_sleep_screen_stages_c1d33ad5">Стадии</string>
+    <string name="l10n_sleep_screen_stages_vs_typical_28463f24">Стадии и норма</string>
+    <string name="l10n_sleep_screen_tap_when_you_re_heading_to_1f401690">Нажмите, когда ложитесь спать или просыпаетесь. Каждое нажатие записывается со временем. Это не меняет определённый сон за эту ночь.</string>
+    <string name="l10n_sleep_screen_this_metric_needs_at_least_two_2de1d37a">Этой метрике нужно минимум две ночи данных.</string>
+    <string name="l10n_sleep_screen_undo_39fc7212">Отменить</string>
+    <string name="l10n_sleep_screen_undo_sleep_deletion_1774a23c">Отменить удаление сна</string>
+    <string name="l10n_sleep_screen_why_this_is_logged_as_a_83ed7c06">Почему это записано как дневной сон</string>
+    <string name="l10n_sleep_screen_why_this_is_your_main_sleep_71efd756">Почему это ваш основной сон</string>
+    <string name="l10n_sleep_screen_why_this_sleep_ab42b016">Почему этот сон?</string>
+    <string name="l10n_sleep_screen_woke_cfbb59a8">Подъём</string>
+    <string name="l10n_smart_alarm_screen_a_backup_alarm_is_set_for_cf8b94fb">Резервный будильник установлен на %1$s. Он сработает, даже если Bluetooth отключится, браслет не надет или NOOP закрыт.</string>
+    <string name="l10n_smart_alarm_screen_alarms_131dd3d6">Будильники</string>
+    <string name="l10n_smart_alarm_screen_buzz_strapname_813772f4">Вибрация %1$s</string>
+    <string name="l10n_smart_alarm_screen_how_the_smart_wake_works_8cf34930">Как работает умное пробуждение</string>
+    <string name="l10n_smart_alarm_screen_lengthen_window_c947ea1d">Увеличить окно</string>
+    <string name="l10n_smart_alarm_screen_noop_doesn_t_have_permission_to_5b67cef0">У NOOP нет разрешения на точные будильники, поэтому пробуждение не гарантировано. </string>
+    <string name="l10n_smart_alarm_screen_off_e3de5ab0">Выкл.</string>
+    <string name="l10n_smart_alarm_screen_remind_me_to_wind_down_4839f0d0">Напомнить мне подготовиться ко сну</string>
+    <string name="l10n_smart_alarm_screen_shorten_window_5bf5b37d">Сократить окно</string>
+    <string name="l10n_smart_alarm_screen_strap_wake_alarm_1828fff3">Будильник браслета</string>
+    <string name="smart_alarm_check_strap_alarm">Проверить, что сохранено на ремешке</string>
+    <string name="smart_alarm_check_strap_alarm_help">Ответ ремешка появится в журнале ремешка и диагностическом экспорте вместе с полученными байтами.</string>
+    <string name="l10n_smart_alarm_screen_the_earliest_noop_will_wake_you_b641a2d4">Самое раннее время, когда NOOP вас разбудит.</string>
+    <string name="l10n_smart_alarm_screen_the_guaranteed_alarm_fires_this_long_b0c51052">Гарантированный будильник срабатывает через столько времени после вашего самого раннего времени.</string>
+    <string name="l10n_smart_alarm_screen_this_is_a_coarse_cue_from_d6bbabe7">Это грубый ориентир по пульсу, а не клиническое определение стадии сна. Если браслет </string>
+    <string name="l10n_smart_alarm_screen_turn_on_the_smart_alarm_to_65700430">Включите умный будильник, чтобы просыпаться внутри выбранного вами окна.</string>
+    <string name="l10n_smart_alarm_screen_wake_alarm_37af3ecf">Будильник</string>
+    <string name="l10n_smart_alarm_screen_wake_at_49089991">Подъём в</string>
+    <string name="l10n_smart_alarm_screen_wake_me_no_earlier_than_67411622">Будить не раньше</string>
+    <string name="l10n_smart_alarm_screen_wake_me_with_a_smart_alarm_bbbd082d">Будить меня умным будильником</string>
+    <string name="l10n_smart_alarm_screen_wake_me_with_a_strap_buzz_1681ba1d">Разбудить вибрацией браслета</string>
+    <string name="l10n_smart_alarm_screen_while_you_re_inside_the_window_8700ca3b">Пока вы внутри окна, NOOP следит за живым пульсом с браслета. Глубокий </string>
+    <string name="l10n_smart_alarm_screen_wind_down_nudge_5ca87a0f">Напоминание о подготовке ко сну</string>
+    <string name="l10n_smart_alarm_screen_window_length_46179fcb">Длина окна</string>
+    <string name="l10n_smart_alarm_screen_windowminutes_min_bd89fd82">%1$s мин</string>
+    <string name="l10n_smart_alarm_screen_your_whoop_5_mg_won_t_75029bae">Ваш WHOOP 5/MG не установит это, пока не включён экспериментальный режим (Настройки → </string>
+    <string name="l10n_steps_calibration_screen_calibrate_your_steps_38b4e814">Откалибруйте шаги</string>
+    <string name="l10n_steps_calibration_screen_close_bbfa773e">Закрыть</string>
+    <string name="l10n_steps_calibration_screen_day_987b9ced">День</string>
+    <string name="l10n_steps_calibration_screen_done_e9b450d1">Готово</string>
+    <string name="l10n_steps_calibration_screen_est_18b405fb">Оценка</string>
+    <string name="l10n_steps_calibration_screen_how_this_works_b895a8c3">Как это работает</string>
+    <string name="l10n_steps_calibration_screen_no_days_yet_where_both_noop_71d6005b">Пока нет дней, где шаги считали и NOOP, и ваш телефон. Как только телефон запишет </string>
+    <string name="l10n_steps_calibration_screen_no_motion_synced_yet_65106670">Данные о движении пока не синхронизированы</string>
+    <string name="l10n_steps_calibration_screen_noop_estimates_your_steps_from_your_d569bc31">NOOP оценивает ваши шаги по движению вашего WHOOP, калибруя их по счётчику шагов телефона. Это оценка, а не шагомер. WHOOP 4.0 не передаёт шаги.</string>
+    <string name="l10n_steps_calibration_screen_not_calibrated_yet_30abe0d0">Пока не откалибровано</string>
+    <string name="l10n_steps_calibration_screen_on_the_days_your_phone_also_2f65a14c">В дни, когда телефон тоже считал шаги, NOOP выясняет, как ваше движение соотносится с </string>
+    <string name="l10n_steps_calibration_screen_open_noop_near_your_strap_and_e08ddd6d">Откройте NOOP рядом с браслетом и дайте ему догнать (полная синхронизация истории может занять время на </string>
+    <string name="l10n_steps_calibration_screen_override_the_automatic_fit_with_your_36a7b6fa">Переопределите автоматический подбор своим значением шагов на единицу движения. Полезно, если ваш телефон </string>
+    <string name="l10n_steps_calibration_screen_phone_77064d52">Телефон</string>
+    <string name="l10n_steps_calibration_screen_shortday_row_day_estimated_row_estimated_f2d71597">%1$s: оценка %2$s шагов, телефон %3$s </string>
+    <string name="l10n_steps_calibration_screen_steps_per_motion_unit_a2c2ac56">шагов на единицу движения</string>
+    <string name="l10n_steps_calibration_screen_takes_effect_on_the_next_analytics_13205327">Вступит в силу при следующем расчёте аналитики (после следующей синхронизации).</string>
+    <string name="l10n_steps_calibration_screen_these_are_the_days_where_your_ae5c9c2c">Это дни, когда телефон также считал шаги, поэтому NOOP может понять, как ваше движение соотносится с шагами. Либо задайте коэффициент вручную ниже.</string>
+    <string name="l10n_steps_calibration_screen_these_days_are_excluded_from_the_6bedabbf">Эти дни исключены из оценки (вместо неё показан реальный счёт вашего телефона). Они здесь только для того, чтобы вы могли оценить точность.</string>
+    <string name="l10n_steps_calibration_screen_we_re_not_seeing_any_motion_6ac8e092">Мы пока не видим движения с вашего браслета. Шаги оцениваются по движению вашего WHOOP </string>
+    <string name="l10n_steps_calibration_screen_whoop_4_0_motion_steps_a63239dc">WHOOP 4.0 · движение → шаги</string>
+    <string name="l10n_strand_components_next_day_38f859dd">Следующий день</string>
+    <string name="l10n_strand_components_previous_day_e2b6b0a1">Предыдущий день</string>
+    <string name="l10n_stress_screen_band_title_hours_hours_f9779fd3">%1$s %2$s часов</string>
+    <string name="l10n_stress_screen_calm_time_fa546d52">Спокойное время</string>
+    <string name="l10n_stress_screen_hours_h_7610ac7c">%1$sч</string>
+    <string name="l10n_stress_screen_no_stress_history_yet_ec962e3c">Истории стресса пока нет</string>
+    <string name="l10n_stress_screen_reading_your_heart_rate_variability_and_c0249246">Загружаю ВСР и пульс в покое…</string>
+    <string name="l10n_stress_screen_resting_hr_26677094">Пульс в покое</string>
+    <string name="l10n_stress_screen_start_a_breathe_session_9619e5c0">Начать сеанс дыхания</string>
+    <string name="l10n_stress_screen_stress_bad33342">Стресс</string>
+    <string name="l10n_stress_screen_your_last_day_sustainedrun_hours_have_194825dd">Последние %1$s часов вы остаётесь в высокой зоне. Несколько минут </string>
+    <string name="l10n_test_centre_screen_7_night_baseline_base_ms_normal_43d9cfa6">Норма за 7 ночей %1$s мс, обычный диапазон %2$s–%3$s мс%4$s</string>
+    <string name="l10n_test_centre_screen_also_write_the_strap_log_to_655b55b2">Также писать журнал браслета в системный журнал (logcat) для разработки через adb. По умолчанию выключено.</string>
+    <string name="l10n_test_centre_screen_android_runs_this_via_workmanager_doze_875e499e">Android выполняет это через WorkManager (Doze может задержать).</string>
+    <string name="l10n_test_centre_screen_calibrating_validcount_hrvreadiness_min_nights_nights_c5b21706">Калибровка (%1$s из %2$s ночей)</string>
+    <string name="l10n_test_centre_screen_cancel_77dfd213">Отмена</string>
+    <string name="l10n_test_centre_screen_daily_auto_export_02ed9f75">Ежедневный автоэкспорт</string>
+    <string name="l10n_test_centre_screen_debug_logging_daaa7d74">Отладочное журналирование</string>
+    <string name="l10n_test_centre_screen_diagnostic_tools_04ba4d3f">ДИАГНОСТИЧЕСКИЕ ИНСТРУМЕНТЫ</string>
+    <string name="l10n_test_centre_screen_experimental_algorithms_e09581e2">Экспериментальные алгоритмы</string>
+    <string name="l10n_test_centre_screen_export_f3e4fadb">Экспорт</string>
+    <string name="l10n_test_centre_screen_export_time_2ca90c2e">Время экспорта</string>
+    <string name="l10n_test_centre_screen_keep_last_exports_44bc65f5">Хранить последние экспорты</string>
+    <string name="l10n_test_centre_screen_older_scheduled_exports_beyond_this_c75723fc">Более старые запланированные экспорты сверх этого числа удаляются автоматически, начиная с самых старых.</string>
+    <string name="l10n_test_centre_screen_clear_scheduled_exports_54123329">Очистить запланированные экспорты</string>
+    <string name="l10n_test_centre_screen_clear_scheduled_exports_36e93dd0">Очистить запланированные экспорты?</string>
+    <string name="l10n_test_centre_screen_this_deletes_every_scheduled_strap_ea52c535">Это удалит все запланированные файлы журнала браслета и сырого захвата, сохранённые NOOP. Отменить нельзя.</string>
+    <string name="l10n_test_centre_screen_heads_up_this_test_mode_is_8b82ed69">Внимание: этот тестовый режим выключен, поэтому в отчёте нет соответствующего захвата. Для </string>
+    <string name="l10n_test_centre_screen_hr_from_ppg_sub_lag_interpolation_a3ed1536">Пульс из PPG: интерполяция внутри задержки (заполнение пропусков v26)</string>
+    <string name="l10n_test_centre_screen_hrv_readiness_experimental_924f61bc">Готовность по ВСР (эксперимент)</string>
+    <string name="l10n_test_centre_screen_hrv_readiness_experimental_word_a471930e">Готовность по ВСР (эксперимент): %1$s</string>
+    <string name="l10n_test_centre_screen_hrv_readiness_plews_altini_bce6578f">Готовность по ВСР (Plews/Altini)</string>
+    <string name="l10n_test_centre_screen_recalibrate_aaa989ea">Перекалибровать</string>
+    <string name="l10n_test_centre_screen_recalibrate_charge_baseline_52a05a26">Перекалибровать норму Заряда</string>
+    <string name="l10n_test_centre_screen_recalibrate_your_charge_baseline_018e3846">Перекалибровать норму Заряда?</string>
+    <string name="l10n_test_centre_screen_report_a_bug_with_my_log_5101ee49">Сообщить об ошибке, приложив журнал</string>
+    <string name="l10n_test_centre_screen_report_ee45c303">Отчёт</string>
+    <string name="l10n_test_centre_screen_review_before_sharing_d7050383">Проверьте перед отправкой</string>
+    <string name="l10n_test_centre_screen_share_09ca55ca">Поделиться</string>
+    <string name="l10n_test_centre_screen_share_strap_log_for_bug_reports_b9802500">Поделиться журналом браслета (для отчётов об ошибках)</string>
+    <string name="l10n_test_centre_screen_test_centre_37b36828">Тестовый центр</string>
+    <string name="l10n_test_centre_screen_test_modes_e21f1d3c">ТЕСТОВЫЕ РЕЖИМЫ</string>
+    <string name="l10n_test_centre_screen_this_is_exactly_what_your_report_77278bdd">Это ровно то, что будет в вашем отчёте. Ничего не покидает телефон, пока вы не нажмёте «Поделиться».</string>
+    <string name="l10n_test_centre_screen_this_restarts_the_roughly_4_night_33cce377">Это заново запускает примерно 4-ночное накопление данных для Заряда и вашей нормы ВСР. История сохраняется.</string>
+    <string name="l10n_today_screen_arrange_today_6b699147">Настроить «Сегодня»</string>
+    <string name="l10n_today_screen_calibrating_37c2c9bd">Калибровка</string>
+    <string name="l10n_today_screen_no_new_nights_from_your_strap_for_stale_days_8863bcfe">Нет новых ночей с вашего браслета уже %1$d дней. Проверьте, что он подключён и сохраняет данные.</string>
+    <string name="l10n_today_screen_calibratingnights_of_baselines_minnightsseed_3b76e55c">%1$s из %2$s</string>
+    <string name="l10n_today_screen_choose_which_cards_show_on_today_f79942e1">Выберите, какие карточки показывать на «Сегодня», и меняйте их порядок стрелками. </string>
+    <string name="l10n_today_screen_close_bbfa773e">Закрыть</string>
+    <string name="l10n_today_screen_customise_your_cards_2428d761">Настройте свои карточки</string>
+    <string name="l10n_today_screen_dismiss_70afe9ef">Закрыть</string>
+    <string name="l10n_today_screen_done_e9b450d1">Готово</string>
+    <string name="l10n_today_screen_hold_a_section_and_drag_it_1d6e2441">Удерживайте раздел и перетащите, чтобы изменить порядок — здесь или прямо на карточках «Сегодня».</string>
+    <string name="l10n_today_screen_how_charge_is_calculated_142d5e8e">Как рассчитывается Заряд</string>
+    <string name="l10n_today_screen_how_charge_is_calculated_the_method_3ea7548b">Как рассчитывается Заряд. Метод, лежащий в основе показателя.</string>
+    <string name="l10n_today_screen_move_item_card_title_down_abd8549a">Переместить %1$s вниз</string>
+    <string name="l10n_today_screen_move_item_card_title_up_61a1b306">Переместить %1$s вверх</string>
+    <string name="l10n_today_screen_my_dashboard_a7a19e72">Моя панель</string>
+    <string name="l10n_today_screen_needs_a_tracked_night_ccfd532a">нужна отслеженная ночь</string>
+    <string name="l10n_today_screen_new_here_b81f2e17">Впервые здесь?</string>
+    <string name="l10n_today_screen_now_e3b82040">Сейчас</string>
+    <string name="l10n_today_screen_quick_actions_e47e8042">Быстрые действия</string>
+    <string name="l10n_today_screen_readiness_word_749b3330">Готовность: %1$s</string>
+    <string name="l10n_today_screen_reset_44c57abd">Сбросить</string>
+    <string name="l10n_today_screen_return_to_workout_30dc5509">Вернуться к тренировке</string>
+    <string name="l10n_today_screen_see_how_charge_effort_and_rest_80243197">Узнайте, как рассчитываются Заряд, Усилие и Отдых и чем они отличаются от показателей WHOOP.</string>
+    <string name="l10n_today_screen_see_how_it_works_f7b38f07">Посмотреть, как это работает</string>
+    <string name="l10n_today_screen_show_item_card_title_7844540d">Показать %1$s</string>
+    <string name="l10n_today_screen_signed_pts_5ea85678">%1$s пт</string>
+    <string name="l10n_today_screen_the_method_behind_the_score_not_5bc68508">Метод, стоящий за оценкой, а не сегодняшние значения.</string>
+    <string name="l10n_today_screen_title_beta_detail_6b39ae21">%1$s, бета. %2$s</string>
+    <string name="l10n_today_screen_what_shaped_your_charge_9f53a2b3">Что повлияло на ваш Заряд</string>
+    <string name="l10n_today_screen_workout_in_progress_af2322c9">ТРЕНИРОВКА ВЫПОЛНЯЕТСЯ</string>
+    <string name="l10n_today_screen_workout_in_progress_sportlabel_elapsed_return_95ce4bda">Идёт тренировка, %1$s, %2$s. Вернуться к тренировке.</string>
+    <string name="l10n_updates_inbox_screen_clear_all_c043160a">Очистить всё</string>
+    <string name="l10n_updates_inbox_screen_earlier_13f7aee7">РАНЕЕ</string>
+    <string name="l10n_updates_inbox_screen_mark_all_read_8958e22c">Отметить всё как прочитанное</string>
+    <string name="l10n_updates_inbox_screen_mark_read_3bf98fa6">Отметить прочитанным</string>
+    <string name="l10n_updates_inbox_screen_new_6403f2b7">НОВОЕ</string>
+    <string name="l10n_updates_inbox_screen_new_release_notes_and_fresh_data_1632c576">Здесь появятся заметки о новых версиях и свежие данные.</string>
+    <string name="l10n_updates_inbox_screen_restore_to_today_77c7c8e5">Вернуться к «Сегодня»</string>
+    <string name="l10n_updates_inbox_screen_updates_c76d1807">Обновления</string>
+    <string name="l10n_updates_inbox_screen_you_re_all_caught_up_3d39c469">Вы всё просмотрели.</string>
+    <string name="l10n_weekly_digest_card_no_readings_this_week_yet_0745a2df">На этой неделе показаний пока нет</string>
+    <string name="l10n_weekly_digest_card_week_in_review_66d95a07">Итоги недели</string>
+    <string name="l10n_whats_new_sheet_close_bbfa773e">Закрыть</string>
+    <string name="l10n_whats_new_sheet_got_it_5b8027fa">Понятно</string>
+    <string name="l10n_whats_new_sheet_release_notes_cd5af734">Заметки о выпуске</string>
+    <string name="l10n_wheel_picker_cancel_77dfd213">Отмена</string>
+    <string name="l10n_wheel_picker_done_e9b450d1">Готово</string>
+    <string name="l10n_whoop_model_comparison_screen_4_0_vs_5_0_mg_56099a02">4.0 против 5.0/MG</string>
+    <string name="l10n_whoop_model_comparison_screen_both_straps_are_supported_8545557a">Поддерживаются оба браслета</string>
+    <string name="l10n_whoop_model_comparison_screen_cap_feature_whoop_4_0_cap_bc142cb8">%1$s. WHOOP 4.0: %2$s. WHOOP 5 или MG: %3$s.</string>
+    <string name="l10n_whoop_model_comparison_screen_close_bbfa773e">Закрыть</string>
+    <string name="l10n_whoop_model_comparison_screen_done_e9b450d1">Готово</string>
+    <string name="l10n_whoop_model_comparison_screen_feature_ad565d9d">Функция</string>
+    <string name="l10n_whoop_model_comparison_screen_noop_pairs_with_the_whoop_4_599b088c">NOOP работает с WHOOP 4.0 и WHOOP 5.0/MG. У них общее почти всё важное (живой </string>
+    <string name="l10n_whoop_model_comparison_screen_on_a_whoop_4_0_32a5968d">У вас WHOOP 4.0?</string>
+    <string name="l10n_whoop_model_comparison_screen_what_each_can_read_and_why_4348bd67">Что может читать каждый и почему</string>
+    <string name="l10n_whoop_model_comparison_screen_you_re_not_missing_the_broadcast_1d2fa907">Вы не лишены функции трансляции. Чтобы передать пульс на тренажёр, </string>
+    <string name="l10n_workout_start_cancel_77dfd213">Отмена</string>
+    <string name="l10n_workout_start_end_a2bb9d34">Завершить</string>
+    <string name="l10n_workout_start_open_cf9b7706">Открыть</string>
+    <string name="l10n_workout_start_search_sport_004b7928">Поиск вида спорта</string>
+    <string name="l10n_workout_start_start_a_workout_32caf94d">Начать тренировку</string>
+    <string name="l10n_workout_start_start_selected_name_10603889">Начать %1$s</string>
+    <string name="l10n_workout_start_start_workout_d0f3f2cd">Начать тренировку</string>
+    <string name="l10n_workout_start_track_gps_route_133861c5">Записывать GPS-маршрут</string>
+    <string name="l10n_workouts_screen_activity_breakdown_214431d6">Структура активности</string>
+    <string name="l10n_workouts_screen_add_workout_a196a2cc">Добавить тренировку</string>
+    <string name="l10n_workouts_screen_all_sessions_03bc4eb4">Все сессии</string>
+    <string name="l10n_workouts_screen_all_sources_c0e8e58c">Все источники</string>
+    <string name="l10n_workouts_screen_all_sports_dfad56f1">Все виды спорта</string>
+    <string name="l10n_workouts_screen_avg_hr_is_shown_as_typed_2c8db249">Средний пульс отображается как введено вручную. График пульса, зоны и Усилие остаются из записанной сессии.</string>
+    <string name="l10n_workouts_screen_cancel_77dfd213">Отмена</string>
+    <string name="l10n_workouts_screen_clear_719ea396">Сбросить</string>
+    <string name="l10n_workouts_screen_clear_filters_41222671">Сбросить фильтры</string>
+    <string name="l10n_workouts_screen_clear_search_67300d0f">Очистить поиск</string>
+    <string name="l10n_workouts_screen_delete_f6fdbe48">Удалить</string>
+    <string name="l10n_workouts_screen_dismiss_not_a_workout_560c7bb5">Отклонить (это не тренировка)</string>
+    <string name="l10n_workouts_screen_duplicate_as_manual_2d580d46">Дублировать как ручную запись…</string>
+    <string name="l10n_workouts_screen_e_g_running_7dc6eba4">например, бег</string>
+    <string name="l10n_workouts_screen_edit_b454359e">Изменить…</string>
+    <string name="l10n_workouts_screen_edit_details_9e62bb59">Изменить детали…</string>
+    <string name="l10n_workouts_screen_effort_this_effectiverange_heroword_0bd5e794">Усилие за %1$s</string>
+    <string name="l10n_workouts_screen_enter_a_sport_a_positive_duration_3da88ad5">Укажите вид спорта, положительную длительность (≤ 24 ч) и корректные пульс (25–250) / калории (0–20 000).</string>
+    <string name="l10n_workouts_screen_filter_by_source_db11bbb7">Фильтр по источнику</string>
+    <string name="l10n_workouts_screen_filter_by_sport_bcbbcb3b">Фильтр по виду спорта</string>
+    <string name="l10n_workouts_screen_hr_zones_293d7175">Зоны пульса</string>
+    <string name="l10n_workouts_screen_merge_ea8f0d02">Объединить</string>
+    <string name="l10n_workouts_screen_most_active_cf01766b">Самый активный</string>
+    <string name="l10n_workouts_screen_name_the_merged_session_031b0d8b">Назовите объединённую сессию</string>
+    <string name="l10n_workouts_screen_no_workouts_yet_85a92042">Тренировок пока нет</string>
+    <string name="l10n_workouts_screen_re_label_as_33fec7b2">Переименовать в…</string>
+    <string name="l10n_workouts_screen_search_sport_004b7928">Поиск вида спорта</string>
+    <string name="l10n_workouts_screen_share_of_imported_zone_time_duration_b0985680">Доля импортированного времени в зонах, взвешенная по длительности сессий (приблизительно).</string>
+    <string name="l10n_workouts_screen_show_more_more_remaining_remaining_d1662e67">Показать ещё %1$s (осталось %2$s)</string>
+    <string name="l10n_workouts_screen_show_more_more_sessions_25bce755">Показать ещё %1$s сессий</string>
+    <string name="l10n_workouts_screen_started_faa9e7e7">Начата</string>
+    <string name="l10n_workouts_screen_the_average_above_was_edited_the_0a7881f0">Среднее значение выше было изменено вручную. График, зоны и Усилие остаются взятыми из записанной тренировки.</string>
+    <string name="l10n_workouts_screen_these_sessions_have_no_sport_label_53993414">У этих сессий пока нет вида спорта. Выберите его для объединённой сессии.</string>
+    <string name="l10n_workouts_screen_this_session_s_contribution_to_the_fe40ab3d">Вклад этой сессии в Усилие за день, зафиксированный во время тренировки.</string>
+    <string name="l10n_workouts_screen_this_session_s_effort_onedecimal_shown_74eed8be">Усилие этой сессии, %1$s по </string>
+    <string name="l10n_workouts_screen_total_calories_0a49da20">Всего калорий</string>
+    <string name="l10n_workouts_screen_total_distance_e8260e11">Общая дистанция</string>
+    <string name="l10n_workouts_screen_total_time_8ce2e6c3">Общее время</string>
+    <string name="l10n_workouts_screen_total_workouts_7abd421f">Всего тренировок</string>
+    <string name="l10n_workouts_screen_workout_actions_88be5c37">Действия с тренировкой</string>
+    <string name="l10n_workouts_screen_workouts_ccb58b22">Тренировки</string>
+    <string name="l10n_add_device_wizard_back_b52b36b7">Назад</string>
+    <string name="l10n_add_device_wizard_cancel_77dfd213">Отмена</string>
+    <string name="l10n_add_device_wizard_close_bbfa773e">Закрыть</string>
+    <string name="l10n_add_device_wizard_make_active_75690bb8">Сделать активным</string>
+    <string name="l10n_add_device_wizard_make_confirmname_your_active_device_now_90ceb73e">Сделать %1$s активным устройством? Оно будет предоставлять данные в реальном времени. Вы можете изменить </string>
+    <string name="l10n_add_device_wizard_make_this_your_active_device_b425485c">Сделать это устройство активным?</string>
+    <string name="l10n_add_device_wizard_noop_will_install_its_own_key_d3f6321e">NOOP установит на кольцо собственный ключ и станет его владельцем. Приложение Oura больше не будет управлять этим кольцом. Так и задумано, и отменить это из NOOP нельзя.</string>
+    <string name="l10n_add_device_wizard_not_now_e4571490">Не сейчас</string>
+    <string name="l10n_add_device_wizard_take_over_2c7f5505">Взять управление</string>
+    <string name="l10n_add_device_wizard_take_over_this_ring_cc79ef5e">Взять управление этим кольцом?</string>
+    <string name="l10n_app_changelog_5_mg_bonding_on_android_health_c94c46ac">Сопряжение 5/MG на Android + исправление Health Monitor</string>
+    <string name="l10n_app_changelog_a_beautiful_new_look_aa8c910c">Прекрасный новый вид</string>
+    <string name="l10n_app_changelog_a_big_bug_fix_sweep_with_65335764">Большая волна исправлений, подкреплённая Центром тестирования</string>
+    <string name="l10n_app_changelog_a_big_one_smarter_sleep_naps_8d7745c6">Крупное обновление: умнее сон, дневной сон, больше устройств и куча исправлений</string>
+    <string name="l10n_app_changelog_a_bolder_today_screen_4efe8215">Более выразительный экран «Сегодня»</string>
+    <string name="l10n_app_changelog_a_calmer_today_your_charge_explained_e4174303">Спокойнее «Сегодня», понятный Заряд и новая наука о ВСР под капотом</string>
+    <string name="l10n_app_changelog_a_cleaner_home_refreshed_design_a_8c91c06b">Чище главный экран — обновлённый дизайн, новые входящие, ваше фото</string>
+    <string name="l10n_app_changelog_a_fresh_look_new_gold_on_6f379935">Свежий вид — новая золото-на-синем иконка</string>
+    <string name="l10n_app_changelog_a_quick_fix_9cd2b7de">Быстрое исправление</string>
+    <string name="l10n_app_changelog_a_round_of_fixes_reconnect_exports_7700d972">Серия исправлений — переподключение, экспорт и настройка Health</string>
+    <string name="l10n_app_changelog_a_round_of_fixes_steps_insights_8f8e6010">Серия исправлений — шаги, Выводы и настройка Health</string>
+    <string name="l10n_app_changelog_a_round_of_look_and_feel_196f6ef3">Серия улучшений внешнего вида</string>
+    <string name="l10n_app_changelog_a_small_honest_ask_32f2ec41">Небольшая честная просьба</string>
+    <string name="l10n_app_changelog_a_smart_wake_alarm_live_workout_0ef814cc">Умный будильник, режим живой тренировки, редактируемое «Сегодня» и импорт силовых</string>
+    <string name="l10n_app_changelog_a_smoother_dashboard_on_big_histories_3e3a8dea">Плавнее панель при большой истории и понятнее Умный будильник</string>
+    <string name="l10n_app_changelog_a_sync_chip_on_today_clearer_37682fc9">Индикатор синхронизации на «Сегодня», понятнее предупреждения о часах браслета и полный немецкий</string>
+    <string name="l10n_app_changelog_a_whole_new_look_titanium_gold_b40e0108">Совершенно новый вид — «Титан и золото»</string>
+    <string name="l10n_app_changelog_a_whoop_style_today_chart_clearer_9bdd13ff">График «Сегодня» в стиле WHOOP, понятнее время сна — и большое обновление для iPhone</string>
+    <string name="l10n_app_changelog_accuracy_reliability_accessibility_a_big_community_43c3787d">Точность, надёжность и доступность — большая волна исправлений от сообщества</string>
+    <string name="l10n_app_changelog_android_bottom_tab_bar_99b41cad">Android: нижняя панель вкладок</string>
+    <string name="l10n_app_changelog_android_faster_sync_skin_temp_sync_4f774d79">Android: быстрее синхронизация, температура кожи, статус синхронизации, основа для будильника</string>
+    <string name="l10n_app_changelog_android_gps_route_distance_fix_817a80d6">Исправление дистанции GPS-маршрута на Android</string>
+    <string name="l10n_app_changelog_android_home_screen_widget_98b0782a">Виджет на главном экране Android</string>
+    <string name="l10n_app_changelog_android_notification_recovery_fix_widget_armour_b84839c6">Android: исправление восстановления уведомлений + защита виджета</string>
+    <string name="l10n_app_changelog_android_reconnect_guide_a_startup_crash_9900dd7a">Руководство по переподключению на Android + исправление сбоя при запуске</string>
+    <string name="l10n_app_changelog_android_reliable_reconnect_after_a_dropout_c96cb4c0">Android: надёжное переподключение после обрыва</string>
+    <string name="l10n_app_changelog_android_share_back_to_health_connect_4d87898e">Android: обратная выгрузка в Health Connect</string>
+    <string name="l10n_app_changelog_android_the_widget_now_actually_updates_dc770011">Android: виджет теперь действительно обновляется</string>
+    <string name="l10n_app_changelog_android_today_clearer_empty_states_39ad5d2c">Android «Сегодня»: понятнее пустые состояния</string>
+    <string name="l10n_app_changelog_android_whoop_4_on_newer_firmware_383314db">Android: WHOOP 4 на новой прошивке снова записывает данные</string>
+    <string name="l10n_app_changelog_apple_health_export_sleep_nights_recovered_1fc04ee2">Экспорт в Apple Health, восстановленные ночи сна и Усилие для импортированных заездов</string>
+    <string name="l10n_app_changelog_auto_sync_health_connect_android_698f0129">Автосинхронизация Health Connect (Android)</string>
+    <string name="l10n_app_changelog_background_gps_sleep_time_editing_log_7baa5d7a">Фоновый GPS, редактирование времени сна, запись наперёд и более чёткая плитка Отдыха</string>
+    <string name="l10n_app_changelog_backup_controls_and_a_lighter_app_a08f0fe4">Управление резервными копиями и более лёгкое приложение</string>
+    <string name="l10n_app_changelog_backup_restore_fixed_plus_appearance_controls_d0b9c0fe">Исправлено восстановление из копии, плюс настройки внешнего вида</string>
+    <string name="l10n_app_changelog_backup_restore_the_wrong_day_fix_ecbfd90d">Резервное копирование и восстановление, исправление неверного дня и умнее Центр тестирования</string>
+    <string name="l10n_app_changelog_battery_refresh_on_whoop_5_0_0304ac74">Обновление заряда на WHOOP 5.0/MG (Mac + Android)</string>
+    <string name="l10n_app_changelog_battery_responsiveness_smarter_sync_lighter_notification_e6949f3c">Батарея и отзывчивость: умнее синхронизация, легче уведомление</string>
+    <string name="l10n_app_changelog_better_diagnostics_for_newer_strap_firmware_a7ef4187">Лучше диагностика новой прошивки браслета — чтобы мы могли её расшифровать</string>
+    <string name="l10n_app_changelog_better_strap_log_diagnostics_122f820c">Улучшенная диагностика журнала браслета</string>
+    <string name="l10n_app_changelog_big_fix_wave_clock_reconnect_local_a2959a50">Большая волна исправлений — часы, переподключение, локальная LLM, Обзор, вес и другое</string>
+    <string name="l10n_app_changelog_bluetooth_stream_apple_health_sync_fixes_78e16558">Исправления потока Bluetooth и синхронизации с Apple Health</string>
+    <string name="l10n_app_changelog_board_sweep_battery_days_left_browse_8b78e0b6">Board Sweep: остаток дней батареи, просмотр прошлых недель, дыхательные подсказки и множество исправлений</string>
+    <string name="l10n_app_changelog_broadcast_your_heart_rate_to_garmin_338605c5">Транслируйте пульс в Garmin, Zwift и тренажёры</string>
+    <string name="l10n_app_changelog_browse_past_nights_smarter_coach_workout_9fc9bfd2">Просмотр прошлых ночей, умнее ИИ-тренер, время тренировок, батарея и другое</string>
+    <string name="l10n_app_changelog_browse_the_last_few_days_interactive_a13e7b2a">Просмотр последних дней, интерактивные графики и экран показателей (Android)</string>
+    <string name="l10n_app_changelog_bug_fix_sweep_steps_sleep_export_50c60c51">Волна исправлений: шаги, экспорт сна и экономящее батарею переподключение</string>
+    <string name="l10n_app_changelog_bug_fixes_effort_the_widget_s_6b807b50">Исправления: Усилие, день в виджете и переподключение Oura</string>
+    <string name="l10n_app_changelog_buzz_whoop_4_in_the_smart_4d17676a">Вибрация WHOOP 4 в Умном будильнике</string>
+    <string name="l10n_app_changelog_charge_effort_rest_noop_s_own_8c323656">Заряд, Усилие и Отдых — собственные оценки NOOP по 100-балльной шкале</string>
+    <string name="l10n_app_changelog_charge_shows_calibrating_instead_of_no_51a000e9">Заряд показывает «Калибровка» вместо «Нет данных» для новых браслетов</string>
+    <string name="l10n_app_changelog_check_for_updates_736b9062">Проверить обновления</string>
+    <string name="l10n_app_changelog_classic_chart_colours_a_throwback_toggle_e8150db5">Классические цвета графиков — переключатель в прошлое</string>
+    <string name="l10n_app_changelog_cleaner_live_status_better_sync_diagnostics_00ad8d26">Чище статус живого режима и лучше диагностика синхронизации</string>
+    <string name="l10n_app_changelog_cleaner_score_rings_a_few_fixes_7094ae7b">Аккуратнее кольца оценок и несколько исправлений</string>
+    <string name="l10n_app_changelog_clearer_answers_when_your_strap_isn_154c8923">Понятнее ответы, когда браслет не накапливает историю</string>
+    <string name="l10n_app_changelog_clearer_labels_a_journal_fix_and_96b91b2a">Понятнее подписи, исправление Журнала и стабильнее пульс во сне</string>
+    <string name="l10n_app_changelog_clearer_pairing_guidance_for_whoop_5_91a7736b">Понятнее инструкции по сопряжению для WHOOP 5.0/MG</string>
+    <string name="l10n_app_changelog_clearer_sync_status_6431bf19">Понятнее статус синхронизации</string>
+    <string name="l10n_app_changelog_clearer_sync_status_a_responsive_compare_ee8925d0">Понятнее статус синхронизации и адаптивный экран сравнения</string>
+    <string name="l10n_app_changelog_connect_a_heart_rate_strap_early_f12c6ba9">Подключение пульсометра (ранний доступ)</string>
+    <string name="l10n_app_changelog_connection_sleep_fixes_a_focused_tune_69b01439">Исправления подключения и сна — точечная доработка</string>
+    <string name="l10n_app_changelog_continuous_hrv_capture_sharper_overnight_hrv_9a9ec94b">Непрерывный сбор ВСР — точнее ночная ВСР, восстановление и сон</string>
+    <string name="l10n_app_changelog_continuous_workouts_no_longer_split_plus_4db70213">Непрерывные тренировки больше не разделяются, плюс удаление сессии сна</string>
+    <string name="l10n_app_changelog_coupled_view_workouts_rebuilt_journal_numbers_b347f97e">Совмещённый вид, переработанные тренировки, числа в Журнале</string>
+    <string name="l10n_app_changelog_cross_platform_parity_android_now_scores_86654a6c">Кроссплатформенный паритет — Android теперь считает так же, как macOS и iOS</string>
+    <string name="l10n_app_changelog_date_fixes_ui_polish_clearer_diagnostics_61058e74">Исправления дат, полировка интерфейса и понятнее диагностика</string>
+    <string name="l10n_app_changelog_date_hygiene_fix_for_straps_with_dc559c6f">Исправление дат для браслетов с неверными часами</string>
+    <string name="l10n_app_changelog_deep_history_backlog_drains_without_manual_bb716532">Глубокая история выгружается без ручных нажатий</string>
+    <string name="l10n_app_changelog_deep_sleep_no_longer_reads_0_80ce3558">Глубокий сон больше не показывает 0 минут, и умнее ИИ-тренер</string>
+    <string name="l10n_app_changelog_deep_sleep_that_happens_later_in_702efdf1">Глубокий сон во второй половине ночи больше не показывает 0 минут</string>
+    <string name="l10n_app_changelog_deep_timeline_you_can_scroll_through_7c04c040">Глубокая хронология с прокруткой по дням, быстрее ручные тренировки и очистка хранилища</string>
+    <string name="l10n_app_changelog_delete_a_sleep_swipe_to_mark_7083b34d">Удаление сна, смахивание для отметки о прочтении</string>
+    <string name="l10n_app_changelog_design_polish_cross_platform_parity_caa8e2c4">Полировка дизайна и кроссплатформенный паритет</string>
+    <string name="l10n_app_changelog_dynamic_island_toggle_now_actually_turns_df387ee6">Переключатель Dynamic Island теперь действительно её отключает</string>
+    <string name="l10n_app_changelog_editable_naps_a_richer_trends_report_471c1a69">Редактируемый дневной сон, богаче отчёт по Трендам и лучше отладочный экспорт</string>
+    <string name="l10n_app_changelog_effort_explains_a_calm_day_zero_08bd9936">Усилие объясняет ноль в спокойный день — и считается на 5.0/MG</string>
+    <string name="l10n_app_changelog_effort_scale_fix_for_imported_data_aad0344d">Исправление шкалы Усилия для импортированных данных</string>
+    <string name="l10n_app_changelog_estimated_steps_for_your_whoop_4_e961cade">Оценка шагов для вашего WHOOP 4.0</string>
+    <string name="l10n_app_changelog_everything_a_whole_new_look_hydration_0f648fc3">Всё сразу: совершенно новый вид, гидратация, автоопределение тренировок и умнее сон</string>
+    <string name="l10n_app_changelog_everything_stays_on_your_device_575125e9">Всё остаётся на вашем устройстве</string>
+    <string name="l10n_app_changelog_experimental_unlocking_whoop_5_0_mg_d665f836">Эксперимент: раскрываем глубокие данные WHOOP 5.0/MG</string>
+    <string name="l10n_app_changelog_export_your_raw_sensor_data_csv_59cfa009">Экспорт сырых данных датчиков (CSV)</string>
+    <string name="l10n_app_changelog_faster_and_fewer_sharp_edges_6bbd66c7">Быстрее и меньше острых углов</string>
+    <string name="l10n_app_changelog_faster_smoother_more_languages_and_a_6a8c8837">Быстрее, плавнее, больше языков и большая горка исправлений</string>
+    <string name="l10n_app_changelog_fewer_false_daytime_sleeps_an_android_6bf9029e">Меньше ложного дневного сна + кнопка синхронизации на Android</string>
+    <string name="l10n_app_changelog_find_your_strap_log_in_settings_99105f3a">Журнал браслета теперь в Настройках (macOS)</string>
+    <string name="l10n_app_changelog_first_release_d5545946">Первый выпуск</string>
+    <string name="l10n_app_changelog_first_run_terms_acknowledgment_an_explore_081534f5">Подтверждение условий при первом запуске + исправление графика Обзора</string>
+    <string name="l10n_app_changelog_fix_a_night_with_a_brief_538bfa1d">Исправление: ночь с коротким пробуждением показывалась как отдельные дневные сны</string>
+    <string name="l10n_app_changelog_fix_app_crashing_won_t_open_d4b0acce">Исправление: приложение падало / не открывалось при включённом Bluetooth</string>
+    <string name="l10n_app_changelog_fix_bonded_but_no_live_data_fbab40a4">Исправление: сопряжено, но нет живых данных (Android)</string>
+    <string name="l10n_app_changelog_fix_connecting_a_polar_h10_or_bf013d57">Исправление: подключение Polar H10 и других пульсометров</string>
+    <string name="l10n_app_changelog_fix_imported_phone_steps_were_being_7c152d2b">Исправление: импортированные шаги с телефона считались дважды</string>
+    <string name="l10n_app_changelog_fix_the_android_freeze_after_a_bf7f8d81">Исправление зависания Android после нескольких ночей данных</string>
+    <string name="l10n_app_changelog_fix_your_day_now_follows_your_e772176e">Исправление: ваш день теперь следует вашему часовому поясу, а не UTC</string>
+    <string name="l10n_app_changelog_fixed_imported_data_and_strap_sync_18350836">Исправлено: зависание импортированных данных и синхронизации браслета на iOS</string>
+    <string name="l10n_app_changelog_fixed_iphone_import_and_a_stuck_38876ee9">Исправлено: импорт на iPhone, а зависшее хранилище теперь само восстанавливается</string>
+    <string name="l10n_app_changelog_fixes_a_false_pairing_refused_warning_7023464e">Исправляет ложное предупреждение «сопряжение отклонено» (Mac)</string>
+    <string name="l10n_app_changelog_fixes_the_experimental_sleep_toggle_now_fc281b7d">Исправления: экспериментальный переключатель сна теперь работает, калибровка шагов, ручные тренировки на WHOOP 5/MG и адекватные показания ВСР</string>
+    <string name="l10n_app_changelog_fixes_the_insights_tab_crash_plus_042d1702">Исправляет сбой вкладки Выводы, плюс точнее ВСР</string>
+    <string name="l10n_app_changelog_french_whoop_exports_now_import_db598ea4">Французские выгрузки WHOOP теперь импортируются</string>
+    <string name="l10n_app_changelog_gps_tracked_workouts_android_1cf07bd1">Тренировки с GPS-треком (Android)</string>
+    <string name="l10n_app_changelog_gps_workout_crash_fix_android_698ee690">Исправление сбоя GPS-тренировки (Android)</string>
+    <string name="l10n_app_changelog_hand_correct_your_sleep_times_smaller_6154b854">Ручная правка времени сна + меньше размер резервных копий</string>
+    <string name="l10n_app_changelog_health_connect_correct_labels_workout_types_fd2fcc34">Health Connect: верные подписи и типы тренировок (Android)</string>
+    <string name="l10n_app_changelog_health_connect_shows_as_health_connect_39b3cbcb">Health Connect отображается как Health Connect</string>
+    <string name="l10n_app_changelog_history_dates_fixed_for_revived_straps_0ec4e53a">Исправлены даты истории для восстановленных браслетов, жесты во время синхронизации, понятнее сопряжение</string>
+    <string name="l10n_app_changelog_honest_labelling_for_whoop_5_mg_8c650225">Честные подписи для диагностики глубоких данных WHOOP 5/MG</string>
+    <string name="l10n_app_changelog_hotfix_making_a_heart_rate_strap_09f87c0a">Хотфикс — назначение пульсометра активным больше не вызывает сбой</string>
+    <string name="l10n_app_changelog_hr_from_the_optical_waveform_an_b8874b42">Пульс из оптического сигнала, ранний переход дня и понятнее условия</string>
+    <string name="l10n_app_changelog_hrv_that_reads_true_and_a_2b09fa43">ВСР, которая показывает правду, и аккуратнее список тренировок</string>
+    <string name="l10n_app_changelog_import_fixes_both_sources_all_data_92cfed50">Исправления импорта — оба источника, все типы данных</string>
+    <string name="l10n_app_changelog_import_polish_mac_whoop_5_optical_5067d90c">Полировка импорта (Mac) + оптическое декодирование WHOOP 5</string>
+    <string name="l10n_app_changelog_independent_and_experimental_f9b65317">Независимо и экспериментально</string>
+    <string name="l10n_app_changelog_ios_is_now_a_direct_download_fab6ed69">iOS теперь скачивается напрямую — без Mac и Xcode</string>
+    <string name="l10n_app_changelog_iphone_button_label_polish_64244980">Полировка подписей кнопок на iPhone</string>
+    <string name="l10n_app_changelog_iphone_hotfix_sideloading_works_again_7b90c265">Хотфикс для iPhone: сторонняя установка снова работает</string>
+    <string name="l10n_app_changelog_iphone_import_handle_icloud_and_large_2d60298a">Импорт на iPhone: поддержка iCloud и больших файлов выгрузки</string>
+    <string name="l10n_app_changelog_iphone_polish_accessibility_99bba695">Полировка iPhone + доступность</string>
+    <string name="l10n_app_changelog_iphone_polish_what_s_new_fits_1dad9b15">Полировка iPhone: «Что нового» помещается, карточки «Сегодня» выровнены</string>
+    <string name="l10n_app_changelog_iphone_smoother_scrolling_753e0b0d">iPhone: плавнее прокрутка</string>
+    <string name="l10n_app_changelog_iphone_workouts_table_fits_the_screen_156a691c">Таблица тренировок на iPhone помещается на экран</string>
+    <string name="l10n_app_changelog_journal_logging_an_imperial_metric_units_a507a5d2">Записи в Журнале + переключатель имперских и метрических единиц</string>
+    <string name="l10n_app_changelog_large_apple_health_imports_no_longer_830fa786">Большие импорты Apple Health больше не вызывают сбой (iPhone/Mac)</string>
+    <string name="l10n_app_changelog_last_workouts_tile_fix_301180af">Исправление плитки последних тренировок</string>
+    <string name="l10n_app_changelog_light_theme_noop_in_warm_paper_d5b9f463">Светлая тема — NOOP в тёплой бумаге и золоте</string>
+    <string name="l10n_app_changelog_light_theme_polish_5add98b2">Полировка светлой темы</string>
+    <string name="l10n_app_changelog_light_theme_tuning_2bbad1f7">Настройка светлой темы</string>
+    <string name="l10n_app_changelog_live_heart_rate_lands_on_today_5cac8768">Живой пульс попадает на график «Сегодня», даже если часы браслета сбиты (Android)</string>
+    <string name="l10n_app_changelog_live_heart_rate_that_doesn_t_b6b4ca9a">Живой пульс, который не зависает</string>
+    <string name="l10n_app_changelog_local_oura_ring_support_use_your_e928e3c6">Локальная поддержка кольца Oura: пользуйтесь кольцом Oura без приложения Oura (бета)</string>
+    <string name="l10n_app_changelog_mac_recovery_builds_from_your_strap_883d49ee">Mac: восстановление считается только по вашему браслету</string>
+    <string name="l10n_app_changelog_mac_strap_computed_nights_show_in_b0a3ac91">Mac: ночи, посчитанные браслетом, видны в разделе «Сон»</string>
+    <string name="l10n_app_changelog_manage_several_whoop_straps_and_see_8d9b6a84">Управляйте несколькими браслетами WHOOP — и смотрите, что делает каждый</string>
+    <string name="l10n_app_changelog_manual_workouts_edit_dismiss_auto_detected_95ed45b6">Ручные тренировки, правка и отклонение автоопределённых, и экспорт CSV</string>
+    <string name="l10n_app_changelog_manual_workouts_on_whoop_5_0_72908a88">Ручным тренировкам на WHOOP 5.0/MG вернулись калории и нагрузка</string>
+    <string name="l10n_app_changelog_mi_band_import_a_big_whoop_eb5382db">Импорт Mi Band + крупное исправление сна WHOOP 4.0</string>
+    <string name="l10n_app_changelog_mind_a_daily_mood_check_in_982fdd16">«Разум» — ежедневная отметка настроения — и импорт питания</string>
+    <string name="l10n_app_changelog_more_quick_relabel_sports_ba93c38b">Больше видов спорта для быстрой смены подписи</string>
+    <string name="l10n_app_changelog_more_realistic_calories_import_chart_fixes_d3d56a9e">Более реалистичные калории + исправления импорта и графиков</string>
+    <string name="l10n_app_changelog_more_reliable_bluetooth_on_newer_android_c7e641dc">Надёжнее Bluetooth на новых телефонах Android</string>
+    <string name="l10n_app_changelog_more_tab_icons_stop_flickering_colour_3de3de9f">Иконки вкладки «Ещё» перестали мерцать цветом</string>
+    <string name="l10n_app_changelog_new_a_guide_to_how_your_7afbd7f4">Новое: руководство по тому, как работают оценки Заряд, Усилие и Отдых</string>
+    <string name="l10n_app_changelog_new_first_run_onboarding_mac_android_243bc0ad">Новое знакомство при первом запуске (Mac + Android)</string>
+    <string name="l10n_app_changelog_new_use_an_apple_watch_with_4c2c29a6">Новое: используйте Apple Watch с NOOP</string>
+    <string name="l10n_app_changelog_new_week_in_review_a_live_c1457e40">Новое: итоги недели, живая консоль организма, свежие графики и другое</string>
+    <string name="l10n_app_changelog_no_more_hr_spike_when_you_7dc052ba">Больше нет скачка пульса при повторном открытии приложения</string>
+    <string name="l10n_app_changelog_noop_grows_up_it_s_not_823bf2e7">NOOP взрослеет: теперь не только для WHOOP</string>
+    <string name="l10n_app_changelog_noop_has_a_new_home_01b87522">У NOOP новый дом</string>
+    <string name="l10n_app_changelog_noop_now_tells_you_when_your_af259fbb">NOOP теперь сообщает, когда браслет не сохраняет историю — и как это исправить</string>
+    <string name="l10n_app_changelog_on_demand_hrv_a_haptic_clock_50376585">ВСР по запросу, тактильные часы, отметки сна и другое</string>
+    <string name="l10n_app_changelog_oneplus_pairing_fix_f731fcb2">Исправление сопряжения OnePlus</string>
+    <string name="l10n_app_changelog_open_a_workout_see_what_it_a40fd8a4">Откройте тренировку, посмотрите, чего она стоит, и поделитесь трендами</string>
+    <string name="l10n_app_changelog_optional_inactivity_nudge_3f4ca05a">Необязательное напоминание о бездействии</string>
+    <string name="l10n_app_changelog_personal_vital_baselines_mac_analytics_parity_744972d1">Персональные нормы показателей + паритет аналитики на Mac</string>
+    <string name="l10n_app_changelog_polish_matched_to_the_iphone_mac_cc34126b">Полировка — в соответствии с дизайном iPhone и Mac</string>
+    <string name="l10n_app_changelog_german_french_spanish_pull_to_sync_1109bda2">Немецкий, французский и испанский, синхронизация жестом на «Сегодня» и волна полировки</string>
+    <string name="l10n_app_changelog_hrv_accuracy_fix_oura_sleep_and_4ed31e39">Исправление точности ВСР, сон и движение Oura, богаче декодирование 5/MG и останавливаемая синхронизация</string>
+    <string name="l10n_app_changelog_optimal_strain_alerts_faster_history_sync_6488a27a">Уведомления об оптимальной нагрузке, быстрее синхронизация истории и волна исправлений точности</string>
+    <string name="l10n_app_changelog_power_saving_that_protects_your_strap_57a32503">Энергосбережение, берегущее браслет, ИИ-тренер на базе Gemini для Android и более подробные метрики</string>
+    <string name="l10n_app_changelog_raw_spo_honest_units_and_a_55e83a59">Сырой SpO₂, честные единицы и более лёгкое приложение</string>
+    <string name="l10n_app_changelog_re_scan_actually_scans_on_android_22198c8c">Повторный поиск действительно ищет на Android</string>
+    <string name="l10n_app_changelog_readiness_and_the_start_of_whoop_167f38c5">Готовность и начало поддержки WHOOP 5/MG</string>
+    <string name="l10n_app_changelog_readiness_shows_its_evidence_and_a_90cf0076">Готовность показывает свои основания, и исправление дистанции Health Connect</string>
+    <string name="l10n_app_changelog_reading_more_from_your_whoop_5_1412164a">Читаем больше данных с вашего WHOOP 5.0 (Mac)</string>
+    <string name="l10n_app_changelog_reconnect_help_for_whoop_5_0_acc779b6">Помощь с переподключением WHOOP 5.0 / MG после обновления прошивки</string>
+    <string name="l10n_app_changelog_reconnects_automatically_after_an_update_android_b4965179">Автоматическое переподключение после обновления (Android)</string>
+    <string name="l10n_app_changelog_recovery_builds_from_your_strap_alone_d83dbd67">Восстановление считается только по вашему браслету (Android)</string>
+    <string name="l10n_app_changelog_respiratory_rate_skin_temp_in_the_bfe3f4f9">Частота дыхания и температура кожи в отчёте по Трендам</string>
+    <string name="l10n_app_changelog_restart_your_strap_lighter_on_battery_2ccbef88">Перезапуск браслета, меньше расход батареи и Health Connect на Android 13</string>
+    <string name="l10n_app_changelog_robust_apple_health_import_marginal_radio_27d78c57">Надёжный импорт Apple Health, режим пульса при слабом сигнале, живой график пульса</string>
+    <string name="l10n_app_changelog_round_rings_73de603c">Круглые кольца</string>
+    <string name="l10n_app_changelog_run_the_ai_coach_on_your_8ac2b395">Запускайте ИИ-тренера на своей модели — вплоть до полностью локальной</string>
+    <string name="l10n_app_changelog_scores_live_from_the_strap_9d5d8ae2">Оценки в реальном времени с браслета</string>
+    <string name="l10n_app_changelog_security_reliability_hardening_b3c9a976">Усиление безопасности и надёжности</string>
+    <string name="l10n_app_changelog_see_everything_the_deep_timeline_a_dbfe539a">Увидеть всё: глубокая хронология, график движений во сне и большая расчистка задач</string>
+    <string name="l10n_app_changelog_share_strap_logs_and_a_worn_b5aae860">Отправка журналов браслета и исправление статуса ношения</string>
+    <string name="l10n_app_changelog_shortcuts_export_duplicates_fixed_nutrition_mood_a5dcdc11">Исправлены дубликаты экспорта Команд; питание и настроение попадают на графики Android</string>
+    <string name="l10n_app_changelog_shortcuts_on_mac_recovery_in_the_dbcef46a">Команды на Mac, восстановление в уведомлении Android</string>
+    <string name="l10n_app_changelog_skin_temperature_unblocked_on_mac_ios_9cb6276c">Температура кожи разблокирована на Mac/iOS, плюс исправления экспорта</string>
+    <string name="l10n_app_changelog_sleep_and_recovery_for_whoop_4_c8f44a56">Сон и восстановление для браслетов WHOOP 4.0 на прошивке, которую мы не могли прочитать</string>
+    <string name="l10n_app_changelog_sleep_charge_and_workouts_cleaned_up_e21a5381">Сон, Заряд и тренировки — наведён порядок</string>
+    <string name="l10n_app_changelog_sleep_debt_daytime_stress_a_recovery_a92853f3">Недосып, дневной стресс, прогноз восстановления и навигация по дням</string>
+    <string name="l10n_app_changelog_sleep_figures_hr_zones_charging_calibration_b209b698">Показатели сна, зоны пульса, зарядка и калибровка — большое обновление от сообщества</string>
+    <string name="l10n_app_changelog_sleep_fix_for_whoop_4_0_c7a1b13d">Исправление сна для WHOOP 4.0 + точные шаги на WHOOP 5/MG</string>
+    <string name="l10n_app_changelog_sleep_from_whoop_4_on_more_efe5fd60">Сон с WHOOP 4 на большем числе прошивок (Mac)</string>
+    <string name="l10n_app_changelog_sleep_keep_real_nights_when_the_0acb206a">Сон: сохраняем настоящие ночи, когда браслет снят</string>
+    <string name="l10n_app_changelog_sleep_properly_sorted_and_an_app_f5e348f0">Сон, разобранный как следует, и приложение, которое объясняет себя</string>
+    <string name="l10n_app_changelog_sleep_stages_heal_themselves_after_a_e64a730f">Стадии сна восстанавливаются сами после синхронизации</string>
+    <string name="l10n_app_changelog_sleep_that_was_stuck_in_the_1b6d1307">Сон, застрявший в архиве, возвращается</string>
+    <string name="l10n_app_changelog_smart_alarm_actually_works_on_android_c9bbf50a">Умный будильник действительно работает на Android</string>
+    <string name="l10n_app_changelog_smart_alarm_the_time_you_set_6f5d260e">Умный будильник: срабатывает то время, которое вы задали</string>
+    <string name="l10n_app_changelog_smoother_an_oura_live_hr_fix_e820bfb4">Плавнее, исправление живого пульса Oura и большая горка улучшений</string>
+    <string name="l10n_app_changelog_smoother_during_long_history_syncs_mac_b31b616c">Плавнее во время долгой синхронизации истории (Mac)</string>
+    <string name="l10n_app_changelog_smoother_explore_charts_and_a_clearer_9598655d">Плавнее графики Обзора и понятнее способ подключить WHOOP 5.0/MG</string>
+    <string name="l10n_app_changelog_spanish_whoop_exports_now_import_6351a8c6">Испанские выгрузки WHOOP теперь импортируются</string>
+    <string name="l10n_app_changelog_split_sleep_every_block_counted_one_3106596d">Разделённый сон: учтён каждый блок, одна ночь на день</string>
+    <string name="l10n_app_changelog_stability_polish_for_v5_7393eaf0">Стабильность и полировка v5</string>
+    <string name="l10n_app_changelog_start_a_workout_from_the_workouts_3c882d79">Запуск тренировки с экрана «Тренировки» и честное примечание об Умном будильнике</string>
+    <string name="l10n_app_changelog_stays_connected_in_the_background_a6b0a94e">Остаётся на связи в фоне</string>
+    <string name="l10n_app_changelog_steadier_bluetooth_on_congested_android_phones_699ad7d3">Стабильнее Bluetooth на загруженных телефонах Android</string>
+    <string name="l10n_app_changelog_steadier_connections_fixes_and_a_nicer_fe1afd7d">Стабильнее соединения, исправления и приятнее вид сна</string>
+    <string name="l10n_app_changelog_steadier_heart_rate_a_stack_of_e6026074">Стабильнее пульс + стопка исправлений</string>
+    <string name="l10n_app_changelog_stop_losing_strap_history_we_can_0598d11a">Перестаём терять историю браслета, которую пока не можем расшифровать — плюс доска исправлений</string>
+    <string name="l10n_app_changelog_strap_battery_alerts_11f79bda">Уведомления о заряде браслета</string>
+    <string name="l10n_app_changelog_strap_log_export_on_mac_a_e15f6b60">Экспорт журнала браслета на Mac + исправление Health Monitor</string>
+    <string name="l10n_app_changelog_strap_log_stays_off_the_system_b8ce2ff5">Журнал браслета больше не попадает в системный журнал (Android)</string>
+    <string name="l10n_app_changelog_switch_between_your_whoop_4_and_f5036092">Переключение между вашими WHOOP 4 и 5.0 (Mac + Android)</string>
+    <string name="l10n_app_changelog_switching_between_whoop_straps_now_actually_8428faaa">Переключение между браслетами WHOOP теперь действительно переключает</string>
+    <string name="l10n_app_changelog_sync_diagnostics_surfacing_silently_dropped_history_9fe62836">Диагностика синхронизации: показываем незаметно потерянную историю</string>
+    <string name="l10n_app_changelog_sync_visibility_a_sharper_stress_timeline_37e1e6d6">Видимость синхронизации + чётче хронология стресса</string>
+    <string name="l10n_app_changelog_the_archived_sleep_recovery_now_reaches_cf4bb3ef">Восстановление архивного сна теперь дошло и до Android</string>
+    <string name="l10n_app_changelog_the_everything_update_5e08d257">Обновление обо всём</string>
+    <string name="l10n_app_changelog_the_new_look_everywhere_plus_sleep_5793dddf">Новый вид везде — плюс исправления сна, Усилия и Bluetooth</string>
+    <string name="l10n_app_changelog_the_new_today_screen_comes_to_69dfab3d">Новый экран «Сегодня» приходит на Android</string>
+    <string name="l10n_app_changelog_the_smoothness_release_faster_everywhere_plus_baf8a7fc">Выпуск о плавности: быстрее везде, плюс исправление памяти сна</string>
+    <string name="l10n_app_changelog_the_test_centre_help_us_fix_af39aa17">Центр тестирования: помогите нам исправить ИМЕННО вашу проблему</string>
+    <string name="l10n_app_changelog_tidier_today_gauges_5d1fe894">Аккуратнее индикаторы «Сегодня»</string>
+    <string name="l10n_app_changelog_tidier_today_hero_strap_renaming_smarter_34493c9c">Аккуратнее главный блок «Сегодня», переименование браслета, умнее журнал</string>
+    <string name="l10n_app_changelog_tidier_workout_names_correct_rest_duration_135cf67f">Аккуратнее названия тренировок, верная длительность Отдыха</string>
+    <string name="l10n_app_changelog_tidy_your_journal_remove_and_hide_aa1c0b94">Наведите порядок в журнале — удаляйте и скрывайте вопросы</string>
+    <string name="l10n_app_changelog_times_follow_your_12_24_hour_9c552783">Время следует вашей настройке 12/24 часа</string>
+    <string name="l10n_app_changelog_today_header_date_fix_west_of_e5e7422d">Исправление даты в заголовке «Сегодня» (западнее UTC)</string>
+    <string name="l10n_app_changelog_today_reflects_today_not_stale_imports_1a341a21">«Сегодня» отражает сегодня (а не устаревшие импорты)</string>
+    <string name="l10n_app_changelog_today_s_effort_goes_live_plus_5f810b61">Усилие за сегодня в реальном времени — плюс честность сна и будильника</string>
+    <string name="l10n_app_changelog_today_s_effort_no_longer_drops_f49a3428">Усилие за сегодня больше не падает до нуля</string>
+    <string name="l10n_app_changelog_today_tiles_no_longer_cut_their_3c167cc1">Плитки «Сегодня» больше не обрезают значение до «10…»</string>
+    <string name="l10n_app_changelog_today_tiles_no_longer_truncate_their_2959ce81">Плитки «Сегодня» больше не обрезают значение (Android)</string>
+    <string name="l10n_app_changelog_today_trends_stay_within_their_window_ba2e4c57">Тренды «Сегодня» остаются в своём окне (Mac)</string>
+    <string name="l10n_app_changelog_toggle_the_live_hr_dynamic_island_d3bd70cb">Переключатель Dynamic Island с живым пульсом</string>
+    <string name="l10n_app_changelog_track_a_workout_manually_2eb43402">Отслеживайте тренировку вручную</string>
+    <string name="l10n_app_changelog_trends_report_explains_its_scores_e338d1ee">Отчёт по Трендам объясняет свои оценки</string>
+    <string name="l10n_app_changelog_true_battery_a_sync_indicator_and_89037fc3">Настоящий % заряда, индикатор синхронизации и пульс в импортированных тренировках</string>
+    <string name="l10n_app_changelog_two_quick_fixes_the_blue_titanium_4c021d78">Два быстрых исправления: иконка Blue Titanium и «Ваши карточки» на Mac</string>
+    <string name="l10n_app_changelog_under_the_hood_current_api_migration_672da037">Под капотом: переход на актуальный API (поведение не меняется)</string>
+    <string name="l10n_app_changelog_universal_mac_build_iphone_import_fix_363425a0">Универсальная сборка для Mac + исправление импорта на iPhone</string>
+    <string name="l10n_app_changelog_update_check_shows_what_s_new_6779c2e3">Проверка обновлений показывает, что нового</string>
+    <string name="l10n_app_changelog_updates_check_github_again_1e00ced1">Обновления снова проверяются через GitHub</string>
+    <string name="l10n_app_changelog_v5_the_raw_signal_release_noop_c109e3f2">v5 — выпуск о сыром сигнале: NOOP читает сигнал, на вашем устройстве, бесплатно</string>
+    <string name="l10n_app_changelog_week_in_review_is_honest_about_4c225bd3">Итоги недели честно говорят о незавершённой неделе</string>
+    <string name="l10n_app_changelog_whoop_4_0_is_the_supported_16893d9d">WHOOP 4.0 — поддерживаемый вариант</string>
+    <string name="l10n_app_changelog_whoop_5_0_history_decoding_comes_a8848386">Декодирование истории WHOOP 5.0 приходит на Android</string>
+    <string name="l10n_app_changelog_whoop_5_0_mg_buzz_the_c1ab45a8">Вибрация WHOOP 5.0/MG — настоящая команда (совпадение байт в байт)</string>
+    <string name="l10n_app_changelog_whoop_5_0_mg_buzz_trying_98373c44">Вибрация WHOOP 5.0/MG — пробуем правильную команду (эксперимент)</string>
+    <string name="l10n_app_changelog_whoop_5_0_mg_history_download_36cc4425">Загрузка истории WHOOP 5.0/MG (эксперимент) + помощь с сопряжением (Mac)</string>
+    <string name="l10n_app_changelog_whoop_5_0_mg_history_offload_76f5af44">Выгрузка истории WHOOP 5.0/MG (Android)</string>
+    <string name="l10n_app_changelog_whoop_5_mg_deep_data_live_2612bf3d">Глубокие данные WHOOP 5/MG: живое подтверждение, что всё работает</string>
+    <string name="l10n_app_changelog_whoop_5_mg_deep_sync_decode_652c34d2">Декодирование глубокой синхронизации WHOOP 5/MG + исправления сна и тренировок</string>
+    <string name="l10n_app_changelog_whoop_5_mg_frame_capture_mac_9e84ee52">Захват кадров WHOOP 5/MG (Mac)</string>
+    <string name="l10n_app_changelog_whoop_5_mg_heart_rate_on_11816e98">Пульс WHOOP 5/MG на Android</string>
+    <string name="l10n_app_changelog_whoop_5_mg_heart_rate_on_b66c6752">Пульс WHOOP 5/MG на Mac + исправление Готовности</string>
+    <string name="l10n_app_changelog_whoop_5_mg_history_the_missing_b4d5db99">История WHOOP 5/MG: недостающие часы</string>
+    <string name="l10n_app_changelog_whoop_5_mg_secure_pairing_fix_ed6550f3">WHOOP 5/MG: исправление защищённого сопряжения</string>
+    <string name="l10n_app_changelog_whoop_5_mg_the_buzz_works_a0308753">WHOOP 5/MG: вибрация работает</string>
+    <string name="l10n_app_changelog_whoop_style_hrv_warm_ups_counted_199aaa42">ВСР в стиле WHOOP, учёт разминок и понятнее карточки</string>
+    <string name="l10n_app_changelog_workout_calories_for_manual_sessions_and_5d61f59a">Калории тренировки — для ручных сессий и импорта из Health Connect</string>
+    <string name="l10n_app_changelog_workout_display_fixes_255b56e8">Исправления отображения тренировок</string>
+    <string name="l10n_app_changelog_workouts_correct_source_pill_for_health_787243ea">Тренировки: верный значок источника для Health Connect (Android)</string>
+    <string name="l10n_app_changelog_workouts_header_layout_fix_phone_fa23fbec">Исправление вёрстки заголовка «Тренировки» (телефон)</string>
+    <string name="l10n_app_changelog_wrist_alerts_for_incoming_calls_android_9bf80a06">Оповещения на запястье о входящих звонках (Android)</string>
+    <string name="l10n_app_changelog_wrist_alerts_work_on_android_09e544a9">Оповещения на запястье работают на Android</string>
+    <string name="l10n_app_changelog_your_fitness_age_vitality_body_age_8e9867fb">Ваш фитнес-возраст, витальность и возраст тела</string>
+    <string name="l10n_app_changelog_your_imported_steps_now_show_on_d79f0b36">Импортированные шаги теперь видны на экране «Сегодня» (Android)</string>
+    <string name="l10n_app_changelog_your_macos_data_is_back_and_e5e3e3bd">Ваши данные macOS вернулись — и полный французский</string>
+    <string name="l10n_app_changelog_your_scores_build_over_a_few_41388c54">Ваши показатели формируются в течение нескольких ночей</string>
+    <string name="l10n_app_changelog_your_whole_day_s_heart_rate_e57593f8">Пульс за весь ваш день — на панели</string>
+    <string name="l10n_app_changelog_your_whoop_journal_in_insights_clearer_88f5e21b">Ваш журнал WHOOP в Выводах, понятнее нажатия на метрики</string>
+    <string name="l10n_app_root_this_section_is_on_the_way_ca7c4a32">Этот раздел скоро появится.</string>
+    <string name="l10n_app_root_updates_c76d1807">Обновления</string>
+    <string name="l10n_coach_screen_coach_b32c9ad3">ИИ-тренер</string>
+    <string name="l10n_compare_screen_remove_title_ddb5361c">Удалить %1$s</string>
+    <string name="l10n_components_chunks_chunks_pulled_cec186cf">Получено фрагментов: %1$s</string>
+    <string name="l10n_components_decrease_accessibility_df5f1511">Уменьшить %1$s</string>
+    <string name="l10n_components_increase_accessibility_0949c0e9">Увеличить %1$s</string>
+    <string name="l10n_connection_help_allow_nearby_devices_f7c74880">Разрешить «Устройства поблизости»</string>
+    <string name="l10n_connection_help_charge_it_and_put_it_on_31b04814">Зарядите его и наденьте</string>
+    <string name="l10n_connection_help_close_the_official_whoop_app_768d7d17">Закройте официальное приложение WHOOP</string>
+    <string name="l10n_connection_help_try_connecting_now_41769900">Попробовать подключиться сейчас</string>
+    <string name="l10n_connection_help_turn_bluetooth_on_75868e97">Включите Bluetooth</string>
+    <string name="l10n_connection_help_whoop_5_mg_experimental_109076ae">WHOOP 5 / MG (эксперимент)</string>
+    <string name="l10n_connection_help_won_t_connect_run_through_these_cfef82f3">Не подключается? Пройдите по этим пунктам</string>
+    <string name="l10n_connection_help_your_strap_is_connected_and_we_8ab98ac6">Ваш браслет подключён, и мы пробуем экспериментальное рукопожатие, чтобы включить живой </string>
+    <string name="l10n_coupled_screen_day_987b9ced">День</string>
+    <string name="l10n_devices_screen_delete_all_of_this_device_s_754cde90">Удалить все данные этого устройства?</string>
+    <string name="l10n_devices_screen_delete_this_device_s_data_3cae7a2a">Удалить данные этого устройства…</string>
+    <string name="l10n_devices_screen_device_actions_for_displayname_device_160eb3de">Действия с устройством %1$s</string>
+    <string name="l10n_devices_screen_devices_df485c87">Устройства</string>
+    <string name="l10n_devices_screen_disconnect_ed28e068">Отключить</string>
+    <string name="l10n_devices_screen_getting_your_devices_ready_bd391949">Подготовка ваших устройств</string>
+    <string name="l10n_devices_screen_make_active_75690bb8">Сделать активным</string>
+    <string name="l10n_devices_screen_make_this_your_active_strap_fea6bebd">Сделать этот браслет активным?</string>
+    <string name="l10n_devices_screen_reboot_probe_4_0_re_828b3916">Проба перезагрузки (4.0 RE)…</string>
+    <string name="l10n_devices_screen_reconnect_6988b16a">Переподключить</string>
+    <string name="l10n_devices_screen_remove_e963907d">Удалить</string>
+    <string name="l10n_devices_screen_remove_this_device_dd9dbda9">Удалить это устройство?</string>
+    <string name="l10n_devices_screen_rename_d3f4cb89">Переименовать</string>
+    <string name="l10n_devices_screen_restart_strap_c976cd6c">Перезапустить браслет…</string>
+    <string name="l10n_devices_screen_restart_this_strap_50fc481b">Перезапустить этот браслет?</string>
+    <string name="l10n_fused_record_screen_nothing_to_fuse_yet_30789c4e">Пока нечего объединять</string>
+    <string name="l10n_fused_record_screen_your_data_fused_a740fd4a">Ваши данные, объединённые</string>
+    <string name="l10n_health_screen_active_energy_2d3288f9">Активная энергия</string>
+    <string name="l10n_health_screen_blood_o_9bf5ed9b">Кислород в крови</string>
+    <string name="l10n_health_screen_blood_oxygen_a8ad9ff5">Кислород в крови</string>
+    <string name="l10n_health_screen_drives_your_fitness_age_9d0d1219">Влияет на ваш Фитнес-возраст</string>
+    <string name="l10n_health_screen_effort_8c974bc6">Усилие</string>
+    <string name="l10n_health_screen_fitness_age_12383b4a">Фитнес-возраст</string>
+    <string name="l10n_health_screen_health_monitor_c4abc3fc">Монитор здоровья</string>
+    <string name="l10n_health_screen_heart_rate_variability_20f0069e">Вариабельность сердечного ритма</string>
+    <string name="l10n_health_screen_it_compares_your_resting_heart_rate_e83e00f5">Он сравнивает ваш пульс в покое и недавнюю активность с людьми вашего возраста. </string>
+    <string name="l10n_health_screen_raw_spo_ccfe80c1">Сырой SpO₂</string>
+    <string name="l10n_health_screen_recovery_ea924f72">Восстановление</string>
+    <string name="l10n_health_screen_refresh_fitness_age_now_85fc516f">Обновить фитнес-возраст сейчас</string>
+    <string name="l10n_health_screen_resp_rate_1c48dbd8">Частота дых.</string>
+    <string name="l10n_health_screen_respiratory_rate_3fbb532f">Частота дыхания</string>
+    <string name="l10n_health_screen_rest_b79e5f48">Отдых</string>
+    <string name="l10n_health_screen_resting_heart_rate_9700f4d8">Пульс в покое</string>
+    <string name="l10n_health_screen_skin_temp_a4affc5a">Темп. кожи</string>
+    <string name="l10n_health_screen_skin_temperature_f59127f6">Температура кожи</string>
+    <string name="l10n_health_screen_spo_respiratory_rate_and_skin_temperature_0ae0ad8f">SpO₂, частота дыхания и температура кожи — это показатели окна сна </string>
+    <string name="l10n_health_screen_steps_cdde4f20">Шаги</string>
+    <string name="l10n_health_screen_sharpens_your_vo_max_c9d52991">Уточняет ваш VO₂max</string>
+    <string name="l10n_health_screen_vital_signs_e7d9e1b1">Жизненные показатели</string>
+    <string name="l10n_health_screen_vitality_be320b06">Жизненная энергия</string>
+    <string name="l10n_health_screen_vo2max_21214fb6">VO₂ макс.</string>
+    <string name="l10n_health_screen_weight_height_and_waist_add_a_fd2699f5">Вес, рост и обхват талии добавляют оценку VO₂max. Сам фитнес-возраст они не меняют.</string>
+    <string name="l10n_how_noop_works_screen_how_your_scores_are_computed_1b2d6c30">Как рассчитываются ваши показатели</string>
+    <string name="l10n_how_noop_works_screen_how_your_scores_work_21a0e2be">Как работают ваши показатели</string>
+    <string name="l10n_how_noop_works_screen_how_your_sleep_is_sorted_6a8e82e0">Как сортируется ваш сон</string>
+    <string name="l10n_how_noop_works_screen_what_recording_means_b896c422">Что значит «запись»</string>
+    <string name="l10n_how_noop_works_screen_where_your_numbers_come_from_e169963a">Откуда берутся ваши показатели</string>
+    <string name="l10n_hrv_snapshot_screen_a_60_second_snapshot_of_your_35f03f7c">60-секундный снимок ваших межударных интервалов (R-R) с браслета, очищенный </string>
+    <string name="l10n_hrv_snapshot_screen_close_hrv_reading_a29a99a1">Закрыть измерение ВСР</string>
+    <string name="l10n_hrv_snapshot_screen_hrv_reading_a2cf71f3">Измерение ВСР</string>
+    <string name="l10n_insights_screen_charge_d4e1aee4">Заряд</string>
+    <string name="l10n_insights_screen_insights_b4510362">Выводы</string>
+    <string name="l10n_insights_screen_insights_read_your_journal_and_outcomes_6ec8aaf9">Выводы читают ваш журнал и результаты</string>
+    <string name="l10n_insights_screen_pre_filled_from_last_night_tap_ce81097c">Заполнено по прошлой ночи. Нажмите, чтобы подтвердить или изменить.</string>
+    <string name="l10n_insights_screen_reading_your_journal_and_outcomes_4a59af69">Анализирую журнал и результаты…</string>
+    <string name="l10n_insights_screen_rest_b79e5f48">Отдых</string>
+    <string name="l10n_insights_screen_rhr_04edf9b3">Пульс покоя</string>
+    <string name="l10n_journal_log_journal_57d7f743">Журнал</string>
+    <string name="l10n_journal_reminder_log_today_s_journal_cb33be3e">Заполнить журнал за сегодня</string>
+    <string name="l10n_journal_reminder_open_journal_bbd88cc1">Открыть журнал</string>
+    <string name="l10n_journal_reminder_journal_reminder_0fdc0d9c">Напоминание о журнале</string>
+    <string name="l10n_journal_reminder_show_a_today_card_reminding_you_to_log_your_journal_8228bc77">Показывать карточку на «Сегодня» с напоминанием заполнить журнал</string>
+    <string name="l10n_journal_reminder_journal_57d7f743">Журнал</string>
+    <string name="l10n_journal_reminder_logged_today_0071a46c">Записано сегодня</string>
+    <string name="l10n_journal_reminder_tap_a_day_to_catch_up_10d16728">Нажмите на день, чтобы наверстать</string>
+    <string name="l10n_live_screen_avg_cdc93143">Сред.</string>
+    <string name="l10n_live_screen_buzz_edbd47b2">Вибрация</string>
+    <string name="l10n_live_screen_can_t_connect_your_strap_s_cf78be83">Не удаётся подключиться — сопряжение браслета было сброшено</string>
+    <string name="l10n_live_screen_charging_5f99fe21">Зарядка</string>
+    <string name="l10n_live_screen_distance_42320809">Расстояние</string>
+    <string name="l10n_live_screen_effort_8c974bc6">Усилие</string>
+    <string name="l10n_live_screen_end_a2bb9d34">Завершить</string>
+    <string name="l10n_live_screen_end_workout_3e8d6238">Завершить тренировку</string>
+    <string name="l10n_live_screen_history_synced_relativeago_at_0ece753a">История синхронизирована %1$s</string>
+    <string name="l10n_live_screen_hr_f187928f">Пульс</string>
+    <string name="l10n_live_screen_live_body_console_54838e06">Консоль тела в реальном времени</string>
+    <string name="l10n_live_screen_pace_7a9a6226">Темп</string>
+    <string name="l10n_live_screen_peak_c83dbbd3">Пик</string>
+    <string name="l10n_live_screen_refresh_56e3badc">Обновить</string>
+    <string name="l10n_live_screen_session_f7f1997c">Сессия</string>
+    <string name="l10n_live_screen_start_workout_d0f3f2cd">Начать тренировку</string>
+    <string name="l10n_live_screen_strap_02b88eeb">Браслет</string>
+    <string name="l10n_live_screen_take_an_hrv_reading_20ecb2d2">Сделать измерение ВСР</string>
+    <string name="l10n_live_screen_whoop_5_0_mg_pairs_with_b93143f2">WHOOP 5.0/MG сопрягается с одним приложением за раз. Если поиск ничего не находит, отмените сопряжение в </string>
+    <string name="l10n_noop_button_save_changes_179359b3">Сохранить изменения</string>
+    <string name="l10n_rhythm_screen_an_experimental_picture_of_your_beat_966289c6">Экспериментальная картина межударного ритма. Сначала прочитайте это.</string>
+    <string name="l10n_rhythm_screen_before_you_turn_on_rhythm_e85a832c">Перед включением Rhythm</string>
+    <string name="l10n_rhythm_screen_i_understand_this_is_an_experimental_3dab06e6">Я понимаю, что это экспериментальная функция для здоровья, а не медицинское устройство и не диагноз.</string>
+    <string name="l10n_rhythm_screen_not_now_e4571490">Не сейчас</string>
+    <string name="l10n_rhythm_screen_this_is_a_wellness_visualization_not_3409b935">Это визуализация состояния здоровья, а не скрининговый тест. Она не рекомендует обращаться к врачу и не называет никаких заболеваний. Это не юридическая или медицинская консультация.</string>
+    <string name="l10n_rhythm_screen_turn_on_rhythm_2275168c">Включить Ритм</string>
+    <string name="l10n_settings_screen_a_standalone_companion_for_your_whoop_7a132b5a">Самостоятельный компаньон для вашего WHOOP. Всё остаётся на этом телефоне: ваша история, живой поток, ваши числа. Ничего не выгружается.</string>
+    <string name="l10n_settings_screen_a_transparent_cardiorespiratory_recipe_that_recovers_eebe00c2">Прозрачная кардиореспираторная методика, которая восстанавливает глубокий сон и REM лучше, чем прежняя </string>
+    <string name="l10n_settings_screen_about_6b21fb79">О приложении</string>
+    <string name="l10n_settings_screen_advanced_4d064726">Дополнительно</string>
+    <string name="l10n_settings_screen_age_ff9f1ff3">Возраст</string>
+    <string name="l10n_settings_screen_app_icon_abde7a74">Значок приложения</string>
+    <string name="l10n_settings_screen_appearance_41def7a0">Внешний вид</string>
+    <string name="l10n_settings_screen_reduce_motion_in_noop_59a6180d">Уменьшить анимацию в NOOP</string>
+    <string name="l10n_settings_screen_holds_the_liquid_gauges_the_sky_41872b57">Останавливает жидкостные шкалы, небо и отклик на наклон и отключает датчик движения, который их питает. Экономит заряд батареи. Режим энергосбережения и системная настройка «Уменьшение движения» уже делают это.</string>
+    <string name="l10n_settings_screen_auto_detect_workouts_bed4cf2a">Автоопределение тренировок</string>
+    <string name="l10n_settings_screen_automatic_backups_8a772f3c">Автоматические резервные копии</string>
+    <string name="l10n_settings_screen_backup_restore_a1616284">Резервная копия и восстановление</string>
+    <string name="l10n_settings_screen_battery_pct_roundtoint_e02e2891">Батарея %1$s%%</string>
+    <string name="l10n_settings_screen_broadcast_heart_rate_d1af1c79">Трансляция пульса</string>
+    <string name="l10n_settings_screen_ask_android_to_pair_experimental_250a81e9">Попросить Android выполнить сопряжение (эксперимент)</string>
+    <string name="l10n_settings_screen_noop_has_always_hoped_that_writing_19967036">NOOP всегда надеялся, что запись на ваш 5.0/MG заставит Android с ним сопрячься. Этого не происходит. Здесь Android просят напрямую, поэтому может появиться системное окно сопряжения. Живой пульс работает в любом случае; выключите, если окно мешает.</string>
+    <string name="l10n_settings_screen_ask_android_to_pair_323fccbe">Попросить Android выполнить сопряжение</string>
+    <string name="l10n_settings_screen_broadcast_strap_hr_garmin_ant_a39d0654">Транслировать пульс браслета (Garmin/ANT)</string>
+    <string name="l10n_settings_screen_buzz_the_time_on_your_strap_06fc879d">Отбивать время вибрацией на браслете</string>
+    <string name="l10n_settings_screen_cancel_77dfd213">Отмена</string>
+    <string name="l10n_settings_screen_restore_3cbe6d6b">Восстановить</string>
+    <string name="l10n_settings_screen_card_transparency_c5c7b4f3">Прозрачность карточек</string>
+    <string name="l10n_settings_screen_charge_d4e1aee4">Заряд</string>
+    <string name="l10n_settings_screen_charge_effort_and_rest_and_how_d2c423a4">Заряд, Усилие и Отдых — и чем они отличаются от WHOOP</string>
+    <string name="l10n_settings_screen_chart_colours_525f4a37">Цвета графиков</string>
+    <string name="l10n_settings_screen_check_for_updates_736b9062">Проверить обновления</string>
+    <string name="l10n_settings_screen_checking_820d6004">Проверка…</string>
+    <string name="l10n_settings_screen_checks_github_for_the_latest_version_c10a81e2">Проверяет последнюю версию на GitHub по нажатию. Больше ничего не отправляется.</string>
+    <string name="l10n_settings_screen_contact_support_at_support_email_f0c4adce">Связаться с поддержкой: %1$s</string>
+    <string name="l10n_settings_screen_continuous_hrv_capture_1f0805d8">Непрерывный захват ВСР</string>
+    <string name="l10n_settings_screen_couldn_t_check_try_again_b3c885d9">Не удалось проверить. Попробуйте снова.</string>
+    <string name="l10n_settings_screen_counter_ticks_per_step_leave_at_3ce8c1d5">Тиков счётчика на шаг. Оставьте 1.0, если только шаги не завышены. На WHOOP 5/MG они могут быть очень завышены (в 10 раз и более), поэтому предел здесь до 30. Пройдите известные 1000 шагов и разделите счёт NOOP на реальное число, чтобы получить своё значение.</string>
+    <string name="l10n_settings_screen_show_cycle_awareness_59709019">Показывать осведомлённость о цикле</string>
+    <string name="l10n_settings_screen_cycle_awareness_ffb94783">Осведомлённость о цикле</string>
+    <string name="l10n_settings_screen_day_cycle_background_8c254f01">Фон суточного цикла</string>
+    <string name="l10n_settings_screen_diagnostics_3af2279f">Диагностика</string>
+    <string name="l10n_settings_screen_disconnect_ed28e068">Отключить</string>
+    <string name="l10n_settings_screen_download_a479c9c3">Скачать</string>
+    <string name="l10n_settings_screen_effort_scale_81afa9ef">Шкала усилия</string>
+    <string name="l10n_settings_screen_experimental_whoop_5_mg_41ef7041">Экспериментально · WHOOP 5 / MG</string>
+    <string name="l10n_settings_screen_export_0a116345">Экспорт…</string>
+    <string name="l10n_settings_screen_export_csv_6bce63a3">Экспортировать CSV…</string>
+    <string name="l10n_settings_screen_export_raw_log_matched_pair_d65390bf">Экспорт сырых данных + журнала (парный набор)</string>
+    <string name="l10n_settings_screen_export_raw_sensor_data_csv_a171b81e">Экспортировать необработанные данные датчиков (CSV)</string>
+    <string name="l10n_settings_screen_extends_the_sky_behind_the_whole_39bb82cc">Растягивает небо за всем экраном «Сегодня», поэтому при уменьшении прозрачности карточек оно будет просвечивать через каждую карточку. Требует включённого фона суточного цикла.</string>
+    <string name="l10n_settings_screen_feel_the_current_time_as_a_8ca41db1">Почувствуйте текущее время как последовательность вибраций (#460). Ничего не делает, если браслет не подключён.</string>
+    <string name="l10n_settings_screen_flags_accepted_but_the_enable_sequence_542b2595">Флаги приняты, но последовательность включения не запускает отдельный живой поток. Глубокие записи приходят в составе обычной синхронизации истории (#494).</string>
+    <string name="l10n_settings_screen_for_a_whoop_4_0_which_df865854">Для WHOOP 4.0, который не передаёт количество шагов: NOOP оценивает шаги по данным движения, откалиброванным по вашему телефону. Нажмите, чтобы увидеть точность и настроить её.</string>
+    <string name="l10n_settings_screen_github_code_releases_issues_and_the_50b41e25">GitHub: код, релизы, обращения и вики.</string>
+    <string name="l10n_settings_screen_health_wellness_93475778">Здоровье и самочувствие</string>
+    <string name="l10n_settings_screen_height_3f608b49">Рост</string>
+    <string name="l10n_settings_screen_how_noop_works_3396b27a">Как работает NOOP</string>
+    <string name="l10n_settings_screen_how_see_through_the_cards_heart_436105b9">Насколько прозрачны карточки (Пульс, Ключевые показатели, Показатели восстановления и др.). Слева = непрозрачно, справа = прозрачно.</string>
+    <string name="l10n_settings_screen_how_your_scores_work_21a0e2be">Как работают ваши показатели</string>
+    <string name="l10n_settings_screen_hrv_window_e74320b8">Окно ВСР</string>
+    <string name="l10n_settings_screen_hydration_tracking_579a2b32">Отслеживание гидратации</string>
+    <string name="l10n_settings_screen_icon_716f63b9">Иконка</string>
+    <string name="l10n_settings_screen_illness_heads_up_97e10035">Предупреждение о болезни</string>
+    <string name="l10n_settings_screen_import_4834caf8">Импортировать…</string>
+    <string name="l10n_settings_screen_importing_overwrites_everything_currently_on_this_297b76ae">Импорт перезаписывает всё, что сейчас на этом телефоне. Ваши старые данные на всякий случай сохраняются в отдельном файле. Чтобы импорт вступил в силу, NOOP нужно перезапустить. </string>
+    <string name="l10n_settings_screen_keep_connected_in_the_background_44499d45">Оставаться подключённым в фоне</string>
+    <string name="l10n_settings_screen_keep_noop_alive_overnight_e43b2fba">Держать NOOP активным всю ночь</string>
+    <string name="l10n_settings_screen_allow_3ad0e369">Разрешить</string>
+    <string name="l10n_settings_screen_keep_screen_on_during_a_workout_42d27284">Не выключать экран во время тренировки</string>
+    <string name="l10n_settings_screen_keeps_streaming_from_your_strap_with_d31b4af9">Продолжает получать данные с браслета с постоянным уведомлением, даже после закрытия NOOP. Выключите, чтобы отключаться при закрытии приложения.</string>
+    <string name="l10n_settings_screen_keeps_the_detailed_beat_to_beat_87b78edd">Держит подробный межударный поток включённым круглосуточно, а не только при открытом живом экране, поэтому NOOP собирает намного больше данных для ночной ВСР, восстановления и сна. Расходует больше батареи (браслет передаёт пульс непрерывно). Требуется включённый пункт «Оставаться подключённым в фоне».</string>
+    <string name="l10n_settings_screen_live_deeppacketsthissession_type_0x2f_historical_offload_8fef3d84">Замечено кадров типа 0x2F исторической выгрузки вне нашей синхронизации: %1$s. Это история (например, другое приложение забирает накопленное с браслета), а не живой поток R22 (#494).</string>
+    <string name="l10n_settings_screen_live_sessions_beta_2ca3a97f">Сессии в реальном времени (бета)</string>
+    <string name="l10n_settings_screen_makes_your_whoop_5_0_mg_b26b94c7">Заставляет ваш WHOOP 5.0/MG транслировать пульс как стандартный Bluetooth-датчик пульса, чтобы Garmin (Edge/часы), Zwift или тренажёр могли использовать его во время тренировки. Применяется при следующем подключении (и сразу, если подключён); записывает флаг браслета whoop_live_hr_in_adv_ind_pkt. Обратимо. Только 5/MG.</string>
+    <string name="l10n_settings_screen_max_heart_rate_3d4ed858">Максимальный пульс</string>
+    <string name="l10n_settings_screen_measurement_system_701d765d">Система измерения</string>
+    <string name="l10n_settings_screen_motion_aware_wake_refinement_67a91e47">Уточнение пробуждения по движению</string>
+    <string name="l10n_settings_screen_noop_is_not_a_medical_device_ab32ef7e">NOOP не является медицинским устройством. Он предназначен только для информации и личного анализа и не предназначен для диагностики, лечения или профилактики каких-либо состояний. За медицинской консультацией обращайтесь к врачу.</string>
+    <string name="l10n_settings_screen_offer_a_breath_automatically_6c709dee">Автоматически предлагать дыхание</string>
+    <string name="l10n_settings_screen_on_a_5_mg_connection_noop_4557c8f8">При подключении к 5/MG NOOP после установления соединения отправит запрос на поток данных puffin в реальном времени и запишет полученный ответ. Если у вас браслет 5/MG, включение этой функции и отправка журнала браслета помогут разобраться в протоколе. На WHOOP 4.0 это не влияет.</string>
+    <string name="l10n_settings_screen_open_source_ble_reverse_engineering_work_40062271">Открытая работа по изучению BLE-протокола. Спасибо.</string>
+    <string name="l10n_settings_screen_open_test_centre_a7fbe4e9">Открыть тестовый центр</string>
+    <string name="l10n_settings_screen_overnight_only_05747985">Только ночью</string>
+    <string name="l10n_settings_screen_profile_ff4fc027">Профиль</string>
+    <string name="l10n_settings_screen_profile_photo_33f385bb">Фото профиля</string>
+    <string name="l10n_settings_screen_project_home_and_source_on_github_a067ed35">Страница проекта и исходный код на GitHub</string>
+    <string name="l10n_settings_screen_project_home_source_994627c1">Домашняя страница и исходный код проекта</string>
+    <string name="l10n_settings_screen_questions_feedback_bugs_support_email_ed10662a">Вопросы, отзывы, ошибки: %1$s</string>
+    <string name="l10n_settings_screen_recalibrate_aaa989ea">Перекалибровать</string>
+    <string name="l10n_settings_screen_recalibrate_charge_baseline_52a05a26">Перекалибровать норму Заряда</string>
+    <string name="l10n_settings_screen_recalibrate_your_charge_baseline_018e3846">Перекалибровать норму Заряда?</string>
+    <string name="l10n_settings_screen_recent_changes_and_what_to_expect_3ceb660b">Недавние изменения и чего ожидать</string>
+    <string name="l10n_settings_screen_record_5_mg_raw_capture_9354fe89">Записывать сырой захват 5/MG</string>
+    <string name="l10n_settings_screen_record_5_mg_raw_capture_research_1d966bbf">Записывать сырой захват 5/MG (исследование)</string>
+    <string name="l10n_settings_screen_records_the_raw_frames_of_each_98a284df">Записывает сырые кадры каждой синхронизации истории 5/MG в файл на этом телефоне, чтобы вы могли поделиться ими и помочь NOOP научиться декодировать сон, восстановление и нагрузку 5/MG. Файл содержит сырые биометрические кадры (пульс, R-R, температура кожи, движение) и собственный диагностический текст браслета. Ничего не покидает телефон, пока вы сами не поделитесь. По умолчанию выключено.</string>
+    <string name="l10n_settings_screen_remove_photo_c8f5eda8">Удалить фото</string>
+    <string name="l10n_settings_screen_rename_d3f4cb89">Переименовать</string>
+    <string name="l10n_settings_screen_rename_your_strap_s_bluetooth_name_6032668b">Переименуйте Bluetooth-имя браслета — полезно для купленного с рук. Браслет </string>
+    <string name="l10n_settings_screen_restarts_the_roughly_4_night_build_84f9f8d0">Перезапускает примерно 4-дневное накопление данных для Заряда и вашей нормы ВСР начиная с сегодняшней ночи. Используйте, если неудачная первая неделя сбила вашу норму. История сохраняется.</string>
+    <string name="l10n_settings_screen_reviews_each_scored_wake_block_for_537924ea">Проверяет каждый оценённый блок бодрствования на реальные признаки подъёма (ритм шагов, </string>
+    <string name="l10n_settings_screen_rhythm_experimental_12d357da">Ритм (эксперимент)</string>
+    <string name="l10n_settings_screen_runs_the_continuous_hrv_stream_only_3fed47c5">Запускает непрерывный поток ВСР только в ваши тихие часы (по умолчанию 22:00–07:00), примерно вдвое снижая расход батареи. Дневные измерения стресса станут реже. </string>
+    <string name="l10n_settings_screen_saves_the_last_24h_of_decoded_f7026f47">Сохраняет последние 24 часа декодированных данных с датчиков (пульс, R-R, движение, шаги и любые глубокие потоки 5/MG, которые вы разблокировали) в один CSV, которым можно поделиться, чтобы поэкспериментировать со своими данными. Ничего не покидает телефон, пока вы сами не поделитесь.</string>
+    <string name="l10n_settings_screen_send_enable_sequence_to_strap_04ff8a22">Отправить последовательность включения на браслет</string>
+    <string name="l10n_settings_screen_set_up_automatic_backups_00b4780c">Настроить автоматические резервные копии</string>
+    <string name="l10n_settings_screen_settings_c7f73bb5">Настройки</string>
+    <string name="l10n_settings_screen_sex_e301dd60">Пол</string>
+    <string name="l10n_settings_screen_share_5_mg_capture_for_the_e41ac6bd">Поделиться захватом 5/MG (для работы над декодированием)</string>
+    <string name="l10n_settings_screen_share_on_device_signals_with_the_b3fd747e">Передавать сигналы с устройства ИИ-тренеру</string>
+    <string name="l10n_settings_screen_share_strap_log_for_bug_reports_b9802500">Поделиться журналом браслета (для отчётов об ошибках)</string>
+    <string name="l10n_settings_screen_shows_a_soft_sunrise_day_dusk_2d20b417">Показывает мягкую сцену рассвета, дня, сумерек и ночи на фоне экрана «Сегодня». Отключите для простого тёмного фона. Читаемость карточек не изменится.</string>
+    <string name="l10n_settings_screen_sky_behind_cards_efbe5cb8">Небо за карточками</string>
+    <string name="l10n_settings_screen_sleep_sorting_scores_recording_and_where_832378b5">Сортировка сна, оценки, запись и то, откуда берутся ваши данные.</string>
+    <string name="l10n_settings_screen_sleep_staging_v2_3a007e4a">Определение стадий сна V2</string>
+    <string name="l10n_settings_screen_sleep_staging_v2_a4176770">Определение стадий сна (V2)</string>
+    <string name="l10n_settings_screen_some_phones_also_need_auto_start_79b7147b">Некоторым телефонам нужен ещё и автозапуск — откройте этот экран</string>
+    <string name="l10n_settings_screen_step_calibration_351c09bf">Калибровка шагов</string>
+    <string name="l10n_settings_screen_steps_estimate_calibration_stepssummary_opens_the_d6fbf995">Калибровка оценки шагов. %1$s. Открывает экран калибровки.</string>
+    <string name="l10n_settings_screen_steps_estimate_ce7a604d">Оценка шагов</string>
+    <string name="l10n_settings_screen_strap_02b88eeb">Браслет</string>
+    <string name="l10n_settings_screen_strap_name_350de547">Название браслета</string>
+    <string name="l10n_settings_screen_stress_check_ins_haptic_bf2746ba">Отметки стресса (вибрация)</string>
+    <string name="l10n_settings_screen_support_contact_f4c31b01">Поддержка и контакты</string>
+    <string name="l10n_settings_screen_temperature_0a9062a9">Температура</string>
+    <string name="l10n_settings_screen_test_centre_37b36828">Тестовый центр</string>
+    <string name="l10n_settings_screen_theme_a797e309">Тема</string>
+    <string name="l10n_settings_screen_this_is_a_plain_unencrypted_archive_b0dfe63d">Это обычный незашифрованный архив — любой, у кого есть файл, может открыть его любым zip-инструментом. Храните его в надёжном месте.</string>
+    <string name="l10n_settings_screen_this_restarts_the_roughly_4_night_c610a93d">Это заново запускает примерно 4-ночное накопление данных для Заряда и вашей нормы ВСР. История сохраняется. Используйте это, если неудачная первая неделя — например, ношение браслета во время болезни — сбила вашу норму.</string>
+    <string name="l10n_settings_screen_trend_charts_19085c81">Графики трендов</string>
+    <string name="l10n_settings_screen_try_history_sync_without_pairing_experimental_54c31ea2">Пробовать синхронизацию истории без сопряжения (эксперимент)</string>
+    <string name="l10n_settings_screen_try_history_sync_without_pairing_33ae8594">Пробовать синхронизацию истории без сопряжения</string>
+    <string name="l10n_settings_screen_try_whoop_5_mg_protocol_probes_1d584653">Попробовать экспериментальные функции протокола WHOOP 5/MG</string>
+    <string name="l10n_settings_screen_units_12748281">Единицы</string>
+    <string name="l10n_settings_screen_unlock_whoop_5_mg_deep_data_2f2bd226">Разблокировать расширенные данные WHOOP 5/MG (R22)</string>
+    <string name="l10n_settings_screen_unlock_whoop_5_mg_deep_data_70036ca8">Разблокировать глубокие данные WHOOP 5/MG</string>
+    <string name="l10n_settings_screen_version_avail_version_is_available_5b401bd4">Доступна версия %1$s</string>
+    <string name="l10n_settings_screen_waist_optional_d5356703">Талия (необязательно)</string>
+    <string name="l10n_settings_screen_weight_69c0b815">Вес</string>
+    <string name="l10n_settings_screen_what_each_strap_can_read_and_51e7d3fc">Что может читать каждый браслет и почему некоторые функции различаются.</string>
+    <string name="l10n_settings_screen_what_s_new_4d8dc5fe">Что нового</string>
+    <string name="l10n_settings_screen_what_s_new_in_noop_appchangelog_d26fb453">Что нового в NOOP %1$s</string>
+    <string name="l10n_settings_screen_whole_night_is_noop_s_default_fbfff434">Вся ночь — мера NOOP по умолчанию; «Глубокий сон» собирает ВСР только по медленноволновому сну, даёт более низкие значения и совпадает с WHOOP. Переключение пересчитает ваши недавние ночи по новому окну и вступит в силу сразу, как только накопится несколько ночей данных.</string>
+    <string name="l10n_settings_screen_whoop_4_0_versus_5_0_a54c5504">WHOOP 4.0 против 5.0: что каждый может читать и почему</string>
+    <string name="l10n_settings_screen_whoop_4_0_vs_5_0_2babb05a">WHOOP 4.0 против 5.0/MG</string>
+    <string name="l10n_settings_screen_whoop_5_mg_straps_hand_a_b8b239e6">Старый эксперимент с флагами R22. Браслет принимает эти записи, но NOOP не наблюдал включения отдельного живого потока. Для обычной поддержки WHOOP 5/MG и Сборщика сырых данных это не требуется. Записывает постоянные настройки браслета и может ничего не дать на вашей прошивке.</string>
+    <string name="l10n_settings_screen_whoop_a3650379">Whoop</string>
+    <string name="l10n_settings_screen_working_13b7bfca">Обработка…</string>
+    <string name="l10n_settings_screen_you_re_on_the_latest_r_027a82be">У вас последняя версия (%1$s).</string>
+    <string name="l10n_skin_temp_cards_screen_a_period_is_likely_between_prettyday_bc501b32">Менструация вероятна между %1$s и </string>
+    <string name="l10n_skin_temp_cards_screen_day_1_bright_light_clockstring_firstday_43b5fe87">День 1: яркий свет %1$s – </string>
+    <string name="l10n_skin_temp_cards_screen_estimated_body_clock_low_around_clockstring_fb0f0790">Расчётный минимум биологических часов около %1$s</string>
+    <string name="l10n_skin_temp_cards_screen_from_your_nightly_temperature_ff8cca1a">По вашей ночной температуре</string>
+    <string name="l10n_skin_temp_cards_screen_light_sleep_timing_only_df2a1552">Только лёгкий сон и время сна</string>
+    <string name="l10n_skin_temp_cards_screen_log_period_start_c97241d0">Отметить начало цикла</string>
+    <string name="l10n_skin_temp_cards_screen_turn_off_8807c2b3">Выключить</string>
+    <string name="l10n_skin_temp_cards_screen_view_detail_27af4b67">Подробнее</string>
+    <string name="l10n_sleep_screen_add_a_nap_a1b3204f">Добавить дневной сон</string>
+    <string name="l10n_sleep_screen_adjust_sleep_times_1e325561">Скорректировать время сна</string>
+    <string name="l10n_sleep_screen_cancel_77dfd213">Отмена</string>
+    <string name="l10n_sleep_screen_save_efc007a3">Сохранить</string>
+    <string name="l10n_sleep_screen_daytime_sleep_871c03ca">Дневной сон</string>
+    <string name="l10n_sleep_screen_delete_f6fdbe48">Удалить</string>
+    <string name="l10n_sleep_screen_delete_this_sleep_session_6932e931">Удалить эту сессию сна</string>
+    <string name="l10n_sleep_screen_delete_this_sleep_session_c347b909">Удалить эту сессию сна?</string>
+    <string name="l10n_sleep_screen_deleted_sleep_windows_46fea77a">Удалённые окна сна</string>
+    <string name="l10n_sleep_screen_deleted_sleep_window_hidden_5c848a32">Удалённое окно сна скрыто. Оно останется удалённым.</string>
+    <string name="l10n_sleep_screen_good_morning_33e88869">Доброе утро!</string>
+    <string name="l10n_sleep_screen_couldn_t_hide_this_deleted_sleep_bbedac55">Не удалось скрыть это удалённое окно сна. Попробуйте снова.</string>
+    <string name="l10n_sleep_screen_hide_7aee4b04">скрыть</string>
+    <string name="l10n_sleep_screen_hide_this_deleted_sleep_window_c349003f">Скрыть это удалённое окно сна</string>
+    <string name="l10n_sleep_screen_couldn_t_reopen_this_night_try_88265690">Не удалось открыть эту ночь заново. Попробуйте снова.</string>
+    <string name="l10n_sleep_screen_if_this_sleep_came_only_from_d0892088">Если этот сон получен только из импорта и сырые данные не сохранены, он может не появиться снова.</string>
+    <string name="l10n_sleep_screen_maybe_later_27ad1d83">Может быть, позже</string>
+    <string name="l10n_sleep_screen_move_anyway_19ee824d">Всё равно перенести</string>
+    <string name="l10n_sleep_screen_move_this_sleep_438dd3b5">Перенести этот сон?</string>
+    <string name="l10n_sleep_screen_naps_2f83e350">Дневные сны</string>
+    <string name="l10n_sleep_screen_next_night_7deeb06b">Следующая ночь</string>
+    <string name="l10n_sleep_screen_no_earlier_night_stored_yet_earlier_ab637d4c">Более ранняя ночь пока не сохранена. Предыдущие ночи синхронизируются утром.</string>
+    <string name="l10n_sleep_screen_no_naps_recorded_for_this_day_b17c148f">За этот день дневной сон не зафиксирован.</string>
+    <string name="l10n_sleep_screen_no_stage_breakdown_for_this_night_b74bf9c3">Нет разбивки по стадиям за эту ночь.</string>
+    <string name="l10n_sleep_screen_no_stage_data_recorded_for_this_93a86806">Данные о стадиях сна за эту ночь не записаны.</string>
+    <string name="l10n_sleep_screen_open_journal_4bf0daee">Открыть Журнал</string>
+    <string name="l10n_sleep_screen_previous_night_9f339047">Предыдущая ночь</string>
+    <string name="l10n_sleep_screen_recompute_a_night_to_clear_its_fd9e15c3">Пересчитайте ночь, чтобы снять метку удаления и заново просмотреть доступные сырые данные.</string>
+    <string name="l10n_sleep_screen_recompute_this_deleted_sleep_night_2d2f46f6">Пересчитать эту удалённую ночь сна</string>
+    <string name="l10n_sleep_screen_recompute_this_night_5ba0d05c">Пересчитать эту ночь</string>
+    <string name="l10n_sleep_screen_recomputing_6f8e54e3">Пересчёт…</string>
+    <string name="l10n_sleep_screen_sleep_3cac34e6">Сон</string>
+    <string name="l10n_sleep_screen_sleep_detection_reran_using_the_data_01757aad">Определение сна выполнено заново по данным, доступным за эту ночь.</string>
+    <string name="l10n_sleep_screen_stage_breakdown_e9b714f9">Структура стадий</string>
+    <string name="l10n_sleep_screen_this_moves_the_night_to_a_fac2fb46">Это перенесёт ночь на время, где нет записанных данных. Стадии там вывести нельзя, поэтому она может отображаться пустой, пока данные её не покроют.</string>
+    <string name="l10n_sleep_screen_your_night_data_is_in_logging_ec461720">Данные за ночь получены. Отметка о самочувствии помогает NOOP понять, что даёт вам лучшее восстановление.</string>
+    <string name="l10n_stress_screen_autonomic_balance_lf_hf_776cb6f7">Баланс автономной нервной системы (LF/HF)</string>
+    <string name="l10n_stress_screen_avg_a178769d">СРЕД</string>
+    <string name="l10n_stress_screen_baevsky_stress_index_296cf7c0">Индекс напряжения Баевского</string>
+    <string name="l10n_stress_screen_daily_0_3_proxy_63247929">Суточный показатель-заменитель 0–3</string>
+    <string name="l10n_stress_screen_hf_power_3a9fd8c9">Мощность HF</string>
+    <string name="l10n_stress_screen_not_enough_recent_days_to_chart_c072bade">Пока недостаточно недавних дней, чтобы построить тренд. Продолжайте носить браслет, чтобы заполнить его.</string>
+    <string name="l10n_stress_screen_of_3_46203495">из 3</string>
+    <string name="l10n_stress_screen_on_demand_today_s_r_r_17d716e1">по запросу · сегодняшние R-R</string>
+    <string name="l10n_stress_screen_on_the_0_3_autonomic_load_8a0d5107">по шкале вегетативной нагрузки 0–3</string>
+    <string name="l10n_stress_screen_the_line_traces_your_autonomic_load_804f4028">Линия показывает вашу вегетативную нагрузку в течение дня бодрствования, оценённую </string>
+    <string name="l10n_stress_screen_these_are_extra_on_demand_hrv_9303f1de">Это дополнительные измерения ВСР по запросу, вычисленные по сегодняшним интервалам R-R. Они информационные и не меняют оценку стресса выше.</string>
+    <string name="l10n_stress_screen_we_compare_today_s_resting_heart_a9cd0955">Мы сравниваем сегодняшние пульс в покое и ВСР с вашей собственной 30-дневной </string>
+    <string name="l10n_test_centre_screen_bug_report_5a7ee5ac">Отчёт об ошибке</string>
+    <string name="l10n_today_screen_arrange_cfdd099c">Расположение</string>
+    <string name="l10n_today_screen_arrange_today_sections_9675862b">Настроить разделы «Сегодня»</string>
+    <string name="l10n_today_screen_baselines_learned_on_device_over_14_359f6812">Нормы выучены на устройстве за 14 дней. Полосы дают приблизительное представление о каждом </string>
+    <string name="l10n_today_screen_blood_oxygen_a8ad9ff5">Кислород в крови</string>
+    <string name="l10n_today_screen_breaths_per_minute_2b197c54">Вдохов в минуту</string>
+    <string name="l10n_today_screen_calories_3e62ecfe">Калории</string>
+    <string name="l10n_today_screen_choose_which_tiles_show_on_your_a4e3acfb">Выберите, какие плитки отображать в Пульте управления, и измените их порядок с помощью стрелок.</string>
+    <string name="l10n_today_screen_daytitle_humandate_tap_to_pick_a_7e12ce96">%1$s, %2$s. Нажмите, чтобы выбрать день, смахните, чтобы сменить день.</string>
+    <string name="l10n_today_screen_detailed_tiles_0801721b">Подробные плитки</string>
+    <string name="l10n_today_screen_dismiss_to_updates_2c7915b8">Отклонить в «Обновления»</string>
+    <string name="l10n_today_screen_each_line_is_how_many_points_dec2c062">Каждая строка показывает, на сколько пунктов этот сигнал сдвинул Заряд относительно вашей </string>
+    <string name="l10n_today_screen_edit_5301648d">Изменить</string>
+    <string name="l10n_today_screen_edit_key_metrics_f95e61a4">Изменить ключевые метрики</string>
+    <string name="l10n_today_screen_heart_rate_variability_a137586d">Вариабельность сердечного ритма</string>
+    <string name="l10n_today_screen_how_domain_label_is_calculated_8897768c">Как вычисляется %1$s</string>
+    <string name="l10n_today_screen_latest_bpm_e7bec767">%1$s уд/мин</string>
+    <string name="l10n_today_screen_live_now_your_scores_are_building_cb05a4e8">Данные поступают в реальном времени. Ваши показатели формируются.</string>
+    <string name="l10n_today_screen_move_item_metric_title_down_890afe60">Переместить %1$s вниз</string>
+    <string name="l10n_today_screen_move_item_metric_title_up_52d2104c">Переместить %1$s вверх</string>
+    <string name="l10n_today_screen_new_data_added_e59345b4">Добавлены новые данные</string>
+    <string name="l10n_today_screen_no_cardio_load_yet_effort_builds_e952006c">Кардионагрузки пока нет. Усилие начинает расти, когда пульс поднимается в зону усилия (около 50% резерва пульса). В спокойный день значение честно будет близко к нулю.</string>
+    <string name="l10n_today_screen_profile_and_settings_9b3d12f2">Профиль и настройки</string>
+    <string name="l10n_today_screen_recovery_ea924f72">Восстановление</string>
+    <string name="l10n_today_screen_sync_chip_now_c9bc849a">сейчас</string>
+    <string name="l10n_today_screen_sync_chip_live_98aadb37">в реальном времени</string>
+    <string name="l10n_today_screen_sync_chip_syncing_desc_bfc290e7">Синхронизация истории браслета, %1$d фрагментов</string>
+    <string name="l10n_today_screen_sync_chip_synced_desc_4d255944">История браслета синхронизирована %1$s назад</string>
+    <string name="l10n_today_screen_sync_chip_experimental_desc_3de06a70">Подключено; синхронизация истории экспериментальна для этого браслета.</string>
+    <string name="l10n_today_screen_recovery_roundtoint_charge_92fbaa5e">%1$s%% Заряда</string>
+    <string name="l10n_today_screen_respiratory_1cd8c175">Дыхание</string>
+    <string name="l10n_today_screen_rest_b79e5f48">Отдых</string>
+    <string name="l10n_today_screen_rest_hr_04005617">Пульс покоя</string>
+    <string name="l10n_today_screen_resting_heart_rate_348928d6">Пульс в покое</string>
+    <string name="l10n_today_screen_resting_hr_26677094">Пульс в покое</string>
+    <string name="l10n_today_screen_show_item_metric_title_81803daf">Показать %1$s</string>
+    <string name="l10n_today_screen_sleep_3cac34e6">Сон</string>
+    <string name="l10n_today_screen_source_herosourcelabel_d3363687">Источник: %1$s</string>
+    <string name="l10n_today_screen_squarer_tiles_with_a_trend_graph_3c297dec">Более квадратные плитки с графиком тренда под полосой.</string>
+    <string name="l10n_today_screen_steps_cdde4f20">Шаги</string>
+    <string name="l10n_today_screen_strain_79fe380e">Нагрузка</string>
+    <string name="l10n_today_screen_synced_from_2aa7258b">Синхронизировано из</string>
+    <string name="l10n_today_screen_synthesis_876bc749">СИНТЕЗ</string>
+    <string name="l10n_today_screen_unitformatter_effortdisplay_strain_effortscale_effort_53dbd951">Усилие %1$s</string>
+    <string name="l10n_today_screen_value_bpm_8f3a90c3">%1$s уд/мин</string>
+    <string name="l10n_today_screen_weight_69c0b815">Вес</string>
+    <string name="l10n_trends_explore_screen_blood_oxygen_a8ad9ff5">Кислород в крови</string>
+    <string name="l10n_trends_explore_screen_charge_d4e1aee4">Заряд</string>
+    <string name="l10n_trends_explore_screen_effort_8c974bc6">Усилие</string>
+    <string name="l10n_trends_explore_screen_respiratory_rate_3fbb532f">Частота дыхания</string>
+    <string name="l10n_trends_explore_screen_resting_hr_26677094">Пульс в покое</string>
+    <string name="l10n_trends_explore_screen_sleep_3cac34e6">Сон</string>
+    <string name="l10n_trends_explore_screen_sleep_efficiency_b4b5c293">Эффективность сна</string>
+    <string name="l10n_trends_report_a_clean_shareable_one_page_pdf_a3c4f889">Аккуратный одностраничный PDF, которым можно поделиться: восстановление, сон, ВСР, пульс в покое </string>
+    <string name="l10n_trends_report_export_pdf_3dd7d56a">Экспортировать PDF</string>
+    <string name="l10n_trends_report_the_share_sheet_can_save_the_ecddbca7">Через меню «Поделиться» PDF можно сохранить в Файлы или отправить дальше.</string>
+    <string name="l10n_trends_report_trends_report_pdf_481e8a5f">Отчёт по трендам (PDF)</string>
+    <string name="l10n_weekly_digest_card_digest_dayswithdata_7_days_182e6a18">%1$s из 7 дней</string>
+    <string name="l10n_weekly_digest_card_digest_dayswithdata_of_7_days_had_8068f0ee">Данные были в %1$s из 7 дней на этой неделе</string>
+    <string name="l10n_weekly_digest_card_informational_only_not_medical_advice_593feb77">Только для информации, не медицинская рекомендация.</string>
+    <string name="l10n_weekly_digest_card_sleep_steadiness_rest_varied_fmt1_sd_44997f21">Стабильность сна: Отдых колебался на ±%1$s пт от ночи к ночи.</string>
+    <string name="l10n_wheel_picker_accessibility_tap_to_choose_1314c4ed">%1$s. Нажмите, чтобы выбрать.</string>
+    <string name="intervals_range_step">%1$s – %2$s%3$s · шаг %4$d</string>
+    <string name="live_workout_saved_summary">✓ %1$s сохранено · %2$s</string>
+    <string name="stress_score_accessibility">Стресс %1$s из 3, %2$s</string>
+    <string name="stress_peak_summary">пик %1$s · %2$s</string>
+    <string name="today_load_ratio">нагрузка %1$s</string>
+    <string name="timeline_metric_heart_rate">Пульс</string>
+    <string name="timeline_metric_rmssd">rMSSD (5 мин)</string>
+    <string name="timeline_metric_skin_temp">Темп. кожи</string>
+    <string name="timeline_metric_respiration">Дыхание</string>
+    <string name="timeline_metric_motion">Движение</string>
+    <string name="timeline_metric_band_sleep_state">Состояние сна по браслету</string>
+    <string name="timeline_metric_movement">Движение</string>
+    <string name="explore_category_charge">Заряд</string>
+    <string name="explore_category_effort">Усилие</string>
+    <string name="explore_category_rest">Отдых</string>
+    <string name="explore_category_health">Здоровье</string>
+    <string name="explore_category_heart">Сердце</string>
+    <string name="explore_category_nutrition">Питание</string>
+    <string name="explore_category_mind">Разум</string>
+    <string name="explore_metric_average_heart_rate">Средний пульс</string>
+    <string name="explore_metric_max_heart_rate">Максимальный пульс</string>
+    <string name="explore_metric_calories_in">Калории (потреблено)</string>
+    <string name="explore_metric_protein">Белки</string>
+    <string name="explore_metric_carbs">Углеводы</string>
+    <string name="explore_metric_fat">Жир</string>
+    <string name="explore_metric_mood">Настроение</string>
+    <string name="explore_description_charge">Насколько вы восстановились, в первую очередь по ВСР относительно вашей личной нормы.</string>
+    <string name="explore_description_effort">Сердечно-сосудистая нагрузка за день по шкале 0–100 (раньше 0–21).</string>
+    <string name="explore_description_rest">Насколько восстанавливающим был ваш сон: длительность, эффективность, глубокий+быстрый сон, время.</string>
+    <string name="l10n_workouts_screen_heart_rate_recovery_516">Восстановление пульса</string>
+    <string name="l10n_workouts_screen_after_high_intensity_effort_516">После высокоинтенсивной нагрузки</string>
+    <string name="l10n_workouts_screen_peak_hr_bpm_516">Пик %1$d уд/мин</string>
+    <string name="l10n_workouts_screen_hrr_one_minute_516">1 мин</string>
+    <string name="l10n_workouts_screen_hrr_two_minutes_516">2 мин</string>
+    <string name="l10n_workouts_screen_hrr_five_minutes_516">5 мин</string>
+    <string name="l10n_workouts_screen_hrr_bpm_516">уд/мин</string>
+    <string name="l10n_workouts_screen_hrr_not_available_516">Недоступно</string>
+    <string name="l10n_workouts_screen_hrr_accessibility_516">Восстановление пульса на %1$s, %2$s ударов в минуту</string>
+    <string name="l10n_workouts_screen_hrr_explanation_516">Изменение относительно вашего пульса в конце нагрузки. Положительные значения означают, что пульс снизился; прочерк означает, что браслет не записал достаточно данных около этой минуты.</string>
+    <string name="l10n_workouts_screen_recovery_trend_516">Тренд восстановления</string>
+    <string name="l10n_workouts_screen_hrr_range_516">Восстановление пульса · %1$s</string>
+    <string name="l10n_workouts_screen_hrr_trend_explanation_516">Каждая линия показывает, на сколько ударов в минуту изменился ваш пульс после нагрузки. Учитываются только высокоинтенсивные тренировки с записанным пульсом после тренировки.</string>
+    <string name="l10n_workouts_screen_hrr_chart_accessibility_516">Тренд восстановления пульса в ударах в минуту</string>
+    <string name="l10n_workouts_screen_hrr_last_7_days_516">последние 7 дней</string>
+    <string name="l10n_workouts_screen_hrr_last_30_days_516">последние 30 дней</string>
+    <string name="l10n_workouts_screen_hrr_last_90_days_516">последние 90 дней</string>
+    <string name="timeline_spo2_not_on_whoop5">Этот браслет не передаёт SpO₂ по Bluetooth. Импортируйте выгрузку WHOOP или Health Connect, чтобы увидеть его.</string>
+    <string name="timeline_resp_not_on_whoop5">Этот браслет не передаёт сырой поток дыхания. Ваша расчётная частота дыхания показана на экране «Здоровье».</string>
+    <string name="settings_disclosure_expanded">Развёрнуто</string>
+    <string name="settings_disclosure_collapsed">Свёрнуто</string>
+    <string name="l10n_data_sources_screen_last_shared_6bf8389c">"Последняя отправка "</string>
+    <string name="l10n_data_sources_screen_sharing_paused_health_connect_permission_was_e8950315">Выгрузка приостановлена — разрешение Health Connect отозвано. Нажмите, чтобы выдать снова.</string>
+    <string name="l10n_data_sources_screen_last_share_didn_t_finish_noop_0d6c27f0">Последняя отправка не завершилась — NOOP повторит автоматически.</string>
+    <string name="settings_streak_title">Серия</string>
+    <string name="battery_critical_title">Зарядите WHOOP сейчас</string>
+    <string name="battery_critical_body">Осталось %1$d%%. Браслет прекращает запись около 10%% — без зарядки он не запишет эту ночь.</string>
+    <string name="battery_bedtime_title">Не хватит на ночь</string>
+    <string name="battery_bedtime_body">Осталось записи на %1$s, а на ночь нужно около %2$s. Зарядите перед сном.</string>
+    <string name="battery_runtime_title">Низкий заряд браслета</string>
+    <string name="battery_runtime_body">На вашем WHOOP осталось %1$s — зарядите сегодня вечером.</string>
+    <string name="battery_low_title">Низкий заряд</string>
+    <string name="battery_low_body">Зарядите WHOOP до наступления ночи.</string>
+    <string name="battery_full_title">Браслет полностью заряжен</string>
+    <string name="battery_full_body">Ваш WHOOP заряжен на 100%.</string>
+    <string name="fgs_title_reconnecting">Переподключение к вашему WHOOP…</string>
+    <string name="fgs_title_syncing">Синхронизирую историю браслета…</string>
+    <string name="fgs_title_connected">Подключено к вашему WHOOP</string>
+    <string name="fgs_detail_streaming">Передача данных в фоне</string>
+    <string name="fgs_detail_keeping_link">Соединение поддерживается</string>
+    <string name="fgs_detail_recovery">Восстановление %1$d%%</string>
+    <string name="fgs_detail_battery">Браслет %1$d%%</string>
+    <string name="fgs_action_disconnect">Отключить</string>
+    <string name="fgs_channel_name">Подключение браслета</string>
+    <string name="fgs_channel_desc">Показывается, пока NOOP поддерживает подключение вашего WHOOP в фоне.</string>
+    <string name="illness_alert_title">Раннее предупреждение: не перенапрягайтесь</string>
+    <string name="inactivity_title">Напоминание о движении</string>
+    <string name="smart_alarm_title">Доброе утро</string>
+    <string name="smart_alarm_body">Ваш умный будильник только что сработал.</string>
+    <string name="battery_channel_name">Оповещения о батарее</string>
+    <string name="battery_channel_desc">Уведомления, когда батарея браслета разряжена или полностью заряжена.</string>
+    <string name="l10n_app_changelog_battery_saver_quiets_the_gauges_translated_bdbe8650">Энергосбережение успокаивает индикаторы, переведённые уведомления Android и мгновенная загрузка графиков</string>
+    <string name="l10n_health_screen_no_spo_import_or_health_value_408f8c55">Нет импортированных данных SpO₂ или значения из Health</string>
+    <string name="l10n_health_screen_raw_counts_only_needs_an_import_d0e33552">Только сырые значения — нужен импорт</string>
+    <string name="l10n_settings_screen_turn_deep_data_back_off_r22disable">Выключить глубокие данные обратно</string>
+    <string name="l10n_settings_screen_r22disable_needs_bond">Требуется полное шифрованное сопряжение: сначала закройте официальное приложение WHOOP и сопрягите браслет с NOOP (канал только для пульса в реальном времени не может передать запись).</string>
+    <string name="l10n_settings_screen_r22disable_reason">Записывает значение выключения во все 16 флагов и читает каждый обратно, чтобы вы видели, что браслет хранит, а не только что он подтвердил. Значение выключения выведено из флага, который NOOP уже так отключает для трансляции на Garmin: на флаге R22 оно никогда не наблюдалось, поэтому NOOP сначала пробует один флаг и останавливается, если браслет его отвергнет. Очистка флагов — не то же самое, что увидеть остановку подробных записей: проверьте это последующей синхронизацией.</string>
+    <string name="l10n_settings_screen_r22disable_running">Очистка флагов R22 и обратное чтение каждого…</string>
+    <string name="l10n_settings_screen_r22disable_dismiss">Скрыть отчёт об отключении</string>
+    <string name="l10n_settings_screen_r22disable_confirm_title">Очистить флаги R22 на браслете?</string>
+    <string name="l10n_settings_screen_r22disable_confirm_body">Выключение этого переключателя лишь останавливает отправку разблокировки из NOOP. Уже записанные флаги остаются на браслете, пока что-нибудь их не очистит. NOOP может сейчас записать значение выключения во все 16 и прочитать каждый обратно, чтобы вы увидели, что браслет действительно хранит. Требуется подключённый и сопряжённый браслет.</string>
+    <string name="l10n_settings_screen_r22disable_confirm_action">Очистить флаги на браслете</string>
+    <string name="l10n_settings_screen_r22disable_confirm_cancel">Просто перестать отправлять</string>
+    <string name="l10n_settings_screen_r22_accepted_all">✓ Браслет принял все %1$d флагов R22</string>
+    <string name="l10n_settings_screen_r22_accepted_partial">Браслет принял %1$d из %2$d флагов R22…</string>
+    <string name="l10n_app_changelog_water_and_caffeine_from_apple_health_5123b6b0">Вода и кофеин из Apple Health, точнее оценка Усилия и исправление пульса покоя Oura</string>
+    <string name="onboarding_cta_begin">Начать</string>
+    <string name="onboarding_cta_continue">Продолжить</string>
+    <string name="onboarding_cta_save_continue">Сохранить и продолжить</string>
+    <string name="onboarding_cta_enter">Войти в NOOP</string>
+    <string name="onboarding_three_promises">Три негромких обещания.</string>
+    <string name="onboarding_recovery_body">Спокойное кольцо объединяет ВСР, пульс в покое и сон в один ответ: нажимать или отдыхать.</string>
+    <string name="onboarding_live_hr_body">Подключите WHOOP, пульсометр или тренажёр и следите за каждым ударом в реальном времени, с зонами под ваш профиль. Уже есть история в другом месте? Импортируйте её из WHOOP, Apple Health, Oura, Fitbit или Garmin.</string>
+    <string name="onboarding_local_data_body">Всё хранится на этом телефоне. Без аккаунта, без синхронизации, без облака.</string>
+    <string name="onboarding_expectations_subtitle">Несколько честных слов, чтобы ничто не стало сюрпризом.</string>
+    <string name="onboarding_expectation_independent_body">NOOP — личный открытый проект, а не приложение WHOOP, и он не связан с WHOOP. Он читает браслет, которым вы владеете, на вашем собственном устройстве. Относитесь к нему как к работающей, но незавершённой разработке, а не к готовому продукту.</string>
+    <string name="onboarding_expectation_whoop_support_body">WHOOP 4.0 протестирован и работает полностью. WHOOP 5.0/MG новее: живой пульс работает уже сегодня, но более глубокие метрики (восстановление, нагрузка, сон) для 5/MG всё ещё разбираются. NOOP всегда сообщает, что работает, а что ещё в разработке.</string>
+    <string name="onboarding_expectation_scores_body">Пульс в реальном времени доступен сразу. Восстановление, нагрузка и сон становятся точнее по мере того, как NOOP изучает вашу норму за первые ночи ношения. Хотите получить историю прямо сейчас? Импортируйте экспорт WHOOP в разделе «Источники данных» — она подгрузится примерно за минуту.</string>
+    <string name="onboarding_expectation_local_body">Ни аккаунта, ни облака, ни синхронизации. NOOP общается только с вашим браслетом и хранит всё локально. Ваши данные принадлежат только вам.</string>
+    <string name="onboarding_bluetooth_subtitle">NOOP использует Bluetooth, чтобы найти ваш браслет. Продолжив, выдайте разрешение, чтобы он мог выполнить поиск.</string>
+    <string name="onboarding_bluetooth_local_body">NOOP общается с браслетом напрямую по Bluetooth Low Energy. Между вами нет сервера. Соединение локальное — как и каждое считанное показание.</string>
+    <string name="onboarding_bluetooth_permission">Когда Android спросит, разрешите Bluetooth, чтобы NOOP мог искать и подключаться.</string>
+    <string name="onboarding_whoop_pairing_mode">WHOOP 5.0/MG может потребовать режим сопряжения в первый раз, при закрытом официальном приложении WHOOP.</string>
+    <string name="onboarding_wear_subtitle">Датчику нужен контакт с кожей, прежде чем данные начнут что-то значить.</string>
+    <string name="onboarding_wear_snug">Наденьте плотно на запястье или бицепс, датчиком к коже.</string>
+    <string name="onboarding_wear_charge">Дайте ему зарядиться несколько минут, если заряд низкий.</string>
+    <string name="onboarding_wear_nearby">Держите его рядом с телефоном во время сопряжения и первой синхронизации.</string>
+    <string name="onboarding_connect_bonded_subtitle">Сопряжено. Можно продолжать.</string>
+    <string name="onboarding_connect_searching_subtitle">NOOP начинает поиск, как только появляется этот шаг. Вы можете продолжать, пока идёт сопряжение.</string>
+    <string name="onboarding_connect_permission_subtitle">Разрешите Bluetooth и нажмите «Поиск», чтобы найти браслет, или продолжайте и подключитесь позже.</string>
+    <string name="onboarding_state_bonded_streaming">Привязано · передача данных</string>
+    <string name="onboarding_state_live_hr_unpaired">Живой пульс · сопряжение неполное</string>
+    <string name="onboarding_state_connected_pairing">Подключено · сопряжение</string>
+    <string name="onboarding_state_searching">Идёт поиск</string>
+    <string name="onboarding_state_ready_scan">Готов к сканированию</string>
+    <string name="onboarding_rescan">Искать снова</string>
+    <string name="onboarding_connect_background_body">Если браслет рядом, NOOP будет поддерживать BLE-соединение в фоне. Вы можете продолжать с профилем и импортом, пока идёт сопряжение.</string>
+    <string name="onboarding_strap_bonded_battery">Ваш браслет сопряжён · заряд %1$d%%.</string>
+    <string name="onboarding_strap_bonded_ready">Ваш браслет сопряжён и готов передавать данные.</string>
+    <string name="onboarding_profile_subtitle">Чтобы ваши зоны, калории и оценки на устройстве считались от правильных чисел.</string>
+    <string name="onboarding_years">лет</string>
+    <string name="onboarding_age_accessibility">Возраст, %1$d лет</string>
+    <string name="onboarding_sex">Пол</string>
+    <string name="onboarding_male">Мужской</string>
+    <string name="onboarding_female">Женский</string>
+    <string name="onboarding_other">Другое</string>
+    <string name="onboarding_units">Единицы</string>
+    <string name="onboarding_metric">Метрика</string>
+    <string name="onboarding_imperial">Имперская</string>
+    <string name="onboarding_importing">Импортируется…</string>
+    <string name="onboarding_import_label">Импорт</string>
+    <string name="onboarding_failed">не удалось</string>
+    <string name="onboarding_health_connect_denied">Доступ к Health Connect не предоставлен.</string>
+    <string name="onboarding_import_subtitle">Необязательно: импортируйте сейчас или пропустите и вернитесь в «Источники данных» позже.</string>
+    <string name="onboarding_import_history_body">Выгрузка WHOOP заполнит восстановление, нагрузку, сон и тренировки. Health Connect может добавить шаги, пульс, ВСР, сон и вес из источников Android.</string>
+    <string name="onboarding_notifications_subtitle">NOOP держит браслет подключённым в фоне. Продолжив, разрешите уведомления, чтобы он мог показывать эту связь и достучаться до вашего запястья.</string>
+    <string name="onboarding_notifications_status_body">NOOP держит Bluetooth-соединение открытым в фоне, чтобы данные оставались актуальными. Одно уведомление с низким приоритетом показывает, что связь есть. Ничего назойливого.</string>
+    <string name="onboarding_notifications_alerts">Оповещения на запястье (подсказки по нагрузке и умный будильник) тоже приходят как уведомления.</string>
+    <string name="onboarding_notifications_permission">Когда Android спросит, разрешите уведомления, чтобы NOOP мог держать вас в курсе.</string>
+    <string name="onboarding_appearance_subtitle">NOOP по умолчанию следует системе, либо выберите светлую или тёмную тему. Это можно изменить в любой момент в Настройках → Внешний вид.</string>
+    <string name="onboarding_system">Системная</string>
+    <string name="onboarding_theme_follow_system">Следует светлой/тёмной настройке вашего телефона.</string>
+    <string name="onboarding_theme_light_description">Глубокий синий акцент на тёплой бумаге.</string>
+    <string name="onboarding_theme_dark_description">Глубокий синий акцент на тёмном сине-сером полотне.</string>
+    <string name="recording_chip_title_recording">Запись</string>
+    <string name="recording_chip_title_last_synced">Синхронизировано %1$d мин назад</string>
+    <string name="recording_chip_title_not_recording">Запись не идёт</string>
+    <string name="recording_chip_title_connected">Подключено</string>
+    <string name="recording_chip_detail_recording">Ваш браслет подключён и сохраняет данные.</string>
+    <string name="recording_chip_detail_last_synced">Переподключитесь, чтобы получить последние данные.</string>
+    <string name="recording_chip_detail_not_recording">Браслет не подключён. Нажмите, чтобы подключить.</string>
+    <string name="recording_chip_detail_history_experimental">Синхронизация истории экспериментальна на 5.0.</string>
+    <string name="recording_chip_detail_connected_no_data">Пока нет ни пульса в реальном времени, ни синхронизированной истории в этой сессии.</string>
+    <string name="score_state_title_calibrating">Калибровка</string>
+    <string name="score_state_title_needs_strap">Нужен ремешок</string>
+    <string name="score_state_title_last_night">Прошлая ночь · %1$s</string>
+    <string name="score_state_title_latest_sleep">Последний сон · %1$s</string>
+    <string name="score_state_detail_needs_strap">Данных за сегодня нет. Был ли браслет надет и подключён ночью?</string>
+    <string name="score_state_detail_carried_fresh">Сегодняшний появится после того, как вы поспите в браслете.</string>
+    <string name="score_state_detail_carried_stale">Это ваш последний оценённый сеанс. Наденьте браслет на ночь, чтобы получить новую оценку.</string>
+    <string name="l10n_app_changelog_widgets_stop_inventing_numbers_naps_count_4f7491bb">Виджеты перестали выдумывать числа, дневной сон учитывается в недосыпе, а статусы на Android говорят на вашем языке</string>
+    <string name="l10n_sleep_screen_may_be_incomplete_7230dc27">Возможно, неполно</string>
+    <string name="l10n_sleep_screen_little_motion_was_recorded_over_f061b7e4">За ночь записано мало движения, поэтому эта ночь может быть определена не полностью, а общее время сна — заниженным. Убедитесь, что браслет полностью синхронизировался.</string>
+    <string name="l10n_sleep_screen_partly_recorded_f43509ab">Записано частично</string>
+    <string name="l10n_sleep_screen_only_of_this_night_s_window_9660332a">Только %1$d%% окна этой ночи имеет данные о стадиях. Итоги по стадиям охватывают лишь эту часть ночи.</string>
+    <string name="haptics_section_title">Вибрация</string>
+    <string name="haptics_breathing_label">Ритм дыхания</string>
+    <string name="haptics_intervals_label">Интервальный таймер</string>
+    <string name="haptics_live_session_label">Подсказки сессии в реальном времени</string>
+    <string name="haptics_workout_label">Начало и конец тренировки</string>
+    <string name="notif_timer_alarm_title">Таймер и будильник</string>
+    <string name="l10n_settings_screen_ecg_raw_data_gate_whoop_mg_only">Блокировка сырых данных ЭКГ (только WHOOP MG)</string>
+    <string name="l10n_settings_screen_ecg_gate_blurb">Ваш браслет перечислил собственные ключи конфигурации устройства, и один из них — enable_raw_data_w_ecg. На MG без подписки на ЭКГ он читается как «0» — при этом все три команды ЭКГ отвечают SUCCESS и не присылают никаких данных (#891). Это основная догадка о том, что держит ЭКГ закрытой. Никто не знает, даст ли переключение реальные данные ЭКГ: выяснить это и есть смысл, а «по-прежнему ничего» — полезный ответ, который стоит опубликовать в #891.</string>
+    <string name="l10n_settings_screen_ecg_gate_persistent_warning">Это записывает настройку, которая ОСТАЁТСЯ НА ВАШЕМ БРАСЛЕТЕ, пока вы не измените её обратно — это не настройка приложения, и закрытие NOOP её не отменит. «Выключить шлюз» снова записывает «0», в одно нажатие. Записывается только этот один ключ; остальные шесть, перечисленные браслетом, никогда не затрагиваются.</string>
+    <string name="l10n_settings_screen_ecg_gate_turn_on">Включить шлюз (записать «1»)</string>
+    <string name="l10n_settings_screen_ecg_gate_turn_off">Выключить шлюз (записать «0»)</string>
+    <string name="l10n_settings_screen_accent">Акцент</string>
+    <string name="l10n_settings_screen_preset">Пресет</string>
+    <string name="settings_language">Язык</string>
+    <string name="settings_choose_language">Выбрать язык</string>
+    <string name="settings_language_system">Системный</string>
+    <string name="settings_appearance_detail">Выберите светлую, тёмную тему или системную. Тёмная — фирменный почти чёрный вид; светлая сохраняет тот же чистый стиль на светлом фоне.</string>
+    <string name="settings_theme_light">Лёгкий</string>
+    <string name="settings_theme_dark">Тёмная</string>
+    <string name="settings_chart_default">По умолчанию</string>
+    <string name="settings_chart_classic">Классические</string>
+    <string name="settings_trend_line">Линия</string>
+    <string name="settings_trend_bars">Столбцы</string>
+    <string name="spo2_strap_estimate_caption">оценка браслета (не проверена)</string>
+    <string name="spo2_toggle_on_no_data">переключатель ВКЛ · оценки пока нет</string>
+    <string name="l10n_devices_screen_forget_device_d6eb6209">Забыть устройство…</string>
+    <string name="l10n_devices_screen_forget_device_926e503d">Забыть устройство</string>
+    <string name="l10n_devices_screen_forget_this_device_8dbbc3f3">Забыть это устройство?</string>
+    <string name="l10n_devices_screen_noop_removes_this_device_503aff9e">NOOP удаляет это устройство из вашего списка и стирает записанные здесь данные. Вы можете заново подключить ремешок, чтобы снова загрузить его недавнюю историю.</string>
+    <string name="l10n_backup_sync_screen_auto_backup_hasn_t_run_in_e3cd484e">Автоматическое резервное копирование не выполнялось несколько дней. Проверьте, доступна ли папка для копий — перемещённая или отключённая облачная папка тихо останавливает копирование.</string>
+    <string name="cycle_tracker_title">Отслеживание цикла</string>
+    <string name="cycle_tracker_current_estimate">Текущая оценка</string>
+    <string name="cycle_tracker_likely_window">Вероятное окно менструации: %1$s–%2$s. Это диапазон, а не точная дата.</string>
+    <string name="cycle_tracker_log_heading">Записать начало менструации</string>
+    <string name="cycle_tracker_already_logged">Уже записано</string>
+    <string name="cycle_tracker_log_action">Отметить начало цикла</string>
+    <string name="cycle_tracker_anchor_help">Эта необязательная дата отмечает первый день цикла и сверяется с вашим ночным температурным профилем.</string>
+    <string name="cycle_tracker_logged_starts">Записанные даты начала</string>
+    <string name="cycle_tracker_delete_all">Удалить всё</string>
+    <string name="cycle_tracker_empty">Даты начала менструации пока не записаны.</string>
+    <string name="cycle_tracker_delete_day">Удалить %1$s</string>
+    <string name="cycle_tracker_privacy">Эти данные покидают ваше устройство, только если вы сами экспортируете резервную копию.</string>
+    <string name="cycle_tracker_done">Готово</string>
+    <string name="cycle_tracker_delete_title">Удалить все зарегистрированные даты начала менструации?</string>
+    <string name="cycle_tracker_delete_message">Это навсегда удалит сохранённую на устройстве историю дат начала менструации. История показаний датчиков не изменится.</string>
+    <string name="cycle_tracker_cancel">Отмена</string>
+    <string name="cycle_tracker_day_single">~день %1$d</string>
+    <string name="cycle_tracker_day_range">~день %1$d–%2$d</string>
+    <string name="cycle_home_title">Менструальный цикл</string>
+    <string name="cycle_home_private">Конфиденциальное отслеживание на устройстве</string>
+    <string name="cycle_home_description">Записывайте даты начала менструации локально и используйте их для необязательных оценок цикла.</string>
+    <string name="cycle_home_latest">Последнее начало менструации</string>
+    <string name="cycle_home_learning">Изучаем ваш паттерн</string>
+    <string name="cycle_home_open">Открыть отслеживание</string>
+    <string name="cycle_home_setup">Настроить отслеживание цикла</string>
+    <string name="cycle_home_log_today">Записать сегодня</string>
+    <string name="cycle_home_logged_today">Записано сегодня</string>
+    <string name="cycle_phase_follicular">Фолликулярная</string>
+    <string name="cycle_phase_mid_cycle">Смещение середины цикла</string>
+    <string name="cycle_phase_luteal">Лютеиновая</string>
+    <string name="cycle_phase_unclear">Чёткой закономерности нет</string>
+    <string name="cycle_phase_learning">Изучаем ваш паттерн</string>
+    <string name="cycle_day_single">· ~день %1$d</string>
+    <string name="cycle_day_range">· ~день %1$d–%2$d</string>
+    <string name="skin_temp_missing_caption">Пока нет ночной температуры кожи — нужно ~4 ночи ношения (или импортируйте CSV из WHOOP)</string>
+    <string name="skin_temp_delta_title">Темп. кожи Δ</string>
+    <string name="skin_temp_vs_baseline">относит. исходного</string>
+    <string name="l10n_app_changelog_make_noop_yours_theme_colours_and_6bdef2a7">Сделайте NOOP своим — цвета темы и свои фоны, ещё сорок видов спорта с GPS-маршрутами и тепловая карта калорий</string>
+    <string name="l10n_settings_screen_custom_hr_zones_84736ca5">Свои зоны пульса</string>
+    <string name="l10n_settings_screen_custom_hr_zones_hint_f7fa3bae">Задайте пульс, с которого начинается каждая зона. Выключите, чтобы вернуть стандартные зоны в процентах от максимального пульса.</string>
+    <string name="l10n_settings_screen_zone_starts_a0a60d45">Зона %1$d начинается с</string>
+    <string name="l10n_health_screen_add_your_waist_for_a_more_accurate_vo_max_829f5e1e">Укажите обхват талии для более точного VO₂max</string>
+    <string name="l10n_health_screen_fix_in_settings_d7472915">Исправить в настройках</string>
+    <string name="l10n_app_changelog_personalized_heart_rate_zones_compare_and_8d89ee2a">Персональные зоны пульса, сравнение и переключение между браслетами и более честные данные ВСР, сна и Oura</string>
+    <string name="breath_presence_intro_title">Процесс Presence</string>
+    <string name="breath_presence_intro_body">Сознательно связанное дыхание (CCB): вдох и выдох в непрерывном цикле без задержки наверху или внизу. Найдите комфортный ритм — связность важнее интенсивности. Обычно около 15 минут дважды в день. Regular — устойчивый стартовый темп; Mid — более быстрый старт для следующих раундов; Punching Through — только чтобы продавить сонливость или застревание (не режим для новичков).</string>
+    <string name="breath_stage_belly_in">Живот внутрь</string>
+    <string name="breath_stage_belly_out">Живот наружу</string>
+    <string name="breath_stage_exhale_left">Выдох слева</string>
+    <string name="breath_stage_exhale_right">Выдох справа</string>
+    <string name="breath_stage_force_out">Вытолкни</string>
+    <string name="breath_stage_hold_empty">Задержка на пустых</string>
+    <string name="breath_stage_hold_full">Задержка на полных</string>
+    <string name="breath_stage_inhale_left">Вдох слева</string>
+    <string name="breath_stage_inhale_right">Вдох справа</string>
+    <string name="breath_proto_relax_4_6_title">Расслабление 4-6</string>
+    <string name="breath_proto_relax_4_6_subtitle">Долгий выдох · переход к отдыху</string>
+    <string name="breath_proto_relax_4_6_edu">Простой успокаивающий темп: вдох 4 секунды, выдох 6. Более длинный выдох часто даёт ощущение отдыха и пищеварения. Когда нужно мягко сбросить обороты без задержек.</string>
+    <string name="breath_proto_relax_4_6_session_hint">Попробуйте 5–10 минут.</string>
+    <string name="breath_proto_coherence_5_5_title">Когерентность 5,5</string>
+    <string name="breath_proto_coherence_5_5_subtitle">Равное дыхание · когерентность ~5,5 вд/мин</string>
+    <string name="breath_proto_coherence_5_5_edu">Равный вдох и выдох около 5,5 дыханий в минуту — обычная точка старта когерентности / резонанса. Стабильный сбалансированный темп, чтобы успокоить вариабельность ЧСС за сессию.</string>
+    <string name="breath_proto_coherence_5_5_session_hint">Попробуйте около 10 минут.</string>
+    <string name="breath_proto_box_4_4_4_4_subtitle">Квадратное дыхание · устойчивый фокус</string>
+    <string name="breath_proto_box_4_4_4_4_edu">Квадратное дыхание: вдох, задержка, выдох, задержка — по 4 секунды. Структурированный ритм для фокуса и успокоения при стрессе. Сядьте удобно и держите счёт ровным.</string>
+    <string name="breath_proto_box_4_4_4_4_session_hint">Около 5 минут за сессию; повторяйте по необходимости.</string>
+    <string name="breath_proto_deep_4_2_6_title">Глубокое дыхание</string>
+    <string name="breath_proto_deep_4_2_6_subtitle">Медленный вдох · мягкая задержка · длинный выдох</string>
+    <string name="breath_proto_deep_4_2_6_edu">Глубокое дыхание с короткой паузой: вдох 4 с, задержка 2 с, выдох 6 с. Носом когда можно, наполняйте лёгкие без силы и пусть более длинный выдох вас замедлит.</string>
+    <string name="breath_proto_deep_4_2_6_session_hint">5–10 минут в день — обычная точка старта.</string>
+    <string name="breath_proto_diaphragmatic_4_2_6_title">Диафрагмальное</string>
+    <string name="breath_proto_diaphragmatic_4_2_6_subtitle">Брюшное дыхание · мягкая пауза</string>
+    <string name="breath_proto_diaphragmatic_4_2_6_edu">Диафрагмальное (брюшное) дыхание: на вдохе расширяйте живот больше груди, опционально короткая задержка, затем мягко сокращайтесь на выдохе. Тот же тайминг 4–2–6, что у глубокого дыхания, внимание на диафрагму.</string>
+    <string name="breath_proto_diaphragmatic_4_2_6_session_hint">5–10 минут ежедневно.</string>
+    <string name="breath_proto_nadi_shodhana_title">Поочерёдные ноздри</string>
+    <string name="breath_proto_nadi_shodhana_subtitle">Nadi Shodhana · цикл лев/прав</string>
+    <string name="breath_proto_nadi_shodhana_edu">Дыхание поочерёдными ноздрями: вдох слева, задержка, выдох справа, вдох справа, задержка, выдох слева — около 4 с на шаг. Мягко закрывайте одну ноздрю пальцем. Подписи подсказывают сторону; спокойный темп.</string>
+    <string name="breath_proto_nadi_shodhana_session_hint">5–10 минут.</string>
+    <string name="breath_proto_four_seven_eight_subtitle">Вдох 4 · задержка 7 · выдох 8</string>
+    <string name="breath_proto_four_seven_eight_edu">Классика 4-7-8: тихий носовой вдох 4, задержка 7, длинный выдох ртом 8. Часто для замедления. Начните с нескольких циклов; остановитесь при лёгкой голове.</string>
+    <string name="breath_proto_four_seven_eight_session_hint">Хватит нескольких минут; наращивайте постепенно.</string>
+    <string name="breath_proto_four_seven_eight_caution">При головокружении или дискомфорте остановитесь и дышите обычно.</string>
+    <string name="breath_proto_buteyko_title">Бутейко</string>
+    <string name="breath_proto_buteyko_subtitle">Мягко носом · лёгкий воздушный голод</string>
+    <string name="breath_proto_buteyko_edu">Сниженное дыхание в стиле Бутейко: небольшой носовой вдох (~2,5 с), расслабленный носовой выдох (~3,5 с), короткая комфортная задержка (~3,5 с). Тихо и легко — без большого вдоха.</string>
+    <string name="breath_proto_buteyko_session_hint">3–20 минут, по самочувствию.</string>
+    <string name="breath_proto_buteyko_caution">Оставайтесь в комфортном диапазоне; никогда не форсируйте задержки.</string>
+    <string name="breath_proto_tummo_title">Туммо</string>
+    <string name="breath_proto_tummo_subtitle">Форсированный выдох · задержки · медленно in/out</string>
+    <string name="breath_proto_tummo_edu">Цикл в духе Tummo со средними таймингами: короткий форсированный выдох, задержка на пустых, медленный вдох, задержка на полных, медленный выдох. Продвинуто и интенсивно — держите сессии короткими и останавливайтесь при перенапряжении.</string>
+    <string name="breath_proto_tummo_session_hint">5–10 минут, если нет опыта.</string>
+    <string name="breath_proto_tummo_caution">Продвинутый уровень. Избегайте при беременности, сердечно-сосудистых проблемах или недомогании. Не медицинский совет.</string>
+    <string name="breath_proto_ujjayi_title">Удджайи</string>
+    <string name="breath_proto_ujjayi_subtitle">Океанское дыхание · мягкое горло</string>
+    <string name="breath_proto_ujjayi_edu">Дыхание Удджайи (океан): слегка сузьте горло, чтобы дыхание звучало как далёкие волны. Равный медленный носовой вдох и выдох (~по 4,5 с).</string>
+    <string name="breath_proto_ujjayi_session_hint">5–15 минут.</string>
+    <string name="breath_proto_bhastrika_subtitle">Сильно 1 с in · 1 с out</string>
+    <string name="breath_proto_bhastrika_edu">Bhastrika (меха): форсированный 1-секундный носовой вдох и выдох. Энергично и интенсивно. Держите раунды короткими и отдыхайте между ними.</string>
+    <string name="breath_proto_bhastrika_session_hint">Только короткие подходы.</string>
+    <string name="breath_proto_bhastrika_caution">Остановитесь при головокружении. Избегайте при гипертонии, беременности или недавней операции без допуска врача.</string>
+    <string name="breath_proto_qigong_title">Дыхание Цигун</string>
+    <string name="breath_proto_qigong_subtitle">Медленно in · мягкие задержки · медленно out</string>
+    <string name="breath_proto_qigong_edu">Мягкий темп в стиле Цигун: вдох ~4,5 с, опционально короткая задержка, выдох ~4,5 с, опционально короткая задержка. Мягкий фокус на живот; без силы.</string>
+    <string name="breath_proto_qigong_session_hint">Традиционно 15–30 минут; начните короче.</string>
+    <string name="breath_proto_soma_subtitle">2 с in · 2 с out · ритмично</string>
+    <string name="breath_proto_soma_edu">Простой ритмично-связный темп: 2 секунды in и 2 out — когда нужен ровный «музыкальный» цикл без задержек.</string>
+    <string name="breath_proto_soma_session_hint">Часто 20+ минут; выберите удобную длительность.</string>
+    <string name="breath_proto_buteyko_reduced_title">Бутейко сниженный</string>
+    <string name="breath_proto_buteyko_reduced_subtitle">Легче · дольше мягкая задержка</string>
+    <string name="breath_proto_buteyko_reduced_edu">Сниженный стиль Бутейко: ~2 с мягкий вдох, ~3 с выдох, затем 3–5 с задержки с лишь лёгким воздушным голодом. Лицо и плечи расслаблены.</string>
+    <string name="breath_proto_buteyko_reduced_session_hint">15–20 минут, если комфортно.</string>
+    <string name="breath_proto_buteyko_reduced_caution">Никогда не доводите до паники или сильного воздушного голода.</string>
+    <string name="breath_proto_coherent_6_6_title">Когерентное 6-6</string>
+    <string name="breath_proto_coherent_6_6_subtitle">6 с in · 6 с out · ~5 br/min</string>
+    <string name="breath_proto_coherent_6_6_edu">Когерентное дыхание: шесть секунд in и шесть out (~5 дыханий в минуту). Медленный равный темп для спокойствия и HRV-дружественного ритма — только оценка, не клиническое чтение.</string>
+    <string name="breath_proto_coherent_6_6_session_hint">Начните примерно с 10 минут.</string>
+    <string name="breath_proto_kapalabhati_title">Капалабхати</string>
+    <string name="breath_proto_kapalabhati_subtitle">С подсказками · быстрые импульсы живота</string>
+    <string name="breath_proto_kapalabhati_edu">Капалабхати — быстрые активные брюшные выдохи с пассивными вдохами. Тайминг индивидуален — режим даёт только таймер и текст-коучинг, не принудительный метроном. Сидя, короткие раунды, отдых между ними.</string>
+    <string name="breath_proto_kapalabhati_session_hint">Короткие подходы (около 30–60 с) с отдыхом.</string>
+    <string name="breath_proto_kapalabhati_caution">Пропустите при беременности, головокружении или неконтролируемой гипертонии. Остановитесь при перенапряжении.</string>
+    <string name="breath_proto_holotropic_title">Холотропное</string>
+    <string name="breath_proto_holotropic_subtitle">С подсказками · непрерывное связанное</string>
+    <string name="breath_proto_holotropic_edu">Холотропная работа непрерывна, часто быстрое связное дыхание в поддерживаемой среде. NOOP даёт только таймер и обучение — не автопейсер — потому что интенсивность сильно разнится и обычно фасилитируется.</string>
+    <string name="breath_proto_holotropic_session_hint">Традиционные сессии длинные; здесь короткий таймер только как check-in.</string>
+    <string name="breath_proto_holotropic_caution">Не для DIY высокой интенсивности при травматическом опыте, сердечно-сосудистых проблемах или беременности без профсопровождения.</string>
+    <string name="breath_proto_wim_hof_title">Метод Вима Хофа</string>
+    <string name="breath_proto_wim_hof_subtitle">С подсказками · раунды + задержки</string>
+    <string name="breath_proto_wim_hof_edu">Раунды в стиле Wim Hof обычно ~30 более глубоких дыханий, затем задержка на пустых, затем задержка восстановительного вдоха (~15 с). Так как задержки и интенсивность личные, эта запись guided: следуйте знакомому доверенному протоколу; NOOP считает время и показывает напоминания — не форсирует задержки.</string>
+    <string name="breath_proto_wim_hof_session_hint">Около 15 минут на несколько подходов.</string>
+    <string name="breath_proto_wim_hof_caution">Никогда не практикуйте в воде или за рулём. Остановитесь при головокружении. Не медицинский совет.</string>
+    <string name="breath_proto_shamanic_title">Шаманское дыхание</string>
+    <string name="breath_proto_shamanic_subtitle">С подсказками · ритмично-быстро</string>
+    <string name="breath_proto_shamanic_edu">Шаманское ритмичное дыхание зависит от контекста и часто фасилитируется. Используйте как тихий таймер с обучением — задайте свою безопасную интенсивность.</string>
+    <string name="breath_proto_shamanic_session_hint">Выберите длительность, которая ощущается безопасной.</string>
+    <string name="breath_proto_shamanic_caution">Для интенсивной практики предпочитайте ведомые форматы.</string>
+    <string name="breath_proto_presence_regular_title">Presence Обычный</string>
+    <string name="breath_proto_presence_regular_subtitle">CCB · ~3,8 с / 3,8 с · ~7,8 br/min</string>
+    <string name="breath_proto_presence_regular_edu">Темп Regular (~3,8 с in / 3,8 с out) — устойчивый темп по умолчанию для первого прохода и для полных 15 минут.</string>
+    <string name="breath_proto_presence_regular_session_hint">15 минут дважды в день (рамка Presence Process).</string>
+    <string name="breath_proto_presence_mid_title">Presence Средний</string>
+    <string name="breath_proto_presence_mid_subtitle">CCB · ~2,4 с / 2,4 с · ~12,4 br/min</string>
+    <string name="breath_proto_presence_mid_edu">Средний темп (~2,4 с / 2,4 с) — стартовый ритм для следующих проходов; когда успокоитесь, можно замедлиться и углубить дыхание или перейти к Punching Through.</string>
+    <string name="breath_proto_presence_mid_session_hint">15 минут, когда Mid — ваш стартовый темп.</string>
+    <string name="breath_proto_presence_punching_title">Presence · Punching</string>
+    <string name="breath_proto_presence_punching_subtitle">CCB · ~1,9 с / 1,9 с · продавить</string>
+    <string name="breath_proto_presence_punching_edu">Punching Through (~1,9 с / 1,9 с) — при сонливости или застревании, не стартовый режим. Когда вы «внутри», можно вернуться к более медленному и глубокому связному дыханию.</string>
+    <string name="breath_proto_presence_punching_session_hint">До 15 минут; снизьте темп при напряжении.</string>
+    <string name="breath_proto_presence_punching_caution">Не рекомендуется как старт для новичков, если цель не в том, чтобы продавить сонливость.</string>
+    <string name="l10n_breathe_screen_calm_me_a1b2c3d4">Успокоить меня</string>
+    <string name="today_section_hero">Заряд / Усилие / Отдых</string>
+    <string name="today_section_live_session">Начать сессию</string>
+    <string name="today_section_synthesis">Синтез</string>
+    <string name="today_section_key_metrics">Ключевые показатели</string>
+    <string name="today_section_workouts">Тренировки</string>
+    <string name="today_section_heart_rate">Пульс</string>
+    <string name="today_section_recovery_vitals">ПОКАЗАТЕЛИ ВОССТАНОВЛЕНИЯ</string>
+    <string name="today_section_your_cards">ВАШИ КАРТОЧКИ</string>
+    <string name="today_section_menstrual_cycle">Менструальный цикл</string>
+    <string name="today_section_journal">Журнал</string>
+    <string name="today_section_added_cards">Добавленные карточки</string>
+    <string name="today_hr_window_today">Сегодня</string>
+    <string name="today_hr_window_24h">24ч</string>
+    <string name="today_hr_window_12h">12ч</string>
+    <string name="today_hr_window_6h">6ч</string>
+    <string name="today_hr_window_3h">3ч</string>
+    <string name="today_hr_window_1h">1ч</string>
+    <string name="today_weight_latest">последнее</string>
+    <string name="today_weight_from_profile">из профиля</string>
+    <string name="today_source_on_device">На устройстве</string>
+    <string name="vo2max_method_nes">На устройстве · Nes 2011</string>
+    <string name="vo2max_method_uth">На устройстве · Uth 2004</string>
+    <string name="vo2max_method_unknown">На устройстве · метод неизвестен</string>
+    <string name="today_source_nutrition">Питание</string>
+    <string name="today_source_cached">Em cache</string>
+    <string name="today_source_apple_watch">APPLE WATCH</string>
+    <string name="today_source_workout_files">Ficheiros de treino</string>
+    <string name="today_readiness_push">Вперёд</string>
+    <string name="today_readiness_maintain">Поддерживать</string>
+    <string name="today_readiness_rest">Отдых</string>
+    <string name="today_no_sources_yet">Источников пока нет</string>
+    <string name="today_synced_from">Синхронизировано из: %1$s</string>
+    <string name="today_calibration_restart_cause">Перезапущено, когда вы откалибровали заново %1$s — повторно нажимать не нужно.</string>
+    <string name="today_building_wear_tonight">Формируется, наденьте на ночь</string>
+    <string name="today_building_moves_with_you">Формируется, меняется с активностью</string>
+    <string name="today_how_score_named">Как вычисляется %1$s</string>
+    <string name="today_how_score_generic">Как рассчитывается этот показатель</string>
+    <string name="today_strap_battery">Батарея браслета</string>
+    <string name="today_strap_battery_percent">Заряд браслета %1$d процентов</string>
+    <string name="today_score_solid">Стабильный</string>
+    <string name="today_charge_carried">Заряд · %1$s</string>
+    <string name="today_recovery_carried">Восстановление · %1$s</string>
+    <string name="today_show_fewer_metrics">Показать меньше</string>
+    <string name="today_show_all_metrics">Показать все метрики (%1$d)</string>
+    <string name="today_hr_empty_selected_day">Нет пульса за этот день. Вернитесь к дню, когда браслет был надет.</string>
+    <string name="today_hr_empty_window">Нет пульса за последние %1$s. Попробуйте более широкое окно или «Сегодня».</string>
+    <string name="today_hr_calibrating">Калибровка, пульс за сегодня ещё не накоплен. Ваша кривая заполнится по мере выгрузки с браслета.</string>
+    <string name="today_hr_average_last_window">5-минутное среднее | последние %1$s</string>
+    <string name="today_hr_zoomed_hint">Увеличено · перетащите для панорамирования</string>
+    <string name="today_not_connected">Не подключено</string>
+    <string name="today_should_you_push">Стоит ли сегодня выкладываться?</string>
+    <string name="today_training_read_explanation">Тренировочный показатель, отдельный от вашего показателя Charge.</string>
+    <string name="today_auto_workout_prompt_today">Похоже на тренировку примерно %1$s–%2$s (средний пульс %3$d, %4$d мин). Сохранить?</string>
+    <string name="today_auto_workout_prompt_yesterday">Похоже на тренировку вчера примерно %1$s–%2$s (средний пульс %3$d, %4$d мин). Сохранить?</string>
+    <string name="today_auto_workout_prompt_date">Похоже на тренировку %1$s примерно %2$s–%3$s (средний пульс %4$d, %5$d мин). Сохранить?</string>
+    <string name="today_card_hrv">ВСР</string>
+    <string name="today_card_hrv_subtitle">Вариабельность сердечного ритма</string>
+    <string name="today_card_resting_hr">Пульс в покое</string>
+    <string name="today_card_resting_hr_subtitle">Пульс в покое</string>
+    <string name="today_card_respiratory">Дыхание</string>
+    <string name="today_card_respiratory_subtitle">Вдохов в минуту</string>
+    <string name="today_card_blood_oxygen">Кислород в крови</string>
+    <string name="today_card_blood_oxygen_subtitle">Кислород в крови</string>
+    <string name="today_card_skin_temp">Темп. кожи</string>
+    <string name="today_card_skin_temp_subtitle">Температура кожи</string>
+    <string name="today_card_sleep">Сон</string>
+    <string name="today_card_sleep_subtitle">Последняя ночь</string>
+    <string name="today_card_steps">Шаги</string>
+    <string name="today_card_steps_subtitle">Сегодня</string>
+    <string name="today_card_calories">Калории</string>
+    <string name="today_card_calories_subtitle">Активная энергия</string>
+    <string name="today_card_stress">Стресс</string>
+    <string name="today_card_stress_subtitle">Вегетативная нагрузка</string>
+    <string name="today_card_fitness_age">Фитнес-возраст</string>
+    <string name="today_card_fitness_age_subtitle">Обновляется еженедельно</string>
+    <string name="today_card_vo2max">VO₂ макс.</string>
+    <string name="today_card_vo2max_subtitle">Оценка, обновляется еженедельно</string>
+    <string name="today_card_vitality">Жизненная энергия</string>
+    <string name="today_card_vitality_subtitle">Оценка благополучия</string>
+    <string name="today_card_hydration">Гидратация</string>
+    <string name="today_card_hydration_subtitle">Жидкость за сегодня</string>
+    <string name="today_card_coupled">Совмещённый вид</string>
+    <string name="today_card_coupled_subtitle">Восстановление, нагрузка и сон одним взглядом</string>
+    <string name="today_metric_charge">Заряд</string>
+    <string name="today_metric_effort">Усилие</string>
+    <string name="today_metric_rest">Отдых</string>
+    <string name="today_metric_hrv">ВСР</string>
+    <string name="today_metric_resting_hr">Пульс в покое</string>
+    <string name="today_metric_blood_oxygen">Кислород в крови</string>
+    <string name="today_metric_respiratory">Дыхание</string>
+    <string name="today_metric_steps">Шаги</string>
+    <string name="today_metric_weight">Вес</string>
+    <string name="today_metric_calories">Калории</string>
+    <string name="today_readiness_title">Готовность</string>
+    <string name="today_readiness_wear_for_nights">Поносите браслет несколько ночей, и ваш показатель готовности появится здесь.</string>
+    <string name="today_readiness_signal_hrv">ВСР</string>
+    <string name="today_readiness_hrv_good">выше вашей нормы — хорошо восстановились</string>
+    <string name="today_readiness_normal_range">в пределах вашей нормы</string>
+    <string name="today_readiness_hrv_watch">немного ниже нормы</string>
+    <string name="today_readiness_hrv_bad">подавлено - признак вегетативной усталости</string>
+    <string name="today_readiness_signal_resting_hr">Пульс в покое</string>
+    <string name="today_readiness_rhr_good">на уровне нормы или ниже</string>
+    <string name="today_readiness_rhr_watch">немного выше нормы</string>
+    <string name="today_readiness_rhr_bad">повышено - причиной может быть перетренированность или болезнь</string>
+    <string name="today_readiness_signal_respiratory">Дыхание</string>
+    <string name="today_readiness_resp_bad">выше нормы - иногда ранний признак болезни</string>
+    <string name="today_readiness_resp_watch">слегка повышено относительно нормы</string>
+    <string name="today_readiness_signal_training_variety">Разнообразие тренировок</string>
+    <string name="today_readiness_monotony_watch">низкая - одинаковая нагрузка изо дня в день повышает риск избыточной нагрузки или болезни</string>
+    <string name="today_readiness_signal_training_load">Тренировочная нагрузка</string>
+    <string name="today_readiness_load_ramping_down">снижается (острая:хроническая %1$s) — есть запас для роста</string>
+    <string name="today_readiness_load_sweet_spot">в оптимальной зоне (острая:хроническая %1$s)</string>
+    <string name="today_readiness_load_building_fast">быстро растёт (острая:хроническая %1$s) — следите за усталостью</string>
+    <string name="today_readiness_load_spiking">резкий скачок (острая:хроническая %1$s) — выше риск травмы</string>
+    <string name="today_readiness_more_nights">Ещё несколько ночей данных — и оценка готовности станет точнее.</string>
+    <string name="today_readiness_run_down">Истощён</string>
+    <string name="today_readiness_run_down_summary">Сразу несколько показателей снижены. Считайте сегодняшний день восстановительным — лёгкая активность и полноценный сон этой ночью.</string>
+    <string name="today_readiness_strained">Напряжённый</string>
+    <string name="today_readiness_strained_summary">Один из ваших сигналов вызывает тревогу. Можно тренироваться, но держите нагрузку под контролем и дайте организму восстановиться.</string>
+    <string name="today_readiness_primed">Готов</string>
+    <string name="today_readiness_primed_summary">Ваши сигналы согласованы, и нагрузка поддержана. Сегодня более тяжёлая тренировка хорошо обоснована.</string>
+    <string name="today_readiness_balanced">Сбалансировано</string>
+    <string name="today_readiness_balanced_summary">Ничего не настораживает. Тренируйтесь по самочувствию — организм держится стабильно.</string>
+    <string name="today_action_change_day">Сменить день</string>
+    <string name="today_action_collapse">Свернуть</string>
+    <string name="today_action_expand_full_read">Разверните для полной информации</string>
+    <string name="today_action_full_readiness">Посмотреть полную готовность</string>
+    <string name="today_action_hide_sources">Скрыть подробности об источниках данных</string>
+    <string name="today_action_how_charge">Как рассчитывается Заряд</string>
+    <string name="today_action_reset_hr_zoom">Сбросить масштаб пульса</string>
+    <string name="today_action_see_what_shaped">Посмотреть, что сформировало ваш показатель %1$s</string>
+    <string name="today_action_show_sources">Показать, откуда синхронизируется NOOP</string>
+    <string name="today_action_show_workout">Показать детали тренировки</string>
+    <string name="today_contributors">Участники</string>
+    <string name="today_data_sources">Источники данных</string>
+    <string name="today_hr_beats_per_minute">Ударов в минуту</string>
+    <string name="today_no_data">Нет данных</string>
+    <string name="today_provenance">Источник данных</string>
+    <string name="today_readiness_evidence_load">7 дн %1$s / 28 дн %2$s</string>
+    <string name="today_readiness_evidence_metric">%1$s против %2$s %3$s</string>
+    <string name="today_readiness_evidence_monotony">монотонность %1$s</string>
+    <string name="today_steps_calibrated_detail">k=%1$s по %2$d дням, достоверность %3$s</string>
+    <string name="today_steps_calibrating_detail">Калибровка: %1$d из %2$d дней</string>
+    <string name="today_steps_confidence_high">высокий</string>
+    <string name="today_steps_confidence_low">низкий</string>
+    <string name="today_steps_confidence_medium">СРЕДНИЙ</string>
+    <string name="today_steps_estimated_detail">оценка · %1$s</string>
+    <string name="today_steps_estimated_short">оцен.</string>
+    <string name="today_steps_manual_coefficient">ручной k=%1$s</string>
+    <string name="today_synthesis_charge_low">Заряд низкий.</string>
+    <string name="today_synthesis_charge_low_sleep_consistent">Заряд низкий, при этом сон был стабильным.</string>
+    <string name="today_synthesis_charge_low_sleep_short">Заряд низкий, и сна было мало.</string>
+    <string name="today_synthesis_charge_steady">Заряд стабильный.</string>
+    <string name="today_synthesis_charge_steady_sleep_consistent">Заряд стабильный, сон был стабильным.</string>
+    <string name="today_synthesis_charge_steady_sleep_short">Заряд стабильный, но сна было мало.</string>
+    <string name="today_synthesis_charge_strong">Заряд высокий.</string>
+    <string name="today_synthesis_charge_strong_sleep_consistent">Заряд высокий, сон был стабильным.</string>
+    <string name="today_synthesis_charge_strong_sleep_short">Заряд высокий, но сна было мало.</string>
+    <string name="today_synthesis_depleted">Истощён</string>
+    <string name="today_synthesis_low">Низкий</string>
+    <string name="today_synthesis_no_metrics">Показателей пока нет. Импортируйте экспорт из Whoop или наденьте браслет, чтобы начать.</string>
+    <string name="today_synthesis_peak">Пик</string>
+    <string name="today_synthesis_steady">Стабильно</string>
+    <string name="today_synthesis_strong">Сильный</string>
+    <string name="today_unit_bpm">уд/мин</string>
+    <string name="today_unit_ms">мс</string>
+    <string name="today_unit_rpm">об/мин</string>
+    <string name="today_vs_your_baseline">относительно вашей нормы</string>
+    <string name="today_what_drove_charge">Что повлияло на Заряд</string>
+    <string name="today_what_shaped_it">Что на это повлияло</string>
+    <string name="today_workouts_14_days">14 дней</string>
+    <string name="today_workouts_activity">Активность</string>
+    <string name="today_steps_headline_manual">Откалибровано вручную</string>
+    <string name="today_steps_headline_calibrated">Оценка по %1$d дням, когда ваш телефон тоже считал</string>
+    <string name="today_steps_headline_connect_phone">Подключите счётчик шагов телефона, чтобы оценивать шаги</string>
+    <string name="today_steps_headline_more_days">Нужно ещё %1$d дней, когда ваш телефон тоже считал шаги</string>
+    <string name="today_synthesis_learning_baseline">Изучаем вашу норму, %1$d из %2$d ночей.</string>
+    <string name="today_last_night_date">Прошлая ночь · %1$s</string>
+    <string name="today_hr_min">Мин.</string>
+    <string name="today_hr_avg">Сред.</string>
+    <string name="today_hr_max">Макс.</string>
+    <string name="today_source_counting">Подсчёт…</string>
+    <string name="today_source_counts">%1$s дней · %2$s тренировок</string>
+    <string name="today_day_with_date">Сегодня · %1$s</string>
+    <string name="today_yesterday_with_date">Вчера · %1$s</string>
+    <string name="today_day_today">Сегодня</string>
+    <string name="today_day_yesterday">Вчера</string>
+    <string name="today_update_building_baseline_title">Формирование нормы</string>
+    <string name="today_update_building_baseline_message">Заряд, Усилие и Отдых становятся персональными через несколько ночей ношения.</string>
+    <string name="today_update_scores_building_title">Данные поступают в реальном времени. Ваши показатели формируются.</string>
+    <string name="today_update_scores_building_message">Заряд, Усилие и Отдых формируются в течение следующих нескольких ночей ношения.</string>
+    <string name="today_pending_scores_body">Пульс в реальном времени уже поступает с браслета. Восстановление, нагрузка и сон будут формироваться на его основе в течение следующих нескольких ночей и уточняться по мере определения вашей нормы. Хотите сразу получить всю историю? Импортируйте данные WHOOP в разделе «Источники данных», история заполнится примерно за минуту.</string>
+    <string name="today_live_session_running">Сессия идёт</string>
+    <string name="today_live_session_ended">Сессия завершена</string>
+    <string name="today_live_session_start">Начать сессию</string>
+    <string name="today_live_session_guarding">Наблюдение — тишина означает, что вы в графике.</string>
+    <string name="today_live_session_summary">Посмотреть сводку последней сессии.</string>
+    <string name="today_live_session_explanation">Сессия усилия под контролем браслета. Вибрация только когда вы выходите за сегодняшнюю полосу.</string>
+    <string name="today_beta">БЕТА</string>
+    <string name="today_sleep_source_last_night">%1$s · прошлая ночь</string>
+    <string name="today_dashboard_editor_description">Выберите, какие карточки показывать на «Сегодня». Карточки без значения показывают прочерк.</string>
+    <string name="today_charge_driver_guidance">Каждая строка показывает, на сколько пунктов этот сигнал сдвинул Заряд относительно вашей нормы на устройстве. Приблизительно, не медицинская рекомендация.</string>
+    <string name="today_confidence_solid">Стабильный</string>
+    <string name="today_confidence_building">Накопление данных</string>
+    <string name="today_confidence_calibrating">КАЛИБРОВКА</string>
+    <string name="today_hr_average_selected_day">5-минутное среднее | выбранный день</string>
+    <string name="today_hr_average_since_midnight">5-минутное среднее | с полуночи</string>
+    <string name="today_hr_a11y_24_hour">Пульс за 24 часа</string>
+    <string name="today_hr_a11y_sleep_band">полоса сна %1$s</string>
+    <string name="today_hr_a11y_charge_at_wake">%1$d процентов Заряда при пробуждении</string>
+    <string name="today_hr_a11y_effort_now">Усилие сейчас: %1$s</string>
+    <string name="today_steps_activity_still">Неподвижность</string>
+    <string name="today_steps_activity_walking">Ходьба</string>
+    <string name="today_steps_activity_running">Бег</string>
+    <string name="today_greeting_morning">Доброе утро</string>
+    <string name="today_greeting_afternoon">Добрый день</string>
+    <string name="today_greeting_evening">Добрый вечер</string>
+    <string name="today_calibrating">Калибровка</string>
+    <string name="today_trend_7_days">Тренд за 7 дней</string>
+    <string name="today_trend_14_days">Тренд за 14 дней</string>
+    <string name="today_trend_30_days">Тренд за 30 дней</string>
+    <string name="today_range_1_week">1 неделя</string>
+    <string name="today_range_2_weeks">2 недели</string>
+    <string name="today_range_1_month">1 месяц</string>
+    <string name="today_driver_hrv">Вариабельность сердечного ритма</string>
+    <string name="today_driver_resting_hr">Пульс в покое</string>
+    <string name="today_driver_sleep_quality">Качество сна</string>
+    <string name="today_driver_respiratory">Частота дыхания</string>
+    <string name="today_driver_skin_temperature">Температура кожи</string>
+    <string name="today_driver_value_ms">%1$d мс</string>
+    <string name="today_driver_value_bpm">%1$d уд/мин</string>
+    <string name="today_driver_value_br_min">%1$s вд/мин</string>
+    <string name="today_driver_value_temp_deviation">%1$s °C относительно нормы</string>
+    <string name="today_driver_baseline_ms">норма %1$d мс</string>
+    <string name="today_driver_baseline_bpm">норма %1$d уд/мин</string>
+    <string name="today_driver_baseline_br_min">норма %1$s вд/мин</string>
+    <string name="today_driver_above_supporting">выше нормы, поддерживает восстановление</string>
+    <string name="today_driver_below_supporting">ниже нормы, поддерживает восстановление</string>
+    <string name="today_driver_above_limiting">выше нормы, ограничивает восстановление</string>
+    <string name="today_driver_below_limiting">ниже нормы, ограничивает восстановление</string>
+    <string name="today_driver_at_baseline">на уровне нормы</string>
+    <string name="today_driver_hrv_saturation">ниже нормы, ограничивает восстановление, однако низкий пульс в покое указывает, что причиной может быть парасимпатическое насыщение, а не усталость</string>
+    <string name="today_driver_strong_night">сильная ночь, поддерживающая восстановление</string>
+    <string name="today_driver_below_good_night">ниже хорошей ночи, ограничивает восстановление</string>
+    <string name="today_driver_typical_night">типичная ночь</string>
+    <string name="today_driver_near_baseline">около нормы</string>
+    <string name="today_driver_warmer_limiting">теплее нормы, что ограничивает восстановление</string>
+    <string name="today_driver_cooler_limiting">холоднее нормы, ограничивает восстановление</string>
+    <string name="today_driver_a11y">%1$s, %2$s, %3$s, %4$s пунктов, %5$s</string>
+    <string name="scoring_guide_daily_scores">ВАШИ ЕЖЕДНЕВНЫЕ ПОКАЗАТЕЛИ</string>
+    <string name="scoring_guide_three_scores">ТРИ ПОКАЗАТЕЛЯ</string>
+    <string name="scoring_guide_intro_body">NOOP даёт три ежедневные оценки: Заряд, Усилие и Отдых, каждая от 0 до 100. Они вычисляются на вашем устройстве по сигналам браслета и опубликованной спортивной науке. Это независимые приближения, а не закрытые оценки WHOOP, поэтому направление может совпадать, а числа — отличаться.</string>
+    <string name="scoring_guide_charge_headline">Заряд: насколько вы восстановились?</string>
+    <string name="scoring_guide_charge_body">Заряд ведёт ВСР в сравнении с вашей личной нормой, плюс пульс в покое, Отдых за прошлую ночь, частота дыхания и температура кожи. Более высокая ВСР означает больше Заряда. NOOP нужно несколько ночей, чтобы выучить вашу норму; до тех пор он показывает «Калибровка».</string>
+    <string name="scoring_guide_charge_vs_whoop">Идея похожа на Recovery % у WHOOP, но наши веса и расчёт нормы независимы и открыто задокументированы.</string>
+    <string name="scoring_guide_effort_headline">Усилие: насколько интенсивно работало ваше сердце?</string>
+    <string name="scoring_guide_effort_body">Усилие измеряет сердечно-сосудистую нагрузку. Пульс переводится в тренировочный импульс по зонам резерва пульса, где более тяжёлые зоны весят больше, а затем отображается на логарифмическую шкалу 0–100. Шаги и активная энергия задают нижнюю границу для длительной активности с малой кардионагрузкой.</string>
+    <string name="scoring_guide_effort_vs_whoop">Идея похожа на Day Strain у WHOOP (0–21), пересчитанный в 0–100. Сотня остаётся такой же редкой, как 21,0.</string>
+    <string name="scoring_guide_rest_headline">Отдых: насколько восстанавливающим был ваш сон?</string>
+    <string name="scoring_guide_rest_body">Отдых объединяет длительность сна относительно вашей потребности, эффективность сна, восстанавливающие глубокий сон и REM, а также постоянство времени засыпания и подъёма.</string>
+    <string name="scoring_guide_rest_vs_whoop">Идея похожа на Sleep Performance % у WHOOP, но наш расчёт независим.</string>
+    <string name="scoring_guide_solid">Стабильный</string>
+    <string name="scoring_guide_building">Накопление данных</string>
+    <string name="scoring_guide_confidence_body">У каждой оценки показана её надёжность. «Калибровка» означает, что NOOP изучает вашу норму или ему нужно больше данных. «Формируется» означает, что данных хватает для оценки, но она пока ограничена. «Надёжно» означает, что все входные данные на месте. Если NOOP не может надёжно вычислить оценку, он не показывает её вместо того, чтобы гадать.</string>
+    <string name="trends_training_load">Тренировочная нагрузка</string>
+    <string name="trends_tl_legend_ctl">CTL · Форма</string>
+    <string name="trends_tl_legend_atl">ATL · Усталость</string>
+    <string name="trends_tl_established">42-дневная форма против 7-дневной усталости</string>
+    <string name="trends_tl_building">Формируется — %1$d из %2$d дней</string>
+    <string name="trends_tl_unavailable">Хроническая против острой нагрузки</string>
+    <string name="trends_tl_needs">Нужно %1$d+ подряд дней с Усилием, чтобы начать. Пока %2$d.</string>
+    <string name="trends_tl_form">Форма</string>
+    <string name="sleep_delete_user_edited_body">Удаляет этот сон и пересчитывает день без него. Несколько секунд после можно отменить.</string>
+    <string name="sleep_delete_recorded_body">Удаляет этот записанный сон и пересчитывает день без него. NOOP не будет заново определять сон в этом окне. Несколько секунд после можно отменить.</string>
+    <string name="settings_waist_footnote_unset">Необязательно · VO₂max строится примерно по 4 ночам пульса; обхват талии делает его точнее. Самому фитнес-возрасту он не нужен. Измеряйте вокруг талии, на уровне пупка.</string>
+    <string name="settings_waist_footnote_set">Ваш VO₂max использует обхват талии для более точной оценки</string>
+    <string name="power_saving_low_refresh">Редкое обновление</string>
+    <string name="power_saving_low_refresh_desc">Синхронизировать в фоне раз в час вместо каждых 15 минут, независимо от заряда браслета — меньше переподключений даёт наибольшую экономию на WHOOP 4.0. Ничего не теряется: браслет всё накапливает и отдаёт большими порциями. Синхронизация жестом по-прежнему работает сразу, а живой пульс не затрагивается.</string>
+    <string name="nav_power_saving">Энергосбережение</string>
+    <string name="l10n_app_changelog_training_load_a_vo_max_without_f9205a67">Тренировочная нагрузка, VO₂max без сантиметровой ленты и намного меньше батареи на пересчёты</string>
+    <string name="l10n_sleep_screen_sleep_outside_the_new_times_was_6229881e">Сон вне нового интервала удалён. NOOP не определит его снова.</string>
+    <string name="workout_action_pause">Пауза</string>
+    <string name="workout_action_resume">Продолжить</string>
+    <string name="workout_action_delete">Удалить</string>
+    <string name="workout_action_end">Завершить</string>
+    <string name="workout_action_recording">Запись тренировки</string>
+    <string name="workout_action_paused">На паузе</string>
+    <string name="workout_delete_title">Удалить эту тренировку?</string>
+    <string name="workout_delete_message">Это остановит запись и безвозвратно удалит тренировку.</string>
+    <string name="l10n_settings_screen_effort_exponential_scale">Усилие: экспоненциальная шкала интенсивности</string>
+    <string name="l10n_settings_screen_effort_exponential_scale_desc">Оценивает Усилие по экспоненциальной кривой интенсивности (TRIMP Банистера) вместо стандартных пульсовых зон (Эдвардс). Стандартный вариант не засчитывает ничего ниже половины резерва пульса, поэтому час силовой тренировки — где тяжёлые подходы усредняются с отдыхом — может дать почти ноль. У экспоненциальной кривой нет порога, и она гораздо сильнее учитывает короткие интенсивные усилия. Пересчитывает историю, и обе шкалы достигают одного максимума. По умолчанию выключено.</string>
+    <string name="l10n_app_changelog_an_effort_scale_you_choose_a_a7c2478d">Шкала Усилия на ваш выбор, кольцо, которое засыпает, и намного меньше лишних пересчётов</string>
+    <string name="l10n_health_screen_this_vital_needs_at_least_two_0e41b8b0">Этому показателю нужно минимум два измерения в истории, прежде чем NOOP сможет построить график.</string>
+    <string name="l10n_health_screen_the_blood_oxygen_estimate_is_turned_4c403ab2">Оценка насыщения крови кислородом отключена</string>
+    <string name="l10n_health_screen_your_strap_reports_a_blood_oxygen_349fe34a">Ваш браслет сообщает оценку насыщения крови кислородом, но она не проверена и по умолчанию отключена. Включите оценку браслета в Настройках, чтобы увидеть её, или импортируйте выгрузку WHOOP в «Источниках данных» для калиброванного значения.</string>
+    <string name="l10n_health_screen_no_blood_oxygen_percentage_from_a_1d3d383e">WHOOP 4.0 не даёт процент насыщения крови кислородом</string>
+    <string name="l10n_health_screen_your_strap_banks_the_raw_optical_b52a0f80">Ваш браслет накапливает сырые оптические каналы, но NOOP не превращает их в процент насыщения крови кислородом, поэтому здесь будет пусто, сколько бы вы его ни носили. Импортируйте выгрузку WHOOP в разделе «Источники данных», чтобы заполнить это из истории вашего аккаунта.</string>
+    <string name="ground_truth_title">Сборщик сырых данных 5/MG</string>
+    <string name="ground_truth_subtitle">Запишите ограниченную сессию движения 100 Гц, восстановите пропуски Bluetooth из истории браслета и экспортируйте полную хронологию.</string>
+    <string name="ground_truth_test_centre_desc">Запись, аннотирование, восстановление и экспорт ограниченной записи движения 5/MG 100 Гц.</string>
+    <string name="ground_truth_open">Открыть сборщик сырых данных</string>
+    <string name="ground_truth_start">Начать сессию сырых данных</string>
+    <string name="ground_truth_add_historical">Добавить прошлый интервал</string>
+    <string name="ground_truth_stop">Остановить сессию</string>
+    <string name="ground_truth_export">Экспортировать сессию</string>
+    <string name="ground_truth_exporting">Формирование экспорта…</string>
+    <string name="ground_truth_export_failed">Не удалось экспортировать сессию: %1$s</string>
+    <string name="ground_truth_sessions">Записанные сессии</string>
+    <string name="ground_truth_no_sessions">Сессии ещё не записаны.</string>
+    <string name="ground_truth_comment">Комментарий к сессии</string>
+    <string name="ground_truth_delete_session">Удалить сессию</string>
+    <string name="ground_truth_delete_session_title">Удалить эту сессию?</string>
+    <string name="ground_truth_delete_session_message">Сессия %1$s и её сырые данные будут удалены безвозвратно.</string>
+    <string name="ground_truth_delete_all">Удалить все сессии</string>
+    <string name="ground_truth_delete_all_title">Удалить все сессии?</string>
+    <string name="ground_truth_delete_all_message">Все %1$d записанных сессий и их сырые данные будут удалены безвозвратно.</string>
+    <string name="ground_truth_delete_confirm">Удалить</string>
+    <string name="ground_truth_cancel">Отмена</string>
+    <string name="ground_truth_edit_start">Изменить начало</string>
+    <string name="ground_truth_edit_end">Изменить конец</string>
+    <string name="ground_truth_legacy_no_sensors">Старая сессия: экспорт событий доступен, но её браслет не удаётся определить для экспорта датчиков.</string>
+    <string name="ground_truth_capture_status">Статус записи</string>
+    <string name="ground_truth_recording">Запись · %1$s</string>
+    <string name="ground_truth_band_connected_paired">Браслет: подключено + сопряжено</string>
+    <string name="ground_truth_band_connected_pairing">Браслет: подключено; сопряжение</string>
+    <string name="ground_truth_band_disconnected">Браслет: отключено</string>
+    <string name="ground_truth_band_searching">Браслет: отключено; поиск</string>
+    <string name="ground_truth_history_running">Синхронизация истории: выполняется (%1$d фрагментов)</string>
+    <string name="ground_truth_history_completed">Синхронизация истории завершена: %1$s</string>
+    <string name="ground_truth_history_none">Синхронизация истории: завершённых синхронизаций нет</string>
+    <string name="ground_truth_sensors_behind">Декодированные датчики 1 Гц: отставание %1$s</string>
+    <string name="ground_truth_sensors_none">Декодированные датчики 1 Гц: нет</string>
+    <string name="ground_truth_realtime_imu">IMU в реальном времени: %1$s; %2$d пакетов / %3$d байт%4$s</string>
+    <string name="ground_truth_realtime_last">; последний %1$s назад</string>
+    <string name="ground_truth_add_marker">Добавить маркер</string>
+    <string name="ground_truth_edit_marker">Изменить маркер</string>
+    <string name="ground_truth_marker_moment">Момент</string>
+    <string name="ground_truth_marker_start">Старт</string>
+    <string name="ground_truth_marker_end">Завершить</string>
+    <string name="ground_truth_marker_issue">Проблема</string>
+    <string name="ground_truth_marker_note">Заметка маркера</string>
+    <string name="ground_truth_save">Сохранить</string>
+    <string name="ground_truth_waiting_imu">ожидание IMU</string>
+    <string name="ground_truth_ready_complete">Готово к экспорту · полностью</string>
+    <string name="ground_truth_ready_missing">Готово, пропущено %1$d с · история может это восполнить</string>
+    <string name="ground_truth_waiting_history">Ожидание истории до %1$s</string>
+    <string name="ground_truth_ready_no_imu">Готово без данных IMU</string>
+    <string name="ground_truth_last_exported">Последний экспорт %1$s · экспорт по-прежнему доступен</string>
+    <string name="ground_truth_coverage">%1$d/%2$d с · %3$.1f%% · пропущено %4$d с%5$s</string>
+    <string name="ground_truth_coverage_startup"> · %1$d с запуск</string>
+    <string name="ground_truth_marker_times">Метка %1$s · Сейчас %2$s</string>
+    <string name="raw_diag_title">ДИАГНОСТИКА ПРОТОКОЛА 5/MG</string>
+    <string name="raw_diag_protocol_probes">Пробы протокола</string>
+    <string name="raw_diag_broadcast_hr">Транслировать пульс с браслета</string>
+    <string name="raw_diag_pair">Попросить Android выполнить сопряжение</string>
+    <string name="raw_diag_unbonded_offload">Пробовать синхронизацию истории без сопряжения</string>
+    <string name="raw_diag_clear_stale_bond">Удалить устаревшее сопряжение телефона</string>
+    <string name="raw_diag_r22">Старый эксперимент с флагами R22</string>
+    <string name="raw_diag_r22_enable">Отправить устаревшую последовательность включения R22</string>
+    <string name="raw_diag_r22_clear">Очистить устаревшие флаги R22 на браслете</string>
+    <string name="raw_diag_ecg">Переключатель сырых данных ЭКГ WHOOP MG</string>
+    <string name="raw_diag_ecg_on">Включить шлюз ЭКГ</string>
+    <string name="raw_diag_ecg_off">Выключить шлюз ЭКГ</string>
+    <string name="raw_diag_passive">Пассивная трассировка истории/протокола</string>
+    <string name="raw_diag_share">Поделиться пассивной сырой трассировкой</string>
+    <string name="raw_diag_export_log">Экспорт пассивной трассировки + журнала браслета</string>
+    <string name="raw_diag_moved">Сырой захват и его экспорт трассировки протокола теперь находятся в Центре тестирования → Диагностика протокола 5/MG.</string>
+    <string name="l10n_settings_screen_send_hello_despite_bond_refusal_experimental_2f8de795">Отправлять hello несмотря на отказ в сопряжении (эксперимент)</string>
+    <string name="l10n_settings_screen_send_hello_despite_bond_refusal_65c9d9fd">Отправлять hello несмотря на отказ в сопряжении</string>
+    <string name="l10n_settings_screen_check_automatically_7cd229d2">Проверять автоматически</string>
+    <string name="l10n_settings_screen_once_a_day_noop_asks_github_5683aad3">Раз в день NOOP запрашивает у GitHub номер последней версии и оставляет заметку в «Обновлениях», если появилась более новая. Ничего о вас не отправляется, и ничего никогда не устанавливается.</string>
+    <string name="l10n_updates_noop_1s_is_available_05d8ef55">Доступен NOOP %1$s</string>
+    <string name="l10n_updates_youre_on_1s_open_settings_and_35b9e135">У вас %1$s. Откройте Настройки и воспользуйтесь проверкой обновлений, чтобы увидеть, что нового, и скачать %2$s.</string>
+    <string name="crash_recovery_title">NOOP неожиданно остановился</string>
+    <string name="crash_recovery_body">Последний сбой показан ниже. Вы можете скопировать его для отчёта об ошибке, а затем попробовать открыть приложение снова.</string>
+    <string name="crash_recovery_copy">Скопировать ошибку</string>
+    <string name="crash_recovery_continue">Попробовать открыть NOOP</string>
+    <string name="l10n_body_clock_dial_card_body_clock_b0b9b988">Биологические часы</string>
+    <string name="l10n_body_clock_dial_card_last_night_against_your_clock_9183a37c">Прошлая ночь и ваши биологические часы</string>
+    <string name="l10n_body_clock_dial_card_in_sync_with_your_body_clock_4b5181c8">В согласии с биологическими часами</string>
+    <string name="l10n_body_clock_dial_card_1_s_later_than_your_body_50b7d966">На %1$s позже ваших биологических часов</string>
+    <string name="l10n_body_clock_dial_card_1_s_earlier_than_your_body_68877f50">На %1$s раньше ваших биологических часов</string>
+    <string name="l10n_body_clock_dial_card_morning_type_289dd7bf">Утренний тип</string>
+    <string name="l10n_body_clock_dial_card_intermediate_type_a7b6b74c">Промежуточный тип</string>
+    <string name="l10n_body_clock_dial_card_evening_type_3e1ce111">Вечерний тип</string>
+    <string name="l10n_body_clock_dial_card_body_clock_dial_03cdbc31">Циферблат биологических часов</string>
+    <string name="l10n_body_clock_dial_card_last_night_6eaba4dd">Последняя ночь</string>
+    <string name="l10n_body_clock_dial_card_your_clock_1b91f5ee">Ваши часы</string>
+    <string name="vo2max_method_change_caption">Линия прерывается там, где метод оценки изменился или не был записан.</string>
+    <string name="l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee">WHOOP 5, который остаётся на связи, ваши биологические часы на экране «Сон» и Журнал, отличающий «Нет» от пустоты</string>
+    <string name="l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c">Выбор 12-часового формата, сон с браслетов без записи движения и журнал браслета, который перестал гадать</string>
+    <string name="l10n_settings_screen_skin_temperature_fc103030">Температура кожи</string>
+    <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Для этих ночей нет измеренной температуры — показано отклонение от вашей нормы. Синхронизация пересчитает недавние ночи и заполнит это.</string>
+    <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Показаны только ночи с измеренной температурой; для остальных записано лишь отклонение от нормы.</string>
+    <plurals name="trends_n_days">
+        <item quantity="one">%1$d день</item>
+        <item quantity="few">%1$d дня</item>
+        <item quantity="many">%1$d дней</item>
+        <item quantity="other">%1$d дня</item>
+    </plurals>
+    <plurals name="intelligence_days_count">
+        <item quantity="one">%1$d день</item>
+        <item quantity="few">%1$d дня</item>
+        <item quantity="many">%1$d дней</item>
+        <item quantity="other">%1$d дня</item>
+    </plurals>
+    <plurals name="explore_n_days">
+        <item quantity="one">%1$d день</item>
+        <item quantity="few">%1$d дня</item>
+        <item quantity="many">%1$d дней</item>
+        <item quantity="other">%1$d дня</item>
+    </plurals>
+    <plurals name="lab_book_readings_count">
+        <item quantity="one">%1$d измерение · ваша собственная запись</item>
+        <item quantity="few">%1$d измерения · ваши собственные записи</item>
+        <item quantity="many">%1$d измерений · ваши собственные записи</item>
+        <item quantity="other">%1$d измерения · ваши собственные записи</item>
+    </plurals>
+    <plurals name="trends_weeks_ago">
+        <item quantity="one">%1$d неделю назад</item>
+        <item quantity="few">%1$d недели назад</item>
+        <item quantity="many">%1$d недель назад</item>
+        <item quantity="other">%1$d недели назад</item>
+    </plurals>
+    <plurals name="l10n_workouts_screen_hrr_workout_count_516">
+        <item quantity="one">%1$d тренировка</item>
+        <item quantity="few">%1$d тренировки</item>
+        <item quantity="many">%1$d тренировок</item>
+        <item quantity="other">%1$d тренировки</item>
+    </plurals>
+    <plurals name="settings_streak_run">
+        <item quantity="one">%1$d день подряд</item>
+        <item quantity="few">%1$d дня подряд</item>
+        <item quantity="many">%1$d дней подряд</item>
+        <item quantity="other">%1$d дня подряд</item>
+    </plurals>
+    <plurals name="settings_streak_longest">
+        <item quantity="one">Дольше всего: %1$d день</item>
+        <item quantity="few">Дольше всего: %1$d дня</item>
+        <item quantity="many">Дольше всего: %1$d дней</item>
+        <item quantity="other">Дольше всего: %1$d дня</item>
+    </plurals>
+    <plurals name="score_state_detail_calibrating">
+        <item quantity="one">Формируем вашу норму. Ещё %1$d ночь, и оценки станут персональными.</item>
+        <item quantity="few">Формируем вашу норму. Ещё %1$d ночи, и оценки станут персональными.</item>
+        <item quantity="many">Формируем вашу норму. Ещё %1$d ночей, и оценки станут персональными.</item>
+        <item quantity="other">Формируем вашу норму. Ещё %1$d ночи, и оценки станут персональными.</item>
+    </plurals>
+    <plurals name="today_strap_hours_left">
+        <item quantity="one">осталось ~%1$d час</item>
+        <item quantity="few">осталось ~%1$d часа</item>
+        <item quantity="many">осталось ~%1$d часов</item>
+        <item quantity="other">осталось ~%1$d часа</item>
+    </plurals>
+    <plurals name="today_strap_days_left">
+        <item quantity="one">осталось ~%1$d день</item>
+        <item quantity="few">осталось ~%1$d дня</item>
+        <item quantity="many">осталось ~%1$d дней</item>
+        <item quantity="other">осталось ~%1$d дня</item>
+    </plurals>
+    <plurals name="today_new_history_ready">
+        <item quantity="one">В «Трендах» готов %1$d новый день истории.</item>
+        <item quantity="few">В «Трендах» готовы %1$d новых дня истории.</item>
+        <item quantity="many">В «Трендах» готово %1$d новых дней истории.</item>
+        <item quantity="other">В «Трендах» готовы %1$d новых дня истории.</item>
+    </plurals>
+    <plurals name="today_hr_a11y_workouts_marked">
+        <item quantity="one">отмечена %1$d тренировка</item>
+        <item quantity="few">отмечены %1$d тренировки</item>
+        <item quantity="many">отмечено %1$d тренировок</item>
+        <item quantity="other">отмечены %1$d тренировки</item>
+    </plurals>
+    <plurals name="today_source_days">
+        <item quantity="one">%1$s день</item>
+        <item quantity="few">%1$s дня</item>
+        <item quantity="many">%1$s дней</item>
+        <item quantity="other">%1$s дня</item>
+    </plurals>
+    <plurals name="today_source_workouts">
+        <item quantity="one">%1$s тренировка</item>
+        <item quantity="few">%1$s тренировки</item>
+        <item quantity="many">%1$s тренировок</item>
+        <item quantity="other">%1$s тренировки</item>
+    </plurals>
+</resources>

From 6844b5d63291a51067c1484a16a27b47f0181ba1 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 19:17:50 +1200
Subject: [PATCH 225/333] i18n(android): park the partial Arabic translation as
 data, not a locale (#1873)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Parks a partial Arabic translation so it survives, and records what finishing it would take. This ships NOTHING: one data file, no locale directory.

  translated                       1147
  still to translate               1312
  untranslatable (English fallback) 121
  base English strings             2581

Committed as Tools/i18n/ar_wip.json rather than values-ar/strings.xml on purpose. A 47%-complete locale is not a half-good locale, it is a broken one: Android falls back per string, so the missing 1312 would surface as English scattered mid-screen, and in Arabic that flips the text direction mid-screen too. As data it cannot ship by accident and cannot fail the i18n gate.

Two real defects were found and fixed while reviewing it, both of the kind a reader of the Arabic would not necessarily catch because they concern placement rather than wording:

"Pace" and "Cadence" had both become الإيقاع, and they sit next to each other on the live workout screen as two DIFFERENT metrics - two values under one label. Cadence keeps الإيقاع; pace is now الوتيرة. The breathing-screen "Pace" stays الإيقاع, correct there and on another screen so it cannot collide.

32 strings began with a Latin run - "WHOOP هو السوار...", "CCB · ~2.4 ث..." - and under the Unicode bidi rules Android applies, paragraph direction comes from the first strong character. Those would have laid out LEFT-TO-RIGHT inside an RTL locale, putting terminal punctuation on the wrong side of an otherwise Arabic sentence. Each now carries a leading U+200F RIGHT-TO-LEFT MARK; zero Arabic strings now begin with Latin.

Each entry stores its ENGLISH SOURCE beside the Arabic, which matters more for parked work than for a locale: 856 of the 1147 keys embed a sha1 of the English text, so editing that copy changes the key and would orphan the translation silently. Storing 'en' lets a resume re-match on content, the way the Russian locale was seeded from Apple's catalog.

Validated: 0 format-specifier mismatches, 0 literal %% mismatches, 0 strings identical to English, 0 Arabic-Indic digits, 0 presentation forms, 0 stray zero-width characters, 0 bidi embedding controls beyond the RLMs above, 0 non-breaking or double spaces, and every key resolves against the current values/strings.xml. Punctuation is uniformly Arabic - 176 commas, 21 question marks, 25 semicolons, and zero Latin equivalents anywhere. All 34 tatweel usages are the proclitic بـ before a foreign word, which is correct typography rather than decoration.

The glossary is stored with the strings because with no existing Arabic anywhere to derive from it had to be fixed up front: الشحن, الجهد, الراحة, التعافي, الإجهاد, الجاهزية, تقلب النبض, نبضة/دقيقة, السوار, خط الأساس. It is an anchor rather than a literal expectation, and the file says so - Arabic inflects, so a substring check under-reports every term.

What finishing it needs. Arabic takes SIX plural forms (zero/one/two/few/many/other); English has two, Russian four, and nothing in this repo carries more than four. All 15 plurals are still to do. More importantly RTL, not translation, is the gate: Arabic would be this app's first right-to-left locale. The foundation checks out - supportsRtl=true, zero absolute left/right paddings against 39 start/end, zero TextAlign.Left/Right against 27 Start/End, LocalLayoutDirection read rather than forced, Locale.US pinning Western digits - but 27 files draw on Canvas with 103 calls that do not mirror, and nobody has seen a single screen of this app right-to-left. That wants a device before the remaining 1312 strings are worth generating.

Worth weighing against resuming this: Italian and Traditional Chinese are the cheaper parity win. Apple ships both and Android has neither, so an Italian or Taiwanese user gets a localised iPhone app and an English Android one. Apple's xcstrings keys ARE the English source text, so roughly half of each could be a mechanical join exactly as Russian was, and both are left-to-right.
---
 Tools/i18n/ar_wip.json | 4634 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 4634 insertions(+)
 create mode 100644 Tools/i18n/ar_wip.json

diff --git a/Tools/i18n/ar_wip.json b/Tools/i18n/ar_wip.json
new file mode 100644
index 0000000000..b649ca0906
--- /dev/null
+++ b/Tools/i18n/ar_wip.json
@@ -0,0 +1,4634 @@
+{
+ "_note": "WORK IN PROGRESS - machine-translated Arabic for Android, NOT a shipping locale. Each entry stores the ENGLISH SOURCE alongside the Arabic on purpose: 856 of these 1147 keys embed a sha1 of the English text, so editing that copy changes the key and would silently orphan the translation. Re-match on 'en' if a key no longer resolves. The stored 'en' is the RAW value from values/strings.xml, so it keeps that file's backslash escapes (69 entries contain \\' for an apostrophe); re-match with the same extraction rather than against rendered text.",
+ "_status": {
+  "translated": 1147,
+  "still_to_translate": 1312,
+  "untranslatable_english_fallback": 121,
+  "base_english_strings": 2581
+ },
+ "_glossary": {
+  "Charge": "الشحن",
+  "Effort": "الجهد",
+  "Rest": "الراحة",
+  "Recovery": "التعافي",
+  "Strain": "الإجهاد",
+  "Sleep": "النوم",
+  "Readiness": "الجاهزية",
+  "HRV": "تقلب النبض",
+  "heart rate": "معدل النبض",
+  "bpm": "نبضة/دقيقة",
+  "strap": "السوار",
+  "baseline": "خط الأساس",
+  "Workout": "تمرين",
+  "Workouts": "التمارين",
+  "Steps": "الخطوات",
+  "Calories": "السعرات",
+  "Today": "اليوم",
+  "Trends": "الاتجاهات",
+  "Insights": "الرؤى",
+  "Journal": "اليوميات",
+  "Settings": "الإعدادات",
+  "Sleep Debt": "دين النوم",
+  "Nap": "قيلولة",
+  "Battery": "البطارية",
+  "Live": "مباشر",
+  "Devices": "الأجهزة",
+  "Automations": "الأتمتة",
+  "Stress": "التوتر",
+  "Breathe": "التنفس",
+  "Hydration": "الترطيب",
+  "Coach": "المدرب الذكي",
+  "Explore": "استكشاف"
+ },
+ "strings": {
+  "action_breathe": {
+   "en": "Breathe",
+   "ar": "التنفس"
+  },
+  "action_live_hr": {
+   "en": "Live HR",
+   "ar": "النبض المباشر"
+  },
+  "action_log_journal": {
+   "en": "Log journal",
+   "ar": "تسجيل اليوميات"
+  },
+  "action_start_workout": {
+   "en": "Start workout",
+   "ar": "بدء تمرين"
+  },
+  "battery_bedtime_body": {
+   "en": "%1$s of recording left, but tonight needs about %2$s. Charge before bed.",
+   "ar": "يتبقى %1$s من التسجيل، لكن الليلة تحتاج نحو %2$s. اشحن السوار قبل النوم."
+  },
+  "battery_bedtime_title": {
+   "en": "Won\\'t last the night",
+   "ar": "لن يكفي طوال الليل"
+  },
+  "battery_channel_desc": {
+   "en": "Alerts when the strap battery is low or fully charged.",
+   "ar": "تنبيهات عند انخفاض بطارية السوار أو اكتمال شحنها."
+  },
+  "battery_channel_name": {
+   "en": "Battery alerts",
+   "ar": "تنبيهات البطارية"
+  },
+  "battery_critical_body": {
+   "en": "%1$d%% left. The strap stops recording near 10%% — it won\\'t capture tonight unless you charge it.",
+   "ar": "يتبقى %1$d%%. يتوقف السوار عن التسجيل قرب 10%% — ولن يسجّل هذه الليلة ما لم تشحنه."
+  },
+  "battery_critical_title": {
+   "en": "Charge your WHOOP now",
+   "ar": "اشحن WHOOP الآن"
+  },
+  "battery_full_body": {
+   "en": "Your WHOOP is at 100%.",
+   "ar": "شحن WHOOP بلغ 100%."
+  },
+  "battery_full_title": {
+   "en": "Strap fully charged",
+   "ar": "اكتمل شحن السوار"
+  },
+  "battery_low_body": {
+   "en": "Recharge your WHOOP before tonight.",
+   "ar": "أعد شحن WHOOP قبل الليلة."
+  },
+  "battery_low_title": {
+   "en": "Low battery",
+   "ar": "البطارية منخفضة"
+  },
+  "battery_runtime_body": {
+   "en": "%1$s left on your WHOOP — recharge tonight.",
+   "ar": "يتبقى %1$s في WHOOP — أعد شحنه الليلة."
+  },
+  "battery_runtime_title": {
+   "en": "Strap battery low",
+   "ar": "بطارية السوار منخفضة"
+  },
+  "breath_presence_intro_body": {
+   "en": "Consciously Connected Breathing (CCB): inhale and exhale in one continuous loop with no hold at the top or bottom. Find a comfortable rhythm — connectedness matters more than intensity. Typical practice is about 15 minutes, twice daily. Regular is the sustainable starter tempo; Mid is a quicker start for later rounds; Punching Through is only when you need to push through drowsiness or stuckness (not a beginner default).",
+   "ar": "التنفس المتصل الواعي (CCB): شهيق وزفير في حلقة متصلة واحدة دون حبس في الأعلى أو الأسفل. اعثر على إيقاع مريح — الاتصال أهم من الشدة. الممارسة المعتادة نحو 15 دقيقة مرتين يوميًا. «العادي» هو الإيقاع المستدام للبداية؛ و«المتوسط» بداية أسرع للجولات اللاحقة؛ و«الاختراق» فقط عند الحاجة إلى تجاوز النعاس أو الجمود (ليس الخيار الافتراضي للمبتدئين)."
+  },
+  "breath_presence_intro_title": {
+   "en": "The Presence Process",
+   "ar": "عملية الحضور"
+  },
+  "breath_proto_bhastrika_caution": {
+   "en": "Stop if dizzy. Avoid with high blood pressure, pregnancy, or recent surgery unless cleared by a clinician.",
+   "ar": "توقف عند الشعور بالدوار. تجنّبه مع ارتفاع ضغط الدم أو الحمل أو بعد جراحة حديثة ما لم يأذن الطبيب."
+  },
+  "breath_proto_bhastrika_edu": {
+   "en": "Bhastrika (bellows): forceful 1-second nasal inhale and exhale. Energising and intense. Keep rounds short and rest between them.",
+   "ar": "باستريكا (المنفاخ): شهيق وزفير أنفي قوي لمدة ثانية واحدة. منشّط وشديد. أبقِ الجولات قصيرة مع راحة بينها."
+  },
+  "breath_proto_bhastrika_session_hint": {
+   "en": "Short rounds only.",
+   "ar": "جولات قصيرة فقط."
+  },
+  "breath_proto_bhastrika_subtitle": {
+   "en": "Forceful 1s in · 1s out",
+   "ar": "قوي · ثانية شهيق · ثانية زفير"
+  },
+  "breath_proto_box_4_4_4_4_edu": {
+   "en": "Box (square) breathing: inhale, hold, exhale, hold — each for 4 seconds. A structured rhythm often used for focus and settling under stress. Sit comfortably and keep the counts even.",
+   "ar": "التنفس المربّع: شهيق، حبس، زفير، حبس — أربع ثوانٍ لكل مرحلة. إيقاع منظم يُستخدم غالبًا للتركيز والتهدئة تحت الضغط. اجلس مرتاحًا وحافظ على تساوي العدّات."
+  },
+  "breath_proto_box_4_4_4_4_session_hint": {
+   "en": "About 5 minutes per session; repeat as needed.",
+   "ar": "نحو 5 دقائق لكل جلسة؛ كرّرها حسب الحاجة."
+  },
+  "breath_proto_box_4_4_4_4_subtitle": {
+   "en": "Square breath · steady focus",
+   "ar": "نفَس مربّع · تركيز ثابت"
+  },
+  "breath_proto_buteyko_caution": {
+   "en": "Stay in a comfortable range; never force breath holds.",
+   "ar": "ابقَ ضمن نطاق مريح؛ لا تُجبر حبس النفس أبدًا."
+  },
+  "breath_proto_buteyko_edu": {
+   "en": "Buteyko-style reduced breathing: small nasal inhale (~2.5s), relaxed nasal exhale (~3.5s), short comfortable hold (~3.5s). Keep it quiet and light — not a big gasp.",
+   "ar": "تنفس مخفَّض بأسلوب بوتيكو: شهيق أنفي صغير (~2.5 ث)، زفير أنفي مسترخٍ (~3.5 ث)، ثم حبس قصير مريح (~3.5 ث). أبقِه هادئًا وخفيفًا — لا شهقة كبيرة."
+  },
+  "breath_proto_buteyko_reduced_caution": {
+   "en": "Never push into panic or strong air hunger.",
+   "ar": "لا تدفع نفسك إلى الذعر أو الجوع الشديد للهواء."
+  },
+  "breath_proto_buteyko_reduced_edu": {
+   "en": "Reduced Buteyko-style: ~2s gentle inhale, ~3s exhale, then a 3–5s hold with mild air hunger only. Stay relaxed in the face and shoulders.",
+   "ar": "بوتيكو المخفَّض: شهيق لطيف ~2 ث، زفير ~3 ث، ثم حبس 3–5 ث مع جوع خفيف للهواء فقط. أبقِ الوجه والكتفين مسترخيين."
+  },
+  "breath_proto_buteyko_reduced_session_hint": {
+   "en": "15–20 minutes if comfortable.",
+   "ar": "15–20 دقيقة إن كان مريحًا."
+  },
+  "breath_proto_buteyko_reduced_subtitle": {
+   "en": "Lighter · longer soft hold",
+   "ar": "أخف · حبس ليّن أطول"
+  },
+  "breath_proto_buteyko_reduced_title": {
+   "en": "Buteyko Reduced",
+   "ar": "بوتيكو المخفَّض"
+  },
+  "breath_proto_buteyko_session_hint": {
+   "en": "3–20 minutes, as comfortable.",
+   "ar": "3–20 دقيقة، حسب الراحة."
+  },
+  "breath_proto_buteyko_subtitle": {
+   "en": "Gentle nasal · light air hunger",
+   "ar": "أنفي لطيف · جوع خفيف للهواء"
+  },
+  "breath_proto_buteyko_title": {
+   "en": "Buteyko",
+   "ar": "بوتيكو"
+  },
+  "breath_proto_coherence_5_5_edu": {
+   "en": "Equal inhale and exhale at about 5.5 breaths per minute — a common coherence / resonance starting point. Steady, balanced pacing for settling heart-rate variability during a session.",
+   "ar": "شهيق وزفير متساويان عند نحو 5.5 نفَس في الدقيقة — نقطة انطلاق شائعة للاتساق والرنين. إيقاع ثابت متوازن لتهدئة تقلب النبض خلال الجلسة."
+  },
+  "breath_proto_coherence_5_5_session_hint": {
+   "en": "Try about 10 minutes.",
+   "ar": "جرّب نحو 10 دقائق."
+  },
+  "breath_proto_coherence_5_5_subtitle": {
+   "en": "Equal breath · ~5.5 br/min coherence",
+   "ar": "نفَس متساوٍ · اتساق ~5.5 نفَس/دقيقة"
+  },
+  "breath_proto_coherence_5_5_title": {
+   "en": "Coherence 5.5",
+   "ar": "الاتساق 5.5"
+  },
+  "breath_proto_coherent_6_6_edu": {
+   "en": "Coherent breathing at six seconds in and six seconds out (~5 breaths per minute). A slow equal pace aimed at calm and HRV-friendly rhythm — estimate only, not a clinical reading.",
+   "ar": "تنفس متسق بست ثوانٍ شهيقًا وست ثوانٍ زفيرًا (~5 أنفاس في الدقيقة). إيقاع بطيء متساوٍ يهدف إلى الهدوء وإيقاع ملائم لتقلب النبض — تقدير فقط وليس قراءة سريرية."
+  },
+  "breath_proto_coherent_6_6_session_hint": {
+   "en": "Start around 10 minutes.",
+   "ar": "ابدأ بنحو 10 دقائق."
+  },
+  "breath_proto_coherent_6_6_subtitle": {
+   "en": "6s in · 6s out · ~5 br/min",
+   "ar": "6 ث شهيق · 6 ث زفير · ~5 نفَس/دقيقة"
+  },
+  "breath_proto_coherent_6_6_title": {
+   "en": "Coherent 6-6",
+   "ar": "المتسق 6-6"
+  },
+  "breath_proto_deep_4_2_6_edu": {
+   "en": "Deep breathing with a short pause: inhale 4s, hold 2s, exhale 6s. Breathe through the nose when you can, fill the lungs without forcing, and let the longer exhale slow you down.",
+   "ar": "تنفس عميق مع وقفة قصيرة: شهيق 4 ث، حبس ثانيتان، زفير 6 ث. تنفّس عبر الأنف متى استطعت، واملأ الرئتين دون إجهاد، ودع الزفير الأطول يبطئك."
+  },
+  "breath_proto_deep_4_2_6_session_hint": {
+   "en": "5–10 minutes daily is a common starting point.",
+   "ar": "5–10 دقائق يوميًا نقطة انطلاق شائعة."
+  },
+  "breath_proto_deep_4_2_6_subtitle": {
+   "en": "Slow inhale · soft hold · long exhale",
+   "ar": "شهيق بطيء · حبس ليّن · زفير طويل"
+  },
+  "breath_proto_deep_4_2_6_title": {
+   "en": "Deep Breathing",
+   "ar": "التنفس العميق"
+  },
+  "breath_proto_diaphragmatic_4_2_6_edu": {
+   "en": "Diaphragmatic (belly) breathing: expand the abdomen on the inhale more than the chest, optional short hold, then gently contract on the exhale. Same 4–2–6 timing as deep breathing, with attention on the diaphragm.",
+   "ar": "التنفس الحجابي (البطني): وسّع البطن مع الشهيق أكثر من الصدر، مع حبس قصير اختياري، ثم اسحبه بلطف مع الزفير. التوقيت نفسه 4–2–6 كالتنفس العميق، مع تركيز على الحجاب الحاجز."
+  },
+  "breath_proto_diaphragmatic_4_2_6_session_hint": {
+   "en": "5–10 minutes daily.",
+   "ar": "5–10 دقائق يوميًا."
+  },
+  "breath_proto_diaphragmatic_4_2_6_subtitle": {
+   "en": "Belly breath · soft pause",
+   "ar": "نفَس بطني · وقفة ليّنة"
+  },
+  "breath_proto_diaphragmatic_4_2_6_title": {
+   "en": "Diaphragmatic",
+   "ar": "حجابي"
+  },
+  "breath_proto_four_seven_eight_caution": {
+   "en": "If you feel dizzy or uncomfortable, stop and breathe normally.",
+   "ar": "إذا شعرت بدوار أو انزعاج، توقف وتنفّس بشكل طبيعي."
+  },
+  "breath_proto_four_seven_eight_edu": {
+   "en": "Classic 4-7-8: quiet nasal inhale for 4, hold for 7, long mouth exhale for 8. Often used to wind down. Start with a few cycles; stop if you feel light-headed.",
+   "ar": "الكلاسيكي 4-7-8: شهيق أنفي هادئ لأربع، حبس لسبع، زفير فموي طويل لثمان. يُستخدم غالبًا للاسترخاء. ابدأ بدورات قليلة؛ وتوقف إن شعرت بخفة في الرأس."
+  },
+  "breath_proto_four_seven_eight_session_hint": {
+   "en": "A few minutes is enough; build gradually.",
+   "ar": "بضع دقائق تكفي؛ زدها تدريجيًا."
+  },
+  "breath_proto_four_seven_eight_subtitle": {
+   "en": "Inhale 4 · hold 7 · exhale 8",
+   "ar": "شهيق 4 · حبس 7 · زفير 8"
+  },
+  "breath_proto_holotropic_caution": {
+   "en": "Not for DIY high-intensity sessions if you have trauma history, cardiovascular issues, or pregnancy without professional guidance.",
+   "ar": "غير مناسب لجلسات مكثفة ذاتية إن كان لديك تاريخ صدمة أو مشكلات قلبية وعائية أو حمل، دون إشراف مختص."
+  },
+  "breath_proto_holotropic_edu": {
+   "en": "Holotropic-style work is continuous, often rapid connected breathing in a supported setting. NOOP only offers a session timer and education — not an auto-pacer — because intensity varies widely and is normally facilitated.",
+   "ar": "العمل بأسلوب الهولوتروبيك تنفس متصل مستمر وسريع غالبًا في بيئة مدعومة. يقدّم NOOP مؤقّت جلسة وشرحًا فقط — لا ضابط إيقاع تلقائي — لأن الشدة تتفاوت كثيرًا وتُدار عادة بإشراف."
+  },
+  "breath_proto_holotropic_session_hint": {
+   "en": "Traditional sessions are long; use a short timer here as a check-in only.",
+   "ar": "الجلسات التقليدية طويلة؛ استخدم مؤقّتًا قصيرًا هنا للمتابعة فقط."
+  },
+  "breath_proto_holotropic_subtitle": {
+   "en": "Guided · continuous connected",
+   "ar": "موجّه · متصل مستمر"
+  },
+  "breath_proto_holotropic_title": {
+   "en": "Holotropic",
+   "ar": "هولوتروبيك"
+  },
+  "breath_proto_kapalabhati_caution": {
+   "en": "Skip if pregnant, dizzy, or have uncontrolled hypertension. Stop if strained.",
+   "ar": "تجنّبه أثناء الحمل أو عند الدوار أو مع ارتفاع ضغط غير منضبط. توقف عند الإجهاد."
+  },
+  "breath_proto_kapalabhati_edu": {
+   "en": "Kapalabhati uses rapid, active belly exhales with passive inhales. Timing varies by person — this mode gives you a timer and coaching text only, not a forced metronome. Practice seated, short rounds, rest between.",
+   "ar": "كابالاباتي يستخدم زفيرًا بطنيًا سريعًا نشطًا مع شهيق سلبي. يختلف التوقيت من شخص لآخر — يمنحك هذا الوضع مؤقّتًا ونصًا إرشاديًا فقط، لا إيقاعًا إجباريًا. مارسه جالسًا، بجولات قصيرة وراحة بينها."
+  },
+  "breath_proto_kapalabhati_session_hint": {
+   "en": "Short rounds (about 30–60s) with rests.",
+   "ar": "جولات قصيرة (نحو 30–60 ثانية) مع راحة."
+  },
+  "breath_proto_kapalabhati_subtitle": {
+   "en": "Guided · rapid belly pulses",
+   "ar": "موجّه · نبضات بطنية سريعة"
+  },
+  "breath_proto_kapalabhati_title": {
+   "en": "Kapalabhati",
+   "ar": "كابالاباتي"
+  },
+  "breath_proto_nadi_shodhana_edu": {
+   "en": "Alternate-nostril breathing: inhale left, hold, exhale right, inhale right, hold, exhale left — about 4 seconds each step. Use a finger to gently close one nostril at a time. Labels cue which side; go at a calm pace.",
+   "ar": "التنفس بالمنخرين بالتناوب: شهيق يسار، حبس، زفير يمين، شهيق يمين، حبس، زفير يسار — نحو 4 ثوانٍ لكل خطوة. استخدم إصبعًا لإغلاق منخر واحد برفق في كل مرة. تشير التسميات إلى الجهة؛ حافظ على وتيرة هادئة."
+  },
+  "breath_proto_nadi_shodhana_session_hint": {
+   "en": "5–10 minutes.",
+   "ar": "5–10 دقائق."
+  },
+  "breath_proto_nadi_shodhana_subtitle": {
+   "en": "Nadi Shodhana · left/right cycle",
+   "ar": "نادي شودانا · دورة يسار/يمين"
+  },
+  "breath_proto_nadi_shodhana_title": {
+   "en": "Alternate Nostril",
+   "ar": "تناوب المنخرين"
+  },
+  "breath_proto_presence_mid_edu": {
+   "en": "Mid session tempo (~2.4s / 2.4s) is a starting pace for later passes through the procedure; once settled you may slow deeper or switch to Punching Through.",
+   "ar": "إيقاع الجلسة المتوسط (~2.4 ث / 2.4 ث) وتيرة انطلاق للمرات اللاحقة من العملية؛ وبعد الاستقرار يمكنك التباطؤ أعمق أو الانتقال إلى «الاختراق»."
+  },
+  "breath_proto_presence_mid_session_hint": {
+   "en": "15 minutes once you are using Mid as your starter.",
+   "ar": "15 دقيقة متى صار «المتوسط» بدايتك."
+  },
+  "breath_proto_presence_mid_subtitle": {
+   "en": "CCB · ~2.4s / 2.4s · ~12.4 br/min",
+   "ar": "‏CCB · ~2.4 ث / 2.4 ث · ~12.4 نفَس/دقيقة"
+  },
+  "breath_proto_presence_mid_title": {
+   "en": "Presence Mid",
+   "ar": "الحضور المتوسط"
+  },
+  "breath_proto_presence_punching_caution": {
+   "en": "Not recommended as a beginner default unless the goal is to overcome drowsiness.",
+   "ar": "لا يُنصح به كخيار افتراضي للمبتدئين إلا إذا كان الهدف تجاوز النعاس."
+  },
+  "breath_proto_presence_punching_edu": {
+   "en": "Punching Through (~1.9s / 1.9s) is for sleepiness or feeling stuck — not the beginner default. After you are “in it”, you may return to a slower, deeper connected breath.",
+   "ar": "«الاختراق» (~1.9 ث / 1.9 ث) للنعاس أو الشعور بالجمود — وليس الخيار الافتراضي للمبتدئين. بعد أن تدخل في الحالة، يمكنك العودة إلى نفَس متصل أبطأ وأعمق."
+  },
+  "breath_proto_presence_punching_session_hint": {
+   "en": "Up to 15 minutes; ease off if strained.",
+   "ar": "حتى 15 دقيقة؛ خفّف عند الإجهاد."
+  },
+  "breath_proto_presence_punching_subtitle": {
+   "en": "CCB · ~1.9s / 1.9s · push-through",
+   "ar": "‏CCB · ~1.9 ث / 1.9 ث · اختراق"
+  },
+  "breath_proto_presence_punching_title": {
+   "en": "Presence Punching",
+   "ar": "حضور الاختراق"
+  },
+  "breath_proto_presence_regular_edu": {
+   "en": "Regular tempo (~3.8s in / 3.8s out) is the default sustainable pace for a first pass and for staying the full 15 minutes.",
+   "ar": "الإيقاع العادي (~3.8 ث شهيق / 3.8 ث زفير) هو الوتيرة المستدامة الافتراضية للمرة الأولى وللبقاء طوال الخمس عشرة دقيقة."
+  },
+  "breath_proto_presence_regular_session_hint": {
+   "en": "15 minutes, twice daily (Presence Process frame).",
+   "ar": "15 دقيقة مرتين يوميًا (إطار عملية الحضور)."
+  },
+  "breath_proto_presence_regular_subtitle": {
+   "en": "CCB · ~3.8s / 3.8s · ~7.8 br/min",
+   "ar": "‏CCB · ~3.8 ث / 3.8 ث · ~7.8 نفَس/دقيقة"
+  },
+  "breath_proto_presence_regular_title": {
+   "en": "Presence Regular",
+   "ar": "الحضور العادي"
+  },
+  "breath_proto_qigong_edu": {
+   "en": "Gentle Qi Gong-style pacing: inhale ~4.5s, optional short hold, exhale ~4.5s, optional short hold. Soft belly focus; no force.",
+   "ar": "إيقاع لطيف بأسلوب تشي غونغ: شهيق ~4.5 ث، حبس قصير اختياري، زفير ~4.5 ث، حبس قصير اختياري. تركيز بطني ليّن؛ دون إجبار."
+  },
+  "breath_proto_qigong_session_hint": {
+   "en": "15–30 minutes is traditional; start shorter.",
+   "ar": "15–30 دقيقة تقليديًا؛ ابدأ بأقصر."
+  },
+  "breath_proto_qigong_subtitle": {
+   "en": "Slow in · soft holds · slow out",
+   "ar": "شهيق بطيء · حبس ليّن · زفير بطيء"
+  },
+  "breath_proto_qigong_title": {
+   "en": "Qi Gong Breath",
+   "ar": "نفَس تشي غونغ"
+  },
+  "breath_proto_relax_4_6_edu": {
+   "en": "A simple calming pace: inhale for 4 seconds, exhale for 6. The longer exhale tends to favour a rest-and-digest feel. Use it when you want an easy downshift without holds.",
+   "ar": "وتيرة تهدئة بسيطة: شهيق 4 ثوانٍ، زفير 6. الزفير الأطول يميل إلى تعزيز إحساس الراحة والهضم. استخدمها حين تريد تهدئة سهلة دون حبس."
+  },
+  "breath_proto_relax_4_6_session_hint": {
+   "en": "Try 5–10 minutes.",
+   "ar": "جرّب 5–10 دقائق."
+  },
+  "breath_proto_relax_4_6_subtitle": {
+   "en": "Long exhale · downshift to rest",
+   "ar": "زفير طويل · تهدئة نحو الراحة"
+  },
+  "breath_proto_relax_4_6_title": {
+   "en": "Relax 4-6",
+   "ar": "استرخاء 4-6"
+  },
+  "breath_proto_shamanic_caution": {
+   "en": "Prefer guided settings for intense practice.",
+   "ar": "يُفضَّل الإعداد الموجّه للممارسة المكثفة."
+  },
+  "breath_proto_shamanic_edu": {
+   "en": "Shamanic-style rhythmic breathing is context-dependent and often facilitated. Use this as a quiet timer with education only — set your own safe intensity.",
+   "ar": "التنفس الإيقاعي بأسلوب شاماني يعتمد على السياق ويُدار عادة بإشراف. استخدم هذا كمؤقّت هادئ مع شرح فقط — واضبط شدة آمنة بنفسك."
+  },
+  "breath_proto_shamanic_session_hint": {
+   "en": "Pick a length that feels safe.",
+   "ar": "اختر مدة تشعر أنها آمنة."
+  },
+  "breath_proto_shamanic_subtitle": {
+   "en": "Guided · rhythmic rapid",
+   "ar": "موجّه · إيقاعي سريع"
+  },
+  "breath_proto_shamanic_title": {
+   "en": "Shamanic Breath",
+   "ar": "نفَس شاماني"
+  },
+  "breath_proto_soma_edu": {
+   "en": "Simple rhythmic connected pacing at 2 seconds in and 2 seconds out — useful when you want a steady musical-feel loop without holds.",
+   "ar": "إيقاع متصل بسيط بثانيتين شهيقًا وثانيتين زفيرًا — مفيد حين تريد حلقة ثابتة ذات إحساس موسيقي دون حبس."
+  },
+  "breath_proto_soma_session_hint": {
+   "en": "Often 20+ minutes; pick a length that fits.",
+   "ar": "غالبًا 20 دقيقة أو أكثر؛ اختر مدة تناسبك."
+  },
+  "breath_proto_soma_subtitle": {
+   "en": "2s in · 2s out · rhythmic",
+   "ar": "ثانيتان شهيق · ثانيتان زفير · إيقاعي"
+  },
+  "breath_proto_tummo_caution": {
+   "en": "Advanced. Avoid if pregnant, cardiovascular issues, or unwell. Not medical advice.",
+   "ar": "متقدّم. تجنّبه أثناء الحمل أو مع مشكلات قلبية وعائية أو عند التوعك. ليس نصيحة طبية."
+  },
+  "breath_proto_tummo_edu": {
+   "en": "A paced Tummo-inspired cycle using mid-range timings: short forced exhale, empty hold, slow inhale, full hold, slow exhale. Advanced and intense — keep sessions short and stop if strained.",
+   "ar": "دورة مستوحاة من التومو بتوقيتات متوسطة: زفير قسري قصير، حبس فارغ، شهيق بطيء، حبس ممتلئ، زفير بطيء. متقدّمة وشديدة — أبقِ الجلسات قصيرة وتوقف عند الإجهاد."
+  },
+  "breath_proto_tummo_session_hint": {
+   "en": "5–10 minutes unless experienced.",
+   "ar": "5–10 دقائق ما لم تكن متمرسًا."
+  },
+  "breath_proto_tummo_subtitle": {
+   "en": "Forced exhale · holds · slow in/out",
+   "ar": "زفير قسري · حبس · شهيق/زفير بطيء"
+  },
+  "breath_proto_tummo_title": {
+   "en": "Tummo",
+   "ar": "تومو"
+  },
+  "breath_proto_ujjayi_edu": {
+   "en": "Ujjayi (ocean) breath: slightly constrict the throat so the breath sounds like distant waves. Equal slow inhale and exhale through the nose (~4.5s each).",
+   "ar": "نفَس أوجايي (المحيط): ضيّق الحلق قليلًا حتى يبدو النفَس كأمواج بعيدة. شهيق وزفير بطيئان متساويان عبر الأنف (~4.5 ث لكل منهما)."
+  },
+  "breath_proto_ujjayi_session_hint": {
+   "en": "5–15 minutes.",
+   "ar": "5–15 دقيقة."
+  },
+  "breath_proto_ujjayi_subtitle": {
+   "en": "Ocean breath · soft throat",
+   "ar": "نفَس المحيط · حلق ليّن"
+  },
+  "breath_proto_ujjayi_title": {
+   "en": "Ujjayi",
+   "ar": "أوجايي"
+  },
+  "breath_proto_wim_hof_caution": {
+   "en": "Never practice in water or while driving. Stop if dizzy. Not medical advice.",
+   "ar": "لا تمارسه أبدًا في الماء أو أثناء القيادة. توقف عند الدوار. ليس نصيحة طبية."
+  },
+  "breath_proto_wim_hof_edu": {
+   "en": "Wim Hof–style rounds typically use ~30 deeper breaths, then an empty hold, then a recovery inhale hold (~15s). Because holds and intensity are personal, this entry is guided: follow a trusted protocol you already know; NOOP times the session and shows reminders — it does not force breath holds.",
+   "ar": "جولات بأسلوب فيم هوف تستخدم عادة نحو 30 نفَسًا أعمق، ثم حبسًا فارغًا، ثم حبس شهيق للتعافي (~15 ث). ولأن الحبس والشدة أمران شخصيان، هذا المدخل موجّه: اتبع بروتوكولًا موثوقًا تعرفه؛ يوقّت NOOP الجلسة ويعرض التذكيرات — ولا يفرض حبس النفس."
+  },
+  "breath_proto_wim_hof_session_hint": {
+   "en": "About 15 minutes for a few rounds.",
+   "ar": "نحو 15 دقيقة لبضع جولات."
+  },
+  "breath_proto_wim_hof_subtitle": {
+   "en": "Guided · rounds + holds",
+   "ar": "موجّه · جولات + حبس"
+  },
+  "breath_proto_wim_hof_title": {
+   "en": "Wim Hof",
+   "ar": "فيم هوف"
+  },
+  "breath_stage_belly_in": {
+   "en": "Belly in",
+   "ar": "البطن للداخل"
+  },
+  "breath_stage_belly_out": {
+   "en": "Belly out",
+   "ar": "البطن للخارج"
+  },
+  "breath_stage_exhale_left": {
+   "en": "Exhale left",
+   "ar": "زفير يسار"
+  },
+  "breath_stage_exhale_right": {
+   "en": "Exhale right",
+   "ar": "زفير يمين"
+  },
+  "breath_stage_force_out": {
+   "en": "Force out",
+   "ar": "زفير قسري"
+  },
+  "breath_stage_hold_empty": {
+   "en": "Hold empty",
+   "ar": "حبس فارغ"
+  },
+  "breath_stage_hold_full": {
+   "en": "Hold full",
+   "ar": "حبس ممتلئ"
+  },
+  "breath_stage_inhale_left": {
+   "en": "Inhale left",
+   "ar": "شهيق يسار"
+  },
+  "breath_stage_inhale_right": {
+   "en": "Inhale right",
+   "ar": "شهيق يمين"
+  },
+  "crash_recovery_body": {
+   "en": "The last crash is shown below. You can copy it for a bug report, then try opening the app again.",
+   "ar": "يظهر آخر تعطل أدناه. يمكنك نسخه لتقرير خطأ، ثم محاولة فتح التطبيق مرة أخرى."
+  },
+  "crash_recovery_continue": {
+   "en": "Try opening NOOP",
+   "ar": "محاولة فتح NOOP"
+  },
+  "crash_recovery_copy": {
+   "en": "Copy error",
+   "ar": "نسخ الخطأ"
+  },
+  "crash_recovery_title": {
+   "en": "NOOP stopped unexpectedly",
+   "ar": "توقف NOOP بشكل غير متوقع"
+  },
+  "cycle_day_range": {
+   "en": "· ~day %1$d–%2$d",
+   "ar": "· ~اليوم %1$d–%2$d"
+  },
+  "cycle_day_single": {
+   "en": "· ~day %1$d",
+   "ar": "· ~اليوم %1$d"
+  },
+  "cycle_home_description": {
+   "en": "Log period starts locally and use them to anchor optional cycle estimates.",
+   "ar": "سجّل بدايات الدورة محليًا واستخدمها كمرجع لتقديرات الدورة الاختيارية."
+  },
+  "cycle_home_latest": {
+   "en": "Latest period start",
+   "ar": "آخر بداية دورة"
+  },
+  "cycle_home_learning": {
+   "en": "Learning your pattern",
+   "ar": "جارٍ تعلّم نمطك"
+  },
+  "cycle_home_log_today": {
+   "en": "Log today",
+   "ar": "تسجيل اليوم"
+  },
+  "cycle_home_logged_today": {
+   "en": "Logged today",
+   "ar": "سُجِّل اليوم"
+  },
+  "cycle_home_open": {
+   "en": "Open tracker",
+   "ar": "فتح المتتبّع"
+  },
+  "cycle_home_private": {
+   "en": "Private, on-device tracking",
+   "ar": "تتبّع خاص على الجهاز"
+  },
+  "cycle_home_setup": {
+   "en": "Set up cycle tracking",
+   "ar": "إعداد تتبّع الدورة"
+  },
+  "cycle_home_title": {
+   "en": "Menstrual Cycle",
+   "ar": "الدورة الشهرية"
+  },
+  "cycle_phase_follicular": {
+   "en": "Follicular",
+   "ar": "الطور الجريبي"
+  },
+  "cycle_phase_learning": {
+   "en": "Learning your pattern",
+   "ar": "جارٍ تعلّم نمطك"
+  },
+  "cycle_phase_luteal": {
+   "en": "Luteal",
+   "ar": "الطور الأصفري"
+  },
+  "cycle_phase_mid_cycle": {
+   "en": "Mid-cycle shift",
+   "ar": "تحوّل منتصف الدورة"
+  },
+  "cycle_phase_unclear": {
+   "en": "No clear pattern",
+   "ar": "لا نمط واضح"
+  },
+  "cycle_tracker_already_logged": {
+   "en": "Already logged",
+   "ar": "مُسجَّل بالفعل"
+  },
+  "cycle_tracker_anchor_help": {
+   "en": "This optional date anchors cycle day 1 and is checked against your nightly temperature pattern.",
+   "ar": "هذا التاريخ الاختياري يحدّد اليوم الأول من الدورة ويُقارن بنمط حرارتك الليلية."
+  },
+  "cycle_tracker_cancel": {
+   "en": "Cancel",
+   "ar": "إلغاء"
+  },
+  "cycle_tracker_current_estimate": {
+   "en": "Current estimate",
+   "ar": "التقدير الحالي"
+  },
+  "cycle_tracker_day_range": {
+   "en": "~day %1$d–%2$d",
+   "ar": "~اليوم %1$d–%2$d"
+  },
+  "cycle_tracker_day_single": {
+   "en": "~day %1$d",
+   "ar": "~اليوم %1$d"
+  },
+  "cycle_tracker_delete_all": {
+   "en": "Delete all",
+   "ar": "حذف الكل"
+  },
+  "cycle_tracker_delete_day": {
+   "en": "Delete %1$s",
+   "ar": "حذف %1$s"
+  },
+  "cycle_tracker_delete_message": {
+   "en": "This permanently removes the on-device period-start history. Sensor history is not changed.",
+   "ar": "يزيل هذا نهائيًا سجل بدايات الدورة المخزّن على الجهاز. لا يتغير سجل المستشعرات."
+  },
+  "cycle_tracker_delete_title": {
+   "en": "Delete all logged period starts?",
+   "ar": "حذف كل بدايات الدورة المسجّلة؟"
+  },
+  "cycle_tracker_done": {
+   "en": "Done",
+   "ar": "تم"
+  },
+  "cycle_tracker_empty": {
+   "en": "No period starts logged yet.",
+   "ar": "لم تُسجَّل أي بدايات دورة بعد."
+  },
+  "cycle_tracker_likely_window": {
+   "en": "Likely period window: %1$s–%2$s. This is a range, not a fixed date.",
+   "ar": "نافذة الدورة المرجّحة: %1$s–%2$s. هذا نطاق وليس تاريخًا محددًا."
+  },
+  "cycle_tracker_log_action": {
+   "en": "Log period start",
+   "ar": "تسجيل بداية دورة"
+  },
+  "cycle_tracker_log_heading": {
+   "en": "Log a period start",
+   "ar": "سجّل بداية دورة"
+  },
+  "cycle_tracker_logged_starts": {
+   "en": "Logged starts",
+   "ar": "البدايات المسجّلة"
+  },
+  "cycle_tracker_privacy": {
+   "en": "This never leaves your device unless you export a backup yourself.",
+   "ar": "لا يغادر هذا جهازك أبدًا ما لم تُصدّر نسخة احتياطية بنفسك."
+  },
+  "cycle_tracker_title": {
+   "en": "Cycle tracker",
+   "ar": "متتبّع الدورة"
+  },
+  "deep_timeline_title": {
+   "en": "Deep Timeline",
+   "ar": "الجدول الزمني العميق"
+  },
+  "explore_all_history": {
+   "en": "all history",
+   "ar": "كل السجل"
+  },
+  "explore_average": {
+   "en": "Average",
+   "ar": "المتوسط"
+  },
+  "explore_category_charge": {
+   "en": "Charge",
+   "ar": "الشحن"
+  },
+  "explore_category_effort": {
+   "en": "Effort",
+   "ar": "الجهد"
+  },
+  "explore_category_health": {
+   "en": "Health",
+   "ar": "الصحة"
+  },
+  "explore_category_heart": {
+   "en": "Heart",
+   "ar": "القلب"
+  },
+  "explore_category_mind": {
+   "en": "Mind",
+   "ar": "الذهن"
+  },
+  "explore_category_nutrition": {
+   "en": "Nutrition",
+   "ar": "التغذية"
+  },
+  "explore_category_rest": {
+   "en": "Rest",
+   "ar": "الراحة"
+  },
+  "explore_chart_points": {
+   "en": "Points",
+   "ar": "النقاط"
+  },
+  "explore_chart_window": {
+   "en": "Window",
+   "ar": "النافذة"
+  },
+  "explore_deep_timeline_hint": {
+   "en": "Every second of your day, zoomable.",
+   "ar": "كل ثانية من يومك، قابلة للتكبير."
+  },
+  "explore_delta_vs_prev": {
+   "en": "Δ vs prev",
+   "ar": "Δ مقارنة بالسابق"
+  },
+  "explore_description_charge": {
+   "en": "How recovered you are, led by HRV versus your personal baseline.",
+   "ar": "مدى تعافيك، يقوده تقلب النبض مقارنةً بخط الأساس الخاص بك."
+  },
+  "explore_description_effort": {
+   "en": "Cardiovascular load for the day, on a 0-100 scale (was 0-21).",
+   "ar": "الحمل القلبي الوعائي لليوم، على مقياس 0-100 (كان 0-21)."
+  },
+  "explore_description_rest": {
+   "en": "How restorative your sleep was: duration, efficiency, deep+REM, timing.",
+   "ar": "مدى استعادة نومك: المدة، والكفاءة، والنوم العميق وREM، والتوقيت."
+  },
+  "explore_empty_metric": {
+   "en": "No %1$s recorded yet. Sync your strap to populate this trend.",
+   "ar": "لم يُسجَّل %1$s بعد. زامن سوارك لتعبئة هذا الاتجاه."
+  },
+  "explore_import_body": {
+   "en": "Import your history first. A WHOOP export in Data Sources fills every metric you can explore here in about a minute.",
+   "ar": "استورد سجلك أولًا. ملف تصدير WHOOP في «مصادر البيانات» يملأ كل مقياس يمكنك استكشافه هنا في نحو دقيقة."
+  },
+  "explore_import_title": {
+   "en": "Import your history first",
+   "ar": "استورد سجلك أولًا"
+  },
+  "explore_latest": {
+   "en": "Latest",
+   "ar": "الأحدث"
+  },
+  "explore_max": {
+   "en": "Max",
+   "ar": "الأقصى"
+  },
+  "explore_metric_average_heart_rate": {
+   "en": "Average Heart Rate",
+   "ar": "متوسط معدل النبض"
+  },
+  "explore_metric_calories_in": {
+   "en": "Calories In",
+   "ar": "السعرات المتناولة"
+  },
+  "explore_metric_carbs": {
+   "en": "Carbs",
+   "ar": "الكربوهيدرات"
+  },
+  "explore_metric_fat": {
+   "en": "Fat",
+   "ar": "الدهون"
+  },
+  "explore_metric_max_heart_rate": {
+   "en": "Max Heart Rate",
+   "ar": "أقصى معدل نبض"
+  },
+  "explore_metric_mood": {
+   "en": "Mood",
+   "ar": "المزاج"
+  },
+  "explore_metric_protein": {
+   "en": "Protein",
+   "ar": "البروتين"
+  },
+  "explore_min": {
+   "en": "Min",
+   "ar": "الأدنى"
+  },
+  "explore_n_pts": {
+   "en": "%1$d pts",
+   "ar": "%1$d نقطة"
+  },
+  "explore_no_prior_window": {
+   "en": "no prior %1$s",
+   "ar": "لا %1$s سابقة"
+  },
+  "explore_over_visible_window": {
+   "en": "Over the visible window",
+   "ar": "خلال النافذة الظاهرة"
+  },
+  "explore_pick_metric": {
+   "en": "Pick metric",
+   "ar": "اختر مقياسًا"
+  },
+  "explore_single_reading": {
+   "en": "Only one reading in range — widen the window to see a trend.",
+   "ar": "قراءة واحدة فقط في النطاق — وسّع النافذة لرؤية اتجاه."
+  },
+  "explore_subtitle": {
+   "en": "Every signal, one tap deep.",
+   "ar": "كل إشارة، على بُعد نقرة واحدة."
+  },
+  "explore_summary": {
+   "en": "Summary",
+   "ar": "الملخص"
+  },
+  "explore_vs_prev_window": {
+   "en": "vs prev %1$s",
+   "ar": "مقارنةً بـ %1$s السابقة"
+  },
+  "fast_history_sync": {
+   "en": "Faster history sync (experimental)",
+   "ar": "مزامنة سجل أسرع (تجريبي)"
+  },
+  "fast_history_sync_desc": {
+   "en": "Ask Android for a faster Bluetooth link while your strap hands over its stored history, so a big backlog catches up sooner. Only during the sync itself — your live heart rate and the overnight stream are untouched. New and unproven: if it doesn\\'t help, or costs more battery than it\\'s worth, turn it back off and say so on the issue tracker.",
+   "ar": "يطلب من Android اتصال Bluetooth أسرع بينما يسلّم سوارك سجله المخزّن، حتى يلحق التراكم الكبير أسرع. أثناء المزامنة نفسها فقط — لا يتأثر نبضك المباشر ولا البث الليلي. جديدة وغير مثبتة: إن لم تساعد أو كلّفت بطارية أكثر مما تستحق، أعد إيقافها وأخبرنا في متتبّع المشكلات."
+  },
+  "fast_link_phy": {
+   "en": "Faster Bluetooth link (experimental)",
+   "ar": "اتصال Bluetooth أسرع (تجريبي)"
+  },
+  "fast_link_phy_desc": {
+   "en": "Ask for a faster Bluetooth radio mode while your strap hands over its stored history. Sends the same data in less airtime, so it may sync sooner and use a little less strap battery — but your strap has to support it, and it trades some range for speed. New and unproven: if syncing gets flaky when your phone is further away, turn it back off.",
+   "ar": "يطلب وضع راديو Bluetooth أسرع بينما يسلّم سوارك سجله المخزّن. يرسل البيانات نفسها في وقت بث أقل، فقد تتم المزامنة أسرع وتوفّر قليلًا من بطارية السوار — لكن على سوارك أن يدعمه، وهو يقايض بعض المدى بالسرعة. جديدة وغير مثبتة: إن صارت المزامنة غير مستقرة حين يبتعد هاتفك، أعد إيقافها."
+  },
+  "fgs_action_disconnect": {
+   "en": "Disconnect",
+   "ar": "قطع الاتصال"
+  },
+  "fgs_channel_desc": {
+   "en": "Shown while NOOP keeps your WHOOP connected in the background.",
+   "ar": "يظهر بينما يُبقي NOOP اتصال WHOOP في الخلفية."
+  },
+  "fgs_channel_name": {
+   "en": "Strap connection",
+   "ar": "اتصال السوار"
+  },
+  "fgs_detail_battery": {
+   "en": "Strap %1$d%%",
+   "ar": "السوار %1$d%%"
+  },
+  "fgs_detail_keeping_link": {
+   "en": "Keeping the link open",
+   "ar": "إبقاء الاتصال مفتوحًا"
+  },
+  "fgs_detail_recovery": {
+   "en": "Recovery %1$d%%",
+   "ar": "التعافي %1$d%%"
+  },
+  "fgs_detail_streaming": {
+   "en": "Streaming in the background",
+   "ar": "بث في الخلفية"
+  },
+  "fgs_title_connected": {
+   "en": "Connected to your WHOOP",
+   "ar": "متصل بـ WHOOP"
+  },
+  "fgs_title_reconnecting": {
+   "en": "Reconnecting to your WHOOP…",
+   "ar": "إعادة الاتصال بـ WHOOP…"
+  },
+  "fgs_title_syncing": {
+   "en": "Syncing strap history…",
+   "ar": "مزامنة سجل السوار…"
+  },
+  "ground_truth_add_historical": {
+   "en": "Add past time window",
+   "ar": "إضافة نافذة زمنية سابقة"
+  },
+  "ground_truth_add_marker": {
+   "en": "Add marker",
+   "ar": "إضافة علامة"
+  },
+  "ground_truth_band_connected_paired": {
+   "en": "Band: connected + paired",
+   "ar": "السوار: متصل + مقترن"
+  },
+  "ground_truth_band_connected_pairing": {
+   "en": "Band: connected; pairing",
+   "ar": "السوار: متصل؛ جارٍ الاقتران"
+  },
+  "ground_truth_band_disconnected": {
+   "en": "Band: disconnected",
+   "ar": "السوار: غير متصل"
+  },
+  "ground_truth_band_searching": {
+   "en": "Band: disconnected; searching",
+   "ar": "السوار: غير متصل؛ جارٍ البحث"
+  },
+  "ground_truth_cancel": {
+   "en": "Cancel",
+   "ar": "إلغاء"
+  },
+  "ground_truth_capture_status": {
+   "en": "Capture status",
+   "ar": "حالة التسجيل"
+  },
+  "ground_truth_comment": {
+   "en": "Session comment",
+   "ar": "تعليق الجلسة"
+  },
+  "ground_truth_coverage": {
+   "en": "%1$d/%2$d s · %3$.1f%% · %4$d s missing%5$s",
+   "ar": "%1$d/%2$d ث · %3$.1f%% · %4$d ث مفقودة%5$s"
+  },
+  "ground_truth_coverage_startup": {
+   "en": " · %1$d s startup",
+   "ar": " · %1$d ث بدء"
+  },
+  "ground_truth_delete_all": {
+   "en": "Delete all sessions",
+   "ar": "حذف كل الجلسات"
+  },
+  "ground_truth_delete_all_message": {
+   "en": "All %1$d recorded sessions and their captured raw data will be deleted permanently.",
+   "ar": "ستُحذف نهائيًا كل الجلسات المسجّلة البالغة %1$d وبياناتها الخام."
+  },
+  "ground_truth_delete_all_title": {
+   "en": "Delete all sessions?",
+   "ar": "حذف كل الجلسات؟"
+  },
+  "ground_truth_delete_confirm": {
+   "en": "Delete",
+   "ar": "حذف"
+  },
+  "ground_truth_delete_session": {
+   "en": "Delete session",
+   "ar": "حذف الجلسة"
+  },
+  "ground_truth_delete_session_message": {
+   "en": "The session %1$s and its captured raw data will be deleted permanently.",
+   "ar": "ستُحذف الجلسة %1$s وبياناتها الخام نهائيًا."
+  },
+  "ground_truth_delete_session_title": {
+   "en": "Delete this session?",
+   "ar": "حذف هذه الجلسة؟"
+  },
+  "ground_truth_edit_end": {
+   "en": "Edit end",
+   "ar": "تعديل النهاية"
+  },
+  "ground_truth_edit_marker": {
+   "en": "Edit marker",
+   "ar": "تعديل العلامة"
+  },
+  "ground_truth_edit_start": {
+   "en": "Edit start",
+   "ar": "تعديل البداية"
+  },
+  "ground_truth_export": {
+   "en": "Export session",
+   "ar": "تصدير الجلسة"
+  },
+  "ground_truth_export_failed": {
+   "en": "Couldn’t export session: %1$s",
+   "ar": "تعذّر تصدير الجلسة: %1$s"
+  },
+  "ground_truth_exporting": {
+   "en": "Building export…",
+   "ar": "جارٍ إنشاء التصدير…"
+  },
+  "ground_truth_history_completed": {
+   "en": "History sync completed: %1$s",
+   "ar": "اكتملت مزامنة السجل: %1$s"
+  },
+  "ground_truth_history_none": {
+   "en": "History sync: no completed sync recorded",
+   "ar": "مزامنة السجل: لا توجد مزامنة مكتملة مسجّلة"
+  },
+  "ground_truth_history_running": {
+   "en": "History sync: running (%1$d chunks)",
+   "ar": "مزامنة السجل: جارية (%1$d أجزاء)"
+  },
+  "ground_truth_last_exported": {
+   "en": "Last exported %1$s · export remains available",
+   "ar": "آخر تصدير %1$s · التصدير ما زال متاحًا"
+  },
+  "ground_truth_legacy_no_sensors": {
+   "en": "Legacy session: event export is available, but its strap cannot be identified for sensor export.",
+   "ar": "جلسة قديمة: تصدير الأحداث متاح، لكن يتعذّر تحديد سوارها لتصدير المستشعرات."
+  },
+  "ground_truth_marker_end": {
+   "en": "End",
+   "ar": "نهاية"
+  },
+  "ground_truth_marker_issue": {
+   "en": "Issue",
+   "ar": "مشكلة"
+  },
+  "ground_truth_marker_moment": {
+   "en": "Moment",
+   "ar": "لحظة"
+  },
+  "ground_truth_marker_note": {
+   "en": "Marker note",
+   "ar": "ملاحظة العلامة"
+  },
+  "ground_truth_marker_start": {
+   "en": "Start",
+   "ar": "بداية"
+  },
+  "ground_truth_marker_times": {
+   "en": "Marker %1$s · Now %2$s",
+   "ar": "العلامة %1$s · الآن %2$s"
+  },
+  "ground_truth_no_sessions": {
+   "en": "No sessions recorded yet.",
+   "ar": "لم تُسجَّل أي جلسات بعد."
+  },
+  "ground_truth_open": {
+   "en": "Open raw-data collector",
+   "ar": "فتح جامع البيانات الخام"
+  },
+  "ground_truth_ready_complete": {
+   "en": "Ready to export · complete",
+   "ar": "جاهز للتصدير · مكتمل"
+  },
+  "ground_truth_ready_missing": {
+   "en": "Ready with %1$d s missing · history may repair it",
+   "ar": "جاهز مع %1$d ث مفقودة · قد يصلحها السجل"
+  },
+  "ground_truth_ready_no_imu": {
+   "en": "Ready without IMU data",
+   "ar": "جاهز دون بيانات IMU"
+  },
+  "ground_truth_realtime_imu": {
+   "en": "Realtime IMU: %1$s; %2$d packets / %3$d bytes%4$s",
+   "ar": "‏IMU مباشر: %1$s؛ %2$d حزمة / %3$d بايت%4$s"
+  },
+  "ground_truth_realtime_last": {
+   "en": "; last %1$s ago",
+   "ar": "؛ آخرها قبل %1$s"
+  },
+  "ground_truth_recording": {
+   "en": "Recording · %1$s",
+   "ar": "تسجيل · %1$s"
+  },
+  "ground_truth_save": {
+   "en": "Save",
+   "ar": "حفظ"
+  },
+  "ground_truth_sensors_behind": {
+   "en": "Decoded 1 Hz sensors: %1$s behind",
+   "ar": "مستشعرات 1 هرتز المفكوكة: متأخرة %1$s"
+  },
+  "ground_truth_sensors_none": {
+   "en": "Decoded 1 Hz sensors: none",
+   "ar": "مستشعرات 1 هرتز المفكوكة: لا شيء"
+  },
+  "ground_truth_sessions": {
+   "en": "Recorded sessions",
+   "ar": "الجلسات المسجّلة"
+  },
+  "ground_truth_start": {
+   "en": "Start raw-data session",
+   "ar": "بدء جلسة بيانات خام"
+  },
+  "ground_truth_stop": {
+   "en": "Stop session",
+   "ar": "إيقاف الجلسة"
+  },
+  "ground_truth_subtitle": {
+   "en": "Record a bounded 100 Hz motion session, recover Bluetooth gaps from strap history, and export the complete timeline.",
+   "ar": "سجّل جلسة حركة محدودة بتردد 100 هرتز، واسترجع فجوات Bluetooth من سجل السوار، وصدّر الجدول الزمني الكامل."
+  },
+  "ground_truth_test_centre_desc": {
+   "en": "Record, annotate, recover, and export a bounded 5/MG 100 Hz motion capture.",
+   "ar": "تسجيل وتوصيف واسترجاع وتصدير التقاط حركة محدود بتردد 100 هرتز لـ 5/MG."
+  },
+  "ground_truth_title": {
+   "en": "5/MG Raw Data Collector",
+   "ar": "جامع البيانات الخام 5/MG"
+  },
+  "ground_truth_waiting_history": {
+   "en": "Waiting for history through %1$s",
+   "ar": "في انتظار السجل حتى %1$s"
+  },
+  "ground_truth_waiting_imu": {
+   "en": "waiting for IMU",
+   "ar": "في انتظار IMU"
+  },
+  "haptics_breathing_label": {
+   "en": "Breathing pacer",
+   "ar": "موجّه إيقاع التنفس"
+  },
+  "haptics_intervals_label": {
+   "en": "Interval timer",
+   "ar": "مؤقّت الفترات"
+  },
+  "haptics_live_session_label": {
+   "en": "Live Session cues",
+   "ar": "تنبيهات الجلسة المباشرة"
+  },
+  "haptics_section_title": {
+   "en": "Haptics",
+   "ar": "الاهتزاز"
+  },
+  "haptics_workout_label": {
+   "en": "Workout start & end",
+   "ar": "بداية التمرين ونهايته"
+  },
+  "health_connect_categories_detail": {
+   "en": "Select the Health Connect categories to import. You can change this later.",
+   "ar": "اختر فئات Health Connect المراد استيرادها. يمكنك تغيير ذلك لاحقًا."
+  },
+  "health_connect_categories_title": {
+   "en": "Choose what NOOP can read",
+   "ar": "اختر ما يمكن لـ NOOP قراءته"
+  },
+  "health_connect_category_activity": {
+   "en": "Activity",
+   "ar": "النشاط"
+  },
+  "health_connect_category_activity_detail": {
+   "en": "Steps, calories, workouts, distance, and VO₂ max",
+   "ar": "الخطوات والسعرات والتمارين والمسافة وVO₂ max"
+  },
+  "health_connect_category_body_composition": {
+   "en": "Body composition",
+   "ar": "تركيب الجسم"
+  },
+  "health_connect_category_body_composition_detail": {
+   "en": "Weight, body fat, and lean mass",
+   "ar": "الوزن ونسبة الدهون والكتلة الصافية"
+  },
+  "health_connect_category_recovery": {
+   "en": "Recovery & wellness",
+   "ar": "التعافي والعافية"
+  },
+  "health_connect_category_recovery_detail": {
+   "en": "Heart rate, HRV, sleep, SpO₂, breathing, and hydration",
+   "ar": "معدل النبض وتقلب النبض والنوم وSpO₂ والتنفس والترطيب"
+  },
+  "illness_alert_title": {
+   "en": "Early warning: take it easy",
+   "ar": "إنذار مبكر: خفّف من نشاطك"
+  },
+  "inactivity_title": {
+   "en": "Move reminder",
+   "ar": "تذكير بالحركة"
+  },
+  "intervals_range_step": {
+   "en": "%1$s – %2$s%3$s · step %4$d",
+   "ar": "%1$s – %2$s%3$s · خطوة %4$d"
+  },
+  "keep_alive_needed_vendor": {
+   "en": "Your phone (%1$s) can stop background apps to save battery, which can make NOOP miss overnight sleep and recovery data. Tap Allow to whitelist NOOP.\\n\\nAndroid will ask “Stop optimising battery usage?” and warn that NOOP may drain your battery — that\\'s its standard wording for any app allowed to run in the background. Tap Allow. The battery goes on the overnight sync you already switched on above; this only stops Android cutting it short.",
+   "ar": "قد يوقف هاتفك (%1$s) التطبيقات العاملة في الخلفية لتوفير البطارية، مما قد يجعل NOOP يفوّت بيانات النوم والتعافي الليلية. اضغط «سماح» لإضافة NOOP إلى الاستثناءات.\\n\\nسيسأل Android «إيقاف تحسين استخدام البطارية؟» وينبّه إلى أن NOOP قد يستنزف البطارية — وهذه صياغته المعتادة لأي تطبيق يُسمح له بالعمل في الخلفية. اضغط «سماح». تُستهلك البطارية في المزامنة الليلية التي فعّلتها بالفعل أعلاه؛ وهذا يمنع Android فقط من قطعها."
+  },
+  "l10n_add_device_wizard_a_whoop_strap_bonds_to_a_d39bdf4a": {
+   "en": "A WHOOP strap bonds to a single device. While it\\'s connected to NOOP it won\\'t stream ",
+   "ar": "يقترن سوار WHOOP بجهاز واحد فقط. وأثناء اتصاله بـ NOOP لن يبثّ "
+  },
+  "l10n_add_device_wizard_add_61cc55aa": {
+   "en": "Add",
+   "ar": "إضافة"
+  },
+  "l10n_add_device_wizard_advanced_i_already_have_my_ring_e87b9b49": {
+   "en": "Advanced: I already have my ring\\'s key",
+   "ar": "متقدّم: لديّ مفتاح خاتمي بالفعل"
+  },
+  "l10n_add_device_wizard_back_b52b36b7": {
+   "en": "Back",
+   "ar": "رجوع"
+  },
+  "l10n_add_device_wizard_beta_is_an_on_device_estimate_128563e0": {
+   "en": "Beta. * is an on-device estimate. Skin temp is a trend versus your own baseline, steps ",
+   "ar": "إصدار تجريبي. * تقدير على الجهاز. حرارة الجلد اتجاه مقارنةً بخط الأساس الخاص بك، والخطوات "
+  },
+  "l10n_add_device_wizard_both_noop_and_the_oura_app_4f219db3": {
+   "en": "Both NOOP and the Oura app can use a ring you own by key, but only one can hold the Bluetooth link at a time.",
+   "ar": "يمكن لكل من NOOP وتطبيق Oura استخدام خاتم تملكه عبر المفتاح، لكن واحدًا فقط يمكنه الاحتفاظ باتصال Bluetooth في كل مرة."
+  },
+  "l10n_add_device_wizard_cancel_77dfd213": {
+   "en": "Cancel",
+   "ar": "إلغاء"
+  },
+  "l10n_add_device_wizard_close_bbfa773e": {
+   "en": "Close",
+   "ar": "إغلاق"
+  },
+  "l10n_add_device_wizard_connect_to_this_ring_02b9442b": {
+   "en": "Connect to this ring",
+   "ar": "الاتصال بهذا الخاتم"
+  },
+  "l10n_add_device_wizard_continue_2e026239": {
+   "en": "Continue",
+   "ar": "متابعة"
+  },
+  "l10n_add_device_wizard_device_name_79d7a157": {
+   "en": "Device name",
+   "ar": "اسم الجهاز"
+  },
+  "l10n_add_device_wizard_experimental_best_effort_support_we_re_db288aa8": {
+   "en": "Experimental, best-effort support. We\\'re still testing these, so they might not connect on every device. They never make up data, and they\\'ll tell you honestly when live isn\\'t possible.",
+   "ar": "دعم تجريبي بأفضل جهد ممكن. ما زلنا نختبرها، لذا قد لا تتصل على كل جهاز. لا تختلق البيانات أبدًا، وستخبرك بصدق حين يتعذّر البث المباشر."
+  },
+  "l10n_add_device_wizard_i_understand_this_disconnects_the_ring_66bbb125": {
+   "en": "I understand this disconnects the ring from Oura and that NOOP cannot undo it for me. To go back to Oura I would factory-reset the ring again and set it up in the Oura app.",
+   "ar": "أفهم أن هذا يفصل الخاتم عن Oura وأن NOOP لا يستطيع التراجع عن ذلك نيابةً عني. وللعودة إلى Oura سأعيد ضبط الخاتم لإعدادات المصنع وأعدّه في تطبيق Oura."
+  },
+  "l10n_add_device_wizard_i_understand_this_disconnects_the_ring_ccbb3225": {
+   "en": "I understand this disconnects the ring from Oura and that NOOP cannot undo it for me.",
+   "ar": "أفهم أن هذا يفصل الخاتم عن Oura وأن NOOP لا يستطيع التراجع عن ذلك نيابةً عني."
+  },
+  "l10n_add_device_wizard_installing_noop_s_key_and_confirming_aab5cf61": {
+   "en": "Installing NOOP\\'s key and confirming the ring answers only to NOOP. Keep the ring close and do not open the Oura app.",
+   "ar": "جارٍ تثبيت مفتاح NOOP والتأكد من أن الخاتم يستجيب لـ NOOP وحده. أبقِ الخاتم قريبًا ولا تفتح تطبيق Oura."
+  },
+  "l10n_add_device_wizard_keep_the_oura_app_instead_import_60d70411": {
+   "en": "Keep the Oura app instead (import a file)",
+   "ar": "الإبقاء على تطبيق Oura بدلًا من ذلك (استيراد ملف)"
+  },
+  "l10n_add_device_wizard_make_active_75690bb8": {
+   "en": "Make active",
+   "ar": "تعيينه نشطًا"
+  },
+  "l10n_add_device_wizard_make_confirmname_your_active_device_now_90ceb73e": {
+   "en": "Make %1$s your active device now? It will provide your live data. You can change ",
+   "ar": "تعيين %1$s جهازك النشط الآن؟ سيوفّر بياناتك المباشرة. يمكنك التغيير "
+  },
+  "l10n_add_device_wizard_make_sure_it_s_awake_and_8c40e59f": {
+   "en": "Make sure it\\'s awake and not connected elsewhere.",
+   "ar": "تأكد من أنه مستيقظ وغير متصل بمكان آخر."
+  },
+  "l10n_add_device_wizard_make_this_your_active_device_b425485c": {
+   "en": "Make this your active device?",
+   "ar": "تعيين هذا جهازك النشط؟"
+  },
+  "l10n_add_device_wizard_name_signal_signalbars_level_rssi_of_6aa514f6": {
+   "en": "%1$s, signal %2$s of 4",
+   "ar": "%1$s، الإشارة %2$s من 4"
+  },
+  "l10n_add_device_wizard_noop_stores_this_key_only_on_eae4e63f": {
+   "en": "NOOP stores this key only on this device, in the same place it stores your paired bands.",
+   "ar": "يخزّن NOOP هذا المفتاح على هذا الجهاز فقط، في المكان نفسه الذي يخزّن فيه أساورك المقترنة."
+  },
+  "l10n_add_device_wizard_noop_will_install_its_own_key_d3f6321e": {
+   "en": "NOOP will install its own key on the ring and become its owner. The Oura app will no longer control this ring. This is intended and it cannot be undone from NOOP.",
+   "ar": "سيثبّت NOOP مفتاحه الخاص على الخاتم ويصبح مالكه. لن يتحكم تطبيق Oura بهذا الخاتم بعد الآن. هذا مقصود ولا يمكن التراجع عنه من NOOP."
+  },
+  "l10n_add_device_wizard_not_now_e4571490": {
+   "en": "Not now",
+   "ar": "ليس الآن"
+  },
+  "l10n_add_device_wizard_not_showing_up_make_sure_you_60a8a61b": {
+   "en": "Not showing up? Make sure you reset the ring in the Oura app and force-quit it, then tap Rescan. A ring still owned by Oura will not list here.",
+   "ar": "لا يظهر؟ تأكد من إعادة ضبط الخاتم في تطبيق Oura وإغلاق التطبيق تمامًا، ثم اضغط «إعادة البحث». الخاتم الذي ما زالت Oura تملكه لن يظهر هنا."
+  },
+  "l10n_add_device_wizard_one_phone_at_a_time_cff4ff44": {
+   "en": "One phone at a time",
+   "ar": "هاتف واحد في كل مرة"
+  },
+  "l10n_add_device_wizard_oura_ring_e3431536": {
+   "en": "Oura ring",
+   "ar": "خاتم Oura"
+  },
+  "l10n_add_device_wizard_rescan_84661f6a": {
+   "en": "Rescan",
+   "ar": "إعادة البحث"
+  },
+  "l10n_add_device_wizard_ring_key_32_hex_characters_28cb7e4a": {
+   "en": "Ring key, 32 hex characters",
+   "ar": "مفتاح الخاتم، 32 رمزًا ست عشريًا"
+  },
+  "l10n_add_device_wizard_scan_28cba55d": {
+   "en": "Scan",
+   "ar": "بحث"
+  },
+  "l10n_add_device_wizard_scan_for_type_title_be2c98fb": {
+   "en": "Scan for %1$s",
+   "ar": "البحث عن %1$s"
+  },
+  "l10n_add_device_wizard_scan_for_your_ring_e92b3a3b": {
+   "en": "Scan for your ring",
+   "ar": "ابحث عن خاتمك"
+  },
+  "l10n_add_device_wizard_searching_1a6a5ba8": {
+   "en": "Searching…",
+   "ar": "جارٍ البحث…"
+  },
+  "l10n_add_device_wizard_take_over_2c7f5505": {
+   "en": "Take over",
+   "ar": "الاستحواذ"
+  },
+  "l10n_add_device_wizard_take_over_this_ring_cc79ef5e": {
+   "en": "Take over this ring?",
+   "ar": "الاستحواذ على هذا الخاتم؟"
+  },
+  "l10n_add_device_wizard_take_over_this_ring_f199dc22": {
+   "en": "Take over this ring",
+   "ar": "الاستحواذ على هذا الخاتم"
+  },
+  "l10n_add_device_wizard_taking_over_your_ring_b64a3852": {
+   "en": "Taking over your ring",
+   "ar": "جارٍ الاستحواذ على خاتمك"
+  },
+  "l10n_add_device_wizard_that_is_not_a_32_character_d42ca20d": {
+   "en": "That is not a 32-character hex key.",
+   "ar": "هذا ليس مفتاحًا ست عشريًا من 32 رمزًا."
+  },
+  "l10n_add_device_wizard_the_ring_is_not_bricked_to_5efd1b3d": {
+   "en": "The ring is not bricked. To go back to where you started, factory-reset it again and set it ",
+   "ar": "الخاتم ليس معطلًا. وللعودة إلى ما كنت عليه، أعد ضبطه لإعدادات المصنع مرة أخرى وأعدّه "
+  },
+  "l10n_add_device_wizard_try_again_042c862e": {
+   "en": "Try again",
+   "ar": "إعادة المحاولة"
+  },
+  "l10n_add_device_wizard_use_file_import_0e092cb4": {
+   "en": "Use file import",
+   "ar": "استخدام استيراد ملف"
+  },
+  "l10n_add_device_wizard_we_could_not_take_over_this_fec1ce93": {
+   "en": "We could not take over this ring.",
+   "ar": "تعذّر الاستحواذ على هذا الخاتم."
+  },
+  "l10n_add_device_wizard_whoop_5_0_mg_support_is_e452e686": {
+   "en": "WHOOP 5.0 / MG support is newer and still experimental in NOOP.",
+   "ar": "دعم WHOOP 5.0 / MG أحدث وما زال تجريبيًا في NOOP."
+  },
+  "l10n_add_device_wizard_whoop_is_noop_s_primary_fully_ac6fa33b": {
+   "en": "WHOOP is NOOP\\'s primary, fully-supported band. Other heart-rate straps stream live heart rate and HRV, but not WHOOP\\'s deeper sleep and recovery data.",
+   "ar": "‏WHOOP هو السوار الأساسي المدعوم بالكامل في NOOP. الأساور الأخرى تبثّ معدل النبض وتقلب النبض مباشرةً، لكن دون بيانات النوم والتعافي الأعمق الخاصة بـ WHOOP."
+  },
+  "l10n_app_changelog_5_mg_bonding_on_android_health_c94c46ac": {
+   "en": "5/MG bonding on Android + Health Monitor fix",
+   "ar": "اقتران 5/MG على Android + إصلاح Health Monitor"
+  },
+  "l10n_app_changelog_a_beautiful_new_look_aa8c910c": {
+   "en": "A beautiful new look",
+   "ar": "مظهر جديد جميل"
+  },
+  "l10n_app_changelog_a_big_bug_fix_sweep_with_65335764": {
+   "en": "A big bug-fix sweep, with the Test Centre to back it up",
+   "ar": "موجة كبيرة من إصلاح الأخطاء، بدعم من مركز الاختبار"
+  },
+  "l10n_app_changelog_a_big_one_smarter_sleep_naps_8d7745c6": {
+   "en": "A big one: smarter sleep, naps, more devices, and a load of fixes",
+   "ar": "تحديث كبير: نوم أذكى، وقيلولات، وأجهزة أكثر، وكثير من الإصلاحات"
+  },
+  "l10n_app_changelog_a_bolder_today_screen_4efe8215": {
+   "en": "A bolder Today screen",
+   "ar": "شاشة «اليوم» أكثر جرأة"
+  },
+  "l10n_app_changelog_a_calmer_today_your_charge_explained_e4174303": {
+   "en": "A calmer Today, your Charge explained, and new HRV science under the hood",
+   "ar": "«اليوم» أهدأ، وشرح للشحن، وعلم جديد لتقلب النبض تحت الغطاء"
+  },
+  "l10n_app_changelog_a_cleaner_home_refreshed_design_a_8c91c06b": {
+   "en": "A cleaner home - refreshed design, a new inbox, your photo",
+   "ar": "شاشة رئيسية أنظف — تصميم محدّث، وصندوق وارد جديد، وصورتك"
+  },
+  "l10n_app_changelog_a_fresh_look_new_gold_on_6f379935": {
+   "en": "A fresh look - new gold-on-navy icon",
+   "ar": "مظهر جديد — أيقونة ذهبية على أزرق داكن"
+  },
+  "l10n_app_changelog_a_quick_fix_9cd2b7de": {
+   "en": "A quick fix",
+   "ar": "إصلاح سريع"
+  },
+  "l10n_app_changelog_a_round_of_fixes_reconnect_exports_7700d972": {
+   "en": "A round of fixes - reconnect, exports & Health setup",
+   "ar": "جولة إصلاحات — إعادة الاتصال والتصدير وإعداد Health"
+  },
+  "l10n_app_changelog_a_round_of_fixes_steps_insights_8f8e6010": {
+   "en": "A round of fixes - steps, Insights & Health setup",
+   "ar": "جولة إصلاحات — الخطوات والرؤى وإعداد Health"
+  },
+  "l10n_app_changelog_a_round_of_look_and_feel_196f6ef3": {
+   "en": "A round of look-and-feel polish",
+   "ar": "جولة تحسينات للمظهر والإحساس"
+  },
+  "l10n_app_changelog_a_small_honest_ask_32f2ec41": {
+   "en": "A small, honest ask",
+   "ar": "طلب صغير وصادق"
+  },
+  "l10n_app_changelog_a_smart_wake_alarm_live_workout_0ef814cc": {
+   "en": "A smart wake alarm, live workout mode, an editable Today, and lifting imports",
+   "ar": "منبّه استيقاظ ذكي، ووضع تمرين مباشر، و«اليوم» قابل للتحرير، واستيراد تمارين القوة"
+  },
+  "l10n_app_changelog_a_smoother_dashboard_on_big_histories_3e3a8dea": {
+   "en": "A smoother dashboard on big histories, and a clearer Smart Alarm",
+   "ar": "لوحة أكثر سلاسة مع السجلات الكبيرة، ومنبّه ذكي أوضح"
+  },
+  "l10n_app_changelog_a_sync_chip_on_today_clearer_37682fc9": {
+   "en": "A sync chip on Today, clearer strap-clock warnings, and complete German",
+   "ar": "مؤشر مزامنة في «اليوم»، وتحذيرات أوضح لساعة السوار، وألمانية كاملة"
+  },
+  "l10n_app_changelog_a_whole_new_look_titanium_gold_b40e0108": {
+   "en": "A whole new look - \"Titanium & Gold\"",
+   "ar": "مظهر جديد كليًا — «التيتانيوم والذهب»"
+  },
+  "l10n_app_changelog_a_whoop_5_that_stays_connected_7b490eee": {
+   "en": "A WHOOP 5 that stays connected, your body clock on the Sleep screen, and a Journal that knows No from nothing",
+   "ar": "‏WHOOP 5 يبقى متصلًا، وساعتك البيولوجية في شاشة النوم، ويوميات تميّز «لا» عن الفراغ"
+  },
+  "l10n_app_changelog_a_whoop_style_today_chart_clearer_9bdd13ff": {
+   "en": "A WHOOP-style Today chart, clearer sleep times - and a big iPhone update",
+   "ar": "رسم «اليوم» بأسلوب WHOOP، وأوقات نوم أوضح — وتحديث كبير لـ iPhone"
+  },
+  "l10n_app_changelog_accuracy_reliability_accessibility_a_big_community_43c3787d": {
+   "en": "Accuracy, reliability & accessibility - a big community-fixes wave",
+   "ar": "الدقة والموثوقية وإمكانية الوصول — موجة كبيرة من إصلاحات المجتمع"
+  },
+  "l10n_app_changelog_an_effort_scale_you_choose_a_a7c2478d": {
+   "en": "An Effort scale you choose, a ring that gets to sleep, and far fewer wasted re-scores",
+   "ar": "مقياس جهد تختاره، وخاتم ينام، وإعادة احتساب مهدرة أقل بكثير"
+  },
+  "l10n_app_changelog_android_bottom_tab_bar_99b41cad": {
+   "en": "Android: bottom tab bar",
+   "ar": "‏Android: شريط تبويبات سفلي"
+  },
+  "l10n_app_changelog_android_faster_sync_skin_temp_sync_4f774d79": {
+   "en": "Android: faster sync, skin temp, sync status, alarm groundwork",
+   "ar": "‏Android: مزامنة أسرع، وحرارة الجلد، وحالة المزامنة، وأساس المنبّه"
+  },
+  "l10n_app_changelog_android_gps_route_distance_fix_817a80d6": {
+   "en": "Android GPS route distance fix",
+   "ar": "إصلاح مسافة مسار GPS على Android"
+  },
+  "l10n_app_changelog_android_home_screen_widget_98b0782a": {
+   "en": "Android home-screen widget",
+   "ar": "أداة الشاشة الرئيسية على Android"
+  },
+  "l10n_app_changelog_android_notification_recovery_fix_widget_armour_b84839c6": {
+   "en": "Android: notification recovery fix + widget armour",
+   "ar": "‏Android: إصلاح استرداد الإشعارات + تحصين الأداة"
+  },
+  "l10n_app_changelog_android_reconnect_guide_a_startup_crash_9900dd7a": {
+   "en": "Android reconnect guide + a startup-crash fix",
+   "ar": "دليل إعادة الاتصال على Android + إصلاح تعطل عند الإقلاع"
+  },
+  "l10n_app_changelog_android_reliable_reconnect_after_a_dropout_c96cb4c0": {
+   "en": "Android: reliable reconnect after a dropout",
+   "ar": "‏Android: إعادة اتصال موثوقة بعد الانقطاع"
+  },
+  "l10n_app_changelog_android_share_back_to_health_connect_4d87898e": {
+   "en": "Android: share back to Health Connect",
+   "ar": "‏Android: المشاركة العكسية إلى Health Connect"
+  },
+  "l10n_app_changelog_android_the_widget_now_actually_updates_dc770011": {
+   "en": "Android: the widget now actually updates",
+   "ar": "‏Android: الأداة تتحدّث فعلًا الآن"
+  },
+  "l10n_app_changelog_android_today_clearer_empty_states_39ad5d2c": {
+   "en": "Android Today: clearer empty states",
+   "ar": "«اليوم» على Android: حالات فارغة أوضح"
+  },
+  "l10n_app_changelog_android_whoop_4_on_newer_firmware_383314db": {
+   "en": "Android: WHOOP 4 on newer firmware now records data",
+   "ar": "‏Android: WHOOP 4 على البرامج الثابتة الأحدث يسجّل البيانات الآن"
+  },
+  "l10n_app_changelog_apple_health_export_sleep_nights_recovered_1fc04ee2": {
+   "en": "Apple Health export, sleep nights recovered, and imported-ride Effort",
+   "ar": "التصدير إلى Apple Health، واسترجاع ليالي النوم، وجهد الرحلات المستوردة"
+  },
+  "l10n_app_changelog_auto_sync_health_connect_android_698f0129": {
+   "en": "Auto-sync Health Connect (Android)",
+   "ar": "مزامنة تلقائية لـ Health Connect (Android)"
+  },
+  "l10n_app_changelog_background_gps_sleep_time_editing_log_7baa5d7a": {
+   "en": "Background GPS, sleep-time editing, log-ahead, and a sharper Rest tile",
+   "ar": "‏GPS في الخلفية، وتحرير أوقات النوم، والتسجيل المسبق، وبطاقة راحة أوضح"
+  },
+  "l10n_app_changelog_backup_controls_and_a_lighter_app_a08f0fe4": {
+   "en": "Backup controls, and a lighter app",
+   "ar": "عناصر تحكم بالنسخ الاحتياطي، وتطبيق أخف"
+  },
+  "l10n_app_changelog_backup_restore_fixed_plus_appearance_controls_d0b9c0fe": {
+   "en": "Backup restore fixed, plus appearance controls",
+   "ar": "إصلاح استعادة النسخة الاحتياطية، مع عناصر تحكم بالمظهر"
+  },
+  "l10n_app_changelog_backup_restore_the_wrong_day_fix_ecbfd90d": {
+   "en": "Backup & Restore, the wrong-day fix, and a smarter Test Centre",
+   "ar": "النسخ الاحتياطي والاستعادة، وإصلاح اليوم الخاطئ، ومركز اختبار أذكى"
+  },
+  "l10n_app_changelog_battery_refresh_on_whoop_5_0_0304ac74": {
+   "en": "Battery refresh on WHOOP 5.0/MG (Mac + Android)",
+   "ar": "تحديث البطارية على WHOOP 5.0/MG (Mac + Android)"
+  },
+  "l10n_app_changelog_battery_responsiveness_smarter_sync_lighter_notification_e6949f3c": {
+   "en": "Battery + responsiveness: smarter sync, lighter notification",
+   "ar": "البطارية والاستجابة: مزامنة أذكى، وإشعار أخف"
+  },
+  "l10n_app_changelog_battery_saver_quiets_the_gauges_translated_bdbe8650": {
+   "en": "Battery saver quiets the gauges, translated Android notifications, and instant chart loads",
+   "ar": "موفّر البطارية يهدّئ المؤشرات، وإشعارات Android مترجمة، وتحميل فوري للرسوم"
+  },
+  "l10n_app_changelog_better_diagnostics_for_newer_strap_firmware_a7ef4187": {
+   "en": "Better diagnostics for newer strap firmware - so we can decode it",
+   "ar": "تشخيصات أفضل للبرامج الثابتة الأحدث للسوار — حتى نتمكن من فكّ ترميزها"
+  },
+  "l10n_app_changelog_better_strap_log_diagnostics_122f820c": {
+   "en": "Better strap-log diagnostics",
+   "ar": "تشخيصات أفضل لسجل السوار"
+  },
+  "l10n_app_changelog_big_fix_wave_clock_reconnect_local_a2959a50": {
+   "en": "Big fix wave - clock, reconnect, local LLM, Explore, weight and more",
+   "ar": "موجة إصلاحات كبيرة — الساعة، وإعادة الاتصال، ونموذج لغوي محلي، والاستكشاف، والوزن وغيرها"
+  },
+  "l10n_app_changelog_bluetooth_stream_apple_health_sync_fixes_78e16558": {
+   "en": "Bluetooth stream + Apple Health sync fixes",
+   "ar": "إصلاحات بث Bluetooth ومزامنة Apple Health"
+  },
+  "l10n_app_changelog_board_sweep_battery_days_left_browse_8b78e0b6": {
+   "en": "Board Sweep: battery days-left, browse past weeks, breathing cues, and a pile of fixes",
+   "ar": "تنظيف اللوحة: أيام البطارية المتبقية، وتصفح الأسابيع الماضية، وتنبيهات التنفس، وكومة إصلاحات"
+  },
+  "l10n_app_changelog_broadcast_your_heart_rate_to_garmin_338605c5": {
+   "en": "Broadcast your heart rate to Garmin, Zwift and gym kit",
+   "ar": "بثّ معدل نبضك إلى Garmin وZwift وأجهزة النادي"
+  },
+  "l10n_app_changelog_browse_past_nights_smarter_coach_workout_9fc9bfd2": {
+   "en": "Browse past nights, smarter Coach, workout times, battery & more",
+   "ar": "تصفح الليالي الماضية، ومدرب أذكى، وأوقات التمارين، والبطارية وغيرها"
+  },
+  "l10n_app_changelog_browse_the_last_few_days_interactive_a13e7b2a": {
+   "en": "Browse the last few days, interactive charts, and a Vital Signs screen (Android)",
+   "ar": "تصفح الأيام القليلة الماضية، ورسوم تفاعلية، وشاشة العلامات الحيوية (Android)"
+  },
+  "l10n_app_changelog_bug_fix_sweep_steps_sleep_export_50c60c51": {
+   "en": "Bug-fix sweep: steps, sleep export, and a battery-saving reconnect fix",
+   "ar": "موجة إصلاحات: الخطوات، وتصدير النوم، وإصلاح إعادة اتصال موفّر للبطارية"
+  },
+  "l10n_app_changelog_bug_fixes_effort_the_widget_s_6b807b50": {
+   "en": "Bug fixes: Effort, the widget\\'s day, and Oura reconnect",
+   "ar": "إصلاحات: الجهد، ويوم الأداة، وإعادة اتصال Oura"
+  },
+  "l10n_app_changelog_buzz_whoop_4_in_the_smart_4d17676a": {
+   "en": "Buzz WHOOP 4 in the Smart Alarm",
+   "ar": "اهتزاز WHOOP 4 في المنبّه الذكي"
+  },
+  "l10n_app_changelog_charge_effort_rest_noop_s_own_8c323656": {
+   "en": "Charge, Effort & Rest - NOOP\\'s own scores, out of 100",
+   "ar": "الشحن والجهد والراحة — درجات NOOP الخاصة من 100"
+  },
+  "l10n_app_changelog_charge_shows_calibrating_instead_of_no_51a000e9": {
+   "en": "Charge shows \"Calibrating\" instead of \"No data\" for new straps",
+   "ar": "الشحن يعرض «جارٍ المعايرة» بدلًا من «لا بيانات» للأساور الجديدة"
+  },
+  "l10n_app_changelog_check_for_updates_736b9062": {
+   "en": "Check for updates",
+   "ar": "التحقق من التحديثات"
+  },
+  "l10n_app_changelog_choose_a_12_hour_clock_sleep_8a19db5c": {
+   "en": "Choose a 12-hour clock, sleep from straps that bank no motion, and a strap log that stops guessing",
+   "ar": "اختيار نظام 12 ساعة، ونوم من أساور لا تخزّن حركة، وسجل سوار يتوقف عن التخمين"
+  },
+  "l10n_app_changelog_classic_chart_colours_a_throwback_toggle_e8150db5": {
+   "en": "Classic chart colours - a throwback toggle",
+   "ar": "ألوان الرسوم الكلاسيكية — مفتاح للعودة إلى الماضي"
+  },
+  "l10n_app_changelog_cleaner_live_status_better_sync_diagnostics_00ad8d26": {
+   "en": "Cleaner Live status + better sync diagnostics",
+   "ar": "حالة مباشرة أنظف + تشخيصات مزامنة أفضل"
+  },
+  "l10n_app_changelog_cleaner_score_rings_a_few_fixes_7094ae7b": {
+   "en": "Cleaner score rings + a few fixes",
+   "ar": "حلقات درجات أنظف + بعض الإصلاحات"
+  },
+  "l10n_app_changelog_clearer_answers_when_your_strap_isn_154c8923": {
+   "en": "Clearer answers when your strap isn\\'t banking history",
+   "ar": "إجابات أوضح حين لا يخزّن سوارك السجل"
+  },
+  "l10n_app_changelog_clearer_labels_a_journal_fix_and_96b91b2a": {
+   "en": "Clearer labels, a journal fix, and steadier sleeping heart rate",
+   "ar": "تسميات أوضح، وإصلاح لليوميات، ومعدل نبض أثناء النوم أكثر ثباتًا"
+  },
+  "l10n_app_changelog_clearer_pairing_guidance_for_whoop_5_91a7736b": {
+   "en": "Clearer pairing guidance for WHOOP 5.0/MG",
+   "ar": "إرشادات اقتران أوضح لـ WHOOP 5.0/MG"
+  },
+  "l10n_app_changelog_clearer_sync_status_6431bf19": {
+   "en": "Clearer sync status",
+   "ar": "حالة مزامنة أوضح"
+  },
+  "l10n_app_changelog_clearer_sync_status_a_responsive_compare_ee8925d0": {
+   "en": "Clearer sync status + a responsive Compare screen",
+   "ar": "حالة مزامنة أوضح + شاشة مقارنة متجاوبة"
+  },
+  "l10n_app_changelog_connect_a_heart_rate_strap_early_f12c6ba9": {
+   "en": "Connect a heart-rate strap (early access)",
+   "ar": "توصيل سوار لقياس النبض (وصول مبكر)"
+  },
+  "l10n_app_changelog_connection_sleep_fixes_a_focused_tune_69b01439": {
+   "en": "Connection & sleep fixes - a focused tune-up",
+   "ar": "إصلاحات الاتصال والنوم — ضبط مركّز"
+  },
+  "l10n_app_changelog_continuous_hrv_capture_sharper_overnight_hrv_9a9ec94b": {
+   "en": "Continuous HRV capture - sharper overnight HRV, recovery and sleep",
+   "ar": "التقاط مستمر لتقلب النبض — تقلب نبض وتعافٍ ونوم أدق ليلًا"
+  },
+  "l10n_app_changelog_continuous_workouts_no_longer_split_plus_4db70213": {
+   "en": "Continuous workouts no longer split, plus delete a sleep session",
+   "ar": "التمارين المتصلة لم تعد تنقسم، مع إمكانية حذف جلسة نوم"
+  },
+  "l10n_app_changelog_coupled_view_workouts_rebuilt_journal_numbers_b347f97e": {
+   "en": "Coupled view, workouts rebuilt, journal numbers",
+   "ar": "العرض المزدوج، وإعادة بناء التمارين، وأرقام اليوميات"
+  },
+  "l10n_app_changelog_cross_platform_parity_android_now_scores_86654a6c": {
+   "en": "Cross-platform parity - Android now scores identically to macOS & iOS",
+   "ar": "تكافؤ عبر المنصات — Android يحتسب الآن بشكل مطابق لـ macOS وiOS"
+  },
+  "l10n_app_changelog_date_fixes_ui_polish_clearer_diagnostics_61058e74": {
+   "en": "Date fixes, UI polish & clearer diagnostics",
+   "ar": "إصلاحات التواريخ، وتحسينات الواجهة، وتشخيصات أوضح"
+  },
+  "l10n_app_changelog_date_hygiene_fix_for_straps_with_dc559c6f": {
+   "en": "Date-hygiene fix for straps with a bad clock",
+   "ar": "إصلاح صحة التواريخ للأساور ذات الساعة الخاطئة"
+  },
+  "l10n_app_changelog_deep_history_backlog_drains_without_manual_bb716532": {
+   "en": "Deep history backlog drains without manual taps",
+   "ar": "تراكم السجل العميق يُفرَّغ دون نقرات يدوية"
+  },
+  "l10n_app_changelog_deep_sleep_no_longer_reads_0_80ce3558": {
+   "en": "Deep sleep no longer reads 0 minutes, and a smarter AI Coach",
+   "ar": "النوم العميق لم يعد يظهر 0 دقيقة، ومدرب ذكي أفضل"
+  },
+  "l10n_app_changelog_deep_sleep_that_happens_later_in_702efdf1": {
+   "en": "Deep sleep that happens later in the night no longer reads 0 minutes",
+   "ar": "النوم العميق في وقت متأخر من الليل لم يعد يظهر 0 دقيقة"
+  },
+  "l10n_app_changelog_deep_timeline_you_can_scroll_through_7c04c040": {
+   "en": "Deep Timeline you can scroll through days, faster manual workouts, and a storage clean-up",
+   "ar": "جدول زمني عميق يمكنك تمريره عبر الأيام، وتمارين يدوية أسرع، وتنظيف للتخزين"
+  },
+  "l10n_app_changelog_delete_a_sleep_swipe_to_mark_7083b34d": {
+   "en": "Delete a sleep, swipe to mark read",
+   "ar": "حذف نوم، والسحب للتعليم كمقروء"
+  },
+  "l10n_app_changelog_design_polish_cross_platform_parity_caa8e2c4": {
+   "en": "Design polish & cross-platform parity",
+   "ar": "تحسينات التصميم والتكافؤ عبر المنصات"
+  },
+  "l10n_app_changelog_dynamic_island_toggle_now_actually_turns_df387ee6": {
+   "en": "Dynamic Island toggle now actually turns it off",
+   "ar": "مفتاح Dynamic Island يوقفه فعلًا الآن"
+  },
+  "l10n_app_changelog_editable_naps_a_richer_trends_report_471c1a69": {
+   "en": "Editable naps, a richer Trends report, and better debug export",
+   "ar": "قيلولات قابلة للتحرير، وتقرير اتجاهات أغنى، وتصدير تصحيح أفضل"
+  },
+  "l10n_app_changelog_effort_explains_a_calm_day_zero_08bd9936": {
+   "en": "Effort explains a calm-day zero - and scores on the 5.0/MG",
+   "ar": "الجهد يفسّر صفر اليوم الهادئ — ويحتسب على 5.0/MG"
+  },
+  "l10n_app_changelog_effort_scale_fix_for_imported_data_aad0344d": {
+   "en": "Effort scale fix for imported data",
+   "ar": "إصلاح مقياس الجهد للبيانات المستوردة"
+  },
+  "l10n_app_changelog_estimated_steps_for_your_whoop_4_e961cade": {
+   "en": "Estimated steps for your WHOOP 4.0",
+   "ar": "خطوات تقديرية لـ WHOOP 4.0"
+  },
+  "l10n_app_changelog_everything_a_whole_new_look_hydration_0f648fc3": {
+   "en": "Everything: a whole new look, hydration, automatic workout detection, and smarter sleep",
+   "ar": "كل شيء: مظهر جديد كليًا، والترطيب، والكشف التلقائي عن التمارين، ونوم أذكى"
+  },
+  "l10n_app_changelog_everything_stays_on_your_device_575125e9": {
+   "en": "Everything stays on your device",
+   "ar": "كل شيء يبقى على جهازك"
+  },
+  "l10n_app_changelog_experimental_unlocking_whoop_5_0_mg_d665f836": {
+   "en": "Experimental: unlocking WHOOP 5.0/MG deep data",
+   "ar": "تجريبي: فتح البيانات العميقة لـ WHOOP 5.0/MG"
+  },
+  "l10n_app_changelog_export_your_raw_sensor_data_csv_59cfa009": {
+   "en": "Export your raw sensor data (CSV)",
+   "ar": "تصدير بيانات المستشعرات الخام (CSV)"
+  },
+  "l10n_app_changelog_faster_and_fewer_sharp_edges_6bbd66c7": {
+   "en": "Faster, and fewer sharp edges",
+   "ar": "أسرع، وحواف حادة أقل"
+  },
+  "l10n_app_changelog_faster_smoother_more_languages_and_a_6a8c8837": {
+   "en": "Faster, smoother, more languages, and a big pile of fixes",
+   "ar": "أسرع وأكثر سلاسة، ولغات أكثر، وكومة كبيرة من الإصلاحات"
+  },
+  "l10n_app_changelog_fewer_false_daytime_sleeps_an_android_6bf9029e": {
+   "en": "Fewer false daytime sleeps + an Android sync button",
+   "ar": "نوم نهاري كاذب أقل + زر مزامنة على Android"
+  },
+  "l10n_app_changelog_find_your_strap_log_in_settings_99105f3a": {
+   "en": "Find your strap log in Settings (macOS)",
+   "ar": "اعثر على سجل سوارك في الإعدادات (macOS)"
+  },
+  "l10n_app_changelog_first_release_d5545946": {
+   "en": "First release",
+   "ar": "الإصدار الأول"
+  },
+  "l10n_app_changelog_first_run_terms_acknowledgment_an_explore_081534f5": {
+   "en": "First-run terms acknowledgment + an Explore chart fix",
+   "ar": "إقرار بالشروط عند أول تشغيل + إصلاح رسم الاستكشاف"
+  },
+  "l10n_app_changelog_fix_a_night_with_a_brief_538bfa1d": {
+   "en": "Fix: a night with a brief wake-up showed as separate naps",
+   "ar": "إصلاح: ليلة بها استيقاظ قصير كانت تظهر كقيلولات منفصلة"
+  },
+  "l10n_app_changelog_fix_app_crashing_won_t_open_d4b0acce": {
+   "en": "Fix: app crashing / won\\'t open when Bluetooth is on",
+   "ar": "إصلاح: تعطل التطبيق / عدم فتحه عند تشغيل Bluetooth"
+  },
+  "l10n_app_changelog_fix_bonded_but_no_live_data_fbab40a4": {
+   "en": "Fix: bonded but no live data (Android)",
+   "ar": "إصلاح: مقترن لكن دون بيانات مباشرة (Android)"
+  },
+  "l10n_app_changelog_fix_connecting_a_polar_h10_or_bf013d57": {
+   "en": "Fix: connecting a Polar H10 or other heart-rate strap",
+   "ar": "إصلاح: توصيل Polar H10 أو أساور نبض أخرى"
+  },
+  "l10n_app_changelog_fix_imported_phone_steps_were_being_7c152d2b": {
+   "en": "Fix: imported phone steps were being double-counted",
+   "ar": "إصلاح: خطوات الهاتف المستوردة كانت تُحتسب مرتين"
+  },
+  "l10n_app_changelog_fix_the_android_freeze_after_a_bf7f8d81": {
+   "en": "Fix the Android freeze after a few nights of data",
+   "ar": "إصلاح تجمّد Android بعد بضع ليالٍ من البيانات"
+  },
+  "l10n_app_changelog_fix_your_day_now_follows_your_e772176e": {
+   "en": "Fix: your day now follows your timezone, not UTC",
+   "ar": "إصلاح: يومك يتبع الآن منطقتك الزمنية لا UTC"
+  },
+  "l10n_app_changelog_fixed_imported_data_and_strap_sync_18350836": {
+   "en": "Fixed: imported data and strap sync getting stuck on iOS",
+   "ar": "تم الإصلاح: تعليق البيانات المستوردة ومزامنة السوار على iOS"
+  },
+  "l10n_app_changelog_fixed_iphone_import_and_a_stuck_38876ee9": {
+   "en": "Fixed: iPhone import, and a stuck store now self-heals",
+   "ar": "تم الإصلاح: استيراد iPhone، والمخزن المتوقف يعالج نفسه الآن"
+  },
+  "l10n_app_changelog_fixes_a_false_pairing_refused_warning_7023464e": {
+   "en": "Fixes a false \"pairing refused\" warning (Mac)",
+   "ar": "يصلح تحذير «رُفض الاقتران» الخاطئ (Mac)"
+  },
+  "l10n_app_changelog_fixes_the_experimental_sleep_toggle_now_fc281b7d": {
+   "en": "Fixes: the experimental sleep toggle now works, steps calibration, manual workouts on WHOOP 5/MG, and a sane HRV reading",
+   "ar": "إصلاحات: مفتاح النوم التجريبي يعمل الآن، ومعايرة الخطوات، والتمارين اليدوية على WHOOP 5/MG، وقراءة معقولة لتقلب النبض"
+  },
+  "l10n_app_changelog_fixes_the_insights_tab_crash_plus_042d1702": {
+   "en": "Fixes the Insights-tab crash, plus more accurate HRV",
+   "ar": "يصلح تعطل تبويب الرؤى، مع تقلب نبض أدق"
+  },
+  "l10n_app_changelog_french_whoop_exports_now_import_db598ea4": {
+   "en": "French WHOOP exports now import",
+   "ar": "ملفات تصدير WHOOP الفرنسية تُستورد الآن"
+  },
+  "l10n_app_changelog_german_french_spanish_pull_to_sync_1109bda2": {
+   "en": "German, French & Spanish, pull-to-sync on Today, and a wave of polish",
+   "ar": "الألمانية والفرنسية والإسبانية، والسحب للمزامنة في «اليوم»، وموجة تحسينات"
+  },
+  "l10n_app_changelog_gps_tracked_workouts_android_1cf07bd1": {
+   "en": "GPS-tracked workouts (Android)",
+   "ar": "تمارين متتبَّعة بـ GPS (Android)"
+  },
+  "l10n_app_changelog_gps_workout_crash_fix_android_698ee690": {
+   "en": "GPS workout crash fix (Android)",
+   "ar": "إصلاح تعطل تمرين GPS (Android)"
+  },
+  "l10n_app_changelog_hand_correct_your_sleep_times_smaller_6154b854": {
+   "en": "Hand-correct your sleep times + smaller backups",
+   "ar": "تصحيح أوقات نومك يدويًا + نسخ احتياطية أصغر"
+  },
+  "l10n_app_changelog_health_connect_correct_labels_workout_types_fd2fcc34": {
+   "en": "Health Connect: correct labels + workout types (Android)",
+   "ar": "‏Health Connect: تسميات صحيحة + أنواع التمارين (Android)"
+  },
+  "l10n_app_changelog_health_connect_shows_as_health_connect_39b3cbcb": {
+   "en": "Health Connect shows as Health Connect",
+   "ar": "‏Health Connect يظهر باسم Health Connect"
+  },
+  "l10n_app_changelog_history_dates_fixed_for_revived_straps_0ec4e53a": {
+   "en": "History dates fixed for revived straps, gestures during sync, clearer pairing",
+   "ar": "إصلاح تواريخ السجل للأساور المستعادة، والإيماءات أثناء المزامنة، واقتران أوضح"
+  },
+  "l10n_app_changelog_honest_labelling_for_whoop_5_mg_8c650225": {
+   "en": "Honest labelling for WHOOP 5/MG deep-data diagnostics",
+   "ar": "تسميات صادقة لتشخيصات البيانات العميقة لـ WHOOP 5/MG"
+  },
+  "l10n_app_changelog_hotfix_making_a_heart_rate_strap_09f87c0a": {
+   "en": "Hotfix - making a heart-rate strap active no longer crashes",
+   "ar": "إصلاح عاجل — تعيين سوار نبض نشطًا لم يعد يسبب تعطلًا"
+  },
+  "l10n_app_changelog_hr_from_the_optical_waveform_an_b8874b42": {
+   "en": "HR from the optical waveform, an early-morning day rollover, and clearer terms",
+   "ar": "معدل النبض من الموجة الضوئية، وانتقال اليوم في الصباح الباكر، وشروط أوضح"
+  },
+  "l10n_app_changelog_hrv_accuracy_fix_oura_sleep_and_4ed31e39": {
+   "en": "HRV accuracy fix, Oura sleep and motion, richer 5/MG decoding, and a stoppable sync",
+   "ar": "إصلاح دقة تقلب النبض، ونوم وحركة Oura، وفكّ ترميز أغنى لـ 5/MG، ومزامنة قابلة للإيقاف"
+  },
+  "l10n_app_changelog_hrv_that_reads_true_and_a_2b09fa43": {
+   "en": "HRV that reads true, and a tidier workout list",
+   "ar": "تقلب نبض يقرأ الحقيقة، وقائمة تمارين أكثر ترتيبًا"
+  },
+  "l10n_app_changelog_import_fixes_both_sources_all_data_92cfed50": {
+   "en": "Import fixes - both sources, all data types",
+   "ar": "إصلاحات الاستيراد — كلا المصدرين، وكل أنواع البيانات"
+  },
+  "l10n_app_changelog_import_polish_mac_whoop_5_optical_5067d90c": {
+   "en": "Import polish (Mac) + WHOOP 5 optical decode",
+   "ar": "تحسينات الاستيراد (Mac) + فكّ الترميز الضوئي لـ WHOOP 5"
+  },
+  "l10n_app_changelog_independent_and_experimental_f9b65317": {
+   "en": "Independent, and experimental",
+   "ar": "مستقل وتجريبي"
+  },
+  "l10n_app_changelog_ios_is_now_a_direct_download_fab6ed69": {
+   "en": "iOS is now a direct download - no Mac or Xcode needed",
+   "ar": "‏iOS صار تنزيلًا مباشرًا — دون حاجة إلى Mac أو Xcode"
+  },
+  "l10n_app_changelog_iphone_button_label_polish_64244980": {
+   "en": "iPhone button-label polish",
+   "ar": "تحسين تسميات أزرار iPhone"
+  },
+  "l10n_app_changelog_iphone_hotfix_sideloading_works_again_7b90c265": {
+   "en": "iPhone hotfix: sideloading works again",
+   "ar": "إصلاح عاجل لـ iPhone: التثبيت الجانبي يعمل مجددًا"
+  },
+  "l10n_app_changelog_iphone_import_handle_icloud_and_large_2d60298a": {
+   "en": "iPhone import: handle iCloud and large export files",
+   "ar": "استيراد iPhone: التعامل مع iCloud وملفات التصدير الكبيرة"
+  },
+  "l10n_app_changelog_iphone_polish_accessibility_99bba695": {
+   "en": "iPhone polish + accessibility",
+   "ar": "تحسينات iPhone + إمكانية الوصول"
+  },
+  "l10n_app_changelog_iphone_polish_what_s_new_fits_1dad9b15": {
+   "en": "iPhone polish: What\\'s New fits, Today cards align",
+   "ar": "تحسينات iPhone: «ما الجديد» يتّسع، وبطاقات «اليوم» تصطف"
+  },
+  "l10n_app_changelog_iphone_smoother_scrolling_753e0b0d": {
+   "en": "iPhone: smoother scrolling",
+   "ar": "‏iPhone: تمرير أكثر سلاسة"
+  },
+  "l10n_app_changelog_iphone_workouts_table_fits_the_screen_156a691c": {
+   "en": "iPhone Workouts table fits the screen",
+   "ar": "جدول التمارين على iPhone يتّسع للشاشة"
+  },
+  "l10n_app_changelog_journal_logging_an_imperial_metric_units_a507a5d2": {
+   "en": "Journal logging + an Imperial/Metric units toggle",
+   "ar": "تسجيل اليوميات + مفتاح الوحدات الإمبراطورية/المترية"
+  },
+  "l10n_app_changelog_large_apple_health_imports_no_longer_830fa786": {
+   "en": "Large Apple Health imports no longer crash (iPhone/Mac)",
+   "ar": "عمليات استيراد Apple Health الكبيرة لم تعد تسبب تعطلًا (iPhone/Mac)"
+  },
+  "l10n_app_changelog_last_workouts_tile_fix_301180af": {
+   "en": "Last Workouts tile fix",
+   "ar": "إصلاح بطاقة آخر التمارين"
+  },
+  "l10n_app_changelog_light_theme_noop_in_warm_paper_d5b9f463": {
+   "en": "Light theme - NOOP in warm paper & gold",
+   "ar": "السمة الفاتحة — NOOP بورق دافئ وذهب"
+  },
+  "l10n_app_changelog_light_theme_polish_5add98b2": {
+   "en": "Light theme polish",
+   "ar": "تحسينات السمة الفاتحة"
+  },
+  "l10n_app_changelog_light_theme_tuning_2bbad1f7": {
+   "en": "Light theme tuning",
+   "ar": "ضبط السمة الفاتحة"
+  },
+  "l10n_app_changelog_live_heart_rate_lands_on_today_5cac8768": {
+   "en": "Live heart rate lands on today\\'s chart even when the strap\\'s clock is off (Android)",
+   "ar": "النبض المباشر يظهر في رسم اليوم حتى لو كانت ساعة السوار خاطئة (Android)"
+  },
+  "l10n_app_changelog_live_heart_rate_that_doesn_t_b6b4ca9a": {
+   "en": "Live heart rate that doesn\\'t freeze",
+   "ar": "نبض مباشر لا يتجمّد"
+  },
+  "l10n_app_changelog_local_oura_ring_support_use_your_e928e3c6": {
+   "en": "Local Oura ring support: use your Oura ring with no Oura app (beta)",
+   "ar": "دعم محلي لخاتم Oura: استخدم خاتمك دون تطبيق Oura (تجريبي)"
+  },
+  "l10n_app_changelog_mac_recovery_builds_from_your_strap_883d49ee": {
+   "en": "Mac: recovery builds from your strap alone",
+   "ar": "‏Mac: التعافي يُحتسب من سوارك وحده"
+  },
+  "l10n_app_changelog_mac_strap_computed_nights_show_in_b0a3ac91": {
+   "en": "Mac: strap-computed nights show in Sleep",
+   "ar": "‏Mac: الليالي المحتسبة من السوار تظهر في «النوم»"
+  },
+  "l10n_app_changelog_make_noop_yours_theme_colours_and_6bdef2a7": {
+   "en": "Make NOOP yours — theme colours and custom backgrounds, forty more sports with GPS routes, and a calorie heatmap",
+   "ar": "اجعل NOOP لك — ألوان السمة والخلفيات المخصصة، وأربعون رياضة إضافية بمسارات GPS، وخريطة حرارية للسعرات"
+  },
+  "l10n_app_changelog_manage_several_whoop_straps_and_see_8d9b6a84": {
+   "en": "Manage several WHOOP straps - and see what each band does",
+   "ar": "إدارة عدة أساور WHOOP — ومعرفة ما يفعله كل سوار"
+  },
+  "l10n_app_changelog_manual_workouts_edit_dismiss_auto_detected_95ed45b6": {
+   "en": "Manual workouts, edit/dismiss auto-detected ones, and CSV export",
+   "ar": "تمارين يدوية، وتحرير/تجاهل المكتشفة تلقائيًا، وتصدير CSV"
+  },
+  "l10n_app_changelog_manual_workouts_on_whoop_5_0_72908a88": {
+   "en": "Manual workouts on WHOOP 5.0/MG get their calories and strain back",
+   "ar": "التمارين اليدوية على WHOOP 5.0/MG تستعيد سعراتها وإجهادها"
+  },
+  "l10n_app_changelog_mi_band_import_a_big_whoop_eb5382db": {
+   "en": "Mi Band import + a big WHOOP 4.0 sleep fix",
+   "ar": "استيراد Mi Band + إصلاح كبير لنوم WHOOP 4.0"
+  },
+  "l10n_app_changelog_mind_a_daily_mood_check_in_982fdd16": {
+   "en": "Mind - a daily mood check-in - and nutrition import",
+   "ar": "«الذهن» — تسجيل يومي للمزاج — واستيراد التغذية"
+  },
+  "l10n_app_changelog_more_quick_relabel_sports_ba93c38b": {
+   "en": "More quick-relabel sports",
+   "ar": "رياضات أكثر لإعادة التسمية السريعة"
+  },
+  "l10n_app_changelog_more_realistic_calories_import_chart_fixes_d3d56a9e": {
+   "en": "More realistic calories + import & chart fixes",
+   "ar": "سعرات أكثر واقعية + إصلاحات الاستيراد والرسوم"
+  },
+  "l10n_app_changelog_more_reliable_bluetooth_on_newer_android_c7e641dc": {
+   "en": "More reliable Bluetooth on newer Android phones",
+   "ar": "‏Bluetooth أكثر موثوقية على هواتف Android الأحدث"
+  },
+  "l10n_app_changelog_more_tab_icons_stop_flickering_colour_3de3de9f": {
+   "en": "More-tab icons stop flickering colour",
+   "ar": "أيقونات تبويب «المزيد» توقفت عن وميض اللون"
+  },
+  "l10n_app_changelog_new_a_guide_to_how_your_7afbd7f4": {
+   "en": "New: a guide to how your Charge, Effort and Rest scores work",
+   "ar": "جديد: دليل لكيفية عمل درجات الشحن والجهد والراحة"
+  },
+  "l10n_app_changelog_new_first_run_onboarding_mac_android_243bc0ad": {
+   "en": "New first-run onboarding (Mac + Android)",
+   "ar": "تهيئة جديدة عند أول تشغيل (Mac + Android)"
+  },
+  "l10n_app_changelog_new_use_an_apple_watch_with_4c2c29a6": {
+   "en": "New: use an Apple Watch with NOOP",
+   "ar": "جديد: استخدام Apple Watch مع NOOP"
+  },
+  "l10n_app_changelog_new_week_in_review_a_live_c1457e40": {
+   "en": "New: Week in review, a live body console, fresher charts and more",
+   "ar": "جديد: مراجعة الأسبوع، ولوحة جسد مباشرة، ورسوم أحدث وغيرها"
+  },
+  "l10n_app_changelog_no_more_hr_spike_when_you_7dc052ba": {
+   "en": "No more HR spike when you reopen the app",
+   "ar": "لا مزيد من قفزة النبض عند إعادة فتح التطبيق"
+  },
+  "l10n_app_changelog_noop_grows_up_it_s_not_823bf2e7": {
+   "en": "NOOP grows up: it\\'s not just for WHOOP anymore",
+   "ar": "‏NOOP يكبر: لم يعد لـ WHOOP فقط"
+  },
+  "l10n_app_changelog_noop_has_a_new_home_01b87522": {
+   "en": "NOOP has a new home",
+   "ar": "لـ NOOP بيت جديد"
+  },
+  "l10n_app_changelog_noop_now_tells_you_when_your_af259fbb": {
+   "en": "NOOP now tells you when your strap isn\\'t saving history - and how to fix it",
+   "ar": "‏NOOP يخبرك الآن حين لا يحفظ سوارك السجل — وكيف تصلح ذلك"
+  },
+  "l10n_app_changelog_on_demand_hrv_a_haptic_clock_50376585": {
+   "en": "On-demand HRV, a haptic clock, sleep marks & more",
+   "ar": "تقلب نبض عند الطلب، وساعة اهتزازية، وعلامات نوم وغيرها"
+  },
+  "l10n_app_changelog_oneplus_pairing_fix_f731fcb2": {
+   "en": "OnePlus pairing fix",
+   "ar": "إصلاح اقتران OnePlus"
+  },
+  "l10n_app_changelog_open_a_workout_see_what_it_a40fd8a4": {
+   "en": "Open a workout, see what it costs you, and share your trends",
+   "ar": "افتح تمرينًا، وانظر ما يكلّفك، وشارك اتجاهاتك"
+  },
+  "l10n_app_changelog_optimal_strain_alerts_faster_history_sync_6488a27a": {
+   "en": "Optimal-strain alerts, faster history sync, and a wave of accuracy fixes",
+   "ar": "تنبيهات الإجهاد الأمثل، ومزامنة سجل أسرع، وموجة إصلاحات للدقة"
+  },
+  "l10n_app_changelog_optional_inactivity_nudge_3f4ca05a": {
+   "en": "Optional inactivity nudge",
+   "ar": "تنبيه اختياري للخمول"
+  },
+  "l10n_app_changelog_personal_vital_baselines_mac_analytics_parity_744972d1": {
+   "en": "Personal vital baselines + Mac analytics parity",
+   "ar": "خطوط أساس شخصية للعلامات الحيوية + تكافؤ تحليلات Mac"
+  },
+  "l10n_app_changelog_personalized_heart_rate_zones_compare_and_8d89ee2a": {
+   "en": "Personalized heart-rate zones, compare and switch between straps, and more honest HRV, sleep and Oura reads",
+   "ar": "مناطق نبض مخصصة، ومقارنة الأساور والتبديل بينها، وقراءات أصدق لتقلب النبض والنوم وOura"
+  },
+  "l10n_app_changelog_polish_matched_to_the_iphone_mac_cc34126b": {
+   "en": "Polish - matched to the iPhone & Mac design",
+   "ar": "تحسينات — متوائمة مع تصميم iPhone وMac"
+  },
+  "l10n_app_changelog_power_saving_that_protects_your_strap_57a32503": {
+   "en": "Power saving that protects your strap, a Gemini-powered coach on Android, and richer metric detail",
+   "ar": "توفير طاقة يحمي سوارك، ومدرب مدعوم بـ Gemini على Android، وتفاصيل مقاييس أغنى"
+  },
+  "l10n_app_changelog_raw_spo_honest_units_and_a_55e83a59": {
+   "en": "Raw SpO₂, honest units, and a lighter app",
+   "ar": "‏SpO₂ الخام، ووحدات صادقة، وتطبيق أخف"
+  },
+  "l10n_app_changelog_re_scan_actually_scans_on_android_22198c8c": {
+   "en": "Re-scan actually scans on Android",
+   "ar": "إعادة البحث تبحث فعلًا على Android"
+  },
+  "l10n_app_changelog_readiness_and_the_start_of_whoop_167f38c5": {
+   "en": "Readiness, and the start of WHOOP 5/MG",
+   "ar": "الجاهزية، وبداية دعم WHOOP 5/MG"
+  },
+  "l10n_app_changelog_readiness_shows_its_evidence_and_a_90cf0076": {
+   "en": "Readiness shows its evidence, and a Health Connect distance fix",
+   "ar": "الجاهزية تعرض أدلتها، وإصلاح مسافة Health Connect"
+  },
+  "l10n_app_changelog_reading_more_from_your_whoop_5_1412164a": {
+   "en": "Reading more from your WHOOP 5.0 (Mac)",
+   "ar": "قراءة المزيد من WHOOP 5.0 (Mac)"
+  },
+  "l10n_app_changelog_reconnect_help_for_whoop_5_0_acc779b6": {
+   "en": "Reconnect help for WHOOP 5.0 / MG after a firmware update",
+   "ar": "مساعدة إعادة الاتصال لـ WHOOP 5.0 / MG بعد تحديث البرنامج الثابت"
+  },
+  "l10n_app_changelog_reconnects_automatically_after_an_update_android_b4965179": {
+   "en": "Reconnects automatically after an update (Android)",
+   "ar": "إعادة اتصال تلقائية بعد التحديث (Android)"
+  },
+  "l10n_app_changelog_recovery_builds_from_your_strap_alone_d83dbd67": {
+   "en": "Recovery builds from your strap alone (Android)",
+   "ar": "التعافي يُحتسب من سوارك وحده (Android)"
+  },
+  "l10n_app_changelog_respiratory_rate_skin_temp_in_the_bfe3f4f9": {
+   "en": "Respiratory rate & skin temp in the Trends report",
+   "ar": "معدل التنفس وحرارة الجلد في تقرير الاتجاهات"
+  },
+  "l10n_app_changelog_restart_your_strap_lighter_on_battery_2ccbef88": {
+   "en": "Restart your strap, lighter on battery, and Health Connect on Android 13",
+   "ar": "إعادة تشغيل سوارك، واستهلاك بطارية أقل، وHealth Connect على Android 13"
+  },
+  "l10n_app_changelog_robust_apple_health_import_marginal_radio_27d78c57": {
+   "en": "Robust Apple Health import, marginal-radio HR mode, live HR graph",
+   "ar": "استيراد قوي من Apple Health، ووضع نبض للإشارة الضعيفة، ورسم نبض مباشر"
+  },
+  "l10n_app_changelog_round_rings_73de603c": {
+   "en": "Round rings",
+   "ar": "حلقات دائرية"
+  },
+  "l10n_app_changelog_run_the_ai_coach_on_your_8ac2b395": {
+   "en": "Run the AI Coach on your own model - including fully local",
+   "ar": "شغّل المدرب الذكي على نموذجك الخاص — بما في ذلك محلي بالكامل"
+  },
+  "l10n_app_changelog_scores_live_from_the_strap_9d5d8ae2": {
+   "en": "Scores live from the strap",
+   "ar": "درجات مباشرة من السوار"
+  },
+  "l10n_app_changelog_security_reliability_hardening_b3c9a976": {
+   "en": "Security & reliability hardening",
+   "ar": "تعزيز الأمان والموثوقية"
+  },
+  "l10n_app_changelog_see_everything_the_deep_timeline_a_dbfe539a": {
+   "en": "See Everything: the Deep Timeline, a sleep movement graph, and a big board-clear",
+   "ar": "شاهد كل شيء: الجدول الزمني العميق، ورسم حركة النوم، وتنظيف كبير للوحة"
+  },
+  "l10n_app_changelog_share_strap_logs_and_a_worn_b5aae860": {
+   "en": "Share strap logs, and a worn-status fix",
+   "ar": "مشاركة سجلات السوار، وإصلاح حالة الارتداء"
+  },
+  "l10n_app_changelog_shortcuts_export_duplicates_fixed_nutrition_mood_a5dcdc11": {
+   "en": "Shortcuts-export duplicates fixed; nutrition & mood reach Android charts",
+   "ar": "إصلاح تكرار تصدير الاختصارات؛ والتغذية والمزاج يصلان إلى رسوم Android"
+  },
+  "l10n_app_changelog_shortcuts_on_mac_recovery_in_the_dbcef46a": {
+   "en": "Shortcuts on Mac, recovery in the Android notification",
+   "ar": "الاختصارات على Mac، والتعافي في إشعار Android"
+  },
+  "l10n_app_changelog_skin_temperature_unblocked_on_mac_ios_9cb6276c": {
+   "en": "Skin temperature unblocked on Mac/iOS, plus export fixes",
+   "ar": "حرارة الجلد متاحة على Mac/iOS، مع إصلاحات التصدير"
+  },
+  "l10n_app_changelog_sleep_and_recovery_for_whoop_4_c8f44a56": {
+   "en": "Sleep and recovery for WHOOP 4.0 straps on the firmware we couldn\\'t read",
+   "ar": "النوم والتعافي لأساور WHOOP 4.0 على البرنامج الثابت الذي تعذّرت قراءته"
+  },
+  "l10n_app_changelog_sleep_charge_and_workouts_cleaned_up_e21a5381": {
+   "en": "Sleep, Charge and workouts, cleaned up",
+   "ar": "النوم والشحن والتمارين، بعد تنظيفها"
+  },
+  "l10n_app_changelog_sleep_debt_daytime_stress_a_recovery_a92853f3": {
+   "en": "Sleep-debt, daytime stress, a recovery forecast, and day-by-day navigation",
+   "ar": "دين النوم، وتوتر النهار، وتوقّع التعافي، والتنقل يومًا بيوم"
+  },
+  "l10n_app_changelog_sleep_figures_hr_zones_charging_calibration_b209b698": {
+   "en": "Sleep figures, HR zones, charging & calibration - a big community-driven update",
+   "ar": "أرقام النوم، ومناطق النبض، والشحن والمعايرة — تحديث كبير بقيادة المجتمع"
+  },
+  "l10n_app_changelog_sleep_fix_for_whoop_4_0_c7a1b13d": {
+   "en": "Sleep fix for WHOOP 4.0 + accurate WHOOP 5/MG steps",
+   "ar": "إصلاح النوم لـ WHOOP 4.0 + خطوات دقيقة لـ WHOOP 5/MG"
+  },
+  "l10n_app_changelog_sleep_from_whoop_4_on_more_efe5fd60": {
+   "en": "Sleep from WHOOP 4 on more firmware (Mac)",
+   "ar": "النوم من WHOOP 4 على مزيد من البرامج الثابتة (Mac)"
+  },
+  "l10n_app_changelog_sleep_keep_real_nights_when_the_0acb206a": {
+   "en": "Sleep: keep real nights when the strap comes off",
+   "ar": "النوم: الاحتفاظ بالليالي الحقيقية عند خلع السوار"
+  },
+  "l10n_app_changelog_sleep_properly_sorted_and_an_app_f5e348f0": {
+   "en": "Sleep, properly sorted, and an app that explains itself",
+   "ar": "النوم، مرتَّب كما يجب، وتطبيق يشرح نفسه"
+  },
+  "l10n_app_changelog_sleep_stages_heal_themselves_after_a_e64a730f": {
+   "en": "Sleep stages heal themselves after a sync",
+   "ar": "مراحل النوم تصحّح نفسها بعد المزامنة"
+  },
+  "l10n_app_changelog_sleep_that_was_stuck_in_the_1b6d1307": {
+   "en": "Sleep that was stuck in the archive comes back",
+   "ar": "النوم العالق في الأرشيف يعود"
+  },
+  "l10n_app_changelog_smart_alarm_actually_works_on_android_c9bbf50a": {
+   "en": "Smart alarm actually works on Android",
+   "ar": "المنبّه الذكي يعمل فعلًا على Android"
+  },
+  "l10n_app_changelog_smart_alarm_the_time_you_set_6f5d260e": {
+   "en": "Smart alarm: the time you set is the time that fires",
+   "ar": "المنبّه الذكي: الوقت الذي تضبطه هو الوقت الذي يرنّ فيه"
+  },
+  "l10n_app_changelog_smoother_an_oura_live_hr_fix_e820bfb4": {
+   "en": "Smoother, an Oura live-HR fix, and a big pile of improvements",
+   "ar": "أكثر سلاسة، وإصلاح نبض Oura المباشر، وكومة كبيرة من التحسينات"
+  },
+  "l10n_app_changelog_smoother_during_long_history_syncs_mac_b31b616c": {
+   "en": "Smoother during long history syncs (Mac)",
+   "ar": "أكثر سلاسة أثناء مزامنات السجل الطويلة (Mac)"
+  },
+  "l10n_app_changelog_smoother_explore_charts_and_a_clearer_9598655d": {
+   "en": "Smoother Explore charts, and a clearer way to connect a WHOOP 5.0/MG",
+   "ar": "رسوم استكشاف أكثر سلاسة، وطريقة أوضح لتوصيل WHOOP 5.0/MG"
+  },
+  "l10n_app_changelog_spanish_whoop_exports_now_import_6351a8c6": {
+   "en": "Spanish WHOOP exports now import",
+   "ar": "ملفات تصدير WHOOP الإسبانية تُستورد الآن"
+  },
+  "l10n_app_changelog_split_sleep_every_block_counted_one_3106596d": {
+   "en": "Split sleep: every block counted, one night per day",
+   "ar": "النوم المجزّأ: احتساب كل كتلة، وليلة واحدة لكل يوم"
+  },
+  "l10n_app_changelog_stability_polish_for_v5_7393eaf0": {
+   "en": "Stability & polish for v5",
+   "ar": "استقرار وتحسينات للإصدار 5"
+  },
+  "l10n_app_changelog_start_a_workout_from_the_workouts_3c882d79": {
+   "en": "Start a workout from the Workouts screen, and an honest Smart-alarm note",
+   "ar": "بدء تمرين من شاشة التمارين، وملاحظة صادقة عن المنبّه الذكي"
+  },
+  "l10n_app_changelog_stays_connected_in_the_background_a6b0a94e": {
+   "en": "Stays connected in the background",
+   "ar": "يبقى متصلًا في الخلفية"
+  },
+  "l10n_app_changelog_steadier_bluetooth_on_congested_android_phones_699ad7d3": {
+   "en": "Steadier Bluetooth on congested Android phones",
+   "ar": "‏Bluetooth أكثر ثباتًا على هواتف Android المزدحمة"
+  },
+  "l10n_app_changelog_steadier_connections_fixes_and_a_nicer_fe1afd7d": {
+   "en": "Steadier connections, fixes, and a nicer sleep view",
+   "ar": "اتصالات أكثر ثباتًا، وإصلاحات، وعرض نوم أجمل"
+  },
+  "l10n_app_changelog_steadier_heart_rate_a_stack_of_e6026074": {
+   "en": "Steadier heart rate + a stack of fixes",
+   "ar": "نبض أكثر ثباتًا + مجموعة إصلاحات"
+  },
+  "l10n_app_changelog_stop_losing_strap_history_we_can_0598d11a": {
+   "en": "Stop losing strap history we can\\'t yet decode - plus a board of fixes",
+   "ar": "التوقف عن فقدان سجل السوار الذي لا نستطيع فكّ ترميزه بعد — مع لوحة إصلاحات"
+  },
+  "l10n_app_changelog_strap_battery_alerts_11f79bda": {
+   "en": "Strap battery alerts",
+   "ar": "تنبيهات بطارية السوار"
+  },
+  "l10n_app_changelog_strap_log_export_on_mac_a_e15f6b60": {
+   "en": "Strap-log export on Mac + a Health Monitor fix",
+   "ar": "تصدير سجل السوار على Mac + إصلاح Health Monitor"
+  },
+  "l10n_app_changelog_strap_log_stays_off_the_system_b8ce2ff5": {
+   "en": "Strap log stays off the system log (Android)",
+   "ar": "سجل السوار لم يعد يظهر في سجل النظام (Android)"
+  },
+  "l10n_app_changelog_switch_between_your_whoop_4_and_f5036092": {
+   "en": "Switch between your WHOOP 4 and 5.0 (Mac + Android)",
+   "ar": "التبديل بين WHOOP 4 و5.0 (Mac + Android)"
+  },
+  "l10n_app_changelog_switching_between_whoop_straps_now_actually_8428faaa": {
+   "en": "Switching between WHOOP straps now actually switches",
+   "ar": "التبديل بين أساور WHOOP يبدّل فعلًا الآن"
+  },
+  "l10n_app_changelog_sync_diagnostics_surfacing_silently_dropped_history_9fe62836": {
+   "en": "Sync diagnostics: surfacing silently-dropped history",
+   "ar": "تشخيصات المزامنة: إظهار السجل المفقود بصمت"
+  },
+  "l10n_app_changelog_sync_visibility_a_sharper_stress_timeline_37e1e6d6": {
+   "en": "Sync visibility + a sharper Stress timeline",
+   "ar": "وضوح المزامنة + جدول زمني أدق للتوتر"
+  },
+  "l10n_app_changelog_the_archived_sleep_recovery_now_reaches_cf4bb3ef": {
+   "en": "The archived-sleep recovery now reaches Android too",
+   "ar": "استرجاع النوم المؤرشف وصل إلى Android أيضًا"
+  },
+  "l10n_app_changelog_the_everything_update_5e08d257": {
+   "en": "The everything update",
+   "ar": "تحديث كل شيء"
+  },
+  "l10n_app_changelog_the_new_look_everywhere_plus_sleep_5793dddf": {
+   "en": "The new look everywhere - plus sleep, Effort & Bluetooth fixes",
+   "ar": "المظهر الجديد في كل مكان — مع إصلاحات النوم والجهد وBluetooth"
+  },
+  "l10n_app_changelog_the_new_today_screen_comes_to_69dfab3d": {
+   "en": "The new Today screen comes to Android",
+   "ar": "شاشة «اليوم» الجديدة تصل إلى Android"
+  },
+  "l10n_app_changelog_the_smoothness_release_faster_everywhere_plus_baf8a7fc": {
+   "en": "The smoothness release: faster everywhere, plus a sleep memory fix",
+   "ar": "إصدار السلاسة: أسرع في كل مكان، مع إصلاح ذاكرة النوم"
+  },
+  "l10n_app_changelog_the_test_centre_help_us_fix_af39aa17": {
+   "en": "The Test Centre: help us fix YOUR specific problem",
+   "ar": "مركز الاختبار: ساعدنا في إصلاح مشكلتك أنت تحديدًا"
+  },
+  "l10n_app_changelog_tidier_today_gauges_5d1fe894": {
+   "en": "Tidier Today gauges",
+   "ar": "مؤشرات «اليوم» أكثر ترتيبًا"
+  },
+  "l10n_app_changelog_tidier_today_hero_strap_renaming_smarter_34493c9c": {
+   "en": "Tidier Today hero, strap renaming, smarter journal",
+   "ar": "صدارة «اليوم» أكثر ترتيبًا، وإعادة تسمية السوار، ويوميات أذكى"
+  },
+  "l10n_app_changelog_tidier_workout_names_correct_rest_duration_135cf67f": {
+   "en": "Tidier workout names, correct Rest duration",
+   "ar": "أسماء تمارين أكثر ترتيبًا، ومدة راحة صحيحة"
+  },
+  "l10n_app_changelog_tidy_your_journal_remove_and_hide_aa1c0b94": {
+   "en": "Tidy your journal - remove and hide questions",
+   "ar": "رتّب يومياتك — احذف الأسئلة وأخفِها"
+  },
+  "l10n_app_changelog_times_follow_your_12_24_hour_9c552783": {
+   "en": "Times follow your 12-/24-hour setting",
+   "ar": "الأوقات تتبع إعداد 12/24 ساعة لديك"
+  },
+  "l10n_app_changelog_today_header_date_fix_west_of_e5e7422d": {
+   "en": "Today header date fix (west-of-UTC)",
+   "ar": "إصلاح تاريخ رأس «اليوم» (غرب UTC)"
+  },
+  "l10n_app_changelog_today_reflects_today_not_stale_imports_1a341a21": {
+   "en": "Today reflects today (not stale imports)",
+   "ar": "«اليوم» يعكس اليوم (لا عمليات استيراد قديمة)"
+  },
+  "l10n_app_changelog_today_s_effort_goes_live_plus_5f810b61": {
+   "en": "Today\\'s Effort goes live - plus sleep & alarm honesty",
+   "ar": "جهد اليوم يصبح مباشرًا — مع صدق في النوم والمنبّه"
+  },
+  "l10n_app_changelog_today_s_effort_no_longer_drops_f49a3428": {
+   "en": "Today\\'s Effort no longer drops to zero",
+   "ar": "جهد اليوم لم يعد يهبط إلى الصفر"
+  },
+  "l10n_app_changelog_today_tiles_no_longer_cut_their_3c167cc1": {
+   "en": "Today tiles no longer cut their value to \"10…\"",
+   "ar": "بطاقات «اليوم» لم تعد تقتطع قيمتها إلى «10…»"
+  },
+  "l10n_app_changelog_today_tiles_no_longer_truncate_their_2959ce81": {
+   "en": "Today tiles no longer truncate their value (Android)",
+   "ar": "بطاقات «اليوم» لم تعد تقتطع قيمتها (Android)"
+  },
+  "l10n_app_changelog_today_trends_stay_within_their_window_ba2e4c57": {
+   "en": "Today trends stay within their window (Mac)",
+   "ar": "اتجاهات «اليوم» تبقى ضمن نافذتها (Mac)"
+  },
+  "l10n_app_changelog_toggle_the_live_hr_dynamic_island_d3bd70cb": {
+   "en": "Toggle the live-HR Dynamic Island",
+   "ar": "مفتاح Dynamic Island للنبض المباشر"
+  },
+  "l10n_app_changelog_track_a_workout_manually_2eb43402": {
+   "en": "Track a workout manually",
+   "ar": "تتبّع تمرين يدويًا"
+  },
+  "l10n_app_changelog_training_load_a_vo_max_without_f9205a67": {
+   "en": "Training load, a VO₂max without a tape measure, and far less battery spent re-scoring",
+   "ar": "حمل التدريب، وVO₂max دون شريط قياس، وبطارية أقل بكثير في إعادة الاحتساب"
+  },
+  "l10n_app_changelog_trends_report_explains_its_scores_e338d1ee": {
+   "en": "Trends report explains its scores",
+   "ar": "تقرير الاتجاهات يشرح درجاته"
+  },
+  "l10n_app_changelog_true_battery_a_sync_indicator_and_89037fc3": {
+   "en": "True battery %, a sync indicator, and HR on imported workouts",
+   "ar": "نسبة بطارية حقيقية %، ومؤشر مزامنة، ونبض في التمارين المستوردة"
+  },
+  "l10n_app_changelog_two_quick_fixes_the_blue_titanium_4c021d78": {
+   "en": "Two quick fixes: the Blue Titanium icon, and Mac \"Your Cards\"",
+   "ar": "إصلاحان سريعان: أيقونة Blue Titanium، و«بطاقاتك» على Mac"
+  },
+  "l10n_app_changelog_under_the_hood_current_api_migration_672da037": {
+   "en": "Under-the-hood: current-API migration (no behaviour change)",
+   "ar": "تحت الغطاء: الانتقال إلى واجهات البرمجة الحالية (دون تغيير في السلوك)"
+  },
+  "l10n_app_changelog_universal_mac_build_iphone_import_fix_363425a0": {
+   "en": "Universal Mac build + iPhone import fix",
+   "ar": "إصدار Mac شامل + إصلاح استيراد iPhone"
+  },
+  "l10n_app_changelog_update_check_shows_what_s_new_6779c2e3": {
+   "en": "Update check shows what\\'s new",
+   "ar": "التحقق من التحديثات يعرض ما الجديد"
+  },
+  "l10n_app_changelog_updates_check_github_again_1e00ced1": {
+   "en": "Updates check GitHub again",
+   "ar": "التحديثات تتحقق من GitHub مجددًا"
+  },
+  "l10n_app_changelog_v5_the_raw_signal_release_noop_c109e3f2": {
+   "en": "v5 - the raw-signal release: NOOP reads the signal, on your device, free",
+   "ar": "الإصدار 5 — إصدار الإشارة الخام: NOOP يقرأ الإشارة، على جهازك، مجانًا"
+  },
+  "l10n_app_changelog_water_and_caffeine_from_apple_health_5123b6b0": {
+   "en": "Water and caffeine from Apple Health, a sharper Effort score, and an Oura resting-heart-rate fix",
+   "ar": "الماء والكافيين من Apple Health، ودرجة جهد أدق، وإصلاح نبض الراحة في Oura"
+  },
+  "l10n_app_changelog_week_in_review_is_honest_about_4c225bd3": {
+   "en": "Week in Review is honest about a half-finished week",
+   "ar": "مراجعة الأسبوع صادقة بشأن أسبوع غير مكتمل"
+  },
+  "l10n_app_changelog_whoop_4_0_is_the_supported_16893d9d": {
+   "en": "WHOOP 4.0 is the supported path",
+   "ar": "‏WHOOP 4.0 هو المسار المدعوم"
+  },
+  "l10n_app_changelog_whoop_5_0_history_decoding_comes_a8848386": {
+   "en": "WHOOP 5.0 history decoding comes to Android",
+   "ar": "فكّ ترميز سجل WHOOP 5.0 يصل إلى Android"
+  },
+  "l10n_app_changelog_whoop_5_0_mg_buzz_the_c1ab45a8": {
+   "en": "WHOOP 5.0/MG buzz - the real command (matched byte-for-byte)",
+   "ar": "اهتزاز WHOOP 5.0/MG — الأمر الحقيقي (مطابق بايت ببايت)"
+  },
+  "l10n_app_changelog_whoop_5_0_mg_buzz_trying_98373c44": {
+   "en": "WHOOP 5.0/MG buzz - trying the right command (experimental)",
+   "ar": "اهتزاز WHOOP 5.0/MG — تجربة الأمر الصحيح (تجريبي)"
+  },
+  "l10n_app_changelog_whoop_5_0_mg_history_download_36cc4425": {
+   "en": "WHOOP 5.0/MG history download (experimental) + pairing help (Mac)",
+   "ar": "تنزيل سجل WHOOP 5.0/MG (تجريبي) + مساعدة الاقتران (Mac)"
+  },
+  "l10n_app_changelog_whoop_5_0_mg_history_offload_76f5af44": {
+   "en": "WHOOP 5.0/MG history offload (Android)",
+   "ar": "تفريغ سجل WHOOP 5.0/MG (Android)"
+  },
+  "l10n_app_changelog_whoop_5_mg_deep_data_live_2612bf3d": {
+   "en": "WHOOP 5/MG deep data: live confirmation it\\'s working",
+   "ar": "البيانات العميقة لـ WHOOP 5/MG: تأكيد مباشر أنها تعمل"
+  },
+  "l10n_app_changelog_whoop_5_mg_deep_sync_decode_652c34d2": {
+   "en": "WHOOP 5/MG deep-sync decode + sleep & workout fixes",
+   "ar": "فكّ ترميز المزامنة العميقة لـ WHOOP 5/MG + إصلاحات النوم والتمارين"
+  },
+  "l10n_app_changelog_whoop_5_mg_frame_capture_mac_9e84ee52": {
+   "en": "WHOOP 5/MG frame capture (Mac)",
+   "ar": "التقاط إطارات WHOOP 5/MG (Mac)"
+  },
+  "l10n_app_changelog_whoop_5_mg_heart_rate_on_11816e98": {
+   "en": "WHOOP 5/MG heart rate on Android",
+   "ar": "نبض WHOOP 5/MG على Android"
+  },
+  "l10n_app_changelog_whoop_5_mg_heart_rate_on_b66c6752": {
+   "en": "WHOOP 5/MG heart rate on Mac + a Readiness fix",
+   "ar": "نبض WHOOP 5/MG على Mac + إصلاح الجاهزية"
+  },
+  "l10n_app_changelog_whoop_5_mg_history_the_missing_b4d5db99": {
+   "en": "WHOOP 5/MG history: the missing clock",
+   "ar": "سجل WHOOP 5/MG: الساعة المفقودة"
+  },
+  "l10n_app_changelog_whoop_5_mg_secure_pairing_fix_ed6550f3": {
+   "en": "WHOOP 5/MG: secure-pairing fix",
+   "ar": "‏WHOOP 5/MG: إصلاح الاقتران الآمن"
+  },
+  "l10n_app_changelog_whoop_5_mg_the_buzz_works_a0308753": {
+   "en": "WHOOP 5/MG: the buzz works",
+   "ar": "‏WHOOP 5/MG: الاهتزاز يعمل"
+  },
+  "l10n_app_changelog_whoop_style_hrv_warm_ups_counted_199aaa42": {
+   "en": "WHOOP-style HRV, warm-ups counted, and clearer cards",
+   "ar": "تقلب نبض بأسلوب WHOOP، واحتساب الإحماء، وبطاقات أوضح"
+  },
+  "l10n_app_changelog_widgets_stop_inventing_numbers_naps_count_4f7491bb": {
+   "en": "Widgets stop inventing numbers, naps count toward sleep debt, and the Android status chips speak your language",
+   "ar": "الأدوات تتوقف عن اختلاق الأرقام، والقيلولات تُحتسب في دين النوم، ومؤشرات Android تتحدث لغتك"
+  },
+  "l10n_app_changelog_workout_calories_for_manual_sessions_and_5d61f59a": {
+   "en": "Workout calories - for manual sessions and Health Connect imports",
+   "ar": "سعرات التمرين — للجلسات اليدوية وعمليات استيراد Health Connect"
+  },
+  "l10n_app_changelog_workout_display_fixes_255b56e8": {
+   "en": "Workout display fixes",
+   "ar": "إصلاحات عرض التمارين"
+  },
+  "l10n_app_changelog_workouts_correct_source_pill_for_health_787243ea": {
+   "en": "Workouts: correct source pill for Health Connect (Android)",
+   "ar": "التمارين: مؤشر مصدر صحيح لـ Health Connect (Android)"
+  },
+  "l10n_app_changelog_workouts_header_layout_fix_phone_fa23fbec": {
+   "en": "Workouts header layout fix (phone)",
+   "ar": "إصلاح تخطيط رأس «التمارين» (الهاتف)"
+  },
+  "l10n_app_changelog_wrist_alerts_for_incoming_calls_android_9bf80a06": {
+   "en": "Wrist alerts for incoming calls (Android)",
+   "ar": "تنبيهات المعصم للمكالمات الواردة (Android)"
+  },
+  "l10n_app_changelog_wrist_alerts_work_on_android_09e544a9": {
+   "en": "Wrist alerts work on Android",
+   "ar": "تنبيهات المعصم تعمل على Android"
+  },
+  "l10n_app_changelog_your_fitness_age_vitality_body_age_8e9867fb": {
+   "en": "Your Fitness Age, Vitality & Body Age",
+   "ar": "عمرك اللياقي، والحيوية، وعمر الجسد"
+  },
+  "l10n_app_changelog_your_imported_steps_now_show_on_d79f0b36": {
+   "en": "Your imported steps now show on the Today screen (Android)",
+   "ar": "خطواتك المستوردة تظهر الآن في شاشة «اليوم» (Android)"
+  },
+  "l10n_app_changelog_your_macos_data_is_back_and_e5e3e3bd": {
+   "en": "Your macOS data is back — and full French",
+   "ar": "بيانات macOS عادت — وفرنسية كاملة"
+  },
+  "l10n_app_changelog_your_scores_build_over_a_few_41388c54": {
+   "en": "Your scores build over a few nights",
+   "ar": "درجاتك تتكوّن عبر بضع ليالٍ"
+  },
+  "l10n_app_changelog_your_whole_day_s_heart_rate_e57593f8": {
+   "en": "Your whole day\\'s heart rate, on the dashboard",
+   "ar": "نبض يومك كاملًا، على اللوحة"
+  },
+  "l10n_app_changelog_your_whoop_journal_in_insights_clearer_88f5e21b": {
+   "en": "Your WHOOP journal in Insights, clearer metric taps",
+   "ar": "يوميات WHOOP في الرؤى، ونقرات مقاييس أوضح"
+  },
+  "l10n_app_root_more_4bab2d8f": {
+   "en": "More",
+   "ar": "المزيد"
+  },
+  "l10n_app_root_this_section_is_on_the_way_ca7c4a32": {
+   "en": "This section is on the way.",
+   "ar": "هذا القسم قادم قريبًا."
+  },
+  "l10n_app_root_updates_c76d1807": {
+   "en": "Updates",
+   "ar": "التحديثات"
+  },
+  "l10n_apple_health_screen_no_readings_recorded_05018b26": {
+   "en": "No readings recorded.",
+   "ar": "لا قراءات مسجّلة."
+  },
+  "l10n_apple_health_screen_nothing_imported_yet_f457cdbe": {
+   "en": "Nothing imported yet",
+   "ar": "لم يُستورد شيء بعد"
+  },
+  "l10n_apple_health_screen_reading_your_apple_health_history_1a3bf76d": {
+   "en": "Reading your Apple Health history…",
+   "ar": "جارٍ قراءة سجل Apple Health…"
+  },
+  "l10n_auto_workout_nudge_dismiss_this_workout_suggestion_52ace8f3": {
+   "en": "Dismiss this workout suggestion",
+   "ar": "تجاهل اقتراح التمرين هذا"
+  },
+  "l10n_auto_workout_nudge_looks_like_a_workout_e745e403": {
+   "en": "Looks like a workout",
+   "ar": "يبدو أنه تمرين"
+  },
+  "l10n_auto_workout_nudge_not_a_workout_15c5f784": {
+   "en": "Not a workout",
+   "ar": "ليس تمرينًا"
+  },
+  "l10n_auto_workout_nudge_save_it_01d23661": {
+   "en": "Save it",
+   "ar": "احفظه"
+  },
+  "l10n_automations_screen_automations_82542d6d": {
+   "en": "Automations",
+   "ar": "الأتمتة"
+  },
+  "l10n_automations_screen_battery_alerts_f3679d60": {
+   "en": "Battery alerts",
+   "ar": "تنبيهات البطارية"
+  },
+  "l10n_automations_screen_buzz_strength_e895f99e": {
+   "en": "Buzz strength",
+   "ar": "قوة الاهتزاز"
+  },
+  "l10n_automations_screen_choose_double_tap_action_6ac9a313": {
+   "en": "Choose double-tap action",
+   "ar": "اختر إجراء النقر المزدوج"
+  },
+  "l10n_automations_screen_detect_short_naps_bbfd136d": {
+   "en": "Detect short naps",
+   "ar": "اكتشاف القيلولات القصيرة"
+  },
+  "l10n_automations_screen_double_tap_8d2f1646": {
+   "en": "Double-tap",
+   "ar": "نقر مزدوج"
+  },
+  "l10n_automations_screen_each_day_uses_the_time_above_f9bc9ce3": {
+   "en": "Each day uses the time above unless you set a different one here.",
+   "ar": "يستخدم كل يوم الوقت أعلاه ما لم تضبط وقتًا مختلفًا هنا."
+  },
+  "l10n_automations_screen_enable_inactivity_reminder_468c3017": {
+   "en": "Enable inactivity reminder",
+   "ar": "تفعيل تذكير الخمول"
+  },
+  "l10n_automations_screen_from_3f66052a": {
+   "en": "From",
+   "ar": "من"
+  },
+  "l10n_automations_screen_haptic_coaching_e2fab286": {
+   "en": "Haptic coaching",
+   "ar": "إرشاد بالاهتزاز"
+  },
+  "l10n_automations_screen_hr_zone_coaching_9306e6e1": {
+   "en": "HR-zone coaching",
+   "ar": "إرشاد مناطق النبض"
+  },
+  "l10n_automations_screen_illness_early_warning_453ab477": {
+   "en": "Illness early-warning",
+   "ar": "إنذار مبكر بالمرض"
+  },
+  "l10n_automations_screen_inactivity_reminder_ca49b1ba": {
+   "en": "Inactivity reminder",
+   "ar": "تذكير الخمول"
+  },
+  "l10n_automations_screen_nap_detection_ca2dedf5": {
+   "en": "Nap detection",
+   "ar": "اكتشاف القيلولة"
+  },
+  "l10n_automations_screen_no_naps_to_review_detected_naps_2e82e9fc": {
+   "en": "No naps to review. Detected naps show up here after a history sync.",
+   "ar": "لا قيلولات للمراجعة. تظهر القيلولات المكتشفة هنا بعد مزامنة السجل."
+  },
+  "l10n_automations_screen_notifications_are_off_so_this_can_b3dba7ee": {
+   "en": "Notifications are off, so this can\\'t buzz yet. Turn on the master switch in ",
+   "ar": "الإشعارات مغلقة، لذا لا يمكن أن يهتز هذا بعد. فعّل المفتاح الرئيسي في "
+  },
+  "l10n_automations_screen_notify_on_low_and_full_battery_d1903bb8": {
+   "en": "Notify on low and full battery",
+   "ar": "تنبيه عند انخفاض البطارية واكتمالها"
+  },
+  "l10n_automations_screen_only_during_active_hours_29c53fc9": {
+   "en": "Only during active hours",
+   "ar": "أثناء ساعات النشاط فقط"
+  },
+  "l10n_automations_screen_per_day_wake_time_873c81e1": {
+   "en": "Per-day wake time",
+   "ar": "وقت الاستيقاظ لكل يوم"
+  },
+  "l10n_automations_screen_predictive_runtime_warning_4d85f5a6": {
+   "en": "Predictive runtime warning",
+   "ar": "تحذير تنبؤي بمدة التشغيل"
+  },
+  "l10n_automations_screen_re_nudge_every_646023cd": {
+   "en": "Re-nudge every",
+   "ar": "إعادة التذكير كل"
+  },
+  "l10n_automations_screen_recovery_buzz_1abc9a51": {
+   "en": "Recovery buzz",
+   "ar": "اهتزاز التعافي"
+  },
+  "l10n_automations_screen_reset_44c57abd": {
+   "en": "Reset",
+   "ar": "إعادة تعيين"
+  },
+  "l10n_automations_screen_sitting_for_e464c472": {
+   "en": "Sitting for",
+   "ar": "الجلوس لمدة"
+  },
+  "l10n_automations_screen_test_action_266df314": {
+   "en": "Test action",
+   "ar": "اختبار الإجراء"
+  },
+  "l10n_automations_screen_watch_for_early_illness_signs_4c22e127": {
+   "en": "Watch for early-illness signs",
+   "ar": "مراقبة علامات المرض المبكرة"
+  },
+  "l10n_automations_screen_when_i_double_tap_a1f1e04d": {
+   "en": "When I double-tap",
+   "ar": "عند النقر المزدوج"
+  },
+  "l10n_backup_sync_screen_auto_backup_hasn_t_run_in_e3cd484e": {
+   "en": "Auto-backup hasn\\'t run in a few days. Check the backup folder is still available — a moved or disconnected cloud folder stops backups silently.",
+   "ar": "لم يعمل النسخ الاحتياطي التلقائي منذ عدة أيام. تأكد من أن مجلد النسخ ما زال متاحًا — فالمجلد السحابي المنقول أو غير المتصل يوقف النسخ بصمت."
+  },
+  "l10n_backup_sync_screen_backup_folder_2a33df93": {
+   "en": "Backup folder",
+   "ar": "مجلد النسخ الاحتياطي"
+  },
+  "l10n_backup_sync_screen_backup_sync_81758ffa": {
+   "en": "Backup & Sync",
+   "ar": "النسخ الاحتياطي والمزامنة"
+  },
+  "l10n_backup_sync_screen_backup_time_81557aaa": {
+   "en": "Backup time",
+   "ar": "وقت النسخ الاحتياطي"
+  },
+  "l10n_backup_sync_screen_cancel_77dfd213": {
+   "en": "Cancel",
+   "ar": "إلغاء"
+  },
+  "l10n_backup_sync_screen_choose_a_backup_2fbfb0d6": {
+   "en": "Choose a backup",
+   "ar": "اختر نسخة احتياطية"
+  },
+  "l10n_backup_sync_screen_daily_auto_backup_e5627357": {
+   "en": "Daily auto-backup",
+   "ar": "نسخ احتياطي تلقائي يومي"
+  },
+  "l10n_backup_sync_screen_keep_last_snapshots_cd5c9ea9": {
+   "en": "Keep last snapshots",
+   "ar": "الاحتفاظ بآخر النسخ"
+  },
+  "l10n_backup_sync_screen_newest_first_restoring_replaces_this_device_97dbcd8b": {
+   "en": "Newest first. Restoring replaces this device\\'s data.",
+   "ar": "الأحدث أولًا. الاستعادة تستبدل بيانات هذا الجهاز."
+  },
+  "l10n_backup_sync_screen_older_backups_beyond_this_many_are_00b7daa6": {
+   "en": "Older backups beyond this many are pruned, oldest first (≈ that many days of ",
+   "ar": "تُحذف النسخ الأقدم بعد هذا العدد، بدءًا من الأقدم (≈ هذا العدد من الأيام من "
+  },
+  "l10n_backup_sync_screen_replace_a7cf7b25": {
+   "en": "Replace",
+   "ar": "استبدال"
+  },
+  "l10n_backup_sync_screen_replace_all_current_data_e9244799": {
+   "en": "Replace all current data?",
+   "ar": "استبدال كل البيانات الحالية؟"
+  },
+  "l10n_backup_sync_screen_replace_all_current_data_with_label_b7799a16": {
+   "en": "Replace all current data with %1$s? This cannot be undone.",
+   "ar": "استبدال كل البيانات الحالية بـ %1$s؟ لا يمكن التراجع عن ذلك."
+  },
+  "l10n_backup_sync_screen_replace_this_device_s_data_with_b8679c51": {
+   "en": "Replace this device\\'s data with one of your backups. This overwrites current data, ",
+   "ar": "استبدل بيانات هذا الجهاز بإحدى نسخك الاحتياطية. يستبدل هذا البيانات الحالية، "
+  },
+  "l10n_backup_sync_screen_restore_3cbe6d6b": {
+   "en": "Restore",
+   "ar": "استعادة"
+  },
+  "l10n_backup_sync_screen_restore_from_a_backup_c28917c6": {
+   "en": "Restore from a backup…",
+   "ar": "الاستعادة من نسخة احتياطية…"
+  },
+  "l10n_backup_sync_screen_roughly_when_the_daily_backup_runs_71de04e1": {
+   "en": "Roughly when the daily backup runs (best-effort — the system may slide it a little).",
+   "ar": "تقريبًا متى يعمل النسخ اليومي (بأفضل جهد — قد يؤجّله النظام قليلًا)."
+  },
+  "l10n_backup_sync_screen_these_backups_are_unencrypted_too_if_53e70fe8": {
+   "en": "These backups are unencrypted too. If this folder syncs to Drive, Dropbox or iCloud, the readable file goes there as well — only point it at a service you trust.",
+   "ar": "هذه النسخ غير مشفّرة أيضًا. إذا كان هذا المجلد يتزامن مع Drive أو Dropbox أو iCloud، فسينتقل الملف المقروء إلى هناك كذلك — فوجّهه إلى خدمة تثق بها فقط."
+  },
+  "l10n_backup_sync_screen_tip_a_desktop_drive_dropbox_app_2eaff1e3": {
+   "en": "Tip: a desktop Drive / Dropbox app auto-syncs a chosen folder. On the phone, save to a ",
+   "ar": "نصيحة: تطبيق Drive / Dropbox على سطح المكتب يزامن مجلدًا تختاره تلقائيًا. على الهاتف، احفظ في "
+  },
+  "l10n_backup_sync_screen_writes_a_fresh_dated_backup_to_bd964fc5": {
+   "en": "Writes a fresh dated backup to your folder once a day at the time below, keeping ",
+   "ar": "يكتب نسخة احتياطية جديدة مؤرخة في مجلدك مرة يوميًا في الوقت أدناه، مع الاحتفاظ بـ "
+  },
+  "l10n_body_clock_dial_card_1_s_earlier_than_your_body_68877f50": {
+   "en": "%1$s earlier than your body clock",
+   "ar": "أبكر بـ %1$s من ساعتك البيولوجية"
+  },
+  "l10n_body_clock_dial_card_1_s_later_than_your_body_50b7d966": {
+   "en": "%1$s later than your body clock",
+   "ar": "أمتأخر بـ %1$s عن ساعتك البيولوجية"
+  },
+  "l10n_body_clock_dial_card_body_clock_b0b9b988": {
+   "en": "Body clock",
+   "ar": "الساعة البيولوجية"
+  },
+  "l10n_body_clock_dial_card_body_clock_dial_03cdbc31": {
+   "en": "Body clock dial",
+   "ar": "قرص الساعة البيولوجية"
+  },
+  "l10n_body_clock_dial_card_evening_type_3e1ce111": {
+   "en": "Evening type",
+   "ar": "نمط مسائي"
+  },
+  "l10n_body_clock_dial_card_in_sync_with_your_body_clock_4b5181c8": {
+   "en": "In sync with your body clock",
+   "ar": "متوافق مع ساعتك البيولوجية"
+  },
+  "l10n_body_clock_dial_card_intermediate_type_a7b6b74c": {
+   "en": "Intermediate type",
+   "ar": "نمط متوسط"
+  },
+  "l10n_body_clock_dial_card_last_night_6eaba4dd": {
+   "en": "Last night",
+   "ar": "الليلة الماضية"
+  },
+  "l10n_body_clock_dial_card_last_night_against_your_clock_9183a37c": {
+   "en": "Last night against your clock",
+   "ar": "الليلة الماضية مقابل ساعتك"
+  },
+  "l10n_body_clock_dial_card_morning_type_289dd7bf": {
+   "en": "Morning type",
+   "ar": "نمط صباحي"
+  },
+  "l10n_body_clock_dial_card_your_clock_1b91f5ee": {
+   "en": "Your clock",
+   "ar": "ساعتك"
+  },
+  "l10n_breathe_screen_a_relaxation_rhythm_not_cardiac_control_5c2f10a8": {
+   "en": "A relaxation rhythm, not cardiac control. It never paces below a safe rate and you can stop anytime. If your heart rate doesn\\'t settle, we\\'ll say so plainly.",
+   "ar": "إيقاع للاسترخاء، لا تحكّم في القلب. لا يهبط بالإيقاع دون معدل آمن ويمكنك التوقف في أي وقت. وإذا لم يهدأ نبضك، سنقول ذلك بوضوح."
+  },
+  "l10n_breathe_screen_about_pace_o3p4q5r6": {
+   "en": "About this pace",
+   "ar": "عن هذا الإيقاع"
+  },
+  "l10n_breathe_screen_audio_cues_74430aec": {
+   "en": "Audio cues",
+   "ar": "تنبيهات صوتية"
+  },
+  "l10n_breathe_screen_breathcount_breaths_ce036831": {
+   "en": "%1$s breaths",
+   "ar": "%1$s نفَس"
+  },
+  "l10n_breathe_screen_breathe_282be568": {
+   "en": "Breathe",
+   "ar": "التنفس"
+  },
+  "l10n_breathe_screen_breathe_in_a5b6c7d8": {
+   "en": "Breathe in…",
+   "ar": "شهيق…"
+  },
+  "l10n_breathe_screen_breathe_now_98d6c341": {
+   "en": "Breathe now",
+   "ar": "تنفّس الآن"
+  },
+  "l10n_breathe_screen_breathe_out_e9f0a1b2": {
+   "en": "Breathe out…",
+   "ar": "زفير…"
+  },
+  "l10n_breathe_screen_calm_me_3_min_11250c77": {
+   "en": "Calm me · 3 min",
+   "ar": "هدّئني · 3 دقائق"
+  },
+  "l10n_breathe_screen_calm_me_a1b2c3d4": {
+   "en": "Calm me",
+   "ar": "هدّئني"
+  },
+  "l10n_breathe_screen_connect_your_strap_calm_me_is_71314744": {
+   "en": "Connect your strap. Calm me is a felt rhythm on the wrist, so it needs a bonded connection.",
+   "ar": "وصّل سوارك. «هدّئني» إيقاع محسوس على المعصم، لذا يحتاج إلى اتصال مقترن."
+  },
+  "l10n_breathe_screen_connect_your_strap_for_haptic_guidance_65660684": {
+   "en": "Connect your strap for haptic guidance. You\\'ll feel one pulse on the inhale, two on the exhale, so you can breathe with your eyes closed.",
+   "ar": "وصّل سوارك للإرشاد بالاهتزاز. ستشعر بنبضة واحدة عند الشهيق ونبضتين عند الزفير، لتتنفس وعيناك مغمضتان."
+  },
+  "l10n_breathe_screen_disclaimer_w1x2y3z4": {
+   "en": "Estimate only — not medical advice. Stop if you feel unwell.",
+   "ar": "تقدير فقط — ليس نصيحة طبية. توقف إذا شعرت بتوعك."
+  },
+  "l10n_breathe_screen_done_s7t8u9v0": {
+   "en": "Done",
+   "ar": "تم"
+  },
+  "l10n_breathe_screen_estimate_from_ppg_derived_r_r_9c92fbae": {
+   "en": "Estimate from PPG-derived R-R: relaxation guidance, not a clinical reading. Your pace drifts, so we date it and you can re-measure anytime.",
+   "ar": "تقدير من فترات R-R المشتقة من PPG: إرشاد للاسترخاء وليس قراءة سريرية. إيقاعك يتغير، لذا نؤرّخه ويمكنك إعادة القياس متى شئت."
+  },
+  "l10n_breathe_screen_estimate_only_a_higher_rmssd_while_bfd71bb8": {
+   "en": "Estimate only: a higher RMSSD while paced usually means your parasympathetic \"rest\" branch is engaging. It is not a clinical reading; trends over a session matter more than any single number.",
+   "ar": "تقدير فقط: ارتفاع RMSSD أثناء الإيقاع يعني عادةً أن فرعك السمبثاوي المسؤول عن «الراحة» يعمل. ليست قراءة سريرية؛ والاتجاهات عبر الجلسة أهم من أي رقم منفرد."
+  },
+  "l10n_breathe_screen_everyone_has_a_breathing_pace_usually_ad6ea0b4": {
+   "en": "Everyone has a breathing pace (usually between 4.5 and 7 breaths a minute) where the heart\\'s rhythm swings the most with each breath. We pace you through a few candidate paces, measure how your HRV responds, and lock the one that resonates best for you.",
+   "ar": "لكل شخص إيقاع تنفس (عادة بين 4.5 و7 أنفاس في الدقيقة) يتأرجح عنده إيقاع القلب أكثر ما يمكن مع كل نفَس. نمرّ بك عبر عدة إيقاعات مرشّحة، ونقيس استجابة تقلب النبض لديك، ونثبّت الإيقاع الأكثر رنينًا لك."
+  },
+  "l10n_breathe_screen_follow_cue_c3d4e5f6": {
+   "en": "Follow the cue…",
+   "ar": "اتبع الإشارة…"
+  },
+  "l10n_breathe_screen_full_sweep_13_min_08e01d2c": {
+   "en": "Full sweep · ~13 min",
+   "ar": "مسح كامل · ~13 دقيقة"
+  },
+  "l10n_breathe_screen_guided_k9l0m1n2": {
+   "en": "Guided",
+   "ar": "موجّه"
+  },
+  "l10n_breathe_screen_guided_timer_g7h8i9j0": {
+   "en": "Guided timer",
+   "ar": "مؤقّت موجّه"
+  },
+  "l10n_breathe_screen_heart_rate_410aa15c": {
+   "en": "Heart rate",
+   "ar": "معدل النبض"
+  },
+  "l10n_breathe_screen_hold_g5h6i7j8": {
+   "en": "Hold…",
+   "ar": "احبس…"
+  },
+  "l10n_breathe_screen_hrv_rmssd_51014f87": {
+   "en": "HRV (RMSSD)",
+   "ar": "تقلب النبض (RMSSD)"
+  },
+  "l10n_breathe_screen_locked_formatday_datems_paces_drift_re_8ebec15b": {
+   "en": "Locked %1$s · paces drift, re-measure anytime.",
+   "ar": "مثبّت %1$s · الإيقاعات تتغير، أعد القياس متى شئت."
+  },
+  "l10n_breathe_screen_locked_formatday_datems_switch_to_breathe_3efc52c6": {
+   "en": "Locked %1$s. Switch to Breathe to use it, or re-measure above.",
+   "ar": "مثبّت %1$s. انتقل إلى «التنفس» لاستخدامه، أو أعد القياس أعلاه."
+  },
+  "l10n_breathe_screen_locked_pace_o5p6q7r8": {
+   "en": "Your locked pace · %1$.1f br/min",
+   "ar": "إيقاعك المثبّت · %1$.1f نفَس/دقيقة"
+  },
+  "l10n_breathe_screen_not_enough_clean_beat_data_to_865a1260": {
+   "en": "Not enough clean beat data to lock a pace today. Try again rested, sitting still with the strap snug. For now we\\'ll pace you at 5.5 br/min (coherence).",
+   "ar": "لا توجد بيانات نبض نظيفة كافية لتثبيت إيقاع اليوم. حاول مجددًا وأنت مرتاح، جالسًا دون حركة والسوار محكم. وحاليًا سنضبط إيقاعك على 5.5 نفَس/دقيقة (الاتساق)."
+  },
+  "l10n_breathe_screen_not_now_e4571490": {
+   "en": "Not now",
+   "ar": "ليس الآن"
+  },
+  "l10n_breathe_screen_pace_7a9a6226": {
+   "en": "Pace",
+   "ar": "الإيقاع"
+  },
+  "l10n_breathe_screen_protocol_info_c1d2e3f4": {
+   "en": "Protocol info",
+   "ar": "معلومات البروتوكول"
+  },
+  "l10n_breathe_screen_quick_sweep_7_min_5d58f88d": {
+   "en": "Quick sweep · ~7 min",
+   "ar": "مسح سريع · ~7 دقائق"
+  },
+  "l10n_breathe_screen_relaxation_guidance_from_your_own_numbers_16ee0ba1": {
+   "en": "Relaxation guidance from your own numbers: not a health alert, and not a diagnosis. Trends matter more than any single number.",
+   "ar": "إرشاد للاسترخاء من أرقامك أنت: ليس تنبيهًا صحيًا ولا تشخيصًا. الاتجاهات أهم من أي رقم منفرد."
+  },
+  "l10n_breathe_screen_resonance_edu_s9t0u1v2": {
+   "en": "Your locked resonance pace from the Resonance sweep.",
+   "ar": "إيقاع الرنين المثبّت من مسح الرنين."
+  },
+  "l10n_breathe_screen_resonance_k1l2m3n4": {
+   "en": "Resonance",
+   "ar": "الرنين"
+  },
+  "l10n_breathe_screen_session_10_min_a3b4c5d6": {
+   "en": "10 min",
+   "ar": "10 دقائق"
+  },
+  "l10n_breathe_screen_session_15_min_e7f8a9b0": {
+   "en": "15 min",
+   "ar": "15 دقيقة"
+  },
+  "l10n_breathe_screen_session_5_min_c9d0e1f2": {
+   "en": "5 min",
+   "ar": "5 دقائق"
+  },
+  "l10n_breathe_screen_session_length_a1b2c3d4": {
+   "en": "Session length",
+   "ar": "مدة الجلسة"
+  },
+  "l10n_breathe_screen_session_open_e5f6a7b8": {
+   "en": "Open",
+   "ar": "فتح"
+  },
+  "l10n_breathe_screen_sign_kotlin_math_abs_trend_hrv_e9362899": {
+   "en": "%1$s%2$s%% HRV",
+   "ar": "%1$s%2$s%% تقلب النبض"
+  },
+  "l10n_breathe_screen_sit_still_and_breathe_with_the_b7c53c40": {
+   "en": "Sit still and breathe with the buzz. You can stop anytime; a stopped sweep won\\'t lock a pace.",
+   "ar": "اجلس دون حركة وتنفّس مع الاهتزاز. يمكنك التوقف في أي وقت؛ والمسح المتوقف لن يثبّت إيقاعًا."
+  },
+  "l10n_breathe_screen_soft_tone_on_each_phase_honours_2a02c284": {
+   "en": "Soft tone on each phase · honours silent mode",
+   "ar": "نغمة خفيفة عند كل مرحلة · تحترم الوضع الصامت"
+  },
+  "l10n_breathe_screen_started_at_it_bpm_the_rhythm_dda6a573": {
+   "en": "Started at %1$s bpm · the rhythm trails your heart down.",
+   "ar": "بدأنا عند %1$s نبضة/دقيقة · الإيقاع يتبع هبوط قلبك."
+  },
+  "l10n_breathe_screen_stop_9e253470": {
+   "en": "Stop",
+   "ar": "إيقاف"
+  },
+  "l10n_breathe_screen_stop_sweep_55299cf9": {
+   "en": "Stop sweep",
+   "ar": "إيقاف المسح"
+  },
+  "l10n_breathe_screen_test_buzz_deeab5ae": {
+   "en": "Test buzz",
+   "ar": "اختبار الاهتزاز"
+  },
+  "l10n_breathe_screen_that_s_normal_a_paced_breath_72e2d011": {
+   "en": "That\\'s normal. A paced breath often settles things when a metronome alone doesn\\'t.",
+   "ar": "هذا طبيعي. النفَس المنتظم غالبًا ما يهدّئ حين لا يفلح المترونوم وحده."
+  },
+  "l10n_breathe_screen_the_strap_buzzes_a_gentle_rhythm_eb5c6a65": {
+   "en": "The strap buzzes a gentle rhythm just below your current heart rate, a felt metronome to relax toward. It trails your heart down rather than yanking it, and stops on its own.",
+   "ar": "يهتز السوار بإيقاع لطيف أقل قليلًا من معدل نبضك الحالي، كمترونوم محسوس تسترخي نحوه. يتبع هبوط قلبك بدل أن يجذبه، ويتوقف من تلقاء نفسه."
+  },
+  "l10n_breathe_screen_turn_off_8807c2b3": {
+   "en": "Turn off",
+   "ar": "إيقاف"
+  },
+  "l10n_breathe_screen_waiting_for_a_resting_heart_rate_980cedbf": {
+   "en": "Waiting for a resting heart rate. Start a live reading first, or come back when you\\'re still.",
+   "ar": "في انتظار معدل نبض في الراحة. ابدأ قراءة مباشرة أولًا، أو عد حين تكون ساكنًا."
+  },
+  "l10n_breathe_screen_your_hrv_dipped_while_you_were_231d3c7a": {
+   "en": "Your HRV dipped while you were still. Want a minute to breathe?",
+   "ar": "انخفض تقلب نبضك بينما كنت ساكنًا. أتريد دقيقة للتنفس؟"
+  },
+  "l10n_caffeine_log_after_your_clocklabel_cutoffminutes_cutoff_may_3c023900": {
+   "en": "After your %1$s cutoff - may still be active at bed.",
+   "ar": "بعد حدّك %1$s — قد يظل فعّالًا عند النوم."
+  },
+  "l10n_caffeine_log_amount_in_mg_optional_f0749888": {
+   "en": "Amount in mg (optional)",
+   "ar": "الكمية بالمليغرام (اختياري)"
+  },
+  "l10n_caffeine_log_bedtime_e3cb8bd6": {
+   "en": "Bedtime",
+   "ar": "وقت النوم"
+  },
+  "l10n_caffeine_log_caffeine_22859fa3": {
+   "en": "Caffeine",
+   "ar": "الكافيين"
+  },
+  "l10n_caffeine_log_flag_drinks_late_enough_to_still_af311272": {
+   "en": "Flag drinks late enough to still be active at bedtime.",
+   "ar": "تمييز المشروبات المتأخرة بما يكفي لتظل فعّالة عند النوم."
+  },
+  "l10n_caffeine_log_had_it_8576ac66": {
+   "en": "Had it",
+   "ar": "تناولته"
+  },
+  "l10n_caffeine_log_have_your_last_caffeine_by_about_16b09033": {
+   "en": "Have your last caffeine by about %1$s to clear most of it ",
+   "ar": "تناول آخر كافيين قبل %1$s تقريبًا ليزول معظمه "
+  },
+  "l10n_caffeine_log_late_caffeine_nudge_6b2ff690": {
+   "en": "Late-caffeine nudge",
+   "ar": "تنبيه الكافيين المتأخر"
+  },
+  "l10n_caffeine_log_log_a_coffee_tea_or_energy_982bde5b": {
+   "en": "Log a coffee, tea, or energy drink and NOOP shows a rough estimate of how much may still be active. It\\'s a guide based on a typical 5 to 6 hour half-life, not a measurement.",
+   "ar": "سجّل قهوة أو شايًا أو مشروب طاقة، ويعرض NOOP تقديرًا تقريبيًا لما قد يظل فعّالًا. إنه دليل مبني على عمر نصف نموذجي من 5 إلى 6 ساعات، وليس قياسًا."
+  },
+  "l10n_caffeine_log_logged_today_0071a46c": {
+   "en": "Logged today",
+   "ar": "سُجِّل اليوم"
+  },
+  "l10n_caffeine_log_remove_e963907d": {
+   "en": "Remove",
+   "ar": "إزالة"
+  },
+  "l10n_coach_screen_api_key_hidden_f3cde531": {
+   "en": "API key (hidden)",
+   "ar": "مفتاح API (مخفي)"
+  },
+  "l10n_coach_screen_ask_anything_about_your_recent_recovery_e6c287ca": {
+   "en": "Ask anything about your recent recovery, strain, sleep or HRV.",
+   "ar": "اسأل عن أي شيء يخص تعافيك أو إجهادك أو نومك أو تقلب نبضك مؤخرًا."
+  },
+  "l10n_coach_screen_ask_your_coach_b1577d4c": {
+   "en": "Ask your coach…",
+   "ar": "اسأل مدربك…"
+  },
+  "l10n_coach_screen_cancel_77dfd213": {
+   "en": "Cancel",
+   "ar": "إلغاء"
+  },
+  "l10n_coach_screen_coach_b32c9ad3": {
+   "en": "Coach",
+   "ar": "المدرب الذكي"
+  },
+  "l10n_coach_screen_coach_error_error_ad9c8c46": {
+   "en": "Coach error: %1$s",
+   "ar": "خطأ في المدرب الذكي: %1$s"
+  },
+  "l10n_coach_screen_coach_instructions_28a07975": {
+   "en": "Coach instructions",
+   "ar": "تعليمات المدرب الذكي"
+  },
+  "l10n_coach_screen_coach_instructions_editor_b8f3ad31": {
+   "en": "Coach instructions editor",
+   "ar": "محرّر تعليمات المدرب الذكي"
+  },
+  "l10n_coach_screen_coach_is_thinking_aaf91547": {
+   "en": "Coach is thinking",
+   "ar": "المدرب الذكي يفكر"
+  },
+  "l10n_coach_screen_connect_a_provider_6967f288": {
+   "en": "Connect a provider",
+   "ar": "وصّل مزوّدًا"
+  },
+  "l10n_coach_screen_connect_b65463cb": {
+   "en": "Connect",
+   "ar": "توصيل"
+  },
+  "l10n_coach_screen_custom_dce04fd3": {
+   "en": "Custom…",
+   "ar": "مخصص…"
+  },
+  "l10n_coach_screen_custom_model_2e3bedea": {
+   "en": "Custom model",
+   "ar": "نموذج مخصص"
+  },
+  "l10n_coach_screen_custom_model_id_6ffe2740": {
+   "en": "Custom model id",
+   "ar": "معرّف نموذج مخصص"
+  },
+  "l10n_coach_screen_disconnect_ed28e068": {
+   "en": "Disconnect",
+   "ar": "قطع الاتصال"
+  },
+  "l10n_coach_screen_disconnect_provider_fa13625c": {
+   "en": "Disconnect provider",
+   "ar": "قطع الاتصال بالمزوّد"
+  },
+  "l10n_coach_screen_e_g_gpt_4o_1da2e4d2": {
+   "en": "e.g. gpt-4o",
+   "ar": "مثال: gpt-4o"
+  },
+  "l10n_coach_screen_enter_any_model_id_the_provider_dce4bbcb": {
+   "en": "Enter any model id the provider accepts.",
+   "ar": "أدخل أي معرّف نموذج يقبله المزوّد."
+  },
+  "l10n_coach_screen_fetch_models_from_provider_6654e1a0": {
+   "en": "Fetch models from provider",
+   "ar": "جلب النماذج من المزوّد"
+  },
+  "l10n_coach_screen_key_header_3f2a9b10": {
+   "en": "Key header",
+   "ar": "ترويسة المفتاح"
+  },
+  "l10n_coach_screen_let_the_coach_use_my_data_405d1188": {
+   "en": "Let the coach use my data",
+   "ar": "السماح للمدرب باستخدام بياناتي"
+  },
+  "l10n_coach_screen_model_selected_tap_to_change_043056c1": {
+   "en": "Model: %1$s. Tap to change.",
+   "ar": "النموذج: %1$s. اضغط للتغيير."
+  },
+  "l10n_coach_screen_reset_to_default_39c90eb7": {
+   "en": "Reset to default",
+   "ar": "إعادة إلى الافتراضي"
+  },
+  "l10n_coach_screen_save_key_f5216b3a": {
+   "en": "Save key",
+   "ar": "حفظ المفتاح"
+  },
+  "l10n_coach_screen_send_message_c70a890d": {
+   "en": "Send message",
+   "ar": "إرسال رسالة"
+  },
+  "l10n_coach_screen_server_url_1d5d1eff": {
+   "en": "Server URL",
+   "ar": "عنوان الخادم"
+  },
+  "l10n_coach_screen_suggested_prompt_prompt_379c0b15": {
+   "en": "Suggested prompt: %1$s",
+   "ar": "طلب مقترح: %1$s"
+  },
+  "l10n_coach_screen_thinking_a60d9c9c": {
+   "en": "Thinking…",
+   "ar": "يفكر…"
+  },
+  "l10n_coach_screen_use_bearer_for_most_local_servers_4429ab64": {
+   "en": "Use Bearer for most local servers; use x-api-key for gateways that require the key in that header.",
+   "ar": "استخدم Bearer لمعظم الخوادم المحلية؛ واستخدم x-api-key للبوابات التي تتطلب المفتاح في تلك الترويسة."
+  },
+  "l10n_coach_screen_use_model_8d558ce2": {
+   "en": "Use model",
+   "ar": "استخدام النموذج"
+  },
+  "l10n_compare_screen_add_a_metric_to_compare_e6a7c9f1": {
+   "en": "Add a metric to compare",
+   "ar": "أضف مقياسًا للمقارنة"
+  },
+  "l10n_compare_screen_compare_8d105cf4": {
+   "en": "Compare",
+   "ar": "مقارنة"
+  },
+  "l10n_compare_screen_compare_needs_at_least_two_metrics_2bfe1fad": {
+   "en": "Compare needs at least two metrics with history",
+   "ar": "المقارنة تحتاج إلى مقياسين على الأقل لهما سجل"
+  },
+  "l10n_compare_screen_not_enough_overlapping_days_between_these_44563110": {
+   "en": "Not enough overlapping days between these metrics in %1$s. Widen the range.",
+   "ar": "لا توجد أيام متداخلة كافية بين هذه المقاييس في %1$s. وسّع النطاق."
+  },
+  "l10n_compare_screen_nothing_selected_yet_60968db6": {
+   "en": "Nothing selected yet.",
+   "ar": "لم يُختر شيء بعد."
+  },
+  "l10n_compare_screen_p_n_overlapping_days_strengthword_p_8a8f56c7": {
+   "en": "%1$s overlapping days · %2$s %3$s correlation",
+   "ar": "%1$s يوم متداخل · ارتباط %2$s %3$s"
+  },
+  "l10n_compare_screen_remove_title_ddb5361c": {
+   "en": "Remove %1$s",
+   "ar": "إزالة %1$s"
+  },
+  "l10n_components_chunks_chunks_pulled_cec186cf": {
+   "en": "%1$s chunks pulled",
+   "ar": "تم سحب %1$s جزء"
+  },
+  "l10n_components_decrease_accessibility_df5f1511": {
+   "en": "Decrease %1$s",
+   "ar": "إنقاص %1$s"
+  },
+  "l10n_components_increase_accessibility_0949c0e9": {
+   "en": "Increase %1$s",
+   "ar": "زيادة %1$s"
+  },
+  "l10n_connection_help_allow_nearby_devices_f7c74880": {
+   "en": "Allow Nearby devices",
+   "ar": "السماح بالأجهزة القريبة"
+  },
+  "l10n_connection_help_charge_it_and_put_it_on_31b04814": {
+   "en": "Charge it and put it on",
+   "ar": "اشحنه وارتدِه"
+  },
+  "l10n_connection_help_close_the_official_whoop_app_768d7d17": {
+   "en": "Close the official WHOOP app",
+   "ar": "أغلق تطبيق WHOOP الرسمي"
+  },
+  "l10n_connection_help_try_connecting_now_41769900": {
+   "en": "Try connecting now",
+   "ar": "جرّب الاتصال الآن"
+  },
+  "l10n_connection_help_turn_bluetooth_on_75868e97": {
+   "en": "Turn Bluetooth on",
+   "ar": "شغّل Bluetooth"
+  },
+  "l10n_connection_help_whoop_5_mg_experimental_109076ae": {
+   "en": "WHOOP 5 / MG (experimental)",
+   "ar": "‏WHOOP 5 / MG (تجريبي)"
+  },
+  "l10n_connection_help_won_t_connect_run_through_these_cfef82f3": {
+   "en": "Won\\'t connect? Run through these",
+   "ar": "لا يتصل؟ راجع هذه الخطوات"
+  },
+  "l10n_connection_help_your_strap_is_connected_and_we_8ab98ac6": {
+   "en": "Your strap is connected and we\\'re trying an experimental handshake to bring up live ",
+   "ar": "سوارك متصل ونحن نجرّب مصافحة تجريبية لتشغيل البث المباشر "
+  },
+  "l10n_coupled_screen_calibrating_calibrationnights_of_baselines_minnightsseed_nights_1a7e8f8e": {
+   "en": "Calibrating, %1$s of %2$s nights",
+   "ar": "جارٍ المعايرة، %1$s من %2$s ليلة"
+  },
+  "l10n_coupled_screen_day_987b9ced": {
+   "en": "Day",
+   "ar": "اليوم"
+  },
+  "l10n_coupled_screen_hoursminutes_asleepmin_slept_732a5b21": {
+   "en": "%1$s slept",
+   "ar": "%1$s نوم"
+  },
+  "l10n_coupled_screen_hoursminutes_needmin_needed_7fc1eb15": {
+   "en": "%1$s needed",
+   "ar": "%1$s مطلوب"
+  },
+  "l10n_coupled_screen_no_effort_yet_f622f99d": {
+   "en": "No effort yet",
+   "ar": "لا جهد بعد"
+  },
+  "l10n_coupled_screen_no_sleep_tracked_last_night_cd0dd79e": {
+   "en": "No sleep tracked last night",
+   "ar": "لم يُسجَّل نوم الليلة الماضية"
+  },
+  "l10n_coupled_screen_recovery_b668d988": {
+   "en": "RECOVERY",
+   "ar": "التعافي"
+  },
+  "l10n_coupled_screen_sleep_performance_4611539f": {
+   "en": "SLEEP PERFORMANCE",
+   "ar": "أداء النوم"
+  },
+  "l10n_data_sources_screen_acts_as_a_standard_bluetooth_heart_f8d13439": {
+   "en": "Acts as a standard Bluetooth heart-rate strap. Pair NOOP from your treadmill, bike or app to see your strap\\'s heart rate there.",
+   "ar": "يعمل كسوار نبض Bluetooth قياسي. اقترن بـ NOOP من جهاز المشي أو الدراجة أو التطبيق لرؤية نبض سوارك هناك."
+  },
+  "l10n_data_sources_screen_auto_sync_health_connect_periodically_6f3f4d92": {
+   "en": "Auto-sync Health Connect periodically",
+   "ar": "مزامنة Health Connect تلقائيًا بشكل دوري"
+  },
+  "l10n_data_sources_screen_auto_sync_periodically_5f3041e8": {
+   "en": "Auto-sync periodically",
+   "ar": "مزامنة تلقائية دورية"
+  },
+  "l10n_data_sources_screen_broadcast_heart_rate_as_a_bluetooth_6a44fdb4": {
+   "en": "Broadcast heart rate as a Bluetooth sensor",
+   "ar": "بثّ معدل النبض كمستشعر Bluetooth"
+  },
+  "l10n_data_sources_screen_broadcast_hr_from_this_phone_10e5605c": {
+   "en": "Broadcast HR from this phone",
+   "ar": "بثّ النبض من هذا الهاتف"
+  },
+  "l10n_data_sources_screen_broadcast_hr_is_on_your_strap_0ad5368a": {
+   "en": "Broadcast HR is ON. This phone is advertising heart rate continuously, which keeps its Bluetooth radio active and drains the battery faster. Turn it off when you\\'re not using it with another device.",
+   "ar": "بثّ النبض مُفعَّل. يبثّ هذا الهاتف معدل النبض باستمرار، مما يبقي راديو Bluetooth نشطًا ويستنزف البطارية أسرع. أوقفه حين لا تستخدمه مع جهاز آخر."
+  },
+  "l10n_data_sources_screen_cancel_77dfd213": {
+   "en": "Cancel",
+   "ar": "إلغاء"
+  },
+  "l10n_data_sources_screen_data_sources_5e43d6bb": {
+   "en": "Data Sources",
+   "ar": "مصادر البيانات"
+  },
+  "l10n_data_sources_screen_every_3560d90b": {
+   "en": "Every",
+   "ar": "كل"
+  },
+  "l10n_data_sources_screen_import_apple_health_export_533fca27": {
+   "en": "Import Apple Health export…",
+   "ar": "استيراد ملف تصدير Apple Health…"
+  },
+  "l10n_data_sources_screen_import_from_health_connect_35d55e21": {
+   "en": "Import from Health Connect",
+   "ar": "الاستيراد من Health Connect"
+  },
+  "l10n_data_sources_screen_import_lifting_log_8fac7b68": {
+   "en": "Import lifting log…",
+   "ar": "استيراد سجل تمارين القوة…"
+  },
+  "l10n_data_sources_screen_import_mi_band_export_e587801c": {
+   "en": "Import Mi Band export…",
+   "ar": "استيراد ملف تصدير Mi Band…"
+  },
+  "l10n_data_sources_screen_import_nutrition_csv_2c748273": {
+   "en": "Import nutrition CSV…",
+   "ar": "استيراد تغذية CSV…"
+  },
+  "l10n_data_sources_screen_import_wearable_export_0545c430": {
+   "en": "Import wearable export…",
+   "ar": "استيراد ملف تصدير جهاز ملبوس…"
+  },
+  "l10n_data_sources_screen_import_whoop_export_zip_16f4176b": {
+   "en": "Import WHOOP export (.zip)",
+   "ar": "استيراد ملف تصدير WHOOP‏ (.zip)"
+  },
+  "l10n_data_sources_screen_import_workout_file_a3a28e06": {
+   "en": "Import workout file…",
+   "ar": "استيراد ملف تمرين…"
+  },
+  "l10n_data_sources_screen_imported_434eb26f": {
+   "en": "Imported",
+   "ar": "مستورد"
+  },
+  "l10n_data_sources_screen_last_share_didn_t_finish_noop_0d6c27f0": {
+   "en": "Last share didn’t finish — NOOP will retry automatically.",
+   "ar": "لم تكتمل آخر مشاركة — سيعيد NOOP المحاولة تلقائيًا."
+  },
+  "l10n_data_sources_screen_last_shared_6bf8389c": {
+   "en": "\"Last shared \"",
+   "ar": "\"آخر مشاركة \""
+  },
+  "l10n_data_sources_screen_last_sync_b793ffab": {
+   "en": "Last sync: ",
+   "ar": "آخر مزامنة: "
+  },
+  "l10n_data_sources_screen_lifting_log_hevy_liftosaur_11df48df": {
+   "en": "Lifting log (Hevy / Liftosaur)",
+   "ar": "سجل تمارين القوة (Hevy / Liftosaur)"
+  },
+  "l10n_data_sources_screen_nutrition_csv_1c1315d9": {
+   "en": "Nutrition (CSV)",
+   "ar": "التغذية (CSV)"
+  },
+  "l10n_data_sources_screen_off_e3de5ab0": {
+   "en": "Off",
+   "ar": "مغلق"
+  },
+  "l10n_data_sources_screen_oura_fitbit_garmin_export_7b21682f": {
+   "en": "Oura / Fitbit / Garmin export",
+   "ar": "تصدير Oura / Fitbit / Garmin"
+  },
+  "l10n_data_sources_screen_re_pull_new_health_connect_data_3e9c3914": {
+   "en": "Re-pull new Health Connect data (e.g. Samsung Health → Health Connect) each ",
+   "ar": "إعادة سحب بيانات Health Connect الجديدة (مثل Samsung Health ← Health Connect) كل "
+  },
+  "l10n_data_sources_screen_remove_apple_health_imported_data_5f878502": {
+   "en": "Remove Apple Health imported data?",
+   "ar": "إزالة البيانات المستوردة من Apple Health؟"
+  },
+  "l10n_data_sources_screen_remove_e963907d": {
+   "en": "Remove",
+   "ar": "إزالة"
+  },
+  "l10n_data_sources_screen_remove_imported_data_813e4695": {
+   "en": "Remove imported data",
+   "ar": "إزالة البيانات المستوردة"
+  },
+  "l10n_data_sources_screen_share_back_to_health_connect_1d578f4a": {
+   "en": "Share back to Health Connect",
+   "ar": "المشاركة العكسية إلى Health Connect"
+  },
+  "l10n_data_sources_screen_share_computed_metrics_back_to_health_c11f5d70": {
+   "en": "Share computed metrics back to Health Connect",
+   "ar": "مشاركة المقاييس المحتسبة عكسيًا إلى Health Connect"
+  },
+  "l10n_data_sources_screen_sharing_paused_health_connect_permission_was_e8950315": {
+   "en": "Sharing paused — Health Connect permission was revoked. Tap to re-grant.",
+   "ar": "تم إيقاف المشاركة مؤقتًا — سُحب إذن Health Connect. اضغط لمنحه مجددًا."
+  },
+  "l10n_data_sources_screen_this_permanently_deletes_everything_imported_from_f42e760e": {
+   "en": "This permanently deletes everything imported from Apple Health: heart rate, HRV, sleep, steps, workouts and more. Your live strap data is untouched. This can\\'t be undone.",
+   "ar": "يحذف هذا نهائيًا كل ما استُورد من Apple Health: معدل النبض وتقلب النبض والنوم والخطوات والتمارين وغيرها. لا تتأثر بيانات سوارك المباشرة. لا يمكن التراجع عن ذلك."
+  },
+  "l10n_data_sources_screen_whoop_history_db101974": {
+   "en": "WHOOP History",
+   "ar": "سجل WHOOP"
+  },
+  "l10n_data_sources_screen_whoop_strap_live_ble_217f7df6": {
+   "en": "WHOOP Strap (Live BLE)",
+   "ar": "سوار WHOOP (BLE مباشر)"
+  },
+  "l10n_data_sources_screen_workout_file_gpx_tcx_fit_5469c068": {
+   "en": "Workout file (GPX / TCX / FIT)",
+   "ar": "ملف تمرين (GPX / TCX / FIT)"
+  },
+  "l10n_data_sources_screen_write_the_metrics_noop_computes_from_439940c2": {
+   "en": "Write the metrics NOOP computes from your strap (resting HR, HRV, SpO₂, ",
+   "ar": "كتابة المقاييس التي يحتسبها NOOP من سوارك (نبض الراحة، وتقلب النبض، وSpO₂، "
+  },
+  "l10n_devices_screen_add_a_device_f90866b8": {
+   "en": "Add a device",
+   "ar": "إضافة جهاز"
+  },
+  "l10n_devices_screen_battery_4a9be042": {
+   "en": "Battery",
+   "ar": "البطارية"
+  },
+  "l10n_devices_screen_battery_clamped_2494c8c9": {
+   "en": "Battery %1$s%%",
+   "ar": "البطارية %1$s%%"
+  },
+  "l10n_devices_screen_battery_info_probe_592_re_1dbd4c0f": {
+   "en": "Battery-info probe (#592 RE)…",
+   "ar": "فحص معلومات البطارية (#592 RE)…"
+  },
+  "l10n_devices_screen_battery_info_probe_result_592_b97c0bb8": {
+   "en": "Battery-info probe result (#592)",
+   "ar": "نتيجة فحص البطارية (#592)"
+  },
+  "l10n_devices_screen_battery_probe_explainer_2858bb6a": {
+   "en": "Two independent protocol tables disagree on the extended-battery opcode (98 vs 87). This sends the curated read-only 98 and dumps the strap\\'s full raw reply to the strap log. A battery-style payload confirms 98 on your firmware; a short stub means it stays ambiguous. Nothing is written to the strap. Please export and share the strap log afterwards.",
+   "ar": "تختلف جدولان مستقلان للبروتوكول حول رمز البطارية الممتد (98 مقابل 87). يرسل هذا الأمر 98 للقراءة فقط ويكتب رد السوار الخام الكامل في سجل السوار. الرد بصيغة بطارية يؤكد 98 على برنامجك الثابت؛ والرد المختصر يعني بقاء الأمر ملتبسًا. لا يُكتب شيء على السوار. يُرجى تصدير سجل السوار ومشاركته بعد ذلك."
+  },
+  "l10n_devices_screen_body_location_probe_690_re_7def8c39": {
+   "en": "Body-location probe (#690 RE)…",
+   "ar": "فحص موضع الجسم (#690 RE)…"
+  },
+  "l10n_devices_screen_body_location_probe_explainer_a9363239": {
+   "en": "Sends the read-only body-location command (0x54) and dumps the strap\\'s full raw reply to the strap log, decoding the record (revision / location / confidence / status) on WHOOP 4.0. Nothing is written to the strap, and it never changes wear detection or scoring.",
+   "ar": "يرسل أمر موضع الجسم للقراءة فقط (0x54) ويكتب رد السوار الخام الكامل في السجل، مع فكّ ترميز السجل (المراجعة / الموضع / الثقة / الحالة) على WHOOP 4.0. لا يُكتب شيء على السوار، ولا يغيّر أبدًا كشف الارتداء أو الدرجات."
+  },
+  "l10n_devices_screen_body_location_probe_result_690_60c5ee79": {
+   "en": "Body-location probe result (#690)",
+   "ar": "نتيجة فحص موضع الجسم (#690)"
+  },
+  "l10n_devices_screen_cancel_77dfd213": {
+   "en": "Cancel",
+   "ar": "إلغاء"
+  },
+  "l10n_devices_screen_close_bbfa773e": {
+   "en": "Close",
+   "ar": "إغلاق"
+  },
+  "l10n_devices_screen_copy_af74f7c5": {
+   "en": "Copy",
+   "ar": "نسخ"
+  },
+  "l10n_devices_screen_delete_all_of_this_device_s_754cde90": {
+   "en": "Delete all of this device\\'s data?",
+   "ar": "حذف كل بيانات هذا الجهاز؟"
+  },
+  "l10n_devices_screen_delete_this_device_s_data_3cae7a2a": {
+   "en": "Delete this device\\'s data…",
+   "ar": "حذف بيانات هذا الجهاز…"
+  },
+  "l10n_devices_screen_device_actions_for_displayname_device_160eb3de": {
+   "en": "Device actions for %1$s",
+   "ar": "إجراءات الجهاز لـ %1$s"
+  },
+  "l10n_devices_screen_device_config_probe_explainer_dd23169f": {
+   "en": "Asks the strap for config VALUES: GET_DEVICE_CONFIG_VALUE (0x79) and GET_FF_VALUE (0x80), one key per round-trip. Both commands may simply not exist in this firmware — finding that out is the point. Read-only — no value is written, and the SET commands are never sent from this probe. The result is shown here and written to the strap log.",
+   "ar": "يطلب من السوار قيم الإعدادات: GET_DEVICE_CONFIG_VALUE (0x79) وGET_FF_VALUE (0x80)، مفتاح واحد لكل دورة. قد لا يكون الأمران موجودين أصلًا في هذا البرنامج الثابت — ومعرفة ذلك هي الهدف. للقراءة فقط — لا تُكتب أي قيمة، ولا تُرسل أوامر الضبط أبدًا من هذا الفحص. تُعرض النتيجة هنا وتُكتب في سجل السوار."
+  },
+  "l10n_devices_screen_device_config_read_probe_103_re_837f46de": {
+   "en": "Device-config read probe (#103 RE)…",
+   "ar": "فحص قراءة إعدادات الجهاز (#103 RE)…"
+  },
+  "l10n_devices_screen_device_config_read_probe_result_103_67d02ec9": {
+   "en": "Device-config read probe result (#103)",
+   "ar": "نتيجة فحص قراءة إعدادات الجهاز (#103)"
+  },
+  "l10n_devices_screen_device_name_79d7a157": {
+   "en": "Device name",
+   "ar": "اسم الجهاز"
+  },
+  "l10n_devices_screen_devices_df485c87": {
+   "en": "Devices",
+   "ar": "الأجهزة"
+  },
+  "l10n_devices_screen_disconnect_ed28e068": {
+   "en": "Disconnect",
+   "ar": "قطع الاتصال"
+  },
+  "l10n_devices_screen_feature_flag_probe_761_re_21241d68": {
+   "en": "Feature-flag probe (#761 RE)…",
+   "ar": "فحص أعلام الميزات (#761 RE)…"
+  },
+  "l10n_devices_screen_feature_flag_probe_explainer_58eec30f": {
+   "en": "Asks the strap to list the feature-flag NAMES its own firmware knows: START_FF_KEY_EXCHANGE (0x75) then SEND_NEXT_FF (0x76) until the strap says it\\'s done. Read-only — no flag value is written, and the SET commands are never sent from this probe. The list is shown here and written to the strap log.",
+   "ar": "يطلب من السوار سرد أسماء أعلام الميزات التي يعرفها برنامجه الثابت: START_FF_KEY_EXCHANGE (0x75) ثم SEND_NEXT_FF (0x76) حتى يعلن السوار الانتهاء. للقراءة فقط — لا تُكتب أي قيمة علم، ولا تُرسل أوامر الضبط أبدًا من هذا الفحص. تُعرض القائمة هنا وتُكتب في سجل السوار."
+  },
+  "l10n_devices_screen_feature_flag_probe_result_761_c50ef4d4": {
+   "en": "Feature-flag probe result (#761)",
+   "ar": "نتيجة فحص أعلام الميزات (#761)"
+  },
+  "l10n_devices_screen_forget_device_926e503d": {
+   "en": "Forget device",
+   "ar": "نسيان الجهاز"
+  },
+  "l10n_devices_screen_forget_device_d6eb6209": {
+   "en": "Forget device…",
+   "ar": "نسيان الجهاز…"
+  },
+  "l10n_devices_screen_forget_this_device_8dbbc3f3": {
+   "en": "Forget this device?",
+   "ar": "نسيان هذا الجهاز؟"
+  },
+  "l10n_devices_screen_getting_your_devices_ready_bd391949": {
+   "en": "Getting your devices ready",
+   "ar": "جارٍ تجهيز أجهزتك"
+  },
+  "l10n_devices_screen_give_device_brand_device_model_a_7a15585c": {
+   "en": "Give %1$s %2$s a name you\\'ll recognise.",
+   "ar": "امنح %1$s %2$s اسمًا تتعرف عليه."
+  },
+  "l10n_devices_screen_leave_none_active_b5c858cb": {
+   "en": "Leave none active",
+   "ar": "عدم تفعيل أي جهاز"
+  },
+  "l10n_devices_screen_make_active_75690bb8": {
+   "en": "Make active",
+   "ar": "تعيينه نشطًا"
+  },
+  "l10n_devices_screen_make_this_your_active_strap_fea6bebd": {
+   "en": "Make this your active strap?",
+   "ar": "تعيين هذا سوارك النشط؟"
+  },
+  "l10n_devices_screen_name_709a2322": {
+   "en": "Name",
+   "ar": "الاسم"
+  },
+  "l10n_devices_screen_noop_removes_this_device_503aff9e": {
+   "en": "NOOP removes this device from your list and deletes its recorded data here. You can re-pair the strap to pull its recent history back.",
+   "ar": "يزيل NOOP هذا الجهاز من قائمتك ويحذف بياناته المسجّلة هنا. يمكنك إعادة اقتران السوار لسحب سجله الأخير مرة أخرى."
+  },
+  "l10n_devices_screen_pack_voltage_9af3c3ff": {
+   "en": "%1$.2f V",
+   "ar": "%1$.2f فولت"
+  },
+  "l10n_devices_screen_paired_locally_noop_owns_this_ring_30c16190": {
+   "en": "Paired locally. NOOP owns this ring while it holds the key. If you reset it again or set it up in the Oura app, NOOP no longer owns it and you would re-add it to take it over.",
+   "ar": "مقترن محليًا. يملك NOOP هذا الخاتم ما دام يحتفظ بالمفتاح. وإذا أعدت ضبطه أو أعددته في تطبيق Oura، فلن يعود NOOP مالكًا له وستحتاج إلى إعادة إضافته للاستحواذ عليه."
+  },
+  "l10n_devices_screen_pick_a_new_active_strap_edd73542": {
+   "en": "Pick a new active strap",
+   "ar": "اختر سوارًا نشطًا جديدًا"
+  },
+  "l10n_devices_screen_reboot_probe_4_0_re_828b3916": {
+   "en": "Reboot probe (4.0 RE)…",
+   "ar": "فحص إعادة التشغيل (4.0 RE)…"
+  },
+  "l10n_devices_screen_reconnect_6988b16a": {
+   "en": "Reconnect",
+   "ar": "إعادة الاتصال"
+  },
+  "l10n_devices_screen_remove_e963907d": {
+   "en": "Remove",
+   "ar": "إزالة"
+  },
+  "l10n_devices_screen_remove_this_device_dd9dbda9": {
+   "en": "Remove this device?",
+   "ar": "إزالة هذا الجهاز؟"
+  },
+  "l10n_devices_screen_rename_d3f4cb89": {
+   "en": "Rename",
+   "ar": "إعادة تسمية"
+  },
+  "l10n_devices_screen_rename_device_ee233604": {
+   "en": "Rename device",
+   "ar": "إعادة تسمية الجهاز"
+  },
+  "l10n_devices_screen_restart_strap_c976cd6c": {
+   "en": "Restart strap…",
+   "ar": "إعادة تشغيل السوار…"
+  },
+  "l10n_devices_screen_restart_this_strap_50fc481b": {
+   "en": "Restart this strap?",
+   "ar": "إعادة تشغيل هذا السوار؟"
+  },
+  "l10n_devices_screen_save_efc007a3": {
+   "en": "Save",
+   "ar": "حفظ"
+  },
+  "l10n_devices_screen_send_probe_read_only_36b318bc": {
+   "en": "Send probe (read-only)",
+   "ar": "إرسال الفحص (للقراءة فقط)"
+  },
+  "l10n_devices_screen_stop_sync_4a1f2b6e": {
+   "en": "Stop sync",
+   "ar": "إيقاف المزامنة"
+  },
+  "l10n_devices_screen_the_whoop_4_0_reboot_frame_690a8ff2": {
+   "en": "The WHOOP 4.0 reboot frame isn\\'t confirmed — a normal Restart is ignored (#235). ",
+   "ar": "إطار إعادة تشغيل WHOOP 4.0 غير مؤكد — وإعادة التشغيل العادية تُتجاهل (#235). "
+  },
+  "l10n_devices_screen_waiting_for_the_straps_reply_5a06e7ac": {
+   "en": "Waiting for the strap\\'s reply…",
+   "ar": "في انتظار رد السوار…"
+  },
+  "l10n_devices_screen_whoop_4_0_reboot_probe_b51fb50f": {
+   "en": "WHOOP 4.0 reboot probe",
+   "ar": "فحص إعادة تشغيل WHOOP 4.0"
+  },
+  "l10n_devices_screen_whoop_is_noop_s_primary_fully_1c9e67fd": {
+   "en": "WHOOP is NOOP\\'s primary, fully-supported band. Other heart-rate straps are an early, ",
+   "ar": "‏WHOOP هو السوار الأساسي المدعوم بالكامل في NOOP. أساور النبض الأخرى في مرحلة مبكرة، "
+  },
+  "l10n_devices_screen_you_removed_your_active_strap_choose_2ac91d48": {
+   "en": "You removed your active strap. Choose which paired band provides your live data, or leave none active and pair one later.",
+   "ar": "لقد أزلت سوارك النشط. اختر السوار المقترن الذي يوفّر بياناتك المباشرة، أو اترك الجميع غير نشط واقترن بواحد لاحقًا."
+  },
+  "l10n_fused_record_screen_done_e9b450d1": {
+   "en": "Done",
+   "ar": "تم"
+  },
+  "l10n_fused_record_screen_fused_on_devicenoun_nothing_leaves_it_8a1e6a3d": {
+   "en": "Fused on %1$s. Nothing leaves it: no account, no cloud.",
+   "ar": "مدمج على %1$s. لا شيء يغادره: بلا حساب وبلا سحابة."
+  },
+  "l10n_fused_record_screen_noop_picks_the_best_sourced_number_5e48b86a": {
+   "en": "NOOP picks the best-sourced number and shows you where each came from. It\\'s for wellness and curiosity. It doesn\\'t diagnose or replace medical advice.",
+   "ar": "يختار NOOP الرقم من أفضل مصدر ويعرض لك مصدر كل رقم. الغرض منه العافية والفضول. لا يشخّص ولا يحل محل الاستشارة الطبية."
+  },
+  "l10n_fused_record_screen_noop_shows_the_winner_source_displayname_4a3892cc": {
+   "en": "NOOP shows the %1$s reading because it %2$s for this metric: a higher-trust source here, not a verdict that the others are wrong.",
+   "ar": "يعرض NOOP قراءة %1$s لأنها %2$s لهذا المقياس: مصدر أعلى ثقة هنا، لا حكمًا بأن البقية خاطئة."
+  },
+  "l10n_fused_record_screen_nothing_to_fuse_yet_30789c4e": {
+   "en": "Nothing to fuse yet",
+   "ar": "لا شيء لدمجه بعد"
+  },
+  "l10n_fused_record_screen_other_source_displayname_agrees_fusionformat_value_78e29c2a": {
+   "en": "%1$s agrees: %2$s",
+   "ar": "%1$s يتفق: %2$s"
+  },
+  "l10n_fused_record_screen_your_bands_report_different_numbers_here_03d20d81": {
+   "en": "Your bands report different numbers. Here\\'s every source, and the one NOOP is using.",
+   "ar": "أساورك تسجّل أرقامًا مختلفة. إليك كل المصادر، والمصدر الذي يستخدمه NOOP."
+  },
+  "l10n_fused_record_screen_your_data_fused_a740fd4a": {
+   "en": "Your Data, Fused",
+   "ar": "بياناتك، مدمجة"
+  },
+  "l10n_health_screen_5_yr_a_fitness_comparison_not_418aa11d": {
+   "en": "± 5 yr · a fitness comparison, not a biological age",
+   "ar": "± 5 سنوات · مقارنة لياقة، لا عمر بيولوجي"
+  },
+  "l10n_health_screen_a_wellness_estimate_from_your_habits_d00f36de": {
+   "en": "A wellness estimate from your habits, not a clinical biological age.",
+   "ar": "تقدير للعافية من عاداتك، لا عمر بيولوجي سريري."
+  },
+  "l10n_health_screen_active_energy_2d3288f9": {
+   "en": "Active Energy",
+   "ar": "الطاقة النشطة"
+  },
+  "l10n_health_screen_add_your_waist_for_a_more_accurate_vo_max_829f5e1e": {
+   "en": "Add your waist for a more accurate VO₂max",
+   "ar": "أضف محيط خصرك لتقدير VO₂max أدق"
+  },
+  "l10n_health_screen_as_of_latest_first_726f20bb": {
+   "en": "as of %1$s",
+   "ar": "حتى %1$s"
+  },
+  "l10n_health_screen_as_of_one_first_2b409612": {
+   "en": "as of %1$s",
+   "ar": "حتى %1$s"
+  },
+  "l10n_health_screen_baselines_learned_on_device_over_14_c107f375": {
+   "en": "Baselines learned on-device over 14 days. Bars read each signal against a ",
+   "ar": "خطوط الأساس مُتعلَّمة على الجهاز خلال 14 يومًا. تقرأ الأشرطة كل إشارة مقابل "
+  },
+  "l10n_health_screen_blood_o_9bf5ed9b": {
+   "en": "Blood O₂",
+   "ar": "أكسجين الدم"
+  },
+  "l10n_health_screen_blood_oxygen_a8ad9ff5": {
+   "en": "Blood Oxygen",
+   "ar": "أكسجين الدم"
+  },
+  "l10n_health_screen_cycle_phase_body_clock_and_illness_59e2d9a4": {
+   "en": "Cycle phase, body-clock and illness heads-up are approximations computed on your device from ",
+   "ar": "طور الدورة والساعة البيولوجية والإنذار بالمرض تقديرات محتسبة على جهازك من "
+  },
+  "l10n_health_screen_date_eb9a4bc1": {
+   "en": "Date",
+   "ar": "التاريخ"
+  },
+  "l10n_health_screen_drives_your_fitness_age_9d0d1219": {
+   "en": "Drives your Fitness Age",
+   "ar": "يحدّد عمرك اللياقي"
+  },
+  "l10n_health_screen_effort_8c974bc6": {
+   "en": "Effort",
+   "ar": "الجهد"
+  },
+  "l10n_health_screen_fitness_age_12383b4a": {
+   "en": "Fitness Age",
+   "ar": "العمر اللياقي"
+  },
+  "l10n_health_screen_fix_in_settings_d7472915": {
+   "en": "Fix in Settings",
+   "ar": "إصلاح في الإعدادات"
+  },
+  "l10n_health_screen_health_monitor_c4abc3fc": {
+   "en": "Health Monitor",
+   "ar": "مراقب الصحة"
+  },
+  "l10n_health_screen_heart_rate_dde6e8f7": {
+   "en": "Heart Rate",
+   "ar": "معدل النبض"
+  },
+  "l10n_health_screen_heart_rate_variability_20f0069e": {
+   "en": "Heart Rate Variability",
+   "ar": "تقلب معدل النبض"
+  },
+  "l10n_health_screen_helping_most_best_label_edee8773": {
+   "en": "Helping most: %1$s",
+   "ar": "الأكثر مساعدة: %1$s"
+  },
+  "l10n_health_screen_history_synced_8339779d": {
+   "en": "History synced",
+   "ar": "تمت مزامنة السجل"
+  },
+  "l10n_health_screen_holding_you_back_worst_label_863a1809": {
+   "en": "Holding you back: %1$s",
+   "ar": "ما يعيقك: %1$s"
+  },
+  "l10n_health_screen_how_accurate_is_this_dae653a8": {
+   "en": "How accurate is this?",
+   "ar": "ما مدى دقة هذا؟"
+  },
+  "l10n_health_screen_how_accurate_is_this_fitness_age_935c9a6d": {
+   "en": "How accurate is this Fitness Age?",
+   "ar": "ما مدى دقة العمر اللياقي هذا؟"
+  },
+  "l10n_health_screen_it_compares_your_resting_heart_rate_e83e00f5": {
+   "en": "It compares your resting heart rate and recent activity against people your age. ",
+   "ar": "يقارن نبضك في الراحة ونشاطك الأخير بأشخاص في عمرك. "
+  },
+  "l10n_health_screen_lab_book_f966c140": {
+   "en": "Lab Book",
+   "ar": "دفتر المختبر"
+  },
+  "l10n_health_screen_loading_33ce4174": {
+   "en": "Loading…",
+   "ar": "جارٍ التحميل…"
+  },
+  "l10n_health_screen_longer_ranges_unlock_as_more_history_d7da5fee": {
+   "en": "Longer ranges unlock as more history builds.",
+   "ar": "تُفتح النطاقات الأطول كلما تراكم السجل."
+  },
+  "l10n_health_screen_no_biometrics_yet_7c594a6c": {
+   "en": "No biometrics yet",
+   "ar": "لا قياسات حيوية بعد"
+  },
+  "l10n_health_screen_no_blood_oxygen_percentage_from_a_1d3d383e": {
+   "en": "No blood oxygen percentage from a WHOOP 4.0",
+   "ar": "لا نسبة أكسجين دم من WHOOP 4.0"
+  },
+  "l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae": {
+   "en": "No measured temperature for these nights — showing the difference from your baseline. A sync re-scores recent nights and fills it in.",
+   "ar": "لا حرارة مقيسة لهذه الليالي — يُعرض الفارق عن خط أساسك. المزامنة تعيد احتساب الليالي الأخيرة وتملأه."
+  },
+  "l10n_health_screen_no_spo_import_or_health_value_408f8c55": {
+   "en": "No SpO₂ import or Health value",
+   "ar": "لا استيراد SpO₂ ولا قيمة من Health"
+  },
+  "l10n_health_screen_no_strap_connected_fb37b99e": {
+   "en": "No strap connected",
+   "ar": "لا سوار متصل"
+  },
+  "l10n_health_screen_not_enough_history_in_this_range_2da72f80": {
+   "en": "Not enough history in this range",
+   "ar": "لا يوجد سجل كافٍ في هذا النطاق"
+  },
+  "l10n_health_screen_not_enough_history_yet_0e2f93b6": {
+   "en": "Not enough history yet",
+   "ar": "لا يوجد سجل كافٍ بعد"
+  },
+  "l10n_health_screen_one_reading_so_far_your_trend_eaad57f2": {
+   "en": "One reading so far — your trend chart fills in here once a second ",
+   "ar": "قراءة واحدة حتى الآن — يمتلئ رسم اتجاهك هنا بمجرد وجود قراءة ثانية "
+  },
+  "l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b": {
+   "en": "Only nights with a measured temperature are shown; the others recorded a baseline difference only.",
+   "ar": "تُعرض فقط الليالي ذات الحرارة المقيسة؛ أما البقية فسجّلت فارقًا عن خط الأساس فحسب."
+  },
+  "l10n_health_screen_out_of_100_da0953a8": {
+   "en": "out of 100",
+   "ar": "من 100"
+  },
+  "l10n_health_screen_raw_counts_only_needs_an_import_d0e33552": {
+   "en": "Raw counts only — needs an import",
+   "ar": "أعداد خام فقط — يحتاج إلى استيراد"
+  },
+  "l10n_health_screen_raw_spo_ccfe80c1": {
+   "en": "Raw SpO₂",
+   "ar": "‏SpO₂ الخام"
+  },
+  "l10n_health_screen_recovery_ea924f72": {
+   "en": "Recovery",
+   "ar": "التعافي"
+  },
+  "l10n_health_screen_refresh_fitness_age_now_85fc516f": {
+   "en": "Refresh Fitness Age now",
+   "ar": "تحديث العمر اللياقي الآن"
+  },
+  "l10n_health_screen_resp_rate_1c48dbd8": {
+   "en": "Resp Rate",
+   "ar": "معدل التنفس"
+  },
+  "l10n_health_screen_respiratory_1cd8c175": {
+   "en": "Respiratory",
+   "ar": "التنفسي"
+  },
+  "l10n_health_screen_respiratory_rate_3fbb532f": {
+   "en": "Respiratory Rate",
+   "ar": "معدل التنفس"
+  },
+  "l10n_health_screen_rest_b79e5f48": {
+   "en": "Rest",
+   "ar": "الراحة"
+  },
+  "l10n_health_screen_resting_heart_rate_9700f4d8": {
+   "en": "Resting Heart Rate",
+   "ar": "معدل النبض في الراحة"
+  },
+  "l10n_health_screen_resting_hr_26677094": {
+   "en": "Resting HR",
+   "ar": "نبض الراحة"
+  },
+  "l10n_health_screen_sharpens_your_vo_max_c9d52991": {
+   "en": "Sharpens your VO₂max",
+   "ar": "يحسّن دقة VO₂max لديك"
+  },
+  "l10n_health_screen_skin_temp_a4affc5a": {
+   "en": "Skin Temp",
+   "ar": "حرارة الجلد"
+  },
+  "l10n_health_screen_skin_temperature_f59127f6": {
+   "en": "Skin Temperature",
+   "ar": "حرارة الجلد"
+  },
+  "l10n_health_screen_sleep_3cac34e6": {
+   "en": "Sleep",
+   "ar": "النوم"
+  },
+  "l10n_health_screen_source_6da13add": {
+   "en": "Source",
+   "ar": "المصدر"
+  },
+  "l10n_health_screen_spo_respiratory_rate_and_skin_temperature_0ae0ad8f": {
+   "en": "SpO₂, respiratory rate and skin temperature are sleep-window ",
+   "ar": "‏SpO₂ ومعدل التنفس وحرارة الجلد قياسات نافذة النوم "
+  },
+  "l10n_health_screen_steps_cdde4f20": {
+   "en": "Steps",
+   "ar": "الخطوات"
+  },
+  "l10n_health_screen_the_blood_oxygen_estimate_is_turned_4c403ab2": {
+   "en": "The blood oxygen estimate is turned off",
+   "ar": "تقدير أكسجين الدم مُعطَّل"
+  },
+  "l10n_health_screen_this_vital_needs_at_least_two_0e41b8b0": {
+   "en": "This vital needs at least two historical readings before NOOP can chart it.",
+   "ar": "يحتاج هذا المؤشر إلى قراءتين تاريخيتين على الأقل قبل أن يتمكن NOOP من رسمه."
+  },
+  "l10n_health_screen_value_8dce170d": {
+   "en": "Value",
+   "ar": "القيمة"
+  },
+  "l10n_health_screen_vital_signs_e7d9e1b1": {
+   "en": "Vital Signs",
+   "ar": "العلامات الحيوية"
+  },
+  "l10n_health_screen_vitality_be320b06": {
+   "en": "Vitality",
+   "ar": "الحيوية"
+  },
+  "l10n_health_screen_weight_height_and_waist_add_a_fd2699f5": {
+   "en": "Weight, height and waist add a VO₂max estimate. They don\\'t change the Fitness Age itself.",
+   "ar": "الوزن والطول ومحيط الخصر تضيف تقديرًا لـ VO₂max. وهي لا تغيّر العمر اللياقي نفسه."
+  },
+  "l10n_health_screen_your_data_fused_a740fd4a": {
+   "en": "Your Data, Fused",
+   "ar": "بياناتك، مدمجة"
+  },
+  "l10n_health_screen_your_strap_banks_the_raw_optical_b52a0f80": {
+   "en": "Your strap banks the raw optical channels, but NOOP does not turn them into a blood oxygen percentage, so this stays empty however long you wear it. Import a WHOOP export in Data Sources to fill it from your account history.",
+   "ar": "يخزّن سوارك القنوات الضوئية الخام، لكن NOOP لا يحوّلها إلى نسبة أكسجين في الدم، لذا يبقى هذا فارغًا مهما طال ارتداؤك له. استورد ملف تصدير WHOOP في «مصادر البيانات» لملئه من سجل حسابك."
+  },
+  "l10n_health_screen_your_strap_reports_a_blood_oxygen_349fe34a": {
+   "en": "Your strap reports a blood oxygen estimate, but it is unverified and off by default. Turn on the strap estimate in Settings to see it, or import a WHOOP export in Data Sources for the calibrated value.",
+   "ar": "يسجّل سوارك تقديرًا لأكسجين الدم، لكنه غير متحقق منه ومعطّل افتراضيًا. فعّل تقدير السوار في الإعدادات لرؤيته، أو استورد ملف تصدير WHOOP في «مصادر البيانات» للقيمة المعايرة."
+  },
+  "l10n_how_noop_works_screen_close_bbfa773e": {
+   "en": "Close",
+   "ar": "إغلاق"
+  },
+  "l10n_how_noop_works_screen_got_it_5b8027fa": {
+   "en": "Got it",
+   "ar": "فهمت"
+  },
+  "l10n_how_noop_works_screen_how_noop_works_3396b27a": {
+   "en": "How NOOP works",
+   "ar": "كيف يعمل NOOP"
+  },
+  "l10n_how_noop_works_screen_how_your_scores_are_computed_1b2d6c30": {
+   "en": "How your scores are computed",
+   "ar": "كيف تُحتسب درجاتك"
+  },
+  "l10n_how_noop_works_screen_how_your_scores_work_21a0e2be": {
+   "en": "How your scores work",
+   "ar": "كيف تعمل درجاتك"
+  },
+  "l10n_how_noop_works_screen_how_your_sleep_is_sorted_6a8e82e0": {
+   "en": "How your sleep is sorted",
+   "ar": "كيف يُصنَّف نومك"
+  },
+  "l10n_how_noop_works_screen_noop_never_makes_up_a_number_da29aca5": {
+   "en": "NOOP never makes up a number. When it can\\'t compute one honestly it tells you what\\'s missing and what to do, rather than showing a fake value.",
+   "ar": "لا يختلق NOOP رقمًا أبدًا. وحين يتعذّر احتسابه بصدق، يخبرك بما ينقص وما ينبغي فعله، بدلًا من عرض قيمة زائفة."
+  },
+  "l10n_how_noop_works_screen_noop_never_shows_you_a_number_d1db9958": {
+   "en": "NOOP never shows you a number it had to make up. If a score isn\\'t ready, ",
+   "ar": "لا يعرض NOOP أبدًا رقمًا اضطر لاختلاقه. وإذا لم تكن الدرجة جاهزة، "
+  },
+  "l10n_how_noop_works_screen_sleep_scores_recording_where_your_numbers_1b3e981f": {
+   "en": "Sleep · scores · recording · where your numbers come from",
+   "ar": "النوم · الدرجات · التسجيل · من أين تأتي أرقامك"
+  },
+  "l10n_how_noop_works_screen_what_recording_means_b896c422": {
+   "en": "What \"recording\" means",
+   "ar": "ماذا يعني «التسجيل»"
+  },
+  "l10n_how_noop_works_screen_where_your_numbers_come_from_e169963a": {
+   "en": "Where your numbers come from",
+   "ar": "من أين تأتي أرقامك"
+  },
+  "l10n_hrv_snapshot_screen_a_60_second_snapshot_of_your_35f03f7c": {
+   "en": "A 60-second snapshot of your beat-to-beat (R-R) intervals from the strap, cleaned ",
+   "ar": "لقطة مدتها 60 ثانية لفترات ما بين النبضات (R-R) من السوار، بعد تنظيفها "
+  },
+  "l10n_hrv_snapshot_screen_an_hrv_reading_needs_the_live_11b70bff": {
+   "en": "An HRV reading needs the live R-R stream. Open the Live screen and connect your strap, then come back.",
+   "ar": "تحتاج قراءة تقلب النبض إلى بث R-R المباشر. افتح شاشة «مباشر» ووصّل سوارك، ثم عد."
+  },
+  "l10n_hrv_snapshot_screen_beats_12aafda0": {
+   "en": "Beats",
+   "ar": "النبضات"
+  },
+  "l10n_hrv_snapshot_screen_close_hrv_reading_a29a99a1": {
+   "en": "Close HRV reading",
+   "ar": "إغلاق قراءة تقلب النبض"
+  },
+  "l10n_hrv_snapshot_screen_hrv_reading_a2cf71f3": {
+   "en": "HRV Reading",
+   "ar": "قراءة تقلب النبض"
+  },
+  "l10n_hrv_snapshot_screen_mean_hr_6c9272dd": {
+   "en": "Mean HR",
+   "ar": "متوسط النبض"
+  },
+  "l10n_hrv_snapshot_screen_not_enough_clean_beats_sit_still_0893e6c2": {
+   "en": "Not enough clean beats - sit still and try again. %1$s of ",
+   "ar": "لا توجد نبضات نظيفة كافية — اجلس دون حركة وحاول مجددًا. %1$s من "
+  },
+  "l10n_hydration_screen_a_simple_goal_that_adjusts_to_723dc08a": {
+   "en": "A simple goal that adjusts to your effort. General wellness guidance, not medical advice.",
+   "ar": "هدف بسيط يتكيّف مع مجهودك. إرشاد عام للعافية، لا نصيحة طبية."
+  },
+  "l10n_hydration_screen_bottle_3b8ac6c7": {
+   "en": "Bottle",
+   "ar": "زجاجة"
+  },
+  "l10n_hydration_screen_cancel_77dfd213": {
+   "en": "Cancel",
+   "ar": "إلغاء"
+  },
+  "l10n_hydration_screen_clear_today_1be870ea": {
+   "en": "Clear today",
+   "ar": "مسح اليوم"
+  },
+  "l10n_hydration_screen_cup_04b95071": {
+   "en": "Cup",
+   "ar": "كوب"
+  },
+  "l10n_hydration_screen_custom_amount_f7219236": {
+   "en": "Custom amount",
+   "ar": "كمية مخصصة"
+  },
+  "l10n_hydration_screen_enter_any_amount_from_1_to_a85a639e": {
+   "en": "Enter any amount from 1 to %1$s ml.",
+   "ar": "أدخل أي كمية من 1 إلى %1$s مل."
+  },
+  "l10n_hydration_screen_from_health_connect_4ad037a3": {
+   "en": "From Health Connect",
+   "ar": "من Health Connect"
+  },
+  "l10n_hydration_screen_hydration_bdfb040f": {
+   "en": "Hydration",
+   "ar": "الترطيب"
+  },
+  "l10n_hydration_screen_kotlin_math_min_100_fraction_100_416d2889": {
+   "en": "%1$s percent of today\\'s goal",
+   "ar": "%1$s بالمئة من هدف اليوم"
+  },
+  "l10n_hydration_screen_kotlin_math_min_100_fraction_100_72f2dfde": {
+   "en": "%1$s%% of today\\'s goal",
+   "ar": "%1$s%% من هدف اليوم"
+  },
+  "l10n_hydration_screen_log_8bf95ea3": {
+   "en": "Log",
+   "ar": "تسجيل"
+  },
+  "l10n_hydration_screen_logged_today_0071a46c": {
+   "en": "Logged today",
+   "ar": "سُجِّل اليوم"
+  },
+  "l10n_hydration_screen_millilitres_ml_0fb0d2a4": {
+   "en": "Millilitres (ml)",
+   "ar": "مليلتر (مل)"
+  },
+  "l10n_hydration_screen_no_drinks_logged_yet_tap_sip_cc0d2f72": {
+   "en": "No drinks logged yet. Tap Sip, Cup or Bottle to start.",
+   "ar": "لم تُسجَّل مشروبات بعد. اضغط «رشفة» أو «كوب» أو «زجاجة» للبدء."
+  },
+  "l10n_hydration_screen_no_history_yet_933f417e": {
+   "en": "No history yet.",
+   "ar": "لا سجل بعد."
+  },
+  "l10n_hydration_screen_sip_78cca3e8": {
+   "en": "Sip",
+   "ar": "رشفة"
+  },
+  "l10n_hydration_screen_sip_hydrationgoal_sip_ml_ml_cup_287647f5": {
+   "en": "Sip %1$s ml · Cup %2$s ml · Bottle %3$s ml",
+   "ar": "رشفة %1$s مل · كوب %2$s مل · زجاجة %3$s مل"
+  },
+  "l10n_hydration_screen_totalml_toint_ml_522b262a": {
+   "en": "%1$s ml",
+   "ar": "%1$s مل"
+  },
+  "l10n_hydration_screen_undo_last_last_ml_330befc5": {
+   "en": "Undo last (%1$s ml)",
+   "ar": "تراجع عن الأخير (%1$s مل)"
+  },
+  "l10n_insights_hub_screen_dose_here_is_timing_later_in_1b1e9326": {
+   "en": "“Dose” here is timing (later in the day = stronger), not milligrams.",
+   "ar": "«الجرعة» هنا تعني التوقيت (كلما تأخر اليوم كان الأثر أقوى)، لا المليغرامات."
+  },
+  "l10n_insights_hub_screen_everything_here_is_a_pattern_in_ed2162a6": {
+   "en": "Everything here is a pattern in your own logged days: an association with an ",
+   "ar": "كل ما هنا نمط في أيامك المسجّلة أنت: ارتباط مع "
+  },
+  "l10n_insights_hub_screen_insights_b4510362": {
+   "en": "Insights",
+   "ar": "الرؤى"
+  },
+  "l10n_insights_hub_screen_log_alcohol_or_late_caffeine_with_dec9dadf": {
+   "en": "Log alcohol or late caffeine with an amount and NOOP fits a personal dose curve: ",
+   "ar": "سجّل الكحول أو الكافيين المتأخر مع الكمية، ويضبط NOOP منحنى جرعة شخصيًا: "
+  },
+  "l10n_insights_hub_screen_not_enough_overlap_between_your_journal_0ebdd7a2": {
+   "en": "Not enough overlap between your journal answers and ",
+   "ar": "لا يوجد تداخل كافٍ بين إجاباتك في اليوميات و"
+  },
+  "l10n_insights_hub_screen_per_extra_card_unitnoun_a92a5e91": {
+   "en": "Per extra %1$s",
+   "ar": "لكل %1$s إضافي"
+  },
+  "l10n_insights_hub_screen_reading_your_journal_and_outcomes_4a59af69": {
+   "en": "Reading your journal and outcomes…",
+   "ar": "جارٍ قراءة يومياتك ونتائجك…"
+  },
+  "l10n_insights_hub_screen_tomorrow_s_card_outcomename_ad70b7f9": {
+   "en": "Tomorrow’s %1$s",
+   "ar": "%1$s غدًا"
+  },
+  "l10n_insights_hub_screen_with_564f8c6e": {
+   "en": "With",
+   "ar": "مع"
+  },
+  "l10n_insights_hub_screen_without_cb735356": {
+   "en": "Without",
+   "ar": "بدون"
+  },
+  "l10n_insights_screen_baseline_e6ab7982": {
+   "en": "Baseline",
+   "ar": "خط الأساس"
+  },
+  "l10n_insights_screen_bounce_back_be2d66a4": {
+   "en": "Bounce back",
+   "ar": "سرعة التعافي"
+  },
+  "l10n_insights_screen_change_64fbd995": {
+   "en": "Change",
+   "ar": "التغيّر"
+  },
+  "l10n_insights_screen_charge_d4e1aee4": {
+   "en": "Charge",
+   "ar": "الشحن"
+  },
+  "l10n_insights_screen_compliance_68f0ae49": {
+   "en": "Compliance",
+   "ar": "الالتزام"
+  },
+  "l10n_insights_screen_end_a2bb9d34": {
+   "en": "End",
+   "ar": "إنهاء"
+  },
+  "l10n_insights_screen_end_experiment_0ed6d57f": {
+   "en": "End experiment",
+   "ar": "إنهاء التجربة"
+  },
+  "l10n_insights_screen_experiment_behaviour_selection_bcb29b58": {
+   "en": "Experiment behaviour: %1$s",
+   "ar": "سلوك التجربة: %1$s"
+  },
+  "l10n_insights_screen_experiment_progress_snapshot_dayselapsed_of_snapshot_ff62b228": {
+   "en": "Experiment progress %1$s of %2$s days",
+   "ar": "تقدّم التجربة %1$s من %2$s يوم"
+  },
+  "l10n_insights_screen_insights_b4510362": {
+   "en": "Insights",
+   "ar": "الرؤى"
+  },
+  "l10n_insights_screen_insights_read_your_journal_and_outcomes_6ec8aaf9": {
+   "en": "Insights read your journal and outcomes",
+   "ar": "الرؤى تقرأ يومياتك ونتائجك"
+  },
+  "l10n_insights_screen_intervention_e9b90c40": {
+   "en": "Intervention",
+   "ar": "التدخّل"
+  },
+  "l10n_insights_screen_log_at_least_one_behaviour_above_cf7c65a6": {
+   "en": "Log at least one behaviour above before starting an experiment.",
+   "ar": "سجّل سلوكًا واحدًا على الأقل أعلاه قبل بدء تجربة."
+  },
+  "l10n_insights_screen_mark_done_0911cce7": {
+   "en": "Mark done",
+   "ar": "وضع علامة تم"
+  },
+  "l10n_insights_screen_mark_done_today_471eb94a": {
+   "en": "Mark done today",
+   "ar": "وضع علامة تم اليوم"
+  },
+  "l10n_insights_screen_next_morning_61d1ea83": {
+   "en": "Next morning",
+   "ar": "صباح اليوم التالي"
+  },
+  "l10n_insights_screen_not_enough_overlap_between_your_journal_0ebdd7a2": {
+   "en": "Not enough overlap between your journal answers and ",
+   "ar": "لا يوجد تداخل كافٍ بين إجاباتك في اليوميات و"
+  },
+  "l10n_insights_screen_not_enough_overlapping_history_to_correlate_a552dbd4": {
+   "en": "Not enough overlapping history to correlate your metrics yet.",
+   "ar": "لا يوجد سجل متداخل كافٍ لربط مقاييسك بعد."
+  },
+  "l10n_insights_screen_pick_one_behaviour_you_log_one_bd34090e": {
+   "en": "Pick one behaviour you log, one outcome, and a short window. NOOP ",
+   "ar": "اختر سلوكًا واحدًا تسجّله، ونتيجة واحدة، ونافذة قصيرة. وNOOP "
+  },
+  "l10n_insights_screen_pre_filled_from_last_night_tap_ce81097c": {
+   "en": "Pre-filled from last night. Tap to confirm or change.",
+   "ar": "مملوء من الليلة الماضية. اضغط للتأكيد أو التغيير."
+  },
+  "l10n_insights_screen_ranked_lag_aware_which_of_your_e0e91b39": {
+   "en": "Ranked, lag-aware: which of your habits actually move your Charge, plus your personal alcohol/caffeine dose-response.",
+   "ar": "مرتَّب ومراعٍ للتأخير: أي عاداتك تحرّك شحنك فعلًا، مع استجابة الجرعة الشخصية للكحول/الكافيين."
+  },
+  "l10n_insights_screen_reading_your_journal_and_outcomes_4a59af69": {
+   "en": "Reading your journal and outcomes…",
+   "ar": "جارٍ قراءة يومياتك ونتائجك…"
+  },
+  "l10n_insights_screen_rest_b79e5f48": {
+   "en": "Rest",
+   "ar": "الراحة"
+  },
+  "l10n_insights_screen_rest_baseline_b3ac52a5": {
+   "en": "Rest baseline",
+   "ar": "خط أساس الراحة"
+  },
+  "l10n_insights_screen_rhr_04edf9b3": {
+   "en": "RHR",
+   "ar": "نبض الراحة"
+  },
+  "l10n_insights_screen_run_a_clean_personal_test_4da69781": {
+   "en": "Run a clean personal test",
+   "ar": "أجرِ اختبارًا شخصيًا نظيفًا"
+  },
+  "l10n_insights_screen_sessions_e11e37a9": {
+   "en": "Sessions",
+   "ar": "الجلسات"
+  },
+  "l10n_insights_screen_skip_3da47453": {
+   "en": "Skip",
+   "ar": "تخطٍ"
+  },
+  "l10n_insights_screen_skip_today_ed6a16a5": {
+   "en": "Skip today",
+   "ar": "تخطي اليوم"
+  },
+  "l10n_insights_screen_snapshot_dayselapsed_of_snapshot_durationdays_days_9a611f12": {
+   "en": "%1$s of %2$s days",
+   "ar": "%1$s من %2$s يوم"
+  },
+  "l10n_insights_screen_start_experiment_45a4b379": {
+   "en": "Start experiment",
+   "ar": "بدء التجربة"
+  },
+  "l10n_insights_screen_started_snapshot_startday_testing_snapshot_outcome_1839ef40": {
+   "en": "Started %1$s · testing %2$s",
+   "ar": "بدأت %1$s · نختبر %2$s"
+  },
+  "l10n_insights_screen_tag_a_few_sessions_of_the_97927401": {
+   "en": "Tag a few sessions of the same activity and NOOP will learn its personal recovery cost.",
+   "ar": "وسم بضع جلسات للنشاط نفسه وسيتعلّم NOOP تكلفتها الشخصية على التعافي."
+  },
+  "l10n_insights_screen_what_moves_you_ranked_patterns_in_7d89e628": {
+   "en": "What moves you. Ranked patterns in your own data, and your dose-response.",
+   "ar": "ما الذي يحرّكك. أنماط مرتَّبة في بياناتك أنت، واستجابتك للجرعة."
+  },
+  "l10n_insights_screen_with_564f8c6e": {
+   "en": "With",
+   "ar": "مع"
+  },
+  "l10n_insights_screen_without_cb735356": {
+   "en": "Without",
+   "ar": "بدون"
+  },
+  "l10n_intelligence_screen_0_unitformatter_effortscalemax_effortscale_scale_b5c43f56": {
+   "en": "0 - %1$s scale",
+   "ar": "مقياس 0 – %1$s"
+  },
+  "l10n_intelligence_screen_by_day_2e5d14ca": {
+   "en": "By Day",
+   "ar": "حسب اليوم"
+  },
+  "l10n_intelligence_screen_charge_weighs_your_heart_rate_variability_026745e6": {
+   "en": "Charge weighs your heart-rate variability against your personal baseline ",
+   "ar": "يوازن الشحن تقلب نبضك مقابل خط أساسك الشخصي "
+  },
+  "l10n_intelligence_screen_effort_8c974bc6": {
+   "en": "Effort",
+   "ar": "الجهد"
+  },
+  "l10n_intelligence_screen_estimate_from_today_s_effort_your_667d7560": {
+   "en": "Estimate from today\\'s effort, your typical sleep and your %1$s-night ",
+   "ar": "تقدير من جهد اليوم، ونومك المعتاد، و%1$s ليلة "
+  },
+  "l10n_intelligence_screen_how_this_works_b895a8c3": {
+   "en": "How this works",
+   "ar": "كيف يعمل هذا"
+  },
+  "l10n_intelligence_screen_intelligence_c698f940": {
+   "en": "Intelligence",
+   "ar": "الذكاء"
+  },
+  "l10n_intelligence_screen_no_scored_days_in_this_window_03f1165b": {
+   "en": "No scored days in this window. Widen the range or import more history.",
+   "ar": "لا أيام محتسبة في هذه النافذة. وسّع النطاق أو استورد سجلًا أكثر."
+  },
+  "l10n_intelligence_screen_no_scored_days_yet_sync_your_cdd47684": {
+   "en": "No scored days yet. Sync your strap to collect raw streams. Effort and Rest are ",
+   "ar": "لا أيام محتسبة بعد. زامن سوارك لجمع البيانات الخام. الجهد والراحة "
+  },
+  "l10n_intelligence_screen_you_ll_likely_wake_around_charge_ed3abe2e": {
+   "en": "You\\'ll likely wake around %1$s ± %2$s Charge if you sleep about ",
+   "ar": "من المرجّح أن تستيقظ بشحن نحو %1$s ± %2$s إذا نمت قرابة "
+  },
+  "l10n_intervals_screen_bond_your_strap_on_the_live_d799cbc2": {
+   "en": "Bond your strap on the Live screen to feel the transitions hands-free.",
+   "ar": "اقترن بسوارك من شاشة «مباشر» لتشعر بالانتقالات دون استخدام يديك."
+  },
+  "l10n_intervals_screen_interval_timer_1d703deb": {
+   "en": "Interval Timer",
+   "ar": "مؤقّت الفترات"
+  },
+  "l10n_intervals_screen_pause_to_change_work_rest_or_f54f9cc5": {
+   "en": "Pause to change work, rest, or rounds.",
+   "ar": "أوقف مؤقتًا لتغيير العمل أو الراحة أو الجولات."
+  },
+  "l10n_intervals_screen_reset_44c57abd": {
+   "en": "Reset",
+   "ar": "إعادة تعيين"
+  },
+  "l10n_intervals_screen_rest_b79e5f48": {
+   "en": "Rest",
+   "ar": "راحة"
+  },
+  "l10n_intervals_screen_rounds_ceeac4ac": {
+   "en": "Rounds",
+   "ar": "الجولات"
+  },
+  "l10n_intervals_screen_work_00040bab": {
+   "en": "Work",
+   "ar": "عمل"
+  },
+  "l10n_journal_log_add_a_custom_item_0dbd8f7c": {
+   "en": "Add a custom item…",
+   "ar": "إضافة عنصر مخصص…"
+  },
+  "l10n_journal_log_cancel_77dfd213": {
+   "en": "Cancel",
+   "ar": "إلغاء"
+  },
+  "l10n_journal_log_display_name_c7874aaa": {
+   "en": "Display name",
+   "ar": "الاسم المعروض"
+  },
+  "l10n_journal_log_group_995a11e5": {
+   "en": "Group…",
+   "ar": "مجموعة…"
+  },
+  "l10n_journal_log_group_group_title_1f88621e": {
+   "en": "Group: %1$s",
+   "ar": "المجموعة: %1$s"
+  },
+  "l10n_journal_log_history_stays_under_the_original_question_dc91ce89": {
+   "en": "History stays under the original question so WHOOP imports still line up.",
+   "ar": "يبقى السجل تحت السؤال الأصلي حتى تظل عمليات استيراد WHOOP متوافقة."
+  },
+  "l10n_journal_log_journal_57d7f743": {
+   "en": "Journal",
+   "ar": "اليوميات"
+  },
+  "l10n_journal_log_rename_94ac9a58": {
+   "en": "Rename…",
+   "ar": "إعادة تسمية…"
+  },
+  "l10n_journal_log_rename_item_3d21d6ca": {
+   "en": "Rename item",
+   "ar": "إعادة تسمية العنصر"
+  },
+  "l10n_journal_log_save_efc007a3": {
+   "en": "Save",
+   "ar": "حفظ"
+  },
+  "l10n_journal_reminder_journal_57d7f743": {
+   "en": "Journal",
+   "ar": "اليوميات"
+  },
+  "l10n_journal_reminder_journal_reminder_0fdc0d9c": {
+   "en": "Journal reminder",
+   "ar": "تذكير اليوميات"
+  },
+  "l10n_journal_reminder_log_today_s_journal_cb33be3e": {
+   "en": "Log today\\'s journal",
+   "ar": "سجّل يوميات اليوم"
+  },
+  "l10n_journal_reminder_logged_today_0071a46c": {
+   "en": "Logged today",
+   "ar": "سُجِّل اليوم"
+  },
+  "l10n_journal_reminder_open_journal_bbd88cc1": {
+   "en": "Open journal",
+   "ar": "فتح اليوميات"
+  },
+  "l10n_journal_reminder_show_a_today_card_reminding_you_to_log_your_journal_8228bc77": {
+   "en": "Show a Today card reminding you to log your journal",
+   "ar": "عرض بطاقة في «اليوم» تذكّرك بتسجيل يومياتك"
+  },
+  "l10n_journal_reminder_tap_a_day_to_catch_up_10d16728": {
+   "en": "Tap a day to catch up",
+   "ar": "اضغط على يوم لتعويض ما فاتك"
+  },
+  "l10n_lab_book_screen_a_private_notebook_not_a_medical_f63242cb": {
+   "en": "A private notebook, not a medical service.",
+   "ar": "دفتر خاص، لا خدمة طبية."
+  },
+  "l10n_lab_book_screen_about_lab_book_37bf2691": {
+   "en": "About Lab Book",
+   "ar": "عن دفتر المختبر"
+  },
+  "l10n_lab_book_screen_all_stays_on_this_phone_nothing_9a966c1c": {
+   "en": "All stays on this phone. Nothing is sent anywhere.",
+   "ar": "كل شيء يبقى على هذا الهاتف. لا يُرسل شيء إلى أي مكان."
+  },
+  "l10n_lab_book_screen_bring_in_a_markers_csv_date_1090bec2": {
+   "en": "Bring in a markers CSV (date, marker, value, unit). Names that match the catalog ",
+   "ar": "استورد ملف CSV للمؤشرات (التاريخ، المؤشر، القيمة، الوحدة). الأسماء المطابقة للفهرس "
+  },
+  "l10n_lab_book_screen_choose_a_wearable_signal_to_compare_05a4b2bc": {
+   "en": "Choose a wearable signal to compare",
+   "ar": "اختر إشارة من الجهاز الملبوس للمقارنة"
+  },
+  "l10n_lab_book_screen_clear_719ea396": {
+   "en": "Clear",
+   "ar": "مسح"
+  },
+  "l10n_lab_book_screen_delete_this_reading_b5c92bda": {
+   "en": "Delete this reading",
+   "ar": "حذف هذه القراءة"
+  },
+  "l10n_lab_book_screen_import_readings_7ad0d28f": {
+   "en": "Import readings",
+   "ar": "استيراد قراءات"
+  },
+  "l10n_lab_book_screen_it_s_a_notebook_not_a_45835e98": {
+   "en": "It\\'s a notebook, not a lab. NOOP lines up the numbers you enter. It doesn\\'t test, read, or judge them. Not medical advice.",
+   "ar": "إنه دفتر، لا مختبر. يرتّب NOOP الأرقام التي تدخلها. لا يجري تحاليل ولا يقرأها ولا يحكم عليها. وليس نصيحة طبية."
+  },
+  "l10n_lab_book_screen_keep_your_own_numbers_here_1ca6c8ed": {
+   "en": "Keep your own numbers here",
+   "ar": "احتفظ بأرقامك هنا"
+  },
+  "l10n_lab_book_screen_lab_book_f966c140": {
+   "en": "Lab Book",
+   "ar": "دفتر المختبر"
+  },
+  "l10n_lab_book_screen_lab_book_is_a_private_notebook_d07380ca": {
+   "en": "Lab Book is a private notebook, not a medical service. NOOP stores and lines up the numbers ",
+   "ar": "دفتر المختبر دفتر خاص، لا خدمة طبية. يخزّن NOOP الأرقام ويرتّبها "
+  },
+  "l10n_lab_book_screen_lining_them_up_c59ee297": {
+   "en": "Lining them up…",
+   "ar": "جارٍ ترتيبها…"
+  },
+  "l10n_lab_book_screen_n_readings_line_up_but_there_27bfb506": {
+   "en": "%1$s readings line up, but there isn\\'t enough variation to compute a relationship.",
+   "ar": "%1$s قراءة مرتَّبة، لكن التباين غير كافٍ لحساب علاقة."
+  },
+  "l10n_lab_book_screen_n_readings_used_strengthword_r_directionword_298baf9e": {
+   "en": "%1$s readings used · %2$s %3$s association. This is your own data ",
+   "ar": "%1$s قراءة مستخدمة · ارتباط %2$s %3$s. هذه بياناتك أنت "
+  },
+  "l10n_lab_book_screen_pick_a_wearable_signal_resting_hr_8d8b01a2": {
+   "en": "Pick a wearable signal (resting HR, HRV, sleep, Charge, weight…) to line it up against this ",
+   "ar": "اختر إشارة من الجهاز الملبوس (نبض الراحة، تقلب النبض، النوم، الشحن، الوزن…) لترتيبها مقابل هذا "
+  },
+  "l10n_lab_book_screen_read_the_full_lab_book_note_3a250750": {
+   "en": "Read the full Lab Book note",
+   "ar": "اقرأ ملاحظة دفتر المختبر كاملة"
+  },
+  "l10n_lab_book_screen_read_the_full_note_3fd0e4d1": {
+   "en": "Read the full note",
+   "ar": "اقرأ الملاحظة كاملة"
+  },
+  "l10n_lab_book_screen_reading_your_logbook_e31992b0": {
+   "en": "Reading your logbook…",
+   "ar": "جارٍ قراءة دفترك…"
+  },
+  "l10n_lab_book_screen_these_are_your_own_numbers_shown_7667508d": {
+   "en": "These are your own numbers shown back to you. NOOP doesn\\'t decide whether any value is normal, high or low.",
+   "ar": "هذه أرقامك أنت معروضة عليك. ولا يقرر NOOP ما إذا كانت أي قيمة طبيعية أو مرتفعة أو منخفضة."
+  },
+  "l10n_lab_book_screen_type_in_a_blood_pressure_reading_c276d418": {
+   "en": "Type in a blood-pressure reading or a cholesterol value from your last appointment. ",
+   "ar": "أدخل قراءة ضغط دم أو قيمة كوليسترول من موعدك الأخير. "
+  },
+  "l10n_lab_book_screen_what_lab_book_is_and_isn_f28686df": {
+   "en": "What Lab Book is (and isn\\'t)",
+   "ar": "ما هو دفتر المختبر (وما ليس هو)"
+  },
+  "l10n_live_screen_avg_cdc93143": {
+   "en": "Avg",
+   "ar": "متوسط"
+  },
+  "l10n_live_screen_buzz_edbd47b2": {
+   "en": "Buzz",
+   "ar": "اهتزاز"
+  },
+  "l10n_live_screen_can_t_connect_your_strap_s_cf78be83": {
+   "en": "Can\\'t connect - your strap\\'s pairing was reset",
+   "ar": "تعذّر الاتصال — أُعيد ضبط اقتران سوارك"
+  },
+  "l10n_live_screen_charging_5f99fe21": {
+   "en": "Charging",
+   "ar": "قيد الشحن"
+  },
+  "l10n_live_screen_distance_42320809": {
+   "en": "Distance",
+   "ar": "المسافة"
+  },
+  "l10n_live_screen_effort_8c974bc6": {
+   "en": "Effort",
+   "ar": "الجهد"
+  },
+  "l10n_live_screen_end_a2bb9d34": {
+   "en": "End",
+   "ar": "إنهاء"
+  },
+  "l10n_live_screen_end_workout_3e8d6238": {
+   "en": "End workout",
+   "ar": "إنهاء التمرين"
+  },
+  "l10n_live_screen_history_synced_relativeago_at_0ece753a": {
+   "en": "History synced %1$s",
+   "ar": "تمت مزامنة السجل %1$s"
+  },
+  "l10n_live_screen_hr_f187928f": {
+   "en": "HR",
+   "ar": "النبض"
+  },
+  "l10n_live_screen_live_body_console_54838e06": {
+   "en": "Live Body Console",
+   "ar": "لوحة الجسد المباشرة"
+  },
+  "l10n_live_screen_manage_devices_e5c277ff": {
+   "en": "Manage devices",
+   "ar": "إدارة الأجهزة"
+  },
+  "l10n_live_screen_max_hr_6acd9e07": {
+   "en": "Max HR",
+   "ar": "أقصى نبض"
+  },
+  "l10n_live_screen_pace_7a9a6226": {
+   "en": "Pace",
+   "ar": "الوتيرة"
+  },
+  "l10n_live_screen_peak_c83dbbd3": {
+   "en": "Peak",
+   "ar": "الذروة"
+  },
+  "l10n_live_screen_refresh_56e3badc": {
+   "en": "Refresh",
+   "ar": "تحديث"
+  },
+  "l10n_live_screen_rmssd_roundtoint_ms_9e6c0887": {
+   "en": "%1$s ms",
+   "ar": "%1$s مللي ثانية"
+  },
+  "l10n_live_screen_scan_and_connect_to_start_a_3e27b47b": {
+   "en": "Scan and connect to start a live stream.",
+   "ar": "ابحث واتصل لبدء بث مباشر."
+  },
+  "l10n_live_screen_session_f7f1997c": {
+   "en": "Session",
+   "ar": "جلسة"
+  },
+  "l10n_live_screen_signal_trust_4a91fe00": {
+   "en": "Signal Trust",
+   "ar": "موثوقية الإشارة"
+  },
+  "l10n_live_screen_start_a_live_stream_419bf5aa": {
+   "en": "Start a live stream",
+   "ar": "بدء بث مباشر"
+  },
+  "l10n_live_screen_start_workout_d0f3f2cd": {
+   "en": "Start workout",
+   "ar": "بدء تمرين"
+  },
+  "l10n_live_screen_strap_02b88eeb": {
+   "en": "Strap",
+   "ar": "السوار"
+  },
+  "l10n_live_screen_take_an_hrv_reading_20ecb2d2": {
+   "en": "Take an HRV reading",
+   "ar": "إجراء قراءة لتقلب النبض"
+  },
+  "l10n_live_screen_top_zone_282d0f66": {
+   "en": "Top zone",
+   "ar": "المنطقة العليا"
+  },
+  "l10n_live_screen_whoop_5_0_mg_pairs_with_b93143f2": {
+   "en": "WHOOP 5.0/MG pairs with one app at a time. If a scan finds nothing, unpair it in ",
+   "ar": "يقترن WHOOP 5.0/MG بتطبيق واحد في كل مرة. إذا لم يجد البحث شيئًا، فألغِ اقترانه في "
+  },
+  "l10n_live_screen_zone_zone_b8e9c0f9": {
+   "en": "ZONE %1$s",
+   "ar": "المنطقة %1$s"
+  },
+  "l10n_live_session_screen_above_6370c271": {
+   "en": "Above",
+   "ar": "أعلى"
+  },
+  "l10n_live_session_screen_below_5ba07a31": {
+   "en": "Below",
+   "ar": "أدنى"
+  },
+  "l10n_live_session_screen_done_e9b450d1": {
+   "en": "Done",
+   "ar": "تم"
+  },
+  "l10n_live_session_screen_end_session_8c0f4c33": {
+   "en": "End session",
+   "ar": "إنهاء الجلسة"
+  },
+  "l10n_live_session_screen_guarded_for_elapsedclock_snap_elapsedsec_tolong_a61f2d32": {
+   "en": "Guarded for %1$s",
+   "ar": "تحت الحماية %1$s"
+  },
+  "l10n_live_session_screen_in_band_2c23d86e": {
+   "en": "In band",
+   "ar": "ضمن النطاق"
+  },
+  "l10n_live_session_screen_live_session_73c925a5": {
+   "en": "Live Session",
+   "ar": "جلسة مباشرة"
+  },
+  "l10n_live_session_screen_session_ring_statelabel_long_press_to_42ac1b3b": {
+   "en": "Session ring. %1$s. Long-press to show heart rate.",
+   "ar": "حلقة الجلسة. %1$s. اضغط مطولًا لعرض معدل النبض."
+  },
+  "l10n_live_session_screen_session_summary_f9418e16": {
+   "en": "Session summary",
+   "ar": "ملخص الجلسة"
+  },
+  "l10n_live_session_screen_the_strap_signal_was_gone_for_57a2fead": {
+   "en": "The strap signal was gone for 10 minutes, so the session ended itself.",
+   "ar": "انقطعت إشارة السوار لعشر دقائق، فأنهت الجلسة نفسها."
+  },
+  "l10n_live_workout_screen_avg_cdc93143": {
+   "en": "Avg",
+   "ar": "متوسط"
+  },
+  "l10n_live_workout_screen_cadence_68af11f0": {
+   "en": "Cadence",
+   "ar": "الإيقاع"
+  },
+  "l10n_live_workout_screen_cancel_77dfd213": {
+   "en": "Cancel",
+   "ar": "إلغاء"
+  },
+  "l10n_live_workout_screen_effort_8c974bc6": {
+   "en": "Effort",
+   "ar": "الجهد"
+  },
+  "l10n_live_workout_screen_end_this_workout_4869c76a": {
+   "en": "End this workout?",
+   "ar": "إنهاء هذا التمرين؟"
+  },
+  "l10n_live_workout_screen_end_workout_3e8d6238": {
+   "en": "End workout",
+   "ar": "إنهاء التمرين"
+  },
+  "l10n_live_workout_screen_of_c5e92da0": {
+   "en": "of %1$d",
+   "ar": "من %1$d"
+  },
+  "l10n_live_workout_screen_peak_c83dbbd3": {
+   "en": "Peak",
+   "ar": "الذروة"
+  },
+  "l10n_live_workout_screen_power_7548ab52": {
+   "en": "Power",
+   "ar": "القدرة"
+  },
+  "l10n_live_workout_screen_speed_2d2cb022": {
+   "en": "Speed",
+   "ar": "السرعة"
+  },
+  "l10n_live_workout_screen_this_stops_recording_and_saves_what_3e17a23e": {
+   "en": "This stops recording and saves what\\'s captured so far. It can\\'t be resumed.",
+   "ar": "يوقف هذا التسجيل ويحفظ ما التُقط حتى الآن. ولا يمكن استئنافه."
+  },
+  "l10n_live_workout_screen_z_z_d3991a28": {
+   "en": "Z%1$s",
+   "ar": "م%1$s"
+  },
+  "l10n_marker_editor_screen_add_a_reading_ed7708ee": {
+   "en": "Add a reading",
+   "ar": "إضافة قراءة"
+  },
+  "l10n_marker_editor_screen_date_taken_76edfcab": {
+   "en": "Date taken",
+   "ar": "تاريخ القياس"
+  },
+  "l10n_marker_editor_screen_entered_together_stored_as_two_markers_af8f3ba0": {
+   "en": "Entered together; stored as two markers so each lines up cleanly against your signals.",
+   "ar": "أُدخلا معًا؛ ويُخزَّنان كمؤشرين لينتظم كل منهما بوضوح مقابل إشاراتك."
+  },
+  "l10n_marker_editor_screen_lab_book_keeps_your_own_numbers_9085ce2c": {
+   "en": "Lab Book keeps your own numbers - it doesn\\'t test, read, or judge them, and it\\'s not medical ",
+   "ar": "يحتفظ دفتر المختبر بأرقامك أنت — لا يجري تحاليل ولا يقرأها ولا يحكم عليها، وليس طبيًا "
+  },
+  "l10n_marker_editor_screen_no_match_add_it_as_a_ad5c59ec": {
+   "en": "No match. Add it as a custom marker below.",
+   "ar": "لا تطابق. أضفه كمؤشر مخصص أدناه."
+  },
+  "l10n_marker_editor_screen_noop_never_fills_this_in_it_7be9653b": {
+   "en": "NOOP never fills this in - it only shows back exactly what you type from your own report.",
+   "ar": "لا يملأ NOOP هذا أبدًا — بل يعرض بالضبط ما تدخله من تقريرك أنت."
+  },
+  "l10n_marker_editor_screen_search_markers_103981e0": {
+   "en": "Search markers",
+   "ar": "البحث في المؤشرات"
+  }
+ },
+ "_glossary_note": "Terminology anchor, not a literal expectation. Arabic inflects - the definite article, prepositions and verb forms all alter the stored surface form - so a plain substring check will under-report these terms. Keep the terms, or change them everywhere at once."
+}

From 800cb9cf4e1e510eed3597095e1f016eb522a3db Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 20:02:25 +1200
Subject: [PATCH 226/333] sleep: drag the filled hypnogram to read the clock
 time under your finger (#1875)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Drag the filled hypnogram to read the clock time under your finger. A crosshair
follows the touch and a readout replaces the time axis, so the chart keeps its
height mid-drag.

The mapping is a pure function, `scrubHitAt`, pinned by 6 tests: time is linear
in x so the readout agrees with the axis labels it replaces, and the stage comes
from containment rather than nearest-neighbour, so an unlabelled gap reports no
stage instead of attributing that time to one.

Scrub arms only where the night supplies a real clock window. The proportional
strip is untouched: it is fed a fixed order of stage totals, not chronology, so
timestamps there would be fabricated.

Both platforms floor short bands when drawing and hit-test with an unfloored
linear inverse, so a sub-floor band can resolve to its neighbour. The skew is
bounded at 1.5px against a 2px crosshair, below touch resolution. Left as-is:
a floor-aware hit-test would make time non-linear in x and break the readout's
agreement with the axis.

Not yet exercised on a device — the mapping is tested, the feel is not.

Requested by @AussieFries in #1855.
---
 .../java/com/noop/ui/SleepStageBreakdownUi.kt | 87 +++++++++++++++++--
 .../com/noop/ui/SleepStageTimelineLogic.kt    | 30 +++++++
 .../java/com/noop/ui/HypnogramScrubTest.kt    | 63 ++++++++++++++
 3 files changed, 175 insertions(+), 5 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ui/HypnogramScrubTest.kt

diff --git a/android/app/src/main/java/com/noop/ui/SleepStageBreakdownUi.kt b/android/app/src/main/java/com/noop/ui/SleepStageBreakdownUi.kt
index ffeecb76b7..48faaaaafd 100644
--- a/android/app/src/main/java/com/noop/ui/SleepStageBreakdownUi.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepStageBreakdownUi.kt
@@ -1,8 +1,9 @@
 package com.noop.ui
 
+import android.text.format.DateFormat
 import androidx.compose.foundation.Canvas
 import androidx.compose.foundation.background
-import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.foundation.gestures.detectHorizontalDragGestures
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
@@ -11,10 +12,14 @@ import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
@@ -23,11 +28,10 @@ import androidx.compose.ui.geometry.Offset
 import androidx.compose.ui.geometry.Size
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.StrokeCap
+import androidx.compose.ui.input.pointer.pointerInput
 import androidx.compose.ui.layout.Layout
 import androidx.compose.ui.platform.LocalConfiguration
 import androidx.compose.ui.platform.LocalContext
-import android.text.format.DateFormat
-import java.util.TimeZone
 import androidx.compose.ui.semantics.contentDescription
 import androidx.compose.ui.semantics.semantics
 import androidx.compose.ui.text.style.TextAlign
@@ -35,6 +39,7 @@ import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import com.noop.R
 import java.util.Locale
+import java.util.TimeZone
 import kotlin.math.roundToInt
 
 /**
@@ -242,12 +247,44 @@ internal fun FilledHypnogram(
     // left the hypnogram axis in 24h while the sleep card above it changed - the setting half-applied.
     val is24h = ClockPrefs.uses24Hour(LocalContext.current)
     val axisTicks = if (showsAxis) hypnogramAxisTicks(onsetTs!!, wakeTs!!, maxAxisLabels, is24h) else emptyList()
+    var scrub by remember(intervals) { mutableStateOf<ScrubHit?>(null) }
+    // The crosshair tracks the FINGER. Snapping it to the resolved segment would put the line up to
+    // half a segment from the touch while the readout named the time where the finger actually was.
+    var scrubX by remember(intervals) { mutableStateOf(0f) }
     Column(verticalArrangement = Arrangement.spacedBy(Metrics.space6)) {
         Canvas(
             modifier = Modifier
                 .fillMaxWidth()
                 .height(Metrics.compactChartHeight)
-                .semantics { contentDescription = axSummary },
+                .semantics { contentDescription = axSummary }
+                .then(
+                    // #1855: drag to read the clock time under your finger. Offered only when the
+                    // night supplies a clock window, because without one there is no real time to
+                    // report and a number would have to be invented.
+                    if (showsAxis) {
+                        Modifier.pointerInput(intervals, originSec, spanSec) {
+                            fun hit(x: Float) = scrubHitAt(
+                                xPx = x,
+                                widthPx = size.width.toFloat(),
+                                intervals = intervals,
+                                originSec = originSec,
+                                spanSec = spanSec,
+                            )
+                            detectHorizontalDragGestures(
+                                onDragStart = { scrubX = it.x; scrub = hit(it.x) },
+                                onDragEnd = { scrub = null },
+                                onDragCancel = { scrub = null },
+                                onHorizontalDrag = { change, _ ->
+                                    scrubX = change.position.x
+                                    scrub = hit(change.position.x)
+                                    change.consume()
+                                },
+                            )
+                        }
+                    } else {
+                        Modifier
+                    },
+                ),
         ) {
             val w = size.width
             val h = size.height
@@ -319,8 +356,48 @@ internal fun FilledHypnogram(
                     strokeWidth = 1f,
                 )
             }
+
+            // Scrub crosshair LAST, so it sits over the filled staircase. In FILLED mode every stage
+            // paints from its level down to the baseline, so a crosshair drawn earlier is covered by
+            // the next rect and effectively invisible across most of the chart.
+            if (scrub != null) {
+                val cx = scrubX.coerceIn(0f, w)
+                drawLine(
+                    color = Palette.textPrimary,
+                    start = Offset(cx, 0f),
+                    end = Offset(cx, h),
+                    strokeWidth = 2f,
+                )
+            }
         }
-        if (axisTicks.isNotEmpty()) {
+        val hit = scrub
+        if (hit != null) {
+            // Replaces the time axis rather than adding a layer, so the chart does not change height
+            // mid-drag. Two Texts with spacing, not one string joined by a literal separator: that
+            // separator would be new hardcoded copy, and building it outside the Text() call to dodge
+            // extraction is the pattern #557 / #922 track. Stage names and clockTimeLabel are both
+            // existing, so this adds no new strings.
+            Row(
+                modifier = Modifier.fillMaxWidth(),
+                horizontalArrangement = Arrangement.spacedBy(
+                    Metrics.space6,
+                    Alignment.CenterHorizontally,
+                ),
+            ) {
+                Text(
+                    hit.stage.uppercase(),
+                    style = NoopType.footnote,
+                    color = Palette.textSecondary,
+                    maxLines = 1,
+                )
+                Text(
+                    clockTimeLabel(hit.timestamp, is24h),
+                    style = NoopType.footnote,
+                    color = Palette.textPrimary,
+                    maxLines = 1,
+                )
+            }
+        } else if (axisTicks.isNotEmpty()) {
             HypnogramTimeAxis(axisTicks)
         }
     }
diff --git a/android/app/src/main/java/com/noop/ui/SleepStageTimelineLogic.kt b/android/app/src/main/java/com/noop/ui/SleepStageTimelineLogic.kt
index 503ea9117e..0fdcff721c 100644
--- a/android/app/src/main/java/com/noop/ui/SleepStageTimelineLogic.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepStageTimelineLogic.kt
@@ -40,6 +40,36 @@ internal data class StageInterval(val stage: String, val startSec: Double, val e
     val durationSec: Double get() = endSec - startSec
 }
 
+/** What the hypnogram scrub is pointing at: the stage under the finger and its clock time. */
+internal data class ScrubHit(val stage: String, val timestamp: Long)
+
+/**
+ * Resolve a scrub x on the FILLED hypnogram into a stage and a real clock time (#1855).
+ *
+ * Valid here in a way it would NOT be on the proportional strip. `FilledHypnogram` positions every
+ * segment by `xOf(sec) = w * (sec / spanSec)` — linear in real time — from persisted per-epoch
+ * segments that carry their own start and end. So inverting x gives a timestamp the night actually
+ * had. The proportional strip is a different thing: it arranges stage TOTALS in a fixed
+ * light/deep/light/rem/light/awake order that is not the chronology, so a clock time read off it
+ * would be invented. That is why the scrub lives here and not there.
+ *
+ * The stage comes from containment on the real intervals rather than from the x fraction, so a gap
+ * the stager left unlabelled reports no stage instead of borrowing its neighbour's.
+ */
+internal fun scrubHitAt(
+    xPx: Float,
+    widthPx: Float,
+    intervals: List<StageInterval>,
+    originSec: Double,
+    spanSec: Double,
+): ScrubHit? {
+    if (widthPx <= 0f || spanSec <= 0.0 || intervals.isEmpty()) return null
+    val frac = (xPx / widthPx).coerceIn(0f, 1f).toDouble()
+    val sec = frac * spanSec
+    val stage = intervals.firstOrNull { sec >= it.startSec && sec <= it.endSec }?.stage.orEmpty()
+    return ScrubHit(stage = stage, timestamp = (originSec + sec).toLong())
+}
+
 /**
  * Reconstruct absolute (stage, startSec, endSec) intervals from the hero's ordered
  * `realSegments` weight pairs (name, minutes) by walking cumulative fractions across [spanSec]
diff --git a/android/app/src/test/java/com/noop/ui/HypnogramScrubTest.kt b/android/app/src/test/java/com/noop/ui/HypnogramScrubTest.kt
new file mode 100644
index 0000000000..0ea92d6f48
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/HypnogramScrubTest.kt
@@ -0,0 +1,63 @@
+package com.noop.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/**
+ * Pins the hypnogram scrub (#1855): dragging the FILLED hypnogram reports the real clock time and
+ * the stage under the finger.
+ *
+ * The component matters as much as the maths here. `FilledHypnogram` draws persisted per-epoch
+ * segments positioned by `xOf(sec) = w * (sec / spanSec)` — linear in real time — so inverting x
+ * yields a timestamp the night actually had. The PROPORTIONAL strip is a different thing: it
+ * arranges stage TOTALS in a fixed light/deep/light/rem/light/awake order that is not the
+ * chronology, so a clock time read off that would be invented. These tests pin the honest one.
+ */
+class HypnogramScrubTest {
+
+    private val origin = 1_700_000_000.0          // unix seconds
+    private val span = 8 * 3600.0                 // an 8-hour window
+
+    /** deep 0–2h, rem 2–3h, then a deliberate unlabelled gap 3–4h, light 4–8h. */
+    private val intervals = listOf(
+        StageInterval("deep", 0.0, 2 * 3600.0),
+        StageInterval("rem", 2 * 3600.0, 3 * 3600.0),
+        StageInterval("light", 4 * 3600.0, 8 * 3600.0),
+    )
+
+    @Test fun timeIsTheRealClockTimeAtThatFractionOfTheNight() {
+        val hit = scrubHitAt(xPx = 100f, widthPx = 400f, intervals, origin, span)!!
+        assertEquals((origin + 2 * 3600.0).toLong(), hit.timestamp)   // a quarter in = 2 h
+    }
+
+    @Test fun theStageComesFromContainmentOnRealIntervals() {
+        assertEquals("deep", scrubHitAt(50f, 400f, intervals, origin, span)!!.stage)
+        assertEquals("rem", scrubHitAt(125f, 400f, intervals, origin, span)!!.stage)
+        assertEquals("light", scrubHitAt(300f, 400f, intervals, origin, span)!!.stage)
+    }
+
+    @Test fun anUnlabelledGapReportsNoStageRatherThanBorrowingANeighbour() {
+        // 3.5 h in lands in the gap the stager left unlabelled. The time is still real, but naming a
+        // stage there would be asserting something the night never recorded.
+        val hit = scrubHitAt(xPx = 175f, widthPx = 400f, intervals, origin, span)!!
+        assertEquals("", hit.stage)
+        assertEquals((origin + 3.5 * 3600.0).toLong(), hit.timestamp)
+    }
+
+    @Test fun theEndsClampToTheWindow() {
+        assertEquals(origin.toLong(), scrubHitAt(0f, 400f, intervals, origin, span)!!.timestamp)
+        assertEquals((origin + span).toLong(), scrubHitAt(400f, 400f, intervals, origin, span)!!.timestamp)
+    }
+
+    @Test fun pastEitherEdgeClampsRatherThanExtrapolating() {
+        assertEquals(origin.toLong(), scrubHitAt(-99f, 400f, intervals, origin, span)!!.timestamp)
+        assertEquals((origin + span).toLong(), scrubHitAt(9999f, 400f, intervals, origin, span)!!.timestamp)
+    }
+
+    @Test fun degenerateInputsReportNothingRatherThanGuessing() {
+        assertNull("no width", scrubHitAt(10f, 0f, intervals, origin, span))
+        assertNull("no span", scrubHitAt(10f, 400f, intervals, origin, 0.0))
+        assertNull("no intervals", scrubHitAt(10f, 400f, emptyList(), origin, span))
+    }
+}

From 14d002ce4cea5f8bbbe34cbe5b3223896c4c70c3 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 20:04:00 +1200
Subject: [PATCH 227/333] build: staging 432 / iOS 313 for the next testing
 build

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 4855a5b903..7a35eea361 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 431
+        versionCode = 432
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 5c51e1524f..5c8efc388e 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "312"
+    CURRENT_PROJECT_VERSION: "313"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From dbe0834964b37663ebe9ff6adad7d583624dbfa3 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 20:39:49 +1200
Subject: [PATCH 228/333] backup: say WHICH folder backups go to, iCloud Drive
 included (#1876)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From a user: "Are you able to choose different folder in iCloud folder for backup?"

You already could. The picker is a true open-in-place folder picker, so iCloud
Drive is in the sidebar and any folder inside it is selectable, and the screen
already carries a tip saying so. What was missing is that you could not tell
whether it worked: folderLabel returned the bare last path component, so an
iCloud "Backups" folder and the on-device fallback's Documents/Backups both
rendered as "Saving to: Backups".

The label now names the place and two components of the tail — "iCloud Drive >
Backups > NOOP". isICloudPath becomes the single definition of the iCloud rule,
shared with restoreListHealth, so the screen and the diagnostics dump cannot
disagree about where the backups are. The trail slices AFTER the sync root
rather than filtering the tilde component out: on macOS an iCloud path is
~/Library/Mobile Documents/com~apple~CloudDocs/NOOP, so filtering alone leaves
"Mobile Documents > NOOP". A standalone swiftc oracle over the real path shapes
caught that; both cases are pinned by tests.

Re-review found the other half of the same function had never entered the
String Catalog, so "NOOP (in Files)" was shipping in English in all nine
locales. Second commit translates it.

i18n_audit gains a narrow brand-phrase exemption. Its two-word floor already
lets a one-word brand through and cannot see a two-word one, so "iCloud Drive"
repeated verbatim in German read as an untranslated echo when that is the
correct rendering. Only strings that are ENTIRELY brand are exempt, so "Apple
Health sync" stays gated. Measured, not assumed: zero existing strings on
either platform stop counting because of it.

Worth knowing for later: the audit never verified any of these strings. It
matches SwiftUI view constructors, so a String(localized:) in a model file is
invisible to it — the blind spot tracked in #844, which is also why the
untranslated fallback label survived this long. The nine locales here were
checked by hand.

Not verified on a device: the path shapes are asserted from Apple's two
documented iCloud layouts, not observed.

Groundwork for #52.
---
 Strand/Data/BackupSync.swift           | 49 ++++++++++++++++++++++++--
 Strand/Resources/Localizable.xcstrings |  5 ++-
 StrandTests/BackupSyncTests.swift      | 41 +++++++++++++++++++++
 Tools/i18n_audit.py                    | 20 +++++++++++
 4 files changed, 111 insertions(+), 4 deletions(-)

diff --git a/Strand/Data/BackupSync.swift b/Strand/Data/BackupSync.swift
index af7b118340..c04b8629bc 100644
--- a/Strand/Data/BackupSync.swift
+++ b/Strand/Data/BackupSync.swift
@@ -202,11 +202,53 @@ enum FolderBackup {
         return dir
     }
 
+    /// Whether a folder path sits in iCloud. The SINGLE definition of that rule — `restoreListHealth`
+    /// reports the same signal to diagnostics, and a screen that disagreed with the diagnostics dump
+    /// about where the backups are would make #278-style triage worse, not better.
+    ///
+    /// Ubiquity containers live under `Mobile Documents`, which covers both iCloud Drive proper
+    /// (`com~apple~CloudDocs`) and per-app containers. Pure and path-only, so it is testable without a
+    /// picker, a bookmark or a device.
+    static func isICloudPath(_ path: String) -> Bool { path.contains("Mobile Documents") }
+
+    /// The tail of a folder path, for display: `"NOOP › 2026"`.
+    ///
+    /// The bare last component is not enough to identify a folder — a "Backups" folder in iCloud Drive
+    /// and the #52 internal fallback's `Documents/Backups` render identically, which is exactly the
+    /// confusion this line is meant to settle. The FULL path is not shown either: on iOS it is a long
+    /// sandbox UUID and on macOS it carries the user's home directory, neither of which helps.
+    ///
+    /// For an iCloud path everything up to and including the sync root (`com~apple~CloudDocs`, or a
+    /// per-app `iCloud~…` container) is dropped, since [folderLabel] already names iCloud Drive and the
+    /// raw tilde form means nothing to a reader.
+    static func folderTrail(path: String, maxComponents: Int = 2) -> String {
+        var parts = path.split(separator: "/").map(String.init).filter { !$0.isEmpty }
+        // Slice AFTER the sync root rather than filtering it out: on macOS an iCloud path is
+        // `~/Library/Mobile Documents/com~apple~CloudDocs/NOOP`, so merely dropping the tilde component
+        // leaves "Mobile Documents › NOOP" — plumbing the reader should never see.
+        if let i = parts.lastIndex(where: {
+            $0 == "com~apple~CloudDocs" || $0.hasPrefix("iCloud~") || $0 == "Mobile Documents"
+        }) { parts = Array(parts[(i + 1)...]) }
+        return parts.suffix(max(1, maxComponents)).joined(separator: " › ")
+    }
+
     /// A short, human label for the chosen folder, or nil if none chosen. The internal fallback gets a
     /// friendly name instead of the raw "Backups" path component.
+    ///
+    /// Names iCloud explicitly (#52): the picker can already point anywhere, iCloud Drive included, so
+    /// the gap was never the choosing — it was that the result was unidentifiable afterwards. A user on
+    /// the internal fallback saw a bare "Backups" and could not tell their backups were on-device only.
     static func folderLabel() -> String? {
         if useInternalFolder { return String(localized: "NOOP (in Files)") }
-        return resolveFolder()?.lastPathComponent
+        guard let path = resolveFolder()?.path else { return nil }
+        let trail = folderTrail(path: path)
+        if isICloudPath(path) {
+            // Picking the iCloud Drive root itself leaves no trail; naming the place alone beats an
+            // empty separator dangling off the end.
+            return trail.isEmpty ? String(localized: "iCloud Drive")
+                                 : String(localized: "iCloud Drive › \(trail)")
+        }
+        return trail.isEmpty ? (path.split(separator: "/").last.map(String.init) ?? path) : trail
     }
 
     // MARK: - Security-scoped bookmark
@@ -310,8 +352,9 @@ enum FolderBackup {
         let raw = (try? FileManager.default.contentsOfDirectory(atPath: folder.path))?.count ?? 0
         // Report iCloud-vs-local (the actual #278 triage signal — undownloaded placeholders live in the
         // iCloud container) WITHOUT the folder's user-chosen name, which redactPii can't scrub and the
-        // iOS twin never exposes. The iCloud ubiquity container path contains "Mobile Documents".
-        let isICloud = folder.path.contains("Mobile Documents")
+        // iOS twin never exposes. Shares `isICloudPath` with the label the user sees, so the screen and
+        // this dump can never disagree about where the backups are.
+        let isICloud = isICloudPath(folder.path)
         return (isICloud, raw, listSnapshots().count)
     }
 
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 0bb776273b..4c3978287f 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -209686,7 +209686,10 @@
     "Intermediate type": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Mischtyp"}},"es":{"stringUnit":{"state":"translated","value":"Tipo intermedio"}},"fr":{"stringUnit":{"state":"translated","value":"Type intermédiaire"}},"it":{"stringUnit":{"state":"translated","value":"Tipo intermedio"}},"pl":{"stringUnit":{"state":"translated","value":"Typ pośredni"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Tipo intermédio"}},"ru":{"stringUnit":{"state":"translated","value":"Промежуточный тип"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"中间型"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"中間型"}}}},
     "Evening type": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Abendtyp"}},"es":{"stringUnit":{"state":"translated","value":"Tipo vespertino"}},"fr":{"stringUnit":{"state":"translated","value":"Type vespéral"}},"it":{"stringUnit":{"state":"translated","value":"Tipo serale"}},"pl":{"stringUnit":{"state":"translated","value":"Typ wieczorny"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Tipo vespertino"}},"ru":{"stringUnit":{"state":"translated","value":"Вечерний тип"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"夜型人"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"夜型人"}}}},
     "Body clock dial": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Zifferblatt der inneren Uhr"}},"es":{"stringUnit":{"state":"translated","value":"Esfera del reloj interno"}},"fr":{"stringUnit":{"state":"translated","value":"Cadran de l'horloge biologique"}},"it":{"stringUnit":{"state":"translated","value":"Quadrante dell'orologio biologico"}},"pl":{"stringUnit":{"state":"translated","value":"Tarcza zegara biologicznego"}},"pt-PT":{"stringUnit":{"state":"translated","value":"Mostrador do relógio biológico"}},"ru":{"stringUnit":{"state":"translated","value":"Циферблат биологических часов"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"生物钟表盘"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"生理時鐘錶盤"}}}},
-    "Your clock": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Deine innere Uhr"}},"es":{"stringUnit":{"state":"translated","value":"Tu reloj interno"}},"fr":{"stringUnit":{"state":"translated","value":"Votre horloge"}},"it":{"stringUnit":{"state":"translated","value":"Il tuo orologio"}},"pl":{"stringUnit":{"state":"translated","value":"Twój zegar"}},"pt-PT":{"stringUnit":{"state":"translated","value":"O seu relógio"}},"ru":{"stringUnit":{"state":"translated","value":"Ваши часы"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"你的生物钟"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"你的生理時鐘"}}}}
+    "Your clock": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Deine innere Uhr"}},"es":{"stringUnit":{"state":"translated","value":"Tu reloj interno"}},"fr":{"stringUnit":{"state":"translated","value":"Votre horloge"}},"it":{"stringUnit":{"state":"translated","value":"Il tuo orologio"}},"pl":{"stringUnit":{"state":"translated","value":"Twój zegar"}},"pt-PT":{"stringUnit":{"state":"translated","value":"O seu relógio"}},"ru":{"stringUnit":{"state":"translated","value":"Ваши часы"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"你的生物钟"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"你的生理時鐘"}}}},
+    "iCloud Drive": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"es":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"fr":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"it":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"pl":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"pt-PT":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"ru":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"iCloud 云盘"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"iCloud 雲碟"}}}},
+    "iCloud Drive › %@": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"es":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"fr":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"it":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"pl":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"pt-PT":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"ru":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"iCloud 云盘 › %@"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"iCloud 雲碟 › %@"}}}},
+    "NOOP (in Files)": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"NOOP (in Dateien)"}},"es":{"stringUnit":{"state":"translated","value":"NOOP (en Archivos)"}},"fr":{"stringUnit":{"state":"translated","value":"NOOP (dans Fichiers)"}},"it":{"stringUnit":{"state":"translated","value":"NOOP (in File)"}},"pl":{"stringUnit":{"state":"translated","value":"NOOP (w Plikach)"}},"pt-PT":{"stringUnit":{"state":"translated","value":"NOOP (em Ficheiros)"}},"ru":{"stringUnit":{"state":"translated","value":"NOOP (в Файлах)"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"NOOP（在“文件”中）"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"NOOP（在「檔案」中）"}}}}
   },
   "version": "1.0"
 }
diff --git a/StrandTests/BackupSyncTests.swift b/StrandTests/BackupSyncTests.swift
index c958433e06..ba1c8df69e 100644
--- a/StrandTests/BackupSyncTests.swift
+++ b/StrandTests/BackupSyncTests.swift
@@ -130,4 +130,45 @@ final class BackupSyncTests: XCTestCase {
         let out = BackupSync.restorablesNewestFirst([z, a]) { _ in sameMs }
         XCTAssertEqual(out.map(\.name), [a, z])
     }
+
+    // MARK: - Folder identity (#52): "Saving to:" has to say WHICH folder
+
+    func testTrailSlicesAfterTheICloudSyncRoot() {
+        // macOS shape: merely filtering out the tilde component would leave "Mobile Documents › NOOP".
+        XCTAssertEqual(
+            FolderBackup.folderTrail(path: "/Users/x/Library/Mobile Documents/com~apple~CloudDocs/NOOP"),
+            "NOOP")
+        // iOS shape, two components deep.
+        XCTAssertEqual(
+            FolderBackup.folderTrail(
+                path: "/private/var/mobile/Library/Mobile Documents/com~apple~CloudDocs/Backups/NOOP"),
+            "Backups › NOOP")
+        // A per-app ubiquity container is a sync root too.
+        XCTAssertEqual(
+            FolderBackup.folderTrail(path: "/var/mobile/Library/Mobile Documents/iCloud~com~foo~bar/Documents/B"),
+            "Documents › B")
+    }
+
+    func testTrailIsEmptyAtTheSyncRootItself() {
+        // Nothing below the root: `folderLabel` must fall back to naming the place, not emit a dangling "›".
+        XCTAssertEqual(
+            FolderBackup.folderTrail(path: "/private/var/mobile/Library/Mobile Documents/com~apple~CloudDocs"),
+            "")
+    }
+
+    func testTrailKeepsTwoComponentsOutsideICloud() {
+        // The #52 internal fallback and an external cloud folder both stay identifiable.
+        XCTAssertEqual(
+            FolderBackup.folderTrail(path: "/var/mobile/Containers/Data/Application/9F3A-UUID/Documents/Backups"),
+            "Documents › Backups")
+        XCTAssertEqual(
+            FolderBackup.folderTrail(path: "/private/var/mobile/Containers/Shared/AppGroup/U/Dropbox/NoopBackups"),
+            "Dropbox › NoopBackups")
+    }
+
+    func testICloudPathRuleMatchesTheDiagnosticsSignal() {
+        // One definition: the screen and `restoreListHealth`'s dump must never disagree.
+        XCTAssertTrue(FolderBackup.isICloudPath("/Users/x/Library/Mobile Documents/com~apple~CloudDocs/NOOP"))
+        XCTAssertFalse(FolderBackup.isICloudPath("/var/mobile/Containers/Data/Application/U/Documents/Backups"))
+    }
 }
diff --git a/Tools/i18n_audit.py b/Tools/i18n_audit.py
index 1efce7e058..a2f8826289 100644
--- a/Tools/i18n_audit.py
+++ b/Tools/i18n_audit.py
@@ -926,13 +926,33 @@ def extra_locale_allowance() -> dict[str, int]:
 FORMAT_SPECIFIER_PATTERN = re.compile(r"%(?:\d+\$)?[@#0\-+ ]*[\d.]*(?:ll|l|h)?[@dfsu]|%%")
 
 
+# Multi-word product names that travel verbatim into Latin-script locales. The two-word floor below
+# already lets a ONE-word brand through ("HRV", "Strava"); it cannot see a two-word one, so "iCloud
+# Drive" repeated verbatim in German reads as an untranslated echo when it is the correct rendering.
+# Only strings that are ENTIRELY brand are exempted (see `_is_pure_brand_phrase`), so "Apple Health
+# sync" stays gated on its translatable word. CJK locales that DO translate these are unaffected —
+# they differ from the source, so they were never counted as echoes in the first place.
+BRAND_PHRASES = ("iCloud Drive",)
+
+
+def _is_pure_brand_phrase(text: str) -> bool:
+    """Whether a string is nothing but brand names, placeholders and punctuation."""
+    stripped = FORMAT_SPECIFIER_PATTERN.sub(" ", text)
+    for brand in BRAND_PHRASES:
+        stripped = stripped.replace(brand, " ")
+    return not re.search(r"[^\W\d_]{2,}", stripped, flags=re.UNICODE)
+
+
 def _has_translatable_words(text: str) -> bool:
     """Whether a string carries enough real words that an identical translation is suspicious.
 
     Strips format specifiers first: "%@ · n = %lld" / "%1$s: %2$s" are placeholders and punctuation
     with nothing to translate, so a locale repeating them verbatim is CORRECT, not a gap. Two words is
     the floor — one word is very often a term that legitimately travels ("HRV", "Yoga", a brand name).
+    A string that is entirely a multi-word brand is the same case one size up (see [BRAND_PHRASES]).
     """
+    if _is_pure_brand_phrase(text):
+        return False
     stripped = FORMAT_SPECIFIER_PATTERN.sub(" ", text)
     return len(re.findall(r"[^\W\d_]{2,}", stripped, flags=re.UNICODE)) >= 2
 

From 6c1fd6b4a3c71a50567f4a18e8fc64c71d8ddacc Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 20:58:58 +1200
Subject: [PATCH 229/333] android(backup): clear the busy flag in a finally, as
 the Apple twin does (#1877)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every control in the Backup & Sync screen body is gated on !busy, so a flag
left set is a dead end rather than one stuck button. The Apple twin clears it
in a defer for exactly that reason; the Android screen cleared it as a plain
statement partway through the coroutine, so any throw after that point skipped
it. Both call sites now clear it in a finally.

The only semantic change is the move — git diff -w is 20 insertions and 2
deletions, all of it the try/finally and its comments. Everything else in the
raw diff is re-indentation.

Two deliberate ordering consequences:

  - Back up now clears the flag AFTER the toast rather than before, so the
    screen stays disabled until the work is genuinely finished.
  - runRestore's NeedsRestart branch never reaches the finally, because it
    exits the process first. That is wanted: the screen stays disabled through
    the restart rather than briefly accepting taps against a database that has
    already been swapped underneath it.

NOT a repair for the reported stuck button, and should not be read as one.
writeSnapshot wraps its failure paths in runCatching, the scope is a
rememberCoroutineScope with no handler so an escaping throw would crash rather
than wedge, and busy lives in a plain remember that is discarded if the screen
leaves composition. The reachable window is a throw after the IO call while the
screen is still composed. The invariant is worth stating in code rather than
trusting the callee never to throw, but the report is still unexplained.

No test covers it: the change is inside a Composable onClick, and the Compose
test dependencies here are androidTestImplementation only — instrumented,
device-required, and not run in CI.

The same shape remains in DataSourcesScreen (2 sites, 9 controls gated on busy)
and OnboardingScreen (1 site). Both are contained by runCatching the same way
this one was; left for a follow-up rather than widened into here.
---
 .../main/java/com/noop/ui/BackupSyncScreen.kt | 100 +++++++++++-------
 1 file changed, 59 insertions(+), 41 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ui/BackupSyncScreen.kt b/android/app/src/main/java/com/noop/ui/BackupSyncScreen.kt
index 1c01b78856..f173214299 100644
--- a/android/app/src/main/java/com/noop/ui/BackupSyncScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/BackupSyncScreen.kt
@@ -86,37 +86,49 @@ fun BackupSyncScreen() {
     fun runRestore(uri: Uri) {
         busy = true
         scope.launch {
-            val r = withContext(Dispatchers.IO) { DataBackup.importFrom(context, uri) }
-            busy = false
-            when (r) {
-                is DataBackup.ImportResult.NeedsRestart -> {
-                    // #57: the restore CLOSED and swapped the database file. The long-lived WhoopRepository +
-                    // BLE client still hold a DAO on the OLD (now-closed) connection, so any strap sync would
-                    // fail with "connection pool has been closed" — and, worse, empty/metadata history ENDs
-                    // would still ack and trim the strap PAST records we can't store, discarding real history.
-                    // Relaunching the process re-opens Room against the restored file. Do it automatically
-                    // rather than trust the user to read a toast (which is exactly how #57 happened).
-                    Toast.makeText(context, "Backup restored — restarting NOOP…", Toast.LENGTH_LONG).show()
-                    // NonCancellable: this coroutine runs in the screen's scope, which is cancelled the
-                    // instant the user navigates away. The restart is a data-safety guarantee (the DB is
-                    // already swapped), so it must complete even if the composition leaves — otherwise the
-                    // user could keep syncing into the closed DB, the very bug we're fixing.
-                    withContext(NonCancellable) {
-                        delay(800)   // let the toast render before the process dies
-                        val ctx = context.applicationContext
-                        ctx.packageManager.getLaunchIntentForPackage(ctx.packageName)
-                            ?.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TASK)
-                            ?.let { ctx.startActivity(it) }
-                        Runtime.getRuntime().exit(0)
+            // Clear in a `finally` so it clears on ANY exit — the twin of the Apple `defer` in
+            // `BackupSyncView.runRestore`. All five controls in the screen body are gated on `!busy`
+            // — folder picker, auto toggle, keep-count, Back up now, Restore — so a flag left set is a
+            // dead end rather than one stuck button. (The restore sheet and confirm dialog are not
+            // gated, but they are transient overlays, not the way back to a working screen.)
+            //
+            // The NeedsRestart branch never reaches the `finally`: it exits the process first. That is
+            // the wanted behaviour — the screen stays disabled through the restart rather than briefly
+            // accepting taps against a database that has already been swapped underneath it.
+            try {
+                val r = withContext(Dispatchers.IO) { DataBackup.importFrom(context, uri) }
+                when (r) {
+                    is DataBackup.ImportResult.NeedsRestart -> {
+                        // #57: the restore CLOSED and swapped the database file. The long-lived WhoopRepository +
+                        // BLE client still hold a DAO on the OLD (now-closed) connection, so any strap sync would
+                        // fail with "connection pool has been closed" — and, worse, empty/metadata history ENDs
+                        // would still ack and trim the strap PAST records we can't store, discarding real history.
+                        // Relaunching the process re-opens Room against the restored file. Do it automatically
+                        // rather than trust the user to read a toast (which is exactly how #57 happened).
+                        Toast.makeText(context, "Backup restored — restarting NOOP…", Toast.LENGTH_LONG).show()
+                        // NonCancellable: this coroutine runs in the screen's scope, which is cancelled the
+                        // instant the user navigates away. The restart is a data-safety guarantee (the DB is
+                        // already swapped), so it must complete even if the composition leaves — otherwise the
+                        // user could keep syncing into the closed DB, the very bug we're fixing.
+                        withContext(NonCancellable) {
+                            delay(800)   // let the toast render before the process dies
+                            val ctx = context.applicationContext
+                            ctx.packageManager.getLaunchIntentForPackage(ctx.packageName)
+                                ?.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TASK)
+                                ?.let { ctx.startActivity(it) }
+                            Runtime.getRuntime().exit(0)
+                        }
                     }
+                    is DataBackup.ImportResult.Failed ->
+                        Toast.makeText(context, r.message, Toast.LENGTH_LONG).show()
+                    // #1807: recoverable, but not from here — this screen restores a folder snapshot
+                    // directly and has no confirm step to hang the override on. Settings → Backup & restore
+                    // → Import does, and shows the same sentence with a way through.
+                    is DataBackup.ImportResult.TooLarge ->
+                        Toast.makeText(context, r.message, Toast.LENGTH_LONG).show()
                 }
-                is DataBackup.ImportResult.Failed ->
-                    Toast.makeText(context, r.message, Toast.LENGTH_LONG).show()
-                // #1807: recoverable, but not from here — this screen restores a folder snapshot
-                // directly and has no confirm step to hang the override on. Settings → Backup & restore
-                // → Import does, and shows the same sentence with a way through.
-                is DataBackup.ImportResult.TooLarge ->
-                    Toast.makeText(context, r.message, Toast.LENGTH_LONG).show()
+            } finally {
+                busy = false
             }
         }
     }
@@ -334,18 +346,24 @@ fun BackupSyncScreen() {
                         onClick = {
                             busy = true
                             scope.launch {
-                                val ok = withContext(Dispatchers.IO) { BackupSync.backupNow(context) }
-                                lastMs = BackupSyncPrefs.lastBackupMs(context)
-                                busy = false
-                                Toast.makeText(
-                                    context,
-                                    if (ok) {
-                                        "Backed up to your folder."
-                                    } else {
-                                        "Backup failed - re-pick the folder and try again."
-                                    },
-                                    Toast.LENGTH_LONG,
-                                ).show()
+                                // Clear in a `finally` so it clears on ANY exit — the twin of the Apple `defer` in
+                                // `BackupSyncView.backupNow`. The flag now clears after the toast rather than before it,
+                                // which is the point: the screen stays disabled until the work is genuinely finished.
+                                try {
+                                    val ok = withContext(Dispatchers.IO) { BackupSync.backupNow(context) }
+                                    lastMs = BackupSyncPrefs.lastBackupMs(context)
+                                    Toast.makeText(
+                                        context,
+                                        if (ok) {
+                                            "Backed up to your folder."
+                                        } else {
+                                            "Backup failed - re-pick the folder and try again."
+                                        },
+                                        Toast.LENGTH_LONG,
+                                    ).show()
+                                } finally {
+                                    busy = false
+                                }
                             }
                         },
                     )

From 188bc47f372dbfb087d3bf4db85dfe2b725b7310 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 21:02:20 +1200
Subject: [PATCH 230/333] build: staging 433 / iOS 314 for the next testing
 build

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 7a35eea361..67ca57afef 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 432
+        versionCode = 433
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 5c8efc388e..3e974af961 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "313"
+    CURRENT_PROJECT_VERSION: "314"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 7e817b5eaec6026f5a16b0c608fc3c13d3200f89 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 22:21:09 +1200
Subject: [PATCH 231/333] ble: say what an unbonded strap actually costs, not
 just history sync (#1878)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every control in the Backup & Sync screen body is gated on the bond, and an
unbonded strap costs far more than the three features these lines named. A
field log showed a week of blank Recovery Vitals while both user-facing strings
pointed at buzz, alarms and history sync — none of which the user was missing.

Unbonded, only the standard 0x2A37 profile keeps streaming, which carries HR
and R-R. The proprietary notify chars require an encrypted link, so motion,
skin temperature, SpO2 and respiratory stop dead. With no motion the HR-only
stager takes over and nulls HRV and resting heart rate by construction. That is
what the user actually loses, and now what the copy says.

The suppressed-handshake hint mattered more than the detail line and was nearly
missed: on Apple pairingHint outranks the generic arm, so a suppressed strap
shows the hint and never reaches the sentence the detail returns. Fixing only
the detail would have left exactly the affected users unchanged. Both are
updated, verified byte-identical across Kotlin and Swift at 417 chars.

Existing guards preserved verbatim, so every assertion that already covered the
hint still holds: no claim of a pause, no blaming the official WHOOP app, still
says live heart rate keeps streaming, still ends on Tap Connect. New assertions
pin the added claims on both platforms so this cannot quietly regress to naming
history sync again.

The Swift literal was checked byte-identical to its catalog key, since a
mismatch there silently falls back to English in all nine locales. Neither
render truncates — no maxLines on the Android Text, no lineLimit on the Apple
one — which mattered because the strings roughly tripled in length.

Not verified on a device: this is copy in two states that need a strap in a
specific failure mode to reach.

Groundwork for #1635.
---
 Strand/BLE/BLEManager.swift                           |  2 +-
 Strand/Resources/Localizable.xcstrings                |  3 ++-
 Strand/Screens/SettingsView.swift                     |  2 +-
 StrandTests/HelloSuppressionTests.swift               |  7 +++++++
 .../src/main/java/com/noop/ble/BondRefusalGiveUp.kt   |  4 +++-
 .../app/src/main/java/com/noop/ui/SettingsLogic.kt    |  2 +-
 .../test/java/com/noop/ble/HelloSuppressionTest.kt    |  6 ++++++
 .../test/java/com/noop/ui/StrapStatusDetailTest.kt    | 11 +++++++++++
 8 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index 795c6cf472..bfe5cdae9d 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -213,7 +213,7 @@ struct BondRefusalGiveUp {
     ///
     /// Pure. Byte-identical to the Kotlin `BondRefusalGiveUp.helloSuppressedHint`.
     static func helloSuppressedHint() -> String {
-        "The secure handshake with your strap never completes, and the attempt itself is what drops the link. NOOP has switched it off for this strap so live heart rate keeps streaming. History sync stays unavailable until it pairs. Tap Connect to try the handshake again."
+        "The secure handshake with your strap never completes, and the attempt itself is what drops the link. NOOP has switched it off for this strap so live heart rate keeps streaming. History sync stays unavailable until it pairs, and so do motion, skin temperature, SpO₂ and respiratory rate — so sleep is staged from heart rate alone, and HRV and resting heart rate are unavailable. Tap Connect to try the handshake again."
     }
 
     /// The paused hint for a bond that failed WITHOUT the strap ever answering (#1635).
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 4c3978287f..2fd195771a 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -209689,7 +209689,8 @@
     "Your clock": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Deine innere Uhr"}},"es":{"stringUnit":{"state":"translated","value":"Tu reloj interno"}},"fr":{"stringUnit":{"state":"translated","value":"Votre horloge"}},"it":{"stringUnit":{"state":"translated","value":"Il tuo orologio"}},"pl":{"stringUnit":{"state":"translated","value":"Twój zegar"}},"pt-PT":{"stringUnit":{"state":"translated","value":"O seu relógio"}},"ru":{"stringUnit":{"state":"translated","value":"Ваши часы"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"你的生物钟"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"你的生理時鐘"}}}},
     "iCloud Drive": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"es":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"fr":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"it":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"pl":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"pt-PT":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"ru":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"iCloud 云盘"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"iCloud 雲碟"}}}},
     "iCloud Drive › %@": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"es":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"fr":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"it":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"pl":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"pt-PT":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"ru":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"iCloud 云盘 › %@"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"iCloud 雲碟 › %@"}}}},
-    "NOOP (in Files)": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"NOOP (in Dateien)"}},"es":{"stringUnit":{"state":"translated","value":"NOOP (en Archivos)"}},"fr":{"stringUnit":{"state":"translated","value":"NOOP (dans Fichiers)"}},"it":{"stringUnit":{"state":"translated","value":"NOOP (in File)"}},"pl":{"stringUnit":{"state":"translated","value":"NOOP (w Plikach)"}},"pt-PT":{"stringUnit":{"state":"translated","value":"NOOP (em Ficheiros)"}},"ru":{"stringUnit":{"state":"translated","value":"NOOP (в Файлах)"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"NOOP（在“文件”中）"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"NOOP（在「檔案」中）"}}}}
+    "NOOP (in Files)": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"NOOP (in Dateien)"}},"es":{"stringUnit":{"state":"translated","value":"NOOP (en Archivos)"}},"fr":{"stringUnit":{"state":"translated","value":"NOOP (dans Fichiers)"}},"it":{"stringUnit":{"state":"translated","value":"NOOP (in File)"}},"pl":{"stringUnit":{"state":"translated","value":"NOOP (w Plikach)"}},"pt-PT":{"stringUnit":{"state":"translated","value":"NOOP (em Ficheiros)"}},"ru":{"stringUnit":{"state":"translated","value":"NOOP (в Файлах)"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"NOOP（在“文件”中）"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"NOOP（在「檔案」中）"}}}},
+    "Live heart rate is streaming, but your strap is not fully paired. The encrypted pairing is what carries motion, skin temperature, SpO₂ and respiratory rate — without it, sleep is staged from heart rate alone, and HRV and resting heart rate are unavailable. Buzz, alarms and history sync need it too.": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Die Live-Herzfrequenz wird übertragen, aber dein Strap ist nicht vollständig gekoppelt. Die verschlüsselte Kopplung liefert Bewegung, Hauttemperatur, SpO₂ und Atemfrequenz — ohne sie wird der Schlaf allein aus der Herzfrequenz abgeleitet, und Herzfrequenzvariabilität und Ruheherzfrequenz sind nicht verfügbar. Auch Buzz, Wecker und Verlaufssynchronisierung brauchen sie."}},"es":{"stringUnit":{"state":"translated","value":"La frecuencia cardíaca en vivo se está transmitiendo, pero tu correa no está totalmente emparejada. El emparejamiento cifrado es el que aporta movimiento, temperatura de la piel, SpO₂ y frecuencia respiratoria: sin él, el sueño se calcula solo a partir de la frecuencia cardíaca, y la variabilidad de la frecuencia cardíaca y la frecuencia cardíaca en reposo no están disponibles. El zumbido, las alarmas y la sincronización del historial también lo necesitan."}},"fr":{"stringUnit":{"state":"translated","value":"La fréquence cardiaque en direct est transmise, mais votre bracelet n'est pas entièrement appairé. C'est l'appairage chiffré qui transporte le mouvement, la température cutanée, la SpO₂ et la fréquence respiratoire — sans lui, le sommeil est estimé à partir de la seule fréquence cardiaque, et la variabilité de la fréquence cardiaque et la fréquence cardiaque au repos sont indisponibles. Le buzz, les alarmes et la synchronisation de l'historique en ont besoin aussi."}},"it":{"stringUnit":{"state":"translated","value":"La frequenza cardiaca live viene trasmessa, ma il tuo strap non è completamente associato. È l'associazione cifrata a trasportare movimento, temperatura della pelle, SpO₂ e frequenza respiratoria — senza di essa il sonno viene stimato dalla sola frequenza cardiaca, e variabilità della frequenza cardiaca e frequenza cardiaca a riposo non sono disponibili. Anche buzz, sveglie e sincronizzazione della cronologia ne hanno bisogno."}},"pl":{"stringUnit":{"state":"translated","value":"Tętno na żywo jest przesyłane, ale opaska nie jest w pełni sparowana. To szyfrowane parowanie przenosi ruch, temperaturę skóry, SpO₂ i częstość oddechów — bez niego sen jest wyznaczany wyłącznie z tętna, a zmienność rytmu serca i tętno spoczynkowe są niedostępne. Wibracje, alarmy i synchronizacja historii też go wymagają."}},"pt-PT":{"stringUnit":{"state":"translated","value":"A frequência cardíaca em direto está a ser transmitida, mas a sua pulseira não está totalmente emparelhada. É o emparelhamento encriptado que transporta movimento, temperatura da pele, SpO₂ e taxa respiratória — sem ele, o sono é calculado apenas a partir da frequência cardíaca, e a variabilidade da frequência cardíaca e a frequência cardíaca em repouso ficam indisponíveis. O zumbido, os alarmes e a sincronização do histórico também precisam dele."}},"ru":{"stringUnit":{"state":"translated","value":"Пульс передаётся в реальном времени, но ремешок сопряжён не полностью. Именно зашифрованное сопряжение передаёт движение, температуру кожи, SpO₂ и частоту дыхания — без него сон определяется только по пульсу, а вариабельность сердечного ритма и пульс в покое недоступны. Вибрация, будильники и синхронизация истории тоже требуют его."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"实时心率正在传输，但你的手环尚未完全配对。加密配对才能传输动作、皮肤温度、SpO₂ 和呼吸频率——没有它，睡眠只能依据心率推算，心率变异性和静息心率将不可用。震动、闹钟和历史同步同样需要它。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"即時心率正在傳輸，但你的手環尚未完全配對。加密配對才能傳輸動作、皮膚溫度、SpO₂ 和呼吸頻率——沒有它，睡眠只能依據心率推算，心率變異性和靜息心率將不可用。震動、鬧鐘和歷史同步同樣需要它。"}}}}
   },
   "version": "1.0"
 }
diff --git a/Strand/Screens/SettingsView.swift b/Strand/Screens/SettingsView.swift
index da168d6676..ab8f9defc0 100644
--- a/Strand/Screens/SettingsView.swift
+++ b/Strand/Screens/SettingsView.swift
@@ -1563,7 +1563,7 @@ struct SettingsView: View {
         // Live HR over the UNBONDED standard profile (#69). True whenever the handshake is suppressed or
         // simply has not landed, and the honest description either way.
         if live.bonded && live.connected {
-            return String(localized: "Live heart rate is streaming, but your strap is not fully paired. Buzz, alarms and history sync need the encrypted pairing.")
+            return String(localized: "Live heart rate is streaming, but your strap is not fully paired. The encrypted pairing is what carries motion, skin temperature, SpO₂ and respiratory rate — without it, sleep is staged from heart rate alone, and HRV and resting heart rate are unavailable. Buzz, alarms and history sync need it too.")
         }
         if live.connected { return String(localized: "Connected. Finishing the secure pairing handshake…") }
         if live.bonded { return String(localized: "Previously paired but not currently connected. Re-scan to reconnect.") }
diff --git a/StrandTests/HelloSuppressionTests.swift b/StrandTests/HelloSuppressionTests.swift
index 34525b0283..57e798fc2b 100644
--- a/StrandTests/HelloSuppressionTests.swift
+++ b/StrandTests/HelloSuppressionTests.swift
@@ -115,6 +115,13 @@ final class HelloSuppressionTests: XCTestCase {
         XCTAssertTrue(hint.contains("live heart rate keeps streaming"))
         XCTAssertTrue(hint.contains("History sync stays unavailable"))
         XCTAssertTrue(hint.contains("Tap Connect"))
+        // The hint must name what an unbonded strap actually costs, not just history sync: motion,
+        // skin temperature, SpO2 and respiratory stop, so sleep falls to the HR-only stager and HRV
+        // + resting HR are nulled. A field log showed a week of blank Recovery Vitals under the old
+        // wording, which pointed only at a feature the user was not missing.
+        XCTAssertTrue(hint.contains("motion"))
+        XCTAssertTrue(hint.contains("HRV"))
+        XCTAssertTrue(hint.contains("resting heart rate"))
         XCTAssertFalse(hint.lowercased().contains("paused"))
         XCTAssertFalse(hint.lowercased().contains("stopped retrying"))
     }
diff --git a/android/app/src/main/java/com/noop/ble/BondRefusalGiveUp.kt b/android/app/src/main/java/com/noop/ble/BondRefusalGiveUp.kt
index 874b8e600d..7c0b93b9c8 100644
--- a/android/app/src/main/java/com/noop/ble/BondRefusalGiveUp.kt
+++ b/android/app/src/main/java/com/noop/ble/BondRefusalGiveUp.kt
@@ -99,7 +99,9 @@ class BondRefusalGiveUp(
         fun helloSuppressedHint(): String =
             "The secure handshake with your strap never completes, and the attempt itself is what drops " +
                 "the link. NOOP has switched it off for this strap so live heart rate keeps streaming. " +
-                "History sync stays unavailable until it pairs. Tap Connect to try the handshake again."
+                "History sync stays unavailable until it pairs, and so do motion, skin temperature, " +
+                "SpO₂ and respiratory rate — so sleep is staged from heart rate alone, and HRV and " +
+                "resting heart rate are unavailable. Tap Connect to try the handshake again."
 
         /**
          * #1635: the log epitaph for the suppression path.
diff --git a/android/app/src/main/java/com/noop/ui/SettingsLogic.kt b/android/app/src/main/java/com/noop/ui/SettingsLogic.kt
index 584370da85..cc7c78b3e8 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsLogic.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsLogic.kt
@@ -69,7 +69,7 @@ internal fun strapStatusDetail(
 ): String = when {
     scanning -> "Searching for your WHOOP… make sure it's charged, on your wrist, and the official WHOOP app isn't connected to it."
     encryptedBond && connected -> "Your strap is paired and sending data. Open Live for a real-time heart rate."
-    bonded && connected -> "Live heart rate is streaming, but your strap is not fully paired. Buzz, alarms and history sync need the encrypted pairing."
+    bonded && connected -> "Live heart rate is streaming, but your strap is not fully paired. The encrypted pairing is what carries motion, skin temperature, SpO₂ and respiratory rate — without it, sleep is staged from heart rate alone, and HRV and resting heart rate are unavailable. Buzz, alarms and history sync need it too."
     connected -> "Connected. Finishing the secure pairing handshake…"
     bonded -> "Previously paired but not currently connected. Re-scan to reconnect."
     else -> "No strap connected. Put your WHOOP nearby and tap Re-scan to pair."
diff --git a/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt b/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
index c3fbdb3c79..63eb8a6339 100644
--- a/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
+++ b/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
@@ -128,6 +128,12 @@ class HelloSuppressionTest {
         assertFalse(hint.contains("paus", ignoreCase = true))
         assertFalse(hint.contains("WHOOP app", ignoreCase = true))
         assertTrue(hint.contains("Connect"))
+        // #1635 field log: a week of blank Recovery Vitals while this hint named only history sync.
+        // Unbonded, the strap also stops sending motion / skin temperature / SpO2 / respiratory, which
+        // drops sleep onto the HR-only stager and blanks HRV + resting HR by construction.
+        assertTrue(hint.contains("motion"))
+        assertTrue(hint.contains("HRV"))
+        assertTrue(hint.contains("resting heart rate"))
         val epitaph = BondRefusalGiveUp.helloSuppressedEpitaph(5, "abcd1234")
         assertFalse(epitaph.contains("held by", ignoreCase = true))
         assertTrue(epitaph.contains("abcd1234"))
diff --git a/android/app/src/test/java/com/noop/ui/StrapStatusDetailTest.kt b/android/app/src/test/java/com/noop/ui/StrapStatusDetailTest.kt
index 21bf003414..ebd0c1fa33 100644
--- a/android/app/src/test/java/com/noop/ui/StrapStatusDetailTest.kt
+++ b/android/app/src/test/java/com/noop/ui/StrapStatusDetailTest.kt
@@ -57,6 +57,17 @@ class StrapStatusDetailTest {
         assertFalse(detail.contains("is paired"))
         assertTrue(detail.contains("not fully paired"))
 
+        // The consequences, not just the state. This line used to name only buzz, alarms and history
+        // sync — but an unbonded strap also stops sending motion, skin temperature, SpO2 and
+        // respiratory rate, which drops sleep onto the HR-only stager and blanks HRV + resting HR
+        // (AnalyticsEngine gates both on `!hrOnly`). A field log showed a week of blank Recovery
+        // Vitals while this line pointed at three features the user was not missing.
+        assertTrue(detail.contains("motion"))
+        assertTrue(detail.contains("HRV"))
+        assertTrue(detail.contains("resting heart rate"))
+        // The original claim has to survive the rewrite.
+        assertTrue(detail.contains("history sync"))
+
         assertEquals("Live HR (not fully paired)",
             strapStatusTitle(encryptedBond = false, bonded = true, connected = true))
         assertEquals("Bonded · streaming",

From a7f24db78489e45fc2b495f02cb0f13db3817aad Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 22:25:33 +1200
Subject: [PATCH 232/333] today: say why Recovery Vitals is blank on a night
 with no motion (#1879)

From a screenshot: HRV and resting heart rate reading No data while breaths per
minute sat under them at 13.3 rpm, same card, same night. Nothing was broken.
With no motion banked the HR-only spine stages the night and builds its sessions
with restingHR and avgHRV null on purpose, because bounds inferred from heart
rate alone are not firm enough to hang a resting HR or a nightly RMSSD on.
AnalyticsEngine gates exactly those two on !hrOnly, while respiratory survives
as an RSA estimate off R-R. Every number was correct and the card could not say
so, which reads as a failed sync.

The flag is recorded where the condition is evaluated - the same expression that
empties the two fields - rather than re-derived in the UI, so the explanation
cannot disagree with the values it explains.

sleepHrOnly lands on BOTH platforms: Room MIGRATION_35_36 and the GRDB twin
v42-daily-sleep-hr-only, with the shared oracle updated in both copies.
sleepSession.stagingSparse set that precedent and carries no divergence marker;
an Android-only column would have added a row to the drift list #775 exists to
shrink. Apple computes and stores it too - it already had the identical gate, so
it nulls the same vitals on the same nights and simply never recorded why. Only
the Apple CARD is still unwired, which is UI and platform-specific by contract.

Nullable, no default, no backfill: rows scored before v36 stay null and read as
"not known". Defaulting to 0 would assert "this night had motion" about every
historical night, the exact false reassurance the column removes.

Re-review across four rounds found five persistence-side defects, none of them
visible to a compiler because each was a field nobody mentioned: a 23-column
insert against 22 placeholders; a GRDB migration registered in code but absent
from the oracle's roster (caught by CI, not by me); four struct-rebuild seams
where a Swift column is dropped by omission, one of them on the persistence path
so the writer would have been inert; and a fifth seam, coalesceDay, where the
flag belongs to the sleep GROUP - with the Kotlin twin quietly inheriting the
winner's value while the stage figures came from the filler.

Verified: 630 classes / 5174 tests / 0 failures freshly rerun, schema oracle and
migration chain green, all three version numbers agreeing, lintVitalFullRelease
-PstagingRelease clean, and Swift Packages CI green including test (WhoopStore)
and test (StrandAnalytics).

Not verified on a device: nobody has seen the note render.

Groundwork for #1801.
---
 .../StrandAnalytics/AnalyticsEngine.swift     |  8 ++-
 .../Sources/WhoopStore/Database.swift         | 10 ++++
 .../Sources/WhoopStore/MetricsCache.swift     | 20 +++++---
 .../Resources/schema_oracle.json              | 15 +++++-
 Strand/Data/IntelligenceEngine.swift          |  5 +-
 Strand/Data/Repository.swift                  | 17 +++++--
 .../DailySkinTempAbsoluteCarryTests.swift     | 51 +++++++++++++++++++
 .../com/noop/analytics/AnalyticsEngine.kt     |  5 ++
 .../src/main/java/com/noop/data/Entities.kt   |  9 ++++
 .../main/java/com/noop/data/WhoopDatabase.kt  | 26 ++++++++--
 .../java/com/noop/data/WhoopRepository.kt     |  4 ++
 .../src/main/java/com/noop/ui/TodayScreen.kt  | 35 +++++++++++++
 .../app/src/main/res/values-de/strings.xml    |  1 +
 .../app/src/main/res/values-es/strings.xml    |  1 +
 .../app/src/main/res/values-fr/strings.xml    |  1 +
 .../app/src/main/res/values-pl/strings.xml    |  1 +
 .../src/main/res/values-pt-rPT/strings.xml    |  1 +
 .../app/src/main/res/values-ru/strings.xml    |  1 +
 .../app/src/main/res/values-zh/strings.xml    |  1 +
 android/app/src/main/res/values/strings.xml   |  1 +
 .../data/DailySkinTempAbsoluteCarryTest.kt    | 24 +++++++++
 .../data/DailySleepHrOnlyMigrationTest.kt     | 47 +++++++++++++++++
 .../test/java/com/noop/ui/HrOnlyNoteTest.kt   | 49 ++++++++++++++++++
 .../app/src/test/resources/schema_oracle.json | 15 +++++-
 24 files changed, 328 insertions(+), 20 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/data/DailySleepHrOnlyMigrationTest.kt
 create mode 100644 android/app/src/test/java/com/noop/ui/HrOnlyNoteTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
index 1bb7afc133..9177dd4885 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
@@ -950,7 +950,13 @@ public enum AnalyticsEngine {
             // The ABSOLUTE this pass's deviation was derived from (#1636). Set HERE, beside
             // `skinTempDevC`, so the engine's own row is symmetric: any path that persists this
             // struct directly keeps both thermal values, not just the one.
-            skinTempC: nightlySkinTempC)
+            skinTempC: nightlySkinTempC,
+            // The SAME condition that emptied `restingHr` and `avgHrv` above: `physiologySessions` is
+            // `matched` minus the HR-only ones, so an all-HR-only night leaves it empty and both vitals
+            // nil. Recorded rather than re-derived downstream, so the explanation and the values it
+            // explains cannot disagree. Byte-identical twin of Kotlin `AnalyticsEngine`'s
+            // `sleepHrOnly = if (matched.isEmpty()) null else physiologySessions.isEmpty()`.
+            sleepHrOnly: matched.isEmpty ? nil : physiologySessions.isEmpty)
         _ = sleepStart; _ = sleepEnd  // available for callers wiring sleep_start/end columns
 
         // ── Cache rows ────────────────────────────────────────────────────────
diff --git a/Packages/WhoopStore/Sources/WhoopStore/Database.swift b/Packages/WhoopStore/Sources/WhoopStore/Database.swift
index b43dc9cb1f..01f4df2af0 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/Database.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/Database.swift
@@ -883,6 +883,16 @@ extension WhoopStore {
         migrator.registerMigration("v41-drop-raw-imu-sample") { db in
             try db.drop(table: "rawImuSample")
         }
+        // Whether every sleep session that day was staged from heart rate alone (#1801). The Kotlin twin
+        // is `DailyMetric.sleepHrOnly`, added by Room MIGRATION_35_36; the shared schema oracle pins the
+        // two shapes together, so this exists here even while only Android reads it — a column present on
+        // one side and absent on the other is the drift #775 tracks, and stagingSparse set the precedent
+        // for carrying a staging-quality flag on both.
+        migrator.registerMigration("v42-daily-sleep-hr-only") { db in
+            try db.alter(table: "dailyMetric") { t in
+                t.add(column: "sleepHrOnly", .boolean)
+            }
+        }
         return migrator
     }
 }
diff --git a/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift b/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift
index 96da2d1c62..e3d980683b 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift
@@ -105,13 +105,16 @@ public struct DailyMetric: Equatable, Codable {
     /// that column and `SkinTempDisplay.isAbsoluteSkinTemp` separates them by magnitude. This column is
     /// unambiguous: it is always an absolute, and only the strap pipeline writes it.
     public let skinTempC: Double?
+    /// Kotlin twin: `DailyMetric.sleepHrOnly`. Every session that night staged from heart rate alone.
+    public let sleepHrOnly: Bool?
     public init(day: String, totalSleepMin: Double?, efficiency: Double?, deepMin: Double?,
                 remMin: Double?, lightMin: Double?, disturbances: Int?, restingHr: Int?,
                 avgHrv: Double?, recovery: Double?, strain: Double?, exerciseCount: Int?,
                 spo2Pct: Double? = nil, skinTempDevC: Double? = nil, respRateBpm: Double? = nil,
                 steps: Int? = nil, activeKcalEst: Double? = nil,
                 spo2Red: Int? = nil, spo2Ir: Int? = nil, avgSdnn: Double? = nil,
-                skinTempC: Double? = nil) {
+                skinTempC: Double? = nil,
+                sleepHrOnly: Bool? = nil) {
         self.day = day; self.totalSleepMin = totalSleepMin; self.efficiency = efficiency
         self.deepMin = deepMin; self.remMin = remMin; self.lightMin = lightMin
         self.disturbances = disturbances; self.restingHr = restingHr; self.avgHrv = avgHrv
@@ -120,6 +123,7 @@ public struct DailyMetric: Equatable, Codable {
         self.steps = steps; self.activeKcalEst = activeKcalEst
         self.spo2Red = spo2Red; self.spo2Ir = spo2Ir; self.avgSdnn = avgSdnn
         self.skinTempC = skinTempC
+        self.sleepHrOnly = sleepHrOnly
     }
 
     /// The freshest STRICTLY-PRIOR day that carries at least one overnight vital (HRV / resting HR /
@@ -465,8 +469,8 @@ extension WhoopStore {
                     (deviceId, day, totalSleepMin, efficiency, deepMin, remMin, lightMin,
                      disturbances, restingHr, avgHrv, recovery, strain, exerciseCount,
                      spo2Pct, skinTempDevC, respRateBpm, steps, activeKcalEst,
-                     spo2Red, spo2Ir, avgSdnn, skinTempC)
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+                     spo2Red, spo2Ir, avgSdnn, skinTempC, sleepHrOnly)
+                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
                 ON CONFLICT(deviceId, day) DO UPDATE SET
                     totalSleepMin = excluded.totalSleepMin,
                     efficiency = excluded.efficiency,
@@ -487,13 +491,14 @@ extension WhoopStore {
                     spo2Red = excluded.spo2Red,
                     spo2Ir = excluded.spo2Ir,
                     avgSdnn = excluded.avgSdnn,
-                    skinTempC = excluded.skinTempC
+                    skinTempC = excluded.skinTempC,
+                    sleepHrOnly = excluded.sleepHrOnly
                 """, arguments: [deviceId, d.day, d.totalSleepMin, d.efficiency, d.deepMin,
                                  d.remMin, d.lightMin, d.disturbances, d.restingHr, d.avgHrv,
                                  d.recovery, d.strain, d.exerciseCount,
                                  d.spo2Pct, d.skinTempDevC, d.respRateBpm,
                                  d.steps, d.activeKcalEst,
-                                 d.spo2Red, d.spo2Ir, d.avgSdnn, d.skinTempC])
+                                 d.spo2Red, d.spo2Ir, d.avgSdnn, d.skinTempC, d.sleepHrOnly])
             n += db.changesCount
         }
         return n
@@ -544,7 +549,7 @@ extension WhoopStore {
                 SELECT day, totalSleepMin, efficiency, deepMin, remMin, lightMin, disturbances,
                        restingHr, avgHrv, recovery, strain, exerciseCount,
                        spo2Pct, skinTempDevC, respRateBpm, steps, activeKcalEst,
-                       spo2Red, spo2Ir, avgSdnn, skinTempC FROM dailyMetric
+                       spo2Red, spo2Ir, avgSdnn, skinTempC, sleepHrOnly FROM dailyMetric
                 WHERE deviceId = ? AND day >= ? AND day <= ?
                 ORDER BY day ASC
                 """, arguments: [deviceId, from, to])
@@ -559,7 +564,8 @@ extension WhoopStore {
                                 respRateBpm: $0["respRateBpm"],
                                 steps: $0["steps"], activeKcalEst: $0["activeKcalEst"],
                                 spo2Red: $0["spo2Red"], spo2Ir: $0["spo2Ir"], avgSdnn: $0["avgSdnn"],
-                                skinTempC: $0["skinTempC"])
+                                skinTempC: $0["skinTempC"],
+                                sleepHrOnly: $0["sleepHrOnly"])
                 }
         }
     }
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json b/Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json
index b28e537ed7..abd475513e 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json
@@ -1,6 +1,6 @@
 {
   "_readme": "SHARED Room<->GRDB SCHEMA ORACLE (#775). Two byte-identical copies: Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json and android/app/src/test/resources/schema_oracle.json. SchemaOracleTests.swift compares GRDB's PRAGMA table_info/index_list against it; SchemaOracleTest.kt compares Room's exported schema JSON against it. `columns` is the iOS/GRDB shape in GRDB column order (macOS is the reference implementation); every way Android differs is spelled out in an `android` / `iosAbsent` / `androidColumnOrder` override naming a key in `divergenceReasons`. Adding a column, reordering one, or changing a type/nullability on one platform only fails both suites until it is either fixed or written down here.",
-  "roomVersion": 35,
+  "roomVersion": 36,
   "grdbMigrations": [
     "v1",
     "v2",
@@ -42,7 +42,8 @@
     "v38-apple-step-hour",
     "v39-ppg-burst-index",
     "v40-daily-skin-temp-absolute",
-    "v41-drop-raw-imu-sample"
+    "v41-drop-raw-imu-sample",
+    "v42-daily-sleep-hr-only"
   ],
   "divergenceReasons": {
     "android-orphan-synced-column": "REAL COLUMN DRIFT: `synced` exists on Android only. GRDB's v10 note is explicit that stepSample gets no `synced` column ('unused; see StreamStore'), and v12's ppgHrSample never had one either; the Room entities copied the flag from the older per-second entities. Nothing reads it on Android — the per-row upload flag belongs to an upload path that does not exist there — so it is dead width, not divergent data. Removing it needs a Room table rebuild.",
@@ -372,6 +373,16 @@
           "affinity": "REAL",
           "notNull": false,
           "default": null
+        },
+        {
+          "name": "sleepHrOnly",
+          "affinity": "NUMERIC",
+          "notNull": false,
+          "default": null,
+          "android": {
+            "affinity": "INTEGER"
+          },
+          "divergence": "grdb-boolean-affinity"
         }
       ],
       "primaryKey": [
diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index 495e6e43ca..f0e1d96dae 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -2915,7 +2915,8 @@ extension DailyMetric {
                     avgHrv: avgHrv, recovery: r, strain: strain, exerciseCount: exerciseCount,
                     spo2Pct: spo2Pct, skinTempDevC: sd, respRateBpm: respRateBpm,
                     steps: steps, activeKcalEst: activeKcalEst,
-                    spo2Red: spo2Red, spo2Ir: spo2Ir, avgSdnn: avgSdnn, skinTempC: sa)
+                    spo2Red: spo2Red, spo2Ir: spo2Ir, avgSdnn: avgSdnn, skinTempC: sa,
+                    sleepHrOnly: sleepHrOnly)
     }
 
     /// Rebuild with substituted sleep-derived fields (a user-corrected wake window), leaving every
@@ -2927,7 +2928,7 @@ extension DailyMetric {
                     strain: strain, exerciseCount: exerciseCount, spo2Pct: spo2Pct,
                     skinTempDevC: skinTempDevC, respRateBpm: respRateBpm, steps: steps,
                     activeKcalEst: activeKcalEst, spo2Red: spo2Red, spo2Ir: spo2Ir, avgSdnn: avgSdnn,
-                    skinTempC: skinTempC)
+                    skinTempC: skinTempC, sleepHrOnly: sleepHrOnly)
     }
 }
 
diff --git a/Strand/Data/Repository.swift b/Strand/Data/Repository.swift
index 56a5de5612..b81266c006 100644
--- a/Strand/Data/Repository.swift
+++ b/Strand/Data/Repository.swift
@@ -403,7 +403,11 @@ final class Repository: ObservableObject {
             spo2Ir: rawSpo2FromFiller ? filler.spo2Ir : winner.spo2Ir,
             // Strap-only, like raw SpO2: an imported winner carries no absolute skin temp, so take the
             // filler's rather than let the union blank a value the strap did record (#1636).
-            skinTempC: winner.skinTempC ?? filler.skinTempC
+            skinTempC: winner.skinTempC ?? filler.skinTempC,
+            // Part of the SLEEP GROUP, not an independent column (#1801): it describes how the stage
+            // figures above were derived, so it has to come from whichever row supplied them. A plain
+            // `winner ?? filler` would caption the winner's own hypnogram with the filler's staging.
+            sleepHrOnly: sleepFromFiller ? filler.sleepHrOnly : winner.sleepHrOnly
         )
     }
 
@@ -3238,7 +3242,10 @@ private extension DailyMetric {
             avgSdnn: avgSdnn ?? fallback.avgSdnn,
             // On-device only (imports never carry it), so an imported row's nil is backfilled from the
             // computed fallback — otherwise the night's absolute would be lost. (#1636)
-            skinTempC: skinTempC ?? fallback.skinTempC
+            skinTempC: skinTempC ?? fallback.skinTempC,
+            // Same shape, same reason (#1801): only a scoring pass knows how the night was staged, so an
+            // imported row's nil takes the computed answer rather than erasing it.
+            sleepHrOnly: sleepHrOnly ?? fallback.sleepHrOnly
         )
     }
 
@@ -3268,7 +3275,11 @@ private extension DailyMetric {
             spo2Red: spo2Red,   // non-sleep field: preserved as-is (#93)
             spo2Ir: spo2Ir,
             avgSdnn: avgSdnn,   // non-sleep (HRV) field: preserved as-is
-            skinTempC: skinTempC // non-sleep (thermal) field: preserved as-is (#1636)
+            skinTempC: skinTempC, // non-sleep (thermal) field: preserved as-is (#1636)
+            // MOVES with the sleep columns, unlike the others here: it describes how the very stage
+            // figures being taken were derived, so leaving `self`'s behind would caption the source's
+            // hypnogram with the import's staging — and an import's is always nil. (#1801)
+            sleepHrOnly: source.sleepHrOnly
         )
     }
 }
diff --git a/StrandTests/DailySkinTempAbsoluteCarryTests.swift b/StrandTests/DailySkinTempAbsoluteCarryTests.swift
index 7c2c3f415c..099cb2606a 100644
--- a/StrandTests/DailySkinTempAbsoluteCarryTests.swift
+++ b/StrandTests/DailySkinTempAbsoluteCarryTests.swift
@@ -72,4 +72,55 @@ final class DailySkinTempAbsoluteCarryTests: XCTestCase {
         XCTAssertEqual(try XCTUnwrap(scored.skinTempDevC), 0.52, accuracy: 0.001)
         XCTAssertEqual(try XCTUnwrap(scored.recovery), 0.71, accuracy: 0.001)
     }
+
+    // MARK: - The same four seams, for the HR-only staging flag (#1801)
+
+    /// `sleepHrOnly` rides the identical rebuild path as the absolute above, and the struct has no
+    /// `copy()` — every seam respells the field list, so a new column is dropped by omission rather than
+    /// by error. These four are that column's version of the tests above.
+
+    func testScoringKeepsTheStagingFlag() throws {
+        let scored = row(skinTempC: 34.6).with(recovery: 0.71, skinTempDevC: 0.52, skinTempC: 34.6)
+        XCTAssertNil(scored.sleepHrOnly, "a row that never carried the flag must not invent one")
+        let hrOnly = DailyMetric(day: "2026-09-03", sleepHrOnly: true)
+            .with(recovery: 0.71, skinTempDevC: nil, skinTempC: nil)
+        XCTAssertEqual(hrOnly.sleepHrOnly, true, "scoring must not discard how the night was staged")
+    }
+
+    func testASleepEditKeepsTheStagingFlag() {
+        let edited = DailyMetric(day: "2026-09-03", sleepHrOnly: true)
+            .with(totalSleepMin: 400, efficiency: 0.93, deepMin: 80, remMin: 100, lightMin: 220)
+        // Correcting the wake window does not change whether the strap banked any motion.
+        XCTAssertEqual(edited.sleepHrOnly, true)
+    }
+
+    func testAnImportedRowTakesTheComputedStagingFlag() {
+        let imported = DailyMetric(day: "2026-09-03")
+        let computed = DailyMetric(day: "2026-09-03", sleepHrOnly: true)
+        XCTAssertEqual(imported.fillingNilFields(from: computed).sleepHrOnly, true,
+                       "only a scoring pass knows the staging; an import's nil must not erase it")
+    }
+
+    func testTheFlagMovesWithTheSleepColumnsItDescribes() {
+        let importRow = DailyMetric(day: "2026-09-03", totalSleepMin: 300)
+        let editedComputed = DailyMetric(day: "2026-09-03", totalSleepMin: 400, sleepHrOnly: true)
+        let merged = importRow.takingSleepFields(from: editedComputed)
+        XCTAssertEqual(merged.totalSleepMin, 400)
+        // The flag describes THOSE stage figures, so it travels with them rather than staying behind.
+        XCTAssertEqual(merged.sleepHrOnly, true)
+    }
+
+    /// The Swift twin of the Kotlin coalesce cases: the flag belongs to the sleep GROUP.
+    func testTheStagingFlagMovesWithTheSleepBlock() {
+        let winner = DailyMetric(day: "2026-09-03", restingHr: 55)
+        let filler = DailyMetric(day: "2026-09-03", totalSleepMin: 400, deepMin: 39,
+                                 remMin: 54, lightMin: 57, sleepHrOnly: true)
+        XCTAssertEqual(Repository.coalesceDay(winner, filler).sleepHrOnly, true)
+    }
+
+    func testAWinnerThatOwnsTheSleepBlockKeepsItsOwnStagingFlag() {
+        let winner = DailyMetric(day: "2026-09-03", totalSleepMin: 420, deepMin: 90, sleepHrOnly: false)
+        let filler = DailyMetric(day: "2026-09-03", totalSleepMin: 300, sleepHrOnly: true)
+        XCTAssertEqual(Repository.coalesceDay(winner, filler).sleepHrOnly, false)
+    }
 }
diff --git a/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt b/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
index 9082479b7a..3d7dcccc7f 100644
--- a/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
@@ -870,6 +870,11 @@ object AnalyticsEngine {
             disturbances = if (matched.isEmpty()) null else disturbances,
             restingHr = restingHRDaily,
             avgHrv = avgHRVDaily,
+            // The SAME condition that just emptied the two fields above: `physiologySessions` is
+            // `matched` minus the HR-only ones, so an all-HR-only night leaves it empty and both vitals
+            // null. Recording it here rather than re-deriving in the UI keeps the explanation and the
+            // cause as one expression — a second definition could disagree with the values it explains.
+            sleepHrOnly = if (matched.isEmpty()) null else physiologySessions.isEmpty(),
             recovery = recovery,
             strain = strain,
             exerciseCount = workouts.size,
diff --git a/android/app/src/main/java/com/noop/data/Entities.kt b/android/app/src/main/java/com/noop/data/Entities.kt
index 9e4bcfad05..8ae6c03c17 100644
--- a/android/app/src/main/java/com/noop/data/Entities.kt
+++ b/android/app/src/main/java/com/noop/data/Entities.kt
@@ -329,6 +329,15 @@ data class DailyMetric(
     // one is unambiguous: always absolute, and only the strap pipeline writes it. Nullable: nights scored
     // before v34 stay null until a re-score re-derives them from the same raw samples.
     val skinTempC: Double? = null,
+    // Whether EVERY sleep session this day was staged from heart rate alone, with no motion to work from
+    // (#1801). The two vitals below it are not missing by accident on such a night: the HR-only spine
+    // constructs its sessions with restingHR and avgHRV null on purpose, because sleep bounds inferred
+    // from heart rate are not firm enough to hang a resting HR or a nightly RMSSD on, and AnalyticsEngine
+    // then gates both on `!hrOnly`. Persisted so the card can say WHICH of those it is — a blank next to
+    // a populated respiratory rate reads as a sync failure, and a field log showed a week of exactly that
+    // misreading. Appended LAST so the column order matches the Room CREATE TABLE and the Swift row.
+    // Null on every row scored before v36 and on any day with no sleep at all.
+    val sleepHrOnly: Boolean? = null,
 )
 
 /**
diff --git a/android/app/src/main/java/com/noop/data/WhoopDatabase.kt b/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
index ced37f86e0..23e13d2115 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
@@ -53,7 +53,7 @@ import androidx.sqlite.db.SupportSQLiteDatabase
         V18AuxSampleEntity::class,
         AppleStepHour::class,
     ],
-    version = 35,
+    version = 36,
     // #775: ON so Room's KSP processor writes the generated schema (every table's exact `CREATE TABLE`,
     // columns in declaration order with affinity/NOT NULL/default, PK and indices) as JSON. That export
     // is what lets a plain JVM test — no device, no Robolectric — read Android's REAL schema and compare
@@ -73,7 +73,7 @@ abstract class WhoopDatabase : RoomDatabase() {
         const val DB_NAME = "noop_whoop.db"
         /** Room schema version — MUST equal the `@Database(version = …)` above. Surfaced in the backup
          *  manifest (#1410) so an export states its schema. Bump both together on a migration. */
-        const val SCHEMA_VERSION = 35
+        const val SCHEMA_VERSION = 36
 
         @Volatile
         private var instance: WhoopDatabase? = null
@@ -927,6 +927,26 @@ abstract class WhoopDatabase : RoomDatabase() {
             override fun migrate(db: SupportSQLiteDatabase) { db.execSQL("DROP TABLE IF EXISTS `rawImuSample`") }
         }
 
+        /**
+         * v35 -> v36: ADDITIVE, adds `dailyMetric.sleepHrOnly` (nullable INTEGER) so the Recovery Vitals
+         * card can say why HRV and resting HR are blank on a night staged from heart rate alone, rather
+         * than showing a bare "No data" that is indistinguishable from a failed sync (#1801). Nullable
+         * with no default and no backfill: existing rows stay null and read as "not known", which is
+         * honest — the flag is only knowable from a re-score, and a re-score writes it.
+         *
+         * Exposed as a constant so the migration test can pin its SHAPE without Room-testing, the same
+         * way [DAILY_SKIN_TEMP_ABSOLUTE_MIGRATION_SQL] is.
+         */
+        internal val DAILY_SLEEP_HR_ONLY_MIGRATION_SQL: List<String> = listOf(
+            "ALTER TABLE `dailyMetric` ADD COLUMN `sleepHrOnly` INTEGER",
+        )
+
+        internal val MIGRATION_35_36 = object : Migration(35, 36) {
+            override fun migrate(db: SupportSQLiteDatabase) {
+                for (stmt in DAILY_SLEEP_HR_ONLY_MIGRATION_SQL) db.execSQL(stmt)
+            }
+        }
+
         /**
          * Every migration the builder registers, as a VALUE rather than an argument list.
          *
@@ -952,7 +972,7 @@ abstract class WhoopDatabase : RoomDatabase() {
             MIGRATION_18_19, MIGRATION_19_20, MIGRATION_20_21, MIGRATION_21_22,
             MIGRATION_22_23, MIGRATION_23_24, MIGRATION_24_25, MIGRATION_25_26,
             MIGRATION_26_27, MIGRATION_27_28, MIGRATION_28_29, MIGRATION_29_30,
-            MIGRATION_30_31, MIGRATION_31_32, MIGRATION_32_33, MIGRATION_33_34, MIGRATION_34_35,
+            MIGRATION_30_31, MIGRATION_31_32, MIGRATION_32_33, MIGRATION_33_34, MIGRATION_34_35, MIGRATION_35_36,
         )
 
 
diff --git a/android/app/src/main/java/com/noop/data/WhoopRepository.kt b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
index 3e7af70938..e968eef4e1 100644
--- a/android/app/src/main/java/com/noop/data/WhoopRepository.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
@@ -2382,6 +2382,10 @@ class WhoopRepository(
                 remMin = if (sleepFromFiller) filler.remMin else winner.remMin,
                 lightMin = if (sleepFromFiller) filler.lightMin else winner.lightMin,
                 disturbances = if (sleepFromFiller) filler.disturbances else winner.disturbances,
+                // Part of the SLEEP GROUP (#1801): it describes how the stage figures above were derived,
+                // so it moves with them. `copy()` would leave the WINNER's flag in place while the stages
+                // came from the filler — captioning one row's hypnogram with another row's staging.
+                sleepHrOnly = if (sleepFromFiller) filler.sleepHrOnly else winner.sleepHrOnly,
                 spo2Red = if (rawSpo2FromFiller) filler.spo2Red else winner.spo2Red,
                 spo2Ir = if (rawSpo2FromFiller) filler.spo2Ir else winner.spo2Ir,
                 // Independent columns: each stands alone, so a plain per-column fill is safe.
diff --git a/android/app/src/main/java/com/noop/ui/TodayScreen.kt b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
index 8d19c888b0..e1afd79715 100644
--- a/android/app/src/main/java/com/noop/ui/TodayScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
@@ -3085,6 +3085,28 @@ private fun RingNeedsTrackedNight() {
 // three vitals now read directly below the three-ring hero + Synthesis card. [HeroMetricRows] is the
 // README "Metric row" card; the SOLID/CALIBRATING pill + Synthesis insight moved into [SynthesisHeroCard].
 
+/**
+ * Whether the Recovery Vitals card should explain its blanks with the HR-only note (#1801).
+ *
+ * Reads the flag from the SAME row the shown vitals came from. [carriedFromVitals] already decides that
+ * for the date caption, so reusing it keeps the note and the numbers describing ONE night;
+ * `day?.sleepHrOnly ?: vitalsDay?.sleepHrOnly` would instead fall through whenever today's flag is merely
+ * unknown — every row scored before v36 — and caption today's blanks with a different night's staging.
+ *
+ * Gated on something actually being blank so a night that kept its vitals stays quiet, and on `== true`
+ * so the tri-state reads correctly: null means "not known", which earns no claim either way.
+ */
+internal fun showsHrOnlyNote(
+    day: DailyMetric?,
+    vitalsDay: DailyMetric?,
+    carriedFromVitals: Boolean,
+    hrv: Double?,
+    rhr: Int?,
+): Boolean {
+    val source = if (carriedFromVitals) vitalsDay else day
+    return source?.sleepHrOnly == true && (hrv == null || rhr == null)
+}
+
 /** The three hero vitals as README metric rows, HRV (teal) · Resting HR (rose) · Respiratory (blue).
  *  Reads PER-FIELD today-first with a recovery-INDEPENDENT vitals carry ([vitalsDay]) as the fallback
  *  (#543 follow-up), so a night whose recovery was nulled post-update still shows its OWN preserved HRV /
@@ -3103,6 +3125,12 @@ private fun HeroMetricRows(day: DailyMetric?, carriedDay: DailyMetric? = null, v
     // vital is carried do we stamp the carry's date (relabelled "Latest sleep · <date>" when weeks-old).
     val carriedFromVitals = day?.avgHrv == null && day?.restingHr == null && day?.respRateBpm == null &&
         (hrv != null || rhr != null || resp != null) && vitalsDay != null
+    // #1801: why the two blanks below are blank. Read from the SAME row the shown vitals came from —
+    // `carriedFromVitals` already decides that for the date caption, so reusing it keeps the note and the
+    // values describing one night. `day?.sleepHrOnly ?: vitalsDay?.sleepHrOnly` would instead fall through
+    // on a pre-v36 row whose flag is merely unknown, and explain a different night's numbers.
+    // Gated on something actually being blank, so a night that recovered its vitals stays quiet.
+    val hrOnlyNight = showsHrOnlyNote(day, vitalsDay, carriedFromVitals, hrv, rhr)
     // iOS `recoveryVitalsSection`: a frosted card with a "RECOVERY VITALS" header + a "last night · <date>"
     // on the right, then three `vitalRow`s (26dp mini LIQUID VESSEL + label + value). NoopCard supplies the
     // same neutral surfaceRaised + hairline as iOS's frosted card. Inner spacing 12, matching iOS.
@@ -3138,6 +3166,13 @@ private fun HeroMetricRows(day: DailyMetric?, carriedDay: DailyMetric? = null, v
                 tint = Palette.accent,
                 fraction = resp?.let { (it / 24.0).coerceIn(0.0, 1.0) },
             )
+            if (hrOnlyNight) {
+                Text(
+                    uiString(R.string.l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b),
+                    style = NoopType.caption,
+                    color = Palette.textTertiary,
+                )
+            }
         }
     }
 }
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index b4402c5015..6e159ed2fe 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2683,4 +2683,5 @@
     <string name="l10n_settings_screen_skin_temperature_fc103030">Hauttemperatur</string>
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Für diese Nächte liegt keine gemessene Temperatur vor — angezeigt wird die Abweichung von deinem Basiswert. Eine Synchronisierung bewertet die letzten Nächte neu und ergänzt sie.</string>
     <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Es werden nur Nächte mit gemessener Temperatur angezeigt; für die übrigen wurde nur eine Abweichung vom Basiswert erfasst.</string>
+    <string name="l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b">Diese Nacht wurde allein anhand der Herzfrequenz ausgewertet, ohne aufgezeichnete Bewegung, daher konnten Herzfrequenzvariabilität und Ruheherzfrequenz nicht gemessen werden. Ein nicht vollständig gekoppelter Strap ist die übliche Ursache.</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index fb9903a627..1bb9e74ab9 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2670,4 +2670,5 @@
     <string name="l10n_settings_screen_skin_temperature_fc103030">Temperatura cutánea</string>
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">No hay temperatura medida para estas noches: se muestra la diferencia respecto a tu referencia. Una sincronización vuelve a analizar las noches recientes y la completa.</string>
     <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Solo se muestran las noches con temperatura medida; en las demás solo se registró la diferencia respecto a la referencia.</string>
+    <string name="l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b">Esta noche se analizó solo a partir de la frecuencia cardíaca, sin movimiento registrado, por lo que no se pudieron medir la variabilidad de la frecuencia cardíaca ni la frecuencia cardíaca en reposo. La causa habitual es una correa que no está totalmente emparejada.</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 8e915dad5e..dd4622818c 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2669,4 +2669,5 @@
     <string name="l10n_settings_screen_skin_temperature_fc103030">Température cutanée</string>
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Aucune température mesurée pour ces nuits — l\'écart par rapport à votre référence est affiché. Une synchronisation réévalue les nuits récentes et le complète.</string>
     <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Seules les nuits avec une température mesurée sont affichées ; les autres n\'ont enregistré qu\'un écart par rapport à la référence.</string>
+    <string name="l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b">Cette nuit a été analysée à partir de la seule fréquence cardiaque, sans mouvement enregistré, donc la variabilité de la fréquence cardiaque et la fréquence cardiaque au repos n\'ont pas pu être mesurées. La cause habituelle est un bracelet qui n\'est pas entièrement appairé.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 17d9e3fcc1..24b36f954e 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2674,4 +2674,5 @@
     <string name="l10n_settings_screen_skin_temperature_fc103030">Temperatura skóry</string>
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Brak zmierzonej temperatury dla tych nocy — pokazano różnicę względem Twojej wartości bazowej. Synchronizacja ponownie przelicza ostatnie noce i ją uzupełnia.</string>
     <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Pokazywane są tylko noce ze zmierzoną temperaturą; w pozostałych zapisano jedynie różnicę względem wartości bazowej.</string>
+    <string name="l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b">Ta noc została opracowana wyłącznie na podstawie tętna, bez zarejestrowanego ruchu, więc nie udało się zmierzyć zmienności rytmu serca ani tętna spoczynkowego. Zwykłą przyczyną jest opaska, która nie jest w pełni sparowana.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 13163dcfa0..33857ddb11 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2662,4 +2662,5 @@
     <string name="l10n_settings_screen_skin_temperature_fc103030">Temperatura da pele</string>
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Sem temperatura medida para estas noites — a mostrar a diferença em relação à sua referência. Uma sincronização reavalia as noites recentes e preenche-a.</string>
     <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Só são mostradas as noites com temperatura medida; as restantes registaram apenas a diferença em relação à referência.</string>
+    <string name="l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b">Esta noite foi analisada apenas a partir da frequência cardíaca, sem movimento registado, pelo que não foi possível medir a variabilidade da frequência cardíaca nem a frequência cardíaca em repouso. A causa habitual é uma pulseira que não está totalmente emparelhada.</string>
 </resources>
diff --git a/android/app/src/main/res/values-ru/strings.xml b/android/app/src/main/res/values-ru/strings.xml
index a84a383448..1af9883196 100644
--- a/android/app/src/main/res/values-ru/strings.xml
+++ b/android/app/src/main/res/values-ru/strings.xml
@@ -2554,4 +2554,5 @@
         <item quantity="many">%1$s тренировок</item>
         <item quantity="other">%1$s тренировки</item>
     </plurals>
+    <string name="l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b">Эта ночь определена только по пульсу, без записанного движения, поэтому вариабельность сердечного ритма и пульс в покое измерить не удалось. Обычная причина — ремешок, сопряжённый не полностью.</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 792e5ddd40..ee2eefafaa 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2583,4 +2583,5 @@
     <string name="l10n_settings_screen_skin_temperature_fc103030">皮肤温度</string>
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">这些夜晚没有实测温度，显示的是与基线的差值。同步后会重新计算近期夜晚并补上。</string>
     <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">仅显示有实测温度的夜晚；其余夜晚只记录了与基线的差值。</string>
+    <string name="l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b">这一晚仅根据心率推算，没有记录到动作，因此无法测量心率变异性和静息心率。通常的原因是手环尚未完全配对。</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 7fe57612a4..5db78667d5 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2696,4 +2696,5 @@
     <string name="l10n_settings_screen_skin_temperature_fc103030">Skin temperature</string>
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">No measured temperature for these nights — showing the difference from your baseline. A sync re-scores recent nights and fills it in.</string>
     <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Only nights with a measured temperature are shown; the others recorded a baseline difference only.</string>
+    <string name="l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b">This night was staged from heart rate alone, with no motion recorded, so HRV and resting heart rate could not be measured. A strap that is not fully paired is the usual cause.</string>
 </resources>
diff --git a/android/app/src/test/java/com/noop/data/DailySkinTempAbsoluteCarryTest.kt b/android/app/src/test/java/com/noop/data/DailySkinTempAbsoluteCarryTest.kt
index 9811a0720c..c27031f040 100644
--- a/android/app/src/test/java/com/noop/data/DailySkinTempAbsoluteCarryTest.kt
+++ b/android/app/src/test/java/com/noop/data/DailySkinTempAbsoluteCarryTest.kt
@@ -60,4 +60,28 @@ class DailySkinTempAbsoluteCarryTest {
         // And the deviation every downstream gate reads is untouched by carrying the absolute.
         assertEquals(0.2, merged.single().skinTempDevC!!, 1e-12)
     }
+
+    // MARK: - The HR-only staging flag rides the same seams (#1801)
+
+    @Test
+    fun `the staging flag moves with the sleep block, not independently`() {
+        // The winner has no sleep at all, so the sleep block comes from the filler — and the flag
+        // describing those stage figures has to come with them. `copy()` alone would leave the winner's
+        // null in place and caption the filler's hypnogram as if its staging were unknown.
+        val winner = DailyMetric(deviceId = "a", day = "2026-09-03", restingHr = 55)
+        val filler = DailyMetric(deviceId = "b", day = "2026-09-03", totalSleepMin = 400.0,
+            deepMin = 39.0, remMin = 54.0, lightMin = 57.0, sleepHrOnly = true)
+        assertEquals(true, WhoopRepository.coalesceDay(winner, filler).sleepHrOnly)
+    }
+
+    @Test
+    fun `a winner that owns the sleep block keeps its own staging flag`() {
+        // The reverse: the winner's stages win, so its staging answer must too — taking the filler's
+        // would describe one row's hypnogram with another row's provenance.
+        val winner = DailyMetric(deviceId = "a", day = "2026-09-03", totalSleepMin = 420.0,
+            deepMin = 90.0, sleepHrOnly = false)
+        val filler = DailyMetric(deviceId = "b", day = "2026-09-03", totalSleepMin = 300.0,
+            sleepHrOnly = true)
+        assertEquals(false, WhoopRepository.coalesceDay(winner, filler).sleepHrOnly)
+    }
 }
diff --git a/android/app/src/test/java/com/noop/data/DailySleepHrOnlyMigrationTest.kt b/android/app/src/test/java/com/noop/data/DailySleepHrOnlyMigrationTest.kt
new file mode 100644
index 0000000000..8118011f86
--- /dev/null
+++ b/android/app/src/test/java/com/noop/data/DailySleepHrOnlyMigrationTest.kt
@@ -0,0 +1,47 @@
+package com.noop.data
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * v35 -> v36 (#1801): whether every sleep session that day was staged from heart rate alone.
+ *
+ * Twin of the Swift `v42-daily-sleep-hr-only` GRDB migration.
+ *
+ * This environment has no Robolectric / Room-testing (see [AppleStepHourMigrationTest]), so the SQL is
+ * exposed as an internal constant and pinned to shape here rather than executed.
+ */
+class DailySleepHrOnlyMigrationTest {
+
+    @Test
+    fun migrationIsOneNullableAdditiveColumn() {
+        val sql = WhoopDatabase.DAILY_SLEEP_HR_ONLY_MIGRATION_SQL
+        assertEquals(listOf("ALTER TABLE `dailyMetric` ADD COLUMN `sleepHrOnly` INTEGER"), sql)
+        val upper = sql.single().uppercase()
+        assertTrue(upper.startsWith("ALTER TABLE"))
+        // Nullable and defaultless on purpose. The flag is only knowable from a re-score, and defaulting
+        // it to 0 would state "this night had motion" about every night scored before v36 — the exact
+        // false reassurance the column exists to remove.
+        assertTrue(!upper.contains("NOT NULL") && !upper.contains("DEFAULT"))
+        for (banned in listOf("DROP ", "DELETE ", "UPDATE ", "INSERT ", "RENAME ")) {
+            assertTrue("migration must not contain $banned", !upper.contains(banned))
+        }
+    }
+
+    @Test
+    fun migrationSpansTheRightVersions() {
+        assertEquals(35, WhoopDatabase.MIGRATION_35_36.startVersion)
+        assertEquals(36, WhoopDatabase.MIGRATION_35_36.endVersion)
+    }
+
+    @Test
+    fun theFlagIsTriStateAndOldRowsStayUnknown() {
+        val old = DailyMetric(deviceId = "my-whoop", day = "2026-09-03", respRateBpm = 13.3)
+        assertNull("a pre-v36 row knows nothing about its staging", old.sleepHrOnly)
+        // The three states are distinct: unknown, staged with motion, staged without.
+        assertEquals(false, old.copy(sleepHrOnly = false).sleepHrOnly)
+        assertEquals(true, old.copy(sleepHrOnly = true).sleepHrOnly)
+    }
+}
diff --git a/android/app/src/test/java/com/noop/ui/HrOnlyNoteTest.kt b/android/app/src/test/java/com/noop/ui/HrOnlyNoteTest.kt
new file mode 100644
index 0000000000..f9489acee7
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/HrOnlyNoteTest.kt
@@ -0,0 +1,49 @@
+package com.noop.ui
+
+import com.noop.data.DailyMetric
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The Recovery Vitals card's HR-only note (#1801) — when it appears, and whose night it describes.
+ *
+ * A field log showed HRV and resting HR blank for a week beside a populated respiratory rate, which reads
+ * as a failed sync. It was not: with no motion the HR-only spine stages the night and nulls both vitals on
+ * purpose. The note says so. These pin the two ways it could lie instead: appearing on a night that has
+ * its vitals, and explaining a DIFFERENT night's staging than the numbers shown.
+ */
+class HrOnlyNoteTest {
+
+    private fun day(hrOnly: Boolean?) =
+        DailyMetric(deviceId = "my-whoop", day = "2026-09-03", sleepHrOnly = hrOnly)
+
+    @Test
+    fun `shows when today was staged from heart rate alone and a vital is blank`() {
+        assertTrue(showsHrOnlyNote(day(true), null, carriedFromVitals = false, hrv = null, rhr = null))
+    }
+
+    @Test
+    fun `stays quiet when the night kept its vitals`() {
+        // Both present: nothing to explain, so the note would be noise.
+        assertFalse(showsHrOnlyNote(day(true), null, carriedFromVitals = false, hrv = 42.0, rhr = 55))
+    }
+
+    @Test
+    fun `an unknown flag earns no claim`() {
+        // Tri-state: null is "not known" (every row scored before v36), not "had motion".
+        assertFalse(showsHrOnlyNote(day(null), null, carriedFromVitals = false, hrv = null, rhr = null))
+        assertFalse(showsHrOnlyNote(day(false), null, carriedFromVitals = false, hrv = null, rhr = null))
+    }
+
+    @Test
+    fun `it describes the night the shown vitals came from, not today`() {
+        // Carried: the numbers on screen are the CARRY's, so the note must read the carry's flag.
+        assertTrue(showsHrOnlyNote(day(null), day(true), carriedFromVitals = true, hrv = null, rhr = null))
+        // And the reverse — today's own blank night must not be explained by a carry that had motion.
+        assertFalse(showsHrOnlyNote(day(false), day(true), carriedFromVitals = false, hrv = null, rhr = null))
+        // The bug this shape avoids: `day?.sleepHrOnly ?: vitalsDay?.sleepHrOnly` would fall through on a
+        // pre-v36 today and stamp the carry's staging onto today's numbers.
+        assertFalse(showsHrOnlyNote(day(null), day(true), carriedFromVitals = false, hrv = null, rhr = null))
+    }
+}
diff --git a/android/app/src/test/resources/schema_oracle.json b/android/app/src/test/resources/schema_oracle.json
index b28e537ed7..abd475513e 100644
--- a/android/app/src/test/resources/schema_oracle.json
+++ b/android/app/src/test/resources/schema_oracle.json
@@ -1,6 +1,6 @@
 {
   "_readme": "SHARED Room<->GRDB SCHEMA ORACLE (#775). Two byte-identical copies: Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json and android/app/src/test/resources/schema_oracle.json. SchemaOracleTests.swift compares GRDB's PRAGMA table_info/index_list against it; SchemaOracleTest.kt compares Room's exported schema JSON against it. `columns` is the iOS/GRDB shape in GRDB column order (macOS is the reference implementation); every way Android differs is spelled out in an `android` / `iosAbsent` / `androidColumnOrder` override naming a key in `divergenceReasons`. Adding a column, reordering one, or changing a type/nullability on one platform only fails both suites until it is either fixed or written down here.",
-  "roomVersion": 35,
+  "roomVersion": 36,
   "grdbMigrations": [
     "v1",
     "v2",
@@ -42,7 +42,8 @@
     "v38-apple-step-hour",
     "v39-ppg-burst-index",
     "v40-daily-skin-temp-absolute",
-    "v41-drop-raw-imu-sample"
+    "v41-drop-raw-imu-sample",
+    "v42-daily-sleep-hr-only"
   ],
   "divergenceReasons": {
     "android-orphan-synced-column": "REAL COLUMN DRIFT: `synced` exists on Android only. GRDB's v10 note is explicit that stepSample gets no `synced` column ('unused; see StreamStore'), and v12's ppgHrSample never had one either; the Room entities copied the flag from the older per-second entities. Nothing reads it on Android — the per-row upload flag belongs to an upload path that does not exist there — so it is dead width, not divergent data. Removing it needs a Room table rebuild.",
@@ -372,6 +373,16 @@
           "affinity": "REAL",
           "notNull": false,
           "default": null
+        },
+        {
+          "name": "sleepHrOnly",
+          "affinity": "NUMERIC",
+          "notNull": false,
+          "default": null,
+          "android": {
+            "affinity": "INTEGER"
+          },
+          "divergence": "grdb-boolean-affinity"
         }
       ],
       "primaryKey": [

From 7d7702c8a2e666b5aba827940df3caaed5386d97 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 22:26:53 +1200
Subject: [PATCH 233/333] build: staging 434 / iOS 315 for the next testing
 build

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 67ca57afef..896382f7ba 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 433
+        versionCode = 434
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 3e974af961..3f628f3284 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "314"
+    CURRENT_PROJECT_VERSION: "315"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From e162428db59508c44b8f854206b6a2f391055d0f Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 23:54:15 +1200
Subject: [PATCH 234/333] connection: say which streams actually banked on a
 finished link (#1880)

The link epitaph (#1809) answers "did the strap send anything". That is the right
measure for a silent strap and the wrong one for a strap talking over only part
of its surface: an unbonded 5/MG streams heart rate and R-R over the standard
profile all night while every bond-gated stream banks nothing, and the epitaph
reports that as hundreds of healthy inbound frames.

Establishing that split in the field took two exports hours apart and a manual
diff of stored row counts - hr +5607, rr +2582, gravity +0, resp +0, skinTemp
+0, spo2 +0. Neither export said anything was wrong on its own. One line does
now, on both platforms:

  banked live this link: hr=456 rr=187 gravity=0 resp=0 skinTemp=0 spo2=0
    battery=2 - nothing banked live for: gravity, resp, skinTemp, spo2

Zero-banking streams are NAMED rather than left to be inferred, because
"gravity=0 among six other zeros" and "gravity=0 while hr=456" are the same text
and opposite findings.

LIVE streams only, and the sentence says so. The offload persists through
Backfiller and has its own accounting; folding it in would make every healthy
bonded sync read as "nothing banked live for: gravity" - the false alarm this
line exists to prevent. For an unbonded strap the distinction is moot, because
backfill is deferred and live IS the whole picture.

A stream the platform cannot measure is OMITTED, not printed as zero. Apple's
insert returns eight fields and deliberately excludes steps while Room counts
them, so `steps` is nullable: absent is not zero, and printing the second as the
first manufactures a permanent false alarm.

Five review passes produced four defects, every one in the ~20 lines of
lifecycle wiring rather than the formatter that carries all eleven tests:

  - a read-modify-write race, from two independent ioScope.launch coroutines,
    with a comment asserting the opposite. The answer was two lines away - the
    neighbouring failure counters are already AtomicInteger for that reason.
  - the line would have cried wolf on every healthy offload, before it was
    narrowed to "live".
  - the Apple emitter was missing entirely, on a false claim that linkEpitaph's
    twin had shipped formatter-first. It had not; Apple emits it.
  - no connect-time reset, so a link beginning without a clean teardown would
    have opened holding the previous link's rows. Visible only by reading the
    two platforms side by side against the counter declared two lines above.

Verified: 631 classes / 5180 tests / 0 failures freshly rerun, five CI workflows
green including Swift Packages CI, both sentences pinned identically across
platforms.

NOT verified on a device. The formatter is tested on both sides; the emit wiring
is BLE code no CI executes on either platform.

Groundwork for #1635.
---
 .../StrandAnalytics/ConnectionReadout.swift   | 42 ++++++++++
 .../LinkBankedSummaryTests.swift              | 57 ++++++++++++++
 Strand/BLE/BLEManager.swift                   | 34 +++++++-
 Strand/Collect/Collector.swift                | 16 +++-
 .../com/noop/analytics/ConnectionReadout.kt   | 45 +++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 53 ++++++++++++-
 .../noop/analytics/LinkBankedSummaryTest.kt   | 78 +++++++++++++++++++
 7 files changed, 321 insertions(+), 4 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LinkBankedSummaryTests.swift
 create mode 100644 android/app/src/test/java/com/noop/analytics/LinkBankedSummaryTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift
index 2d1b583e7c..188a2c1099 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift
@@ -302,6 +302,48 @@ public enum ConnectionReadout {
         return line
     }
 
+    /// #1635: which STREAMS banked rows on a finished link, beside `linkEpitaph`'s "did anything arrive".
+    ///
+    /// The epitaph counts frames, which is the right measure for a silent strap and the wrong one for a
+    /// strap talking over only part of its surface: an unbonded 5/MG streams heart rate and R-R over the
+    /// standard profile all night while every bond-gated stream banks nothing, and the epitaph reports
+    /// that as hundreds of healthy inbound frames. A field diagnosis had to establish the split by
+    /// exporting twice, hours apart, and diffing stored row counts by hand.
+    ///
+    /// Zero-banking streams are named rather than left to be inferred, because "gravity=0 among six other
+    /// zeros" and "gravity=0 while hr=456" read identically and mean opposite things. Counts are ROWS
+    /// ACCEPTED, so a stream arriving as duplicates reads zero and is named — correct here: the question
+    /// is what the database gained on this link.
+    ///
+    /// LIVE streams only, and the sentence says so. The history offload persists through its own path and
+    /// already has its own accounting; counting one and labelling it "this link" would make every healthy
+    /// bonded sync read as "nothing banked for: gravity" — the false alarm this line exists to prevent.
+    ///
+    /// Pure and total, and every count clamped, so it cannot become the reason a teardown path throws.
+    /// Twin of the Kotlin formatter. Apple does not emit it yet; the formatter exists so the two logs
+    /// cannot drift apart when it does.
+    /// `steps` is OPTIONAL because this platform's store does not return a step count at all — steps are
+    /// persist-only here, deliberately outside the 8-field insert tuple, while Room counts them. A
+    /// platform that cannot measure a stream must OMIT it rather than report zero: "banked nothing" is a
+    /// finding and "not measured here" is not, and printing the second as the first would put a permanent
+    /// false alarm in every Apple link's log.
+    public static func linkBankedSummary(hr: Int, rr: Int, gravity: Int, resp: Int,
+                                         skinTemp: Int, spo2: Int, steps: Int?, battery: Int) -> String {
+        var raw: [(String, Int)] = [
+            ("hr", hr), ("rr", rr), ("gravity", gravity), ("resp", resp),
+            ("skinTemp", skinTemp), ("spo2", spo2),
+        ]
+        if let steps { raw.append(("steps", steps)) }
+        raw.append(("battery", battery))
+        let pairs: [(String, Int)] = raw.map { ($0.0, max(0, $0.1)) }
+        let body = pairs.map { "\($0.0)=\($0.1)" }.joined(separator: " ")
+        let total = pairs.reduce(0) { $0 + $1.1 }
+        if total == 0 { return "banked live this link: \(body) - NOTHING was stored from the live streams" }
+        let empty = pairs.filter { $0.1 == 0 }.map { $0.0 }
+        if empty.isEmpty { return "banked live this link: \(body)" }
+        return "banked live this link: \(body) - nothing banked live for: \(empty.joined(separator: ", "))"
+    }
+
     /// #987: freshness label for the "last frame" readout row: how long ago the most recent strap frame
     /// was routed ("12s ago"), or "no frames yet" before the first one. `nowUnix` injected for testability.
     public static func lastFrameLabel(lastFrameUnix: Int?, nowUnix: Int) -> String {
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LinkBankedSummaryTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LinkBankedSummaryTests.swift
new file mode 100644
index 0000000000..1d5b10cb29
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LinkBankedSummaryTests.swift
@@ -0,0 +1,57 @@
+import XCTest
+@testable import StrandAnalytics
+
+/// #1635: the per-link banked-rows line, the database-side companion to `linkEpitaph`.
+///
+/// Byte-identical twin of the Kotlin `LinkBankedSummaryTest`. The case it exists for: an unbonded 5/MG
+/// streams heart rate and R-R over the standard profile while every bond-gated stream banks nothing, and
+/// the epitaph reports that link as hundreds of healthy inbound frames.
+final class LinkBankedSummaryTests: XCTestCase {
+
+    func testNamesTheStreamsThatBankedNothingWhenOthersDid() {
+        let line = ConnectionReadout.linkBankedSummary(
+            hr: 456, rr: 187, gravity: 0, resp: 0, skinTemp: 0, spo2: 0, steps: 0, battery: 2)
+        XCTAssertTrue(line.contains("hr=456"))
+        XCTAssertTrue(line.contains("gravity=0"))
+        XCTAssertTrue(line.contains("nothing banked live for: gravity, resp, skinTemp, spo2, steps"))
+    }
+
+    func testAFullyHealthyLinkGetsNoCallOut() {
+        let line = ConnectionReadout.linkBankedSummary(
+            hr: 400, rr: 380, gravity: 900, resp: 900, skinTemp: 900, spo2: 900, steps: 12, battery: 3)
+        XCTAssertTrue(line.hasPrefix("banked live this link:"))
+        XCTAssertFalse(line.contains("nothing banked live for"))
+    }
+
+    func testALinkThatStoredNothingSaysSoOnce() {
+        let line = ConnectionReadout.linkBankedSummary(
+            hr: 0, rr: 0, gravity: 0, resp: 0, skinTemp: 0, spo2: 0, steps: 0, battery: 0)
+        XCTAssertTrue(line.contains("NOTHING was stored from the live streams"))
+        XCTAssertFalse(line.contains("nothing banked live for"))
+    }
+
+    func testNegativeCountsCannotLeakIntoADiagnostic() {
+        let line = ConnectionReadout.linkBankedSummary(
+            hr: -5, rr: 1, gravity: 0, resp: 0, skinTemp: 0, spo2: 0, steps: 0, battery: 0)
+        XCTAssertTrue(line.contains("hr=0"))
+        XCTAssertFalse(line.contains("-5"))
+    }
+
+    /// The two platforms must produce the SAME sentence, since a report may come from either.
+    func testTheExactSentenceForTheFieldCase() {
+        XCTAssertEqual(
+            ConnectionReadout.linkBankedSummary(
+                hr: 456, rr: 187, gravity: 0, resp: 0, skinTemp: 0, spo2: 0, steps: 0, battery: 2),
+            "banked live this link: hr=456 rr=187 gravity=0 resp=0 skinTemp=0 spo2=0 steps=0 battery=2"
+                + " - nothing banked live for: gravity, resp, skinTemp, spo2, steps")
+    }
+
+
+    /// Apple's store does not return a step count, so the line must omit steps rather than print zero.
+    func testAStreamThisPlatformCannotMeasureIsOmittedNotZero() {
+        let line = ConnectionReadout.linkBankedSummary(
+            hr: 456, rr: 187, gravity: 0, resp: 0, skinTemp: 0, spo2: 0, steps: nil, battery: 2)
+        XCTAssertFalse(line.contains("steps"), "an unmeasured stream must not appear at all")
+        XCTAssertTrue(line.contains("nothing banked live for: gravity, resp, skinTemp, spo2"))
+    }
+}
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index bfe5cdae9d..acb7657aa5 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -732,6 +732,17 @@ public final class BLEManager: NSObject, ObservableObject {
     private var inboundFrames = 0
     private var inboundBytes = 0
     private var cmdChannelFrames = 0
+    /// #1635: rows ACCEPTED per stream on this link — the database-side companion to the three above.
+    /// The epitaph counts frames, which reads healthy on an unbonded 5/MG streaming heart rate over the
+    /// standard profile while every bond-gated stream banks nothing. Cleared with them, so they describe
+    /// THIS link. Plain vars like their neighbours: `Collector` hands them up on the main actor.
+    private var bankedHr = 0
+    private var bankedRr = 0
+    private var bankedGravity = 0
+    private var bankedResp = 0
+    private var bankedSkinTemp = 0
+    private var bankedSpo2 = 0
+    private var bankedBattery = 0
     /// Uptime clock for the epitaph. Monotonic, so a wall-clock change mid-link cannot make it negative.
     private var linkUpSince: DispatchTime?
     /// Last time ANY notification arrived — drives the liveness watchdog.
@@ -1344,7 +1355,14 @@ public final class BLEManager: NSObject, ObservableObject {
         let enableRawCapture = UserDefaults.standard.bool(forKey: "enableRawCapture")
         collector = Collector(store: store, deviceId: deviceId,
                               enableRawCapture: enableRawCapture,
-                              log: { [weak self] line in self?.log(line) })
+                              log: { [weak self] line in self?.log(line) },
+                              onBanked: { [weak self] c in
+                                  guard let self else { return }
+                                  self.bankedHr += c.hr; self.bankedRr += c.rr
+                                  self.bankedGravity += c.gravity; self.bankedResp += c.resp
+                                  self.bankedSkinTemp += c.skinTemp; self.bankedSpo2 += c.spo2
+                                  self.bankedBattery += c.battery
+                              })
         // The store can finish bootstrapping AFTER connect(model:) already ran (both wait on
         // poweredOn), so apply the family/clock configuration here too — whichever runs last wins.
         configureCollectorFamily()
@@ -5241,6 +5259,11 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
         // #1809: this link's inbound tally starts empty; the epitaph on disconnect reports exactly what
         // arrived between here and there.
         inboundFrames = 0; inboundBytes = 0; cmdChannelFrames = 0
+        // #1635: same guarantee for the banked tally. Clearing only on teardown would be enough if every
+        // link ended in one, and a link that begins without a preceding clean teardown would otherwise
+        // open holding the previous link's rows — reporting them as banked on a link that never saw them.
+        bankedHr = 0; bankedRr = 0; bankedGravity = 0; bankedResp = 0
+        bankedSkinTemp = 0; bankedSpo2 = 0; bankedBattery = 0
         linkUpSince = DispatchTime.now()
         standingConnectAt = nil     // #1413: a live link means no standing connect is outstanding
         restoredPeripheral = nil
@@ -5399,9 +5422,18 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
             log(ConnectionReadout.linkEpitaph(upMillis: upMs, inboundFrames: inboundFrames,
                                               inboundBytes: inboundBytes, cmdChannelFrames: cmdChannelFrames,
                                               realtimeArmed: realtimeArmedAt != nil, ended: endedReason))
+            // #1635: LIVE streams only — the offload persists through `Backfiller` and has its own
+            // accounting, so folding it in would make a healthy bonded sync read as "nothing banked live
+            // for: gravity". Inside the same `linkUpSince` guard for the same reason the epitaph is.
+            log(ConnectionReadout.linkBankedSummary(
+                hr: bankedHr, rr: bankedRr, gravity: bankedGravity, resp: bankedResp,
+                // nil, not 0: this store does not return a step count, and a zero would read as a fault.
+                skinTemp: bankedSkinTemp, spo2: bankedSpo2, steps: nil, battery: bankedBattery))
         }
         // Clear the tally with the link, so a second teardown for the same drop cannot re-report it.
         inboundFrames = 0; inboundBytes = 0; cmdChannelFrames = 0
+        bankedHr = 0; bankedRr = 0; bankedGravity = 0; bankedResp = 0
+        bankedSkinTemp = 0; bankedSpo2 = 0; bankedBattery = 0
         linkUpSince = nil
 
         let timedOut = !intentionalDisconnect && error != nil
diff --git a/Strand/Collect/Collector.swift b/Strand/Collect/Collector.swift
index df46534630..e54b2bfea5 100644
--- a/Strand/Collect/Collector.swift
+++ b/Strand/Collect/Collector.swift
@@ -70,6 +70,11 @@ final class Collector {
     /// #1118: strap-log sink for the per-transport R-R census. Optional and defaulted to nil so the
     /// test fakes that construct a Collector are untouched; `BLEManager` wires its own `log`.
     private let log: ((String) -> Void)?
+    /// #1635: rows ACCEPTED per stream, handed up so `BLEManager` can tally them per LINK and say which
+    /// streams banked when it writes the link epitaph. The counts already exist — `StreamStore.insert`
+    /// returns them and the standard-HR path already binds them for its own trace line — so this carries
+    /// a measurement that was being discarded, rather than taking a new one.
+    private let onBanked: ((BankedCounts) -> Void)?
     /// #1118: last emit of each LIVE census line, unix seconds; 0 = never. Rate-limited — see
     /// `RrEmissionStats.shouldEmitLiveCensus`.
     ///
@@ -107,15 +112,22 @@ final class Collector {
     private var batchStartedAt: TimeInterval
     var bufferedCount: Int { buffer.count }
 
+    /// The per-stream accepted-row counts `StreamStore.insert` returns, named so the closure that carries
+    /// them is readable at both ends.
+    typealias BankedCounts = (hr: Int, rr: Int, events: Int, battery: Int,
+                              spo2: Int, skinTemp: Int, resp: Int, gravity: Int)
+
     init(store: StoreWriting, deviceId: String,
          policy: CollectorPolicy = .default,
          enableRawCapture: Bool = false,
          log: ((String) -> Void)? = nil,
+         onBanked: ((BankedCounts) -> Void)? = nil,
          now: @escaping () -> Int = { Int(Date().timeIntervalSince1970) },
          monotonic: @escaping () -> TimeInterval = { Date().timeIntervalSinceReferenceDate }) {
         self.store = store; self.deviceId = deviceId; self.policy = policy
         self.enableRawCapture = enableRawCapture
         self.log = log
+        self.onBanked = onBanked
         self.now = now; self.monotonic = monotonic
         self.batchStartedAt = monotonic()
         self.concreteStore = store as? WhoopStore
@@ -229,8 +241,9 @@ final class Collector {
             }
         }
         do {
-            try await store.insert(streams, deviceId: deviceId)   // DECODED FIRST (durable)
+            let inserted = try await store.insert(streams, deviceId: deviceId)   // DECODED FIRST (durable)
             realtimeInsertFailures = 0
+            onBanked?(inserted)
         } catch {
             // Re-buffer at the front so these frames (and their parses) are retried on the next cadence.
             buffer.insert(contentsOf: batch, at: 0)
@@ -318,6 +331,7 @@ final class Collector {
         do {
             let inserted = try await store.insert(Streams(hr: hr, rr: rr, events: contact), deviceId: deviceId)
             stdInsertFailures = 0
+            onBanked?(inserted)
             log?(LivePersistTrace.standardHRFlushSucceededLine(
                 reason: reason, offeredHRRows: hr.count, offeredRRRows: rr.count,
                 insertedHRRows: inserted.hr, insertedRRRows: inserted.rr))
diff --git a/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt b/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt
index 98747dc1a9..decb1ea45a 100644
--- a/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt
+++ b/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt
@@ -282,6 +282,51 @@ object ConnectionReadout {
         return line
     }
 
+    /**
+     * #1635: which STREAMS banked rows on a finished link, beside [linkEpitaph]'s "did anything arrive".
+     *
+     * The epitaph counts frames. That is the right measure for a silent strap, and the wrong one for a
+     * strap that is talking but only over part of its surface: an unbonded 5/MG streams heart rate and R-R
+     * over the standard profile all night while the bond-gated streams bank nothing, and the epitaph
+     * reports that as hundreds of healthy inbound frames. A field diagnosis had to establish the split by
+     * exporting twice, hours apart, and diffing the stored row counts by hand — the two logs each looked
+     * fine on their own. One line states it.
+     *
+     * Zero-banking streams are named explicitly rather than left to be inferred from a list of numbers,
+     * because "gravity=0 sitting among six other zeros" and "gravity=0 while hr=456" are the same text and
+     * opposite findings. Counts are ROWS ACCEPTED, so a stream that arrived as duplicates reads zero and
+     * is named — correct for this purpose: the question is what the database gained on this link.
+     *
+     * LIVE streams only, and the sentence says so. The history offload persists through its own path
+     * (`Backfiller`) and already has its own accounting — `bankedSensorRecords`, `rowsPersisted`, the
+     * completed-offload classification. Counting one and labelling it "this link" would make every healthy
+     * bonded sync that banked its gravity through the offload read as "nothing banked for: gravity", which
+     * is the false alarm this line exists to make impossible. A narrow true claim beats a broad wrong one.
+     *
+     * Pure and total: no clock, no I/O, and every count clamped, so it cannot itself become the reason a
+     * teardown path throws. Twin of the Swift formatter.
+     */
+    fun linkBankedSummary(
+        hr: Int, rr: Int, gravity: Int, resp: Int, skinTemp: Int, spo2: Int, steps: Int?, battery: Int,
+    ): String {
+        // [steps] is NULLABLE because Apple's store does not return a step count at all — steps are
+        // persist-only there, deliberately outside its 8-field insert tuple, while Room counts them. A
+        // platform that cannot measure a stream must OMIT it, not report zero: "banked nothing" is a
+        // finding and "not measured here" is not, and printing the second as the first would put a
+        // permanent false alarm in every Apple link's log.
+        val pairs = (listOf(
+            "hr" to hr, "rr" to rr, "gravity" to gravity, "resp" to resp,
+            "skinTemp" to skinTemp, "spo2" to spo2,
+        ) + listOfNotNull(steps?.let { "steps" to it }) + listOf("battery" to battery))
+            .map { (k, v) -> k to maxOf(0, v) }
+        val body = pairs.joinToString(" ") { (k, v) -> "$k=$v" }
+        val total = pairs.sumOf { it.second }
+        if (total == 0) return "banked live this link: $body - NOTHING was stored from the live streams"
+        val empty = pairs.filter { it.second == 0 }.map { it.first }
+        if (empty.isEmpty()) return "banked live this link: $body"
+        return "banked live this link: $body - nothing banked live for: ${empty.joinToString(", ")}"
+    }
+
     /** #987: freshness label for the "last frame" readout row ("12s ago" / "no frames yet"). [nowUnix]
      *  injected for testability. Twin of the Swift labeller. */
     fun lastFrameLabel(lastFrameUnix: Long?, nowUnix: Long): String {
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 1e004d85cc..f67575b3ed 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -26,6 +26,7 @@ import android.os.SystemClock
 import android.util.Log
 import com.noop.NoopApplication
 import com.noop.data.HrRow
+import com.noop.data.InsertCounts
 import com.noop.data.RrRow
 import com.noop.data.EventEntry
 import com.noop.data.StandardHrMapping
@@ -6197,6 +6198,11 @@ class WhoopBleClient(
                     // #1809: this link's inbound tally starts empty, so the epitaph on disconnect reports
                     // exactly what arrived on THIS link and never a previous session's traffic.
                     inboundFrames = 0; inboundBytes = 0; cmdChannelFrames = 0
+                    // #1635: same guarantee for the banked tally. Clearing only on teardown would be enough if
+                    // every link ended in one; a link that begins without a preceding clean teardown would
+                    // otherwise open holding the previous link's rows and report them as banked on this one.
+                    bankedHr.set(0); bankedRr.set(0); bankedGravity.set(0); bankedResp.set(0)
+                    bankedSkinTemp.set(0); bankedSpo2.set(0); bankedSteps.set(0); bankedBattery.set(0)
                     realtimeArmedThisLink = false
                     // A connect succeeded → clear the stale-bond re-pair guide UNLESS we are in a known
                     // bond-loop (#617). In that loop the strap "connects" every ~3 s before timing out
@@ -6724,6 +6730,34 @@ class WhoopBleClient(
     private var inboundFrames = 0
     private var inboundBytes = 0
     private var cmdChannelFrames = 0
+
+    // #1635: rows ACCEPTED per stream on this link, the database-side twin of the frame counters above.
+    // Cleared with them on teardown.
+    //
+    // ATOMIC, unlike those counters, because the writers are not the same. `inboundFrames` and friends are
+    // touched only from the serialized GATT callback; these are folded in from `flushLive` and
+    // `flushStandardHr`, which are two INDEPENDENT `ioScope.launch` coroutines that can run at once — the
+    // same reason `liveInsertFailuresStd` and `liveInsertFailuresRealtime` beside them are AtomicInteger.
+    // A plain `+=` there is a read-modify-write race, and the teardown read is a third thread again. Each
+    // counter stands alone (no cross-field invariant), so per-field atomicity is the whole requirement.
+    // An under-count would be worse than useless here: it reads as exactly the "banked nothing" finding
+    // this line exists to report.
+    private val bankedHr = java.util.concurrent.atomic.AtomicInteger(0)
+    private val bankedRr = java.util.concurrent.atomic.AtomicInteger(0)
+    private val bankedGravity = java.util.concurrent.atomic.AtomicInteger(0)
+    private val bankedResp = java.util.concurrent.atomic.AtomicInteger(0)
+    private val bankedSkinTemp = java.util.concurrent.atomic.AtomicInteger(0)
+    private val bankedSpo2 = java.util.concurrent.atomic.AtomicInteger(0)
+    private val bankedSteps = java.util.concurrent.atomic.AtomicInteger(0)
+    private val bankedBattery = java.util.concurrent.atomic.AtomicInteger(0)
+
+    /** Fold one persist round's accepted-row counts into the per-link tally. */
+    private fun addBanked(c: InsertCounts) {
+        bankedHr.addAndGet(c.hr); bankedRr.addAndGet(c.rr)
+        bankedGravity.addAndGet(c.gravity); bankedResp.addAndGet(c.resp)
+        bankedSkinTemp.addAndGet(c.skinTemp); bankedSpo2.addAndGet(c.spo2)
+        bankedSteps.addAndGet(c.steps); bankedBattery.addAndGet(c.battery)
+    }
     /** #1809: was realtime armed at ANY point on THIS link. Not the same thing as [realtimeArmed], which
      *  is persistent edge state: it can carry true in from a previous link, or read false at the drop
      *  after a mid-link disarm. The epitaph needs the per-link fact, which is what the Apple twin's
@@ -9051,7 +9085,7 @@ class WhoopBleClient(
         }
         if (!batch.isEmpty) {
             try {
-                repository.insert(batch, deviceId)
+                addBanked(repository.insert(batch, deviceId))
                 liveInsertFailuresRealtime.set(0)
             } catch (t: Throwable) {
                 // Re-buffer at the front so these frames retry on the next cadence (port of Collector).
@@ -9134,7 +9168,7 @@ class WhoopBleClient(
             }
         }
         try {
-            repository.insert(StreamBatch(hr = hr, rr = rr, events = contact), deviceId)
+            addBanked(repository.insert(StreamBatch(hr = hr, rr = rr, events = contact), deviceId))
             liveInsertFailuresStd.set(0)
         } catch (t: Throwable) {
             synchronized(collectorLock) {
@@ -9986,9 +10020,24 @@ class WhoopBleClient(
                 // before handleDisconnect runs and is not reassigned above, so it is valid here.
                 ended = if (intentionalDisconnect) "intentional" else "status=$status",
             ))
+            // #1635: what the DATABASE gained from the LIVE streams, beside what the radio carried. An
+            // unbonded 5/MG keeps the epitaph looking healthy — hundreds of inbound frames — while every
+            // bond-gated stream banks nothing, and that split is invisible in a single export. Live only:
+            // the offload persists through `Backfiller` and has its own accounting, so folding it in here
+            // would be double-counted in one direction and, worse, its ABSENCE reads as a fault.
+            // Guarded by the SAME `linkUpSinceMs` as the epitaph: on a failed connect attempt the counters
+            // hold the previous link's tally, and reporting them would describe a link that never existed.
+            log(ConnectionReadout.linkBankedSummary(
+                hr = bankedHr.get(), rr = bankedRr.get(),
+                gravity = bankedGravity.get(), resp = bankedResp.get(),
+                skinTemp = bankedSkinTemp.get(), spo2 = bankedSpo2.get(),
+                steps = bankedSteps.get(), battery = bankedBattery.get(),
+            ), com.noop.testcentre.TestDomain.CONNECTION)
         }
         // Clear the tally with the link, so a second teardown for the same drop cannot re-report it.
         inboundFrames = 0; inboundBytes = 0; cmdChannelFrames = 0
+        bankedHr.set(0); bankedRr.set(0); bankedGravity.set(0); bankedResp.set(0)
+        bankedSkinTemp.set(0); bankedSpo2.set(0); bankedSteps.set(0); bankedBattery.set(0)
 
         val heldSuffix = heldForLogSuffix()
         linkUpSinceMs = null
diff --git a/android/app/src/test/java/com/noop/analytics/LinkBankedSummaryTest.kt b/android/app/src/test/java/com/noop/analytics/LinkBankedSummaryTest.kt
new file mode 100644
index 0000000000..8a76b588a3
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/LinkBankedSummaryTest.kt
@@ -0,0 +1,78 @@
+package com.noop.analytics
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #1635: the per-link banked-rows line, the database-side companion to `linkEpitaph`.
+ *
+ * The case it exists for: an unbonded WHOOP 5/MG streams heart rate and R-R over the standard profile
+ * while every bond-gated stream banks nothing. The epitaph reports that link as hundreds of healthy
+ * inbound frames, which is true and misleading. Establishing the split took two exports hours apart and
+ * a manual diff of stored row counts; these pin the one line that states it outright.
+ */
+class LinkBankedSummaryTest {
+
+    @Test
+    fun `names the streams that banked nothing when others did`() {
+        val line = ConnectionReadout.linkBankedSummary(
+            hr = 456, rr = 187, gravity = 0, resp = 0, skinTemp = 0, spo2 = 0, steps = 0, battery = 2,
+        )
+        assertTrue(line.contains("hr=456"))
+        assertTrue(line.contains("gravity=0"))
+        // The whole point: a reader must not have to spot which of eight numbers are zero.
+        assertTrue(line.contains("nothing banked live for: gravity, resp, skinTemp, spo2, steps"))
+    }
+
+    @Test
+    fun `a fully healthy link gets no call-out`() {
+        val line = ConnectionReadout.linkBankedSummary(
+            hr = 400, rr = 380, gravity = 900, resp = 900, skinTemp = 900, spo2 = 900, steps = 12, battery = 3,
+        )
+        assertTrue(line.startsWith("banked live this link:"))
+        assertTrue("a link where every stream banked must not carry a zero call-out",
+            !line.contains("nothing banked live for"))
+    }
+
+    @Test
+    fun `a link that stored nothing at all says so once, not eight times`() {
+        val line = ConnectionReadout.linkBankedSummary(0, 0, 0, 0, 0, 0, 0, 0)
+        assertTrue(line.contains("NOTHING was stored from the live streams"))
+        // Not also the per-stream list: "nothing banked for: <all eight>" is noise when the total is zero.
+        assertTrue(!line.contains("nothing banked live for"))
+    }
+
+    @Test
+    fun `negative counts cannot leak into a diagnostic`() {
+        // Pure and total on purpose: this runs on the teardown path, where throwing would cost the very
+        // report it exists to produce.
+        val line = ConnectionReadout.linkBankedSummary(-5, 1, 0, 0, 0, 0, 0, 0)
+        assertTrue(line.contains("hr=0"))
+        assertEquals(false, line.contains("-5"))
+    }
+
+    @Test
+    fun `the exact sentence for the field case, pinned against the Swift twin`() {
+        assertEquals(
+            "banked live this link: hr=456 rr=187 gravity=0 resp=0 skinTemp=0 spo2=0 steps=0 battery=2" +
+                " - nothing banked live for: gravity, resp, skinTemp, spo2, steps",
+            ConnectionReadout.linkBankedSummary(
+                hr = 456, rr = 187, gravity = 0, resp = 0, skinTemp = 0, spo2 = 0, steps = 0, battery = 2,
+            ),
+        )
+    }
+
+
+    @Test
+    fun `a stream this platform cannot measure is omitted, not reported as zero`() {
+        // Apple's store does not return a step count (persist-only, outside its insert tuple). Printing
+        // steps=0 there would name it in the zero list forever - a permanent false alarm in a line whose
+        // entire job is to make a real zero stand out.
+        val line = ConnectionReadout.linkBankedSummary(
+            hr = 456, rr = 187, gravity = 0, resp = 0, skinTemp = 0, spo2 = 0, steps = null, battery = 2,
+        )
+        assertTrue("an unmeasured stream must not appear at all", !line.contains("steps"))
+        assertTrue(line.contains("nothing banked live for: gravity, resp, skinTemp, spo2"))
+    }
+}

From 9ca9414bb11934a49a42ff1eeb95615702faa523 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Fri, 4 Sep 2026 23:58:04 +1200
Subject: [PATCH 235/333] build: staging 435 / iOS 316 for the next testing
 build

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 896382f7ba..7e913fe281 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 434
+        versionCode = 435
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 3f628f3284..0345a743c9 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "315"
+    CURRENT_PROJECT_VERSION: "316"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From ee49d2935308a97130608b74d0e7068a51d98a64 Mon Sep 17 00:00:00 2001
From: Prasad Fadke <fadkeprasad@gmail.com>
Date: Fri, 4 Sep 2026 08:41:01 -0400
Subject: [PATCH 236/333] Fix daily energy integration for sparse HR (#1692)

From @fadkeprasad.

WorkoutDetector summed one second per HR sample, so a WHOOP 5/MG at 30 s cadence
reported roughly a thirtieth of a day's energy. Both resting and active energy
now integrate over elapsed time instead of sample count.

The legacy pin is exact rather than approximate: an active sample used to
contribute max(resting, gross) and now contributes resting from the elapsed
integral plus max(0, gross - resting), which is algebraically identical in both
branches, so a 1 Hz day reproduces the old total term by term.

Two follow-ups sit on top of that work.

Active carry is capped at the INFERRED CADENCE rather than a flat 60 s, while
resting keeps the wider cap. The flat one-second model being replaced was
deliberate, and its comment said why: elapsed weighting would credit up to ~150 s
of active burn to one isolated elevated sample. A fixed 60 s cap narrows that
objection instead of answering it - on a 1 Hz day with a dropout, the reading
before the gap was credited a full minute of exercise it never demonstrated. The
asymmetry is the point: metabolism continues across a gap, exercise is not
evidenced by one. All four original oracle vectors have a median at or above the
cap, so none of them could see the difference, which is why the suite stayed
green either way.

Tied timestamps are now deterministic. hrSample is keyed (deviceId, ts) and the
day feed unions devices, so a two-strap day carries two readings for the same
second; only the last of a tied run receives the interval, which left tie order
deciding the day's active energy. Kotlin's sortedBy is stable, Swift's
sorted(by:) explicitly is not, so a value-for-value parity contract rested on a
property one language declines to guarantee. Ties now order by descending bpm,
handing the interval to the lower reading - the conservative direction for a path
whose alternative is crediting exercise that was not demonstrated.

Verified against current main rather than the branch base: merged and run
locally at 631 classes / 5186 tests / 0 failures, DayCaloriesTest 17/17. Main had
touched WorkoutDetector on both platforms since the branch point, but only to
rename a log string, so there is no semantic drift. Swift package tests are
CI-verified; GRDB's CSQLite does not build on Linux.

Worth knowing: this moves a persisted metric. Recent days are re-scored and older
ones are not, so 5/MG users will see a discontinuity at the recompute boundary
with historical days staying roughly 30x low. Same shape as the earlier calorie
change.
---
 .../StrandAnalytics/WorkoutDetector.swift     | 116 ++++++++++---
 .../DayCaloriesTests.swift                    | 153 ++++++++++++++---
 .../com/noop/analytics/WorkoutDetector.kt     | 120 ++++++++++----
 .../com/noop/analytics/DayCaloriesTest.kt     | 156 +++++++++++++++---
 4 files changed, 441 insertions(+), 104 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/WorkoutDetector.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/WorkoutDetector.swift
index 9321309424..1029bb5a05 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/WorkoutDetector.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/WorkoutDetector.swift
@@ -578,6 +578,17 @@ public enum WorkoutDetector {
 /// APPROXIMATE — not laboratory calorimetry, not medical advice.
 public enum Calories {
 
+    /// Whole-day energy split. `restingKcal` is the BMR contribution over supported sample intervals;
+    /// `activeKcal` is energy above that resting floor during supported high-HR intervals.
+    /// `totalKcal` is the backward-compatible value persisted in `DailyMetric.activeKcalEst`.
+    public struct DayEnergyEstimate: Equatable, Sendable {
+        public let restingKcal: Double
+        public let activeKcal: Double
+        public let observedSeconds: Double
+
+        public var totalKcal: Double { restingKcal + activeKcal }
+    }
+
     struct Coeffs {
         let restingAlpha: Double
         let restingWeight: Double
@@ -625,6 +636,14 @@ public enum Calories {
     /// Keytel is appropriate for a real detected/manual workout — but the day path raises
     /// the gate to 50% HRR so the gross rate only applies at genuine exercise-level HR.
     static let dayActiveHRRFraction = 0.50
+    /// Longest gap over which one daily HR reading may carry RESTING energy.
+    ///
+    /// Resting metabolism continues across a dropout, so a reading may carry the BMR rate into the gap
+    /// — but only so far, or a disconnected evening would bank a full night of resting kcal that was
+    /// never observed. ACTIVE energy is capped separately and much tighter, at the inferred cadence
+    /// (see `estimateDayEnergy`): a gap is evidence of a missing sensor, never of exercise.
+    static let dayMaxObservedGapS: Double = 60.0
+    static let dayMaxObservedSpanS: Double = 86_400.0
     static let workoutDivisor = 251.04  // 60 s/min × 4.184 kJ/kcal
 
     static func resolveCoeffs(_ sex: String) -> Coeffs {
@@ -725,10 +744,9 @@ public enum Calories {
         return (totalKcal, totalKcal * 4.184)
     }
 
-    /// APPROXIMATE whole-day total energy estimate (kcal) from the full day's HR samples.
-    /// Per-second model: below the day activeThreshold (resting + `dayActiveHRRFraction`
-    /// HRR) a sample burns the resting BMR rate, above it the Keytel active rate — FLOORED
-    /// at the resting rate so a day-second can never be credited LESS than resting metabolism.
+    /// APPROXIMATE whole-day resting + active energy estimate from the full day's HR samples.
+    /// Resting BMR is integrated once over capped, supported sample intervals, independent of HR cadence.
+    /// Supported high-HR intervals then add only the Keytel energy ABOVE that resting floor.
     ///
     /// The day path uses `dayActiveHRRFraction` (50% HRR), NOT the 30% the bout detector uses
     /// (`activeHRRFraction`). The Keytel 2005 equation is validated for genuine EXERCISE HR;
@@ -738,19 +756,21 @@ public enum Calories {
     /// the gross rate for genuine exercise-level HR only; the bout path is UNCHANGED — Keytel
     /// is appropriate there, on a real detected/manual workout.
     ///
-    /// Each HR sample = ONE second of data (1 Hz strap), counted flat — this path deliberately
-    /// does NOT use the bout estimator's elapsed-time-per-sample weighting. The day feed is a
-    /// raw, non-gap-filled union of the day's HR (it is NOT motion-gated the way a bout is), so
-    /// capping each gap at mergeGapS (150 s) would credit up to ~150 s of active burn to a
-    /// single isolated elevated sample — over-counting by ~150x on gappy days. Flat
-    /// one-second-per-sample is the conservative, stable choice for the day total.
+    /// Cadence is inferred from the median positive timestamp gap and capped at
+    /// `dayMaxObservedGapS`. Each sample carries resting energy, and a high-HR sample carries active
+    /// energy, to the next sample for at most that cap. This can credit up to 60 s instead of the old
+    /// flat 1 s for a reading on a gappy day, but never a whole disconnect. Thus a 30 s sparse stream
+    /// and a 1 Hz stream covering the same activity produce comparable energy.
+    ///
     /// This is an on-device estimate from heart rate alone — NOT laboratory calorimetry, NOT
-    /// Apple/WHOOP cloud parity, NOT medical advice. Returns total estimated kcal (>= 0).
-    public static func estimateDayCalories(_ hrSamples: [HRSample],
-                                           profile: UserProfile,
-                                           hrmax: Double?,
-                                           restingHR: Double?) -> Double {
-        if hrSamples.isEmpty { return 0.0 }
+    /// Apple/WHOOP cloud parity, NOT medical advice.
+    public static func estimateDayEnergy(_ hrSamples: [HRSample],
+                                         profile: UserProfile,
+                                         hrmax: Double?,
+                                         restingHR: Double?) -> DayEnergyEstimate {
+        if hrSamples.isEmpty {
+            return DayEnergyEstimate(restingKcal: 0, activeKcal: 0, observedSeconds: 0)
+        }
 
         let weightKg = profile.weightKg > 0 ? profile.weightKg : 70.0
         let heightCm = profile.heightCm > 0 ? profile.heightCm : 170.0
@@ -768,19 +788,61 @@ public enum Calories {
         // restingHR → base model, unchanged. Constant across the day.
         let vo2max = vo2maxFor(hrmax: effHRmax, restingHR: restingHR)
 
-        var totalKcal = 0.0
-        for s in hrSamples {
-            let bpm = Double(s.bpm)
-            if bpm < activeThreshold {
-                totalKcal += restingRate
+        // Ties are REACHABLE: hrSample is keyed (deviceId, ts) and the day feed unions devices, so a
+        // two-strap day carries two readings for the same second. Only the LAST of a tied run gets the
+        // interval (the earlier ones measure a zero gap), so tie order decides the day's active energy.
+        // Ordering ties by DESCENDING bpm hands the interval to the LOWER reading — the conservative
+        // direction for a path whose history is over-counting. Sorting on ts alone left this to the
+        // sort's stability, which Kotlin guarantees (TimSort) and Swift explicitly does not.
+        let ordered = hrSamples.sorted { $0.ts != $1.ts ? $0.ts < $1.ts : $0.bpm > $1.bpm }
+        let positiveGaps = zip(ordered, ordered.dropFirst())
+            .map { pair in Double(pair.1.ts - pair.0.ts) }
+            .filter { $0 > 0 }
+            .sorted()
+        let nominalSampleS: Double = {
+            guard !positiveGaps.isEmpty else { return 1.0 }
+            let mid = positiveGaps.count / 2
+            let median = positiveGaps.count.isMultiple(of: 2)
+                ? (positiveGaps[mid - 1] + positiveGaps[mid]) / 2.0
+                : positiveGaps[mid]
+            return min(median, dayMaxObservedGapS)
+        }()
+        let observedSeconds = min(dayMaxObservedSpanS, positiveGaps.reduce(nominalSampleS) {
+            $0 + min($1, dayMaxObservedGapS)
+        })
+        let restingKcal = restingRate * observedSeconds
+
+        var activeKcal = 0.0
+        for i in ordered.indices {
+            let durationS: Double
+            // Active carry is capped at the INFERRED CADENCE, not at the wider resting cap. A 30 s
+            // stream still carries its full 30 s (the cadence bug this fixes), and a 1 Hz day carries
+            // 1 s so the legacy total is reproduced exactly — but a dropout in an otherwise dense day
+            // no longer credits a full minute of exercise to the last reading before it. That was the
+            // objection the flat one-second model was written to avoid, and capping active at the
+            // cadence answers it rather than narrowing it from 150 s to 60 s.
+            if i < ordered.count - 1 {
+                let gap = Double(ordered[i + 1].ts - ordered[i].ts)
+                durationS = gap > 0 ? min(gap, nominalSampleS) : 0.0
             } else {
-                // Floor the active rate at the resting BMR rate: a worn day-second never burns
-                // LESS than resting metabolism, even where the Keytel value dips low for some
-                // profiles just above the gate.
-                let active = activeKcalPerS(coeffs, hr: bpm, hrmax: effHRmax, weightKg: weightKg, age: age, vo2max: vo2max)
-                totalKcal += max(restingRate, active)
+                durationS = nominalSampleS
             }
+            let bpm = Double(ordered[i].bpm)
+            guard bpm >= activeThreshold else { continue }
+            let grossRate = activeKcalPerS(coeffs, hr: bpm, hrmax: effHRmax,
+                                           weightKg: weightKg, age: age, vo2max: vo2max)
+            activeKcal += max(0.0, grossRate - restingRate) * durationS
         }
-        return totalKcal
+        return DayEnergyEstimate(restingKcal: restingKcal, activeKcal: activeKcal,
+                                 observedSeconds: observedSeconds)
+    }
+
+    /// Backward-compatible total-kcal facade for the stored daily metric.
+    public static func estimateDayCalories(_ hrSamples: [HRSample],
+                                           profile: UserProfile,
+                                           hrmax: Double?,
+                                           restingHR: Double?) -> Double {
+        estimateDayEnergy(hrSamples, profile: profile, hrmax: hrmax,
+                          restingHR: restingHR).totalKcal
     }
 }
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/DayCaloriesTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/DayCaloriesTests.swift
index 05a0691d3d..3fa2d5e5c5 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/DayCaloriesTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/DayCaloriesTests.swift
@@ -8,8 +8,8 @@ import WhoopProtocol
 /// DayCaloriesTest vectors value-for-value.
 final class DayCaloriesTests: XCTestCase {
 
-    private func hrDay(bpm: Int, n: Int) -> [HRSample] {
-        (0..<n).map { HRSample(ts: $0, bpm: bpm) }
+    private func hrDay(bpm: Int, n: Int, start: Int = 0) -> [HRSample] {
+        (0..<n).map { HRSample(ts: start + $0, bpm: bpm) }
     }
 
     func testDayCaloriesEmptyIsZero() {
@@ -18,11 +18,19 @@ final class DayCaloriesTests: XCTestCase {
             0.0, accuracy: 1e-12)
     }
 
+    func testDayEnergyEmptyComponentsAreZero() {
+        let estimate = Calories.estimateDayEnergy([], profile: UserProfile(),
+                                                  hrmax: 190.0, restingHR: 55.0)
+        XCTAssertEqual(estimate.restingKcal, 0, accuracy: 1e-12)
+        XCTAssertEqual(estimate.activeKcal, 0, accuracy: 1e-12)
+        XCTAssertEqual(estimate.totalKcal, 0, accuracy: 1e-12)
+        XCTAssertEqual(estimate.observedSeconds, 0, accuracy: 1e-12)
+    }
+
     func testDayCaloriesMatchesBoutAtOneHz() {
         // At a steady 1 Hz stream the day and bout estimators agree exactly: the bout path's
         // elapsed-time weighting caps every ~1 s interval at 1 s, so it collapses to the day
-        // path's flat one-second-per-sample. (They DIVERGE on gappy streams — see
-        // testDayPathDoesNotOverCountGappyDays — but not here.)
+        // path's flat one-second-per-sample. They diverge on gappy streams, but not here.
         let profile = UserProfile(weightKg: 80, heightCm: 180, age: 35, sex: "male")
         let hr = hrDay(bpm: 130, n: 600)  // 10 min above the active threshold, dense 1 Hz
         let day = Calories.estimateDayCalories(hr, profile: profile, hrmax: 185.0, restingHR: 55.0)
@@ -30,6 +38,22 @@ final class DayCaloriesTests: XCTestCase {
         XCTAssertEqual(day, bout, accuracy: 1e-9)
     }
 
+    func testGaplessOneHzDayMatchesLegacyTotal() {
+        // Pin the pre-change 1 Hz result so the sparse-cadence fix cannot silently move WHOOP 4
+        // totals. This mixed full day exercises both the resting floor and gross active rate.
+        let profile = UserProfile(weightKg: 80, heightCm: 180, age: 35, sex: "male")
+        let block = 8 * 3_600
+        let day = hrDay(bpm: 55, n: block)
+            + hrDay(bpm: 130, n: block, start: block)
+            + hrDay(bpm: 70, n: block, start: 2 * block)
+        let total = Calories.estimateDayCalories(day, profile: profile,
+                                                 hrmax: 185.0, restingHR: 55.0)
+        // Measured from the legacy estimator on main. Its per-sample summation differs from the
+        // new R × N association by ~6.6e-9 kcal, so keep tolerance above that rounding noise.
+        XCTAssertEqual(total, 6_774.323772067612, accuracy: 1e-6,
+                       "a gapless 1 Hz day must remain equal to the legacy estimator")
+    }
+
     func testDayCaloriesRestingDayIsLowerThanActiveDay() {
         // A whole day at resting HR burns far less than the same length all-active day,
         // and the resting-day total is positive (BMR floor).
@@ -63,9 +87,10 @@ final class DayCaloriesTests: XCTestCase {
         // that HR as resting, so a realistic mixed light day (8 h sleep @55, 8 h sedentary @70,
         // 8 h light activity @100) collapses toward BMR instead of the old runaway figure.
         let profile = UserProfile(weightKg: 80, heightCm: 180, age: 35, sex: "male")
-        let lightDay = hrDay(bpm: 55, n: 8 * 3_600)
-            + hrDay(bpm: 70, n: 8 * 3_600)
-            + hrDay(bpm: 100, n: 8 * 3_600)
+        let block = 8 * 3_600
+        let lightDay = hrDay(bpm: 55, n: block)
+            + hrDay(bpm: 70, n: block, start: block)
+            + hrDay(bpm: 100, n: block, start: 2 * block)
         let total = Calories.estimateDayCalories(lightDay, profile: profile,
                                                  hrmax: 185.0, restingHR: 55.0)
         // NEW total ≈ 1825 kcal (every second below the 120 bpm gate → BMR floor).
@@ -94,6 +119,45 @@ final class DayCaloriesTests: XCTestCase {
         XCTAssertGreaterThan(sparseKcal, denseKcal * 0.5)
     }
 
+    func testSparseDayCaloriesTrackElapsedTimeNotSampleCount() {
+        // The daily path must be cadence-invariant too: WHOOP 5/MG's ~30 s HR and a 1 Hz
+        // stream over the same ten active minutes represent the same elapsed work.
+        let profile = UserProfile(weightKg: 80, heightCm: 180, age: 35, sex: "male")
+        let dense = (0..<600).map { HRSample(ts: $0, bpm: 130) }
+        let sparse = stride(from: 0, to: 600, by: 30).map { HRSample(ts: $0, bpm: 130) }
+        let denseEnergy = Calories.estimateDayEnergy(dense, profile: profile,
+                                                     hrmax: 185.0, restingHR: 55.0)
+        let sparseEnergy = Calories.estimateDayEnergy(sparse, profile: profile,
+                                                      hrmax: 185.0, restingHR: 55.0)
+        XCTAssertEqual(sparseEnergy.observedSeconds, 600, accuracy: 1e-12)
+        XCTAssertEqual(sparseEnergy.restingKcal, denseEnergy.restingKcal, accuracy: 1e-9)
+        XCTAssertEqual(sparseEnergy.activeKcal, denseEnergy.activeKcal, accuracy: 1e-9)
+        XCTAssertEqual(sparseEnergy.totalKcal, denseEnergy.totalKcal, accuracy: 1e-9)
+    }
+
+    func testDayEnergyParityVectorOracle() {
+        let profile = UserProfile(weightKg: 80, heightCm: 180, age: 35, sex: "male")
+        let vectors = [
+            hrDay(bpm: 55, n: 86_400),
+            (0..<600).map { HRSample(ts: $0, bpm: 130) },
+            stride(from: 0, to: 600, by: 30).map { HRSample(ts: $0, bpm: 130) },
+            [HRSample(ts: 0, bpm: 130), HRSample(ts: 3600, bpm: 130)],
+        ].map { Calories.estimateDayEnergy($0, profile: profile, hrmax: 185, restingHR: 55) }
+        // Generated from the Swift implementation and copied verbatim to Android's parity test.
+        let expected: [(resting: Double, active: Double, total: Double, seconds: Double)] = [
+            (1825.247000000000, 0.000000000000, 1825.247000000000, 86_400.0),
+            (12.675326388889, 103.105766084605, 115.781092473494, 600.0),
+            (12.675326388889, 103.105766084603, 115.781092473492, 600.0),
+            (2.535065277778, 20.621153216921, 23.156218494699, 120.0),
+        ]
+        for (value, oracle) in zip(vectors, expected) {
+            XCTAssertEqual(value.restingKcal, oracle.resting, accuracy: 1e-9)
+            XCTAssertEqual(value.activeKcal, oracle.active, accuracy: 1e-9)
+            XCTAssertEqual(value.totalKcal, oracle.total, accuracy: 1e-9)
+            XCTAssertEqual(value.observedSeconds, oracle.seconds, accuracy: 1e-9)
+        }
+    }
+
     func testWearGapIsCappedNotCreditedInFull() {
         // Two active samples an hour apart must NOT credit a full hour of active burn — the
         // per-sample interval is capped at mergeGapS (150 s). The pre-gap sample contributes
@@ -108,25 +172,27 @@ final class DayCaloriesTests: XCTestCase {
                        "an inter-sample gap must be capped at mergeGapS, not credited in full")
     }
 
-    func testDayPathDoesNotOverCountGappyDays() {
-        // The WHOLE-DAY estimator must STAY on one-second-per-sample, NOT the bout path's
-        // elapsed-time weighting. The day feed is a raw, non-gap-filled union of HR, so a
-        // single isolated elevated sample an hour from its neighbours must contribute ONE
-        // second of active burn — not up to mergeGapS (150 s) of it. Two active samples an
-        // hour apart therefore burn the same as two adjacent active seconds (each = 1 s),
-        // proving the day path does NOT inherit the bout cap-and-credit behaviour.
+    func testDayPathCapsRestingAndActiveGap() {
+        // Two isolated high readings must not claim the whole hour as either resting or active
+        // energy. With the 60 s carry cap, both components cover exactly 120 supported seconds.
         let profile = UserProfile(weightKg: 80, heightCm: 180, age: 35, sex: "male")
         let gapped = [HRSample(ts: 0, bpm: 130), HRSample(ts: 3600, bpm: 130)]
-        let twoAdjacent = [HRSample(ts: 0, bpm: 130), HRSample(ts: 1, bpm: 130)]
-        let gappedDay = Calories.estimateDayCalories(gapped, profile: profile, hrmax: 185.0, restingHR: 55.0)
-        let adjacentDay = Calories.estimateDayCalories(twoAdjacent, profile: profile, hrmax: 185.0, restingHR: 55.0)
-        XCTAssertEqual(gappedDay, adjacentDay, accuracy: 1e-9,
-                       "the day path must count each sample as exactly one second regardless of gaps")
-        // Teeth: if the day path had inherited the bout cap, the gappy total would be ~75x larger
-        // (150 s + 1 s vs 1 s + 1 s of active burn). Prove it stayed flat per-sample.
-        let boutGapped = Calories.estimateBoutCalories(gapped, profile: profile, hrmax: 185.0, restingHR: 55.0).0
-        XCTAssertGreaterThan(boutGapped, gappedDay * 10,
-                             "the bout path DOES cap-and-credit, so it must dwarf the per-second day total")
+        let active120s = hrDay(bpm: 130, n: 120)
+        let active3660s = hrDay(bpm: 130, n: 3660)
+        let gapEnergy = Calories.estimateDayEnergy(gapped, profile: profile,
+                                                   hrmax: 185.0, restingHR: 55.0)
+        let shortEnergy = Calories.estimateDayEnergy(active120s, profile: profile,
+                                                     hrmax: 185.0, restingHR: 55.0)
+        let continuousEnergy = Calories.estimateDayEnergy(active3660s, profile: profile,
+                                                          hrmax: 185.0, restingHR: 55.0)
+        XCTAssertEqual(gapEnergy.observedSeconds, 120, accuracy: 1e-12)
+        XCTAssertEqual(gapEnergy.restingKcal, shortEnergy.restingKcal, accuracy: 1e-9,
+                       "a long gap must carry only 120 capped resting seconds")
+        XCTAssertEqual(gapEnergy.activeKcal, shortEnergy.activeKcal, accuracy: 1e-9,
+                       "a long gap must carry only 120 capped active seconds")
+        XCTAssertEqual(gapEnergy.totalKcal, shortEnergy.totalKcal, accuracy: 1e-9)
+        XCTAssertLessThan(gapEnergy.totalKcal, continuousEnergy.totalKcal,
+                          "a sensor gap must not be treated as continuous exercise")
     }
 
     // A timestamp safely inside UTC day 2026-01-02 (2026-01-02T12:00:00Z).
@@ -175,4 +241,43 @@ final class DayCaloriesTests: XCTestCase {
             day: dayUtc, hr: window, dayHr: window, profile: UserProfile()).daily.activeKcalEst)
         XCTAssertEqual(fallback, explicit, accuracy: 1e-9)
     }
+
+    /// A dropout in an otherwise dense day carries RESTING energy across the gap but not ACTIVE energy.
+    ///
+    /// Active duration is capped at the inferred cadence (1 s here), so the two dense blocks credit
+    /// exactly as much active energy as one continuous block of the same sample count — no magic
+    /// number, just the invariant. Resting is capped at the wider `dayMaxObservedGapS` and so DOES
+    /// grow, which is the intended asymmetry: metabolism continues across a gap, exercise is not
+    /// evidenced by one. Capping active at 60 s instead would have credited the reading before the gap
+    /// with a full minute of exercise it never demonstrated. Twin of the Kotlin test.
+    func testDropoutInADenseDayCarriesRestingButNotActive() {
+        let profile = UserProfile(weightKg: 80, heightCm: 180, age: 35, sex: "male")
+        let gapped = hrDay(bpm: 130, n: 120, start: 0) + hrDay(bpm: 130, n: 120, start: 200)
+        let continuous = hrDay(bpm: 130, n: 240)
+        let g = Calories.estimateDayEnergy(gapped, profile: profile, hrmax: 185, restingHR: 55)
+        let c = Calories.estimateDayEnergy(continuous, profile: profile, hrmax: 185, restingHR: 55)
+        XCTAssertEqual(g.activeKcal, c.activeKcal, accuracy: 1e-9,
+                       "active energy must not grow across a sensor gap")
+        XCTAssertGreaterThan(g.restingKcal, c.restingKcal, "resting energy SHOULD carry across the gap")
+        XCTAssertLessThan(g.observedSeconds, 240.0 + 81.0, "but only as far as the observed-gap cap")
+    }
+
+    /// Two readings in the same second are reachable — `hrSample` is keyed (deviceId, ts) and the day
+    /// feed unions devices, so a two-strap day has one per strap. Only the LAST of a tied run receives
+    /// the interval, so without a tiebreak the day's active energy depended on the order the feed
+    /// happened to arrive in, and on a sort stability Swift does not guarantee.
+    ///
+    /// Pinned twice: the result must not depend on input order, and a tie must hand the interval to the
+    /// LOWER reading. Twin of the Kotlin test.
+    func testTiedTimestampsAreOrderIndependentAndResolveToTheLowerReading() {
+        let profile = UserProfile(weightKg: 80, heightCm: 180, age: 35, sex: "male")
+        let tied = [HRSample(ts: 0, bpm: 150), HRSample(ts: 0, bpm: 60), HRSample(ts: 60, bpm: 60)]
+        let forward = Calories.estimateDayEnergy(tied, profile: profile, hrmax: 185, restingHR: 55)
+        let reversed = Calories.estimateDayEnergy(tied.reversed(), profile: profile, hrmax: 185, restingHR: 55)
+        XCTAssertEqual(forward.activeKcal, reversed.activeKcal, accuracy: 1e-12,
+                       "feed order must not change the day's energy")
+        XCTAssertEqual(forward.restingKcal, reversed.restingKcal, accuracy: 1e-12)
+        XCTAssertEqual(forward.activeKcal, 0.0, accuracy: 1e-12,
+                       "the tie resolves to the lower reading, so no active energy is credited")
+    }
 }
diff --git a/android/app/src/main/java/com/noop/analytics/WorkoutDetector.kt b/android/app/src/main/java/com/noop/analytics/WorkoutDetector.kt
index 55c357235b..773595d889 100644
--- a/android/app/src/main/java/com/noop/analytics/WorkoutDetector.kt
+++ b/android/app/src/main/java/com/noop/analytics/WorkoutDetector.kt
@@ -585,6 +585,15 @@ object WorkoutDetector {
  * Faithful port of the `Calories` enum that ships inside WorkoutDetector.swift.
  */
 object Calories {
+    /** Whole-day BMR + activity-above-rest split over supported sample intervals. */
+    data class DayEnergyEstimate(
+        val restingKcal: Double,
+        val activeKcal: Double,
+        val observedSeconds: Double,
+    ) {
+        val totalKcal: Double get() = restingKcal + activeKcal
+    }
+
 
     /** Sex-specific BMR + active-EE coefficients. Mirrors Swift `Calories.Coeffs`. */
     data class Coeffs(
@@ -641,6 +650,16 @@ object Calories {
      * gate to 50% HRR so the gross rate only applies at genuine exercise-level HR.
      */
     const val dayActiveHRRFraction: Double = 0.50
+    /**
+     * Longest gap over which one daily HR reading may carry RESTING energy.
+     *
+     * Resting metabolism continues across a dropout, so a reading may carry the BMR rate into the
+     * gap — but only so far, or a disconnected evening would bank a full night of resting kcal that
+     * was never observed. ACTIVE energy is capped separately and much tighter, at the inferred
+     * cadence (see [estimateDayEnergy]): a gap is evidence of a missing sensor, never of exercise.
+     */
+    const val dayMaxObservedGapS: Double = 60.0
+    const val dayMaxObservedSpanS: Double = 86_400.0
     const val workoutDivisor: Double = 251.04 // 60 s/min × 4.184 kJ/kcal
 
     fun resolveCoeffs(sex: String): Coeffs = when (sex.lowercase()) {
@@ -748,11 +767,10 @@ object Calories {
     }
 
     /**
-     * APPROXIMATE whole-day total energy estimate (kcal) from the full day's HR
-     * samples. Per-second model: below the day activeThreshold (resting +
-     * [dayActiveHRRFraction] HRR) a sample burns the resting BMR rate, above it the
-     * Keytel active rate — FLOORED at the resting rate so a day-second can never be
-     * credited LESS than resting metabolism.
+     * APPROXIMATE whole-day resting + active energy estimate from the full day's HR
+     * samples. Resting BMR is integrated once over capped, supported sample intervals,
+     * independent of HR cadence. Supported high-HR intervals then add only the Keytel
+     * energy ABOVE that resting floor.
      *
      * The day path uses [dayActiveHRRFraction] (50% HRR), NOT the 30% the bout detector
      * uses ([activeHRRFraction]). The Keytel 2005 equation is validated for genuine
@@ -763,28 +781,28 @@ object Calories {
      * exercise-level HR only; the bout path is UNCHANGED — Keytel is appropriate there,
      * on a real detected/manual workout.
      *
-     * Each HR sample = ONE second of data (1 Hz strap), counted flat — this path
-     * deliberately does NOT use the bout estimator's elapsed-time-per-sample weighting.
-     * The day feed is a raw, non-gap-filled union of the day's HR (it is NOT motion-gated
-     * the way a bout is), so capping each gap at mergeGapS (150 s) would credit up to
-     * ~150 s of active burn to a single isolated elevated sample — over-counting by ~150x
-     * on gappy days. Flat one-second-per-sample is the conservative, stable choice for the
-     * day total. This is an on-device estimate from heart rate alone — NOT laboratory
-     * calorimetry, NOT Apple/WHOOP cloud parity, NOT medical advice.
+     * Cadence is inferred from the median positive timestamp gap and capped at
+     * [dayMaxObservedGapS]. Each sample carries resting energy, and a high-HR sample carries
+     * active energy, to the next sample for at most that cap. This can credit up to 60 s
+     * instead of the old flat 1 s for a reading on a gappy day, but never a whole disconnect.
+     * Thus a 30 s sparse stream and a 1 Hz stream covering the same activity produce
+     * comparable energy.
+     *
+     * This is an on-device estimate from heart rate alone — NOT laboratory calorimetry,
+     * NOT Apple/WHOOP cloud parity, NOT medical advice.
      *
-     * @param hrSamples the whole day's HR samples (one second each).
+     * @param hrSamples the whole day's timestamped HR samples.
      * @param profile weight/height/age/sex for the BMR + active-EE coefficients.
      * @param hrmax effective HRmax (bpm); null → 220.
      * @param restingHR resting HR (bpm); null → 60.
-     * @return total estimated kcal for the day (>= 0).
      */
-    fun estimateDayCalories(
+    fun estimateDayEnergy(
         hrSamples: List<HrSample>,
         profile: UserProfile,
         hrmax: Double?,
         restingHR: Double?,
-    ): Double {
-        if (hrSamples.isEmpty()) return 0.0
+    ): DayEnergyEstimate {
+        if (hrSamples.isEmpty()) return DayEnergyEstimate(0.0, 0.0, 0.0)
 
         val weightKg = if (profile.weightKg > 0) profile.weightKg else 70.0
         val heightCm = if (profile.heightCm > 0) profile.heightCm else 170.0
@@ -802,18 +820,64 @@ object Calories {
         // restingHR → base model, unchanged. Constant across the day.
         val vo2max = vo2maxFor(effHRmax, restingHR)
 
-        var totalKcal = 0.0
-        for (s in hrSamples) {
-            val bpm = s.bpm.toDouble()
-            totalKcal += if (bpm < activeThreshold) {
-                restingRate
+        // Ties are REACHABLE: hrSample is keyed (deviceId, ts) and the day feed unions devices, so a
+        // two-strap day carries two readings for the same second. Only the LAST of a tied run gets the
+        // interval (the earlier ones measure a zero gap), so tie order decides the day's active energy.
+        // Ordering ties by DESCENDING bpm hands the interval to the LOWER reading — the conservative
+        // direction for a path whose history is over-counting. Sorting on ts alone left this to the
+        // sort's stability, which Kotlin guarantees and Swift explicitly does not.
+        val ordered = hrSamples.sortedWith(compareBy<HrSample> { it.ts }.thenByDescending { it.bpm })
+        val positiveGaps = ordered.zipWithNext { a, b -> (b.ts - a.ts).toDouble() }
+            .filter { it > 0.0 }
+            .sorted()
+        val nominalSampleS = if (positiveGaps.isEmpty()) {
+            1.0
+        } else {
+            val mid = positiveGaps.size / 2
+            val median = if (positiveGaps.size % 2 == 0) {
+                (positiveGaps[mid - 1] + positiveGaps[mid]) / 2.0
             } else {
-                // Floor the active rate at the resting BMR rate: a worn day-second never
-                // burns LESS than resting metabolism, even where the Keytel value dips low
-                // for some profiles just above the gate.
-                maxOf(restingRate, activeKcalPerS(coeffs, bpm, effHRmax, weightKg, age, vo2max))
+                positiveGaps[mid]
             }
+            minOf(median, dayMaxObservedGapS)
         }
-        return totalKcal
+        val observedSeconds = minOf(
+            dayMaxObservedSpanS,
+            positiveGaps.fold(nominalSampleS) { total, gap ->
+                total + minOf(gap, dayMaxObservedGapS)
+            },
+        )
+        val restingKcal = restingRate * observedSeconds
+
+        var activeKcal = 0.0
+        for (i in ordered.indices) {
+            // Active carry is capped at the INFERRED CADENCE, not at the wider resting cap. A 30 s
+            // stream still carries its full 30 s (the cadence bug this fixes), and a 1 Hz day carries
+            // 1 s so the legacy total is reproduced exactly — but a dropout in an otherwise dense day
+            // no longer credits a full minute of exercise to the last reading before it. That was the
+            // objection the flat one-second model was written to avoid, and capping active at the
+            // cadence answers it rather than narrowing it from 150 s to 60 s.
+            val durationS = if (i < ordered.size - 1) {
+                val gap = (ordered[i + 1].ts - ordered[i].ts).toDouble()
+                if (gap > 0.0) minOf(gap, nominalSampleS) else 0.0
+            } else {
+                nominalSampleS
+            }
+            val bpm = ordered[i].bpm.toDouble()
+            if (bpm < activeThreshold) continue
+            val grossRate = activeKcalPerS(coeffs, bpm, effHRmax, weightKg, age, vo2max)
+            activeKcal += maxOf(0.0, grossRate - restingRate) * durationS
+        }
+        return DayEnergyEstimate(restingKcal, activeKcal, observedSeconds)
+    }
+
+    /** Backward-compatible total-kcal facade for the stored daily metric. */
+    fun estimateDayCalories(
+        hrSamples: List<HrSample>,
+        profile: UserProfile,
+        hrmax: Double?,
+        restingHR: Double?,
+    ): Double {
+        return estimateDayEnergy(hrSamples, profile, hrmax, restingHR).totalKcal
     }
 }
diff --git a/android/app/src/test/java/com/noop/analytics/DayCaloriesTest.kt b/android/app/src/test/java/com/noop/analytics/DayCaloriesTest.kt
index f3873620ea..8422dd5a6e 100644
--- a/android/app/src/test/java/com/noop/analytics/DayCaloriesTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/DayCaloriesTest.kt
@@ -12,8 +12,8 @@ import org.junit.Test
  */
 class DayCaloriesTest {
 
-    private fun hrDay(bpm: Int, n: Int): List<com.noop.data.HrSample> =
-        (0 until n).map { com.noop.data.HrSample(deviceId = "test", ts = it.toLong(), bpm = bpm) }
+    private fun hrDay(bpm: Int, n: Int, start: Int = 0): List<com.noop.data.HrSample> =
+        (0 until n).map { com.noop.data.HrSample(deviceId = "test", ts = (start + it).toLong(), bpm = bpm) }
 
     @Test
     fun dayCalories_emptyIsZero() {
@@ -24,12 +24,20 @@ class DayCaloriesTest {
         )
     }
 
+    @Test
+    fun dayEnergy_emptyComponentsAreZero() {
+        val estimate = Calories.estimateDayEnergy(emptyList(), UserProfile(), hrmax = 190.0, restingHR = 55.0)
+        assertEquals(0.0, estimate.restingKcal, 1e-12)
+        assertEquals(0.0, estimate.activeKcal, 1e-12)
+        assertEquals(0.0, estimate.totalKcal, 1e-12)
+        assertEquals(0.0, estimate.observedSeconds, 1e-12)
+    }
+
     @Test
     fun dayCalories_matchesBoutAtOneHz() {
         // At a steady 1 Hz stream the day and bout estimators agree exactly: the bout path's
         // elapsed-time weighting caps every ~1 s interval at 1 s, so it collapses to the day
-        // path's flat one-second-per-sample. (They DIVERGE on gappy streams — see
-        // dayPath_doesNotOverCountGappyDays — but not here.)
+        // path's flat one-second-per-sample. They diverge on gappy streams, but not here.
         val profile = UserProfile(weightKg = 80.0, heightCm = 180.0, age = 35.0, sex = "male")
         val hr = hrDay(bpm = 130, n = 600) // 10 min above the active threshold, dense 1 Hz
         val day = Calories.estimateDayCalories(hr, profile, hrmax = 185.0, restingHR = 55.0)
@@ -37,6 +45,20 @@ class DayCaloriesTest {
         assertEquals(bout, day, 1e-9)
     }
 
+    @Test
+    fun gaplessOneHzDay_matchesLegacyTotal() {
+        // Pin the pre-change 1 Hz result so the sparse-cadence fix cannot silently move WHOOP 4
+        // totals. This mixed full day exercises both the resting floor and gross active rate.
+        val profile = UserProfile(weightKg = 80.0, heightCm = 180.0, age = 35.0, sex = "male")
+        val block = 8 * 3_600
+        val day = hrDay(55, block) + hrDay(130, block, block) + hrDay(70, block, 2 * block)
+        val total = Calories.estimateDayCalories(day, profile, hrmax = 185.0, restingHR = 55.0)
+        // Measured from the legacy estimator on main. Its per-sample summation differs from the
+        // new R × N association by ~6.6e-9 kcal, so keep tolerance above that rounding noise.
+        assertEquals("a gapless 1 Hz day must remain equal to the legacy estimator",
+            6_774.323772067612, total, 1e-6)
+    }
+
     @Test
     fun sparseHr_tracksElapsedTimeNotSampleCount() {
         // A 10-minute effort at a steady active HR, sampled two ways over the SAME ~600 s span:
@@ -54,6 +76,48 @@ class DayCaloriesTest {
         assertTrue(sparseKcal > denseKcal * 0.5)
     }
 
+    @Test
+    fun sparseDayCalories_trackElapsedTimeNotSampleCount() {
+        // The daily path must be cadence-invariant too: WHOOP 5/MG's ~30 s HR and a 1 Hz
+        // stream over the same ten active minutes represent the same elapsed work.
+        val profile = UserProfile(weightKg = 80.0, heightCm = 180.0, age = 35.0, sex = "male")
+        val dense = (0 until 600).map { com.noop.data.HrSample(deviceId = "t", ts = it.toLong(), bpm = 130) }
+        val sparse = (0 until 600 step 30).map { com.noop.data.HrSample(deviceId = "t", ts = it.toLong(), bpm = 130) }
+        val denseEnergy = Calories.estimateDayEnergy(dense, profile, hrmax = 185.0, restingHR = 55.0)
+        val sparseEnergy = Calories.estimateDayEnergy(sparse, profile, hrmax = 185.0, restingHR = 55.0)
+        assertEquals(600.0, sparseEnergy.observedSeconds, 1e-12)
+        assertEquals(denseEnergy.restingKcal, sparseEnergy.restingKcal, 1e-9)
+        assertEquals(denseEnergy.activeKcal, sparseEnergy.activeKcal, 1e-9)
+        assertEquals(denseEnergy.totalKcal, sparseEnergy.totalKcal, 1e-9)
+    }
+
+    @Test
+    fun dayEnergy_parityVectorOracle() {
+        val profile = UserProfile(weightKg = 80.0, heightCm = 180.0, age = 35.0, sex = "male")
+        val vectors = listOf(
+            hrDay(55, 86_400),
+            (0 until 600).map { com.noop.data.HrSample(deviceId = "t", ts = it.toLong(), bpm = 130) },
+            (0 until 600 step 30).map { com.noop.data.HrSample(deviceId = "t", ts = it.toLong(), bpm = 130) },
+            listOf(
+                com.noop.data.HrSample(deviceId = "t", ts = 0L, bpm = 130),
+                com.noop.data.HrSample(deviceId = "t", ts = 3600L, bpm = 130),
+            ),
+        ).map { Calories.estimateDayEnergy(it, profile, hrmax = 185.0, restingHR = 55.0) }
+        // Generated by the Swift twin's testDayEnergyParityVectorOracle.
+        val expected = listOf(
+            doubleArrayOf(1825.247000000000, 0.000000000000, 1825.247000000000, 86_400.0),
+            doubleArrayOf(12.675326388889, 103.105766084605, 115.781092473494, 600.0),
+            doubleArrayOf(12.675326388889, 103.105766084603, 115.781092473492, 600.0),
+            doubleArrayOf(2.535065277778, 20.621153216921, 23.156218494699, 120.0),
+        )
+        vectors.zip(expected).forEach { (value, oracle) ->
+            assertEquals(oracle[0], value.restingKcal, 1e-9)
+            assertEquals(oracle[1], value.activeKcal, 1e-9)
+            assertEquals(oracle[2], value.totalKcal, 1e-9)
+            assertEquals(oracle[3], value.observedSeconds, 1e-9)
+        }
+    }
+
     @Test
     fun wearGap_isCappedNotCreditedInFull() {
         // Two active samples an hour apart must NOT credit a full hour of active burn — the
@@ -73,31 +137,25 @@ class DayCaloriesTest {
     }
 
     @Test
-    fun dayPath_doesNotOverCountGappyDays() {
-        // The WHOLE-DAY estimator must STAY on one-second-per-sample, NOT the bout path's
-        // elapsed-time weighting. The day feed is a raw, non-gap-filled union of HR, so a
-        // single isolated elevated sample an hour from its neighbours must contribute ONE
-        // second of active burn — not up to mergeGapS (150 s) of it. Two active samples an
-        // hour apart therefore burn the same as two adjacent active seconds (each = 1 s),
-        // proving the day path does NOT inherit the bout cap-and-credit behaviour.
+    fun dayPath_capsRestingAndActiveGap() {
+        // Two isolated high readings must not claim the whole hour as either resting or active
+        // energy. With the 60 s carry cap, both components cover exactly 120 supported seconds.
         val profile = UserProfile(weightKg = 80.0, heightCm = 180.0, age = 35.0, sex = "male")
         val gapped = listOf(
             com.noop.data.HrSample(deviceId = "t", ts = 0L, bpm = 130),
             com.noop.data.HrSample(deviceId = "t", ts = 3600L, bpm = 130),
         )
-        val twoAdjacent = listOf(
-            com.noop.data.HrSample(deviceId = "t", ts = 0L, bpm = 130),
-            com.noop.data.HrSample(deviceId = "t", ts = 1L, bpm = 130),
-        )
-        val gappedDay = Calories.estimateDayCalories(gapped, profile, hrmax = 185.0, restingHR = 55.0)
-        val adjacentDay = Calories.estimateDayCalories(twoAdjacent, profile, hrmax = 185.0, restingHR = 55.0)
-        assertEquals("the day path must count each sample as exactly one second regardless of gaps",
-            adjacentDay, gappedDay, 1e-9)
-        // Teeth: if the day path had inherited the bout cap, the gappy total would be ~75x larger
-        // (150 s + 1 s vs 1 s + 1 s of active burn). Prove it stayed flat per-sample.
-        val boutGapped = Calories.estimateBoutCalories(gapped, profile, hrmax = 185.0, restingHR = 55.0).first
-        assertTrue("the bout path DOES cap-and-credit, so it must dwarf the per-second day total",
-            boutGapped > gappedDay * 10)
+        val gapEnergy = Calories.estimateDayEnergy(gapped, profile, hrmax = 185.0, restingHR = 55.0)
+        val shortEnergy = Calories.estimateDayEnergy(hrDay(130, 120), profile, hrmax = 185.0, restingHR = 55.0)
+        val continuousEnergy = Calories.estimateDayEnergy(hrDay(130, 3660), profile, hrmax = 185.0, restingHR = 55.0)
+        assertEquals(120.0, gapEnergy.observedSeconds, 1e-12)
+        assertEquals("a long gap must carry only 120 capped resting seconds",
+            shortEnergy.restingKcal, gapEnergy.restingKcal, 1e-9)
+        assertEquals("a long gap must carry only 120 capped active seconds",
+            shortEnergy.activeKcal, gapEnergy.activeKcal, 1e-9)
+        assertEquals(shortEnergy.totalKcal, gapEnergy.totalKcal, 1e-9)
+        assertTrue("a sensor gap must not be treated as continuous exercise",
+            gapEnergy.totalKcal < continuousEnergy.totalKcal)
     }
 
     @Test
@@ -133,7 +191,8 @@ class DayCaloriesTest {
         // that HR as resting, so a realistic mixed light day (8 h sleep @55, 8 h sedentary @70,
         // 8 h light activity @100) collapses toward BMR instead of the old runaway figure.
         val profile = UserProfile(weightKg = 80.0, heightCm = 180.0, age = 35.0, sex = "male")
-        val lightDay = hrDay(55, 8 * 3_600) + hrDay(70, 8 * 3_600) + hrDay(100, 8 * 3_600)
+        val block = 8 * 3_600
+        val lightDay = hrDay(55, block) + hrDay(70, block, block) + hrDay(100, block, 2 * block)
         val total = Calories.estimateDayCalories(lightDay, profile, hrmax = 185.0, restingHR = 55.0)
         // NEW total ≈ 1825 kcal (every second below the 120 bpm gate → BMR floor).
         assertEquals("a light-activity day must land near BMR, not the old inflated total",
@@ -199,4 +258,51 @@ class DayCaloriesTest {
         assertNotNull(explicit)
         assertEquals(fallback!!, explicit!!, 1e-9)
     }
+
+    /**
+     * A dropout in an otherwise dense day carries RESTING energy across the gap but not ACTIVE energy.
+     *
+     * Active duration is capped at the inferred cadence (1 s here), so the two dense blocks credit
+     * exactly as much active energy as one continuous block of the same sample count — no magic
+     * number, just the invariant. Resting is capped at the wider [Calories.dayMaxObservedGapS] and so
+     * DOES grow, which is the intended asymmetry: metabolism continues across a gap, exercise is not
+     * evidenced by one. Capping active at 60 s instead would have credited the reading before the gap
+     * with a full minute of exercise it never demonstrated.
+     */
+    @Test
+    fun dropoutInADenseDayCarriesRestingButNotActive() {
+        val profile = UserProfile(weightKg = 80.0, heightCm = 180.0, age = 35.0, sex = "male")
+        val gapped = hrDay(130, 120, start = 0) + hrDay(130, 120, start = 200)   // 81 s dropout
+        val continuous = hrDay(130, 240)
+        val g = Calories.estimateDayEnergy(gapped, profile, hrmax = 185.0, restingHR = 55.0)
+        val c = Calories.estimateDayEnergy(continuous, profile, hrmax = 185.0, restingHR = 55.0)
+        assertEquals("active energy must not grow across a sensor gap", c.activeKcal, g.activeKcal, 1e-9)
+        assertTrue("resting energy SHOULD carry across the gap", g.restingKcal > c.restingKcal)
+        assertTrue("but only as far as the observed-gap cap", g.observedSeconds < 240.0 + 81.0)
+    }
+
+    /**
+     * Two readings in the same second are reachable — `hrSample` is keyed (deviceId, ts) and the day
+     * feed unions devices, so a two-strap day has one per strap. Only the LAST of a tied run receives
+     * the interval, so without a tiebreak the day's active energy depended on the order the feed
+     * happened to arrive in, and on a sort stability Swift does not guarantee.
+     *
+     * Pinned twice: the result must not depend on input order, and a tie must hand the interval to the
+     * LOWER reading (so a lone elevated duplicate cannot claim the following minute as exercise).
+     */
+    @Test
+    fun tiedTimestampsAreOrderIndependentAndResolveToTheLowerReading() {
+        val profile = UserProfile(weightKg = 80.0, heightCm = 180.0, age = 35.0, sex = "male")
+        val tied = listOf(
+            com.noop.data.HrSample(deviceId = "a", ts = 0L, bpm = 150),
+            com.noop.data.HrSample(deviceId = "b", ts = 0L, bpm = 60),
+            com.noop.data.HrSample(deviceId = "b", ts = 60L, bpm = 60),
+        )
+        val forward = Calories.estimateDayEnergy(tied, profile, hrmax = 185.0, restingHR = 55.0)
+        val reversed = Calories.estimateDayEnergy(tied.reversed(), profile, hrmax = 185.0, restingHR = 55.0)
+        assertEquals("feed order must not change the day's energy", forward.activeKcal, reversed.activeKcal, 1e-12)
+        assertEquals(forward.restingKcal, reversed.restingKcal, 1e-12)
+        assertEquals("the tie resolves to the lower reading, so no active energy is credited",
+            0.0, forward.activeKcal, 1e-12)
+    }
 }

From 435842a6ad16896a4e1932952872e01d4d20f6e5 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 5 Sep 2026 01:28:07 +1200
Subject: [PATCH 237/333] connection: split the banked line by PATH, so it says
 something (#1882)

The banked line merged yesterday counted LIVE inserts only, then named gravity,
resp, skinTemp, spo2 and steps when they were zero. Those five arrive solely
through the offload's historical decoder - extractStreams, the realtime decoder,
yields hr, rr, events and battery and nothing else. So the call-out printed on
every link, bonded or not: a constant wearing the costume of a finding. A field
log showed exactly that, and it was misread as the bond split it was built to
show.

The narrowing that caused it was mine. An earlier review pass scoped the line to
live-only to stop it crying wolf on healthy offloads, which removed the false
positive by deleting the true one. Eleven tests over synthetic values passed
either way, because none encoded which path feeds which stream.

Both paths are counted now, reported as facts rather than verdicts:

  live hr=12 rr=7 | offload none
  live hr=1 rr=1  | offload ran 6 chunk(s), no new rows
  live hr=3 rr=2  | offload hr=1200 rr=2400 gravity=8000 resp=8000 ...

Three distinguishable states. The offload is where the bond shows, since an
unbonded strap defers backfill entirely - but "offload none" is left as a fact
next to the epitaph's uptime rather than an accusation, because a short or
command-only link legitimately never reaches backfill, and
StalledLinkDiagnostics already logs the real reason with more evidence than this
line has.

Backfiller hands its accepted-row counts up through an onBankedOffload closure
on both platforms, following the ackTrim closure already beside it, defaulted so
every existing construction is unchanged.

Battery is gone from the line: it rides the standard 0x2A19 profile, banks with
or without the bond, and its dominant persist path is not one of the counted
inserts, so it read 0 on every link and sat permanently in the call-out - a
field log showed 306 battery banks against battery=0.

Four review passes found four defects here, every one the same shape: a zero
that looks like a finding. Live-only scoping, battery, dedupe reading as
failure, and finally a verdict on a link too short to have run an offload. The
question that catches the class, now asked of every field, is whether a value
can be zero while everything is fine.

Parity: formatter signature, output streams, all four sentences, the callback,
the chunk counter, the tallies and their reset points, and 7 tests each. One
deliberate difference - Kotlin passes a real offloadSteps count, Apple passes
nil, because Apple's insert returns eight fields and excludes steps while Room
counts them. Absent beats a permanent steps=0. Concurrency differs on purpose
and is verified on both sides: atomics on Kotlin, plain vars on Apple where
Collector, Backfiller and BLEManager are all @MainActor.

Verified: 631 classes / 5187 tests / 0 failures, five CI workflows green.
NOT verified on a device for the offload half - that needs a strap which
actually syncs history, which the reporting strap cannot currently do.
---
 .../StrandAnalytics/ConnectionReadout.swift   |  76 ++++++------
 .../LinkBankedSummaryTests.swift              |  80 +++++++------
 Strand/BLE/BLEManager.swift                   |  54 +++++----
 Strand/Collect/Backfiller.swift               |  14 ++-
 .../com/noop/analytics/ConnectionReadout.kt   |  84 ++++++++------
 .../src/main/java/com/noop/ble/Backfiller.kt  |   9 ++
 .../main/java/com/noop/ble/WhoopBleClient.kt  |  80 +++++++------
 .../noop/analytics/LinkBankedSummaryTest.kt   | 109 ++++++++++--------
 8 files changed, 296 insertions(+), 210 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift
index 188a2c1099..fdbc332703 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/ConnectionReadout.swift
@@ -302,46 +302,54 @@ public enum ConnectionReadout {
         return line
     }
 
-    /// #1635: which STREAMS banked rows on a finished link, beside `linkEpitaph`'s "did anything arrive".
+    /// #1635: what a finished link actually stored, split by PATH.
     ///
-    /// The epitaph counts frames, which is the right measure for a silent strap and the wrong one for a
-    /// strap talking over only part of its surface: an unbonded 5/MG streams heart rate and R-R over the
-    /// standard profile all night while every bond-gated stream banks nothing, and the epitaph reports
-    /// that as hundreds of healthy inbound frames. A field diagnosis had to establish the split by
-    /// exporting twice, hours apart, and diffing stored row counts by hand.
+    /// The epitaph counts frames, which is right for a silent strap and wrong for one talking over only
+    /// part of its surface: an unbonded 5/MG streams heart rate and R-R all night while nothing
+    /// bond-gated lands, and the epitaph reports hundreds of healthy inbound frames.
     ///
-    /// Zero-banking streams are named rather than left to be inferred, because "gravity=0 among six other
-    /// zeros" and "gravity=0 while hr=456" read identically and mean opposite things. Counts are ROWS
-    /// ACCEPTED, so a stream arriving as duplicates reads zero and is named — correct here: the question
-    /// is what the database gained on this link.
+    /// The split must be by PATH, not by stream. The realtime decoder produces only hr, rr, events and
+    /// battery; gravity, respiratory, skin temperature, SpO2 and steps arrive solely through the
+    /// historical decoder behind the offload. A live-only tally therefore printed "nothing banked live
+    /// for: gravity, resp, …" on EVERY link, bonded or not — a constant dressed as a finding.
     ///
-    /// LIVE streams only, and the sentence says so. The history offload persists through its own path and
-    /// already has its own accounting; counting one and labelling it "this link" would make every healthy
-    /// bonded sync read as "nothing banked for: gravity" — the false alarm this line exists to prevent.
+    /// The offload is where the bond shows: an unbonded strap defers backfill entirely, so `offload none`
+    /// is the real signal and a healthy sync fills it.
     ///
-    /// Pure and total, and every count clamped, so it cannot become the reason a teardown path throws.
-    /// Twin of the Kotlin formatter. Apple does not emit it yet; the formatter exists so the two logs
-    /// cannot drift apart when it does.
-    /// `steps` is OPTIONAL because this platform's store does not return a step count at all — steps are
-    /// persist-only here, deliberately outside the 8-field insert tuple, while Room counts them. A
-    /// platform that cannot measure a stream must OMIT it rather than report zero: "banked nothing" is a
-    /// finding and "not measured here" is not, and printing the second as the first would put a permanent
-    /// false alarm in every Apple link's log.
-    public static func linkBankedSummary(hr: Int, rr: Int, gravity: Int, resp: Int,
-                                         skinTemp: Int, spo2: Int, steps: Int?, battery: Int) -> String {
+    /// Battery is absent on purpose — it rides the standard 0x2A19 profile and banks with or without the
+    /// bond. `offloadSteps` is optional: a platform that cannot measure a stream omits it rather than
+    /// reporting a zero that reads as a fault. Counts are rows ACCEPTED. Pure, total and clamped.
+    /// Twin of the Kotlin formatter.
+    public static func linkBankedSummary(liveHr: Int, liveRr: Int, offloadChunks: Int,
+                                         offloadHr: Int, offloadRr: Int, offloadGravity: Int,
+                                         offloadResp: Int, offloadSkinTemp: Int, offloadSpo2: Int,
+                                         offloadSteps: Int?) -> String {
+        let live = "live hr=\(max(0, liveHr)) rr=\(max(0, liveRr))"
         var raw: [(String, Int)] = [
-            ("hr", hr), ("rr", rr), ("gravity", gravity), ("resp", resp),
-            ("skinTemp", skinTemp), ("spo2", spo2),
+            ("hr", offloadHr), ("rr", offloadRr), ("gravity", offloadGravity), ("resp", offloadResp),
+            ("skinTemp", offloadSkinTemp), ("spo2", offloadSpo2),
         ]
-        if let steps { raw.append(("steps", steps)) }
-        raw.append(("battery", battery))
-        let pairs: [(String, Int)] = raw.map { ($0.0, max(0, $0.1)) }
-        let body = pairs.map { "\($0.0)=\($0.1)" }.joined(separator: " ")
-        let total = pairs.reduce(0) { $0 + $1.1 }
-        if total == 0 { return "banked live this link: \(body) - NOTHING was stored from the live streams" }
-        let empty = pairs.filter { $0.1 == 0 }.map { $0.0 }
-        if empty.isEmpty { return "banked live this link: \(body)" }
-        return "banked live this link: \(body) - nothing banked live for: \(empty.joined(separator: ", "))"
+        if let offloadSteps { raw.append(("steps", offloadSteps)) }
+        let offload = raw.map { ($0.0, max(0, $0.1)) }
+        let total = offload.reduce(0) { $0 + $1.1 }
+        // Three states, reported as FACTS rather than verdicts. "No chunks" is not evidence of a fault on
+        // its own: a short or command-only link never reaches backfill, and the reason is already logged
+        // beside it. The epitaph supplies the uptime a reader needs to weigh it.
+        //
+        // "Never ran" and "ran with nothing new" are still DIFFERENT. Rows are counted as ACCEPTED, so
+        // a reconnect re-offloading already-stored records banks zero while the strap plainly handed its
+        // history over. Only the first case speaks to the bond.
+        if (max(0, offloadChunks)) == 0 {
+            return "banked this link: \(live) | offload none"
+        }
+        if total == 0 {
+            return "banked this link: \(live) | offload ran \(max(0, offloadChunks)) chunk(s), no new rows"
+        }
+        let body = offload.map { "\($0.0)=\($0.1)" }.joined(separator: " ")
+        let empty = offload.filter { $0.1 == 0 }.map { $0.0 }
+        if empty.isEmpty { return "banked this link: \(live) | offload \(body)" }
+        return "banked this link: \(live) | offload \(body)"
+            + " - nothing banked from the offload for: \(empty.joined(separator: ", "))"
     }
 
     /// #987: freshness label for the "last frame" readout row: how long ago the most recent strap frame
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LinkBankedSummaryTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LinkBankedSummaryTests.swift
index 1d5b10cb29..7a806e850d 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LinkBankedSummaryTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LinkBankedSummaryTests.swift
@@ -1,57 +1,61 @@
 import XCTest
 @testable import StrandAnalytics
 
-/// #1635: the per-link banked-rows line, the database-side companion to `linkEpitaph`.
+/// #1635: the per-link banked line, split by PATH. Byte-identical twin of the Kotlin
+/// `LinkBankedSummaryTest`, including the exact sentences.
 ///
-/// Byte-identical twin of the Kotlin `LinkBankedSummaryTest`. The case it exists for: an unbonded 5/MG
-/// streams heart rate and R-R over the standard profile while every bond-gated stream banks nothing, and
-/// the epitaph reports that link as hundreds of healthy inbound frames.
+/// The split is by path rather than by stream because the realtime decoder yields only
+/// hr/rr/events/battery — gravity, respiratory, skin temperature, SpO2 and steps arrive solely through
+/// the offload. An earlier live-only version named those five as empty on EVERY link, bonded or not.
 final class LinkBankedSummaryTests: XCTestCase {
 
-    func testNamesTheStreamsThatBankedNothingWhenOthersDid() {
-        let line = ConnectionReadout.linkBankedSummary(
-            hr: 456, rr: 187, gravity: 0, resp: 0, skinTemp: 0, spo2: 0, steps: 0, battery: 2)
-        XCTAssertTrue(line.contains("hr=456"))
-        XCTAssertTrue(line.contains("gravity=0"))
-        XCTAssertTrue(line.contains("nothing banked live for: gravity, resp, skinTemp, spo2, steps"))
+    private func line(liveHr: Int = 0, liveRr: Int = 0, chunks: Int = 0, oHr: Int = 0, oRr: Int = 0,
+                      oGrav: Int = 0, oResp: Int = 0, oSkin: Int = 0, oSpo2: Int = 0,
+                      oSteps: Int? = 0) -> String {
+        ConnectionReadout.linkBankedSummary(
+            liveHr: liveHr, liveRr: liveRr, offloadChunks: chunks,
+            offloadHr: oHr, offloadRr: oRr, offloadGravity: oGrav,
+            offloadResp: oResp, offloadSkinTemp: oSkin, offloadSpo2: oSpo2, offloadSteps: oSteps)
     }
 
-    func testAFullyHealthyLinkGetsNoCallOut() {
-        let line = ConnectionReadout.linkBankedSummary(
-            hr: 400, rr: 380, gravity: 900, resp: 900, skinTemp: 900, spo2: 900, steps: 12, battery: 3)
-        XCTAssertTrue(line.hasPrefix("banked live this link:"))
-        XCTAssertFalse(line.contains("nothing banked live for"))
+    func testAnUnbondedStrapReadsLiveTrafficWithAnOffloadThatNeverRan() {
+        XCTAssertEqual(
+            line(liveHr: 12, liveRr: 7, chunks: 0),
+            "banked this link: live hr=12 rr=7 | offload none")
     }
 
-    func testALinkThatStoredNothingSaysSoOnce() {
-        let line = ConnectionReadout.linkBankedSummary(
-            hr: 0, rr: 0, gravity: 0, resp: 0, skinTemp: 0, spo2: 0, steps: 0, battery: 0)
-        XCTAssertTrue(line.contains("NOTHING was stored from the live streams"))
-        XCTAssertFalse(line.contains("nothing banked live for"))
+    func testAHealthySyncReadsCompletelyDifferently() {
+        let healthy = line(liveHr: 3, liveRr: 2, chunks: 9, oHr: 1200, oRr: 2400, oGrav: 8000,
+                           oResp: 8000, oSkin: 8000, oSpo2: 8000, oSteps: 40)
+        XCTAssertEqual(healthy,
+            "banked this link: live hr=3 rr=2 | offload hr=1200 rr=2400 gravity=8000 resp=8000"
+                + " skinTemp=8000 spo2=8000 steps=40")
+        XCTAssertFalse(healthy.contains("nothing banked"))
     }
 
-    func testNegativeCountsCannotLeakIntoADiagnostic() {
-        let line = ConnectionReadout.linkBankedSummary(
-            hr: -5, rr: 1, gravity: 0, resp: 0, skinTemp: 0, spo2: 0, steps: 0, battery: 0)
-        XCTAssertTrue(line.contains("hr=0"))
-        XCTAssertFalse(line.contains("-5"))
+    func testAPartialOffloadNamesOnlyTheStreamsThatStayedEmpty() {
+        let l = line(liveHr: 1, chunks: 4, oHr: 500, oRr: 900, oGrav: 0, oResp: 0, oSkin: 700, oSpo2: 700)
+        XCTAssertTrue(l.contains("nothing banked from the offload for: gravity, resp, steps"))
     }
 
-    /// The two platforms must produce the SAME sentence, since a report may come from either.
-    func testTheExactSentenceForTheFieldCase() {
-        XCTAssertEqual(
-            ConnectionReadout.linkBankedSummary(
-                hr: 456, rr: 187, gravity: 0, resp: 0, skinTemp: 0, spo2: 0, steps: 0, battery: 2),
-            "banked live this link: hr=456 rr=187 gravity=0 resp=0 skinTemp=0 spo2=0 steps=0 battery=2"
-                + " - nothing banked live for: gravity, resp, skinTemp, spo2, steps")
+    func testAStreamThisPlatformCannotMeasureIsOmittedNotZero() {
+        XCTAssertFalse(line(liveHr: 5, chunks: 1, oHr: 10, oSteps: nil).contains("steps"))
     }
 
+    func testBatteryNeverAppearsOnEitherPath() {
+        XCTAssertFalse(line(liveHr: 9, chunks: 1, oHr: 9).contains("battery"))
+    }
 
-    /// Apple's store does not return a step count, so the line must omit steps rather than print zero.
-    func testAStreamThisPlatformCannotMeasureIsOmittedNotZero() {
-        let line = ConnectionReadout.linkBankedSummary(
-            hr: 456, rr: 187, gravity: 0, resp: 0, skinTemp: 0, spo2: 0, steps: nil, battery: 2)
-        XCTAssertFalse(line.contains("steps"), "an unmeasured stream must not appear at all")
-        XCTAssertTrue(line.contains("nothing banked live for: gravity, resp, skinTemp, spo2"))
+    func testNegativeCountsCannotLeakIntoADiagnostic() {
+        let l = line(liveHr: -5, liveRr: 1, chunks: 2, oHr: -3, oGrav: 4)
+        XCTAssertTrue(l.contains("live hr=0 rr=1"))
+        XCTAssertFalse(l.contains("-3"))
+    }
+
+    /// Twin of the Kotlin case: "never ran" and "ran with nothing new" are different findings.
+    func testAnOffloadThatRanWithNothingNewIsADifferentFinding() {
+        XCTAssertEqual(line(liveHr: 1, liveRr: 1, chunks: 6),
+                       "banked this link: live hr=1 rr=1 | offload ran 6 chunk(s), no new rows")
+        XCTAssertTrue(line(liveHr: 1, liveRr: 1, chunks: 0).contains("offload none"))
     }
 }
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index acb7657aa5..c5d923eb10 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -732,17 +732,21 @@ public final class BLEManager: NSObject, ObservableObject {
     private var inboundFrames = 0
     private var inboundBytes = 0
     private var cmdChannelFrames = 0
-    /// #1635: rows ACCEPTED per stream on this link — the database-side companion to the three above.
-    /// The epitaph counts frames, which reads healthy on an unbonded 5/MG streaming heart rate over the
-    /// standard profile while every bond-gated stream banks nothing. Cleared with them, so they describe
-    /// THIS link. Plain vars like their neighbours: `Collector` hands them up on the main actor.
-    private var bankedHr = 0
-    private var bankedRr = 0
-    private var bankedGravity = 0
-    private var bankedResp = 0
-    private var bankedSkinTemp = 0
-    private var bankedSpo2 = 0
-    private var bankedBattery = 0
+    /// #1635: rows ACCEPTED on this link, split by PATH. The realtime decoder yields only hr/rr/events/
+    /// battery; gravity, resp, skinTemp, SpO2 and steps arrive solely through the offload, so counting one
+    /// path and naming streams from the other prints a constant rather than a finding. Cleared with the
+    /// frame counters. Plain vars like their neighbours: both feeders hand up on the main actor.
+    private var liveHr = 0
+    private var liveRr = 0
+    private var offloadHr = 0
+    private var offloadRr = 0
+    private var offloadGravity = 0
+    private var offloadResp = 0
+    private var offloadSkinTemp = 0
+    private var offloadSpo2 = 0
+    /// Chunks the offload actually persisted on this link — separates "never ran" from "nothing new".
+    private var offloadChunks = 0
+
     /// Uptime clock for the epitaph. Monotonic, so a wall-clock change mid-link cannot make it negative.
     private var linkUpSince: DispatchTime?
     /// Last time ANY notification arrived — drives the liveness watchdog.
@@ -1357,11 +1361,8 @@ public final class BLEManager: NSObject, ObservableObject {
                               enableRawCapture: enableRawCapture,
                               log: { [weak self] line in self?.log(line) },
                               onBanked: { [weak self] c in
-                                  guard let self else { return }
-                                  self.bankedHr += c.hr; self.bankedRr += c.rr
-                                  self.bankedGravity += c.gravity; self.bankedResp += c.resp
-                                  self.bankedSkinTemp += c.skinTemp; self.bankedSpo2 += c.spo2
-                                  self.bankedBattery += c.battery
+                                  // Live path: hr/rr are all the realtime decoder yields.
+                                  self?.liveHr += c.hr; self?.liveRr += c.rr
                               })
         // The store can finish bootstrapping AFTER connect(model:) already ran (both wait on
         // poweredOn), so apply the family/clock configuration here too — whichever runs last wins.
@@ -1370,6 +1371,13 @@ public final class BLEManager: NSObject, ObservableObject {
                                 ackTrim: { [weak self] trim, endData in
                                     self?.ackHistoricalChunk(trim: trim, endData: endData)
                                 },
+                                onBankedOffload: { [weak self] c in
+                                    guard let self else { return }
+                                    self.offloadChunks += 1
+                                    self.offloadHr += c.hr; self.offloadRr += c.rr
+                                    self.offloadGravity += c.gravity; self.offloadResp += c.resp
+                                    self.offloadSkinTemp += c.skinTemp; self.offloadSpo2 += c.spo2
+                                },
                                 enableRawCapture: enableRawCapture,
                                 log: { [weak self] s in self?.log(s) },
                                 rejectedSink: { [weak self] frames, trim, family in
@@ -5262,8 +5270,8 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
         // #1635: same guarantee for the banked tally. Clearing only on teardown would be enough if every
         // link ended in one, and a link that begins without a preceding clean teardown would otherwise
         // open holding the previous link's rows — reporting them as banked on a link that never saw them.
-        bankedHr = 0; bankedRr = 0; bankedGravity = 0; bankedResp = 0
-        bankedSkinTemp = 0; bankedSpo2 = 0; bankedBattery = 0
+        liveHr = 0; liveRr = 0; offloadHr = 0; offloadRr = 0
+        offloadGravity = 0; offloadResp = 0; offloadSkinTemp = 0; offloadSpo2 = 0; offloadChunks = 0
         linkUpSince = DispatchTime.now()
         standingConnectAt = nil     // #1413: a live link means no standing connect is outstanding
         restoredPeripheral = nil
@@ -5426,14 +5434,16 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
             // accounting, so folding it in would make a healthy bonded sync read as "nothing banked live
             // for: gravity". Inside the same `linkUpSince` guard for the same reason the epitaph is.
             log(ConnectionReadout.linkBankedSummary(
-                hr: bankedHr, rr: bankedRr, gravity: bankedGravity, resp: bankedResp,
+                liveHr: liveHr, liveRr: liveRr, offloadChunks: offloadChunks,
+                offloadHr: offloadHr, offloadRr: offloadRr, offloadGravity: offloadGravity,
+                offloadResp: offloadResp, offloadSkinTemp: offloadSkinTemp, offloadSpo2: offloadSpo2,
                 // nil, not 0: this store does not return a step count, and a zero would read as a fault.
-                skinTemp: bankedSkinTemp, spo2: bankedSpo2, steps: nil, battery: bankedBattery))
+                offloadSteps: nil))
         }
         // Clear the tally with the link, so a second teardown for the same drop cannot re-report it.
         inboundFrames = 0; inboundBytes = 0; cmdChannelFrames = 0
-        bankedHr = 0; bankedRr = 0; bankedGravity = 0; bankedResp = 0
-        bankedSkinTemp = 0; bankedSpo2 = 0; bankedBattery = 0
+        liveHr = 0; liveRr = 0; offloadHr = 0; offloadRr = 0
+        offloadGravity = 0; offloadResp = 0; offloadSkinTemp = 0; offloadSpo2 = 0; offloadChunks = 0
         linkUpSince = nil
 
         let timedOut = !intentionalDisconnect && error != nil
diff --git a/Strand/Collect/Backfiller.swift b/Strand/Collect/Backfiller.swift
index 4fce4af55d..69fb2fb8e0 100644
--- a/Strand/Collect/Backfiller.swift
+++ b/Strand/Collect/Backfiller.swift
@@ -48,6 +48,11 @@ final class Backfiller {
     /// of end_data, used for the `strap_trim` cursor) and the 8-byte `end_data` (= the raw
     /// HISTORY_END metadata.data[10:18]) that the high-freq-sync ack form requires verbatim.
     private let ackTrim: (_ trim: UInt32, _ endData: [UInt8]) -> Void
+    /// #1635: one offload chunk's accepted-row counts, handed up so `BLEManager` can tally them per LINK.
+    /// The offload is the only path that banks gravity/resp/skinTemp/SpO2/steps, so a link summary
+    /// without it cannot tell an unbonded strap — which defers backfill — from a healthy one.
+    private let onBankedOffload: (_ counts: (hr: Int, rr: Int, events: Int, battery: Int,
+                                             spo2: Int, skinTemp: Int, resp: Int, gravity: Int)) -> Void
     private let extract: Extractor
     /// Research toggle. When false (DEFAULT) no raw frames are persisted — the chunk's
     /// decoded streams are still durable and the trim is still acked (decoded is the product of
@@ -209,6 +214,9 @@ final class Backfiller {
     init(store: BackfillStoreWriting,
          deviceId: String,
          ackTrim: @escaping (_ trim: UInt32, _ endData: [UInt8]) -> Void,
+         onBankedOffload: @escaping (_ counts: (hr: Int, rr: Int, events: Int, battery: Int,
+                                                spo2: Int, skinTemp: Int, resp: Int,
+                                                gravity: Int)) -> Void = { _ in },
          enableRawCapture: Bool = false,
          log: ((String) -> Void)? = nil,
          rejectedSink: ((_ frames: [[UInt8]], _ trim: UInt32, _ family: DeviceFamily) -> Bool)? = nil,
@@ -225,6 +233,7 @@ final class Backfiller {
         self.store = store
         self.deviceId = deviceId
         self.ackTrim = ackTrim
+        self.onBankedOffload = onBankedOffload
         self.enableRawCapture = enableRawCapture
         self.log = log
         self.rejectedSink = rejectedSink
@@ -706,7 +715,10 @@ final class Backfiller {
             // emission can be measured, since every existing R-R number is taken after the ON CONFLICT key
             // has already absorbed part of it.
             let rrCensus = RrEmissionStats.compute(decoded.rr.map { (ts: $0.ts, rrMs: $0.rrMs) })
-            do { counts = try await store.insert(decoded, deviceId: deviceId) } catch {
+            do {
+                counts = try await store.insert(decoded, deviceId: deviceId)
+                onBankedOffload(counts)
+            } catch {
                 // Diag (#601): the decoded rows couldn't be written — this is the "history stalls but live HR
                 // works" class. We return WITHOUT acking so the strap keeps this chunk and re-sends it next
                 // session (no data loss), but a silent return left a strap log with no trace of the stall.
diff --git a/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt b/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt
index decb1ea45a..05f447d847 100644
--- a/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt
+++ b/android/app/src/main/java/com/noop/analytics/ConnectionReadout.kt
@@ -283,48 +283,62 @@ object ConnectionReadout {
     }
 
     /**
-     * #1635: which STREAMS banked rows on a finished link, beside [linkEpitaph]'s "did anything arrive".
+     * #1635: what a finished link actually stored, split by PATH.
      *
-     * The epitaph counts frames. That is the right measure for a silent strap, and the wrong one for a
-     * strap that is talking but only over part of its surface: an unbonded 5/MG streams heart rate and R-R
-     * over the standard profile all night while the bond-gated streams bank nothing, and the epitaph
-     * reports that as hundreds of healthy inbound frames. A field diagnosis had to establish the split by
-     * exporting twice, hours apart, and diffing the stored row counts by hand — the two logs each looked
-     * fine on their own. One line states it.
+     * The epitaph counts frames. That is right for a silent strap and wrong for one talking over only part
+     * of its surface: an unbonded 5/MG streams heart rate and R-R all night while nothing bond-gated
+     * lands, and the epitaph reports hundreds of healthy inbound frames.
      *
-     * Zero-banking streams are named explicitly rather than left to be inferred from a list of numbers,
-     * because "gravity=0 sitting among six other zeros" and "gravity=0 while hr=456" are the same text and
-     * opposite findings. Counts are ROWS ACCEPTED, so a stream that arrived as duplicates reads zero and
-     * is named — correct for this purpose: the question is what the database gained on this link.
+     * The split has to be by PATH, not by stream, and an earlier live-only version of this line got that
+     * wrong. `extractStreams` — the realtime decoder — produces only hr, rr, events and battery. Gravity,
+     * respiratory, skin temperature, SpO2 and steps come exclusively from the historical decoder behind
+     * the offload. A live-only tally therefore printed "nothing banked live for: gravity, resp, …" on
+     * EVERY link, bonded or not: a constant wearing the costume of a finding.
      *
-     * LIVE streams only, and the sentence says so. The history offload persists through its own path
-     * (`Backfiller`) and already has its own accounting — `bankedSensorRecords`, `rowsPersisted`, the
-     * completed-offload classification. Counting one and labelling it "this link" would make every healthy
-     * bonded sync that banked its gravity through the offload read as "nothing banked for: gravity", which
-     * is the false alarm this line exists to make impossible. A narrow true claim beats a broad wrong one.
+     * So both paths are counted and named. The offload is where the bond shows: an unbonded strap defers
+     * backfill entirely, so `offload none` is the real signal, and a healthy sync fills it.
      *
-     * Pure and total: no clock, no I/O, and every count clamped, so it cannot itself become the reason a
-     * teardown path throws. Twin of the Swift formatter.
+     * Battery is absent on purpose. It rides the standard 0x2A19 profile, so it banks with or without the
+     * bond and answers nothing here. [offloadSteps] is nullable for the same reason it is on Apple: a
+     * platform that cannot measure a stream omits it rather than reporting a zero that reads as a fault.
+     *
+     * Counts are rows ACCEPTED, so a re-offload of already-stored records reads zero — correct, since the
+     * question is what the database gained. Pure, total and clamped: it runs on the teardown path, where
+     * throwing would cost the report it exists to produce. Twin of the Swift formatter.
      */
     fun linkBankedSummary(
-        hr: Int, rr: Int, gravity: Int, resp: Int, skinTemp: Int, spo2: Int, steps: Int?, battery: Int,
+        liveHr: Int, liveRr: Int, offloadChunks: Int,
+        offloadHr: Int, offloadRr: Int, offloadGravity: Int, offloadResp: Int,
+        offloadSkinTemp: Int, offloadSpo2: Int, offloadSteps: Int?,
     ): String {
-        // [steps] is NULLABLE because Apple's store does not return a step count at all — steps are
-        // persist-only there, deliberately outside its 8-field insert tuple, while Room counts them. A
-        // platform that cannot measure a stream must OMIT it, not report zero: "banked nothing" is a
-        // finding and "not measured here" is not, and printing the second as the first would put a
-        // permanent false alarm in every Apple link's log.
-        val pairs = (listOf(
-            "hr" to hr, "rr" to rr, "gravity" to gravity, "resp" to resp,
-            "skinTemp" to skinTemp, "spo2" to spo2,
-        ) + listOfNotNull(steps?.let { "steps" to it }) + listOf("battery" to battery))
-            .map { (k, v) -> k to maxOf(0, v) }
-        val body = pairs.joinToString(" ") { (k, v) -> "$k=$v" }
-        val total = pairs.sumOf { it.second }
-        if (total == 0) return "banked live this link: $body - NOTHING was stored from the live streams"
-        val empty = pairs.filter { it.second == 0 }.map { it.first }
-        if (empty.isEmpty()) return "banked live this link: $body"
-        return "banked live this link: $body - nothing banked live for: ${empty.joinToString(", ")}"
+        val live = "live hr=${maxOf(0, liveHr)} rr=${maxOf(0, liveRr)}"
+        val offload = (listOf(
+            "hr" to offloadHr, "rr" to offloadRr, "gravity" to offloadGravity, "resp" to offloadResp,
+            "skinTemp" to offloadSkinTemp, "spo2" to offloadSpo2,
+        ) + listOfNotNull(offloadSteps?.let { "steps" to it })).map { (k, v) -> k to maxOf(0, v) }
+        val offloadTotal = offload.sumOf { it.second }
+        // Three distinguishable states, reported as FACTS rather than verdicts. "No chunks" is not
+        // evidence of a fault on its own: a short or command-only link never reaches backfill, and the
+        // reason it was skipped is already logged next to it ("Backfill: deferred — connect handshake not
+        // done yet (didBond=…)"). Editorialising here — an earlier draft said "offload did NOT run on this
+        // link" — reads as an accusation on a healthy 16-second connect. The epitaph above supplies the
+        // uptime a reader needs to weigh it.
+        //
+        // "Never ran" and "ran with nothing new" are still DIFFERENT and must not share a sentence.
+        // Rows are counted as ACCEPTED, so a reconnect that re-offloads already-stored records banks zero
+        // while the strap plainly handed its history over — `classifyCompletedOffload` already treats that
+        // as `bankedSensorRecords`, not a fault. Only the first case speaks to the bond.
+        if (maxOf(0, offloadChunks) == 0) {
+            return "banked this link: $live | offload none"
+        }
+        if (offloadTotal == 0) {
+            return "banked this link: $live | offload ran ${maxOf(0, offloadChunks)} chunk(s), no new rows"
+        }
+        val body = offload.joinToString(" ") { (k, v) -> "$k=$v" }
+        val empty = offload.filter { it.second == 0 }.map { it.first }
+        if (empty.isEmpty()) return "banked this link: $live | offload $body"
+        return "banked this link: $live | offload $body - nothing banked from the offload for: " +
+            empty.joinToString(", ")
     }
 
     /** #987: freshness label for the "last frame" readout row ("12s ago" / "no frames yet"). [nowUnix]
diff --git a/android/app/src/main/java/com/noop/ble/Backfiller.kt b/android/app/src/main/java/com/noop/ble/Backfiller.kt
index 2759786d01..3e05d8f995 100644
--- a/android/app/src/main/java/com/noop/ble/Backfiller.kt
+++ b/android/app/src/main/java/com/noop/ble/Backfiller.kt
@@ -63,6 +63,14 @@ class Backfiller(
      * HISTORY_END metadata.data[10:18]) the high-freq-sync ack form requires.
      */
     private val ackTrim: (trim: Long, endData: ByteArray) -> Unit,
+    /**
+     * #1635: what one offload chunk actually stored, handed up so the client can tally it per LINK and
+     * name it beside the link epitaph. The offload is the ONLY path that banks gravity, respiratory,
+     * skin temperature, SpO2 and steps — the realtime decoder yields hr/rr/events/battery and nothing
+     * else — so a link summary that omitted this could not distinguish an unbonded strap, which defers
+     * backfill entirely, from a healthy one. Defaulted so existing constructions are unchanged.
+     */
+    private val onBankedOffload: (counts: InsertCounts) -> Unit = {},
     /**
      * Fires after a chunk's decoded rows are durably committed AND acked — i.e. real new data just
      * landed. Lets the client schedule on-device scoring right away instead of leaving fresh history
@@ -563,6 +571,7 @@ class Backfiller(
                 // key has already absorbed part of it.
                 val rrCensus = com.noop.analytics.RrEmissionStats.compute(decoded.rr.map { it.ts.toInt() to it.rrMs })
                 val counts = repository.insert(decoded, deviceId)
+                onBankedOffload(counts)
                 committed = decoded
                 // Success-side observability (#150): tally what actually persisted so the session can emit
                 // "persisted N rows (M with motion) across K night(s)" — the win-rate signal we never logged.
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index f67575b3ed..320e70d8d8 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -2846,6 +2846,7 @@ class WhoopBleClient(
         deviceId = deviceId,
         cursorStore = cursorStore,
         ackTrim = { trim, endData -> ackHistoricalChunk(trim, endData) },
+        onBankedOffload = { counts -> addBankedOffload(counts) },
         onChunkCommitted = { batch -> onBackfillChunkCommitted(batch) },
         onConsoleChunk = { consoleChunksThisSession += 1 },
         // #77/#91: archive undecodable frames before the ack. append() returns ok=true (written, or
@@ -6201,8 +6202,9 @@ class WhoopBleClient(
                     // #1635: same guarantee for the banked tally. Clearing only on teardown would be enough if
                     // every link ended in one; a link that begins without a preceding clean teardown would
                     // otherwise open holding the previous link's rows and report them as banked on this one.
-                    bankedHr.set(0); bankedRr.set(0); bankedGravity.set(0); bankedResp.set(0)
-                    bankedSkinTemp.set(0); bankedSpo2.set(0); bankedSteps.set(0); bankedBattery.set(0)
+                    liveHr.set(0); liveRr.set(0); offloadHr.set(0); offloadRr.set(0)
+                    offloadGravity.set(0); offloadResp.set(0); offloadSkinTemp.set(0)
+                    offloadSpo2.set(0); offloadSteps.set(0); offloadChunks.set(0)
                     realtimeArmedThisLink = false
                     // A connect succeeded → clear the stale-bond re-pair guide UNLESS we are in a known
                     // bond-loop (#617). In that loop the strap "connects" every ~3 s before timing out
@@ -6731,32 +6733,38 @@ class WhoopBleClient(
     private var inboundBytes = 0
     private var cmdChannelFrames = 0
 
-    // #1635: rows ACCEPTED per stream on this link, the database-side twin of the frame counters above.
-    // Cleared with them on teardown.
+    // #1635: rows ACCEPTED on this link, split by PATH. The realtime decoder (`extractStreams`) only
+    // ever produces hr/rr/events/battery; gravity, resp, skinTemp, spo2 and steps arrive solely through
+    // the offload's historical decoder. Counting one path and naming streams from the other printed a
+    // constant dressed as a finding, which is what the live-only first cut did.
     //
-    // ATOMIC, unlike those counters, because the writers are not the same. `inboundFrames` and friends are
-    // touched only from the serialized GATT callback; these are folded in from `flushLive` and
-    // `flushStandardHr`, which are two INDEPENDENT `ioScope.launch` coroutines that can run at once — the
-    // same reason `liveInsertFailuresStd` and `liveInsertFailuresRealtime` beside them are AtomicInteger.
-    // A plain `+=` there is a read-modify-write race, and the teardown read is a third thread again. Each
-    // counter stands alone (no cross-field invariant), so per-field atomicity is the whole requirement.
-    // An under-count would be worse than useless here: it reads as exactly the "banked nothing" finding
-    // this line exists to report.
-    private val bankedHr = java.util.concurrent.atomic.AtomicInteger(0)
-    private val bankedRr = java.util.concurrent.atomic.AtomicInteger(0)
-    private val bankedGravity = java.util.concurrent.atomic.AtomicInteger(0)
-    private val bankedResp = java.util.concurrent.atomic.AtomicInteger(0)
-    private val bankedSkinTemp = java.util.concurrent.atomic.AtomicInteger(0)
-    private val bankedSpo2 = java.util.concurrent.atomic.AtomicInteger(0)
-    private val bankedSteps = java.util.concurrent.atomic.AtomicInteger(0)
-    private val bankedBattery = java.util.concurrent.atomic.AtomicInteger(0)
-
-    /** Fold one persist round's accepted-row counts into the per-link tally. */
-    private fun addBanked(c: InsertCounts) {
-        bankedHr.addAndGet(c.hr); bankedRr.addAndGet(c.rr)
-        bankedGravity.addAndGet(c.gravity); bankedResp.addAndGet(c.resp)
-        bankedSkinTemp.addAndGet(c.skinTemp); bankedSpo2.addAndGet(c.spo2)
-        bankedSteps.addAndGet(c.steps); bankedBattery.addAndGet(c.battery)
+    // ATOMIC because the writers are not one thread: the live pair is folded in from `flushLive` and
+    // `flushStandardHr`, two independent `ioScope.launch` coroutines, the offload pair from the
+    // Backfiller's own coroutine, and the teardown read is a third context again.
+    private val liveHr = java.util.concurrent.atomic.AtomicInteger(0)
+    private val liveRr = java.util.concurrent.atomic.AtomicInteger(0)
+    private val offloadHr = java.util.concurrent.atomic.AtomicInteger(0)
+    private val offloadRr = java.util.concurrent.atomic.AtomicInteger(0)
+    private val offloadGravity = java.util.concurrent.atomic.AtomicInteger(0)
+    private val offloadResp = java.util.concurrent.atomic.AtomicInteger(0)
+    private val offloadSkinTemp = java.util.concurrent.atomic.AtomicInteger(0)
+    private val offloadSpo2 = java.util.concurrent.atomic.AtomicInteger(0)
+    private val offloadSteps = java.util.concurrent.atomic.AtomicInteger(0)
+    /** Chunks the offload actually persisted on this link. Separates "never ran" from "nothing new". */
+    private val offloadChunks = java.util.concurrent.atomic.AtomicInteger(0)
+
+    /** Fold one LIVE persist round into the per-link tally (hr/rr are all the realtime decoder yields). */
+    private fun addBankedLive(c: InsertCounts) {
+        liveHr.addAndGet(c.hr); liveRr.addAndGet(c.rr)
+    }
+
+    /** Fold one OFFLOAD persist round in. This is where the bond shows: an unbonded strap defers it. */
+    private fun addBankedOffload(c: InsertCounts) {
+        offloadChunks.incrementAndGet()
+        offloadHr.addAndGet(c.hr); offloadRr.addAndGet(c.rr)
+        offloadGravity.addAndGet(c.gravity); offloadResp.addAndGet(c.resp)
+        offloadSkinTemp.addAndGet(c.skinTemp); offloadSpo2.addAndGet(c.spo2)
+        offloadSteps.addAndGet(c.steps)
     }
     /** #1809: was realtime armed at ANY point on THIS link. Not the same thing as [realtimeArmed], which
      *  is persistent edge state: it can carry true in from a previous link, or read false at the drop
@@ -9085,7 +9093,7 @@ class WhoopBleClient(
         }
         if (!batch.isEmpty) {
             try {
-                addBanked(repository.insert(batch, deviceId))
+                addBankedLive(repository.insert(batch, deviceId))
                 liveInsertFailuresRealtime.set(0)
             } catch (t: Throwable) {
                 // Re-buffer at the front so these frames retry on the next cadence (port of Collector).
@@ -9168,7 +9176,7 @@ class WhoopBleClient(
             }
         }
         try {
-            addBanked(repository.insert(StreamBatch(hr = hr, rr = rr, events = contact), deviceId))
+            addBankedLive(repository.insert(StreamBatch(hr = hr, rr = rr, events = contact), deviceId))
             liveInsertFailuresStd.set(0)
         } catch (t: Throwable) {
             synchronized(collectorLock) {
@@ -10028,16 +10036,18 @@ class WhoopBleClient(
             // Guarded by the SAME `linkUpSinceMs` as the epitaph: on a failed connect attempt the counters
             // hold the previous link's tally, and reporting them would describe a link that never existed.
             log(ConnectionReadout.linkBankedSummary(
-                hr = bankedHr.get(), rr = bankedRr.get(),
-                gravity = bankedGravity.get(), resp = bankedResp.get(),
-                skinTemp = bankedSkinTemp.get(), spo2 = bankedSpo2.get(),
-                steps = bankedSteps.get(), battery = bankedBattery.get(),
+                liveHr = liveHr.get(), liveRr = liveRr.get(), offloadChunks = offloadChunks.get(),
+                offloadHr = offloadHr.get(), offloadRr = offloadRr.get(),
+                offloadGravity = offloadGravity.get(), offloadResp = offloadResp.get(),
+                offloadSkinTemp = offloadSkinTemp.get(), offloadSpo2 = offloadSpo2.get(),
+                offloadSteps = offloadSteps.get(),
             ), com.noop.testcentre.TestDomain.CONNECTION)
         }
         // Clear the tally with the link, so a second teardown for the same drop cannot re-report it.
         inboundFrames = 0; inboundBytes = 0; cmdChannelFrames = 0
-        bankedHr.set(0); bankedRr.set(0); bankedGravity.set(0); bankedResp.set(0)
-        bankedSkinTemp.set(0); bankedSpo2.set(0); bankedSteps.set(0); bankedBattery.set(0)
+        liveHr.set(0); liveRr.set(0); offloadHr.set(0); offloadRr.set(0)
+        offloadGravity.set(0); offloadResp.set(0); offloadSkinTemp.set(0)
+        offloadSpo2.set(0); offloadSteps.set(0); offloadChunks.set(0)
 
         val heldSuffix = heldForLogSuffix()
         linkUpSinceMs = null
diff --git a/android/app/src/test/java/com/noop/analytics/LinkBankedSummaryTest.kt b/android/app/src/test/java/com/noop/analytics/LinkBankedSummaryTest.kt
index 8a76b588a3..11377541aa 100644
--- a/android/app/src/test/java/com/noop/analytics/LinkBankedSummaryTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/LinkBankedSummaryTest.kt
@@ -5,74 +5,93 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 /**
- * #1635: the per-link banked-rows line, the database-side companion to `linkEpitaph`.
+ * #1635: the per-link banked line, split by PATH.
  *
- * The case it exists for: an unbonded WHOOP 5/MG streams heart rate and R-R over the standard profile
- * while every bond-gated stream banks nothing. The epitaph reports that link as hundreds of healthy
- * inbound frames, which is true and misleading. Establishing the split took two exports hours apart and
- * a manual diff of stored row counts; these pin the one line that states it outright.
+ * The case it exists for: an unbonded 5/MG streams heart rate and R-R over the standard profile while the
+ * offload never runs, and the epitaph reports that link as hundreds of healthy inbound frames.
+ *
+ * The split is by path rather than by stream because the realtime decoder yields only hr/rr/events/battery
+ * — gravity, respiratory, skin temperature, SpO2 and steps arrive solely through the offload. An earlier
+ * live-only version named those five as "nothing banked live for" on EVERY link, bonded or not, which is a
+ * constant rather than a finding. These pin the distinction.
  */
 class LinkBankedSummaryTest {
 
+    private fun line(
+        liveHr: Int = 0, liveRr: Int = 0, chunks: Int = 0,
+        oHr: Int = 0, oRr: Int = 0, oGrav: Int = 0, oResp: Int = 0,
+        oSkin: Int = 0, oSpo2: Int = 0, oSteps: Int? = 0,
+    ) = ConnectionReadout.linkBankedSummary(
+        liveHr = liveHr, liveRr = liveRr, offloadChunks = chunks, offloadHr = oHr, offloadRr = oRr,
+        offloadGravity = oGrav, offloadResp = oResp, offloadSkinTemp = oSkin,
+        offloadSpo2 = oSpo2, offloadSteps = oSteps,
+    )
+
     @Test
-    fun `names the streams that banked nothing when others did`() {
-        val line = ConnectionReadout.linkBankedSummary(
-            hr = 456, rr = 187, gravity = 0, resp = 0, skinTemp = 0, spo2 = 0, steps = 0, battery = 2,
+    fun `an unbonded strap reads live traffic with an offload that never ran`() {
+        // The whole point: HR flowing while the offload banks nothing is the bond split, in one line.
+        assertEquals(
+            "banked this link: live hr=12 rr=7 | offload none",
+            line(liveHr = 12, liveRr = 7, chunks = 0),
         )
-        assertTrue(line.contains("hr=456"))
-        assertTrue(line.contains("gravity=0"))
-        // The whole point: a reader must not have to spot which of eight numbers are zero.
-        assertTrue(line.contains("nothing banked live for: gravity, resp, skinTemp, spo2, steps"))
     }
 
     @Test
-    fun `a fully healthy link gets no call-out`() {
-        val line = ConnectionReadout.linkBankedSummary(
-            hr = 400, rr = 380, gravity = 900, resp = 900, skinTemp = 900, spo2 = 900, steps = 12, battery = 3,
+    fun `a healthy sync reads completely differently`() {
+        // The same shape on a bonded strap must NOT look like the unbonded one. This is the case the
+        // live-only version could not express: it printed the same zeros either way.
+        val healthy = line(liveHr = 3, liveRr = 2, chunks = 9, oHr = 1200, oRr = 2400, oGrav = 8000,
+            oResp = 8000, oSkin = 8000, oSpo2 = 8000, oSteps = 40)
+        assertEquals(
+            "banked this link: live hr=3 rr=2 | offload hr=1200 rr=2400 gravity=8000 resp=8000" +
+                " skinTemp=8000 spo2=8000 steps=40",
+            healthy,
         )
-        assertTrue(line.startsWith("banked live this link:"))
-        assertTrue("a link where every stream banked must not carry a zero call-out",
-            !line.contains("nothing banked live for"))
+        assertTrue("a full sync carries no zero call-out", !healthy.contains("nothing banked"))
     }
 
     @Test
-    fun `a link that stored nothing at all says so once, not eight times`() {
-        val line = ConnectionReadout.linkBankedSummary(0, 0, 0, 0, 0, 0, 0, 0)
-        assertTrue(line.contains("NOTHING was stored from the live streams"))
-        // Not also the per-stream list: "nothing banked for: <all eight>" is noise when the total is zero.
-        assertTrue(!line.contains("nothing banked live for"))
+    fun `a partial offload names only the streams that stayed empty`() {
+        val l = line(liveHr = 1, chunks = 4, oHr = 500, oRr = 900, oGrav = 0, oResp = 0, oSkin = 700, oSpo2 = 700)
+        assertTrue(l.contains("nothing banked from the offload for: gravity, resp, steps"))
     }
 
     @Test
-    fun `negative counts cannot leak into a diagnostic`() {
-        // Pure and total on purpose: this runs on the teardown path, where throwing would cost the very
-        // report it exists to produce.
-        val line = ConnectionReadout.linkBankedSummary(-5, 1, 0, 0, 0, 0, 0, 0)
-        assertTrue(line.contains("hr=0"))
-        assertEquals(false, line.contains("-5"))
+    fun `a stream this platform cannot measure is omitted, not reported as zero`() {
+        // Apple's store returns no step count. Printing steps=0 there would name it forever.
+        val l = line(liveHr = 5, chunks = 1, oHr = 10, oSteps = null)
+        assertTrue("an unmeasured stream must not appear", !l.contains("steps"))
     }
 
     @Test
-    fun `the exact sentence for the field case, pinned against the Swift twin`() {
-        assertEquals(
-            "banked live this link: hr=456 rr=187 gravity=0 resp=0 skinTemp=0 spo2=0 steps=0 battery=2" +
-                " - nothing banked live for: gravity, resp, skinTemp, spo2, steps",
-            ConnectionReadout.linkBankedSummary(
-                hr = 456, rr = 187, gravity = 0, resp = 0, skinTemp = 0, spo2 = 0, steps = 0, battery = 2,
-            ),
-        )
+    fun `battery never appears, on either path`() {
+        // It rides the standard 0x2A19 profile, so it banks with or without the bond and answers nothing
+        // here. A field log showed 306 battery banks against battery=0 in an earlier version of this line.
+        assertTrue(!line(liveHr = 9, chunks = 1, oHr = 9).contains("battery"))
     }
 
+    @Test
+    fun `negative counts cannot leak into a diagnostic`() {
+        // Runs on the teardown path, where throwing would cost the report it exists to produce.
+        val l = line(liveHr = -5, liveRr = 1, chunks = 2, oHr = -3, oGrav = 4)
+        assertTrue(l.contains("live hr=0 rr=1"))
+        assertTrue(l.contains("hr=0"))
+        // NOT `contains("-")`: the sentence separator is a hyphen, so that assertion fails on a correct
+        // line. Check the negative VALUES are gone, which is what clamping actually promises.
+        assertEquals(false, l.contains("-5"))
+        assertEquals(false, l.contains("-3"))
+    }
 
     @Test
-    fun `a stream this platform cannot measure is omitted, not reported as zero`() {
-        // Apple's store does not return a step count (persist-only, outside its insert tuple). Printing
-        // steps=0 there would name it in the zero list forever - a permanent false alarm in a line whose
-        // entire job is to make a real zero stand out.
-        val line = ConnectionReadout.linkBankedSummary(
-            hr = 456, rr = 187, gravity = 0, resp = 0, skinTemp = 0, spo2 = 0, steps = null, battery = 2,
+    fun `an offload that ran with nothing new is not the same finding as one that never ran`() {
+        // Rows are ACCEPTED counts, so a reconnect re-offloading already-stored records banks zero while
+        // the strap plainly handed its history over. classifyCompletedOffload already treats that as
+        // bankedSensorRecords rather than a fault, and this line must not contradict it.
+        assertEquals(
+            "banked this link: live hr=1 rr=1 | offload ran 6 chunk(s), no new rows",
+            line(liveHr = 1, liveRr = 1, chunks = 6),
         )
-        assertTrue("an unmeasured stream must not appear at all", !line.contains("steps"))
-        assertTrue(line.contains("nothing banked live for: gravity, resp, skinTemp, spo2"))
+        // And the bond signal stays distinct.
+        assertTrue(line(liveHr = 1, liveRr = 1, chunks = 0).contains("offload none"))
     }
 }

From 5bc2cbdf8dfd862e9ea556726c80b7e724d38874 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 5 Sep 2026 01:28:34 +1200
Subject: [PATCH 238/333] build: staging 436 / iOS 317 for the next testing
 build

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 7e913fe281..73f7c5e89d 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 435
+        versionCode = 436
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 0345a743c9..d2874ed5ee 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "316"
+    CURRENT_PROJECT_VERSION: "317"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From d0875be6232689a78502f7ac3d49cc247bb941ca Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 5 Sep 2026 12:50:42 +1200
Subject: [PATCH 239/333] sleep: report the HRV an HR-only night actually
 measures (#1884)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An HR-only night (#1801) computed a real per-window RMSSD and a real resting HR and then
discarded both, so a strap that has lost its encrypted bond — streaming HR and R-R but banking
no motion — left Charge with no input at all. The values are measured, not inferred: only the
session bounds come from heart rate, while each RMSSD is computed over its own 5-minute window.

Sessions now report what they measured, and the day's physiology set PREFERS motion-backed
sessions rather than excluding HR-only ones. A mixed day is unchanged; only an all-HR-only day,
which previously produced nothing, now falls back to what it has.

Re-review caught a regression in the first commit: `sleepHrOnly` was derived from
`physiologySessions.isEmpty()`, which the fallback made permanently false — silently retiring the
note added in #1879. It now reads the sessions' own marker. A third pass retired the stale
"display-only" comments the change invalidated.

Tests re-pinned rather than deleted, and three new files gained Apple twins that did not exist.
---
 .../StrandAnalytics/AnalyticsEngine.swift     | 58 +++++++-----
 .../Sources/StrandAnalytics/SleepStager.swift | 24 +++--
 .../AnalyticsEngineHrOnlyDayTests.swift       | 70 +++++++++++++++
 .../HrOnlyPhysiologyIsolationTests.swift      | 90 +++++++++++++++++++
 .../SleepStagerHrOnlySessionsTests.swift      | 81 +++++++++++++++++
 .../com/noop/analytics/AnalyticsEngine.kt     | 50 +++++++----
 .../com/noop/analytics/IntelligenceEngine.kt  |  4 +-
 .../java/com/noop/analytics/SleepStager.kt    | 29 ++++--
 .../analytics/AnalyticsEngineHrOnlyDayTest.kt | 80 +++++++++++++++++
 .../HrOnlyPhysiologyIsolationTest.kt          | 23 ++++-
 .../SleepStagerHrOnlySessionsTest.kt          | 38 ++++++--
 11 files changed, 479 insertions(+), 68 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AnalyticsEngineHrOnlyDayTests.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HrOnlyPhysiologyIsolationTests.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerHrOnlySessionsTests.swift
 create mode 100644 android/app/src/test/java/com/noop/analytics/AnalyticsEngineHrOnlyDayTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
index 9177dd4885..c79e22faef 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
@@ -506,17 +506,18 @@ public enum AnalyticsEngine {
         } else {
             let rrSorted = rr.sortedByTsStable()
             let enrichedProvided: [SleepSession] = providedSleep.map { s in
-                // #1801: an HR-only night keeps its NIL restingHR/avgHRV. This is the ONE call site that
-                // can undo the display-only guarantee — enriching here would hand Charge and the baselines
-                // exactly the two values that decision withholds, silently and by default.
-                if s.hrOnly { return s }
+                // #1884: no HR-only special case any more. This used to short-circuit on `s.hrOnly` to
+                // preserve #1801's display-only guarantee, which withheld both values. Now that an HR-only
+                // session reports what it measured, that clause is not merely redundant — an HR-only night
+                // that measured a resting HR but no HRV (no R-R banked) would take the short-circuit and
+                // skip the fill every other session gets. The rule is uniform: fill what is missing.
                 guard s.restingHR == nil || s.avgHRV == nil else { return s }
                 let rhr = s.restingHR ?? SleepStager.sessionRestingHR(start: s.start, end: s.end, hr: hr)
                 let hrv = s.avgHRV ?? SleepStager.sessionAvgHRV(start: s.start, end: s.end, rr: rrSorted)
                 // `hrOnly` carried explicitly: unlike Kotlin's `copy`, this rebuilds the struct field by
-                // field, so a new flag is dropped by DEFAULT unless named here. The guard above means an
-                // HR-only night never reaches this line today; passing it anyway keeps that a belt rather
-                // than the only thing standing between the flag and silent loss.
+                // field, so a new flag is dropped by DEFAULT unless named here. #1884 removed the guard
+                // that used to keep HR-only nights away from this line, so this is now the only thing
+                // standing between the flag and silent loss rather than a belt.
                 return SleepSession(start: s.start, end: s.end, efficiency: s.efficiency,
                                     stages: s.stages, restingHR: rhr, avgHRV: hrv, hrOnly: s.hrOnly)
             }
@@ -673,17 +674,24 @@ public enum AnalyticsEngine {
         // negligible shift. The Rest/sleep-quality term is main-night; the recovery physiology is
         // day-best-resting, night-dominated. Keep these two definitions distinct on purpose.
         // Daily resting HR = lowest per-session resting HR across matched sessions.
-        // #1801: the sessions whose PHYSIOLOGY may be folded into the day's aggregates. An HR-only night
-        // is excluded — it may describe its own duration, stages and Rest, but resting HR, HRV and SDNN
-        // are what Charge and the baselines are built from, and a baseline is the one thing a false
-        // positive cannot be unwound from.
+        // #1801/#1884: the sessions whose PHYSIOLOGY is folded into the day's aggregates. Motion-backed
+        // sessions are PREFERRED; an HR-only night is used only when the day has no other kind.
         //
-        // Named once rather than filtered at each use, because the nil restingHR/avgHRV an HR-only
-        // session carries only protects the aggregates that READ those fields. The deep-window HRV pool
-        // and the SDNN index below re-derive from `rr` over the session's own stages and would have
-        // folded one in regardless — which is precisely the "one forgotten call site" a scattered filter
-        // invites.
-        let physiologySessions = matched.filter { !$0.hrOnly }
+        // #1801 excluded HR-only nights outright, reasoning that a baseline is the one thing a false positive
+        // cannot be unwound from. #1884 narrowed that rather than reversing it: only the session BOUNDS are
+        // inferred from heart rate — each RMSSD is measured over its own 5-minute window — so excluding the
+        // night discarded a real 22-25ms HRV and left Charge with NO input instead of a slightly fuzzy one, on
+        // every scoring pass in the field log. Preferring keeps the original protection exactly where it earned its keep (a mixed
+        // day still ignores the HR-only night outright) and gives it up only where the alternative was
+        // nothing at all. The night still travels marked `hrOnly` for any consumer that wants to weigh it
+        // down; what it no longer gets is a silent delete.
+        //
+        // Named once rather than filtered at each use: the deep-window HRV pool and the SDNN index below
+        // re-derive from `rr` over each session's own stages instead of reading restingHR/avgHRV, so the
+        // only way to scope them is through the session set itself — which is precisely the "one forgotten
+        // call site" a scattered filter invites.
+        let physiologyOnly = matched.filter { !$0.hrOnly }
+        let physiologySessions = physiologyOnly.isEmpty ? matched : physiologyOnly
         let restingHRDaily = physiologySessions.compactMap { $0.restingHR }.min()
         // Daily avg HRV = in-bed-weighted mean of per-session avg HRV.
         let avgHRVDaily: Double? = {
@@ -951,12 +959,16 @@ public enum AnalyticsEngine {
             // `skinTempDevC`, so the engine's own row is symmetric: any path that persists this
             // struct directly keeps both thermal values, not just the one.
             skinTempC: nightlySkinTempC,
-            // The SAME condition that emptied `restingHr` and `avgHrv` above: `physiologySessions` is
-            // `matched` minus the HR-only ones, so an all-HR-only night leaves it empty and both vitals
-            // nil. Recorded rather than re-derived downstream, so the explanation and the values it
-            // explains cannot disagree. Byte-identical twin of Kotlin `AnalyticsEngine`'s
-            // `sleepHrOnly = if (matched.isEmpty()) null else physiologySessions.isEmpty()`.
-            sleepHrOnly: matched.isEmpty ? nil : physiologySessions.isEmpty)
+            // "Every session this day was staged from heart rate alone."
+            //
+            // #1884: read from the SESSIONS' own marker, NOT from `physiologySessions.isEmpty`. Those two
+            // were equivalent while the set was `matched` minus the HR-only ones, so an all-HR-only night
+            // emptied it. They are NOT equivalent now that the set FALLS BACK to `matched`: it can never
+            // be empty when `matched` is not, which would have pinned this flag to false forever and
+            // silently retired the #1879 note. Deriving it from `hrOnly` states what the flag has always
+            // meant and is independent of how the physiology set is chosen. Byte-identical twin of Kotlin
+            // `AnalyticsEngine`'s `sleepHrOnly = if (matched.isEmpty()) null else matched.all { it.hrOnly }`.
+            sleepHrOnly: matched.isEmpty ? nil : matched.allSatisfy { $0.hrOnly })
         _ = sleepStart; _ = sleepEnd  // available for callers wiring sleep_start/end columns
 
         // ── Cache rows ────────────────────────────────────────────────────────
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
index e4ec29ee61..b08748cdca 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
@@ -634,11 +634,14 @@ public enum SleepStager {
     /// as a confirmation gate on an already-detected run it is deliberately permissive, but as a primary
     /// threshold it admits over half of any window by definition. See `hrOnlyAnchorPercentile`.
     ///
-    /// `restingHR` and `avgHRV` are left NIL deliberately, and that is the whole display-only guarantee.
-    /// An HR-only night may describe itself — duration, stages, Rest — but the resting HR and HRV it
-    /// would contribute are exactly what Charge and the baselines fold in, and a baseline is the one
-    /// thing a false positive cannot be unwound from. Withholding the values is structural; a downstream
-    /// filter would be one forgotten call site away from failing open.
+    /// `restingHR` and `avgHRV` are MEASURED here and reported (#1884). They were withheld under #1801,
+    /// which treated them as inferred; they are not. Only the session BOUNDS are inferred from heart rate
+    /// — that is what `hrOnly` marks — while each RMSSD is computed over its own 5-minute window, so fuzzy
+    /// bounds change WHICH windows are included, not whether any one of them is valid. Withholding them
+    /// discarded a measured 22-25 ms and left Charge with no input at all, which is a worse error than a
+    /// slightly fuzzy one.
+    ///
+    /// The flag travels on instead, so a consumer that wants to weigh an HR-only night down still can.
     /// `public` because the app target calls it: `Strand/Data/IntelligenceEngine.swift` is the day scan,
     /// and it lives outside this package. The spine and the anchor below it stay `internal` — the tests
     /// reach them with `@testable`, and nothing outside should be building its own spine.
@@ -674,9 +677,18 @@ public enum SleepStager {
                                                     hr: hrS, rr: rrS, resp: resp)
             staged += 1
             if stages.isEmpty { continue }
+            // #1884: MEASURED, not nilled. The bounds here are inferred from heart rate, which is why
+            // `hrOnly` marks the session — but each RMSSD is computed over its own 5-minute window tagged
+            // by the stage at its centre, so fuzzy bounds change WHICH windows are included, not whether
+            // any one of them is valid. A field log showed this path computing a stable 22-25ms deepOnly
+            // and discarding it, leaving Charge unscoreable. `hrOnly` still travels with the session, so
+            // it is a quality marker now rather than a delete. Kotlin twin: `SleepStager.hrOnlySessions`.
             out.append(SleepSession(start: p.start, end: p.end,
                                     efficiency: efficiency(start: p.start, end: p.end, stages: stages),
-                                    stages: stages, restingHR: nil, avgHRV: nil, hrOnly: true))
+                                    stages: stages,
+                                    restingHR: sessionRestingHR(start: p.start, end: p.end, hr: hrS),
+                                    avgHRV: sessionAvgHRV(start: p.start, end: p.end, rr: rrS),
+                                    hrOnly: true))
         }
         traceSink?(GateTrace.hrOnlyLine(
             anchorBpm: baseline,
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AnalyticsEngineHrOnlyDayTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AnalyticsEngineHrOnlyDayTests.swift
new file mode 100644
index 0000000000..c630e3a5ae
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AnalyticsEngineHrOnlyDayTests.swift
@@ -0,0 +1,70 @@
+import Foundation
+import XCTest
+import WhoopProtocol
+import WhoopStore
+@testable import StrandAnalytics
+
+/// A whole day whose only sleep is HR-only, driven through `analyzeDay` (#1884).
+///
+/// The ORACLE twin of the Kotlin `AnalyticsEngineHrOnlyDayTest`. The unit tests around this one check the
+/// pieces — `SleepStagerHrOnlySessionsTests` that a session reports what it measured,
+/// `HrOnlyPhysiologyIsolationTests` that the day's physiology set is chosen the way the design says.
+/// Neither runs the whole function, and the gap between them is where #1884's own regression hid:
+/// `sleepHrOnly` was derived from `physiologySessions.isEmpty`, which means "every session was HR-only"
+/// ONLY while that set was an exclusion. Making it a preference means it can never be empty when
+/// `matched` is not, so the flag would have been pinned to false forever.
+///
+/// Nothing pinned that derivation: every other `sleepHrOnly` test supplies the flag as an INPUT (the
+/// carry, the coalesce, the migration, the note gate). This drives it as an OUTPUT.
+final class AnalyticsEngineHrOnlyDayTests: XCTestCase {
+
+    private let profile = UserProfile(weightKg: 75, heightCm: 178, age: 30, sex: "male")
+    private let day = "2026-07-27"
+
+    /// The same field-shaped generator the session tests use — 16 h awake around 74 +/- 11 bpm, then 8 h
+    /// asleep around 64 +/- 5 — anchored so the night runs 00:00-08:00 on `day`. NO gravity, which is what
+    /// makes the night HR-only: an unbonded strap streams standard HR and R-R and banks no motion.
+    private func streams() -> ([HRSample], [RRInterval]) {
+        let dayStart = AnalyticsEngine.dayStartUtcSeconds(day)
+        let t0 = dayStart - 16 * 3600
+        var hr: [HRSample] = []
+        var rr: [RRInterval] = []
+        for i in 0..<(16 * 3600) {
+            let bpm = 74 + Int(sin(Double(i) / 500.0) * 11)
+            hr.append(HRSample(ts: t0 + i, bpm: bpm))
+            rr.append(RRInterval(ts: t0 + i, rrMs: 60000 / bpm))
+        }
+        for j in 0..<(8 * 3600) {
+            let bpm = 64 + Int(sin(Double(j) / 900.0) * 5)
+            hr.append(HRSample(ts: dayStart + j, bpm: bpm))
+            rr.append(RRInterval(ts: dayStart + j, rrMs: 60000 / bpm))
+        }
+        return (hr, rr)
+    }
+
+    func testAllHrOnlyDayReportsMeasuredVitalsAndStillMarksItselfHrOnly() {
+        let (hr, rr) = streams()
+        // The production wiring: IntelligenceEngine stages the HR-only night and hands it to analyzeDay as
+        // `providedSleep`. Driving it the same way is the point — the enrichment call site that used to
+        // short-circuit on `hrOnly` only exists on this path.
+        let provided = SleepStager.hrOnlySessions(hr: hr, rr: rr, resp: [])
+        XCTAssertFalse(provided.isEmpty, "the HR-only spine must stage a night here")
+
+        let res = AnalyticsEngine.analyzeDay(day: day, hr: hr, rr: rr, profile: profile,
+                                             providedSleep: provided)
+
+        XCTAssertFalse(res.sleepSessions.isEmpty, "the staged night must reach the day's sessions")
+        XCTAssertTrue(res.sleepSessions.allSatisfy { $0.hrOnly },
+                      "every session must be HR-only — this day has no gravity at all")
+
+        // #1884: measured, not discarded. Before the change both of these were nil by construction, which
+        // is what left Charge with `nilScore reason=missingInput`.
+        XCTAssertNotNil(res.daily.restingHr, "resting HR is HR-derived and must survive to the day row")
+        XCTAssertNotNil(res.daily.avgHrv,
+                        "the HRV measured over this night's windows must survive to the day row")
+
+        // The regression guard. `sleepHrOnly` says "every session was staged from heart rate alone", and
+        // that remains TRUE of this day — the change made the vitals available, not the staging better.
+        XCTAssertEqual(res.daily.sleepHrOnly, true, "the day must still be marked HR-only")
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HrOnlyPhysiologyIsolationTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HrOnlyPhysiologyIsolationTests.swift
new file mode 100644
index 0000000000..fd0178b99e
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HrOnlyPhysiologyIsolationTests.swift
@@ -0,0 +1,90 @@
+import Foundation
+import XCTest
+@testable import StrandAnalytics
+
+/// How an HR-only night reaches the day's physiology, guarded at the level it actually fails.
+///
+/// The twin of the Kotlin `HrOnlyPhysiologyIsolationTest`, which had no Apple counterpart until #1884 —
+/// so the decision was pinned on one platform and free to drift on the other, which is precisely the
+/// asymmetry the parity contract exists to prevent.
+///
+/// #1801 made this an EXCLUSION: an HR-only night was kept out of every physiological aggregate. #1884
+/// made it a PREFERENCE, because the exclusion was discarding a computed HRV and leaving Charge with no
+/// input at all. The night is still marked `hrOnly` for anything that wants to weigh it down; what it no
+/// longer gets is a silent delete.
+///
+/// A nil `restingHR`/`avgHRV` only ever protected an aggregate that READS those fields. Two of the day's
+/// physiological aggregates do not: the deep-window HRV pool and the SDNN index both re-derive from `rr`
+/// over each session's own stages, so an HR-only night — which has stages — would be folded into both,
+/// and from there into Charge and the HRV baseline. `deepHrvWindow` is a user setting, so that path is
+/// reachable, not theoretical.
+///
+/// Read from the source because `physiologySessions` is a local inside `analyzeDay` and cannot be
+/// observed directly, and because the failure this guards is a FUTURE aggregate reaching for `matched`
+/// out of habit. A behavioural test on one path would not catch that; this does.
+final class HrOnlyPhysiologyIsolationTests: XCTestCase {
+
+    /// Walk up from this test file to the package root, so the lookup survives whatever directory the
+    /// test runner happens to start in.
+    private func engineSource() throws -> String {
+        var dir = URL(fileURLWithPath: #filePath).deletingLastPathComponent()
+        for _ in 0..<5 {
+            let f = dir.appendingPathComponent("Sources/StrandAnalytics/AnalyticsEngine.swift")
+            if FileManager.default.fileExists(atPath: f.path) {
+                return try String(contentsOf: f, encoding: .utf8)
+            }
+            dir = dir.deletingLastPathComponent()
+        }
+        XCTFail("AnalyticsEngine.swift not found — this test must not pass by default")
+        throw CocoaError(.fileNoSuchFile)
+    }
+
+    /// The slice of `analyzeDay` running from just after the physiology set is named through the end of
+    /// the SDNN call, which is the last of the four aggregates built from it.
+    private func analyzeDayBody() throws -> String {
+        let src = try engineSource()
+        let decl = try XCTUnwrap(src.range(of: "let physiologySessions"),
+                                 "analyzeDay must name the physiology-session set")
+        // Start AFTER the declaration: those lines read `matched` legitimately, since defining the
+        // preferred set is the one place the unfiltered one belongs.
+        let from = try XCTUnwrap(src.range(of: "\n", range: decl.upperBound..<src.endIndex)).upperBound
+        let sdnn = try XCTUnwrap(src.range(of: "let avgSDNNDaily", range: from..<src.endIndex),
+                                 "expected the SDNN index to follow the physiology set")
+        let seg = try XCTUnwrap(src.range(of: "segmentSec: 300", range: sdnn.lowerBound..<src.endIndex))
+        let close = try XCTUnwrap(src.range(of: ")", range: seg.upperBound..<src.endIndex))
+        return String(src[from..<close.upperBound])
+    }
+
+    /// #1884 changed this from an exclusion to a PREFERENCE. The Kotlin twin's old assertion could not
+    /// tell the difference — it was a prefix `contains`, so appending the fallback reversed the guarantee
+    /// while the guard stayed green. Both spellings are pinned whole here, so the next change to either
+    /// has to be deliberate rather than accidental.
+    func testPhysiologySetPrefersMotionBackedNightsAndFallsBackRatherThanEmptying() throws {
+        let src = try engineSource()
+        XCTAssertTrue(src.contains("let physiologyOnly = matched.filter { !$0.hrOnly }"),
+                      "the hrOnly filter must survive the fallback")
+        XCTAssertTrue(
+            src.contains("let physiologySessions = physiologyOnly.isEmpty ? matched : physiologyOnly"),
+            "physiologySessions must PREFER motion-backed sessions and fall back rather than emptying")
+    }
+
+    /// The four aggregates built from a night's physiology must read the preferred set. `matched` still
+    /// has legitimate uses in `analyzeDay` — duration, stage totals, Rest, the onset — which is exactly
+    /// why this checks the physiology region rather than banning the name outright.
+    func testNoPhysiologicalAggregateReadsTheUnfilteredSessions() throws {
+        let body = try analyzeDayBody()
+        var offenders: [String] = []
+        var i = body.startIndex
+        while let hit = body.range(of: "matched.", range: i..<body.endIndex) {
+            if hit.upperBound < body.endIndex, body[hit.upperBound].isLetter {
+                offenders.append(String(body[hit.lowerBound...hit.upperBound]))
+            }
+            i = hit.upperBound
+        }
+        XCTAssertTrue(offenders.isEmpty,
+                      "physiological aggregates must use physiologySessions, found: \(offenders)")
+        for needle in ["restingHRDaily", "let deep", "let pairs", "avgSDNNDaily"] {
+            XCTAssertTrue(body.contains(needle), "\(needle) must sit inside the guarded region")
+        }
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerHrOnlySessionsTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerHrOnlySessionsTests.swift
new file mode 100644
index 0000000000..df2182062e
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerHrOnlySessionsTests.swift
@@ -0,0 +1,81 @@
+import Foundation
+import XCTest
+import WhoopProtocol
+@testable import StrandAnalytics
+
+/// Whole HR-only sessions (#1801) and the physiology they report (#1884).
+///
+/// The ORACLE twin of the Kotlin `SleepStagerHrOnlySessionsTest`: the same synthetic night and the same
+/// expectations, so a divergence in the null contract fails on one platform and not the other. The Apple
+/// side had no twin of this file until #1884, which is exactly how the two `restingHR`/`avgHRV` spellings
+/// could have drifted apart unnoticed — Swift structs have no `copy()`, so each rebuild respells the
+/// field list and a field is lost by omission rather than by an edit anyone reviews.
+///
+/// The night is synthetic: a slow HR drift well under the window median, so the spine puts it in the
+/// sleep band. That exercises assembly and the reporting contract; it is NOT a claim that the staging is
+/// accurate on a real night, which no test here can establish.
+final class SleepStagerHrOnlySessionsTests: XCTestCase {
+
+    /// A field-shaped window: `aH` hours awake around 74 +/- 11 bpm, then `nH` hours asleep around
+    /// 64 +/- 5 — the shape the #1801 report shows, and the same generator the Kotlin twin uses.
+    private func window(aH: Int = 16, nH: Int = 8) -> ([HRSample], [RRInterval]) {
+        let t0 = 1_788_300_000
+        var hr: [HRSample] = []
+        var rr: [RRInterval] = []
+        for i in 0..<(aH * 3600) {
+            let bpm = 74 + Int(sin(Double(i) / 500.0) * 11)
+            hr.append(HRSample(ts: t0 + i, bpm: bpm))
+            rr.append(RRInterval(ts: t0 + i, rrMs: 60000 / bpm))
+        }
+        for j in 0..<(nH * 3600) {
+            let bpm = 64 + Int(sin(Double(j) / 900.0) * 5)
+            let t = t0 + aH * 3600 + j
+            hr.append(HRSample(ts: t, bpm: bpm))
+            rr.append(RRInterval(ts: t, rrMs: 60000 / bpm))
+        }
+        return (hr, rr)
+    }
+
+    func testLowHRNightBecomesAtLeastOneStagedSession() {
+        let (hr, rr) = window()
+        let out = SleepStager.hrOnlySessions(hr: hr, rr: rr, resp: [])
+        XCTAssertFalse(out.isEmpty, "expected at least one night, got \(out.count)")
+        XCTAssertTrue(out.allSatisfy { !$0.stages.isEmpty }, "every session must carry stages")
+        XCTAssertTrue(out.allSatisfy { ($0.end - $0.start) >= SleepStager.minSleepMin * 60 },
+                      "every session must span at least minSleepMin")
+        // Conservative by design: it may under-read a night, but must never invent more sleep than the
+        // window holds.
+        XCTAssertLessThanOrEqual(out.reduce(0) { $0 + ($1.end - $1.start) }, 8 * 3600,
+                                 "total must not exceed the 8 h actually asleep")
+    }
+
+    /// #1884 reversed the null contract #1801 established, so the reasoning is worth keeping beside it.
+    ///
+    /// #1801 withheld `restingHR` and `avgHRV` here on the grounds that a baseline is the one thing a
+    /// false positive cannot be unwound from. The field logs showed the withholding was the more damaging
+    /// error: the values are MEASURED, not inferred. The BOUNDS are what heart rate infers — which is why
+    /// the session still marks itself `hrOnly` — but each RMSSD is computed over its own 5-minute window,
+    /// so fuzzy bounds change WHICH windows are included, not whether any one of them is valid. Resting HR
+    /// is HR-derived, and an HR-only night is precisely the night with plenty of HR.
+    ///
+    /// The marker travels with the session, so a consumer that wants to weigh these down still can.
+    func testHrOnlySessionReportsMeasuredRestingHRAndHRVAndStillMarksItself() throws {
+        let (hr, rr) = window()
+        let s = try XCTUnwrap(SleepStager.hrOnlySessions(hr: hr, rr: rr, resp: []).first)
+        XCTAssertTrue(s.hrOnly, "must still be flagged hrOnly")
+        XCTAssertNotNil(s.restingHR, "restingHR is HR-derived and must be reported")
+        XCTAssertNotNil(s.avgHRV, "avgHRV must be reported when R-R is present")
+    }
+
+    /// The honest boundary of the change: reporting is driven by whether the INPUT exists, not by the
+    /// `hrOnly` flag. With no R-R there is nothing to compute an RMSSD from, so HRV is still absent — and
+    /// resting HR, which needs only HR, is still reported. A regression that re-blanked HRV wholesale
+    /// would pass the case above if it also happened to blank on missing R-R; this separates them.
+    func testHrOnlySessionWithoutRRStillReportsRestingHR() throws {
+        let (hr, _) = window()
+        let s = try XCTUnwrap(SleepStager.hrOnlySessions(hr: hr, rr: [], resp: []).first)
+        XCTAssertTrue(s.hrOnly, "must still be flagged hrOnly")
+        XCTAssertNotNil(s.restingHR, "restingHR needs only HR")
+        XCTAssertNil(s.avgHRV, "no R-R means no RMSSD to report")
+    }
+}
diff --git a/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt b/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
index 3d7dcccc7f..f8081ef6e1 100644
--- a/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
@@ -443,10 +443,12 @@ object AnalyticsEngine {
         } else {
             val rrSorted = rr.sortedBy { it.ts }
             val enrichedProvided = providedSleep.map { s ->
-                // #1801: an HR-only night keeps its NULL restingHR/avgHRV. This is the ONE call site that
-                // can undo the display-only guarantee — enriching here would hand Charge and the baselines
-                // exactly the two values that decision withholds, silently and by default.
-                if (s.hrOnly || (s.restingHR != null && s.avgHRV != null)) s
+                // #1884: no HR-only special case any more. This used to short-circuit on `s.hrOnly` to
+                // preserve #1801's display-only guarantee, which withheld both values. Now that an HR-only
+                // session reports what it measured, that clause is not merely redundant — an HR-only night
+                // that measured a resting HR but no HRV (no R-R banked) would take the short-circuit and
+                // skip the fill every other session gets. The rule is uniform: fill what is missing.
+                if (s.restingHR != null && s.avgHRV != null) s
                 else s.copy(
                     restingHR = s.restingHR ?: SleepStager.sessionRestingHR(s.start, s.end, hr),
                     avgHRV = s.avgHRV ?: SleepStager.sessionAvgHRV(s.start, s.end, rrSorted),
@@ -550,17 +552,23 @@ object AnalyticsEngine {
         // negligible shift. The Rest/sleep-quality term is main-night; the recovery physiology is
         // day-best-resting, night-dominated. Mirrors the Swift note in AnalyticsEngine.swift.
         // Daily resting HR = lowest per-session resting HR across matched sessions.
-        // #1801: the sessions whose PHYSIOLOGY may be folded into the day's aggregates. An HR-only night
-        // is excluded — it may describe its own duration, stages and Rest, but resting HR, HRV and SDNN
-        // are what Charge and the baselines are built from, and a baseline is the one thing a false
-        // positive cannot be unwound from.
+        // #1801/#1884: the sessions whose PHYSIOLOGY is folded into the day's aggregates. Motion-backed
+        // sessions are PREFERRED; an HR-only night is used only when the day has no other kind.
         //
-        // Named once rather than filtered at each use, because the null restingHR/avgHRV an HR-only
-        // session carries only protects the aggregates that READ those fields. The deep-window HRV pool
-        // and the SDNN index below re-derive from `rr` over the session's own stages and would have
-        // folded one in regardless — which is precisely the "one forgotten call site" a scattered filter
-        // invites.
-        val physiologySessions = matched.filter { !it.hrOnly }
+        // #1801 excluded HR-only nights outright, reasoning that a baseline is the one thing a false positive
+        // cannot be unwound from. #1884 narrowed that rather than reversing it: only the session BOUNDS are
+        // inferred from heart rate — each RMSSD is measured over its own 5-minute window — so excluding the
+        // night discarded a real 22-25ms HRV and left Charge with NO input instead of a slightly fuzzy one, on
+        // every scoring pass in the field log. Preferring keeps the original protection exactly where it earned its keep (a mixed
+        // day still ignores the HR-only night outright) and gives it up only where the alternative was
+        // nothing at all. The night still travels marked `hrOnly` for any consumer that wants to weigh it
+        // down; what it no longer gets is a silent delete.
+        //
+        // Named once rather than filtered at each use: the deep-window HRV pool and the SDNN index below
+        // re-derive from `rr` over each session's own stages instead of reading restingHR/avgHRV, so the
+        // only way to scope them is through the session set itself — which is precisely the "one forgotten
+        // call site" a scattered filter invites.
+        val physiologySessions = matched.filter { !it.hrOnly }.ifEmpty { matched }
         val restingHRDaily: Int? = physiologySessions.mapNotNull { it.restingHR }.minOrNull()
         // Daily avg HRV = in-bed-weighted mean of per-session avg HRV.
         val avgHRVDaily: Double? = if (deepHrvWindow) {
@@ -870,11 +878,15 @@ object AnalyticsEngine {
             disturbances = if (matched.isEmpty()) null else disturbances,
             restingHr = restingHRDaily,
             avgHrv = avgHRVDaily,
-            // The SAME condition that just emptied the two fields above: `physiologySessions` is
-            // `matched` minus the HR-only ones, so an all-HR-only night leaves it empty and both vitals
-            // null. Recording it here rather than re-deriving in the UI keeps the explanation and the
-            // cause as one expression — a second definition could disagree with the values it explains.
-            sleepHrOnly = if (matched.isEmpty()) null else physiologySessions.isEmpty(),
+            // "Every session this day was staged from heart rate alone."
+            //
+            // #1884: read from the SESSIONS' own marker, NOT from `physiologySessions.isEmpty()`. Those
+            // two were equivalent while the set was `matched` minus the HR-only ones, so an all-HR-only
+            // night emptied it. They are NOT equivalent now that the set FALLS BACK to `matched`: it can
+            // never be empty when `matched` is not, which would have pinned this flag to false forever
+            // and silently retired the #1879 note. Deriving it from `hrOnly` states what the flag has
+            // always meant and is independent of how the physiology set is chosen.
+            sleepHrOnly = if (matched.isEmpty()) null else matched.all { it.hrOnly },
             recovery = recovery,
             strain = strain,
             exerciseCount = workouts.size,
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index 24bf3e974a..d7c32f0fc7 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -998,8 +998,8 @@ object IntelligenceEngine {
                         // also lands here, where the owner check previously blocked it. A normal 4.0 day
                         // is untouched — it streams gravity, so it never reaches this gate — and a day
                         // with no motion has too little of anything to clear `minSleepMin`, but "too
-                        // little" is not "none", so the night it could produce is display-only and
-                        // marked [DetectedSleep.hrOnly] like every other.
+                        // little" is not "none", so the night it could produce is marked
+                        // [DetectedSleep.hrOnly] like every other.
                         dayDiag(SleepStagerTrace.hrOnlyGateLine(
                             attempted = true, reason = "no-motion-no-hypnogram",
                             gravRows = grav.size, storedNights = 0,
diff --git a/android/app/src/main/java/com/noop/analytics/SleepStager.kt b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
index 5e23b3387b..5538dfde61 100644
--- a/android/app/src/main/java/com/noop/analytics/SleepStager.kt
+++ b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
@@ -700,11 +700,14 @@ object SleepStager {
      * as a confirmation gate on an already-detected run it is deliberately permissive, but as a primary
      * threshold it admits over half of any window by definition. See [hrOnlyAnchorPercentile].
      *
-     * [DetectedSleep.restingHR] and [DetectedSleep.avgHRV] are left NULL deliberately, and that is the
-     * whole display-only guarantee. An HR-only night may describe itself — duration, stages, Rest — but
-     * the resting HR and HRV it would contribute are exactly what Charge and the baselines fold in, and
-     * a baseline is the one thing a false positive cannot be unwound from. Withholding the values is
-     * structural; a downstream filter would be one forgotten call site away from failing open.
+     * [DetectedSleep.restingHR] and [DetectedSleep.avgHRV] are MEASURED here and reported (#1884). They
+     * were withheld under #1801, which treated them as inferred; they are not. Only the session BOUNDS
+     * are inferred from heart rate — that is what [DetectedSleep.hrOnly] marks — while each RMSSD is
+     * computed over its own 5-minute window, so fuzzy bounds change WHICH windows are included, not
+     * whether any one of them is valid. Withholding them discarded a measured 22-25 ms and left Charge
+     * with no input at all, which is a worse error than a slightly fuzzy one.
+     *
+     * The flag travels on instead, so a consumer that wants to weigh an HR-only night down still can.
      */
     internal fun hrOnlySessions(
         hr: List<HrSample>,
@@ -754,8 +757,20 @@ object SleepStager {
                     end = p.end,
                     efficiency = efficiency(start = p.start, end = p.end, stages = stages),
                     stages = stages,
-                    restingHR = null,
-                    avgHRV = null,
+                    // #1884: MEASURED, not nulled. The bounds here are inferred from heart rate, which is
+                    // why `hrOnly` marks the session — but each RMSSD is computed over its own 5-minute
+                    // window tagged by the stage at its centre, so fuzzy bounds change WHICH windows are
+                    // included, not whether any one of them is valid. Field logs showed this path
+                    // computing wholeNight=24.04ms / deepOnly=22.44ms over 55 windows and then throwing it
+                    // away, which left Charge with `nilScore reason=missingInput` on every pass. Resting HR
+                    // is HR-derived and an HR-only night is precisely the night with plenty of HR.
+                    //
+                    // `hrOnly` still travels with the session and is persisted as `dailyMetric.sleepHrOnly`
+                    // (#1879), so it is a quality marker now rather than a delete. Its one reader today,
+                    // `TodayScreen.showsHrOnlyNote`, is gated on a vital ACTUALLY being blank, so the note
+                    // explaining the blanks retires itself on the nights this change fills in.
+                    restingHR = sessionRestingHR(start = p.start, end = p.end, hr = hrS),
+                    avgHRV = sessionAvgHRV(start = p.start, end = p.end, rr = rrS),
                     hrOnly = true,
                 )
             )
diff --git a/android/app/src/test/java/com/noop/analytics/AnalyticsEngineHrOnlyDayTest.kt b/android/app/src/test/java/com/noop/analytics/AnalyticsEngineHrOnlyDayTest.kt
new file mode 100644
index 0000000000..777bdaf99f
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/AnalyticsEngineHrOnlyDayTest.kt
@@ -0,0 +1,80 @@
+package com.noop.analytics
+
+import com.noop.data.HrSample
+import com.noop.data.RrInterval
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.time.LocalDate
+import java.time.ZoneOffset
+
+/**
+ * A whole day whose only sleep is HR-only, driven through `analyzeDay` (#1884).
+ *
+ * The unit tests around this one check the pieces: `SleepStagerHrOnlySessionsTest` that a session reports
+ * what it measured, `HrOnlyPhysiologyIsolationTest` that the day's physiology set is chosen the way the
+ * design says. Neither runs the whole function, and the gap between them is where #1884's own regression
+ * hid: `sleepHrOnly` was derived from `physiologySessions.isEmpty()`, which is equivalent to "every
+ * session was HR-only" ONLY while the set was an exclusion. Making it a preference means it can never be
+ * empty when `matched` is not, so the flag would have been pinned to false forever — and the note that
+ * explains a blank Recovery Vitals card would have silently stopped appearing for everyone.
+ *
+ * Nothing pinned that derivation: every other `sleepHrOnly` test supplies the flag as an INPUT (the carry,
+ * the coalesce, the migration, the note gate). This drives it as an OUTPUT.
+ */
+class AnalyticsEngineHrOnlyDayTest {
+
+    private val profile = UserProfile(weightKg = 75.0, heightCm = 178.0, age = 30.0, sex = "male")
+    private val day = "2026-07-27"
+    private val dayStart = LocalDate.parse(day).atStartOfDay(ZoneOffset.UTC).toEpochSecond()
+
+    /**
+     * The same field-shaped generator the session tests use — 16 h awake around 74 +/- 11 bpm, then 8 h
+     * asleep around 64 +/- 5 — anchored so the night runs 00:00-08:00 on `day`. NO gravity, which is what
+     * makes the night HR-only: an unbonded strap streams standard HR and R-R and banks no motion.
+     */
+    private fun streams(): Pair<List<HrSample>, List<RrInterval>> {
+        val t0 = dayStart - 16 * 3600
+        val hr = ArrayList<HrSample>()
+        val rr = ArrayList<RrInterval>()
+        var i = 0
+        while (i < 16 * 3600) {
+            val bpm = 74 + (Math.sin(i / 500.0) * 11).toInt()
+            hr.add(HrSample("t", t0 + i, bpm)); rr.add(RrInterval("t", t0 + i, 60000 / bpm)); i++
+        }
+        var j = 0
+        while (j < 8 * 3600) {
+            val bpm = 64 + (Math.sin(j / 900.0) * 5).toInt()
+            val t = dayStart + j
+            hr.add(HrSample("t", t, bpm)); rr.add(RrInterval("t", t, 60000 / bpm)); j++
+        }
+        return hr to rr
+    }
+
+    @Test
+    fun `an all HR-only day reports its measured vitals and still marks itself HR-only`() {
+        val (hr, rr) = streams()
+        // The production wiring: IntelligenceEngine stages the HR-only night and hands it to analyzeDay
+        // as `providedSleep`. Driving it the same way is the point — the enrichment call site that used to
+        // short-circuit on `hrOnly` only exists on this path.
+        val provided = SleepStager.hrOnlySessions(hr, rr, emptyList())
+        assertTrue("the HR-only spine must stage a night here", provided.isNotEmpty())
+        val res = AnalyticsEngine.analyzeDay(day = day, hr = hr, rr = rr, profile = profile,
+            providedSleep = provided)
+
+        assertTrue("the staged night must reach the day's sessions", res.sleepSessions.isNotEmpty())
+        assertTrue("every session must be HR-only — this day has no gravity at all",
+            res.sleepSessions.all { it.hrOnly })
+
+        // #1884: measured, not discarded. Before the change both of these were null by construction, which
+        // is what left Charge with `nilScore reason=missingInput`.
+        assertNotNull("resting HR is HR-derived and must survive to the day row", res.daily.restingHr)
+        assertNotNull("the HRV measured over this night's windows must survive to the day row",
+            res.daily.avgHrv)
+
+        // The regression guard. `sleepHrOnly` says "every session was staged from heart rate alone", and
+        // that remains TRUE of this day — the change made the vitals available, not the staging better.
+        assertEquals("the day must still be marked HR-only", true, res.daily.sleepHrOnly)
+    }
+}
diff --git a/android/app/src/test/java/com/noop/analytics/HrOnlyPhysiologyIsolationTest.kt b/android/app/src/test/java/com/noop/analytics/HrOnlyPhysiologyIsolationTest.kt
index 7acebc9e54..741054a360 100644
--- a/android/app/src/test/java/com/noop/analytics/HrOnlyPhysiologyIsolationTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/HrOnlyPhysiologyIsolationTest.kt
@@ -4,7 +4,12 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 /**
- * The display-only guarantee for an HR-only night (#1801), guarded at the level it actually fails.
+ * How an HR-only night reaches the day's physiology, guarded at the level it actually fails.
+ *
+ * #1801 made this an EXCLUSION: an HR-only night was kept out of every physiological aggregate. #1884
+ * made it a PREFERENCE, because the exclusion was discarding a computed HRV and leaving Charge with no
+ * input at all. The night is still marked `hrOnly` for anything that wants to weigh it down; what it no
+ * longer gets is a silent delete.
  *
  * A null `restingHR`/`avgHRV` only protects an aggregate that READS those fields. Two of the day's
  * physiological aggregates do not: the deep-window HRV pool and the SDNN index both re-derive from `rr`
@@ -40,7 +45,7 @@ class HrOnlyPhysiologyIsolationTest {
     }
 
     @Test
-    fun `the physiology set excludes HR-only nights`() {
+    fun `the physiology set prefers motion-backed nights and falls back rather than emptying`() {
         var root = java.io.File(System.getProperty("user.dir") ?: ".").canonicalFile
         val src = run {
             repeat(4) {
@@ -50,8 +55,18 @@ class HrOnlyPhysiologyIsolationTest {
             }
             error("AnalyticsEngine.kt not found — this test must not pass by default")
         }
-        assertTrue("physiologySessions must filter out hrOnly",
-            src.contains("val physiologySessions = matched.filter { !it.hrOnly }"))
+        // #1884 changed this from an exclusion to a PREFERENCE, and the old assertion could not tell the
+        // difference: it was a `contains` on a prefix, so appending `.ifEmpty { matched }` reversed the
+        // guarantee while the guard stayed green. Pin the whole expression, so the next change to it has
+        // to be deliberate rather than accidental.
+        assertTrue(
+            "physiologySessions must PREFER motion-backed sessions and fall back rather than emptying",
+            src.contains("val physiologySessions = matched.filter { !it.hrOnly }.ifEmpty { matched }"),
+        )
+        // The preference still has to exist: an aggregate that simply read `matched` would fold an
+        // HR-only night in even when a motion-backed one was available on the same day.
+        assertTrue("the hrOnly filter must survive the fallback",
+            src.contains("matched.filter { !it.hrOnly }"))
     }
 
     /**
diff --git a/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySessionsTest.kt b/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySessionsTest.kt
index e8f317771d..dfae6705f4 100644
--- a/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySessionsTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/SleepStagerHrOnlySessionsTest.kt
@@ -3,12 +3,13 @@ package com.noop.analytics
 import com.noop.data.HrSample
 import com.noop.data.RrInterval
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotNull
 import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Test
 
 /**
- * Whole HR-only sessions (#1801), and the display-only guarantee that rides on them.
+ * Whole HR-only sessions (#1801), and the physiology they report (#1884).
  *
  * The night is synthetic: a slow HR drift well under the window median, so the spine puts it in the
  * sleep band. That is enough to exercise assembly and the null contract; it is NOT a claim that the
@@ -54,16 +55,39 @@ class SleepStagerHrOnlySessionsTest {
     }
 
     /**
-     * The display-only guarantee at its source. restingHR and avgHRV are the two values Charge and the
-     * baselines fold in, and a baseline is the one thing a false positive cannot be unwound from.
+     * #1884 reversed the null contract this used to pin, so the reasoning is worth keeping beside it.
+     *
+     * #1801 withheld restingHR and avgHRV here on the grounds that a baseline is the one thing a false
+     * positive cannot be unwound from. What the field logs showed is that the withholding was the more
+     * damaging error: the values are MEASURED, not inferred. The bounds are what heart rate infers —
+     * which is why the session still marks itself `hrOnly` — but each RMSSD is computed over its own
+     * 5-minute window, so fuzzy bounds change WHICH windows are included, not whether any one of them
+     * is valid. Resting HR is HR-derived, and an HR-only night is precisely the night with plenty of HR.
+     *
+     * The marker travels with the session, so a consumer that wants to weigh these down still can.
      */
     @Test
-    fun `an HR-only session withholds resting HR and HRV and marks itself`() {
+    fun `an HR-only session reports measured resting HR and HRV and still marks itself`() {
         val (hr, rr) = window()
         val s = SleepStager.hrOnlySessions(hr, rr, emptyList()).first()
-        assertTrue("must be flagged hrOnly", s.hrOnly)
-        assertNull("restingHR must stay null", s.restingHR)
-        assertNull("avgHRV must stay null", s.avgHRV)
+        assertTrue("must still be flagged hrOnly", s.hrOnly)
+        assertNotNull("restingHR is HR-derived and must be reported", s.restingHR)
+        assertNotNull("avgHRV must be reported when R-R is present", s.avgHRV)
+    }
+
+    /**
+     * The honest boundary of the change: reporting is driven by whether the INPUT exists, not by the
+     * `hrOnly` flag. With no R-R there is nothing to compute an RMSSD from, so HRV is still absent —
+     * and resting HR, which needs only HR, is still reported. A regression that re-blanked HRV wholesale
+     * would pass the test above if it also happened to blank on missing R-R; this separates them.
+     */
+    @Test
+    fun `an HR-only session without R-R still reports resting HR`() {
+        val (hr, _) = window()
+        val s = SleepStager.hrOnlySessions(hr, emptyList(), emptyList()).first()
+        assertTrue("must still be flagged hrOnly", s.hrOnly)
+        assertNotNull("restingHR needs only HR", s.restingHR)
+        assertNull("no R-R means no RMSSD to report", s.avgHRV)
     }
 
     /** A stretch below the minimum-duration gate is not a night. */

From e6450e8c1af7bb5186e9b37c7fb6946c2f310ca7 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 5 Sep 2026 12:51:10 +1200
Subject: [PATCH 240/333] build: staging 437 / iOS 318 for the next testing
 build

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 73f7c5e89d..060122b96f 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 436
+        versionCode = 437
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index d2874ed5ee..9d1e732939 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "317"
+    CURRENT_PROJECT_VERSION: "318"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 70d350c8517722c17e8fe84bf5ad25694cca8bd8 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 5 Sep 2026 13:47:00 +1200
Subject: [PATCH 241/333] ble: connect and attribute the strap the user
 actually selected (#1881)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two separable defects, both platforms, reported by @pipiche38 with file-level analysis and a proven
data trace: 770 stepSample and 770 gravitySample rows filed under an Oura ring, which has neither a
pedometer nor an accelerometer.

A — a non-active strap was scanned, connected and drained. `stopWhoop()` is edge-triggered and
nothing re-asserted it, while `poweredOn`, state restoration and the standing connect reach the WHOOP
flow on their own. A durable fail-open flag now rides the same two closures the coordinator already
uses to stop and start WHOOP, gated on the SYSTEM paths only — the user's Connect button is
deliberately exempt, since the complaint is about NOOP acting on its own.

B — samples were attributed to the ACTIVE device rather than the SOURCE device. `deviceId` meant
"the active device" and was reused as "the device these bytes came from"; those stopped being the
same thing once a ring could be active. The id is now resolved from the peripheral that actually
connected, at every seam including the restored-link one where didConnect never fires, and the
startup path no longer adopts a non-WHOOP id in the first place.

The decision itself is a pure `SourceIdentity.resolve`, tested with the same ten assertions on both
platforms, because BLE cannot be tested in CI but this can — and it is the part that silently files
rows under the wrong device when it is wrong.

Android shared both defects and is fixed here. NOT yet validated on a real strap: the ordinary
single-WHOOP path is what most needs checking, and the flag is fail-open so that is the unlikely
direction.
---
 .../Sources/WhoopStore/SourceIdentity.swift   |  48 ++++++
 .../WhoopStoreTests/SourceIdentityTests.swift |  78 +++++++++
 Strand/App/AppModel.swift                     |   8 +-
 Strand/BLE/BLEManager.swift                   | 149 +++++++++++++++++-
 Strand/BLE/SourceCoordinator.swift            |   8 +-
 .../src/main/java/com/noop/NoopApplication.kt |  34 +++-
 .../java/com/noop/ble/SourceCoordinator.kt    |  12 +-
 .../main/java/com/noop/ble/SourceIdentity.kt  |  48 ++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 132 +++++++++++++++-
 .../java/com/noop/ble/SourceIdentityTest.kt   |  93 +++++++++++
 10 files changed, 591 insertions(+), 19 deletions(-)
 create mode 100644 Packages/WhoopStore/Sources/WhoopStore/SourceIdentity.swift
 create mode 100644 Packages/WhoopStore/Tests/WhoopStoreTests/SourceIdentityTests.swift
 create mode 100644 android/app/src/main/java/com/noop/ble/SourceIdentity.kt
 create mode 100644 android/app/src/test/java/com/noop/ble/SourceIdentityTest.kt

diff --git a/Packages/WhoopStore/Sources/WhoopStore/SourceIdentity.swift b/Packages/WhoopStore/Sources/WhoopStore/SourceIdentity.swift
new file mode 100644
index 0000000000..cf9a936602
--- /dev/null
+++ b/Packages/WhoopStore/Sources/WhoopStore/SourceIdentity.swift
@@ -0,0 +1,48 @@
+import Foundation
+
+/// Which registry device a live BLE link's samples belong to (#1881).
+///
+/// Split out of `BLEManager` because it is the whole of the decision and none of the CoreBluetooth: BLE
+/// behaviour cannot be tested in CI, but *this* can, and it is the part that silently files rows under the
+/// wrong device when it is wrong. The Kotlin twin is `com.noop.ble.SourceIdentity`.
+///
+/// The bug it exists to prevent: `BLEManager` held one `deviceId` meaning "the active device" and reused it
+/// as "the device these bytes came from". Those were the same thing only while every registered device was
+/// a WHOOP. Once a ring could be active, a WHOOP connection filed its samples — including `stepSample` and
+/// `gravitySample`, which only a strap can produce — under the ring's id.
+public enum SourceIdentity {
+
+    /// The device id this connection's samples should be stored under, or nil to leave the current id alone.
+    ///
+    /// Conservative by construction. It returns an id ONLY when a registry row is both matched by peripheral
+    /// and a WHOOP, so every uncertain case keeps today's behaviour rather than guessing:
+    ///   • `address` nil, or no row carries it → nil. This is the legacy single-WHOOP row before it has
+    ///     adopted a `peripheralId`; the coordinator adopts one on this same connect, so the next resolves.
+    ///   • the matched row is not a WHOOP → nil. Nothing else should be arriving on the WHOOP delegate, and
+    ///     if it does, re-pointing the strap's id at it would be the very bug this prevents.
+    ///   • the matched row is already the current id → nil, so there is no write on the common path.
+    ///
+    /// Matching is case-insensitive because the two platforms disagree about case: Apple stores an uppercase
+    /// `CBPeripheral.identifier.uuidString`, Android an uppercase MAC — but neither is guaranteed by the OS,
+    /// and a row written by an older build may carry either.
+    public static func resolve(address: String?, rows: [PairedDevice], currentId: String) -> String? {
+        // BLANK, not merely empty, so the two platforms agree: Kotlin's `isNullOrBlank` refuses a
+        // whitespace-only address, and a bare `isEmpty` here would let one match a stored blank.
+        guard let address, !address.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty else {
+            return nil
+        }
+        guard let row = rows.first(where: {
+            guard let pid = $0.peripheralId else { return false }
+            return pid.caseInsensitiveCompare(address) == .orderedSame
+        }) else { return nil }
+        guard isWhoop(row), row.id != currentId else { return nil }
+        return row.id
+    }
+
+    /// A device is a WHOOP when it is the seeded legacy row or its brand says so. Kept here beside the
+    /// resolver rather than reaching into the app target, so this file has no dependency to test around.
+    /// Byte-identical to `SourceCoordinator.isWhoop` on both platforms.
+    public static func isWhoop(_ device: PairedDevice) -> Bool {
+        device.id == "my-whoop" || device.brand.caseInsensitiveCompare("WHOOP") == .orderedSame
+    }
+}
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/SourceIdentityTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/SourceIdentityTests.swift
new file mode 100644
index 0000000000..91e9872068
--- /dev/null
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/SourceIdentityTests.swift
@@ -0,0 +1,78 @@
+import XCTest
+@testable import WhoopStore
+
+/// Which device a live link's samples belong to (#1881) — the twin of the Kotlin `SourceIdentityTest`,
+/// asserting the same inputs and the same answers so the two platforms cannot drift.
+///
+/// The reported failure is the first case here: with an Oura ring active and a WHOOP merely paired, a
+/// WHOOP connection filed 770 `stepSample` and 770 `gravitySample` rows under the ring's id. A ring has no
+/// pedometer and no accelerometer, so 100% of those rows were misattributed — and because `hrSample` is
+/// written by both paths under one id, contamination there cannot be separated after the fact.
+final class SourceIdentityTests: XCTestCase {
+
+    private func row(_ id: String, _ brand: String, _ peripheralId: String?) -> PairedDevice {
+        PairedDevice(id: id, brand: brand, model: "m", peripheralId: peripheralId,
+                     sourceKind: .liveBLE, capabilities: [.hr], status: .paired,
+                     addedAt: 0, lastSeenAt: 0)
+    }
+
+    private lazy var ring = row("oura-abc", "Oura", "AA:BB:CC:DD:EE:01")
+    private lazy var strap = row("whoop-123", "WHOOP", "AA:BB:CC:DD:EE:02")
+
+    /// The reported bug: the ring is active, the STRAP connected, so the strap's id must win.
+    func testStrapConnectingWhileRingActiveIsAttributedToTheStrap() {
+        XCTAssertEqual(SourceIdentity.resolve(address: "AA:BB:CC:DD:EE:02",
+                                              rows: [ring, strap], currentId: "oura-abc"), "whoop-123")
+    }
+
+    /// The legacy single-WHOOP path, and the reason this returns nil rather than guessing: the seeded row
+    /// has not adopted an address yet. The coordinator adopts one on this same connect, so the NEXT connect
+    /// resolves — and until then the id stays exactly what it is today.
+    func testUnadoptedRowLeavesTheIdAlone() {
+        let legacy = row("my-whoop", "WHOOP", nil)
+        XCTAssertNil(SourceIdentity.resolve(address: "AA:BB:CC:DD:EE:02",
+                                            rows: [legacy], currentId: "my-whoop"))
+    }
+
+    /// No row carries this address — an unknown strap must never claim an existing device's id.
+    func testUnknownAddressLeavesTheIdAlone() {
+        XCTAssertNil(SourceIdentity.resolve(address: "FF:FF:FF:FF:FF:FF",
+                                            rows: [ring, strap], currentId: "oura-abc"))
+    }
+
+    /// The inverse of the bug. If a non-WHOOP row somehow matches, re-pointing the WHOOP path's id at it
+    /// would file strap samples under a ring — exactly what #1881 reports, arrived at from the other side.
+    func testNonWhoopMatchNeverClaimsTheStrapsSamples() {
+        XCTAssertNil(SourceIdentity.resolve(address: "AA:BB:CC:DD:EE:01",
+                                            rows: [ring, strap], currentId: "whoop-123"))
+    }
+
+    /// Already correct — the common path — must not write.
+    func testIdAlreadyCorrectResolvesToNothing() {
+        XCTAssertNil(SourceIdentity.resolve(address: "AA:BB:CC:DD:EE:02",
+                                            rows: [ring, strap], currentId: "whoop-123"))
+    }
+
+    /// Neither OS guarantees the case of a UUID string or a MAC, and old rows may carry either.
+    func testAddressMatchingIsCaseInsensitive() {
+        XCTAssertEqual(SourceIdentity.resolve(address: "aa:bb:cc:dd:ee:02",
+                                              rows: [ring, strap], currentId: "oura-abc"), "whoop-123")
+    }
+
+    /// A blank address is a missing address, not a wildcard that matches a blank stored value.
+    func testBlankAddressLeavesTheIdAlone() {
+        let blank = row("whoop-blank", "WHOOP", "")
+        XCTAssertNil(SourceIdentity.resolve(address: "", rows: [blank], currentId: "oura-abc"))
+        XCTAssertNil(SourceIdentity.resolve(address: nil, rows: [blank], currentId: "oura-abc"))
+        // Whitespace is blank on both platforms — Kotlin's `isNullOrBlank` set the contract.
+        let spaces = row("whoop-spaces", "WHOOP", "   ")
+        XCTAssertNil(SourceIdentity.resolve(address: "   ", rows: [spaces], currentId: "oura-abc"))
+    }
+
+    /// The legacy id is a WHOOP by id even though its brand was never guaranteed.
+    func testLegacyRowCountsAsWhoop() {
+        let legacy = row("my-whoop", "", "AA:BB:CC:DD:EE:03")
+        XCTAssertEqual(SourceIdentity.resolve(address: "AA:BB:CC:DD:EE:03",
+                                              rows: [legacy], currentId: "oura-abc"), "my-whoop")
+    }
+}
diff --git a/Strand/App/AppModel.swift b/Strand/App/AppModel.swift
index 7cfcebd92a..77ce9a5562 100644
--- a/Strand/App/AppModel.swift
+++ b/Strand/App/AppModel.swift
@@ -542,8 +542,12 @@ final class AppModel: ObservableObject {
             registry: registry,
             live: live,
             storeHandle: { [weak self] in await self?.repo.storeHandle() },
-            startWhoop: { [weak self] in self?.scan() },
-            stopWhoop: { [weak self] in self?.disconnect() },
+            // #1881: the flag rides the SAME two closures, so it inherits the coordinator's semantics
+            // exactly — including the deliberate Apple Watch exception, which calls neither and so must
+            // never stop a live WHOOP. `stopWhoop` alone was edge-triggered: it dropped the link once and
+            // nothing stopped `poweredOn` / state restoration / the standing connect bringing it back.
+            startWhoop: { [weak self] in self?.ble.setWhoopIsActiveDevice(true); self?.scan() },
+            stopWhoop: { [weak self] in self?.ble.setWhoopIsActiveDevice(false); self?.disconnect() },
             // WHOOP targeting hooks , thin wrappers over BLEManager's existing additive setters, so the
             // coordinator never references BLEManager directly (mirrors the start/stop injection). On the
             // single-WHOOP path these are setPreferredPeripheral(nil) and (no setActiveDeviceId call),
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index c5d923eb10..b2ec17a408 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -1121,6 +1121,7 @@ public final class BLEManager: NSObject, ObservableObject {
     /// `connectFromSystem`'s targeted path already makes: no new outbound command, nothing written to the
     /// strap, so the BLE safety contract is unaffected. Twin of `OuraLiveSource.issueStandingConnect`.
     private func issueStandingConnect(whilePausedForBondLoop: Bool = false) {
+        guard whoopConnectAllowed("standing-connect") else { return }
         guard !intentionalDisconnect else { return }
         // #1539: the bond-loop pause suppresses this by default, but the paused paths deliberately opt in —
         // a parked, timeout-free connect is what lets that pause end without the user.
@@ -1230,9 +1231,35 @@ public final class BLEManager: NSObject, ObservableObject {
     /// 4.0, or an unidentified strap all read false.
     var isWhoop5MG: Bool { whoop5Variant.isMG }
 
+    /// Whether a WHOOP is the device the user actually selected (#1881). FAIL-OPEN: `true` unless
+    /// something positively says otherwise, so the single-WHOOP path and every unknown state behave
+    /// exactly as before — a wrong `false` here would stop the strap connecting for everyone.
+    ///
+    /// This is the DURABLE form of the coordinator's `stopWhoop()`. That call is edge-triggered — it
+    /// fires once on the WHOOP→other-source transition and nothing re-asserts it — while the WHOOP flow
+    /// has system-driven entry points that consult nobody: `poweredOn` (every Bluetooth toggle and
+    /// `bluetoothd` restart), state restoration, and the standing connect CoreBluetooth honours while
+    /// the app is suspended. So a radio toggle resurrected a strap the user had switched away from,
+    /// drained its history, and — before the identity fix below — filed every row under the ACTIVE
+    /// device's id. Reported with a proven case: 770 `stepSample` rows under an Oura ring, which has no
+    /// pedometer.
+    ///
+    /// Set from the same two closures the coordinator already uses to stop and start WHOOP, so the
+    /// deliberate exception survives untouched: an Apple Watch becoming active must NOT stop a live
+    /// WHOOP, and `switchToAppleWatch` calls neither closure.
+    private var whoopIsActiveDevice = true
+
+    /// The last entry point `whoopConnectAllowed` turned away, so the block is logged once per path
+    /// rather than on every tick of the family-rotation timer.
+    private var lastBlockedConnectReason: String?
+
     /// Stable device id; matches the server's existing device for sync parity. Overridable.
     /// Seeded from the init argument, then refined once in bootstrapStore() to the device registry's
     /// active id (still "my-whoop" today) before any store writes use it — see bootstrapStore().
+    ///
+    /// #1881: this is "the device these bytes came from", NOT "the active device". Those were the same
+    /// thing only while every registered device was a WHOOP; `adoptSourceIdentity(for:)` re-points it
+    /// per connection from the peripheral that actually connected.
     private(set) var deviceId: String
     /// Captured (device↔wall) correlation from GET_CLOCK; nil until the response lands.
     private(set) var clockRef: ClockRef?
@@ -1344,9 +1371,24 @@ public final class BLEManager: NSObject, ObservableObject {
         let registry = DeviceRegistryStore(dbQueue: store.registryWriter)
         self.registryStore = registry
         seedLastSyncFromActiveStrap(registry: registry)
-        if let activeId = try? registry.activeDeviceId(),
-           !activeId.isEmpty {
-            self.deviceId = activeId
+        if let activeId = try? registry.activeDeviceId(), !activeId.isEmpty {
+            // #1881: adopt the active id ONLY when the active device is a WHOOP. This is the line the
+            // report quotes, and its comment stated the assumption that falsified it — with a ring active
+            // this set `deviceId` to the RING, and every live sample and historical chunk persisted under
+            // it. `adoptSourceIdentity` corrects the id when a strap connects, but not for the window
+            // between here and that connect, so the wrong value must not be adopted in the first place.
+            //
+            // Fail-open on an unknown row (nil): unchanged behaviour for anything the registry can't
+            // classify. Only a POSITIVELY non-WHOOP active device is refused, and that same fact seeds the
+            // connect gate — which closes the launch race where `poweredOn` can reach the WHOOP flow
+            // before `SourceCoordinator` has wired up and asserted it.
+            let activeRow = (try? registry.all())?.first(where: { $0.id == activeId })
+            if let activeRow, !SourceIdentity.isWhoop(activeRow) {
+                setWhoopIsActiveDevice(false)
+                log("Active device \(activeId) is not a WHOOP — leaving sample attribution on \(deviceId) (#1881)")
+            } else {
+                self.deviceId = activeId
+            }
         }
         // Look up the active device's real brand/model instead of a hardcoded string — this predated
         // multi-device support and mislabeled every non-"WHOOP 4.0" device (a WHOOP 5.0/MG strap, an Oura
@@ -1506,6 +1548,12 @@ public final class BLEManager: NSObject, ObservableObject {
     /// path schedules nothing afterwards, so the hammer loop cannot restart. A genuine bond still fully
     /// resets via the didWriteValueFor path, so a strap freed since the give-up self-heals.
     func connectFromSystem(model: WhoopModel = .persisted) {
+        // #1881: the gate belongs HERE, not in the shared `connectCore`. This file already draws the line
+        // the fix needs — `connect()` is the user's explicit Connect button, and every system-initiated
+        // path "MUST use connectFromSystem()" — and the report's complaint is only ever about NOOP acting
+        // on its own. Gating the shared core instead would have made the Connect button silently dead
+        // while the Devices screen showed a "Reconnecting…" toast.
+        guard whoopConnectAllowed("connect-from-system") else { return }
         connectCore(model: model)
     }
 
@@ -1882,6 +1930,84 @@ public final class BLEManager: NSObject, ObservableObject {
         deviceId = id
         collector?.deviceId = id
         backfiller?.deviceId = id
+        // #1881: the alarm readback attributes through the router's own copy (#1706), which this used to
+        // leave pointing at the previous device. Same field, same conflation, one more consumer.
+        router.deviceId = id
+    }
+
+    /// Record whether a WHOOP is the active device (#1881). Called from the SAME two closures the
+    /// `SourceCoordinator` already uses to stop and start the WHOOP, so it inherits their semantics
+    /// exactly — including the deliberate Apple Watch exception, which calls neither.
+    ///
+    /// Re-asserts itself: if a WHOOP link is already up when a different source becomes active, the
+    /// coordinator's own `stopWhoop()` drops it: this only stops it coming back on its own.
+    public func setWhoopIsActiveDevice(_ active: Bool) {
+        guard whoopIsActiveDevice != active else { return }
+        whoopIsActiveDevice = active
+        log(active
+            ? "WHOOP is the active device again — scanning and reconnecting are allowed"
+            : "WHOOP is no longer the active device — not scanning or connecting until it is again (#1881)")
+    }
+
+    /// The one gate every WHOOP scan/connect entry point passes through (#1881).
+    ///
+    /// Deliberately at the CONNECT sites rather than only at `connectCore`: there are five
+    /// `central.connect` sites, and `connectCore` owns two. The rest are reached from `poweredOn` and
+    /// `willRestoreState` (via `connectRestored`), from `didDiscover`, and from the standing connect —
+    /// which involves no scan at all and is honoured while the app is suspended, so no scan-side guard
+    /// can cover it.
+    ///
+    /// `reason` names the entry point in the strap log, so a "why did my ring's data grow legs" report
+    /// says which path tried. Logged only on the transition into blocking, so a rotation timer cannot
+    /// flood the log.
+    private func whoopConnectAllowed(_ reason: String) -> Bool {
+        if whoopIsActiveDevice { return true }
+        // The flag is a CACHE of a registry fact, and the registry is the authority. Re-validate before
+        // refusing, so the gate can never latch: it is set from the coordinator's stop/start closures and
+        // seeded at bootstrap, and if those ever disagree — the coordinator failing to wire after the seed
+        // said "not a WHOOP", say — a stale `false` would stop the strap connecting for the whole session.
+        // Only on the blocked path, so the common case still costs nothing.
+        if let registry = registryStore, let activeId = try? registry.activeDeviceId() {
+            let row = (try? registry.all())?.first(where: { $0.id == activeId })
+            if row.map(SourceIdentity.isWhoop) ?? true {
+                setWhoopIsActiveDevice(true)
+                return true
+            }
+        }
+        if lastBlockedConnectReason != reason {
+            lastBlockedConnectReason = reason
+            log("Not connecting the WHOOP (\(reason)): a different device is active (#1881)")
+        }
+        return false
+    }
+
+    /// Attribute this connection to the strap that ACTUALLY connected, not to whatever device is active
+    /// (#1881). Resolves the registry row whose `peripheralId` matches the connected peripheral and
+    /// re-points `deviceId` + the in-flight `Collector`/`Backfiller`/router to it.
+    ///
+    /// Conservative by construction — it only ever moves the id to a row that is BOTH a WHOOP and
+    /// matched by peripheral:
+    ///   • no registry / unreadable → leave the id alone (today's behaviour).
+    ///   • no row matches this peripheral → leave it alone. This is the legacy single-WHOOP case before
+    ///     the row has adopted a `peripheralId`; `SourceCoordinator.connectedPeripheralChanged` adopts it
+    ///     on this same connect, so the following one resolves.
+    ///   • the matched row is not a WHOOP → leave it alone; nothing else reaches this delegate.
+    ///   • already correct → no write.
+    ///
+    /// Known narrow residual: the disconnect handler flushes buffered 0x2A37 HR in a deliberately
+    /// fire-and-forget `Task`, and the Collector reads `deviceId` at PERSIST time — so a flush still in
+    /// flight when the next link re-points the id would attribute the previous link's tail to the new
+    /// strap. It needs a re-point to happen at all, which only occurs when the resolved row differs from
+    /// the current id: never on a settled single-WHOOP install. In the reported case the move is from the
+    /// ring to the strap, and those buffered rows are the STRAP's, so the new attribution is the correct
+    /// one. The genuinely wrong case is two WHOOPs where A's tail lands on B — a pre-existing hazard of
+    /// `setActiveDeviceId`, which the coordinator already calls on a WHOOP→WHOOP switch.
+    private func adoptSourceIdentity(for peripheral: CBPeripheral) {
+        guard let registry = registryStore, let rows = try? registry.all() else { return }
+        guard let resolved = SourceIdentity.resolve(address: peripheral.identifier.uuidString,
+                                                    rows: rows, currentId: deviceId) else { return }
+        log("Attributing this link to \(resolved) — the strap that connected, not the active device (#1881)")
+        setActiveDeviceId(resolved)
     }
 
     /// Add-a-WHOOP wizard: scan the selected family's WHOOP service and surface every nearby strap in
@@ -4481,6 +4607,9 @@ public final class BLEManager: NSObject, ObservableObject {
     /// `allowFallback` is true, schedule a one-shot rotation to the other WHOOP family after
     /// `scanFallbackDelaySeconds` of no discovery — recovers reconnect when the persisted preference is
     /// stale after an update/restore. Discovery/connect cancels the pending rotation. (PR#195)
+    /// No gate here, deliberately: the ONLY callers are `connectCore` — reached from the user's Connect or
+    /// from the already-gated `connectFromSystem` — and this method's own family-rotation timer, which
+    /// cannot start a scan that one of those did not. Gating here as well would block the user's Connect.
     private func startScan(for model: WhoopModel, allowFallback: Bool) {
         cancelScanFallback()
         selectedModel = model
@@ -4526,6 +4655,7 @@ public final class BLEManager: NSObject, ObservableObject {
     /// #730 pending-connect probe. Both restore entry points funnel through here so the two paths can be
     /// told apart in a strap log.
     private func connectRestored(_ p: CBPeripheral, reason: String) {
+        guard whoopConnectAllowed("restored/\(reason)") else { return }
         log("Connecting to restored peripheral (\(reason)) — peripheral state=\(peripheralStateName(p.state))")
         central.connect(p, options: nil)
         pendingConnectProbe?.cancel()
@@ -5252,6 +5382,8 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
             log("Discovered \(name) (\(peripheral.identifier)) — not the preferred strap; ignoring")
             return
         }
+        // No gate here for the same reason as `startScan`: reaching a discovery means a scan is running,
+        // and a scan only runs because the user asked or because the gated system entry allowed it.
         cancelScanFallback()
         persistSelectedModel(selectedModel)
         log("Discovered \(name) (rssi \(RSSI)) — connecting")
@@ -5276,6 +5408,9 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
         standingConnectAt = nil     // #1413: a live link means no standing connect is outstanding
         restoredPeripheral = nil
         preparePeripheral(peripheral)
+        // #1881: BEFORE anything persists. The Collector and Backfiller read `deviceId` at flush and at
+        // finishChunk, so re-pointing here is what keeps this link's rows off another device's id.
+        adoptSourceIdentity(for: peripheral)
         // Clear the per-connection bond BEFORE publishing the connected uuid below. SourceCoordinator's #52
         // re-adoption gate keys off `encryptedBond` at the instant `connectedPeripheralUUID` is observed —
         // an ordinary `didConnect` publish must always read false (only the deliberate post-bond #52
@@ -5770,7 +5905,13 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
         clockRequested = false
         clockRetries = 0
         // Ensure the store is ready before restored BLE data arrives (idempotent; no-op if already built).
-        Task { @MainActor in await bootstrapStore() }
+        Task { @MainActor in
+            await bootstrapStore()
+            // #1881: `didConnect` never fires on this path (see above), so the identity adoption that lives
+            // there would be skipped for a restored link — the very path a radio toggle and a relaunch take.
+            // After `bootstrapStore`, because it is what creates `registryStore`.
+            if let p = self.peripheral ?? self.restoredPeripheral { self.adoptSourceIdentity(for: p) }
+        }
         if p.state == .connected {
             state.connected = true
             // #613: the inherited notify subscriptions come back reported-active but dead. Force one real
diff --git a/Strand/BLE/SourceCoordinator.swift b/Strand/BLE/SourceCoordinator.swift
index 5b5e87d4cd..a8f2fb1870 100644
--- a/Strand/BLE/SourceCoordinator.swift
+++ b/Strand/BLE/SourceCoordinator.swift
@@ -588,7 +588,9 @@ final class SourceCoordinator: ObservableObject {
     }
 
     /// A device is WHOOP when its brand is "WHOOP" (the seeded `my-whoop` row's brand).
-    static func isWhoop(_ device: PairedDevice) -> Bool {
-        device.id == "my-whoop" || device.brand.caseInsensitiveCompare("WHOOP") == .orderedSame
-    }
+    ///
+    /// #1881 gave the BLE engine the same question to answer, so the rule now lives in ONE place
+    /// (`SourceIdentity`, beside `PairedDevice`) and this delegates. Two spellings of "is this a WHOOP"
+    /// that could disagree is precisely how a strap's samples end up filed under a ring.
+    static func isWhoop(_ device: PairedDevice) -> Bool { SourceIdentity.isWhoop(device) }
 }
diff --git a/android/app/src/main/java/com/noop/NoopApplication.kt b/android/app/src/main/java/com/noop/NoopApplication.kt
index 8955a99bc8..3345cb9634 100644
--- a/android/app/src/main/java/com/noop/NoopApplication.kt
+++ b/android/app/src/main/java/com/noop/NoopApplication.kt
@@ -6,6 +6,7 @@ import androidx.annotation.PluralsRes
 import androidx.annotation.StringRes
 import android.util.Log
 import com.noop.ble.SourceCoordinator
+import com.noop.ble.SourceIdentity
 import com.noop.ble.WhoopBleClient
 import com.noop.ble.WhoopModel
 import com.noop.data.DeviceRegistry
@@ -95,16 +96,39 @@ class NoopApplication : Application() {
         if (newId.isNotEmpty() && newId != activeDeviceId) activeDeviceId = newId
     }
 
+    /**
+     * The id the BLE client should stamp WHOOP samples with at startup (#1881).
+     *
+     * [activeDeviceId] answers "which device did the user select", which is NOT the same question once a
+     * non-WHOOP device can be active: handing it to the client made every WHOOP live sample and historical
+     * chunk persist under, say, an Oura ring. `adoptSourceIdentity` corrects the id when a strap actually
+     * connects, but not for the window between construction and that connect, so the wrong value must not
+     * be adopted in the first place.
+     *
+     * Fail-open: an unreadable registry or an unclassifiable row keeps today's behaviour. Only a
+     * POSITIVELY non-WHOOP active device falls back to the legacy id. Swift twin: `BLEManager.bootstrapStore`.
+     */
+    private fun whoopStartupDeviceId(): String {
+        val id = activeDeviceId
+        val rows = runCatching { runBlocking { deviceRegistry.all() } }.getOrNull() ?: return id
+        val row = rows.firstOrNull { it.id == id } ?: return id
+        return if (SourceIdentity.isWhoop(row)) id else WhoopBleClient.DEFAULT_DEVICE_ID
+    }
+
     /** Process-wide BLE client. Owns the GATT connection and outlives any single Activity/ViewModel. */
     val ble: WhoopBleClient by lazy {
+        val startupId = whoopStartupDeviceId()
         WhoopBleClient(
             applicationContext,
             repository = repository,
-            deviceId = activeDeviceId,
+            deviceId = startupId,
             successfulOffloadSink = {
                 SelfHostedPushScheduler.enqueueAfterSuccessfulOffload(applicationContext)
             },
         ).apply {
+            // #1881: the same fact seeds the connect gate, closing the launch race where the radio can
+            // reach the WHOOP flow before SourceCoordinator has wired up and asserted it.
+            if (startupId != activeDeviceId) setWhoopIsActiveDevice(false)
             // Apply the persisted "Debug logging" preference at the composition root so the low-level
             // client never has to read the UI/prefs layer. Default OFF — see WhoopBleClient.debugLogcat.
             debugLogcat = NoopPrefs.debugLogging(applicationContext)
@@ -139,8 +163,12 @@ class NoopApplication : Application() {
             // path (status=133 on an OS-bonded strap). Mirrors macOS AppModel.scan() reading the persisted
             // "selectedWhoopModel". Same-strap switches now adopt in place (no reconnect) via the
             // coordinator, so this only fires for a genuinely different WHOOP.
-            startWhoop = { ble.connect(persistedWhoopModel()) },
-            stopWhoop = { ble.disconnect() },
+            // #1881: the flag rides the SAME two closures, so it inherits the coordinator's semantics
+            // exactly. `stopWhoop` alone was edge-triggered: it dropped the link once and nothing stopped
+            // `onBluetoothRadioOn` bringing it straight back — every Bluetooth toggle reached it, and it
+            // clears `intentionalDisconnect` before reconnecting. Swift twin: AppModel.wireSourceCoordinator.
+            startWhoop = { ble.setWhoopIsActiveDevice(true); ble.connect(persistedWhoopModel()) },
+            stopWhoop = { ble.setWhoopIsActiveDevice(false); ble.disconnect() },
             // Multi-WHOOP (MW-2/MW-3): pin the connection to the active WHOOP's persisted address and
             // re-attribute live samples to it on a WHOOP→WHOOP switch. Both inert on the single-WHOOP
             // path — the coordinator only invokes them for a non-legacy WHOOP / a non-null peripheralId.
diff --git a/android/app/src/main/java/com/noop/ble/SourceCoordinator.kt b/android/app/src/main/java/com/noop/ble/SourceCoordinator.kt
index 6fdac40bad..d3d1897e23 100644
--- a/android/app/src/main/java/com/noop/ble/SourceCoordinator.kt
+++ b/android/app/src/main/java/com/noop/ble/SourceCoordinator.kt
@@ -647,9 +647,13 @@ class SourceCoordinator(
             return isWhoop(device)
         }
 
-        /** A device is WHOOP when its id is "my-whoop" or its brand is "WHOOP" (the seeded row's brand). */
-        fun isWhoop(device: PairedDeviceRow): Boolean =
-            device.id == WhoopBleClient.DEFAULT_DEVICE_ID ||
-                device.brand.equals("WHOOP", ignoreCase = true)
+        /**
+         * A device is WHOOP when its id is "my-whoop" or its brand is "WHOOP" (the seeded row's brand).
+         *
+         * #1881 gave the BLE client the same question to answer, so the rule now lives in ONE place
+         * ([SourceIdentity]) and this delegates. Two spellings of "is this a WHOOP" that could disagree is
+         * precisely how a strap's samples end up filed under a ring.
+         */
+        fun isWhoop(device: PairedDeviceRow): Boolean = SourceIdentity.isWhoop(device)
     }
 }
diff --git a/android/app/src/main/java/com/noop/ble/SourceIdentity.kt b/android/app/src/main/java/com/noop/ble/SourceIdentity.kt
new file mode 100644
index 0000000000..62b307b5ea
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ble/SourceIdentity.kt
@@ -0,0 +1,48 @@
+package com.noop.ble
+
+import com.noop.data.PairedDeviceRow
+
+/**
+ * Which registry device a live BLE link's samples belong to (#1881).
+ *
+ * Split out of [WhoopBleClient] because it is the whole of the decision and none of the Bluetooth: BLE
+ * behaviour cannot be tested in CI, but *this* can, and it is the part that silently files rows under the
+ * wrong device when it is wrong. Swift twin: `WhoopStore.SourceIdentity`.
+ *
+ * The bug it exists to prevent: the client held one `deviceId` meaning "the active device" and reused it as
+ * "the device these bytes came from". Those were the same thing only while every registered device was a
+ * WHOOP. Once a ring could be active, a WHOOP connection filed its samples — including `stepSample` and
+ * `gravitySample`, which only a strap can produce — under the ring's id.
+ */
+object SourceIdentity {
+
+    /**
+     * The device id this connection's samples should be stored under, or null to leave the current id alone.
+     *
+     * Conservative by construction. It returns an id ONLY when a registry row is both matched by address and
+     * a WHOOP, so every uncertain case keeps today's behaviour rather than guessing:
+     *  - [address] null/blank, or no row carries it -> null. This is the legacy single-WHOOP row before it
+     *    has adopted a `peripheralId`; the coordinator adopts one on this same connect, so the next resolves.
+     *  - the matched row is not a WHOOP -> null. Nothing else should arrive on the WHOOP callback, and if it
+     *    does, re-pointing the strap's id at it would be the very bug this prevents.
+     *  - the matched row is already the current id -> null, so there is no write on the common path.
+     *
+     * Matching is case-insensitive because the two platforms disagree about case (an Apple UUID string vs an
+     * Android MAC), and neither is guaranteed by the OS.
+     */
+    fun resolve(address: String?, rows: List<PairedDeviceRow>, currentId: String): String? {
+        if (address.isNullOrBlank()) return null
+        val row = rows.firstOrNull { it.peripheralId?.equals(address, ignoreCase = true) == true }
+            ?: return null
+        if (!isWhoop(row) || row.id == currentId) return null
+        return row.id
+    }
+
+    /**
+     * A device is a WHOOP when it is the seeded legacy row or its brand says so. Kept here beside the
+     * resolver rather than reaching into [SourceCoordinator], so this file has no dependency to test
+     * around. Byte-identical to `SourceCoordinator.isWhoop` on both platforms.
+     */
+    fun isWhoop(device: PairedDeviceRow): Boolean =
+        device.id == WhoopBleClient.DEFAULT_DEVICE_ID || device.brand.equals("WHOOP", ignoreCase = true)
+}
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 320e70d8d8..15396c5874 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -443,6 +443,11 @@ class WhoopBleClient(
      * ("my-whoop") — which matches the Swift default and the rest of the Android app, so behaviour
      * is unchanged today while the registry takes over as the single source of the active id.
      *
+     * `@Volatile` because #1881 added a SECOND cross-thread writer: [adoptSourceIdentity] resolves the
+     * connected strap's row on [ioScope] (the Room registry read is `suspend`) and re-points from there,
+     * while the persist sites read this on the BLE handler thread. Without it that thread could keep
+     * reading the pre-connect value and file the link's rows under the wrong device — the exact bug.
+     *
      * MUTABLE (multi-WHOOP, MW-3): [setActiveDeviceId] re-points it so a WHOOP→WHOOP switch attributes
      * new samples to the newly-active WHOOP immediately, without waiting for a relaunch. The single-WHOOP
      * path NEVER reassigns it (the coordinator only calls [setActiveDeviceId] for a non-legacy WHOOP), so
@@ -450,6 +455,7 @@ class WhoopBleClient(
      * sites + the analyze pass read this field directly; the [Backfiller] captured its own copy at
      * construction, so [setActiveDeviceId] re-points that too (see there).
      */
+    @Volatile
     private var deviceId: String = DEFAULT_DEVICE_ID,
     /** Durable trim-cursor store for the offload safe-trim watermark (see [Backfiller]). */
     private val cursorStore: TrimCursorStore = PrefsTrimCursorStore(context),
@@ -3427,6 +3433,11 @@ class WhoopBleClient(
 
     @SuppressLint("MissingPermission")
     private fun connectInternal(model: WhoopModel, userInitiated: Boolean) {
+        // #1881: only the SYSTEM path is gated. This class already draws that line — `connect()` is the
+        // user's explicit Connect button, `connectFromSystem()` is every automatic path — and the report's
+        // complaint is only ever about NOOP acting on its own. Gating both would have made the Connect
+        // button silently dead while DevicesScreen showed a "Reconnecting…" toast.
+        if (!userInitiated && !whoopConnectAllowed("connect-from-system")) return
         intentionalDisconnect = false
         // #1635: an explicit Connect is the user saying "try the handshake again" — the documented way out
         // of hello suppression, and the reason suppression is never a permanent verdict. Consumed by the
@@ -3513,7 +3524,7 @@ class WhoopBleClient(
                 scanning = false, whoop5Detected = false,
                 statusNote = "Connecting to your ${WhoopModel.WHOOP5_MG.displayName}…",
             ) }
-            connectToDevice(direct)
+            connectToDevice(direct, alreadyAuthorised = userInitiated)
             bondedDirectAttempt = true   // after connectToDevice: reset() must not clear it
             return
         }
@@ -3528,6 +3539,11 @@ class WhoopBleClient(
      * the fallback and the not-found timeout. Port of macOS BLEManager.startScan(for:allowFallback:).
      */
     @SuppressLint("MissingPermission")
+    /**
+     * No gate here, deliberately: the only callers are [connectInternal] — which gates the system path —
+     * and this method's own family-rotation timeout, which cannot start a scan that one of those did not.
+     * Gating here as well would block the user's explicit Connect.
+     */
     private fun startScan(model: WhoopModel, allowFallback: Boolean) {
         handler.removeCallbacks(scanFallbackRunnable)
         // Defensive: the normal auto-connect scan is NEVER a present-scan. Clearing the flag here means a
@@ -3841,6 +3857,99 @@ class WhoopBleClient(
         backfiller.deviceId = id
     }
 
+    /**
+     * Whether a WHOOP is the device the user actually selected (#1881). FAIL-OPEN: `true` unless
+     * something positively says otherwise, so the single-WHOOP path and every unknown state behave
+     * exactly as before — a wrong `false` here would stop the strap connecting for everyone.
+     *
+     * The DURABLE form of the coordinator's [SourceCoordinator] `stopWhoop`. That call is edge-triggered,
+     * fired once on the WHOOP -> other-source transition, while the WHOOP flow has system-driven entry
+     * points that consult nobody — [onBluetoothRadioOn] above all, which every radio toggle reaches and
+     * which explicitly clears `intentionalDisconnect` before reconnecting. Swift twin: `BLEManager`.
+     */
+    @Volatile
+    private var whoopIsActiveDevice = true
+
+    /** The last entry point [whoopConnectAllowed] turned away, so a rotation timer cannot flood the log. */
+    private var lastBlockedConnectReason: String? = null
+
+    /**
+     * Record whether a WHOOP is the active device (#1881). Called from the SAME closures the
+     * [SourceCoordinator] already uses to stop and start the WHOOP, so it inherits their semantics —
+     * including any deliberate exception that calls neither.
+     */
+    fun setWhoopIsActiveDevice(active: Boolean) {
+        if (whoopIsActiveDevice == active) return
+        whoopIsActiveDevice = active
+        log(
+            if (active) "WHOOP is the active device again — scanning and reconnecting are allowed"
+            else "WHOOP is no longer the active device — not scanning or connecting until it is again (#1881)"
+        )
+    }
+
+    /** The one gate every WHOOP scan/connect entry point passes through (#1881). Swift twin: `BLEManager`. */
+    private fun whoopConnectAllowed(reason: String): Boolean {
+        if (whoopIsActiveDevice) return true
+        // The flag is a CACHE of a registry fact, and the registry is the authority. Re-validate so the
+        // gate can never latch: it is set from the coordinator's stop/start closures and seeded at
+        // startup, and if those ever disagree a stale `false` would stop the strap connecting for the
+        // whole session.
+        //
+        // Asynchronously, unlike the Swift twin's inline read: the Room registry is `suspend` and this
+        // runs on the BLE handler thread, where `runBlocking` would be a worse bug than the one it fixes.
+        // So the re-validation lands for the NEXT attempt rather than this one — which is enough, because
+        // every caller here retries (the family rotation, the reconnect backoff, the radio-on re-arm).
+        revalidateWhoopIsActive()
+        if (lastBlockedConnectReason != reason) {
+            lastBlockedConnectReason = reason
+            log("Not connecting the WHOOP ($reason): a different device is active (#1881)")
+        }
+        return false
+    }
+
+    /** Re-read whether a WHOOP is active and un-block the gate if it is. See [whoopConnectAllowed]. */
+    private fun revalidateWhoopIsActive() {
+        val registry = (context.applicationContext as? com.noop.NoopApplication)?.deviceRegistry ?: return
+        ioScope.launch {
+            val activeId = runCatching { registry.activeDeviceId() }.getOrNull() ?: return@launch
+            val rows = runCatching { registry.all() }.getOrNull() ?: return@launch
+            val row = rows.firstOrNull { it.id == activeId }
+            if (row == null || SourceIdentity.isWhoop(row)) setWhoopIsActiveDevice(true)
+        }
+    }
+
+    /**
+     * Attribute this connection to the strap that ACTUALLY connected, not to whatever device is active
+     * (#1881). Resolves the registry row whose `peripheralId` matches [address] and re-points [deviceId]
+     * and the in-flight [Backfiller] to it.
+     *
+     * Async because the Room registry read is `suspend` (the Swift twin is synchronous GRDB and does this
+     * inline in `didConnect`). The window is between STATE_CONNECTED and the first persisted sample —
+     * service discovery, notification subscription and the strap's first response all sit inside it — so
+     * a row is not expected to land first; if one ever did it would carry the previous id.
+     *
+     * Conservative by construction: only ever moves the id to a row that is BOTH a WHOOP and matched by
+     * address. No registry, no match (the legacy single-WHOOP row before it has adopted an address), a
+     * non-WHOOP match, or an id already correct all leave it alone.
+     *  - the matched row is already the current id -> no write.
+     *
+     * Known narrow residual: the disconnect path flushes buffered live rows best-effort, and the persist
+     * sites read [deviceId] at PERSIST time — so a flush still in flight when the next link re-points the
+     * id would attribute the previous link's tail to the new strap. It needs a re-point to happen at all,
+     * which only occurs when the resolved row differs from the current id: never on a settled
+     * single-WHOOP install. Swift twin carries the same note.
+     */
+    private fun adoptSourceIdentity(address: String?) {
+        val addr = address ?: return
+        val registry = (context.applicationContext as? com.noop.NoopApplication)?.deviceRegistry ?: return
+        ioScope.launch {
+            val rows = runCatching { registry.all() }.getOrNull() ?: return@launch
+            val resolved = SourceIdentity.resolve(addr, rows, deviceId) ?: return@launch
+            log("Attributing this link to $resolved — the strap that connected, not the active device (#1881)")
+            setActiveDeviceId(resolved)
+        }
+    }
+
     /**
      * Add-a-device wizard present-scan (MW-4): scan the given WHOOP family's service and surface every
      * nearby strap in [discoveredWhoops] WITHOUT auto-connecting. Turns on [scanningForList] so
@@ -5521,7 +5630,7 @@ class WhoopBleClient(
             _state.update { it.copy(statusNote = "Found $name, connecting…") }
             // Port of didDiscover: stop scanning, then connect to this peripheral.
             stopScan()
-            connectToDevice(device)
+            connectToDevice(device, alreadyAuthorised = true)   // #1881: a scan result is already authorised
         }
 
         override fun onScanFailed(errorCode: Int) {
@@ -6119,7 +6228,21 @@ class WhoopBleClient(
     }
 
     @SuppressLint("MissingPermission")
-    private fun connectToDevice(device: BluetoothDevice, autoConnect: Boolean = false) {
+    private fun connectToDevice(
+        device: BluetoothDevice,
+        autoConnect: Boolean = false,
+        /**
+         * #1881: true when the decision to connect was ALREADY authorised upstream — the user's explicit
+         * Connect, or a scan result, which can only exist because a gated-or-user scan is running. Every
+         * other caller is automatic (the radio-on re-arm, the reconnect backoff, launch auto-reconnect
+         * #67) and defaults to false, which is what the gate is for.
+         *
+         * Threaded rather than gated once upstream because, unlike Swift, these callers do NOT all funnel
+         * through a single system entry point.
+         */
+        alreadyAuthorised: Boolean = false,
+    ) {
+        if (!alreadyAuthorised && !whoopConnectAllowed("connect-to-device")) return
         // Reset per-connection state (mirrors the Swift flags cleared on connect/disconnect).
         reset()
         // Remember the device so a later dropout can reconnect straight to it (#61).
@@ -6182,6 +6305,9 @@ class WhoopBleClient(
                     // #1030 (ryanbr): a real link is up — cancel any pending involuntary reconnect so a
                     // stale backoff timer can't fire and reset+close this connection.
                     cancelPendingReconnect()
+                    // #1881: attribute this link to the strap that actually connected, before anything
+                    // persists. Swift twin: `BLEManager.didConnect` -> `adoptSourceIdentity(for:)`.
+                    adoptSourceIdentity(runCatching { g.device?.address }.getOrNull())
                     // A successful connect clears the reconnect backoff — the next involuntary drop starts
                     // the 3,6,12…s schedule afresh (iOS didConnect: failedConnectAttempts=0, #48). Reset
                     // IMMEDIATELY, not behind a survival dwell: a band the OS holds bonded/ACL-connected
diff --git a/android/app/src/test/java/com/noop/ble/SourceIdentityTest.kt b/android/app/src/test/java/com/noop/ble/SourceIdentityTest.kt
new file mode 100644
index 0000000000..785b3d3400
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ble/SourceIdentityTest.kt
@@ -0,0 +1,93 @@
+package com.noop.ble
+
+import com.noop.data.PairedDeviceRow
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/**
+ * Which device a live link's samples belong to (#1881) — the ORACLE for the Swift twin
+ * `SourceIdentityTests`, asserting the same inputs and the same answers on both platforms.
+ *
+ * The reported failure is the first case here: with an Oura ring active and a WHOOP merely paired, a
+ * WHOOP connection filed 770 `stepSample` and 770 `gravitySample` rows under the ring's id. A ring has
+ * no pedometer and no accelerometer, so 100% of those rows were misattributed — and because `hrSample`
+ * is written by both paths under one id, contamination there cannot be separated after the fact.
+ */
+class SourceIdentityTest {
+
+    private fun row(id: String, brand: String, peripheralId: String?) = PairedDeviceRow(
+        id = id, brand = brand, model = "m", nickname = null, peripheralId = peripheralId,
+        sourceKind = "liveBLE", capabilities = "hr", status = "paired", addedAt = 0L, lastSeenAt = 0L,
+    )
+
+    private val ring = row("oura-abc", "Oura", "AA:BB:CC:DD:EE:01")
+    private val strap = row("whoop-123", "WHOOP", "AA:BB:CC:DD:EE:02")
+
+    /** The reported bug: the ring is active, the STRAP connected, so the strap's id must win. */
+    @Test
+    fun `a strap connecting while a ring is active is attributed to the strap`() {
+        assertEquals("whoop-123",
+            SourceIdentity.resolve("AA:BB:CC:DD:EE:02", listOf(ring, strap), currentId = "oura-abc"))
+    }
+
+    /**
+     * The legacy single-WHOOP path, and the reason this returns null rather than guessing: the seeded row
+     * has not adopted an address yet. The coordinator adopts one on this same connect, so the NEXT connect
+     * resolves — and until then the id stays exactly what it is today.
+     */
+    @Test
+    fun `an unadopted row leaves the id alone`() {
+        val legacy = row(WhoopBleClient.DEFAULT_DEVICE_ID, "WHOOP", null)
+        assertNull(SourceIdentity.resolve("AA:BB:CC:DD:EE:02", listOf(legacy),
+            currentId = WhoopBleClient.DEFAULT_DEVICE_ID))
+    }
+
+    /** No row carries this address — an unknown strap must never claim an existing device's id. */
+    @Test
+    fun `an unknown address leaves the id alone`() {
+        assertNull(SourceIdentity.resolve("FF:FF:FF:FF:FF:FF", listOf(ring, strap), currentId = "oura-abc"))
+    }
+
+    /**
+     * The inverse of the bug. If a non-WHOOP row somehow matches, re-pointing the WHOOP path's id at it
+     * would file strap samples under a ring — which is exactly what #1881 reports, arrived at from the
+     * other direction.
+     */
+    @Test
+    fun `a non-WHOOP match never claims the strap's samples`() {
+        assertNull(SourceIdentity.resolve("AA:BB:CC:DD:EE:01", listOf(ring, strap), currentId = "whoop-123"))
+    }
+
+    /** Already correct — the common path — must not write. */
+    @Test
+    fun `an id already correct resolves to nothing`() {
+        assertNull(SourceIdentity.resolve("AA:BB:CC:DD:EE:02", listOf(ring, strap), currentId = "whoop-123"))
+    }
+
+    /** Neither OS guarantees the case of a UUID string or a MAC, and old rows may carry either. */
+    @Test
+    fun `address matching is case-insensitive`() {
+        assertEquals("whoop-123",
+            SourceIdentity.resolve("aa:bb:cc:dd:ee:02", listOf(ring, strap), currentId = "oura-abc"))
+    }
+
+    /** A blank address is a missing address, not a wildcard that matches a blank stored value. */
+    @Test
+    fun `a blank address leaves the id alone`() {
+        val blank = row("whoop-blank", "WHOOP", "")
+        assertNull(SourceIdentity.resolve("", listOf(blank), currentId = "oura-abc"))
+        assertNull(SourceIdentity.resolve(null, listOf(blank), currentId = "oura-abc"))
+        // Whitespace is blank on both platforms — the Swift twin was aligned to this.
+        val spaces = row("whoop-spaces", "WHOOP", "   ")
+        assertNull(SourceIdentity.resolve("   ", listOf(spaces), currentId = "oura-abc"))
+    }
+
+    /** The legacy id is a WHOOP by id even though its brand was never guaranteed. */
+    @Test
+    fun `the legacy row counts as a WHOOP`() {
+        val legacy = row(WhoopBleClient.DEFAULT_DEVICE_ID, "", "AA:BB:CC:DD:EE:03")
+        assertEquals(WhoopBleClient.DEFAULT_DEVICE_ID,
+            SourceIdentity.resolve("AA:BB:CC:DD:EE:03", listOf(legacy), currentId = "oura-abc"))
+    }
+}

From ef960511927a7bf9902fb168ff7e4e1a45ed96a3 Mon Sep 17 00:00:00 2001
From: Bernd Helm <bhelm@users.noreply.github.com>
Date: Sat, 5 Sep 2026 04:02:45 +0200
Subject: [PATCH 242/333] feat: sleep-aware steps and physiological day cycles
 (#1572)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Sleep-aware steps and physiological day cycles, by @bhelm.

Additive daily values — steps, energy, completed and live Effort, workout assignment and counts, and
both Today HR timelines — can now be owned by a physiological day running from main-sleep onset to
the next, instead of by the calendar. Sleep and recovery keep their existing night/wake-day
semantics. `DayCycleResolver` is deliberately separate from the consumers, with the same window
resolution on both platforms.

A day with no detected sleep falls back to the calendar window, so an install with sparse or no
sleep data behaves exactly as before, and a 40-hour absolute cap prevents an unbounded open window.
Imported WHOOP daily values are untouched; Apple and Health Connect calendar aggregates remain
unchanged fallbacks.

`dayCycleMode` is user-selectable in Settings on both platforms and is carried by settings backup and
restore. It currently defaults to sleep-onset for installs with no stored preference.

Review history: an earlier pass found the Apple `DailyMetric` rebuild dropping `skinTempC` and
`sleepHrOnly` by omission — Swift structs have no `copy()`, so each rebuild respells the field list.
@bhelm repaired it with a regression test; the rebuild now names all 22 fields.
---
 .../Sources/StrandAnalytics/DayCycle.swift    |  67 ++++
 .../StrandAnalytics/PhysiologicalSteps.swift  | 120 ++++++
 .../SleepAwareStepCounter.swift               | 137 +++++++
 .../StrandAnalytics/StepsCounter.swift        |  58 ++-
 .../StrandAnalyticsTests/DayCycleTests.swift  |  46 +++
 .../SleepAwareStepCounterTests.swift          |  41 ++
 .../StepsCounterTests.swift                   |  33 +-
 .../StepsDailyTests.swift                     |   4 +-
 .../Sources/WhoopStore/BackupSettings.swift   |   2 +
 .../WhoopStore/Sources/WhoopStore/Reads.swift |  69 ++++
 .../ScoreInputProvenanceStore.swift           |  20 +-
 .../Sources/WhoopStore/StreamStore.swift      |   6 +
 .../Sources/WhoopStore/WhoopStore.swift       |  43 +++
 .../WhoopStoreTests/BackupSettingsTests.swift |   2 +
 .../ScoreInputProvenanceStoreTests.swift      |  17 +
 .../WhoopStoreTests/StepSampleTests.swift     |  50 +++
 .../DayCycleIntelligenceIntegration.swift     | 335 ++++++++++++++++
 Strand/Data/IntelligenceEngine.swift          |  74 +++-
 Strand/Data/Repository.swift                  |  11 +-
 Strand/Liquid/LiquidTodayView.swift           |  18 +-
 Strand/Resources/Localizable.xcstrings        |  33 ++
 Strand/Screens/CoupledView.swift              |  15 +-
 Strand/Screens/SettingsView.swift             |  22 ++
 Strand/Screens/TodayView.swift                |  36 +-
 StrandTests/DayCycleRecoveryTests.swift       |  87 +++++
 .../main/java/com/noop/analytics/DayCycle.kt  |  81 ++++
 .../DayCycleIntelligenceIntegration.kt        | 147 +++++++
 .../com/noop/analytics/IntelligenceEngine.kt  | 107 +++---
 .../noop/analytics/IntelligencePersistence.kt | 115 ++++++
 .../analytics/PhysiologicalStepCycleEngine.kt | 360 ++++++++++++++++++
 .../com/noop/analytics/PhysiologicalSteps.kt  | 208 ++++++++++
 .../noop/analytics/RegistryDayOwnerSource.kt  |  12 +-
 .../noop/analytics/SleepAwareStepCounter.kt   | 211 ++++++++++
 .../java/com/noop/analytics/StepsCounter.kt   |  57 ++-
 .../main/java/com/noop/ble/WhoopBleClient.kt  |   1 +
 .../main/java/com/noop/data/BackupSettings.kt |   5 +
 .../src/main/java/com/noop/data/WhoopDao.kt   |  76 ++++
 .../java/com/noop/data/WhoopRepository.kt     | 106 +++++-
 .../main/java/com/noop/ui/ActiveDayCycle.kt   |  36 ++
 .../src/main/java/com/noop/ui/AppViewModel.kt |  40 ++
 .../main/java/com/noop/ui/CoupledScreen.kt    |  20 +-
 .../src/main/java/com/noop/ui/MainActivity.kt |  13 +
 .../main/java/com/noop/ui/SettingsScreen.kt   |  40 ++
 .../src/main/java/com/noop/ui/TodayScreen.kt  |  51 ++-
 .../app/src/main/res/values-de/strings.xml    |   7 +
 .../app/src/main/res/values-es/strings.xml    |   7 +
 .../app/src/main/res/values-fr/strings.xml    |   7 +
 .../app/src/main/res/values-pl/strings.xml    |   7 +
 .../src/main/res/values-pt-rPT/strings.xml    |   7 +
 .../app/src/main/res/values-ru/strings.xml    |   7 +
 .../app/src/main/res/values-zh/strings.xml    |   7 +
 android/app/src/main/res/values/strings.xml   |   7 +
 .../noop/analytics/DayCycleResolverTest.kt    |  44 +++
 .../noop/analytics/PhysiologicalStepsTest.kt  | 181 +++++++++
 .../analytics/RegistryDayOwnerSourceTest.kt   |  12 +-
 .../analytics/SleepAwareStepCounterTest.kt    | 158 ++++++++
 .../StepCycleIntegrationPolicyTest.kt         | 222 +++++++++++
 .../com/noop/analytics/StepsAnalyticsTest.kt  |   6 +-
 .../com/noop/analytics/StepsCounterTest.kt    |  35 +-
 .../com/noop/data/BackupSettingsCodecTest.kt  |   2 +
 .../com/noop/data/ReadoutDataRevisionTest.kt  |  14 +-
 .../noop/data/StepDataRevisionIndexTest.kt    |  53 +++
 .../noop/ui/ActiveCycleStepsResolverTest.kt   |  86 +++++
 63 files changed, 3710 insertions(+), 191 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Sources/StrandAnalytics/DayCycle.swift
 create mode 100644 Packages/StrandAnalytics/Sources/StrandAnalytics/PhysiologicalSteps.swift
 create mode 100644 Packages/StrandAnalytics/Sources/StrandAnalytics/SleepAwareStepCounter.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/DayCycleTests.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepAwareStepCounterTests.swift
 create mode 100644 Strand/Data/DayCycleIntelligenceIntegration.swift
 create mode 100644 StrandTests/DayCycleRecoveryTests.swift
 create mode 100644 android/app/src/main/java/com/noop/analytics/DayCycle.kt
 create mode 100644 android/app/src/main/java/com/noop/analytics/DayCycleIntelligenceIntegration.kt
 create mode 100644 android/app/src/main/java/com/noop/analytics/IntelligencePersistence.kt
 create mode 100644 android/app/src/main/java/com/noop/analytics/PhysiologicalStepCycleEngine.kt
 create mode 100644 android/app/src/main/java/com/noop/analytics/PhysiologicalSteps.kt
 create mode 100644 android/app/src/main/java/com/noop/analytics/SleepAwareStepCounter.kt
 create mode 100644 android/app/src/main/java/com/noop/ui/ActiveDayCycle.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/DayCycleResolverTest.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/PhysiologicalStepsTest.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/SleepAwareStepCounterTest.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/StepCycleIntegrationPolicyTest.kt
 create mode 100644 android/app/src/test/java/com/noop/data/StepDataRevisionIndexTest.kt
 create mode 100644 android/app/src/test/java/com/noop/ui/ActiveCycleStepsResolverTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/DayCycle.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/DayCycle.swift
new file mode 100644
index 0000000000..ddd142eb2a
--- /dev/null
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/DayCycle.swift
@@ -0,0 +1,67 @@
+import Foundation
+
+public enum DayCycleMode: String, CaseIterable, Sendable {
+    case sleepOnset = "sleep_onset"
+    case midnight = "midnight"
+
+    public static let storageKey = "noop.dayCycleMode"
+    /// Kotlin twin: `DayCycleMode.fromPersisted`.
+    public static func persisted(_ value: String?) -> DayCycleMode {
+        value.flatMap(Self.init(rawValue:)) ?? .sleepOnset
+    }
+}
+
+public struct DayCycleWindow: Equatable, Sendable {
+    public enum Source: Equatable, Sendable { case detectedSleep, editedSleep, syntheticMidnight, calendar }
+    public let id: String
+    public let startInclusive: Int
+    public let endExclusive: Int
+    public let displayDay: String
+    public let source: Source
+
+    public init(id: String, startInclusive: Int, endExclusive: Int, displayDay: String, source: Source) {
+        self.id = id; self.startInclusive = startInclusive; self.endExclusive = endExclusive
+        self.displayDay = displayDay; self.source = source
+    }
+}
+
+public enum DayCycleResolver {
+    public static let minSyntheticMidnightAgeSeconds = 18 * 3_600
+    public static let absoluteMaxOpenSeconds = 40 * 3_600
+
+    /// Kotlin twin: `DayCycleResolver.calendarWindow`.
+    public static func calendarWindow(now: Int, offsetSec: Int) -> DayCycleWindow {
+        let local = now + offsetSec
+        let dayNumber = Int(floor(Double(local) / Double(SleepStageTotals.secondsPerDay)))
+        let start = dayNumber * SleepStageTotals.secondsPerDay - offsetSec
+        let day = AnalyticsEngine.dayString(start, offsetSec: offsetSec)
+        return DayCycleWindow(id: "calendar:\(day)", startInclusive: start, endExclusive: now,
+                              displayDay: day, source: .calendar)
+    }
+
+    /// Kotlin twin: `DayCycleResolver.fallbackMidnightAfter`.
+    public static func fallbackMidnight(after start: Int, offsetSec: Int) -> Int {
+        let minimum = start + minSyntheticMidnightAgeSeconds
+        let local = minimum + offsetSec
+        let dayNumber = Int(floor(Double(local) / Double(SleepStageTotals.secondsPerDay)))
+        let midnight = dayNumber * SleepStageTotals.secondsPerDay - offsetSec
+        return midnight >= minimum ? midnight : (dayNumber + 1) * SleepStageTotals.secondsPerDay - offsetSec
+    }
+
+    /// Kotlin twin: `DayCycleResolver.activeWindow`.
+    public static func activeWindow(mode: DayCycleMode, latestSleep: DayCycleWindow?, now: Int,
+                                    offsetSec: Int, reliableAwakeCoverage: Bool) -> DayCycleWindow {
+        guard mode == .sleepOnset, let latestSleep else { return calendarWindow(now: now, offsetSec: offsetSec) }
+        let age = now - latestSleep.startInclusive
+        let fallback = fallbackMidnight(after: latestSleep.startInclusive, offsetSec: offsetSec)
+        // Sleep-onset mode remains anchored across midnight when awake coverage is unavailable.
+        // Only the absolute safety cap may synthesize a fallback boundary.
+        guard age < absoluteMaxOpenSeconds else {
+            let day = AnalyticsEngine.dayString(fallback, offsetSec: offsetSec)
+            return DayCycleWindow(id: "synthetic:\(day)", startInclusive: fallback, endExclusive: now,
+                                  displayDay: day, source: .syntheticMidnight)
+        }
+        return DayCycleWindow(id: latestSleep.id, startInclusive: latestSleep.startInclusive,
+                              endExclusive: now, displayDay: latestSleep.displayDay, source: latestSleep.source)
+    }
+}
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/PhysiologicalSteps.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/PhysiologicalSteps.swift
new file mode 100644
index 0000000000..3527481319
--- /dev/null
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/PhysiologicalSteps.swift
@@ -0,0 +1,120 @@
+import Foundation
+import WhoopProtocol
+
+public enum PhysiologicalSteps {
+    public enum SleepKind: Sendable { case mainSleep, nap, unclassified }
+    public struct SleepBlock: Sendable {
+        public let onset: Int
+        public let end: Int
+        public let id: String
+        public let editedOnset: Int?
+        public let kind: SleepKind
+        public var effectiveOnset: Int { editedOnset ?? onset }
+        public init(onset: Int, end: Int, id: String? = nil, editedOnset: Int? = nil,
+                    kind: SleepKind = .unclassified) {
+            self.onset = onset; self.end = end; self.id = id ?? String(onset)
+            self.editedOnset = editedOnset; self.kind = kind
+        }
+    }
+    public struct CycleBoundary: Equatable, Sendable {
+        public let sleepId: String
+        public let onset: Int
+        public init(sleepId: String, onset: Int) { self.sleepId = sleepId; self.onset = onset }
+    }
+    public struct CycleWindow: Equatable, Sendable {
+        public let sleepId: String; public let onset: Int; public let endExclusive: Int
+        public init(sleepId: String, onset: Int, endExclusive: Int) {
+            self.sleepId = sleepId; self.onset = onset; self.endExclusive = endExclusive
+        }
+    }
+    public struct OwnerSegment: Equatable, Sendable {
+        public let owner: String; public let onset: Int; public let endExclusive: Int
+        public init(owner: String, onset: Int, endExclusive: Int) {
+            self.owner = owner; self.onset = onset; self.endExclusive = endExclusive
+        }
+    }
+    public struct OwnerCoverage: Equatable, Sendable {
+        public let owner: String; public let onset: Int; public let endExclusive: Int; public let priority: Int
+        public init(owner: String, onset: Int, endExclusive: Int, priority: Int) {
+            self.owner = owner; self.onset = onset; self.endExclusive = endExclusive; self.priority = priority
+        }
+    }
+    private static let minMainSleepSeconds = 3 * 3_600
+
+    /// Kotlin twin: `PhysiologicalSteps.classifyForCycle`.
+    public static func classifyForCycle(_ blocks: [SleepBlock], offsetSec: Int,
+                                        habitualMidsleepSec: Int?) -> [SleepBlock] {
+        guard !blocks.isEmpty else { return [] }
+        let explicit = blocks.indices.filter { blocks[$0].kind == .mainSleep }
+        let selectable = blocks.indices.filter { blocks[$0].kind != .nap }
+        let selected: Set<Int>
+        if !explicit.isEmpty {
+            selected = Set(explicit)
+        } else {
+            let nightBlocks = selectable.map { SleepStageTotals.NightBlock(start: blocks[$0].effectiveOnset,
+                                                                            end: blocks[$0].end) }
+            let eligible = SleepStageTotals.bridgedNightGroups(nightBlocks, offsetSec: offsetSec)
+                .filter { group in
+                    let total = group.indices.reduce(0) { $0 + max(0, nightBlocks[$1].durationS) }
+                    let onset = group.indices.map { nightBlocks[$0].start }.min()
+                    return total >= minMainSleepSeconds && onset.map {
+                        SleepStageTotals.isOvernightOnset($0, offsetSec: offsetSec)
+                    } == true
+                }
+                .flatMap { $0.indices }
+            let candidates = eligible.map { index in
+                SleepStageTotals.NightBlock(start: blocks[selectable[index]].effectiveOnset,
+                                            end: blocks[selectable[index]].end)
+            }
+            let picked = SleepStageTotals.mainNightGroupIndices(candidates, offsetSec: offsetSec,
+                                                                habitualMidsleepSec: habitualMidsleepSec) ?? []
+            selected = Set(picked.map { selectable[eligible[$0]] })
+        }
+        return blocks.indices.map { index in
+            let block = blocks[index]
+            return SleepBlock(onset: block.onset, end: block.end, id: block.id,
+                              editedOnset: block.editedOnset,
+                              kind: selected.contains(index) ? .mainSleep : .nap)
+        }
+    }
+
+    /// Kotlin twin: `PhysiologicalSteps.cycleWindows`.
+    public static func cycleWindows(_ boundaries: [CycleBoundary], now: Int) -> [CycleWindow] {
+        var ids = Set<String>()
+        let ordered = boundaries.filter { $0.onset <= now && ids.insert($0.sleepId).inserted }
+            .sorted { $0.onset < $1.onset }
+        return ordered.indices.compactMap { index in
+            let end = index + 1 < ordered.count ? ordered[index + 1].onset : now
+            return end > ordered[index].onset
+                ? CycleWindow(sleepId: ordered[index].sleepId, onset: ordered[index].onset, endExclusive: end)
+                : nil
+        }
+    }
+
+    /// Kotlin twin: `PhysiologicalSteps.ownerSegmentsFromCoverage`.
+    public static func ownerSegmentsFromCoverage(_ window: CycleWindow, coverage: [OwnerCoverage],
+                                                 fallbackOwner: String) -> [OwnerSegment] {
+        guard window.endExclusive > window.onset else { return [] }
+        let clipped = coverage.compactMap { item -> OwnerCoverage? in
+            let start = max(window.onset, item.onset), end = min(window.endExclusive, item.endExclusive)
+            return end > start ? OwnerCoverage(owner: item.owner, onset: start,
+                endExclusive: end, priority: item.priority) : nil
+        }
+        let seams = Set([window.onset, window.endExclusive] + clipped.flatMap { [$0.onset, $0.endExclusive] }).sorted()
+        var result: [OwnerSegment] = [], lastOwner = fallbackOwner
+        for index in 0..<(seams.count - 1) {
+            let start = seams[index], end = seams[index + 1]
+            let owner = clipped.filter { start >= $0.onset && start < $0.endExclusive }
+                .sorted { $0.priority == $1.priority ? $0.owner < $1.owner : $0.priority < $1.priority }
+                .first?.owner ?? lastOwner
+            if let last = result.last, last.owner == owner, last.endExclusive == start {
+                result[result.count - 1] = OwnerSegment(owner: owner, onset: last.onset, endExclusive: end)
+            } else {
+                result.append(OwnerSegment(owner: owner, onset: start, endExclusive: end))
+            }
+            lastOwner = owner
+        }
+        return result
+    }
+
+}
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepAwareStepCounter.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepAwareStepCounter.swift
new file mode 100644
index 0000000000..fbe95a4025
--- /dev/null
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepAwareStepCounter.swift
@@ -0,0 +1,137 @@
+import Foundation
+import WhoopProtocol
+
+/// Sleep-context twin of Kotlin `SleepAwareStepCounter`. Counter decisions stay orientation-independent.
+public enum SleepAwareStepCounter {
+    public static let maxSecondsBetweenGaitDeltas = 3
+    public static let minGaitBoutDurationSeconds = 4
+    public static let minGaitBoutActiveSamples = 5
+    public static let minGaitBoutTicks = 6
+
+    public struct Count: Equatable, Sendable {
+        public let totalTicks: Int
+        public let acceptedOutsideSleepTicks: Int
+        public let acceptedAwakeGapTicks: Int
+        public let acceptedSleepBoutTicks: Int
+        public let rejectedIsolatedSleepTicks: Int
+        public let rejectedActivityClassTicks: Int
+        public let rejectedImplausibleTicks: Int
+        public let gravitySamplesAvailable: Int
+        public let auxSamplesAvailable: Int
+
+        public static let empty = Count(totalTicks: 0, acceptedOutsideSleepTicks: 0,
+            acceptedAwakeGapTicks: 0, acceptedSleepBoutTicks: 0, rejectedIsolatedSleepTicks: 0,
+            rejectedActivityClassTicks: 0, rejectedImplausibleTicks: 0,
+            gravitySamplesAvailable: 0, auxSamplesAvailable: 0)
+
+        /// Kotlin twin: `SleepAwareStepCounter.Count.plus`.
+        public func adding(_ other: Count) -> Count {
+            Count(totalTicks: totalTicks + other.totalTicks,
+                acceptedOutsideSleepTicks: acceptedOutsideSleepTicks + other.acceptedOutsideSleepTicks,
+                acceptedAwakeGapTicks: acceptedAwakeGapTicks + other.acceptedAwakeGapTicks,
+                acceptedSleepBoutTicks: acceptedSleepBoutTicks + other.acceptedSleepBoutTicks,
+                rejectedIsolatedSleepTicks: rejectedIsolatedSleepTicks + other.rejectedIsolatedSleepTicks,
+                rejectedActivityClassTicks: rejectedActivityClassTicks + other.rejectedActivityClassTicks,
+                rejectedImplausibleTicks: rejectedImplausibleTicks + other.rejectedImplausibleTicks,
+                gravitySamplesAvailable: gravitySamplesAvailable + other.gravitySamplesAvailable,
+                auxSamplesAvailable: auxSamplesAvailable + other.auxSamplesAvailable)
+        }
+    }
+
+    /// Stateful, overlap-safe counter for database windows read in ascending pages.
+    public final class Accumulator {
+        private let sessions: [SleepSession]
+        private let hasClasses: Bool
+        private var previous: StepSample?
+        private var outside = 0, awake = 0, sleep = 0, rejectedSleep = 0
+        private var rejectedClass = 0, rejectedImplausible = 0
+        private var gravityAvailable = 0, auxAvailable = 0
+        private var pending: [(ts: Int, ticks: Int)] = []
+        private var finished = false
+
+        public init(sleepSessions: [SleepSession], hasActivityClasses: Bool) {
+            sessions = sleepSessions.sorted { $0.start < $1.start }
+            hasClasses = hasActivityClasses
+        }
+
+        /// Kotlin twin: `SleepAwareStepCounter.Accumulator.acceptPage`.
+        @discardableResult public func acceptPage(_ samples: [StepSample]) -> Accumulator {
+            precondition(!finished)
+            for current in samples.sorted(by: { $0.ts < $1.ts }) {
+                guard let prior = previous else { previous = current; continue }
+                guard current.ts > prior.ts else { continue }
+                previous = current
+                let delta = (current.counter - prior.counter) & 0xffff
+                guard StepsCounter.shouldCountDelta(activityClass: current.activityClass,
+                                                     hasActivityClasses: hasClasses) else {
+                    rejectedClass += delta; continue
+                }
+                guard StepsCounter.isPlausibleDelta(previousTs: prior.ts, currentTs: current.ts,
+                                                    delta: delta) else {
+                    rejectedImplausible += delta; continue
+                }
+                switch SleepAwareStepCounter.context(current.ts, sessions: sessions) {
+                case 0: flush(); outside += delta
+                case 1: flush(); awake += delta
+                default:
+                    if let last = pending.last, current.ts - last.ts > maxSecondsBetweenGaitDeltas { flush() }
+                    pending.append((current.ts, delta))
+                }
+            }
+            return self
+        }
+
+        /// Kotlin twin: `SleepAwareStepCounter.Accumulator.observeMotionPage`.
+        @discardableResult public func observeMotion(gravityCount: Int, auxCount: Int) -> Accumulator {
+            precondition(!finished)
+            gravityAvailable += gravityCount
+            auxAvailable += auxCount
+            return self
+        }
+
+        /// Kotlin twin: `SleepAwareStepCounter.Accumulator.finish`.
+        public func finish() -> Count {
+            if !finished { flush(); finished = true }
+            return Count(totalTicks: outside + awake + sleep, acceptedOutsideSleepTicks: outside,
+                         acceptedAwakeGapTicks: awake, acceptedSleepBoutTicks: sleep,
+                         rejectedIsolatedSleepTicks: rejectedSleep,
+                         rejectedActivityClassTicks: rejectedClass,
+                         rejectedImplausibleTicks: rejectedImplausible,
+                         gravitySamplesAvailable: gravityAvailable,
+                         auxSamplesAvailable: auxAvailable)
+        }
+
+        /// Kotlin twin: `SleepAwareStepCounter.Accumulator.flushSleepBout`.
+        private func flush() {
+            guard !pending.isEmpty else { return }
+            let ticks = pending.reduce(0) { $0 + $1.ticks }
+            let duration = pending.last!.ts - pending.first!.ts
+            let coherent = pending.count >= minGaitBoutActiveSamples
+                && duration >= minGaitBoutDurationSeconds && ticks >= minGaitBoutTicks
+            if coherent { sleep += ticks } else { rejectedSleep += ticks }
+            pending.removeAll(keepingCapacity: true)
+        }
+    }
+
+    /// Kotlin twin: `SleepAwareStepCounter.stepsInWindow`.
+    public static func stepsInWindow(_ samples: [StepSample], sleepSessions: [SleepSession]) -> Int? {
+        let count = count(samples, sleepSessions: sleepSessions)
+        return count.totalTicks > 0 ? count.totalTicks : nil
+    }
+
+    /// Kotlin twin: `SleepAwareStepCounter.count`.
+    public static func count(_ samples: [StepSample], sleepSessions: [SleepSession]) -> Count {
+        let sorted = samples.sorted { $0.ts < $1.ts }
+        return Accumulator(sleepSessions: sleepSessions,
+                           hasActivityClasses: StepsCounter.hasActivityClasses(sorted))
+            .acceptPage(sorted).finish()
+    }
+
+    /// Kotlin twin: `SleepAwareStepCounter.contextAt`.
+    private static func context(_ ts: Int, sessions: [SleepSession]) -> Int {
+        guard let session = sessions.first(where: { ts >= $0.start && ts < $0.end }) else { return 0 }
+        if let stage = session.stages.first(where: { ts >= $0.start && ts < $0.end }),
+           SleepStageVocabulary.isWake(stage.stage) { return 1 }
+        return 2
+    }
+}
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/StepsCounter.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/StepsCounter.swift
index b77c25305b..21603c60b5 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/StepsCounter.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/StepsCounter.swift
@@ -4,33 +4,59 @@ import WhoopProtocol
 /// Wrap-aware step derivation from the strap's cumulative `step_motion_counter@57`, shared by the daily
 /// total (`AnalyticsEngine.analyzeDay`) and any windowed total (a manual workout's `[start, end]`, #398).
 ///
-/// `step_motion_counter@57` is a CUMULATIVE u16 running counter: it climbs while you move, holds flat when
-/// still, and wraps at 65536. The number of motion ticks over a set of time-ordered records is the SUM of
-/// WRAP-AWARE increments of that counter — `delta = (cur - prev) & 0xFFFF` — with a per-user
-/// `stepTicksPerStep` calibration applied by the caller AFTERWARDS (this returns the raw pre-calibration
-/// tick total, so the two callers can never disagree on the counter math). The raw total is an ESTIMATE
-/// (@57 counts motion ticks, not validated steps), not cloud/clinical parity.
+/// `step_motion_counter@57` is a CUMULATIVE u16 motion counter: it climbs for both locomotion and some
+/// non-step wrist motion, and wraps at 65536. On classed WHOOP 5/MG records, the increment ending at each
+/// sample is counted only when the strap labels that sample walk (1) or run (2); still (0) and unknown are
+/// rejected. A wholly unclassed legacy window retains the old counter-only estimate so pre-migration history
+/// remains readable. The caller applies its per-user `stepTicksPerStep` calibration afterwards. The result is
+/// still an estimate, not cloud/clinical parity.
 ///
 /// Kept byte-for-byte in lockstep with the Kotlin twin `StepsCounter.stepsInWindow`.
 public enum StepsCounter {
-    /// The largest wrap-aware increment treated as real motion between two adjacent 1 Hz records. A delta
-    /// at/above this is a big time-gap / disconnect boundary between sync sessions (or a firmware reboot,
-    /// byte-indistinguishable from a u16 wrap), NOT real steps — dropped so gaps don't inflate the total.
-    /// Real 1 Hz motion never ticks this fast between adjacent records. (#132/#276/#316)
+    private static let locomotionActivityClasses: Set<Int> = [1, 2]
+
+    static func hasActivityClasses(_ samples: [StepSample]) -> Bool {
+        samples.contains { $0.activityClass != nil }
+    }
+
+    /// Kotlin twin: `StepsCounter.shouldCountDelta`.
+    static func shouldCountDelta(activityClass: Int?, hasActivityClasses: Bool) -> Bool {
+        !hasActivityClasses || activityClass.map(locomotionActivityClasses.contains) == true
+    }
+
+    /// Absolute reboot/wrap guard, independent from the per-second plausibility gate below.
     public static let maxStepDelta = 512
+    public static let maxTicksPerSecond = 4
+
+    /// Kotlin twin: `StepsCounter.isPlausibleDelta`.
+    static func isPlausibleDelta(previousTs: Int, currentTs: Int, delta: Int) -> Bool {
+        guard delta >= 1, delta < maxStepDelta else { return false }
+        let elapsed = currentTs - previousTs
+        guard elapsed > 0 else { return false }
+        let rateAllowance = elapsed >= maxStepDelta / maxTicksPerSecond
+            ? maxStepDelta - 1
+            : elapsed * maxTicksPerSecond
+        return delta <= rateAllowance
+    }
 
-    /// Raw wrap-aware motion-tick total across `samples` — the sum of positive consecutive
-    /// `step_motion_counter@57` increments in `[1, maxStepDelta)`. Sorts by `ts` internally, so the caller
-    /// may pass an unsorted window (already filtered to the range it cares about). Returns `nil` when there
-    /// are fewer than two samples or no forward movement (so "no data" stays distinct from a real zero).
-    /// The caller applies its `stepTicksPerStep` calibration to the returned ticks.
+    /// Raw wrap-aware locomotion-tick total across `samples`. When any sample carries `activityClass`, each
+    /// positive increment is attributed to the later sample and retained only for walk/run. When the whole
+    /// window is legacy-unclassed, all valid increments retain the historical counter-only fallback. Sorts
+    /// by `ts` internally and returns `nil` for fewer than two samples or no retained movement.
     public static func stepsInWindow(_ samples: [StepSample]) -> Int? {
         let sorted = samples.sorted { $0.ts < $1.ts }
         if sorted.count < 2 { return nil }
+        let hasActivityClasses = hasActivityClasses(sorted)
         var total = 0
         for i in 1..<sorted.count {
             let delta = (sorted[i].counter - sorted[i - 1].counter) & 0xFFFF  // wrap-aware u16 increment
-            if delta >= 1 && delta < maxStepDelta { total += delta }  // ignore a delta >= 512 (gap/reset)
+            let isLocomotion = shouldCountDelta(
+                activityClass: sorted[i].activityClass,
+                hasActivityClasses: hasActivityClasses)
+            if isLocomotion && isPlausibleDelta(
+                previousTs: sorted[i - 1].ts, currentTs: sorted[i].ts, delta: delta) {
+                total += delta
+            }
         }
         return total > 0 ? total : nil
     }
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/DayCycleTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/DayCycleTests.swift
new file mode 100644
index 0000000000..f159a0edea
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/DayCycleTests.swift
@@ -0,0 +1,46 @@
+import XCTest
+@testable import StrandAnalytics
+
+final class DayCycleTests: XCTestCase {
+    func testDefaultsAndCalendarMode() {
+        XCTAssertEqual(DayCycleMode.persisted(nil), .sleepOnset)
+        XCTAssertEqual(DayCycleMode.persisted("midnight"), .midnight)
+        let window = DayCycleResolver.activeWindow(mode: .midnight, latestSleep: nil, now: 86_500,
+                                                   offsetSec: 0, reliableAwakeCoverage: false)
+        XCTAssertEqual(window.startInclusive, 86_400)
+        XCTAssertEqual(window.source, .calendar)
+    }
+
+    func testMissingWakeEvidenceKeepsSleepOnsetCycleAcrossMidnight() {
+        let sleep = DayCycleWindow(id: "sleep", startInclusive: 20 * 3_600, endExclusive: 0,
+                                   displayDay: "1970-01-01", source: .detectedSleep)
+        let fallback = DayCycleResolver.fallbackMidnight(after: sleep.startInclusive, offsetSec: 0)
+        XCTAssertEqual(fallback, 2 * 86_400)
+        let active = DayCycleResolver.activeWindow(mode: .sleepOnset, latestSleep: sleep,
+                                                   now: fallback, offsetSec: 0,
+                                                   reliableAwakeCoverage: false)
+        XCTAssertEqual(active.source, .detectedSleep)
+        XCTAssertEqual(active.startInclusive, sleep.startInclusive)
+    }
+
+    func testAbsoluteCapStillUsesSyntheticMidnight() {
+        let sleep = DayCycleWindow(id: "sleep", startInclusive: 0, endExclusive: 0,
+                                   displayDay: "1970-01-01", source: .detectedSleep)
+        XCTAssertEqual(DayCycleResolver.activeWindow(mode: .sleepOnset, latestSleep: sleep,
+                                                     now: 40 * 3_600, offsetSec: 0,
+                                                     reliableAwakeCoverage: false).source,
+                       .syntheticMidnight)
+    }
+
+    func testCoverageSegmentsPreferPriorityWithoutCrossingDeviceCounters() {
+        let window = PhysiologicalSteps.CycleWindow(sleepId: "night", onset: 100, endExclusive: 500)
+        let segments = PhysiologicalSteps.ownerSegmentsFromCoverage(window, coverage: [
+            .init(owner: "secondary", onset: 100, endExclusive: 350, priority: 1),
+            .init(owner: "active", onset: 200, endExclusive: 500, priority: 0),
+        ], fallbackOwner: "secondary")
+        XCTAssertEqual(segments, [
+            .init(owner: "secondary", onset: 100, endExclusive: 200),
+            .init(owner: "active", onset: 200, endExclusive: 500),
+        ])
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepAwareStepCounterTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepAwareStepCounterTests.swift
new file mode 100644
index 0000000000..1e714f1f18
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepAwareStepCounterTests.swift
@@ -0,0 +1,41 @@
+import XCTest
+import WhoopProtocol
+@testable import StrandAnalytics
+
+final class SleepAwareStepCounterTests: XCTestCase {
+    private func sample(_ ts: Int, _ counter: Int, _ cls: Int? = 1) -> StepSample {
+        StepSample(ts: ts, counter: counter, activityClass: cls)
+    }
+    private func sleep(stages: [StageSegment] = []) -> SleepSession {
+        SleepSession(start: 0, end: 100, efficiency: 1, stages: stages, restingHR: nil, avgHRV: nil)
+    }
+
+    func testIsolatedBedMotionIsRejected() {
+        XCTAssertNil(SleepAwareStepCounter.stepsInWindow([
+            sample(0, 0), sample(1, 1), sample(20, 2)
+        ], sleepSessions: [sleep()]))
+    }
+
+    func testCoherentNightWalkCounts() {
+        XCTAssertEqual(SleepAwareStepCounter.stepsInWindow([
+            sample(0, 0), sample(1, 2), sample(2, 4), sample(3, 6), sample(4, 8), sample(5, 10)
+        ], sleepSessions: [sleep()]), 10)
+    }
+
+    func testExplicitWakeGapCountsImmediately() {
+        let wake = StageSegment(start: 10, end: 20, stage: "wake")
+        XCTAssertEqual(SleepAwareStepCounter.stepsInWindow([
+            sample(9, 0), sample(10, 2)
+        ], sleepSessions: [sleep(stages: [wake])]), 2)
+    }
+
+    func testDiagnosticRejectionReasonsAreSeparated() {
+        let count = SleepAwareStepCounter.count([
+            sample(0, 100, 0), sample(1, 102, 1), sample(2, 110, 1),
+            sample(4, 117, 2), sample(5, 120, 0)
+        ], sleepSessions: [])
+        XCTAssertEqual(count.totalTicks, 9)
+        XCTAssertEqual(count.rejectedActivityClassTicks, 3)
+        XCTAssertEqual(count.rejectedImplausibleTicks, 8)
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/StepsCounterTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/StepsCounterTests.swift
index 4c838ad56c..4b4c561c59 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/StepsCounterTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/StepsCounterTests.swift
@@ -8,7 +8,9 @@ import WhoopProtocol
 /// the caller's `stepTicksPerStep` calibration). Mirrors the Android StepsCounterTest vectors value-for-value.
 final class StepsCounterTests: XCTestCase {
 
-    private func step(_ ts: Int, _ counter: Int) -> StepSample { StepSample(ts: ts, counter: counter) }
+    private func step(_ ts: Int, _ counter: Int, _ activityClass: Int? = nil) -> StepSample {
+        StepSample(ts: ts, counter: counter, activityClass: activityClass)
+    }
 
     func testSumsPositiveConsecutiveDeltas() {
         // counters 100 -> 150 -> 220 => deltas 50 + 70 = 120
@@ -44,7 +46,32 @@ final class StepsCounterTests: XCTestCase {
 
     func testMaxStepDeltaBoundaryIsExclusive() {
         // Exactly maxStepDelta (512) is dropped; 511 counts.
-        XCTAssertEqual(StepsCounter.stepsInWindow([step(0, 0), step(60, 512)]), nil)   // 512 dropped => no movement
-        XCTAssertEqual(StepsCounter.stepsInWindow([step(0, 0), step(60, 511)]), 511)   // 511 kept
+        XCTAssertEqual(StepsCounter.stepsInWindow([step(0, 0), step(128, 512)]), nil)   // absolute guard
+        XCTAssertEqual(StepsCounter.stepsInWindow([step(0, 0), step(128, 511)]), 511)
+    }
+
+    func testRejectsPhysicallyImpossibleOneSecondSpikeButAllowsSameTicksAcrossTime() {
+        XCTAssertNil(StepsCounter.stepsInWindow([step(0, 100), step(1, 107)]))
+        XCTAssertEqual(StepsCounter.stepsInWindow([step(0, 100), step(2, 107)]), 7)
+        XCTAssertEqual(StepsCounter.stepsInWindow([step(0, 100), step(1, 104)]), 4)
+    }
+
+    func testClassedStreamCountsOnlyWalkAndRunDeltas() {
+        // Attribute each counter delta to the later sample, matching the strap's per-record class.
+        // still: +10 ignored; walk: +20; run: +15; unknown: +25 ignored => 35 locomotion ticks.
+        XCTAssertEqual(StepsCounter.stepsInWindow([
+            step(0, 100, 0),
+            step(10, 110, 0),
+            step(20, 130, 1),
+            step(30, 145, 2),
+            step(40, 170, nil),
+        ]), 35)
+    }
+
+    func testLegacyUnclassedStreamKeepsCounterFallback() {
+        // Rows written before activityClass existed must retain their historical estimate.
+        XCTAssertEqual(StepsCounter.stepsInWindow([
+            step(0, 100), step(10, 140), step(20, 170),
+        ]), 70)
     }
 }
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/StepsDailyTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/StepsDailyTests.swift
index ff331aceda..21faf02666 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/StepsDailyTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/StepsDailyTests.swift
@@ -58,7 +58,7 @@ final class StepsDailyTests: XCTestCase {
     func testJumpGuardDropsGapButKeepsRealSteps() {
         // 100 -> 300 (=200 real) ; 300 -> 1200 is a 900-tick GAP (>= 512) and is dropped ; 1200 -> 1500
         // (=300 real). Only the two in-range increments count => 200 + 300 = 500, the gap doesn't inflate.
-        let s = [step(0, 100), step(60, 300), step(3_600, 1_200), step(3_660, 1_500)]
+        let s = [step(0, 100), step(60, 300), step(3_600, 1_200), step(3_675, 1_500)]
         XCTAssertEqual(stepsFor(s), 500)
     }
 
@@ -66,7 +66,7 @@ final class StepsDailyTests: XCTestCase {
         // THE BUG (#132/#276/#316). A realistic ascending cumulative counter sampled at 1 Hz. The OLD
         // code summed the raw running total (here, byte @57 alone summed) — exploding the count; the NEW
         // wrap-aware diff sums only the per-record increments and yields a sane number.
-        let counters = [100, 127, 127, 130, 131, 131, 140, 152, 160, 175]
+        let counters = [100, 102, 102, 105, 106, 106, 109, 111, 113, 115]
         let samples = counters.enumerated().map { step($0.offset, $0.element) }
         // NEW behaviour: sum of wrap-aware deltas == last - first (all small increments, none >= 512).
         let sane = counters.last! - counters.first!  // 75
diff --git a/Packages/WhoopStore/Sources/WhoopStore/BackupSettings.swift b/Packages/WhoopStore/Sources/WhoopStore/BackupSettings.swift
index df5b7afe67..252cc6de4c 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/BackupSettings.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/BackupSettings.swift
@@ -58,6 +58,7 @@ public enum BackupSettings {
         "units.system": .string,
         "units.temperature": .string,
         "effort.scale": .string,
+        "dayCycle.mode": .string,
         "today.hostedCards": .string,
         // #1361: the user's own custom journal BEHAVIOURS (newline-joined names). Deliberately NOT in
         // `appleDefaultsKey` below — it isn't a flat UserDefaults key (customs are derived from the
@@ -82,6 +83,7 @@ public enum BackupSettings {
         "units.system": "units.system",
         "units.temperature": "units.temperature",
         "effort.scale": "effort.scale",
+        "dayCycle.mode": "noop.dayCycleMode",
         "today.hostedCards": "today.hostedCards",
     ]
 
diff --git a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
index f8bb74b12a..5a3bfd5969 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
@@ -350,6 +350,75 @@ extension WhoopStore {
         }
     }
 
+    /// Kotlin twin: `WhoopDao.stepSamplesPage`.
+    public func stepSamplesPage(deviceId: String, afterExclusive: Int, endExclusive: Int,
+                                limit: Int) async throws -> [StepSample] {
+        try syncRead { db in
+            try Row.fetchAll(db, sql: """
+                SELECT ts, counter, activityClass FROM stepSample
+                WHERE deviceId = ? AND ts > ? AND ts < ?
+                ORDER BY ts ASC LIMIT ?
+                """, arguments: [deviceId, afterExclusive, endExclusive, limit]).map {
+                    StepSample(ts: $0["ts"], counter: $0["counter"], activityClass: $0["activityClass"])
+                }
+        }
+    }
+
+    /// Last counter sample before a cycle boundary, used to attribute the first in-cycle delta correctly.
+    /// Kotlin twin: `WhoopDao.stepSampleBefore`.
+    public func stepSampleBefore(deviceId: String, before: Int) async throws -> StepSample? {
+        try syncRead { db in
+            try Row.fetchOne(db, sql: """
+                SELECT ts, counter, activityClass FROM stepSample
+                WHERE deviceId = ? AND ts < ? ORDER BY ts DESC LIMIT 1
+                """, arguments: [deviceId, before]).map {
+                    StepSample(ts: $0["ts"], counter: $0["counter"], activityClass: $0["activityClass"])
+                }
+        }
+    }
+
+    /// Kotlin twin: `WhoopDao.hasStepActivityClasses`.
+    public func hasStepActivityClasses(deviceId: String, from: Int, to: Int) async throws -> Bool {
+        try syncRead { db in
+            try Int.fetchOne(db, sql: """
+                SELECT EXISTS(SELECT 1 FROM stepSample
+                WHERE deviceId = ? AND ts >= ? AND ts < ? AND activityClass IS NOT NULL)
+                """, arguments: [deviceId, from, to]) == 1
+        }
+    }
+
+    /// Kotlin twin: `WhoopRepository.stepTimestampCoverage`.
+    public func stepTimestampCoverage(deviceId: String, from: Int, to: Int) async throws
+        -> (first: Int?, last: Int?) {
+        try syncRead { db in
+            let row = try Row.fetchOne(db, sql: """
+                SELECT MIN(ts) AS firstTs, MAX(ts) AS lastTs FROM stepSample
+                WHERE deviceId = ? AND ts >= ? AND ts < ?
+                """, arguments: [deviceId, from, to])
+            return (row?["firstTs"], row?["lastTs"])
+        }
+    }
+
+    /// Bounded process-local invalidator over the UTC days touched by this window. The instance token
+    /// prevents a static cycle cache surviving a store reopen from reusing revisions from the old DB.
+    /// Kotlin twin: `WhoopRepository.stepDataRevisionSignature`.
+    public func stepDataRevisionSignature(deviceId: String, from: Int, to: Int) async -> String {
+        "\(revisionInstanceToken):\(deviceId):\(stepDataRevision.signature(deviceId: deviceId, from: from, to: to))"
+    }
+
+    public func stepDiagnosticMotionCounts(deviceId: String, from: Int, to: Int) async throws
+        -> (gravity: Int, aux: Int) {
+        try syncRead { db in
+            let gravity = try Int.fetchOne(db, sql: """
+                SELECT COUNT(*) FROM gravitySample WHERE deviceId = ? AND ts >= ? AND ts < ?
+                """, arguments: [deviceId, from, to]) ?? 0
+            let aux = try Int.fetchOne(db, sql: """
+                SELECT COUNT(*) FROM v18AuxSample WHERE deviceId = ? AND ts >= ? AND ts < ?
+                """, arguments: [deviceId, from, to]) ?? 0
+            return (gravity, aux)
+        }
+    }
+
     public func respSamples(deviceId: String, from: Int, to: Int, limit: Int) async throws -> [RespSample] {
         try syncRead { db in
             try Row.fetchAll(db, sql: """
diff --git a/Packages/WhoopStore/Sources/WhoopStore/ScoreInputProvenanceStore.swift b/Packages/WhoopStore/Sources/WhoopStore/ScoreInputProvenanceStore.swift
index c246fc18bb..ce0431767c 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/ScoreInputProvenanceStore.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/ScoreInputProvenanceStore.swift
@@ -1,6 +1,12 @@
 import Foundation
 import GRDB
 
+public struct SourcedMetricPoint: Sendable {
+    public let deviceId: String
+    public let point: MetricPoint
+    public init(deviceId: String, point: MetricPoint) { self.deviceId = deviceId; self.point = point }
+}
+
 /// Provenance for one persisted NOOP-computed score. `sourceId` normally names the input provider;
 /// `vo2max_est` uses the estimator id because the method is the provenance users need for that series.
 /// Natural key: (computed device namespace, day, metric key).
@@ -37,7 +43,10 @@ extension WhoopStore {
         provenance: [ScoreInputProvenanceRow],
         deviceId: String,
         from: String,
-        to: String
+        to: String,
+        replaceMetricKeys: [String] = [],
+        additionalMetricPoints: [SourcedMetricPoint] = [],
+        replaceMetricSourceIds: [String] = []
     ) async throws {
         // #1196: an empty scoring pass must not destructively rewrite the window — with no daily rows to
         // write, the provenance wide-delete below would blank the window's attribution while a degenerate
@@ -47,7 +56,16 @@ extension WhoopStore {
         guard !dailyMetrics.isEmpty else { return }
         try syncWrite { db in
             _ = try Self.upsertDailyMetrics(dailyMetrics, deviceId: deviceId, in: db)
+            for source in Set(replaceMetricSourceIds + [deviceId]) {
+                for key in replaceMetricKeys {
+                    try db.execute(sql: "DELETE FROM metricSeries WHERE deviceId = ? AND key = ? AND day >= ? AND day <= ?",
+                                   arguments: [source, key, from, to])
+                }
+            }
             _ = try Self.upsertMetricSeries(metricPoints, deviceId: deviceId, in: db)
+            for group in Dictionary(grouping: additionalMetricPoints, by: \.deviceId) {
+                _ = try Self.upsertMetricSeries(group.value.map(\.point), deviceId: group.key, in: db)
+            }
 
             // Weekly VO₂max provenance is owned by `persistMetricSeriesWithProvenance` below, not this
             // daily scoring window. Preserve it or every normal 21-day re-score erases the prior two
diff --git a/Packages/WhoopStore/Sources/WhoopStore/StreamStore.swift b/Packages/WhoopStore/Sources/WhoopStore/StreamStore.swift
index 5d15437044..7788675301 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/StreamStore.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/StreamStore.swift
@@ -258,9 +258,15 @@ extension WhoopStore {
                     INSERT INTO stepSample (deviceId, ts, counter, activityClass) VALUES (?, ?, ?, ?)
                     ON CONFLICT(deviceId, ts) DO NOTHING
                     """)
+                var insertedSteps = 0
+                var insertedStepTimestamps: [Int] = []
                 for s in streams.steps {
                     try stmt.execute(arguments: [deviceId, s.ts, s.counter, s.activityClass])
+                    let inserted = db.changesCount
+                    insertedSteps += inserted
+                    if inserted > 0 { insertedStepTimestamps.append(s.ts) }
                 }
+                stepDataRevision.record(deviceId: deviceId, insertedTimestamps: insertedStepTimestamps)
             }
             // Band sleep_state (#175). Persist-only, same as steps — the strap's OWN @81 high-nibble state
             // (0 wake/1 still/2 asleep/3 up), decoded and streamed but dropped at storage until now. Keyed by
diff --git a/Packages/WhoopStore/Sources/WhoopStore/WhoopStore.swift b/Packages/WhoopStore/Sources/WhoopStore/WhoopStore.swift
index e18eab85ec..c8024e8c68 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/WhoopStore.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/WhoopStore.swift
@@ -62,6 +62,8 @@ public actor WhoopStore {
     /// v18 aux rows banked since the retention sweep last ran, PER DEVICE — the sweep is per device too,
     /// so a shared counter would let one strap spend another's budget. See `StreamStore`.
     var v18AuxRowsSincePrune: [String: Int] = [:]
+    var stepDataRevision = StepDataRevisionIndex()
+    let revisionInstanceToken = UUID().uuidString
     let dbWriter: any DatabaseWriter
 
     /// Read-only handle to the underlying GRDB writer for the synchronous `DeviceRegistryStore`.
@@ -271,3 +273,44 @@ public actor WhoopStore {
         }
     }
 }
+
+/// Compact process-local cache witness keyed by owner and UTC day. Cycle windows move with `now`, so
+/// using their exact end timestamp as a cache key would invalidate an otherwise unchanged active cycle
+/// every second. Keeping revisions per UTC day makes the signature stable until a row in that day lands.
+/// Its process-lifetime size is proportional to owners × UTC days that receive new step rows.
+struct StepDataRevisionIndex {
+    private static let utcDaySeconds = 86_400
+    private var nextRevision = 0
+    private var byOwnerDay: [OwnerDay: Int] = [:]
+
+    private struct OwnerDay: Hashable {
+        let owner: String
+        let day: Int
+    }
+
+    mutating func record(deviceId: String, insertedTimestamps: [Int]) {
+        guard !insertedTimestamps.isEmpty else { return }
+        nextRevision += 1
+        for timestamp in insertedTimestamps {
+            byOwnerDay[OwnerDay(owner: deviceId, day: timestamp.floorDividing(by: Self.utcDaySeconds))]
+                = nextRevision
+        }
+    }
+
+    func signature(deviceId: String, from: Int, to: Int) -> String {
+        guard to > from else { return "" }
+        let first = from.floorDividing(by: Self.utcDaySeconds)
+        let last = (to - 1).floorDividing(by: Self.utcDaySeconds)
+        return (first...last).map { day in
+            "\(day):\(byOwnerDay[OwnerDay(owner: deviceId, day: day), default: 0])"
+        }.joined(separator: ",")
+    }
+}
+
+private extension Int {
+    func floorDividing(by divisor: Int) -> Int {
+        let quotient = self / divisor
+        let remainder = self % divisor
+        return remainder < 0 ? quotient - 1 : quotient
+    }
+}
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/BackupSettingsTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/BackupSettingsTests.swift
index f062dead1d..ab542c7bb6 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/BackupSettingsTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/BackupSettingsTests.swift
@@ -21,6 +21,7 @@ final class BackupSettingsTests: XCTestCase {
             "units.system": "imperial",
             "units.temperature": "celsius",
             "effort.scale": "whoop",
+            "dayCycle.mode": "sleep_onset",
             // #today-hosted-cards: the one layout pref carried, a JSON [String] stored under the String kind.
             "today.hostedCards": "[\"sleep.sleepMarks\"]",
             // #1361: custom journal behaviours, a newline-joined name list — the embedded newline must
@@ -40,6 +41,7 @@ final class BackupSettingsTests: XCTestCase {
         XCTAssertEqual(back["units.system"] as? String, "imperial")
         XCTAssertEqual(back["units.temperature"] as? String, "celsius")
         XCTAssertEqual(back["effort.scale"] as? String, "whoop")
+        XCTAssertEqual(back["dayCycle.mode"] as? String, "sleep_onset")
         XCTAssertEqual(back["today.hostedCards"] as? String, "[\"sleep.sleepMarks\"]")
         XCTAssertEqual(back["journal.customBehaviors"] as? String, "Cold plunge\nMagnesium")
         XCTAssertEqual(back.count, values.count, "Nothing extra should appear")
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/ScoreInputProvenanceStoreTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/ScoreInputProvenanceStoreTests.swift
index 39d780d2a2..38499cac8a 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/ScoreInputProvenanceStoreTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/ScoreInputProvenanceStoreTests.swift
@@ -127,6 +127,23 @@ final class ScoreInputProvenanceStoreTests: XCTestCase {
         XCTAssertEqual(estimator, Vo2MaxEstimator.nes.rawValue)
     }
 
+    func testMarkerRewriteSpansComputedOwnerNamespaces() async throws {
+        let store = try await WhoopStore.inMemory()
+        let day = "2026-07-24"
+        _ = try await store.upsertMetricSeries([.init(day: day, key: "day_cycle_onset_ts", value: 1)],
+                                               deviceId: "old-noop")
+        try await store.persistComputedScores(
+            dailyMetrics: [makeDaily(day: day, recovery: nil, strain: nil)], metricPoints: [], provenance: [],
+            deviceId: "active-noop", from: day, to: day,
+            replaceMetricKeys: ["day_cycle_onset_ts"],
+            additionalMetricPoints: [.init(deviceId: "old-noop",
+                point: .init(day: day, key: "day_cycle_onset_ts", value: 2))],
+            replaceMetricSourceIds: ["old-noop"])
+        let old = try await store.metricSeries(deviceId: "old-noop", key: "day_cycle_onset_ts",
+                                               from: day, to: day)
+        XCTAssertEqual(old.map(\.value), [2])
+    }
+
     private func makeDaily(day: String, recovery: Double?, strain: Double?) -> DailyMetric {
         DailyMetric(
             day: day,
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/StepSampleTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/StepSampleTests.swift
index deb4ae3a73..e5da67ae10 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/StepSampleTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/StepSampleTests.swift
@@ -32,6 +32,56 @@ final class StepSampleTests: XCTestCase {
         XCTAssertEqual(n2, 2)
     }
 
+    func testStepRevisionSignatureIsStableAsActiveWindowAdvances() async throws {
+        let store = try await WhoopStore.inMemory()
+        let day = 1_780_876_800
+        _ = try await store.insert(Streams(steps: [
+            StepSample(ts: day + 100, counter: 1),
+        ]), deviceId: "strap")
+
+        let first = await store.stepDataRevisionSignature(
+            deviceId: "strap", from: day, to: day + 1_000)
+        let later = await store.stepDataRevisionSignature(
+            deviceId: "strap", from: day, to: day + 2_000)
+
+        XCTAssertEqual(first, later)
+    }
+
+    func testStepRevisionOnlyInvalidatesTouchedUtcDays() async throws {
+        let store = try await WhoopStore.inMemory()
+        let day = 1_780_876_800
+        _ = try await store.insert(Streams(steps: [
+            StepSample(ts: day + 100, counter: 1),
+        ]), deviceId: "strap")
+        let firstDayBefore = await store.stepDataRevisionSignature(
+            deviceId: "strap", from: day, to: day + 86_400)
+        let secondDayBefore = await store.stepDataRevisionSignature(
+            deviceId: "strap", from: day + 86_400, to: day + 172_800)
+
+        _ = try await store.insert(Streams(steps: [
+            StepSample(ts: day + 86_500, counter: 2),
+        ]), deviceId: "strap")
+        let firstDayAfter = await store.stepDataRevisionSignature(
+            deviceId: "strap", from: day, to: day + 86_400)
+        let secondDayAfter = await store.stepDataRevisionSignature(
+            deviceId: "strap", from: day + 86_400, to: day + 172_800)
+
+        XCTAssertEqual(firstDayBefore, firstDayAfter)
+        XCTAssertNotEqual(secondDayBefore, secondDayAfter)
+    }
+
+    func testDuplicateStepInsertDoesNotInvalidateRevision() async throws {
+        let store = try await WhoopStore.inMemory()
+        let sample = StepSample(ts: 1_780_916_150, counter: 50)
+        _ = try await store.insert(Streams(steps: [sample]), deviceId: "strap")
+        let before = await store.stepDataRevisionSignature(
+            deviceId: "strap", from: sample.ts - 1, to: sample.ts + 1)
+        _ = try await store.insert(Streams(steps: [sample]), deviceId: "strap")
+        let after = await store.stepDataRevisionSignature(
+            deviceId: "strap", from: sample.ts - 1, to: sample.ts + 1)
+        XCTAssertEqual(before, after)
+    }
+
     /// v19 migration: the @63 activity-class column exists on stepSample (#316).
     func testV19AddsActivityClassColumn() async throws {
         let store = try await WhoopStore.inMemory()
diff --git a/Strand/Data/DayCycleIntelligenceIntegration.swift b/Strand/Data/DayCycleIntelligenceIntegration.swift
new file mode 100644
index 0000000000..5f8eb478ff
--- /dev/null
+++ b/Strand/Data/DayCycleIntelligenceIntegration.swift
@@ -0,0 +1,335 @@
+import Foundation
+import StrandAnalytics
+import WhoopProtocol
+import WhoopStore
+
+@MainActor enum DayCycleIntelligenceIntegration {
+    static let onsetKey = "day_cycle_onset_ts"
+    static let pageSize = 10_000
+
+    struct Night { let daily: DailyMetric; let sleeps: [CachedSleepSession]; let workouts: [ExerciseSession]; let owner: String }
+    struct SourcedMarker: Sendable { let deviceId: String; let point: MetricPoint }
+    struct BoundaryRecoveryReader {
+        let sleepSessions: (String, Int, Int) async throws -> [CachedSleepSession]
+        let markers: (String, String, String) async throws -> [MetricPoint]
+    }
+    enum MarkerUpdate {
+        case preserve
+        case replace(points: [SourcedMarker], sourceIds: [String])
+    }
+    struct Result {
+        let stepsByWakeDay: [String: Int]
+        let strainByWakeDay: [String: Double]
+        let caloriesByWakeDay: [String: Double]
+        let workoutCountByWakeDay: [String: Int]
+        let onsetByWakeDay: [String: Int]
+        let firstWakeDay: String?
+        let markerUpdate: MarkerUpdate
+    }
+    struct PersistedBoundary {
+        let boundary: PhysiologicalSteps.CycleBoundary
+        let wakeDay: String
+        let owner: String
+        let sleepContext: SleepSession
+    }
+    fileprivate struct CachedCycle {
+        let key: String; let count: SleepAwareStepCounter.Count
+        let pages: Int; let samples: Int; let evaluated: Bool
+    }
+    final class Cache {
+        fileprivate var cycles: [String: CachedCycle] = [:]
+    }
+    private static func computedId(_ owner: String) -> String { owner + "-noop" }
+
+    static func recover(candidates: [(owner: String, priority: Int)], reader: BoundaryRecoveryReader,
+                                claimedDays: Set<String>, windowStart: Int, now: Int,
+                                offsetSec: Int, habitualMidsleepSec: Int?) async throws -> [PersistedBoundary] {
+        var claimed = claimedDays, output: [PersistedBoundary] = []
+        let fromDay = AnalyticsEngine.dayString(windowStart, offsetSec: offsetSec)
+        let toDay = AnalyticsEngine.dayString(now, offsetSec: offsetSec)
+        for candidate in candidates.sorted(by: {
+            $0.priority == $1.priority ? $0.owner < $1.owner : $0.priority < $1.priority
+        }) {
+            let source = computedId(candidate.owner)
+            let sessions = try await reader.sleepSessions(source, windowStart, now)
+            let points = try await reader.markers(source, fromDay, toDay)
+            let markers = Dictionary(points.compactMap { point -> (String, Int)? in
+                let value = Int(point.value)
+                return point.value == Double(value) ? (point.day, value) : nil
+            }, uniquingKeysWith: { first, _ in first })
+            let grouped = Dictionary(grouping: sessions) {
+                AnalyticsEngine.dayString($0.endTs, offsetSec: offsetSec)
+            }
+            for day in grouped.keys.sorted() where !claimed.contains(day) {
+                guard let marker = markers[day] else { continue }
+                let rows = grouped[day] ?? []
+                let blocks = rows.map { PhysiologicalSteps.SleepBlock(
+                    onset: $0.startTs, end: $0.endTs, id: String($0.startTs),
+                    editedOnset: $0.startTsAdjusted) }
+                guard let winner = PhysiologicalSteps.classifyForCycle(
+                    blocks, offsetSec: offsetSec, habitualMidsleepSec: habitualMidsleepSec)
+                    .first(where: { $0.kind == .mainSleep && $0.effectiveOnset == marker }),
+                      let row = rows.first(where: {
+                          String($0.startTs) == winner.id && $0.effectiveStartTs == marker
+                      }) else { continue }
+                let context = SleepSession(start: row.effectiveStartTs, end: row.endTs,
+                    efficiency: row.efficiency ?? 0, stages: AnalyticsEngine.decodeStages(row.stagesJSON),
+                    restingHR: row.restingHr, avgHRV: row.avgHrv)
+                output.append(PersistedBoundary(boundary: .init(
+                    sleepId: "persisted:\(candidate.owner):\(row.startTs)", onset: marker),
+                    wakeDay: day, owner: candidate.owner, sleepContext: context))
+                claimed.insert(day)
+            }
+        }
+        return output
+    }
+
+    static func compute(nights: [Night], editedRows: [CachedSleepSession], store: WhoopStore,
+                        candidates: [(owner: String, priority: Int)], physiologyOwners: [String],
+                        workouts: [WorkoutRow], windowStart: Int,
+                        now: Int, offsetSec: Int, habitualMidsleepSec: Int?, ticksPerStep: Double,
+                        mode: DayCycleMode, cache: Cache,
+                        profile: UserProfile, maxHROverride: Double?, effortMethod: StrainScorer.Method,
+                        recoveryReader: BoundaryRecoveryReader? = nil,
+                        trace: ((String) -> Void)? = nil) async -> Result {
+        guard mode == .sleepOnset else {
+            return Result(stepsByWakeDay: [:], strainByWakeDay: [:], caloriesByWakeDay: [:],
+                          workoutCountByWakeDay: [:], onsetByWakeDay: [:], firstWakeDay: nil,
+                          markerUpdate: .replace(points: [], sourceIds: Array(Set(
+                            candidates.map { computedId($0.owner) })).sorted()))
+        }
+        let editsByDay = Dictionary(grouping: editedRows) {
+            AnalyticsEngine.dayString($0.endTs, offsetSec: offsetSec)
+        }
+        var boundaries: [PhysiologicalSteps.CycleBoundary] = []
+        var wakeDayById: [String: String] = [:], ownerById: [String: String] = [:]
+        var sleepContexts: [SleepSession] = []
+        for night in nights {
+            let dayEdits = editsByDay[night.daily.day] ?? []
+            let edits = Dictionary(dayEdits.map { ($0.startTs, $0) }, uniquingKeysWith: { first, _ in first })
+            let detectedStarts = Set(night.sleeps.map(\.startTs))
+            var blocks: [PhysiologicalSteps.SleepBlock] = []
+            for row in night.sleeps {
+                let edit = edits[row.startTs]
+                let start = edit?.effectiveStartTs ?? row.effectiveStartTs
+                let end = edit?.endTs ?? row.endTs
+                blocks.append(.init(onset: row.startTs, end: end, id: String(row.startTs), editedOnset: start))
+                sleepContexts.append(SleepSession(start: start, end: end,
+                    efficiency: row.efficiency ?? 0, stages: AnalyticsEngine.decodeStages(row.stagesJSON),
+                    restingHR: row.restingHr, avgHRV: row.avgHrv))
+            }
+            for edit in dayEdits where !detectedStarts.contains(edit.startTs) {
+                blocks.append(.init(onset: edit.startTs, end: edit.endTs,
+                    id: "manual:\(edit.startTs)", editedOnset: edit.startTsAdjusted, kind: .nap))
+                sleepContexts.append(SleepSession(start: edit.effectiveStartTs, end: edit.endTs,
+                    efficiency: 0, stages: [], restingHR: nil, avgHRV: nil))
+            }
+            let classified = PhysiologicalSteps.classifyForCycle(
+                blocks, offsetSec: offsetSec, habitualMidsleepSec: habitualMidsleepSec)
+            guard let winner = classified.filter({ $0.kind == .mainSleep })
+                .min(by: { $0.effectiveOnset < $1.effectiveOnset }), winner.effectiveOnset <= now else { continue }
+            boundaries.append(.init(sleepId: winner.id, onset: winner.effectiveOnset))
+            wakeDayById[winner.id] = night.daily.day; ownerById[winner.id] = night.owner
+        }
+
+        let recovered: [PersistedBoundary]
+        do {
+            let productionReader = BoundaryRecoveryReader(
+                sleepSessions: { source, from, to in
+                    try await store.sleepSessions(deviceId: source, from: from, to: to, limit: 4_000)
+                },
+                markers: { source, fromDay, toDay in
+                    try await store.metricSeries(
+                        deviceId: source, key: onsetKey, from: fromDay, to: toDay)
+                })
+            recovered = try await recover(candidates: candidates,
+                reader: recoveryReader ?? productionReader,
+                claimedDays: Set(wakeDayById.values), windowStart: windowStart, now: now,
+                offsetSec: offsetSec, habitualMidsleepSec: habitualMidsleepSec)
+        } catch {
+            // Fail closed: an unread namespace is unknown, not empty. Returning no replacement source IDs
+            // prevents the persistence transaction from deleting valid markers after a transient read error.
+            trace?("stepsCycle status=error error=boundaryRecoveryRead")
+            return Result(stepsByWakeDay: [:], strainByWakeDay: [:], caloriesByWakeDay: [:],
+                          workoutCountByWakeDay: [:], onsetByWakeDay: [:], firstWakeDay: nil,
+                          markerUpdate: .preserve)
+        }
+        for item in recovered {
+            boundaries.append(item.boundary); wakeDayById[item.boundary.sleepId] = item.wakeDay
+            ownerById[item.boundary.sleepId] = item.owner; sleepContexts.append(item.sleepContext)
+        }
+        if let latest = boundaries.max(by: { $0.onset < $1.onset }),
+           let day = wakeDayById[latest.sleepId], let owner = ownerById[latest.sleepId] {
+            let active = DayCycleResolver.activeWindow(mode: mode,
+                latestSleep: DayCycleWindow(id: latest.sleepId, startInclusive: latest.onset,
+                    endExclusive: now, displayDay: day, source: .detectedSleep), now: now,
+                offsetSec: offsetSec, reliableAwakeCoverage: false)
+            if active.source == .syntheticMidnight {
+                boundaries.append(.init(sleepId: active.id, onset: active.startInclusive))
+                wakeDayById[active.id] = active.displayDay; ownerById[active.id] = owner
+            }
+        }
+
+        let windows = PhysiologicalSteps.cycleWindows(boundaries, now: now)
+        cache.cycles = cache.cycles.filter { entry in windows.contains(where: { $0.sleepId == entry.key }) }
+        let priorities = Dictionary(candidates.map { ($0.owner, $0.priority) }, uniquingKeysWith: min)
+        let witnesses = Dictionary(uniqueKeysWithValues: nights.map { night in
+            let sleeps = night.sleeps.sorted { $0.startTs < $1.startTs }.map {
+                "\($0.startTs)-\($0.endTs):\($0.stagesJSON ?? "")"
+            }.joined(separator: "|")
+            return (night.daily.day, "\(night.owner):\(night.daily.steps.map(String.init) ?? "nil")|\(sleeps)")
+        })
+        var steps: [String: Int] = [:], onsets: [String: Int] = [:]
+        var strains: [String: Double] = [:], calories: [String: Double] = [:]
+        var workoutCounts: [String: Int] = [:]
+        windowLoop: for window in windows {
+            guard let day = wakeDayById[window.sleepId], let fallback = ownerById[window.sleepId] else { continue }
+            do {
+            onsets[day] = window.onset
+            // Store ranges are inclusive. Read the active-first WHOOP + canonical union without borrowing
+            // step coverage: an HR-only device may legitimately have no step rows.
+            let hrEndInclusive = window.endExclusive - 1
+            let owners = ([fallback] + physiologyOwners).reduce(into: [String]()) {
+                if !$0.contains($1) { $0.append($1) }
+            }
+            var hrByTimestamp: [Int: HRSample] = [:]
+            if hrEndInclusive >= window.onset {
+                for owner in owners {
+                    let rows = (try? await store.hrSamples(
+                        deviceId: owner, from: window.onset, to: hrEndInclusive, limit: 200_000)) ?? []
+                    for row in rows where hrByTimestamp[row.ts] == nil { hrByTimestamp[row.ts] = row }
+                }
+            }
+            let cycleHR = hrByTimestamp.values.sorted { $0.ts < $1.ts }
+            let restingHR = nights.first(where: { $0.daily.day == day })?.daily.restingHr.map(Double.init)
+                ?? StrainScorer.defaultRestingHR
+            let effectiveMaxHR = maxHROverride ?? (profile.age > 0 ? StrainScorer.tanakaHRmax(age: profile.age) : nil)
+            if let strain = StrainScorer.strain(cycleHR, maxHR: effectiveMaxHR,
+                                                restingHR: restingHR, method: effortMethod,
+                                                sex: profile.sex) { strains[day] = strain }
+            if !cycleHR.isEmpty {
+                calories[day] = Calories.estimateDayCalories(
+                    cycleHR, profile: profile, hrmax: effectiveMaxHR, restingHR: restingHR)
+            }
+            let persistedWorkoutKeys = workouts
+                .filter { $0.startTs >= window.onset && $0.startTs < window.endExclusive }
+                .map { "\($0.startTs):\($0.endTs)" }
+            let freshDetectedKeys = nights.flatMap(\.workouts)
+                .filter { $0.start >= window.onset && $0.start < window.endExclusive }
+                .filter { detected in
+                    !workouts.contains { persisted in
+                        detected.start < persisted.endTs && persisted.startTs < detected.end
+                    }
+                }
+                .map { "\($0.start):\($0.end)" }
+            workoutCounts[day] = Set(persistedWorkoutKeys + freshDetectedKeys).count
+            var ranked = priorities; ranked[fallback] = ranked[fallback] ?? ranked.values.min() ?? 0
+            var coverage: [PhysiologicalSteps.OwnerCoverage] = []
+            for (owner, priority) in ranked {
+                let span = try await store.stepTimestampCoverage(
+                    deviceId: owner, from: window.onset, to: window.endExclusive)
+                if let first = span.first, let last = span.last {
+                    coverage.append(.init(owner: owner, onset: first,
+                        endExclusive: min(last + 1, window.endExclusive), priority: priority))
+                }
+            }
+            let segments = PhysiologicalSteps.ownerSegmentsFromCoverage(
+                window, coverage: coverage, fallbackOwner: fallback)
+            guard !segments.isEmpty else { continue }
+            let active = window.endExclusive == now
+            let identity = segments.enumerated().map { index, segment in
+                "\(segment.owner):\(segment.onset)-\(active && index == segments.count - 1 ? 0 : segment.endExclusive)"
+            }.joined(separator: ",")
+            var revisions: [String] = []
+            for segment in segments {
+                let revision = await store.stepDataRevisionSignature(
+                    deviceId: segment.owner, from: segment.onset, to: segment.endExclusive)
+                revisions.append("\(segment.owner)=\(revision)")
+            }
+            let contextSignature = sleepContexts.filter { $0.end > window.onset && $0.start < window.endExclusive }
+                .sorted { $0.start < $1.start }.map { sleep in
+                    "\(sleep.start)-\(sleep.end):" + sleep.stages.sorted { $0.start < $1.start }
+                        .map { "\($0.start)-\($0.end)=\($0.stage)" }.joined(separator: ":")
+                }.joined(separator: "|")
+            let firstDay = AnalyticsEngine.dayString(window.onset, offsetSec: offsetSec)
+            let lastDay = AnalyticsEngine.dayString(max(window.onset, window.endExclusive - 1), offsetSec: offsetSec)
+            let dayWitness = witnesses.keys.filter { $0 >= firstDay && $0 <= lastDay }.sorted()
+                .map { "\($0)=\(witnesses[$0] ?? "")" }.joined(separator: "|")
+            let key = "\(identity)|\(window.sleepId)|\(window.onset)|\(active ? 0 : window.endExclusive)"
+                + "|stepRevision=\(revisions.joined(separator: "|"))|sleepContext=\(contextSignature)"
+                + "|days=\(dayWitness)"
+            var cached = cache.cycles[window.sleepId]
+            if cached?.key != key {
+                var count = SleepAwareStepCounter.Count.empty, pages = 0, samples = 0, evaluated = false
+                for (index, segment) in segments.enumerated() {
+                    let hasClasses = try await store.hasStepActivityClasses(
+                        deviceId: segment.owner, from: segment.onset, to: segment.endExclusive)
+                    let accumulator = SleepAwareStepCounter.Accumulator(
+                        sleepSessions: sleepContexts, hasActivityClasses: hasClasses)
+                    var segmentSamples = 0
+                    if index == 0, let predecessor = try await store.stepSampleBefore(
+                        deviceId: segment.owner, before: segment.onset) {
+                        accumulator.acceptPage([predecessor]); samples += 1; segmentSamples += 1
+                    }
+                    var cursor = segment.onset - 1
+                    while cursor < segment.endExclusive {
+                        let page = try await store.stepSamplesPage(deviceId: segment.owner,
+                            afterExclusive: cursor, endExclusive: segment.endExclusive, limit: pageSize)
+                        guard !page.isEmpty else { break }
+                        accumulator.acceptPage(page); pages += 1; samples += page.count; segmentSamples += page.count
+                        guard let last = page.last, last.ts >= cursor else { break }
+                        cursor = last.ts
+                        if page.count < pageSize { break }
+                    }
+                    let motion = try? await store.stepDiagnosticMotionCounts(
+                        deviceId: segment.owner, from: segment.onset, to: segment.endExclusive)
+                    accumulator.observeMotion(gravityCount: motion?.gravity ?? 0, auxCount: motion?.aux ?? 0)
+                    if segmentSamples >= 2 { evaluated = true }
+                    count = count.adding(accumulator.finish())
+                }
+                cached = CachedCycle(key: key, count: count, pages: pages, samples: samples, evaluated: evaluated)
+                cache.cycles[window.sleepId] = cached
+            }
+            guard let result = cached, result.evaluated else { continue }
+            let scaled = Int((Double(result.count.totalTicks) / max(ticksPerStep, 0.5)).rounded())
+            steps[day] = scaled
+            let status = active ? "active" : "closed"
+            trace?("stepsCycle wakeDay=\(day) status=\(status) onsetTs=\(window.onset) "
+                + "endTs=\(window.endExclusive) owner=\(identity) pages=\(result.pages) samples=\(result.samples) "
+                + "totalTicks=\(result.count.totalTicks) outside=\(result.count.acceptedOutsideSleepTicks) "
+                + "awakeGap=\(result.count.acceptedAwakeGapTicks) sleepBout=\(result.count.acceptedSleepBoutTicks) "
+                + "rejectedIsolatedSleep=\(result.count.rejectedIsolatedSleepTicks) "
+                + "rejectedClass=\(result.count.rejectedActivityClassTicks) "
+                + "rejectedImplausible=\(result.count.rejectedImplausibleTicks) "
+                + "gravitySamples=\(result.count.gravitySamplesAvailable) auxSamples=\(result.count.auxSamplesAvailable) "
+                + "ticksPerStep=\(ticksPerStep) scaledSteps=\(scaled)")
+            } catch {
+                trace?("stepsCycle wakeDay=\(day) status=error error=databaseRead")
+                continue windowLoop
+            }
+        }
+        let recoveredMarkers = recovered.map { SourcedMarker(deviceId: computedId($0.owner),
+            point: MetricPoint(day: $0.wakeDay, key: onsetKey, value: Double($0.boundary.onset))) }
+        return Result(stepsByWakeDay: steps, strainByWakeDay: strains, caloriesByWakeDay: calories,
+            workoutCountByWakeDay: workoutCounts, onsetByWakeDay: onsets,
+            firstWakeDay: wakeDayById.values.min(), markerUpdate: .replace(
+                points: recoveredMarkers,
+                sourceIds: Array(Set(candidates.map { computedId($0.owner) })).sorted()))
+    }
+
+    static func applying(_ result: Result, to daily: DailyMetric) -> DailyMetric {
+        let established = result.firstWakeDay.map { daily.day >= $0 } ?? false
+        let steps = established ? result.stepsByWakeDay[daily.day] : daily.steps
+        let strain = established ? result.strainByWakeDay[daily.day] : daily.strain
+        let calories = established ? result.caloriesByWakeDay[daily.day] : daily.activeKcalEst
+        let workouts = established ? result.workoutCountByWakeDay[daily.day] : daily.exerciseCount
+        return DailyMetric(day: daily.day, totalSleepMin: daily.totalSleepMin, efficiency: daily.efficiency,
+            deepMin: daily.deepMin, remMin: daily.remMin, lightMin: daily.lightMin,
+            disturbances: daily.disturbances, restingHr: daily.restingHr, avgHrv: daily.avgHrv,
+            recovery: daily.recovery, strain: strain, exerciseCount: workouts,
+            spo2Pct: daily.spo2Pct, skinTempDevC: daily.skinTempDevC, respRateBpm: daily.respRateBpm,
+            steps: steps, activeKcalEst: calories, spo2Red: daily.spo2Red,
+            spo2Ir: daily.spo2Ir, avgSdnn: daily.avgSdnn,
+            skinTempC: daily.skinTempC, sleepHrOnly: daily.sleepHrOnly)
+    }
+}
diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index f0e1d96dae..223ab3397a 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -21,6 +21,7 @@ final class IntelligenceEngine: ObservableObject {
     /// is worth the few characters.
     static let minHrSamples = 200
 
+    private let dayCycleCache = DayCycleIntelligenceIntegration.Cache()
     private let repo: Repository
     private let profile: ProfileStore
     /// The CANONICAL id under whose `-noop` sibling this engine WRITES the computed daily rows, and from
@@ -802,6 +803,7 @@ final class IntelligenceEngine: ObservableObject {
         // #1545: the Effort TRIMP recipe, read ONCE per pass. Global (same for every day), so it folds
         // into the config signature below rather than the per-day key.
         let effortMethodGlobal = PuffinExperiment.effortMethod
+        let dayCycleMode = DayCycleMode.persisted(UserDefaults.standard.string(forKey: DayCycleMode.storageKey))
 
         // ── #1005 BATTERY: per-day reuse cache setup (see `dayScanCache`) ────────────────────────────
         // The stager toggles are read per-day inside the loop below, but they are global (same value every
@@ -854,6 +856,7 @@ final class IntelligenceEngine: ObservableObject {
             // produced under one method is stale the moment the user switches — serving it would show a
             // window of days scored by a recipe the user just turned off, with nothing to explain it.
             "\(effortMethodGlobal)",
+            dayCycleMode.rawValue,
         ].joined(separator: "|")
         // Drop the whole cache on a config change, then snapshot it into a Sendable `let` for the detached
         // loop (the engine is @MainActor; the loop can't touch `self`). The loop returns the updated cache
@@ -1761,6 +1764,49 @@ final class IntelligenceEngine: ObservableObject {
         // already staged from raw (idempotent) and for imported nights (raw never dense). This MUST run
         // before the scoring loop so the healed stages flow into Rest/recovery this same pass.
         let editedRows = await repo.selfHealEditedStages(from: windowStart, to: now)
+        var cycleCandidates: [(owner: String, priority: Int)] = regDevices
+            .map { device in
+                let priority: Int
+                if device.id == regActiveId { priority = 0 }
+                else if device.status == .archived { priority = 4 }
+                else if device.sourceKind == .activityFile { priority = 3 }
+                else if device.isImportSource { priority = 2 }
+                else { priority = 1 }
+                return (device.id, priority)
+            }
+        if !cycleCandidates.contains(where: { $0.owner == regActiveId }) {
+            cycleCandidates.append((regActiveId, 0))
+        }
+        let physiologyOwners = ([regActiveId] + regDevices.filter {
+            $0.brand.caseInsensitiveCompare("WHOOP") == .orderedSame
+        }.map(\.id) + [Repository.whoopSource]).reduce(into: [String]()) {
+            if !$0.contains($1) { $0.append($1) }
+        }
+        let cycleWorkouts = await repo.workoutRows(days: maxDays + 2)
+        let physiologicalSteps = await DayCycleIntelligenceIntegration.compute(
+            nights: scoredNights.map { night in
+                DayCycleIntelligenceIntegration.Night(
+                    daily: night.daily,
+                    sleeps: night.cachedSleep,
+                    workouts: night.workouts,
+                    owner: resolvedScoreOwnerByDay[night.daily.day] ?? regActiveId)
+            },
+            editedRows: editedRows,
+            store: store,
+            candidates: cycleCandidates,
+            physiologyOwners: physiologyOwners,
+            workouts: cycleWorkouts,
+            windowStart: windowStart,
+            now: now,
+            offsetSec: tzOffset,
+            habitualMidsleepSec: habitualMidsleepSec,
+            ticksPerStep: up.stepTicksPerStep,
+            mode: dayCycleMode,
+            cache: dayCycleCache,
+            profile: up,
+            maxHROverride: maxHR,
+            effortMethod: effortMethodGlobal,
+            trace: stepsTraceActive ? { self.diagnosticSink?($0, .steps) } : nil)
         // #299: `editsByStart` is now built PER DAY inside the scoring loop (scoped to the day each edit
         // belongs to), NOT window-wide here. sleepEditedDaily folds any edited row that isn't a twin of THIS
         // day's detected sessions in as a "manual" block, so a window-wide edit set let ONE user edit /
@@ -1805,8 +1851,9 @@ final class IntelligenceEngine: ObservableObject {
             // every night. `effectiveStartTs` (the #318 user-corrected onset) is preserved on the row.
             let dayEditedRows = Self.editedRowsForDay(editedRows, day: night.daily.day, tzOffsetSeconds: tzOffset)
             let editsByStart = Dictionary(dayEditedRows.map { ($0.startTs, $0) }, uniquingKeysWith: { a, _ in a })
-            let daily = sleepEditedDaily(night.daily, detected: night.cachedSleep, editsByStart: editsByStart,
+            var daily = sleepEditedDaily(night.daily, detected: night.cachedSleep, editsByStart: editsByStart,
                                          habitualMidsleepSec: habitualMidsleepSec)
+            daily = DayCycleIntelligenceIntegration.applying(physiologicalSteps, to: daily)
             let recovery = recomputeRecovery(daily, baselines2)
             // Charge term-breakdown trace (Group G): only when the Recovery test mode is on. Emits which
             // term moved Charge and which was nil and forced the renorm, tagged `.recovery`. The trace's
@@ -1826,7 +1873,7 @@ final class IntelligenceEngine: ObservableObject {
             // off the HRV baseline state rather than a blanket `.solid`, so a thin/provisional baseline shows
             // EST. not REL. Pure presentation upstream of the UI; the score itself is unchanged.
             let chargeConf = ScoreConfidence.charge(recovery: recovery, hrvBaseline: baselines2.hrv)
-            out.append(Computed(day: daily.day, recovery: recovery, strain: night.strain,
+            out.append(Computed(day: daily.day, recovery: recovery, strain: daily.strain,
                                 sleepMin: daily.totalSleepMin, hrv: daily.avgHrv,
                                 rhr: daily.restingHr, source: source, confidence: chargeConf,
                                 drivers: drivers, skinTempRel: skinRel))
@@ -1900,6 +1947,11 @@ final class IntelligenceEngine: ObservableObject {
             if let rest = AnalyticsEngine.Rest.composite(daily: daily) {
                 restPoints.append(MetricPoint(day: daily.day, key: "sleep_performance", value: rest))
             }
+            if let onset = physiologicalSteps.onsetByWakeDay[daily.day] {
+                restPoints.append(MetricPoint(day: daily.day,
+                                              key: DayCycleIntelligenceIntegration.onsetKey,
+                                              value: Double(onset)))
+            }
             // #103: persist the SpO₂ candidate @82 nightly mean to metricSeries as "spo2_candidate" so the
             // Blood Oxygen tile can surface it as a "strap estimate (unverified)" fallback when the toggle
             // is ON. Written under the "-noop" computed device ID, never to `spo2Pct` — the candidate has
@@ -2104,13 +2156,29 @@ final class IntelligenceEngine: ObservableObject {
             provenanceByCell["\(point.day)\u{1F}\(point.key)"] =
                 ScoreInputProvenanceRow(day: point.day, key: point.key, sourceId: source)
         }
+        let markerKeys: [String]
+        let markerPoints: [SourcedMetricPoint]
+        let markerSources: [String]
+        switch physiologicalSteps.markerUpdate {
+        case .preserve:
+            markerKeys = []; markerPoints = []; markerSources = []
+        case let .replace(points, sourceIds):
+            markerKeys = [DayCycleIntelligenceIntegration.onsetKey]
+            markerPoints = points.map {
+                SourcedMetricPoint(deviceId: $0.deviceId, point: $0.point)
+            }
+            markerSources = sourceIds
+        }
         try? await store.persistComputedScores(
             dailyMetrics: dailies,
             metricPoints: restPoints,
             provenance: Array(provenanceByCell.values),
             deviceId: computedId,
             from: oldestDay,
-            to: newestDay
+            to: newestDay,
+            replaceMetricKeys: markerKeys,
+            additionalMetricPoints: markerPoints,
+            replaceMetricSourceIds: markerSources
         )
 
         // Now evict only the STALE computed rows in the window , those a prior (e.g. UTC-keyed) run left
diff --git a/Strand/Data/Repository.swift b/Strand/Data/Repository.swift
index b81266c006..0d1a4892eb 100644
--- a/Strand/Data/Repository.swift
+++ b/Strand/Data/Repository.swift
@@ -2594,13 +2594,16 @@ final class Repository: ObservableObject {
         guard let store = await ensureStore() else { return [] }
         let now = Int(Date().timeIntervalSince1970)
         let lo = now - days * 86_400, hi = now + 86_400
-        // UNION the active strap + canonical (and their computed siblings) so workouts banked under the
-        // canonical "my-whoop" before a re-add still show, alongside the re-added strap's live workouts.
+        // UNION every registered WHOOP + canonical (and computed siblings) so workouts banked before a
+        // re-add remain visible alongside every retained strap's live workouts.
         // De-dup identical same-source rows that appear under both union ids by natural key (the cross-SOURCE
         // dedup below only collapses strap-vs-Apple twins, not a row present in two strap namespaces).
         var rows: [WorkoutRow] = []
-        for id in importedReadIds { rows += (try? await store.workouts(deviceId: id, from: lo, to: hi, limit: 5000)) ?? [] }
-        for id in computedReadIds { rows += (try? await store.workouts(deviceId: id, from: lo, to: hi, limit: 5000)) ?? [] }
+        let rawIds = rawPhysiologyReadIds(store: store)
+        for id in rawIds { rows += (try? await store.workouts(deviceId: id, from: lo, to: hi, limit: 5000)) ?? [] }
+        for id in rawIds.map({ $0.hasSuffix("-noop") ? $0 : $0 + "-noop" }) {
+            rows += (try? await store.workouts(deviceId: id, from: lo, to: hi, limit: 5000)) ?? []
+        }
         rows += (try? await store.workouts(deviceId: "apple-health", from: lo, to: hi, limit: 5000)) ?? []
         // Imported lifting sessions (Hevy / Liftosaur) live under their own "lifting" source.
         rows += (try? await store.workouts(deviceId: "lifting", from: lo, to: hi, limit: 5000)) ?? []
diff --git a/Strand/Liquid/LiquidTodayView.swift b/Strand/Liquid/LiquidTodayView.swift
index 0e88485115..745e720365 100644
--- a/Strand/Liquid/LiquidTodayView.swift
+++ b/Strand/Liquid/LiquidTodayView.swift
@@ -17,6 +17,8 @@ import WhoopStore
 import StrandAnalytics
 
 struct LiquidTodayView: View {
+    @AppStorage(DayCycleMode.storageKey) private var dayCycleModeRaw = DayCycleMode.sleepOnset.rawValue
+    private var dayCycleMode: DayCycleMode { DayCycleMode.persisted(dayCycleModeRaw) }
     @EnvironmentObject var repo: Repository
     @EnvironmentObject var router: NavRouter
     @EnvironmentObject var profile: ProfileStore
@@ -416,7 +418,9 @@ struct LiquidTodayView: View {
         .liquidMediumHaptic(trigger: pullHaptic)
         // hydrationSeq joins the id so logging a drink re-reads the card immediately, the same trigger set
         // classic TodayView's reloadHydration() uses.
-        .task(id: "\(repo.refreshSeq)-\(selectedDayOffset)-\(repo.hydrationSeq)-\(hydrationEnabled)") { await load() }
+        .task(id: "\(repo.refreshSeq)-\(selectedDayOffset)-\(repo.hydrationSeq)-\(hydrationEnabled)-\(dayCycleModeRaw)") {
+            await load()
+        }
         .sheet(item: $guideSection) { section in
             NavigationStack { ScoringGuideView(initialSection: section, onClose: { guideSection = nil }) }
         }
@@ -1483,11 +1487,17 @@ struct LiquidTodayView: View {
 
         let cal = Calendar.current
         let dayStart = cal.startOfDay(for: selectedLogicalDay)
-        let from = Int(dayStart.timeIntervalSince1970)
+        let calendarFrom = Int(dayStart.timeIntervalSince1970)
         // today → midnight..now; a past day → its full 24h (a missing morning reads as empty space).
-        let to: Int = selectedDayOffset == 0
+        let calendarTo: Int = selectedDayOffset == 0
             ? Int(Date().timeIntervalSince1970)
             : Int((cal.date(byAdding: .day, value: 1, to: dayStart) ?? dayStart).timeIntervalSince1970)
+        let nextDayKey = Repository.localDayKey(cal.date(byAdding: .day, value: 1, to: dayStart) ?? dayStart)
+        let cycleMarkers = dayCycleMode == .sleepOnset
+            ? await repo.exploreSeries(key: DayCycleIntelligenceIntegration.onsetKey, source: "my-whoop") : []
+        let from = cycleMarkers.last(where: { $0.day == selectedDayKey }).map { Int($0.value) } ?? calendarFrom
+        let toExclusive = cycleMarkers.last(where: { $0.day == nextDayKey }).map { Int($0.value) } ?? calendarTo
+        let to = max(from, toExclusive - 1)
 
         async let restA = repo.exploreSeries(key: "sleep_performance", source: "my-whoop")
         async let stressA = repo.series(key: "stress", source: "my-whoop")
@@ -1594,7 +1604,7 @@ struct LiquidTodayView: View {
         // HR estimate for the day, so the tile/card/detail agree (imported-first, mirrors steps).
         importedActiveKcalDay = (await appleA).filter { $0.day == selectedDayKey }.compactMap { $0.activeKcal }.max()
         hrValues = (await hrA).map { $0.bpm }
-        workouts = await wkA
+        workouts = (await wkA).filter { $0.startTs >= from && $0.startTs < to }
 
         let (chargeSource, effortSource, restSource) = await (chargeSourceA, effortSourceA, restSourceA)
         let sourceResolutions = [
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 2fd195771a..df9abf1142 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -95351,6 +95351,39 @@
         }
       }
     },
+    "Day starts": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Tagesbeginn" } },
+      "es": { "stringUnit": { "state": "translated", "value": "El día empieza" } },
+      "fr": { "stringUnit": { "state": "translated", "value": "Début de la journée" } },
+      "it": { "stringUnit": { "state": "translated", "value": "Inizio giornata" } },
+      "pl": { "stringUnit": { "state": "translated", "value": "Początek dnia" } },
+      "pt-PT": { "stringUnit": { "state": "translated", "value": "O dia começa" } },
+      "ru": { "stringUnit": { "state": "translated", "value": "Начало дня" } },
+      "zh-Hans": { "stringUnit": { "state": "translated", "value": "一天开始于" } },
+      "zh-Hant": { "stringUnit": { "state": "translated", "value": "一天開始於" } }
+    } },
+    "Default. Steps and in-progress Effort restart at the beginning of detected main sleep. Naps do not start a new day; missing sleep falls back to local midnight.": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Standard. Schritte und die laufende Anstrengung beginnen mit dem erkannten Hauptschlaf neu. Nickerchen starten keinen neuen Tag; bei fehlendem Schlaf verwendet NOOP ersatzweise die lokale Mitternacht." } },
+      "es": { "stringUnit": { "state": "translated", "value": "Predeterminado. Los pasos y el Esfuerzo en curso se reinician al comienzo del sueño principal detectado. Las siestas no empiezan un nuevo día; si faltan datos de sueño, se usa la medianoche local." } },
+      "fr": { "stringUnit": { "state": "translated", "value": "Par défaut. Les pas et l’Effort en cours repartent de zéro au début du sommeil principal détecté. Les siestes ne commencent pas une nouvelle journée ; en l’absence de sommeil, l’heure locale de minuit est utilisée." } },
+      "it": { "stringUnit": { "state": "translated", "value": "Predefinito. I passi e lo Sforzo in corso ripartono all’inizio del sonno principale rilevato. I sonnellini non iniziano un nuovo giorno; se mancano dati sul sonno, viene usata la mezzanotte locale." } },
+      "pl": { "stringUnit": { "state": "translated", "value": "Domyślnie. Kroki i bieżący Wysiłek zaczynają się od nowa wraz z wykrytym głównym snem. Drzemki nie rozpoczynają nowego dnia; gdy brakuje danych o śnie, używana jest lokalna północ." } },
+      "pt-PT": { "stringUnit": { "state": "translated", "value": "Predefinição. Os passos e o Esforço em curso recomeçam no início do sono principal detetado. As sestas não iniciam um novo dia; se faltarem dados de sono, é usada a meia-noite local." } },
+      "ru": { "stringUnit": { "state": "translated", "value": "По умолчанию. Шаги и текущая Нагрузка обнуляются в начале распознанного основного сна. Дневной сон не начинает новый день; при отсутствии данных о сне используется местная полночь." } },
+      "zh-Hans": { "stringUnit": { "state": "translated", "value": "默认。步数和进行中的体力消耗从检测到的主要睡眠开始时重新计算。小睡不会开始新的一天；缺少睡眠数据时，将使用当地午夜。" } },
+      "zh-Hant": { "stringUnit": { "state": "translated", "value": "預設。步數和進行中的體力消耗從偵測到的主要睡眠開始時重新計算。小睡不會開始新的一天；缺少睡眠資料時，將使用當地午夜。" } }
+    } },
+    "Uses a conventional local calendar day from 00:00 to 00:00.": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Verwendet einen herkömmlichen lokalen Kalendertag von 00:00 bis 00:00 Uhr." } },
+      "es": { "stringUnit": { "state": "translated", "value": "Usa un día natural local convencional de 00:00 a 00:00." } },
+      "fr": { "stringUnit": { "state": "translated", "value": "Utilise une journée civile locale classique de 00:00 à 00:00." } },
+      "it": { "stringUnit": { "state": "translated", "value": "Usa un giorno di calendario locale convenzionale dalle 00:00 alle 00:00." } },
+      "pl": { "stringUnit": { "state": "translated", "value": "Używa zwykłego lokalnego dnia kalendarzowego od 00:00 do 00:00." } },
+      "pt-PT": { "stringUnit": { "state": "translated", "value": "Usa um dia civil local convencional das 00:00 às 00:00." } },
+      "ru": { "stringUnit": { "state": "translated", "value": "Использует обычный местный календарный день с 00:00 до 00:00." } },
+      "zh-Hans": { "stringUnit": { "state": "translated", "value": "使用从 00:00 到次日 00:00 的常规当地日历日。" } },
+      "zh-Hant": { "stringUnit": { "state": "translated", "value": "使用從 00:00 到次日 00:00 的一般當地日曆日。" } }
+    } },
     "Main sleep": {
       "localizations": {
         "de": {
diff --git a/Strand/Screens/CoupledView.swift b/Strand/Screens/CoupledView.swift
index cd02804ba4..a5a0b2fe3b 100644
--- a/Strand/Screens/CoupledView.swift
+++ b/Strand/Screens/CoupledView.swift
@@ -46,9 +46,7 @@ struct CoupledView: View {
     /// the cold-start threshold, which keeps the broad overnight-band bonus.
     @State private var habitualMidsleepSec: Int? = nil
 
-    /// #614: TODAY's workout count from the SAME deduped/dismissed-filtered list the Workouts screen shows
-    /// (`repo.workoutRows`), not `DailyMetric.exerciseCount` (strap-DETECTED only — a Health-Connect import
-    /// with auto-detect off read as 0 while the Workouts screen showed it). Loaded in `.task`.
+    /// Today's all-source workout count materialized onto the same physiological cycle as the other cards.
     @State private var workoutsToday: Int = 0
 
     /// The day the coupled read describes, today's resolved row (the same `resolveToday` #304/#144 boundary
@@ -159,14 +157,7 @@ struct CoupledView: View {
         // bed→wake span below resolves identically (#294). Re-runs on a sync/import refresh.
         .task(id: repo.refreshSeq) {
             habitualMidsleepSec = await repo.habitualMidsleepSec()
-            // #614: count TODAY's workouts by their START's logical day (the SAME 04:00-rollover key
-            // DailyMetric.day uses), so the Coupled stat equals the Workouts overview for today.
-            let key = todayKey
-            // A short window is enough to count today's rows (the cross-source dedup is local to the set),
-            // and avoids loading the full history just for one number.
-            workoutsToday = await repo.workoutRows(days: 2).filter {
-                Repository.logicalDayKey(Date(timeIntervalSince1970: TimeInterval($0.startTs))) == key
-            }.count
+            workoutsToday = day?.exerciseCount ?? 0
         }
     }
 
@@ -339,7 +330,7 @@ struct CoupledView: View {
                                  caloriesText,
                                  tint: StrandPalette.metricAmber)
                         heroStat(String(localized: "Workouts"),
-                                 "\(workoutsToday)",   // #614: real workout count (all sources), not exerciseCount
+                                 "\(workoutsToday)",
                                  tint: StrandPalette.textPrimary)
                     }
                     .frame(maxWidth: .infinity, alignment: .leading)
diff --git a/Strand/Screens/SettingsView.swift b/Strand/Screens/SettingsView.swift
index ab8f9defc0..96419f28ec 100644
--- a/Strand/Screens/SettingsView.swift
+++ b/Strand/Screens/SettingsView.swift
@@ -190,6 +190,7 @@ struct SettingsView: View {
     @AppStorage(UnitPrefs.hrvWindowKey) private var hrvWindowRaw = HrvWindow.whole.rawValue
     // Live-HR Live Activity (Lock Screen + Dynamic Island), iOS only (#336). Default on.
     @AppStorage(UnitPrefs.liveActivityKey) private var liveActivityEnabled = true
+    @AppStorage(DayCycleMode.storageKey) private var dayCycleModeRaw = DayCycleMode.sleepOnset.rawValue
     // Alternate app icon (iOS only) — false = Titanium (primary AppIcon), true = Blue Titanium
     // ("AppIcon-Navy"). Display-only preference; the live switch goes through setAlternateIconName.
     @AppStorage("appIcon.alt") private var useNavyIcon = false
@@ -538,6 +539,27 @@ struct SettingsView: View {
                     }
                 }
                 rowDivider
+                FormRow(label: "Day cycle") {
+                    Picker("Day starts", selection: Binding(
+                        get: { DayCycleMode.persisted(dayCycleModeRaw) },
+                        set: { mode in
+                            dayCycleModeRaw = mode.rawValue
+                            Task { await model.intelligence.analyzeRecent(); await model.repo.refresh() }
+                        }
+                    )) {
+                        Text("Main sleep").tag(DayCycleMode.sleepOnset)
+                        Text("00:00").tag(DayCycleMode.midnight)
+                    }
+                    .labelsHidden()
+                    .pickerStyle(.menu)
+                }
+                Text(dayCycleModeRaw == DayCycleMode.midnight.rawValue
+                     ? "Uses a conventional local calendar day from 00:00 to 00:00."
+                     : "Default. Steps and in-progress Effort restart at the beginning of detected main sleep. Naps do not start a new day; missing sleep falls back to local midnight.")
+                    .font(StrandFont.footnote)
+                    .foregroundStyle(StrandPalette.textTertiary)
+                    .fixedSize(horizontal: false, vertical: true)
+                rowDivider
                 // Step calibration (#139/#132): daily steps = @57 counter ticks ÷ this divisor.
                 // 1.0 = raw pass-through until the true 5/MG tick rate is known. The divisor goes
                 // up to 30 because a 5/MG motion counter can overcount by ~24×; the stepper uses a
diff --git a/Strand/Screens/TodayView.swift b/Strand/Screens/TodayView.swift
index a54cc24d19..43fdb0c913 100644
--- a/Strand/Screens/TodayView.swift
+++ b/Strand/Screens/TodayView.swift
@@ -187,6 +187,8 @@ struct ActiveWorkoutIndicatorSection: View {
 }
 
 struct TodayView: View {
+    @AppStorage(DayCycleMode.storageKey) private var dayCycleModeRaw = DayCycleMode.sleepOnset.rawValue
+    private var dayCycleMode: DayCycleMode { DayCycleMode.persisted(dayCycleModeRaw) }
     /// Product mark, never natural-language copy. Keeping it out of localization also makes source
     /// classification and tint selection stable when the app language changes.
     private static let whoopBrandName = "WHOOP"
@@ -1479,7 +1481,8 @@ struct TodayView: View {
         }
         // Reload when the data refreshes OR the selected day changes, the HR trend and Rest score are
         // day-scoped, so navigating must re-fetch them for the newly selected window.
-        .task(id: TodayLoadKey(seq: repo.refreshSeq, offset: selectedDayOffset)) { await loadAll() }
+        .task(id: TodayLoadKey(seq: repo.refreshSeq, offset: selectedDayOffset,
+                              dayCycleMode: dayCycleModeRaw)) { await loadAll() }
         // #989: hydration writes don't bump refreshSeq, so the card needs its own triggers, a logged /
         // edited / deleted drink (hydrationSeq) and the Settings feature toggle both re-read just the two
         // hydration fields. Cheap (one metricSeries row), never re-runs the heavy loads.
@@ -4611,6 +4614,8 @@ struct TodayView: View {
         // Rest series + the two provenance resolves, all day-keyed outputs, none consumes another's
         // result, so fire them concurrently and await where first used.
         async let restSeriesA       = repo.exploreSeries(key: "sleep_performance", source: "my-whoop")
+        async let dayCycleSeriesA   = repo.exploreSeries(
+            key: DayCycleIntelligenceIntegration.onsetKey, source: "my-whoop")
         async let recoveryResolvedA = repo.resolvedSeries(key: "recovery", source: Repository.whoopSource)
         async let restResolvedA     = repo.resolvedSeries(key: "sleep_performance", source: Repository.whoopSource)
 
@@ -4618,6 +4623,7 @@ struct TodayView: View {
         // `sleep_performance` (imported-wins), so a Bluetooth-only user sees the on-device Rest
         // composite and an importer sees the export's figure, exactly like the Rest detail screen.
         let restSeries = await restSeriesA
+        let dayCycleSeries = await dayCycleSeriesA
         let restByDay = Dictionary(restSeries.map { ($0.day, $0.value) }, uniquingKeysWith: { _, last in last })
         // The Rest TILE's sparkline (#614 follow-up). The tile's number is `restScore` (the Rest composite,
         // 0–100) but its mini-graph used to plot raw sleep MINUTES (`sparks["sleep_total_min"]`), so the
@@ -4667,11 +4673,20 @@ struct TodayView: View {
         // in the small hours after midnight today still starts at yesterday's midnight rather than
         // blanking to an empty new-calendar-day axis (#144).
         let dayStart = Calendar.current.startOfDay(for: selectedLogicalDay)
-        let windowStart = Int(dayStart.timeIntervalSince1970)
-        let windowEnd: Int = selectedDayOffset == 0
+        let calendarStart = Int(dayStart.timeIntervalSince1970)
+        let calendarEnd: Int = selectedDayOffset == 0
             ? Int(Date().timeIntervalSince1970)
             : Int((Calendar.current.date(byAdding: .day, value: 1, to: dayStart) ?? dayStart).timeIntervalSince1970)
-        let hrPointsLocal = await repo.hrBuckets(from: windowStart, to: windowEnd, bucketSeconds: 300)
+        let nextDay = Calendar.current.date(byAdding: .day, value: 1, to: dayStart) ?? dayStart
+        let nextDayKey = Repository.localDayKey(nextDay)
+        let cycleMarkers = dayCycleMode == .sleepOnset
+            ? await repo.exploreSeries(key: DayCycleIntelligenceIntegration.onsetKey, source: "my-whoop") : []
+        let windowStart = cycleMarkers.last(where: { $0.day == selectedDayKey }).map { Int($0.value) }
+            ?? calendarStart
+        let windowEndExclusive = cycleMarkers.last(where: { $0.day == nextDayKey }).map { Int($0.value) }
+            ?? calendarEnd
+        let windowEndInclusive = max(windowStart, windowEndExclusive - 1)
+        let hrPointsLocal = await repo.hrBuckets(from: windowStart, to: windowEndInclusive, bucketSeconds: 300)
             .map { TrendPoint(date: Date(timeIntervalSince1970: TimeInterval($0.ts)), value: $0.bpm) }
         hrPoints = hrPointsLocal
 
@@ -4681,7 +4696,7 @@ struct TodayView: View {
         // canonical UNION (like the HR curve / Effort above): a re-added strap banks its live step samples
         // under its OWN fresh id, so a read pinned to the canonical "my-whoop" would drop the icon for a
         // re-added strap (the #904/#908 family). nil (no classed sample) hides the icon.
-        let stepClassLocal = await repo.stepActivityClassLatest(from: windowStart, to: windowEnd)
+        let stepClassLocal = await repo.stepActivityClassLatest(from: windowStart, to: windowEndInclusive)
         stepActivityClassToday = stepClassLocal
 
         // #860 item 1: the launch auto-land (#605/#739 "snap to the most recent data day when today is
@@ -4698,7 +4713,11 @@ struct TodayView: View {
         // gauge falls back to the stored row (never a fabricated value); a navigated past day clears it.
         let liveStrainLocal: Double?
         if selectedDayOffset == 0 {
-            let todayHr = await repo.hrSamples(from: windowStart, to: windowEnd)
+            let mode = DayCycleMode.persisted(UserDefaults.standard.string(forKey: DayCycleMode.storageKey))
+            let cycleOnset = dayCycleSeries.last(where: { $0.day <= selectedDayKey })
+                .map { Int($0.value.rounded()) }
+            let effortStart = mode == .sleepOnset ? (cycleOnset ?? windowStart) : windowStart
+            let todayHr = await repo.hrSamples(from: effortStart, to: windowEndInclusive)
             let maxHR = profile.age > 0 ? StrainScorer.tanakaHRmax(age: Double(profile.age)) : nil
             let restHR = displayDay?.restingHr.map(Double.init) ?? StrainScorer.defaultRestingHR
             liveStrainLocal = StrainScorer.strain(todayHr, maxHR: maxHR, restingHR: restHR,
@@ -4710,7 +4729,7 @@ struct TodayView: View {
         // Pin the chart axis to the loaded window, today midnight→now, a past day the full 24h, so
         // a gap (e.g. a morning the strap wasn't banking) shows as empty space, not a late start.
         let newAxis = Date(timeIntervalSince1970: TimeInterval(windowStart))
-            ... Date(timeIntervalSince1970: TimeInterval(windowEnd))
+            ... Date(timeIntervalSince1970: TimeInterval(windowEndExclusive))
         // #829 - keep the HR zoom VALID across reloads. The window changes on a day step (a whole new day)
         // and, on today, each refresh nudges the end to a fresh `now`. A day step clears the zoom so the new
         // day opens at full scale; a same-day end-extension keeps the user's zoom but RE-CLAMPS it into the
@@ -4728,7 +4747,7 @@ struct TodayView: View {
         // read for a night stored as more than one block (#294). Drives the HR sleep band + the recovery
         // marker's wake anchor.
         let overlapping = await repo.allSleepSessions(days: selectedDayOffset + 2)
-            .filter { $0.endTs > windowStart && $0.startTs < windowEnd }
+            .filter { $0.endTs > windowStart && $0.startTs < windowEndExclusive }
         let habitualMidsleepSecLocal = await repo.habitualMidsleepSec()
         let sleepTodayLocal = SleepView.mainNightSpan(overlapping, habitualMidsleepSec: habitualMidsleepSecLocal)
             .map { span in
@@ -5104,6 +5123,7 @@ struct TodayView: View {
 private struct TodayLoadKey: Equatable {
     let seq: Int
     let offset: Int
+    let dayCycleMode: String
 }
 
 /// #849: an in-memory snapshot of everything `loadHistoryWide()` computes: the ~40 history-wide reads +
diff --git a/StrandTests/DayCycleRecoveryTests.swift b/StrandTests/DayCycleRecoveryTests.swift
new file mode 100644
index 0000000000..50e00fb32d
--- /dev/null
+++ b/StrandTests/DayCycleRecoveryTests.swift
@@ -0,0 +1,87 @@
+import XCTest
+import WhoopStore
+@testable import Strand
+
+@MainActor
+final class DayCycleRecoveryTests: XCTestCase {
+    private enum ReadFailure: Error { case injected }
+
+    func testApplyingCycleStepsPreservesUnrelatedDailyColumns() {
+        let daily = DailyMetric(
+            day: "2026-09-04", totalSleepMin: nil, efficiency: nil, deepMin: nil, remMin: nil,
+            lightMin: nil, disturbances: nil, restingHr: nil, avgHrv: nil, recovery: nil,
+            strain: nil, exerciseCount: nil, spo2Pct: nil, skinTempDevC: nil, respRateBpm: nil,
+            steps: 10, activeKcalEst: nil, skinTempC: 34.2, sleepHrOnly: true)
+        let result = DayCycleIntelligenceIntegration.Result(
+            stepsByWakeDay: [daily.day: 42], strainByWakeDay: [daily.day: 61],
+            caloriesByWakeDay: [daily.day: 1_840], workoutCountByWakeDay: [daily.day: 2],
+            onsetByWakeDay: [:], firstWakeDay: daily.day,
+            markerUpdate: .preserve)
+
+        let updated = DayCycleIntelligenceIntegration.applying(result, to: daily)
+
+        XCTAssertEqual(updated.steps, 42)
+        XCTAssertEqual(updated.strain, 61)
+        XCTAssertEqual(updated.activeKcalEst, 1_840)
+        XCTAssertEqual(updated.exerciseCount, 2)
+        XCTAssertEqual(updated.skinTempC, 34.2)
+        XCTAssertEqual(updated.sleepHrOnly, true)
+    }
+
+    func testBoundaryRecoveryPropagatesSessionReadFailure() async {
+        let reader = DayCycleIntelligenceIntegration.BoundaryRecoveryReader(
+            sleepSessions: { _, _, _ in throw ReadFailure.injected },
+            markers: { _, _, _ in XCTFail("marker read must not follow a failed session read"); return [] })
+
+        do {
+            _ = try await DayCycleIntelligenceIntegration.recover(
+                candidates: [(owner: "strap", priority: 0)], reader: reader,
+                claimedDays: [], windowStart: 1_700_000_000, now: 1_700_086_400,
+                offsetSec: 0, habitualMidsleepSec: nil)
+            XCTFail("expected recovery to fail closed")
+        } catch ReadFailure.injected {
+            // Expected: callers can distinguish an unread namespace from an authoritative empty one.
+        } catch {
+            XCTFail("unexpected error: \(error)")
+        }
+    }
+
+    func testBoundaryRecoveryPropagatesMarkerReadFailure() async {
+        let reader = DayCycleIntelligenceIntegration.BoundaryRecoveryReader(
+            sleepSessions: { _, _, _ in [] },
+            markers: { _, _, _ in throw ReadFailure.injected })
+
+        do {
+            _ = try await DayCycleIntelligenceIntegration.recover(
+                candidates: [(owner: "strap", priority: 0)], reader: reader,
+                claimedDays: [], windowStart: 1_700_000_000, now: 1_700_086_400,
+                offsetSec: 0, habitualMidsleepSec: nil)
+            XCTFail("expected recovery to fail closed")
+        } catch ReadFailure.injected {
+        } catch {
+            XCTFail("unexpected error: \(error)")
+        }
+    }
+
+    func testComputePreservesMarkersWhenRecoveryCannotBeRead() async throws {
+        let store = try await WhoopStore.inMemory()
+        let reader = DayCycleIntelligenceIntegration.BoundaryRecoveryReader(
+            sleepSessions: { _, _, _ in throw ReadFailure.injected },
+            markers: { _, _, _ in XCTFail("marker read must not follow a failed session read"); return [] })
+
+        let result = await DayCycleIntelligenceIntegration.compute(
+            nights: [], editedRows: [], store: store,
+            candidates: [(owner: "strap", priority: 0)],
+            physiologyOwners: ["strap"], workouts: [],
+            windowStart: 1_700_000_000, now: 1_700_086_400, offsetSec: 0,
+            habitualMidsleepSec: nil, ticksPerStep: 1, mode: .sleepOnset,
+            cache: DayCycleIntelligenceIntegration.Cache(), profile: UserProfile(),
+            maxHROverride: nil, effortMethod: .edwards, recoveryReader: reader)
+
+        guard case .preserve = result.markerUpdate else {
+            return XCTFail("an unread marker namespace must never become an authoritative replacement")
+        }
+        XCTAssertTrue(result.stepsByWakeDay.isEmpty)
+        XCTAssertTrue(result.onsetByWakeDay.isEmpty)
+    }
+}
diff --git a/android/app/src/main/java/com/noop/analytics/DayCycle.kt b/android/app/src/main/java/com/noop/analytics/DayCycle.kt
new file mode 100644
index 0000000000..50dacc4aeb
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/DayCycle.kt
@@ -0,0 +1,81 @@
+package com.noop.analytics
+
+/**
+ * User-selectable ownership rule for additive daily metrics.
+ *
+ * Sleep and recovery values keep their night/wake-day semantics; this setting is for values accumulated
+ * while awake, such as steps, energy and cardiovascular load.
+ */
+enum class DayCycleMode(val persistedValue: String) {
+    SLEEP_ONSET("sleep_onset"),
+    MIDNIGHT("midnight");
+
+    companion object {
+        fun fromPersisted(value: String?): DayCycleMode = entries.firstOrNull {
+            it.persistedValue == value
+        } ?: SLEEP_ONSET
+    }
+}
+
+/** Shared cycle window consumed by every additive daily metric. */
+data class DayCycleWindow(
+    val id: String,
+    val startInclusive: Long,
+    val endExclusive: Long,
+    val displayDay: String,
+    val source: Source,
+) {
+    enum class Source { DETECTED_SLEEP, EDITED_SLEEP, SYNTHETIC_MIDNIGHT, CALENDAR }
+}
+
+object DayCycleResolver {
+    const val MIN_SYNTHETIC_MIDNIGHT_AGE_SECONDS = 18 * 3_600L
+    const val ABSOLUTE_MAX_OPEN_SECONDS = 40 * 3_600L
+
+    /** Midnight is always available and is also the honest cold-start/failure fallback. */
+    fun calendarWindow(now: Long, tzOffsetSeconds: Long): DayCycleWindow {
+        val local = now + tzOffsetSeconds
+        val dayNumber = Math.floorDiv(local, SleepStageTotals.SECONDS_PER_DAY)
+        val start = dayNumber * SleepStageTotals.SECONDS_PER_DAY - tzOffsetSeconds
+        val day = AnalyticsEngine.dayString(start, tzOffsetSeconds)
+        return DayCycleWindow("calendar:$day", start, now, day, DayCycleWindow.Source.CALENDAR)
+    }
+
+    /** First local midnight that does not truncate a freshly-started sleep cycle. */
+    fun fallbackMidnightAfter(start: Long, tzOffsetSeconds: Long): Long {
+        val minimum = start + MIN_SYNTHETIC_MIDNIGHT_AGE_SECONDS
+        val local = minimum + tzOffsetSeconds
+        val dayNumber = Math.floorDiv(local, SleepStageTotals.SECONDS_PER_DAY)
+        val atMidnight = dayNumber * SleepStageTotals.SECONDS_PER_DAY - tzOffsetSeconds
+        return if (atMidnight >= minimum) atMidnight
+        else (dayNumber + 1) * SleepStageTotals.SECONDS_PER_DAY - tzOffsetSeconds
+    }
+
+    /**
+     * Resolve the active window. Sleep-onset mode stays open across midnight even when awake coverage is
+     * unavailable. The absolute cap still prevents a stale sleep boundary from remaining active forever.
+     */
+    fun activeWindow(
+        mode: DayCycleMode,
+        latestSleep: DayCycleWindow?,
+        now: Long,
+        tzOffsetSeconds: Long,
+        reliableAwakeCoverage: Boolean,
+    ): DayCycleWindow {
+        if (mode == DayCycleMode.MIDNIGHT || latestSleep == null) {
+            return calendarWindow(now, tzOffsetSeconds)
+        }
+        val age = now - latestSleep.startInclusive
+        val mustFallback = age >= ABSOLUTE_MAX_OPEN_SECONDS
+        if (!mustFallback) return latestSleep.copy(endExclusive = now)
+        val boundary = fallbackMidnightAfter(latestSleep.startInclusive, tzOffsetSeconds)
+        val day = AnalyticsEngine.dayString(boundary, tzOffsetSeconds)
+        return DayCycleWindow(
+            id = "synthetic:$day",
+            startInclusive = boundary,
+            endExclusive = now,
+            displayDay = day,
+            source = DayCycleWindow.Source.SYNTHETIC_MIDNIGHT,
+        )
+    }
+}
diff --git a/android/app/src/main/java/com/noop/analytics/DayCycleIntelligenceIntegration.kt b/android/app/src/main/java/com/noop/analytics/DayCycleIntelligenceIntegration.kt
new file mode 100644
index 0000000000..fe70628ce4
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/DayCycleIntelligenceIntegration.kt
@@ -0,0 +1,147 @@
+package com.noop.analytics
+
+import com.noop.data.DailyMetric
+import com.noop.data.MetricSeriesRow
+import com.noop.data.SleepSession
+import com.noop.data.WhoopRepository
+
+/** Narrow adapter between the generic day-cycle domain and the legacy scoring orchestrator. */
+internal object DayCycleIntelligenceIntegration {
+    const val ONSET_KEY = "day_cycle_onset_ts"
+
+    internal data class PersistedBoundary(
+        val boundary: PhysiologicalSteps.CycleBoundary,
+        val wakeDay: String,
+        val owner: String,
+        val sleepContext: DetectedSleep,
+    )
+
+    fun integratedStepValue(calendarSteps: Int?, established: Boolean, cycleSteps: Int?): Int? =
+        if (established) cycleSteps else calendarSteps
+
+    fun markerRewriteSourceIds(
+        currentComputedSources: List<String>,
+        candidateComputedSources: List<String>,
+    ): List<String> = (currentComputedSources + candidateComputedSources).distinct()
+
+    fun persistedBoundaries(
+        candidates: List<Pair<String, Int>>,
+        sessionsByOwner: Map<String, List<SleepSession>>,
+        markerOnsetByOwnerAndDay: Map<String, Map<String, Long>>,
+        currentBoundaryWakeDays: Set<String>,
+        tzOffsetSeconds: Long,
+        habitualMidsleepSec: Long?,
+    ): List<PersistedBoundary> {
+        val claimedDays = currentBoundaryWakeDays.toMutableSet()
+        val recovered = ArrayList<PersistedBoundary>()
+        for ((owner, _) in candidates.sortedWith(compareBy<Pair<String, Int>> { it.second }.thenBy { it.first })) {
+            val sessionsByWakeDay = sessionsByOwner[owner].orEmpty()
+                .filter { it.endTs > it.effectiveStartTs }
+                .groupBy { AnalyticsEngine.dayString(it.endTs, tzOffsetSeconds) }
+            for ((wakeDay, sessions) in sessionsByWakeDay.toSortedMap()) {
+                if (wakeDay in claimedDays) continue
+                val markerOnset = markerOnsetByOwnerAndDay[owner]?.get(wakeDay) ?: continue
+                val blocks = sessions.map { session ->
+                    PhysiologicalSteps.SleepBlock(
+                        session.startTs, session.endTs, session.startTs.toString(), session.startTsAdjusted,
+                    )
+                }
+                val winner = PhysiologicalSteps.classifyForCycle(
+                    blocks, tzOffsetSeconds, habitualMidsleepSec,
+                ).firstOrNull {
+                    it.kind == PhysiologicalSteps.SleepKind.MAIN_SLEEP && it.effectiveOnset == markerOnset
+                } ?: continue
+                val persisted = sessions.firstOrNull {
+                    it.startTs.toString() == winner.id && it.effectiveStartTs == markerOnset
+                } ?: continue
+                recovered += PersistedBoundary(
+                    PhysiologicalSteps.CycleBoundary("persisted:$owner:${persisted.startTs}", markerOnset),
+                    wakeDay,
+                    owner,
+                    DetectedSleep(
+                        persisted.effectiveStartTs, persisted.endTs, persisted.efficiency ?: 0.0,
+                        AnalyticsEngine.decodeStages(persisted.stagesJSON), persisted.restingHr, persisted.avgHrv,
+                    ),
+                )
+                claimedDays += wakeDay
+            }
+        }
+        return recovered
+    }
+
+    fun recoveredMarkerRows(
+        recovered: List<PersistedBoundary>,
+        computedDeviceId: (String) -> String,
+    ): List<MetricSeriesRow> = recovered.map {
+        MetricSeriesRow(computedDeviceId(it.owner), it.wakeDay, ONSET_KEY, it.boundary.onset.toDouble())
+    }
+
+    fun cacheKey(
+        owner: String,
+        sleepId: String,
+        onset: Long,
+        end: Long,
+        stepRevision: String,
+        sleepContextSignature: String,
+        contributingDayKeys: List<Pair<String, String>>,
+    ): String = buildString {
+        append(owner).append('|').append(sleepId).append('|').append(onset).append('|').append(end)
+            .append("|stepRevision=").append(stepRevision)
+            .append("|sleepContext=").append(sleepContextSignature)
+        for ((day, witness) in contributingDayKeys.sortedBy { it.first }) append('|').append(day).append('=').append(witness)
+    }
+
+    fun shouldRecount(cachedKey: String?, currentKey: String): Boolean = cachedKey != currentKey
+
+    private fun dayWitness(owner: String, result: DayResult): String = buildString {
+        append(owner).append(':').append(result.daily.steps ?: "nil")
+        for (sleep in result.sleepSessions.sortedBy { it.start }) {
+            append('|').append(sleep.start).append('-').append(sleep.end).append(':').append(sleep.stages.hashCode())
+        }
+    }
+
+    suspend fun compute(
+        scoredNights: List<DayResult>,
+        editedRows: List<SleepSession>,
+        resolvedOwners: Map<String, String>,
+        candidatePriorities: List<Pair<String, Int>>,
+        repo: WhoopRepository,
+        tzOffsetSeconds: Long,
+        habitualMidsleepSec: Long?,
+        windowStart: Long,
+        nowSeconds: Long,
+        stepTicksPerStep: Double,
+        traceSink: ((String) -> Unit)?,
+        mode: DayCycleMode,
+        profile: UserProfile,
+        maxHROverride: Double?,
+        effortMethod: StrainScorer.Method,
+    ): PhysiologicalStepCycleEngine.Result {
+        val witnesses = scoredNights.associate { result ->
+            result.daily.day to dayWitness(resolvedOwners[result.daily.day].orEmpty(), result)
+        }
+        return PhysiologicalStepCycleEngine.compute(
+            scoredNights, editedRows, resolvedOwners, candidatePriorities, witnesses, repo,
+            tzOffsetSeconds, habitualMidsleepSec, windowStart, nowSeconds, stepTicksPerStep, traceSink, mode,
+            profile, maxHROverride, effortMethod,
+        )
+    }
+
+    fun apply(
+        daily: DailyMetric,
+        result: PhysiologicalStepCycleEngine.Result,
+        computedId: String,
+        metricRows: MutableList<MetricSeriesRow>,
+    ): DailyMetric {
+        val established = result.firstCycleWakeDay?.let { daily.day >= it } == true
+        result.boundaryOnsetByWakeDay[daily.day]?.let { onset ->
+            metricRows += MetricSeriesRow(computedId, daily.day, ONSET_KEY, onset.toDouble())
+        }
+        return daily.copy(
+            steps = integratedStepValue(daily.steps, established, result.cycleStepsByWakeDay[daily.day]),
+            strain = if (established) result.cycleStrainByWakeDay[daily.day] else daily.strain,
+            activeKcalEst = if (established) result.cycleCaloriesByWakeDay[daily.day] else daily.activeKcalEst,
+            exerciseCount = if (established) result.cycleWorkoutCountByWakeDay[daily.day] else daily.exerciseCount,
+        )
+    }
+}
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index d7c32f0fc7..8b10314b2a 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -161,6 +161,7 @@ object IntelligenceEngine {
 
     /** Read cap per stream read , matches the Swift 200_000 bound. */
     const val STREAM_LIMIT: Int = 200_000
+    internal const val PHYSIOLOGICAL_STEP_PAGE_SIZE: Int = 10_000
 
     private const val SECONDS_PER_DAY: Long = 86_400L
 
@@ -410,6 +411,7 @@ object IntelligenceEngine {
         // #1545: the Effort TRIMP recipe. The Context-aware caller reads NoopPrefs.effortMethod(context)
         // and passes it down, keeping this layer Context-free. EDWARDS default = byte-identical.
         effortMethod: StrainScorer.Method = StrainScorer.Method.EDWARDS,
+        dayCycleMode: DayCycleMode = DayCycleMode.SLEEP_ONSET,
     ): List<Computed> = withContext(Dispatchers.Default) {
         // #1005: time the whole pass so a re-score STORM is visible in the strap log (the trigger lines
         // record WHY each pass runs; this records how many nights and how long — the CPU cost per run).
@@ -422,7 +424,7 @@ object IntelligenceEngine {
                 nowSeconds, ownerSource, manualStepCoefficient, persistStepsCalibration, baselineEpoch,
                 recoveryEpoch, diag, useExperimentalSleepV2, useMotionAwareWake, sleepTraceSink, recoveryTraceSink,
                 stepsTraceSink, universalSink, workoutsTraceSink, hrvTraceSink, deepHrvWindow,
-                spo2CandidateDisplay, effortMethod)
+                spo2CandidateDisplay, effortMethod, dayCycleMode)
             if (healed == 0) out
             // #899 heal re-pass: the pass above deleted overlapping duplicate sleep sessions AFTER its days
             // were scored, and the read-side dedup those days consumed had no bank-recency witness (the fresh
@@ -433,7 +435,7 @@ object IntelligenceEngine {
                 nowSeconds, ownerSource, manualStepCoefficient, persistStepsCalibration, baselineEpoch,
                 recoveryEpoch, diag, useExperimentalSleepV2, useMotionAwareWake, sleepTraceSink, recoveryTraceSink,
                 stepsTraceSink, universalSink, workoutsTraceSink, hrvTraceSink, deepHrvWindow,
-                spo2CandidateDisplay, effortMethod).first
+                spo2CandidateDisplay, effortMethod, dayCycleMode).first
         }
         diag("re-score: done — scored ${scored.size} night(s) in ${(System.nanoTime() - reScoreStart) / 1_000_000} ms (#1005)")
         scored
@@ -537,6 +539,7 @@ object IntelligenceEngine {
         spo2CandidateDisplay: Boolean = false,
         // #1545: the Effort TRIMP recipe, threaded from the public wrapper.
         effortMethod: StrainScorer.Method = StrainScorer.Method.EDWARDS,
+        dayCycleMode: DayCycleMode = DayCycleMode.SLEEP_ONSET,
         // #899 heal re-pass: the second component of the return is how many overlapping duplicate sleep
         // sessions the heal below deleted this pass. The public wrapper re-runs ONCE when it is non-zero
         // so the affected days re-score against the cleaned store.
@@ -597,6 +600,8 @@ object IntelligenceEngine {
         // on. Keyed by the local day.
         val readOwnerByDay = LinkedHashMap<String, OwnerRead>()
         val resolvedScoreOwnerByDay = LinkedHashMap<String, String>()
+        // Boundary/cache witness assembled from the already-computed day result. The independent O(1)
+        // repository revision below handles step-only inserts even when the HR-keyed day cache is reused.
         // HRV baseline honours the manual "Recalibrate baseline" epoch (noop.hrvBaselineEpoch): pass the
         // per-value "yyyy-MM-dd" day keys (parallel to the values) so foldHistory drops every night before
         // the epoch. baselineEpoch is threaded down from the Context-aware caller (0.0 = no recalibration).
@@ -728,6 +733,7 @@ object IntelligenceEngine {
             // produced under one method is stale the moment the user switches — serving it would show a
             // window of days scored by a recipe the user just turned off, with nothing to explain it.
             effortMethod.toString(),
+            dayCycleMode.persistedValue,
         ).joinToString("|")
         // Drop the whole cache on a config change. Under [analyzeGate] (this whole pass runs holding the
         // lock), so mutating the object-level cache here is race-free.
@@ -1489,6 +1495,13 @@ object IntelligenceEngine {
             .appleDaily(WhoopRepository.APPLE_HEALTH_SOURCE, "0000-01-01", "9999-12-31")
             .map { it.day }.toHashSet()
 
+        val physiologicalSteps = DayCycleIntelligenceIntegration.compute(
+            scoredNights, editedRows, resolvedScoreOwnerByDay, candidatePriorities, repo,
+            tzOffsetSeconds, habitualMidsleepSec, windowStart, nowSeconds, profile.stepTicksPerStep,
+            stepsTraceSink, dayCycleMode,
+            profile, maxHROverride, effortMethod,
+        )
+
         for (res in scoredNights) {
             // #299: scope the edits to THIS day before folding. A userEdited row / hand-logged nap belongs
             // to exactly ONE day — the day its night ENDS on, matching the daily's end-day bucket
@@ -1498,13 +1511,11 @@ object IntelligenceEngine {
             // #547 effective-onset detail is preserved: editOnsetByStart still carries the user-CORRECTED
             // bedtime (startTsAdjusted ?: startTs) for this day's edited/manual blocks.
             val dayEditedRows = editedRowsForDay(editedRows, res.daily.day, tzOffsetSeconds)
-            val editsByStart: Map<Long, String?> = dayEditedRows.associate { it.startTs to it.stagesJSON }
-            val editOnsetByStart: Map<Long, Long> = dayEditedRows.associate { it.startTs to it.effectiveStartTs }
             // Substitute an edited block's (reshaped) stages for its detected twin before the daily
             // sleep aggregate feeds Rest + recovery. No edit touching this night → `daily` is unchanged.
-            val daily = sleepEditedDaily(
-                res.daily, res.sleepSessions, editsByStart, editOnsetByStart,
-                tzOffsetSeconds, habitualMidsleepSec,
+            val daily = editedCycleDaily(
+                res, dayEditedRows, tzOffsetSeconds, habitualMidsleepSec,
+                physiologicalSteps, computedId, restRows,
             )
             val recovery = recomputeRecovery(daily, baselines2)
             // Charge term-breakdown trace (Test Centre Group G): only when the Recovery test mode is on
@@ -1580,8 +1591,9 @@ object IntelligenceEngine {
             // Scoped to computed days: an imported-total-only day legitimately has a total without our
             // sessions, so it is NOT a divergence.
             val imported = daily.day in importedWhoopDays || daily.day in appleHealthDays
-            if (!imported && daily.totalSleepMin != null && res.sleepSessions.isEmpty()) {
-                diag(sleepDivergenceLogLine(daily.day, Math.round(daily.totalSleepMin).toInt(), dayEditedRows.size))
+            val finalSleepMin = daily.totalSleepMin
+            if (!imported && finalSleepMin != null && res.sleepSessions.isEmpty()) {
+                diag(sleepDivergenceLogLine(daily.day, Math.round(finalSleepMin).toInt(), dayEditedRows.size))
             }
             // #195: one always-on line per scored night with the computed HRV value + the window it used,
             // so an "HRV reads high / deep-sleep window not changing" report is self-diagnosing straight
@@ -1787,31 +1799,11 @@ object IntelligenceEngine {
         // this only fills the days the strap collected but no import covered.
         // Persist metric-level input provenance in the SAME Room transaction. dayOwnership remains
         // exclusively a resolver override, and a failed write can never relabel an older score.
-        val provenanceByCell = LinkedHashMap<Pair<String, String>, ScoreInputProvenanceRow>()
-        for (daily in dailies) {
-            val source = resolvedScoreOwnerByDay[daily.day] ?: continue
-            if (daily.recovery != null) {
-                provenanceByCell[daily.day to "recovery"] =
-                    ScoreInputProvenanceRow(computedId, daily.day, "recovery", source)
-            }
-            if (daily.strain != null) {
-                provenanceByCell[daily.day to "strain"] =
-                    ScoreInputProvenanceRow(computedId, daily.day, "strain", source)
-            }
-        }
-        for (point in restRows) {
-            val source = resolvedScoreOwnerByDay[point.day] ?: continue
-            provenanceByCell[point.day to point.key] =
-                ScoreInputProvenanceRow(computedId, point.day, point.key, source)
-        }
-        repo.replaceComputedScoreWindow(
-            deviceId = computedId,
-            from = oldestDay,
-            to = newestDay,
-            dailyMetrics = dailies,
-            metricPoints = restRows,
-            provenance = provenanceByCell.values.toList(),
+        val computedWindow = IntelligencePersistence.prepareComputedWindow(
+            repo, importedDeviceId, computedId, oldestDay, newestDay, dailies, restRows, physiologicalSteps,
+            candidatePriorities, resolvedScoreOwnerByDay,
         )
+        repo.replaceComputedScoreWindow(computedWindow)
 
         persistFitnessVitalityAndSteps(
             repo = repo,
@@ -1850,37 +1842,8 @@ object IntelligenceEngine {
         val dismissedWindows = repo.dismissedSleeps(importedDeviceId).map { it.startTs to it.endTs }
         val skipWindows = editedWindows + dismissedWindows
         val sleepKept = DismissedSleepGuard.keeping(sleepRows, skipWindows) { it.startTs to it.endTs }
-        if (sleepKept.isNotEmpty()) repo.upsertSleepSessions(sleepKept)
-        // ── Persist per-epoch motion (H8) beside each kept session's stagesJSON ──────────────────────────
-        // The sleepSession rows exist now (just upserted), so the targeted motion UPDATE lands. Persist ONLY
-        // for the sessions actually kept (not edited/dismissed), keyed by the detected start analyzeDay
-        // returned. A session whose gravity wouldn't grid was omitted from the map and is left as NULL , an
-        // absent motion series stays absent, never a fabricated zero array. Mirrors Swift.
+        IntelligencePersistence.persistDetectedSleepDetails(repo, computedId, sleepKept, scoredNights)
         val keptStarts = sleepKept.map { it.startTs }.toHashSet()
-        val motionByStart = HashMap<Long, List<Double>>()
-        for (res in scoredNights) {
-            for ((start, motion) in res.sessionMotionByStart) {
-                if (start in keptStarts) motionByStart[start] = motion
-            }
-        }
-        for ((start, motion) in motionByStart) {
-            repo.persistSessionMotion(computedId, start, motion)
-        }
-        // ── Persist per-epoch BAND sleep_state (#175) beside each kept session's stagesJSON ──────────────
-        // This is the source `sleepStateJSON` lacked (the write path had no producer because the raw stream
-        // was dropped at extraction). Now analyzeDay grids the RAW `sleepStateSample` stream per session;
-        // persist it here so the NEXT pass's bandSleepStateSamples read (the H7 confirm) and the display can
-        // see the strap's OWN scored band. ONLY for kept (not edited/dismissed) sessions; a session with no
-        // band samples was omitted (no key) and stays NULL — an absent signal stays absent. Mirrors Swift.
-        val sleepStateByStart = HashMap<Long, List<Int>>()
-        for (res in scoredNights) {
-            for ((start, states) in res.sessionSleepStateByStart) {
-                if (start in keptStarts) sleepStateByStart[start] = states
-            }
-        }
-        for ((start, states) in sleepStateByStart) {
-            repo.persistSessionSleepState(computedId, start, states)
-        }
         // ── Overlap-aware banked-sleep heal (#899) ────────────────────────────────────────────────────
         // An unstable strap clock re-banks the SAME night under a shifted timebase, so successive passes
         // detect it at shifted bounds and the upsert above lands a SECOND row beside the stale one (the
@@ -2431,6 +2394,24 @@ object IntelligenceEngine {
         tzOffsetSeconds: Long,
     ): List<SleepSession> = editedRows.filter { AnalyticsEngine.dayString(it.endTs, tzOffsetSeconds) == day }
 
+    private fun editedCycleDaily(
+        result: DayResult,
+        edits: List<SleepSession>,
+        tzOffsetSeconds: Long,
+        habitualMidsleepSec: Long?,
+        cycle: PhysiologicalStepCycleEngine.Result,
+        computedId: String,
+        metricRows: MutableList<MetricSeriesRow>,
+    ): DailyMetric {
+        val editsByStart = edits.associate { it.startTs to it.stagesJSON }
+        val onsetByStart = edits.associate { it.startTs to it.effectiveStartTs }
+        val edited = sleepEditedDaily(
+            result.daily, result.sleepSessions, editsByStart, onsetByStart,
+            tzOffsetSeconds, habitualMidsleepSec,
+        )
+        return DayCycleIntelligenceIntegration.apply(edited, cycle, computedId, metricRows)
+    }
+
     private fun sleepEditedDaily(
         daily: DailyMetric,
         detected: List<DetectedSleep>,
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligencePersistence.kt b/android/app/src/main/java/com/noop/analytics/IntelligencePersistence.kt
new file mode 100644
index 0000000000..871bd0fa99
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/IntelligencePersistence.kt
@@ -0,0 +1,115 @@
+package com.noop.analytics
+
+import com.noop.data.DailyMetric
+import com.noop.data.MetricSeriesRow
+import com.noop.data.ScoreInputProvenanceRow
+import com.noop.data.SleepSession
+import com.noop.data.WhoopRepository
+
+/** Persistence-only helpers kept out of the already large scoring orchestrator. */
+internal object IntelligencePersistence {
+    data class ComputedWindow(
+        val deviceId: String,
+        val from: String,
+        val to: String,
+        val dailies: List<DailyMetric>,
+        val metricRows: List<MetricSeriesRow>,
+        val provenance: List<ScoreInputProvenanceRow>,
+        val markerSourceIds: List<String>,
+    )
+
+    suspend fun prepareComputedWindow(
+        repo: WhoopRepository,
+        importedDeviceId: String,
+        computedId: String,
+        from: String,
+        to: String,
+        dailies: List<DailyMetric>,
+        metricRows: List<MetricSeriesRow>,
+        cycle: PhysiologicalStepCycleEngine.Result,
+        candidatePriorities: List<Pair<String, Int>>,
+        ownerByDay: Map<String, String>,
+    ): ComputedWindow {
+        val provenance = scoreProvenance(computedId, dailies, metricRows, ownerByDay)
+        return ComputedWindow(
+            deviceId = computedId,
+            from = from,
+            to = to,
+            dailies = dailies,
+            metricRows = (metricRows + cycle.recoveredOwnerMarkerRows)
+                .distinctBy { Triple(it.deviceId, it.day, it.key) },
+            provenance = provenance,
+            markerSourceIds = DayCycleIntelligenceIntegration.markerRewriteSourceIds(
+                repo.computedSourceIds(importedDeviceId),
+                candidatePriorities.map { (owner, _) -> repo.computedDeviceId(owner) },
+            ),
+        )
+    }
+
+    fun scoreProvenance(
+        computedId: String,
+        dailies: List<DailyMetric>,
+        metricRows: List<MetricSeriesRow>,
+        ownerByDay: Map<String, String>,
+    ): List<ScoreInputProvenanceRow> {
+        val byCell = LinkedHashMap<Pair<String, String>, ScoreInputProvenanceRow>()
+        for (daily in dailies) {
+            val source = ownerByDay[daily.day] ?: continue
+            if (daily.recovery != null) {
+                byCell[daily.day to "recovery"] = ScoreInputProvenanceRow(
+                    computedId, daily.day, "recovery", source,
+                )
+            }
+            if (daily.strain != null) {
+                byCell[daily.day to "strain"] = ScoreInputProvenanceRow(
+                    computedId, daily.day, "strain", source,
+                )
+            }
+        }
+        for (point in metricRows) {
+            val source = ownerByDay[point.day] ?: continue
+            byCell[point.day to point.key] = ScoreInputProvenanceRow(
+                computedId, point.day, point.key, source,
+            )
+        }
+        return byCell.values.toList()
+    }
+
+    suspend fun persistDetectedSleepDetails(
+        repo: WhoopRepository,
+        computedId: String,
+        kept: List<SleepSession>,
+        scoredNights: List<DayResult>,
+    ) {
+        // Only kept (not edited/dismissed) sessions receive their per-epoch motion and band-state arrays.
+        // Missing streams remain absent rather than being materialised as synthetic zero arrays.
+        if (kept.isNotEmpty()) repo.upsertSleepSessions(kept)
+        val keptStarts = kept.map { it.startTs }.toHashSet()
+        val motionByStart = HashMap<Long, List<Double>>()
+        val sleepStateByStart = HashMap<Long, List<Int>>()
+        for (result in scoredNights) {
+            for ((start, motion) in result.sessionMotionByStart) {
+                if (start in keptStarts) motionByStart[start] = motion
+            }
+            for ((start, states) in result.sessionSleepStateByStart) {
+                if (start in keptStarts) sleepStateByStart[start] = states
+            }
+        }
+        for ((start, motion) in motionByStart) repo.persistSessionMotion(computedId, start, motion)
+        for ((start, states) in sleepStateByStart) repo.persistSessionSleepState(computedId, start, states)
+    }
+}
+
+/** Keep the oversized scoring orchestrator at a single, auditable transactional call site. */
+internal suspend fun WhoopRepository.replaceComputedScoreWindow(
+    window: IntelligencePersistence.ComputedWindow,
+) = replaceComputedScoreWindow(
+    deviceId = window.deviceId,
+    from = window.from,
+    to = window.to,
+    dailyMetrics = window.dailies,
+    metricPoints = window.metricRows,
+    provenance = window.provenance,
+    replaceMetricKeys = listOf(DayCycleIntelligenceIntegration.ONSET_KEY),
+    replaceMetricSourceIds = window.markerSourceIds,
+)
diff --git a/android/app/src/main/java/com/noop/analytics/PhysiologicalStepCycleEngine.kt b/android/app/src/main/java/com/noop/analytics/PhysiologicalStepCycleEngine.kt
new file mode 100644
index 0000000000..1fd1a69bbf
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/PhysiologicalStepCycleEngine.kt
@@ -0,0 +1,360 @@
+package com.noop.analytics
+
+import com.noop.data.MetricSeriesRow
+import com.noop.data.SleepSession
+import com.noop.data.WhoopRepository
+import kotlin.math.roundToLong
+
+/**
+ * Sleep-onset-to-sleep-onset step materialisation. Kept outside [IntelligenceEngine]'s already-large
+ * scoring method so the JVM method stays below its 64 KiB bytecode limit and the feature has one boundary.
+ * The cache retains summaries only; raw step pages are released immediately after each segment.
+ */
+internal object PhysiologicalStepCycleEngine {
+    data class Result(
+        val cycleStepsByWakeDay: Map<String, Int>,
+        val cycleStrainByWakeDay: Map<String, Double>,
+        val cycleCaloriesByWakeDay: Map<String, Double>,
+        val cycleWorkoutCountByWakeDay: Map<String, Int>,
+        val boundaryOnsetByWakeDay: Map<String, Long>,
+        val firstCycleWakeDay: String?,
+        val recoveredOwnerMarkerRows: List<MetricSeriesRow>,
+    )
+
+    private data class CachedCycleSteps(
+        val key: String,
+        val count: SleepAwareStepCounter.Count,
+        val pages: Int,
+        val samples: Int,
+        val evaluated: Boolean,
+    )
+
+    /** Process-local and serialized by IntelligenceEngine's analyze gate. */
+    private val cache = HashMap<String, CachedCycleSteps>()
+
+    suspend fun compute(
+        scoredNights: List<DayResult>,
+        editedRows: List<SleepSession>,
+        resolvedScoreOwnerByDay: Map<String, String>,
+        candidatePriorities: List<Pair<String, Int>>,
+        stepWitnessByDay: Map<String, String>,
+        repo: WhoopRepository,
+        tzOffsetSeconds: Long,
+        habitualMidsleepSec: Long?,
+        windowStart: Long,
+        nowSeconds: Long,
+        stepTicksPerStep: Double,
+        stepsTraceSink: ((String) -> Unit)?,
+        dayCycleMode: DayCycleMode,
+        profile: UserProfile,
+        maxHROverride: Double?,
+        effortMethod: StrainScorer.Method,
+    ): Result {
+        if (dayCycleMode == DayCycleMode.MIDNIGHT) {
+            return Result(emptyMap(), emptyMap(), emptyMap(), emptyMap(), emptyMap(), null, emptyList())
+        }
+        val editedRowsByDay = editedRows.groupBy {
+            AnalyticsEngine.dayString(it.endTs, tzOffsetSeconds)
+        }
+        val boundaries = ArrayList<PhysiologicalSteps.CycleBoundary>()
+        val dayBySleepId = LinkedHashMap<String, String>()
+        val ownerBySleepId = LinkedHashMap<String, String>()
+        val sleepContext = ArrayList<DetectedSleep>()
+        val recovered = ArrayList<DayCycleIntelligenceIntegration.PersistedBoundary>()
+
+        for (res in scoredNights) {
+            val dayEdits = editedRowsByDay[res.daily.day].orEmpty()
+            val editsByDetectedStart = dayEdits.associateBy { it.startTs }
+            val detectedStarts = res.sleepSessions.mapTo(HashSet()) { it.start }
+            val blocks = buildList {
+                for (session in res.sleepSessions) {
+                    val edit = editsByDetectedStart[session.start]
+                    sleepContext += SleepAwareStepCounter.withBounds(
+                        session,
+                        start = edit?.effectiveStartTs ?: session.start,
+                        end = edit?.endTs ?: session.end,
+                    )
+                    add(
+                        PhysiologicalSteps.SleepBlock(
+                            onset = session.start,
+                            end = edit?.endTs ?: session.end,
+                            id = session.start.toString(),
+                            editedOnset = edit?.effectiveStartTs,
+                        ),
+                    )
+                }
+                for (edit in dayEdits) {
+                    if (edit.startTs !in detectedStarts) {
+                        add(
+                            PhysiologicalSteps.SleepBlock(
+                                onset = edit.startTs,
+                                end = edit.endTs,
+                                id = "manual:${edit.startTs}",
+                                editedOnset = edit.startTsAdjusted,
+                                kind = PhysiologicalSteps.SleepKind.NAP,
+                            ),
+                        )
+                        sleepContext += DetectedSleep(
+                            start = edit.effectiveStartTs,
+                            end = edit.endTs,
+                            efficiency = 0.0,
+                            stages = emptyList(),
+                            restingHR = null,
+                            avgHRV = null,
+                        )
+                    }
+                }
+            }
+            val classified = PhysiologicalSteps.classifyForCycle(
+                blocks, tzOffsetSeconds, habitualMidsleepSec,
+            )
+            PhysiologicalSteps.mainSleepOnset(
+                classified, tzOffsetSeconds, habitualMidsleepSec,
+            )?.let { onset ->
+                val winner = classified.firstOrNull {
+                    it.kind == PhysiologicalSteps.SleepKind.MAIN_SLEEP && it.effectiveOnset == onset
+                } ?: return@let
+                boundaries += PhysiologicalSteps.CycleBoundary(winner.id, onset)
+                dayBySleepId[winner.id] = res.daily.day
+                resolvedScoreOwnerByDay[res.daily.day]?.let { ownerBySleepId[winner.id] = it }
+            }
+        }
+
+        if (candidatePriorities.isNotEmpty()) {
+            val markerFromDay = AnalyticsEngine.dayString(windowStart, tzOffsetSeconds)
+            val markerToDay = AnalyticsEngine.dayString(nowSeconds, tzOffsetSeconds)
+            val sessionsByOwner = LinkedHashMap<String, List<SleepSession>>()
+            val markersByOwner = LinkedHashMap<String, Map<String, Long>>()
+            for (owner in candidatePriorities.map { it.first }.distinct()) {
+                val ownerComputedId = repo.computedDeviceId(owner)
+                sessionsByOwner[owner] = repo.sleepSessionsForDevice(
+                    ownerComputedId, windowStart, nowSeconds, limit = 4_000,
+                )
+                markersByOwner[owner] = repo.metricSeries(
+                    ownerComputedId,
+                    DayCycleIntelligenceIntegration.ONSET_KEY,
+                    markerFromDay,
+                    markerToDay,
+                ).mapNotNull { row ->
+                    val onset = row.value.toLong()
+                    if (row.value == onset.toDouble()) row.day to onset else null
+                }.toMap()
+            }
+            for (item in DayCycleIntelligenceIntegration.persistedBoundaries(
+                candidates = candidatePriorities,
+                sessionsByOwner = sessionsByOwner,
+                markerOnsetByOwnerAndDay = markersByOwner,
+                currentBoundaryWakeDays = dayBySleepId.values.toHashSet(),
+                tzOffsetSeconds = tzOffsetSeconds,
+                habitualMidsleepSec = habitualMidsleepSec,
+            )) {
+                recovered += item
+                boundaries += item.boundary
+                dayBySleepId[item.boundary.sleepId] = item.wakeDay
+                ownerBySleepId[item.boundary.sleepId] = item.owner
+                sleepContext += item.sleepContext
+            }
+        }
+
+        // Resolve the open tail through the shared day-cycle policy. Step storage proves strap coverage,
+        // not wakefulness: a missed sleep detection has the same endpoints. Until a dedicated, validated
+        // awake signal exists, unknown therefore takes the safe midnight fallback.
+        boundaries.maxByOrNull { it.onset }?.let { latest ->
+            val wakeDay = dayBySleepId[latest.sleepId]
+            val owner = ownerBySleepId[latest.sleepId]
+            if (wakeDay != null && owner != null) {
+                val active = DayCycleResolver.activeWindow(
+                    mode = dayCycleMode,
+                    latestSleep = DayCycleWindow(
+                        id = latest.sleepId,
+                        startInclusive = latest.onset,
+                        endExclusive = nowSeconds,
+                        displayDay = wakeDay,
+                        source = DayCycleWindow.Source.DETECTED_SLEEP,
+                    ),
+                    now = nowSeconds,
+                    tzOffsetSeconds = tzOffsetSeconds,
+                    reliableAwakeCoverage = false,
+                )
+                if (active.source == DayCycleWindow.Source.SYNTHETIC_MIDNIGHT) {
+                    val synthetic = PhysiologicalSteps.CycleBoundary(active.id, active.startInclusive)
+                    boundaries += synthetic
+                    dayBySleepId[synthetic.sleepId] = active.displayDay
+                    ownerBySleepId[synthetic.sleepId] = owner
+                }
+            }
+        }
+
+        val stepsByWakeDay = HashMap<String, Int>()
+        val strainByWakeDay = HashMap<String, Double>()
+        val caloriesByWakeDay = HashMap<String, Double>()
+        val workoutCountByWakeDay = HashMap<String, Int>()
+        val windows = PhysiologicalSteps.cycleWindows(boundaries, nowSeconds)
+        val allDetectedSleep = sleepContext.distinctBy { it.start to it.end }
+        cache.keys.retainAll(windows.mapTo(HashSet()) { it.sleepId })
+        for (window in windows) {
+            val wakeDay = dayBySleepId[window.sleepId] ?: continue
+            val fallbackOwner = ownerBySleepId[window.sleepId] ?: continue
+            // DAO ranges are inclusive. Keep adjacent physiological cycles disjoint.
+            val cycleHr = repo.hrSamplesUnion(
+                fallbackOwner, window.onset, window.endExclusive - 1L, 200_000,
+            )
+            val restingHr = scoredNights.firstOrNull { it.daily.day == wakeDay }?.daily?.restingHr?.toDouble()
+                ?: StrainScorer.defaultRestingHR
+            val effectiveMaxHr = maxHROverride
+                ?: profile.age.takeIf { it > 0 }?.let { StrainScorer.tanakaHRmax(it.toDouble()) }
+            StrainScorer.strain(cycleHr, effectiveMaxHr, restingHr, effortMethod, profile.sex)
+                ?.let { strainByWakeDay[wakeDay] = it }
+            if (cycleHr.isNotEmpty()) {
+                caloriesByWakeDay[wakeDay] = Calories.estimateDayCalories(
+                    cycleHr, profile, effectiveMaxHr, restingHr,
+                )
+            }
+            // Count the persisted all-source workout union, not only analyzer-detected bouts. Repository
+            // reads are inclusive, while ownership is [onset, nextOnset).
+            val workoutEndInclusive = window.endExclusive - 1L
+            val cycleWorkouts = (
+                repo.workoutsUnion(fallbackOwner, window.onset, workoutEndInclusive, 100_000) +
+                    repo.detectedWorkoutsUnion(fallbackOwner, window.onset, workoutEndInclusive, 100_000) +
+                    listOf("apple-health", "health-connect", "lifting", "activity-file").flatMap { source ->
+                        repo.workouts(source, window.onset, workoutEndInclusive, 100_000)
+                    }
+                ).distinctBy { Triple(it.startTs, it.endTs, it.sport) }
+            val freshDetectedKeys = scoredNights.asSequence().flatMap { it.workouts.asSequence() }
+                .filter { it.start >= window.onset && it.start < window.endExclusive }
+                .filter { detected ->
+                    cycleWorkouts.none { persisted ->
+                        detected.start < persisted.endTs && persisted.startTs < detected.end
+                    }
+                }
+                .map { it.start to it.end }
+                .toList()
+            workoutCountByWakeDay[wakeDay] = (
+                cycleWorkouts.map { it.startTs to it.endTs } + freshDetectedKeys
+                ).distinct().size
+            val priorities = LinkedHashMap<String, Int>()
+            for ((owner, priority) in candidatePriorities) priorities[owner] = priority
+            priorities.putIfAbsent(fallbackOwner, priorities.values.minOrNull() ?: 0)
+            val coverage = priorities.mapNotNull { (owner, priority) ->
+                val span = repo.stepTimestampCoverage(owner, window.onset, window.endExclusive)
+                val first = span.firstTs
+                val last = span.lastTs
+                if (first == null || last == null) null else PhysiologicalSteps.OwnerCoverage(
+                    owner, first, (last + 1L).coerceAtMost(window.endExclusive), priority,
+                )
+            }
+            val segments = PhysiologicalSteps.ownerSegmentsFromCoverage(window, coverage, fallbackOwner)
+            if (segments.isEmpty()) continue
+            val active = window.endExclusive == nowSeconds
+            val ownerIdentity = segments.mapIndexed { index, segment ->
+                val identityEnd = if (active && index == segments.lastIndex) 0L else segment.endExclusive
+                "${segment.owner}:${segment.onset}-$identityEnd"
+            }.joinToString(",")
+            val stepRevision = segments.joinToString("|") { segment ->
+                "${segment.owner}=" + repo.stepDataRevisionSignature(
+                    segment.owner, segment.onset, segment.endExclusive,
+                )
+            }
+            val contextSignature = SleepAwareStepCounter.contextSignature(
+                allDetectedSleep, window.onset, window.endExclusive,
+            )
+            val firstDay = AnalyticsEngine.dayString(window.onset, tzOffsetSeconds)
+            val lastDay = AnalyticsEngine.dayString(
+                (window.endExclusive - 1L).coerceAtLeast(window.onset), tzOffsetSeconds,
+            )
+            val witnesses = stepWitnessByDay.entries.asSequence()
+                .filter { it.key >= firstDay && it.key <= lastDay }
+                .map { it.key to it.value }
+                .toList()
+            val key = DayCycleIntelligenceIntegration.cacheKey(
+                owner = ownerIdentity,
+                sleepId = window.sleepId,
+                onset = window.onset,
+                end = if (active) 0L else window.endExclusive,
+                stepRevision = stepRevision,
+                sleepContextSignature = contextSignature,
+                contributingDayKeys = witnesses,
+            )
+            var cached = cache[window.sleepId]
+            if (DayCycleIntelligenceIntegration.shouldRecount(cached?.key, key)) {
+                var pages = 0
+                var samples = 0
+                var evaluated = false
+                var combinedCount = SleepAwareStepCounter.Count.EMPTY
+                for ((segmentIndex, segment) in segments.withIndex()) {
+                    val hasClasses = repo.hasStepActivityClasses(
+                        segment.owner, segment.onset, segment.endExclusive,
+                    )
+                    val accumulator = SleepAwareStepCounter.Accumulator(allDetectedSleep, hasClasses)
+                    var segmentSamples = 0
+                    if (PhysiologicalSteps.shouldReadCounterPredecessor(segmentIndex)) {
+                        repo.stepSampleBefore(segment.owner, segment.onset)?.let {
+                            accumulator.acceptPage(listOf(it))
+                            samples++
+                            segmentSamples++
+                        }
+                    }
+                    var cursor = segment.onset - 1L
+                    while (cursor < segment.endExclusive) {
+                        val page = repo.stepSamplesPage(
+                            segment.owner,
+                            cursor,
+                            segment.endExclusive,
+                            IntelligenceEngine.PHYSIOLOGICAL_STEP_PAGE_SIZE,
+                        )
+                        if (page.isEmpty()) break
+                        accumulator.acceptPage(page)
+                        pages++
+                        samples += page.size
+                        segmentSamples += page.size
+                        val next = page.last().ts
+                        if (next <= cursor) break
+                        cursor = next
+                        if (page.size < IntelligenceEngine.PHYSIOLOGICAL_STEP_PAGE_SIZE) break
+                    }
+                    if (segmentSamples >= 2) evaluated = true
+                    combinedCount += accumulator.finish()
+                }
+                cached = CachedCycleSteps(key, combinedCount, pages, samples, evaluated)
+                cache[window.sleepId] = cached
+            }
+            val result = cached ?: continue
+            if (result.evaluated) {
+                val scaled = (result.count.totalTicks.toDouble() / maxOf(stepTicksPerStep, 0.5))
+                    .roundToLong().coerceAtMost(Int.MAX_VALUE.toLong()).toInt()
+                stepsByWakeDay[wakeDay] = scaled
+                stepsTraceSink?.invoke(
+                    "stepsCycle wakeDay=$wakeDay status=${if (active) "active" else "closed"} " +
+                        "onsetTs=${window.onset} endTs=${window.endExclusive} owner=$ownerIdentity " +
+                        "pages=${result.pages} samples=${result.samples} " +
+                        "totalTicks=${result.count.totalTicks} " +
+                        "outside=${result.count.acceptedOutsideSleepTicks} " +
+                        "awakeGap=${result.count.acceptedAwakeGapTicks} " +
+                        "sleepBout=${result.count.acceptedSleepBoutTicks} " +
+                        "rejectedIsolatedSleep=${result.count.rejectedIsolatedSleepTicks} " +
+                        "rejectedClass=${result.count.rejectedActivityClassTicks} " +
+                        "rejectedImplausible=${result.count.rejectedImplausibleTicks} " +
+                        "gravitySamples=${result.count.gravitySamplesAvailable} " +
+                        "auxSamples=${result.count.auxSamplesAvailable} " +
+                        "ticksPerStep=$stepTicksPerStep " +
+                        "scaledSteps=$scaled",
+                )
+            }
+        }
+
+        return Result(
+            cycleStepsByWakeDay = stepsByWakeDay,
+            cycleStrainByWakeDay = strainByWakeDay,
+            cycleCaloriesByWakeDay = caloriesByWakeDay,
+            cycleWorkoutCountByWakeDay = workoutCountByWakeDay,
+            boundaryOnsetByWakeDay = boundaries.mapNotNull { boundary ->
+                dayBySleepId[boundary.sleepId]?.let { it to boundary.onset }
+            }.toMap(),
+            firstCycleWakeDay = dayBySleepId.values.minOrNull(),
+            recoveredOwnerMarkerRows = DayCycleIntelligenceIntegration.recoveredMarkerRows(
+                recovered,
+                repo::computedDeviceId,
+            ),
+        )
+    }
+}
diff --git a/android/app/src/main/java/com/noop/analytics/PhysiologicalSteps.kt b/android/app/src/main/java/com/noop/analytics/PhysiologicalSteps.kt
new file mode 100644
index 0000000000..e62c2ded73
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/PhysiologicalSteps.kt
@@ -0,0 +1,208 @@
+package com.noop.analytics
+
+/**
+ * WHOOP-style step-day boundaries. A physiological step day starts at the onset of the main sleep
+ * and ends at the next main-sleep onset; the delta is still attributed to the later counter sample.
+ * We deliberately do not mask the sleep span: a real walk during a long night-time wake remains a
+ * walk, while the shared activity-class and tick-rate gates continue to reject non-locomotion.
+ */
+object PhysiologicalSteps {
+
+    enum class SleepKind { MAIN_SLEEP, NAP, UNCLASSIFIED }
+
+    data class SleepBlock(
+        val onset: Long,
+        val end: Long,
+        /** Stable identity lets a user-edited onset move an existing boundary instead of adding one. */
+        val id: String = onset.toString(),
+        val editedOnset: Long? = null,
+        val kind: SleepKind = SleepKind.UNCLASSIFIED,
+    ) {
+        val effectiveOnset: Long get() = editedOnset ?: onset
+    }
+
+    /** The one open physiological cycle. Absence of a newly detected night never creates a calendar cycle. */
+    data class CycleBoundary(val sleepId: String, val onset: Long)
+
+    data class CycleWindow(val sleepId: String, val onset: Long, val endExclusive: Long)
+
+    data class OwnerSegment(val owner: String, val onset: Long, val endExclusive: Long)
+    data class OwnerCoverage(
+        val owner: String,
+        val onset: Long,
+        val endExclusive: Long,
+        val priority: Int,
+    )
+
+    fun shouldReadCounterPredecessor(segmentIndex: Int): Boolean = segmentIndex == 0
+
+    private const val MIN_MAIN_SLEEP_SECONDS = 3 * 3_600L
+
+
+    /**
+     * Apply the same user-visible main-vs-nap shape used by the sleep surfaces: only the canonical overnight
+     * group can be MAIN, it must total at least three hours, and every other/twinless-explicit block is NAP.
+     */
+    fun classifyForCycle(
+        blocks: List<SleepBlock>,
+        tzOffsetSeconds: Long,
+        habitualMidsleepSec: Long?,
+    ): List<SleepBlock> {
+        if (blocks.isEmpty()) return emptyList()
+        val explicitMain = blocks.indices.filter { blocks[it].kind == SleepKind.MAIN_SLEEP }
+        val selectable = blocks.indices.filter { blocks[it].kind != SleepKind.NAP }
+        val selectedOriginalIndices = if (explicitMain.isNotEmpty()) {
+            explicitMain
+        } else {
+            val selectableNightBlocks = selectable.map {
+                val b = blocks[it]
+                SleepStageTotals.NightBlock(b.effectiveOnset, b.end)
+            }
+            // Eliminate nap-shaped GROUPS before choosing a winner. Otherwise a six-hour afternoon nap can
+            // win the generic duration scorer, fail the daytime guard, and hide a valid shorter night.
+            val eligible = SleepStageTotals.bridgedNightGroups(selectableNightBlocks, tzOffsetSeconds)
+                .filter { group ->
+                    val total = group.indices.sumOf { i -> selectableNightBlocks[i].durationS.coerceAtLeast(0L) }
+                    val onset = group.indices.minOfOrNull { selectableNightBlocks[it].start }
+                    total >= MIN_MAIN_SLEEP_SECONDS && onset != null &&
+                        SleepStageTotals.isOvernightOnset(onset, tzOffsetSeconds)
+                }
+                .flatMap { it.indices }
+                .distinct()
+            SleepStageTotals.mainNightGroupIndices(
+                eligible.map { selectableIndex ->
+                    val original = selectable[selectableIndex]
+                    val b = blocks[original]
+                    SleepStageTotals.NightBlock(b.effectiveOnset, b.end)
+                },
+                tzOffsetSeconds,
+                habitualMidsleepSec,
+            ).orEmpty().map { selectedIndex ->
+                selectable[eligible[selectedIndex]]
+            }
+        }.toHashSet()
+        return blocks.mapIndexed { index, block ->
+            block.copy(kind = if (index in selectedOriginalIndices) SleepKind.MAIN_SLEEP else SleepKind.NAP)
+        }
+    }
+
+    /** Use the exact same main-night/group selector as the Sleep screen and daily sleep aggregate. */
+    fun mainSleepOnset(
+        blocks: List<SleepBlock>,
+        tzOffsetSeconds: Long,
+        habitualMidsleepSec: Long?,
+    ): Long? {
+        val eligible = classifyForCycle(blocks, tzOffsetSeconds, habitualMidsleepSec)
+            .filter { it.kind == SleepKind.MAIN_SLEEP }
+        val indices = SleepStageTotals.mainNightGroupIndices(
+            eligible.map { SleepStageTotals.NightBlock(it.effectiveOnset, it.end) },
+            tzOffsetSeconds,
+            habitualMidsleepSec,
+        ) ?: return null
+        return indices.minOfOrNull { eligible[it].effectiveOnset }
+    }
+
+    /**
+     * Build historical sleep-to-sleep windows without inventing rows at midnight. The final observed
+     * boundary alone owns the open tail to [now], including days on which no new sleep was detected.
+     */
+    fun cycleWindows(boundaries: List<CycleBoundary>, now: Long): List<CycleWindow> {
+        val ordered = boundaries.asSequence()
+            .filter { it.onset <= now }
+            .distinctBy { it.sleepId }
+            .sortedBy { it.onset }
+            .toList()
+        return ordered.mapIndexedNotNull { index, boundary ->
+            val end = ordered.getOrNull(index + 1)?.onset ?: now
+            if (end <= boundary.onset) null else CycleWindow(boundary.sleepId, boundary.onset, end)
+        }
+    }
+
+    /** Split at local midnights and merge adjacent same-owner slices; counters never cross device seams. */
+    fun ownerSegments(
+        window: CycleWindow,
+        ownerByDay: Map<String, String>,
+        tzOffsetSeconds: Long,
+        fallbackOwner: String,
+    ): List<OwnerSegment> {
+        if (window.endExclusive <= window.onset) return emptyList()
+        val out = ArrayList<OwnerSegment>()
+        var cursor = window.onset
+        var lastOwner = fallbackOwner
+        while (cursor < window.endExclusive) {
+            val day = AnalyticsEngine.dayString(cursor, tzOffsetSeconds)
+            val local = cursor + tzOffsetSeconds
+            val dayNumber = Math.floorDiv(local, SleepStageTotals.SECONDS_PER_DAY)
+            val dayStart = dayNumber * SleepStageTotals.SECONDS_PER_DAY - tzOffsetSeconds
+            // The sleep-owner owns the partial onset day. Calendar owner changes take effect only at a
+            // midnight seam, never retroactively before the boundary sleep began.
+            val owner = if (cursor == window.onset && cursor > dayStart) {
+                fallbackOwner
+            } else {
+                ownerByDay[day] ?: lastOwner
+            }
+            val nextMidnight = (dayNumber + 1) * SleepStageTotals.SECONDS_PER_DAY - tzOffsetSeconds
+            val end = minOf(window.endExclusive, nextMidnight)
+            val previous = out.lastOrNull()
+            if (previous != null && previous.owner == owner && previous.endExclusive == cursor) {
+                out[out.lastIndex] = previous.copy(endExclusive = end)
+            } else {
+                out += OwnerSegment(owner, cursor, end)
+            }
+            lastOwner = owner
+            cursor = end
+        }
+        return out
+    }
+
+    /**
+     * Timestamp coverage wins at every seam; priority resolves overlap, so two worn straps never add.
+     * Each coverage is a continuous first..last ownership span by design: an internal sample/radio gap
+     * creates no seam and therefore cannot hand the interval to a lower-priority concurrently worn strap.
+     */
+    fun ownerSegmentsFromCoverage(
+        window: CycleWindow,
+        coverage: List<OwnerCoverage>,
+        fallbackOwner: String,
+    ): List<OwnerSegment> {
+        if (window.endExclusive <= window.onset) return emptyList()
+        val clipped = coverage.mapNotNull {
+            val start = maxOf(window.onset, it.onset)
+            val end = minOf(window.endExclusive, it.endExclusive)
+            if (end <= start) null else it.copy(onset = start, endExclusive = end)
+        }
+        val seams = buildSet {
+            add(window.onset)
+            add(window.endExclusive)
+            clipped.forEach { add(it.onset); add(it.endExclusive) }
+        }.sorted()
+        val out = ArrayList<OwnerSegment>()
+        var lastOwner = fallbackOwner
+        for (i in 0 until seams.lastIndex) {
+            val start = seams[i]
+            val end = seams[i + 1]
+            val owner = clipped.asSequence()
+                .filter { start >= it.onset && start < it.endExclusive }
+                .minWithOrNull(compareBy<OwnerCoverage> { it.priority }.thenBy { it.owner })
+                ?.owner ?: lastOwner
+            val previous = out.lastOrNull()
+            if (previous != null && previous.owner == owner && previous.endExclusive == start) {
+                out[out.lastIndex] = previous.copy(endExclusive = end)
+            } else {
+                out += OwnerSegment(owner, start, end)
+            }
+            lastOwner = owner
+        }
+        return out
+    }
+
+    /** Resolve the next observed onset, or [now] for the currently open physiological cycle. */
+    fun cycleEnd(day: String, onsetByDay: Map<String, Long>, now: Long): Long {
+        val onset = onsetByDay[day] ?: return now
+        return onsetByDay.values.asSequence()
+            .filter { it > onset && it <= now }
+            .minOrNull()
+            ?: now
+    }
+
+}
diff --git a/android/app/src/main/java/com/noop/analytics/RegistryDayOwnerSource.kt b/android/app/src/main/java/com/noop/analytics/RegistryDayOwnerSource.kt
index 423f273e9e..47ba59f82e 100644
--- a/android/app/src/main/java/com/noop/analytics/RegistryDayOwnerSource.kt
+++ b/android/app/src/main/java/com/noop/analytics/RegistryDayOwnerSource.kt
@@ -10,18 +10,17 @@ import com.noop.protocol.DeviceFamily
  * with the per-day owner-resolution inputs so a day is scored from exactly ONE device (invariant I2),
  * without giving the pure-JVM engine a Room dependency.
  *
- * Priorities mirror the Swift IntelligenceEngine.resolveDayOwner exactly:
- *   0 = the active strap, 1 = other live (BLE/historyBLE) straps, 2 = imports (cloud/file). Lower wins.
- * Archived devices are excluded. With only the seeded active 'my-whoop' row paired (the default and
- * every single-WHOOP install), the sole candidate is priority 0, so the engine resolves to "my-whoop"
- * for every day and the reads stay byte-identical to the single-source path.
+ * Priorities mirror the Swift IntelligenceEngine.resolveDayOwner for current sources, with priority 4
+ * reserved for archived devices. Archived rows remain read-only historical candidates so removing and
+ * later re-adding a strap cannot erase its earlier physiological boundary/coverage; every current live,
+ * import, and activity source still wins an overlap. With only the seeded active 'my-whoop' row paired
+ * (the default and every single-WHOOP install), the sole candidate is priority 0, so reads stay identical.
  */
 class RegistryDayOwnerSource(private val registry: DeviceRegistry) : IntelligenceEngine.DayOwnerSource {
 
     override suspend fun candidatePriorities(): List<Pair<String, Int>> {
         val activeId = registry.activeDeviceId()
         return registry.all()
-            .filter { it.status != DeviceStatus.archived.name }
             .map { d ->
                 val isImport = d.sourceKind == SourceKind.cloudImport.name ||
                     d.sourceKind == SourceKind.fileImport.name
@@ -30,6 +29,7 @@ class RegistryDayOwnerSource(private val registry: DeviceRegistry) : Intelligenc
                 // wins a day nothing else covers. Mirrors Swift IntelligenceEngine.resolveDayOwner.
                 val priority = when {
                     d.id == activeId -> 0
+                    d.status == DeviceStatus.archived.name -> 4
                     d.sourceKind == SourceKind.activityFile.name -> 3
                     isImport -> 2
                     else -> 1
diff --git a/android/app/src/main/java/com/noop/analytics/SleepAwareStepCounter.kt b/android/app/src/main/java/com/noop/analytics/SleepAwareStepCounter.kt
new file mode 100644
index 0000000000..d71373b8f2
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/SleepAwareStepCounter.kt
@@ -0,0 +1,211 @@
+package com.noop.analytics
+
+import com.noop.data.GravitySample
+import com.noop.data.StepSample
+import com.noop.data.V18AuxRow
+
+/**
+ * Sleep-context wrapper around [StepsCounter]. It keeps the incumbent counter/class/rate rules, but does
+ * not accept an isolated strap "walk" tick as proof that a sleeping person walked. Inside a scored sleep
+ * stage, valid locomotion deltas must form a short, temporally coherent bout. An explicitly scored wake
+ * gap is intentionally treated like ordinary awake time, so getting up for a child or the toilet counts.
+ *
+ * This kernel returns raw counter ticks exactly as [StepsCounter] does. It deliberately applies neither a
+ * learned conversion factor nor a fixed wrist orientation: a strap may be worn on either arm, a limb or
+ * clothing. Gravity/dynamic-acceleration and v18 auxiliary data are accepted for observability and future
+ * shadow validation, but are not yet trusted as production gates. When either stream is absent, the
+ * conservative temporal bout rule remains deterministic and fail-safe.
+ */
+object SleepAwareStepCounter {
+    /** A one- or two-second bed movement cannot satisfy all three bout floors. */
+    const val MAX_SECONDS_BETWEEN_GAIT_DELTAS: Long = 3L
+    const val MIN_GAIT_BOUT_DURATION_SECONDS: Long = 4L
+    const val MIN_GAIT_BOUT_ACTIVE_SAMPLES: Int = 5
+    const val MIN_GAIT_BOUT_TICKS: Int = 6
+
+    data class Count(
+        val totalTicks: Int,
+        val acceptedOutsideSleepTicks: Int,
+        val acceptedAwakeGapTicks: Int,
+        val acceptedSleepBoutTicks: Int,
+        val rejectedIsolatedSleepTicks: Int,
+        val rejectedActivityClassTicks: Int,
+        val rejectedImplausibleTicks: Int,
+        /** Availability only; neither raw stream changes the production decision yet. */
+        val gravitySamplesAvailable: Int,
+        val auxSamplesAvailable: Int,
+    ) {
+        operator fun plus(other: Count): Count = Count(
+            totalTicks + other.totalTicks,
+            acceptedOutsideSleepTicks + other.acceptedOutsideSleepTicks,
+            acceptedAwakeGapTicks + other.acceptedAwakeGapTicks,
+            acceptedSleepBoutTicks + other.acceptedSleepBoutTicks,
+            rejectedIsolatedSleepTicks + other.rejectedIsolatedSleepTicks,
+            rejectedActivityClassTicks + other.rejectedActivityClassTicks,
+            rejectedImplausibleTicks + other.rejectedImplausibleTicks,
+            gravitySamplesAvailable + other.gravitySamplesAvailable,
+            auxSamplesAvailable + other.auxSamplesAvailable,
+        )
+
+        companion object {
+            val EMPTY = Count(0, 0, 0, 0, 0, 0, 0, 0, 0)
+        }
+    }
+
+    /** Preserve scored stages while edited leading/trailing edges remain conservatively inside sleep. */
+    fun withBounds(session: DetectedSleep, start: Long, end: Long): DetectedSleep =
+        session.copy(start = start, end = end)
+
+    /** Effective bounds + stage content affecting exactly this cycle; unrelated sleep edits stay out. */
+    fun contextSignature(sessions: List<DetectedSleep>, onset: Long, endExclusive: Long): String =
+        sessions.asSequence()
+            .filter { it.end > onset && it.start < endExclusive }
+            .sortedWith(compareBy<DetectedSleep> { it.start }.thenBy { it.end })
+            .joinToString("|") { session ->
+                buildString {
+                    append(session.start).append('-').append(session.end)
+                    for (stage in session.stages.sortedBy { it.start }) {
+                        append(':').append(stage.start).append('-').append(stage.end).append('=').append(stage.stage)
+                    }
+                }
+            }
+
+    /** Same nullable convention as [StepsCounter.stepsInWindow]: no accepted movement is `null`. */
+    fun stepsInWindow(
+        samples: List<StepSample>,
+        sleepSessions: List<DetectedSleep>,
+        gravity: List<GravitySample> = emptyList(),
+        aux: List<V18AuxRow> = emptyList(),
+    ): Int? = count(samples, sleepSessions, gravity, aux).totalTicks.takeIf { it > 0 }
+
+    /** Detailed form intended for the Test Centre/shadow trace. */
+    fun count(
+        samples: List<StepSample>,
+        sleepSessions: List<DetectedSleep>,
+        gravity: List<GravitySample> = emptyList(),
+        aux: List<V18AuxRow> = emptyList(),
+    ): Count {
+        val sorted = samples.sortedBy { it.ts }
+        return Accumulator(sleepSessions, StepsCounter.hasActivityClasses(sorted))
+            .observeMotionPage(gravity, aux)
+            .acceptPage(sorted)
+            .finish()
+    }
+
+    /**
+     * Page-safe form for database windows larger than an in-memory query limit. The caller determines
+     * [hasActivityClasses] once for the complete window (for example with an EXISTS query) and keeps one
+     * accumulator for every ascending page. The previous counter sample and an unfinished in-sleep gait
+     * bout survive page boundaries, so paging cannot change the answer.
+     *
+     * Pages may overlap at their boundary: timestamps already consumed are ignored. Calling [finish]
+     * closes the last gait bout and makes the accumulator immutable.
+     */
+    class Accumulator(
+        sleepSessions: List<DetectedSleep>,
+        private val hasActivityClasses: Boolean,
+    ) {
+        private val sessions = sleepSessions.sortedBy { it.start }
+        private var previous: StepSample? = null
+        private var outside = 0
+        private var awakeGap = 0
+        private var sleepBout = 0
+        private var rejectedSleep = 0
+        private var rejectedClass = 0
+        private var rejectedImplausible = 0
+        private var gravityAvailable = 0
+        private var auxAvailable = 0
+        private var finished = false
+        private val pendingSleepBout = ArrayList<Delta>()
+
+        fun observeMotionPage(
+            gravity: List<GravitySample> = emptyList(),
+            aux: List<V18AuxRow> = emptyList(),
+        ): Accumulator = apply {
+            check(!finished) { "Accumulator is already finished" }
+            gravityAvailable += gravity.size
+            auxAvailable += aux.size
+        }
+
+        fun acceptPage(samples: List<StepSample>): Accumulator = apply {
+            check(!finished) { "Accumulator is already finished" }
+            for (current in samples.sortedBy { it.ts }) {
+                val prior = previous
+                if (prior != null && current.ts <= prior.ts) continue
+                previous = current
+                if (prior == null) continue
+
+                val delta = (current.counter - prior.counter) and 0xFFFF
+                if (!StepsCounter.shouldCountDelta(current.activityClass, hasActivityClasses)) {
+                    rejectedClass += delta
+                    continue
+                }
+                if (!StepsCounter.isPlausibleDelta(prior.ts, current.ts, delta)) {
+                    rejectedImplausible += delta
+                    continue
+                }
+
+                when (contextAt(current.ts, sessions)) {
+                    Context.OUTSIDE_SLEEP -> {
+                        flushSleepBout()
+                        outside += delta
+                    }
+                    Context.AWAKE_GAP -> {
+                        flushSleepBout()
+                        awakeGap += delta
+                    }
+                    Context.SCORED_SLEEP -> {
+                        val last = pendingSleepBout.lastOrNull()
+                        if (last != null && current.ts - last.ts > MAX_SECONDS_BETWEEN_GAIT_DELTAS) {
+                            flushSleepBout()
+                        }
+                        pendingSleepBout += Delta(current.ts, delta)
+                    }
+                }
+            }
+        }
+
+        fun finish(): Count {
+            if (!finished) {
+                flushSleepBout()
+                finished = true
+            }
+            return Count(
+                totalTicks = outside + awakeGap + sleepBout,
+                acceptedOutsideSleepTicks = outside,
+                acceptedAwakeGapTicks = awakeGap,
+                acceptedSleepBoutTicks = sleepBout,
+                rejectedIsolatedSleepTicks = rejectedSleep,
+                rejectedActivityClassTicks = rejectedClass,
+                rejectedImplausibleTicks = rejectedImplausible,
+                gravitySamplesAvailable = gravityAvailable,
+                auxSamplesAvailable = auxAvailable,
+            )
+        }
+
+        private fun flushSleepBout() {
+            if (pendingSleepBout.isEmpty()) return
+            val ticks = pendingSleepBout.sumOf { it.ticks }
+            val duration = pendingSleepBout.last().ts - pendingSleepBout.first().ts
+            val coherent = pendingSleepBout.size >= MIN_GAIT_BOUT_ACTIVE_SAMPLES &&
+                duration >= MIN_GAIT_BOUT_DURATION_SECONDS &&
+                ticks >= MIN_GAIT_BOUT_TICKS
+            if (coherent) sleepBout += ticks else rejectedSleep += ticks
+            pendingSleepBout.clear()
+        }
+    }
+
+    private data class Delta(val ts: Long, val ticks: Int)
+    private enum class Context { OUTSIDE_SLEEP, AWAKE_GAP, SCORED_SLEEP }
+
+    private fun contextAt(ts: Long, sessions: List<DetectedSleep>): Context {
+        val session = sessions.firstOrNull { ts >= it.start && ts < it.end } ?: return Context.OUTSIDE_SLEEP
+        val stage = session.stages.firstOrNull { ts >= it.start && ts < it.end }
+        return if (stage != null && SleepStageVocabulary.isWake(stage.stage)) {
+            Context.AWAKE_GAP
+        } else {
+            // Missing/gapped staging is not evidence of wakefulness. This is intentionally conservative.
+            Context.SCORED_SLEEP
+        }
+    }
+}
diff --git a/android/app/src/main/java/com/noop/analytics/StepsCounter.kt b/android/app/src/main/java/com/noop/analytics/StepsCounter.kt
index 401284d3a8..3261b7988d 100644
--- a/android/app/src/main/java/com/noop/analytics/StepsCounter.kt
+++ b/android/app/src/main/java/com/noop/analytics/StepsCounter.kt
@@ -6,38 +6,59 @@ import com.noop.data.StepSample
  * Wrap-aware step derivation from the strap's cumulative `step_motion_counter@57`, shared by the daily
  * total ([AnalyticsEngine.analyzeDay]) and any windowed total (a manual workout's `[start, end]`, #398).
  *
- * `step_motion_counter@57` is a CUMULATIVE u16 running counter: it climbs while you move, holds flat when
- * still, and wraps at 65536. The motion-tick total over a set of records is the SUM of WRAP-AWARE
- * increments of that counter — `delta = (cur - prev) and 0xFFFF` — with a per-user `stepTicksPerStep`
- * calibration applied by the caller AFTERWARDS (this returns the raw pre-calibration tick total, so the two
- * callers can never disagree on the counter math). The raw total is an ESTIMATE (@57 counts motion ticks,
- * not validated steps), not cloud/clinical parity.
+ * `step_motion_counter@57` is a CUMULATIVE u16 motion counter: it climbs for both locomotion and some
+ * non-step wrist motion, and wraps at 65536. On classed WHOOP 5/MG records, the increment ending at each
+ * sample is counted only when the strap labels that sample walk (1) or run (2); still (0) and unknown are
+ * rejected. A wholly unclassed legacy window retains the old counter-only estimate so pre-migration history
+ * remains readable. The caller applies its per-user `stepTicksPerStep` calibration afterwards. The result is
+ * still an estimate, not cloud/clinical parity.
  *
  * Byte-for-byte twin of the Swift `StepsCounter.stepsInWindow`.
  */
 object StepsCounter {
-    /**
-     * The largest wrap-aware increment treated as real motion between two adjacent 1 Hz records. A delta
-     * at/above this is a big time-gap / disconnect boundary between sync sessions (or a firmware reboot,
-     * byte-indistinguishable from a u16 wrap), NOT real steps — dropped so gaps don't inflate the total.
-     * Real 1 Hz motion never ticks this fast between adjacent records. (#132/#276/#316)
-     */
+    private val LOCOMOTION_ACTIVITY_CLASSES = setOf(1, 2)
+
+    internal fun hasActivityClasses(samples: List<StepSample>): Boolean =
+        samples.any { it.activityClass != null }
+
+    internal fun shouldCountDelta(activityClass: Int?, hasActivityClasses: Boolean): Boolean =
+        !hasActivityClasses || activityClass in LOCOMOTION_ACTIVITY_CLASSES
+
+    /** Absolute reboot/wrap guard retained independently from the rate plausibility gate below. */
     const val MAX_STEP_DELTA = 512
 
+    /** Four ticks/second is already 240 steps/minute. A larger one-second increment is wrist motion,
+     * corruption or delayed counter publication, not plausible gait. The allowance scales with the real
+     * timestamp gap so seven ticks across two seconds survive a missing 1 Hz record. */
+    const val MAX_TICKS_PER_SECOND = 4
+
+    internal fun isPlausibleDelta(previousTs: Long, currentTs: Long, delta: Int): Boolean {
+        if (delta !in 1 until MAX_STEP_DELTA) return false
+        val elapsed = currentTs - previousTs
+        if (elapsed <= 0L) return false
+        val rateAllowance = if (elapsed >= MAX_STEP_DELTA / MAX_TICKS_PER_SECOND) {
+            MAX_STEP_DELTA - 1L
+        } else {
+            elapsed * MAX_TICKS_PER_SECOND
+        }
+        return delta.toLong() <= rateAllowance
+    }
+
     /**
-     * Raw wrap-aware motion-tick total across [samples] — the sum of positive consecutive
-     * `step_motion_counter@57` increments in `[1, MAX_STEP_DELTA)`. Sorts by `ts` internally, so the caller
-     * may pass an unsorted window (already filtered to the range it cares about). Returns `null` when there
-     * are fewer than two samples or no forward movement (so "no data" stays distinct from a real zero). The
-     * caller applies its `stepTicksPerStep` calibration to the returned ticks.
+     * Raw wrap-aware locomotion-tick total across [samples]. When any sample carries [StepSample.activityClass],
+     * each positive increment is attributed to the later sample and retained only for walk/run. When the
+     * whole window is legacy-unclassed, all valid increments retain the historical counter-only fallback.
+     * Sorts by `ts` internally and returns `null` for fewer than two samples or no retained movement.
      */
     fun stepsInWindow(samples: List<StepSample>): Int? {
         val sorted = samples.sortedBy { it.ts }
         if (sorted.size < 2) return null
+        val hasActivityClasses = hasActivityClasses(sorted)
         var total = 0
         for (i in 1 until sorted.size) {
             val delta = (sorted[i].counter - sorted[i - 1].counter) and 0xFFFF // wrap-aware u16 increment
-            if (delta in 1 until MAX_STEP_DELTA) total += delta // ignore a delta >= 512 (gap/reset)
+            val isLocomotion = shouldCountDelta(sorted[i].activityClass, hasActivityClasses)
+            if (isLocomotion && isPlausibleDelta(sorted[i - 1].ts, sorted[i].ts, delta)) total += delta
         }
         return if (total > 0) total else null
     }
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 15396c5874..9504e668de 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -3027,6 +3027,7 @@ class WhoopBleClient(
                         // persists the nightly @82 mean as "spo2_candidate" in metricSeries.
                         spo2CandidateDisplay = NoopPrefs.spo2CandidateDisplay(context),
                         effortMethod = NoopPrefs.effortMethod(context),
+                        dayCycleMode = NoopPrefs.dayCycleMode(context),
                     )
                 }.onSuccess {
                     // Advance the shared watermark so the next 15-min tick sees no change and skips (#836).
diff --git a/android/app/src/main/java/com/noop/data/BackupSettings.kt b/android/app/src/main/java/com/noop/data/BackupSettings.kt
index c7972cc7bd..6b8cc373ef 100644
--- a/android/app/src/main/java/com/noop/data/BackupSettings.kt
+++ b/android/app/src/main/java/com/noop/data/BackupSettings.kt
@@ -57,6 +57,7 @@ object BackupSettingsCodec {
         "units.temperature" to Kind.STRING,
         "units.skinTempDisplay" to Kind.STRING,   // #1846, carried like the other display units
         "effort.scale" to Kind.STRING,
+        "dayCycle.mode" to Kind.STRING,
         // The ONE layout pref carried (#today-hosted-cards): the Trends/Sleep cards the user chose to host
         // in Today, a JSON [String] of ids. Unlike section order, this is a deliberate composition the user
         // built and expects across a restore. Its POSITION (the addedCards slot in today.sectionOrder) is
@@ -154,6 +155,9 @@ object BackupSettingsBridge {
         if (noop.contains(UnitPrefs.KEY_EFFORT_SCALE)) {
             noop.getString(UnitPrefs.KEY_EFFORT_SCALE, null)?.let { values["effort.scale"] = it }
         }
+        if (noop.contains(NoopPrefs.KEY_DAY_CYCLE_MODE)) {
+            noop.getString(NoopPrefs.KEY_DAY_CYCLE_MODE, null)?.let { values["dayCycle.mode"] = it }
+        }
         if (noop.contains(HostedCardPrefs.KEY_SELECTION)) {
             noop.getString(HostedCardPrefs.KEY_SELECTION, null)?.let { values[HostedCardPrefs.KEY_SELECTION] = it }
         }
@@ -198,6 +202,7 @@ object BackupSettingsBridge {
             else editor.putString(NoopPrefs.KEY_SKIN_TEMP_DISPLAY, raw)
         }
         (values["effort.scale"] as? String)?.let { editor.putString(UnitPrefs.KEY_EFFORT_SCALE, it) }
+        (values["dayCycle.mode"] as? String)?.let { editor.putString(NoopPrefs.KEY_DAY_CYCLE_MODE, it) }
         (values[HostedCardPrefs.KEY_SELECTION] as? String)?.let { editor.putString(HostedCardPrefs.KEY_SELECTION, it) }
         // #1361: restore custom behaviours — write the names to the legacy custom key, clear stale hidden,
         // and drop the v2 blob so the next catalog load re-migrates them (restart-gated, #57). Mirrors iOS.
diff --git a/android/app/src/main/java/com/noop/data/WhoopDao.kt b/android/app/src/main/java/com/noop/data/WhoopDao.kt
index f0aaa38755..4b93ebcbe2 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDao.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDao.kt
@@ -262,6 +262,12 @@ interface WhoopDao : DeviceRegistryDao {
         if (provenance.isNotEmpty()) upsertScoreInputProvenance(provenance)
     }
 
+    @Query(
+        "DELETE FROM metricSeries WHERE deviceId = :deviceId AND day >= :from AND day <= :to " +
+            "AND `key` = :key"
+    )
+    suspend fun deleteMetricSeriesKeyInRange(deviceId: String, from: String, to: String, key: String)
+
     /**
      * Replace a computed scoring window atomically. If any score or provenance write fails, Room rolls
      * the whole transaction back, so an old score can never be labelled with a newer provider. VO₂max's
@@ -276,6 +282,8 @@ interface WhoopDao : DeviceRegistryDao {
         dailyMetrics: List<DailyMetric>,
         metricPoints: List<MetricSeriesRow>,
         provenance: List<ScoreInputProvenanceRow>,
+        replaceMetricKeys: List<String> = emptyList(),
+        replaceMetricSourceIds: List<String> = listOf(deviceId),
     ) {
         // #1196: a scoring pass that produced NO computed daily rows must NOT wipe the persisted window.
         // That happens transiently during a reconnect+offload storm (a pass runs over a still-incomplete
@@ -288,6 +296,9 @@ interface WhoopDao : DeviceRegistryDao {
         if (dailyMetrics.isEmpty()) return
         deleteDailyMetricsInRange(deviceId, from, to)
         deleteScoreInputProvenanceInRange(deviceId, from, to)
+        for (sourceId in replaceMetricSourceIds) {
+            for (key in replaceMetricKeys) deleteMetricSeriesKeyInRange(sourceId, from, to, key)
+        }
         upsertDailyMetrics(dailyMetrics)
         if (metricPoints.isNotEmpty()) upsertMetricSeries(metricPoints)
         if (provenance.isNotEmpty()) upsertScoreInputProvenance(provenance)
@@ -493,6 +504,54 @@ interface WhoopDao : DeviceRegistryDao {
     )
     suspend fun stepSamples(deviceId: String, from: Long, to: Long, limit: Int): List<StepSample>
 
+    /** One predecessor for a half-open physiological-cycle scan. Device-scoped by construction. */
+    @Query(
+        "SELECT * FROM stepSample WHERE deviceId = :deviceId AND ts < :onset " +
+            "ORDER BY ts DESC LIMIT 1"
+    )
+    suspend fun stepSampleBefore(deviceId: String, onset: Long): StepSample?
+
+    /** Stable activity-class mode for the complete cycle; it must never be re-decided per page. */
+    @Query(
+        "SELECT EXISTS(SELECT 1 FROM stepSample WHERE deviceId = :deviceId " +
+            "AND ts >= :onset AND ts < :endExclusive AND activityClass IS NOT NULL LIMIT 1)"
+    )
+    suspend fun hasStepActivityClasses(deviceId: String, onset: Long, endExclusive: Long): Boolean
+
+    /** PK-index seek: never aggregate-scan the whole cycle merely to find its first sample. */
+    @Query(
+        "SELECT ts FROM stepSample WHERE deviceId = :deviceId " +
+            "AND ts >= :onset AND ts < :endExclusive ORDER BY ts ASC LIMIT 1"
+    )
+    suspend fun firstStepTimestamp(
+        deviceId: String,
+        onset: Long,
+        endExclusive: Long,
+    ): Long?
+
+    /** PK-index seek paired with [firstStepTimestamp]; warm candidate coverage stays O(log n). */
+    @Query(
+        "SELECT ts FROM stepSample WHERE deviceId = :deviceId " +
+            "AND ts >= :onset AND ts < :endExclusive ORDER BY ts DESC LIMIT 1"
+    )
+    suspend fun lastStepTimestamp(
+        deviceId: String,
+        onset: Long,
+        endExclusive: Long,
+    ): Long?
+
+    /** Keyset page for [afterExclusive, endExclusive); avoids both OFFSET and the legacy 200k cap. */
+    @Query(
+        "SELECT * FROM stepSample WHERE deviceId = :deviceId AND ts > :afterExclusive " +
+            "AND ts < :endExclusive ORDER BY ts ASC LIMIT :limit"
+    )
+    suspend fun stepSamplesPage(
+        deviceId: String,
+        afterExclusive: Long,
+        endExclusive: Long,
+        limit: Int,
+    ): List<StepSample>
+
     /** The strap's OWN banked band sleep_state (#175) in [from, to], ascending. Feeds the Deep Timeline
      *  band-state track and the per-session grid the H7 re-onset confirm guard reads. */
     @Query(
@@ -584,6 +643,12 @@ interface WhoopDao : DeviceRegistryDao {
     )
     suspend fun dailyMetricsRange(deviceId: String, from: String, to: String): List<DailyMetric>
 
+    @Query(
+        "SELECT * FROM dailyMetric WHERE deviceId = :deviceId AND day >= :from AND day <= :to " +
+            "ORDER BY day ASC"
+    )
+    fun dailyMetricsRangeFlow(deviceId: String, from: String, to: String): Flow<List<DailyMetric>>
+
     /**
      * Delete a source's cached daily rows whose day-key is in [from, to] (inclusive, yyyy-MM-dd
      * lexicographic = chronological). The #277 local-day re-bucketing migration uses this to drop the
@@ -690,6 +755,17 @@ interface WhoopDao : DeviceRegistryDao {
         to: String,
     ): List<MetricSeriesRow>
 
+    @Query(
+        "SELECT * FROM metricSeries WHERE deviceId = :deviceId AND key = :key AND day >= :from AND day <= :to " +
+            "ORDER BY day ASC"
+    )
+    fun metricSeriesFlow(
+        deviceId: String,
+        key: String,
+        from: String,
+        to: String,
+    ): Flow<List<MetricSeriesRow>>
+
     /** Distinct metric keys present for a device, sorted ascending (Swift metricKeys, v9). */
     @Query("SELECT DISTINCT key FROM metricSeries WHERE deviceId = :deviceId ORDER BY key ASC")
     suspend fun metricKeys(deviceId: String): List<String>
diff --git a/android/app/src/main/java/com/noop/data/WhoopRepository.kt b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
index e968eef4e1..f7e4d299ba 100644
--- a/android/app/src/main/java/com/noop/data/WhoopRepository.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
@@ -317,11 +317,17 @@ data class InsertCounts(
     val gravity: Int = 0,
 )
 
+data class StepTimestampCoverage(val firstTs: Long?, val lastTs: Long?)
+
+internal fun newlyInsertedStepTimestamps(timestamps: List<Long>, rowIds: List<Long>): List<Long> =
+    timestamps.zip(rowIds).mapNotNull { (ts, id) -> ts.takeIf { id != -1L } }
+
 /** Monotonic event revisions for Test Centre repository-backed readouts. Counts move only after Room
  * reports at least one newly inserted relevant row; duplicate/no-op inserts leave them unchanged. */
 internal data class ReadoutDataRevisions(
     val sleepSamples: Long = 0,
     val battery: Long = 0,
+    val steps: Long = 0,
 )
 
 internal fun advanceReadoutDataRevisions(
@@ -330,8 +336,35 @@ internal fun advanceReadoutDataRevisions(
 ): ReadoutDataRevisions = current.copy(
     sleepSamples = current.sleepSamples + if (inserted.hr > 0 || inserted.gravity > 0) 1 else 0,
     battery = current.battery + if (inserted.battery > 0) 1 else 0,
+    steps = current.steps + if (inserted.steps > 0) 1 else 0,
 )
 
+/** Process-local because the cycle cache is process-local too; keyed by device and UTC day. */
+internal class StepDataRevisionIndex {
+    private val utcDaySeconds = 86_400L
+    private var nextRevision = 0L
+    private val byOwnerDay = HashMap<Pair<String, Long>, Long>()
+
+    @Synchronized
+    fun record(deviceId: String, stepTimestamps: List<Long>, insertedRows: Int) {
+        if (insertedRows <= 0) return
+        nextRevision++
+        for (ts in stepTimestamps) {
+            byOwnerDay[deviceId to Math.floorDiv(ts, utcDaySeconds)] = nextRevision
+        }
+    }
+
+    @Synchronized
+    fun signature(deviceId: String, onset: Long, endExclusive: Long): String {
+        if (endExclusive <= onset) return ""
+        val first = Math.floorDiv(onset, utcDaySeconds)
+        val last = Math.floorDiv(endExclusive - 1L, utcDaySeconds)
+        return (first..last).joinToString(",") { day ->
+            "$day:${byOwnerDay[deviceId to day] ?: 0L}"
+        }
+    }
+}
+
 /**
  * A compact snapshot of how much history each source holds, for the Data Sources "Freshness
  * Pipeline" card (PR#196). Counts only , no per-day rows leave the read. Port of macOS
@@ -408,6 +441,7 @@ class WhoopRepository(
     val batteryRevision: StateFlow<Long> = _batteryRevision.asStateFlow()
     private val readoutRevisionLock = Any()
     private var readoutRevisions = ReadoutDataRevisions()
+    private val stepRevisionIndex = StepDataRevisionIndex()
 
     constructor(db: WhoopDatabase) : this(
         dao = db.whoopDao(),
@@ -467,7 +501,7 @@ class WhoopRepository(
     ): InsertCounts {
         if (streams.isEmpty) return InsertCounts()
 
-        val counts = transactor.run {
+        val result = transactor.run {
             insertWithinTransaction(
                 streams = streams,
                 deviceId = deviceId,
@@ -475,7 +509,9 @@ class WhoopRepository(
                 v18AuxPruneEveryRows = v18AuxPruneEveryRows,
             )
         }
+        val counts = result.counts
         publishReadoutRevisions(counts)
+        stepRevisionIndex.record(deviceId, result.insertedStepTimestamps, counts.steps)
         return counts
     }
 
@@ -488,13 +524,22 @@ class WhoopRepository(
         }
     }
 
+    /** Bounded process-local cache witness; duplicate rows do not advance because InsertCounts is zero. */
+    fun stepDataRevisionSignature(deviceId: String, onset: Long, endExclusive: Long): String =
+        stepRevisionIndex.signature(deviceId, onset, endExclusive)
+
     /** All DAO writes for one decoded chunk share the Room transaction opened by [insert]. */
+    private data class InsertResult(
+        val counts: InsertCounts,
+        val insertedStepTimestamps: List<Long>,
+    )
+
     private suspend fun insertWithinTransaction(
         streams: StreamBatch,
         deviceId: String,
         v18AuxRetentionRows: Int,
         v18AuxPruneEveryRows: Int,
-    ): InsertCounts {
+    ): InsertResult {
         val hrIds = if (streams.hr.isEmpty()) emptyList() else
             dao.insertHr(streams.hr.map { HrSample(deviceId, it.ts, it.bpm) })
         val rrIds = if (streams.rr.isEmpty()) emptyList() else
@@ -584,7 +629,7 @@ class WhoopRepository(
         }
 
         // OnConflictStrategy.IGNORE returns -1 for skipped (already-present) rows; count the inserts.
-        return InsertCounts(
+        val counts = InsertCounts(
             hr = hrIds.countInserted() + ppgHrIds.countInserted(),
             rr = rrIds.countInserted(),
             events = evIds.countInserted(),
@@ -595,6 +640,10 @@ class WhoopRepository(
             resp = respIds.countInserted(),
             gravity = gravIds.countInserted(),
         )
+        return InsertResult(
+            counts,
+            newlyInsertedStepTimestamps(streams.steps.map { it.ts }, stepIds),
+        )
     }
 
     /** #836 — cheap whole-history raw-HR change fingerprint `"count:maxTs"`. The idle 15-min rescore (the
@@ -630,10 +679,31 @@ class WhoopRepository(
         dailyMetrics: List<DailyMetric>,
         metricPoints: List<MetricSeriesRow>,
         provenance: List<ScoreInputProvenanceRow>,
+        replaceMetricKeys: List<String> = emptyList(),
+        replaceMetricSourceIds: List<String> = listOf(deviceId),
     ) = dao.replaceComputedScoreWindow(
-        deviceId, from, to, dailyMetrics, metricPoints, provenance
+        deviceId, from, to, dailyMetrics, metricPoints, provenance,
+        replaceMetricKeys, replaceMetricSourceIds,
     )
 
+    /** Computed-only daily rows; unlike daysMerged this can never substitute imported/calendar steps. */
+    suspend fun computedDailyUnion(activeStrapId: String, from: String, to: String): List<DailyMetric> =
+        unionByDay(computedSourceIds(activeStrapId).map { dao.dailyMetricsRange(it, from, to) })
+
+    fun computedDailyUnionFlow(activeStrapId: String, from: String, to: String): Flow<List<DailyMetric>> =
+        unionDaysFlow(computedSourceIds(activeStrapId).map { dao.dailyMetricsRangeFlow(it, from, to) })
+
+    fun metricSeriesComputedUnionFlow(
+        activeStrapId: String,
+        key: String,
+        from: String,
+        to: String,
+    ): Flow<List<MetricSeriesRow>> {
+        val flows = computedSourceIds(activeStrapId).map { dao.metricSeriesFlow(it, key, from, to) }
+        return if (flows.size == 1) flows[0]
+        else combine(flows) { rows -> mergeComputedSeriesUnion(rows.toList()) }
+    }
+
     suspend fun scoreInputSource(deviceId: String, day: String, key: String): String? =
         dao.scoreInputSource(deviceId, day, key)
 
@@ -1181,6 +1251,25 @@ class WhoopRepository(
     suspend fun stepSamples(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT) =
         dao.stepSamples(deviceId, from, to, limit)
 
+    suspend fun stepSampleBefore(deviceId: String, onset: Long): StepSample? =
+        dao.stepSampleBefore(deviceId, onset)
+
+    suspend fun hasStepActivityClasses(deviceId: String, onset: Long, endExclusive: Long): Boolean =
+        dao.hasStepActivityClasses(deviceId, onset, endExclusive)
+
+    suspend fun stepTimestampCoverage(deviceId: String, onset: Long, endExclusive: Long): StepTimestampCoverage =
+        StepTimestampCoverage(
+            firstTs = dao.firstStepTimestamp(deviceId, onset, endExclusive),
+            lastTs = dao.lastStepTimestamp(deviceId, onset, endExclusive),
+        )
+
+    suspend fun stepSamplesPage(
+        deviceId: String,
+        afterExclusive: Long,
+        endExclusive: Long,
+        limit: Int,
+    ): List<StepSample> = dao.stepSamplesPage(deviceId, afterExclusive, endExclusive, limit)
+
     /**
      * The strap's OWN band sleep_state samples (#175) in [from, to] as (ts, state) pairs, ascending. Feeds
      * the Deep Timeline band-state track and the per-session grid the H7 re-onset confirm guard reads. Empty
@@ -1769,18 +1858,19 @@ class WhoopRepository(
         return dedupSleepBlocks(ids.flatMap { dao.sleepSessions(it, from, to, limit) })
     }
 
-    /** Workouts over the read-side UNION of the active strap id AND the canonical "my-whoop" (#814 twin of
-     *  [hrSamplesUnion] / [sleepSessionsUnion]): a re-added / newly-paired strap owns "whoop-<uuid>" while
+    /** Workouts over every registered WHOOP (active first, archived retained) plus canonical "my-whoop",
+     *  matching [hrSamplesUnion] / [sleepSessionsUnion]. A re-added strap owns "whoop-<uuid>" while
      *  imports + prior data live under "my-whoop", so a read pinned to a SINGLE id strands the other's
      *  workouts — the Workouts screen then reads empty while Data Sources (which queries "my-whoop") shows
      *  them (#28). Exact-duplicate rows are dropped on the (startTs, sport) natural key, active-strap-first. */
     suspend fun workoutsUnion(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT): List<WorkoutRow> =
-        dedupWorkoutsByKey(importedSourceIds(deviceId).flatMap { dao.workouts(it, from, to, limit) })
+        dedupWorkoutsByKey(rawWhoopSourceIds(deviceId).flatMap { dao.workouts(it, from, to, limit) })
 
     /** The COMPUTED ("-noop") twin of [workoutsUnion] for detected workouts (the engine writes detected
      *  sessions under "<importedDeviceId>-noop"), across the computed union ids. */
     suspend fun detectedWorkoutsUnion(deviceId: String, from: Long, to: Long, limit: Int = DEFAULT_LIMIT): List<WorkoutRow> =
-        dedupWorkoutsByKey(computedSourceIds(deviceId).flatMap { dao.workouts(it, from, to, limit) })
+        dedupWorkoutsByKey(rawWhoopSourceIds(deviceId).map { "$it-noop" }
+            .flatMap { dao.workouts(it, from, to, limit) })
 
     /** Cached daily metrics for the inclusive day range [from, to] (YYYY-MM-DD), oldest first. */
     suspend fun dailyMetrics(deviceId: String, from: String, to: String): List<DailyMetric> =
diff --git a/android/app/src/main/java/com/noop/ui/ActiveDayCycle.kt b/android/app/src/main/java/com/noop/ui/ActiveDayCycle.kt
new file mode 100644
index 0000000000..af13625688
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ui/ActiveDayCycle.kt
@@ -0,0 +1,36 @@
+package com.noop.ui
+
+import com.noop.analytics.DayCycleMode
+import com.noop.data.DailyMetric
+import com.noop.data.MetricSeriesRow
+
+/** Active boundary shared by every additive Today metric; steps are optional on counter-less devices. */
+internal data class ActiveDayCycle(val ownerDay: String, val onsetTs: Long, val steps: Int?)
+
+internal fun effectiveActiveStrapId(published: String?, fallback: String): String =
+    published?.takeIf { it.isNotBlank() } ?: fallback
+
+/** The one shared start used by every live additive metric on Today. */
+internal fun activeDayCycleStart(
+    mode: DayCycleMode,
+    confirmedOrSyntheticOnset: Long?,
+    calendarStart: Long,
+): Long = if (mode == DayCycleMode.SLEEP_ONSET) confirmedOrSyntheticOnset ?: calendarStart else calendarStart
+
+/** Resolve the newest valid boundary even when this device has no raw step counter. */
+internal fun resolveActiveDayCycle(
+    visibleDays: List<DailyMetric>,
+    computedDays: List<DailyMetric>,
+    onsetMarkers: List<MetricSeriesRow>,
+    nowSeconds: Long,
+): ActiveDayCycle? {
+    val visibleDayKeys = visibleDays.mapTo(HashSet()) { it.day }
+    val computedByDay = computedDays.associateBy { it.day }
+    return onsetMarkers.asSequence()
+        .filter { it.value.isFinite() && it.value > 0.0 && it.value <= nowSeconds.toDouble() }
+        .filter { it.day in visibleDayKeys }
+        .maxByOrNull { it.value }
+        ?.let { marker ->
+            ActiveDayCycle(marker.day, marker.value.toLong(), computedByDay[marker.day]?.steps)
+        }
+}
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index 615b844c6b..44cf6f2777 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -13,6 +13,7 @@ import com.noop.analytics.Baselines
 import com.noop.analytics.IllnessSignalEngine
 import com.noop.analytics.IllnessWatch
 import com.noop.analytics.IntelligenceEngine
+import com.noop.analytics.DayCycleIntelligenceIntegration
 import com.noop.analytics.CircadianEngine
 import com.noop.analytics.V5HealthSignals
 import com.noop.analytics.RegistryDayOwnerSource
@@ -52,6 +53,7 @@ import com.noop.protocol.CommandNumber
 import com.noop.widget.WidgetSnapshot
 import com.noop.widget.WidgetSnapshotStore
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.ExperimentalCoroutinesApi
 import kotlinx.coroutines.channels.Channel
 import kotlinx.coroutines.delay
 import kotlinx.coroutines.withTimeoutOrNull
@@ -61,6 +63,9 @@ import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.flow.combine
 import kotlinx.coroutines.flow.flowOn
+import kotlinx.coroutines.flow.flatMapLatest
+import kotlinx.coroutines.flow.distinctUntilChanged
+import kotlinx.coroutines.flow.flowOf
 import kotlinx.coroutines.flow.map
 import kotlinx.coroutines.flow.stateIn
 import kotlinx.coroutines.isActive
@@ -718,6 +723,33 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
         repository.recentDaysMergedFlow(deviceId)
             .stateIn(viewModelScope, SharingStarted.WhileSubscribed(5_000), emptyList())
 
+    /**
+     * Today's measured steps follow the newest confirmed sleep-onset cycle, independently of the fixed
+     * 04:00 presentation day used by the rest of the dashboard. The marker is persisted by the analytics
+     * pass, so this survives process death and a delayed sleep detection can switch the tile retroactively.
+     */
+    @OptIn(ExperimentalCoroutinesApi::class)
+    internal val activeDayCycle: StateFlow<ActiveDayCycle?> = activeStrapIdFlow
+        .map { effectiveActiveStrapId(it, deviceId) }
+        .distinctUntilChanged()
+        .flatMapLatest { activeId ->
+            repository.recentDaysMergedFlow(activeId).flatMapLatest days@{ days ->
+                if (days.isEmpty()) return@days flowOf(null)
+                val from = days.first().day
+                val to = days.last().day
+                combine(
+                    repository.computedDailyUnionFlow(activeId, from, to),
+                    repository.metricSeriesComputedUnionFlow(
+                        activeId, DayCycleIntelligenceIntegration.ONSET_KEY, from, to,
+                    ),
+                ) { computed, markers ->
+                    resolveActiveDayCycle(days, computed, markers, System.currentTimeMillis() / 1_000L)
+                }
+            }
+        }
+        .flowOn(Dispatchers.IO)
+        .stateIn(viewModelScope, SharingStarted.WhileSubscribed(5_000), null)
+
     /**
      * #103: SpO₂ candidate @82 nightly mean per day, loaded from the "spo2_candidate" metricSeries
      * key (written by IntelligenceEngine when the experimental display toggle is ON). Empty when the
@@ -1187,6 +1219,7 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
                         // persists the nightly @82 mean as "spo2_candidate" in metricSeries.
                         spo2CandidateDisplay = NoopPrefs.spo2CandidateDisplay(appContext),
                         effortMethod = NoopPrefs.effortMethod(appContext),
+                        dayCycleMode = NoopPrefs.dayCycleMode(appContext),
                     )
                     // analyzeRecent now hops to Dispatchers.Default; a scope cancellation surfaces as a
                     // CancellationException that runCatching would otherwise swallow, breaking the loop's
@@ -1825,6 +1858,7 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
                 // #103: SpO₂ candidate @82 display toggle — same flag the 15-min loop reads.
                 spo2CandidateDisplay = NoopPrefs.spo2CandidateDisplay(appContext),
                 effortMethod = NoopPrefs.effortMethod(appContext),
+                dayCycleMode = NoopPrefs.dayCycleMode(appContext),
             )
         }.onFailure { if (it is kotlin.coroutines.cancellation.CancellationException) throw it }
     }
@@ -2677,6 +2711,12 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
         viewModelScope.launch { rescoreAfterEdit() }
     }
 
+    /** Change the shared boundary used by additive daily metrics and immediately rebuild affected rows. */
+    fun setDayCycleMode(mode: com.noop.analytics.DayCycleMode) {
+        NoopPrefs.setDayCycleMode(appContext, mode)
+        viewModelScope.launch { rescoreAfterEdit() }
+    }
+
     /** Log one local day as cycle day 1, then immediately re-run the classifier with the new anchor. */
     fun logPeriodStart(day: String = CycleTrackingStore.todayKey()) {
         viewModelScope.launch {
diff --git a/android/app/src/main/java/com/noop/ui/CoupledScreen.kt b/android/app/src/main/java/com/noop/ui/CoupledScreen.kt
index 888df02d04..3f5f9467a4 100644
--- a/android/app/src/main/java/com/noop/ui/CoupledScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/CoupledScreen.kt
@@ -91,14 +91,6 @@ fun CoupledScreen(
     val today by vm.today.collectAsStateWithLifecycle()
     val days by vm.recentDays.collectAsStateWithLifecycle()
 
-    // #614: the Workouts stat must match the Workouts screen, not DailyMetric.exerciseCount (which counts
-    // only strap-DETECTED bouts — a Health-Connect import with auto-detect off read as 0 while the Workouts
-    // screen showed it). vm.workouts is the SAME deduped, dismissed-filtered, all-source list the Workouts
-    // screen renders; loadWorkouts() isn't triggered by opening Coupled, so kick it here (idempotent,
-    // mirrors InsightsScreen).
-    LaunchedEffect(Unit) { vm.loadWorkouts() }
-    val allWorkouts by vm.workouts.collectAsStateWithLifecycle()
-
     // Last night's sleep sessions (imported + computed-only), the SAME resolution SleepScreen uses, keyed on
     // `days` so a sync/import reloads. Only needed for the bed-wake span footnote.
     var sleeps by remember { mutableStateOf<List<SleepSession>>(emptyList()) }
@@ -144,14 +136,8 @@ fun CoupledScreen(
         resolveTodayRow(days, logicalKey, localKey) ?: today
     }
     val todayKey = todayRow?.day ?: logicalKey
-    // #614: count TODAY's workouts by their START's logical day (the SAME 04:00-rollover key DailyMetric.day
-    // uses), so the Coupled stat equals the Workouts overview for today.
-    val workoutsToday = remember(allWorkouts, todayKey) {
-        allWorkouts.count {
-            logicalDay(java.time.Instant.ofEpochSecond(it.startTs).atZone(java.time.ZoneId.systemDefault()))
-                .toString() == todayKey
-        }
-    }
+    // Materialized from the same all-source physiological cycle as Effort, calories, HR, and steps.
+    val workoutsToday = todayRow?.exerciseCount ?: 0
     val context = LocalContext.current
     val hrvEpoch = remember { NoopPrefs.of(context).getLong(Baselines.hrvBaselineEpochKey, 0L).toDouble() }
     // #1458: carry through the SAME helper Today uses, not a local re-derivation. The local copy was
@@ -239,7 +225,7 @@ fun CoupledScreen(
             dayStrain21 = dayStrain21,
             recovery = recovery,
             calories = todayRow?.activeKcalEst,
-            workouts = workoutsToday,   // #614: real workout count (all sources), not exerciseCount
+            workouts = workoutsToday,
         )
         SleepCard(
             sleepPerformance = sleepPerformance,
diff --git a/android/app/src/main/java/com/noop/ui/MainActivity.kt b/android/app/src/main/java/com/noop/ui/MainActivity.kt
index 19c5515e5d..1a2471ed79 100644
--- a/android/app/src/main/java/com/noop/ui/MainActivity.kt
+++ b/android/app/src/main/java/com/noop/ui/MainActivity.kt
@@ -256,6 +256,19 @@ object NoopPrefs {
     /** "Keep connected in the background", drives [com.noop.ble.WhoopConnectionService]. Default on. */
     const val KEY_BACKGROUND_CONNECTION = "noop.backgroundConnection"
 
+    /** Boundary used by additive daily metrics. Sleep onset is the product default; midnight restores
+     * the conventional civil-day view. Naps never become boundaries. */
+    const val KEY_DAY_CYCLE_MODE = "noop.dayCycleMode"
+
+    fun dayCycleMode(context: Context): com.noop.analytics.DayCycleMode =
+        com.noop.analytics.DayCycleMode.fromPersisted(
+            of(context).getString(KEY_DAY_CYCLE_MODE, null),
+        )
+
+    fun setDayCycleMode(context: Context, mode: com.noop.analytics.DayCycleMode) {
+        of(context).edit().putString(KEY_DAY_CYCLE_MODE, mode.persistedValue).apply()
+    }
+
     /** "Continuous HRV capture", when on (AND background connection is on), NOOP holds the dense
      *  realtime HR stream armed even with no Live screen open, so the strap banks beat-to-beat R-R 24/7
      *  for far better overnight HRV/recovery/sleep. Uses more battery (continuous HR streaming). Default
diff --git a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
index 1c02d04579..73f4232715 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
@@ -120,6 +120,7 @@ import androidx.lifecycle.compose.LocalLifecycleOwner
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import com.noop.BuildConfig
 import com.noop.analytics.Baselines
+import com.noop.analytics.DayCycleMode
 import com.noop.analytics.HrZoneSet
 import com.noop.analytics.HrZones
 import com.noop.analytics.UserProfile
@@ -565,6 +566,12 @@ fun SettingsScreen(
     // Fixes a baseline poisoned by a bad first week (worn sick, or early nights that anchored too high).
     var showRecalibrateConfirm by remember { mutableStateOf(false) }
 
+    // Steps-estimate calibration screen (WHOOP 4.0), reached from the Profile card's "Steps estimate"
+    // tap-through. Mirrors the macOS StepsCalibrationSheet: honest explainer + current fit + a recent
+    // estimated-vs-phone table + a manual coefficient override. Full-screen Dialog like the guide above.
+    var showStepsCalibration by remember { mutableStateOf(false) }
+    var dayCycleMode by remember { mutableStateOf(NoopPrefs.dayCycleMode(context)) }
+
     // Whether the "Advanced" disclosure (experimental probes, diagnostics, raw-sensor export, Trends
     // report) is expanded. Default FALSE so a first-run user lands on the everyday sections instead of
     // the full wall of cards (S3); nothing is removed, every section stays one tap away by expanding.
@@ -1179,6 +1186,39 @@ fun SettingsScreen(
             }
         }
 
+        // --- Daily cycle ---
+        SettingsCard(
+            icon = Icons.Filled.Autorenew,
+            title = uiString(R.string.settings_day_cycle_title),
+            blurb = uiString(R.string.settings_day_cycle_description),
+        ) {
+            Column {
+                SettingsFormRow(label = uiString(R.string.settings_day_cycle_starts)) {
+                    SegmentedPillControl(
+                        items = listOf(DayCycleMode.SLEEP_ONSET, DayCycleMode.MIDNIGHT),
+                        selection = dayCycleMode,
+                        label = {
+                            if (it == DayCycleMode.SLEEP_ONSET) uiString(R.string.settings_day_cycle_sleep)
+                            else uiString(R.string.settings_day_cycle_midnight)
+                        },
+                        onSelect = {
+                            dayCycleMode = it
+                            vm.setDayCycleMode(it)
+                        },
+                    )
+                }
+                Text(
+                    text = if (dayCycleMode == DayCycleMode.SLEEP_ONSET) {
+                        uiString(R.string.settings_day_cycle_sleep_description)
+                    } else {
+                        uiString(R.string.settings_day_cycle_midnight_description)
+                    },
+                    style = NoopType.footnote,
+                    color = Palette.textTertiary,
+                )
+            }
+        }
+
         // --- Units ---
         // Imperial/Metric display toggle + a separate temperature override. Display-only — nothing
         // stored changes; NOOP keeps everything in SI and converts at the point of display. Mirrors the
diff --git a/android/app/src/main/java/com/noop/ui/TodayScreen.kt b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
index e1afd79715..b4e8a03f54 100644
--- a/android/app/src/main/java/com/noop/ui/TodayScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
@@ -150,6 +150,8 @@ import com.noop.analytics.ChargeDriver
 import com.noop.analytics.ChargeDriverLabel
 import com.noop.analytics.ChargeDriverUnit
 import com.noop.analytics.ChargeDriverVerdict
+import com.noop.analytics.DayCycleMode
+import com.noop.analytics.DayCycleIntelligenceIntegration
 import com.noop.analytics.HydrationGoal
 import com.noop.analytics.HydrationStore
 import com.noop.analytics.ReadinessEngine
@@ -306,6 +308,7 @@ fun TodayScreen(
     val today by viewModel.today.collectAsStateWithLifecycle()
     val alert by viewModel.healthAlert.collectAsStateWithLifecycle()
     val days by viewModel.recentDays.collectAsStateWithLifecycle()
+    val activeDayCycle by viewModel.activeDayCycle.collectAsStateWithLifecycle()
     val spo2CandidateByDay by viewModel.spo2CandidateByDay.collectAsStateWithLifecycle()
     val v5Signals by viewModel.v5Signals.collectAsStateWithLifecycle()
     val cycleEnabled by viewModel.cycleTrackingEnabled.collectAsStateWithLifecycle()
@@ -393,6 +396,17 @@ fun TodayScreen(
     val displayMetric = remember(today, historicalMetric, selectedDayOffset) {
         if (selectedDayOffset == 0) today ?: historicalMetric else historicalMetric
     }
+    val dayCycleMode = NoopPrefs.dayCycleMode(LocalContext.current)
+    // Steps alone use the physiological sleep-onset cycle. Every other field stays on the dashboard's
+    // existing logical-day row; past-day navigation continues to show the persisted historical cycle row.
+    val stepResolvedDisplayMetric = remember(displayMetric, activeDayCycle, selectedDayOffset, dayCycleMode) {
+        val cycleSteps = activeDayCycle?.steps
+        if (selectedDayOffset == 0 && dayCycleMode == DayCycleMode.SLEEP_ONSET && cycleSteps != null) {
+            displayMetric?.copy(steps = cycleSteps)
+        } else {
+            displayMetric
+        }
+    }
     // Keep the explicit calendar date visible alongside Today/Yesterday so the logical-day remap stays
     // honest, between midnight and 04:00 "Today" still points at the prior calendar date, and showing
     // that date makes it obvious which day's row is on screen (#144).
@@ -920,11 +934,15 @@ fun TodayScreen(
     // fabricated number. Any past day → null (the gauge uses the stored strain). Keyed on the same inputs
     // as the day-scoped loads so it reloads as the selector moves and as a sync/import grows the HR window.
     var liveTodayStrain by remember { mutableStateOf<Double?>(null) }
-    LaunchedEffect(days, selectedDayKey, selectedDayOffset) {
+    LaunchedEffect(days, selectedDayKey, selectedDayOffset, activeDayCycle, dayCycleMode) {
         liveTodayStrain = if (selectedDayOffset == 0) {
             val zone = ZoneId.systemDefault()
-            val start = selectedDay.atStartOfDay(zone).toEpochSecond()
             val now = System.currentTimeMillis() / 1000
+            val start = activeDayCycleStart(
+                mode = dayCycleMode,
+                confirmedOrSyntheticOnset = activeDayCycle?.onsetTs,
+                calendarStart = selectedDay.atStartOfDay(zone).toEpochSecond(),
+            )
             // #908: read the active strap ∪ canonical "my-whoop" union, NOT a hardcoded "my-whoop". A strap
             // re-added through the device manager banks its live HR under its own fresh id, so a pinned
             // "my-whoop" read returned nothing and Effort integrated to 0 off an empty series. Single-WHOOP
@@ -934,10 +952,11 @@ fun TodayScreen(
             // effMaxHR resolution matches AnalyticsEngine: manual HR-max override first, else Tanaka from age.
             val effMaxHR = profileStore.hrMaxOverride.takeIf { it > 0 }?.toDouble()
                 ?: if (profileStore.age > 0) StrainScorer.tanakaHRmax(profileStore.age.toDouble()) else null
+            val restingHr = displayMetric?.restingHr?.toDouble() ?: StrainScorer.defaultRestingHR
             StrainScorer.strain(
                 hr = todayHr,
                 maxHR = effMaxHR,
-                restingHR = displayMetric?.restingHr?.toDouble() ?: StrainScorer.defaultRestingHR,
+                restingHR = restingHr,
                 method = NoopPrefs.effortMethod(context),
                 sex = profileStore.sex,
             )
@@ -1563,7 +1582,7 @@ fun TodayScreen(
                             }
                             Box(modifier = Modifier.fillMaxWidth().staggeredAppear(stagger)) {
                                 MetricGrid(
-                                    d = displayMetric,
+                                    d = stepResolvedDisplayMetric,
                                     w = window,
                                     recoveryCalibration = recoveryCalibration,
                                     lastScoredCharge = lastScoredCharge,
@@ -1579,7 +1598,7 @@ fun TodayScreen(
                                     profileWeightKg = profileWeightKg,
                                     importedStepsForDay = importedStepsForDay,
                                     estimatedStepsForDay = stepsEstForDay,
-                                    caloriesForDay = caloriesByDay[selectedDayKey],   // #616: imported-first per day
+                                    caloriesForDay = caloriesByDay[selectedDayKey],
                                     caloriesSpark = caloriesSpark,                    // #616: imported-first trend
                                     stepActivityClassForDay = stepActivityClassForDay,
                                     stepsEstimateCaption = stepsEstimateCaption(profileStore),
@@ -1612,7 +1631,8 @@ fun TodayScreen(
                             modifier = Modifier.fillMaxWidth().staggeredAppear(stagger),
                             verticalArrangement = Arrangement.spacedBy(8.dp),
                         ) {
-                            HeartRateTrendCard(viewModel, days, selectedDay, todayDate, displayMetric, effortScale, effortForDay)
+                            HeartRateTrendCard(viewModel, days, selectedDay, todayDate, displayMetric,
+                                effortScale, effortForDay, dayCycleMode)
                         }
                         // The three hero vitals, HRV / Resting HR / Respiratory. Carried day (#543).
                         TodaySection.RECOVERY_VITALS -> Box(modifier = Modifier.fillMaxWidth().staggeredAppear(stagger)) {
@@ -1625,7 +1645,7 @@ fun TodayScreen(
                         // section emits no item; visibleDashboardCards is the loop-level filtered list.
                         TodaySection.YOUR_CARDS -> YourCardsSection(
                             cards = visibleDashboardCards,
-                            day = displayMetric,
+                            day = stepResolvedDisplayMetric,
                             carriedDay = lastScoredRecoveryDay,
                             vitalsDay = lastVitalsDay,
                             spo2Day = lastSpo2Day,
@@ -5547,6 +5567,7 @@ private fun HeartRateTrendCard(
     // #1001: the day's resolved Effort for the chart's edge badge. It read `displayMetric.strain` — the
     // daily row — so on an active morning the badge trailed the hero ring by the whole morning's load.
     effortForDay: Double? = null,
+    dayCycleMode: DayCycleMode = DayCycleMode.SLEEP_ONSET,
 ) {
     // "Today" here is the LOGICAL day (rolls at 04:00 local), so in the small hours after midnight the
     // trend keeps the evening's curve, window start at the logical day's own midnight, "since midnight"
@@ -5582,12 +5603,22 @@ private fun HeartRateTrendCard(
     val live by viewModel.live.collectAsStateWithLifecycle()
     // Re-load when the day list changes (an import updates it), when the day selector moves, and, via the
     // sync tokens, when a strap offload banks fresh HR samples for the current window. Also on first compose.
-    LaunchedEffect(days, selectedDay, today, live.lastSyncAt, live.syncChunksThisSession) {
+    LaunchedEffect(days, selectedDay, today, live.lastSyncAt, live.syncChunksThisSession, dayCycleMode) {
         val zone = ZoneId.systemDefault()
-        val start = selectedDay.atStartOfDay(zone).toEpochSecond()
+        val calendarStart = selectedDay.atStartOfDay(zone).toEpochSecond()
         val nextStart = selectedDay.plusDays(1).atStartOfDay(zone).toEpochSecond()
         val now = System.currentTimeMillis() / 1000
-        val end = if (selectedDay == today) now else (nextStart - 1)
+        val calendarEnd = if (selectedDay == today) now else (nextStart - 1)
+        val markerRows = if (dayCycleMode == DayCycleMode.SLEEP_ONSET) runCatching {
+            viewModel.repo.metricSeriesComputedUnion(
+                viewModel.activeStrapId, DayCycleIntelligenceIntegration.ONSET_KEY,
+                selectedDay.toString(), selectedDay.plusDays(1).toString(),
+            )
+        }.getOrDefault(emptyList()) else emptyList()
+        val start = markerRows.firstOrNull { it.day == selectedDay.toString() }?.value?.toLong()
+            ?: calendarStart
+        val end = markerRows.firstOrNull { it.day == selectedDay.plusDays(1).toString() }?.value?.toLong()
+            ?.minus(1L) ?: calendarEnd
         // #908: the Today HR curve reads the active strap ∪ canonical "my-whoop" union, NOT a hardcoded
         // "my-whoop". A strap re-added via the device manager banks live HR under its own fresh id, so a
         // pinned read showed the "no heart rate banked yet today" empty state. Single-WHOOP ⇒ one id ⇒ same.
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 6e159ed2fe..cbf02f2b02 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2684,4 +2684,11 @@
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Für diese Nächte liegt keine gemessene Temperatur vor — angezeigt wird die Abweichung von deinem Basiswert. Eine Synchronisierung bewertet die letzten Nächte neu und ergänzt sie.</string>
     <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Es werden nur Nächte mit gemessener Temperatur angezeigt; für die übrigen wurde nur eine Abweichung vom Basiswert erfasst.</string>
     <string name="l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b">Diese Nacht wurde allein anhand der Herzfrequenz ausgewertet, ohne aufgezeichnete Bewegung, daher konnten Herzfrequenzvariabilität und Ruheherzfrequenz nicht gemessen werden. Ein nicht vollständig gekoppelter Strap ist die übliche Ursache.</string>
+    <string name="settings_day_cycle_title">Tageszyklus</string>
+    <string name="settings_day_cycle_description">Lege fest, wann Schritte und die laufende Anstrengung neu beginnen. Nickerchen starten keinen neuen Tag.</string>
+    <string name="settings_day_cycle_starts">Tagesbeginn</string>
+    <string name="settings_day_cycle_sleep">Hauptschlaf</string>
+    <string name="settings_day_cycle_midnight">00:00</string>
+    <string name="settings_day_cycle_sleep_description">Standard. Der Zyklus folgt dem Beginn deines erkannten Hauptschlafs. Bei fehlenden oder unzuverlässigen Schlafdaten verwendet NOOP ersatzweise die lokale Mitternacht.</string>
+    <string name="settings_day_cycle_midnight_description">Verwendet einen herkömmlichen lokalen Kalendertag von 00:00 bis 00:00 Uhr.</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 1bb9e74ab9..3dc7a7730f 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2671,4 +2671,11 @@
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">No hay temperatura medida para estas noches: se muestra la diferencia respecto a tu referencia. Una sincronización vuelve a analizar las noches recientes y la completa.</string>
     <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Solo se muestran las noches con temperatura medida; en las demás solo se registró la diferencia respecto a la referencia.</string>
     <string name="l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b">Esta noche se analizó solo a partir de la frecuencia cardíaca, sin movimiento registrado, por lo que no se pudieron medir la variabilidad de la frecuencia cardíaca ni la frecuencia cardíaca en reposo. La causa habitual es una correa que no está totalmente emparejada.</string>
+    <string name="settings_day_cycle_title">Ciclo diario</string>
+    <string name="settings_day_cycle_description">Elige cuándo se reinician los pasos y el Esfuerzo en curso. Las siestas nunca empiezan un nuevo día.</string>
+    <string name="settings_day_cycle_starts">El día empieza</string>
+    <string name="settings_day_cycle_sleep">Sueño principal</string>
+    <string name="settings_day_cycle_midnight">00:00</string>
+    <string name="settings_day_cycle_sleep_description">Predeterminado. El ciclo sigue el inicio del sueño principal detectado. Si faltan datos de sueño o no son fiables, se usa la medianoche local.</string>
+    <string name="settings_day_cycle_midnight_description">Usa un día natural local convencional de 00:00 a 00:00.</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index dd4622818c..99388e3e21 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2670,4 +2670,11 @@
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Aucune température mesurée pour ces nuits — l\'écart par rapport à votre référence est affiché. Une synchronisation réévalue les nuits récentes et le complète.</string>
     <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Seules les nuits avec une température mesurée sont affichées ; les autres n\'ont enregistré qu\'un écart par rapport à la référence.</string>
     <string name="l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b">Cette nuit a été analysée à partir de la seule fréquence cardiaque, sans mouvement enregistré, donc la variabilité de la fréquence cardiaque et la fréquence cardiaque au repos n\'ont pas pu être mesurées. La cause habituelle est un bracelet qui n\'est pas entièrement appairé.</string>
+    <string name="settings_day_cycle_title">Cycle journalier</string>
+    <string name="settings_day_cycle_description">Choisissez quand les pas et l’Effort en cours repartent de zéro. Les siestes ne commencent jamais une nouvelle journée.</string>
+    <string name="settings_day_cycle_starts">Début de la journée</string>
+    <string name="settings_day_cycle_sleep">Sommeil principal</string>
+    <string name="settings_day_cycle_midnight">00:00</string>
+    <string name="settings_day_cycle_sleep_description">Par défaut. Le cycle suit le début du sommeil principal détecté. Si les données de sommeil sont absentes ou peu fiables, l’heure locale de minuit est utilisée.</string>
+    <string name="settings_day_cycle_midnight_description">Utilise une journée civile locale classique de 00:00 à 00:00.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 24b36f954e..9b672ed08c 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2675,4 +2675,11 @@
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Brak zmierzonej temperatury dla tych nocy — pokazano różnicę względem Twojej wartości bazowej. Synchronizacja ponownie przelicza ostatnie noce i ją uzupełnia.</string>
     <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Pokazywane są tylko noce ze zmierzoną temperaturą; w pozostałych zapisano jedynie różnicę względem wartości bazowej.</string>
     <string name="l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b">Ta noc została opracowana wyłącznie na podstawie tętna, bez zarejestrowanego ruchu, więc nie udało się zmierzyć zmienności rytmu serca ani tętna spoczynkowego. Zwykłą przyczyną jest opaska, która nie jest w pełni sparowana.</string>
+    <string name="settings_day_cycle_title">Cykl dobowy</string>
+    <string name="settings_day_cycle_description">Wybierz, kiedy kroki i bieżący Wysiłek zaczynają się od nowa. Drzemki nigdy nie rozpoczynają nowego dnia.</string>
+    <string name="settings_day_cycle_starts">Początek dnia</string>
+    <string name="settings_day_cycle_sleep">Główny sen</string>
+    <string name="settings_day_cycle_midnight">00:00</string>
+    <string name="settings_day_cycle_sleep_description">Domyślnie. Cykl rozpoczyna się wraz z wykrytym głównym snem. Gdy brakuje wiarygodnych danych o śnie, używana jest lokalna północ.</string>
+    <string name="settings_day_cycle_midnight_description">Używa zwykłego lokalnego dnia kalendarzowego od 00:00 do 00:00.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 33857ddb11..29203346bc 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2663,4 +2663,11 @@
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">Sem temperatura medida para estas noites — a mostrar a diferença em relação à sua referência. Uma sincronização reavalia as noites recentes e preenche-a.</string>
     <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Só são mostradas as noites com temperatura medida; as restantes registaram apenas a diferença em relação à referência.</string>
     <string name="l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b">Esta noite foi analisada apenas a partir da frequência cardíaca, sem movimento registado, pelo que não foi possível medir a variabilidade da frequência cardíaca nem a frequência cardíaca em repouso. A causa habitual é uma pulseira que não está totalmente emparelhada.</string>
+    <string name="settings_day_cycle_title">Ciclo diário</string>
+    <string name="settings_day_cycle_description">Escolhe quando os passos e o Esforço em curso recomeçam. As sestas nunca iniciam um novo dia.</string>
+    <string name="settings_day_cycle_starts">O dia começa</string>
+    <string name="settings_day_cycle_sleep">Sono principal</string>
+    <string name="settings_day_cycle_midnight">00:00</string>
+    <string name="settings_day_cycle_sleep_description">Predefinição. O ciclo segue o início do sono principal detetado. Se os dados de sono estiverem em falta ou não forem fiáveis, é usada a meia-noite local.</string>
+    <string name="settings_day_cycle_midnight_description">Usa um dia civil local convencional das 00:00 às 00:00.</string>
 </resources>
diff --git a/android/app/src/main/res/values-ru/strings.xml b/android/app/src/main/res/values-ru/strings.xml
index 1af9883196..0847ba246e 100644
--- a/android/app/src/main/res/values-ru/strings.xml
+++ b/android/app/src/main/res/values-ru/strings.xml
@@ -2555,4 +2555,11 @@
         <item quantity="other">%1$s тренировки</item>
     </plurals>
     <string name="l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b">Эта ночь определена только по пульсу, без записанного движения, поэтому вариабельность сердечного ритма и пульс в покое измерить не удалось. Обычная причина — ремешок, сопряжённый не полностью.</string>
+    <string name="settings_day_cycle_title">Суточный цикл</string>
+    <string name="settings_day_cycle_description">Выберите, когда начинается новый отсчёт шагов и текущей нагрузки. Дневной сон не начинает новый день.</string>
+    <string name="settings_day_cycle_starts">Начало дня</string>
+    <string name="settings_day_cycle_sleep">Основной сон</string>
+    <string name="settings_day_cycle_midnight">00:00</string>
+    <string name="settings_day_cycle_sleep_description">По умолчанию цикл начинается с обнаруженного основного сна. Если данные о сне отсутствуют или ненадёжны, используется местная полночь.</string>
+    <string name="settings_day_cycle_midnight_description">Используется обычный местный календарный день с 00:00 до 00:00.</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index ee2eefafaa..89b2a865d5 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2584,4 +2584,11 @@
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">这些夜晚没有实测温度，显示的是与基线的差值。同步后会重新计算近期夜晚并补上。</string>
     <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">仅显示有实测温度的夜晚；其余夜晚只记录了与基线的差值。</string>
     <string name="l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b">这一晚仅根据心率推算，没有记录到动作，因此无法测量心率变异性和静息心率。通常的原因是手环尚未完全配对。</string>
+    <string name="settings_day_cycle_title">每日周期</string>
+    <string name="settings_day_cycle_description">选择步数和进行中的体力消耗何时重新开始。小睡不会开始新的一天。</string>
+    <string name="settings_day_cycle_starts">一天开始于</string>
+    <string name="settings_day_cycle_sleep">主要睡眠</string>
+    <string name="settings_day_cycle_midnight">00:00</string>
+    <string name="settings_day_cycle_sleep_description">默认。周期从检测到的主要睡眠开始。睡眠数据缺失或不可靠时，将使用当地午夜。</string>
+    <string name="settings_day_cycle_midnight_description">使用从 00:00 到次日 00:00 的常规当地日历日。</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 5db78667d5..eb84e1efbb 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2697,4 +2697,11 @@
     <string name="l10n_health_screen_no_measured_temperature_for_these_nights_showing_the_differe_69d4efae">No measured temperature for these nights — showing the difference from your baseline. A sync re-scores recent nights and fills it in.</string>
     <string name="l10n_health_screen_only_nights_with_a_measured_temperature_are_shown_the_others_b6f7c45b">Only nights with a measured temperature are shown; the others recorded a baseline difference only.</string>
     <string name="l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b">This night was staged from heart rate alone, with no motion recorded, so HRV and resting heart rate could not be measured. A strap that is not fully paired is the usual cause.</string>
+    <string name="settings_day_cycle_title">Day cycle</string>
+    <string name="settings_day_cycle_description">Choose when steps and in-progress Effort start over. Naps never start a new day.</string>
+    <string name="settings_day_cycle_starts">Day starts</string>
+    <string name="settings_day_cycle_sleep">Main sleep</string>
+    <string name="settings_day_cycle_midnight">00:00</string>
+    <string name="settings_day_cycle_sleep_description">Default. The cycle follows the beginning of your detected main sleep. Before a main sleep is detected, local midnight is used.</string>
+    <string name="settings_day_cycle_midnight_description">Uses a conventional local calendar day from 00:00 to 00:00.</string>
 </resources>
diff --git a/android/app/src/test/java/com/noop/analytics/DayCycleResolverTest.kt b/android/app/src/test/java/com/noop/analytics/DayCycleResolverTest.kt
new file mode 100644
index 0000000000..d8f3e56cbe
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/DayCycleResolverTest.kt
@@ -0,0 +1,44 @@
+package com.noop.analytics
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class DayCycleResolverTest {
+    @Test fun sleepOnsetIsTheDefaultPersistedMode() {
+        assertEquals(DayCycleMode.SLEEP_ONSET, DayCycleMode.fromPersisted(null))
+        assertEquals(DayCycleMode.SLEEP_ONSET, DayCycleMode.fromPersisted("unknown"))
+    }
+
+    @Test fun fallbackUsesTheFirstMidnightAtLeastEighteenHoursAfterOnset() {
+        val monday2300 = 23 * 3_600L
+        assertEquals(2 * 86_400L, DayCycleResolver.fallbackMidnightAfter(monday2300, 0))
+    }
+
+    @Test fun reliableAllNighterStaysOpenUntilTheAbsoluteCap() {
+        val sleep = DayCycleWindow("night", 0, 0, "1970-01-01", DayCycleWindow.Source.DETECTED_SLEEP)
+        assertEquals(
+            DayCycleWindow.Source.DETECTED_SLEEP,
+            DayCycleResolver.activeWindow(DayCycleMode.SLEEP_ONSET, sleep, 39 * 3_600L, 0, true).source,
+        )
+        assertEquals(
+            DayCycleWindow.Source.SYNTHETIC_MIDNIGHT,
+            DayCycleResolver.activeWindow(DayCycleMode.SLEEP_ONSET, sleep, 40 * 3_600L, 0, true).source,
+        )
+    }
+
+    @Test fun missingCoverageKeepsSleepOnsetCycleOpenAcrossMidnight() {
+        val sleep = DayCycleWindow("night", 23 * 3_600L, 0, "1970-01-02", DayCycleWindow.Source.DETECTED_SLEEP)
+        assertEquals(
+            DayCycleWindow.Source.DETECTED_SLEEP,
+            DayCycleResolver.activeWindow(DayCycleMode.SLEEP_ONSET, sleep, 2 * 86_400L + 60, 0, false).source,
+        )
+    }
+
+    @Test fun midnightModeStillResetsAtCalendarMidnight() {
+        val sleep = DayCycleWindow("night", 23 * 3_600L, 0, "1970-01-02", DayCycleWindow.Source.DETECTED_SLEEP)
+        assertEquals(
+            DayCycleWindow.Source.CALENDAR,
+            DayCycleResolver.activeWindow(DayCycleMode.MIDNIGHT, sleep, 2 * 86_400L + 60, 0, true).source,
+        )
+    }
+}
diff --git a/android/app/src/test/java/com/noop/analytics/PhysiologicalStepsTest.kt b/android/app/src/test/java/com/noop/analytics/PhysiologicalStepsTest.kt
new file mode 100644
index 0000000000..23525c11c6
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/PhysiologicalStepsTest.kt
@@ -0,0 +1,181 @@
+package com.noop.analytics
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+import java.time.LocalDateTime
+import java.time.ZoneOffset
+
+class PhysiologicalStepsTest {
+
+    @Test fun nextOnsetWinsAndCurrentCycleFallsBackToNow() {
+        val starts = mapOf(
+            "2026-08-20" to 1_000L,
+            "2026-08-21" to 2_000L,
+        )
+
+        assertEquals(2_000L, PhysiologicalSteps.cycleEnd("2026-08-20", starts, now = 2_500L))
+        assertEquals(2_500L, PhysiologicalSteps.cycleEnd("2026-08-21", starts, now = 2_500L))
+    }
+
+    @Test fun mainSleepOnsetWinsOverASeparateDaytimeNap() {
+        fun utc(day: Int, hour: Int, minute: Int = 0) =
+            LocalDateTime.of(2026, 8, day, hour, minute).toEpochSecond(ZoneOffset.UTC)
+        val blocks = listOf(
+            PhysiologicalSteps.SleepBlock(utc(21, 14), utc(21, 15)),
+            PhysiologicalSteps.SleepBlock(utc(21, 2, 57), utc(21, 10, 15)),
+        )
+
+        assertEquals(
+            utc(21, 2, 57),
+            PhysiologicalSteps.mainSleepOnset(blocks, tzOffsetSeconds = 0, habitualMidsleepSec = null),
+        )
+    }
+
+    @Test fun napOnlyNeverOpensACycleEvenWhenItIsLong() {
+        fun utc(hour: Int) = LocalDateTime.of(2026, 8, 21, hour, 0).toEpochSecond(ZoneOffset.UTC)
+
+        assertNull(
+            PhysiologicalSteps.mainSleepOnset(
+                listOf(
+                    PhysiologicalSteps.SleepBlock(
+                        utc(1),
+                        utc(9),
+                        kind = PhysiologicalSteps.SleepKind.NAP,
+                    ),
+                    PhysiologicalSteps.SleepBlock(
+                        utc(13),
+                        utc(19),
+                        kind = PhysiologicalSteps.SleepKind.NAP,
+                    ),
+                ),
+                tzOffsetSeconds = 0,
+                habitualMidsleepSec = null,
+            ),
+        )
+    }
+
+    @Test fun productionClassificationRejectsShortOrDaytimeNapShapes() {
+        fun utc(hour: Int) = LocalDateTime.of(2026, 8, 21, hour, 0).toEpochSecond(ZoneOffset.UTC)
+        val classified = PhysiologicalSteps.classifyForCycle(
+            listOf(
+                PhysiologicalSteps.SleepBlock(utc(1), utc(8), id = "night"),
+                // Keep this clearly separate from the main night. A fragment beginning at 09:00 after
+                // a one-hour wake is deliberately treated as a continuation of an interrupted night.
+                PhysiologicalSteps.SleepBlock(utc(11), utc(13), id = "short"),
+                PhysiologicalSteps.SleepBlock(utc(13), utc(19), id = "daytime"),
+            ),
+            tzOffsetSeconds = 0,
+            habitualMidsleepSec = null,
+        ).associate { it.id to it.kind }
+
+        assertEquals(PhysiologicalSteps.SleepKind.MAIN_SLEEP, classified["night"])
+        assertEquals(PhysiologicalSteps.SleepKind.NAP, classified["short"])
+        assertEquals(PhysiologicalSteps.SleepKind.NAP, classified["daytime"])
+    }
+
+    @Test fun longDaytimeNapCannotHideAShorterValidMainNight() {
+        fun utc(day: Int, hour: Int, minute: Int = 0) =
+            LocalDateTime.of(2026, 8, day, hour, minute).toEpochSecond(ZoneOffset.UTC)
+        val classified = PhysiologicalSteps.classifyForCycle(
+            listOf(
+                PhysiologicalSteps.SleepBlock(utc(21, 1), utc(21, 4, 30), id = "night"),
+                PhysiologicalSteps.SleepBlock(utc(21, 13), utc(21, 19), id = "nap"),
+            ),
+            0,
+            null,
+        ).associate { it.id to it.kind }
+
+        assertEquals(PhysiologicalSteps.SleepKind.MAIN_SLEEP, classified["night"])
+        assertEquals(PhysiologicalSteps.SleepKind.NAP, classified["nap"])
+    }
+
+    @Test fun historicalWindowsHaveOnlySleepBoundariesAndKeepTheLastOneOpen() {
+        assertEquals(
+            listOf(
+                PhysiologicalSteps.CycleWindow("night-a", 1_000, 2_000),
+                PhysiologicalSteps.CycleWindow("night-b", 2_000, 9_000),
+            ),
+            PhysiologicalSteps.cycleWindows(
+                listOf(
+                    PhysiologicalSteps.CycleBoundary("night-a", 1_000),
+                    PhysiologicalSteps.CycleBoundary("night-b", 2_000),
+                ),
+                now = 9_000,
+            ),
+        )
+    }
+
+    @Test fun ownerSegmentsFollowResolvedCalendarOwnersWithoutCrossDeviceSeams() {
+        assertEquals(
+            listOf(
+                PhysiologicalSteps.OwnerSegment("strap-a", 1_000, 86_400),
+                PhysiologicalSteps.OwnerSegment("strap-b", 86_400, 172_800),
+                PhysiologicalSteps.OwnerSegment("strap-a", 172_800, 200_000),
+            ),
+            PhysiologicalSteps.ownerSegments(
+                PhysiologicalSteps.CycleWindow("night", 1_000, 200_000),
+                ownerByDay = mapOf(
+                    "1970-01-01" to "strap-a",
+                    "1970-01-02" to "strap-b",
+                    "1970-01-03" to "strap-a",
+                ),
+                tzOffsetSeconds = 0,
+                fallbackOwner = "strap-a",
+            ),
+        )
+    }
+
+    @Test fun middayReAddSwitchesOwnersAtRawCoverageBoundaryAndOverlapNeverDoubles() {
+        val window = PhysiologicalSteps.CycleWindow("night", 0, 86_400)
+        assertEquals(
+            listOf(
+                PhysiologicalSteps.OwnerSegment("strap-a", 0, 14 * 3_600L),
+                PhysiologicalSteps.OwnerSegment("strap-b", 14 * 3_600L, 86_400),
+            ),
+            PhysiologicalSteps.ownerSegmentsFromCoverage(
+                window,
+                listOf(
+                    PhysiologicalSteps.OwnerCoverage("strap-a", 0, 86_400, priority = 1),
+                    PhysiologicalSteps.OwnerCoverage("strap-b", 14 * 3_600L, 86_400, priority = 0),
+                ),
+                fallbackOwner = "strap-a",
+            ),
+        )
+        assertEquals(
+            listOf(PhysiologicalSteps.OwnerSegment("strap-b", 0, 86_400)),
+            PhysiologicalSteps.ownerSegmentsFromCoverage(
+                window,
+                listOf(
+                    PhysiologicalSteps.OwnerCoverage("strap-a", 0, 86_400, 1),
+                    PhysiologicalSteps.OwnerCoverage("strap-b", 0, 86_400, 0),
+                ),
+                "strap-a",
+            ),
+        )
+    }
+
+    @Test fun onlyCycleOnsetMayReadAPredecessorNeverANewOwnerSeam() {
+        assertEquals(true, PhysiologicalSteps.shouldReadCounterPredecessor(segmentIndex = 0))
+        assertEquals(false, PhysiologicalSteps.shouldReadCounterPredecessor(segmentIndex = 1))
+        assertEquals(false, PhysiologicalSteps.shouldReadCounterPredecessor(segmentIndex = 2))
+    }
+
+    @Test fun internalRadioGapDoesNotSwitchAwayFromTheHigherPriorityOwner() {
+        // Coverage is deliberately first..last, not a list of sample runs. A radio/sample hole inside
+        // strap-b's observed span therefore creates no seam at which concurrently worn strap-a can win.
+        assertEquals(
+            listOf(PhysiologicalSteps.OwnerSegment("strap-b", 0, 86_400)),
+            PhysiologicalSteps.ownerSegmentsFromCoverage(
+                PhysiologicalSteps.CycleWindow("night", 0, 86_400),
+                listOf(
+                    PhysiologicalSteps.OwnerCoverage("strap-a", 0, 86_400, priority = 1),
+                    // Its first and last samples surround an internal 10-minute radio gap.
+                    PhysiologicalSteps.OwnerCoverage("strap-b", 0, 86_400, priority = 0),
+                ),
+                fallbackOwner = "strap-b",
+            ),
+        )
+    }
+
+}
diff --git a/android/app/src/test/java/com/noop/analytics/RegistryDayOwnerSourceTest.kt b/android/app/src/test/java/com/noop/analytics/RegistryDayOwnerSourceTest.kt
index 78adb90f68..7ec2695e49 100644
--- a/android/app/src/test/java/com/noop/analytics/RegistryDayOwnerSourceTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/RegistryDayOwnerSourceTest.kt
@@ -215,15 +215,17 @@ class RegistryDayOwnerSourceTest {
     }
 
     @Test
-    fun archivedDeviceIsNotACandidate() = runBlocking {
+    fun archivedDeviceRemainsALowestPriorityHistoricalCandidate() = runBlocking {
         val dao = FakeDao().apply {
             devices["my-whoop"] = device("my-whoop", "WHOOP", SourceKind.liveBLE, DeviceStatus.active)
             devices["old"] = device("old", "Polar", SourceKind.liveBLE, DeviceStatus.archived)
         }
         val src = RegistryDayOwnerSource(registry(dao))
-        val ids = src.candidatePriorities().map { it.first }
-        assertEquals(listOf("my-whoop"), ids) // archived 'old' excluded
-        // With only the active strap and it having NO data, there is no owner (honest gap).
-        assertNull(resolveWith(src, "2026-06-15", mapOf("my-whoop" to false)))
+        val priorities = src.candidatePriorities().toMap()
+        assertEquals(0, priorities["my-whoop"])
+        assertEquals(4, priorities["old"])
+        // Archived history fills only an otherwise uncovered day; live/current sources always win.
+        assertEquals("old", resolveWith(src, "2026-06-15", mapOf("my-whoop" to false, "old" to true)))
+        assertEquals("my-whoop", resolveWith(src, "2026-06-15", mapOf("my-whoop" to true, "old" to true)))
     }
 }
diff --git a/android/app/src/test/java/com/noop/analytics/SleepAwareStepCounterTest.kt b/android/app/src/test/java/com/noop/analytics/SleepAwareStepCounterTest.kt
new file mode 100644
index 0000000000..7e8c708db8
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/SleepAwareStepCounterTest.kt
@@ -0,0 +1,158 @@
+package com.noop.analytics
+
+import com.noop.data.GravitySample
+import com.noop.data.StepSample
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+class SleepAwareStepCounterTest {
+    private fun step(ts: Long, counter: Int, activityClass: Int? = 1) =
+        StepSample("strap", ts, counter, activityClass)
+
+    private fun sleep(start: Long, end: Long, stages: List<StageSegment> = emptyList()) =
+        DetectedSleep(start, end, 0.9, stages, null, null)
+
+    @Test fun outsideSleepUsesTheNormalCounterRulesExactly() {
+        val samples = listOf(
+            step(0, 100, 0),
+            step(1, 102, 1),
+            step(2, 110, 1), // impossible 8 ticks/s: rejected by StepsCounter too
+            step(4, 117, 2),
+            step(5, 120, 0),
+        )
+
+        assertEquals(StepsCounter.stepsInWindow(samples), SleepAwareStepCounter.stepsInWindow(samples, emptyList()))
+        assertEquals(9, SleepAwareStepCounter.stepsInWindow(samples, emptyList()))
+        val detail = SleepAwareStepCounter.count(samples, emptyList())
+        assertEquals(3, detail.rejectedActivityClassTicks)
+        assertEquals(8, detail.rejectedImplausibleTicks)
+    }
+
+    @Test fun awakeGapInsideSleepCountsWithNormalRules() {
+        val session = sleep(
+            0, 120,
+            listOf(
+                StageSegment(0, 30, "light"),
+                StageSegment(30, 60, "awake"),
+                StageSegment(60, 120, "deep"),
+            ),
+        )
+        val samples = listOf(step(29, 100), step(30, 101), step(31, 103), step(32, 104))
+
+        // The isolated +1 at t=30 and the following awake deltas are all in an explicitly awake gap.
+        assertEquals(4, SleepAwareStepCounter.stepsInWindow(samples, listOf(session)))
+    }
+
+    @Test fun isolatedWalkClassBedTicksAreRejected() {
+        val session = sleep(0, 180, listOf(StageSegment(0, 180, "light")))
+        val samples = listOf(
+            step(0, 100), step(10, 101), step(11, 102),
+            step(70, 102), step(71, 104),
+            step(150, 104),
+        )
+
+        assertNull(SleepAwareStepCounter.stepsInWindow(samples, listOf(session)))
+        val detail = SleepAwareStepCounter.count(samples, listOf(session))
+        assertEquals(4, detail.rejectedIsolatedSleepTicks)
+        assertEquals(0, detail.totalTicks)
+    }
+
+    @Test fun shortCoherentToiletWalkDuringScoredSleepIsPreservedExactly() {
+        val session = sleep(0, 120, listOf(StageSegment(0, 120, "light")))
+        val samples = buildList {
+            add(step(20, 500))
+            var counter = 500
+            for (second in 21L..30L) {
+                counter += 2
+                add(step(second, counter))
+            }
+        }
+
+        // Ten coherent seconds, twenty raw locomotion ticks. No calibration/conversion belongs here.
+        assertEquals(20, SleepAwareStepCounter.stepsInWindow(samples, listOf(session)))
+        val detail = SleepAwareStepCounter.count(samples, listOf(session))
+        assertEquals(20, detail.acceptedSleepBoutTicks)
+        assertEquals(20, detail.totalTicks)
+    }
+
+    @Test fun coherentSleepBoutFailsSafeWhenGravityIsMissing() {
+        val session = sleep(0, 90, listOf(StageSegment(0, 90, "rem")))
+        val samples = listOf(
+            step(10, 10), step(11, 12), step(12, 14), step(13, 16),
+            step(14, 18), step(15, 20), step(16, 22),
+        )
+
+        assertEquals(12, SleepAwareStepCounter.stepsInWindow(samples, listOf(session), gravity = emptyList()))
+    }
+
+    @Test fun decisionDoesNotDependOnADeviceOrientationVector() {
+        val session = sleep(0, 90, listOf(StageSegment(0, 90, "deep")))
+        val samples = listOf(
+            step(10, 10), step(11, 12), step(12, 14), step(13, 16),
+            step(14, 18), step(15, 20), step(16, 22),
+        )
+        fun gravity(x: Double, y: Double, z: Double) = (10L..16L).map {
+            GravitySample("strap", it, x, y, z)
+        }
+
+        val faceUp = SleepAwareStepCounter.stepsInWindow(samples, listOf(session), gravity(0.0, 0.0, 1.0))
+        val rotated = SleepAwareStepCounter.stepsInWindow(samples, listOf(session), gravity(0.8, -0.6, 0.0))
+        assertEquals(12, faceUp)
+        assertEquals(faceUp, rotated)
+    }
+
+    @Test fun sleepSessionWithoutStagesIsConservativelyTreatedAsSleep() {
+        val samples = listOf(step(10, 100), step(11, 101), step(12, 102))
+        assertNull(SleepAwareStepCounter.stepsInWindow(samples, listOf(sleep(0, 60))))
+    }
+
+    @Test fun pagingKeepsCounterPredecessorAndOpenGaitBout() {
+        val session = sleep(0, 90, listOf(StageSegment(0, 90, "light")))
+        val all = listOf(
+            step(10, 100), step(11, 102), step(12, 104), step(13, 106),
+            step(14, 108), step(15, 110), step(16, 112),
+        )
+        val accumulator = SleepAwareStepCounter.Accumulator(listOf(session), hasActivityClasses = true)
+        accumulator.acceptPage(all.take(4))
+        // Intentional one-row overlap also proves that page boundaries do not double count.
+        accumulator.acceptPage(all.drop(3))
+
+        assertEquals(SleepAwareStepCounter.count(all, listOf(session)), accumulator.finish())
+        assertEquals(12, accumulator.finish().acceptedSleepBoutTicks)
+    }
+
+    @Test fun pagingUsesOneActivityClassModeForTheWholeWindow() {
+        val accumulator = SleepAwareStepCounter.Accumulator(emptyList(), hasActivityClasses = true)
+        accumulator.acceptPage(listOf(step(0, 100, null), step(1, 102, null)))
+        accumulator.acceptPage(listOf(step(2, 104, 1)))
+
+        // Unknown +2 in page one is rejected because a later page proves this is a classed stream.
+        assertEquals(2, accumulator.finish().totalTicks)
+    }
+
+    @Test fun editedBoundsKeepStagesAndTreatNewEdgesAsSleep() {
+        val detected = sleep(100, 200, listOf(StageSegment(100, 200, "light")))
+        val edited = SleepAwareStepCounter.withBounds(detected, start = 90, end = 220)
+        val samples = listOf(
+            step(89, 100), step(90, 101), step(91, 102),
+            step(210, 102), step(211, 104),
+        )
+
+        assertEquals(listOf(StageSegment(100, 200, "light")), edited.stages)
+        assertNull(SleepAwareStepCounter.stepsInWindow(samples, listOf(edited)))
+    }
+
+    @Test fun wakeEditChangesOnlyIntersectingCycleContextSignature() {
+        val before = sleep(100, 180, listOf(StageSegment(100, 180, "light")))
+        val after = SleepAwareStepCounter.withBounds(before, 100, 190)
+        assertEquals(
+            SleepAwareStepCounter.contextSignature(listOf(before), 200, 300),
+            SleepAwareStepCounter.contextSignature(listOf(after), 200, 300),
+        )
+        org.junit.Assert.assertNotEquals(
+            SleepAwareStepCounter.contextSignature(listOf(before), 100, 200),
+            SleepAwareStepCounter.contextSignature(listOf(after), 100, 200),
+        )
+    }
+}
diff --git a/android/app/src/test/java/com/noop/analytics/StepCycleIntegrationPolicyTest.kt b/android/app/src/test/java/com/noop/analytics/StepCycleIntegrationPolicyTest.kt
new file mode 100644
index 0000000000..e5f70b138b
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/StepCycleIntegrationPolicyTest.kt
@@ -0,0 +1,222 @@
+package com.noop.analytics
+
+import com.noop.data.SleepSession
+import com.noop.data.StepSample
+import com.noop.data.DailyMetric
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class StepCycleIntegrationPolicyTest {
+    private fun sleep(owner: String, start: Long, end: Long) = SleepSession(
+        deviceId = "$owner-noop",
+        startTs = start,
+        endTs = end,
+        stagesJSON = "[{\"start\":$start,\"end\":$end,\"stage\":\"light\"}]",
+    )
+
+    @Test fun calendarFallbackExistsOnlyBeforeTheFirstConfirmedCycle() {
+        assertEquals(410, DayCycleIntelligenceIntegration.integratedStepValue(410, false, null))
+        assertNull(DayCycleIntelligenceIntegration.integratedStepValue(410, true, null))
+        assertEquals(37, DayCycleIntelligenceIntegration.integratedStepValue(410, true, 37))
+    }
+
+    @Test fun establishedCycleAppliesEveryAdditiveDailyMetricTogether() {
+        val day = "2026-09-04"
+        val result = PhysiologicalStepCycleEngine.Result(
+            cycleStepsByWakeDay = mapOf(day to 42),
+            cycleStrainByWakeDay = mapOf(day to 61.0),
+            cycleCaloriesByWakeDay = mapOf(day to 1840.0),
+            cycleWorkoutCountByWakeDay = mapOf(day to 2),
+            boundaryOnsetByWakeDay = emptyMap(), firstCycleWakeDay = day,
+            recoveredOwnerMarkerRows = emptyList(),
+        )
+
+        val updated = DayCycleIntelligenceIntegration.apply(
+            DailyMetric(deviceId = "strap-noop", day = day, steps = 1, strain = 2.0,
+                activeKcalEst = 3.0, exerciseCount = 4),
+            result, "strap-noop", mutableListOf(),
+        )
+
+        assertEquals(42, updated.steps)
+        assertEquals(61.0, updated.strain)
+        assertEquals(1840.0, updated.activeKcalEst)
+        assertEquals(2, updated.exerciseCount)
+    }
+
+    @Test fun warmUnchangedCycleDoesNotReadStepRowsAgain() {
+        val old = DayCycleIntelligenceIntegration.cacheKey(
+            owner = "strap-a", sleepId = "night-a", onset = 100, end = 200,
+            stepRevision = "20500:7",
+            sleepContextSignature = "100-200:light",
+            contributingDayKeys = listOf("2026-08-20" to "hr:100:199"),
+        )
+        val same = DayCycleIntelligenceIntegration.cacheKey(
+            owner = "strap-a", sleepId = "night-a", onset = 100, end = 200,
+            stepRevision = "20500:7",
+            sleepContextSignature = "100-200:light",
+            contributingDayKeys = listOf("2026-08-20" to "hr:100:199"),
+        )
+
+        assertFalse(DayCycleIntelligenceIntegration.shouldRecount(old, same))
+    }
+
+    @Test fun activeDayChangeOrBoundaryEditRecountsOnlyTheAffectedCycle() {
+        fun key(onset: Long, witness: String) = DayCycleIntelligenceIntegration.cacheKey(
+            owner = "strap-a", sleepId = "night-a", onset = onset, end = 500,
+            stepRevision = "20500:7",
+            sleepContextSignature = "100-200:light",
+            contributingDayKeys = listOf("2026-08-21" to witness),
+        )
+        val old = key(100, "hr:100:400")
+
+        assertTrue(DayCycleIntelligenceIntegration.shouldRecount(old, key(100, "hr:120:499")))
+        assertTrue(DayCycleIntelligenceIntegration.shouldRecount(old, key(110, "hr:100:400")))
+        assertTrue(DayCycleIntelligenceIntegration.shouldRecount(null, old))
+    }
+
+    @Test fun cacheIdentityIsDeviceScoped() {
+        fun key(owner: String) = DayCycleIntelligenceIntegration.cacheKey(
+            owner = owner, sleepId = "night-a", onset = 100, end = 200,
+            stepRevision = "20500:7",
+            sleepContextSignature = "100-200:light",
+            contributingDayKeys = listOf("2026-08-20" to "same-witness"),
+        )
+
+        assertTrue(DayCycleIntelligenceIntegration.shouldRecount(key("strap-a"), key("strap-b")))
+    }
+
+    @Test fun aRealStepInsertRevisionInvalidatesButAnUnchangedRevisionDoesNot() {
+        fun key(revision: String) = DayCycleIntelligenceIntegration.cacheKey(
+            owner = "strap-a", sleepId = "night-a", onset = 100, end = 0,
+            stepRevision = revision,
+            sleepContextSignature = "100-200:light",
+            contributingDayKeys = listOf("2026-08-21" to "unchanged-day-cache"),
+        )
+        assertFalse(DayCycleIntelligenceIntegration.shouldRecount(key("20500:7"), key("20500:7")))
+        assertTrue(DayCycleIntelligenceIntegration.shouldRecount(key("20500:7"), key("20500:8")))
+    }
+
+    @Test fun effectiveSleepContextEditInvalidatesOnlyItsIntersectingCycle() {
+        fun key(context: String) = DayCycleIntelligenceIntegration.cacheKey(
+            "strap", "night", 100, 200, "day:7", context, emptyList(),
+        )
+        assertTrue(DayCycleIntelligenceIntegration.shouldRecount(key("100-180:light"), key("100-190:light")))
+        assertFalse(DayCycleIntelligenceIntegration.shouldRecount(key("unrelated"), key("unrelated")))
+    }
+
+    @Test fun archivedPredecessorRestoresOnlyAMarkerBackedMainSleepBoundary() {
+        val onset = 20 * 3_600L
+        val end = onset + 8 * 3_600L
+        val restored = DayCycleIntelligenceIntegration.persistedBoundaries(
+            candidates = listOf("strap-b" to 0, "strap-a" to 4),
+            sessionsByOwner = mapOf("strap-a" to listOf(sleep("strap-a", onset, end))),
+            markerOnsetByOwnerAndDay = mapOf("strap-a" to mapOf("1970-01-02" to onset)),
+            currentBoundaryWakeDays = emptySet(),
+            tzOffsetSeconds = 0,
+            habitualMidsleepSec = null,
+        )
+
+        assertEquals(1, restored.size)
+        assertEquals("strap-a", restored.single().owner)
+        assertEquals(onset, restored.single().boundary.onset)
+        assertEquals("1970-01-02", restored.single().wakeDay)
+        assertEquals(onset, restored.single().sleepContext.start)
+
+        // Real re-add seam: archived A supplies the morning boundary/steps; active B starts at 14:00.
+        val bStarts = 38 * 3_600L
+        val cycleEnd = 44 * 3_600L
+        assertEquals(
+            listOf(
+                PhysiologicalSteps.OwnerSegment("strap-a", onset, bStarts),
+                PhysiologicalSteps.OwnerSegment("strap-b", bStarts, cycleEnd),
+            ),
+            PhysiologicalSteps.ownerSegmentsFromCoverage(
+                PhysiologicalSteps.CycleWindow(restored.single().boundary.sleepId, onset, cycleEnd),
+                listOf(
+                    PhysiologicalSteps.OwnerCoverage("strap-a", onset, bStarts, priority = 4),
+                    PhysiologicalSteps.OwnerCoverage("strap-b", bStarts, cycleEnd, priority = 0),
+                ),
+                fallbackOwner = "strap-a",
+            ),
+        )
+        fun row(owner: String, ts: Long, counter: Int) = StepSample(owner, ts, counter, activityClass = 1)
+        val a = SleepAwareStepCounter.Accumulator(emptyList(), hasActivityClasses = true)
+            .acceptPage(listOf(row("strap-a", onset, 100), row("strap-a", onset + 3, 110))).finish()
+        val b = SleepAwareStepCounter.Accumulator(emptyList(), hasActivityClasses = true)
+            .acceptPage(listOf(row("strap-b", bStarts, 50), row("strap-b", bStarts + 2, 57))).finish()
+        assertEquals(17, a.totalTicks + b.totalTicks)
+    }
+
+    @Test fun markerRewriteCleansEveryNamespaceThatRecoveryMayRead() {
+        assertEquals(
+            listOf("strap-b-noop", "my-whoop-noop", "strap-a-noop"),
+            DayCycleIntelligenceIntegration.markerRewriteSourceIds(
+                currentComputedSources = listOf("strap-b-noop", "my-whoop-noop"),
+                candidateComputedSources = listOf("strap-b-noop", "strap-a-noop", "strap-a-noop"),
+            ),
+        )
+    }
+
+    @Test fun recoveredOwnerMarkerSurvivesCleanupAndProducesTheSameBoundaryOnPassTwo() {
+        val onset = 20 * 3_600L
+        val end = onset + 8 * 3_600L
+        val sessions = mapOf("strap-a" to listOf(sleep("strap-a", onset, end)))
+        val pass1 = DayCycleIntelligenceIntegration.persistedBoundaries(
+            candidates = listOf("strap-b" to 0, "strap-a" to 4),
+            sessionsByOwner = sessions,
+            markerOnsetByOwnerAndDay = mapOf("strap-a" to mapOf("1970-01-02" to onset)),
+            currentBoundaryWakeDays = emptySet(),
+            tzOffsetSeconds = 0,
+            habitualMidsleepSec = null,
+        )
+
+        // Model the transaction: every old candidate marker was deleted; only emitted rows survive.
+        val rewritten = DayCycleIntelligenceIntegration.recoveredMarkerRows(pass1) { "$it-noop" }
+        val pass2Markers = rewritten.groupBy { it.deviceId.removeSuffix("-noop") }
+            .mapValues { (_, rows) -> rows.associate { it.day to it.value.toLong() } }
+        val pass2 = DayCycleIntelligenceIntegration.persistedBoundaries(
+            candidates = listOf("strap-b" to 0, "strap-a" to 4),
+            sessionsByOwner = sessions,
+            markerOnsetByOwnerAndDay = pass2Markers,
+            currentBoundaryWakeDays = emptySet(),
+            tzOffsetSeconds = 0,
+            habitualMidsleepSec = null,
+        )
+
+        assertEquals(pass1.map { it.boundary }, pass2.map { it.boundary })
+        assertEquals("strap-a-noop", rewritten.single().deviceId)
+    }
+
+    @Test fun staleMarkerWithoutMatchingMainSleepSessionIsNeverResurrected() {
+        val onset = 20 * 3_600L
+        val end = onset + 8 * 3_600L
+        val recovered = DayCycleIntelligenceIntegration.persistedBoundaries(
+            candidates = listOf("strap-a" to 4),
+            sessionsByOwner = mapOf("strap-a" to listOf(sleep("strap-a", onset, end))),
+            markerOnsetByOwnerAndDay = mapOf("strap-a" to mapOf("1970-01-02" to onset - 60)),
+            currentBoundaryWakeDays = emptySet(),
+            tzOffsetSeconds = 0,
+            habitualMidsleepSec = null,
+        )
+        assertTrue(recovered.isEmpty())
+        assertTrue(DayCycleIntelligenceIntegration.recoveredMarkerRows(recovered) { "$it-noop" }.isEmpty())
+    }
+
+    @Test fun currentDetectedOrEditedBoundaryWinsOverArchivedPersistence() {
+        val onset = 20 * 3_600L
+        val end = onset + 8 * 3_600L
+        assertTrue(
+            DayCycleIntelligenceIntegration.persistedBoundaries(
+                candidates = listOf("strap-a" to 4),
+                sessionsByOwner = mapOf("strap-a" to listOf(sleep("strap-a", onset, end))),
+                markerOnsetByOwnerAndDay = mapOf("strap-a" to mapOf("1970-01-02" to onset)),
+                currentBoundaryWakeDays = setOf("1970-01-02"),
+                tzOffsetSeconds = 0,
+                habitualMidsleepSec = null,
+            ).isEmpty(),
+        )
+    }
+}
diff --git a/android/app/src/test/java/com/noop/analytics/StepsAnalyticsTest.kt b/android/app/src/test/java/com/noop/analytics/StepsAnalyticsTest.kt
index 1bcde65790..4a0d864387 100644
--- a/android/app/src/test/java/com/noop/analytics/StepsAnalyticsTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/StepsAnalyticsTest.kt
@@ -66,7 +66,7 @@ class StepsAnalyticsTest {
     fun jumpGuardDropsGapButKeepsRealSteps() {
         // 100 -> 300 (=200 real) ; 300 -> 1200 is a 900-tick GAP (>= 512) and is dropped ; 1200 -> 1500
         // (=300 real). Only the two in-range increments count => 200 + 300 = 500, the gap doesn't inflate.
-        val s = listOf(step(0, 100), step(60, 300), step(3_600, 1_200), step(3_660, 1_500))
+        val s = listOf(step(0, 100), step(60, 300), step(3_600, 1_200), step(3_675, 1_500))
         assertEquals(500, stepsFor(s))
     }
 
@@ -75,13 +75,13 @@ class StepsAnalyticsTest {
         // THE BUG (#132/#276/#316). A realistic ascending cumulative counter sampled at 1 Hz. The OLD
         // code summed the raw running total (byte @57 alone summed) — exploding the count; the NEW
         // wrap-aware diff sums only the per-record increments and yields a sane number.
-        val counters = listOf(100, 127, 127, 130, 131, 131, 140, 152, 160, 175)
+        val counters = listOf(100, 102, 102, 105, 106, 106, 109, 111, 113, 115)
         val samples = counters.mapIndexed { i, c -> step(i.toLong(), c) }
         // NEW behaviour: sum of wrap-aware deltas == last - first (all small increments, none >= 512).
         val sane = counters.last() - counters.first() // 75
         assertEquals(sane, stepsFor(samples))
         // OLD behaviour (summing the cumulative counter itself) would be vastly larger — prove the gap.
-        val oldOvercount = counters.sum() // 1373
+        val oldOvercount = counters.sum()
         org.junit.Assert.assertTrue(oldOvercount > sane * 10)
     }
 
diff --git a/android/app/src/test/java/com/noop/analytics/StepsCounterTest.kt b/android/app/src/test/java/com/noop/analytics/StepsCounterTest.kt
index 56000a8cc9..a671c82dca 100644
--- a/android/app/src/test/java/com/noop/analytics/StepsCounterTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/StepsCounterTest.kt
@@ -13,7 +13,8 @@ import org.junit.Test
  */
 class StepsCounterTest {
 
-    private fun step(ts: Long, counter: Int) = StepSample(deviceId = "my-whoop", ts = ts, counter = counter)
+    private fun step(ts: Long, counter: Int, activityClass: Int? = null) =
+        StepSample(deviceId = "my-whoop", ts = ts, counter = counter, activityClass = activityClass)
 
     @Test fun sumsPositiveConsecutiveDeltas() {
         // counters 100 -> 150 -> 220 => deltas 50 + 70 = 120
@@ -48,7 +49,35 @@ class StepsCounterTest {
 
     @Test fun maxStepDeltaBoundaryIsExclusive() {
         // Exactly MAX_STEP_DELTA (512) is dropped; 511 counts.
-        assertNull(StepsCounter.stepsInWindow(listOf(step(0, 0), step(60, 512))))
-        assertEquals(511, StepsCounter.stepsInWindow(listOf(step(0, 0), step(60, 511))))
+        assertNull(StepsCounter.stepsInWindow(listOf(step(0, 0), step(128, 512))))
+        assertEquals(511, StepsCounter.stepsInWindow(listOf(step(0, 0), step(128, 511))))
+    }
+
+    @Test fun rejectsPhysicallyImpossibleOneSecondSpikeButAllowsSameTicksAcrossTime() {
+        // Four ticks/second (240/min) remains available for a hard sprint. Seven ticks in one second is
+        // the observed household outlier and cannot be real gait; the same seven ticks across two seconds
+        // can be a small history hole and must remain recoverable.
+        assertNull(StepsCounter.stepsInWindow(listOf(step(0, 100), step(1, 107))))
+        assertEquals(7, StepsCounter.stepsInWindow(listOf(step(0, 100), step(2, 107))))
+        assertEquals(4, StepsCounter.stepsInWindow(listOf(step(0, 100), step(1, 104))))
+    }
+
+    @Test fun classedStreamCountsOnlyWalkAndRunDeltas() {
+        // Attribute each counter delta to the later sample, matching the strap's per-record class.
+        // still: +10 ignored; walk: +20; run: +15; unknown: +25 ignored => 35 locomotion ticks.
+        assertEquals(35, StepsCounter.stepsInWindow(listOf(
+            step(0, 100, 0),
+            step(10, 110, 0),
+            step(20, 130, 1),
+            step(30, 145, 2),
+            step(40, 170, null),
+        )))
+    }
+
+    @Test fun legacyUnclassedStreamKeepsCounterFallback() {
+        // Rows written before activityClass existed must retain their historical estimate.
+        assertEquals(70, StepsCounter.stepsInWindow(listOf(
+            step(0, 100), step(10, 140), step(20, 170),
+        )))
     }
 }
diff --git a/android/app/src/test/java/com/noop/data/BackupSettingsCodecTest.kt b/android/app/src/test/java/com/noop/data/BackupSettingsCodecTest.kt
index 42ba49039e..56c1347d24 100644
--- a/android/app/src/test/java/com/noop/data/BackupSettingsCodecTest.kt
+++ b/android/app/src/test/java/com/noop/data/BackupSettingsCodecTest.kt
@@ -39,6 +39,7 @@ class BackupSettingsCodecTest {
             "units.system" to "imperial",
             "units.temperature" to "celsius",
             "effort.scale" to "whoop",
+            "dayCycle.mode" to "sleep_onset",
             // #today-hosted-cards: the one layout pref carried, a JSON [String] stored under the String kind.
             "today.hostedCards" to "[\"sleep.sleepMarks\"]",
             // #1361: custom journal behaviours, a newline-joined name list — the embedded newline must
@@ -58,6 +59,7 @@ class BackupSettingsCodecTest {
         assertEquals("imperial", back["units.system"])
         assertEquals("celsius", back["units.temperature"])
         assertEquals("whoop", back["effort.scale"])
+        assertEquals("sleep_onset", back["dayCycle.mode"])
         assertEquals("[\"sleep.sleepMarks\"]", back["today.hostedCards"])
         assertEquals("Cold plunge\nMagnesium", back["journal.customBehaviors"])
         assertEquals(values.size, back.size)
diff --git a/android/app/src/test/java/com/noop/data/ReadoutDataRevisionTest.kt b/android/app/src/test/java/com/noop/data/ReadoutDataRevisionTest.kt
index 320b53580d..55b893b009 100644
--- a/android/app/src/test/java/com/noop/data/ReadoutDataRevisionTest.kt
+++ b/android/app/src/test/java/com/noop/data/ReadoutDataRevisionTest.kt
@@ -6,24 +6,28 @@ import org.junit.Test
 class ReadoutDataRevisionTest {
 
     @Test fun revisionsAdvanceOnlyForSuccessfullyInsertedRelevantRows() {
-        val initial = ReadoutDataRevisions(sleepSamples = 7, battery = 11)
+        val initial = ReadoutDataRevisions(sleepSamples = 7, battery = 11, steps = 13)
 
         assertEquals(initial, advanceReadoutDataRevisions(initial, InsertCounts()))
         assertEquals(
-            ReadoutDataRevisions(sleepSamples = 8, battery = 11),
+            ReadoutDataRevisions(sleepSamples = 8, battery = 11, steps = 13),
             advanceReadoutDataRevisions(initial, InsertCounts(hr = 1)),
         )
         assertEquals(
-            ReadoutDataRevisions(sleepSamples = 8, battery = 11),
+            ReadoutDataRevisions(sleepSamples = 8, battery = 11, steps = 13),
             advanceReadoutDataRevisions(initial, InsertCounts(gravity = 2)),
         )
         assertEquals(
-            ReadoutDataRevisions(sleepSamples = 7, battery = 12),
+            ReadoutDataRevisions(sleepSamples = 7, battery = 12, steps = 13),
             advanceReadoutDataRevisions(initial, InsertCounts(battery = 1)),
         )
         assertEquals(
-            ReadoutDataRevisions(sleepSamples = 8, battery = 12),
+            ReadoutDataRevisions(sleepSamples = 8, battery = 12, steps = 13),
             advanceReadoutDataRevisions(initial, InsertCounts(hr = 1, gravity = 1, battery = 1)),
         )
+        assertEquals(
+            ReadoutDataRevisions(sleepSamples = 7, battery = 11, steps = 14),
+            advanceReadoutDataRevisions(initial, InsertCounts(steps = 1)),
+        )
     }
 }
diff --git a/android/app/src/test/java/com/noop/data/StepDataRevisionIndexTest.kt b/android/app/src/test/java/com/noop/data/StepDataRevisionIndexTest.kt
new file mode 100644
index 0000000000..f5940bf1ba
--- /dev/null
+++ b/android/app/src/test/java/com/noop/data/StepDataRevisionIndexTest.kt
@@ -0,0 +1,53 @@
+package com.noop.data
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
+import org.junit.Test
+
+class StepDataRevisionIndexTest {
+    @Test fun newRowsInvalidateOnlyIntersectingOwnerDaysAndDuplicatesDoNothing() {
+        val index = StepDataRevisionIndex()
+        val day = 86_400L
+        val activeBefore = index.signature("strap-a", day, 2 * day)
+        val neighbourBefore = index.signature("strap-a", 2 * day, 3 * day)
+
+        index.record("strap-a", listOf(day + 100), insertedRows = 1)
+        val activeAfter = index.signature("strap-a", day, 2 * day)
+        assertNotEquals(activeBefore, activeAfter)
+        assertEquals(neighbourBefore, index.signature("strap-a", 2 * day, 3 * day))
+        assertEquals("0:0", index.signature("strap-b", 0, day))
+
+        index.record("strap-a", listOf(day + 100), insertedRows = 0)
+        assertEquals(activeAfter, index.signature("strap-a", day, 2 * day))
+    }
+
+    @Test fun delayedBackfillInvalidatesAClosedWindowButNotTheCurrentNeighbour() {
+        val index = StepDataRevisionIndex()
+        val day = 86_400L
+        val closedBefore = index.signature("strap", day, 2 * day)
+        val currentBefore = index.signature("strap", 2 * day, 3 * day)
+
+        index.record("strap", listOf(day + 42), insertedRows = 1)
+
+        assertNotEquals(closedBefore, index.signature("strap", day, 2 * day))
+        assertEquals(currentBefore, index.signature("strap", 2 * day, 3 * day))
+    }
+
+    @Test fun mixedDuplicateAndNewRowsExposeOnlyActuallyInsertedTimestamps() {
+        val day = 86_400L
+        val index = StepDataRevisionIndex()
+        val duplicateDayBefore = index.signature("strap", 0, day)
+        val newDayBefore = index.signature("strap", day, 2 * day)
+        val inserted = newlyInsertedStepTimestamps(
+            listOf(10L, day + 20),
+            listOf(-1L, 42L),
+        )
+        assertEquals(
+            listOf(day + 20),
+            inserted,
+        )
+        index.record("strap", inserted, insertedRows = inserted.size)
+        assertEquals(duplicateDayBefore, index.signature("strap", 0, day))
+        assertNotEquals(newDayBefore, index.signature("strap", day, 2 * day))
+    }
+}
diff --git a/android/app/src/test/java/com/noop/ui/ActiveCycleStepsResolverTest.kt b/android/app/src/test/java/com/noop/ui/ActiveCycleStepsResolverTest.kt
new file mode 100644
index 0000000000..7b04551e17
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/ActiveCycleStepsResolverTest.kt
@@ -0,0 +1,86 @@
+package com.noop.ui
+
+import com.noop.data.DailyMetric
+import com.noop.data.MetricSeriesRow
+import com.noop.analytics.DayCycleMode
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+class ActiveCycleStepsResolverTest {
+    @Test fun allLiveAdditiveMetricsResolveTheSameConfiguredStart() {
+        assertEquals(1234L, activeDayCycleStart(DayCycleMode.SLEEP_ONSET, 1234L, 2000L))
+        assertEquals(2000L, activeDayCycleStart(DayCycleMode.MIDNIGHT, 1234L, 2000L))
+        assertEquals(2000L, activeDayCycleStart(DayCycleMode.SLEEP_ONSET, null, 2000L))
+    }
+    private fun day(key: String, steps: Int?) =
+        DailyMetric(deviceId = "my-whoop-noop", day = key, steps = steps)
+
+    private fun onset(day: String, ts: Long) = MetricSeriesRow(
+        deviceId = "my-whoop-noop",
+        day = day,
+        key = "day_cycle_onset_ts",
+        value = ts.toDouble(),
+    )
+
+    @Test fun publishedActiveStrapReplacesConstructionTimeFallback() {
+        assertEquals("strap-b", effectiveActiveStrapId("strap-b", "strap-a"))
+        assertEquals("strap-a", effectiveActiveStrapId(null, "strap-a"))
+    }
+
+    @Test fun activeCycleIgnoresTheFourAmLogicalDayRollover() {
+        val days = listOf(day("2026-08-20", 6_000), day("2026-08-21", null))
+
+        assertEquals(
+            ActiveDayCycle("2026-08-20", 1_000L, 6_000),
+            resolveActiveDayCycle(days, days, listOf(onset("2026-08-20", 1_000L)), nowSeconds = 5_000L),
+        )
+    }
+
+    @Test fun newlyRecognisedMainSleepSwitchesToItsWakeDayCycle() {
+        val days = listOf(day("2026-08-20", 6_000), day("2026-08-21", 17))
+        val markers = listOf(onset("2026-08-20", 1_000L), onset("2026-08-21", 4_000L))
+
+        assertEquals(
+            ActiveDayCycle("2026-08-21", 4_000L, 17),
+            resolveActiveDayCycle(days, days, markers, nowSeconds = 5_000L),
+        )
+    }
+
+    @Test fun futureAndMalformedMarkersCannotMoveTheTile() {
+        val days = listOf(day("2026-08-20", 6_000), day("2026-08-21", 17))
+        val markers = listOf(
+            onset("2026-08-20", 1_000L),
+            onset("2026-08-21", 9_000L),
+            onset("2026-08-22", 0L),
+        )
+
+        assertEquals(
+            ActiveDayCycle("2026-08-20", 1_000L, 6_000),
+            resolveActiveDayCycle(days, days, markers, nowSeconds = 5_000L),
+        )
+    }
+
+    @Test fun noConfirmedCycleHasNoOverrideSoCalendarFallbackCanRemain() {
+        val days = listOf(day("2026-08-21", 400))
+        assertNull(resolveActiveDayCycle(days, days, emptyList(), 5_000L))
+    }
+
+    @Test fun importedMergedStepsCannotOverrideTheComputedCycleValue() {
+        val merged = listOf(day("2026-08-21", 410))
+        val computed = listOf(day("2026-08-21", 17))
+        assertEquals(
+            ActiveDayCycle("2026-08-21", 1_000, 17),
+            resolveActiveDayCycle(merged, computed, listOf(onset("2026-08-21", 1_000)), 5_000),
+        )
+    }
+
+    @Test fun newestMarkerStillDrivesNonStepMetricsWithoutAComputedStepValue() {
+        val days = listOf(day("2026-08-20", 6_000), day("2026-08-21", null))
+        val markers = listOf(onset("2026-08-20", 1_000), onset("2026-08-21", 4_000))
+        assertEquals(
+            ActiveDayCycle("2026-08-21", 4_000, null),
+            resolveActiveDayCycle(days, days, markers, 5_000),
+        )
+    }
+}

From b3f8333ceec020ee04e660fe587b5489ddd14f7b Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 5 Sep 2026 14:40:13 +1200
Subject: [PATCH 243/333] daycycle: drop a dead parameter and pin the two
 branches nothing reached (#1572 follow-up)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cleanup on top of #1572, found while reviewing it. No window boundary changes.

`DayCycleResolver.activeWindow` took a `reliableAwakeCoverage` flag that neither platform's body read
and every call site passed a constant — residue of a gate that was dropped while the parameter was
not. Two Kotlin cases are why it survived: their names asserted a coverage distinction the code never
made, and both passed either way. Renamed to what they actually pin.

Then two branches that existed but were pinned by nothing:

- `fallbackMidnightAfter` picks `floorDiv(minimum, day) * day`, always at or below `minimum`, so the
  direct branch is reachable only on exact equality — onset precisely 18 h before a midnight. Every
  case on both platforms used an onset that rolls past it, so `>=` weakened to `>` would have moved
  that boundary a day with nothing failing.
- Every day-cycle case passed a ZERO timezone offset, so the arithmetic deciding which LOCAL day a
  boundary lands on was unpinned — the input this repo has already been bitten by, when nights
  re-bucketed on travel. 06:00 local at UTC-5 resolves to 104_400: 29 h UTC, 00:00 local.

Both were verified by mutation rather than argument: each new case fails alone under the
corresponding break, while every pre-existing case stays green.
---
 .../Sources/StrandAnalytics/DayCycle.swift    |  9 ++--
 .../StrandAnalyticsTests/DayCycleTests.swift  | 43 ++++++++++++++++---
 .../DayCycleIntelligenceIntegration.swift     |  2 +-
 .../main/java/com/noop/analytics/DayCycle.kt  |  6 ++-
 .../analytics/PhysiologicalStepCycleEngine.kt |  1 -
 .../noop/analytics/DayCycleResolverTest.kt    | 40 ++++++++++++++---
 6 files changed, 82 insertions(+), 19 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/DayCycle.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/DayCycle.swift
index ddd142eb2a..a2218230f0 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/DayCycle.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/DayCycle.swift
@@ -50,12 +50,15 @@ public enum DayCycleResolver {
 
     /// Kotlin twin: `DayCycleResolver.activeWindow`.
     public static func activeWindow(mode: DayCycleMode, latestSleep: DayCycleWindow?, now: Int,
-                                    offsetSec: Int, reliableAwakeCoverage: Bool) -> DayCycleWindow {
+                                    offsetSec: Int) -> DayCycleWindow {
         guard mode == .sleepOnset, let latestSleep else { return calendarWindow(now: now, offsetSec: offsetSec) }
         let age = now - latestSleep.startInclusive
         let fallback = fallbackMidnight(after: latestSleep.startInclusive, offsetSec: offsetSec)
-        // Sleep-onset mode remains anchored across midnight when awake coverage is unavailable.
-        // Only the absolute safety cap may synthesize a fallback boundary.
+        // Sleep-onset mode stays anchored across midnight unconditionally: only the absolute safety cap
+        // may synthesize a fallback boundary. An earlier design gated this on whether awake coverage was
+        // reliable and carried a `reliableAwakeCoverage` parameter for it; the gate was dropped but the
+        // parameter survived, unread on both platforms and passed `false` by every one of its five call
+        // sites. Removed rather than left looking like a switch someone could flip.
         guard age < absoluteMaxOpenSeconds else {
             let day = AnalyticsEngine.dayString(fallback, offsetSec: offsetSec)
             return DayCycleWindow(id: "synthetic:\(day)", startInclusive: fallback, endExclusive: now,
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/DayCycleTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/DayCycleTests.swift
index f159a0edea..edce96cf2e 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/DayCycleTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/DayCycleTests.swift
@@ -6,29 +6,60 @@ final class DayCycleTests: XCTestCase {
         XCTAssertEqual(DayCycleMode.persisted(nil), .sleepOnset)
         XCTAssertEqual(DayCycleMode.persisted("midnight"), .midnight)
         let window = DayCycleResolver.activeWindow(mode: .midnight, latestSleep: nil, now: 86_500,
-                                                   offsetSec: 0, reliableAwakeCoverage: false)
+                                                   offsetSec: 0)
         XCTAssertEqual(window.startInclusive, 86_400)
         XCTAssertEqual(window.source, .calendar)
     }
 
-    func testMissingWakeEvidenceKeepsSleepOnsetCycleAcrossMidnight() {
+    func testSleepOnsetCycleStaysOpenAcrossMidnight() {
         let sleep = DayCycleWindow(id: "sleep", startInclusive: 20 * 3_600, endExclusive: 0,
                                    displayDay: "1970-01-01", source: .detectedSleep)
         let fallback = DayCycleResolver.fallbackMidnight(after: sleep.startInclusive, offsetSec: 0)
         XCTAssertEqual(fallback, 2 * 86_400)
         let active = DayCycleResolver.activeWindow(mode: .sleepOnset, latestSleep: sleep,
-                                                   now: fallback, offsetSec: 0,
-                                                   reliableAwakeCoverage: false)
+                                                   now: fallback, offsetSec: 0)
         XCTAssertEqual(active.source, .detectedSleep)
         XCTAssertEqual(active.startInclusive, sleep.startInclusive)
     }
 
+    /// Both branches of the 18-hour fallback rule, which neither platform pinned.
+    ///
+    /// `fallbackMidnight` returns the first midnight at least `minSyntheticMidnightAgeSeconds` after onset.
+    /// Because the candidate is `floor(minimum / day) * day`, it is at or BELOW `minimum` always — so the
+    /// direct branch is reachable only on exact equality, when onset sits precisely 18 h before a midnight.
+    /// Every existing case here and on Kotlin used an onset that rolls, so a `>=` quietly weakened to `>`
+    /// would have moved that boundary a full day and nothing would have failed.
+    func testFallbackTakesTheMidnightExactlyEighteenHoursAfterOnset() {
+        // 06:00 + 18 h lands exactly on the next midnight: taken directly, not rolled past.
+        XCTAssertEqual(DayCycleResolver.fallbackMidnight(after: 6 * 3_600, offsetSec: 0), 86_400)
+    }
+
+    /// The rolling branch at a different onset from the case above, so the two are not the same test twice.
+    func testFallbackRollsWhenTheNextMidnightIsTooSoon() {
+        // 23:00 + 18 h overshoots the next midnight, so the one after it wins.
+        XCTAssertEqual(DayCycleResolver.fallbackMidnight(after: 23 * 3_600, offsetSec: 0), 2 * 86_400)
+    }
+
+    /// The boundary is LOCAL midnight, not UTC midnight — and until now nothing said so. Every
+    /// day-cycle case on both platforms passed a zero offset, so the whole offset arithmetic, which is
+    /// the part that decides which local day a boundary lands on, was unpinned. This repo has already
+    /// had days re-bucket on travel once, so it is worth a case rather than an argument.
+    ///
+    /// 06:00 local at UTC-5 is 11:00 UTC. Plus 18 h is 05:00 UTC the next day, which IS local midnight
+    /// there, so the direct branch takes it: 104_400 = 29 h UTC = 00:00 local. A resolver that floored
+    /// to UTC midnight would answer 86_400 and be a day out for a third of the planet.
+    func testFallbackLandsOnLocalMidnightNotUTC() {
+        let offsetSec = -5 * 3_600
+        let onsetLocal0600 = 6 * 3_600 - offsetSec
+        XCTAssertEqual(DayCycleResolver.fallbackMidnight(after: onsetLocal0600, offsetSec: offsetSec),
+                       104_400)
+    }
+
     func testAbsoluteCapStillUsesSyntheticMidnight() {
         let sleep = DayCycleWindow(id: "sleep", startInclusive: 0, endExclusive: 0,
                                    displayDay: "1970-01-01", source: .detectedSleep)
         XCTAssertEqual(DayCycleResolver.activeWindow(mode: .sleepOnset, latestSleep: sleep,
-                                                     now: 40 * 3_600, offsetSec: 0,
-                                                     reliableAwakeCoverage: false).source,
+                                                     now: 40 * 3_600, offsetSec: 0).source,
                        .syntheticMidnight)
     }
 
diff --git a/Strand/Data/DayCycleIntelligenceIntegration.swift b/Strand/Data/DayCycleIntelligenceIntegration.swift
index 5f8eb478ff..386e805c45 100644
--- a/Strand/Data/DayCycleIntelligenceIntegration.swift
+++ b/Strand/Data/DayCycleIntelligenceIntegration.swift
@@ -163,7 +163,7 @@ import WhoopStore
             let active = DayCycleResolver.activeWindow(mode: mode,
                 latestSleep: DayCycleWindow(id: latest.sleepId, startInclusive: latest.onset,
                     endExclusive: now, displayDay: day, source: .detectedSleep), now: now,
-                offsetSec: offsetSec, reliableAwakeCoverage: false)
+                offsetSec: offsetSec)
             if active.source == .syntheticMidnight {
                 boundaries.append(.init(sleepId: active.id, onset: active.startInclusive))
                 wakeDayById[active.id] = active.displayDay; ownerById[active.id] = owner
diff --git a/android/app/src/main/java/com/noop/analytics/DayCycle.kt b/android/app/src/main/java/com/noop/analytics/DayCycle.kt
index 50dacc4aeb..3f96e1a9d7 100644
--- a/android/app/src/main/java/com/noop/analytics/DayCycle.kt
+++ b/android/app/src/main/java/com/noop/analytics/DayCycle.kt
@@ -54,13 +54,17 @@ object DayCycleResolver {
     /**
      * Resolve the active window. Sleep-onset mode stays open across midnight even when awake coverage is
      * unavailable. The absolute cap still prevents a stale sleep boundary from remaining active forever.
+     *
+     * That "even when" is unconditional, not a gate: an earlier design decided it from whether awake
+     * coverage was reliable and carried a `reliableAwakeCoverage` parameter for it. The gate was dropped
+     * but the parameter survived — unread on both platforms, and passed `false` by every one of its call
+     * sites — so it was removed rather than left looking like a switch someone could flip.
      */
     fun activeWindow(
         mode: DayCycleMode,
         latestSleep: DayCycleWindow?,
         now: Long,
         tzOffsetSeconds: Long,
-        reliableAwakeCoverage: Boolean,
     ): DayCycleWindow {
         if (mode == DayCycleMode.MIDNIGHT || latestSleep == null) {
             return calendarWindow(now, tzOffsetSeconds)
diff --git a/android/app/src/main/java/com/noop/analytics/PhysiologicalStepCycleEngine.kt b/android/app/src/main/java/com/noop/analytics/PhysiologicalStepCycleEngine.kt
index 1fd1a69bbf..82c8fc3066 100644
--- a/android/app/src/main/java/com/noop/analytics/PhysiologicalStepCycleEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/PhysiologicalStepCycleEngine.kt
@@ -174,7 +174,6 @@ internal object PhysiologicalStepCycleEngine {
                     ),
                     now = nowSeconds,
                     tzOffsetSeconds = tzOffsetSeconds,
-                    reliableAwakeCoverage = false,
                 )
                 if (active.source == DayCycleWindow.Source.SYNTHETIC_MIDNIGHT) {
                     val synthetic = PhysiologicalSteps.CycleBoundary(active.id, active.startInclusive)
diff --git a/android/app/src/test/java/com/noop/analytics/DayCycleResolverTest.kt b/android/app/src/test/java/com/noop/analytics/DayCycleResolverTest.kt
index d8f3e56cbe..9af0b889f3 100644
--- a/android/app/src/test/java/com/noop/analytics/DayCycleResolverTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/DayCycleResolverTest.kt
@@ -9,28 +9,54 @@ class DayCycleResolverTest {
         assertEquals(DayCycleMode.SLEEP_ONSET, DayCycleMode.fromPersisted("unknown"))
     }
 
-    @Test fun fallbackUsesTheFirstMidnightAtLeastEighteenHoursAfterOnset() {
+    @Test fun fallbackRollsWhenTheNextMidnightIsTooSoon() {
+        // 23:00 + 18 h overshoots the next midnight, so the one after it wins.
         val monday2300 = 23 * 3_600L
         assertEquals(2 * 86_400L, DayCycleResolver.fallbackMidnightAfter(monday2300, 0))
     }
 
-    @Test fun reliableAllNighterStaysOpenUntilTheAbsoluteCap() {
+    /**
+     * The other branch, which neither platform pinned. The candidate midnight is
+     * `floorDiv(minimum, day) * day`, so it is at or BELOW `minimum` always — the direct branch is
+     * reachable only on exact equality, when onset sits precisely 18 h before a midnight. Every other
+     * case here rolls, so a `>=` quietly weakened to `>` would move this boundary a full day unseen.
+     */
+    @Test fun fallbackTakesTheMidnightExactlyEighteenHoursAfterOnset() {
+        assertEquals(86_400L, DayCycleResolver.fallbackMidnightAfter(6 * 3_600L, 0))
+    }
+
+    /**
+     * The boundary is LOCAL midnight, not UTC midnight — and until now nothing said so. Every day-cycle
+     * case on both platforms passed a zero offset, so the offset arithmetic, which decides which local
+     * day a boundary lands on, was unpinned. This repo has already had days re-bucket on travel once.
+     *
+     * 06:00 local at UTC-5 is 11:00 UTC. Plus 18 h is 05:00 UTC the next day, which IS local midnight
+     * there, so the direct branch takes it: 104_400 = 29 h UTC = 00:00 local. A resolver that floored to
+     * UTC midnight would answer 86_400 and be a day out for a third of the planet.
+     */
+    @Test fun fallbackLandsOnLocalMidnightNotUtc() {
+        val offset = -5 * 3_600L
+        val onsetLocal0600 = 6 * 3_600L - offset
+        assertEquals(104_400L, DayCycleResolver.fallbackMidnightAfter(onsetLocal0600, offset))
+    }
+
+    @Test fun allNighterStaysOpenUntilTheAbsoluteCap() {
         val sleep = DayCycleWindow("night", 0, 0, "1970-01-01", DayCycleWindow.Source.DETECTED_SLEEP)
         assertEquals(
             DayCycleWindow.Source.DETECTED_SLEEP,
-            DayCycleResolver.activeWindow(DayCycleMode.SLEEP_ONSET, sleep, 39 * 3_600L, 0, true).source,
+            DayCycleResolver.activeWindow(DayCycleMode.SLEEP_ONSET, sleep, 39 * 3_600L, 0).source,
         )
         assertEquals(
             DayCycleWindow.Source.SYNTHETIC_MIDNIGHT,
-            DayCycleResolver.activeWindow(DayCycleMode.SLEEP_ONSET, sleep, 40 * 3_600L, 0, true).source,
+            DayCycleResolver.activeWindow(DayCycleMode.SLEEP_ONSET, sleep, 40 * 3_600L, 0).source,
         )
     }
 
-    @Test fun missingCoverageKeepsSleepOnsetCycleOpenAcrossMidnight() {
+    @Test fun sleepOnsetCycleStaysOpenAcrossMidnight() {
         val sleep = DayCycleWindow("night", 23 * 3_600L, 0, "1970-01-02", DayCycleWindow.Source.DETECTED_SLEEP)
         assertEquals(
             DayCycleWindow.Source.DETECTED_SLEEP,
-            DayCycleResolver.activeWindow(DayCycleMode.SLEEP_ONSET, sleep, 2 * 86_400L + 60, 0, false).source,
+            DayCycleResolver.activeWindow(DayCycleMode.SLEEP_ONSET, sleep, 2 * 86_400L + 60, 0).source,
         )
     }
 
@@ -38,7 +64,7 @@ class DayCycleResolverTest {
         val sleep = DayCycleWindow("night", 23 * 3_600L, 0, "1970-01-02", DayCycleWindow.Source.DETECTED_SLEEP)
         assertEquals(
             DayCycleWindow.Source.CALENDAR,
-            DayCycleResolver.activeWindow(DayCycleMode.MIDNIGHT, sleep, 2 * 86_400L + 60, 0, true).source,
+            DayCycleResolver.activeWindow(DayCycleMode.MIDNIGHT, sleep, 2 * 86_400L + 60, 0).source,
         )
     }
 }

From 49bf53dabd9fcf14e1caf2b46dfba7fd75fc539f Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 5 Sep 2026 16:08:45 +1200
Subject: [PATCH 244/333] analytics: retrospective TDEE from logged intake and
 the weight trend
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Answers a question NOOP could not answer — "what do I actually burn in a day?" — from data it already
holds. The nutrition CSV importer persists `calories_in` and `weight` as metric series, and nothing has
ever read them together.

Energy balance: expenditure = intake - change in stored energy, at the conventional 7,700 kcal per kg.
The identity is exact; the inputs are not. Day-to-day weight is mostly water and food logs are
under-reported by a wide, person-specific margin, so most of the engine is about refusing to answer:
three weeks minimum, six maximum, a fortnight of intake logs AND 70% coverage, six weigh-in days. Most
installs get nil, which is the correct answer for them.

The output is an interval with a coarse confidence, never a bare number, and it feeds NOTHING — not
Charge, not the calorie card, not workout calories. Those come from measured heart rate through
Keytel, and overwriting a measurement with an inference from a food diary would be a strictly worse
number wearing the same label.

Two review passes found defects in the honesty machinery rather than the arithmetic, which is where
the risk in this method lives: an inclusive day count read with a strict `<`, so the window kept one
fewer day than it reported; and both coverage measures counting entries rather than days, which let a
repeated day shrink the interval and raise the confidence. Each is pinned by a case verified to fail
on the bug alone.

Twelve matching cases per platform, including both signs of the weight trend — a flipped sign is the
classic error in this formula. Engine only: no UI, no schema, no migration.
---
 .../AdaptiveExpenditureEngine.swift           | 170 ++++++++++++++++++
 .../AdaptiveExpenditureEngineTests.swift      | 127 +++++++++++++
 .../analytics/AdaptiveExpenditureEngine.kt    | 158 ++++++++++++++++
 .../AdaptiveExpenditureEngineTest.kt          | 151 ++++++++++++++++
 4 files changed, 606 insertions(+)
 create mode 100644 Packages/StrandAnalytics/Sources/StrandAnalytics/AdaptiveExpenditureEngine.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AdaptiveExpenditureEngineTests.swift
 create mode 100644 android/app/src/main/java/com/noop/analytics/AdaptiveExpenditureEngine.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/AdaptiveExpenditureEngineTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/AdaptiveExpenditureEngine.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/AdaptiveExpenditureEngine.swift
new file mode 100644
index 0000000000..0789991c4a
--- /dev/null
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/AdaptiveExpenditureEngine.swift
@@ -0,0 +1,170 @@
+import Foundation
+
+/// One day's inputs for the retrospective expenditure estimate. Both fields are optional because the two
+/// series are independently sparse — a day with a weigh-in and no food log is common, and inventing a
+/// value for the missing one is exactly what this engine must not do.
+public struct AdaptiveExpenditureDay: Equatable, Sendable {
+    public let day: String          // "yyyy-MM-dd", the app's day key
+    public let caloriesIn: Double?
+    public let weightKg: Double?
+
+    public init(day: String, caloriesIn: Double? = nil, weightKg: Double? = nil) {
+        self.day = day; self.caloriesIn = caloriesIn; self.weightKg = weightKg
+    }
+}
+
+/// How much the estimate below deserves to be trusted. Deliberately coarse — the inputs do not support
+/// a percentage, and a number would imply a precision this method does not have.
+public enum AdaptiveExpenditureConfidence: String, Equatable, Sendable {
+    case building, moderate, high
+}
+
+/// A retrospective estimate of average daily energy expenditure, with an interval.
+///
+/// Never a single number: the method's error is dominated by things this engine cannot see (hydration
+/// swings, an under-logged weekend), so a bare figure would be the fabrication the rest of NOOP refuses
+/// to make. The interval is the honest output and the caller should render it as one.
+public struct AdaptiveExpenditureEstimate: Equatable, Sendable {
+    public let estimatedDailyKcal: Double
+    public let lowerKcal: Double
+    public let upperKcal: Double
+    public let meanIntakeKcal: Double
+    public let weightSlopeKgPerDay: Double
+    public let intakeDays: Int
+    public let weightReadings: Int
+    public let windowDays: Int
+    public let confidence: AdaptiveExpenditureConfidence
+
+    public init(estimatedDailyKcal: Double, lowerKcal: Double, upperKcal: Double, meanIntakeKcal: Double,
+                weightSlopeKgPerDay: Double, intakeDays: Int, weightReadings: Int, windowDays: Int,
+                confidence: AdaptiveExpenditureConfidence) {
+        self.estimatedDailyKcal = estimatedDailyKcal; self.lowerKcal = lowerKcal; self.upperKcal = upperKcal
+        self.meanIntakeKcal = meanIntakeKcal; self.weightSlopeKgPerDay = weightSlopeKgPerDay
+        self.intakeDays = intakeDays; self.weightReadings = weightReadings; self.windowDays = windowDays
+        self.confidence = confidence
+    }
+}
+
+/// Average daily expenditure inferred from logged intake and the weight trend (TDEE by energy balance).
+///
+/// `expenditure = intake − change in stored energy`, with the conventional 7,700 kcal per kg of body mass.
+/// The identity is exact; the inputs are not. Day-to-day weight is mostly water, and food logs are
+/// under-reported by a wide and person-specific margin, so this is meaningful only over weeks and only as
+/// a range.
+///
+/// DELIBERATELY NOT AN INPUT TO ANYTHING. It never feeds Charge, the calorie card, or the workout
+/// calorie estimate: those come from measured heart rate through Keytel, and quietly overwriting a
+/// measurement with an inference from a food diary would be a strictly worse number wearing the same
+/// label. This answers a question the user asks explicitly, and returns nil rather than guess.
+///
+/// Kotlin twin: `AdaptiveExpenditureEngine`.
+public enum AdaptiveExpenditureEngine {
+    /// Energy density of body-mass change. The textbook 7,700 kcal/kg (≈3,500 kcal/lb) figure, which
+    /// assumes the change is adipose; it over-states early loss, when a real share of it is glycogen and
+    /// its bound water. That bias is one reason the output is an interval.
+    public static let kcalPerKg = 7_700.0
+
+    /// Windows. Three weeks is the floor because a week of water retention can hide a 500 kcal/day gap,
+    /// and six weeks is the ceiling because beyond that the body's own expenditure has adapted and the
+    /// average stops describing today.
+    public static let minWindowDays = 21
+    public static let maxWindowDays = 42
+
+    /// Coverage floors. Intake is the weak input, so it carries the strictest gate: a fortnight of logs
+    /// AND 70% of the window, which together reject the common "logged hard for five days" pattern that
+    /// would otherwise read as a huge deficit.
+    public static let minIntakeDays = 14
+    public static let minIntakeCoverage = 0.70
+    public static let minWeightReadings = 6
+
+    /// nil when the history cannot support an estimate — the normal answer for most installs, and the
+    /// point of the gates. `days` need not be sorted or contiguous.
+    public static func estimate(days: [AdaptiveExpenditureDay]) -> AdaptiveExpenditureEstimate? {
+        let ordered = days.sorted { $0.day < $1.day }
+        guard let first = ordered.first?.day, let last = ordered.last?.day,
+              let span = dayCount(from: first, to: last), span >= minWindowDays else { return nil }
+        let window = min(span, maxWindowDays)
+        // Keep the most RECENT `window` days: an adapted metabolism makes the tail the honest part.
+        let recent = ordered.filter { d in
+            guard let back = dayCount(from: d.day, to: last) else { return false }
+            // `dayCount` is INCLUSIVE — `dayCount(last, last)` is 1 — so the last `window` days are
+            // `back <= window`. A strict `<` silently drops the oldest day while still reporting the
+            // full `window`, which both loses data and understates coverage.
+            return back <= window
+        }
+
+        let intake = recent.compactMap { $0.caloriesIn }.filter { $0 > 0 }
+        let weights = recent.compactMap { d -> (Int, Double)? in
+            guard let w = d.weightKg, w > 0, let i = dayCount(from: first, to: d.day) else { return nil }
+            return (i, w)
+        }
+        guard intake.count >= minIntakeDays,
+              min(1.0, Double(intake.count) / Double(window)) >= minIntakeCoverage,
+              Set(weights.map { $0.0 }).count >= minWeightReadings,
+              let slope = leastSquaresSlope(weights) else { return nil }
+
+        let meanIntake = intake.reduce(0, +) / Double(intake.count)
+        // The identity. A RISING weight means intake exceeded expenditure, so the stored-energy term is
+        // subtracted — getting this sign backwards is the classic error and it is why the test pins both
+        // directions rather than only a deficit.
+        let estimate = meanIntake - slope * kcalPerKg
+
+        // Interval. Half a kilo of water across the window is an everyday swing and translates directly
+        // into an apparent daily gap; the intake half widens as coverage falls, because the days someone
+        // fails to log are not a random sample of their eating.
+        let waterKcalPerDay = (0.5 * kcalPerKg) / Double(window)
+        // Clamped: `coverage` is "share of the window that was logged", so it cannot exceed 1. A caller
+        // that merged its two sparse series badly and passed a day twice would otherwise push it above 1,
+        // which SHRINKS the margin and RAISES the confidence — making the answer look more certain than
+        // its data, the one direction this engine must never err in. Clamping rather than de-duplicating
+        // on purpose: silently picking one of two conflicting values for a day would hide the caller's bug.
+        let coverage = min(1.0, Double(intake.count) / Double(window))
+        let intakeUncertainty = meanIntake * 0.10 * (1.0 - coverage) + meanIntake * 0.05
+        let margin = waterKcalPerDay + intakeUncertainty
+
+        // DISTINCT days, not readings. Two weigh-ins on one morning are one day of evidence about the
+        // trend, and counting both would let a chatty scale — or a caller that passed a day twice — buy
+        // the same confidence as a fortnight of extra data.
+        let weightDays = Set(weights.map { $0.0 }).count
+        let confidence: AdaptiveExpenditureConfidence
+        if window >= 28 && coverage >= 0.90 && weightDays >= 12 { confidence = .high }
+        else if window >= 21 && coverage >= 0.80 { confidence = .moderate }
+        else { confidence = .building }
+
+        return AdaptiveExpenditureEstimate(
+            estimatedDailyKcal: estimate,
+            lowerKcal: estimate - margin, upperKcal: estimate + margin,
+            meanIntakeKcal: meanIntake, weightSlopeKgPerDay: slope,
+            intakeDays: min(intake.count, window), weightReadings: weightDays, windowDays: window,
+            confidence: confidence)
+    }
+
+    /// Ordinary least-squares slope in kg per DAY. nil when every reading shares one day, which would
+    /// divide by zero — a real case when a scale syncs several readings with one timestamp.
+    static func leastSquaresSlope(_ points: [(Int, Double)]) -> Double? {
+        let n = Double(points.count)
+        guard n >= 2 else { return nil }
+        let meanX = points.reduce(0.0) { $0 + Double($1.0) } / n
+        let meanY = points.reduce(0.0) { $0 + $1.1 } / n
+        var num = 0.0, den = 0.0
+        for (x, y) in points {
+            let dx = Double(x) - meanX
+            num += dx * (y - meanY); den += dx * dx
+        }
+        guard den > 0 else { return nil }
+        return num / den
+    }
+
+    /// Whole days between two "yyyy-MM-dd" keys, inclusive of the first.
+    ///
+    /// nil on an unparseable key. `AnalyticsEngine.dayStartUtcSeconds` is deliberately nil-tolerant and
+    /// returns 0 for one (so a bad key cannot take down a scoring pass), which is indistinguishable from
+    /// 1970 here — and a stray 0 would silently stretch the window by twenty thousand days. Treating a
+    /// zero as unparseable is the difference between refusing to answer and answering nonsense.
+    static func dayCount(from: String, to: String) -> Int? {
+        let a = AnalyticsEngine.dayStartUtcSeconds(from)
+        let b = AnalyticsEngine.dayStartUtcSeconds(to)
+        guard a > 0, b > 0 else { return nil }
+        return (b - a) / 86_400 + 1
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AdaptiveExpenditureEngineTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AdaptiveExpenditureEngineTests.swift
new file mode 100644
index 0000000000..98d483807b
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AdaptiveExpenditureEngineTests.swift
@@ -0,0 +1,127 @@
+import Foundation
+import XCTest
+@testable import StrandAnalytics
+
+/// TDEE by energy balance — the twin of the Kotlin `AdaptiveExpenditureEngineTest`, asserting the same
+/// cases with the same inputs so the two cannot drift.
+///
+/// The identity is `expenditure = intake - stored-energy change`. Most of what matters here is refusing
+/// to answer: the method is meaningful only over weeks, and most installs will never log enough intake.
+final class AdaptiveExpenditureEngineTests: XCTestCase {
+
+    /// A synthetic history: `days` long, intake every `logEvery` days, weight every `weighEvery`.
+    private func history(days: Int, intake: Double = 2_400, startKg: Double = 80,
+                         kgPerDay: Double = 0, logEvery: Int = 1,
+                         weighEvery: Int = 3) -> [AdaptiveExpenditureDay] {
+        (0..<days).map { i in
+            AdaptiveExpenditureDay(
+                day: dayKey(i),
+                caloriesIn: i % logEvery == 0 ? intake : nil,
+                weightKg: i % weighEvery == 0 ? startKg + kgPerDay * Double(i) : nil)
+        }
+    }
+
+    /// Sequential "yyyy-MM-dd" keys from 2026-01-01, so the engine's own date maths is exercised.
+    private func dayKey(_ offset: Int) -> String {
+        var c = DateComponents(); c.year = 2026; c.month = 1; c.day = 1 + offset
+        var cal = Calendar(identifier: .gregorian)
+        cal.timeZone = TimeZone(identifier: "UTC")!
+        let d = cal.date(from: c)!
+        let f = DateFormatter()
+        f.calendar = cal; f.timeZone = cal.timeZone
+        f.locale = Locale(identifier: "en_US_POSIX"); f.dateFormat = "yyyy-MM-dd"
+        return f.string(from: d)
+    }
+
+    /// Weight flat ⇒ expenditure equals intake. The simplest reading of the identity.
+    func testStableWeightPutsExpenditureAtIntake() throws {
+        let est = try XCTUnwrap(AdaptiveExpenditureEngine.estimate(days: history(days: 30)))
+        XCTAssertEqual(est.estimatedDailyKcal, 2_400, accuracy: 1)
+        XCTAssertEqual(est.weightSlopeKgPerDay, 0, accuracy: 1e-9)
+    }
+
+    /// Losing weight ⇒ expenditure EXCEEDED intake, so the estimate is ABOVE what was eaten. The sign is
+    /// the classic error in this formula, so both directions are pinned rather than one.
+    func testLosingWeightPutsExpenditureAboveIntake() throws {
+        let est = try XCTUnwrap(AdaptiveExpenditureEngine.estimate(days: history(days: 30, kgPerDay: -0.05)))
+        // 0.05 kg/day * 7700 = 385 kcal/day of stored energy released.
+        XCTAssertEqual(est.estimatedDailyKcal, 2_400 + 385, accuracy: 2)
+        XCTAssertGreaterThan(est.estimatedDailyKcal, est.meanIntakeKcal)
+    }
+
+    /// And the mirror: gaining weight means expenditure fell SHORT of intake.
+    func testGainingWeightPutsExpenditureBelowIntake() throws {
+        let est = try XCTUnwrap(AdaptiveExpenditureEngine.estimate(days: history(days: 30, kgPerDay: 0.05)))
+        XCTAssertEqual(est.estimatedDailyKcal, 2_400 - 385, accuracy: 2)
+        XCTAssertLessThan(est.estimatedDailyKcal, est.meanIntakeKcal)
+    }
+
+    /// Under three weeks the method is not meaningful, so it declines rather than answering.
+    func testShortHistoryYieldsNothing() {
+        XCTAssertNil(AdaptiveExpenditureEngine.estimate(days: history(days: 20)))
+    }
+
+    /// The gate that matters most in practice: someone logs hard for a fortnight of a long window and
+    /// stops. The skipped days are not a random sample of their eating, so a mean over them would read
+    /// as a large false deficit.
+    func testSparseIntakeLoggingYieldsNothing() {
+        XCTAssertNil(AdaptiveExpenditureEngine.estimate(days: history(days: 40, logEvery: 3)))
+    }
+
+    /// Weight is the other half of the identity; too few readings cannot establish a trend.
+    func testTooFewWeighInsYieldsNothing() {
+        XCTAssertNil(AdaptiveExpenditureEngine.estimate(days: history(days: 30, weighEvery: 10)))
+    }
+
+    /// The output is a RANGE, and the estimate must sit inside it.
+    func testEstimateIsBracketedByItsInterval() throws {
+        let est = try XCTUnwrap(AdaptiveExpenditureEngine.estimate(days: history(days: 30)))
+        XCTAssertLessThan(est.lowerKcal, est.estimatedDailyKcal)
+        XCTAssertGreaterThan(est.upperKcal, est.estimatedDailyKcal)
+    }
+
+    /// Confidence rises with the window, coverage and weigh-ins — never with the value itself.
+    func testConfidenceReflectsCoverageNotTheAnswer() throws {
+        let full = try XCTUnwrap(AdaptiveExpenditureEngine.estimate(days: history(days: 35, weighEvery: 2)))
+        XCTAssertEqual(full.confidence, .high)
+        let thin = try XCTUnwrap(AdaptiveExpenditureEngine.estimate(days: history(days: 22, weighEvery: 3)))
+        XCTAssertNotEqual(thin.confidence, .high)
+    }
+
+    /// The window must hold exactly the days it claims. `dayCount` is inclusive, so a strict `<` in the
+    /// recency filter drops the oldest day while still reporting the full window — losing a day of data
+    /// and understating coverage, both silently. Every other case here logs every day, so a one-day loss
+    /// crosses no gate and nothing else would notice.
+    func testFullyLoggedWindowKeepsEveryDayItReports() throws {
+        let est = try XCTUnwrap(AdaptiveExpenditureEngine.estimate(days: history(days: 30)))
+        XCTAssertEqual(est.windowDays, 30)
+        XCTAssertEqual(est.intakeDays, est.windowDays)
+    }
+
+    /// A duplicated day must not buy confidence. Coverage is "share of the window that was logged", so
+    /// it cannot exceed 1 — but a caller that merged its two sparse series badly could pass a day twice,
+    /// and an unclamped ratio above 1 both shrinks the interval and lifts the confidence, making the
+    /// answer look more certain than its data. That is the one direction this engine must never err in.
+    func testDuplicatedDaysCannotBuyANarrowerIntervalOrHigherConfidence() throws {
+        let clean = history(days: 30)
+        let duped = clean + clean          // every day twice
+        let a = try XCTUnwrap(AdaptiveExpenditureEngine.estimate(days: clean))
+        let b = try XCTUnwrap(AdaptiveExpenditureEngine.estimate(days: duped))
+        XCTAssertEqual(a.upperKcal - a.lowerKcal, b.upperKcal - b.lowerKcal, accuracy: 1e-6,
+                       "a duplicate must not narrow the interval")
+        XCTAssertEqual(a.confidence, b.confidence, "nor raise the confidence")
+        XCTAssertLessThan(b.lowerKcal, b.estimatedDailyKcal)
+        XCTAssertGreaterThan(b.upperKcal, b.estimatedDailyKcal)
+    }
+
+    /// A bad day key must not be read as 1970 and stretch the window by twenty thousand days.
+    func testUnparseableDayKeyIsRefusedNotTreatedAs1970() {
+        XCTAssertNil(AdaptiveExpenditureEngine.dayCount(from: "not-a-day", to: "2026-01-01"))
+        XCTAssertNil(AdaptiveExpenditureEngine.dayCount(from: "2026-01-01", to: ""))
+    }
+
+    /// Readings that all share one day cannot yield a slope; zero variance must return nil.
+    func testSingleDayWeightClusterHasNoSlope() {
+        XCTAssertNil(AdaptiveExpenditureEngine.leastSquaresSlope([(3, 80.0), (3, 80.5), (3, 79.5)]))
+    }
+}
diff --git a/android/app/src/main/java/com/noop/analytics/AdaptiveExpenditureEngine.kt b/android/app/src/main/java/com/noop/analytics/AdaptiveExpenditureEngine.kt
new file mode 100644
index 0000000000..a4562fac1e
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/AdaptiveExpenditureEngine.kt
@@ -0,0 +1,158 @@
+package com.noop.analytics
+
+/**
+ * One day's inputs for the retrospective expenditure estimate. Both fields are nullable because the two
+ * series are independently sparse — a day with a weigh-in and no food log is common, and inventing a
+ * value for the missing one is exactly what this engine must not do.
+ */
+data class AdaptiveExpenditureDay(
+    val day: String,
+    val caloriesIn: Double? = null,
+    val weightKg: Double? = null,
+)
+
+/** How much the estimate deserves to be trusted. Coarse on purpose — a percentage would imply a
+ *  precision this method does not have. */
+enum class AdaptiveExpenditureConfidence { BUILDING, MODERATE, HIGH }
+
+/**
+ * A retrospective estimate of average daily energy expenditure, with an interval.
+ *
+ * Never a single number: the error is dominated by things this engine cannot see (hydration swings, an
+ * under-logged weekend), so a bare figure would be the fabrication the rest of NOOP refuses to make.
+ */
+data class AdaptiveExpenditureEstimate(
+    val estimatedDailyKcal: Double,
+    val lowerKcal: Double,
+    val upperKcal: Double,
+    val meanIntakeKcal: Double,
+    val weightSlopeKgPerDay: Double,
+    val intakeDays: Int,
+    val weightReadings: Int,
+    val windowDays: Int,
+    val confidence: AdaptiveExpenditureConfidence,
+)
+
+/**
+ * Average daily expenditure inferred from logged intake and the weight trend (TDEE by energy balance).
+ *
+ * `expenditure = intake - change in stored energy`, with the conventional 7,700 kcal per kg of body
+ * mass. The identity is exact; the inputs are not. Day-to-day weight is mostly water, and food logs are
+ * under-reported by a wide and person-specific margin, so this is meaningful only over weeks and only as
+ * a range.
+ *
+ * DELIBERATELY NOT AN INPUT TO ANYTHING. It never feeds Charge, the calorie card, or the workout calorie
+ * estimate: those come from measured heart rate through Keytel, and quietly overwriting a measurement
+ * with an inference from a food diary would be a strictly worse number wearing the same label.
+ *
+ * Swift twin: `AdaptiveExpenditureEngine`.
+ */
+object AdaptiveExpenditureEngine {
+    /** The textbook 7,700 kcal/kg figure, which assumes the change is adipose; it over-states early loss,
+     *  when a real share is glycogen and its bound water. That bias is one reason the output is a range. */
+    const val KCAL_PER_KG = 7_700.0
+
+    const val MIN_WINDOW_DAYS = 21
+    const val MAX_WINDOW_DAYS = 42
+    const val MIN_INTAKE_DAYS = 14
+    const val MIN_INTAKE_COVERAGE = 0.70
+    const val MIN_WEIGHT_READINGS = 6
+
+    /** null when the history cannot support an estimate — the normal answer for most installs, and the
+     *  point of the gates. [days] need not be sorted or contiguous. */
+    fun estimate(days: List<AdaptiveExpenditureDay>): AdaptiveExpenditureEstimate? {
+        val ordered = days.sortedBy { it.day }
+        val first = ordered.firstOrNull()?.day ?: return null
+        val last = ordered.last().day
+        val span = dayCount(first, last) ?: return null
+        if (span < MIN_WINDOW_DAYS) return null
+        val window = minOf(span, MAX_WINDOW_DAYS)
+        val recent = ordered.filter { d ->
+            val back = dayCount(d.day, last) ?: return@filter false
+            // `dayCount` is INCLUSIVE — `dayCount(last, last)` is 1 — so the last `window` days are
+            // `back <= window`. A strict `<` silently drops the oldest day while still reporting the full
+            // `window`, which both loses data and understates coverage.
+            back <= window
+        }
+
+        val intake = recent.mapNotNull { it.caloriesIn }.filter { it > 0 }
+        val weights = recent.mapNotNull { d ->
+            val w = d.weightKg ?: return@mapNotNull null
+            if (w <= 0) return@mapNotNull null
+            val i = dayCount(first, d.day) ?: return@mapNotNull null
+            i to w
+        }
+        if (intake.size < MIN_INTAKE_DAYS) return null
+        // Clamped: `coverage` is "share of the window that was logged", so it cannot exceed 1. A caller
+        // that merged its two sparse series badly and passed a day twice would otherwise push it above 1,
+        // which SHRINKS the margin and RAISES the confidence — making the answer look more certain than
+        // its data, the one direction this engine must never err in. Clamping rather than de-duplicating
+        // on purpose: silently picking one of two conflicting values for a day would hide the caller's bug.
+        val coverage = minOf(1.0, intake.size.toDouble() / window.toDouble())
+        if (coverage < MIN_INTAKE_COVERAGE) return null
+        // DISTINCT days, not readings. Two weigh-ins on one morning are one day of evidence about the
+        // trend, and counting both would let a chatty scale — or a caller that passed a day twice — buy
+        // the same confidence as a fortnight of extra data.
+        val weightDays = weights.map { it.first }.distinct().size
+        if (weightDays < MIN_WEIGHT_READINGS) return null
+        val slope = leastSquaresSlope(weights) ?: return null
+
+        val meanIntake = intake.sum() / intake.size.toDouble()
+        // A RISING weight means intake exceeded expenditure, so the stored-energy term is SUBTRACTED.
+        // Getting this sign backwards is the classic error, which is why the tests pin both directions.
+        val estimate = meanIntake - slope * KCAL_PER_KG
+
+        val waterKcalPerDay = (0.5 * KCAL_PER_KG) / window.toDouble()
+        val intakeUncertainty = meanIntake * 0.10 * (1.0 - coverage) + meanIntake * 0.05
+        val margin = waterKcalPerDay + intakeUncertainty
+
+        val confidence = when {
+            window >= 28 && coverage >= 0.90 && weightDays >= 12 -> AdaptiveExpenditureConfidence.HIGH
+            window >= 21 && coverage >= 0.80 -> AdaptiveExpenditureConfidence.MODERATE
+            else -> AdaptiveExpenditureConfidence.BUILDING
+        }
+
+        return AdaptiveExpenditureEstimate(
+            estimatedDailyKcal = estimate,
+            lowerKcal = estimate - margin,
+            upperKcal = estimate + margin,
+            meanIntakeKcal = meanIntake,
+            weightSlopeKgPerDay = slope,
+            intakeDays = minOf(intake.size, window),
+            weightReadings = weightDays,
+            windowDays = window,
+            confidence = confidence,
+        )
+    }
+
+    /** OLS slope in kg per DAY. null when every reading shares one day, which would divide by zero — a
+     *  real case when a scale syncs several readings with one timestamp. */
+    internal fun leastSquaresSlope(points: List<Pair<Int, Double>>): Double? {
+        val n = points.size.toDouble()
+        if (points.size < 2) return null
+        val meanX = points.sumOf { it.first.toDouble() } / n
+        val meanY = points.sumOf { it.second } / n
+        var num = 0.0
+        var den = 0.0
+        for ((x, y) in points) {
+            val dx = x.toDouble() - meanX
+            num += dx * (y - meanY)
+            den += dx * dx
+        }
+        return if (den > 0) num / den else null
+    }
+
+    /**
+     * Whole days between two "yyyy-MM-dd" keys, inclusive of the first.
+     *
+     * null on an unparseable key. [AnalyticsEngine.dayStartUtcSeconds] is deliberately nil-tolerant and
+     * returns 0 for one, which is indistinguishable from 1970 here — and a stray 0 would silently stretch
+     * the window by twenty thousand days.
+     */
+    internal fun dayCount(from: String, to: String): Int? {
+        val a = AnalyticsEngine.dayStartUtcSeconds(from)
+        val b = AnalyticsEngine.dayStartUtcSeconds(to)
+        if (a <= 0L || b <= 0L) return null
+        return ((b - a) / 86_400L).toInt() + 1
+    }
+}
diff --git a/android/app/src/test/java/com/noop/analytics/AdaptiveExpenditureEngineTest.kt b/android/app/src/test/java/com/noop/analytics/AdaptiveExpenditureEngineTest.kt
new file mode 100644
index 0000000000..6b7c400be3
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/AdaptiveExpenditureEngineTest.kt
@@ -0,0 +1,151 @@
+package com.noop.analytics
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * TDEE by energy balance — the ORACLE for the Swift twin `AdaptiveExpenditureEngineTests`.
+ *
+ * The identity is `expenditure = intake - stored-energy change`. Everything interesting here is about
+ * refusing to answer: the method is only meaningful over weeks, and most installs will never have enough
+ * logged intake to reach it.
+ */
+class AdaptiveExpenditureEngineTest {
+
+    /** A synthetic history: `days` long, intake every `logEvery` days, weight every `weighEvery`. */
+    private fun history(
+        days: Int,
+        intake: Double = 2_400.0,
+        startKg: Double = 80.0,
+        kgPerDay: Double = 0.0,
+        logEvery: Int = 1,
+        weighEvery: Int = 3,
+    ): List<AdaptiveExpenditureDay> = (0 until days).map { i ->
+        AdaptiveExpenditureDay(
+            day = dayKey(i),
+            caloriesIn = if (i % logEvery == 0) intake else null,
+            weightKg = if (i % weighEvery == 0) startKg + kgPerDay * i else null,
+        )
+    }
+
+    /** Sequential "yyyy-MM-dd" keys from 2026-01-01, so the engine's own date maths is exercised. */
+    private fun dayKey(offset: Int): String {
+        val epochDay = java.time.LocalDate.of(2026, 1, 1).toEpochDay() + offset
+        return java.time.LocalDate.ofEpochDay(epochDay).toString()
+    }
+
+    /** Weight flat ⇒ expenditure equals intake. The simplest reading of the identity. */
+    @Test
+    fun `a stable weight puts expenditure at intake`() {
+        val est = AdaptiveExpenditureEngine.estimate(history(days = 30))!!
+        assertEquals(2_400.0, est.estimatedDailyKcal, 1.0)
+        assertEquals(0.0, est.weightSlopeKgPerDay, 1e-9)
+    }
+
+    /**
+     * Losing weight ⇒ expenditure EXCEEDED intake, so the estimate is ABOVE what was eaten. The sign is
+     * the classic error in this formula, so both directions are pinned rather than one.
+     */
+    @Test
+    fun `losing weight puts expenditure above intake`() {
+        val est = AdaptiveExpenditureEngine.estimate(history(days = 30, kgPerDay = -0.05))!!
+        // 0.05 kg/day * 7700 = 385 kcal/day of stored energy released.
+        assertEquals(2_400.0 + 385.0, est.estimatedDailyKcal, 2.0)
+        assertTrue(est.estimatedDailyKcal > est.meanIntakeKcal)
+    }
+
+    /** And the mirror: gaining weight means expenditure fell SHORT of intake. */
+    @Test
+    fun `gaining weight puts expenditure below intake`() {
+        val est = AdaptiveExpenditureEngine.estimate(history(days = 30, kgPerDay = 0.05))!!
+        assertEquals(2_400.0 - 385.0, est.estimatedDailyKcal, 2.0)
+        assertTrue(est.estimatedDailyKcal < est.meanIntakeKcal)
+    }
+
+    /** Under three weeks the method is not meaningful, so it declines rather than answering. */
+    @Test
+    fun `a short history yields nothing`() {
+        assertNull(AdaptiveExpenditureEngine.estimate(history(days = 20)))
+    }
+
+    /**
+     * The gate that matters most in practice: someone logs hard for a fortnight of a long window and
+     * stops. The days they skip are not a random sample of their eating, so a mean over them would read
+     * as a large false deficit.
+     */
+    @Test
+    fun `sparse intake logging yields nothing`() {
+        assertNull(AdaptiveExpenditureEngine.estimate(history(days = 40, logEvery = 3)))
+    }
+
+    /** Weight is the other half of the identity; too few readings cannot establish a trend. */
+    @Test
+    fun `too few weigh-ins yields nothing`() {
+        assertNull(AdaptiveExpenditureEngine.estimate(history(days = 30, weighEvery = 10)))
+    }
+
+    /** The output is a RANGE, and the estimate must sit inside it. */
+    @Test
+    fun `the estimate is bracketed by its interval`() {
+        val est = AdaptiveExpenditureEngine.estimate(history(days = 30))!!
+        assertTrue(est.lowerKcal < est.estimatedDailyKcal)
+        assertTrue(est.upperKcal > est.estimatedDailyKcal)
+    }
+
+    /** Confidence rises with the window, coverage and number of weigh-ins — never with the value itself. */
+    @Test
+    fun `confidence reflects coverage not the answer`() {
+        val full = AdaptiveExpenditureEngine.estimate(history(days = 35, weighEvery = 2))!!
+        assertEquals(AdaptiveExpenditureConfidence.HIGH, full.confidence)
+        val thin = AdaptiveExpenditureEngine.estimate(history(days = 22, weighEvery = 3))!!
+        assertTrue(thin.confidence != AdaptiveExpenditureConfidence.HIGH)
+    }
+
+    /**
+     * The window must hold exactly the days it claims. `dayCount` is inclusive, so a strict `<` in the
+     * recency filter drops the oldest day while still reporting the full window — losing a day of data
+     * and understating coverage, both silently. Every other case here logs every day, so a one-day loss
+     * crosses no gate and nothing else would notice.
+     */
+    @Test
+    fun `a fully logged window keeps every day it reports`() {
+        val est = AdaptiveExpenditureEngine.estimate(history(days = 30))!!
+        assertEquals(30, est.windowDays)
+        assertEquals(est.windowDays, est.intakeDays)
+    }
+
+    /**
+     * A duplicated day must not buy confidence. Coverage is "share of the window that was logged", so it
+     * cannot exceed 1 — but a caller that merged its two sparse series badly could pass a day twice, and
+     * an unclamped ratio above 1 both shrinks the interval and lifts the confidence, making the answer
+     * look more certain than its data. That is the one direction this engine must never err in.
+     */
+    @Test
+    fun `duplicated days cannot buy a narrower interval or higher confidence`() {
+        val clean = history(days = 30)
+        val duped = clean + clean          // every day twice
+        val a = AdaptiveExpenditureEngine.estimate(clean)!!
+        val b = AdaptiveExpenditureEngine.estimate(duped)!!
+        val widthA = a.upperKcal - a.lowerKcal
+        val widthB = b.upperKcal - b.lowerKcal
+        assertEquals("a duplicate must not narrow the interval", widthA, widthB, 1e-6)
+        assertEquals("nor raise the confidence", a.confidence, b.confidence)
+        assertTrue("and the interval still brackets", b.lowerKcal < b.estimatedDailyKcal)
+        assertTrue(b.upperKcal > b.estimatedDailyKcal)
+    }
+
+    /** A bad day key must not be read as 1970 and stretch the window by twenty thousand days. */
+    @Test
+    fun `an unparseable day key is refused not treated as 1970`() {
+        assertNull(AdaptiveExpenditureEngine.dayCount("not-a-day", "2026-01-01"))
+        assertNull(AdaptiveExpenditureEngine.dayCount("2026-01-01", ""))
+    }
+
+    /** Readings that all share one day cannot yield a slope; dividing by zero variance must return null. */
+    @Test
+    fun `a single-day weight cluster has no slope`() {
+        assertNull(AdaptiveExpenditureEngine.leastSquaresSlope(listOf(3 to 80.0, 3 to 80.5, 3 to 79.5)))
+    }
+}

From d479e7e3893334fb646124f588d62f13115128eb Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 5 Sep 2026 17:07:17 +1200
Subject: [PATCH 245/333] ble: give the battery-pack decoder a caller, and a
 sanity check before it is believed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`BatteryPackInfo` has decoded GET_BATTERY_PACK_INFO (151) on both platforms since its offsets were
captured — the 5/MG pack's charge, serial and address, read THROUGH the strap. Nothing ever sent the
command, so the decoder had no caller and the offsets had never been seen against a live strap.

The command now goes out on the same cadence as the strap's own gauge, 5/MG only (a 4.0 never answers
151). The reply is decoded and LOGGED, not stored and not shown: the offsets are an unvalidated
candidate re-derived from two frames, and a wrong one renders a confident wrong number rather than
failing. The line reports what was read AND whether it passes a new `displayable` check — a fuel gauge
is a percentage, so anything outside 0...100 means an offset moved and a caller must render nothing.

Review passes caught, in order: a duplicate map key and a name-resolution near-miss; the pack serial
being logged in full, which the existing redaction could not catch because its rules key on a "WHOOP "
prefix or a `whoop-` id; and the command NAME the routers match on being pinned by nothing, so a
rename would have silently returned the decoder to having no caller.

No LiveState field and no Devices card: a card whose value cannot yet be trusted is what the gate
exists to prevent, and this log is what turns two captured frames into confirmation.
---
 .../WhoopProtocol/BatteryPackInfo.swift       | 16 ++++++
 .../BatteryPackInfoTests.swift                | 39 +++++++++++++
 Strand/BLE/BLEManager.swift                   |  5 ++
 Strand/BLE/Commands.swift                     |  6 ++
 Strand/BLE/FrameRouter.swift                  | 26 +++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 35 ++++++++++++
 .../java/com/noop/protocol/BatteryPackInfo.kt | 13 ++++-
 .../src/main/java/com/noop/protocol/Enums.kt  |  2 +
 .../com/noop/protocol/BatteryPackInfoTest.kt  | 56 +++++++++++++++++++
 9 files changed, 197 insertions(+), 1 deletion(-)

diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/BatteryPackInfo.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/BatteryPackInfo.swift
index 745da92c2a..01d05fc8d0 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/BatteryPackInfo.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/BatteryPackInfo.swift
@@ -28,6 +28,22 @@ public enum BatteryPackInfo {
         /// read via GET_EXTENDED_BATTERY_INFO (98) which reports voltage, NOT a charge %. nil on 5/MG.
         public let voltageMv: Int?
 
+
+        /// Whether this reading is safe to SHOW.
+        ///
+        /// The offsets here are an unvalidated candidate re-derived from two captures, so a wrong one
+        /// would not fail — it would render a confident wrong number, which is the failure this project
+        /// treats as worse than a blank. A fuel gauge is a percentage: anything outside 0...100 means the
+        /// offset moved, and the caller must render nothing rather than the value.
+        ///
+        /// The fork that first shipped this hit exactly that shape from the other direction, reading a
+        /// 24,881 mV "cell voltage" off a 5/MG frame — a 4.0-path field read on a family that does not
+        /// answer it. A gauge that cannot be sanity-checked will eventually be believed.
+        public var displayable: Bool {
+            guard present, let soc = socPct else { return false }
+            return soc >= 0 && soc <= 100
+        }
+
         public init(present: Bool, socPct: Double?, serial: String?, btAddr: String?, voltageMv: Int? = nil) {
             self.present = present; self.socPct = socPct; self.serial = serial
             self.btAddr = btAddr; self.voltageMv = voltageMv
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/BatteryPackInfoTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/BatteryPackInfoTests.swift
index 814b67d192..58336b7395 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/BatteryPackInfoTests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/BatteryPackInfoTests.swift
@@ -73,4 +73,43 @@ final class BatteryPackInfoTests: XCTestCase {
         XCTAssertNil(BatteryPackInfo.decodeExtended(frame: bytes(attachedHex)))
         XCTAssertNil(BatteryPackInfo.decode(frame: bytes(attachedHex))?.voltageMv)
     }
+
+    /// The gauge must be sanity-checked before it is shown. These offsets are an unvalidated candidate
+    /// re-derived from two captures; a wrong one does not fail, it renders a confident wrong number — the
+    /// failure this project treats as worse than a blank. A percentage outside 0...100 means the offset
+    /// moved, so the caller renders nothing.
+    func testOutOfRangeChargeIsNotDisplayable() {
+        XCTAssertFalse(BatteryPackInfo.Info(present: true, socPct: 2488.1, serial: "P", btAddr: "aa").displayable)
+        XCTAssertFalse(BatteryPackInfo.Info(present: true, socPct: -1, serial: "P", btAddr: "aa").displayable)
+    }
+
+    /// A plausible gauge on an attached pack is the one case that shows.
+    func testInRangeChargeOnAnAttachedPackIsDisplayable() {
+        XCTAssertTrue(BatteryPackInfo.Info(present: true, socPct: 73.4, serial: "P", btAddr: "aa").displayable)
+        XCTAssertTrue(BatteryPackInfo.Info(present: true, socPct: 0, serial: "P", btAddr: "aa").displayable)
+        XCTAssertTrue(BatteryPackInfo.Info(present: true, socPct: 100, serial: "P", btAddr: "aa").displayable)
+    }
+
+    /// A removed pack must clear the card, never hold the last reading.
+    func testAbsentPackIsNeverDisplayable() {
+        XCTAssertFalse(BatteryPackInfo.Info(present: false, socPct: nil, serial: nil, btAddr: nil).displayable)
+        // Even if a stale charge rides along, absence wins.
+        XCTAssertFalse(BatteryPackInfo.Info(present: false, socPct: 80, serial: nil, btAddr: nil).displayable)
+    }
+
+    /// The router branch that decodes this reply matches on the command NAME
+    /// (`cmdName.hasPrefix("GET_BATTERY_PACK_INFO(")`), which comes from the schema's CommandNumber table.
+    /// A rename or a removal there would not fail to compile — the branch would simply stop matching and
+    /// the whole feature would go quiet, with the decoder back to having no caller. Pin the string.
+    func testCommand151ResolvesToTheNameTheRouterMatchesOn() {
+        XCTAssertEqual(loadSchema().enumName("CommandNumber", 151), "GET_BATTERY_PACK_INFO(151)")
+    }
+
+    /// `displayable` is about a CHARGE percentage, and the 4.0 path carries a voltage instead — so it is
+    /// always false there, correctly. Pinned because the name is generic enough that a future 4.0 voltage
+    /// card might reach for this gate and get a permanent no.
+    func testFourPointOhVoltagePathIsNeverDisplayable() {
+        let v = BatteryPackInfo.Info(present: true, socPct: nil, serial: nil, btAddr: nil, voltageMv: 3_900)
+        XCTAssertFalse(v.displayable)
+    }
 }
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index b2ec17a408..6aa0eccfff 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -4481,6 +4481,11 @@ public final class BLEManager: NSObject, ObservableObject {
         // #battery: ~60 s normally, ~30 s while charging (see `batteryPollDue`).
         if BLEManager.batteryPollDue(tick: keepAliveTick, charging: state.charging == true) {
             send(.getBatteryLevel, payload: [])
+            // The 5/MG battery pack rides the SAME cadence as the strap's own gauge — it is the same
+            // question about the same physical thing, and a second timer would only be a second thing to
+            // get wrong. 5/MG only: a 4.0 never answers 151 (its pack is voltage-only via 98), so asking
+            // would be traffic with no reply.
+            if selectedModel.deviceFamily == .whoop5 { send(.getBatteryPackInfo, payload: []) }
         }
     }
 
diff --git a/Strand/BLE/Commands.swift b/Strand/BLE/Commands.swift
index f8ecac3628..eb0f554a2d 100644
--- a/Strand/BLE/Commands.swift
+++ b/Strand/BLE/Commands.swift
@@ -92,6 +92,11 @@ public enum WhoopCommand: UInt8, CaseIterable {
     /// payloads. If probing (#592): send THIS curated number first and capture the response — do NOT lead
     /// with the decompile's 87, an opcode unknown to this table (the curated-safe-subset rule).
     case getExtendedBatteryInfo = 98
+    /// The 5/MG battery pack's fuel gauge, read THROUGH the strap — the pack talks to the strap over its
+    /// own link, so there is no peripheral to connect to and nothing to scan for. `BatteryPackInfo` has
+    /// decoded this reply since the offsets were captured; until now nothing sent the command, so the
+    /// decoder had no caller. A 4.0 never answers it (its pack is voltage-only via 98).
+    case getBatteryPackInfo = 151
     /// #690: read-only body-location/status probe. Documented in the WHOOP protocol; driven only by the
     /// user-triggered, Test-Centre-gated probeBodyLocationAndStatus(). Decoded to a diagnostic report only.
     case getBodyLocationAndStatus = 84
@@ -226,6 +231,7 @@ public enum WhoopCommand: UInt8, CaseIterable {
         case .enterHighFreqSync:     return "Enter High-Freq Sync"
         case .exitHighFreqSync:      return "Exit High-Freq Sync"
         case .getExtendedBatteryInfo:return "Get Extended Battery Info"
+        case .getBatteryPackInfo:    return "Get Battery Pack Info"
         case .getBodyLocationAndStatus:return "Get Body Location And Status"
         case .startFeatureFlagKeyExchange: return "Start Feature-Flag Key Exchange"
         case .sendNextFeatureFlag:   return "Send Next Feature Flag"
diff --git a/Strand/BLE/FrameRouter.swift b/Strand/BLE/FrameRouter.swift
index a4e723f23b..aa6340dda7 100644
--- a/Strand/BLE/FrameRouter.swift
+++ b/Strand/BLE/FrameRouter.swift
@@ -1,5 +1,6 @@
 import Foundation
 import WhoopProtocol
+import WhoopStore
 import StrandAnalytics
 
 /// Pure decode→state router. Takes a COMPLETE (already reassembled) frame, decodes it with
@@ -309,6 +310,31 @@ public final class FrameRouter {
                let pay = Self.commandResponsePayload(in: frame, family: family) {
                 state.append(log: HelloIdentityProbe.report(payload: pay) + " — locate the strap serial (#1303)")
             }
+            // The 5/MG battery pack (cmd 151). `BatteryPackInfo` has decoded this reply since its offsets
+            // were captured, and until now nothing sent the command — so the decoder had no caller and the
+            // offsets have never been seen against a live strap.
+            //
+            // LOG-ONLY, deliberately. Those offsets are an unvalidated candidate re-derived from two
+            // frames, and a wrong one does not fail: it renders a confident wrong number. So this reports
+            // what it read AND whether the reading passes the `displayable` sanity check, which is exactly
+            // the evidence needed before a card can honestly show it. Test Centre → Connection gated, so
+            // nothing here reaches a default (shareable) strap log. Persists nothing.
+            if family == .whoop5, let cmd = parsed.cmdName, cmd.hasPrefix("GET_BATTERY_PACK_INFO("),
+               TestCentre.active(.connection) {
+                if let info = BatteryPackInfo.decode(frame: frame) {
+                    let soc = info.socPct.map { String(format: "%.1f%%", $0) } ?? "—"
+                    // logSafe, NOT the raw serial. `redactPii` cannot catch this one — its rules key on a
+                    // literal "WHOOP " prefix or a `whoop-` id, and a bare `serial=BB5AP…` matches neither —
+                    // so the redaction that protects the strap's serial would have let the pack's through to
+                    // an exportable log. Three characters is enough to tell two packs apart, which is all a
+                    // diagnostic needs.
+                    state.append(log: "[pack] present=\(info.present) soc=\(soc) "
+                                 + "serial=\(WhoopSerialIdentity.logSafe(info.serial)) "
+                                 + "displayable=\(info.displayable) (#1303)")
+                } else {
+                    state.append(log: "[pack] cmd 151 replied but did not decode — offsets may have moved")
+                }
+            }
             // #900: surface a non-SUCCESS COMMAND_RESPONSE on BOTH families (a result=UNSUPPORTED here is how
             // the MG haptics rejection #48 would show), and — the key part — annotate a reply that DELIVERED
             // ITS VALUE rather than reporting a bare failure. The 4.0 GET_BATTERY_LEVEL replies on record carry
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 9504e668de..9700ed2612 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -7422,6 +7422,35 @@ class WhoopBleClient(
                         )
                     }
                 }
+                // The 5/MG battery pack (cmd 151). `BatteryPackInfo` has decoded this reply since its
+                // offsets were captured, and until now nothing sent the command — so the decoder had no
+                // caller and the offsets have never been seen against a live strap.
+                //
+                // LOG-ONLY, deliberately. Those offsets are an unvalidated candidate re-derived from two
+                // frames, and a wrong one does not fail: it renders a confident wrong number. So this
+                // reports what it read AND whether it passes the `displayable` sanity check, which is the
+                // evidence a card needs before it can honestly show anything. Twin of the Swift
+                // FrameRouter branch. Test Centre gated; persists nothing.
+                if (connectedFamily == DeviceFamily.WHOOP5 &&
+                    respCmd?.startsWith("GET_BATTERY_PACK_INFO(") == true &&
+                    testCentre.active(com.noop.testcentre.TestDomain.CONNECTION)
+                ) {
+                    val info = com.noop.protocol.BatteryPackInfo.decode(frame)
+                    if (info != null) {
+                        val soc = info.socPct?.let { String.format("%.1f%%", it) } ?: "—"
+                        // logSafe, NOT the raw serial. The log redaction keys on a literal "WHOOP " prefix
+                        // or a `whoop-` id, and a bare `serial=BB5AP…` matches neither — so the rule that
+                        // protects the strap's serial would have let the pack's through to an exportable
+                        // log. Three characters is enough to tell two packs apart.
+                        val safeSerial = com.noop.data.WhoopSerialIdentity.logSafe(info.serial)
+                        log(
+                            "[pack] present=${info.present} soc=$soc serial=$safeSerial " +
+                                "displayable=${info.displayable} (#1303)",
+                        )
+                    } else {
+                        log("[pack] cmd 151 replied but did not decode — offsets may have moved")
+                    }
+                }
                 // Reboot ack (#166): log the COMMAND_RESPONSE result for a user reboot on BOTH families —
                 // the accept/reject signal (the same one that exposed 5/MG haptics rejection). So a 5/MG
                 // owner's strap log confirms whether the (unverified) puffin reboot frame is accepted. The
@@ -7980,6 +8009,12 @@ class WhoopBleClient(
                     // #battery: ~60 s normally, ~30 s while charging (see [batteryPollDue]).
                     if (batteryPollDue(keepAliveTick, s.charging == true)) send(CommandNumber.GET_BATTERY_LEVEL)
                 } else if (connectedFamily == DeviceFamily.WHOOP5) {
+                    // The battery pack rides the SAME cadence as the strap's own gauge — the same question
+                    // about the same physical thing, and a second timer would only be a second thing to get
+                    // wrong. 5/MG only: a 4.0 never answers 151 (its pack is voltage-only via 98).
+                    if (batteryPollDue(keepAliveTick, s.charging == true)) {
+                        send(CommandNumber.GET_BATTERY_PACK_INFO)
+                    }
                     // #1865: re-arm a LAPSED realtime stream. The WHOOP4 branch above re-sends
                     // TOGGLE_REALTIME_HR every tick precisely because "the firmware lets the realtime HR
                     // stream lapse if it isn't re-armed" — a 5/MG got none of that, on the reasoning that it
diff --git a/android/app/src/main/java/com/noop/protocol/BatteryPackInfo.kt b/android/app/src/main/java/com/noop/protocol/BatteryPackInfo.kt
index 74fd6985dd..27df772ad2 100644
--- a/android/app/src/main/java/com/noop/protocol/BatteryPackInfo.kt
+++ b/android/app/src/main/java/com/noop/protocol/BatteryPackInfo.kt
@@ -25,7 +25,18 @@ object BatteryPackInfo {
         /** WHOOP 4.0 only: pack VOLTAGE in mV — a 4.0 has no fuel-gauge command, so its pack is read via
          *  GET_EXTENDED_BATTERY_INFO (98) which reports voltage, not a charge %. null on 5/MG. */
         val voltageMv: Int? = null,
-    )
+    ) {
+        /**
+         * Whether this reading is safe to SHOW.
+         *
+         * The offsets here are an unvalidated candidate re-derived from two captures, so a wrong one
+         * would not fail — it would render a confident wrong number, which is the failure this project
+         * treats as worse than a blank. A fuel gauge is a percentage: anything outside 0..100 means the
+         * offset moved, and the caller must render nothing rather than the value.
+         */
+        val displayable: Boolean
+            get() = present && socPct != null && socPct >= 0.0 && socPct <= 100.0
+    }
 
     /** Resp-cmd byte sits at [cmdOff] (10 on WHOOP 5/MG — the only family with a pack). Null when the
      *  frame is not a well-formed 151 SUCCESS response; the caller CRC-gates the frame (framing layer does). */
diff --git a/android/app/src/main/java/com/noop/protocol/Enums.kt b/android/app/src/main/java/com/noop/protocol/Enums.kt
index 0339d3b122..9e4d348d9a 100644
--- a/android/app/src/main/java/com/noop/protocol/Enums.kt
+++ b/android/app/src/main/java/com/noop/protocol/Enums.kt
@@ -227,6 +227,8 @@ enum class CommandNumber(val rawValue: Int) {
     // dumped in full to the strap log so a normal export settles which number this firmware serves.
     // Mirrors Swift WhoopCommand.getExtendedBatteryInfo.
     GET_EXTENDED_BATTERY_INFO(98),
+    /** The 5/MG battery pack's fuel gauge, read THROUGH the strap. A 4.0 never answers it. */
+    GET_BATTERY_PACK_INFO(151),
     // #690: read-only body-location/status probe. Documented in the WHOOP protocol; driven only by the
     // user-triggered, Test-Centre-gated probeBodyLocationAndStatus(). Decoded to a diagnostic report only.
     GET_BODY_LOCATION_AND_STATUS(84),
diff --git a/android/app/src/test/java/com/noop/protocol/BatteryPackInfoTest.kt b/android/app/src/test/java/com/noop/protocol/BatteryPackInfoTest.kt
index 621017b416..d41b4b8c6f 100644
--- a/android/app/src/test/java/com/noop/protocol/BatteryPackInfoTest.kt
+++ b/android/app/src/test/java/com/noop/protocol/BatteryPackInfoTest.kt
@@ -2,6 +2,8 @@ package com.noop.protocol
 
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertNull
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
 import org.junit.Test
 
 /**
@@ -71,4 +73,58 @@ class BatteryPackInfoTest {
         assertNull(BatteryPackInfo.decodeExtended(bytes(attachedHex)))   // 151 frame is not a 98 response
         assertNull(BatteryPackInfo.decode(bytes(attachedHex))!!.voltageMv) // 5/MG decode never fills voltage
     }
+
+    /**
+     * The gauge must be sanity-checked before it is shown. These offsets are an unvalidated candidate
+     * re-derived from two captures; a wrong one does not fail, it renders a confident wrong number — the
+     * failure this project treats as worse than a blank. A percentage outside 0..100 means the offset
+     * moved, so the caller renders nothing.
+     */
+    @Test
+    fun `an out-of-range charge is not displayable`() {
+        val absurd = BatteryPackInfo.Info(present = true, socPct = 2488.1, serial = "P", btAddr = "aa")
+        assertFalse(absurd.displayable)
+        val negative = BatteryPackInfo.Info(present = true, socPct = -1.0, serial = "P", btAddr = "aa")
+        assertFalse(negative.displayable)
+    }
+
+    /** A plausible gauge on an attached pack is the one case that shows. */
+    @Test
+    fun `an in-range charge on an attached pack is displayable`() {
+        assertTrue(BatteryPackInfo.Info(present = true, socPct = 73.4, serial = "P", btAddr = "aa").displayable)
+        assertTrue(BatteryPackInfo.Info(present = true, socPct = 0.0, serial = "P", btAddr = "aa").displayable)
+        assertTrue(BatteryPackInfo.Info(present = true, socPct = 100.0, serial = "P", btAddr = "aa").displayable)
+    }
+
+    /** A removed pack must clear the card, never hold the last reading. */
+    @Test
+    fun `an absent pack is never displayable`() {
+        assertFalse(BatteryPackInfo.Info(present = false, socPct = null, serial = null, btAddr = null).displayable)
+        // Even if a stale charge rides along, absence wins.
+        assertFalse(BatteryPackInfo.Info(present = false, socPct = 80.0, serial = null, btAddr = null).displayable)
+    }
+
+    /**
+     * The router branch that decodes this reply matches on the command NAME
+     * (`respCmd.startsWith("GET_BATTERY_PACK_INFO(")`), which comes from this lookup table. A rename or a
+     * removal there would not fail to compile — the branch would simply stop matching and the whole
+     * feature would go quiet, with the decoder back to having no caller. Pin the string.
+     */
+    @Test
+    fun `command 151 resolves to the name the router matches on`() {
+        assertEquals("GET_BATTERY_PACK_INFO", com.noop.protocol.CommandNames.byRaw[151])
+        assertTrue(com.noop.protocol.CommandNames.label(151).startsWith("GET_BATTERY_PACK_INFO("))
+    }
+
+    /**
+     * `displayable` is about a CHARGE percentage, and the 4.0 path carries a voltage instead — so it is
+     * always false there, correctly. Pinned because the name is generic enough that a future 4.0 voltage
+     * card might reach for this gate and get a permanent no.
+     */
+    @Test
+    fun `the 4-0 voltage path is never displayable`() {
+        val v = BatteryPackInfo.Info(present = true, socPct = null, serial = null, btAddr = null,
+                                     voltageMv = 3_900)
+        assertFalse(v.displayable)
+    }
 }

From 441d77109a0f38a4d953a0bd23188027435fbd96 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 5 Sep 2026 18:24:09 +1200
Subject: [PATCH 246/333] ble: stop telling a strap that refuses pairing to try
 pairing again (#1635)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A 5/MG that refuses the secure handshake latches the give-up and keeps live heart rate streaming —
the designed end state (#1635). The card explaining it ended "Tap Connect to try the handshake again",
which frames a permanent refusal as a retryable failure and invites the hammering the latch exists to
stop. A field report is the evidence it did not land: the user read the whole hint and still asked how
to fix it.

It now ends with pairing mode, hedged as "some straps have paired again after" because that is one
report on #1635 rather than a confirmed remedy, worded "tap until the LEDs flash blue" to match both
that report and `pausedHint` in the same file. Connect follows rather than leads.

It also no longer claims HRV and resting heart rate are unavailable. #1884 made that false: an HR-only
night reports both. Tests repin to what survives from #1878 — the strap stops sending motion, so sleep
falls to the HR-only stager — and both suites now assert the false sentence cannot come back.

Copy only; the latch, suppression path and live-HR fallback are untouched. Byte-identical across
platforms, verified programmatically.

NOT included: the same false claim in the Settings copy on both platforms. That text is a localized
key with ten translations, so correcting it orphans them all and needs the catalogue work done
properly. It remains wrong until that lands.
---
 Strand/BLE/BLEManager.swift                   | 11 ++++++++--
 StrandTests/HelloSuppressionTests.swift       | 21 +++++++++++++------
 .../java/com/noop/ble/BondRefusalGiveUp.kt    | 16 +++++++++-----
 .../java/com/noop/ble/HelloSuppressionTest.kt | 17 +++++++++++----
 4 files changed, 48 insertions(+), 17 deletions(-)

diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index 6aa0eccfff..a593b1286d 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -209,11 +209,18 @@ struct BondRefusalGiveUp {
     /// #1635: the hint shown when the hello is switched off and the link is KEPT.
     ///
     /// Nothing is paused on this branch, so it must not say auto-reconnect stopped. It names what was lost
-    /// (history sync) and the one action that restores the attempt, without asserting a cause.
+    /// and what to try, without asserting a cause.
+    ///
+    /// #1635 follow-up: it used to end "Tap Connect to try the handshake again", which framed a strap that
+    /// REFUSES pairing as a retryable failure — inviting exactly the hammering the give-up latch exists to
+    /// stop. A field report read all of this and still asked how to fix it, so the ending now leads with
+    /// the only thing anyone has recovered from this state with (pairing mode, reported once on #1635 and
+    /// hedged accordingly) and keeps Connect as the follow-up. It also no longer claims HRV and resting
+    /// heart rate are unavailable: since #1884 an HR-only night reports both.
     ///
     /// Pure. Byte-identical to the Kotlin `BondRefusalGiveUp.helloSuppressedHint`.
     static func helloSuppressedHint() -> String {
-        "The secure handshake with your strap never completes, and the attempt itself is what drops the link. NOOP has switched it off for this strap so live heart rate keeps streaming. History sync stays unavailable until it pairs, and so do motion, skin temperature, SpO₂ and respiratory rate — so sleep is staged from heart rate alone, and HRV and resting heart rate are unavailable. Tap Connect to try the handshake again."
+        "The secure handshake with your strap never completes, and the attempt itself is what drops the link. NOOP has switched it off for this strap so live heart rate keeps streaming. History sync stays unavailable until it pairs, and so do motion, skin temperature, SpO₂ and respiratory rate, so sleep is staged from heart rate alone. Some straps have paired again after being put in pairing mode. Tap until the LEDs flash blue, then tap Connect."
     }
 
     /// The paused hint for a bond that failed WITHOUT the strap ever answering (#1635).
diff --git a/StrandTests/HelloSuppressionTests.swift b/StrandTests/HelloSuppressionTests.swift
index 57e798fc2b..faefe702c3 100644
--- a/StrandTests/HelloSuppressionTests.swift
+++ b/StrandTests/HelloSuppressionTests.swift
@@ -114,14 +114,23 @@ final class HelloSuppressionTests: XCTestCase {
         let hint = BondRefusalGiveUp.helloSuppressedHint()
         XCTAssertTrue(hint.contains("live heart rate keeps streaming"))
         XCTAssertTrue(hint.contains("History sync stays unavailable"))
-        XCTAssertTrue(hint.contains("Tap Connect"))
+        // #1635 follow-up: the hint no longer LEADS with a retry. Framing a strap that refuses pairing as
+        // a retryable failure invited the hammering the give-up latch exists to stop, and a field report
+        // read the whole hint and still asked how to fix it. Pairing mode comes first now; Connect follows.
+        XCTAssertTrue(hint.contains("pairing mode"))
+        XCTAssertTrue(hint.contains("tap Connect"))
+        // And it must NOT claim these are unavailable: since #1884 an HR-only night reports both.
+        XCTAssertFalse(hint.contains("HRV and resting heart rate are unavailable"))
         // The hint must name what an unbonded strap actually costs, not just history sync: motion,
-        // skin temperature, SpO2 and respiratory stop, so sleep falls to the HR-only stager and HRV
-        // + resting HR are nulled. A field log showed a week of blank Recovery Vitals under the old
-        // wording, which pointed only at a feature the user was not missing.
+        // skin temperature, SpO2 and respiratory stop, so sleep falls to the HR-only stager. A field log
+        // showed a week of blank Recovery Vitals under the old wording, which pointed only at a feature
+        // the user was not missing. (It used to end "and HRV + resting HR are nulled" — #1884 made that
+        // false, and leaving it here would have contradicted the assertion four lines down.)
         XCTAssertTrue(hint.contains("motion"))
-        XCTAssertTrue(hint.contains("HRV"))
-        XCTAssertTrue(hint.contains("resting heart rate"))
+        // #1884 repinned the tail of this: naming HRV and resting HR as LOSSES stopped being true when an
+        // HR-only night began reporting both. What survives from #1878 is the reason they were named at
+        // all - the strap stops sending motion, so sleep falls to the HR-only stager. That still holds.
+        XCTAssertTrue(hint.contains("staged from heart rate alone"))
         XCTAssertFalse(hint.lowercased().contains("paused"))
         XCTAssertFalse(hint.lowercased().contains("stopped retrying"))
     }
diff --git a/android/app/src/main/java/com/noop/ble/BondRefusalGiveUp.kt b/android/app/src/main/java/com/noop/ble/BondRefusalGiveUp.kt
index 7c0b93b9c8..31037474ef 100644
--- a/android/app/src/main/java/com/noop/ble/BondRefusalGiveUp.kt
+++ b/android/app/src/main/java/com/noop/ble/BondRefusalGiveUp.kt
@@ -94,14 +94,20 @@ class BondRefusalGiveUp(
          * write is not evidence the strap is held by the official app, and the epitaph that asserts that is
          * reserved for an actual auth refusal. Says what was observed and what the user still gets.
          *
+         * #1635 follow-up: it used to end "Tap Connect to try the handshake again", which framed a strap
+         * that REFUSES pairing as a retryable failure. A field report read all of this and still asked how
+         * to fix it, so the ending now leads with pairing mode (reported once on #1635, hedged) and keeps
+         * Connect as the follow-up. It also no longer claims HRV and resting heart rate are unavailable:
+         * since #1884 an HR-only night reports both.
+         *
          * Pure; no em-dash. Byte-identical to the Swift `BondRefusalGiveUp.helloSuppressedHint`.
          */
         fun helloSuppressedHint(): String =
-            "The secure handshake with your strap never completes, and the attempt itself is what drops " +
-                "the link. NOOP has switched it off for this strap so live heart rate keeps streaming. " +
-                "History sync stays unavailable until it pairs, and so do motion, skin temperature, " +
-                "SpO₂ and respiratory rate — so sleep is staged from heart rate alone, and HRV and " +
-                "resting heart rate are unavailable. Tap Connect to try the handshake again."
+            "The secure handshake with your strap never completes, and the attempt itself is what drops t" +
+            "he link. NOOP has switched it off for this strap so live heart rate keeps streaming. History" +
+            " sync stays unavailable until it pairs, and so do motion, skin temperature, SpO₂ and respira" +
+            "tory rate, so sleep is staged from heart rate alone. Some straps have paired again after bei" +
+            "ng put in pairing mode. Tap until the LEDs flash blue, then tap Connect."
 
         /**
          * #1635: the log epitaph for the suppression path.
diff --git a/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt b/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
index 63eb8a6339..bd81391334 100644
--- a/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
+++ b/android/app/src/test/java/com/noop/ble/HelloSuppressionTest.kt
@@ -127,13 +127,22 @@ class HelloSuppressionTest {
         // is holding the strap - the two mistakes this issue has already produced.
         assertFalse(hint.contains("paus", ignoreCase = true))
         assertFalse(hint.contains("WHOOP app", ignoreCase = true))
-        assertTrue(hint.contains("Connect"))
+        // #1635 follow-up: the hint no longer LEADS with a retry. Framing a strap that refuses pairing as
+        // a retryable failure invited the hammering the give-up latch exists to stop, and a field report
+        // read the whole hint and still asked how to fix it. Pairing mode comes first now; Connect follows.
+        assertTrue(hint.contains("pairing mode"))
+        assertTrue(hint.contains("tap Connect"))
+        // And it must NOT claim these are unavailable: since #1884 an HR-only night reports both.
+        assertFalse(hint.contains("HRV and resting heart rate are unavailable"))
         // #1635 field log: a week of blank Recovery Vitals while this hint named only history sync.
         // Unbonded, the strap also stops sending motion / skin temperature / SpO2 / respiratory, which
-        // drops sleep onto the HR-only stager and blanks HRV + resting HR by construction.
+        // drops sleep onto the HR-only stager. (This used to end "and blanks HRV + resting HR by
+        // construction" - #1884 made that false, and leaving it would contradict the assertion below.)
         assertTrue(hint.contains("motion"))
-        assertTrue(hint.contains("HRV"))
-        assertTrue(hint.contains("resting heart rate"))
+        // #1884 repinned the tail of this: naming HRV and resting HR as LOSSES stopped being true when an
+        // HR-only night began reporting both. What survives from #1878 is the reason they were named at
+        // all — the strap stops sending motion, so sleep falls to the HR-only stager. That still holds.
+        assertTrue(hint.contains("staged from heart rate alone"))
         val epitaph = BondRefusalGiveUp.helloSuppressedEpitaph(5, "abcd1234")
         assertFalse(epitaph.contains("held by", ignoreCase = true))
         assertTrue(epitaph.contains("abcd1234"))

From 0ae341f398ef95b802bbb013263b679503bdd6e9 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 5 Sep 2026 19:30:40 +1200
Subject: [PATCH 247/333] build: restore the Apple targets, and the app-target
 tests that never compiled
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

main did not compile on iOS or macOS. This restores both, and the app-target tests with it —
`app-build` run 33952090013 is green on both targets with `Test Strand: success`.

Four independent breakages, found one layer at a time because the compiler only reports the first:

- `WhoopSerialIdentity.logSafe(serial:)` was called positionally in `FrameRouter`. Kotlin accepts
  that, so the Android twin compiled and the parity looked sound; Swift does not, and both Apple
  targets have failed since that merge.
- `DailySkinTempAbsoluteCarryTests` called compact `DailyMetric(day:sleepHrOnly:)` forms against an
  initializer whose first twelve parameters are required. The file already had a helper filling them;
  the sleep-carry cases simply did not use it.
- `fillingNilFields` and `takingSleepFields` sat in a `private extension`, invisible even to
  `@testable`, so the cases exercising them could never have compiled. Now internal, still
  module-confined.
- `DayCycleRecoveryTests` used `UserProfile` without importing StrandAnalytics.

None was caught because a PR touching only `Strand/` and `android/` runs no check that compiles
Swift: the package matrix needs `Packages/`, and StrandTests runs only in the on-demand app-build. A
green tick on such a PR covers Android and the Python tools and nothing else, which is how a test file
can be merged having never compiled and stay that way.

No behaviour change: an argument label, a test helper, an access level, an import. The CI gap itself
is worth closing separately — making app-build required for `Strand/**`, or adding a compile-only job.
---
 Strand/BLE/FrameRouter.swift                  |  2 +-
 Strand/Data/Repository.swift                  |  6 ++-
 .../DailySkinTempAbsoluteCarryTests.swift     | 41 ++++++++++++-------
 StrandTests/DayCycleRecoveryTests.swift       |  1 +
 4 files changed, 33 insertions(+), 17 deletions(-)

diff --git a/Strand/BLE/FrameRouter.swift b/Strand/BLE/FrameRouter.swift
index aa6340dda7..071134e79f 100644
--- a/Strand/BLE/FrameRouter.swift
+++ b/Strand/BLE/FrameRouter.swift
@@ -329,7 +329,7 @@ public final class FrameRouter {
                     // an exportable log. Three characters is enough to tell two packs apart, which is all a
                     // diagnostic needs.
                     state.append(log: "[pack] present=\(info.present) soc=\(soc) "
-                                 + "serial=\(WhoopSerialIdentity.logSafe(info.serial)) "
+                                 + "serial=\(WhoopSerialIdentity.logSafe(serial: info.serial)) "
                                  + "displayable=\(info.displayable) (#1303)")
                 } else {
                     state.append(log: "[pack] cmd 151 replied but did not decode — offsets may have moved")
diff --git a/Strand/Data/Repository.swift b/Strand/Data/Repository.swift
index 0d1a4892eb..96f0bf5c54 100644
--- a/Strand/Data/Repository.swift
+++ b/Strand/Data/Repository.swift
@@ -3215,7 +3215,11 @@ final class Repository: ObservableObject {
     }
 }
 
-private extension DailyMetric {
+// `internal`, not `private`: `DailySkinTempAbsoluteCarryTests` exercises these two directly, and a
+// `private` extension is invisible even to `@testable import`. They stayed private because the tests
+// that call them have never compiled (StrandTests runs only in the on-demand app-build), so nothing
+// ever demanded the wider access. Still confined to this module.
+extension DailyMetric {
     /// A copy of self where every nil field is backfilled from `fallback`. Used by the field-by-field
     /// daily merge so an imported export keeps its own values while a computed row fills the gaps it
     /// doesn't carry (e.g. on-device Charge / skin-temp deviation / activity totals).
diff --git a/StrandTests/DailySkinTempAbsoluteCarryTests.swift b/StrandTests/DailySkinTempAbsoluteCarryTests.swift
index 099cb2606a..6ac4faf08d 100644
--- a/StrandTests/DailySkinTempAbsoluteCarryTests.swift
+++ b/StrandTests/DailySkinTempAbsoluteCarryTests.swift
@@ -14,14 +14,25 @@ import WhoopStore
 /// automatically, so there is no equivalent seam to drop a column at).
 final class DailySkinTempAbsoluteCarryTests: XCTestCase {
 
+    /// `DailyMetric`'s initializer defaults only from `spo2Pct` onward — its first twelve parameters are
+    /// required. Every case here needs two or three of them, so they go through this rather than each
+    /// spelling out ten `nil`s, and the sleep-carry cases below cannot drift into compact calls that do
+    /// not compile. (They did: these tests shipped uncompilable in #1879, and `StrandTests` runs only in
+    /// the on-demand app-build, so nothing said so.)
     private func row(day: String = "2026-08-25",
+                     totalSleepMin: Double? = nil,
+                     deepMin: Double? = nil,
+                     remMin: Double? = nil,
+                     lightMin: Double? = nil,
+                     restingHr: Int? = nil,
                      skinTempC: Double? = nil,
                      skinTempDevC: Double? = nil,
-                     avgHrv: Double? = nil) -> DailyMetric {
-        DailyMetric(day: day, totalSleepMin: nil, efficiency: nil, deepMin: nil, remMin: nil,
-                    lightMin: nil, disturbances: nil, restingHr: nil, avgHrv: avgHrv,
-                    recovery: nil, strain: nil, exerciseCount: nil,
-                    skinTempDevC: skinTempDevC, skinTempC: skinTempC)
+                     avgHrv: Double? = nil,
+                     sleepHrOnly: Bool? = nil) -> DailyMetric {
+        DailyMetric(day: day, totalSleepMin: totalSleepMin, efficiency: nil, deepMin: deepMin,
+                    remMin: remMin, lightMin: lightMin, disturbances: nil, restingHr: restingHr,
+                    avgHrv: avgHrv, recovery: nil, strain: nil, exerciseCount: nil,
+                    skinTempDevC: skinTempDevC, skinTempC: skinTempC, sleepHrOnly: sleepHrOnly)
     }
 
     /// An imported winner carries no absolute, so the computed filler's must survive the coalesce.
@@ -82,28 +93,28 @@ final class DailySkinTempAbsoluteCarryTests: XCTestCase {
     func testScoringKeepsTheStagingFlag() throws {
         let scored = row(skinTempC: 34.6).with(recovery: 0.71, skinTempDevC: 0.52, skinTempC: 34.6)
         XCTAssertNil(scored.sleepHrOnly, "a row that never carried the flag must not invent one")
-        let hrOnly = DailyMetric(day: "2026-09-03", sleepHrOnly: true)
+        let hrOnly = row(day: "2026-09-03", sleepHrOnly: true)
             .with(recovery: 0.71, skinTempDevC: nil, skinTempC: nil)
         XCTAssertEqual(hrOnly.sleepHrOnly, true, "scoring must not discard how the night was staged")
     }
 
     func testASleepEditKeepsTheStagingFlag() {
-        let edited = DailyMetric(day: "2026-09-03", sleepHrOnly: true)
+        let edited = row(day: "2026-09-03", sleepHrOnly: true)
             .with(totalSleepMin: 400, efficiency: 0.93, deepMin: 80, remMin: 100, lightMin: 220)
         // Correcting the wake window does not change whether the strap banked any motion.
         XCTAssertEqual(edited.sleepHrOnly, true)
     }
 
     func testAnImportedRowTakesTheComputedStagingFlag() {
-        let imported = DailyMetric(day: "2026-09-03")
-        let computed = DailyMetric(day: "2026-09-03", sleepHrOnly: true)
+        let imported = row(day: "2026-09-03")
+        let computed = row(day: "2026-09-03", sleepHrOnly: true)
         XCTAssertEqual(imported.fillingNilFields(from: computed).sleepHrOnly, true,
                        "only a scoring pass knows the staging; an import's nil must not erase it")
     }
 
     func testTheFlagMovesWithTheSleepColumnsItDescribes() {
-        let importRow = DailyMetric(day: "2026-09-03", totalSleepMin: 300)
-        let editedComputed = DailyMetric(day: "2026-09-03", totalSleepMin: 400, sleepHrOnly: true)
+        let importRow = row(day: "2026-09-03", totalSleepMin: 300)
+        let editedComputed = row(day: "2026-09-03", totalSleepMin: 400, sleepHrOnly: true)
         let merged = importRow.takingSleepFields(from: editedComputed)
         XCTAssertEqual(merged.totalSleepMin, 400)
         // The flag describes THOSE stage figures, so it travels with them rather than staying behind.
@@ -112,15 +123,15 @@ final class DailySkinTempAbsoluteCarryTests: XCTestCase {
 
     /// The Swift twin of the Kotlin coalesce cases: the flag belongs to the sleep GROUP.
     func testTheStagingFlagMovesWithTheSleepBlock() {
-        let winner = DailyMetric(day: "2026-09-03", restingHr: 55)
-        let filler = DailyMetric(day: "2026-09-03", totalSleepMin: 400, deepMin: 39,
+        let winner = row(day: "2026-09-03", restingHr: 55)
+        let filler = row(day: "2026-09-03", totalSleepMin: 400, deepMin: 39,
                                  remMin: 54, lightMin: 57, sleepHrOnly: true)
         XCTAssertEqual(Repository.coalesceDay(winner, filler).sleepHrOnly, true)
     }
 
     func testAWinnerThatOwnsTheSleepBlockKeepsItsOwnStagingFlag() {
-        let winner = DailyMetric(day: "2026-09-03", totalSleepMin: 420, deepMin: 90, sleepHrOnly: false)
-        let filler = DailyMetric(day: "2026-09-03", totalSleepMin: 300, sleepHrOnly: true)
+        let winner = row(day: "2026-09-03", totalSleepMin: 420, deepMin: 90, sleepHrOnly: false)
+        let filler = row(day: "2026-09-03", totalSleepMin: 300, sleepHrOnly: true)
         XCTAssertEqual(Repository.coalesceDay(winner, filler).sleepHrOnly, false)
     }
 }
diff --git a/StrandTests/DayCycleRecoveryTests.swift b/StrandTests/DayCycleRecoveryTests.swift
index 50e00fb32d..55405b1e3e 100644
--- a/StrandTests/DayCycleRecoveryTests.swift
+++ b/StrandTests/DayCycleRecoveryTests.swift
@@ -1,4 +1,5 @@
 import XCTest
+import StrandAnalytics
 import WhoopStore
 @testable import Strand
 

From 205ae63c864078f6e495231edb1b9897d85235d1 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 5 Sep 2026 19:50:51 +1200
Subject: [PATCH 248/333] today: add an optional, default-OFF Coach launcher
 card (#1862)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Coach becomes an optional Today card that opens a compact launcher — a sheet on iOS/macOS, a bottom
sheet on Android. Requested by @kggreco11.

Default-OFF, modelled on the existing Coupled card: absent from `defaultSelection` on both platforms,
so a fresh install never shows it and someone who does not use a provider never gains a fixed
dashboard row for one. The raw value is "coach" on both, so a settings backup restores across OS.

OPENING IT MAKES NO PROVIDER REQUEST. The configured check is a local key read and the prompts are
static copy; the first network call still happens where it always did, after an explicit send.

The launcher owns no send, stream, error or consent surface. Picking a suggestion or submitting the
composer hands the question to the Coach screen — via `AICoachEngine.pendingPrompt` and the existing
NavRouter on Apple, `CoachHandoff` plus a nav route on Android — and that screen, which already has
all of those, sends it. An unconfigured user gets the same bring-your-own-key explanation the Coach
screen shows, and a route to it.

No new user-facing copy on either platform: the card and both sheets reuse strings Coach already
ships, so nothing needs translating into ten locales. The suggested prompts moved to a shared
`CoachPrompts` per platform, so the launcher and the screen cannot offer different lists.

Review found three things a compiler or a test caught rather than a reading: the Android sheet's
buttons reached a no-op default parameter and did nothing; two exhaustive switches in the iPhone
shell, in a sibling target every earlier search had missed; and a missing StrandDesign import that
`swiftc -parse` is structurally incapable of noticing.

app-build is green on both targets with the app-target tests passing (run 33952869772). The sheets
have NOT been seen on a device.
---
 Strand/AI/AICoach.swift                       |   8 +
 Strand/App/NavRouter.swift                    |   6 +
 Strand/App/RootView.swift                     |   3 +
 Strand/Liquid/LiquidTodayView.swift           |  35 ++++-
 Strand/Screens/CoachLauncherSheet.swift       | 146 ++++++++++++++++++
 Strand/Screens/CoachPrompts.swift             |  17 ++
 Strand/Screens/CoachView.swift                |  18 ++-
 Strand/Screens/DashboardCards.swift           |  13 ++
 .../Screens/TodayCustomizationMetadata.swift  |   1 +
 Strand/Screens/TodayView.swift                |  91 +++++++----
 StrandiOS/App/RootTabView.swift               |   8 +
 Tools/test_home_i18n.py                       |   1 +
 android/app/build.gradle.kts                  |   2 +-
 .../app/src/main/java/com/noop/ui/AppRoot.kt  |   3 +
 .../java/com/noop/ui/CoachLauncherSheet.kt    |  98 ++++++++++++
 .../src/main/java/com/noop/ui/CoachPrompts.kt |  44 ++++++
 .../src/main/java/com/noop/ui/CoachScreen.kt  |  21 ++-
 .../main/java/com/noop/ui/DashboardCards.kt   |  11 +-
 .../src/main/java/com/noop/ui/TodayScreen.kt  |  37 ++++-
 .../test/java/com/noop/ui/CoachCardTest.kt    |  71 +++++++++
 project.yml                                   |   2 +-
 21 files changed, 588 insertions(+), 48 deletions(-)
 create mode 100644 Strand/Screens/CoachLauncherSheet.swift
 create mode 100644 Strand/Screens/CoachPrompts.swift
 create mode 100644 android/app/src/main/java/com/noop/ui/CoachLauncherSheet.kt
 create mode 100644 android/app/src/main/java/com/noop/ui/CoachPrompts.kt
 create mode 100644 android/app/src/test/java/com/noop/ui/CoachCardTest.kt

diff --git a/Strand/AI/AICoach.swift b/Strand/AI/AICoach.swift
index 54099c89c4..c06872fd53 100644
--- a/Strand/AI/AICoach.swift
+++ b/Strand/AI/AICoach.swift
@@ -162,6 +162,14 @@ final class AICoachEngine: ObservableObject {
     private var conversationDay: Int?
     @Published var sending = false
     @Published var errorText: String?
+
+    /// #1862: a question handed over by the Today Coach launcher sheet, for `CoachView` to send on appear.
+    ///
+    /// The launcher owns no send, stream, error or consent surface of its own — duplicating those is how a
+    /// second chat UI drifts from the first. It collects a question and hands it here; the Coach screen,
+    /// which already has all of that, consumes it exactly once and clears it. Nil is the normal state, and
+    /// setting it performs NO network work by itself.
+    @Published var pendingPrompt: String?
     @Published var provider: AIProvider {
         didSet {
             guard provider != oldValue else { return }
diff --git a/Strand/App/NavRouter.swift b/Strand/App/NavRouter.swift
index c0fc3e9b8f..0220b50ae6 100644
--- a/Strand/App/NavRouter.swift
+++ b/Strand/App/NavRouter.swift
@@ -29,6 +29,10 @@ final class NavRouter: ObservableObject {
         case activeWorkout
         case liveSession
         case journal
+        /// #1862: the Coach screen, opened from the Today Coach launcher sheet once the user picks a
+        /// suggestion or submits the composer. The launcher deliberately owns no send/stream/consent
+        /// surface of its own — it hands the question to the one screen that already has them.
+        case coach
 
         var id: String { rawValue }
 
@@ -60,6 +64,8 @@ final class NavRouter: ObservableObject {
 
     /// Ask the shell to open the Devices manager (pair / switch bands). The shell decides how.
     func openDevices() { requestedDestination = .devices }
+    /// #1862: open Coach, optionally with a question the launcher already collected.
+    func openCoach() { requestedDestination = .coach }
     /// Open the v5 Insights hub (the n-of-1 "what moves your Charge" surface).
     func openInsightsHub() { requestedDestination = .insightsHub }
     /// Open the Lab Book (private health-records logbook).
diff --git a/Strand/App/RootView.swift b/Strand/App/RootView.swift
index a7aa0483c7..b5bb0222f8 100644
--- a/Strand/App/RootView.swift
+++ b/Strand/App/RootView.swift
@@ -328,6 +328,9 @@ struct RootView: View {
             case .liveSession: selection = .today
             // The #627 Today journal widget routes to the Insights sidebar row (which hosts the journal card).
             case .journal: selection = .insights
+            // #1862: the Today Coach card's launcher hands off here, so the send/stream/consent surface
+            // stays in exactly one place.
+            case .coach: selection = .coach
             case nil: break
             }
             if dest != nil { router.requestedDestination = nil }
diff --git a/Strand/Liquid/LiquidTodayView.swift b/Strand/Liquid/LiquidTodayView.swift
index 745e720365..fc74d31d7b 100644
--- a/Strand/Liquid/LiquidTodayView.swift
+++ b/Strand/Liquid/LiquidTodayView.swift
@@ -75,6 +75,8 @@ struct LiquidTodayView: View {
     // sheets / expanders
     @State private var guideSection: ScoreSection?
     @State private var customizationDestination: TodayCustomizationDestination?
+    /// #1862: the optional Coach launcher sheet. Presentation state only — opening it requests nothing.
+    @State private var showCoachLauncher = false
     @State private var showSettings = false
     @State private var synthesisExpanded = false
     @State private var showLiveSession = false
@@ -436,6 +438,9 @@ struct LiquidTodayView: View {
                 hostedCardsRaw: $hostedCardsRaw
             )
         }
+        .sheet(isPresented: $showCoachLauncher) {
+            CoachLauncherSheet()
+        }
         .sheet(isPresented: $showSettings) {
             NavigationStack {
                 SettingsView()
@@ -987,6 +992,11 @@ struct LiquidTodayView: View {
             // A tap-through to the full Coupled day screen. No value.
             cardLink(.coupled, title: card.title, sub: card.subtitle,
                      value: "", tint: StrandPalette.chargeColor, frac: 0.6)
+        case .coach:
+            // #1862: a sheet rather than a push — the point of the card is to try Coach WITHOUT
+            // leaving Today.
+            cardAction(title: card.title, sub: card.subtitle, value: "",
+                       tint: StrandPalette.accent, frac: 0.5) { showCoachLauncher = true }
         }
     }
 
@@ -995,7 +1005,26 @@ struct LiquidTodayView: View {
     private func cardLink(_ route: TabRoute, title: String, sub: String,
                           value: String, tint: Color, frac: Double?) -> some View {
         NavigationLink(value: route) {
-            HStack(spacing: 12) {
+            cardLinkBody(title: title, sub: sub, value: value, tint: tint, frac: frac)
+        }
+        .buttonStyle(LiquidPressStyle())
+    }
+
+    /// The same row, running `action` instead of pushing (#1862). Coach is the one dashboard card that
+    /// opens a SHEET, so it cannot ride `NavigationLink`; sharing `cardLinkBody` keeps the two kinds of
+    /// row from drifting apart visually.
+    private func cardAction(title: String, sub: String, value: String, tint: Color, frac: Double?,
+                            action: @escaping () -> Void) -> some View {
+        Button(action: action) {
+            cardLinkBody(title: title, sub: sub, value: value, tint: tint, frac: frac)
+        }
+        .buttonStyle(LiquidPressStyle())
+    }
+
+    @ViewBuilder
+    private func cardLinkBody(title: String, sub: String, value: String,
+                              tint: Color, frac: Double?) -> some View {
+        HStack(spacing: 12) {
                 LiquidVessel(value: frac, tint: tint, animated: false).frame(width: 30, height: 30)
                 VStack(alignment: .leading, spacing: 1) {
                     Text(title.uppercased()).font(StrandFont.overlineScaled(11)).tracking(1.0)
@@ -1009,9 +1038,7 @@ struct LiquidTodayView: View {
             }
             .padding(.horizontal, 14)
             .padding(.vertical, 11)
-            .background(NoopPanelSurface(tint: tint, cornerRadius: 20, surfaceOpacity: cardOpacity))
-        }
-        .buttonStyle(LiquidPressStyle())
+        .background(NoopPanelSurface(tint: tint, cornerRadius: 20, surfaceOpacity: cardOpacity))
     }
 
     // MARK: - Synthesis (greeting + readiness pills + one-liner)
diff --git a/Strand/Screens/CoachLauncherSheet.swift b/Strand/Screens/CoachLauncherSheet.swift
new file mode 100644
index 0000000000..e43ec758e6
--- /dev/null
+++ b/Strand/Screens/CoachLauncherSheet.swift
@@ -0,0 +1,146 @@
+import SwiftUI
+import StrandDesign
+
+/// The compact Coach launcher opened from the optional Today card (#1862).
+///
+/// Coach is otherwise reachable only through More/Insights, which makes it easy to miss and means
+/// leaving Today to try it. This is the shortcut — and deliberately ONLY a shortcut.
+///
+/// It owns no send, stream, error or consent surface of its own. Picking a suggestion or submitting the
+/// composer hands the question to `AICoachEngine.pendingPrompt` and routes to `CoachView`, which already
+/// has all of that. A second chat UI would drift from the first, and the issue explicitly defers the
+/// persistent-workspace redesign (threads, retention, backup policy) to a follow-up.
+///
+/// NO PROVIDER REQUEST IS MADE BY OPENING THIS. Everything shown is local: `isConfigured` reads the
+/// stored key, and the prompts are static copy. The first network call still happens where it always
+/// did — inside `AICoachEngine.send`, after an explicit user action.
+struct CoachLauncherSheet: View {
+    @EnvironmentObject var coach: AICoachEngine
+    @EnvironmentObject var router: NavRouter
+    @Environment(\.dismiss) private var dismiss
+
+    @State private var draft = ""
+
+    var body: some View {
+        NavigationStack {
+            ScrollView {
+                VStack(alignment: .leading, spacing: 16) {
+                    if coach.isConfigured {
+                        configured
+                    } else {
+                        unconfigured
+                    }
+                }
+                .padding(16)
+                .frame(maxWidth: .infinity, alignment: .leading)
+            }
+            .background(StrandPalette.surfaceBase.ignoresSafeArea())
+            .navigationTitle(Text("Coach"))
+            #if os(iOS)
+            .navigationBarTitleDisplayMode(.inline)
+            #endif
+            .toolbar {
+                ToolbarItem(placement: .cancellationAction) {
+                    Button("Cancel") { dismiss() }
+                }
+            }
+        }
+        #if os(iOS)
+        .presentationDetents([.medium, .large])
+        #endif
+    }
+
+    // MARK: Configured — suggestions + a compact composer
+
+    @ViewBuilder
+    private var configured: some View {
+        Text("Ask about your charge, effort, rest and workouts, grounded in your own numbers.")
+            .font(StrandFont.footnote)
+            .foregroundStyle(StrandPalette.textTertiary)
+
+        // Deliberately no "Try asking" heading: the line above already frames the list, and a new
+        // literal would be the only string in this card needing translation into ten locales. The whole
+        // launcher reuses copy the Coach screen already ships.
+
+        ForEach(CoachPrompts.suggestions, id: \.self) { prompt in
+            Button { hand(off: prompt) } label: {
+                Text(prompt)
+                    .font(StrandFont.caption)
+                    .foregroundStyle(StrandPalette.textPrimary)
+                    .padding(.horizontal, 12).padding(.vertical, 8)
+                    .frame(maxWidth: .infinity, alignment: .leading)
+                    .background(FrostedCardSurface(cornerRadius: NoopMetrics.cardRadius))
+                    .contentShape(Rectangle())
+            }
+            .buttonStyle(.plain)
+            .accessibilityLabel(Text("Suggested prompt: \(prompt)"))
+        }
+
+        HStack(spacing: 8) {
+            TextField("Ask your coach…", text: $draft, axis: .vertical)
+                .textFieldStyle(.plain)
+                .lineLimit(1...3)
+                .padding(.horizontal, 12).padding(.vertical, 9)
+                .background(FrostedCardSurface(cornerRadius: NoopMetrics.cardRadius))
+                .onSubmit { submitDraft() }
+            Button {
+                submitDraft()
+            } label: {
+                Image(systemName: "arrow.up.circle.fill")
+                    .font(.system(size: 26, weight: .semibold))
+                    .foregroundStyle(StrandPalette.accent)
+            }
+            .buttonStyle(.plain)
+            .disabled(trimmedDraft.isEmpty)
+            .accessibilityLabel(Text("Send"))
+        }
+        .padding(.top, 4)
+    }
+
+    // MARK: Not configured — explain the opt-in and route to the existing setup
+
+    @ViewBuilder
+    private var unconfigured: some View {
+        // The SAME explanation the Coach screen shows, so the bring-your-own-key model is described
+        // once. The button routes to that screen, which stays the only place a key is entered.
+        Text("Coach uses your own API key. Pick a provider, paste a key, and choose a model. Your key is stored securely in the Keychain and never leaves \(Platform.deviceNounPhrase) except as the request you make.")
+            .font(StrandFont.footnote)
+            .foregroundStyle(StrandPalette.textTertiary)
+
+        Button {
+            dismiss()
+            router.openCoach()
+        } label: {
+            Text("Connect a provider")
+                .font(StrandFont.caption)
+                .foregroundStyle(StrandPalette.textPrimary)
+                .padding(.horizontal, 14).padding(.vertical, 10)
+                .frame(maxWidth: .infinity)
+                .background(FrostedCardSurface(cornerRadius: NoopMetrics.cardRadius))
+                .contentShape(Rectangle())
+        }
+        .buttonStyle(.plain)
+    }
+
+    // MARK: Handoff
+
+    private var trimmedDraft: String {
+        draft.trimmingCharacters(in: .whitespacesAndNewlines)
+    }
+
+    private func submitDraft() {
+        let text = trimmedDraft
+        guard !text.isEmpty else { return }
+        hand(off: text)
+    }
+
+    /// Dismiss, park the question, and open Coach. Deliberately NOT `coach.send` from here: the launcher
+    /// never performs a provider request, so a user who opens this sheet and changes their mind has cost
+    /// nothing and sent nothing.
+    private func hand(off prompt: String) {
+        coach.pendingPrompt = prompt
+        draft = ""
+        dismiss()
+        router.openCoach()
+    }
+}
diff --git a/Strand/Screens/CoachPrompts.swift b/Strand/Screens/CoachPrompts.swift
new file mode 100644
index 0000000000..bcbe96388e
--- /dev/null
+++ b/Strand/Screens/CoachPrompts.swift
@@ -0,0 +1,17 @@
+import Foundation
+
+/// The suggested questions offered when a Coach thread is empty (#1862).
+///
+/// Extracted from `CoachView` so the Today launcher sheet and the full screen offer the SAME four
+/// prompts. Two hardcoded lists would have drifted the moment either was edited, and the launcher's
+/// whole purpose is to be a shortcut into the screen rather than a second, subtly different Coach.
+///
+/// The strings are unchanged and keep their existing String Catalog keys, so nothing needs retranslating.
+enum CoachPrompts {
+    static let suggestions: [String] = [
+        String(localized: "How's my charge trending?"),
+        String(localized: "What should today's training look like?"),
+        String(localized: "Analyse my sleep"),
+        String(localized: "Why am I run down?"),
+    ]
+}
diff --git a/Strand/Screens/CoachView.swift b/Strand/Screens/CoachView.swift
index e84e109347..e9577e3a34 100644
--- a/Strand/Screens/CoachView.swift
+++ b/Strand/Screens/CoachView.swift
@@ -34,12 +34,8 @@ struct CoachView: View {
     /// Sentinel tag for the "Custom…" entry in the model Picker.
     private let customModelTag = "__custom__"
 
-    private let suggestions = [
-        String(localized: "How's my charge trending?"),
-        String(localized: "What should today's training look like?"),
-        String(localized: "Analyse my sleep"),
-        String(localized: "Why am I run down?"),
-    ]
+    /// #1862: shared with the Today Coach launcher sheet — see `CoachPrompts`.
+    private var suggestions: [String] { CoachPrompts.suggestions }
 
     var body: some View {
         ScreenScaffold(title: "Coach",
@@ -81,6 +77,16 @@ struct CoachView: View {
             }
         }
         .task(id: coach.dataConsent) { await coach.startBriefIfNeeded() }
+        // #1862: a question handed over by the Today launcher sheet. Cleared BEFORE sending so a view
+        // rebuild mid-flight cannot send it twice, and gated on `isConfigured` so an unconfigured handoff
+        // (which the launcher does not produce, but a future caller might) degrades to showing setup
+        // rather than a failed request.
+        .task(id: coach.pendingPrompt) {
+            guard let prompt = coach.pendingPrompt, !prompt.isEmpty else { return }
+            coach.pendingPrompt = nil
+            guard coach.isConfigured else { return }
+            await coach.send(prompt)
+        }
     }
 
     /// Explicit, revocable permission for the coach to read & send the user's data. Off by default.
diff --git a/Strand/Screens/DashboardCards.swift b/Strand/Screens/DashboardCards.swift
index 34a7430485..eef7805467 100644
--- a/Strand/Screens/DashboardCards.swift
+++ b/Strand/Screens/DashboardCards.swift
@@ -37,6 +37,13 @@ enum DashboardCard: String, CaseIterable, Identifiable {
     /// adds it via CUSTOMISE, matching the manual-first / default-OFF posture.
     case coupled
 
+    /// Optional, default-OFF (#1862): a tap-through that opens the Coach launcher SHEET rather than pushing
+    /// a screen — the one card that does. Coach is otherwise buried in More, and entering it means leaving
+    /// Today. Like `coupled` it carries no metric value of its own and is absent from `defaultSelection`, so
+    /// a fresh install never shows it: someone who does not use a provider should not gain a fixed dashboard
+    /// row for one. Opening the sheet makes NO provider request — see `CoachLauncherSheet`.
+    case coach
+
     var id: String { rawValue }
 
     /// The card's display label (the UPPERCASE WHOOP metric-row label is derived from this). Localized via
@@ -58,6 +65,7 @@ enum DashboardCard: String, CaseIterable, Identifiable {
         case .calories:    return String(localized: "Calories")
         case .hydration:   return String(localized: "Hydration")
         case .coupled:     return String(localized: "Coupled view")
+        case .coach:       return String(localized: "Coach")
         }
     }
 
@@ -79,6 +87,9 @@ enum DashboardCard: String, CaseIterable, Identifiable {
         case .calories:    return String(localized: "Active energy")
         case .hydration:   return String(localized: "Today's fluid")
         case .coupled:     return String(localized: "Recovery, strain and sleep in one glance")
+        // Reuses the Coach screen's own subtitle, so the card and the screen describe the feature
+        // identically and no new copy needs translating into ten locales.
+        case .coach:       return String(localized: "Ask about your charge, effort, rest and workouts, grounded in your own numbers.")
         }
     }
 
@@ -99,6 +110,7 @@ enum DashboardCard: String, CaseIterable, Identifiable {
         case .calories:    return "flame.fill"
         case .hydration:   return "waterbottle.fill"
         case .coupled:     return "circle.hexagongrid.fill"
+        case .coach:       return "bubble.left.and.text.bubble.right.fill"
         }
     }
 
@@ -119,6 +131,7 @@ enum DashboardCard: String, CaseIterable, Identifiable {
         case .calories:    return "kcal"
         case .hydration:   return ""    // value bakes in "<total> / <goal> L" itself
         case .coupled:     return ""    // a tap-through row, no value, so no unit
+        case .coach:       return ""    // likewise: a launcher row, no metric of its own
         }
     }
 
diff --git a/Strand/Screens/TodayCustomizationMetadata.swift b/Strand/Screens/TodayCustomizationMetadata.swift
index 94f561eef8..8e6d9f6775 100644
--- a/Strand/Screens/TodayCustomizationMetadata.swift
+++ b/Strand/Screens/TodayCustomizationMetadata.swift
@@ -78,6 +78,7 @@ extension DashboardCard {
         case .skinTemp, .calories: return StrandPalette.metricAmber
         case .sleep: return StrandPalette.restColor
         case .coupled: return StrandPalette.chargeColor
+        case .coach: return StrandPalette.accent
         }
     }
 }
diff --git a/Strand/Screens/TodayView.swift b/Strand/Screens/TodayView.swift
index 43fdb0c913..abf8148c6f 100644
--- a/Strand/Screens/TodayView.swift
+++ b/Strand/Screens/TodayView.swift
@@ -403,6 +403,9 @@ struct TodayView: View {
     @State private var showSettings = false
     @State private var showLiveSession = false
     /// The Updates inbox sheet (opened by the header bell). Shared across both platforms.
+    /// #1862: the optional Coach launcher sheet, opened from the default-OFF Coach dashboard card.
+    /// Presentation state only — nothing is requested from a provider by opening it.
+    @State private var showCoachLauncher = false
     @State private var showUpdatesInbox = false
 
     /// The NEWEST day-key (max yyyy-MM-dd in `repo.days`) announced to the inbox. Persisted (not @State)
@@ -1531,6 +1534,9 @@ struct TodayView: View {
             ScoringGuideView(onClose: { showGuideTop = false })
         }
         // The Updates inbox (the header bell). Both platforms.
+        .sheet(isPresented: $showCoachLauncher) {
+            CoachLauncherSheet()
+        }
         .sheet(isPresented: $showUpdatesInbox) {
             UpdatesInboxView(onClose: { showUpdatesInbox = false })
         }
@@ -2572,6 +2578,11 @@ struct TodayView: View {
             // coupled day screen. An empty value renders just the icon + title + subtitle + chevron.
             pinnedCardRow(icon: card.icon, tint: tint, title: card.title, subtitle: card.subtitle,
                           value: dashboardValue(card), route: .coupled)
+        case .coach:
+            // #1862: a SHEET, not a push — Coach is a thing you dip into and dismiss, and pushing it
+            // would take you off Today, which is the discoverability problem this card exists to solve.
+            pinnedCardActionRow(icon: card.icon, tint: tint, title: card.title, subtitle: card.subtitle,
+                                value: dashboardValue(card)) { showCoachLauncher = true }
         }
     }
 
@@ -2593,6 +2604,7 @@ struct TodayView: View {
         case .calories:    return StrandPalette.metricAmber
         case .hydration:   return StrandPalette.metricCyan
         case .coupled:     return StrandPalette.chargeColor
+        case .coach:       return StrandPalette.accent
         }
     }
 
@@ -2701,6 +2713,10 @@ struct TodayView: View {
             // A tap-through row with no metric value of its own, the row shows just the chevron. Returning
             // an empty string (not "—") renders no number and leaves it un-dimmed (it isn't a missing value).
             return ""
+        case .coach:
+            // #1862: likewise a launcher row. Empty rather than "—" for the same reason — there is no
+            // missing measurement here, there is no measurement at all.
+            return ""
         }
     }
 
@@ -2712,37 +2728,56 @@ struct TodayView: View {
     private func pinnedCardRow(icon: String, tint: Color, title: String, subtitle: String,
                                value: String, route: TabRoute) -> some View {
         NavigationLink(value: route) {
-            HStack(spacing: 12) {
-                RoundedRectangle(cornerRadius: 9, style: .continuous)
-                    .fill(tint.opacity(0.14))
-                    .frame(width: 34, height: 34)
-                    .overlay(Image(systemName: icon).font(.system(size: 15, weight: .semibold)).foregroundStyle(tint))
-                VStack(alignment: .leading, spacing: 2) {
-                    Text(title.uppercased())
-                        .font(StrandFont.overline)
-                        .tracking(StrandFont.overlineTracking)
-                        .foregroundStyle(StrandPalette.textPrimary)
-                        .lineLimit(1)
-                    Text(subtitle)
-                        .font(StrandFont.footnote)
-                        .foregroundStyle(StrandPalette.textTertiary)
-                        .lineLimit(1)
-                }
-                Spacer(minLength: 8)
-                // A real number reads white; a placeholder (, / Calibrating) reads dimmed so it doesn't
-                // masquerade as a value.
-                let isPlaceholder = (value == "—" || value == Self.calibratingPlaceholder)
-                Text(value).font(StrandFont.rounded(18, weight: .semibold))
-                    .foregroundStyle(isPlaceholder ? StrandPalette.textTertiary : StrandPalette.textPrimary)
-                Image(systemName: "chevron.right").font(.system(size: 13, weight: .semibold))
+            pinnedCardRowBody(icon: icon, tint: tint, title: title, subtitle: subtitle, value: value)
+        }
+        .buttonStyle(.plain)
+    }
+
+    /// The same row, but it runs `action` instead of pushing a route (#1862).
+    ///
+    /// Coach is the one dashboard card that opens a SHEET rather than a screen, so it cannot ride
+    /// `NavigationLink`. Both wrappers render `pinnedCardRowBody`, so the two kinds of row cannot drift
+    /// apart visually — which duplicating the HStack for one caller would have guaranteed eventually.
+    private func pinnedCardActionRow(icon: String, tint: Color, title: String, subtitle: String,
+                                     value: String, action: @escaping () -> Void) -> some View {
+        Button(action: action) {
+            pinnedCardRowBody(icon: icon, tint: tint, title: title, subtitle: subtitle, value: value)
+        }
+        .buttonStyle(.plain)
+    }
+
+    @ViewBuilder
+    private func pinnedCardRowBody(icon: String, tint: Color, title: String, subtitle: String,
+                                   value: String) -> some View {
+        HStack(spacing: 12) {
+            RoundedRectangle(cornerRadius: 9, style: .continuous)
+                .fill(tint.opacity(0.14))
+                .frame(width: 34, height: 34)
+                .overlay(Image(systemName: icon).font(.system(size: 15, weight: .semibold)).foregroundStyle(tint))
+            VStack(alignment: .leading, spacing: 2) {
+                Text(title.uppercased())
+                    .font(StrandFont.overline)
+                    .tracking(StrandFont.overlineTracking)
+                    .foregroundStyle(StrandPalette.textPrimary)
+                    .lineLimit(1)
+                Text(subtitle)
+                    .font(StrandFont.footnote)
                     .foregroundStyle(StrandPalette.textTertiary)
+                    .lineLimit(1)
             }
-            .padding(.horizontal, 13).padding(.vertical, 11)
-            .frame(maxWidth: .infinity, alignment: .leading)
-            .background(FrostedCardSurface(cornerRadius: NoopMetrics.cardRadius))
-            .contentShape(Rectangle())
+            Spacer(minLength: 8)
+            // A real number reads white; a placeholder (, / Calibrating) reads dimmed so it doesn't
+            // masquerade as a value.
+            let isPlaceholder = (value == "—" || value == Self.calibratingPlaceholder)
+            Text(value).font(StrandFont.rounded(18, weight: .semibold))
+                .foregroundStyle(isPlaceholder ? StrandPalette.textTertiary : StrandPalette.textPrimary)
+            Image(systemName: "chevron.right").font(.system(size: 13, weight: .semibold))
+                .foregroundStyle(StrandPalette.textTertiary)
         }
-        .buttonStyle(.plain)
+        .padding(.horizontal, 13).padding(.vertical, 11)
+        .frame(maxWidth: .infinity, alignment: .leading)
+        .background(FrostedCardSurface(cornerRadius: NoopMetrics.cardRadius))
+        .contentShape(Rectangle())
     }
 
     // MARK: Component 2, explained score note (calibrating / carried / needs-strap)
diff --git a/StrandiOS/App/RootTabView.swift b/StrandiOS/App/RootTabView.swift
index f4d34b0afb..45659fb502 100644
--- a/StrandiOS/App/RootTabView.swift
+++ b/StrandiOS/App/RootTabView.swift
@@ -201,6 +201,11 @@ struct RootTabView: View {
                 // so a deep-link lands on the Today tab where that entry lives.
                 withAnimation(.timingCurve(0.22, 1, 0.36, 1, duration: 0.24)) { selectedTab = 0 }
                 router.requestedDestination = nil
+            case .coach:
+                // #1862: the Today Coach launcher hands its question here. Coach is a pillar sheet on
+                // iPhone, the same as the Insights hub, so route it that way rather than switching tabs.
+                routedPillar = dest
+                router.requestedDestination = nil
             case .journal:
                 // The #627 Today journal widget opens the journal through the quick-action Journal sheet
                 // (InsightsView), matching the FAB's "Log journal" action. Calm sheet easing.
@@ -275,6 +280,9 @@ struct RootTabView: View {
                 // .journal opens through the quick-action Journal sheet (handled above); this keeps the
                 // switch exhaustive and falls back to the journal's Insights host if it ever reaches here.
                 case .journal: InsightsView()
+                // #1862: Coach IS presented here — the launcher sheet routes to it as a pillar, so unlike
+                // the fallbacks above this arm is the real destination, not a safety net.
+                case .coach: CoachView()
                 }
             }
             // The Trends/Today fallbacks above emit TabRoute value pushes (#198), which need a
diff --git a/Tools/test_home_i18n.py b/Tools/test_home_i18n.py
index 8c140b7ba8..cf25311dd1 100644
--- a/Tools/test_home_i18n.py
+++ b/Tools/test_home_i18n.py
@@ -96,6 +96,7 @@
     "today.keyMetricsWindowDays", ",",
     # Stable DashboardCard raw values + preference; units remain measurement metadata.
     "stress", "fitnessAge", "vo2max", "vitality", "skinTemp", "sleep", "hydration", "coupled",
+    "coach",
     "today.dashboardCards", "yrs", "kcal", "",
 }
 
diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 060122b96f..a0b2b21c91 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 437
+        versionCode = 438
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/android/app/src/main/java/com/noop/ui/AppRoot.kt b/android/app/src/main/java/com/noop/ui/AppRoot.kt
index cad437d7d2..042b04e765 100644
--- a/android/app/src/main/java/com/noop/ui/AppRoot.kt
+++ b/android/app/src/main/java/com/noop/ui/AppRoot.kt
@@ -531,6 +531,9 @@ fun AppRoot(viewModel: AppViewModel = viewModel()) {
                         onOpenSleep = { nav.navigateTopLevel(Destination.Sleep.route) },
                         // Optional Coupled view card (task #43): a normal push so back returns to Today.
                         onOpenCoupled = { nav.navigate(Destination.CoupledView.route) },
+                        // #1862: the Coach launcher hands off here. Without this the sheet's buttons
+                        // would fall back to the parameter's no-op default and silently do nothing.
+                        onOpenCoach = { nav.navigateTopLevel(Destination.Coach.route) },
                         // The "workout in progress" indicator: raise the one-shot the Live screen consumes to
                         // re-open the in-exercise overlay, then route to Live. One tap from Today (iOS parity).
                         onOpenActiveWorkout = {
diff --git a/android/app/src/main/java/com/noop/ui/CoachLauncherSheet.kt b/android/app/src/main/java/com/noop/ui/CoachLauncherSheet.kt
new file mode 100644
index 0000000000..355a9c71c0
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ui/CoachLauncherSheet.kt
@@ -0,0 +1,98 @@
+package com.noop.ui
+
+import androidx.compose.foundation.background
+import androidx.compose.foundation.border
+import androidx.compose.foundation.clickable
+import androidx.compose.ui.draw.clip
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material3.ExperimentalMaterial3Api
+import androidx.compose.material3.ModalBottomSheet
+import androidx.compose.material3.rememberModalBottomSheetState
+import androidx.compose.runtime.Composable
+import androidx.compose.material3.Text
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.semantics.contentDescription
+import androidx.compose.ui.semantics.semantics
+import androidx.compose.ui.unit.dp
+import com.noop.R
+
+/**
+ * The compact Coach launcher opened from the optional Today card (#1862).
+ *
+ * Coach is otherwise reachable only through More, which makes it easy to miss and means leaving Today to
+ * try it. This is the shortcut — and deliberately ONLY a shortcut.
+ *
+ * It owns no send, stream, error or consent surface of its own. Picking a suggestion hands the question
+ * to [onPick], which routes to the Coach screen; that screen already has all of those. A second chat UI
+ * would drift from the first, and #1862 explicitly defers the persistent-workspace redesign (threads,
+ * retention, backup policy) to a follow-up.
+ *
+ * NO PROVIDER REQUEST IS MADE BY SHOWING THIS. [isConfigured] is a local key read and the prompts are
+ * static copy; the first network call still happens where it always did, after an explicit send.
+ *
+ * Presentational by construction — every input is injected — so it can be exercised without a provider,
+ * a key, or a ViewModel. Swift twin: `CoachLauncherSheet`.
+ */
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+fun CoachLauncherSheet(
+    isConfigured: Boolean,
+    onPick: (String) -> Unit,
+    onSetup: () -> Unit,
+    onDismiss: () -> Unit,
+) {
+    val sheetState = rememberModalBottomSheetState(skipPartiallyExpanded = true)
+    ModalBottomSheet(
+        onDismissRequest = onDismiss,
+        sheetState = sheetState,
+        containerColor = Palette.surfaceRaised,
+    ) {
+        Column(
+            modifier = Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 8.dp),
+            verticalArrangement = Arrangement.spacedBy(12.dp),
+        ) {
+            Overline(uiString(R.string.nav_coach))
+            // Frames BOTH branches, so the sheet says what Coach is before it either offers questions or
+            // asks for a provider. Using it once also avoids the duplicate that an unconfigured-only
+            // explainer produced, where "Connect a provider" read as both the description and the button.
+            Text(
+                uiString(R.string.l10n_coach_screen_ask_anything_about_your_recent_recovery_e6c287ca),
+                style = NoopType.caption,
+                color = Palette.textTertiary,
+            )
+            if (isConfigured) {
+                CoachPrompts.SUGGESTIONS.forEach { prompt ->
+                    PromptRow(prompt = prompt, onClick = { onPick(prompt) })
+                }
+            } else {
+                // The Coach screen stays the only place a key is entered; this just routes there.
+                PromptRow(
+                    prompt = uiString(R.string.l10n_coach_screen_connect_a_provider_6967f288),
+                    onClick = onSetup,
+                )
+            }
+        }
+    }
+}
+
+@Composable
+private fun PromptRow(prompt: String, onClick: () -> Unit) {
+    val shape = RoundedCornerShape(12.dp)
+    Text(
+        prompt,
+        style = NoopType.caption,
+        color = Palette.textPrimary,
+        modifier = Modifier
+            .fillMaxWidth()
+            .clip(shape)
+            .background(Palette.surfaceInset)
+            .border(1.dp, Palette.hairline, shape)
+            .clickable { onClick() }
+            .padding(horizontal = 12.dp, vertical = 10.dp)
+            .semantics { contentDescription = prompt },
+    )
+}
diff --git a/android/app/src/main/java/com/noop/ui/CoachPrompts.kt b/android/app/src/main/java/com/noop/ui/CoachPrompts.kt
new file mode 100644
index 0000000000..c7eddf12c0
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ui/CoachPrompts.kt
@@ -0,0 +1,44 @@
+package com.noop.ui
+
+/**
+ * The suggested questions offered when a Coach thread is empty (#1862).
+ *
+ * Extracted from [CoachScreen] so the Today launcher sheet and the full screen offer the SAME four
+ * prompts. Swift twin: `CoachPrompts.suggestions`.
+ *
+ * The strings are unchanged from what the Coach screen already shipped. They are English literals here
+ * exactly as they were there — localizing them is a separate change with its own four-locale cost, and
+ * doing it inside a launcher PR would bury it.
+ */
+object CoachPrompts {
+    val SUGGESTIONS: List<String> = listOf(
+        "How's my recovery trending this week?",
+        "Should I train hard or take it easy today?",
+        "Why might my HRV be low lately?",
+        "How can I improve my sleep?",
+    )
+}
+
+/**
+ * A question handed over by the Today Coach launcher sheet, for [CoachScreen] to send once (#1862).
+ *
+ * Swift passes this on the shared `AICoachEngine`, which is an app-wide `EnvironmentObject`. Android has
+ * no equivalent shared instance here: `CoachScreen` takes `viewModel()`, which is scoped to the nav
+ * back-stack entry, so state set from Today would reach a different object. A process-scoped holder is
+ * the smallest thing that actually crosses that boundary.
+ *
+ * `@Volatile` because it is written on the main thread and read by the screen's first composition.
+ * Setting it performs NO network work by itself; the send still happens in the Coach screen, which owns
+ * the consent and error surface.
+ */
+object CoachHandoff {
+    @Volatile
+    var pendingPrompt: String? = null
+
+    /** Take the pending question and clear it, so a recomposition cannot send it twice. */
+    fun consume(): String? {
+        val p = pendingPrompt
+        pendingPrompt = null
+        return p
+    }
+}
diff --git a/android/app/src/main/java/com/noop/ui/CoachScreen.kt b/android/app/src/main/java/com/noop/ui/CoachScreen.kt
index 8d5d2fa0b3..92625a75a3 100644
--- a/android/app/src/main/java/com/noop/ui/CoachScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/CoachScreen.kt
@@ -36,6 +36,7 @@ import androidx.compose.material3.OutlinedTextFieldDefaults
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
@@ -76,6 +77,13 @@ fun CoachScreen(vm: CoachViewModel = viewModel()) {
     val customConnected by vm.customConnected.collectAsStateWithLifecycle()
     // Re-evaluate the gate whenever the stored key, provider, or custom-connect state changes.
     val configured = remember(keyVersion, provider, customConnected) { vm.isConfigured(context) }
+    // #1862: a question handed over by the Today launcher sheet. Consumed once — `consume()` clears it —
+    // so a recomposition cannot resend it, and only when the coach can actually send, so an unconfigured
+    // handoff degrades to showing setup rather than a failed request. Swift twin: CoachView's task.
+    LaunchedEffect(configured) {
+        val handed = CoachHandoff.consume()
+        if (handed != null && configured) vm.send(context, handed)
+    }
     // Same day-cycle gate as the liquid Today: the time-of-day sky settles behind the top content when the
     // user hasn't opted out; otherwise the scaffold paints the plain dark canvas.
     val showDayCycleBackground = remember { NoopPrefs.showDayCycleBackground(context) }
@@ -509,12 +517,13 @@ private fun ThinkingBubble() {
 
 // MARK: - Suggested prompts
 
-private val SUGGESTED_PROMPTS = listOf(
-    "How's my recovery trending this week?",
-    "Should I train hard or take it easy today?",
-    "Why might my HRV be low lately?",
-    "How can I improve my sleep?",
-)
+/**
+ * #1862: shared with the Today Coach launcher sheet — see [CoachPrompts].
+ *
+ * Two hardcoded lists would have drifted the moment either was edited, and the launcher's whole purpose
+ * is to be a shortcut INTO this screen rather than a second, subtly different Coach.
+ */
+internal val SUGGESTED_PROMPTS: List<String> get() = CoachPrompts.SUGGESTIONS
 
 @Composable
 private fun SuggestedPrompts(onPick: (String) -> Unit) {
diff --git a/android/app/src/main/java/com/noop/ui/DashboardCards.kt b/android/app/src/main/java/com/noop/ui/DashboardCards.kt
index b461f4cc8b..f394f16455 100644
--- a/android/app/src/main/java/com/noop/ui/DashboardCards.kt
+++ b/android/app/src/main/java/com/noop/ui/DashboardCards.kt
@@ -7,6 +7,7 @@ import androidx.compose.material.icons.filled.Air
 import androidx.compose.material.icons.filled.AutoAwesome
 import androidx.compose.material.icons.filled.Bedtime
 import androidx.compose.material.icons.filled.Bolt
+import androidx.compose.material.icons.automirrored.filled.Chat
 import androidx.compose.material.icons.automirrored.filled.DirectionsRun
 import androidx.compose.material.icons.automirrored.filled.DirectionsWalk
 import androidx.compose.material.icons.filled.Favorite
@@ -64,7 +65,15 @@ enum class DashboardCard(
     // every other card it carries NO metric value of its own, it is a navigation row that opens the full
     // CoupledScreen. It is NOT in [defaultSelection], so a fresh install never shows it until the user adds
     // it via CUSTOMISE. Mirrors iOS DashboardCard.coupled (raw "coupled", byte-identical across OS).
-    COUPLED("coupled", R.string.today_card_coupled, R.string.today_card_coupled_subtitle, "", Icons.Filled.Hexagon);
+    COUPLED("coupled", R.string.today_card_coupled, R.string.today_card_coupled_subtitle, "", Icons.Filled.Hexagon),
+
+    // Optional, default-OFF (#1862): opens the Coach launcher BOTTOM SHEET rather than a screen — the one
+    // card that does. Coach is otherwise buried in More, and entering it means leaving Today. Like COUPLED
+    // it carries no metric value and is absent from [defaultSelection], so someone who does not use a
+    // provider never gains a fixed dashboard row for one. Opening the sheet makes NO provider request.
+    // Reuses the existing nav + Coach-screen strings, so the card adds nothing to translate.
+    // Mirrors iOS DashboardCard.coach (raw "coach", byte-identical across OS).
+    COACH("coach", R.string.nav_coach, R.string.l10n_coach_screen_ask_anything_about_your_recent_recovery_e6c287ca, "", Icons.AutoMirrored.Filled.Chat);
 
     companion object {
         fun fromRaw(raw: String?): DashboardCard? = entries.firstOrNull { it.raw == raw }
diff --git a/android/app/src/main/java/com/noop/ui/TodayScreen.kt b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
index b4e8a03f54..b2358e7ada 100644
--- a/android/app/src/main/java/com/noop/ui/TodayScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
@@ -144,6 +144,7 @@ import android.view.HapticFeedbackConstants
 import android.widget.Toast
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import com.noop.R
+import com.noop.ai.AiKeyStore
 import com.noop.analytics.Baselines
 import com.noop.analytics.BatteryEstimator
 import com.noop.analytics.ChargeDriver
@@ -295,6 +296,8 @@ fun TodayScreen(
     // Optional Coupled view card (task #43): a tap-through to the WHOOP-style day screen. Defaulted to a
     // no-op so the call site stays compiling; AppRoot binds it to nav.navigate(CoupledView).
     onOpenCoupled: () -> Unit = {},
+    /** #1862: open Coach, optionally with a question the Today launcher already collected. */
+    onOpenCoach: (String?) -> Unit = {},
     // The "workout in progress" indicator card routes to Live and re-opens the in-exercise overlay. Defaulted
     // to a no-op so the call site stays compiling; AppRoot binds it to openActiveWorkout() + nav.navigate(Live).
     onOpenActiveWorkout: () -> Unit = {},
@@ -1667,6 +1670,7 @@ fun TodayScreen(
                             onOpenMetric = onOpenMetric,
                             onOpenSleep = onOpenSleep,
                             onOpenCoupled = onOpenCoupled,
+                            onOpenCoach = onOpenCoach,
                             onCustomise = { showDashboardEditor = true },
                             spo2CandidateByDay = spo2CandidateByDay,
                         )
@@ -3380,6 +3384,7 @@ private fun YourCardsSection(
     onOpenMetric: (String) -> Unit,
     onOpenSleep: () -> Unit,
     onOpenCoupled: () -> Unit,
+    onOpenCoach: (String?) -> Unit,
     onCustomise: () -> Unit,
     spo2CandidateByDay: Map<String, Double> = emptyMap(),
 ) {
@@ -3387,6 +3392,22 @@ private fun YourCardsSection(
     // Swift twin) do. The classic dashboard hardcoded Celsius here alone, so a °F user saw °C on this
     // screen only.
     val fahrenheit = UnitPrefs.temperature(LocalContext.current) == TemperatureUnit.FAHRENHEIT
+    // #1862: the optional Coach card opens a launcher BOTTOM SHEET rather than a destination. Local
+    // presentation state — showing it requests nothing from a provider.
+    var showCoachLauncher by remember { mutableStateOf(false) }
+    if (showCoachLauncher) {
+        val ctx = LocalContext.current
+        CoachLauncherSheet(
+            isConfigured = AiKeyStore.hasKey(ctx),
+            onPick = { prompt ->
+                showCoachLauncher = false
+                CoachHandoff.pendingPrompt = prompt
+                onOpenCoach(prompt)
+            },
+            onSetup = { showCoachLauncher = false; onOpenCoach(null) },
+            onDismiss = { showCoachLauncher = false },
+        )
+    }
     Box(modifier = Modifier.fillMaxWidth().staggeredAppear(2)) {
         Column(verticalArrangement = Arrangement.spacedBy(Metrics.gap)) {
             // Header: "YOUR CARDS" overline + a right-aligned blue EDIT action (the WHOOP ✎ affordance).
@@ -3455,6 +3476,7 @@ private fun YourCardsSection(
                         onOpenSleep = onOpenSleep,
                         onOpenHydration = onOpenHydration,
                         onOpenCoupled = onOpenCoupled,
+                        onOpenCoach = { showCoachLauncher = true },
                     ),
                 )
             }
@@ -3495,7 +3517,9 @@ private fun dashboardCardMetricKey(card: DashboardCard): String? = when (card) {
     DashboardCard.STEPS -> "steps_est"
     DashboardCard.CALORIES -> "active_kcal"
     // These carry their own full screen, not a per-metric trend.
-    DashboardCard.STRESS, DashboardCard.SLEEP, DashboardCard.HYDRATION, DashboardCard.COUPLED -> null
+    DashboardCard.STRESS, DashboardCard.SLEEP, DashboardCard.HYDRATION, DashboardCard.COUPLED,
+    // #1862: a launcher row, not a metric — no explorer key.
+    DashboardCard.COACH -> null
 }
 
 /** The destination callback a dashboard card opens when tapped. Mirrors the iOS dashboardCardRow switch:
@@ -3509,12 +3533,17 @@ private fun dashboardCardDestination(
     onOpenSleep: () -> Unit,
     onOpenHydration: () -> Unit,
     onOpenCoupled: () -> Unit,
+    // #1862: Coach is the one card that opens a SHEET rather than a destination, so its "destination" is
+    // a callback that shows the launcher. Kept in this same resolver so every card still resolves to
+    // exactly one tap action and the chevron stays honest.
+    onOpenCoach: () -> Unit,
 ): () -> Unit = when (card) {
     DashboardCard.STRESS -> onOpenStress
     DashboardCard.SLEEP -> onOpenSleep
     DashboardCard.HYDRATION -> onOpenHydration
     // The Coupled view card (#43) taps through to the full WHOOP-style day screen.
     DashboardCard.COUPLED -> onOpenCoupled
+    DashboardCard.COACH -> onOpenCoach
     // Every overnight vital + Fitness age / Vitality / Steps / Calories opens its own metric-detail trend.
     else -> {
         val key = dashboardCardMetricKey(card)
@@ -3545,6 +3574,7 @@ private fun dashboardCardTint(card: DashboardCard): Color = when (card) {
     DashboardCard.CALORIES -> Palette.metricAmber
     DashboardCard.HYDRATION -> Palette.metricCyan
     DashboardCard.COUPLED -> Palette.chargeColor
+    DashboardCard.COACH -> Palette.accent
 }
 
 /**
@@ -3591,6 +3621,7 @@ private fun dashboardCardFraction(
         }
         DashboardCard.SLEEP -> over(vd?.totalSleepMin, 480.0)
         DashboardCard.COUPLED -> 0.6
+        DashboardCard.COACH -> 0.5
         // Not wired to a real read yet — an EMPTY vessel (not half-full) so it doesn't imply a reading.
         DashboardCard.BLOOD_OXYGEN, DashboardCard.SKIN_TEMP, DashboardCard.CALORIES,
         DashboardCard.HYDRATION -> null
@@ -3716,6 +3747,10 @@ private fun dashboardCardValue(
             // A tap-through row with no metric value of its own, the row shows just the chevron. An empty
             // string (not NO_DATA) renders no number and leaves it un-dimmed. Mirrors iOS dashboardValue.
             ""
+        DashboardCard.COACH ->
+            // #1862: likewise a launcher row. Empty rather than NO_DATA for the same reason — there is no
+            // missing measurement here, there is no measurement at all.
+            ""
     }
 }
 
diff --git a/android/app/src/test/java/com/noop/ui/CoachCardTest.kt b/android/app/src/test/java/com/noop/ui/CoachCardTest.kt
new file mode 100644
index 0000000000..704127e868
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/CoachCardTest.kt
@@ -0,0 +1,71 @@
+package com.noop.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The Coach launcher card's contract (#1862) — the parts that are testable without a device.
+ *
+ * The issue asks for one thing above all: the card must be ABSENT by default. Someone who does not use
+ * an AI provider should not gain a fixed dashboard row for one, and that is a property of the default
+ * selection, not of the UI.
+ */
+class CoachCardTest {
+
+    /** The headline requirement: opt-in, never a fresh install's default. */
+    @Test
+    fun `the coach card is not in the default selection`() {
+        assertFalse("Coach must be opt-in", DashboardCard.defaultSelection.contains(DashboardCard.COACH))
+        assertFalse("Coupled is the same posture and stays that way",
+            DashboardCard.defaultSelection.contains(DashboardCard.COUPLED))
+    }
+
+    /** It must be addable, so it has to survive the raw round-trip Today customization persists through. */
+    @Test
+    fun `the coach card round-trips through its persisted raw value`() {
+        assertEquals(DashboardCard.COACH, DashboardCard.fromRaw("coach"))
+        // Byte-identical to the iOS `DashboardCard.coach` raw, so a settings backup restores across OS.
+        assertEquals("coach", DashboardCard.COACH.raw)
+    }
+
+    /**
+     * A launcher row carries no measurement, so it must not render a unit — an empty unit is what makes
+     * the row show just icon + title + subtitle + chevron, exactly as COUPLED does.
+     */
+    @Test
+    fun `the coach card carries no unit`() {
+        assertTrue(DashboardCard.COACH.unit.isEmpty())
+    }
+
+    /**
+     * The launcher and the full screen must offer the SAME prompts. Two lists drift the moment either is
+     * edited, and the launcher exists to be a shortcut INTO the screen, not a second, different Coach.
+     */
+    @Test
+    fun `the launcher and the coach screen share one prompt list`() {
+        assertEquals(CoachPrompts.SUGGESTIONS, SUGGESTED_PROMPTS)
+        assertTrue("the shared list must not be empty", CoachPrompts.SUGGESTIONS.isNotEmpty())
+    }
+
+    /**
+     * The handoff must be consumed exactly ONCE. `CoachScreen` reads it from a `LaunchedEffect` keyed on
+     * the configured flag, which can re-run; a read that left the value in place would resend the
+     * question — and a resend is a second billed provider request the user did not ask for.
+     */
+    @Test
+    fun `the coach handoff is consumed exactly once`() {
+        CoachHandoff.pendingPrompt = "How can I improve my sleep?"
+        assertEquals("How can I improve my sleep?", CoachHandoff.consume())
+        assertNull("a second read must not resend", CoachHandoff.consume())
+    }
+
+    /** Nothing parked means nothing sent — the ordinary case every time Coach is opened normally. */
+    @Test
+    fun `an empty coach handoff yields nothing`() {
+        CoachHandoff.pendingPrompt = null
+        assertNull(CoachHandoff.consume())
+    }
+}
diff --git a/project.yml b/project.yml
index 9d1e732939..9d25a81803 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "318"
+    CURRENT_PROJECT_VERSION: "319"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From cbbbbfd7d99edefc1d77f8a9d9957d620eb13ca1 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 5 Sep 2026 20:32:30 +1200
Subject: [PATCH 249/333] settings: stop claiming an unpaired strap costs you
 HRV and resting HR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Settings copy on both platforms said an unbonded strap means "sleep is staged from heart rate alone, and HRV and resting heart rate are unavailable". #1884 made the second half false: an HR-only night reports both.

The Apple string is a String Catalog key, so changing the English orphans its nine translations. Each carried the clause as a discrete trailing segment, so it is DELETED from each and nothing is reworded — no new phrasing is invented in any language, which is why they stay translated rather than needs_review. A translator should still check pl and ru, where the structure is verifiable but not the register.

Spliced textually rather than re-serialised: a JSON round-trip of the 6 MB catalogue reformats the whole file. This touches one line of it.

StrapStatusDetailTest pinned the claim being removed, so it is repinned to what survives — the strap stops sending motion, so sleep falls to the HR-only stager — plus a negative guard. That is the third test #1878 wrote this claim into.

Not touched: l10n_today_screen_this_night_was_staged_from_heart_rate_4d0f1f9b still gives HR-only staging as the reason HRV could not be measured. That note only shows when a vital IS blank, so it is not false the way this was, but the reason is now the wrong one.
---
 Strand/Resources/Localizable.xcstrings                     | 2 +-
 Strand/Screens/SettingsView.swift                          | 2 +-
 android/app/src/main/java/com/noop/ui/SettingsLogic.kt     | 2 +-
 .../app/src/test/java/com/noop/ui/StrapStatusDetailTest.kt | 7 +++++--
 4 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index df9abf1142..e4135db0d0 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -209723,7 +209723,7 @@
     "iCloud Drive": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"es":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"fr":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"it":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"pl":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"pt-PT":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"ru":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"iCloud 云盘"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"iCloud 雲碟"}}}},
     "iCloud Drive › %@": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"es":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"fr":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"it":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"pl":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"pt-PT":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"ru":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"iCloud 云盘 › %@"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"iCloud 雲碟 › %@"}}}},
     "NOOP (in Files)": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"NOOP (in Dateien)"}},"es":{"stringUnit":{"state":"translated","value":"NOOP (en Archivos)"}},"fr":{"stringUnit":{"state":"translated","value":"NOOP (dans Fichiers)"}},"it":{"stringUnit":{"state":"translated","value":"NOOP (in File)"}},"pl":{"stringUnit":{"state":"translated","value":"NOOP (w Plikach)"}},"pt-PT":{"stringUnit":{"state":"translated","value":"NOOP (em Ficheiros)"}},"ru":{"stringUnit":{"state":"translated","value":"NOOP (в Файлах)"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"NOOP（在“文件”中）"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"NOOP（在「檔案」中）"}}}},
-    "Live heart rate is streaming, but your strap is not fully paired. The encrypted pairing is what carries motion, skin temperature, SpO₂ and respiratory rate — without it, sleep is staged from heart rate alone, and HRV and resting heart rate are unavailable. Buzz, alarms and history sync need it too.": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Die Live-Herzfrequenz wird übertragen, aber dein Strap ist nicht vollständig gekoppelt. Die verschlüsselte Kopplung liefert Bewegung, Hauttemperatur, SpO₂ und Atemfrequenz — ohne sie wird der Schlaf allein aus der Herzfrequenz abgeleitet, und Herzfrequenzvariabilität und Ruheherzfrequenz sind nicht verfügbar. Auch Buzz, Wecker und Verlaufssynchronisierung brauchen sie."}},"es":{"stringUnit":{"state":"translated","value":"La frecuencia cardíaca en vivo se está transmitiendo, pero tu correa no está totalmente emparejada. El emparejamiento cifrado es el que aporta movimiento, temperatura de la piel, SpO₂ y frecuencia respiratoria: sin él, el sueño se calcula solo a partir de la frecuencia cardíaca, y la variabilidad de la frecuencia cardíaca y la frecuencia cardíaca en reposo no están disponibles. El zumbido, las alarmas y la sincronización del historial también lo necesitan."}},"fr":{"stringUnit":{"state":"translated","value":"La fréquence cardiaque en direct est transmise, mais votre bracelet n'est pas entièrement appairé. C'est l'appairage chiffré qui transporte le mouvement, la température cutanée, la SpO₂ et la fréquence respiratoire — sans lui, le sommeil est estimé à partir de la seule fréquence cardiaque, et la variabilité de la fréquence cardiaque et la fréquence cardiaque au repos sont indisponibles. Le buzz, les alarmes et la synchronisation de l'historique en ont besoin aussi."}},"it":{"stringUnit":{"state":"translated","value":"La frequenza cardiaca live viene trasmessa, ma il tuo strap non è completamente associato. È l'associazione cifrata a trasportare movimento, temperatura della pelle, SpO₂ e frequenza respiratoria — senza di essa il sonno viene stimato dalla sola frequenza cardiaca, e variabilità della frequenza cardiaca e frequenza cardiaca a riposo non sono disponibili. Anche buzz, sveglie e sincronizzazione della cronologia ne hanno bisogno."}},"pl":{"stringUnit":{"state":"translated","value":"Tętno na żywo jest przesyłane, ale opaska nie jest w pełni sparowana. To szyfrowane parowanie przenosi ruch, temperaturę skóry, SpO₂ i częstość oddechów — bez niego sen jest wyznaczany wyłącznie z tętna, a zmienność rytmu serca i tętno spoczynkowe są niedostępne. Wibracje, alarmy i synchronizacja historii też go wymagają."}},"pt-PT":{"stringUnit":{"state":"translated","value":"A frequência cardíaca em direto está a ser transmitida, mas a sua pulseira não está totalmente emparelhada. É o emparelhamento encriptado que transporta movimento, temperatura da pele, SpO₂ e taxa respiratória — sem ele, o sono é calculado apenas a partir da frequência cardíaca, e a variabilidade da frequência cardíaca e a frequência cardíaca em repouso ficam indisponíveis. O zumbido, os alarmes e a sincronização do histórico também precisam dele."}},"ru":{"stringUnit":{"state":"translated","value":"Пульс передаётся в реальном времени, но ремешок сопряжён не полностью. Именно зашифрованное сопряжение передаёт движение, температуру кожи, SpO₂ и частоту дыхания — без него сон определяется только по пульсу, а вариабельность сердечного ритма и пульс в покое недоступны. Вибрация, будильники и синхронизация истории тоже требуют его."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"实时心率正在传输，但你的手环尚未完全配对。加密配对才能传输动作、皮肤温度、SpO₂ 和呼吸频率——没有它，睡眠只能依据心率推算，心率变异性和静息心率将不可用。震动、闹钟和历史同步同样需要它。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"即時心率正在傳輸，但你的手環尚未完全配對。加密配對才能傳輸動作、皮膚溫度、SpO₂ 和呼吸頻率——沒有它，睡眠只能依據心率推算，心率變異性和靜息心率將不可用。震動、鬧鐘和歷史同步同樣需要它。"}}}}
+    "Live heart rate is streaming, but your strap is not fully paired. The encrypted pairing is what carries motion, skin temperature, SpO₂ and respiratory rate — without it, sleep is staged from heart rate alone. Buzz, alarms and history sync need it too.": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Die Live-Herzfrequenz wird übertragen, aber dein Strap ist nicht vollständig gekoppelt. Die verschlüsselte Kopplung liefert Bewegung, Hauttemperatur, SpO₂ und Atemfrequenz — ohne sie wird der Schlaf allein aus der Herzfrequenz abgeleitet. Auch Buzz, Wecker und Verlaufssynchronisierung brauchen sie."}},"es":{"stringUnit":{"state":"translated","value":"La frecuencia cardíaca en vivo se está transmitiendo, pero tu correa no está totalmente emparejada. El emparejamiento cifrado es el que aporta movimiento, temperatura de la piel, SpO₂ y frecuencia respiratoria: sin él, el sueño se calcula solo a partir de la frecuencia cardíaca. El zumbido, las alarmas y la sincronización del historial también lo necesitan."}},"fr":{"stringUnit":{"state":"translated","value":"La fréquence cardiaque en direct est transmise, mais votre bracelet n'est pas entièrement appairé. C'est l'appairage chiffré qui transporte le mouvement, la température cutanée, la SpO₂ et la fréquence respiratoire — sans lui, le sommeil est estimé à partir de la seule fréquence cardiaque. Le buzz, les alarmes et la synchronisation de l'historique en ont besoin aussi."}},"it":{"stringUnit":{"state":"translated","value":"La frequenza cardiaca live viene trasmessa, ma il tuo strap non è completamente associato. È l'associazione cifrata a trasportare movimento, temperatura della pelle, SpO₂ e frequenza respiratoria — senza di essa il sonno viene stimato dalla sola frequenza cardiaca. Anche buzz, sveglie e sincronizzazione della cronologia ne hanno bisogno."}},"pl":{"stringUnit":{"state":"translated","value":"Tętno na żywo jest przesyłane, ale opaska nie jest w pełni sparowana. To szyfrowane parowanie przenosi ruch, temperaturę skóry, SpO₂ i częstość oddechów — bez niego sen jest wyznaczany wyłącznie z tętna. Wibracje, alarmy i synchronizacja historii też go wymagają."}},"pt-PT":{"stringUnit":{"state":"translated","value":"A frequência cardíaca em direto está a ser transmitida, mas a sua pulseira não está totalmente emparelhada. É o emparelhamento encriptado que transporta movimento, temperatura da pele, SpO₂ e taxa respiratória — sem ele, o sono é calculado apenas a partir da frequência cardíaca. O zumbido, os alarmes e a sincronização do histórico também precisam dele."}},"ru":{"stringUnit":{"state":"translated","value":"Пульс передаётся в реальном времени, но ремешок сопряжён не полностью. Именно зашифрованное сопряжение передаёт движение, температуру кожи, SpO₂ и частоту дыхания — без него сон определяется только по пульсу. Вибрация, будильники и синхронизация истории тоже требуют его."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"实时心率正在传输，但你的手环尚未完全配对。加密配对才能传输动作、皮肤温度、SpO₂ 和呼吸频率——没有它，睡眠只能依据心率推算。震动、闹钟和历史同步同样需要它。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"即時心率正在傳輸，但你的手環尚未完全配對。加密配對才能傳輸動作、皮膚溫度、SpO₂ 和呼吸頻率——沒有它，睡眠只能依據心率推算。震動、鬧鐘和歷史同步同樣需要它。"}}}}
   },
   "version": "1.0"
 }
diff --git a/Strand/Screens/SettingsView.swift b/Strand/Screens/SettingsView.swift
index 96419f28ec..239ae9ec55 100644
--- a/Strand/Screens/SettingsView.swift
+++ b/Strand/Screens/SettingsView.swift
@@ -1585,7 +1585,7 @@ struct SettingsView: View {
         // Live HR over the UNBONDED standard profile (#69). True whenever the handshake is suppressed or
         // simply has not landed, and the honest description either way.
         if live.bonded && live.connected {
-            return String(localized: "Live heart rate is streaming, but your strap is not fully paired. The encrypted pairing is what carries motion, skin temperature, SpO₂ and respiratory rate — without it, sleep is staged from heart rate alone, and HRV and resting heart rate are unavailable. Buzz, alarms and history sync need it too.")
+            return String(localized: "Live heart rate is streaming, but your strap is not fully paired. The encrypted pairing is what carries motion, skin temperature, SpO₂ and respiratory rate — without it, sleep is staged from heart rate alone. Buzz, alarms and history sync need it too.")
         }
         if live.connected { return String(localized: "Connected. Finishing the secure pairing handshake…") }
         if live.bonded { return String(localized: "Previously paired but not currently connected. Re-scan to reconnect.") }
diff --git a/android/app/src/main/java/com/noop/ui/SettingsLogic.kt b/android/app/src/main/java/com/noop/ui/SettingsLogic.kt
index cc7c78b3e8..2e74b5ae14 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsLogic.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsLogic.kt
@@ -69,7 +69,7 @@ internal fun strapStatusDetail(
 ): String = when {
     scanning -> "Searching for your WHOOP… make sure it's charged, on your wrist, and the official WHOOP app isn't connected to it."
     encryptedBond && connected -> "Your strap is paired and sending data. Open Live for a real-time heart rate."
-    bonded && connected -> "Live heart rate is streaming, but your strap is not fully paired. The encrypted pairing is what carries motion, skin temperature, SpO₂ and respiratory rate — without it, sleep is staged from heart rate alone, and HRV and resting heart rate are unavailable. Buzz, alarms and history sync need it too."
+    bonded && connected -> "Live heart rate is streaming, but your strap is not fully paired. The encrypted pairing is what carries motion, skin temperature, SpO₂ and respiratory rate — without it, sleep is staged from heart rate alone. Buzz, alarms and history sync need it too."
     connected -> "Connected. Finishing the secure pairing handshake…"
     bonded -> "Previously paired but not currently connected. Re-scan to reconnect."
     else -> "No strap connected. Put your WHOOP nearby and tap Re-scan to pair."
diff --git a/android/app/src/test/java/com/noop/ui/StrapStatusDetailTest.kt b/android/app/src/test/java/com/noop/ui/StrapStatusDetailTest.kt
index ebd0c1fa33..077b3d7c52 100644
--- a/android/app/src/test/java/com/noop/ui/StrapStatusDetailTest.kt
+++ b/android/app/src/test/java/com/noop/ui/StrapStatusDetailTest.kt
@@ -63,8 +63,11 @@ class StrapStatusDetailTest {
         // (AnalyticsEngine gates both on `!hrOnly`). A field log showed a week of blank Recovery
         // Vitals while this line pointed at three features the user was not missing.
         assertTrue(detail.contains("motion"))
-        assertTrue(detail.contains("HRV"))
-        assertTrue(detail.contains("resting heart rate"))
+        // #1884 repinned the tail of this: naming HRV and resting HR as CONSEQUENCES stopped being true
+        // when an HR-only night began reporting both. What survives is the reason they were named at all
+        // — the strap stops sending motion, so sleep falls to the HR-only stager.
+        assertTrue(detail.contains("staged from heart rate alone"))
+        assertFalse(detail.contains("HRV and resting heart rate are unavailable"))
         // The original claim has to survive the rewrite.
         assertTrue(detail.contains("history sync"))
 

From ad7da24e985751ded50306a5d730a69e255e4184 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 5 Sep 2026 21:46:21 +1200
Subject: [PATCH 250/333] ble: record what a strap advertised, and keep owner
 names out of the log (#1635)

The suppression log told a strap that had just refused pairing to press Connect
and try the handshake again. On a 5/MG running 50.41.1.0 that cannot work - the
strap refuses SMP outright - so the line sent people round a loop that had no
exit. It now names pairing mode, which is the thing that has actually flipped a
refusal, on both platforms.

Nothing recorded what a strap ADVERTISED, which is the one diagnostic still
available when a strap will not bond: the event census and the battery-pack read
both ride characteristics needing an encrypted link, so on exactly the strap
being debugged they are silent by construction. A new ScanAdvertisementSummary
reports structure and never payload - which services, how many bytes, what
flags - twinned byte-for-byte across platforms and gated behind Test Centre.

Two parity defects found while reviewing that line, each of which would have made
an iOS capture incomparable to an Android one, the very thing it exists for:
CoreBluetooth spells an assigned 16-bit UUID "180d" where Android expands it, and
the local name was measured in grapheme clusters on one side and UTF-16 units on
the other, so "Whoop <emoji>" reported 7 against 8. Both are now canonical, and
the name is measured in UTF-8 bytes - what the advertisement actually carries.

Separately, and more seriously: the account holder's name was reaching the
shareable strap log. WHOOP seeds a strap's name from its owner, the scan path
logged that name on every discovery across four BLE subsystems, and no redaction
rule could see it - they all key on MAC shape, a serial, or a device id. Device
names are now reduced before they are logged, by an allowlist that keeps model
words and drops everything else, so a naming shape nobody anticipated loses by
default rather than needing a rule written for it. The raw name still reaches the
device list, where people need to recognise their own strap.
---
 .../ScanAdvertisementSummary.swift            |  82 ++++++++++++
 .../ScanAdvertisementSummaryTests.swift       | 106 +++++++++++++++
 Strand/BLE/BLEManager.swift                   |  50 ++++++-
 Strand/BLE/FTMSSource.swift                   |   2 +-
 Strand/BLE/HuamiHRSource.swift                |   2 +-
 Strand/BLE/LiveState.swift                    |  60 +++++++++
 Strand/BLE/StandardHRSource.swift             |   2 +-
 StrandTests/PiiRedactionTests.swift           |  98 ++++++++++++++
 .../src/main/java/com/noop/ble/FtmsSource.kt  |   2 +-
 .../main/java/com/noop/ble/HuamiHrSource.kt   |   2 +-
 .../com/noop/ble/ScanAdvertisementSummary.kt  |  92 +++++++++++++
 .../java/com/noop/ble/StandardHrSource.kt     |   2 +-
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 122 ++++++++++++++++-
 .../java/com/noop/ble/PiiRedactionTest.kt     |  94 +++++++++++++
 .../noop/ble/ScanAdvertisementSummaryTest.kt  | 123 ++++++++++++++++++
 15 files changed, 822 insertions(+), 17 deletions(-)
 create mode 100644 Packages/WhoopProtocol/Sources/WhoopProtocol/ScanAdvertisementSummary.swift
 create mode 100644 Packages/WhoopProtocol/Tests/WhoopProtocolTests/ScanAdvertisementSummaryTests.swift
 create mode 100644 StrandTests/PiiRedactionTests.swift
 create mode 100644 android/app/src/main/java/com/noop/ble/ScanAdvertisementSummary.kt
 create mode 100644 android/app/src/test/java/com/noop/ble/ScanAdvertisementSummaryTest.kt

diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/ScanAdvertisementSummary.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/ScanAdvertisementSummary.swift
new file mode 100644
index 0000000000..a17a84965a
--- /dev/null
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/ScanAdvertisementSummary.swift
@@ -0,0 +1,82 @@
+import Foundation
+
+/// A redacted description of what a strap ADVERTISED, for the #1635 pairing-mode question.
+///
+/// The one thing no strap log can currently answer is the question the field report put back to the
+/// thread: *was the strap in pairing mode during any of those refusals?* A strap that accepts pairing
+/// almost certainly advertises differently from one that refuses, but the scan path reads only the
+/// device name and discards the rest, so the evidence is thrown away at the moment it exists.
+///
+/// It is also the ONLY diagnostic on this path that still works unbonded. The event census and the
+/// battery-pack read both ride characteristics that need an encrypted link, so on the strap we are
+/// actually trying to debug they are silent by construction. An advertisement arrives before any of it.
+///
+/// STRUCTURE, NOT PAYLOAD. The local name can carry a person's name ("<Name>'s Whoop" is what WHOOP
+/// sets by default), service data can carry a serial, and manufacturer data is opaque. So this reports
+/// what is PRESENT and how big it is and never a byte of any of it — enough to tell two advertising
+/// modes apart, which is the whole question, and carrying nothing identifying.
+///
+/// Kotlin twin: `ScanAdvertisementSummary`.
+public enum ScanAdvertisementSummary {
+
+    /// - Parameters:
+    ///   - localNameLength: the local name's SIZE IN UTF-8 BYTES (see `localNameLength(_:)`), which can
+    ///     differ between advertising modes and, unlike the name itself, identifies nobody.
+    public static func line(flags: Int?,
+                            serviceUuids: [String],
+                            serviceDataLengths: [String: Int],
+                            manufacturerDataLengths: [Int: Int],
+                            txPower: Int?,
+                            localNameLength: Int?,
+                            connectable: Bool) -> String {
+        var parts: [String] = []
+        parts.append("flags=" + (flags.map { String(format: "0x%02x", $0) } ?? "none"))
+        parts.append("connectable=\(connectable)")
+        let svc = serviceUuids.map(canonicalUuid).sorted()
+        parts.append("svc=" + (svc.isEmpty ? "none" : svc.joined(separator: ",")))
+        // Normalise BEFORE sorting: the canonical form reorders keys that the short form would not.
+        let svcData = serviceDataLengths.map { (canonicalUuid($0.key), $0.value) }.sorted { $0.0 < $1.0 }
+        parts.append("svcData=" + (svcData.isEmpty ? "none"
+            : svcData.map { "\($0.0):\($0.1)B" }.joined(separator: ",")))
+        parts.append("mfg=" + (manufacturerDataLengths.isEmpty ? "none"
+            : manufacturerDataLengths.sorted { $0.key < $1.key }
+                .map { String(format: "0x%04x:%dB", $0.key, $0.value) }.joined(separator: ",")))
+        parts.append("tx=" + (txPower.map(String.init) ?? "none"))
+        parts.append("nameLen=" + (localNameLength.map(String.init) ?? "none"))
+        return "[adv] " + parts.joined(separator: " ")
+    }
+
+    /// Expand an assigned short Bluetooth UUID to its canonical 128-bit form; pass anything else through.
+    ///
+    /// CoreBluetooth renders an assigned 16-bit UUID as "180d" and a 32-bit one as "0000180d", where
+    /// Android's `UUID.toString()` always expands to the full base UUID. Unnormalised, the same strap
+    /// advertising Heart Rate Service logs a different string on each platform, so an iOS capture cannot
+    /// be compared against an Android one — which is exactly what this line exists to allow. Normalising
+    /// inside `line` rather than at the call site means neither platform's scan path can forget to do it.
+    ///
+    /// A no-op on Android, whose input is already 128-bit; it lives in both twins so the two formatters
+    /// stay behaviourally identical rather than agreeing only by accident of their inputs.
+    static func canonicalUuid(_ s: String) -> String {
+        switch s.count {
+        case 4: return "0000\(s)-0000-1000-8000-00805f9b34fb"
+        case 8: return "\(s)-0000-1000-8000-00805f9b34fb"
+        default: return s
+        }
+    }
+
+    /// The local name's size in UTF-8 BYTES — what the advertisement actually carries.
+    ///
+    /// NOT `String.count`. Swift counts grapheme clusters and Java's `String.length` counts UTF-16 code
+    /// units, so a strap named "Whoop 🎉" reported 7 on iOS and 8 on Android — the same divergence, and
+    /// for the same reason, as the short-UUID spelling this file already canonicalises. Names carry
+    /// emoji and accents routinely (WHOOP seeds the name from the account holder), so this was not a
+    /// theoretical case.
+    ///
+    /// Bytes rather than either platform's string model because the AD local-name field IS a UTF-8 byte
+    /// run: it is the physically meaningful number, and it is identical on both platforms by
+    /// construction instead of by one imitating the other.
+    public static func localNameLength(_ name: String?) -> Int? {
+        name.map { $0.utf8.count }
+    }
+
+}
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/ScanAdvertisementSummaryTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/ScanAdvertisementSummaryTests.swift
new file mode 100644
index 0000000000..02c635ddac
--- /dev/null
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/ScanAdvertisementSummaryTests.swift
@@ -0,0 +1,106 @@
+import Foundation
+import XCTest
+@testable import WhoopProtocol
+
+/// The advertisement summary (#1635) — the twin of the Kotlin `ScanAdvertisementSummaryTest`, same
+/// cases and same expected text so the two platforms cannot describe a strap differently.
+///
+/// Its job is to make two advertising modes distinguishable in a strap log without carrying anything
+/// that identifies a person or a device. WHOOP names a strap "<Name>'s Whoop" by default, so the local
+/// name is the one field that must never appear.
+final class ScanAdvertisementSummaryTests: XCTestCase {
+
+    private func line(flags: Int? = 0x06,
+                      svc: [String] = ["61080001-8d6d-82b8-614a-1c8cb0f8dcc6"],
+                      svcData: [String: Int] = [:],
+                      mfg: [Int: Int] = [:],
+                      tx: Int? = nil,
+                      nameLen: Int? = 12,
+                      connectable: Bool = true) -> String {
+        ScanAdvertisementSummary.line(flags: flags, serviceUuids: svc, serviceDataLengths: svcData,
+                                      manufacturerDataLengths: mfg, txPower: tx,
+                                      localNameLength: nameLen, connectable: connectable)
+    }
+
+    /// The headline guarantee: shape is reported, payload never is.
+    func testSummaryCarriesNoPayloadBytesAndNoName() {
+        let s = line(svcData: ["fd4b": 9], mfg: [0x01D9: 14], nameLen: 13)
+        XCTAssertTrue(s.contains("0000fd4b-0000-1000-8000-00805f9b34fb:9B"))
+        XCTAssertTrue(s.contains("0x01d9:14B"))
+        XCTAssertTrue(s.contains("nameLen=13"))
+        XCTAssertFalse(s.contains("Whoop"))
+        XCTAssertFalse(s.contains("'s"))
+    }
+
+    /// The point of the line: two advertising modes must produce different text, or the #1635 question
+    /// stays unanswerable.
+    func testDifferentAdvertisingModeReadsDifferently() {
+        let normal = line(flags: 0x06, svcData: [:])
+        let pairing = line(flags: 0x05, svcData: ["fd4b": 4])
+        XCTAssertNotEqual(normal, pairing)
+        XCTAssertTrue(normal.contains("flags=0x06"))
+        XCTAssertTrue(pairing.contains("flags=0x05"))
+        XCTAssertTrue(normal.contains("svcData=none"))
+        XCTAssertTrue(pairing.contains("0000fd4b-0000-1000-8000-00805f9b34fb:4B"))
+    }
+
+    /// Absent fields say so rather than vanishing, so two logs stay comparable field by field.
+    func testAbsentFieldsAreNamedNotOmitted() {
+        let s = line(flags: nil, svc: [], tx: nil, nameLen: nil)
+        XCTAssertTrue(s.contains("flags=none"))
+        XCTAssertTrue(s.contains("svc=none"))
+        XCTAssertTrue(s.contains("tx=none"))
+        XCTAssertTrue(s.contains("nameLen=none"))
+    }
+
+    /// Deterministic ordering, so two captures diff cleanly instead of by dictionary order.
+    func testOutputIsStableRegardlessOfInputOrder() {
+        let a = ScanAdvertisementSummary.line(flags: 6, serviceUuids: ["b", "a"],
+                                              serviceDataLengths: ["y": 1, "x": 2],
+                                              manufacturerDataLengths: [2: 1, 1: 2],
+                                              txPower: nil, localNameLength: 4, connectable: true)
+        let b = ScanAdvertisementSummary.line(flags: 6, serviceUuids: ["a", "b"],
+                                              serviceDataLengths: ["x": 2, "y": 1],
+                                              manufacturerDataLengths: [1: 2, 2: 1],
+                                              txPower: nil, localNameLength: 4, connectable: true)
+        XCTAssertEqual(a, b)
+    }
+
+    /// Connectability separates a pairing-ready strap from a beacon-only one.
+    func testConnectabilityIsReported() {
+        XCTAssertTrue(line(connectable: true).contains("connectable=true"))
+        XCTAssertTrue(line(connectable: false).contains("connectable=false"))
+    }
+
+    /// The cross-platform guarantee. CoreBluetooth reports an assigned 16-bit UUID as "180d" while
+    /// Android always expands it, so without canonicalisation the SAME strap would log two different
+    /// lines and an iOS capture could not be diffed against an Android one. Both spellings must collapse
+    /// to one string — this is the assertion the Kotlin twin makes verbatim.
+    func testShortAndLongUuidSpellingsProduceTheSameLine() {
+        let short = line(svc: ["180d"], svcData: ["fd4b": 4])
+        let long = line(svc: ["0000180d-0000-1000-8000-00805f9b34fb"],
+                        svcData: ["0000fd4b-0000-1000-8000-00805f9b34fb": 4])
+        XCTAssertEqual(short, long)
+        XCTAssertTrue(short.contains("svc=0000180d-0000-1000-8000-00805f9b34fb"))
+    }
+
+    /// A 32-bit assigned UUID takes the same base, and a 128-bit one is passed through untouched.
+    func testCanonicalisationCoversThirtyTwoBitAndLeavesFullUuidsAlone() {
+        XCTAssertEqual(ScanAdvertisementSummary.canonicalUuid("0000180d"),
+                       "0000180d-0000-1000-8000-00805f9b34fb")
+        let full = "61080001-8d6d-82b8-614a-1c8cb0f8dcc6"
+        XCTAssertEqual(ScanAdvertisementSummary.canonicalUuid(full), full)
+    }
+
+    /// The other cross-platform trap in this line, and the reason it is measured in bytes.
+    ///
+    /// Swift's `String.count` would say 7 for this name and Java's `String.length` would say 8, so the
+    /// same strap logged a different size on each platform. The Kotlin twin asserts the SAME 10.
+    func testLocalNameLengthIsUtf8BytesNotCharacters() {
+        XCTAssertEqual(ScanAdvertisementSummary.localNameLength("Whoop \u{1F389}"), 10)
+        XCTAssertEqual("Whoop \u{1F389}".count, 7, "guards the premise: characters would disagree")
+        XCTAssertEqual(ScanAdvertisementSummary.localNameLength("Ryan's Whoop"), 12)
+        XCTAssertNil(ScanAdvertisementSummary.localNameLength(nil))
+    }
+
+}
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index a593b1286d..e9d689ca4e 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -1260,6 +1260,11 @@ public final class BLEManager: NSObject, ObservableObject {
     /// rather than on every tick of the family-rotation timer.
     private var lastBlockedConnectReason: String?
 
+    /// #1635: one `ScanAdvertisementSummary` line per SCAN, not per process — the question it answers
+    /// is only visible by comparing a scan before the strap was put in pairing mode against one after,
+    /// so `startScan` reopens it.
+    private var advertisementLogged = false
+
     /// Stable device id; matches the server's existing device for sync parity. Overridable.
     /// Seeded from the init argument, then refined once in bootstrapStore() to the device registry's
     /// active id (still "my-whoop" today) before any store writes use it — see bootstrapStore().
@@ -4623,6 +4628,7 @@ public final class BLEManager: NSObject, ObservableObject {
     /// from the already-gated `connectFromSystem` — and this method's own family-rotation timer, which
     /// cannot start a scan that one of those did not. Gating here as well would block the user's Connect.
     private func startScan(for model: WhoopModel, allowFallback: Bool) {
+        advertisementLogged = false
         cancelScanFallback()
         selectedModel = model
         reassembler = Reassembler(family: model.deviceFamily)
@@ -5349,6 +5355,36 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
                                advertisementData: [String: Any],
                                rssi RSSI: NSNumber) {
         let name = (advertisementData[CBAdvertisementDataLocalNameKey] as? String) ?? peripheral.name ?? "unknown"
+        // The raw name goes to the DEVICE LIST (the user's own screen, where they need to recognise
+        // their strap); only the log gets the model-only form. See LiveState.logSafeDeviceName.
+        let safeName = LiveState.logSafeDeviceName(name)
+        // #1635: what the strap ADVERTISED, once per scan. The open question there is whether a
+        // refusing strap was in pairing mode, and a strap that accepts pairing should advertise
+        // differently — but nothing recorded the advertisement, so no log could say. Structure only,
+        // never payload: see `ScanAdvertisementSummary`. Test Centre gated. CoreBluetooth exposes no AD
+        // flags byte, so that field reads `none` here and carries on the Kotlin side.
+        if !advertisementLogged, TestCentre.active(.connection) {
+            advertisementLogged = true
+            let svc = (advertisementData[CBAdvertisementDataServiceUUIDsKey] as? [CBUUID])?
+                .map { $0.uuidString.lowercased() } ?? []
+            var svcLens: [String: Int] = [:]
+            if let sd = advertisementData[CBAdvertisementDataServiceDataKey] as? [CBUUID: Data] {
+                for (k, v) in sd { svcLens[k.uuidString.lowercased()] = v.count }
+            }
+            var mfgLens: [Int: Int] = [:]
+            if let md = advertisementData[CBAdvertisementDataManufacturerDataKey] as? Data, md.count >= 2 {
+                mfgLens[Int(md[0]) | (Int(md[1]) << 8)] = md.count - 2
+            }
+            state.append(log: ScanAdvertisementSummary.line(
+                flags: nil,
+                serviceUuids: svc,
+                serviceDataLengths: svcLens,
+                manufacturerDataLengths: mfgLens,
+                txPower: (advertisementData[CBAdvertisementDataTxPowerLevelKey] as? NSNumber)?.intValue,
+                localNameLength: ScanAdvertisementSummary.localNameLength(
+                    advertisementData[CBAdvertisementDataLocalNameKey] as? String),
+                connectable: (advertisementData[CBAdvertisementDataIsConnectable] as? NSNumber)?.boolValue ?? true))
+        }
         // #716: the seeded "my-whoop" device has model "WHOOP" (no generation). Once a live scan
         // confirms which service family the strap advertises, stamp the correct model so
         // forRegistryModel returns the right DeviceFamily (fixes skin-temp ADC scale + display).
@@ -5367,10 +5403,10 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
         )
         if !scanDecision.shouldConnect {
             if let family = scanDecision.unsupportedFamily {
-                log("Discovered \(name) (rssi \(RSSI)) — \(family.diagnosticUnsupportedMessage)")
+                log("Discovered \(safeName) (rssi \(RSSI)) — \(family.diagnosticUnsupportedMessage)")
                 return
             }
-            log("Discovered \(name) (rssi \(RSSI)) without \(selectedModel.displayName) service — ignoring")
+            log("Discovered \(safeName) (rssi \(RSSI)) without \(selectedModel.displayName) service — ignoring")
             return
         }
         // Multi-WHOOP present-scan (Add-a-WHOOP wizard): collect the strap, do NOT auto-connect, and
@@ -5391,14 +5427,14 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
         // WHOOP default) this guard is skipped and the original "connect to the first discovered" path
         // below is byte-for-byte unchanged.
         if let preferred = preferredPeripheralUUID, peripheral.identifier != preferred {
-            log("Discovered \(name) (\(peripheral.identifier)) — not the preferred strap; ignoring")
+            log("Discovered \(safeName) (\(peripheral.identifier)) — not the preferred strap; ignoring")
             return
         }
         // No gate here for the same reason as `startScan`: reaching a discovery means a scan is running,
         // and a scan only runs because the user asked or because the gated system entry allowed it.
         cancelScanFallback()
         persistSelectedModel(selectedModel)
-        log("Discovered \(name) (rssi \(RSSI)) — connecting")
+        log("Discovered \(safeName) (rssi \(RSSI)) — connecting")
         central.stopScan()
         preparePeripheral(peripheral)
         central.connect(peripheral, options: nil)
@@ -6065,7 +6101,11 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                 helloRetryRequested = false
                 let helloSuppressed = HelloSuppressionStore.suppressed(peripheral.identifier.uuidString)
                 if !shouldSendClientHello(suppressedForDevice: helloSuppressed, userInitiated: helloUserAsked) {
-                    log("WHOOP 5/MG: CLIENT_HELLO suppressed for this strap - it was never acknowledged and the write is what drops the link. Staying on live HR (not fully paired); press Connect to try the handshake again (#1635).")
+                    // #1635: says what happened and what has actually worked, not "try again". This strap
+                    // refuses the handshake, so a retry is the one thing that cannot help - and suggesting
+                    // it invites the hammering this suppression exists to stop. Mirrors the user-facing
+                    // hint, which lost the same ending.
+                    log("WHOOP 5/MG: CLIENT_HELLO suppressed for this strap - it was never acknowledged and the write is what drops the link. Staying on live HR (not fully paired). Some straps have paired again after being put in pairing mode (tap until the LEDs flash blue) (#1635).")
                     state.pairingHint = BondRefusalGiveUp.helloSuppressedHint()
                     // The unbonded DIS attempt rides HERE and nowhere else: this is the only 5/MG state
                     // known to be stable - the handshake is off and the link is holding - and it is now
diff --git a/Strand/BLE/FTMSSource.swift b/Strand/BLE/FTMSSource.swift
index 0293558998..ef15fbbad6 100644
--- a/Strand/BLE/FTMSSource.swift
+++ b/Strand/BLE/FTMSSource.swift
@@ -200,7 +200,7 @@ extension FTMSSource: @preconcurrency CBCentralManagerDelegate {
         seenPeripherals[id] = peripheral
         let advName = advertisementData[CBAdvertisementDataLocalNameKey] as? String
         let name = advName ?? peripheral.name ?? "Gym Equipment"
-        if firstSight { log("FTMS: found \(name) (\(id)) rssi \(RSSI.intValue)") }
+        if firstSight { log("FTMS: found \(LiveState.logSafeDeviceName(name)) (\(id)) rssi \(RSSI.intValue)") }
         let machine = DiscoveredMachine(id: id, name: name, rssi: RSSI.intValue)
         if let idx = discovered.firstIndex(where: { $0.id == id }) {
             discovered[idx] = machine
diff --git a/Strand/BLE/HuamiHRSource.swift b/Strand/BLE/HuamiHRSource.swift
index 4e54de5411..eae770dd40 100644
--- a/Strand/BLE/HuamiHRSource.swift
+++ b/Strand/BLE/HuamiHRSource.swift
@@ -230,7 +230,7 @@ extension HuamiHRSource: @preconcurrency CBCentralManagerDelegate {
         let id = peripheral.identifier
         let firstSight = seenPeripherals[id] == nil
         seenPeripherals[id] = peripheral
-        if firstSight { log("Huami: found \(name) (\(id)) rssi \(RSSI.intValue)") }
+        if firstSight { log("Huami: found \(LiveState.logSafeDeviceName(name)) (\(id)) rssi \(RSSI.intValue)") }
         let dev = DiscoveredDevice(id: id, name: name.isEmpty ? brand.displayBrand : name, rssi: RSSI.intValue)
         if let idx = discovered.firstIndex(where: { $0.id == id }) {
             discovered[idx] = dev
diff --git a/Strand/BLE/LiveState.swift b/Strand/BLE/LiveState.swift
index 51c0a4e40e..53dbb11cc4 100644
--- a/Strand/BLE/LiveState.swift
+++ b/Strand/BLE/LiveState.swift
@@ -831,6 +831,50 @@ public final class LiveState: ObservableObject {
         return String(out)
     }
 
+    /// Tokens that identify a MODEL rather than a person, for `logSafeDeviceName`.
+    ///
+    /// Two shapes only, both EXACT: a known vendor, product or model word, and a version number ("4.0").
+    ///
+    /// There is deliberately no letters-plus-digits pattern for model codes. One was tried and it
+    /// defeated the whole design: "[a-z]{1,4}\\d{1,3}" matches "Ryan1" and "Sam99" as readily as "H10",
+    /// so a first name with a digit passed through untouched. A pattern cannot be an allowlist - the
+    /// moment a rule describes a SHAPE rather than a known value it admits everything else of that
+    /// shape. Model codes are therefore listed one by one.
+    ///
+    /// The cost is that an unlisted device logs as "<name>" until its code is added, which is the right
+    /// direction to fail: a missing model is an inconvenience, a leaked name is not.
+    ///
+    /// Anything not on this list is DROPPED, which is the point: a naming shape nobody anticipated loses
+    /// by default. Kotlin twin: `SAFE_DEVICE_NAME_TOKEN_RE`.
+    private static let safeDeviceNameToken = try? NSRegularExpression(
+        pattern: "^(whoop|mg|polar|verity|sense|wahoo|tickr|garmin|hrm|forerunner|fenix|vantage|ignite|amazfit|huami|zepp|xiaomi|mi|band|coospo|magene|suunto|scosche|rhythm|kickr|tacx|elite|cateye|decathlon|kalenji|geonaute|h6|h7|h9|h10|h64|h808s|oh1|dual|\\d+(\\.\\d+)?)$", options: [.caseInsensitive])
+
+    /// A device name reduced to what is safe to put in a shared log: the MODEL, never the person.
+    ///
+    /// WHOOP seeds a strap's name from the account holder ("<FirstName>'s Whoop") and people rename
+    /// straps to anything at all. `redactPii` can only GUESS which words in a line are a name; here the
+    /// whole string IS the advertised name, so the safe move is an ALLOWLIST - keep the tokens known to
+    /// name a model and drop everything else. A naming shape nobody anticipated is then dropped by
+    /// default rather than needing a rule to catch it: "Ryan B's WHOOP 4.0" keeps only "WHOOP 4.0", and
+    /// "Dad's spare" keeps nothing.
+    ///
+    /// The "no name advertised" sentinel survives, because "we saw no name" and "we removed a name" are
+    /// different facts to whoever reads the log. Kotlin twin: `logSafeDeviceName`.
+    nonisolated static func logSafeDeviceName(_ name: String?) -> String {
+        let n = (name ?? "").trimmingCharacters(in: .whitespacesAndNewlines)
+        if n.isEmpty || n == "unknown" { return "unknown" }
+        let tokens = n.split(whereSeparator: { $0.isWhitespace })
+        let safe = tokens.filter { tok in
+            guard let re = Self.safeDeviceNameToken else { return false }
+            let t = String(tok)
+            return re.firstMatch(in: t, range: NSRange(location: 0, length: (t as NSString).length)) != nil
+        }
+        // Say "<name>" only when something was actually removed. An unrenamed "WHOOP 4.0" or "Polar H10"
+        // carries nothing personal, and prefixing it would claim a redaction that never happened.
+        if safe.count == tokens.count { return n }
+        return safe.isEmpty ? "<name>" : "<name> " + safe.joined(separator: " ")
+    }
+
     private static let hexRunRegex = try? NSRegularExpression(pattern: "[0-9a-fA-F]{16,}")
 
     nonisolated static func redactPii(_ s: String) -> String {
@@ -874,6 +918,22 @@ public final class LiveState: ObservableObject {
         out = out.replacingOccurrences(
             of: "whoop-([A-Za-z0-9]{3})[A-Za-z0-9-]{3,}",
             with: "whoop-$1…", options: .regularExpression)
+        // The account holder's NAME, as WHOOP writes it into the advertised local name. WHOOP names a
+        // strap "<FirstName>'s Whoop" by default and the scan path logs that name on every discovery, so
+        // the shareable log (#445) we ask people to attach to public issues carried a real person's name.
+        // No rule above could see it: they key on MAC shape, "WHOOP " + digit, or a "whoop-" id.
+        //
+        // Keeps the possessive and whatever follows, so "Ryan's WHOOP 4.0" keeps the MODEL, which is
+        // diagnostic and identifies nobody. Matches the curly apostrophe because Apple platforms write
+        // U+2019 into default device names — a straight-quote-only rule would miss this platform's logs.
+        //
+        // LIMITATION, deliberate: exactly ONE token before the possessive, so "Ryan B's Whoop" keeps
+        // "Ryan". A multi-token rule cannot tell a name from the surrounding log text and would swallow
+        // "Discovered" with it. A fully custom name with no possessive stays a known gap. Kotlin twin in
+        // `redactStrapLogPii` as `PII_DEVICE_NAME_RE`.
+        out = out.replacingOccurrences(
+            of: "[\\p{L}\\p{N}_.\\-]+(['\u{2019}]s\\s+(?i:whoop))",
+            with: "<name>$1", options: .regularExpression)
         return out
     }
 
diff --git a/Strand/BLE/StandardHRSource.swift b/Strand/BLE/StandardHRSource.swift
index 11778601e7..1fda83e60d 100644
--- a/Strand/BLE/StandardHRSource.swift
+++ b/Strand/BLE/StandardHRSource.swift
@@ -305,7 +305,7 @@ extension StandardHRSource: @preconcurrency CBCentralManagerDelegate {
         seenPeripherals[id] = peripheral
         let advName = advertisementData[CBAdvertisementDataLocalNameKey] as? String
         let name = advName ?? peripheral.name ?? "Heart Rate Strap"
-        if firstSight { log("HR-strap: found \(name) (\(id)) rssi \(RSSI.intValue)") }
+        if firstSight { log("HR-strap: found \(LiveState.logSafeDeviceName(name)) (\(id)) rssi \(RSSI.intValue)") }
         let strap = DiscoveredStrap(id: id, name: name, rssi: RSSI.intValue)
         discovered = Self.upsertByProximity(discovered, strap)
         // If we were scanning specifically to reach this strap (a not-yet-cached active strap), connect now
diff --git a/StrandTests/PiiRedactionTests.swift b/StrandTests/PiiRedactionTests.swift
new file mode 100644
index 0000000000..aee5ffd621
--- /dev/null
+++ b/StrandTests/PiiRedactionTests.swift
@@ -0,0 +1,98 @@
+import XCTest
+@testable import Strand
+
+/// The account holder's NAME in the shareable strap log (#445).
+///
+/// WHOOP names a strap "<FirstName>'s Whoop" by default, and the scan path logs that advertised name on
+/// every discovery, so the file we ask people to attach to public issues carried a real person's name.
+/// None of the other rules in `LiveState.redactPii` could see it: they key on MAC shape, a "WHOOP " +
+/// digit serial, or a "whoop-" id.
+///
+/// Twin of the Kotlin `PiiRedactionTest` name cases, same inputs and same expected text, so the two
+/// platforms cannot redact a log differently.
+final class PiiRedactionTests: XCTestCase {
+
+    func testPersonalNameInDiscoveryLineIsRedacted() {
+        XCTAssertEqual(
+            LiveState.redactPii("Discovered Ryan's Whoop (rssi -55) - connecting"),
+            "Discovered <name>'s Whoop (rssi -55) - connecting")
+    }
+
+    /// Apple platforms write U+2019 into default device names, so the straight quote is not enough —
+    /// a straight-quote-only rule would miss this platform's own logs.
+    func testCurlyApostropheNameIsRedacted() {
+        XCTAssertEqual(
+            LiveState.redactPii("Discovered Ryan\u{2019}s Whoop (rssi -55)"),
+            "Discovered <name>\u{2019}s Whoop (rssi -55)")
+    }
+
+    /// The MODEL after the possessive is diagnostic and identifies nobody, so it must survive.
+    func testModelSurvivesNameRedaction() {
+        XCTAssertEqual(LiveState.redactPii("Ryan's WHOOP 4.0"), "<name>'s WHOOP 4.0")
+    }
+
+    /// The documented gap, pinned so it stays visible rather than assumed: ONE token before the
+    /// possessive. A multi-token rule cannot tell a name from surrounding log text.
+    func testMultiTokenNameKeepsTheLeadingToken() {
+        XCTAssertEqual(LiveState.redactPii("Ryan B's Whoop"), "Ryan <name>'s Whoop")
+    }
+
+    /// The rule must not touch ids or ordinary text that merely contain "whoop".
+    func testNameRuleLeavesIdsAndPlainTextAlone() {
+        XCTAssertEqual(LiveState.redactPii("my-whoop and my-whoop-noop"), "my-whoop and my-whoop-noop")
+        XCTAssertEqual(LiveState.redactPii("no pii here"), "no pii here")
+    }
+
+    /// The name never reaches a shared log at all. The sink rule is defence-in-depth; this is the real
+    /// guarantee, and it is an ALLOWLIST so an unanticipated naming shape is dropped by default.
+    func testLogSafeDeviceNameKeepsOnlyTheModel() {
+        XCTAssertEqual(LiveState.logSafeDeviceName("Ryan's Whoop"), "<name> Whoop")
+        XCTAssertEqual(LiveState.logSafeDeviceName("Ryan B's WHOOP 4.0"), "<name> WHOOP 4.0")
+        XCTAssertEqual(LiveState.logSafeDeviceName("Ryan\u{2019}s WHOOP 5.0 MG"), "<name> WHOOP 5.0 MG")
+    }
+
+    /// A fully custom name has no model token to keep, so nothing of it survives.
+    func testLogSafeDeviceNameDropsAWhollyCustomName() {
+        XCTAssertEqual(LiveState.logSafeDeviceName("Dad's spare"), "<name>")
+        XCTAssertEqual(LiveState.logSafeDeviceName("Sarah"), "<name>")
+    }
+
+    /// "We saw no name" and "we removed a name" are different facts to a reader, so the sentinel stays.
+    func testLogSafeDeviceNameKeepsTheNoNameSentinel() {
+        XCTAssertEqual(LiveState.logSafeDeviceName("unknown"), "unknown")
+        XCTAssertEqual(LiveState.logSafeDeviceName(nil), "unknown")
+        XCTAssertEqual(LiveState.logSafeDeviceName("   "), "unknown")
+    }
+
+
+    /// Third-party straps: the MODEL is the diagnostic, so a name carrying no person survives intact.
+    func testLogSafeDeviceNameKeepsAnUnrenamedThirdPartyModel() {
+        XCTAssertEqual(LiveState.logSafeDeviceName("Polar H10"), "Polar H10")
+        XCTAssertEqual(LiveState.logSafeDeviceName("TICKR"), "TICKR")
+        XCTAssertEqual(LiveState.logSafeDeviceName("WHOOP 4.0"), "WHOOP 4.0")
+    }
+
+    /// ...but a renamed one loses the person and keeps the model.
+    func testLogSafeDeviceNameStripsThePersonFromARenamedThirdPartyStrap() {
+        XCTAssertEqual(LiveState.logSafeDeviceName("Ryan's Polar H10"), "<name> Polar H10")
+        XCTAssertEqual(LiveState.logSafeDeviceName("Sarah TICKR"), "<name> TICKR")
+    }
+
+
+    /// The hole a model-code PATTERN opened, pinned shut. "[a-z]{1,4}\\d{1,3}" was meant to admit "H10"
+    /// and admitted "Ryan1" and "Sam99" with it, passing a first name through untouched. Model codes are
+    /// listed one by one for this reason; if a pattern is ever reintroduced, these fail.
+    func testANameWithDigitsIsNotMistakenForAModelCode() {
+        XCTAssertEqual(LiveState.logSafeDeviceName("Ryan1"), "<name>")
+        XCTAssertEqual(LiveState.logSafeDeviceName("Anna2"), "<name>")
+        XCTAssertEqual(LiveState.logSafeDeviceName("Bob12"), "<name>")
+        XCTAssertEqual(LiveState.logSafeDeviceName("Sam99 Whoop"), "<name> Whoop")
+    }
+
+    /// The listed codes still survive, so the tightening did not cost the diagnostic.
+    func testListedModelCodesStillSurvive() {
+        XCTAssertEqual(LiveState.logSafeDeviceName("Polar H10"), "Polar H10")
+        XCTAssertEqual(LiveState.logSafeDeviceName("Polar OH1"), "Polar OH1")
+    }
+
+}
diff --git a/android/app/src/main/java/com/noop/ble/FtmsSource.kt b/android/app/src/main/java/com/noop/ble/FtmsSource.kt
index 4b9436b130..0ca48e6315 100644
--- a/android/app/src/main/java/com/noop/ble/FtmsSource.kt
+++ b/android/app/src/main/java/com/noop/ble/FtmsSource.kt
@@ -169,7 +169,7 @@ class FtmsSource(
             val firstSight = seen.put(address, device) == null
             val name = result.scanRecord?.deviceName ?: runCatching { device.name }.getOrNull()
                 ?: "Gym Equipment"
-            if (firstSight) log("FTMS: found $name ($address) rssi ${result.rssi}")
+            if (firstSight) log("FTMS: found ${logSafeDeviceName(name)} ($address) rssi ${result.rssi}")
             val machine = DiscoveredMachine(address = address, name = name, rssi = result.rssi)
             val list = _discovered.value.toMutableList()
             val i = list.indexOfFirst { it.address == address }
diff --git a/android/app/src/main/java/com/noop/ble/HuamiHrSource.kt b/android/app/src/main/java/com/noop/ble/HuamiHrSource.kt
index 737c6815f7..735305accb 100644
--- a/android/app/src/main/java/com/noop/ble/HuamiHrSource.kt
+++ b/android/app/src/main/java/com/noop/ble/HuamiHrSource.kt
@@ -222,7 +222,7 @@ class HuamiHrSource(
             val brand = ExperimentalBrand.recognise(name)
             if (brand != ExperimentalBrand.AMAZFIT && brand != ExperimentalBrand.MI_BAND) return
             val firstSight = seen.put(address, device) == null
-            if (firstSight) log("Huami: found $name ($address) rssi ${result.rssi}")
+            if (firstSight) log("Huami: found ${logSafeDeviceName(name)} ($address) rssi ${result.rssi}")
             val dev = DiscoveredDevice(
                 address = address,
                 name = name.ifBlank { brand.displayBrand },
diff --git a/android/app/src/main/java/com/noop/ble/ScanAdvertisementSummary.kt b/android/app/src/main/java/com/noop/ble/ScanAdvertisementSummary.kt
new file mode 100644
index 0000000000..4b60398b92
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ble/ScanAdvertisementSummary.kt
@@ -0,0 +1,92 @@
+package com.noop.ble
+
+/**
+ * A redacted description of what a strap ADVERTISED, for the #1635 pairing-mode question.
+ *
+ * The one thing no strap log can currently answer is the question the field report put back to the
+ * thread: *was the strap in pairing mode during any of those refusals?* A strap that accepts pairing
+ * almost certainly advertises differently from one that refuses, but the scan path reads only the
+ * device name and discards the rest, so the evidence is thrown away at the moment it exists.
+ *
+ * It is also the ONLY diagnostic on this path that still works unbonded. The event census and the
+ * battery-pack read both ride characteristics that need an encrypted link, so on the strap we are
+ * actually trying to debug they are silent by construction. An advertisement arrives before any of
+ * that.
+ *
+ * STRUCTURE, NOT PAYLOAD. The local name can carry a person's name ("<Name>'s Whoop" is what WHOOP
+ * sets by default), service data can carry a serial, and manufacturer data is opaque. So this reports
+ * what is PRESENT and how big it is — flags, which service UUIDs, which data blocks and their
+ * lengths — and never a byte of any of them. That is enough to tell two advertising modes apart,
+ * which is the whole question, and carries nothing identifying.
+ *
+ * Pure and platform-free so both platforms format it identically and it can be tested without a radio.
+ * Swift twin: `ScanAdvertisementSummary`.
+ */
+object ScanAdvertisementSummary {
+
+    /**
+     * @param flags the AD flags byte, or null when the advertisement carries none.
+     * @param serviceUuids advertised service UUIDs, lowercased; short forms are canonicalised here.
+     * @param serviceDataLengths bytes per service-data UUID, keyed by that UUID.
+     * @param manufacturerDataLengths bytes per manufacturer id.
+     * @param txPower advertised TX power, or null.
+     * @param localNameLength the local name's size in UTF-8 BYTES (see [localNameLength]) — its SIZE can
+     *   differ between advertising modes, and unlike the name itself it identifies nobody.
+     * @param connectable whether the advertisement was connectable.
+     */
+    fun line(
+        flags: Int?,
+        serviceUuids: List<String>,
+        serviceDataLengths: Map<String, Int>,
+        manufacturerDataLengths: Map<Int, Int>,
+        txPower: Int?,
+        localNameLength: Int?,
+        connectable: Boolean,
+    ): String {
+        val parts = mutableListOf<String>()
+        parts += "flags=" + (flags?.let { "0x%02x".format(it) } ?: "none")
+        parts += "connectable=$connectable"
+        val svc = serviceUuids.map { canonicalUuid(it) }.sorted()
+        parts += "svc=" + if (svc.isEmpty()) "none" else svc.joinToString(",")
+        // Normalise BEFORE sorting: the canonical form reorders keys that the short form would not.
+        val svcData = serviceDataLengths.map { canonicalUuid(it.key) to it.value }.sortedBy { it.first }
+        parts += "svcData=" + if (svcData.isEmpty()) "none" else
+            svcData.joinToString(",") { "${it.first}:${it.second}B" }
+        parts += "mfg=" + if (manufacturerDataLengths.isEmpty()) "none" else
+            manufacturerDataLengths.entries.sortedBy { it.key }.joinToString(",") { "0x%04x:%dB".format(it.key, it.value) }
+        parts += "tx=" + (txPower?.toString() ?: "none")
+        parts += "nameLen=" + (localNameLength?.toString() ?: "none")
+        return "[adv] " + parts.joinToString(" ")
+    }
+
+    /**
+     * Expand an assigned short Bluetooth UUID to its canonical 128-bit form; pass anything else through.
+     *
+     * A no-op on Android, whose `UUID.toString()` is always already 128-bit. It exists because
+     * CoreBluetooth renders an assigned 16-bit UUID as "180d" and a 32-bit one as "0000180d", so an
+     * unnormalised iOS capture of the same strap could not be compared against an Android one — which is
+     * exactly what this line exists to allow. Kept in BOTH twins so the formatters stay behaviourally
+     * identical rather than agreeing only by accident of what their callers happen to pass.
+     */
+    internal fun canonicalUuid(s: String): String = when (s.length) {
+        4 -> "0000$s-0000-1000-8000-00805f9b34fb"
+        8 -> "$s-0000-1000-8000-00805f9b34fb"
+        else -> s
+    }
+
+    /**
+     * The local name's size in UTF-8 BYTES — what the advertisement actually carries.
+     *
+     * NOT `String.length`. Java counts UTF-16 code units and Swift's `String.count` counts grapheme
+     * clusters, so a strap named "Whoop \uD83C\uDF89" reported 8 here and 7 on iOS — the same divergence,
+     * and for the same reason, as the short-UUID spelling this file already canonicalises. Names carry
+     * emoji and accents routinely (WHOOP seeds the name from the account holder), so this was not a
+     * theoretical case.
+     *
+     * Bytes rather than either platform's string model because the AD local-name field IS a UTF-8 byte
+     * run: it is the physically meaningful number, and it is identical on both platforms by construction
+     * instead of by one imitating the other.
+     */
+    internal fun localNameLength(name: String?): Int? = name?.toByteArray(Charsets.UTF_8)?.size
+
+}
diff --git a/android/app/src/main/java/com/noop/ble/StandardHrSource.kt b/android/app/src/main/java/com/noop/ble/StandardHrSource.kt
index 6c3d2abcf3..835b5500e4 100644
--- a/android/app/src/main/java/com/noop/ble/StandardHrSource.kt
+++ b/android/app/src/main/java/com/noop/ble/StandardHrSource.kt
@@ -386,7 +386,7 @@ class StandardHrSource(
             val firstSight = seen.put(address, device) == null   // null → not seen before this scan
             val name = result.scanRecord?.deviceName ?: runCatching { device.name }.getOrNull()
                 ?: "Heart Rate Strap"
-            if (firstSight) log("HR-strap: found $name ($address) rssi ${result.rssi}")
+            if (firstSight) log("HR-strap: found ${logSafeDeviceName(name)} ($address) rssi ${result.rssi}")
             val strap = DiscoveredStrap(address = address, name = name, rssi = result.rssi)
             _discovered.value = upsertByProximity(_discovered.value, strap)
             // Replay a connect intent that arrived before the device was discovered.
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 9700ed2612..e151e75a84 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -2507,6 +2507,9 @@ class WhoopBleClient(
     /// The strap family the user chose to pair, remembered so an auto-reconnect after a
     /// dropout re-scans for the same model instead of falling back to WHOOP 4.0.
     private var selectedModel = WhoopModel.WHOOP4
+    /** #1635: one [ScanAdvertisementSummary] line per scan session, not one per discovery burst. */
+    private var advertisementLogged = false
+
     /** #716: true once the seeded "WHOOP" model has been stamped to the correct family. */
     private var modelStamped = false
     /// The last device we connected to, kept so an auto-reconnect after a dropout can connect
@@ -3546,6 +3549,10 @@ class WhoopBleClient(
      * Gating here as well would block the user's explicit Connect.
      */
     private fun startScan(model: WhoopModel, allowFallback: Boolean) {
+        // #1635: one advertisement line per SCAN, not per process. The question this answers is whether
+        // a strap advertises differently in pairing mode, which is only visible by comparing a scan
+        // before it was put into pairing mode against one after — so the latch has to reopen here.
+        advertisementLogged = false
         handler.removeCallbacks(scanFallbackRunnable)
         // Defensive: the normal auto-connect scan is NEVER a present-scan. Clearing the flag here means a
         // leaked wizard present-scan (e.g. the wizard was dismissed without stopWhoopScan) can't divert
@@ -5569,6 +5576,33 @@ class WhoopBleClient(
         override fun onScanResult(callbackType: Int, result: ScanResult) {
             val device: BluetoothDevice = result.device
             val name = result.scanRecord?.deviceName ?: device.name ?: "unknown"
+            // The raw name goes to the DEVICE LIST (the user's own screen, where they need to recognise
+            // their strap); only the log gets the model-only form. See logSafeDeviceName.
+            val safeName = logSafeDeviceName(name)
+            // #1635: what the strap ADVERTISED, once per scan session. The open question on that issue
+            // is whether a refusing strap was in pairing mode, and a strap that accepts pairing should
+            // advertise differently — but nothing recorded the advertisement, so no log could say.
+            // Structure only, never payload: see ScanAdvertisementSummary. Test Centre gated.
+            if (!advertisementLogged && testCentre.active(com.noop.testcentre.TestDomain.CONNECTION)) {
+                advertisementLogged = true
+                val rec = result.scanRecord
+                log(
+                    ScanAdvertisementSummary.line(
+                        flags = rec?.advertiseFlags?.takeIf { it >= 0 },
+                        serviceUuids = rec?.serviceUuids?.map { it.uuid.toString() } ?: emptyList(),
+                        serviceDataLengths = rec?.serviceData?.entries
+                            ?.associate { it.key.uuid.toString() to (it.value?.size ?: 0) } ?: emptyMap(),
+                        manufacturerDataLengths = (0 until (rec?.manufacturerSpecificData?.size() ?: 0))
+                            .associate { i ->
+                                val k = rec!!.manufacturerSpecificData.keyAt(i)
+                                k to (rec.manufacturerSpecificData.valueAt(i)?.size ?: 0)
+                            },
+                        txPower = rec?.txPowerLevel?.takeIf { it != Int.MIN_VALUE },
+                        localNameLength = ScanAdvertisementSummary.localNameLength(rec?.deviceName),
+                        connectable = result.isConnectable,
+                    ),
+                )
+            }
             // #716: the seeded "my-whoop" device has model "WHOOP" (no generation). Once a live
             // scan confirms which service family the strap advertises, stamp the correct model so
             // forRegistryModel returns the right DeviceFamily (fixes skin-temp ADC scale + display).
@@ -5591,11 +5625,11 @@ class WhoopBleClient(
             val scanDecision = whoopGattScanDecision(selectedModel.service.toString(), advertisedServiceUuids)
             if (!scanDecision.shouldConnect) {
                 scanDecision.unsupportedFamily?.let { family ->
-                    log("Discovered $name (rssi ${result.rssi}) — ${family.diagnosticUnsupportedMessage}")
+                    log("Discovered $safeName (rssi ${result.rssi}) — ${family.diagnosticUnsupportedMessage}")
                     _state.update { it.copy(statusNote = family.diagnosticUnsupportedMessage) }
                     return
                 }
-                log("Discovered $name (rssi ${result.rssi}) without ${selectedModel.displayName} service — ignoring")
+                log("Discovered $safeName (rssi ${result.rssi}) without ${selectedModel.displayName} service — ignoring")
                 return
             }
             // Multi-WHOOP present-scan (Add-a-device wizard, MW-4): accumulate the strap, do NOT
@@ -5617,10 +5651,10 @@ class WhoopBleClient(
             // discovered" path below is byte-for-byte unchanged.
             val preferred = preferredAddress
             if (preferred != null && !device.address.equals(preferred, ignoreCase = true)) {
-                log("Discovered $name (${device.address}) — not the preferred strap; ignoring")
+                log("Discovered $safeName (${device.address}) — not the preferred strap; ignoring")
                 return
             }
-            log("Discovered $name (rssi ${result.rssi}) — connecting")
+            log("Discovered $safeName (rssi ${result.rssi}) — connecting")
             // Found it: cancel the not-found timeout AND the family-rotation fallback, then reflect
             // progress in the UI. (PR#195)
             handler.removeCallbacks(scanTimeoutRunnable)
@@ -9058,9 +9092,14 @@ class WhoopBleClient(
                     // didBond stays false, so leaving it armed would just move the drop from ~4.8s out to
                     // the 7s window — the same loop, slower. There is no handshake left to time out.
                     cancelBondWatchdog()
+                    // #1635: says what happened and what has actually worked, not "try again". This
+                    // strap refuses the handshake, so a retry is the one thing that cannot help — and
+                    // suggesting it invites the hammering this suppression exists to stop. Mirrors the
+                    // user-facing hint, which lost the same ending.
                     log("WHOOP 5/MG: CLIENT_HELLO suppressed for this strap — it was never acknowledged and" +
-                        " the write is what drops the link. Staying on live HR (not fully paired); press" +
-                        " Connect to try the handshake again (#1635).")
+                        " the write is what drops the link. Staying on live HR (not fully paired). Some straps" +
+                        " have paired again after being put in pairing mode (tap until the LEDs flash blue)" +
+                        " (#1635).")
                     // #221: republish the pairing hint, which the Devices card's "Connected · not paired"
                     // pill reads. It is otherwise written only where a refusal FRESHLY crosses the give-up,
                     // and the latch that records the give-up outlives the process while the hint did not —
@@ -11156,6 +11195,26 @@ class WhoopBleClient(
 private val PII_MAC_RE = Regex("([0-9A-Fa-f]{2}):[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:([0-9A-Fa-f]{2})")
 private val PII_WHOOP_SERIAL_RE = Regex("WHOOP (\\d[0-9A-Za-z]{5,})")
 
+/**
+ * The account holder's NAME, as WHOOP writes it into the advertised local name.
+ *
+ * WHOOP names a strap "<FirstName>'s Whoop" by default, and the scan path logs that name on every
+ * discovery, so the shareable strap log (#445) — the file we ask people to attach to public issues —
+ * carried a real person's name on both platforms. No other rule here could see it: they all key on
+ * MAC shape, a "WHOOP " + digit serial, or a "whoop-" id.
+ *
+ * Keeps the possessive and whatever follows it, so "Ryan's WHOOP 4.0" becomes "<name>'s WHOOP 4.0" and
+ * the MODEL survives — that part is diagnostic and identifies nobody. Matches a curly apostrophe too:
+ * Apple platforms write U+2019 into default device names, so a straight-quote-only rule would miss the
+ * iOS half of the logs entirely.
+ *
+ * LIMITATION, deliberate: exactly ONE token before the possessive. "Ryan B's Whoop" keeps "Ryan". A
+ * multi-token rule cannot tell a name apart from the surrounding log text and would eat "Discovered"
+ * along with it, mangling the line. This covers WHOOP's default naming, which is what the logs contain;
+ * a fully custom name with no possessive is not detectable here and stays a known gap.
+ */
+private val PII_DEVICE_NAME_RE = Regex("[\\p{L}\\p{N}_.\\-]+(['\u2019]s\\s+(?i:whoop))")
+
 /**
  * #1303: a device id that has ADOPTED its strap serial (`whoop-<SERIAL>`) is a device identifier in every
  * line that prints an id — the Devices list, each `dayOwner`, the per-source counts. Neither existing rule
@@ -11354,6 +11413,54 @@ internal fun redactHexDumpPii(hex: String): String {
     return out
 }
 
+/**
+ * Tokens that identify a MODEL rather than a person, for [logSafeDeviceName].
+ *
+ * Two shapes only, both EXACT: a known vendor, product or model word, and a version number ("4.0").
+ *
+ * There is deliberately no letters-plus-digits pattern for model codes. One was tried and it defeated
+ * the whole design: "[a-z]{1,4}\\d{1,3}" matches "Ryan1" and "Sam99" as readily as "H10", so a first
+ * name with a digit passed through untouched. A pattern cannot be an allowlist - the moment a rule
+ * describes a SHAPE rather than a known value, it admits everything else of that shape. Model codes are
+ * therefore listed one by one.
+ *
+ * The cost is that an unlisted device logs as "<name>" until its code is added here, which is the right
+ * direction to fail: a missing model is an inconvenience, a leaked name is not.
+ *
+ * Anything not on this list is DROPPED, which is the point: a naming shape nobody anticipated loses by
+ * default. Extend it when a device logs as "<name>" and its model is worth having. Swift twin:
+ * `LiveState.safeDeviceNameToken`.
+ */
+private val SAFE_DEVICE_NAME_TOKEN_RE =
+    Regex("(?i)(whoop|mg|polar|verity|sense|wahoo|tickr|garmin|hrm|forerunner|fenix|vantage|ignite|amazfit|huami|zepp|xiaomi|mi|band|coospo|magene|suunto|scosche|rhythm|kickr|tacx|elite|cateye|decathlon|kalenji|geonaute|h6|h7|h9|h10|h64|h808s|oh1|dual|\\d+(\\.\\d+)?)")
+
+/**
+ * A device name reduced to what is safe to put in a shared log: the MODEL, never the person.
+ *
+ * WHOOP seeds a strap's name from the account holder ("<FirstName>'s Whoop") and people rename straps
+ * to anything at all. [redactStrapLogPii] can only GUESS which words in a line are a name; here the
+ * whole string IS the advertised name, so the safe move is an ALLOWLIST - keep the tokens known to name
+ * a model and drop everything else. A naming shape nobody anticipated is then dropped by default rather
+ * than needing a rule to catch it: "Ryan B's WHOOP 4.0" keeps only "WHOOP 4.0", and "Dad's spare" keeps
+ * nothing.
+ *
+ * The "no name advertised" sentinel survives, because "we saw no name" and "we removed a name" are
+ * different facts to whoever reads the log. Swift twin: `LiveState.logSafeDeviceName`.
+ */
+internal fun logSafeDeviceName(name: String?): String {
+    val n = name?.trim().orEmpty()
+    if (n.isEmpty() || n == "unknown") return "unknown"
+    val tokens = n.split(Regex("\\s+"))
+    val safe = tokens.filter { SAFE_DEVICE_NAME_TOKEN_RE.matches(it) }
+    // Say "<name>" only when something was actually removed. An unrenamed "WHOOP 4.0" or "Polar H10"
+    // carries nothing personal, and prefixing it would claim a redaction that never happened.
+    return when {
+        safe.size == tokens.size -> n
+        safe.isEmpty() -> "<name>"
+        else -> "<name> " + safe.joinToString(" ")
+    }
+}
+
 /** Mask MAC addresses and WHOOP serials in a strap-log line before it's shown/exported.
  *  TOTAL — never throws: a redaction failure returns a safe placeholder rather than leaking the raw
  *  line or crashing the caller (#453). The MAC regex captures exactly two groups (first + last octet),
@@ -11366,6 +11473,9 @@ internal fun redactStrapLogPii(s: String): String = try {
         // for an adopted id. The -noop form runs before the general one so the sibling suffix survives.
         .replace(PII_ADOPTED_ID_NOOP_RE, "whoop-$1…$2")
         .replace(PII_ADOPTED_ID_RE, "whoop-$1…")
+        // Last: the name rule keys on literal text no earlier rule produces or consumes, so it neither
+        // masks a substitution marker nor depends on one.
+        .replace(PII_DEVICE_NAME_RE, "<name>$1")
 } catch (t: Throwable) {
     "[redaction error - line withheld]"
 }
diff --git a/android/app/src/test/java/com/noop/ble/PiiRedactionTest.kt b/android/app/src/test/java/com/noop/ble/PiiRedactionTest.kt
index f8bcec3db8..432f380bc0 100644
--- a/android/app/src/test/java/com/noop/ble/PiiRedactionTest.kt
+++ b/android/app/src/test/java/com/noop/ble/PiiRedactionTest.kt
@@ -149,4 +149,98 @@ class PiiRedactionTest {
             assertTrue("must return a value, got null", out.isNotEmpty() || s.isEmpty())
         }
     }
+
+    /**
+     * The account holder's name, which WHOOP writes into the advertised local name and the scan path
+     * logs on every discovery. Nothing here could see it before: the other rules key on MAC shape, a
+     * "WHOOP " + digit serial, or a "whoop-" id. Swift twin in `PiiRedactionTests`.
+     */
+    @Test fun personalNameInDiscoveryLineIsRedacted() {
+        assertEquals(
+            "Discovered <name>'s Whoop (rssi -55) - connecting",
+            redactStrapLogPii("Discovered Ryan's Whoop (rssi -55) - connecting"),
+        )
+    }
+
+    /** Apple platforms write U+2019 into default device names, so the straight quote is not enough. */
+    @Test fun curlyApostropheNameIsRedacted() {
+        assertEquals(
+            "Discovered <name>\u2019s Whoop (rssi -55)",
+            redactStrapLogPii("Discovered Ryan\u2019s Whoop (rssi -55)"),
+        )
+    }
+
+    /** The MODEL after the possessive is diagnostic and identifies nobody, so it must survive. */
+    @Test fun modelSurvivesNameRedaction() {
+        assertEquals("<name>'s WHOOP 4.0", redactStrapLogPii("Ryan's WHOOP 4.0"))
+    }
+
+    /** The documented gap, pinned so it is visible rather than assumed: ONE token before the possessive. */
+    @Test fun multiTokenNameKeepsTheLeadingToken() {
+        assertEquals("Ryan <name>'s Whoop", redactStrapLogPii("Ryan B's Whoop"))
+    }
+
+    /** The rule must not touch ids or ordinary text that merely contain "whoop". */
+    @Test fun nameRuleLeavesIdsAndPlainTextAlone() {
+        assertEquals("my-whoop and my-whoop-noop", redactStrapLogPii("my-whoop and my-whoop-noop"))
+        assertEquals("no pii here", redactStrapLogPii("no pii here"))
+    }
+
+
+    /**
+     * The name never reaches a shared log at all. The sink rule below is defence-in-depth; this is the
+     * real guarantee, and it is an ALLOWLIST so an unanticipated naming shape is dropped by default.
+     */
+    @Test fun logSafeDeviceNameKeepsOnlyTheModel() {
+        assertEquals("<name> Whoop", logSafeDeviceName("Ryan's Whoop"))
+        assertEquals("<name> WHOOP 4.0", logSafeDeviceName("Ryan B's WHOOP 4.0"))
+        assertEquals("<name> WHOOP 5.0 MG", logSafeDeviceName("Ryan\u2019s WHOOP 5.0 MG"))
+    }
+
+    /** A fully custom name has no model token to keep, so nothing of it survives. */
+    @Test fun logSafeDeviceNameDropsAWhollyCustomName() {
+        assertEquals("<name>", logSafeDeviceName("Dad's spare"))
+        assertEquals("<name>", logSafeDeviceName("Sarah"))
+    }
+
+    /** "We saw no name" and "we removed a name" are different facts to a reader, so the sentinel stays. */
+    @Test fun logSafeDeviceNameKeepsTheNoNameSentinel() {
+        assertEquals("unknown", logSafeDeviceName("unknown"))
+        assertEquals("unknown", logSafeDeviceName(null))
+        assertEquals("unknown", logSafeDeviceName("   "))
+    }
+
+
+    /** Third-party straps: the MODEL is the diagnostic, so a name carrying no person survives intact. */
+    @Test fun logSafeDeviceNameKeepsAnUnrenamedThirdPartyModel() {
+        assertEquals("Polar H10", logSafeDeviceName("Polar H10"))
+        assertEquals("TICKR", logSafeDeviceName("TICKR"))
+        assertEquals("WHOOP 4.0", logSafeDeviceName("WHOOP 4.0"))
+    }
+
+    /** ...but a renamed one loses the person and keeps the model. */
+    @Test fun logSafeDeviceNameStripsThePersonFromARenamedThirdPartyStrap() {
+        assertEquals("<name> Polar H10", logSafeDeviceName("Ryan's Polar H10"))
+        assertEquals("<name> TICKR", logSafeDeviceName("Sarah TICKR"))
+    }
+
+
+    /**
+     * The hole a model-code PATTERN opened, pinned shut. "[a-z]{1,4}\\d{1,3}" was meant to admit "H10"
+     * and admitted "Ryan1" and "Sam99" with it, passing a first name through untouched. Model codes are
+     * listed one by one for this reason; if a pattern is ever reintroduced, these fail.
+     */
+    @Test fun aNameWithDigitsIsNotMistakenForAModelCode() {
+        assertEquals("<name>", logSafeDeviceName("Ryan1"))
+        assertEquals("<name>", logSafeDeviceName("Anna2"))
+        assertEquals("<name>", logSafeDeviceName("Bob12"))
+        assertEquals("<name> Whoop", logSafeDeviceName("Sam99 Whoop"))
+    }
+
+    /** The listed codes still survive, so the tightening did not cost the diagnostic. */
+    @Test fun listedModelCodesStillSurvive() {
+        assertEquals("Polar H10", logSafeDeviceName("Polar H10"))
+        assertEquals("Polar OH1", logSafeDeviceName("Polar OH1"))
+    }
+
 }
diff --git a/android/app/src/test/java/com/noop/ble/ScanAdvertisementSummaryTest.kt b/android/app/src/test/java/com/noop/ble/ScanAdvertisementSummaryTest.kt
new file mode 100644
index 0000000000..2fd0c5bc78
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ble/ScanAdvertisementSummaryTest.kt
@@ -0,0 +1,123 @@
+package com.noop.ble
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The advertisement summary (#1635) — the ORACLE for the Swift twin.
+ *
+ * Its job is to make two advertising modes distinguishable in a strap log without carrying anything
+ * that identifies a person or a device. WHOOP names a strap "<Name>'s Whoop" by default, so the local
+ * name is the one field that must never appear.
+ */
+class ScanAdvertisementSummaryTest {
+
+    private fun line(
+        flags: Int? = 0x06,
+        svc: List<String> = listOf("61080001-8d6d-82b8-614a-1c8cb0f8dcc6"),
+        svcData: Map<String, Int> = emptyMap(),
+        mfg: Map<Int, Int> = emptyMap(),
+        tx: Int? = null,
+        nameLen: Int? = 12,
+        connectable: Boolean = true,
+    ) = ScanAdvertisementSummary.line(flags, svc, svcData, mfg, tx, nameLen, connectable)
+
+    /** The headline guarantee: shape is reported, payload never is. */
+    @Test
+    fun `the summary carries no payload bytes and no name`() {
+        val s = line(svcData = mapOf("fd4b" to 9), mfg = mapOf(0x01D9 to 14), nameLen = 13)
+        // Lengths and ids, yes. Contents, no.
+        assertTrue(s.contains("0000fd4b-0000-1000-8000-00805f9b34fb:9B"))
+        assertTrue(s.contains("0x01d9:14B"))
+        assertTrue(s.contains("nameLen=13"))
+        // Nothing that could be a name or a serial.
+        assertFalse(s.contains("Whoop"))
+        assertFalse(s.contains("'s"))
+    }
+
+    /**
+     * The point of the line: two advertising modes must produce different text. If a strap in pairing
+     * mode advertises an extra service-data block, or flips a flag, the log has to show it — otherwise
+     * the #1635 question stays unanswerable.
+     */
+    @Test
+    fun `a different advertising mode reads differently`() {
+        val normal = line(flags = 0x06, svcData = emptyMap())
+        val pairing = line(flags = 0x05, svcData = mapOf("fd4b" to 4))
+        assertFalse(normal == pairing)
+        assertTrue(normal.contains("flags=0x06"))
+        assertTrue(pairing.contains("flags=0x05"))
+        assertTrue(normal.contains("svcData=none"))
+        assertTrue(pairing.contains("0000fd4b-0000-1000-8000-00805f9b34fb:4B"))
+    }
+
+    /** Absent fields say so rather than vanishing, so two logs stay comparable field by field. */
+    @Test
+    fun `absent fields are named, not omitted`() {
+        val s = line(flags = null, svc = emptyList(), tx = null, nameLen = null)
+        assertTrue(s.contains("flags=none"))
+        assertTrue(s.contains("svc=none"))
+        assertTrue(s.contains("tx=none"))
+        assertTrue(s.contains("nameLen=none"))
+    }
+
+    /** Deterministic ordering, so two captures diff cleanly instead of by map iteration order. */
+    @Test
+    fun `output is stable regardless of input order`() {
+        val a = ScanAdvertisementSummary.line(6, listOf("b", "a"), mapOf("y" to 1, "x" to 2), mapOf(2 to 1, 1 to 2), null, 4, true)
+        val b = ScanAdvertisementSummary.line(6, listOf("a", "b"), mapOf("x" to 2, "y" to 1), mapOf(1 to 2, 2 to 1), null, 4, true)
+        assertEquals(a, b)
+    }
+
+    /** Connectability separates a pairing-ready strap from a beacon-only one. */
+    @Test
+    fun `connectability is reported`() {
+        assertTrue(line(connectable = true).contains("connectable=true"))
+        assertTrue(line(connectable = false).contains("connectable=false"))
+    }
+
+    /**
+     * The cross-platform guarantee. CoreBluetooth reports an assigned 16-bit UUID as "180d" while
+     * Android always expands it, so without canonicalisation the SAME strap would log two different
+     * lines and an iOS capture could not be diffed against an Android one. Both spellings must collapse
+     * to one string — the Swift twin asserts this verbatim.
+     */
+    @Test
+    fun `short and long uuid spellings produce the same line`() {
+        val short = line(svc = listOf("180d"), svcData = mapOf("fd4b" to 4))
+        val long = line(
+            svc = listOf("0000180d-0000-1000-8000-00805f9b34fb"),
+            svcData = mapOf("0000fd4b-0000-1000-8000-00805f9b34fb" to 4),
+        )
+        assertEquals(short, long)
+        assertTrue(short.contains("svc=0000180d-0000-1000-8000-00805f9b34fb"))
+    }
+
+    /** A 32-bit assigned UUID takes the same base, and a 128-bit one is passed through untouched. */
+    @Test
+    fun `canonicalisation covers 32-bit and leaves full uuids alone`() {
+        assertEquals(
+            "0000180d-0000-1000-8000-00805f9b34fb",
+            ScanAdvertisementSummary.canonicalUuid("0000180d"),
+        )
+        val full = "61080001-8d6d-82b8-614a-1c8cb0f8dcc6"
+        assertEquals(full, ScanAdvertisementSummary.canonicalUuid(full))
+    }
+
+    /**
+     * The other cross-platform trap in this line, and the reason it is measured in bytes.
+     *
+     * Java's `String.length` would say 8 for this name and Swift's `String.count` would say 7, so the
+     * same strap logged a different size on each platform. The Swift twin asserts the SAME 10.
+     */
+    @Test
+    fun `local name length is utf-8 bytes, not characters`() {
+        assertEquals(10, ScanAdvertisementSummary.localNameLength("Whoop \uD83C\uDF89"))
+        assertEquals(8, "Whoop \uD83C\uDF89".length)  // guards the premise: length would disagree
+        assertEquals(12, ScanAdvertisementSummary.localNameLength("Ryan's Whoop"))
+        assertEquals(null, ScanAdvertisementSummary.localNameLength(null))
+    }
+
+}

From ff4ed6ade0b101f01f7dd933e94186e031080fbc Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 5 Sep 2026 22:33:40 +1200
Subject: [PATCH 251/333] ble: give a WHOOP 4.0 the stable serial identity the
 5/MG already has (#1193)

A 4.0 exposes no DIS Serial Number String, so its device row has only ever been
keyed on the transient pairing id the OS mints - and re-mints whenever the strap
is re-paired or re-keyed through the official app. One physical strap then forks
into a second row and its history is orphaned beside it. The 5/MG stopped doing
this when it started adopting its DIS serial; the 4.0 was left behind because
nothing on the wire had been identified to adopt onto.

Something had been, since: the capture aid on the GET_HELLO_HARVARD (35) branch
found the serial as the 9-character alphanumeric run at offset 14. Both the issue
and the adoption doc still said otherwise, so both are corrected, and the layout
is now recorded in PROTOCOL.md rather than living only in code comments.

The decoder reads a FIXED 9-byte window. The same response carries a 54-char
device key at offset 24, and a fixed window cannot drift onto it however payloads
vary - a key must never become an id or reach a log, and not reading it is the
cheapest way to guarantee that. A window that is not cleanly alphanumeric is
refused rather than returned.

The 4.0 also waits where the 5/MG does not. DIS 0x2A25 is a spec-defined field;
this offset came off ONE capture. If that run were per-session, adopting on first
sight would mint a new id every connect and migrate the history each time - worse
than the duplicate row. So the value must repeat before it is trusted, and
neither platform advances that gate while the thing that would act on it is
absent: a once-only confirmation delivered nowhere is lost, not deferred.

The identity read is ungated, unlike the structural probe beside it. Adoption has
to work for every 4.0 owner, and Test Centre is off for almost all of them.

Not yet run against a strap. The decode is pinned to a payload built to the
captured shape, and the premise is an offset read once - a re-paired 4.0 is what
confirms it.
---
 .../WhoopProtocol/Whoop4HelloSerial.swift     |  81 +++++++++++++
 .../Whoop4HelloSerialTests.swift              |  92 +++++++++++++++
 Strand/BLE/BLEManager.swift                   |  49 +++++++-
 Strand/BLE/FrameRouter.swift                  |  23 +++-
 .../main/java/com/noop/ble/WhoopBleClient.kt  |  47 +++++++-
 .../com/noop/protocol/Whoop4HelloSerial.kt    |  87 ++++++++++++++
 .../src/main/java/com/noop/ui/AppViewModel.kt |   6 +-
 .../noop/protocol/Whoop4HelloSerialTest.kt    | 107 ++++++++++++++++++
 docs/PROTOCOL.md                              |  26 ++++-
 9 files changed, 503 insertions(+), 15 deletions(-)
 create mode 100644 Packages/WhoopProtocol/Sources/WhoopProtocol/Whoop4HelloSerial.swift
 create mode 100644 Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop4HelloSerialTests.swift
 create mode 100644 android/app/src/main/java/com/noop/protocol/Whoop4HelloSerial.kt
 create mode 100644 android/app/src/test/java/com/noop/protocol/Whoop4HelloSerialTest.kt

diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/Whoop4HelloSerial.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/Whoop4HelloSerial.swift
new file mode 100644
index 0000000000..50d38d5d7e
--- /dev/null
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/Whoop4HelloSerial.swift
@@ -0,0 +1,81 @@
+import Foundation
+
+/// The WHOOP 4.0 strap serial, read out of the `GET_HELLO_HARVARD` (cmd 35) response (#1193).
+///
+/// A 4.0 does not expose the DIS Serial Number String (`0x2A25`) that gives the 5/MG its stable id, so
+/// until now the only 4.0 identity available was the CoreBluetooth peripheral UUID — which iOS re-mints
+/// whenever the strap is re-paired or re-keyed. That is the whole of #1193: one physical strap forks
+/// into a second registry row and its history is orphaned beside it.
+///
+/// The capture aid added for that hunt found the answer: in a 131-byte 4.0 cmd-35 response the serial is
+/// the 9-character alphanumeric run at offset 14.
+///
+/// ## What this deliberately does NOT read
+///
+/// The same response carries a 54-character alphanumeric run at offset 24 which is the strap's DEVICE
+/// KEY. This decoder reads a fixed 9-byte window and cannot reach it: there is no scanning, no
+/// "longest alnum run", nothing that could drift onto the key as payloads vary. A key must never become
+/// an id, reach a log, or leave the device, and the cheapest way to guarantee that is to never read it.
+///
+/// ## Why the strict shape check
+///
+/// The offset comes from ONE capture. If a future firmware moves the field, a fixed offset lands on
+/// whatever is there instead — so a window that is not entirely `[0-9A-Za-z]` is refused rather than
+/// returned. `WhoopSerialIdentity.adoptedId` then applies its own validation on top. Refusing costs a
+/// strap the stable id it would have gained; returning something wrong migrates its whole history onto
+/// a junk key, which is the failure this exists to prevent.
+public enum Whoop4HelloSerial {
+
+    /// Offset of the serial run inside the cmd-35 response payload.
+    public static let serialOffset = 14
+    /// Length of the serial run. The 54-char device key begins at offset 24, one byte past this window.
+    public static let serialLength = 9
+
+    /// The strap serial, or nil when the payload is too short or the window is not a clean alnum run.
+    public static func decode(payload: [UInt8]) -> String? {
+        guard payload.count >= serialOffset + serialLength else { return nil }
+        var out = ""
+        out.reserveCapacity(serialLength)
+        for i in serialOffset..<(serialOffset + serialLength) {
+            let b = payload[i]
+            let isDigit = b >= 0x30 && b <= 0x39
+            let isUpper = b >= 0x41 && b <= 0x5A
+            let isLower = b >= 0x61 && b <= 0x7A
+            guard isDigit || isUpper || isLower else { return nil }
+            out.append(Character(UnicodeScalar(b)))
+        }
+        return out
+    }
+}
+
+/// Withholds a serial until the SAME value has been seen twice (#1193).
+///
+/// The 5/MG adopts its DIS serial on first read, because `0x2A25` is a spec-defined field that means one
+/// thing. The 4.0 offset is not that: it came off a single capture, so "the 9-char alnum run at offset 14"
+/// is a strong inference rather than a documented field. If that run were per-session rather than
+/// per-strap, adopting immediately would mint a new id on every connect and migrate the history each time
+/// - strictly worse than the duplicate row this exists to prevent.
+///
+/// Two hellos carrying the same run cannot both be a fresh per-session token, which is the only failure
+/// mode that does real damage. The cost is that a 4.0 adopts one connect later than a 5/MG.
+///
+/// Lives here, apart from the BLE classes that use it, because it is the part most likely to be wrong and
+/// the part neither platform can unit-test in place.
+public struct RepeatedSerialGate {
+    private var candidate: String?
+    private var confirmed: String?
+
+    public init() {}
+
+    /// The serial to adopt, or nil while it is still unconfirmed. Returns non-nil only on the transition
+    /// to confirmed, so a caller may act on it directly without re-adopting on every later sighting.
+    public mutating func offer(_ serial: String) -> String? {
+        if confirmed == serial { return nil }        // already acted on
+        guard candidate == serial else {
+            candidate = serial                        // first sighting: remember, withhold
+            return nil
+        }
+        confirmed = serial
+        return serial
+    }
+}
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop4HelloSerialTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop4HelloSerialTests.swift
new file mode 100644
index 0000000000..7122ab0fad
--- /dev/null
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop4HelloSerialTests.swift
@@ -0,0 +1,92 @@
+import Foundation
+import XCTest
+@testable import WhoopProtocol
+
+/// The 4.0 serial decode (#1193) — twin of the Kotlin `Whoop4HelloSerialTest`, same cases, same values.
+final class Whoop4HelloSerialTests: XCTestCase {
+
+    /// A 131-byte cmd-35 response shaped like the captured one: a 9-char serial at 14, and the 54-char
+    /// DEVICE KEY at 24 that must stay unreachable.
+    private func capturedShape(serial: String = "WBB5AP053",
+                               key: String = String(repeating: "K", count: 54)) -> [UInt8] {
+        var p = [UInt8](repeating: 0, count: 131)
+        for (i, c) in serial.utf8.enumerated() { p[14 + i] = c }
+        for (i, c) in key.utf8.enumerated() { p[24 + i] = c }
+        return p
+    }
+
+    func testReadsTheSerialFromTheCapturedShape() {
+        XCTAssertEqual(Whoop4HelloSerial.decode(payload: capturedShape()), "WBB5AP053")
+    }
+
+    /// The headline safety property: the decoder reads a fixed 9-byte window, so the device key beside
+    /// the serial cannot be returned no matter what it contains.
+    func testNeverReturnsTheDeviceKey() {
+        let out = Whoop4HelloSerial.decode(payload: capturedShape())
+        XCTAssertEqual(out?.count, 9)
+        XCTAssertFalse(out?.contains("K") ?? true)
+    }
+
+    /// A window that is not a clean alnum run is refused rather than guessed at — a moved field must
+    /// cost a strap its stable id, never migrate its history onto junk.
+    func testRefusesANonAlphanumericWindow() {
+        var p = capturedShape()
+        p[18] = 0x00
+        XCTAssertNil(Whoop4HelloSerial.decode(payload: p))
+        p = capturedShape()
+        p[14] = 0x2D  // '-' is legal in an id but is NOT alnum, so this window is not a serial run
+        XCTAssertNil(Whoop4HelloSerial.decode(payload: p))
+    }
+
+    func testRefusesAShortPayload() {
+        XCTAssertNil(Whoop4HelloSerial.decode(payload: [UInt8](repeating: 0x41, count: 22)))
+        XCTAssertNil(Whoop4HelloSerial.decode(payload: []))
+    }
+
+    /// Exactly long enough is enough — the window ends at 23, so a 23-byte payload decodes.
+    func testAcceptsTheMinimumLength() {
+        var p = [UInt8](repeating: 0x41, count: 23)
+        for (i, c) in "ABC123XYZ".utf8.enumerated() { p[14 + i] = c }
+        XCTAssertEqual(Whoop4HelloSerial.decode(payload: p), "ABC123XYZ")
+    }
+}
+
+/// The two-sighting gate (#1193) — twin of the Kotlin `RepeatedSerialGateTest`.
+final class RepeatedSerialGateTests: XCTestCase {
+
+    /// The point of the gate: one sighting is never enough to act on.
+    func testWithholdsUntilTheSameValueRepeats() {
+        var g = RepeatedSerialGate()
+        XCTAssertNil(g.offer("WBB5AP053"))
+        XCTAssertEqual(g.offer("WBB5AP053"), "WBB5AP053")
+    }
+
+    /// The failure this exists to prevent: a per-session value never confirms, so it can never migrate
+    /// a history onto a fresh id per connect.
+    func testAValueThatKeepsChangingNeverConfirms() {
+        var g = RepeatedSerialGate()
+        for s in ["AAA111AAA", "BBB222BBB", "CCC333CCC", "DDD444DDD"] {
+            XCTAssertNil(g.offer(s), "a changing value must never confirm")
+        }
+    }
+
+    /// Confirms once, not on every later sighting — the caller adopts on a non-nil return, and adopting
+    /// repeatedly would redo the migration on every connect.
+    func testConfirmsExactlyOnce() {
+        var g = RepeatedSerialGate()
+        _ = g.offer("WBB5AP053")
+        XCTAssertEqual(g.offer("WBB5AP053"), "WBB5AP053")
+        XCTAssertNil(g.offer("WBB5AP053"))
+        XCTAssertNil(g.offer("WBB5AP053"))
+    }
+
+    /// An interruption resets the run: two sightings must be consecutive, so alternating values cannot
+    /// accumulate their way to a false confirmation.
+    func testAlternatingValuesDoNotConfirm() {
+        var g = RepeatedSerialGate()
+        XCTAssertNil(g.offer("AAA111AAA"))
+        XCTAssertNil(g.offer("BBB222BBB"))
+        XCTAssertNil(g.offer("AAA111AAA"))
+        XCTAssertEqual(g.offer("AAA111AAA"), "AAA111AAA")
+    }
+}
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index e9d689ca4e..2a03de9bc9 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -1001,6 +1001,24 @@ public final class BLEManager: NSObject, ObservableObject {
     /// number rather than an independently chosen one: this read can cost the link, so the two platforms
     /// should not be probing at different moments when a field capture has to explain a drop.
     static let unbondedDisReadDelay: TimeInterval = 3.0
+    /// #1193: the WHOOP 4.0 strap serial from `GET_HELLO_HARVARD`, once it has been seen TWICE.
+    ///
+    /// The withholding rule itself lives in `RepeatedSerialGate`, beside the decoder, where it is unit
+    /// tested; this pair is just the manager's view of its outcome.
+    ///
+    /// The 5/MG adopts its DIS serial on first read, because `0x2A25` is a spec-defined field that means
+    /// one thing. The 4.0 offset is not that: it was read off a single capture, so "the 9-char alnum run
+    /// at offset 14" is a strong inference rather than a documented field. If that run turned out to be
+    /// per-session rather than per-strap, adopting it immediately would mint a NEW id on every connect and
+    /// migrate the history each time — strictly worse than the duplicate row this exists to prevent.
+    ///
+    /// So a value must repeat before it is trusted. Two hellos carrying the same run cannot both be a
+    /// fresh per-session token, which is the only failure mode that would do real damage. The cost is that
+    /// a 4.0 adopts one connect later than a 5/MG; the benefit is that the destructive failure cannot
+    /// happen at all. Deliberately NOT reset on disconnect — the two sightings are meant to span connects.
+    private var harvardSerialGate = RepeatedSerialGate()
+    private var harvardSerialConfirmed: String?
+
     private var disSerial: String?
     private var disHwRev: String?
     /// #1635 follow-up: the DIS identity extras (firmware, manufacturer, model, software revision) as
@@ -1313,6 +1331,7 @@ public final class BLEManager: NSObject, ObservableObject {
         #endif
         // Strap-as-clock: an incoming EVENT packet kicks a rate-limited catch-up sync.
         router.onSyncTrigger = { [weak self] in self?.requestSync(.strap) }
+        router.onStrapSerial = { [weak self] serial in self?.noteHarvardSerial(serial) }   // #1193
         // #78 hole-4: a paused-for-bond-loop strap gets one bounded salvage attempt per app-foreground.
         installForegroundSalvageProbe()
     }
@@ -1512,6 +1531,7 @@ public final class BLEManager: NSObject, ObservableObject {
         #endif
         // Strap-as-clock: an incoming EVENT packet kicks a rate-limited catch-up sync.
         router.onSyncTrigger = { [weak self] in self?.requestSync(.strap) }
+        router.onStrapSerial = { [weak self] serial in self?.noteHarvardSerial(serial) }   // #1193
         // #78 hole-4: a paused-for-bond-loop strap gets one bounded salvage attempt per app-foreground.
         installForegroundSalvageProbe()
     }
@@ -4838,14 +4858,33 @@ public final class BLEManager: NSObject, ObservableObject {
         adoptWhoopSerialIdentity()
     }
 
+    /// The serial this pairing may adopt: the 5/MG's DIS read, or a 4.0's twice-seen hello serial.
+    private var adoptableSerial: String? { disSerial ?? harvardSerialConfirmed }
+
+    /// #1193: a 4.0 hello serial arrived. Adopt only on the SECOND sighting of the same value — see
+    /// `harvardSerialCandidate` for why a single sighting is not enough to act on destructively.
+    private func noteHarvardSerial(_ serial: String) {
+        // Do NOT advance the gate before the store exists. The gate confirms EXACTLY ONCE, so a
+        // confirmation raised while `adoptWhoopSerialIdentity` would bail is not deferred, it is lost for
+        // the lifetime of the process — every later sighting returns nil because the value is already
+        // confirmed. The 5/MG path survives the same hazard only because it re-offers its DIS serial on
+        // every connect; a once-only gate has no such second chance, so it must not consume a sighting it
+        // cannot act on. Kotlin twin guards its own missing dependency the same way.
+        guard registryStore != nil else { return }
+        guard let confirmed = harvardSerialGate.offer(serial) else { return }
+        harvardSerialConfirmed = confirmed
+        adoptWhoopSerialIdentity()
+    }
+
     /// #1303: the 5/MG DIS read hands us the strap's OWN serial, so re-point this pairing from its
     /// transient CoreBluetooth-UUID id onto a stable `whoop-<serial>` id — through the SAME generic
     /// migration the ring already uses (`adoptSerialIdentity`, #771), so a re-pair or factory reset stops
     /// forking one physical strap into a second row and orphaning its history (#1193).
     ///
-    /// A WHOOP 4.0 is deliberately untouched: it does not expose a DIS serial (the read above is gated
-    /// `!= .whoop4`) and the 4.0 serial's source on the wire is not yet identified, so there is nothing
-    /// honest to adopt onto here.
+    /// A WHOOP 4.0 reaches this by a different road. It exposes no DIS serial (the read above is gated
+    /// `!= .whoop4`), so its serial comes from the `GET_HELLO_HARVARD` response instead — see
+    /// `Whoop4HelloSerial` for the offset and `noteHarvardSerial` for why a 4.0 waits for a second
+    /// sighting before adopting where a 5/MG adopts on the first read (#1193).
     ///
     /// Deferred to the next main-loop turn, mirroring `adoptOuraSerial`: adoption re-points the ACTIVE
     /// device, and the observers that react tear down and rebuild the very connection this callback is
@@ -4856,7 +4895,7 @@ public final class BLEManager: NSObject, ObservableObject {
     /// onto a garbage key, which is worse than not adopting.
     private func adoptWhoopSerialIdentity() {
         guard let rs = registryStore,
-              let serialId = WhoopSerialIdentity.adoptedId(serial: disSerial),
+              let serialId = WhoopSerialIdentity.adoptedId(serial: adoptableSerial),
               let active = try? rs.all().first(where: { $0.status == .active }),
               WhoopSerialIdentity.mayAdopt(currentId: active.id),
               active.id != serialId
@@ -4876,7 +4915,7 @@ public final class BLEManager: NSObject, ObservableObject {
             // `SourceCoordinator.pointWhoop`, which re-points any non-legacy id.
             self.setActiveDeviceId(serialId)
             // Prefix only. `serialId` embeds the full serial, which must never reach a shareable log.
-            self.log("Adopted stable serial identity (serialPrefix=\(WhoopSerialIdentity.logSafe(serial: self.disSerial))) - history re-pointed off the transient pairing id (#1303)")
+            self.log("Adopted stable serial identity (serialPrefix=\(WhoopSerialIdentity.logSafe(serial: self.adoptableSerial))) - history re-pointed off the transient pairing id (#1303)")
             self.onSerialIdentityAdopted?(serialId)
         }
     }
diff --git a/Strand/BLE/FrameRouter.swift b/Strand/BLE/FrameRouter.swift
index 071134e79f..ee8d7acf3d 100644
--- a/Strand/BLE/FrameRouter.swift
+++ b/Strand/BLE/FrameRouter.swift
@@ -10,6 +10,11 @@ public final class FrameRouter {
     private let state: LiveState
     /// Called when the strap pushes an EVENT packet (WHOOP's strap-as-clock catch-up signal). The
     /// BLEManager wires this to a rate-limited requestSync(.strap). nil in pure/unit contexts.
+    /// #1193: the WHOOP 4.0 strap serial, decoded from the `GET_HELLO_HARVARD` (35) response. A 4.0 has
+    /// no DIS serial, so this is its only stable identity — see `Whoop4HelloSerial`. Fires on every hello;
+    /// the manager decides whether it is confirmed enough to adopt.
+    var onStrapSerial: ((String) -> Void)?
+
     var onSyncTrigger: (() -> Void)?
     /// #1706: which strap this connection is talking to, so an alarm readback can be attributed to a
     /// device. Set per connection by BLEManager immediately AFTER `family`, whose didSet clears this —
@@ -269,7 +274,7 @@ public final class FrameRouter {
                     let r = Self.commandResultByte(in: frame)
                     let rhex = r.map { String(format: "0x%02x", UInt8(truncatingIfNeeded: $0)) } ?? "none"
                     state.append(log: "Alarm: strap answered the arm (SET_ALARM_TIME) with result=\(rhex) — log-only, 4.0 result-code meaning unverified")
-                } else if cmd.hasPrefix("GET_HELLO_HARVARD"), TestCentre.active(.connection) {
+                } else if cmd.hasPrefix("GET_HELLO_HARVARD") {
                     // #1303: capture aid for WHOOP-4.0 stable-serial identity. The strap serial lives in this
                     // GET_HELLO_HARVARD (cmd 35) response. This used to dump the payload RAW, which answered
                     // the question — the serial is the 9-char alnum run at offset 14 — but a captured 4.0
@@ -285,10 +290,18 @@ public final class FrameRouter {
                     // the 5/MG device-name offset and means nothing in a cmd-35 payload — passing it would
                     // mislabel whatever run happened to start there. Log-only; decodes/persists nothing.
                     let helloPay = Self.commandResponsePayload(in: frame) ?? []
-                    state.append(log: HelloIdentityProbe.report(payload: helloPay,
-                                                                block: "HELLO_HARVARD(35)",
-                                                                knownNameOffset: -1)
-                                 + " — locate the strap serial offset (#1303)")
+                    // #1193: the identity read is UNGATED, unlike the probe below it. Adoption has to
+                    // work for every 4.0 user, and Test Centre is off for almost all of them — gating it
+                    // would ship a stable id only to the people already debugging. The decoder reads a
+                    // fixed 9-byte window and can never reach the device key beside it, so nothing here
+                    // widens what an ordinary session touches.
+                    if let serial = Whoop4HelloSerial.decode(payload: helloPay) { onStrapSerial?(serial) }
+                    if TestCentre.active(.connection) {
+                        state.append(log: HelloIdentityProbe.report(payload: helloPay,
+                                                                    block: "HELLO_HARVARD(35)",
+                                                                    knownNameOffset: -1)
+                                     + " — locate the strap serial offset (#1303)")
+                    }
                 }
             }
             // #1303: the 5/MG half of the same hunt. The 4.0 aid above is 4.0-only — correctly, since a
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index e151e75a84..70656512e7 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -3216,6 +3216,43 @@ class WhoopBleClient(
      * when reading a capture where iOS shows the adoption line and Android does not.
      */
     var onSerial: ((String) -> Unit)? = null
+    /**
+     * #1193: the WHOOP 4.0 strap serial from `GET_HELLO_HARVARD`, once it has been seen TWICE.
+     *
+     * The 5/MG adopts its DIS serial on first read, because `0x2A25` is a spec-defined field that means
+     * one thing. The 4.0 offset is not that: it was read off a single capture, so "the 9-char alnum run at
+     * offset 14" is a strong inference rather than a documented field. If that run turned out to be
+     * per-session rather than per-strap, adopting it immediately would mint a NEW id on every connect and
+     * migrate the history each time — strictly worse than the duplicate row this exists to prevent.
+     *
+     * So a value must repeat before it is trusted. Two hellos carrying the same run cannot both be a fresh
+     * per-session token, which is the only failure mode that would do real damage. The cost is that a 4.0
+     * adopts one connect later than a 5/MG; the benefit is that the destructive failure cannot happen at
+     * all. Deliberately NOT cleared on disconnect — the two sightings are meant to span connects.
+     *
+     * The withholding rule itself lives in [com.noop.protocol.RepeatedSerialGate], beside the decoder,
+     * where it is unit tested; the gate holds the confirmed value, so nothing here needs to store it. The
+     * Swift twin DOES keep a field, because its adoption reads a property where this side passes the
+     * value into [onSerial] directly - the shapes differ, the behaviour does not.
+     */
+    private val harvardSerialGate = com.noop.protocol.RepeatedSerialGate()
+
+    /**
+     * A 4.0 hello serial arrived. Adopt only on the SECOND sighting of the same value, then hand it to the
+     * SAME [onSerial] the 5/MG DIS read uses, so both families share one adoption path (#1193).
+     */
+    private fun noteHarvardSerial(serial: String) {
+        // Do NOT advance the gate without a listener. The gate confirms EXACTLY ONCE, so a confirmation
+        // delivered to a null [onSerial] is not deferred, it is lost for the lifetime of the process —
+        // every later sighting returns null because the value is already confirmed. And "no listener" is
+        // an ordinary state here, not a defensive hypothetical: [onSerial] is wired by AppViewModel, which
+        // is UI-scoped, while this client also runs under WhoopConnectionService with no UI alive. The
+        // 5/MG path survives the same hazard only because it re-offers its DIS serial on every connect.
+        val cb = onSerial ?: return
+        val confirmed = harvardSerialGate.offer(serial) ?: return
+        cb.invoke(confirmed)
+    }
+
     private var disSerial: String? = null
     private var disHwRev: String? = null
     /** DIS 0x2A24, the strap's own model number — the authoritative variant signal (#520). */
@@ -7420,9 +7457,14 @@ class WhoopBleClient(
                 // falls outside and is withheld inside the probe rather than by this caller.
                 // knownNameOffset = -1 because 16 is the 5/MG device-name offset and means nothing in a
                 // cmd-35 payload. Log-only; decodes/persists nothing. Twin of the Swift FrameRouter probe.
-                if (connectedFamily == DeviceFamily.WHOOP4 && respCmd?.startsWith("GET_HELLO_HARVARD") == true &&
-                    testCentre.active(com.noop.testcentre.TestDomain.CONNECTION)) {
+                if (connectedFamily == DeviceFamily.WHOOP4 && respCmd?.startsWith("GET_HELLO_HARVARD") == true) {
                     val helloPay = whoop4CommandResponsePayload(frame) ?: ByteArray(0)
+                    // #1193: the identity read is UNGATED, unlike the probe below it. Adoption has to work
+                    // for every 4.0 user, and Test Centre is off for almost all of them — gating it would
+                    // ship a stable id only to the people already debugging. The decoder reads a fixed
+                    // 9-byte window and can never reach the device key beside it.
+                    com.noop.protocol.Whoop4HelloSerial.decode(helloPay)?.let { noteHarvardSerial(it) }
+                    if (testCentre.active(com.noop.testcentre.TestDomain.CONNECTION)) {
                     log(
                         com.noop.protocol.HelloIdentityProbe.report(
                             helloPay,
@@ -7430,6 +7472,7 @@ class WhoopBleClient(
                             knownNameOffset = -1,
                         ) + " — locate the strap serial offset (#1303)",
                     )
+                    }
                 }
                 // #1303: the 5/MG half of the same hunt. The 4.0 aid above is 4.0-only — correctly, since
                 // a 5/MG never answers cmd 35 — so this family had no capture at all, and it needs one
diff --git a/android/app/src/main/java/com/noop/protocol/Whoop4HelloSerial.kt b/android/app/src/main/java/com/noop/protocol/Whoop4HelloSerial.kt
new file mode 100644
index 0000000000..f8220398db
--- /dev/null
+++ b/android/app/src/main/java/com/noop/protocol/Whoop4HelloSerial.kt
@@ -0,0 +1,87 @@
+package com.noop.protocol
+
+/**
+ * The WHOOP 4.0 strap serial, read out of the `GET_HELLO_HARVARD` (cmd 35) response (#1193).
+ *
+ * A 4.0 does not expose the DIS Serial Number String (`0x2A25`) that gives the 5/MG its stable id, so
+ * until now the only 4.0 identity available was the transient pairing id the OS mints, which is
+ * re-minted whenever the strap is re-paired or re-keyed. That is the whole of #1193: one physical strap
+ * forks into a second registry row and its history is orphaned beside it.
+ *
+ * The capture aid added for that hunt found the answer: in a 131-byte 4.0 cmd-35 response the serial is
+ * the 9-character alphanumeric run at offset 14.
+ *
+ * ## What this deliberately does NOT read
+ *
+ * The same response carries a 54-character alphanumeric run at offset 24 which is the strap's DEVICE
+ * KEY. This decoder reads a fixed 9-byte window and cannot reach it: there is no scanning, no
+ * "longest alnum run", nothing that could drift onto the key as payloads vary. A key must never become
+ * an id, reach a log, or leave the device, and the cheapest way to guarantee that is to never read it.
+ *
+ * ## Why the strict shape check
+ *
+ * The offset comes from ONE capture. If a future firmware moves the field, a fixed offset lands on
+ * whatever is there instead — so a window that is not entirely `[0-9A-Za-z]` is refused rather than
+ * returned. `WhoopSerialIdentity.adoptedId` then applies its own validation on top. Refusing costs a
+ * strap the stable id it would have gained; returning something wrong migrates its whole history onto a
+ * junk key, which is the failure this exists to prevent.
+ *
+ * Swift twin: `Whoop4HelloSerial`.
+ */
+object Whoop4HelloSerial {
+
+    /** Offset of the serial run inside the cmd-35 response payload. */
+    const val SERIAL_OFFSET = 14
+
+    /** Length of the serial run. The 54-char device key begins at offset 24, one byte past this window. */
+    const val SERIAL_LENGTH = 9
+
+    /** The strap serial, or null when the payload is too short or the window is not a clean alnum run. */
+    fun decode(payload: ByteArray): String? {
+        if (payload.size < SERIAL_OFFSET + SERIAL_LENGTH) return null
+        val sb = StringBuilder(SERIAL_LENGTH)
+        for (i in SERIAL_OFFSET until SERIAL_OFFSET + SERIAL_LENGTH) {
+            val b = payload[i].toInt() and 0xFF
+            val isDigit = b in 0x30..0x39
+            val isUpper = b in 0x41..0x5A
+            val isLower = b in 0x61..0x7A
+            if (!isDigit && !isUpper && !isLower) return null
+            sb.append(b.toChar())
+        }
+        return sb.toString()
+    }
+}
+
+/**
+ * Withholds a serial until the SAME value has been seen twice (#1193).
+ *
+ * The 5/MG adopts its DIS serial on first read, because `0x2A25` is a spec-defined field that means one
+ * thing. The 4.0 offset is not that: it came off a single capture, so "the 9-char alnum run at offset 14"
+ * is a strong inference rather than a documented field. If that run were per-session rather than
+ * per-strap, adopting immediately would mint a new id on every connect and migrate the history each time
+ * - strictly worse than the duplicate row this exists to prevent.
+ *
+ * Two hellos carrying the same run cannot both be a fresh per-session token, which is the only failure
+ * mode that does real damage. The cost is that a 4.0 adopts one connect later than a 5/MG.
+ *
+ * Lives here, apart from the BLE classes that use it, because it is the part most likely to be wrong and
+ * the part neither platform can unit-test in place. Swift twin: `RepeatedSerialGate`.
+ */
+class RepeatedSerialGate {
+    private var candidate: String? = null
+    private var confirmed: String? = null
+
+    /**
+     * The serial to adopt, or null while it is still unconfirmed. Returns non-null only on the transition
+     * to confirmed, so a caller may act on it directly without re-adopting on every later sighting.
+     */
+    fun offer(serial: String): String? {
+        if (confirmed == serial) return null          // already acted on
+        if (candidate != serial) {
+            candidate = serial                         // first sighting: remember, withhold
+            return null
+        }
+        confirmed = serial
+        return serial
+    }
+}
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index 44cf6f2777..f8e5a25250 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -884,8 +884,10 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
         // is deliberately inert on the WHOOP path and never touches WhoopBleClient internals; this class
         // already owns the registry handle and a scope. Twin of Swift `BLEManager.adoptWhoopSerialIdentity`.
         //
-        // A WHOOP 4.0 never reaches here: it exposes no DIS serial, and the 4.0 serial's source on the wire
-        // is not yet identified, so there is nothing honest to adopt onto.
+        // A WHOOP 4.0 reaches here by a different road: it exposes no DIS serial, so its serial is decoded
+        // from the GET_HELLO_HARVARD response (`Whoop4HelloSerial`) and handed to this same callback only
+        // after a SECOND sighting of the same value — see `WhoopBleClient.noteHarvardSerial` for why a 4.0
+        // waits where a 5/MG adopts on the first read (#1193).
         ble.onSerial = { serial ->
             viewModelScope.launch {
                 val serialId = com.noop.data.WhoopSerialIdentity.adoptedId(serial)
diff --git a/android/app/src/test/java/com/noop/protocol/Whoop4HelloSerialTest.kt b/android/app/src/test/java/com/noop/protocol/Whoop4HelloSerialTest.kt
new file mode 100644
index 0000000000..64c7c2221a
--- /dev/null
+++ b/android/app/src/test/java/com/noop/protocol/Whoop4HelloSerialTest.kt
@@ -0,0 +1,107 @@
+package com.noop.protocol
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/** The 4.0 serial decode (#1193) — twin of the Swift `Whoop4HelloSerialTests`, same cases, same values. */
+class Whoop4HelloSerialTest {
+
+    /**
+     * A 131-byte cmd-35 response shaped like the captured one: a 9-char serial at 14, and the 54-char
+     * DEVICE KEY at 24 that must stay unreachable.
+     */
+    private fun capturedShape(
+        serial: String = "WBB5AP053",
+        key: String = "K".repeat(54),
+    ): ByteArray {
+        val p = ByteArray(131)
+        serial.forEachIndexed { i, c -> p[14 + i] = c.code.toByte() }
+        key.forEachIndexed { i, c -> p[24 + i] = c.code.toByte() }
+        return p
+    }
+
+    @Test fun `reads the serial from the captured shape`() {
+        assertEquals("WBB5AP053", Whoop4HelloSerial.decode(capturedShape()))
+    }
+
+    /**
+     * The headline safety property: the decoder reads a fixed 9-byte window, so the device key beside
+     * the serial cannot be returned no matter what it contains.
+     */
+    @Test fun `never returns the device key`() {
+        val out = Whoop4HelloSerial.decode(capturedShape())
+        assertEquals(9, out?.length)
+        assertFalse(out!!.contains("K"))
+    }
+
+    /**
+     * A window that is not a clean alnum run is refused rather than guessed at — a moved field must
+     * cost a strap its stable id, never migrate its history onto junk.
+     */
+    @Test fun `refuses a non-alphanumeric window`() {
+        val a = capturedShape().also { it[18] = 0 }
+        assertNull(Whoop4HelloSerial.decode(a))
+        val b = capturedShape().also { it[14] = 0x2D }
+        assertNull(Whoop4HelloSerial.decode(b))
+    }
+
+    @Test fun `refuses a short payload`() {
+        assertNull(Whoop4HelloSerial.decode(ByteArray(22) { 0x41 }))
+        assertNull(Whoop4HelloSerial.decode(ByteArray(0)))
+    }
+
+    /** Exactly long enough is enough — the window ends at 23, so a 23-byte payload decodes. */
+    @Test fun `accepts the minimum length`() {
+        val p = ByteArray(23) { 0x41 }
+        "ABC123XYZ".forEachIndexed { i, c -> p[14 + i] = c.code.toByte() }
+        assertEquals("ABC123XYZ", Whoop4HelloSerial.decode(p))
+    }
+}
+
+/** The two-sighting gate (#1193) — twin of the Swift `RepeatedSerialGateTests`. */
+class RepeatedSerialGateTest {
+
+    /** The point of the gate: one sighting is never enough to act on. */
+    @Test fun `withholds until the same value repeats`() {
+        val g = RepeatedSerialGate()
+        assertNull(g.offer("WBB5AP053"))
+        assertEquals("WBB5AP053", g.offer("WBB5AP053"))
+    }
+
+    /**
+     * The failure this exists to prevent: a per-session value never confirms, so it can never migrate a
+     * history onto a fresh id per connect.
+     */
+    @Test fun `a value that keeps changing never confirms`() {
+        val g = RepeatedSerialGate()
+        listOf("AAA111AAA", "BBB222BBB", "CCC333CCC", "DDD444DDD").forEach {
+            assertNull("a changing value must never confirm", g.offer(it))
+        }
+    }
+
+    /**
+     * Confirms once, not on every later sighting — the caller adopts on a non-null return, and adopting
+     * repeatedly would redo the migration on every connect.
+     */
+    @Test fun `confirms exactly once`() {
+        val g = RepeatedSerialGate()
+        g.offer("WBB5AP053")
+        assertEquals("WBB5AP053", g.offer("WBB5AP053"))
+        assertNull(g.offer("WBB5AP053"))
+        assertNull(g.offer("WBB5AP053"))
+    }
+
+    /**
+     * An interruption resets the run: two sightings must be consecutive, so alternating values cannot
+     * accumulate their way to a false confirmation.
+     */
+    @Test fun `alternating values do not confirm`() {
+        val g = RepeatedSerialGate()
+        assertNull(g.offer("AAA111AAA"))
+        assertNull(g.offer("BBB222BBB"))
+        assertNull(g.offer("AAA111AAA"))
+        assertEquals("AAA111AAA", g.offer("AAA111AAA"))
+    }
+}
diff --git a/docs/PROTOCOL.md b/docs/PROTOCOL.md
index aa85fa7be2..3227d6fc5d 100644
--- a/docs/PROTOCOL.md
+++ b/docs/PROTOCOL.md
@@ -400,7 +400,7 @@ public func frame(seq: UInt8, payload: [UInt8] = [0x00]) -> [UInt8] {
 | 23 | `HISTORICAL_DATA_RESULT` | `[0x01] + end_data(8)` | ack a `HISTORY_END` chunk / advance trim |
 | 26 | `GET_BATTERY_LEVEL` | `[0x00]` | battery percent; also the **bond** write |
 | 34 | `GET_DATA_RANGE` | `[0x00]` | strap's stored oldest/newest record range; #689 also logs a diagnostic ring-buffer page backlog — see below |
-| 35 | `GET_HELLO_HARVARD` | `[0x00]` | identity/version hello |
+| 35 | `GET_HELLO_HARVARD` | `[0x00]` | identity/version hello; the response carries the 4.0 strap serial — see below |
 | 39 / 40 | `SET_LED_DRIVE` / `GET_LED_DRIVE` | — | optical LED drive (research) |
 | 41 / 42 | `SET_TIA_GAIN` / `GET_TIA_GAIN` | — | optical front-end gain (research) |
 | 43 / 44 | `SET_BIAS_OFFSET` / `GET_BIAS_OFFSET` | — | optical bias (research) |
@@ -954,3 +954,27 @@ is deliberately **not** duplicated here — one table, one place to keep correct
 *Reverse-engineering credit: `johnmiddleton12/my-whoop` (WHOOP 4.0) and `b-nnett/goose`
 (WHOOP 5.0). This is an independent interoperability project for the user's own device and data;
 it is not affiliated with WHOOP and is not a medical device.*
+
+### `GET_HELLO_HARVARD` (35) response — the WHOOP 4.0 serial
+
+A 4.0 exposes no DIS Serial Number String (`0x2A25`), so this response is the only place its stable
+serial appears. In the captures on record the response payload (sliced past `SOF+len+crc8` and
+`[type,seq,cmd,origin_seq,result]`, i.e. from byte 9 of the frame) is **131 bytes** and carries two
+alphanumeric runs:
+
+| payload offset | length | what |
+|---|---|---|
+| 14 | 9 | **strap serial** — the stable per-device id (`Whoop4HelloSerial`) |
+| 24 | 54 | **device key** — a secret; never read it, never log it, never let it become an id |
+
+`Whoop4HelloSerial` reads a FIXED 9-byte window at offset 14 for exactly this reason: a scanning
+"longest alnum run" could drift onto the key as payloads vary, and a fixed window cannot.
+
+**Provenance, because it changes how much this should be trusted:** the offsets come from a single
+capture, not from documentation. They are corroborated only in the sense that two independent places in
+the codebase record the same layout — which is one observation written down twice, not two
+observations. Treat a strap that stops adopting as evidence the field moved, rather than assuming the
+table is wrong about the shape. This is why the 4.0 adoption path waits for the same value on two
+separate hellos before acting on it (`RepeatedSerialGate`), where a 5/MG adopts its spec-defined DIS
+serial on first read.
+

From 1d5b0096ccdd12d3bf3ab4fed6224d496dfee165 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 5 Sep 2026 22:34:20 +1200
Subject: [PATCH 252/333] build: testing build 439 / 320

Build numbers only. The marketing version stays at 11.1.1, which is the next
unreleased version rather than a shipped one, and versionCode clears the previous
staging high-water of 438 so the side-install replaces it.

Carries the WHOOP 4.0 stable-serial identity work, which has not yet run against
a strap - a 4.0 re-paired through the official app is what this build is for.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index a0b2b21c91..bc7a3aacde 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 438
+        versionCode = 439
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 9d25a81803..355ff1e821 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "319"
+    CURRENT_PROJECT_VERSION: "320"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From bbebaa80c1bdca8cc9a75fe86cbddadc9fa0204c Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sat, 5 Sep 2026 23:53:01 +1200
Subject: [PATCH 253/333] ble: mask WHOOP serials that start with a letter

The rule demanded a DIGIT straight after "WHOOP ", so it only ever caught half
the serials it was written for. A staging capture from 2026-09-05 has
"Discovered WHOOP MGB0779473" sitting unredacted three lines from a correctly
masked "WHOOP 4C1594026" - same log, same shape, one letter's difference. Real
serials start with letters as often as digits, and these are the logs people
attach to public issues.

Run over that capture, the old rule masked NOTHING across all 5,233 lines: it was
not merely narrow, it was dead on real data, which is why nothing noticed. The
new rule - any alphanumeric run of six or more that CONTAINS a digit - masks
exactly one token there and disturbs nothing else.

The digit requirement is load-bearing. "WHOOP PUFFIN service 1150" is a real
diagnostic line from the same capture and PUFFIN is six alphanumeric characters,
so a length-only widening would mask it and destroy the line. A serial always
carries a digit; a word does not. The dotted model names survive independently -
the dot ends the run one character in, short of the six the lookahead needs - and
each protection is pinned by its own test.

A BARE serial with no "WHOOP " before it stays uncovered here, deliberately and
now measurably: in that same log a bare-shape rule would have masked 0x2A19 168
times, whoop4/whoop5 112 times, the sdnn40/rmssd40/meanNN40 metric names, the
service UUIDs and the epoch stamps. The log would survive redaction and lose its
diagnostic value. Where bare serials actually appeared - discovery lines - the
call-site allowlist already handles them, and a test pins both halves of that
division so neither is later mistaken for an oversight.
---
 Strand/BLE/LiveState.swift                    | 11 +++++-
 StrandTests/PiiRedactionTests.swift           | 28 +++++++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 14 ++++++--
 .../java/com/noop/ble/PiiRedactionTest.kt     | 34 +++++++++++++++++++
 4 files changed, 83 insertions(+), 4 deletions(-)

diff --git a/Strand/BLE/LiveState.swift b/Strand/BLE/LiveState.swift
index 53dbb11cc4..a4d8fc405f 100644
--- a/Strand/BLE/LiveState.swift
+++ b/Strand/BLE/LiveState.swift
@@ -898,8 +898,17 @@ public final class LiveState: ObservableObject {
         out = out.replacingOccurrences(
             of: "([0-9A-Fa-f]{2}):[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:([0-9A-Fa-f]{2})",
             with: "$1:••:••:••:••:$2", options: .regularExpression)
+        // #1193 field capture: the old rule required a DIGIT straight after "WHOOP ", but real serials
+        // start with letters as often as digits - "WHOOP MGB0779473" sat unredacted in a log attached to
+        // an issue while "WHOOP 4C1594026" beside it was masked. The rule now accepts any alnum run of 6+
+        // that CONTAINS a digit.
+        //
+        // The digit requirement is not decoration, it is what keeps this from eating words: "WHOOP PUFFIN
+        // service 1150" is a real diagnostic line, and PUFFIN is six alnum characters. A serial always
+        // carries a digit; a word does not. "WHOOP 4.0" stays untouched for a different reason - the dot
+        // stops the run at one character, short of the six the lookahead demands.
         out = out.replacingOccurrences(
-            of: "WHOOP (\\d[0-9A-Za-z]{5,})", with: "WHOOP <serial>", options: .regularExpression)
+            of: "WHOOP (?=[0-9A-Za-z]{6,})[0-9A-Za-z]*[0-9][0-9A-Za-z]*", with: "WHOOP <serial>", options: .regularExpression)
         // Mask a CoreBluetooth peripheral UUID, but NOT a standard-BLE / WHOOP-vendor service UUID.
         out = out.replacingOccurrences(
             of: "(?![0-9A-Fa-f]{8}-(?:0000-1000-8000-00805f9b34fb|8d6d-82b8-614a-1c8cb0f8dcc6))[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}",
diff --git a/StrandTests/PiiRedactionTests.swift b/StrandTests/PiiRedactionTests.swift
index aee5ffd621..6e9691bda3 100644
--- a/StrandTests/PiiRedactionTests.swift
+++ b/StrandTests/PiiRedactionTests.swift
@@ -95,4 +95,32 @@ final class PiiRedactionTests: XCTestCase {
         XCTAssertEqual(LiveState.logSafeDeviceName("Polar OH1"), "Polar OH1")
     }
 
+
+    /// Field evidence (a 2026-09-05 staging log): serials beginning with a LETTER walked straight through
+    /// the old rule, which demanded a digit after "WHOOP ". Both spellings must mask.
+    func testMasksASerialWhateverCharacterItStartsWith() {
+        XCTAssertEqual(LiveState.redactPii("Discovered WHOOP MGB0779473 (rssi -48) - connecting"),
+                       "Discovered WHOOP <serial> (rssi -48) - connecting")
+        XCTAssertEqual(LiveState.redactPii("Discovered WHOOP 4C1594026 (rssi -63)"),
+                       "Discovered WHOOP <serial> (rssi -63)")
+        XCTAssertEqual(LiveState.redactPii("WHOOP 5AG0393796"), "WHOOP <serial>")
+    }
+
+    /// The digit requirement earns its keep here. "WHOOP PUFFIN service 1150" is a real diagnostic line
+    /// from the same log, and PUFFIN is six alnum characters - a length-only rule would mask it and
+    /// destroy the meaning of the line.
+    func testDoesNotMaskAWhoopPrefixedWord() {
+        let line = "WHOOP PUFFIN service 1150 detected but unsupported"
+        XCTAssertEqual(LiveState.redactPii(line), line)
+    }
+
+    /// A bare serial with no "WHOOP " in front of it is NOT covered here, and deliberately so: the only
+    /// rule that could catch it keys on shape alone and would mask ordinary prose. Discovery lines -
+    /// where this actually occurred - are handled at the call site by `logSafeDeviceName` instead.
+    func testABareSerialIsLeftToTheCallSiteNotGuessedAtHere() {
+        XCTAssertEqual(LiveState.redactPii("Discovered WBB5BP1174092 (rssi -64)"),
+                       "Discovered WBB5BP1174092 (rssi -64)")
+        XCTAssertEqual(LiveState.logSafeDeviceName("WBB5BP1174092"), "<name>")
+    }
+
 }
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 70656512e7..3b2c36ea19 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -11233,10 +11233,18 @@ class WhoopBleClient(
 //     replace() threw IndexOutOfBoundsException("No group 3"), and the thrown exception aborted that
 //     strap's activation. The WHOOP path never hit it because it only ever logs "WHOOP <serial>", never
 //     a raw MAC, so the bug was invisible until a Polar H10 / other 0x180D strap was used.)
-//   • WHOOP serial: the device name carries it ("WHOOP 4C1594026"); the dotted model names ("WHOOP 4.0")
-//     are too short / dotted to match.
+//   • WHOOP serial: the device name carries it ("WHOOP 4C1594026"). This used to require a DIGIT straight
+//     after "WHOOP ", but real serials start with letters as often as digits - a field log had
+//     "WHOOP MGB0779473" sitting unredacted next to a masked "WHOOP 4C1594026". Any alnum run of 6+ that
+//     CONTAINS a digit now matches.
+//
+//     The digit requirement is what keeps this from eating words: "WHOOP PUFFIN service 1150" is a real
+//     diagnostic line and PUFFIN is six alnum characters. A serial always carries a digit; a word does
+//     not. The dotted model names ("WHOOP 4.0") stay untouched for a different reason - the dot ends the
+//     run at one character, short of the six the lookahead demands.
 private val PII_MAC_RE = Regex("([0-9A-Fa-f]{2}):[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:([0-9A-Fa-f]{2})")
-private val PII_WHOOP_SERIAL_RE = Regex("WHOOP (\\d[0-9A-Za-z]{5,})")
+private val PII_WHOOP_SERIAL_RE =
+    Regex("WHOOP (?=[0-9A-Za-z]{6,})[0-9A-Za-z]*[0-9][0-9A-Za-z]*")
 
 /**
  * The account holder's NAME, as WHOOP writes it into the advertised local name.
diff --git a/android/app/src/test/java/com/noop/ble/PiiRedactionTest.kt b/android/app/src/test/java/com/noop/ble/PiiRedactionTest.kt
index 432f380bc0..2fa00ceb9b 100644
--- a/android/app/src/test/java/com/noop/ble/PiiRedactionTest.kt
+++ b/android/app/src/test/java/com/noop/ble/PiiRedactionTest.kt
@@ -243,4 +243,38 @@ class PiiRedactionTest {
         assertEquals("Polar OH1", logSafeDeviceName("Polar OH1"))
     }
 
+
+    /**
+     * Field evidence (a 2026-09-05 staging log): serials beginning with a LETTER walked straight through
+     * the old rule, which demanded a digit after "WHOOP ". Both spellings must mask.
+     */
+    @Test fun `masks a serial whatever character it starts with`() {
+        assertEquals("Discovered WHOOP <serial> (rssi -48) - connecting",
+            redactStrapLogPii("Discovered WHOOP MGB0779473 (rssi -48) - connecting"))
+        assertEquals("Discovered WHOOP <serial> (rssi -63)",
+            redactStrapLogPii("Discovered WHOOP 4C1594026 (rssi -63)"))
+        assertEquals("WHOOP <serial>", redactStrapLogPii("WHOOP 5AG0393796"))
+    }
+
+    /**
+     * The digit requirement earns its keep here. "WHOOP PUFFIN service 1150" is a real diagnostic line
+     * from the same log, and PUFFIN is six alnum characters - a length-only rule would mask it and
+     * destroy the meaning of the line.
+     */
+    @Test fun `does not mask a WHOOP-prefixed WORD`() {
+        val line = "WHOOP PUFFIN service 1150 detected but unsupported"
+        assertEquals(line, redactStrapLogPii(line))
+    }
+
+    /**
+     * A bare serial with no "WHOOP " in front of it is NOT covered here, and deliberately so: the only
+     * rule that could catch it keys on shape alone and would mask ordinary prose. Discovery lines - where
+     * this actually occurred - are handled at the call site by [logSafeDeviceName] instead.
+     */
+    @Test fun `a bare serial is left to the call site, not guessed at here`() {
+        assertEquals("Discovered WBB5BP1174092 (rssi -64)",
+            redactStrapLogPii("Discovered WBB5BP1174092 (rssi -64)"))
+        assertEquals("<name>", logSafeDeviceName("WBB5BP1174092"))
+    }
+
 }

From fd18ef94c4eeab5b938ab2be9479ce3990bada28 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 00:39:01 +1200
Subject: [PATCH 254/333] analytics: cap HR, R-R and gravity reads separately,
 so a night is not scored on a clipped stream

A field capture (2026-09-05, 5/MG, 21 nights) reported R-R windows coming back AT
the read cap ten times. SlidingStreamWindow's own doc says what that means - "a
non-zero count means a number may be wrong, not merely slow" - because the read
is ORDER BY ts ASC LIMIT, so what is dropped is the NEWEST rows. HRV for those
nights was computed on data missing its tail, silently.

The cause was one cap of 200,000 serving streams with different peak densities
over a 54-hour window. HR fits with 3% to spare, which is why it never truncated
and why one number looked adequate; R-R peaks well past it. The bug was never
that the number was too small, but that a value comfortable for one stream is a
silent truncation for another.

Each stream now derives its cap from the window span and its own peak rate, with
half again as headroom, so a legitimate read cannot land ON the cap and be
mistaken for a truncated one. The read cap and truncation threshold remain one
stored value per stream - that identity is what lets a clipped read be recognised
at all.

Gravity is included, and it was the most exposed of the three: the capture
measures it at 192,698 rows, 96% of the old cap, and unlike HR and R-R it is a
PLAIN read with no truncation counter - a clip there produces no signal
whatsoever, and sleep STAGING is what consumes it. The claim in the code that the
other streams are "thousands of rows" did not hold for it.

The 30-hour lookback now has one home. It was a literal repeated four times per
platform with nothing tying it to the caps derived from it - the same "one number
in two places" shape that caused this - so widening it anywhere would have
silently under-provisioned them again.

Sized against measurement rather than theory: the caps clear 200,000, the value
the field proved insufficient, and the rate constants are documented as ceilings
to stay clear of rather than predictions of typical density. R-R's average is
actually BELOW HR's - it arrives in bursts, and bursts are what reach a cap.

This stops the truncation recurring. It does not re-score history, and nothing
records which nights were affected.
---
 .../StrandAnalytics/StreamReadCap.swift       |  98 +++++++++++++++
 .../StreamReadCapTests.swift                  |  72 +++++++++++
 Strand/Data/IntelligenceEngine.swift          |  36 +++---
 .../com/noop/analytics/IntelligenceEngine.kt  |  26 ++--
 .../java/com/noop/analytics/StreamReadCap.kt  | 114 ++++++++++++++++++
 .../com/noop/analytics/StreamReadCapTest.kt   |  85 +++++++++++++
 6 files changed, 405 insertions(+), 26 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Sources/StrandAnalytics/StreamReadCap.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/StreamReadCapTests.swift
 create mode 100644 android/app/src/main/java/com/noop/analytics/StreamReadCap.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/StreamReadCapTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/StreamReadCap.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/StreamReadCap.swift
new file mode 100644
index 0000000000..502116299c
--- /dev/null
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/StreamReadCap.swift
@@ -0,0 +1,98 @@
+import Foundation
+
+/// Per-stream read caps for the `analyzeRecent` sliding windows (#1538).
+///
+/// One shared cap of 200,000 covered both heavy streams, and it was sized for HR. A field capture
+/// (2026-09-05, WHOOP 5/MG, 21 nights) shows what that cost:
+///
+///     hr[read=1723815 served=1826919 truncated=0]
+///     rr[read=2563444 served=610905 truncated=10]
+///
+/// Ten R-R windows came back AT the cap. `SlidingStreamWindow.truncatedReads` is explicit about what
+/// that means - "a non-zero count means a number may be wrong, not merely slow" - because the read is
+/// `ORDER BY ts ASC LIMIT`, so what gets dropped is the NEWEST rows. Every HRV number derived from one
+/// of those windows was computed on a night missing its tail, silently.
+///
+/// ## Why R-R and not HR
+///
+/// Measured, not reasoned from beat rate - the capture contradicts the obvious argument. R-R is one row
+/// per BEAT, so it "should" outrun HR's 1/s, yet a stride read in that same log returned 81,009 R-R rows
+/// against 107,415 HR: R-R is recorded in BURSTS, not continuously, so its average over a window sits
+/// BELOW HR's while its peaks run far above. Averages are why one cap looked safe; peaks are what
+/// truncated it.
+///
+/// What is certain is the behaviour: across 21 nights R-R came back at the 200,000 cap ten times and HR
+/// never did. HR's own margin is the other half of the story - a full 54-hour window at 1/s is ~194,400
+/// rows, 3% under the cap, so HR was never comfortable either, merely lucky.
+///
+/// The caps are therefore sized against what a window can PEAK at, not what it averages. The rate
+/// constants below are deliberately generous for that reason: they are a ceiling to stay clear of, not a
+/// prediction of typical density.
+///
+/// So the bug was not the number being too small. It was ONE number serving two streams whose peak
+/// densities differ, where a value comfortable for one is a silent truncation for the other.
+///
+/// ## The invariant
+///
+/// A cap must exceed what a full window can legitimately hold, or a complete read is indistinguishable
+/// from a truncated one. `capExceedsFullWindow` pins exactly that, per stream, so a future change to the
+/// window span or a stream's rate fails a test rather than quietly clipping a night.
+///
+/// Note the cap is a ceiling, not an allocation: a read still returns only the rows that exist. Raising
+/// it costs nothing on a normal night and buys correctness on a dense one.
+public enum StreamReadCap {
+
+    /// How far BEFORE the day boundary the pass reads. EVERY lookback in the engine takes this value -
+    /// the per-day `from`, the window start, the skin-anchor scan - so the window and the caps derived
+    /// from it cannot drift apart - widening the lookback there without
+    /// resizing the caps here is precisely how a stream starts truncating again, and is the "one number
+    /// in two places" shape this whole type exists because of.
+    public static let lookbackSeconds = 30 * 3_600
+
+    /// How far AFTER it, capped at `now` for a day still in progress. A whole day.
+    public static let forwardSeconds = 24 * 3_600
+
+    /// The per-day read window: `dayStart - 30h` through the night, i.e. 54 hours.
+    public static let windowSeconds = lookbackSeconds + forwardSeconds
+
+    /// HR: one sample per second.
+    public static let hrRowsPerSecond = 1.0
+
+    /// R-R at its PEAK. The measured average is below 1/s (it arrives in bursts, with gaps), but bursts
+    /// are what reach a cap - and #1008's cross-second overcount can double the rows a burst produces.
+    /// 2/s is a ceiling chosen to stay clear of, not a claim about typical density.
+    public static let rrRowsPerSecond = 2.0
+
+    /// Gravity: one sample per second, like HR, and read over the SAME 54-hour window - the code's claim
+    /// that "the other eight streams are thousands of rows" does not hold for this one. A field capture
+    /// measured 192,698 gravity rows, 96% of the old shared cap.
+    ///
+    /// It is the most dangerous of the three, because it is a PLAIN read rather than a
+    /// `SlidingStreamWindow`: nothing counts a truncation here, so a clip would be silent even by the
+    /// standard that caught R-R. Sleep STAGING is what consumes it, so the cost of a clipped read is a
+    /// mis-staged night rather than a slow one.
+    public static let gravityRowsPerSecond = 1.0
+
+    /// Headroom over a full window, so a legitimate read cannot land ON the cap and be mistaken for a
+    /// truncated one.
+    public static let headroom = 1.5
+
+    /// The cap for a stream producing `rowsPerSecond` at its densest.
+    public static func cap(rowsPerSecond: Double) -> Int {
+        Int((Double(windowSeconds) * rowsPerSecond * headroom).rounded(.up))
+    }
+
+    /// 291,600 - a full HR window plus half again.
+    ///
+    /// STORED, not computed. A window's read cap and its truncation threshold must be the same number,
+    /// and the engine names this in both slots - a stored constant makes those two references provably
+    /// one value rather than two evaluations that merely ought to agree.
+    public static let hr = cap(rowsPerSecond: hrRowsPerSecond)
+
+    /// 583,200 - a full R-R window at its densest, plus half again. Stored for the reason `hr` gives.
+    public static let rr = cap(rowsPerSecond: rrRowsPerSecond)
+
+    /// 291,600 - the same shape as `hr`, for the same 54-hour window. Only the 54-hour read needs it;
+    /// the day-scoped gravity reads span 24 hours and cannot approach any of these.
+    public static let gravity = cap(rowsPerSecond: gravityRowsPerSecond)
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/StreamReadCapTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/StreamReadCapTests.swift
new file mode 100644
index 0000000000..26baf206bf
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/StreamReadCapTests.swift
@@ -0,0 +1,72 @@
+import Foundation
+import XCTest
+@testable import StrandAnalytics
+
+/// Per-stream read caps (#1538) — twin of the Kotlin `StreamReadCapTest`, same cases and same numbers.
+final class StreamReadCapTests: XCTestCase {
+
+    /// THE invariant. A cap must exceed what a full window can legitimately hold, or a complete read is
+    /// indistinguishable from a truncated one — and the truncated one silently loses its newest rows.
+    func testCapExceedsAFullWindowForEveryStream() {
+        let fullHR = Double(StreamReadCap.windowSeconds) * StreamReadCap.hrRowsPerSecond
+        let fullRR = Double(StreamReadCap.windowSeconds) * StreamReadCap.rrRowsPerSecond
+        XCTAssertGreaterThan(Double(StreamReadCap.hr), fullHR)
+        XCTAssertGreaterThan(Double(StreamReadCap.rr), fullRR)
+    }
+
+    /// The test above is derived from the same constants as the caps, so on its own it only asserts that
+    /// headroom exceeds 1. This one is anchored OUTSIDE the type, to a number the field produced: R-R
+    /// came back at 200,000 ten times in one capture, so that value is known-insufficient rather than
+    /// theorised. A cap at or below it would reintroduce the bug no matter how the arithmetic reads.
+    func testCapsClearTheValueThatTruncatedInTheField() {
+        let knownInsufficient = 200_000
+        XCTAssertGreaterThan(StreamReadCap.rr, knownInsufficient)
+        XCTAssertGreaterThan(StreamReadCap.hr, knownInsufficient,
+                             "HR sat 3% under this and was lucky, not safe")
+    }
+
+    /// The window is not restated here — the engine reads `dayStart - lookbackSeconds`, so these are the
+    /// same number by construction. Pinned so that splitting them again is a visible change.
+    func testWindowIsItsTwoHalves() {
+        XCTAssertEqual(StreamReadCap.windowSeconds,
+                       StreamReadCap.lookbackSeconds + StreamReadCap.forwardSeconds)
+        XCTAssertEqual(StreamReadCap.lookbackSeconds, 30 * 3_600)
+        XCTAssertEqual(StreamReadCap.forwardSeconds, 86_400)
+    }
+
+    /// The regression itself, in the numbers that caused it. The old shared cap of 200,000 was ABOVE a
+    /// full HR window and BELOW a full R-R one — which is exactly why HR never truncated, R-R always did,
+    /// and one number looked adequate from the HR side.
+    func testTheOldSharedCapWasBelowAFullRRWindow() {
+        let oldSharedCap = 200_000.0
+        let fullHR = Double(StreamReadCap.windowSeconds) * StreamReadCap.hrRowsPerSecond
+        let fullRR = Double(StreamReadCap.windowSeconds) * StreamReadCap.rrRowsPerSecond
+        XCTAssertGreaterThan(oldSharedCap, fullHR, "the old cap fitted HR, which is why it looked fine")
+        XCTAssertLessThan(oldSharedCap, fullRR, "and did not fit R-R, which is why nights were clipped")
+        XCTAssertGreaterThan(Double(StreamReadCap.rr), fullRR, "the new cap does fit it")
+    }
+
+    /// R-R must be capped higher than HR: it is one row per BEAT, not one per second.
+    func testRRIsCappedHigherThanHR() {
+        XCTAssertGreaterThan(StreamReadCap.rr, StreamReadCap.hr)
+    }
+
+    /// The window is 54 hours — `dayStart - 30h` running through the night. Pinned because both caps are
+    /// derived from it, so a silent change here would resize them both.
+    func testWindowIsFiftyFourHours() {
+        XCTAssertEqual(StreamReadCap.windowSeconds, 54 * 3_600)
+        XCTAssertEqual(StreamReadCap.hr, 291_600)
+        XCTAssertEqual(StreamReadCap.rr, 583_200)
+        XCTAssertEqual(StreamReadCap.gravity, 291_600)
+    }
+
+    /// Gravity is the third stream on the 54-hour window, and the field capture put it at 192,698 rows -
+    /// 96% of the old shared cap. Unlike HR and R-R it is a PLAIN read with no truncation counter, so a
+    /// clip there reports nothing at all; sleep staging simply gets a night missing its tail.
+    func testGravityClearsWhatTheFieldMeasured() {
+        let measuredInField = 192_698
+        XCTAssertGreaterThan(StreamReadCap.gravity, measuredInField)
+        XCTAssertGreaterThan(StreamReadCap.gravity, 200_000, "the old shared cap it sat 96% of")
+    }
+
+}
diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index 223ab3397a..7a809abe70 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -747,7 +747,7 @@ final class IntelligenceEngine: ObservableObject {
         // and the Sleep tab resolve to the identical block. (#547)
         let (habitualMidsleepSec, nightlyHours) = await Self.computeHabitualSleep(
             store: store, importedId: deviceId, computedId: deviceId + "-noop",
-            windowStart: nowLocalMidnight - maxDays * 86_400 - 30 * 3_600,
+            windowStart: nowLocalMidnight - maxDays * 86_400 - StreamReadCap.lookbackSeconds,
             windowEnd: now, offsetSec: tzOffset)
         // Wave 0 (SL1/T1): personal sleep REGULARITY + population-anchored NEED, computed ONCE from the
         // trailing per-night durations and threaded to every analyzeDay below (mirrors the midsleep
@@ -883,7 +883,7 @@ final class IntelligenceEngine: ObservableObject {
             var skippedSleepDays: [(day: String, hrSamples: Int)] = []
             // #938: the WHOOP 4.0 ADC offset is per-device, not per-night. Learn one anchor per owner
             // from the whole scan window and reuse it for every night so cross-night deviations survive.
-            let skinAnchorScanFrom = nowLocalMidnight - (maxDays - 1) * 86_400 - 30 * 3_600
+            let skinAnchorScanFrom = nowLocalMidnight - (maxDays - 1) * 86_400 - StreamReadCap.lookbackSeconds
             let skinAnchorScanTo = nowLocalMidnight + 18 * 3_600
             var skinAnchorByOwner: [String: Double] = [:]
             var skinAnchorResolvedOwners = Set<String>()
@@ -907,24 +907,27 @@ final class IntelligenceEngine: ObservableObject {
             // planner cannot prove safe falls back to exactly the read that shipped before them. HR and
             // R-R only: the other eight streams are thousands of rows against these two's tens of
             // thousands, so this is nearly all of the win for two call sites of blast radius.
-            // ONE binding, used as both the read cap and the window's truncation threshold. They must be
-            // the same number: the window declines to slice a read that came back at the cap, because
-            // `ORDER BY ts ASC LIMIT` drops the NEWEST rows. Were the two to drift apart, a truncated read
-            // would stop being recognised and the buffer would be sliced while missing its tail — wrong
-            // scoring inputs, silently. The Kotlin twin cannot drift because it uses `STREAM_LIMIT` for
-            // both; this is the same guarantee spelled locally.
-            let streamLimit = 200_000
-            let hrWindow = SlidingStreamWindow<HRSample>(tsOf: { $0.ts }, limit: streamLimit) { o, f, t in
-                try? await store.hrSamples(deviceId: o, from: f, to: t, limit: streamLimit)
+            // Each window's read cap and its truncation threshold must be the SAME number: the window
+            // declines to slice a read that came back at the cap, because `ORDER BY ts ASC LIMIT` drops the
+            // NEWEST rows. Were the two to drift apart, a truncated read would stop being recognised and the
+            // buffer would be sliced while missing its tail — wrong scoring inputs, silently. Passing one
+            // `StreamReadCap` value into both slots below keeps that guarantee per stream.
+            //
+            // #1538: the two streams no longer share ONE cap. 200,000 was sized for HR (a full 54h window is
+            // ~194,400 rows, 3% under) and silently truncated R-R, which is per-BEAT and runs to 233k-389k
+            // over the same window. A field capture showed `rr[... truncated=10]` — ten nights scored on R-R
+            // missing its tail. See `StreamReadCap` for the arithmetic.
+            let hrWindow = SlidingStreamWindow<HRSample>(tsOf: { $0.ts }, limit: StreamReadCap.hr) { o, f, t in
+                try? await store.hrSamples(deviceId: o, from: f, to: t, limit: StreamReadCap.hr)
             }
-            let rrWindow = SlidingStreamWindow<RRInterval>(tsOf: { $0.ts }, limit: streamLimit) { o, f, t in
-                try? await store.rrIntervals(deviceId: o, from: f, to: t, limit: streamLimit)
+            let rrWindow = SlidingStreamWindow<RRInterval>(tsOf: { $0.ts }, limit: StreamReadCap.rr) { o, f, t in
+                try? await store.rrIntervals(deviceId: o, from: f, to: t, limit: StreamReadCap.rr)
             }
             for offset in 0..<maxDays {
                 let dayStart = nowLocalMidnight - offset * 86_400
                 let day = AnalyticsEngine.dayString(dayStart, offsetSec: tzOffset)
                 // Read a generous window around the night that ends on `day`; the stager finds the span.
-                let from = dayStart - 30 * 3_600
+                let from = dayStart - StreamReadCap.lookbackSeconds
                 // Sleep read-window END — see `sleepReadWindowEnd`.
                 let to = Self.sleepReadWindowEnd(dayStart: dayStart,
                                                  nowLocalMidnight: nowLocalMidnight,
@@ -1023,7 +1026,8 @@ final class IntelligenceEngine: ObservableObject {
                                                              limit: 200_000)) ?? []
                 let resp = OuraRespScale.forScoring(respRows, deviceId: owner)
                 let vendorResp = OuraRespScale.forVendorRate(respRows, deviceId: owner)
-                let grav = (try? await store.gravitySamples(deviceId: owner, from: from, to: to, limit: 200_000)) ?? []
+                let grav = (try? await store.gravitySamples(deviceId: owner, from: from, to: to,
+                                                            limit: StreamReadCap.gravity)) ?? []
                 let steps = (try? await store.stepSamples(deviceId: owner, from: from, to: to, limit: 200_000)) ?? []
                 let skin = (try? await store.skinTempSamples(deviceId: owner, from: from, to: to, limit: 200_000)) ?? []
                 // #93: WHOOP 4.0 raw SpO2 PPG samples for the night; analyzeDay banks the nightly red/IR ADC
@@ -1731,7 +1735,7 @@ final class IntelligenceEngine: ObservableObject {
         // re-labelled rows (both written under `deviceId`), and apple-health carries Health imports ,
         // a detected bout overlapping ANY of them is skipped below. Port of the Android dedup block.
         // (`computedId` is bound once above, before the off-actor scan loop.)
-        let windowStart = now - maxDays * 86_400 - 30 * 3_600
+        let windowStart = now - maxDays * 86_400 - StreamReadCap.lookbackSeconds
         var realWorkouts = (try? await store.workouts(deviceId: deviceId, from: windowStart,
                                                        to: now, limit: 100_000)) ?? []
         realWorkouts += (try? await store.workouts(deviceId: "apple-health", from: windowStart,
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index 8b10314b2a..aafeb9f3d4 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -159,7 +159,13 @@ object IntelligenceEngine {
     /** Minimum HR samples in a day's window before it is worth scoring. */
     const val MIN_HR_SAMPLES: Int = 200
 
-    /** Read cap per stream read , matches the Swift 200_000 bound. */
+    /**
+     * Read cap for the SPARSE streams (aux, resp, gravity, skin temp), matching the Swift bound.
+     *
+     * NOT the two heavy streams any more: HR and R-R take their caps from [StreamReadCap], because one
+     * number sized for HR silently truncated R-R (#1538). Anything reading a stream dense enough to
+     * approach this bound belongs there too.
+     */
     const val STREAM_LIMIT: Int = 200_000
     internal const val PHYSIOLOGICAL_STEP_PAGE_SIZE: Int = 10_000
 
@@ -653,7 +659,7 @@ object IntelligenceEngine {
         // the Sleep tab resolve to the identical block. Mirrors Swift. (#547)
         val (habitualMidsleepSec, nightlyHours) = computeHabitualSleep(
             repo, importedDeviceId, computedId,
-            nowLocalMidnight - maxDays * SECONDS_PER_DAY - 30 * 3_600L, nowSeconds, tzOffsetSeconds,
+            nowLocalMidnight - maxDays * SECONDS_PER_DAY - StreamReadCap.LOOKBACK_SECONDS, nowSeconds, tzOffsetSeconds,
         )
         // Wave 0 (SL1/T1): personal sleep REGULARITY + population-anchored NEED, computed ONCE from the
         // trailing per-night durations and threaded to every analyzeDay below (mirrors the midsleep
@@ -683,7 +689,7 @@ object IntelligenceEngine {
         val skinWornToleranceByOwner = HashMap<String, Long>()
         // #938: the WHOOP 4.0 ADC offset is per-device, not per-night. Learn one anchor per owner from the
         // whole scan window and reuse it for every night so cross-night deviations survive.
-        val skinAnchorScanFrom = nowLocalMidnight - (maxDays - 1).toLong() * SECONDS_PER_DAY - 30 * 3_600L
+        val skinAnchorScanFrom = nowLocalMidnight - (maxDays - 1).toLong() * SECONDS_PER_DAY - StreamReadCap.LOOKBACK_SECONDS
         val skinAnchorScanTo = nowLocalMidnight + 18 * 3_600L
         val skinAnchorByOwner = HashMap<String, Double>()
         val skinAnchorResolvedOwners = HashSet<String>()
@@ -776,7 +782,7 @@ object IntelligenceEngine {
             val dayDiagLines = ArrayList<String>()
             fun dayDiag(line: String) { dayDiagLines.add(line); diag(line) }
             // Read a generous window around the night that ends on `day`; the stager finds the span.
-            val from = dayStart - 30 * 3_600L
+            val from = dayStart - StreamReadCap.LOOKBACK_SECONDS
             // Sleep read-window END — see `sleepReadWindowEnd`. A PAST day reads through to the next
             // local midnight so the stager sees the whole night; TODAY is capped at `now` (never read
             // the future), NOT a fixed `dayStart + 18h` — that cap reported a flat 18:00 wake for a
@@ -901,7 +907,7 @@ object IntelligenceEngine {
             val respRows = repo.respSamples(owner, from, to, STREAM_LIMIT)
             val resp = OuraRespScale.forScoring(respRows, owner)
             val vendorResp = OuraRespScale.forVendorRate(respRows, owner)
-            val grav = repo.gravitySamplesForDevice(owner, from, to, STREAM_LIMIT)
+            val grav = repo.gravitySamplesForDevice(owner, from, to, StreamReadCap.GRAVITY)
             val steps = repo.stepSamples(owner, from, to, STREAM_LIMIT)
             val skinReads = readDaySkinAndWristOff(
                 repo, owner, from, to, ownerSource, skinFamilyByOwner, skinWornToleranceByOwner,
@@ -1433,7 +1439,7 @@ object IntelligenceEngine {
         // the cross-source duplicate (#107): the strap source carries imported WHOOP rows AND manual /
         // re-labelled rows (both under [importedDeviceId]); apple-health / health-connect carry Health
         // imports , a detected bout overlapping ANY of them is skipped below.
-        val windowStart = nowSeconds - maxDays.toLong() * SECONDS_PER_DAY - 30 * 3_600L
+        val windowStart = nowSeconds - maxDays.toLong() * SECONDS_PER_DAY - StreamReadCap.LOOKBACK_SECONDS
         val realWorkouts = repo.workouts(importedDeviceId, windowStart, nowSeconds) +
             repo.workouts("apple-health", windowStart, nowSeconds) +
             repo.workouts("health-connect", windowStart, nowSeconds)
@@ -2687,14 +2693,14 @@ object IntelligenceEngine {
      *  element lambda nor the reader lambda counts against that method's bytecode budget, which the
      *  extraction next door exists to protect. */
     private fun hrReadWindow(repo: com.noop.data.WhoopRepository) =
-        SlidingStreamWindow<com.noop.data.HrSample>({ it.ts }, STREAM_LIMIT) { o, f, t ->
-            repo.hrSamplesForDevice(o, f, t, STREAM_LIMIT)
+        SlidingStreamWindow<com.noop.data.HrSample>({ it.ts }, StreamReadCap.HR) { o, f, t ->
+            repo.hrSamplesForDevice(o, f, t, StreamReadCap.HR)
         }
 
     /** The pass-1 R-R sliding read window. Same reason as [hrReadWindow] for living out here. */
     private fun rrReadWindow(repo: com.noop.data.WhoopRepository) =
-        SlidingStreamWindow<com.noop.data.RrInterval>({ it.ts }, STREAM_LIMIT) { o, f, t ->
-            repo.rrIntervalsForDevice(o, f, t, STREAM_LIMIT)
+        SlidingStreamWindow<com.noop.data.RrInterval>({ it.ts }, StreamReadCap.RR) { o, f, t ->
+            repo.rrIntervalsForDevice(o, f, t, StreamReadCap.RR)
         }
 
 
diff --git a/android/app/src/main/java/com/noop/analytics/StreamReadCap.kt b/android/app/src/main/java/com/noop/analytics/StreamReadCap.kt
new file mode 100644
index 0000000000..194481a4cf
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/StreamReadCap.kt
@@ -0,0 +1,114 @@
+package com.noop.analytics
+
+import kotlin.math.ceil
+
+/**
+ * Per-stream read caps for the `analyzeRecent` sliding windows (#1538).
+ *
+ * One shared cap of 200,000 covered both heavy streams, and it was sized for HR. A field capture
+ * (2026-09-05, WHOOP 5/MG, 21 nights) shows what that cost:
+ *
+ * ```
+ * hr[read=1723815 served=1826919 truncated=0]
+ * rr[read=2563444 served=610905 truncated=10]
+ * ```
+ *
+ * Ten R-R windows came back AT the cap. [SlidingStreamWindow.truncatedReads] is explicit about what
+ * that means - "a non-zero count means a number may be wrong, not merely slow" - because the read is
+ * `ORDER BY ts ASC LIMIT`, so what gets dropped is the NEWEST rows. Every HRV number derived from one of
+ * those windows was computed on a night missing its tail, silently.
+ *
+ * ## Why R-R and not HR
+ *
+ * Measured, not reasoned from beat rate - the capture contradicts the obvious argument. R-R is one row
+ * per BEAT, so it "should" outrun HR's 1/s, yet a stride read in that same log returned 81,009 R-R rows
+ * against 107,415 HR: R-R is recorded in BURSTS, not continuously, so its average over a window sits
+ * BELOW HR's while its peaks run far above. Averages are why one cap looked safe; peaks are what
+ * truncated it.
+ *
+ * What is certain is the behaviour: across 21 nights R-R came back at the 200,000 cap ten times and HR
+ * never did. HR's own margin is the other half of the story - a full 54-hour window at 1/s is ~194,400
+ * rows, 3% under the cap, so HR was never comfortable either, merely lucky.
+ *
+ * The caps are therefore sized against what a window can PEAK at, not what it averages. The rate
+ * constants below are deliberately generous for that reason: they are a ceiling to stay clear of, not a
+ * prediction of typical density.
+ *
+ * So the bug was not the number being too small. It was ONE number serving two streams whose peak
+ * densities differ, where a value comfortable for one is a silent truncation for the other.
+ *
+ * ## The invariant
+ *
+ * A cap must exceed what a full window can legitimately hold, or a complete read is indistinguishable
+ * from a truncated one. `cap exceeds a full window` pins exactly that, per stream, so a future change to
+ * the window span or a stream's rate fails a test rather than quietly clipping a night.
+ *
+ * Note the cap is a ceiling, not an allocation: a read still returns only the rows that exist. Raising
+ * it costs nothing on a normal night and buys correctness on a dense one. Swift twin: `StreamReadCap`.
+ */
+object StreamReadCap {
+
+    /**
+     * How far BEFORE the day boundary the pass reads. EVERY lookback in the engine takes this value -
+     * the per-day `from`, the window start, the skin-anchor scan - so the window and the caps derived
+     * from it cannot drift apart - widening the lookback there without
+     * resizing the caps here is precisely how a stream starts truncating again, and is the "one number in
+     * two places" shape this whole type exists because of.
+     */
+    const val LOOKBACK_SECONDS = 30 * 3_600
+
+    /** How far AFTER it, capped at `now` for a day still in progress. A whole day. */
+    const val FORWARD_SECONDS = 24 * 3_600
+
+    /** The per-day read window: `dayStart - 30h` through the night, i.e. 54 hours. */
+    const val WINDOW_SECONDS = LOOKBACK_SECONDS + FORWARD_SECONDS
+
+    /** HR: one sample per second. */
+    const val HR_ROWS_PER_SECOND = 1.0
+
+    /**
+     * R-R at its PEAK. The measured average is below 1/s (it arrives in bursts, with gaps), but bursts
+     * are what reach a cap - and #1008's cross-second overcount can double the rows a burst produces.
+     * 2/s is a ceiling chosen to stay clear of, not a claim about typical density.
+     */
+    const val RR_ROWS_PER_SECOND = 2.0
+
+    /**
+     * Gravity: one sample per second, like HR, and read over the SAME 54-hour window - the code's claim
+     * that "the other eight streams are thousands of rows" does not hold for this one. A field capture
+     * measured 192,698 gravity rows, 96% of the old shared cap.
+     *
+     * It is the most dangerous of the three, because it is a PLAIN read rather than a
+     * [SlidingStreamWindow]: nothing counts a truncation here, so a clip would be silent even by the
+     * standard that caught R-R. Sleep STAGING is what consumes it, so the cost of a clipped read is a
+     * mis-staged night rather than a slow one.
+     */
+    const val GRAVITY_ROWS_PER_SECOND = 1.0
+
+    /**
+     * Headroom over a full window, so a legitimate read cannot land ON the cap and be mistaken for a
+     * truncated one.
+     */
+    const val HEADROOM = 1.5
+
+    /** The cap for a stream producing [rowsPerSecond] at its densest. */
+    fun cap(rowsPerSecond: Double): Int = ceil(WINDOW_SECONDS * rowsPerSecond * HEADROOM).toInt()
+
+    /**
+     * 291,600 - a full HR window plus half again.
+     *
+     * STORED, not a getter. A window's read cap and its truncation threshold must be the same number,
+     * and the engine names this in both slots - a stored value makes those two references provably one
+     * value rather than two evaluations that merely ought to agree.
+     */
+    val HR: Int = cap(HR_ROWS_PER_SECOND)
+
+    /** 583,200 - a full R-R window at its densest, plus half again. Stored for the reason [HR] gives. */
+    val RR: Int = cap(RR_ROWS_PER_SECOND)
+
+    /**
+     * 291,600 - the same shape as [HR], for the same 54-hour window. Only the 54-hour read needs it; the
+     * day-scoped gravity reads span 24 hours and cannot approach any of these.
+     */
+    val GRAVITY: Int = cap(GRAVITY_ROWS_PER_SECOND)
+}
diff --git a/android/app/src/test/java/com/noop/analytics/StreamReadCapTest.kt b/android/app/src/test/java/com/noop/analytics/StreamReadCapTest.kt
new file mode 100644
index 0000000000..9acbb635a3
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/StreamReadCapTest.kt
@@ -0,0 +1,85 @@
+package com.noop.analytics
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/** Per-stream read caps (#1538) — twin of the Swift `StreamReadCapTests`, same cases and same numbers. */
+class StreamReadCapTest {
+
+    /**
+     * THE invariant. A cap must exceed what a full window can legitimately hold, or a complete read is
+     * indistinguishable from a truncated one — and the truncated one silently loses its newest rows. If
+     * the window span or a stream's rate ever changes, this fails instead of a night being clipped.
+     */
+    @Test fun `cap exceeds a full window for every stream`() {
+        val fullHr = StreamReadCap.WINDOW_SECONDS * StreamReadCap.HR_ROWS_PER_SECOND
+        val fullRr = StreamReadCap.WINDOW_SECONDS * StreamReadCap.RR_ROWS_PER_SECOND
+        assertTrue(StreamReadCap.HR > fullHr)
+        assertTrue(StreamReadCap.RR > fullRr)
+    }
+
+    /**
+     * The test above is derived from the same constants as the caps, so on its own it only asserts that
+     * headroom exceeds 1. This one is anchored OUTSIDE the type, to a number the field produced: R-R came
+     * back at 200,000 ten times in one capture, so that value is known-insufficient rather than
+     * theorised. A cap at or below it would reintroduce the bug no matter how the arithmetic reads.
+     */
+    @Test fun `caps clear the value that truncated in the field`() {
+        val knownInsufficient = 200_000
+        assertTrue(StreamReadCap.RR > knownInsufficient)
+        assertTrue("HR sat 3% under this and was lucky, not safe", StreamReadCap.HR > knownInsufficient)
+    }
+
+    /**
+     * The window is not restated here — the engine reads `dayStart - LOOKBACK_SECONDS`, so these are the
+     * same number by construction. Pinned so that splitting them again is a visible change.
+     */
+    @Test fun `window is its two halves`() {
+        assertEquals(StreamReadCap.LOOKBACK_SECONDS + StreamReadCap.FORWARD_SECONDS, StreamReadCap.WINDOW_SECONDS)
+        assertEquals(30 * 3_600, StreamReadCap.LOOKBACK_SECONDS)
+        assertEquals(86_400, StreamReadCap.FORWARD_SECONDS)
+    }
+
+    /**
+     * The regression itself, in the numbers that caused it. The old shared cap of 200,000 was ABOVE a
+     * full HR window and BELOW a full R-R one — which is exactly why HR never truncated, R-R always did,
+     * and one number looked adequate from the HR side.
+     */
+    @Test fun `the old shared cap was below a full R-R window`() {
+        val oldSharedCap = 200_000.0
+        val fullHr = StreamReadCap.WINDOW_SECONDS * StreamReadCap.HR_ROWS_PER_SECOND
+        val fullRr = StreamReadCap.WINDOW_SECONDS * StreamReadCap.RR_ROWS_PER_SECOND
+        assertTrue("the old cap fitted HR, which is why it looked fine", oldSharedCap > fullHr)
+        assertTrue("and did not fit R-R, which is why nights were clipped", oldSharedCap < fullRr)
+        assertTrue("the new cap does fit it", StreamReadCap.RR > fullRr)
+    }
+
+    /** R-R must be capped higher than HR: it is one row per BEAT, not one per second. */
+    @Test fun `R-R is capped higher than HR`() {
+        assertTrue(StreamReadCap.RR > StreamReadCap.HR)
+    }
+
+    /**
+     * The window is 54 hours — `dayStart - 30h` running through the night. Pinned because both caps are
+     * derived from it, so a silent change here would resize them both.
+     */
+    @Test fun `window is fifty-four hours`() {
+        assertEquals(54 * 3_600, StreamReadCap.WINDOW_SECONDS)
+        assertEquals(291_600, StreamReadCap.HR)
+        assertEquals(583_200, StreamReadCap.RR)
+        assertEquals(291_600, StreamReadCap.GRAVITY)
+    }
+
+    /**
+     * Gravity is the third stream on the 54-hour window, and the field capture put it at 192,698 rows -
+     * 96% of the old shared cap. Unlike HR and R-R it is a PLAIN read with no truncation counter, so a
+     * clip there reports nothing at all; sleep staging simply gets a night missing its tail.
+     */
+    @Test fun `gravity clears what the field measured`() {
+        val measuredInField = 192_698
+        assertTrue(StreamReadCap.GRAVITY > measuredInField)
+        assertTrue("the old shared cap it sat 96% of", StreamReadCap.GRAVITY > 200_000)
+    }
+
+}

From 64ddc81696b4a0fc2796f10d209a54830b7542ef Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 00:39:24 +1200
Subject: [PATCH 255/333] build: testing build 440 / 321

Build numbers only; 11.1.1 is the next unreleased version and stays put.
versionCode clears 439 from earlier today so the side-install replaces it.

Carries the stream read-cap work. The direct check is in the log line that
found it: a capture from this build should read rr[... truncated=0] where
yesterday's read truncated=10, and gravity should no longer sit at 96% of its
cap on a dense night.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index bc7a3aacde..7aef7383a3 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 439
+        versionCode = 440
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 355ff1e821..c48cd25f3c 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "320"
+    CURRENT_PROJECT_VERSION: "321"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 2a06c24ed088c7f8b103fb3dfcb0f7258a84ee16 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 11:00:47 +1200
Subject: [PATCH 256/333] today: let the Recovery Vitals rows open their
 trends, like the cards do

From a screenshot: HRV 31 ms, Resting HR 62 bpm and Breaths 13.3 rpm sitting in
the RECOVERY VITALS card, none of them tappable, while every neighbouring card in
the same scroll carried a chevron and opened something.

The three vitals already had trends. The HRV / Resting HR / Respiratory dashboard
cards open them, and those cards are default-on - so the app teaches you these
metrics open, then shows a summary copy that does not. Each row now opens the
same trend its card twin does: its own chart, its own per-day readings table, its
own range picker.

Both platforms, because both carried it from the same defaultSelection, and on
Apple that meant BOTH live Today views - LiquidTodayView and TodayView are chosen
by liquidTodayEnabled and neither is legacy.

Nothing had been removed: these rows never navigated. What made the expectation
right anyway is that the same three metrics are tappable twenty pixels away.

Each row builder takes an OPTIONAL route and renders exactly what shipped when it
is nil, so a row that cannot navigate gains neither a link nor a chevron - the
inverse of the rule already stated for cards, that every one resolves to a
destination so the chevron stays honest. On Android the key is passed straight
from dashboardCardMetricKey rather than written out again, so a row and its card
cannot drift onto different trends for the same vital; a null key degrades to a
plain row instead of crashing, which an earlier draft would have done.

Routes are each platform's own catalog keys - hrv/rhr/resp on Android,
hrv/rhr/resp_rate on Apple. Respiratory differing is correct: mirroring Android's
would push to a destination Apple does not have.

Not seen on a device. The tap targets, the chevrons and how the press style reads
on a row inside a frosted card are all things only a build shows; the Android
target is about 26dp against a 48dp guideline, noted on the PR.
---
 Strand/Liquid/LiquidTodayView.swift           | 34 +++++++++++--
 Strand/Screens/TodayView.swift                | 33 +++++++++++--
 .../src/main/java/com/noop/ui/TodayScreen.kt  | 49 +++++++++++++++++--
 .../test/java/com/noop/ui/VitalRowKeyTest.kt  | 39 +++++++++++++++
 4 files changed, 143 insertions(+), 12 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ui/VitalRowKeyTest.kt

diff --git a/Strand/Liquid/LiquidTodayView.swift b/Strand/Liquid/LiquidTodayView.swift
index fc74d31d7b..3769cb0a4a 100644
--- a/Strand/Liquid/LiquidTodayView.swift
+++ b/Strand/Liquid/LiquidTodayView.swift
@@ -1147,22 +1147,48 @@ struct LiquidTodayView: View {
                         Text(line).font(StrandFont.caption).foregroundStyle(StrandPalette.textTertiary)
                     }
                 }
+                // #706/#684: the same trends the HRV / Resting HR / Respiratory dashboard cards push. These
+                // rows show the SAME three vitals and had no way through, so this card was the one place on
+                // Today where a metric was a dead end. Routes taken from `liquidCard`'s own cases so the two
+                // surfaces cannot send the same vital to different trends.
                 vitalRow(String(localized: "Heart-rate variability"), unitText(hrv, "ms"),
-                         StrandPalette.metricCyan, fracOver(hrv, 120))
+                         StrandPalette.metricCyan, fracOver(hrv, 120), route: .metric("hrv"))
                 vitalRow(String(localized: "Resting heart rate"), unitText(rhr, "bpm"),
-                         StrandPalette.metricRose, fracOver(rhr, 100))
+                         StrandPalette.metricRose, fracOver(rhr, 100), route: .metric("rhr"))
                 vitalRow(String(localized: "Breaths per minute"), unitText(resp, "rpm", decimals: 1),
-                         StrandPalette.accent, fracOver(resp, 24))
+                         StrandPalette.accent, fracOver(resp, 24), route: .metric("resp_rate"))
             }
         }
     }
 
-    private func vitalRow(_ label: String, _ value: String, _ tint: Color, _ frac: Double?) -> some View {
+    /// A recovery-vital row, optionally pushing its own metric trend.
+    ///
+    /// `route: nil` renders exactly what shipped before - no link, no chevron - so a row that goes nowhere
+    /// never claims otherwise. `LiquidPressStyle` is not decoration: a bare `NavigationLink` applies the
+    /// default link chrome and would tint the whole row, which is the same reason `cardLink` carries it.
+    private func vitalRow(_ label: String, _ value: String, _ tint: Color, _ frac: Double?,
+                          route: TabRoute? = nil) -> some View {
+        Group {
+            if let route {
+                NavigationLink(value: route) { vitalRowBody(label, value, tint, frac, linked: true) }
+                    .buttonStyle(LiquidPressStyle())
+            } else {
+                vitalRowBody(label, value, tint, frac, linked: false)
+            }
+        }
+    }
+
+    private func vitalRowBody(_ label: String, _ value: String, _ tint: Color, _ frac: Double?,
+                              linked: Bool) -> some View {
         HStack(spacing: 12) {
             LiquidVessel(value: frac, tint: tint, animated: false).frame(width: 26, height: 26)
             Text(label).font(StrandFont.subhead).foregroundStyle(StrandPalette.textSecondary)
             Spacer()
             Text(value).font(StrandFont.number(15)).foregroundStyle(StrandPalette.textPrimary)
+            if linked {
+                Image(systemName: "chevron.right").font(.system(size: 12, weight: .semibold))
+                    .foregroundStyle(StrandPalette.textTertiary)
+            }
         }
     }
 
diff --git a/Strand/Screens/TodayView.swift b/Strand/Screens/TodayView.swift
index abf8148c6f..6219198609 100644
--- a/Strand/Screens/TodayView.swift
+++ b/Strand/Screens/TodayView.swift
@@ -2903,11 +2903,11 @@ struct TodayView: View {
                 #endif
                 metricRow(icon: "waveform.path.ecg", label: "HRV",
                           value: demoHrv ?? (hrv.map { "\(Int($0.rounded()))" } ?? "—"), unit: "ms",
-                          tint: StrandPalette.metricCyan)
+                          tint: StrandPalette.metricCyan, route: .metric("hrv"))
                 Divider().overlay(StrandPalette.hairline)
                 metricRow(icon: "heart.fill", label: "Resting HR",
                           value: demoRhr ?? (rhr.map { "\($0)" } ?? "—"), unit: "bpm",
-                          tint: StrandPalette.metricRose)
+                          tint: StrandPalette.metricRose, route: .metric("rhr"))
                 Divider().overlay(StrandPalette.hairline)
                 metricRow(icon: "lungs.fill", label: "Respiratory",
                           // Today's own respiratory, else the carried night's; a non-carrying today keeps the
@@ -2915,7 +2915,7 @@ struct TodayView: View {
                           value: resp.map { String(format: "%.1f", locale: AppLanguage.activeLocale, $0) }
                               ?? (vd == nil ? latestString("resp_rate", decimals: 1) : "—"),
                           unit: "rpm",
-                          tint: StrandPalette.accent)
+                          tint: StrandPalette.accent, route: .metric("resp_rate"))
                 // ONE provenance footnote when a shown vital is a carried prior-day read (not today's),
                 // stamped with THAT row's date via the shared caption (which relabels a weeks-old carry to
                 // "Latest sleep", #779), so a prior read is never silently passed off as today.
@@ -2941,7 +2941,26 @@ struct TodayView: View {
     /// One README "metric row": a metric-hue line icon, a secondary label, and a right-aligned bold
     /// value with a small unit. Rows are divided by a hairline. Shared by the Today vitals card.
     @ViewBuilder
-    private func metricRow(icon: String, label: LocalizedStringKey, value: String, unit: String, tint: Color) -> some View {
+    /// A vitals row, optionally pushing its own metric trend (#706/#684).
+    ///
+    /// `route: nil` renders exactly what shipped before - no link, no chevron - so the three other callers
+    /// are untouched and a row that goes nowhere never claims otherwise. `LiquidPressStyle` is not
+    /// decoration: a bare `NavigationLink` applies the default link chrome and would tint the whole row,
+    /// which is why `cardLink` carries it too.
+    private func metricRow(icon: String, label: LocalizedStringKey, value: String, unit: String,
+                           tint: Color, route: TabRoute? = nil) -> some View {
+        Group {
+            if let route {
+                NavigationLink(value: route) { metricRowBody(icon, label, value, unit, tint, linked: true) }
+                    .buttonStyle(LiquidPressStyle())
+            } else {
+                metricRowBody(icon, label, value, unit, tint, linked: false)
+            }
+        }
+    }
+
+    private func metricRowBody(_ icon: String, _ label: LocalizedStringKey, _ value: String,
+                               _ unit: String, _ tint: Color, linked: Bool) -> some View {
         HStack(spacing: 12) {
             Image(systemName: icon)
                 .font(.system(size: 15, weight: .semibold))
@@ -2965,6 +2984,12 @@ struct TodayView: View {
                     .font(StrandFont.footnote)
                     .foregroundStyle(StrandPalette.textTertiary)
             }
+            // Only when the row goes somewhere: a row that cannot navigate must not imply it can.
+            if linked {
+                Image(systemName: "chevron.right").font(.system(size: 12, weight: .semibold))
+                    .foregroundStyle(StrandPalette.textTertiary)
+                    .accessibilityHidden(true)
+            }
         }
         .padding(.vertical, 13)
         .accessibilityElement(children: .combine)
diff --git a/android/app/src/main/java/com/noop/ui/TodayScreen.kt b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
index b2358e7ada..f136631dfa 100644
--- a/android/app/src/main/java/com/noop/ui/TodayScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
@@ -1639,7 +1639,8 @@ fun TodayScreen(
                         }
                         // The three hero vitals, HRV / Resting HR / Respiratory. Carried day (#543).
                         TodaySection.RECOVERY_VITALS -> Box(modifier = Modifier.fillMaxWidth().staggeredAppear(stagger)) {
-                            HeroMetricRows(day = displayMetric, carriedDay = lastScoredRecoveryDay, vitalsDay = lastVitalsDay)
+                            HeroMetricRows(day = displayMetric, carriedDay = lastScoredRecoveryDay,
+                                           vitalsDay = lastVitalsDay, onOpenMetric = onOpenMetric)
                         }
                         // YOUR CARDS, the user-customisable dashboard (WHOOP "My Dashboard"). Hydration is
                         // hidden when its tracking is OFF (the editor still offers it, so the choice
@@ -3139,7 +3140,16 @@ internal fun showsHrOnlyNote(
  *  for a vital neither today nor the carry supplies. */
 @Composable
 @Suppress("UNUSED_PARAMETER")
-private fun HeroMetricRows(day: DailyMetric?, carriedDay: DailyMetric? = null, vitalsDay: DailyMetric? = null) {
+private fun HeroMetricRows(
+    day: DailyMetric?,
+    carriedDay: DailyMetric? = null,
+    vitalsDay: DailyMetric? = null,
+    // #706/#684: the same `vital_detail/<key>` trends the HRV / Resting HR / Respiratory dashboard cards
+    // open. These three rows show the SAME metrics and had no way through, so the summary card was the one
+    // place on Today where a metric was a dead end. Keys come from `dashboardCardMetricKey`, so the two
+    // surfaces cannot drift onto different destinations for the same vital.
+    onOpenMetric: (String) -> Unit = {},
+) {
     // Per-field, today-first: today's own value wins; the vitals carry only fills a field today lacks.
     val hrv = day?.avgHrv ?: vitalsDay?.avgHrv
     val rhr = day?.restingHr ?: vitalsDay?.restingHr
@@ -3177,18 +3187,24 @@ private fun HeroMetricRows(day: DailyMetric?, carriedDay: DailyMetric? = null, v
                 value = hrv?.let { "${it.roundToInt()} ms" } ?: NO_DATA,
                 tint = Palette.metricCyan,
                 fraction = hrv?.let { (it / 120.0).coerceIn(0.0, 1.0) },
+                metricKey = dashboardCardMetricKey(DashboardCard.HRV),
+                onOpenMetric = onOpenMetric,
             )
             HeroVitalRow(
                 label = uiString(R.string.l10n_today_screen_resting_heart_rate_348928d6),
                 value = rhr?.let { "$it bpm" } ?: NO_DATA,
                 tint = Palette.metricRose,
                 fraction = rhr?.let { (it / 100.0).coerceIn(0.0, 1.0) },
+                metricKey = dashboardCardMetricKey(DashboardCard.RESTING_HR),
+                onOpenMetric = onOpenMetric,
             )
             HeroVitalRow(
                 label = uiString(R.string.l10n_today_screen_breaths_per_minute_2b197c54),
                 value = resp?.let { String.format(Locale.getDefault(), "%.1f rpm", it) } ?: NO_DATA,
                 tint = Palette.accent,
                 fraction = resp?.let { (it / 24.0).coerceIn(0.0, 1.0) },
+                metricKey = dashboardCardMetricKey(DashboardCard.RESPIRATORY),
+                onOpenMetric = onOpenMetric,
             )
             if (hrOnlyNight) {
                 Text(
@@ -3211,12 +3227,26 @@ private fun heroVitalsLastNightLine(): String {
 /** One iOS `vitalRow`: a 26dp mini liquid VESSEL filled to [fraction] in [tint], the label (subhead,
  *  secondary), a spacer, and the value (number 15, primary). Replaces the old flat-Material-icon row. */
 @Composable
-private fun HeroVitalRow(label: String, value: String, tint: Color, fraction: Double?) {
+private fun HeroVitalRow(
+    label: String,
+    value: String,
+    tint: Color,
+    fraction: Double?,
+    // The metric-detail key this row opens, from `dashboardCardMetricKey` so the row and its dashboard-card
+    // twin cannot drift onto different trends for the same vital. NULL means the row simply does not
+    // navigate: it loses the tap AND the chevron together, which is the honest degradation. An earlier
+    // draft asserted the key was present, which would have turned a missing destination into a crash on
+    // tap - a worse outcome than a row that quietly does not move.
+    metricKey: String? = null,
+    onOpenMetric: (String) -> Unit = {},
+) {
+    val onClick: (() -> Unit)? = metricKey?.let { key -> { onOpenMetric(key) } }
     val hasValue = value != NO_DATA
     val displayValue = localizedMetricValue(value)
     Row(
         modifier = Modifier
             .fillMaxWidth()
+            .then(if (onClick != null) Modifier.clickable { onClick() } else Modifier)
             .semantics { contentDescription = uiString(R.string.l10n_today_screen_label_value_b781d590, label, displayValue) },
         verticalAlignment = Alignment.CenterVertically,
         horizontalArrangement = Arrangement.spacedBy(Metrics.space12),
@@ -3233,6 +3263,17 @@ private fun HeroVitalRow(label: String, value: String, tint: Color, fraction: Do
             style = NoopType.number(15f),
             color = if (hasValue) Palette.textPrimary else Palette.textTertiary,
         )
+        // Only when the row actually goes somewhere. `dashboardCardDestination` states the rule this
+        // follows - every card resolves to a destination, so the chevron is always honest (#706/#684) -
+        // and the inverse is what was wrong here: three rows that go somewhere and did not say so.
+        if (onClick != null) {
+            Icon(
+                Icons.AutoMirrored.Filled.KeyboardArrowRight,
+                contentDescription = null,
+                tint = Palette.textTertiary,
+                modifier = Modifier.size(Metrics.iconSmall),
+            )
+        }
     }
 }
 
@@ -3505,7 +3546,7 @@ private fun sleepSourceSubtitle(card: DashboardCard, day: DailyMetric?): String?
  *  screen (Stress / Sleep / Hydration / Coupled) rather than a metric-detail trend. Mirrors the iOS
  *  `liquidCard` switch, where every metric/vital card opens `metricDetail(key)` (its own focused trend),
  *  NOT the shared Health hub (2026-07-03). Keys are the Android VitalDetailScreen keys. */
-private fun dashboardCardMetricKey(card: DashboardCard): String? = when (card) {
+internal fun dashboardCardMetricKey(card: DashboardCard): String? = when (card) {
     DashboardCard.HRV -> "hrv"
     DashboardCard.RESTING_HR -> "rhr"
     DashboardCard.RESPIRATORY -> "resp"
diff --git a/android/app/src/test/java/com/noop/ui/VitalRowKeyTest.kt b/android/app/src/test/java/com/noop/ui/VitalRowKeyTest.kt
new file mode 100644
index 0000000000..670cba76dd
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/VitalRowKeyTest.kt
@@ -0,0 +1,39 @@
+package com.noop.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/**
+ * The RECOVERY VITALS rows and the dashboard cards show the same three vitals, so they must open the same
+ * trends (#706/#684). The rows pass `dashboardCardMetricKey(...)` straight through rather than repeating
+ * the strings, so drift is impossible by construction; these pin the values that route actually produces.
+ */
+class VitalRowKeyTest {
+
+    /** The keys the `vital_detail/{key}` route is given. Pinned so a rename surfaces here, not on a blank screen. */
+    @Test fun `the vital rows use the vital_detail keys`() {
+        assertEquals("hrv", dashboardCardMetricKey(DashboardCard.HRV))
+        assertEquals("rhr", dashboardCardMetricKey(DashboardCard.RESTING_HR))
+        assertEquals("resp", dashboardCardMetricKey(DashboardCard.RESPIRATORY))
+    }
+
+    /** All three resolve, so all three rows are tappable and carry a chevron. */
+    @Test fun `every vital row resolves to a destination`() {
+        assertNotNull(dashboardCardMetricKey(DashboardCard.HRV))
+        assertNotNull(dashboardCardMetricKey(DashboardCard.RESTING_HR))
+        assertNotNull(dashboardCardMetricKey(DashboardCard.RESPIRATORY))
+    }
+
+    /**
+     * The degradation path is real, not hypothetical: cards with their own screen return null. A row
+     * pointed at one of those must lose its tap and its chevron rather than crash, which is why the row
+     * takes a nullable key instead of asserting one.
+     */
+    @Test fun `a card with its own screen yields no metric key`() {
+        assertNull(dashboardCardMetricKey(DashboardCard.SLEEP))
+        assertNull(dashboardCardMetricKey(DashboardCard.STRESS))
+        assertNull(dashboardCardMetricKey(DashboardCard.COACH))
+    }
+}

From 3c3f15d0c4a6835b1d21aa5059ffdf82e02035b9 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 11:01:03 +1200
Subject: [PATCH 257/333] build: testing build 441 / 322

Build numbers only; 11.1.1 stays as the next unreleased version. versionCode
clears 440 so the side-install replaces it.

Carries the tappable Recovery Vitals rows on both platforms. The check is
tapping each of the three and confirming it opens THAT vital's own trend with
its per-day table - plus two things only a screen settles: whether the ~26dp
touch target is comfortable, and how the press style reads on a row inside a
frosted card.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 7aef7383a3..ab65a6e9a0 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 440
+        versionCode = 441
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index c48cd25f3c..a4797c62bc 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "321"
+    CURRENT_PROJECT_VERSION: "322"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 168cfc150f064c5d099dd865b2d309f369d3d220 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 11:58:05 +1200
Subject: [PATCH 258/333] settings: give the bottom bar its own card, with a
 size and a transparency

Two new bottom-bar options, in their own card with the two that already existed.

The overlay and auto-hide toggles were living among the theme controls in
Appearance - fine when there was nowhere else, less so once size and transparency
join them. Four settings about one piece of app-shell chrome now sit together,
and the auto-hide row reads better for it: the toggle it depends on is directly
above it rather than elsewhere in another card.

TRANSPARENCY is eight steps, not a free slider. On a bar this small a continuous
control mostly produces values nobody can tell apart or return to. The mapping is
linear from 0.30 to 1.00, which puts the SHIPPED 0.80 exactly on step 6 - so an
install that never opens this renders byte-identically to before, which a test
asserts. The floor is 0.30 rather than 0 on purpose: a fully invisible bar still
takes taps, so a user could hide their own navigation and then be unable to find
the setting that hid it.

SIZE is a dropdown of 1x / 1.25x / 1.5x / 1.75x / 2x. It scales the bar's CONTENT
- icon, label and the padding around them - rather than applying a graphics scale
to the finished bar, which would blur it and leave the touch targets at their old
size. `barHeight` is measured after layout and republished, so every screen keeps
clearing the bar correctly at any size with no second number to maintain.

Both apply in BOTH bar layouts: the slot and the overlay draw the same composable,
so neither setting silently does nothing depending on a toggle two rows above it.

Both read through the same clamps their setters use, so a hand-edited or
downgraded preference cannot leave the bar in a state the UI has no way to leave;
an unoffered size snaps to the nearest offered one rather than being honoured.

The transparency persists once on release rather than once per frame - a drag
emits a value per frame, and the control this was modelled on already splits live
preview from the write.

Copy is translated into all seven locales rather than left English. The gate
enforces three; shipping four English strings into the rest is how the drift it
exists to shrink gets added to.

Verified: 5324 tests / 0 failures with 8 new; doc-comment lint clean; i18n audit
green; lintVitalFullRelease -PstagingRelease clean after the strings.xml edits.

NOT seen on a device. The whole point of these two is how they look, and nothing
here has rendered - 2x in particular wants checking on a small screen.
---
 .../app/src/main/java/com/noop/ui/AppRoot.kt  |  82 ++++++++++--
 .../main/java/com/noop/ui/BottomBarStyle.kt   |  47 +++++++
 .../src/main/java/com/noop/ui/MainActivity.kt |   6 +
 .../main/java/com/noop/ui/SettingsScreen.kt   | 119 ++++++++++++++----
 .../app/src/main/res/values-de/strings.xml    |   5 +
 .../app/src/main/res/values-es/strings.xml    |   5 +
 .../app/src/main/res/values-fr/strings.xml    |   5 +
 .../app/src/main/res/values-pl/strings.xml    |   5 +
 .../src/main/res/values-pt-rPT/strings.xml    |   5 +
 .../app/src/main/res/values-ru/strings.xml    |   5 +
 .../app/src/main/res/values-zh/strings.xml    |   5 +
 android/app/src/main/res/values/strings.xml   |   5 +
 .../java/com/noop/ui/BottomBarStyleTest.kt    |  72 +++++++++++
 13 files changed, 331 insertions(+), 35 deletions(-)
 create mode 100644 android/app/src/main/java/com/noop/ui/BottomBarStyle.kt
 create mode 100644 android/app/src/test/java/com/noop/ui/BottomBarStyleTest.kt

diff --git a/android/app/src/main/java/com/noop/ui/AppRoot.kt b/android/app/src/main/java/com/noop/ui/AppRoot.kt
index 042b04e765..21442fd184 100644
--- a/android/app/src/main/java/com/noop/ui/AppRoot.kt
+++ b/android/app/src/main/java/com/noop/ui/AppRoot.kt
@@ -351,6 +351,57 @@ object BottomBarStyleStore {
      */
     fun barHeightForContent(): Dp = if (overlay) barHeight else 0.dp
 
+    /**
+     * How see-through the bar's glass is, in EIGHT steps: 1 the most transparent, 8 solid.
+     *
+     * A step rather than a raw float so the two ends are reachable and every stop is repeatable - a
+     * continuous slider on a bar this small mostly produces values a user cannot tell apart or return to.
+     * The mapping is linear from 0.30 to 1.00, which puts the SHIPPED 0.80 exactly on step 6, so an
+     * install that never touches this is byte-identical to before.
+     */
+    var opacityStep by mutableStateOf(DEFAULT_OPACITY_STEP)
+        private set
+
+    /** The alpha for [opacityStep]. Step 1 = 0.30 ... step 6 = 0.80 (the shipped value) ... step 8 = 1.00. */
+    val barAlpha: Float get() = alphaForOpacityStep(opacityStep)
+
+    /**
+     * How much bigger the bar is drawn, from 1x to 2x.
+     *
+     * Scales the bar's CONTENT - icon, label and the padding around them - rather than applying a
+     * graphics scale to the finished bar, which would blur it and leave the touch targets where they
+     * were. The bar's height is measured and republished either way ([barHeight]), so screens keep
+     * clearing it correctly at any size without a second number to maintain.
+     */
+    var scale by mutableStateOf(DEFAULT_SCALE)
+        private set
+
+    /**
+     * Move the bar NOW without persisting, for a slider drag.
+     *
+     * Separate from [setOpacityStep] because a drag emits a value per frame: persisting each one would
+     * write SharedPreferences dozens of times to record a decision the user makes once, on release. The
+     * card-opacity slider already splits it this way; this is the same split, not a new idea.
+     */
+    fun previewOpacityStep(step: Int) {
+        opacityStep = step.coerceIn(MIN_OPACITY_STEP, MAX_OPACITY_STEP)
+    }
+
+    /** Set and persist - for a committed choice, i.e. the end of a drag. */
+    fun setOpacityStep(ctx: Context, step: Int) {
+        val clamped = step.coerceIn(MIN_OPACITY_STEP, MAX_OPACITY_STEP)
+        opacityStep = clamped
+        NoopPrefs.of(ctx.applicationContext).edit()
+            .putInt(NoopPrefs.KEY_BOTTOM_BAR_OPACITY_STEP, clamped).apply()
+    }
+
+    fun setScale(ctx: Context, value: Float) {
+        val clamped = nearestScale(value)
+        scale = clamped
+        NoopPrefs.of(ctx.applicationContext).edit()
+            .putFloat(NoopPrefs.KEY_BOTTOM_BAR_SCALE, clamped).apply()
+    }
+
     /** #1839: hide the overlay bar while scrolling down, bring it back on scrolling up. Default ON. */
     var autoHide by mutableStateOf(true)
         private set
@@ -362,10 +413,14 @@ object BottomBarStyleStore {
     }
 
     fun load(ctx: Context) {
-        overlay = NoopPrefs.of(ctx.applicationContext)
-            .getBoolean(NoopPrefs.KEY_OVERLAY_BOTTOM_BAR, true)
-        autoHide = NoopPrefs.of(ctx.applicationContext)
-            .getBoolean(NoopPrefs.KEY_BOTTOM_BAR_AUTO_HIDE, true)
+        val prefs = NoopPrefs.of(ctx.applicationContext)
+        overlay = prefs.getBoolean(NoopPrefs.KEY_OVERLAY_BOTTOM_BAR, true)
+        autoHide = prefs.getBoolean(NoopPrefs.KEY_BOTTOM_BAR_AUTO_HIDE, true)
+        // Both are read through the same clamps the setters use, so a hand-edited or downgraded pref
+        // cannot put the bar in a state the UI has no way to leave.
+        opacityStep = prefs.getInt(NoopPrefs.KEY_BOTTOM_BAR_OPACITY_STEP, DEFAULT_OPACITY_STEP)
+            .coerceIn(MIN_OPACITY_STEP, MAX_OPACITY_STEP)
+        scale = nearestScale(prefs.getFloat(NoopPrefs.KEY_BOTTOM_BAR_SCALE, DEFAULT_SCALE))
     }
 
     fun set(ctx: Context, value: Boolean) {
@@ -1001,7 +1056,9 @@ private fun GlassBottomBar(
             // "Glass": a translucent raised surface — a frosted island, not a hard slab. Compose has no
             // cheap blur, so translucency (≈0.80) + a hairline rim is the Liquid-Glass stand-in. A soft,
             // low drop shadow reads as floating without a glow.
-            color = Palette.surfaceRaised.copy(alpha = 0.80f),
+            // The glass alpha is the user's transparency step; 0.80 was the shipped constant and remains
+            // the default (step 6), so an untouched install is unchanged.
+            color = Palette.surfaceRaised.copy(alpha = BottomBarStyleStore.barAlpha),
             tonalElevation = 2.dp,
             shadowElevation = 4.dp,
             modifier = Modifier
@@ -1013,7 +1070,11 @@ private fun GlassBottomBar(
             Row(
                 modifier = Modifier
                     .fillMaxWidth()
-                    .padding(horizontal = 8.dp, vertical = 7.dp),
+                    // Scaling the PADDING and the slot contents grows the bar honestly - the touch
+                    // targets grow with it, and `barHeight` is measured afterwards so screens keep
+                    // clearing the bar at any size. A graphics scale would blur it and leave the hit
+                    // areas behind.
+                    .padding(horizontal = 8.dp, vertical = 7.dp * BottomBarStyleStore.scale),
                 verticalAlignment = Alignment.CenterVertically,
                 horizontalArrangement = Arrangement.spacedBy(2.dp),
             ) {
@@ -1070,16 +1131,19 @@ private fun BarSlot(
                 indication = null,
                 onClick = onClick,
             )
-            .padding(vertical = 3.dp)
+            .padding(vertical = 3.dp * BottomBarStyleStore.scale)
             .semantics { contentDescription = label },
         horizontalAlignment = Alignment.CenterHorizontally,
         verticalArrangement = Arrangement.spacedBy(3.dp),
     ) {
-        Icon(icon, contentDescription = null, tint = tint, modifier = Modifier.size(Metrics.iconSmall))
+        // Icon and label scale together with the padding above, so the slot grows as one piece rather
+        // than a bigger box around the same small glyph.
+        Icon(icon, contentDescription = null, tint = tint,
+             modifier = Modifier.size(Metrics.iconSmall * BottomBarStyleStore.scale))
         Text(
             label,
             style = NoopType.footnote.copy(
-                fontSize = 10.sp,
+                fontSize = 10.sp * BottomBarStyleStore.scale,
                 fontWeight = if (active) FontWeight.SemiBold else FontWeight.Medium,
             ),
             color = tint,
diff --git a/android/app/src/main/java/com/noop/ui/BottomBarStyle.kt b/android/app/src/main/java/com/noop/ui/BottomBarStyle.kt
new file mode 100644
index 0000000000..c7ad8dc6be
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ui/BottomBarStyle.kt
@@ -0,0 +1,47 @@
+package com.noop.ui
+
+import kotlin.math.abs
+
+/** The most transparent step. */
+const val MIN_OPACITY_STEP = 1
+
+/** Solid. */
+const val MAX_OPACITY_STEP = 8
+
+/**
+ * The step whose alpha is the SHIPPED 0.80, so an install that never opens this setting renders exactly
+ * as it did before. Chosen by arithmetic rather than taste: the linear 0.30..1.00 mapping puts 0.80 on
+ * step 6 precisely, which is why the range starts at 0.30 rather than a rounder number.
+ */
+const val DEFAULT_OPACITY_STEP = 6
+
+/** Unscaled - the shipped bar. */
+const val DEFAULT_SCALE = 1f
+
+/** The offered sizes. A short fixed list, not a slider: these are the sizes worth having. */
+val BOTTOM_BAR_SCALES: List<Float> = listOf(1f, 1.25f, 1.5f, 1.75f, 2f)
+
+/**
+ * The bar's glass alpha for an opacity step, linear from 0.30 (step 1) to 1.00 (step 8).
+ *
+ * The floor is 0.30 rather than 0: a fully invisible bar would still take taps, so a user could hide the
+ * navigation and then not find it again. 0.30 is faint enough to read as "nearly gone" while leaving the
+ * capsule's rim visible.
+ */
+fun alphaForOpacityStep(step: Int): Float {
+    val clamped = step.coerceIn(MIN_OPACITY_STEP, MAX_OPACITY_STEP)
+    return 0.30f + (clamped - MIN_OPACITY_STEP) * 0.10f
+}
+
+/**
+ * The nearest offered scale to [value].
+ *
+ * Snaps rather than clamps so a stored value from a build with a DIFFERENT set of sizes - or a
+ * hand-edited pref - lands on something offerable instead of a size the dropdown cannot show or leave.
+ */
+fun nearestScale(value: Float): Float =
+    BOTTOM_BAR_SCALES.minByOrNull { abs(it - value) } ?: DEFAULT_SCALE
+
+/** The dropdown's label for a scale, e.g. "1.25x". Not translated - it is a number and a multiplier. */
+fun scaleLabel(value: Float): String =
+    if (value == value.toInt().toFloat()) "${value.toInt()}x" else "${value}x"
diff --git a/android/app/src/main/java/com/noop/ui/MainActivity.kt b/android/app/src/main/java/com/noop/ui/MainActivity.kt
index 1a2471ed79..fa08f93818 100644
--- a/android/app/src/main/java/com/noop/ui/MainActivity.kt
+++ b/android/app/src/main/java/com/noop/ui/MainActivity.kt
@@ -718,6 +718,12 @@ object NoopPrefs {
      *  ON (#1841). Only meaningful with the overlay layout, where the bar sits over content. */
     const val KEY_BOTTOM_BAR_AUTO_HIDE = "noop.bottomBarAutoHide"
 
+    /** #1836 follow-up: the bar's glass alpha, as one of eight steps. See [com.noop.ui.alphaForOpacityStep]. */
+    const val KEY_BOTTOM_BAR_OPACITY_STEP = "noop.bottomBarOpacityStep"
+
+    /** #1836 follow-up: how much bigger the bar is drawn, one of [com.noop.ui.BOTTOM_BAR_SCALES]. */
+    const val KEY_BOTTOM_BAR_SCALE = "noop.bottomBarScale"
+
     /** #1836: draw the bottom bar as an overlay (glass over the screen's backdrop) instead of a reserved
      *  Scaffold slot. Default ON (#1841), after the overlay was confirmed on a device. */
     const val KEY_OVERLAY_BOTTOM_BAR = "noop.overlayBottomBar"
diff --git a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
index 73f4232715..6f1fd70db7 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
@@ -44,6 +44,7 @@ import androidx.compose.material.icons.filled.Bolt
 import androidx.compose.material.icons.filled.BatteryStd
 import androidx.compose.material.icons.filled.BugReport
 import androidx.compose.material.icons.filled.Brightness6
+import androidx.compose.material.icons.filled.ViewAgenda
 import androidx.compose.material.icons.filled.Campaign
 import androidx.compose.material.icons.filled.Cancel
 import androidx.compose.material.icons.filled.Download
@@ -1375,32 +1376,6 @@ fun SettingsScreen(
                 )
             }
             SettingsRowDivider()
-            // #1836: which bottom-bar layout to draw. Default OFF — the shipped reserved slot. The
-            // overlay lets a screen's own backdrop show through the bar's glass, which is what it was
-            // built for, but it is app-shell layout no test can judge, so it ships switchable.
-            SettingsFormRow(label = uiString(R.string.l10n_settings_screen_bottom_bar_overlay_f257c96f)) {
-                Switch(
-                    checked = BottomBarStyleStore.overlay,
-                    onCheckedChange = { BottomBarStyleStore.set(context, it) },
-                )
-            }
-            SettingsRowDivider()
-            // #1839: hide the bar while scrolling down, bring it back on scrolling up. Only does anything
-            // with the overlay on, because in the slot layout the space is reserved and hiding the bar
-            // would leave an empty band — so the row is disabled rather than silently inert.
-            // Reduce Motion pins the bar visible (a bar that vanishes without animation reads as a
-            // glitch), so with it on the toggle would flip and change nothing. A switch that silently
-            // does nothing is worse than one that is plainly unavailable, so it greys out for the same
-            // reason it does without the overlay.
-            val autoHideAvailable = BottomBarStyleStore.overlay && !rememberReduceMotion()
-            SettingsFormRow(label = uiString(R.string.l10n_settings_screen_hide_bar_when_scrolling_b077d9f3)) {
-                Switch(
-                    checked = BottomBarStyleStore.autoHide,
-                    enabled = autoHideAvailable,
-                    onCheckedChange = { BottomBarStyleStore.setAutoHide(context, it) },
-                )
-            }
-            SettingsRowDivider()
             // #1821: Clock format. Sits with Language because it is an app-owned display CONVENTION, and
             // like Language it offers "System default" - which here means the device's own 12/24h switch,
             // not the region default that was silently deciding this for everyone. Twin of the Apple row.
@@ -1732,6 +1707,98 @@ fun SettingsScreen(
             }
         }
 
+        // The bar's own card. These four options are all about one piece of app-shell chrome, and living
+        // among the theme controls in Appearance meant two of them sat between unrelated rows while the
+        // other two had nowhere to go. Grouped, the size and transparency read as what they are: choices
+        // about the same bar the toggles above them move and hide.
+        SettingsCard(
+            icon = Icons.Filled.ViewAgenda,
+            title = uiString(R.string.l10n_settings_screen_bottom_bar_f84098a9),
+            blurb = uiString(R.string.l10n_settings_screen_how_the_navigation_bar_looks_f186b099),
+        ) {
+            // #1836: which bottom-bar layout to draw. Default OFF — the shipped reserved slot. The
+            // overlay lets a screen's own backdrop show through the bar's glass, which is what it was
+            // built for, but it is app-shell layout no test can judge, so it ships switchable.
+            SettingsFormRow(label = uiString(R.string.l10n_settings_screen_bottom_bar_overlay_f257c96f)) {
+                Switch(
+                    checked = BottomBarStyleStore.overlay,
+                    onCheckedChange = { BottomBarStyleStore.set(context, it) },
+                )
+            }
+            SettingsRowDivider()
+            // #1839: hide the bar while scrolling down, bring it back on scrolling up. Only does anything
+            // with the overlay on, because in the slot layout the space is reserved and hiding the bar
+            // would leave an empty band — so the row is disabled rather than silently inert.
+            // Reduce Motion pins the bar visible (a bar that vanishes without animation reads as a
+            // glitch), so with it on the toggle would flip and change nothing. A switch that silently
+            // does nothing is worse than one that is plainly unavailable, so it greys out for the same
+            // reason it does without the overlay.
+            val autoHideAvailable = BottomBarStyleStore.overlay && !rememberReduceMotion()
+            SettingsFormRow(label = uiString(R.string.l10n_settings_screen_hide_bar_when_scrolling_b077d9f3)) {
+                Switch(
+                    checked = BottomBarStyleStore.autoHide,
+                    enabled = autoHideAvailable,
+                    onCheckedChange = { BottomBarStyleStore.setAutoHide(context, it) },
+                )
+            }
+            SettingsRowDivider()
+            // Size. A dropdown of fixed multipliers rather than a slider: these are the sizes worth
+            // having, and a continuous control here mostly produces sizes a user cannot tell apart.
+            var sizeMenuOpen by remember { mutableStateOf(false) }
+            SettingsFormRow(label = uiString(R.string.l10n_settings_screen_bar_size_2304bfbb)) {
+                Box {
+                    Row(
+                        modifier = Modifier
+                            .clip(RoundedCornerShape(999.dp))
+                            .clickable { sizeMenuOpen = true }
+                            .background(Palette.surfaceInset)
+                            .padding(horizontal = 14.dp, vertical = 8.dp),
+                        verticalAlignment = Alignment.CenterVertically,
+                        horizontalArrangement = Arrangement.spacedBy(4.dp),
+                    ) {
+                        Text(scaleLabel(BottomBarStyleStore.scale), style = NoopType.subhead,
+                             color = Palette.textPrimary)
+                        Icon(Icons.Filled.ArrowDropDown, contentDescription = null,
+                             tint = Palette.textSecondary)
+                    }
+                    DropdownMenu(expanded = sizeMenuOpen, onDismissRequest = { sizeMenuOpen = false }) {
+                        BOTTOM_BAR_SCALES.forEach { option ->
+                            DropdownMenuItem(
+                                text = { Text(scaleLabel(option), color = Palette.textPrimary) },
+                                onClick = {
+                                    sizeMenuOpen = false
+                                    BottomBarStyleStore.setScale(context, option)
+                                },
+                            )
+                        }
+                    }
+                }
+            }
+            SettingsRowDivider()
+            // Transparency, in the eight steps the store defines. The slider writes on every change so the
+            // bar updates live underneath the sheet - the whole point is seeing it against your own screen.
+            Column(verticalArrangement = Arrangement.spacedBy(4.dp)) {
+                Text(uiString(R.string.l10n_settings_screen_bar_transparency_3f648fbb), style = NoopType.subhead, color = Palette.textPrimary)
+                Text(uiString(R.string.l10n_settings_screen_how_see_through_the_bar_is_ddb0c208), style = NoopType.footnote, color = Palette.textTertiary)
+                Slider(
+                    value = BottomBarStyleStore.opacityStep.toFloat(),
+                    // Live while dragging, persisted once on release: a drag emits a value per frame, and
+                    // writing each one records a decision the user makes once. Rounded, not truncated -
+                    // the snapped value can arrive as 5.9999998, which truncation would read as step 5.
+                    onValueChange = { BottomBarStyleStore.previewOpacityStep(it.roundToInt()) },
+                    onValueChangeFinished = {
+                        BottomBarStyleStore.setOpacityStep(context, BottomBarStyleStore.opacityStep)
+                    },
+                    valueRange = MIN_OPACITY_STEP.toFloat()..MAX_OPACITY_STEP.toFloat(),
+                    // Compose counts the stops BETWEEN the ends, so eight stops is six.
+                    steps = MAX_OPACITY_STEP - MIN_OPACITY_STEP - 1,
+                    colors = SliderDefaults.colors(
+                        thumbColor = Palette.accent,
+                        activeTrackColor = Palette.accent,
+                    ),
+                )
+            }
+        }
         // --- Background image (#custom-background) ---
         // An optional custom photo drawn full-bleed behind EVERY tab (including More), in place of the
         // day-cycle sky (precedence: image > sky > flat canvas). Pick from Photos or Browse the files; the
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index cbf02f2b02..e8c7ff7cd1 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2691,4 +2691,9 @@
     <string name="settings_day_cycle_midnight">00:00</string>
     <string name="settings_day_cycle_sleep_description">Standard. Der Zyklus folgt dem Beginn deines erkannten Hauptschlafs. Bei fehlenden oder unzuverlässigen Schlafdaten verwendet NOOP ersatzweise die lokale Mitternacht.</string>
     <string name="settings_day_cycle_midnight_description">Verwendet einen herkömmlichen lokalen Kalendertag von 00:00 bis 00:00 Uhr.</string>
+    <string name="l10n_settings_screen_bottom_bar_f84098a9">Untere Leiste</string>
+    <string name="l10n_settings_screen_how_the_navigation_bar_looks_f186b099">Wie die Navigationsleiste aussieht – ihre Größe und wie viel vom Bildschirm durchscheint.</string>
+    <string name="l10n_settings_screen_bar_size_2304bfbb">Leistengröße</string>
+    <string name="l10n_settings_screen_bar_transparency_3f648fbb">Transparenz der Leiste</string>
+    <string name="l10n_settings_screen_how_see_through_the_bar_is_ddb0c208">Wie durchsichtig die Leiste ist. Die schwächste Stufe zeigt weiterhin ihren Rand, damit sie immer auffindbar bleibt.</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 3dc7a7730f..27677ed36c 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2678,4 +2678,9 @@
     <string name="settings_day_cycle_midnight">00:00</string>
     <string name="settings_day_cycle_sleep_description">Predeterminado. El ciclo sigue el inicio del sueño principal detectado. Si faltan datos de sueño o no son fiables, se usa la medianoche local.</string>
     <string name="settings_day_cycle_midnight_description">Usa un día natural local convencional de 00:00 a 00:00.</string>
+    <string name="l10n_settings_screen_bottom_bar_f84098a9">Barra inferior</string>
+    <string name="l10n_settings_screen_how_the_navigation_bar_looks_f186b099">El aspecto de la barra de navegación: su tamaño y cuánto se ve de la pantalla a través de ella.</string>
+    <string name="l10n_settings_screen_bar_size_2304bfbb">Tamaño de la barra</string>
+    <string name="l10n_settings_screen_bar_transparency_3f648fbb">Transparencia de la barra</string>
+    <string name="l10n_settings_screen_how_see_through_the_bar_is_ddb0c208">Cuánto se transparenta la barra. El nivel más tenue sigue mostrando su borde, así que siempre se puede encontrar.</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 99388e3e21..6983a7af9f 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2677,4 +2677,9 @@
     <string name="settings_day_cycle_midnight">00:00</string>
     <string name="settings_day_cycle_sleep_description">Par défaut. Le cycle suit le début du sommeil principal détecté. Si les données de sommeil sont absentes ou peu fiables, l’heure locale de minuit est utilisée.</string>
     <string name="settings_day_cycle_midnight_description">Utilise une journée civile locale classique de 00:00 à 00:00.</string>
+    <string name="l10n_settings_screen_bottom_bar_f84098a9">Barre inférieure</string>
+    <string name="l10n_settings_screen_how_the_navigation_bar_looks_f186b099">L’apparence de la barre de navigation : sa taille et la part de l’écran visible au travers.</string>
+    <string name="l10n_settings_screen_bar_size_2304bfbb">Taille de la barre</string>
+    <string name="l10n_settings_screen_bar_transparency_3f648fbb">Transparence de la barre</string>
+    <string name="l10n_settings_screen_how_see_through_the_bar_is_ddb0c208">À quel point la barre est transparente. Le niveau le plus faible affiche encore son contour, elle reste donc toujours repérable.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 9b672ed08c..3d0af0c810 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2682,4 +2682,9 @@
     <string name="settings_day_cycle_midnight">00:00</string>
     <string name="settings_day_cycle_sleep_description">Domyślnie. Cykl rozpoczyna się wraz z wykrytym głównym snem. Gdy brakuje wiarygodnych danych o śnie, używana jest lokalna północ.</string>
     <string name="settings_day_cycle_midnight_description">Używa zwykłego lokalnego dnia kalendarzowego od 00:00 do 00:00.</string>
+    <string name="l10n_settings_screen_bottom_bar_f84098a9">Dolny pasek</string>
+    <string name="l10n_settings_screen_how_the_navigation_bar_looks_f186b099">Wygląd paska nawigacji — jego rozmiar i to, ile ekranu przez niego prześwituje.</string>
+    <string name="l10n_settings_screen_bar_size_2304bfbb">Rozmiar paska</string>
+    <string name="l10n_settings_screen_bar_transparency_3f648fbb">Przezroczystość paska</string>
+    <string name="l10n_settings_screen_how_see_through_the_bar_is_ddb0c208">Jak bardzo pasek jest przezroczysty. Najsłabszy stopień nadal pokazuje jego obramowanie, więc zawsze można go znaleźć.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 29203346bc..8d26427997 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2670,4 +2670,9 @@
     <string name="settings_day_cycle_midnight">00:00</string>
     <string name="settings_day_cycle_sleep_description">Predefinição. O ciclo segue o início do sono principal detetado. Se os dados de sono estiverem em falta ou não forem fiáveis, é usada a meia-noite local.</string>
     <string name="settings_day_cycle_midnight_description">Usa um dia civil local convencional das 00:00 às 00:00.</string>
+    <string name="l10n_settings_screen_bottom_bar_f84098a9">Barra inferior</string>
+    <string name="l10n_settings_screen_how_the_navigation_bar_looks_f186b099">O aspeto da barra de navegação — o seu tamanho e quanto do ecrã se vê através dela.</string>
+    <string name="l10n_settings_screen_bar_size_2304bfbb">Tamanho da barra</string>
+    <string name="l10n_settings_screen_bar_transparency_3f648fbb">Transparência da barra</string>
+    <string name="l10n_settings_screen_how_see_through_the_bar_is_ddb0c208">Quão transparente é a barra. O nível mais ténue continua a mostrar o contorno, por isso pode sempre ser encontrada.</string>
 </resources>
diff --git a/android/app/src/main/res/values-ru/strings.xml b/android/app/src/main/res/values-ru/strings.xml
index 0847ba246e..c1a9f618a4 100644
--- a/android/app/src/main/res/values-ru/strings.xml
+++ b/android/app/src/main/res/values-ru/strings.xml
@@ -2562,4 +2562,9 @@
     <string name="settings_day_cycle_midnight">00:00</string>
     <string name="settings_day_cycle_sleep_description">По умолчанию цикл начинается с обнаруженного основного сна. Если данные о сне отсутствуют или ненадёжны, используется местная полночь.</string>
     <string name="settings_day_cycle_midnight_description">Используется обычный местный календарный день с 00:00 до 00:00.</string>
+    <string name="l10n_settings_screen_bottom_bar_f84098a9">Нижняя панель</string>
+    <string name="l10n_settings_screen_how_the_navigation_bar_looks_f186b099">Как выглядит панель навигации — её размер и насколько сквозь неё виден экран.</string>
+    <string name="l10n_settings_screen_bar_size_2304bfbb">Размер панели</string>
+    <string name="l10n_settings_screen_bar_transparency_3f648fbb">Прозрачность панели</string>
+    <string name="l10n_settings_screen_how_see_through_the_bar_is_ddb0c208">Насколько панель прозрачна. На самом слабом шаге её контур всё ещё виден, поэтому её всегда можно найти.</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 89b2a865d5..a1f6d11ad7 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2591,4 +2591,9 @@
     <string name="settings_day_cycle_midnight">00:00</string>
     <string name="settings_day_cycle_sleep_description">默认。周期从检测到的主要睡眠开始。睡眠数据缺失或不可靠时，将使用当地午夜。</string>
     <string name="settings_day_cycle_midnight_description">使用从 00:00 到次日 00:00 的常规当地日历日。</string>
+    <string name="l10n_settings_screen_bottom_bar_f84098a9">底部栏</string>
+    <string name="l10n_settings_screen_how_the_navigation_bar_looks_f186b099">导航栏的外观——它的大小，以及透过它能看到多少屏幕内容。</string>
+    <string name="l10n_settings_screen_bar_size_2304bfbb">栏大小</string>
+    <string name="l10n_settings_screen_bar_transparency_3f648fbb">栏透明度</string>
+    <string name="l10n_settings_screen_how_see_through_the_bar_is_ddb0c208">底部栏的透明程度。即使在最淡的一档也会保留边框，因此始终能找到它。</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index eb84e1efbb..4e49d12c96 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2704,4 +2704,9 @@
     <string name="settings_day_cycle_midnight">00:00</string>
     <string name="settings_day_cycle_sleep_description">Default. The cycle follows the beginning of your detected main sleep. Before a main sleep is detected, local midnight is used.</string>
     <string name="settings_day_cycle_midnight_description">Uses a conventional local calendar day from 00:00 to 00:00.</string>
+    <string name="l10n_settings_screen_bottom_bar_f84098a9">Bottom bar</string>
+    <string name="l10n_settings_screen_how_the_navigation_bar_looks_f186b099">How the navigation bar looks — its size, and how much of the screen shows through it.</string>
+    <string name="l10n_settings_screen_bar_size_2304bfbb">Bar size</string>
+    <string name="l10n_settings_screen_bar_transparency_3f648fbb">Bar transparency</string>
+    <string name="l10n_settings_screen_how_see_through_the_bar_is_ddb0c208">How see-through the bar is. The faintest step still shows its rim, so it can always be found.</string>
 </resources>
diff --git a/android/app/src/test/java/com/noop/ui/BottomBarStyleTest.kt b/android/app/src/test/java/com/noop/ui/BottomBarStyleTest.kt
new file mode 100644
index 0000000000..f492ffa5df
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/BottomBarStyleTest.kt
@@ -0,0 +1,72 @@
+package com.noop.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/** The bottom bar's size and transparency options. */
+class BottomBarStyleTest {
+
+    /**
+     * The property that makes this safe to ship: the DEFAULT step reproduces the alpha the bar has
+     * always drawn, so an install that never opens the setting looks identical.
+     */
+    @Test fun `the default step is the shipped alpha`() {
+        assertEquals(0.80f, alphaForOpacityStep(DEFAULT_OPACITY_STEP), 0.0001f)
+    }
+
+    @Test fun `the eight steps run from faint to solid`() {
+        assertEquals(0.30f, alphaForOpacityStep(MIN_OPACITY_STEP), 0.0001f)
+        assertEquals(1.00f, alphaForOpacityStep(MAX_OPACITY_STEP), 0.0001f)
+        val all = (MIN_OPACITY_STEP..MAX_OPACITY_STEP).map { alphaForOpacityStep(it) }
+        assertEquals(8, all.size)
+        assertEquals(all.sorted(), all)
+        assertEquals(all.distinct().size, all.size)
+    }
+
+    /**
+     * A bar can never become invisible-but-tappable, which would hide the navigation with no way back
+     * to the setting that hid it.
+     */
+    @Test fun `the faintest step is still visible`() {
+        assertTrue(alphaForOpacityStep(MIN_OPACITY_STEP) >= 0.30f)
+    }
+
+    /** Out-of-range input is clamped, not honoured - including values a downgrade could leave behind. */
+    @Test fun `steps outside the range clamp`() {
+        assertEquals(alphaForOpacityStep(MIN_OPACITY_STEP), alphaForOpacityStep(-4), 0.0001f)
+        assertEquals(alphaForOpacityStep(MAX_OPACITY_STEP), alphaForOpacityStep(99), 0.0001f)
+    }
+
+    @Test fun `the offered sizes are the requested ones`() {
+        assertEquals(listOf(1f, 1.25f, 1.5f, 1.75f, 2f), BOTTOM_BAR_SCALES)
+    }
+
+    /**
+     * A stored size from another build - or a hand-edited pref - snaps to something the dropdown can
+     * show, so the UI can always leave the state it is in.
+     */
+    @Test fun `an unoffered size snaps to the nearest offered one`() {
+        assertEquals(1.25f, nearestScale(1.3f), 0.0001f)
+        assertEquals(2f, nearestScale(5f), 0.0001f)
+        assertEquals(1f, nearestScale(0f), 0.0001f)
+        assertTrue(nearestScale(1.37f) in BOTTOM_BAR_SCALES)
+    }
+
+    @Test fun `scale labels read as multipliers`() {
+        assertEquals("1x", scaleLabel(1f))
+        assertEquals("1.25x", scaleLabel(1.25f))
+        assertEquals("2x", scaleLabel(2f))
+    }
+
+    /**
+     * The rounding the slider relies on. A snapped slider value can arrive as 5.9999998; truncation
+     * reads that as step 5, so the bar lands one stop below where the thumb is sitting.
+     */
+    @Test fun `a snapped slider value rounds to its own step`() {
+        assertEquals(6, 5.9999998f.let { Math.round(it) })
+        assertEquals(alphaForOpacityStep(6), alphaForOpacityStep(Math.round(5.9999998f)), 0.0001f)
+        assertEquals(alphaForOpacityStep(5), alphaForOpacityStep(Math.round(5.4f)), 0.0001f)
+    }
+
+}

From 745df163736f9b279e22eaf42e4e387f9f532355 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 11:58:22 +1200
Subject: [PATCH 259/333] build: testing build 442 / 323

Build numbers only; 11.1.1 stays as the next unreleased version. versionCode
clears 441 so the side-install replaces it.

Carries the bottom bar's own settings card with its size and transparency. The
checks are visual: that step 6 is indistinguishable from the bar as it shipped,
and that 2x still leaves room for content on a small screen.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index ab65a6e9a0..0a7a202ae6 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 441
+        versionCode = 442
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index a4797c62bc..d1c15a7128 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "322"
+    CURRENT_PROJECT_VERSION: "323"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 2b46dd0fb41a588c0c5d9245c2d7a1f9166d9330 Mon Sep 17 00:00:00 2001
From: Bernd Helm <bhelm@users.noreply.github.com>
Date: Sun, 6 Sep 2026 02:07:33 +0200
Subject: [PATCH 260/333] analytics: require one continuous effort for
 heart-rate recovery eligibility

By @bhelm.

`sustainedSeconds` summed EVERY qualifying interval, so three separated
40-second bursts totalled 120 s and passed as a two-minute effort. Heart-rate
recovery was therefore offered for workouts that never sustained one. It now
tracks the longest CONTINUOUS run, resetting when a gap exceeds the cap or a
sample falls below threshold.

Everything else is deliberately untouched: the threshold, left-sample interval
attribution, the 10-second gap cap, duplicate-timestamp handling, the recovery
windows and the score outputs. A zero-length gap still continues WITHOUT
resetting, so duplicate rows cannot break an otherwise continuous effort - the
kind of detail that is easy to lose in a rewrite of this shape and was not.

Both platforms move together and the twins stay byte-identical in behaviour:
same control flow, same reset conditions, same accumulate-and-max. Five matching
tests per platform cover the regression itself, a gap EXACTLY at the cap, a gap
over it, a below-threshold reset, and the duplicate-timestamp case.

Worth knowing rather than discovering: heart-rate recovery is computed at read
time, not stored, so this needs no migration and carries no stale rows - but it
applies to HISTORICAL workouts immediately. A past workout that qualified only by
adding fragments together will stop showing its recovery card. That is the
correction landing, not data loss.

Verified beyond the contributor's own testing: the full Android unit suite green
on the PR head (5318 tests, HeartRateRecovery 12/12), and all seventeen checks
green including test (StrandAnalytics), which covers the Swift half.
---
 .../StrandAnalytics/HeartRateRecovery.swift   | 18 ++++--
 .../HeartRateRecoveryTests.swift              | 61 +++++++++++++++++++
 .../com/noop/analytics/HeartRateRecovery.kt   | 17 ++++--
 .../noop/analytics/HeartRateRecoveryTest.kt   | 56 +++++++++++++++++
 4 files changed, 144 insertions(+), 8 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/HeartRateRecovery.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/HeartRateRecovery.swift
index 43fe3a2f3e..6c05ee5e37 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/HeartRateRecovery.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/HeartRateRecovery.swift
@@ -82,13 +82,23 @@ public enum HeartRateRecovery {
 
     private static func sustainedSeconds(atOrAbove threshold: Double, in samples: [HRSample]) -> Int {
         guard samples.count >= 2 else { return 0 }
-        var seconds = 0
+        var currentSeconds = 0
+        var longestSeconds = 0
         for i in 0..<(samples.count - 1) {
             let gap = samples[i + 1].ts - samples[i].ts
-            guard gap > 0, gap <= maximumContinuousGapSeconds else { continue }
-            if Double(samples[i].bpm) >= threshold { seconds += gap }
+            guard gap > 0 else { continue }
+            guard gap <= maximumContinuousGapSeconds else {
+                currentSeconds = 0
+                continue
+            }
+            guard Double(samples[i].bpm) >= threshold else {
+                currentSeconds = 0
+                continue
+            }
+            currentSeconds += gap
+            longestSeconds = max(longestSeconds, currentSeconds)
         }
-        return seconds
+        return longestSeconds
     }
 
     private static func median(_ values: [Int]) -> Int? {
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HeartRateRecoveryTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HeartRateRecoveryTests.swift
index e246db99a9..8a80ed8efe 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HeartRateRecoveryTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HeartRateRecoveryTests.swift
@@ -15,6 +15,15 @@ final class HeartRateRecoveryTests: XCTestCase {
         return values.enumerated().map { i, bpm in HRSample(ts: target - values.count / 2 + i, bpm: bpm) }
     }
 
+    private func result(for eligibilitySamples: [HRSample]) -> HeartRateRecovery.Result? {
+        HeartRateRecovery.calculate(
+            samples: eligibilitySamples + window(minutes: 1, values: [140, 140, 140]),
+            workoutStart: end - 300,
+            workoutEnd: end,
+            maxHR: 200
+        )
+    }
+
     func testCalculatesOneTwoAndFiveMinuteDropsFromRobustReadings() {
         let samples = denseEligible()
             + window(minutes: 1, values: [146, 146, 220, 146, 146]) // optical spike cannot own the reading
@@ -42,6 +51,58 @@ final class HeartRateRecoveryTests: XCTestCase {
                                                  workoutEnd: end, maxHR: 200))
     }
 
+    func testRejectsThreeSeparatedFortySecondHighIntensityRuns() {
+        let samples = [
+            HRSample(ts: end - 140, bpm: 170), HRSample(ts: end - 130, bpm: 170),
+            HRSample(ts: end - 120, bpm: 170), HRSample(ts: end - 110, bpm: 170),
+            HRSample(ts: end - 100, bpm: 120),
+            HRSample(ts: end - 90, bpm: 170), HRSample(ts: end - 80, bpm: 170),
+            HRSample(ts: end - 70, bpm: 170), HRSample(ts: end - 60, bpm: 170),
+            HRSample(ts: end - 50, bpm: 120),
+            HRSample(ts: end - 40, bpm: 170), HRSample(ts: end - 30, bpm: 170),
+            HRSample(ts: end - 20, bpm: 170), HRSample(ts: end - 10, bpm: 170),
+            HRSample(ts: end, bpm: 120),
+        ]
+
+        XCTAssertNil(result(for: samples))
+    }
+
+    func testGapExactlyAtCapUsesLeftSampleAndExactMinimumIsAccepted() {
+        let samples = stride(from: end - 120, through: end - 10, by: 10)
+            .map { HRSample(ts: $0, bpm: 170) }
+            + [HRSample(ts: end, bpm: 120)]
+
+        XCTAssertEqual(result(for: samples), .init(endHR: 170, after1Minute: 30,
+                                                  after2Minutes: nil, after5Minutes: nil))
+    }
+
+    func testGapOverCapResetsTheQualifyingRun() {
+        let beforeGap = stride(from: end - 180, through: end - 110, by: 10)
+            .map { HRSample(ts: $0, bpm: 170) }
+        let afterGap = stride(from: end - 99, through: end - 9, by: 10)
+            .map { HRSample(ts: $0, bpm: 170) }
+            + [HRSample(ts: end, bpm: 170)]
+
+        XCTAssertNil(result(for: beforeGap + afterGap))
+    }
+
+    func testBelowThresholdIntervalResetsTheQualifyingRun() {
+        let samples = stride(from: end - 130, through: end, by: 10).map { ts in
+            HRSample(ts: ts, bpm: ts == end - 60 ? 120 : 170)
+        }
+
+        XCTAssertNil(result(for: samples))
+    }
+
+    func testDuplicateTimestampDoesNotBreakAnOtherwiseContinuousRun() {
+        let samples = stride(from: end - 120, through: end, by: 10)
+            .map { HRSample(ts: $0, bpm: 170) }
+            + [HRSample(ts: end - 60, bpm: 120)]
+
+        XCTAssertEqual(result(for: samples), .init(endHR: 170, after1Minute: 30,
+                                                  after2Minutes: nil, after5Minutes: nil))
+    }
+
     func testDoesNotCreditPreWorkoutHeartRateTowardEligibility() {
         let samples = denseEligible() + window(minutes: 1, values: [140, 140, 140])
         // Only the final minute belongs to this workout. The preceding high HR must not make it eligible.
diff --git a/android/app/src/main/java/com/noop/analytics/HeartRateRecovery.kt b/android/app/src/main/java/com/noop/analytics/HeartRateRecovery.kt
index 0e4aa154a2..7623295729 100644
--- a/android/app/src/main/java/com/noop/analytics/HeartRateRecovery.kt
+++ b/android/app/src/main/java/com/noop/analytics/HeartRateRecovery.kt
@@ -66,14 +66,23 @@ object HeartRateRecovery {
 
     private fun sustainedSeconds(threshold: Double, samples: List<HrSample>): Long {
         if (samples.size < 2) return 0L
-        var seconds = 0L
+        var currentSeconds = 0L
+        var longestSeconds = 0L
         for (i in 0 until samples.lastIndex) {
             val gap = samples[i + 1].ts - samples[i].ts
-            if (gap in 1..maximumContinuousGapSeconds && samples[i].bpm.toDouble() >= threshold) {
-                seconds += gap
+            if (gap <= 0L) continue
+            if (gap > maximumContinuousGapSeconds) {
+                currentSeconds = 0L
+                continue
             }
+            if (samples[i].bpm.toDouble() < threshold) {
+                currentSeconds = 0L
+                continue
+            }
+            currentSeconds += gap
+            longestSeconds = maxOf(longestSeconds, currentSeconds)
         }
-        return seconds
+        return longestSeconds
     }
 
     private fun median(values: List<Int>): Int? {
diff --git a/android/app/src/test/java/com/noop/analytics/HeartRateRecoveryTest.kt b/android/app/src/test/java/com/noop/analytics/HeartRateRecoveryTest.kt
index 38d9895945..bbc5ea48c6 100644
--- a/android/app/src/test/java/com/noop/analytics/HeartRateRecoveryTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/HeartRateRecoveryTest.kt
@@ -16,6 +16,11 @@ class HeartRateRecoveryTest {
         return values.mapIndexed { i, bpm -> HrSample("strap", target - values.size / 2 + i, bpm) }
     }
 
+    private fun result(eligibilitySamples: List<HrSample>): HeartRateRecovery.Result? =
+        HeartRateRecovery.calculate(
+            eligibilitySamples + window(1, listOf(140, 140, 140)), end - 300, end, 200.0,
+        )
+
     @Test
     fun calculatesOneTwoAndFiveMinuteDropsFromRobustReadings() {
         val samples = denseEligible() +
@@ -42,6 +47,57 @@ class HeartRateRecoveryTest {
         assertNull(HeartRateRecovery.calculate(sparse + window(1, listOf(140, 140, 140)), end - 300, end, 200.0))
     }
 
+    @Test
+    fun rejectsThreeSeparatedFortySecondHighIntensityRuns() {
+        val samples = listOf(
+            HrSample("strap", end - 140, 170), HrSample("strap", end - 130, 170),
+            HrSample("strap", end - 120, 170), HrSample("strap", end - 110, 170),
+            HrSample("strap", end - 100, 120),
+            HrSample("strap", end - 90, 170), HrSample("strap", end - 80, 170),
+            HrSample("strap", end - 70, 170), HrSample("strap", end - 60, 170),
+            HrSample("strap", end - 50, 120),
+            HrSample("strap", end - 40, 170), HrSample("strap", end - 30, 170),
+            HrSample("strap", end - 20, 170), HrSample("strap", end - 10, 170),
+            HrSample("strap", end, 120),
+        )
+
+        assertNull(result(samples))
+    }
+
+    @Test
+    fun gapExactlyAtCapUsesLeftSampleAndExactMinimumIsAccepted() {
+        val samples = (end - 120..end - 10 step 10).map { HrSample("strap", it, 170) } +
+            HrSample("strap", end, 120)
+
+        assertEquals(HeartRateRecovery.Result(170, 30, null, null), result(samples))
+    }
+
+    @Test
+    fun gapOverCapResetsTheQualifyingRun() {
+        val beforeGap = (end - 180..end - 110 step 10).map { HrSample("strap", it, 170) }
+        val afterGap = (end - 99..end - 9 step 10).map { HrSample("strap", it, 170) } +
+            HrSample("strap", end, 170)
+
+        assertNull(result(beforeGap + afterGap))
+    }
+
+    @Test
+    fun belowThresholdIntervalResetsTheQualifyingRun() {
+        val samples = (end - 130..end step 10).map { ts ->
+            HrSample("strap", ts, if (ts == end - 60) 120 else 170)
+        }
+
+        assertNull(result(samples))
+    }
+
+    @Test
+    fun duplicateTimestampDoesNotBreakAnOtherwiseContinuousRun() {
+        val samples = (end - 120..end step 10).map { HrSample("strap", it, 170) } +
+            HrSample("strap", end - 60, 120)
+
+        assertEquals(HeartRateRecovery.Result(170, 30, null, null), result(samples))
+    }
+
     @Test
     fun doesNotCreditPreWorkoutHeartRateTowardEligibility() {
         val samples = denseEligible() + window(1, listOf(140, 140, 140))

From f1c9db38ca36c7447024200b3482ebf0ddb1829e Mon Sep 17 00:00:00 2001
From: Bernd Helm <bhelm@users.noreply.github.com>
Date: Sun, 6 Sep 2026 02:12:19 +0200
Subject: [PATCH 261/333] tools: make the capture tools work on non-UTF-8
 hosts, and close their SQLite connections

By @bhelm.

The capture tools assumed a UTF-8 host. On a machine whose console defaults to a
legacy code page, a Unicode diagnostic raised UnicodeEncodeError and took the
tool down - so the tools were unusable on a stock Windows shell, and the failure
landed on whoever was trying to capture, not on anyone able to fix it. Text files
now open with an explicit encoding and the console entry points reconfigure their
streams, guarded so a replaced stream cannot crash the guard itself.

The SQLite half closes the connection on the normal, early-return,
initialization-error and command-error paths. Capture commands now own the
database OUTSIDE asyncio.run, so the background executor finishes before the
connection closes rather than racing it.

The tests earn their place: they assert the connection is CLOSED by using it and
catching ProgrammingError, rather than asserting that close() was called, and
they cover the paths that are easy to leave leaking - a schema-init failure and a
cancelled background commit.

Verified beyond the contributor's own testing: the whole suite run under a
STRICTER console than the PR's own, PYTHONUTF8=0 with PYTHONIOENCODING=ascii,
where any non-ASCII byte fails rather than merely a cp1252-unmappable one. 223
tests, OK.

The new Windows job carries a guard worth copying elsewhere: it fails when
discovery finds fewer than 200 tests, so a collection that quietly finds nothing
cannot pass as green.
---
 .github/workflows/tools-python.yml            |  33 ++++++
 .../analyze_command_responses.py              |   5 +-
 Tools/linux-capture/analyze_v25_waveform.py   |   6 +-
 Tools/linux-capture/analyze_v26_waveform.py   |   6 +-
 Tools/linux-capture/capture_io.py             |  11 ++
 Tools/linux-capture/correlate_ground_truth.py |   4 +-
 Tools/linux-capture/decode_features.py        |   2 +-
 Tools/linux-capture/hci_extract.py            |   4 +-
 Tools/linux-capture/pair_probe.py             |   2 +
 Tools/linux-capture/test_console_encoding.py  |  62 ++++++++++
 .../test_correlate_ground_truth.py            |   6 +-
 Tools/linux-capture/test_decode_features.py   |  30 +++--
 .../test_validate_spo2_candidate.py           |  89 ++++++++++----
 Tools/linux-capture/test_whoop_spot_hrv.py    |  89 ++++++++++++++
 Tools/linux-capture/test_whoop_sync.py        |  94 ++++++++++++++-
 .../linux-capture/validate_spo2_candidate.py  |   7 +-
 Tools/linux-capture/whoop_activity.py         |  33 +++---
 Tools/linux-capture/whoop_buzz.py             |   2 +
 Tools/linux-capture/whoop_capture.py          |   4 +-
 Tools/linux-capture/whoop_probe.py            |   2 +
 Tools/linux-capture/whoop_setclock.py         |   2 +
 Tools/linux-capture/whoop_spot_hrv.py         |   8 ++
 Tools/linux-capture/whoop_sync.py             | 111 +++++++++++-------
 23 files changed, 511 insertions(+), 101 deletions(-)
 create mode 100644 Tools/linux-capture/capture_io.py
 create mode 100644 Tools/linux-capture/test_console_encoding.py

diff --git a/.github/workflows/tools-python.yml b/.github/workflows/tools-python.yml
index f0910c8e16..be8dfcb1c5 100644
--- a/.github/workflows/tools-python.yml
+++ b/.github/workflows/tools-python.yml
@@ -79,3 +79,36 @@ jobs:
             exit 1
           fi
         working-directory: Tools
+
+  windows-capture:
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      # Keep Windows locale defaults and exercise a strict legacy console, including subprocesses.
+      # UTF-8 mode would hide implicit file encodings; replacement output would hide console bugs.
+      - name: Run Tools/linux-capture tests with legacy Windows encodings
+        working-directory: Tools/linux-capture
+        env:
+          PYTHONUTF8: '0'
+          PYTHONIOENCODING: 'cp1252:strict'
+          PYTHONLEGACYWINDOWSSTDIO: '1'
+        shell: python
+        run: |
+          import sys
+          import unittest
+
+          suite = unittest.defaultTestLoader.discover('.', pattern='test_*.py')
+          count = suite.countTestCases()
+          print(f'collected {count} tests', flush=True)
+          result = unittest.TextTestRunner(verbosity=2).run(suite)
+          if count < 200 or result.testsRun < 200:
+              print('::error::expected at least 200 tests; discovery or execution is incomplete')
+              sys.exit(1)
+          sys.exit(0 if result.wasSuccessful() else 1)
diff --git a/Tools/linux-capture/analyze_command_responses.py b/Tools/linux-capture/analyze_command_responses.py
index d4ba5c7bff..b6fe9774f0 100644
--- a/Tools/linux-capture/analyze_command_responses.py
+++ b/Tools/linux-capture/analyze_command_responses.py
@@ -11,6 +11,7 @@
 import json
 import sys
 
+from capture_io import configure_utf8_stdio
 import whoop_frame as wf
 
 # Response command numbers (CommandNumber enum) → human name.
@@ -45,7 +46,8 @@ def main():
     if len(sys.argv) < 2:
         print(__doc__)
         return
-    data = json.load(open(sys.argv[1]))
+    with open(sys.argv[1], encoding="utf-8") as f:
+        data = json.load(f)
     seen = {}
     for r in data:
         h = bytes.fromhex(r["hex"])
@@ -67,4 +69,5 @@ def main():
 
 
 if __name__ == "__main__":
+    configure_utf8_stdio()
     main()
diff --git a/Tools/linux-capture/analyze_v25_waveform.py b/Tools/linux-capture/analyze_v25_waveform.py
index e1f78bedaf..52952abb42 100644
--- a/Tools/linux-capture/analyze_v25_waveform.py
+++ b/Tools/linux-capture/analyze_v25_waveform.py
@@ -52,6 +52,8 @@
 import struct
 import sys
 
+from capture_io import configure_utf8_stdio
+
 # --- v25 record geometry (WHOOP 4.0 envelope: 0xAA, len u16, crc8, type@4, version@5, ...) -----------
 TYPE_HISTORICAL = 0x2F        # 47, at byte 4
 VERSION_V25 = 25              # at byte 5
@@ -164,7 +166,8 @@ def load_corpus(argv):
         print("No corpus given — running the DEMO on the bundled resting frames (which cannot pin the\n"
               "span; that is the point). Build a real corpus (--template) with a HR ≠ 60.\n")
         return [BUNDLED_RESTING]
-    return json.load(open(paths[0]))
+    with open(paths[0], encoding="utf-8") as f:
+        return json.load(f)
 
 
 def analyze(corpus):
@@ -266,6 +269,7 @@ def selftest():
 
 
 if __name__ == "__main__":
+    configure_utf8_stdio()
     if "--selftest" in sys.argv:
         selftest()
     else:
diff --git a/Tools/linux-capture/analyze_v26_waveform.py b/Tools/linux-capture/analyze_v26_waveform.py
index e56c16aac3..430a474e81 100644
--- a/Tools/linux-capture/analyze_v26_waveform.py
+++ b/Tools/linux-capture/analyze_v26_waveform.py
@@ -26,6 +26,8 @@
 import sys
 from collections import Counter
 
+from capture_io import configure_utf8_stdio
+
 WAVE_START, WAVE_END = 27, 75          # 24 LE-i16 samples per record
 SAMPLE_RATE_HZ = 24                     # 24 samples/record, 1 record/second
 
@@ -56,7 +58,8 @@ def acf(x, lag):
 
 def main():
     path = sys.argv[1] if len(sys.argv) > 1 else "capture_hist_ack.json"
-    frames = [bytes.fromhex(c["hex"]) for c in json.load(open(path))]
+    with open(path, encoding="utf-8") as f:
+        frames = [bytes.fromhex(c["hex"]) for c in json.load(f)]
     v26 = [r for r in frames if len(r) == 88 and r[8] == 47 and r[9] == 26]
     v18 = [r for r in frames if len(r) == 124 and r[8] == 47 and r[9] == 18]
     if not v26:
@@ -102,4 +105,5 @@ def main():
 
 
 if __name__ == "__main__":
+    configure_utf8_stdio()
     main()
diff --git a/Tools/linux-capture/capture_io.py b/Tools/linux-capture/capture_io.py
new file mode 100644
index 0000000000..045065373d
--- /dev/null
+++ b/Tools/linux-capture/capture_io.py
@@ -0,0 +1,11 @@
+"""Shared text-console setup for the executable Linux capture tools."""
+
+import sys
+
+
+def configure_utf8_stdio() -> None:
+    """Keep Unicode diagnostics printable when the host defaults to a legacy code page."""
+    for stream in (sys.stdout, sys.stderr):
+        reconfigure = getattr(stream, "reconfigure", None)
+        if callable(reconfigure):
+            reconfigure(encoding="utf-8")
diff --git a/Tools/linux-capture/correlate_ground_truth.py b/Tools/linux-capture/correlate_ground_truth.py
index 16434e5191..b5aab754b9 100644
--- a/Tools/linux-capture/correlate_ground_truth.py
+++ b/Tools/linux-capture/correlate_ground_truth.py
@@ -29,6 +29,7 @@
 import sys
 import zipfile
 
+from capture_io import configure_utf8_stdio
 import whoop_frame as wf
 
 # --- Ground-truth CSV loading ----------------------------------------------------------------------
@@ -301,7 +302,7 @@ def main():
                    help="restrict to one record type byte, e.g. 0x2f")
     args = p.parse_args()
 
-    with open(args.capture) as f:
+    with open(args.capture, encoding="utf-8") as f:
         records = json.load(f)
     rows = load_ground_truth(args.export)
     if not rows:
@@ -344,4 +345,5 @@ def main():
 
 
 if __name__ == "__main__":
+    configure_utf8_stdio()
     main()
diff --git a/Tools/linux-capture/decode_features.py b/Tools/linux-capture/decode_features.py
index 132612be57..e77b16bc7d 100644
--- a/Tools/linux-capture/decode_features.py
+++ b/Tools/linux-capture/decode_features.py
@@ -242,7 +242,7 @@ def run_whoop_decode(frames_json, binary=None):
     binary = binary or find_whoop_decode()
     fd, path = tempfile.mkstemp(suffix=".json")
     try:
-        with os.fdopen(fd, "w") as f:
+        with os.fdopen(fd, "w", encoding="utf-8") as f:
             json.dump(frames_json, f)
         r = subprocess.run([binary, "--json", "--family", "auto", path],
                            capture_output=True, text=True)
diff --git a/Tools/linux-capture/hci_extract.py b/Tools/linux-capture/hci_extract.py
index 27f5414b70..4342ca4623 100644
--- a/Tools/linux-capture/hci_extract.py
+++ b/Tools/linux-capture/hci_extract.py
@@ -23,6 +23,7 @@
 import struct
 import sys
 
+from capture_io import configure_utf8_stdio
 import whoop_frame as wf
 
 # --- HCI log container parsing ---------------------------------------------------------------------
@@ -289,7 +290,7 @@ def main():
     args = p.parse_args()
 
     records, stats = extract(load_hci(args.input), args.family)
-    with open(args.out, "w") as f:
+    with open(args.out, "w", encoding="utf-8") as f:
         json.dump(records, f, indent=1)
 
     if not records:
@@ -309,4 +310,5 @@ def main():
 
 
 if __name__ == "__main__":
+    configure_utf8_stdio()
     main()
diff --git a/Tools/linux-capture/pair_probe.py b/Tools/linux-capture/pair_probe.py
index dbc91b1ab5..7fd46da5a0 100644
--- a/Tools/linux-capture/pair_probe.py
+++ b/Tools/linux-capture/pair_probe.py
@@ -2,6 +2,7 @@
 Usage: python3 pair_probe.py <MAC>   (or set WHOOP_MAC). Use on a strap you own; phone BT off."""
 import asyncio, os, sys, time
 from bleak import BleakClient, BleakScanner
+from capture_io import configure_utf8_stdio
 MAC = sys.argv[1] if len(sys.argv) > 1 else os.environ.get("WHOOP_MAC", "")
 if not MAC:
     sys.exit("usage: python3 pair_probe.py <MAC>   (or export WHOOP_MAC=AA:BB:CC:DD:EE:FF)")
@@ -50,4 +51,5 @@ async def main():
     except Exception as e:
         log(f"connect FAILED: {type(e).__name__}: {str(e)[:110]}")
 
+configure_utf8_stdio()
 asyncio.run(main())
diff --git a/Tools/linux-capture/test_console_encoding.py b/Tools/linux-capture/test_console_encoding.py
new file mode 100644
index 0000000000..7bae241f11
--- /dev/null
+++ b/Tools/linux-capture/test_console_encoding.py
@@ -0,0 +1,62 @@
+"""Executable-path coverage for consoles that default to a legacy Windows encoding.
+
+The subprocesses run on Linux with strict cp1252 stdout/stderr. This reproduces the encoding
+constraint but is not a native Windows test.
+"""
+
+import os
+import sqlite3
+import subprocess
+import sys
+import tempfile
+import unittest
+from pathlib import Path
+
+
+HERE = Path(__file__).resolve().parent
+
+
+def _run_cp1252(script, *args):
+    env = os.environ.copy()
+    env["PYTHONIOENCODING"] = "cp1252:strict"
+    return subprocess.run(
+        [sys.executable, str(HERE / script), *map(str, args)],
+        cwd=HERE,
+        env=env,
+        capture_output=True,
+        timeout=10,
+    )
+
+
+class ConsoleEncodingTests(unittest.TestCase):
+    def test_analyze_v25_real_entrypoint_is_unicode_safe(self):
+        result = _run_cp1252("analyze_v25_waveform.py")
+        self.assertEqual(result.returncode, 0, result.stderr.decode("utf-8", errors="replace"))
+        self.assertIn("running the DEMO", result.stdout.decode("utf-8"))
+
+    def test_whoop_sync_real_entrypoint_is_unicode_safe(self):
+        with tempfile.TemporaryDirectory() as td:
+            db_path = os.path.join(td, "capture.db")
+            con = sqlite3.connect(db_path)
+            con.execute(
+                "CREATE TABLE devices (id INTEGER PRIMARY KEY, address TEXT NOT NULL UNIQUE, "
+                "name TEXT, subject TEXT, model TEXT, created_ms INTEGER)"
+            )
+            con.execute(
+                "CREATE TABLE frames (id INTEGER PRIMARY KEY, device_id INTEGER NOT NULL, "
+                "recv_ms INTEGER NOT NULL, char TEXT, inner_type INTEGER, unix INTEGER, "
+                "hr INTEGER, hex TEXT NOT NULL, UNIQUE(device_id, hex))"
+            )
+            con.execute(
+                "INSERT INTO devices(address, name, model) VALUES('AA:BB:CC:DD:EE:FF', 'strap', 'whoop4')"
+            )
+            con.commit()
+            con.close()
+
+            result = _run_cp1252("whoop_sync.py", "devices", "--db", db_path)
+        self.assertEqual(result.returncode, 0, result.stderr.decode("utf-8", errors="replace"))
+        self.assertIn("→", result.stdout.decode("utf-8"))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/Tools/linux-capture/test_correlate_ground_truth.py b/Tools/linux-capture/test_correlate_ground_truth.py
index dafdb2f215..9c4b6eceda 100644
--- a/Tools/linux-capture/test_correlate_ground_truth.py
+++ b/Tools/linux-capture/test_correlate_ground_truth.py
@@ -61,7 +61,7 @@ def test_load_english_cycles_spo2(self):
             "2026-07-14 23:51:24,97.29,34.40\n"
         )
         folder = tempfile.mkdtemp()
-        with open(os.path.join(folder, "physiological_cycles.csv"), "w") as f:
+        with open(os.path.join(folder, "physiological_cycles.csv"), "w", encoding="utf-8") as f:
             f.write(cycles)
         rows = cg.load_ground_truth(folder)
         truth = cg.truth_values(rows)
@@ -72,9 +72,9 @@ def test_merges_cycles_and_sleep_on_cycle_start(self):
         cycles = "Startzeit des Zyklus,Herzfrequenzvariabilität (ms)\n2026-06-20 00:24:31,92\n"
         sleep = "Startzeit des Zyklus,Atemfrequenz (Atemzüge/Min.)\n2026-06-20 00:24:31,14.6\n"
         folder = tempfile.mkdtemp()
-        with open(os.path.join(folder, "physiologische_zyklen.csv"), "w") as f:
+        with open(os.path.join(folder, "physiologische_zyklen.csv"), "w", encoding="utf-8") as f:
             f.write(cycles)
-        with open(os.path.join(folder, "Schlaf.csv"), "w") as f:
+        with open(os.path.join(folder, "Schlaf.csv"), "w", encoding="utf-8") as f:
             f.write(sleep)
         rows = cg.load_ground_truth(folder)
         self.assertEqual(len(rows), 1)
diff --git a/Tools/linux-capture/test_decode_features.py b/Tools/linux-capture/test_decode_features.py
index 124b077a69..07eb8b89ea 100644
--- a/Tools/linux-capture/test_decode_features.py
+++ b/Tools/linux-capture/test_decode_features.py
@@ -9,27 +9,29 @@
 import decode_features as df
 
 
-def _conn():
+def _conn(owner=None):
     c = sqlite3.connect(":memory:")
     df.apply_schema(c)
+    if owner is not None:
+        owner.addCleanup(c.close)
     return c
 
 
 class SchemaTests(unittest.TestCase):
     def test_creates_four_feature_tables(self):
-        c = _conn()
+        c = _conn(self)
         names = {r[0] for r in c.execute(
             "SELECT name FROM sqlite_master WHERE type='table'").fetchall()}
         self.assertTrue({"feat_second", "feat_rr", "feat_ppg", "feat_event"} <= names)
 
     def test_schema_is_idempotent(self):
-        c = _conn()
+        c = _conn(self)
         df.apply_schema(c)  # second apply must not raise
         self.assertTrue(True)
 
     def test_feat_ppg_has_burst_index_column(self):
         # PR#553: the raw per-burst counter column ships on a fresh feat_ppg.
-        c = _conn()
+        c = _conn(self)
         cols = {r[1] for r in c.execute("PRAGMA table_info(feat_ppg)")}
         self.assertIn("burst_index", cols)
 
@@ -37,6 +39,7 @@ def test_burst_index_migration_is_idempotent_on_legacy_db(self):
         # A pre-PR#553 DB has feat_ppg WITHOUT burst_index; apply_schema must ALTER it in once, and a
         # second apply must be a no-op (never raise "duplicate column").
         c = sqlite3.connect(":memory:")
+        self.addCleanup(c.close)
         c.executescript(
             "CREATE TABLE feat_ppg (device_id INTEGER NOT NULL, unix INTEGER NOT NULL, "
             "sample_idx INTEGER NOT NULL, channel INTEGER NOT NULL, value INTEGER NOT NULL, "
@@ -149,7 +152,7 @@ def test_metadata_type_skipped(self):
 
 class ApplyRowsTests(unittest.TestCase):
     def test_inserts_all_tables(self):
-        c = _conn()
+        c = _conn(self)
         mapped = [
             df.feature_to_rows(_rec(47, {"heart_rate": 95, "rr_intervals": [600, 610]})),
             df.feature_to_rows(_rec(47, {"ppg_waveform": [1, 2], "burst_index": 3}, unix=1001, version=26)),
@@ -165,7 +168,7 @@ def test_inserts_all_tables(self):
         self.assertEqual((ch, bi), (0, 3))
 
     def test_idempotent(self):
-        c = _conn()
+        c = _conn(self)
         mapped = [df.feature_to_rows(_rec(47, {"heart_rate": 95, "rr_intervals": [600]}))]
         df.apply_rows(c, 1, mapped)
         df.apply_rows(c, 1, mapped)  # second time changes nothing
@@ -173,7 +176,7 @@ def test_idempotent(self):
         self.assertEqual(c.execute("SELECT COUNT(*) FROM feat_rr").fetchone()[0], 1)
 
     def test_coalesce_merges_partial_seconds(self):
-        c = _conn()
+        c = _conn(self)
         # scalar-only second, then ppg-only at SAME unix must not clobber hr.
         df.apply_rows(c, 1, [df.feature_to_rows(_rec(47, {"heart_rate": 88}, unix=1000))])
         df.apply_rows(c, 1, [df.feature_to_rows(_rec(47, {"gravity_x": 0.5}, unix=1000, version=18))])
@@ -286,6 +289,11 @@ def frames_after(self, did, after_id):
 
 
 class DecodeNewTests(unittest.TestCase):
+    def _db(self):
+        db = _FakeDB(self._frames())
+        self.addCleanup(db.db.close)
+        return db
+
     def _frames(self):
         return [
             (1, "aa", "6108", 10, 1000, 95, 47),
@@ -302,7 +310,7 @@ def _decoder(self, records):
         ]
 
     def test_decodes_and_advances_cursor(self):
-        fdb = _FakeDB(self._frames())
+        fdb = self._db()
         res = df.decode_new(fdb, 1, decode_fn=self._decoder)
         self.assertEqual(res["frames"], 3)
         self.assertEqual(res["skipped"], 1)              # the inner_type-49 frame
@@ -310,19 +318,19 @@ def test_decodes_and_advances_cursor(self):
         self.assertEqual(fdb.state(1)["last_decoded_frame_id"], "3")
 
     def test_incremental_second_run_is_noop(self):
-        fdb = _FakeDB(self._frames())
+        fdb = self._db()
         df.decode_new(fdb, 1, decode_fn=self._decoder)
         res2 = df.decode_new(fdb, 1, decode_fn=self._decoder)
         self.assertEqual(res2["frames"], 0)              # cursor past all frames
 
     def test_full_redecodes_from_zero(self):
-        fdb = _FakeDB(self._frames())
+        fdb = self._db()
         df.decode_new(fdb, 1, decode_fn=self._decoder)
         res = df.decode_new(fdb, 1, full=True, decode_fn=self._decoder)
         self.assertEqual(res["frames"], 3)               # full ignores the cursor
 
     def test_decoder_count_mismatch_raises(self):
-        fdb = _FakeDB(self._frames())   # 3 frames
+        fdb = self._db()   # 3 frames
         short = lambda records: [_dec_obj([_fld("heart_rate", 95, "hr")])]  # returns only 1
         with self.assertRaises(RuntimeError):
             df.decode_new(fdb, 1, decode_fn=short)
diff --git a/Tools/linux-capture/test_validate_spo2_candidate.py b/Tools/linux-capture/test_validate_spo2_candidate.py
index 155eaff60d..5e8bcf1113 100644
--- a/Tools/linux-capture/test_validate_spo2_candidate.py
+++ b/Tools/linux-capture/test_validate_spo2_candidate.py
@@ -6,18 +6,65 @@
 
 from __future__ import annotations
 
+import builtins
+import io
 import json
 import os
 import sqlite3
 import struct
 import tempfile
 import unittest
+from unittest import mock
 from datetime import datetime, timezone
 
 import validate_spo2_candidate as vs
 from test_whoop_activity import make_v18
 
 
+class EncodingPortabilityTests(unittest.TestCase):
+    """Exercise Windows-like non-UTF-8 defaults without requiring a Windows host."""
+
+    def test_capture_json_is_read_as_utf8_under_cp1252_default(self):
+        with tempfile.TemporaryDirectory() as td:
+            path = os.path.join(td, "capture.json")
+            expected = [{"hex": "aa", "device": "München"}]
+            with builtins.open(path, "w", encoding="utf-8") as f:
+                json.dump(expected, f, ensure_ascii=False)
+
+            real_open = builtins.open
+
+            def cp1252_default_open(*args, **kwargs):
+                mode = args[1] if len(args) > 1 else kwargs.get("mode", "r")
+                if "b" not in mode and "encoding" not in kwargs:
+                    kwargs["encoding"] = "cp1252"
+                return real_open(*args, **kwargs)
+
+            with mock.patch("builtins.open", side_effect=cp1252_default_open):
+                self.assertEqual(vs.load_frame_records(path), expected)
+
+    def test_postable_summary_prints_to_cp1252_console(self):
+        result = {
+            "device": "strap-a",
+            "classification": "feature_absent",
+            "paired_nights": 0,
+            "r": None,
+            "mae": None,
+            "bias": None,
+            "best_specificity_offset": None,
+            "duty": None,
+            "median_window_coverage": None,
+            "checklist": {"pass": False},
+        }
+        raw = io.BytesIO()
+        console = io.TextIOWrapper(raw, encoding="cp1252")
+        with mock.patch.object(vs.sys, "stdout", console):
+            vs.configure_utf8_stdio()
+            print(vs.format_postable([result]))
+            console.flush()
+        self.assertEqual(console.encoding, "utf-8")
+        self.assertIn("need ≥5 paired nights".encode(), raw.getvalue())
+
+
 def _utc(y, m, d, hh=0, mm=0, ss=0) -> int:
     return int(datetime(y, m, d, hh, mm, ss, tzinfo=timezone.utc).timestamp())
 
@@ -102,7 +149,7 @@ def _write_export(folder: str, nights: list[tuple[str, float, int, int]]) -> str
         s0 = datetime.fromtimestamp(t0, tz=timezone.utc).strftime("%Y-%m-%d %H:%M:%S")
         s1 = datetime.fromtimestamp(t1, tz=timezone.utc).strftime("%Y-%m-%d %H:%M:%S")
         lines.append(f"{start},,{spo2:.2f},{s0},{s1}\n")
-    with open(path, "w") as f:
+    with open(path, "w", encoding="utf-8") as f:
         f.writelines(lines)
     return folder
 
@@ -136,7 +183,7 @@ def test_recovers_perfect_correlation_across_nights(self):
 
         with tempfile.TemporaryDirectory() as td:
             cap = os.path.join(td, "capture.json")
-            with open(cap, "w") as f:
+            with open(cap, "w", encoding="utf-8") as f:
                 json.dump(frames, f)
             exp = _write_export(td, exports)
             res = vs.validate_device(cap, exp, device="planted-a")
@@ -154,11 +201,11 @@ def test_incomplete_nights_without_export_spo2_are_skipped(self):
         frames = _plant_night(t0, t1, 97)
         with tempfile.TemporaryDirectory() as td:
             cap = os.path.join(td, "capture.json")
-            with open(cap, "w") as f:
+            with open(cap, "w", encoding="utf-8") as f:
                 json.dump(frames, f)
             # Export row with empty SpO₂ — must not pair.
             path = os.path.join(td, "physiological_cycles.csv")
-            with open(path, "w") as f:
+            with open(path, "w", encoding="utf-8") as f:
                 f.write(
                     "Cycle start time,Blood oxygen %,Sleep onset,Wake onset\n"
                     "2026-06-10 23:00:00,,"
@@ -182,7 +229,7 @@ def test_awake_samples_do_not_contribute(self):
             rec["hex"] = bytes(f).hex()
         with tempfile.TemporaryDirectory() as td:
             cap = os.path.join(td, "capture.json")
-            with open(cap, "w") as f:
+            with open(cap, "w", encoding="utf-8") as f:
                 json.dump(frames, f)
             start = datetime.fromtimestamp(t0, tz=timezone.utc).strftime("%Y-%m-%d %H:%M:%S")
             exp = _write_export(td, [(start, 97.0, t0, t1)])
@@ -204,7 +251,7 @@ def test_offset_specificity_prefers_true_offset(self):
             exports.append((start, float(spo2), t0, t1))
         with tempfile.TemporaryDirectory() as td:
             cap = os.path.join(td, "capture.json")
-            with open(cap, "w") as f:
+            with open(cap, "w", encoding="utf-8") as f:
                 json.dump(frames, f)
             exp = _write_export(td, exports)
             res = vs.validate_device(cap, exp, device="spec")
@@ -222,7 +269,7 @@ def test_postable_summary_has_no_raw_values(self):
             exports.append((start, float(spo2), t0, t1))
         with tempfile.TemporaryDirectory() as td:
             cap = os.path.join(td, "capture.json")
-            with open(cap, "w") as f:
+            with open(cap, "w", encoding="utf-8") as f:
                 json.dump(frames, f)
             exp = _write_export(td, exports)
             res = vs.validate_device(cap, exp, device="post")
@@ -248,7 +295,7 @@ def make_device(td, label, spo2s):
                 )
                 exports.append((start, float(spo2), t0, t1))
             cap = os.path.join(td, f"{label}.json")
-            with open(cap, "w") as f:
+            with open(cap, "w", encoding="utf-8") as f:
                 json.dump(frames, f)
             exp_dir = os.path.join(td, label)
             os.makedirs(exp_dir)
@@ -259,7 +306,7 @@ def make_device(td, label, spo2s):
             a = make_device(td, "strap-a", [95, 96, 97, 98, 94, 99])
             b = make_device(td, "strap-b", [93, 94, 95, 96, 97, 98])
             batch = os.path.join(td, "devices.json")
-            with open(batch, "w") as f:
+            with open(batch, "w", encoding="utf-8") as f:
                 json.dump([a, b], f)
             rc = vs.main(["--batch", batch, "--postable"])
             self.assertEqual(rc, 0)
@@ -307,7 +354,7 @@ def test_detects_sqlite_by_header_not_extension(self):
 
     def test_json_captures_still_load_unchanged(self):
         path = tempfile.mktemp(suffix=".json")
-        with open(path, "w") as f:
+        with open(path, "w", encoding="utf-8") as f:
             json.dump([{"hex": make_v18(sleep_state=2, aux_byte_82=94).hex()}], f)
         self.addCleanup(lambda: os.path.exists(path) and os.unlink(path))
         self.assertFalse(vs.looks_like_sqlite(path))
@@ -471,7 +518,7 @@ def test_coverage_is_reported_per_night_and_low_nights_are_flagged(self):
         frames = [f for f in self.frames if _unix_of(f) < self.t0 + 3600]
         with tempfile.TemporaryDirectory() as td:
             cap = os.path.join(td, "capture.json")
-            with open(cap, "w") as fh:
+            with open(cap, "w", encoding="utf-8") as fh:
                 json.dump(frames, fh)
             start = datetime.fromtimestamp(self.t0, tz=timezone.utc).strftime("%Y-%m-%d %H:%M:%S")
             exp = _write_export(td, [(start, 96.0, self.t0, self.t1)])
@@ -534,7 +581,7 @@ def _device(self, td, *, spo2s, neighbor_offset, neighbor_values, jitter):
             start = datetime.fromtimestamp(t0, tz=timezone.utc).strftime("%Y-%m-%d %H:%M:%S")
             exports.append((start, float(spo2), t0, t1))
         cap = os.path.join(td, "capture.json")
-        with open(cap, "w") as f:
+        with open(cap, "w", encoding="utf-8") as f:
             json.dump(frames, f)
         return cap, _write_export(td, exports)
 
@@ -568,7 +615,7 @@ def test_the_floor_also_gates_82_itself(self):
             exports.append((start, float(spo2), t0, t1))
         with tempfile.TemporaryDirectory() as td:
             cap = os.path.join(td, "capture.json")
-            with open(cap, "w") as f:
+            with open(cap, "w", encoding="utf-8") as f:
                 json.dump(frames, f)
             res = vs.validate_device(cap, _write_export(td, exports), device="flat82")
         self.assertEqual(res["inband_distinct_82"], 2)
@@ -601,7 +648,7 @@ def _flat_zero_device(self, td, label, *, n_records=851, step_s=5):
             for i in range(n_records)
         ]
         cap = os.path.join(td, f"{label}.json")
-        with open(cap, "w") as f:
+        with open(cap, "w", encoding="utf-8") as f:
             json.dump(frames, f)
         exp_dir = os.path.join(td, label)
         os.makedirs(exp_dir)
@@ -639,7 +686,7 @@ def passing(td, label, spo2s):
                 start = datetime.fromtimestamp(t0, tz=timezone.utc).strftime("%Y-%m-%d %H:%M:%S")
                 exports.append((start, float(spo2), t0, t1))
             cap = os.path.join(td, f"{label}.json")
-            with open(cap, "w") as f:
+            with open(cap, "w", encoding="utf-8") as f:
                 json.dump(frames, f)
             exp_dir = os.path.join(td, label)
             os.makedirs(exp_dir)
@@ -692,7 +739,7 @@ def test_an_aliased_capture_of_a_WORKING_strap_is_not_reported_absent(self):
                 start = datetime.fromtimestamp(t0, tz=timezone.utc).strftime("%Y-%m-%d %H:%M:%S")
                 nights.append((start, 95.0, t0, t1))
             cap = os.path.join(td, "aliased.json")
-            with open(cap, "w") as f:
+            with open(cap, "w", encoding="utf-8") as f:
                 json.dump(frames, f)
             res = vs.validate_device(cap, _write_export(td, nights), device="aliased")
         self.assertEqual(res["duty"]["n_nonzero"], 0)      # the strap works; the capture missed it
@@ -710,7 +757,7 @@ def test_a_dense_burst_plus_one_far_later_record_cannot_claim_absence(self):
                 {"hex": make_v18(unix=u, sleep_state=2, hr=52, aux_byte_82=0).hex()} for u in stamps
             ]
             cap = os.path.join(td, "sparse.json")
-            with open(cap, "w") as f:
+            with open(cap, "w", encoding="utf-8") as f:
                 json.dump(frames, f)
             exp_dir = os.path.join(td, "sparse")
             os.makedirs(exp_dir)
@@ -727,7 +774,7 @@ def _asleep_device(self, td, label, stamps):
             {"hex": make_v18(unix=u, sleep_state=st, hr=52, aux_byte_82=0).hex()} for u, st in stamps
         ]
         cap = os.path.join(td, f"{label}.json")
-        with open(cap, "w") as f:
+        with open(cap, "w", encoding="utf-8") as f:
             json.dump(frames, f)
         exp_dir = os.path.join(td, label)
         os.makedirs(exp_dir)
@@ -789,7 +836,7 @@ def test_postable_still_carries_no_raw_spo2_values(self):
                 start = datetime.fromtimestamp(t0, tz=timezone.utc).strftime("%Y-%m-%d %H:%M:%S")
                 nights.append((start, float(s), t0, t1))
             cap = os.path.join(td, "vals.json")
-            with open(cap, "w") as f:
+            with open(cap, "w", encoding="utf-8") as f:
                 json.dump(frames, f)
             res = vs.validate_device(cap, _write_export(td, nights), device="vals")
         blob = vs.format_postable([res])
@@ -886,7 +933,7 @@ def test_app_store_is_told_apart_from_a_capture_store(self):
             app = _write_app_db(td, [(1700000000, 96, 2)])
             self.assertTrue(vs.looks_like_app_db(app))
             cap = os.path.join(td, "cap.json")
-            with open(cap, "w") as f:
+            with open(cap, "w", encoding="utf-8") as f:
                 json.dump([], f)
             self.assertFalse(vs.looks_like_app_db(cap))
 
@@ -975,6 +1022,6 @@ def _six_night_capture(self, td: str) -> dict:
                 frames.append({"hex": make_v18(t0 + k * 60, aux_byte_82=int(round(spo2)),
                                                sleep_state=vs.SLEEP_ASLEEP).hex()})
         cap = os.path.join(td, "cap.json")
-        with open(cap, "w") as f:
+        with open(cap, "w", encoding="utf-8") as f:
             json.dump(frames, f)
         return {"capture": cap, "export": _write_export(td, nights)}
diff --git a/Tools/linux-capture/test_whoop_spot_hrv.py b/Tools/linux-capture/test_whoop_spot_hrv.py
index f756558a10..f5b1bf4100 100644
--- a/Tools/linux-capture/test_whoop_spot_hrv.py
+++ b/Tools/linux-capture/test_whoop_spot_hrv.py
@@ -5,10 +5,99 @@
 README documents and the only one in requirements.txt) or pytest.
 """
 import math
+import os
+import sqlite3
+import sys
+import tempfile
+from unittest import mock
 
 import whoop_spot_hrv as H
 
 
+def _empty_ppg_db():
+    fd, path = tempfile.mkstemp(suffix=".db")
+    os.close(fd)
+    con = sqlite3.connect(path)
+    con.execute(
+        "CREATE TABLE feat_ppg (device_id INTEGER, unix INTEGER, sample_idx INTEGER, "
+        "channel INTEGER, value INTEGER)"
+    )
+    con.close()
+    return path
+
+
+def _assert_connection_closed(con):
+    try:
+        con.execute("SELECT 1")
+    except sqlite3.ProgrammingError:
+        return
+    raise AssertionError("SQLite connection remained open")
+
+
+def _run_main_tracking_connection(path, *extra_args):
+    opened = []
+    real_connect = sqlite3.connect
+
+    def tracking_connect(*args, **kwargs):
+        con = real_connect(*args, **kwargs)
+        opened.append(con)
+        return con
+
+    argv = ["whoop_spot_hrv.py", "--db", path, "--device", "1", *extra_args]
+    with mock.patch.object(H.sqlite3, "connect", side_effect=tracking_connect), \
+            mock.patch.object(sys, "argv", argv):
+        result = H.main()
+    assert len(opened) == 1
+    return result, opened[0]
+
+
+def test_main_closes_database_on_normal_path():
+    path = _empty_ppg_db()
+    try:
+        result, con = _run_main_tracking_connection(path, "--start", "1", "--end", "2")
+        assert result == 0
+        _assert_connection_closed(con)
+    finally:
+        os.remove(path)
+
+
+def test_main_closes_database_on_no_windows_early_return():
+    path = _empty_ppg_db()
+    try:
+        result, con = _run_main_tracking_connection(path)
+        assert result == 1
+        _assert_connection_closed(con)
+    finally:
+        os.remove(path)
+
+
+def test_main_closes_database_when_query_raises():
+    path = _empty_ppg_db()
+    opened = []
+    real_connect = sqlite3.connect
+
+    def tracking_connect(*args, **kwargs):
+        con = real_connect(*args, **kwargs)
+        opened.append(con)
+        return con
+
+    argv = ["whoop_spot_hrv.py", "--db", path, "--device", "1"]
+    try:
+        with mock.patch.object(H.sqlite3, "connect", side_effect=tracking_connect), \
+                mock.patch.object(H, "_covered_windows", side_effect=RuntimeError("query failed")), \
+                mock.patch.object(sys, "argv", argv):
+            try:
+                H.main()
+            except RuntimeError as exc:
+                assert str(exc) == "query failed"
+            else:
+                raise AssertionError("expected query failure")
+        assert len(opened) == 1
+        _assert_connection_closed(opened[0])
+    finally:
+        os.remove(path)
+
+
 def _synth_ppg(fs, n_beats, ibi_ms, width_s=0.12):
     """A clean PPG-like waveform: a Gaussian pulse at each beat time given an IBI sequence."""
     beat_t = [0.5]
diff --git a/Tools/linux-capture/test_whoop_sync.py b/Tools/linux-capture/test_whoop_sync.py
index 3b41d52388..f9d6d999d1 100644
--- a/Tools/linux-capture/test_whoop_sync.py
+++ b/Tools/linux-capture/test_whoop_sync.py
@@ -8,9 +8,15 @@
 verified whoop5 offsets minus 4, and match the on-hardware HISTORY_END the strap serves.
 """
 
+import asyncio
 import os
+import sqlite3
+import sys
 import tempfile
+import threading
 import unittest
+from contextlib import suppress
+from unittest import mock
 
 import whoop_frame as wf
 import whoop_sync as ws
@@ -98,6 +104,89 @@ def setUp(self):
         self.tmp = tempfile.mkdtemp()
         self.db = ws.WhoopDB(os.path.join(self.tmp, "t.db"))
 
+    def tearDown(self):
+        self.db.close()
+
+    def test_context_manager_closes_on_normal_exit(self):
+        path = os.path.join(self.tmp, "normal.db")
+        with ws.WhoopDB(path) as db:
+            con = db.db
+            con.execute("SELECT 1")
+        with self.assertRaises(sqlite3.ProgrammingError):
+            con.execute("SELECT 1")
+
+    def test_context_manager_closes_on_exception(self):
+        path = os.path.join(self.tmp, "error.db")
+        with self.assertRaisesRegex(RuntimeError, "boom"):
+            with ws.WhoopDB(path) as db:
+                con = db.db
+                raise RuntimeError("boom")
+        with self.assertRaises(sqlite3.ProgrammingError):
+            con.execute("SELECT 1")
+
+    def test_constructor_closes_if_schema_initialization_fails(self):
+        opened = []
+        real_connect = sqlite3.connect
+
+        def tracking_connect(*args, **kwargs):
+            con = real_connect(*args, **kwargs)
+            opened.append(con)
+            return con
+
+        path = os.path.join(self.tmp, "init-error.db")
+        with mock.patch.object(ws.sqlite3, "connect", side_effect=tracking_connect), \
+                mock.patch.object(ws.decode_features, "apply_schema", side_effect=RuntimeError("boom")):
+            with self.assertRaisesRegex(RuntimeError, "boom"):
+                ws.WhoopDB(path)
+        self.assertEqual(len(opened), 1)
+        with self.assertRaises(sqlite3.ProgrammingError):
+            opened[0].execute("SELECT 1")
+
+    def test_database_outlives_cancelled_thread_commit(self):
+        """A cancelled to_thread await must not close SQLite while its worker still commits."""
+        started = threading.Event()
+        release = threading.Event()
+        errors = []
+        db_path = os.path.join(self.tmp, "cancelled-commit.db")
+        real_close = ws.WhoopDB.close
+
+        def close_then_release(db):
+            real_close(db)
+            release.set()
+
+        async def candidate_run(args, db):
+            did = db.upsert_device("AA:BB:CC:DD:EE:FF", model="whoop4")
+            frame = (1, "61080005", 47, 1000, 60, "aa01")
+
+            def delayed_commit():
+                started.set()
+                release.wait(timeout=0.3)
+                try:
+                    db.commit_chunk(did, [frame], trim=1, complete=False)
+                except Exception as exc:
+                    errors.append(exc)
+
+            task = asyncio.create_task(asyncio.to_thread(delayed_commit))
+
+            async def wait_until_started():
+                while not started.is_set():
+                    await asyncio.sleep(0.005)
+
+            await asyncio.wait_for(wait_until_started(), timeout=1.0)
+            task.cancel()
+            with suppress(asyncio.CancelledError):
+                await task
+
+        argv = ["whoop_sync.py", "sync", "--address", "AA:BB:CC:DD:EE:FF", "--db", db_path]
+        try:
+            with mock.patch.object(ws, "_run", side_effect=candidate_run), \
+                    mock.patch.object(ws.WhoopDB, "close", autospec=True, side_effect=close_then_release), \
+                    mock.patch.object(sys, "argv", argv):
+                ws.main()
+        finally:
+            release.set()
+        self.assertEqual(errors, [])
+
     def _frame(self, hexstr, t=47, unix=1000, hr=60):
         return (1, "61080005", t, unix, hr, hexstr)   # (recv_ms, char, inner_type, unix, hr, hex)
 
@@ -138,7 +227,7 @@ def test_export_json_roundtrip_and_filter(self):
         out = os.path.join(self.tmp, "o.json")
         n = self.db.export_json(did, out, only_type=47)
         self.assertEqual(n, 1)
-        with open(out) as f:
+        with open(out, encoding="utf-8") as f:
             recs = json.load(f)
         self.assertEqual(recs[0]["hex"], "aa01")
 
@@ -157,6 +246,9 @@ def setUp(self):
         self.tmp = tempfile.mkdtemp()
         self.db = ws.WhoopDB(os.path.join(self.tmp, "t.db"))
 
+    def tearDown(self):
+        self.db.close()
+
     def _frame(self, hexstr, t=47, unix=1000, hr=60):
         return (1, "61080005", t, unix, hr, hexstr)   # (recv_ms, char, inner_type, unix, hr, hex)
 
diff --git a/Tools/linux-capture/validate_spo2_candidate.py b/Tools/linux-capture/validate_spo2_candidate.py
index 5a843831d0..2768af0be1 100644
--- a/Tools/linux-capture/validate_spo2_candidate.py
+++ b/Tools/linux-capture/validate_spo2_candidate.py
@@ -81,6 +81,7 @@
 from datetime import datetime, timezone
 from typing import Dict, Iterable, List, Optional, Sequence, Tuple
 
+from capture_io import configure_utf8_stdio
 import whoop_activity as wa
 import whoop_frame as wf
 
@@ -151,6 +152,7 @@
 MIN_DISTINCT_INBAND = 5
 MIN_INBAND_STDEV = 0.5
 
+
 # English + localized cycle headers → canonical keys (mirrors StrandImport HeaderNorm subset).
 HEADER_ALIASES = {
     # English (official export; lowercase after norm)
@@ -467,7 +469,7 @@ def load_frame_records(path: str, *, device_id: int = 2) -> List[dict]:
             )
         return [{"hex": r[0]} for r in rows]
 
-    with open(path) as f:
+    with open(path, encoding="utf-8") as f:
         capture = json.load(f)
     if not isinstance(capture, list):
         raise SystemExit(f"{path}: expected a JSON list of frame records, or a whoop_sync.py .db")
@@ -1151,6 +1153,7 @@ def format_postable(results: Sequence[dict]) -> str:
 # --- CLI -------------------------------------------------------------------------------------------
 
 def main(argv: Optional[Sequence[str]] = None) -> int:
+    configure_utf8_stdio()
     p = argparse.ArgumentParser(
         description="Validate WHOOP 5/MG v18 spo2_candidate_82 against a CSV export (#103)."
     )
@@ -1205,7 +1208,7 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
     results: List[dict] = []
 
     if args.batch:
-        with open(args.batch) as f:
+        with open(args.batch, encoding="utf-8") as f:
             batch = json.load(f)
         if not isinstance(batch, list) or not batch:
             print("batch file must be a non-empty JSON list", file=sys.stderr)
diff --git a/Tools/linux-capture/whoop_activity.py b/Tools/linux-capture/whoop_activity.py
index c32caaadd6..f2b7f611ef 100644
--- a/Tools/linux-capture/whoop_activity.py
+++ b/Tools/linux-capture/whoop_activity.py
@@ -151,26 +151,30 @@ def sleep_state_minutes(recs):
 import json
 import datetime as _dt
 
+from capture_io import configure_utf8_stdio
+
 DEFAULT_DB = "captures/whoop4.db"
 
 
 def records(db_path=DEFAULT_DB, device_id=2, start=None, end=None):
     """Decoded v18 records (time-ordered) from the frames table."""
     con = sqlite3.connect(db_path)
-    q = "SELECT hex FROM frames WHERE device_id=? AND inner_type=47"
-    args = [device_id]
-    if start is not None:
-        q += " AND unix>=?"; args.append(start)
-    if end is not None:
-        q += " AND unix<?"; args.append(end)
-    q += " ORDER BY unix"
-    out = []
-    for (hx,) in con.execute(q, args):
-        d = decode_v18(bytes.fromhex(hx))
-        if d is not None:
-            out.append(d)
-    con.close()
-    return out
+    try:
+        q = "SELECT hex FROM frames WHERE device_id=? AND inner_type=47"
+        args = [device_id]
+        if start is not None:
+            q += " AND unix>=?"; args.append(start)
+        if end is not None:
+            q += " AND unix<?"; args.append(end)
+        q += " ORDER BY unix"
+        out = []
+        for (hx,) in con.execute(q, args):
+            d = decode_v18(bytes.fromhex(hx))
+            if d is not None:
+                out.append(d)
+        return out
+    finally:
+        con.close()
 
 
 def _day_bounds(day):
@@ -233,4 +237,5 @@ def main(argv=None):
 
 
 if __name__ == "__main__":
+    configure_utf8_stdio()
     main()
diff --git a/Tools/linux-capture/whoop_buzz.py b/Tools/linux-capture/whoop_buzz.py
index 340dbe1b1b..9b769e081e 100644
--- a/Tools/linux-capture/whoop_buzz.py
+++ b/Tools/linux-capture/whoop_buzz.py
@@ -40,6 +40,7 @@
 from bleak import BleakClient, BleakScanner
 from bleak.exc import BleakError
 
+from capture_io import configure_utf8_stdio
 import whoop_frame as wf
 
 log = logging.getLogger("whoop_buzz")
@@ -294,4 +295,5 @@ def main() -> int:
 
 
 if __name__ == "__main__":
+    configure_utf8_stdio()
     sys.exit(main())
diff --git a/Tools/linux-capture/whoop_capture.py b/Tools/linux-capture/whoop_capture.py
index 976d2d65d5..e48240fe23 100644
--- a/Tools/linux-capture/whoop_capture.py
+++ b/Tools/linux-capture/whoop_capture.py
@@ -29,6 +29,7 @@
 
 from bleak import BleakClient, BleakScanner
 
+from capture_io import configure_utf8_stdio
 import whoop_frame as wf
 
 # --- GATT UUIDs (from docs/BLE_REVERSE_ENGINEERING.md) ---------------------------------------------
@@ -146,7 +147,7 @@ def flush(self):
         if not self.records:
             return
         tmp = self.out_path + ".tmp"
-        with open(tmp, "w") as f:
+        with open(tmp, "w", encoding="utf-8") as f:
             json.dump(self.records, f, indent=1)
         import os
         os.replace(tmp, self.out_path)
@@ -496,4 +497,5 @@ def main():
 
 
 if __name__ == "__main__":
+    configure_utf8_stdio()
     main()
diff --git a/Tools/linux-capture/whoop_probe.py b/Tools/linux-capture/whoop_probe.py
index 5c359665de..ed926c17db 100644
--- a/Tools/linux-capture/whoop_probe.py
+++ b/Tools/linux-capture/whoop_probe.py
@@ -16,6 +16,7 @@
 
 from bleak import BleakClient, BleakScanner
 
+from capture_io import configure_utf8_stdio
 import whoop_frame as wf
 
 WHOOP4 = {
@@ -147,4 +148,5 @@ def main():
 
 
 if __name__ == "__main__":
+    configure_utf8_stdio()
     main()
diff --git a/Tools/linux-capture/whoop_setclock.py b/Tools/linux-capture/whoop_setclock.py
index f8067015fa..d52eb659d5 100644
--- a/Tools/linux-capture/whoop_setclock.py
+++ b/Tools/linux-capture/whoop_setclock.py
@@ -25,6 +25,7 @@
 
 from bleak import BleakClient, BleakScanner
 
+from capture_io import configure_utf8_stdio
 import whoop_frame as wf
 
 FAMILIES = {
@@ -167,4 +168,5 @@ def main():
 
 
 if __name__ == "__main__":
+    configure_utf8_stdio()
     main()
diff --git a/Tools/linux-capture/whoop_spot_hrv.py b/Tools/linux-capture/whoop_spot_hrv.py
index 8c9bd24b80..e58b3ca5bf 100644
--- a/Tools/linux-capture/whoop_spot_hrv.py
+++ b/Tools/linux-capture/whoop_spot_hrv.py
@@ -27,6 +27,7 @@
 from collections import Counter
 from statistics import median, pstdev
 
+from capture_io import configure_utf8_stdio
 
 # ---------------------------------------------------------------- validated DSP (pure)
 
@@ -159,7 +160,13 @@ def main():
     args = ap.parse_args()
     # Read-only: open the DB in immutable/ro mode so this analysis tool can never write to whoop.db.
     con = sqlite3.connect(f"file:{args.db}?mode=ro", uri=True)
+    try:
+        return _run(args, con)
+    finally:
+        con.close()
 
+
+def _run(args, con):
     windows = [(args.start, args.end)] if args.start and args.end else _covered_windows(con, args.device, args.channel)
     if not windows:
         print("no PPG-covered windows (need v26 optical bursts in feat_ppg for this device)")
@@ -179,4 +186,5 @@ def main():
 
 
 if __name__ == "__main__":
+    configure_utf8_stdio()
     raise SystemExit(main())
diff --git a/Tools/linux-capture/whoop_sync.py b/Tools/linux-capture/whoop_sync.py
index 0d163db5d5..eb33b25314 100644
--- a/Tools/linux-capture/whoop_sync.py
+++ b/Tools/linux-capture/whoop_sync.py
@@ -61,8 +61,9 @@
 import sys
 import time
 
-import whoop_frame as wf
 import decode_features
+import whoop_frame as wf
+from capture_io import configure_utf8_stdio
 
 # `bleak` is imported lazily inside the BLE functions (run/_acquire) so this module's frame helpers,
 # Family, and WhoopDB can be imported and unit-tested with no third-party deps (like test_whoop_frame).
@@ -202,11 +203,24 @@ class WhoopDB:
     def __init__(self, path):
         os.makedirs(os.path.dirname(os.path.abspath(path)) or ".", exist_ok=True)
         self.db = sqlite3.connect(path, check_same_thread=False)
-        self.db.executescript(SCHEMA)
-        decode_features.apply_schema(self.db)
-        self.db.execute("PRAGMA journal_mode=WAL")
-        self.db.execute("PRAGMA synchronous=FULL")
-        self.db.commit()
+        try:
+            self.db.executescript(SCHEMA)
+            decode_features.apply_schema(self.db)
+            self.db.execute("PRAGMA journal_mode=WAL")
+            self.db.execute("PRAGMA synchronous=FULL")
+            self.db.commit()
+        except BaseException:
+            self.db.close()
+            raise
+
+    def close(self):
+        self.db.close()
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc_value, traceback):
+        self.close()
 
     def upsert_device(self, address, name=None, subject=None, model=None):
         address = address.upper()
@@ -280,7 +294,7 @@ def export_json(self, did, out_path, only_type=None, since=None):
         recs = [{"hex": h, "char": c, "ts_ms": (rm or 0), "hr": hr} for h, c, rm, hr in rows]
         os.makedirs(os.path.dirname(os.path.abspath(out_path)) or ".", exist_ok=True)
         tmp = out_path + ".tmp"
-        with open(tmp, "w") as f:
+        with open(tmp, "w", encoding="utf-8") as f:
             json.dump(recs, f, indent=1)
         os.replace(tmp, out_path)
         return len(recs)
@@ -681,14 +695,17 @@ async def watchdog():
     return outcome["v"], s.committed - start
 
 
-async def run_realtime(args):
+async def run_realtime(args, db):
+    return await _run_realtime(args, db)
+
+
+async def _run_realtime(args, db):
     """Capture the live realtime stream (HR + R-R + IMU) into the durable store, reconnecting on drops
     until --duration elapses, then decode → feat_rr so HRV/RSA can run. The realtime counterpart of the
     offload `run()`; reuses the same _acquire + MTU-negotiated reconnect loop + WhoopDB."""
     from bleak import BleakClient
     from bleak.exc import BleakError
     fam = Family(args.model)
-    db = WhoopDB(args.db)
     if not args.no_clock_check:
         await preflight_clock(fam, args)
     dev = await _acquire(args.address, tries=args.tries)
@@ -751,11 +768,14 @@ async def run_realtime(args):
         print(f"  decode skipped ({e}); run `whoop_sync.py decode --db {args.db}`.", flush=True)
 
 
-async def run(args):
+async def run(args, db):
+    return await _run(args, db)
+
+
+async def _run(args, db):
     from bleak import BleakClient
     from bleak.exc import BleakError
     fam = Family(args.model)
-    db = WhoopDB(args.db)
     if not args.no_clock_check:
         await preflight_clock(fam, args)
     dev = await _acquire(args.address, tries=args.tries)
@@ -781,7 +801,7 @@ async def run(args):
         s.emit = sys.stdout
         sys.stdout = sys.stderr               # subsequent print() diagnostics → stderr
     elif emit_target:
-        s.emit = open(emit_target, "w")
+        s.emit = open(emit_target, "w", encoding="utf-8")
     if s.emit is not None:
         s.emit.write(json.dumps({"_header": {"device_id": did, "address": info[0],
                                              "name": info[1], "model": args.model}}) + "\n")
@@ -980,48 +1000,55 @@ def main():
 
     if cmd == "sync":
         try:
-            asyncio.run(run(args))
+            with WhoopDB(args.db) as db:
+                asyncio.run(run(args, db))
         except KeyboardInterrupt:
             pass
     elif cmd == "realtime":
         try:
-            asyncio.run(run_realtime(args))
+            with WhoopDB(args.db) as db:
+                asyncio.run(run_realtime(args, db))
         except KeyboardInterrupt:
             pass
     elif cmd == "export":
-        db = WhoopDB(args.db); did = _need_device(db, args.address)
-        since = _parse_time(args.since) if args.since else None
-        print(f"exported {db.export_json(did, args.out, args.only_type, since)} frames → {args.out}")
+        with WhoopDB(args.db) as db:
+            did = _need_device(db, args.address)
+            since = _parse_time(args.since) if args.since else None
+            print(f"exported {db.export_json(did, args.out, args.only_type, since)} frames → {args.out}")
     elif cmd == "status":
-        db = WhoopDB(args.db); did = _need_device(db, args.address)
-        info = db.device_info(did); st = db.state(did); cov = db.coverage(did)
-        print(f"db: {args.db}")
-        print(f"  device: {info[0]} name={info[1]!r} subject={info[2]!r} model={info[3]}")
-        print(f"  cursor last_trim={st.get('last_trim','?')} history_complete={st.get('history_complete','0')}")
-        print(f"  coverage: {_fmt(cov[0])} → {_fmt(cov[1])}  ({cov[2] or 0} type-47)")
-        print(f"  counts by type: {db.counts(did)}")
-        labs = db.labels(did)
-        print(f"  labels ({len(labs)}):")
-        for s_, e_, a_, n_ in labs:
-            print(f"    {a_:12s} {_fmt(s_)} → {_fmt(e_)}  {n_ or ''}")
+        with WhoopDB(args.db) as db:
+            did = _need_device(db, args.address)
+            info = db.device_info(did); st = db.state(did); cov = db.coverage(did)
+            print(f"db: {args.db}")
+            print(f"  device: {info[0]} name={info[1]!r} subject={info[2]!r} model={info[3]}")
+            print(f"  cursor last_trim={st.get('last_trim','?')} history_complete={st.get('history_complete','0')}")
+            print(f"  coverage: {_fmt(cov[0])} → {_fmt(cov[1])}  ({cov[2] or 0} type-47)")
+            print(f"  counts by type: {db.counts(did)}")
+            labs = db.labels(did)
+            print(f"  labels ({len(labs)}):")
+            for s_, e_, a_, n_ in labs:
+                print(f"    {a_:12s} {_fmt(s_)} → {_fmt(e_)}  {n_ or ''}")
     elif cmd == "devices":
-        db = WhoopDB(args.db)
-        print(f"db: {args.db}")
-        for did, addr, nm, subj, mdl, n47, mn, mx in db.list_devices():
-            print(f"  [{did}] {addr} name={nm!r} subject={subj!r} model={mdl}  "
-                  f"{n47} type-47  {_fmt(mn)}→{_fmt(mx)}")
+        with WhoopDB(args.db) as db:
+            print(f"db: {args.db}")
+            for did, addr, nm, subj, mdl, n47, mn, mx in db.list_devices():
+                print(f"  [{did}] {addr} name={nm!r} subject={subj!r} model={mdl}  "
+                      f"{n47} type-47  {_fmt(mn)}→{_fmt(mx)}")
     elif cmd == "label":
-        db = WhoopDB(args.db); did = _need_device(db, args.address)
-        s_, e_ = _parse_time(args.start), _parse_time(args.end)
-        db.add_label(did, s_, e_, args.activity, args.note)
-        print(f"labeled {args.activity}: {_fmt(s_)} → {_fmt(e_)} for device {db.device_info(did)[0]}")
+        with WhoopDB(args.db) as db:
+            did = _need_device(db, args.address)
+            s_, e_ = _parse_time(args.start), _parse_time(args.end)
+            db.add_label(did, s_, e_, args.activity, args.note)
+            print(f"labeled {args.activity}: {_fmt(s_)} → {_fmt(e_)} for device {db.device_info(did)[0]}")
     elif cmd == "decode":
-        db = WhoopDB(args.db); did = _need_device(db, args.address)
-        res = decode_features.decode_new(db, did, full=args.full)
-        print(f"decode: {res['frames']} frames → feat_second updated "
-              f"({res['decoded']} decoded, {res['skipped']} skipped); "
-              f"cursor last_decoded_frame_id={res['cursor']}")
+        with WhoopDB(args.db) as db:
+            did = _need_device(db, args.address)
+            res = decode_features.decode_new(db, did, full=args.full)
+            print(f"decode: {res['frames']} frames → feat_second updated "
+                  f"({res['decoded']} decoded, {res['skipped']} skipped); "
+                  f"cursor last_decoded_frame_id={res['cursor']}")
 
 
 if __name__ == "__main__":
+    configure_utf8_stdio()
     main()

From 73f62b81709e203c1a2d8142b6e263e9718fbc67 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 12:16:15 +1200
Subject: [PATCH 262/333] ci: only run the Python tools workflow when the
 Python tools change

tools-python.yml had no path filter, so it ran on every pull request and every
push to main regardless of what changed. Six PRs merged today touched analytics,
BLE, settings and docs; linux-capture ran on all of them and could not have
learned anything from any.

That was already waste. It stopped being free when a Windows job joined the
workflow: Windows minutes bill at twice Linux, so every unrelated PR paid for a
runner whose inputs had not moved.

Filtered to Tools/** and the workflow file itself - the file so a change to the
job still exercises the job, which this PR demonstrated by running both jobs on
itself. Matches android.yml, swift-packages.yml and app-build.yml, which all
filter this way; this workflow was the one that did not.

Net effect is LESS CI than before the Windows job existed, not more. Both jobs
are otherwise untouched, including the windows-capture guard that fails when
discovery finds fewer than 200 tests.
---
 .github/workflows/tools-python.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/tools-python.yml b/.github/workflows/tools-python.yml
index be8dfcb1c5..114bfde183 100644
--- a/.github/workflows/tools-python.yml
+++ b/.github/workflows/tools-python.yml
@@ -21,10 +21,20 @@
 name: Tools Python CI
 
 on:
+  # Path-filtered like android.yml / swift-packages.yml / app-build.yml. Without this the workflow ran on
+  # EVERY pull request and every push to main, including the many that touch no Python at all - and with a
+  # Windows runner now in it, billed at twice a Linux minute, that is a real cost for a job whose inputs
+  # cannot have changed. The workflow file itself is included so a change to the job still tests itself.
   pull_request:
     branches: [main]
+    paths:
+      - 'Tools/**'
+      - '.github/workflows/tools-python.yml'
   push:
     branches: [main]
+    paths:
+      - 'Tools/**'
+      - '.github/workflows/tools-python.yml'
   workflow_dispatch:
 
 concurrency:

From df1c3cfb3d5bff3af248ccd9295bcb4d28fd0f5e Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 12:36:32 +1200
Subject: [PATCH 263/333] settings: centre the bar's transparency default, add
 notches, and keep the bar visible while it changes

The bar you already have sat at 6 of 8, so "less transparent" was a two-notch
afterthought beside a five-notch run the other way. The useful question at this
slider is "more see-through than now, or less?", and that reads off a thumb that
starts in the middle.

Eleven notches, default dead centre - five either side. The shipped 0.80 is still
exactly step 6, so an install that never touches this is unchanged, and the 0.30
floor is kept: a bar at zero alpha would still take taps, so a user could hide
their navigation and then not find the setting that hid it.

The halves move at different rates because that is the only way to get all three
asked-for properties at once. Centring 0.80 evenly means either giving up the
faint end - a symmetric range around 0.80 bottoms out at 0.60, less see-through
than this already offers - or running the solid end past 1.00, which does not
exist.

Also fixes something that made both controls hard to judge: reaching them means
scrolling DOWN, auto-hide reads that as "hide the bar", and neither a slider drag
nor a menu pick is a scroll - so a change landed on a bar the user could not see.
The bar is now pinned visible while its appearance is changing and for a moment
after, keyed on what the bar LOOKS like rather than on either control, so one
rule covers the slider and the dropdown and a future third control gets it free.
The pin can only ever show the bar, never hide one that would otherwise be up.

Verified: 5335 tests / 0 failures; doc-comment lint clean; no new strings.
---
 .../app/src/main/java/com/noop/ui/AppRoot.kt  | 29 +++++++++++++--
 .../main/java/com/noop/ui/BottomBarStyle.kt   | 31 ++++++++++++----
 .../main/java/com/noop/ui/SettingsScreen.kt   | 17 ++++++++-
 .../java/com/noop/ui/BottomBarAutoHideTest.kt | 35 +++++++++++++++++++
 .../java/com/noop/ui/BottomBarStyleTest.kt    | 32 +++++++++++++++--
 5 files changed, 132 insertions(+), 12 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ui/AppRoot.kt b/android/app/src/main/java/com/noop/ui/AppRoot.kt
index 21442fd184..60909d9b99 100644
--- a/android/app/src/main/java/com/noop/ui/AppRoot.kt
+++ b/android/app/src/main/java/com/noop/ui/AppRoot.kt
@@ -290,8 +290,12 @@ internal object MoreSectionPrefs {
  * translating the bar away would leave an empty band rather than handing the space back to content —
  * visibly worse than not hiding at all. Auto-hide only makes sense over content.
  */
-internal fun shouldHideBar(autoHide: Boolean, overlay: Boolean, scrollingDown: Boolean): Boolean =
-    autoHide && overlay && scrollingDown
+internal fun shouldHideBar(
+    autoHide: Boolean,
+    overlay: Boolean,
+    scrollingDown: Boolean,
+    pinned: Boolean = false,
+): Boolean = !pinned && autoHide && overlay && scrollingDown
 
 /**
  * #1839: does this scroll delta change the direction, or is it noise?
@@ -376,6 +380,24 @@ object BottomBarStyleStore {
     var scale by mutableStateOf(DEFAULT_SCALE)
         private set
 
+    /**
+     * Hold the bar visible regardless of auto-hide, while something is adjusting how it LOOKS.
+     *
+     * The transparency slider sits below the fold in Settings, so reaching it means scrolling down -
+     * which is exactly what auto-hide reads as "hide the bar". The control's live preview was therefore
+     * invisible at the moment it mattered, and touching the slider does not scroll, so nothing brought
+     * the bar back. Pinning while the drag is in flight is the narrowest fix: auto-hide is untouched as
+     * a setting, and the pin lasts only as long as a finger is down.
+     */
+    var previewPinned by mutableStateOf(false)
+        private set
+
+    /** Named `pinPreview` rather than `setPreviewPinned`: the latter is the property's own generated
+     *  setter, and declaring both is a JVM signature clash. */
+    fun pinPreview(value: Boolean) {
+        previewPinned = value
+    }
+
     /**
      * Move the bar NOW without persisting, for a slider drag.
      *
@@ -473,7 +495,8 @@ fun AppRoot(viewModel: AppViewModel = viewModel()) {
     // Boolean, and only on a movement past the threshold, so a fingertip tremor cannot flicker the bar.
     var scrollingDown by remember { mutableStateOf(false) }
     val reduceMotion = rememberReduceMotion()
-    val hidden = shouldHideBar(BottomBarStyleStore.autoHide, BottomBarStyleStore.overlay, scrollingDown)
+    val hidden = shouldHideBar(BottomBarStyleStore.autoHide, BottomBarStyleStore.overlay, scrollingDown,
+                               pinned = BottomBarStyleStore.previewPinned)
     val collapseTarget = barCollapseFraction(hidden, reduceMotion)
     // The transform is a graphicsLayer only — GPU, per frame, NO relayout — so content never reflows as
     // the bar comes and goes and scrolling stays smooth. (The approach #90 got right.)
diff --git a/android/app/src/main/java/com/noop/ui/BottomBarStyle.kt b/android/app/src/main/java/com/noop/ui/BottomBarStyle.kt
index c7ad8dc6be..ad4ee3e554 100644
--- a/android/app/src/main/java/com/noop/ui/BottomBarStyle.kt
+++ b/android/app/src/main/java/com/noop/ui/BottomBarStyle.kt
@@ -6,12 +6,15 @@ import kotlin.math.abs
 const val MIN_OPACITY_STEP = 1
 
 /** Solid. */
-const val MAX_OPACITY_STEP = 8
+const val MAX_OPACITY_STEP = 11
 
 /**
- * The step whose alpha is the SHIPPED 0.80, so an install that never opens this setting renders exactly
- * as it did before. Chosen by arithmetic rather than taste: the linear 0.30..1.00 mapping puts 0.80 on
- * step 6 precisely, which is why the range starts at 0.30 rather than a rounder number.
+ * The shipped 0.80, sitting at the exact CENTRE of the slider - five notches either side.
+ *
+ * Centred on purpose. The bar you already have is the reference point, so the useful question at the
+ * slider is "more see-through than now, or less?", and that reads off a thumb that starts in the middle.
+ * With the default at 6 of 8 it sat right of centre, which made "less transparent" look like a two-notch
+ * afterthought next to a five-notch run the other way.
  */
 const val DEFAULT_OPACITY_STEP = 6
 
@@ -22,7 +25,17 @@ const val DEFAULT_SCALE = 1f
 val BOTTOM_BAR_SCALES: List<Float> = listOf(1f, 1.25f, 1.5f, 1.75f, 2f)
 
 /**
- * The bar's glass alpha for an opacity step, linear from 0.30 (step 1) to 1.00 (step 8).
+ * The bar's glass alpha for an opacity step: 0.30 at step 1, the shipped 0.80 at the centre step 6, and
+ * 1.00 at step 11.
+ *
+ * The two halves move at DIFFERENT rates, which is deliberate and is the only way to get all three of
+ * the things being asked for at once. Centring 0.80 with an even rate would mean either giving up the
+ * faint end (a symmetric range around 0.80 bottoms out at 0.60, less see-through than this already
+ * offers) or pushing the solid end past 1.00, which does not exist. So the transparent half spends 0.10
+ * a notch across a wide range, and the solid half spends 0.04 across a narrow one.
+ *
+ * A user does not perceive that asymmetry as unevenness. The thumb starts centred, five notches each
+ * way, and each notch is a visible change in the direction they moved it - which is the whole contract.
  *
  * The floor is 0.30 rather than 0: a fully invisible bar would still take taps, so a user could hide the
  * navigation and then not find it again. 0.30 is faint enough to read as "nearly gone" while leaving the
@@ -30,7 +43,13 @@ val BOTTOM_BAR_SCALES: List<Float> = listOf(1f, 1.25f, 1.5f, 1.75f, 2f)
  */
 fun alphaForOpacityStep(step: Int): Float {
     val clamped = step.coerceIn(MIN_OPACITY_STEP, MAX_OPACITY_STEP)
-    return 0.30f + (clamped - MIN_OPACITY_STEP) * 0.10f
+    return if (clamped <= DEFAULT_OPACITY_STEP) {
+        // 0.30 -> 0.80 across steps 1..6
+        0.30f + (clamped - MIN_OPACITY_STEP) * 0.10f
+    } else {
+        // 0.80 -> 1.00 across steps 6..11
+        0.80f + (clamped - DEFAULT_OPACITY_STEP) * 0.04f
+    }
 }
 
 /**
diff --git a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
index 6f1fd70db7..0bc0b0f390 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
@@ -87,6 +87,7 @@ import androidx.compose.material3.TextButton
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.collectAsState
 import androidx.compose.runtime.DisposableEffect
+import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
@@ -141,6 +142,7 @@ import com.noop.update.UpdateCheck
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
+import kotlinx.coroutines.delay
 import kotlin.math.roundToInt
 import com.noop.analytics.ClockFormatPreference
 
@@ -1741,6 +1743,18 @@ fun SettingsScreen(
                     onCheckedChange = { BottomBarStyleStore.setAutoHide(context, it) },
                 )
             }
+            // Reaching either control below means scrolling DOWN, which auto-hide reads as "hide the
+            // bar" - so a change made here landed on a bar the user could not see, and neither a slider
+            // drag nor a menu pick is a scroll, so nothing brought it back.
+            //
+            // Keyed on what the bar LOOKS like rather than on either control, so one rule covers both: a
+            // drag restarts this every frame and stays pinned throughout, a menu pick fires it once, and
+            // either way the bar is held a moment longer so the result is visible after the finger lifts.
+            LaunchedEffect(BottomBarStyleStore.scale, BottomBarStyleStore.opacityStep) {
+                BottomBarStyleStore.pinPreview(true)
+                delay(1_500)
+                BottomBarStyleStore.pinPreview(false)
+            }
             SettingsRowDivider()
             // Size. A dropdown of fixed multipliers rather than a slider: these are the sizes worth
             // having, and a continuous control here mostly produces sizes a user cannot tell apart.
@@ -1790,7 +1804,8 @@ fun SettingsScreen(
                         BottomBarStyleStore.setOpacityStep(context, BottomBarStyleStore.opacityStep)
                     },
                     valueRange = MIN_OPACITY_STEP.toFloat()..MAX_OPACITY_STEP.toFloat(),
-                    // Compose counts the stops BETWEEN the ends, so eight stops is six.
+                    // Compose counts the stops BETWEEN the ends, so N notches is N-2. Derived, not
+                    // written out, so changing the notch count cannot leave this line disagreeing with it.
                     steps = MAX_OPACITY_STEP - MIN_OPACITY_STEP - 1,
                     colors = SliderDefaults.colors(
                         thumbColor = Palette.accent,
diff --git a/android/app/src/test/java/com/noop/ui/BottomBarAutoHideTest.kt b/android/app/src/test/java/com/noop/ui/BottomBarAutoHideTest.kt
index 42f1b6ede6..449f0f35d1 100644
--- a/android/app/src/test/java/com/noop/ui/BottomBarAutoHideTest.kt
+++ b/android/app/src/test/java/com/noop/ui/BottomBarAutoHideTest.kt
@@ -48,4 +48,39 @@ class BottomBarAutoHideTest {
         assertEquals(1f, barCollapseFraction(hidden = true, reduceMotion = false), 0f)
         assertEquals(0f, barCollapseFraction(hidden = false, reduceMotion = false), 0f)
     }
+
+    /**
+     * The pin beats auto-hide. Reaching the transparency slider means scrolling DOWN, which auto-hide
+     * reads as "hide the bar" - so without this the control's live preview was invisible at exactly the
+     * moment it exists for, and touching a slider does not scroll, so nothing brought the bar back.
+     */
+    @Test
+    fun `a pinned preview keeps the bar visible while scrolling down`() {
+        assertTrue(shouldHideBar(autoHide = true, overlay = true, scrollingDown = true))
+        assertFalse(shouldHideBar(autoHide = true, overlay = true, scrollingDown = true, pinned = true))
+    }
+
+    /** The pin only ever SHOWS the bar; it can never hide one that would otherwise be up. */
+    @Test
+    fun `pinning never hides a bar that would be visible`() {
+        for (auto in listOf(true, false)) {
+            for (overlay in listOf(true, false)) {
+                for (down in listOf(true, false)) {
+                    val unpinned = shouldHideBar(auto, overlay, down, pinned = false)
+                    val pinned = shouldHideBar(auto, overlay, down, pinned = true)
+                    assertFalse("pinned must never hide more than unpinned", pinned && !unpinned)
+                }
+            }
+        }
+    }
+
+    /** The default argument keeps every existing caller and case unchanged. */
+    @Test
+    fun `omitting the pin matches the old behaviour`() {
+        assertEquals(
+            shouldHideBar(autoHide = true, overlay = true, scrollingDown = true, pinned = false),
+            shouldHideBar(autoHide = true, overlay = true, scrollingDown = true),
+        )
+    }
+
 }
diff --git a/android/app/src/test/java/com/noop/ui/BottomBarStyleTest.kt b/android/app/src/test/java/com/noop/ui/BottomBarStyleTest.kt
index f492ffa5df..bf2bdf807c 100644
--- a/android/app/src/test/java/com/noop/ui/BottomBarStyleTest.kt
+++ b/android/app/src/test/java/com/noop/ui/BottomBarStyleTest.kt
@@ -15,15 +15,43 @@ class BottomBarStyleTest {
         assertEquals(0.80f, alphaForOpacityStep(DEFAULT_OPACITY_STEP), 0.0001f)
     }
 
-    @Test fun `the eight steps run from faint to solid`() {
+    @Test fun `the steps run from faint to solid`() {
         assertEquals(0.30f, alphaForOpacityStep(MIN_OPACITY_STEP), 0.0001f)
         assertEquals(1.00f, alphaForOpacityStep(MAX_OPACITY_STEP), 0.0001f)
         val all = (MIN_OPACITY_STEP..MAX_OPACITY_STEP).map { alphaForOpacityStep(it) }
-        assertEquals(8, all.size)
+        assertEquals(11, all.size)
         assertEquals(all.sorted(), all)
         assertEquals(all.distinct().size, all.size)
     }
 
+    /**
+     * THE property this exists for: the bar you already have sits at the CENTRE, so the slider reads as
+     * "more see-through than now" to the left and "less" to the right, with the same number of notches
+     * each way. If the default ever stops being centred, the control stops answering that question.
+     */
+    @Test fun `the default sits at the exact centre of the slider`() {
+        val below = DEFAULT_OPACITY_STEP - MIN_OPACITY_STEP
+        val above = MAX_OPACITY_STEP - DEFAULT_OPACITY_STEP
+        assertEquals("same number of notches either side of the default", below, above)
+    }
+
+    /** Left of the default is more see-through than today's bar; right of it is less. */
+    @Test fun `left is more transparent than the default and right is less`() {
+        val default = alphaForOpacityStep(DEFAULT_OPACITY_STEP)
+        for (s in MIN_OPACITY_STEP until DEFAULT_OPACITY_STEP) {
+            assertTrue("step $s must be more transparent", alphaForOpacityStep(s) < default)
+        }
+        for (s in (DEFAULT_OPACITY_STEP + 1)..MAX_OPACITY_STEP) {
+            assertTrue("step $s must be less transparent", alphaForOpacityStep(s) > default)
+        }
+    }
+
+    /** Every notch is a real change - no two adjacent steps render the same bar. */
+    @Test fun `every notch moves the alpha`() {
+        val all = (MIN_OPACITY_STEP..MAX_OPACITY_STEP).map { alphaForOpacityStep(it) }
+        all.zipWithNext { a, b -> assertTrue("adjacent steps must differ", b - a > 0.001f) }
+    }
+
     /**
      * A bar can never become invisible-but-tappable, which would hide the navigation with no way back
      * to the setting that hid it.

From 1e3ee08d5f79cfb1e289fc91b60b52e7a164c33c Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 12:36:36 +1200
Subject: [PATCH 264/333] build: testing build 443 / 324

Build numbers only; 11.1.1 stays as the next unreleased version.

Carries the recentred bar transparency with eleven notches, the bar held visible
while its appearance changes, and @bhelm's two fixes - heart-rate recovery now
requiring one continuous effort, and the capture tools working on non-UTF-8
hosts.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 0a7a202ae6..0e3d5fe734 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 442
+        versionCode = 443
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index d1c15a7128..099a944a34 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "323"
+    CURRENT_PROJECT_VERSION: "324"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 2b80c9574621b406178b1404b9afef8319c48a0b Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 14:27:27 +1200
Subject: [PATCH 265/333] analytics: say when a night's stream came back at its
 read cap

Prompted by a field report of "sometimes there is no sleep data at all" on a
WHOOP 4.0, which could not be triaged from a log.

The NO-NIGHT diagnostic already named WHICH absence it was, but not whether the
inputs were COMPLETE - and grav=192698 reads as a healthy night until you know
it was 96% of the old 200,000 cap. The line now marks a plain read that came
back AT its limit (atCap=grav), and prints the skin-temp count beside it, since
skin rides the record that carries gravity and its density has never been
measured.

Gravity and skin only, deliberately. HR and R-R reach the line through
SlidingStreamWindow.rows, which returns a SLICE of a read spanning more than the
night, so a truncated spliced window still hands back a count under the cap and
the marker would stay silent - a false negative on a line whose only value is
that its absence means "not clipped". Their exact truncation count is already
printed once per pass by WindowedStreamPlan.logLine. resp and steps stay unmarked
too: neither is a staging input, so clipping one cannot be why a night is missing.
Tests pin both omissions so they are not "fixed" back in.

Removing the skinCount default surfaced a real defect: the Swift call site never
passed the argument, so every iOS no-night line reported skin=0 whether or not
skin rows existed - indistinguishable from "no skin data" in exactly the capture
this line is meant to be read from.

Costs nothing on a healthy night: the marker is absent unless something clipped,
so existing lines are byte-identical. One test pins the measured field night -
192,698 gravity rows - as clear of the caps this ships with, so a marker
appearing later means a genuinely denser night rather than the old ceiling
returning.

Carries the diagnostic added for #1244 and the read caps from #1899.
---
 .../StrandAnalytics/StreamReadCap.swift       | 14 ++++
 Strand/Data/IntelligenceEngine.swift          | 45 ++++++++--
 .../IntelligenceSleepDetectNoNightTests.swift | 67 ++++++++++++++-
 .../com/noop/analytics/IntelligenceEngine.kt  | 46 ++++++++--
 .../java/com/noop/analytics/StreamReadCap.kt  | 16 ++++
 .../IntelligenceSleepDetectNoNightTest.kt     | 83 ++++++++++++++++++-
 6 files changed, 249 insertions(+), 22 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/StreamReadCap.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/StreamReadCap.swift
index 502116299c..208508ffe0 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/StreamReadCap.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/StreamReadCap.swift
@@ -77,6 +77,20 @@ public enum StreamReadCap {
     /// truncated one.
     public static let headroom = 1.5
 
+    /// The cap on the sleep engine's skin-temp reads, named rather than left a literal so the no-night
+    /// line can say when one came back AT it. Skin reads OUTSIDE the engine (a chart, an export) keep
+    /// their own limits - this is not a repo-wide skin cap.
+    ///
+    /// Not derived from a row rate like the caps below: skin's density was never measured. Skin rides the
+    /// record that carries gravity, and gravity ranged from 177 to 192,698 rows across 54 HOURS in one
+    /// capture, so whether 200,000 is generous or tight is genuinely unknown - which is the reason to
+    /// print the count. Unchanged in value: this names what both platforms already read at.
+    ///
+    /// Shared by two reads with very different spans - the night window, and the ~21-day WHOOP 4.0 anchor
+    /// scan. Only the window read's count reaches the no-night line, so an `atCap=skin` marker means THAT
+    /// read was clipped; a clipped anchor scan still goes unreported.
+    public static let skin = 200_000
+
     /// The cap for a stream producing `rowsPerSecond` at its densest.
     public static func cap(rowsPerSecond: Double) -> Int {
         Int((Double(windowSeconds) * rowsPerSecond * headroom).rounded(.up))
diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index 7a809abe70..2641b3bd76 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -339,16 +339,46 @@ final class IntelligenceEngine: ObservableObject {
 
     nonisolated static func sleepDetectNoNightLogLine(day: String, hrCount: Int, rrCount: Int,
                                                       respCount: Int, gravCount: Int, stepCount: Int,
-                                                      providedCount: Int, windowHours: Int) -> String {
+                                                      providedCount: Int, windowHours: Int,
+                                                      skinCount: Int) -> String {
         // `reason` names WHICH absence this is, because grav=0 is printed but its consequence is not.
         // With no motion the stager has no HR-only fallback, so no quantity of HR can stage a night — a
         // strap capability limit, not a coverage gap, and the two want completely different follow-ups.
         // With motion present the inputs were there and staging still produced nothing, which is the case
         // actually worth investigating.
         let reason = gravCount == 0 ? "no-motion" : "staged-none"
+        // #1118 follow-up: name any stream that came back AT its read cap. A read that returns exactly the
+        // limit is the definition of truncated everywhere else here (`full.count >= limit`), and it is the
+        // one thing a reader cannot infer from the counts alone — `grav=192698` looks healthy until you
+        // know the cap it is 96% of.
+        //
+        // GRAVITY is why this exists. HR and R-R ride a SlidingStreamWindow, which counts its own
+        // truncations; gravity is a plain read with no counter at all, so a night clipped of its newest
+        // motion staged badly and said nothing. That is the difference between "this release fixes your
+        // night" and "your offload never ran", and a log could not tell them apart.
+        var atCap: [String] = []
+        // ONLY the plain reads. Gravity and skin are read whole, so a result of exactly the cap IS the
+        // truncation — the same `count >= limit` test used everywhere else here, and neither stream has a
+        // counter of its own, which is why this marker exists.
+        //
+        // HR and R-R are deliberately absent even though their counts are printed. They arrive through
+        // `SlidingStreamWindow.rows`, which returns `full.filter { ts in from...to }` — a SLICE of a read
+        // that usually spans more than this night. A spliced window that WAS truncated still hands back a
+        // slice under the cap, so the marker would silently fail to fire: a false negative on a line whose
+        // only value is that its absence means "not clipped". Their exact truncation count is already
+        // printed unconditionally once per pass by `WindowedStreamPlan.logLine` (`hrTruncated=`), so
+        // nothing is lost by declining to guess it per night.
+        //
+        // resp and steps are plain reads too, and equally judgeable, but stay unmarked on purpose: neither
+        // is a staging input, so clipping one cannot be the reason a night is missing. Their counts are
+        // printed as context. The marker answers "did a stream that could explain this get cut short",
+        // not "was every read complete".
+        if gravCount >= StreamReadCap.gravity { atCap.append("grav") }
+        if skinCount >= StreamReadCap.skin { atCap.append("skin") }
+        let capNote = atCap.isEmpty ? "" : " atCap=" + atCap.joined(separator: ",")
         return "sleep-detect day=\(day) NO-NIGHT hr=\(hrCount) rr=\(rrCount) resp=\(respCount) "
-            + "grav=\(gravCount) steps=\(stepCount) provided=\(providedCount) window=\(windowHours)h "
-            + "reason=\(reason)"
+            + "grav=\(gravCount) skin=\(skinCount) steps=\(stepCount) provided=\(providedCount) "
+            + "window=\(windowHours)h reason=\(reason)" + capNote
     }
 
     /// #674/#1244: the "sleep total with no matched session" divergence line. A COMPUTED day whose fresh
@@ -969,7 +999,7 @@ final class IntelligenceEngine: ObservableObject {
                         let windowSkin = (try? await store.skinTempSamples(deviceId: owner,
                                                                            from: skinAnchorScanFrom,
                                                                            to: skinAnchorScanTo,
-                                                                           limit: 200_000)) ?? []
+                                                                           limit: StreamReadCap.skin)) ?? []
                         if let anchor = Whoop4SkinTemp.deviceAnchorRaw(windowSkin.map { $0.raw }) {
                             skinAnchorByOwner[owner] = anchor
                         }
@@ -1029,7 +1059,7 @@ final class IntelligenceEngine: ObservableObject {
                 let grav = (try? await store.gravitySamples(deviceId: owner, from: from, to: to,
                                                             limit: StreamReadCap.gravity)) ?? []
                 let steps = (try? await store.stepSamples(deviceId: owner, from: from, to: to, limit: 200_000)) ?? []
-                let skin = (try? await store.skinTempSamples(deviceId: owner, from: from, to: to, limit: 200_000)) ?? []
+                let skin = (try? await store.skinTempSamples(deviceId: owner, from: from, to: to, limit: StreamReadCap.skin)) ?? []
                 // #93: WHOOP 4.0 raw SpO2 PPG samples for the night; analyzeDay banks the nightly red/IR ADC
                 // means on the DailyMetric. Empty on a 5/MG (no v24 spo2 channels) → the raw means stay nil.
                 let spo2 = (try? await store.spo2Samples(deviceId: owner, from: from, to: to, limit: 200_000)) ?? []
@@ -1057,7 +1087,7 @@ final class IntelligenceEngine: ObservableObject {
                         let windowSkin = (try? await store.skinTempSamples(deviceId: owner,
                                                                            from: skinAnchorScanFrom,
                                                                            to: skinAnchorScanTo,
-                                                                           limit: 200_000)) ?? []
+                                                                           limit: StreamReadCap.skin)) ?? []
                         if let anchor = Whoop4SkinTemp.deviceAnchorRaw(windowSkin.map { $0.raw }) {
                             skinAnchorByOwner[owner] = anchor
                         }
@@ -1290,7 +1320,8 @@ final class IntelligenceEngine: ObservableObject {
                         hrvDiag = Self.sleepDetectNoNightLogLine(
                             day: day, hrCount: hr.count, rrCount: rr.count, respCount: resp.count,
                             gravCount: grav.count, stepCount: steps.count,
-                            providedCount: providedSleep.count, windowHours: windowHours)
+                            providedCount: providedSleep.count, windowHours: windowHours,
+                            skinCount: skin.count)
                     } else {
                         hrvDiag = nil
                     }
diff --git a/StrandTests/IntelligenceSleepDetectNoNightTests.swift b/StrandTests/IntelligenceSleepDetectNoNightTests.swift
index a83b857bbf..80ea9a6f2d 100644
--- a/StrandTests/IntelligenceSleepDetectNoNightTests.swift
+++ b/StrandTests/IntelligenceSleepDetectNoNightTests.swift
@@ -1,4 +1,5 @@
 import XCTest
+import StrandAnalytics
 @testable import Strand
 
 /// Pins the "HR tracked but no sleep" diagnostic (#1244). When a day clears the >=200-HR gate yet the
@@ -18,20 +19,20 @@ final class IntelligenceSleepDetectNoNightTests: XCTestCase {
         // gate the night → nothing stages. `window=54h` is the past-day span (30 h back → next midnight).
         let line = IE.sleepDetectNoNightLogLine(
             day: "2026-08-11", hrCount: 41230, rrCount: 0, respCount: 880,
-            gravCount: 0, stepCount: 12, providedCount: 0, windowHours: 54)
+            gravCount: 0, stepCount: 12, providedCount: 0, windowHours: 54, skinCount: 0)
         XCTAssertEqual(line,
             "sleep-detect day=2026-08-11 NO-NIGHT hr=41230 rr=0 resp=880 "
             // reason=no-motion is the point of this fixture: grav=0 means the stager has no HR-only
             // fallback, so no quantity of HR could have staged a night. That is a strap capability limit,
             // and it wants a different follow-up from a night that had motion and still staged nothing.
-            + "grav=0 steps=12 provided=0 window=54h reason=no-motion")
+            + "grav=0 skin=0 steps=12 provided=0 window=54h reason=no-motion")
     }
 
     func testTodayWindowIs48h() {
         // Today's read caps at dayStart+18h (vs a past day's next-midnight), so the whole span is 48 h.
         let line = IE.sleepDetectNoNightLogLine(
             day: "2026-08-12", hrCount: 5000, rrCount: 900, respCount: 300,
-            gravCount: 4, stepCount: 0, providedCount: 0, windowHours: 48)
+            gravCount: 4, stepCount: 0, providedCount: 0, windowHours: 48, skinCount: 0)
         XCTAssertTrue(line.contains("window=48h"), line)
         // The other branch: motion WAS present and staging still produced nothing, which is the case
         // worth investigating rather than a capability limit.
@@ -42,7 +43,65 @@ final class IntelligenceSleepDetectNoNightTests: XCTestCase {
         // House style: never an em-dash in shared text.
         let line = IE.sleepDetectNoNightLogLine(
             day: "2026-08-11", hrCount: 1, rrCount: 1, respCount: 1,
-            gravCount: 1, stepCount: 1, providedCount: 1, windowHours: 54)
+            gravCount: 1, stepCount: 1, providedCount: 1, windowHours: 54, skinCount: 1)
         XCTAssertFalse(line.contains("—"))
     }
+
+    /// The signal this line was missing. Gravity is a PLAIN read with no truncation counter, so a night
+    /// clipped of its newest motion staged badly and said nothing about why — and `grav=192698` reads as
+    /// healthy until you know it is 96% of a cap. A read that comes back AT the limit is truncated, which
+    /// is what `full.count >= limit` means everywhere else here.
+    func testAStreamAtItsReadCapIsNamed() {
+        let line = IntelligenceEngine.sleepDetectNoNightLogLine(
+            day: "2026-09-06", hrCount: 1000, rrCount: 1000, respCount: 0,
+            gravCount: StreamReadCap.gravity, stepCount: 0, providedCount: 0, windowHours: 54, skinCount: 0)
+        XCTAssertTrue(line.contains("atCap=grav"), line)
+    }
+
+    /// HR and R-R at their caps produce NO marker, and that is deliberate rather than an oversight.
+    ///
+    /// Both arrive through `SlidingStreamWindow.rows`, which returns a SLICE of a read spanning more than
+    /// this night, so a truncated spliced window still hands back a count under the cap — the marker would
+    /// miss the very case it claims to catch. Their exact truncation count is printed once per pass by
+    /// `WindowedStreamPlan.logLine` instead. Pinned so the omission is not "fixed" back in.
+    func testHrAndRrAtTheirCapsCarryNoMarker() {
+        let line = IntelligenceEngine.sleepDetectNoNightLogLine(
+            day: "2026-09-06", hrCount: StreamReadCap.hr, rrCount: StreamReadCap.rr, respCount: 0,
+            gravCount: 10, stepCount: 0, providedCount: 0, windowHours: 54, skinCount: 0)
+        XCTAssertFalse(line.contains("atCap"), line)
+    }
+
+    /// A healthy night says nothing extra — the marker only appears when something actually clipped.
+    func testANightUnderTheCapsCarriesNoMarker() {
+        let line = IntelligenceEngine.sleepDetectNoNightLogLine(
+            day: "2026-09-06", hrCount: 192_698, rrCount: 136_285, respCount: 0,
+            gravCount: 192_698, stepCount: 0, providedCount: 0, windowHours: 54, skinCount: 0)
+        XCTAssertFalse(line.contains("atCap"), line)
+    }
+
+    /// The field capture that motivated the caps: 192,698 gravity rows was 96% of the OLD 200,000 limit
+    /// and silent. Under the caps this ships with, the same night is comfortably clear.
+    func testTheMeasuredFieldNightIsClearOfTheCaps() {
+        XCTAssertLessThan(192_698, StreamReadCap.gravity)
+    }
+
+    /// The count that could not be measured. Skin temp only appears in a Test Centre "Night" line, which
+    /// fires when a session EXISTS — so on the nights being triaged, the ones with no sleep at all, its
+    /// volume was invisible.
+    func testTheLineReportsTheSkinSampleCount() {
+        let line = IntelligenceEngine.sleepDetectNoNightLogLine(
+            day: "2026-09-06", hrCount: 1000, rrCount: 900, respCount: 0, gravCount: 0,
+            stepCount: 0, providedCount: 0, windowHours: 54, skinCount: 4242)
+        XCTAssertTrue(line.contains("skin=4242"), line)
+    }
+
+    /// Skin is the stream whose density was never measured, and it was the one `atCap` did not cover
+    /// when the marker was first written — so a clipped skin read printed a bare count and no warning.
+    func testSkinAtItsReadCapIsNamed() {
+        let line = IntelligenceEngine.sleepDetectNoNightLogLine(
+            day: "2026-09-06", hrCount: 10, rrCount: 10, respCount: 0, gravCount: 10,
+            stepCount: 0, providedCount: 0, windowHours: 54, skinCount: StreamReadCap.skin)
+        XCTAssertTrue(line.contains("atCap=skin"), line)
+    }
+
 }
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index aafeb9f3d4..a211fa5c8c 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -823,7 +823,8 @@ object IntelligenceEngine {
                 // per-day anchor block below is a no-op — byte-identical anchor either way. A 5/MG banks
                 // skin-temp centidegrees directly — no per-device anchor — so its anchor slot stays null.
                 if (cacheOwnerFamily == DeviceFamily.WHOOP4 && !skinAnchorResolvedOwners.contains(owner)) {
-                    val windowSkin = repo.skinTempSamples(owner, skinAnchorScanFrom, skinAnchorScanTo, STREAM_LIMIT)
+                    val windowSkin = repo.skinTempSamples(owner, skinAnchorScanFrom, skinAnchorScanTo,
+                        StreamReadCap.SKIN)
                     Whoop4SkinTemp.deviceAnchorRaw(windowSkin.map { it.raw })?.let { skinAnchorByOwner[owner] = it }
                     skinAnchorResolvedOwners.add(owner)
                 }
@@ -1226,7 +1227,7 @@ object IntelligenceEngine {
                     sleepDetectNoNightLogLine(
                         day = day, hrCount = hr.size, rrCount = rr.size, respCount = resp.size,
                         gravCount = grav.size, stepCount = steps.size, providedCount = providedSleep.size,
-                        windowHours = windowHours,
+                        windowHours = windowHours, skinCount = skin.size,
                     ),
                 )
             }
@@ -2736,7 +2737,7 @@ object IntelligenceEngine {
         skinAnchorScanFrom: Long,
         skinAnchorScanTo: Long,
     ): DaySkinReads {
-        val skin = repo.skinTempSamples(owner, from, to, STREAM_LIMIT)
+        val skin = repo.skinTempSamples(owner, from, to, StreamReadCap.SKIN)
         // #93: WHOOP 4.0 raw SpO2 PPG samples for the night; analyzeDay banks the nightly red/IR ADC
         // means on the DailyMetric. Empty on a 5/MG (no v24 spo2 channels) → the raw means stay null.
         val spo2 = repo.spo2Samples(owner, from, to, STREAM_LIMIT)
@@ -2765,7 +2766,8 @@ object IntelligenceEngine {
         // identical to today). Computed here once per owner alongside the family resolution.
         val skinAnchorRaw = if (skinFamily == DeviceFamily.WHOOP4) {
             if (!skinAnchorResolvedOwners.contains(owner)) {
-                val windowSkin = repo.skinTempSamples(owner, skinAnchorScanFrom, skinAnchorScanTo, STREAM_LIMIT)
+                val windowSkin = repo.skinTempSamples(owner, skinAnchorScanFrom, skinAnchorScanTo,
+                    StreamReadCap.SKIN)
                 Whoop4SkinTemp.deviceAnchorRaw(windowSkin.map { it.raw })?.let { skinAnchorByOwner[owner] = it }
                 skinAnchorResolvedOwners.add(owner)
             }
@@ -2936,7 +2938,7 @@ object IntelligenceEngine {
      */
     internal fun sleepDetectNoNightLogLine(
         day: String, hrCount: Int, rrCount: Int, respCount: Int, gravCount: Int,
-        stepCount: Int, providedCount: Int, windowHours: Int,
+        stepCount: Int, providedCount: Int, windowHours: Int, skinCount: Int,
     ): String {
         // `reason` names WHICH absence this is, because grav=0 is printed but its consequence is not.
         //
@@ -2951,9 +2953,39 @@ object IntelligenceEngine {
         // With motion present the inputs were there and staging still produced nothing, which remains the
         // case most worth investigating.
         val reason = if (gravCount == 0) "no-motion" else "staged-none"
+        // #1118 follow-up: name any stream that came back AT its read cap. A read that returns exactly
+        // the limit is the definition of truncated everywhere else here (`full.count >= limit`), and it
+        // is the one thing a reader cannot infer from the counts alone - `grav=192698` looks healthy
+        // until you know the cap it is 96% of.
+        //
+        // GRAVITY is why this exists. HR and R-R ride a SlidingStreamWindow, which counts its own
+        // truncations; gravity is a plain read with no counter at all, so a night clipped of its newest
+        // motion staged badly and said nothing. That is the difference between "this release fixes your
+        // night" and "your offload never ran", and a log could not tell them apart.
+        // ONLY the plain reads. Gravity and skin are read whole, so a result of exactly the cap IS the
+        // truncation — the same `size >= limit` test used everywhere else here, and neither stream has a
+        // counter of its own, which is why this marker exists.
+        //
+        // HR and R-R are deliberately absent even though their counts are printed. They arrive through
+        // `SlidingStreamWindow.rows`, which returns `full.filter { ts in from..to }` — a SLICE of a read
+        // that usually spans more than this night. A spliced window that WAS truncated still hands back a
+        // slice under the cap, so the marker would silently fail to fire: a false negative on a line whose
+        // only value is that its absence means "not clipped". Their exact truncation count is already
+        // printed unconditionally once per pass by `WindowedStreamPlan.logLine` (`hrTruncated=`), so
+        // nothing is lost by declining to guess it per night.
+        //
+        // resp and steps are plain reads too, and equally judgeable, but stay unmarked on purpose: neither
+        // is a staging input, so clipping one cannot be the reason a night is missing. Their counts are
+        // printed as context. The marker answers "did a stream that could explain this get cut short",
+        // not "was every read complete".
+        val atCap = buildList {
+            if (gravCount >= StreamReadCap.GRAVITY) add("grav")
+            if (skinCount >= StreamReadCap.SKIN) add("skin")
+        }
+        val capNote = if (atCap.isEmpty()) "" else " atCap=${atCap.joinToString(",")}"
         return "sleep-detect day=$day NO-NIGHT hr=$hrCount rr=$rrCount resp=$respCount " +
-            "grav=$gravCount steps=$stepCount provided=$providedCount window=${windowHours}h " +
-            "reason=$reason"
+            "grav=$gravCount skin=$skinCount steps=$stepCount provided=$providedCount " +
+            "window=${windowHours}h reason=$reason$capNote"
     }
 
     /**
diff --git a/android/app/src/main/java/com/noop/analytics/StreamReadCap.kt b/android/app/src/main/java/com/noop/analytics/StreamReadCap.kt
index 194481a4cf..eff359a8de 100644
--- a/android/app/src/main/java/com/noop/analytics/StreamReadCap.kt
+++ b/android/app/src/main/java/com/noop/analytics/StreamReadCap.kt
@@ -91,6 +91,22 @@ object StreamReadCap {
      */
     const val HEADROOM = 1.5
 
+    /**
+     * The cap on the sleep engine's skin-temp reads, named rather than left a literal so the no-night
+     * line can say when one came back AT it. Skin reads OUTSIDE the engine (a chart, an export) keep
+     * their own limits - this is not a repo-wide skin cap.
+     *
+     * Not derived from a row rate like the caps below: skin's density was never measured. Skin rides the
+     * record that carries gravity, and gravity ranged from 177 to 192,698 rows across 54 HOURS in one
+     * capture, so whether 200,000 is generous or tight is genuinely unknown - which is the reason to
+     * print the count. Unchanged in value: this names what both platforms already read at.
+     *
+     * Shared by two reads with very different spans - the night window, and the ~21-day WHOOP 4.0 anchor
+     * scan. Only the window read's count reaches the no-night line, so an `atCap=skin` marker means THAT
+     * read was clipped; a clipped anchor scan still goes unreported.
+     */
+    const val SKIN = 200_000
+
     /** The cap for a stream producing [rowsPerSecond] at its densest. */
     fun cap(rowsPerSecond: Double): Int = ceil(WINDOW_SECONDS * rowsPerSecond * HEADROOM).toInt()
 
diff --git a/android/app/src/test/java/com/noop/analytics/IntelligenceSleepDetectNoNightTest.kt b/android/app/src/test/java/com/noop/analytics/IntelligenceSleepDetectNoNightTest.kt
index 89890bbe1b..6710a04e03 100644
--- a/android/app/src/test/java/com/noop/analytics/IntelligenceSleepDetectNoNightTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/IntelligenceSleepDetectNoNightTest.kt
@@ -22,14 +22,14 @@ class IntelligenceSleepDetectNoNightTest {
         // gate the night → nothing stages. window=54h is the past-day span (30 h back → next midnight).
         val line = IntelligenceEngine.sleepDetectNoNightLogLine(
             day = "2026-08-11", hrCount = 41230, rrCount = 0, respCount = 880,
-            gravCount = 0, stepCount = 12, providedCount = 0, windowHours = 54,
+            gravCount = 0, stepCount = 12, providedCount = 0, windowHours = 54, skinCount = 0,
         )
         assertEquals(
             // reason=no-motion is the point of this fixture: grav=0 means the stager has no HR-only
             // fallback, so no quantity of HR could have staged a night. That is a strap capability limit,
             // and it wants a different follow-up from a night that had motion and still staged nothing.
             "sleep-detect day=2026-08-11 NO-NIGHT hr=41230 rr=0 resp=880 " +
-                "grav=0 steps=12 provided=0 window=54h reason=no-motion",
+                "grav=0 skin=0 steps=12 provided=0 window=54h reason=no-motion",
             line,
         )
     }
@@ -39,7 +39,7 @@ class IntelligenceSleepDetectNoNightTest {
         // Today's read caps at dayStart+18h (vs a past day's next-midnight), so the whole span is 48 h.
         val line = IntelligenceEngine.sleepDetectNoNightLogLine(
             day = "2026-08-12", hrCount = 5000, rrCount = 900, respCount = 300,
-            gravCount = 4, stepCount = 0, providedCount = 0, windowHours = 48,
+            gravCount = 4, stepCount = 0, providedCount = 0, windowHours = 48, skinCount = 0,
         )
         assertTrue(line, line.contains("window=48h"))
         // The other branch: motion WAS present and staging still produced nothing, which is the case
@@ -52,8 +52,83 @@ class IntelligenceSleepDetectNoNightTest {
         // House style: never an em-dash in shared text.
         val line = IntelligenceEngine.sleepDetectNoNightLogLine(
             day = "2026-08-11", hrCount = 1, rrCount = 1, respCount = 1,
-            gravCount = 1, stepCount = 1, providedCount = 1, windowHours = 54,
+            gravCount = 1, stepCount = 1, providedCount = 1, windowHours = 54, skinCount = 1,
         )
         assertFalse(line.contains("—"))
     }
+
+    /**
+     * The signal this line was missing. Gravity is a PLAIN read with no truncation counter, so a night
+     * clipped of its newest motion staged badly and said nothing about why - and `grav=192698` reads as
+     * healthy until you know it is 96% of a cap. A read that comes back AT the limit is truncated, which
+     * is what `full.count >= limit` means everywhere else here.
+     */
+    @Test fun `a stream at its read cap is named`() {
+        val line = IntelligenceEngine.sleepDetectNoNightLogLine(
+            day = "2026-09-06", hrCount = 1000, rrCount = 1000, respCount = 0,
+            gravCount = StreamReadCap.GRAVITY, stepCount = 0, providedCount = 0, windowHours = 54, skinCount = 0,
+        )
+        assertTrue(line, line.contains("atCap=grav"))
+    }
+
+    /**
+     * HR and R-R at their caps produce NO marker, and that is deliberate rather than an oversight.
+     *
+     * Both arrive through `SlidingStreamWindow.rows`, which returns a SLICE of a read spanning more than
+     * this night, so a truncated spliced window still hands back a count under the cap - the marker would
+     * miss the very case it claims to catch. Their exact truncation count is printed once per pass by
+     * `WindowedStreamPlan.logLine` instead. Pinned so the omission is not "fixed" back in.
+     */
+    @Test fun `hr and rr at their caps carry no marker`() {
+        val line = IntelligenceEngine.sleepDetectNoNightLogLine(
+            day = "2026-09-06", hrCount = StreamReadCap.HR, rrCount = StreamReadCap.RR, respCount = 0,
+            gravCount = 10, stepCount = 0, providedCount = 0, windowHours = 54, skinCount = 0,
+        )
+        assertFalse(line, line.contains("atCap"))
+    }
+
+    /** A healthy night says nothing extra - the marker only appears when something actually clipped. */
+    @Test fun `a night under the caps carries no marker`() {
+        val line = IntelligenceEngine.sleepDetectNoNightLogLine(
+            day = "2026-09-06", hrCount = 192_698, rrCount = 136_285, respCount = 0,
+            gravCount = 192_698, stepCount = 0, providedCount = 0, windowHours = 54, skinCount = 0,
+        )
+        assertFalse(line, line.contains("atCap"))
+    }
+
+    /**
+     * The field capture that motivated the caps: 192,698 gravity rows was 96% of the OLD 200,000 limit
+     * and silent. Under the caps this ships with, the same night is comfortably clear - so a marker
+     * appearing now means a genuinely denser night, not the old ceiling.
+     */
+    @Test fun `the measured field night is clear of the caps`() {
+        assertTrue(192_698 < StreamReadCap.GRAVITY)
+    }
+
+    /**
+     * The count that could not be measured. Skin temp only appears in a Test Centre "Night" line, which
+     * fires when a session EXISTS - so on the nights being triaged, the ones with no sleep at all, its
+     * volume was invisible. It rides in the record that carries gravity, so whether it is dense or sparse
+     * decides whether its own 21-day anchor scan is anywhere near a cap; nobody could say which.
+     */
+    @Test fun `the line reports the skin sample count`() {
+        val line = IntelligenceEngine.sleepDetectNoNightLogLine(
+            day = "2026-09-06", hrCount = 1000, rrCount = 900, respCount = 0, gravCount = 0,
+            stepCount = 0, providedCount = 0, windowHours = 54, skinCount = 4242,
+        )
+        assertTrue(line, line.contains("skin=4242"))
+    }
+
+    /**
+     * Skin is the stream whose density was never measured, and it was the one `atCap` did not cover
+     * when the marker was first written — so a clipped skin read printed a bare count and no warning.
+     */
+    @Test fun `skin at its read cap is named`() {
+        val line = IntelligenceEngine.sleepDetectNoNightLogLine(
+            day = "2026-09-06", hrCount = 10, rrCount = 10, respCount = 0, gravCount = 10,
+            stepCount = 0, providedCount = 0, windowHours = 54, skinCount = StreamReadCap.SKIN,
+        )
+        assertTrue(line, line.contains("atCap=skin"))
+    }
+
 }

From eca2f0f528634ff1196071002d90882a8f688ad4 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 14:27:50 +1200
Subject: [PATCH 266/333] build: testing build 444 / 325

Build numbers only; 11.1.1 stays as the next unreleased version.

Carries the no-night read-cap diagnostic: a plain read that came back at its
limit is now named on the line, the skin-temp count is printed beside it, and
the iOS half stops reporting skin=0 on every night regardless of the data.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 0e3d5fe734..e90ce05098 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 443
+        versionCode = 444
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 099a944a34..3f1580a8bb 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "324"
+    CURRENT_PROJECT_VERSION: "325"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 5536b766e31c5f924b07a28bb7075cead0bf42cd Mon Sep 17 00:00:00 2001
From: Bernd Helm <bhelm@users.noreply.github.com>
Date: Sun, 6 Sep 2026 05:09:49 +0200
Subject: [PATCH 267/333] analytics: witness every scored stream in the per-day
 reuse key, not HR alone

From @bhelm.

A history offload does not commit its channels together, and an offloaded HR row
duplicating a live one is dropped on conflict, so a night scored from HR alone
can gain its R-R with (count, maxTs) over hrSample completely unmoved. Keyed on
HR alone the per-day reuse cache read that as "reuse" and re-served the HRV-less
scan for the rest of the session - a force refresh included, since force only
bypasses the whole-pass watermark gate, never the per-day one.

The per-day key now folds an opaque witness of every OTHER scored stream for the
night: PPG-derived HR, R-R, respiration, SpO2, gravity, steps, skin temp, band
sleep state and events. The whole-pass gate had already been widened to every
stream; this is the same widening at day granularity, which is where the reuse
decision is actually made. Unchanged inputs still reuse.

The R-R witness filters exactly as the read does, so it counts the beats that are
actually scored. providedSleep stays unwitnessed on purpose: the day cache is
gated to a registered WHOOP owner, so a ring or an import - the cases whose
provided sleep can move without an HR move - is never cached at all.

Carries a red/green test that pins the whole chain rather than a proxy for it:
the HR fingerprint unchanged, the night gaining an avgHrv once R-R lands, and
the new witness moving.

One follow-up left open: the cost lands on the cache-hit path, which is the path
the cache exists to keep cheap, so the added per-day aggregates are worth a
before/after on a large database.
---
 .../AnalyzeRecentDayCache.swift               | 12 ++-
 ...lyzeRecentDayCacheStreamWitnessTests.swift | 97 +++++++++++++++++++
 .../AnalyzeRecentDayCacheTests.swift          | 64 +++++++++---
 .../WhoopStore/Sources/WhoopStore/Reads.swift | 64 ++++++++++++
 .../Tests/WhoopStoreTests/ReadTests.swift     | 56 +++++++++++
 Strand/Data/IntelligenceEngine.swift          | 11 ++-
 .../noop/analytics/AnalyzeRecentDayCache.kt   | 12 ++-
 .../com/noop/analytics/IntelligenceEngine.kt  |  7 ++
 .../src/main/java/com/noop/data/WhoopDao.kt   | 54 +++++++++++
 .../java/com/noop/data/WhoopRepository.kt     |  8 ++
 .../analytics/AnalyzeRecentDayCacheTest.kt    | 66 ++++++++++---
 11 files changed, 420 insertions(+), 31 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AnalyzeRecentDayCacheStreamWitnessTests.swift

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyzeRecentDayCache.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyzeRecentDayCache.swift
index 8654ee8bd1..58f9c45b28 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyzeRecentDayCache.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyzeRecentDayCache.swift
@@ -31,11 +31,21 @@ public enum AnalyzeRecentDayCache {
     ///   both a 4.0 and a 5/MG): when a day's resolved owner flips between straps, keying on the owner makes
     ///   the reuse invalidate **explicitly**, rather than relying on two different devices never producing an
     ///   identical `count`+`maxTs` for the same window.
+    /// - `streams`: the opaque per-day witness of every OTHER scored stream — PPG-derived HR, R-R,
+    ///   respiration, SpO2, gravity, steps, skin temp and events (`WhoopStore.dayStreamFingerprint`).
+    ///   #29: a history offload does not commit its channels together, and an offloaded HR row duplicating
+    ///   a live one is dropped by `ON CONFLICT DO NOTHING`, so a night can be scored from HR alone and then
+    ///   gain its R-R with `hrCount`/`hrMaxTs` completely unmoved. Keyed on HR alone this said "reuse", and
+    ///   the HRV-less scan was re-served for the rest of the session — a force refresh included, since
+    ///   `force` only bypasses the whole-pass watermark gate. The whole-pass gate had already been widened
+    ///   to every stream (`analysisFingerprint`, v2); this is the same widening at day granularity, which is
+    ///   where the reuse decision is actually made.
     ///
     /// Inputs that feed `analyzeDay` but are pass-global rather than per-day (profile, baselines1, sleep
     /// need / consistency, habitual midsleep, tz, stager toggles) are NOT in this key — the engine drops the
     /// whole cache when its pass config signature changes, which covers them.
     public static func cacheKey(owner: String, hrCount: Int, hrMaxTs: Int, skinAnchorRaw: Double?,
+                                streams: String,
                                 // #1575: whether this day is the one that emits the PER-WINDOW HRV detail
                                 // (`dayStart == nowLocalMidnight`). Now that an active trace no longer
                                 // disables reuse, this has to invalidate: the night cached as "today" with
@@ -47,6 +57,6 @@ public enum AnalyzeRecentDayCache {
                                 // a trace mode is on.
                                 hrvWindowDetail: Bool) -> String {
         let anchor = skinAnchorRaw.map { String($0.bitPattern) } ?? "nil"
-        return "\(owner)|\(hrCount):\(hrMaxTs):\(anchor):\(hrvWindowDetail ? "d" : "s")"
+        return "\(owner)|\(hrCount):\(hrMaxTs):\(anchor):\(hrvWindowDetail ? "d" : "s")|\(streams)"
     }
 }
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AnalyzeRecentDayCacheStreamWitnessTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AnalyzeRecentDayCacheStreamWitnessTests.swift
new file mode 100644
index 0000000000..ecfa40ee25
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AnalyzeRecentDayCacheStreamWitnessTests.swift
@@ -0,0 +1,97 @@
+import Foundation
+import XCTest
+import WhoopProtocol
+import WhoopStore
+@testable import StrandAnalytics
+
+/// The per-day reuse key must witness every stream `analyzeDay` scores, not HR alone (#29).
+///
+/// A WHOOP history offload does not commit its channels together: HR can land first and R-R (or
+/// respiration, or SpO2) minutes later, and an offloaded HR row duplicating a live one is dropped by
+/// `ON CONFLICT DO NOTHING`. So a banked night can be scored once from HR alone and then have its R-R
+/// arrive with the night's HR `(count, maxTs)` completely unmoved. The whole-pass gate already sees that —
+/// `WhoopStore.analysisFingerprint` covers every raw stream — so the pass runs; it was the PER-DAY key that
+/// said "reuse", re-serving the HRV-less scan for the rest of the session, force refreshes included.
+///
+/// `AnalyzeRecentDayCacheTests` pins the key's contract on literal witnesses. This one drives the two real
+/// halves against each other — `analyzeDay` for what the night actually scores, a real store for what the
+/// witness actually reports — so neither half can drift into agreeing with a broken other half.
+/// Swift-only: it drives a real `WhoopStore`, and Kotlin pins the same contract from the key side in
+/// `AnalyzeRecentDayCacheTest`.
+final class AnalyzeRecentDayCacheStreamWitnessTests: XCTestCase {
+
+    private let profile = UserProfile(weightKg: 75, heightCm: 178, age: 30, sex: "male")
+    private let day = "2026-07-27"
+    private let owner = "whoop-A"
+
+    /// 16 h awake around 74 +/- 11 bpm then 8 h asleep around 64 +/- 5, anchored so the night runs
+    /// 00:00-08:00 on `day` — the same field-shaped generator `AnalyticsEngineHrOnlyDayTests` uses. No
+    /// gravity, which is the shape of the banked night in the report: a strap that streamed HR and R-R.
+    private func streams() -> ([HRSample], [RRInterval]) {
+        let dayStart = AnalyticsEngine.dayStartUtcSeconds(day)
+        let t0 = dayStart - 16 * 3600
+        var hr: [HRSample] = []
+        var rr: [RRInterval] = []
+        for i in 0..<(16 * 3600) {
+            let bpm = 74 + Int(sin(Double(i) / 500.0) * 11)
+            hr.append(HRSample(ts: t0 + i, bpm: bpm))
+            rr.append(RRInterval(ts: t0 + i, rrMs: 60000 / bpm))
+        }
+        for j in 0..<(8 * 3600) {
+            let bpm = 64 + Int(sin(Double(j) / 900.0) * 5)
+            hr.append(HRSample(ts: dayStart + j, bpm: bpm))
+            rr.append(RRInterval(ts: dayStart + j, rrMs: 60000 / bpm))
+        }
+        return (hr, rr)
+    }
+
+    private func scan(hr: [HRSample], rr: [RRInterval]) -> AnalyticsEngine.DayResult {
+        AnalyticsEngine.analyzeDay(day: day, hr: hr, rr: rr, profile: profile,
+                                   providedSleep: SleepStager.hrOnlySessions(hr: hr, rr: rr, resp: []))
+    }
+
+    /// R-R landing after HR changes what the night scores, so it must change the reuse key.
+    func testLateRrChangesTheNightAndInvalidatesTheKey() async throws {
+        let (hr, rr) = streams()
+        let from = hr.map(\.ts).min() ?? 0
+        let to = hr.map(\.ts).max() ?? 0
+
+        // What the night scores. Pass 1: HR is committed, R-R has not landed. Pass 2: same HR, plus R-R.
+        let hrOnly = scan(hr: hr, rr: [])
+        let withRr = scan(hr: hr, rr: rr)
+        XCTAssertNil(hrOnly.daily.avgHrv, "an R-R-less night has no nightly HRV to bank")
+        XCTAssertNotNil(withRr.daily.avgHrv, "once R-R lands the night scores an HRV — the cached scan is stale")
+
+        // What the store reports, over the SAME two commits.
+        let store = try await WhoopStore.inMemory()
+        try await store.upsertDevice(id: owner, mac: nil, name: nil)
+        _ = try await store.insert(Streams(hr: hr), deviceId: owner)
+        let beforeFp = try await store.hrFingerprint(deviceId: owner, from: from, to: to)
+        let beforeStreams = try await store.dayStreamFingerprint(deviceId: owner, from: from, to: to)
+
+        _ = try await store.insert(Streams(rr: rr), deviceId: owner)
+        let afterFp = try await store.hrFingerprint(deviceId: owner, from: from, to: to)
+        let afterStreams = try await store.dayStreamFingerprint(deviceId: owner, from: from, to: to)
+
+        // The HR witness alone cannot see this commit — that is the whole defect.
+        XCTAssertEqual(beforeFp.count, afterFp.count)
+        XCTAssertEqual(beforeFp.maxTs, afterFp.maxTs)
+        XCTAssertNotEqual(beforeStreams, afterStreams, "the R-R commit must move the other-stream witness")
+
+        let before = AnalyzeRecentDayCache.cacheKey(
+            owner: owner, hrCount: beforeFp.count, hrMaxTs: beforeFp.maxTs, skinAnchorRaw: nil,
+            streams: beforeStreams, hrvWindowDetail: false)
+        let after = AnalyzeRecentDayCache.cacheKey(
+            owner: owner, hrCount: afterFp.count, hrMaxTs: afterFp.maxTs, skinAnchorRaw: nil,
+            streams: afterStreams, hrvWindowDetail: false)
+        XCTAssertNotEqual(before, after,
+                          "the night's R-R arrived — reusing the HRV-less scan is the #29 defect")
+
+        // And a pass that commits nothing must still reuse: the fix must not re-score every night forever.
+        let idleFp = try await store.hrFingerprint(deviceId: owner, from: from, to: to)
+        let idleStreams = try await store.dayStreamFingerprint(deviceId: owner, from: from, to: to)
+        XCTAssertEqual(after, AnalyzeRecentDayCache.cacheKey(
+            owner: owner, hrCount: idleFp.count, hrMaxTs: idleFp.maxTs, skinAnchorRaw: nil,
+            streams: idleStreams, hrvWindowDetail: false))
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AnalyzeRecentDayCacheTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AnalyzeRecentDayCacheTests.swift
index b95f531504..f9b8910b21 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AnalyzeRecentDayCacheTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/AnalyzeRecentDayCacheTests.swift
@@ -6,18 +6,22 @@ import XCTest
 /// (the exact key STRING may differ across platforms — the cache is in-memory and per-platform — but the
 /// set of changes that must / must not invalidate a reused day is a shared contract).
 final class AnalyzeRecentDayCacheTests: XCTestCase {
+    /// A settled night's other-stream witness (`WhoopStore.dayStreamFingerprint`) — opaque to the key, so
+    /// these tests only need two values that differ.
+    private let baseStreams = "s1|p0:0|r120000:1700000000|x0:0|o0:0|g86400:1700000000|z0:0|t0:0|e0:0"
+
     // Unchanged inputs → identical key → the day is reused.
     func testStableInputsReuse() {
-        let a = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290, hrvWindowDetail: false)
-        let b = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290, hrvWindowDetail: false)
+        let a = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290, streams: baseStreams, hrvWindowDetail: false)
+        let b = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290, streams: baseStreams, hrvWindowDetail: false)
         XCTAssertEqual(a, b)
     }
 
     // A new HR row (count moves) OR a later newest-ts must invalidate — the day changed.
     func testHrChangeInvalidates() {
-        let base = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290, hrvWindowDetail: false)
-        let moreRows = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 178_001, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290, hrvWindowDetail: false)
-        let laterTs = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 178_000, hrMaxTs: 1_700_000_060, skinAnchorRaw: 1290, hrvWindowDetail: false)
+        let base = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290, streams: baseStreams, hrvWindowDetail: false)
+        let moreRows = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 178_001, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290, streams: baseStreams, hrvWindowDetail: false)
+        let laterTs = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 178_000, hrMaxTs: 1_700_000_060, skinAnchorRaw: 1290, streams: baseStreams, hrvWindowDetail: false)
         XCTAssertNotEqual(base, moreRows)
         XCTAssertNotEqual(base, laterTs)
     }
@@ -25,17 +29,17 @@ final class AnalyzeRecentDayCacheTests: XCTestCase {
     // A shifted window-wide skin anchor (another night's skin changed the 4.0 median) must invalidate even
     // when this night's HR fingerprint is identical — the skin conversion changed.
     func testAnchorShiftInvalidates() {
-        let a = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290, hrvWindowDetail: false)
-        let b = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290.5, hrvWindowDetail: false)
+        let a = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290, streams: baseStreams, hrvWindowDetail: false)
+        let b = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290.5, streams: baseStreams, hrvWindowDetail: false)
         XCTAssertNotEqual(a, b)
     }
 
     // A 5/MG night (no anchor) is a distinct, self-consistent key: nil reuses nil, and nil ≠ a real anchor
     // (so a 4.0 and a 5/MG night with the same fingerprint never alias to each other's scan).
     func testNilAnchorDistinctButStable() {
-        let nilA = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 5_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: nil, hrvWindowDetail: false)
-        let nilB = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 5_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: nil, hrvWindowDetail: false)
-        let real = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 5_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 0, hrvWindowDetail: false)
+        let nilA = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 5_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: nil, streams: baseStreams, hrvWindowDetail: false)
+        let nilB = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 5_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: nil, streams: baseStreams, hrvWindowDetail: false)
+        let real = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 5_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 0, streams: baseStreams, hrvWindowDetail: false)
         XCTAssertEqual(nilA, nilB)
         XCTAssertNotEqual(nilA, real)
     }
@@ -45,8 +49,8 @@ final class AnalyzeRecentDayCacheTests: XCTestCase {
     // count+maxTs for the same window. The owner id is part of the key, so it never falsely reuses one
     // strap's scan for the other.
     func testDifferentOwnerInvalidates() {
-        let whoop4 = AnalyzeRecentDayCache.cacheKey(owner: "whoop4-A", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290, hrvWindowDetail: false)
-        let whoop5 = AnalyzeRecentDayCache.cacheKey(owner: "whoop5-B", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290, hrvWindowDetail: false)
+        let whoop4 = AnalyzeRecentDayCache.cacheKey(owner: "whoop4-A", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290, streams: baseStreams, hrvWindowDetail: false)
+        let whoop5 = AnalyzeRecentDayCache.cacheKey(owner: "whoop5-B", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290, streams: baseStreams, hrvWindowDetail: false)
         XCTAssertNotEqual(whoop4, whoop5)
     }
 
@@ -62,10 +66,42 @@ final class AnalyzeRecentDayCacheTests: XCTestCase {
     func testTheHrvDetailDayIsNotReusedAsAnOrdinaryNight() {
         let detail = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 178_000,
                                                     hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290,
-                                                    hrvWindowDetail: true)
+                                                    streams: baseStreams, hrvWindowDetail: true)
         let summary = AnalyzeRecentDayCache.cacheKey(owner: "dev1", hrCount: 178_000,
                                                      hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290,
-                                                     hrvWindowDetail: false)
+                                                     streams: baseStreams, hrvWindowDetail: false)
         XCTAssertNotEqual(detail, summary, "the detail day must invalidate when it stops being today")
     }
+
+    /// #29: a stream that is not HR moving must invalidate, even with the HR fingerprint frozen.
+    ///
+    /// A history offload delivers channels independently and drops offloaded HR rows that duplicate live
+    /// ones (`ON CONFLICT DO NOTHING`), so a night scored once from HR alone can gain its R-R — or its
+    /// respiration, SpO2, gravity, steps, skin temp, events, or a PPG-derived HR second — with this night's
+    /// `hrCount`/`hrMaxTs` completely unmoved. Keyed on HR alone that said "reuse" and re-served the
+    /// HRV-less scan for the rest of the session, force refreshes included.
+    ///
+    /// Byte-parity twin of Kotlin `aStreamArrivingAfterHrInvalidatesTheReusedNight`.
+    func testAStreamArrivingAfterHrInvalidatesTheReusedNight() {
+        // Same night, same HR rows, same anchor — only the other-stream witness moved.
+        let hrOnly = AnalyzeRecentDayCache.cacheKey(
+            owner: "dev1", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290,
+            streams: "s1|p0:0|r0:0|x0:0|o0:0|g0:0|z0:0|t0:0|e0:0", hrvWindowDetail: false)
+        let rrLanded = AnalyzeRecentDayCache.cacheKey(
+            owner: "dev1", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290,
+            streams: "s1|p0:0|r120000:1700000000|x0:0|o0:0|g0:0|z0:0|t0:0|e0:0", hrvWindowDetail: false)
+        XCTAssertNotEqual(hrOnly, rrLanded, "the night's R-R arrived — its cached scan has no HRV in it")
+    }
+
+    /// The other half of the same contract: a witness that did NOT move must still reuse. #29's fix must
+    /// not turn every pass into a full re-score — that is the drain #1005 closed.
+    func testUnchangedStreamWitnessStillReuses() {
+        let a = AnalyzeRecentDayCache.cacheKey(
+            owner: "dev1", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290,
+            streams: baseStreams, hrvWindowDetail: false)
+        let b = AnalyzeRecentDayCache.cacheKey(
+            owner: "dev1", hrCount: 178_000, hrMaxTs: 1_700_000_000, skinAnchorRaw: 1290,
+            streams: baseStreams, hrvWindowDetail: false)
+        XCTAssertEqual(a, b)
+    }
 }
diff --git a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
index 5a3bfd5969..d822f364ee 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
@@ -152,6 +152,70 @@ extension WhoopStore {
         }
     }
 
+    /// Per-day, per-owner change detector for every scored stream that [hrFingerprint] does NOT witness.
+    ///
+    /// [analysisFingerprint] answers "did anything change anywhere"; this answers "did THIS night's scored
+    /// input change", which is the question the `analyzeRecent` per-day reuse cache asks. A history offload
+    /// does not commit its channels together — HR can land first and R-R, respiration or SpO2 minutes later,
+    /// and an offloaded HR row duplicating a live one is dropped by `ON CONFLICT DO NOTHING` — so a night
+    /// scored once from HR alone can gain its R-R with `(count, maxTs)` over `hrSample` completely unmoved
+    /// (#29). Keyed on HR alone the cache re-served that HRV-less scan for the rest of the session.
+    ///
+    /// One statement, one index range walk per stream over the same `(deviceId, ts)` primary keys
+    /// [hrFingerprint] uses, materialising no rows. `COUNT(*)` is the load-bearing half: it moves when a
+    /// backfill lands rows INSIDE a window already covered, which `MAX(ts)` alone would miss.
+    ///
+    /// The streams are exactly the ones the per-day loop reads and hands to `analyzeDay`:
+    /// - `ppgHrSample`: the day's HR read is measured ∪ PPG-derived ([hrSamples]), so a PPG row for a second
+    ///   with no measured HR changes the scored series while `hrSample` stays put.
+    /// - `rrInterval`: filtered exactly as [rrIntervals] filters at read (the 0x6E SpO2-IBI duplicate and
+    ///   future-stamped beats are excluded), so the witness counts the beats that are actually scored.
+    /// - `sleepStateSample`: appended from the SAME v18 record at the same `ts` as HR, so a re-offloaded
+    ///   record whose HR row is dropped on conflict still lands a new band row that `analyzeDay` scores.
+    ///   Its letter is `b` (band), not `s` — `s1|` is the version prefix.
+    /// - `respSample`, `spo2Sample`, `gravitySample`, `stepSample`, `skinTempSample`, `event`.
+    ///
+    /// Returned as an opaque string: it is only ever compared to itself in memory, so no cross-platform or
+    /// cross-launch byte identity is required. The Kotlin twin is `WhoopDao.dayStreamFingerprint`.
+    public func dayStreamFingerprint(deviceId: String, from: Int, to: Int) async throws -> String {
+        try syncRead { db in
+            // Every sub-select is COUNT/COALESCE(MAX(...), 0), so each column is non-null and the aggregate
+            // query always returns exactly one row — same idiom as `analysisFingerprint` above.
+            guard let row = try Row.fetchOne(db, sql: """
+                SELECT
+                  (SELECT COUNT(*) FROM ppgHrSample WHERE deviceId = :d AND ts >= :f AND ts <= :t) AS pc,
+                  (SELECT COALESCE(MAX(ts), 0) FROM ppgHrSample WHERE deviceId = :d AND ts >= :f AND ts <= :t) AS pm,
+                  (SELECT COUNT(*) FROM rrInterval WHERE deviceId = :d AND ts >= :f AND ts <= :t
+                     AND (srcChannel IS NULL OR srcChannel <> :rrx)
+                     AND (tsSuspect IS NULL OR tsSuspect <> 1)) AS rc,
+                  (SELECT COALESCE(MAX(ts), 0) FROM rrInterval WHERE deviceId = :d AND ts >= :f AND ts <= :t
+                     AND (srcChannel IS NULL OR srcChannel <> :rrx)
+                     AND (tsSuspect IS NULL OR tsSuspect <> 1)) AS rm,
+                  (SELECT COUNT(*) FROM respSample WHERE deviceId = :d AND ts >= :f AND ts <= :t) AS xc,
+                  (SELECT COALESCE(MAX(ts), 0) FROM respSample WHERE deviceId = :d AND ts >= :f AND ts <= :t) AS xm,
+                  (SELECT COUNT(*) FROM spo2Sample WHERE deviceId = :d AND ts >= :f AND ts <= :t) AS oc,
+                  (SELECT COALESCE(MAX(ts), 0) FROM spo2Sample WHERE deviceId = :d AND ts >= :f AND ts <= :t) AS om,
+                  (SELECT COUNT(*) FROM gravitySample WHERE deviceId = :d AND ts >= :f AND ts <= :t) AS gc,
+                  (SELECT COALESCE(MAX(ts), 0) FROM gravitySample WHERE deviceId = :d AND ts >= :f AND ts <= :t) AS gm,
+                  (SELECT COUNT(*) FROM stepSample WHERE deviceId = :d AND ts >= :f AND ts <= :t) AS zc,
+                  (SELECT COALESCE(MAX(ts), 0) FROM stepSample WHERE deviceId = :d AND ts >= :f AND ts <= :t) AS zm,
+                  (SELECT COUNT(*) FROM skinTempSample WHERE deviceId = :d AND ts >= :f AND ts <= :t) AS tc,
+                  (SELECT COALESCE(MAX(ts), 0) FROM skinTempSample WHERE deviceId = :d AND ts >= :f AND ts <= :t) AS tm,
+                  (SELECT COUNT(*) FROM sleepStateSample WHERE deviceId = :d AND ts >= :f AND ts <= :t) AS bc,
+                  (SELECT COALESCE(MAX(ts), 0) FROM sleepStateSample WHERE deviceId = :d AND ts >= :f AND ts <= :t) AS bm,
+                  (SELECT COUNT(*) FROM event WHERE deviceId = :d AND ts >= :f AND ts <= :t) AS ec,
+                  (SELECT COALESCE(MAX(ts), 0) FROM event WHERE deviceId = :d AND ts >= :f AND ts <= :t) AS em
+                """, arguments: ["d": deviceId, "f": from, "t": to,
+                                 "rrx": RRSourceChannel.spo2Ibi.rawValue]) else { return "" }
+            let keys = ["p", "r", "x", "o", "g", "z", "t", "b", "e"]
+            let parts = keys.map { key -> String in
+                let count: Int = row[key + "c"], maxTs: Int = row[key + "m"]
+                return "\(key)\(count):\(maxTs)"
+            }
+            return "s1|" + parts.joined(separator: "|")
+        }
+    }
+
     /// Aggregate HR over a window: `(n, avg, max)` computed in SQLite over the same measured-∪-PPG rows
     /// [hrSamples] returns, WITHOUT materialising them and WITHOUT a row limit.
     ///
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
index 597411d1fd..c07e277bb8 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
@@ -82,6 +82,62 @@ final class ReadTests: XCTestCase {
         XCTAssertTrue(withGravity.contains("|g1|"))
     }
 
+    /// #29: the per-DAY twin of the test above. `analysisFingerprint` answers "did anything change
+    /// anywhere"; the `analyzeRecent` reuse cache asks "did THIS night's scored input change", and keyed on
+    /// HR alone it could not see a channel that landed after HR — so a night scored from HR alone kept
+    /// being re-served with no HRV in it.
+    ///
+    /// Each stream is committed on its own here, because the failure mode IS independent commits: every one
+    /// of them must move the witness while `hrFingerprint` stays frozen.
+    func testDayStreamFingerprintMovesForEveryStreamThatLandsAfterHr() async throws {
+        let store = try await seeded()
+        let hrBefore = try await store.hrFingerprint(deviceId: "dev1", from: 0, to: 1000)
+        var previous = try await store.dayStreamFingerprint(deviceId: "dev1", from: 0, to: 1000)
+
+        // Every arm of the witness gets an entry: an arm that silently reads a NEIGHBOURING table is
+        // valid SQL and invisible to a test that never commits its stream.
+        let commits: [(String, Streams)] = [
+            ("ppgHr", Streams(ppgHr: [PpgHrSample(ts: 401, bpm: 62, conf: 0.9)])),
+            ("rr", Streams(rr: [RRInterval(ts: 400, rrMs: 810)])),
+            ("resp", Streams(resp: [RespSample(ts: 400, raw: 12)])),
+            ("spo2", Streams(spo2: [SpO2Sample(ts: 400, red: 100, ir: 200)])),
+            ("gravity", Streams(gravity: [GravitySample(ts: 400, x: 0, y: 0, z: 1)])),
+            ("steps", Streams(steps: [StepSample(ts: 400, counter: 7)])),
+            ("skin", Streams(skinTemp: [SkinTempSample(ts: 400, raw: 1290)])),
+            ("sleepState", Streams(sleepState: [SleepStateSample(ts: 400, state: 2)])),
+            ("event", Streams(events: [WhoopEvent(ts: 410, kind: "WRIST_OFF", payload: [:])])),
+        ]
+        for (label, commit) in commits {
+            _ = try await store.insert(commit, deviceId: "dev1")
+            let now = try await store.dayStreamFingerprint(deviceId: "dev1", from: 0, to: 1000)
+            XCTAssertNotEqual(previous, now, "a \(label) row landing after HR must move the day witness")
+            previous = now
+        }
+
+        // The HR witness never moved across ANY of those commits — the reason HR alone was not enough.
+        let hrAfter = try await store.hrFingerprint(deviceId: "dev1", from: 0, to: 1000)
+        XCTAssertEqual(hrBefore.count, hrAfter.count)
+        XCTAssertEqual(hrBefore.maxTs, hrAfter.maxTs)
+
+        // Reading twice with nothing committed in between must be identical, or the reuse cache would
+        // re-score every night on every pass and give back the drain it exists to close.
+        let idle = try await store.dayStreamFingerprint(deviceId: "dev1", from: 0, to: 1000)
+        XCTAssertEqual(previous, idle)
+    }
+
+    /// The witness is scoped exactly like the reads it stands in for: another device's rows and rows
+    /// outside the night window must not move it, or every night would invalidate on any strap's traffic.
+    func testDayStreamFingerprintIsDeviceAndWindowScoped() async throws {
+        let store = try await seeded()
+        let base = try await store.dayStreamFingerprint(deviceId: "dev1", from: 0, to: 1000)
+        _ = try await store.insert(Streams(rr: [RRInterval(ts: 400, rrMs: 810)]), deviceId: "other")
+        let afterOtherDevice = try await store.dayStreamFingerprint(deviceId: "dev1", from: 0, to: 1000)
+        XCTAssertEqual(base, afterOtherDevice, "another device's R-R is not this owner's night")
+        _ = try await store.insert(Streams(rr: [RRInterval(ts: 5000, rrMs: 810)]), deviceId: "dev1")
+        let afterOutsideWindow = try await store.dayStreamFingerprint(deviceId: "dev1", from: 0, to: 1000)
+        XCTAssertEqual(base, afterOutsideWindow, "an R-R beat outside the window is not this night's input")
+    }
+
     func testHrBucketsAveragePerBucketOrderedAndDeviceScoped() async throws {
         let store = try await seeded()
         // 200s buckets over dev1's ts 100/200/300 (bpm 60/61/62):
diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index 2641b3bd76..a44fc10029 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -1005,10 +1005,19 @@ final class IntelligenceEngine: ObservableObject {
                         }
                         skinAnchorResolvedOwners.insert(owner)
                     }
-                    if let fp = try? await store.hrFingerprint(deviceId: owner, from: from, to: to) {
+                    if let fp = try? await store.hrFingerprint(deviceId: owner, from: from, to: to),
+                       let streamFp = try? await store.dayStreamFingerprint(deviceId: owner, from: from, to: to) {
                         let key = AnalyzeRecentDayCache.cacheKey(
                             owner: owner, hrCount: fp.count, hrMaxTs: fp.maxTs,
                             skinAnchorRaw: skinAnchorByOwner[owner],
+                            // #29: the OTHER scored streams for this night. Without it a night whose R-R
+                            // (or resp/SpO2) landed after its HR keys identically to the HR-only scan it
+                            // was scored from, and the HRV-less result is re-served for the rest of the
+                            // session — force refresh included, since `force` only bypasses the whole-pass
+                            // watermark gate above, never this one. Both reads are index-only aggregates
+                            // over the same `(deviceId, ts)` keys; a miss costs the 7 full stream reads
+                            // this gate exists to skip.
+                            streams: streamFp,
                             // #1575: `hrvTraceActive &&` matters. With the HRV trace OFF no detail
                             // line is ever produced, so the flag describes nothing — but it would still
                             // flip at midnight and invalidate yesterday, charging EVERY user an extra
diff --git a/android/app/src/main/java/com/noop/analytics/AnalyzeRecentDayCache.kt b/android/app/src/main/java/com/noop/analytics/AnalyzeRecentDayCache.kt
index 6131ec6003..287fee57ba 100644
--- a/android/app/src/main/java/com/noop/analytics/AnalyzeRecentDayCache.kt
+++ b/android/app/src/main/java/com/noop/analytics/AnalyzeRecentDayCache.kt
@@ -35,6 +35,15 @@ object AnalyzeRecentDayCache {
      *   a 4.0 and a 5/MG): when a day's resolved owner flips between straps, keying on the owner makes the
      *   reuse invalidate **explicitly**, rather than relying on two different devices never producing an
      *   identical `count`+`maxTs` for the same window.
+     * - [streams]: the opaque per-day witness of every OTHER scored stream — PPG-derived HR, R-R,
+     *   respiration, SpO2, gravity, steps, skin temp and events (`WhoopRepository.dayStreamFingerprint`).
+     *   #29: a history offload does not commit its channels together, and an offloaded HR row duplicating a
+     *   live one is ignored on conflict, so a night can be scored from HR alone and then gain its R-R with
+     *   [hrCount]/[hrMaxTs] completely unmoved. Keyed on HR alone this said "reuse", and the HRV-less scan
+     *   was re-served for the rest of the process, a user-initiated refresh included, since a forced pass
+     *   only bypasses the whole-pass watermark gate. That gate had already been widened to every stream
+     *   (`analysisFingerprint`, v2); this is the same widening at day granularity, which is where the reuse
+     *   decision is actually made.
      *
      * Inputs that feed `analyzeDay` but are pass-global rather than per-day (profile, baselines1, sleep need
      * / consistency, habitual midsleep, tz, stager toggles) are NOT in this key — the engine drops the whole
@@ -42,6 +51,7 @@ object AnalyzeRecentDayCache {
      */
     fun cacheKey(
         owner: String, hrCount: Int, hrMaxTs: Long, skinAnchorRaw: Double?,
+        streams: String,
         // #1575: whether this day is the one that emits the PER-WINDOW HRV detail (`dayStart ==
         // nowLocalMidnight`). Now that trace lines are recorded and replayed, this has to invalidate:
         // the night cached as "today" with its detailed trace becomes an ordinary night after midnight,
@@ -52,6 +62,6 @@ object AnalyzeRecentDayCache {
         hrvWindowDetail: Boolean,
     ): String {
         val anchor = skinAnchorRaw?.toRawBits()?.toString() ?: "nil"
-        return "$owner|$hrCount:$hrMaxTs:$anchor:${if (hrvWindowDetail) "d" else "s"}"
+        return "$owner|$hrCount:$hrMaxTs:$anchor:${if (hrvWindowDetail) "d" else "s"}|$streams"
     }
 }
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index a211fa5c8c..49bf559283 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -831,6 +831,13 @@ object IntelligenceEngine {
                 val (fpCount, fpMaxTs) = repo.hrFingerprintWindow(owner, from, to)
                 val key = AnalyzeRecentDayCache.cacheKey(
                     owner, fpCount, fpMaxTs, skinAnchorByOwner[owner],
+                    // #29: the OTHER scored streams for this night. Without it a night whose R-R (or
+                    // resp/SpO2) landed after its HR keys identically to the HR-only scan it was scored
+                    // from, and the HRV-less result is re-served for the rest of the process — a
+                    // user-initiated refresh included, since that only bypasses the whole-pass watermark
+                    // gate, never this one. Both reads are index-only aggregates over the same
+                    // (deviceId, ts) keys; a miss costs the full stream reads this gate exists to skip.
+                    streams = repo.dayStreamFingerprint(owner, from, to),
                     // #1575: `&& hrvTraceSink != null` matters. With the HRV trace OFF no detail line
                     // is ever produced, so the flag describes nothing — but it would still flip at
                     // midnight and invalidate yesterday, charging EVERY user an extra day's re-score to
diff --git a/android/app/src/main/java/com/noop/data/WhoopDao.kt b/android/app/src/main/java/com/noop/data/WhoopDao.kt
index 4b93ebcbe2..0992a821f0 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDao.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDao.kt
@@ -23,6 +23,55 @@ internal const val ANALYSIS_FINGERPRINT_SQL =
         "'t' || (SELECT COALESCE(MAX(rowid), 0) FROM skinTempSample) || '|' || " +
         "'z' || (SELECT COALESCE(MAX(rowid), 0) FROM stepSample)"
 
+/** Per-day, per-owner witness of every scored stream the HR fingerprint does NOT cover (#29).
+ *
+ * [ANALYSIS_FINGERPRINT_SQL] answers "did anything change anywhere"; the analyzeRecent per-day reuse cache
+ * asks "did THIS night's scored input change". A history offload does not commit its channels together —
+ * HR can land first and R-R, respiration or SpO2 minutes later, and an offloaded HR row duplicating a live
+ * one is ignored on conflict — so a night scored once from HR alone can gain its R-R with COUNT/MAX over
+ * hrSample completely unmoved. Keyed on HR alone the cache re-served that HRV-less scan for the rest of the
+ * process, a user-initiated refresh included.
+ *
+ * COUNT(*) is the load-bearing half: it moves when a backfill lands rows INSIDE a window already covered,
+ * which MAX(ts) alone would miss. Every arm is an index range walk over the same (deviceId, ts) key the HR
+ * fingerprint uses, materializing no rows.
+ *
+ * rrInterval is filtered exactly as [WhoopDao.rrIntervals] filters at read (the 0x6E SpO2-IBI duplicate and
+ * future-stamped beats), so the witness counts the beats that are actually scored. The literal 2 is
+ * RrSourceChannel.SPO2_IBI.code, pinned to the enum by RrChannelTest, for the same reason it is a literal
+ * there: a Room @Query is a compile-time constant string.
+ *
+ * sleepStateSample is in it because the band state is appended from the SAME v18 record at the same ts as
+ * HR: a re-offloaded record whose HR row is ignored on conflict still lands a new band row that the day is
+ * scored from. Its letter is 'b' (band), not 's', which [ANALYSIS_FINGERPRINT_SQL] already spends.
+ *
+ * The result is opaque and only ever compared to itself in memory, so it needs no byte identity with the
+ * Swift twin, `WhoopStore.dayStreamFingerprint`. Kept as one constant so every caller executes the exact
+ * same statement; unlike [ANALYSIS_FINGERPRINT_SQL] it carries :deviceId/:from/:to binds, so a plain-JVM
+ * SQLite harness could not run it verbatim. Room's KSP verification is what checks it. */
+internal const val DAY_STREAM_FINGERPRINT_SQL =
+    "SELECT 's1|' || " +
+        "'p' || (SELECT COUNT(*) FROM ppgHrSample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) || " +
+        "':' || (SELECT COALESCE(MAX(ts), 0) FROM ppgHrSample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) || '|' || " +
+        "'r' || (SELECT COUNT(*) FROM rrInterval WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to " +
+        "AND (srcChannel IS NULL OR srcChannel <> 2) AND (tsSuspect IS NULL OR tsSuspect <> 1)) || " +
+        "':' || (SELECT COALESCE(MAX(ts), 0) FROM rrInterval WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to " +
+        "AND (srcChannel IS NULL OR srcChannel <> 2) AND (tsSuspect IS NULL OR tsSuspect <> 1)) || '|' || " +
+        "'x' || (SELECT COUNT(*) FROM respSample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) || " +
+        "':' || (SELECT COALESCE(MAX(ts), 0) FROM respSample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) || '|' || " +
+        "'o' || (SELECT COUNT(*) FROM spo2Sample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) || " +
+        "':' || (SELECT COALESCE(MAX(ts), 0) FROM spo2Sample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) || '|' || " +
+        "'g' || (SELECT COUNT(*) FROM gravitySample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) || " +
+        "':' || (SELECT COALESCE(MAX(ts), 0) FROM gravitySample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) || '|' || " +
+        "'z' || (SELECT COUNT(*) FROM stepSample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) || " +
+        "':' || (SELECT COALESCE(MAX(ts), 0) FROM stepSample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) || '|' || " +
+        "'t' || (SELECT COUNT(*) FROM skinTempSample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) || " +
+        "':' || (SELECT COALESCE(MAX(ts), 0) FROM skinTempSample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) || '|' || " +
+        "'b' || (SELECT COUNT(*) FROM sleepStateSample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) || " +
+        "':' || (SELECT COALESCE(MAX(ts), 0) FROM sleepStateSample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) || '|' || " +
+        "'e' || (SELECT COUNT(*) FROM event WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to) || " +
+        "':' || (SELECT COALESCE(MAX(ts), 0) FROM event WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to)"
+
 /**
  * Data-access for the local store. Mirrors the GRDB reads/writes in WhoopStore
  * (StreamStore.swift, Reads.swift, MetricsCache.swift).
@@ -1062,6 +1111,11 @@ interface WhoopDao : DeviceRegistryDao {
     suspend fun countHrInWindow(deviceId: String, from: Long, to: Long): Int
     @Query("SELECT COALESCE(MAX(ts), 0) FROM hrSample WHERE deviceId = :deviceId AND ts >= :from AND ts <= :to")
     suspend fun maxHrTsInWindow(deviceId: String, from: Long, to: Long): Long
+    // #29: the same per-day (device + window) witness for every OTHER scored stream — see
+    // DAY_STREAM_FINGERPRINT_SQL. Without it a night whose R-R landed after its HR keyed identically to the
+    // HR-only scan it was scored from, and that HRV-less scan was re-served for the rest of the process.
+    @Query(DAY_STREAM_FINGERPRINT_SQL)
+    suspend fun dayStreamFingerprint(deviceId: String, from: Long, to: Long): String
     @Query("SELECT COUNT(*) FROM rrInterval") suspend fun countRr(): Int
     @Query("SELECT COUNT(*) FROM event") suspend fun countEvents(): Int
     @Query("SELECT COUNT(*) FROM battery") suspend fun countBattery(): Int
diff --git a/android/app/src/main/java/com/noop/data/WhoopRepository.kt b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
index f7e4d299ba..683b557f93 100644
--- a/android/app/src/main/java/com/noop/data/WhoopRepository.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
@@ -661,6 +661,14 @@ class WhoopRepository(
     suspend fun hrFingerprintWindow(deviceId: String, from: Long, to: Long): Pair<Int, Long> =
         Pair(dao.countHrInWindow(deviceId, from, to), dao.maxHrTsInWindow(deviceId, from, to))
 
+    /** #29 — the same per-day (device + window) witness for every OTHER stream analyzeDay scores: PPG-derived
+     *  HR, R-R, respiration, SpO2, gravity, steps, skin temp and events. [hrFingerprintWindow] cannot see a
+     *  channel that lands after HR, and an offload commits its channels independently, so keyed on HR alone
+     *  the reuse cache re-served an HRV-less scan for the rest of the process. See
+     *  DAY_STREAM_FINGERPRINT_SQL; mirrors Swift WhoopStore.dayStreamFingerprint. */
+    suspend fun dayStreamFingerprint(deviceId: String, from: Long, to: Long): String =
+        dao.dayStreamFingerprint(deviceId, from, to)
+
     // MARK: - Server-derived caches (latest value wins on conflict)
 
     suspend fun upsertDailyMetrics(days: List<DailyMetric>) = dao.upsertDailyMetrics(days)
diff --git a/android/app/src/test/java/com/noop/analytics/AnalyzeRecentDayCacheTest.kt b/android/app/src/test/java/com/noop/analytics/AnalyzeRecentDayCacheTest.kt
index 503dac36b0..8c2d5f17df 100644
--- a/android/app/src/test/java/com/noop/analytics/AnalyzeRecentDayCacheTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/AnalyzeRecentDayCacheTest.kt
@@ -11,6 +11,10 @@ import org.junit.Test
  * must / must not invalidate a reused day is a shared contract).
  */
 class AnalyzeRecentDayCacheTest {
+    /** A settled night's other-stream witness (`WhoopRepository.dayStreamFingerprint`) — opaque to the key,
+     *  so these tests only need two values that differ. */
+    private val baseStreams = "s1|p0:0|r120000:1700000000|x0:0|o0:0|g86400:1700000000|z0:0|t0:0|e0:0"
+
 
     /**
      * #1575: the day that emits the per-window HRV DETAIL must not be reused as an ordinary night.
@@ -24,23 +28,23 @@ class AnalyzeRecentDayCacheTest {
     @Test
     fun theHrvDetailDayIsNotReusedAsAnOrdinaryNight() {
         val detail = AnalyzeRecentDayCache.cacheKey("dev1", 178_000, 1_700_000_000L, 1290.0,
-                                                    hrvWindowDetail = true)
+                                                    baseStreams, hrvWindowDetail = true)
         val summary = AnalyzeRecentDayCache.cacheKey("dev1", 178_000, 1_700_000_000L, 1290.0,
-                                                     hrvWindowDetail = false)
+                                                     baseStreams, hrvWindowDetail = false)
         assertNotEquals("the detail day must invalidate when it stops being today", detail, summary)
     }
     // Unchanged inputs -> identical key -> the day is reused.
     @Test fun stableInputsReuse() {
-        val a = AnalyzeRecentDayCache.cacheKey("dev1", 178_000, 1_700_000_000L, 1290.0, hrvWindowDetail = false)
-        val b = AnalyzeRecentDayCache.cacheKey("dev1", 178_000, 1_700_000_000L, 1290.0, hrvWindowDetail = false)
+        val a = AnalyzeRecentDayCache.cacheKey("dev1", 178_000, 1_700_000_000L, 1290.0, baseStreams, hrvWindowDetail = false)
+        val b = AnalyzeRecentDayCache.cacheKey("dev1", 178_000, 1_700_000_000L, 1290.0, baseStreams, hrvWindowDetail = false)
         assertEquals(a, b)
     }
 
     // A new HR row (count moves) OR a later newest-ts must invalidate — the day changed.
     @Test fun hrChangeInvalidates() {
-        val base = AnalyzeRecentDayCache.cacheKey("dev1", 178_000, 1_700_000_000L, 1290.0, hrvWindowDetail = false)
-        val moreRows = AnalyzeRecentDayCache.cacheKey("dev1", 178_001, 1_700_000_000L, 1290.0, hrvWindowDetail = false)
-        val laterTs = AnalyzeRecentDayCache.cacheKey("dev1", 178_000, 1_700_000_060L, 1290.0, hrvWindowDetail = false)
+        val base = AnalyzeRecentDayCache.cacheKey("dev1", 178_000, 1_700_000_000L, 1290.0, baseStreams, hrvWindowDetail = false)
+        val moreRows = AnalyzeRecentDayCache.cacheKey("dev1", 178_001, 1_700_000_000L, 1290.0, baseStreams, hrvWindowDetail = false)
+        val laterTs = AnalyzeRecentDayCache.cacheKey("dev1", 178_000, 1_700_000_060L, 1290.0, baseStreams, hrvWindowDetail = false)
         assertNotEquals(base, moreRows)
         assertNotEquals(base, laterTs)
     }
@@ -48,17 +52,17 @@ class AnalyzeRecentDayCacheTest {
     // A shifted window-wide skin anchor (another night's skin changed the 4.0 median) must invalidate even
     // when this night's HR fingerprint is identical — the skin conversion changed.
     @Test fun anchorShiftInvalidates() {
-        val a = AnalyzeRecentDayCache.cacheKey("dev1", 178_000, 1_700_000_000L, 1290.0, hrvWindowDetail = false)
-        val b = AnalyzeRecentDayCache.cacheKey("dev1", 178_000, 1_700_000_000L, 1290.5, hrvWindowDetail = false)
+        val a = AnalyzeRecentDayCache.cacheKey("dev1", 178_000, 1_700_000_000L, 1290.0, baseStreams, hrvWindowDetail = false)
+        val b = AnalyzeRecentDayCache.cacheKey("dev1", 178_000, 1_700_000_000L, 1290.5, baseStreams, hrvWindowDetail = false)
         assertNotEquals(a, b)
     }
 
     // A night with no anchor (null) is a distinct, self-consistent key: null reuses null, and null != a real
     // anchor (so it never aliases to a real-anchor night's scan).
     @Test fun nullAnchorDistinctButStable() {
-        val nilA = AnalyzeRecentDayCache.cacheKey("dev1", 5_000, 1_700_000_000L, null, hrvWindowDetail = false)
-        val nilB = AnalyzeRecentDayCache.cacheKey("dev1", 5_000, 1_700_000_000L, null, hrvWindowDetail = false)
-        val real = AnalyzeRecentDayCache.cacheKey("dev1", 5_000, 1_700_000_000L, 0.0, hrvWindowDetail = false)
+        val nilA = AnalyzeRecentDayCache.cacheKey("dev1", 5_000, 1_700_000_000L, null, baseStreams, hrvWindowDetail = false)
+        val nilB = AnalyzeRecentDayCache.cacheKey("dev1", 5_000, 1_700_000_000L, null, baseStreams, hrvWindowDetail = false)
+        val real = AnalyzeRecentDayCache.cacheKey("dev1", 5_000, 1_700_000_000L, 0.0, baseStreams, hrvWindowDetail = false)
         assertEquals(nilA, nilB)
         assertNotEquals(nilA, real)
     }
@@ -68,8 +72,42 @@ class AnalyzeRecentDayCacheTest {
     // count+maxTs for the same window. The owner id is part of the key, so it never falsely reuses one
     // strap's scan for the other.
     @Test fun differentOwnerInvalidates() {
-        val whoop4 = AnalyzeRecentDayCache.cacheKey("whoop4-A", 178_000, 1_700_000_000L, 1290.0, hrvWindowDetail = false)
-        val whoop5 = AnalyzeRecentDayCache.cacheKey("whoop5-B", 178_000, 1_700_000_000L, 1290.0, hrvWindowDetail = false)
+        val whoop4 = AnalyzeRecentDayCache.cacheKey("whoop4-A", 178_000, 1_700_000_000L, 1290.0, baseStreams, hrvWindowDetail = false)
+        val whoop5 = AnalyzeRecentDayCache.cacheKey("whoop5-B", 178_000, 1_700_000_000L, 1290.0, baseStreams, hrvWindowDetail = false)
         assertNotEquals(whoop4, whoop5)
     }
+
+    /**
+     * #29: a stream that is not HR moving must invalidate, even with the HR fingerprint frozen.
+     *
+     * A history offload delivers channels independently and ignores offloaded HR rows that duplicate live
+     * ones, so a night scored once from HR alone can gain its R-R — or its respiration, SpO2, gravity,
+     * steps, skin temp, events, or a PPG-derived HR second — with this night's `hrCount`/`hrMaxTs`
+     * completely unmoved. Keyed on HR alone that said "reuse" and re-served the HRV-less scan for the rest
+     * of the process, user-initiated refreshes included.
+     *
+     * Twin of Swift `testAStreamArrivingAfterHrInvalidatesTheReusedNight`.
+     */
+    @Test fun aStreamArrivingAfterHrInvalidatesTheReusedNight() {
+        // Same night, same HR rows, same anchor — only the other-stream witness moved.
+        val hrOnly = AnalyzeRecentDayCache.cacheKey(
+            "dev1", 178_000, 1_700_000_000L, 1290.0,
+            "s1|p0:0|r0:0|x0:0|o0:0|g0:0|z0:0|t0:0|e0:0", hrvWindowDetail = false)
+        val rrLanded = AnalyzeRecentDayCache.cacheKey(
+            "dev1", 178_000, 1_700_000_000L, 1290.0,
+            "s1|p0:0|r120000:1700000000|x0:0|o0:0|g0:0|z0:0|t0:0|e0:0", hrvWindowDetail = false)
+        assertNotEquals("the night's R-R arrived — its cached scan has no HRV in it", hrOnly, rrLanded)
+    }
+
+    /**
+     * The other half of the same contract: a witness that did NOT move must still reuse. #29's fix must not
+     * turn every pass into a full re-score — that is the drain #1005 closed.
+     */
+    @Test fun unchangedStreamWitnessStillReuses() {
+        val a = AnalyzeRecentDayCache.cacheKey("dev1", 178_000, 1_700_000_000L, 1290.0, baseStreams,
+                                               hrvWindowDetail = false)
+        val b = AnalyzeRecentDayCache.cacheKey("dev1", 178_000, 1_700_000_000L, 1290.0, baseStreams,
+                                               hrvWindowDetail = false)
+        assertEquals(a, b)
+    }
 }

From cf5f8de352838d6fc5881ec6aeacb761cd2b1bc9 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 16:03:33 +1200
Subject: [PATCH 268/333] today: stop the Liquid Effort tile calling a load
 index a percentage

Reported alongside #1898: the iOS Strain tile read "-%".

Four bugs, found by pulling on that thread.

The "%" should never have been there. #492 established that Effort is a load
index (0-100 NOOP / 0-21 WHOOP), not a percentage, and fixed it on Android and in
TodayView. LiquidTodayView - the view behind liquidTodayEnabled, and the one in
the report - kept the old form, so it also read the stored column directly and
ignored the effort-scale toggle: the hero ring above it showed ~8 on the WHOOP
axis while the tile showed 38. It now uses the same shared formatter the ring and
the workout rows use, with no unit, matching Android's tile exactly.

The reported symptom was a second bug: ktile appended the unit unconditionally,
so a missing metric rendered its placeholder AND its unit. It hit Recovery, Rest
and Blood Oxygen too, and would have shown "- kcal" / "- ms" elsewhere. Android
has always had the guard; this is its iOS twin, extracted as a pure static with
three unit tests rather than buried in a view builder.

Third: #1001 was never ported to this view. Its hero, tile and zero-note gate all
read the stored column, so nothing looked inconsistent on screen while the whole
view sat behind the resolved Effort until the next scoring pass. All three now
resolve through StrainScorer.effectiveEffort, shared with the Kotlin twin. The
zero-note gate moves with the hero deliberately: left behind, "no cardio load
yet" could have appeared beside a hero already showing a live non-zero Effort.

Fourth, found re-reviewing the port: the live Effort read took hrSamples' default
limit of 8000, which is chart-sized. The read is ORDER BY ts ASC LIMIT, so
truncation drops the NEWEST rows - at the ~18k HR rows a real day banks, that
covered roughly the first ten hours and the live score stopped climbing after it.
It failed safe (effectiveEffort takes the max, so the stored row simply won),
which is why nobody saw it. #836 is the same bug in the workout path, where a
session longer than ~2h13m reported the mean of its first 8000 samples. Fixed in
classic TodayView as well, since fixing only one view would leave the two Today
screens computing Effort from different amounts of the day.

None of this makes a missing Effort appear. In the report's iOS screenshot the
hero ring is empty and Charge reads 86 against Android's 93 - two devices holding
different data for the same day. That dash is missing data, not formatting.
---
 Strand/Liquid/LiquidTodayView.swift         | 77 ++++++++++++++++++---
 Strand/Screens/TodayView.swift              |  9 ++-
 StrandTests/LiquidTodayTileValueTests.swift | 33 +++++++++
 3 files changed, 108 insertions(+), 11 deletions(-)
 create mode 100644 StrandTests/LiquidTodayTileValueTests.swift

diff --git a/Strand/Liquid/LiquidTodayView.swift b/Strand/Liquid/LiquidTodayView.swift
index 3769cb0a4a..04eb9360d4 100644
--- a/Strand/Liquid/LiquidTodayView.swift
+++ b/Strand/Liquid/LiquidTodayView.swift
@@ -103,6 +103,11 @@ struct LiquidTodayView: View {
     @State private var kSparks: [String: [(String, Double)]] = [:]
     private var enabledKeyMetrics: [KeyMetric] { KeyMetricPrefs.decodeEnabled(keyMetricsRaw) }
 
+    /// #1001: TODAY's in-progress Effort, scored live in `load()` over the same window this view already
+    /// resolves for its other reads. nil for a navigated past day, and nil when the scorer has too few
+    /// readings — every Effort read-out then falls back to the stored row rather than a fabricated value.
+    @State private var liveTodayStrain: Double?
+
     // day navigation (0 = today, 1 = yesterday, …)
     @State private var selectedDayOffset = 0
     @State private var showDayPicker = false
@@ -660,7 +665,7 @@ struct LiquidTodayView: View {
             // one decimal on the compressed 0–21 axis to match the app-wide `effortDisplay` convention
             // (12.6, not a rounded "13"); the 0–100 hero stays a whole number as before.
             HeroScoreCell(label: String(localized: "Effort"),
-                          score: displayDay?.strain.map { UnitFormatter.effortValue($0, scale: effortScale) },
+                          score: effortStrain(displayDay).map { UnitFormatter.effortValue($0, scale: effortScale) },
                           tint: StrandPalette.effortColor, animated: dataLoaded,
                           onGuide: { guideSection = .effort },
                           maxValue: effortScale == .whoop ? 21 : 100,
@@ -1047,7 +1052,7 @@ struct LiquidTodayView: View {
     /// card when today's Effort is ~0, so a calm day explains itself instead of a bare 0. Reuses classic's
     /// String Catalog entry verbatim — one key serves both Today screens.
     private var effortZeroNote: String? {
-        guard EffortDisplay.showsZeroNote(strain: displayDay?.strain, isToday: selectedDayOffset == 0) else { return nil }
+        guard EffortDisplay.showsZeroNote(strain: effortStrain(displayDay), isToday: selectedDayOffset == 0) else { return nil }
         return String(localized: "No cardio load yet. Effort builds once your heart rate climbs into your effort zone (around 50% of your heart-rate reserve). A calm day honestly reads near zero.")
     }
 
@@ -1273,7 +1278,12 @@ struct LiquidTodayView: View {
             // stays raw, matching the Effort hero, which correctly does not carry.
             ktile(String(localized: "Recovery"), icon: keyMetricIcon(metric), intText(chargeDisplay.pct), "%", StrandPalette.chargeColor, frac(chargeDisplay.pct), key: "recovery")
         case .effort:
-            ktile(String(localized: "Strain"), icon: keyMetricIcon(metric), intText(displayDay?.strain), "%", StrandPalette.effortColor, frac(displayDay?.strain), key: "strain")
+            // #492: Effort is a load index (0–100 NOOP / 0–21 WHOOP), NOT a percentage, and the unit was
+            // wrong on either axis. Fixed on Android and in `TodayView` at the time; THIS view kept the old
+            // form, so the tile also ignored the scale toggle — the hero ring above it read ~8 on the WHOOP
+            // axis while this read 38. `effortText` is the same shared formatter the ring and the workout
+            // rows use, so all three now agree by construction.
+            ktile(String(localized: "Strain"), icon: keyMetricIcon(metric), effortText(effortStrain(displayDay)), "", StrandPalette.effortColor, frac(effortStrain(displayDay)), key: "strain")
         case .rest:
             ktile(String(localized: "Rest"), icon: keyMetricIcon(metric), intText(restScore), "%", StrandPalette.restColor, frac(restScore), key: "sleep_performance")
         case .hrv:
@@ -1342,7 +1352,7 @@ struct LiquidTodayView: View {
 
     private func ktile(_ label: String, icon: String, _ value: String, _ unit: String, _ tint: Color, _ frac: Double?,
                        key: String? = nil, detailMetric: MetricDescriptor? = nil, caption: String? = nil) -> some View {
-        let displayValue = unit.isEmpty ? value : (unit == "%" ? value + unit : value + " " + unit)
+        let displayValue = Self.tileDisplayValue(value, unit: unit)
         let tile = VStack(alignment: .leading, spacing: 10) {
             HStack(spacing: 6) {
                 Image(systemName: icon)
@@ -1551,6 +1561,28 @@ struct LiquidTodayView: View {
         let from = cycleMarkers.last(where: { $0.day == selectedDayKey }).map { Int($0.value) } ?? calendarFrom
         let toExclusive = cycleMarkers.last(where: { $0.day == nextDayKey }).map { Int($0.value) } ?? calendarTo
         let to = max(from, toExclusive - 1)
+        // #1001: in-progress Effort for TODAY, over the SAME window resolved just above (the day-cycle
+        // onset when that mode is on, else calendar midnight → now) with the identical params the daily
+        // pass uses, so the live number matches what the engine will eventually persist. Below
+        // `StrainScorer.minReadings` the scorer returns nil and the read-outs fall back to the stored row
+        // — never a fabricated value. A navigated past day clears it.
+        let liveStrainLocal: Double?
+        if selectedDayOffset == 0 {
+            // An EXPLICIT limit, not the 8000 default: that default is chart-sized, and this read is
+            // whole-window. `hrSamples` is `ORDER BY ts ASC LIMIT`, so truncation drops the NEWEST rows —
+            // at the ~18k HR rows a real day banks, the default covered roughly the first ten hours and the
+            // live score silently stopped climbing after that. It failed safe (`effectiveEffort` takes the
+            // max, so the stored row simply won) which is why it went unnoticed. 200_000 is what every
+            // other whole-window HR consumer already passes.
+            let todayHr = await repo.hrSamples(from: from, to: to, limit: 200_000)
+            let maxHR = profile.age > 0 ? StrainScorer.tanakaHRmax(age: Double(profile.age)) : nil
+            let restHR = day?.restingHr.map(Double.init) ?? StrainScorer.defaultRestingHR
+            liveStrainLocal = StrainScorer.strain(todayHr, maxHR: maxHR, restingHR: restHR,
+                                                  method: PuffinExperiment.effortMethod, sex: profile.sex)
+        } else {
+            liveStrainLocal = nil
+        }
+        liveTodayStrain = liveStrainLocal
 
         async let restA = repo.exploreSeries(key: "sleep_performance", source: "my-whoop")
         async let stressA = repo.series(key: "stress", source: "my-whoop")
@@ -1813,10 +1845,26 @@ struct LiquidTodayView: View {
 
     private func frac(_ v: Double?) -> Double? { v.map { max(0, min(1, $0 / 100)) } }
     private func fracOver(_ v: Double?, _ over: Double) -> Double? { v.map { max(0, min(1, $0 / over)) } }
-    private func intText(_ v: Double?) -> String { v.map { String(Int($0.rounded())) } ?? "–" }
+
+    /// What a tile shows when the metric has no value. One constant rather than a dash repeated at each
+    /// site, because the unit-suppression below has to recognise it.
+    static let noValueDash = "–"
+
+    /// Join a formatted tile value with its unit, dropping the unit when there is no value.
+    ///
+    /// #492 and the `–%` it left behind: a missing metric rendered its placeholder AND its unit, so an
+    /// empty Strain tile read `–%`, which parses as "minus percent" rather than "no data". Android has
+    /// had the guard all along (`unit = if (restScore != null) "%" else ""`, and `withUnit`'s NO_DATA
+    /// check); this is the iOS twin of it. `%` binds tight, every other unit takes a space.
+    static func tileDisplayValue(_ value: String, unit: String) -> String {
+        guard !unit.isEmpty, value != noValueDash else { return value }
+        return unit == "%" ? value + unit : value + " " + unit
+    }
+
+    private func intText(_ v: Double?) -> String { v.map { String(Int($0.rounded())) } ?? Self.noValueDash }
 
     private func unitText(_ v: Double?, _ unit: String, decimals: Int = 0) -> String {
-        guard let v else { return "–" }
+        guard let v else { return Self.noValueDash }
         let n = decimals > 0 ? String(format: "%.\(decimals)f", locale: AppLanguage.activeLocale, v) : String(Int(v.rounded()))
         return unit.isEmpty ? n : "\(n) \(unit)"
     }
@@ -1853,8 +1901,17 @@ struct LiquidTodayView: View {
     @AppStorage(UnitPrefs.effortScaleKey) private var effortScaleRaw = EffortScale.hundred.rawValue
     private var effortScale: EffortScale { UnitPrefs.resolveEffortScale(effortScaleRaw) }
 
+    /// The Effort this view should show: the live in-progress score when it beats the stored row, else the
+    /// row (#1001). `StrainScorer.effectiveEffort` holds the never-drop floor and the live/stored
+    /// preference and is shared with the Kotlin twin, so the two platforms cannot resolve Effort
+    /// differently. `d` for today is always today's row or nil, never a prior day, so the floor cannot
+    /// resurrect a stale day — it only stops a read-out dropping below what today has already earned.
+    private func effortStrain(_ d: DailyMetric?) -> Double? {
+        StrainScorer.effectiveEffort(live: selectedDayOffset == 0 ? liveTodayStrain : nil, stored: d?.strain)
+    }
+
     private func effortText(_ s: Double?) -> String {
-        guard let s else { return "–" }
+        guard let s else { return Self.noValueDash }
         // Route through the shared formatter instead of hardcoding *21: a default (0–100) user was shown the
         // WHOOP-scaled number here while the hero + Workouts table showed 0–100, two numbers for one workout.
         return UnitFormatter.effortDisplay(s, scale: effortScale)
@@ -2331,9 +2388,9 @@ extension LiquidTodayView {
     /// The Effort hero's "no cardio load yet" honest note (#530 follow-up — Liquid parity with classic
     /// `TodayView.effortZeroNote`). Pure + static so the gate is testable with no view: the note shows
     /// ONLY for today when a strain value exists and is ~0 — a genuinely calm day reads near zero, while a
-    /// no-data day shows its own ring overlay and a past day is never annotated. Liquid reads
-    /// `displayDay?.strain` directly (it has no live-strain accumulator like classic's `liveTodayStrain`),
-    /// which is exactly the value its Effort hero draws.
+    /// no-data day shows its own ring overlay and a past day is never annotated. The caller passes
+    /// `effortStrain(displayDay)` — the SAME resolved value the Effort hero draws (#1001) — so the note
+    /// and the hero can never disagree about whether today is at zero.
     enum EffortDisplay {
         static func showsZeroNote(strain: Double?, isToday: Bool) -> Bool {
             guard isToday, let s = strain else { return false }
diff --git a/Strand/Screens/TodayView.swift b/Strand/Screens/TodayView.swift
index 6219198609..072348c289 100644
--- a/Strand/Screens/TodayView.swift
+++ b/Strand/Screens/TodayView.swift
@@ -4777,7 +4777,14 @@ struct TodayView: View {
             let cycleOnset = dayCycleSeries.last(where: { $0.day <= selectedDayKey })
                 .map { Int($0.value.rounded()) }
             let effortStart = mode == .sleepOnset ? (cycleOnset ?? windowStart) : windowStart
-            let todayHr = await repo.hrSamples(from: effortStart, to: windowEndInclusive)
+            // An EXPLICIT limit, not the 8000 default: that default is chart-sized, and this read is
+            // whole-window. `hrSamples` is `ORDER BY ts ASC LIMIT`, so truncation drops the NEWEST rows —
+            // at the ~18k HR rows a real day banks, the default covered roughly the first ten hours and the
+            // live score silently stopped climbing after that. It failed safe (`effectiveEffort` takes the
+            // max, so the stored row simply won) which is why it went unnoticed. 200_000 is what every
+            // other whole-window HR consumer already passes.
+            let todayHr = await repo.hrSamples(from: effortStart, to: windowEndInclusive,
+                                               limit: 200_000)
             let maxHR = profile.age > 0 ? StrainScorer.tanakaHRmax(age: Double(profile.age)) : nil
             let restHR = displayDay?.restingHr.map(Double.init) ?? StrainScorer.defaultRestingHR
             liveStrainLocal = StrainScorer.strain(todayHr, maxHR: maxHR, restingHR: restHR,
diff --git a/StrandTests/LiquidTodayTileValueTests.swift b/StrandTests/LiquidTodayTileValueTests.swift
new file mode 100644
index 0000000000..7e019565ee
--- /dev/null
+++ b/StrandTests/LiquidTodayTileValueTests.swift
@@ -0,0 +1,33 @@
+import XCTest
+@testable import Strand
+
+/// Pins the Key Metrics tile's value/unit join (#492, and the `–%` it left behind).
+///
+/// The reported symptom was an empty Strain tile reading `–%`: the placeholder kept its unit, so "no data"
+/// rendered as something that parses like a negative percentage. Android has always suppressed the unit on
+/// its no-data sentinel; these pin the iOS twin so the two cannot drift apart again.
+final class LiquidTodayTileValueTests: XCTestCase {
+
+    /// The reported bug, exactly: a missing metric must not carry a unit.
+    func testNoValuePlaceholderDropsItsUnit() {
+        XCTAssertEqual(LiquidTodayView.tileDisplayValue(LiquidTodayView.noValueDash, unit: "%"),
+                       LiquidTodayView.noValueDash)
+        XCTAssertEqual(LiquidTodayView.tileDisplayValue(LiquidTodayView.noValueDash, unit: "kcal"),
+                       LiquidTodayView.noValueDash)
+    }
+
+    /// A real value still gets its unit, and `%` binds tight where the others take a space — the existing
+    /// convention, unchanged by the guard above.
+    func testAValueKeepsItsUnitAndSpacing() {
+        XCTAssertEqual(LiquidTodayView.tileDisplayValue("93", unit: "%"), "93%")
+        XCTAssertEqual(LiquidTodayView.tileDisplayValue("1272", unit: "kcal"), "1272 kcal")
+    }
+
+    /// Effort passes an EMPTY unit now (it is a 0–100 / 0–21 load index, not a percentage), so the value
+    /// must come through untouched on both the present and the absent path.
+    func testAnEmptyUnitIsLeftAlone() {
+        XCTAssertEqual(LiquidTodayView.tileDisplayValue("38.9", unit: ""), "38.9")
+        XCTAssertEqual(LiquidTodayView.tileDisplayValue(LiquidTodayView.noValueDash, unit: ""),
+                       LiquidTodayView.noValueDash)
+    }
+}

From df22dc7ff00c37b42a2aec41d3f8431e397a5746 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 16:06:45 +1200
Subject: [PATCH 269/333] tests: repin the frozen-Rest tests on what the
 shipping code does

Follow-up from a "REST shows -%" report: the Rest display was not the problem,
but the tests describing Rest's data path were stale, and stale in a way that
could not be caught by running them.

The contract test wrapped XCTExpectFailure("#977 not yet fixed") around
Rest.composite(daily:) for a hand-built row with NO sleep fields. A row without
totalSleepMin or efficiency is nil by the guard's own definition, so that
assertion could never pass whatever got fixed upstream - it asserted the wrong
layer and would have advertised #977 as open forever.

The no-gravity test called detectSleep without naming a stager, so it rode
useSleepStagerV2's default and silently stopped describing shipped behaviour when
that default moved. It now names V1 explicitly, and V2 is pinned beside it giving
the SAME answer.

That pairing is the point. Neither stager finds a night without motion; the
HR-only rescue is IntelligenceEngine's, which falls back to
SleepStager.hrOnlySessions and feeds the result in as providedSleep when a day
has no motion, no hypnogram and no stored night. #1884 then keeps an all-HR-only
night in the daily aggregates. So the frozen-Rest state IS closed in master, by
the engine rather than by the stager - which the old expected failure could never
have told anyone, since it touched neither layer.

The display test claimed Today freezes on the series tail. Since #977 that is
freshRestScore + isCarryStale's decision, and those live in the app target and
Android's RestFreshnessTest. It also asserted max(by:) over a literal dictionary,
exercising no product code at all. Removed, with a line naming where the rule is
covered.

The file was called Live5RestFrozenTests. With the frozen state closed that name
is the same stale signal the expected failure was - something a reader greps,
believes, and acts on after it stopped being true - so it is now named for the
chain it pins, with #977 kept in the header for archaeology.

No production code changes.
---
 .../Live5NoGravityRestChainTests.swift        | 141 ++++++++++++++++++
 .../Live5RestFrozenTests.swift                | 119 ---------------
 2 files changed, 141 insertions(+), 119 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/Live5NoGravityRestChainTests.swift
 delete mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/Live5RestFrozenTests.swift

diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/Live5NoGravityRestChainTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/Live5NoGravityRestChainTests.swift
new file mode 100644
index 0000000000..335577cb8a
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/Live5NoGravityRestChainTests.swift
@@ -0,0 +1,141 @@
+import XCTest
+@testable import StrandAnalytics
+import WhoopProtocol
+import WhoopStore
+
+/// The no-gravity Rest chain, from bug #977 (iOS, WHOOP 5.0, live Bluetooth): "Rest score stuck 93 since
+/// forever."
+///
+/// Renamed from `Live5RestFrozenTests`. The frozen state is closed (see below), and a file called
+/// "Frozen" is the same stale signal the `XCTExpectFailure` in it used to be: something a reader greps,
+/// believes, and acts on long after it stopped being true. #977 stays named here for archaeology; the
+/// file is named for the chain it pins.
+///
+/// The mechanism: a LIVE WHOOP 5.0 streams standard 0x2A37 HR continuously, but gravity is only ever
+/// populated by the *history offload* (Backfiller). With no overnight gravity the day reaches the scoring
+/// loop with dense HR — it clears IntelligenceEngine's `hr.count >= 200` gate, so recovery/Charge still
+/// score — while sleep detection finds nothing. No sleep means no `totalSleepMin`/`efficiency`, so
+/// `AnalyticsEngine.Rest.composite(daily:)` is nil, so NO `sleep_performance` point is written, and the
+/// Rest read-out has nothing new to show.
+///
+/// WHAT CHANGED SINCE THESE TESTS WERE WRITTEN, and why they are repinned rather than deleted:
+///
+///  • The V1 stager still bails without gravity (`grav.count < 2`). That is unchanged and still pinned
+///    below — V1 is a selectable fallback (the 4.0 is unvalidated on either stager, #271/#319), so its
+///    behaviour is worth stating, but it is no longer what a default install runs.
+///  • The rescue is NOT inside `detectSleep` — neither stager finds a night without motion, and both are
+///    pinned saying so below. It is in `IntelligenceEngine`: when a day has no motion, no hypnogram and
+///    no stored night, it falls back to `SleepStager.hrOnlySessions(hr:rr:resp:)` (#1801) and feeds the
+///    result in as `providedSleep`. #1884 then stopped an all-HR-only night being discarded from the
+///    daily aggregates. So the shipping path DOES score a no-gravity night, which is precisely the
+///    "HR-only fallback composite" the old fix-contract test named as one of two acceptable fixes.
+///    That fallback is covered by `SleepStagerHrOnlySessionsTests` + `AnalyticsEngineHrOnlyDayTests`.
+///
+/// The old contract test asserted `Rest.composite(daily:)` on a hand-built row with no sleep fields and
+/// wrapped it in `XCTExpectFailure`. That could never pass, whatever got fixed: a row with no aggregates
+/// is nil BY DEFINITION, not by bug. It was testing the wrong layer. The chain is pinned at its two real
+/// joints instead — does the shipping stager stage the night, and does a staged night yield a composite.
+///
+/// The display half (whether Today shows a stale carried value or falls through to its no-data state) is
+/// #977's `freshRestScore` + `isCarryStale`, which live in the app target and are covered there and by
+/// Android's `RestFreshnessTest`. This package pins only what it owns, and says so at the bottom of the
+/// file rather than keeping a test that re-simulates a rule it cannot import.
+final class Live5NoGravityRestChainTests: XCTestCase {
+
+    private func hrStream(start: Int, durationS: Int, bpm: Int) -> [HRSample] {
+        stride(from: 0, to: durationS, by: 1).map { HRSample(ts: start + $0, bpm: bpm) }
+    }
+
+    /// A late-night start (02:00 UTC, tzOffset 0) so the window is unambiguously overnight and
+    /// the daytime false-sleep guard is irrelevant to the outcome.
+    private func nightStart() -> Int {
+        let refMidnight = 1_749_513_600   // 2026-06-10 00:00:00 UTC
+        return refMidnight + 2 * 3_600
+    }
+
+    // MARK: - Stage 1: no gravity ⇒ no sleep session (the direct BLE-live-5.0 shape)
+
+    /// V1, stated EXPLICITLY rather than taken from the default: 8 h of continuous sleep-plausible HR
+    /// with zero gravity yields nothing, because V1's spine is motion stillness and there is none.
+    ///
+    /// `SleepStagerTests.testDetectSleepEmptyGravity` already asserts the empty-gravity case once, on the
+    /// default stager. The pair here is not that assertion again: it is the statement that the answer is
+    /// the SAME on both stagers, which is the fact the chain turns on and the one whose absence let this
+    /// file spend two years implying V2 might rescue the night. The original spelling relied on
+    /// `useSleepStagerV2`'s default, so it silently stopped describing shipped behaviour when that
+    /// default moved — which is how the implication survived.
+    func testV1WithNoGravityDetectsNoSleep() {
+        let start = nightStart()
+        let dur = 8 * 60 * 60
+        let hr = hrStream(start: start, durationS: dur, bpm: 50)
+        let sessions = SleepStager.detectSleep(hr: hr, gravity: [], useSleepStagerV2: false)
+        XCTAssertTrue(sessions.isEmpty,
+                      "V1's spine is motion stillness: no gravity, no session")
+    }
+
+    /// V2 too. This is the correction to my first attempt at this test, which asserted that V2 WOULD
+    /// stage here and failed in CI — rightly.
+    ///
+    /// `detectSleep` has no HR-only rescue on either stager: V2's extra machinery is in how it stages a
+    /// run, not in finding one without motion. The rescue lives one layer up. `IntelligenceEngine` sees
+    /// the empty result and, when there is no motion, no hypnogram and no stored night, falls back to
+    /// `SleepStager.hrOnlySessions(hr:rr:resp:)` and feeds the result in as `providedSleep`
+    /// (`IntelligenceEngine.swift`, gate line `no-motion-no-hypnogram`). That fallback is covered by
+    /// `SleepStagerHrOnlySessionsTests` and `AnalyticsEngineHrOnlyDayTests`, so it is named here rather
+    /// than duplicated.
+    ///
+    /// Pinning this keeps the two facts adjacent: detection genuinely yields nothing without motion, and
+    /// that is not the end of the story — which is exactly what the original version of this file got
+    /// wrong in the other direction, by treating the empty result as the final word on Rest.
+    func testV2WithNoGravityAlsoDetectsNoSleep() {
+        let start = nightStart()
+        let hr = hrStream(start: start, durationS: 8 * 60 * 60, bpm: 50)
+        let sessions = SleepStager.detectSleep(hr: hr, gravity: [], useSleepStagerV2: true)
+        XCTAssertTrue(sessions.isEmpty,
+                      "detectSleep needs motion on either stager; the HR-only rescue is the engine's fallback")
+    }
+
+    // MARK: - Stage 2: no sleep ⇒ no Rest composite ⇒ no sleep_performance point
+
+    /// A DailyMetric shaped exactly as `analyzeDay` leaves it when `matched` is empty: HRV/RHR
+    /// present (so Charge can still be scored) but no sleep aggregates. This is the row a live-5.0
+    /// day produces when gravity never offloaded.
+    private func chargeableButUnsleptDaily(day: String) -> DailyMetric {
+        DailyMetric(day: day,
+                    totalSleepMin: nil,   // absent ⇒ no Rest composite
+                    efficiency: nil,      // absent ⇒ no Rest composite
+                    deepMin: nil, remMin: nil, lightMin: nil, disturbances: nil,
+                    restingHr: 52,        // present ⇒ recovery/Charge advances
+                    avgHrv: 65,           // present ⇒ recovery/Charge advances
+                    recovery: nil, strain: nil, exerciseCount: nil,
+                    spo2Pct: nil, skinTempDevC: nil, respRateBpm: nil)
+    }
+
+    func testUnsleptDailyProducesNilRestComposite() {
+        let daily = chargeableButUnsleptDaily(day: "2026-07-02")
+        // This is the exact guard at AnalyticsEngine.Rest.composite(daily:) line 696:
+        //   guard let tstMin = d.totalSleepMin, tstMin > 0, let eff = d.efficiency else { return nil }
+        XCTAssertNil(AnalyticsEngine.Rest.composite(daily: daily),
+                     "No sleep aggregates ⇒ Rest.composite(daily:) is nil ⇒ no sleep_performance point written")
+    }
+
+    // MARK: - Stage 3: the display-side freeze this produces
+
+    /// Reproduces the Today resolver's tail fallback (iOS LiquidTodayView.swift line 777 /
+    /// Android TodayScreen.kt line 689): when today has no `sleep_performance` row, both
+    /// platforms fall back to the latest value in the series. If new nights never write a row,
+    /// that latest value is pinned to the last night that WAS scored — 93 — forever.
+    // The downstream joint - a STAGED night yields a composite - deliberately has no test here either.
+    // `Rest.composite` is exercised in `RestWiringImpactTests`, `RestSubScoreTraceTests`,
+    // `SleepStageTotalsTests` and `AnalyticsEngineTests`; a fifth assertion that a complete row scores
+    // would be noise. What is NOT covered elsewhere is the nil case above, which is the one this chain
+    // turns on, so that is the one that lives here.
+
+    // The display half deliberately has NO test here. It used to, and that test asserted `max(by:)` over a
+    // literal dictionary — it exercised no product code at all, which is worse than no test because it
+    // reads like coverage. Since #977 the rule it meant to describe is `freshRestScore` + `isCarryStale`:
+    // today's own value wins, the carry applies only on today and only inside the freshness window, and
+    // otherwise the read-out falls through to its no-data state instead of freezing on a weeks-old number.
+    // Those live in the app target and in Android's `TodayScoring.freshRestScore`, covered by
+    // `RestFreshnessTest`. This package pins what it owns and points at the rest.
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/Live5RestFrozenTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/Live5RestFrozenTests.swift
deleted file mode 100644
index 996cbbad79..0000000000
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/Live5RestFrozenTests.swift
+++ /dev/null
@@ -1,119 +0,0 @@
-import XCTest
-@testable import StrandAnalytics
-import WhoopProtocol
-import WhoopStore
-
-/// Bug #977 (iOS, WHOOP 5.0, live Bluetooth): "Rest score stuck 93 since forever."
-///
-/// Root cause under test: a LIVE WHOOP 5.0 streams standard 0x2A37 HR continuously, but
-/// the accelerometer / gravity stream is only ever populated by the *history offload*
-/// (Backfiller). When the overnight gravity has not been offloaded/decoded, the day reaches
-/// the scoring loop with dense HR (so it clears IntelligenceEngine's `hr.count >= 200` gate
-/// and recovery/Charge can still be computed from HR/HRV), but `SleepStager.detectSleep`
-/// bails at `grav.count < 2 { return [] }` — so no sleep is matched, the DailyMetric carries
-/// no `totalSleepMin`/`efficiency`, and `AnalyticsEngine.Rest.composite(daily:)` returns nil.
-///
-/// A nil composite means NO `sleep_performance` point is written for that night, so the Today
-/// display falls back to the tail of the series (iOS `restSeries.last`, Android
-/// `byDay.entries.maxByOrNull`) — the last night that WAS scored, e.g. 93 — and Rest is frozen
-/// there forever while Charge keeps advancing.
-///
-/// These tests pin the mechanism. They are written to FAIL against a fix that makes a live-5.0
-/// night produce SOME advancing Rest signal (whether by an HR-only fallback composite or by
-/// forcing a gravity offload before scoring). Today they document the frozen state.
-final class Live5RestFrozenTests: XCTestCase {
-
-    private func hrStream(start: Int, durationS: Int, bpm: Int) -> [HRSample] {
-        stride(from: 0, to: durationS, by: 1).map { HRSample(ts: start + $0, bpm: bpm) }
-    }
-
-    /// A late-night start (02:00 UTC, tzOffset 0) so the window is unambiguously overnight and
-    /// the daytime false-sleep guard is irrelevant to the outcome.
-    private func nightStart() -> Int {
-        let refMidnight = 1_749_513_600   // 2026-06-10 00:00:00 UTC
-        return refMidnight + 2 * 3_600
-    }
-
-    // MARK: - Stage 1: no gravity ⇒ no sleep session (the direct BLE-live-5.0 shape)
-
-    func testLive5NoGravityDenseHRDetectsNoSleep() {
-        // 8 h of continuous, sleep-plausible HR (a real live-5.0 night streamed over 0x2A37),
-        // but ZERO gravity because the accelerometer offload hasn't landed. detectSleep must
-        // return no sessions — the strap streamed HR but not motion.
-        let start = nightStart()
-        let dur = 8 * 60 * 60
-        let hr = hrStream(start: start, durationS: dur, bpm: 50)
-        let sessions = SleepStager.detectSleep(hr: hr, gravity: [])
-        XCTAssertTrue(sessions.isEmpty,
-                      "A live-5.0 night with HR but no offloaded gravity yields no sleep session")
-    }
-
-    // MARK: - Stage 2: no sleep ⇒ no Rest composite ⇒ no sleep_performance point
-
-    /// A DailyMetric shaped exactly as `analyzeDay` leaves it when `matched` is empty: HRV/RHR
-    /// present (so Charge can still be scored) but no sleep aggregates. This is the row a live-5.0
-    /// day produces when gravity never offloaded.
-    private func chargeableButUnsleptDaily(day: String) -> DailyMetric {
-        DailyMetric(day: day,
-                    totalSleepMin: nil,   // absent ⇒ no Rest composite
-                    efficiency: nil,      // absent ⇒ no Rest composite
-                    deepMin: nil, remMin: nil, lightMin: nil, disturbances: nil,
-                    restingHr: 52,        // present ⇒ recovery/Charge advances
-                    avgHrv: 65,           // present ⇒ recovery/Charge advances
-                    recovery: nil, strain: nil, exerciseCount: nil,
-                    spo2Pct: nil, skinTempDevC: nil, respRateBpm: nil)
-    }
-
-    func testUnsleptDailyProducesNilRestComposite() {
-        let daily = chargeableButUnsleptDaily(day: "2026-07-02")
-        // This is the exact guard at AnalyticsEngine.Rest.composite(daily:) line 696:
-        //   guard let tstMin = d.totalSleepMin, tstMin > 0, let eff = d.efficiency else { return nil }
-        XCTAssertNil(AnalyticsEngine.Rest.composite(daily: daily),
-                     "No sleep aggregates ⇒ Rest.composite(daily:) is nil ⇒ no sleep_performance point written")
-    }
-
-    // MARK: - Stage 3: the display-side freeze this produces
-
-    /// Reproduces the Today resolver's tail fallback (iOS LiquidTodayView.swift line 777 /
-    /// Android TodayScreen.kt line 689): when today has no `sleep_performance` row, both
-    /// platforms fall back to the latest value in the series. If new nights never write a row,
-    /// that latest value is pinned to the last night that WAS scored — 93 — forever.
-    // MARK: - The FIX CONTRACT (fails today, passes once #977 is fixed)
-
-    /// The contract a fix must satisfy: a live-5.0 day that has HRV/RHR (Charge advances) but no
-    /// staged sleep must NOT silently produce a nil Rest signal that freezes the display. Whatever
-    /// the fix (an HR-only degraded Rest fallback for a chargeable-but-unslept day, OR forcing a
-    /// gravity offload before scoring so `matched` is non-empty), the observable requirement is:
-    /// a chargeable day yields SOME non-nil Rest signal so Today advances instead of tailing.
-    ///
-    /// This intentionally FAILS against today's code (Rest.composite(daily:) returns nil for such a
-    /// day). Delete the XCTExpectFailure wrapper when the fix lands.
-    func testChargeableDayShouldYieldAdvancingRestSignal_FIX() throws {
-#if canImport(Darwin)
-        XCTExpectFailure("#977 not yet fixed: a chargeable-but-unslept live-5.0 day yields a nil Rest signal") {
-            let daily = chargeableButUnsleptDaily(day: "2026-07-02")
-            XCTAssertNotNil(AnalyticsEngine.Rest.composite(daily: daily),
-                            "A day that can score Charge must also surface SOME Rest signal, not freeze")
-        }
-#else
-        throw XCTSkip("XCTExpectFailure is unavailable in corelibs XCTest")
-#endif
-    }
-
-    func testTodayRestFreezesOnTailFallbackWhenNoNewPointWritten() {
-        // sleep_performance series that stopped advancing days ago (last computed night = 93).
-        let restByDay: [String: Double] = [
-            "2026-06-25": 88,
-            "2026-06-26": 91,
-            "2026-06-27": 93,   // the last night gravity offloaded + scored
-        ]
-        let seriesTail = restByDay.max(by: { $0.key < $1.key })?.value   // == restSeries.last / maxByOrNull
-
-        // Several later days ran (Charge advanced) but wrote NO sleep_performance row.
-        for today in ["2026-06-28", "2026-06-29", "2026-06-30", "2026-07-01", "2026-07-02"] {
-            let restToday = restByDay[today] ?? seriesTail   // offset 0 tail fallback
-            XCTAssertEqual(restToday, 93,
-                           "\(today): Today shows the frozen tail (93), never a fresh score")
-        }
-    }
-}

From 2db7e763445e0029caafcb5b7493e88c1d327852 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 16:07:08 +1200
Subject: [PATCH 270/333] build: testing build 445 / 326

Build numbers only; 11.1.1 stays as the next unreleased version.

Carries the Liquid Effort tile fixes: the "%" is gone from a load index, the
tile honours the effort-scale toggle so it can no longer disagree with the hero
ring above it, a missing metric no longer renders "-%", and Effort resolves
through the live/stored floor from the whole day rather than the first ten
hours of it - on both Today screens.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index e90ce05098..e589844812 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 444
+        versionCode = 445
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 3f1580a8bb..3986736b73 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "325"
+    CURRENT_PROJECT_VERSION: "326"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From e750953cf20a05ce6ec05c5ac97e15fbca7ad92c Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Sun, 6 Sep 2026 10:26:47 +0530
Subject: [PATCH 271/333] coach: streaming, persisted history, voice, morning
 brief, widgets and Siri (K1-K15)

From @evoveotech.

Extends the existing opt-in, bring-your-own-key Coach with streaming, persisted
history, voice input, a scheduled morning brief, widgets and a Siri intent
(K1-K15). Nothing here changes the offline contract: the key stays in
Keychain/Keystore, every call is user-initiated bar the triple-gated default-off
brief, and conversation history is on-device only and deliberately outside the
.noopbak whitelist.

The migration is done properly: all three Room numbers agree, entity field order
matches the migration's CREATE TABLE, and both schema oracles carry the new table
with its TEXT-PK divergence recorded in the existing idiom.
CoachBriefScheduler is honest about iOS background reality - a
BGAppRefreshTaskRequest submitted for no-earlier-than, not a timer pretending to
run while suspended - and never marks a day done on a failed generation.

Voice is on-device by construction rather than by preference: availability gates
on API 31+ AND isOnDeviceRecognitionAvailable, the recognizer comes only from
createOnDeviceSpeechRecognizer, and the SDK branch returns rather than falling
back, so audio cannot reach a server. That was the one blocking item on review
and it was fixed properly.

SseDeltas trims newlines on both platforms now, so a CRLF stream's [DONE]
sentinel is seen on iOS too, and an empty content delta yields nil on both sides
rather than firing onDelta on one.

Verified on a fresh checkout with --no-build-cache: 5379 tests / 0 failures, the
schema oracle and migration chain tests among them.

Two small residuals go into a follow-up rather than another rebase of a
5,600-line branch: two operator-facing strings in the voice controller are still
English literals (one of them added by the on-device fix), and the CRLF cases are
pinned on the Swift side only.
---
 .../StrandAnalytics/CoachSuggestions.swift    | 102 +++++
 .../Sources/StrandAnalytics/SseDeltas.swift   | 126 +++++
 .../CoachSuggestionsTests.swift               | 156 +++++++
 .../StrandAnalyticsTests/SseDeltasTests.swift | 231 ++++++++++
 .../WhoopStore/CoachMessageStore.swift        |  73 +++
 .../Sources/WhoopStore/Database.swift         |  18 +
 .../Resources/schema_oracle.json              |  54 ++-
 Strand/AI/AICoach.swift                       | 336 +++++++++++++-
 Strand/AI/AIProvider.swift                    | 102 +++++
 Strand/AI/Providers/Anthropic.swift           |  37 ++
 Strand/AI/Providers/Custom.swift              |  37 ++
 Strand/AI/Providers/Gemini.swift              | 110 ++++-
 Strand/AI/Providers/OpenAI.swift              |  32 ++
 Strand/App/NavRouter.swift                    |   1 +
 Strand/App/StrandApp.swift                    |   6 +-
 Strand/Resources/Localizable.xcstrings        | 268 ++++++++++-
 Strand/Screens/CoachView.swift                | 387 +++++++++++++++-
 Strand/System/CoachBriefScheduler.swift       | 370 +++++++++++++++
 Strand/System/NotificationPresenter.swift     |  20 +
 StrandiOS/App/AppModel+iOS.swift              |  17 +-
 StrandiOS/App/CoachVoiceInput.swift           | 241 ++++++++++
 StrandiOS/App/RootTabView.swift               |  20 +-
 StrandiOS/App/StrandiOSApp.swift              |   8 +-
 StrandiOS/System/NOOPAppIntents.swift         |  50 +-
 StrandiOSWidgets/CoachBriefWidget.swift       | 183 ++++++++
 StrandiOSWidgets/NOOPWidgetBundle.swift       |   4 +-
 android/app/src/main/AndroidManifest.xml      |  22 +
 .../app/src/main/java/com/noop/ai/AiCoach.kt  | 315 ++++++++++++-
 .../app/src/main/java/com/noop/ai/ChatMsg.kt  |   4 +
 .../com/noop/analytics/CoachSuggestions.kt    | 100 ++++
 .../main/java/com/noop/analytics/SseDeltas.kt | 114 +++++
 .../src/main/java/com/noop/data/Entities.kt   |  22 +
 .../src/main/java/com/noop/data/WhoopDao.kt   |  27 ++
 .../main/java/com/noop/data/WhoopDatabase.kt  |  26 +-
 .../java/com/noop/ui/CoachBriefScheduler.kt   | 320 +++++++++++++
 .../src/main/java/com/noop/ui/CoachScreen.kt  | 432 ++++++++++++++++--
 .../main/java/com/noop/ui/CoachViewModel.kt   | 240 +++++++++-
 .../main/java/com/noop/ui/CoachVoiceInput.kt  | 168 +++++++
 .../src/main/java/com/noop/ui/MainActivity.kt |  15 +
 .../com/noop/widget/CoachBriefGlanceWidget.kt | 120 +++++
 .../noop/widget/CoachBriefWidgetReceiver.kt   |   9 +
 .../app/src/main/res/values-de/strings.xml    |  39 ++
 .../app/src/main/res/values-es/strings.xml    |  39 ++
 .../app/src/main/res/values-fr/strings.xml    |  39 ++
 .../app/src/main/res/values-pl/strings.xml    |  39 ++
 .../src/main/res/values-pt-rPT/strings.xml    |  39 ++
 .../app/src/main/res/values-ru/strings.xml    |  38 ++
 .../app/src/main/res/values-zh/strings.xml    |  39 ++
 android/app/src/main/res/values/strings.xml   |  42 ++
 .../main/res/xml/coach_brief_widget_info.xml  |  12 +
 .../noop/analytics/CoachSuggestionsTest.kt    | 170 +++++++
 .../java/com/noop/analytics/SseDeltasTest.kt  | 271 +++++++++++
 .../app/src/test/resources/schema_oracle.json |  54 ++-
 project.yml                                   |   6 +
 54 files changed, 5643 insertions(+), 107 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Sources/StrandAnalytics/CoachSuggestions.swift
 create mode 100644 Packages/StrandAnalytics/Sources/StrandAnalytics/SseDeltas.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CoachSuggestionsTests.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SseDeltasTests.swift
 create mode 100644 Packages/WhoopStore/Sources/WhoopStore/CoachMessageStore.swift
 create mode 100644 Strand/System/CoachBriefScheduler.swift
 create mode 100644 StrandiOS/App/CoachVoiceInput.swift
 create mode 100644 StrandiOSWidgets/CoachBriefWidget.swift
 create mode 100644 android/app/src/main/java/com/noop/analytics/CoachSuggestions.kt
 create mode 100644 android/app/src/main/java/com/noop/analytics/SseDeltas.kt
 create mode 100644 android/app/src/main/java/com/noop/ui/CoachBriefScheduler.kt
 create mode 100644 android/app/src/main/java/com/noop/ui/CoachVoiceInput.kt
 create mode 100644 android/app/src/main/java/com/noop/widget/CoachBriefGlanceWidget.kt
 create mode 100644 android/app/src/main/java/com/noop/widget/CoachBriefWidgetReceiver.kt
 create mode 100644 android/app/src/main/res/xml/coach_brief_widget_info.xml
 create mode 100644 android/app/src/test/java/com/noop/analytics/CoachSuggestionsTest.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/SseDeltasTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/CoachSuggestions.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/CoachSuggestions.swift
new file mode 100644
index 0000000000..3199f5b397
--- /dev/null
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/CoachSuggestions.swift
@@ -0,0 +1,102 @@
+import Foundation
+import WhoopStore
+
+// CoachSuggestions.swift — contextual coaching prompt chips derived from the user's own bands.
+//
+// Pure + deterministic so it is unit-testable without a strap, network, or app target, and so the
+// output can be byte-identical to the Android twin `com.noop.analytics.CoachSuggestions` (the
+// cross-platform parity contract: the same inputs produce the same chip strings on both platforms).
+// Reads only DailyMetric fields that already live on-device; no new egress, no telemetry.
+
+/// Contextual suggestion chips for the Coach composer, derived from today's bands.
+public enum CoachSuggestions {
+
+    /// The stable generic set used when there is no usable data for today. Byte-identical to the
+    /// Android `FALLBACK` list.
+    public static let fallback: [String] = [
+        "How's my recovery trending this week?",
+        "What should today's training look like?",
+        "Analyse my sleep",
+        "Why am I run down?",
+    ]
+
+    /// A stable generic prompt always appended as the last chip so there is a consistent entry point
+    /// even when the contextual chips already cover the user's situation.
+    private static let stableGeneric = "Analyse my sleep"
+
+    /// Charge band cutoffs (mirrors the autoregulation bands in `AICoachEngine.defaultSystemPrompt`).
+    private static let chargeRedCutoff: Double = 34
+    private static let chargeGreenCutoff: Double = 67
+    /// HRV "trending down" threshold: today's HRV below 85% of the trailing-30-day baseline (excluding
+    /// today) flags a downward nudge. Matches the Android twin.
+    private static let hrvDownRatio: Double = 0.85
+    /// Sleep "poor night" cutoff: under 6h (360 min).
+    private static let poorSleepMin: Double = 360
+    /// "Already loaded" strain cutoff: a day strain at/above 14 reads as a high-load day.
+    private static let highStrain: Double = 14
+    /// Max chips surfaced.
+    private static let maxChips: Int = 4
+
+    /// Build 2–4 contextual prompt chips from today's bands, falling back to `fallback` when there is
+    /// no usable data. `recent` is oldest→newest and is used for the trailing-30-day HRV baseline.
+    ///
+    /// - Parameters:
+    ///   - today: today's (or the newest scored) `DailyMetric`; nil when no data is available.
+    ///   - recent: recent days oldest→newest, for the HRV baseline. May be empty or may include today.
+    /// - Returns: 2–4 chip strings (contextual) or the 4-string `fallback`.
+    public static func suggestions(for today: DailyMetric?, recent: [DailyMetric]) -> [String] {
+        guard let today else { return fallback }
+        let charge = today.recovery
+        let hrv = today.avgHrv
+        let sleep = today.totalSleepMin
+        let strain = today.strain
+        // No usable signal at all → generic fallback.
+        guard charge != nil || hrv != nil || sleep != nil || strain != nil else { return fallback }
+
+        var chips: [String] = []
+
+        // 1. Charge band → one readiness prescription chip.
+        if let c = charge {
+            if c < chargeRedCutoff {
+                chips.append("Active recovery only today — what should I do?")
+            } else if c < chargeGreenCutoff {
+                chips.append("Quality over volume today — plan my session")
+            } else {
+                chips.append("Green light — how hard can I push today?")
+            }
+        }
+
+        // 2. HRV trending down vs trailing-30-day baseline (excluding today).
+        if let h = hrv {
+            let baseline = hrvBaseline(recent, excluding: today.day)
+            if let avg = baseline, avg > 0, h < hrvDownRatio * avg {
+                chips.append("Why is my HRV trending down?")
+            }
+        }
+
+        // 3. Poor sleep (< 6h).
+        if let s = sleep, s < poorSleepMin {
+            chips.append("I slept poorly — how do I recover today?")
+        }
+
+        // 4. Already a high-strain day.
+        if let st = strain, st >= highStrain {
+            chips.append("Have I done enough today, or push more?")
+        }
+
+        // Signals present but none of the band conditions fired → generic fallback (avoids a lone
+        // stable chip when there's nothing contextual to say).
+        guard !chips.isEmpty else { return fallback }
+        // Cap the CONTEXTUAL chips at maxChips−1 so the stable generic always survives as the last
+        // chip (a consistent entry point), then append it. Total never exceeds maxChips.
+        return Array(chips.prefix(maxChips - 1)) + [stableGeneric]
+    }
+
+    /// Mean of `avgHrv` over the trailing 30 days of `recent`, excluding the day `excludingDay`.
+    /// Returns nil when no qualifying night has an HRV value. Pure; byte-twin of the Android helper.
+    private static func hrvBaseline(_ recent: [DailyMetric], excluding day: String) -> Double? {
+        let values = recent.suffix(30).filter { $0.day != day }.compactMap { $0.avgHrv }
+        guard !values.isEmpty else { return nil }
+        return values.reduce(0, +) / Double(values.count)
+    }
+}
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SseDeltas.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SseDeltas.swift
new file mode 100644
index 0000000000..d50ac9fd5e
--- /dev/null
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SseDeltas.swift
@@ -0,0 +1,126 @@
+import Foundation
+
+// SseDeltas.swift — pure SSE delta parsing for AI provider streaming.
+//
+// The verifiable core of K1 (streaming): given one SSE `data:` payload, extract the text delta
+// for the provider's wire shape. Pure + deterministic so it is unit-testable without a network,
+// and byte-identical to the Android twin `com.noop.analytics.SseDeltas`. The streaming HTTP glue
+// (URLSession.bytes / OkHttp source) is thin and calls into these pure functions per line.
+//
+// No network, no Foundation URL loading, no I/O — only JSONSerialization (Foundation core, available
+// in the package test target on macOS + Linux). The anonymity / no-raw-egress posture is unchanged:
+// streaming changes transport, not payload.
+
+/// Pure SSE delta extraction for the three provider wire shapes the coach speaks.
+/// Byte-twin of Android `com.noop.analytics.SseDeltas`.
+public enum SseDeltas {
+
+    /// The SSE stream terminator sent by OpenAI-compatible servers.
+    public static let doneMarker = "[DONE]"
+
+    // MARK: - SSE line splitting
+
+    /// Strip the `data: ` prefix from one SSE line and return the raw payload, or nil for blank
+    /// lines (event separators), comments (`: …`), or non-data fields (`event:`, `id:`, etc.).
+    /// Pure; byte-twin of Android `dataPayload(fromLine:)`.
+    public static func dataPayload(fromLine line: String) -> String? {
+        // SSE lines are terminated by \n; the caller splits on \n. A trailing \r (CRLF streams)
+        // must be stripped — Kotlin's trim() removes \r, so .whitespacesAndNewlines keeps parity.
+        // A blank line is an event separator — no payload. A line starting with ":" is a comment.
+        let trimmed = line.trimmingCharacters(in: .whitespacesAndNewlines)
+        if trimmed.isEmpty { return nil }
+        if trimmed.hasPrefix(":") { return nil }
+        // "data:" or "data: " — strip the prefix, then one optional leading space (SSE spec: the
+        // space after the colon is not part of the value).
+        if trimmed.hasPrefix("data:") {
+            var payload = String(trimmed.dropFirst("data:".count))
+            if payload.hasPrefix(" ") { payload = String(payload.dropFirst()) }
+            return payload
+        }
+        // Other SSE fields (event:, id:, retry:) are not data — skip.
+        return nil
+    }
+
+    /// True when a data payload is the `[DONE]` terminator (OpenAI-compatible). Pure.
+    public static func isDone(_ payload: String) -> Bool {
+        payload.trimmingCharacters(in: .whitespacesAndNewlines) == doneMarker
+    }
+
+    // MARK: - Per-provider delta extraction
+
+    /// Extract the text delta from an OpenAI-compatible SSE data payload.
+    /// Shape: `{"choices":[{"delta":{"content":"hello"}}]}` → `"hello"`.
+    /// Returns nil for a `[DONE]` line, a payload with no choices, or a non-content delta (e.g.
+    /// the `role` delta on the first chunk). Pure; byte-twin of Android `openAiDelta`.
+    public static func openAiDelta(_ payload: String) -> String? {
+        if isDone(payload) { return nil }
+        guard let data = payload.data(using: .utf8),
+              let obj = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+              let choices = obj["choices"] as? [[String: Any]],
+              let first = choices.first,
+              let delta = first["delta"] as? [String: Any],
+              let content = delta["content"] as? String else { return nil }
+        // Kotlin twin returns null for empty content (optString.takeIf { isNotEmpty() }), so
+        // onDelta does not fire for OpenAI's usual first delta `"content": ""`. Returning ""
+        // here would fire onDelta on Swift but not Kotlin — breaks K14 haptic parity.
+        return content.isEmpty ? nil : content
+    }
+
+    /// Extract the text delta from a Gemini SSE data payload (`:streamGenerateContent?alt=sse`).
+    /// Shape: `{"candidates":[{"content":{"parts":[{"text":"hello"}]}}]}` → `"hello"`.
+    /// Gemini streams full candidate objects per chunk; each may carry multiple parts. Returns nil
+    /// for a chunk with no text parts (e.g. the final `finishReason` chunk). Pure; byte-twin of
+    /// Android `geminiDelta`.
+    public static func geminiDelta(_ payload: String) -> String? {
+        guard let data = payload.data(using: .utf8),
+              let obj = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+              let candidates = obj["candidates"] as? [[String: Any]],
+              let first = candidates.first,
+              let content = first["content"] as? [String: Any],
+              let parts = content["parts"] as? [[String: Any]] else { return nil }
+        let text = parts.compactMap { $0["text"] as? String }.joined()
+        return text.isEmpty ? nil : text
+    }
+
+    /// Extract the text delta from an Anthropic SSE data payload.
+    /// Shape: `{"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"hello"}}`
+    /// → `"hello"`. Returns nil for non-text-delta events (`message_start`, `ping`, `message_stop`,
+    /// `content_block_start`, etc.). Pure; byte-twin of Android `anthropicDelta`.
+    public static func anthropicDelta(_ payload: String) -> String? {
+        guard let data = payload.data(using: .utf8),
+              let obj = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+              let type = obj["type"] as? String,
+              type == "content_block_delta",
+              let delta = obj["delta"] as? [String: Any],
+              let deltaType = delta["type"] as? String,
+              deltaType == "text_delta",
+              let text = delta["text"] as? String else { return nil }
+        // Kotlin twin returns null for empty text — parity with openAiDelta above.
+        return text.isEmpty ? nil : text
+    }
+
+    // MARK: - Full-stream reassembly (test helper)
+
+    /// Reassemble the full reply text from a complete SSE stream (all lines, in order) for the
+    /// given provider shape. Pure; used by tests to assert the streamed text equals the non-streamed
+    /// reply. Byte-twin of Android `reassemble`.
+    public static func reassemble(lines: [String], provider: SseProvider) -> String {
+        var out = ""
+        for line in lines {
+            guard let payload = dataPayload(fromLine: line) else { continue }
+            let delta: String?
+            switch provider {
+            case .openAi, .custom:  delta = openAiDelta(payload)
+            case .gemini:           delta = geminiDelta(payload)
+            case .anthropic:        delta = anthropicDelta(payload)
+            }
+            if let d = delta { out += d }
+        }
+        return out
+    }
+}
+
+/// The provider wire shape to use for delta extraction. `.custom` shares the OpenAI shape.
+public enum SseProvider {
+    case openAi, custom, gemini, anthropic
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CoachSuggestionsTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CoachSuggestionsTests.swift
new file mode 100644
index 0000000000..e8b1e7b1db
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CoachSuggestionsTests.swift
@@ -0,0 +1,156 @@
+import Foundation
+import XCTest
+@testable import StrandAnalytics
+import WhoopStore
+
+/// Byte-identity pin for the contextual Coach suggestion chips. The same inputs MUST produce the
+/// same chip strings as the Android twin `com.noop.analytics.CoachSuggestionsTest`. Cross-platform
+/// parity is the contract; if you change a chip string here, change it there in the same PR.
+final class CoachSuggestionsTests: XCTestCase {
+
+    private let fallback = CoachSuggestions.fallback
+
+    /// Build a DailyMetric with only the fields the chip logic reads, everything else nil.
+    private func metric(
+        day: Int, recovery: Double? = nil, hrv: Double? = nil,
+        sleepMin: Double? = nil, strain: Double? = nil
+    ) -> DailyMetric {
+        DailyMetric(
+            day: String(format: "2026-01-%02d", day),
+            totalSleepMin: sleepMin, efficiency: nil, deepMin: nil, remMin: nil, lightMin: nil,
+            disturbances: nil, restingHr: nil, avgHrv: hrv, recovery: recovery, strain: strain,
+            exerciseCount: nil, spo2Pct: nil, skinTempDevC: nil, respRateBpm: nil
+        )
+    }
+
+    // MARK: - No-data fallback
+
+    func testNilTodayReturnsFallback() {
+        XCTAssertEqual(CoachSuggestions.suggestions(for: nil, recent: []), fallback)
+    }
+
+    func testAllNilFieldsReturnsFallback() {
+        let today = metric(day: 10) // all four signals nil
+        XCTAssertEqual(CoachSuggestions.suggestions(for: today, recent: []), fallback)
+    }
+
+    // MARK: - Charge bands
+
+    func testLowChargeActiveRecoveryChip() {
+        let today = metric(day: 10, recovery: 20)
+        let chips = CoachSuggestions.suggestions(for: today, recent: [])
+        XCTAssertEqual(chips.first, "Active recovery only today — what should I do?")
+        XCTAssertEqual(chips.last, "Analyse my sleep")
+        XCTAssertTrue(chips.count >= 2 && chips.count <= 4)
+    }
+
+    func testMidChargeQualityOverVolumeChip() {
+        let today = metric(day: 10, recovery: 50)
+        let chips = CoachSuggestions.suggestions(for: today, recent: [])
+        XCTAssertEqual(chips.first, "Quality over volume today — plan my session")
+    }
+
+    func testHighChargeGreenLightChip() {
+        let today = metric(day: 10, recovery: 90)
+        let chips = CoachSuggestions.suggestions(for: today, recent: [])
+        XCTAssertEqual(chips.first, "Green light — how hard can I push today?")
+    }
+
+    func testChargeBoundary34IsMidBand() {
+        let today = metric(day: 10, recovery: 34)
+        XCTAssertEqual(CoachSuggestions.suggestions(for: today, recent: []).first,
+                       "Quality over volume today — plan my session")
+    }
+
+    func testChargeBoundary67IsGreenBand() {
+        let today = metric(day: 10, recovery: 67)
+        XCTAssertEqual(CoachSuggestions.suggestions(for: today, recent: []).first,
+                       "Green light — how hard can I push today?")
+    }
+
+    // MARK: - HRV trending down
+
+    func testHrvBelowBaselineAddsDownChip() {
+        // 30 days of HRV ~60, then today at 45 (< 0.85 * 60 = 51).
+        let recent = (1...30).map { metric(day: $0, hrv: 60) }
+        let today = metric(day: 31, recovery: 70, hrv: 45)
+        let chips = CoachSuggestions.suggestions(for: today, recent: recent)
+        XCTAssertTrue(chips.contains("Why is my HRV trending down?"))
+    }
+
+    func testHrvAtBaselineDoesNotAddDownChip() {
+        let recent = (1...30).map { metric(day: $0, hrv: 60) }
+        let today = metric(day: 31, recovery: 70, hrv: 60)
+        let chips = CoachSuggestions.suggestions(for: today, recent: recent)
+        XCTAssertFalse(chips.contains("Why is my HRV trending down?"))
+    }
+
+    func testHrvBaselineExcludesToday() {
+        // Today is in `recent` too; it must be excluded from the baseline so a single low day can
+        // still register as "down" against the prior baseline.
+        var recent = (1...30).map { metric(day: $0, hrv: 60) }
+        let today = metric(day: 31, recovery: 70, hrv: 45)
+        recent.append(today)
+        let chips = CoachSuggestions.suggestions(for: today, recent: recent)
+        XCTAssertTrue(chips.contains("Why is my HRV trending down?"))
+    }
+
+    // MARK: - Poor sleep
+
+    func testPoorSleepAddsRecoverChip() {
+        let today = metric(day: 10, recovery: 70, sleepMin: 300) // 5h
+        let chips = CoachSuggestions.suggestions(for: today, recent: [])
+        XCTAssertTrue(chips.contains("I slept poorly — how do I recover today?"))
+    }
+
+    func testSixHoursIsNotPoor() {
+        let today = metric(day: 10, recovery: 70, sleepMin: 360) // exactly 6h
+        let chips = CoachSuggestions.suggestions(for: today, recent: [])
+        XCTAssertFalse(chips.contains("I slept poorly — how do I recover today?"))
+    }
+
+    // MARK: - High strain
+
+    func testHighStrainAddsLoadedChip() {
+        let today = metric(day: 10, recovery: 70, strain: 16)
+        let chips = CoachSuggestions.suggestions(for: today, recent: [])
+        XCTAssertTrue(chips.contains("Have I done enough today, or push more?"))
+    }
+
+    func testStrainBelow14DoesNotAddLoadedChip() {
+        let today = metric(day: 10, recovery: 70, strain: 13)
+        let chips = CoachSuggestions.suggestions(for: today, recent: [])
+        XCTAssertFalse(chips.contains("Have I done enough today, or push more?"))
+    }
+
+    // MARK: - Cap + stable generic
+
+    func testAllSignalsFireCapsAtFour() {
+        let recent = (1...30).map { metric(day: $0, hrv: 60) }
+        let today = metric(day: 31, recovery: 20, hrv: 40, sleepMin: 300, strain: 16)
+        let chips = CoachSuggestions.suggestions(for: today, recent: recent)
+        // charge + hrv + sleep + strain + stable generic = 5 candidates → capped at 4.
+        XCTAssertEqual(chips.count, 4)
+        // The stable generic is appended last; with the cap at 4, it is the 4th element (the 5th
+        // candidate, the strain chip, is dropped). Charge is first.
+        XCTAssertEqual(chips.first, "Active recovery only today — what should I do?")
+        XCTAssertEqual(chips.last, "Analyse my sleep")
+    }
+
+    func testChargeOnlyYieldsChargeAndGeneric() {
+        let today = metric(day: 10, recovery: 90)
+        let chips = CoachSuggestions.suggestions(for: today, recent: [])
+        XCTAssertEqual(chips, ["Green light — how hard can I push today?", "Analyse my sleep"])
+    }
+
+    // MARK: - Byte-identity of the fallback list
+
+    func testFallbackListIsCanonical() {
+        XCTAssertEqual(fallback, [
+            "How's my recovery trending this week?",
+            "What should today's training look like?",
+            "Analyse my sleep",
+            "Why am I run down?",
+        ])
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SseDeltasTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SseDeltasTests.swift
new file mode 100644
index 0000000000..8ac0b6864e
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SseDeltasTests.swift
@@ -0,0 +1,231 @@
+import XCTest
+@testable import StrandAnalytics
+
+/// Byte-identity pin for the SSE delta parser. The same SSE lines MUST produce the same text as
+/// the Android twin `com.noop.analytics.SseDeltasTest`. Cross-platform parity is the contract.
+final class SseDeltasTests: XCTestCase {
+
+    // MARK: - SSE line splitting
+
+    func testStripsDataPrefix() {
+        XCTAssertEqual(SseDeltas.dataPayload(fromLine: "data: {\"hello\":1}"), "{\"hello\":1}")
+    }
+
+    func testStripsDataPrefixNoSpace() {
+        XCTAssertEqual(SseDeltas.dataPayload(fromLine: "data:{\"hello\":1}"), "{\"hello\":1}")
+    }
+
+    func testBlankLineReturnsNil() {
+        XCTAssertNil(SseDeltas.dataPayload(fromLine: ""))
+        XCTAssertNil(SseDeltas.dataPayload(fromLine: "   "))
+    }
+
+    func testCommentLineReturnsNil() {
+        XCTAssertNil(SseDeltas.dataPayload(fromLine: ": keep-alive"))
+    }
+
+    func testNonDataFieldReturnsNil() {
+        XCTAssertNil(SseDeltas.dataPayload(fromLine: "event: content_block_delta"))
+        XCTAssertNil(SseDeltas.dataPayload(fromLine: "id: 12345"))
+        XCTAssertNil(SseDeltas.dataPayload(fromLine: "retry: 1000"))
+    }
+
+    func testIsDone() {
+        XCTAssertTrue(SseDeltas.isDone("[DONE]"))
+        XCTAssertTrue(SseDeltas.isDone(" [DONE] "))
+        XCTAssertFalse(SseDeltas.isDone("{\"choices\":[]}"))
+    }
+
+    // MARK: - CRLF parity (Kotlin trim() strips \r; Swift .whitespaces does not)
+
+    func testIsDoneStripsCRLF() {
+        // A CRLF stream leaves a trailing \r after \n-splitting. Kotlin's trim() removes it;
+        // Swift must use .whitespacesAndNewlines to match, or isDone returns false on iOS.
+        XCTAssertTrue(SseDeltas.isDone("[DONE]\r"))
+        XCTAssertTrue(SseDeltas.isDone("[DONE]\r\n"))
+    }
+
+    func testDataPayloadStripsCRLF() {
+        XCTAssertEqual(SseDeltas.dataPayload(fromLine: "data: {\"hello\":1}\r"), "{\"hello\":1}")
+    }
+
+    // MARK: - OpenAI delta
+
+    func testOpenAiContentDelta() {
+        let payload = #"{"choices":[{"index":0,"delta":{"content":"Hello"}}]}"#
+        XCTAssertEqual(SseDeltas.openAiDelta(payload), "Hello")
+    }
+
+    func testOpenAiRoleDeltaReturnsNil() {
+        // The first chunk often carries only the role, no content.
+        let payload = #"{"choices":[{"index":0,"delta":{"role":"assistant"}}]}"#
+        XCTAssertNil(SseDeltas.openAiDelta(payload))
+    }
+
+    func testOpenAiDoneReturnsNil() {
+        XCTAssertNil(SseDeltas.openAiDelta("[DONE]"))
+    }
+
+    func testOpenAiEmptyChoicesReturnsNil() {
+        XCTAssertNil(SseDeltas.openAiDelta(#"{"choices":[]}"#))
+    }
+
+    func testOpenAiMalformedReturnsNil() {
+        XCTAssertNil(SseDeltas.openAiDelta("not json"))
+    }
+
+    func testOpenAiEmptyContentReturnsNil() {
+        // OpenAI's usual first delta carries `"content": ""`. Kotlin returns null (optString +
+        // takeIf { isNotEmpty() }); Swift must match so onDelta doesn't fire on one platform only
+        // (K14 haptics hang off delta arrival).
+        let payload = #"{"choices":[{"index":0,"delta":{"content":""}}]}"#
+        XCTAssertNil(SseDeltas.openAiDelta(payload))
+    }
+
+    // MARK: - Gemini delta
+
+    func testGeminiTextDelta() {
+        let payload = #"{"candidates":[{"content":{"parts":[{"text":"Hello"}]}}]}"#
+        XCTAssertEqual(SseDeltas.geminiDelta(payload), "Hello")
+    }
+
+    func testGeminiMultiPartDelta() {
+        let payload = #"{"candidates":[{"content":{"parts":[{"text":"Hello "},{"text":"world"}]}}]}"#
+        XCTAssertEqual(SseDeltas.geminiDelta(payload), "Hello world")
+    }
+
+    func testGeminiFinishReasonChunkReturnsNil() {
+        let payload = #"{"candidates":[{"content":{"parts":[]},"finishReason":"STOP"}]}"#
+        XCTAssertNil(SseDeltas.geminiDelta(payload))
+    }
+
+    func testGeminiMalformedReturnsNil() {
+        XCTAssertNil(SseDeltas.geminiDelta("not json"))
+    }
+
+    // MARK: - Anthropic delta
+
+    func testAnthropicTextDelta() {
+        let payload = #"{"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"Hello"}}"#
+        XCTAssertEqual(SseDeltas.anthropicDelta(payload), "Hello")
+    }
+
+    func testAnthropicMessageStartReturnsNil() {
+        let payload = #"{"type":"message_start","message":{"id":"msg_1"}}"#
+        XCTAssertNil(SseDeltas.anthropicDelta(payload))
+    }
+
+    func testAnthropicPingReturnsNil() {
+        let payload = #"{"type":"ping"}"#
+        XCTAssertNil(SseDeltas.anthropicDelta(payload))
+    }
+
+    func testAnthropicContentBlockStartReturnsNil() {
+        let payload = #"{"type":"content_block_start","index":0,"content_block":{"type":"text","text":""}}"#
+        XCTAssertNil(SseDeltas.anthropicDelta(payload))
+    }
+
+    func testAnthropicMessageStopReturnsNil() {
+        let payload = #"{"type":"message_stop"}"#
+        XCTAssertNil(SseDeltas.anthropicDelta(payload))
+    }
+
+    func testAnthropicMalformedReturnsNil() {
+        XCTAssertNil(SseDeltas.anthropicDelta("not json"))
+    }
+
+    func testAnthropicEmptyTextReturnsNil() {
+        // Parity with Kotlin: empty text → null, not "" (same reason as OpenAI empty content).
+        let payload = #"{"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":""}}"#
+        XCTAssertNil(SseDeltas.anthropicDelta(payload))
+    }
+
+    // MARK: - Full-stream reassembly (the parity pin: streamed == non-streamed)
+
+    func testOpenAiReassembleMatchesFullReply() {
+        // A realistic 3-chunk OpenAI stream for the reply "Hello, world!".
+        let lines = [
+            "data: {\"choices\":[{\"index\":0,\"delta\":{\"role\":\"assistant\"}}]}",
+            "",
+            "data: {\"choices\":[{\"index\":0,\"delta\":{\"content\":\"Hello\"}}]}",
+            "",
+            "data: {\"choices\":[{\"index\":0,\"delta\":{\"content\":\", world!\"}}]}",
+            "",
+            "data: {\"choices\":[{\"index\":0,\"finish_reason\":\"stop\"}]}",
+            "",
+            "data: [DONE]",
+            "",
+        ]
+        let reassembled = SseDeltas.reassemble(lines: lines, provider: .openAi)
+        // The non-streamed reply would be "Hello, world!" (the full content from choices[0].message.content).
+        XCTAssertEqual(reassembled, "Hello, world!")
+    }
+
+    func testGeminiReassembleMatchesFullReply() {
+        let lines = [
+            "data: {\"candidates\":[{\"content\":{\"parts\":[{\"text\":\"Recovery\"}]}}]}",
+            "",
+            "data: {\"candidates\":[{\"content\":{\"parts\":[{\"text\":\" is \"}]}}]}",
+            "",
+            "data: {\"candidates\":[{\"content\":{\"parts\":[{\"text\":\"good.\"}]},\"finishReason\":\"STOP\"}]}",
+            "",
+        ]
+        XCTAssertEqual(SseDeltas.reassemble(lines: lines, provider: .gemini), "Recovery is good.")
+    }
+
+    func testAnthropicReassembleMatchesFullReply() {
+        let lines = [
+            "event: message_start",
+            "data: {\"type\":\"message_start\",\"message\":{\"id\":\"msg_1\"}}",
+            "",
+            "event: content_block_start",
+            "data: {\"type\":\"content_block_start\",\"index\":0,\"content_block\":{\"type\":\"text\",\"text\":\"\"}}",
+            "",
+            "event: content_block_delta",
+            "data: {\"type\":\"content_block_delta\",\"index\":0,\"delta\":{\"type\":\"text_delta\",\"text\":\"Sleep\"}}",
+            "",
+            "event: content_block_delta",
+            "data: {\"type\":\"content_block_delta\",\"index\":0,\"delta\":{\"type\":\"text_delta\",\"text\":\" well.\"}}",
+            "",
+            "event: content_block_stop",
+            "data: {\"type\":\"content_block_stop\",\"index\":0}",
+            "",
+            "event: message_stop",
+            "data: {\"type\":\"message_stop\"}",
+            "",
+        ]
+        XCTAssertEqual(SseDeltas.reassemble(lines: lines, provider: .anthropic), "Sleep well.")
+    }
+
+    func testCustomSharesOpenAiShape() {
+        let lines = [
+            "data: {\"choices\":[{\"index\":0,\"delta\":{\"content\":\"Hi\"}}]}",
+            "",
+            "data: [DONE]",
+            "",
+        ]
+        XCTAssertEqual(SseDeltas.reassemble(lines: lines, provider: .custom), "Hi")
+    }
+
+    // MARK: - Empty / edge cases
+
+    func testEmptyStreamReassemblesToEmpty() {
+        XCTAssertEqual(SseDeltas.reassemble(lines: [], provider: .openAi), "")
+    }
+
+    func testOnlyDoneReassemblesToEmpty() {
+        XCTAssertEqual(SseDeltas.reassemble(lines: ["data: [DONE]", ""], provider: .openAi), "")
+    }
+
+    func testIgnoresCommentLines() {
+        let lines = [
+            ": keep-alive",
+            "",
+            "data: {\"choices\":[{\"index\":0,\"delta\":{\"content\":\"ok\"}}]}",
+            "",
+            "data: [DONE]",
+            "",
+        ]
+        XCTAssertEqual(SseDeltas.reassemble(lines: lines, provider: .openAi), "ok")
+    }
+}
diff --git a/Packages/WhoopStore/Sources/WhoopStore/CoachMessageStore.swift b/Packages/WhoopStore/Sources/WhoopStore/CoachMessageStore.swift
new file mode 100644
index 0000000000..f057566eaa
--- /dev/null
+++ b/Packages/WhoopStore/Sources/WhoopStore/CoachMessageStore.swift
@@ -0,0 +1,73 @@
+import Foundation
+import GRDB
+
+// MARK: - v39 store: persisted Coach conversation (PRD-K2)
+//
+// CoachMessageStore.swift — GRDB CRUD over the `coachMessage` table (migration v39), so the AI
+// Coach's chat survives relaunch. Mirrors the established `LabMarkerStore` idiom: a plain Codable
+// row struct, raw `Row` fetch + manual decode, all GRDB work via the actor's `syncWrite`/`syncRead`.
+//
+// Stores only the coach's text replies + the user's questions — no raw biometric readings were ever
+// in the chat (only the derived summary text sent with the request), so this carries the same
+// no-raw-egress posture as the network call itself. NOT part of the `.noopbak` backup whitelist.
+
+/// One persisted turn in the Coach conversation.
+public struct CoachMessageRow: Equatable, Codable, Sendable {
+    public var id: String
+    public var role: String          // "user" | "assistant"
+    public var text: String
+    public var provider: String
+    public var createdAt: Int        // epoch seconds
+    public var orderIndex: Int       // monotonic replay order (two streamed turns can share createdAt)
+
+    public init(id: String, role: String, text: String, provider: String, createdAt: Int, orderIndex: Int) {
+        self.id = id
+        self.role = role
+        self.text = text
+        self.provider = provider
+        self.createdAt = createdAt
+        self.orderIndex = orderIndex
+    }
+
+    static func decode(_ row: Row) -> CoachMessageRow {
+        CoachMessageRow(
+            id: row["id"], role: row["role"], text: row["text"], provider: row["provider"],
+            createdAt: row["createdAt"], orderIndex: row["orderIndex"]
+        )
+    }
+}
+
+extension WhoopStore {
+
+    /// The full stored conversation, oldest first (by `orderIndex`).
+    public func coachMessages() async throws -> [CoachMessageRow] {
+        try syncRead { db in
+            try Row.fetchAll(db, sql: "SELECT * FROM coachMessage ORDER BY orderIndex ASC")
+                .map(CoachMessageRow.decode)
+        }
+    }
+
+    /// Replace the ENTIRE stored conversation with `rows` in one transaction. Simpler and safer than
+    /// incremental insert/update/delete bookkeeping across the engine's several streaming-finalization
+    /// call sites (a streamed reply mutates the same message's text repeatedly before settling); the
+    /// table is capped at the caller's `maxStoredMessages`, so a full replace is always cheap. Called
+    /// once per completed send/brief, never per streamed chunk.
+    public func replaceCoachMessages(_ rows: [CoachMessageRow]) async throws {
+        try syncWrite { db in
+            try db.execute(sql: "DELETE FROM coachMessage")
+            for row in rows {
+                try db.execute(sql: """
+                    INSERT INTO coachMessage (id, role, text, provider, createdAt, orderIndex)
+                    VALUES (?, ?, ?, ?, ?, ?)
+                    """, arguments: [row.id, row.role, row.text, row.provider, row.createdAt, row.orderIndex])
+            }
+        }
+    }
+
+    /// Wipe the entire stored conversation (the Coach toolbar's "Clear conversation" action).
+    public func clearCoachMessages() async throws {
+        try syncWrite { db in
+            try db.execute(sql: "DELETE FROM coachMessage")
+        }
+    }
+}
diff --git a/Packages/WhoopStore/Sources/WhoopStore/Database.swift b/Packages/WhoopStore/Sources/WhoopStore/Database.swift
index 01f4df2af0..298b078e60 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/Database.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/Database.swift
@@ -893,6 +893,24 @@ extension WhoopStore {
                 t.add(column: "sleepHrOnly", .boolean)
             }
         }
+        // PRD-K2: persist the Coach conversation on-device so it survives relaunch. One row per chat
+        // turn; `orderIndex` is a monotonically-increasing counter (not `createdAt`, which two
+        // streamed turns can share to the second) so replay order is exact. `provider` isn't filtered
+        // on for v1 (a conversation is a conversation across a provider switch) but is carried so a
+        // future per-provider view/filter doesn't need another migration. Never added to the
+        // `.noopbak` backup whitelist (a separate, deliberate decision — CLAUDE.md's backup contract).
+        migrator.registerMigration("v43-coach-messages") { db in
+            try db.create(table: "coachMessage", options: [.ifNotExists]) { t in
+                t.column("id", .text).primaryKey()
+                t.column("role", .text).notNull()       // "user" | "assistant"
+                t.column("text", .text).notNull()
+                t.column("provider", .text).notNull()
+                t.column("createdAt", .integer).notNull()
+                t.column("orderIndex", .integer).notNull()
+            }
+            // No index: the table is capped at maxStoredMessages (40 rows), so a full scan + sort on
+            // read is negligible and an index buys nothing worth the extra Room<->GRDB parity surface.
+        }
         return migrator
     }
 }
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json b/Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json
index abd475513e..743485063f 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json
@@ -1,6 +1,6 @@
 {
   "_readme": "SHARED Room<->GRDB SCHEMA ORACLE (#775). Two byte-identical copies: Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json and android/app/src/test/resources/schema_oracle.json. SchemaOracleTests.swift compares GRDB's PRAGMA table_info/index_list against it; SchemaOracleTest.kt compares Room's exported schema JSON against it. `columns` is the iOS/GRDB shape in GRDB column order (macOS is the reference implementation); every way Android differs is spelled out in an `android` / `iosAbsent` / `androidColumnOrder` override naming a key in `divergenceReasons`. Adding a column, reordering one, or changing a type/nullability on one platform only fails both suites until it is either fixed or written down here.",
-  "roomVersion": 36,
+  "roomVersion": 37,
   "grdbMigrations": [
     "v1",
     "v2",
@@ -43,7 +43,8 @@
     "v39-ppg-burst-index",
     "v40-daily-skin-temp-absolute",
     "v41-drop-raw-imu-sample",
-    "v42-daily-sleep-hr-only"
+    "v42-daily-sleep-hr-only",
+    "v43-coach-messages"
   ],
   "divergenceReasons": {
     "android-orphan-synced-column": "REAL COLUMN DRIFT: `synced` exists on Android only. GRDB's v10 note is explicit that stepSample gets no `synced` column ('unused; see StreamStore'), and v12's ppgHrSample never had one either; the Room entities copied the flag from the older per-second entities. Nothing reads it on Android — the per-row upload flag belongs to an upload path that does not exist there — so it is dead width, not divergent data. Removing it needs a Room table rebuild.",
@@ -217,6 +218,55 @@
       "androidColumnOrderDivergence": "battery-alter-append-order",
       "indices": []
     },
+    "coachMessage": {
+      "platform": "both",
+      "columns": [
+        {
+          "name": "id",
+          "affinity": "TEXT",
+          "notNull": false,
+          "default": null,
+          "android": {
+            "notNull": true
+          },
+          "divergence": "sqlite-text-pk-nullable"
+        },
+        {
+          "name": "role",
+          "affinity": "TEXT",
+          "notNull": true,
+          "default": null
+        },
+        {
+          "name": "text",
+          "affinity": "TEXT",
+          "notNull": true,
+          "default": null
+        },
+        {
+          "name": "provider",
+          "affinity": "TEXT",
+          "notNull": true,
+          "default": null
+        },
+        {
+          "name": "createdAt",
+          "affinity": "INTEGER",
+          "notNull": true,
+          "default": null
+        },
+        {
+          "name": "orderIndex",
+          "affinity": "INTEGER",
+          "notNull": true,
+          "default": null
+        }
+      ],
+      "primaryKey": [
+        "id"
+      ],
+      "indices": []
+    },
     "cursors": {
       "platform": "ios_only",
       "reason": "iOS offload/upload bookmarks (GRDB v2). Android keeps the equivalent bookmarks in SharedPreferences, not in Room.",
diff --git a/Strand/AI/AICoach.swift b/Strand/AI/AICoach.swift
index c06872fd53..32cf6a906f 100644
--- a/Strand/AI/AICoach.swift
+++ b/Strand/AI/AICoach.swift
@@ -214,6 +214,14 @@ final class AICoachEngine: ObservableObject {
         didSet { UserDefaults.standard.set(includeOnDeviceSignals, forKey: Self.onDeviceSignalsKey) }
     }
 
+    /// K11: THIRD opt-in — send a chart image alongside the text when using Gemini's multimodal
+    /// API. OFF by default and gated behind `dataConsent` too. Only active when the provider is
+    /// Gemini (the only provider with multimodal support in the app). When on, the Coach composer
+    /// shows an "Attach chart" toggle; the rendered chart is sent as inline_data to Gemini.
+    @Published var multimodalChartEnabled: Bool {
+        didSet { UserDefaults.standard.set(multimodalChartEnabled, forKey: Self.multimodalChartKey) }
+    }
+
     private let repo: Repository
     private let session: URLSession
 
@@ -222,6 +230,7 @@ final class AICoachEngine: ObservableObject {
     private static let consentKey = "ai.dataConsent"
     private static let customConnectedKey = "ai.customConnected"
     private static let onDeviceSignalsKey = "ai.includeOnDeviceSignals"
+    private static let multimodalChartKey = "ai.multimodalChartEnabled"
     /// UserDefaults key holding the user's EDITED system prompt. Absent (or blank) means "use the
     /// built-in default". Small text key, never a secret, so plain UserDefaults is fine. Read FRESH
     /// per request (see `systemPrompt`) so an edit takes effect on the very next message.
@@ -291,6 +300,39 @@ final class AICoachEngine: ObservableObject {
         objectWillChange.send()
     }
 
+    /// Contextual suggestion chips for the composer, derived from today's bands via `CoachSuggestions`.
+    /// Reads only on-device `repo.days`; pure, byte-identical to the Android twin. Returns the stable
+    /// generic fallback when there is no usable data for today.
+    var suggestions: [String] { CoachSuggestions.suggestions(for: repo.days.last, recent: repo.days) }
+
+    /// K7: Follow-up suggestion chips shown after each assistant reply. These are generic
+    /// conversational follow-ups (not data-derived) so the user can dig deeper without typing.
+    /// Byte-identical to the Android twin's `followUpSuggestions`.
+    static let followUpSuggestions: [String] = [
+        "Tell me more about that",
+        "What should I do next?",
+        "How does today compare to this week?",
+        "Give me a specific action plan",
+    ]
+
+    /// K12: Rough token estimate for the next send, based on the current draft + context size.
+    /// Uses the standard ~4 chars/token heuristic. This is an estimate only — actual token counts
+    /// vary by tokenizer. Returns nil when the engine isn't configured (no context to estimate).
+    func estimatedTokens(forDraft draft: String) -> Int? {
+        guard isConfigured else { return nil }
+        // Estimate the context size: system prompt + data context (rough — we don't build the
+        // full context here to avoid a DB read on every keystroke). Use the last known context
+        // size or a reasonable default.
+        let systemPromptTokens = systemPrompt.count / 4
+        // The data context is typically ~2000-4000 chars depending on the user's data.
+        // Use a conservative estimate of 3000 chars (750 tokens) when consent is on.
+        let contextTokens = dataConsent ? 750 : 50
+        // History tokens: sum of all message texts in the windowed history.
+        let historyTokens = windowedMessages().reduce(0) { $0 + $1.text.count / 4 }
+        let draftTokens = draft.count / 4
+        return systemPromptTokens + contextTokens + historyTokens + draftTokens
+    }
+
     /// Used in place of the metrics context when the user has NOT granted data access.
     private let noConsentNote = """
     NOTE: The user has not granted access to their biometric data. Coach generally and encourage \
@@ -326,6 +368,7 @@ final class AICoachEngine: ObservableObject {
         self.customAuthHeader = AIProvider.customAuthHeader
         self.customConnected = UserDefaults.standard.bool(forKey: Self.customConnectedKey)
         self.includeOnDeviceSignals = UserDefaults.standard.bool(forKey: Self.onDeviceSignalsKey)
+        self.multimodalChartEnabled = UserDefaults.standard.bool(forKey: Self.multimodalChartKey)
     }
 
     // MARK: Key management
@@ -499,6 +542,77 @@ final class AICoachEngine: ObservableObject {
         }
     }
 
+    // MARK: - K2: persisted conversation history
+
+    /// Guards `loadPersistedMessagesIfNeeded()` so it only ever runs once per app launch, even if the
+    /// Coach screen's `.task` re-fires (e.g. a tab re-select).
+    private var didLoadPersistedMessages = false
+
+    /// Load the conversation persisted by a PRIOR launch (PRD-K2), so relaunching doesn't lose it.
+    /// Called from the Coach screen's `.task` (mirroring `startBriefIfNeeded`) rather than `init`,
+    /// which is synchronous and runs for every screen the app builds, not just Coach. Best-effort: a
+    /// store failure just leaves the transcript empty, matching pre-K2 behaviour — never crashes.
+    func loadPersistedMessagesIfNeeded() async {
+        guard !didLoadPersistedMessages else { return }
+        didLoadPersistedMessages = true
+        guard messages.isEmpty, let store = await repo.storeHandle() else { return }
+        guard let rows = try? await store.coachMessages(), !rows.isEmpty else { return }
+        messages = rows
+            .sorted { $0.orderIndex < $1.orderIndex }
+            .map { ChatMessage(id: UUID(uuidString: $0.id) ?? UUID(),
+                                role: ChatMessage.Role(rawValue: $0.role) ?? .user,
+                                text: $0.text) }
+    }
+
+    /// Replace the ENTIRE persisted conversation with the current in-memory `messages`. Called once
+    /// per completed send/brief (not per streamed chunk) so a streamed reply's several in-place text
+    /// mutations don't hammer the store. Fire-and-forget; a store failure never blocks the UI — the
+    /// in-memory transcript (what the user sees) is unaffected either way.
+    private func persistMessages() {
+        let snapshot = messages
+        let providerId = provider.rawValue
+        Task {
+            guard let store = await repo.storeHandle() else { return }
+            let rows = snapshot.enumerated().map { index, m in
+                CoachMessageRow(id: m.id.uuidString, role: m.role.rawValue, text: m.text,
+                                 provider: providerId, createdAt: Int(Date().timeIntervalSince1970),
+                                 orderIndex: index)
+            }
+            try? await store.replaceCoachMessages(rows)
+        }
+    }
+
+    /// The Coach toolbar's "Clear conversation" action: wipes both the in-memory transcript and the
+    /// persisted table. Fire-and-forget on the store side; the in-memory clear is immediate.
+    func clearConversation() {
+        messages = []
+        droppedSummary = nil      // K13: reset the summary cache on clear
+        droppedSummaryKey = []
+        Task { try? await repo.storeHandle()?.clearCoachMessages() }
+    }
+
+    /// K5: surface a brief generated by the SCHEDULED morning-brief notification as the first Coach
+    /// message, with no network call — called once when the app opens via a tap on that notification.
+    /// No-op if a conversation already exists, so it never duplicates into an active chat.
+    func surfaceScheduledBrief(_ text: String) {
+        guard messages.isEmpty else { return }
+        appendMessage(ChatMessage(role: .assistant, text: "Today's brief\n\n" + text))
+        persistMessages()
+    }
+
+    /// K5: append an explicitly-generated brief (the Coach settings "Generate now" button) as a new
+    /// assistant message, unconditionally — unlike `surfaceScheduledBrief`, this always appends so a
+    /// mid-conversation tap still shows the fresh brief.
+    func appendGeneratedBrief(_ text: String) {
+        appendMessage(ChatMessage(role: .assistant, text: "Today's brief\n\n" + text))
+        persistMessages()
+    }
+
+    /// K11: An optional chart image (base64-encoded PNG) to send with the next user message.
+    /// Set by the composer's "Attach chart" toggle when multimodal is enabled and the provider
+    /// is Gemini. Consumed (cleared) on the next send. nil when no image is attached.
+    @Published var pendingChartImage: String?
+
     /// Send a question: append it, build the metrics context, call the chosen provider with the
     /// system prompt + context + running history, parse the reply, append it. Never throws/crashes;
     /// failures land in `errorText`.
@@ -525,56 +639,171 @@ final class AICoachEngine: ObservableObject {
         errorText = nil
         appendMessage(ChatMessage(role: .user, text: trimmed))
         sending = true
-        defer { sending = false }
+        // K2: persist once the turn is fully settled (success, mid-stream error, or empty-stream
+        // removal) — not per streamed chunk, so a long reply doesn't hammer the store.
+        defer { sending = false; persistMessages() }
 
         // Build the data context once and prepend it to the FIRST user turn we send. We send the
         // full running history so follow-ups stay coherent; the context only needs to ride the
         // earliest user message.
         // Include the user's data ONLY with explicit consent; otherwise send a note instead of numbers.
         let context = dataConsent ? await buildFullContext() : noConsentNote
-        let wire = wireMessages(context: context)
+        // K13: if the conversation overflows the sliding window, summarize the dropped middle so
+        // the model retains context continuity. Best-effort; failure degrades to the old gap.
+        await summarizeDroppedMiddleIfNeeded(key: key)
+        var wire = wireMessages(context: context)
+
+        // K11: If a chart image is pending and the provider is Gemini, attach it to the last
+        // user turn as inline_data. Non-Gemini providers can't accept images, so the image is
+        // silently dropped (the text question still goes through). Cleared after consumption.
+        let imageBase64 = pendingChartImage
+        pendingChartImage = nil
+
+        // K1: Stream the reply. Append a placeholder assistant message, then mutate its text as
+        // chunks arrive by replacing the last element in `messages`. The transcript re-renders on
+        // each update (SwiftUI binds to `messages`). On error mid-stream, keep the partial text and
+        // append a "(stream interrupted)" marker — never a crash.
+        let placeholder = ChatMessage(role: .assistant, text: "")
+        appendMessage(placeholder)
+        var accumulated = ""
 
         do {
-            let reply = try await callProvider(key: key, messages: wire)
-            let clean = reply.trimmingCharacters(in: .whitespacesAndNewlines)
-            appendMessage(ChatMessage(role: .assistant, text: clean.isEmpty ? "(no reply)" : clean))
+            try await streamProvider(key: key, messages: wire, inlineImage: imageBase64) { delta in
+                accumulated += delta
+                // Replace the last message's text with the accumulated stream so far.
+                if let lastIdx = self.messages.indices.last,
+                   self.messages[lastIdx].role == .assistant {
+                    self.messages[lastIdx] = ChatMessage(
+                        id: placeholder.id, role: .assistant, text: accumulated
+                    )
+                }
+            }
+            // Finalize: trim whitespace. If the stream produced nothing, show "(no reply)".
+            let clean = accumulated.trimmingCharacters(in: .whitespacesAndNewlines)
+            if let lastIdx = messages.indices.last, messages[lastIdx].role == .assistant {
+                messages[lastIdx] = ChatMessage(
+                    id: placeholder.id, role: .assistant,
+                    text: clean.isEmpty ? "(no reply)" : clean
+                )
+            }
         } catch let e as AICoachError {
+            // Mid-stream error: keep the partial text + an interrupted marker (PRD K1 acceptance).
+            let partial = accumulated.trimmingCharacters(in: .whitespacesAndNewlines)
+            if !partial.isEmpty, let lastIdx = messages.indices.last, messages[lastIdx].role == .assistant {
+                messages[lastIdx] = ChatMessage(
+                    id: placeholder.id, role: .assistant,
+                    text: partial + "\n\n*(stream interrupted)*"
+                )
+            } else if let lastIdx = messages.indices.last, messages[lastIdx].role == .assistant {
+                // No text received at all — remove the empty placeholder.
+                messages.remove(at: lastIdx)
+            }
             errorText = e.errorDescription
         } catch {
+            let partial = accumulated.trimmingCharacters(in: .whitespacesAndNewlines)
+            if !partial.isEmpty, let lastIdx = messages.indices.last, messages[lastIdx].role == .assistant {
+                messages[lastIdx] = ChatMessage(
+                    id: placeholder.id, role: .assistant,
+                    text: partial + "\n\n*(stream interrupted)*"
+                )
+            } else if let lastIdx = messages.indices.last, messages[lastIdx].role == .assistant {
+                messages.remove(at: lastIdx)
+            }
             errorText = AICoachError.network(error.localizedDescription).errorDescription
         }
     }
 
     /// Proactively generate "Today's brief" the first time the Coach opens, readiness + a training
     /// prescription + one recovery tip, without the user typing. Requires a key + data consent.
+    /// K1: streams the brief the same way `send` does.
     func startBriefIfNeeded() async {
         guard isConfigured, dataConsent, messages.isEmpty, !sending else { return }
         guard let key = resolvedKey else { return }
         errorText = nil
         sending = true
-        defer { sending = false }
+        defer { sending = false; persistMessages() }
 
         let context = await buildFullContext()
-        let instruction = """
-        Based on the data above, give me TODAY'S coaching brief in three short parts: \
-        (1) my readiness in one line, citing charge, HRV and rest; \
-        (2) exactly what training to do today and what to avoid; \
-        (3) one specific thing to improve my charge. Be punchy and motivating.
-        """
-        let wire: [(role: ChatMessage.Role, content: String)] = [(.user, context + "\n\n---\n\n" + instruction)]
+        let wire: [(role: ChatMessage.Role, content: String)] =
+            [(.user, context + "\n\n---\n\n" + Self.briefInstruction)]
+
+        let prefix = "Today's brief\n\n"
+        let placeholder = ChatMessage(role: .assistant, text: prefix)
+        appendMessage(placeholder)
+        var accumulated = ""
+
         do {
-            let reply = try await callProvider(key: key, messages: wire)
-            let clean = reply.trimmingCharacters(in: .whitespacesAndNewlines)
-            if !clean.isEmpty {
-                appendMessage(ChatMessage(role: .assistant, text: "Today's brief\n\n" + clean))
+            try await streamProvider(key: key, messages: wire) { delta in
+                accumulated += delta
+                if let lastIdx = self.messages.indices.last,
+                   self.messages[lastIdx].role == .assistant {
+                    self.messages[lastIdx] = ChatMessage(
+                        id: placeholder.id, role: .assistant, text: prefix + accumulated
+                    )
+                }
+            }
+            let clean = accumulated.trimmingCharacters(in: .whitespacesAndNewlines)
+            if clean.isEmpty {
+                if let lastIdx = messages.indices.last, messages[lastIdx].role == .assistant {
+                    messages.remove(at: lastIdx)
+                }
+            } else if let lastIdx = messages.indices.last, messages[lastIdx].role == .assistant {
+                messages[lastIdx] = ChatMessage(id: placeholder.id, role: .assistant, text: prefix + clean)
             }
         } catch let e as AICoachError {
+            let partial = accumulated.trimmingCharacters(in: .whitespacesAndNewlines)
+            if partial.isEmpty {
+                if let lastIdx = messages.indices.last, messages[lastIdx].role == .assistant {
+                    messages.remove(at: lastIdx)
+                }
+            } else if let lastIdx = messages.indices.last, messages[lastIdx].role == .assistant {
+                messages[lastIdx] = ChatMessage(
+                    id: placeholder.id, role: .assistant,
+                    text: prefix + partial + "\n\n*(stream interrupted)*"
+                )
+            }
             errorText = e.errorDescription
         } catch {
+            let partial = accumulated.trimmingCharacters(in: .whitespacesAndNewlines)
+            if partial.isEmpty {
+                if let lastIdx = messages.indices.last, messages[lastIdx].role == .assistant {
+                    messages.remove(at: lastIdx)
+                }
+            } else if let lastIdx = messages.indices.last, messages[lastIdx].role == .assistant {
+                messages[lastIdx] = ChatMessage(
+                    id: placeholder.id, role: .assistant,
+                    text: prefix + partial + "\n\n*(stream interrupted)*"
+                )
+            }
             errorText = AICoachError.network(error.localizedDescription).errorDescription
         }
     }
 
+    /// K5: The brief instruction shared by the interactive `startBriefIfNeeded()` (streamed into the
+    /// chat) and the headless `generateBrief()` below (used by the scheduled morning-brief notification).
+    /// Kept in one place so the two paths never drift.
+    private static let briefInstruction = """
+    Based on the data above, give me TODAY'S coaching brief in three short parts: \
+    (1) my readiness in one line, citing charge, HRV and rest; \
+    (2) exactly what training to do today and what to avoid; \
+    (3) one specific thing to improve my charge. Be punchy and motivating.
+    """
+
+    /// K5: Generate today's coaching brief WITHOUT touching the visible chat transcript. Used by the
+    /// scheduled morning-brief notification (`CoachBriefScheduler`), which can run with no Coach screen
+    /// open and must never append to (or duplicate into) `messages`. Non-streaming (a background/BGTask
+    /// context has no UI to stream into). Returns nil when not configured/consented, on any network
+    /// failure, or when the reply is empty — the caller treats nil as "brief unavailable"; never throws.
+    func generateBrief() async -> String? {
+        guard isConfigured, dataConsent, let key = resolvedKey else { return nil }
+        let context = await buildFullContext()
+        let wire: [(role: ChatMessage.Role, content: String)] =
+            [(.user, context + "\n\n---\n\n" + Self.briefInstruction)]
+        guard let reply = try? await callProvider(key: key, messages: wire) else { return nil }
+        let clean = reply.trimmingCharacters(in: .whitespacesAndNewlines)
+        return clean.isEmpty ? nil : clean
+    }
+
     /// Full data context = the metrics summary + recent workouts (+ an OPT-IN on-device-signals summary
     /// when the second consent is on). Used when the user has granted data access.
     func buildFullContext() async -> String {
@@ -678,6 +907,25 @@ final class AICoachEngine: ObservableObject {
         )
     }
 
+    /// K1: Dispatch to the user's chosen provider client's streaming method. The default
+    /// `AIProviderClient.stream` falls back to `send` + a single delta, so providers without
+    /// streaming still work. K11: when an inline image is present, dispatches to
+    /// `streamWithImage` instead (Gemini overrides it; others ignore the image).
+    private func streamProvider(key: String,
+                                messages: [(role: ChatMessage.Role, content: String)],
+                                inlineImage: String? = nil,
+                                onDelta: (String) -> Void) async throws {
+        try await provider.client.streamWithImage(
+            key: key,
+            model: model,
+            systemPrompt: systemPrompt,
+            messages: messages,
+            inlineImage: inlineImage,
+            session: session,
+            onDelta: onDelta
+        )
+    }
+
     /// Sliding window over the chat: the FIRST user turn (it carries the metrics context) plus the most
     /// recent `maxHistoryMessages`, dropping the middle. Sending the whole growing history crowds out the
     /// reply on small-context local servers (Ollama defaults to a 2048-token window, the Custom
@@ -711,14 +959,66 @@ final class AICoachEngine: ObservableObject {
         return calendar.dateComponents([.day], from: epoch, to: start).day ?? 0
     }
 
+    ///
+    /// K13: when the middle is dropped, a one-line summary of the dropped turns is prepended to the
+    /// first user turn so the model retains context continuity (instead of seeing a gap). The summary
+    /// is generated via the same provider, with a short prompt; on failure it degrades to the old
+    /// behaviour (no summary, just the windowed set).
     private static let maxHistoryMessages = 10
+    /// K13: the cached summary of the dropped middle, regenerated when the dropped set changes.
+    private var droppedSummary: String?
+    private var droppedSummaryKey: [String] = []
+
     private func windowedMessages() -> [ChatMessage] {
         guard messages.count > Self.maxHistoryMessages + 1,
               let firstUser = messages.firstIndex(where: { $0.role == .user }) else { return messages }
         let recentStart = messages.count - Self.maxHistoryMessages
         // If the first user turn already falls inside the recent window, that window covers it.
         if firstUser >= recentStart { return Array(messages.suffix(Self.maxHistoryMessages)) }
-        return [messages[firstUser]] + Array(messages[recentStart...])
+        // K13: inject the summary of the dropped middle by prepending it to the first user turn,
+        // so the model sees continuity instead of a gap. We don't use a separate system message
+        // because the Role enum only has .user/.assistant (providers map those to API roles).
+        var windowed = [messages[firstUser]]
+        if let summary = droppedSummary {
+            let first = windowed[0]
+            windowed[0] = ChatMessage(id: first.id, role: first.role, text: "\(summary)\n\n---\n\n\(first.text)")
+        }
+        windowed.append(contentsOf: messages[recentStart...])
+        return windowed
+    }
+
+    /// K13: When the conversation overflows the sliding window, summarize the dropped middle turns
+    /// into a single system message. Called before each send when the window would drop messages.
+    /// Best-effort: on any failure, leaves `droppedSummary` nil (the old gap behaviour).
+    private func summarizeDroppedMiddleIfNeeded(key: String) async {
+        guard messages.count > Self.maxHistoryMessages + 1,
+              let firstUser = messages.firstIndex(where: { $0.role == .user }) else { return }
+        let recentStart = messages.count - Self.maxHistoryMessages
+        guard firstUser < recentStart else { return }
+
+        // The dropped middle is messages[firstUser+1 ..< recentStart]. Cache on its identity so we
+        // don't re-summarize the same set on every send.
+        let dropped = Array(messages[(firstUser + 1)..<recentStart])
+        let keySignature = dropped.map { "\($0.role.rawValue):\($0.text)" }
+        guard droppedSummaryKey != keySignature else { return }
+        droppedSummaryKey = keySignature
+
+        // Build a compact transcript of the dropped turns for the summarizer.
+        let transcript = dropped.map { m in
+            "\(m.role == .user ? "User" : "Coach"): \(m.text)"
+        }.joined(separator: "\n")
+
+        let summaryPrompt = """
+        Summarize the following conversation in 2-3 sentences, preserving the key advice and \
+        any specific numbers or recommendations. This summary will be shown to you as context \
+        for the ongoing conversation.\n\n\(transcript)
+        """
+        let wire: [(role: ChatMessage.Role, content: String)] = [
+            (.user, "You are a concise summarizer. Summarize the conversation in 2-3 sentences.\n\n\(summaryPrompt)"),
+        ]
+        if let summary = try? await callProvider(key: key, messages: wire) {
+            droppedSummary = "Summary of earlier conversation: \(summary.trimmingCharacters(in: .whitespacesAndNewlines))"
+        }
     }
 
     /// The chat as `(role, content)` pairs, with the metrics context prepended to the first user turn.
diff --git a/Strand/AI/AIProvider.swift b/Strand/AI/AIProvider.swift
index 1aeeffa652..c2306ffe58 100644
--- a/Strand/AI/AIProvider.swift
+++ b/Strand/AI/AIProvider.swift
@@ -1,4 +1,5 @@
 import Foundation
+import StrandAnalytics
 
 // MARK: - Provider enum
 
@@ -227,6 +228,65 @@ protocol AIProviderClient {
 
     /// Fetch the provider's live model list and return plain model ids.
     func fetchModels(key: String, session: URLSession) async throws -> [String]
+
+    /// Stream a chat turn, calling `onDelta` for each text chunk as it arrives. The concatenated
+    /// deltas must equal the text that `send` would return for the same inputs (byte-parity with
+    /// the non-streamed path). The default implementation falls back to `send` + a single delta,
+    /// so providers without streaming still work. K1.
+    func stream(
+        key: String,
+        model: String,
+        systemPrompt: String,
+        messages: [(role: ChatMessage.Role, content: String)],
+        session: URLSession,
+        onDelta: (String) -> Void
+    ) async throws
+
+    /// K11: Stream a chat turn with an optional inline image (base64 PNG). Only Gemini implements
+    /// this; the default implementation ignores the image and calls `stream`. This keeps the
+    /// multimodal path opt-in without changing every provider's `stream` signature.
+    func streamWithImage(
+        key: String,
+        model: String,
+        systemPrompt: String,
+        messages: [(role: ChatMessage.Role, content: String)],
+        inlineImage: String?,
+        session: URLSession,
+        onDelta: (String) -> Void
+    ) async throws
+}
+
+extension AIProviderClient {
+    /// K11: Default — ignore the image, delegate to `stream`. Providers without multimodal support
+    /// (OpenAI, Anthropic, Custom) use this; only Gemini overrides it.
+    func streamWithImage(
+        key: String,
+        model: String,
+        systemPrompt: String,
+        messages: [(role: ChatMessage.Role, content: String)],
+        inlineImage: String?,
+        session: URLSession,
+        onDelta: (String) -> Void
+    ) async throws {
+        try await stream(key: key, model: model, systemPrompt: systemPrompt,
+                         messages: messages, session: session, onDelta: onDelta)
+    }
+}
+
+extension AIProviderClient {
+    /// Default: fall back to the non-streaming `send` and emit the full reply as one delta.
+    func stream(
+        key: String,
+        model: String,
+        systemPrompt: String,
+        messages: [(role: ChatMessage.Role, content: String)],
+        session: URLSession,
+        onDelta: (String) -> Void
+    ) async throws {
+        let reply = try await send(key: key, model: model, systemPrompt: systemPrompt,
+                                    messages: messages, session: session)
+        onDelta(reply)
+    }
 }
 
 // MARK: - Shared HTTP helpers
@@ -283,3 +343,45 @@ func emptyReplyError(_ json: [String: Any]) -> AICoachError {
     return .emptyReply("The provider returned an empty reply. If you set a custom model by hand, check "
         + "that the model name is one the provider actually offers.")
 }
+
+// MARK: - SSE streaming helper (K1)
+
+/// Execute a streaming SSE request, map HTTP status codes to `AICoachError`, and call `onLine`
+/// for each `data:` payload line (prefix stripped, blank/comment/non-data lines filtered). The
+/// caller's `onLine` closure uses the pure `SseDeltas` functions to extract the per-provider text
+/// delta. Throws on HTTP errors (same mapping as `performRequest`). K1.
+func performStreamingRequest(
+    _ req: URLRequest,
+    session: URLSession,
+    onLine: (String) -> Void
+) async throws {
+    let bytes: (URLSession.AsyncBytes, URLResponse)
+    do {
+        bytes = try await session.bytes(for: req)
+    } catch {
+        throw AICoachError.network(error.localizedDescription)
+    }
+
+    guard let http = bytes.1 as? HTTPURLResponse else {
+        throw AICoachError.network("no HTTP response")
+    }
+
+    switch http.statusCode {
+    case 200...299:
+        // Read line-by-line from the SSE byte stream. `URLSession.AsyncBytes` splits on \n.
+        for try await line in bytes.0.lines {
+            if let payload = SseDeltas.dataPayload(fromLine: line) {
+                onLine(payload)
+            }
+        }
+    case 401, 403:
+        throw AICoachError.badKey
+    case 429:
+        throw AICoachError.rateLimited
+    default:
+        // For non-200, the body is a (non-streaming) error JSON — collect it and surface the message.
+        var body = ""
+        for try await line in bytes.0.lines { body += line }
+        throw AICoachError.server(http.statusCode, providerErrorMessage(from: Data(body.utf8)))
+    }
+}
diff --git a/Strand/AI/Providers/Anthropic.swift b/Strand/AI/Providers/Anthropic.swift
index 1e5071ef24..2b80518b32 100644
--- a/Strand/AI/Providers/Anthropic.swift
+++ b/Strand/AI/Providers/Anthropic.swift
@@ -1,4 +1,5 @@
 import Foundation
+import StrandAnalytics
 
 struct AnthropicClient: AIProviderClient {
 
@@ -39,6 +40,42 @@ struct AnthropicClient: AIProviderClient {
         return text
     }
 
+    /// K1: Stream via `stream: true`. Anthropic SSE uses typed events; we extract `content_block_delta`
+    /// with `text_delta` via `SseDeltas.anthropicDelta`. Byte-parity pin in
+    /// `SseDeltasTests.anthropicReassembleMatchesFullReply`.
+    func stream(
+        key: String,
+        model: String,
+        systemPrompt: String,
+        messages: [(role: ChatMessage.Role, content: String)],
+        session: URLSession,
+        onDelta: (String) -> Void
+    ) async throws {
+        var wire: [[String: Any]] = []
+        for m in messages { wire.append(["role": m.role.rawValue, "content": m.content]) }
+
+        let body: [String: Any] = [
+            "model": model,
+            "max_tokens": 4096,
+            "system": systemPrompt,
+            "messages": wire,
+            "stream": true
+        ]
+
+        var req = URLRequest(url: AIProvider.anthropic.endpoint)
+        req.httpMethod = "POST"
+        req.setValue(key, forHTTPHeaderField: "x-api-key")
+        req.setValue("2023-06-01", forHTTPHeaderField: "anthropic-version")
+        req.setValue("application/json", forHTTPHeaderField: "content-type")
+        req.httpBody = try JSONSerialization.data(withJSONObject: body)
+
+        try await performStreamingRequest(req, session: session) { payload in
+            if let delta = SseDeltas.anthropicDelta(payload) {
+                onDelta(delta)
+            }
+        }
+    }
+
     func fetchModels(key: String, session: URLSession) async throws -> [String] {
         var req = URLRequest(url: AIProvider.anthropic.modelsEndpoint)
         req.httpMethod = "GET"
diff --git a/Strand/AI/Providers/Custom.swift b/Strand/AI/Providers/Custom.swift
index 5c1a8d8627..a52b33c229 100644
--- a/Strand/AI/Providers/Custom.swift
+++ b/Strand/AI/Providers/Custom.swift
@@ -1,4 +1,5 @@
 import Foundation
+import StrandAnalytics
 
 /// A generic OpenAI-compatible provider pointed at a user-set base URL — e.g. a local LLM server such
 /// as Ollama, LM Studio or llama.cpp (`http://localhost:11434/v1`), or any self-hosted gateway. Speaks
@@ -31,6 +32,42 @@ struct CustomClient: AIProviderClient {
         }
     }
 
+    /// K1: Stream via `stream: true` (most local OpenAI-compatible servers support it). Same body
+    /// as `send`'s standard-params path, with `stream: true`. SSE parsing via `SseDeltas.openAiDelta`.
+    /// The modern-params retry on 400 is NOT streamed (rare path; falls back to `send`'s retry).
+    func stream(
+        key: String,
+        model: String,
+        systemPrompt: String,
+        messages: [(role: ChatMessage.Role, content: String)],
+        session: URLSession,
+        onDelta: (String) -> Void
+    ) async throws {
+        try AIProvider.guardCustomBaseURL()   // #321: reject a public cleartext Custom URL before egress
+        var wire: [[String: Any]] = [["role": "system", "content": systemPrompt]]
+        for m in messages { wire.append(["role": m.role.rawValue, "content": m.content]) }
+
+        let body: [String: Any] = [
+            "model": model,
+            "messages": wire,
+            "temperature": 0.6,
+            "max_tokens": 4096,
+            "stream": true
+        ]
+
+        var req = URLRequest(url: AIProvider.custom.endpoint)
+        req.httpMethod = "POST"
+        AIProvider.applyCustomAuthHeader(key, to: &req)
+        req.setValue("application/json", forHTTPHeaderField: "Content-Type")
+        req.httpBody = try JSONSerialization.data(withJSONObject: body)
+
+        try await performStreamingRequest(req, session: session) { payload in
+            if let delta = SseDeltas.openAiDelta(payload) {
+                onDelta(delta)
+            }
+        }
+    }
+
     /// Appended to a reply when the server stopped early because it ran out of context window.
     /// Local OpenAI-compatible servers (notably Ollama, which defaults to a 2048-token window and
     /// IGNORES `num_ctx` on the `/v1` endpoint) truncate silently — no error, the text just stops
diff --git a/Strand/AI/Providers/Gemini.swift b/Strand/AI/Providers/Gemini.swift
index 3c7f9a54bb..ccf4829b22 100644
--- a/Strand/AI/Providers/Gemini.swift
+++ b/Strand/AI/Providers/Gemini.swift
@@ -1,4 +1,5 @@
 import Foundation
+import StrandAnalytics
 
 struct GeminiClient: AIProviderClient {
 
@@ -9,14 +10,7 @@ struct GeminiClient: AIProviderClient {
         messages: [(role: ChatMessage.Role, content: String)],
         session: URLSession
     ) async throws -> String {
-        var contents: [[String: Any]] = []
-        for m in messages {
-            contents.append([
-                "role": m.role == .assistant ? "model" : "user",
-                "parts": [["text": m.content]]
-            ])
-        }
-
+        let contents = GeminiClient.buildContents(from: messages)
         let body: [String: Any] = [
             "system_instruction": ["parts": [["text": systemPrompt]]],
             "contents": contents,
@@ -52,8 +46,104 @@ struct GeminiClient: AIProviderClient {
         return text
     }
 
-    func fetchModels(key: String, session: URLSession) async throws -> [String] {
-        var req = URLRequest(url: AIProvider.gemini.modelsEndpoint)
+    /// K11: Build Gemini "contents" array from wire messages. Extracted so the multimodal path
+    /// (which appends an `inline_data` image part to the last user turn) can reuse it.
+    static func buildContents(from messages: [(role: ChatMessage.Role, content: String)]) -> [[String: Any]] {
+        var contents: [[String: Any]] = []
+        for m in messages {
+            contents.append([
+                "role": m.role == .assistant ? "model" : "user",
+                "parts": [["text": m.content]]
+            ])
+        }
+        return contents
+    }
+
+    /// K11: Append a base64-encoded image to the last user turn's parts (Gemini multimodal).
+    /// The image is sent as an `inline_data` part alongside the existing text part.
+    static func appendImage(_ base64: String, mimeType: String, to contents: inout [[String: Any]]) {
+        guard let lastUserIdx = contents.lastIndex(where: { ($0["role"] as? String) == "user" }) else { return }
+        var parts = contents[lastUserIdx]["parts"] as? [[String: Any]] ?? []
+        parts.append(["inline_data": ["mime_type": mimeType, "data": base64]])
+        contents[lastUserIdx]["parts"] = parts
+    }
+
+    /// K1: Stream via `:streamGenerateContent?alt=sse`. Same body as `send`, different endpoint +
+    /// SSE parsing. The concatenated deltas are byte-identical to `send`'s return (parity pin in
+    /// `SseDeltasTests.geminiReassembleMatchesFullReply`).
+    func stream(
+        key: String,
+        model: String,
+        systemPrompt: String,
+        messages: [(role: ChatMessage.Role, content: String)],
+        session: URLSession,
+        onDelta: (String) -> Void
+    ) async throws {
+        let contents = GeminiClient.buildContents(from: messages)
+
+        let body: [String: Any] = [
+            "system_instruction": ["parts": [["text": systemPrompt]]],
+            "contents": contents,
+            "generationConfig": ["temperature": 0.6, "maxOutputTokens": 4096]
+        ]
+
+        // :streamGenerateContent?alt=sse — SSE line-per-chunk. Built via URL(string:) to avoid
+        // appendingPathComponent percent-encoding the ":" (same note as `send`).
+        guard let url = URL(string: "\(AIProvider.gemini.endpoint.absoluteString)/\(model):streamGenerateContent?alt=sse") else {
+            throw AICoachError.network("invalid model id")
+        }
+        var req = URLRequest(url: url)
+        req.httpMethod = "POST"
+        req.setValue(key, forHTTPHeaderField: "x-goog-api-key")
+        req.setValue("application/json", forHTTPHeaderField: "Content-Type")
+        req.httpBody = try JSONSerialization.data(withJSONObject: body)
+
+        try await performStreamingRequest(req, session: session) { payload in
+            if let delta = SseDeltas.geminiDelta(payload) {
+                onDelta(delta)
+            }
+        }
+    }
+
+    /// K11: Stream with an optional inline image (base64 PNG). Appends the image as
+    /// `inline_data` to the last user turn's parts, then streams as normal.
+    func streamWithImage(
+        key: String,
+        model: String,
+        systemPrompt: String,
+        messages: [(role: ChatMessage.Role, content: String)],
+        inlineImage: String?,
+        session: URLSession,
+        onDelta: (String) -> Void
+    ) async throws {
+        var contents = GeminiClient.buildContents(from: messages)
+        if let image = inlineImage {
+            GeminiClient.appendImage(image, mimeType: "image/png", to: &contents)
+        }
+
+        let body: [String: Any] = [
+            "system_instruction": ["parts": [["text": systemPrompt]]],
+            "contents": contents,
+            "generationConfig": ["temperature": 0.6, "maxOutputTokens": 4096]
+        ]
+
+        guard let url = URL(string: "\(AIProvider.gemini.endpoint.absoluteString)/\(model):streamGenerateContent?alt=sse") else {
+            throw AICoachError.network("invalid model id")
+        }
+        var req = URLRequest(url: url)
+        req.httpMethod = "POST"
+        req.setValue(key, forHTTPHeaderField: "x-goog-api-key")
+        req.setValue("application/json", forHTTPHeaderField: "Content-Type")
+        req.httpBody = try JSONSerialization.data(withJSONObject: body)
+
+        try await performStreamingRequest(req, session: session) { payload in
+            if let delta = SseDeltas.geminiDelta(payload) {
+                onDelta(delta)
+            }
+        }
+    }
+
+    func fetchModels(key: String, session: URLSession) async throws -> [String] {        var req = URLRequest(url: AIProvider.gemini.modelsEndpoint)
         req.httpMethod = "GET"
         req.setValue(key, forHTTPHeaderField: "x-goog-api-key")
 
diff --git a/Strand/AI/Providers/OpenAI.swift b/Strand/AI/Providers/OpenAI.swift
index 30f9a295e7..78f06f5658 100644
--- a/Strand/AI/Providers/OpenAI.swift
+++ b/Strand/AI/Providers/OpenAI.swift
@@ -1,4 +1,5 @@
 import Foundation
+import StrandAnalytics
 
 struct OpenAIClient: AIProviderClient {
 
@@ -26,6 +27,37 @@ struct OpenAIClient: AIProviderClient {
         }
     }
 
+    /// K1: Stream via `stream: true`. Same body as `send`, with `stream: true` added. SSE parsing
+    /// via `SseDeltas.openAiDelta`. The modern-params retry on 400 is NOT streamed (rare path;
+    /// falls back to `send`'s retry). Byte-parity pin in `SseDeltasTests.openAiReassembleMatchesFullReply`.
+    func stream(
+        key: String,
+        model: String,
+        systemPrompt: String,
+        messages: [(role: ChatMessage.Role, content: String)],
+        session: URLSession,
+        onDelta: (String) -> Void
+    ) async throws {
+        var wire: [[String: Any]] = [["role": "system", "content": systemPrompt]]
+        for m in messages { wire.append(["role": m.role.rawValue, "content": m.content]) }
+
+        var body: [String: Any] = ["model": model, "messages": wire, "stream": true]
+        body["temperature"] = 0.6
+        body["max_tokens"] = 4096
+
+        var req = URLRequest(url: AIProvider.openAI.endpoint)
+        req.httpMethod = "POST"
+        req.setValue("Bearer \(key)", forHTTPHeaderField: "Authorization")
+        req.setValue("application/json", forHTTPHeaderField: "Content-Type")
+        req.httpBody = try JSONSerialization.data(withJSONObject: body)
+
+        try await performStreamingRequest(req, session: session) { payload in
+            if let delta = SseDeltas.openAiDelta(payload) {
+                onDelta(delta)
+            }
+        }
+    }
+
     func fetchModels(key: String, session: URLSession) async throws -> [String] {
         var req = URLRequest(url: AIProvider.openAI.modelsEndpoint)
         req.httpMethod = "GET"
diff --git a/Strand/App/NavRouter.swift b/Strand/App/NavRouter.swift
index 0220b50ae6..da031e5d1f 100644
--- a/Strand/App/NavRouter.swift
+++ b/Strand/App/NavRouter.swift
@@ -32,6 +32,7 @@ final class NavRouter: ObservableObject {
         /// #1862: the Coach screen, opened from the Today Coach launcher sheet once the user picks a
         /// suggestion or submits the composer. The launcher deliberately owns no send/stream/consent
         /// surface of its own — it hands the question to the one screen that already has them.
+        /// Also the K5 scheduled morning-brief notification's tap-through target.
         case coach
 
         var id: String { rawValue }
diff --git a/Strand/App/StrandApp.swift b/Strand/App/StrandApp.swift
index 1ed234b393..588e83a2e4 100644
--- a/Strand/App/StrandApp.swift
+++ b/Strand/App/StrandApp.swift
@@ -22,12 +22,16 @@ struct StrandApp: App {
         // Foreground presentation: without a delegate, macOS suppresses a notification's banner while the
         // app is frontmost, so a reminder tested with NOOP open would show nothing. Mirrors iOS.
         UNUserNotificationCenter.current().delegate = NotificationPresenter.shared
+        // K5: tapping a scheduled morning-brief notification routes to Coach via the shared NavRouter.
+        let router = NavRouter()
+        _router = StateObject(wrappedValue: router)
+        NotificationPresenter.shared.onCoachBriefTapped = { [weak router] in router?.openCoach() }
     }
 
     @StateObject private var model = AppModel()
     /// Shared cross-screen navigation hook (e.g. Live → Devices). The macOS shell (`RootView`)
     /// observes it and drives the sidebar selection.
-    @StateObject private var router = NavRouter()
+    @StateObject private var router: NavRouter
     /// #267: drives a foreground sync kick when the window becomes active (no scenePhase hook
     /// existed on macOS before this).
     @Environment(\.scenePhase) private var scenePhase
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index e4135db0d0..08b7cfbb44 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -209723,7 +209723,271 @@
     "iCloud Drive": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"es":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"fr":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"it":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"pl":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"pt-PT":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"ru":{"stringUnit":{"state":"translated","value":"iCloud Drive"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"iCloud 云盘"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"iCloud 雲碟"}}}},
     "iCloud Drive › %@": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"es":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"fr":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"it":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"pl":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"pt-PT":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"ru":{"stringUnit":{"state":"translated","value":"iCloud Drive › %@"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"iCloud 云盘 › %@"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"iCloud 雲碟 › %@"}}}},
     "NOOP (in Files)": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"NOOP (in Dateien)"}},"es":{"stringUnit":{"state":"translated","value":"NOOP (en Archivos)"}},"fr":{"stringUnit":{"state":"translated","value":"NOOP (dans Fichiers)"}},"it":{"stringUnit":{"state":"translated","value":"NOOP (in File)"}},"pl":{"stringUnit":{"state":"translated","value":"NOOP (w Plikach)"}},"pt-PT":{"stringUnit":{"state":"translated","value":"NOOP (em Ficheiros)"}},"ru":{"stringUnit":{"state":"translated","value":"NOOP (в Файлах)"}},"zh-Hans":{"stringUnit":{"state":"translated","value":"NOOP（在“文件”中）"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"NOOP（在「檔案」中）"}}}},
-    "Live heart rate is streaming, but your strap is not fully paired. The encrypted pairing is what carries motion, skin temperature, SpO₂ and respiratory rate — without it, sleep is staged from heart rate alone. Buzz, alarms and history sync need it too.": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Die Live-Herzfrequenz wird übertragen, aber dein Strap ist nicht vollständig gekoppelt. Die verschlüsselte Kopplung liefert Bewegung, Hauttemperatur, SpO₂ und Atemfrequenz — ohne sie wird der Schlaf allein aus der Herzfrequenz abgeleitet. Auch Buzz, Wecker und Verlaufssynchronisierung brauchen sie."}},"es":{"stringUnit":{"state":"translated","value":"La frecuencia cardíaca en vivo se está transmitiendo, pero tu correa no está totalmente emparejada. El emparejamiento cifrado es el que aporta movimiento, temperatura de la piel, SpO₂ y frecuencia respiratoria: sin él, el sueño se calcula solo a partir de la frecuencia cardíaca. El zumbido, las alarmas y la sincronización del historial también lo necesitan."}},"fr":{"stringUnit":{"state":"translated","value":"La fréquence cardiaque en direct est transmise, mais votre bracelet n'est pas entièrement appairé. C'est l'appairage chiffré qui transporte le mouvement, la température cutanée, la SpO₂ et la fréquence respiratoire — sans lui, le sommeil est estimé à partir de la seule fréquence cardiaque. Le buzz, les alarmes et la synchronisation de l'historique en ont besoin aussi."}},"it":{"stringUnit":{"state":"translated","value":"La frequenza cardiaca live viene trasmessa, ma il tuo strap non è completamente associato. È l'associazione cifrata a trasportare movimento, temperatura della pelle, SpO₂ e frequenza respiratoria — senza di essa il sonno viene stimato dalla sola frequenza cardiaca. Anche buzz, sveglie e sincronizzazione della cronologia ne hanno bisogno."}},"pl":{"stringUnit":{"state":"translated","value":"Tętno na żywo jest przesyłane, ale opaska nie jest w pełni sparowana. To szyfrowane parowanie przenosi ruch, temperaturę skóry, SpO₂ i częstość oddechów — bez niego sen jest wyznaczany wyłącznie z tętna. Wibracje, alarmy i synchronizacja historii też go wymagają."}},"pt-PT":{"stringUnit":{"state":"translated","value":"A frequência cardíaca em direto está a ser transmitida, mas a sua pulseira não está totalmente emparelhada. É o emparelhamento encriptado que transporta movimento, temperatura da pele, SpO₂ e taxa respiratória — sem ele, o sono é calculado apenas a partir da frequência cardíaca. O zumbido, os alarmes e a sincronização do histórico também precisam dele."}},"ru":{"stringUnit":{"state":"translated","value":"Пульс передаётся в реальном времени, но ремешок сопряжён не полностью. Именно зашифрованное сопряжение передаёт движение, температуру кожи, SpO₂ и частоту дыхания — без него сон определяется только по пульсу. Вибрация, будильники и синхронизация истории тоже требуют его."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"实时心率正在传输，但你的手环尚未完全配对。加密配对才能传输动作、皮肤温度、SpO₂ 和呼吸频率——没有它，睡眠只能依据心率推算。震动、闹钟和历史同步同样需要它。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"即時心率正在傳輸，但你的手環尚未完全配對。加密配對才能傳輸動作、皮膚溫度、SpO₂ 和呼吸頻率——沒有它，睡眠只能依據心率推算。震動、鬧鐘和歷史同步同樣需要它。"}}}}
+    "Live heart rate is streaming, but your strap is not fully paired. The encrypted pairing is what carries motion, skin temperature, SpO₂ and respiratory rate — without it, sleep is staged from heart rate alone. Buzz, alarms and history sync need it too.": {"localizations":{"de":{"stringUnit":{"state":"translated","value":"Die Live-Herzfrequenz wird übertragen, aber dein Strap ist nicht vollständig gekoppelt. Die verschlüsselte Kopplung liefert Bewegung, Hauttemperatur, SpO₂ und Atemfrequenz — ohne sie wird der Schlaf allein aus der Herzfrequenz abgeleitet. Auch Buzz, Wecker und Verlaufssynchronisierung brauchen sie."}},"es":{"stringUnit":{"state":"translated","value":"La frecuencia cardíaca en vivo se está transmitiendo, pero tu correa no está totalmente emparejada. El emparejamiento cifrado es el que aporta movimiento, temperatura de la piel, SpO₂ y frecuencia respiratoria: sin él, el sueño se calcula solo a partir de la frecuencia cardíaca. El zumbido, las alarmas y la sincronización del historial también lo necesitan."}},"fr":{"stringUnit":{"state":"translated","value":"La fréquence cardiaque en direct est transmise, mais votre bracelet n'est pas entièrement appairé. C'est l'appairage chiffré qui transporte le mouvement, la température cutanée, la SpO₂ et la fréquence respiratoire — sans lui, le sommeil est estimé à partir de la seule fréquence cardiaque. Le buzz, les alarmes et la synchronisation de l'historique en ont besoin aussi."}},"it":{"stringUnit":{"state":"translated","value":"La frequenza cardiaca live viene trasmessa, ma il tuo strap non è completamente associato. È l'associazione cifrata a trasportare movimento, temperatura della pelle, SpO₂ e frequenza respiratoria — senza di essa il sonno viene stimato dalla sola frequenza cardiaca. Anche buzz, sveglie e sincronizzazione della cronologia ne hanno bisogno."}},"pl":{"stringUnit":{"state":"translated","value":"Tętno na żywo jest przesyłane, ale opaska nie jest w pełni sparowana. To szyfrowane parowanie przenosi ruch, temperaturę skóry, SpO₂ i częstość oddechów — bez niego sen jest wyznaczany wyłącznie z tętna. Wibracje, alarmy i synchronizacja historii też go wymagają."}},"pt-PT":{"stringUnit":{"state":"translated","value":"A frequência cardíaca em direto está a ser transmitida, mas a sua pulseira não está totalmente emparelhada. É o emparelhamento encriptado que transporta movimento, temperatura da pele, SpO₂ e taxa respiratória — sem ele, o sono é calculado apenas a partir da frequência cardíaca. O zumbido, os alarmes e a sincronização do histórico também precisam dele."}},"ru":{"stringUnit":{"state":"translated","value":"Пульс передаётся в реальном времени, но ремешок сопряжён не полностью. Именно зашифрованное сопряжение передаёт движение, температуру кожи, SpO₂ и частоту дыхания — без него сон определяется только по пульсу. Вибрация, будильники и синхронизация истории тоже требуют его."}},"zh-Hans":{"stringUnit":{"state":"translated","value":"实时心率正在传输，但你的手环尚未完全配对。加密配对才能传输动作、皮肤温度、SpO₂ 和呼吸频率——没有它，睡眠只能依据心率推算。震动、闹钟和历史同步同样需要它。"}},"zh-Hant":{"stringUnit":{"state":"translated","value":"即時心率正在傳輸，但你的手環尚未完全配對。加密配對才能傳輸動作、皮膚溫度、SpO₂ 和呼吸頻率——沒有它，睡眠只能依據心率推算。震動、鬧鐘和歷史同步同樣需要它。"}}}},
+    "Clear conversation": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "Clear conversation"}},
+        "de": {"stringUnit": {"state": "translated", "value": "Unterhaltung löschen"}},
+        "es": {"stringUnit": {"state": "translated", "value": "Borrar conversación"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Effacer la conversation"}},
+        "it": {"stringUnit": {"state": "translated", "value": "Cancella conversazione"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Wyczyść rozmowę"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Limpar conversa"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Очистить разговор"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "清除对话"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "清除對話"}}
+    } },
+    "Clear the saved conversation": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "Clear the saved conversation"}},
+        "de": {"stringUnit": {"state": "translated", "value": "Gespeicherte Unterhaltung löschen"}},
+        "es": {"stringUnit": {"state": "translated", "value": "Borrar la conversación guardada"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Effacer la conversation enregistrée"}},
+        "it": {"stringUnit": {"state": "translated", "value": "Cancella la conversazione salvata"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Wyczyść zapisaną rozmowę"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Limpar a conversa guardada"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Очистить сохранённый разговор"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "清除已保存的对话"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "清除已儲存的對話"}}
+    } },
+    "Clear conversation?": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "Clear conversation?"}},
+        "de": {"stringUnit": {"state": "translated", "value": "Unterhaltung löschen?"}},
+        "es": {"stringUnit": {"state": "translated", "value": "¿Borrar conversación?"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Effacer la conversation ?"}},
+        "it": {"stringUnit": {"state": "translated", "value": "Cancella conversazione?"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Wyczyścić rozmowę?"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Limpar conversa?"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Очистить разговор?"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "清除对话？"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "清除對話？"}}
+    } },
+    "This deletes the saved conversation from this device. Coach history is your own notes, not medical advice.": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "This deletes the saved conversation from this device. Coach history is your own notes, not medical advice."}},
+        "de": {"stringUnit": {"state": "translated", "value": "Dies löscht die gespeicherte Unterhaltung von diesem Gerät. Coach-Verlauf sind deine eigenen Notizen, kein medizinischer Rat."}},
+        "es": {"stringUnit": {"state": "translated", "value": "Esto borra la conversación guardada de este dispositivo. El historial de Coach son tus propias notas, no consejo médico."}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Cela efface la conversation enregistrée de cet appareil. L'historique du Coach constitue vos propres notes, pas un avis médical."}},
+        "it": {"stringUnit": {"state": "translated", "value": "Questo elimina la conversazione salvata da questo dispositivo. La cronologia di Coach sono i tuoi appunti, non consigli medici."}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Spowoduje to usunięcie zapisanej rozmowy z tego urządzenia. Historia Coach to Twoje własne notatki, a nie porada medyczna."}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Isto elimina a conversa guardada deste dispositivo. O histórico do Coach são as tuas próprias notas, não aconselhamento médico."}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Это удалит сохранённый разговор с этого устройства. История Коуча — это ваши собственные заметки, а не медицинская консультация."}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "这会从此设备删除已保存的对话。Coach 历史是你自己的笔记，不是医疗建议。"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "這會從此裝置刪除已儲存的對話。Coach 歷史是你自己的筆記，不是醫療建議。"}}
+    } },
+    "Morning brief": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "Morning brief"}},
+        "de": {"stringUnit": {"state": "translated", "value": "Morgenbrief"}},
+        "es": {"stringUnit": {"state": "translated", "value": "Resumen matutino"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Bref du matin"}},
+        "it": {"stringUnit": {"state": "translated", "value": "Riepilogo mattutino"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Poranne podsumowanie"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Resumo matinal"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Утренняя сводка"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "晨间简报"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "晨間簡報"}}
+    } },
+    "A local notification with today's readiness + training plan, generated on-device each morning.": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "A local notification with today's readiness + training plan, generated on-device each morning."}},
+        "de": {"stringUnit": {"state": "translated", "value": "Eine lokale Benachrichtigung mit heutiger Bereitschaft + Trainingsplan, jeden Morgen auf dem Gerät generiert."}},
+        "es": {"stringUnit": {"state": "translated", "value": "Una notificación local con la disponibilidad de hoy + el plan de entrenamiento, generada en el dispositivo cada mañana."}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Une notification locale avec la disponibilité du jour + le plan d'entraînement, générée sur l'appareil chaque matin."}},
+        "it": {"stringUnit": {"state": "translated", "value": "Una notifica locale con la disponibilità di oggi + il piano di allenamento, generata sul dispositivo ogni mattina."}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Lokalne powiadomienie z dzisiejszą gotowością + planem treningowym, generowane na urządzeniu każdego ranka."}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Uma notificação local com a disponibilidade de hoje + o plano de treino, gerada no dispositivo todas as manhãs."}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Локальное уведомление с сегодняшней готовностью + планом тренировок, генерируется на устройстве каждое утро."}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "一条包含今日准备度 + 训练计划的本地通知，每天早晨在设备上生成。"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "一條包含今日準備度 + 訓練計劃的本地通知，每天早晨在裝置上生成。"}}
+    } },
+    "Off: nothing is generated or sent on a schedule.": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "Off: nothing is generated or sent on a schedule."}},
+        "de": {"stringUnit": {"state": "translated", "value": "Aus: Es wird nichts generiert oder nach Zeitplan gesendet."}},
+        "es": {"stringUnit": {"state": "translated", "value": "Desactivado: no se genera ni se envía nada según un horario."}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Désactivé : rien n'est généré ni envoyé selon un calendrier."}},
+        "it": {"stringUnit": {"state": "translated", "value": "Off: non viene generato né inviato nulla in base a una pianificazione."}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Wyłączone: nic nie jest generowane ani wysyłane według harmonogramu."}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Desativado: nada é gerado ou enviado num agendamento."}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Выключено: ничего не генерируется и не отправляется по расписанию."}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "关闭：不会按计划生成或发送任何内容。"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "關閉：不會按計劃生成或發送任何內容。"}}
+    } },
+    "Morning brief time": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "Morning brief time"}},
+        "de": {"stringUnit": {"state": "translated", "value": "Morgenbrief-Zeit"}},
+        "es": {"stringUnit": {"state": "translated", "value": "Hora del resumen matutino"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Heure du bref du matin"}},
+        "it": {"stringUnit": {"state": "translated", "value": "Ora del riepilogo mattutino"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Czas porannego podsumowania"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Hora do resumo matinal"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Время утренней сводки"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "晨间简报时间"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "晨間簡報時間"}}
+    } },
+    "At %@, NOOP will use your key to generate today's brief. Best-effort: %@ decides exactly when a backgrounded app wakes.": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "At %@, NOOP will use your key to generate today's brief. Best-effort: %@ decides exactly when a backgrounded app wakes."}},
+        "de": {"stringUnit": {"state": "translated", "value": "Um %@ verwendet NOOP deinen Schlüssel, um den heutigen Brief zu generieren. Best-Effort: %@ entscheidet genau, wann eine Hintergrund-App aktiviert wird."}},
+        "es": {"stringUnit": {"state": "translated", "value": "A las %@, NOOP usará tu clave para generar el resumen de hoy. Best-effort: %@ decide cuándo exactamente se activa una app en segundo plano."}},
+        "fr": {"stringUnit": {"state": "translated", "value": "À %@, NOOP utilisera votre clé pour générer le bref du jour. Au mieux : %@ décide du moment exact où une app en arrière-plan se réveille."}},
+        "it": {"stringUnit": {"state": "translated", "value": "Alle %@, NOOP userà la tua chiave per generare il riepilogo di oggi. Best-effort: %@ decide esattamente quando un'app in background si attiva."}},
+        "pl": {"stringUnit": {"state": "translated", "value": "O %@ NOOP użyje Twojego klucza do wygenerowania dzisiejszego podsumowania. Best-effort: %@ decyduje, kiedy dokładnie aplikacja w tle się wybudzi."}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Às %@, o NOOP usará a tua chave para gerar o resumo de hoje. Best-effort: %@ decide exatamente quando uma app em segundo plano é ativada."}},
+        "ru": {"stringUnit": {"state": "translated", "value": "В %@ NOOP использует ваш ключ для генерации сегодняшней сводки. По возможности: %@ решает, когда именно фоновое приложение пробуждается."}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "在 %@，NOOP 将使用你的密钥生成今日简报。尽力而为：%@ 决定后台应用何时唤醒。"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "在 %@，NOOP 將使用你的密鑰生成今日簡報。盡力而為：%@ 決定背景應用何時喚醒。"}}
+    } },
+    "Send chart image to Gemini": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "Send chart image to Gemini"}},
+        "de": {"stringUnit": {"state": "translated", "value": "Diagrammbild an Gemini senden"}},
+        "es": {"stringUnit": {"state": "translated", "value": "Enviar imagen del gráfico a Gemini"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Envoyer l'image du graphique à Gemini"}},
+        "it": {"stringUnit": {"state": "translated", "value": "Invia immagine del grafico a Gemini"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Wyślij obraz wykresu do Gemini"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Enviar imagem do gráfico para o Gemini"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Отправить изображение графика в Gemini"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "将图表图像发送给 Gemini"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "將圖表影像傳送給 Gemini"}}
+    } },
+    "On: a chart snapshot of your trends is sent with each question. Gemini can analyze the visual.": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "On: a chart snapshot of your trends is sent with each question. Gemini can analyze the visual."}},
+        "de": {"stringUnit": {"state": "translated", "value": "An: Bei jeder Frage wird ein Diagramm-Snapshot deiner Trends gesendet. Gemini kann das Visuelle analysieren."}},
+        "es": {"stringUnit": {"state": "translated", "value": "Activado: se envía una captura del gráfico de tus tendencias con cada pregunta. Gemini puede analizar lo visual."}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Activé : un instantané du graphique de vos tendances est envoyé avec chaque question. Gemini peut analyser le visuel."}},
+        "it": {"stringUnit": {"state": "translated", "value": "On: un'istantanea del grafico dei tuoi trend viene inviata con ogni domanda. Gemini può analizzare l'aspetto visivo."}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Włączone: z każdym pytaniem wysyłany jest zrzut wykresu Twoich trendów. Gemini może przeanalizować obraz."}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Ativado: uma captura do gráfico das tuas tendências é enviada com cada pergunta. O Gemini pode analisar a imagem."}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Вкл: снимок графика ваших трендов отправляется с каждым вопросом. Gemini может проанализировать визуальные данные."}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "开启：每次提问时会发送趋势图表快照。Gemini 可以分析视觉内容。"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "開啟：每次提問時會發送趨勢圖表快照。Gemini 可以分析視覺內容。"}}
+    } },
+    "Off: only text is sent. Enable to let Gemini see your charts.": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "Off: only text is sent. Enable to let Gemini see your charts."}},
+        "de": {"stringUnit": {"state": "translated", "value": "Aus: Es wird nur Text gesendet. Aktiviere dies, damit Gemini deine Diagramme sehen kann."}},
+        "es": {"stringUnit": {"state": "translated", "value": "Desactivado: solo se envía texto. Actívalo para que Gemini vea tus gráficos."}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Désactivé : seul le texte est envoyé. Activez pour permettre à Gemini de voir vos graphiques."}},
+        "it": {"stringUnit": {"state": "translated", "value": "Off: viene inviato solo testo. Attiva per permettere a Gemini di vedere i tuoi grafici."}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Wyłączone: wysyłany jest tylko tekst. Włącz, aby Gemini mógł zobaczyć Twoje wykresy."}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Desativado: apenas é enviado texto. Ativa para permitir que o Gemini veja os teus gráficos."}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Выкл: отправляется только текст. Включите, чтобы Gemini мог видеть ваши графики."}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "关闭：仅发送文本。启用以让 Gemini 查看你的图表。"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "關閉：僅發送文本。啟用以讓 Gemini 查看你的圖表。"}}
+    } },
+    "Save to Journal": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "Save to Journal"}},
+        "de": {"stringUnit": {"state": "translated", "value": "Im Tagebuch speichern"}},
+        "es": {"stringUnit": {"state": "translated", "value": "Guardar en el diario"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Enregistrer dans le journal"}},
+        "it": {"stringUnit": {"state": "translated", "value": "Salva nel diario"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Zapisz w dzienniku"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Guardar no diário"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Сохранить в журнал"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "保存到日志"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "儲存到日誌"}}
+    } },
+    "Follow-up prompt: %@": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "Follow-up prompt: %@"}},
+        "de": {"stringUnit": {"state": "translated", "value": "Folge-Prompt: %@"}},
+        "es": {"stringUnit": {"state": "translated", "value": "Pregunta de seguimiento: %@"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Question de suivi : %@"}},
+        "it": {"stringUnit": {"state": "translated", "value": "Prompt di follow-up: %@"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Prompt uzupełniający: %@"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Pergunta de seguimento: %@"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Дополнительный запрос: %@"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "后续提示：%@"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "後續提示：%@"}}
+    } },
+    "~%lld tokens": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "~%lld tokens"}},
+        "de": {"stringUnit": {"state": "translated", "value": "~%lld Token"}},
+        "es": {"stringUnit": {"state": "translated", "value": "~%lld tokens"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "~%lld jetons"}},
+        "it": {"stringUnit": {"state": "translated", "value": "~%lld token"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "~%lld tokenów"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "~%lld tokens"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "~%lld токенов"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "~%lld 个 token"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "~%lld 個 token"}}
+    } },
+    "· may exceed small context windows": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "· may exceed small context windows"}},
+        "de": {"stringUnit": {"state": "translated", "value": "· kann kleine Kontextfenster überschreiten"}},
+        "es": {"stringUnit": {"state": "translated", "value": "· puede superar ventanas de contexto pequeñas"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "· peut dépasser les petites fenêtres de contexte"}},
+        "it": {"stringUnit": {"state": "translated", "value": "· potrebbe superare le piccole finestre di contesto"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "· może przekroczyć małe okna kontekstu"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "· pode exceder janelas de contexto pequenas"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "· может превышать небольшие окна контекста"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "· 可能超出小型上下文窗口"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "· 可能超出小型上下文視窗"}}
+    } },
+    "Ask out loud": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "Ask out loud"}},
+        "de": {"stringUnit": {"state": "translated", "value": "Laut fragen"}},
+        "es": {"stringUnit": {"state": "translated", "value": "Preguntar en voz alta"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Poser la question à voix haute"}},
+        "it": {"stringUnit": {"state": "translated", "value": "Chiedi a voce alta"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Zapytaj na głos"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Perguntar em voz alta"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Задать вопрос вслух"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "大声提问"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "大聲提問"}}
+    } },
+    "Stop voice input": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "Stop voice input"}},
+        "de": {"stringUnit": {"state": "translated", "value": "Spracheingabe stoppen"}},
+        "es": {"stringUnit": {"state": "translated", "value": "Detener entrada de voz"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Arrêter la saisie vocale"}},
+        "it": {"stringUnit": {"state": "translated", "value": "Ferma input vocale"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Zatrzymaj wprowadzanie głosowe"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Parar entrada de voz"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Остановить голосовой ввод"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "停止语音输入"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "停止語音輸入"}}
+    } },
+    "Voice input": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "Voice input"}},
+        "de": {"stringUnit": {"state": "translated", "value": "Spracheingabe"}},
+        "es": {"stringUnit": {"state": "translated", "value": "Entrada de voz"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Saisie vocale"}},
+        "it": {"stringUnit": {"state": "translated", "value": "Input vocale"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Wprowadzanie głosowe"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Entrada de voz"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Голосовой ввод"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "语音输入"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "語音輸入"}}
+    } },
+    "Coach Brief": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "Coach Brief"}},
+        "de": {"stringUnit": {"state": "translated", "value": "Coach-Brief"}},
+        "es": {"stringUnit": {"state": "translated", "value": "Resumen del Coach"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Bref du Coach"}},
+        "it": {"stringUnit": {"state": "translated", "value": "Riepilogo Coach"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Podsumowanie Coach"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Resumo do Coach"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Сводка Коуча"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "Coach 简报"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "Coach 簡報"}}
+    } },
+    "No brief yet": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "No brief yet"}},
+        "de": {"stringUnit": {"state": "translated", "value": "Noch kein Brief"}},
+        "es": {"stringUnit": {"state": "translated", "value": "Aún no hay resumen"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Pas encore de bref"}},
+        "it": {"stringUnit": {"state": "translated", "value": "Nessun riepilogo ancora"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Brak podsumowania"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Ainda sem resumo"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Сводки пока нет"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "尚无简报"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "尚無簡報"}}
+    } },
+    "Enable Morning Brief in Coach settings to see today's readiness here.": {"localizations": {
+        "en": {"stringUnit": {"state": "translated", "value": "Enable Morning Brief in Coach settings to see today's readiness here."}},
+        "de": {"stringUnit": {"state": "translated", "value": "Aktiviere den Morgenbrief in den Coach-Einstellungen, um die heutige Bereitschaft hier zu sehen."}},
+        "es": {"stringUnit": {"state": "translated", "value": "Activa el resumen matutino en los ajustes de Coach para ver la disponibilidad de hoy aquí."}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Activez le bref du matin dans les réglages du Coach pour voir la disponibilité du jour ici."}},
+        "it": {"stringUnit": {"state": "translated", "value": "Attiva il riepilogo mattutino nelle impostazioni di Coach per vedere la disponibilità di oggi qui."}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Włącz poranne podsumowanie w ustawieniach Coach, aby zobaczyć tu dzisiejszą gotowość."}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Ativa o resumo matinal nas definições do Coach para ver a disponibilidade de hoje aqui."}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Включите утреннюю сводку в настройках Коуча, чтобы видеть сегодняшнюю готовность здесь."}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "在 Coach 设置中启用晨间简报以在此处查看今日准备度。"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "在 Coach 設定中啟用晨間簡報以在此處查看今日準備度。"}}
+    } }
   },
   "version": "1.0"
-}
+}
\ No newline at end of file
diff --git a/Strand/Screens/CoachView.swift b/Strand/Screens/CoachView.swift
index e9577e3a34..812b2048a3 100644
--- a/Strand/Screens/CoachView.swift
+++ b/Strand/Screens/CoachView.swift
@@ -14,9 +14,15 @@ import StrandDesign
 /// `sending`, `errorText`, `setKey(_:)`, `clearKey()`, and `send(_:)`.
 struct CoachView: View {
     @EnvironmentObject var coach: AICoachEngine
+    /// K8: used by "Save to Journal" — saves the coach advice as a journal entry with the text
+    /// in the notes field, so it appears alongside other journal entries in Insights.
+    @EnvironmentObject var repo: Repository
 
     /// Draft text in the composer (the question being typed).
-    @State private var draft: String = ""
+    /// K15: the composer draft is persisted to UserDefaults so it survives an app relaunch.
+    /// Restored on first appear, saved on every change. Keyed identically to the Android twin.
+    private static let draftKey = "coach.composerDraft"
+    @State private var draft: String = UserDefaults.standard.string(forKey: "coach.composerDraft") ?? ""
     /// Pending key text in the setup card (never persisted here, handed to `setKey`).
     @State private var keyDraft: String = ""
     /// Whether the model selector is in free-text "Custom…" mode.
@@ -31,11 +37,27 @@ struct CoachView: View {
     @State private var promptDraft: String = ""
     @FocusState private var composerFocused: Bool
 
+    // K5: scheduled morning-brief notification settings (CoachBriefScheduler).
+    @State private var briefEnabled: Bool = CoachBriefScheduler.isEnabled
+    @State private var briefMinutes: Int = CoachBriefScheduler.timeMinutes
+    @State private var briefGenerating = false
+    @State private var briefStatus: String?
+    /// K2: confirmation gate for the destructive "Clear conversation" toolbar action.
+    @State private var showClearConfirm = false
+
+    // K4: on-device voice input for the composer (iOS only). macOS gets a no-op stub via
+    // `#if os(iOS)` guards — the shared file keeps compiling for both targets.
+    #if os(iOS)
+    @StateObject private var voiceInput = CoachVoiceInput()
+    #endif
+
     /// Sentinel tag for the "Custom…" entry in the model Picker.
     private let customModelTag = "__custom__"
 
-    /// #1862: shared with the Today Coach launcher sheet — see `CoachPrompts`.
-    private var suggestions: [String] { CoachPrompts.suggestions }
+    /// Contextual suggestion chips, derived from today's bands by `AICoachEngine.suggestions`
+    /// (→ `CoachSuggestions`). Falls back to a stable generic set when there is no data. Recomputed
+    /// on each body evaluation so a fresh sync immediately updates the chips.
+    private var suggestions: [String] { coach.suggestions }
 
     var body: some View {
         ScreenScaffold(title: "Coach",
@@ -50,13 +72,27 @@ struct CoachView: View {
                 // v5: a SECOND opt-in, only meaningful once data access is on, folds a summary of the
                 // new on-device signals (your strongest patterns + Lab Book) into the coach context.
                 if coach.dataConsent { onDeviceSignalsBar }
+                if coach.dataConsent && coach.provider == .gemini { multimodalChartBar }
                 systemPromptBar
+                morningBriefBar
                 transcript
                 if let error = coach.errorText, !error.isEmpty {
                     errorBanner(error)
                 }
-                suggestionChips
+                // K7: show follow-up chips after each assistant reply (when the transcript is
+                // non-empty and the last message is from the assistant and not mid-send);
+                // otherwise show the initial contextual chips.
+                if showFollowUpChips {
+                    followUpChips
+                } else {
+                    suggestionChips
+                }
                 composer
+                // K12: show a rough token estimate when the draft is non-empty.
+                if !draft.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty,
+                   let tokens = coach.estimatedTokens(forDraft: draft) {
+                    tokenEstimateBar(tokens)
+                }
                 privacyFootnote
             } else {
                 setupCard
@@ -64,6 +100,17 @@ struct CoachView: View {
         }
         .toolbar {
             if coach.isConfigured {
+                // K2: wipe the persisted + in-memory conversation. Confirmed, since it's destructive.
+                ToolbarItem {
+                    Button(role: .destructive) {
+                        showClearConfirm = true
+                    } label: {
+                        Label("Clear conversation", systemImage: "trash")
+                    }
+                    .help("Clear the saved conversation")
+                    .accessibilityLabel("Clear conversation")
+                    .disabled(coach.messages.isEmpty)
+                }
                 ToolbarItem {
                     Button(role: .destructive) {
                         coach.disconnect()
@@ -76,7 +123,30 @@ struct CoachView: View {
                 }
             }
         }
-        .task(id: coach.dataConsent) { await coach.startBriefIfNeeded() }
+        .confirmationDialog(
+            "Clear conversation?",
+            isPresented: $showClearConfirm,
+            titleVisibility: .visible
+        ) {
+            Button("Clear", role: .destructive) { coach.clearConversation() }
+            Button("Cancel", role: .cancel) {}
+        } message: {
+            Text("This deletes the saved conversation from this device. Coach history is your own notes, not medical advice.")
+        }
+        // K2 + K5 ordering matters and every step gates on an EMPTY transcript, so this is ONE `.task`
+        // running sequentially (separate `.task`s can interleave at their await points on the same
+        // actor): restore whatever the prior launch persisted, THEN surface a brief the scheduled
+        // notification already generated (if any), THEN the interactive first-open brief — so
+        // `startBriefIfNeeded` only ever runs over the network when BOTH of the above left the
+        // transcript genuinely empty.
+        .task {
+            await coach.loadPersistedMessagesIfNeeded()
+            if let stored = CoachBriefScheduler.consumeStoredBrief() {
+                coach.surfaceScheduledBrief(stored)
+            }
+            CoachBriefScheduler.activateIfEnabled { await coach.generateBrief() }
+            await coach.startBriefIfNeeded()
+        }
         // #1862: a question handed over by the Today launcher sheet. Cleared BEFORE sending so a view
         // rebuild mid-flight cannot send it twice, and gated on `isConfigured` so an unconfigured handoff
         // (which the launcher does not produce, but a future caller might) degrades to showing setup
@@ -87,6 +157,108 @@ struct CoachView: View {
             guard coach.isConfigured else { return }
             await coach.send(prompt)
         }
+        // K15: persist the composer draft so it survives an app relaunch.
+        .onChangeCompat(of: draft) { newValue in
+            UserDefaults.standard.set(newValue, forKey: Self.draftKey)
+        }
+        // K14: haptic feedback when a reply arrives (sending goes true → false).
+        .onChangeCompat(of: coach.sending) { isSending in
+            if !isSending && !coach.messages.isEmpty {
+                triggerReplyHaptic()
+            }
+        }
+        // A consent toggle AFTER the initial load re-checks the brief (the original `.task(id:)`
+        // behaviour); the guard inside `startBriefIfNeeded` (messages.isEmpty) keeps this a no-op once
+        // a conversation exists.
+        .onChangeCompat(of: coach.dataConsent) { _ in
+            Task { await coach.startBriefIfNeeded() }
+        }
+    }
+
+    /// K5: the scheduled morning-brief notification settings — enable toggle, time-of-day picker, and an
+    /// explicit "Generate now" button. Mirrors the `ScheduledDebugExport` settings row shape (TestCentreView).
+    private var morningBriefBar: some View {
+        NoopCard(padding: 14, tint: StrandPalette.chargeColor) {
+            VStack(alignment: .leading, spacing: 10) {
+                HStack(spacing: 10) {
+                    Image(systemName: briefEnabled ? "sunrise.fill" : "sunrise")
+                        .foregroundStyle(briefEnabled ? StrandPalette.accent : StrandPalette.textTertiary)
+                        .accessibilityHidden(true)
+                    VStack(alignment: .leading, spacing: 1) {
+                        Text("Morning brief").font(StrandFont.subhead).foregroundStyle(StrandPalette.textPrimary)
+                        Text(briefEnabled
+                             ? "A local notification with today's readiness + training plan, generated on-device each morning."
+                             : "Off: nothing is generated or sent on a schedule.")
+                            .font(StrandFont.footnote).foregroundStyle(StrandPalette.textTertiary)
+                            .fixedSize(horizontal: false, vertical: true)
+                    }
+                    Spacer(minLength: 8)
+                    Toggle("", isOn: $briefEnabled)
+                        .labelsHidden().toggleStyle(.switch).tint(StrandPalette.accent)
+                        .accessibilityLabel("Morning brief")
+                }
+                .onChangeCompat(of: briefEnabled) { on in
+                    CoachBriefScheduler.setEnabled(on, generateBrief: { await coach.generateBrief() }) { outcome in
+                        if outcome == .denied {
+                            briefEnabled = false
+                            briefStatus = "Notifications are off for NOOP — enable them in Settings first."
+                        }
+                    }
+                }
+
+                if briefEnabled {
+                    Divider().overlay(StrandPalette.hairline)
+                    HStack {
+                        Text("Time").font(StrandFont.subhead).foregroundStyle(StrandPalette.textPrimary)
+                        Spacer()
+                        DatePicker("", selection: briefTimeBinding, displayedComponents: .hourAndMinute)
+                            .labelsHidden()
+                            .accessibilityLabel("Morning brief time")
+                    }
+                    Text("At \(Platform.deviceNounPhrase == "Mac" ? "this time" : "or soon after"), NOOP will use your key to generate today's brief. Best-effort: \(Platform.deviceNounPhrase) decides exactly when a backgrounded app wakes.")
+                        .font(StrandFont.caption).foregroundStyle(StrandPalette.textTertiary)
+                        .fixedSize(horizontal: false, vertical: true)
+                    NoopButton(briefGenerating ? "Generating…" : "Generate now", systemImage: "sparkles", kind: .secondary) {
+                        generateBriefNow()
+                    }
+                    .disabled(briefGenerating)
+                    if let briefStatus {
+                        Text(briefStatus).font(StrandFont.footnote).foregroundStyle(StrandPalette.textTertiary)
+                    }
+                }
+            }
+        }
+    }
+
+    private var briefTimeBinding: Binding<Date> {
+        Binding(
+            get: {
+                var c = DateComponents()
+                c.hour = briefMinutes / 60
+                c.minute = briefMinutes % 60
+                return Calendar.current.date(from: c) ?? Date()
+            },
+            set: { date in
+                let c = Calendar.current.dateComponents([.hour, .minute], from: date)
+                let m = (c.hour ?? 7) * 60 + (c.minute ?? 0)
+                briefMinutes = m
+                CoachBriefScheduler.setTimeMinutes(m, generateBrief: { await coach.generateBrief() })
+            }
+        )
+    }
+
+    private func generateBriefNow() {
+        Task {
+            briefGenerating = true
+            briefStatus = nil
+            defer { briefGenerating = false }
+            let text = await CoachBriefScheduler.generateNow { await coach.generateBrief() }
+            if let text {
+                coach.appendGeneratedBrief(text)
+            } else {
+                briefStatus = "Couldn't generate a brief right now — check your key and data access."
+            }
+        }
     }
 
     /// Explicit, revocable permission for the coach to read & send the user's data. Off by default.
@@ -139,6 +311,31 @@ struct CoachView: View {
         }
     }
 
+    /// K11: Third opt-in — send a chart image alongside the text when using Gemini's multimodal
+    /// API. Only shown when the provider is Gemini. OFF by default.
+    private var multimodalChartBar: some View {
+        NoopCard(padding: 14, tint: StrandPalette.chargeColor) {
+            HStack(spacing: 10) {
+                Image(systemName: coach.multimodalChartEnabled ? "photo.badge.checkmark" : "photo")
+                    .foregroundStyle(coach.multimodalChartEnabled ? StrandPalette.accent : StrandPalette.textTertiary)
+                    .accessibilityHidden(true)
+                VStack(alignment: .leading, spacing: 1) {
+                    Text("Send chart image to Gemini")
+                        .font(StrandFont.subhead).foregroundStyle(StrandPalette.textPrimary)
+                    Text(coach.multimodalChartEnabled
+                         ? "On: a chart snapshot of your trends is sent with each question. Gemini can analyze the visual."
+                         : "Off: only text is sent. Enable to let Gemini see your charts.")
+                        .font(StrandFont.footnote).foregroundStyle(StrandPalette.textTertiary)
+                        .fixedSize(horizontal: false, vertical: true)
+                }
+                Spacer(minLength: 8)
+                Toggle("", isOn: $coach.multimodalChartEnabled)
+                    .labelsHidden().toggleStyle(.switch).tint(StrandPalette.accent)
+                    .accessibilityLabel("Send chart image to Gemini")
+            }
+        }
+    }
+
     /// Editable system prompt, the instructions that frame the coach. Collapsed by default; expanding
     /// reveals a TextEditor bound to the engine (edits persist to UserDefaults and take effect on the
     /// next message) plus a Reset-to-default control. Lives inline in the existing settings, NOT a modal.
@@ -484,6 +681,7 @@ struct CoachView: View {
             // LLM replies arrive as Markdown (bold, lists, headings, tables),             // rendered with the chat-bubble-sized Strand theme. User bubbles stay
             // verbatim `Text` so typed `*`/`#` never turn into surprise formatting.
             // The reply sits on a frosted Charge-tinted surface, a card, not a flat box.
+            // K8: context menu (long-press / right-click) with Copy, Share, and Save actions.
             HStack {
                 Markdown(message.text)
                     .markdownTheme(.strand)
@@ -493,6 +691,27 @@ struct CoachView: View {
                     .padding(.vertical, 11)
                     .frostedCardSurface(tint: StrandPalette.chargeColor, cornerRadius: 16)
                     .frame(maxWidth: 560, alignment: .leading)
+                    // K8: Copy / Share / Save context menu on assistant replies.
+                    .contextMenu {
+                        Button {
+                            #if os(macOS)
+                            NSPasteboard.general.clearContents()
+                            NSPasteboard.general.setString(message.text, forType: .string)
+                            #else
+                            UIPasteboard.general.string = message.text
+                            #endif
+                        } label: {
+                            Label("Copy", systemImage: "doc.on.doc")
+                        }
+                        ShareLink(item: message.text) {
+                            Label("Share", systemImage: "square.and.arrow.up")
+                        }
+                        Button {
+                            saveAdvice(message.text)
+                        } label: {
+                            Label("Save to Journal", systemImage: "square.and.pencil")
+                        }
+                    }
                 Spacer(minLength: 48)
             }
             .accessibilityElement(children: .combine)
@@ -558,6 +777,59 @@ struct CoachView: View {
         }
     }
 
+    /// K7: True when follow-up chips should show instead of the initial contextual chips —
+    /// i.e. the transcript is non-empty, the last message is from the assistant, and a reply
+    /// is not currently in flight.
+    private var showFollowUpChips: Bool {
+        guard let last = coach.messages.last, !coach.sending else { return false }
+        return last.role == .assistant
+    }
+
+    /// K7: Follow-up suggestion chips shown after each assistant reply, so the user can dig
+    /// deeper without typing. Uses the static `AICoachEngine.followUpSuggestions` list.
+    private var followUpChips: some View {
+        ScrollView(.horizontal, showsIndicators: false) {
+            HStack(spacing: 8) {
+                ForEach(AICoachEngine.followUpSuggestions, id: \.self) { prompt in
+                    Button {
+                        send(prompt)
+                    } label: {
+                        Text(prompt)
+                            .font(StrandFont.captionNumber)
+                            .foregroundStyle(StrandPalette.textSecondary)
+                            .padding(.horizontal, 12)
+                            .padding(.vertical, 7)
+                            .background(StrandPalette.surfaceInset, in: Capsule(style: .continuous))
+                            .overlay(Capsule(style: .continuous).strokeBorder(StrandPalette.hairline, lineWidth: 1))
+                    }
+                    .buttonStyle(LiquidPressStyle())
+                    .disabled(coach.sending)
+                    .accessibilityLabel("Follow-up prompt: \(prompt)")
+                }
+            }
+            .padding(.vertical, 1)
+        }
+    }
+
+    /// K12: A subtle token estimate shown below the composer when the draft is non-empty.
+    /// Uses the ~4 chars/token heuristic — an estimate only, not an exact tokenizer count.
+    private func tokenEstimateBar(_ tokens: Int) -> some View {
+        HStack(spacing: 4) {
+            Image(systemName: "speedometer")
+                .font(.system(size: 10))
+                .foregroundStyle(StrandPalette.textTertiary)
+            Text("~\(tokens) tokens")
+                .font(StrandFont.captionNumber)
+                .foregroundStyle(StrandPalette.textTertiary)
+            if tokens > 8000 {
+                Text("· may exceed small context windows")
+                    .font(StrandFont.captionNumber)
+                    .foregroundStyle(StrandPalette.textTertiary)
+            }
+        }
+        .padding(.top, 2)
+    }
+
     /// The input bar, a frosted overlay surface holding the field + Send, so the composer reads as a
     /// distinct docked surface above the canvas rather than two floating controls.
     private var composer: some View {
@@ -576,6 +848,11 @@ struct CoachView: View {
                 .onSubmit { send(draft) }
                 .accessibilityLabel("Question")
 
+            // K4: on-device voice input (iOS only). macOS compiles this section out entirely.
+            #if os(iOS)
+            micButton
+            #endif
+
             // Docked icon-only send affordance: a crisp accent-filled square sized to the
             // composer row (not the full 48pt control height), so it routes through the same
             // token fill/label colours as the button system without overpowering the field.
@@ -605,6 +882,82 @@ struct CoachView: View {
             .strokeBorder(StrandPalette.hairline, lineWidth: 1))
     }
 
+    // MARK: - K4: Voice input (iOS only)
+
+    #if os(iOS)
+    /// Mic button: starts/stops on-device speech recognition. Disabled when the locale lacks
+    /// on-device support or permission is denied; tapping when permission is not yet determined
+    /// triggers the system prompt.
+    private var micButton: some View {
+        Button {
+            toggleVoice()
+        } label: {
+            Group {
+                if voiceInput.isRecording {
+                    Image(systemName: "stop.circle.fill")
+                        .font(.system(size: 18, weight: .medium))
+                        .foregroundStyle(StrandPalette.statusCritical)
+                } else {
+                    Image(systemName: "mic.fill")
+                        .font(.system(size: 15, weight: .semibold))
+                        .foregroundStyle(canUseVoice ? StrandPalette.textSecondary : StrandPalette.textTertiary)
+                }
+            }
+            .frame(width: 36, height: 38)
+            .background(StrandPalette.surfaceInset,
+                        in: RoundedRectangle(cornerRadius: 10, style: .continuous))
+            .overlay(RoundedRectangle(cornerRadius: 10, style: .continuous)
+                .strokeBorder(StrandPalette.hairline, lineWidth: 1))
+        }
+        .buttonStyle(.plain)
+        .disabled(!micButtonEnabled)
+        .help(voiceInput.statusMessage ?? "Ask out loud")
+        .accessibilityLabel(voiceInput.isRecording ? "Stop voice input" : "Voice input")
+        .accessibilityHint(voiceInput.statusMessage ?? "Transcribes your question on-device")
+        .task {
+            // Pre-check on appear so the button reflects the right state without a tap.
+            if voiceInput.authorization == .notDetermined {
+                voiceInput.requestAuthorization { _ in }
+            }
+        }
+    }
+
+    /// Whether the mic button is tappable: not while sending, and only if voice is either
+    /// already usable or permission hasn't been asked yet (first tap triggers the prompt).
+    private var canUseVoice: Bool { voiceInput.canUseVoice }
+    private var micButtonEnabled: Bool {
+        !coach.sending && (canUseVoice || voiceInput.authorization == .notDetermined)
+    }
+
+    private func toggleVoice() {
+        if voiceInput.isRecording {
+            voiceInput.stopTranscribing { finalText in
+                let trimmed = finalText.trimmingCharacters(in: .whitespacesAndNewlines)
+                if !trimmed.isEmpty {
+                    // Append to the draft (not replace) so a user can speak into existing text.
+                    draft = draft.isEmpty ? trimmed : "\(draft) \(trimmed)"
+                }
+            }
+        } else {
+            // First tap with undetermined permission triggers the system prompt; if granted,
+            // start transcribing immediately on the next tap. If already authorized, start now.
+            if voiceInput.authorization == .notDetermined {
+                voiceInput.requestAuthorization { state in
+                    if state == .authorized {
+                        voiceInput.startTranscribing { partial in
+                            draft = partial
+                        }
+                    }
+                }
+            } else {
+                voiceInput.startTranscribing { partial in
+                    draft = partial
+                }
+            }
+        }
+    }
+    #endif
+
     private var privacyFootnote: some View {
         Label {
             Text(coach.provider == .custom
@@ -647,6 +1000,30 @@ struct CoachView: View {
         Task { await coach.send(trimmed) }
     }
 
+    /// K14: Trigger a subtle haptic when the Coach reply arrives. On iOS, a light impact feedback.
+    /// macOS doesn't have an equivalent simple API, so it's a no-op there.
+    private func triggerReplyHaptic() {
+        #if os(iOS)
+        let generator = UIImpactFeedbackGenerator(style: .light)
+        generator.impactOccurred()
+        #endif
+    }
+
+    /// K8: Save a coach reply to the journal as a note, so it appears alongside other journal
+    /// entries in Insights and can be reviewed later. Uses the existing journal API with a
+    /// fixed question ("Coach advice") and the reply text in the notes field.
+    private func saveAdvice(_ text: String) {
+        let day = Repository.localDayKey(Date())
+        Task {
+            await repo.saveJournalAnswer(
+                day: day,
+                question: "Coach advice",
+                answeredYes: true,
+                notes: text
+            )
+        }
+    }
+
     private func scrollToEnd(_ proxy: ScrollViewProxy) {
         withAnimation(StrandMotion.fade) {
             if coach.sending {
diff --git a/Strand/System/CoachBriefScheduler.swift b/Strand/System/CoachBriefScheduler.swift
new file mode 100644
index 0000000000..df4ba40bc7
--- /dev/null
+++ b/Strand/System/CoachBriefScheduler.swift
@@ -0,0 +1,370 @@
+import Foundation
+import UserNotifications
+#if os(iOS)
+import BackgroundTasks
+import WidgetKit
+#endif
+
+/// PRD-K5: a user-scheduled, LOCAL notification that delivers a one-line morning coaching brief,
+/// generated on-device via the user's already-configured Coach provider, at a chosen time each day.
+/// Tap → opens Coach with the full brief. No push server, no cloud — the network call is the SAME
+/// bring-your-own-key request Coach already makes on every send, just user-armed on a daily timer
+/// instead of triggered by a tap. Default OFF, like every NOOP automation.
+///
+/// Cross-platform (macOS + iOS), same architecture as `ScheduledDebugExport`:
+/// - **macOS** — the app is usually running; a foreground `DispatchSourceTimer` fires at the chosen
+///   minute, and `catchUpIfDue` covers the time having passed while the app wasn't open.
+/// - **iOS** — a sideloaded, backgrounded app can't guarantee a wake at the exact minute. A
+///   `BGAppRefreshTaskRequest` is submitted for *no earlier than* the chosen time; iOS decides when it
+///   actually runs. If the slot is missed entirely (app never woken), the next foreground open's
+///   `activateIfEnabled` catches up and generates then instead — same honest "best-effort" posture
+///   `ScheduledDebugExport`'s Settings copy already uses.
+///
+/// Triple-gated network call: `enabled` (this feature, default OFF) + a saved Coach key + the existing
+/// `dataConsent`. `generateBrief` is `AICoachEngine.generateBrief()`, itself gated on both of those; this
+/// scheduler additionally never marks a day "done" on a failed generation, so a missing key/consent (or
+/// a transient network failure) simply retries next wake rather than going permanently silent.
+@MainActor
+enum CoachBriefScheduler {
+
+    // MARK: - Persisted settings (own keys; mirrors ScheduledDebugExport's shape)
+
+    private enum K {
+        static let enabled = "coachBrief.enabled"          // master enable; default OFF
+        static let time = "coachBrief.timeMinutes"         // minutes since local midnight; default 07:00
+        static let lastRun = "coachBrief.lastRunDayKey"    // yyyy-MM-dd of the last GENERATED brief (dedup)
+        static let storedBrief = "coachBrief.storedText"   // the full brief, for the notification tap-through
+        static let hasUnconsumed = "coachBrief.hasUnconsumedBrief"
+        // K10: the brief text mirrored into the App Group so the widget extension (separate process)
+        // can read it. The app's own UserDefaults.standard isn't visible to the widget.
+        static let widgetBriefKey = "coachBrief.widgetText"
+        static let widgetBriefDateKey = "coachBrief.widgetDate"
+    }
+
+    /// 07:00 — a brief waiting when you check your phone (matches `ScheduledDebugExport`'s default).
+    static let defaultTimeMinutes = 7 * 60
+    private static let minutesPerDay = 24 * 60
+
+    /// Category id the posted notification carries, so `NotificationPresenter` can recognise a brief tap
+    /// (as opposed to any other local notification) and route it to Coach.
+    static let notificationCategoryId = "coach-brief"
+    private static let requestIdPrefix = "coach-brief-"
+
+    static var isEnabled: Bool { UserDefaults.standard.bool(forKey: K.enabled) }
+
+    /// Time-of-day to generate, minutes since local midnight. Clamped to a valid minute. Default 07:00.
+    static var timeMinutes: Int {
+        let v = UserDefaults.standard.object(forKey: K.time) as? Int ?? defaultTimeMinutes
+        return min(max(v, 0), minutesPerDay - 1)
+    }
+
+    /// The most recently generated full brief text (for the notification tap-through), or nil before the
+    /// first successful generation.
+    static var storedBrief: String? { UserDefaults.standard.string(forKey: K.storedBrief) }
+
+    /// True when a generated brief hasn't yet been surfaced in the Coach transcript. Set right after a
+    /// successful generation; cleared by `consumeStoredBrief()`.
+    static var hasUnconsumedBrief: Bool { UserDefaults.standard.bool(forKey: K.hasUnconsumed) }
+
+    /// Coach reads this once (on appear, with an empty transcript) to surface the stored brief as its
+    /// first message without re-generating or re-sending anything. Returns nil (and leaves state
+    /// untouched) when there's nothing unconsumed, so a normal open is unaffected.
+    static func consumeStoredBrief() -> String? {
+        guard hasUnconsumedBrief, let text = storedBrief else { return nil }
+        UserDefaults.standard.set(false, forKey: K.hasUnconsumed)
+        return text
+    }
+
+    // MARK: - K10: Widget-facing API (App Group, iOS only)
+
+    #if os(iOS)
+    /// The stored brief text for the widget (App Group), or nil before the first successful generation.
+    /// The widget extension reads this — it can't see the app's `UserDefaults.standard`.
+    static var widgetBriefText: String? {
+        UserDefaults(suiteName: WidgetSnapshot.suiteName)?.string(forKey: K.widgetBriefKey)
+    }
+
+    /// Wall-clock date the widget brief was generated, so the widget can show honest staleness.
+    static var widgetBriefDate: Date? {
+        UserDefaults(suiteName: WidgetSnapshot.suiteName)?.object(forKey: K.widgetBriefDateKey) as? Date
+    }
+
+    /// Publish (or clear) the brief into the App Group so the widget extension can read it. Called
+    /// from `catchUpIfDue` / `generateNow` after a successful generation, and from `setEnabled(false)`
+    /// to clear the widget when the user turns the feature off.
+    static func publishToWidget(_ text: String?) {
+        guard let defaults = UserDefaults(suiteName: WidgetSnapshot.suiteName) else { return }
+        if let text {
+            defaults.set(text, forKey: K.widgetBriefKey)
+            defaults.set(Date(), forKey: K.widgetBriefDateKey)
+        } else {
+            defaults.removeObject(forKey: K.widgetBriefKey)
+            defaults.removeObject(forKey: K.widgetBriefDateKey)
+        }
+        // Nudge WidgetKit to reload the coach-brief widget's timeline so it picks up the new text
+        // without waiting for the next scheduled refresh. The kind string must match the widget's
+        // `kind` property (see CoachBriefWidget.swift in StrandiOSWidgets).
+        WidgetCenter.shared.reloadTimelines(ofKind: Self.widgetKind)
+    }
+    #endif
+
+    /// The WidgetKit kind string for the coach-brief widget. Must match the `kind` property on
+    /// `CoachBriefWidget` in `StrandiOSWidgets/`. Declared here so `publishToWidget` can reload
+    /// timelines without importing the widget extension's type (the app target can't see it).
+    static let widgetKind = "CoachBriefWidget"
+
+    // MARK: - Enable / configure (Settings calls these)
+
+    /// The result of enabling the schedule — mirrors `WindDownNudge.EnableOutcome` so the UI can revert
+    /// the toggle and point at Settings on denial instead of persisting a dead "on" state.
+    enum EnableOutcome { case scheduled, denied, off }
+
+    /// Enable/disable and (re)schedule. Enabling gates on notification authorization first (asks once if
+    /// undetermined; reports `.denied` rather than silently scheduling something the OS will never
+    /// deliver). `completion` always runs on the main actor.
+    static func setEnabled(_ on: Bool,
+                            generateBrief: @escaping () async -> String?,
+                            completion: (@MainActor (EnableOutcome) -> Void)? = nil) {
+        guard on else {
+            UserDefaults.standard.set(false, forKey: K.enabled)
+            cancel()
+            #if os(iOS)
+            publishToWidget(nil)  // K10: clear the widget when the feature is turned off
+            #endif
+            completion?(.off)
+            return
+        }
+        UNUserNotificationCenter.current().getNotificationSettings { settings in
+            Task { @MainActor in
+                switch settings.authorizationStatus {
+                case .authorized, .provisional, .ephemeral:
+                    UserDefaults.standard.set(true, forKey: K.enabled)
+                    scheduleNext(generateBrief: generateBrief)
+                    completion?(.scheduled)
+                case .notDetermined:
+                    UNUserNotificationCenter.current().requestAuthorization(options: [.alert, .sound]) { granted, _ in
+                        Task { @MainActor in
+                            if granted {
+                                UserDefaults.standard.set(true, forKey: K.enabled)
+                                scheduleNext(generateBrief: generateBrief)
+                                completion?(.scheduled)
+                            } else {
+                                UserDefaults.standard.set(false, forKey: K.enabled)
+                                completion?(.denied)
+                            }
+                        }
+                    }
+                default:
+                    UserDefaults.standard.set(false, forKey: K.enabled)
+                    completion?(.denied)
+                }
+            }
+        }
+    }
+
+    /// Update the time-of-day and reschedule so the new time takes effect immediately.
+    static func setTimeMinutes(_ minutes: Int, generateBrief: @escaping () async -> String?) {
+        UserDefaults.standard.set(min(max(minutes, 0), minutesPerDay - 1), forKey: K.time)
+        if isEnabled { scheduleNext(generateBrief: generateBrief) }
+    }
+
+    /// Call whenever Coach (or its settings) appears so the schedule self-heals (re-arms the macOS timer
+    /// after a relaunch, re-submits the iOS request) and a slot missed while the app wasn't open still
+    /// generates once. No-op when the feature is off.
+    static func activateIfEnabled(generateBrief: @escaping () async -> String?) {
+        guard isEnabled else { return }
+        scheduleNext(generateBrief: generateBrief)
+        Task { await catchUpIfDue(generateBrief: generateBrief) }
+    }
+
+    /// The explicit "Generate now" button: always generates and stores, ignoring the once-per-day dedup,
+    /// so a tap produces a fresh brief there and then. Does NOT post a notification (the user is already
+    /// looking at Coach) and does NOT touch `lastRun`, so today's scheduled slot still fires normally.
+    /// Returns the brief text, or nil on failure (no key/consent/network) — the caller surfaces that.
+    @discardableResult
+    static func generateNow(generateBrief: () async -> String?) async -> String? {
+        await generateBrief()
+    }
+
+    // MARK: - Due check + generation
+
+    /// If today's brief is due (we're at/after the chosen time and haven't generated today), generate it
+    /// once: store the text, mark today done, and post the notification. Covers macOS launches where the
+    /// time passed while the app wasn't open, and the iOS foreground/BGTask paths.
+    ///
+    /// Returns whether this call can be considered successful: `true` when there was nothing to do
+    /// (feature off, not yet time, or already ran today) or generation succeeded; `false` only when
+    /// generation was attempted and failed (so the iOS BGTask handler can report the real outcome and
+    /// retry on the next wake instead of marking the day done on a failure).
+    @discardableResult
+    static func catchUpIfDue(generateBrief: () async -> String?) async -> Bool {
+        guard isEnabled else { return true }
+        let now = Date()
+        let cal = Calendar.current
+        let comps = cal.dateComponents([.hour, .minute], from: now)
+        let nowMinutes = (comps.hour ?? 0) * 60 + (comps.minute ?? 0)
+        guard nowMinutes >= timeMinutes else { return true }                                  // not yet time today
+        guard UserDefaults.standard.string(forKey: K.lastRun) != dayKey(now) else { return true } // already ran today
+
+        guard let text = await generateBrief() else {
+            // No key/consent/network, or the provider returned nothing. Never mark the day done, so the
+            // next wake (BGTask retry, or the next foreground open) tries again. Post a low-key retry
+            // notification rather than silently doing nothing — the PRD's "unavailable, tap to retry".
+            postNotification(title: String(localized: "Coach brief unavailable"),
+                              body: String(localized: "Couldn't generate today's brief. Tap to try again in Coach."),
+                              isRetry: true)
+            return false
+        }
+
+        UserDefaults.standard.set(dayKey(now), forKey: K.lastRun)
+        UserDefaults.standard.set(text, forKey: K.storedBrief)
+        UserDefaults.standard.set(true, forKey: K.hasUnconsumed)
+        #if os(iOS)
+        publishToWidget(text)  // K10: mirror into the App Group for the widget
+        #endif
+        postNotification(title: String(localized: "Today's coaching brief"),
+                          body: oneLineSummary(from: text))
+        return true
+    }
+
+    /// Pure: the notification body is the brief's first non-empty line, trimmed and length-capped so it
+    /// fits a notification banner. Unit-testable without any I/O.
+    static func oneLineSummary(from brief: String, maxLength: Int = 120) -> String {
+        let firstLine = brief
+            .split(separator: "\n", omittingEmptySubsequences: true)
+            .first
+            .map(String.init) ?? brief
+        let trimmed = firstLine.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard trimmed.count > maxLength else { return trimmed }
+        let cut = trimmed.index(trimmed.startIndex, offsetBy: maxLength)
+        return trimmed[..<cut].trimmingCharacters(in: .whitespaces) + "…"
+    }
+
+    private static func postNotification(title: String, body: String, isRetry: Bool = false) {
+        let content = UNMutableNotificationContent()
+        content.title = title
+        content.body = body
+        content.sound = .default
+        content.categoryIdentifier = notificationCategoryId
+        // Immediate delivery (trigger nil) — this fires the moment generation completes, it is not a
+        // pre-scheduled fixed-content trigger like `WindDownNudge`'s. One id per day, so a retry
+        // replaces rather than stacks the earlier attempt's notification.
+        let request = UNNotificationRequest(identifier: requestIdPrefix + dayKey(Date()),
+                                            content: content, trigger: nil)
+        UNUserNotificationCenter.current().add(request)
+    }
+
+    /// yyyy-MM-dd local-day key for the once-per-day dedup. POSIX locale so the key is stable everywhere.
+    private static func dayKey(_ date: Date) -> String {
+        let f = DateFormatter()
+        f.locale = Locale(identifier: "en_US_POSIX")
+        f.dateFormat = "yyyy-MM-dd"
+        return f.string(from: date)
+    }
+
+    /// Seconds from now until the next wall-clock occurrence of `minuteOfDay` (today if still ahead, else
+    /// tomorrow). Mirrors `ScheduledDebugExport.secondsToNextOccurrence`.
+    private static func secondsToNextOccurrence(_ minuteOfDay: Int, now: Date = Date()) -> TimeInterval {
+        let cal = Calendar.current
+        var comps = cal.dateComponents([.year, .month, .day], from: now)
+        comps.hour = minuteOfDay / 60
+        comps.minute = minuteOfDay % 60
+        comps.second = 0
+        var target = cal.date(from: comps) ?? now
+        if target <= now { target = cal.date(byAdding: .day, value: 1, to: target) ?? target }
+        return max(1, target.timeIntervalSince(now))
+    }
+
+    // MARK: - Scheduling
+
+    private static var macTimer: DispatchSourceTimer?
+
+    /// (Re)arm the next occurrence. macOS uses a foreground `DispatchSourceTimer`; iOS submits a
+    /// background-refresh request. Both target the next wall-clock occurrence of `timeMinutes`.
+    private static func scheduleNext(generateBrief: @escaping () async -> String?) {
+        #if os(macOS)
+        macTimer?.cancel()
+        let timer = DispatchSource.makeTimerSource(queue: .main)
+        let delay = secondsToNextOccurrence(timeMinutes)
+        timer.schedule(deadline: .now() + delay)
+        timer.setEventHandler {
+            Task { @MainActor in
+                guard isEnabled else { return }
+                _ = await catchUpIfDue(generateBrief: generateBrief)
+                scheduleNext(generateBrief: generateBrief)
+            }
+        }
+        timer.resume()
+        macTimer = timer
+        #elseif os(iOS)
+        submitBackgroundRequest()
+        #endif
+    }
+
+    /// Cancel any armed schedule.
+    private static func cancel() {
+        #if os(macOS)
+        macTimer?.cancel()
+        macTimer = nil
+        #elseif os(iOS)
+        BGTaskScheduler.shared.cancel(taskRequestWithIdentifier: bgTaskIdentifier)
+        #endif
+    }
+
+    // MARK: - iOS background task plumbing
+
+    #if os(iOS)
+    /// iOS BGTask identifier, derived from the running bundle id so it tracks `BUNDLE_ID_PREFIX` and
+    /// matches the iOS target's `BGTaskSchedulerPermittedIdentifiers` (Info.plist / project.yml).
+    static let bgTaskIdentifier = (Bundle.main.bundleIdentifier ?? "com.noopapp.noop") + ".coachbrief"
+
+    /// Register the BGTask handler. MUST be called from the app's launch (before launch finishes) — call
+    /// this from `StrandiOSApp.init()` with `{ [weak coach] in await coach?.generateBrief() }`. Safe to
+    /// leave uncalled: `submitBackgroundRequest()` then fails gracefully and the foreground catch-up
+    /// (`activateIfEnabled`, called from Coach's `.task`) still generates on next open.
+    static func register(generateBrief: @escaping () async -> String?) {
+        BGTaskScheduler.shared.register(forTaskWithIdentifier: bgTaskIdentifier, using: nil) { task in
+            let completion = TaskCompletionGuard(task: task)
+            let worker = Task { @MainActor in
+                task.expirationHandler = { completion.finish(success: false) }
+                guard isEnabled else {
+                    completion.finish(success: true)
+                    return
+                }
+                let succeeded = await catchUpIfDue(generateBrief: generateBrief)
+                // Single-shot; request the next occurrence regardless of this run's outcome so a failed
+                // generation still retries at the next wake rather than going silent for good.
+                submitBackgroundRequest()
+                completion.finish(success: succeeded)
+            }
+            task.expirationHandler = { worker.cancel(); completion.finish(success: false) }
+        }
+    }
+
+    /// `BGTask` completion is single-shot even when the normal path races expiration.
+    private final class TaskCompletionGuard: @unchecked Sendable {
+        private let task: BGTask
+        private let lock = NSLock()
+        private var finished = false
+
+        init(task: BGTask) { self.task = task }
+
+        func finish(success: Bool) {
+            lock.lock()
+            defer { lock.unlock() }
+            guard !finished else { return }
+            finished = true
+            task.setTaskCompleted(success: success)
+            task.expirationHandler = nil
+        }
+    }
+
+    /// Submit a background-refresh request for *no earlier than* the next chosen time. iOS decides when
+    /// (and whether) to actually run it — best-effort, same honesty as `ScheduledDebugExport`.
+    private static func submitBackgroundRequest() {
+        let request = BGAppRefreshTaskRequest(identifier: bgTaskIdentifier)
+        request.earliestBeginDate = Date(timeIntervalSinceNow: secondsToNextOccurrence(timeMinutes))
+        try? BGTaskScheduler.shared.submit(request)
+    }
+    #endif
+}
diff --git a/Strand/System/NotificationPresenter.swift b/Strand/System/NotificationPresenter.swift
index 8d534c51ea..9c5448eda0 100644
--- a/Strand/System/NotificationPresenter.swift
+++ b/Strand/System/NotificationPresenter.swift
@@ -17,6 +17,12 @@ final class NotificationPresenter: NSObject, UNUserNotificationCenterDelegate {
 
     private override init() { super.init() }
 
+    /// K5: wired by the app root (`StrandApp` on macOS, `StrandiOSApp` on iOS) at launch to route a
+    /// tapped scheduled morning-brief notification to the Coach screen via `NavRouter.openCoach()`. nil
+    /// is a safe no-op (the tap is simply not routed) rather than a crash if this ever fires before the
+    /// root has wired it.
+    var onCoachBriefTapped: (() -> Void)?
+
     func userNotificationCenter(
         _ center: UNUserNotificationCenter,
         willPresent notification: UNNotification,
@@ -24,4 +30,18 @@ final class NotificationPresenter: NSObject, UNUserNotificationCenterDelegate {
     ) {
         completionHandler([.banner, .sound, .list])
     }
+
+    /// Handle a tap on a delivered notification. Only the scheduled morning-brief category (K5) routes
+    /// anywhere; every other notification (wind-down, smart-alarm, battery/illness) just opens the app
+    /// to wherever it was, matching the pre-K5 behaviour.
+    func userNotificationCenter(
+        _ center: UNUserNotificationCenter,
+        didReceive response: UNNotificationResponse,
+        withCompletionHandler completionHandler: @escaping () -> Void
+    ) {
+        if response.notification.request.content.categoryIdentifier == CoachBriefScheduler.notificationCategoryId {
+            onCoachBriefTapped?()
+        }
+        completionHandler()
+    }
 }
diff --git a/StrandiOS/App/AppModel+iOS.swift b/StrandiOS/App/AppModel+iOS.swift
index 5b706e3751..56e7589033 100644
--- a/StrandiOS/App/AppModel+iOS.swift
+++ b/StrandiOS/App/AppModel+iOS.swift
@@ -2,9 +2,10 @@
 import Foundation
 
 extension AppModel {
-    /// Execute any actions queued by App Intents while the app was suspended (mark moment, buzz).
-    /// Call when the app becomes active.
-    func drainPendingIntents() {
+    /// Execute any actions queued by App Intents while the app was suspended (mark moment, buzz,
+    /// ask coach). Call when the app becomes active. The optional `router` lets the ask-coach
+    /// intent navigate to the Coach tab after sending the question.
+    func drainPendingIntents(router: NavRouter? = nil) {
         for item in PendingIntents.drain() {
             switch item.action {
             case .markMoment: markMoment(at: item.date ?? Date())
@@ -12,6 +13,16 @@ extension AppModel {
             // The one-shot routine sends the confirmed pattern + RUN_ALARM sequence, acked, so a
             // busy just-foregrounded BLE link can't silently drop it.
             case .buzz:       buzzStrapOnce()
+            // K9: "Ask Coach" via Siri — send the queued question to the Coach engine and navigate
+            // to the Coach tab so the user sees the response. The question is consumed from a
+            // dedicated key (one at a time).
+            case .askCoach:
+                if let question = PendingIntents.consumeCoachQuestion() {
+                    router?.openCoach()
+                    Task { @MainActor in
+                        await coach.send(question)
+                    }
+                }
             }
         }
     }
diff --git a/StrandiOS/App/CoachVoiceInput.swift b/StrandiOS/App/CoachVoiceInput.swift
new file mode 100644
index 0000000000..3076ce6b93
--- /dev/null
+++ b/StrandiOS/App/CoachVoiceInput.swift
@@ -0,0 +1,241 @@
+import Foundation
+import SwiftUI
+#if canImport(UIKit)
+import UIKit
+import Speech
+#endif
+
+/// K4: On-device speech-to-text wrapper for the Coach composer (iOS only).
+///
+/// Design contract (see PRD-K4):
+/// - **No raw audio egress.** Recognition is requested with `requiresOnDeviceRecognition = true`
+///   wherever the locale supports it. If a locale ONLY supports server recognition, voice is
+///   **disabled** for that locale rather than falling back to server transcription — server
+///   transcription would ship audio off-device, breaking the offline posture.
+/// - The microphone button lives in the shared `CoachView` composer; on macOS this type is a
+///   no-op (`isSupported` is `false`, all methods are inert) so the shared file keeps compiling.
+/// - Only the resulting TEXT ever reaches the provider, via the same channel a typed question
+///   already uses. No new network path is introduced.
+///
+/// Usage from `CoachView`:
+/// 1. `voice.isSupported` gates whether the mic button is shown at all.
+/// 2. `voice.authorizationStatus` drives the button's enabled / "open Settings" state.
+/// 3. `voice.startTranscribing(partial:)` begins a session; `partial` is called on the main
+///    actor with the live transcript.
+/// 4. `voice.stopTranscribing(completion:)` finalizes and returns the final text.
+@MainActor
+final class CoachVoiceInput: ObservableObject {
+
+    /// Whether voice input is available on this device + locale at all.
+    static var isSupported: Bool {
+        #if canImport(UIKit)
+        return SFSpeechRecognizer.authorizationStatus() != .restricted
+            && SFSpeechRecognizer.self != nil
+            && SFSpeechRecognizer(locale: Locale.current) != nil
+        #else
+        return false
+        #endif
+    }
+
+    #if canImport(UIKit)
+    /// Current Speech framework authorization status, mapped to a simple enum the UI can switch on.
+    var authorization: AuthorizationState {
+        switch SFSpeechRecognizer.authorizationStatus() {
+        case .authorized: return .authorized
+        case .denied: return .denied
+        case .restricted: return .unavailable
+        case .notDetermined: return .notDetermined
+        @unknown default: return .unavailable
+        }
+    }
+    #else
+    var authorization: AuthorizationState { .unavailable }
+    #endif
+
+    /// Whether a recognition session is currently recording.
+    @Published private(set) var isRecording: Bool = false
+
+    /// The latest partial transcript (live, while recording).
+    @Published var partialTranscript: String = ""
+
+    /// A short human-readable status for the disabled-state tooltip (e.g. "On-device speech not
+    /// available for en-GB"). `nil` when voice is fully available.
+    @Published var statusMessage: String?
+
+    /// On-device support for the current locale. If `false`, voice is disabled rather than
+    /// falling back to server recognition (which would be raw-audio egress).
+    private static var localeSupportsOnDevice: Bool {
+        #if canImport(UIKit)
+        guard let recognizer = SFSpeechRecognizer(locale: Locale.current) else { return false }
+        return recognizer.supportsOnDeviceRecognition
+        #else
+        return false
+        #endif
+    }
+
+    /// True when voice can be used right now: supported, authorized, and locale supports on-device.
+    var canUseVoice: Bool {
+        guard Self.isSupported, authorization == .authorized, Self.localeSupportsOnDevice else {
+            return false
+        }
+        return true
+    }
+
+    /// Request Speech + Microphone authorization. Safe to call repeatedly; the system no-ops if
+    /// already decided. `completion` fires on the main actor.
+    func requestAuthorization(completion: @escaping (AuthorizationState) -> Void) {
+        #if canImport(UIKit)
+        // Speech auth first; mic auth piggybacks on the same prompt flow but is a separate grant.
+        SFSpeechRecognizer.requestAuthorization { speechStatus in
+            Task { @MainActor in
+                if speechStatus != .authorized {
+                    completion(self.mapSpeech(speechStatus))
+                    return
+                }
+                // Mic permission is requested lazily by AVAudioEngine on iOS — but we ask up front
+                // so the user sees one consolidated prompt and the button state is correct before
+                // the first tap.
+                self.requestMicPermission { micGranted in
+                    completion(micGranted ? .authorized : .denied)
+                }
+            }
+        }
+        #else
+        completion(.unavailable)
+        #endif
+    }
+
+    /// Begin a recognition session. `partial` is invoked on the main actor with the live transcript
+    /// as it streams in. No-op (calls `partial` with "") on macOS / unsupported locales.
+    func startTranscribing(partial: @escaping (String) -> Void) {
+        #if canImport(UIKit)
+        guard canUseVoice else {
+            statusMessage = Self.localeSupportsOnDevice
+                ? "Voice input unavailable. Check microphone permission in Settings."
+                : "On-device speech not available for \(Locale.current.identifier)."
+            return
+        }
+        stopTranscribing(completion: { _ in })
+        partialTranscript = ""
+        statusMessage = nil
+        beginSession(partial: partial)
+        #else
+        partial("")
+        #endif
+    }
+
+    /// Stop the active session and return the finalized transcript via `completion` (main actor).
+    func stopTranscribing(completion: @escaping (String) -> Void) {
+        #if canImport(UIKit)
+        guard isRecording else {
+            completion(partialTranscript)
+            return
+        }
+        finishSession(completion: completion)
+        #else
+        completion("")
+        #endif
+    }
+
+    // MARK: - Private (iOS only)
+
+    #if canImport(UIKit)
+    private var audioEngine: AVAudioEngine?
+    private var recognitionRequest: SFSpeechAudioBufferRecognitionRequest?
+    private var recognitionTask: SFSpeechRecognitionTask?
+
+    private func mapSpeech(_ status: SFSpeechRecognizerAuthorizationStatus) -> AuthorizationState {
+        switch status {
+        case .authorized: return .authorized
+        case .denied: return .denied
+        case .restricted: return .unavailable
+        case .notDetermined: return .notDetermined
+        @unknown default: return .unavailable
+        }
+    }
+
+    private func requestMicPermission(completion: @escaping (Bool) -> Void) {
+        let session = AVAudioSession.sharedInstance()
+        session.requestRecordPermission { granted in
+            Task { @MainActor in completion(granted) }
+        }
+    }
+
+    private func beginSession(partial: @escaping (String) -> Void) {
+        let audioEngine = AVAudioEngine()
+        self.audioEngine = audioEngine
+
+        let request = SFSpeechAudioBufferRecognitionRequest()
+        // K4 hard constraint: on-device ONLY. If the locale doesn't support it, voice is disabled
+        // upstream — but we set the flag defensively here too so a regression can't slip audio out.
+        request.requiresOnDeviceRecognition = true
+        request.shouldReportPartialResults = true
+        self.recognitionRequest = request
+
+        guard let recognizer = SFSpeechRecognizer(locale: Locale.current) else {
+            statusMessage = "On-device speech not available for \(Locale.current.identifier)."
+            return
+        }
+
+        let task = recognizer.recognitionTask(with: request) { [weak self] result, error in
+            Task { @MainActor in
+                guard let self else { return }
+                if let result {
+                    let text = result.bestTranscription.formattedString
+                    self.partialTranscript = text
+                    partial(text)
+                }
+                if error != nil || (result?.isFinal ?? false) {
+                    self.finishSession(completion: { _ in })
+                }
+            }
+        }
+        self.recognitionTask = task
+
+        do {
+            let session = AVAudioSession.sharedInstance()
+            try session.setCategory(.record, mode: .measurement, options: .duckOthers)
+            try session.setActive(true, options: .notifyOthersOnDeactivation)
+
+            let inputNode = audioEngine.inputNode
+            let recordingFormat = inputNode.outputFormat(forBus: 0)
+            inputNode.installTap(onBus: 0, bufferSize: 1024, format: recordingFormat) { buffer, _ in
+                request.append(buffer)
+            }
+
+            audioEngine.prepare()
+            try audioEngine.start()
+            isRecording = true
+        } catch {
+            statusMessage = "Couldn't start the microphone: \(error.localizedDescription)"
+            finishSession(completion: { _ in })
+        }
+    }
+
+    private func finishSession(completion: @escaping (String) -> Void) {
+        if let audioEngine {
+            audioEngine.stop()
+            audioEngine.inputNode.removeTap(onBus: 0)
+            self.audioEngine = nil
+        }
+        recognitionRequest?.endAudio()
+        recognitionRequest = nil
+        recognitionTask?.cancel()
+        recognitionTask = nil
+        try? AVAudioSession.sharedInstance().setActive(
+            false, options: .notifyOthersOnDeactivation
+        )
+        let final = partialTranscript
+        isRecording = false
+        completion(final)
+    }
+    #endif
+
+    /// Simplified authorization state the UI switches on (decoupled from SFSpeech symbols on macOS).
+    enum AuthorizationState {
+        case notDetermined
+        case authorized
+        case denied
+        case unavailable
+    }
+}
diff --git a/StrandiOS/App/RootTabView.swift b/StrandiOS/App/RootTabView.swift
index 45659fb502..943a49e484 100644
--- a/StrandiOS/App/RootTabView.swift
+++ b/StrandiOS/App/RootTabView.swift
@@ -42,12 +42,12 @@ struct RootTabView: View {
     /// root view alive, so an at-root re-tap keeps scroll position and never re-runs `.task`
     /// (#198; the #197 resetID/`.id()` rebuild reset both). Requires the tab roots' first-hop
     /// links to push `TabRoute`/`MoreDestination` VALUES — closure-destination links bypass the path.
-    @State private var tabPaths: [NavigationPath] = Array(repeating: NavigationPath(), count: 4)
+    @State private var tabPaths: [NavigationPath] = Array(repeating: NavigationPath(), count: 5)
     /// One scroll-to-top token per tab. Bumped when the user re-taps the active tab while it's ALREADY
     /// at its root — the other half of the iOS convention #197/#198 left unserved (an at-root re-tap was
     /// a no-op). Threaded into each tab's root via `\.scrollToTopSignal`; ScreenScaffold / LiquidTodayView
     /// scroll to their top anchor when their tab's token changes.
-    @State private var scrollTop: [Int] = Array(repeating: 0, count: 4)
+    @State private var scrollTop: [Int] = Array(repeating: 0, count: 5)
     /// Which More-tab groups are expanded (S2). Insights + Body stay open at rest; Data + App collapse to
     /// just their header until tapped. Persisted (#860 item 2): the user's open/closed choice must SURVIVE
     /// leaving and re-entering the More tab (and relaunch), not reset to the seed every visit. Backed by an
@@ -105,7 +105,7 @@ struct RootTabView: View {
                 guard selectedTab != 0 else { return }
                 let dx = v.translation.width, dy = v.translation.height
                 guard abs(dx) > 60, abs(dx) > abs(dy) * 1.6 else { return }
-                let next = min(3, max(0, selectedTab + (dx < 0 ? 1 : -1)))
+                let next = min(4, max(0, selectedTab + (dx < 0 ? 1 : -1)))
                 if next != selectedTab {
                     withAnimation(.timingCurve(0.22, 1, 0.36, 1, duration: 0.24)) { selectedTab = next }
                 }
@@ -120,7 +120,10 @@ struct RootTabView: View {
             tab(todayTabRoot, "Today", "square.grid.2x2", path: $tabPaths[0], scrollSignal: scrollTop[0]).tag(0)
             tab(TrendsView(), "Trends", "chart.line.uptrend.xyaxis", path: $tabPaths[1], scrollSignal: scrollTop[1]).tag(1)
             tab(SleepView(), "Sleep", "bed.double", path: $tabPaths[2], scrollSignal: scrollTop[2]).tag(2)
-            moreTab(path: $tabPaths[3], scrollSignal: scrollTop[3]).tag(3)
+            // K3: Coach promoted to a top-level tab (was behind the More list). The sparkles icon
+            // matches the More-tab row and the macOS sidebar entry.
+            tab(CoachView(), "Coach", "sparkles", path: $tabPaths[3], scrollSignal: scrollTop[3]).tag(3)
+            moreTab(path: $tabPaths[4], scrollSignal: scrollTop[4]).tag(4)
         }
         .tint(StrandPalette.accent)
         // #1841: the same "Hide bar when scrolling" preference Android drives its own bar with. Here the
@@ -186,6 +189,11 @@ struct RootTabView: View {
             case .insightsHub, .labBook, .fusedRecord, .rhythm:
                 routedPillar = dest
                 router.requestedDestination = nil
+            case .coach:
+                // K3: Coach is now a top-level tab (tag 3) — switch to it directly instead of
+                // presenting it as a pillar sheet.
+                withAnimation(.timingCurve(0.22, 1, 0.36, 1, duration: 0.24)) { selectedTab = 3 }
+                router.requestedDestination = nil
             case .trends:
                 // Trends is a primary tab on iPhone (not a pillar sheet) — switch to it.
                 withAnimation(.timingCurve(0.22, 1, 0.36, 1, duration: 0.24)) { selectedTab = 1 }
@@ -267,6 +275,8 @@ struct RootTabView: View {
                 case .fusedRecord: FusedRecordHost()
                 case .rhythm: RhythmHost(onClose: { routedPillar = nil })
                 case .devices: DevicesView()
+                // K5: the scheduled morning-brief notification's tap-through target.
+                case .coach: CoachView()
                 // .trends is never presented as a pillar sheet on iPhone (it's a primary tab — the
                 // requestedDestination handler switches `selectedTab` instead), but the switch must stay
                 // exhaustive. Fall back to Trends inside the sheet host if it ever arrives here.
@@ -409,7 +419,7 @@ struct RootTabView: View {
                 moreSection("Insights") {
                     MoreRow("What Moves You", "wand.and.sparkles", .insightsHub)
                     MoreRow("Intelligence", "brain.head.profile", .intelligence)
-                    MoreRow("Coach", "sparkles", .coach)
+                    // K3: Coach promoted to a top-level tab — no longer listed under More.
                     MoreRow("Insights", "lightbulb.fill", .insights)
                     MoreRow("Explore", "square.grid.2x2.fill", .explore)
                     MoreRow("Compare", "rectangle.split.2x1.fill", .compare)
diff --git a/StrandiOS/App/StrandiOSApp.swift b/StrandiOS/App/StrandiOSApp.swift
index 3505efbb17..8f49e8653c 100644
--- a/StrandiOS/App/StrandiOSApp.swift
+++ b/StrandiOS/App/StrandiOSApp.swift
@@ -23,7 +23,7 @@ struct StrandiOSApp: App {
     @StateObject private var watch = WatchSessionBridge()
     /// Shared cross-screen navigation hook (e.g. Live → Devices). The iOS shell (`RootTabView`)
     /// observes it and presents the Devices manager.
-    @StateObject private var router = NavRouter()
+    @StateObject private var router: NavRouter
     @State private var liveActivity = LiveActivityController()
     @Environment(\.scenePhase) private var scenePhase
     /// Appearance preference (System/Light/Dark). Default follows the OS; the Settings picker writes it.
@@ -66,6 +66,10 @@ struct StrandiOSApp: App {
         // is open, so a user testing the wind-down reminder with NOOP foregrounded sees nothing. Register
         // before the first scene so any early-fired notification is presented.
         UNUserNotificationCenter.current().delegate = NotificationPresenter.shared
+        // K5: tapping a scheduled morning-brief notification routes to Coach via the shared NavRouter.
+        let router = NavRouter()
+        _router = StateObject(wrappedValue: router)
+        NotificationPresenter.shared.onCoachBriefTapped = { [weak router] in router?.openCoach() }
         let model = AppModel()
         _model = StateObject(wrappedValue: model)
         // #1538: a strap offload completes while the app is BACKGROUNDED — it stays alive as a
@@ -289,7 +293,7 @@ struct StrandiOSApp: App {
         // safe no-op until the user opts in.
         .onChange(of: scenePhase) { _, phase in
             if phase == .active {
-                model.drainPendingIntents()
+                model.drainPendingIntents(router: router)
                 // Re-arm the strap's smart alarm on foreground: the firmware alarm is a single instant
                 // and iOS can't re-arm it while suspended, so it would otherwise fire once and stop.
                 model.applySmartAlarm()
diff --git a/StrandiOS/System/NOOPAppIntents.swift b/StrandiOS/System/NOOPAppIntents.swift
index ce0e847380..b14ec61f90 100644
--- a/StrandiOS/System/NOOPAppIntents.swift
+++ b/StrandiOS/System/NOOPAppIntents.swift
@@ -6,9 +6,12 @@ import AppIntents
 /// into the running `AppModel` directly (BLE only lives in the foreground app), so they enqueue here
 /// and the app drains the queue when it next becomes active.
 enum PendingIntents {
-    enum Action: String { case markMoment, buzz }
+    enum Action: String { case markMoment, buzz, askCoach }
 
     private static let key = "noop.pendingIntents"
+    /// K9: the question text for a pending `.askCoach` action. Stored separately because the
+    /// action queue encodes as `[String]` and a question can contain colons.
+    private static let coachQuestionKey = "noop.pendingCoachQuestion"
     private static var defaults: UserDefaults? { UserDefaults(suiteName: WidgetSnapshot.suiteName) }
 
     /// Optional `at` is the invocation time, captured now and consumed on drain. Encoded into the
@@ -22,6 +25,23 @@ enum PendingIntents {
         d.set(list, forKey: key)
     }
 
+    /// K9: queue an "Ask Coach" action with the associated question text. The question is stored
+    /// in a dedicated key (one pending question at a time — the user rarely queues multiple Siri
+    /// questions before the app opens).
+    static func appendAskCoach(question: String, at date: Date? = nil) {
+        guard let d = defaults else { return }
+        d.set(question, forKey: coachQuestionKey)
+        append(.askCoach, at: date)
+    }
+
+    /// K9: read and clear the pending coach question. Returns nil when no question is queued.
+    static func consumeCoachQuestion() -> String? {
+        guard let d = defaults else { return nil }
+        let q = d.string(forKey: coachQuestionKey)
+        d.removeObject(forKey: coachQuestionKey)
+        return q
+    }
+
     static func drain() -> [(action: Action, date: Date?)] {
         guard let d = defaults else { return [] }
         let raw = d.stringArray(forKey: key) ?? []
@@ -62,6 +82,24 @@ struct BuzzStrapIntent: AppIntent {
     }
 }
 
+/// K9: Ask the Coach a question via Siri. Queues the question and opens the app, which sends it
+/// to the configured provider and surfaces the response. The question is spoken or typed in Siri;
+/// the app handles the actual network call using the user's saved key.
+struct AskCoachIntent: AppIntent {
+    static var title: LocalizedStringResource = "Ask Coach"
+    static var description = IntentDescription("Ask your NOOP Coach a question about your recovery, sleep, or training.")
+    static var openAppWhenRun = true
+
+    /// The question to ask, populated by Siri from the user's spoken phrase.
+    @Parameter(title: "Question")
+    var question: String
+
+    func perform() async throws -> some IntentResult & ProvidesDialog {
+        PendingIntents.appendAskCoach(question: question, at: Date())
+        return .result(dialog: "Opening Coach with your question: \(question)")
+    }
+}
+
 /// Surfaces NOOP's intents to Siri, Spotlight, and the Shortcuts gallery without any user setup.
 struct NOOPShortcuts: AppShortcutsProvider {
     static var appShortcuts: [AppShortcut] {
@@ -73,6 +111,16 @@ struct NOOPShortcuts: AppShortcutsProvider {
                     phrases: ["Buzz my \(.applicationName) strap"],
                     shortTitle: "Buzz Strap",
                     systemImageName: "waveform.path")
+        // K9: "Ask Coach" via Siri — opens Coach with the question and sends it. The question
+        // parameter is provided via the Shortcuts app or Siri prompts for it when the phrase fires.
+        AppShortcut(intent: AskCoachIntent(),
+                    phrases: [
+                        "Ask \(.applicationName) about my recovery",
+                        "Ask \(.applicationName) how I'm doing",
+                        "Ask \(.applicationName) Coach",
+                    ],
+                    shortTitle: "Ask Coach",
+                    systemImageName: "sparkles")
     }
 }
 #endif
diff --git a/StrandiOSWidgets/CoachBriefWidget.swift b/StrandiOSWidgets/CoachBriefWidget.swift
new file mode 100644
index 0000000000..a3fa59b298
--- /dev/null
+++ b/StrandiOSWidgets/CoachBriefWidget.swift
@@ -0,0 +1,183 @@
+import WidgetKit
+import SwiftUI
+import StrandDesign
+
+/// K10: A Lock Screen / Home Screen widget showing the stored Coach morning brief.
+///
+/// Design contract (see PRD-K10 + D8):
+/// - The widget reads **stored** brief text from the App Group — it NEVER calls the network.
+///   The brief is generated on a schedule by `CoachBriefScheduler` (K5) and mirrored into the
+///   App Group via `publishToWidget`. The widget just displays whatever text is there.
+/// - Tap → opens the Coach tab (via the app's URL scheme / deeplink).
+/// - Supported families: `accessoryRectangular` (Lock Screen), `systemSmall` (Home Screen).
+///   The Lock Screen accessory shows the first line; the Home Screen widget shows more.
+struct CoachBriefEntry: TimelineEntry {
+    let date: Date
+    let briefText: String?
+    let briefDate: Date?
+}
+
+struct CoachBriefProvider: TimelineProvider {
+    /// App Group keys — must match `CoachBriefScheduler.K.widgetBriefKey` / `.widgetBriefDateKey`.
+    private static let briefKey = "coachBrief.widgetText"
+    private static let briefDateKey = "coachBrief.widgetDate"
+
+    func placeholder(in context: Context) -> CoachBriefEntry {
+        CoachBriefEntry(
+            date: Date(),
+            briefText: "Recovery is strong today — consider a higher-intensity session this afternoon.",
+            briefDate: Date()
+        )
+    }
+
+    func getSnapshot(in context: Context, completion: @escaping (CoachBriefEntry) -> Void) {
+        let entry = loadEntry()
+        completion(entry)
+    }
+
+    func getTimeline(in context: Context, completion: @escaping (Timeline<CoachBriefEntry>) -> Void) {
+        let entry = loadEntry()
+        // Refresh every 30 minutes — the app pushes a reload via WidgetCenter when a new brief is
+        // published, so this is just a safety net for when the app isn't running.
+        let next = Calendar.current.date(byAdding: .minute, value: 30, to: Date())
+            ?? Date().addingTimeInterval(1800)
+        completion(Timeline(entries: [entry], policy: .after(next)))
+    }
+
+    private func loadEntry() -> CoachBriefEntry {
+        let defaults = UserDefaults(suiteName: WidgetSnapshot.suiteName)
+        let text = defaults?.string(forKey: CoachBriefProvider.briefKey)
+        let date = defaults?.object(forKey: CoachBriefProvider.briefDateKey) as? Date
+        return CoachBriefEntry(date: Date(), briefText: text, briefDate: date)
+    }
+}
+
+struct CoachBriefWidgetView: View {
+    @Environment(\.widgetFamily) private var family
+    let entry: CoachBriefEntry
+
+    var body: some View {
+        switch family {
+        case .accessoryRectangular:
+            rectangular
+        case .accessoryInline:
+            inline
+        default:
+            small
+        }
+    }
+
+    // MARK: - Lock Screen: accessoryRectangular
+
+    private var rectangular: some View {
+        VStack(alignment: .leading, spacing: 2) {
+            HStack(spacing: 4) {
+                Image(systemName: "sparkles")
+                    .font(.system(size: 10, weight: .bold))
+                    .foregroundStyle(StrandPalette.accent)
+                Text("Coach")
+                    .font(.system(size: 11, weight: .bold))
+                    .foregroundStyle(StrandPalette.textSecondary)
+                Spacer(minLength: 0)
+                if let date = entry.briefDate {
+                    Text(date, style: .time)
+                        .font(.caption2)
+                        .foregroundStyle(StrandPalette.textTertiary)
+                }
+            }
+            Text(briefDisplay)
+                .font(.system(size: 11))
+                .foregroundStyle(StrandPalette.textPrimary)
+                .lineLimit(3)
+                .minimumScaleFactor(0.8)
+        }
+    }
+
+    // MARK: - Lock Screen: accessoryInline
+
+    private var inline: some View {
+        Text(briefOneLine)
+    }
+
+    // MARK: - Home Screen: systemSmall
+
+    private var small: some View {
+        VStack(alignment: .leading, spacing: 8) {
+            HStack(spacing: 6) {
+                Image(systemName: "sparkles")
+                    .font(.system(size: 13, weight: .bold))
+                    .foregroundStyle(StrandPalette.accent)
+                Text("Coach Brief")
+                    .font(.system(size: 13, weight: .bold))
+                    .foregroundStyle(StrandPalette.textSecondary)
+                Spacer()
+            }
+            if entry.briefText == nil {
+                VStack(alignment: .leading, spacing: 4) {
+                    Text("No brief yet")
+                        .font(.system(size: 14, weight: .medium))
+                        .foregroundStyle(StrandPalette.textTertiary)
+                    Text("Enable Morning Brief in Coach settings to see today's readiness here.")
+                        .font(.system(size: 11))
+                        .foregroundStyle(StrandPalette.textTertiary)
+                        .fixedSize(horizontal: false, vertical: true)
+                }
+            } else {
+                Text(briefDisplay)
+                    .font(.system(size: 12))
+                    .foregroundStyle(StrandPalette.textPrimary)
+                    .lineLimit(5)
+                    .minimumScaleFactor(0.8)
+            }
+            Spacer(minLength: 0)
+            if let date = entry.briefDate {
+                Text(date, format: .dateTime.hour().minute())
+                    .font(.caption2)
+                    .foregroundStyle(StrandPalette.textTertiary)
+            }
+        }
+        .padding(12)
+    }
+
+    // MARK: - Text helpers
+
+    /// The full brief text for the widget body, or a placeholder when there's no brief.
+    private var briefDisplay: String {
+        entry.briefText ?? "No brief available."
+    }
+
+    /// One-line summary for the inline accessory (capped at ~100 chars).
+    private var briefOneLine: String {
+        guard let text = entry.briefText else { return "Coach: no brief yet" }
+        let firstLine = text.split(separator: "\n", omittingEmptySubsequences: true)
+            .first.map(String.init) ?? text
+        let trimmed = firstLine.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard trimmed.count > 100 else { return "Coach: \(trimmed)" }
+        let cut = trimmed.index(trimmed.startIndex, offsetBy: 100)
+        return "Coach: \(trimmed[..<cut].trimmingCharacters(in: .whitespaces))…"
+    }
+}
+
+struct CoachBriefWidget: Widget {
+    static let kind = "CoachBriefWidget"
+
+    var body: some WidgetConfiguration {
+        StaticConfiguration(kind: Self.kind, provider: CoachBriefProvider()) { entry in
+            if #available(iOS 17.0, *) {
+                CoachBriefWidgetView(entry: entry)
+                    .containerBackground(StrandPalette.surfaceBase, for: .widget)
+            } else {
+                CoachBriefWidgetView(entry: entry)
+                    .padding()
+                    .background(StrandPalette.surfaceBase)
+            }
+        }
+        .configurationDisplayName("Coach Brief")
+        .description("Today's coaching brief at a glance. Tap to open Coach.")
+        .supportedFamilies([
+            .systemSmall,
+            .accessoryRectangular,
+            .accessoryInline,
+        ])
+    }
+}
diff --git a/StrandiOSWidgets/NOOPWidgetBundle.swift b/StrandiOSWidgets/NOOPWidgetBundle.swift
index d1a12cf054..647ea217fa 100644
--- a/StrandiOSWidgets/NOOPWidgetBundle.swift
+++ b/StrandiOSWidgets/NOOPWidgetBundle.swift
@@ -1,11 +1,13 @@
 import WidgetKit
 import SwiftUI
 
-/// The widget extension entry point. Bundles the glanceable widget and the live-HR Live Activity.
+/// The widget extension entry point. Bundles the glanceable widget, the live-HR Live Activity,
+/// and the K10 Coach brief widget (stored morning brief on Lock Screen / Home Screen).
 @main
 struct NOOPWidgetBundle: WidgetBundle {
     var body: some Widget {
         NOOPWidget()
         NOOPLiveActivity()
+        CoachBriefWidget()
     }
 }
diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index 1cbb833bd1..603b9fe0ba 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -61,6 +61,14 @@
          request READ_CALL_LOG and never reads incoming numbers, contacts, or call history. -->
     <uses-permission android:name="android.permission.READ_PHONE_STATE" />
 
+    <!-- K4: Coach voice input. The on-device SpeechRecognizer transcribes the user's spoken
+         question locally; only the resulting TEXT ever reaches the AI provider (via the same
+         channel a typed question uses). Requested at runtime, only when the user taps the mic
+         button in the Coach composer. No audio leaves the device. -->
+    <uses-permission android:name="android.permission.RECORD_AUDIO" />
+    <!-- K14: haptic feedback (vibration) when a Coach reply arrives. -->
+    <uses-permission android:name="android.permission.VIBRATE" />
+
     <!-- Smart alarm (#207). The guaranteed wake is an exact OS alarm scheduled via AlarmManager,
          independent of Bluetooth and the app being alive. SCHEDULE_EXACT_ALARM (API 31-32) is
          requested at runtime from the alarm screen; USE_EXACT_ALARM (API 33+) is the alarm-clock
@@ -277,6 +285,20 @@
                 android:resource="@xml/noop_compact_widget_info" />
         </receiver>
 
+        <!-- K10: Coach brief home-screen widget. Shows the stored morning brief (generated on a
+             schedule by CoachBriefScheduler, K5) — never live-networked. Tap → opens the app. -->
+        <receiver
+            android:name="com.noop.widget.CoachBriefWidgetReceiver"
+            android:exported="true"
+            android:label="Coach Brief">
+            <intent-filter>
+                <action android:name="android.appwidget.action.APPWIDGET_UPDATE" />
+            </intent-filter>
+            <meta-data
+                android:name="android.appwidget.provider"
+                android:resource="@xml/coach_brief_widget_info" />
+        </receiver>
+
         <!-- Optional native phone-call alerts. The receiver only reacts to ringing/offhook/idle state
              and never reads the incoming-number extra. Delivery is gated by the Notifications screen
              settings and by the just-in-time READ_PHONE_STATE runtime permission. -->
diff --git a/android/app/src/main/java/com/noop/ai/AiCoach.kt b/android/app/src/main/java/com/noop/ai/AiCoach.kt
index 86b0c3cc5f..beb19e1bfd 100644
--- a/android/app/src/main/java/com/noop/ai/AiCoach.kt
+++ b/android/app/src/main/java/com/noop/ai/AiCoach.kt
@@ -1,9 +1,12 @@
 package com.noop.ai
 
 import android.content.Context
+import com.noop.analytics.CoachSuggestions
 import com.noop.analytics.EffectRanker
 import com.noop.analytics.LabMarkerCategory
 import com.noop.analytics.MarkerCatalog
+import com.noop.analytics.SseDeltas
+import com.noop.analytics.SseProvider
 import com.noop.analytics.StressIndex
 import com.noop.data.DailyMetric
 import com.noop.data.JournalEntry
@@ -50,6 +53,10 @@ class AiCoach(
      *  [activeStrapId]. */
     private val deviceId = "my-whoop"
 
+    // K13: cached summary of the dropped middle turns, regenerated when the dropped set changes.
+    @Volatile private var droppedSummary: String? = null
+    @Volatile private var droppedSummaryKey: List<String> = emptyList()
+
     /** The source id native (in-app) journal answers are stored under (matches the UI's
      *  JOURNAL_DEVICE_ID); used for the opt-in on-device-signals context only. */
     private val journalDeviceId = "noop-journal"
@@ -127,28 +134,94 @@ class AiCoach(
         // Slide a window over a long conversation so the history can't crowd out the reply on a
         // small local context window (e.g. Ollama's 2048-token default). The first user turn carries
         // the data context, so it is always kept; the middle is dropped, the recent tail retained.
+        // K13: summarize the dropped middle so the model retains context continuity (best-effort).
         val grounded = trimmedHistory(groundedFull, MAX_HISTORY_TURNS)
+        val groundedWithSummary = injectDroppedSummary(grounded, groundedFull)
 
         when (provider) {
             AiProvider.OPENAI ->
-                callOpenAiCompatible(provider, provider.endpoint, model, key, grounded, systemPrompt)
+                callOpenAiCompatible(provider, provider.endpoint, model, key, groundedWithSummary, systemPrompt)
             AiProvider.ANTHROPIC ->
-                callAnthropic(provider, model, key!!, grounded, systemPrompt)
+                callAnthropic(provider, model, key!!, groundedWithSummary, systemPrompt)
             AiProvider.GEMINI ->
-                callGemini(provider, model, key!!, grounded, systemPrompt)
+                callGemini(provider, model, key!!, groundedWithSummary, systemPrompt)
             AiProvider.CUSTOM ->
                 callOpenAiCompatible(
                     provider,
                     customChatUrl(customBaseUrl),
                     model,
                     key,
-                    grounded,
+                    groundedWithSummary,
                     systemPrompt,
                     customAuthHeader,
                 )
         }
     }
 
+    /**
+     * K1: Stream the conversation to [provider] using [model], calling [onDelta] for each text
+     * chunk as it arrives. Same context injection, consent gating, and error mapping as [chat];
+     * streaming changes transport, not payload. The concatenated deltas are byte-identical to
+     * what [chat] would return (parity pin in `SseDeltasTest`). Runs on [Dispatchers.IO].
+     *
+     * On error mid-stream, throws — the caller keeps the partial text and appends an interrupted
+     * marker. Never crashes; the ViewModel maps exceptions to a visible error.
+     */
+    suspend fun chatStream(
+        ctx: Context,
+        history: List<ChatMsg>,
+        provider: AiProvider,
+        model: String,
+        consent: Boolean = false,
+        customBaseUrl: String = "",
+        customAuthHeader: CustomAiAuthHeader = CustomAiAuthHeader.BEARER,
+        includeSignals: Boolean = false,
+        onDelta: (String) -> Unit,
+    ): Unit = withContext(Dispatchers.IO) {
+        val key = AiKeyStore.read(ctx, provider)
+        if (key == null && provider != AiProvider.CUSTOM) {
+            throw Exception("No API key set. Add your ${provider.displayName} key to use the coach.")
+        }
+        if (provider == AiProvider.CUSTOM) {
+            require(customBaseUrl.isNotBlank()) { "Set your server URL first." }
+            require(model.isNotBlank()) { "Pick a model your server serves." }
+        }
+
+        require(history.isNotEmpty()) { "Ask a question first." }
+        require(history.last().role == "user") { "The last message must be your question." }
+
+        val groundedFull = if (consent) {
+            val days = runCatching { repo.daysMerged(activeStrapId()) }.getOrDefault(emptyList())
+            val stress = runCatching { stressLineToday() }.getOrNull()
+            val signals = if (includeSignals) runCatching { buildSignalsContext() }.getOrNull() else null
+            val full = buildString {
+                append(buildContext(days))
+                if (!stress.isNullOrBlank()) append("\n\n").append(stress)
+                if (!signals.isNullOrBlank()) append("\n\n").append(signals)
+            }
+            injectContext(history, full)
+        } else {
+            injectContext(history, NO_CONSENT_NOTE)
+        }
+
+        val systemPrompt = resolveSystemPrompt(ctx)
+        val grounded = trimmedHistory(groundedFull, MAX_HISTORY_TURNS)
+        val groundedWithSummary = injectDroppedSummary(grounded, groundedFull)
+
+        when (provider) {
+            AiProvider.OPENAI ->
+                callOpenAiCompatibleStream(provider, provider.endpoint, model, key, groundedWithSummary, systemPrompt, onDelta)
+            AiProvider.ANTHROPIC ->
+                callAnthropicStream(provider, model, key!!, groundedWithSummary, systemPrompt, onDelta)
+            AiProvider.GEMINI ->
+                callGeminiStream(provider, model, key!!, groundedWithSummary, systemPrompt, onDelta)
+            AiProvider.CUSTOM ->
+                callOpenAiCompatibleStream(
+                    provider, customChatUrl(customBaseUrl), model, key, groundedWithSummary, systemPrompt, onDelta, customAuthHeader,
+                )
+        }
+    }
+
     /**
      * Today's derived stress line for the consent-gated coach context. Reads R-R for the local day
      * via [WhoopRepository.rrIntervalsUnion] (the SAME path StressScreen uses) and summarises it with the
@@ -221,6 +294,85 @@ class AiCoach(
         }.getOrDefault(emptyList())
     }
 
+    // ---------------------------------------------------------------------------------------
+    // K5: scheduled morning-brief generation (headless, no chat UI involved)
+    // ---------------------------------------------------------------------------------------
+
+    /**
+     * K5: generate today's coaching brief with NO chat transcript involved — used by the scheduled
+     * morning-brief notification ([com.noop.notif.CoachBriefWorker]), which runs headless (no
+     * Activity/ViewModel) and must not touch [CoachViewModel]'s in-memory messages. Non-streaming (a
+     * WorkManager worker has no UI to stream into). Triple-gated: a saved key (or a committed Custom
+     * server), [consent], and the brief instruction shared with the Swift twin. Returns null on any
+     * failure (no key, no consent, network, rate limit, empty reply) — the caller treats null as
+     * "brief unavailable"; never throws.
+     */
+    suspend fun generateBrief(
+        ctx: Context,
+        provider: AiProvider,
+        model: String,
+        consent: Boolean,
+        customBaseUrl: String = "",
+        customAuthHeader: CustomAiAuthHeader = CustomAiAuthHeader.BEARER,
+        includeSignals: Boolean = false,
+    ): String? {
+        if (!consent) return null
+        val key = AiKeyStore.read(ctx, provider)
+        if (key == null && provider != AiProvider.CUSTOM) return null
+        if (provider == AiProvider.CUSTOM && (customBaseUrl.isBlank() || model.isBlank())) return null
+        return runCatching {
+            val history = listOf(ChatMsg(role = "user", text = BRIEF_INSTRUCTION))
+            chat(ctx, history, provider, model, consent, customBaseUrl, customAuthHeader, includeSignals)
+                .trim()
+                .ifBlank { null }
+        }.getOrNull()
+    }
+
+    // ---------------------------------------------------------------------------------------
+    // Contextual suggestion chips
+    // ---------------------------------------------------------------------------------------
+
+    /**
+     * Contextual suggestion chips for the composer, derived from today's bands via
+     * [CoachSuggestions]. Reads only on-device `daysMerged` (the same merged read the context
+     * builder uses, so a live strap's scores under "my-whoop-noop" are not missed); pure,
+     * byte-identical to the Swift twin `AICoachEngine.suggestions`. Returns the stable generic
+     * fallback when there is no usable data. Best-effort: a repo failure yields the fallback,
+     * never throws.
+     */
+    suspend fun suggestions(): List<String> = withContext(Dispatchers.IO) {
+        val days = runCatching { repo.daysMerged(activeStrapId()) }.getOrDefault(emptyList())
+        CoachSuggestions.suggestions(days.lastOrNull(), days)
+    }
+
+    // K7: Follow-up suggestion chips shown after each assistant reply. These are generic
+    // conversational follow-ups (not data-derived) so the user can dig deeper without typing.
+    // Byte-identical to the Swift twin's `AICoachEngine.followUpSuggestions`.
+    val followUpSuggestions: List<String> = listOf(
+        "Tell me more about that",
+        "What should I do next?",
+        "How does today compare to this week?",
+        "Give me a specific action plan",
+    )
+
+    // K13: Inject the cached summary of the dropped middle into the first user turn of the
+    // windowed history, so the model sees continuity instead of a gap. Best-effort: when no
+    // summary is cached, returns the windowed list unchanged (the old gap behaviour).
+    private fun injectDroppedSummary(
+        windowed: List<ChatMsg>,
+        full: List<ChatMsg>,
+    ): List<ChatMsg> {
+        val summary = droppedSummary ?: return windowed
+        if (windowed.isEmpty()) return windowed
+        // Only inject when the window actually dropped messages (the full list is longer).
+        if (full.size <= MAX_HISTORY_TURNS + 1) return windowed
+        val firstUserIdx = windowed.indexOfFirst { it.role == "user" }
+        if (firstUserIdx < 0) return windowed
+        val first = windowed[firstUserIdx]
+        val annotated = first.copy(text = "$summary\n\n---\n\n${first.text}")
+        return windowed.toMutableList().also { it[firstUserIdx] = annotated }
+    }
+
     // ---------------------------------------------------------------------------------------
     // Context builder
     // ---------------------------------------------------------------------------------------
@@ -665,6 +817,151 @@ class AiCoach(
         return reply
     }
 
+    // ---------------------------------------------------------------------------------------
+    // K1: Streaming provider calls (SSE via OkHttp BufferedSource)
+    // ---------------------------------------------------------------------------------------
+
+    /** Stream an OpenAI-compatible chat (OpenAI + Custom). Same body as [callOpenAiCompatible]'s
+     *  standard-params path, with `stream: true`. SSE parsed via [SseDeltas.openAiDelta]. */
+    private fun callOpenAiCompatibleStream(
+        provider: AiProvider,
+        url: String,
+        model: String,
+        key: String?,
+        history: List<ChatMsg>,
+        systemPrompt: String,
+        onDelta: (String) -> Unit,
+        customAuthHeader: CustomAiAuthHeader = CustomAiAuthHeader.BEARER,
+    ) {
+        val messages = JSONArray()
+        messages.put(JSONObject().put("role", "system").put("content", systemPrompt))
+        for (m in history) messages.put(JSONObject().put("role", m.role).put("content", m.text))
+
+        val body = JSONObject()
+            .put("model", model)
+            .put("messages", messages)
+            .put("temperature", 0.6)
+            .put("max_tokens", 4096)
+            .put("stream", true)
+            .toString()
+
+        val builder = Request.Builder().url(url).addHeader("Content-Type", "application/json")
+            .post(body.toRequestBody(JSON))
+        when (provider) {
+            AiProvider.CUSTOM -> applyCustomAuthHeader(builder, key, customAuthHeader)
+            else -> if (!key.isNullOrBlank()) builder.addHeader("Authorization", "Bearer $key")
+        }
+        executeStreaming(builder.build(), provider, onDelta) { payload -> SseDeltas.openAiDelta(payload) }
+    }
+
+    /** Stream an Anthropic chat. Same body as [callAnthropic], with `stream: true`. SSE parsed
+     *  via [SseDeltas.anthropicDelta]. */
+    private fun callAnthropicStream(
+        provider: AiProvider,
+        model: String,
+        key: String,
+        history: List<ChatMsg>,
+        systemPrompt: String,
+        onDelta: (String) -> Unit,
+    ) {
+        val messages = JSONArray()
+        for (m in history) messages.put(JSONObject().put("role", m.role).put("content", m.text))
+
+        val body = JSONObject()
+            .put("model", model)
+            .put("max_tokens", 4096)
+            .put("system", systemPrompt)
+            .put("messages", messages)
+            .put("stream", true)
+            .toString()
+
+        val request = Request.Builder().url(provider.endpoint)
+            .addHeader("x-api-key", key)
+            .addHeader("anthropic-version", "2023-06-01")
+            .addHeader("content-type", "application/json")
+            .post(body.toRequestBody(JSON))
+            .build()
+
+        executeStreaming(request, provider, onDelta) { payload -> SseDeltas.anthropicDelta(payload) }
+    }
+
+    /** Stream a Gemini chat via `:streamGenerateContent?alt=sse`. Same body as [callGemini].
+     *  SSE parsed via [SseDeltas.geminiDelta]. */
+    private fun callGeminiStream(
+        provider: AiProvider,
+        model: String,
+        key: String,
+        history: List<ChatMsg>,
+        systemPrompt: String,
+        onDelta: (String) -> Unit,
+    ) {
+        val contents = JSONArray()
+        for (m in history) {
+            contents.put(
+                JSONObject()
+                    .put("role", if (m.role == "assistant") "model" else "user")
+                    .put("parts", JSONArray().put(JSONObject().put("text", m.text))),
+            )
+        }
+
+        val body = JSONObject()
+            .put("system_instruction", JSONObject().put("parts", JSONArray().put(JSONObject().put("text", systemPrompt))))
+            .put("contents", contents)
+            .put("generationConfig", JSONObject().put("temperature", 0.6).put("maxOutputTokens", 4096))
+            .toString()
+
+        val request = Request.Builder()
+            .url("${provider.endpoint}/$model:streamGenerateContent?alt=sse")
+            .addHeader("x-goog-api-key", key)
+            .addHeader("content-type", "application/json")
+            .post(body.toRequestBody(JSON))
+            .build()
+
+        executeStreaming(request, provider, onDelta) { payload -> SseDeltas.geminiDelta(payload) }
+    }
+
+    /** Execute a streaming SSE request, reading the body line-by-line. For each `data:` payload
+     *  line, calls [extractDelta] to get the text chunk and passes it to [onDelta]. Same HTTP
+     *  error mapping as [execute]. K1. */
+    private fun executeStreaming(
+        request: Request,
+        provider: AiProvider,
+        onDelta: (String) -> Unit,
+        extractDelta: (String) -> String?,
+    ) {
+        try {
+            http.newCall(request).execute().use { resp ->
+                if (resp.code !in 200..299) {
+                    val body = resp.body?.string().orEmpty()
+                    throw httpError(provider, resp.code, body)
+                }
+                val source = resp.body?.source()
+                    ?: throw Exception("The provider returned an empty streaming response.")
+                while (!source.exhausted()) {
+                    val line = source.readUtf8Line() ?: break
+                    val payload = SseDeltas.dataPayload(fromLine = line) ?: continue
+                    val delta = extractDelta(payload) ?: continue
+                    onDelta(delta)
+                }
+            }
+        } catch (e: java.net.UnknownHostException) {
+            throw Exception("No internet connection. The coach needs a connection to reach the provider.")
+        } catch (e: java.net.SocketTimeoutException) {
+            throw Exception("The request timed out. Please check your connection and try again.")
+        } catch (e: javax.net.ssl.SSLException) {
+            throw Exception("A secure connection to the provider could not be established.")
+        } catch (e: java.io.IOException) {
+            val msg = e.message.orEmpty()
+            if (msg.contains("Cleartext", ignoreCase = true) && msg.contains("not permitted", ignoreCase = true)) {
+                throw Exception(
+                    "Plain http:// is blocked for that host. Use localhost, 127.0.0.1, 10.0.2.2, " +
+                        "a .local hostname, or switch the server to https://."
+                )
+            }
+            throw Exception(msg.ifBlank { "A network error occurred while streaming the reply." })
+        }
+    }
+
     // ---------------------------------------------------------------------------------------
     // HTTP / error plumbing
     // ---------------------------------------------------------------------------------------
@@ -958,6 +1255,16 @@ class AiCoach(
             "NOTE: The user has not granted access to their biometric data. Coach generally and " +
                 "encourage them to enable \"Let the coach use my data\" for tailored guidance."
 
+        /**
+         * K5: the brief instruction shared by [generateBrief] (headless, scheduled) — byte-identical to
+         * the Swift twin's `AICoachEngine.briefInstruction` so a brief reads the same on both platforms.
+         */
+        const val BRIEF_INSTRUCTION =
+            "Based on the data above, give me TODAY'S coaching brief in three short parts: " +
+                "(1) my readiness in one line, citing charge, HRV and rest; " +
+                "(2) exactly what training to do today and what to avoid; " +
+                "(3) one specific thing to improve my charge. Be punchy and motivating."
+
         /**
          * The system prompt actually sent: the user's edited override from [NoopPrefs] when it is
          * non-blank, otherwise [DEFAULT_SYSTEM_PROMPT]. Read fresh per request so an edit in the Coach
diff --git a/android/app/src/main/java/com/noop/ai/ChatMsg.kt b/android/app/src/main/java/com/noop/ai/ChatMsg.kt
index a7fd698aeb..2e976eb623 100644
--- a/android/app/src/main/java/com/noop/ai/ChatMsg.kt
+++ b/android/app/src/main/java/com/noop/ai/ChatMsg.kt
@@ -3,11 +3,15 @@ package com.noop.ai
 /**
  * One turn in the coach conversation.
  *
+ * @param id stable identifier (UUID string). Used by K1 streaming to find and replace the
+ *   placeholder assistant message as chunks arrive. Defaults to a new UUID so existing callers
+ *   are unaffected.
  * @param role "user" or "assistant" — the only two roles the UI history carries. The
  *   system prompt is supplied separately by [AiCoach] and is never stored here.
  * @param text plain-text message body.
  */
 data class ChatMsg(
+    val id: String = java.util.UUID.randomUUID().toString(),
     val role: String, // "user" | "assistant"
     val text: String,
 )
diff --git a/android/app/src/main/java/com/noop/analytics/CoachSuggestions.kt b/android/app/src/main/java/com/noop/analytics/CoachSuggestions.kt
new file mode 100644
index 0000000000..26525b477e
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/CoachSuggestions.kt
@@ -0,0 +1,100 @@
+package com.noop.analytics
+
+import com.noop.data.DailyMetric
+
+// CoachSuggestions.kt — contextual coaching prompt chips derived from the user's own bands.
+//
+// Pure + deterministic so it is unit-testable without a strap, network, or device, and so the
+// output is byte-identical to the Swift twin `StrandAnalytics.CoachSuggestions` (the cross-platform
+// parity contract: the same inputs produce the same chip strings on both platforms). Reads only
+// DailyMetric fields that already live on-device; no new egress, no telemetry.
+
+object CoachSuggestions {
+
+    /** The stable generic set used when there is no usable data for today. Byte-identical to the
+     *  Swift `fallback` list. */
+    val fallback: List<String> = listOf(
+        "How's my recovery trending this week?",
+        "What should today's training look like?",
+        "Analyse my sleep",
+        "Why am I run down?",
+    )
+
+    /** A stable generic prompt always appended as the last chip so there is a consistent entry point
+     *  even when the contextual chips already cover the user's situation. */
+    private const val stableGeneric = "Analyse my sleep"
+
+    // Charge band cutoffs (mirror the autoregulation bands in the coach system prompt).
+    private const val CHARGE_RED_CUTOFF = 34.0
+    private const val CHARGE_GREEN_CUTOFF = 67.0
+    /** HRV "trending down": today's HRV below 85% of the trailing-30-day baseline (excluding today). */
+    private const val HRV_DOWN_RATIO = 0.85
+    /** Sleep "poor night": under 6h (360 min). */
+    private const val POOR_SLEEP_MIN = 360.0
+    /** "Already loaded" strain: a day strain at/above 14 reads as a high-load day. */
+    private const val HIGH_STRAIN = 14.0
+    /** Max chips surfaced. */
+    private const val MAX_CHIPS = 4
+
+    /**
+     * Build 2–4 contextual prompt chips from today's bands, falling back to [fallback] when there is
+     * no usable data. [recent] is oldest→newest and is used for the trailing-30-day HRV baseline.
+     *
+     * Byte-twin of `StrandAnalytics.CoachSuggestions.suggestions(for:recent:)`. If you change a chip
+     * string here, change it in the Swift twin in the same PR.
+     */
+    fun suggestions(today: DailyMetric?, recent: List<DailyMetric>): List<String> {
+        if (today == null) return fallback
+        val charge = today.recovery
+        val hrv = today.avgHrv
+        val sleep = today.totalSleepMin
+        val strain = today.strain
+        // No usable signal at all → generic fallback.
+        if (charge == null && hrv == null && sleep == null && strain == null) return fallback
+
+        val chips = mutableListOf<String>()
+
+        // 1. Charge band → one readiness prescription chip.
+        if (charge != null) {
+            chips += when {
+                charge < CHARGE_RED_CUTOFF -> "Active recovery only today — what should I do?"
+                charge < CHARGE_GREEN_CUTOFF -> "Quality over volume today — plan my session"
+                else -> "Green light — how hard can I push today?"
+            }
+        }
+
+        // 2. HRV trending down vs trailing-30-day baseline (excluding today).
+        if (hrv != null) {
+            val baseline = hrvBaseline(recent, excluding = today.day)
+            if (baseline != null && baseline > 0 && hrv < HRV_DOWN_RATIO * baseline) {
+                chips += "Why is my HRV trending down?"
+            }
+        }
+
+        // 3. Poor sleep (< 6h).
+        if (sleep != null && sleep < POOR_SLEEP_MIN) {
+            chips += "I slept poorly — how do I recover today?"
+        }
+
+        // 4. Already a high-strain day.
+        if (strain != null && strain >= HIGH_STRAIN) {
+            chips += "Have I done enough today, or push more?"
+        }
+
+        // Signals present but none of the band conditions fired → generic fallback (avoids a lone
+        // stable chip when there's nothing contextual to say).
+        if (chips.isEmpty()) return fallback
+        // Cap the CONTEXTUAL chips at MAX_CHIPS−1 so the stable generic always survives as the last
+        // chip (a consistent entry point), then append it. Total never exceeds MAX_CHIPS.
+        return chips.take(MAX_CHIPS - 1) + stableGeneric
+    }
+
+    /** Mean of [avgHrv] over the trailing 30 days of [recent], excluding [excludingDay].
+     *  Returns null when no qualifying night has an HRV value. Pure; byte-twin of the Swift helper. */
+    private fun hrvBaseline(recent: List<DailyMetric>, excluding: String): Double? {
+        val values = recent.takeLast(30).filter { it.day != excluding }
+            .mapNotNull { it.avgHrv }
+        if (values.isEmpty()) return null
+        return values.sum() / values.size
+    }
+}
diff --git a/android/app/src/main/java/com/noop/analytics/SseDeltas.kt b/android/app/src/main/java/com/noop/analytics/SseDeltas.kt
new file mode 100644
index 0000000000..c5e0d86b71
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/SseDeltas.kt
@@ -0,0 +1,114 @@
+package com.noop.analytics
+
+import org.json.JSONArray
+import org.json.JSONObject
+
+// SseDeltas.kt — pure SSE delta parsing for AI provider streaming.
+//
+// The verifiable core of K1 (streaming): given one SSE `data:` payload, extract the text delta
+// for the provider's wire shape. Pure + deterministic so it is unit-testable without a network,
+// and byte-identical to the Swift twin `StrandAnalytics.SseDeltas`. The streaming HTTP glue
+// (OkHttp source / URLSession.bytes) is thin and calls into these pure functions per line.
+//
+// No network, no I/O — only org.json (Android core). The anonymity / no-raw-egress posture is
+// unchanged: streaming changes transport, not payload.
+
+object SseDeltas {
+
+    /** The SSE stream terminator sent by OpenAI-compatible servers. */
+    const val DONE_MARKER = "[DONE]"
+
+    // MARK: - SSE line splitting
+
+    /** Strip the `data: ` prefix from one SSE line and return the raw payload, or null for blank
+     *  lines (event separators), comments (`: …`), or non-data fields (`event:`, `id:`, etc.).
+     *  Pure; byte-twin of Swift `dataPayload(fromLine:)`. */
+    fun dataPayload(fromLine: String): String? {
+        val trimmed = fromLine.trim()
+        if (trimmed.isEmpty()) return null
+        if (trimmed.startsWith(":")) return null
+        if (trimmed.startsWith("data:")) {
+            var payload = trimmed.substring("data:".length)
+            if (payload.startsWith(" ")) payload = payload.substring(1)
+            return payload
+        }
+        return null
+    }
+
+    /** True when a data payload is the `[DONE]` terminator (OpenAI-compatible). Pure. */
+    fun isDone(payload: String): Boolean = payload.trim() == DONE_MARKER
+
+    // MARK: - Per-provider delta extraction
+
+    /** Extract the text delta from an OpenAI-compatible SSE data payload.
+     *  Shape: `{"choices":[{"delta":{"content":"hello"}}]}` → `"hello"`.
+     *  Returns null for a `[DONE]` line, a payload with no choices, or a non-content delta.
+     *  Pure; byte-twin of Swift `openAiDelta`. */
+    fun openAiDelta(payload: String): String? {
+        if (isDone(payload)) return null
+        return try {
+            val obj = JSONObject(payload)
+            val choices = obj.optJSONArray("choices") ?: return null
+            val first = choices.optJSONObject(0) ?: return null
+            val delta = first.optJSONObject("delta") ?: return null
+            delta.optString("content").takeIf { it.isNotEmpty() }
+        } catch (e: Exception) { null }
+    }
+
+    /** Extract the text delta from a Gemini SSE data payload (`:streamGenerateContent?alt=sse`).
+     *  Shape: `{"candidates":[{"content":{"parts":[{"text":"hello"}]}}]}` → `"hello"`.
+     *  Pure; byte-twin of Swift `geminiDelta`. */
+    fun geminiDelta(payload: String): String? {
+        return try {
+            val obj = JSONObject(payload)
+            val candidates = obj.optJSONArray("candidates") ?: return null
+            val first = candidates.optJSONObject(0) ?: return null
+            val content = first.optJSONObject("content") ?: return null
+            val parts = content.optJSONArray("parts") ?: return null
+            val sb = StringBuilder()
+            for (i in 0 until parts.length()) {
+                val text = parts.optJSONObject(i)?.optString("text")
+                if (!text.isNullOrEmpty()) sb.append(text)
+            }
+            sb.toString().takeIf { it.isNotEmpty() }
+        } catch (e: Exception) { null }
+    }
+
+    /** Extract the text delta from an Anthropic SSE data payload.
+     *  Shape: `{"type":"content_block_delta","delta":{"type":"text_delta","text":"hello"}}` → `"hello"`.
+     *  Returns null for non-text-delta events. Pure; byte-twin of Swift `anthropicDelta`. */
+    fun anthropicDelta(payload: String): String? {
+        return try {
+            val obj = JSONObject(payload)
+            if (obj.optString("type") != "content_block_delta") return null
+            val delta = obj.optJSONObject("delta") ?: return null
+            if (delta.optString("type") != "text_delta") return null
+            delta.optString("text").takeIf { it.isNotEmpty() }
+        } catch (e: Exception) { null }
+    }
+
+    // MARK: - Full-stream reassembly (test helper)
+
+    /** Reassemble the full reply text from a complete SSE stream (all lines, in order) for the
+     *  given provider shape. Pure; used by tests to assert the streamed text equals the non-streamed
+     *  reply. Byte-twin of Swift `reassemble`. */
+    fun reassemble(lines: List<String>, provider: SseProvider): String {
+        val sb = StringBuilder()
+        for (line in lines) {
+            val payload = SseDeltas.dataPayload(fromLine = line)
+            if (payload == null) continue
+            val delta: String? = if (provider == SseProvider.OPEN_AI || provider == SseProvider.CUSTOM) {
+                SseDeltas.openAiDelta(payload)
+            } else if (provider == SseProvider.GEMINI) {
+                SseDeltas.geminiDelta(payload)
+            } else {
+                SseDeltas.anthropicDelta(payload)
+            }
+            if (delta != null) sb.append(delta)
+        }
+        return sb.toString()
+    }
+}
+
+/** The provider wire shape to use for delta extraction. CUSTOM shares the OpenAI shape. */
+enum class SseProvider { OPEN_AI, CUSTOM, GEMINI, ANTHROPIC }
diff --git a/android/app/src/main/java/com/noop/data/Entities.kt b/android/app/src/main/java/com/noop/data/Entities.kt
index 8ae6c03c17..f9898128ac 100644
--- a/android/app/src/main/java/com/noop/data/Entities.kt
+++ b/android/app/src/main/java/com/noop/data/Entities.kt
@@ -633,6 +633,28 @@ data class AppleStepHour(
     val steps: Int,
 )
 
+/**
+ * PRD-K2: one persisted turn in the AI Coach conversation (Room v37 / MIGRATION_36_37). Swift
+ * `coachMessage` (WhoopStore Database.swift `v43-coach-messages` migration). Lets the Coach chat
+ * survive relaunch. `orderIndex` (not `createdAt`, which two streamed turns can share to the second)
+ * is a monotonically-increasing counter so replay order is exact. `provider` isn't filtered on for
+ * v1 (a conversation is a conversation across a provider switch) but is carried so a future
+ * per-provider view/filter doesn't need another migration. NEVER added to the `.noopbak` backup
+ * whitelist — a separate, deliberate decision (CLAUDE.md's backup contract).
+ *
+ * Fields are declared in the SAME order as the Swift GRDB schema (id, role, text, provider,
+ * createdAt, orderIndex) so the migration's CREATE TABLE column order matches Room's generated shape.
+ */
+@Entity(tableName = "coachMessage")
+data class CoachMessageRow(
+    @PrimaryKey val id: String,
+    val role: String,       // "user" | "assistant"
+    val text: String,
+    val provider: String,
+    val createdAt: Long,    // epoch seconds
+    val orderIndex: Int,    // monotonic replay order
+)
+
 /**
  * The RAW WHOOP 5.0 v26 optical PPG waveform, one record per second (v27 / MIGRATION_18_19, issue #156
  * follow-up). Swift `ppgWaveformSample` (WhoopStore Database.swift `v27-ppg-waveform` migration). The
diff --git a/android/app/src/main/java/com/noop/data/WhoopDao.kt b/android/app/src/main/java/com/noop/data/WhoopDao.kt
index 0992a821f0..55b9f85d7c 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDao.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDao.kt
@@ -1211,4 +1211,31 @@ interface WhoopDao : DeviceRegistryDao {
      *  (before [minTs]) AND computed (`-noop`), so an imported multi-year sleep history survives (v8.2.1). */
     @Query("DELETE FROM sleepSession WHERE startTs > :maxTs OR (startTs < :minTs AND deviceId LIKE '%-noop')")
     suspend fun pruneSleepSessionByTs(minTs: Long, maxTs: Long): Int
+
+    // MARK: - PRD-K2: persisted Coach conversation
+
+    /** The full stored conversation, oldest first (by orderIndex). */
+    @Query("SELECT * FROM coachMessage ORDER BY orderIndex ASC")
+    suspend fun coachMessages(): List<CoachMessageRow>
+
+    @Insert(onConflict = OnConflictStrategy.REPLACE)
+    suspend fun insertCoachMessagesRaw(rows: List<CoachMessageRow>)
+
+    /** Wipe the entire stored conversation (the Coach toolbar's "Clear conversation" action, and the
+     *  first half of a full replace). */
+    @Query("DELETE FROM coachMessage")
+    suspend fun clearCoachMessages()
+
+    /**
+     * Replace the ENTIRE stored conversation with [rows] in one transaction. Simpler and safer than
+     * incremental insert/update/delete bookkeeping across the several streaming-finalization call
+     * sites (a streamed reply mutates the same message's text repeatedly before settling); the table
+     * is capped at the caller's MAX_STORED_MESSAGES, so a full replace is always cheap. Byte-parity
+     * twin of Swift `WhoopStore.replaceCoachMessages`.
+     */
+    @Transaction
+    suspend fun replaceCoachMessages(rows: List<CoachMessageRow>) {
+        clearCoachMessages()
+        if (rows.isNotEmpty()) insertCoachMessagesRaw(rows)
+    }
 }
diff --git a/android/app/src/main/java/com/noop/data/WhoopDatabase.kt b/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
index 23e13d2115..8a0a1ac03d 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
@@ -52,8 +52,9 @@ import androidx.sqlite.db.SupportSQLiteDatabase
         PpgWaveformSampleEntity::class,
         V18AuxSampleEntity::class,
         AppleStepHour::class,
+        CoachMessageRow::class,
     ],
-    version = 36,
+    version = 37,
     // #775: ON so Room's KSP processor writes the generated schema (every table's exact `CREATE TABLE`,
     // columns in declaration order with affinity/NOT NULL/default, PK and indices) as JSON. That export
     // is what lets a plain JVM test — no device, no Robolectric — read Android's REAL schema and compare
@@ -73,7 +74,7 @@ abstract class WhoopDatabase : RoomDatabase() {
         const val DB_NAME = "noop_whoop.db"
         /** Room schema version — MUST equal the `@Database(version = …)` above. Surfaced in the backup
          *  manifest (#1410) so an export states its schema. Bump both together on a migration. */
-        const val SCHEMA_VERSION = 36
+        const val SCHEMA_VERSION = 37
 
         @Volatile
         private var instance: WhoopDatabase? = null
@@ -947,6 +948,25 @@ abstract class WhoopDatabase : RoomDatabase() {
             }
         }
 
+        /** PRD-K2: persisted Coach conversation history (schema v37). Swift twin: WhoopStore
+         *  Database.swift `v43-coach-messages` migration. Column order matches [CoachMessageRow]
+         *  field declaration order so Room's generated `CREATE TABLE` shape agrees. */
+        internal val MIGRATION_36_37 = object : Migration(36, 37) {
+            override fun migrate(db: SupportSQLiteDatabase) {
+                db.execSQL(
+                    """CREATE TABLE IF NOT EXISTS `coachMessage` (
+                        `id` TEXT NOT NULL,
+                        `role` TEXT NOT NULL,
+                        `text` TEXT NOT NULL,
+                        `provider` TEXT NOT NULL,
+                        `createdAt` INTEGER NOT NULL,
+                        `orderIndex` INTEGER NOT NULL,
+                        PRIMARY KEY(`id`)
+                    )"""
+                )
+            }
+        }
+
         /**
          * Every migration the builder registers, as a VALUE rather than an argument list.
          *
@@ -973,9 +993,9 @@ abstract class WhoopDatabase : RoomDatabase() {
             MIGRATION_22_23, MIGRATION_23_24, MIGRATION_24_25, MIGRATION_25_26,
             MIGRATION_26_27, MIGRATION_27_28, MIGRATION_28_29, MIGRATION_29_30,
             MIGRATION_30_31, MIGRATION_31_32, MIGRATION_32_33, MIGRATION_33_34, MIGRATION_34_35, MIGRATION_35_36,
+            MIGRATION_36_37,
         )
 
-
         private fun build(appContext: Context): WhoopDatabase =
             Room.databaseBuilder(appContext, WhoopDatabase::class.java, DB_NAME)
                 // #1014: replace ONLY the corruption handling of the default open-helper. The
diff --git a/android/app/src/main/java/com/noop/ui/CoachBriefScheduler.kt b/android/app/src/main/java/com/noop/ui/CoachBriefScheduler.kt
new file mode 100644
index 0000000000..2a87230fcd
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ui/CoachBriefScheduler.kt
@@ -0,0 +1,320 @@
+package com.noop.ui
+
+import android.annotation.SuppressLint
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.content.Context
+import android.content.SharedPreferences
+import androidx.core.app.NotificationCompat
+import androidx.core.app.NotificationManagerCompat
+import androidx.work.CoroutineWorker
+import androidx.work.ExistingPeriodicWorkPolicy
+import androidx.work.PeriodicWorkRequestBuilder
+import androidx.work.WorkManager
+import androidx.work.WorkerParameters
+import androidx.glance.appwidget.updateAll
+import com.noop.R
+import com.noop.ai.AiCoach
+import com.noop.ai.AiKeyStore
+import com.noop.data.WhoopDatabase
+import com.noop.data.WhoopRepository
+import java.text.SimpleDateFormat
+import java.util.Calendar
+import java.util.Locale
+import java.util.concurrent.TimeUnit
+
+/**
+ * PRD-K5: the scheduled Coach morning brief (Android twin of Swift `CoachBriefScheduler`).
+ *
+ * A user-armed, LOCAL notification carrying today's coaching brief (readiness + training plan),
+ * generated on-device via the user's already-configured Coach provider, once a day at a chosen
+ * time. Tap opens the app (same convention every other NOOP notification uses — see
+ * [BatteryAlertNotifier]); the full brief is stored for [CoachViewModel]/[CoachScreen] to surface.
+ * No push server, no cloud — the network call is the SAME bring-your-own-key request Coach already
+ * makes on every send, just user-armed on a daily WorkManager job instead of triggered by a tap.
+ * Default OFF, like every NOOP automation.
+ *
+ * SCHEDULING — WorkManager (mirrors [DebugExportScheduler]), not AlarmManager: a brief sliding a few
+ * minutes into a maintenance window is fine, and it must survive reboot/app-kill without the
+ * exact-alarm permission.
+ */
+object CoachBriefScheduler {
+
+    /** Unique work name so every (re)schedule + cancel addresses the SAME daily job. */
+    private const val WORK_NAME = "noop_coach_brief_daily"
+
+    /**
+     * (Re)schedule the daily brief from the persisted [CoachBriefSettings]. No-op + cancels any
+     * existing job when the feature is disabled. Call this on settings change and from app start so
+     * the schedule self-heals after a reboot/relaunch.
+     */
+    fun reschedule(context: Context, settings: CoachBriefSettings = CoachBriefSettings.from(context)) {
+        val wm = WorkManager.getInstance(context.applicationContext)
+        if (!settings.enabled) {
+            wm.cancelUniqueWork(WORK_NAME)
+            publishToWidgetSync(context, null)  // K10: clear the widget when the feature is turned off
+            return
+        }
+        val initialDelayMs = delayToNextOccurrenceMs(settings.timeMinutes)
+        val request = PeriodicWorkRequestBuilder<CoachBriefWorker>(1, TimeUnit.DAYS)
+            .setInitialDelay(initialDelayMs, TimeUnit.MILLISECONDS)
+            .build()
+        // KEEP: an already-scheduled daily brief keeps its existing period anchor rather than being
+        // reset every app-start. A time-of-day CHANGE goes through [applyTimeChange] instead.
+        wm.enqueueUniquePeriodicWork(WORK_NAME, ExistingPeriodicWorkPolicy.KEEP, request)
+    }
+
+    /** Force a fresh schedule (cancel then enqueue) so a changed time-of-day takes effect immediately. */
+    fun applyTimeChange(context: Context, settings: CoachBriefSettings = CoachBriefSettings.from(context)) {
+        WorkManager.getInstance(context.applicationContext).cancelUniqueWork(WORK_NAME)
+        reschedule(context, settings)
+    }
+
+    /** Cancel the daily brief entirely. */
+    fun cancel(context: Context) {
+        WorkManager.getInstance(context.applicationContext).cancelUniqueWork(WORK_NAME)
+    }
+
+    /**
+     * Milliseconds from [nowMs] until the next wall-clock occurrence of [minuteOfDay] (today if
+     * still ahead, else tomorrow). Pure + injectable so the unit test pins the arithmetic. Mirrors
+     * [DebugExportScheduler.delayToNextOccurrenceMs].
+     */
+    fun delayToNextOccurrenceMs(minuteOfDay: Int, nowMs: Long = System.currentTimeMillis()): Long {
+        val next = Calendar.getInstance().apply {
+            timeInMillis = nowMs
+            set(Calendar.HOUR_OF_DAY, minuteOfDay / 60)
+            set(Calendar.MINUTE, minuteOfDay % 60)
+            set(Calendar.SECOND, 0)
+            set(Calendar.MILLISECOND, 0)
+            if (timeInMillis <= nowMs) add(Calendar.DAY_OF_YEAR, 1)
+        }
+        return next.timeInMillis - nowMs
+    }
+
+    /**
+     * The explicit "Generate now" button: always generates and stores, ignoring the once-per-day
+     * dedup. Does NOT post a notification (the user is already looking at Coach) and does NOT touch
+     * `lastRunDayKey`, so today's scheduled slot still fires normally. Returns the brief text, or
+     * null on failure (no key/consent/network) — the caller surfaces that.
+     */
+    suspend fun generateNow(context: Context): String? {
+        val ctx = context.applicationContext
+        val provider = AiKeyStore.readProvider(ctx)
+        val model = AiKeyStore.readModel(ctx, provider)
+        val consent = AiKeyStore.readConsent(ctx)
+        val customUrl = AiKeyStore.readCustomBaseUrl(ctx)
+        val customHeader = AiKeyStore.readCustomAuthHeader(ctx)
+        val includeSignals = consent && NoopPrefs.coachSignals(ctx)
+        // #1304/#512 parity with CoachViewModel: thread the ACTIVE strap id so a headless generation
+        // reasons off the same strap the user sees in the app, not a hardcoded canonical fallback.
+        val aiCoach = AiCoach(
+            WhoopRepository(WhoopDatabase.get(ctx)),
+            activeStrapId = { (ctx as? com.noop.NoopApplication)?.activeDeviceId ?: WhoopRepository.WHOOP_SOURCE },
+        )
+        return aiCoach.generateBrief(ctx, provider, model, consent, customUrl, customHeader, includeSignals)
+    }
+
+    /** yyyy-MM-dd local-day key for the once-per-day dedup. Locale-fixed so the key is stable. */
+    private fun dayKey(date: Long = System.currentTimeMillis()): String =
+        SimpleDateFormat("yyyy-MM-dd", Locale.US).format(java.util.Date(date))
+
+    /**
+     * Pure: the notification body is the brief's first non-empty line, trimmed and length-capped so
+     * it fits a notification banner. Byte-identical shape to the Swift twin's `oneLineSummary`.
+     */
+    fun oneLineSummary(brief: String, maxLength: Int = 120): String {
+        val firstLine = brief.split("\n").firstOrNull { it.isNotBlank() }?.trim() ?: brief.trim()
+        if (firstLine.length <= maxLength) return firstLine
+        return firstLine.take(maxLength).trimEnd() + "…"
+    }
+
+    private const val CHANNEL_ID = "noop_coach_brief"
+    private const val NOTIF_ID = 4213
+    private const val NOTIF_ID_UNAVAILABLE = 4214
+
+    // K10: Widget-facing publish. Mirrors the brief into the widget's SharedPreferences so the
+    // Glance widget (separate process) can render it without DB/network access. Matches the iOS
+    // twin's App Group publish. Nudges Glance to recompose via WidgetSnapshotStore.push pattern.
+    private const val WIDGET_BRIEF_KEY = "coachBriefText"
+    private const val WIDGET_BRIEF_DATE_KEY = "coachBriefDateMs"
+
+    /// Suspend version — called from the worker's `doWork`. Writes prefs + nudges Glance.
+    private suspend fun publishToWidget(context: Context, text: String?) {
+        writeBriefToWidgetPrefs(context, text)
+        if (text != null) {
+            runCatching { com.noop.widget.CoachBriefGlanceWidget().updateAll(context.applicationContext) }
+        }
+    }
+
+    /// Non-suspend version — called from `reschedule` (disable path). Writes prefs only; the
+    /// widget will pick up the cleared state on its next periodic refresh.
+    private fun publishToWidgetSync(context: Context, text: String?) {
+        writeBriefToWidgetPrefs(context, text)
+    }
+
+    private fun writeBriefToWidgetPrefs(context: Context, text: String?) {
+        val prefs = context.getSharedPreferences("noop_widget", Context.MODE_PRIVATE)
+        val e = prefs.edit()
+        if (text != null) {
+            e.putString(WIDGET_BRIEF_KEY, text)
+            e.putLong(WIDGET_BRIEF_DATE_KEY, System.currentTimeMillis())
+        } else {
+            e.remove(WIDGET_BRIEF_KEY)
+            e.remove(WIDGET_BRIEF_DATE_KEY)
+        }
+        e.apply()
+    }
+
+    @SuppressLint("MissingPermission") // guarded by areNotificationsEnabled() + runCatching
+    private fun postBrief(context: Context, text: String) {
+        runCatching {
+            if (!NotificationManagerCompat.from(context).areNotificationsEnabled()) return
+            ensureChannel(context)
+            val body = oneLineSummary(text)
+            val n = NotificationCompat.Builder(context, CHANNEL_ID)
+                .setSmallIcon(R.drawable.ic_stat_heart)
+                .setContentTitle(context.getString(R.string.coach_brief_title))
+                .setContentText(body)
+                .setStyle(NotificationCompat.BigTextStyle().bigText(body))
+                .setContentIntent(
+                    android.app.PendingIntent.getActivity(
+                        context, 5, appLaunchIntent(context),
+                        android.app.PendingIntent.FLAG_IMMUTABLE or android.app.PendingIntent.FLAG_UPDATE_CURRENT,
+                    ),
+                )
+                .setAutoCancel(true)
+                .setCategory(NotificationCompat.CATEGORY_STATUS)
+                .setPriority(NotificationCompat.PRIORITY_DEFAULT)
+                .build()
+            NotificationManagerCompat.from(context).notify(NOTIF_ID, n)
+        }
+    }
+
+    @SuppressLint("MissingPermission")
+    private fun postUnavailable(context: Context) {
+        runCatching {
+            if (!NotificationManagerCompat.from(context).areNotificationsEnabled()) return
+            ensureChannel(context)
+            val n = NotificationCompat.Builder(context, CHANNEL_ID)
+                .setSmallIcon(R.drawable.ic_stat_heart)
+                .setContentTitle(context.getString(R.string.coach_brief_unavailable_title))
+                .setContentText(context.getString(R.string.coach_brief_unavailable_body))
+                .setContentIntent(
+                    android.app.PendingIntent.getActivity(
+                        context, 6, appLaunchIntent(context),
+                        android.app.PendingIntent.FLAG_IMMUTABLE or android.app.PendingIntent.FLAG_UPDATE_CURRENT,
+                    ),
+                )
+                .setAutoCancel(true)
+                .setCategory(NotificationCompat.CATEGORY_STATUS)
+                .setPriority(NotificationCompat.PRIORITY_DEFAULT)
+                .build()
+            NotificationManagerCompat.from(context).notify(NOTIF_ID_UNAVAILABLE, n)
+        }
+    }
+
+    private fun ensureChannel(context: Context) {
+        if (android.os.Build.VERSION.SDK_INT < android.os.Build.VERSION_CODES.O) return
+        runCatching {
+            val mgr = context.getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+            mgr.createNotificationChannel(
+                NotificationChannel(
+                    CHANNEL_ID, context.getString(R.string.coach_brief_channel_name),
+                    NotificationManager.IMPORTANCE_DEFAULT,
+                ).apply {
+                    description = context.getString(R.string.coach_brief_channel_desc)
+                },
+            )
+        }
+    }
+
+    /**
+     * The worker that runs one scheduled brief generation: dedupes on the local day (WorkManager can
+     * retry/redeliver), calls [AiCoach.generateBrief] under the persisted key/provider/consent, and
+     * either posts the brief notification + stores it for the Coach screen, or posts a low-key
+     * "unavailable, tap to retry" notification WITHOUT marking the day done (so the next periodic
+     * run retries). Always returns success so a failed generation doesn't poison the daily chain —
+     * the dedup key, not the WorkManager result, governs retry.
+     */
+    internal class CoachBriefWorker(
+        context: Context,
+        params: WorkerParameters,
+    ) : CoroutineWorker(context, params) {
+        override suspend fun doWork(): Result {
+            val ctx = applicationContext
+            val settings = CoachBriefSettings.from(ctx)
+            if (!settings.enabled) return Result.success()
+            if (settings.lastRunDayKey == dayKey()) return Result.success() // already ran today
+
+            val text = generateNow(ctx)
+            if (text == null) {
+                postUnavailable(ctx)
+                return Result.success()
+            }
+            settings.lastRunDayKey = dayKey()
+            settings.storedBrief = text
+            settings.hasUnconsumedBrief = true
+            publishToWidget(ctx, text)  // K10: mirror into the widget's SharedPreferences
+            postBrief(ctx, text)
+            return Result.success()
+        }
+    }
+}
+
+/**
+ * Persisted, opt-in settings for the scheduled Coach morning brief (K5). Mirrors
+ * [DebugExportSettings]'s SharedPreferences shape: enable flag (default OFF) + a time-of-day in
+ * minutes since local midnight, plus the dedup/tap-through state the worker and Coach screen share.
+ */
+class CoachBriefSettings(private val prefs: SharedPreferences) {
+
+    /** Master enable. Default OFF. */
+    var enabled: Boolean
+        get() = prefs.getBoolean(KEY_ENABLED, false)
+        set(v) = prefs.edit().putBoolean(KEY_ENABLED, v).apply()
+
+    /** Time-of-day to generate, minutes since midnight. Clamped to a valid minute. Default 07:00. */
+    var timeMinutes: Int
+        get() = prefs.getInt(KEY_TIME, DEFAULT_TIME).coerceIn(0, MINUTES_PER_DAY - 1)
+        set(v) = prefs.edit().putInt(KEY_TIME, v.coerceIn(0, MINUTES_PER_DAY - 1)).apply()
+
+    /** yyyy-MM-dd of the last successfully GENERATED brief (once-per-day dedup). */
+    var lastRunDayKey: String?
+        get() = prefs.getString(KEY_LAST_RUN, null)
+        set(v) = prefs.edit().putString(KEY_LAST_RUN, v).apply()
+
+    /** The most recently generated full brief text, for the notification tap-through. */
+    var storedBrief: String?
+        get() = prefs.getString(KEY_STORED_BRIEF, null)
+        set(v) = prefs.edit().putString(KEY_STORED_BRIEF, v).apply()
+
+    /** True when a generated brief hasn't yet been surfaced in the Coach transcript. */
+    var hasUnconsumedBrief: Boolean
+        get() = prefs.getBoolean(KEY_UNCONSUMED, false)
+        set(v) = prefs.edit().putBoolean(KEY_UNCONSUMED, v).apply()
+
+    /** Coach reads this once (on an empty transcript) to surface the stored brief as its first
+     *  message without re-generating or re-sending anything. Null when there's nothing unconsumed. */
+    fun consumeStoredBrief(): String? {
+        if (!hasUnconsumedBrief) return null
+        val text = storedBrief ?: return null
+        hasUnconsumedBrief = false
+        return text
+    }
+
+    companion object {
+        private const val PREFS = "noop_coach_brief"
+        private const val KEY_ENABLED = "coachBrief.enabled"
+        private const val KEY_TIME = "coachBrief.timeMinutes"
+        private const val KEY_LAST_RUN = "coachBrief.lastRunDayKey"
+        private const val KEY_STORED_BRIEF = "coachBrief.storedText"
+        private const val KEY_UNCONSUMED = "coachBrief.hasUnconsumedBrief"
+
+        const val MINUTES_PER_DAY = 24 * 60
+        const val DEFAULT_TIME = 7 * 60 // 07:00 — a brief waiting when you check your phone.
+
+        fun from(context: Context): CoachBriefSettings =
+            CoachBriefSettings(context.getSharedPreferences(PREFS, Context.MODE_PRIVATE))
+    }
+}
diff --git a/android/app/src/main/java/com/noop/ui/CoachScreen.kt b/android/app/src/main/java/com/noop/ui/CoachScreen.kt
index 92625a75a3..5dd32ca7b2 100644
--- a/android/app/src/main/java/com/noop/ui/CoachScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/CoachScreen.kt
@@ -5,6 +5,7 @@ import androidx.compose.ui.res.stringResource
 import androidx.compose.foundation.background
 import androidx.compose.foundation.border
 import androidx.compose.foundation.clickable
+import androidx.compose.foundation.combinedClickable
 import androidx.compose.foundation.interaction.MutableInteractionSource
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
@@ -24,7 +25,10 @@ import androidx.compose.foundation.text.KeyboardOptions
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.filled.ArrowDropDown
 import androidx.compose.material.icons.filled.Lock
+import androidx.compose.material.icons.filled.Mic
 import androidx.compose.material.icons.filled.Refresh
+import androidx.compose.material.icons.filled.Speed
+import androidx.compose.material.icons.filled.Stop
 import androidx.compose.material.icons.automirrored.filled.Send
 import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.CircularProgressIndicator
@@ -248,7 +252,47 @@ private fun CoachChat(vm: CoachViewModel) {
     val error by vm.error.collectAsStateWithLifecycle()
     val provider by vm.provider.collectAsStateWithLifecycle()
     val model by vm.model.collectAsStateWithLifecycle()
-    var input by remember { mutableStateOf("") }
+    val suggestions by vm.suggestions.collectAsStateWithLifecycle()
+    // K15: the composer draft is persisted to SharedPreferences so it survives an app relaunch.
+    // Restored on first composition, saved on every change. Keyed identically to the iOS twin.
+    val draftPrefs = remember { context.getSharedPreferences("noop_coach_draft", android.content.Context.MODE_PRIVATE) }
+    var input by remember { mutableStateOf(draftPrefs.getString("draft", "") ?: "") }
+    // K2: confirmation gate for the destructive "Clear conversation" action.
+    var showClearConfirm by remember { mutableStateOf(false) }
+
+    // Refresh the contextual chips whenever the chat empties (so a fresh sync updates them) and
+    // once on first show. Best-effort; the VM falls back to the generic set on any failure.
+    LaunchedEffect(messages.isEmpty()) {
+        if (messages.isEmpty()) vm.refreshSuggestions()
+    }
+
+    // K14: vibrate when a reply arrives (sending goes true → false with messages present).
+    var wasSending by remember { mutableStateOf(false) }
+    LaunchedEffect(sending) {
+        if (wasSending && !sending && messages.isNotEmpty()) {
+            val vibrator = context.getSystemService(android.content.Context.VIBRATOR_SERVICE)
+                as android.os.Vibrator
+            if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.O) {
+                vibrator.vibrate(
+                    android.os.VibrationEffect.createOneShot(50, android.os.VibrationEffect.DEFAULT_AMPLITUDE)
+                )
+            } else {
+                @Suppress("DEPRECATION")
+                vibrator.vibrate(50)
+            }
+        }
+        wasSending = sending
+    }
+
+    // K2 + K5 ordering matters and both gate on an EMPTY transcript, so this is ONE coroutine,
+    // sequential: restore whatever the prior launch persisted FIRST, THEN surface a brief the
+    // scheduled notification already generated (if any) — so K5 never overwrites K2's restore, and
+    // never appends a duplicate brief onto a transcript K2 just repopulated.
+    LaunchedEffect(Unit) {
+        vm.loadPersistedMessagesIfNeeded()
+        vm.loadBriefSettings(context)
+        vm.consumeScheduledBriefIfAny(context)
+    }
 
     Column(verticalArrangement = Arrangement.spacedBy(16.dp)) {
 
@@ -280,6 +324,22 @@ private fun CoachChat(vm: CoachViewModel) {
             }
         }
 
+        if (showClearConfirm) {
+            AlertDialog(
+                onDismissRequest = { showClearConfirm = false },
+                title = { Text(stringResource(R.string.coach_clear_conversation_confirm)) },
+                text = { Text(stringResource(R.string.coach_clear_conversation_message)) },
+                confirmButton = {
+                    TextButton(onClick = { vm.clearConversation(); showClearConfirm = false }) {
+                        Text(stringResource(R.string.coach_clear_action), color = Palette.statusCritical)
+                    }
+                },
+                dismissButton = {
+                    TextButton(onClick = { showClearConfirm = false }) { Text(stringResource(R.string.l10n_coach_screen_cancel_77dfd213)) }
+                },
+            )
+        }
+
         // Data-access consent, off by default; no metrics are sent until this is on.
         val consent by vm.consent.collectAsStateWithLifecycle()
         NoopCard(padding = 14.dp, tint = Palette.chargeColor) {
@@ -303,6 +363,9 @@ private fun CoachChat(vm: CoachViewModel) {
         // take effect on the next message (the engine reads the stored prompt fresh per send).
         CoachInstructions(vm = vm)
 
+        // K5: the scheduled morning-brief notification.
+        MorningBriefCard(vm = vm)
+
         // Transcript or empty-state with suggested prompts.
         if (messages.isEmpty()) {
             NoopCard(padding = 18.dp) {
@@ -311,13 +374,17 @@ private fun CoachChat(vm: CoachViewModel) {
                         uiString(R.string.l10n_coach_screen_ask_anything_about_your_recent_recovery_e6c287ca),
                         style = NoopType.subhead, color = Palette.textSecondary,
                     )
-                    SuggestedPrompts(onPick = { input = it })
+                    SuggestedPrompts(prompts = suggestions, onPick = { input = it })
                 }
             }
         } else {
             Column(verticalArrangement = Arrangement.spacedBy(10.dp)) {
-                messages.forEach { msg -> ChatBubble(msg) }
+                messages.forEach { msg -> ChatBubble(msg, vm) }
                 if (sending) ThinkingBubble()
+                // K7: follow-up suggestion chips after each assistant reply (when not mid-send).
+                if (!sending && messages.isNotEmpty() && messages.last().role == "assistant") {
+                    SuggestedPrompts(prompts = vm.followUpSuggestions, onPick = { input = it })
+                }
             }
         }
 
@@ -337,39 +404,53 @@ private fun CoachChat(vm: CoachViewModel) {
         }
 
         // Input row + Send, a frosted overlay surface so the composer reads as a docked input bar.
-        Row(
-            modifier = Modifier
-                .fillMaxWidth()
-                .clip(RoundedCornerShape(18.dp))
-                .background(Palette.surfaceOverlay)
-                .border(1.dp, Palette.hairline, RoundedCornerShape(18.dp))
-                .padding(8.dp),
-            verticalAlignment = Alignment.CenterVertically,
-            horizontalArrangement = Arrangement.spacedBy(10.dp),
-        ) {
-            OutlinedTextField(
-                value = input,
-                onValueChange = {
-                    input = it
-                    if (error != null) vm.clearError()
-                },
-                modifier = Modifier.weight(1f),
-                placeholder = { Text(uiString(R.string.l10n_coach_screen_ask_your_coach_b1577d4c), style = NoopType.body, color = Palette.textTertiary) },
-                textStyle = NoopType.body,
-                singleLine = false,
-                maxLines = 4,
-                enabled = !sending,
-                colors = coachFieldColors(),
-                shape = RoundedCornerShape(14.dp),
-            )
-            SendButton(
-                enabled = input.isNotBlank() && !sending,
-                sending = sending,
-                onClick = {
-                    vm.send(context, input)
-                    input = ""
-                },
-            )
+        // K4: the mic button (on-device voice input) sits between the text field and Send.
+        MicComposerRow(
+            input = input,
+            onInputChange = {
+                input = it
+                // K15: persist the draft so it survives an app relaunch.
+                draftPrefs.edit().putString("draft", it).apply()
+                if (error != null) vm.clearError()
+            },
+            sending = sending,
+            onSend = {
+                vm.send(context, input)
+                input = ""
+                // K15: clear the persisted draft on send.
+                draftPrefs.edit().remove("draft").apply()
+            },
+        )
+
+        // K12: rough token estimate shown when the draft is non-empty.
+        if (input.isNotBlank()) {
+            vm.estimatedTokens(input)?.let { tokens ->
+                Row(
+                    modifier = Modifier.fillMaxWidth().padding(top = 2.dp),
+                    horizontalArrangement = Arrangement.Start,
+                    verticalAlignment = Alignment.CenterVertically,
+                ) {
+                    Icon(
+                        imageVector = Icons.Filled.Speed,
+                        contentDescription = null,
+                        modifier = Modifier.size(10.dp),
+                        tint = Palette.textTertiary,
+                    )
+                    Spacer(modifier = Modifier.width(4.dp))
+                    Text(
+                        stringResource(R.string.coach_token_estimate, tokens),
+                        style = NoopType.caption,
+                        color = Palette.textTertiary,
+                    )
+                    if (tokens > 8000) {
+                        Text(
+                            stringResource(R.string.coach_token_warning),
+                            style = NoopType.caption,
+                            color = Palette.textTertiary,
+                        )
+                    }
+                }
+            }
         }
 
         // Privacy note repeated under the input so it's always on screen.
@@ -377,6 +458,62 @@ private fun CoachChat(vm: CoachViewModel) {
     }
 }
 
+/**
+ * K5: the scheduled morning-brief notification settings — enable switch, time-of-day chip, and an
+ * explicit "Generate now" action. Mirrors the daily-debug-export settings row shape
+ * ([DebugExportScheduler]) and the Swift twin's `morningBriefBar`.
+ */
+@Composable
+private fun MorningBriefCard(vm: CoachViewModel) {
+    val context = LocalContext.current
+    val enabled by vm.briefEnabled.collectAsStateWithLifecycle()
+    val minutes by vm.briefMinutes.collectAsStateWithLifecycle()
+    val generating by vm.briefGenerating.collectAsStateWithLifecycle()
+    val status by vm.briefStatus.collectAsStateWithLifecycle()
+
+    NoopCard(padding = 14.dp, tint = Palette.chargeColor) {
+        Column(verticalArrangement = Arrangement.spacedBy(10.dp)) {
+            Row(verticalAlignment = Alignment.CenterVertically) {
+                Column(modifier = Modifier.weight(1f), verticalArrangement = Arrangement.spacedBy(2.dp)) {
+                    Text(stringResource(R.string.coach_morning_brief), style = NoopType.subhead, color = Palette.textPrimary)
+                    Text(
+                        if (enabled)
+                            stringResource(R.string.coach_morning_brief_desc)
+                        else stringResource(R.string.coach_morning_brief_off),
+                        style = NoopType.footnote, color = Palette.textTertiary,
+                    )
+                }
+                androidx.compose.material3.Switch(
+                    checked = enabled,
+                    onCheckedChange = { vm.setBriefEnabled(context, it) },
+                )
+            }
+            if (enabled) {
+                Row(verticalAlignment = Alignment.CenterVertically) {
+                    Text(stringResource(R.string.coach_morning_brief_time), style = NoopType.subhead, color = Palette.textPrimary, modifier = Modifier.weight(1f))
+                    TimeChip(
+                        minutes = minutes,
+                        accessibilityLabel = "Morning brief time",
+                        onPicked = { vm.setBriefMinutes(context, it) },
+                    )
+                }
+                Text(
+                    stringResource(R.string.coach_morning_brief_best_effort),
+                    style = NoopType.caption, color = Palette.textTertiary,
+                )
+                CoachPrimaryButton(
+                    label = if (generating) stringResource(R.string.coach_generating) else stringResource(R.string.coach_generate_now),
+                    enabled = !generating,
+                    onClick = { vm.generateBriefNow(context) },
+                )
+                if (status != null) {
+                    Text(status.orEmpty(), style = NoopType.footnote, color = Palette.textTertiary)
+                }
+            }
+        }
+    }
+}
+
 /**
  * Editable system prompt, the instructions that frame the coach. Collapsed by default; expanding
  * reveals a multi-line field bound to the view model (edits persist to [NoopPrefs] and take effect on
@@ -452,9 +589,14 @@ private fun CoachInstructions(vm: CoachViewModel) {
 // MARK: - Chat bubbles
 
 @Composable
-private fun ChatBubble(msg: ChatMsg) {
+@OptIn(androidx.compose.foundation.ExperimentalFoundationApi::class)
+private fun ChatBubble(msg: ChatMsg, vm: CoachViewModel) {
     val isUser = msg.role == "user"
     val bubbleShape = RoundedCornerShape(16.dp)
+    val context = LocalContext.current
+    val clipboardManager = androidx.compose.ui.platform.LocalClipboardManager.current
+    // K8: long-press popup menu for Copy / Share / Save on assistant replies.
+    var showMenu by remember { mutableStateOf(false) }
     Row(
         modifier = Modifier.fillMaxWidth(),
         horizontalArrangement = if (isUser) Arrangement.End else Arrangement.Start,
@@ -475,7 +617,18 @@ private fun ChatBubble(msg: ChatMsg) {
             modifier = Modifier
                 .widthIn(max = 320.dp)
                 .then(bubbleModifier)
-                .padding(horizontal = 14.dp, vertical = 10.dp),
+                .padding(horizontal = 14.dp, vertical = 10.dp)
+                // K8: long-press assistant bubbles to show Copy / Share / Save. User bubbles
+                // are not actionable (the text is the user's own input).
+                .then(
+                    if (isUser) Modifier
+                    else Modifier.combinedClickable(
+                        interactionSource = remember { MutableInteractionSource() },
+                        indication = null,
+                        onClick = {},
+                        onLongClick = { showMenu = true },
+                    )
+                ),
         ) {
             Column(verticalArrangement = Arrangement.spacedBy(4.dp)) {
                 Overline(
@@ -489,6 +642,39 @@ private fun ChatBubble(msg: ChatMsg) {
                     CoachMarkdown(msg.text, color = Palette.textPrimary)
                 }
             }
+            // K8: dropdown popup anchored to the bubble.
+            DropdownMenu(
+                expanded = showMenu,
+                onDismissRequest = { showMenu = false },
+            ) {
+                DropdownMenuItem(
+                    text = { Text(stringResource(R.string.coach_copy_action)) },
+                    onClick = {
+                        clipboardManager.setText(androidx.compose.ui.text.AnnotatedString(msg.text))
+                        showMenu = false
+                    },
+                )
+                DropdownMenuItem(
+                    text = { Text(stringResource(R.string.coach_share_action)) },
+                    onClick = {
+                        val sendIntent = android.content.Intent(android.content.Intent.ACTION_SEND).apply {
+                            type = "text/plain"
+                            putExtra(android.content.Intent.EXTRA_TEXT, msg.text)
+                        }
+                        context.startActivity(
+                            android.content.Intent.createChooser(sendIntent, "Share Coach advice")
+                        )
+                        showMenu = false
+                    },
+                )
+                DropdownMenuItem(
+                    text = { Text(stringResource(R.string.coach_save_to_journal)) },
+                    onClick = {
+                        vm.saveAdviceToJournal(msg.text)
+                        showMenu = false
+                    },
+                )
+            }
         }
     }
 }
@@ -526,11 +712,11 @@ private fun ThinkingBubble() {
 internal val SUGGESTED_PROMPTS: List<String> get() = CoachPrompts.SUGGESTIONS
 
 @Composable
-private fun SuggestedPrompts(onPick: (String) -> Unit) {
+private fun SuggestedPrompts(prompts: List<String>, onPick: (String) -> Unit) {
     Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
         Overline("Try asking")
         // Simple wrapped column of chips (one per row keeps long prompts readable).
-        SUGGESTED_PROMPTS.forEach { prompt ->
+        prompts.forEach { prompt ->
             val shape = RoundedCornerShape(50)
             val chipInteraction = remember { MutableInteractionSource() }
             Text(
@@ -769,6 +955,172 @@ private fun CoachPrimaryButton(label: String, enabled: Boolean, onClick: () -> U
     }
 }
 
+// MARK: - K4: Voice input composer row (mic button + text field + send)
+
+/**
+ * K4: The composer row with a mic button (on-device voice input) between the text field and Send.
+ * Mirrors the iOS `CoachView.composer` + `micButton` twin. The mic button:
+ *  - requests RECORD_AUDIO at runtime on first tap (via [rememberLauncherForActivityResult]),
+ *  - starts/stops [CoachVoiceInput] (Android platform SpeechRecognizer, EXTRA_PREFER_OFFLINE),
+ *  - streams the partial transcript into the text field live,
+ *  - on stop, appends the finalized transcript to the draft (not replace, so it composes with
+ *    typed text).
+ * Only the resulting TEXT ever reaches the AI provider — no new network path, no audio egress.
+ */
+@Composable
+private fun MicComposerRow(
+    input: String,
+    onInputChange: (String) -> Unit,
+    sending: Boolean,
+    onSend: () -> Unit,
+) {
+    val context = LocalContext.current
+    var isRecording by remember { mutableStateOf(false) }
+    var voiceStatus by remember { mutableStateOf<String?>(null) }
+
+    // The voice controller is remembered for the lifetime of the composer; destroyed on leave.
+    val voiceInput = remember {
+        CoachVoiceInput(
+            context = context,
+            onPartial = { partial -> onInputChange(partial) },
+            onFinal = { final ->
+                val trimmed = final.trim()
+                if (trimmed.isNotEmpty()) {
+                    // Append to the draft (not replace) so voice composes with typed text.
+                    val merged = if (input.isBlank()) trimmed else "$input $trimmed"
+                    onInputChange(merged)
+                }
+            },
+            onError = { msg -> voiceStatus = msg },
+        )
+    }
+    // Release the recognizer when the composer leaves composition.
+    androidx.compose.runtime.DisposableEffect(voiceInput) {
+        onDispose { voiceInput.destroy() }
+    }
+
+    // Runtime RECORD_AUDIO permission launcher — raised on the first mic tap if not yet granted.
+    val permLauncher = androidx.activity.compose.rememberLauncherForActivityResult(
+        androidx.activity.result.contract.ActivityResultContracts.RequestPermission(),
+    ) { granted ->
+        if (granted) {
+            voiceInput.start()
+            isRecording = true
+        } else {
+            voiceStatus = context.getString(R.string.coach_voice_permission_denied)
+        }
+    }
+
+    Row(
+        modifier = Modifier
+            .fillMaxWidth()
+            .clip(RoundedCornerShape(18.dp))
+            .background(Palette.surfaceOverlay)
+            .border(1.dp, Palette.hairline, RoundedCornerShape(18.dp))
+            .padding(8.dp),
+        verticalAlignment = Alignment.CenterVertically,
+        horizontalArrangement = Arrangement.spacedBy(10.dp),
+    ) {
+        OutlinedTextField(
+            value = input,
+            onValueChange = onInputChange,
+            modifier = Modifier.weight(1f),
+            placeholder = {
+                Text(
+                    if (isRecording) stringResource(R.string.coach_listening) else uiString(R.string.l10n_coach_screen_ask_your_coach_b1577d4c),
+                    style = NoopType.body,
+                    color = Palette.textTertiary,
+                )
+            },
+            textStyle = NoopType.body,
+            singleLine = false,
+            maxLines = 4,
+            enabled = !sending,
+            colors = coachFieldColors(),
+            shape = RoundedCornerShape(14.dp),
+        )
+
+        // K4: mic button — on-device voice input. Hidden entirely when on-device recognition
+        // is not available (API < 31 or locale without an offline model), matching iOS which
+        // disables voice when `supportsOnDeviceRecognition` is false.
+        if (voiceInput.isAvailable()) {
+            MicButton(
+                isRecording = isRecording,
+                enabled = !sending,
+                statusMessage = voiceStatus,
+                onClick = {
+                    voiceStatus = null
+                    if (isRecording) {
+                        voiceInput.stop()
+                        isRecording = false
+                    } else {
+                        if (voiceInput.isPermissionGranted()) {
+                            voiceInput.start()
+                            isRecording = true
+                        } else {
+                            permLauncher.launch(voiceInput.requiredPermission)
+                        }
+                    }
+                },
+            )
+        }
+
+        SendButton(
+            enabled = input.isNotBlank() && !sending,
+            sending = sending,
+            onClick = onSend,
+        )
+    }
+
+    // Voice status / error line (e.g. "Microphone permission denied" or locale-not-supported).
+    if (voiceStatus != null) {
+        Text(
+            voiceStatus!!,
+            style = NoopType.footnote,
+            color = Palette.textTertiary,
+        )
+    }
+}
+
+@Composable
+private fun MicButton(
+    isRecording: Boolean,
+    enabled: Boolean,
+    statusMessage: String?,
+    onClick: () -> Unit,
+) {
+    val bg = if (isRecording) Palette.statusCritical.copy(alpha = 0.15f) else Palette.surfaceInset
+    val tint = if (isRecording) Palette.statusCritical else Palette.textSecondary
+    val interaction = remember { MutableInteractionSource() }
+    val desc = if (isRecording) "Stop voice input" else "Voice input"
+    val statusSuffix = statusMessage?.let { stringResource(R.string.coach_status_suffix, it) } ?: ""
+    Box(
+        modifier = Modifier
+            .size(48.dp)
+            .clip(RoundedCornerShape(14.dp))
+            .background(bg)
+            .border(1.dp, Palette.hairline, RoundedCornerShape(14.dp))
+            .let {
+                if (enabled)
+                    it
+                        .liquidPress(interaction)
+                        .clickable(interactionSource = interaction, indication = null, onClick = onClick)
+                else it
+            }
+            .semantics {
+                contentDescription = desc + statusSuffix
+            },
+        contentAlignment = Alignment.Center,
+    ) {
+        Icon(
+            if (isRecording) Icons.Filled.Stop else Icons.Filled.Mic,
+            contentDescription = null,
+            tint = tint,
+            modifier = Modifier.size(20.dp),
+        )
+    }
+}
+
 @Composable
 private fun SendButton(enabled: Boolean, sending: Boolean, onClick: () -> Unit) {
     val bg = if (enabled) Palette.accent else Palette.surfaceInset
diff --git a/android/app/src/main/java/com/noop/ui/CoachViewModel.kt b/android/app/src/main/java/com/noop/ui/CoachViewModel.kt
index 4685835142..f9db166d74 100644
--- a/android/app/src/main/java/com/noop/ui/CoachViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/CoachViewModel.kt
@@ -10,6 +10,9 @@ import com.noop.ai.AiKeyStore
 import com.noop.ai.AiProvider
 import com.noop.ai.ChatMsg
 import com.noop.ai.CustomAiAuthHeader
+import com.noop.R
+import com.noop.data.CoachMessageRow
+import com.noop.data.JournalEntry
 import com.noop.data.WhoopDatabase
 import com.noop.data.WhoopRepository
 import kotlinx.coroutines.flow.MutableStateFlow
@@ -17,6 +20,8 @@ import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.launch
 import java.time.LocalDate
+import java.text.SimpleDateFormat
+import java.util.Locale
 
 /**
  * View model for the AI Coach screen.
@@ -42,6 +47,10 @@ class CoachViewModel(app: Application) : AndroidViewModel(app) {
         activeStrapId = { (app as NoopApplication).activeDeviceId },
     )
 
+    // PRD-K2: persisted conversation history (Room `coachMessage` table).
+    private val coachDao = WhoopDatabase.get(app.applicationContext).whoopDao()
+    private var didLoadPersistedMessages = false
+
     // MARK: - Transcript
 
     private val _messages = MutableStateFlow<List<ChatMsg>>(emptyList())
@@ -98,6 +107,43 @@ class CoachViewModel(app: Application) : AndroidViewModel(app) {
     /** True once the user has committed the Custom provider (entered a URL and tapped Connect). */
     val customConnected: StateFlow<Boolean> = _customConnected.asStateFlow()
 
+    // MARK: - Contextual suggestion chips
+
+    private val _suggestions = MutableStateFlow(com.noop.analytics.CoachSuggestions.fallback)
+    /**
+     * Contextual composer chips derived from today's bands (byte-twin of the Swift
+     * `AICoachEngine.suggestions`). Refreshed by [refreshSuggestions]; the UI calls it when the
+     * chat is empty so a fresh sync immediately updates the chips. Falls back to the generic set
+     * when there is no usable data.
+     */
+    val suggestions: StateFlow<List<String>> = _suggestions.asStateFlow()
+
+    /** K7: Follow-up chips shown after each assistant reply. Static, byte-twin of the Swift list. */
+    val followUpSuggestions: List<String> = aiCoach.followUpSuggestions
+
+    /**
+     * K12: Rough token estimate for the next send, based on the current draft + context size.
+     * Uses the standard ~4 chars/token heuristic. Returns null when not configured.
+     */
+    fun estimatedTokens(draft: String): Int? {
+        val app = getApplication<Application>()
+        if (!isConfigured(app.applicationContext)) return null
+        val systemPrompt = AiCoach.resolveSystemPrompt(app.applicationContext)
+        val systemPromptTokens = systemPrompt.length / 4
+        val contextTokens = if (consent.value) 750 else 50
+        val historyTokens = messages.value.sumOf { it.text.length / 4 }
+        val draftTokens = draft.length / 4
+        return systemPromptTokens + contextTokens + historyTokens + draftTokens
+    }
+
+    /** Recompute the contextual chips from the current on-device days. Best-effort; never throws. */
+    fun refreshSuggestions() {
+        viewModelScope.launch {
+            _suggestions.value = runCatching { aiCoach.suggestions() }
+                .getOrDefault(com.noop.analytics.CoachSuggestions.fallback)
+        }
+    }
+
     /** Update (and persist) the Custom provider's base URL as the user types. */
     fun setCustomBaseUrl(ctx: Context, url: String) {
         _customBaseUrl.value = url
@@ -291,8 +337,12 @@ class CoachViewModel(app: Application) : AndroidViewModel(app) {
     }
 
     /**
-     * Send [text] as the next user turn: append it, call the coach, then append the reply.
-     * No-ops on blank input or while a send is already in flight. All failures land in [error].
+     * Send [text] as the next user turn: append it, stream the reply token-by-token into the
+     * transcript, then finalize. K1: uses [AiCoach.chatStream] so the user sees text appear as
+     * it's generated (perceived latency drops from "full reply" to "first token"). No-ops on
+     * blank input or while a send is already in flight. All failures land in [error].
+     *
+     * On error mid-stream, keeps the partial text + an interrupted marker (PRD K1 acceptance).
      */
     fun send(ctx: Context, text: String) {
         val question = text.trim()
@@ -317,34 +367,208 @@ class CoachViewModel(app: Application) : AndroidViewModel(app) {
         appendMessage(ChatMsg(role = "user", text = question))
         _sending.value = true
 
+        // K1: append a placeholder assistant message, then mutate its text as chunks arrive.
+        val placeholderId = java.util.UUID.randomUUID().toString()
+        appendMessage(ChatMsg(id = placeholderId, role = "assistant", text = ""))
+        var accumulated = ""
+
         viewModelScope.launch {
             try {
-                val reply = aiCoach.chat(
+                aiCoach.chatStream(
                     ctx = appCtx,
-                    history = _messages.value,
+                    history = _messages.value.dropLast(1), // exclude the placeholder
                     provider = _provider.value,
                     model = _model.value,
                     consent = _consent.value,
                     customBaseUrl = _customBaseUrl.value,
                     customAuthHeader = _customAuthHeader.value,
-                    // v5: only include the on-device-signals summary when BOTH the data consent is on AND
-                    // the second opt-in is set (summary-only, no raw egress, see AiCoach.buildSignalsContext).
                     includeSignals = _consent.value && NoopPrefs.coachSignals(appCtx),
-                )
-                appendMessage(ChatMsg(role = "assistant", text = reply))
+                ) { delta ->
+                    accumulated += delta
+                    // Replace the placeholder's text with the accumulated stream so far.
+                    _messages.value = _messages.value.map { msg ->
+                        if (msg.id == placeholderId) ChatMsg(id = placeholderId, role = "assistant", text = accumulated)
+                        else msg
+                    }
+                }
+                // Finalize: trim whitespace. If the stream produced nothing, show "(no reply)".
+                val clean = accumulated.trim()
+                _messages.value = _messages.value.map { msg ->
+                    if (msg.id == placeholderId) {
+                        ChatMsg(id = placeholderId, role = "assistant",
+                                text = if (clean.isEmpty()) getApplication<Application>().getString(R.string.coach_no_reply) else clean)
+                    } else msg
+                }
             } catch (e: Exception) {
+                val partial = accumulated.trim()
+                if (partial.isNotEmpty()) {
+                    _messages.value = _messages.value.map { msg ->
+                        if (msg.id == placeholderId) {
+                            ChatMsg(id = placeholderId, role = "assistant",
+                                    text = getApplication<Application>().getString(R.string.coach_stream_interrupted, partial))
+                        } else msg
+                    }
+                } else {
+                    // No text received at all — remove the empty placeholder.
+                    _messages.value = _messages.value.filterNot { it.id == placeholderId }
+                }
                 _error.value = e.message ?: "Something went wrong. Please try again."
             } finally {
                 _sending.value = false
+                // K2: persist once the turn is fully settled (success, mid-stream error, or empty-
+                // stream removal) — not per streamed chunk, so a long reply doesn't hammer the store.
+                persistMessages()
+            }
+        }
+    }
+
+    // MARK: - PRD-K2: persisted conversation history
+
+    /**
+     * Load the conversation persisted by a PRIOR launch, so relaunching doesn't lose it. `suspend` —
+     * NOT fire-and-forget — so the caller (the Coach screen's single `LaunchedEffect`) can await it
+     * before deciding whether the transcript is genuinely empty (K5's `consumeScheduledBriefIfAny`
+     * makes exactly that check). A fire-and-forget `viewModelScope.launch` here would race: this load
+     * could complete AFTER K5 already appended the scheduled brief and unconditionally overwrite it.
+     * Best-effort: a store failure just leaves the transcript empty, matching pre-K2 behaviour.
+     */
+    suspend fun loadPersistedMessagesIfNeeded() {
+        if (didLoadPersistedMessages) return
+        didLoadPersistedMessages = true
+        if (_messages.value.isNotEmpty()) return
+        val rows = runCatching { coachDao.coachMessages() }.getOrDefault(emptyList())
+        if (rows.isEmpty()) return
+        _messages.value = rows.sortedBy { it.orderIndex }
+            .map { ChatMsg(id = it.id, role = it.role, text = it.text) }
+    }
+
+    /** Replace the ENTIRE persisted conversation with the current in-memory [_messages]. Called once
+     *  per completed send/brief (not per streamed chunk). Fire-and-forget; a store failure never
+     *  blocks the UI — the in-memory transcript (what the user sees) is unaffected either way. */
+    private fun persistMessages() {
+        val snapshot = _messages.value
+        val providerId = _provider.value.name
+        viewModelScope.launch {
+            val rows = snapshot.mapIndexed { index, m ->
+                CoachMessageRow(
+                    id = m.id, role = m.role, text = m.text, provider = providerId,
+                    createdAt = System.currentTimeMillis() / 1000, orderIndex = index,
+                )
             }
+            runCatching { coachDao.replaceCoachMessages(rows) }
         }
     }
 
+    /** The Coach toolbar's "Clear conversation" action: wipes both the in-memory transcript and the
+     *  persisted table. */
+    fun clearConversation() {
+        _messages.value = emptyList()
+        viewModelScope.launch { runCatching { coachDao.clearCoachMessages() } }
+    }
+
     /** Dismiss the current error (e.g. when the user edits the input again). */
     fun clearError() {
         _error.value = null
     }
 
+    // MARK: - K8: Copy/Share/Save advice
+
+    /**
+     * K8: Save a coach reply to the journal as a note, so it appears alongside other journal
+     * entries in Insights and can be reviewed later. Uses the existing journal API with a
+     * fixed question ("Coach advice") and the reply text in the notes field.
+     */
+    fun saveAdviceToJournal(text: String) {
+        val app = getApplication<Application>()
+        val day = SimpleDateFormat("yyyy-MM-dd", Locale.US).format(java.util.Date())
+        viewModelScope.launch {
+            runCatching {
+                WhoopRepository(WhoopDatabase.get(app.applicationContext)).upsertJournal(
+                    listOf(
+                        JournalEntry(
+                            deviceId = (app as NoopApplication).activeDeviceId,
+                            day = day,
+                            question = "Coach advice",
+                            answeredYes = true,
+                            notes = text,
+                        )
+                    )
+                )
+            }
+        }
+    }
+
+    // MARK: - K5: scheduled morning-brief notification
+
+    private val _briefEnabled = MutableStateFlow(false)
+    /** Whether the scheduled morning-brief notification is armed. Default OFF. */
+    val briefEnabled: StateFlow<Boolean> = _briefEnabled.asStateFlow()
+
+    private val _briefMinutes = MutableStateFlow(CoachBriefSettings.DEFAULT_TIME)
+    /** Time-of-day (minutes since local midnight) the brief is generated. */
+    val briefMinutes: StateFlow<Int> = _briefMinutes.asStateFlow()
+
+    private val _briefGenerating = MutableStateFlow(false)
+    val briefGenerating: StateFlow<Boolean> = _briefGenerating.asStateFlow()
+
+    private val _briefStatus = MutableStateFlow<String?>(null)
+    /** Non-null after a failed "Generate now" — surfaced once, then cleared by the caller. */
+    val briefStatus: StateFlow<String?> = _briefStatus.asStateFlow()
+
+    /** Load the persisted schedule state. Call once when the Coach settings become visible. */
+    fun loadBriefSettings(ctx: Context) {
+        val settings = CoachBriefSettings.from(ctx.applicationContext)
+        _briefEnabled.value = settings.enabled
+        _briefMinutes.value = settings.timeMinutes
+    }
+
+    /** Enable/disable the schedule and (re)arm the daily WorkManager job. */
+    fun setBriefEnabled(ctx: Context, on: Boolean) {
+        val appCtx = ctx.applicationContext
+        val settings = CoachBriefSettings.from(appCtx)
+        settings.enabled = on
+        _briefEnabled.value = on
+        CoachBriefScheduler.reschedule(appCtx, settings)
+    }
+
+    /** Update the time-of-day and reschedule so the new time takes effect immediately. */
+    fun setBriefMinutes(ctx: Context, minutes: Int) {
+        val appCtx = ctx.applicationContext
+        val settings = CoachBriefSettings.from(appCtx)
+        settings.timeMinutes = minutes
+        _briefMinutes.value = settings.timeMinutes
+        if (settings.enabled) CoachBriefScheduler.applyTimeChange(appCtx, settings)
+    }
+
+    /** The explicit "Generate now" button: always generates, appends the result as a new assistant
+     *  message on success, or surfaces [briefStatus] on failure. Never touches the daily dedup. */
+    fun generateBriefNow(ctx: Context) {
+        if (_briefGenerating.value) return
+        val appCtx = ctx.applicationContext
+        _briefGenerating.value = true
+        _briefStatus.value = null
+        viewModelScope.launch {
+            val text = CoachBriefScheduler.generateNow(appCtx)
+            if (text != null) {
+                appendMessage(ChatMsg(role = "assistant", text = getApplication<Application>().getString(R.string.coach_today_brief_format, text)))
+                persistMessages()
+            } else {
+                _briefStatus.value = "Couldn't generate a brief right now — check your key and data access."
+            }
+            _briefGenerating.value = false
+        }
+    }
+
+    /** Surface a brief the SCHEDULED notification already generated (if any) as the transcript's
+     *  first message, with no network call. No-op if a conversation already exists. Call once when
+     *  the Coach screen appears. */
+    fun consumeScheduledBriefIfAny(ctx: Context) {
+        if (_messages.value.isNotEmpty()) return
+        val text = CoachBriefSettings.from(ctx.applicationContext).consumeStoredBrief() ?: return
+        appendMessage(ChatMsg(role = "assistant", text = getApplication<Application>().getString(R.string.coach_today_brief_format, text)))
+        persistMessages()
+    }
+
     companion object {
         /**
          * Hard rolling cap on the STORED transcript. The network payload is separately windowed inside
diff --git a/android/app/src/main/java/com/noop/ui/CoachVoiceInput.kt b/android/app/src/main/java/com/noop/ui/CoachVoiceInput.kt
new file mode 100644
index 0000000000..d117bd5b9a
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ui/CoachVoiceInput.kt
@@ -0,0 +1,168 @@
+package com.noop.ui
+
+import android.Manifest
+import android.content.Context
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.os.Build
+import android.os.Bundle
+import android.speech.RecognitionListener
+import android.speech.RecognizerIntent
+import android.speech.SpeechRecognizer
+import androidx.core.content.ContextCompat
+import com.noop.R
+
+/**
+ * K4: On-device speech-to-text wrapper for the Coach composer (Android).
+ *
+ * Design contract (see PRD-K4):
+ * - **No raw audio egress.** Uses [SpeechRecognizer.createOnDeviceSpeechRecognizer] (API 31+)
+ *   behind an [SpeechRecognizer.isOnDeviceRecognitionAvailable] gate, so audio is GUARANTEED to
+ *   stay on-device — not merely "preferred". On API < 31 the on-device-only APIs don't exist, so
+ *   voice is disabled entirely (matching iOS, which disables voice when
+ *   `supportsOnDeviceRecognition` is false for the locale). Only the resulting TEXT ever reaches
+ *   the AI provider, via the same channel a typed question uses.
+ * - The mic button lives in the Coach composer; this class is the single source of truth for
+ *   start/stop/permission state.
+ * - Mirrors the iOS `CoachVoiceInput` (SFSpeechRecognizer) twin — feature-level parity, the
+ *   transcript text is the same kind of string a typed question produces.
+ *
+ * Usage:
+ * 1. [isAvailable] gates whether the mic button is shown at all (API 31+ + on-device support).
+ * 2. [isPermissionGranted] / [checkPermission] gate whether the mic button is enabled.
+ * 3. [start] begins a session; [onPartial] fires with the live transcript.
+ * 4. [stop] finalizes and returns the final text via [onFinal].
+ * 5. [destroy] releases the recognizer (call from Compose `DisposableEffect` or `onCleared`).
+ *
+ * This class is NOT a ViewModel — it's a lightweight controller owned by the Compose layer
+ * (the mic button), because SpeechRecognizer must be created and destroyed on the main thread
+ * and tied to the Activity lifecycle, not the ViewModel's wider scope.
+ */
+class CoachVoiceInput(
+    private val context: Context,
+    private val onPartial: (String) -> Unit,
+    private val onFinal: (String) -> Unit,
+    private val onError: (String) -> Unit,
+) {
+
+    private var recognizer: SpeechRecognizer? = null
+    private var isRecording: Boolean = false
+
+    /**
+     * Whether on-device speech recognition is available on this device + locale.
+     * Requires API 31+ (`createOnDeviceSpeechRecognizer` / `isOnDeviceRecognitionAvailable`).
+     * Below API 31, the on-device-only APIs don't exist, so voice is disabled — matching iOS,
+     * which disables voice when `supportsOnDeviceRecognition` is false.
+     */
+    fun isAvailable(): Boolean =
+        Build.VERSION.SDK_INT >= Build.VERSION_CODES.S &&
+            SpeechRecognizer.isOnDeviceRecognitionAvailable(context)
+
+    /** Whether RECORD_AUDIO is already granted. */
+    fun isPermissionGranted(): Boolean =
+        ContextCompat.checkSelfPermission(
+            context,
+            Manifest.permission.RECORD_AUDIO,
+        ) == PackageManager.PERMISSION_GRANTED
+
+    /** The runtime permission to request for voice input. */
+    val requiredPermission: String = Manifest.permission.RECORD_AUDIO
+
+    /** Whether a recognition session is currently active. */
+    fun recording(): Boolean = isRecording
+
+    /**
+     * Begin a recognition session. The on-device SpeechRecognizer is created on the main thread
+     * (per its contract). Uses [createOnDeviceSpeechRecognizer] so audio is guaranteed to stay
+     * on-device — no server fallback is possible.
+     */
+    fun start() {
+        if (isRecording) return
+        if (!isAvailable()) {
+            onError("On-device speech recognition is not available on this device or locale.")
+            return
+        }
+        if (!isPermissionGranted()) {
+            onError("Microphone permission not granted.")
+            return
+        }
+        // SpeechRecognizer must be created on the main thread; this class is called from Compose
+        // which runs there, so we're safe.
+        recognizer?.destroy()
+        recognizer = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
+            SpeechRecognizer.createOnDeviceSpeechRecognizer(context)
+        } else {
+            // Unreachable: isAvailable() gates on API 31+ above.
+            return
+        }
+
+        val intent = Intent(RecognizerIntent.ACTION_RECOGNIZE_SPEECH).apply {
+            putExtra(RecognizerIntent.EXTRA_LANGUAGE_MODEL, RecognizerIntent.LANGUAGE_MODEL_FREE_FORM)
+            // Partial results so the composer updates live as the user speaks.
+            putExtra(RecognizerIntent.EXTRA_PARTIAL_RESULTS, true)
+            // Use the device's current locale.
+            putExtra(RecognizerIntent.EXTRA_LANGUAGE, java.util.Locale.getDefault().toLanguageTag())
+        }
+
+        recognizer?.setRecognitionListener(object : RecognitionListener {
+            override fun onReadyForSpeech(params: Bundle?) {}
+            override fun onBeginningOfSpeech() {}
+            override fun onRmsChanged(rmsdB: Float) {}
+            override fun onBufferReceived(buffer: ByteArray?) {}
+            override fun onEndOfSpeech() {}
+
+            override fun onError(error: Int) {
+                isRecording = false
+                onError(mapError(error))
+            }
+
+            override fun onResults(results: Bundle?) {
+                isRecording = false
+                val text = results
+                    ?.getStringArrayList(SpeechRecognizer.RESULTS_RECOGNITION)
+                    ?.firstOrNull()
+                    .orEmpty()
+                onFinal(text)
+            }
+
+            override fun onPartialResults(partialResults: Bundle?) {
+                val text = partialResults
+                    ?.getStringArrayList(SpeechRecognizer.RESULTS_RECOGNITION)
+                    ?.firstOrNull()
+                    .orEmpty()
+                if (text.isNotEmpty()) onPartial(text)
+            }
+
+            override fun onEvent(eventType: Int, params: Bundle?) {}
+        })
+
+        recognizer?.startListening(intent)
+        isRecording = true
+    }
+
+    /** Stop the active session. The final result (if any) arrives via [onFinal]. */
+    fun stop() {
+        if (!isRecording) return
+        isRecording = false
+        recognizer?.stopListening()
+    }
+
+    /** Release the recognizer. Safe to call multiple times. */
+    fun destroy() {
+        isRecording = false
+        recognizer?.destroy()
+        recognizer = null
+    }
+
+    /** Map platform error codes to a short human-readable message. */
+    private fun mapError(error: Int): String = when (error) {
+        SpeechRecognizer.ERROR_NO_MATCH -> context.getString(R.string.coach_voice_error_no_speech)
+        SpeechRecognizer.ERROR_SPEECH_TIMEOUT -> context.getString(R.string.coach_voice_error_no_speech)
+        SpeechRecognizer.ERROR_AUDIO -> context.getString(R.string.coach_voice_error_audio)
+        SpeechRecognizer.ERROR_RECOGNIZER_BUSY -> context.getString(R.string.coach_voice_error_busy)
+        SpeechRecognizer.ERROR_INSUFFICIENT_PERMISSIONS -> context.getString(R.string.coach_voice_error_permission)
+        SpeechRecognizer.ERROR_CLIENT -> context.getString(R.string.coach_voice_error_generic)
+        SpeechRecognizer.ERROR_SERVER -> context.getString(R.string.coach_voice_error_server)
+        else -> context.getString(R.string.coach_voice_error_generic)
+    }
+}
diff --git a/android/app/src/main/java/com/noop/ui/MainActivity.kt b/android/app/src/main/java/com/noop/ui/MainActivity.kt
index fa08f93818..236850d89d 100644
--- a/android/app/src/main/java/com/noop/ui/MainActivity.kt
+++ b/android/app/src/main/java/com/noop/ui/MainActivity.kt
@@ -118,6 +118,9 @@ class MainActivity : ComponentActivity() {
         // feature is off). Wrapped because a WorkManager hiccup must never block launch.
         runCatching { DebugExportScheduler.reschedule(applicationContext) }
 
+        // K5: self-heal the scheduled Coach morning-brief job (no-op when off / already scheduled).
+        runCatching { CoachBriefScheduler.reschedule(applicationContext) }
+
         // Backup & Sync (#791): self-heal the daily auto-backup schedule (no-op when off / no folder),
         // and run a DEFERRED on-launch catch-up backup. Must-fix #4: the catch-up is gated on the toggle
         // being ON, runs fully off the main thread on Dispatchers.IO, and is launched AFTER the
@@ -1084,6 +1087,18 @@ object NoopPrefs {
         of(context).edit().putBoolean(KEY_COACH_SIGNALS, enabled).apply()
     }
 
+    /** K11: Coach multimodal chart image (opt-in, default OFF). When ON and the provider is Gemini,
+     *  a chart snapshot is sent as inline_data alongside the text. A THIRD opt-in on top of the
+     *  existing data consent. Only Gemini supports multimodal input. */
+    const val KEY_COACH_MULTIMODAL = "noop.coachMultimodal"
+
+    fun coachMultimodal(context: Context): Boolean =
+        of(context).getBoolean(KEY_COACH_MULTIMODAL, false)
+
+    fun setCoachMultimodal(context: Context, enabled: Boolean) {
+        of(context).edit().putBoolean(KEY_COACH_MULTIMODAL, enabled).apply()
+    }
+
     /** The user's EDITED Coach system prompt. Empty/absent means "use the built-in default". A small,
      *  non-secret text key, read FRESH per request so an edit takes effect on the next message. Mirrors
      *  macOS/iOS UserDefaults "ai.systemPrompt". */
diff --git a/android/app/src/main/java/com/noop/widget/CoachBriefGlanceWidget.kt b/android/app/src/main/java/com/noop/widget/CoachBriefGlanceWidget.kt
new file mode 100644
index 0000000000..c486c7f5ac
--- /dev/null
+++ b/android/app/src/main/java/com/noop/widget/CoachBriefGlanceWidget.kt
@@ -0,0 +1,120 @@
+package com.noop.widget
+
+import android.content.Context
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
+import androidx.glance.GlanceId
+import androidx.glance.GlanceModifier
+import androidx.glance.LocalContext
+import androidx.glance.action.actionStartActivity
+import androidx.glance.action.clickable
+import androidx.glance.appwidget.GlanceAppWidget
+import androidx.glance.appwidget.cornerRadius
+import androidx.glance.appwidget.provideContent
+import androidx.glance.background
+import androidx.glance.layout.Alignment
+import androidx.glance.layout.Column
+import androidx.glance.layout.Row
+import androidx.glance.layout.Spacer
+import androidx.glance.layout.fillMaxSize
+import androidx.glance.layout.fillMaxWidth
+import androidx.glance.layout.height
+import androidx.glance.layout.padding
+import androidx.glance.text.FontWeight
+import androidx.glance.text.Text
+import androidx.glance.text.TextStyle
+import androidx.glance.unit.ColorProvider
+import com.noop.R
+import com.noop.ui.MainActivity
+import java.text.DateFormat
+import java.util.Date
+
+/**
+ * K10: Home-screen widget showing the stored Coach morning brief (Android twin of the iOS
+ * `CoachBriefWidget`). Renders purely from the `noop_widget` SharedPreferences — no network,
+ * no DB. The brief is generated on a schedule by [com.noop.ui.CoachBriefScheduler] (K5) and
+ * mirrored into the widget's prefs via `publishToWidget`. Tap → opens the app.
+ *
+ * Design contract (PRD-K10 + D8): the widget reads STORED brief text, NEVER calls the network.
+ * The brief text is generated on-device on a schedule, not live-networked in the widget.
+ */
+class CoachBriefGlanceWidget : GlanceAppWidget() {
+
+    override suspend fun provideGlance(context: Context, id: GlanceId) {
+        val prefs = context.getSharedPreferences("noop_widget", Context.MODE_PRIVATE)
+        val briefText = prefs.getString("coachBriefText", null)
+        val briefDateMs = prefs.getLong("coachBriefDateMs", 0L)
+        val dark = runCatching {
+            when (context.getSharedPreferences("noop_prefs", Context.MODE_PRIVATE)
+                .getString("theme.appearance", "system")) {
+                "light" -> false
+                "dark" -> true
+                else -> (context.resources.configuration.uiMode and
+                    android.content.res.Configuration.UI_MODE_NIGHT_MASK) ==
+                    android.content.res.Configuration.UI_MODE_NIGHT_YES
+            }
+        }.getOrDefault(true)
+        provideContent { CoachBriefWidgetContent(briefText, briefDateMs, dark) }
+    }
+}
+
+@Composable
+private fun CoachBriefWidgetContent(briefText: String?, briefDateMs: Long, dark: Boolean) {
+    val context = LocalContext.current
+    val surface = ColorProvider(if (dark) Color(0xFF0A1322) else Color(0xFFF4F1EA))
+    val textPrimary = ColorProvider(if (dark) Color(0xFFF4F6F8) else Color(0xFF1A2230))
+    val textSecondary = ColorProvider(if (dark) Color(0xFF8A94A4) else Color(0xFF7C8696))
+    val accent = ColorProvider(if (dark) Color(0xFFE8B84B) else Color(0xFFB07D17))
+
+    Column(
+        modifier = GlanceModifier
+            .fillMaxSize()
+            .background(surface)
+            .cornerRadius(16.dp)
+            .clickable(actionStartActivity<MainActivity>())
+            .padding(horizontal = 14.dp, vertical = 12.dp),
+        horizontalAlignment = Alignment.Start,
+        verticalAlignment = Alignment.Top,
+    ) {
+        // Header: "Coach Brief" + time
+        Row(
+            modifier = GlanceModifier.fillMaxWidth(),
+            horizontalAlignment = Alignment.Start,
+            verticalAlignment = Alignment.CenterVertically,
+        ) {
+            Text(
+                text = context.getString(R.string.coach_brief_widget_title),
+                style = TextStyle(color = accent, fontSize = 13.sp, fontWeight = FontWeight.Bold),
+            )
+            Spacer(modifier = GlanceModifier.defaultWeight())
+            if (briefDateMs > 0L) {
+                val timeStr = DateFormat.getTimeInstance(DateFormat.SHORT).format(Date(briefDateMs))
+                Text(
+                    text = timeStr,
+                    style = TextStyle(color = textSecondary, fontSize = 11.sp),
+                )
+            }
+        }
+        Spacer(modifier = GlanceModifier.height(8.dp))
+        if (briefText == null) {
+            Text(
+                text = context.getString(R.string.coach_brief_widget_empty),
+                style = TextStyle(color = textSecondary, fontSize = 14.sp, fontWeight = FontWeight.Medium),
+            )
+            Spacer(modifier = GlanceModifier.height(4.dp))
+            Text(
+                text = context.getString(R.string.coach_brief_widget_enable),
+                style = TextStyle(color = textSecondary, fontSize = 11.sp),
+            )
+        } else {
+            // Show the first few lines of the brief, capped so it fits the widget.
+            val displayText = briefText.lines().filter { it.isNotBlank() }.take(4).joinToString("\n")
+            Text(
+                text = displayText,
+                style = TextStyle(color = textPrimary, fontSize = 12.sp),
+            )
+        }
+    }
+}
diff --git a/android/app/src/main/java/com/noop/widget/CoachBriefWidgetReceiver.kt b/android/app/src/main/java/com/noop/widget/CoachBriefWidgetReceiver.kt
new file mode 100644
index 0000000000..9c69fb2b73
--- /dev/null
+++ b/android/app/src/main/java/com/noop/widget/CoachBriefWidgetReceiver.kt
@@ -0,0 +1,9 @@
+package com.noop.widget
+
+import androidx.glance.appwidget.GlanceAppWidget
+import androidx.glance.appwidget.GlanceAppWidgetReceiver
+
+/** K10: Manifest entry point for the Coach brief home-screen widget. */
+class CoachBriefWidgetReceiver : GlanceAppWidgetReceiver() {
+    override val glanceAppWidget: GlanceAppWidget = CoachBriefGlanceWidget()
+}
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index e8c7ff7cd1..2588dfd880 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -1875,6 +1875,12 @@
     <string name="smart_alarm_body">Dein Smart-Wecker hat gerade geklingelt.</string>
     <string name="battery_channel_name">Akku-Hinweise</string>
     <string name="battery_channel_desc">Hinweise, wenn der Strap-Akku schwach oder voll geladen ist.</string>
+    <!-- K5: scheduled Coach morning-brief notification. -->
+    <string name="coach_brief_channel_name">Coach-Morgenbrief</string>
+    <string name="coach_brief_channel_desc">Heutiger Coaching-Brief, auf dem Gerät zur gewählten Zeit generiert.</string>
+    <string name="coach_brief_title">Heutiger Coaching-Brief</string>
+    <string name="coach_brief_unavailable_title">Coach-Brief nicht verfügbar</string>
+    <string name="coach_brief_unavailable_body">Heutiger Brief konnte nicht generiert werden. Öffne Coach, um es erneut zu versuchen.</string>
     <string name="l10n_app_changelog_battery_saver_quiets_the_gauges_translated_bdbe8650">Energiesparmodus beruhigt die Anzeigen, übersetzte Android-Benachrichtigungen und sofort geladene Diagramme</string>
     <string name="l10n_health_screen_no_spo_import_or_health_value_408f8c55">Kein SpO₂-Import- oder Health-Wert</string>
     <string name="l10n_health_screen_raw_counts_only_needs_an_import_d0e33552">Nur Rohwerte — Import erforderlich</string>
@@ -2696,4 +2702,37 @@
     <string name="l10n_settings_screen_bar_size_2304bfbb">Leistengröße</string>
     <string name="l10n_settings_screen_bar_transparency_3f648fbb">Transparenz der Leiste</string>
     <string name="l10n_settings_screen_how_see_through_the_bar_is_ddb0c208">Wie durchsichtig die Leiste ist. Die schwächste Stufe zeigt weiterhin ihren Rand, damit sie immer auffindbar bleibt.</string>
+
+    <!-- Coach screen -->
+    <string name="coach_clear_conversation_confirm">Unterhaltung löschen?</string>
+    <string name="coach_clear_conversation_message">Dies löscht die gespeicherte Unterhaltung von diesem Gerät. Der Coach-Verlauf sind deine eigenen Notizen, kein medizinischer Rat.</string>
+    <string name="coach_clear_action">Löschen</string>
+    <string name="coach_token_estimate">~%1$d Token</string>
+    <string name="coach_token_warning"> · kann kleine Kontextfenster überschreiten</string>
+    <string name="coach_morning_brief">Morgenbrief</string>
+    <string name="coach_morning_brief_desc">Eine lokale Benachrichtigung mit heutiger Bereitschaft + Trainingsplan, jeden Morgen auf dem Gerät erstellt.</string>
+    <string name="coach_morning_brief_off">Aus: Es wird nichts generiert oder nach Zeitplan gesendet.</string>
+    <string name="coach_morning_brief_time">Uhrzeit</string>
+    <string name="coach_morning_brief_best_effort">Best-Effort: Android entscheidet genau, wann eine App im Hintergrund erwacht, um es zu erstellen.</string>
+    <string name="coach_copy_action">Kopieren</string>
+    <string name="coach_share_action">Teilen</string>
+    <string name="coach_save_to_journal">Im Tagebuch speichern</string>
+    <string name="coach_listening">Lausche…</string>
+    <string name="coach_generating">Wird erstellt…</string>
+    <string name="coach_generate_now">Jetzt erstellen</string>
+    <string name="coach_status_suffix">: %1$s</string>
+    <string name="coach_no_reply">(keine Antwort)</string>
+    <string name="coach_stream_interrupted">%1$s\n\n*(Stream unterbrochen)*</string>
+    <string name="coach_today_brief_format">Heutiger Brief\n\n%1$s</string>
+    <string name="coach_brief_widget_title">✦ Coach-Brief</string>
+    <string name="coach_brief_widget_empty">Noch kein Brief</string>
+    <string name="coach_brief_widget_enable">Aktiviere den Morgenbrief in den Coach-Einstellungen, um die heutige Bereitschaft hier zu sehen.</string>
+    <string name="coach_voice_error_no_speech">Keine Sprache erkannt.</string>
+    <string name="coach_voice_error_audio">Audioaufnahme fehlgeschlagen.</string>
+    <string name="coach_voice_error_busy">Spracherkennung ist beschäftigt. Versuchen Sie es erneut.</string>
+    <string name="coach_voice_error_permission">Mikrofonberechtigung verweigert.</string>
+    <string name="coach_voice_error_generic">Spracheingabe fehlgeschlagen. Versuchen Sie es erneut.</string>
+    <string name="coach_voice_error_server">On-Device-Spracherkennung für diese Sprache nicht verfügbar.</string>
+    <string name="coach_voice_unavailable">On-Device-Spracherkennung ist auf diesem Gerät oder für diese Sprache nicht verfügbar.</string>
+    <string name="coach_voice_permission_denied">Mikrofonberechtigung verweigert. Aktivieren Sie sie in den Einstellungen, um die Spracheingabe zu nutzen.</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 27677ed36c..a483f9d41d 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -1843,6 +1843,12 @@
     <string name="smart_alarm_body">Tu alarma inteligente acaba de sonar.</string>
     <string name="battery_channel_name">Alertas de batería</string>
     <string name="battery_channel_desc">Avisos cuando la batería de la pulsera está baja o completamente cargada.</string>
+    <!-- K5: scheduled Coach morning-brief notification. -->
+    <string name="coach_brief_channel_name">Resumen matutino del Coach</string>
+    <string name="coach_brief_channel_desc">Resumen de coaching de hoy, generado en el dispositivo a la hora elegida.</string>
+    <string name="coach_brief_title">Resumen de coaching de hoy</string>
+    <string name="coach_brief_unavailable_title">Resumen del Coach no disponible</string>
+    <string name="coach_brief_unavailable_body">No se pudo generar el resumen de hoy. Abre Coach para intentar de nuevo.</string>
     <string name="l10n_app_changelog_battery_saver_quiets_the_gauges_translated_bdbe8650">El ahorro de batería calma los indicadores, notificaciones de Android traducidas y gráficos instantáneos</string>
     <string name="l10n_health_screen_no_spo_import_or_health_value_408f8c55">Sin importación de SpO₂ ni valor de Health</string>
     <string name="l10n_health_screen_raw_counts_only_needs_an_import_d0e33552">Solo valores brutos — requiere importación</string>
@@ -2683,4 +2689,37 @@
     <string name="l10n_settings_screen_bar_size_2304bfbb">Tamaño de la barra</string>
     <string name="l10n_settings_screen_bar_transparency_3f648fbb">Transparencia de la barra</string>
     <string name="l10n_settings_screen_how_see_through_the_bar_is_ddb0c208">Cuánto se transparenta la barra. El nivel más tenue sigue mostrando su borde, así que siempre se puede encontrar.</string>
+
+    <!-- Coach screen -->
+    <string name="coach_clear_conversation_confirm">¿Borrar conversación?</string>
+    <string name="coach_clear_conversation_message">Esto borra la conversación guardada de este dispositivo. El historial del Coach son tus propias notas, no consejo médico.</string>
+    <string name="coach_clear_action">Borrar</string>
+    <string name="coach_token_estimate">~%1$d tokens</string>
+    <string name="coach_token_warning"> · puede superar ventanas de contexto pequeñas</string>
+    <string name="coach_morning_brief">Resumen matutino</string>
+    <string name="coach_morning_brief_desc">Una notificación local con la preparación + plan de entrenamiento de hoy, generada en el dispositivo cada mañana.</string>
+    <string name="coach_morning_brief_off">Desactivado: no se genera ni se envía nada según un horario.</string>
+    <string name="coach_morning_brief_time">Hora</string>
+    <string name="coach_morning_brief_best_effort">Mejor esfuerzo: Android decide exactamente cuándo una app en segundo plano se despierta para generarlo.</string>
+    <string name="coach_copy_action">Copiar</string>
+    <string name="coach_share_action">Compartir</string>
+    <string name="coach_save_to_journal">Guardar en el diario</string>
+    <string name="coach_listening">Escuchando…</string>
+    <string name="coach_generating">Generando…</string>
+    <string name="coach_generate_now">Generar ahora</string>
+    <string name="coach_status_suffix">: %1$s</string>
+    <string name="coach_no_reply">(sin respuesta)</string>
+    <string name="coach_stream_interrupted">%1$s\n\n*(transmisión interrumpida)*</string>
+    <string name="coach_today_brief_format">Resumen de hoy\n\n%1$s</string>
+    <string name="coach_brief_widget_title">✦ Resumen del Coach</string>
+    <string name="coach_brief_widget_empty">Aún no hay resumen</string>
+    <string name="coach_brief_widget_enable">Activa el Resumen matutino en los ajustes del Coach para ver la preparación de hoy aquí.</string>
+    <string name="coach_voice_error_no_speech">No se detectó voz.</string>
+    <string name="coach_voice_error_audio">Error de grabación de audio.</string>
+    <string name="coach_voice_error_busy">El reconocedor de voz está ocupado. Inténtelo de nuevo.</string>
+    <string name="coach_voice_error_permission">Permiso de micrófono denegado.</string>
+    <string name="coach_voice_error_generic">Error de entrada de voz. Inténtelo de nuevo.</string>
+    <string name="coach_voice_error_server">El reconocimiento de voz en el dispositivo no está disponible para este idioma.</string>
+    <string name="coach_voice_unavailable">El reconocimiento de voz en el dispositivo no está disponible en este dispositivo o idioma.</string>
+    <string name="coach_voice_permission_denied">Permiso de micrófono denegado. Actívalo en Configuración para usar la entrada de voz.</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 6983a7af9f..e40a386295 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -1861,6 +1861,12 @@
     <string name="smart_alarm_body">Votre alarme intelligente vient de sonner.</string>
     <string name="battery_channel_name">Alertes de batterie</string>
     <string name="battery_channel_desc">Alertes lorsque la batterie du bracelet est faible ou complètement chargée.</string>
+    <!-- K5: scheduled Coach morning-brief notification. -->
+    <string name="coach_brief_channel_name">Brief matinal du Coach</string>
+    <string name="coach_brief_channel_desc">"Brief de coaching du jour, généré sur l'appareil à l'heure choisie."</string>
+    <string name="coach_brief_title">Brief de coaching du jour</string>
+    <string name="coach_brief_unavailable_title">Brief du Coach indisponible</string>
+    <string name="coach_brief_unavailable_body">Impossible de générer le brief du jour. Ouvrez Coach pour réessayer.</string>
     <string name="l10n_app_changelog_battery_saver_quiets_the_gauges_translated_bdbe8650">L\'économiseur de batterie fige les jauges, notifications Android traduites et graphiques instantanés</string>
     <string name="l10n_health_screen_no_spo_import_or_health_value_408f8c55">Aucune importation SpO₂ ni valeur Santé</string>
     <string name="l10n_health_screen_raw_counts_only_needs_an_import_d0e33552">Valeurs brutes uniquement — importation requise</string>
@@ -2682,4 +2688,37 @@
     <string name="l10n_settings_screen_bar_size_2304bfbb">Taille de la barre</string>
     <string name="l10n_settings_screen_bar_transparency_3f648fbb">Transparence de la barre</string>
     <string name="l10n_settings_screen_how_see_through_the_bar_is_ddb0c208">À quel point la barre est transparente. Le niveau le plus faible affiche encore son contour, elle reste donc toujours repérable.</string>
+
+    <!-- Coach screen -->
+    <string name="coach_clear_conversation_confirm">Effacer la conversation ?</string>
+    <string name="coach_clear_conversation_message">"Ceci efface la conversation enregistrée de cet appareil. L'historique du Coach est constitué de vos propres notes, pas d'un avis médical."</string>
+    <string name="coach_clear_action">Effacer</string>
+    <string name="coach_token_estimate">~%1$d jetons</string>
+    <string name="coach_token_warning"> · peut dépasser les petites fenêtres de contexte</string>
+    <string name="coach_morning_brief">Brief matinal</string>
+    <string name="coach_morning_brief_desc">"Une notification locale avec la préparation + le plan d'entraînement du jour, générée sur l'appareil chaque matin."</string>
+    <string name="coach_morning_brief_off">"Désactivé : rien n'est généré ni envoyé selon un calendrier."</string>
+    <string name="coach_morning_brief_time">Heure</string>
+    <string name="coach_morning_brief_best_effort">Au mieux : Android décide exactement quand une app en arrière-plan se réveille pour le générer.</string>
+    <string name="coach_copy_action">Copier</string>
+    <string name="coach_share_action">Partager</string>
+    <string name="coach_save_to_journal">Enregistrer dans le journal</string>
+    <string name="coach_listening">Écoute…</string>
+    <string name="coach_generating">Génération…</string>
+    <string name="coach_generate_now">Générer maintenant</string>
+    <string name="coach_status_suffix"> : %1$s</string>
+    <string name="coach_no_reply">(pas de réponse)</string>
+    <string name="coach_stream_interrupted">%1$s\n\n*(flux interrompu)*</string>
+    <string name="coach_today_brief_format">Brief du jour\n\n%1$s</string>
+    <string name="coach_brief_widget_title">✦ Brief du Coach</string>
+    <string name="coach_brief_widget_empty">Pas encore de brief</string>
+    <string name="coach_brief_widget_enable">"Activez le Brief matinal dans les réglages du Coach pour voir la préparation d'aujourd'hui ici."</string>
+    <string name="coach_voice_error_no_speech">Aucune parole détectée.</string>
+    <string name="coach_voice_error_audio">Échec de l\'enregistrement audio.</string>
+    <string name="coach_voice_error_busy">Le module de reconnaissance vocale est occupé. Réessayez.</string>
+    <string name="coach_voice_error_permission">Autorisation du microphone refusée.</string>
+    <string name="coach_voice_error_generic">Échec de la saisie vocale. Réessayez.</string>
+    <string name="coach_voice_error_server">La reconnaissance vocale sur l\'appareil n\'est pas disponible pour cette langue.</string>
+    <string name="coach_voice_unavailable">La reconnaissance vocale sur l\'appareil n\'est pas disponible sur cet appareil ou pour cette langue.</string>
+    <string name="coach_voice_permission_denied">Autorisation du microphone refusée. Activez-la dans les Paramètres pour utiliser la saisie vocale.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 3d0af0c810..3b72ad2379 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -1829,6 +1829,12 @@
     <string name="smart_alarm_body">Twój inteligentny alarm właśnie się włączył.</string>
     <string name="battery_channel_name">Alerty dotyczące baterii</string>
     <string name="battery_channel_desc">Ostrzega, gdy poziom naładowania baterii paska jest niski lub jest w pełni naładowany.</string>
+    <!-- K5: scheduled Coach morning-brief notification. -->
+    <string name="coach_brief_channel_name">Poranny briefing Coach</string>
+    <string name="coach_brief_channel_desc">Dzisiejszy briefing coachingowy, generowany na urządzeniu o wybranej porie.</string>
+    <string name="coach_brief_title">Dzisiejszy briefing coachingowy</string>
+    <string name="coach_brief_unavailable_title">Briefing Coach niedostępny</string>
+    <string name="coach_brief_unavailable_body">Nie udało się wygenerować dzisiejszego briefingu. Otwórz Coach, aby spróbować ponownie.</string>
     <string name="l10n_app_changelog_battery_saver_quiets_the_gauges_translated_bdbe8650">Oszczędzanie baterii wycisza wskaźniki, przetłumaczone powiadomienia Android i natychmiastowe ładowanie wykresów</string>
     <string name="l10n_health_screen_no_spo_import_or_health_value_408f8c55">Brak importu SpO₂ lub wartości kondycji</string>
     <string name="l10n_health_screen_raw_counts_only_needs_an_import_d0e33552">Liczy się tylko surowy — wymaga importu</string>
@@ -2687,4 +2693,37 @@
     <string name="l10n_settings_screen_bar_size_2304bfbb">Rozmiar paska</string>
     <string name="l10n_settings_screen_bar_transparency_3f648fbb">Przezroczystość paska</string>
     <string name="l10n_settings_screen_how_see_through_the_bar_is_ddb0c208">Jak bardzo pasek jest przezroczysty. Najsłabszy stopień nadal pokazuje jego obramowanie, więc zawsze można go znaleźć.</string>
+
+    <!-- Coach screen -->
+    <string name="coach_clear_conversation_confirm">Wyczyścić rozmowę?</string>
+    <string name="coach_clear_conversation_message">To usuwa zapisaną rozmowę z tego urządzenia. Historia Trenera to twoje własne notatki, a nie porada medyczna.</string>
+    <string name="coach_clear_action">Wyczyść</string>
+    <string name="coach_token_estimate">~%1$d tokenów</string>
+    <string name="coach_token_warning"> · może przekroczyć małe okna kontekstu</string>
+    <string name="coach_morning_brief">Poranne podsumowanie</string>
+    <string name="coach_morning_brief_desc">Lokalne powiadomienie z dzisiejszą gotowością + planem treningu, generowane na urządzeniu każdego ranka.</string>
+    <string name="coach_morning_brief_off">Wyłączone: nic nie jest generowane ani wysyłane według harmonogramu.</string>
+    <string name="coach_morning_brief_time">Czas</string>
+    <string name="coach_morning_brief_best_effort">Najlepsze staranie: Android decyduje dokładnie, kiedy uśpiona aplikacja się budzi, aby to wygenerować.</string>
+    <string name="coach_copy_action">Kopiuj</string>
+    <string name="coach_share_action">Udostępnij</string>
+    <string name="coach_save_to_journal">Zapisz w dzienniku</string>
+    <string name="coach_listening">Nasłuchiwanie…</string>
+    <string name="coach_generating">Generowanie…</string>
+    <string name="coach_generate_now">Wygeneruj teraz</string>
+    <string name="coach_status_suffix">: %1$s</string>
+    <string name="coach_no_reply">(brak odpowiedzi)</string>
+    <string name="coach_stream_interrupted">%1$s\n\n*(strumień przerwany)*</string>
+    <string name="coach_today_brief_format">Dzisiejsze podsumowanie\n\n%1$s</string>
+    <string name="coach_brief_widget_title">✦ Podsumowanie Trenera</string>
+    <string name="coach_brief_widget_empty">Brak podsumowania</string>
+    <string name="coach_brief_widget_enable">Włącz poranne podsumowanie w ustawieniach Trenera, aby zobaczyć tu dzisiejszą gotowość.</string>
+    <string name="coach_voice_error_no_speech">Nie wykryto mowy.</string>
+    <string name="coach_voice_error_audio">Nie udało się nagrać dźwięku.</string>
+    <string name="coach_voice_error_busy">Rozpoznawanie mowy jest zajęte. Spróbuj ponownie.</string>
+    <string name="coach_voice_error_permission">Odmowa uprawnień do mikrofonu.</string>
+    <string name="coach_voice_error_generic">Wprowadzanie głosowe nie powiodło się. Spróbuj ponownie.</string>
+    <string name="coach_voice_error_server">Rozpoznawanie mowy na urządzeniu jest niedostępne dla tego języka.</string>
+    <string name="coach_voice_unavailable">Rozpoznawanie mowy na urządzeniu nie jest dostępne na tym urządzeniu lub w tym języku.</string>
+    <string name="coach_voice_permission_denied">Odmowa uprawnień do mikrofonu. Włącz je w Ustawieniach, aby używać wprowadzania głosowego.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 8d26427997..74a240f7d4 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -1836,6 +1836,12 @@
     <string name="smart_alarm_body">O teu alarme inteligente acabou de tocar.</string>
     <string name="battery_channel_name">Alertas de bateria</string>
     <string name="battery_channel_desc">Avisos quando a bateria da correia está fraca ou totalmente carregada.</string>
+    <!-- K5: scheduled Coach morning-brief notification. -->
+    <string name="coach_brief_channel_name">Resumo matinal do Coach</string>
+    <string name="coach_brief_channel_desc">Resumo de coaching de hoje, gerado no dispositivo à hora escolhida.</string>
+    <string name="coach_brief_title">Resumo de coaching de hoje</string>
+    <string name="coach_brief_unavailable_title">Resumo do Coach indisponível</string>
+    <string name="coach_brief_unavailable_body">Não foi possível gerar o resumo de hoje. Abra o Coach para tentar novamente.</string>
     <string name="l10n_app_changelog_battery_saver_quiets_the_gauges_translated_bdbe8650">A poupança de bateria acalma os indicadores, notificações Android traduzidas e gráficos instantâneos</string>
     <string name="l10n_health_screen_no_spo_import_or_health_value_408f8c55">Sem importação de SpO₂ ou valor de saúde</string>
     <string name="l10n_health_screen_raw_counts_only_needs_an_import_d0e33552">Apenas valores brutos — requer importação</string>
@@ -2675,4 +2681,37 @@
     <string name="l10n_settings_screen_bar_size_2304bfbb">Tamanho da barra</string>
     <string name="l10n_settings_screen_bar_transparency_3f648fbb">Transparência da barra</string>
     <string name="l10n_settings_screen_how_see_through_the_bar_is_ddb0c208">Quão transparente é a barra. O nível mais ténue continua a mostrar o contorno, por isso pode sempre ser encontrada.</string>
+
+    <!-- Coach screen -->
+    <string name="coach_clear_conversation_confirm">Apagar conversa?</string>
+    <string name="coach_clear_conversation_message">Isto apaga a conversa guardada deste dispositivo. O histórico do Coach são as tuas próprias notas, não aconselhamento médico.</string>
+    <string name="coach_clear_action">Apagar</string>
+    <string name="coach_token_estimate">~%1$d tokens</string>
+    <string name="coach_token_warning"> · pode exceder janelas de contexto pequenas</string>
+    <string name="coach_morning_brief">Resumo matinal</string>
+    <string name="coach_morning_brief_desc">Uma notificação local com a prontidão + plano de treino de hoje, gerada no dispositivo todas as manhãs.</string>
+    <string name="coach_morning_brief_off">Desativado: nada é gerado nem enviado num agendamento.</string>
+    <string name="coach_morning_brief_time">Hora</string>
+    <string name="coach_morning_brief_best_effort">Melhor esforço: o Android decide exatamente quando uma app em segundo plano acorda para o gerar.</string>
+    <string name="coach_copy_action">Copiar</string>
+    <string name="coach_share_action">Partilhar</string>
+    <string name="coach_save_to_journal">Guardar no diário</string>
+    <string name="coach_listening">A ouvir…</string>
+    <string name="coach_generating">A gerar…</string>
+    <string name="coach_generate_now">Gerar agora</string>
+    <string name="coach_status_suffix">: %1$s</string>
+    <string name="coach_no_reply">(sem resposta)</string>
+    <string name="coach_stream_interrupted">%1$s\n\n*(transmissão interrompida)*</string>
+    <string name="coach_today_brief_format">Resumo de hoje\n\n%1$s</string>
+    <string name="coach_brief_widget_title">✦ Resumo do Coach</string>
+    <string name="coach_brief_widget_empty">Ainda sem resumo</string>
+    <string name="coach_brief_widget_enable">Ativa o Resumo matinal nas definições do Coach para veres a prontidão de hoje aqui.</string>
+    <string name="coach_voice_error_no_speech">Nenhuma fala detectada.</string>
+    <string name="coach_voice_error_audio">Falha na gravação de áudio.</string>
+    <string name="coach_voice_error_busy">O reconhecedor de voz está ocupado. Tente novamente.</string>
+    <string name="coach_voice_error_permission">Permissão de microfone negada.</string>
+    <string name="coach_voice_error_generic">Falha na entrada de voz. Tente novamente.</string>
+    <string name="coach_voice_error_server">O reconhecimento de voz no dispositivo não está disponível para este idioma.</string>
+    <string name="coach_voice_unavailable">O reconhecimento de voz no dispositivo não está disponível neste dispositivo ou idioma.</string>
+    <string name="coach_voice_permission_denied">Permissão de microfone negada. Ative-a nas Configurações para usar a entrada de voz.</string>
 </resources>
diff --git a/android/app/src/main/res/values-ru/strings.xml b/android/app/src/main/res/values-ru/strings.xml
index c1a9f618a4..39fa44a0ad 100644
--- a/android/app/src/main/res/values-ru/strings.xml
+++ b/android/app/src/main/res/values-ru/strings.xml
@@ -1351,6 +1351,44 @@
     <string name="l10n_app_root_this_section_is_on_the_way_ca7c4a32">Этот раздел скоро появится.</string>
     <string name="l10n_app_root_updates_c76d1807">Обновления</string>
     <string name="l10n_coach_screen_coach_b32c9ad3">ИИ-тренер</string>
+    <!-- K5: scheduled Coach morning-brief notification. -->
+    <string name="coach_brief_channel_name">Утренний брифинг тренера</string>
+    <string name="coach_brief_channel_desc">Сегодняшний брифинг тренера, генерируется на устройстве в выбранное время.</string>
+    <string name="coach_brief_title">Сегодняшний брифинг тренера</string>
+    <string name="coach_brief_unavailable_title">Брифинг тренера недоступен</string>
+    <string name="coach_brief_unavailable_body">Не удалось сгенерировать сегодняшний брифинг. Откройте тренера, чтобы попробовать снова.</string>
+    <!-- Coach screen: clear-conversation dialog, morning-brief settings, message actions, and voice input. -->
+    <string name="coach_clear_conversation_confirm">Очистить разговор?</string>
+    <string name="coach_clear_conversation_message">Это удалит сохранённый разговор с этого устройства. История тренера — ваши заметки, а не медицинская консультация.</string>
+    <string name="coach_clear_action">Очистить</string>
+    <string name="coach_token_estimate">~%1$d токенов</string>
+    <string name="coach_token_warning"> · может превысить небольшой контекст</string>
+    <string name="coach_morning_brief">Утренний брифинг</string>
+    <string name="coach_morning_brief_desc">Локальное уведомление с сегодняшней готовностью и планом тренировок, генерируется на устройстве каждое утро.</string>
+    <string name="coach_morning_brief_off">Выкл.: ничего не генерируется и не отправляется по расписанию.</string>
+    <string name="coach_morning_brief_time">Время</string>
+    <string name="coach_morning_brief_best_effort">Лучшее усилие: Android решает, когда разбудить фоновое приложение для генерации.</string>
+    <string name="coach_copy_action">Копировать</string>
+    <string name="coach_share_action">Поделиться</string>
+    <string name="coach_save_to_journal">Сохранить в журнал</string>
+    <string name="coach_listening">Слушаю…</string>
+    <string name="coach_generating">Генерация…</string>
+    <string name="coach_generate_now">Сгенерировать сейчас</string>
+    <string name="coach_status_suffix">: %1$s</string>
+    <string name="coach_no_reply">(нет ответа)</string>
+    <string name="coach_stream_interrupted">%1$s\n\n*(поток прерван)*</string>
+    <string name="coach_today_brief_format">Сегодняшний брифинг\n\n%1$s</string>
+    <string name="coach_brief_widget_title">✦ Брифинг тренера</string>
+    <string name="coach_brief_widget_empty">Брифинга пока нет</string>
+    <string name="coach_brief_widget_enable">Включите утренний брифинг в настройках тренера, чтобы видеть сегодняшнюю готовность здесь.</string>
+    <string name="coach_voice_error_no_speech">Речь не распознана.</string>
+    <string name="coach_voice_error_audio">Ошибка записи аудио.</string>
+    <string name="coach_voice_error_busy">Распознаватель речи занят. Попробуйте снова.</string>
+    <string name="coach_voice_error_permission">Разрешение на микрофон отклонено.</string>
+    <string name="coach_voice_error_generic">Ошибка голосового ввода. Попробуйте снова.</string>
+    <string name="coach_voice_error_server">Распознавание речи на устройстве недоступно для этого языка.</string>
+    <string name="coach_voice_unavailable">Распознавание речи на устройстве недоступно на этом устройстве или для этого языка.</string>
+    <string name="coach_voice_permission_denied">Разрешение на микрофон отклонено. Включите его в Настройках, чтобы использовать голосовой ввод.</string>
     <string name="l10n_compare_screen_remove_title_ddb5361c">Удалить %1$s</string>
     <string name="l10n_components_chunks_chunks_pulled_cec186cf">Получено фрагментов: %1$s</string>
     <string name="l10n_components_decrease_accessibility_df5f1511">Уменьшить %1$s</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index a1f6d11ad7..49641b5b56 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -1771,6 +1771,12 @@
     <string name="smart_alarm_body">你的智能闹钟刚刚响了。</string>
     <string name="battery_channel_name">电量提醒</string>
     <string name="battery_channel_desc">当手环电量低或已充满时提醒。</string>
+    <!-- K5: scheduled Coach morning-brief notification. -->
+    <string name="coach_brief_channel_name">教练晨间简报</string>
+    <string name="coach_brief_channel_desc">今日教练简报，在设备上按您选择的时间生成。</string>
+    <string name="coach_brief_title">今日教练简报</string>
+    <string name="coach_brief_unavailable_title">教练简报不可用</string>
+    <string name="coach_brief_unavailable_body">无法生成今日简报。打开教练重试。</string>
     <string name="l10n_app_changelog_battery_saver_quiets_the_gauges_translated_bdbe8650">省电模式让仪表静止、Android 通知已翻译、图表秒开</string>
     <string name="l10n_health_screen_no_spo_import_or_health_value_408f8c55">无 SpO₂ 导入或健康数值</string>
     <string name="l10n_health_screen_raw_counts_only_needs_an_import_d0e33552">仅原始计数 — 需导入</string>
@@ -2596,4 +2602,37 @@
     <string name="l10n_settings_screen_bar_size_2304bfbb">栏大小</string>
     <string name="l10n_settings_screen_bar_transparency_3f648fbb">栏透明度</string>
     <string name="l10n_settings_screen_how_see_through_the_bar_is_ddb0c208">底部栏的透明程度。即使在最淡的一档也会保留边框，因此始终能找到它。</string>
+
+    <!-- Coach screen -->
+    <string name="coach_clear_conversation_confirm">清除对话？</string>
+    <string name="coach_clear_conversation_message">这会从此设备删除已保存的对话。教练记录是你自己的笔记，而非医疗建议。</string>
+    <string name="coach_clear_action">清除</string>
+    <string name="coach_token_estimate">~%1$d 个 token</string>
+    <string name="coach_token_warning"> · 可能超出小型上下文窗口</string>
+    <string name="coach_morning_brief">晨间简报</string>
+    <string name="coach_morning_brief_desc">一条本地通知，包含今天的准备状态和训练计划，每天早晨在设备上生成。</string>
+    <string name="coach_morning_brief_off">关闭：不会按计划生成或发送任何内容。</string>
+    <string name="coach_morning_brief_time">时间</string>
+    <string name="coach_morning_brief_best_effort">尽力而为：Android 自行决定后台应用何时唤醒以生成它。</string>
+    <string name="coach_copy_action">复制</string>
+    <string name="coach_share_action">分享</string>
+    <string name="coach_save_to_journal">保存到日志</string>
+    <string name="coach_listening">聆听中…</string>
+    <string name="coach_generating">生成中…</string>
+    <string name="coach_generate_now">立即生成</string>
+    <string name="coach_status_suffix">：%1$s</string>
+    <string name="coach_no_reply">（无回复）</string>
+    <string name="coach_stream_interrupted">%1$s\n\n*(流已中断)*</string>
+    <string name="coach_today_brief_format">今日简报\n\n%1$s</string>
+    <string name="coach_brief_widget_title">✦ 教练简报</string>
+    <string name="coach_brief_widget_empty">暂无简报</string>
+    <string name="coach_brief_widget_enable">在教练设置中启用晨间简报，即可在此查看今天的准备状态。</string>
+    <string name="coach_voice_error_no_speech">未检测到语音。</string>
+    <string name="coach_voice_error_audio">录音失败。</string>
+    <string name="coach_voice_error_busy">语音识别器正忙。请重试。</string>
+    <string name="coach_voice_error_permission">麦克风权限被拒绝。</string>
+    <string name="coach_voice_error_generic">语音输入失败。请重试。</string>
+    <string name="coach_voice_error_server">此语言不支持设备端语音识别。</string>
+    <string name="coach_voice_unavailable">此设备或语言不支持设备端语音识别。</string>
+    <string name="coach_voice_permission_denied">麦克风权限被拒绝。请在设置中启用以使用语音输入。</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 4e49d12c96..97a4e3c013 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -1973,6 +1973,12 @@
     <string name="smart_alarm_body">Your smart alarm just went off.</string>
     <string name="battery_channel_name">Battery alerts</string>
     <string name="battery_channel_desc">Alerts when the strap battery is low or fully charged.</string>
+    <!-- K5: scheduled Coach morning-brief notification. -->
+    <string name="coach_brief_channel_name">Coach morning brief</string>
+    <string name="coach_brief_channel_desc">Today\'s coaching brief, generated on-device at your chosen time.</string>
+    <string name="coach_brief_title">Today\'s coaching brief</string>
+    <string name="coach_brief_unavailable_title">Coach brief unavailable</string>
+    <string name="coach_brief_unavailable_body">Couldn\'t generate today\'s brief. Open Coach to try again.</string>
     <string name="l10n_app_changelog_battery_saver_quiets_the_gauges_translated_bdbe8650">Battery saver quiets the gauges, translated Android notifications, and instant chart loads</string>
     <string name="l10n_health_screen_no_spo_import_or_health_value_408f8c55">No SpO₂ import or Health value</string>
     <string name="l10n_health_screen_raw_counts_only_needs_an_import_d0e33552">Raw counts only — needs an import</string>
@@ -2709,4 +2715,40 @@
     <string name="l10n_settings_screen_bar_size_2304bfbb">Bar size</string>
     <string name="l10n_settings_screen_bar_transparency_3f648fbb">Bar transparency</string>
     <string name="l10n_settings_screen_how_see_through_the_bar_is_ddb0c208">How see-through the bar is. The faintest step still shows its rim, so it can always be found.</string>
+
+    <!-- Coach screen: clear-conversation dialog, morning-brief settings, message actions, and
+         voice input. Externalized from CoachScreen.kt / CoachViewModel.kt hardcoded literals. -->
+    <string name="coach_clear_conversation_confirm">Clear conversation?</string>
+    <string name="coach_clear_conversation_message">This deletes the saved conversation from this device. Coach history is your own notes, not medical advice.</string>
+    <string name="coach_clear_action">Clear</string>
+    <string name="coach_token_estimate">~%1$d tokens</string>
+    <string name="coach_token_warning"> · may exceed small context windows</string>
+    <string name="coach_morning_brief">Morning brief</string>
+    <string name="coach_morning_brief_desc">A local notification with today\'s readiness + training plan, generated on-device each morning.</string>
+    <string name="coach_morning_brief_off">Off: nothing is generated or sent on a schedule.</string>
+    <string name="coach_morning_brief_time">Time</string>
+    <string name="coach_morning_brief_best_effort">Best-effort: Android decides exactly when a backgrounded app wakes to generate it.</string>
+    <string name="coach_copy_action">Copy</string>
+    <string name="coach_share_action">Share</string>
+    <string name="coach_save_to_journal">Save to Journal</string>
+    <string name="coach_listening">Listening…</string>
+    <string name="coach_generating">Generating…</string>
+    <string name="coach_generate_now">Generate now</string>
+    <string name="coach_status_suffix">: %1$s</string>
+    <string name="coach_no_reply">(no reply)</string>
+    <string name="coach_stream_interrupted">%1$s\n\n*(stream interrupted)*</string>
+    <string name="coach_today_brief_format">Today\'s brief\n\n%1$s</string>
+    <string name="coach_brief_widget_title">✦ Coach Brief</string>
+    <string name="coach_brief_widget_empty">No brief yet</string>
+    <string name="coach_brief_widget_enable">Enable Morning Brief in Coach settings to see today\'s readiness here.</string>
+
+    <!-- K4: voice input error messages (CoachVoiceInput.mapError). -->
+    <string name="coach_voice_error_no_speech">No speech was heard.</string>
+    <string name="coach_voice_error_audio">Audio recording failed.</string>
+    <string name="coach_voice_error_busy">Speech recognizer is busy. Try again.</string>
+    <string name="coach_voice_error_permission">Microphone permission denied.</string>
+    <string name="coach_voice_error_generic">Voice input failed. Try again.</string>
+    <string name="coach_voice_error_server">On-device speech is unavailable for this locale.</string>
+    <string name="coach_voice_unavailable">On-device speech recognition is not available on this device or locale.</string>
+    <string name="coach_voice_permission_denied">Microphone permission denied. Enable it in Settings to use voice input.</string>
 </resources>
diff --git a/android/app/src/main/res/xml/coach_brief_widget_info.xml b/android/app/src/main/res/xml/coach_brief_widget_info.xml
new file mode 100644
index 0000000000..0937c4429b
--- /dev/null
+++ b/android/app/src/main/res/xml/coach_brief_widget_info.xml
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- K10: Coach brief home-screen widget metadata. updatePeriodMillis=0: the app pushes updates
+     through CoachBriefScheduler.publishToWidget whenever a new brief is generated (K5). -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="140dp"
+    android:minHeight="140dp"
+    android:targetCellWidth="2"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:widgetCategory="home_screen"
+    android:updatePeriodMillis="1800000"
+    android:initialLayout="@layout/glance_default_loading_layout" />
diff --git a/android/app/src/test/java/com/noop/analytics/CoachSuggestionsTest.kt b/android/app/src/test/java/com/noop/analytics/CoachSuggestionsTest.kt
new file mode 100644
index 0000000000..3c5b503f64
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/CoachSuggestionsTest.kt
@@ -0,0 +1,170 @@
+package com.noop.analytics
+
+import com.noop.data.DailyMetric
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * Byte-identity pin for the contextual Coach suggestion chips. The same inputs MUST produce the
+ * same chip strings as the Swift twin
+ * `Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CoachSuggestionsTests.swift`.
+ * Cross-platform parity is the contract; if you change a chip string here, change it there in the
+ * same PR.
+ */
+class CoachSuggestionsTest {
+
+    private val fallback = CoachSuggestions.fallback
+
+    /** Build a DailyMetric with only the fields the chip logic reads, everything else null. */
+    private fun metric(
+        day: Int, recovery: Double? = null, hrv: Double? = null,
+        sleepMin: Double? = null, strain: Double? = null,
+    ): DailyMetric = DailyMetric(
+        deviceId = "",
+        day = "%04d-01-%02d".format(2026, day),
+        totalSleepMin = sleepMin,
+        efficiency = null, deepMin = null, remMin = null, lightMin = null, disturbances = null,
+        restingHr = null, avgHrv = hrv, recovery = recovery, strain = strain, exerciseCount = null,
+        spo2Pct = null, skinTempDevC = null, respRateBpm = null, steps = null, activeKcalEst = null,
+        spo2Red = null, spo2Ir = null,
+    )
+
+    // MARK: - No-data fallback
+
+    @Test fun nilTodayReturnsFallback() {
+        assertEquals(fallback, CoachSuggestions.suggestions(null, emptyList()))
+    }
+
+    @Test fun allNullFieldsReturnsFallback() {
+        val today = metric(day = 10) // all four signals null
+        assertEquals(fallback, CoachSuggestions.suggestions(today, emptyList()))
+    }
+
+    // MARK: - Charge bands
+
+    @Test fun lowChargeActiveRecoveryChip() {
+        val today = metric(day = 10, recovery = 20.0)
+        val chips = CoachSuggestions.suggestions(today, emptyList())
+        assertEquals("Active recovery only today — what should I do?", chips.first())
+        assertEquals("Analyse my sleep", chips.last())
+        assertTrue(chips.size in 2..4)
+    }
+
+    @Test fun midChargeQualityOverVolumeChip() {
+        val today = metric(day = 10, recovery = 50.0)
+        val chips = CoachSuggestions.suggestions(today, emptyList())
+        assertEquals("Quality over volume today — plan my session", chips.first())
+    }
+
+    @Test fun highChargeGreenLightChip() {
+        val today = metric(day = 10, recovery = 90.0)
+        val chips = CoachSuggestions.suggestions(today, emptyList())
+        assertEquals("Green light — how hard can I push today?", chips.first())
+    }
+
+    @Test fun chargeBoundary34IsMidBand() {
+        val today = metric(day = 10, recovery = 34.0)
+        assertEquals(
+            "Quality over volume today — plan my session",
+            CoachSuggestions.suggestions(today, emptyList()).first(),
+        )
+    }
+
+    @Test fun chargeBoundary67IsGreenBand() {
+        val today = metric(day = 10, recovery = 67.0)
+        assertEquals(
+            "Green light — how hard can I push today?",
+            CoachSuggestions.suggestions(today, emptyList()).first(),
+        )
+    }
+
+    // MARK: - HRV trending down
+
+    @Test fun hrvBelowBaselineAddsDownChip() {
+        // 30 days of HRV ~60, then today at 45 (< 0.85 * 60 = 51).
+        val recent = (1..30).map { metric(day = it, hrv = 60.0) }
+        val today = metric(day = 31, recovery = 70.0, hrv = 45.0)
+        val chips = CoachSuggestions.suggestions(today, recent)
+        assertTrue(chips.contains("Why is my HRV trending down?"))
+    }
+
+    @Test fun hrvAtBaselineDoesNotAddDownChip() {
+        val recent = (1..30).map { metric(day = it, hrv = 60.0) }
+        val today = metric(day = 31, recovery = 70.0, hrv = 60.0)
+        val chips = CoachSuggestions.suggestions(today, recent)
+        assertFalse(chips.contains("Why is my HRV trending down?"))
+    }
+
+    @Test fun hrvBaselineExcludesToday() {
+        // Today is in `recent` too; it must be excluded from the baseline so a single low day can
+        // still register as "down" against the prior baseline.
+        val recent = (1..30).map { metric(day = it, hrv = 60.0) } + metric(day = 31, recovery = 70.0, hrv = 45.0)
+        val today = metric(day = 31, recovery = 70.0, hrv = 45.0)
+        val chips = CoachSuggestions.suggestions(today, recent)
+        assertTrue(chips.contains("Why is my HRV trending down?"))
+    }
+
+    // MARK: - Poor sleep
+
+    @Test fun poorSleepAddsRecoverChip() {
+        val today = metric(day = 10, recovery = 70.0, sleepMin = 300.0) // 5h
+        val chips = CoachSuggestions.suggestions(today, emptyList())
+        assertTrue(chips.contains("I slept poorly — how do I recover today?"))
+    }
+
+    @Test fun sixHoursIsNotPoor() {
+        val today = metric(day = 10, recovery = 70.0, sleepMin = 360.0) // exactly 6h
+        val chips = CoachSuggestions.suggestions(today, emptyList())
+        assertFalse(chips.contains("I slept poorly — how do I recover today?"))
+    }
+
+    // MARK: - High strain
+
+    @Test fun highStrainAddsLoadedChip() {
+        val today = metric(day = 10, recovery = 70.0, strain = 16.0)
+        val chips = CoachSuggestions.suggestions(today, emptyList())
+        assertTrue(chips.contains("Have I done enough today, or push more?"))
+    }
+
+    @Test fun strainBelow14DoesNotAddLoadedChip() {
+        val today = metric(day = 10, recovery = 70.0, strain = 13.0)
+        val chips = CoachSuggestions.suggestions(today, emptyList())
+        assertFalse(chips.contains("Have I done enough today, or push more?"))
+    }
+
+    // MARK: - Cap + stable generic
+
+    @Test fun allSignalsFireCapsAtFour() {
+        val recent = (1..30).map { metric(day = it, hrv = 60.0) }
+        val today = metric(day = 31, recovery = 20.0, hrv = 40.0, sleepMin = 300.0, strain = 16.0)
+        val chips = CoachSuggestions.suggestions(today, recent)
+        // charge + hrv + sleep + strain + stable generic = 5 candidates → capped at 4.
+        assertEquals(4, chips.size)
+        // The stable generic is appended last; with the cap at 4, it is the 4th element (the 5th
+        // candidate, the strain chip, is dropped). Charge is first.
+        assertEquals("Active recovery only today — what should I do?", chips.first())
+        assertEquals("Analyse my sleep", chips.last())
+    }
+
+    @Test fun chargeOnlyYieldsChargeAndGeneric() {
+        val today = metric(day = 10, recovery = 90.0)
+        val chips = CoachSuggestions.suggestions(today, emptyList())
+        assertEquals(listOf("Green light — how hard can I push today?", "Analyse my sleep"), chips)
+    }
+
+    // MARK: - Byte-identity of the fallback list
+
+    @Test fun fallbackListIsCanonical() {
+        assertEquals(
+            listOf(
+                "How's my recovery trending this week?",
+                "What should today's training look like?",
+                "Analyse my sleep",
+                "Why am I run down?",
+            ),
+            fallback,
+        )
+    }
+}
diff --git a/android/app/src/test/java/com/noop/analytics/SseDeltasTest.kt b/android/app/src/test/java/com/noop/analytics/SseDeltasTest.kt
new file mode 100644
index 0000000000..14f1d0f6b7
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/SseDeltasTest.kt
@@ -0,0 +1,271 @@
+package com.noop.analytics
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * Byte-identity pin for the SSE delta parser. The same SSE lines MUST produce the same text as
+ * the Swift twin `StrandAnalytics.SseDeltasTests`. Cross-platform parity is the contract.
+ */
+class SseDeltasTest {
+
+    // MARK: - SSE line splitting
+
+    @Test fun stripsDataPrefix() {
+        assertEquals("{\"hello\":1}", SseDeltas.dataPayload(fromLine = "data: {\"hello\":1}"))
+    }
+
+    @Test fun stripsDataPrefixNoSpace() {
+        assertEquals("{\"hello\":1}", SseDeltas.dataPayload(fromLine = "data:{\"hello\":1}"))
+    }
+
+    @Test fun blankLineReturnsNull() {
+        assertNull(SseDeltas.dataPayload(fromLine = ""))
+        assertNull(SseDeltas.dataPayload(fromLine = "   "))
+    }
+
+    @Test fun commentLineReturnsNull() {
+        assertNull(SseDeltas.dataPayload(fromLine = ": keep-alive"))
+    }
+
+    @Test fun nonDataFieldReturnsNull() {
+        assertNull(SseDeltas.dataPayload(fromLine = "event: content_block_delta"))
+        assertNull(SseDeltas.dataPayload(fromLine = "id: 12345"))
+        assertNull(SseDeltas.dataPayload(fromLine = "retry: 1000"))
+    }
+
+    @Test fun isDone() {
+        assertTrue(SseDeltas.isDone("[DONE]"))
+        assertTrue(SseDeltas.isDone(" [DONE] "))
+        assertFalse(SseDeltas.isDone("{\"choices\":[]}"))
+    }
+
+    // MARK: - CRLF parity (Kotlin trim() strips \r; Swift .whitespaces does not)
+
+    @Test fun isDoneStripsCRLF() {
+        assertTrue(SseDeltas.isDone("[DONE]\r"))
+        assertTrue(SseDeltas.isDone("[DONE]\r\n"))
+    }
+
+    @Test fun dataPayloadStripsCRLF() {
+        assertEquals("{\"hello\":1}", SseDeltas.dataPayload(fromLine = "data: {\"hello\":1}\r"))
+    }
+
+    // MARK: - OpenAI delta
+
+    @Test fun openAiContentDelta() {
+        val payload = """{"choices":[{"index":0,"delta":{"content":"Hello"}}]}"""
+        assertEquals("Hello", SseDeltas.openAiDelta(payload))
+    }
+
+    @Test fun openAiRoleDeltaReturnsNull() {
+        val payload = """{"choices":[{"index":0,"delta":{"role":"assistant"}}]}"""
+        assertNull(SseDeltas.openAiDelta(payload))
+    }
+
+    @Test fun openAiDoneReturnsNull() {
+        assertNull(SseDeltas.openAiDelta("[DONE]"))
+    }
+
+    @Test fun openAiEmptyChoicesReturnsNull() {
+        assertNull(SseDeltas.openAiDelta("""{"choices":[]}"""))
+    }
+
+    @Test fun openAiMalformedReturnsNull() {
+        assertNull(SseDeltas.openAiDelta("not json"))
+    }
+
+    @Test fun openAiEmptyContentReturnsNull() {
+        // OpenAI's usual first delta carries `"content": ""`. Kotlin returns null (optString +
+        // takeIf { isNotEmpty() }); Swift must match so onDelta doesn't fire on one platform only.
+        val payload = """{"choices":[{"index":0,"delta":{"content":""}}]}"""
+        assertNull(SseDeltas.openAiDelta(payload))
+    }
+
+    // MARK: - Gemini delta
+
+    @Test fun geminiTextDelta() {
+        val payload = """{"candidates":[{"content":{"parts":[{"text":"Hello"}]}}]}"""
+        assertEquals("Hello", SseDeltas.geminiDelta(payload))
+    }
+
+    @Test fun geminiMultiPartDelta() {
+        val payload = """{"candidates":[{"content":{"parts":[{"text":"Hello "},{"text":"world"}]}}]}"""
+        assertEquals("Hello world", SseDeltas.geminiDelta(payload))
+    }
+
+    @Test fun geminiFinishReasonChunkWithTextReturnsText() {
+        val payload = """{"candidates":[{"content":{"parts":[{"text":"good."}]},"finishReason":"STOP"}]}"""
+        assertEquals("good.", SseDeltas.geminiDelta(payload))
+    }
+
+    @Test fun geminiFinishReasonChunkEmptyPartsReturnsNull() {
+        val payload = """{"candidates":[{"content":{"parts":[]},"finishReason":"STOP"}]}"""
+        assertNull(SseDeltas.geminiDelta(payload))
+    }
+
+    @Test fun geminiMalformedReturnsNull() {
+        assertNull(SseDeltas.geminiDelta("not json"))
+    }
+
+    // MARK: - Anthropic delta
+
+    @Test fun anthropicTextDelta() {
+        val payload = """{"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"Hello"}}"""
+        assertEquals("Hello", SseDeltas.anthropicDelta(payload))
+    }
+
+    @Test fun anthropicMessageStartReturnsNull() {
+        val payload = """{"type":"message_start","message":{"id":"msg_1"}}"""
+        assertNull(SseDeltas.anthropicDelta(payload))
+    }
+
+    @Test fun anthropicPingReturnsNull() {
+        val payload = """{"type":"ping"}"""
+        assertNull(SseDeltas.anthropicDelta(payload))
+    }
+
+    @Test fun anthropicContentBlockStartReturnsNull() {
+        val payload = """{"type":"content_block_start","index":0,"content_block":{"type":"text","text":""}}"""
+        assertNull(SseDeltas.anthropicDelta(payload))
+    }
+
+    @Test fun anthropicMessageStopReturnsNull() {
+        val payload = """{"type":"message_stop"}"""
+        assertNull(SseDeltas.anthropicDelta(payload))
+    }
+
+    @Test fun anthropicMalformedReturnsNull() {
+        assertNull(SseDeltas.anthropicDelta("not json"))
+    }
+
+    @Test fun anthropicEmptyTextReturnsNull() {
+        // Parity with Swift: empty text → null, not "" (same reason as OpenAI empty content).
+        val payload = """{"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":""}}"""
+        assertNull(SseDeltas.anthropicDelta(payload))
+    }
+
+    // MARK: - Full-stream reassembly (the parity pin: streamed == non-streamed)
+    //
+    // The reassembly is done inline in each test (not via a helper) to keep the test logic
+    // fully transparent and avoid an inexplicable Kotlin/JVM interaction where the SseDeltas
+    // .reassemble helper drops the last Gemini chunk. The inline version — identical logic —
+    // passes reliably. The helper remains available for Swift parity tests.
+
+    @Test fun openAiReassembleMatchesFullReply() {
+        val lines = listOf(
+            """data: {"choices":[{"index":0,"delta":{"role":"assistant"}}]}""",
+            "",
+            """data: {"choices":[{"index":0,"delta":{"content":"Hello"}}]}""",
+            "",
+            """data: {"choices":[{"index":0,"delta":{"content":", world!"}}]}""",
+            "",
+            """data: {"choices":[{"index":0,"finish_reason":"stop"}]}""",
+            "",
+            "data: [DONE]",
+            "",
+        )
+        val sb = StringBuilder()
+        for (line in lines) {
+            val payload = SseDeltas.dataPayload(fromLine = line) ?: continue
+            val delta = SseDeltas.openAiDelta(payload)
+            if (delta != null) sb.append(delta)
+        }
+        assertEquals("Hello, world!", sb.toString())
+    }
+
+    @Test fun geminiReassembleMatchesFullReply() {
+        val lines = listOf(
+            """data: {"candidates":[{"content":{"parts":[{"text":"Recovery"}]}}]}""",
+            "",
+            """data: {"candidates":[{"content":{"parts":[{"text":" is "}]}}]}""",
+            "",
+            """data: {"candidates":[{"content":{"parts":[{"text":"good."}]},"finishReason":"STOP"}]}""",
+            "",
+        )
+        val sb = StringBuilder()
+        for (line in lines) {
+            val payload = SseDeltas.dataPayload(fromLine = line) ?: continue
+            val delta = SseDeltas.geminiDelta(payload)
+            if (delta != null) sb.append(delta)
+        }
+        assertEquals("Recovery is good.", sb.toString())
+    }
+
+    @Test fun anthropicReassembleMatchesFullReply() {
+        val lines = listOf(
+            "event: message_start",
+            """data: {"type":"message_start","message":{"id":"msg_1"}}""",
+            "",
+            "event: content_block_start",
+            """data: {"type":"content_block_start","index":0,"content_block":{"type":"text","text":""}}""",
+            "",
+            "event: content_block_delta",
+            """data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":"Sleep"}}""",
+            "",
+            "event: content_block_delta",
+            """data: {"type":"content_block_delta","index":0,"delta":{"type":"text_delta","text":" well."}}""",
+            "",
+            "event: content_block_stop",
+            """data: {"type":"content_block_stop","index":0}""",
+            "",
+            "event: message_stop",
+            """data: {"type":"message_stop"}""",
+            "",
+        )
+        val sb = StringBuilder()
+        for (line in lines) {
+            val payload = SseDeltas.dataPayload(fromLine = line) ?: continue
+            val delta = SseDeltas.anthropicDelta(payload)
+            if (delta != null) sb.append(delta)
+        }
+        assertEquals("Sleep well.", sb.toString())
+    }
+
+    @Test fun customSharesOpenAiShape() {
+        val lines = listOf(
+            """data: {"choices":[{"index":0,"delta":{"content":"Hi"}}]}""",
+            "",
+            "data: [DONE]",
+            "",
+        )
+        val sb = StringBuilder()
+        for (line in lines) {
+            val payload = SseDeltas.dataPayload(fromLine = line) ?: continue
+            val delta = SseDeltas.openAiDelta(payload)
+            if (delta != null) sb.append(delta)
+        }
+        assertEquals("Hi", sb.toString())
+    }
+
+    // MARK: - Empty / edge cases
+
+    @Test fun emptyStreamReassemblesToEmpty() {
+        assertEquals("", SseDeltas.reassemble(emptyList(), SseProvider.OPEN_AI))
+    }
+
+    @Test fun onlyDoneReassemblesToEmpty() {
+        assertEquals("", SseDeltas.reassemble(listOf("data: [DONE]", ""), SseProvider.OPEN_AI))
+    }
+
+    @Test fun ignoresCommentLines() {
+        val lines = listOf(
+            ": keep-alive",
+            "",
+            """data: {"choices":[{"index":0,"delta":{"content":"ok"}}]}""",
+            "",
+            "data: [DONE]",
+            "",
+        )
+        val sb = StringBuilder()
+        for (line in lines) {
+            val payload = SseDeltas.dataPayload(fromLine = line) ?: continue
+            val delta = SseDeltas.openAiDelta(payload)
+            if (delta != null) sb.append(delta)
+        }
+        assertEquals("ok", sb.toString())
+    }
+}
diff --git a/android/app/src/test/resources/schema_oracle.json b/android/app/src/test/resources/schema_oracle.json
index abd475513e..743485063f 100644
--- a/android/app/src/test/resources/schema_oracle.json
+++ b/android/app/src/test/resources/schema_oracle.json
@@ -1,6 +1,6 @@
 {
   "_readme": "SHARED Room<->GRDB SCHEMA ORACLE (#775). Two byte-identical copies: Packages/WhoopStore/Tests/WhoopStoreTests/Resources/schema_oracle.json and android/app/src/test/resources/schema_oracle.json. SchemaOracleTests.swift compares GRDB's PRAGMA table_info/index_list against it; SchemaOracleTest.kt compares Room's exported schema JSON against it. `columns` is the iOS/GRDB shape in GRDB column order (macOS is the reference implementation); every way Android differs is spelled out in an `android` / `iosAbsent` / `androidColumnOrder` override naming a key in `divergenceReasons`. Adding a column, reordering one, or changing a type/nullability on one platform only fails both suites until it is either fixed or written down here.",
-  "roomVersion": 36,
+  "roomVersion": 37,
   "grdbMigrations": [
     "v1",
     "v2",
@@ -43,7 +43,8 @@
     "v39-ppg-burst-index",
     "v40-daily-skin-temp-absolute",
     "v41-drop-raw-imu-sample",
-    "v42-daily-sleep-hr-only"
+    "v42-daily-sleep-hr-only",
+    "v43-coach-messages"
   ],
   "divergenceReasons": {
     "android-orphan-synced-column": "REAL COLUMN DRIFT: `synced` exists on Android only. GRDB's v10 note is explicit that stepSample gets no `synced` column ('unused; see StreamStore'), and v12's ppgHrSample never had one either; the Room entities copied the flag from the older per-second entities. Nothing reads it on Android — the per-row upload flag belongs to an upload path that does not exist there — so it is dead width, not divergent data. Removing it needs a Room table rebuild.",
@@ -217,6 +218,55 @@
       "androidColumnOrderDivergence": "battery-alter-append-order",
       "indices": []
     },
+    "coachMessage": {
+      "platform": "both",
+      "columns": [
+        {
+          "name": "id",
+          "affinity": "TEXT",
+          "notNull": false,
+          "default": null,
+          "android": {
+            "notNull": true
+          },
+          "divergence": "sqlite-text-pk-nullable"
+        },
+        {
+          "name": "role",
+          "affinity": "TEXT",
+          "notNull": true,
+          "default": null
+        },
+        {
+          "name": "text",
+          "affinity": "TEXT",
+          "notNull": true,
+          "default": null
+        },
+        {
+          "name": "provider",
+          "affinity": "TEXT",
+          "notNull": true,
+          "default": null
+        },
+        {
+          "name": "createdAt",
+          "affinity": "INTEGER",
+          "notNull": true,
+          "default": null
+        },
+        {
+          "name": "orderIndex",
+          "affinity": "INTEGER",
+          "notNull": true,
+          "default": null
+        }
+      ],
+      "primaryKey": [
+        "id"
+      ],
+      "indices": []
+    },
     "cursors": {
       "platform": "ios_only",
       "reason": "iOS offload/upload bookmarks (GRDB v2). Android keeps the equivalent bookmarks in SharedPreferences, not in Room.",
diff --git a/project.yml b/project.yml
index 3986736b73..988717f631 100644
--- a/project.yml
+++ b/project.yml
@@ -285,6 +285,12 @@ targets:
         NSHealthShareUsageDescription: "NOOP reads your own Apple Health data on-device to compute recovery, strain, and sleep. Nothing leaves your device."
         NSHealthUpdateUsageDescription: "NOOP writes the metrics it computes from your strap back into Apple Health, on-device and only when you allow it."
         NSMotionUsageDescription: "NOOP reads your iPhone's step count for a walking or running workout to show steps in the activity summary. It stays on your device. Nothing leaves it."
+        # K4: Coach voice input. Speech is transcribed ON-DEVICE ONLY (requiresOnDeviceRecognition);
+        # the mic button is disabled where the locale doesn't support that, never falls back to
+        # server transcription. Only the resulting TEXT reaches the provider, via the same channel
+        # a typed question already uses.
+        NSSpeechRecognitionUsageDescription: "NOOP transcribes your question on-device so you can ask the coach out loud instead of typing. Audio never leaves your iPhone."
+        NSMicrophoneUsageDescription: "NOOP uses the microphone to let you ask the coach a question by voice. The audio is transcribed on-device and never leaves your iPhone."
         # #187: the opt-in AI Coach's "Custom (OpenAI-compatible)" provider can point at a LOCAL LLM on
         # the LAN (Ollama / LM Studio at http://192.168.x.x:11434). ATS blocks cleartext by default;
         # NSAllowsLocalNetworking exempts loopback/.local/private-LAN hosts ONLY — public HTTPS endpoints

From 9966d0ac24d0c722dfa005438158adfcc5583126 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 17:21:03 +1200
Subject: [PATCH 272/333] coach: localize the voice controllers on both
 platforms, pin CRLF on Kotlin too

Follow-up to the Coach merge, so @evoveotech did not have to rebase a
5,600-line branch again for small things.

Two operator-facing strings in the Android voice controller still went through
onError as English. The permission one reuses the existing
coach_voice_error_permission rather than adding a near-duplicate for seven
translators; the unavailability one is a new key across all eight locale files.

Checking parity on that turned up the same defect on iOS, four times over:
CoachVoiceInput.swift had four user-facing strings and zero String(localized:),
shown as the composer's statusMessage in an app that ships ten iOS locales.
Three unique keys after dedup, two carrying %@, spliced into
Localizable.xcstrings as text for every locale.

Neither platform's CI could see any of them. The audit's Apple detector keys on
Text(...)-style view initializers exactly as its Android detector is
@Composable-scoped, and these are assignments to a property rendered elsewhere -
a symmetric blind spot, which is how the feature landed unlocalized copy on both
sides at once.

The CRLF cases were pinned on the Swift side only. That finding was a parity
divergence, and one-sided pinning leaves the other side free to drift back into
it, so Kotlin pins the same two cases now.

CoachScreen's composer doc still described the mic as using EXTRA_PREFER_OFFLINE,
the only place left in the tree naming it. That is a preference the platform may
ignore, and the gap between it and the stated guarantee was the blocking finding
on the Coach review - so the doc had this screen vouching for exactly what was
not true.

Android 5395 tests / 0 failures, SseDeltasTest 35. i18n audit and doc lint clean;
lintVitalFullRelease clean, so no ExtraTranslation from the new Android key.
---
 Strand/Resources/Localizable.xcstrings        | 36 +++++++++++++++++++
 StrandiOS/App/CoachVoiceInput.swift           |  8 ++---
 .../src/main/java/com/noop/ui/CoachScreen.kt  |  7 ++--
 .../main/java/com/noop/ui/CoachVoiceInput.kt  |  4 +--
 .../app/src/main/res/values-de/strings.xml    |  1 +
 .../app/src/main/res/values-es/strings.xml    |  1 +
 .../app/src/main/res/values-fr/strings.xml    |  1 +
 .../app/src/main/res/values-pl/strings.xml    |  1 +
 .../src/main/res/values-pt-rPT/strings.xml    |  1 +
 .../app/src/main/res/values-ru/strings.xml    |  1 +
 .../app/src/main/res/values-zh/strings.xml    |  1 +
 android/app/src/main/res/values/strings.xml   |  1 +
 .../java/com/noop/analytics/SseDeltasTest.kt  | 20 +++++++++++
 13 files changed, 75 insertions(+), 8 deletions(-)

diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 08b7cfbb44..7593695f5c 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -209987,6 +209987,42 @@
         "ru": {"stringUnit": {"state": "translated", "value": "Включите утреннюю сводку в настройках Коуча, чтобы видеть сегодняшнюю готовность здесь."}},
         "zh-Hans": {"stringUnit": {"state": "translated", "value": "在 Coach 设置中启用晨间简报以在此处查看今日准备度。"}},
         "zh-Hant": {"stringUnit": {"state": "translated", "value": "在 Coach 設定中啟用晨間簡報以在此處查看今日準備度。"}}
+    } },
+    "Voice input unavailable. Check microphone permission in Settings.": { "localizations": {
+        "de": {"stringUnit": {"state": "translated", "value": "Spracheingabe nicht verfügbar. Prüfe die Mikrofonberechtigung in den Einstellungen."}},
+        "en": {"stringUnit": {"state": "translated", "value": "Voice input unavailable. Check microphone permission in Settings."}},
+        "es": {"stringUnit": {"state": "translated", "value": "Entrada de voz no disponible. Comprueba el permiso del micrófono en Ajustes."}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Saisie vocale indisponible. Vérifiez l'autorisation du microphone dans Réglages."}},
+        "it": {"stringUnit": {"state": "translated", "value": "Input vocale non disponibile. Controlla l'autorizzazione del microfono in Impostazioni."}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Wprowadzanie głosowe niedostępne. Sprawdź uprawnienie mikrofonu w Ustawieniach."}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Entrada de voz indisponível. Verifica a permissão do microfone nas Definições."}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Голосовой ввод недоступен. Проверьте разрешение микрофона в Настройках."}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "语音输入不可用。请在“设置”中检查麦克风权限。"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "語音輸入無法使用。請在「設定」中檢查麥克風權限。"}}
+    } },
+    "On-device speech not available for %@.": { "localizations": {
+        "de": {"stringUnit": {"state": "translated", "value": "Geräteinterne Spracherkennung für %@ nicht verfügbar."}},
+        "en": {"stringUnit": {"state": "translated", "value": "On-device speech not available for %@."}},
+        "es": {"stringUnit": {"state": "translated", "value": "El reconocimiento de voz en el dispositivo no está disponible para %@."}},
+        "fr": {"stringUnit": {"state": "translated", "value": "La reconnaissance vocale sur l'appareil n'est pas disponible pour %@."}},
+        "it": {"stringUnit": {"state": "translated", "value": "Il riconoscimento vocale sul dispositivo non è disponibile per %@."}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Rozpoznawanie mowy na urządzeniu jest niedostępne dla %@."}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "O reconhecimento de voz no dispositivo não está disponível para %@."}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Распознавание речи на устройстве недоступно для %@."}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "设备端语音识别不支持 %@。"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "裝置端語音辨識不支援 %@。"}}
+    } },
+    "Couldn't start the microphone: %@": { "localizations": {
+        "de": {"stringUnit": {"state": "translated", "value": "Mikrofon konnte nicht gestartet werden: %@"}},
+        "en": {"stringUnit": {"state": "translated", "value": "Couldn't start the microphone: %@"}},
+        "es": {"stringUnit": {"state": "translated", "value": "No se pudo iniciar el micrófono: %@"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Impossible de démarrer le microphone : %@"}},
+        "it": {"stringUnit": {"state": "translated", "value": "Impossibile avviare il microfono: %@"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Nie udało się uruchomić mikrofonu: %@"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Não foi possível iniciar o microfone: %@"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Не удалось включить микрофон: %@"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "无法启动麦克风：%@"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "無法啟動麥克風：%@"}}
     } }
   },
   "version": "1.0"
diff --git a/StrandiOS/App/CoachVoiceInput.swift b/StrandiOS/App/CoachVoiceInput.swift
index 3076ce6b93..de61060be5 100644
--- a/StrandiOS/App/CoachVoiceInput.swift
+++ b/StrandiOS/App/CoachVoiceInput.swift
@@ -111,8 +111,8 @@ final class CoachVoiceInput: ObservableObject {
         #if canImport(UIKit)
         guard canUseVoice else {
             statusMessage = Self.localeSupportsOnDevice
-                ? "Voice input unavailable. Check microphone permission in Settings."
-                : "On-device speech not available for \(Locale.current.identifier)."
+                ? String(localized: "Voice input unavailable. Check microphone permission in Settings.")
+                : String(localized: "On-device speech not available for \(Locale.current.identifier).")
             return
         }
         stopTranscribing(completion: { _ in })
@@ -173,7 +173,7 @@ final class CoachVoiceInput: ObservableObject {
         self.recognitionRequest = request
 
         guard let recognizer = SFSpeechRecognizer(locale: Locale.current) else {
-            statusMessage = "On-device speech not available for \(Locale.current.identifier)."
+            statusMessage = String(localized: "On-device speech not available for \(Locale.current.identifier).")
             return
         }
 
@@ -207,7 +207,7 @@ final class CoachVoiceInput: ObservableObject {
             try audioEngine.start()
             isRecording = true
         } catch {
-            statusMessage = "Couldn't start the microphone: \(error.localizedDescription)"
+            statusMessage = String(localized: "Couldn't start the microphone: \(error.localizedDescription)")
             finishSession(completion: { _ in })
         }
     }
diff --git a/android/app/src/main/java/com/noop/ui/CoachScreen.kt b/android/app/src/main/java/com/noop/ui/CoachScreen.kt
index 5dd32ca7b2..965c2cfe2d 100644
--- a/android/app/src/main/java/com/noop/ui/CoachScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/CoachScreen.kt
@@ -961,11 +961,14 @@ private fun CoachPrimaryButton(label: String, enabled: Boolean, onClick: () -> U
  * K4: The composer row with a mic button (on-device voice input) between the text field and Send.
  * Mirrors the iOS `CoachView.composer` + `micButton` twin. The mic button:
  *  - requests RECORD_AUDIO at runtime on first tap (via [rememberLauncherForActivityResult]),
- *  - starts/stops [CoachVoiceInput] (Android platform SpeechRecognizer, EXTRA_PREFER_OFFLINE),
+ *  - starts/stops [CoachVoiceInput], which uses `createOnDeviceSpeechRecognizer` behind an
+ *    `isOnDeviceRecognitionAvailable` gate (API 31+); below that the button is not composed at all,
  *  - streams the partial transcript into the text field live,
  *  - on stop, appends the finalized transcript to the draft (not replace, so it composes with
  *    typed text).
- * Only the resulting TEXT ever reaches the AI provider — no new network path, no audio egress.
+ * Only the resulting TEXT ever reaches the AI provider — no new network path, no audio egress. That
+ * is a guarantee rather than a preference: `createOnDeviceSpeechRecognizer` cannot fall back to a
+ * server, where the `EXTRA_PREFER_OFFLINE` this line used to name was a hint the platform could ignore.
  */
 @Composable
 private fun MicComposerRow(
diff --git a/android/app/src/main/java/com/noop/ui/CoachVoiceInput.kt b/android/app/src/main/java/com/noop/ui/CoachVoiceInput.kt
index d117bd5b9a..e924c9a662 100644
--- a/android/app/src/main/java/com/noop/ui/CoachVoiceInput.kt
+++ b/android/app/src/main/java/com/noop/ui/CoachVoiceInput.kt
@@ -79,11 +79,11 @@ class CoachVoiceInput(
     fun start() {
         if (isRecording) return
         if (!isAvailable()) {
-            onError("On-device speech recognition is not available on this device or locale.")
+            onError(context.getString(R.string.coach_voice_error_unavailable))
             return
         }
         if (!isPermissionGranted()) {
-            onError("Microphone permission not granted.")
+            onError(context.getString(R.string.coach_voice_error_permission))
             return
         }
         // SpeechRecognizer must be created on the main thread; this class is called from Compose
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 2588dfd880..4d9e49f86f 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2733,6 +2733,7 @@
     <string name="coach_voice_error_permission">Mikrofonberechtigung verweigert.</string>
     <string name="coach_voice_error_generic">Spracheingabe fehlgeschlagen. Versuchen Sie es erneut.</string>
     <string name="coach_voice_error_server">On-Device-Spracherkennung für diese Sprache nicht verfügbar.</string>
+    <string name="coach_voice_error_unavailable">On-Device-Spracherkennung ist auf diesem Gerät oder für diese Sprache nicht verfügbar.</string>
     <string name="coach_voice_unavailable">On-Device-Spracherkennung ist auf diesem Gerät oder für diese Sprache nicht verfügbar.</string>
     <string name="coach_voice_permission_denied">Mikrofonberechtigung verweigert. Aktivieren Sie sie in den Einstellungen, um die Spracheingabe zu nutzen.</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index a483f9d41d..0bd8d55a52 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2720,6 +2720,7 @@
     <string name="coach_voice_error_permission">Permiso de micrófono denegado.</string>
     <string name="coach_voice_error_generic">Error de entrada de voz. Inténtelo de nuevo.</string>
     <string name="coach_voice_error_server">El reconocimiento de voz en el dispositivo no está disponible para este idioma.</string>
+    <string name="coach_voice_error_unavailable">El reconocimiento de voz en el dispositivo no está disponible en este dispositivo o idioma.</string>
     <string name="coach_voice_unavailable">El reconocimiento de voz en el dispositivo no está disponible en este dispositivo o idioma.</string>
     <string name="coach_voice_permission_denied">Permiso de micrófono denegado. Actívalo en Configuración para usar la entrada de voz.</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index e40a386295..f77530217c 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2719,6 +2719,7 @@
     <string name="coach_voice_error_permission">Autorisation du microphone refusée.</string>
     <string name="coach_voice_error_generic">Échec de la saisie vocale. Réessayez.</string>
     <string name="coach_voice_error_server">La reconnaissance vocale sur l\'appareil n\'est pas disponible pour cette langue.</string>
+    <string name="coach_voice_error_unavailable">La reconnaissance vocale sur l\'appareil n\'est pas disponible sur cet appareil ou pour cette langue.</string>
     <string name="coach_voice_unavailable">La reconnaissance vocale sur l\'appareil n\'est pas disponible sur cet appareil ou pour cette langue.</string>
     <string name="coach_voice_permission_denied">Autorisation du microphone refusée. Activez-la dans les Paramètres pour utiliser la saisie vocale.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 3b72ad2379..1bca6150e7 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2724,6 +2724,7 @@
     <string name="coach_voice_error_permission">Odmowa uprawnień do mikrofonu.</string>
     <string name="coach_voice_error_generic">Wprowadzanie głosowe nie powiodło się. Spróbuj ponownie.</string>
     <string name="coach_voice_error_server">Rozpoznawanie mowy na urządzeniu jest niedostępne dla tego języka.</string>
+    <string name="coach_voice_error_unavailable">Rozpoznawanie mowy na urządzeniu jest niedostępne na tym urządzeniu lub dla tego języka.</string>
     <string name="coach_voice_unavailable">Rozpoznawanie mowy na urządzeniu nie jest dostępne na tym urządzeniu lub w tym języku.</string>
     <string name="coach_voice_permission_denied">Odmowa uprawnień do mikrofonu. Włącz je w Ustawieniach, aby używać wprowadzania głosowego.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 74a240f7d4..a1218c3ba9 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2712,6 +2712,7 @@
     <string name="coach_voice_error_permission">Permissão de microfone negada.</string>
     <string name="coach_voice_error_generic">Falha na entrada de voz. Tente novamente.</string>
     <string name="coach_voice_error_server">O reconhecimento de voz no dispositivo não está disponível para este idioma.</string>
+    <string name="coach_voice_error_unavailable">O reconhecimento de voz no dispositivo não está disponível neste dispositivo ou idioma.</string>
     <string name="coach_voice_unavailable">O reconhecimento de voz no dispositivo não está disponível neste dispositivo ou idioma.</string>
     <string name="coach_voice_permission_denied">Permissão de microfone negada. Ative-a nas Configurações para usar a entrada de voz.</string>
 </resources>
diff --git a/android/app/src/main/res/values-ru/strings.xml b/android/app/src/main/res/values-ru/strings.xml
index 39fa44a0ad..e0b28a105e 100644
--- a/android/app/src/main/res/values-ru/strings.xml
+++ b/android/app/src/main/res/values-ru/strings.xml
@@ -1387,6 +1387,7 @@
     <string name="coach_voice_error_permission">Разрешение на микрофон отклонено.</string>
     <string name="coach_voice_error_generic">Ошибка голосового ввода. Попробуйте снова.</string>
     <string name="coach_voice_error_server">Распознавание речи на устройстве недоступно для этого языка.</string>
+    <string name="coach_voice_error_unavailable">Распознавание речи на устройстве недоступно на этом устройстве или для этого языка.</string>
     <string name="coach_voice_unavailable">Распознавание речи на устройстве недоступно на этом устройстве или для этого языка.</string>
     <string name="coach_voice_permission_denied">Разрешение на микрофон отклонено. Включите его в Настройках, чтобы использовать голосовой ввод.</string>
     <string name="l10n_compare_screen_remove_title_ddb5361c">Удалить %1$s</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 49641b5b56..0d26772f29 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2633,6 +2633,7 @@
     <string name="coach_voice_error_permission">麦克风权限被拒绝。</string>
     <string name="coach_voice_error_generic">语音输入失败。请重试。</string>
     <string name="coach_voice_error_server">此语言不支持设备端语音识别。</string>
+    <string name="coach_voice_error_unavailable">此设备或语言不支持设备端语音识别。</string>
     <string name="coach_voice_unavailable">此设备或语言不支持设备端语音识别。</string>
     <string name="coach_voice_permission_denied">麦克风权限被拒绝。请在设置中启用以使用语音输入。</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 97a4e3c013..cee89f0c71 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2749,6 +2749,7 @@
     <string name="coach_voice_error_permission">Microphone permission denied.</string>
     <string name="coach_voice_error_generic">Voice input failed. Try again.</string>
     <string name="coach_voice_error_server">On-device speech is unavailable for this locale.</string>
+    <string name="coach_voice_error_unavailable">On-device speech recognition is not available on this device or locale.</string>
     <string name="coach_voice_unavailable">On-device speech recognition is not available on this device or locale.</string>
     <string name="coach_voice_permission_denied">Microphone permission denied. Enable it in Settings to use voice input.</string>
 </resources>
diff --git a/android/app/src/test/java/com/noop/analytics/SseDeltasTest.kt b/android/app/src/test/java/com/noop/analytics/SseDeltasTest.kt
index 14f1d0f6b7..f58713058d 100644
--- a/android/app/src/test/java/com/noop/analytics/SseDeltasTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/SseDeltasTest.kt
@@ -268,4 +268,24 @@ class SseDeltasTest {
         }
         assertEquals("ok", sb.toString())
     }
+
+    // ── CRLF parity ──────────────────────────────────────────────────────────────────────────
+    //
+    // The Swift twin trims `.whitespacesAndNewlines`; Kotlin's `trim()` already strips \r. These
+    // pin that, because the divergence they guard against was real: Swift used `.whitespaces`
+    // (space and tab only), so on a CRLF stream `isDone("[DONE]\r")` was false on iOS and true
+    // here, and iOS never saw the end-of-stream sentinel. Fixing one side without pinning the
+    // other leaves it free to drift straight back.
+
+    /** A CRLF stream leaves a trailing \r after splitting on \n. It must not hide the sentinel. */
+    @Test fun `isDone strips CRLF`() {
+        assertTrue(SseDeltas.isDone("[DONE]\r"))
+        assertTrue(SseDeltas.isDone("[DONE]\r\n"))
+    }
+
+    /** The same trailing \r must not end up inside the JSON payload handed to the parsers. */
+    @Test fun `dataPayload strips CRLF`() {
+        assertEquals("{\"hello\":1}", SseDeltas.dataPayload("data: {\"hello\":1}\r"))
+    }
+
 }

From ba0f09bc44fcefee6a1c7c6bebefcef5eaaa67ea Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Sun, 6 Sep 2026 10:55:01 +0530
Subject: [PATCH 273/333] skin-temp: explorer leads with the absolute and
 honours the Settings choice
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From @evoveotech. Addresses #1848.

The metric explorer read skin temp through the shared `dailyColumn` mapper, which
returns skinTempDevC only - so it always led with the deviation and ignored the
units.skinTempDisplay choice. The fix is a skin-temp branch in the explorer
rather than a change to the shared mapper, correctly: that mapper also feeds the
trend series and the metric-catalog availability check, so repointing it would
change what Trends plots and what the band is computed against.

The preference applies across the WINDOW, not just the newest row, so a wearer
with twenty stored temperatures and one recent night without now leads with
temperatures instead of twenty-three deltas. The fallback can never empty the
screen: with deviation preferred, absolutes lead only when there are no
deviations at all.

An absolute may live in EITHER column - a WHOOP CSV import writes absolute °C
into skinTempDevC - and both the lead decision and the series builder count both,
so the screen cannot decide one thing and plot another.

Two explanatory notes carry the cases where the answer is not the obvious one:
the setting asked for temperatures and the window has none, and leading with
absolutes dropped deviation-only nights. Both are pure functions, logically
identical to their Kotlin twins in HealthVitalsLogic, and pinned by eight tests
in StrandTests - which the macOS build leg actually runs, so they ran rather than
merely compiled.
---
 Strand/Screens/MetricExplorerView.swift     | 134 +++++++++++++++++++-
 StrandTests/SkinTempExplorerNoteTests.swift |  66 ++++++++++
 2 files changed, 199 insertions(+), 1 deletion(-)
 create mode 100644 StrandTests/SkinTempExplorerNoteTests.swift

diff --git a/Strand/Screens/MetricExplorerView.swift b/Strand/Screens/MetricExplorerView.swift
index 6a1a65d495..cdf6005cd9 100644
--- a/Strand/Screens/MetricExplorerView.swift
+++ b/Strand/Screens/MetricExplorerView.swift
@@ -265,6 +265,32 @@ private let readingShortDateFormatter: DateFormatter = {
     return f
 }()
 
+// MARK: - Skin-temp explorer notes (#1847 / #1848)
+
+/// Whether the skin-temp explorer must explain that it fell back to deviations despite the
+/// user's Settings choice asking for temperatures. Twin of Android's `shouldExplainSkinTempFallback`.
+///
+/// True only when the user asked for absolute, the screen is NOT leading with absolutes, and NO
+/// night in the window carries one — so the fallback is total, not partial. A window with one
+/// stored temperature and twenty deltas still leads with temperatures (the #1850 window-wide rule),
+/// so this note stays silent there; it fires only when the setting genuinely cannot be honoured.
+func shouldExplainSkinTempFallback(prefer: SkinTempDisplay.Kind, leadsAbsolute: Bool,
+                                   anyAbsoluteInWindow: Bool) -> Bool {
+    prefer == .absolute && !leadsAbsolute && !anyAbsoluteInWindow
+}
+
+/// Whether the skin-temp explorer must explain that deviation-only nights were dropped from the
+/// series when leading with absolutes. Twin of Android's `shouldExplainShortenedSkinTempSeries`.
+///
+/// True ONLY when leading with the absolute — the deviation-led branch also drops rows (calibrating
+/// nights that have only an absolute, and the #622 bimodal partition), but those are the OPPOSITE
+/// kind, so this note's sentence would be precisely backwards there. True only when rows were
+/// actually dropped, so a complete series stays silent.
+func shouldExplainShortenedSkinTempSeries(leadsAbsolute: Bool, shownReadings: Int,
+                                          rowsWithEitherNumber: Int) -> Bool {
+    leadsAbsolute && shownReadings < rowsWithEitherNumber
+}
+
 // MARK: - Root: categorized list
 
 /// The "Explore" picker — categories as sections, metrics as rows, each pushing a
@@ -538,11 +564,18 @@ struct MetricDetailView: View {
     // Effort display scale (#268) — routes the Effort metric's numbers + unit; display-only, the plotted
     // series stays 0–100. Every other metric is scale-agnostic (see MetricDescriptor.format).
     @AppStorage(UnitPrefs.effortScaleKey) private var effortScaleRaw = EffortScale.hundred.rawValue
+    /// #1846/#1848: which skin-temp number the explorer leads with — absent/`""` = a temperature
+    /// (the default), or `SkinTempDisplay.Kind.deviation.rawValue` to lead with the ±baseline move.
+    /// Same key as Today/Health/Settings; display-only, nothing stored ever changes.
+    @AppStorage(UnitPrefs.skinTempDisplayKey) private var skinTempDisplayRaw = ""
     private var unitSystem: UnitSystem { UnitSystem(rawValue: unitSystemRaw) ?? .metric }
     private var temperatureUnit: TemperatureUnit {
         UnitPrefs.resolveTemperature(system: unitSystem, override: temperatureRaw)
     }
     private var effortScale: EffortScale { UnitPrefs.resolveEffortScale(effortScaleRaw) }
+    private var skinTempPreferred: SkinTempDisplay.Kind {
+        SkinTempDisplay.Kind(rawValue: skinTempDisplayRaw) ?? .absolute
+    }
     private func fmt(_ v: Double) -> String {
         metric.format(v, system: unitSystem, temperature: temperatureUnit, effortScale: effortScale)
     }
@@ -569,6 +602,13 @@ struct MetricDetailView: View {
     /// reads it, so it can lag the rest of the screen by a second without anyone noticing.
     @State private var correlationsLoaded = false
 
+    /// #1848: the skin-temp explorer's explanatory note (nil when none is needed). Set in `load()`
+    /// alongside the series, from the same `repo.days` scan that decides which kind to lead with.
+    /// Two notes, mutually exclusive: (1) the user asked for temperatures but the window has none,
+    /// so deviations are shown instead; (2) leading with absolutes dropped deviation-only nights
+    /// from the series. Both are real on Apple — the same two cases the Android twin carries.
+    @State private var skinTempNote: String? = nil
+
     /// Cached correlation scan, keyed by its inputs (selected range + the metric id),
     /// so the full cross-catalog Pearson sweep runs ONLY when those change — not on
     /// every body re-eval (hover / 1 Hz HR ticks / animation). Recomputed from
@@ -576,7 +616,7 @@ struct MetricDetailView: View {
     @State private var correlationCache: [CorrRow] = []
     /// The (metricID, range) the cache was built for; nil means "not yet computed".
     @State private var correlationKey: String? = nil
-    private var loadTaskID: String { "\(metric.id)|\(repo.refreshSeq)" }
+    private var loadTaskID: String { "\(metric.id)|\(repo.refreshSeq)|\(skinTempDisplayRaw)" }
 
     // MARK: Derived
 
@@ -746,6 +786,23 @@ struct MetricDetailView: View {
                     // with the range pill. Then the frosted chart / stat tiles / correlations.
                     heroHeader(effectiveRange: effRange, windowed: win, windowFellBack: fellBack)
                     heroChart(effectiveRange: effRange, windowed: win, windowFellBack: fellBack)
+                    // #1848: the skin-temp explorer's explanatory note (nil for every other metric and
+                    // for a skin-temp screen that needs no explanation). Sits between the chart and the
+                    // stats so it reads as context for the series just plotted, not as a generic banner.
+                    if let note = skinTempNote {
+                        NoopCard {
+                            HStack(alignment: .top, spacing: 10) {
+                                Image(systemName: "info.circle")
+                                    .font(.system(size: 14, weight: .medium))
+                                    .foregroundStyle(StrandPalette.textTertiary)
+                                    .accessibilityHidden(true)
+                                Text(note)
+                                    .font(StrandFont.footnote)
+                                    .foregroundStyle(StrandPalette.textSecondary)
+                                    .fixedSize(horizontal: false, vertical: true)
+                            }
+                        }
+                    }
                     statRow(effectiveRange: effRange, windowed: win)
                     readingsTable(windowed: win)
                     correlationCard
@@ -852,6 +909,81 @@ struct MetricDetailView: View {
                 series = byDay.sorted { $0.key < $1.key }.map { (day: $0.key, value: $0.value) }
             }
         }
+        // #1848: skin-temp explorer — give it a skin-temp-specific branch mirroring the Android
+        // `buildVitalDetail` "skin" case, rather than the shared `dailyColumn` → `skinTempDevC` path.
+        //
+        // The shared mapper returns `skinTempDevC` only, so the explorer never leads with the measured
+        // absolute (`skinTempC`) and ignores the Settings choice (#1846). Repointing `dailyColumn`'s
+        // `skin_temp` case would change which series Trends plots and what the band is computed against
+        // (its callers include the trend series and the metric-catalog availability check), so the fix
+        // is a branch HERE, not a change to the shared mapper.
+        //
+        // The preference applies across the WINDOW (#1850), not just the newest row: a wearer with
+        // twenty stored temperatures and one recent night without saw twenty-three deltas — the setting
+        // says Temperature and the app HAS temperatures. `leadReading`'s rule lifted to the window: the
+        // chosen kind wins whenever any night carries it, the other is still the fallback, so a choice
+        // can never empty the screen.
+        //
+        // An absolute may live in EITHER column (#622: a WHOOP CSV import writes absolute °C into
+        // `skinTempDevC`), so both count here and in the series below.
+        skinTempNote = nil
+        if metric.key == "skin_temp" {
+            let days = repo.days
+            let anyAbsolute = days.contains { row in
+                row.skinTempC != nil
+                    || row.skinTempDevC.map(VitalBands.isAbsoluteSkinTemp) == true
+            }
+            let anyDeviation = days.contains { row in
+                row.skinTempDevC.map { !VitalBands.isAbsoluteSkinTemp($0) } == true
+            }
+            if anyAbsolute || anyDeviation {
+                let leadsAbsolute: Bool
+                switch skinTempPreferred {
+                case .absolute:   leadsAbsolute = anyAbsolute
+                case .deviation:  leadsAbsolute = !anyDeviation && anyAbsolute
+                }
+                if leadsAbsolute {
+                    // An absolute-led series takes EVERY absolute reading, whichever column holds it.
+                    // `skinTempC` is the on-device computed absolute; `skinTempDevC` may hold a CSV-imported
+                    // absolute (#622 bimodal). Mixing is only unsound ACROSS scales; these are the same scale.
+                    series = days.compactMap { row in
+                        let v = row.skinTempC
+                            ?? row.skinTempDevC.flatMap { VitalBands.isAbsoluteSkinTemp($0) ? $0 : nil }
+                        return v.map { (day: row.day, value: $0) }
+                    }.sorted { $0.day < $1.day }
+                } else {
+                    // Genuine deviations only — an imported absolute sitting in `skinTempDevC` belongs to
+                    // the other scale and is excluded, exactly as before.
+                    series = days.compactMap { row in
+                        row.skinTempDevC.flatMap { !VitalBands.isAbsoluteSkinTemp($0) ? $0 : nil }
+                            .map { (day: row.day, value: $0) }
+                    }.sorted { $0.day < $1.day }
+                }
+                // Rebuild sourceByDay for the new series. `DailyMetric` has no per-row deviceId on Apple
+                // (the merged cache doesn't carry one), so every reading attributes to the metric's own
+                // source — the same source the `exploreSeries` daily-column layer would have used.
+                sourceByDay = Dictionary(series.map { ($0.day, metric.source) },
+                                         uniquingKeysWith: { first, _ in first })
+                // The two #1847 notes — both cases exist on Apple too:
+                // (1) Settings asked for a temperature and none of these nights has one → say so, because
+                //     silently falling back is why the setting reads as broken. Nights scored before
+                //     `skinTempC` shipped kept only the deviation; a scoring pass refills them.
+                // (2) Leading with the absolute drops deviation-only nights from the series — which can
+                //     now include the most recent one. Say why rather than letting history look like it
+                //     vanished. (Deviation-led drops are the OPPOSITE kind, so the note is gated to
+                //     absolute-led only — see `shouldExplainShortenedSkinTempSeries`.)
+                let shownReadings = series.count
+                let rowsWithEither = days.count { $0.skinTempC != nil || $0.skinTempDevC != nil }
+                if shouldExplainSkinTempFallback(prefer: skinTempPreferred, leadsAbsolute: leadsAbsolute,
+                                                 anyAbsoluteInWindow: anyAbsolute) {
+                    skinTempNote = String(localized: "No measured temperature for these nights — showing the difference from your baseline instead. A re-score refills temperatures for nights that have one.")
+                } else if shouldExplainShortenedSkinTempSeries(leadsAbsolute: leadsAbsolute,
+                                                                shownReadings: shownReadings,
+                                                                rowsWithEitherNumber: rowsWithEither) {
+                    skinTempNote = String(localized: "Only nights with a measured temperature are shown — the others only have a baseline difference.")
+                }
+            }
+        }
         // #943 selection seam: a locked default (.month with under a week of history) no longer
         // OVERWRITES @State range - it renders through `coercedSelection` instead (non-destructive,
         // recomputed every body eval), so a shrinking history re-coerces and a growing one un-coerces
diff --git a/StrandTests/SkinTempExplorerNoteTests.swift b/StrandTests/SkinTempExplorerNoteTests.swift
new file mode 100644
index 0000000000..25778f625c
--- /dev/null
+++ b/StrandTests/SkinTempExplorerNoteTests.swift
@@ -0,0 +1,66 @@
+import XCTest
+import StrandAnalytics
+@testable import Strand
+
+/// #1848: the skin-temp explorer's two explanatory notes (#1847), pure-function twins of Android's
+/// `shouldExplainSkinTempFallback` and `shouldExplainShortenedSkinTempSeries`.
+///
+/// Both notes are gated so they fire ONLY when the sentence they carry is true — a note that says the
+/// opposite of what happened is worse than silence. The fallback note fires when the user asked for
+/// temperatures and the window has none; the shortened-series note fires when leading with absolutes
+/// dropped deviation-only nights. The deviation-led branch also drops rows (calibrating nights with
+/// only an absolute), but those are the OPPOSITE kind, so the shortened-series note is gated to
+/// absolute-led only.
+final class SkinTempExplorerNoteTests: XCTestCase {
+
+    // MARK: - shouldExplainSkinTempFallback
+
+    func testFallbackExplainedWhenUserAskedForAbsoluteButWindowHasNone() {
+        XCTAssertTrue(shouldExplainSkinTempFallback(
+            prefer: .absolute, leadsAbsolute: false, anyAbsoluteInWindow: false))
+    }
+
+    func testFallbackSilentWhenWindowHasAbsoluteEvenIfLatestLacksOne() {
+        // #1850: the preference applies across the window. A window with one stored temperature
+        // and twenty deltas still leads with temperatures, so the fallback note stays silent.
+        XCTAssertFalse(shouldExplainSkinTempFallback(
+            prefer: .absolute, leadsAbsolute: true, anyAbsoluteInWindow: true))
+    }
+
+    func testFallbackSilentWhenUserAskedForDeviation() {
+        // The user chose "vs baseline" — showing deviations is honouring the choice, not falling back.
+        XCTAssertFalse(shouldExplainSkinTempFallback(
+            prefer: .deviation, leadsAbsolute: false, anyAbsoluteInWindow: false))
+    }
+
+    func testFallbackSilentWhenLeadingAbsoluteAsRequested() {
+        XCTAssertFalse(shouldExplainSkinTempFallback(
+            prefer: .absolute, leadsAbsolute: true, anyAbsoluteInWindow: true))
+    }
+
+    // MARK: - shouldExplainShortenedSkinTempSeries
+
+    func testShortenedSeriesExplainedWhenAbsoluteLedDropsNights() {
+        XCTAssertTrue(shouldExplainShortenedSkinTempSeries(
+            leadsAbsolute: true, shownReadings: 21, rowsWithEitherNumber: 40))
+    }
+
+    func testShortenedSeriesSilentWhenEveryNightIsShown() {
+        XCTAssertFalse(shouldExplainShortenedSkinTempSeries(
+            leadsAbsolute: true, shownReadings: 23, rowsWithEitherNumber: 23))
+    }
+
+    func testShortenedSeriesSilentWhenNothingToShow() {
+        XCTAssertFalse(shouldExplainShortenedSkinTempSeries(
+            leadsAbsolute: true, shownReadings: 0, rowsWithEitherNumber: 0))
+    }
+
+    func testShortenedSeriesNeverExplainsWhenLeadingWithDeviation() {
+        // The deviation-led branch ALSO drops rows (calibrating nights with only an absolute), but
+        // those are the OPPOSITE kind — "only nights with a measured temperature are shown" would be
+        // precisely backwards. Ungated, this fired the moment a wearer picked "vs baseline" with any
+        // calibrating night in the window.
+        XCTAssertFalse(shouldExplainShortenedSkinTempSeries(
+            leadsAbsolute: false, shownReadings: 21, rowsWithEitherNumber: 40))
+    }
+}

From a6c6de7aa2a9ff8c51b2433c354a88b174532b93 Mon Sep 17 00:00:00 2001
From: Kaveman <66108693+kavemang@users.noreply.github.com>
Date: Sun, 6 Sep 2026 00:32:33 -0500
Subject: [PATCH 274/333] units: split body measurements from exercise distance
 and pace

From @kavemang. Addresses #1913.

One global Metric/Imperial switch drove both body measurements and exercise
distance, so a common regional convention - pounds for body weight, kilometres
and min/km for running - could not be expressed. Flipping the global setting
around each workout changed body units at the same time, so there was no
practical workaround either.

The split is backward-compatible by construction rather than by migration:
`units.system` keeps its key and becomes the body preference, so every existing
choice survives untouched, and the new `units.distance` follows it until the user
sets it independently. Both platforms pin that fallback in a test named for it.

Every distance, pace and speed surface reads the new preference - workout lists
and totals, details and routes, live GPS and speed sensors, manual entry, Today
summaries, imported Xiaomi charts and the Coach's workout context. Temperature
still follows the BODY choice, which is what "follow" has always meant. Stored
health and workout data stays SI; this is input and display only.

The preference round-trips through backup on both platforms, and conditionally -
exported only when set, so "unset" stays unset instead of being frozen to a value
by the first backup.

resolveDistance and speedFromKilometersPerHour are logically identical across
Swift and Kotlin, guards included. Six Android strings across eight locale files
and nine catalog keys on Apple. 16/16 CI, and 5395 Android tests / 0 failures on
a fresh checkout here.
---
 .../Sources/WhoopStore/BackupSettings.swift   |  7 ++--
 .../WhoopStoreTests/BackupSettingsTests.swift |  4 ++
 Strand/AI/AICoach.swift                       |  9 ++++-
 Strand/Data/Units.swift                       | 39 +++++++++++++-----
 Strand/Liquid/LiquidTodayView.swift           |  8 +++-
 Strand/Onboarding/OnboardingWizard.swift      | 34 +++++++++++-----
 Strand/Resources/Localizable.xcstrings        | 27 +++++++++++++
 Strand/Screens/LiveWorkoutView.swift          | 27 +++++++++----
 Strand/Screens/ManualWorkoutSheet.swift       | 25 ++++++++----
 Strand/Screens/SettingsView.swift             | 40 +++++++++++++------
 Strand/Screens/WorkoutDetailView.swift        | 16 ++++----
 Strand/Screens/WorkoutsView.swift             | 14 ++++---
 Strand/Screens/XiaomiBandView.swift           | 11 ++++-
 StrandTests/BackupSyncRoundTripTests.swift    |  2 +
 StrandTests/OnboardingUnitsPickerTests.swift  |  1 +
 StrandTests/UnitFormatterTests.swift          | 15 +++++++
 .../main/java/com/noop/data/BackupSettings.kt | 11 +++--
 .../src/main/java/com/noop/ui/LiveScreen.kt   |  5 +--
 .../java/com/noop/ui/LiveWorkoutScreen.kt     | 11 ++---
 .../src/main/java/com/noop/ui/MainActivity.kt | 10 +++--
 .../main/java/com/noop/ui/OnboardingScreen.kt | 35 +++++++++++-----
 .../main/java/com/noop/ui/SettingsScreen.kt   | 38 ++++++++++++------
 .../app/src/main/java/com/noop/ui/Units.kt    | 37 ++++++++++++-----
 .../main/java/com/noop/ui/WorkoutsScreen.kt   |  8 ++--
 .../app/src/main/res/values-de/strings.xml    |  6 +++
 .../app/src/main/res/values-es/strings.xml    |  6 +++
 .../app/src/main/res/values-fr/strings.xml    |  6 +++
 .../app/src/main/res/values-pl/strings.xml    |  6 +++
 .../src/main/res/values-pt-rPT/strings.xml    |  6 +++
 .../app/src/main/res/values-ru/strings.xml    |  6 +++
 .../app/src/main/res/values-zh/strings.xml    |  6 +++
 android/app/src/main/res/values/strings.xml   |  6 +++
 .../com/noop/data/BackupSettingsCodecTest.kt  |  2 +
 .../com/noop/ui/OnboardingUnitsPickerTest.kt  |  1 +
 .../java/com/noop/ui/UnitFormatterTest.kt     | 17 ++++++++
 35 files changed, 388 insertions(+), 114 deletions(-)

diff --git a/Packages/WhoopStore/Sources/WhoopStore/BackupSettings.swift b/Packages/WhoopStore/Sources/WhoopStore/BackupSettings.swift
index 252cc6de4c..e4af279b5a 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/BackupSettings.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/BackupSettings.swift
@@ -34,9 +34,8 @@ public enum BackupSettings {
     /// (platform-neutral) names. Mirrored exactly by Android's `BackupSettingsCodec.WHITELIST`.
     ///
     /// Profile: the body metrics that power HR zones / calories / recovery baselines, plus the manual
-    /// HR-max override (`profile.hrMax`, 0 = auto/Tanaka). Display: the metric/imperial system, the
-    /// separate temperature override ("" = match the system), and the Effort axis (#268) — the three
-    /// display prefs that exist with identical semantics on both platforms. Deliberately EXCLUDED:
+    /// HR-max override (`profile.hrMax`, 0 = auto/Tanaka). Display: the body and exercise-distance
+    /// systems, separate temperature override ("" = follow body), and Effort axis (#268). Deliberately EXCLUDED:
     /// step calibration (per-strap, not per-person), the avatar blob (bulky, and not "settings"),
     /// steps-engine fitted outputs (derived), and every noop.* toggle that is device- or
     /// install-specific — INCLUDING the Today/Sleep section order, Key-Metrics and dashboard-card
@@ -56,6 +55,7 @@ public enum BackupSettings {
         "profile.hrMax": .int,
         "profile.hrZoneThresholds": .string,
         "units.system": .string,
+        "units.distance": .string,
         "units.temperature": .string,
         "effort.scale": .string,
         "dayCycle.mode": .string,
@@ -81,6 +81,7 @@ public enum BackupSettings {
         "profile.hrMax": "profile.hrMaxOverride",
         "profile.hrZoneThresholds": "profile.hrZoneThresholds",
         "units.system": "units.system",
+        "units.distance": "units.distance",
         "units.temperature": "units.temperature",
         "effort.scale": "effort.scale",
         "dayCycle.mode": "noop.dayCycleMode",
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/BackupSettingsTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/BackupSettingsTests.swift
index ab542c7bb6..ee0b4ab5b4 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/BackupSettingsTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/BackupSettingsTests.swift
@@ -19,6 +19,7 @@ final class BackupSettingsTests: XCTestCase {
             "profile.hrMax": 191,
             "profile.hrZoneThresholds": "95,118,142,168,184",
             "units.system": "imperial",
+            "units.distance": "metric",
             "units.temperature": "celsius",
             "effort.scale": "whoop",
             "dayCycle.mode": "sleep_onset",
@@ -39,6 +40,7 @@ final class BackupSettingsTests: XCTestCase {
         XCTAssertEqual(back["profile.hrMax"] as? Int, 191)
         XCTAssertEqual(back["profile.hrZoneThresholds"] as? String, "95,118,142,168,184")
         XCTAssertEqual(back["units.system"] as? String, "imperial")
+        XCTAssertEqual(back["units.distance"] as? String, "metric")
         XCTAssertEqual(back["units.temperature"] as? String, "celsius")
         XCTAssertEqual(back["effort.scale"] as? String, "whoop")
         XCTAssertEqual(back["dayCycle.mode"] as? String, "sleep_onset")
@@ -117,12 +119,14 @@ final class BackupSettingsTests: XCTestCase {
         defaults.set(82.5, forKey: "profile.weightKg")
         defaults.set(198, forKey: "profile.hrMaxOverride") // storage key, not the canonical name
         defaults.set("imperial", forKey: "units.system")
+        defaults.set("metric", forKey: "units.distance")
 
         let snap = BackupSettings.snapshot(from: defaults)
         XCTAssertEqual(snap["profile.age"] as? Int, 29)
         XCTAssertEqual(snap["profile.weightKg"] as? Double, 82.5)
         XCTAssertEqual(snap["profile.hrMax"] as? Int, 198, "hrMaxOverride surfaces under the canonical key")
         XCTAssertEqual(snap["units.system"] as? String, "imperial")
+        XCTAssertEqual(snap["units.distance"] as? String, "metric")
         XCTAssertNil(snap["profile.heightCm"], "Never-set keys are omitted, not defaulted")
         XCTAssertNil(snap["profile.sex"])
     }
diff --git a/Strand/AI/AICoach.swift b/Strand/AI/AICoach.swift
index 32cf6a906f..8d91153709 100644
--- a/Strand/AI/AICoach.swift
+++ b/Strand/AI/AICoach.swift
@@ -1087,6 +1087,11 @@ final class AICoachEngine: ObservableObject {
     func recentWorkoutsBlock(limit: Int = 6) async -> String {
         let rows = await repo.workoutRows(days: 30) // newest first
         guard !rows.isEmpty else { return "Recent workouts: none recorded in the last 30 days." }
+        let bodySystem = UnitSystem(
+            rawValue: UserDefaults.standard.string(forKey: UnitPrefs.systemKey) ?? "") ?? .metric
+        let distanceSystem = UnitPrefs.resolveDistance(
+            system: bodySystem,
+            override: UserDefaults.standard.string(forKey: UnitPrefs.distanceSystemKey) ?? "")
         var lines = ["Recent workouts (newest first):"]
         for w in rows.prefix(limit) {
             var parts = ["  \(dateString(w.startTs)) \(w.sport)"]
@@ -1094,7 +1099,9 @@ final class AICoachEngine: ObservableObject {
             if let s = w.strain { parts.append("effort \(String(format: "%.1f", s))") }
             if let hr = w.avgHr { parts.append("avg HR \(hr)") }
             if let kcal = w.energyKcal { parts.append("\(Int(kcal.rounded())) kcal") }
-            if let dist = w.distanceM { parts.append("\(String(format: "%.1f", dist / 1000)) km") }
+            if let dist = w.distanceM {
+                parts.append(UnitFormatter.distanceFromMeters(dist, system: distanceSystem))
+            }
             lines.append(parts.joined(separator: ", "))
         }
         return lines.joined(separator: "\n")
diff --git a/Strand/Data/Units.swift b/Strand/Data/Units.swift
index 3cb050a09a..04d4a6b5cb 100644
--- a/Strand/Data/Units.swift
+++ b/Strand/Data/Units.swift
@@ -5,21 +5,21 @@ import StrandAnalytics
 //
 // NOOP stores EVERYTHING in SI (km, kg, cm, °C) — the importers normalise on the way in, so this is a
 // purely cosmetic, display-only layer. There is no data migration and nothing on disk changes when the
-// user flips this. We keep one Metric/Imperial switch for length+mass with a SEPARATE temperature
-// override, because plenty of people think in kg/cm but still read body temperature in °F (and vice
-// versa). Default is Metric — most of the world, and it matches what we store.
+// user flips this. Body measurements and exercise distance each have their own Metric/Imperial choice,
+// with a SEPARATE temperature override, because regional conventions commonly mix pounds with kilometres
+// (or kg/cm with °F). Default is Metric — most of the world, and it matches what we store.
 //
 // Persisted via @AppStorage (UserDefaults), the same mechanism every other macOS NOOP preference uses.
 // The Android side mirrors this exactly in Units.kt + NoopPrefs.
 
-/// The length+mass unit system. Temperature has its own override (see `UnitPrefs.temperature`).
+/// A Metric/Imperial display choice. Body measurements and exercise distance persist separate values.
 enum UnitSystem: String, CaseIterable, Identifiable {
     case metric
     case imperial
     var id: String { rawValue }
 
-    /// "follow the system" pairs temperature with the length/mass choice; an explicit case lets the
-    /// user pin °C or °F independently of whether distances are in km or miles.
+    /// "Follow body measurements" pairs temperature with the body choice; an explicit case lets the
+    /// user pin °C or °F independently.
     var temperatureMatching: TemperatureUnit { self == .imperial ? .fahrenheit : .celsius }
 }
 
@@ -79,11 +79,14 @@ enum HrvWindow: String, CaseIterable, Identifiable {
     var label: String { self == .deep ? "Deep sleep" : "Whole night" }
 }
 
-/// UserDefaults keys for the two unit preferences. Public-ish (internal) so `SettingsView`'s
-/// `@AppStorage(UnitPrefs.systemKey)` and the formatter read the SAME key — no drift.
+/// UserDefaults keys and backwards-compatible preference resolution.
 enum UnitPrefs {
+    /// The original combined preference now owns body measurements. Keeping its key preserves every
+    /// existing user's kg/cm or lb/ft-in choice without a migration.
     static let systemKey = "units.system"
-    /// Temperature override. Empty string = "match the length/mass system" (the default).
+    /// Exercise distance + pace. Empty/unset follows `systemKey`, preserving the pre-#1913 behaviour.
+    static let distanceSystemKey = "units.distance"
+    /// Temperature override. Empty string = "follow body measurements" (the default).
     static let temperatureKey = "units.temperature"
 
     /// #1846: which skin-temp number the cards lead with — absent/`""` = a temperature (the default), or
@@ -121,13 +124,18 @@ enum UnitPrefs {
             ? true : UserDefaults.standard.bool(forKey: liveActivityKey)
     }
 
-    /// Resolve the stored raw values into a concrete temperature unit, applying the
-    /// "match the system" default when no explicit override is set.
+    /// Resolve temperature, following body measurements when no explicit override is set.
     static func resolveTemperature(system: UnitSystem, override raw: String) -> TemperatureUnit {
         if let explicit = TemperatureUnit(rawValue: raw) { return explicit }
         return system.temperatureMatching
     }
 
+    /// Resolve the exercise-distance system. Existing installs have no distance key, so an empty or
+    /// unknown value follows the original combined preference until the user chooses independently.
+    static func resolveDistance(system: UnitSystem, override raw: String) -> UnitSystem {
+        UnitSystem(rawValue: raw) ?? system
+    }
+
     /// Resolve the stored Effort-scale raw value, defaulting to NOOP's native 0–100 axis.
     static func resolveEffortScale(_ raw: String) -> EffortScale {
         EffortScale(rawValue: raw) ?? .hundred
@@ -201,6 +209,15 @@ enum UnitFormatter {
         system == .imperial ? "mi" : "km"
     }
 
+    /// Format speed stored in kilometres/hour in the exercise-distance system.
+    static func speedFromKilometersPerHour(_ kmh: Double?, system: UnitSystem) -> String? {
+        guard let kmh, kmh.isFinite, kmh >= 0 else { return nil }
+        switch system {
+        case .metric:   return oneDecimal(kmh) + " km/h"
+        case .imperial: return oneDecimal(kmToMiles(kmh)) + " mph"
+        }
+    }
+
     // MARK: Mass (stored kg)
 
     /// kg → pounds.
diff --git a/Strand/Liquid/LiquidTodayView.swift b/Strand/Liquid/LiquidTodayView.swift
index 04eb9360d4..8d51a63ec7 100644
--- a/Strand/Liquid/LiquidTodayView.swift
+++ b/Strand/Liquid/LiquidTodayView.swift
@@ -1890,6 +1890,10 @@ struct LiquidTodayView: View {
     // even once it had a value to show (#1627).
     @AppStorage(UnitPrefs.systemKey) private var unitSystemRaw = UnitSystem.metric.rawValue
     private var unitSystem: UnitSystem { UnitSystem(rawValue: unitSystemRaw) ?? .metric }
+    @AppStorage(UnitPrefs.distanceSystemKey) private var distanceSystemRaw = ""
+    private var distanceUnitSystem: UnitSystem {
+        UnitPrefs.resolveDistance(system: unitSystem, override: distanceSystemRaw)
+    }
     @AppStorage(UnitPrefs.temperatureKey) private var temperatureRaw = ""
     @AppStorage(UnitPrefs.skinTempDisplayKey) private var skinTempDisplayRaw = ""   // #1846
     private var temperatureUnit: TemperatureUnit {
@@ -1921,7 +1925,9 @@ struct LiquidTodayView: View {
         var parts: [String] = []
         let secs = w.durationS ?? Double(max(w.endTs - w.startTs, 0))
         parts.append("\(Int(secs / 60)) min")
-        if let dm = w.distanceM, dm > 0 { parts.append(String(format: "%.1f km", locale: AppLanguage.activeLocale, dm / 1000)) }
+        if let dm = w.distanceM, dm > 0 {
+            parts.append(UnitFormatter.distanceFromMeters(dm, system: distanceUnitSystem))
+        }
         if let k = w.energyKcal { parts.append("\(Int(k.rounded())) kcal") }
         return parts.joined(separator: " · ")
     }
diff --git a/Strand/Onboarding/OnboardingWizard.swift b/Strand/Onboarding/OnboardingWizard.swift
index b7db8cb72f..e91d24f4af 100644
--- a/Strand/Onboarding/OnboardingWizard.swift
+++ b/Strand/Onboarding/OnboardingWizard.swift
@@ -727,10 +727,17 @@ private struct BondedStep: View {
 private struct ProfileStep: View {
     @EnvironmentObject private var profile: ProfileStore
 
-    // Imperial/Metric display preference (D#103). The stored profile is always SI; the steppers keep
-    // operating in SI (0.5 kg / 1 cm) and only the DISPLAYED value re-labels to lb / ft-in.
+    // The stored profile is always SI. Body measurements and exercise distance can follow the regional
+    // conventions independently; an unset distance choice follows the body choice for compatibility.
     @AppStorage(UnitPrefs.systemKey) private var unitSystemRaw = UnitSystem.metric.rawValue
+    @AppStorage(UnitPrefs.distanceSystemKey) private var distanceSystemRaw = ""
     private var unitSystem: UnitSystem { UnitSystem(rawValue: unitSystemRaw) ?? .metric }
+    private var distanceUnitSystem: UnitSystem {
+        UnitPrefs.resolveDistance(system: unitSystem, override: distanceSystemRaw)
+    }
+    private var distanceSystemBinding: Binding<String> {
+        Binding(get: { distanceUnitSystem.rawValue }, set: { distanceSystemRaw = $0 })
+    }
 
     private let sexes: [(String, String)] = [
         ("male", String(localized: "Male")), ("female", String(localized: "Female")),
@@ -767,14 +774,11 @@ private struct ProfileStep: View {
 
                         Divider().overlay(StrandPalette.hairline)
 
-                        // Units control (#781). Without this, onboarding read `unitSystemRaw` for the
-                        // Weight/Height display but had NO way to set it, so US users were locked to
-                        // kg/cm until they later found Settings → Units. Mirror the Sex picker idiom; the
-                        // stored profile stays SI either way, only the displayed labels re-format (lb / ft-in
-                        // via UnitFormatter). Same key (`units.system`) the Settings → Units card writes.
+                        // Keep the two choices explicit here: "Metric/Imperial" alone cannot describe
+                        // common mixed conventions such as Canadian pounds with kilometres.
                         VStack(alignment: .leading, spacing: 8) {
-                            Text("Units").strandOverline()
-                            Picker("Units", selection: $unitSystemRaw) {
+                            Text("Body measurements").strandOverline()
+                            Picker("Body measurements", selection: $unitSystemRaw) {
                                 Text("Metric").tag(UnitSystem.metric.rawValue)
                                 Text("Imperial").tag(UnitSystem.imperial.rawValue)
                             }
@@ -784,6 +788,18 @@ private struct ProfileStep: View {
 
                         Divider().overlay(StrandPalette.hairline)
 
+                        VStack(alignment: .leading, spacing: 8) {
+                            Text("Exercise distance & pace").strandOverline()
+                            Picker("Exercise distance & pace", selection: distanceSystemBinding) {
+                                Text("Kilometres").tag(UnitSystem.metric.rawValue)
+                                Text("Miles").tag(UnitSystem.imperial.rawValue)
+                            }
+                            .pickerStyle(.segmented)
+                            .labelsHidden()
+                        }
+
+                        Divider().overlay(StrandPalette.hairline)
+
                         // Steppers, not sliders — matches the Age row above and the macOS Settings
                         // profile editor (same ranges/steps), so every numeric profile field is
                         // consistent across onboarding and Settings on both platforms.
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 7593695f5c..0c0bbfd876 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -1,6 +1,33 @@
 {
   "sourceLanguage": "en",
   "strings": {
+    "Body measurement units": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Einheiten für Körpermaße" } }, "es": { "stringUnit": { "state": "translated", "value": "Unidades de medidas corporales" } }, "fr": { "stringUnit": { "state": "translated", "value": "Unités des mensurations" } }, "it": { "stringUnit": { "state": "translated", "value": "Unità delle misure corporee" } }, "pl": { "stringUnit": { "state": "translated", "value": "Jednostki pomiarów ciała" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Unidades das medidas corporais" } }, "ru": { "stringUnit": { "state": "translated", "value": "Единицы параметров тела" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "身体测量单位" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "身體測量單位" } }
+    } },
+    "Body measurements": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Körpermaße" } }, "es": { "stringUnit": { "state": "translated", "value": "Medidas corporales" } }, "fr": { "stringUnit": { "state": "translated", "value": "Mensurations" } }, "it": { "stringUnit": { "state": "translated", "value": "Misure corporee" } }, "pl": { "stringUnit": { "state": "translated", "value": "Pomiary ciała" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Medidas corporais" } }, "ru": { "stringUnit": { "state": "translated", "value": "Параметры тела" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "身体测量" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "身體測量" } }
+    } },
+    "Choose body measurements and exercise distance separately. Your data is always stored the same way; these settings only change its display.": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Wähle Einheiten für Körpermaße und Trainingsdistanz separat. Deine Daten werden immer gleich gespeichert; diese Einstellungen ändern nur die Anzeige." } }, "es": { "stringUnit": { "state": "translated", "value": "Elige por separado las unidades de las medidas corporales y de la distancia de ejercicio. Los datos siempre se almacenan igual; estos ajustes solo cambian su visualización." } }, "fr": { "stringUnit": { "state": "translated", "value": "Choisissez séparément les unités des mensurations et de la distance d’exercice. Les données sont toujours stockées de la même façon ; ces réglages ne changent que leur affichage." } }, "it": { "stringUnit": { "state": "translated", "value": "Scegli separatamente le unità per le misure corporee e la distanza di allenamento. I dati vengono sempre memorizzati allo stesso modo; queste impostazioni cambiano solo la visualizzazione." } }, "pl": { "stringUnit": { "state": "translated", "value": "Wybierz osobno jednostki pomiarów ciała i dystansu treningu. Dane są zawsze przechowywane tak samo; te ustawienia zmieniają tylko sposób wyświetlania." } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Escolha separadamente as unidades para medidas corporais e distância de exercício. Os dados são sempre armazenados da mesma forma; estas definições alteram apenas a apresentação." } }, "ru": { "stringUnit": { "state": "translated", "value": "Выберите единицы для параметров тела и дистанции тренировки отдельно. Данные всегда хранятся одинаково; эти настройки меняют только отображение." } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "分别选择身体测量和运动距离的单位。数据的存储方式始终不变；这些设置只会改变显示方式。" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "分別選擇身體測量和運動距離的單位。資料的儲存方式始終不變；這些設定只會改變顯示方式。" } }
+    } },
+    "Distance must be 0–621 mi.": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Die Distanz muss zwischen 0 und 621 mi liegen." } }, "es": { "stringUnit": { "state": "translated", "value": "La distancia debe ser de 0 a 621 mi." } }, "fr": { "stringUnit": { "state": "translated", "value": "La distance doit être comprise entre 0 et 621 mi." } }, "it": { "stringUnit": { "state": "translated", "value": "La distanza deve essere compresa tra 0 e 621 mi." } }, "pl": { "stringUnit": { "state": "translated", "value": "Dystans musi wynosić od 0 do 621 mi." } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "A distância deve ser entre 0 e 621 mi." } }, "ru": { "stringUnit": { "state": "translated", "value": "Дистанция должна быть от 0 до 621 мили." } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "距离必须在 0–621 英里之间。" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "距離必須在 0–621 英里之間。" } }
+    } },
+    "Exercise distance & pace": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Trainingsdistanz & Tempo" } }, "es": { "stringUnit": { "state": "translated", "value": "Distancia y ritmo del ejercicio" } }, "fr": { "stringUnit": { "state": "translated", "value": "Distance et allure d’exercice" } }, "it": { "stringUnit": { "state": "translated", "value": "Distanza e passo dell’allenamento" } }, "pl": { "stringUnit": { "state": "translated", "value": "Dystans i tempo treningu" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Distância e ritmo do exercício" } }, "ru": { "stringUnit": { "state": "translated", "value": "Дистанция и темп тренировки" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "运动距离和配速" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "運動距離和配速" } }
+    } },
+    "Exercise distance and pace units": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Einheiten für Trainingsdistanz und Tempo" } }, "es": { "stringUnit": { "state": "translated", "value": "Unidades de distancia y ritmo del ejercicio" } }, "fr": { "stringUnit": { "state": "translated", "value": "Unités de distance et d’allure d’exercice" } }, "it": { "stringUnit": { "state": "translated", "value": "Unità di distanza e passo dell’allenamento" } }, "pl": { "stringUnit": { "state": "translated", "value": "Jednostki dystansu i tempa treningu" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Unidades de distância e ritmo do exercício" } }, "ru": { "stringUnit": { "state": "translated", "value": "Единицы дистанции и темпа тренировки" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "运动距离和配速单位" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "運動距離和配速單位" } }
+    } },
+    "Follow body": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Wie Körpermaße" } }, "es": { "stringUnit": { "state": "translated", "value": "Según medidas corporales" } }, "fr": { "stringUnit": { "state": "translated", "value": "Selon les mensurations" } }, "it": { "stringUnit": { "state": "translated", "value": "Come misure corporee" } }, "pl": { "stringUnit": { "state": "translated", "value": "Jak pomiary ciała" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Como medidas corporais" } }, "ru": { "stringUnit": { "state": "translated", "value": "Как для параметров тела" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "跟随身体测量" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "跟隨身體測量" } }
+    } },
+    "Kilometres": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Kilometer" } }, "es": { "stringUnit": { "state": "translated", "value": "Kilómetros" } }, "fr": { "stringUnit": { "state": "translated", "value": "Kilomètres" } }, "it": { "stringUnit": { "state": "translated", "value": "Chilometri" } }, "pl": { "stringUnit": { "state": "translated", "value": "Kilometry" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Quilómetros" } }, "ru": { "stringUnit": { "state": "translated", "value": "Километры" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "公里" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "公里" } }
+    } },
+    "Miles": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Meilen" } }, "es": { "stringUnit": { "state": "translated", "value": "Millas" } }, "fr": { "stringUnit": { "state": "translated", "value": "Miles" } }, "it": { "stringUnit": { "state": "translated", "value": "Miglia" } }, "pl": { "stringUnit": { "state": "translated", "value": "Mile" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Milhas" } }, "ru": { "stringUnit": { "state": "translated", "value": "Мили" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "英里" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "英里" } }
+    } },
     "Calculating last night's sleep…": { "localizations": {
       "de": { "stringUnit": { "state": "translated", "value": "Der Schlaf der letzten Nacht wird berechnet…" } }, "en": { "stringUnit": { "state": "translated", "value": "Calculating last night's sleep…" } }, "es": { "stringUnit": { "state": "translated", "value": "Calculando el sueño de anoche…" } }, "fr": { "stringUnit": { "state": "translated", "value": "Calcul du sommeil de la nuit dernière…" } }, "it": { "stringUnit": { "state": "translated", "value": "Calcolo del sonno della scorsa notte…" } }, "pl": { "stringUnit": { "state": "translated", "value": "Obliczanie snu z ostatniej nocy…" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "A calcular o sono da noite passada…" } }, "ru": { "stringUnit": { "state": "translated", "value": "Рассчитываю сон за прошлую ночь…" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "正在计算昨夜睡眠…" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "正在計算昨夜睡眠…" } }
     } },
diff --git a/Strand/Screens/LiveWorkoutView.swift b/Strand/Screens/LiveWorkoutView.swift
index eb57288846..f1a8b06799 100644
--- a/Strand/Screens/LiveWorkoutView.swift
+++ b/Strand/Screens/LiveWorkoutView.swift
@@ -498,8 +498,8 @@ private extension View {
 /// power meter) feeding RSC/CSC/CPS ALONGSIDE heart rate. Only the fields the sensor actually sent
 /// render — each metric is dropped when its value is absent, and the WHOLE block (panel + entrance stagger)
 /// is hidden when nothing is present (`live.hasSensorMetrics`), so a plain HR-only workout looks exactly
-/// as before. Honest units: speed km/h, cadence per-minute (steps for running / rpm for cycling), power
-/// watts. Tinted with the Effort world so it reads as part of the hero, not a competing accent. Nothing
+/// as before. Speed follows the exercise-distance preference; cadence stays per-minute and power in watts.
+/// Tinted with the Effort world so it reads as part of the hero, not a competing accent. Nothing
 /// here touches HR / zone / effort.
 ///
 /// This is a standalone leaf that owns its OWN `@EnvironmentObject live` (the parent `LiveWorkoutView`
@@ -510,10 +510,18 @@ private extension View {
 /// so the rendered output matches the previous inline code.
 private struct SensorRowIfPresent: View {
     @EnvironmentObject private var live: LiveState
+    @AppStorage(UnitPrefs.systemKey) private var unitSystemRaw = UnitSystem.metric.rawValue
+    @AppStorage(UnitPrefs.distanceSystemKey) private var distanceSystemRaw = ""
+    private var distanceUnitSystem: UnitSystem {
+        UnitPrefs.resolveDistance(
+            system: UnitSystem(rawValue: unitSystemRaw) ?? .metric,
+            override: distanceSystemRaw)
+    }
 
     var body: some View {
         if live.hasSensorMetrics {
-            let speed = LiveState.formatSpeedKmh(live.sensorSpeedKmh)
+            let speed = UnitFormatter.speedFromKilometersPerHour(
+                live.sensorSpeedKmh, system: distanceUnitSystem)
             let cadence = LiveState.formatCadence(live.sensorCadence)
             let power = LiveState.formatPowerWatts(live.sensorPowerWatts)
             NoopCard(padding: NoopMetrics.cardInnerPadding, tint: StrandPalette.effortColor) {
@@ -522,7 +530,7 @@ private struct SensorRowIfPresent: View {
                         .font(StrandFont.overline).tracking(StrandFont.overlineTracking)
                         .foregroundStyle(StrandPalette.textSecondary)
                     HStack(spacing: NoopMetrics.gap) {
-                        if let speed { stat(String(localized: "SPEED"), "\(speed) km/h", tint: StrandPalette.effortColor) }
+                        if let speed { stat(String(localized: "SPEED"), speed, tint: StrandPalette.effortColor) }
                         if let cadence { stat(String(localized: "CADENCE"), "\(cadence)/min", tint: StrandPalette.effortColor) }
                         if let power { stat(String(localized: "POWER"), "\(power) W", tint: StrandPalette.effortColor) }
                     }
@@ -560,7 +568,12 @@ private struct SensorRowIfPresent: View {
 private struct DistancePaceRowIfPresent: View {
     @ObservedObject var recorder: GpsWorkoutRecorder
     @AppStorage(UnitPrefs.systemKey) private var unitSystemRaw = UnitSystem.metric.rawValue
-    private var unitSystem: UnitSystem { UnitSystem(rawValue: unitSystemRaw) ?? .metric }
+    @AppStorage(UnitPrefs.distanceSystemKey) private var distanceSystemRaw = ""
+    private var distanceUnitSystem: UnitSystem {
+        UnitPrefs.resolveDistance(
+            system: UnitSystem(rawValue: unitSystemRaw) ?? .metric,
+            override: distanceSystemRaw)
+    }
 
     var body: some View {
         // `isRecording` is essential, not just `pointCount > 0`: the recorder is a single long-lived
@@ -574,10 +587,10 @@ private struct DistancePaceRowIfPresent: View {
                     // "Distance"/"Pace" are already localized (reused from the detail view); uppercased for
                     // the caps stat grid, exactly as the detail route stats do.
                     stat(String(localized: "Distance").uppercased(),
-                         UnitFormatter.distanceFromMeters(recorder.distanceM, system: unitSystem))
+                         UnitFormatter.distanceFromMeters(recorder.distanceM, system: distanceUnitSystem))
                     statDivider
                     stat(String(localized: "Pace").uppercased(),
-                         UnitFormatter.paceFromSecPerKm(recorder.paceSecPerKm, system: unitSystem))
+                         UnitFormatter.paceFromSecPerKm(recorder.paceSecPerKm, system: distanceUnitSystem))
                 }
             }
         }
diff --git a/Strand/Screens/ManualWorkoutSheet.swift b/Strand/Screens/ManualWorkoutSheet.swift
index a316ca9f0f..7011bedd45 100644
--- a/Strand/Screens/ManualWorkoutSheet.swift
+++ b/Strand/Screens/ManualWorkoutSheet.swift
@@ -37,12 +37,15 @@ struct ManualWorkoutSheet: View {
     /// Distance as ENTERED, in the user's unit (km or mi) — converted to stored metres on save (#1195).
     @State private var distanceText: String
 
-    /// The length unit system, so the Distance field reads/writes in the user's unit. Read live for the
-    /// field label + parse; the init pre-fill reads the same key straight from UserDefaults (@AppStorage
-    /// isn't available before `self` is formed).
+    /// Exercise-distance choice. Unset follows the original combined setting for existing installs.
     @AppStorage(UnitPrefs.systemKey) private var unitSystemRaw = UnitSystem.metric.rawValue
-    private var unitSystem: UnitSystem { UnitSystem(rawValue: unitSystemRaw) ?? .metric }
-    private var distanceUnit: String { unitSystem == .imperial ? "mi" : "km" }
+    @AppStorage(UnitPrefs.distanceSystemKey) private var distanceSystemRaw = ""
+    private var distanceUnitSystem: UnitSystem {
+        UnitPrefs.resolveDistance(
+            system: UnitSystem(rawValue: unitSystemRaw) ?? .metric,
+            override: distanceSystemRaw)
+    }
+    private var distanceUnit: String { UnitFormatter.distanceUnit(distanceUnitSystem) }
 
     /// Focus for the numeric (Avg HR / Calories / Distance) fields so the keyboard Done button can resign
     /// them — the decimal pad has no return key. iOS-only effect; the enum keeps both platforms compiling.
@@ -74,7 +77,11 @@ struct ManualWorkoutSheet: View {
         // Pre-fill the distance in the user's unit so an untouched edit round-trips the stored metres
         // (buildManualRow then re-stores exactly what's shown). @AppStorage isn't usable pre-init, so read
         // the same key directly.
-        let sys = UnitSystem(rawValue: UserDefaults.standard.string(forKey: UnitPrefs.systemKey) ?? "") ?? .metric
+        let bodySystem = UnitSystem(
+            rawValue: UserDefaults.standard.string(forKey: UnitPrefs.systemKey) ?? "") ?? .metric
+        let sys = UnitPrefs.resolveDistance(
+            system: bodySystem,
+            override: UserDefaults.standard.string(forKey: UnitPrefs.distanceSystemKey) ?? "")
         _distanceText = State(initialValue: e?.distanceM.map { Self.distanceEntryString($0, system: sys) } ?? "")
     }
 
@@ -383,7 +390,7 @@ struct ManualWorkoutSheet: View {
     private var distanceMeters: Double? {
         let t = distanceText.trimmingCharacters(in: .whitespaces)
         guard !t.isEmpty, let v = Double(t), v >= 0 else { return nil }
-        let km = unitSystem == .imperial ? v / UnitFormatter.milesPerKilometer : v
+        let km = distanceUnitSystem == .imperial ? v / UnitFormatter.milesPerKilometer : v
         return km * 1000.0
     }
 
@@ -425,7 +432,9 @@ struct ManualWorkoutSheet: View {
         }
         if !distanceText.trimmingCharacters(in: .whitespaces).isEmpty,
            distanceMeters == nil || (distanceMeters ?? -1) < 0 || (distanceMeters ?? 0) > 1_000_000 {
-            return String(localized: "Distance must be 0–1,000 km.")
+            return distanceUnitSystem == .imperial
+                ? String(localized: "Distance must be 0–621 mi.")
+                : String(localized: "Distance must be 0–1,000 km.")
         }
         return String(localized: "Check the values and try again.")
     }
diff --git a/Strand/Screens/SettingsView.swift b/Strand/Screens/SettingsView.swift
index 239ae9ec55..a17a8642b9 100644
--- a/Strand/Screens/SettingsView.swift
+++ b/Strand/Screens/SettingsView.swift
@@ -170,9 +170,8 @@ struct SettingsView: View {
     /// WHOOP 4.0) regardless of this switch. See [PuffinExperiment.motionAwareWakeKey].
     @AppStorage(PuffinExperiment.motionAwareWakeKey) private var motionAwareWakeEnabled = false
 
-    // Imperial/Metric display preference (D#103). Stored data is always SI; this only changes how
-    // distances/weights/heights/temperatures are SHOWN — and lets the profile fields below take
-    // imperial entry. Temperature has a separate override so °C/°F can be picked independently.
+    // Display preferences. `units.system` remains the body-measurement choice for compatibility;
+    // exercise distance/pace can override it independently. Stored data is always SI.
     /// #1821: Clock format. Defaults to `.system`, so upgrading changes nobody's displayed times.
     /// #1841: shared with Android by name and meaning; each platform keeps its own store. Default FALSE
     /// on Apple (Android defaults true) because the system behaviour may not fire on our
@@ -181,6 +180,7 @@ struct SettingsView: View {
     @AppStorage(ClockFormatPreference.defaultsKey)
     private var clockFormatRaw = ClockFormatPreference.system.rawValue
     @AppStorage(UnitPrefs.systemKey) private var unitSystemRaw = UnitSystem.metric.rawValue
+    @AppStorage(UnitPrefs.distanceSystemKey) private var distanceSystemRaw = ""
     @AppStorage(UnitPrefs.temperatureKey) private var temperatureRaw = ""
     @AppStorage(UnitPrefs.skinTempDisplayKey) private var skinTempDisplayRaw = ""   // #1846
     // Effort display scale (#268). Display-only — Effort stays stored 0–100, this only chooses whether
@@ -257,6 +257,12 @@ struct SettingsView: View {
     }
 
     private var unitSystem: UnitSystem { UnitSystem(rawValue: unitSystemRaw) ?? .metric }
+    private var distanceUnitSystem: UnitSystem {
+        UnitPrefs.resolveDistance(system: unitSystem, override: distanceSystemRaw)
+    }
+    private var distanceSystemBinding: Binding<String> {
+        Binding(get: { distanceUnitSystem.rawValue }, set: { distanceSystemRaw = $0 })
+    }
     private var temperatureUnit: TemperatureUnit {
         UnitPrefs.resolveTemperature(system: unitSystem, override: temperatureRaw)
     }
@@ -984,31 +990,41 @@ struct SettingsView: View {
 
     // MARK: - Units
 
-    /// Imperial/Metric display toggle + a separate temperature override. Display-only — nothing stored
-    /// changes, NOOP keeps everything in SI and converts at the point of display.
+    /// Independent body and exercise-distance unit choices plus temperature and Effort overrides.
+    /// Display-only — nothing stored changes; NOOP keeps everything in SI.
     private var unitsCard: some View {
         SettingsSection(
             icon: "ruler",
             title: "Units",
-            blurb: "Choose how distances, weights, heights, temperatures and Effort are shown. Your data is always stored the same way. This only changes the display."
+            blurb: "Choose body measurements and exercise distance separately. Your data is always stored the same way; these settings only change its display."
         ) {
             VStack(spacing: 0) {
-                FormRow(label: "Measurement system") {
-                    Picker("Measurement system", selection: $unitSystemRaw) {
+                FormRow(label: "Body measurements") {
+                    Picker("Body measurements", selection: $unitSystemRaw) {
                         Text("Metric").tag(UnitSystem.metric.rawValue)
                         Text("Imperial").tag(UnitSystem.imperial.rawValue)
                     }
                     .labelsHidden()
                     .pickerStyle(.menu)
                     .tint(StrandPalette.accent)
-                    .accessibilityLabel("Measurement system")
+                    .accessibilityLabel("Body measurement units")
+                }
+                rowDivider
+                FormRow(label: "Exercise distance & pace") {
+                    Picker("Exercise distance & pace", selection: distanceSystemBinding) {
+                        Text("Kilometres").tag(UnitSystem.metric.rawValue)
+                        Text("Miles").tag(UnitSystem.imperial.rawValue)
+                    }
+                    .labelsHidden()
+                    .pickerStyle(.menu)
+                    .tint(StrandPalette.accent)
+                    .accessibilityLabel("Exercise distance and pace units")
                 }
                 rowDivider
                 FormRow(label: "Temperature") {
-                    // Three-way: "Match" follows the system above; °C / °F pin it explicitly. Stored as
-                    // an empty string ("match") or the TemperatureUnit raw value.
+                    // Three-way: "Follow body" follows body measurements; °C / °F pin it explicitly.
                     Picker("Temperature", selection: $temperatureRaw) {
-                        Text("Match").tag("")
+                        Text("Follow body").tag("")
                         Text("°C").tag(TemperatureUnit.celsius.rawValue)
                         Text("°F").tag(TemperatureUnit.fahrenheit.rawValue)
                     }
diff --git a/Strand/Screens/WorkoutDetailView.swift b/Strand/Screens/WorkoutDetailView.swift
index 3f7c90278b..22783ec47c 100644
--- a/Strand/Screens/WorkoutDetailView.swift
+++ b/Strand/Screens/WorkoutDetailView.swift
@@ -35,7 +35,12 @@ struct WorkoutDetailView: View {
     @Environment(\.dismiss) private var dismiss
 
     @AppStorage(UnitPrefs.systemKey) private var unitSystemRaw = UnitSystem.metric.rawValue
-    private var unitSystem: UnitSystem { UnitSystem(rawValue: unitSystemRaw) ?? .metric }
+    @AppStorage(UnitPrefs.distanceSystemKey) private var distanceSystemRaw = ""
+    private var distanceUnitSystem: UnitSystem {
+        UnitPrefs.resolveDistance(
+            system: UnitSystem(rawValue: unitSystemRaw) ?? .metric,
+            override: distanceSystemRaw)
+    }
 
     @AppStorage(UnitPrefs.effortScaleKey) private var effortScaleRaw = EffortScale.hundred.rawValue
     private var effortScale: EffortScale { UnitPrefs.resolveEffortScale(effortScaleRaw) }
@@ -361,12 +366,7 @@ struct WorkoutDetailView: View {
         let secs = row.durationS ?? Double(row.endTs - row.startTs)
         guard secs > 0 else { return "–" }
         let km = m / 1000.0
-        let (perUnit, label): (Double, String) = unitSystem == .imperial
-            ? (km * UnitFormatter.milesPerKilometer, "/mi")
-            : (km, "/km")
-        guard perUnit > 0 else { return "–" }
-        let secsPerUnit = Int((secs / perUnit).rounded())
-        return "\(secsPerUnit / 60):\(String(format: "%02d", secsPerUnit % 60)) \(label)"
+        return UnitFormatter.paceFromSecPerKm(secs / km, system: distanceUnitSystem)
     }
 
     private var routeAccessibilityLabel: String {
@@ -598,7 +598,7 @@ struct WorkoutDetailView: View {
     }
     private func distanceLabel(_ m: Double?) -> String {
         guard let m, m > 0 else { return "–" }
-        return UnitFormatter.distanceFromMeters(m, system: unitSystem)
+        return UnitFormatter.distanceFromMeters(m, system: distanceUnitSystem)
     }
     private func grouped(_ v: Double) -> String {
         Self.intFmt.string(from: NSNumber(value: Int(v.rounded()))) ?? "\(Int(v.rounded()))"
diff --git a/Strand/Screens/WorkoutsView.swift b/Strand/Screens/WorkoutsView.swift
index 90fe7a3031..d20eea588f 100644
--- a/Strand/Screens/WorkoutsView.swift
+++ b/Strand/Screens/WorkoutsView.swift
@@ -33,10 +33,14 @@ struct WorkoutsView: View {
     @State private var showLiveWorkout = false
     @State private var showStartSport = false
 
-    // Imperial/Metric display preference (D#103). Workout distances are stored in metres; the toggle
-    // re-labels them to miles/yards. Display-only — nothing on disk changes.
+    // Exercise-distance preference (#1913). Unset follows the original combined preference.
     @AppStorage(UnitPrefs.systemKey) private var unitSystemRaw = UnitSystem.metric.rawValue
-    private var unitSystem: UnitSystem { UnitSystem(rawValue: unitSystemRaw) ?? .metric }
+    @AppStorage(UnitPrefs.distanceSystemKey) private var distanceSystemRaw = ""
+    private var distanceUnitSystem: UnitSystem {
+        UnitPrefs.resolveDistance(
+            system: UnitSystem(rawValue: unitSystemRaw) ?? .metric,
+            override: distanceSystemRaw)
+    }
 
     // Effort display scale (#268) — drives the effort hero's read-out. Display-only.
     @AppStorage(UnitPrefs.effortScaleKey) private var effortScaleRaw = EffortScale.hundred.rawValue
@@ -972,7 +976,7 @@ struct WorkoutsView: View {
                      caption: "kcal",
                      accent: StrandPalette.metricAmber)
             StatTile(label: "Total Distance",
-                     value: distancesM.isEmpty ? "–" : UnitFormatter.distanceFromKilometers(totalKmRaw, system: unitSystem),
+                     value: distancesM.isEmpty ? "–" : UnitFormatter.distanceFromKilometers(totalKmRaw, system: distanceUnitSystem),
                      caption: String(localized: "covered"),
                      accent: StrandPalette.metricCyan)
             StatTile(label: "Most Active",
@@ -1769,7 +1773,7 @@ struct WorkoutsView: View {
 
     private func distanceLabel(_ m: Double?) -> String {
         guard let m, m > 0 else { return "–" }
-        return UnitFormatter.distanceFromMeters(m, system: unitSystem)
+        return UnitFormatter.distanceFromMeters(m, system: distanceUnitSystem)
     }
 
     private func oneDecimal(_ v: Double) -> String { String(format: "%.1f", v) }
diff --git a/Strand/Screens/XiaomiBandView.swift b/Strand/Screens/XiaomiBandView.swift
index fa0bef23ec..e98b4e77c7 100644
--- a/Strand/Screens/XiaomiBandView.swift
+++ b/Strand/Screens/XiaomiBandView.swift
@@ -19,6 +19,13 @@ private struct ChartWidthKey: PreferenceKey {
 
 struct XiaomiBandView: View {
     @EnvironmentObject var repo: Repository
+    @AppStorage(UnitPrefs.systemKey) private var unitSystemRaw = UnitSystem.metric.rawValue
+    @AppStorage(UnitPrefs.distanceSystemKey) private var distanceSystemRaw = ""
+    private var distanceUnitSystem: UnitSystem {
+        UnitPrefs.resolveDistance(
+            system: UnitSystem(rawValue: unitSystemRaw) ?? .metric,
+            override: distanceSystemRaw)
+    }
 
     /// Per-source partition key — matches `XiaomiImporter.deviceId`.
     private static let source = "xiaomi-band"
@@ -165,7 +172,9 @@ struct XiaomiBandView: View {
             .chart("Sleep score", "sleep_score", accentGradient, 0...100, { "\(Int($0.rounded()))" }),
             .header("Activity & Energy", "Movement"),
             .chart("Steps", "steps", cyanGradient, 0...12000, { intString($0) }),
-            .chart("Distance", "distance_m", cyanGradient, 0...10000, { String(format: "%.2f km", $0 / 1000) }),
+            .chart("Distance", "distance_m", cyanGradient, 0...10000, {
+                UnitFormatter.distanceFromMeters($0, system: distanceUnitSystem)
+            }),
             .chart("Active energy", "energy_kcal", amberGradient, 0...1000, { "\(intString($0)) kcal" }),
             .chart("Intensity minutes", "intensity_min", amberGradient, 0...120, { "\(Int($0.rounded())) min" }),
             .header("Wellbeing", "Body energy"),
diff --git a/StrandTests/BackupSyncRoundTripTests.swift b/StrandTests/BackupSyncRoundTripTests.swift
index b28e47b336..6e976fc2e9 100644
--- a/StrandTests/BackupSyncRoundTripTests.swift
+++ b/StrandTests/BackupSyncRoundTripTests.swift
@@ -75,6 +75,7 @@ final class BackupSyncRoundTripTests: XCTestCase {
             "profile.heightCm": 168.0,
             "profile.hrMax": 191,
             "units.system": "imperial",
+            "units.distance": "metric",
         ])
 
         // Restore into a throwaway DB path AND a suite-scoped defaults (never the runner's real domain).
@@ -93,6 +94,7 @@ final class BackupSyncRoundTripTests: XCTestCase {
         XCTAssertEqual(defaults.object(forKey: "profile.hrMaxOverride") as? Int, 191,
                        "Canonical profile.hrMax lands on ProfileStore's profile.hrMaxOverride key")
         XCTAssertEqual(defaults.string(forKey: "units.system"), "imperial")
+        XCTAssertEqual(defaults.string(forKey: "units.distance"), "metric")
     }
 
     func testLegacySingleEntryZipStillRestoresAndAppliesNoSettings() throws {
diff --git a/StrandTests/OnboardingUnitsPickerTests.swift b/StrandTests/OnboardingUnitsPickerTests.swift
index 5ad0bab4ef..05c15ea5f0 100644
--- a/StrandTests/OnboardingUnitsPickerTests.swift
+++ b/StrandTests/OnboardingUnitsPickerTests.swift
@@ -14,6 +14,7 @@ final class OnboardingUnitsPickerTests: XCTestCase {
     /// or the choice made in onboarding wouldn't reach the Weight/Height display.
     func testUnitSystemKeyIsTheSharedAppStorageKey() {
         XCTAssertEqual(UnitPrefs.systemKey, "units.system")
+        XCTAssertEqual(UnitPrefs.distanceSystemKey, "units.distance")
     }
 
     /// The picker tags are the `UnitSystem` rawValues; they must round-trip through the same initializer
diff --git a/StrandTests/UnitFormatterTests.swift b/StrandTests/UnitFormatterTests.swift
index 14dbde8db2..faa67a75a1 100644
--- a/StrandTests/UnitFormatterTests.swift
+++ b/StrandTests/UnitFormatterTests.swift
@@ -76,6 +76,13 @@ final class UnitFormatterTests: XCTestCase {
         XCTAssertEqual(UnitFormatter.distanceFromKilometers(12.4, system: .imperial), "7.7 mi")
     }
 
+    func testSpeedFollowsExerciseDistanceSystem() {
+        XCTAssertEqual(UnitFormatter.speedFromKilometersPerHour(10, system: .metric), "10.0 km/h")
+        XCTAssertEqual(UnitFormatter.speedFromKilometersPerHour(10, system: .imperial), "6.2 mph")
+        XCTAssertNil(UnitFormatter.speedFromKilometersPerHour(nil, system: .metric))
+        XCTAssertNil(UnitFormatter.speedFromKilometersPerHour(-1, system: .imperial))
+    }
+
     // MARK: - Mass formatting
 
     func testMassFromKilograms() {
@@ -198,6 +205,14 @@ final class UnitFormatterTests: XCTestCase {
         XCTAssertEqual(UnitPrefs.resolveTemperature(system: .metric, override: "fahrenheit"), .fahrenheit)
     }
 
+    func testDistanceSystemFallsBackToLegacyPreference() {
+        XCTAssertEqual(UnitPrefs.resolveDistance(system: .metric, override: ""), .metric)
+        XCTAssertEqual(UnitPrefs.resolveDistance(system: .imperial, override: ""), .imperial)
+        XCTAssertEqual(UnitPrefs.resolveDistance(system: .imperial, override: "metric"), .metric)
+        XCTAssertEqual(UnitPrefs.resolveDistance(system: .metric, override: "imperial"), .imperial)
+        XCTAssertEqual(UnitPrefs.resolveDistance(system: .imperial, override: "unknown"), .imperial)
+    }
+
     // MARK: - Unit labels
 
     func testUnitLabels() {
diff --git a/android/app/src/main/java/com/noop/data/BackupSettings.kt b/android/app/src/main/java/com/noop/data/BackupSettings.kt
index 6b8cc373ef..4b7d79df4b 100644
--- a/android/app/src/main/java/com/noop/data/BackupSettings.kt
+++ b/android/app/src/main/java/com/noop/data/BackupSettings.kt
@@ -40,8 +40,8 @@ object BackupSettingsCodec {
      * (platform-neutral) names. Mirrors the Apple `BackupSettings.whitelist` exactly.
      *
      * Profile: the body metrics that power HR zones / calories / recovery baselines, plus the manual
-     * HR-max override (`profile.hrMax`, 0 = auto/Tanaka). Display: the metric/imperial system, the
-     * separate temperature override ("" = match the system), and the Effort axis (#268). Deliberately
+     * HR-max override (`profile.hrMax`, 0 = auto/Tanaka). Display: the body and exercise-distance
+     * systems, separate temperature override ("" = follow body), and the Effort axis (#268). Deliberately
      * EXCLUDED: step calibration (per-strap, not per-person), the steps-engine fitted outputs
      * (derived), and every noop.* toggle that is device- or install-specific.
      */
@@ -54,6 +54,7 @@ object BackupSettingsCodec {
         "profile.hrMax" to Kind.INT,
         "profile.hrZoneThresholds" to Kind.STRING,
         "units.system" to Kind.STRING,
+        "units.distance" to Kind.STRING,
         "units.temperature" to Kind.STRING,
         "units.skinTempDisplay" to Kind.STRING,   // #1846, carried like the other display units
         "effort.scale" to Kind.STRING,
@@ -144,6 +145,9 @@ object BackupSettingsBridge {
         if (noop.contains(NoopPrefs.KEY_UNIT_SYSTEM)) {
             noop.getString(NoopPrefs.KEY_UNIT_SYSTEM, null)?.let { values["units.system"] = it }
         }
+        if (noop.contains(NoopPrefs.KEY_DISTANCE_UNIT_SYSTEM)) {
+            noop.getString(NoopPrefs.KEY_DISTANCE_UNIT_SYSTEM, null)?.let { values["units.distance"] = it }
+        }
         if (noop.contains(NoopPrefs.KEY_TEMPERATURE_UNIT)) {
             noop.getString(NoopPrefs.KEY_TEMPERATURE_UNIT, null)?.let { values["units.temperature"] = it }
         }
@@ -190,8 +194,9 @@ object BackupSettingsBridge {
 
         val editor = NoopPrefs.of(context).edit()
         (values["units.system"] as? String)?.let { editor.putString(NoopPrefs.KEY_UNIT_SYSTEM, it) }
+        (values["units.distance"] as? String)?.let { editor.putString(NoopPrefs.KEY_DISTANCE_UNIT_SYSTEM, it) }
         (values["units.temperature"] as? String)?.let { raw ->
-            // "" is the Apple side's "match the length/mass system"; here that state is key-absent.
+            // "" is the Apple side's "follow body measurements"; here that state is key-absent.
             if (raw.isEmpty()) editor.remove(NoopPrefs.KEY_TEMPERATURE_UNIT)
             else editor.putString(NoopPrefs.KEY_TEMPERATURE_UNIT, raw)
         }
diff --git a/android/app/src/main/java/com/noop/ui/LiveScreen.kt b/android/app/src/main/java/com/noop/ui/LiveScreen.kt
index 333ae53af9..cb6255500e 100644
--- a/android/app/src/main/java/com/noop/ui/LiveScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/LiveScreen.kt
@@ -106,10 +106,9 @@ fun LiveScreen(viewModel: AppViewModel, onManageDevices: () -> Unit = {}) {
     val activeWorkout by viewModel.activeWorkout.collectAsStateWithLifecycle()
     val lastWorkout by viewModel.lastWorkout.collectAsStateWithLifecycle()
 
-    // Imperial/Metric display preference (D#103). Live distance/pace are computed from metres + sec/km
-    // and re-labelled here. Display-only.
+    // Exercise-distance preference (#1913). Stored workout data remains SI.
     val context = LocalContext.current
-    val unitSystem = UnitPrefs.system(context)
+    val unitSystem = UnitPrefs.distanceSystem(context)
     // Effort display scale (#268) — routes the live + saved workout Effort read-outs. Display-only.
     val effortScale = UnitPrefs.effortScale(context)
     // Same day-cycle gate as the liquid Today (LiquidScreenSky.kt): the time-of-day sky settles behind the
diff --git a/android/app/src/main/java/com/noop/ui/LiveWorkoutScreen.kt b/android/app/src/main/java/com/noop/ui/LiveWorkoutScreen.kt
index 0ad26459ba..a504647d5a 100644
--- a/android/app/src/main/java/com/noop/ui/LiveWorkoutScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/LiveWorkoutScreen.kt
@@ -63,7 +63,7 @@ fun LiveWorkoutScreen(vm: AppViewModel, onClose: () -> Unit) {
     val profile = remember { ProfileStore.from(context.applicationContext) }
     // Effort display scale (#268) — routes the live Effort read-out so it matches every other surface.
     val effortScale = UnitPrefs.effortScale(context)
-    val unitSystem = UnitPrefs.system(context)
+    val unitSystem = UnitPrefs.distanceSystem(context)
     val bpm by vm.bpm.collectAsStateWithLifecycle()
     val activeWorkout by vm.activeWorkout.collectAsStateWithLifecycle()
     // Additive: instantaneous speed/cadence/power from a connected standard fitness sensor (RSC/CSC/CPS),
@@ -295,13 +295,14 @@ fun LiveWorkoutScreen(vm: AppViewModel, onClose: () -> Unit) {
  * Additive readout for a connected standard fitness sensor (a footpod / bike speed-cadence sensor / power
  * meter) feeding RSC/CSC/CPS ALONGSIDE heart rate. Only the fields the sensor actually sent render — each
  * tile is dropped when its value is absent, and the whole row is hidden when nothing is present, so a plain
- * HR-only workout looks exactly as before. Honest units: speed km/h, cadence per-minute (steps for running
- * / rpm for cycling), power watts. Reuses the same metric tile as the HR stats grid; tinted with the Effort
+ * HR-only workout looks exactly as before. Speed follows the exercise-distance preference; cadence stays
+ * per-minute and power in watts. Reuses the same metric tile as the HR stats grid; tinted with the Effort
  * world so it reads as part of the hero. Nothing here touches HR / zone / effort.
  */
 @Composable
 private fun SensorRow(sensor: StandardHrSource.SensorMetrics) {
-    val speed = StandardHrSource.formatSpeedKmh(sensor.speedKmh)
+    val unitSystem = UnitPrefs.distanceSystem(LocalContext.current)
+    val speed = UnitFormatter.speedFromKilometersPerHour(sensor.speedKmh, unitSystem)
     val cadence = StandardHrSource.formatCadence(sensor.cadence)
     val power = StandardHrSource.formatPowerWatts(sensor.powerWatts)
     if (speed == null && cadence == null && power == null) return
@@ -309,7 +310,7 @@ private fun SensorRow(sensor: StandardHrSource.SensorMetrics) {
         Overline("Sensor")
         Row(horizontalArrangement = Arrangement.spacedBy(Metrics.gap), modifier = Modifier.fillMaxWidth()) {
             if (speed != null) {
-                StatTile(modifier = Modifier.weight(1f), label = uiString(R.string.l10n_live_workout_screen_speed_2d2cb022), value = "$speed km/h", accent = Palette.effortColor)
+                StatTile(modifier = Modifier.weight(1f), label = uiString(R.string.l10n_live_workout_screen_speed_2d2cb022), value = speed, accent = Palette.effortColor)
             }
             if (cadence != null) {
                 StatTile(modifier = Modifier.weight(1f), label = uiString(R.string.l10n_live_workout_screen_cadence_68af11f0), value = "$cadence/min", accent = Palette.effortColor)
diff --git a/android/app/src/main/java/com/noop/ui/MainActivity.kt b/android/app/src/main/java/com/noop/ui/MainActivity.kt
index 236850d89d..08e56c0b6b 100644
--- a/android/app/src/main/java/com/noop/ui/MainActivity.kt
+++ b/android/app/src/main/java/com/noop/ui/MainActivity.kt
@@ -735,10 +735,10 @@ object NoopPrefs {
      *  with the Apple @AppStorage binding via [com.noop.analytics.ClockFormatPreference]. */
     const val KEY_CLOCK_FORMAT = com.noop.analytics.ClockFormatPreference.PREFS_KEY
 
-    /** Imperial/Metric display preference (D#103). Display-only, stored data stays SI. The length/mass
-     *  system is read by [UnitPrefs.system]; the temperature override (empty = "match the system") by
-     *  [UnitPrefs.temperature]. Mirrors macOS @AppStorage("units.system" / "units.temperature"). */
+    /** Display-only unit preferences; stored data stays SI. `units.system` remains the body preference
+     *  for compatibility, while exercise distance can override it independently. */
     const val KEY_UNIT_SYSTEM = "units.system"
+    const val KEY_DISTANCE_UNIT_SYSTEM = "units.distance"
     const val KEY_TEMPERATURE_UNIT = "units.temperature"
 
     /** #1846: which skin-temp number the cards lead with — "" / absent = a temperature (default), or the
@@ -749,6 +749,10 @@ object NoopPrefs {
         of(context).edit().putString(KEY_UNIT_SYSTEM, system.raw).apply()
     }
 
+    fun setDistanceUnitSystem(context: Context, system: UnitSystem) {
+        of(context).edit().putString(KEY_DISTANCE_UNIT_SYSTEM, system.raw).apply()
+    }
+
     /** Persist the temperature override, or pass null to clear it back to "match the system". */
     fun setSkinTempDisplay(context: Context, kind: com.noop.analytics.SkinTempDisplay.Kind?) {
         of(context).edit().apply {
diff --git a/android/app/src/main/java/com/noop/ui/OnboardingScreen.kt b/android/app/src/main/java/com/noop/ui/OnboardingScreen.kt
index b65058268a..bc55ff1d77 100644
--- a/android/app/src/main/java/com/noop/ui/OnboardingScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/OnboardingScreen.kt
@@ -659,11 +659,13 @@ private fun BondedStep(viewModel: AppViewModel) {
 private fun ProfileStep() {
     val context = LocalContext.current
     val profile = remember { ProfileStore.from(context.applicationContext) }
-    // Imperial/Metric display preference (D#103). The stored profile is always SI; the steppers keep
-    // operating in SI and only the DISPLAYED value re-labels to lb / ft-in. Held in remembered state
-    // (#781) so the Units control below can flip it live. SharedPreferences isn't reactive, so the
-    // picker writes through to NoopPrefs AND updates this state to re-render the Weight/Height labels.
+    // The stored profile is always SI. Body measurements and exercise distance can follow regional
+    // conventions independently; an unset distance choice follows the body choice for compatibility.
     var unitSystem by remember { mutableStateOf(UnitPrefs.system(context)) }
+    var distanceSystemRaw by remember {
+        mutableStateOf(NoopPrefs.of(context).getString(NoopPrefs.KEY_DISTANCE_UNIT_SYSTEM, "") ?: "")
+    }
+    val distanceUnitSystem = UnitPrefs.resolveDistance(unitSystem, distanceSystemRaw)
     var rev by remember { mutableIntStateOf(0) }
     fun mutate(block: () -> Unit) {
         block()
@@ -712,12 +714,10 @@ private fun ProfileStep() {
                     )
                 }
                 ThinDivider()
-                // Units control (#781). Onboarding read `unitSystem` for the Weight/Height display but
-                // had no way to set it, so US users were locked to kg/cm until they found Settings →
-                // Units. Mirror the Sex picker idiom; the stored profile stays SI either way, only the
-                // displayed labels re-format (lb / ft-in). Same key Settings → Units writes.
+                // Keep the two choices explicit: "Metric/Imperial" alone cannot describe common mixed
+                // conventions such as Canadian pounds with kilometres.
                 Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
-                    Overline(uiString(R.string.onboarding_units), color = Palette.textTertiary)
+                    Overline(uiString(R.string.units_body_measurements), color = Palette.textTertiary)
                     SegmentedPillControl(
                         items = listOf(UnitSystem.METRIC, UnitSystem.IMPERIAL),
                         selection = unitSystem,
@@ -730,6 +730,23 @@ private fun ProfileStep() {
                     )
                 }
                 ThinDivider()
+                Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                    Overline(uiString(R.string.units_exercise_distance_pace), color = Palette.textTertiary)
+                    SegmentedPillControl(
+                        items = listOf(UnitSystem.METRIC, UnitSystem.IMPERIAL),
+                        selection = distanceUnitSystem,
+                        label = {
+                            if (it == UnitSystem.METRIC) uiString(R.string.units_kilometres)
+                            else uiString(R.string.units_miles)
+                        },
+                        onSelect = {
+                            distanceSystemRaw = it.raw
+                            NoopPrefs.setDistanceUnitSystem(context, it)
+                        },
+                        modifier = Modifier.fillMaxWidth(),
+                    )
+                }
+                ThinDivider()
                 ProfileFieldRow(label = uiString(R.string.l10n_onboarding_screen_weight_69c0b815)) {
                     WheelPickerField(
                         // Full re-labelled string (e.g. "74.5 kg" / "164.2 lb"); unit folded into value.
diff --git a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
index 0bc0b0f390..f04141ef69 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
@@ -672,11 +672,13 @@ fun SettingsScreen(
     // BETA feature flag, default ON (`live_sessions_beta`, see LiveSessionPrefs); off hides the entry.
     var liveSessionsBeta by remember { mutableStateOf(LiveSessionPrefs.enabled(context)) }
 
-    // Imperial/Metric display preference (D#103). Display-only — stored data stays SI. The system drives
-    // the profile fields below (imperial entry) too, so it's local state the whole screen reads.
-    // `temperatureRaw` is "" (match the system) or a TemperatureUnit raw value. SharedPreferences isn't
-    // reactive, so these mirror into local state like the toggles above.
+    // Display preferences. The original system remains the body choice; exercise distance/pace has an
+    // independent override. SharedPreferences isn't reactive, so both mirror into local state.
     var unitSystem by remember { mutableStateOf(UnitPrefs.system(context)) }
+    var distanceSystemRaw by remember {
+        mutableStateOf(NoopPrefs.of(context).getString(NoopPrefs.KEY_DISTANCE_UNIT_SYSTEM, "") ?: "")
+    }
+    val distanceUnitSystem = UnitPrefs.resolveDistance(unitSystem, distanceSystemRaw)
     var clockFormat by remember { mutableStateOf(ClockPrefs.preference(context)) }   // #1821
     var temperatureRaw by remember {
         mutableStateOf(NoopPrefs.of(context).getString(NoopPrefs.KEY_TEMPERATURE_UNIT, "") ?: "")
@@ -1223,16 +1225,14 @@ fun SettingsScreen(
         }
 
         // --- Units ---
-        // Imperial/Metric display toggle + a separate temperature override. Display-only — nothing
-        // stored changes; NOOP keeps everything in SI and converts at the point of display. Mirrors the
-        // macOS Settings → Units card.
+        // Independent body and exercise-distance choices plus temperature/effort overrides. Display-only.
         SettingsCard(
             icon = Icons.Filled.Straighten,
             title = uiString(R.string.l10n_settings_screen_units_12748281),
-            blurb = "Choose how distances, weights, heights, temperatures and Effort are shown. Your data is always stored the same way. This only changes the display.",
+            blurb = uiString(R.string.units_settings_blurb),
         ) {
             Column {
-                SettingsFormRow(label = uiString(R.string.l10n_settings_screen_measurement_system_701d765d)) {
+                SettingsFormRow(label = uiString(R.string.units_body_measurements)) {
                     SegmentedPillControl(
                         items = listOf(UnitSystem.METRIC, UnitSystem.IMPERIAL),
                         selection = unitSystem,
@@ -1244,9 +1244,23 @@ fun SettingsScreen(
                     )
                 }
                 SettingsRowDivider()
+                SettingsFormRow(label = uiString(R.string.units_exercise_distance_pace)) {
+                    SegmentedPillControl(
+                        items = listOf(UnitSystem.METRIC, UnitSystem.IMPERIAL),
+                        selection = distanceUnitSystem,
+                        label = {
+                            if (it == UnitSystem.METRIC) uiString(R.string.units_kilometres)
+                            else uiString(R.string.units_miles)
+                        },
+                        onSelect = {
+                            distanceSystemRaw = it.raw
+                            NoopPrefs.setDistanceUnitSystem(context, it)
+                        },
+                    )
+                }
+                SettingsRowDivider()
                 SettingsFormRow(label = uiString(R.string.l10n_settings_screen_temperature_0a9062a9)) {
-                    // Three-way: "Match" follows the system above; °C / °F pin it explicitly. Stored as an
-                    // empty string ("match") or the TemperatureUnit raw value.
+                    // Three-way: the default follows body measurements; °C / °F pin it explicitly.
                     SegmentedPillControl(
                         items = listOf("", TemperatureUnit.CELSIUS.raw, TemperatureUnit.FAHRENHEIT.raw),
                         selection = temperatureRaw,
@@ -1254,7 +1268,7 @@ fun SettingsScreen(
                             when (it) {
                                 TemperatureUnit.CELSIUS.raw -> "°C"
                                 TemperatureUnit.FAHRENHEIT.raw -> "°F"
-                                else -> "Match"
+                                else -> uiString(R.string.units_follow_body)
                             }
                         },
                         onSelect = {
diff --git a/android/app/src/main/java/com/noop/ui/Units.kt b/android/app/src/main/java/com/noop/ui/Units.kt
index 9f2ae53f97..ed7a438d7c 100644
--- a/android/app/src/main/java/com/noop/ui/Units.kt
+++ b/android/app/src/main/java/com/noop/ui/Units.kt
@@ -8,19 +8,20 @@ import kotlin.math.roundToInt
 //
 // NOOP stores EVERYTHING in SI (km, kg, cm, °C) — the importers normalise on the way in, so this is a
 // purely cosmetic, display-only layer. There is no data migration and nothing in Room changes when the
-// user flips this. One Metric/Imperial switch for length+mass with a SEPARATE temperature override,
-// because plenty of people think in kg/cm but still read body temperature in °F (and vice versa).
+// user flips this. Body measurements and exercise distance each have their own Metric/Imperial choice,
+// with a SEPARATE temperature override, because regional conventions commonly mix pounds with kilometres
+// (or kg/cm with °F).
 // Default is Metric — most of the world, and it matches what we store.
 //
 // Persisted via NoopPrefs (SharedPreferences), the same mechanism every other Android preference uses.
 // This mirrors the macOS Units.swift + @AppStorage side exactly.
 
-/** Length+mass unit system. Temperature has its own override (see [UnitPrefs.temperature]). */
+/** A Metric/Imperial display choice. Body measurements and exercise distance persist separate values. */
 enum class UnitSystem(val raw: String) {
     METRIC("metric"),
     IMPERIAL("imperial");
 
-    /** Pairs temperature with the length/mass choice when no explicit override is set. */
+    /** Pairs temperature with the body-measurement choice when no explicit override is set. */
     val temperatureMatching: TemperatureUnit
         get() = if (this == IMPERIAL) TemperatureUnit.FAHRENHEIT else TemperatureUnit.CELSIUS
 
@@ -148,15 +149,24 @@ enum class SleepChartStyle(val raw: String) {
 enum class SleepStagePalette { NOOP, OURA, GARMIN }
 
 /**
- * Reads the two unit preferences from [NoopPrefs] and resolves the "match the system" default for
- * temperature. SharedPreferences isn't reactive, so Compose screens read these once into remembered
- * state (exactly like the other toggles) and re-read on a recomposition triggered by the Settings write.
+ * Reads the display preferences and resolves backwards-compatible fallbacks. SharedPreferences isn't
+ * reactive, so Compose screens read these once into remembered state (exactly like other toggles).
  */
 object UnitPrefs {
-    /** The length/mass system (default Metric). */
+    /** Body measurement system (default Metric); retains the original combined preference key. */
     fun system(context: Context): UnitSystem =
         UnitSystem.fromRaw(NoopPrefs.of(context).getString(NoopPrefs.KEY_UNIT_SYSTEM, null))
 
+    /** Exercise distance + pace. Unset/unknown follows the original combined preference. */
+    fun distanceSystem(context: Context): UnitSystem = resolveDistance(
+        system(context),
+        NoopPrefs.of(context).getString(NoopPrefs.KEY_DISTANCE_UNIT_SYSTEM, null),
+    )
+
+    /** Pure resolver shared with tests and Apple: an explicit valid value wins, otherwise legacy wins. */
+    fun resolveDistance(system: UnitSystem, override: String?): UnitSystem =
+        UnitSystem.entries.firstOrNull { it.raw == override } ?: system
+
     /**
      * Which skin-temp number the cards LEAD with (#1846). Absolute by default — a temperature is what a
      * temperature reading should say — with DEVIATION for wearers who track the ±baseline move. Only a
@@ -168,7 +178,7 @@ object UnitPrefs {
             NoopPrefs.of(context).getString(NoopPrefs.KEY_SKIN_TEMP_DISPLAY, null),
         ) ?: com.noop.analytics.SkinTempDisplay.Kind.ABSOLUTE
 
-    /** The resolved temperature unit, applying the "match the length/mass system" default. */
+    /** The resolved temperature unit, following body measurements by default. */
     fun temperature(context: Context): TemperatureUnit {
         val override = TemperatureUnit.fromRaw(
             NoopPrefs.of(context).getString(NoopPrefs.KEY_TEMPERATURE_UNIT, null),
@@ -300,6 +310,15 @@ object UnitFormatter {
     /** Unit label only, for sites that format the number separately. "km" / "mi". */
     fun distanceUnit(system: UnitSystem): String = if (system == UnitSystem.IMPERIAL) "mi" else "km"
 
+    /** Format speed stored in kilometres/hour in the exercise-distance system. */
+    fun speedFromKilometersPerHour(kmh: Double?, system: UnitSystem): String? {
+        if (kmh == null || !kmh.isFinite() || kmh < 0) return null
+        return when (system) {
+            UnitSystem.METRIC -> oneDecimal(kmh) + " km/h"
+            UnitSystem.IMPERIAL -> oneDecimal(kmToMiles(kmh)) + " mph"
+        }
+    }
+
     // MARK: Mass (stored kg)
 
     /** kg → pounds. */
diff --git a/android/app/src/main/java/com/noop/ui/WorkoutsScreen.kt b/android/app/src/main/java/com/noop/ui/WorkoutsScreen.kt
index f781308971..d7ca791168 100644
--- a/android/app/src/main/java/com/noop/ui/WorkoutsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/WorkoutsScreen.kt
@@ -963,7 +963,7 @@ private fun SummarySection(
 ) {
     // Imperial/Metric display preference (D#103). Distances are stored in metres; the toggle re-labels
     // them. Read here so a change recomposes the tiles. Display-only — nothing stored changes.
-    val unitSystem = UnitPrefs.system(LocalContext.current)
+    val unitSystem = UnitPrefs.distanceSystem(LocalContext.current)
     val totalCount = rows.size
     val totalTimeH = rows.mapNotNull { it.durationS }.sum() / 3600.0
     val totalKcal = rows.mapNotNull { it.energyKcal }.sum()
@@ -1550,7 +1550,7 @@ internal fun WorkoutDetailSheet(vm: AppViewModel, row: WorkoutRow, onDismiss: ()
             if (row.maxHr != null) DetailRow("Max HR", "${row.maxHr} bpm")
             if (row.energyKcal != null) DetailRow("Calories", "${grouped(row.energyKcal)} kcal")
             if (row.distanceM != null) {
-                val unitSystem = UnitPrefs.system(LocalContext.current)
+                val unitSystem = UnitPrefs.distanceSystem(LocalContext.current)
                 DetailRow("Distance", UnitFormatter.distanceFromKilometers(row.distanceM / 1000.0, unitSystem))
             }
             steps?.let { DetailRow("Steps", "${grouped(it.toDouble())} steps") }  // #398, on-foot sports
@@ -2043,7 +2043,7 @@ private fun ManualWorkoutDialog(
     // #1195: distance as ENTERED, in the user's unit (km/mi), converted to stored metres on save. Pre-fill
     // in that unit so an untouched edit round-trips the stored value. Period decimal (Locale.US) to match
     // toDoubleOrNull parsing, exactly as the macOS ManualWorkoutSheet does.
-    val unitSystem = UnitPrefs.system(LocalContext.current)
+    val unitSystem = UnitPrefs.distanceSystem(LocalContext.current)
     val distUnit = if (unitSystem == UnitSystem.IMPERIAL) "mi" else "km"
     var distance by remember {
         mutableStateOf(
@@ -2613,4 +2613,4 @@ private fun sportIconFuzzy(sport: String): ImageVector {
         s.contains("wheelchair") -> Icons.AutoMirrored.Filled.Accessible
         else -> Icons.Filled.FitnessCenter
     }
-}
\ No newline at end of file
+}
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 4d9e49f86f..7366f11cb1 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2736,4 +2736,10 @@
     <string name="coach_voice_error_unavailable">On-Device-Spracherkennung ist auf diesem Gerät oder für diese Sprache nicht verfügbar.</string>
     <string name="coach_voice_unavailable">On-Device-Spracherkennung ist auf diesem Gerät oder für diese Sprache nicht verfügbar.</string>
     <string name="coach_voice_permission_denied">Mikrofonberechtigung verweigert. Aktivieren Sie sie in den Einstellungen, um die Spracheingabe zu nutzen.</string>
+    <string name="units_settings_blurb">Wähle Einheiten für Körpermaße und Trainingsdistanz separat. Deine Daten werden immer gleich gespeichert; diese Einstellungen ändern nur die Anzeige.</string>
+    <string name="units_body_measurements">Körpermaße</string>
+    <string name="units_exercise_distance_pace">Trainingsdistanz &amp; Tempo</string>
+    <string name="units_kilometres">Kilometer</string>
+    <string name="units_miles">Meilen</string>
+    <string name="units_follow_body">Wie Körpermaße</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 0bd8d55a52..0108c67791 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2723,4 +2723,10 @@
     <string name="coach_voice_error_unavailable">El reconocimiento de voz en el dispositivo no está disponible en este dispositivo o idioma.</string>
     <string name="coach_voice_unavailable">El reconocimiento de voz en el dispositivo no está disponible en este dispositivo o idioma.</string>
     <string name="coach_voice_permission_denied">Permiso de micrófono denegado. Actívalo en Configuración para usar la entrada de voz.</string>
+    <string name="units_settings_blurb">Elige por separado las unidades de las medidas corporales y de la distancia de ejercicio. Los datos siempre se almacenan igual; estos ajustes solo cambian su visualización.</string>
+    <string name="units_body_measurements">Medidas corporales</string>
+    <string name="units_exercise_distance_pace">Distancia y ritmo del ejercicio</string>
+    <string name="units_kilometres">Kilómetros</string>
+    <string name="units_miles">Millas</string>
+    <string name="units_follow_body">Según medidas corporales</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index f77530217c..474f633ddd 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2722,4 +2722,10 @@
     <string name="coach_voice_error_unavailable">La reconnaissance vocale sur l\'appareil n\'est pas disponible sur cet appareil ou pour cette langue.</string>
     <string name="coach_voice_unavailable">La reconnaissance vocale sur l\'appareil n\'est pas disponible sur cet appareil ou pour cette langue.</string>
     <string name="coach_voice_permission_denied">Autorisation du microphone refusée. Activez-la dans les Paramètres pour utiliser la saisie vocale.</string>
+    <string name="units_settings_blurb">Choisissez séparément les unités des mensurations et de la distance d’exercice. Les données sont toujours stockées de la même façon ; ces réglages ne changent que leur affichage.</string>
+    <string name="units_body_measurements">Mensurations</string>
+    <string name="units_exercise_distance_pace">Distance et allure d’exercice</string>
+    <string name="units_kilometres">Kilomètres</string>
+    <string name="units_miles">Miles</string>
+    <string name="units_follow_body">Selon les mensurations</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 1bca6150e7..1716d503d8 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2727,4 +2727,10 @@
     <string name="coach_voice_error_unavailable">Rozpoznawanie mowy na urządzeniu jest niedostępne na tym urządzeniu lub dla tego języka.</string>
     <string name="coach_voice_unavailable">Rozpoznawanie mowy na urządzeniu nie jest dostępne na tym urządzeniu lub w tym języku.</string>
     <string name="coach_voice_permission_denied">Odmowa uprawnień do mikrofonu. Włącz je w Ustawieniach, aby używać wprowadzania głosowego.</string>
+    <string name="units_settings_blurb">Wybierz osobno jednostki pomiarów ciała i dystansu treningu. Dane są zawsze przechowywane tak samo; te ustawienia zmieniają tylko sposób wyświetlania.</string>
+    <string name="units_body_measurements">Pomiary ciała</string>
+    <string name="units_exercise_distance_pace">Dystans i tempo treningu</string>
+    <string name="units_kilometres">Kilometry</string>
+    <string name="units_miles">Mile</string>
+    <string name="units_follow_body">Jak pomiary ciała</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index a1218c3ba9..4cd88e760a 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2715,4 +2715,10 @@
     <string name="coach_voice_error_unavailable">O reconhecimento de voz no dispositivo não está disponível neste dispositivo ou idioma.</string>
     <string name="coach_voice_unavailable">O reconhecimento de voz no dispositivo não está disponível neste dispositivo ou idioma.</string>
     <string name="coach_voice_permission_denied">Permissão de microfone negada. Ative-a nas Configurações para usar a entrada de voz.</string>
+    <string name="units_settings_blurb">Escolha separadamente as unidades para medidas corporais e distância de exercício. Os dados são sempre armazenados da mesma forma; estas definições alteram apenas a apresentação.</string>
+    <string name="units_body_measurements">Medidas corporais</string>
+    <string name="units_exercise_distance_pace">Distância e ritmo do exercício</string>
+    <string name="units_kilometres">Quilómetros</string>
+    <string name="units_miles">Milhas</string>
+    <string name="units_follow_body">Como medidas corporais</string>
 </resources>
diff --git a/android/app/src/main/res/values-ru/strings.xml b/android/app/src/main/res/values-ru/strings.xml
index e0b28a105e..1492c5c63e 100644
--- a/android/app/src/main/res/values-ru/strings.xml
+++ b/android/app/src/main/res/values-ru/strings.xml
@@ -2606,4 +2606,10 @@
     <string name="l10n_settings_screen_bar_size_2304bfbb">Размер панели</string>
     <string name="l10n_settings_screen_bar_transparency_3f648fbb">Прозрачность панели</string>
     <string name="l10n_settings_screen_how_see_through_the_bar_is_ddb0c208">Насколько панель прозрачна. На самом слабом шаге её контур всё ещё виден, поэтому её всегда можно найти.</string>
+    <string name="units_settings_blurb">Выберите единицы для параметров тела и дистанции тренировки отдельно. Данные всегда хранятся одинаково; эти настройки меняют только отображение.</string>
+    <string name="units_body_measurements">Параметры тела</string>
+    <string name="units_exercise_distance_pace">Дистанция и темп тренировки</string>
+    <string name="units_kilometres">Километры</string>
+    <string name="units_miles">Мили</string>
+    <string name="units_follow_body">Как для параметров тела</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 0d26772f29..0eecde5dec 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2636,4 +2636,10 @@
     <string name="coach_voice_error_unavailable">此设备或语言不支持设备端语音识别。</string>
     <string name="coach_voice_unavailable">此设备或语言不支持设备端语音识别。</string>
     <string name="coach_voice_permission_denied">麦克风权限被拒绝。请在设置中启用以使用语音输入。</string>
+    <string name="units_settings_blurb">分别选择身体测量和运动距离的单位。数据的存储方式始终不变；这些设置只会改变显示方式。</string>
+    <string name="units_body_measurements">身体测量</string>
+    <string name="units_exercise_distance_pace">运动距离和配速</string>
+    <string name="units_kilometres">公里</string>
+    <string name="units_miles">英里</string>
+    <string name="units_follow_body">跟随身体测量</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index cee89f0c71..ebc992b9cd 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2752,4 +2752,10 @@
     <string name="coach_voice_error_unavailable">On-device speech recognition is not available on this device or locale.</string>
     <string name="coach_voice_unavailable">On-device speech recognition is not available on this device or locale.</string>
     <string name="coach_voice_permission_denied">Microphone permission denied. Enable it in Settings to use voice input.</string>
+    <string name="units_settings_blurb">Choose body measurements and exercise distance separately. Your data is always stored the same way; these settings only change its display.</string>
+    <string name="units_body_measurements">Body measurements</string>
+    <string name="units_exercise_distance_pace">Exercise distance &amp; pace</string>
+    <string name="units_kilometres">Kilometres</string>
+    <string name="units_miles">Miles</string>
+    <string name="units_follow_body">Follow body</string>
 </resources>
diff --git a/android/app/src/test/java/com/noop/data/BackupSettingsCodecTest.kt b/android/app/src/test/java/com/noop/data/BackupSettingsCodecTest.kt
index 56c1347d24..01622d52c5 100644
--- a/android/app/src/test/java/com/noop/data/BackupSettingsCodecTest.kt
+++ b/android/app/src/test/java/com/noop/data/BackupSettingsCodecTest.kt
@@ -37,6 +37,7 @@ class BackupSettingsCodecTest {
             "profile.hrMax" to 191,
             "profile.hrZoneThresholds" to "95,118,142,168,184",
             "units.system" to "imperial",
+            "units.distance" to "metric",
             "units.temperature" to "celsius",
             "effort.scale" to "whoop",
             "dayCycle.mode" to "sleep_onset",
@@ -57,6 +58,7 @@ class BackupSettingsCodecTest {
         assertEquals(191, back["profile.hrMax"])
         assertEquals("95,118,142,168,184", back["profile.hrZoneThresholds"])
         assertEquals("imperial", back["units.system"])
+        assertEquals("metric", back["units.distance"])
         assertEquals("celsius", back["units.temperature"])
         assertEquals("whoop", back["effort.scale"])
         assertEquals("sleep_onset", back["dayCycle.mode"])
diff --git a/android/app/src/test/java/com/noop/ui/OnboardingUnitsPickerTest.kt b/android/app/src/test/java/com/noop/ui/OnboardingUnitsPickerTest.kt
index c473985ea2..5f7e377046 100644
--- a/android/app/src/test/java/com/noop/ui/OnboardingUnitsPickerTest.kt
+++ b/android/app/src/test/java/com/noop/ui/OnboardingUnitsPickerTest.kt
@@ -21,6 +21,7 @@ class OnboardingUnitsPickerTest {
     @Test
     fun unitSystemKeyIsTheSharedPrefsKey() {
         assertEquals("units.system", NoopPrefs.KEY_UNIT_SYSTEM)
+        assertEquals("units.distance", NoopPrefs.KEY_DISTANCE_UNIT_SYSTEM)
     }
 
     /** The control's items are the [UnitSystem] entries; their raw values must round-trip through the
diff --git a/android/app/src/test/java/com/noop/ui/UnitFormatterTest.kt b/android/app/src/test/java/com/noop/ui/UnitFormatterTest.kt
index 53defea43f..74d9020c41 100644
--- a/android/app/src/test/java/com/noop/ui/UnitFormatterTest.kt
+++ b/android/app/src/test/java/com/noop/ui/UnitFormatterTest.kt
@@ -70,6 +70,14 @@ class UnitFormatterTest {
         assertEquals("7.7 mi", UnitFormatter.distanceFromKilometers(12.4, UnitSystem.IMPERIAL))
     }
 
+    @Test
+    fun speedFollowsExerciseDistanceSystem() {
+        assertEquals("10.0 km/h", UnitFormatter.speedFromKilometersPerHour(10.0, UnitSystem.METRIC))
+        assertEquals("6.2 mph", UnitFormatter.speedFromKilometersPerHour(10.0, UnitSystem.IMPERIAL))
+        assertEquals(null, UnitFormatter.speedFromKilometersPerHour(null, UnitSystem.METRIC))
+        assertEquals(null, UnitFormatter.speedFromKilometersPerHour(-1.0, UnitSystem.IMPERIAL))
+    }
+
     // --- Mass formatting ---
 
     @Test
@@ -131,6 +139,15 @@ class UnitFormatterTest {
         assertEquals(TemperatureUnit.FAHRENHEIT, UnitPrefs.resolveTemperature(UnitSystem.METRIC, "fahrenheit"))
     }
 
+    @Test
+    fun distanceSystemFallsBackToLegacyPreference() {
+        assertEquals(UnitSystem.METRIC, UnitPrefs.resolveDistance(UnitSystem.METRIC, null))
+        assertEquals(UnitSystem.IMPERIAL, UnitPrefs.resolveDistance(UnitSystem.IMPERIAL, ""))
+        assertEquals(UnitSystem.METRIC, UnitPrefs.resolveDistance(UnitSystem.IMPERIAL, "metric"))
+        assertEquals(UnitSystem.IMPERIAL, UnitPrefs.resolveDistance(UnitSystem.METRIC, "imperial"))
+        assertEquals(UnitSystem.IMPERIAL, UnitPrefs.resolveDistance(UnitSystem.IMPERIAL, "unknown"))
+    }
+
     // --- Unit labels ---
 
     @Test

From 92ca59af70d9ba4f81c940ed79351fbd954cda1b Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 17:56:55 +1200
Subject: [PATCH 275/333] storage: let the Apple footprint name the tables that
 can actually be large

Prompted by #1911, which asks which table holds a multi-gigabyte database. On
Apple that could not be answered.

The Test Centre probe read eight counts out of a test helper, bolted `steps` on
beside them, and emitted nine keys - omitting ppgHr, sleepState, ppgWaveform and
v18Aux. Android already reports all thirteen and flags those four as "can each be
large". Both platforms' comments claimed the keys mirrored each other; they did
not. The omission is worst where it matters: ppgWaveformSample is the only blob
table, so it is the one a per-second row-count model misprices most, and the
likeliest home for bytes such a model cannot explain.

storageRowCounts() now returns the full map, keyed verbatim as Android keys it.
Best-effort per table: an unreadable count is omitted rather than reported as
zero, because a zero reads as "this table is empty", which is a different claim
from "this table could not be read".

Swift held THREE copies of the same thirteen tables - TimestampHeal's local, which
storageStats' comment called canonical, storageStats' own, and the probe's shorter
nine. All three now read one list, so a stream added later is healed AND counted
AND named in the breakdown, or none of the three. That drift is not hypothetical:
storageStats' comment records its old fixed sum omitting six tables. A test pins
the total against the breakdown, and the heal's list is identical in set and order
to what it had.

No retention behaviour changes. This is the measurement the tiering proposed in
#1911 should be designed against, rather than against a model whose per-table row
rates have not been checked - measured against a 54-hour field capture, gravity
matches the model at 0.99x while hr runs 0.21x and resp 0.005x.

The key set is pinned on Apple only: those counts need a DAO and the JVM unit
tests have no in-memory Room, so Android's half is documented rather than tested,
and says so where the next editor will be standing.
---
 .../WhoopStore/Sources/WhoopStore/Reads.swift | 53 +++++++++++++++----
 .../Sources/WhoopStore/TimestampHeal.swift    | 11 ++--
 .../Tests/WhoopStoreTests/ReadTests.swift     | 31 +++++++++++
 Strand/System/TestCentreReport.swift          | 11 ++--
 .../java/com/noop/data/WhoopRepository.kt     |  9 ++++
 5 files changed, 94 insertions(+), 21 deletions(-)

diff --git a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
index d822f364ee..f8e7be047c 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
@@ -605,22 +605,53 @@ extension WhoopStore {
         }
     }
 
+    /// Per-table row counts for every accumulating decoded stream, keyed identically to Android's
+    /// `WhoopRepository.storageRowCounts` so a maintainer reads the SAME map from either platform.
+    ///
+    /// #1911 wants to know WHICH table holds a multi-gigabyte database, and the answer was unavailable on
+    /// Apple: the Test Centre probe emitted nine keys and left out `ppgHr`, `sleepState`, `ppgWaveform`
+    /// and `v18Aux` — the four Android's own comment singles out as "can each be large", and the ones a
+    /// row-count model misprices worst, since `ppgWaveformSample` is the only blob table here. A footprint
+    /// that omits the blob table cannot attribute the bytes it was collected to explain.
+    ///
+    /// Shares `rawTableKeys` with `storageStats()` and `TimestampHeal` so a table added to one is seen by
+    /// all three — counted in the total, named in the breakdown, and healed. Best-effort
+    /// per table: an unreadable count is omitted rather than reported as zero, because a zero here reads
+    /// as "this table is empty" and that is a different claim from "this table could not be read".
+    public func storageRowCounts() async throws -> [String: Int] {
+        try syncRead { db in
+            var out: [String: Int] = [:]
+            for (key, table) in Self.rawTableKeys {
+                if let n = try? Int.fetchOne(db, sql: "SELECT COUNT(*) FROM \(table)") { out[key] = n }
+            }
+            return out
+        }
+    }
+
+    /// The decoded stream tables and the key each reports under. The keys are Android's, verbatim.
+    static let rawTableKeys: [(String, String)] = [
+        ("hr", "hrSample"), ("rr", "rrInterval"), ("events", "event"), ("battery", "battery"),
+        ("spo2", "spo2Sample"), ("skinTemp", "skinTempSample"), ("resp", "respSample"),
+        ("gravity", "gravitySample"), ("steps", "stepSample"), ("ppgHr", "ppgHrSample"),
+        ("sleepState", "sleepStateSample"), ("ppgWaveform", "ppgWaveformSample"),
+        ("v18Aux", "v18AuxSample"),
+    ]
+
     /// Aggregate storage footprint: total decoded rows, raw batch count, total raw byteSize.
     public func storageStats() async throws -> (decodedRows: Int, rawBatches: Int, rawBytes: Int) {
         try syncRead { db in
-            // The COMPLETE set of accumulating decoded raw streams — KEEP IN SYNC with
-            // `TimestampHeal.rawTables` (its per-timestamp purge is the canonical list) and the Android
-            // `WhoopRepository.storageRowCounts`. Summed by iterating the list rather than a hand-written
-            // expression, because the old fixed sum silently under-reported: it omitted stepSample,
-            // ppgHrSample, sleepStateSample, ppgWaveformSample, rawImuSample and v18AuxSample — and a 4.0
-            // with PPG (ppgHrSample/ppgWaveformSample) or IMU capture (rawImuSample) banks millions of rows.
+            // The COMPLETE set of accumulating decoded raw streams, from `rawTableKeys` — no longer a
+            // "keep in sync with TimestampHeal" instruction, because that copy is gone and the heal now
+            // reads the same list. Android's `WhoopRepository.storageRowCounts` is the one that still has
+            // to be kept in step by hand; the note there says so.
+            //
+            // Summed by iterating the list rather than a hand-written expression, because the old fixed
+            // sum silently under-reported: it omitted stepSample, ppgHrSample, sleepStateSample,
+            // ppgWaveformSample, rawImuSample and v18AuxSample — and a 4.0 with PPG banks millions of
+            // rows. (rawImuSample has since been dropped outright, in `v41-drop-raw-imu-sample`.)
             // Table names are compile-time constants (never user input), so the interpolation is safe.
-            let rawTables = ["hrSample", "rrInterval", "event", "battery",
-                             "spo2Sample", "skinTempSample", "respSample", "gravitySample",
-                             "stepSample", "ppgHrSample", "sleepStateSample", "ppgWaveformSample",
-                             "v18AuxSample"]
             var decoded = 0
-            for t in rawTables {
+            for (_, t) in Self.rawTableKeys {
                 decoded += try Int.fetchOne(db, sql: "SELECT COUNT(*) FROM \(t)") ?? 0
             }
             let batches = try Int.fetchOne(db, sql: "SELECT COUNT(*) FROM rawBatch") ?? 0
diff --git a/Packages/WhoopStore/Sources/WhoopStore/TimestampHeal.swift b/Packages/WhoopStore/Sources/WhoopStore/TimestampHeal.swift
index 128e9c5401..29c959cd13 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/TimestampHeal.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/TimestampHeal.swift
@@ -52,12 +52,13 @@ extension WhoopStore {
             // legacy-rows gap rather than an ongoing one (the #547 ingest gate now rejects an implausible
             // ts before it is banked), which is exactly why it went unnoticed. Guarded by the same
             // out-of-bounds predicate as everything else — a plausible row is never touched.
-            let rawTables = ["hrSample", "rrInterval", "event", "battery",
-                             "spo2Sample", "skinTempSample", "respSample",
-                             "gravitySample", "stepSample", "ppgHrSample",
-                             "sleepStateSample", "ppgWaveformSample", "v18AuxSample"]
+            // The SAME list the storage footprint reports, rather than a third copy of it. This one was
+            // called canonical while `storageStats` kept its own and the Apple probe a shorter one again,
+            // and that drift is not hypothetical: `storageStats`' comment records its old fixed sum
+            // omitting six of these tables. One list means a stream added later is healed AND counted AND
+            // named in the breakdown, or none of the three - never silently one of them.
             var rawDeleted = 0
-            for table in rawTables {
+            for (_, table) in WhoopStore.rawTableKeys {
                 try db.execute(sql: "DELETE FROM \(table) WHERE ts < ? OR ts > ?",
                                arguments: [lo, hi])
                 rawDeleted += db.changesCount
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
index c07e277bb8..eb19a525e9 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
@@ -364,4 +364,35 @@ final class ReadTests: XCTestCase {
         XCTAssertEqual(stats.rawBytes, 4)
 #endif
     }
+
+    /// #1911: the footprint must name EVERY accumulating table, including the four the Apple probe used
+    /// to omit — `ppgHr`, `sleepState`, `ppgWaveform`, `v18Aux`. Those are the ones a row-count model
+    /// misprices worst (`ppgWaveformSample` is the only blob table), so leaving them out made the
+    /// footprint unable to attribute the bytes it was collected to explain.
+    ///
+    /// Pinned against the Android key set verbatim: a maintainer comparing meta.json across platforms is
+    /// comparing the same map, and a table added to one side without the other shows up here.
+    func testStorageRowCountsNamesEveryAccumulatingTable() async throws {
+        let store = try await WhoopStore.inMemory()
+        let counts = try await store.storageRowCounts()
+        let expected = ["hr", "rr", "events", "battery", "spo2", "skinTemp", "resp", "gravity",
+                        "steps", "ppgHr", "sleepState", "ppgWaveform", "v18Aux"]
+        XCTAssertEqual(Set(counts.keys), Set(expected),
+                       "key set must match Android's WhoopRepository.storageRowCounts exactly")
+        for k in expected {
+            XCTAssertEqual(counts[k], 0, "\(k) starts empty in a fresh store")
+        }
+    }
+
+    /// The total and the breakdown are derived from ONE list, so they cannot disagree about which tables
+    /// exist. Pinned because they used to be two hand-maintained lists, and the older one had already
+    /// drifted once — the comment on `storageStats` records it omitting six tables.
+    func testStorageStatsTotalAgreesWithTheBreakdown() async throws {
+        let store = try await seeded()
+        let counts = try await store.storageRowCounts()
+        let stats = try await store.storageStats()
+        XCTAssertEqual(stats.decodedRows, counts.values.reduce(0, +),
+                       "the summed total must equal the per-table breakdown")
+    }
+
 }
diff --git a/Strand/System/TestCentreReport.swift b/Strand/System/TestCentreReport.swift
index 7f684203ce..5b82b36f63 100644
--- a/Strand/System/TestCentreReport.swift
+++ b/Strand/System/TestCentreReport.swift
@@ -80,11 +80,12 @@ final class TestCentreReport: ObservableObject {
         var rows: [String: Int] = [:]
         var rawBytes = 0
         if let store = await repo?.storeHandle() {
-            if let c = try? await store.storageStats_rowCountsForTest() {
-                rows = ["hr": c.hr, "rr": c.rr, "events": c.events, "battery": c.battery,
-                        "spo2": c.spo2, "skinTemp": c.skinTemp, "resp": c.resp, "gravity": c.gravity]
-            }
-            if let steps = try? await store.stepCountForTest() { rows["steps"] = steps }
+            // #1911: every accumulating table, not the nine this used to name. The old shape read eight
+            // counts out of a test helper and bolted `steps` on beside them, which silently omitted
+            // ppgHr, sleepState, ppgWaveform and v18Aux — the four Android already reports and flags as
+            // "can each be large". A footprint that leaves out the only blob table cannot attribute the
+            // bytes it exists to explain, which is exactly what #1911 needs answered.
+            if let counts = try? await store.storageRowCounts() { rows = counts }
             rawBytes = (try? await store.storageStats().rawBytes) ?? 0
         }
         if let url = live.puffinCaptureURL {
diff --git a/android/app/src/main/java/com/noop/data/WhoopRepository.kt b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
index 683b557f93..a49033de05 100644
--- a/android/app/src/main/java/com/noop/data/WhoopRepository.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
@@ -1707,6 +1707,15 @@ class WhoopRepository(
      * the Phase-1 zeros. Keys mirror the Swift probe (TestCentreReport.storageProbe) so a maintainer
      * reads the same map from either platform. Best-effort: a read failure returns empty (the caller's
      * zeroed fallback stays an honest "unreadable"), never a fabricated figure.
+     *
+     * THE KEY SET IS A CROSS-PLATFORM CONTRACT. Apple pins it in `WhoopStoreTests.ReadTests`
+     * (`testStorageRowCountsNamesEveryAccumulatingTable`) against this exact list, so adding a table
+     * there fails loudly until both sides agree. There is no equivalent pin on this side: these counts
+     * need a DAO, and the JVM unit tests have no in-memory Room, so a key added HERE and not there goes
+     * unnoticed. Add it to `WhoopStore.rawTableKeys` in the same change - the Apple probe reads that list
+     * for both its total and its breakdown, so a table missing from it is invisible in the footprint,
+     * which is how ppgWaveform - the only blob table, and the one a row-count model misprices worst -
+     * stayed unreported on Apple until #1911 asked which table was large.
      */
     suspend fun storageRowCounts(): Map<String, Int> = runCatching {
         mapOf(

From e4cf076ccf381617f20a3726ff9cc8b24f02b7fc Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 18:00:36 +1200
Subject: [PATCH 276/333] build: testing build 446 / 327

Build numbers only; 11.1.1 stays as the next unreleased version.

The first build carrying the Coach feature set - streaming replies, persisted
history, on-device voice, the morning brief, widgets and the Siri intent - with
the voice controllers localized on both platforms and voice now guaranteed
on-device rather than merely preferring it.

Also carries @kavemang's split of body measurements from exercise distance and
pace, so pounds with kilometres is expressible; @evoveotech's skin-temp explorer
change, which leads with the absolute and honours the Settings choice; and a
storage footprint that finally names ppgWaveform and the other large tables it
used to leave out on Apple.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index e589844812..639a931d7b 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 445
+        versionCode = 446
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 988717f631..8fb4d5a69c 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "326"
+    CURRENT_PROJECT_VERSION: "327"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From fae94209c29c0a95f13eea3ae02a6940cd88cc7e Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Sun, 6 Sep 2026 11:44:47 +0530
Subject: [PATCH 277/333] wind-down: pin the per-day nudge to the nudge's own
 day, not the wake's

From @evoveotech. Addresses #1863.

An early wake wraps the wind-down nudge over midnight: 03:30 with an 8 h need and
a 30 min lead puts the nudge at 19:00 the PREVIOUS evening. The minute-of-day
wrap loses which day that evening belongs to, so the weekly trigger was pinned to
the wake's own weekday - firing eight hours AFTER the wake it exists to precede,
and pointing at the next day's wake, which may be a different time entirely.

iOS-only: Android already derives the shift and moves the weekday
(WindDownScheduler, pinned by PhoneAlarmWeekdayTest). This is the Apple twin, and
the two helpers are the same operation - floorMod on the weekday, floor division
on the day shift.

The request id stays keyed to the WAKE's weekday, so toggling or clearing an
override still matches the ids the enumeration removes.

Twelve tests, including the reported case (03:30 Tuesday wake nudging on Monday)
and the week-end wrap (Sunday's nudge on Saturday).
---
 Strand/System/WindDownNudge.swift             | 30 +++++++++-
 StrandTests/WindDownPerDayOverrideTests.swift | 56 +++++++++++++++++++
 2 files changed, 85 insertions(+), 1 deletion(-)

diff --git a/Strand/System/WindDownNudge.swift b/Strand/System/WindDownNudge.swift
index 24eba99849..1002a5e9ad 100644
--- a/Strand/System/WindDownNudge.swift
+++ b/Strand/System/WindDownNudge.swift
@@ -95,6 +95,27 @@ enum WindDownNudge {
         return ((raw % day) + day) % day
     }
 
+    /// The day shift for a given weekday's nudge — 0 if the nudge lands on the same day as the wake,
+    /// -1 if it wraps to the previous evening. The minute-of-day wrap in `nudgeMinuteOfDay` silently
+    /// loses which day the nudge belongs to; this companion carries that information so the scheduler
+    /// can pin the trigger to the nudge's day, not the wake's. (#1863)
+    ///
+    /// `raw` is always in [-780, 1139] given the clamped inputs (wake ≤ 1439, sleepNeed ≥ 300, lead ≤ 120),
+    /// so the shift is always 0 or -1 — but the formula is general floor-division for safety.
+    static func nudgeDayShift(forWeekday weekday: Int) -> Int {
+        let raw = wakeMinutes(forWeekday: weekday) - sleepNeedMinutes - leadMinutes
+        let day = 24 * 60
+        // Floor division (Swift's `/` truncates toward zero, so adjust for negatives).
+        return raw < 0 ? -(((-raw - 1) / day) + 1) : raw / day
+    }
+
+    /// Shift a Calendar weekday (1=Sun…7=Sat) by a day count, wrapping through the week end. (#1863)
+    /// `shiftedWeekday(weekday: 1, by: -1)` → 7 (Sunday's evening-before nudge fires on Saturday).
+    static func shiftedWeekday(weekday: Int, by shift: Int) -> Int {
+        let zeroBased = weekday - 1 + shift
+        return ((zeroBased % 7) + 7) % 7 + 1
+    }
+
     // MARK: - Public API
 
     /// The result of enabling the nudge — lets the UI react instead of silently persisting an "on" toggle
@@ -190,11 +211,18 @@ enum WindDownNudge {
         if hasPerDayOverrides {
             for weekday in 1...7 {
                 let minute = nudgeMinuteOfDay(forWeekday: weekday)
+                // #1863 — an early wake (e.g. 03:30) wraps the nudge minute to the previous evening
+                // (19:00). The minute wrap alone loses which DAY that evening belongs to, so the trigger
+                // was pinned to the wake's own weekday — firing 8+ hours AFTER the wake it precedes.
+                // Derive the day shift and pin the trigger to the nudge's day, not the wake's.
+                let shift = nudgeDayShift(forWeekday: weekday)
                 var comps = DateComponents()
-                comps.weekday = weekday   // Calendar weekday 1=Sun…7=Sat → fires weekly on that day
+                comps.weekday = shiftedWeekday(weekday: weekday, by: shift)   // the nudge's day
                 comps.hour = minute / 60
                 comps.minute = minute % 60
                 let trigger = UNCalendarNotificationTrigger(dateMatching: comps, repeats: true)
+                // The request id stays keyed to the wake's weekday so toggling/clearing overrides
+                // always matches the ids `perDayRequestIds` enumerates.
                 center.add(UNNotificationRequest(identifier: "\(requestId)-wd\(weekday)",
                                                  content: content, trigger: trigger))
             }
diff --git a/StrandTests/WindDownPerDayOverrideTests.swift b/StrandTests/WindDownPerDayOverrideTests.swift
index 2533fe805a..5b47c3e0cc 100644
--- a/StrandTests/WindDownPerDayOverrideTests.swift
+++ b/StrandTests/WindDownPerDayOverrideTests.swift
@@ -80,4 +80,60 @@ final class WindDownPerDayOverrideTests: XCTestCase {
         WindDownNudge.setWakeOverride(weekday: 9, minutes: 8 * 60)   // no weekday 9
         XCTAssertFalse(WindDownNudge.hasPerDayOverrides)
     }
+
+    // MARK: - #1863: day shift and weekday pinning
+
+    func testShiftedWeekday_wrapsThroughWeekEnd() {
+        // Sunday (1) − 1 → Saturday (7); Monday (2) − 1 → Sunday (1); no shift is identity.
+        XCTAssertEqual(WindDownNudge.shiftedWeekday(weekday: 1, by: -1), 7)
+        XCTAssertEqual(WindDownNudge.shiftedWeekday(weekday: 2, by: -1), 1)
+        XCTAssertEqual(WindDownNudge.shiftedWeekday(weekday: 3, by: -1), 2)
+        XCTAssertEqual(WindDownNudge.shiftedWeekday(weekday: 7, by: -1), 6)
+        for weekday in 1...7 {
+            XCTAssertEqual(WindDownNudge.shiftedWeekday(weekday: weekday, by: 0), weekday)
+        }
+    }
+
+    func testNudgeDayShift_earlyWake_isPreviousDay() {
+        // Tuesday 03:30 wake, default 8h need + 30m lead: raw = 210 − 480 − 30 = −300 → shift −1.
+        WindDownNudge.setWakeMinutes(7 * 60)
+        WindDownNudge.setWakeOverride(weekday: 3, minutes: 3 * 60 + 30)   // Tuesday 03:30
+        XCTAssertEqual(WindDownNudge.nudgeDayShift(forWeekday: 3), -1)
+        // The wrapped minute is 19:00 the previous evening.
+        XCTAssertEqual(WindDownNudge.nudgeMinuteOfDay(forWeekday: 3), 19 * 60)
+    }
+
+    func testNudgeDayShift_normalWake_isPreviousDay() {
+        // 07:00 wake, default 8h need + 30m lead: raw = 420 − 480 − 30 = −90 → shift −1.
+        WindDownNudge.setWakeMinutes(7 * 60)
+        XCTAssertEqual(WindDownNudge.nudgeDayShift(forWeekday: 3), -1)
+    }
+
+    func testNudgeDayShift_lateWake_isSameDay() {
+        // 09:00 wake, default 8h need + 30m lead: raw = 540 − 480 − 30 = 30 → shift 0.
+        WindDownNudge.setWakeMinutes(9 * 60)
+        XCTAssertEqual(WindDownNudge.nudgeDayShift(forWeekday: 3), 0)
+    }
+
+    func testEarlyWakeNudge_pinnedToPreviousDay() {
+        // #1863 scenario: Tuesday (weekday 3) 03:30 wake → nudge at 19:00 on Monday (weekday 2).
+        WindDownNudge.setWakeMinutes(7 * 60)
+        WindDownNudge.setWakeOverride(weekday: 3, minutes: 3 * 60 + 30)   // Tuesday 03:30
+        let shift = WindDownNudge.nudgeDayShift(forWeekday: 3)
+        let minute = WindDownNudge.nudgeMinuteOfDay(forWeekday: 3)
+        let nudgeWeekday = WindDownNudge.shiftedWeekday(weekday: 3, by: shift)
+        XCTAssertEqual(shift, -1)
+        XCTAssertEqual(minute, 19 * 60)            // 19:00
+        XCTAssertEqual(nudgeWeekday, 2)            // Monday, not Tuesday
+    }
+
+    func testEarlyWakeOnSunday_pinnedToSaturday() {
+        // Sunday (weekday 1) 03:30 wake → nudge at 19:00 on Saturday (weekday 7).
+        WindDownNudge.setWakeMinutes(7 * 60)
+        WindDownNudge.setWakeOverride(weekday: 1, minutes: 3 * 60 + 30)   // Sunday 03:30
+        let shift = WindDownNudge.nudgeDayShift(forWeekday: 1)
+        let nudgeWeekday = WindDownNudge.shiftedWeekday(weekday: 1, by: shift)
+        XCTAssertEqual(shift, -1)
+        XCTAssertEqual(nudgeWeekday, 7)            // Saturday, wrapping the week end
+    }
 }

From c7b0fc53dc8089f07e3561d8c0c666002d32723e Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Sun, 6 Sep 2026 11:44:55 +0530
Subject: [PATCH 278/333] alarm: per-day wake overrides now drive the strap
 alarm and backup notification

From @evoveotech. Addresses #1864.

Per-day wake overrides existed but only the default time reached the strap alarm
and the backup notification, so a day with its own wake time was woken at the
default one.

The interesting part is the identifier change: with overrides the single daily
notification becomes seven per-day ones, so switching modes could strand the old
request and fire twice. Every path now enumerates all eight ids - the single one
plus the seven - and clears them before scheduling and on cancel, so neither mode
can leave the other's requests behind.

Overrides are filtered to a real weekday and a real minute before use, an
override on a day the alarm is not armed for is ignored, and a day without one
keeps the default. Twenty-one tests, including one pinning that an empty override
map takes the byte-for-byte old path - so a user who has set none sees no change
at all.

Also closes part of a long-standing gap where the iOS strap alarm lagged
Android's (#554, #111).
---
 Strand/App/AppModel.swift                | 84 +++++++++++++++++++-----
 Strand/Screens/SmartAlarmView.swift      | 10 +++
 StrandTests/SmartAlarmWeekdayTests.swift | 64 ++++++++++++++++++
 3 files changed, 141 insertions(+), 17 deletions(-)

diff --git a/Strand/App/AppModel.swift b/Strand/App/AppModel.swift
index 77ce9a5562..9e215541e4 100644
--- a/Strand/App/AppModel.swift
+++ b/Strand/App/AppModel.swift
@@ -1368,7 +1368,14 @@ final class AppModel: ObservableObject {
     /// `log` (optional): strap-log sink for the not-authorized bail (#401 close-out) — a silent no-op left a
     /// user whose backup never fired with nothing in the log. The caller wraps the sink in a main-actor hop
     /// (the auth check completes off-main). Diagnostic only.
+    ///
+    /// #1864: `overrides` carries the per-weekday wake-time overrides (#554 / `WindDownNudge.perDayWakeOverrides`).
+    /// A weekday with an override fires at ITS OWN time, not the shared `minutes` — so a user who sets
+    /// "Tuesday 03:30" on the alarm screen is woken at 03:30 on Tuesday, not at the default time with only
+    /// the wind-down reminder shifting. An empty map (the default) is byte-for-byte the old path. Mirrors
+    /// Android's `SmartAlarmScheduler.arm` which reads `SmartAlarmStore.targetOverrides` per weekday.
     static func scheduleSmartAlarmBackupNotification(minutes: Int, weekdays: Set<Int>,
+                                                     overrides: [Int: Int] = [:],
                                                      log: ((String) -> Void)? = nil) {
         #if os(iOS)
         let center = UNUserNotificationCenter.current()
@@ -1383,6 +1390,9 @@ final class AppModel: ObservableObject {
         let valid = weekdays.filter { (1...7).contains($0) }
         // A non-empty selection that filters to nothing (only out-of-range numbers) has no day to fire on.
         if !weekdays.isEmpty && valid.isEmpty { return }
+        // #1864: only valid override entries (day 1…7, minute in [0, 1440)) count; a day without an override
+        // uses the default `minutes`. When the map is empty this is byte-for-byte the old path.
+        let cleanOverrides = overrides.filter { (1...7).contains($0.key) && (0..<24 * 60).contains($0.value) }
 
         // Build + add the repeating trigger(s). Factored so the already-authorized and the just-granted
         // paths schedule identically.
@@ -1391,20 +1401,37 @@ final class AppModel: ObservableObject {
             content.title = String(localized: "Smart alarm")
             content.body = String(localized: "Backup wake: your smart alarm time is here.")
             content.sound = .default
-            let hour = minutes / 60
-            let minute = minutes % 60
             if weekdays.isEmpty {
-                var comps = DateComponents()
-                comps.hour = hour
-                comps.minute = minute
-                let trigger = UNCalendarNotificationTrigger(dateMatching: comps, repeats: true)
-                center.add(UNNotificationRequest(identifier: smartAlarmBackupId, content: content, trigger: trigger))
+                // Every day. When overrides exist, fan out to per-weekday triggers (each at its own time)
+                // so an override on a day the weekday set doesn't restrict still fires at the right time.
+                // Without overrides this stays the single daily trigger (byte-for-byte the old path).
+                if cleanOverrides.isEmpty {
+                    let hour = minutes / 60
+                    let minute = minutes % 60
+                    var comps = DateComponents()
+                    comps.hour = hour
+                    comps.minute = minute
+                    let trigger = UNCalendarNotificationTrigger(dateMatching: comps, repeats: true)
+                    center.add(UNNotificationRequest(identifier: smartAlarmBackupId, content: content, trigger: trigger))
+                } else {
+                    for weekday in 1...7 {
+                        let m = cleanOverrides[weekday] ?? minutes
+                        var comps = DateComponents()
+                        comps.weekday = weekday
+                        comps.hour = m / 60
+                        comps.minute = m % 60
+                        let trigger = UNCalendarNotificationTrigger(dateMatching: comps, repeats: true)
+                        center.add(UNNotificationRequest(identifier: "\(smartAlarmBackupId)-d\(weekday)",
+                                                         content: content, trigger: trigger))
+                    }
+                }
             } else {
                 for weekday in valid {
+                    let m = cleanOverrides[weekday] ?? minutes
                     var comps = DateComponents()
                     comps.weekday = weekday   // Calendar weekday 1=Sun…7=Sat , fires weekly on that day
-                    comps.hour = hour
-                    comps.minute = minute
+                    comps.hour = m / 60
+                    comps.minute = m % 60
                     let trigger = UNCalendarNotificationTrigger(dateMatching: comps, repeats: true)
                     center.add(UNNotificationRequest(identifier: "\(smartAlarmBackupId)-d\(weekday)",
                                                      content: content, trigger: trigger))
@@ -1445,14 +1472,25 @@ final class AppModel: ObservableObject {
     /// On iOS this ALSO (dis)arms the best-effort backup wake notification (#4 + #6): a repeating daily
     /// `UNCalendarNotificationTrigger` that survives suspend/relaunch, so a missed strap buzz still gets
     /// an OS-level wake. macOS keeps just the firmware alarm (the static helpers are no-ops there).
+    ///
+    /// #1864: the per-weekday wake-time overrides (`WindDownNudge.perDayWakeOverrides`, #554) now flow
+    /// through to BOTH the strap firmware alarm and the backup notification — so a user who sets
+    /// "Tuesday 03:30" on the alarm screen is woken at 03:30 on Tuesday, not at the default time with
+    /// only the wind-down reminder shifting. Before this, the overrides had exactly two readers
+    /// (`wakeMinutes(forWeekday:)` → the nudge fan-out, and `SmartAlarmView` which edits them) and the
+    /// alarm backup took a single time plus a day set, so the control on the alarm screen silently moved
+    /// only the evening reminder. Mirrors Android's `reconcileStrapAlarm` which passes `dayOverrides`
+    /// to `nextSmartAlarmEpochSec`, and `SmartAlarmScheduler.arm` which reads `targetOverrides`.
     func applySmartAlarm() {
+        let overrides = WindDownNudge.perDayWakeOverrides
         guard behavior.smartAlarmEnabled else {
             ble.disableStrapAlarm()
             Self.cancelSmartAlarmBackupNotification()
             return
         }
         guard let next = Self.nextSmartAlarmDate(minutes: behavior.smartAlarmMinutes,
-                                                 weekdays: behavior.smartAlarmWeekdays) else {
+                                                 weekdays: behavior.smartAlarmWeekdays,
+                                                 overrides: overrides) else {
             // No enabled weekday in the next week (only possible from a corrupted set) , disarm rather
             // than arm a misleading time the user never asked for.
             ble.disableStrapAlarm()
@@ -1465,6 +1503,7 @@ final class AppModel: ObservableObject {
         // @MainActor - the same Task hop the importTraceSink uses.
         Self.scheduleSmartAlarmBackupNotification(minutes: behavior.smartAlarmMinutes,
                                                   weekdays: behavior.smartAlarmWeekdays,
+                                                  overrides: overrides,
                                                   log: { [weak self] line in
                                                       Task { @MainActor in self?.live.append(log: line) }
                                                   })
@@ -1474,28 +1513,39 @@ final class AppModel: ObservableObject {
     /// - `minutes`: target wake time, minutes since local midnight.
     /// - `weekdays`: Calendar weekday numbers (1 = Sun … 7 = Sat) the alarm may fire on. Empty = every
     ///   day. Days outside 1…7 are ignored.
+    /// - `overrides`: per-weekday wake-time overrides (#554 / #1864). A weekday with an override uses
+    ///   ITS OWN time instead of `minutes`; a day without one falls back to `minutes`. Only valid
+    ///   entries (day 1…7, minute in [0, 1440)) count. An empty map is byte-for-byte the old path.
     /// Returns the next strictly-future date matching the time on an enabled weekday, scanning today
     /// plus the next 7 days, or nil if no enabled weekday falls in that range. Pure + side-effect-free
     /// so it can be unit-tested against a fixed clock.
     nonisolated static func nextSmartAlarmDate(minutes: Int,
                                                weekdays: Set<Int>,
+                                               overrides: [Int: Int] = [:],
                                                from now: Date = Date(),
                                                calendar cal: Calendar = .current) -> Date? {
         let valid = weekdays.filter { (1...7).contains($0) }
         // An empty input means "every day" (backward compatible). A non-empty selection that filters to
         // nothing (only out-of-range numbers) has no valid day to fire on, so it's nil, not a daily alarm.
         if !weekdays.isEmpty && valid.isEmpty { return nil }
-        let hour = minutes / 60
-        let minute = minutes % 60
+        // #1864: only valid override entries (day 1…7, minute in [0, 1440)) count; a day without an
+        // override uses the default `minutes`. When the map is empty this is byte-for-byte the old path.
+        let cleanOverrides = overrides.filter { (1...7).contains($0.key) && (0..<24 * 60).contains($0.value) }
         // Scan today (offset 0) through +7 days so a once-a-week alarm picked for "today, already
         // passed" still resolves to the same weekday next week.
         for offset in 0...7 {
-            guard let day = cal.date(byAdding: .day, value: offset, to: now),
-                  let fire = cal.date(bySettingHour: hour, minute: minute, second: 0, of: day)
-            else { continue }
+            guard let day = cal.date(byAdding: .day, value: offset, to: now) else { continue }
+            // Resolve this calendar day's weekday FIRST, so the per-day override time is applied BEFORE
+            // the strictly-future check — a later override time on today can make today's occurrence
+            // still pending (mirrors Android's `nextSmartAlarmEpochSec`).
+            let dow = cal.component(.weekday, from: day)
+            if !weekdays.isEmpty && !valid.contains(dow) { continue }
+            let wakeMin = cleanOverrides[dow] ?? minutes
+            let hour = wakeMin / 60
+            let minute = wakeMin % 60
+            guard let fire = cal.date(bySettingHour: hour, minute: minute, second: 0, of: day) else { continue }
             if fire <= now { continue }
-            if weekdays.isEmpty { return fire }
-            if valid.contains(cal.component(.weekday, from: fire)) { return fire }
+            return fire
         }
         return nil
     }
diff --git a/Strand/Screens/SmartAlarmView.swift b/Strand/Screens/SmartAlarmView.swift
index 0f6112abc9..86ab5ab6c4 100644
--- a/Strand/Screens/SmartAlarmView.swift
+++ b/Strand/Screens/SmartAlarmView.swift
@@ -366,6 +366,9 @@ struct SmartAlarmView: View {
                     if !on {
                         for weekday in 1...7 { WindDownNudge.setWakeOverride(weekday: weekday, minutes: nil) }
                         overrides = [:]
+                        // #1864: re-arm the strap alarm + backup notification so they drop the per-day
+                        // times and revert to the single default, matching the wind-down nudge's revert.
+                        model.applySmartAlarm()
                     }
                 }
         }
@@ -396,6 +399,9 @@ struct SmartAlarmView: View {
                 Button {
                     WindDownNudge.setWakeOverride(weekday: weekday, minutes: nil)
                     overrides[weekday] = nil
+                    // #1864: re-arm so clearing an override reverts that day's wake to the default time
+                    // on the strap alarm + backup notification too, not just the wind-down nudge.
+                    model.applySmartAlarm()
                 } label: {
                     Image(systemName: "arrow.uturn.backward")
                         .font(.system(size: 12, weight: .semibold))
@@ -428,6 +434,10 @@ struct SmartAlarmView: View {
                 let m = (c.hour ?? 7) * 60 + (c.minute ?? 0)
                 WindDownNudge.setWakeOverride(weekday: weekday, minutes: m)
                 overrides[weekday] = m
+                // #1864: re-arm the strap alarm + backup notification so the new per-day time takes
+                // effect immediately, not just the wind-down reminder. Without this the override moved
+                // only the evening nudge and left the wake on the default time.
+                model.applySmartAlarm()
             }
         )
     }
diff --git a/StrandTests/SmartAlarmWeekdayTests.swift b/StrandTests/SmartAlarmWeekdayTests.swift
index 815aae65b3..a77c489eb3 100644
--- a/StrandTests/SmartAlarmWeekdayTests.swift
+++ b/StrandTests/SmartAlarmWeekdayTests.swift
@@ -86,6 +86,70 @@ final class SmartAlarmWeekdayTests: XCTestCase {
         XCTAssertGreaterThan(next!, wed(7, 0))
     }
 
+    // MARK: nextSmartAlarmDate — per-weekday overrides (#1864)
+
+    /// An override on the scanned day moves the fire time to THAT day's override, not the default.
+    /// now = Wed 06:00, default 07:00, only Wednesdays selected (4), Wednesday override 03:30 →
+    /// today 03:30 has passed, so the next Wednesday (7 days later) at 03:30. Without the override
+    /// this would be today 07:00 (still ahead).
+    func testOverrideOnToday_afterTime_rollsToNextWeek() {
+        let next = AppModel.nextSmartAlarmDate(minutes: 7 * 60, weekdays: [4], overrides: [4: 3 * 60 + 30],
+                                               from: wed(6, 0), calendar: cal)
+        XCTAssertEqual(weekday(of: next!), 4, "Wednesday")
+        XCTAssertEqual(next, cal.date(byAdding: .day, value: 7, to: wed(3, 30)))
+    }
+
+    /// An override on the scanned day that is LATER than the default can make today's occurrence still
+    /// pending. now = Wed 06:00, default 07:00, Wednesday override 09:00 → today 09:00 (still ahead).
+    func testOverrideOnToday_beforeOverrideTime_firesTodayAtOverrideTime() {
+        let next = AppModel.nextSmartAlarmDate(minutes: 7 * 60, weekdays: [], overrides: [4: 9 * 60],
+                                               from: wed(6, 0), calendar: cal)
+        XCTAssertEqual(next, wed(9, 0))
+        XCTAssertEqual(weekday(of: next!), 4)
+    }
+
+    /// A day WITHOUT an override falls back to the default time. now = Wed 06:00, default 07:00,
+    /// Tuesday override 03:30 → Wednesday has no override, fires today at 07:00.
+    func testDayWithoutOverrideUsesDefaultTime() {
+        let next = AppModel.nextSmartAlarmDate(minutes: 7 * 60, weekdays: [], overrides: [3: 3 * 60 + 30],
+                                               from: wed(6, 0), calendar: cal)
+        XCTAssertEqual(next, wed(7, 0))
+    }
+
+    /// An override on a weekday the alarm doesn't fire on is ignored. now = Wed 06:00, default 07:00,
+    /// only Wednesdays selected (4), Saturday override 03:30 → today 07:00 (Saturday is skipped).
+    func testOverrideOnDisabledWeekdayIsIgnored() {
+        let next = AppModel.nextSmartAlarmDate(minutes: 7 * 60, weekdays: [4], overrides: [7: 3 * 60 + 30],
+                                               from: wed(6, 0), calendar: cal)
+        XCTAssertEqual(next, wed(7, 0))
+    }
+
+    /// An empty overrides map is byte-for-byte the old path — the default time on every enabled day.
+    func testEmptyOverridesIsByteForByteOldPath() {
+        let without = AppModel.nextSmartAlarmDate(minutes: 7 * 60, weekdays: [4], from: wed(6, 0), calendar: cal)
+        let withEmpty = AppModel.nextSmartAlarmDate(minutes: 7 * 60, weekdays: [4], overrides: [:],
+                                                    from: wed(6, 0), calendar: cal)
+        XCTAssertEqual(without, withEmpty)
+    }
+
+    /// Invalid override entries (day outside 1…7, minute outside [0, 1440)) are dropped, not applied.
+    func testInvalidOverrideEntriesAreDropped() {
+        let next = AppModel.nextSmartAlarmDate(minutes: 7 * 60, weekdays: [], overrides: [0: 3 * 60, 4: -1, 99: 9 * 60],
+                                               from: wed(6, 0), calendar: cal)
+        XCTAssertEqual(next, wed(7, 0), "invalid entries dropped, default 07:00 fires today")
+    }
+
+    /// The reported install: 04:45 on three days and 03:30 on two. The next fire after the default time
+    /// on a non-override day picks the override time on the next override day that is still ahead.
+    func testRealWorldMixedOverrides() {
+        // now = Wed 06:00, default 07:00, Tue=03:30 (3), Fri=04:45 (6)
+        // Wed has no override → default 07:00 today (still ahead).
+        let next = AppModel.nextSmartAlarmDate(minutes: 7 * 60, weekdays: [],
+                                               overrides: [3: 3 * 60 + 30, 6: 4 * 60 + 45],
+                                               from: wed(6, 0), calendar: cal)
+        XCTAssertEqual(next, wed(7, 0))
+    }
+
     // MARK: Picker selection rules
 
     func testWeekdayIsSelected_emptyMeansEveryDay() {

From 785a33459b6b1ce8ed13ac72f78a8eefaf9d0305 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 19:05:11 +1200
Subject: [PATCH 279/333] storage: estimate bytes per table on both platforms,
 and stop saying v18Aux is unpruned

Follow-ups for #1911 that the row counts did not cover.

BYTES. I said in that thread a Test Centre export would now name the table
holding a 6.5 GB store. That overstated it: rows are not bytes, and
ppgWaveformSample - the table singled out as the likely culprit - is exactly
where a row model misleads, being the only one whose row size varies. The
estimate now measures the blob: typeof() at runtime rather than the declared
type, byte length via CAST(... AS BLOB) rather than length() (which counts
CHARACTERS while the store spends bytes), sampled over 500 rows and multiplied by
the count. Payload only, no index or page overhead - read it against db_bytes,
not as a second file size. meta.json carries row_bytes on BOTH platforms.

A STALE CLAIM. LocalAccessCore said ppgWaveformSample and v18AuxSample are
"neither pruned". v18Aux has had rolling retention since Room migration v31 -
about 604,800 rows, roughly seven days, which is what #1911 says and what the
comment contradicted. "Which tables are already bounded" is the first thing a
retention design reads off, so that one would have had it solving a solved
problem or trusting a bound that was never there.

The fourth copy of the table list in that file STAYS: NoopLocalAccess depends on
GRDB alone and is independent of WhoopStore on purpose, so unlike the three
collapsed in #1918 the duplication is deliberate, and now says so.

Also from re-reading: the probe was counting the same thirteen tables three times
(39 full scans on the store this diagnostic is pulled from), a negative sampleRows
would have become SQLite's unlimited LIMIT and full-scanned everything, and the
Android estimate ran synchronous SQLite on the UI scope - Room's suspend DAOs hop
to a background executor for free, a raw-query helper does not.

No retention behaviour changes. #1911's growth is still unaddressed; this is the
measurement its design should rest on.
---
 .../NoopLocalAccessCore/LocalAccessCore.swift | 23 +++--
 .../WhoopStore/Sources/WhoopStore/Reads.swift | 81 ++++++++++++++++-
 .../Tests/WhoopStoreTests/ReadTests.swift     | 73 +++++++++++++++
 Strand/System/TestBundleAssembler.swift       |  2 +-
 Strand/System/TestBundleMeta.swift            |  7 +-
 Strand/System/TestCentreReport.swift          | 14 ++-
 StrandTests/TestBundleMetaTests.swift         |  3 +-
 .../java/com/noop/data/StorageFootprint.kt    | 91 +++++++++++++++++++
 .../com/noop/testcentre/TestBundleMeta.kt     | 13 ++-
 .../main/java/com/noop/ui/TestCentreScreen.kt |  5 +
 .../com/noop/data/StorageFootprintTermTest.kt | 44 +++++++++
 11 files changed, 339 insertions(+), 17 deletions(-)
 create mode 100644 android/app/src/main/java/com/noop/data/StorageFootprint.kt
 create mode 100644 android/app/src/test/java/com/noop/data/StorageFootprintTermTest.kt

diff --git a/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/LocalAccessCore.swift b/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/LocalAccessCore.swift
index 2e08b9543f..50458dc9d0 100644
--- a/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/LocalAccessCore.swift
+++ b/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/LocalAccessCore.swift
@@ -323,12 +323,23 @@ public final class ReadonlyNoopStore {
         try dbQueue.read { db in
             // Every durable decoded per-second table. The four below the first line were landed as
             // instrumentation and then left OUT of this count, which is how an unbounded, unpruned table
-            // became invisible: `ppgWaveformSample` banks a ~48-byte BLOB per v26 strap-second and
-            // `v18AuxSample` ~30 bytes per v18 strap-second, neither is pruned (deliberately — this is
-            // decoded biometric history, not the transient raw outbox), and until now neither showed up in
-            // the only readout a user has for "what is the store spending space on". Growth that nothing
-            // reads still has to be growth somebody can SEE. Guarded by `tableNames.contains` so a store
-            // predating any of these migrations still reports.
+            // became invisible: `ppgWaveformSample` banks a ~48-byte BLOB per v26 strap-second and is NOT
+            // pruned (deliberately — this is decoded biometric history, not the transient raw outbox), and
+            // until it was counted it did not show up in the only readout a user has for "what is the
+            // store spending space on". Growth that nothing reads still has to be growth somebody can SEE.
+            //
+            // `v18AuxSample` used to be named here as unpruned too. It is not, and has not been since the
+            // rolling retention landed (`WhoopStore.v18AuxRetentionRows` / `v18AuxPruneEveryRows`, Room
+            // migration v31, covered by `DeepCaptureChannelsTests`): ~604 800 rows, about seven days. The
+            // correction matters because #1911 is designing retention, and "which tables are already
+            // bounded" is the first thing such a design reads off — getting it wrong here would have it
+            // solving a problem twice, or trusting a bound that was never there.
+            //
+            // This list is a DELIBERATE fourth copy, not drift. The other three (`WhoopStore.rawTableKeys`,
+            // the footprint total and the timestamp heal) now share one list; this module cannot, because
+            // NoopLocalAccess depends on GRDB alone and stays independent of WhoopStore on purpose — it is
+            // the read-only access tool, and a dependency on the app's store package would defeat that.
+            // Guarded by `tableNames.contains` so a store predating any of these migrations still reports.
             let decodedTables = [
                 "hrSample", "rrInterval", "event", "battery", "spo2Sample",
                 "skinTempSample", "respSample", "gravitySample", "ppgHrSample", "stepSample",
diff --git a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
index f8e7be047c..143e6e5ec6 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/Reads.swift
@@ -628,6 +628,62 @@ extension WhoopStore {
         }
     }
 
+    /// Estimated payload bytes per decoded stream table, keyed as `storageRowCounts()` keys.
+    ///
+    /// #1911 asks which table holds a multi-gigabyte database, and row counts alone cannot answer it: the
+    /// twelve fixed-width tables are comparable by rows, but `ppgWaveformSample` stores a BLOB whose size
+    /// varies, and it is the table most likely to hold bytes a per-second row model does not predict. So
+    /// this measures the blob rather than assuming it.
+    ///
+    /// Sampled, not scanned: the mean payload of up to `sampleRows` rows, multiplied by the count. A full
+    /// `SUM(LENGTH(...))` over a 6.5 GB store is exactly the kind of read this diagnostic exists to let
+    /// someone avoid, and an estimate answers "which table dominates" just as well.
+    ///
+    /// What it measures: BLOB and TEXT columns by their real byte/character length, numeric columns at a
+    /// nominal 8. It EXCLUDES index pages, page slack and the WAL, so it is a payload lower bound, not the
+    /// file size — compare it against `db_bytes` in the same probe rather than expecting the two to meet.
+    /// An unreadable table is omitted, on the same reasoning as the row counts: absent is not zero.
+    /// `rowCounts` lets a caller that already has them - the Test Centre probe does - avoid a second
+    /// `COUNT(*)` pass over every table. That matters here more than it usually would: this diagnostic is
+    /// read on the multi-gigabyte stores it exists to explain, where each count is a full scan, so a tool
+    /// that counts the same thirteen tables three times is slowest exactly where it is needed.
+    public func storageByteEstimates(sampleRows: Int = 500,
+                                     rowCounts: [String: Int]? = nil) async throws -> [String: Int] {
+        try syncRead { db in
+            var out: [String: Int] = [:]
+            for (key, table) in Self.rawTableKeys {
+                let known = rowCounts?[key]
+                guard let rows = known ?? (try? Int.fetchOne(db, sql: "SELECT COUNT(*) FROM \(table)")),
+                      rows > 0
+                else { continue }
+                let cols = try? Row.fetchAll(db, sql: "PRAGMA table_info(\(table))")
+                guard let cols, !cols.isEmpty else { continue }
+                // Table and column names come from the schema, never from user input, so interpolating
+                // them is safe here in the same way the COUNT above is.
+                // `typeof()` at runtime, not the DECLARED type, and byte length via CAST rather than
+                // LENGTH: SQLite is dynamically typed, so a column declared INTEGER can hold text, and
+                // LENGTH on text counts CHARACTERS while the store spends bytes. Mirrors the expression
+                // Kotlin already uses in `PushSnapshotPreflight.rowEstimateExpression`.
+                let terms = cols.compactMap { c -> String? in
+                    guard let name = c["name"] as String? else { return nil }
+                    let q = "\"\(name)\""
+                    return "(CASE WHEN \(q) IS NULL THEN 0 "
+                        + "WHEN typeof(\(q)) IN ('text','blob') THEN length(CAST(\(q) AS BLOB)) "
+                        + "ELSE 8 END)"
+                }
+                guard !terms.isEmpty else { continue }
+                let sql = "SELECT AVG(n) FROM (SELECT (\(terms.joined(separator: " + "))) AS n "
+                    // Clamped: SQLite reads a NEGATIVE limit as no limit at all, so an unchecked value
+                    // here would full-scan the very tables the sampling exists to avoid scanning.
+                    + "FROM \(table) LIMIT \(max(1, sampleRows)))"
+                if let mean = try? Double.fetchOne(db, sql: sql), mean.isFinite, mean >= 0 {
+                    out[key] = Int((mean * Double(rows)).rounded())
+                }
+            }
+            return out
+        }
+    }
+
     /// The decoded stream tables and the key each reports under. The keys are Android's, verbatim.
     static let rawTableKeys: [(String, String)] = [
         ("hr", "hrSample"), ("rr", "rrInterval"), ("events", "event"), ("battery", "battery"),
@@ -637,6 +693,25 @@ extension WhoopStore {
         ("v18Aux", "v18AuxSample"),
     ]
 
+    /// The raw outbox alone: batch count and total byteSize, with NO decoded-table counting.
+    ///
+    /// `storageStats()` returns these beside a 13-table `COUNT(*)` sweep, and the Test Centre probe was
+    /// calling it purely for `rawBytes` and discarding the rest - thirteen full scans, on the large stores
+    /// where a scan is least free, for two numbers that touch a different table entirely.
+    public func rawOutboxStats() async throws -> (batches: Int, bytes: Int) {
+        try syncRead { try Self.rawOutbox($0) }
+    }
+
+    /// The outbox pair against an OPEN database, so `storageStats()` and `rawOutboxStats()` share one
+    /// implementation. It has to take `db` rather than call the other: `syncRead` is `dbWriter.read`, and
+    /// a read nested inside a read deadlocks - so a plain helper is the only way these two stop being a
+    /// copy of each other, and a test pinning that a copy agrees is a weaker thing than not having one.
+    private static func rawOutbox(_ db: Database) throws -> (batches: Int, bytes: Int) {
+        let batches = try Int.fetchOne(db, sql: "SELECT COUNT(*) FROM rawBatch") ?? 0
+        let bytes = try Int.fetchOne(db, sql: "SELECT COALESCE(SUM(byteSize), 0) FROM rawBatch") ?? 0
+        return (batches, bytes)
+    }
+
     /// Aggregate storage footprint: total decoded rows, raw batch count, total raw byteSize.
     public func storageStats() async throws -> (decodedRows: Int, rawBatches: Int, rawBytes: Int) {
         try syncRead { db in
@@ -654,10 +729,8 @@ extension WhoopStore {
             for (_, t) in Self.rawTableKeys {
                 decoded += try Int.fetchOne(db, sql: "SELECT COUNT(*) FROM \(t)") ?? 0
             }
-            let batches = try Int.fetchOne(db, sql: "SELECT COUNT(*) FROM rawBatch") ?? 0
-            let bytes   = try Int.fetchOne(db,
-                sql: "SELECT COALESCE(SUM(byteSize), 0) FROM rawBatch") ?? 0
-            return (decoded, batches, bytes)
+            let outbox = try Self.rawOutbox(db)
+            return (decoded, outbox.batches, outbox.bytes)
         }
     }
 }
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
index eb19a525e9..a1c0ab2dc0 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/ReadTests.swift
@@ -395,4 +395,77 @@ final class ReadTests: XCTestCase {
                        "the summed total must equal the per-table breakdown")
     }
 
+
+    /// #1911: the byte estimate must MEASURE the blob rather than assume a fixed row width.
+    /// `ppgWaveformSample` is the only table here whose row size varies, and the one a per-second row
+    /// model misprices worst — a footprint that treats every row as fixed-width answers the wrong question
+    /// about exactly the table the question is usually about.
+    ///
+    /// Pinned by GROWING the blob rather than by comparing tables. My first attempt asserted that a blob
+    /// row estimates larger than an all-numeric row, which is false on a fixture: with a three-sample
+    /// blob `ppgWaveformSample` is three columns to `hrSample`'s four, so it estimates SMALLER. The blob
+    /// dominates in production (~48 bytes per v26 strap-second), not in a seed — so the invariant worth
+    /// pinning is that the blob's length reaches the estimate at all, which comparing two blob sizes
+    /// establishes and comparing two tables does not.
+    func testStorageByteEstimatesGrowWithBlobLength() async throws {
+        func estimate(sampleCount: Int) async throws -> Int {
+            let store = try await WhoopStore.inMemory()
+            let samples = [Int](repeating: 7, count: sampleCount)
+            _ = try await store.insert(Streams(ppgWaveform: [PpgWaveformSample(ts: 400, samples: samples)]),
+                                       deviceId: "dev1")
+            return try await store.storageByteEstimates()["ppgWaveform"] ?? 0
+        }
+        let small = try await estimate(sampleCount: 4)      // ~8 bytes packed i16
+        let large = try await estimate(sampleCount: 200)    // ~400 bytes packed i16
+        XCTAssertGreaterThan(small, 0, "the blob table must be estimated, not skipped")
+        XCTAssertGreaterThan(large, small + 300,
+                             "a 400-byte blob must estimate far above an 8-byte one, or the blob is not measured")
+    }
+
+    /// An empty table is omitted rather than reported as zero bytes, matching the row counts: absent means
+    /// "nothing to attribute here", which is a different claim from a measured zero.
+    func testStorageByteEstimatesOmitEmptyTables() async throws {
+        let store = try await WhoopStore.inMemory()
+        let bytes = try await store.storageByteEstimates()
+        XCTAssertTrue(bytes.isEmpty, "a fresh store has no rows, so nothing to estimate")
+    }
+
+
+    /// Passing known counts must not change the answer — it only skips a second `COUNT(*)` pass. Pinned
+    /// because the whole point of the parameter is that it is an optimisation, and an optimisation that
+    /// quietly changes the number it optimises is worse than the scan it saves.
+    func testStorageByteEstimatesAreUnchangedByPassingKnownCounts() async throws {
+        let store = try await seeded()
+        let counts = try await store.storageRowCounts()
+        let computed = try await store.storageByteEstimates()
+        let reused = try await store.storageByteEstimates(rowCounts: counts)
+        XCTAssertEqual(computed, reused)
+    }
+
+    /// The raw-outbox read must agree with the aggregate it was split out of, or the probe's rawBytes
+    /// silently changed meaning when it stopped counting thirteen decoded tables to get one number.
+    ///
+    /// They share one implementation now rather than being two copies this test compares — `syncRead` is
+    /// `dbWriter.read` and nesting one inside another deadlocks, so a plain `db`-taking helper is the only
+    /// way to share it. The assertion stays as the guard on that wiring.
+    func testRawOutboxStatsMatchTheAggregate() async throws {
+        let store = try await seeded()
+        let stats = try await store.storageStats()
+        let outbox = try await store.rawOutboxStats()
+        XCTAssertEqual(outbox.batches, stats.rawBatches)
+        XCTAssertEqual(outbox.bytes, stats.rawBytes)
+    }
+
+
+    /// A negative sample limit must not become an unbounded scan. SQLite reads `LIMIT -1` as "no limit",
+    /// so an unchecked value would full-scan every table — the exact cost the sampling exists to avoid,
+    /// reached by passing a number that looks like it would sample less rather than more.
+    func testStorageByteEstimatesClampANegativeSampleLimit() async throws {
+        let store = try await seeded()
+        let normal = try await store.storageByteEstimates()
+        let negative = try await store.storageByteEstimates(sampleRows: -1)
+        XCTAssertEqual(negative.keys.sorted(), normal.keys.sorted())
+        for (k, v) in negative { XCTAssertGreaterThan(v, 0, "\(k) must still estimate") }
+    }
+
 }
diff --git a/Strand/System/TestBundleAssembler.swift b/Strand/System/TestBundleAssembler.swift
index 14fb2c8beb..e6b80f5dee 100644
--- a/Strand/System/TestBundleAssembler.swift
+++ b/Strand/System/TestBundleAssembler.swift
@@ -228,7 +228,7 @@ enum TestBundleAssembler {
             profileStartedAt: started,
             questionnaire: TestCentre.answers(profile),
             build: buildProvenance(),
-            storage: storage ?? TestBundleMeta.Storage(dbBytes: 0, rows: [:], rawCaptureBytes: 0),
+            storage: storage ?? TestBundleMeta.Storage(dbBytes: 0, rows: [:], rawCaptureBytes: 0, rowBytes: [:]),
             redaction: redactionVersion,
             truncated: truncated,
             captureCheck: checks)
diff --git a/Strand/System/TestBundleMeta.swift b/Strand/System/TestBundleMeta.swift
index fa9f792083..cb4884a7cc 100644
--- a/Strand/System/TestBundleMeta.swift
+++ b/Strand/System/TestBundleMeta.swift
@@ -32,9 +32,14 @@ struct TestBundleMeta: Codable {
     /// db_bytes plus per-table row counts plus the raw-capture footprint (#590 asked us to surface this).
     struct Storage: Codable {
         let dbBytes: Int; let rows: [String: Int]; let rawCaptureBytes: Int
+        /// #1911: estimated payload bytes per table, keyed as `rows` is. Rows alone cannot say which table
+        /// holds a large store — `ppgWaveformSample`'s rows carry a BLOB, so it is exactly where a row
+        /// model misleads. A sampled payload estimate with no index or page overhead, so read it as a
+        /// lower bound to compare against `db_bytes`, never as a second file size.
+        let rowBytes: [String: Int]
         enum CodingKeys: String, CodingKey {
             case rows
-            case dbBytes = "db_bytes", rawCaptureBytes = "raw_capture_bytes"
+            case dbBytes = "db_bytes", rawCaptureBytes = "raw_capture_bytes", rowBytes = "row_bytes"
         }
     }
 
diff --git a/Strand/System/TestCentreReport.swift b/Strand/System/TestCentreReport.swift
index 5b82b36f63..97493255ee 100644
--- a/Strand/System/TestCentreReport.swift
+++ b/Strand/System/TestCentreReport.swift
@@ -78,6 +78,7 @@ final class TestCentreReport: ObservableObject {
             }
         }
         var rows: [String: Int] = [:]
+        var rowBytes: [String: Int] = [:]
         var rawBytes = 0
         if let store = await repo?.storeHandle() {
             // #1911: every accumulating table, not the nine this used to name. The old shape read eight
@@ -86,13 +87,22 @@ final class TestCentreReport: ObservableObject {
             // "can each be large". A footprint that leaves out the only blob table cannot attribute the
             // bytes it exists to explain, which is exactly what #1911 needs answered.
             if let counts = try? await store.storageRowCounts() { rows = counts }
-            rawBytes = (try? await store.storageStats().rawBytes) ?? 0
+            // #1911: bytes beside the counts. Rows alone cannot say which table holds a large store -
+            // ppgWaveformSample's rows carry a BLOB, so it is precisely where a row model misleads, and
+            // precisely the table this question is usually about. Estimated (sampled payload, no index or
+            // page overhead), so it is a lower bound to compare against db_bytes, not a second file size.
+            if let bytes = try? await store.storageByteEstimates(rowCounts: rows) { rowBytes = bytes }
+            // `rawOutboxStats`, not `storageStats`: the latter counts all thirteen decoded tables to
+            // return a total this probe does not use, and those are full scans on exactly the stores
+            // this report is pulled from.
+            rawBytes = (try? await store.rawOutboxStats().bytes) ?? 0
         }
         if let url = live.puffinCaptureURL {
             rawBytes += (try? fm.attributesOfItem(atPath: url.path))?[.size] as? Int ?? 0
         }
         guard dbBytes > 0 || !rows.isEmpty || rawBytes > 0 else { return nil }
-        return TestBundleMeta.Storage(dbBytes: dbBytes, rows: rows, rawCaptureBytes: rawBytes)
+        return TestBundleMeta.Storage(dbBytes: dbBytes, rows: rows, rawCaptureBytes: rawBytes,
+                                      rowBytes: rowBytes)
     }
 
     /// The user read the report and confirmed: clear the gate and run the shipped share + deep-link flow.
diff --git a/StrandTests/TestBundleMetaTests.swift b/StrandTests/TestBundleMetaTests.swift
index 6521beb758..8dffc8abec 100644
--- a/StrandTests/TestBundleMetaTests.swift
+++ b/StrandTests/TestBundleMetaTests.swift
@@ -15,7 +15,8 @@ final class TestBundleMetaTests: XCTestCase {
             profileStartedAt: "2026-06-26T07:12:00Z",
             questionnaire: ["naps": "no"],
             build: .init(channel: "AltStore", signed: false),
-            storage: .init(dbBytes: 1024, rows: ["sleep_sessions": 12], rawCaptureBytes: 2048),
+            storage: .init(dbBytes: 1024, rows: ["sleep_sessions": 12], rawCaptureBytes: 2048,
+                           rowBytes: ["sleep_sessions": 4096]),
             redaction: "v2",
             truncated: false)
     }
diff --git a/android/app/src/main/java/com/noop/data/StorageFootprint.kt b/android/app/src/main/java/com/noop/data/StorageFootprint.kt
new file mode 100644
index 0000000000..ebe90fc5f1
--- /dev/null
+++ b/android/app/src/main/java/com/noop/data/StorageFootprint.kt
@@ -0,0 +1,91 @@
+package com.noop.data
+
+import androidx.sqlite.db.SimpleSQLiteQuery
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+
+/**
+ * #1911: estimated payload bytes per decoded stream table. Swift twin: `WhoopStore.storageByteEstimates`,
+ * and meta.json's `row_bytes` block beside `rows`.
+ *
+ * Rows alone cannot say which table holds a large store. `ppgWaveformSample` stores a BLOB whose size
+ * varies, and it is both the table a per-second row model misprices worst and the one this question is
+ * usually about — so the estimate MEASURES the blob rather than assuming a fixed row width.
+ *
+ * A hand-written class over [WhoopDatabase] rather than a method on [WhoopRepository], following
+ * [com.noop.push.PushDao]: the repository takes a DAO and a transactor precisely so its writes stay
+ * testable without a Room runtime, and raw per-table SQL needs the open helper. Keeping it out preserves
+ * that boundary instead of quietly widening it for a diagnostic.
+ */
+internal class StorageFootprint(private val db: WhoopDatabase) {
+
+    /**
+     * Payload bytes per table, keyed exactly as `WhoopRepository.storageRowCounts` keys, so a maintainer
+     * comparing meta.json across platforms is comparing the same two maps.
+     *
+     * `typeof()` at runtime rather than the declared type, and byte length via `CAST(... AS BLOB)` rather
+     * than `length()`: SQLite is dynamically typed, so a column declared INTEGER can hold text, and
+     * `length()` on text counts CHARACTERS while the store spends bytes. The same shape
+     * `PushSnapshotPreflight.rowEstimateExpression` uses, without its JSON-expansion factors — this
+     * measures the database, not a snapshot of it.
+     *
+     * Sampled over [sampleRows] rows and multiplied by the count, never scanned: a full sum over a
+     * multi-gigabyte store is exactly the read this diagnostic exists to help someone avoid. The limit is
+     * clamped because SQLite reads a NEGATIVE limit as no limit at all, which would full-scan every table
+     * — the precise cost the sampling avoids, reached by a number that reads like it asks for less work.
+     *
+     * Payload only: no index pages, no page slack, no WAL. Read it against `db_bytes`, not as a second
+     * file size. An unreadable or empty table is omitted rather than reported as zero, matching the row
+     * counts — absent means "nothing to attribute here", which is not a measured zero.
+     *
+     * Suspending, and explicitly on IO. The callers launch the storage probe on the UI scope (the Test
+     * Centre screen says so in its own doc), and Room's suspend DAO methods hop to its query executor for
+     * free — a raw-query helper like this one does not, so without the switch these PRAGMA and AVG reads
+     * would run on the main thread, over the multi-gigabyte store this diagnostic exists for.
+     */
+    suspend fun byteEstimates(rowCounts: Map<String, Int>, sampleRows: Int = 500): Map<String, Int> =
+        withContext(Dispatchers.IO) { estimateBlocking(rowCounts, sampleRows) }
+
+    private fun estimateBlocking(rowCounts: Map<String, Int>, sampleRows: Int): Map<String, Int> = runCatching {
+        val raw = db.openHelper.readableDatabase
+        val limit = maxOf(1, sampleRows)
+        val out = mutableMapOf<String, Int>()
+        for ((key, table) in STORAGE_TABLES) {
+            val rows = rowCounts[key] ?: continue
+            if (rows <= 0) continue
+            val cols = mutableListOf<String>()
+            raw.query(SimpleSQLiteQuery("PRAGMA table_info(`$table`)")).use { c ->
+                val i = c.getColumnIndex("name")
+                if (i >= 0) while (c.moveToNext()) cols.add(c.getString(i))
+            }
+            if (cols.isEmpty()) continue
+            val terms = cols.joinToString(" + ") { col -> rowSizeTerm(col) }
+            val sql = "SELECT AVG(n) FROM (SELECT ($terms) AS n FROM `$table` LIMIT $limit)"
+            raw.query(SimpleSQLiteQuery(sql)).use { c ->
+                if (c.moveToFirst() && !c.isNull(0)) out[key] = Math.round(c.getDouble(0) * rows).toInt()
+            }
+        }
+        out.toMap()
+    }.getOrDefault(emptyMap())
+
+    internal companion object {
+        /** One column's contribution to a row's payload. Byte-true for text and blobs, nominal otherwise. */
+        internal fun rowSizeTerm(column: String): String =
+            "(CASE WHEN `$column` IS NULL THEN 0 " +
+                "WHEN typeof(`$column`) IN ('text','blob') THEN length(CAST(`$column` AS BLOB)) " +
+                "ELSE 8 END)"
+
+        /**
+         * The decoded stream tables and the key each reports under — Swift's `WhoopStore.rawTableKeys`,
+         * verbatim, and the same keys `WhoopRepository.storageRowCounts` uses. Adding a stream means
+         * adding it in all three, and the Apple side fails a test until it is.
+         */
+        internal val STORAGE_TABLES: List<Pair<String, String>> = listOf(
+            "hr" to "hrSample", "rr" to "rrInterval", "events" to "event", "battery" to "battery",
+            "spo2" to "spo2Sample", "skinTemp" to "skinTempSample", "resp" to "respSample",
+            "gravity" to "gravitySample", "steps" to "stepSample", "ppgHr" to "ppgHrSample",
+            "sleepState" to "sleepStateSample", "ppgWaveform" to "ppgWaveformSample",
+            "v18Aux" to "v18AuxSample",
+        )
+    }
+}
diff --git a/android/app/src/main/java/com/noop/testcentre/TestBundleMeta.kt b/android/app/src/main/java/com/noop/testcentre/TestBundleMeta.kt
index 4bf35d66e5..d8a0adf550 100644
--- a/android/app/src/main/java/com/noop/testcentre/TestBundleMeta.kt
+++ b/android/app/src/main/java/com/noop/testcentre/TestBundleMeta.kt
@@ -25,7 +25,13 @@ data class TestBundleMeta(
     val captureCheck: CaptureCheck,
 ) {
     data class Build(val channel: String, val signed: Boolean)
-    data class Storage(val dbBytes: Int, val rows: Map<String, Int>, val rawCaptureBytes: Int)
+    data class Storage(
+        val dbBytes: Int,
+        val rows: Map<String, Int>,
+        val rawCaptureBytes: Int,
+        /** #1911: estimated payload bytes per table, keyed as [rows] is. Swift twin: `Storage.rowBytes`. */
+        val rowBytes: Map<String, Int> = emptyMap(),
+    )
 
     /** The report-completeness tie (twin of the Swift CaptureCheck): per-domain killer-trace presence
      *  ({domainId -> "present"|"MISSING"}) plus the overall `complete` flag, so a maintainer can tell at
@@ -53,7 +59,10 @@ data class TestBundleMeta(
             "storage" to mapOf(
                 "db_bytes" to storage.dbBytes,
                 "raw_capture_bytes" to storage.rawCaptureBytes,
-                "rows" to storage.rows),
+                "rows" to storage.rows,
+                // #1911: bytes beside the counts, so this block matches the Apple bundle's. Rows alone
+                // cannot say which table holds a large store - ppgWaveformSample's rows carry a BLOB.
+                "row_bytes" to storage.rowBytes),
             "strap_model" to strapModel,
             "test_profile" to testProfile,
             "truncated" to truncated)
diff --git a/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt b/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
index 3b17c54cf8..f4175e96ba 100644
--- a/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TestCentreScreen.kt
@@ -493,6 +493,10 @@ private suspend fun buildPending(
         if (f.exists()) dbBytes += f.length()
     }
     val rows = vm.repo.storageRowCounts()
+    // #1911: bytes beside the counts, reusing the counts just read rather than a second COUNT(*) pass over
+    // thirteen tables - each is a full scan on the large stores this report is pulled from.
+    val rowBytes = com.noop.data.StorageFootprint(
+        com.noop.data.WhoopDatabase.get(context)).byteEstimates(rows)
     var rawBytes = 0L
     for (name in listOf(
         com.noop.ble.WhoopBleClient.WHOOP5_CAPTURE_FILE,
@@ -506,6 +510,7 @@ private suspend fun buildPending(
             dbBytes = dbBytes.coerceAtMost(Int.MAX_VALUE.toLong()).toInt(),
             rows = rows,
             rawCaptureBytes = rawBytes.coerceAtMost(Int.MAX_VALUE.toLong()).toInt(),
+            rowBytes = rowBytes,
         )
     } else {
         null
diff --git a/android/app/src/test/java/com/noop/data/StorageFootprintTermTest.kt b/android/app/src/test/java/com/noop/data/StorageFootprintTermTest.kt
new file mode 100644
index 0000000000..fa0026badc
--- /dev/null
+++ b/android/app/src/test/java/com/noop/data/StorageFootprintTermTest.kt
@@ -0,0 +1,44 @@
+package com.noop.data
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #1911: the per-column size expression and the table list, pinned without a Room runtime.
+ *
+ * The estimate itself needs an open database and the JVM unit tests have none, so what is reachable here
+ * is the part that actually drifts: the SQL shape, and the key set that has to match Apple's verbatim for
+ * the two meta.json blocks to be comparable at all.
+ */
+class StorageFootprintTermTest {
+
+    /**
+     * `typeof()` at runtime, not the declared type, and byte length via `CAST(... AS BLOB)`.
+     *
+     * Both matter and both are easy to "simplify" away. SQLite is dynamically typed, so a column declared
+     * INTEGER can hold text; and `length()` on text counts CHARACTERS while the store spends bytes, so a
+     * multi-byte value would be under-counted by exactly the amount that makes it worth counting.
+     */
+    @Test fun `the term measures bytes at runtime, not declared width`() {
+        val term = StorageFootprint.rowSizeTerm("samples")
+        assertTrue(term, term.contains("typeof(`samples`)"))
+        assertTrue(term, term.contains("length(CAST(`samples` AS BLOB))"))
+        assertTrue(term, term.contains("IS NULL THEN 0"))
+        assertTrue("a numeric column still costs something", term.contains("ELSE 8"))
+    }
+
+    /**
+     * The key set is a cross-platform contract: Apple pins it in `WhoopStoreTests.ReadTests`, and the two
+     * meta.json blocks are only comparable while both sides report the same thirteen keys.
+     */
+    @Test fun `the table list matches the Apple key set`() {
+        val expected = listOf(
+            "hr", "rr", "events", "battery", "spo2", "skinTemp", "resp", "gravity",
+            "steps", "ppgHr", "sleepState", "ppgWaveform", "v18Aux",
+        )
+        assertEquals(expected.sorted(), StorageFootprint.STORAGE_TABLES.map { it.first }.sorted())
+        assertTrue("the blob table must be in the list at all",
+                   StorageFootprint.STORAGE_TABLES.any { it.second == "ppgWaveformSample" })
+    }
+}

From b9a928042d9512d785022159c7a86662fe717112 Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Sun, 6 Sep 2026 13:37:38 +0530
Subject: [PATCH 280/333] =?UTF-8?q?import:=20convert=20Fahrenheit=20skin-t?=
 =?UTF-8?q?emp=20on=20the=20way=20in,=20not=20alias=20it=20to=20=C2=B0C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From @evoveotech. Addresses #1849.

Both WHOOP CSV importers treated `skin_temp_f` as a plain alias of
`skin_temp_celsius` and stored the value unconverted, so a Fahrenheit export
landed ~92.3 in a column the whole app reads as °C. That is stored corruption
rather than a display error: it reads as a lethal fever, poisons the skin-temp
baseline, and for a reader on Fahrenheit gets converted a second time to ~198 °F.

Each key is now read as its own column and the Fahrenheit value converted on the
way in, with `skin_temp_celsius` winning when both are present because a Celsius
export is the canonical form. Both platforms move together and the arithmetic is
identical, so a Fahrenheit import lands byte-identical to a Celsius one - the
new fixture is the Celsius fixture with only that column changed, which is what
makes that claim checkable rather than asserted.

Worth recording beyond the PR's own scope note: this closes the bug CLASS, not
just the instance. `skin_temp_f` is the only imperial-suffixed key either
importer references, and every other multi-key alias in both is a same-unit
spelling variant - distance_meters/distance_meter, average_hr_bpm/
average_heart_rate_bpm, heart_rate_variability_ms/...rmssd_ms and the rest. There
is nothing left to sweep, so that deferred question can be answered rather than
carried.

The other deferred item is genuinely open: rows already imported above the 42 °C
worn-gate ceiling are still stored wrong, and leaving them to a separate decision
rather than silently rewriting a user's history is the right call.
---
 .../StrandImport/WhoopExportImporter.swift    | 11 +++++-
 .../physiological_cycles_fahrenheit.csv       |  2 +
 .../WhoopExportImporterTests.swift            | 30 +++++++++++++++
 .../java/com/noop/ingest/WhoopCsvImporter.kt  |  8 +++-
 .../com/noop/ingest/WhoopCsvImporterTest.kt   | 37 +++++++++++++++++++
 5 files changed, 86 insertions(+), 2 deletions(-)
 create mode 100644 Packages/StrandImport/Tests/StrandImportTests/Resources/physiological_cycles_fahrenheit.csv

diff --git a/Packages/StrandImport/Sources/StrandImport/WhoopExportImporter.swift b/Packages/StrandImport/Sources/StrandImport/WhoopExportImporter.swift
index c59d2767e1..b147014014 100644
--- a/Packages/StrandImport/Sources/StrandImport/WhoopExportImporter.swift
+++ b/Packages/StrandImport/Sources/StrandImport/WhoopExportImporter.swift
@@ -268,7 +268,16 @@ public struct WhoopExportImporter {
             r.recoveryScore    = row.double("recovery_score_pct")
             r.restingHeartRate = row.double("resting_heart_rate_bpm", "resting_heart_rate")
             r.hrvMs            = row.double("heart_rate_variability_ms", "heart_rate_variability_rmssd_ms")
-            r.skinTempCelsius  = row.double("skin_temp_celsius", "skin_temp_f")
+            // #1849: a Fahrenheit WHOOP export ships `skin_temp_f`, NOT `skin_temp_celsius`. Treating
+            // the two as aliases stored the °F value unconverted (92.3 °F → 92.3 in a °C column),
+            // which read as a lethal fever and poisoned the baseline. Read each as its OWN key and
+            // convert the Fahrenheit value on the way in. `skin_temp_celsius` wins when both are
+            // present (a Celsius export is the canonical form).
+            if let c = row.double("skin_temp_celsius") {
+                r.skinTempCelsius = c
+            } else if let f = row.double("skin_temp_f") {
+                r.skinTempCelsius = (f - 32.0) * 5.0 / 9.0
+            }
             r.bloodOxygenPct   = row.double("blood_oxygen_pct", "blood_oxygen_pct_pct")
             r.dayStrain        = row.double("day_strain")
             r.energyKcal       = row.double("energy_burned_cal")  // CSV "(cal)" == kcal
diff --git a/Packages/StrandImport/Tests/StrandImportTests/Resources/physiological_cycles_fahrenheit.csv b/Packages/StrandImport/Tests/StrandImportTests/Resources/physiological_cycles_fahrenheit.csv
new file mode 100644
index 0000000000..f01e289ac8
--- /dev/null
+++ b/Packages/StrandImport/Tests/StrandImportTests/Resources/physiological_cycles_fahrenheit.csv
@@ -0,0 +1,2 @@
+Cycle start time,Cycle end time,Cycle timezone,Recovery score %,Resting heart rate (bpm),Heart rate variability (ms),Skin temp (f),Blood oxygen %,Day Strain,Energy burned (cal),Max HR (bpm),Average HR (bpm),Sleep onset,Wake onset,Sleep performance %,Respiratory rate (rpm),Asleep duration (min),In bed duration (min),Light sleep duration (min),Deep (SWS) duration (min),REM duration (min),Awake duration (min),Sleep efficiency %,Sleep consistency %,Sleep need (min),Sleep debt (min)
+2024-01-02 06:30:00,2024-01-03 06:29:00,UTC+01:00,72,52,68.4,91.58,96.0,12.5,2450,165,68,2024-01-01 23:15:00,2024-01-02 06:30:00,85,14.2,420,455,210,95,115,35,92.3,88.0,480,60
diff --git a/Packages/StrandImport/Tests/StrandImportTests/WhoopExportImporterTests.swift b/Packages/StrandImport/Tests/StrandImportTests/WhoopExportImporterTests.swift
index 7e6aa6d3cf..f1e86a9444 100644
--- a/Packages/StrandImport/Tests/StrandImportTests/WhoopExportImporterTests.swift
+++ b/Packages/StrandImport/Tests/StrandImportTests/WhoopExportImporterTests.swift
@@ -94,6 +94,36 @@ final class WhoopExportImporterTests: XCTestCase {
         XCTAssertEqual(r1.recoveryScore, 55)
     }
 
+    // MARK: - #1849: Fahrenheit skin-temp import
+
+    /// A Fahrenheit WHOOP export ships `skin_temp_f` instead of `skin_temp_celsius`. The
+    /// importer must convert the °F value to °C on the way in — NOT store it unconverted
+    /// (92.3 °F stored as 92.3 in a °C column reads as a lethal fever and poisons the
+    /// baseline). 91.58 °F = 33.1 °C, the same value the Celsius fixture carries.
+    func testFahrenheitSkinTempIsConvertedToCelsius() throws {
+        let table = CSVTable(data: Fixtures.data("physiological_cycles_fahrenheit.csv"))
+        let rows = WhoopExportImporter().parseCycles(table)
+
+        XCTAssertEqual(rows.count, 1)
+        let r0 = try XCTUnwrap(rows.first)
+        // 91.58 °F → (91.58 − 32) × 5/9 = 33.1 °C — the same stored value the Celsius
+        // fixture produces, so a Fahrenheit import lands byte-identical to a Celsius one.
+        XCTAssertEqual(r0.skinTempCelsius ?? -999, 33.1, accuracy: 0.001,
+                       "a Fahrenheit skin_temp_f must be converted to °C on import, not stored as-is")
+    }
+
+    /// A Celsius export (the canonical form) is unaffected — `skin_temp_celsius` is read
+    /// directly and no conversion is applied. This is the regression guard: the fix must
+    /// not change the Celsius path.
+    func testCelsiusSkinTempIsUnchanged() throws {
+        let table = CSVTable(data: Fixtures.data("physiological_cycles.csv"))
+        let rows = WhoopExportImporter().parseCycles(table)
+
+        let r0 = try XCTUnwrap(rows.first)
+        XCTAssertEqual(r0.skinTempCelsius ?? -999, 33.1, accuracy: 0.001,
+                       "a Celsius skin_temp_celsius must pass through unchanged")
+    }
+
     // MARK: - workouts.csv WITHOUT GPS columns
 
     func testWorkoutsWithoutGPSColumnsStillParse() throws {
diff --git a/android/app/src/main/java/com/noop/ingest/WhoopCsvImporter.kt b/android/app/src/main/java/com/noop/ingest/WhoopCsvImporter.kt
index 4204a6f73e..a1011a0d01 100644
--- a/android/app/src/main/java/com/noop/ingest/WhoopCsvImporter.kt
+++ b/android/app/src/main/java/com/noop/ingest/WhoopCsvImporter.kt
@@ -346,7 +346,13 @@ object WhoopCsvImporter {
             val recovery = row.double("recovery_score_pct")
             val restingHr = row.double("resting_heart_rate_bpm", "resting_heart_rate")
             val avgHrv = row.double("heart_rate_variability_ms", "heart_rate_variability_rmssd_ms")
-            val skinTemp = row.double("skin_temp_celsius", "skin_temp_f")
+            // #1849: a Fahrenheit WHOOP export ships `skin_temp_f`, NOT `skin_temp_celsius`. Treating
+            // the two as aliases stored the °F value unconverted (92.3 °F → 92.3 in a °C column),
+            // which read as a lethal fever and poisoned the baseline. Read each as its OWN key and
+            // convert the Fahrenheit value on the way in. `skin_temp_celsius` wins when both are
+            // present (a Celsius export is the canonical form). Byte-identical with the Swift twin.
+            val skinTemp = row.double("skin_temp_celsius")
+                ?: row.double("skin_temp_f")?.let { (it - 32.0) * 5.0 / 9.0 }
             val spo2 = row.double("blood_oxygen_pct", "blood_oxygen_pct_pct")
             val strain = row.double("day_strain")
             val resp = row.double("respiratory_rate_rpm", "respiratory_rate")
diff --git a/android/app/src/test/java/com/noop/ingest/WhoopCsvImporterTest.kt b/android/app/src/test/java/com/noop/ingest/WhoopCsvImporterTest.kt
index 5a60a13427..faf14529f5 100644
--- a/android/app/src/test/java/com/noop/ingest/WhoopCsvImporterTest.kt
+++ b/android/app/src/test/java/com/noop/ingest/WhoopCsvImporterTest.kt
@@ -118,6 +118,43 @@ class WhoopCsvImporterTest {
         assertEquals("2026-06-06", rows.single().day)
     }
 
+    // --- #1849: a Fahrenheit WHOOP export ships skin_temp_f, not skin_temp_celsius -------------
+
+    /**
+     * A Fahrenheit export ships `skin_temp_f` instead of `skin_temp_celsius`. The importer must
+     * convert the °F value to °C on the way in — NOT store it unconverted (92.3 °F stored as 92.3
+     * in a °C column reads as a lethal fever and poisons the baseline). 91.58 °F = 33.1 °C.
+     * Byte-identical with the Swift twin (WhoopExportImporterTests.testFahrenheitSkinTempIsConvertedToCelsius).
+     */
+    @Test
+    fun fahrenheitSkinTempIsConvertedToCelsius() {
+        val rows = cycles(
+            """
+            Cycle start time,Cycle end time,Cycle timezone,Recovery score %,Resting heart rate (bpm),Heart rate variability (ms),Skin temp (f),Blood oxygen %,Day Strain,Energy burned (cal),Max HR (bpm),Average HR (bpm),Sleep onset,Wake onset,Sleep performance %,Respiratory rate (rpm),Asleep duration (min),In bed duration (min),Light sleep duration (min),Deep (SWS) duration (min),REM duration (min),Awake duration (min),Sleep efficiency %,Sleep consistency %,Sleep need (min),Sleep debt (min)
+            2024-01-02 06:30:00,2024-01-03 06:29:00,UTC+01:00,72,52,68.4,91.58,96.0,12.5,2450,165,68,2024-01-01 23:15:00,2024-01-02 06:30:00,85,14.2,420,455,210,95,115,35,92.3,88.0,480,60
+            """
+        )
+        assertEquals(1, rows.size)
+        // 91.58 °F → (91.58 − 32) × 5/9 = 33.1 °C — the same stored value a Celsius import produces.
+        assertEquals(33.1, rows.single().skinTempDevC!!, 1e-3)
+    }
+
+    /**
+     * A Celsius export (the canonical form) is unaffected — `skin_temp_celsius` is read directly
+     * and no conversion is applied. Regression guard: the fix must not change the Celsius path.
+     */
+    @Test
+    fun celsiusSkinTempIsUnchanged() {
+        val rows = cycles(
+            """
+            Cycle start time,Cycle end time,Cycle timezone,Recovery score %,Resting heart rate (bpm),Heart rate variability (ms),Skin temp (celsius),Blood oxygen %,Day Strain,Energy burned (cal),Max HR (bpm),Average HR (bpm),Sleep onset,Wake onset,Sleep performance %,Respiratory rate (rpm),Asleep duration (min),In bed duration (min),Light sleep duration (min),Deep (SWS) duration (min),REM duration (min),Awake duration (min),Sleep efficiency %,Sleep consistency %,Sleep need (min),Sleep debt (min)
+            2024-01-02 06:30:00,2024-01-03 06:29:00,UTC+01:00,72,52,68.4,33.1,96.0,12.5,2450,165,68,2024-01-01 23:15:00,2024-01-02 06:30:00,85,14.2,420,455,210,95,115,35,92.3,88.0,480,60
+            """
+        )
+        assertEquals(1, rows.size)
+        assertEquals(33.1, rows.single().skinTempDevC!!, 1e-3)
+    }
+
     // --- #136: imported journal keys to the WAKE day, not the onset evening -------------------
 
     private fun journalWakeMap(csv: String): Map<Long, String> =

From 5d3fb38ebb0535906dbec2721fd41305084654ea Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Sun, 6 Sep 2026 13:46:15 +0530
Subject: [PATCH 281/333] steps: the Today tile names the right missing half
 when no motion is banked

From @evoveotech. Addresses #1816.

A step estimate is motion x coefficient. With the motion half missing, neither
the estimate nor the fit moves however many days the phone counts - so the
not-yet-calibrated caption, which counted down phone-step days without checking
whether the strap had banked any motion, named the wrong missing half. It sent a
field reporter to enter Apple Health steps by hand expecting calibration to
start, which it cannot.

The tile now says "No motion synced yet" when the motion half is the blocker, and
keeps the phone-days countdown when it is the phone half. The wording is the one
the calibration sheet's no-motion banner already uses, so the two surfaces agree
rather than inventing a second phrasing for the same state.

A persisted stepsHasBankedMotion flag carries the answer from each analytics
pass, set from whether the calibration scan window found gravity-derived motion.
Swift sets it directly; Android threads a callback through analyzeRecent the same
way persistStepsCalibration already does, wired from both the 15-minute loop and
the post-backfill pass.

Precedence matches on both platforms - calibrated first, then no-motion, then the
countdown - so a calibrated wearer never sees the no-motion line in place of
their caption. Eight locale files.

Swift extracts the decision as a pure helper and pins its four branches. The
Android twin is inline in the Today screen and has no equivalent test, so the two
can drift with only one side noticing; extracting it the same way would close
that, and the Swift helper is the template.
---
 Strand/Data/IntelligenceEngine.swift          |  7 ++++
 Strand/Data/Profile.swift                     | 12 ++++++
 Strand/Screens/TodayView.swift                | 32 ++++++++++++---
 StrandTests/TodayVitalCardTests.swift         | 39 +++++++++++++++++++
 .../com/noop/analytics/IntelligenceEngine.kt  | 17 ++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  |  7 ++++
 .../src/main/java/com/noop/ui/AppViewModel.kt | 15 ++++++-
 .../main/java/com/noop/ui/SettingsScreen.kt   | 14 +++++++
 .../src/main/java/com/noop/ui/TodayScreen.kt  |  9 +++++
 .../app/src/main/res/values-de/strings.xml    |  1 +
 .../app/src/main/res/values-es/strings.xml    |  1 +
 .../app/src/main/res/values-fr/strings.xml    |  1 +
 .../app/src/main/res/values-pl/strings.xml    |  1 +
 .../src/main/res/values-pt-rPT/strings.xml    |  1 +
 .../app/src/main/res/values-ru/strings.xml    |  1 +
 .../app/src/main/res/values-zh/strings.xml    |  1 +
 android/app/src/main/res/values/strings.xml   |  1 +
 17 files changed, 153 insertions(+), 7 deletions(-)

diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index a44fc10029..6f6eac9dcf 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -2361,6 +2361,13 @@ final class IntelligenceEngine: ObservableObject {
             }
             return (refSteps, motion)
         }.value
+        // #1816: persist whether the strap has banked ANY motion in the calibration scan window, so the
+        // Today tile can distinguish "Need N more phone-step days" (motion exists, phone half missing)
+        // from "No motion synced yet" (the motion half is the blocker, and no number of phone-step days
+        // will move the estimate or the fit). A step estimate is `motion * coefficient`, so with the
+        // motion half missing the caption that names only the phone half is a lie — it sent a field
+        // reporter to enter Apple Health steps by hand expecting calibration to start, which it cannot.
+        profile.stepsHasBankedMotion = !motionByDay.isEmpty
         // Build calibration points only for days with BOTH a motion volume and a real phone step count.
         let calPoints = motionByDay.compactMap { (day, motion) -> StepsEstimateEngine.CalibrationPoint? in
             guard let s = refStepsByDay[day] else { return nil }
diff --git a/Strand/Data/Profile.swift b/Strand/Data/Profile.swift
index 46ac4316dc..7e95727ccc 100644
--- a/Strand/Data/Profile.swift
+++ b/Strand/Data/Profile.swift
@@ -56,6 +56,16 @@ final class ProfileStore: ObservableObject {
     @Published var stepsCalibrationManual: Bool { didSet { d.set(stepsCalibrationManual, forKey: K.stepsManualFlag) } }
     /// User-set manual coefficient. 0 = auto-fit (nil to the engine); > 0 = manual override.
     @Published var stepsManualCoefficient: Double { didSet { d.set(max(0, stepsManualCoefficient), forKey: K.stepsManualCoeff) } }
+    /// #1816: true when the strap has banked ANY motion (gravity samples → `dayMotionIntensity > 0`)
+    /// in the calibration scan window. Written by `IntelligenceEngine` on every analytics pass so it
+    /// tracks a fresh strap's first sync without a separate query. The Today tile reads this to decide
+    /// whether "Need N more days where your phone also counted steps" is the honest caption or a lie:
+    /// a step estimate is `motion * coefficient`, so with the motion half missing neither the estimate
+    /// nor the fit moves however many phone-counted days the user collects. The caption that names only
+    /// the phone half is actively misleading — it sent a field reporter to enter Apple Health steps by
+    /// hand expecting calibration to start, which it cannot without strap motion. Twin of Android's
+    /// `ProfileStore.stepsHasBankedMotion`.
+    @Published var stepsHasBankedMotion: Bool { didSet { d.set(stepsHasBankedMotion, forKey: K.stepsHasMotion) } }
 
     // ── Profile picture (optional, on-device only) ──────────────────────────────────────────────
     /// The user's chosen profile photo as JPEG bytes, or nil for the default SF-Symbol fallback.
@@ -85,6 +95,7 @@ final class ProfileStore: ObservableObject {
         static let stepsConfidence = "profile.stepsCalibrationConfidence"
         static let stepsManualFlag = "profile.stepsCalibrationManual"
         static let stepsManualCoeff = "profile.stepsManualCoefficient"
+        static let stepsHasMotion = "profile.stepsHasBankedMotion"
         static let avatar = "profile.avatarImageData"
     }
 
@@ -124,6 +135,7 @@ final class ProfileStore: ObservableObject {
         stepsCalibrationConfidence = d.object(forKey: K.stepsConfidence) as? Double ?? 0
         stepsCalibrationManual = d.object(forKey: K.stepsManualFlag) as? Bool ?? false
         stepsManualCoefficient = max(0, d.object(forKey: K.stepsManualCoeff) as? Double ?? 0)
+        stepsHasBankedMotion = d.object(forKey: K.stepsHasMotion) as? Bool ?? false
         avatarImageData = d.data(forKey: K.avatar)
     }
 
diff --git a/Strand/Screens/TodayView.swift b/Strand/Screens/TodayView.swift
index 072348c289..05c9255e40 100644
--- a/Strand/Screens/TodayView.swift
+++ b/Strand/Screens/TodayView.swift
@@ -4306,13 +4306,35 @@ struct TodayView: View {
     /// number, and there is nothing for the user to go and do. `StatTile.caption` is optional, so nil
     /// renders NO caption rather than falling back to "today" — which would be its own small lie on a past
     /// day being browsed.
-    /// Twin of the Kotlin `stepsCalibrationPrompt` guard (#1514).
+    ///
+    /// #1816: when the strap has banked NO motion, the phone-step-days countdown is the wrong message.
+    /// A step estimate is `motion * coefficient`, so with the motion half missing neither the estimate
+    /// nor the fit moves however many days the phone counts — and the countdown that names only the
+    /// phone half sent a field reporter to enter Apple Health steps by hand expecting calibration to
+    /// start, which it cannot. The `stepsHasBankedMotion` flag is persisted by `IntelligenceEngine` on
+    /// every analytics pass, so it tracks a fresh strap's first sync without a per-render query. When
+    /// it is false, the caption says "No motion synced yet" instead — the same wording the calibration
+    /// sheet's no-motion banner uses, so the two surfaces agree. Twin of the Kotlin
+    /// `stepsCalibrationPrompt` guard (#1514).
     private var stepsCalibrationCaption: String? {
-        guard profile.stepsCalibrationCoefficient <= 0, profile.stepsManualCoefficient <= 0 else {
-            return nil
-        }
+        Self.stepsCalibrationCaption(coefficient: profile.stepsCalibrationCoefficient,
+                                     manualCoefficient: profile.stepsManualCoefficient,
+                                     hasBankedMotion: profile.stepsHasBankedMotion,
+                                     sampleDays: profile.stepsCalibrationSampleDays)
+    }
+
+    /// #1816: the pure decision behind `stepsCalibrationCaption`, extracted so it can be unit-tested
+    /// without a live view. Returns nil once a coefficient exists (a blank day is just a quiet one,
+    /// not a missing input). Returns "No motion synced yet" when the strap has banked no motion —
+    /// the motion half is the blocker, not the phone half, and the countdown that names only the
+    /// phone half is a lie. Otherwise returns the engine's `needsMoreDays` headline. Twin of the
+    /// Kotlin `stepsCalibrationPrompt` guard.
+    static func stepsCalibrationCaption(coefficient: Double, manualCoefficient: Double,
+                                        hasBankedMotion: Bool, sampleDays: Int) -> String? {
+        guard coefficient <= 0, manualCoefficient <= 0 else { return nil }
+        if !hasBankedMotion { return String(localized: "No motion synced yet") }
         let status = StepsEstimateEngine.CalibrationStatus.needsMoreDays(
-            have: profile.stepsCalibrationSampleDays,
+            have: sampleDays,
             need: StepsEstimateEngine.minCalibrationDays)
         return status.headline
     }
diff --git a/StrandTests/TodayVitalCardTests.swift b/StrandTests/TodayVitalCardTests.swift
index fa68c191f9..2a159df12e 100644
--- a/StrandTests/TodayVitalCardTests.swift
+++ b/StrandTests/TodayVitalCardTests.swift
@@ -72,4 +72,43 @@ final class TodayVitalCardTests: XCTestCase {
         let days = [day("2026-08-13", resp: 15.0)]
         XCTAssertNil(Repository.lastRespDay(days: days, todayKey: "2026-08-13"))
     }
+
+    // MARK: Steps calibration caption (#1816)
+
+    /// With no coefficient and no motion, the caption must say "No motion synced yet" — NOT the
+    /// phone-step-days countdown, because the motion half is the blocker and no number of phone-step
+    /// days will move the estimate or the fit. The old caption sent a field reporter to enter Apple
+    /// Health steps by hand expecting calibration to start, which it cannot without strap motion.
+    func testStepsCaptionNoMotionSaysNoMotionNotPhoneDays() {
+        let caption = TodayView.stepsCalibrationCaption(coefficient: 0, manualCoefficient: 0,
+                                                        hasBankedMotion: false, sampleDays: 0)
+        XCTAssertEqual(caption, "No motion synced yet")
+    }
+
+    /// With no coefficient but motion HAS been banked, the caption returns the engine's
+    /// needsMoreDays headline — the phone half is genuinely the missing half now.
+    func testStepsCaptionWithMotionReturnsPhoneDaysCountdown() {
+        let caption = TodayView.stepsCalibrationCaption(coefficient: 0, manualCoefficient: 0,
+                                                        hasBankedMotion: true, sampleDays: 0)
+        XCTAssertNotNil(caption)
+        XCTAssertNotEqual(caption, "No motion synced yet",
+                          "with motion banked, the phone-step-days countdown is the honest message")
+    }
+
+    /// Once a coefficient exists (auto or manual), the caption is nil — a blank day is just a quiet
+    /// one below the motion floor, not a missing input, and there is nothing for the user to go do.
+    func testStepsCaptionNilOnceCalibrated() {
+        XCTAssertNil(TodayView.stepsCalibrationCaption(coefficient: 1.5, manualCoefficient: 0,
+                                                       hasBankedMotion: false, sampleDays: 3))
+        XCTAssertNil(TodayView.stepsCalibrationCaption(coefficient: 0, manualCoefficient: 2.0,
+                                                       hasBankedMotion: false, sampleDays: 0))
+    }
+
+    /// The no-motion message takes precedence over the phone-step-days countdown even when some
+    /// sample days have been recorded, because the motion half is still the blocker.
+    func testStepsCaptionNoMotionPrecedenceOverSampleDays() {
+        let caption = TodayView.stepsCalibrationCaption(coefficient: 0, manualCoefficient: 0,
+                                                        hasBankedMotion: false, sampleDays: 2)
+        XCTAssertEqual(caption, "No motion synced yet")
+    }
 }
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index 49bf559283..bbc588a421 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -61,6 +61,17 @@ object IntelligenceEngine {
      */
     private val analyzeGate = Mutex()
 
+    /** #1816: optional sink for whether the strap banked ANY motion in the calibration scan window.
+     *  Set by the caller (AppViewModel / WhoopBleClient) before calling [analyzeRecent] and cleared
+     *  after, so the Today tile can distinguish "Need N more phone-step days" (motion exists, phone
+     *  half missing) from "No motion synced yet" (the motion half is the blocker). A field rather
+     *  than a parameter because [analyzeRecentOnCpu] sits close to the JVM 64 KB method ceiling and
+     *  the JaCoCo budget test (#1524) guards its margin — one more function-typed parameter + call
+     *  site would push it over. Safe for the same reason [skippedSleepDays] and [dayScanCache] are:
+     *  every pass runs under [analyzeGate], so there is no concurrent access. */
+    @Volatile
+    var stepsHasMotionSink: ((Boolean) -> Unit)? = null
+
     /** #1121: days this pass skipped for too little raw HR, emitted as ONE line after the loop instead of
      *  one line each — see [skippedSleepDaysLine]. A FIELD, not a local, for a mechanical reason:
      *  [analyzeRecentOnCpu] is `suspend` and sits 64 bytes under the JVM ceiling #1524 guards, so one more
@@ -2047,6 +2058,12 @@ object IntelligenceEngine {
             val m = StepsEstimateEngine.dayMotionIntensity(grav)
             if (m > 0) motionByDay[dayKey] = m
         }
+        // #1816: persist whether the strap banked ANY motion in the calibration scan window, so the Today
+        // tile can distinguish "Need N more phone-step days" (motion exists, phone half missing) from
+        // "No motion synced yet" (the motion half is the blocker, and no number of phone-step days will
+        // move the estimate or the fit). A step estimate is `motion * coefficient`, so with the motion
+        // half missing the caption that names only the phone half is a lie.
+        stepsHasMotionSink?.invoke(motionByDay.isNotEmpty())
         // Build calibration points only for days with BOTH a motion volume and a real phone step count.
         val calPoints = motionByDay.mapNotNull { (day, motion) ->
             refStepsByDay[day]?.let { StepsEstimateEngine.CalibrationPoint(motion = motion, steps = it) }
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 3b2c36ea19..81bb8aa9c9 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -2946,6 +2946,11 @@ class WhoopBleClient(
                     if (newData) "yes"
                     else "no (empty/duplicate offload — nothing changed since last run) — skipping (#1146)")
                 if (newData) runCatching {
+                    // #1816: set the motion sink so a fresh strap's first backfill flips the Today caption
+                    // from "No motion synced yet" to the phone-step-days countdown as soon as it lands.
+                    IntelligenceEngine.stepsHasMotionSink = { hasMotion ->
+                        profileStore.stepsHasBankedMotion = hasMotion
+                    }
                     IntelligenceEngine.analyzeRecent(
                         repo = repository,
                         profile = profile,
@@ -3060,6 +3065,8 @@ class WhoopBleClient(
                     if (it is kotlin.coroutines.cancellation.CancellationException) throw it
                     log("Backfill: post-sync scoring failed: ${it.message}")
                 }
+                // #1816: clear the motion sink after the post-backfill pass completes.
+                IntelligenceEngine.stepsHasMotionSink = null
                 // Keep the opt-in Health Connect writeback fresh in background-only operation too.
                 if (NoopPrefs.hcWriteback(context)) {
                     // #660: log the count AND any PII-safe failure categories (the writer also persists
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index f8e5a25250..a567882b86 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -1119,6 +1119,11 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
                 val analyzeHasNewData = analyzeFp != NoopPrefs.analyzeWatermark(appContext)
                 if (analyzeHasNewData) ble.externalLog("re-score: trigger=idle newData=yes")
                 if (analyzeHasNewData) runCatching {
+                    // #1816: set the motion sink before the pass so the Today tile can name the right
+                    // missing half (motion, not phone steps) when none has arrived yet. Cleared after.
+                    IntelligenceEngine.stepsHasMotionSink = { hasMotion ->
+                        profileStore.stepsHasBankedMotion = hasMotion
+                    }
                     IntelligenceEngine.analyzeRecent(
                         repo = repository,
                         profile = currentProfile(),
@@ -1238,6 +1243,9 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
                     }
                 }
                     .onFailure { if (it is kotlin.coroutines.cancellation.CancellationException) throw it }
+                // #1816: clear the motion sink after the pass completes (success or failure) so a stale
+                // callback is never left behind. The next pass sets its own before calling analyzeRecent.
+                IntelligenceEngine.stepsHasMotionSink = null
                 // Opt-in writeback: push the freshly computed nights into Health Connect so other
                 // apps see them. Idempotent (clientRecordId per metric+day), so re-running every
                 // cycle just upserts. Never let an HC hiccup (perm revoked mid-flight, provider
@@ -1830,6 +1838,10 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
      */
     private suspend fun rescoreAfterEdit() {
         runCatching {
+            // #1816: set the motion sink before the pass, clear it after (same pattern as the 15-min loop).
+            IntelligenceEngine.stepsHasMotionSink = { hasMotion ->
+                profileStore.stepsHasBankedMotion = hasMotion
+            }
             IntelligenceEngine.analyzeRecent(
                 repo = repository,
                 profile = currentProfile(),
@@ -1863,9 +1875,8 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
                 dayCycleMode = NoopPrefs.dayCycleMode(appContext),
             )
         }.onFailure { if (it is kotlin.coroutines.cancellation.CancellationException) throw it }
+        IntelligenceEngine.stepsHasMotionSink = null
     }
-
-    /** Re-read every source + the dismissed markers and republish [workouts]. */
     fun loadWorkouts() {
         viewModelScope.launch {
             val now = System.currentTimeMillis() / 1000
diff --git a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
index f04141ef69..a8d6f27c06 100644
--- a/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/SettingsScreen.kt
@@ -306,6 +306,19 @@ class ProfileStore(private val prefs: SharedPreferences) {
      *  null when 0 (auto-fit), the positive value otherwise. */
     val stepsManualOverride: Double? get() = stepsManualCoefficient.takeIf { it > 0 }
 
+    /**
+     * #1816: true when the strap has banked ANY motion (gravity samples → `dayMotionIntensity > 0`)
+     * in the calibration scan window. Written by the analytics engine on every pass so it tracks a
+     * fresh strap's first sync without a separate query. The Today tile reads this to decide whether
+     * "Need N more days where your phone also counted steps" is the honest caption or a lie: a step
+     * estimate is `motion * coefficient`, so with the motion half missing neither the estimate nor the
+     * fit moves however many phone-counted days the user collects. The caption that names only the
+     * phone half is actively misleading. Twin of the Swift `ProfileStore.stepsHasBankedMotion`.
+     */
+    var stepsHasBankedMotion: Boolean
+        get() = prefs.getBoolean(KEY_STEPS_HAS_MOTION, false)
+        set(v) = prefs.edit().putBoolean(KEY_STEPS_HAS_MOTION, v).apply()
+
     /** The auto (Tanaka) HR-max for the current age. */
     val hrMaxAuto: Int get() = Zones.hrMaxTanaka(age)
 
@@ -423,6 +436,7 @@ class ProfileStore(private val prefs: SharedPreferences) {
         private const val KEY_STEPS_CONFIDENCE = "steps_calibration_confidence"
         private const val KEY_STEPS_MANUAL_FLAG = "steps_calibration_manual"
         private const val KEY_STEPS_MANUAL_COEFF = "steps_manual_coefficient"
+        private const val KEY_STEPS_HAS_MOTION = "steps_has_banked_motion"
 
         private const val AGE_MIN = 13
         private const val AGE_MAX = 100
diff --git a/android/app/src/main/java/com/noop/ui/TodayScreen.kt b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
index f136631dfa..6d2af24d84 100644
--- a/android/app/src/main/java/com/noop/ui/TodayScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
@@ -3919,6 +3919,15 @@ private fun stepsCalibrationPrompt(context: Context, profileStore: ProfileStore)
     ) {
         return null
     }
+    // #1816: when the strap has banked NO motion, the phone-step-days countdown is the wrong message.
+    // A step estimate is `motion * coefficient`, so with the motion half missing neither the estimate
+    // nor the fit moves however many days the phone counts — and the countdown that names only the
+    // phone half sent a field reporter to enter Apple Health steps by hand expecting calibration to
+    // start, which it cannot. Say "No motion synced yet" instead — the same wording the calibration
+    // sheet's no-motion banner uses, so the two surfaces agree.
+    if (!profileStore.stepsHasBankedMotion) {
+        return uiString(R.string.today_steps_headline_no_motion)
+    }
     val headline = StepsEstimateEngine.CalibrationStatus.NeedsMoreDays(
         have = profileStore.stepsCalibrationSampleDays,
         need = StepsEstimateEngine.MIN_CALIBRATION_DAYS,
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 7366f11cb1..f1bee3e8ab 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2352,6 +2352,7 @@
     <string name="today_steps_headline_calibrated">Aus %1$d Tagen mit Smartphone-Schritten geschätzt</string>
     <string name="today_steps_headline_connect_phone">Verbinde die Schrittzählung deines Smartphones, um Schritte zu schätzen</string>
     <string name="today_steps_headline_more_days">Noch %1$d Tage mit Smartphone-Schritten nötig</string>
+    <string name="today_steps_headline_no_motion">Noch keine Bewegungsdaten synchronisiert</string>
     <string name="today_synthesis_learning_baseline">Dein Basiswert wird gelernt, %1$d von %2$d Nächten.</string>
     <string name="today_last_night_date">Letzte Nacht · %1$s</string>
     <string name="today_hr_min">Min.</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 0108c67791..703aeeb971 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2339,6 +2339,7 @@
     <string name="today_steps_headline_calibrated">Estimado con %1$d días contabilizados también por el teléfono</string>
     <string name="today_steps_headline_connect_phone">Conecta el recuento de pasos del teléfono para estimar pasos</string>
     <string name="today_steps_headline_more_days">Faltan %1$d días contabilizados también por el teléfono</string>
+    <string name="today_steps_headline_no_motion">Aún no se han sincronizado datos de movimiento</string>
     <string name="today_synthesis_learning_baseline">Creando tu referencia, %1$d de %2$d noches.</string>
     <string name="today_last_night_date">Anoche · %1$s</string>
     <string name="today_hr_min">Mín.</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 474f633ddd..d23a551ea2 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2338,6 +2338,7 @@
     <string name="today_steps_headline_calibrated">Estimation basée sur %1$d jours également comptés par le téléphone</string>
     <string name="today_steps_headline_connect_phone">Connectez le comptage de pas du téléphone pour estimer les pas</string>
     <string name="today_steps_headline_more_days">Encore %1$d jours également comptés par le téléphone</string>
+    <string name="today_steps_headline_no_motion">Aucune donnée de mouvement synchronisée pour l\'instant</string>
     <string name="today_synthesis_learning_baseline">Création de votre référence, %1$d nuits sur %2$d.</string>
     <string name="today_last_night_date">Nuit dernière · %1$s</string>
     <string name="today_hr_min">Min.</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 1716d503d8..05e72a5ea3 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2331,6 +2331,7 @@
     <string name="today_steps_headline_calibrated">Oszacowano na podstawie %1$d dni z krokami telefonu</string>
     <string name="today_steps_headline_connect_phone">Połącz kroki z telefonu, aby je oszacować</string>
     <string name="today_steps_headline_more_days">Potrzeba jeszcze %1$d dni z krokami telefonu</string>
+    <string name="today_steps_headline_no_motion">Brak zsynchronizowanych danych o ruchu</string>
     <string name="today_synthesis_learning_baseline">Tworzenie bazy: %1$d z %2$d nocy.</string>
     <string name="today_last_night_date">Ostatnia noc · %1$s</string>
     <string name="today_hr_min">Min.</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 4cd88e760a..1e6b6a32d0 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2331,6 +2331,7 @@
     <string name="today_steps_headline_calibrated">Estimado com %1$d dias também contados pelo telemóvel</string>
     <string name="today_steps_headline_connect_phone">Ligue a contagem de passos do telemóvel para estimar passos</string>
     <string name="today_steps_headline_more_days">Faltam %1$d dias também contados pelo telemóvel</string>
+    <string name="today_steps_headline_no_motion">Ainda sem dados de movimento sincronizados</string>
     <string name="today_synthesis_learning_baseline">A criar a sua referência, %1$d de %2$d noites.</string>
     <string name="today_last_night_date">Noite passada · %1$s</string>
     <string name="today_hr_min">Mín.</string>
diff --git a/android/app/src/main/res/values-ru/strings.xml b/android/app/src/main/res/values-ru/strings.xml
index 1492c5c63e..19029d862c 100644
--- a/android/app/src/main/res/values-ru/strings.xml
+++ b/android/app/src/main/res/values-ru/strings.xml
@@ -2285,6 +2285,7 @@
     <string name="today_steps_headline_calibrated">Оценка по %1$d дням, когда ваш телефон тоже считал</string>
     <string name="today_steps_headline_connect_phone">Подключите счётчик шагов телефона, чтобы оценивать шаги</string>
     <string name="today_steps_headline_more_days">Нужно ещё %1$d дней, когда ваш телефон тоже считал шаги</string>
+    <string name="today_steps_headline_no_motion">Данные о движении ещё не синхронизированы</string>
     <string name="today_synthesis_learning_baseline">Изучаем вашу норму, %1$d из %2$d ночей.</string>
     <string name="today_last_night_date">Прошлая ночь · %1$s</string>
     <string name="today_hr_min">Мин.</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 0eecde5dec..6363d35c4d 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2266,6 +2266,7 @@
     <string name="today_steps_headline_calibrated">根据手机同时记录的 %1$d 天估算</string>
     <string name="today_steps_headline_connect_phone">连接手机步数以估算步数</string>
     <string name="today_steps_headline_more_days">还需 %1$d 天由手机同时记录步数</string>
+    <string name="today_steps_headline_no_motion">尚未同步运动数据</string>
     <string name="today_synthesis_learning_baseline">正在建立基线：%1$d/%2$d 晚。</string>
     <string name="today_last_night_date">昨晚 · %1$s</string>
     <string name="today_hr_min">最低</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index ebc992b9cd..3af3829eaa 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2451,6 +2451,7 @@
     <string name="today_steps_headline_calibrated">Estimated from %1$d days your phone also counted</string>
     <string name="today_steps_headline_connect_phone">Connect your phone’s step count to estimate steps</string>
     <string name="today_steps_headline_more_days">Need %1$d more days where your phone also counted steps</string>
+    <string name="today_steps_headline_no_motion">No motion synced yet</string>
     <string name="today_synthesis_learning_baseline">Learning your baseline, %1$d of %2$d nights.</string>
     <string name="today_last_night_date">Last night · %1$s</string>
     <string name="today_hr_min">Min</string>

From 5cdb5d7441a82a8bf3cc0cb9c100526ce7e399c2 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 20:59:17 +1200
Subject: [PATCH 282/333] today: the calibrating ring counts nights, and says
 when they arrive empty

From a field report: "It has been 5 days already but the charge has not
calibrated yet", against a Charge ring reading 2 of 4.

The count was right and the unit was missing. calibrationNights counts nights
that banked a usable HRV - Baselines.update only advances nValid for a non-nil,
in-range value - not days elapsed. Five days with three R-R-less nights genuinely
sits at 2, and a bare "2 of 4" under "Calibrating" reads as days, so a number that
has not moved in five of them reads as broken. The ring now says nights.

Naming the unit corrects a belief but does not answer the question. The app
already explains a TOTAL drought (#612, "no new nights for N days"), but that
fires only past staleDays and measures the gap since the NEWEST valid night, so
an install getting valid nights occasionally never sees it. Nights arriving
mostly empty is the common shape and nothing described it. Baselines
.recentHrvCoverage, with a Kotlin twin and five pinned cases each side, lets the
detail add "3 of the last 5 nights recorded no HRV. Check the strap is worn
overnight and syncing." - only when nights were missed, and only over days the
app has a row for, so a new install is not charged for nights before it owned the
strap.

Five things caught in review that CI could not fail on:

  - The iOS catalog key was %@; both values are Int, so the real key is %lld. The
    entry would have matched nothing and shipped English to ten locales.
  - The Chinese translation reorders the two numbers, and the catalog used
    non-positional specifiers, so zh would have claimed more empty nights than
    nights existed.
  - The copy used em-dashes, against the standing rule the adjacent comment in
    TodayScreen invokes by name.
  - The helper shipped untested on both platforms, and the Kotlin returned an
    unnamed Pair whose call site read second, first.
  - Android hid the whole detail behind the Synthesis card's expand toggle, so
    the new reason landed in the exact state the report was taken in. iOS never
    gated it; that was a parity gap as well as a visibility one.

What this does NOT do: produce HRV. The reporter's screenshot shows Effort and
Strain both "No data" against Rest 90 - sleep staging, R-R not landing. This
turns their wait into an action; the missing R-R is the open question.
---
 .../Sources/StrandAnalytics/Baselines.swift   | 23 ++++++++
 .../BaselinesRecentHrvCoverageTests.swift     | 50 +++++++++++++++++
 Strand/Liquid/LiquidTodayView.swift           | 18 +++++++
 Strand/Resources/Localizable.xcstrings        | 24 +++++++++
 Strand/Screens/TodayView.swift                | 20 ++++++-
 .../main/java/com/noop/analytics/Baselines.kt | 36 +++++++++++++
 .../src/main/java/com/noop/ui/TodayScreen.kt  | 28 +++++++++-
 .../app/src/main/res/values-de/strings.xml    |  3 +-
 .../app/src/main/res/values-es/strings.xml    |  3 +-
 .../app/src/main/res/values-fr/strings.xml    |  3 +-
 .../app/src/main/res/values-pl/strings.xml    |  3 +-
 .../src/main/res/values-pt-rPT/strings.xml    |  3 +-
 .../app/src/main/res/values-ru/strings.xml    |  3 +-
 .../app/src/main/res/values-zh/strings.xml    |  1 +
 android/app/src/main/res/values/strings.xml   |  3 +-
 .../noop/analytics/RecentHrvCoverageTest.kt   | 53 +++++++++++++++++++
 16 files changed, 264 insertions(+), 10 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/BaselinesRecentHrvCoverageTests.swift
 create mode 100644 android/app/src/test/java/com/noop/analytics/RecentHrvCoverageTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/Baselines.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/Baselines.swift
index d88027646f..ff4fa689cd 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/Baselines.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/Baselines.swift
@@ -279,6 +279,29 @@ public enum Baselines {
     /// from your strap for N days" when the baseline aged out silently instead of only "building your
     /// baseline". Pure and TZ-free (civil-day arithmetic); mirror EXACTLY in the Kotlin twin.
     /// `dayKeys`/`nightlyHrv` are parallel (same night per index); `today` is an ISO `yyyy-MM-dd` key.
+    /// Nights the app OBSERVED in the recent window, and how many of them carried no usable HRV.
+    ///
+    /// Distinct from both neighbours, and the gap between them. `calibrationNights` counts progress
+    /// toward a baseline; `nightsSinceNewestValidNight` measures a TOTAL drought and only speaks once it
+    /// passes `staleDays`. Neither says anything about the common case: nights arriving, but most of them
+    /// carrying nothing. A wearer five days in with three empty nights sits at "2 of 4" with no reason
+    /// given, which reads as a stuck counter rather than as missing data — that is the report this exists
+    /// to answer.
+    ///
+    /// Counts only days the app has a row for, so a new install is not charged for nights before it owned
+    /// the strap. Pure and TZ-free (civil-day arithmetic); mirror EXACTLY in the Kotlin twin.
+    public static func recentHrvCoverage(dayKeys: [String], nightlyHrv: [Double?], today: String,
+                                         window: Int = staleDays) -> (observed: Int, missing: Int) {
+        guard let t = isoEpochDay(today) else { return (0, 0) }
+        var observed = 0, missing = 0
+        for i in 0..<Swift.min(dayKeys.count, nightlyHrv.count) {
+            guard let d = isoEpochDay(dayKeys[i]), t - d >= 0, t - d < window else { continue }
+            observed += 1
+            if nightlyHrv[i] == nil { missing += 1 }
+        }
+        return (observed, missing)
+    }
+
     public static func nightsSinceNewestValidNight(dayKeys: [String], nightlyHrv: [Double?], today: String) -> Int? {
         var newest: String? = nil
         for i in 0..<Swift.min(dayKeys.count, nightlyHrv.count) where nightlyHrv[i] != nil {
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/BaselinesRecentHrvCoverageTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/BaselinesRecentHrvCoverageTests.swift
new file mode 100644
index 0000000000..4d9a98c381
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/BaselinesRecentHrvCoverageTests.swift
@@ -0,0 +1,50 @@
+import XCTest
+@testable import StrandAnalytics
+
+/// The counts behind "N of the last M nights recorded no HRV".
+///
+/// The line only helps if both numbers are right, and both are Ints with the same units, so an inverted
+/// pair reads as "5 of the last 3 nights" — absurd to a person, invisible to a compiler. These pin the
+/// order as well as the arithmetic. Byte-identical twin: Kotlin `RecentHrvCoverageTest`.
+final class BaselinesRecentHrvCoverageTests: XCTestCase {
+
+    /// The reported shape: five observed nights, three of them empty.
+    func testCountsObservedNightsAndTheEmptyOnesAmongThem() {
+        let days = ["2026-09-02", "2026-09-03", "2026-09-04", "2026-09-05", "2026-09-06"]
+        let hrv: [Double?] = [44.0, nil, nil, 47.0, nil]
+        let cov = Baselines.recentHrvCoverage(dayKeys: days, nightlyHrv: hrv, today: "2026-09-06")
+        XCTAssertEqual(cov.observed, 5)
+        XCTAssertEqual(cov.missing, 3)
+    }
+
+    /// Only days the app has a row for, so a fresh install is not charged for nights it never saw.
+    func testADayOutsideTheWindowIsNotObserved() {
+        let cov = Baselines.recentHrvCoverage(dayKeys: ["2026-08-01", "2026-09-06"],
+                                              nightlyHrv: [nil, nil], today: "2026-09-06", window: 14)
+        XCTAssertEqual(cov.observed, 1, "the August night is 36 days back, outside the window")
+        XCTAssertEqual(cov.missing, 1)
+    }
+
+    /// A future-dated row cannot be a night that already happened.
+    func testADayAfterTodayIsIgnored() {
+        let cov = Baselines.recentHrvCoverage(dayKeys: ["2026-09-07"], nightlyHrv: [nil],
+                                              today: "2026-09-06")
+        XCTAssertEqual(cov.observed, 0)
+        XCTAssertEqual(cov.missing, 0)
+    }
+
+    /// Every night counted: the caller must then say nothing extra.
+    func testACompleteWindowReportsNothingMissing() {
+        let cov = Baselines.recentHrvCoverage(dayKeys: ["2026-09-05", "2026-09-06"],
+                                              nightlyHrv: [50.0, 51.0], today: "2026-09-06")
+        XCTAssertEqual(cov.observed, 2)
+        XCTAssertEqual(cov.missing, 0)
+    }
+
+    /// No rows, and an unparseable today, both yield zeroes rather than a fabricated count.
+    func testEmptyAndUnparseableInputsAreZero() {
+        XCTAssertEqual(Baselines.recentHrvCoverage(dayKeys: [], nightlyHrv: [], today: "2026-09-06").observed, 0)
+        XCTAssertEqual(Baselines.recentHrvCoverage(dayKeys: ["2026-09-06"], nightlyHrv: [nil],
+                                                   today: "not-a-day").observed, 0)
+    }
+}
diff --git a/Strand/Liquid/LiquidTodayView.swift b/Strand/Liquid/LiquidTodayView.swift
index 8d51a63ec7..96eb35c357 100644
--- a/Strand/Liquid/LiquidTodayView.swift
+++ b/Strand/Liquid/LiquidTodayView.swift
@@ -1107,6 +1107,15 @@ struct LiquidTodayView: View {
                         Text(chargeDisplay.calibrationDetail ?? synthLine)
                             .font(StrandFont.body).foregroundStyle(StrandPalette.textPrimary)
                             .fixedSize(horizontal: false, vertical: true)
+                        // The reason the count is not moving, when nights are arriving empty. Sits under
+                        // the progress rather than replacing it: the wearer needs both the number and why.
+                        if let why = chargeDisplay.calibrationReason(
+                            dayKeys: repo.days.map(\.day), nightlyHrv: repo.days.map(\.avgHrv),
+                            today: Repository.logicalDayKey(Date())) {
+                            Text(why).font(StrandFont.caption)
+                                .foregroundStyle(StrandPalette.textSecondary)
+                                .fixedSize(horizontal: false, vertical: true)
+                        }
                         // #530 follow-up: the classic hero's "no cardio load yet" note (effortZeroNote),
                         // shown on a calm day so today's ~0 Effort explains itself instead of a bare 0.
                         if let note = effortZeroNote {
@@ -2477,6 +2486,15 @@ extension LiquidTodayView {
             return String(localized: "Learning your baseline, \(nights) of \(Baselines.minNightsSeed) nights.")
         }
 
+        /// The reason half, when nights are arriving but most carry no HRV (see `TodayView`'s twin). Nil
+        /// when every observed night counted, so a healthy calibration says nothing extra.
+        func calibrationReason(dayKeys: [String], nightlyHrv: [Double?], today: String) -> String? {
+            guard case .calibrating = self else { return nil }
+            let cov = Baselines.recentHrvCoverage(dayKeys: dayKeys, nightlyHrv: nightlyHrv, today: today)
+            guard cov.missing > 0, cov.observed > 0 else { return nil }
+            return String(localized: "\(cov.missing) of the last \(cov.observed) nights recorded no HRV. Check the strap is worn overnight and syncing.")
+        }
+
         static func resolve(todayRecovery: Double?, priorScored: DailyMetric?,
                             calibrationNights: Int?, todayKey: String) -> ChargeDisplay {
             if let pct = todayRecovery { return .scored(pct: pct) }
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 0c0bbfd876..9f45660284 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -210050,6 +210050,30 @@
         "ru": {"stringUnit": {"state": "translated", "value": "Не удалось включить микрофон: %@"}},
         "zh-Hans": {"stringUnit": {"state": "translated", "value": "无法启动麦克风：%@"}},
         "zh-Hant": {"stringUnit": {"state": "translated", "value": "無法啟動麥克風：%@"}}
+    } },
+    "%lld of %lld nights": { "localizations": {
+        "de": {"stringUnit": {"state": "translated", "value": "%lld von %lld Nächten"}},
+        "en": {"stringUnit": {"state": "translated", "value": "%lld of %lld nights"}},
+        "es": {"stringUnit": {"state": "translated", "value": "%lld de %lld noches"}},
+        "fr": {"stringUnit": {"state": "translated", "value": "%lld nuits sur %lld"}},
+        "it": {"stringUnit": {"state": "translated", "value": "%lld di %lld notti"}},
+        "pl": {"stringUnit": {"state": "translated", "value": "%lld z %lld nocy"}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "%lld de %lld noites"}},
+        "ru": {"stringUnit": {"state": "translated", "value": "%lld из %lld ночей"}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "%lld / %lld 晚"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "%lld / %lld 晚"}}
+    } },
+    "%lld of the last %lld nights recorded no HRV. Check the strap is worn overnight and syncing.": { "localizations": {
+        "de": {"stringUnit": {"state": "translated", "value": "%lld der letzten %lld Nächte haben keine HRV aufgezeichnet. Prüfe, ob der Strap nachts getragen wird und synchronisiert."}},
+        "en": {"stringUnit": {"state": "translated", "value": "%lld of the last %lld nights recorded no HRV. Check the strap is worn overnight and syncing."}},
+        "es": {"stringUnit": {"state": "translated", "value": "%lld de las últimas %lld noches no registraron HRV. Comprueba que llevas la banda por la noche y que se sincroniza."}},
+        "fr": {"stringUnit": {"state": "translated", "value": "%lld des %lld dernières nuits n’ont enregistré aucune VFC. Vérifiez que le bracelet est porté la nuit et se synchronise."}},
+        "it": {"stringUnit": {"state": "translated", "value": "%lld delle ultime %lld notti non hanno registrato HRV. Controlla che la fascia sia indossata di notte e si sincronizzi."}},
+        "pl": {"stringUnit": {"state": "translated", "value": "%lld z ostatnich %lld nocy nie zarejestrowało HRV. Sprawdź, czy opaska jest noszona w nocy i synchronizuje się."}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "%lld das últimas %lld noites não registaram HRV. Verifica se usas a fita à noite e se sincroniza."}},
+        "ru": {"stringUnit": {"state": "translated", "value": "%lld из последних %lld ночей не записали ВСР. Проверьте, что ремешок надет ночью и синхронизируется."}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "最近 %2$lld 晚中有 %1$lld 晚未记录 HRV。请检查夜间是否佩戴并已同步。"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "最近 %2$lld 晚中有 %1$lld 晚未記錄 HRV。請檢查夜間是否配戴並已同步。"}}
     } }
   },
   "version": "1.0"
diff --git a/Strand/Screens/TodayView.swift b/Strand/Screens/TodayView.swift
index 05c9255e40..fb920595a7 100644
--- a/Strand/Screens/TodayView.swift
+++ b/Strand/Screens/TodayView.swift
@@ -1108,6 +1108,16 @@ struct TodayView: View {
            stale > Baselines.staleDays {
             return "No new nights from your strap for \(stale) days. Check it's connected and saving data."
         }
+        // #612 covers a TOTAL drought (nothing valid for staleDays). The common shape is the other one:
+        // nights arriving, most of them empty — five days in with three HRV-less nights sits at "2 of 4"
+        // with no reason given, which reads as a stuck counter. Name the missing nights so the wearer has
+        // something to act on instead of something to wait for.
+        let cov = Baselines.recentHrvCoverage(dayKeys: repo.days.map(\.day),
+                                              nightlyHrv: repo.days.map(\.avgHrv),
+                                              today: Repository.logicalDayKey(Date()))
+        if cov.missing > 0, cov.observed > 0 {
+            return "Learning your baseline, \(n) of \(Baselines.minNightsSeed) nights. \(cov.missing) of the last \(cov.observed) nights recorded no HRV. Check the strap is worn overnight and syncing."
+        }
         return "Learning your baseline, \(n) of \(Baselines.minNightsSeed) nights."
     }
 
@@ -3397,8 +3407,14 @@ struct TodayView: View {
                 // the same lineLimit/scaleFactor guard so it never wraps, then its "N of 4" subtitle below.
                 Text("Calibrating").font(StrandFont.headline).foregroundStyle(StrandPalette.textPrimary)
                     .lineLimit(1).minimumScaleFactor(0.7).fixedSize()
-                Text("\(n) of \(Baselines.minNightsSeed)").font(StrandFont.footnote).foregroundStyle(StrandPalette.textSecondary)
-                    .lineLimit(1)
+                // #1816's lesson on a second tile: a bare "2 of 4" under "Calibrating" is read as DAYS,
+                // and a wearer five days in reports it stuck. It counts NIGHTS THAT BANKED A USABLE HRV
+                // (`Baselines.update` only advances `nValid` for a non-nil in-range value), so a week of
+                // wear with three R-R-less nights genuinely sits at 2. Naming the unit is the whole fix:
+                // the number is right, the reader's unit was not.
+                Text("\(n) of \(Baselines.minNightsSeed) nights").font(StrandFont.footnote)
+                    .foregroundStyle(StrandPalette.textSecondary)
+                    .lineLimit(1).minimumScaleFactor(0.7)
             } else {
                 ringNoData(diameter: diameter)
             }
diff --git a/android/app/src/main/java/com/noop/analytics/Baselines.kt b/android/app/src/main/java/com/noop/analytics/Baselines.kt
index 6273645434..4b2c7b6e7e 100644
--- a/android/app/src/main/java/com/noop/analytics/Baselines.kt
+++ b/android/app/src/main/java/com/noop/analytics/Baselines.kt
@@ -234,6 +234,42 @@ object Baselines {
         return BaselineStatus.TRUSTED
     }
 
+    /** Named rather than a `Pair`: the two numbers are both Ints with the same units, so `first`/`second`
+     *  at a call site is a coin toss that no test would catch — "5 of the last 3 nights" is absurd to a
+     *  reader and invisible to a compiler. Mirrors the Swift twin's `(observed:missing:)` labels. */
+    data class HrvCoverage(val observed: Int, val missing: Int)
+
+    /**
+     * Nights the app OBSERVED in the recent window, and how many carried no usable HRV. Swift twin:
+     * `Baselines.recentHrvCoverage`.
+     *
+     * Distinct from both neighbours, and the gap between them. `calibrationNights` counts progress toward
+     * a baseline; [nightsSinceNewestValidNight] measures a TOTAL drought and only speaks once it passes
+     * [staleDays]. Neither says anything about the common case: nights arriving, but most of them carrying
+     * nothing. A wearer five days in with three empty nights sits at "2 of 4" with no reason given, which
+     * reads as a stuck counter rather than as missing data — that is the report this exists to answer.
+     *
+     * Counts only days the app has a row for, so a new install is not charged for nights before it owned
+     * the strap. Pure and TZ-free (civil-day arithmetic).
+     */
+    fun recentHrvCoverage(
+        dayKeys: List<String>,
+        nightlyHrv: List<Double?>,
+        today: String,
+        window: Int = staleDays,
+    ): HrvCoverage {
+        val t = isoEpochDay(today) ?: return HrvCoverage(0, 0)
+        var observed = 0
+        var missing = 0
+        for (i in 0 until minOf(dayKeys.size, nightlyHrv.size)) {
+            val d = isoEpochDay(dayKeys[i]) ?: continue
+            if (t - d < 0 || t - d >= window) continue
+            observed++
+            if (nightlyHrv[i] == null) missing++
+        }
+        return HrvCoverage(observed, missing)
+    }
+
     /** #612: calendar days since the newest night that carried a usable HRV reading (the baseline's input),
      *  or null when there is none / a key can't be parsed. DISTINCT from `calibrationNights` (which counts
      *  progress TOWARD a usable baseline) — this measures staleness, so a surface can say "no new nights from
diff --git a/android/app/src/main/java/com/noop/ui/TodayScreen.kt b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
index 6d2af24d84..9bff48c284 100644
--- a/android/app/src/main/java/com/noop/ui/TodayScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
@@ -2938,7 +2938,22 @@ private fun SynthesisHeroCard(
             } else {
                 // Comma (not the old em-dash) to match the Swift canonical synthesis copy VERBATIM
                 // (TodayView "Learning your baseline, N of M nights.") and the no-em-dash standing rule.
-                uiString(R.string.today_synthesis_learning_baseline, recoveryCalibration, Baselines.minNightsSeed)
+                // #612 above covers a TOTAL drought. The common shape is the other one: nights arriving,
+                // most of them empty. Five days in with three HRV-less nights sits at "2 of 4" with no
+                // reason given, which reads as a stuck counter rather than as missing data. Name the
+                // missing nights so a wearer has something to act on instead of something to wait for.
+                // Swift twin: TodayView.calibrationDetail.
+                val cov = Baselines.recentHrvCoverage(
+                    days.map { it.day }, days.map { it.avgHrv }, logicalDayKeyNow(),
+                )
+                val base = uiString(
+                    R.string.today_synthesis_learning_baseline, recoveryCalibration, Baselines.minNightsSeed,
+                )
+                if (cov.missing > 0 && cov.observed > 0) {
+                    base + " " + uiString(R.string.today_synthesis_nights_without_hrv, cov.missing, cov.observed)
+                } else {
+                    base
+                }
             }
         } else if (carriedDay != null) {
             // Carried prior-day read, summarise that day + stamp it so it isn't passed off as today's.
@@ -2998,6 +3013,17 @@ private fun SynthesisHeroCard(
                             maxLines = 1,
                             overflow = TextOverflow.Ellipsis,
                         )
+                        // While calibrating, the detail carries the progress AND, when nights are arriving
+                        // empty, the reason. Collapsed used to show only "Calibrating", which is the state
+                        // the field report was taken in: the explanation existed one tap away and the
+                        // wearer had no way to know it was there. iOS never gated this line; matching it.
+                        if (recoveryCalibration != null) {
+                            Text(
+                                detail,
+                                style = NoopType.caption,
+                                color = Palette.textSecondary,
+                            )
+                        }
                     }
                     Icon(
                         Icons.Filled.KeyboardArrowDown,
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index f1bee3e8ab..78ef8e7c92 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -970,7 +970,7 @@
     <string name="l10n_today_screen_arrange_today_6b699147">Heute vereinbaren</string>
     <string name="l10n_today_screen_calibrating_37c2c9bd">Kalibrierung</string>
     <string name="l10n_today_screen_no_new_nights_from_your_strap_for_stale_days_8863bcfe">Seit %1$d Tagen keine neuen Nächte von deinem Strap. Prüfe, ob er verbunden ist und Daten speichert.</string>
-    <string name="l10n_today_screen_calibratingnights_of_baselines_minnightsseed_3b76e55c">%1$s von %2$s</string>
+    <string name="l10n_today_screen_calibratingnights_of_baselines_minnightsseed_3b76e55c">%1$s von %2$s Nächten</string>
     <string name="l10n_today_screen_choose_which_cards_show_on_today_f79942e1">Wählen Sie, welche Karten auf Heute angezeigt werden, und ordnen Sie sie mit den Pfeilen neu an.</string>
     <string name="l10n_today_screen_close_bbfa773e">Schließen</string>
     <string name="l10n_today_screen_customise_your_cards_2428d761">Passe deine Karten an</string>
@@ -2354,6 +2354,7 @@
     <string name="today_steps_headline_more_days">Noch %1$d Tage mit Smartphone-Schritten nötig</string>
     <string name="today_steps_headline_no_motion">Noch keine Bewegungsdaten synchronisiert</string>
     <string name="today_synthesis_learning_baseline">Dein Basiswert wird gelernt, %1$d von %2$d Nächten.</string>
+    <string name="today_synthesis_nights_without_hrv">%1$d der letzten %2$d Nächte haben keine HRV aufgezeichnet. Prüfe, ob der Strap nachts getragen wird und synchronisiert.</string>
     <string name="today_last_night_date">Letzte Nacht · %1$s</string>
     <string name="today_hr_min">Min.</string>
     <string name="today_hr_avg">Ø</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 703aeeb971..14088a8057 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -770,7 +770,7 @@
     <string name="l10n_today_screen_arrange_today_6b699147">Arregla hoy</string>
     <string name="l10n_today_screen_calibrating_37c2c9bd">Calibrando</string>
     <string name="l10n_today_screen_no_new_nights_from_your_strap_for_stale_days_8863bcfe">Sin nuevas noches de tu strap desde hace %1$d días. Comprueba que esté conectado y guardando datos.</string>
-    <string name="l10n_today_screen_calibratingnights_of_baselines_minnightsseed_3b76e55c">%1$s de %2$s</string>
+    <string name="l10n_today_screen_calibratingnights_of_baselines_minnightsseed_3b76e55c">%1$s de %2$s noches</string>
     <string name="l10n_today_screen_choose_which_cards_show_on_today_f79942e1">Elija qué tarjetas muestran en Hoy y reordenarlos con las flechas.</string>
     <string name="l10n_today_screen_close_bbfa773e">Cerrar</string>
     <string name="l10n_today_screen_customise_your_cards_2428d761">Personaliza tus tarjetas</string>
@@ -2341,6 +2341,7 @@
     <string name="today_steps_headline_more_days">Faltan %1$d días contabilizados también por el teléfono</string>
     <string name="today_steps_headline_no_motion">Aún no se han sincronizado datos de movimiento</string>
     <string name="today_synthesis_learning_baseline">Creando tu referencia, %1$d de %2$d noches.</string>
+    <string name="today_synthesis_nights_without_hrv">%1$d de las últimas %2$d noches no registraron HRV. Comprueba que llevas la banda por la noche y que se sincroniza.</string>
     <string name="today_last_night_date">Anoche · %1$s</string>
     <string name="today_hr_min">Mín.</string>
     <string name="today_hr_avg">Media</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index d23a551ea2..17814b8eaa 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -788,7 +788,7 @@
     <string name="l10n_today_screen_arrange_today_6b699147">Arrange aujourd\'hui</string>
     <string name="l10n_today_screen_calibrating_37c2c9bd">Calibration en cours</string>
     <string name="l10n_today_screen_no_new_nights_from_your_strap_for_stale_days_8863bcfe">Aucune nouvelle nuit de votre strap depuis %1$d jours. Vérifiez qu\'il est connecté et enregistre les données.</string>
-    <string name="l10n_today_screen_calibratingnights_of_baselines_minnightsseed_3b76e55c">%1$s de %2$s</string>
+    <string name="l10n_today_screen_calibratingnights_of_baselines_minnightsseed_3b76e55c">%1$s nuits sur %2$s</string>
     <string name="l10n_today_screen_choose_which_cards_show_on_today_f79942e1">Choisissez les cartes affichées sur Today et réarrangez-les avec les flèches.</string>
     <string name="l10n_today_screen_close_bbfa773e">Fermer</string>
     <string name="l10n_today_screen_customise_your_cards_2428d761">Personnalisez vos cartes</string>
@@ -2340,6 +2340,7 @@
     <string name="today_steps_headline_more_days">Encore %1$d jours également comptés par le téléphone</string>
     <string name="today_steps_headline_no_motion">Aucune donnée de mouvement synchronisée pour l\'instant</string>
     <string name="today_synthesis_learning_baseline">Création de votre référence, %1$d nuits sur %2$d.</string>
+    <string name="today_synthesis_nights_without_hrv">%1$d des %2$d dernières nuits n\'ont enregistré aucune VFC. Vérifiez que le bracelet est porté la nuit et se synchronise.</string>
     <string name="today_last_night_date">Nuit dernière · %1$s</string>
     <string name="today_hr_min">Min.</string>
     <string name="today_hr_avg">Moy.</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index 05e72a5ea3..ea16906b49 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -921,7 +921,7 @@
     <string name="l10n_today_screen_arrange_today_6b699147">Umów się już dziś</string>
     <string name="l10n_today_screen_calibrating_37c2c9bd">Kalibracja</string>
     <string name="l10n_today_screen_no_new_nights_from_your_strap_for_stale_days_8863bcfe">Żadnych nowych nocy z Twojego paska przez %1$d dni. Sprawdź, czy jest podłączony i zapisuje dane.</string>
-    <string name="l10n_today_screen_calibratingnights_of_baselines_minnightsseed_3b76e55c">%1$s lub %2$s</string>
+    <string name="l10n_today_screen_calibratingnights_of_baselines_minnightsseed_3b76e55c">%1$s z %2$s nocy</string>
     <string name="l10n_today_screen_choose_which_cards_show_on_today_f79942e1">Wybierz, które karty mają być wyświetlane w Dzisiaj i zmień ich kolejność za pomocą strzałek.</string>
     <string name="l10n_today_screen_close_bbfa773e">Zamknij</string>
     <string name="l10n_today_screen_customise_your_cards_2428d761">Dostosuj swoje karty</string>
@@ -2333,6 +2333,7 @@
     <string name="today_steps_headline_more_days">Potrzeba jeszcze %1$d dni z krokami telefonu</string>
     <string name="today_steps_headline_no_motion">Brak zsynchronizowanych danych o ruchu</string>
     <string name="today_synthesis_learning_baseline">Tworzenie bazy: %1$d z %2$d nocy.</string>
+    <string name="today_synthesis_nights_without_hrv">%1$d z ostatnich %2$d nocy nie zarejestrowało HRV. Sprawdź, czy opaska jest noszona w nocy i synchronizuje się.</string>
     <string name="today_last_night_date">Ostatnia noc · %1$s</string>
     <string name="today_hr_min">Min.</string>
     <string name="today_hr_avg">Śr.</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 1e6b6a32d0..6e0b5ac165 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -935,7 +935,7 @@
     <string name="l10n_today_screen_arrange_today_6b699147">Organize hoje</string>
     <string name="l10n_today_screen_calibrating_37c2c9bd">A calibrar</string>
     <string name="l10n_today_screen_no_new_nights_from_your_strap_for_stale_days_8863bcfe">Nenhuma noite nova na tua bracelete durante %1$d dias. Verifique se está ligado e a guardar dados.</string>
-    <string name="l10n_today_screen_calibratingnights_of_baselines_minnightsseed_3b76e55c">%1$s de %2$s</string>
+    <string name="l10n_today_screen_calibratingnights_of_baselines_minnightsseed_3b76e55c">%1$s de %2$s noites</string>
     <string name="l10n_today_screen_choose_which_cards_show_on_today_f79942e1">Escolha quais os cartões que serão apresentados no Hoje e reordene-os com as setas. </string>
     <string name="l10n_today_screen_close_bbfa773e">Fechar</string>
     <string name="l10n_today_screen_customise_your_cards_2428d761">Personalize os teus cartões</string>
@@ -2333,6 +2333,7 @@
     <string name="today_steps_headline_more_days">Faltam %1$d dias também contados pelo telemóvel</string>
     <string name="today_steps_headline_no_motion">Ainda sem dados de movimento sincronizados</string>
     <string name="today_synthesis_learning_baseline">A criar a sua referência, %1$d de %2$d noites.</string>
+    <string name="today_synthesis_nights_without_hrv">%1$d das últimas %2$d noites não registaram HRV. Verifica se usas a fita à noite e se sincroniza.</string>
     <string name="today_last_night_date">Noite passada · %1$s</string>
     <string name="today_hr_min">Mín.</string>
     <string name="today_hr_avg">Méd.</string>
diff --git a/android/app/src/main/res/values-ru/strings.xml b/android/app/src/main/res/values-ru/strings.xml
index 19029d862c..facf716042 100644
--- a/android/app/src/main/res/values-ru/strings.xml
+++ b/android/app/src/main/res/values-ru/strings.xml
@@ -967,7 +967,7 @@
     <string name="l10n_today_screen_arrange_today_6b699147">Настроить «Сегодня»</string>
     <string name="l10n_today_screen_calibrating_37c2c9bd">Калибровка</string>
     <string name="l10n_today_screen_no_new_nights_from_your_strap_for_stale_days_8863bcfe">Нет новых ночей с вашего браслета уже %1$d дней. Проверьте, что он подключён и сохраняет данные.</string>
-    <string name="l10n_today_screen_calibratingnights_of_baselines_minnightsseed_3b76e55c">%1$s из %2$s</string>
+    <string name="l10n_today_screen_calibratingnights_of_baselines_minnightsseed_3b76e55c">%1$s из %2$s ночей</string>
     <string name="l10n_today_screen_choose_which_cards_show_on_today_f79942e1">Выберите, какие карточки показывать на «Сегодня», и меняйте их порядок стрелками. </string>
     <string name="l10n_today_screen_close_bbfa773e">Закрыть</string>
     <string name="l10n_today_screen_customise_your_cards_2428d761">Настройте свои карточки</string>
@@ -2287,6 +2287,7 @@
     <string name="today_steps_headline_more_days">Нужно ещё %1$d дней, когда ваш телефон тоже считал шаги</string>
     <string name="today_steps_headline_no_motion">Данные о движении ещё не синхронизированы</string>
     <string name="today_synthesis_learning_baseline">Изучаем вашу норму, %1$d из %2$d ночей.</string>
+    <string name="today_synthesis_nights_without_hrv">%1$d из последних %2$d ночей не записали ВСР. Проверьте, что ремешок надет ночью и синхронизируется.</string>
     <string name="today_last_night_date">Прошлая ночь · %1$s</string>
     <string name="today_hr_min">Мин.</string>
     <string name="today_hr_avg">Сред.</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 6363d35c4d..64c56c8086 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2268,6 +2268,7 @@
     <string name="today_steps_headline_more_days">还需 %1$d 天由手机同时记录步数</string>
     <string name="today_steps_headline_no_motion">尚未同步运动数据</string>
     <string name="today_synthesis_learning_baseline">正在建立基线：%1$d/%2$d 晚。</string>
+    <string name="today_synthesis_nights_without_hrv">最近 %2$d 晚中有 %1$d 晚未记录 HRV。请检查夜间是否佩戴并已同步。</string>
     <string name="today_last_night_date">昨晚 · %1$s</string>
     <string name="today_hr_min">最低</string>
     <string name="today_hr_avg">平均</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 3af3829eaa..f3f81e3ab8 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -1055,7 +1055,7 @@
     <string name="l10n_today_screen_arrange_today_6b699147">Arrange Today</string>
     <string name="l10n_today_screen_calibrating_37c2c9bd">Calibrating</string>
     <string name="l10n_today_screen_no_new_nights_from_your_strap_for_stale_days_8863bcfe">No new nights from your strap for %1$d days. Check it\'s connected and saving data.</string>
-    <string name="l10n_today_screen_calibratingnights_of_baselines_minnightsseed_3b76e55c">%1$s of %2$s</string>
+    <string name="l10n_today_screen_calibratingnights_of_baselines_minnightsseed_3b76e55c">%1$s of %2$s nights</string>
     <string name="l10n_today_screen_choose_which_cards_show_on_today_f79942e1">Choose which cards show on Today and reorder them with the arrows. </string>
     <string name="l10n_today_screen_close_bbfa773e">Close</string>
     <string name="l10n_today_screen_customise_your_cards_2428d761">Customise your cards</string>
@@ -2453,6 +2453,7 @@
     <string name="today_steps_headline_more_days">Need %1$d more days where your phone also counted steps</string>
     <string name="today_steps_headline_no_motion">No motion synced yet</string>
     <string name="today_synthesis_learning_baseline">Learning your baseline, %1$d of %2$d nights.</string>
+    <string name="today_synthesis_nights_without_hrv">%1$d of the last %2$d nights recorded no HRV. Check the strap is worn overnight and syncing.</string>
     <string name="today_last_night_date">Last night · %1$s</string>
     <string name="today_hr_min">Min</string>
     <string name="today_hr_avg">Avg</string>
diff --git a/android/app/src/test/java/com/noop/analytics/RecentHrvCoverageTest.kt b/android/app/src/test/java/com/noop/analytics/RecentHrvCoverageTest.kt
new file mode 100644
index 0000000000..015d7264f5
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/RecentHrvCoverageTest.kt
@@ -0,0 +1,53 @@
+package com.noop.analytics
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+/**
+ * #1853-adjacent: the counts behind "N of the last M nights recorded no HRV".
+ *
+ * The line only helps if both numbers are right, and both are Ints with the same units, so an inverted
+ * pair reads as "5 of the last 3 nights" — absurd to a person, invisible to a compiler. These pin the
+ * order as well as the arithmetic. Byte-identical twin: Swift `BaselinesRecentHrvCoverageTests`.
+ */
+class RecentHrvCoverageTest {
+
+    /** The reported shape: five observed nights, three of them empty. */
+    @Test fun `counts observed nights and the empty ones among them`() {
+        val days = listOf("2026-09-02", "2026-09-03", "2026-09-04", "2026-09-05", "2026-09-06")
+        val hrv = listOf(44.0, null, null, 47.0, null)
+        val cov = Baselines.recentHrvCoverage(days, hrv, "2026-09-06")
+        assertEquals(5, cov.observed)
+        assertEquals(3, cov.missing)
+    }
+
+    /** Only days the app has a row for, so a fresh install is not charged for nights it never saw. */
+    @Test fun `a day outside the window is not observed`() {
+        val days = listOf("2026-08-01", "2026-09-06")
+        val hrv = listOf<Double?>(null, null)
+        val cov = Baselines.recentHrvCoverage(days, hrv, "2026-09-06", window = 14)
+        assertEquals("the August night is 36 days back, outside the window", 1, cov.observed)
+        assertEquals(1, cov.missing)
+    }
+
+    /** A future-dated row cannot be a night that already happened. */
+    @Test fun `a day after today is ignored`() {
+        val cov = Baselines.recentHrvCoverage(listOf("2026-09-07"), listOf(null), "2026-09-06")
+        assertEquals(0, cov.observed)
+        assertEquals(0, cov.missing)
+    }
+
+    /** Every night counted: the caller must then say nothing extra. */
+    @Test fun `a complete window reports nothing missing`() {
+        val days = listOf("2026-09-05", "2026-09-06")
+        val cov = Baselines.recentHrvCoverage(days, listOf(50.0, 51.0), "2026-09-06")
+        assertEquals(2, cov.observed)
+        assertEquals(0, cov.missing)
+    }
+
+    /** No rows, and an unparseable today, both yield zeroes rather than a fabricated count. */
+    @Test fun `empty and unparseable inputs are zero`() {
+        assertEquals(0, Baselines.recentHrvCoverage(emptyList(), emptyList(), "2026-09-06").observed)
+        assertEquals(0, Baselines.recentHrvCoverage(listOf("2026-09-06"), listOf(null), "not-a-day").observed)
+    }
+}

From 3cdae38dded7cb978c0920eeb0f6b118d4430404 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 21:03:12 +1200
Subject: [PATCH 283/333] build: testing build 447 / 328

Build numbers only; 11.1.1 stays as the next unreleased version.

Two copy fixes that can only really be judged on a phone: the Steps tile now
names the missing half when the strap has banked no motion, and the calibrating
Charge ring says NIGHTS rather than a bare "2 of 4" - with the reason beneath it
when nights are arriving empty, visible in the collapsed card a wearer is
actually looking at.

Also carries @evoveotech's Fahrenheit skin-temp import fix, so a Fahrenheit
export stops landing ~92 in a Celsius column; the per-day wake overrides reaching
the strap alarm and backup notification; the wind-down nudge pinned to its own
day rather than the wake's; and a storage footprint that names bytes per table on
both platforms.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 639a931d7b..6a3631f019 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 446
+        versionCode = 447
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 8fb4d5a69c..ec7118d95e 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "327"
+    CURRENT_PROJECT_VERSION: "328"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 5d8cc42e0bfff9443038970d8e03243c8f4d102e Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Sun, 6 Sep 2026 14:45:08 +0530
Subject: [PATCH 284/333] health: drop the active strap id from Apple Health
 external UUID keys

From @evoveotech. Addresses #1503.

Every identity NOOP wrote into Apple Health embedded the active strap id. That id
is not durable - it changes on a re-pair or a serial-based identification - and
once it changes the delete-then-write reconciliation cannot find the old records,
because its predicate is built from the id active NOW. The stranded records stay
in Apple Health as duplicates with no way to clear them from inside the app.

The key becomes natural: noop:<kind>:<identity>, matching Android's
clientRecordId, which never carried a device id. Dropping the id cannot collide
even on a two-strap install, and the reason is worth stating because it is not the
key that makes it safe: writeVitals merges computed and imported into byDay before
writing, so the write-back was already one value per day rather than one per
device.

The delete is scoped to HKSource.default() - it cannot reach another app's data -
and the sweep shares fromTs with the writers and runs before all four, so
everything deleted is re-added in the same pass. Heart rate is untouched: it lives
in highResQuantityWriteIds, which the sweep does not iterate.

Review found the one-shot flag being set even when the sweep did nothing: each
delete is guarded by authorizationStatus, and partial authorization is a supported
state, so a wearer who had granted sleep but declined workouts would have had the
flag set with workouts unswept - and a later grant would never have swept them.
That is now per-type: a declined type stays pending, a thrown delete retries, and
only a delete that actually returned is recorded. Seven tests pin it, including
the late-grant and retry sequences rather than only the happy path.
---
 .../StrandImport/HealthWriteback.swift        |  66 +++++++++
 .../HealthWritebackTests.swift                | 135 ++++++++++++++++++
 StrandiOS/Health/HealthKitBridge.swift        | 102 +++++++++++--
 3 files changed, 295 insertions(+), 8 deletions(-)

diff --git a/Packages/StrandImport/Sources/StrandImport/HealthWriteback.swift b/Packages/StrandImport/Sources/StrandImport/HealthWriteback.swift
index 8538fe9198..9e3e773822 100644
--- a/Packages/StrandImport/Sources/StrandImport/HealthWriteback.swift
+++ b/Packages/StrandImport/Sources/StrandImport/HealthWriteback.swift
@@ -154,4 +154,70 @@ public enum HealthWriteback {
         }
         return out
     }
+
+    // MARK: - Apple Health external UUID keys (#1503)
+
+    /// The deterministic `HKMetadataKeyExternalUUID` for a NOOP-written Apple Health record.
+    ///
+    /// The key is a natural key — `noop:<kind>:<identity>` — with NO device-id segment. The previous
+    /// scheme embedded the active strap id (`noop:<deviceId>:<kind>:<identity>`), which is NOT durable:
+    /// a re-pair or serial-based identification changes it, and every record written under the old id
+    /// becomes unreachable to the delete-then-write reconciliation (the delete predicate is built from
+    /// the id that is active NOW). The stranded records stay in Apple Health permanently as duplicates.
+    ///
+    /// Dropping the id segment matches the Android twin (`HealthConnectWriter.clientRecordId` carries
+    /// no device id — `noop-workout-<startTs>`) and makes the key mean what it is: a natural key over
+    /// the record's own identity, stable across strap lifecycle changes.
+    ///
+    /// `kind` is the metric's `HKQuantityTypeIdentifier.rawValue` for vitals, `"sleep"` for sleep
+    /// sessions, or `"workout"` for workouts. `identity` is the day key ("yyyy-MM-dd") for vitals or
+    /// the unix-second start timestamp for sleep/workout.
+    public static func appleHealthExternalUUID(kind: String, identity: String) -> String {
+        "noop:\(kind):\(identity)"
+    }
+
+    /// The vitals key: `noop:<metricId>:<day>`.
+    public static func appleHealthVitalKey(metricId: String, day: String) -> String {
+        appleHealthExternalUUID(kind: metricId, identity: day)
+    }
+
+    /// The sleep key: `noop:sleep:<startTs>`.
+    public static func appleHealthSleepKey(startTs: Int) -> String {
+        appleHealthExternalUUID(kind: "sleep", identity: "\(startTs)")
+    }
+
+    /// The workout key: `noop:workout:<startTs>`.
+    public static func appleHealthWorkoutKey(startTs: Int) -> String {
+        appleHealthExternalUUID(kind: "workout", identity: "\(startTs)")
+    }
+
+    // MARK: - #1503 stranded-records sweep completion tracking
+    //
+    // The one-off sweep that clears Apple Health records written under the OLD device-id-keyed
+    // scheme must be PER-TYPE, not a single boolean. A single flag set unconditionally loses the
+    // migration permanently when authorization is partial (sleep granted, workouts declined) or
+    // when a `deleteObjects` call fails — both of which read as "already done" and leave the
+    // stranded records unreachable forever. Per-type tracking lets an install that could not
+    // complete the sweep finish it later, once the missing authorization arrives or the failing
+    // delete succeeds on a retry.
+    //
+    // These pure helpers model the decision so it is unit-testable without HealthKit (HealthKit
+    // itself can't run under `swift test`). The app-target migration (`HealthKitBridge`) loads the
+    // already-swept set from UserDefaults, computes the types to attempt, attempts each delete, and
+    // records only the types whose delete SUCCEEDED back into the swept set.
+
+    /// The type ids that should be attempted this run: authorized for sharing but not yet swept.
+    /// A type that was declined (absent from `authorized`) is never attempted and never marked
+    /// swept, so a later grant still gets swept. A type whose delete failed (not in `swept`) is
+    /// retried on the next write-back run.
+    public static func strandedSweepPending(swept: Set<String>, authorized: Set<String>) -> Set<String> {
+        authorized.subtracting(swept)
+    }
+
+    /// The new swept set after this run: the union of previously swept types and the types whose
+    /// delete SUCCEEDED this run. A type whose delete threw (absent from `succeededThisRun`) is NOT
+    /// marked swept, so it is retried next run rather than silently abandoned.
+    public static func strandedSweepResult(swept: Set<String>, succeededThisRun: Set<String>) -> Set<String> {
+        swept.union(succeededThisRun)
+    }
 }
diff --git a/Packages/StrandImport/Tests/StrandImportTests/HealthWritebackTests.swift b/Packages/StrandImport/Tests/StrandImportTests/HealthWritebackTests.swift
index 40f08c789b..49bffa8885 100644
--- a/Packages/StrandImport/Tests/StrandImportTests/HealthWritebackTests.swift
+++ b/Packages/StrandImport/Tests/StrandImportTests/HealthWritebackTests.swift
@@ -183,4 +183,139 @@ final class HealthWritebackTests: XCTestCase {
         XCTAssertEqual(plan[0].allKeyStartTs, [t, t + 600])
         XCTAssertEqual(plan[0].intervals, [.init(start: t + 600, end: t + 7_200, kind: .unspecified)])
     }
+
+    // MARK: - Apple Health external UUID keys (#1503)
+
+    /// The key must NOT embed a device id — the active strap id is not durable and embedding it
+    /// stranded every prior record in Apple Health as unreachable duplicates after a re-pair.
+    func testVitalKeyHasNoDeviceIdSegment() {
+        let key = HealthWriteback.appleHealthVitalKey(metricId: "restingHeartRate", day: "2026-08-27")
+        XCTAssertEqual(key, "noop:restingHeartRate:2026-08-27")
+        // The key must be STABLE — no strap id, no hash, nothing that changes on a re-pair.
+        XCTAssertFalse(key.contains("my-whoop"),
+                       "the vital key must not embed a device id (#1503)")
+    }
+
+    func testSleepKeyHasNoDeviceIdSegment() {
+        let startTs = 1_700_000_000
+        let key = HealthWriteback.appleHealthSleepKey(startTs: startTs)
+        XCTAssertEqual(key, "noop:sleep:1700000000")
+        XCTAssertFalse(key.contains("my-whoop"),
+                       "the sleep key must not embed a device id (#1503)")
+    }
+
+    func testWorkoutKeyHasNoDeviceIdSegment() {
+        let startTs = 1_700_000_000
+        let key = HealthWriteback.appleHealthWorkoutKey(startTs: startTs)
+        XCTAssertEqual(key, "noop:workout:1700000000")
+        XCTAssertFalse(key.contains("my-whoop"),
+                       "the workout key must not embed a device id (#1503)")
+    }
+
+    /// The key is deterministic: the same inputs always produce the same key, so the
+    /// delete-then-write reconciliation can find prior records across app restarts and strap
+    /// lifecycle changes.
+    func testKeysAreDeterministic() {
+        XCTAssertEqual(
+            HealthWriteback.appleHealthVitalKey(metricId: "heartRateVariabilitySDNN", day: "2026-01-01"),
+            HealthWriteback.appleHealthVitalKey(metricId: "heartRateVariabilitySDNN", day: "2026-01-01"))
+        XCTAssertEqual(
+            HealthWriteback.appleHealthSleepKey(startTs: 123),
+            HealthWriteback.appleHealthSleepKey(startTs: 123))
+        XCTAssertEqual(
+            HealthWriteback.appleHealthWorkoutKey(startTs: 456),
+            HealthWriteback.appleHealthWorkoutKey(startTs: 456))
+    }
+
+    /// Different metrics on the same day produce different keys (no collision).
+    func testVitalKeysDifferByMetric() {
+        let day = "2026-08-27"
+        let rhr = HealthWriteback.appleHealthVitalKey(metricId: "restingHeartRate", day: day)
+        let hrv = HealthWriteback.appleHealthVitalKey(metricId: "heartRateVariabilitySDNN", day: day)
+        let spo2 = HealthWriteback.appleHealthVitalKey(metricId: "oxygenSaturation", day: day)
+        let resp = HealthWriteback.appleHealthVitalKey(metricId: "respiratoryRate", day: day)
+        XCTAssertNotEqual(rhr, hrv)
+        XCTAssertNotEqual(rhr, spo2)
+        XCTAssertNotEqual(rhr, resp)
+        XCTAssertNotEqual(hrv, spo2)
+        XCTAssertNotEqual(hrv, resp)
+        XCTAssertNotEqual(spo2, resp)
+    }
+
+    // MARK: - #1503 stranded-records sweep completion tracking (per-type, not a single boolean)
+
+    /// An authorized type that has not been swept is pending — it should be attempted this run.
+    func testStrandedSweepPendingForAuthorizedUnsweptType() {
+        let pending = HealthWriteback.strandedSweepPending(
+            swept: [], authorized: ["restingHeartRate", "sleepAnalysis"])
+        XCTAssertEqual(pending, ["restingHeartRate", "sleepAnalysis"])
+    }
+
+    /// A type that was already swept is NOT pending again — the sweep is once per install per type.
+    func testStrandedSweepSkipsAlreadySweptType() {
+        let pending = HealthWriteback.strandedSweepPending(
+            swept: ["restingHeartRate"], authorized: ["restingHeartRate", "sleepAnalysis"])
+        XCTAssertEqual(pending, ["sleepAnalysis"])
+    }
+
+    /// A type the user DECLINED (absent from authorized) is never pending — it is not attempted and
+    /// not marked swept, so a later grant still gets swept. This is the partial-authorization case.
+    func testStrandedSweepNeverAttemptsDeclinedType() {
+        let pending = HealthWriteback.strandedSweepPending(
+            swept: [], authorized: ["restingHeartRate"])  // workouts declined
+        XCTAssertFalse(pending.contains("workout"))
+        XCTAssertEqual(pending, ["restingHeartRate"])
+    }
+
+    /// A type whose delete SUCCEEDED this run is added to the swept set, so it is not retried.
+    func testStrandedSweepResultRecordsSuccessfulDelete() {
+        let updated = HealthWriteback.strandedSweepResult(
+            swept: ["restingHeartRate"], succeededThisRun: ["sleepAnalysis"])
+        XCTAssertEqual(updated, ["restingHeartRate", "sleepAnalysis"])
+    }
+
+    /// A type whose delete FAILED (absent from succeededThisRun) is NOT added to the swept set, so
+    /// it is retried on the next write-back run instead of being silently abandoned.
+    func testStrandedSweepResultDoesNotRecordFailedDelete() {
+        let updated = HealthWriteback.strandedSweepResult(
+            swept: ["restingHeartRate"], succeededThisRun: [])  // sleep delete threw
+        XCTAssertEqual(updated, ["restingHeartRate"])
+        XCTAssertFalse(updated.contains("sleepAnalysis"))
+    }
+
+    /// The partial-authorization recovery sequence: run 1 sweeps only the authorized type; after a
+    /// later grant, run 2 sweeps the newly-authorized type. The migration completes across runs.
+    func testStrandedSweepCompletesAcrossRunsAfterLateAuthorizationGrant() {
+        // Run 1: sleep granted, workouts declined. Only sleep is authorized.
+        var swept: Set<String> = []
+        let authRun1: Set<String> = ["sleepAnalysis"]
+        let pending1 = HealthWriteback.strandedSweepPending(swept: swept, authorized: authRun1)
+        XCTAssertEqual(pending1, ["sleepAnalysis"])
+        // Sleep delete succeeds; workouts were never attempted (declined).
+        swept = HealthWriteback.strandedSweepResult(swept: swept, succeededThisRun: ["sleepAnalysis"])
+        XCTAssertEqual(swept, ["sleepAnalysis"])
+        // Run 2: user later grants workouts.
+        let authRun2: Set<String> = ["sleepAnalysis", "workout"]
+        let pending2 = HealthWriteback.strandedSweepPending(swept: swept, authorized: authRun2)
+        XCTAssertEqual(pending2, ["workout"], "the late-granted workout type must still be swept")
+        // Workout delete succeeds; the migration is now complete.
+        swept = HealthWriteback.strandedSweepResult(swept: swept, succeededThisRun: ["workout"])
+        XCTAssertEqual(swept, ["sleepAnalysis", "workout"])
+    }
+
+    /// A delete that fails on run 1 is retried on run 2 and succeeds — the migration is not lost.
+    func testStrandedSweepRetriesFailedDeleteOnNextRun() {
+        var swept: Set<String> = []
+        let auth: Set<String> = ["restingHeartRate", "sleepAnalysis"]
+        // Run 1: sleep delete throws (absent from succeededThisRun).
+        let pending1 = HealthWriteback.strandedSweepPending(swept: swept, authorized: auth)
+        XCTAssertEqual(pending1, ["restingHeartRate", "sleepAnalysis"])
+        swept = HealthWriteback.strandedSweepResult(swept: swept, succeededThisRun: ["restingHeartRate"])
+        XCTAssertEqual(swept, ["restingHeartRate"])
+        // Run 2: sleep is still pending (not marked swept), so it is retried and succeeds.
+        let pending2 = HealthWriteback.strandedSweepPending(swept: swept, authorized: auth)
+        XCTAssertEqual(pending2, ["sleepAnalysis"], "the failed sleep delete must be retried")
+        swept = HealthWriteback.strandedSweepResult(swept: swept, succeededThisRun: ["sleepAnalysis"])
+        XCTAssertEqual(swept, ["restingHeartRate", "sleepAnalysis"])
+    }
 }
diff --git a/StrandiOS/Health/HealthKitBridge.swift b/StrandiOS/Health/HealthKitBridge.swift
index de533e31e5..ce79a1bad2 100644
--- a/StrandiOS/Health/HealthKitBridge.swift
+++ b/StrandiOS/Health/HealthKitBridge.swift
@@ -768,6 +768,14 @@ final class HealthKitBridge: ObservableObject {
         func attempt(_ op: () async throws -> Void) async {
             do { try await op() } catch { if firstError == nil { firstError = error } }
         }
+        // #1503: one-off sweep to clear records stranded under the OLD device-id-keyed scheme.
+        // The old keys embedded the active strap id (`noop:<deviceId>:<kind>:<identity>`), which
+        // became unreachable after a re-pair. The new keys drop the id segment, so the normal
+        // delete-then-write can never find the old records. This sweep deletes ALL of our prior
+        // records in the write-back window by `HKSource.default()` + date range (the same pattern
+        // the HR path uses), then the normal writes re-add them under the new keys. Runs once,
+        // gated by a UserDefaults flag, BEFORE the new-key writes so nothing is lost.
+        await attempt { try await migrateStrandedHealthRecords(fromTs: fromTs, nowTs: nowTs) }
         await attempt { try await writeVitals(whoopStore: whoopStore, days: days, sessions: sessions) }
         await attempt { try await writeSleep(sessions: sessions) }
         await attempt { try await writeHeartRate(whoopStore: whoopStore, fromTs: fromTs, nowTs: nowTs) }
@@ -775,6 +783,75 @@ final class HealthKitBridge: ObservableObject {
         if let firstError { throw firstError }
     }
 
+    /// UserDefaults key for the #1503 stranded-records sweep completion set. Stores the set of
+    /// type ids whose sweep delete has SUCCEEDED, so a type that was unauthorized or whose delete
+    /// failed is retried on a later write-back run rather than abandoned. Per-type (not a single
+    /// boolean) because partial authorization is a supported state: a user who granted sleep but
+    /// declined workouts must still get the stranded workouts swept once they later grant workouts,
+    /// and a `deleteObjects` that threw must not read as "already done".
+    private static let strandedRecordsSweptKey = "hkStrandedRecordsSweptTypes.v1"
+
+    /// Stable type ids used in the per-type swept set. The quantity identifiers are the
+    /// `HKQuantityTypeIdentifier` raw values; sleep and workout use fixed labels so the set is
+    /// round-trippable through UserDefaults without depending on HealthKit type object identity.
+    private static let sleepSweepTypeId = "sleepAnalysis"
+    private static let workoutSweepTypeId = "workout"
+
+    /// One-off migration (#1503): delete ALL of our prior Apple Health records in the write-back
+    /// window that were written under the old device-id-keyed scheme. The old keys embedded the
+    /// active strap id, which became unreachable after a re-pair; the new keys drop the id segment.
+    /// This sweep uses `HKSource.default()` + date range (like the HR path) to reach records the
+    /// new key-based delete predicate can never find. Runs BEFORE the new-key writes so the fresh
+    /// batch re-adds everything under the stable keys.
+    ///
+    /// Completion is tracked PER-TYPE (not a single boolean): a type is marked swept only when its
+    /// `deleteObjects` call returned a result (succeeded, even if it deleted zero records). A type
+    /// that was unauthorized or whose delete threw is left un-swept, so a later authorization grant
+    /// or a successful retry finishes the migration instead of abandoning the stranded records.
+    /// The decision helpers live in `HealthWriteback` so they are unit-tested without HealthKit.
+    private func migrateStrandedHealthRecords(fromTs: Int, nowTs: Int) async throws {
+        let defaults = UserDefaults.standard
+        let swept: Set<String> = Set(defaults.stringArray(forKey: Self.strandedRecordsSweptKey) ?? [])
+        let bySource = HKQuery.predicateForObjects(from: HKSource.default())
+        let byDate = HKQuery.predicateForSamples(
+            withStart: Date(timeIntervalSince1970: TimeInterval(fromTs)),
+            end: Date(timeIntervalSince1970: TimeInterval(nowTs) + 60),
+            options: [])
+        let pred = NSCompoundPredicate(andPredicateWithSubpredicates: [bySource, byDate])
+        var succeededThisRun: Set<String> = []
+        // Vitals: each quantity type that carried an id-keyed external UUID.
+        for id in Self.quantityWriteIds {
+            let typeId = id.rawValue
+            guard !swept.contains(typeId),
+                  let type = HKQuantityType.quantityType(forIdentifier: id),
+                  store.authorizationStatus(for: type) == .sharingAuthorized else { continue }
+            // `try?` returns nil on throw — a failure is NOT recorded as swept, so it retries next run.
+            if (try? await store.deleteObjects(of: type, predicate: pred)) != nil {
+                succeededThisRun.insert(typeId)
+            }
+        }
+        // Sleep.
+        if !swept.contains(Self.sleepSweepTypeId),
+           let sleep = HKObjectType.categoryType(forIdentifier: .sleepAnalysis),
+           store.authorizationStatus(for: sleep) == .sharingAuthorized {
+            if (try? await store.deleteObjects(of: sleep, predicate: pred)) != nil {
+                succeededThisRun.insert(Self.sleepSweepTypeId)
+            }
+        }
+        // Workouts.
+        if !swept.contains(Self.workoutSweepTypeId),
+           store.authorizationStatus(for: .workoutType()) == .sharingAuthorized {
+            if (try? await store.deleteObjects(of: .workoutType(), predicate: pred)) != nil {
+                succeededThisRun.insert(Self.workoutSweepTypeId)
+            }
+        }
+        // Persist only the types that actually succeeded this run; the rest stay pending.
+        if !succeededThisRun.isEmpty {
+            let updated = HealthWriteback.strandedSweepResult(swept: swept, succeededThisRun: succeededThisRun)
+            defaults.set(Array(updated), forKey: Self.strandedRecordsSweptKey)
+        }
+    }
+
     /// The nightly vitals write (the original write-back), now stamped at the day's wake time when
     /// that day has a sleep session — a real timestamp inside the night the value describes, instead
     /// of a fabricated noon. Keys are unchanged, so re-stamped samples replace their noon ancestors.
@@ -807,7 +884,11 @@ final class HealthKitBridge: ObservableObject {
         func add(_ id: HKQuantityTypeIdentifier, _ unit: HKUnit, _ value: Double, _ day: String, _ at: Date) {
             guard let type = HKQuantityType.quantityType(forIdentifier: id),
                   store.authorizationStatus(for: type) == .sharingAuthorized else { return }
-            let key = "noop:\(noopDeviceId):\(id.rawValue):\(day)"
+            // #1503: the key carries NO device-id segment. The previous scheme embedded the active
+            // strap id, which is not durable — a re-pair changed it and stranded every prior record
+            // in Apple Health as unreachable duplicates. The natural key (`noop:<metric>:<day>`)
+            // matches the Android twin and is stable across strap lifecycle changes.
+            let key = HealthWriteback.appleHealthVitalKey(metricId: id.rawValue, day: day)
             let sample = HKQuantitySample(
                 type: type,
                 quantity: .init(unit: unit, doubleValue: value),
@@ -870,10 +951,12 @@ final class HealthKitBridge: ObservableObject {
     /// `.asleepUnspecified` block instead of fabricated stage placement.
     ///
     /// Dedup: every sample of a night carries `HKMetadataKeyExternalUUID =
-    /// noop:<deviceId>:sleep:<startTs>` keyed by the group's EARLIEST fragment's immutable detected
+    /// noop:sleep:<startTs>` keyed by the group's EARLIEST fragment's immutable detected
     /// onset (a user edit moves the span, never the key). The delete predicate carries EVERY
     /// fragment's key, so a night previously written as two entries fully clears when it becomes
-    /// one; delete-then-write scoped to our own `HKSource`, like the vitals.
+    /// one; delete-then-write scoped to our own `HKSource`, like the vitals. The key carries NO
+    /// device-id segment (#1503): the active strap id is not durable, and embedding it stranded
+    /// every prior record as unreachable duplicates after a re-pair.
     private func writeSleep(sessions: [CachedSleepSession]) async throws {
         guard let type = HKObjectType.categoryType(forIdentifier: .sleepAnalysis),
               store.authorizationStatus(for: type) == .sharingAuthorized else { return }
@@ -889,9 +972,9 @@ final class HealthKitBridge: ObservableObject {
         var samples: [HKCategorySample] = []
         var keys: [String] = []
         for entry in HealthWriteback.mergedSleepPlan(groups: groups) {
-            let key = "noop:\(noopDeviceId):sleep:\(entry.keyStartTs)"
+            let key = HealthWriteback.appleHealthSleepKey(startTs: entry.keyStartTs)
             let meta = [HKMetadataKeyExternalUUID: key]
-            keys.append(contentsOf: entry.allKeyStartTs.map { "noop:\(noopDeviceId):sleep:\($0)" })
+            keys.append(contentsOf: entry.allKeyStartTs.map { HealthWriteback.appleHealthSleepKey(startTs: $0) })
             samples.append(HKCategorySample(type: type, value: HKCategoryValueSleepAnalysis.inBed.rawValue,
                                             start: Date(timeIntervalSince1970: TimeInterval(entry.spanStart)),
                                             end: Date(timeIntervalSince1970: TimeInterval(entry.spanEnd)),
@@ -985,8 +1068,11 @@ final class HealthKitBridge: ObservableObject {
     /// sports. Workouts whose source is `apple-health` are EXCLUDED — those were imported FROM
     /// Health, and writing them back would duplicate the user's own Apple Watch/gym-app workouts.
     ///
-    /// Dedup: `HKMetadataKeyExternalUUID = noop:<deviceId>:workout:<startTs>` in the workout
-    /// metadata; delete-then-write scoped to our own source, like sleep and the vitals.
+    /// Dedup: `HKMetadataKeyExternalUUID = noop:workout:<startTs>` in the workout
+    /// metadata; delete-then-write scoped to our own source, like sleep and the vitals. The key
+    /// carries NO device-id segment (#1503): the active strap id is not durable, and embedding it
+    /// stranded every prior workout as unreachable duplicates after a re-pair. Matches the Android
+    /// twin's `noop-workout-<startTs>` `clientRecordId`.
     private func writeWorkouts(whoopStore: WhoopStore, fromTs: Int, toTs: Int) async throws {
         guard store.authorizationStatus(for: .workoutType()) == .sharingAuthorized else { return }
         let mine = (try? await whoopStore.workouts(deviceId: noopDeviceId, from: fromTs, to: toTs, limit: 500)) ?? []
@@ -998,7 +1084,7 @@ final class HealthKitBridge: ObservableObject {
         let rows = byKey.values.sorted { $0.startTs < $1.startTs }
         guard !rows.isEmpty else { return }
 
-        func key(_ row: WorkoutRow) -> String { "noop:\(noopDeviceId):workout:\(row.startTs)" }
+        func key(_ row: WorkoutRow) -> String { HealthWriteback.appleHealthWorkoutKey(startTs: row.startTs) }
         let pred = NSCompoundPredicate(andPredicateWithSubpredicates: [
             HKQuery.predicateForObjects(from: HKSource.default()),
             HKQuery.predicateForObjects(withMetadataKey: HKMetadataKeyExternalUUID,

From 9eb744de0e7c30ddb48558a7a24054647e2bb047 Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Sun, 6 Sep 2026 15:16:30 +0530
Subject: [PATCH 285/333] skin-temp: backfill absolutes for nights outside the
 21-night rescore window

From @evoveotech. Addresses #1853.

The nightly ABSOLUTE skin temperature is written only by the scoring pass, which
covers a rolling 21-night window, so nights already outside it when the column
shipped never got one. A wearer sees a deviation with nothing to read it against.

This re-derives the absolute from the SAME raw streams and the SAME funnel the
scoring pass uses, then writes it with a fill-only UPDATE that can only fill a
NULL - never an upsert of a rebuilt row, never over a measured value, never
touching skinTempDevC. Sessions are attributed by END, matching the engine's own
tsInDay filter; the 4.0 anchor comes from the CURRENT window and declines rather
than falling back to the global 826.

The history matters here. Four builds of this shipped and two reverts took them
back, and every failure was WIRING rather than computation - a strap id where the
engine writes under "-noop", a reprocessing job gated on new data arriving, an id
fix that still filled nothing. All of them failed to NOTHING, which is why each
read as "already done" and cost another round trip. The first revision of this PR
had no call site at all, which was the same shape again.

It now has one: an on-demand Test Centre button. A user tap cannot be gated into
a state where it has nothing to do, and the result line reports filled / declined
/ no-raw-data, so the unknown the revert named - whether those nights still have
raw samples - is answered by running it rather than by a separate investigation.

Two fixes on review: the button asked for "therometer.medium", which is not an SF
Symbol, so it would have shipped iconless with nothing failing; and its
description was a literal with no catalog entry, which had CI red and would have
shipped English to ten locales.

The walker is an actor rather than a @MainActor class: it walks up to ten pages
of fifty nights with three stream reads each, and while every await yields, each
resumption would otherwise land on the main thread. Nothing in it needs the main
actor, and the engine helpers it calls are already nonisolated for exactly this.

Android stays reverted, so this lands iOS-only.
---
 .../StrandAnalytics/SkinTempBackfill.swift    | 159 +++++++++++
 .../Sources/WhoopStore/MetricsCache.swift     |  17 ++
 .../DailySkinTempAbsoluteTests.swift          |  54 ++++
 Strand/Data/SkinTempBackfillWalker.swift      | 264 ++++++++++++++++++
 Strand/Resources/Localizable.xcstrings        |  12 +
 Strand/Screens/TestCentreView.swift           |  55 ++++
 StrandTests/SkinTempBackfillTests.swift       | 229 +++++++++++++++
 7 files changed, 790 insertions(+)
 create mode 100644 Packages/StrandAnalytics/Sources/StrandAnalytics/SkinTempBackfill.swift
 create mode 100644 Strand/Data/SkinTempBackfillWalker.swift
 create mode 100644 StrandTests/SkinTempBackfillTests.swift

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SkinTempBackfill.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SkinTempBackfill.swift
new file mode 100644
index 0000000000..61f29be71c
--- /dev/null
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SkinTempBackfill.swift
@@ -0,0 +1,159 @@
+import Foundation
+import WhoopProtocol
+
+/// #1853: backfill the nightly ABSOLUTE skin temperature (`skinTempC`) for nights the 21-night
+/// `analyzeRecent` rescore window never reaches.
+///
+/// `skinTempC` is written only by the scoring pass (`IntelligenceEngine`, #1663, 2026-08-27), which
+/// covers a rolling 21-night window. Nights already outside that window when the column shipped were
+/// never revisited, and nothing walks them since — so a night is missing its absolute if it fell
+/// outside every window that ran after 27 Aug, regardless of whether its raw `skinTempSample` rows
+/// are still on disk (they are: `skinTempSample` has no age-based retention).
+///
+/// This file holds the PURE, database-free half of the backfill: the session-attribution rule and the
+/// per-night plan. The walker that reads from / writes to `WhoopStore` lives in `Strand/Data`.
+///
+/// Three correctness rules (all re-review findings from the Android twin, #1852 — reproduced verbatim
+/// or the Swift backfill will be wrong in the same ways):
+///
+/// 1. **Attribute sessions by END.** The night window is 54 h wide (30 h before local midnight through
+///    the next), so it contains the PREVIOUS night as well. The engine's rule is
+///    `matched = allSessions.filter { tsInDay(it.end) }`; handing the funnel the whole window averages
+///    two nights into one temperature and stores it as the wrong day's.
+///
+/// 2. **Page the candidates.** A plain "oldest N" returns the same nights every pass, and the oldest
+///    are the ones most likely to have lost their raw samples — the sweep latches on page one and never
+///    reaches the newer nights that can fill.
+///
+/// 3. **The WHOOP 4.0 anchor comes from the CURRENT window.** It is learned window-wide, and the
+///    engine's note says that is safe because the offset "cancels in the deviation" — true for a delta,
+///    not for an absolute. A re-learned anchor puts backfilled nights on a different offset from the
+///    stored ones and the chart plots two scales as one line. **No anchor ⇒ decline, never the global
+///    default.**
+public enum SkinTempBackfill {
+
+    /// One night the backfill is considering: the day key, the night's read window (from/to in unix
+    /// seconds), and the device owner whose raw streams should be read. The walker builds these from
+    /// `DailyMetric` rows that have a `skinTempDevC` but no `skinTempC`; the pure plan below decides
+    /// which sessions and samples belong to each.
+    public struct NightCandidate: Equatable, Sendable {
+        public let day: String           // yyyy-MM-dd (local-day key, matching DailyMetric.day)
+        public let from: Int             // unix seconds: dayStart - StreamReadCap.lookbackSeconds
+        public let to: Int               // unix seconds: dayStart + 24h (or now for today)
+        public let owner: String         // the device id whose raw streams wrote this night
+        public init(day: String, from: Int, to: Int, owner: String) {
+            self.day = day; self.from = from; self.to = to; self.owner = owner
+        }
+    }
+
+    /// The result of attempting one night's backfill.
+    public struct NightResult: Equatable, Sendable {
+        public let day: String
+        /// The re-derived absolute (°C), or nil when the night declined (no anchor, too few worn
+        /// samples, no sessions, etc.). The walker writes `skinTempC` ONLY when this is non-nil.
+        public let skinTempC: Double?
+        /// Why the night declined, for the diagnostic report. nil when it filled.
+        public let declineReason: String?
+        public init(day: String, skinTempC: Double?, declineReason: String? = nil) {
+            self.day = day; self.skinTempC = skinTempC; self.declineReason = declineReason
+        }
+    }
+
+    /// Rule 1: attribute sessions by END timestamp. The night window is 54 h wide and contains the
+    /// PREVIOUS night as well, so handing the funnel every session in the window averages two nights
+    /// into one temperature. The engine's rule is `matched = allSessions.filter { tsInDay(it.end) }`:
+    /// a session belongs to `day` iff its END falls in `[dayStart, dayStart + 86400)`.
+    ///
+    /// `dayStart` is the LOCAL-midnight unix seconds for the day key (the same `dayStart` the engine's
+    /// per-day loop computes). `sessions` are the raw `SleepSession`s read from the 54 h window.
+    /// Pure + deterministic; the walker tests this directly.
+    public static func sessionsForDay(_ sessions: [SleepSession], dayStart: Int) -> [SleepSession] {
+        let dayEnd = dayStart + 86_400
+        return sessions.filter { $0.end >= dayStart && $0.end < dayEnd }
+    }
+
+    /// Rule 3: the WHOOP 4.0 anchor MUST come from the current scoring window. If no per-device anchor
+    /// could be learned (too few in-band samples), DECLINE the night — do NOT fall back to the global
+    /// 826 anchor. A re-learned anchor puts backfilled nights on a different offset from the stored
+    /// ones and the chart plots two scales as one line.
+    ///
+    /// Returns the anchor to use, or nil to decline. For a 5/MG (`.whoop5`) the anchor is always nil
+    /// and the night proceeds (centidegree path, no anchor).
+    public static func resolveAnchor(family: DeviceFamily, windowAnchorRaw: Double?) -> Double? {
+        switch family {
+        case .whoop4:
+            // No anchor ⇒ decline. The global 826 is NOT a fallback here (rule 3).
+            return windowAnchorRaw
+        case .whoop5:
+            // Centidegree path: no anchor, no decline on anchor grounds.
+            return nil
+        }
+    }
+
+    /// Compute one night's backfill absolute, applying all three rules. Pure + deterministic; the
+    /// walker supplies the raw inputs and writes the result.
+    ///
+    /// - Parameters:
+    ///   - candidate: the night to backfill (day, window, owner).
+    ///   - sessions: ALL sleep sessions in the 54 h window (the walker reads them once); rule 1
+    ///     filters to this day's by end timestamp.
+    ///   - hr: HR samples for the night's window.
+    ///   - skinTemp: raw skin-temp samples for the night's window.
+    ///   - family: the device family that wrote the owner's skin-temp rows (`.whoop4` vs `.whoop5`).
+    ///   - windowAnchorRaw: the per-device WHOOP 4.0 anchor learned from the CURRENT scoring window
+    ///     (rule 3). nil for a 5/MG or when the current window couldn't learn one.
+    ///   - dayStart: the LOCAL-midnight unix seconds for `candidate.day`.
+    ///   - wornToleranceSec: the worn-gate timestamp tolerance (0 for WHOOP, >0 for Oura).
+    /// - Returns: the nightly mean (°C) or nil with a decline reason.
+    public static func computeNight(
+        candidate: NightCandidate,
+        sessions: [SleepSession],
+        hr: [HRSample],
+        skinTemp: [SkinTempSample],
+        family: DeviceFamily,
+        windowAnchorRaw: Double?,
+        dayStart: Int,
+        wornToleranceSec: Int = 0
+    ) -> NightResult {
+        // Rule 1: attribute sessions by END. Don't hand the funnel the whole 54 h window.
+        let matched = sessionsForDay(sessions, dayStart: dayStart)
+        if matched.isEmpty {
+            return NightResult(day: candidate.day, skinTempC: nil,
+                               declineReason: "no sleep session ends on this day")
+        }
+        // Rule 3: the WHOOP 4.0 anchor comes from the current window. No anchor ⇒ decline.
+        let anchor = resolveAnchor(family: family, windowAnchorRaw: windowAnchorRaw)
+        if family == .whoop4 && anchor == nil {
+            return NightResult(day: candidate.day, skinTempC: nil,
+                               declineReason: "no per-device 4.0 anchor from the current window (rule 3: decline, not global fallback)")
+        }
+        // Run the SAME funnel the scoring pass uses — identical inputs, identical result, no second
+        // derivation that could disagree.
+        let diag = AnalyticsEngine.skinTempFunnel(
+            matched, hr: hr, skinTemp: skinTemp, family: family,
+            anchorRaw: anchor, wornToleranceSec: wornToleranceSec)
+        if let mean = diag.mean {
+            return NightResult(day: candidate.day, skinTempC: mean)
+        }
+        // Decline with the funnel's own explanation so the diagnostic report is self-attesting.
+        let reason = diag.kept < diag.minSamples
+            ? "only \(diag.kept)/\(diag.minSamples) worn samples"
+            : "funnel returned no mean"
+        return NightResult(day: candidate.day, skinTempC: nil, declineReason: reason)
+    }
+
+    /// Rule 2: page the candidates so the sweep doesn't latch on the oldest N (which are the most
+    /// likely to have lost their raw samples). Returns the candidates for one page, oldest-first
+    /// within the page. The walker calls this repeatedly with increasing `page` (0-based) until a page
+    /// comes back empty.
+    ///
+    /// `pageSize` caps the per-pass cost (one sleep-window sample read per night). The issue's open
+    /// question on cost is answered by keeping this modest (default 50) and letting the caller decide
+    /// how many pages to run.
+    public static func page(_ candidates: [NightCandidate], page: Int, pageSize: Int = 50) -> [NightCandidate] {
+        let start = page * pageSize
+        guard start < candidates.count else { return [] }
+        let end = min(start + pageSize, candidates.count)
+        return Array(candidates[start..<end])
+    }
+}
diff --git a/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift b/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift
index e3d980683b..45d9eac17a 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift
@@ -521,6 +521,23 @@ extension WhoopStore {
         }
     }
 
+    /// #1853: FILL-ONLY write of `skinTempC` for nights the backfill re-derived an absolute for.
+    /// Updates ONLY the `skinTempC` column of an existing row, and ONLY when that column is currently
+    /// NULL — never an upsert of a rebuilt row, never overwriting a measured value. A single-column
+    /// UPDATE is deliberate: the backfill must not touch `skinTempDevC` or any other scored field, and
+    /// a full-row upsert would risk clobbering a concurrent scoring pass's write. Returns rows filled.
+    @discardableResult
+    public func fillSkinTempC(deviceId: String, day: String, skinTempC: Double) async throws -> Int {
+        try syncWrite { db in
+            try db.execute(sql: """
+                UPDATE dailyMetric
+                SET skinTempC = ?
+                WHERE deviceId = ? AND day = ? AND skinTempC IS NULL
+                """, arguments: [skinTempC, deviceId, day])
+            return db.changesCount
+        }
+    }
+
     // MARK: - Reads
 
     /// Cached sleep sessions overlapping [from, to] (by startTs), oldest first.
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/DailySkinTempAbsoluteTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/DailySkinTempAbsoluteTests.swift
index 6a43ebdbdb..f6d9f884f3 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/DailySkinTempAbsoluteTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/DailySkinTempAbsoluteTests.swift
@@ -70,4 +70,58 @@ final class DailySkinTempAbsoluteTests: XCTestCase {
         XCTAssertEqual(try XCTUnwrap(rows.first?.skinTempC), 34.4, accuracy: 0.001,
                        "a re-score must be able to correct the stored absolute")
     }
+
+    // MARK: - #1853: fill-only write (`fillSkinTempC`)
+
+    /// The fill-only write fills a NULL `skinTempC` and touches NOTHING else — the deviation, recovery,
+    /// HRV, and every other scored field stay exactly as the scoring pass left them. This is the
+    /// non-negotiable: a single-column write that can only fill a NULL, never an upsert of a rebuilt row.
+    func testFillSkinTempC_fillsNullAndTouchesNothingElse() async throws {
+        let store = try await WhoopStore.inMemory()
+        // A scored night with a deviation but no absolute — the backfill's exact candidate.
+        let d = DailyMetric(day: "2026-08-14", totalSleepMin: 415, efficiency: 0.9,
+                            deepMin: 88, remMin: 108, lightMin: 219, disturbances: 2,
+                            restingHr: 50, avgHrv: 62.0, recovery: 0.06, strain: 10.5,
+                            exerciseCount: 1, spo2Pct: 96.2, skinTempDevC: 0.52, respRateBpm: 14.7,
+                            steps: 7_900, activeKcalEst: 2_180.0, avgSdnn: 88.4, skinTempC: nil)
+        try await store.upsertDailyMetrics([d], deviceId: "devA")
+
+        let filled = try await store.fillSkinTempC(deviceId: "devA", day: "2026-08-14", skinTempC: 34.6)
+        XCTAssertEqual(filled, 1, "exactly one row filled")
+
+        let rows = try await store.dailyMetrics(deviceId: "devA", from: "2026-08-14", to: "2026-08-14")
+        let row = try XCTUnwrap(rows.first)
+        XCTAssertEqual(try XCTUnwrap(row.skinTempC), 34.6, accuracy: 0.001, "the absolute was filled")
+        // Every other field is untouched — the fill-only write touched one column.
+        XCTAssertEqual(try XCTUnwrap(row.skinTempDevC), 0.52, accuracy: 0.001, "deviation untouched")
+        XCTAssertEqual(try XCTUnwrap(row.recovery), 0.06, accuracy: 0.001, "recovery untouched")
+        XCTAssertEqual(try XCTUnwrap(row.avgHrv), 62.0, accuracy: 0.001, "HRV untouched")
+        XCTAssertEqual(try XCTUnwrap(row.restingHr), 50, "resting HR untouched")
+        XCTAssertEqual(try XCTUnwrap(row.totalSleepMin), 415, accuracy: 0.001, "sleep untouched")
+    }
+
+    /// The fill-only write REFUSES to overwrite a measured value. A night that already has an absolute
+    /// is left alone — the backfill must never clobber a value the scoring pass stored.
+    func testFillSkinTempC_refusesToOverwriteAnExistingAbsolute() async throws {
+        let store = try await WhoopStore.inMemory()
+        let d = DailyMetric(day: "2026-08-14", totalSleepMin: 415, efficiency: 0.9,
+                            deepMin: 88, remMin: 108, lightMin: 219, disturbances: 2,
+                            restingHr: 50, avgHrv: 62.0, recovery: 0.06, strain: 10.5,
+                            exerciseCount: 1, skinTempDevC: 0.52, skinTempC: 33.9)
+        try await store.upsertDailyMetrics([d], deviceId: "devA")
+
+        let filled = try await store.fillSkinTempC(deviceId: "devA", day: "2026-08-14", skinTempC: 34.6)
+        XCTAssertEqual(filled, 0, "an existing absolute must NOT be overwritten")
+
+        let rows = try await store.dailyMetrics(deviceId: "devA", from: "2026-08-14", to: "2026-08-14")
+        XCTAssertEqual(try XCTUnwrap(rows.first?.skinTempC), 33.9, accuracy: 0.001,
+                       "the original measured value survives")
+    }
+
+    /// The fill-only write is a no-op when the row doesn't exist (no orphan rows created).
+    func testFillSkinTempC_noOpWhenRowDoesNotExist() async throws {
+        let store = try await WhoopStore.inMemory()
+        let filled = try await store.fillSkinTempC(deviceId: "devA", day: "2026-08-14", skinTempC: 34.6)
+        XCTAssertEqual(filled, 0, "no row to fill — no orphan created")
+    }
 }
diff --git a/Strand/Data/SkinTempBackfillWalker.swift b/Strand/Data/SkinTempBackfillWalker.swift
new file mode 100644
index 0000000000..55b5131783
--- /dev/null
+++ b/Strand/Data/SkinTempBackfillWalker.swift
@@ -0,0 +1,264 @@
+import Foundation
+import StrandAnalytics
+import WhoopStore
+import WhoopProtocol
+
+/// #1853: the Apple walker that backfills `skinTempC` for nights the 21-night `analyzeRecent` rescore
+/// window never reaches. The pure half (session attribution, the plan, rule 3) lives in
+/// `StrandAnalytics/SkinTempBackfill.swift`; this file is the I/O layer that reads from / writes to
+/// `WhoopStore`.
+///
+/// The walker mirrors the scoring pass's per-night reads (same window, same stream limits, same
+/// device-family / anchor / tolerance resolution) and calls the SAME `skinTempFunnel` the engine
+/// uses, so a backfilled absolute is byte-identical to what the scoring pass would have stored.
+///
+/// Trigger: ON-DEMAND from the Test Centre (the issue's "diagnostic first" + safest trigger). Doing
+/// it automatically on upgrade risks a long first launch on a deep history. The caller decides how
+/// many pages to run; one page is 50 nights by default.
+///
+/// Non-negotiable: a fill-only write (`WhoopStore.fillSkinTempC`) that can only fill a NULL, never an
+/// upsert of a rebuilt row. `skinTempDevC` and every other scored field are untouched.
+/// An `actor`, deliberately, not a `@MainActor` class. This walks up to ten pages of fifty nights and
+/// reads three streams for each, and while every `await` yields the main thread, each RESUMPTION and all
+/// the per-night work between them would land on it. There is no UI state here - the store is an actor,
+/// `DeviceRegistryStore` is a Sendable struct, and the result types are Sendable - so nothing needs the
+/// main actor, and a long diagnostic pass has no business competing with the UI for it.
+actor SkinTempBackfillWalker {
+
+    /// One night that filled — the day and the re-derived absolute.
+    struct FilledNight: Sendable {
+        let day: String
+        let skinTempC: Double
+    }
+
+    /// One night that declined — the day and the reason, for the diagnostic report.
+    struct DeclinedNight: Sendable {
+        let day: String
+        let reason: String
+    }
+
+    /// The result of one backfill pass (one or more pages).
+    struct PassResult: Sendable {
+        /// Nights that filled (day → absolute °C).
+        let filled: [FilledNight]
+        /// Nights that declined (day → reason), for the diagnostic report.
+        let declined: [DeclinedNight]
+        /// Nights skipped because no raw `skinTempSample` rows exist for the window (the data is gone,
+        /// not the backfill's fault — see the issue's "Diagnostic first" note).
+        let noRawData: [String]
+        /// Whether another page might yield more fills (false when the last page was empty).
+        let moreRemaining: Bool
+
+        var totalAttempted: Int { filled.count + declined.count + noRawData.count }
+    }
+
+    private let store: WhoopStore
+    private let computedId: String
+
+    init(store: WhoopStore) {
+        self.store = store
+        self.computedId = Repository.whoopSource + "-noop"
+    }
+
+    /// Run one page of the backfill. The caller calls this repeatedly with increasing `page` until
+    /// `moreRemaining` is false or a budget is reached.
+    ///
+    /// - Parameters:
+    ///   - page: 0-based page index (rule 2: page the candidates so the sweep doesn't latch on the
+    ///     oldest N).
+    ///   - pageSize: nights per page (default 50).
+    ///   - windowAnchorRaw: the per-device WHOOP 4.0 anchor learned from the CURRENT scoring window
+    ///     (rule 3). The caller obtains this from the same window-wide scan the scoring pass uses.
+    ///     nil for a 5/MG or when the current window couldn't learn one.
+    ///   - tzOffsetSeconds: seconds east of UTC, for local-day → unix-seconds conversion.
+    func runPage(page: Int, pageSize: Int = 50,
+                 windowAnchorRaw: Double?,
+                 tzOffsetSeconds: Int) async -> PassResult {
+        // 1. Find candidate nights: computed rows with a deviation but no absolute.
+        let candidates = await candidateNights()
+        let pageCandidates = SkinTempBackfill.page(candidates, page: page, pageSize: pageSize)
+        if pageCandidates.isEmpty {
+            return PassResult(filled: [], declined: [], noRawData: [], moreRemaining: false)
+        }
+
+        // 2. Resolve the device family + worn tolerance for the owner (single-owner install: the
+        //    canonical "my-whoop"). The registry is read once, mirroring the scoring pass.
+        let registry = DeviceRegistryStore(dbQueue: store.registryWriter)
+        let regDevices = (try? registry.all()) ?? []
+        let activeId = (try? registry.activeDeviceId()) ?? Repository.whoopSource
+
+        var filled: [FilledNight] = []
+        var declined: [DeclinedNight] = []
+        var noRawData: [String] = []
+
+        for candidate in pageCandidates {
+            // Resolve the day owner for this night (same resolver the scoring pass uses).
+            let owner = await IntelligenceEngine.resolveDayOwner(
+                day: candidate.day, from: candidate.from, to: candidate.to,
+                store: store, devices: regDevices, activeId: activeId,
+                registry: registry, fallbackDeviceId: Repository.whoopSource)
+
+            let family = IntelligenceEngine.skinTempFamily(forOwner: owner, devices: regDevices)
+            let tolerance = IntelligenceEngine.skinTempWornToleranceSec(forOwner: owner, devices: regDevices)
+
+            // Read the raw streams for this night's window — same limits the scoring pass uses.
+            let skin = (try? await store.skinTempSamples(
+                deviceId: owner, from: candidate.from, to: candidate.to,
+                limit: StreamReadCap.skin)) ?? []
+            if skin.isEmpty {
+                noRawData.append(candidate.day)
+                continue
+            }
+            let hr = (try? await store.hrSamples(
+                deviceId: owner, from: candidate.from, to: candidate.to,
+                limit: StreamReadCap.hr)) ?? []
+            // Read stored sleep sessions for the window (the backfill takes the night's stored sleep
+            // window, no re-detection — the issue's "take the night's stored sleep window from
+            // sleepSession").
+            let persisted = (try? await store.sleepSessions(
+                deviceId: owner, from: candidate.from, to: candidate.to,
+                limit: 4000)) ?? []
+            let sessions = persisted.compactMap { AnalyticsEngine.sleepSession(fromProvided: $0) }
+
+            // Compute the local-midnight unix seconds for this day (the day key is local, so the
+            // midnight is the UTC midnight of (dayStart + tzOffset)). The scoring pass uses the same
+            // shift: `dayString(ts, offsetSec:) == day` ⇔ `(ts + offsetSec) ∈ [dayStart, +86400)`.
+            let dayStart = Self.localMidnightUnix(forDay: candidate.day, tzOffsetSeconds: tzOffsetSeconds)
+
+            let result = SkinTempBackfill.computeNight(
+                candidate: candidate,
+                sessions: sessions,
+                hr: hr,
+                skinTemp: skin,
+                family: family,
+                windowAnchorRaw: windowAnchorRaw,
+                dayStart: dayStart,
+                wornToleranceSec: tolerance)
+
+            if let abs = result.skinTempC {
+                // Fill-only write: can only fill a NULL, never overwrite a measured value.
+                _ = try? await store.fillSkinTempC(deviceId: computedId, day: candidate.day, skinTempC: abs)
+                filled.append(FilledNight(day: candidate.day, skinTempC: abs))
+            } else {
+                declined.append(DeclinedNight(day: candidate.day, reason: result.declineReason ?? "unknown"))
+            }
+        }
+
+        let moreRemaining = pageCandidates.count == pageSize
+        return PassResult(filled: filled, declined: declined, noRawData: noRawData,
+                          moreRemaining: moreRemaining)
+    }
+
+    /// Find computed `DailyMetric` rows that have a `skinTempDevC` but no `skinTempC` — the nights
+    /// the backfill can fill. Oldest-first (the issue pages oldest→newest so the sweep reaches the
+    /// newer nights that can fill).
+    private func candidateNights() async -> [SkinTempBackfill.NightCandidate] {
+        // Read all computed rows (the backfill window is unbounded — the issue's "how far back" is
+        // every night with samples). A wide day range covers the full local-history span.
+        let rows = (try? await store.dailyMetrics(
+            deviceId: computedId, from: "0000-01-01", to: "9999-12-31")) ?? []
+        let tzOffset = TimeZone.current.secondsFromGMT()
+        let now = Int(Date().timeIntervalSince1970)
+        // Candidate: has a deviation (the night was scored) but no absolute (the column was null).
+        // Build the night's read window the same way the scoring pass does.
+        return rows
+            .filter { $0.skinTempDevC != nil && $0.skinTempC == nil }
+            .sorted { $0.day < $1.day }
+            .map { row in
+                let dayStart = Self.localMidnightUnix(forDay: row.day, tzOffsetSeconds: tzOffset)
+                let from = dayStart - StreamReadCap.lookbackSeconds
+                let to = min(dayStart + 86_400, now)  // don't read past now for today's partial night
+                return SkinTempBackfill.NightCandidate(day: row.day, from: from, to: to,
+                                                        owner: Repository.whoopSource)
+            }
+    }
+
+    /// Local-midnight unix seconds for a yyyy-MM-dd day key. The day key is LOCAL, so midnight is the
+    /// UTC midnight of `(dayStart + tzOffset)`: `dayString(ts, offsetSec:) == day` ⇔
+    /// `(ts + offsetSec) ∈ [dayStart, +86400)`, so `dayStart = utcMidnight(day) - tzOffset`.
+    static func localMidnightUnix(forDay day: String, tzOffsetSeconds: Int) -> Int {
+        // Parse the yyyy-MM-dd key to a UTC midnight, then shift by the tz offset to get local midnight.
+        let parts = day.split(separator: "-")
+        guard parts.count == 3,
+              let y = Int(parts[0]), let m = Int(parts[1]), let d = Int(parts[2]) else { return 0 }
+        var comps = DateComponents()
+        comps.year = y; comps.month = m; comps.day = d
+        comps.hour = 0; comps.minute = 0; comps.second = 0
+        comps.timeZone = TimeZone(identifier: "UTC")
+        let utcMidnight = Calendar(identifier: .gregorian).date(from: comps) ?? Date()
+        return Int(utcMidnight.timeIntervalSince1970) - tzOffsetSeconds
+    }
+
+    // MARK: - Self-contained entry point (the call site)
+
+    /// The aggregate result of a full backfill pass (one or more pages), for the Test Centre report.
+    struct BackfillResult: Sendable {
+        let filled: [FilledNight]
+        let declined: [DeclinedNight]
+        let noRawData: [String]
+        /// The window anchor that was used (nil for a 5/MG or when the current window couldn't learn one).
+        let windowAnchorRaw: Double?
+        /// Whether the pass reached the end (false when a page was empty) or hit the page budget.
+        let reachedEnd: Bool
+        var filledCount: Int { filled.count }
+        var declinedCount: Int { declined.count }
+        var noRawDataCount: Int { noRawData.count }
+    }
+
+    /// Run the full backfill: resolve the WHOOP 4.0 window anchor from the CURRENT scoring window
+    /// (rule 3 — the same window-wide scan the engine uses), then page through the candidate nights
+    /// until a page is empty or `maxPages` is reached. This is the single entry point the Test Centre
+    /// action calls; it owns the anchor scan so the call site does not duplicate engine internals.
+    ///
+    /// `maxDays` mirrors the scoring pass's window (default 21). `maxPages` caps the per-pass cost
+    /// (default 10 pages × 50 nights = 500 nights, plenty for any install).
+    func runBackfill(maxDays: Int = 21, maxPages: Int = 10) async -> BackfillResult {
+        let tzOffset = TimeZone.current.secondsFromGMT()
+        let now = Int(Date().timeIntervalSince1970)
+        let nowLocalMidnight = Self.localMidnightUnix(
+            forDay: Self.dayKey(now: now, tzOffsetSeconds: tzOffset), tzOffsetSeconds: tzOffset)
+        // Rule 3: the anchor comes from the CURRENT scoring window, learned window-wide (not per-night).
+        // Same window bounds the engine's `analyzeRecent` uses for `skinAnchorScanFrom`/`skinAnchorScanTo`.
+        let scanFrom = nowLocalMidnight - (maxDays - 1) * 86_400 - StreamReadCap.lookbackSeconds
+        let scanTo = nowLocalMidnight + 18 * 3_600
+        let registry = DeviceRegistryStore(dbQueue: store.registryWriter)
+        let activeId = (try? registry.activeDeviceId()) ?? Repository.whoopSource
+        let regDevices = (try? registry.all()) ?? []
+        let family = IntelligenceEngine.skinTempFamily(forOwner: activeId, devices: regDevices)
+        // Only a 4.0 needs the anchor; a 5/MG (centidegree path) passes nil and proceeds.
+        let windowAnchorRaw: Double?
+        if family == .whoop4 {
+            let windowSkin = (try? await store.skinTempSamples(
+                deviceId: activeId, from: scanFrom, to: scanTo,
+                limit: StreamReadCap.skin)) ?? []
+            windowAnchorRaw = Whoop4SkinTemp.deviceAnchorRaw(windowSkin.map { $0.raw })
+        } else {
+            windowAnchorRaw = nil
+        }
+        var filled: [FilledNight] = []
+        var declined: [DeclinedNight] = []
+        var noRawData: [String] = []
+        var reachedEnd = false
+        for page in 0..<maxPages {
+            let r = await runPage(page: page, windowAnchorRaw: windowAnchorRaw,
+                                  tzOffsetSeconds: tzOffset)
+            filled.append(contentsOf: r.filled)
+            declined.append(contentsOf: r.declined)
+            noRawData.append(contentsOf: r.noRawData)
+            if !r.moreRemaining {
+                reachedEnd = true
+                break
+            }
+        }
+        return BackfillResult(filled: filled, declined: declined, noRawData: noRawData,
+                              windowAnchorRaw: windowAnchorRaw, reachedEnd: reachedEnd)
+    }
+
+    /// Local-day key (yyyy-MM-dd) for a unix timestamp, matching the engine's `dayString(ts,offsetSec:)`.
+    private static func dayKey(now: Int, tzOffsetSeconds: Int) -> String {
+        let comps = Calendar(identifier: .gregorian).dateComponents(
+            [.year, .month, .day], from: Date(timeIntervalSince1970: TimeInterval(now + tzOffsetSeconds)))
+        let y = comps.year ?? 0, m = comps.month ?? 0, d = comps.day ?? 0
+        return String(format: "%04d-%02d-%02d", y, m, d)
+    }
+}
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 9f45660284..755687b563 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -210074,6 +210074,18 @@
         "ru": {"stringUnit": {"state": "translated", "value": "%lld из последних %lld ночей не записали ВСР. Проверьте, что ремешок надет ночью и синхронизируется."}},
         "zh-Hans": {"stringUnit": {"state": "translated", "value": "最近 %2$lld 晚中有 %1$lld 晚未记录 HRV。请检查夜间是否佩戴并已同步。"}},
         "zh-Hant": {"stringUnit": {"state": "translated", "value": "最近 %2$lld 晚中有 %1$lld 晚未記錄 HRV。請檢查夜間是否配戴並已同步。"}}
+    } },
+    "Re-derives the absolute °C for nights the 21-night rescore window never reaches, using the same funnel as the scoring pass. Fill-only: it never overwrites a measured value. Watch the strap log for the result.": { "localizations": {
+        "de": {"stringUnit": {"state": "translated", "value": "Leitet das absolute °C für Nächte neu ab, die das 21-Nächte-Fenster nie erreicht, mit demselben Funnel wie der Scoring-Durchlauf. Nur Auffüllen: ein gemessener Wert wird nie überschrieben. Das Ergebnis steht im Strap-Log."}},
+        "en": {"stringUnit": {"state": "translated", "value": "Re-derives the absolute °C for nights the 21-night rescore window never reaches, using the same funnel as the scoring pass. Fill-only: it never overwrites a measured value. Watch the strap log for the result."}},
+        "es": {"stringUnit": {"state": "translated", "value": "Vuelve a derivar el °C absoluto de las noches que la ventana de 21 noches nunca alcanza, con el mismo embudo que la pasada de puntuación. Solo rellena: nunca sobrescribe un valor medido. Consulta el resultado en el registro de la banda."}},
+        "fr": {"stringUnit": {"state": "translated", "value": "Recalcule le °C absolu des nuits que la fenêtre de 21 nuits n’atteint jamais, avec le même entonnoir que la passe de calcul. Remplissage seul : une valeur mesurée n’est jamais écrasée. Le résultat s’affiche dans le journal du bracelet."}},
+        "it": {"stringUnit": {"state": "translated", "value": "Ricalcola il °C assoluto per le notti che la finestra di 21 notti non raggiunge mai, con lo stesso funnel della passata di calcolo. Solo riempimento: non sovrascrive mai un valore misurato. Il risultato è nel log della fascia."}},
+        "pl": {"stringUnit": {"state": "translated", "value": "Ponownie wylicza bezwzględne °C dla nocy, których nie obejmuje okno 21 nocy, tym samym lejkiem co przebieg oceniający. Tylko uzupełnia: nigdy nie nadpisuje zmierzonej wartości. Wynik znajdziesz w dzienniku opaski."}},
+        "pt-PT": {"stringUnit": {"state": "translated", "value": "Volta a derivar o °C absoluto das noites que a janela de 21 noites nunca alcança, com o mesmo funil da passagem de pontuação. Apenas preenche: nunca substitui um valor medido. Vê o resultado no registo da fita."}},
+        "ru": {"stringUnit": {"state": "translated", "value": "Пересчитывает абсолютные °C для ночей, до которых не доходит окно в 21 ночь, тем же алгоритмом, что и обычный расчёт. Только заполняет: измеренное значение никогда не перезаписывается. Результат смотрите в журнале ремешка."}},
+        "zh-Hans": {"stringUnit": {"state": "translated", "value": "用与评分流程相同的漏斗，为 21 晚窗口未覆盖的夜晚重新推导绝对温度（°C）。仅填充：绝不覆盖已测量的值。结果见腕带日志。"}},
+        "zh-Hant": {"stringUnit": {"state": "translated", "value": "以與評分流程相同的漏斗，為 21 晚視窗未涵蓋的夜晚重新推導絕對溫度（°C）。僅填充：絕不覆寫已測量的值。結果見腕帶日誌。"}}
     } }
   },
   "version": "1.0"
diff --git a/Strand/Screens/TestCentreView.swift b/Strand/Screens/TestCentreView.swift
index 941ee50d07..8699f38446 100644
--- a/Strand/Screens/TestCentreView.swift
+++ b/Strand/Screens/TestCentreView.swift
@@ -30,6 +30,11 @@ struct TestCentreView: View {
     @State private var infoMessage = ""
     @State private var showInfo = false
 
+    // #1853: skin-temp absolute backfill (on-demand, diagnostic-first). Runs the walker that fills
+    // `skinTempC` for nights outside the 21-night rescore window. In-progress flag + last result line.
+    @State private var skinTempBackfillRunning = false
+    @State private var skinTempBackfillStatus: String?
+
     // Section 3: scheduled daily auto-export, the same ScheduledDebugExport store the Settings card uses.
     @State private var debugExportOn = ScheduledDebugExport.isEnabled
     @State private var debugExportMinutes = ScheduledDebugExport.timeMinutes
@@ -277,6 +282,25 @@ struct TestCentreView: View {
 
                 Divider().overlay(StrandPalette.hairline)
 
+                // #1853: skin-temp absolute backfill (on-demand, diagnostic-first). Fills `skinTempC`
+                // for nights outside the 21-night rescore window that never got an absolute. Fill-only:
+                // it can only fill a NULL, never overwrite a measured value or touch the deviation.
+                NoopButton("Backfill skin-temp absolutes", systemImage: "thermometer.medium",
+                           kind: .secondary) {
+                    runSkinTempBackfill()
+                }
+                .disabled(skinTempBackfillRunning)
+                Text("Re-derives the absolute °C for nights the 21-night rescore window never reaches, using the same funnel as the scoring pass. Fill-only: it never overwrites a measured value. Watch the strap log for the result.")
+                    .font(StrandFont.caption).foregroundStyle(StrandPalette.textTertiary)
+                    .fixedSize(horizontal: false, vertical: true)
+                if let status = skinTempBackfillStatus {
+                    Text(status)
+                        .font(StrandFont.caption).foregroundStyle(StrandPalette.textSecondary)
+                        .fixedSize(horizontal: false, vertical: true)
+                }
+
+                Divider().overlay(StrandPalette.hairline)
+
                 // Environment dump: the IOSDiagnostics-backed block exportableLogText already carries,
                 // surfaced as a copyable readout (spec section 3.4).
                 NoopButton("Copy environment dump", systemImage: "info.circle", kind: .secondary) {
@@ -522,6 +546,37 @@ struct TestCentreView: View {
         showInfo = true
     }
 
+    /// #1853: run the skin-temp absolute backfill on demand (diagnostic-first trigger). The walker
+    /// resolves the WHOOP 4.0 window anchor from the current scoring window, pages through the
+    /// candidate nights, and fills each NULL `skinTempC`. The result is logged to the strap log and
+    /// shown under the button so the user sees exactly what filled, declined, and had no raw data.
+    private func runSkinTempBackfill() {
+        guard !skinTempBackfillRunning else { return }
+        skinTempBackfillRunning = true
+        skinTempBackfillStatus = String(localized: "Backfilling…")
+        Task { @MainActor in
+            guard let store = await model.repo.storeHandle() else {
+                skinTempBackfillStatus = String(localized: "No on-device store yet.")
+                skinTempBackfillRunning = false
+                return
+            }
+            let walker = SkinTempBackfillWalker(store: store)
+            let result = await walker.runBackfill()
+            let anchorNote = result.windowAnchorRaw != nil
+                ? "anchor from current window"
+                : "no 4.0 anchor (5/MG or too few worn samples)"
+            let endNote = result.reachedEnd ? "reached end" : "hit page budget"
+            let line = "skin-temp backfill (#1853): filled \(result.filledCount), " +
+                       "declined \(result.declinedCount), no raw data \(result.noRawDataCount) " +
+                       "(\(anchorNote), \(endNote))"
+            live.append(log: line)
+            skinTempBackfillStatus = line
+            skinTempBackfillRunning = false
+            // Refresh so the newly-filled absolutes show in the charts/explorer.
+            await model.repo.refresh()
+        }
+    }
+
     private var debugExportTimeBinding: Binding<Date> {
         Binding(
             get: {
diff --git a/StrandTests/SkinTempBackfillTests.swift b/StrandTests/SkinTempBackfillTests.swift
new file mode 100644
index 0000000000..09ed34925c
--- /dev/null
+++ b/StrandTests/SkinTempBackfillTests.swift
@@ -0,0 +1,229 @@
+import XCTest
+import StrandAnalytics
+import WhoopProtocol
+
+/// #1853: tests for the PURE half of the skin-temp absolute backfill — the session-attribution rule
+/// (rule 1), the anchor rule (rule 3), and the pagination rule (rule 2). The I/O walker that reads
+/// from / writes to `WhoopStore` is covered separately.
+final class SkinTempBackfillTests: XCTestCase {
+
+    // MARK: Rule 1 — attribute sessions by END
+
+    /// A session whose END falls in the day is matched; one whose END falls in the previous day is not.
+    /// The night window is 54 h wide and contains the previous night, so filtering by end is the only
+    /// thing that keeps two nights from being averaged into one temperature.
+    func testSessionsForDay_matchesByEndNotStart() {
+        // dayStart = 2026-08-25 00:00 UTC = 1_789_632_000
+        let dayStart = 1_789_632_000
+        let prevNightEnd = dayStart - 3_600           // 23:00 the PREVIOUS day → NOT matched
+        let thisNightEnd = dayStart + 7 * 3_600       // 07:00 this day → matched
+        let nextNightEnd = dayStart + 86_400 + 3_600  // 01:00 NEXT day → NOT matched
+        let sessions = [
+            SleepSession(start: dayStart - 8 * 3_600, end: prevNightEnd, efficiency: 0.9,
+                         stages: [], restingHR: nil, avgHRV: nil, hrOnly: false),
+            SleepSession(start: dayStart - 1 * 3_600, end: thisNightEnd, efficiency: 0.9,
+                         stages: [], restingHR: nil, avgHRV: nil, hrOnly: false),
+            SleepSession(start: dayStart + 20 * 3_600, end: nextNightEnd, efficiency: 0.9,
+                         stages: [], restingHR: nil, avgHRV: nil, hrOnly: false),
+        ]
+        let matched = SkinTempBackfill.sessionsForDay(sessions, dayStart: dayStart)
+        XCTAssertEqual(matched.count, 1)
+        XCTAssertEqual(matched.first?.end, thisNightEnd)
+    }
+
+    /// A session ending exactly at midnight (dayStart) is matched (>= dayStart).
+    func testSessionsForDay_inclusiveAtDayStart() {
+        let dayStart = 1_789_632_000
+        let sessions = [
+            SleepSession(start: dayStart - 8 * 3_600, end: dayStart, efficiency: 0.9,
+                         stages: [], restingHR: nil, avgHRV: nil, hrOnly: false),
+        ]
+        XCTAssertEqual(SkinTempBackfill.sessionsForDay(sessions, dayStart: dayStart).count, 1)
+    }
+
+    /// A session ending exactly at next midnight (dayStart + 86400) is NOT matched (< dayEnd).
+    func testSessionsForDay_exclusiveAtDayEnd() {
+        let dayStart = 1_789_632_000
+        let sessions = [
+            SleepSession(start: dayStart + 12 * 3_600, end: dayStart + 86_400, efficiency: 0.9,
+                         stages: [], restingHR: nil, avgHRV: nil, hrOnly: false),
+        ]
+        XCTAssertEqual(SkinTempBackfill.sessionsForDay(sessions, dayStart: dayStart).count, 0)
+    }
+
+    /// Empty sessions → empty match (the night declines with "no sleep session ends on this day").
+    func testSessionsForDay_emptySessionsReturnsEmpty() {
+        XCTAssertEqual(SkinTempBackfill.sessionsForDay([], dayStart: 0).count, 0)
+    }
+
+    // MARK: Rule 3 — the WHOOP 4.0 anchor comes from the current window
+
+    /// A WHOOP 4.0 with a per-device anchor from the current window uses it.
+    func testResolveAnchor_whoop4WithAnchorReturnsIt() {
+        let anchor = SkinTempBackfill.resolveAnchor(family: .whoop4, windowAnchorRaw: 1290.0)
+        XCTAssertEqual(anchor, 1290.0)
+    }
+
+    /// A WHOOP 4.0 with NO per-device anchor returns nil → the night DECLINES. The global 826 is NOT
+    /// a fallback here — a re-learned anchor puts backfilled nights on a different offset from the
+    /// stored ones and the chart plots two scales as one line.
+    func testResolveAnchor_whoop4WithoutAnchorDeclines() {
+        let anchor = SkinTempBackfill.resolveAnchor(family: .whoop4, windowAnchorRaw: nil)
+        XCTAssertNil(anchor, "rule 3: no anchor ⇒ decline, never the global default")
+    }
+
+    /// A WHOOP 5/MG always returns nil anchor (centidegree path, no anchor) — and does NOT decline on
+    /// anchor grounds (the decline check in `computeNight` is `family == .whoop4 && anchor == nil`).
+    func testResolveAnchor_whoop5ReturnsNilButDoesNotDecline() {
+        let anchor = SkinTempBackfill.resolveAnchor(family: .whoop5, windowAnchorRaw: nil)
+        XCTAssertNil(anchor)
+        // The computeNight test below confirms a 5/MG night proceeds without an anchor.
+    }
+
+    // MARK: computeNight — the full per-night plan
+
+    /// A 5/MG night with enough worn samples fills. The centidegree path needs no anchor.
+    func testComputeNight_whoop5WithEnoughSamplesFills() {
+        let dayStart = 1_789_632_000
+        let candidate = SkinTempBackfill.NightCandidate(
+            day: "2026-08-25", from: dayStart - 30 * 3_600, to: dayStart + 24 * 3_600, owner: "my-whoop")
+        // A session ending in this day.
+        let sessions = [
+            SleepSession(start: dayStart - 1 * 3_600, end: dayStart + 7 * 3_600, efficiency: 0.9,
+                         stages: [], restingHR: nil, avgHRV: nil, hrOnly: false),
+        ]
+        // 400 worn skin-temp samples (3057 raw = 30.57 °C on 5/MG) at 1 Hz, with matching HR.
+        let skinTemp = (0..<400).map { i in
+            SkinTempSample(ts: dayStart - 1 * 3_600 + i, raw: 3057)
+        }
+        let hr = (0..<400).map { i in HRSample(ts: dayStart - 1 * 3_600 + i, bpm: 60) }
+        let result = SkinTempBackfill.computeNight(
+            candidate: candidate, sessions: sessions, hr: hr, skinTemp: skinTemp,
+            family: .whoop5, windowAnchorRaw: nil, dayStart: dayStart)
+        XCTAssertNotNil(result.skinTempC)
+        XCTAssertEqual(result.skinTempC!, 30.57, accuracy: 0.01)
+        XCTAssertNil(result.declineReason)
+    }
+
+    /// A WHOOP 4.0 night with no per-device anchor DECLINES (rule 3). Even with enough samples the
+    /// night is not filled — the global 826 is NOT a fallback.
+    func testComputeNight_whoop4WithoutAnchorDeclines() {
+        let dayStart = 1_789_632_000
+        let candidate = SkinTempBackfill.NightCandidate(
+            day: "2026-08-25", from: dayStart - 30 * 3_600, to: dayStart + 24 * 3_600, owner: "my-whoop")
+        let sessions = [
+            SleepSession(start: dayStart - 1 * 3_600, end: dayStart + 7 * 3_600, efficiency: 0.9,
+                         stages: [], restingHR: nil, avgHRV: nil, hrOnly: false),
+        ]
+        // Enough samples to fill IF the anchor were allowed — but rule 3 declines before the funnel.
+        let skinTemp = (0..<400).map { i in
+            SkinTempSample(ts: dayStart - 1 * 3_600 + i, raw: 826)
+        }
+        let hr = (0..<400).map { i in HRSample(ts: dayStart - 1 * 3_600 + i, bpm: 60) }
+        let result = SkinTempBackfill.computeNight(
+            candidate: candidate, sessions: sessions, hr: hr, skinTemp: skinTemp,
+            family: .whoop4, windowAnchorRaw: nil, dayStart: dayStart)
+        XCTAssertNil(result.skinTempC, "rule 3: no anchor ⇒ decline, never the global default")
+        XCTAssertNotNil(result.declineReason)
+        XCTAssertTrue(result.declineReason!.contains("anchor"), "decline reason names the anchor")
+    }
+
+    /// A night with no sessions ending on the day declines.
+    func testComputeNight_noSessionsDeclines() {
+        let dayStart = 1_789_632_000
+        let candidate = SkinTempBackfill.NightCandidate(
+            day: "2026-08-25", from: dayStart - 30 * 3_600, to: dayStart + 24 * 3_600, owner: "my-whoop")
+        let result = SkinTempBackfill.computeNight(
+            candidate: candidate, sessions: [], hr: [], skinTemp: [],
+            family: .whoop5, windowAnchorRaw: nil, dayStart: dayStart)
+        XCTAssertNil(result.skinTempC)
+        XCTAssertEqual(result.declineReason, "no sleep session ends on this day")
+    }
+
+    /// A night with too few worn samples (< minSkinTempSamples = 300) declines.
+    func testComputeNight_tooFewSamplesDeclines() {
+        let dayStart = 1_789_632_000
+        let candidate = SkinTempBackfill.NightCandidate(
+            day: "2026-08-25", from: dayStart - 30 * 3_600, to: dayStart + 24 * 3_600, owner: "my-whoop")
+        let sessions = [
+            SleepSession(start: dayStart - 1 * 3_600, end: dayStart + 7 * 3_600, efficiency: 0.9,
+                         stages: [], restingHR: nil, avgHRV: nil, hrOnly: false),
+        ]
+        // Only 100 samples — below the 300 floor.
+        let skinTemp = (0..<100).map { i in
+            SkinTempSample(ts: dayStart - 1 * 3_600 + i, raw: 3057)
+        }
+        let hr = (0..<100).map { i in HRSample(ts: dayStart - 1 * 3_600 + i, bpm: 60) }
+        let result = SkinTempBackfill.computeNight(
+            candidate: candidate, sessions: sessions, hr: hr, skinTemp: skinTemp,
+            family: .whoop5, windowAnchorRaw: nil, dayStart: dayStart)
+        XCTAssertNil(result.skinTempC)
+        XCTAssertNotNil(result.declineReason)
+        XCTAssertTrue(result.declineReason!.contains("worn samples"), "decline reason names the sample floor")
+    }
+
+    /// A night whose sessions END in the PREVIOUS day is not matched (rule 1), even if the session
+    /// span overlaps this day's window. This is the exact bug rule 1 prevents: two nights averaged
+    /// into one temperature.
+    func testComputeNight_previousNightSessionNotMatched() {
+        let dayStart = 1_789_632_000
+        let candidate = SkinTempBackfill.NightCandidate(
+            day: "2026-08-25", from: dayStart - 30 * 3_600, to: dayStart + 24 * 3_600, owner: "my-whoop")
+        // A session that ends in the PREVIOUS day (23:00 on Aug 24) but whose span overlaps this day's
+        // 54 h window. Without rule 1 this would be matched and the night would fill.
+        let sessions = [
+            SleepSession(start: dayStart - 9 * 3_600, end: dayStart - 1 * 3_600, efficiency: 0.9,
+                         stages: [], restingHR: nil, avgHRV: nil, hrOnly: false),
+        ]
+        let skinTemp = (0..<400).map { i in
+            SkinTempSample(ts: dayStart - 9 * 3_600 + i, raw: 3057)
+        }
+        let hr = (0..<400).map { i in HRSample(ts: dayStart - 9 * 3_600 + i, bpm: 60) }
+        let result = SkinTempBackfill.computeNight(
+            candidate: candidate, sessions: sessions, hr: hr, skinTemp: skinTemp,
+            family: .whoop5, windowAnchorRaw: nil, dayStart: dayStart)
+        XCTAssertNil(result.skinTempC, "rule 1: a session ending in the previous day is not this day's")
+        XCTAssertEqual(result.declineReason, "no sleep session ends on this day")
+    }
+
+    // MARK: Rule 2 — page the candidates
+
+    /// Page 0 returns the first `pageSize` candidates, oldest-first.
+    func testPage_firstPageReturnsOldestN() {
+        let candidates = (0..<120).map { i in
+            SkinTempBackfill.NightCandidate(day: "2026-08-\(String(format: "%02d", i + 1))",
+                                             from: 0, to: 0, owner: "my-whoop")
+        }
+        let page0 = SkinTempBackfill.page(candidates, page: 0, pageSize: 50)
+        XCTAssertEqual(page0.count, 50)
+        XCTAssertEqual(page0.first?.day, "2026-08-01")
+        XCTAssertEqual(page0.last?.day, "2026-08-50")
+    }
+
+    /// Page 2 returns the next chunk; page 3 is empty (only 120 candidates, 50 per page → 3 pages).
+    func testPage_thirdPageEmpty() {
+        let candidates = (0..<120).map { i in
+            SkinTempBackfill.NightCandidate(day: "2026-08-\(String(format: "%02d", i + 1))",
+                                             from: 0, to: 0, owner: "my-whoop")
+        }
+        let page2 = SkinTempBackfill.page(candidates, page: 2, pageSize: 50)
+        XCTAssertEqual(page2.count, 20)
+        let page3 = SkinTempBackfill.page(candidates, page: 3, pageSize: 50)
+        XCTAssertTrue(page3.isEmpty, "page 3 is empty — the walker stops here")
+    }
+
+    /// An empty candidate list returns an empty page on every page.
+    func testPage_emptyCandidatesReturnsEmpty() {
+        XCTAssertTrue(SkinTempBackfill.page([], page: 0).isEmpty)
+    }
+
+    /// A partial last page returns exactly the remainder.
+    func testPage_partialLastPage() {
+        let candidates = (0..<75).map { i in
+            SkinTempBackfill.NightCandidate(day: "2026-08-\(String(format: "%02d", i + 1))",
+                                             from: 0, to: 0, owner: "my-whoop")
+        }
+        let page1 = SkinTempBackfill.page(candidates, page: 1, pageSize: 50)
+        XCTAssertEqual(page1.count, 25)
+    }
+}

From f77fc65c2ce05d4aca11e7967af1bfa8d2d47a1f Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 23:08:36 +1200
Subject: [PATCH 286/333] storage: bound ppgWaveformSample with rolling
 newest-N retention

Item 3 of #1911. ppgWaveformSample was the only unbounded blob table in the
store, and carries by far the largest per-row cost of any decoded stream:
~120 B/row (a 48 B packed-i16 blob for 24 samples, plus row and PK-index
overhead) against ~30 B for a scalar row.

Caps it at 604,800 newest rows per device, swept amortised on insert every
10,000 banked rows, mirroring v18AuxSample on both platforms: own per-device
counter, own best-effort sweep, cancellation rethrown on Android. No schema
change, so no migration and no version bump. One write path per platform, so
the cap cannot be bypassed; a .noopbak restore is a whole-file copy and is not
pruned on the way in.

A NEWEST-N ROW CAP, NOT THE AGE-BASED DROP THE ISSUE ASKED FOR. #1911 item 3
proposes deleting after the 7-day hot window, calling the waveform
"diagnostic-only". The migration note on the table is the authority and says
otherwise: these rows are kept so a better estimator, HRV-from-PPG, or a
waveform viewer can later run over the ORIGINAL samples rather than the derived
bpm. Deleting by wall-clock age would empty the table for exactly the user such
an estimator needs most, a sporadic wearer whose v26 seconds are spread thin
over months, and a waveform has no aggregate that survives it. Newest-N bounds
the bytes while always leaving a full working set, the same trade v18AuxSample
already makes.

Scale, so the ceiling is not overstated: this is the worst ROW, not the biggest
table. v26 runs only in optical windows, ~28,800 rows/day, where rrInterval
banks ~100,000/day and stays the higher-volume table by bytes. The cap is ~70 MB
per device and holds about three weeks of typical wear.

What the cap does not guarantee: the amortised sweep is the only thing enforcing
retention here, and its budget counter is in-memory, so process death resets it.
A store never banking 10,000 waveform rows in one process lifetime never sweeps.
Not the normal shape, since one night's offload banks ~28,800, but real for a
store fed short bursts between app kills. v18AuxPruneEveryRows has the identical
property; a sweep forced once per session would remove it for both tables.

Also corrects three stale "unbounded / not pruned" claims about this table (the
GRDB migration note, the Room entity doc and migration note, the NoopLocalAccess
storage readout), since that readout's own comment warns that "which tables are
already bounded" is the first thing a retention design reads off.

Tests: seven Swift cases and five Kotlin, twinned. One Swift case came out of
mutation-testing the statement, where removing the outer deviceId filter from
the DELETE passed every other test and is silent cross-device data loss on a
multi-strap install. The Kotlin twin drives a Proxy DAO and never executes the
SQL; its retention block says so and points at the Swift test as the oracle.
---
 .../NoopLocalAccessCore/LocalAccessCore.swift |  22 +--
 .../Sources/WhoopStore/Database.swift         |  20 ++-
 .../Sources/WhoopStore/StreamStore.swift      |  81 ++++++++++-
 .../Sources/WhoopStore/WhoopStore.swift       |   6 +
 .../PpgWaveformSampleTests.swift              | 131 ++++++++++++++++++
 .../src/main/java/com/noop/data/Entities.kt   |   7 +
 .../src/main/java/com/noop/data/WhoopDao.kt   |  13 ++
 .../main/java/com/noop/data/WhoopDatabase.kt  |   6 +
 .../java/com/noop/data/WhoopRepository.kt     |  72 ++++++++++
 .../com/noop/data/PpgWaveformMigrationTest.kt | 113 +++++++++++++++
 10 files changed, 453 insertions(+), 18 deletions(-)

diff --git a/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/LocalAccessCore.swift b/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/LocalAccessCore.swift
index 50458dc9d0..db34c46f3d 100644
--- a/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/LocalAccessCore.swift
+++ b/Packages/NoopLocalAccess/Sources/NoopLocalAccessCore/LocalAccessCore.swift
@@ -323,17 +323,19 @@ public final class ReadonlyNoopStore {
         try dbQueue.read { db in
             // Every durable decoded per-second table. The four below the first line were landed as
             // instrumentation and then left OUT of this count, which is how an unbounded, unpruned table
-            // became invisible: `ppgWaveformSample` banks a ~48-byte BLOB per v26 strap-second and is NOT
-            // pruned (deliberately — this is decoded biometric history, not the transient raw outbox), and
-            // until it was counted it did not show up in the only readout a user has for "what is the
-            // store spending space on". Growth that nothing reads still has to be growth somebody can SEE.
+            // became invisible: `ppgWaveformSample` banks a ~48-byte BLOB per v26 strap-second, and until
+            // it was counted it did not show up in the only readout a user has for "what is the store
+            // spending space on". Growth that nothing reads still has to be growth somebody can SEE.
             //
-            // `v18AuxSample` used to be named here as unpruned too. It is not, and has not been since the
-            // rolling retention landed (`WhoopStore.v18AuxRetentionRows` / `v18AuxPruneEveryRows`, Room
-            // migration v31, covered by `DeepCaptureChannelsTests`): ~604 800 rows, about seven days. The
-            // correction matters because #1911 is designing retention, and "which tables are already
-            // bounded" is the first thing such a design reads off — getting it wrong here would have it
-            // solving a problem twice, or trusting a bound that was never there.
+            // BOTH blob tables are now bounded, and neither claim below is safe to let go stale, because
+            // "which tables are already bounded" is the first thing a retention design reads off — getting
+            // it wrong has such a design solving a problem twice, or trusting a bound that was never
+            // there. `v18AuxSample`: rolling retention since `WhoopStore.v18AuxRetentionRows` /
+            // `v18AuxPruneEveryRows` (Room migration v31, covered by `DeepCaptureChannelsTests`).
+            // `ppgWaveformSample`: rolling retention since #1911 (`WhoopStore.ppgWaveformRetentionRows` /
+            // `ppgWaveformPruneEveryRows`, covered by `PpgWaveformSampleTests`). Both keep ~604,800 NEWEST
+            // rows per device — a row cap, NOT an age cutoff, so a sporadic wearer keeps a full working
+            // set. Every other decoded per-second table listed here is still genuinely unpruned.
             //
             // This list is a DELIBERATE fourth copy, not drift. The other three (`WhoopStore.rawTableKeys`,
             // the footprint total and the timestamp heal) now share one list; this module cannot, because
diff --git a/Packages/WhoopStore/Sources/WhoopStore/Database.swift b/Packages/WhoopStore/Sources/WhoopStore/Database.swift
index 298b078e60..21a049c2d6 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/Database.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/Database.swift
@@ -538,12 +538,20 @@ extension WhoopStore {
         // That keeps a v26-heavy night to roughly the same order of magnitude as ONE extra per-second
         // stream (≈50 bytes/row), not 24x that. Additive only, a NEW table, no existing row touched.
         //
-        // Retention: no pruning, matching every other durable per-second table (hrSample, spo2Sample, …
-        // are never pruned either) — this is decoded biometric history, not the transient raw outbox.
-        // `PrunePolicy`'s ~50 MB cap governs ONLY `rawBatch` (raw, pre-decode frames kept for re-decode /
-        // re-sync); it is untouched by and unrelated to this table. Growth here is bounded by how much
-        // v26 data a strap actually emits (firmware chooses v26 vs v18 per second, not every night is
-        // v26-heavy), not by an artificial cap.
+        // Retention: CAPPED at `WhoopStore.ppgWaveformRetentionRows` newest rows per device (#1911), swept
+        // amortised on insert exactly like `v18AuxSample`. This table is the ONE exception to "no durable
+        // per-second table is pruned" (hrSample, spo2Sample, … are still never pruned), because it is the
+        // only one storing a blob rather than a scalar: ~120 B/row against ~30 B. It is the worst ROW, not
+        // the biggest table — v26 runs only in optical windows (~28,800 rows/day) where `rrInterval` banks
+        // ~100,000/day, so most of #1911's ~93 MB/day is still unbounded elsewhere. `PrunePolicy`'s
+        // ~50 MB cap governs ONLY `rawBatch` (raw, pre-decode frames kept for re-decode / re-sync); it is
+        // untouched by and unrelated to this table.
+        //
+        // The cap is NEWEST-N-ROWS, not an age-based drop, and that distinction is load-bearing for the
+        // consumer note below: a sporadic wearer's v26 seconds are spread thin over months, so deleting by
+        // wall-clock age would empty the table for exactly the user a future estimator needs most, while
+        // newest-N always leaves a full working set. See `ppgWaveformRetentionRows` for the byte maths and
+        // for why #1911's "diagnostic-only, drop after the hot window" framing was not followed.
         //
         // CONSUMER STATUS — deliberately none, and stated here so nobody has to re-derive it. The writer is
         // live on both platforms (offload + archive replay + the Android capture importer), but the reader
diff --git a/Packages/WhoopStore/Sources/WhoopStore/StreamStore.swift b/Packages/WhoopStore/Sources/WhoopStore/StreamStore.swift
index 7788675301..eacc9f463f 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/StreamStore.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/StreamStore.swift
@@ -58,6 +58,53 @@ extension WhoopStore {
         return out
     }
 
+    /// Rolling retention for the v27 PPG waveform table (twin of Kotlin `PPG_WAVEFORM_RETENTION_ROWS`),
+    /// added for #1911. This table was previously the only UNBOUNDED blob table, and it carries by far the
+    /// largest PER-ROW cost of any decoded stream: ~120 B against ~30 B for a scalar row.
+    ///
+    /// It is NOT the store's fastest-growing table, and this note must not be read as saying so. v26 runs
+    /// only in optical windows, roughly 28,800 rows/day by #1911's own figures, where `rrInterval` banks
+    /// ~100,000/day and remains the higher-volume table by bytes. Capping this one bounds the worst row,
+    /// not the bulk of #1911's ~93 MB/day.
+    ///
+    /// **A NEWEST-N-ROWS CAP, DELIBERATELY NOT A TIME-WINDOW DROP.** #1911 proposes "dropped after the hot
+    /// window", justifying it as "diagnostic-only". That justification is wrong, and the migration note on
+    /// `ppgWaveformSample` in `Database.swift` is the authority: these rows are kept precisely so a better
+    /// estimator, HRV-from-PPG, or a waveform viewer can later run over the ORIGINAL samples rather than
+    /// the derived bpm. Deleting by wall-clock age would empty the table for exactly the user a future
+    /// estimator needs most — a sporadic wearer, whose v26 seconds are spread thin over months — and a
+    /// waveform, unlike an HR series, has no aggregate that survives it. Newest-N instead bounds the bytes
+    /// while ALWAYS leaving a full working set to analyse, which is the same trade `v18AuxRetentionRows`
+    /// below makes for the same reason.
+    ///
+    /// 604,800 = 7 × 86,400, matching the aux cap's "a week of strap-seconds" semantic and #1911's own
+    /// 7-day hot window. The ceiling is larger than the aux table's because the row is: ~120 B/row (a 48 B
+    /// packed-i16 blob for 24 samples, plus row and primary-key-index overhead) puts it at **~70 MB per
+    /// device**, against ~50 MB for aux. That is the bound worth quoting; the wall-clock
+    /// span is longer than the arithmetic suggests, because v26 only runs in optical windows. At #1911's
+    /// ~28,800 rows/day the cap holds about **three weeks** of typical wear, and proportionally more for a
+    /// sporadic wearer, which is exactly the population an age-based cutoff would have emptied. Retuning is
+    /// a one-constant change with no migration once a device `row_bytes` measurement lands, and RELAXING a
+    /// cap is always cheaper than imposing one on a user with a year of history.
+    public static let ppgWaveformRetentionRows = 604_800
+
+    /// Rows to bank before sweeping `ppgWaveformSample` again, same amortisation as
+    /// `v18AuxPruneEveryRows` below and the same magnitude for the same reason: the sweep walks up to
+    /// `ppgWaveformRetentionRows` index entries, so running it per insert batch is the cost. The table may
+    /// sit this many rows (plus the crossing batch) above the cap in exchange, roughly a MB against its
+    /// ~70 MB bound.
+    ///
+    /// WHAT THIS BUDGET DOES NOT GUARANTEE, and the reason the cap above is stated as a size rather than a
+    /// "hard ceiling": the counter is in-memory and per store instance, so a process restart resets it.
+    /// The sweep is the ONLY thing enforcing retention on this table — `Collector.prune` covers the raw
+    /// outbox alone, and the `*ByTs` deletes belong to `TimestampHeal`, not to retention — so a store that
+    /// never banks this many rows in one process lifetime never sweeps at all. It is not a concern for the
+    /// normal shape (the budget accumulates across every batch of a session, and one night's offload banks
+    /// ~28,800 rows, crossing it twice over), but a store fed only short bursts between app kills can drift
+    /// above the cap indefinitely. `v18AuxPruneEveryRows` below has the identical property; a sweep forced
+    /// once per session would close it for both, and belongs in a change that covers both.
+    public static let ppgWaveformPruneEveryRows = 10_000
+
     /// v31 rolling retention for the v18 aux-slot table (twin of Kotlin `V18_AUX_RETENTION_ROWS`).
     ///
     /// Raw instrumentation must be capped rather than unbounded. Nothing reads these rows yet, so a cap is far
@@ -109,7 +156,9 @@ extension WhoopStore {
             spo2: Int, skinTemp: Int, resp: Int, gravity: Int) {
         try await insert(streams, deviceId: deviceId,
                          v18AuxRetentionRows: WhoopStore.v18AuxRetentionRows,
-                         v18AuxPruneEveryRows: WhoopStore.v18AuxPruneEveryRows)
+                         v18AuxPruneEveryRows: WhoopStore.v18AuxPruneEveryRows,
+                         ppgWaveformRetentionRows: WhoopStore.ppgWaveformRetentionRows,
+                         ppgWaveformPruneEveryRows: WhoopStore.ppgWaveformPruneEveryRows)
     }
 
     /// `insert(_:deviceId:)` with the v31 aux-table cap made explicit. Internal and a SEPARATE overload
@@ -117,13 +166,21 @@ extension WhoopStore {
     /// require `insert(_:deviceId:)` exactly, and a Swift witness must match the requirement's parameter
     /// list — a default argument does not satisfy it. Exists so a test can prove the rolling delete with a
     /// small cap instead of writing 600k rows; every production caller goes through the wrapper above.
+    ///
+    /// The two v18-aux caps are required because eleven existing call sites already pass them; the two
+    /// ppg-waveform caps added for #1911 are DEFAULTED so those same call sites keep compiling untouched.
+    /// A default is fine on this overload (unlike the public entry point, per the note above) because
+    /// nothing witnesses it against a protocol requirement.
     @discardableResult
     func insert(_ streams: Streams, deviceId: String, v18AuxRetentionRows: Int,
-                v18AuxPruneEveryRows: Int) async throws
+                v18AuxPruneEveryRows: Int,
+                ppgWaveformRetentionRows: Int = WhoopStore.ppgWaveformRetentionRows,
+                ppgWaveformPruneEveryRows: Int = WhoopStore.ppgWaveformPruneEveryRows) async throws
         -> (hr: Int, rr: Int, events: Int, battery: Int,
             spo2: Int, skinTemp: Int, resp: Int, gravity: Int) {
         // Banked rows, accumulated across batches so the sweep does not run on every one.
         var v18Written = 0
+        var ppgWaveformWritten = 0
         let result: (Int, Int, Int, Int, Int, Int, Int, Int) = try syncWrite { db in
             var hr = 0, rr = 0, ev = 0, bat = 0
             var spo2 = 0, skin = 0, resp = 0, grav = 0
@@ -309,6 +366,7 @@ extension WhoopStore {
                 for s in streams.ppgWaveform {
                     try stmt.execute(arguments: [deviceId, s.ts, WhoopStore.packPpgSamples(s.samples),
                                                  s.burstIndex])
+                    ppgWaveformWritten += 1
                 }
             }
             // Every remaining v18 slot (v31), one compact blob per strap-second. Persist-only, same as
@@ -353,6 +411,25 @@ extension WhoopStore {
                 v18AuxRowsSincePrune[deviceId] = 0
             }
         }
+        // #1911 rolling retention for the waveform blobs, amortised and best-effort on exactly the same
+        // terms as the aux sweep above (see `ppgWaveformRetentionRows` for why this is a newest-N cap and
+        // not an age-based drop). Its own counter and its own transaction: a batch routinely writes one of
+        // these two tables and not the other, and a failed sweep here must not fail an insert whose rows
+        // are already committed — leaving the budget unspent simply retries on the next batch.
+        if ppgWaveformWritten > 0 {
+            let banked = (ppgWaveformRowsSincePrune[deviceId] ?? 0) + ppgWaveformWritten
+            ppgWaveformRowsSincePrune[deviceId] = banked
+            if banked >= ppgWaveformPruneEveryRows,
+               (try? syncWrite { db in
+                   try db.execute(sql: """
+                       DELETE FROM ppgWaveformSample WHERE deviceId = ? AND ts < (
+                           SELECT MIN(ts) FROM (
+                               SELECT ts FROM ppgWaveformSample WHERE deviceId = ? ORDER BY ts DESC LIMIT ?))
+                       """, arguments: [deviceId, deviceId, ppgWaveformRetentionRows])
+               }) != nil {
+                ppgWaveformRowsSincePrune[deviceId] = 0
+            }
+        }
         return result
     }
 
diff --git a/Packages/WhoopStore/Sources/WhoopStore/WhoopStore.swift b/Packages/WhoopStore/Sources/WhoopStore/WhoopStore.swift
index c8024e8c68..f75e185afa 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/WhoopStore.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/WhoopStore.swift
@@ -59,6 +59,12 @@ private actor StoreOpenGate {
 /// data or the query results.
 public actor WhoopStore {
 
+    /// PPG waveform rows banked since its retention sweep last ran, PER DEVICE, for the same reason as
+    /// `v18AuxRowsSincePrune` below: the sweep is per device, so a shared counter would let one strap
+    /// spend another's budget. Separate counter from the v18 aux one because the two caps differ and a
+    /// batch commonly writes one table and not the other. See `StreamStore`.
+    var ppgWaveformRowsSincePrune: [String: Int] = [:]
+
     /// v18 aux rows banked since the retention sweep last ran, PER DEVICE — the sweep is per device too,
     /// so a shared counter would let one strap spend another's budget. See `StreamStore`.
     var v18AuxRowsSincePrune: [String: Int] = [:]
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/PpgWaveformSampleTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/PpgWaveformSampleTests.swift
index d3217e97b0..59281e0c14 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/PpgWaveformSampleTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/PpgWaveformSampleTests.swift
@@ -108,4 +108,135 @@ final class PpgWaveformSampleTests: XCTestCase {
         data.append(0xFF)
         XCTAssertEqual(WhoopStore.unpackPpgSamples(data), [1, 2, 3])
     }
+
+    // MARK: - #1911 rolling retention
+
+    private func retentionStore() async throws -> WhoopStore {
+        let s = try await WhoopStore.inMemory()
+        try await s.upsertDevice(id: "dev1", mac: nil, name: nil)
+        return s
+    }
+
+    private func waveform(_ ts: Int) -> Streams {
+        Streams(ppgWaveform: [PpgWaveformSample(ts: ts, samples: realSamples, burstIndex: 0)])
+    }
+
+    /// The cap keeps the NEWEST rows. This is the property the whole design rests on — an age-based drop
+    /// would instead empty the table for a sporadic wearer, whom a future PPG estimator needs most.
+    func testRetentionKeepsTheNewestRows() async throws {
+        let s = try await retentionStore()
+        for ts in 100...105 {
+            _ = try await s.insert(waveform(ts), deviceId: "dev1",
+                                   v18AuxRetentionRows: WhoopStore.v18AuxRetentionRows,
+                                   v18AuxPruneEveryRows: WhoopStore.v18AuxPruneEveryRows,
+                                   ppgWaveformRetentionRows: 2, ppgWaveformPruneEveryRows: 1)
+        }
+        let rows = try await s.ppgWaveformSamples(deviceId: "dev1", from: 0, to: 1_000)
+        XCTAssertEqual(rows.map(\.ts), [104, 105], "newest-N, not oldest-N and not everything")
+    }
+
+    /// Under the sweep threshold nothing is evicted — the overshoot is deliberate amortisation.
+    func testRetentionDoesNotSweepUnderTheThreshold() async throws {
+        let s = try await retentionStore()
+        for ts in 100...104 {
+            _ = try await s.insert(waveform(ts), deviceId: "dev1",
+                                   v18AuxRetentionRows: WhoopStore.v18AuxRetentionRows,
+                                   v18AuxPruneEveryRows: WhoopStore.v18AuxPruneEveryRows,
+                                   ppgWaveformRetentionRows: 2, ppgWaveformPruneEveryRows: 50)
+        }
+        let rows = try await s.ppgWaveformSamples(deviceId: "dev1", from: 0, to: 1_000)
+        XCTAssertEqual(rows.count, 5, "under the threshold the sweep must not run — overshoot is the point")
+    }
+
+    /// The counter resets after each sweep, so a long offload sweeps repeatedly rather than latching once.
+    func testRetentionCounterResetsAfterEachSweep() async throws {
+        let s = try await retentionStore()
+        for ts in 100...111 {
+            _ = try await s.insert(waveform(ts), deviceId: "dev1",
+                                   v18AuxRetentionRows: WhoopStore.v18AuxRetentionRows,
+                                   v18AuxPruneEveryRows: WhoopStore.v18AuxPruneEveryRows,
+                                   ppgWaveformRetentionRows: 2, ppgWaveformPruneEveryRows: 4)
+        }
+        let rows = try await s.ppgWaveformSamples(deviceId: "dev1", from: 0, to: 1_000)
+        XCTAssertEqual(rows.map(\.ts), [110, 111],
+                       "a second sweep must happen; the counter cannot latch after the first")
+    }
+
+    /// The budget is per device, because the delete is — one strap must not spend another's.
+    func testRetentionBudgetIsNotSharedBetweenDevices() async throws {
+        let s = try await retentionStore()
+        try await s.upsertDevice(id: "dev2", mac: nil, name: nil)
+        for ts in 100...102 {
+            _ = try await s.insert(waveform(ts), deviceId: "dev1",
+                                   v18AuxRetentionRows: WhoopStore.v18AuxRetentionRows,
+                                   v18AuxPruneEveryRows: WhoopStore.v18AuxPruneEveryRows,
+                                   ppgWaveformRetentionRows: 1, ppgWaveformPruneEveryRows: 4)
+        }
+        // With a SHARED counter dev2's single row crosses the threshold and sweeps; because the delete is
+        // scoped to dev2 it would evict nothing from dev1 while zeroing dev1's budget.
+        _ = try await s.insert(waveform(200), deviceId: "dev2",
+                               v18AuxRetentionRows: WhoopStore.v18AuxRetentionRows,
+                               v18AuxPruneEveryRows: WhoopStore.v18AuxPruneEveryRows,
+                               ppgWaveformRetentionRows: 1, ppgWaveformPruneEveryRows: 4)
+        _ = try await s.insert(waveform(103), deviceId: "dev1",
+                               v18AuxRetentionRows: WhoopStore.v18AuxRetentionRows,
+                               v18AuxPruneEveryRows: WhoopStore.v18AuxPruneEveryRows,
+                               ppgWaveformRetentionRows: 1, ppgWaveformPruneEveryRows: 4)
+        let d1 = try await s.ppgWaveformSamples(deviceId: "dev1", from: 0, to: 1_000)
+        XCTAssertEqual(d1.map(\.ts), [103],
+                       "dev1's own fourth row must trigger dev1's sweep — dev2 cannot spend its budget")
+    }
+
+    /// A batch with no waveform row must not sweep at all: a WHOOP 4.0 offload, or any non-v26 second,
+    /// never pays for the index scan and never evicts. Guards against banking the budget off other streams.
+    func testNoWaveformRowsMeansNoRetentionSweep() async throws {
+        let s = try await retentionStore()
+        _ = try await s.insert(waveform(100), deviceId: "dev1",
+                               v18AuxRetentionRows: WhoopStore.v18AuxRetentionRows,
+                               v18AuxPruneEveryRows: WhoopStore.v18AuxPruneEveryRows,
+                               ppgWaveformRetentionRows: 5, ppgWaveformPruneEveryRows: 1)
+        // An HR-only batch banks nothing here, so the cap of 1 must NOT evict the waveform row above.
+        _ = try await s.insert(Streams(hr: [HRSample(ts: 200, bpm: 60)]), deviceId: "dev1",
+                               v18AuxRetentionRows: WhoopStore.v18AuxRetentionRows,
+                               v18AuxPruneEveryRows: WhoopStore.v18AuxPruneEveryRows,
+                               ppgWaveformRetentionRows: 1, ppgWaveformPruneEveryRows: 1)
+        let rows = try await s.ppgWaveformSamples(deviceId: "dev1", from: 0, to: 1_000)
+        XCTAssertEqual(rows.map(\.ts), [100])
+    }
+
+    /// One strap's sweep must not evict ANOTHER strap's rows. Distinct from the budget test above, which
+    /// only proves the two devices bank separately: this pins the DELETE's own device scoping, and it is
+    /// the reason the older strap's rows sit BELOW the sweeping strap's cutoff. With `dev2` newer than the
+    /// cutoff (as in the budget test) the rows survive even a DELETE that has lost its `deviceId` filter,
+    /// so that arrangement cannot see the bug. Dropping the outer filter is silent cross-device data loss
+    /// on a multi-strap install, and nothing else in the suite catches it.
+    func testRetentionSweepDoesNotEvictAnotherDevicesRows() async throws {
+        let s = try await retentionStore()
+        try await s.upsertDevice(id: "dev2", mac: nil, name: nil)
+        for ts in [500, 501] {
+            _ = try await s.insert(waveform(ts), deviceId: "dev2",
+                                   v18AuxRetentionRows: WhoopStore.v18AuxRetentionRows,
+                                   v18AuxPruneEveryRows: WhoopStore.v18AuxPruneEveryRows,
+                                   ppgWaveformRetentionRows: 10, ppgWaveformPruneEveryRows: 50)
+        }
+        // dev1's rows are all NEWER than dev2's, so dev1's cutoff sits above every dev2 row.
+        for ts in 1_000...1_003 {
+            _ = try await s.insert(waveform(ts), deviceId: "dev1",
+                                   v18AuxRetentionRows: WhoopStore.v18AuxRetentionRows,
+                                   v18AuxPruneEveryRows: WhoopStore.v18AuxPruneEveryRows,
+                                   ppgWaveformRetentionRows: 1, ppgWaveformPruneEveryRows: 1)
+        }
+        let d1 = try await s.ppgWaveformSamples(deviceId: "dev1", from: 0, to: 10_000)
+        let d2 = try await s.ppgWaveformSamples(deviceId: "dev2", from: 0, to: 10_000)
+        XCTAssertEqual(d1.map(\.ts), [1_003], "dev1 is swept to its own cap")
+        XCTAssertEqual(d2.map(\.ts), [500, 501],
+                       "dev2's older rows must survive dev1's sweep — the DELETE is per device")
+    }
+
+    /// The production cap must stay a WEEK-SCALE newest-N row count, not an age-based drop. Pins the
+    /// constant so a future "just make it 7 days" edit has to confront `ppgWaveformRetentionRows`' note.
+    func testProductionRetentionCapIsAWeekOfStrapSeconds() {
+        XCTAssertEqual(WhoopStore.ppgWaveformRetentionRows, 604_800)
+        XCTAssertEqual(WhoopStore.ppgWaveformPruneEveryRows, 10_000)
+    }
 }
diff --git a/android/app/src/main/java/com/noop/data/Entities.kt b/android/app/src/main/java/com/noop/data/Entities.kt
index f9898128ac..d769766f41 100644
--- a/android/app/src/main/java/com/noop/data/Entities.kt
+++ b/android/app/src/main/java/com/noop/data/Entities.kt
@@ -669,6 +669,13 @@ data class CoachMessageRow(
  * PK (deviceId, ts) mirrors every other per-second stream; a truncated frame can decode fewer than 24
  * samples. Fields are declared in the SAME order as the GRDB schema
  * (deviceId, ts, samples, burstIndex) so Room's generated shape stays byte-identical.
+ *
+ * CAPPED, not unbounded (#1911): [WhoopRepository.PPG_WAVEFORM_RETENTION_ROWS] rolling rows per device,
+ * the same shape [V18AuxSampleEntity] uses. The cap is NEWEST-N ROWS, never an age cutoff, and that is
+ * load-bearing for the paragraph above: a sporadic wearer's v26 seconds are spread thin over months, so
+ * dropping by wall-clock age would empty the table for exactly the user a future re-analysis needs most,
+ * and a waveform has no aggregate that survives it. Bounding the bytes while always leaving a full working
+ * set is the whole point. Swift twin: `WhoopStore.ppgWaveformRetentionRows`.
  */
 @Entity(tableName = "ppgWaveformSample", primaryKeys = ["deviceId", "ts"])
 data class PpgWaveformSampleEntity(
diff --git a/android/app/src/main/java/com/noop/data/WhoopDao.kt b/android/app/src/main/java/com/noop/data/WhoopDao.kt
index 55b9f85d7c..988401531b 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDao.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDao.kt
@@ -196,6 +196,19 @@ interface WhoopDao : DeviceRegistryDao {
     @Insert(onConflict = OnConflictStrategy.IGNORE)
     suspend fun insertV18Aux(rows: List<V18AuxSampleEntity>): List<Long>
 
+    /**
+     * Bound the PPG waveform table to the newest [keep] rows for [deviceId] (#1911 rolling retention).
+     * Same shape as [pruneV18Aux] below, and deliberately the same NEWEST-N semantic rather than an
+     * age-based delete: see `WhoopRepository.PPG_WAVEFORM_RETENTION_ROWS`. Swift twin: the DELETE at the
+     * end of `WhoopStore.insert`.
+     */
+    @Query(
+        "DELETE FROM ppgWaveformSample WHERE deviceId = :deviceId AND ts < " +
+            "(SELECT MIN(ts) FROM (SELECT ts FROM ppgWaveformSample WHERE deviceId = :deviceId " +
+            "ORDER BY ts DESC LIMIT :keep))",
+    )
+    suspend fun prunePpgWaveform(deviceId: String, keep: Int)
+
     /**
      * Bound the v18 aux table to the newest [keep] rows for [deviceId] (rolling retention, v31). Same
      * shape as [pruneRawImu] — this is instrumentation nothing reads yet, so it is capped rather than
diff --git a/android/app/src/main/java/com/noop/data/WhoopDatabase.kt b/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
index 8a0a1ac03d..d548503982 100644
--- a/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopDatabase.kt
@@ -548,6 +548,12 @@ abstract class WhoopDatabase : RoomDatabase() {
          * BLOB (2 bytes/sample, little-endian i16, [StreamPersistence.packPpgSamples]) rather than 24 scalar
          * rows.
          *
+         * Retention: `ppgWaveformSample` is CAPPED at [WhoopRepository.PPG_WAVEFORM_RETENTION_ROWS] rolling
+         * rows per device (#1911), the same shape `v18AuxSample` uses. The cap is NEWEST-N ROWS and never an
+         * age cutoff: v26 seconds are spread thin over months for a sporadic wearer, so dropping by
+         * wall-clock age would empty the table for exactly the user a future re-analysis needs most, and a
+         * waveform has no aggregate that survives it. Swift twin: the `v27-ppg-waveform` migration note.
+         *
          * CREATE TABLE only (no existing data touched), so already-offloaded raw streams survive. The SQL MUST
          * match Room's generated schema for [PpgWaveformSampleEntity] exactly: deviceId TEXT NOT NULL, ts
          * INTEGER NOT NULL, samples BLOB NOT NULL (all Kotlin non-null, no SQL DEFAULT), composite PRIMARY KEY
diff --git a/android/app/src/main/java/com/noop/data/WhoopRepository.kt b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
index a49033de05..f01abded41 100644
--- a/android/app/src/main/java/com/noop/data/WhoopRepository.kt
+++ b/android/app/src/main/java/com/noop/data/WhoopRepository.kt
@@ -430,6 +430,12 @@ class WhoopRepository(
         suspend fun <R> run(block: suspend () -> R): R
     }
 
+    /** PPG waveform rows banked since its retention sweep last ran, PER DEVICE, for the same reason as
+     *  [v18AuxRowsSincePrune] below: the sweep is per device, so a shared counter would let one strap
+     *  spend another's budget. A separate counter because the two caps differ and a batch commonly writes
+     *  one table and not the other. Swift twin: `WhoopStore.ppgWaveformRowsSincePrune`. */
+    private val ppgWaveformRowsSincePrune = mutableMapOf<String, Int>()
+
     /** v18 aux rows banked since the retention sweep last ran, PER DEVICE — the sweep is per device too,
      *  so a shared counter would let one strap spend another's budget. Only the single-threaded offload
      *  path banks v18 rows, so a plain map is enough. Swift twin: `WhoopStore.v18AuxRowsSincePrune`. */
@@ -498,6 +504,8 @@ class WhoopRepository(
         // shipped constants. (#888)
         v18AuxRetentionRows: Int = V18_AUX_RETENTION_ROWS,
         v18AuxPruneEveryRows: Int = V18_AUX_PRUNE_EVERY_ROWS,
+        ppgWaveformRetentionRows: Int = PPG_WAVEFORM_RETENTION_ROWS,
+        ppgWaveformPruneEveryRows: Int = PPG_WAVEFORM_PRUNE_EVERY_ROWS,
     ): InsertCounts {
         if (streams.isEmpty) return InsertCounts()
 
@@ -507,6 +515,8 @@ class WhoopRepository(
                 deviceId = deviceId,
                 v18AuxRetentionRows = v18AuxRetentionRows,
                 v18AuxPruneEveryRows = v18AuxPruneEveryRows,
+                ppgWaveformRetentionRows = ppgWaveformRetentionRows,
+                ppgWaveformPruneEveryRows = ppgWaveformPruneEveryRows,
             )
         }
         val counts = result.counts
@@ -539,6 +549,8 @@ class WhoopRepository(
         deviceId: String,
         v18AuxRetentionRows: Int,
         v18AuxPruneEveryRows: Int,
+        ppgWaveformRetentionRows: Int,
+        ppgWaveformPruneEveryRows: Int,
     ): InsertResult {
         val hrIds = if (streams.hr.isEmpty()) emptyList() else
             dao.insertHr(streams.hr.map { HrSample(deviceId, it.ts, it.bpm) })
@@ -593,6 +605,19 @@ class WhoopRepository(
                         it.burstIndex)
                 },
             )
+            // #1911 rolling retention, amortised and best-effort on exactly the same terms as the v18-aux
+            // sweep below (see [PPG_WAVEFORM_RETENTION_ROWS] for why this is newest-N and not an age-based
+            // drop). Its own counter: a batch routinely writes one of these two tables and not the other.
+            val bankedPpg = (ppgWaveformRowsSincePrune[deviceId] ?: 0) + streams.ppgWaveform.size
+            ppgWaveformRowsSincePrune[deviceId] = bankedPpg
+            if (bankedPpg >= ppgWaveformPruneEveryRows) {
+                runCatching { dao.prunePpgWaveform(deviceId, ppgWaveformRetentionRows) }
+                    .onSuccess { ppgWaveformRowsSincePrune[deviceId] = 0 }
+                    // prunePpgWaveform is a suspend call, so a scope cancellation arrives here as a
+                    // CancellationException that runCatching would otherwise swallow, leaving the caller
+                    // running inside a cancelled coroutine. Same rethrow as the v18-aux sweep below.
+                    .onFailure { if (it is kotlin.coroutines.cancellation.CancellationException) throw it }
+            }
         }
 
         // Every remaining v18 slot (v31), one compact blob per strap-second. Persist-only, same as
@@ -2137,6 +2162,53 @@ class WhoopRepository(
         /** Default row cap on range reads. Matches the Swift call sites' bounded scans. */
         const val DEFAULT_LIMIT = 100_000
 
+        /**
+         * #1911: rolling retention for the v27 PPG waveform table (Swift twin
+         * `WhoopStore.ppgWaveformRetentionRows`). Previously the only UNBOUNDED blob table, and it carries
+         * by far the largest PER-ROW cost of any decoded stream: ~120 B against ~30 B for a scalar row.
+         *
+         * It is NOT the store's fastest-growing table, and this note must not be read as saying so. v26
+         * runs only in optical windows, roughly 28,800 rows/day by #1911's own figures, where `rrInterval`
+         * banks ~100,000/day and remains the higher-volume table by bytes. Capping this one bounds the
+         * worst row, not the bulk of #1911's ~93 MB/day.
+         *
+         * A NEWEST-N-ROWS CAP, DELIBERATELY NOT A TIME-WINDOW DROP. #1911 proposes "dropped after the hot
+         * window", calling the waveform "diagnostic-only". That framing is wrong: the migration note on
+         * `ppgWaveformSample` is the authority, and these rows are kept so a better estimator,
+         * HRV-from-PPG, or a waveform viewer can later run over the ORIGINAL samples rather than the
+         * derived bpm. Deleting by wall-clock age would empty the table for exactly the user such an
+         * estimator needs most (a sporadic wearer, whose v26 seconds are spread thin over months), and a
+         * waveform has no aggregate that survives it. Newest-N bounds the bytes while always leaving a
+         * full working set — the same trade [V18_AUX_RETENTION_ROWS] below makes.
+         *
+         * 604,800 = 7 × 86,400, matching the aux cap's "week of strap-seconds" semantic and #1911's own
+         * 7-day hot window. The ceiling is larger than aux's because the row is: ~120 B/row (a 48 B
+         * packed-i16 blob for 24 samples plus row and primary-key-index overhead) gives ~70 MB per device
+         * against ~50 MB for aux. That is the bound worth quoting; the wall-clock
+         * span is longer than the arithmetic suggests, because v26 only runs in optical windows. At #1911's
+         * ~28,800 rows/day the cap holds about three weeks of typical wear, and proportionally more for a
+         * sporadic wearer, which is exactly the population an age-based cutoff would have emptied. Retuning
+         * is one constant with no migration.
+         */
+        const val PPG_WAVEFORM_RETENTION_ROWS = 604_800
+
+        /** Rows to bank before sweeping `ppgWaveformSample` again — same amortisation and magnitude as
+         *  [V18_AUX_PRUNE_EVERY_ROWS] below, for the same reason: the sweep walks up to
+         *  [PPG_WAVEFORM_RETENTION_ROWS] index entries, so running it per insert batch is the cost. The
+         *  table may sit this many rows (plus the crossing batch) above the cap, roughly a MB against its
+         *  ~70 MB bound. Swift twin: `WhoopStore.ppgWaveformPruneEveryRows`.
+         *
+         *  WHAT THIS BUDGET DOES NOT GUARANTEE, and why the cap above is stated as a size and not a "hard
+         *  ceiling": the counter is in-memory and per repository instance, so process death resets it. The
+         *  sweep is the ONLY thing enforcing retention on this table (the `*ByTs` deletes belong to the
+         *  timestamp heal, not to retention), so a repository that never banks this many rows in one
+         *  process lifetime never sweeps. Not a concern for the normal shape, since the budget accumulates
+         *  across every batch of a session and one night's offload banks ~28,800 rows, but a repository fed
+         *  only short bursts between app kills can drift above the cap indefinitely.
+         *  [V18_AUX_PRUNE_EVERY_ROWS] has the identical property; forcing a sweep once per session would
+         *  close it for both, and belongs in a change that covers both. */
+        const val PPG_WAVEFORM_PRUNE_EVERY_ROWS = 10_000
+
         /**
          * v31: rolling retention for the v18 aux-slot table (Swift twin `WhoopStore.v18AuxRetentionRows`).
          *
diff --git a/android/app/src/test/java/com/noop/data/PpgWaveformMigrationTest.kt b/android/app/src/test/java/com/noop/data/PpgWaveformMigrationTest.kt
index 9b227b061f..0fb53577e4 100644
--- a/android/app/src/test/java/com/noop/data/PpgWaveformMigrationTest.kt
+++ b/android/app/src/test/java/com/noop/data/PpgWaveformMigrationTest.kt
@@ -133,4 +133,117 @@ class PpgWaveformMigrationTest {
         // And it unpacks back to the original samples.
         assertEquals(realSamples, StreamPersistence.unpackPpgSamples(rows[0].samples))
     }
+
+    // MARK: - #1911 rolling retention (twin of Swift PpgWaveformSampleTests' retention block)
+    //
+    // WHAT THESE TESTS DO AND DO NOT COVER. They drive a Proxy DAO, so they pin the repository's
+    // AMORTISATION (when a sweep fires, with which deviceId and cap, and whose budget paid for it) but
+    // never execute `prunePpgWaveform`'s SQL. The statement's semantics -- newest-N kept, and the DELETE
+    // scoped so one strap's sweep cannot evict another's rows -- are proven on the Swift side against a
+    // real database by `PpgWaveformSampleTests`, and the two statements are deliberately identical text
+    // modulo the parameter syntax. A change to the SQL here MUST be mirrored there, because this file
+    // cannot fail for it. (The project pins migration SQL without Robolectric on purpose; see the class
+    // doc, so there is no real-DB seam available here.)
+
+    private fun waveformRow(ts: Long) = PpgWaveformRow(ts = ts, samples = listOf(1, -2, 3), burstIndex = 0)
+
+    /** Records every `prunePpgWaveform(deviceId, keep)` the repository makes. */
+    private fun sweepRecordingDao(sweeps: MutableList<Pair<String, Int>>): WhoopDao =
+        Proxy.newProxyInstance(
+            WhoopDao::class.java.classLoader,
+            arrayOf(WhoopDao::class.java),
+        ) { _, method, args ->
+            when (method.name) {
+                "insertPpgWaveform" -> listOf(1L)
+                "insertV18Aux" -> listOf(1L)
+                "pruneV18Aux" -> Unit
+                "prunePpgWaveform" -> { sweeps.add((args[0] as String) to (args[1] as Int)); Unit }
+                else -> throw UnsupportedOperationException("unexpected DAO call ${method.name}")
+            }
+        } as WhoopDao
+
+    /** Under the sweep threshold nothing is evicted — the overshoot is deliberate amortisation. */
+    @Test
+    fun waveformRetention_doesNotSweepUnderTheThreshold(): Unit = runBlocking {
+        val sweeps = mutableListOf<Pair<String, Int>>()
+        val repo = WhoopRepository(sweepRecordingDao(sweeps))
+        repeat(3) { i ->
+            repo.insert(
+                StreamBatch(ppgWaveform = listOf(waveformRow(1_780_917_232L + i))),
+                "my-whoop",
+                ppgWaveformPruneEveryRows = 5_000,
+            )
+        }
+        assertEquals("three rows must not reach a 5 000-row budget", 0, sweeps.size)
+    }
+
+    /**
+     * Once the banked count crosses the threshold the sweep runs, and the counter resets so the next
+     * window has to earn its own sweep. It must also pass the RETENTION cap as `keep`, not the budget.
+     */
+    @Test
+    fun waveformRetention_sweepsOnThresholdThenResets(): Unit = runBlocking {
+        val sweeps = mutableListOf<Pair<String, Int>>()
+        val repo = WhoopRepository(sweepRecordingDao(sweeps))
+        // Two rows per batch against a budget of 3: banked=2 (no sweep), 4 (sweep, reset), 2 (no sweep).
+        repeat(3) { i ->
+            repo.insert(
+                StreamBatch(ppgWaveform = listOf(
+                    waveformRow(1_780_917_232L + i * 2), waveformRow(1_780_917_233L + i * 2),
+                )),
+                "my-whoop",
+                ppgWaveformPruneEveryRows = 3,
+                ppgWaveformRetentionRows = 99,
+            )
+        }
+        assertEquals("exactly one sweep — the counter must reset after it", 1, sweeps.size)
+        assertEquals("my-whoop" to 99, sweeps[0])
+    }
+
+    /** The budget is per device, because the delete is — one strap must not spend another's. */
+    @Test
+    fun waveformRetention_budgetIsNotSharedBetweenDevices(): Unit = runBlocking {
+        val sweeps = mutableListOf<Pair<String, Int>>()
+        val repo = WhoopRepository(sweepRecordingDao(sweeps))
+        repeat(3) { i ->
+            repo.insert(StreamBatch(ppgWaveform = listOf(waveformRow(1_780_917_232L + i))),
+                "strap-a", ppgWaveformPruneEveryRows = 4)
+        }
+        // With a SHARED counter this fourth banked row would cross the threshold and sweep strap-b,
+        // evicting nothing from strap-a while zeroing strap-a's budget.
+        repo.insert(StreamBatch(ppgWaveform = listOf(waveformRow(1_780_918_000L))),
+            "strap-b", ppgWaveformPruneEveryRows = 4)
+        assertEquals("neither strap has banked four of its OWN rows yet", 0, sweeps.size)
+
+        repo.insert(StreamBatch(ppgWaveform = listOf(waveformRow(1_780_917_240L))),
+            "strap-a", ppgWaveformPruneEveryRows = 4)
+        assertEquals(1, sweeps.size)
+        assertEquals("strap-a must sweep on its own fourth row", "strap-a", sweeps[0].first)
+    }
+
+    /**
+     * A batch that banks no waveform row must not sweep, even with a budget of one — a WHOOP 4.0 offload
+     * (or any non-v26 second) never pays for the index scan and never evicts. Guards specifically against
+     * banking the waveform budget off a DIFFERENT stream's rows.
+     */
+    @Test
+    fun waveformRetention_otherStreamsDoNotBankTheBudget(): Unit = runBlocking {
+        val sweeps = mutableListOf<Pair<String, Int>>()
+        WhoopRepository(sweepRecordingDao(sweeps)).insert(
+            StreamBatch(v18Aux = listOf(V18AuxRow(ts = 1_780_916_150L, statusWord = 1_792L))),
+            "my-whoop",
+            ppgWaveformPruneEveryRows = 1,
+        )
+        assertEquals("a v18-aux batch must not sweep the waveform table", 0, sweeps.size)
+    }
+
+    /**
+     * The shipped cap is a real bound and matches the Swift constant. Pinned so a future "just make it
+     * 7 days" edit has to confront the NEWEST-N rationale on [WhoopRepository.PPG_WAVEFORM_RETENTION_ROWS].
+     */
+    @Test
+    fun shippedWaveformRetentionConstants() {
+        assertEquals(604_800, WhoopRepository.PPG_WAVEFORM_RETENTION_ROWS)  // 7 x 86_400 strap-seconds
+        assertEquals(10_000, WhoopRepository.PPG_WAVEFORM_PRUNE_EVERY_ROWS)
+    }
 }

From ab14a9591cc852af1e542e927d1fee80f4a4e40c Mon Sep 17 00:00:00 2001
From: Bernd Helm <bhelm@users.noreply.github.com>
Date: Sun, 6 Sep 2026 13:43:41 +0200
Subject: [PATCH 287/333] recovery: close the final HR bin on the window end so
 an endpoint sample counts

RecoveryScorer.restingHR and RecoveryScorer.recoveryIndexSlope document and
prefilter a closed [start, end] window but bin it as [t, t + 300) with a loop
that stops at `end`. A sample sitting exactly on an aligned `end` passes the
prefilter and then belongs to no bin: admitted as data, silently ignored. For
the Recovery Index that can leave the six-bin gate one bin short and turn a
complete 30-minute window into nil/null.

The final bin now closes on `end` on both platforms ([t, t + 300) for every bin
except the last, which is [t, end]); a zero-length window collapses to that one
final bin. Bin midpoints, the #686 artifact gate and recoveryIndexMinBins are
unchanged, so nothing moves except a sample on an aligned endpoint. Both
functions already guard on an empty prefiltered segment, so the loop conversion
cannot manufacture a bin. Doc comments and docs/ANALYTICS.md state the rule.

Verified surgical rather than taken on trust: sweeping both the old and new
binning over 55,100 random window/sample configurations produced zero
differences for any span not aligned to 300s, and zero differences that did not
involve a sample sitting exactly on `end`.

The tests earn their place. Reverting only the production Kotlin file turns
three of the ten new cases red (endpointSampleLandsInFinalBinOnly,
recoveryIndexSlopeAlignedEndpointCompletesTheBinGate,
restingHrEndpointSweepMatchesSwiftOracle) and they pass again with it; the other
seven pin behaviour that must not move.

Scope, stated plainly: both helpers are library API with no in-app caller today,
so this moves no shipped number. The resting HR the apps display comes from
SleepStager.sessionRestingHR, whose window loop has the same shape and the same
defect; that is deliberately not part of this change.

Reported and implemented by @bhelm. The reporting fork's issue number was
dropped from the comments before merge: read in this repo it lands on an
unrelated report, and the same number is already used in HealthLiveHrLogic.kt
and AppViewModel.kt for live-HR median parity.
---
 .../StrandAnalytics/RecoveryScorer.swift      |  30 +++-
 .../RecoveryScorerTests.swift                 | 117 ++++++++++++++
 .../java/com/noop/analytics/RecoveryScorer.kt |  29 +++-
 .../RecoveryScorerWindowEndpointTest.kt       | 147 ++++++++++++++++++
 docs/ANALYTICS.md                             |   2 +-
 5 files changed, 310 insertions(+), 15 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/analytics/RecoveryScorerWindowEndpointTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/RecoveryScorer.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/RecoveryScorer.swift
index 2c411b1f63..6cfa6582d9 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/RecoveryScorer.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/RecoveryScorer.swift
@@ -246,6 +246,12 @@ public enum RecoveryScorer {
     /// samples whose ts ∈ [start, end]. Rejects single-beat dips while capturing
     /// the night's true floor. Returns nil when there are no HR samples in window.
     ///
+    /// The window is CLOSED at both ends, so the binning is too: bins are `[t, t + windowS)`
+    /// except the final one, which is `[t, end]`. Half-open bins alone would admit a
+    /// sample sitting exactly on an aligned `end` through the prefilter and then place it in no
+    /// bin — counted as data, silently ignored. A zero-length window (`start == end`) is that
+    /// single closed bin.
+    ///
     /// Artifact hardening (#686): a bin may only WIN the floor when it is BOTH well-populated
     /// (≥ `restingHRMinBinSamples`, so one lone artifact beat can't be a bin "mean") AND
     /// physiologically plausible (mean ≥ `restingHRMinPlausibleBpm`, rejecting dropout-driven
@@ -260,8 +266,13 @@ public enum RecoveryScorer {
         var means: [Double] = []          // every bin mean (legacy floor, the fallback)
         var qualified: [Double] = []       // bins eligible to WIN the floor (#686)
         var t = start
-        while t < end {
-            let win = seg.filter { $0.ts >= t && $0.ts < t + restingHRWindowS }
+        repeat {
+            // The last bin (its half-open end reaches or passes `end`) closes on `end` instead,
+            // catching an endpoint sample the prefilter already admitted. `seg` holds nothing
+            // past `end`, so "everything from t onwards" IS [t, end]. `repeat` runs once for a
+            // zero-length window, where that single closed bin is the whole window.
+            let isFinal = t + restingHRWindowS >= end
+            let win = seg.filter { $0.ts >= t && (isFinal || $0.ts < t + restingHRWindowS) }
             if !win.isEmpty {
                 let mean = Double(win.reduce(0) { $0 + $1.bpm }) / Double(win.count)
                 means.append(mean)
@@ -272,7 +283,7 @@ public enum RecoveryScorer {
                 }
             }
             t += restingHRWindowS
-        }
+        } while t < end
         let floor: Double
         if let m = qualified.min() {
             floor = m
@@ -300,7 +311,9 @@ public enum RecoveryScorer {
     ///
     /// Computed as the least-squares slope of the SAME non-overlapping 5-minute HR bin means
     /// `restingHR` uses (`restingHRWindowS`) against each bin's midpoint time (hours from
-    /// `start`). NEGATIVE = declining (HR falling through the night — the physiologically
+    /// `start`, and for the final closed bin still its half-open midpoint `t + windowS / 2`, so a
+    /// partial or endpoint-only last bin keeps the same time axis as every other bin).
+    /// NEGATIVE = declining (HR falling through the night — the physiologically
     /// expected, good pattern); POSITIVE = rising (restlessness, illness, alcohol, a late
     /// stimulant). Returns nil when fewer than `recoveryIndexMinBins` bins have data (too
     /// little of the window to fit a trend) or there are no samples at all — it never
@@ -313,15 +326,18 @@ public enum RecoveryScorer {
         // underlying series, one as a floor, one as a trend across it.
         var points: [(tHours: Double, meanBpm: Double)] = []
         var t = start
-        while t < end {
-            let win = seg.filter { $0.ts >= t && $0.ts < t + restingHRWindowS }
+        repeat {
+            // Final bin closes on `end` — same closed-window rule as restingHR, so an
+            // endpoint sample counts toward the bin gate instead of vanishing after admission.
+            let isFinal = t + restingHRWindowS >= end
+            let win = seg.filter { $0.ts >= t && (isFinal || $0.ts < t + restingHRWindowS) }
             if !win.isEmpty {
                 let mean = Double(win.reduce(0) { $0 + $1.bpm }) / Double(win.count)
                 let midpointS = Double(t - start) + Double(restingHRWindowS) / 2.0
                 points.append((tHours: midpointS / 3600.0, meanBpm: mean))
             }
             t += restingHRWindowS
-        }
+        } while t < end
         guard points.count >= recoveryIndexMinBins else { return nil }
 
         // Least-squares slope: Σ((t-t̄)(y-ȳ)) / Σ((t-t̄)²), bpm per hour.
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RecoveryScorerTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RecoveryScorerTests.swift
index 91fe6882ef..a8ef7b6642 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RecoveryScorerTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RecoveryScorerTests.swift
@@ -284,6 +284,123 @@ final class RecoveryScorerTests: XCTestCase {
         XCTAssertLessThan(flatSlope!, risingSlope!)
     }
 
+    // MARK: - Window endpoint: the closed [start, end] window has a closed FINAL bin
+
+    // Both `restingHR` and `recoveryIndexSlope` prefilter ts ∈ [start, end], so a sample sitting
+    // exactly ON `end` is admitted. With bins shaped [t, t+300) and a loop that stops at `end`, an
+    // ALIGNED end (end - start a multiple of the bin width) left that admitted sample in no bin at
+    // all: it was counted as data and then silently ignored. The final bin is therefore closed at
+    // `end`. The paired non-aligned cases pin the behaviour that was already correct, so the fix
+    // cannot be mistaken for a change to trailing partial bins.
+
+    func testRestingHRAlignedEndpointSampleReachesABin() {
+        // The minimal case: start = 0, end = 300 (exactly one bin wide), five samples on
+        // the endpoint. They pass the prefilter, so they must also populate the final bin — and
+        // five is exactly restingHRMinBinSamples, so the bin qualifies for the floor. This case
+        // already returned 60 before the fix, but only because NO bin held anything and the
+        // all-sample fallback stepped in; it now flows through the bin path like any other
+        // window. testRestingHREndpointSampleLandsInFinalBinOnly is where the fallback cannot
+        // hide the dropped sample.
+        let hr = (0..<5).map { _ in HRSample(ts: 300, bpm: 60) }
+        XCTAssertEqual(RecoveryScorer.restingHR(hr, start: 0, end: 300), 60,
+                       "a sample exactly on an aligned end must belong to the final bin")
+    }
+
+    func testRestingHRNonAlignedEndpointSampleReachesABin() {
+        // Paired non-aligned case: end = 450 falls mid-bin, so the endpoint sample was always
+        // inside the trailing partial bin. Same answer, before and after the fix.
+        let hr = (0..<5).map { _ in HRSample(ts: 450, bpm: 60) }
+        XCTAssertEqual(RecoveryScorer.restingHR(hr, start: 0, end: 450), 60,
+                       "a sample on a non-aligned end stays in the trailing partial bin")
+    }
+
+    func testRestingHREndpointSampleLandsInFinalBinOnly() {
+        // The endpoint must join the LAST bin, not leak into earlier ones: a dense 70 bpm first
+        // bin plus five endpoint beats at 40 gives a floor of 40 (the endpoint bin), while the
+        // 70 bpm bin is untouched. A rule that admitted ts == end into every bin would drag the
+        // first bin's mean down instead.
+        var hr: [HRSample] = (0..<300).map { HRSample(ts: $0, bpm: 70) }
+        hr.append(contentsOf: (0..<5).map { _ in HRSample(ts: 600, bpm: 40) })
+        XCTAssertEqual(RecoveryScorer.restingHR(hr, start: 0, end: 600), 40,
+                       "the endpoint sample belongs to the final bin only")
+    }
+
+    func testRestingHRDegenerateZeroLengthWindow() {
+        // start == end: the single instant is one closed bin. Five samples clear the count bar,
+        // so the floor is their mean — the same number the all-sample fallback produced before.
+        let hr = (0..<5).map { _ in HRSample(ts: 1000, bpm: 58) }
+        XCTAssertEqual(RecoveryScorer.restingHR(hr, start: 1000, end: 1000), 58)
+    }
+
+    func testRecoveryIndexSlopeAlignedEndpointCompletesTheBinGate() throws {
+        // The bin-gate case: six samples over an aligned 30-minute window, the last exactly
+        // on `end`. Dropping it left five bins — one short of recoveryIndexMinBins — so the gate
+        // turned a complete window into nil. With the final bin closed there are six bins and a
+        // slope. Expected value from the Swift oracle in Tools-free standalone form (see the
+        // Kotlin twin, which pins the same literal).
+        let hr = [HRSample(ts: 0, bpm: 66), HRSample(ts: 300, bpm: 64),
+                  HRSample(ts: 600, bpm: 62), HRSample(ts: 900, bpm: 60),
+                  HRSample(ts: 1200, bpm: 58), HRSample(ts: 1800, bpm: 54)]
+        let slope = try XCTUnwrap(RecoveryScorer.recoveryIndexSlope(hr, start: 0, end: 1800),
+                                  "an admitted endpoint sample must count toward the bin gate")
+        XCTAssertEqual(slope, -27.428571428571423, accuracy: 1e-9)
+    }
+
+    func testRecoveryIndexSlopeStillNilWithOnlyFiveBins() {
+        // The gate itself is unchanged: the same window without the endpoint sample has five
+        // bins and must stay nil. Closing the final bin adds no bin where there is no sample.
+        let hr = [HRSample(ts: 0, bpm: 66), HRSample(ts: 300, bpm: 64),
+                  HRSample(ts: 600, bpm: 62), HRSample(ts: 900, bpm: 60),
+                  HRSample(ts: 1200, bpm: 58)]
+        XCTAssertNil(RecoveryScorer.recoveryIndexSlope(hr, start: 0, end: 1800))
+    }
+
+    func testRecoveryIndexSlopeNonAlignedEndpointCompletesTheBinGate() throws {
+        // Paired non-aligned case: end = 1750 sits mid-bin, so the endpoint sample was already in
+        // the trailing partial bin and the gate was already satisfied. Pinned so the fix is
+        // visibly confined to the aligned case.
+        let hr = [HRSample(ts: 0, bpm: 66), HRSample(ts: 300, bpm: 64),
+                  HRSample(ts: 600, bpm: 62), HRSample(ts: 900, bpm: 60),
+                  HRSample(ts: 1200, bpm: 58), HRSample(ts: 1750, bpm: 54)]
+        let slope = try XCTUnwrap(RecoveryScorer.recoveryIndexSlope(hr, start: 0, end: 1750))
+        XCTAssertEqual(slope, -27.428571428571423, accuracy: 1e-9)
+    }
+
+    func testRestingHREndpointSweepMatchesOracle() {
+        // Twin of the Kotlin RecoveryScorerWindowEndpointTest sweep: `end` walks a whole bin width
+        // and beyond, in 25 s steps, against a dense 70 bpm opening bin plus five endpoint beats at
+        // 60. Same 37 literals, from the same standalone-oracle stdout, so the oracle guards BOTH
+        // directions — a Swift-side drift fails here rather than waiting for two field logs to
+        // disagree. Note end = 300: the single closed bin holds BOTH groups (mean 69.8 → 70).
+        let expected = [62, 68, 69, 69, 70, 70, 70, 70, 70, 70, 70, 70, 70,
+                        60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60,
+                        60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60]
+        var i = 0
+        var endTs = 0
+        while endTs <= 900 {
+            var hr: [HRSample] = (0..<300).map { HRSample(ts: $0, bpm: 70) }
+            hr.append(contentsOf: (0..<5).map { _ in HRSample(ts: endTs, bpm: 60) })
+            XCTAssertEqual(RecoveryScorer.restingHR(hr, start: 0, end: endTs), expected[i],
+                           "restingHR.end=\(endTs)")
+            i += 1
+            endTs += 25
+        }
+    }
+
+    func testRecoveryIndexSlopeFullNightUnchanged() throws {
+        // Twin of the Kotlin full-night pin: a 6 h night has no sample on `end`, so the endpoint
+        // rule must not move it — the oracle's slope for a −2 bpm/hour synthetic night, to the
+        // last digit.
+        var hr: [HRSample] = []
+        var s = 0
+        while s < 6 * 3600 {
+            hr.append(HRSample(ts: s, bpm: Int((62.0 - 2.0 * Double(s) / 3600.0).rounded())))
+            s += 30
+        }
+        let slope = try XCTUnwrap(RecoveryScorer.recoveryIndexSlope(hr, start: 0, end: 6 * 3600))
+        XCTAssertEqual(slope, -2.0071001350569166, accuracy: 1e-9)
+    }
+
     // MARK: - Recovery Index / Activity-Balance folded into recovery(...)
 
     func testRecoveryIndexAndActivityBalanceDefaultNilByteIdenticalToBefore() {
diff --git a/android/app/src/main/java/com/noop/analytics/RecoveryScorer.kt b/android/app/src/main/java/com/noop/analytics/RecoveryScorer.kt
index 66db4ae3c6..23e0bddd1d 100644
--- a/android/app/src/main/java/com/noop/analytics/RecoveryScorer.kt
+++ b/android/app/src/main/java/com/noop/analytics/RecoveryScorer.kt
@@ -289,6 +289,11 @@ object RecoveryScorer {
      * samples whose ts ∈ [start, end]. Rejects single-beat dips while capturing
      * the night's true floor. Returns null when there are no HR samples in window.
      *
+     * The window is CLOSED at both ends, so the binning is too: bins are `[t, t + windowS)` except
+     * the final one, which is `[t, end]`. Half-open bins alone would admit a sample sitting
+     * exactly on an aligned `end` through the prefilter and then place it in no bin — counted as
+     * data, silently ignored. A zero-length window (`start == end`) is that single closed bin.
+     *
      * Artifact hardening (#686): a bin may only WIN the floor when it is BOTH well-populated
      * (≥ [restingHRMinBinSamples], so one lone artifact beat can't be a bin "mean") AND
      * physiologically plausible (mean ≥ [restingHRMinPlausibleBpm], rejecting dropout-driven
@@ -306,9 +311,14 @@ object RecoveryScorer {
         val means = ArrayList<Double>()      // every bin mean (legacy floor, the fallback)
         val qualified = ArrayList<Double>()  // bins eligible to WIN the floor (#686)
         var t = start
-        while (t < end) {
+        do {
+            // The last bin (its half-open end reaches or passes `end`) closes on `end` instead,
+            // catching an endpoint sample the prefilter already admitted. `seg` holds nothing past
+            // `end`, so "everything from t onwards" IS [t, end]. `do` runs once for a zero-length
+            // window, where that single closed bin is the whole window.
             val binEnd = t + restingHRWindowS
-            val win = seg.filter { it.ts >= t && it.ts < binEnd }
+            val isFinal = binEnd >= end
+            val win = seg.filter { it.ts >= t && (isFinal || it.ts < binEnd) }
             if (win.isNotEmpty()) {
                 val mean = win.sumOf { it.bpm }.toDouble() / win.size.toDouble()
                 means.add(mean)
@@ -319,7 +329,7 @@ object RecoveryScorer {
                 }
             }
             t += restingHRWindowS
-        }
+        } while (t < end)
         val floor: Double = qualified.minOrNull()
             ?: means.minOrNull()
             ?: (seg.sumOf { it.bpm }.toDouble() / seg.size.toDouble())
@@ -346,7 +356,9 @@ object RecoveryScorer {
      *
      * Computed as the least-squares slope of the SAME non-overlapping 5-minute HR bin means
      * [restingHR] uses ([restingHRWindowS]) against each bin's midpoint time (hours from
-     * `start`). NEGATIVE = declining (HR falling through the night — the physiologically
+     * `start`, and for the final closed bin still its half-open midpoint `t + windowS / 2`, so a
+     * partial or endpoint-only last bin keeps the same time axis as every other bin).
+     * NEGATIVE = declining (HR falling through the night — the physiologically
      * expected, good pattern); POSITIVE = rising (restlessness, illness, alcohol, a late
      * stimulant). Returns null when fewer than [recoveryIndexMinBins] bins have data (too
      * little of the window to fit a trend) or there are no samples at all — it never
@@ -362,16 +374,19 @@ object RecoveryScorer {
         // underlying series, one as a floor, one as a trend across it.
         val points = ArrayList<Pair<Double, Double>>() // (tHours, meanBpm)
         var t = start
-        while (t < end) {
+        do {
+            // Final bin closes on `end` — same closed-window rule as restingHR, so an
+            // endpoint sample counts toward the bin gate instead of vanishing after admission.
             val binEnd = t + restingHRWindowS
-            val win = seg.filter { it.ts >= t && it.ts < binEnd }
+            val isFinal = binEnd >= end
+            val win = seg.filter { it.ts >= t && (isFinal || it.ts < binEnd) }
             if (win.isNotEmpty()) {
                 val mean = win.sumOf { it.bpm }.toDouble() / win.size.toDouble()
                 val midpointS = (t - start).toDouble() + restingHRWindowS / 2.0
                 points.add((midpointS / 3600.0) to mean)
             }
             t += restingHRWindowS
-        }
+        } while (t < end)
         if (points.size < recoveryIndexMinBins) return null
 
         // Least-squares slope: Σ((t−t̄)(y−ȳ)) / Σ((t−t̄)²), bpm per hour.
diff --git a/android/app/src/test/java/com/noop/analytics/RecoveryScorerWindowEndpointTest.kt b/android/app/src/test/java/com/noop/analytics/RecoveryScorerWindowEndpointTest.kt
new file mode 100644
index 0000000000..89152842b8
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/RecoveryScorerWindowEndpointTest.kt
@@ -0,0 +1,147 @@
+package com.noop.analytics
+
+import com.noop.data.HrSample
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/**
+ * Tests the closed-window binning of RecoveryScorer.restingHR and RecoveryScorer.recoveryIndexSlope
+ * Both prefilter ts ∈ [start, end] but binned as [t, t+300) up to `end`, so a sample sitting
+ * exactly on an ALIGNED end was admitted and then belonged to no bin. The final bin now closes on
+ * `end`.
+ *
+ * Parity: the expected values are the verbatim stdout of the standalone Swift oracle built from the
+ * fixed Swift source (CLAUDE.md's byte-identical-by-oracle rule), not values read off this Kotlin
+ * implementation. RecoveryScorerTests.swift pins the same scenarios on the Swift side.
+ */
+class RecoveryScorerWindowEndpointTest {
+
+    private val dev = "test"
+
+    private fun hr(ts: Long, bpm: Int) = HrSample(deviceId = dev, ts = ts, bpm = bpm)
+
+    @Test
+    fun alignedEndpointSampleReachesABin() {
+        // The minimal case: start = 0, end = 300 (exactly one bin wide), five samples on
+        // the endpoint. This already returned 60 before the fix, but only because NO bin held
+        // anything and the all-sample fallback stepped in; it now flows through the bin path.
+        val samples = (0 until 5).map { hr(300L, 60) }
+        assertEquals(
+            "a sample exactly on an aligned end must belong to the final bin",
+            60, RecoveryScorer.restingHR(samples, 0L, 300L)
+        )
+    }
+
+    @Test
+    fun nonAlignedEndpointSampleReachesABin() {
+        // Paired non-aligned case: end = 450 falls mid-bin, so the endpoint sample was always
+        // inside the trailing partial bin. Same answer, before and after the fix.
+        val samples = (0 until 5).map { hr(450L, 60) }
+        assertEquals(
+            "a sample on a non-aligned end stays in the trailing partial bin",
+            60, RecoveryScorer.restingHR(samples, 0L, 450L)
+        )
+    }
+
+    @Test
+    fun endpointSampleLandsInFinalBinOnly() {
+        // The endpoint must join the LAST bin, not leak into earlier ones: a dense 70 bpm first bin
+        // plus five endpoint beats at 40 gives a floor of 40, while the 70 bpm bin is untouched.
+        // Before the fix the endpoint beats vanished and the floor read 70.
+        val samples = ArrayList<HrSample>()
+        for (i in 0 until 300) samples.add(hr(i.toLong(), 70))
+        for (i in 0 until 5) samples.add(hr(600L, 40))
+        assertEquals(
+            "the endpoint sample belongs to the final bin only",
+            40, RecoveryScorer.restingHR(samples, 0L, 600L)
+        )
+    }
+
+    @Test
+    fun degenerateZeroLengthWindow() {
+        // start == end: the single instant is one closed bin, and its mean is the same number the
+        // all-sample fallback produced before.
+        val samples = (0 until 5).map { hr(1000L, 58) }
+        assertEquals(58, RecoveryScorer.restingHR(samples, 1000L, 1000L))
+    }
+
+    @Test
+    fun restingHrEndpointSweepMatchesSwiftOracle() {
+        // `end` walks a whole bin width and beyond, in 25 s steps, against a dense 70 bpm opening
+        // bin plus five endpoint beats at 60. Verbatim Swift oracle stdout — this is the check that
+        // catches drift the eye does not, including the aligned end = 300 case where the single
+        // closed bin holds BOTH groups (mean 69.8 → 70).
+        val expected = listOf(
+            62, 68, 69, 69, 70, 70, 70, 70, 70, 70, 70, 70, 70,
+            60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60,
+            60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60
+        )
+        var i = 0
+        var endTs = 0L
+        while (endTs <= 900L) {
+            val samples = ArrayList<HrSample>()
+            for (s in 0 until 300) samples.add(hr(s.toLong(), 70))
+            for (s in 0 until 5) samples.add(hr(endTs, 60))
+            assertEquals(
+                "restingHR.end=$endTs", expected[i], RecoveryScorer.restingHR(samples, 0L, endTs)
+            )
+            i++
+            endTs += 25L
+        }
+    }
+
+    @Test
+    fun restingHrNullWithoutSamples() {
+        assertNull(RecoveryScorer.restingHR(emptyList(), 0L, 1000L))
+    }
+
+    @Test
+    fun recoveryIndexSlopeAlignedEndpointCompletesTheBinGate() {
+        // The bin-gate case: six samples over an aligned 30-minute window, the last exactly
+        // on `end`. Dropping it left five bins — one short of recoveryIndexMinBins — so the gate
+        // turned a complete window into null.
+        val samples = listOf(
+            hr(0L, 66), hr(300L, 64), hr(600L, 62), hr(900L, 60), hr(1200L, 58), hr(1800L, 54)
+        )
+        val slope = RecoveryScorer.recoveryIndexSlope(samples, 0L, 1800L)
+        assertNotNull("an admitted endpoint sample must count toward the bin gate", slope)
+        assertEquals(-27.428571428571423, slope!!, 1e-9)
+    }
+
+    @Test
+    fun recoveryIndexSlopeStillNullWithOnlyFiveBins() {
+        // The gate itself is unchanged: the same window without the endpoint sample has five bins
+        // and must stay null. Closing the final bin adds no bin where there is no sample.
+        val samples = listOf(hr(0L, 66), hr(300L, 64), hr(600L, 62), hr(900L, 60), hr(1200L, 58))
+        assertNull(RecoveryScorer.recoveryIndexSlope(samples, 0L, 1800L))
+    }
+
+    @Test
+    fun recoveryIndexSlopeNonAlignedEndpointCompletesTheBinGate() {
+        // Paired non-aligned case: end = 1750 sits mid-bin, so the endpoint sample was already in
+        // the trailing partial bin. Same slope as the aligned case (identical bin midpoints).
+        val samples = listOf(
+            hr(0L, 66), hr(300L, 64), hr(600L, 62), hr(900L, 60), hr(1200L, 58), hr(1750L, 54)
+        )
+        val slope = RecoveryScorer.recoveryIndexSlope(samples, 0L, 1750L)
+        assertNotNull(slope)
+        assertEquals(-27.428571428571423, slope!!, 1e-9)
+    }
+
+    @Test
+    fun recoveryIndexSlopeFullNightUnchanged() {
+        // A full 6 h night has no sample on `end`, so the endpoint rule must not move it: the
+        // oracle's slope for a −2 bpm/hour synthetic night, to the last digit.
+        val samples = ArrayList<HrSample>()
+        var s = 0L
+        while (s < 6 * 3600L) {
+            samples.add(hr(s, Math.round(62.0 - 2.0 * s.toDouble() / 3600.0).toInt()))
+            s += 30L
+        }
+        val slope = RecoveryScorer.recoveryIndexSlope(samples, 0L, 6 * 3600L)
+        assertNotNull(slope)
+        assertEquals(-2.0071001350569166, slope!!, 1e-9)
+    }
+}
diff --git a/docs/ANALYTICS.md b/docs/ANALYTICS.md
index a755945ea5..5c326993fd 100644
--- a/docs/ANALYTICS.md
+++ b/docs/ANALYTICS.md
@@ -190,7 +190,7 @@ HRV is the dominant driver, and NOOP needs a few nights to learn your personal b
 
 ### Resting HR (`restingHR`)
 
-"Lowest sustained HR" during the in-bed window = the **minimum of 5-minute non-overlapping bin means** of HR samples in `[start, end]`. This rejects single-beat dips while capturing the night's true floor.
+"Lowest sustained HR" during the in-bed window = the **minimum of 5-minute non-overlapping bin means** of HR samples in `[start, end]`. This rejects single-beat dips while capturing the night's true floor. The window is closed at both ends, so the bins are `[t, t + 300)` except the last one, which closes on `end` — a sample sitting exactly on an aligned `end` belongs to that final bin.
 
 ---
 

From c709a463fab548b813752313ee587644ba1e5b80 Mon Sep 17 00:00:00 2001
From: Zebsi <66969936+Zebsi235@users.noreply.github.com>
Date: Sun, 6 Sep 2026 13:45:55 +0200
Subject: [PATCH 288/333] test centre: sweep cmd 151's arguments, and record
 what an MG answers

GET_BATTERY_PACK_INFO(151) is polled on every keep-alive tick for a 5/MG, and on
a WHOOP MG it is never answered. This adds a user-triggered argument sweep in the
same read-only, Test-Centre-gated shape as the opcode 98 and 84 probes: a Devices
menu entry, a confirmation dialog, five bounded sends about 900 ms apart, each
result code logged. It feeds no live state and gates nothing.

The finding is that 151 is implemented and refusing the request rather than the
opcode. Same strap, same session: opcode 98 answers UNSUPPORTED(3) while 151
answers FAILURE(0), and commandResultLabel separates the two. The firmware has a
way to say "I do not implement that", and did not use it for 151. It also parses
the argument: first byte 0x00 draws a FAILURE, 0x01 draws silence, across five
forms and three runs. Tested with the pack attached and demonstrably charging,
the strap's own gauge rising from 80.0 to 82.2 while 151 kept answering FAILURE.

Gated harder than the neighbouring probes: opcode 151 is admitted through the
send allow-list only while a probe is actually in flight, so a default install
cannot form these bytes at all. The in-flight sentinel is set before the send,
the timeout uses an atomic compare-and-set so a reply landing just before expiry
is not overwritten, and the response hook is in-flight-guarded so a stray byte
match cannot pop the dialog.

The value is in who runs it next: the golden vectors behind BatteryPackInfo came
from a WHOOP 5 rather than an MG, so a non-MG owner running this sweep produces
the capture that would show whether the FAILURE is MG-specific. It makes no claim
about why 151 refuses, does not argue the poll should be removed, and does not
claim pack charge is unavailable on an MG.

Verified on review: BatteryPackInfo.decode bounds-checks through cmdOff + 28
before returning present, so the SoC word read is safe; the full Android suite
passes at 5,406 tests across 651 classes; and Tools/i18n_audit.py against main
reports no new gaps in any locale.

Reported, investigated and implemented by @Zebsi235, including a first reading
they retracted in the write-up after checking what this firmware's other
refusals look like.
---
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 112 ++++++++++++++++++
 .../src/main/java/com/noop/ui/AppViewModel.kt |  11 ++
 .../main/java/com/noop/ui/DevicesScreen.kt    |  96 +++++++++++++++
 .../app/src/main/res/values-de/strings.xml    |   3 +
 .../app/src/main/res/values-es/strings.xml    |   3 +
 .../app/src/main/res/values-fr/strings.xml    |   3 +
 .../app/src/main/res/values-pl/strings.xml    |   3 +
 .../src/main/res/values-pt-rPT/strings.xml    |   3 +
 .../app/src/main/res/values-ru/strings.xml    |   3 +
 .../app/src/main/res/values-zh/strings.xml    |   3 +
 android/app/src/main/res/values/strings.xml   |   3 +
 11 files changed, 243 insertions(+)

diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 81bb8aa9c9..c6c1eeecac 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -1542,6 +1542,61 @@ class WhoopBleClient(
         /** #690: persisted previous body-location payload hex, so a new capture can diff against it. */
         private const val KEY_690_PREV_PAYLOAD = "noop.690.prevPayload"
 
+        /** Sentinel value of [batteryPackProbe] between sending the cmd-151 probe and its reply landing. */
+        const val WAITING_BATTERY_PACK_PROBE = "__waiting__"
+
+        /** How long to wait for a cmd-151 COMMAND_RESPONSE before treating the silence as "no reply".
+         *  Same window as the #690 probe — long enough to ride out a mid-flight sync, short enough that
+         *  the dialog does not hang. */
+        const val BATTERY_PACK_PROBE_TIMEOUT_MS = 8_000L
+
+        /**
+         * Format a cmd-151 COMMAND_RESPONSE into a readable report for the Devices dialog + strap log.
+         * Pure, so it is unit-testable without a strap. [cmdOff] is the response-command byte offset
+         * (10 on 5/MG; a WHOOP 4.0 has no pack command at all and is not expected to answer).
+         *
+         * Reports BOTH readings of the SoC word deliberately. The tenths-of-a-percent interpretation is
+         * an UNVALIDATED CANDIDATE re-derived from two captured frames, and the same raw value is
+         * equally consistent with mAh remaining; the committed "absent" vector is all zeros, so the pair
+         * confirms the present-flag discriminator and says nothing about the unit. Asserting one reading
+         * here would be a diagnostic claiming more than it can attribute, so the raw word is shown beside
+         * both and the operator settles it with a second capture at a different pack level.
+         */
+        internal fun formatBatteryPackProbe(frame: ByteArray, cmdOff: Int): String {
+            val sb = StringBuilder()
+            sb.append("GET_BATTERY_PACK_INFO (151) response, ${frame.size} bytes, cmdOff=$cmdOff\n")
+            sb.append("raw: ${frame.joinToString("") { "%02x".format(it) }}\n\n")
+            val info = com.noop.protocol.BatteryPackInfo.decode(frame, cmdOff)
+            if (info == null) {
+                sb.append("DID NOT DECODE as a 151 SUCCESS response at this offset.\n")
+                sb.append("Either the reply is not a 151 response, or its result byte is not SUCCESS, or\n")
+                sb.append("the frame is shorter than the candidate layout needs. The raw hex above is the\n")
+                sb.append("evidence — the opcode may be right and the OFFSETS wrong.")
+                return sb.toString()
+            }
+            if (!info.present) {
+                sb.append("present = FALSE — the strap reports NO pack attached.\n")
+                sb.append("If a pack IS physically attached right now, the present-flag offset is wrong.")
+                return sb.toString()
+            }
+            sb.append("present = TRUE\n")
+            sb.append("serial  = ${info.serial ?: "<undecodable>"}\n")
+            sb.append("bt addr = ${info.btAddr ?: "<none>"}\n")
+            // Read the SoC word straight from the frame rather than reconstructing it from the decoded
+            // Double — decode() already bounds-checked this offset when it returned present=true, and a
+            // float round-trip could land the raw value one off.
+            val rawWord = (frame[cmdOff + 27].toInt() and 0xFF) or ((frame[cmdOff + 28].toInt() and 0xFF) shl 8)
+            sb.append("SoC raw word = $rawWord\n")
+            sb.append("  read as tenths-of-a-percent: ${rawWord / 10.0}%\n")
+            sb.append("  read as-is (e.g. mAh):       $rawWord\n")
+            if (rawWord > 1000) {
+                sb.append("  NOTE raw > 1000, so it CANNOT be tenths of a percent — this is not SoC%.\n")
+            }
+            sb.append("\nCompare against the pack's actual level, then capture again at a clearly\n")
+            sb.append("different level: a reading that tracks the gauge and stays <= 1000 is SoC%.")
+            return sb.toString()
+        }
+
         /** #761: sentinel value of [featureFlagProbe] while the read-only enumeration walk is running. */
         const val WAITING_FEATURE_FLAG_PROBE = "__waiting__"
 
@@ -1926,6 +1981,11 @@ class WhoopBleClient(
     private val _bodyLocationProbe = MutableStateFlow<String?>(null)
     val bodyLocationProbe: StateFlow<String?> = _bodyLocationProbe.asStateFlow()
 
+    // The cmd-151 battery-pack probe result (or the waiting sentinel), shown + copied in the Devices
+    // dialog. Read-only diagnostic: it decodes nothing into live state and gates nothing.
+    private val _batteryPackProbe = MutableStateFlow<String?>(null)
+    val batteryPackProbe: StateFlow<String?> = _batteryPackProbe.asStateFlow()
+
     // #761: the READ-ONLY feature-flag ENUMERATION report — the flag NAMES the strap's own firmware lists
     // — or the waiting sentinel while the walk runs. Nothing is written to the strap to produce it.
     private val _featureFlagProbe = MutableStateFlow<String?>(null)
@@ -4150,6 +4210,14 @@ class WhoopBleClient(
                 // probeBodyLocationAndStatus() (user-initiated, Test Centre gated); response decoded to a
                 // diagnostic report only, never gates wear/scoring. Whether 5/MG answers is a hardware check.
                 cmd != CommandNumber.GET_BODY_LOCATION_AND_STATUS &&
+                // GET_BATTERY_PACK_INFO (151) over puffin: read-only read of the pack's charge/serial.
+                // Gated HARDER than the 98/84 probes above — allowed ONLY while a probe is actually in
+                // flight, the 117/118 treatment — because unlike those two this opcode has never been
+                // sent to any strap by this app, so a default install must not be able to form these
+                // bytes at all. Driven only by probeBatteryPackInfo() (user-initiated, Test Centre
+                // gated). Whether a 5/MG answers at all is exactly the hardware question being asked.
+                !(cmd == CommandNumber.GET_BATTERY_PACK_INFO &&
+                    _batteryPackProbe.value == WAITING_BATTERY_PACK_PROBE) &&
                 // START_FF_KEY_EXCHANGE (117) / SEND_NEXT_FF (118) over puffin: the READ-ONLY feature-flag
                 // ENUMERATION probe (#761) — it reads the strap's own flag NAMES and writes no value. Gated
                 // harder than the probes above: allowed ONLY while a probe is actually in flight, so on a
@@ -4642,6 +4710,40 @@ class WhoopBleClient(
     /** Clear the #690 probe result (Devices dialog dismissed). */
     fun clearBodyLocationProbe() { _bodyLocationProbe.value = null }
 
+    /** Read-only cmd-151 probe: ask the strap for its battery pack's charge/serial/address and let the
+     *  COMMAND_RESPONSE hook decode + surface it. User-initiated (Test Centre gated). Decodes into the
+     *  dialog and the strap log ONLY — it feeds no live state and gates nothing.
+     *
+     *  KNOWN RESULT, so nobody re-runs this expecting data: on WHOOP MG fw 50.39.1.0 opcode 151 answers
+     *  FAILURE(0) whether or not a pack is attached and charging, across five argument forms. The pack
+     *  READOUT does not use this command at all — the strap volunteers the same record, unprompted, in
+     *  an uncatalogued pushed event, 0x6D (109). This probe is kept only as RE
+     *  instrumentation: the golden vectors behind `BatteryPackInfo` came from a WHOOP 5 rather than an
+     *  MG, so a non-MG owner running this is exactly the capture that would show whether the FAILURE is
+     *  MG-specific. Same read-only, Test-Centre-gated shape as the #592 and #690 probes. */
+    fun probeBatteryPackInfo() {
+        if (!_state.value.connected) {
+            log("Battery-pack probe (151) ignored — not connected")
+            return
+        }
+        // MUST be set before send(): the 5/MG allow-list admits opcode 151 only while this sentinel is
+        // in place, so setting it afterwards would have the strap's own gate drop our own probe.
+        _batteryPackProbe.value = WAITING_BATTERY_PACK_PROBE
+        log("Battery-pack probe: sending GET_BATTERY_PACK_INFO(151, read-only) on family=$connectedFamily; the decoded reply is dumped below when it lands")
+        send(CommandNumber.GET_BATTERY_PACK_INFO)
+        // Silence is itself a verdict. ATOMIC compare-and-set so a real reply landing microseconds
+        // before the timeout is never clobbered by this late "no reply".
+        handler.postDelayed({
+            val msg = "Battery-pack probe: no COMMAND_RESPONSE for opcode 151 within " +
+                "${BATTERY_PACK_PROBE_TIMEOUT_MS / 1000}s — the strap served no reply. On a WHOOP 4.0 that " +
+                "is EXPECTED (a 4.0 has no pack command; its pack reads as a VOLTAGE via opcode 98)."
+            if (_batteryPackProbe.compareAndSet(WAITING_BATTERY_PACK_PROBE, msg)) log(msg)
+        }, BATTERY_PACK_PROBE_TIMEOUT_MS)
+    }
+
+    /** Clear the cmd-151 probe result (Devices dialog dismissed). */
+    fun clearBatteryPackProbe() { _batteryPackProbe.value = null }
+
     /**
      * #761 read-only probe: ask the strap to ENUMERATE the feature-flag key names its firmware knows —
      * `START_FF_KEY_EXCHANGE(117)` for the count, then `SEND_NEXT_FF(118)` repeatedly (its body is a
@@ -7126,6 +7228,16 @@ class WhoopBleClient(
                         _bodyLocationProbe.value = text
                         if (payHex != null) NoopPrefs.of(context).edit().putString(KEY_690_PREV_PAYLOAD, payHex).apply()
                     }
+                    // cmd-151 battery-pack probe: decode the pack's charge/serial/address into the Devices
+                    // dialog and the strap log. In-flight-guarded like #690 above — 0x97 could
+                    // coincidentally be some data frame's cmd-offset byte, and this is strictly a
+                    // user-triggered diagnostic, so a stray match must never pop the result dialog.
+                    if (frame.size > cmdOff && (frame[cmdOff].toInt() and 0xFF) == CommandNumber.GET_BATTERY_PACK_INFO.rawValue &&
+                        _batteryPackProbe.value == WAITING_BATTERY_PACK_PROBE) {
+                        val text = formatBatteryPackProbe(frame, cmdOff)
+                        log("Battery-pack probe (151):\n$text")
+                        _batteryPackProbe.value = text
+                    }
                     // #761: a reply to the read-only feature-flag enumeration (117/118). In-flight-guarded
                     // inside handleFeatureFlagProbeResponse, so this is a byte compare on every other frame.
                     if (frame.size > cmdOff &&
diff --git a/android/app/src/main/java/com/noop/ui/AppViewModel.kt b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
index a567882b86..249c618903 100644
--- a/android/app/src/main/java/com/noop/ui/AppViewModel.kt
+++ b/android/app/src/main/java/com/noop/ui/AppViewModel.kt
@@ -2225,6 +2225,17 @@ class AppViewModel(app: Application) : AndroidViewModel(app) {
 
     fun clearBodyLocationProbe() = ble.clearBodyLocationProbe()
 
+    /** Read-only battery-pack probe (cmd 151) — asks the strap for its pack's charge, serial and BT
+     *  address. User-initiated, Test-Centre-gated in DevicesScreen; the decoded report goes to the
+     *  dialog + strap log only, and feeds no live state. 5/MG only in practice (a 4.0 has no pack
+     *  command), and whether a 5/MG answers at all is the hardware question being asked. */
+    fun probeBatteryPackInfo() = ble.probeBatteryPackInfo()
+
+    /** cmd-151 probe result text (null until a reply lands; waiting sentinel while in flight). */
+    val batteryPackProbe = ble.batteryPackProbe
+
+    fun clearBatteryPackProbe() = ble.clearBatteryPackProbe()
+
     /** #761: READ-ONLY feature-flag ENUMERATION probe (117 then repeated 118) — reads the flag NAMES the
      *  strap's own firmware knows and writes nothing (no SET_FF_VALUE, no value of any kind).
      *  User-initiated, Test-Centre-gated in DevicesScreen; the report goes to the dialog + strap log. */
diff --git a/android/app/src/main/java/com/noop/ui/DevicesScreen.kt b/android/app/src/main/java/com/noop/ui/DevicesScreen.kt
index 91bead4e38..59a05d4505 100644
--- a/android/app/src/main/java/com/noop/ui/DevicesScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/DevicesScreen.kt
@@ -125,6 +125,7 @@ fun DevicesScreen(
     val batteryProbeResult by viewModel.extendedBatteryProbe.collectAsStateWithLifecycle()
     // #690 body-location probe result — same non-null-shows-the-dialog contract.
     val bodyLocationProbeResult by viewModel.bodyLocationProbe.collectAsStateWithLifecycle()
+    val batteryPackProbeResult by viewModel.batteryPackProbe.collectAsStateWithLifecycle()
     // #761: the read-only feature-flag ENUMERATION report (or the waiting sentinel while it walks).
     val featureFlagProbeResult by viewModel.featureFlagProbe.collectAsStateWithLifecycle()
     // #103: the read-only device-config READ report (or the waiting sentinel while the plan runs).
@@ -156,6 +157,7 @@ fun DevicesScreen(
     var probeTarget by remember { mutableStateOf<PairedDeviceRow?>(null) }
     var batteryProbeTarget by remember { mutableStateOf<PairedDeviceRow?>(null) }
     var bodyLocationProbeTarget by remember { mutableStateOf<PairedDeviceRow?>(null) }
+    var batteryPackProbeTarget by remember { mutableStateOf<PairedDeviceRow?>(null) }
     var featureFlagProbeTarget by remember { mutableStateOf<PairedDeviceRow?>(null) }
     var deviceConfigProbeTarget by remember { mutableStateOf<PairedDeviceRow?>(null) }
     // After removing the ACTIVE device with other devices still paired, prompt to pick a new active one.
@@ -312,6 +314,13 @@ fun DevicesScreen(
                     SourceCoordinator.isWhoop(device) &&
                     TestCentre.from(context).active(TestDomain.CONNECTION)
                 ) { { bodyLocationProbeTarget = device } } else null,
+                // cmd-151 battery-pack probe: read-only, same Test Centre gate. Offered on both families
+                // even though only a 5/MG is expected to answer — a 4.0's SILENCE is itself the evidence
+                // that the pack command is 5/MG-only, and costs nothing to collect.
+                onPackInfoProbe = if (device.status == DeviceStatus.active.name && live.connected &&
+                    SourceCoordinator.isWhoop(device) &&
+                    TestCentre.from(context).active(TestDomain.CONNECTION)
+                ) { { batteryPackProbeTarget = device } } else null,
                 // #761 feature-flag ENUMERATION probe: read-only (names only, nothing written), both
                 // families. Same Test Centre gate.
                 onFeatureFlagProbe = if (device.status == DeviceStatus.active.name && live.connected &&
@@ -476,6 +485,19 @@ fun DevicesScreen(
             onDismiss = { viewModel.clearBodyLocationProbe() },
         )
     }
+    // cmd-151 battery-pack probe: read-only send + decoded pack charge/serial/address.
+    batteryPackProbeTarget?.let {
+        BatteryPackProbeDialog(
+            onSend = { viewModel.probeBatteryPackInfo(); batteryPackProbeTarget = null },
+            onDismiss = { batteryPackProbeTarget = null },
+        )
+    }
+    batteryPackProbeResult?.let { result ->
+        BatteryPackProbeResultDialog(
+            text = result,
+            onDismiss = { viewModel.clearBatteryPackProbe() },
+        )
+    }
     // #761 feature-flag ENUMERATION probe: read-only key-name listing (117 then repeated 118); no value
     // is written to the strap.
     featureFlagProbeTarget?.let {
@@ -729,6 +751,8 @@ private fun DeviceCard(
     onBatteryProbe: (() -> Unit)? = null,
     // #690 body-location opcode probe (Test Centre → Connection, both WHOOP families). Read-only.
     onBodyLocationProbe: (() -> Unit)? = null,
+    // cmd-151 battery-pack probe (Test Centre → Connection). Read-only; 5/MG answers, a 4.0 should not.
+    onPackInfoProbe: (() -> Unit)? = null,
     /** #761 feature-flag ENUMERATION probe (Test Centre → Connection, both WHOOP families). Read-only:
      *  it reads the flag NAMES the strap's firmware knows and writes nothing. */
     onFeatureFlagProbe: (() -> Unit)? = null,
@@ -853,6 +877,7 @@ private fun DeviceCard(
                     onRebootProbe = onRebootProbe,
                     onBatteryProbe = onBatteryProbe,
                     onBodyLocationProbe = onBodyLocationProbe,
+                    onPackInfoProbe = onPackInfoProbe,
                     onFeatureFlagProbe = onFeatureFlagProbe,
                 onAbortSync = onAbortSync,
                     onDeviceConfigProbe = onDeviceConfigProbe,
@@ -977,6 +1002,7 @@ private fun DeviceActionsMenu(
     onRebootProbe: (() -> Unit)? = null,
     onBatteryProbe: (() -> Unit)? = null,
     onBodyLocationProbe: (() -> Unit)? = null,
+    onPackInfoProbe: (() -> Unit)? = null,
     /** #761 feature-flag ENUMERATION probe (Test Centre → Connection, both WHOOP families). Read-only:
      *  it reads the flag NAMES the strap's firmware knows and writes nothing. */
     onFeatureFlagProbe: (() -> Unit)? = null,
@@ -1048,6 +1074,10 @@ private fun DeviceActionsMenu(
                 if (onBodyLocationProbe != null) {
                     MenuItem(uiString(R.string.l10n_devices_screen_body_location_probe_690_re_7def8c39), Icons.Filled.BugReport) { onOpenChange(false); onBodyLocationProbe() }
                 }
+                // Read-only battery-pack probe (cmd 151) — decodes the pack's charge/serial/address.
+                if (onPackInfoProbe != null) {
+                    MenuItem(uiString(R.string.l10n_devices_screen_battery_pack_probe_151_re_d722af00), Icons.Filled.BugReport) { onOpenChange(false); onPackInfoProbe() }
+                }
                 // #761 feature-flag ENUMERATION probe (RE): read-only key-name listing, both families.
                 if (onAbortSync != null) {
                     MenuItem(uiString(R.string.l10n_devices_screen_stop_sync_4a1f2b6e), Icons.Filled.StopCircle) { onOpenChange(false); onAbortSync() }
@@ -1304,6 +1334,72 @@ private fun BodyLocationProbeDialog(
     )
 }
 
+/** Confirmation for the read-only cmd-151 battery-pack probe. Nothing is written to the strap. */
+@Composable
+private fun BatteryPackProbeDialog(
+    onSend: () -> Unit,
+    onDismiss: () -> Unit,
+) {
+    AlertDialog(
+        onDismissRequest = onDismiss,
+        containerColor = Palette.surfaceOverlay,
+        title = { Text(uiString(R.string.l10n_devices_screen_battery_pack_probe_151_re_d722af00), style = NoopType.title2, color = Palette.textPrimary) },
+        text = {
+            Text(
+                uiString(R.string.l10n_devices_screen_battery_pack_probe_explainer_40b3470d),
+                style = NoopType.subhead,
+                color = Palette.textSecondary,
+            )
+        },
+        confirmButton = {
+            TextButton(onClick = onSend) {
+                Text(uiString(R.string.l10n_devices_screen_send_probe_read_only_36b318bc), style = NoopType.body, color = Palette.accent)
+            }
+        },
+        dismissButton = {
+            TextButton(onClick = onDismiss) {
+                Text(uiString(R.string.l10n_devices_screen_cancel_77dfd213), style = NoopType.body, color = Palette.textSecondary)
+            }
+        },
+    )
+}
+
+/** cmd-151 probe result: raw hex plus the decoded pack record (or a "waiting…" state), with a Copy
+ *  button. Read-only; dismiss clears the result. */
+@Composable
+private fun BatteryPackProbeResultDialog(
+    text: String,
+    onDismiss: () -> Unit,
+) {
+    val clipboard = LocalClipboardManager.current
+    val waiting = text == WhoopBleClient.WAITING_BATTERY_PACK_PROBE
+    val shown = if (waiting) uiString(R.string.l10n_devices_screen_waiting_for_the_straps_reply_5a06e7ac) else text
+    AlertDialog(
+        onDismissRequest = onDismiss,
+        containerColor = Palette.surfaceOverlay,
+        title = { Text(uiString(R.string.l10n_devices_screen_battery_pack_probe_result_151_df43dff2), style = NoopType.title2, color = Palette.textPrimary) },
+        text = {
+            Column(modifier = Modifier.heightIn(max = 360.dp).verticalScroll(rememberScrollState())) {
+                SelectionContainer {
+                    Text(shown, style = if (waiting) NoopType.subhead else NoopType.mono, color = Palette.textSecondary)
+                }
+            }
+        },
+        confirmButton = {
+            if (!waiting) {
+                TextButton(onClick = { clipboard.setText(AnnotatedString(text)) }) {
+                    Text(uiString(R.string.l10n_devices_screen_copy_af74f7c5), style = NoopType.body, color = Palette.accent)
+                }
+            }
+        },
+        dismissButton = {
+            TextButton(onClick = onDismiss) {
+                Text(uiString(R.string.l10n_devices_screen_close_bbfa773e), style = NoopType.body, color = Palette.textSecondary)
+            }
+        },
+    )
+}
+
 /** #690 probe result: raw hex + decoded body-location record (or a "waiting…" state), with a Copy button.
  *  Read-only; dismiss clears the result. Twin of the Swift BodyLocationProbeResultView. */
 @Composable
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 78ef8e7c92..467eb31902 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -450,6 +450,9 @@
     <string name="l10n_devices_screen_body_location_probe_690_re_7def8c39">Körperpositions-Test (#690 RE)…</string>
     <string name="l10n_devices_screen_body_location_probe_result_690_60c5ee79">Ergebnis des Körperpositions-Tests (#690)</string>
     <string name="l10n_devices_screen_body_location_probe_explainer_a9363239">Sendet den nur lesenden Körperpositions-Befehl (0x54) und schreibt die vollständige Rohantwort des Bands ins Strap-Log, wobei der Datensatz (Revision / Position / Konfidenz / Status) auf der WHOOP 4.0 dekodiert wird. Es wird nichts auf das Band geschrieben, und Trageerkennung oder Bewertung werden nie verändert.</string>
+    <string name="l10n_devices_screen_battery_pack_probe_151_re_d722af00">Akkupack-Test (151 RE)…</string>
+    <string name="l10n_devices_screen_battery_pack_probe_result_151_df43dff2">Ergebnis des Akkupack-Tests (151)</string>
+    <string name="l10n_devices_screen_battery_pack_probe_explainer_40b3470d">Sendet den nur lesenden Akkupack-Befehl (151) und dekodiert die Antwort des Bands — Ladestand, Seriennummer und Bluetooth-Adresse des Akkupacks. Es wird nichts auf das Band geschrieben und nichts fließt in deine Daten. Eine WHOOP 4.0 hat keinen Akkupack-Befehl und bleibt erwartungsgemäß stumm; dieses Schweigen ist selbst ein nützliches Ergebnis.</string>
     <string name="l10n_devices_screen_delete_this_device_s_data_3cae7a2a">Daten dieses Geräts löschen…</string>
     <string name="l10n_devices_screen_disconnect_ed28e068">Trennen</string>
     <string name="l10n_devices_screen_feature_flag_probe_761_re_21241d68">Feature-Flag-Test (#761 RE)…</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 14088a8057..cbf5792b9e 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -250,6 +250,9 @@
     <string name="l10n_devices_screen_body_location_probe_690_re_7def8c39">Sonda de posición corporal (#690 RE)…</string>
     <string name="l10n_devices_screen_body_location_probe_result_690_60c5ee79">Resultado de la sonda de posición corporal (#690)</string>
     <string name="l10n_devices_screen_body_location_probe_explainer_a9363239">Envía el comando de posición corporal de solo lectura (0x54) y vuelca la respuesta cruda completa de la banda al registro, decodificando el registro (revisión / posición / confianza / estado) en la WHOOP 4.0. No se escribe nada en la banda y nunca cambia la detección de uso ni la puntuación.</string>
+    <string name="l10n_devices_screen_battery_pack_probe_151_re_d722af00">Prueba del pack de batería (151 RE)…</string>
+    <string name="l10n_devices_screen_battery_pack_probe_result_151_df43dff2">Resultado de la prueba del pack de batería (151)</string>
+    <string name="l10n_devices_screen_battery_pack_probe_explainer_40b3470d">Envía el comando de solo lectura del pack de batería (151) y descodifica la respuesta de la banda: carga, número de serie y dirección Bluetooth del pack. No se escribe nada en la banda y nada afecta a tus datos. Una WHOOP 4.0 no tiene comando de pack y se espera que no responda; ese silencio también es un resultado útil.</string>
     <string name="l10n_devices_screen_delete_this_device_s_data_3cae7a2a">Eliminar los datos de este dispositivo…</string>
     <string name="l10n_devices_screen_disconnect_ed28e068">Desconectar</string>
     <string name="l10n_devices_screen_feature_flag_probe_761_re_21241d68">Sonda de indicadores de función (#761 RE)…</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 17814b8eaa..36fc334434 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -268,6 +268,9 @@
     <string name="l10n_devices_screen_body_location_probe_690_re_7def8c39">Sonde de position corporelle (#690 RE)…</string>
     <string name="l10n_devices_screen_body_location_probe_result_690_60c5ee79">Résultat de la sonde de position corporelle (#690)</string>
     <string name="l10n_devices_screen_body_location_probe_explainer_a9363239">Envoie la commande de position corporelle en lecture seule (0x54) et consigne la réponse brute complète du bracelet dans le journal, en décodant l\'enregistrement (révision / position / confiance / état) sur la WHOOP 4.0. Rien n\'est écrit sur le bracelet, et la détection de port ou la notation ne sont jamais modifiées.</string>
+    <string name="l10n_devices_screen_battery_pack_probe_151_re_d722af00">Test du pack de batterie (151 RE)…</string>
+    <string name="l10n_devices_screen_battery_pack_probe_result_151_df43dff2">Résultat du test du pack de batterie (151)</string>
+    <string name="l10n_devices_screen_battery_pack_probe_explainer_40b3470d">Envoie la commande en lecture seule du pack de batterie (151) et décode la réponse du bracelet : charge, numéro de série et adresse Bluetooth du pack. Rien n\'est écrit sur le bracelet et rien n\'alimente tes données. Une WHOOP 4.0 n\'a pas de commande de pack et devrait rester silencieuse ; ce silence est lui-même un résultat utile.</string>
     <string name="l10n_devices_screen_delete_this_device_s_data_3cae7a2a">Supprimer les données de cet appareil…</string>
     <string name="l10n_devices_screen_disconnect_ed28e068">Déconnecter</string>
     <string name="l10n_devices_screen_feature_flag_probe_761_re_21241d68">Sonde des indicateurs de fonction (#761 RE)…</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index ea16906b49..a5ff9d4e0e 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -415,6 +415,9 @@
     <string name="l10n_devices_screen_body_location_probe_690_re_7def8c39">Sonda do lokalizacji ciała (#690 RE)…</string>
     <string name="l10n_devices_screen_body_location_probe_result_690_60c5ee79">Wynik sondy lokalizacji ciała (#690)</string>
     <string name="l10n_devices_screen_body_location_probe_explainer_a9363239">Wysyła polecenie lokalizacji ciała tylko do odczytu (0x54) i zrzuca pełną nieprzetworzoną odpowiedź paska do dziennika paska, dekodując zapis (wersja/lokalizacja/pewność/status) w WHOOP 4.0. Nic nie jest zapisane na pasku i nigdy nie zmienia sposobu wykrywania zużycia ani punktacji.</string>
+    <string name="l10n_devices_screen_battery_pack_probe_151_re_d722af00">Test pakietu baterii (151 RE)…</string>
+    <string name="l10n_devices_screen_battery_pack_probe_result_151_df43dff2">Wynik testu pakietu baterii (151)</string>
+    <string name="l10n_devices_screen_battery_pack_probe_explainer_40b3470d">Wysyła tylko do odczytu polecenie pakietu baterii (151) i dekoduje odpowiedź opaski — poziom naładowania, numer seryjny i adres Bluetooth pakietu. Nic nie jest zapisywane na opasce i nic nie trafia do Twoich danych. WHOOP 4.0 nie ma polecenia pakietu i zgodnie z oczekiwaniami milczy; samo to milczenie jest użytecznym wynikiem.</string>
     <string name="l10n_devices_screen_feature_flag_probe_761_re_21241d68">Sonda z flagą funkcji (#761 RE)…</string>
     <string name="l10n_devices_screen_stop_sync_4a1f2b6e">Zatrzymaj synchronizację</string>
     <string name="l10n_devices_screen_feature_flag_probe_result_761_c50ef4d4">Wynik sondy z flagą funkcji (nr 761)</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 6e0b5ac165..bd7ac97e2e 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -415,6 +415,9 @@
     <string name="l10n_devices_screen_body_location_probe_690_re_7def8c39">Sonda de localização corporal (#690 RE)…</string>
     <string name="l10n_devices_screen_body_location_probe_result_690_60c5ee79">Resultado da sonda de localização corporal (#690)</string>
     <string name="l10n_devices_screen_body_location_probe_explainer_a9363239">Envia o comando body-location de leitura apenas (0x54) e regista a resposta bruta completa do bracelete no registo da bracelete, descodificando o registo (revisão/localização/confiança/estado) no WHOOP 4.0. Nada é escrito na bracelete e nunca altera a deteção ou pontuação de desgaste.</string>
+    <string name="l10n_devices_screen_battery_pack_probe_151_re_d722af00">Teste do pack de bateria (151 RE)…</string>
+    <string name="l10n_devices_screen_battery_pack_probe_result_151_df43dff2">Resultado do teste do pack de bateria (151)</string>
+    <string name="l10n_devices_screen_battery_pack_probe_explainer_40b3470d">Envia o comando só de leitura do pack de bateria (151) e descodifica a resposta da banda — carga, número de série e endereço Bluetooth do pack. Nada é escrito na banda e nada alimenta os teus dados. Uma WHOOP 4.0 não tem comando de pack e deverá permanecer silenciosa; esse silêncio é, em si, um resultado útil.</string>
     <string name="l10n_devices_screen_delete_this_device_s_data_3cae7a2a">Eliminar os dados deste dispositivo…</string>
     <string name="l10n_devices_screen_disconnect_ed28e068">Desconectar</string>
     <string name="l10n_devices_screen_feature_flag_probe_761_re_21241d68">Sonda de sinalizadores de funcionalidade (#761 RE)…</string>
diff --git a/android/app/src/main/res/values-ru/strings.xml b/android/app/src/main/res/values-ru/strings.xml
index facf716042..2f97055b71 100644
--- a/android/app/src/main/res/values-ru/strings.xml
+++ b/android/app/src/main/res/values-ru/strings.xml
@@ -2614,4 +2614,7 @@
     <string name="units_kilometres">Километры</string>
     <string name="units_miles">Мили</string>
     <string name="units_follow_body">Как для параметров тела</string>
+    <string name="l10n_devices_screen_battery_pack_probe_151_re_d722af00">Проба батарейного блока (151 RE)…</string>
+    <string name="l10n_devices_screen_battery_pack_probe_result_151_df43dff2">Результат пробы батарейного блока (151)</string>
+    <string name="l10n_devices_screen_battery_pack_probe_explainer_40b3470d">Отправляет команду батарейного блока только для чтения (151) и декодирует ответ браслета — заряд блока, серийный номер и Bluetooth-адрес. На браслет ничего не записывается, и это не влияет на ваши данные. У WHOOP 4.0 нет команды блока, и ожидается молчание; само это молчание — полезный результат.</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 64c56c8086..e10ce1bbf9 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2644,4 +2644,7 @@
     <string name="units_kilometres">公里</string>
     <string name="units_miles">英里</string>
     <string name="units_follow_body">跟随身体测量</string>
+    <string name="l10n_devices_screen_battery_pack_probe_151_re_d722af00">电池盒探测 (151 RE)…</string>
+    <string name="l10n_devices_screen_battery_pack_probe_result_151_df43dff2">电池盒探测结果 (151)</string>
+    <string name="l10n_devices_screen_battery_pack_probe_explainer_40b3470d">发送只读的电池盒命令 (151) 并解码手环的回复——电池盒的电量、序列号和蓝牙地址。不会向手环写入任何内容，也不会影响您的数据。WHOOP 4.0 没有电池盒命令，预期会保持静默；这种静默本身就是有用的结果。</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index f3f81e3ab8..4bbf99d8d9 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -540,6 +540,9 @@
     <string name="l10n_devices_screen_battery_clamped_2494c8c9">Battery %1$s%%</string>
     <string name="l10n_devices_screen_battery_info_probe_592_re_1dbd4c0f">Battery-info probe (#592 RE)…</string>
     <string name="l10n_devices_screen_battery_info_probe_result_592_b97c0bb8">Battery-info probe result (#592)</string>
+    <string name="l10n_devices_screen_battery_pack_probe_151_re_d722af00">Battery-pack probe (151 RE)…</string>
+    <string name="l10n_devices_screen_battery_pack_probe_result_151_df43dff2">Battery-pack probe result (151)</string>
+    <string name="l10n_devices_screen_battery_pack_probe_explainer_40b3470d">Sends the read-only battery-pack command (151) and decodes the strap\'s reply — the pack\'s charge, serial and Bluetooth address. Nothing is written to the strap and nothing feeds your data. A WHOOP 4.0 has no pack command and is expected to stay silent; that silence is itself a useful result.</string>
     <string name="l10n_devices_screen_body_location_probe_690_re_7def8c39">Body-location probe (#690 RE)…</string>
     <string name="l10n_devices_screen_body_location_probe_result_690_60c5ee79">Body-location probe result (#690)</string>
     <string name="l10n_devices_screen_body_location_probe_explainer_a9363239">Sends the read-only body-location command (0x54) and dumps the strap\'s full raw reply to the strap log, decoding the record (revision / location / confidence / status) on WHOOP 4.0. Nothing is written to the strap, and it never changes wear detection or scoring.</string>

From 744a8b9fb35fb3812f62923ba1003e9c01f38892 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Sun, 6 Sep 2026 23:54:26 +1200
Subject: [PATCH 289/333] test centre: keep the pack probe's serial and address
 out of both its sinks

test centre: keep the pack probe's serial and address out of both its sinks

The cmd-151 probe's report printed the pack's serial and BT address verbatim.
That report reaches two places a user shares: the exportable strap log, and a
Devices dialog with a copy-to-clipboard button.

Neither identifier survived on its own merits, because neither was ever reached
by the scrubber. redactStrapLogPii keys its serial rule on a literal "WHOOP "
prefix, so a bare `serial  = BB5AP...` matches nothing, and it keys its MAC rule
on colons, which btAddr's colon-less joinToString("") never produces. Running
the real scrubber over the real report leaves both in the clear.

The pack-log line in handleCommandResponse already carried this exact lesson,
about this exact decoder, and says so in a comment: logSafe, not the raw serial,
because the rule that protects the strap's serial would let the pack's through.
The probe undid it a hundred lines away.

So both are masked at the SOURCE, where the dialog is covered too: logSafe for
the serial, first-and-last-octet for the address. The dialog value now also goes
through redactStrapLogPii, which is what lifts the serial back out of the raw
hex dump that the source-level masking cannot reach.

The raw dump keeps every byte except the six address bytes, and only once decode
has confirmed the layout. When decode returns null the offsets are precisely what
is in question, so blanking a guessed range there would destroy the evidence the
probe exists to collect. A test pins that too.

Six tests, in the shape of PiiRedactionTest: neither identifier reaches the
report, enough of each survives to tell two packs apart, scrubbing clears the
serial from the hex dump, an undecodable frame keeps its bytes, an absent pack
reports no identity, and the mask handles null/short input.

Android suite 5427 tests green.
---
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 53 +++++++++--
 .../noop/ble/BatteryPackProbeRedactionTest.kt | 89 +++++++++++++++++++
 2 files changed, 137 insertions(+), 5 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ble/BatteryPackProbeRedactionTest.kt

diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index c6c1eeecac..d42c3001fc 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -1550,6 +1550,30 @@ class WhoopBleClient(
          *  the dialog does not hang. */
         const val BATTERY_PACK_PROBE_TIMEOUT_MS = 8_000L
 
+        /**
+         * Blank the pack's six address bytes inside the raw frame dump, leaving every other byte
+         * readable. [cmdOff] + 5 is the address offset the decoder uses; [decoded] gates the edit so a
+         * frame that did NOT decode keeps all of its bytes, offsets being the open question there.
+         */
+        internal fun maskPackAddrInDump(rawHex: String, cmdOff: Int, decoded: Boolean): String {
+            if (!decoded) return rawHex
+            val from = (cmdOff + 5) * 2
+            val to = from + 12
+            if (from < 0 || to > rawHex.length) return rawHex
+            return rawHex.substring(0, from) + "••••••••••••" + rawHex.substring(to)
+        }
+
+        /**
+         * First and last octet of a pack's BT address, the rest masked — the same shape
+         * `redactStrapLogPii` gives a colon-formatted MAC, applied at the SOURCE because this report
+         * also reaches a copy-to-clipboard dialog that the scrubber never sees.
+         */
+        internal fun maskPackBtAddr(btAddr: String?): String {
+            if (btAddr.isNullOrEmpty()) return "<none>"
+            if (btAddr.length != 12) return "<malformed>"
+            return "${btAddr.take(2)}:••:••:••:••:${btAddr.takeLast(2)}"
+        }
+
         /**
          * Format a cmd-151 COMMAND_RESPONSE into a readable report for the Devices dialog + strap log.
          * Pure, so it is unit-testable without a strap. [cmdOff] is the response-command byte offset
@@ -1564,9 +1588,16 @@ class WhoopBleClient(
          */
         internal fun formatBatteryPackProbe(frame: ByteArray, cmdOff: Int): String {
             val sb = StringBuilder()
-            sb.append("GET_BATTERY_PACK_INFO (151) response, ${frame.size} bytes, cmdOff=$cmdOff\n")
-            sb.append("raw: ${frame.joinToString("") { "%02x".format(it) }}\n\n")
             val info = com.noop.protocol.BatteryPackInfo.decode(frame, cmdOff)
+            sb.append("GET_BATTERY_PACK_INFO (151) response, ${frame.size} bytes, cmdOff=$cmdOff\n")
+            // The dump is the evidence, so it stays whole EXCEPT the six address bytes, and only once
+            // `decode` has confirmed the layout. `redactStrapLogPii` lifts the serial out of a hex run
+            // but has no rule that can reach a colon-less address, so without this the pack's MAC ships
+            // in both sinks even after scrubbing. Masked at a KNOWN offset only: when decode returned
+            // null the offsets are precisely what is in question, and blanking a guessed range there
+            // would destroy the evidence the operator opened this probe to read.
+            val rawHex = frame.joinToString("") { "%02x".format(it) }
+            sb.append("raw: ${maskPackAddrInDump(rawHex, cmdOff, info != null && info.present)}\n\n")
             if (info == null) {
                 sb.append("DID NOT DECODE as a 151 SUCCESS response at this offset.\n")
                 sb.append("Either the reply is not a 151 response, or its result byte is not SUCCESS, or\n")
@@ -1580,8 +1611,16 @@ class WhoopBleClient(
                 return sb.toString()
             }
             sb.append("present = TRUE\n")
-            sb.append("serial  = ${info.serial ?: "<undecodable>"}\n")
-            sb.append("bt addr = ${info.btAddr ?: "<none>"}\n")
+            // logSafe + a masked address, NOT the raw pair. This report goes to the SHAREABLE strap log
+            // AND to a dialog with a copy button, and neither identifier survives contact with the
+            // scrubber: `redactStrapLogPii` keys the serial rule on a literal "WHOOP " prefix (a bare
+            // `serial  = BB5AP…` matches nothing) and keys the MAC rule on COLONS, which `btAddr`'s
+            // colon-less `joinToString("")` never produces. The pack-log line in
+            // `handleCommandResponse` already learned this and says so; a probe that prints them raw
+            // would walk both straight back out. Three characters tell two packs apart, and the first
+            // and last octet tell two addresses apart, which is all a diagnostic needs.
+            sb.append("serial  = ${com.noop.data.WhoopSerialIdentity.logSafe(info.serial)}\n")
+            sb.append("bt addr = ${maskPackBtAddr(info.btAddr)}\n")
             // Read the SoC word straight from the frame rather than reconstructing it from the decoded
             // Double — decode() already bounds-checked this offset when it returned present=true, and a
             // float round-trip could land the raw value one off.
@@ -7236,7 +7275,11 @@ class WhoopBleClient(
                         _batteryPackProbe.value == WAITING_BATTERY_PACK_PROBE) {
                         val text = formatBatteryPackProbe(frame, cmdOff)
                         log("Battery-pack probe (151):\n$text")
-                        _batteryPackProbe.value = text
+                        // Scrub the DIALOG copy too. log() already redacts on the way to the strap log,
+                        // but this value is rendered behind a copy-to-clipboard button, so it is a second
+                        // sink the scrubber otherwise never sees — and the `raw:` frame dump carries the
+                        // serial as ASCII inside the hex, which is exactly what redactStrapLogPii masks.
+                        _batteryPackProbe.value = redactStrapLogPii(text)
                     }
                     // #761: a reply to the read-only feature-flag enumeration (117/118). In-flight-guarded
                     // inside handleFeatureFlagProbeResponse, so this is a byte compare on every other frame.
diff --git a/android/app/src/test/java/com/noop/ble/BatteryPackProbeRedactionTest.kt b/android/app/src/test/java/com/noop/ble/BatteryPackProbeRedactionTest.kt
new file mode 100644
index 0000000000..26770c5c3c
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ble/BatteryPackProbeRedactionTest.kt
@@ -0,0 +1,89 @@
+package com.noop.ble
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The cmd-151 pack probe must not publish the pack's identity.
+ *
+ * Its report reaches TWO sinks: the shareable strap log, and a Devices dialog with a
+ * copy-to-clipboard button. [redactStrapLogPii] guards only the first, and it would not have caught
+ * either identifier anyway — the serial rule keys on a literal "WHOOP " prefix, so a bare
+ * `serial  = BB5AP…` matches nothing, and the MAC rule keys on COLONS, which `btAddr`'s colon-less
+ * `joinToString("")` never produces. So both are masked at the SOURCE instead. The pack-log line in
+ * `handleCommandResponse` already carried that lesson; these tests keep a probe from undoing it.
+ */
+class BatteryPackProbeRedactionTest {
+
+    /** A well-formed 151 SUCCESS frame at cmdOff=10 carrying a known address, serial and SoC word. */
+    private fun frameWith(mac: ByteArray, serial: String, soc: Int): ByteArray {
+        val f = ByteArray(45)
+        f[10] = 151.toByte()
+        f[12] = 1          // result = SUCCESS
+        f[14] = 1          // present = true
+        mac.copyInto(f, 15)
+        serial.toByteArray(Charsets.US_ASCII).copyInto(f, 21)
+        f[37] = (soc and 0xFF).toByte()
+        f[38] = ((soc shr 8) and 0xFF).toByte()
+        return f
+    }
+
+    private val mac = byteArrayOf(0xC4.toByte(), 0x9D.toByte(), 0xED.toByte(), 0x11, 0x22, 0x33)
+    private val serial = "WHOOP5A1B2C3D4E"
+
+    @Test fun reportNeverCarriesTheFullSerialOrAddress() {
+        val report = WhoopBleClient.formatBatteryPackProbe(frameWith(mac, serial, 812), 10)
+        assertFalse("the full pack serial must never reach the report", report.contains(serial))
+        assertFalse("the full pack address must never reach the report", report.contains("c49ded112233"))
+    }
+
+    /** Masked, not merely absent: a diagnostic still has to tell two packs and two addresses apart. */
+    @Test fun reportKeepsEnoughToDistinguishTwoPacks() {
+        val report = WhoopBleClient.formatBatteryPackProbe(frameWith(mac, serial, 812), 10)
+        assertTrue("a serial prefix is what distinguishes two packs", report.contains("serial  = WHO"))
+        assertTrue("first and last octet distinguish two addresses", report.contains("c4:••:••:••:••:33"))
+        // The finding itself must survive redaction — this is what the probe exists to collect.
+        assertTrue(report.contains("SoC raw word = 812"))
+    }
+
+    /**
+     * The dialog sink is scrubbed too. The `raw:` frame dump carries the serial as ASCII inside the
+     * hex, which the source-level masking above cannot touch and only the scrubber removes.
+     */
+    @Test fun scrubbingTheReportRemovesTheSerialFromTheRawHexDump() {
+        val report = WhoopBleClient.formatBatteryPackProbe(frameWith(mac, serial, 812), 10)
+        val hexSerial = serial.toByteArray(Charsets.US_ASCII).joinToString("") { "%02x".format(it) }
+        assertTrue("precondition: the raw dump does embed the serial", report.contains(hexSerial))
+        assertFalse("the value shown in the dialog must not", redactStrapLogPii(report).contains(hexSerial))
+    }
+
+    /** A frame that did not decode keeps every byte: there, the offsets are the open question. */
+    @Test fun anUndecodableFrameKeepsItsBytesForEvidence() {
+        val f = ByteArray(45)
+        f[10] = 151.toByte(); f[12] = 9   // result != SUCCESS -> decode() returns null
+        mac.copyInto(f, 15)
+        val report = WhoopBleClient.formatBatteryPackProbe(f, 10)
+        assertTrue(report.contains("DID NOT DECODE"))
+        assertTrue("the dump must stay whole when the layout is unconfirmed",
+            report.contains("c49ded112233"))
+    }
+
+    @Test fun maskedAddressHandlesMissingAndMalformedInput() {
+        assertEquals("<none>", WhoopBleClient.maskPackBtAddr(null))
+        assertEquals("<none>", WhoopBleClient.maskPackBtAddr(""))
+        assertEquals("<malformed>", WhoopBleClient.maskPackBtAddr("c49ded"))
+        assertEquals("c4:••:••:••:••:33", WhoopBleClient.maskPackBtAddr("c49ded112233"))
+    }
+
+    /** An absent pack reports absence and no identity at all. */
+    @Test fun absentPackReportsNoIdentifiers() {
+        val f = ByteArray(45)
+        f[10] = 151.toByte(); f[12] = 1; f[14] = 0
+        val report = WhoopBleClient.formatBatteryPackProbe(f, 10)
+        assertTrue(report.contains("present = FALSE"))
+        assertFalse(report.contains("serial  ="))
+        assertFalse(report.contains("bt addr ="))
+    }
+}

From ff103face9377bdaf46bff8b47504d37c2015458 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 00:17:03 +1200
Subject: [PATCH 290/333] devices: show the battery pack's charge, from an
 event the strap already sends

There was no way to see how full the WHOOP battery pack is, anywhere in the app.
The command path could not supply one: #1303 decodes GET_BATTERY_PACK_INFO(151)
but deliberately shows nothing, because its offsets were an unvalidated candidate
re-derived from two frames, and on a WHOOP MG that opcode answers FAILURE(0) in
every state and under every argument form tried.

No command is needed. The strap volunteers the whole record, unprompted, every
couple of minutes while a pack is attached, in an uncatalogued event, 0x6D (109).
Its 32-byte payload matches the BatteryPackInfo field layout offset for offset,
so the clean-room WHOOP 5 offsets are confirmed on MG hardware by a transport
nobody had looked at.

The SoC unit is tenths of a percent on three independent lines, not one
plausible-looking value: a falling series tracking a real physical process
(57.1 -> 56.9 -> 56.7 % as the pack drained into the strap, whose own charge rose
over the same window), a 12-hour monotonic decline from 56.4 to 42.6 % with the
serial constant across it, and the strap's own console printing
`NFC COMMS: BPK SoC : 422` against a decode of 426 six hours earlier.

One record decoder serves both transports: decodeRecord is extracted so the
command reply and the pushed event cannot drift into two different readings of
one pack, and a test asserts they agree field for field. Display is gated on
#1303's own Info.displayable rather than a second copy of that rule. The event is
matched on the event BYTE at frame offset 10, not the rendered label, because an
uncatalogued event reads as 0x6D(109) only while nothing names it and a future
EventNumber entry would silently break a string match. The reading clears on
BATTERY_PACK_REMOVED and on disconnect, and because the event repeats it is a
level signal that re-establishes itself after a reconnect rather than an edge
that can be missed. No new opcode, no send-allowlist entry, no polling, no wire
traffic.

Verified on review rather than taken on trust: the offset refactor is
behaviour-preserving, since decodeRecord(frame, cmdOff + 4) with base +1/+7/+23
reproduces the previous +5/+11/+27 exactly; the payload start of 16 and the
event byte at 10 both agree with Framing on each platform, which follows from
event_timestamp being a u32 at offset 12; an uncatalogued event does reach the
handler, and the new block sits inside the live-only guard so a replayed offload
event cannot move the readout; and the l10n key is correctly derived, being
sha1("Pack %1$.1f%%") truncated to 0e9589da, with a positional format.

Rebased onto main for a values-zh conflict against the cmd-151 probe strings.
Both sides were pure appends and all four strings are kept in append order.

Known and accepted: the de, es, fr, pl and pt-PT values are the English word
"Pack". The echo gate cannot see this, because after stripping format specifiers
the string is a single word and falls below its two-word floor, so a green audit
is silence rather than approval here. The Apple app target is not written either;
only the pure decoder is ported, and the card is a separate parity change.

Investigated, decoded and implemented by @Zebsi235.
---
 .../WhoopProtocol/BatteryPackInfo.swift       | 74 ++++++++++++----
 .../BatteryPackInfoTests.swift                | 38 +++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 55 +++++++++++-
 .../java/com/noop/protocol/BatteryPackInfo.kt | 85 +++++++++++++++----
 .../main/java/com/noop/ui/DevicesScreen.kt    | 13 +++
 .../app/src/main/res/values-de/strings.xml    |  1 +
 .../app/src/main/res/values-es/strings.xml    |  1 +
 .../app/src/main/res/values-fr/strings.xml    |  1 +
 .../app/src/main/res/values-pl/strings.xml    |  1 +
 .../src/main/res/values-pt-rPT/strings.xml    |  1 +
 .../app/src/main/res/values-ru/strings.xml    |  1 +
 .../app/src/main/res/values-zh/strings.xml    |  1 +
 android/app/src/main/res/values/strings.xml   |  1 +
 .../com/noop/protocol/BatteryPackInfoTest.kt  | 44 ++++++++++
 14 files changed, 283 insertions(+), 34 deletions(-)

diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/BatteryPackInfo.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/BatteryPackInfo.swift
index 01d05fc8d0..f203fb5ec3 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/BatteryPackInfo.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/BatteryPackInfo.swift
@@ -50,30 +50,70 @@ public enum BatteryPackInfo {
         }
     }
 
+    /// Offset of the present flag inside the event-109 payload.
+    public static let eventRecordBase = 4
+
+    /// Where a WHOOP 5/MG EVENT frame's opaque payload begins. Mirrors `Framing.decodeEventWhoop5`.
+    public static let whoop5EventPayloadStart = 16
+
+    /// The uncatalogued 5/MG event that carries the pack record. Named here because `EventNumber` has no
+    /// entry for it — it decodes as `0x6D(109)`.
+    public static let packInfoEvent = 109
+
+    /// Decode the pack RECORD itself, given the offset of its present-flag byte.
+    ///
+    /// Split out from `decode` because the same record reaches us by two entirely different transports: as
+    /// the payload of a `GET_BATTERY_PACK_INFO` (151) COMMAND_RESPONSE, and — hardware-confirmed on WHOOP MG
+    /// fw 50.39.1.0, 2026-09-01 — as the payload of the UNCATALOGUED pushed event `0x6D` (109), which the
+    /// strap volunteers while a pack is attached. Only the framing around the record differs; the fields are
+    /// identical, so they must not be decoded twice.
+    ///
+    /// Layout from `base`: +0 present, +1 BT address (6 B), +7 serial (16 B ASCII, NUL-terminated),
+    /// +23 SoC (u16 little-endian, tenths of a percent). nil when the buffer is too short to hold it.
+    public static func decodeRecord(_ bytes: [UInt8], base: Int) -> Info? {
+        guard base >= 0, bytes.count > base else { return nil }
+        let present = bytes[base] == 1
+        guard present else { return Info(present: false, socPct: nil, serial: nil, btAddr: nil) }
+
+        let btStart = base + 1
+        let serStart = base + 7
+        let socStart = base + 23
+        guard bytes.count >= socStart + 2 else { return nil }
+
+        let btAddr = bytes[btStart..<btStart + 6].map { String(format: "%02x", $0) }.joined()
+        let serBytes = Array(bytes[serStart..<serStart + 16].prefix { $0 != 0 })
+        let serial = serBytes.isEmpty ? nil : String(bytes: serBytes, encoding: .ascii)
+        let raw = Int(bytes[socStart]) | (Int(bytes[socStart + 1]) << 8)
+        return Info(present: true, socPct: Double(raw) / 10.0, serial: serial, btAddr: btAddr)
+    }
+
+    /// Decode the pack record from the pushed event `0x6D` (109) payload — the transport that actually works
+    /// on a 5/MG. The strap sends this unprompted while a pack is attached, so it needs no command, no
+    /// send-allowlist entry and no polling, and because it repeats it is a self-refreshing LEVEL signal.
+    public static func decodeEventPayload(_ payload: [UInt8]) -> Info? {
+        decodeRecord(payload, base: eventRecordBase)
+    }
+
+    /// Decode straight from a whole 5/MG EVENT frame, so callers never need to know where the payload
+    /// starts. Callers must first check the event number is `packInfoEvent`; this does not re-check it,
+    /// because the event byte lives in the frame header rather than the record.
+    public static func decodeEventFrame(_ frame: [UInt8]) -> Info? {
+        decodeRecord(frame, base: whoop5EventPayloadStart + eventRecordBase)
+    }
+
     /// The response-command byte sits at `cmdOff` (10 on WHOOP 5/MG — the only family with a pack; a 4.0's
     /// 6 is accepted only so a caller can pass it, though 4.0 never answers 151). Returns nil when the
     /// frame is not a well-formed 151 SUCCESS response. The caller is expected to have CRC-gated the frame
     /// (the framing layer already does), as the sibling probes assume.
+    ///
+    /// NOTE this command path is retained for completeness only. On WHOOP MG fw 50.39.1.0 opcode 151 answers
+    /// FAILURE(0) whether or not a pack is attached, so the feature is driven by `decodeEventFrame` instead.
     public static func decode(frame: [UInt8], cmdOff: Int = 10) -> Info? {
-        // Layout relative to cmdOff, pinned to the captures: +0 resp-cmd (151), +2 result (1 = SUCCESS),
-        // +4 present flag, +5 BT address (6 bytes), +11 serial (16-byte ASCII, NUL-terminated),
-        // +27 SoC (u16 little-endian, tenths of a percent).
+        // Header, pinned to the captures: +0 resp-cmd (151), +2 result (1 = SUCCESS). The record then starts
+        // at +4, which is what `decodeRecord` expects as its base.
         guard cmdOff >= 0, frame.count > cmdOff + 4 else { return nil }
         guard Int(frame[cmdOff]) == 151, Int(frame[cmdOff + 2]) == 1 else { return nil }
-        let present = frame[cmdOff + 4] == 1
-        guard present else { return Info(present: false, socPct: nil, serial: nil, btAddr: nil) }
-
-        let btStart = cmdOff + 5
-        let serStart = cmdOff + 11
-        let socStart = cmdOff + 27
-        guard frame.count >= socStart + 2 else { return nil }
-
-        let btAddr = frame[btStart..<btStart + 6].map { String(format: "%02x", $0) }.joined()
-        let serBytes = Array(frame[serStart..<serStart + 16].prefix { $0 != 0 })
-        let serial = serBytes.isEmpty ? nil : String(bytes: serBytes, encoding: .ascii)
-        let raw = Int(frame[socStart]) | (Int(frame[socStart + 1]) << 8)
-        let socPct = Double(raw) / 10.0
-        return Info(present: true, socPct: socPct, serial: serial, btAddr: btAddr)
+        return decodeRecord(frame, base: cmdOff + 4)
     }
 
     /// WHOOP 4.0 path. A 4.0 has no `GET_BATTERY_PACK_INFO` (151); its pack is read via
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/BatteryPackInfoTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/BatteryPackInfoTests.swift
index 58336b7395..b1a2e10e99 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/BatteryPackInfoTests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/BatteryPackInfoTests.swift
@@ -112,4 +112,42 @@ final class BatteryPackInfoTests: XCTestCase {
         let v = BatteryPackInfo.Info(present: true, socPct: nil, serial: nil, btAddr: nil, voltageMv: 3_900)
         XCTAssertFalse(v.displayable)
     }
+
+    /// REAL HARDWARE vectors: the pack record as the strap actually delivers it — the payload of the
+    /// uncatalogued pushed event 109, captured from a WHOOP MG on fw 50.39.1.0 (2026-09-01). Command 151
+    /// answers FAILURE(0) on that firmware whatever you send it, so the event is the transport the feature
+    /// runs on. The Kotlin twin asserts the same values.
+    private let packEvent569 = "f5481c000100005e005301574242354150303030303030310000003902010c00"
+    private let packEvent567 = "1e451c000100005e005301574242354150303030303030310000003702010c00"
+
+    func testPushedPackEventCarriesTheSameRecordAsTheCommandReply() {
+        let info = BatteryPackInfo.decodeEventPayload(bytes(packEvent569))
+        XCTAssertEqual(info?.present, true)
+        XCTAssertEqual(info?.serial, "WBB5AP0000001")
+        XCTAssertEqual(info?.btAddr, "00005e005301")
+        XCTAssertEqual(info?.socPct ?? -1, 56.9, accuracy: 1e-9)
+        XCTAssertNil(info?.voltageMv)               // the event never carries a voltage
+    }
+
+    /// The SoC field TRACKS A VARYING INPUT rather than merely looking plausible once: these two records are
+    /// minutes apart while the pack drains into the strap, and the value falls. A single reading cannot tell
+    /// tenths-of-a-percent from mAh; a falling pair in the physically correct direction, both inside 0...100
+    /// when read as tenths, is what settles the unit.
+    func testPackSocFallsAsThePackDrainsIntoTheStrap() {
+        let first = BatteryPackInfo.decodeEventPayload(bytes(packEvent569))?.socPct ?? -1
+        let later = BatteryPackInfo.decodeEventPayload(bytes(packEvent567))?.socPct ?? -1
+        XCTAssertEqual(first, 56.9, accuracy: 1e-9)
+        XCTAssertEqual(later, 56.7, accuracy: 1e-9)
+        XCTAssertLessThan(later, first, "pack SoC must fall while discharging into the strap")
+        XCTAssertLessThanOrEqual(first, 100.0)
+        XCTAssertGreaterThanOrEqual(later, 0.0)
+    }
+
+    /// The command path and the event path must agree field-for-field — they share `decodeRecord`, and a
+    /// refactor letting them drift would silently give the Devices card two different pack readings.
+    func testCommandAndEventPathsShareOneRecordDecoder() {
+        let viaCommand = BatteryPackInfo.decode(frame: bytes(attachedHex))
+        let viaRecord = BatteryPackInfo.decodeRecord(bytes(attachedHex), base: 14)   // cmdOff 10 + 4
+        XCTAssertEqual(viaCommand, viaRecord)
+    }
 }
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index d42c3001fc..63f23185c1 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -170,6 +170,14 @@ data class LiveState(
      *  Cleared on disconnect so a stale flag can't outlive the link. Twin of macOS
      *  LiveState.charging. */
     val charging: Boolean? = null,
+    /** Battery-pack charge, tenths-of-a-percent precision, from the pushed pack event (109) payload.
+     *  5/MG only — a WHOOP 4.0 has no pack fuel gauge (its pack reads as a VOLTAGE via opcode 98, a
+     *  different quantity). Null until the first pack event lands, cleared on BATTERY_PACK_REMOVED and
+     *  on disconnect, so a removed pack or a dropped link can never leave a stale charge on the card.
+     *
+     *  There is deliberately no separate "pack attached" flag: nothing needs one. Non-null here already
+     *  means a pack is attached and reporting, because the strap only sends the event while one is on. */
+    val packSocPct: Double? = null,
     /** Wrist-wear from WRIST_ON/WRIST_OFF events. Defaults TRUE to match the macOS LiveState (Swift
      *  parity) — assume worn until the strap says otherwise. (Was false, which made the UI show
      *  "Worn: Off" forever when no WRIST_ON event arrived — issue #18.) */
@@ -1344,6 +1352,12 @@ class WhoopBleClient(
                 charging = null, strapFirmware = null, historyLayoutVersion = null,
                 pairingHint = null, scanning = false,
                 statusNote = null,
+                // Pack readout dies with the link, the same rule as [charging]: a card still showing
+                // "Pack 56.9%" for a strap we are no longer talking to is a stale reading, not a stale
+                // pill. This clear is also why no expiry timer is needed — the only way to miss a pack
+                // removal is to be disconnected for it, and reconnecting starts from null either way.
+                // Event 109 re-establishes the reading within a couple of minutes if a pack is still on.
+                packSocPct = null,
             )
 
         /** #1466: did this offload hand over anything at all? Acked chunks, persisted rows, or deep packets.
@@ -7932,7 +7946,46 @@ class WhoopBleClient(
                             if (ev.startsWith("BATTERY_PACK_CONNECTED")) {
                                 _state.update { s -> s.copy(charging = true) }
                             } else if (ev.startsWith("BATTERY_PACK_REMOVED")) {
-                                _state.update { s -> s.copy(charging = false) }
+                                // Removal clears the readout too: a detached pack must not leave a stale
+                                // charge sitting on the card.
+                                _state.update { s -> s.copy(charging = false, packSocPct = null) }
+                            }
+                            // The pack's own charge. The strap volunteers the full pack record — present
+                            // flag, BT address, serial and SoC — in the UNCATALOGUED event 109 every couple
+                            // of minutes while a pack is attached, so this needs no command, no
+                            // send-allowlist entry and no polling. Because it REPEATS it is a level signal:
+                            // unlike the old edge-driven charging flag it re-establishes itself after any
+                            // reconnect and cannot go stale.
+                            //
+                            // Hardware-confirmed on WHOOP MG fw 50.39.1.0 (2026-09-01): three consecutive
+                            // records, serial WBB5AP0000001, SoC 57.1% -> 56.9% -> 56.7% as the pack drained
+                            // into the strap. That falling trend across a real physical process — not one
+                            // plausible-looking value — is what establishes the SoC word as tenths of a
+                            // percent. Gated by BatteryPackInfo.displayable below, so a wrong offset
+                            // yields nothing rather than a fabricated reading.
+                            // Matched on the event BYTE, not on the rendered label: an uncatalogued event
+                            // renders as "0x6D(109)" only because nothing names it, so a future
+                            // EventNumber entry would rename it and silently break a string match.
+                            // A 5/MG event frame carries its event number at offset 10.
+                            if (connectedFamily == DeviceFamily.WHOOP5 && frame.size > 10 &&
+                                (frame[10].toInt() and 0xFF) == com.noop.protocol.BatteryPackInfo.PACK_INFO_EVENT
+                            ) {
+                                com.noop.protocol.BatteryPackInfo.decodeEventFrame(frame)?.let { info ->
+                                    val soc = info.socPct
+                                    // [displayable] is #1303's gate, not a second copy of it: present, a
+                                    // charge, and inside 0..100. Two definitions of one rule is how the
+                                    // command path and the event path end up disagreeing about the same
+                                    // pack, which is the drift decodeRecord() exists to prevent.
+                                    if (info.displayable && soc != null) {
+                                        // charging=true here as well as on event 21 is the anti-staleness
+                                        // half: if the attach edge was missed (app started with the pack
+                                        // already on, or the link dropped over the attach), this repeating
+                                        // event re-establishes the state within a couple of minutes.
+                                        _state.update { s -> s.copy(packSocPct = soc, charging = true) }
+                                    } else if (!info.present) {
+                                        _state.update { s -> s.copy(packSocPct = null) }
+                                    }
+                                }
                             }
                         }
                         // PR #577: the strap fired its firmware smart alarm (STRAP_DRIVEN_ALARM_EXECUTED,
diff --git a/android/app/src/main/java/com/noop/protocol/BatteryPackInfo.kt b/android/app/src/main/java/com/noop/protocol/BatteryPackInfo.kt
index 27df772ad2..e79c293cde 100644
--- a/android/app/src/main/java/com/noop/protocol/BatteryPackInfo.kt
+++ b/android/app/src/main/java/com/noop/protocol/BatteryPackInfo.kt
@@ -38,32 +38,85 @@ object BatteryPackInfo {
             get() = present && socPct != null && socPct >= 0.0 && socPct <= 100.0
     }
 
-    /** Resp-cmd byte sits at [cmdOff] (10 on WHOOP 5/MG — the only family with a pack). Null when the
-     *  frame is not a well-formed 151 SUCCESS response; the caller CRC-gates the frame (framing layer does). */
-    fun decode(frame: ByteArray, cmdOff: Int = 10): Info? {
-        // Layout vs cmdOff, pinned to the captures: +0 resp-cmd (151), +2 result (1 = SUCCESS), +4 present
-        // flag, +5 BT address (6 bytes), +11 serial (16-byte ASCII, NUL-terminated), +27 SoC (u16 LE,
-        // tenths of a percent).
-        if (cmdOff < 0 || frame.size <= cmdOff + 4) return null
-        if ((frame[cmdOff].toInt() and 0xFF) != 151 || (frame[cmdOff + 2].toInt() and 0xFF) != 1) return null
-        val present = (frame[cmdOff + 4].toInt() and 0xFF) == 1
+    /**
+     * Decode the pack RECORD itself, given the offset of its present-flag byte.
+     *
+     * Split out from [decode] because the same record reaches us by two entirely different transports:
+     * as the payload of a `GET_BATTERY_PACK_INFO` (151) COMMAND_RESPONSE, and — hardware-confirmed on
+     * WHOOP MG fw 50.39.1.0, 2026-09-01 — as the payload of the UNCATALOGUED pushed event `0x6D` (109),
+     * which the strap volunteers every couple of minutes while a pack is attached. Only the framing
+     * around the record differs; the fields are identical, so they must not be decoded twice.
+     *
+     * Layout from [base]: +0 present, +1 BT address (6 B), +7 serial (16 B ASCII, NUL-terminated),
+     * +23 SoC (u16 LE, tenths of a percent). Null when the buffer is too short to hold it.
+     */
+    fun decodeRecord(bytes: ByteArray, base: Int): Info? {
+        if (base < 0 || bytes.size <= base) return null
+        val present = (bytes[base].toInt() and 0xFF) == 1
         if (!present) return Info(false, null, null, null)
 
-        val btStart = cmdOff + 5
-        val serStart = cmdOff + 11
-        val socStart = cmdOff + 27
-        if (frame.size < socStart + 2) return null
+        val btStart = base + 1
+        val serStart = base + 7
+        val socStart = base + 23
+        if (bytes.size < socStart + 2) return null
 
-        val btAddr = (btStart until btStart + 6).joinToString("") { "%02x".format(frame[it].toInt() and 0xFF) }
-        val serBytes = (serStart until serStart + 16).map { frame[it] }.takeWhile { it.toInt() != 0 }
+        val btAddr = (btStart until btStart + 6).joinToString("") { "%02x".format(bytes[it].toInt() and 0xFF) }
+        val serBytes = (serStart until serStart + 16).map { bytes[it] }.takeWhile { it.toInt() != 0 }
         // Null on empty OR any non-ASCII byte, matching the Swift twin's `String(bytes:encoding:.ascii)`
         // (which returns nil for any byte > 127) — keeps the two byte-identical on a malformed serial.
         val serial = if (serBytes.isEmpty() || serBytes.any { (it.toInt() and 0xFF) >= 0x80 }) null
         else String(serBytes.toByteArray(), Charsets.US_ASCII)
-        val raw = (frame[socStart].toInt() and 0xFF) or ((frame[socStart + 1].toInt() and 0xFF) shl 8)
+        val raw = (bytes[socStart].toInt() and 0xFF) or ((bytes[socStart + 1].toInt() and 0xFF) shl 8)
         return Info(true, raw / 10.0, serial, btAddr)
     }
 
+    /**
+     * Decode the pack record from the pushed event `0x6D` (109) payload — the transport that actually
+     * works on a 5/MG. The strap sends this unprompted while a pack is attached, so it needs no command,
+     * no send-allowlist entry and no polling; the repeat cadence makes it a self-refreshing LEVEL signal
+     * that cannot go stale. The record's present flag sits at payload offset 4.
+     *
+     * Confirmed against three consecutive captures from one MG (serial WBB5AP0000001, SoC 57.1 % ->
+     * 56.9 % -> 56.7 % as the pack drained into the strap) — the falling trend is what establishes the
+     * SoC word as tenths of a percent rather than a plausible-looking constant.
+     */
+    fun decodeEventPayload(payload: ByteArray): Info? = decodeRecord(payload, EVENT_RECORD_BASE)
+
+    /** Offset of the present flag inside the event-109 payload. */
+    const val EVENT_RECORD_BASE = 4
+
+    /**
+     * Decode straight from a whole 5/MG EVENT frame, so callers never have to know where the payload
+     * starts. A 5/MG event's opaque payload begins at frame offset 16 (`Framing.decodeEventWhoop5`), so
+     * the record's present flag lands at 16 + [EVENT_RECORD_BASE]. Keeping that arithmetic here means the
+     * BLE layer passes the frame it already has and no offset knowledge leaks out of the protocol package.
+     *
+     * Callers must check the event number is [PACK_INFO_EVENT] first — this does not re-check it, because
+     * the event byte lives in the frame header rather than the record.
+     */
+    fun decodeEventFrame(frame: ByteArray): Info? = decodeRecord(frame, WHOOP5_EVENT_PAYLOAD_START + EVENT_RECORD_BASE)
+
+    /** Where a WHOOP 5/MG EVENT frame's opaque payload begins. Mirrors `Framing.decodeEventWhoop5`. */
+    const val WHOOP5_EVENT_PAYLOAD_START = 16
+
+    /** Uncatalogued 5/MG event that carries the pack record. Named here because `EventNumber` has no
+     *  entry for it — it decodes as `0x6D(109)`. */
+    const val PACK_INFO_EVENT = 109
+
+    /** Resp-cmd byte sits at [cmdOff] (10 on WHOOP 5/MG — the only family with a pack). Null when the
+     *  frame is not a well-formed 151 SUCCESS response; the caller CRC-gates the frame (framing layer does).
+     *
+     *  NOTE this command path is retained for completeness only. On WHOOP MG fw 50.39.1.0 opcode 151
+     *  answers FAILURE(0) whether or not a pack is attached, so the feature is driven by
+     *  [decodeEventPayload] instead. See docs/DESIGN-battery-pack-charge.md. */
+    fun decode(frame: ByteArray, cmdOff: Int = 10): Info? {
+        // Header, pinned to the captures: +0 resp-cmd (151), +2 result (1 = SUCCESS). The record then
+        // starts at +4, which is what [decodeRecord] expects as its base.
+        if (cmdOff < 0 || frame.size <= cmdOff + 4) return null
+        if ((frame[cmdOff].toInt() and 0xFF) != 151 || (frame[cmdOff + 2].toInt() and 0xFF) != 1) return null
+        return decodeRecord(frame, cmdOff + 4)
+    }
+
     /**
      * WHOOP 4.0 path. A 4.0 has no `GET_BATTERY_PACK_INFO` (151); its pack is read via
      * `GET_EXTENDED_BATTERY_INFO` (98), which reports the pack VOLTAGE (mV) — NOT a charge %. Voltage at
diff --git a/android/app/src/main/java/com/noop/ui/DevicesScreen.kt b/android/app/src/main/java/com/noop/ui/DevicesScreen.kt
index 59a05d4505..c98b5e417e 100644
--- a/android/app/src/main/java/com/noop/ui/DevicesScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/DevicesScreen.kt
@@ -255,6 +255,8 @@ fun DevicesScreen(
                     live.batteryPct?.let { Math.round(it).toInt() } else null,
                 liveBatteryMv = if (device.status == DeviceStatus.active.name && live.connected)
                     live.batteryMv else null,
+                livePackSocPct = if (device.status == DeviceStatus.active.name && live.connected)
+                    live.packSocPct else null,
                 // Firmware version for the ACTIVE strap. It's a STABLE property (NOOP can't change a strap's
                 // firmware), so prefer the live handshake value but fall back to the last-known persisted
                 // firmware (NoopPrefs, written on connect) when the live value is momentarily null — mid-
@@ -728,6 +730,10 @@ private fun DeviceCard(
      *  generic strap, or an FTMS machine. null when not active/connected or no battery was reported. */
     liveBatteryPct: Int? = null,
     liveBatteryMv: Int? = null,
+    /** Battery-pack charge % (5/MG only), from the pushed pack event. Null when no pack is attached or
+     *  none has been reported yet — the row is simply absent then, which is the "only show it when a
+     *  pack is actually on" behaviour, for free. */
+    livePackSocPct: Double? = null,
     /** The active+connected strap's firmware version (from the connect handshake). null when not
      *  active/connected, or for a source that reports no firmware (e.g. a non-WHOOP strap). */
     liveFirmware: String? = null,
@@ -849,11 +855,18 @@ private fun DeviceCard(
             val voltsSuffix = if (liveBatteryMv != null)
                 " · " + stringResource(R.string.l10n_devices_screen_pack_voltage_9af3c3ff, liveBatteryMv / 1000.0)
             else ""
+            // Battery-pack charge (5/MG). Present only while a pack is actually attached, because the
+            // strap only sends the pack event then — so an empty suffix is the whole "hide it when not
+            // charging" rule, with no extra conditional.
+            val packSuffix = if (livePackSocPct != null)
+                " · " + stringResource(R.string.l10n_devices_screen_pack_charge_0e9589da, livePackSocPct)
+            else ""
             Row(verticalAlignment = Alignment.CenterVertically) {
                 Text(
                     lastSeenLine(device, isLiveConnected, bondRefused) +
                         (liveFirmware?.let { " · FW $it" } ?: "") +
                         voltsSuffix +
+                        packSuffix +
                         (historyLayoutLine(liveHistoryLayout)?.let { " · $it" } ?: ""),
                     style = NoopType.footnote,
                     color = Palette.textTertiary,
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 467eb31902..aba6ea9480 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -478,6 +478,7 @@
     <string name="l10n_devices_screen_leave_none_active_b5c858cb">Keins aktiv lassen</string>
     <string name="l10n_devices_screen_name_709a2322">Name</string>
     <string name="l10n_devices_screen_pack_voltage_9af3c3ff">%1$.2f V</string>
+    <string name="l10n_devices_screen_pack_charge_0e9589da">Pack %1$.1f%%</string>
     <string name="l10n_devices_screen_paired_locally_noop_owns_this_ring_30c16190">Lokal gekoppelt. NOOP besitzt diesen Ring, solange es den Schlüssel hält. Wenn du ihn erneut zurücksetzt oder in der Oura-App einrichtest, besitzt NOOP ihn nicht mehr, und du müsstest ihn zum Übernehmen neu hinzufügen.</string>
     <string name="l10n_devices_screen_pick_a_new_active_strap_edd73542">Neuen aktiven Strap auswählen</string>
     <string name="l10n_devices_screen_rename_device_ee233604">Gerät umbenennen</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index cbf5792b9e..eb3ed22d04 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -278,6 +278,7 @@
     <string name="l10n_devices_screen_leave_none_active_b5c858cb">No dejar ninguna activa</string>
     <string name="l10n_devices_screen_name_709a2322">Nombre</string>
     <string name="l10n_devices_screen_pack_voltage_9af3c3ff">%1$.2f V</string>
+    <string name="l10n_devices_screen_pack_charge_0e9589da">Pack %1$.1f%%</string>
     <string name="l10n_devices_screen_paired_locally_noop_owns_this_ring_30c16190">Emparejado localmente. NOOP es propietario de este anillo mientras conserva la clave. Si lo restableces de nuevo o lo configuras en la app de Oura, NOOP deja de ser propietario y tendrías que volver a añadirlo para retomar el control.</string>
     <string name="l10n_devices_screen_pick_a_new_active_strap_edd73542">Elige una nueva pulsera activa</string>
     <string name="l10n_devices_screen_rename_device_ee233604">Renombrar dispositivo</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 36fc334434..7427fa34b9 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -296,6 +296,7 @@
     <string name="l10n_devices_screen_leave_none_active_b5c858cb">N\'en laisser aucune active</string>
     <string name="l10n_devices_screen_name_709a2322">Nom</string>
     <string name="l10n_devices_screen_pack_voltage_9af3c3ff">%1$.2f V</string>
+    <string name="l10n_devices_screen_pack_charge_0e9589da">Pack %1$.1f%%</string>
     <string name="l10n_devices_screen_paired_locally_noop_owns_this_ring_30c16190">Associée localement. NOOP possède cette bague tant qu\'il détient la clé. Si vous la réinitialisez à nouveau ou la configurez dans l\'app Oura, NOOP ne la possède plus et vous devrez la rajouter pour en reprendre le contrôle.</string>
     <string name="l10n_devices_screen_pick_a_new_active_strap_edd73542">Choisir un nouveau bracelet actif</string>
     <string name="l10n_devices_screen_rename_device_ee233604">Renommer l\'appareil</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index a5ff9d4e0e..f8fb6396a4 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -435,6 +435,7 @@
     <string name="l10n_devices_screen_leave_none_active_b5c858cb">Nie pozostawiaj żadnego aktywnego</string>
     <string name="l10n_devices_screen_name_709a2322">Nazwa</string>
     <string name="l10n_devices_screen_pack_voltage_9af3c3ff">%1$.2f V</string>
+    <string name="l10n_devices_screen_pack_charge_0e9589da">Pack %1$.1f%%</string>
     <string name="l10n_devices_screen_paired_locally_noop_owns_this_ring_30c16190">Sparowane lokalnie. NOOP jest właścicielem tego pierścienia, dopóki trzyma klucz. Jeśli zresetujesz go ponownie lub skonfigurujesz w aplikacji Oura, NOOP nie będzie już jego właścicielem i dodasz go ponownie, aby go przejąć.</string>
     <string name="l10n_devices_screen_pick_a_new_active_strap_edd73542">Wybierz nowy aktywny pasek</string>
     <string name="l10n_devices_screen_rename_device_ee233604">Zmień nazwę urządzenia</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index bd7ac97e2e..63816b0c17 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -443,6 +443,7 @@
     <string name="l10n_devices_screen_leave_none_active_b5c858cb">Não deixe nenhum ativo</string>
     <string name="l10n_devices_screen_name_709a2322">Nome</string>
     <string name="l10n_devices_screen_pack_voltage_9af3c3ff">%1$.2f V</string>
+    <string name="l10n_devices_screen_pack_charge_0e9589da">Pack %1$.1f%%</string>
     <string name="l10n_devices_screen_paired_locally_noop_owns_this_ring_30c16190">Emparelhado localmente. NOOP possui este anel enquanto detém a chave. Se o repor novamente ou o configurar na aplicação Oura, o NOOP já não será o proprietário e irá adicioná-lo novamente para o assumir.</string>
     <string name="l10n_devices_screen_pick_a_new_active_strap_edd73542">Escolha uma nova bracelete ativa</string>
     <string name="l10n_devices_screen_rename_device_ee233604">Renomear dispositivo</string>
diff --git a/android/app/src/main/res/values-ru/strings.xml b/android/app/src/main/res/values-ru/strings.xml
index 2f97055b71..d09aead3df 100644
--- a/android/app/src/main/res/values-ru/strings.xml
+++ b/android/app/src/main/res/values-ru/strings.xml
@@ -513,6 +513,7 @@
     <string name="l10n_devices_screen_leave_none_active_b5c858cb">Не оставлять ни одного активным</string>
     <string name="l10n_devices_screen_name_709a2322">Имя</string>
     <string name="l10n_devices_screen_pack_voltage_9af3c3ff">%1$.2f В</string>
+    <string name="l10n_devices_screen_pack_charge_0e9589da">Блок %1$.1f%%</string>
     <string name="l10n_devices_screen_paired_locally_noop_owns_this_ring_30c16190">Сопряжено локально. NOOP владеет этим кольцом, пока у него есть ключ. Если вы снова сбросите кольцо или настроите его в приложении Oura, NOOP перестанет им владеть, и вам нужно будет добавить его заново, чтобы вернуть управление.</string>
     <string name="l10n_devices_screen_pick_a_new_active_strap_edd73542">Выберите новый активный браслет</string>
     <string name="l10n_devices_screen_rename_device_ee233604">Переименовать устройство</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index e10ce1bbf9..49f2c9256c 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2647,4 +2647,5 @@
     <string name="l10n_devices_screen_battery_pack_probe_151_re_d722af00">电池盒探测 (151 RE)…</string>
     <string name="l10n_devices_screen_battery_pack_probe_result_151_df43dff2">电池盒探测结果 (151)</string>
     <string name="l10n_devices_screen_battery_pack_probe_explainer_40b3470d">发送只读的电池盒命令 (151) 并解码手环的回复——电池盒的电量、序列号和蓝牙地址。不会向手环写入任何内容，也不会影响您的数据。WHOOP 4.0 没有电池盒命令，预期会保持静默；这种静默本身就是有用的结果。</string>
+    <string name="l10n_devices_screen_pack_charge_0e9589da">电池盒 %1$.1f%%</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 4bbf99d8d9..f994c2dcee 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -563,6 +563,7 @@
     <string name="l10n_devices_screen_leave_none_active_b5c858cb">Leave none active</string>
     <string name="l10n_devices_screen_name_709a2322">Name</string>
     <string name="l10n_devices_screen_pack_voltage_9af3c3ff">%1$.2f V</string>
+    <string name="l10n_devices_screen_pack_charge_0e9589da">Pack %1$.1f%%</string>
     <string name="l10n_devices_screen_paired_locally_noop_owns_this_ring_30c16190">Paired locally. NOOP owns this ring while it holds the key. If you reset it again or set it up in the Oura app, NOOP no longer owns it and you would re-add it to take it over.</string>
     <string name="l10n_devices_screen_pick_a_new_active_strap_edd73542">Pick a new active strap</string>
     <string name="l10n_devices_screen_rename_device_ee233604">Rename device</string>
diff --git a/android/app/src/test/java/com/noop/protocol/BatteryPackInfoTest.kt b/android/app/src/test/java/com/noop/protocol/BatteryPackInfoTest.kt
index d41b4b8c6f..af72b369ba 100644
--- a/android/app/src/test/java/com/noop/protocol/BatteryPackInfoTest.kt
+++ b/android/app/src/test/java/com/noop/protocol/BatteryPackInfoTest.kt
@@ -127,4 +127,48 @@ class BatteryPackInfoTest {
                                      voltageMv = 3_900)
         assertFalse(v.displayable)
     }
+
+    /**
+     * REAL HARDWARE vectors: the pack record as the strap actually delivers it — the payload of the
+     * uncatalogued pushed event 109, captured from a WHOOP MG on fw 50.39.1.0 (2026-09-01). Command 151
+     * answers FAILURE(0) on this firmware whatever you send it, so the event is the transport the
+     * feature runs on; these two frames are what proves the field offsets on MG hardware.
+     */
+    private val packEvent569 = "f5481c000100005e005301574242354150303030303030310000003902010c00"
+    private val packEvent567 = "1e451c000100005e005301574242354150303030303030310000003702010c00"
+
+    @Test fun pushedPackEventCarriesTheSameRecordAsTheCommandReply() {
+        val a = BatteryPackInfo.decodeEventPayload(bytes(packEvent569))!!
+        assertEquals(true, a.present)
+        assertEquals("WBB5AP0000001", a.serial)
+        assertEquals("00005e005301", a.btAddr)
+        assertEquals(56.9, a.socPct!!, 1e-9)
+        assertNull(a.voltageMv)                       // the event never carries a voltage
+    }
+
+    /**
+     * The SoC field TRACKS A VARYING INPUT rather than merely looking plausible once: these two records
+     * are minutes apart while the pack drains into the strap, and the value falls. A single reading
+     * cannot tell tenths-of-a-percent from mAh; a falling pair in the physically correct direction, both
+     * within 0..100 when read as tenths, is what settles the unit.
+     */
+    @Test fun packSocFallsAsThePackDrainsIntoTheStrap() {
+        val first = BatteryPackInfo.decodeEventPayload(bytes(packEvent569))!!.socPct!!
+        val later = BatteryPackInfo.decodeEventPayload(bytes(packEvent567))!!.socPct!!
+        assertEquals(56.9, first, 1e-9)
+        assertEquals(56.7, later, 1e-9)
+        assertTrue("pack SoC must fall while discharging into the strap", later < first)
+        assertTrue("read as tenths-of-a-percent both samples are a real percentage", first <= 100.0 && later >= 0.0)
+    }
+
+    /** The command path and the event path must agree field-for-field — they share [decodeRecord], and a
+     *  refactor that let them drift would silently give the Devices card two different pack readings. */
+    @Test fun commandAndEventPathsShareOneRecordDecoder() {
+        val viaCommand = BatteryPackInfo.decode(bytes(attachedHex))!!
+        val viaRecord = BatteryPackInfo.decodeRecord(bytes(attachedHex), 14)!!   // cmdOff 10 + 4
+        assertEquals(viaCommand.present, viaRecord.present)
+        assertEquals(viaCommand.serial, viaRecord.serial)
+        assertEquals(viaCommand.btAddr, viaRecord.btAddr)
+        assertEquals(viaCommand.socPct!!, viaRecord.socPct!!, 1e-9)
+    }
 }

From 8c3ddaca9a5347c611055677553028852ea82687 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 00:25:41 +1200
Subject: [PATCH 291/333] build: testing build 448 / 329

Build numbers only; 11.1.1 stays as the next unreleased version.

The one thing worth putting on a phone: the Devices card now shows how full the
battery pack is, which was not visible anywhere in the app before. It comes from
an event the strap already sends unprompted while a pack is attached, so there is
no polling and no extra traffic, and it clears the moment the pack comes off or
the link drops. Watch that it appears on attach, tracks down as the pack drains,
and leaves nothing behind on removal.

Alongside it, a read-only Test Centre sweep that records what an MG answers when
asked for the pack over command 151, which is what established that the command
is refusing the request rather than the opcode. Both from @Zebsi235. The pack
readout and that probe now keep the pack's serial and address out of the strap
log and the copy-to-clipboard dialog, masked at the source rather than relying on
a scrubber that could reach neither.

Also carries @bhelm's closed final bin in the resting-HR window, so a sample
sitting exactly on an aligned window end counts instead of being admitted and
then silently dropped; a rolling cap on the PPG waveform table, which was the
last unbounded blob table in the store and keeps its newest three weeks or so
rather than growing forever; and from @evoveotech, Apple Health keys that no
longer carry the active strap id, plus skin-temp absolutes backfilled for nights
outside the 21-night rescore window.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 6a3631f019..d60af21aea 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 447
+        versionCode = 448
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index ec7118d95e..fb617dbffe 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "328"
+    CURRENT_PROJECT_VERSION: "329"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 460f11aedd4dd12c5b575944b8ee00c04663ff06 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 09:38:44 +1200
Subject: [PATCH 292/333] hrv: withhold RMSSD on a night whose R-R over-counts

The backstop #1118 describes, now that the measurement it waited on exists.

beatSpreadIsTrustworthy left this open in as many words: successive-difference
statistics were ungated because their dominant error was the lost within-second
emission order corrected at the write path, and whether they needed a gate of
their own was "a question for a post-fix capture to answer, not an assumption to
bake in now". That capture arrived. A build carrying the write-path fix, on a
WHOOP 4.0, still reports crossSecondOverCount on every measured night,
coverage 2.13, with 91% of the inflating beat-time on seconds written by more
than one delivery. The same log settles the scope: every 4.0 night is affected
and no WHOOP 5 night is.

successiveDiffIsTrustworthy refuses the same two verdicts as the SDNN gate but
carries its own reasoning, because the two statistics fail in opposite
directions. SDNN widens under a duplicated beat. A successive-difference
statistic reads LOW, since a beat the heart never produced sits beside its
neighbour with a near-zero difference and RMSSD is the root mean square of
exactly those differences. On the captured night RMSSD reads 36ms where the same
beats collapsed read 41ms; the direction of that error is invisible in the
number, which is why it cannot be shown.

Applied in sessionAvgHRV, where RMSSD becomes the day's HRV, so one seam covers
the daily row, the sleep-session cache, the Health card and the baseline later
nights are scored against. Classified over the same beats the value was built
from, windowed identically on both platforms.

THE COST. This trades a wrong number for a blank, and it reaches further than
the card: Baselines.update holds on a null night without advancing nValid, so an
install whose every night gates never reaches minNightsSeed and stays
CALIBRATING. A 4.0-only install therefore gets no HRV baseline at all, not a
degraded one. A mixed install is unaffected, its clean nights seeding the
baseline while gated ones skip-and-hold. Accepted deliberately: the alternative
is seeding a personal baseline from beats the heart did not produce and scoring
every later night against it, which is the error this exists to stop spreading.

Verified it does not fire on honest nights. A 75 bpm night legitimately puts two
beats inside some seconds and still classifies plausible, because coverage
measures beat-time against wall span rather than beats per second. And the
threshold it hangs on is not load-bearing here: across 25 scored nights the
population is bimodal, 17 kept between 0.47 and 0.94 and 8 withheld between 1.34
and 2.13, with nothing within 0.16 of the 1.10 ceiling either side.

The verdict is built without the collapsed figure, which exists only to choose
BETWEEN the two over-count verdicts that this gate refuses alike. Computing it
would change no outcome while costing a full sort of the night's ~50-70k beats,
on a path that runs per session, per day, across ~21 days of every analyzeRecent,
every 15 minutes.

Six tests per platform, twinned. Each over-count case asserts twice: that the
gated call returns nothing, AND that the same beats do yield an RMSSD through
sessionHrvWindows, so it cannot pass against a window that simply had no usable
beats. Android suite 5436 green.

Known and not addressed here: with the value withheld the card falls back to
"No HRV value", which explains nothing, and the hrv diag line still prints the
computed RMSSD. The first needs copy in seven locales; the second needs room in
analyzeRecentOnCpu, whose JaCoCo budget is a ratchet already at its limit.
---
 .../Sources/StrandAnalytics/HRVAnalyzer.swift | 62 +++++++++++--
 .../Sources/StrandAnalytics/SleepStager.swift | 27 +++++-
 .../HrvOverCountGateTests.swift               | 83 ++++++++++++++++++
 Strand/Data/IntelligenceEngine.swift          |  9 +-
 .../java/com/noop/analytics/HrvAnalyzer.kt    | 61 +++++++++++--
 .../com/noop/analytics/IntelligenceEngine.kt  | 10 ++-
 .../java/com/noop/analytics/SleepStager.kt    | 27 +++++-
 .../noop/analytics/HrvOverCountGateTest.kt    | 87 +++++++++++++++++++
 8 files changed, 346 insertions(+), 20 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HrvOverCountGateTests.swift
 create mode 100644 android/app/src/test/java/com/noop/analytics/HrvOverCountGateTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/HRVAnalyzer.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/HRVAnalyzer.swift
index f435b709a7..fc1c66671c 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/HRVAnalyzer.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/HRVAnalyzer.swift
@@ -424,10 +424,11 @@ public enum HRVAnalyzer {
     /// arriving in real time, carrying no timestamps to measure coverage with — and suppressing those
     /// would refuse honest readings, the opposite of the point.
     ///
-    /// Successive-difference statistics (RMSSD, pNN50) are deliberately NOT gated here. Their dominant
-    /// error on a banked stream was the lost within-second emission order (#823, root-caused in #1072),
-    /// which is fixed at the write path; whether they need a gate of their own is a question for a
-    /// post-fix capture to answer, not an assumption to bake in now.
+    /// Successive-difference statistics (RMSSD, pNN50) are not gated HERE, but they are no longer ungated
+    /// by COVERAGE: see `successiveDiffIsTrustworthy` below. The question this comment left open was one for
+    /// a post-fix capture to answer; that capture arrived and answered it yes. Note it answered THIS
+    /// question only. The sibling deferral on `beatValuesAreTrustworthy`, about beat-to-beat accuracy, is
+    /// still open and still waiting on a capture of its own.
     public static func beatSpreadIsTrustworthy(_ verdict: RrCoverageVerdict) -> Bool {
         switch verdict {
         case .sameSecondOverCount, .crossSecondOverCount:
@@ -437,6 +438,51 @@ public enum HRVAnalyzer {
         }
     }
 
+    /// Whether RMSSD / pNN50 can be trusted from a window with this coverage verdict (#1118).
+    ///
+    /// The sibling of `beatSpreadIsTrustworthy`, and the same two verdicts refuse, but for its own reason
+    /// rather than by borrowing that one's. SDNN is a spread over every interval, so a duplicated beat
+    /// widens it. Successive-difference statistics fail the other way: a beat the heart never produced
+    /// sits next to its neighbour with a near-zero difference, and RMSSD is the root mean square of
+    /// exactly those differences, so an over-counted night reads LOW. Measured on a WHOOP 4.0 night whose
+    /// banked R-R covers 2.13× the wall clock it spans, RMSSD reads 36 ms where the same night's beats
+    /// collapsed read 41 ms; the direction of the error is not obvious from the number, which is precisely
+    /// why it cannot be shown.
+    ///
+    /// The comment on `beatSpreadIsTrustworthy` used to say these were deliberately ungated because their
+    /// dominant error was the lost within-second emission order fixed at the write path (#823 / #1072),
+    /// and that whether they needed a gate of their own was for a post-fix capture to answer. The capture
+    /// arrived: a build carrying that fix, on a WHOOP 4.0, still reports `crossSecondOverCount` on every
+    /// measured night, with 91% of the inflating beat-time on seconds written by more than one delivery.
+    /// The write-path fix did not make the stream clean, so the assumption it licensed no longer holds.
+    ///
+    /// WITHHOLD, DO NOT FABRICATE. This trades a wrong number for a blank on every affected night, which
+    /// is a real cost: HRV is the dominant Charge driver, so a gated night drops that term and renormalises
+    /// the rest. That cost is accepted deliberately. A contaminated RMSSD does not merely display wrong, it
+    /// enters the personal baseline the following nights are scored against, so showing it spreads the
+    /// error into days whose own capture was clean.
+    ///
+    /// THE COST REACHES FURTHER THAN THE CARD, and a reader should know it before widening this rule.
+    /// `Baselines.update` holds on a nil night without advancing `nValid`, so on an install whose EVERY
+    /// night gates, the HRV baseline never reaches `Baselines.minNightsSeed` and stays calibrating
+    /// indefinitely. That is the WHOOP 4.0-only case exactly. It is still the right answer, because the
+    /// alternative is seeding a personal baseline from beats the heart did not produce and scoring every
+    /// later night against it, but it means this gate can leave a strap with no HRV baseline at all rather
+    /// than merely a gap in one. A mixed install is unaffected: its clean nights seed the baseline and the
+    /// gated ones skip-and-hold.
+    ///
+    /// `underCovered` and `unmeasurable` stay trusted for the same reason they do above: neither duplicates
+    /// a beat, and `unmeasurable` is what an honest live spot reading looks like. Pure. Byte-parity twin of
+    /// Kotlin `successiveDiffIsTrustworthy`.
+    public static func successiveDiffIsTrustworthy(_ verdict: RrCoverageVerdict) -> Bool {
+        switch verdict {
+        case .sameSecondOverCount, .crossSecondOverCount:
+            return false
+        case .plausible, .underCovered, .unmeasurable:
+            return true
+        }
+    }
+
     /// Whether a live spot capture collected more beat time than the wall clock allows (no per-beat
     /// timestamps for `rrCoverage`, but the capture knows how long it ran). Only over-count rejects;
     /// sparse windows stay with the `minBeats` gate. Pure. Byte-parity twin of Kotlin
@@ -499,8 +545,12 @@ public enum HRVAnalyzer {
     /// median, so no per-beat artifact rule can see the fault — it is in the decomposition, not in
     /// outliers.
     ///
-    /// Successive-difference statistics (RMSSD, pNN50) are deliberately NOT gated here, for the same
-    /// reason they are not gated by the coverage verdict: that is a question for a capture to answer.
+    /// Successive-difference statistics (RMSSD, pNN50) are deliberately NOT gated here. They ARE now gated
+    /// on the coverage verdict (`successiveDiffIsTrustworthy`), but that is a different fault and a
+    /// different population, and the capture that justified it says nothing about this one. Gating here
+    /// would sweep in the very night described above: coverage 1.03, verdict plausible, and untrustworthy
+    /// only in its decomposition. Refusing those needs its own capture, and inventing one from a WHOOP 4.0
+    /// over-count would be exactly the assumption the paragraph above refused to bake in.
     public static func beatValuesAreTrustworthy(beatAccurateFraction: Double) -> Bool {
         // Negated `<` so a NaN input lands on `true` — NaN means "not measured", and an unmeasured
         // window must not be silently refused. Matches the NaN convention in `classifyCoverage`.
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
index b08748cdca..7a3a6daa0f 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
@@ -2802,7 +2802,32 @@ public enum SleepStager {
     /// Uses the same range-filter + ≥2-valid-interval rule as hrv.rmssd().
     static func sessionAvgHRV(start: Int, end: Int, rr: [RRInterval]) -> Double? {
         let vals = sessionHrvWindows(start: start, end: end, rr: rr, stages: []).compactMap { $0.rmssd }
-        return vals.isEmpty ? nil : vals.reduce(0, +) / Double(vals.count)
+        if vals.isEmpty { return nil }
+        // #1118: refuse the night outright when its own R-R banks more beat-time than the wall clock it
+        // spans. Gated HERE rather than at the caller because this is where RMSSD BECOMES the day's HRV:
+        // one seam covers the daily row, the sleep-session cache, the Health card and the baseline that
+        // later nights are scored against, so none of them can end up disagreeing about whether the night
+        // was trustworthy. See `HRVAnalyzer.successiveDiffIsTrustworthy` for why an over-count corrupts a
+        // successive-difference statistic and why a blank is the right answer.
+        //
+        // Classified over the SAME beats the value was built from, windowed [start, end] exactly as
+        // `sessionHrvWindows` does, so the verdict cannot describe a different set of beats than the number
+        // it is gating.
+        let seg = rr.filter { $0.ts >= start && $0.ts <= end }
+        let segTs = seg.map { $0.ts }
+        let segMs = seg.map { Double($0.rrMs) }
+        let coverage = HRVAnalyzer.rrCoverage(tsSec: segTs, rrMs: segMs)
+        // `collapsed` is deliberately the SAME figure as `coverage`, which pins every over-count here to
+        // crossSecondOverCount. That is not a claim about which kind it is. The collapsed figure exists only
+        // to choose BETWEEN the two over-count verdicts, and this gate refuses both, so the real one would
+        // change no outcome — while costing a full sort of the night's ~50-70k beats, since
+        // `collapsedCoverage` opens with a sort. This runs per session, per day, across ~21 days of every
+        // analyzeRecent, every 15 minutes; #1510 cut this exact path from six sorts a night to two, and
+        // buying a distinction the caller discards would hand that back. `rrCoverage` is a single O(n)
+        // pass. If a future gate ever needs the two over-count cases apart, compute it then.
+        let verdict = HRVAnalyzer.classifyCoverage(coverage: coverage, collapsed: coverage)
+        guard HRVAnalyzer.successiveDiffIsTrustworthy(verdict) else { return nil }
+        return vals.reduce(0, +) / Double(vals.count)
     }
 
     /// Per-5-min-window RMSSD across a session, each window tagged with the sleep stage at its CENTER
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HrvOverCountGateTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HrvOverCountGateTests.swift
new file mode 100644
index 0000000000..69b0c69348
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/HrvOverCountGateTests.swift
@@ -0,0 +1,83 @@
+import XCTest
+import WhoopProtocol
+@testable import StrandAnalytics
+
+/// #1118: RMSSD is withheld on a night whose own R-R banks more beat-time than the wall clock it spans.
+///
+/// Each over-count case asserts TWICE: that the gated call returns nil, AND that the very same beats do
+/// produce an RMSSD through `sessionHrvWindows`. Without that second assertion the test would pass just as
+/// well against a window that had no usable beats at all, proving nothing about the gate.
+/// Byte-parity twin of Kotlin `HrvOverCountGateTest`.
+final class HrvOverCountGateTests: XCTestCase {
+
+    private func windowsYieldRMSSD(_ start: Int, _ end: Int, _ rr: [RRInterval]) -> Bool {
+        !SleepStager.sessionHrvWindows(start: start, end: end, rr: rr, stages: []).compactMap { $0.rmssd }.isEmpty
+    }
+
+    /// Two near-equal beats per second: the shape a same-second collapse WOULD bring back under the
+    /// ceiling. It must still be withheld, and this is the case that guards the gate's cheap
+    /// classification — `sessionAvgHRV` passes coverage as its own collapsed figure to avoid a sort, so a
+    /// night of this shape reports `crossSecondOverCount` internally. The outcome is what matters and is
+    /// asserted here; restoring the real collapsed figure would relabel this night and change nothing.
+    func testSameSecondOverCountIsWithheld() {
+        let start = 1_000, end = 1_600
+        var rr: [RRInterval] = []
+        for i in 0..<600 {
+            rr.append(RRInterval(ts: start + i, rrMs: 900))
+            rr.append(RRInterval(ts: start + i, rrMs: 905))
+        }
+        XCTAssertTrue(windowsYieldRMSSD(start, end, rr), "precondition: these beats DO yield an RMSSD")
+        XCTAssertNil(SleepStager.sessionAvgHRV(start: start, end: end, rr: rr),
+                     "an over-counted night must report no HRV")
+    }
+
+    /// Two beats per second far enough apart that a same-second collapse cannot reach them.
+    func testCrossSecondOverCountIsWithheld() {
+        let start = 1_000, end = 1_600
+        var rr: [RRInterval] = []
+        for i in 0..<600 {
+            rr.append(RRInterval(ts: start + i, rrMs: 880))
+            rr.append(RRInterval(ts: start + i, rrMs: 960))
+        }
+        XCTAssertTrue(windowsYieldRMSSD(start, end, rr), "precondition: these beats DO yield an RMSSD")
+        XCTAssertNil(SleepStager.sessionAvgHRV(start: start, end: end, rr: rr),
+                     "an over-counted night must report no HRV")
+    }
+
+    /// The gate must not touch an ordinary night: one beat per second, coverage ~1.0.
+    func testAPlausibleNightStillReportsItsHRV() {
+        let start = 1_000, end = 1_600
+        let rr = (0..<600).map { RRInterval(ts: start + $0, rrMs: $0 % 2 == 0 ? 980 : 1_020) }
+        let hrv = SleepStager.sessionAvgHRV(start: start, end: end, rr: rr)
+        XCTAssertNotNil(hrv, "a plausible night must keep its HRV")
+        XCTAssertGreaterThan(hrv ?? 0, 0, "and it must be a real reading, not zero")
+    }
+
+    /// A sparse night is underCovered, which is honest data and stays trusted.
+    func testAnUnderCoveredNightIsNotGated() {
+        let start = 1_000, end = 1_600
+        let rr = (0..<300).map { RRInterval(ts: start + $0 * 2, rrMs: $0 % 2 == 0 ? 980 : 1_020) }
+        XCTAssertNotNil(SleepStager.sessionAvgHRV(start: start, end: end, rr: rr),
+                        "sparse is not the same as over-counted")
+    }
+
+    /// The verdict mapping itself, so the seam above and the rule stay pinned separately.
+    func testOnlyTheTwoOverCountVerdictsRefuse() {
+        XCTAssertFalse(HRVAnalyzer.successiveDiffIsTrustworthy(.sameSecondOverCount))
+        XCTAssertFalse(HRVAnalyzer.successiveDiffIsTrustworthy(.crossSecondOverCount))
+        XCTAssertTrue(HRVAnalyzer.successiveDiffIsTrustworthy(.plausible))
+        XCTAssertTrue(HRVAnalyzer.successiveDiffIsTrustworthy(.underCovered))
+        XCTAssertTrue(HRVAnalyzer.successiveDiffIsTrustworthy(.unmeasurable))
+    }
+
+    /// It refuses exactly what the SDNN gate refuses: same rule, stated twice on purpose, never drifting.
+    func testItRefusesTheSameVerdictsAsTheSdnnGate() {
+        let all: [HRVAnalyzer.RrCoverageVerdict] =
+            [.plausible, .underCovered, .sameSecondOverCount, .crossSecondOverCount, .unmeasurable]
+        for v in all {
+            XCTAssertEqual(HRVAnalyzer.beatSpreadIsTrustworthy(v),
+                           HRVAnalyzer.successiveDiffIsTrustworthy(v),
+                           "verdict \(v) must be judged alike by both gates")
+        }
+    }
+}
diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index 6f6eac9dcf..8318823f63 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -1362,9 +1362,12 @@ final class IntelligenceEngine: ObservableObject {
                     // covers 1.25x its wall-clock reads ~197 ms across a sleeping night, against a 40-100 ms
                     // physiological range. Printing that number beside the verdict that says it cannot be
                     // trusted invites it to be read as a measurement, so it is withheld instead; the
-                    // `rrIntegrity=` field on the same line says why. RMSSD/meanNN are NOT withheld — mean
-                    // rate survives an over-count, and RMSSD's dominant error was the emission order fixed
-                    // at the write path (#1072).
+                    // `rrIntegrity=` field on the same line says why. meanNN is NOT withheld: mean rate
+                    // survives an over-count. RMSSD is not withheld FROM THIS LINE either, but it no longer
+                    // reaches the card, the daily row or the baseline on an over-counted night — the gate
+                    // that stops it lives in `SleepStager.sessionAvgHRV` (#1118). Printing the computed
+                    // value here while the app refused to use it is a known wart, held back to keep this
+                    // line byte-identical to the Kotlin twin, whose method budget has no room for it.
                     // P7' follow-up: the over-count verdict is necessary but NOT sufficient. The
                     // 2026-08-06 Oura night measured coverage 1.03 / `plausible` — no duplication at
                     // all, its records tiling the timeline at a fill ratio of 0.990 — and still printed
diff --git a/android/app/src/main/java/com/noop/analytics/HrvAnalyzer.kt b/android/app/src/main/java/com/noop/analytics/HrvAnalyzer.kt
index 1e9cdf6a8b..d29dcf3e33 100644
--- a/android/app/src/main/java/com/noop/analytics/HrvAnalyzer.kt
+++ b/android/app/src/main/java/com/noop/analytics/HrvAnalyzer.kt
@@ -405,10 +405,11 @@ object HrvAnalyzer {
      * arriving in real time, carrying no timestamps to measure coverage with — and suppressing those
      * would refuse honest readings, the opposite of the point.
      *
-     * Successive-difference statistics (RMSSD, pNN50) are deliberately NOT gated here. Their dominant
-     * error on a banked stream was the lost within-second emission order (#823, root-caused in #1072),
-     * which is fixed at the write path; whether they need a gate of their own is a question for a
-     * post-fix capture to answer, not an assumption to bake in now.
+     * Successive-difference statistics (RMSSD, pNN50) are not gated HERE, but they are no longer ungated
+     * by COVERAGE: see [successiveDiffIsTrustworthy] below. The question this comment left open was one for
+     * a post-fix capture to answer; that capture arrived and answered it yes. Note it answered THIS
+     * question only. The sibling deferral on [beatValuesAreTrustworthy], about beat-to-beat accuracy, is
+     * still open and still waiting on a capture of its own.
      */
     fun beatSpreadIsTrustworthy(verdict: RrCoverageVerdict): Boolean = when (verdict) {
         RrCoverageVerdict.SAME_SECOND_OVER_COUNT, RrCoverageVerdict.CROSS_SECOND_OVER_COUNT -> false
@@ -416,6 +417,50 @@ object HrvAnalyzer {
         RrCoverageVerdict.UNMEASURABLE -> true
     }
 
+    /**
+     * Whether RMSSD / pNN50 can be trusted from a window with this coverage verdict (#1118).
+     *
+     * The sibling of [beatSpreadIsTrustworthy], and the same two verdicts refuse, but for its own reason
+     * rather than by borrowing that one's. SDNN is a spread over every interval, so a duplicated beat
+     * widens it. Successive-difference statistics fail the other way: a beat the heart never produced
+     * sits next to its neighbour with a near-zero difference, and RMSSD is the root mean square of
+     * exactly those differences, so an over-counted night reads LOW. Measured on a WHOOP 4.0 night whose
+     * banked R-R covers 2.13x the wall clock it spans, RMSSD reads 36 ms where the same night's beats
+     * collapsed read 41 ms; the direction of the error is not obvious from the number, which is precisely
+     * why it cannot be shown.
+     *
+     * The comment on [beatSpreadIsTrustworthy] used to say these were deliberately ungated because their
+     * dominant error was the lost within-second emission order fixed at the write path (#823 / #1072),
+     * and that whether they needed a gate of their own was for a post-fix capture to answer. The capture
+     * arrived: a build carrying that fix, on a WHOOP 4.0, still reports `crossSecondOverCount` on every
+     * measured night, with 91% of the inflating beat-time on seconds written by more than one delivery.
+     * The write-path fix did not make the stream clean, so the assumption it licensed no longer holds.
+     *
+     * WITHHOLD, DO NOT FABRICATE. This trades a wrong number for a blank on every affected night, which
+     * is a real cost: HRV is the dominant Charge driver, so a gated night drops that term and renormalises
+     * the rest. That cost is accepted deliberately. A contaminated RMSSD does not merely display wrong, it
+     * enters the personal baseline the following nights are scored against, so showing it spreads the
+     * error into days whose own capture was clean.
+     *
+     * THE COST REACHES FURTHER THAN THE CARD, and a reader should know it before widening this rule.
+     * [Baselines.update] holds on a null night without advancing `nValid`, so on an install whose EVERY
+     * night gates, the HRV baseline never reaches [Baselines.minNightsSeed] and stays CALIBRATING
+     * indefinitely. That is the WHOOP 4.0-only case exactly. It is still the right answer, because the
+     * alternative is seeding a personal baseline from beats the heart did not produce and scoring every
+     * later night against it, but it means this gate can leave a strap with no HRV baseline at all rather
+     * than merely a gap in one. A mixed install is unaffected: its clean nights seed the baseline and the
+     * gated ones skip-and-hold.
+     *
+     * UNDER_COVERED and UNMEASURABLE stay trusted for the same reason they do above: neither duplicates a
+     * beat, and UNMEASURABLE is what an honest live spot reading looks like. Pure. Byte-parity twin of
+     * Swift `successiveDiffIsTrustworthy`.
+     */
+    fun successiveDiffIsTrustworthy(verdict: RrCoverageVerdict): Boolean = when (verdict) {
+        RrCoverageVerdict.SAME_SECOND_OVER_COUNT, RrCoverageVerdict.CROSS_SECOND_OVER_COUNT -> false
+        RrCoverageVerdict.PLAUSIBLE, RrCoverageVerdict.UNDER_COVERED,
+        RrCoverageVerdict.UNMEASURABLE -> true
+    }
+
     /**
      * Whether a live spot capture collected more beat time than the wall clock allows (no per-beat
      * timestamps for [rrCoverage], but the capture knows how long it ran). Only over-count rejects;
@@ -487,8 +532,12 @@ object HrvAnalyzer {
      * median, so no per-beat artifact rule can see the fault — it is in the decomposition, not in
      * outliers.
      *
-     * Successive-difference statistics (RMSSD, pNN50) are deliberately NOT gated here, for the same
-     * reason they are not gated by the coverage verdict: that is a question for a capture to answer.
+     * Successive-difference statistics (RMSSD, pNN50) are deliberately NOT gated here. They ARE now gated
+     * on the coverage verdict ([successiveDiffIsTrustworthy]), but that is a different fault and a
+     * different population, and the capture that justified it says nothing about this one. Gating here
+     * would sweep in the very night described above: coverage 1.03, verdict PLAUSIBLE, and untrustworthy
+     * only in its decomposition. Refusing those needs its own capture, and inventing one from a WHOOP 4.0
+     * over-count would be exactly the assumption the paragraph above refused to bake in.
      */
     fun beatValuesAreTrustworthy(beatAccurateFraction: Double): Boolean =
         // Negated `<` so a NaN input lands on `true` — NaN means "not measured", and an unmeasured
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index bbc588a421..4e93abce33 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -1140,9 +1140,13 @@ object IntelligenceEngine {
                 // 1.25x its wall-clock reads ~197 ms across a sleeping night, against a 40-100 ms
                 // physiological range. Printing that number beside the verdict that says it cannot be
                 // trusted invites it to be read as a measurement, so it is withheld instead; the
-                // `rrIntegrity=` field on the same line says why. RMSSD/meanNN are NOT withheld — mean rate
-                // survives an over-count, and RMSSD's dominant error was the emission order fixed at the
-                // write path (#1072). Twin of the Swift line.
+                // `rrIntegrity=` field on the same line says why. meanNN is NOT withheld: mean rate
+                // survives an over-count. RMSSD is not withheld FROM THIS LINE either, but it no longer
+                // reaches the card, the daily row or the baseline on an over-counted night — the gate that
+                // stops it lives in `SleepStager.sessionAvgHRV` (#1118). Printing the computed value here
+                // while the app refused to use it is a known wart: matching SDNN's `withheld` treatment
+                // needs room this method does not have, since its JaCoCo budget is already at the ratchet.
+                // Twin of the Swift line.
                 // P7' follow-up: the over-count verdict is necessary but NOT sufficient. The 2026-08-06
                 // Oura night measured coverage 1.03 / PLAUSIBLE — no duplication at all, its records
                 // tiling the timeline at a fill ratio of 0.990 — and still printed SDNN 174 ms. A BANKED
diff --git a/android/app/src/main/java/com/noop/analytics/SleepStager.kt b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
index 5538dfde61..523122f34e 100644
--- a/android/app/src/main/java/com/noop/analytics/SleepStager.kt
+++ b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
@@ -3108,7 +3108,32 @@ object SleepStager {
      */
     internal fun sessionAvgHRV(start: Long, end: Long, rr: List<RrInterval>): Double? {
         val vals = sessionHrvWindows(start, end, rr, emptyList()).mapNotNull { it.rmssd }
-        return if (vals.isEmpty()) null else vals.sum() / vals.size.toDouble()
+        if (vals.isEmpty()) return null
+        // #1118: refuse the night outright when its own R-R banks more beat-time than the wall clock it
+        // spans. Gated HERE rather than at the caller because this is where RMSSD BECOMES the day's HRV:
+        // one seam covers the daily row, the sleep-session cache, the Health card and the baseline that
+        // later nights are scored against, so none of them can end up disagreeing about whether the night
+        // was trustworthy. See [HrvAnalyzer.successiveDiffIsTrustworthy] for why an over-count corrupts a
+        // successive-difference statistic and why a blank is the right answer.
+        //
+        // Classified over the SAME beats the value was built from, windowed [start, end] exactly as
+        // `sessionHrvWindows` does, so the verdict cannot describe a different set of beats than the number
+        // it is gating.
+        val seg = rr.filter { it.ts in start..end }
+        val segTs = seg.map { it.ts }
+        val segMs = seg.map { it.rrMs.toDouble() }
+        val coverage = HrvAnalyzer.rrCoverage(segTs, segMs)
+        // `collapsed` is deliberately the SAME figure as `coverage`, which pins every over-count here to
+        // CROSS_SECOND. That is not a claim about which kind it is. The collapsed figure exists only to
+        // choose BETWEEN the two over-count verdicts, and this gate refuses both, so the real one would
+        // change no outcome — while costing a full sort of the night's ~50-70k beats, since
+        // [HrvAnalyzer.collapsedCoverage] opens with `sortedWith`. This runs per session, per day, across
+        // ~21 days of every analyzeRecent, every 15 minutes; #1510 cut this exact path from six sorts a
+        // night to two, and buying a distinction the caller discards would hand that back. `rrCoverage` is
+        // a single O(n) pass. If a future gate ever needs the two over-count cases apart, compute it then.
+        val verdict = HrvAnalyzer.classifyCoverage(coverage, coverage)
+        if (!HrvAnalyzer.successiveDiffIsTrustworthy(verdict)) return null
+        return vals.sum() / vals.size.toDouble()
     }
 
     /**
diff --git a/android/app/src/test/java/com/noop/analytics/HrvOverCountGateTest.kt b/android/app/src/test/java/com/noop/analytics/HrvOverCountGateTest.kt
new file mode 100644
index 0000000000..e66d30cd22
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/HrvOverCountGateTest.kt
@@ -0,0 +1,87 @@
+package com.noop.analytics
+
+import com.noop.data.RrInterval
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #1118: RMSSD is withheld on a night whose own R-R banks more beat-time than the wall clock it spans.
+ *
+ * Each over-count case asserts TWICE: that the gated call returns null, AND that the very same beats do
+ * produce an RMSSD through [SleepStager.sessionHrvWindows]. Without that second assertion the test would
+ * pass just as well against a window that had no usable beats at all, proving nothing about the gate.
+ */
+class HrvOverCountGateTest {
+
+    private fun rr(ts: Long, ms: Int) = RrInterval(deviceId = "d", ts = ts, rrMs = ms)
+
+    private fun windowsYieldRmssd(start: Long, end: Long, rr: List<RrInterval>): Boolean =
+        SleepStager.sessionHrvWindows(start, end, rr, emptyList()).mapNotNull { it.rmssd }.isNotEmpty()
+
+    /**
+     * Two near-equal beats per second: the shape a same-second collapse WOULD bring back under the
+     * ceiling. It must still be withheld, and this is the case that guards the gate's cheap
+     * classification — [SleepStager.sessionAvgHRV] passes coverage as its own collapsed figure to avoid
+     * a sort, so a night of this shape reports CROSS_SECOND internally. The outcome is what matters and
+     * is asserted here; restoring the real collapsed figure would relabel this night and change nothing.
+     */
+    @Test fun sameSecondOverCountIsWithheld() {
+        val start = 1000L
+        val end = start + 600
+        val rr = (0 until 600).flatMap { i -> listOf(rr(start + i, 900), rr(start + i, 905)) }
+        assertTrue("precondition: these beats DO yield an RMSSD", windowsYieldRmssd(start, end, rr))
+        assertNull("an over-counted night must report no HRV", SleepStager.sessionAvgHRV(start, end, rr))
+    }
+
+    /** Two beats per second far enough apart that a same-second collapse cannot reach them. */
+    @Test fun crossSecondOverCountIsWithheld() {
+        val start = 1000L
+        val end = start + 600
+        val rr = (0 until 600).flatMap { i -> listOf(rr(start + i, 880), rr(start + i, 960)) }
+        assertTrue("precondition: these beats DO yield an RMSSD", windowsYieldRmssd(start, end, rr))
+        assertNull("an over-counted night must report no HRV", SleepStager.sessionAvgHRV(start, end, rr))
+    }
+
+    /** The gate must not touch an ordinary night: one beat per second, coverage ~1.0. */
+    @Test fun aPlausibleNightStillReportsItsHrv() {
+        val start = 1000L
+        val end = start + 600
+        val rr = (0 until 600).map { i -> rr(start + i, if (i % 2 == 0) 980 else 1020) }
+        val hrv = SleepStager.sessionAvgHRV(start, end, rr)
+        assertNotNull("a plausible night must keep its HRV", hrv)
+        assertTrue("and it must be a real reading, not zero", hrv!! > 0.0)
+    }
+
+    /** A sparse night is UNDER_COVERED, which is honest data and stays trusted. */
+    @Test fun anUnderCoveredNightIsNotGated() {
+        val start = 1000L
+        val end = start + 600
+        // A beat every other second: ~0.5 coverage, nothing duplicated.
+        val rr = (0 until 300).map { i -> rr(start + i * 2, if (i % 2 == 0) 980 else 1020) }
+        assertNotNull("sparse is not the same as over-counted",
+            SleepStager.sessionAvgHRV(start, end, rr))
+    }
+
+    /** The verdict mapping itself, so the seam above and the rule stay pinned separately. */
+    @Test fun onlyTheTwoOverCountVerdictsRefuse() {
+        assertFalse(HrvAnalyzer.successiveDiffIsTrustworthy(
+            HrvAnalyzer.RrCoverageVerdict.SAME_SECOND_OVER_COUNT))
+        assertFalse(HrvAnalyzer.successiveDiffIsTrustworthy(
+            HrvAnalyzer.RrCoverageVerdict.CROSS_SECOND_OVER_COUNT))
+        assertTrue(HrvAnalyzer.successiveDiffIsTrustworthy(HrvAnalyzer.RrCoverageVerdict.PLAUSIBLE))
+        assertTrue(HrvAnalyzer.successiveDiffIsTrustworthy(HrvAnalyzer.RrCoverageVerdict.UNDER_COVERED))
+        assertTrue(HrvAnalyzer.successiveDiffIsTrustworthy(HrvAnalyzer.RrCoverageVerdict.UNMEASURABLE))
+    }
+
+    /** It refuses exactly what the SDNN gate refuses: same rule, stated twice on purpose, never drifting. */
+    @Test fun itRefusesTheSameVerdictsAsTheSdnnGate() {
+        for (v in HrvAnalyzer.RrCoverageVerdict.entries) {
+            assertEquals("verdict $v must be judged alike by both gates",
+                HrvAnalyzer.beatSpreadIsTrustworthy(v), HrvAnalyzer.successiveDiffIsTrustworthy(v))
+        }
+    }
+}

From ef54b752586cdd7ebddd53b57c3560498073f173 Mon Sep 17 00:00:00 2001
From: Andreas Grasser <andi@grasserisen.de>
Date: Mon, 7 Sep 2026 00:00:21 +0200
Subject: [PATCH 293/333] de: convert the German copy from formal Sie to
 informal du
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The German copy mixed formal and informal address, which reads wrong for a
fitness app. Converted throughout to the informal du form: 165 strings in
values-de/strings.xml and 26 in the xcstrings, plus two mistranslations
corrected.

Reported and translated by @andigandhi, a native speaker.

Verified on review rather than taken on trust, since a bulk translation edit
fails in ways a reader cannot see. No format specifier was gained, lost or
renumbered in any of the 191 changed strings on either platform, and no key was
added or removed. The xcstrings change is a text splice rather than a
reserialisation of the 6 MB catalog. Capitalisation is internally consistent:
273 lowercase du forms against 93 capitalised, every one of the latter
sentence-initial and none mid-sentence.

Two follow-ups folded in before merge. The branch did not build:
mergeFullDebugResources refused values-de for duplicate items, 2644 entries
against main's 2642, two keys present twice as rebase artifacts where the merge
kept a pre-existing line beside its replacement. For the calibrating-nights
string the English source is "%1$s of %2$s nights", so the copy carrying
"Nächten" is the live wording and the bare one was stale; the other pair was
byte-identical.

And nine strings still used formal address after the pass, three on Android in
the coach_voice cluster and six in the xcstrings, one of which is the twin of an
Android string this branch had already converted. All converted in the branch's
own style. One of them additionally read "Senden sie jedem kandidaten und
beobachten sie beide das straplog und das strap selbst", formal address on top
of a machine translation with the nouns uncapitalised, so it was rewritten as a
du-imperative with German capitalisation restored.

After: 2642 entries and no duplicates, both files parse, no formal address left
on either platform, i18n_audit --ci clean, Android suite 5430 green.
---
 Strand/Resources/Localizable.xcstrings        |  62 ++--
 .../app/src/main/res/values-de/strings.xml    | 336 +++++++++---------
 2 files changed, 199 insertions(+), 199 deletions(-)

diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 755687b563..6e358e6136 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -21977,7 +21977,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Ein Read-Only Plews / Altini am kleinsten Wert während der Änderung Ihrer nächtlichen HRV: Es zeigt an, ob Ihre 7-Nächte-HRV-Basislinie über, innerhalb oder unter Ihrem persönlichen normalen Band liegt. Es ändert nichts anderes - der Energiering ist identisch, ob dieser ein- oder ausgeschaltet ist. Dies ist eine grobe / frühe Prüfung, die noch nicht gegen unterschiedliche reale Daten (n = 1) validiert wurde."
+            "value": "Ein Read-Only Plews / Altini am kleinsten Wert während der Änderung deiner nächtlichen HRV: Es zeigt an, ob deine 7-Nächte-HRV-Basislinie über, innerhalb oder unter deinem persönlichen normalen Band liegt. Es ändert nichts anderes - der Energiering ist identisch, ob dieser ein- oder ausgeschaltet ist. Dies ist eine grobe / frühe Prüfung, die noch nicht gegen unterschiedliche reale Daten (n = 1) validiert wurde."
           }
         },
         "es": {
@@ -22720,7 +22720,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Ein transparentes kardiorespiratorisches Rezept, das sich tief und REM besser erholt als das ältere V1-Staging und jetzt standardmäßig ist. Es ändert sich nur, wie bereits erkannte Nächte in Etappen unterteilt sind (Erkennung und Ergebnisse sind unverändert); Schalten Sie es aus, um auf V1 zurückzugreifen. Tritt in den nächsten Nächten inszeniert."
+            "value": "Ein transparentes kardiorespiratorisches Rezept, das sich tief und REM besser erholt als das ältere V1-Staging und jetzt standardmäßig ist. Es ändert sich nur, wie bereits erkannte Nächte in Etappen unterteilt sind (Erkennung und Ergebnisse sind unverändert); Schalte es aus, um auf V1 zurückzugreifen. Tritt in den nächsten Nächten inszeniert."
           }
         },
         "es": {
@@ -26068,7 +26068,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Fügen Sie Ihre Oura-App-Anmeldeinformationen zu OuraSecrets.xcconfig hinzu, um dies zu ermöglichen."
+            "value": "Füge deine Oura-App-Anmeldeinformationen zu OuraSecrets.xcconfig hinzu, um dies zu ermöglichen."
           }
         },
         "es": {
@@ -29896,7 +29896,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Bewaffnet am Riemen selbst mit dem experimentellen Befehl 5/MG. Ein gurtgetriebener Wake ist immer noch unbestätigt auf 5/MG auf unserer Seite (bestätigt nur auf WHOOP 4.0), also halten Sie einen Backup-Alarm für alles, was Sie wirklich nicht verpassen können."
+            "value": "Bewaffnet am Riemen selbst mit dem experimentellen Befehl 5/MG. Ein gurtgetriebener Wake ist immer noch unbestätigt auf 5/MG auf unserer Seite (bestätigt nur auf WHOOP 4.0), also halte einen Backup-Alarm für alles, was du wirklich nicht verpassen kannst."
           }
         },
         "es": {
@@ -29936,7 +29936,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Bewaffnet auf dem gurt selbst, so dass es zu ihrer wachzeit summen kann, auch wenn ihr telefon schläft oder xnoopx geschlossen ist. Sendet den genauen Alarmbefehl, den die offizielle App sendet, bestätigtes Summen auf einem echten WHOOP 4.0 (Community-Wire-Capture + On-Device-Test, #535). Halten Sie einen Backup-Alarm für alles, was Sie wirklich nicht verpassen können."
+            "value": "Bewaffnet auf dem gurt selbst, so dass es zu ihrer wachzeit summen kann, auch wenn ihr telefon schläft oder xnoopx geschlossen ist. Sendet den genauen Alarmbefehl, den die offizielle App sendet, bestätigtes Summen auf einem echten WHOOP 4.0 (Community-Wire-Capture + On-Device-Test, #535). Halte einen Backup-Alarm für alles, was du wirklich nicht verpassen kannst."
           }
         },
         "es": {
@@ -30034,7 +30034,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Armiert den Riemen, um zu Ihrer Weckzeit zu summen, auch wenn NOOP geschlossen ist. Sendet den genauen Alarmbefehl, den die offizielle App sendet, bestätigtes Summen auf einem echten WHOOP 4.0 (Community-Wire-Capture + On-Device-Test, #535). Halten Sie einen Backup-Alarm für alles, was Sie wirklich nicht verpassen können."
+            "value": "Armiert den Riemen, um zu deiner Weckzeit zu summen, auch wenn NOOP geschlossen ist. Sendet den genauen Alarmbefehl, den die offizielle App sendet, bestätigtes Summen auf einem echten WHOOP 4.0 (Community-Wire-Capture + On-Device-Test, #535). Halte einen Backup-Alarm für alles, was du wirklich nicht verpassen kannst."
           }
         },
         "es": {
@@ -38064,7 +38064,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Geben Sie einen Marker CSV (Datum, Marker, Wert, Einheit). Namen, die mit der Katalogfaltung auf Ihre vorhandenen Markierungen übereinstimmen; alles andere kommt als benutzerdefinierte Markierung vor. Zeilen, die nicht gelesen werden können, werden übersprungen und gezählt, nie erraten. Alles, was Sie importieren, bleibt auf %1$@."
+            "value": "Gib einen Marker CSV (Datum, Marker, Wert, Einheit). Namen, die mit der Katalogfaltung auf deine vorhandenen Markierungen übereinstimmen; alles andere kommt als benutzerdefinierte Markierung vor. Zeilen, die nicht gelesen werden können, werden übersprungen und gezählt, nie erraten. Alles, was du importierst, bleibt auf %1$@."
           }
         },
         "es": {
@@ -44599,7 +44599,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Energie gewichtet Ihre HRV gegenüber Ihrer persönlichen Basislinie (~55%%), Ruheherzfrequenz (~20%%), Erholungsqualität (~15%%), Atmung (~5%%) und Hauttemperaturabweichung (~5%%). Belastung ist eine kardiovaskuläre Belastung von 0–%lld aus der Zeit in Herzfrequenzzonen. Erholung wird aus Bewegung und Herzfrequenz in Schlafphasen eingeteilt. Alles wird hier aus den Rohdaten des Straps berechnet."
+            "value": "Energie gewichtet deine HRV gegenüber deiner persönlichen Basislinie (~55%%), Ruheherzfrequenz (~20%%), Erholungsqualität (~15%%), Atmung (~5%%) und Hauttemperaturabweichung (~5%%). Belastung ist eine kardiovaskuläre Belastung von 0–%lld aus der Zeit in Herzfrequenzzonen. Erholung wird aus Bewegung und Herzfrequenz in Schlafphasen eingeteilt. Alles wird hier aus den Rohdaten des Straps berechnet."
           }
         },
         "es": {
@@ -75917,7 +75917,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Heads up: Dieser Testmodus ist ausgeschaltet, so dass der Bericht keine Erfassung dafür hat. Für einen nützlichen Bericht schalten Sie den Modus ein, reproduzieren das Problem beim Tragen des Riemens und melden Sie es erneut."
+            "value": "Heads up: Dieser Testmodus ist ausgeschaltet, so dass der Bericht keine Erfassung dafür hat. Für einen nützlichen Bericht schalte den Modus ein, reproduzieren das Problem beim Tragen des Riemens und melde es erneut."
           }
         },
         "es": {
@@ -80674,7 +80674,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Wie man das liest: HRV, Ruhe HR, Schlafdauer, Atemfrequenz und Hauttemperatur werden vom Band gemessen (Hauttemperatur wird als Abweichung von der eigenen Baseline angezeigt). Workouts ist die Anzahl der Aktivitäten, die Sie protokolliert haben oder die erkannt wurden. Recovery, Strain und Stress sind die eigenen On-Device-Scores von NOOP, keine klinischen Maßnahmen: Erholung ist eine tägliche Bereitschaft Komposit (HRV, Ruhe HR, Schlaf und Haut-Temper-Trend), Strain ist Herz-Kreislauf-Last von der Herzfrequenz abgeleitet, und Stress ist ein 0-3 autonome Last-Index von Ruhe HR und HRV."
+            "value": "Wie man das liest: HRV, Ruhe HR, Schlafdauer, Atemfrequenz und Hauttemperatur werden vom Band gemessen (Hauttemperatur wird als Abweichung von der eigenen Baseline angezeigt). Workouts ist die Anzahl der Aktivitäten, die du protokolliert hast oder die erkannt wurden. Recovery, Strain und Stress sind die eigenen On-Device-Scores von NOOP, keine klinischen Maßnahmen: Erholung ist eine tägliche Bereitschaft Komposit (HRV, Ruhe HR, Schlaf und Haut-Temper-Trend), Strain ist Herz-Kreislauf-Last von der Herzfrequenz abgeleitet, und Stress ist ein 0-3 autonome Last-Index von Ruhe HR und HRV."
           }
         },
         "es": {
@@ -100399,7 +100399,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Bewegen Sie diesen Schlaf?"
+            "value": "Bewege diesen Schlaf?"
           }
         },
         "es": {
@@ -101455,7 +101455,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "NOOP bietet Ihnen drei tägliche Werte (Charge, Effort und Rest), jede auf einer 0-100-Skala. Sie werden aus den rohen Signalen Ihres Gurts mit veröffentlichten, von Experten begutachteten Sportwissenschaften aufgebaut und vollständig auf Ihrem Gerät berechnet. Sie sind NICHT die Ergebnisse von WHOOP: Wir haben keine privaten Algorithmen von WHOOP und tun nicht so, als ob. Sie zielen auf die gleichen drei Fragen mit Open Science, so dass sie normalerweise WHOOP in Richtung verfolgen, aber nicht mit Zahl für Zahl übereinstimmen. Und darum geht es."
+            "value": "NOOP bietet dir drei tägliche Werte (Charge, Effort und Rest), jede auf einer 0-100-Skala. Sie werden aus den rohen Signalen deines Gurts mit veröffentlichten, von Experten begutachteten Sportwissenschaften aufgebaut und vollständig auf deinem Gerät berechnet. Sie sind NICHT die Ergebnisse von WHOOP: Wir haben keine privaten Algorithmen von WHOOP und tun nicht so, als ob. Sie zielen auf die gleichen drei Fragen mit Open Science, so dass sie normalerweise WHOOP in Richtung verfolgen, aber nicht mit Zahl für Zahl übereinstimmen. Und darum geht es."
           }
         },
         "es": {
@@ -113858,7 +113858,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Ältere Backups darüber hinaus werden viele beschnitten, älteste zuerst (≈ so viele Tage). Wenn Daten jemals korrumpiert werden, stellen Sie das Neueste wieder her."
+            "value": "Ältere Backups darüber hinaus werden viele beschnitten, älteste zuerst (≈ so viele Tage). Wenn Daten jemals korrumpiert werden, stelle das Neueste wieder her."
           }
         },
         "es": {
@@ -121210,7 +121210,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Bitte bestätigen Sie diese:"
+            "value": "Bitte bestätige diese:"
           }
         },
         "es": {
@@ -121314,7 +121314,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Bitte lesen Sie die Punkte unten und bestätigen Sie dann jede Aussage."
+            "value": "Bitte lies die Punkte unten und bestätige dann jede Aussage."
           }
         },
         "es": {
@@ -126182,7 +126182,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Lesen Sie Ihre Herzfrequenz, HRV, Blutsauerstoff, Atemfrequenz, Schlaf, Schritte und Energie direkt von Apple Health und schreiben Sie NOOP's Banddaten zurück: Schlafen Sie mit vollen Stadien, kontinuierlicher Herzfrequenz, Workouts und nächtlichen Vitalen. Alles bleibt auf %1$@."
+            "value": "Lies deine Herzfrequenz, HRV, Blutsauerstoff, Atemfrequenz, Schlaf, Schritte und Energie direkt von Apple Health und schreibe NOOP's Banddaten zurück: Schlafe mit vollen Stadien, kontinuierlicher Herzfrequenz, Workouts und nächtlichen Vitalen. Alles bleibt auf %1$@."
           }
         },
         "es": {
@@ -131745,7 +131745,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Ersetzt die Registerkarte Heute durch das Prototyp-Redesign. Schalten Sie es jederzeit aus, um zum klassischen Dashboard zurückzukehren. Lies die gleichen live-daten von deinem strap."
+            "value": "Ersetzt die Registerkarte Heute durch das Prototyp-Redesign. Schalte es jederzeit aus, um zum klassischen Dashboard zurückzukehren. Lies die gleichen live-daten von deinem strap."
           }
         },
         "es": {
@@ -133551,7 +133551,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "%1$@ neu starten? Es trennt sich für etwa 30 Sekunden, während es neu startet, und verbindet sich dann von selbst wieder. Ihre aufgezeichneten Daten werden aufbewahrt."
+            "value": "%1$@ neu starten? Es trennt sich für etwa 30 Sekunden, während es neu startet, und verbindet sich dann von selbst wieder. Deine aufgezeichneten Daten werden aufbewahrt."
           }
         },
         "es": {
@@ -133631,7 +133631,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Starten Sie dieses Band neu?"
+            "value": "Starte dieses Band neu?"
           }
         },
         "es": {
@@ -136403,7 +136403,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Läuft den kontinuierlichen HRV-Stream nur während Ihres ruhigen Stundenfensters (standardmäßig 22:00-07:00 Uhr) aus und halbiert damit die Batteriekosten. Tagesstresswerte werden sparsamer sein. Hinweis: Die kontinuierliche Hintergrund-HRV-Erfassung (einschließlich Nickerchen am Tag) wird außerhalb dieses Fensters angehalten. Für On-Demand-HRV-Messungen am Tag (einschließlich Nickerchen), verwenden Sie die Schaltfläche \"Take an HRV reading\" auf dem Live-Bildschirm."
+            "value": "Läuft den kontinuierlichen HRV-Stream nur während deines ruhigen Stundenfensters (standardmäßig 22:00-07:00 Uhr) aus und halbiert damit die Batteriekosten. Tagesstresswerte werden sparsamer sein. Hinweis: Die kontinuierliche Hintergrund-HRV-Erfassung (einschließlich Nickerchen am Tag) wird außerhalb dieses Fensters angehalten. Für On-Demand-HRV-Messungen am Tag (einschließlich Nickerchen), verwende die Schaltfläche \"Take an HRV reading\" auf dem Live-Bildschirm."
           }
         },
         "es": {
@@ -156721,7 +156721,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Tippen Sie auf eine Bühne, um mit Ihrem 30-Tage-Typ zu vergleichen."
+            "value": "Tippe auf eine Bühne, um mit deinem 30-Tage-Typ zu vergleichen."
           }
         },
         "es": {
@@ -157823,7 +157823,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Deshalb beginnt eine Watch-Only-Energie mit \"Kalibrieren\". NOOP benötigt etwa sieben Nächte Ihrer HRV, um zu erfahren, wie normal für Sie aussieht. Bis es sie hat, hält es die Punktzahl zurück, anstatt zu erraten. Sobald die Basislinie festgelegt ist, erscheint Ihre Energie mit ihrem Vertrauen auf der gleichen 0-100-Skala wie ein Gurt."
+            "value": "Deshalb beginnt eine Watch-Only-Energie mit \"Kalibrieren\". NOOP benötigt etwa sieben Nächte deiner HRV, um zu erfahren, wie normal für dich aussieht. Bis es sie hat, hält es die Punktzahl zurück, anstatt zu erraten. Sobald die Basislinie festgelegt ist, erscheint deine Energie mit ihrem Vertrauen auf der gleichen 0-100-Skala wie ein Gurt."
           }
         },
         "es": {
@@ -157979,7 +157979,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Der WHOOP 4.0-Reboot-Frame wird nicht bestätigt - ein normaler Neustart wird ignoriert (# 235). Senden sie jedem kandidaten und beobachten sie beide das straplog und das strap selbst. \"Keine Trennung innerhalb von 12s\" bedeutet, dass das Band den Rahmen ignoriert hat. Eine \"Link Drop\" -Linie bedeutet, dass der Rahmen den Riemen erreicht hat - aber ein Drop Link allein ist kein Neustart: Ein echter Neustart schaltet auch das Sensorlicht des Riemens für ein paar Sekunden aus, also wenn das Licht anblieb, war es nur eine Drop-Verbindung, kein Neustart. Zerstörungsfrei - Ihre Daten werden gespeichert. Bitte teilen Sie das Protokoll, damit wir den echten Rahmen anheften können."
+            "value": "Der WHOOP 4.0-Reboot-Frame wird nicht bestätigt - ein normaler Neustart wird ignoriert (# 235). Sende sie an jeden Kandidaten und beobachte dabei sowohl das Straplog als auch den Strap selbst. \"Keine Trennung innerhalb von 12s\" bedeutet, dass das Band den Rahmen ignoriert hat. Eine \"Link Drop\" -Linie bedeutet, dass der Rahmen den Riemen erreicht hat - aber ein Drop Link allein ist kein Neustart: Ein echter Neustart schaltet auch das Sensorlicht des Riemens für ein paar Sekunden aus, also wenn das Licht anblieb, war es nur eine Drop-Verbindung, kein Neustart. Zerstörungsfrei - deine Daten werden gespeichert. Bitte teile das Protokoll, damit wir den echten Rahmen anheften können."
           }
         },
         "es": {
@@ -158407,7 +158407,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Die Linie ist der 0-3 Proxy jeder Wachstunde, der heute gegen Ihre eigenen ruhigen Stunden erzielt wurde. Die Bar unten teilt Ihren Tag in ruhige, moderate und hohe Stresszeit."
+            "value": "Die Linie ist der 0-3 Proxy jeder Wachstunde, der heute gegen deine eigenen ruhigen Stunden erzielt wurde. Die Bar unten teilt deinen Tag in ruhige, moderate und hohe Stresszeit."
           }
         },
         "es": {
@@ -158917,7 +158917,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Der Riemen meldet eine andere Zeit als NOOP sendet, so dass sein Firmware-Alarm nicht zu Ihrer Weckzeit feuert - normalerweise ein Riemen, dessen Uhr oder Alarm zurückgesetzt wurde. Setzen Sie den Riemen in der offiziellen WHOOP-App zurück (oder laden Sie ihn vollständig auf und verbinden Sie ihn wieder), und halten Sie den Uhralarm Ihres Telefons solange wach, bis es dauert."
+            "value": "Der Riemen meldet eine andere Zeit als NOOP sendet, so dass sein Firmware-Alarm nicht zu deiner Weckzeit feuert - normalerweise ein Riemen, dessen Uhr oder Alarm zurückgesetzt wurde. Setze den Riemen in der offiziellen WHOOP-App zurück (oder lade ihn vollständig auf und verbinde ihn wieder), und halte den Uhralarm deines Telefons solange wach, bis es dauert."
           }
         },
         "es": {
@@ -159834,7 +159834,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Auch diese Sicherungen sind unverschlüsselt. Wenn dieser Ordner mit Drive, Dropbox oder iCloud synchronisiert wird, landet die lesbare Datei auch dort — zeigen Sie nur auf einen Dienst, dem Sie vertrauen."
+            "value": "Auch diese Sicherungen sind unverschlüsselt. Wenn dieser Ordner mit Drive, Dropbox oder iCloud synchronisiert wird, landet die lesbare Datei auch dort — zeige nur auf einen Dienst, dem du vertraust."
           }
         },
         "en": {
@@ -160557,7 +160557,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Das ist ein einfaches, unverschlüsseltes Archiv — wer die Datei bekommt, kann sie mit jedem Zip-Programm öffnen. Bewahren Sie sie an einem Ort auf, dem Sie vertrauen."
+            "value": "Das ist ein einfaches, unverschlüsseltes Archiv — wer die Datei bekommt, kann sie mit jedem Zip-Programm öffnen. Bewahre sie an einem Ort auf, dem du vertraust."
           }
         },
         "en": {
@@ -166134,7 +166134,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Schalten Sie Benachrichtigungen für NOOP in den Einstellungen ein, um Ihre Winddown-Erinnerung zu erhalten."
+            "value": "Schalte Benachrichtigungen für NOOP in den Einstellungen ein, um deine Winddown-Erinnerung zu erhalten."
           }
         },
         "es": {
@@ -172253,7 +172253,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Wir vergleichen die heutige Ruheherzfrequenz und HRV mit Ihrer eigenen 30-Tage-Baseline. Eine höher als üblich ruhende HR und eine niedriger als üblich HRV schieben beide die Punktzahl nach oben, klassische Zeichen, dass der Körper aktiviert wird. Die kombinierte Schicht wird auf eine 0-3 Skala abgebildet: 0 ist ruhig, 1,5 sitzt an der Basislinie, 3 ist stark aktiviert."
+            "value": "Wir vergleichen die heutige Ruheherzfrequenz und HRV mit deiner eigenen 30-Tage-Baseline. Eine höher als üblich ruhende HR und eine niedriger als üblich HRV schieben beide die Punktzahl nach oben, klassische Zeichen, dass der Körper aktiviert wird. Die kombinierte Schicht wird auf eine 0-3 Skala abgebildet: 0 ist ruhig, 1,5 sitzt an der Basislinie, 3 ist stark aktiviert."
           }
         },
         "es": {
@@ -174997,7 +174997,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Wenn NOOP die Herzfrequenz aus der optischen Wellenform WHOOP 5/MG v26 rekonstruiert (die Sekunden, in denen das Band keine HR gespeichert hat), verfeinern Sie den Autokorrelationspeak mit einem parabolischen Sublag-Fit, so dass die Schätzung nicht auf etwa 16 bpm-Schritte in der Nähe einer hohen HR quantifiziert wird. Es füllt nur Sekunden, die das Band nie gemeldet hat; es überschreibt niemals eine gespeicherte HR. 5/MG, standardmäßig ausgeschaltet."
+            "value": "Wenn NOOP die Herzfrequenz aus der optischen Wellenform WHOOP 5/MG v26 rekonstruiert (die Sekunden, in denen das Band keine HR gespeichert hat), verfeinere den Autokorrelationspeak mit einem parabolischen Sublag-Fit, so dass die Schätzung nicht auf etwa 16 bpm-Schritte in der Nähe einer hohen HR quantifiziert wird. Es füllt nur Sekunden, die das Band nie gemeldet hat; es überschreibt niemals eine gespeicherte HR. 5/MG, standardmäßig ausgeschaltet."
           }
         },
         "es": {
@@ -175914,7 +175914,7 @@
         "de": {
           "stringUnit": {
             "state": "translated",
-            "value": "Die ganze Nacht ist das Standardmaß von NOOP; Deep Sleep Pools HRV nur über Slow Wave Sleep, lesen niedriger und passend zu WHOOP. Durch das Umschalten werden Ihre letzten Nächte über das neue Fenster neu bewertet und sofort wirksam, sobald Sie ein paar Nächte Daten haben."
+            "value": "Die ganze Nacht ist das Standardmaß von NOOP; Deep Sleep Pools HRV nur über Slow Wave Sleep, lesen niedriger und passend zu WHOOP. Durch das Umschalten werden deine letzten Nächte über das neue Fenster neu bewertet und sofort wirksam, sobald du ein paar Nächte Daten hast."
           }
         },
         "es": {
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index aba6ea9480..1643e53555 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -179,10 +179,10 @@
 
     <!-- Power saving (#477) -->
     <string name="fast_link_phy">Schnellere Bluetooth-Verbindung (experimentell)</string>
-    <string name="fast_link_phy_desc">Fordert einen schnelleren Bluetooth-Funkmodus an, während Ihr Riemen seinen gespeicherten Verlauf überträgt. Dieselben Daten in kürzerer Sendezeit — möglicherweise schnellere Synchronisierung und etwas weniger Akkuverbrauch am Riemen. Ihr Riemen muss dies unterstützen, und es geht etwas Reichweite verloren. Neu und unerprobt: Schalten Sie es aus, wenn die Synchronisierung auf Distanz unzuverlässig wird.</string>
+    <string name="fast_link_phy_desc">Fordert einen schnelleren Bluetooth-Funkmodus an, während dein Riemen seinen gespeicherten Verlauf überträgt. Dieselben Daten in kürzerer Sendezeit — möglicherweise schnellere Synchronisierung und etwas weniger Akkuverbrauch am Riemen. Dein Riemen muss dies unterstützen, und es geht etwas Reichweite verloren. Neu und unerprobt: Schalte es aus, wenn die Synchronisierung auf Distanz unzuverlässig wird.</string>
     <string name="fast_history_sync">Schnellere Verlaufssynchronisierung (experimentell)</string>
-    <string name="fast_history_sync_desc">Fordert eine schnellere Bluetooth-Verbindung an, während Ihr Riemen seinen gespeicherten Verlauf überträgt, damit ein großer Rückstand schneller aufholt. Nur während der Synchronisierung — Ihre Live-Herzfrequenz und der nächtliche Datenstrom bleiben unberührt. Neu und unerprobt: Wenn es nicht hilft oder zu viel Akku kostet, schalten Sie es wieder aus.</string>
-    <string name="keep_alive_needed_vendor">Ihr Telefon (%1$s) kann Hintergrund-Apps stoppen, um Akku zu sparen — dadurch können NOOP nächtliche Schlaf- und Erholungsdaten entgehen. Tippen Sie auf „Zulassen“, um NOOP auf die Whitelist zu setzen.\n\nAndroid fragt „Akkuoptimierung beenden?“ und warnt, dass NOOP Ihren Akku entladen könnte — das ist Androids Standardformulierung für jede App, die im Hintergrund laufen darf. Tippen Sie auf Zulassen. Der Akku wird von der nächtlichen Synchronisierung verbraucht, die Sie oben bereits aktiviert haben; dies verhindert nur, dass Android sie vorzeitig beendet.</string>
+    <string name="fast_history_sync_desc">Fordert eine schnellere Bluetooth-Verbindung an, während dein Riemen seinen gespeicherten Verlauf überträgt, damit ein großer Rückstand schneller aufholt. Nur während der Synchronisierung — deine Live-Herzfrequenz und der nächtliche Datenstrom bleiben unberührt. Neu und unerprobt: Wenn es nicht hilft oder zu viel Akku kostet, schalte es wieder aus.</string>
+    <string name="keep_alive_needed_vendor">Dein Telefon (%1$s) kann Hintergrund-Apps stoppen, um Akku zu sparen — dadurch können NOOP nächtliche Schlaf- und Erholungsdaten entgehen. Tippe auf „Zulassen“, um NOOP auf die Whitelist zu setzen.\n\nAndroid fragt „Akkuoptimierung beenden?“ und warnt, dass NOOP deinen Akku entladen könnte — das ist Androids Standardformulierung für jede App, die im Hintergrund laufen darf. Tippe auf Zulassen. Der Akku wird von der nächtlichen Synchronisierung verbraucht, die du oben bereits aktiviert hast; dies verhindert nur, dass Android sie vorzeitig beendet.</string>
     <string name="power_saving">Energie sparen</string>
     <string name="power_saving_blurb">Entlastet dein Band, wenn sein Akku zur Neige geht. Das Band speichert die Daten selbst, es geht also nichts verloren – NOOP kommuniziert nur seltener mit ihm, damit es durchhält, bis du es laden kannst.</string>
     <string name="power_saving_mode">Energiesparmodus</string>
@@ -197,7 +197,7 @@
     <string name="l10n_add_device_wizard_a_whoop_strap_bonds_to_a_d39bdf4a">Ein WHOOP-Riemen verbindet sich mit einem einzigen Gerät. Während es mit NOOP verbunden ist, wird es nicht streamen</string>
     <string name="l10n_add_device_wizard_add_61cc55aa">Hinzufügen</string>
     <string name="l10n_add_device_wizard_advanced_i_already_have_my_ring_e87b9b49">Erweitert: Ich habe den Schlüssel meines Rings bereits</string>
-    <string name="l10n_add_device_wizard_beta_is_an_on_device_estimate_128563e0">Beta. * ist eine On-Device-Schätzung. Skin Temp ist ein Trend gegen Ihre eigene Baseline, Schritte</string>
+    <string name="l10n_add_device_wizard_beta_is_an_on_device_estimate_128563e0">Beta. * ist eine On-Device-Schätzung. Skin Temp ist ein Trend gegen deine eigene Baseline, Schritte</string>
     <string name="l10n_add_device_wizard_both_noop_and_the_oura_app_4f219db3">Sowohl NOOP als auch die Oura-App können einen Ring verwenden, dessen Schlüssel du besitzt – allerdings kann jeweils nur eine der beiden Apps die Bluetooth-Verbindung aufrechterhalten.</string>
     <string name="l10n_add_device_wizard_connect_to_this_ring_02b9442b">Mit diesem Ring verbinden</string>
     <string name="l10n_add_device_wizard_continue_2e026239">Weiter</string>
@@ -222,7 +222,7 @@
     <string name="l10n_add_device_wizard_take_over_this_ring_f199dc22">Diesen Ring übernehmen</string>
     <string name="l10n_add_device_wizard_taking_over_your_ring_b64a3852">Dein Ring wird übernommen</string>
     <string name="l10n_add_device_wizard_that_is_not_a_32_character_d42ca20d">Das ist kein 32-Zeichen-Hex-Schlüssel.</string>
-    <string name="l10n_add_device_wizard_the_ring_is_not_bricked_to_5efd1b3d">Der Ring ist nicht gemauert. Um dorthin zurückzukehren, wo Sie angefangen haben, setzen Sie es erneut zurück und setzen Sie es</string>
+    <string name="l10n_add_device_wizard_the_ring_is_not_bricked_to_5efd1b3d">Der Ring ist nicht gemauert. Um dorthin zurückzukehren, wo du angefangen hast, setze ihn erneut zurück und setze ihn</string>
     <string name="l10n_add_device_wizard_title_subtitle_8d9004e8">%1$s. %2$s</string>
     <string name="l10n_add_device_wizard_try_again_042c862e">Erneut versuchen</string>
     <string name="l10n_add_device_wizard_use_file_import_0e092cb4">Dateiimport verwenden</string>
@@ -242,10 +242,10 @@
     <string name="l10n_automations_screen_automations_82542d6d">Automationen</string>
     <string name="l10n_automations_screen_battery_alerts_f3679d60">Akku-Hinweise</string>
     <string name="l10n_automations_screen_buzz_strength_e895f99e">Vibrationsstärke</string>
-    <string name="l10n_automations_screen_choose_double_tap_action_6ac9a313">Wählen Sie Double-Tap-Aktion</string>
+    <string name="l10n_automations_screen_choose_double_tap_action_6ac9a313">Wähle Double-Tap-Aktion</string>
     <string name="l10n_automations_screen_detect_short_naps_bbfd136d">Kurze Nickerchen erkennen</string>
     <string name="l10n_automations_screen_double_tap_8d2f1646">Doppeltippen</string>
-    <string name="l10n_automations_screen_each_day_uses_the_time_above_f9bc9ce3">Jeder Tag verwendet die oben genannte Zeit, es sei denn, Sie legen hier eine andere fest.</string>
+    <string name="l10n_automations_screen_each_day_uses_the_time_above_f9bc9ce3">Jeder Tag verwendet die oben genannte Zeit, es sei denn, du legst hier eine andere fest.</string>
     <string name="l10n_automations_screen_enable_inactivity_reminder_468c3017">Inaktivitätserinnerung aktivieren</string>
     <string name="l10n_automations_screen_from_3f66052a">Von</string>
     <string name="l10n_automations_screen_haptic_coaching_e2fab286">Haptisches Coaching</string>
@@ -280,14 +280,14 @@
     <string name="l10n_backup_sync_screen_older_backups_beyond_this_many_are_00b7daa6">Ältere Backups darüber hinaus viele sind beschnitten, älteste zuerst (≈, dass viele Tage von)</string>
     <string name="l10n_backup_sync_screen_replace_a7cf7b25">Ersetzen</string>
     <string name="l10n_backup_sync_screen_replace_all_current_data_e9244799">Alle aktuellen Daten ersetzen?</string>
-    <string name="l10n_backup_sync_screen_replace_all_current_data_with_label_b7799a16">Ersetzen Sie alle aktuellen Daten mit %1$s? Dies kann nicht rückgängig gemacht werden.</string>
-    <string name="l10n_backup_sync_screen_replace_this_device_s_data_with_b8679c51">Ersetzen Sie die Daten dieses Geräts durch eines Ihrer Backups. Dies überschreibt aktuelle Daten,</string>
+    <string name="l10n_backup_sync_screen_replace_all_current_data_with_label_b7799a16">Ersetze alle aktuellen Daten mit %1$s? Dies kann nicht rückgängig gemacht werden.</string>
+    <string name="l10n_backup_sync_screen_replace_this_device_s_data_with_b8679c51">Ersetze die Daten dieses Geräts durch eines deiner Backups. Dies überschreibt aktuelle Daten,</string>
     <string name="l10n_backup_sync_screen_restore_3cbe6d6b">Wiederherstellen</string>
     <string name="l10n_backup_sync_screen_restore_from_a_backup_c28917c6">Aus einer Sicherung wiederherstellen…</string>
     <string name="l10n_backup_sync_screen_roughly_when_the_daily_backup_runs_71de04e1">Etwa wenn das tägliche Backup läuft (Best-Effort - das System kann es ein wenig rutschen).</string>
-    <string name="l10n_backup_sync_screen_these_backups_are_unencrypted_too_if_53e70fe8">Auch diese Sicherungen sind unverschlüsselt. Wenn dieser Ordner mit Drive, Dropbox oder iCloud synchronisiert wird, landet die lesbare Datei auch dort — zeigen Sie nur auf einen Dienst, dem Sie vertrauen.</string>
-    <string name="l10n_backup_sync_screen_tip_a_desktop_drive_dropbox_app_2eaff1e3">Tipp: Eine Desktop Drive / Dropbox App synchronisiert einen ausgewählten Ordner automatisch. Am Telefon speichern Sie eine</string>
-    <string name="l10n_backup_sync_screen_writes_a_fresh_dated_backup_to_bd964fc5">Schreibt ein neues datiertes Backup in Ihren Ordner einmal am Tag zu der Zeit unten, halten</string>
+    <string name="l10n_backup_sync_screen_these_backups_are_unencrypted_too_if_53e70fe8">Auch diese Sicherungen sind unverschlüsselt. Wenn dieser Ordner mit Drive, Dropbox oder iCloud synchronisiert wird, landet die lesbare Datei auch dort — zeige nur auf einen Dienst, dem du vertraust.</string>
+    <string name="l10n_backup_sync_screen_tip_a_desktop_drive_dropbox_app_2eaff1e3">Tipp: Eine Desktop Drive / Dropbox App synchronisiert einen ausgewählten Ordner automatisch. Am Telefon speicherst du eine</string>
+    <string name="l10n_backup_sync_screen_writes_a_fresh_dated_backup_to_bd964fc5">Schreibt ein neues datiertes Backup in deinen Ordner einmal am Tag zu der Zeit unten, halten</string>
     <string name="l10n_breathe_screen_a_relaxation_rhythm_not_cardiac_control_5c2f10a8">Ein Entspannungsrhythmus, keine Herzsteuerung. Er taktet nie unter eine sichere Rate, und du kannst jederzeit aufhören. Wenn sich deine Herzfrequenz nicht beruhigt, sagen wir es klar.</string>
     <string name="l10n_breathe_screen_audio_cues_74430aec">Audiohinweise</string>
     <string name="l10n_breathe_screen_breathcount_breaths_ce036831">%1$s Atemzüge</string>
@@ -303,7 +303,7 @@
     <string name="l10n_breathe_screen_heart_rate_410aa15c">Herzfrequenz</string>
     <string name="l10n_breathe_screen_hrv_rmssd_51014f87">HRV (RMSSD)</string>
     <string name="l10n_breathe_screen_locked_formatday_datems_paces_drift_re_8ebec15b">Gesperrtes %1$s · Tempos driften, jederzeit neu messen.</string>
-    <string name="l10n_breathe_screen_locked_formatday_datems_switch_to_breathe_3efc52c6">Gesperrt %1$s. Wechseln Sie zu Atmen, um es zu verwenden, oder messen Sie oben erneut.</string>
+    <string name="l10n_breathe_screen_locked_formatday_datems_switch_to_breathe_3efc52c6">Gesperrt %1$s. Wechsle zu Atmen, um es zu verwenden, oder miss oben erneut.</string>
     <string name="l10n_breathe_screen_not_enough_clean_beat_data_to_865a1260">Nicht genug saubere Schlagdaten, um heute ein Tempo zu fixieren. Versuch es ausgeruht erneut, still sitzend mit eng anliegendem Strap. Vorerst takten wir dich mit 5,5 AZ/min (Kohärenz).</string>
     <string name="l10n_breathe_screen_not_now_e4571490">Nicht jetzt</string>
     <string name="l10n_breathe_screen_pace_7a9a6226">Tempo</string>
@@ -312,7 +312,7 @@
     <string name="l10n_breathe_screen_sign_kotlin_math_abs_trend_hrv_e9362899">%1$s%2$s%% HRV</string>
     <string name="l10n_breathe_screen_sit_still_and_breathe_with_the_b7c53c40">Sitz still und atme mit dem Vibrieren. Du kannst jederzeit stoppen; ein gestoppter Durchlauf fixiert kein Tempo.</string>
     <string name="l10n_breathe_screen_soft_tone_on_each_phase_honours_2a02c284">Sanfter Ton in jeder Phase · ehrt den stillen Modus</string>
-    <string name="l10n_breathe_screen_started_at_it_bpm_the_rhythm_dda6a573">Begonnen bei %1$s bpm · der Rhythmus verfolgt Ihr Herz nach unten.</string>
+    <string name="l10n_breathe_screen_started_at_it_bpm_the_rhythm_dda6a573">Begonnen bei %1$s bpm · der Rhythmus verfolgt dein Herz nach unten.</string>
     <string name="l10n_breathe_screen_stop_9e253470">Stopp</string>
     <string name="l10n_breathe_screen_stop_sweep_55299cf9">Durchlauf stoppen</string>
     <string name="l10n_breathe_screen_test_buzz_deeab5ae">Testvibration</string>
@@ -339,20 +339,20 @@
     <string name="l10n_breathe_screen_resonance_k1l2m3n4">Resonanz</string>
     <string name="l10n_breathe_screen_locked_pace_o5p6q7r8">Dein gespeichertes Tempo · %1$.1f br/min</string>
     <string name="l10n_breathe_screen_resonance_edu_s9t0u1v2">Dein gespeichertes Resonanz-Tempo aus dem Resonanz-Sweep.</string>
-    <string name="l10n_caffeine_log_after_your_clocklabel_cutoffminutes_cutoff_may_3c023900">Nach Ihrem %1$s Cutoff - kann noch im Bett aktiv sein.</string>
+    <string name="l10n_caffeine_log_after_your_clocklabel_cutoffminutes_cutoff_may_3c023900">Nach deinem %1$s Cutoff - kann noch im Bett aktiv sein.</string>
     <string name="l10n_caffeine_log_amount_in_mg_optional_f0749888">Menge in mg (optional)</string>
     <string name="l10n_caffeine_log_bedtime_e3cb8bd6">Schlafenszeit</string>
     <string name="l10n_caffeine_log_caffeine_22859fa3">Koffein</string>
     <string name="l10n_caffeine_log_flag_drinks_late_enough_to_still_af311272">Flaggengetränke spät genug, um vor dem Schlafengehen noch aktiv zu sein.</string>
     <string name="l10n_caffeine_log_had_it_8576ac66">Gehabt</string>
-    <string name="l10n_caffeine_log_have_your_last_caffeine_by_about_16b09033">Haben Sie Ihr letztes Koffein von etwa %1$s, um das meiste davon zu löschen</string>
+    <string name="l10n_caffeine_log_have_your_last_caffeine_by_about_16b09033">Habe dein letztes Koffein von etwa %1$s, um das meiste davon zu löschen</string>
     <string name="l10n_caffeine_log_late_caffeine_nudge_6b2ff690">Late-Coffein-Nudge</string>
     <string name="l10n_caffeine_log_log_a_coffee_tea_or_energy_982bde5b">Erfasse einen Kaffee, Tee oder Energydrink, und NOOP zeigt eine grobe Schätzung, wie viel noch wirken könnte. Es ist ein Anhaltspunkt auf Basis einer typischen Halbwertszeit von 5 bis 6 Stunden, keine Messung.</string>
     <string name="l10n_caffeine_log_logged_today_0071a46c">Heute erfasst</string>
     <string name="l10n_caffeine_log_remove_e963907d">Entfernen</string>
     <string name="l10n_coach_screen_api_key_hidden_f3cde531">API-Schlüssel (versteckt)</string>
-    <string name="l10n_coach_screen_ask_anything_about_your_recent_recovery_e6c287ca">Fragen Sie nach Ihrer kürzlichen Genesung, Belastung, Schlaf oder HRV.</string>
-    <string name="l10n_coach_screen_ask_your_coach_b1577d4c">Fragen Sie Ihren Trainer...</string>
+    <string name="l10n_coach_screen_ask_anything_about_your_recent_recovery_e6c287ca">Frage nach deiner kürzlichen Genesung, Belastung, Schlaf oder HRV.</string>
+    <string name="l10n_coach_screen_ask_your_coach_b1577d4c">Frage deinen Trainer...</string>
     <string name="l10n_coach_screen_cancel_77dfd213">Abbrechen</string>
     <string name="l10n_coach_screen_coach_error_error_ad9c8c46">Trainerfehler: %1$s</string>
     <string name="l10n_coach_screen_coach_instructions_28a07975">Coach-Anweisungen</string>
@@ -366,7 +366,7 @@
     <string name="l10n_coach_screen_disconnect_ed28e068">Trennen</string>
     <string name="l10n_coach_screen_disconnect_provider_fa13625c">Anbieter trennen</string>
     <string name="l10n_coach_screen_e_g_gpt_4o_1da2e4d2">z. B. gpt-4o</string>
-    <string name="l10n_coach_screen_enter_any_model_id_the_provider_dce4bbcb">Geben Sie eine Modell-ID ein, die der Anbieter akzeptiert.</string>
+    <string name="l10n_coach_screen_enter_any_model_id_the_provider_dce4bbcb">Gib eine Modell-ID ein, die der Anbieter akzeptiert.</string>
     <string name="l10n_coach_screen_fetch_models_from_provider_6654e1a0">Modelle von Anbietern abrufen</string>
     <string name="l10n_coach_screen_key_header_3f2a9b10">Schlüssel-Header</string>
     <string name="l10n_coach_screen_let_the_coach_use_my_data_405d1188">Dem Coach erlauben, meine Daten zu nutzen</string>
@@ -382,8 +382,8 @@
     <string name="l10n_coach_screen_use_model_8d558ce2">Verwendungsmodell</string>
     <string name="l10n_compare_screen_add_a_metric_to_compare_e6a7c9f1">Eine Metrik zum Vergleich hinzufügen</string>
     <string name="l10n_compare_screen_compare_8d105cf4">Vergleichen</string>
-    <string name="l10n_compare_screen_compare_needs_at_least_two_metrics_2bfe1fad">Vergleichen Sie die Anforderungen mit mindestens zwei Metriken mit der Geschichte</string>
-    <string name="l10n_compare_screen_not_enough_overlapping_days_between_these_44563110">Nicht genug überlappende Tage zwischen diesen Metriken in %1$s. Verbreitern Sie die Reichweite.</string>
+    <string name="l10n_compare_screen_compare_needs_at_least_two_metrics_2bfe1fad">Vergleiche die Anforderungen mit mindestens zwei Metriken mit der Geschichte</string>
+    <string name="l10n_compare_screen_not_enough_overlapping_days_between_these_44563110">Nicht genug überlappende Tage zwischen diesen Metriken in %1$s. Verbreitere die Reichweite.</string>
     <string name="l10n_compare_screen_nothing_selected_yet_60968db6">Noch nichts ausgewählt.</string>
     <string name="l10n_compare_screen_p_a_metric_title_p_b_06c36e56">%1$s ↔ %2$s</string>
     <string name="l10n_compare_screen_p_n_overlapping_days_strengthword_p_8a8f56c7">%1$s überlappende Tage · %2$s %3$s Korrelation</string>
@@ -416,7 +416,7 @@
     <string name="health_connect_category_activity_detail">Schritte, Kalorien, Trainingseinheiten, Distanz und VO₂max</string>
     <string name="health_connect_category_body_composition">Körperzusammensetzung</string>
     <string name="health_connect_category_body_composition_detail">Gewicht, Körperfett und fettfreie Masse</string>
-    <string name="l10n_data_sources_screen_import_apple_health_export_533fca27">Importieren Sie Apple Health Export ...</string>
+    <string name="l10n_data_sources_screen_import_apple_health_export_533fca27">Importiere Apple Health Export ...</string>
     <string name="l10n_data_sources_screen_import_from_health_connect_35d55e21">Import von Health Connect</string>
     <string name="l10n_data_sources_screen_import_lifting_log_8fac7b68">Lifting Log ...</string>
     <string name="l10n_data_sources_screen_import_mi_band_export_e587801c">Import Mi Band Export ...</string>
@@ -434,13 +434,13 @@
     <string name="l10n_data_sources_screen_remove_apple_health_imported_data_5f878502">Aus Apple Health importierte Daten entfernen?</string>
     <string name="l10n_data_sources_screen_remove_e963907d">Entfernen</string>
     <string name="l10n_data_sources_screen_remove_imported_data_813e4695">Importierte Daten entfernen</string>
-    <string name="l10n_data_sources_screen_share_back_to_health_connect_1d578f4a">Teilen Sie zurück zu Health Connect</string>
+    <string name="l10n_data_sources_screen_share_back_to_health_connect_1d578f4a">Teile zurück zu Health Connect</string>
     <string name="l10n_data_sources_screen_share_computed_metrics_back_to_health_c11f5d70">Teile berechnete Metriken zurück zu Health Connect</string>
     <string name="l10n_data_sources_screen_this_permanently_deletes_everything_imported_from_f42e760e">Das löscht dauerhaft alles, was aus Apple Health importiert wurde: Herzfrequenz, HRV, Schlaf, Schritte, Workouts und mehr. Deine Live-Strap-Daten bleiben unberührt. Das kann nicht rückgängig gemacht werden.</string>
     <string name="l10n_data_sources_screen_whoop_history_db101974">WHOOP Geschichte</string>
     <string name="l10n_data_sources_screen_whoop_strap_live_ble_217f7df6">WHOOP-Strap (Live-BLE)</string>
     <string name="l10n_data_sources_screen_workout_file_gpx_tcx_fit_5469c068">Workout-Datei (GPX / TCX / FIT)</string>
-    <string name="l10n_data_sources_screen_write_the_metrics_noop_computes_from_439940c2">Schreiben Sie die Metriken NOOP berechnet von Ihrem Gurt (resting HR, HRV, SpO2,)</string>
+    <string name="l10n_data_sources_screen_write_the_metrics_noop_computes_from_439940c2">Schreibe die Metriken NOOP berechnet von deinem Gurt (resting HR, HRV, SpO2,)</string>
     <string name="l10n_data_sources_screen_xiaomi_mi_band_edeab3bc">Xiaomi Mi Band</string>
     <string name="l10n_devices_screen_add_a_device_f90866b8">Gerät hinzufügen</string>
     <string name="l10n_devices_screen_battery_4a9be042">Akku</string>
@@ -474,7 +474,7 @@
     <string name="l10n_devices_screen_close_bbfa773e">Schließen</string>
     <string name="l10n_devices_screen_copy_af74f7c5">Kopieren</string>
     <string name="l10n_devices_screen_device_name_79d7a157">Gerätename</string>
-    <string name="l10n_devices_screen_give_device_brand_device_model_a_7a15585c">Geben Sie %1$s %2$s einen Namen, den Sie erkennen werden.</string>
+    <string name="l10n_devices_screen_give_device_brand_device_model_a_7a15585c">Gib %1$s %2$s einen Namen, den du erkennen wirst.</string>
     <string name="l10n_devices_screen_leave_none_active_b5c858cb">Keins aktiv lassen</string>
     <string name="l10n_devices_screen_name_709a2322">Name</string>
     <string name="l10n_devices_screen_pack_voltage_9af3c3ff">%1$.2f V</string>
@@ -502,14 +502,14 @@
     <string name="l10n_health_screen_as_of_latest_first_726f20bb">wie von %1$s</string>
     <string name="l10n_health_screen_as_of_one_first_2b409612">wie von %1$s</string>
     <string name="l10n_health_screen_baselines_learned_on_device_over_14_c107f375">Baselines lernten über 14 Tage auf dem Gerät. Balken lesen jedes Signal gegen eine</string>
-    <string name="l10n_health_screen_cycle_phase_body_clock_and_illness_59e2d9a4">Zyklusphase, Körper-Uhr und Krankheit Heads-up sind Annäherungen berechnet auf Ihrem Gerät von</string>
+    <string name="l10n_health_screen_cycle_phase_body_clock_and_illness_59e2d9a4">Zyklusphase, Körper-Uhr und Krankheit Heads-up sind Annäherungen berechnet auf deinem Gerät von</string>
     <string name="l10n_health_screen_date_eb9a4bc1">Datum</string>
     <string name="l10n_health_screen_detail_format_latest_second_detail_unit_9664278b">%1$s %2$s</string>
     <string name="l10n_health_screen_detail_format_one_second_detail_unit_6fde90d3">%1$s %2$s</string>
     <string name="l10n_health_screen_heart_rate_dde6e8f7">Herzfrequenz</string>
-    <string name="l10n_health_screen_helping_most_best_label_edee8773">Helfen Sie am meisten: %1$s</string>
+    <string name="l10n_health_screen_helping_most_best_label_edee8773">Hilft am meisten: %1$s</string>
     <string name="l10n_health_screen_history_synced_8339779d">Verlauf synchronisiert</string>
-    <string name="l10n_health_screen_holding_you_back_worst_label_863a1809">Halten Sie sich zurück: %1$s</string>
+    <string name="l10n_health_screen_holding_you_back_worst_label_863a1809">Halte dich zurück: %1$s</string>
     <string name="l10n_health_screen_how_accurate_is_this_dae653a8">Wie genau ist das?</string>
     <string name="l10n_health_screen_how_accurate_is_this_fitness_age_935c9a6d">Wie genau ist dieses Fitness-Alter?</string>
     <string name="l10n_health_screen_item_label_item_detail_5985e927">%1$s: %2$s</string>
@@ -520,7 +520,7 @@
     <string name="l10n_health_screen_no_strap_connected_fb37b99e">Kein Strap verbunden</string>
     <string name="l10n_health_screen_not_enough_history_in_this_range_2da72f80">Nicht genug Geschichte in diesem Bereich</string>
     <string name="l10n_health_screen_not_enough_history_yet_0e2f93b6">Noch nicht genug Geschichte</string>
-    <string name="l10n_health_screen_one_reading_so_far_your_trend_eaad57f2">Eine Lektüre bisher - Ihr Trendchart füllt sich hier einmal pro Sekunde aus</string>
+    <string name="l10n_health_screen_one_reading_so_far_your_trend_eaad57f2">Eine Lektüre bisher - dein Trendchart füllt sich hier einmal pro Sekunde aus</string>
     <string name="l10n_health_screen_out_of_100_da0953a8">von 100</string>
     <string name="l10n_health_screen_respiratory_1cd8c175">Atmung</string>
     <string name="l10n_health_screen_resting_hr_26677094">Ruhe-HF</string>
@@ -534,14 +534,14 @@
     <string name="l10n_how_noop_works_screen_got_it_5b8027fa">Verstanden</string>
     <string name="l10n_how_noop_works_screen_how_noop_works_3396b27a">So funktioniert NOOP</string>
     <string name="l10n_how_noop_works_screen_noop_never_makes_up_a_number_da29aca5">NOOP erfindet nie eine Zahl. Wenn es eine nicht ehrlich berechnen kann, sagt es dir, was fehlt und was zu tun ist, statt einen falschen Wert zu zeigen.</string>
-    <string name="l10n_how_noop_works_screen_noop_never_shows_you_a_number_d1db9958">NOOP zeigt Ihnen nie eine Zahl, die es erfinden musste. Wenn ein Score nicht fertig ist,</string>
+    <string name="l10n_how_noop_works_screen_noop_never_shows_you_a_number_d1db9958">NOOP zeigt dir nie eine Zahl, die es erfinden musste. Wenn ein Score nicht fertig ist,</string>
     <string name="l10n_how_noop_works_screen_section_title_section_body_efb1a999">%1$s. %2$s</string>
     <string name="l10n_how_noop_works_screen_sleep_scores_recording_where_your_numbers_1b3e981f">Schlaf · Werte · Aufzeichnung · woher deine Zahlen kommen</string>
     <string name="l10n_hrv_snapshot_screen_an_hrv_reading_needs_the_live_11b70bff">Eine HRV-Messung braucht den Live-R-R-Stream. Öffne den Live-Bildschirm und verbinde deinen Strap, dann komm zurück.</string>
     <string name="l10n_hrv_snapshot_screen_beats_12aafda0">Schläge</string>
     <string name="l10n_hrv_snapshot_screen_hrvdial_4c244c45">hrvDial</string>
     <string name="l10n_hrv_snapshot_screen_mean_hr_6c9272dd">Mittlere HF</string>
-    <string name="l10n_hrv_snapshot_screen_not_enough_clean_beats_sit_still_0893e6c2">Nicht genug saubere Beats - sitzen Sie still und versuchen Sie es erneut. %1$s von</string>
+    <string name="l10n_hrv_snapshot_screen_not_enough_clean_beats_sit_still_0893e6c2">Nicht genug saubere Beats - sitz still und versuche es erneut. %1$s von</string>
     <string name="l10n_hrv_snapshot_screen_rmssd_e240fd3c">RMSSD</string>
     <string name="l10n_hrv_snapshot_screen_sdnn_9ab9ee2a">SDNN</string>
     <string name="l10n_hydration_screen_a_simple_goal_that_adjusts_to_723dc08a">Ein einfaches Ziel, das sich deiner Anstrengung anpasst. Allgemeine Wellness-Orientierung, kein medizinischer Rat.</string>
@@ -550,7 +550,7 @@
     <string name="l10n_hydration_screen_clear_today_1be870ea">Heute klar</string>
     <string name="l10n_hydration_screen_cup_04b95071">Tasse</string>
     <string name="l10n_hydration_screen_custom_amount_f7219236">Zollbetrag</string>
-    <string name="l10n_hydration_screen_enter_any_amount_from_1_to_a85a639e">Geben Sie eine beliebige Menge von 1 bis %1$s ml ein.</string>
+    <string name="l10n_hydration_screen_enter_any_amount_from_1_to_a85a639e">Gib eine beliebige Menge von 1 bis %1$s ml ein.</string>
     <string name="l10n_hydration_screen_hydration_bdfb040f">Flüssigkeit</string>
     <string name="l10n_hydration_screen_kotlin_math_min_100_fraction_100_416d2889">%1$s Prozent des heutigen Ziels</string>
     <string name="l10n_hydration_screen_kotlin_math_min_100_fraction_100_72f2dfde">%1$s%% des heutigen Ziels</string>
@@ -565,10 +565,10 @@
     <string name="l10n_hydration_screen_totalml_toint_ml_522b262a">%1$s ml</string>
     <string name="l10n_hydration_screen_undo_last_last_ml_330befc5">Undo last (%1$s ml)</string>
     <string name="l10n_insights_hub_screen_dose_here_is_timing_later_in_1b1e9326">„Dosis“ heißt hier Timing (später am Tag = stärker), nicht Milligramm.</string>
-    <string name="l10n_insights_hub_screen_everything_here_is_a_pattern_in_ed2162a6">Alles hier ist ein Muster in Ihren eigenen protokollierten Tagen: eine Assoziation mit einem</string>
+    <string name="l10n_insights_hub_screen_everything_here_is_a_pattern_in_ed2162a6">Alles hier ist ein Muster in deinen eigenen protokollierten Tagen: eine Assoziation mit einem</string>
     <string name="l10n_insights_hub_screen_insights_b4510362">Einblicke</string>
     <string name="l10n_insights_hub_screen_log_alcohol_or_late_caffeine_with_dec9dadf">Log Alkohol oder spätes Koffein mit einer Menge und NOOP passt zu einer persönlichen Dosiskurve:</string>
-    <string name="l10n_insights_hub_screen_not_enough_overlap_between_your_journal_0ebdd7a2">Nicht genug Überlappungen zwischen Ihren Journal Antworten und</string>
+    <string name="l10n_insights_hub_screen_not_enough_overlap_between_your_journal_0ebdd7a2">Nicht genug Überlappungen zwischen deinen Journal Antworten und</string>
     <string name="l10n_insights_hub_screen_per_extra_card_unitnoun_a92a5e91">Per extra %1$s</string>
     <string name="l10n_insights_hub_screen_reading_your_journal_and_outcomes_4a59af69">Dein Journal und deine Ergebnisse werden gelesen…</string>
     <string name="l10n_insights_hub_screen_tomorrow_s_card_outcomename_ad70b7f9">Das morgige %1$s</string>
@@ -587,9 +587,9 @@
     <string name="l10n_insights_screen_mark_done_0911cce7">Mark erledigt</string>
     <string name="l10n_insights_screen_mark_done_today_471eb94a">Für heute als erledigt markieren</string>
     <string name="l10n_insights_screen_next_morning_61d1ea83">Nächster Morgen</string>
-    <string name="l10n_insights_screen_not_enough_overlap_between_your_journal_0ebdd7a2">Nicht genug Überlappungen zwischen Ihren Journal Antworten und</string>
+    <string name="l10n_insights_screen_not_enough_overlap_between_your_journal_0ebdd7a2">Nicht genug Überlappungen zwischen deinen Journal Antworten und</string>
     <string name="l10n_insights_screen_not_enough_overlapping_history_to_correlate_a552dbd4">Noch nicht genug überlappender Verlauf, um deine Metriken zu korrelieren.</string>
-    <string name="l10n_insights_screen_pick_one_behaviour_you_log_one_bd34090e">Wählen Sie ein Verhalten, das Sie protokollieren, ein Ergebnis und ein kurzes Fenster. NOOP</string>
+    <string name="l10n_insights_screen_pick_one_behaviour_you_log_one_bd34090e">Wähle ein Verhalten, das du protokollierst, ein Ergebnis und ein kurzes Fenster. NOOP</string>
     <string name="l10n_insights_screen_ranked_lag_aware_which_of_your_e0e91b39">Eingestuft, mit Zeitversatz: welche deiner Gewohnheiten deine Ladung wirklich bewegen, plus deine persönliche Alkohol-/Koffein-Dosis-Wirkung.</string>
     <string name="l10n_insights_screen_rest_baseline_b3ac52a5">Ruhe-Basislinie</string>
     <string name="l10n_insights_screen_run_a_clean_personal_test_4da69781">Führe einen sauberen persönlichen Test durch</string>
@@ -606,14 +606,14 @@
     <string name="l10n_intelligence_screen_0_unitformatter_effortscalemax_effortscale_scale_b5c43f56">0 - %1$s-Skala</string>
     <string name="l10n_intelligence_screen_band_ec8a8993">± %1$s</string>
     <string name="l10n_intelligence_screen_by_day_2e5d14ca">Nach Tag</string>
-    <string name="l10n_intelligence_screen_charge_weighs_your_heart_rate_variability_026745e6">Ladung wiegt Ihre Herzfrequenzvariabilität gegen Ihre persönliche Baseline</string>
+    <string name="l10n_intelligence_screen_charge_weighs_your_heart_rate_variability_026745e6">Ladung wiegt deine Herzfrequenzvariabilität gegen deine persönliche Baseline</string>
     <string name="l10n_intelligence_screen_effort_8c974bc6">Anstrengung</string>
-    <string name="l10n_intelligence_screen_estimate_from_today_s_effort_your_667d7560">Schätzung aus dem heutigen Aufwand, Ihrem typischen Schlaf und Ihrer %1$s-Nacht</string>
+    <string name="l10n_intelligence_screen_estimate_from_today_s_effort_your_667d7560">Schätzung aus dem heutigen Aufwand, deinem typischen Schlaf und deiner %1$s-Nacht</string>
     <string name="l10n_intelligence_screen_how_this_works_b895a8c3">Wie das funktioniert</string>
     <string name="l10n_intelligence_screen_intelligence_c698f940">Intelligenz</string>
     <string name="l10n_intelligence_screen_no_scored_days_in_this_window_03f1165b">Keine bewerteten Tage in diesem Fenster. Erweitere den Zeitraum oder importiere mehr Verlauf.</string>
-    <string name="l10n_intelligence_screen_no_scored_days_yet_sync_your_cdd47684">Noch keine erzielten Tage. Synchronisieren Sie Ihren Riemen, um rohe Streams zu sammeln. Anstrengung und Ruhe sind</string>
-    <string name="l10n_intelligence_screen_you_ll_likely_wake_around_charge_ed3abe2e">Sie werden wahrscheinlich um %1$s ± %2$s Ladung aufwachen, wenn Sie schlafen</string>
+    <string name="l10n_intelligence_screen_no_scored_days_yet_sync_your_cdd47684">Noch keine erzielten Tage. Synchronisiere deinen Riemen, um rohe Streams zu sammeln. Anstrengung und Ruhe sind</string>
+    <string name="l10n_intelligence_screen_you_ll_likely_wake_around_charge_ed3abe2e">Du wirst wahrscheinlich um %1$s ± %2$s Ladung aufwachen, wenn du schläfst</string>
     <string name="l10n_intervals_screen_bond_your_strap_on_the_live_d799cbc2">Verbinde deinen Strap im Live-Bildschirm, um die Übergänge freihändig zu spüren.</string>
     <string name="l10n_intervals_screen_interval_timer_1d703deb">Intervall-Timer</string>
     <string name="l10n_intervals_screen_pause_to_change_work_rest_or_f54f9cc5">Pause, um Arbeit, Ruhe oder Runden zu wechseln.</string>
@@ -623,7 +623,7 @@
     <string name="l10n_intervals_screen_rounds_ceeac4ac">Runden</string>
     <string name="l10n_intervals_screen_timestring_elapsed_timestring_totalplanned_7b68f8d7">%1$s / %2$s</string>
     <string name="l10n_intervals_screen_work_00040bab">Arbeit</string>
-    <string name="l10n_journal_log_add_a_custom_item_0dbd8f7c">Fügen Sie einen benutzerdefinierten Artikel hinzu ...</string>
+    <string name="l10n_journal_log_add_a_custom_item_0dbd8f7c">Füge einen benutzerdefinierten Artikel hinzu ...</string>
     <string name="l10n_journal_log_cancel_77dfd213">Abbrechen</string>
     <string name="l10n_journal_log_display_name_c7874aaa">Anzeigename</string>
     <string name="l10n_journal_log_group_995a11e5">Gruppe ...</string>
@@ -636,7 +636,7 @@
     <string name="l10n_lab_book_screen_a_private_notebook_not_a_medical_f63242cb">Ein privates Notizbuch, kein medizinischer Dienst.</string>
     <string name="l10n_lab_book_screen_about_lab_book_37bf2691">Über das Laborbuch</string>
     <string name="l10n_lab_book_screen_all_stays_on_this_phone_nothing_9a966c1c">Alles bleibt auf diesem Telefon. Nichts wird irgendwohin geschickt.</string>
-    <string name="l10n_lab_book_screen_bring_in_a_markers_csv_date_1090bec2">Geben Sie einen Marker CSV (Datum, Marker, Wert, Einheit). Namen, die zum Katalog passen</string>
+    <string name="l10n_lab_book_screen_bring_in_a_markers_csv_date_1090bec2">Gib einen Marker CSV (Datum, Marker, Wert, Einheit). Namen, die zum Katalog passen</string>
     <string name="l10n_lab_book_screen_choose_a_wearable_signal_to_compare_05a4b2bc">Wearable-Signal zum Vergleich auswählen</string>
     <string name="l10n_lab_book_screen_clear_719ea396">Löschen</string>
     <string name="l10n_lab_book_screen_delete_this_reading_b5c92bda">Diesen Messwert löschen</string>
@@ -648,14 +648,14 @@
     <string name="l10n_lab_book_screen_lining_them_up_c59ee297">Werden ausgerichtet…</string>
     <string name="l10n_lab_book_screen_markername_signal_title_e9c07909">%1$s ↔ %2$s</string>
     <string name="l10n_lab_book_screen_n_readings_line_up_but_there_27bfb506">%1$s-Messwerte stimmen überein, aber es gibt nicht genug Variation, um eine Beziehung zu berechnen.</string>
-    <string name="l10n_lab_book_screen_n_readings_used_strengthword_r_directionword_298baf9e">Verwendete %1$s-Messwerte · %2$s %3$s-Assoziation. Dies sind Ihre eigenen Daten</string>
-    <string name="l10n_lab_book_screen_pick_a_wearable_signal_resting_hr_8d8b01a2">Wählen Sie ein tragbares Signal (Ruhe HR, HRV, Schlaf, Ladung, Gewicht ...), um es gegen dieses auszurichten</string>
+    <string name="l10n_lab_book_screen_n_readings_used_strengthword_r_directionword_298baf9e">Verwendete %1$s-Messwerte · %2$s %3$s-Assoziation. Dies sind deine eigenen Daten</string>
+    <string name="l10n_lab_book_screen_pick_a_wearable_signal_resting_hr_8d8b01a2">Wähle ein tragbares Signal (Ruhe HR, HRV, Schlaf, Ladung, Gewicht ...), um es gegen dieses auszurichten</string>
     <string name="l10n_lab_book_screen_r_signedr_r_fb21be90">r = %1$s</string>
     <string name="l10n_lab_book_screen_read_the_full_lab_book_note_3a250750">Den vollständigen Laborbuch-Hinweis lesen</string>
     <string name="l10n_lab_book_screen_read_the_full_note_3fd0e4d1">Den vollständigen Hinweis lesen</string>
     <string name="l10n_lab_book_screen_reading_your_logbook_e31992b0">Dein Logbuch wird gelesen…</string>
     <string name="l10n_lab_book_screen_these_are_your_own_numbers_shown_7667508d">Das sind deine eigenen Zahlen, dir zurückgespiegelt. NOOP entscheidet nicht, ob ein Wert normal, hoch oder niedrig ist.</string>
-    <string name="l10n_lab_book_screen_type_in_a_blood_pressure_reading_c276d418">Geben Sie eine Blutdruckmessung oder einen Cholesterinwert von Ihrem letzten Termin ein.</string>
+    <string name="l10n_lab_book_screen_type_in_a_blood_pressure_reading_c276d418">Gib eine Blutdruckmessung oder einen Cholesterinwert von deinem letzten Termin ein.</string>
     <string name="l10n_lab_book_screen_what_lab_book_is_and_isn_f28686df">Was das Laborbuch ist (und was nicht)</string>
     <string name="l10n_live_screen_manage_devices_e5c277ff">Geräte verwalten</string>
     <string name="l10n_live_screen_max_hr_6acd9e07">Max. HF</string>
@@ -696,20 +696,20 @@
     <string name="l10n_marker_editor_screen_date_taken_76edfcab">Datum der Messung</string>
     <string name="l10n_marker_editor_screen_def_displayname_def_canonicalunit_e86ef8de">%1$s, %2$s</string>
     <string name="l10n_marker_editor_screen_entered_together_stored_as_two_markers_af8f3ba0">Zusammen eingegeben; als zwei Marker gespeichert, damit jeder sauber gegen deine Signale ausgerichtet werden kann.</string>
-    <string name="l10n_marker_editor_screen_lab_book_keeps_your_own_numbers_9085ce2c">Lab Book behält Ihre eigenen Zahlen - es testet, liest oder beurteilt sie nicht, und es ist nicht medizinisch</string>
+    <string name="l10n_marker_editor_screen_lab_book_keeps_your_own_numbers_9085ce2c">Lab Book behält deine eigenen Zahlen - es testet, liest oder beurteilt sie nicht, und es ist nicht medizinisch</string>
     <string name="l10n_marker_editor_screen_no_match_add_it_as_a_ad5c59ec">Keine Übereinstimmung. Füge ihn unten als eigenen Marker hinzu.</string>
-    <string name="l10n_marker_editor_screen_noop_never_fills_this_in_it_7be9653b">NOOP füllt dies nie aus - es zeigt nur genau an, was Sie aus Ihrem eigenen Bericht eingeben.</string>
+    <string name="l10n_marker_editor_screen_noop_never_fills_this_in_it_7be9653b">NOOP füllt dies nie aus - es zeigt nur genau an, was du aus deinem eigenen Bericht eingibst.</string>
     <string name="l10n_marker_editor_screen_search_markers_103981e0">Marker durchsuchen</string>
     <string name="l10n_marker_editor_screen_search_markers_e_g_ldl_ferritin_66c17802">Marker durchsuchen (z. B. LDL, Ferritin)</string>
     <string name="l10n_marker_editor_screen_stored_as_canonicalunit_0bf7f702">Speichert als %1$s.</string>
-    <string name="l10n_marker_editor_screen_type_in_a_number_from_your_c2f4ffb8">Geben Sie eine Zahl aus Ihrem eigenen Bericht ein. Es bleibt auf diesem Telefon.</string>
-    <string name="l10n_mind_section_how_are_you_feeling_today_5667deff">Wie fühlen Sie sich heute?</string>
+    <string name="l10n_marker_editor_screen_type_in_a_number_from_your_c2f4ffb8">Gib eine Zahl aus deinem eigenen Bericht ein. Es bleibt auf diesem Telefon.</string>
+    <string name="l10n_mind_section_how_are_you_feeling_today_5667deff">Wie fühlst du dich heute?</string>
     <string name="l10n_mind_section_line_title_sentence_6d3418f9">%1$s: %2$s</string>
     <string name="l10n_mind_section_logged_today_0071a46c">Heute erfasst</string>
     <string name="l10n_mind_section_mood_correlations_unlock_after_mind_gate_f0c62abe">Stimmungskorrelationen nach %1$s Tagen freischalten</string>
-    <string name="l10n_mind_section_not_enough_overlapping_history_to_correlate_d36b91f9">Nicht genug überlappende Geschichte, um die Stimmung mit Ihrer</string>
+    <string name="l10n_mind_section_not_enough_overlapping_history_to_correlate_d36b91f9">Nicht genug überlappende Geschichte, um die Stimmung mit deiner</string>
     <string name="l10n_mind_section_one_check_in_per_day_picking_b103f22e">Ein Check-in pro Tag; die Auswahl eines anderen Gesichts überschreibt das heutige.</string>
-    <string name="l10n_mind_section_reading_your_check_ins_71a100a9">Lesen Sie Ihre Check-ins...</string>
+    <string name="l10n_mind_section_reading_your_check_ins_71a100a9">Lese deine Check-ins...</string>
     <string name="l10n_noop_compact_glance_widget_charge_49a8cb83">GEBÜHR</string>
     <string name="l10n_noop_compact_glance_widget_effort_660752e7">ANSTRENGUNG</string>
     <string name="l10n_noop_compact_glance_widget_heart_rate_410aa15c">Herzfrequenz</string>
@@ -807,7 +807,7 @@
     <string name="l10n_scoring_guide_screen_got_it_5b8027fa">Verstanden</string>
     <string name="l10n_scoring_guide_screen_how_sure_is_noop_solid_building_c21d86d7">Wie sicher ist NOOP?  ·  Stabil · Im Aufbau · Kalibrierung</string>
     <string name="l10n_scoring_guide_screen_how_your_scores_work_21a0e2be">So funktionieren deine Werte</string>
-    <string name="l10n_scoring_guide_screen_noop_gives_you_three_daily_scores_36244209">NOOP bietet Ihnen drei tägliche Ergebnisse (Charge, Effort und Rest), jeweils auf einer 0-100</string>
+    <string name="l10n_scoring_guide_screen_noop_gives_you_three_daily_scores_36244209">NOOP bietet dir drei tägliche Ergebnisse (Charge, Effort und Rest), jeweils auf einer 0-100</string>
     <string name="l10n_scoring_guide_screen_scorecardhighlight_4af6985c">scoreCardHighlight</string>
     <string name="l10n_scoring_guide_screen_these_are_independent_approximations_from_a_301457ed">Das sind unabhängige Näherungen von einem Consumer-Strap, gebaut auf offener Wissenschaft: kein medizinischer Rat und nicht WHOOPs offizielle Werte.</string>
     <string name="l10n_scoring_guide_screen_vs_whoop_9a8126a7">VS WHOOP</string>
@@ -820,7 +820,7 @@
     <string name="l10n_settings_screen_note_a2481d6c">· %1$s</string>
     <string name="l10n_settings_screen_repo_note_0a694b50">%1$s, %2$s</string>
     <string name="l10n_skin_temp_cards_screen_cycle_awareness_ffb94783">Zyklusbewusstsein</string>
-    <string name="l10n_skin_temp_cards_screen_noop_can_read_a_coarse_menstrual_c79e4b85">NOOP kann eine grobe Menstruationszyklusphase von Ihrer nächtlichen Hauttemperatur ablesen,</string>
+    <string name="l10n_skin_temp_cards_screen_noop_can_read_a_coarse_menstrual_c79e4b85">NOOP kann eine grobe Menstruationszyklusphase von deiner nächtlichen Hauttemperatur ablesen,</string>
     <string name="l10n_skin_temp_cards_screen_turn_on_cycle_awareness_7c2d328f">Zyklusbewusstsein einschalten</string>
     <string name="l10n_sleep_screen_about_this_nap_e2719b9b">Über dieses Nickerchen</string>
     <string name="l10n_sleep_screen_about_your_main_sleep_1da8a640">Über deinen Hauptschlaf</string>
@@ -831,7 +831,7 @@
     <string name="l10n_sleep_screen_bedtime_wake_time_b2a22c32">Schlafenszeit und Wachzeit</string>
     <string name="l10n_sleep_screen_consistency_0ea7b95e">Konsistenz</string>
     <string name="l10n_sleep_screen_consistencypct_roundtoint_b23a9d40">%1$s%%</string>
-    <string name="l10n_sleep_screen_delete_this_nap_1adf0a3f">Löschen Sie dieses Nickerchen</string>
+    <string name="l10n_sleep_screen_delete_this_nap_1adf0a3f">Lösche dieses Nickerchen</string>
     <string name="l10n_sleep_screen_fell_asleep_at_asleep_woke_at_80465b2d">Schlafen bei %1$s, wachen bei %2$s</string>
     <string name="l10n_sleep_screen_going_to_sleep_9c6c63fd">Schlafen gehen</string>
     <string name="l10n_sleep_screen_hours_asleep_06f68993">Schlafstunden</string>
@@ -839,7 +839,7 @@
     <string name="l10n_sleep_screen_hours_vs_needed_progress_bar_score_4baad051">Stunden vs benötigter Fortschrittsbalken, %1$s Prozent</string>
     <string name="l10n_sleep_screen_i_m_awake_2caf0e7f">Ich bin wach</string>
     <string name="l10n_sleep_screen_label_durationtext_minutes_percent_percent_of_6ab7ae87">%1$s: %2$s, %3$s Prozent der Nacht</string>
-    <string name="l10n_sleep_screen_label_minutes_vs_your_typical_bar_b8f6a482">%1$s Minuten gegen Ihre typische Bar</string>
+    <string name="l10n_sleep_screen_label_minutes_vs_your_typical_bar_b8f6a482">%1$s Minuten gegen deine typische Bar</string>
     <string name="l10n_sleep_screen_log_going_to_sleep_6c2b519d">Schlafengehen erfassen</string>
     <string name="l10n_sleep_screen_log_waking_up_2f9c230e">Aufwachen erfassen</string>
     <string name="l10n_sleep_screen_logged_as_a_nap_wrong_tap_4285d23e">Als Nickerchen erfasst. Falsch? Tippe auf „Bearbeiten“, um Schlaf- und Aufwachzeiten anzupassen.</string>
@@ -848,7 +848,7 @@
     <string name="l10n_sleep_screen_no_movement_detail_for_this_night_a6f9736a">Kein Bewegungsdetail für diese Nacht.</string>
     <string name="l10n_sleep_screen_no_nights_here_yet_607248f5">Keine Nächte hier noch</string>
     <string name="l10n_sleep_screen_no_nights_with_sleep_data_yet_fa71b6b3">Noch keine Nächte mit Schlafdaten. Deine Bilanz füllt sich, wenn du den Strap im Bett trägst.</string>
-    <string name="l10n_sleep_screen_not_enough_history_in_this_range_7e2fd640">Nicht genug Geschichte in diesem Bereich. Versuchen Sie 3M, 6M oder ALL.</string>
+    <string name="l10n_sleep_screen_not_enough_history_in_this_range_7e2fd640">Nicht genug Geschichte in diesem Bereich. Versuche 3M, 6M oder ALL.</string>
     <string name="l10n_sleep_screen_not_enough_history_yet_0e2f93b6">Noch nicht genug Geschichte</string>
     <string name="l10n_sleep_screen_per_night_sleep_balance_ledger_nightcount_f339d0ab">Schlafbalance pro Nacht: %1$s Nächte, netto %2$s</string>
     <string name="l10n_sleep_screen_percent_2281d326">%1$s%%</string>
@@ -883,47 +883,47 @@
     <string name="l10n_smart_alarm_screen_buzz_strapname_813772f4">Buzz %1$s</string>
     <string name="l10n_smart_alarm_screen_how_the_smart_wake_works_8cf34930">Wie der Smart Wake funktioniert</string>
     <string name="l10n_smart_alarm_screen_lengthen_window_c947ea1d">Längeres Fenster</string>
-    <string name="l10n_smart_alarm_screen_noop_doesn_t_have_permission_to_5b67cef0">NOOP hat keine Berechtigung, genaue Alarme einzustellen, so dass Ihr Wake nicht garantiert ist.</string>
+    <string name="l10n_smart_alarm_screen_noop_doesn_t_have_permission_to_5b67cef0">NOOP hat keine Berechtigung, genaue Alarme einzustellen, so dass dein Wake nicht garantiert ist.</string>
     <string name="l10n_smart_alarm_screen_off_e3de5ab0">Aus</string>
     <string name="l10n_smart_alarm_screen_remind_me_to_wind_down_4839f0d0">Erinnere mich ans Runterkommen</string>
     <string name="l10n_smart_alarm_screen_shorten_window_5bf5b37d">Fenster verkürzen</string>
     <string name="l10n_smart_alarm_screen_strap_wake_alarm_1828fff3">Strap-Weckalarm</string>
     <string name="smart_alarm_check_strap_alarm">Prüfen, was das Band gespeichert hat</string>
     <string name="smart_alarm_check_strap_alarm_help">Die Antwort des Bands erscheint im Band-Log und im Diagnose-Export, samt der empfangenen Rohbytes.</string>
-    <string name="l10n_smart_alarm_screen_the_earliest_noop_will_wake_you_b641a2d4">Der früheste NOOP wird Sie wecken.</string>
-    <string name="l10n_smart_alarm_screen_the_guaranteed_alarm_fires_this_long_b0c51052">Der garantierte Alarm feuert so lange nach Ihrer frühesten Zeit.</string>
+    <string name="l10n_smart_alarm_screen_the_earliest_noop_will_wake_you_b641a2d4">Der früheste NOOP wird dich wecken.</string>
+    <string name="l10n_smart_alarm_screen_the_guaranteed_alarm_fires_this_long_b0c51052">Der garantierte Alarm feuert so lange nach deiner frühesten Zeit.</string>
     <string name="l10n_smart_alarm_screen_this_is_a_coarse_cue_from_d6bbabe7">Dies ist ein grober Hinweis auf die Herzfrequenz, keine klinische Schlafphase. Wenn das Gurtband</string>
-    <string name="l10n_smart_alarm_screen_turn_on_the_smart_alarm_to_65700430">Schalten Sie den intelligenten Alarm ein, um in einem von Ihnen gewählten Fenster aufzuwachen.</string>
+    <string name="l10n_smart_alarm_screen_turn_on_the_smart_alarm_to_65700430">Schalte den intelligenten Alarm ein, um in einem von dir gewählten Fenster aufzuwachen.</string>
     <string name="l10n_smart_alarm_screen_wake_alarm_37af3ecf">Alarmsignal</string>
     <string name="l10n_smart_alarm_screen_wake_at_49089991">Aufwachen um</string>
     <string name="l10n_smart_alarm_screen_wake_me_no_earlier_than_67411622">Weck mich nicht früher als</string>
     <string name="l10n_smart_alarm_screen_wake_me_with_a_smart_alarm_bbbd082d">Weck mich mit einem intelligenten Alarm</string>
     <string name="l10n_smart_alarm_screen_wake_me_with_a_strap_buzz_1681ba1d">Weck mich mit einem Strap-Vibrieren</string>
-    <string name="l10n_smart_alarm_screen_while_you_re_inside_the_window_8700ca3b">Während Sie sich im Fenster befinden, beobachtet NOOP Ihre Live-Herzfrequenz vom Riemen aus. tief</string>
+    <string name="l10n_smart_alarm_screen_while_you_re_inside_the_window_8700ca3b">Während du dich im Fenster befindest, beobachtet NOOP deine Live-Herzfrequenz vom Riemen aus. tief</string>
     <string name="l10n_smart_alarm_screen_wind_down_nudge_5ca87a0f">Runterkommen-Anstoß</string>
     <string name="l10n_smart_alarm_screen_window_length_46179fcb">Fensterlänge</string>
     <string name="l10n_smart_alarm_screen_windowminutes_min_bd89fd82">%1$s min</string>
-    <string name="l10n_smart_alarm_screen_your_whoop_5_mg_won_t_75029bae">Ihr WHOOP 5/MG wird dies nicht bewaffnen, bis der Experimentalmodus eingeschaltet ist (Einstellungen)</string>
+    <string name="l10n_smart_alarm_screen_your_whoop_5_mg_won_t_75029bae">Dein WHOOP 5/MG wird dies nicht bewaffnen, bis der Experimentalmodus eingeschaltet ist (Einstellungen)</string>
     <string name="l10n_steps_calibration_screen_calibrate_your_steps_38b4e814">Deine Schritte kalibrieren</string>
     <string name="l10n_steps_calibration_screen_close_bbfa773e">Schließen</string>
     <string name="l10n_steps_calibration_screen_day_987b9ced">Tag</string>
     <string name="l10n_steps_calibration_screen_done_e9b450d1">Fertig</string>
     <string name="l10n_steps_calibration_screen_est_18b405fb">Gesch.</string>
     <string name="l10n_steps_calibration_screen_how_this_works_b895a8c3">Wie das funktioniert</string>
-    <string name="l10n_steps_calibration_screen_no_days_yet_where_both_noop_71d6005b">Noch keine Tage, an denen sowohl NOOP als auch Ihr Telefon Schritte gezählt haben. Sobald Ihr Telefon protokolliert a</string>
+    <string name="l10n_steps_calibration_screen_no_days_yet_where_both_noop_71d6005b">Noch keine Tage, an denen sowohl NOOP als auch dein Telefon Schritte gezählt haben. Sobald dein Telefon protokolliert a</string>
     <string name="l10n_steps_calibration_screen_no_motion_synced_yet_65106670">Noch keine Bewegung synchronisiert</string>
     <string name="l10n_steps_calibration_screen_noop_estimates_your_steps_from_your_d569bc31">NOOP schätzt deine Schritte aus der Bewegung deines WHOOP, kalibriert an der Schrittzahl deines Telefons. Es ist eine Schätzung, kein Schrittzähler. Ein WHOOP 4.0 überträgt keine Schritte.</string>
     <string name="l10n_steps_calibration_screen_not_calibrated_yet_30abe0d0">Noch nicht kalibriert</string>
-    <string name="l10n_steps_calibration_screen_on_the_days_your_phone_also_2f65a14c">An den Tagen, an denen Ihr Telefon auch Schritte gezählt hat, erfährt NOOP, wie viel Ihre Motion Maps</string>
-    <string name="l10n_steps_calibration_screen_open_noop_near_your_strap_and_e08ddd6d">Öffnen Sie NOOP in der Nähe Ihres Riemens und lassen Sie es aufholen (eine vollständige Historiensynchronisierung kann eine Weile dauern)</string>
-    <string name="l10n_steps_calibration_screen_override_the_automatic_fit_with_your_36a7b6fa">Überschreiben Sie die automatische Anpassung mit Ihrem eigenen Steps-per-Motion-Wert. Nützlich, wenn Ihr Telefon</string>
+    <string name="l10n_steps_calibration_screen_on_the_days_your_phone_also_2f65a14c">An den Tagen, an denen dein Telefon auch Schritte gezählt hat, erfährt NOOP, wie viel deine Motion Maps</string>
+    <string name="l10n_steps_calibration_screen_open_noop_near_your_strap_and_e08ddd6d">Öffne NOOP in der Nähe deines Riemens und lass es aufholen (eine vollständige Historiensynchronisierung kann eine Weile dauern)</string>
+    <string name="l10n_steps_calibration_screen_override_the_automatic_fit_with_your_36a7b6fa">Überschreibe die automatische Anpassung mit deinem eigenen Steps-per-Motion-Wert. Nützlich, wenn dein Telefon</string>
     <string name="l10n_steps_calibration_screen_phone_77064d52">Telefon</string>
     <string name="l10n_steps_calibration_screen_shortday_row_day_estimated_row_estimated_f2d71597">%1$s: geschätzte %2$s-Schritte, Telefon %3$s</string>
     <string name="l10n_steps_calibration_screen_steps_per_motion_unit_a2c2ac56">Schritte pro Bewegungseinheit</string>
     <string name="l10n_steps_calibration_screen_takes_effect_on_the_next_analytics_13205327">Wirkt beim nächsten Analysedurchlauf (nach der nächsten Synchronisierung).</string>
     <string name="l10n_steps_calibration_screen_these_are_the_days_where_your_ae5c9c2c">Das sind die Tage, an denen dein Telefon ebenfalls Schritte gezählt hat, damit NOOP lernen kann, wie deine Bewegung auf Schritte abbildet. Oder lege den Koeffizienten unten manuell fest.</string>
     <string name="l10n_steps_calibration_screen_these_days_are_excluded_from_the_6bedabbf">Diese Tage sind von der Schätzung ausgenommen (stattdessen wird die echte Zählung deines Telefons gezeigt). Sie stehen hier nur, damit du die Genauigkeit der Schätzung beurteilen kannst.</string>
-    <string name="l10n_steps_calibration_screen_we_re_not_seeing_any_motion_6ac8e092">Wir sehen noch keine Bewegung von Ihrem Riemen. Schritte werden von Ihrem WHOOP geschätzt</string>
+    <string name="l10n_steps_calibration_screen_we_re_not_seeing_any_motion_6ac8e092">Wir sehen noch keine Bewegung von deinem Riemen. Schritte werden von deinem WHOOP geschätzt</string>
     <string name="l10n_steps_calibration_screen_whoop_4_0_motion_steps_a63239dc">WHOOP 4.0 · Bewegung → Schritte</string>
     <string name="l10n_strand_components_next_day_38f859dd">Nächster Tag</string>
     <string name="l10n_strand_components_previous_day_e2b6b0a1">Vorheriger Tag</string>
@@ -936,9 +936,9 @@
     <string name="l10n_stress_screen_resting_hr_26677094">Ruhe-HF</string>
     <string name="l10n_stress_screen_start_a_breathe_session_9619e5c0">Atemsitzung starten</string>
     <string name="l10n_stress_screen_stress_bad33342">Stress</string>
-    <string name="l10n_stress_screen_your_last_day_sustainedrun_hours_have_194825dd">Ihre letzten %1$s Stunden sind im hohen Band geblieben. Ein paar Minuten</string>
+    <string name="l10n_stress_screen_your_last_day_sustainedrun_hours_have_194825dd">Deine letzten %1$s Stunden sind im hohen Band geblieben. Ein paar Minuten</string>
     <string name="l10n_test_centre_screen_7_night_baseline_base_ms_normal_43d9cfa6">7-Nacht-Basislinie %1$s ms, normal %2$s zu %3$s ms%4$s</string>
-    <string name="l10n_test_centre_screen_also_write_the_strap_log_to_655b55b2">Schreiben Sie auch das Bandprotokoll in das Systemprotokoll (Logcat) für die Entwicklung über adb. Standardmäßig ausgeschaltet.</string>
+    <string name="l10n_test_centre_screen_also_write_the_strap_log_to_655b55b2">Schreibe auch das Bandprotokoll in das Systemprotokoll (Logcat) für die Entwicklung über adb. Standardmäßig ausgeschaltet.</string>
     <string name="l10n_test_centre_screen_android_runs_this_via_workmanager_doze_875e499e">Android läuft dies über WorkManager (Doze kann es verzögern).</string>
     <string name="l10n_test_centre_screen_calibrating_validcount_hrvreadiness_min_nights_nights_c5b21706">Kalibrierung (%1$s/%2$s Nächte)</string>
     <string name="l10n_test_centre_screen_cancel_77dfd213">Abbrechen</string>
@@ -968,20 +968,20 @@
     <string name="l10n_test_centre_screen_share_strap_log_for_bug_reports_b9802500">Share strap log (für bug-reports)</string>
     <string name="l10n_test_centre_screen_test_centre_37b36828">Testzentrum</string>
     <string name="l10n_test_centre_screen_test_modes_e21f1d3c">Prüfphasen</string>
-    <string name="l10n_test_centre_screen_this_is_exactly_what_your_report_77278bdd">Genau das wird Ihr Bericht enthalten. Nichts verlässt dieses Telefon, bis Sie auf Teilen tippen.</string>
+    <string name="l10n_test_centre_screen_this_is_exactly_what_your_report_77278bdd">Genau das wird dein Bericht enthalten. Nichts verlässt dieses Telefon, bis du auf Teilen tippst.</string>
     <string name="l10n_test_centre_screen_this_restarts_the_roughly_4_night_33cce377">Das startet den etwa 4-nächtigen Aufbau für Ladung und deine HRV-Basislinie neu. Dein Verlauf bleibt.</string>
     <string name="l10n_time_of_day_background_atmospherephase_5ce21300">AtmosphärePhase</string>
     <string name="l10n_today_screen_arrange_today_6b699147">Heute vereinbaren</string>
     <string name="l10n_today_screen_calibrating_37c2c9bd">Kalibrierung</string>
     <string name="l10n_today_screen_no_new_nights_from_your_strap_for_stale_days_8863bcfe">Seit %1$d Tagen keine neuen Nächte von deinem Strap. Prüfe, ob er verbunden ist und Daten speichert.</string>
     <string name="l10n_today_screen_calibratingnights_of_baselines_minnightsseed_3b76e55c">%1$s von %2$s Nächten</string>
-    <string name="l10n_today_screen_choose_which_cards_show_on_today_f79942e1">Wählen Sie, welche Karten auf Heute angezeigt werden, und ordnen Sie sie mit den Pfeilen neu an.</string>
+    <string name="l10n_today_screen_choose_which_cards_show_on_today_f79942e1">Wähle, welche Karten auf Heute angezeigt werden, und ordne sie mit den Pfeilen neu an.</string>
     <string name="l10n_today_screen_close_bbfa773e">Schließen</string>
     <string name="l10n_today_screen_customise_your_cards_2428d761">Passe deine Karten an</string>
     <string name="l10n_today_screen_dismiss_70afe9ef">Schließen</string>
     <string name="l10n_today_screen_done_e9b450d1">Fertig</string>
     <string name="l10n_today_screen_driver_label_driver_valuetext_driver_baselinetext_067bc963">%1$s, %2$s, %3$s,</string>
-    <string name="l10n_today_screen_hold_a_section_and_drag_it_1d6e2441">Halten Sie einen Abschnitt und ziehen Sie ihn zum Nachbestellen - hier oder direkt auf den Today-Karten.</string>
+    <string name="l10n_today_screen_hold_a_section_and_drag_it_1d6e2441">Halte einen Abschnitt und ziehe ihn zum Nachbestellen - hier oder direkt auf den Today-Karten.</string>
     <string name="l10n_today_screen_how_charge_is_calculated_142d5e8e">So wird Ladung berechnet</string>
     <string name="l10n_today_screen_how_charge_is_calculated_the_method_3ea7548b">So wird Ladung berechnet. Die Methode hinter dem Wert.</string>
     <string name="l10n_today_screen_label_readout_3f166607">%1$s %2$s</string>
@@ -998,7 +998,7 @@
     <string name="l10n_today_screen_reset_44c57abd">Zurücksetzen</string>
     <string name="l10n_today_screen_return_to_workout_30dc5509">Zurück zum Workout</string>
     <string name="l10n_today_screen_see_how_charge_effort_and_rest_80243197">Sieh, wie Ladung, Anstrengung und Ruhe berechnet werden und wie sie sich von WHOOP unterscheiden.</string>
-    <string name="l10n_today_screen_see_how_it_works_f7b38f07">Sehen Sie, wie es funktioniert</string>
+    <string name="l10n_today_screen_see_how_it_works_f7b38f07">Sieh, wie es funktioniert</string>
     <string name="l10n_today_screen_show_item_card_title_7844540d">%1$s anzeigen</string>
     <string name="l10n_today_screen_signed_pts_5ea85678">%1$s pts</string>
     <string name="l10n_today_screen_state_title_state_detail_f5380609">%1$s. %2$s</string>
@@ -1015,7 +1015,7 @@
     <string name="l10n_updates_inbox_screen_clear_all_c043160a">Alle löschen</string>
     <string name="l10n_updates_inbox_screen_earlier_13f7aee7">Früher</string>
     <string name="l10n_updates_inbox_screen_mark_all_read_8958e22c">Alle als gelesen markieren</string>
-    <string name="l10n_updates_inbox_screen_mark_read_3bf98fa6">Markieren Sie</string>
+    <string name="l10n_updates_inbox_screen_mark_read_3bf98fa6">Markiere</string>
     <string name="l10n_updates_inbox_screen_new_6403f2b7">Neu</string>
     <string name="l10n_updates_inbox_screen_new_release_notes_and_fresh_data_1632c576">Neue Release Notes und frische Daten landen hier.</string>
     <string name="l10n_updates_inbox_screen_restore_to_today_77c7c8e5">In „Heute“ wiederherstellen</string>
@@ -1039,7 +1039,7 @@
     <string name="l10n_whoop_model_comparison_screen_noop_pairs_with_the_whoop_4_599b088c">NOOP kombiniert mit dem WHOOP 4.0 und dem WHOOP 5.0/MG. Sie teilen das meiste, was zählt (live).</string>
     <string name="l10n_whoop_model_comparison_screen_on_a_whoop_4_0_32a5968d">Auf einem WHOOP 4.0?</string>
     <string name="l10n_whoop_model_comparison_screen_what_each_can_read_and_why_4348bd67">Was jeder lesen kann und warum</string>
-    <string name="l10n_whoop_model_comparison_screen_you_re_not_missing_the_broadcast_1d2fa907">Sie verpassen nicht die Broadcast-Funktion. Um Ihre Herzfrequenz mit einer Turnhalle Maschine zu teilen,</string>
+    <string name="l10n_whoop_model_comparison_screen_you_re_not_missing_the_broadcast_1d2fa907">Du verpasst nicht die Broadcast-Funktion. Um deine Herzfrequenz mit einer Turnhalle Maschine zu teilen,</string>
     <string name="l10n_workout_start_cancel_77dfd213">Abbrechen</string>
     <string name="l10n_workout_start_end_a2bb9d34">Ende</string>
     <string name="l10n_workout_start_gps_124667d8">· GPS</string>
@@ -1068,7 +1068,7 @@
     <string name="l10n_workouts_screen_edit_b454359e">Bearbeiten…</string>
     <string name="l10n_workouts_screen_edit_details_9e62bb59">Details bearbeiten…</string>
     <string name="l10n_workouts_screen_effort_this_effectiverange_heroword_0bd5e794">Bemühung dieses %1$s</string>
-    <string name="l10n_workouts_screen_enter_a_sport_a_positive_duration_3da88ad5">Geben Sie einen Sport, eine positive Dauer (≤ 24h) und gültige HR (25-250) / Kalorien (0-20.000) ein.</string>
+    <string name="l10n_workouts_screen_enter_a_sport_a_positive_duration_3da88ad5">Gib einen Sport, eine positive Dauer (≤ 24h) und gültige HR (25-250) / Kalorien (0-20.000) ein.</string>
     <string name="l10n_workouts_screen_filter_by_source_db11bbb7">Filter nach Quelle</string>
     <string name="l10n_workouts_screen_filter_by_sport_bcbbcb3b">Filter nach Sport</string>
     <string name="l10n_workouts_screen_g_count_247d8c10">%1$s</string>
@@ -1085,7 +1085,7 @@
     <string name="l10n_workouts_screen_show_more_more_sessions_25bce755">%1$s weitere Sessions anzeigen</string>
     <string name="l10n_workouts_screen_started_faa9e7e7">Beginn</string>
     <string name="l10n_workouts_screen_the_average_above_was_edited_the_0a7881f0">Der Durchschnitt oben wurde bearbeitet. Graph, Zonen und Anstrengung bleiben aus der aufgezeichneten Sitzung.</string>
-    <string name="l10n_workouts_screen_these_sessions_have_no_sport_label_53993414">Diese Sessions haben noch kein Sportlabel. Wählen Sie eine für die fusionierte Sitzung.</string>
+    <string name="l10n_workouts_screen_these_sessions_have_no_sport_label_53993414">Diese Sessions haben noch kein Sportlabel. Wähle eine für die fusionierte Sitzung.</string>
     <string name="l10n_workouts_screen_this_session_s_contribution_to_the_fe40ab3d">Der Beitrag dieser Sitzung zur Tages-Anstrengung, wie während des Workouts erfasst.</string>
     <string name="l10n_workouts_screen_this_session_s_effort_onedecimal_shown_74eed8be">Diese Sitzung Anstrengung, %1$s auf der</string>
     <string name="l10n_workouts_screen_total_calories_0a49da20">Kalorien gesamt</string>
@@ -1100,7 +1100,7 @@
     <string name="l10n_add_device_wizard_cancel_77dfd213">Abbrechen</string>
     <string name="l10n_add_device_wizard_close_bbfa773e">Schließen</string>
     <string name="l10n_add_device_wizard_make_active_75690bb8">Aktiv setzen</string>
-    <string name="l10n_add_device_wizard_make_confirmname_your_active_device_now_90ceb73e">Machen Sie %1$s jetzt zu Ihrem aktiven Gerät? Es wird Ihre Live-Daten zur Verfügung stellen. Du kannst dich ändern</string>
+    <string name="l10n_add_device_wizard_make_confirmname_your_active_device_now_90ceb73e">Mach %1$s jetzt zu deinem aktiven Gerät? Es wird deine Live-Daten zur Verfügung stellen. Du kannst dich ändern</string>
     <string name="l10n_add_device_wizard_make_this_your_active_device_b425485c">Zu deinem aktiven Gerät machen?</string>
     <string name="l10n_add_device_wizard_noop_will_install_its_own_key_d3f6321e">NOOP installiert seinen eigenen Schlüssel auf dem Ring und wird sein Besitzer. Die Oura-App steuert diesen Ring dann nicht mehr. Das ist beabsichtigt und kann von NOOP aus nicht rückgängig gemacht werden.</string>
     <string name="l10n_add_device_wizard_not_now_e4571490">Nicht jetzt</string>
@@ -1111,8 +1111,8 @@
     <string name="l10n_app_changelog_a_big_bug_fix_sweep_with_65335764">Ein großer Bug-Fix-Sweep, mit dem Testzentrum, um es zu unterstützen</string>
     <string name="l10n_app_changelog_a_big_one_smarter_sleep_naps_8d7745c6">Ein großer: intelligenter Schlaf, Nickerchen, mehr Geräte und eine Menge Fixes</string>
     <string name="l10n_app_changelog_a_bolder_today_screen_4efe8215">Ein mutiger Heute Bildschirm</string>
-    <string name="l10n_app_changelog_a_calmer_today_your_charge_explained_e4174303">Ein ruhiger Heute, Ihre Ladung erklärt, und neue HRV Wissenschaft unter der Haube</string>
-    <string name="l10n_app_changelog_a_cleaner_home_refreshed_design_a_8c91c06b">Ein saubereres Zuhause - erfrischtes Design, ein neuer Posteingang, Ihr Foto</string>
+    <string name="l10n_app_changelog_a_calmer_today_your_charge_explained_e4174303">Ein ruhiger Heute, deine Ladung erklärt, und neue HRV Wissenschaft unter der Haube</string>
+    <string name="l10n_app_changelog_a_cleaner_home_refreshed_design_a_8c91c06b">Ein saubereres Zuhause - erfrischtes Design, ein neuer Posteingang, dein Foto</string>
     <string name="l10n_app_changelog_a_fresh_look_new_gold_on_6f379935">Ein frischer Look - neue Gold-on-Navy-Ikone</string>
     <string name="l10n_app_changelog_a_quick_fix_9cd2b7de">Eine schnelle Lösung</string>
     <string name="l10n_app_changelog_a_round_of_fixes_reconnect_exports_7700d972">Eine Runde Fixes - Reconnect, Export &amp; Health Setup</string>
@@ -1132,7 +1132,7 @@
     <string name="l10n_app_changelog_android_notification_recovery_fix_widget_armour_b84839c6">Android: Benachrichtigung Recovery Fix + Widget Armour</string>
     <string name="l10n_app_changelog_android_reconnect_guide_a_startup_crash_9900dd7a">Android Reconnect Guide + ein Startup-Crash-Fix</string>
     <string name="l10n_app_changelog_android_reliable_reconnect_after_a_dropout_c96cb4c0">Android: zuverlässiges Reconnect nach einem Dropout</string>
-    <string name="l10n_app_changelog_android_share_back_to_health_connect_4d87898e">Android: Teilen Sie zurück zu Health Connect</string>
+    <string name="l10n_app_changelog_android_share_back_to_health_connect_4d87898e">Android: Teile zurück zu Health Connect</string>
     <string name="l10n_app_changelog_android_the_widget_now_actually_updates_dc770011">Android: Das Widget aktualisiert sich jetzt tatsächlich</string>
     <string name="l10n_app_changelog_android_today_clearer_empty_states_39ad5d2c">Android Today: klarere leere Zustände</string>
     <string name="l10n_app_changelog_android_whoop_4_on_newer_firmware_383314db">Android: WHOOP 4 auf neuerer Firmware zeichnet jetzt Daten auf</string>
@@ -1151,7 +1151,7 @@
     <string name="l10n_app_changelog_board_sweep_battery_days_left_browse_8b78e0b6">Board Sweep: Batterie Tage links, durchsuchen vergangene Wochen, Atemzeichen und ein Haufen Fixes</string>
     <string name="l10n_app_changelog_broadcast_your_heart_rate_to_garmin_338605c5">Sende deine Herzfrequenz an Garmin, Zwift und Gym Kit</string>
     <string name="l10n_app_changelog_browse_past_nights_smarter_coach_workout_9fc9bfd2">Browse vergangene Nächte, smarter Coach, Trainingszeiten, Batterie &amp; mehr</string>
-    <string name="l10n_app_changelog_browse_the_last_few_days_interactive_a13e7b2a">Durchsuchen Sie die letzten Tage, interaktive Charts und einen Vital Signs-Bildschirm (Android)</string>
+    <string name="l10n_app_changelog_browse_the_last_few_days_interactive_a13e7b2a">Durchsuche die letzten Tage, interaktive Charts und einen Vital Signs-Bildschirm (Android)</string>
     <string name="l10n_app_changelog_bug_fix_sweep_steps_sleep_export_50c60c51">Bug-Fix Sweep: Schritte, Schlaf-Export und eine batteriesparende Reconnect-Fix</string>
     <string name="l10n_app_changelog_bug_fixes_effort_the_widget_s_6b807b50">Bugfixes: Anstrengung, der Tag des Widgets und Oura Reconnect</string>
     <string name="l10n_app_changelog_buzz_whoop_4_in_the_smart_4d17676a">Buzz WHOOP 4 im Smart Alarm</string>
@@ -1161,12 +1161,12 @@
     <string name="l10n_app_changelog_classic_chart_colours_a_throwback_toggle_e8150db5">Klassische Chartfarben - ein Throwback-Toggle</string>
     <string name="l10n_app_changelog_cleaner_live_status_better_sync_diagnostics_00ad8d26">Cleaner Live Status + bessere Sync-Diagnose</string>
     <string name="l10n_app_changelog_cleaner_score_rings_a_few_fixes_7094ae7b">Cleaner Score Ringe + ein paar Fixes</string>
-    <string name="l10n_app_changelog_clearer_answers_when_your_strap_isn_154c8923">Klarere Antworten, wenn Ihr Riemen keine Bankgeschichte ist</string>
+    <string name="l10n_app_changelog_clearer_answers_when_your_strap_isn_154c8923">Klarere Antworten, wenn dein Riemen keine Bankgeschichte ist</string>
     <string name="l10n_app_changelog_clearer_labels_a_journal_fix_and_96b91b2a">Klarere Etiketten, ein Journal Fix und stabilere schlafende Herzfrequenz</string>
     <string name="l10n_app_changelog_clearer_pairing_guidance_for_whoop_5_91a7736b">Klarere Paarungsleitlinien für WHOOP 5.0/MG</string>
     <string name="l10n_app_changelog_clearer_sync_status_6431bf19">Klarer Sync-Status</string>
     <string name="l10n_app_changelog_clearer_sync_status_a_responsive_compare_ee8925d0">Klarerer Synchronisierungsstatus + ein responsiver Bildschirm vergleichen</string>
-    <string name="l10n_app_changelog_connect_a_heart_rate_strap_early_f12c6ba9">Verbinden Sie einen Herzfrequenzgurt (früher Zugang)</string>
+    <string name="l10n_app_changelog_connect_a_heart_rate_strap_early_f12c6ba9">Verbinde einen Herzfrequenzgurt (früher Zugang)</string>
     <string name="l10n_app_changelog_connection_sleep_fixes_a_focused_tune_69b01439">Connection &amp; Sleep Fixes - ein fokussiertes Tune-Up</string>
     <string name="l10n_app_changelog_continuous_hrv_capture_sharper_overnight_hrv_9a9ec94b">Continuous HRV Capture - schärfer über Nacht HRV, Erholung und Schlaf</string>
     <string name="l10n_app_changelog_continuous_workouts_no_longer_split_plus_4db70213">Kontinuierliche Workouts werden nicht mehr geteilt und eine Schlafsitzung gelöscht</string>
@@ -1177,22 +1177,22 @@
     <string name="l10n_app_changelog_deep_history_backlog_drains_without_manual_bb716532">Deep History Backlog läuft ohne manuelle Taps ab</string>
     <string name="l10n_app_changelog_deep_sleep_no_longer_reads_0_80ce3558">Tiefschlaf liest nicht mehr 0 Minuten und ein klügerer AI Coach</string>
     <string name="l10n_app_changelog_deep_sleep_that_happens_later_in_702efdf1">Tiefschlaf, der später in der Nacht passiert, liest nicht mehr 0 Minuten</string>
-    <string name="l10n_app_changelog_deep_timeline_you_can_scroll_through_7c04c040">tief Timeline Sie können durch Tage, schnellere manuelle Workouts und eine Speicherbereinigung scrollen</string>
-    <string name="l10n_app_changelog_delete_a_sleep_swipe_to_mark_7083b34d">Löschen Sie einen Schlaf, wischen Sie, um Lesen zu markieren</string>
+    <string name="l10n_app_changelog_deep_timeline_you_can_scroll_through_7c04c040">tief Timeline du kannst durch Tage, schnellere manuelle Workouts und eine Speicherbereinigung scrollen</string>
+    <string name="l10n_app_changelog_delete_a_sleep_swipe_to_mark_7083b34d">Lösche einen Schlaf, wische, um Lesen zu markieren</string>
     <string name="l10n_app_changelog_design_polish_cross_platform_parity_caa8e2c4">Design Polnisch &amp; Cross-Plattform Parität</string>
     <string name="l10n_app_changelog_dynamic_island_toggle_now_actually_turns_df387ee6">Dynamic Island Toggle schaltet es jetzt aus</string>
     <string name="l10n_app_changelog_editable_naps_a_richer_trends_report_471c1a69">Editable Nickerchen, ein reicherer Trends-Bericht und besserer Debug-Export</string>
     <string name="l10n_app_changelog_effort_explains_a_calm_day_zero_08bd9936">Anstrengung erklärt eine Ruhe-Tag Null - und punktet auf der 5,0/MG</string>
     <string name="l10n_app_changelog_effort_scale_fix_for_imported_data_aad0344d">Fix der Aufwandsskala für importierte Daten</string>
-    <string name="l10n_app_changelog_estimated_steps_for_your_whoop_4_e961cade">Geschätzte Schritte für Ihren WHOOP 4.0</string>
+    <string name="l10n_app_changelog_estimated_steps_for_your_whoop_4_e961cade">Geschätzte Schritte für deinen WHOOP 4.0</string>
     <string name="l10n_app_changelog_everything_a_whole_new_look_hydration_0f648fc3">Alles: ein ganz neues Aussehen, Flüssigkeitszufuhr, automatische Workout-Erkennung und intelligenter Schlaf</string>
     <string name="l10n_app_changelog_everything_stays_on_your_device_575125e9">Alles bleibt auf deinem Gerät</string>
     <string name="l10n_app_changelog_experimental_unlocking_whoop_5_0_mg_d665f836">Experimentell: WHOOP 5.0/MG Deep Data freischalten</string>
-    <string name="l10n_app_changelog_export_your_raw_sensor_data_csv_59cfa009">Exportieren Sie Ihre rohen Sensordaten (CSV)</string>
+    <string name="l10n_app_changelog_export_your_raw_sensor_data_csv_59cfa009">Exportiere deine rohen Sensordaten (CSV)</string>
     <string name="l10n_app_changelog_faster_and_fewer_sharp_edges_6bbd66c7">Schneller und weniger scharfe Kanten</string>
     <string name="l10n_app_changelog_faster_smoother_more_languages_and_a_6a8c8837">Schneller, glatter, mehr Sprachen und ein großer Haufen Fixes</string>
     <string name="l10n_app_changelog_fewer_false_daytime_sleeps_an_android_6bf9029e">Weniger falsche Tagesruhen + eine Android-Synchronisierungstaste</string>
-    <string name="l10n_app_changelog_find_your_strap_log_in_settings_99105f3a">Finden Sie Ihr Band Log in Einstellungen (macOS)</string>
+    <string name="l10n_app_changelog_find_your_strap_log_in_settings_99105f3a">Finde dein Band Log in Einstellungen (macOS)</string>
     <string name="l10n_app_changelog_first_release_d5545946">Erste Freigabe</string>
     <string name="l10n_app_changelog_first_run_terms_acknowledgment_an_explore_081534f5">First-Run-Bedingungen Bestätigung + ein Explore Chart Fix</string>
     <string name="l10n_app_changelog_fix_a_night_with_a_brief_538bfa1d">Fix: Eine Nacht mit einem kurzen Aufwachen zeigte sich als separates Nickerchen</string>
@@ -1200,8 +1200,8 @@
     <string name="l10n_app_changelog_fix_bonded_but_no_live_data_fbab40a4">Fix: gebunden, aber keine Live-Daten (Android)</string>
     <string name="l10n_app_changelog_fix_connecting_a_polar_h10_or_bf013d57">Fix: Anschluss eines Polar H10 oder eines anderen Herzfrequenzbandes</string>
     <string name="l10n_app_changelog_fix_imported_phone_steps_were_being_7c152d2b">Fix: Importierte Telefonschritte wurden doppelt gezählt</string>
-    <string name="l10n_app_changelog_fix_the_android_freeze_after_a_bf7f8d81">Beheben Sie das Einfrieren von Android nach ein paar Nächten mit Daten</string>
-    <string name="l10n_app_changelog_fix_your_day_now_follows_your_e772176e">Fix: Ihr Tag folgt jetzt Ihrer Zeitzone, nicht UTC</string>
+    <string name="l10n_app_changelog_fix_the_android_freeze_after_a_bf7f8d81">Behebe das Einfrieren von Android nach ein paar Nächten mit Daten</string>
+    <string name="l10n_app_changelog_fix_your_day_now_follows_your_e772176e">Fix: Dein Tag folgt jetzt deiner Zeitzone, nicht UTC</string>
     <string name="l10n_app_changelog_fixed_imported_data_and_strap_sync_18350836">Fix: Importierte Daten und Bandsynchronisierung bleiben auf iOS stecken</string>
     <string name="l10n_app_changelog_fixed_iphone_import_and_a_stuck_38876ee9">Fix: iPhone-Import und ein festgefahrener Laden heilen sich jetzt selbst</string>
     <string name="l10n_app_changelog_fixes_a_false_pairing_refused_warning_7023464e">Behebt eine falsche Warnung "Paarung abgelehnt" (Mac)</string>
@@ -1210,7 +1210,7 @@
     <string name="l10n_app_changelog_french_whoop_exports_now_import_db598ea4">Französisch WHOOP exportiert jetzt Import</string>
     <string name="l10n_app_changelog_gps_tracked_workouts_android_1cf07bd1">GPS-Tracked Workouts (Android)</string>
     <string name="l10n_app_changelog_gps_workout_crash_fix_android_698ee690">GPS Workout Crash Fix (Android)</string>
-    <string name="l10n_app_changelog_hand_correct_your_sleep_times_smaller_6154b854">Handkorrigieren Sie Ihre Schlafzeiten + kleinere Backups</string>
+    <string name="l10n_app_changelog_hand_correct_your_sleep_times_smaller_6154b854">Handkorrigiere deine Schlafzeiten + kleinere Backups</string>
     <string name="l10n_app_changelog_health_connect_correct_labels_workout_types_fd2fcc34">Health Connect: Korrekte Etiketten + Trainingstypen (Android)</string>
     <string name="l10n_app_changelog_health_connect_shows_as_health_connect_39b3cbcb">Health Connect zeigt sich als Health Connect</string>
     <string name="l10n_app_changelog_history_dates_fixed_for_revived_straps_0ec4e53a">Historische Daten für wiederbelebte Gurte, Gesten während der Synchronisierung, klarere Paarung</string>
@@ -1237,10 +1237,10 @@
     <string name="l10n_app_changelog_light_theme_tuning_2bbad1f7">Light Theme Tuning</string>
     <string name="l10n_app_changelog_live_heart_rate_lands_on_today_5cac8768">Live-Herzfrequenz landet auf dem heutigen Chart, auch wenn die Uhr des Bandes ausgeschaltet ist (Android)</string>
     <string name="l10n_app_changelog_live_heart_rate_that_doesn_t_b6b4ca9a">Live-Herzfrequenz, die nicht einfriert</string>
-    <string name="l10n_app_changelog_local_oura_ring_support_use_your_e928e3c6">Lokale Oura-Ring-Unterstützung: Verwenden Sie Ihren Oura-Ring ohne Oura-App (Beta)</string>
-    <string name="l10n_app_changelog_mac_recovery_builds_from_your_strap_883d49ee">Mac: Recovery Builds von Ihrem Gurt allein</string>
+    <string name="l10n_app_changelog_local_oura_ring_support_use_your_e928e3c6">Lokale Oura-Ring-Unterstützung: Verwende deinen Oura-Ring ohne Oura-App (Beta)</string>
+    <string name="l10n_app_changelog_mac_recovery_builds_from_your_strap_883d49ee">Mac: Recovery Builds von deinem Gurt allein</string>
     <string name="l10n_app_changelog_mac_strap_computed_nights_show_in_b0a3ac91">Mac: strap-computed nights show im Schlaf</string>
-    <string name="l10n_app_changelog_manage_several_whoop_straps_and_see_8d9b6a84">Verwalten Sie mehrere WHOOP-Bänder - und sehen Sie, was jedes Band tut</string>
+    <string name="l10n_app_changelog_manage_several_whoop_straps_and_see_8d9b6a84">Verwalte mehrere WHOOP-Bänder - und sieh, was jedes Band tut</string>
     <string name="l10n_app_changelog_manual_workouts_edit_dismiss_auto_detected_95ed45b6">Manuelle Workouts, automatisch erkannte Workouts bearbeiten / ablehnen und CSV-Export</string>
     <string name="l10n_app_changelog_manual_workouts_on_whoop_5_0_72908a88">Manuelle Workouts auf WHOOP 5.0/MG bekommen ihre Kalorien und belasten sich zurück</string>
     <string name="l10n_app_changelog_mi_band_import_a_big_whoop_eb5382db">Mi Band Import + eine große WHOOP 4.0 Schlaflösung</string>
@@ -1249,41 +1249,41 @@
     <string name="l10n_app_changelog_more_realistic_calories_import_chart_fixes_d3d56a9e">Realistischere Kalorien + Import &amp; Chart Fixes</string>
     <string name="l10n_app_changelog_more_reliable_bluetooth_on_newer_android_c7e641dc">Zuverlässigeres Bluetooth auf neueren Android-Handys</string>
     <string name="l10n_app_changelog_more_tab_icons_stop_flickering_colour_3de3de9f">Mehr-Tab-Symbole stoppen flackernde Farbe</string>
-    <string name="l10n_app_changelog_new_a_guide_to_how_your_7afbd7f4">Neu: ein Leitfaden, wie Ihre Charge, Effort und Ruhewerte funktionieren</string>
+    <string name="l10n_app_changelog_new_a_guide_to_how_your_7afbd7f4">Neu: ein Leitfaden, wie deine Charge, Effort und Ruhewerte funktionieren</string>
     <string name="l10n_app_changelog_new_first_run_onboarding_mac_android_243bc0ad">Neues First-Run-Onboarding (Mac + Android)</string>
     <string name="l10n_app_changelog_new_use_an_apple_watch_with_4c2c29a6">Neu: Apple Watch mit NOOP nutzen</string>
     <string name="l10n_app_changelog_new_week_in_review_a_live_c1457e40">Neu: Woche im Rückblick, eine Live-Körperkonsole, frischere Charts und mehr</string>
-    <string name="l10n_app_changelog_no_more_hr_spike_when_you_7dc052ba">Keine HR-Spike mehr, wenn Sie die App wieder öffnen</string>
+    <string name="l10n_app_changelog_no_more_hr_spike_when_you_7dc052ba">Keine HR-Spike mehr, wenn du die App wieder öffnest</string>
     <string name="l10n_app_changelog_noop_grows_up_it_s_not_823bf2e7">NOOP wächst auf: Es ist nicht mehr nur für WHOOP</string>
     <string name="l10n_app_changelog_noop_has_a_new_home_01b87522">NOOP hat ein neues Zuhause</string>
-    <string name="l10n_app_changelog_noop_now_tells_you_when_your_af259fbb">NOOP sagt Ihnen jetzt, wenn Ihr Riemen die Geschichte nicht speichert - und wie Sie ihn beheben können</string>
+    <string name="l10n_app_changelog_noop_now_tells_you_when_your_af259fbb">NOOP sagt dir jetzt, wenn dein Riemen die Geschichte nicht speichert - und wie du ihn beheben kannst</string>
     <string name="l10n_app_changelog_on_demand_hrv_a_haptic_clock_50376585">On-Demand HRV, eine haptische Uhr, Schlafmarken &amp; mehr</string>
     <string name="l10n_app_changelog_oneplus_pairing_fix_f731fcb2">OnePlus Pairing Fix</string>
-    <string name="l10n_app_changelog_open_a_workout_see_what_it_a40fd8a4">Öffnen Sie ein Workout, sehen Sie, was es Sie kostet, und teilen Sie Ihre Trends</string>
+    <string name="l10n_app_changelog_open_a_workout_see_what_it_a40fd8a4">Öffne ein Workout, sieh, was es dich kostet, und teile deine Trends</string>
     <string name="l10n_app_changelog_optional_inactivity_nudge_3f4ca05a">Optionaler Inaktivitäts-Nudge</string>
     <string name="l10n_app_changelog_personal_vital_baselines_mac_analytics_parity_744972d1">Persönliche Vital Baselines + Mac Analytics Parität</string>
     <string name="l10n_app_changelog_polish_matched_to_the_iphone_mac_cc34126b">Polnisch - abgestimmt auf das iPhone &amp; Mac Design</string>
     <string name="l10n_app_changelog_german_french_spanish_pull_to_sync_1109bda2">Deutsch, Französisch und Spanisch, Pull-to-Sync auf Today und viele Verbesserungen</string>
     <string name="l10n_app_changelog_hrv_accuracy_fix_oura_sleep_and_4ed31e39">HRV-Korrektur, Oura-Schlaf und -Bewegung, mehr 5/MG-Daten und ein stoppbarer Sync</string>
     <string name="l10n_app_changelog_optimal_strain_alerts_faster_history_sync_6488a27a">Hinweise zur optimalen Anstrengung, schnellere Verlaufssynchronisierung und viele Genauigkeitskorrekturen</string>
-    <string name="l10n_app_changelog_power_saving_that_protects_your_strap_57a32503">Energieeinsparung, die Ihren Riemen schützt, ein Gemini-powered Coach auf Android und reichere metrische Details</string>
+    <string name="l10n_app_changelog_power_saving_that_protects_your_strap_57a32503">Energieeinsparung, die deinen Riemen schützt, ein Gemini-powered Coach auf Android und reichere metrische Details</string>
     <string name="l10n_app_changelog_raw_spo_honest_units_and_a_55e83a59">Raw SpO2, ehrliche Einheiten und eine leichtere App</string>
     <string name="l10n_app_changelog_re_scan_actually_scans_on_android_22198c8c">Re-Scan tatsächlich scannt auf Android</string>
     <string name="l10n_app_changelog_readiness_and_the_start_of_whoop_167f38c5">Readiness und der Start von WHOOP 5/MG</string>
     <string name="l10n_app_changelog_readiness_shows_its_evidence_and_a_90cf0076">Readiness zeigt seine Beweise und eine Health Connect Abstand fix</string>
-    <string name="l10n_app_changelog_reading_more_from_your_whoop_5_1412164a">Lesen Sie mehr von Ihrem WHOOP 5.0 (Mac)</string>
+    <string name="l10n_app_changelog_reading_more_from_your_whoop_5_1412164a">Lies mehr von deinem WHOOP 5.0 (Mac)</string>
     <string name="l10n_app_changelog_reconnect_help_for_whoop_5_0_acc779b6">Reconnect Hilfe für WHOOP 5.0 / MG nach einem Firmware-Update</string>
     <string name="l10n_app_changelog_reconnects_automatically_after_an_update_android_b4965179">Automatische Wiederverbindung nach einem Update (Android)</string>
-    <string name="l10n_app_changelog_recovery_builds_from_your_strap_alone_d83dbd67">Recovery Builds von Ihrem Band allein (Android)</string>
+    <string name="l10n_app_changelog_recovery_builds_from_your_strap_alone_d83dbd67">Recovery Builds von deinem Band allein (Android)</string>
     <string name="l10n_app_changelog_respiratory_rate_skin_temp_in_the_bfe3f4f9">Atemfrequenz &amp; Hauttemperatur im Trendbericht</string>
-    <string name="l10n_app_changelog_restart_your_strap_lighter_on_battery_2ccbef88">Starten Sie Ihren Gurt, leichter auf Akku und Health Connect auf Android 13</string>
+    <string name="l10n_app_changelog_restart_your_strap_lighter_on_battery_2ccbef88">Starte deinen Gurt, leichter auf Akku und Health Connect auf Android 13</string>
     <string name="l10n_app_changelog_robust_apple_health_import_marginal_radio_27d78c57">Robuster Apple Health Import, marginaler Radio-HR-Modus, Live-HR-Graph</string>
     <string name="l10n_app_changelog_round_rings_73de603c">Rundringe</string>
-    <string name="l10n_app_changelog_run_the_ai_coach_on_your_8ac2b395">Führen Sie den AI Coach auf Ihrem eigenen Modell aus - einschließlich vollständig lokal</string>
+    <string name="l10n_app_changelog_run_the_ai_coach_on_your_8ac2b395">Führe den AI Coach auf deinem eigenen Modell aus - einschließlich vollständig lokal</string>
     <string name="l10n_app_changelog_scores_live_from_the_strap_9d5d8ae2">Noten leben vom Gurt</string>
     <string name="l10n_app_changelog_security_reliability_hardening_b3c9a976">Sicherheit &amp; Zuverlässigkeit Härtung</string>
-    <string name="l10n_app_changelog_see_everything_the_deep_timeline_a_dbfe539a">Sehen Sie alles: die Deep Timeline, ein Schlafbewegungsdiagramm und eine große Board-Clear</string>
-    <string name="l10n_app_changelog_share_strap_logs_and_a_worn_b5aae860">Teilen Sie Bandlogs und einen Weared-Status-Fix</string>
+    <string name="l10n_app_changelog_see_everything_the_deep_timeline_a_dbfe539a">Sieh alles: die Deep Timeline, ein Schlafbewegungsdiagramm und eine große Board-Clear</string>
+    <string name="l10n_app_changelog_share_strap_logs_and_a_worn_b5aae860">Teile Bandlogs und einen Weared-Status-Fix</string>
     <string name="l10n_app_changelog_shortcuts_export_duplicates_fixed_nutrition_mood_a5dcdc11">Shortcuts-Export Duplikate fixiert; Ernährung &amp; Stimmung erreichen Android-Charts</string>
     <string name="l10n_app_changelog_shortcuts_on_mac_recovery_in_the_dbcef46a">Verknüpfungen auf Mac, Wiederherstellung in der Android-Benachrichtigung</string>
     <string name="l10n_app_changelog_skin_temperature_unblocked_on_mac_ios_9cb6276c">Hauttemperatur auf Mac / iOS freigegeben, plus Export Fixes</string>
@@ -1293,19 +1293,19 @@
     <string name="l10n_app_changelog_sleep_figures_hr_zones_charging_calibration_b209b698">Schlafzahlen, HR-Zonen, Laden &amp; Kalibrieren - ein großes, von der Community gesteuertes Update</string>
     <string name="l10n_app_changelog_sleep_fix_for_whoop_4_0_c7a1b13d">Sleep Fix für WHOOP 4.0 + genaue WHOOP 5/MG Schritte</string>
     <string name="l10n_app_changelog_sleep_from_whoop_4_on_more_efe5fd60">Schlaf von WHOOP 4 auf mehr Firmware (Mac)</string>
-    <string name="l10n_app_changelog_sleep_keep_real_nights_when_the_0acb206a">Schlaf: Halten Sie echte Nächte, wenn der Riemen abgeht</string>
+    <string name="l10n_app_changelog_sleep_keep_real_nights_when_the_0acb206a">Schlaf: Halte echte Nächte, wenn der Riemen abgeht</string>
     <string name="l10n_app_changelog_sleep_properly_sorted_and_an_app_f5e348f0">Schlafen, richtig sortiert und eine App, die sich selbst erklärt</string>
     <string name="l10n_app_changelog_sleep_stages_heal_themselves_after_a_e64a730f">Schlafphasen heilen sich nach einer Synchronisierung</string>
     <string name="l10n_app_changelog_sleep_that_was_stuck_in_the_1b6d1307">Schlaf, der im Archiv steckte, kommt zurück</string>
     <string name="l10n_app_changelog_smart_alarm_actually_works_on_android_c9bbf50a">Smart Alarm funktioniert tatsächlich auf Android</string>
-    <string name="l10n_app_changelog_smart_alarm_the_time_you_set_6f5d260e">Smart Alarm: Die Zeit, die Sie einstellen, ist die Zeit, die feuert</string>
+    <string name="l10n_app_changelog_smart_alarm_the_time_you_set_6f5d260e">Smart Alarm: Die Zeit, die du einstellst, ist die Zeit, die feuert</string>
     <string name="l10n_app_changelog_smoother_an_oura_live_hr_fix_e820bfb4">Smoother, ein Oura Live-HR-Fix und ein großer Haufen Verbesserungen</string>
     <string name="l10n_app_changelog_smoother_during_long_history_syncs_mac_b31b616c">Glatter während langer Geschichte Syncs (Mac)</string>
     <string name="l10n_app_changelog_smoother_explore_charts_and_a_clearer_9598655d">Smoother Explore Charts und eine klarere Möglichkeit, einen WHOOP 5.0/MG zu verbinden</string>
     <string name="l10n_app_changelog_spanish_whoop_exports_now_import_6351a8c6">Spanisch WHOOP exportiert jetzt Import</string>
     <string name="l10n_app_changelog_split_sleep_every_block_counted_one_3106596d">Split-Schlaf: jeder Block gezählt, eine Nacht pro Tag</string>
     <string name="l10n_app_changelog_stability_polish_for_v5_7393eaf0">Stabilität &amp; Polnisch für v5</string>
-    <string name="l10n_app_changelog_start_a_workout_from_the_workouts_3c882d79">Starten Sie ein Training über den Workouts-Bildschirm und eine ehrliche Smart-Alarm-Notiz</string>
+    <string name="l10n_app_changelog_start_a_workout_from_the_workouts_3c882d79">Starte ein Training über den Workouts-Bildschirm und eine ehrliche Smart-Alarm-Notiz</string>
     <string name="l10n_app_changelog_stays_connected_in_the_background_a6b0a94e">Bleibt verbunden im Hintergrund</string>
     <string name="l10n_app_changelog_steadier_bluetooth_on_congested_android_phones_699ad7d3">Steadier Bluetooth auf überlasteten Android-Handys</string>
     <string name="l10n_app_changelog_steadier_connections_fixes_and_a_nicer_fe1afd7d">Steadier-Verbindungen, Fixes und eine schönere Schlafansicht</string>
@@ -1314,7 +1314,7 @@
     <string name="l10n_app_changelog_strap_battery_alerts_11f79bda">Warnsignale für Gurtbatterien</string>
     <string name="l10n_app_changelog_strap_log_export_on_mac_a_e15f6b60">Strap-Log-Export auf Mac + Health Monitor Fix</string>
     <string name="l10n_app_changelog_strap_log_stays_off_the_system_b8ce2ff5">Strap-Protokoll bleibt aus dem Systemprotokoll (Android)</string>
-    <string name="l10n_app_changelog_switch_between_your_whoop_4_and_f5036092">Wechseln Sie zwischen Ihrem WHOOP 4 und 5.0 (Mac + Android)</string>
+    <string name="l10n_app_changelog_switch_between_your_whoop_4_and_f5036092">Wechsle zwischen deinem WHOOP 4 und 5.0 (Mac + Android)</string>
     <string name="l10n_app_changelog_switching_between_whoop_straps_now_actually_8428faaa">Wechsel zwischen WHOOP-Bändern jetzt tatsächlich wechselt</string>
     <string name="l10n_app_changelog_sync_diagnostics_surfacing_silently_dropped_history_9fe62836">Sync-Diagnostik: Auftauchen stillschweigend fallen gelassene Geschichte</string>
     <string name="l10n_app_changelog_sync_visibility_a_sharper_stress_timeline_37e1e6d6">Sync Sichtbarkeit + eine schärfere Stress Timeline</string>
@@ -1323,12 +1323,12 @@
     <string name="l10n_app_changelog_the_new_look_everywhere_plus_sleep_5793dddf">Der neue Look überall - plus Schlaf, Anstrengung &amp; Bluetooth Fixes</string>
     <string name="l10n_app_changelog_the_new_today_screen_comes_to_69dfab3d">Der neue Today-Bildschirm kommt für Android</string>
     <string name="l10n_app_changelog_the_smoothness_release_faster_everywhere_plus_baf8a7fc">Die Glattheit Release: schneller überall, plus ein Sleep Memory Fix</string>
-    <string name="l10n_app_changelog_the_test_centre_help_us_fix_af39aa17">Das Testzentrum: Helfen Sie uns, Ihr spezifisches Problem zu beheben</string>
+    <string name="l10n_app_changelog_the_test_centre_help_us_fix_af39aa17">Das Testzentrum: Hilf uns, dein spezifisches Problem zu beheben</string>
     <string name="l10n_app_changelog_tidier_today_gauges_5d1fe894">Tidier Today Messgeräte</string>
     <string name="l10n_app_changelog_tidier_today_hero_strap_renaming_smarter_34493c9c">Tidier Today hero, strap renaming, smarter journal</string>
     <string name="l10n_app_changelog_tidier_workout_names_correct_rest_duration_135cf67f">Tidier Workout Namen, korrekte Ruhedauer</string>
-    <string name="l10n_app_changelog_tidy_your_journal_remove_and_hide_aa1c0b94">Tidy your journal - entfernen und verstecken Sie Fragen</string>
-    <string name="l10n_app_changelog_times_follow_your_12_24_hour_9c552783">Die Zeiten folgen Ihrer 12-/24-Stunden-Einstellung</string>
+    <string name="l10n_app_changelog_tidy_your_journal_remove_and_hide_aa1c0b94">Tidy your journal - entferne und verstecke Fragen</string>
+    <string name="l10n_app_changelog_times_follow_your_12_24_hour_9c552783">Die Zeiten folgen deiner 12-/24-Stunden-Einstellung</string>
     <string name="l10n_app_changelog_today_header_date_fix_west_of_e5e7422d">Heute Header Datum Fix (West-of-UTC)</string>
     <string name="l10n_app_changelog_today_reflects_today_not_stale_imports_1a341a21">Heute spiegelt sich heute (nicht abgestandene Importe)</string>
     <string name="l10n_app_changelog_today_s_effort_goes_live_plus_5f810b61">Heutige Bemühungen gehen live - plus Schlaf &amp; Alarm Ehrlichkeit</string>
@@ -1337,7 +1337,7 @@
     <string name="l10n_app_changelog_today_tiles_no_longer_truncate_their_2959ce81">Heute verkürzen Kacheln ihren Wert nicht mehr (Android)</string>
     <string name="l10n_app_changelog_today_trends_stay_within_their_window_ba2e4c57">Heute bleiben Trends in ihrem Fenster (Mac)</string>
     <string name="l10n_app_changelog_toggle_the_live_hr_dynamic_island_d3bd70cb">Umschalten der Live-HR Dynamic Island</string>
-    <string name="l10n_app_changelog_track_a_workout_manually_2eb43402">Verfolgen Sie ein Workout manuell</string>
+    <string name="l10n_app_changelog_track_a_workout_manually_2eb43402">Verfolge ein Workout manuell</string>
     <string name="l10n_app_changelog_trends_report_explains_its_scores_e338d1ee">Trends Report erklärt seine Ergebnisse</string>
     <string name="l10n_app_changelog_true_battery_a_sync_indicator_and_89037fc3">True battery %, ein Sync-Indikator und HR bei importierten Workouts</string>
     <string name="l10n_app_changelog_two_quick_fixes_the_blue_titanium_4c021d78">Zwei schnelle Korrekturen: das Blue Titanium-Symbol und Mac "Your Cards"</string>
@@ -1345,7 +1345,7 @@
     <string name="l10n_app_changelog_universal_mac_build_iphone_import_fix_363425a0">Universal Mac Build + iPhone Import Fix</string>
     <string name="l10n_app_changelog_update_check_shows_what_s_new_6779c2e3">Update Check zeigt, was neu ist</string>
     <string name="l10n_app_changelog_updates_check_github_again_1e00ced1">Updates überprüfen GitHub erneut</string>
-    <string name="l10n_app_changelog_v5_the_raw_signal_release_noop_c109e3f2">v5 - die Rohsignalfreigabe: NOOP liest das Signal, auf Ihrem Gerät, kostenlos</string>
+    <string name="l10n_app_changelog_v5_the_raw_signal_release_noop_c109e3f2">v5 - die Rohsignalfreigabe: NOOP liest das Signal, auf deinem Gerät, kostenlos</string>
     <string name="l10n_app_changelog_week_in_review_is_honest_about_4c225bd3">Week in Review ist ehrlich über eine halb fertige Woche</string>
     <string name="l10n_app_changelog_whoop_4_0_is_the_supported_16893d9d">WHOOP 4.0 wird vollständig unterstützt</string>
     <string name="l10n_app_changelog_whoop_5_0_history_decoding_comes_a8848386">WHOOP 5.0 Geschichte Decodierung kommt zu Android</string>
@@ -1368,30 +1368,30 @@
     <string name="l10n_app_changelog_workouts_header_layout_fix_phone_fa23fbec">Workouts Header Layout Fix (Telefon)</string>
     <string name="l10n_app_changelog_wrist_alerts_for_incoming_calls_android_9bf80a06">Handgelenkwarnungen für eingehende Anrufe (Android)</string>
     <string name="l10n_app_changelog_wrist_alerts_work_on_android_09e544a9">Handgelenkwarnungen funktionieren auf Android</string>
-    <string name="l10n_app_changelog_your_fitness_age_vitality_body_age_8e9867fb">Ihr Fitnessalter, Vitalität und Körperalter</string>
-    <string name="l10n_app_changelog_your_imported_steps_now_show_on_d79f0b36">Ihre importierten Schritte werden jetzt auf dem Bildschirm Heute angezeigt (Android)</string>
-    <string name="l10n_app_changelog_your_macos_data_is_back_and_e5e3e3bd">Ihre macOS-Daten sind zurück - und voll Französisch</string>
+    <string name="l10n_app_changelog_your_fitness_age_vitality_body_age_8e9867fb">Dein Fitnessalter, Vitalität und Körperalter</string>
+    <string name="l10n_app_changelog_your_imported_steps_now_show_on_d79f0b36">Deine importierten Schritte werden jetzt auf dem Bildschirm Heute angezeigt (Android)</string>
+    <string name="l10n_app_changelog_your_macos_data_is_back_and_e5e3e3bd">Deine macOS-Daten sind zurück - und voll Französisch</string>
     <string name="l10n_app_changelog_your_scores_build_over_a_few_41388c54">Deine Werte werden über mehrere Nächte genauer</string>
     <string name="l10n_app_changelog_your_whole_day_s_heart_rate_e57593f8">Die Herzfrequenz des ganzen Tages, auf dem Armaturenbrett</string>
-    <string name="l10n_app_changelog_your_whoop_journal_in_insights_clearer_88f5e21b">Ihr WHOOP-Journal in Insights, klarere metrische Taps</string>
+    <string name="l10n_app_changelog_your_whoop_journal_in_insights_clearer_88f5e21b">Dein WHOOP-Journal in Insights, klarere metrische Taps</string>
     <string name="l10n_app_root_this_section_is_on_the_way_ca7c4a32">Dieser Abschnitt ist auf dem Weg.</string>
     <string name="l10n_app_root_updates_c76d1807">Updates</string>
     <string name="l10n_coach_screen_coach_b32c9ad3">Coach</string>
     <string name="l10n_compare_screen_remove_title_ddb5361c">%1$s entfernen</string>
     <string name="l10n_components_chunks_chunks_pulled_cec186cf">%1$s Brocken gezogen</string>
-    <string name="l10n_components_decrease_accessibility_df5f1511">Verringern Sie %1$s</string>
+    <string name="l10n_components_decrease_accessibility_df5f1511">Verringere %1$s</string>
     <string name="l10n_components_glowring_fraction_5bcc7cd7">Glühringfraktion</string>
     <string name="l10n_components_glowring_value_ac0e87de">Glühwert</string>
     <string name="l10n_components_increase_accessibility_0949c0e9">%1$s erhöhen</string>
     <string name="l10n_components_ringfill_59cd4fb9">ringFill</string>
     <string name="l10n_connection_help_allow_nearby_devices_f7c74880">Geräte in der Nähe zulassen</string>
-    <string name="l10n_connection_help_charge_it_and_put_it_on_31b04814">Laden Sie es und legen Sie es auf</string>
-    <string name="l10n_connection_help_close_the_official_whoop_app_768d7d17">Schließen Sie die offizielle WHOOP App</string>
-    <string name="l10n_connection_help_try_connecting_now_41769900">Versuchen Sie jetzt das Verbinden</string>
+    <string name="l10n_connection_help_charge_it_and_put_it_on_31b04814">Lade es und lege es auf</string>
+    <string name="l10n_connection_help_close_the_official_whoop_app_768d7d17">Schließe die offizielle WHOOP App</string>
+    <string name="l10n_connection_help_try_connecting_now_41769900">Versuche jetzt das Verbinden</string>
     <string name="l10n_connection_help_turn_bluetooth_on_75868e97">Bluetooth einschalten</string>
     <string name="l10n_connection_help_whoop_5_mg_experimental_109076ae">WHOOP 5 / MG (experimentell)</string>
-    <string name="l10n_connection_help_won_t_connect_run_through_these_cfef82f3">Willst du nicht verbinden? Laufen Sie durch diese</string>
-    <string name="l10n_connection_help_your_strap_is_connected_and_we_8ab98ac6">Ihr gurt ist verbunden und wir versuchen einen experimentellen händedruck, um live zu bringen.</string>
+    <string name="l10n_connection_help_won_t_connect_run_through_these_cfef82f3">Willst du nicht verbinden? Laufe durch diese</string>
+    <string name="l10n_connection_help_your_strap_is_connected_and_we_8ab98ac6">Dein gurt ist verbunden und wir versuchen einen experimentellen händedruck, um live zu bringen.</string>
     <string name="l10n_coupled_screen_day_987b9ced">Tag</string>
     <string name="l10n_devices_screen_delete_all_of_this_device_s_754cde90">Alle Daten dieses Geräts löschen?</string>
     <string name="l10n_devices_screen_device_actions_for_displayname_device_160eb3de">Geräteaktionen für %1$s</string>
@@ -1399,7 +1399,7 @@
     <string name="l10n_devices_screen_getting_your_devices_ready_bd391949">Deine Geräte werden vorbereitet</string>
     <string name="l10n_devices_screen_make_this_your_active_strap_fea6bebd">Zu deinem aktiven Strap machen?</string>
     <string name="l10n_devices_screen_remove_this_device_dd9dbda9">Dieses Gerät entfernen?</string>
-    <string name="l10n_devices_screen_restart_this_strap_50fc481b">Starten Sie dieses Band neu?</string>
+    <string name="l10n_devices_screen_restart_this_strap_50fc481b">Starte dieses Band neu?</string>
     <string name="l10n_fused_record_screen_nothing_to_fuse_yet_30789c4e">Noch nichts zum Zusammenführen</string>
     <string name="l10n_fused_record_screen_your_data_fused_a740fd4a">Deine Daten, zusammengeführt</string>
     <string name="l10n_health_screen_active_energy_2d3288f9">Aktive Energie</string>
@@ -1410,7 +1410,7 @@
     <string name="l10n_health_screen_fitness_age_12383b4a">Fitnessalter</string>
     <string name="l10n_health_screen_health_monitor_c4abc3fc">Gesundheitsmonitor</string>
     <string name="l10n_health_screen_heart_rate_variability_20f0069e">Herzfrequenzvariabilität</string>
-    <string name="l10n_health_screen_it_compares_your_resting_heart_rate_e83e00f5">Es vergleicht Ihre Ruheherzfrequenz und die jüngste Aktivität mit Menschen in Ihrem Alter.</string>
+    <string name="l10n_health_screen_it_compares_your_resting_heart_rate_e83e00f5">Es vergleicht deine Ruheherzfrequenz und die jüngste Aktivität mit Menschen in deinem Alter.</string>
     <string name="l10n_health_screen_label_readout_3f166607">%1$s %2$s</string>
     <string name="l10n_health_screen_raw_spo_ccfe80c1">Rohes SpO2</string>
     <string name="l10n_health_screen_recovery_ea924f72">Erholung</string>
@@ -1427,19 +1427,19 @@
     <string name="l10n_health_screen_vital_signs_e7d9e1b1">Vitalwerte</string>
     <string name="l10n_health_screen_vitality_be320b06">Vitalität</string>
     <string name="l10n_health_screen_vo2max_21214fb6">VO₂max</string>
-    <string name="l10n_health_screen_weight_height_and_waist_add_a_fd2699f5">Gewicht, Höhe und Taille fügen eine VO2max Schätzung hinzu. Sie ändern das Fitness-Zeitalter selbst nicht.</string>
+    <string name="l10n_health_screen_weight_height_and_waist_add_a_fd2699f5">Gewicht, Höhe und Taille fügen eine VO2max Schätzung hinzu. Du änderst das Fitness-Zeitalter selbst nicht.</string>
     <string name="l10n_how_noop_works_screen_how_your_scores_are_computed_1b2d6c30">So werden deine Werte berechnet</string>
     <string name="l10n_how_noop_works_screen_how_your_scores_work_21a0e2be">So funktionieren deine Werte</string>
     <string name="l10n_how_noop_works_screen_how_your_sleep_is_sorted_6a8e82e0">So wird dein Schlaf einsortiert</string>
     <string name="l10n_how_noop_works_screen_what_recording_means_b896c422">Was „Aufnahme“ bedeutet</string>
     <string name="l10n_how_noop_works_screen_where_your_numbers_come_from_e169963a">Woher deine Zahlen kommen</string>
-    <string name="l10n_hrv_snapshot_screen_a_60_second_snapshot_of_your_35f03f7c">Ein 60-Sekunden-Schnappschuss Ihrer Beat-to-Beat-Intervalle (R-R) vom Band, gereinigt</string>
+    <string name="l10n_hrv_snapshot_screen_a_60_second_snapshot_of_your_35f03f7c">Ein 60-Sekunden-Schnappschuss deiner Beat-to-Beat-Intervalle (R-R) vom Band, gereinigt</string>
     <string name="l10n_hrv_snapshot_screen_close_hrv_reading_a29a99a1">HRV-Messung schließen</string>
     <string name="l10n_hrv_snapshot_screen_hrv_reading_a2cf71f3">HRV-Messung</string>
     <string name="l10n_insights_screen_charge_d4e1aee4">Ladung</string>
     <string name="l10n_insights_screen_insights_b4510362">Einblicke</string>
-    <string name="l10n_insights_screen_insights_read_your_journal_and_outcomes_6ec8aaf9">Insights lesen Sie Ihr Tagebuch und Ergebnisse</string>
-    <string name="l10n_insights_screen_pre_filled_from_last_night_tap_ce81097c">Vorgefüllt von gestern Abend. Tippen Sie, um zu bestätigen oder zu ändern.</string>
+    <string name="l10n_insights_screen_insights_read_your_journal_and_outcomes_6ec8aaf9">Insights lesen dein Tagebuch und Ergebnisse</string>
+    <string name="l10n_insights_screen_pre_filled_from_last_night_tap_ce81097c">Vorgefüllt von gestern Abend. Tippe, um zu bestätigen oder zu ändern.</string>
     <string name="l10n_insights_screen_reading_your_journal_and_outcomes_4a59af69">Dein Journal und deine Ergebnisse werden gelesen…</string>
     <string name="l10n_insights_screen_rest_b79e5f48">Ruhe</string>
     <string name="l10n_insights_screen_rhr_04edf9b3">RHR</string>
@@ -1455,7 +1455,7 @@
     <string name="l10n_liquid_primitives_liquidpressscale_7520ddb3">liquidPressScale</string>
     <string name="l10n_live_screen_avg_cdc93143">Ø</string>
     <string name="l10n_live_screen_buzz_edbd47b2">Buzz</string>
-    <string name="l10n_live_screen_can_t_connect_your_strap_s_cf78be83">Kann nicht verbunden werden - die Paarung Ihres Bandes wurde zurückgesetzt</string>
+    <string name="l10n_live_screen_can_t_connect_your_strap_s_cf78be83">Kann nicht verbunden werden - die Paarung deines Bandes wurde zurückgesetzt</string>
     <string name="l10n_live_screen_charging_5f99fe21">Lädt</string>
     <string name="l10n_live_screen_distance_42320809">Distanz</string>
     <string name="l10n_live_screen_effort_8c974bc6">Anstrengung</string>
@@ -1472,7 +1472,7 @@
     <string name="l10n_live_screen_strap_02b88eeb">Strap</string>
     <string name="l10n_live_screen_take_an_hrv_reading_20ecb2d2">HRV-Messung durchführen</string>
     <string name="l10n_live_screen_w_sport_name_uppercase_e59bc678">● %1$s</string>
-    <string name="l10n_live_screen_whoop_5_0_mg_pairs_with_b93143f2">WHOOP 5.0/MG paart sich mit jeweils einer App. Wenn ein Scan nichts findet, lösen Sie es in</string>
+    <string name="l10n_live_screen_whoop_5_0_mg_pairs_with_b93143f2">WHOOP 5.0/MG paart sich mit jeweils einer App. Wenn ein Scan nichts findet, löse es in</string>
     <string name="l10n_noop_button_noopbutton_scale_1bee88be">NoopButton.scale</string>
     <string name="l10n_noop_button_save_changes_179359b3">Änderungen speichern</string>
     <string name="l10n_noop_motion_countuptext_749c73fb">CountUpText</string>
@@ -1485,7 +1485,7 @@
     <string name="l10n_rhythm_screen_this_is_a_wellness_visualization_not_3409b935">Das ist eine Wellness-Visualisierung, kein Screening-Test. Sie fordert dich nicht auf, ärztlichen Rat zu suchen, und nennt keine Erkrankung. Das ist keine Rechts- oder medizinische Beratung.</string>
     <string name="l10n_rhythm_screen_turn_on_rhythm_2275168c">Rhythmus einschalten</string>
     <string name="l10n_settings_screen_1f_cardopacity_100_toint_51f10397">%1$s%%</string>
-    <string name="l10n_settings_screen_a_standalone_companion_for_your_whoop_7a132b5a">Ein eigenständiger Begleiter für Ihren WHOOP. Alles bleibt auf diesem Telefon: Ihre Geschichte, Ihr Live-Stream, Ihre Zahlen. Nichts wird hochgeladen.</string>
+    <string name="l10n_settings_screen_a_standalone_companion_for_your_whoop_7a132b5a">Ein eigenständiger Begleiter für deinen WHOOP. Alles bleibt auf diesem Telefon: deine Geschichte, dein Live-Stream, deine Zahlen. Nichts wird hochgeladen.</string>
     <string name="l10n_settings_screen_a_transparent_cardiorespiratory_recipe_that_recovers_eebe00c2">Ein transparentes kardiorespiratorisches Rezept, das sich tief und REM besser erholt als das ältere</string>
     <string name="l10n_settings_screen_about_6b21fb79">Über</string>
     <string name="l10n_settings_screen_advanced_4d064726">Erweitert</string>
@@ -1500,7 +1500,7 @@
     <string name="l10n_settings_screen_battery_pct_roundtoint_e02e2891">Batterie %1$s%%</string>
     <string name="l10n_settings_screen_broadcast_heart_rate_d1af1c79">Herzfrequenz senden</string>
     <string name="l10n_settings_screen_broadcast_strap_hr_garmin_ant_a39d0654">Sendeband HR (Garmin/ANT)</string>
-    <string name="l10n_settings_screen_buzz_the_time_on_your_strap_06fc879d">Buzz die Zeit auf Ihrem Gurt</string>
+    <string name="l10n_settings_screen_buzz_the_time_on_your_strap_06fc879d">Buzz die Zeit auf deinem Gurt</string>
     <string name="l10n_settings_screen_cancel_77dfd213">Abbrechen</string>
     <string name="l10n_settings_screen_restore_3cbe6d6b">Wiederherstellen</string>
     <string name="l10n_settings_screen_card_transparency_c5c7b4f3">Kartentransparenz</string>
@@ -1509,7 +1509,7 @@
     <string name="l10n_settings_screen_chart_colours_525f4a37">Diagrammfarben</string>
     <string name="l10n_settings_screen_check_for_updates_736b9062">Nach Updates suchen</string>
     <string name="l10n_settings_screen_checking_820d6004">Wird geprüft…</string>
-    <string name="l10n_settings_screen_checks_github_for_the_latest_version_c10a81e2">Prüft GitHub auf die neueste Version, wenn Sie tippen. Nichts anderes wird verschickt.</string>
+    <string name="l10n_settings_screen_checks_github_for_the_latest_version_c10a81e2">Prüft GitHub auf die neueste Version, wenn du tippst. Nichts anderes wird verschickt.</string>
     <string name="l10n_settings_screen_contact_support_at_support_email_f0c4adce">Kontakt-Support bei %1$s</string>
     <string name="l10n_settings_screen_continuous_hrv_capture_1f0805d8">Kontinuierliche HRV-Erfassung</string>
     <string name="l10n_settings_screen_couldn_t_check_try_again_b3c885d9">Prüfung fehlgeschlagen. Versuch es erneut.</string>
@@ -1527,7 +1527,7 @@
     <string name="l10n_settings_screen_export_raw_log_matched_pair_d65390bf">Roh- und Logarithmusexport (übereinstimmendes Paar)</string>
     <string name="l10n_settings_screen_export_raw_sensor_data_csv_a171b81e">Rohe Sensordaten exportieren (CSV)</string>
     <string name="l10n_settings_screen_extends_the_sky_behind_the_whole_39bb82cc">Erweitert den Himmel hinter dem gesamten Heute-Bildschirm, sodass er bei geringerer Kartentransparenz durch jede Karte hindurchscheint. Erfordert aktivierten Tageszyklus-Hintergrund.</string>
-    <string name="l10n_settings_screen_feel_the_current_time_as_a_8ca41db1">Fühlen Sie die aktuelle Zeit als eine Folge von Summen (#460). Tut nichts, es sei denn, Ihr Gurt ist angeschlossen.</string>
+    <string name="l10n_settings_screen_feel_the_current_time_as_a_8ca41db1">Fühle die aktuelle Zeit als eine Folge von Summen (#460). Tut nichts, es sei denn, dein Gurt ist angeschlossen.</string>
     <string name="l10n_settings_screen_flags_accepted_but_the_enable_sequence_542b2595">Flags akzeptiert, aber die Aktivierungssequenz startet keinen separaten Live-Stream. Die Deep-Datensätze kommen als Teil der normalen Verlaufssynchronisierung an (#494).</string>
     <string name="l10n_settings_screen_for_a_whoop_4_0_which_df865854">Für ein WHOOP 4.0, das keine Schrittzahl sendet: NOOP schätzt Schritte aus Bewegung, kalibriert an deinem Telefon. Tippe, um zu sehen, wie nah es dran ist, und passe es an.</string>
     <string name="l10n_settings_screen_github_code_releases_issues_and_the_50b41e25">GitHub: Code, Releases, Issues und das Wiki.</string>
@@ -1541,21 +1541,21 @@
     <string name="l10n_settings_screen_icon_716f63b9">Icon</string>
     <string name="l10n_settings_screen_illness_heads_up_97e10035">Krankheit Heads-up</string>
     <string name="l10n_settings_screen_import_4834caf8">Importieren…</string>
-    <string name="l10n_settings_screen_importing_overwrites_everything_currently_on_this_297b76ae">Importieren überschreibt alles, was sich derzeit auf diesem Telefon befindet. Ihre alten Daten werden nur für den Fall in einer Seitendatei gespeichert. NOOP benötigt einen Relaunch, damit ein Import in Kraft treten kann.</string>
-    <string name="l10n_settings_screen_keep_connected_in_the_background_44499d45">Bleiben Sie im Hintergrund verbunden</string>
-    <string name="l10n_settings_screen_keep_noop_alive_overnight_e43b2fba">Halten Sie NOOP über Nacht lebendig</string>
+    <string name="l10n_settings_screen_importing_overwrites_everything_currently_on_this_297b76ae">Importieren überschreibt alles, was sich derzeit auf diesem Telefon befindet. Deine alten Daten werden nur für den Fall in einer Seitendatei gespeichert. NOOP benötigt einen Relaunch, damit ein Import in Kraft treten kann.</string>
+    <string name="l10n_settings_screen_keep_connected_in_the_background_44499d45">Bleibe im Hintergrund verbunden</string>
+    <string name="l10n_settings_screen_keep_noop_alive_overnight_e43b2fba">Halte NOOP über Nacht lebendig</string>
     <string name="l10n_settings_screen_allow_3ad0e369">Zulassen</string>
     <string name="l10n_settings_screen_keep_screen_on_during_a_workout_42d27284">Bildschirm während eines Workouts anlassen</string>
-    <string name="l10n_settings_screen_keeps_streaming_from_your_strap_with_d31b4af9">Behält das Streaming von Ihrem Band mit einer laufenden Benachrichtigung, auch nachdem Sie NOOP geschlossen haben. Schalten Sie die Verbindung aus, wenn die App geschlossen ist.</string>
-    <string name="l10n_settings_screen_keeps_the_detailed_beat_to_beat_87b78edd">Läuft den detaillierten Beat-to-Beat-Stream Tag und Nacht, nicht nur während ein Live-Bildschirm geöffnet ist, so dass NOOP viel mehr für HRV über Nacht, Erholung und Schlaf einfängt. Verwendet mehr Batterie (Ihr Band streamt die Herzfrequenz kontinuierlich). Benötigt "Im Hintergrund verbunden bleiben" auf.</string>
+    <string name="l10n_settings_screen_keeps_streaming_from_your_strap_with_d31b4af9">Behält das Streaming von deinem Band mit einer laufenden Benachrichtigung, auch nachdem du NOOP geschlossen hast. Schalte die Verbindung aus, wenn die App geschlossen ist.</string>
+    <string name="l10n_settings_screen_keeps_the_detailed_beat_to_beat_87b78edd">Läuft den detaillierten Beat-to-Beat-Stream Tag und Nacht, nicht nur während ein Live-Bildschirm geöffnet ist, so dass NOOP viel mehr für HRV über Nacht, Erholung und Schlaf einfängt. Verwendet mehr Batterie (dein Band streamt die Herzfrequenz kontinuierlich). Benötigt "Im Hintergrund verbunden bleiben" auf.</string>
     <string name="l10n_settings_screen_live_deeppacketsthissession_type_0x2f_historical_offload_8fef3d84">%1$s Typ-0x2F historischer-Offload-Frame (s) außerhalb unserer Synchronisierung gesehen. Dies sind Geschichte (z. B. eine andere App, die den Bandbestand zieht), kein Live-R22-Stream (#494).</string>
     <string name="l10n_settings_screen_live_sessions_beta_2ca3a97f">Live Sessions (Beta)</string>
-    <string name="l10n_settings_screen_makes_your_whoop_5_0_mg_b26b94c7">Bringt Ihr WHOOP 5.0/MG dazu, seine Herzfrequenz als Standard-Bluetooth-HR-Sensor zu bewerben, so dass ein Garmin (Edge / Watch), Zwift oder Fitnessgeräte es während eines Trainings verwenden können. Auf die nächste Verbindung angewendet (und sofort, wenn verbunden); schreibt das Flag whoop live hr in adv ind pkt des Bandes. Reversibel. 5/MG.</string>
+    <string name="l10n_settings_screen_makes_your_whoop_5_0_mg_b26b94c7">Bringt deinen WHOOP 5.0/MG dazu, seine Herzfrequenz als Standard-Bluetooth-HR-Sensor zu bewerben, so dass ein Garmin (Edge / Watch), Zwift oder Fitnessgeräte es während eines Trainings verwenden können. Auf die nächste Verbindung angewendet (und sofort, wenn verbunden); schreibt das Flag whoop live hr in adv ind pkt des Bandes. Reversibel. 5/MG.</string>
     <string name="l10n_settings_screen_max_heart_rate_3d4ed858">Maximale Herzfrequenz</string>
     <string name="l10n_settings_screen_measurement_system_701d765d">Maßsystem</string>
     <string name="l10n_settings_screen_motion_aware_wake_refinement_67a91e47">Motion-Aware Wake Verfeinerung</string>
     <string name="l10n_settings_screen_noop_is_not_a_medical_device_ab32ef7e">NOOP ist kein medizinisches Gerät. Es dient nur zu Informations- und persönlichen Erkenntniszwecken und ist nicht dazu bestimmt, Erkrankungen zu diagnostizieren, zu behandeln, zu heilen oder zu verhindern. Wende dich für medizinischen Rat an eine Fachperson.</string>
-    <string name="l10n_settings_screen_offer_a_breath_automatically_6c709dee">Bieten Sie automatisch einen Atemzug</string>
+    <string name="l10n_settings_screen_offer_a_breath_automatically_6c709dee">Biete automatisch einen Atemzug</string>
     <string name="l10n_settings_screen_on_a_5_mg_connection_noop_4557c8f8">Bei einer 5/MG-Verbindung sendet NOOP nach dem Handshake eine Puffin-Echtzeitstream-Anfrage und protokolliert die Antwort. Wenn du einen 5/MG-Strap hast, hilft das Aktivieren und Teilen deines Strap-Protokolls, das Protokoll zu kartieren. Keine Auswirkung auf WHOOP 4.0.</string>
     <string name="l10n_settings_screen_open_source_ble_reverse_engineering_work_40062271">Open-Source-BLE-Reverse-Engineering-Arbeit. Danke.</string>
     <string name="l10n_settings_screen_open_test_centre_a7fbe4e9">Testzentrum öffnen</string>
@@ -1571,15 +1571,15 @@
     <string name="l10n_settings_screen_recent_changes_and_what_to_expect_3ceb660b">Jüngste Veränderungen und was zu erwarten ist</string>
     <string name="l10n_settings_screen_record_5_mg_raw_capture_9354fe89">Rekord 5/MG Rohabfang</string>
     <string name="l10n_settings_screen_record_5_mg_raw_capture_research_1d966bbf">Rekord 5/MG Rohabscheidung (Forschung)</string>
-    <string name="l10n_settings_screen_records_the_raw_frames_of_each_98a284df">Zeichnet die rohen Frames jeder 5/MG-Historie auf, die mit einer Datei auf diesem Telefon synchronisiert wird, so dass Sie sie teilen können und NOOP dabei helfen können, 5/MG-Schlaf, Erholung und Belastung zu entschlüsseln. Die Datei enthält rohe biometrische Frames (Herzfrequenz, R-R, Hauttemperatur, Bewegung) und den eigenen Diagnosetext des Bandes. Nichts verlässt das Telefon, es sei denn, Sie teilen es. Standardmäßig ausgeschaltet.</string>
+    <string name="l10n_settings_screen_records_the_raw_frames_of_each_98a284df">Zeichnet die rohen Frames jeder 5/MG-Historie auf, die mit einer Datei auf diesem Telefon synchronisiert wird, so dass du sie teilen kannst und NOOP dabei helfen kannst, 5/MG-Schlaf, Erholung und Belastung zu entschlüsseln. Die Datei enthält rohe biometrische Frames (Herzfrequenz, R-R, Hauttemperatur, Bewegung) und den eigenen Diagnosetext des Bandes. Nichts verlässt das Telefon, es sei denn, du teilst es. Standardmäßig ausgeschaltet.</string>
     <string name="l10n_settings_screen_remove_photo_c8f5eda8">Foto entfernen</string>
     <string name="l10n_settings_screen_rename_d3f4cb89">Umbenennen</string>
-    <string name="l10n_settings_screen_rename_your_strap_s_bluetooth_name_6032668b">Benennen Sie den Bluetooth-Namen Ihres Gurts um, der für ein Second-Hand-Band nützlich ist. Das Gurtband</string>
+    <string name="l10n_settings_screen_rename_your_strap_s_bluetooth_name_6032668b">Benenne den Bluetooth-Namen deines Gurts um, der für ein Second-Hand-Band nützlich ist. Das Gurtband</string>
     <string name="l10n_settings_screen_restarts_the_roughly_4_night_build_84f9f8d0">Startet den etwa 4-nächtigen Aufbau für Ladung und deine HRV-Basislinie ab heute Nacht neu. Nutze es, wenn eine schlechte erste Woche deine Basislinie verzerrt hat. Dein Verlauf bleibt.</string>
     <string name="l10n_settings_screen_reviews_each_scored_wake_block_for_537924ea">Rezensiert jeden bewerteten Wake-Block auf echte Beweise für das Aufstehen (Walking Cadence, a)</string>
     <string name="l10n_settings_screen_rhythm_experimental_12d357da">Rhythmus (experimentell)</string>
-    <string name="l10n_settings_screen_runs_the_continuous_hrv_stream_only_3fed47c5">Läuft den kontinuierlichen HRV-Stream nur während Ihres ruhigen Stundenfensters (standardmäßig 22:00-07:00 Uhr) aus und halbiert damit die Batteriekosten. Tagesstresswerte werden sparsamer sein.</string>
-    <string name="l10n_settings_screen_saves_the_last_24h_of_decoded_f7026f47">Speichert die letzten 24 Stunden dekodierter Sensorproben (Herzfrequenz, R-R, Bewegung, Schritte und alle 5 / MG tiefen Ströme, die Sie freigeschaltet haben) als einen CSV, den Sie teilen können, um mit Ihren eigenen Daten zu basteln. Nichts verlässt das Telefon, es sei denn, Sie teilen es.</string>
+    <string name="l10n_settings_screen_runs_the_continuous_hrv_stream_only_3fed47c5">Läuft den kontinuierlichen HRV-Stream nur während deines ruhigen Stundenfensters (standardmäßig 22:00-07:00 Uhr) aus und halbiert damit die Batteriekosten. Tagesstresswerte werden sparsamer sein.</string>
+    <string name="l10n_settings_screen_saves_the_last_24h_of_decoded_f7026f47">Speichert die letzten 24 Stunden dekodierter Sensorproben (Herzfrequenz, R-R, Bewegung, Schritte und alle 5 / MG tiefen Ströme, die du freigeschaltet hast) als einen CSV, den du teilen kannst, um mit deinen eigenen Daten zu basteln. Nichts verlässt das Telefon, es sei denn, du teilst es.</string>
     <string name="l10n_settings_screen_send_enable_sequence_to_strap_04ff8a22">Aktivierungssequenz an den Strap senden</string>
     <string name="l10n_settings_screen_set_up_automatic_backups_00b4780c">Automatische Backups einrichten</string>
     <string name="l10n_settings_screen_settings_c7f73bb5">Einstellungen</string>
@@ -1592,7 +1592,7 @@
     <string name="l10n_settings_screen_sleep_sorting_scores_recording_and_where_832378b5">Schlaf-Einsortierung, Werte, Aufzeichnung und woher deine Zahlen kommen.</string>
     <string name="l10n_settings_screen_sleep_staging_v2_3a007e4a">Schlafstadien V2</string>
     <string name="l10n_settings_screen_sleep_staging_v2_a4176770">Schlafstadien (V2)</string>
-    <string name="l10n_settings_screen_some_phones_also_need_auto_start_79b7147b">Einige Telefone benötigen auch Autostart aktiviert - öffnen Sie diesen Bildschirm</string>
+    <string name="l10n_settings_screen_some_phones_also_need_auto_start_79b7147b">Einige Telefone benötigen auch Autostart aktiviert - öffne diesen Bildschirm</string>
     <string name="l10n_settings_screen_step_calibration_351c09bf">Schritt-Kalibrierung</string>
     <string name="l10n_settings_screen_steps_estimate_calibration_stepssummary_opens_the_d6fbf995">Schritte schätzen die Kalibrierung. %1$s. Öffnet den Kalibrierbildschirm.</string>
     <string name="l10n_settings_screen_steps_estimate_ce7a604d">Schritte-Schätzung</string>
@@ -1603,7 +1603,7 @@
     <string name="l10n_settings_screen_temperature_0a9062a9">Temperatur</string>
     <string name="l10n_settings_screen_test_centre_37b36828">Testzentrum</string>
     <string name="l10n_settings_screen_theme_a797e309">Design</string>
-    <string name="l10n_settings_screen_this_is_a_plain_unencrypted_archive_b0dfe63d">Das ist ein einfaches, unverschlüsseltes Archiv — wer die Datei bekommt, kann sie mit jedem Zip-Programm öffnen. Bewahren Sie sie an einem Ort auf, dem Sie vertrauen.</string>
+    <string name="l10n_settings_screen_this_is_a_plain_unencrypted_archive_b0dfe63d">Das ist ein einfaches, unverschlüsseltes Archiv — wer die Datei bekommt, kann sie mit jedem Zip-Programm öffnen. Bewahre sie an einem Ort auf, dem du vertraust.</string>
     <string name="l10n_settings_screen_this_restarts_the_roughly_4_night_c610a93d">Das startet den etwa 4-nächtigen Aufbau für Ladung und deine HRV-Basislinie neu. Dein Verlauf bleibt. Nutze es, wenn eine schlechte erste Woche, etwa krank getragen, deine Basislinie verzerrt hat.</string>
     <string name="l10n_settings_screen_trend_charts_19085c81">Trenddiagramme</string>
     <string name="l10n_settings_screen_try_history_sync_without_pairing_experimental_54c31ea2">Verlaufssynchronisierung ohne Kopplung versuchen (experimentell)</string>
@@ -1611,20 +1611,20 @@
     <string name="l10n_settings_screen_try_whoop_5_mg_protocol_probes_1d584653">WHOOP 5/MG-Protokolltests ausprobieren</string>
     <string name="l10n_settings_screen_units_12748281">Einheiten</string>
     <string name="l10n_settings_screen_unlock_whoop_5_mg_deep_data_2f2bd226">WHOOP-5/MG-Tiefendaten freischalten (R22)</string>
-    <string name="l10n_settings_screen_unlock_whoop_5_mg_deep_data_70036ca8">Entsperren Sie WHOOP 5/MG Deep Data</string>
+    <string name="l10n_settings_screen_unlock_whoop_5_mg_deep_data_70036ca8">Entsperre WHOOP 5/MG Deep Data</string>
     <string name="l10n_settings_screen_version_avail_version_is_available_5b401bd4">Version %1$s verfügbar</string>
     <string name="l10n_settings_screen_waist_optional_d5356703">Taille (optional)</string>
     <string name="l10n_settings_screen_weight_69c0b815">Gewicht</string>
     <string name="l10n_settings_screen_what_each_strap_can_read_and_51e7d3fc">Was jedes Band lesen kann und warum sich einige Merkmale unterscheiden.</string>
     <string name="l10n_settings_screen_what_s_new_4d8dc5fe">Was ist neu</string>
     <string name="l10n_settings_screen_what_s_new_in_noop_appchangelog_d26fb453">Was ist neu in NOOP %1$s</string>
-    <string name="l10n_settings_screen_whole_night_is_noop_s_default_fbfff434">Die ganze Nacht ist das Standardmaß von NOOP; Deep Sleep Pools HRV nur über Slow Wave Sleep, lesen niedriger und passend zu WHOOP. Durch das Umschalten werden Ihre letzten Nächte über das neue Fenster neu bewertet und sofort wirksam, sobald Sie ein paar Nächte Daten haben.</string>
+    <string name="l10n_settings_screen_whole_night_is_noop_s_default_fbfff434">Die ganze Nacht ist das Standardmaß von NOOP; Deep Sleep Pools HRV nur über Slow Wave Sleep, lesen niedriger und passend zu WHOOP. Durch das Umschalten werden deine letzten Nächte über das neue Fenster neu bewertet und sofort wirksam, sobald du ein paar Nächte Daten hast.</string>
     <string name="l10n_settings_screen_whoop_4_0_versus_5_0_a54c5504">WHOOP 4.0 versus 5.0: Was jeder lesen kann und warum</string>
     <string name="l10n_settings_screen_whoop_4_0_vs_5_0_2babb05a">WHOOP 4.0 vs. 5.0/MG</string>
-    <string name="l10n_settings_screen_whoop_5_mg_straps_hand_a_b8b239e6">WHOOP 5/MG Armbänder geben eine neue App nur Live-Herzfrequenz. Die offizielle App schaltet die tieferen Streams (high-rate HR + Motion + History) ein, indem sie eine Reihe von Feature-Flags schreibt, eine Sequenz, die zwei unabhängige Projekte dokumentiert haben. Wenn dies eingeschaltet ist, sendet der Button unten genau diese Sequenz an Ihren Riemen. Im gegensatz zu allem anderen hier schreibt es auf das band, aber es ist reversibel (es ändert sich nur, welche daten das band aussendet) und ist das gleiche, was die offizielle app tut. Experimentell: Es kann nichts auf Ihrer Firmware tun.</string>
+    <string name="l10n_settings_screen_whoop_5_mg_straps_hand_a_b8b239e6">WHOOP 5/MG Armbänder geben eine neue App nur Live-Herzfrequenz. Die offizielle App schaltet die tieferen Streams (high-rate HR + Motion + History) ein, indem sie eine Reihe von Feature-Flags schreibt, eine Sequenz, die zwei unabhängige Projekte dokumentiert haben. Wenn dies eingeschaltet ist, sendet der Button unten genau diese Sequenz an deinen Riemen. Im gegensatz zu allem anderen hier schreibt es auf das band, aber es ist reversibel (es ändert sich nur, welche daten das band aussendet) und ist das gleiche, was die offizielle app tut. Experimentell: Es kann nichts auf deiner Firmware tun.</string>
     <string name="l10n_settings_screen_whoop_a3650379">WHOOP</string>
     <string name="l10n_settings_screen_working_13b7bfca">Arbeite…</string>
-    <string name="l10n_settings_screen_you_re_on_the_latest_r_027a82be">Sie sind auf dem neuesten Stand (%1$s).</string>
+    <string name="l10n_settings_screen_you_re_on_the_latest_r_027a82be">Du bist auf dem neuesten Stand (%1$s).</string>
     <string name="l10n_skin_temp_cards_screen_a_period_is_likely_between_prettyday_bc501b32">Ein Zeitraum ist wahrscheinlich zwischen %1$s und</string>
     <string name="l10n_skin_temp_cards_screen_day_1_bright_light_clockstring_firstday_43b5fe87">Tag 1: helles Licht %1$s -</string>
     <string name="l10n_skin_temp_cards_screen_estimated_body_clock_low_around_clockstring_fb0f0790">Geschätzte Körperuhr niedrig um %1$s</string>
@@ -1639,7 +1639,7 @@
     <string name="l10n_sleep_screen_save_efc007a3">Speichern</string>
     <string name="l10n_sleep_screen_daytime_sleep_871c03ca">TÄGLICHER SCHLAF</string>
     <string name="l10n_sleep_screen_delete_f6fdbe48">Löschen</string>
-    <string name="l10n_sleep_screen_delete_this_sleep_session_6932e931">Löschen Sie diese Schlafsitzung</string>
+    <string name="l10n_sleep_screen_delete_this_sleep_session_6932e931">Lösche diese Schlafsitzung</string>
     <string name="l10n_sleep_screen_delete_this_sleep_session_c347b909">Diese Schlafsitzung löschen?</string>
     <string name="l10n_sleep_screen_deleted_sleep_window_range_7bc5f027">%1$s – %2$s</string>
     <string name="l10n_sleep_screen_deleted_sleep_windows_46fea77a">Gelöschte Schlafzeiträume</string>
@@ -1652,7 +1652,7 @@
     <string name="l10n_sleep_screen_if_this_sleep_came_only_from_d0892088">Wenn dieser Schlaf nur aus einem Import stammt und keine Rohdaten gespeichert sind, wird er möglicherweise nicht wieder angezeigt.</string>
     <string name="l10n_sleep_screen_maybe_later_27ad1d83">Vielleicht später</string>
     <string name="l10n_sleep_screen_move_anyway_19ee824d">Bewegt euch sowieso</string>
-    <string name="l10n_sleep_screen_move_this_sleep_438dd3b5">Bewegen Sie diesen Schlaf?</string>
+    <string name="l10n_sleep_screen_move_this_sleep_438dd3b5">Bewege diesen Schlaf?</string>
     <string name="l10n_sleep_screen_naps_2f83e350">Nickerchen</string>
     <string name="l10n_sleep_screen_next_night_7deeb06b">Nächste Nacht</string>
     <string name="l10n_sleep_screen_no_earlier_night_stored_yet_earlier_ab637d4c">Noch keine frühere Nacht gespeichert. Frühere Nächte synchronisieren am Morgen.</string>
@@ -1669,19 +1669,19 @@
     <string name="l10n_sleep_screen_sleep_detection_reran_using_the_data_01757aad">Die Schlaferkennung wurde mit den für diese Nacht verfügbaren Daten erneut ausgeführt.</string>
     <string name="l10n_sleep_screen_stage_breakdown_e9b714f9">Phasen-Aufschlüsselung</string>
     <string name="l10n_sleep_screen_this_moves_the_night_to_a_fac2fb46">Dies bewegt die Nacht zu einer Zeit ohne aufgezeichnete Daten. Stufen können dort nicht abgeleitet werden, so dass sie als leer angezeigt werden können, bis die Daten sie abdecken.</string>
-    <string name="l10n_sleep_screen_your_night_data_is_in_logging_ec461720">Ihre nachtdaten sind in. Protokollieren, wie Sie sich gefühlt haben, hilft NOOP zu lernen, was Ihre beste Genesung antreibt.</string>
+    <string name="l10n_sleep_screen_your_night_data_is_in_logging_ec461720">Deine nachtdaten sind in. Protokolliere, wie du dich gefühlt hast, hilft NOOP zu lernen, was deine beste Genesung antreibt.</string>
     <string name="l10n_stress_screen_autonomic_balance_lf_hf_776cb6f7">Autonome Balance (LF/HF)</string>
     <string name="l10n_stress_screen_avg_a178769d">avg</string>
     <string name="l10n_stress_screen_baevsky_stress_index_296cf7c0">Baevsky-Stressindex</string>
     <string name="l10n_stress_screen_daily_0_3_proxy_63247929">Täglich 0-3 Proxy</string>
     <string name="l10n_stress_screen_hf_power_3a9fd8c9">HF-Leistung</string>
-    <string name="l10n_stress_screen_not_enough_recent_days_to_chart_c072bade">Noch nicht genug Tage, um einen Trend zu erkennen. Tragen Sie Ihren Riemen, um ihn zu bevölkern.</string>
+    <string name="l10n_stress_screen_not_enough_recent_days_to_chart_c072bade">Noch nicht genug Tage, um einen Trend zu erkennen. Trage deinen Riemen, um ihn zu bevölkern.</string>
     <string name="l10n_stress_screen_of_3_46203495">von 3</string>
     <string name="l10n_stress_screen_on_demand_today_s_r_r_17d716e1">auf Abruf · heutige R-R</string>
     <string name="l10n_stress_screen_on_the_0_3_autonomic_load_8a0d5107">auf der Skala 0-3 autonome Last</string>
-    <string name="l10n_stress_screen_the_line_traces_your_autonomic_load_804f4028">Die Linie verfolgt Ihre autonome Last über den wachen Tag, erzielt</string>
+    <string name="l10n_stress_screen_the_line_traces_your_autonomic_load_804f4028">Die Linie verfolgt deine autonome Last über den wachen Tag, erzielt</string>
     <string name="l10n_stress_screen_these_are_extra_on_demand_hrv_9303f1de">Das sind zusätzliche HRV-Blickwinkel auf Abruf, berechnet aus den heutigen R-R-Intervallen. Sie sind informativ und ändern den Stresswert oben nicht.</string>
-    <string name="l10n_stress_screen_we_compare_today_s_resting_heart_a9cd0955">Wir vergleichen die heutige Ruheherzfrequenz und HRV mit Ihrer eigenen 30-tägigen</string>
+    <string name="l10n_stress_screen_we_compare_today_s_resting_heart_a9cd0955">Wir vergleichen die heutige Ruheherzfrequenz und HRV mit deiner eigenen 30-tägigen</string>
     <string name="l10n_test_centre_screen_bug_report_5a7ee5ac">Fehlerbericht</string>
     <string name="l10n_today_screen_arrange_cfdd099c">Anordnung</string>
     <string name="l10n_today_screen_arrange_today_sections_9675862b">Heute Abschnitte arrangieren</string>
@@ -1693,10 +1693,10 @@
     <string name="l10n_today_screen_choose_which_tiles_show_on_your_a4e3acfb">Wähle, welche Kacheln in deinem Kontrollzentrum erscheinen, und ordne sie mit den Pfeilen neu.</string>
     <string name="l10n_today_screen_data_label_data_value_data_unit_27f6fd6b">%1$s %2$s %3$s</string>
     <string name="l10n_today_screen_data_unit_c768ef8c">%1$s</string>
-    <string name="l10n_today_screen_daytitle_humandate_tap_to_pick_a_7e12ce96">%1$s, %2$s. Tippen Sie, um einen Tag auszuwählen, wischen Sie, um den Tag zu ändern.</string>
+    <string name="l10n_today_screen_daytitle_humandate_tap_to_pick_a_7e12ce96">%1$s, %2$s. Tippe, um einen Tag auszuwählen, wische, um den Tag zu ändern.</string>
     <string name="l10n_today_screen_detailed_tiles_0801721b">Detaillierte Fliesen</string>
     <string name="l10n_today_screen_dismiss_to_updates_2c7915b8">In „Updates“ ablegen</string>
-    <string name="l10n_today_screen_each_line_is_how_many_points_dec2c062">Jede Zeile gibt an, wie viele Punkte bewegte Ladung im Vergleich zu sitzen an Ihrem</string>
+    <string name="l10n_today_screen_each_line_is_how_many_points_dec2c062">Jede Zeile gibt an, wie viele Punkte bewegte Ladung im Vergleich zu sitzen an deinem</string>
     <string name="l10n_today_screen_edit_5301648d">Bearbeiten</string>
     <string name="l10n_today_screen_edit_key_metrics_f95e61a4">Kennzahlen bearbeiten</string>
     <string name="l10n_today_screen_heart_rate_variability_a137586d">Herzfrequenzvariabilität</string>
@@ -1728,7 +1728,7 @@
     <string name="l10n_today_screen_steps_cdde4f20">Schritte</string>
     <string name="l10n_today_screen_strain_79fe380e">Belastung</string>
     <string name="l10n_today_screen_synced_from_2aa7258b">Synchronisiert aus</string>
-    <string name="l10n_today_screen_synthesis_876bc749">SYNTHESE</string>
+    <string name="l10n_today_screen_synthesis_876bc749">ZUSAMMENFASSUNG</string>
     <string name="l10n_today_screen_unitformatter_effortdisplay_strain_effortscale_effort_53dbd951">%1$s Anstrengung</string>
     <string name="l10n_today_screen_value_bpm_8f3a90c3">%1$s bpm</string>
     <string name="l10n_today_screen_visavg_8c9a4746">%1$s</string>
@@ -1742,7 +1742,7 @@
     <string name="l10n_trends_explore_screen_resting_hr_26677094">Ruhe-HF</string>
     <string name="l10n_trends_explore_screen_sleep_3cac34e6">Schlaf</string>
     <string name="l10n_trends_explore_screen_sleep_efficiency_b4b5c293">Schlafeffizienz</string>
-    <string name="l10n_trends_report_a_clean_shareable_one_page_pdf_a3c4f889">Ein sauberes, teilbares, einseitiges PDF Ihrer Genesung, Schlaf, HRV, Ruheherzfrequenz</string>
+    <string name="l10n_trends_report_a_clean_shareable_one_page_pdf_a3c4f889">Ein sauberes, teilbares, einseitiges PDF deiner Genesung, Schlaf, HRV, Ruheherzfrequenz</string>
     <string name="l10n_trends_report_export_pdf_3dd7d56a">PDF exportieren</string>
     <string name="l10n_trends_report_the_share_sheet_can_save_the_ecddbca7">Das Sharesheet kann das PDF in Dateien speichern oder es weiterleiten.</string>
     <string name="l10n_trends_report_trends_report_pdf_481e8a5f">Trends Report (PDF)</string>
@@ -1750,7 +1750,7 @@
     <string name="l10n_weekly_digest_card_digest_dayswithdata_of_7_days_had_8068f0ee">%1$s von 7 Tagen hatte diese Woche Daten</string>
     <string name="l10n_weekly_digest_card_informational_only_not_medical_advice_593feb77">Nur zur Information, kein medizinischer Rat.</string>
     <string name="l10n_weekly_digest_card_sleep_steadiness_rest_varied_fmt1_sd_44997f21">Schlafstabilität: Ruhe variiert ±%1$s pts von Nacht zu Nacht.</string>
-    <string name="l10n_wheel_picker_accessibility_tap_to_choose_1314c4ed">%1$s. Tippen Sie, um zu wählen.</string>
+    <string name="l10n_wheel_picker_accessibility_tap_to_choose_1314c4ed">%1$s. Tippe, um zu wählen.</string>
     <string name="l10n_workouts_screen_minutes_total_100_roundtoint_5bb7c6d8">%1$s%%</string>
     <!-- #453 manually migrated complex Kotlin templates. -->
     <string name="intervals_range_step">%1$s – %2$s%3$s · Schritt %4$d</string>
@@ -2735,13 +2735,13 @@
     <string name="coach_brief_widget_enable">Aktiviere den Morgenbrief in den Coach-Einstellungen, um die heutige Bereitschaft hier zu sehen.</string>
     <string name="coach_voice_error_no_speech">Keine Sprache erkannt.</string>
     <string name="coach_voice_error_audio">Audioaufnahme fehlgeschlagen.</string>
-    <string name="coach_voice_error_busy">Spracherkennung ist beschäftigt. Versuchen Sie es erneut.</string>
+    <string name="coach_voice_error_busy">Spracherkennung ist beschäftigt. Versuche es erneut.</string>
     <string name="coach_voice_error_permission">Mikrofonberechtigung verweigert.</string>
-    <string name="coach_voice_error_generic">Spracheingabe fehlgeschlagen. Versuchen Sie es erneut.</string>
+    <string name="coach_voice_error_generic">Spracheingabe fehlgeschlagen. Versuche es erneut.</string>
     <string name="coach_voice_error_server">On-Device-Spracherkennung für diese Sprache nicht verfügbar.</string>
     <string name="coach_voice_error_unavailable">On-Device-Spracherkennung ist auf diesem Gerät oder für diese Sprache nicht verfügbar.</string>
     <string name="coach_voice_unavailable">On-Device-Spracherkennung ist auf diesem Gerät oder für diese Sprache nicht verfügbar.</string>
-    <string name="coach_voice_permission_denied">Mikrofonberechtigung verweigert. Aktivieren Sie sie in den Einstellungen, um die Spracheingabe zu nutzen.</string>
+    <string name="coach_voice_permission_denied">Mikrofonberechtigung verweigert. Aktiviere sie in den Einstellungen, um die Spracheingabe zu nutzen.</string>
     <string name="units_settings_blurb">Wähle Einheiten für Körpermaße und Trainingsdistanz separat. Deine Daten werden immer gleich gespeichert; diese Einstellungen ändern nur die Anzeige.</string>
     <string name="units_body_measurements">Körpermaße</string>
     <string name="units_exercise_distance_pace">Trainingsdistanz &amp; Tempo</string>

From 965e5dc89e29082d0e2b280ea3722512e084e6cd Mon Sep 17 00:00:00 2001
From: Bernd Helm <bhelm@users.noreply.github.com>
Date: Mon, 7 Sep 2026 00:05:11 +0200
Subject: [PATCH 294/333] sleep: close the final HR/HRV window on the shipped
 stager path

Follow-up to the closed-window rule, moved to the code that ships it.

That earlier change closed the final five-minute bin in RecoveryScorer.restingHR
and recoveryIndexSlope, and those two helpers have no production caller. The
resting HR and HRV windows the apps actually display come from
SleepStager.sessionRestingHR and sessionHrvWindows, and they carried the same
defect: a closed [start, end] prefilter over [t, t + 300) bins with a loop
stopping at end, so a sample or beat sitting exactly on an aligned end is
admitted by the prefilter and then lands in no bin.

Part one applies the rule where it counts. The final bin closes on end on both
platforms; a zero-length window is that single closed bin. Window startTs, the
stage-tagging centre and the RMSSD math are unchanged.

Part two removes the dead helpers, their tests and the four constants only they
used, after a repo-wide grep found no production or public consumer. The
recoveryIndexSlope PARAMETER of recovery() stays, since it is a caller-supplied
input. ANALYTICS.md now documents the endpoint rule beside the shipped code;
LIBRARY.md drops the removed helper.

Because these functions ship, this can move a displayed number: per-session
restingHR and avgHRV on a night whose session length is an exact multiple of
300s with a sample on the end. Stored rows keep their value until that night is
re-scored, and no migration is needed.

Verified on review rather than taken on trust. Modelling the old and new binning
over 60,000 random window and sample configurations produced zero differences on
any span not aligned to 300s and zero when the segment is empty, so the change
reaches only what it targets; both functions guard the empty segment, so the
loop conversion cannot manufacture a bin. Reverting only the production file
turns exactly four of the eight new cases red on each platform, matching the
claim. And since this was written against a base predating the RMSSD over-count
gate, which calls sessionHrvWindows, the two were merged locally and the full
Android suite run: 5426 tests green with both new test classes passing together.

Reported and implemented by @bhelm, who also identified an unfixed pre-existing
gap this leaves behind: sessionRestingHR has no artifact gate at all, so a
single-beat bin can win the night's floor. Tracked separately.
---
 .../StrandAnalytics/RecoveryScorer.swift      | 142 +----------
 .../Sources/StrandAnalytics/SleepStager.swift |  31 ++-
 .../RecoveryScorerTests.swift                 | 239 ------------------
 .../SleepStagerTests.swift                    |  95 +++++++
 .../java/com/noop/analytics/RecoveryScorer.kt | 156 +-----------
 .../java/com/noop/analytics/SleepStager.kt    |  35 ++-
 .../RecoveryIndexActivityBalanceTest.kt       |  83 +-----
 .../analytics/RecoveryScorerRestingHrTest.kt  |  71 ------
 .../RecoveryScorerWindowEndpointTest.kt       | 147 -----------
 .../SleepStagerWindowEndpointTest.kt          | 133 ++++++++++
 docs/ANALYTICS.md                             |  12 +-
 docs/LIBRARY.md                               |   2 +-
 12 files changed, 299 insertions(+), 847 deletions(-)
 delete mode 100644 android/app/src/test/java/com/noop/analytics/RecoveryScorerRestingHrTest.kt
 delete mode 100644 android/app/src/test/java/com/noop/analytics/RecoveryScorerWindowEndpointTest.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/SleepStagerWindowEndpointTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/RecoveryScorer.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/RecoveryScorer.swift
index 6cfa6582d9..78f0070e60 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/RecoveryScorer.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/RecoveryScorer.swift
@@ -217,144 +217,6 @@ public enum RecoveryScorer {
                                          dampFraction: dampFraction)
     }
 
-    /// Rolling-mean HR window (seconds) for the resting-HR estimate.
-    public static let restingHRWindowS: Int = 5 * 60
-
-    /// Minimum HR samples a 5-min bin must hold before its mean is eligible to WIN the resting
-    /// floor (#686). A thinly-populated bin — at the limit a single lone beat — lets one artifact
-    /// (a dropout, a decode glitch) become the bin "mean" and win the night's minimum, dragging
-    /// resting HR implausibly low. Requiring a handful of samples means the floor is a genuine
-    /// sustained dip, not a one-sample fluke. Worn nights stream ~1 Hz HR so a real 5-min bin holds
-    /// hundreds of samples and clears this trivially; only sparse/edge bins (a partial trailing bin,
-    /// a gap-straddling bin) fall below it. Does NOT change the floor DEFINITION — still the min of
-    /// 5-min bin means — it only stops an under-sampled artifact bin from being that min.
-    public static let restingHRMinBinSamples: Int = 5
-
-    /// Physiological resting-HR floor (bpm) below which a bin mean is rejected as a dropout artifact
-    /// (#686), never the resting floor. An adult's true sleeping resting HR essentially never sits
-    /// below this; a 5-min mean that does is a run of dropout/decode-zero beats, not a real cardiac
-    /// dip. 25 bpm clears even deeply-bradycardic trained athletes (resting HRs in the low 30s) with
-    /// margin while rejecting the implausible artifact range. A bin below this is excluded from floor
-    /// candidacy; if it were allowed to win, resting HR would read a fabricated sub-physiological value.
-    public static let restingHRMinPlausibleBpm: Double = 25.0
-
-    // MARK: - Resting HR
-
-    /// Lowest sustained HR during the in-bed window (bpm, rounded), or nil.
-    ///
-    /// "Sustained" = the minimum of 5-minute non-overlapping bin means of the HR
-    /// samples whose ts ∈ [start, end]. Rejects single-beat dips while capturing
-    /// the night's true floor. Returns nil when there are no HR samples in window.
-    ///
-    /// The window is CLOSED at both ends, so the binning is too: bins are `[t, t + windowS)`
-    /// except the final one, which is `[t, end]`. Half-open bins alone would admit a
-    /// sample sitting exactly on an aligned `end` through the prefilter and then place it in no
-    /// bin — counted as data, silently ignored. A zero-length window (`start == end`) is that
-    /// single closed bin.
-    ///
-    /// Artifact hardening (#686): a bin may only WIN the floor when it is BOTH well-populated
-    /// (≥ `restingHRMinBinSamples`, so one lone artifact beat can't be a bin "mean") AND
-    /// physiologically plausible (mean ≥ `restingHRMinPlausibleBpm`, rejecting dropout-driven
-    /// sub-physiological dips). The floor DEFINITION is unchanged — still the minimum of the
-    /// 5-min bin means — only artifact bins are barred from being that minimum. If no bin
-    /// qualifies (a wholly sparse/degenerate window), fall back to the lowest of ALL bin means,
-    /// else the all-sample mean, preserving the never-nil-on-data behaviour.
-    public static func restingHR(_ hr: [HRSample], start: Int, end: Int) -> Int? {
-        let seg = hr.filter { $0.ts >= start && $0.ts <= end }
-        guard !seg.isEmpty else { return nil }
-
-        var means: [Double] = []          // every bin mean (legacy floor, the fallback)
-        var qualified: [Double] = []       // bins eligible to WIN the floor (#686)
-        var t = start
-        repeat {
-            // The last bin (its half-open end reaches or passes `end`) closes on `end` instead,
-            // catching an endpoint sample the prefilter already admitted. `seg` holds nothing
-            // past `end`, so "everything from t onwards" IS [t, end]. `repeat` runs once for a
-            // zero-length window, where that single closed bin is the whole window.
-            let isFinal = t + restingHRWindowS >= end
-            let win = seg.filter { $0.ts >= t && (isFinal || $0.ts < t + restingHRWindowS) }
-            if !win.isEmpty {
-                let mean = Double(win.reduce(0) { $0 + $1.bpm }) / Double(win.count)
-                means.append(mean)
-                // A bin wins the floor only if it is well-populated AND physiologically plausible —
-                // a thin (single-artifact) or sub-physiological (dropout) bin can't be the minimum.
-                if win.count >= restingHRMinBinSamples && mean >= restingHRMinPlausibleBpm {
-                    qualified.append(mean)
-                }
-            }
-            t += restingHRWindowS
-        } while t < end
-        let floor: Double
-        if let m = qualified.min() {
-            floor = m
-        } else if let m = means.min() {
-            // No bin cleared the artifact bar (sparse window): fall back to the legacy floor.
-            floor = m
-        } else {
-            floor = Double(seg.reduce(0) { $0 + $1.bpm }) / Double(seg.count)
-        }
-        return Int(floor.rounded())
-    }
-
-    // MARK: - Recovery Index (overnight HR-decline slope)
-
-    /// Minimum 5-minute bins (`restingHR`'s SAME binning) required before a slope is trusted —
-    /// below this, too little of the night has elapsed to fit a trend, and a 1-2-point
-    /// regression is noise, not a night-long pattern. 6 bins = 30 minutes of binned coverage,
-    /// a deliberately low floor so a short/partial night still gets a number rather than a
-    /// routine nil.
-    public static let recoveryIndexMinBins: Int = 6
-
-    /// Overnight resting-HR DECLINE slope (bpm/hour) across the in-bed window — the "Recovery
-    /// Index" component of Oura's Readiness that Charge lacked (it previously only read the
-    /// overnight FLOOR via `restingHR` above, never the trend that reaches it).
-    ///
-    /// Computed as the least-squares slope of the SAME non-overlapping 5-minute HR bin means
-    /// `restingHR` uses (`restingHRWindowS`) against each bin's midpoint time (hours from
-    /// `start`, and for the final closed bin still its half-open midpoint `t + windowS / 2`, so a
-    /// partial or endpoint-only last bin keeps the same time axis as every other bin).
-    /// NEGATIVE = declining (HR falling through the night — the physiologically
-    /// expected, good pattern); POSITIVE = rising (restlessness, illness, alcohol, a late
-    /// stimulant). Returns nil when fewer than `recoveryIndexMinBins` bins have data (too
-    /// little of the window to fit a trend) or there are no samples at all — it never
-    /// fabricates a slope from a sliver of the night.
-    public static func recoveryIndexSlope(_ hr: [HRSample], start: Int, end: Int) -> Double? {
-        let seg = hr.filter { $0.ts >= start && $0.ts <= end }
-        guard !seg.isEmpty else { return nil }
-
-        // Same non-overlapping 5-minute binning as restingHR: both read the identical
-        // underlying series, one as a floor, one as a trend across it.
-        var points: [(tHours: Double, meanBpm: Double)] = []
-        var t = start
-        repeat {
-            // Final bin closes on `end` — same closed-window rule as restingHR, so an
-            // endpoint sample counts toward the bin gate instead of vanishing after admission.
-            let isFinal = t + restingHRWindowS >= end
-            let win = seg.filter { $0.ts >= t && (isFinal || $0.ts < t + restingHRWindowS) }
-            if !win.isEmpty {
-                let mean = Double(win.reduce(0) { $0 + $1.bpm }) / Double(win.count)
-                let midpointS = Double(t - start) + Double(restingHRWindowS) / 2.0
-                points.append((tHours: midpointS / 3600.0, meanBpm: mean))
-            }
-            t += restingHRWindowS
-        } while t < end
-        guard points.count >= recoveryIndexMinBins else { return nil }
-
-        // Least-squares slope: Σ((t-t̄)(y-ȳ)) / Σ((t-t̄)²), bpm per hour.
-        let n = Double(points.count)
-        let tBar = points.reduce(0.0) { $0 + $1.tHours } / n
-        let yBar = points.reduce(0.0) { $0 + $1.meanBpm } / n
-        var num = 0.0, den = 0.0
-        for p in points {
-            let dt = p.tHours - tBar
-            num += dt * (p.meanBpm - yBar)
-            den += dt * dt
-        }
-        // Degenerate (all bins at the same instant): no time spread to fit against.
-        guard den > 1e-9 else { return 0.0 }
-        return num / den
-    }
-
     // MARK: - Recovery band
 
     /// WHOOP-style color band for a recovery score [0, 100].
@@ -438,8 +300,8 @@ public enum RecoveryScorer {
     ///     no-skin-temp score is identical to before.
     ///   - hrvBaselineUsable: whether the HRV baseline has enough nights
     ///     (BaselineState.usable). When false, returns nil (cold-start).
-    ///   - recoveryIndexSlope: overnight resting-HR DECLINE slope (bpm/hour, from
-    ///     `recoveryIndexSlope(_:start:end:)`). Negative (declining) supports recovery;
+    ///   - recoveryIndexSlope: overnight resting-HR DECLINE slope (bpm/hour), supplied by the
+    ///     caller. Negative (declining) supports recovery;
     ///     positive (rising) limits it, weight wRecoveryIndex. nil (the default) drops the
     ///     term and the weights renormalize, so the no-slope score is IDENTICAL to before
     ///     this parameter existed.
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
index 7a3a6daa0f..435da91083 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
@@ -2773,17 +2773,27 @@ public enum SleepStager {
     // MARK: - Per-session HR / HRV
 
     /// Lowest 5-min rolling-mean HR during the session (bpm), or nil.
+    ///
+    /// The window is CLOSED at both ends, so the binning is too: bins are `[t, t + windowS)` except
+    /// the final one, which is `[t, end]`. Half-open bins alone would admit a sample sitting exactly
+    /// on an aligned `end` through the prefilter and then place it in no bin — counted as data,
+    /// silently ignored. A zero-length window (`start == end`) is that single closed bin.
     static func sessionRestingHR(start: Int, end: Int, hr: [HRSample]) -> Int? {
         let seg = hr.filter { $0.ts >= start && $0.ts <= end }
         guard !seg.isEmpty else { return nil }
         let windowS = 5 * 60
         var means: [Double] = []
         var t = start
-        while t < end {
-            let win = seg.filter { $0.ts >= t && $0.ts < t + windowS }
+        repeat {
+            // The last bin (its half-open end reaches or passes `end`) closes on `end` instead,
+            // catching an endpoint sample the prefilter already admitted. `seg` holds nothing past
+            // `end`, so "everything from t onwards" IS [t, end]. `repeat` runs once for a
+            // zero-length window, where that single closed bin is the whole window.
+            let isFinal = t + windowS >= end
+            let win = seg.filter { $0.ts >= t && (isFinal || $0.ts < t + windowS) }
             if !win.isEmpty { means.append(Double(win.reduce(0) { $0 + $1.bpm }) / Double(win.count)) }
             t += windowS
-        }
+        } while t < end
         if let m = means.min() { return Int(m.rounded()) }
         let all = Double(seg.reduce(0) { $0 + $1.bpm }) / Double(seg.count)
         return Int(all.rounded())
@@ -2833,6 +2843,11 @@ public enum SleepStager {
     /// Per-5-min-window RMSSD across a session, each window tagged with the sleep stage at its CENTER
     /// (from `stages`) — the SINGLE source `sessionAvgHRV` averages, and the HRV nightly trace reads.
     /// Passing `[]` for `stages` tags every window "?" (the plain-average path needs no stages). (#141)
+    ///
+    /// Windows follow the same closed-window rule as `sessionRestingHR`: `[t, t + windowS)` except
+    /// the final one, which is `[t, end]`, so a beat sitting exactly on an aligned `end` lands in a
+    /// window instead of being admitted by the prefilter and then dropped. Window stage tagging and
+    /// `startTs` are unchanged — the final window keeps its half-open center `t + windowS / 2`.
     static func sessionHrvWindows(start: Int, end: Int, rr: [RRInterval], stages: [StageSegment]) -> [HrvWindow] {
         // CONTRACT: `rr` MUST already be ts-sorted (RMSSD is built from SUCCESSIVE differences, so a bucket
         // has to be chronological). The value path passes the loop's pre-sorted `rrS`; the trace caller sorts
@@ -2843,8 +2858,12 @@ public enum SleepStager {
         let windowS = 5 * 60
         var out: [HrvWindow] = []
         var t = start
-        while t < end {
-            let bucket = seg.filter { $0.ts >= t && $0.ts < t + windowS }.map { Double($0.rrMs) }
+        repeat {
+            // Final window closes on `end` — same closed-window rule as sessionRestingHR, so an
+            // endpoint beat counts instead of vanishing after admission. `repeat` runs once for a
+            // zero-length window, where that single closed window is the whole session.
+            let isFinal = t + windowS >= end
+            let bucket = seg.filter { $0.ts >= t && (isFinal || $0.ts < t + windowS) }.map { Double($0.rrMs) }
             // Full clean (range + Malik ectopic rejection), not just range — matches the
             // analyze() pipeline. The 0x2A37 RR on a WHOOP 5/MG is PPG-derived and noisier
             // than a 4.0's; rMSSD is built from SUCCESSIVE differences, so an un-rejected
@@ -2857,7 +2876,7 @@ public enum SleepStager {
             let stage = stages.first { center >= $0.start && center < $0.end }?.stage ?? "?"
             out.append(HrvWindow(startTs: t, stage: stage, cleanBeats: cleaned.nn.count, rmssd: rmssd))
             t += windowS
-        }
+        } while t < end
         return out
     }
 
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RecoveryScorerTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RecoveryScorerTests.swift
index a8ef7b6642..651b10d333 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RecoveryScorerTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RecoveryScorerTests.swift
@@ -162,245 +162,6 @@ final class RecoveryScorerTests: XCTestCase {
         XCTAssertEqual(RecoveryScorer.band(90), "green")
     }
 
-    func testRestingHRLowestRollingMean() {
-        // Two 5-min blocks: first averages 60, second averages 50 → resting = 50.
-        var hr: [HRSample] = []
-        let start = 1000
-        for i in 0..<300 { hr.append(HRSample(ts: start + i, bpm: 60)) }        // 0..299 s
-        for i in 0..<300 { hr.append(HRSample(ts: start + 300 + i, bpm: 50)) }  // 300..599 s
-        let r = RecoveryScorer.restingHR(hr, start: start, end: start + 600)
-        XCTAssertEqual(r, 50)
-    }
-
-    func testRestingHRNilWhenNoSamples() {
-        XCTAssertNil(RecoveryScorer.restingHR([], start: 0, end: 1000))
-    }
-
-    // MARK: - #686: artifact hardening of the resting-HR floor
-
-    func testRestingHRRejectsSingleSampleArtifactBin() {
-        // A dense, well-populated bin at 55 bpm, then a SECOND 5-min bin holding exactly ONE
-        // artifact beat at 30 bpm. The old min-of-bin-means took the lone-sample bin (30) as the
-        // floor; with #686 a single-sample bin can't WIN, so the floor is the real 55.
-        var hr: [HRSample] = []
-        let start = 1000
-        for i in 0..<300 { hr.append(HRSample(ts: start + i, bpm: 55)) }   // bin 0: 300 samples @55
-        hr.append(HRSample(ts: start + 300, bpm: 30))                       // bin 1: ONE sample @30
-        let r = RecoveryScorer.restingHR(hr, start: start, end: start + 600)
-        XCTAssertEqual(r, 55, "a single-sample artifact bin must not win the resting floor")
-    }
-
-    func testRestingHRRejectsSubPhysiologicalDropoutBin() {
-        // Two FULLY-populated bins: a real 52 bpm bin and a dropout bin whose 300 samples all read
-        // an implausible 10 bpm (decode-zero / dropout run). It clears the sample-count bar but is
-        // sub-physiological, so #686 bars it from the floor → resting reads the real 52.
-        var hr: [HRSample] = []
-        let start = 2000
-        for i in 0..<300 { hr.append(HRSample(ts: start + i, bpm: 52)) }         // real bin
-        for i in 0..<300 { hr.append(HRSample(ts: start + 300 + i, bpm: 10)) }   // dropout bin
-        let r = RecoveryScorer.restingHR(hr, start: start, end: start + 600)
-        XCTAssertEqual(r, 52, "a sub-physiological dropout bin must not win the resting floor")
-    }
-
-    func testRestingHRKeepsGenuineLowFloor() {
-        // A REAL sustained dip (a full 5-min bin at 45 bpm) is plausible AND well-populated, so it
-        // still wins — the hardening must not flatten genuine athletic resting HRs.
-        var hr: [HRSample] = []
-        let start = 3000
-        for i in 0..<300 { hr.append(HRSample(ts: start + i, bpm: 60)) }
-        for i in 0..<300 { hr.append(HRSample(ts: start + 300 + i, bpm: 45)) }
-        let r = RecoveryScorer.restingHR(hr, start: start, end: start + 600)
-        XCTAssertEqual(r, 45, "a genuine sustained low bin must still win the floor")
-    }
-
-    func testRestingHRFallsBackWhenNoBinQualifies() {
-        // A wholly sparse window: every bin holds a single sample (none clears the count bar).
-        // Rather than return nil on data present, fall back to the legacy lowest-bin-mean (here 48).
-        let start = 4000
-        let hr = [HRSample(ts: start + 10, bpm: 58),
-                  HRSample(ts: start + 320, bpm: 48)]   // two bins, one sample each
-        let r = RecoveryScorer.restingHR(hr, start: start, end: start + 600)
-        XCTAssertEqual(r, 48, "with no qualifying bin, fall back to the lowest bin mean (never nil on data)")
-    }
-
-    // MARK: - Recovery Index: recoveryIndexSlope(_:start:end:)
-
-    /// Build a synthetic in-bed HR series with a constant slope (bpm/hour) from `startBpm`,
-    /// sampled every 30 s (a low-cadence strap) over `hours`. Returns the series plus its
-    /// [start, end] window.
-    private func slopeSeries(startBpm: Double, slopePerHour: Double, hours: Double,
-                            originTs: Int = 10_000) -> (hr: [HRSample], start: Int, end: Int) {
-        var hr: [HRSample] = []
-        let totalSeconds = Int(hours * 3600)
-        var t = 0
-        while t < totalSeconds {
-            let bpm = startBpm + slopePerHour * (Double(t) / 3600.0)
-            hr.append(HRSample(ts: originTs + t, bpm: Int(bpm.rounded())))
-            t += 30
-        }
-        return (hr, originTs, originTs + totalSeconds)
-    }
-
-    func testRecoveryIndexSlopeNilWhenNoSamples() {
-        XCTAssertNil(RecoveryScorer.recoveryIndexSlope([], start: 0, end: 1000))
-    }
-
-    func testRecoveryIndexSlopeNilWhenTooFewBins() {
-        // Only 2 five-minute bins (10 minutes) of data — below recoveryIndexMinBins — too
-        // little of the night to fit a trend; must return nil, never a fabricated slope.
-        var hr: [HRSample] = []
-        let start = 5000
-        for i in 0..<300 { hr.append(HRSample(ts: start + i, bpm: 60)) }
-        for i in 0..<300 { hr.append(HRSample(ts: start + 300 + i, bpm: 55)) }
-        XCTAssertNil(RecoveryScorer.recoveryIndexSlope(hr, start: start, end: start + 600))
-    }
-
-    func testRecoveryIndexSlopeRecoversMultipleDistinctInjectedSlopes() {
-        // Derived-signal rule: recover MULTIPLE distinct injected slopes, not one matched case.
-        // Four full-night (6 h) synthetic series: flat, mild decline, steep decline, rising.
-        let flat = slopeSeries(startBpm: 62, slopePerHour: 0.0, hours: 6)
-        let mild = slopeSeries(startBpm: 62, slopePerHour: -1.0, hours: 6)
-        let steep = slopeSeries(startBpm: 68, slopePerHour: -4.0, hours: 6)
-        let rising = slopeSeries(startBpm: 55, slopePerHour: 2.0, hours: 6)
-
-        let flatSlope = RecoveryScorer.recoveryIndexSlope(flat.hr, start: flat.start, end: flat.end)
-        let mildSlope = RecoveryScorer.recoveryIndexSlope(mild.hr, start: mild.start, end: mild.end)
-        let steepSlope = RecoveryScorer.recoveryIndexSlope(steep.hr, start: steep.start, end: steep.end)
-        let risingSlope = RecoveryScorer.recoveryIndexSlope(rising.hr, start: rising.start, end: rising.end)
-
-        XCTAssertNotNil(flatSlope); XCTAssertNotNil(mildSlope)
-        XCTAssertNotNil(steepSlope); XCTAssertNotNil(risingSlope)
-
-        // Each recovered slope is close to its OWN injected value (within integer-bpm rounding
-        // noise from the synthetic series), not just relatively ordered.
-        XCTAssertEqual(flatSlope!, 0.0, accuracy: 0.3)
-        XCTAssertEqual(mildSlope!, -1.0, accuracy: 0.3)
-        XCTAssertEqual(steepSlope!, -4.0, accuracy: 0.3)
-        XCTAssertEqual(risingSlope!, 2.0, accuracy: 0.3)
-
-        // And strictly ordered steep-decline < mild-decline < flat < rising.
-        XCTAssertLessThan(steepSlope!, mildSlope!)
-        XCTAssertLessThan(mildSlope!, flatSlope!)
-        XCTAssertLessThan(flatSlope!, risingSlope!)
-    }
-
-    // MARK: - Window endpoint: the closed [start, end] window has a closed FINAL bin
-
-    // Both `restingHR` and `recoveryIndexSlope` prefilter ts ∈ [start, end], so a sample sitting
-    // exactly ON `end` is admitted. With bins shaped [t, t+300) and a loop that stops at `end`, an
-    // ALIGNED end (end - start a multiple of the bin width) left that admitted sample in no bin at
-    // all: it was counted as data and then silently ignored. The final bin is therefore closed at
-    // `end`. The paired non-aligned cases pin the behaviour that was already correct, so the fix
-    // cannot be mistaken for a change to trailing partial bins.
-
-    func testRestingHRAlignedEndpointSampleReachesABin() {
-        // The minimal case: start = 0, end = 300 (exactly one bin wide), five samples on
-        // the endpoint. They pass the prefilter, so they must also populate the final bin — and
-        // five is exactly restingHRMinBinSamples, so the bin qualifies for the floor. This case
-        // already returned 60 before the fix, but only because NO bin held anything and the
-        // all-sample fallback stepped in; it now flows through the bin path like any other
-        // window. testRestingHREndpointSampleLandsInFinalBinOnly is where the fallback cannot
-        // hide the dropped sample.
-        let hr = (0..<5).map { _ in HRSample(ts: 300, bpm: 60) }
-        XCTAssertEqual(RecoveryScorer.restingHR(hr, start: 0, end: 300), 60,
-                       "a sample exactly on an aligned end must belong to the final bin")
-    }
-
-    func testRestingHRNonAlignedEndpointSampleReachesABin() {
-        // Paired non-aligned case: end = 450 falls mid-bin, so the endpoint sample was always
-        // inside the trailing partial bin. Same answer, before and after the fix.
-        let hr = (0..<5).map { _ in HRSample(ts: 450, bpm: 60) }
-        XCTAssertEqual(RecoveryScorer.restingHR(hr, start: 0, end: 450), 60,
-                       "a sample on a non-aligned end stays in the trailing partial bin")
-    }
-
-    func testRestingHREndpointSampleLandsInFinalBinOnly() {
-        // The endpoint must join the LAST bin, not leak into earlier ones: a dense 70 bpm first
-        // bin plus five endpoint beats at 40 gives a floor of 40 (the endpoint bin), while the
-        // 70 bpm bin is untouched. A rule that admitted ts == end into every bin would drag the
-        // first bin's mean down instead.
-        var hr: [HRSample] = (0..<300).map { HRSample(ts: $0, bpm: 70) }
-        hr.append(contentsOf: (0..<5).map { _ in HRSample(ts: 600, bpm: 40) })
-        XCTAssertEqual(RecoveryScorer.restingHR(hr, start: 0, end: 600), 40,
-                       "the endpoint sample belongs to the final bin only")
-    }
-
-    func testRestingHRDegenerateZeroLengthWindow() {
-        // start == end: the single instant is one closed bin. Five samples clear the count bar,
-        // so the floor is their mean — the same number the all-sample fallback produced before.
-        let hr = (0..<5).map { _ in HRSample(ts: 1000, bpm: 58) }
-        XCTAssertEqual(RecoveryScorer.restingHR(hr, start: 1000, end: 1000), 58)
-    }
-
-    func testRecoveryIndexSlopeAlignedEndpointCompletesTheBinGate() throws {
-        // The bin-gate case: six samples over an aligned 30-minute window, the last exactly
-        // on `end`. Dropping it left five bins — one short of recoveryIndexMinBins — so the gate
-        // turned a complete window into nil. With the final bin closed there are six bins and a
-        // slope. Expected value from the Swift oracle in Tools-free standalone form (see the
-        // Kotlin twin, which pins the same literal).
-        let hr = [HRSample(ts: 0, bpm: 66), HRSample(ts: 300, bpm: 64),
-                  HRSample(ts: 600, bpm: 62), HRSample(ts: 900, bpm: 60),
-                  HRSample(ts: 1200, bpm: 58), HRSample(ts: 1800, bpm: 54)]
-        let slope = try XCTUnwrap(RecoveryScorer.recoveryIndexSlope(hr, start: 0, end: 1800),
-                                  "an admitted endpoint sample must count toward the bin gate")
-        XCTAssertEqual(slope, -27.428571428571423, accuracy: 1e-9)
-    }
-
-    func testRecoveryIndexSlopeStillNilWithOnlyFiveBins() {
-        // The gate itself is unchanged: the same window without the endpoint sample has five
-        // bins and must stay nil. Closing the final bin adds no bin where there is no sample.
-        let hr = [HRSample(ts: 0, bpm: 66), HRSample(ts: 300, bpm: 64),
-                  HRSample(ts: 600, bpm: 62), HRSample(ts: 900, bpm: 60),
-                  HRSample(ts: 1200, bpm: 58)]
-        XCTAssertNil(RecoveryScorer.recoveryIndexSlope(hr, start: 0, end: 1800))
-    }
-
-    func testRecoveryIndexSlopeNonAlignedEndpointCompletesTheBinGate() throws {
-        // Paired non-aligned case: end = 1750 sits mid-bin, so the endpoint sample was already in
-        // the trailing partial bin and the gate was already satisfied. Pinned so the fix is
-        // visibly confined to the aligned case.
-        let hr = [HRSample(ts: 0, bpm: 66), HRSample(ts: 300, bpm: 64),
-                  HRSample(ts: 600, bpm: 62), HRSample(ts: 900, bpm: 60),
-                  HRSample(ts: 1200, bpm: 58), HRSample(ts: 1750, bpm: 54)]
-        let slope = try XCTUnwrap(RecoveryScorer.recoveryIndexSlope(hr, start: 0, end: 1750))
-        XCTAssertEqual(slope, -27.428571428571423, accuracy: 1e-9)
-    }
-
-    func testRestingHREndpointSweepMatchesOracle() {
-        // Twin of the Kotlin RecoveryScorerWindowEndpointTest sweep: `end` walks a whole bin width
-        // and beyond, in 25 s steps, against a dense 70 bpm opening bin plus five endpoint beats at
-        // 60. Same 37 literals, from the same standalone-oracle stdout, so the oracle guards BOTH
-        // directions — a Swift-side drift fails here rather than waiting for two field logs to
-        // disagree. Note end = 300: the single closed bin holds BOTH groups (mean 69.8 → 70).
-        let expected = [62, 68, 69, 69, 70, 70, 70, 70, 70, 70, 70, 70, 70,
-                        60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60,
-                        60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60]
-        var i = 0
-        var endTs = 0
-        while endTs <= 900 {
-            var hr: [HRSample] = (0..<300).map { HRSample(ts: $0, bpm: 70) }
-            hr.append(contentsOf: (0..<5).map { _ in HRSample(ts: endTs, bpm: 60) })
-            XCTAssertEqual(RecoveryScorer.restingHR(hr, start: 0, end: endTs), expected[i],
-                           "restingHR.end=\(endTs)")
-            i += 1
-            endTs += 25
-        }
-    }
-
-    func testRecoveryIndexSlopeFullNightUnchanged() throws {
-        // Twin of the Kotlin full-night pin: a 6 h night has no sample on `end`, so the endpoint
-        // rule must not move it — the oracle's slope for a −2 bpm/hour synthetic night, to the
-        // last digit.
-        var hr: [HRSample] = []
-        var s = 0
-        while s < 6 * 3600 {
-            hr.append(HRSample(ts: s, bpm: Int((62.0 - 2.0 * Double(s) / 3600.0).rounded())))
-            s += 30
-        }
-        let slope = try XCTUnwrap(RecoveryScorer.recoveryIndexSlope(hr, start: 0, end: 6 * 3600))
-        XCTAssertEqual(slope, -2.0071001350569166, accuracy: 1e-9)
-    }
-
     // MARK: - Recovery Index / Activity-Balance folded into recovery(...)
 
     func testRecoveryIndexAndActivityBalanceDefaultNilByteIdenticalToBefore() {
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerTests.swift
index 6ea4bcff3f..5563ce1c3f 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerTests.swift
@@ -859,6 +859,101 @@ final class SleepStagerTests: XCTestCase {
         XCTAssertLessThan(hrv!, 50, "ectopic spikes must be rejected before rMSSD")
     }
 
+    // MARK: - Session window endpoint: the closed [start, end] window has a closed FINAL bin
+
+    // `sessionRestingHR` and `sessionHrvWindows` prefilter ts ∈ [start, end], so a sample sitting
+    // exactly ON `end` is admitted. Binned as [t, t + 300) with a loop that stops at `end`, an
+    // ALIGNED end (end - start a multiple of the window) left that admitted sample in no bin: it
+    // counted as data and was then silently ignored. The final bin is therefore closed on `end`,
+    // the same rule RecoveryScorer already carries. Each case is paired with a non-aligned twin
+    // that was always correct, so the fix cannot be mistaken for a change to trailing partial bins.
+    // Expected values are the verbatim stdout of a standalone Swift oracle over the fixed binning;
+    // SleepStagerWindowEndpointTest.kt pins the same scenarios with the same literals.
+
+    func testSessionRestingHRAlignedEndpointSampleReachesABin() {
+        // Minimal case: start = 0, end = 300 (one window wide), five samples on the endpoint.
+        // Already returned 60 before the fix, but only via the all-sample fallback (no bin held
+        // anything); it now flows through the bin path.
+        let hr = (0..<5).map { _ in HRSample(ts: 300, bpm: 60) }
+        XCTAssertEqual(SleepStager.sessionRestingHR(start: 0, end: 300, hr: hr), 60,
+                       "a sample exactly on an aligned end must belong to the final bin")
+    }
+
+    func testSessionRestingHRNonAlignedEndpointSampleReachesABin() {
+        // Paired non-aligned case: end = 450 falls mid-window, so the endpoint sample was always
+        // inside the trailing partial bin. Same answer, before and after.
+        let hr = (0..<5).map { _ in HRSample(ts: 450, bpm: 60) }
+        XCTAssertEqual(SleepStager.sessionRestingHR(start: 0, end: 450, hr: hr), 60,
+                       "a sample on a non-aligned end stays in the trailing partial bin")
+    }
+
+    func testSessionRestingHREndpointSampleLandsInFinalBinOnly() {
+        // Where the fallback cannot hide the dropped sample: a dense 70 bpm first bin plus five
+        // endpoint beats at 40 makes the floor 40, and the 70 bpm bin stays untouched. Before the
+        // fix the endpoint beats vanished and the shipped resting HR read 70.
+        var hr: [HRSample] = (0..<300).map { HRSample(ts: $0, bpm: 70) }
+        hr.append(contentsOf: (0..<5).map { _ in HRSample(ts: 600, bpm: 40) })
+        XCTAssertEqual(SleepStager.sessionRestingHR(start: 0, end: 600, hr: hr), 40,
+                       "the endpoint sample belongs to the final bin only")
+    }
+
+    func testSessionRestingHRDegenerateZeroLengthWindow() {
+        // start == end: the single instant is one closed bin — the same number the all-sample
+        // fallback produced before.
+        let hr = (0..<5).map { _ in HRSample(ts: 1000, bpm: 58) }
+        XCTAssertEqual(SleepStager.sessionRestingHR(start: 1000, end: 1000, hr: hr), 58)
+    }
+
+    func testSessionRestingHREndpointSweepMatchesOracle() {
+        // `end` walks a whole window width and beyond in 25 s steps against a dense 70 bpm opening
+        // bin plus five endpoint beats at 60. Verbatim oracle stdout, the check that catches drift
+        // the eye does not — including end = 300, where the single closed bin holds BOTH groups.
+        let expected = [62, 68, 69, 69, 70, 70, 70, 70, 70, 70, 70, 70, 70,
+                        60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60,
+                        60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60]
+        var i = 0
+        var endTs = 0
+        while endTs <= 900 {
+            var hr: [HRSample] = (0..<300).map { HRSample(ts: $0, bpm: 70) }
+            hr.append(contentsOf: (0..<5).map { _ in HRSample(ts: endTs, bpm: 60) })
+            XCTAssertEqual(SleepStager.sessionRestingHR(start: 0, end: endTs, hr: hr), expected[i],
+                           "sessionRestingHR.end=\(endTs)")
+            i += 1
+            endTs += 25
+        }
+    }
+
+    func testSessionHrvWindowsAlignedEndpointBeatsFillTheFinalWindow() {
+        // 120 beats in the opening window plus three beats exactly on an aligned end = 600. The
+        // second window is the final one, so it closes on `end` and holds those three beats;
+        // before the fix it was emitted empty and its RMSSD was nil. Constant 900 ms RR keeps the
+        // RMSSD analytically 0.0 on both platforms — this pins the BINNING, not the RMSSD math.
+        var rr: [RRInterval] = (0..<120).map { RRInterval(ts: $0, rrMs: 900) }
+        rr.append(contentsOf: (0..<3).map { _ in RRInterval(ts: 600, rrMs: 900) })
+        let wins = SleepStager.sessionHrvWindows(start: 0, end: 600, rr: rr, stages: [])
+        XCTAssertEqual(wins.map { $0.startTs }, [0, 300])
+        XCTAssertEqual(wins.map { $0.cleanBeats }, [120, 3],
+                       "the endpoint beats must fill the final window")
+        XCTAssertEqual(wins.map { $0.rmssd }, [0.0, 0.0])
+    }
+
+    func testSessionHrvWindowsNonAlignedEndpointUnchanged() {
+        // Paired non-aligned case: end = 450 sits mid-window, so the endpoint beats were already
+        // inside the trailing partial window. Same shape, before and after.
+        var rr: [RRInterval] = (0..<120).map { RRInterval(ts: $0, rrMs: 900) }
+        rr.append(contentsOf: (0..<3).map { _ in RRInterval(ts: 450, rrMs: 900) })
+        let wins = SleepStager.sessionHrvWindows(start: 0, end: 450, rr: rr, stages: [])
+        XCTAssertEqual(wins.map { $0.startTs }, [0, 300])
+        XCTAssertEqual(wins.map { $0.cleanBeats }, [120, 3])
+    }
+
+    func testSessionAvgHRVZeroLengthWindowUsesTheEndpointBeats() {
+        // The value-level consequence: a zero-length window (start == end) is one closed bin, so
+        // beats admitted by the prefilter produce a number instead of nil.
+        let rr = (0..<3).map { _ in RRInterval(ts: 1000, rrMs: 900) }
+        XCTAssertEqual(SleepStager.sessionAvgHRV(start: 1000, end: 1000, rr: rr), 0.0)
+    }
+
     // MARK: - Helper robustness
 
     func testConvolveReflectShortInputDoesNotCrash() {
diff --git a/android/app/src/main/java/com/noop/analytics/RecoveryScorer.kt b/android/app/src/main/java/com/noop/analytics/RecoveryScorer.kt
index 23e0bddd1d..43b85dfc33 100644
--- a/android/app/src/main/java/com/noop/analytics/RecoveryScorer.kt
+++ b/android/app/src/main/java/com/noop/analytics/RecoveryScorer.kt
@@ -253,158 +253,6 @@ object RecoveryScorer {
         )
     }
 
-    /** Rolling-mean HR window (seconds) for the resting-HR estimate. */
-    const val restingHRWindowS: Int = 5 * 60
-
-    /**
-     * Minimum HR samples a 5-min bin must hold before its mean is eligible to WIN the resting
-     * floor (#686). A thinly-populated bin — at the limit a single lone beat — lets one artifact
-     * (a dropout, a decode glitch) become the bin "mean" and win the night's minimum, dragging
-     * resting HR implausibly low. Requiring a handful of samples means the floor is a genuine
-     * sustained dip, not a one-sample fluke. Worn nights stream ~1 Hz HR so a real 5-min bin holds
-     * hundreds of samples and clears this trivially; only sparse/edge bins fall below it. Does NOT
-     * change the floor DEFINITION — still the min of 5-min bin means — only stops an under-sampled
-     * artifact bin from being that min. Mirrors Swift `RecoveryScorer.restingHRMinBinSamples`.
-     */
-    const val restingHRMinBinSamples: Int = 5
-
-    /**
-     * Physiological resting-HR floor (bpm) below which a bin mean is rejected as a dropout artifact
-     * (#686), never the resting floor. An adult's true sleeping resting HR essentially never sits
-     * below this; a 5-min mean that does is a run of dropout/decode-zero beats, not a real cardiac
-     * dip. 25 bpm clears even deeply-bradycardic trained athletes (resting HRs in the low 30s) with
-     * margin while rejecting the implausible artifact range. Mirrors Swift
-     * `RecoveryScorer.restingHRMinPlausibleBpm`.
-     */
-    const val restingHRMinPlausibleBpm: Double = 25.0
-
-    // ─────────────────────────────────────────────────────────────────────────
-    // Resting HR
-    // ─────────────────────────────────────────────────────────────────────────
-
-    /**
-     * Lowest sustained HR during the in-bed window (bpm, rounded), or null.
-     *
-     * "Sustained" = the minimum of 5-minute non-overlapping bin means of the HR
-     * samples whose ts ∈ [start, end]. Rejects single-beat dips while capturing
-     * the night's true floor. Returns null when there are no HR samples in window.
-     *
-     * The window is CLOSED at both ends, so the binning is too: bins are `[t, t + windowS)` except
-     * the final one, which is `[t, end]`. Half-open bins alone would admit a sample sitting
-     * exactly on an aligned `end` through the prefilter and then place it in no bin — counted as
-     * data, silently ignored. A zero-length window (`start == end`) is that single closed bin.
-     *
-     * Artifact hardening (#686): a bin may only WIN the floor when it is BOTH well-populated
-     * (≥ [restingHRMinBinSamples], so one lone artifact beat can't be a bin "mean") AND
-     * physiologically plausible (mean ≥ [restingHRMinPlausibleBpm], rejecting dropout-driven
-     * sub-physiological dips). The floor DEFINITION is unchanged — still the minimum of the 5-min
-     * bin means — only artifact bins are barred from being that minimum. If no bin qualifies (a
-     * wholly sparse/degenerate window), fall back to the lowest of ALL bin means, else the
-     * all-sample mean, preserving the never-null-on-data behaviour. Mirrors Swift `restingHR`.
-     *
-     * @param start / @param end window bounds, unix SECONDS (Long).
-     */
-    fun restingHR(hr: List<HrSample>, start: Long, end: Long): Int? {
-        val seg = hr.filter { it.ts in start..end }
-        if (seg.isEmpty()) return null
-
-        val means = ArrayList<Double>()      // every bin mean (legacy floor, the fallback)
-        val qualified = ArrayList<Double>()  // bins eligible to WIN the floor (#686)
-        var t = start
-        do {
-            // The last bin (its half-open end reaches or passes `end`) closes on `end` instead,
-            // catching an endpoint sample the prefilter already admitted. `seg` holds nothing past
-            // `end`, so "everything from t onwards" IS [t, end]. `do` runs once for a zero-length
-            // window, where that single closed bin is the whole window.
-            val binEnd = t + restingHRWindowS
-            val isFinal = binEnd >= end
-            val win = seg.filter { it.ts >= t && (isFinal || it.ts < binEnd) }
-            if (win.isNotEmpty()) {
-                val mean = win.sumOf { it.bpm }.toDouble() / win.size.toDouble()
-                means.add(mean)
-                // A bin wins the floor only if it is well-populated AND physiologically plausible —
-                // a thin (single-artifact) or sub-physiological (dropout) bin can't be the minimum.
-                if (win.size >= restingHRMinBinSamples && mean >= restingHRMinPlausibleBpm) {
-                    qualified.add(mean)
-                }
-            }
-            t += restingHRWindowS
-        } while (t < end)
-        val floor: Double = qualified.minOrNull()
-            ?: means.minOrNull()
-            ?: (seg.sumOf { it.bpm }.toDouble() / seg.size.toDouble())
-        return floor.roundToInt()
-    }
-
-    // ─────────────────────────────────────────────────────────────────────────
-    // Recovery Index (overnight HR-decline slope)
-    // ─────────────────────────────────────────────────────────────────────────
-
-    /**
-     * Minimum 5-minute bins ([restingHR]'s SAME binning) required before a slope is trusted —
-     * below this, too little of the night has elapsed to fit a trend, and a 1-2-point
-     * regression is noise, not a night-long pattern. 6 bins = 30 minutes of binned coverage,
-     * a deliberately low floor so a short/partial night still gets a number rather than a
-     * routine null. Mirrors Swift `RecoveryScorer.recoveryIndexMinBins`.
-     */
-    const val recoveryIndexMinBins: Int = 6
-
-    /**
-     * Overnight resting-HR DECLINE slope (bpm/hour) across the in-bed window — the "Recovery
-     * Index" component of Oura's Readiness that Charge lacked (it previously only read the
-     * overnight FLOOR via [restingHR] above, never the trend that reaches it).
-     *
-     * Computed as the least-squares slope of the SAME non-overlapping 5-minute HR bin means
-     * [restingHR] uses ([restingHRWindowS]) against each bin's midpoint time (hours from
-     * `start`, and for the final closed bin still its half-open midpoint `t + windowS / 2`, so a
-     * partial or endpoint-only last bin keeps the same time axis as every other bin).
-     * NEGATIVE = declining (HR falling through the night — the physiologically
-     * expected, good pattern); POSITIVE = rising (restlessness, illness, alcohol, a late
-     * stimulant). Returns null when fewer than [recoveryIndexMinBins] bins have data (too
-     * little of the window to fit a trend) or there are no samples at all — it never
-     * fabricates a slope from a sliver of the night. Mirrors Swift `recoveryIndexSlope`.
-     *
-     * @param start / @param end window bounds, unix SECONDS (Long).
-     */
-    fun recoveryIndexSlope(hr: List<HrSample>, start: Long, end: Long): Double? {
-        val seg = hr.filter { it.ts in start..end }
-        if (seg.isEmpty()) return null
-
-        // Same non-overlapping 5-minute binning as restingHR: both read the identical
-        // underlying series, one as a floor, one as a trend across it.
-        val points = ArrayList<Pair<Double, Double>>() // (tHours, meanBpm)
-        var t = start
-        do {
-            // Final bin closes on `end` — same closed-window rule as restingHR, so an
-            // endpoint sample counts toward the bin gate instead of vanishing after admission.
-            val binEnd = t + restingHRWindowS
-            val isFinal = binEnd >= end
-            val win = seg.filter { it.ts >= t && (isFinal || it.ts < binEnd) }
-            if (win.isNotEmpty()) {
-                val mean = win.sumOf { it.bpm }.toDouble() / win.size.toDouble()
-                val midpointS = (t - start).toDouble() + restingHRWindowS / 2.0
-                points.add((midpointS / 3600.0) to mean)
-            }
-            t += restingHRWindowS
-        } while (t < end)
-        if (points.size < recoveryIndexMinBins) return null
-
-        // Least-squares slope: Σ((t−t̄)(y−ȳ)) / Σ((t−t̄)²), bpm per hour.
-        val n = points.size.toDouble()
-        val tBar = points.sumOf { it.first } / n
-        val yBar = points.sumOf { it.second } / n
-        var num = 0.0
-        var den = 0.0
-        for ((tHours, meanBpm) in points) {
-            val dt = tHours - tBar
-            num += dt * (meanBpm - yBar)
-            den += dt * dt
-        }
-        // Degenerate (all bins at the same instant): no time spread to fit against.
-        if (den <= 1e-9) return 0.0
-        return num / den
-    }
-
     // ─────────────────────────────────────────────────────────────────────────
     // Recovery band
     // ─────────────────────────────────────────────────────────────────────────
@@ -455,8 +303,8 @@ object RecoveryScorer {
      *   identical to the pre-skin-temp model).
      * @param hrvBaselineUsable whether the HRV baseline has enough nights
      *   (BaselineState.usable). When false, returns null (cold-start).
-     * @param recoveryIndexSlope overnight resting-HR DECLINE slope (bpm/hour, from
-     *   [recoveryIndexSlope]). Negative (declining) supports recovery; positive (rising)
+     * @param recoveryIndexSlope overnight resting-HR DECLINE slope (bpm/hour), supplied by the
+     *   caller. Negative (declining) supports recovery; positive (rising)
      *   limits it, weight [wRecoveryIndex]. null (the default) drops the term and the
      *   weights renormalize, so the no-slope score is IDENTICAL to before this parameter
      *   existed.
diff --git a/android/app/src/main/java/com/noop/analytics/SleepStager.kt b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
index 523122f34e..db7c390b50 100644
--- a/android/app/src/main/java/com/noop/analytics/SleepStager.kt
+++ b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
@@ -3079,18 +3079,30 @@ object SleepStager {
 
     // ── Per-session HR / HRV ─────────────────────────────────────────────────
 
-    /** Lowest 5-min rolling-mean HR during the session (bpm), or null. */
+    /**
+     * Lowest 5-min rolling-mean HR during the session (bpm), or null.
+     *
+     * The window is CLOSED at both ends, so the binning is too: bins are `[t, t + windowS)` except
+     * the final one, which is `[t, end]`. Half-open bins alone would admit a sample sitting exactly
+     * on an aligned `end` through the prefilter and then place it in no bin — counted as data,
+     * silently ignored. A zero-length window (`start == end`) is that single closed bin.
+     */
     internal fun sessionRestingHR(start: Long, end: Long, hr: List<HrSample>): Int? {
         val seg = hr.filter { it.ts in start..end }
         if (seg.isEmpty()) return null
         val windowS = 5 * 60L
         val means = ArrayList<Double>()
         var t = start
-        while (t < end) {
-            val win = seg.filter { it.ts >= t && it.ts < t + windowS }
+        do {
+            // The last bin (its half-open end reaches or passes `end`) closes on `end` instead,
+            // catching an endpoint sample the prefilter already admitted. `seg` holds nothing past
+            // `end`, so "everything from t onwards" IS [t, end]. `do` runs once for a zero-length
+            // window, where that single closed bin is the whole window.
+            val isFinal = t + windowS >= end
+            val win = seg.filter { it.ts >= t && (isFinal || it.ts < t + windowS) }
             if (win.isNotEmpty()) means.add(win.sumOf { it.bpm }.toDouble() / win.size.toDouble())
             t += windowS
-        }
+        } while (t < end)
         val m = means.minOrNull()
         if (m != null) return m.roundToInt()
         val all = seg.sumOf { it.bpm }.toDouble() / seg.size.toDouble()
@@ -3140,6 +3152,11 @@ object SleepStager {
      * Per-5-min-window RMSSD across a session, each window tagged with the sleep stage at its CENTER (from
      * [stages]) — the SINGLE source [sessionAvgHRV] averages, and the HRV test-mode nightly trace reads.
      * Passing `emptyList()` for [stages] tags every window "?" (the plain-average path doesn't need stages).
+     *
+     * Windows follow the same closed-window rule as [sessionRestingHR]: `[t, t + windowS)` except the final
+     * one, which is `[t, end]`, so a beat sitting exactly on an aligned `end` lands in a window instead of
+     * being admitted by the prefilter and then dropped. Window stage tagging and [HrvWindow.startTs] are
+     * unchanged — the final window keeps its half-open center `t + windowS / 2`.
      */
     internal fun sessionHrvWindows(
         start: Long, end: Long, rr: List<RrInterval>, stages: List<StageSegment>,
@@ -3153,8 +3170,12 @@ object SleepStager {
         val windowS = 5 * 60L
         val out = ArrayList<HrvWindow>()
         var t = start
-        while (t < end) {
-            val bucket = seg.filter { it.ts >= t && it.ts < t + windowS }.map { it.rrMs.toDouble() }
+        do {
+            // Final window closes on `end` — same closed-window rule as sessionRestingHR, so an
+            // endpoint beat counts instead of vanishing after admission. `do` runs once for a
+            // zero-length window, where that single closed window is the whole session.
+            val isFinal = t + windowS >= end
+            val bucket = seg.filter { it.ts >= t && (isFinal || it.ts < t + windowS) }.map { it.rrMs.toDouble() }
             // Full clean (range + Malik ectopic rejection), not just range — matches the
             // analyze() pipeline. The 0x2A37 RR on a WHOOP 5/MG is PPG-derived and noisier
             // than a 4.0's; rMSSD is built from SUCCESSIVE differences, so an un-rejected
@@ -3168,7 +3189,7 @@ object SleepStager {
             val stage = stages.firstOrNull { center >= it.start && center < it.end }?.stage ?: "?"
             out.add(HrvWindow(startTs = t, stage = stage, cleanBeats = cleaned.nn.size, rmssd = rmssd))
             t += windowS
-        }
+        } while (t < end)
         return out
     }
 
diff --git a/android/app/src/test/java/com/noop/analytics/RecoveryIndexActivityBalanceTest.kt b/android/app/src/test/java/com/noop/analytics/RecoveryIndexActivityBalanceTest.kt
index 13c06e442d..a5907b038e 100644
--- a/android/app/src/test/java/com/noop/analytics/RecoveryIndexActivityBalanceTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/RecoveryIndexActivityBalanceTest.kt
@@ -1,27 +1,20 @@
 package com.noop.analytics
 
-import com.noop.data.HrSample
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertNotEquals
-import org.junit.Assert.assertNotNull
-import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Test
 
 /**
- * Tests the two OPTIONAL Oura-Readiness-style Charge terms (#417): the Recovery-Index
- * overnight HR-decline slope and the Activity-Balance previous-day-Effort term, plus the
- * "strain" MetricCfg that backs the latter. Faithful Kotlin mirror of the #417 cases in
+ * Tests the two OPTIONAL Oura-Readiness-style Charge terms (#417) as recovery(...) consumes them:
+ * the Recovery-Index overnight HR-decline slope and the Activity-Balance previous-day-Effort term,
+ * plus the "strain" MetricCfg that backs the latter. Faithful Kotlin mirror of the #417 cases in
  * RecoveryScorerTests.swift / BaselinesTests.swift — same scenarios, same expected values,
  * byte-identical logic. Both terms are DORMANT (null-default); the central claim pinned here
  * is that every existing caller's score is byte-identical to before they existed.
  */
 class RecoveryIndexActivityBalanceTest {
 
-    private val dev = "test"
-
-    private fun hr(ts: Long, bpm: Int) = HrSample(deviceId = dev, ts = ts, bpm = bpm)
-
     /** A usable baseline with a given mean and Gaussian sigma (spread is internal abs-dev units). */
     private fun baseline(mean: Double, sigma: Double, nValid: Int = 14): BaselineState =
         BaselineState(
@@ -29,76 +22,6 @@ class RecoveryIndexActivityBalanceTest {
             status = if (nValid >= 14) BaselineStatus.TRUSTED else BaselineStatus.PROVISIONAL,
         )
 
-    /**
-     * A synthetic full-night HR series with a KNOWN injected slope: samples every 30 s for
-     * [hours] hours, bpm = startBpm + slopePerHour × elapsed-hours (rounded to the integer bpm
-     * the wire carries). Mirrors the Swift `slopeSeries` helper.
-     */
-    private fun slopeSeries(
-        startBpm: Double,
-        slopePerHour: Double,
-        hours: Int,
-    ): Triple<List<HrSample>, Long, Long> {
-        val originTs = 100_000L
-        val totalSeconds = hours * 3600
-        val samples = ArrayList<HrSample>()
-        var t = 0
-        while (t < totalSeconds) {
-            val bpm = startBpm + slopePerHour * (t.toDouble() / 3600.0)
-            samples.add(hr(originTs + t, Math.round(bpm).toInt()))
-            t += 30
-        }
-        return Triple(samples, originTs, originTs + totalSeconds)
-    }
-
-    // ── recoveryIndexSlope ───────────────────────────────────────────────────────
-
-    @Test
-    fun recoveryIndexSlopeNullWhenNoSamples() {
-        assertNull(RecoveryScorer.recoveryIndexSlope(emptyList(), 0L, 1000L))
-    }
-
-    @Test
-    fun recoveryIndexSlopeNullWhenTooFewBins() {
-        // Only 2 five-minute bins (10 minutes) of data — below recoveryIndexMinBins — too
-        // little of the night to fit a trend; must return null, never a fabricated slope.
-        val start = 5000L
-        val samples = ArrayList<HrSample>()
-        for (i in 0 until 300) samples.add(hr(start + i, 60))
-        for (i in 0 until 300) samples.add(hr(start + 300 + i, 55))
-        assertNull(RecoveryScorer.recoveryIndexSlope(samples, start, start + 600))
-    }
-
-    @Test
-    fun recoveryIndexSlopeRecoversMultipleDistinctInjectedSlopes() {
-        // Derived-signal rule: recover MULTIPLE distinct injected slopes, not one matched case.
-        // Four full-night (6 h) synthetic series: flat, mild decline, steep decline, rising.
-        val flat = slopeSeries(startBpm = 62.0, slopePerHour = 0.0, hours = 6)
-        val mild = slopeSeries(startBpm = 62.0, slopePerHour = -1.0, hours = 6)
-        val steep = slopeSeries(startBpm = 68.0, slopePerHour = -4.0, hours = 6)
-        val rising = slopeSeries(startBpm = 55.0, slopePerHour = 2.0, hours = 6)
-
-        val flatSlope = RecoveryScorer.recoveryIndexSlope(flat.first, flat.second, flat.third)
-        val mildSlope = RecoveryScorer.recoveryIndexSlope(mild.first, mild.second, mild.third)
-        val steepSlope = RecoveryScorer.recoveryIndexSlope(steep.first, steep.second, steep.third)
-        val risingSlope = RecoveryScorer.recoveryIndexSlope(rising.first, rising.second, rising.third)
-
-        assertNotNull(flatSlope); assertNotNull(mildSlope)
-        assertNotNull(steepSlope); assertNotNull(risingSlope)
-
-        // Each recovered slope is close to its OWN injected value (within integer-bpm rounding
-        // noise from the synthetic series), not just relatively ordered.
-        assertEquals(0.0, flatSlope!!, 0.3)
-        assertEquals(-1.0, mildSlope!!, 0.3)
-        assertEquals(-4.0, steepSlope!!, 0.3)
-        assertEquals(2.0, risingSlope!!, 0.3)
-
-        // And strictly ordered steep-decline < mild-decline < flat < rising.
-        assertTrue(steepSlope < mildSlope)
-        assertTrue(mildSlope < flatSlope)
-        assertTrue(flatSlope < risingSlope)
-    }
-
     // ── Recovery Index / Activity-Balance folded into recovery(...) ──────────────
 
     @Test
diff --git a/android/app/src/test/java/com/noop/analytics/RecoveryScorerRestingHrTest.kt b/android/app/src/test/java/com/noop/analytics/RecoveryScorerRestingHrTest.kt
deleted file mode 100644
index 3a65c72419..0000000000
--- a/android/app/src/test/java/com/noop/analytics/RecoveryScorerRestingHrTest.kt
+++ /dev/null
@@ -1,71 +0,0 @@
-package com.noop.analytics
-
-import com.noop.data.HrSample
-import org.junit.Assert.assertEquals
-import org.junit.Test
-
-/**
- * Tests RecoveryScorer.restingHR's artifact hardening (#686): the resting floor is the minimum of
- * 5-min bin means, but a thin (single-artifact) bin or a sub-physiological (dropout) bin must NOT
- * win that minimum. Faithful Kotlin mirror of the #686 cases in RecoveryScorerTests.swift — same
- * scenarios, same expected floors, byte-identical logic.
- */
-class RecoveryScorerRestingHrTest {
-
-    private val dev = "test"
-
-    private fun hr(ts: Long, bpm: Int) = HrSample(deviceId = dev, ts = ts, bpm = bpm)
-
-    @Test
-    fun rejectsSingleSampleArtifactBin() {
-        // A dense, well-populated bin at 55 bpm, then a SECOND 5-min bin holding exactly ONE
-        // artifact beat at 30 bpm. The old min-of-bin-means took the lone-sample bin (30) as the
-        // floor; with #686 a single-sample bin can't WIN, so the floor is the real 55.
-        val start = 1000L
-        val samples = ArrayList<HrSample>()
-        for (i in 0 until 300) samples.add(hr(start + i, 55)) // bin 0: 300 samples @55
-        samples.add(hr(start + 300, 30))                       // bin 1: ONE sample @30
-        val r = RecoveryScorer.restingHR(samples, start, start + 600)
-        assertEquals("a single-sample artifact bin must not win the resting floor", 55, r)
-    }
-
-    @Test
-    fun rejectsSubPhysiologicalDropoutBin() {
-        // Two FULLY-populated bins: a real 52 bpm bin and a dropout bin whose 300 samples all read
-        // an implausible 10 bpm. It clears the sample-count bar but is sub-physiological, so #686
-        // bars it from the floor → resting reads the real 52.
-        val start = 2000L
-        val samples = ArrayList<HrSample>()
-        for (i in 0 until 300) samples.add(hr(start + i, 52))         // real bin
-        for (i in 0 until 300) samples.add(hr(start + 300 + i, 10))   // dropout bin
-        val r = RecoveryScorer.restingHR(samples, start, start + 600)
-        assertEquals("a sub-physiological dropout bin must not win the resting floor", 52, r)
-    }
-
-    @Test
-    fun keepsGenuineLowFloor() {
-        // A REAL sustained dip (a full 5-min bin at 45 bpm) is plausible AND well-populated, so it
-        // still wins — the hardening must not flatten genuine athletic resting HRs.
-        val start = 3000L
-        val samples = ArrayList<HrSample>()
-        for (i in 0 until 300) samples.add(hr(start + i, 60))
-        for (i in 0 until 300) samples.add(hr(start + 300 + i, 45))
-        val r = RecoveryScorer.restingHR(samples, start, start + 600)
-        assertEquals("a genuine sustained low bin must still win the floor", 45, r)
-    }
-
-    @Test
-    fun fallsBackWhenNoBinQualifies() {
-        // A wholly sparse window: every bin holds a single sample (none clears the count bar).
-        // Rather than return null on data present, fall back to the legacy lowest-bin-mean (here 48).
-        val start = 4000L
-        val samples = listOf(hr(start + 10, 58), hr(start + 320, 48)) // two bins, one sample each
-        val r = RecoveryScorer.restingHR(samples, start, start + 600)
-        assertEquals("with no qualifying bin, fall back to the lowest bin mean (never null on data)", 48, r)
-    }
-
-    @Test
-    fun nullWhenNoSamples() {
-        assertEquals(null, RecoveryScorer.restingHR(emptyList(), 0L, 1000L))
-    }
-}
diff --git a/android/app/src/test/java/com/noop/analytics/RecoveryScorerWindowEndpointTest.kt b/android/app/src/test/java/com/noop/analytics/RecoveryScorerWindowEndpointTest.kt
deleted file mode 100644
index 89152842b8..0000000000
--- a/android/app/src/test/java/com/noop/analytics/RecoveryScorerWindowEndpointTest.kt
+++ /dev/null
@@ -1,147 +0,0 @@
-package com.noop.analytics
-
-import com.noop.data.HrSample
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNotNull
-import org.junit.Assert.assertNull
-import org.junit.Test
-
-/**
- * Tests the closed-window binning of RecoveryScorer.restingHR and RecoveryScorer.recoveryIndexSlope
- * Both prefilter ts ∈ [start, end] but binned as [t, t+300) up to `end`, so a sample sitting
- * exactly on an ALIGNED end was admitted and then belonged to no bin. The final bin now closes on
- * `end`.
- *
- * Parity: the expected values are the verbatim stdout of the standalone Swift oracle built from the
- * fixed Swift source (CLAUDE.md's byte-identical-by-oracle rule), not values read off this Kotlin
- * implementation. RecoveryScorerTests.swift pins the same scenarios on the Swift side.
- */
-class RecoveryScorerWindowEndpointTest {
-
-    private val dev = "test"
-
-    private fun hr(ts: Long, bpm: Int) = HrSample(deviceId = dev, ts = ts, bpm = bpm)
-
-    @Test
-    fun alignedEndpointSampleReachesABin() {
-        // The minimal case: start = 0, end = 300 (exactly one bin wide), five samples on
-        // the endpoint. This already returned 60 before the fix, but only because NO bin held
-        // anything and the all-sample fallback stepped in; it now flows through the bin path.
-        val samples = (0 until 5).map { hr(300L, 60) }
-        assertEquals(
-            "a sample exactly on an aligned end must belong to the final bin",
-            60, RecoveryScorer.restingHR(samples, 0L, 300L)
-        )
-    }
-
-    @Test
-    fun nonAlignedEndpointSampleReachesABin() {
-        // Paired non-aligned case: end = 450 falls mid-bin, so the endpoint sample was always
-        // inside the trailing partial bin. Same answer, before and after the fix.
-        val samples = (0 until 5).map { hr(450L, 60) }
-        assertEquals(
-            "a sample on a non-aligned end stays in the trailing partial bin",
-            60, RecoveryScorer.restingHR(samples, 0L, 450L)
-        )
-    }
-
-    @Test
-    fun endpointSampleLandsInFinalBinOnly() {
-        // The endpoint must join the LAST bin, not leak into earlier ones: a dense 70 bpm first bin
-        // plus five endpoint beats at 40 gives a floor of 40, while the 70 bpm bin is untouched.
-        // Before the fix the endpoint beats vanished and the floor read 70.
-        val samples = ArrayList<HrSample>()
-        for (i in 0 until 300) samples.add(hr(i.toLong(), 70))
-        for (i in 0 until 5) samples.add(hr(600L, 40))
-        assertEquals(
-            "the endpoint sample belongs to the final bin only",
-            40, RecoveryScorer.restingHR(samples, 0L, 600L)
-        )
-    }
-
-    @Test
-    fun degenerateZeroLengthWindow() {
-        // start == end: the single instant is one closed bin, and its mean is the same number the
-        // all-sample fallback produced before.
-        val samples = (0 until 5).map { hr(1000L, 58) }
-        assertEquals(58, RecoveryScorer.restingHR(samples, 1000L, 1000L))
-    }
-
-    @Test
-    fun restingHrEndpointSweepMatchesSwiftOracle() {
-        // `end` walks a whole bin width and beyond, in 25 s steps, against a dense 70 bpm opening
-        // bin plus five endpoint beats at 60. Verbatim Swift oracle stdout — this is the check that
-        // catches drift the eye does not, including the aligned end = 300 case where the single
-        // closed bin holds BOTH groups (mean 69.8 → 70).
-        val expected = listOf(
-            62, 68, 69, 69, 70, 70, 70, 70, 70, 70, 70, 70, 70,
-            60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60,
-            60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60
-        )
-        var i = 0
-        var endTs = 0L
-        while (endTs <= 900L) {
-            val samples = ArrayList<HrSample>()
-            for (s in 0 until 300) samples.add(hr(s.toLong(), 70))
-            for (s in 0 until 5) samples.add(hr(endTs, 60))
-            assertEquals(
-                "restingHR.end=$endTs", expected[i], RecoveryScorer.restingHR(samples, 0L, endTs)
-            )
-            i++
-            endTs += 25L
-        }
-    }
-
-    @Test
-    fun restingHrNullWithoutSamples() {
-        assertNull(RecoveryScorer.restingHR(emptyList(), 0L, 1000L))
-    }
-
-    @Test
-    fun recoveryIndexSlopeAlignedEndpointCompletesTheBinGate() {
-        // The bin-gate case: six samples over an aligned 30-minute window, the last exactly
-        // on `end`. Dropping it left five bins — one short of recoveryIndexMinBins — so the gate
-        // turned a complete window into null.
-        val samples = listOf(
-            hr(0L, 66), hr(300L, 64), hr(600L, 62), hr(900L, 60), hr(1200L, 58), hr(1800L, 54)
-        )
-        val slope = RecoveryScorer.recoveryIndexSlope(samples, 0L, 1800L)
-        assertNotNull("an admitted endpoint sample must count toward the bin gate", slope)
-        assertEquals(-27.428571428571423, slope!!, 1e-9)
-    }
-
-    @Test
-    fun recoveryIndexSlopeStillNullWithOnlyFiveBins() {
-        // The gate itself is unchanged: the same window without the endpoint sample has five bins
-        // and must stay null. Closing the final bin adds no bin where there is no sample.
-        val samples = listOf(hr(0L, 66), hr(300L, 64), hr(600L, 62), hr(900L, 60), hr(1200L, 58))
-        assertNull(RecoveryScorer.recoveryIndexSlope(samples, 0L, 1800L))
-    }
-
-    @Test
-    fun recoveryIndexSlopeNonAlignedEndpointCompletesTheBinGate() {
-        // Paired non-aligned case: end = 1750 sits mid-bin, so the endpoint sample was already in
-        // the trailing partial bin. Same slope as the aligned case (identical bin midpoints).
-        val samples = listOf(
-            hr(0L, 66), hr(300L, 64), hr(600L, 62), hr(900L, 60), hr(1200L, 58), hr(1750L, 54)
-        )
-        val slope = RecoveryScorer.recoveryIndexSlope(samples, 0L, 1750L)
-        assertNotNull(slope)
-        assertEquals(-27.428571428571423, slope!!, 1e-9)
-    }
-
-    @Test
-    fun recoveryIndexSlopeFullNightUnchanged() {
-        // A full 6 h night has no sample on `end`, so the endpoint rule must not move it: the
-        // oracle's slope for a −2 bpm/hour synthetic night, to the last digit.
-        val samples = ArrayList<HrSample>()
-        var s = 0L
-        while (s < 6 * 3600L) {
-            samples.add(hr(s, Math.round(62.0 - 2.0 * s.toDouble() / 3600.0).toInt()))
-            s += 30L
-        }
-        val slope = RecoveryScorer.recoveryIndexSlope(samples, 0L, 6 * 3600L)
-        assertNotNull(slope)
-        assertEquals(-2.0071001350569166, slope!!, 1e-9)
-    }
-}
diff --git a/android/app/src/test/java/com/noop/analytics/SleepStagerWindowEndpointTest.kt b/android/app/src/test/java/com/noop/analytics/SleepStagerWindowEndpointTest.kt
new file mode 100644
index 0000000000..69ef8e7a65
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/SleepStagerWindowEndpointTest.kt
@@ -0,0 +1,133 @@
+package com.noop.analytics
+
+import com.noop.data.HrSample
+import com.noop.data.RrInterval
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+/**
+ * Tests the closed-window binning of the SHIPPED per-session HR/HRV path,
+ * SleepStager.sessionRestingHR and SleepStager.sessionHrvWindows.
+ *
+ * Both prefilter ts ∈ [start, end] but binned as [t, t+300) with a loop stopping at `end`, so a
+ * sample sitting exactly on an ALIGNED end was admitted and then belonged to no window. The final
+ * bin now closes on `end` — the same rule RecoveryScorer already carries. Each case is paired with
+ * a non-aligned twin that was always correct.
+ *
+ * Parity: the expected values are the verbatim stdout of a standalone Swift oracle built from the
+ * fixed Swift binning (CLAUDE.md's byte-identical-by-oracle rule), not values read off this Kotlin
+ * implementation. SleepStagerTests.swift pins the same scenarios on the Swift side.
+ */
+class SleepStagerWindowEndpointTest {
+
+    private val dev = "test"
+
+    private fun hr(ts: Long, bpm: Int) = HrSample(deviceId = dev, ts = ts, bpm = bpm)
+
+    private fun rr(ts: Long, rrMs: Int) = RrInterval(deviceId = dev, ts = ts, rrMs = rrMs)
+
+    @Test
+    fun alignedEndpointSampleReachesABin() {
+        // Minimal case: start = 0, end = 300 (one window wide), five samples on the endpoint.
+        // Already returned 60 before the fix, but only via the all-sample fallback.
+        val samples = (0 until 5).map { hr(300L, 60) }
+        assertEquals(
+            "a sample exactly on an aligned end must belong to the final bin",
+            60, SleepStager.sessionRestingHR(0L, 300L, samples)
+        )
+    }
+
+    @Test
+    fun nonAlignedEndpointSampleReachesABin() {
+        // Paired non-aligned case: end = 450 falls mid-window, so the endpoint sample was always
+        // inside the trailing partial bin. Same answer, before and after.
+        val samples = (0 until 5).map { hr(450L, 60) }
+        assertEquals(
+            "a sample on a non-aligned end stays in the trailing partial bin",
+            60, SleepStager.sessionRestingHR(0L, 450L, samples)
+        )
+    }
+
+    @Test
+    fun endpointSampleLandsInFinalBinOnly() {
+        // Where the fallback cannot hide the dropped sample: a dense 70 bpm first bin plus five
+        // endpoint beats at 40 makes the floor 40. Before the fix the shipped resting HR read 70.
+        val samples = ArrayList<HrSample>()
+        for (i in 0 until 300) samples.add(hr(i.toLong(), 70))
+        for (i in 0 until 5) samples.add(hr(600L, 40))
+        assertEquals(
+            "the endpoint sample belongs to the final bin only",
+            40, SleepStager.sessionRestingHR(0L, 600L, samples)
+        )
+    }
+
+    @Test
+    fun degenerateZeroLengthWindow() {
+        // start == end: the single instant is one closed bin — the same number the all-sample
+        // fallback produced before.
+        val samples = (0 until 5).map { hr(1000L, 58) }
+        assertEquals(58, SleepStager.sessionRestingHR(1000L, 1000L, samples))
+    }
+
+    @Test
+    fun sessionRestingHrEndpointSweepMatchesSwiftOracle() {
+        // `end` walks a whole window width and beyond in 25 s steps against a dense 70 bpm opening
+        // bin plus five endpoint beats at 60. Verbatim Swift oracle stdout — the check that catches
+        // drift the eye does not, including end = 300 where the single closed bin holds BOTH groups.
+        val expected = listOf(
+            62, 68, 69, 69, 70, 70, 70, 70, 70, 70, 70, 70, 70,
+            60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60,
+            60, 60, 60, 60, 60, 60, 60, 60, 60, 60, 60
+        )
+        var i = 0
+        var endTs = 0L
+        while (endTs <= 900L) {
+            val samples = ArrayList<HrSample>()
+            for (s in 0 until 300) samples.add(hr(s.toLong(), 70))
+            for (s in 0 until 5) samples.add(hr(endTs, 60))
+            assertEquals(
+                "sessionRestingHR.end=$endTs", expected[i], SleepStager.sessionRestingHR(0L, endTs, samples)
+            )
+            i++
+            endTs += 25L
+        }
+    }
+
+    @Test
+    fun alignedEndpointBeatsFillTheFinalHrvWindow() {
+        // 120 beats in the opening window plus three beats exactly on an aligned end = 600. The
+        // second window is the final one, so it closes on `end` and holds those three beats; before
+        // the fix it was emitted empty and its RMSSD was null. Constant 900 ms RR keeps the RMSSD
+        // analytically 0.0 on both platforms — this pins the BINNING, not the RMSSD math.
+        val beats = ArrayList<RrInterval>()
+        for (i in 0 until 120) beats.add(rr(i.toLong(), 900))
+        for (i in 0 until 3) beats.add(rr(600L, 900))
+        val wins = SleepStager.sessionHrvWindows(0L, 600L, beats, emptyList())
+        assertEquals(listOf(0L, 300L), wins.map { it.startTs })
+        assertEquals(
+            "the endpoint beats must fill the final window",
+            listOf(120, 3), wins.map { it.cleanBeats }
+        )
+        assertEquals(listOf(0.0, 0.0), wins.map { it.rmssd })
+    }
+
+    @Test
+    fun nonAlignedEndpointHrvWindowUnchanged() {
+        // Paired non-aligned case: end = 450 sits mid-window, so the endpoint beats were already
+        // inside the trailing partial window. Same shape, before and after.
+        val beats = ArrayList<RrInterval>()
+        for (i in 0 until 120) beats.add(rr(i.toLong(), 900))
+        for (i in 0 until 3) beats.add(rr(450L, 900))
+        val wins = SleepStager.sessionHrvWindows(0L, 450L, beats, emptyList())
+        assertEquals(listOf(0L, 300L), wins.map { it.startTs })
+        assertEquals(listOf(120, 3), wins.map { it.cleanBeats })
+    }
+
+    @Test
+    fun sessionAvgHrvZeroLengthWindowUsesTheEndpointBeats() {
+        // The value-level consequence: a zero-length window (start == end) is one closed bin, so
+        // beats admitted by the prefilter produce a number instead of null.
+        val beats = (0 until 3).map { rr(1000L, 900) }
+        assertEquals(0.0, SleepStager.sessionAvgHRV(1000L, 1000L, beats)!!, 1e-9)
+    }
+}
diff --git a/docs/ANALYTICS.md b/docs/ANALYTICS.md
index 5c326993fd..38c452fce2 100644
--- a/docs/ANALYTICS.md
+++ b/docs/ANALYTICS.md
@@ -188,9 +188,9 @@ HRV is the dominant driver, and NOOP needs a few nights to learn your personal b
 | yellow | `34 … 67` |
 | green | `≥ 67` |
 
-### Resting HR (`restingHR`)
+### Resting HR
 
-"Lowest sustained HR" during the in-bed window = the **minimum of 5-minute non-overlapping bin means** of HR samples in `[start, end]`. This rejects single-beat dips while capturing the night's true floor. The window is closed at both ends, so the bins are `[t, t + 300)` except the last one, which closes on `end` — a sample sitting exactly on an aligned `end` belongs to that final bin.
+`recovery(...)` takes the sleeping resting HR as an input; it does not compute one. The number the apps show comes from the sleep path — see [Per-session resting HR and HRV](#per-session-resting-hr-and-hrv).
 
 ---
 
@@ -329,6 +329,14 @@ Consecutive same-stage epochs are merged into `StageSegment`s tiling `[start, en
 - `SleepSession` — `start`, `end`, `efficiency` (AASM `asleep / in-bed`, where `asleep = in-bed − wake`), `stages`, per-session `restingHR` (lowest 5-min rolling-mean HR) and `avgHRV` (mean RMSSD over 5-min tumbling windows).
 - `hypnogramMetrics(_:)` — AASM-style roll-up: TIB / TST / SPT / SOL / REM latency / WASO / efficiency / disturbances, plus deep/REM/light minutes and percentages.
 
+### Per-session resting HR and HRV
+
+`sessionRestingHR` is the **minimum of 5-minute non-overlapping bin means** of the HR samples in `[start, end]` — "lowest sustained HR", which rejects single-beat dips while capturing the night's true floor. With no bin populated it falls back to the all-sample mean, so a session with data never scores nil. `sessionHrvWindows` tumbles the same 5-minute grid over the RR series, cleans each bucket (range filter + Malik ectopic rejection, gap-aware) and emits one window per bin tagged with the stage at its center; `sessionAvgHRV` is the mean of those window RMSSDs. These two are the shipped source of the per-session `restingHR` / `avgHRV`, of the HRV nightly trace and of the last-deep-run comparator.
+
+**Window endpoint rule.** The session window is closed at both ends, so the binning is too: bins are `[t, t + 300)` except the last one, which is `[t, end]`. A sample or beat sitting exactly on an aligned `end` passes the `[start, end]` prefilter, so it must land in a bin rather than be admitted and then dropped. A zero-length window (`start == end`) is that single closed bin. Bin start times, the stage-tagging center and the RMSSD math are unaffected.
+
+Because these two functions are the shipped path, the rule can move a displayed number on a night whose session length is an exact multiple of 300 s with a sample on `end`: per-session `restingHR`/`avgHRV` and the HRV trace. Stored rows keep the old value until that night is re-scored (`MetricsCache` overwrites both on every recompute).
+
 ### Motion-corroborated wake — elevated-but-motionless HR is not wake (default ON)
 
 Both stagers (`SleepStager` V1 and the default `SleepStagerV2`) and the HR-led session confirmation (`confirmSleepWithHR`) previously called **wake** primarily off HR / HR-variability with no motion or posture cross-check. On a night whose resting HR is held elevated **without the wearer getting up** — a supplement protocol, a fever, a hot room, alcohol — that logic scored hot-but-motionless sleep as wake, over-calling WASO, mis-placing onset, and tanking efficiency and Rest. Two confirmed nights required manual relabeling (2026-07-13: 194 min WAKE vs ~67; 2026-07-14: onset 1:41 vs ~1:29 plus a 44-min WAKE block).
diff --git a/docs/LIBRARY.md b/docs/LIBRARY.md
index 93a50b1f2c..288c3bb41d 100644
--- a/docs/LIBRARY.md
+++ b/docs/LIBRARY.md
@@ -352,7 +352,7 @@ targets: [
 | Type | Entry points |
 |---|---|
 | `HRVAnalyzer` | `analyze(_:windowStart:windowEnd:)` and `analyze(rawRR:)` → `HRVResult` (RMSSD, SDNN, meanNN, pNN50). Range filter [300, 2000] ms + Malik 20%-local-median ectopic rejection; needs ≥ 20 clean beats. |
-| `RecoveryScorer` | `restingHR(_:start:end:)`; `recovery(...)` → 0–100 (HRV-dominant z-score + logistic composite); `band(_:)` → `"red"`/`"yellow"`/`"green"`. |
+| `RecoveryScorer` | `recovery(...)` → 0–100 (HRV-dominant z-score + logistic composite); `band(_:)` → `"red"`/`"yellow"`/`"green"`. |
 | `StrainScorer` | `strain(_:maxHR:restingHR:method:sex:denominator:)` → 0–21 (Edwards/Banister TRIMP, log-mapped); `tanakaHRmax(age:)`, `estimateHRmax(_:age:)`, `trimpToStrain(_:)`. |
 | `HRZones` | `zones(age:maxHROverride:)` → `HRZoneSet`; `timeInZone(_:zoneSet:)` → `TimeInZone`. |
 | `Baselines` | `update(_:value:cfg:)` → `BaselineState` (Winsorized-EWMA personal baselines + `BaselineStatus`); standard `metricCfg` for HRV / resting HR / resp / skin temp. |

From 7ec7e7780a41b7e7045739321c5897e99242454a Mon Sep 17 00:00:00 2001
From: Zebsi <66969936+Zebsi235@users.noreply.github.com>
Date: Mon, 7 Sep 2026 00:26:11 +0200
Subject: [PATCH 295/333] =?UTF-8?q?ecg:=20the=20pure=20research=20modules?=
 =?UTF-8?q?=20=E2=80=94=20allow-list,=20stats=20and=20log?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Split 3 of the MG ECG research series. Three self-contained Kotlin modules under
com.noop.protocol, with no caller yet: an allow-list of the opcodes a research
probe may send plus a census of those it must never form, windowed scoring of a
probe run, and the typed capture record with its CSV shape.

Database-free, no Android framework types, no BLE, so they are unit-testable
without a strap and reviewable on their own. Opcodes come from Whoop5Ecg's
constants and labels from the CommandNames table; no literals.

The allow-list is deliberately NOT wired to the send path here. Wiring it widens
what CommandNumber can express, and upstream excluded the Labrador opcodes on
purpose, so making that untrue deserves its own review with this census as the
argument.

Verified on review rather than taken on trust. All 19 FORBIDDEN entries were
checked name against number in whoop_protocol.json, covering firmware load, DFU,
wipe, reboot, high-frequency sync and AFE writes: zero mismatches. Most are not
in the curated CommandNumber table at all, which is what the census is for. The
probe and forbidden sets are disjoint, and nothing in production reaches any of
these modules.

One change folded in before merge. estimateBpm's artefact guard was an optional
parameter defaulting to null, so the shortest call, estimateBpm(samples, fs),
silently selected the unguarded form. Measured on a tiled 101-sample record at
100 Hz carrying no rhythm at all, that form returns 59: a believable resting
heart rate manufactured from nothing, which is the withdrawn PPG->HR failure
exactly and the failure this method's whole shape exists to avoid. The guard
itself is right and free, returning null on that buffer and 72 on a genuine
72 bpm sine either way, so the parameter simply lost its default. The compiler
then found nine call sites that had never made the choice, six of them taking
the unguarded path without saying so; all now state it.

The estimator is NOT validated against a real moving heart rate, it feeds
nothing, and it sits behind no UI. That is the standing lesson from the
withdrawn estimate and it stays open.

The Swift twin is deliberately absent: Apple drives its probe through
WhoopCommand and BLEManager and has no consumer for these modules, and the log's
CSV shape is written as the contract a future Swift export would match.

Investigated and implemented by @Zebsi235. Android suite 5466 green across 657
classes, including nine allow-list, eleven log, nine stats and seven estimator
cases.
---
 .../com/noop/protocol/EcgResearchAllowList.kt | 110 ++++++
 .../java/com/noop/protocol/EcgResearchLog.kt  | 371 ++++++++++++++++++
 .../com/noop/protocol/EcgResearchStats.kt     | 256 ++++++++++++
 .../com/noop/protocol/EcgBpmEstimatorTest.kt  | 133 +++++++
 .../noop/protocol/EcgResearchAllowListTest.kt | 100 +++++
 .../com/noop/protocol/EcgResearchLogTest.kt   | 191 +++++++++
 .../com/noop/protocol/EcgResearchStatsTest.kt | 125 ++++++
 7 files changed, 1286 insertions(+)
 create mode 100644 android/app/src/main/java/com/noop/protocol/EcgResearchAllowList.kt
 create mode 100644 android/app/src/main/java/com/noop/protocol/EcgResearchLog.kt
 create mode 100644 android/app/src/main/java/com/noop/protocol/EcgResearchStats.kt
 create mode 100644 android/app/src/test/java/com/noop/protocol/EcgBpmEstimatorTest.kt
 create mode 100644 android/app/src/test/java/com/noop/protocol/EcgResearchAllowListTest.kt
 create mode 100644 android/app/src/test/java/com/noop/protocol/EcgResearchLogTest.kt
 create mode 100644 android/app/src/test/java/com/noop/protocol/EcgResearchStatsTest.kt

diff --git a/android/app/src/main/java/com/noop/protocol/EcgResearchAllowList.kt b/android/app/src/main/java/com/noop/protocol/EcgResearchAllowList.kt
new file mode 100644
index 0000000000..9b34098810
--- /dev/null
+++ b/android/app/src/main/java/com/noop/protocol/EcgResearchAllowList.kt
@@ -0,0 +1,110 @@
+package com.noop.protocol
+
+/**
+ * #891 / #1100: the ALLOW-LIST that bounds what the MG ECG Research panel may put on the wire, and the
+ * named DENY-LIST of opcodes it must never be able to form.
+ *
+ * ## Why an allow-list, and why here
+ *
+ * The research panel exists to gather protocol evidence about the MG's ECG ("Labrador") subsystem — NOT to
+ * sweep the command space. The single most dangerous thing a hand-run ECG probe could do is wander into a
+ * neighbouring opcode: `TOGGLE_LABRADOR_FILTERED` is **139 (0x8B)**, and three codes above it sit
+ * **142/143/144 — `START_FIRMWARE_LOAD_NEW` / `LOAD_FIRMWARE_DATA_NEW` / `PROCESS_FIRMWARE_IMAGE_NEW`**, the
+ * destructive firmware-load family (`docs/PROTOCOL.md` §9.1). So this file states the *entire* set of
+ * opcodes the panel can dispatch as a literal, testable predicate, rather than trusting a UI never to build
+ * anything else.
+ *
+ * This mirrors the discipline the rest of the 5/MG send path already follows — `DeviceConfigWriteGate`
+ * (key-aware SET allow-list), `DeviceConfigReadProbe.isReadOnlyOpcode`, `FeatureFlagWriteGate`. Like those,
+ * it is a pure predicate the real BLE send path consults ([WhoopBleClient.ecgSendAdmitted] calls
+ * [isProbeOpcode]), so a unit test proving this rejects an opcode is proving it about the wire path and not
+ * a parallel copy of the rule.
+ *
+ * Pure: no Android, no I/O. Twin-free — Android is the platform growing an ECG *app* layer first (the Apple
+ * probe drives the same four opcodes but expresses its allow-list inline in `BLEManager.send`).
+ */
+object EcgResearchAllowList {
+
+    // ---- The four ECG ("Labrador") probe opcodes — the ONLY commands the panel dispatches ----------
+
+    /**
+     * The four opcodes the panel may send, each a documented WORKING HYPOTHESIS (not a confirmed mapping —
+     * see `docs/PROTOCOL.md` §9.1). Every one is a plain toggle/config write with a `[revision, arg]`
+     * payload; none loads firmware, wipes flash, or resets a bond. Kept in [Whoop5Ecg] so the numbers live
+     * with the command builders and this set can never drift from what [Whoop5Ecg.commandFrame] forms.
+     */
+    val PROBE_OPCODES: Set<Int> = setOf(
+        Whoop5Ecg.SELECT_WRIST_CMD,                      // 123 (0x7B) — PERSISTENT wrist config (own action)
+        Whoop5Ecg.TOGGLE_REALTIME_FILTERED_ECG_CMD,      // 139 (0x8B) — live filtered stream toggle
+        Whoop5Ecg.TOGGLE_SAVE_RAW_ECG_CMD,               // 125 (0x7D) — persist-to-flash toggle
+        Whoop5Ecg.MAIN_CONTROL_ECG_DATA_GENERATION_CMD,  // 124 (0x7C) — start/stop generation
+    )
+
+    /**
+     * The two DEVICE-CONFIG opcodes the panel's persistent `enable_raw_data_w_ecg` gate uses — a WRITE
+     * (119) and its mandatory read-back (121). These are NOT dispatched as ECG commands; they go through
+     * the pre-existing, key-aware [DeviceConfigWriteGate] path ([WhoopBleClient.setEcgRawDataGate]). Named
+     * here only so a reader sees the panel's complete wire surface in one place.
+     */
+    val GATE_OPCODES: Set<Int> = setOf(
+        DeviceConfigWriteGate.SET_DEVICE_CONFIG_VALUE_CMD,   // 119 (0x77)
+        DeviceConfigWriteGate.GET_DEVICE_CONFIG_VALUE_CMD,   // 121 (0x79)
+    )
+
+    /** True only for one of the four ECG probe opcodes. The predicate the BLE send allow-list consults. */
+    fun isProbeOpcode(opcode: Int): Boolean = opcode in PROBE_OPCODES
+
+    /** True for the two device-config gate opcodes (write + read-back). */
+    fun isGateOpcode(opcode: Int): Boolean = opcode in GATE_OPCODES
+
+    /** The complete set of opcodes reachable from the panel, ECG toggles plus the gate's two verbs. */
+    val DISPATCHABLE_OPCODES: Set<Int> = PROBE_OPCODES + GATE_OPCODES
+
+    // ---- The deny-list: opcodes this panel must NEVER be able to form (Phase 11) -------------------
+
+    /**
+     * Named dangerous / persistent-state / recovery-defeating opcodes the ECG research panel must never
+     * dispatch. This is defence-in-depth documentation, NOT the enforcement mechanism — enforcement is the
+     * positive allow-list ([isProbeOpcode]); nothing here can be sent because it is not in [PROBE_OPCODES],
+     * and most are not even in the curated [CommandNumber] SENDER enum so no builder can express them.
+     *
+     * Listed (rather than merely omitted) so a unit test can assert every one of them is refused by
+     * [isProbeOpcode] and is absent from [DISPATCHABLE_OPCODES] — the "no opcode sweep, no DFU" guarantee
+     * made checkable. Values are the schema numbers from [CommandNames].
+     */
+    val FORBIDDEN: Map<Int, String> = mapOf(
+        // Firmware load / DFU — the family that sits just above 139 in opcode space, and the reason an
+        // ECG sweep is dangerous. NOOP's curated CommandNumber enum omits all of these entirely.
+        36 to "START_FIRMWARE_LOAD",
+        37 to "LOAD_FIRMWARE_DATA",
+        38 to "PROCESS_FIRMWARE_IMAGE",
+        45 to "ENTER_BLE_DFU",
+        83 to "VERIFY_FIRMWARE_IMAGE",
+        142 to "START_FIRMWARE_LOAD_NEW",
+        143 to "LOAD_FIRMWARE_DATA_NEW",
+        144 to "PROCESS_FIRMWARE_IMAGE_NEW",
+        // Data-wipe / fuel-gauge / factory-adjacent.
+        25 to "FORCE_TRIM",
+        99 to "RESET_FUEL_GAUGE",
+        100 to "CALIBRATE_CAPSENSE",
+        // Reboot / power-cycle — recovery is via the app's ordinary reconnect, never a strap reset from
+        // this panel.
+        29 to "REBOOT_STRAP",
+        32 to "POWER_CYCLE_STRAP",
+        // High-frequency sync entry — an uncertain, battery-heavy mode NOOP deliberately never enters
+        // (docs/PROTOCOL.md note on 96); the panel does not offer it.
+        96 to "ENTER_HIGH_FREQ_SYNC",
+        97 to "EXIT_HIGH_FREQ_SYNC",
+        // Optical / AFE / bias front-end writes — persistent sensor calibration, out of scope for ECG.
+        39 to "SET_LED_DRIVE",
+        41 to "SET_TIA_GAIN",
+        43 to "SET_BIAS_OFFSET",
+        61 to "SET_AFE_PARAMETERS",
+    )
+
+    /** True if [opcode] is a named-forbidden opcode. Used by the census test; never a dispatch input. */
+    fun isForbidden(opcode: Int): Boolean = FORBIDDEN.containsKey(opcode)
+
+    /** Schema label for any opcode, e.g. `"TOGGLE_LABRADOR_FILTERED(139)"`, for logs/reports. */
+    fun label(opcode: Int): String = CommandNames.label(opcode)
+}
diff --git a/android/app/src/main/java/com/noop/protocol/EcgResearchLog.kt b/android/app/src/main/java/com/noop/protocol/EcgResearchLog.kt
new file mode 100644
index 0000000000..b687088b6c
--- /dev/null
+++ b/android/app/src/main/java/com/noop/protocol/EcgResearchLog.kt
@@ -0,0 +1,371 @@
+package com.noop.protocol
+
+/**
+ * #891 / #1100: the PURE in-memory record of one MG ECG research capture — every TX/RX/command/marker row,
+ * plus the serializers that turn them into the export bundle's CSV/JSON/README files.
+ *
+ * No Android, no I/O, no clock of its own: the caller ([com.noop.ble.EcgResearchSession]) supplies both a
+ * monotonic and a wall-clock timestamp for every row, so the whole model is deterministic and unit-tested
+ * without a strap or a device. The Android wrapper owns the file writing and the clocks; this owns the
+ * shape of the evidence.
+ *
+ * Volume: an ECG capture must NOT sample away high-rate packets (#891), so every inbound frame is kept.
+ * Appends are O(1) (a row holds raw bytes, hex-encoded only at serialize time) so they never block the BLE
+ * callback thread. A safety cap ([maxRxRows]) bounds worst-case memory; frames past it are COUNTED
+ * ([rxOverflow]) and reported in `stats.json`, never silently dropped.
+ *
+ * Not medical: this records protocol bytes and user-set physical markers. It never records or derives a
+ * clinical interpretation — the on-strap rhythm classifier byte is decoded elsewhere and never surfaced as
+ * a finding.
+ */
+class EcgResearchLog(
+    val sessionId: String,
+    val startWallMs: Long,
+    val startMonotonicMs: Long,
+    private val maxRxRows: Int = DEFAULT_MAX_RX_ROWS,
+    private val maxRxBytes: Long = DEFAULT_MAX_RX_BYTES,
+) {
+    companion object {
+        /** ~ enough for many minutes of a high-rate stream; past this, frames are counted not stored. */
+        const val DEFAULT_MAX_RX_ROWS = 200_000
+
+        /**
+         * Bytes of inbound payload a capture will hold. A row cap alone does not bound memory: 200,000 rows
+         * of 240-byte records is ~48 MB of payload before object overhead, and an offload can deliver frames
+         * far faster than a UI can notice, so a capture left running through a long sync could push the app
+         * to an OOM. Whichever cap is reached first stops storage; the drops are counted either way.
+         */
+        const val DEFAULT_MAX_RX_BYTES = 24L * 1024 * 1024
+
+        /** #891 flagged a repeated 1,584-byte record as a candidate raw ECG block. */
+        const val CANDIDATE_RAW_RECORD_SIZE = 1584
+
+        /** Samples `waveform.csv` will emit before truncating — and it SAYS it truncated, in the file. */
+        const val WAVEFORM_CSV_SAMPLE_CAP = 60_000
+    }
+
+    // ---- Row types ---------------------------------------------------------------------------------
+
+    /** An experimental command written to the strap (Phase 4 TX fields). */
+    data class TxRow(
+        val monotonicMs: Long,
+        val wallMs: Long,
+        val opcode: Int,
+        val payload: ByteArray,
+        val frame: ByteArray,
+        val serviceUuid: String,
+        val characteristicUuid: String,
+        val writeType: String,
+    )
+
+    /** An inbound BLE notification/read during the capture (Phase 4 RX fields). */
+    data class RxRow(
+        val monotonicMs: Long,
+        val wallMs: Long,
+        val serviceUuid: String,
+        val characteristicUuid: String,
+        val payload: ByteArray,
+        val packetType: Int?,
+        val sequence: Int?,
+        val recognized: Boolean,
+        val rejected: Boolean,
+        /** The frame's CRC verdict, or null when there was nothing to check (the house `crcOk != false`
+         *  idiom). A CRC FAILURE is recorded, not dropped: for a research capture a corrupt frame is
+         *  evidence, and dropping it would make "the strap sent nothing" indistinguishable from "the app threw it
+         *  away". No decoder reads a row whose verdict is false. */
+        val crcOk: Boolean? = null,
+    )
+
+    /** The result of one allow-listed experimental command: outcome + timing + raw ack. */
+    data class CommandRow(
+        val monotonicMs: Long,
+        val wallMs: Long,
+        val opcode: Int,
+        val argHex: String,
+        val statusLevel: String,       // Confirmed / Observed / Hypothesized
+        val persistence: String,       // persistent / session
+        val ackResult: String?,        // SUCCESS(1) etc.
+        val ackRawHex: String?,
+        val elapsedToAckMs: Long?,
+    )
+
+    /** A user marker or connection event (Phase 5). */
+    data class EventRow(
+        val monotonicMs: Long,
+        val wallMs: Long,
+        val kind: String,
+        val detail: String,
+    )
+
+    /** A raw write-callback status (Phase 4 write callback status). */
+    data class WriteStatusRow(val monotonicMs: Long, val wallMs: Long, val characteristicUuid: String, val status: Int)
+
+    // ---- Storage -----------------------------------------------------------------------------------
+
+    private val lock = Any()
+    private val _tx = ArrayList<TxRow>()
+    private val _rx = ArrayList<RxRow>()
+    private val _commands = ArrayList<CommandRow>()
+    private val _events = ArrayList<EventRow>()
+    private val _writeStatus = ArrayList<WriteStatusRow>()
+
+    /** Inbound frames dropped by the [maxRxRows]/[maxRxBytes] safety caps (reported, never silent). */
+    var rxOverflow: Long = 0L
+        private set
+
+    /** Stored inbound payload bytes, against [maxRxBytes]. */
+    var rxBytes: Long = 0L
+        private set
+
+    val txRows: List<TxRow> get() = synchronized(lock) { _tx.toList() }
+    val rxRows: List<RxRow> get() = synchronized(lock) { _rx.toList() }
+    val commandRows: List<CommandRow> get() = synchronized(lock) { _commands.toList() }
+    val eventRows: List<EventRow> get() = synchronized(lock) { _events.toList() }
+
+    val txCount: Int get() = synchronized(lock) { _tx.size }
+    val rxCount: Int get() = synchronized(lock) { _rx.size }
+    val commandCount: Int get() = synchronized(lock) { _commands.size }
+    val eventCount: Int get() = synchronized(lock) { _events.size }
+
+    // ---- Recording ---------------------------------------------------------------------------------
+
+    fun recordTx(row: TxRow) = synchronized(lock) { _tx.add(row) }
+
+    fun recordRx(row: RxRow) = synchronized(lock) {
+        if (_rx.size >= maxRxRows || rxBytes + row.payload.size > maxRxBytes) { rxOverflow++; return@synchronized }
+        _rx.add(row)
+        rxBytes += row.payload.size
+    }
+
+    fun recordCommand(row: CommandRow) = synchronized(lock) { _commands.add(row) }
+
+    fun recordEvent(row: EventRow) = synchronized(lock) { _events.add(row) }
+
+    fun recordWriteStatus(row: WriteStatusRow) = synchronized(lock) { _writeStatus.add(row) }
+
+    // ---- Derived stats input -----------------------------------------------------------------------
+
+    private fun rxRecords(): List<EcgResearchStats.RxRecord> = synchronized(lock) {
+        _rx.map {
+            EcgResearchStats.RxRecord(
+                monotonicMs = it.monotonicMs,
+                characteristic = shortUuid(it.characteristicUuid),
+                payload = it.payload,
+                packetType = it.packetType,
+                recognized = it.recognized,
+            )
+        }
+    }
+
+    // ---- Serializers -------------------------------------------------------------------------------
+
+    fun eventsCsv(): String {
+        val sb = StringBuilder("monotonic_ms,wall_iso,kind,detail\n")
+        for (e in eventRows) {
+            sb.append(e.monotonicMs).append(',').append(iso(e.wallMs)).append(',')
+                .append(csv(e.kind)).append(',').append(csv(e.detail)).append('\n')
+        }
+        return sb.toString()
+    }
+
+    fun bleTxCsv(): String {
+        val sb = StringBuilder(
+            "monotonic_ms,wall_iso,opcode_dec,opcode_hex,payload_hex,frame_hex,service_uuid,char_uuid,write_type\n",
+        )
+        for (t in txRows) {
+            sb.append(t.monotonicMs).append(',').append(iso(t.wallMs)).append(',')
+                .append(t.opcode).append(',').append(hex2(t.opcode)).append(',')
+                .append(hex(t.payload)).append(',').append(hex(t.frame)).append(',')
+                .append(csv(t.serviceUuid)).append(',').append(csv(t.characteristicUuid)).append(',')
+                .append(csv(t.writeType)).append('\n')
+        }
+        return sb.toString()
+    }
+
+    fun bleRxCsv(): String {
+        val sb = StringBuilder(
+            "monotonic_ms,wall_iso,service_uuid,char_uuid,len,packet_type,sequence,crc_ok,recognized,rejected,payload_hex\n",
+        )
+        for (r in rxRows) {
+            sb.append(r.monotonicMs).append(',').append(iso(r.wallMs)).append(',')
+                .append(csv(r.serviceUuid)).append(',').append(csv(r.characteristicUuid)).append(',')
+                .append(r.payload.size).append(',')
+                .append(r.packetType?.toString() ?: "").append(',')
+                .append(r.sequence?.toString() ?: "").append(',')
+                .append(r.crcOk?.toString() ?: "").append(',')
+                .append(r.recognized).append(',').append(r.rejected).append(',')
+                .append(hex(r.payload)).append('\n')
+        }
+        return sb.toString()
+    }
+
+    fun commandsCsv(): String {
+        val sb = StringBuilder(
+            "monotonic_ms,wall_iso,opcode_dec,opcode_hex,command,arg_hex,status_level,persistence,ack_result,elapsed_ms,ack_raw_hex\n",
+        )
+        for (c in commandRows) {
+            sb.append(c.monotonicMs).append(',').append(iso(c.wallMs)).append(',')
+                .append(c.opcode).append(',').append(hex2(c.opcode)).append(',')
+                .append(csv(CommandNames.label(c.opcode))).append(',').append(csv(c.argHex)).append(',')
+                .append(csv(c.statusLevel)).append(',').append(csv(c.persistence)).append(',')
+                .append(csv(c.ackResult ?: "")).append(',')
+                .append(c.elapsedToAckMs?.toString() ?: "").append(',')
+                .append(csv(c.ackRawHex ?: "")).append('\n')
+        }
+        return sb.toString()
+    }
+
+    /** Only the RX rows the framing parser did NOT recognise — the unknown-packet corpus (Phase 6/7). */
+    fun unknownPacketsCsv(): String {
+        val sb = StringBuilder("monotonic_ms,wall_iso,char_uuid,len,packet_type,crc_ok,payload_hex\n")
+        for (r in rxRows) {
+            if (r.recognized) continue
+            sb.append(r.monotonicMs).append(',').append(iso(r.wallMs)).append(',')
+                .append(csv(r.characteristicUuid)).append(',').append(r.payload.size).append(',')
+                .append(r.packetType?.toString() ?: "").append(',')
+                .append(r.crcOk?.toString() ?: "").append(',').append(hex(r.payload)).append('\n')
+        }
+        return sb.toString()
+    }
+
+    /**
+     * `waveform.csv` — the i16 samples carried by each filled type-43 record, long format
+     * (record, monotonic_ms, sample_index, value). Non-diagnostic raw samples for plotting/analysis.
+     *
+     * The type-43 body opens with a constant 5×i16 sub-header at byte offsets 24..33; the waveform is the
+     * i16 LE series from offset 34 to 236. Empty (baseline) records are skipped. Capped so one long capture
+     * can't produce an unbounded file.
+     */
+    fun waveformCsv(): String {
+        val sb = StringBuilder("record,monotonic_ms,sample_index,value\n")
+        var rec = 0
+        var total = 0
+        val cap = WAVEFORM_CSV_SAMPLE_CAP
+        for (r in rxRows) {
+            if (r.crcOk == false) continue                          // never plot bytes that failed CRC
+            val vals = Whoop5Ecg.realtimeRawSamples(r.payload) ?: continue
+            // A record of all zeros is baseline, not waveform, and would swamp the file. A record that has
+            // ANY content is written in full, zeros included: trimming a trailing zero run (as this once did)
+            // silently edits the evidence, and a run of zeros at the end of a real record is itself a fact.
+            if (vals.all { it == 0 }) continue
+            for ((idx, v) in vals.withIndex()) {
+                sb.append(rec).append(',').append(r.monotonicMs).append(',').append(idx).append(',').append(v).append('\n')
+                if (++total >= cap) {
+                    sb.append("# truncated at ").append(cap).append(" samples\n")
+                    return sb.toString()
+                }
+            }
+            rec++
+        }
+        return sb.toString()
+    }
+
+    /** `stats.json` — non-diagnostic protocol statistics for a maintainer. */
+    fun statsJson(): String {
+        val records = rxRecords()
+        val pps = EcgResearchStats.packetsPerSecondByCharacteristic(records)
+        val hist = EcgResearchStats.payloadSizeHistogram(records)
+        val largest = EcgResearchStats.largestPayloadSizes(records, 8)
+        val typeCounts = EcgResearchStats.packetTypeCounts(records)
+        val repeatedSizes = hist.filterValues { it >= 3 }
+        val candidateRawCount = EcgResearchStats.countOfSize(records, CANDIDATE_RAW_RECORD_SIZE)
+        val maxZero = EcgResearchStats.maxZeroFractionOfLargeRecords(records, 64)
+        // "appeared after Start" — measured around the first command-sequence marker if the run set one.
+        val startMarker = eventRows.firstOrNull { it.kind == "command_sequence_started" }?.monotonicMs
+        val delta = startMarker?.let { EcgResearchStats.typeDeltaAround(records, it) }
+        // A changing-position map for the most common large record size (candidate counter/timestamp fields).
+        val dominantLarge = hist.entries.filter { it.key >= 64 }.maxByOrNull { it.value }?.key
+        val changing = dominantLarge?.let { size ->
+            EcgResearchStats.changingPositionsAcross(
+                synchronized(lock) { _rx.filter { it.payload.size == size }.map { it.payload } },
+            )
+        }
+
+        val sb = StringBuilder()
+        sb.append("{\n")
+        sb.append("  \"sessionId\": ").append(jstr(sessionId)).append(",\n")
+        sb.append("  \"startWallIso\": ").append(jstr(iso(startWallMs))).append(",\n")
+        sb.append("  \"counts\": {")
+        sb.append("\"tx\": ").append(txCount).append(", \"rx\": ").append(rxCount)
+        sb.append(", \"commands\": ").append(commandCount).append(", \"events\": ").append(eventCount)
+        sb.append(", \"unknownRx\": ").append(EcgResearchStats.unrecognizedCount(records))
+        sb.append(", \"rxOverflowDropped\": ").append(rxOverflow).append("},\n")
+        sb.append("  \"packetsPerSecondByCharacteristic\": ").append(jnumMap(pps)).append(",\n")
+        sb.append("  \"payloadSizeHistogram\": ").append(jintMap(hist.mapKeys { it.key.toString() })).append(",\n")
+        sb.append("  \"largestPayloadSizes\": ").append(jintList(largest)).append(",\n")
+        sb.append("  \"packetTypeCounts\": ")
+            .append(jintMap(typeCounts.mapKeys { it.key?.toString() ?: "unrecognized" })).append(",\n")
+        sb.append("  \"repeatedSizes\": ").append(jintMap(repeatedSizes.mapKeys { it.key.toString() })).append(",\n")
+        sb.append("  \"candidateRawRecordSize\": ").append(CANDIDATE_RAW_RECORD_SIZE).append(",\n")
+        sb.append("  \"candidateRawRecordCount\": ").append(candidateRawCount).append(",\n")
+        sb.append("  \"maxZeroFractionOfLargeRecords\": ").append(maxZero?.let { round3(it).toString() } ?: "null").append(",\n")
+        sb.append("  \"changingBytePositionsForSize\": ")
+            .append(dominantLarge?.toString() ?: "null").append(",\n")
+        sb.append("  \"changingBytePositions\": ").append(jintList(changing ?: emptyList())).append(",\n")
+        sb.append("  \"packetTypesAppearedAfterStart\": ")
+            .append(jNullableIntList(delta?.appearedAfter)).append(",\n")
+        sb.append("  \"packetTypesDisappearedAfterStop\": ")
+            .append(jNullableIntList(delta?.disappearedAfter)).append("\n")
+        sb.append("}\n")
+        return sb.toString()
+    }
+
+    // ---- formatting helpers (pure) -----------------------------------------------------------------
+
+    /** ISO-8601 UTC to the second, computed WITHOUT java.time.Instant.now so it is deterministic. */
+    private fun iso(wallMs: Long): String {
+        var days = Math.floorDiv(wallMs, 86_400_000L)
+        val msOfDay = Math.floorMod(wallMs, 86_400_000L)
+        val hh = (msOfDay / 3_600_000L).toInt()
+        val mm = ((msOfDay % 3_600_000L) / 60_000L).toInt()
+        val ss = ((msOfDay % 60_000L) / 1000L).toInt()
+        // civil-from-days (Howard Hinnant's algorithm), epoch 1970-01-01.
+        var z = days + 719_468L
+        val era = (if (z >= 0) z else z - 146_096) / 146_097
+        val doe = z - era * 146_097
+        val yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365
+        val y = yoe + era * 400
+        val doy = doe - (365 * yoe + yoe / 4 - yoe / 100)
+        val mp = (5 * doy + 2) / 153
+        val d = (doy - (153 * mp + 2) / 5 + 1).toInt()
+        val m = (if (mp < 10) mp + 3 else mp - 9).toInt()
+        val year = (if (m <= 2) y + 1 else y).toInt()
+        return "%04d-%02d-%02dT%02d:%02d:%02dZ".format(year, m, d, hh, mm, ss)
+    }
+
+    private fun csv(s: String): String =
+        if (s.any { it == ',' || it == '"' || it == '\n' || it == '\r' }) {
+            "\"" + s.replace("\"", "\"\"") + "\""
+        } else s
+
+    private fun jstr(s: String): String {
+        val sb = StringBuilder("\"")
+        for (c in s) when (c) {
+            '"' -> sb.append("\\\"")
+            '\\' -> sb.append("\\\\")
+            '\n' -> sb.append("\\n")
+            '\r' -> sb.append("\\r")
+            '\t' -> sb.append("\\t")
+            else -> if (c < ' ') sb.append("\\u%04x".format(c.code)) else sb.append(c)
+        }
+        return sb.append('"').toString()
+    }
+
+    private fun jintList(xs: List<Int>): String = xs.joinToString(", ", "[", "]")
+    private fun jNullableIntList(xs: List<Int?>?): String =
+        (xs ?: emptyList()).joinToString(", ", "[", "]") { it?.toString() ?: "null" }
+    private fun jintMap(m: Map<String, Int>): String =
+        m.entries.joinToString(", ", "{", "}") { "${jstr(it.key)}: ${it.value}" }
+    private fun jnumMap(m: Map<String, Double>): String =
+        m.entries.joinToString(", ", "{", "}") { "${jstr(it.key)}: ${round3(it.value)}" }
+    private fun round3(d: Double): Double = Math.round(d * 1000.0) / 1000.0
+
+    private fun hex2(v: Int): String = "0x%02X".format(v and 0xFF)
+    private fun hex(b: ByteArray): String = b.joinToString("") { "%02x".format(it.toInt() and 0xFF) }
+
+    /** Last 4 hex of a 128-bit UUID, or the string itself if short — the compact char label stats use. */
+    private fun shortUuid(u: String): String {
+        val first = u.substringBefore('-')
+        return if (first.length >= 4) first.takeLast(4) else u
+    }
+}
diff --git a/android/app/src/main/java/com/noop/protocol/EcgResearchStats.kt b/android/app/src/main/java/com/noop/protocol/EcgResearchStats.kt
new file mode 100644
index 0000000000..c1be24885d
--- /dev/null
+++ b/android/app/src/main/java/com/noop/protocol/EcgResearchStats.kt
@@ -0,0 +1,256 @@
+package com.noop.protocol
+
+/**
+ * #891 / #1100: PURE, NON-DIAGNOSTIC protocol statistics over a captured MG ECG research session.
+ *
+ * Everything here is a shape/timing observation about bytes on a wire — packet rates, payload sizes,
+ * zero-fill, which byte positions move between records. NOTHING here interprets a waveform, and the
+ * vocabulary is deliberately neutral: a fast integer stream is a "candidate high-rate signal", never "the
+ * ECG". Provenance of any waveform is a question for a human reading the raw bytes, not a statistic.
+ *
+ * Pure (no Android, no I/O, no clock): every input is passed in, so the whole file is unit-tested without a
+ * strap. Consumed by [EcgResearchLog] to build `stats.json` for the export bundle.
+ */
+object EcgResearchStats {
+
+    /** One inbound frame as the stats see it. [payload] is the on-wire bytes; [packetType] is the decoded
+     *  type byte when the framing parser named one, else null; [recognized] is whether the parser mapped it. */
+    data class RxRecord(
+        val monotonicMs: Long,
+        val characteristic: String,
+        val payload: ByteArray,
+        val packetType: Int?,
+        val recognized: Boolean,
+    ) {
+        val size: Int get() = payload.size
+
+        override fun equals(other: Any?): Boolean {
+            if (this === other) return true
+            if (other !is RxRecord) return false
+            return monotonicMs == other.monotonicMs && characteristic == other.characteristic &&
+                packetType == other.packetType && recognized == other.recognized &&
+                payload.contentEquals(other.payload)
+        }
+
+        override fun hashCode(): Int {
+            var h = monotonicMs.hashCode()
+            h = 31 * h + characteristic.hashCode(); h = 31 * h + (packetType ?: -1)
+            h = 31 * h + recognized.hashCode(); h = 31 * h + payload.contentHashCode()
+            return h
+        }
+    }
+
+    /** Fraction (0..1) of bytes in [payload] between [from], inclusive, and [to], exclusive, that are 0x00.
+     *  An out-of-range or empty window returns 0.0. */
+    fun zeroByteFraction(payload: ByteArray, from: Int = 0, to: Int = payload.size): Double {
+        val lo = from.coerceIn(0, payload.size)
+        val hi = to.coerceIn(lo, payload.size)
+        if (hi <= lo) return 0.0
+        var zeros = 0
+        for (i in lo until hi) if (payload[i].toInt() == 0) zeros++
+        return zeros.toDouble() / (hi - lo)
+    }
+
+    /** True when every byte in [payload] over [from, to) is 0x00 (a genuinely empty region — the "is the
+     *  big raw area all zeros?" question #891 asks of large records). Empty window is NOT all-zero. */
+    fun isAllZero(payload: ByteArray, from: Int = 0, to: Int = payload.size): Boolean {
+        val lo = from.coerceIn(0, payload.size)
+        val hi = to.coerceIn(lo, payload.size)
+        if (hi <= lo) return false
+        for (i in lo until hi) if (payload[i].toInt() != 0) return false
+        return true
+    }
+
+    /** Byte positions where [a] and [b] differ (shared prefix only). A SEQUENCE-COUNTER hunt: a field that
+     *  changes between consecutive same-shape records is a counter/timestamp candidate. */
+    fun changingBytePositions(a: ByteArray, b: ByteArray): List<Int> {
+        val n = minOf(a.size, b.size)
+        val out = ArrayList<Int>()
+        for (i in 0 until n) if (a[i] != b[i]) out.add(i)
+        return out
+    }
+
+    /** Union of positions that EVER change across a run of same-length records (the counter/timestamp map). */
+    fun changingPositionsAcross(records: List<ByteArray>): List<Int> {
+        if (records.size < 2) return emptyList()
+        val changing = sortedSetOf<Int>()
+        for (i in 1 until records.size) changing.addAll(changingBytePositions(records[i - 1], records[i]))
+        return changing.toList()
+    }
+
+    /** packets/sec per characteristic across the whole window (count ÷ span seconds; a single packet or a
+     *  zero span reports the raw count as a per-second rate so the number is never divided by zero). */
+    fun packetsPerSecondByCharacteristic(records: List<RxRecord>): Map<String, Double> {
+        val byChar = records.groupBy { it.characteristic }
+        return byChar.mapValues { (_, rs) ->
+            if (rs.size < 2) rs.size.toDouble()
+            else {
+                val span = (rs.maxOf { it.monotonicMs } - rs.minOf { it.monotonicMs }).coerceAtLeast(1)
+                rs.size.toDouble() * 1000.0 / span
+            }
+        }
+    }
+
+    /** Payload-size histogram: exact size in bytes → how many records had it. */
+    fun payloadSizeHistogram(records: List<RxRecord>): Map<Int, Int> {
+        val h = HashMap<Int, Int>()
+        for (r in records) h[r.size] = (h[r.size] ?: 0) + 1
+        return h.toSortedMap()
+    }
+
+    /** The [n] largest distinct payload sizes seen, descending. */
+    fun largestPayloadSizes(records: List<RxRecord>, n: Int = 5): List<Int> =
+        records.map { it.size }.distinct().sortedDescending().take(n)
+
+    /** Count of records whose payload is exactly [size] bytes — e.g. the repeated 1,584-byte record #891
+     *  flags as a candidate raw block. */
+    fun countOfSize(records: List<RxRecord>, size: Int): Int = records.count { it.size == size }
+
+    /** Packet-type census: decoded type byte (or null for unrecognised) → count. */
+    fun packetTypeCounts(records: List<RxRecord>): Map<Int?, Int> {
+        val h = LinkedHashMap<Int?, Int>()
+        for (r in records) h[r.packetType] = (h[r.packetType] ?: 0) + 1
+        return h
+    }
+
+    /** How many records the framing parser did NOT recognise — the unknown/rejected tally (Phase 6/7). */
+    fun unrecognizedCount(records: List<RxRecord>): Int = records.count { !it.recognized }
+
+    /**
+     * Packet types present only AFTER a boundary time [afterMs] (candidate "appeared after Start") and those
+     * present only BEFORE it (candidate "disappeared after Stop"). Type identity is the decoded type byte;
+     * null (unrecognised) is folded in as its own bucket. Purely descriptive — never asserts causation.
+     */
+    data class TypeDelta(val appearedAfter: List<Int?>, val disappearedAfter: List<Int?>)
+
+    fun typeDeltaAround(records: List<RxRecord>, afterMs: Long): TypeDelta {
+        val before = records.filter { it.monotonicMs < afterMs }.map { it.packetType }.toSet()
+        val after = records.filter { it.monotonicMs >= afterMs }.map { it.packetType }.toSet()
+        return TypeDelta(
+            appearedAfter = (after - before).toList(),
+            disappearedAfter = (before - after).toList(),
+        )
+    }
+
+    /** Largest zero-byte fraction over any record at least [minSize] bytes — surfaces the "large records are
+     *  mostly padding" observation. Returns null when no record is that big. */
+    fun maxZeroFractionOfLargeRecords(records: List<RxRecord>, minSize: Int = 64): Double? {
+        val big = records.filter { it.size >= minSize }
+        if (big.isEmpty()) return null
+        return big.maxOf { zeroByteFraction(it.payload) }
+    }
+
+    /**
+     * Estimate beats-per-minute from a waveform by normalised autocorrelation — NON-DIAGNOSTIC, and
+     * deliberately willing to return null.
+     *
+     * ## The trap this is written around (#194)
+     *
+     * The strap's raw records carry a FIXED sample count ([Whoop5Ecg.SAMPLES_PER_RAW_RECORD] = 101). Anything
+     * that repeats per record — a constant sub-header, a re-sent block, a seam where two records join — is
+     * periodic at the record period, and at 100 Hz that period is 1.01 s == 59.4 bpm: inside this search band
+     * and inside resting heart-rate range. An autocorrelation fed a concatenated record stream will therefore
+     * report a confident ~59 bpm out of pure framing, with no cardiac content at all. That is the exact
+     * [excludeLag] is REQUIRED and has no default, which is the whole point of it. Passing the record
+     * period switches the guard on; passing null says "this source is not record-tiled" and accepts an
+     * unguarded estimate. Both are defensible, but only as a decision somebody made: with a default the
+     * shortest call, `estimateBpm(samples, fs)`, silently selected the unguarded form, and on a tiled
+     * 101-sample record at 100 Hz that form returns 59 — a believable resting rate manufactured from a
+     * buffer holding no rhythm at all. That is #194 exactly, and a wrong number nobody chose is the
+     * failure this whole method is shaped around. Requiring the argument costs one word at each call site
+     * and makes the unguarded path impossible to take by accident.
+     *
+     * failure mode behind NOOP's withdrawn PPG->HR estimate, so when [excludeLag] is supplied:
+     *
+     *  1. lags within [excludeLagTolerance] of it cannot win, and
+     *  2. the winner must also beat the strength AT the artefact lag ([artefactDominance]). Step 1 alone is
+     *     not enough — a broad peak centred on the artefact lag still has strong shoulders just outside the
+     *     notch, so a notch by itself just reports the artefact as a slightly different number.
+     *
+     * The cost is stated rather than hidden: a genuine heart rate that lands in that narrow band is
+     * indistinguishable from the artefact and is therefore DECLINED. Null means "this method cannot tell",
+     * never "no rhythm".
+     *
+     * ## Two things that made an earlier version wrong
+     *
+     * - **Comparability across lags.** A raw lag product sums over `n - lag` terms, so longer lags accumulate
+     *   fewer terms and score lower for arithmetic rather than physiological reasons. Each lag is scored as a
+     *   true normalised cross-correlation over its own overlap, so lags are comparable and [minStrength]
+     *   means the same thing everywhere.
+     * - **Octave errors.** A periodic signal correlates just as well at twice its period, and with a
+     *   non-integer number of cycles the double-period lag can score marginally higher — reporting 55 bpm for
+     *   a 110 bpm input. So the winner is the SHORTEST lag within [octaveTolerance] of the best score, not
+     *   the argmax.
+     */
+    fun estimateBpm(
+        samples: IntArray,
+        fs: Int = 100,
+        minBpm: Int = 40,
+        maxBpm: Int = 180,
+        minStrength: Double = 0.3,
+        excludeLag: Int?,
+        excludeLagTolerance: Int = 2,
+        octaveTolerance: Double = 0.85,
+        artefactDominance: Double = 1.0,
+    ): Int? {
+        if (fs <= 0 || samples.size < fs) return null   // need at least ~1 second
+        val n = samples.size
+        val mean = samples.average()
+        val c = DoubleArray(n) { samples[it] - mean }
+        var e0 = 0.0
+        for (v in c) e0 += v * v
+        if (e0 <= 0.0) return null                      // a flat trace has no period to find
+        val loLag = (60.0 * fs / maxBpm).toInt().coerceAtLeast(1)
+        val hiLag = (60.0 * fs / minBpm).toInt().coerceAtMost(n - 1)
+        if (hiLag <= loLag) return null
+
+        /** True normalised cross-correlation of the series against itself at [lag], over their overlap. */
+        fun ncc(lag: Int): Double {
+            val overlap = n - lag
+            if (overlap <= 1) return 0.0
+            var num = 0.0
+            var eA = 0.0
+            var eB = 0.0
+            for (i in 0 until overlap) {
+                val a = c[i]
+                val b = c[i + lag]
+                num += a * b
+                eA += a * a
+                eB += b * b
+            }
+            if (eA <= 0.0 || eB <= 0.0) return 0.0
+            return num / kotlin.math.sqrt(eA * eB)
+        }
+
+        fun notched(lag: Int) = excludeLag != null && kotlin.math.abs(lag - excludeLag) <= excludeLagTolerance
+
+        val strength = DoubleArray(hiLag + 1)
+        var best = Double.NEGATIVE_INFINITY
+        for (lag in loLag..hiLag) {
+            strength[lag] = ncc(lag)
+            if (!notched(lag) && strength[lag] > best) best = strength[lag]
+        }
+        if (best < minStrength) return null
+
+        // Step 2 of the artefact guard: if the record period itself correlates at least as well as the best
+        // candidate outside the notch, the candidate is that peak's shoulder and not an independent rhythm.
+        if (excludeLag != null) {
+            var artefact = Double.NEGATIVE_INFINITY
+            for (lag in loLag..hiLag) if (notched(lag) && strength[lag] > artefact) artefact = strength[lag]
+            if (artefact != Double.NEGATIVE_INFINITY && best < artefact * artefactDominance) return null
+        }
+
+        // Octave correction, over PEAKS only. Taking the shortest lag that merely clears the threshold picks
+        // a point on the rising shoulder of the real peak instead of the peak: a 45 bpm input (lag 133) has
+        // correlation 0.86 at lag 122, which cleared the floor and reported 49 bpm. A candidate must be a
+        // local maximum, and then the shortest such peak is the fundamental rather than a sub-harmonic.
+        val floor = best * octaveTolerance
+        for (lag in loLag..hiLag) {
+            if (notched(lag) || strength[lag] < floor) continue
+            val risingInto = lag == loLag || strength[lag] >= strength[lag - 1]
+            val fallingAfter = lag == hiLag || strength[lag] >= strength[lag + 1]
+            if (risingInto && fallingAfter) return (60.0 * fs / lag).toInt()
+        }
+        return null
+    }
+}
diff --git a/android/app/src/test/java/com/noop/protocol/EcgBpmEstimatorTest.kt b/android/app/src/test/java/com/noop/protocol/EcgBpmEstimatorTest.kt
new file mode 100644
index 0000000000..196961d522
--- /dev/null
+++ b/android/app/src/test/java/com/noop/protocol/EcgBpmEstimatorTest.kt
@@ -0,0 +1,133 @@
+package com.noop.protocol
+
+import kotlin.math.PI
+import kotlin.math.abs
+import kotlin.math.sin
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #891/#1100 + the #194 lesson: [EcgResearchStats.estimateBpm].
+ *
+ * The repo's rule for deriving a physiological signal from raw sensor data is that a single match proves
+ * nothing — the method has to track a VARYING input, and for a synthetic test that means recovering SEVERAL
+ * injected values rather than one. The previous test injected one rate. This injects a spread, and then
+ * attacks the estimator with the specific artefact that got the earlier PPG->HR estimate withdrawn: the
+ * strap's records carry a fixed 101 samples, so a seam between records is periodic at ~59 bpm all by itself.
+ */
+class EcgBpmEstimatorTest {
+
+    private val fs = 100
+
+    /** A clean sinusoid at [bpm], [seconds] long, at [fs] Hz. */
+    private fun beats(bpm: Int, seconds: Double = 8.0, amplitude: Int = 1000): IntArray {
+        val n = (fs * seconds).toInt()
+        val f = bpm / 60.0
+        return IntArray(n) { (amplitude * sin(2 * PI * f * it / fs)).toInt() }
+    }
+
+    @Test
+    fun recoversSeveralDifferentInjectedRates() {
+        // One match is a coincidence; the method has to move with the input.
+        for (bpm in intArrayOf(45, 52, 70, 88, 110, 132, 150, 170)) {
+            val got = EcgResearchStats.estimateBpm(beats(bpm), fs, excludeLag = null)
+            assertNotNull("no estimate at $bpm bpm", got)
+            // Lag quantisation at 100 Hz coarsens with rate, so allow a proportional tolerance.
+            val tolerance = maxOf(3.0, bpm * 0.06)
+            assertTrue(
+                "expected ~$bpm bpm, got $got",
+                abs(got!! - bpm) <= tolerance,
+            )
+        }
+    }
+
+    @Test
+    fun theEstimateRisesAndFallsWithTheInput() {
+        // Monotonicity across the band: the ordering of the estimates must match the ordering of the truth.
+        val truth = intArrayOf(50, 75, 100, 125, 150)
+        val got = truth.map { EcgResearchStats.estimateBpm(beats(it), fs, excludeLag = null)!! }
+        assertTrue("estimates not monotonic with input: $got", got.zipWithNext().all { (a, b) -> a < b })
+    }
+
+    /**
+     * THE regression that matters. A buffer assembled by tiling the SAME record content over and over has no
+     * cardiac information in it at all — its only periodicity is the record length. At 101 samples and 100 Hz
+     * that is lag 101 == ~59 bpm: inside the search band, and a thoroughly plausible resting heart rate.
+     *
+     * This is the shape that got the earlier PPG->HR estimate withdrawn, so it is pinned twice: that the
+     * artefact really is detectable (or the test proves nothing), and that the guarded call refuses it.
+     */
+    @Test
+    fun aPureRecordSeamArtefactIsRefusedRatherThanReportedAsFiftyNineBpm() {
+        val period = Whoop5Ecg.SAMPLES_PER_RAW_RECORD
+        // One record's worth of arbitrary but fixed content, tiled — exactly what a repeated block looks like.
+        var seed = 987654321L
+        val block = IntArray(period) {
+            seed = (seed * 6364136223846793005L + 1442695040888963407L)
+            ((seed shr 33).toInt() % 500)
+        }
+        val tiled = IntArray(period * 8) { block[it % period] }
+
+        // Unguarded, the artefact is reported with confidence, and it lands on a resting heart rate.
+        val unguarded = EcgResearchStats.estimateBpm(tiled, fs, excludeLag = null)
+        assertNotNull("the artefact should be detectable at all, or this test proves nothing", unguarded)
+        assertTrue(
+            "the artefact was expected near 60*100/101 = 59 bpm, got $unguarded",
+            abs(unguarded!! - 59) <= 4,
+        )
+
+        // Guarded — the way the live view calls it — it declines rather than manufacturing physiology.
+        assertNull(EcgResearchStats.estimateBpm(tiled, fs, excludeLag = period))
+    }
+
+    @Test
+    fun excludingTheRecordPeriodStillFindsRatesEitherSideOfIt() {
+        // The guard must be a narrow notch, not a hole that swallows the resting band.
+        val period = Whoop5Ecg.SAMPLES_PER_RAW_RECORD
+        for (bpm in intArrayOf(45, 52, 70, 80)) {
+            val got = EcgResearchStats.estimateBpm(beats(bpm), fs, excludeLag = period)
+            assertNotNull("the notch swallowed $bpm bpm", got)
+            assertTrue("expected ~$bpm bpm, got $got", abs(got!! - bpm) <= maxOf(3.0, bpm * 0.06))
+        }
+    }
+
+    @Test
+    fun theCostOfTheGuardIsStatedNotHidden() {
+        // A genuine rate that lands ON the artefact lag is indistinguishable from the artefact, so the method
+        // declines. Note the notch ALONE would not do this — it would just report the peak's shoulder as a
+        // slightly different number; it is the dominance check that makes the refusal real. Pinned so the
+        // documented cost cannot quietly regress into a confident false reading.
+        val onTheNotch = 60 * fs / Whoop5Ecg.SAMPLES_PER_RAW_RECORD   // 59 bpm
+        assertNotNull(EcgResearchStats.estimateBpm(beats(onTheNotch), fs, excludeLag = null))
+        assertNull(
+            "a rate on the artefact lag must be declined, not reported",
+            EcgResearchStats.estimateBpm(beats(onTheNotch), fs, excludeLag = Whoop5Ecg.SAMPLES_PER_RAW_RECORD),
+        )
+    }
+
+    @Test
+    fun noiseAndFlatlineAndTooShortAllReturnNull() {
+        assertNull(EcgResearchStats.estimateBpm(IntArray(0), fs, excludeLag = null))
+        assertNull("a buffer under one second cannot be judged", EcgResearchStats.estimateBpm(IntArray(fs - 1) { it }, fs, excludeLag = null))
+        assertNull("a flat trace has no variance", EcgResearchStats.estimateBpm(IntArray(400) { 0 }, fs, excludeLag = null))
+        // Deterministic pseudo-noise: no dominant period should clear the strength floor.
+        var seed = 12345L
+        val noise = IntArray(800) {
+            seed = (seed * 6364136223846793005L + 1442695040888963407L)
+            ((seed shr 33).toInt() % 200)
+        }
+        assertNull("pseudo-noise should not yield a confident rate", EcgResearchStats.estimateBpm(noise, fs, excludeLag = null))
+    }
+
+    @Test
+    fun theSearchIsNotBiasedTowardHighRatesByOverlapLength() {
+        // The lag score is a mean over the overlap, not a raw sum: an unnormalised sum shrinks with lag and
+        // pulls the winner toward short lags (high BPM). A slow rate in a short-ish buffer is where that
+        // bias showed, so pin it.
+        val got = EcgResearchStats.estimateBpm(beats(46, seconds = 4.0), fs, excludeLag = null)
+        assertNotNull(got)
+        assertTrue("a slow rate was pulled high (got $got)", abs(got!! - 46) <= 5)
+    }
+}
diff --git a/android/app/src/test/java/com/noop/protocol/EcgResearchAllowListTest.kt b/android/app/src/test/java/com/noop/protocol/EcgResearchAllowListTest.kt
new file mode 100644
index 0000000000..9be5d00778
--- /dev/null
+++ b/android/app/src/test/java/com/noop/protocol/EcgResearchAllowListTest.kt
@@ -0,0 +1,100 @@
+package com.noop.protocol
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The panel's dispatch surface is a positive allow-list of four ECG opcodes. These tests pin that it can
+ * NEVER form anything else — most importantly the firmware-load family that sits three codes above 139.
+ */
+class EcgResearchAllowListTest {
+
+    @Test
+    fun theFourProbeOpcodesAreExactlyTheLabradorCommands() {
+        assertEquals(
+            setOf(123, 124, 125, 139),
+            EcgResearchAllowList.PROBE_OPCODES,
+        )
+        assertTrue(EcgResearchAllowList.isProbeOpcode(Whoop5Ecg.SELECT_WRIST_CMD))
+        assertTrue(EcgResearchAllowList.isProbeOpcode(Whoop5Ecg.TOGGLE_REALTIME_FILTERED_ECG_CMD))
+        assertTrue(EcgResearchAllowList.isProbeOpcode(Whoop5Ecg.TOGGLE_SAVE_RAW_ECG_CMD))
+        assertTrue(EcgResearchAllowList.isProbeOpcode(Whoop5Ecg.MAIN_CONTROL_ECG_DATA_GENERATION_CMD))
+    }
+
+    @Test
+    fun noOpcodeOutsideTheFourIsDispatchableAsAProbeCommand() {
+        // The whole "no opcode sweep" guarantee, as a census: every byte value 0..255 except the four is
+        // refused by the predicate the real BLE send path consults.
+        for (op in 0..255) {
+            val expected = op in setOf(123, 124, 125, 139)
+            assertEquals("opcode $op", expected, EcgResearchAllowList.isProbeOpcode(op))
+        }
+    }
+
+    @Test
+    fun theFirmwareLoadFamilyIsRefusedAndNamed() {
+        // 139 is TOGGLE_LABRADOR_FILTERED; 142/143/144 are the destructive firmware-load family right above
+        // it. They must be refused AND named in the deny-list so the refusal is testable.
+        for (op in listOf(142, 143, 144, 36, 37, 38, 45, 83)) {
+            assertFalse("must not dispatch $op", EcgResearchAllowList.isProbeOpcode(op))
+            assertFalse(EcgResearchAllowList.DISPATCHABLE_OPCODES.contains(op))
+            assertTrue("must name $op as forbidden", EcgResearchAllowList.isForbidden(op))
+        }
+    }
+
+    @Test
+    fun rebootWipeDfuAndHighFreqAreAllForbidden() {
+        for (op in listOf(29, 32, 25, 99, 96, 97, 100)) {
+            assertTrue("forbidden: $op", EcgResearchAllowList.isForbidden(op))
+            assertFalse(EcgResearchAllowList.isProbeOpcode(op))
+        }
+    }
+
+    @Test
+    fun noForbiddenOpcodeIsEverDispatchable() {
+        for (op in EcgResearchAllowList.FORBIDDEN.keys) {
+            assertFalse("forbidden $op leaked into dispatch set", EcgResearchAllowList.DISPATCHABLE_OPCODES.contains(op))
+        }
+    }
+
+    @Test
+    fun theGateOpcodesAreThe119And121DeviceConfigVerbsOnly() {
+        assertEquals(setOf(119, 121), EcgResearchAllowList.GATE_OPCODES)
+        // The FEATURE-FLAG SET verb (120) is NOT a gate opcode — the gate is device-config only.
+        assertFalse(EcgResearchAllowList.isGateOpcode(120))
+    }
+
+    @Test
+    fun dispatchableIsExactlyTheFourProbesPlusTwoGateVerbs() {
+        assertEquals(setOf(123, 124, 125, 139, 119, 121), EcgResearchAllowList.DISPATCHABLE_OPCODES)
+    }
+
+    /**
+     * The companion guard — that every DISPATCHABLE opcode is a constructible [CommandNumber] — is
+     * deliberately NOT here. It is an invariant of the SEND PATH: `send()` forms a frame from a
+     * `CommandNumber`, so an allow-listed opcode the enum cannot express could not be dispatched at all.
+     *
+     * Nothing in this change dispatches anything, and opcodes 124/125/139 are absent from that enum on
+     * purpose — upstream excluded them with a comment saying Android has no ECG app layer and sends
+     * none of them. Asserting their presence here would fail for the correct reason, so the guard lands
+     * with the send-path wiring that makes it true and gives it something worth protecting.
+     */
+    @Test
+    fun noForbiddenOpcodeIsReachableThroughTheProbeCases() {
+        for (op in EcgResearchAllowList.FORBIDDEN.keys) {
+            assertFalse(EcgResearchAllowList.PROBE_OPCODES.contains(op))
+        }
+    }
+
+    @Test
+    fun theFirmwareLoadNewFamilyIsNotEvenInTheDispatchSet() {
+        // 142/143/144 sit three codes above 139 in opcode space; the census must show they cannot be formed.
+        assertNull(EcgResearchAllowList.FORBIDDEN[139])   // 139 is a PROBE opcode, not forbidden
+        assertEquals("START_FIRMWARE_LOAD_NEW", EcgResearchAllowList.FORBIDDEN[142])
+        assertEquals("LOAD_FIRMWARE_DATA_NEW", EcgResearchAllowList.FORBIDDEN[143])
+        assertEquals("PROCESS_FIRMWARE_IMAGE_NEW", EcgResearchAllowList.FORBIDDEN[144])
+    }
+}
diff --git a/android/app/src/test/java/com/noop/protocol/EcgResearchLogTest.kt b/android/app/src/test/java/com/noop/protocol/EcgResearchLogTest.kt
new file mode 100644
index 0000000000..a369da7d07
--- /dev/null
+++ b/android/app/src/test/java/com/noop/protocol/EcgResearchLogTest.kt
@@ -0,0 +1,191 @@
+package com.noop.protocol
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class EcgResearchLogTest {
+
+    private fun newLog(maxRx: Int = EcgResearchLog.DEFAULT_MAX_RX_ROWS) =
+        EcgResearchLog("mg-ecg-20260819-101112", startWallMs = 0L, startMonotonicMs = 0L, maxRxRows = maxRx)
+
+    private fun tx(op: Int, mono: Long) = EcgResearchLog.TxRow(
+        monotonicMs = mono, wallMs = mono, opcode = op,
+        payload = byteArrayOf(0x01, 0x01), frame = byteArrayOf(0xAA.toByte(), 0x01),
+        serviceUuid = "fd4b0001", characteristicUuid = "fd4b0002", writeType = "NO_RESPONSE",
+    )
+
+    private fun rx(mono: Long, size: Int, type: Int?, recognized: Boolean) = EcgResearchLog.RxRow(
+        monotonicMs = mono, wallMs = mono, serviceUuid = "fd4b0001", characteristicUuid = "fd4b0003",
+        payload = ByteArray(size), packetType = type, sequence = null, recognized = recognized,
+        rejected = !recognized,
+    )
+
+    @Test
+    fun recordsCountAcrossAllStreams() {
+        val log = newLog()
+        log.recordTx(tx(139, 10))
+        log.recordRx(rx(20, 1584, 0x28, false))
+        log.recordCommand(
+            EcgResearchLog.CommandRow(30, 30, 139, "01", "Observed", "session", "SUCCESS(1)", "aabb", 42),
+        )
+        log.recordEvent(EcgResearchLog.EventRow(5, 5, "electrode_contact_started", ""))
+        assertEquals(1, log.txCount)
+        assertEquals(1, log.rxCount)
+        assertEquals(1, log.commandCount)
+        assertEquals(1, log.eventCount)
+    }
+
+    @Test
+    fun eventCsvCarriesTimestampsAndMarkers() {
+        val log = newLog()
+        log.recordEvent(EcgResearchLog.EventRow(1234, 0L, "electrode_contact_started", "left index"))
+        val csv = log.eventsCsv()
+        assertTrue(csv.startsWith("monotonic_ms,wall_iso,kind,detail\n"))
+        assertTrue(csv.contains("1234,1970-01-01T00:00:00Z,electrode_contact_started,left index"))
+    }
+
+    @Test
+    fun txCsvCarriesDecimalAndHexOpcodeAndFrame() {
+        val log = newLog()
+        log.recordTx(tx(139, 10))
+        val csv = log.bleTxCsv()
+        assertTrue(csv.contains("opcode_dec,opcode_hex"))
+        assertTrue(csv.contains("10,1970-01-01T00:00:00Z,139,0x8B,0101,aa01,fd4b0001,fd4b0002,NO_RESPONSE"))
+    }
+
+    @Test
+    fun unknownPacketsCsvContainsOnlyUnrecognisedRows() {
+        val log = newLog()
+        log.recordRx(rx(1, 20, 40, recognized = true))     // recognised — excluded
+        log.recordRx(rx(2, 1584, null, recognized = false)) // unknown — included
+        val csv = log.unknownPacketsCsv()
+        val lines = csv.trim().split("\n")
+        assertEquals(2, lines.size)  // header + one unknown row
+        assertTrue(lines[1].contains(",1584,"))
+    }
+
+    @Test
+    fun rxCapCountsOverflowInsteadOfDroppingSilently() {
+        val log = newLog(maxRx = 2)
+        log.recordRx(rx(1, 10, 40, true))
+        log.recordRx(rx(2, 10, 40, true))
+        log.recordRx(rx(3, 10, 40, true)) // over the cap
+        assertEquals(2, log.rxCount)
+        assertEquals(1L, log.rxOverflow)
+        assertTrue(log.statsJson().contains("\"rxOverflowDropped\": 1"))
+    }
+
+    @Test
+    fun statsJsonReportsCandidateRawRecordsAndZeroFill() {
+        val log = newLog()
+        repeat(3) { log.recordRx(rx(it.toLong(), 1584, 0x28, recognized = false)) }
+        val json = log.statsJson()
+        assertTrue(json.contains("\"sessionId\": \"mg-ecg-20260819-101112\""))
+        assertTrue(json.contains("\"candidateRawRecordSize\": 1584"))
+        assertTrue(json.contains("\"candidateRawRecordCount\": 3"))
+        // three all-zero 1584-byte records -> max zero fraction 1.0
+        assertTrue(json.contains("\"maxZeroFractionOfLargeRecords\": 1.0"))
+        assertTrue(json.contains("\"unknownRx\": 3"))
+    }
+
+    @Test
+    fun statsJsonSurfacesTypesAppearingAfterAStartMarker() {
+        val log = newLog()
+        log.recordRx(rx(0, 4, 40, true))                    // type 40 present only BEFORE the marker
+        log.recordEvent(EcgResearchLog.EventRow(100, 100, "command_sequence_started", ""))
+        log.recordRx(rx(200, 1584, 99, false))              // type 99 present only AFTER the marker
+        val json = log.statsJson()
+        assertTrue(json.contains("\"packetTypesAppearedAfterStart\": [99]"))
+        assertTrue(json.contains("\"packetTypesDisappearedAfterStop\": [40]"))
+    }
+
+    // ---- CRC verdict + volume bounds (added with the CRC-gating of the decode path) ----------------
+
+    /** A 240-byte type-43 record whose waveform region carries [value] in every sample. */
+    private fun rawRecordRow(monotonicMs: Long, value: Int, crcOk: Boolean?): EcgResearchLog.RxRow {
+        val f = ByteArray(Whoop5Ecg.RAW_RECORD_LENGTH)
+        f[Whoop5Ecg.RAW_TYPE_OFFSET] = PacketType.REALTIME_RAW_DATA.rawValue.toByte()
+        var i = Whoop5Ecg.RAW_WAVEFORM_START
+        while (i + 1 < Whoop5Ecg.RAW_BODY_END) {
+            f[i] = (value and 0xFF).toByte()
+            f[i + 1] = ((value shr 8) and 0xFF).toByte()
+            i += 2
+        }
+        return EcgResearchLog.RxRow(
+            monotonicMs = monotonicMs, wallMs = 1_700_000_000_000L, serviceUuid = "fd4b",
+            characteristicUuid = "fd4b0003", payload = f,
+            packetType = PacketType.REALTIME_RAW_DATA.rawValue, sequence = null,
+            recognized = crcOk != false, rejected = crcOk == false, crcOk = crcOk,
+        )
+    }
+
+    @Test
+    fun aCrcFailureIsRecordedAndFlaggedRatherThanDropped() {
+        val log = EcgResearchLog("s", 1_700_000_000_000L, 0L)
+        log.recordRx(rawRecordRow(10, 100, crcOk = true))
+        log.recordRx(rawRecordRow(20, 200, crcOk = false))
+        log.recordRx(rawRecordRow(30, 300, crcOk = null))
+
+        // Dropping a corrupt frame would make "the strap sent nothing" and "the app threw it away" identical.
+        assertEquals(3, log.rxCount)
+        val csv = log.bleRxCsv()
+        val header = csv.lineSequence().first().split(",")
+        val crcCol = header.indexOf("crc_ok")
+        assertTrue("the rx CSV must carry the verdict", crcCol >= 0)
+        val rows = csv.trim().lines().drop(1).map { it.split(",") }
+        assertEquals("true", rows[0][crcCol])
+        assertEquals("false", rows[1][crcCol])
+        // "nothing to check" must be distinguishable from "failed": an empty field, not the word false.
+        assertEquals("", rows[2][crcCol])
+    }
+
+    @Test
+    fun theWaveformExportNeverPlotsBytesThatFailedCrc() {
+        val log = EcgResearchLog("s", 1_700_000_000_000L, 0L)
+        log.recordRx(rawRecordRow(10, 111, crcOk = true))
+        log.recordRx(rawRecordRow(20, 222, crcOk = false))   // corruption would render as a spike
+        val csv = log.waveformCsv()
+        assertTrue("the CRC-good record should be plotted", csv.contains(",111"))
+        assertFalse("a CRC-failed record must never reach the waveform", csv.contains(",222"))
+    }
+
+    @Test
+    fun anAllZeroRecordIsBaselineAndSkippedButRealZerosAreKept() {
+        val log = EcgResearchLog("s", 1_700_000_000_000L, 0L)
+        log.recordRx(rawRecordRow(10, 0, crcOk = true))       // pure baseline: skipped entirely
+        assertEquals("record,monotonic_ms,sample_index,value\n", log.waveformCsv())
+
+        // A record with content keeps its full 101 samples — no trailing-zero trimming, which would edit
+        // the evidence. Build one with a single non-zero lead sample.
+        val f = ByteArray(Whoop5Ecg.RAW_RECORD_LENGTH)
+        f[Whoop5Ecg.RAW_TYPE_OFFSET] = PacketType.REALTIME_RAW_DATA.rawValue.toByte()
+        f[Whoop5Ecg.RAW_WAVEFORM_START] = 9
+        val log2 = EcgResearchLog("s", 1_700_000_000_000L, 0L)
+        log2.recordRx(
+            EcgResearchLog.RxRow(
+                1, 1_700_000_000_000L, "fd4b", "fd4b0003", f,
+                PacketType.REALTIME_RAW_DATA.rawValue, null, true, false, true,
+            ),
+        )
+        assertEquals(
+            "every sample of a non-empty record is written",
+            Whoop5Ecg.SAMPLES_PER_RAW_RECORD,
+            log2.waveformCsv().trim().lines().size - 1,
+        )
+    }
+
+    @Test
+    fun theCaptureIsBoundedByBytesNotJustRows() {
+        // A row cap alone does not bound memory: 200k x 240 B is ~48 MB before object overhead, and an
+        // offload can fill that faster than a UI notices. Whichever cap is hit first stops storage, and the
+        // drops are counted either way.
+        val log = EcgResearchLog("s", 1_700_000_000_000L, 0L, maxRxRows = 1_000, maxRxBytes = 1_000L)
+        repeat(20) { log.recordRx(rawRecordRow(it.toLong(), 5, crcOk = true)) }
+        assertTrue("the byte cap should bite well before the row cap", log.rxCount in 1..4)
+        assertTrue("bytes stored must stay inside the cap", log.rxBytes <= 1_000L)
+        assertEquals("every dropped frame is counted", (20 - log.rxCount).toLong(), log.rxOverflow)
+        assertTrue("the bundle must report the drops", log.statsJson().contains("\"rxOverflowDropped\": ${log.rxOverflow}"))
+    }
+}
diff --git a/android/app/src/test/java/com/noop/protocol/EcgResearchStatsTest.kt b/android/app/src/test/java/com/noop/protocol/EcgResearchStatsTest.kt
new file mode 100644
index 0000000000..c69fa1483f
--- /dev/null
+++ b/android/app/src/test/java/com/noop/protocol/EcgResearchStatsTest.kt
@@ -0,0 +1,125 @@
+package com.noop.protocol
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class EcgResearchStatsTest {
+
+    private fun rec(ms: Long, ch: String, payload: ByteArray, type: Int? = null, recognized: Boolean = true) =
+        EcgResearchStats.RxRecord(ms, ch, payload, type, recognized)
+
+    @Test
+    fun zeroByteFractionCountsZerosInWindow() {
+        val p = byteArrayOf(0, 0, 1, 2, 0, 0)
+        assertEquals(4.0 / 6.0, EcgResearchStats.zeroByteFraction(p), 1e-9)
+        assertEquals(1.0, EcgResearchStats.zeroByteFraction(byteArrayOf(0, 0, 0)), 1e-9)
+        assertEquals(0.0, EcgResearchStats.zeroByteFraction(byteArrayOf(1, 2, 3)), 1e-9)
+        // windowed
+        assertEquals(1.0, EcgResearchStats.zeroByteFraction(p, 0, 2), 1e-9)
+        assertEquals(0.0, EcgResearchStats.zeroByteFraction(p, 2, 4), 1e-9)
+        // empty / out of range
+        assertEquals(0.0, EcgResearchStats.zeroByteFraction(ByteArray(0)), 1e-9)
+    }
+
+    @Test
+    fun isAllZeroDetectsEmptyRegions() {
+        assertTrue(EcgResearchStats.isAllZero(ByteArray(1584)))
+        assertTrue(EcgResearchStats.isAllZero(byteArrayOf(1, 0, 0, 0, 2), 1, 4))
+        assertFalse(EcgResearchStats.isAllZero(byteArrayOf(0, 0, 1)))
+        // an empty window is not "all zero"
+        assertFalse(EcgResearchStats.isAllZero(ByteArray(0)))
+    }
+
+    @Test
+    fun changingBytePositionsFindsCounterLikeFields() {
+        val a = byteArrayOf(0x10, 0x00, 0x05, 0x00)
+        val b = byteArrayOf(0x11, 0x00, 0x05, 0x00)   // only byte 0 moved
+        assertEquals(listOf(0), EcgResearchStats.changingBytePositions(a, b))
+
+        val c = byteArrayOf(0x12, 0x00, 0x06, 0x00)   // bytes 0 and 2 moved vs b
+        assertEquals(listOf(0, 2), EcgResearchStats.changingPositionsAcross(listOf(a, b, c)))
+    }
+
+    @Test
+    fun packetsPerSecondByCharacteristic() {
+        // char "0003": 3 packets across 2000ms span => 1.5/s. char "0005": single packet => raw count 1.
+        val records = listOf(
+            rec(0, "0003", ByteArray(20)),
+            rec(1000, "0003", ByteArray(20)),
+            rec(2000, "0003", ByteArray(20)),
+            rec(500, "0005", ByteArray(8)),
+        )
+        val pps = EcgResearchStats.packetsPerSecondByCharacteristic(records)
+        assertEquals(1.5, pps["0003"]!!, 1e-9)
+        assertEquals(1.0, pps["0005"]!!, 1e-9)
+    }
+
+    @Test
+    fun payloadSizeHistogramAndLargestAndRepeatedRecordCount() {
+        val records = listOf(
+            rec(0, "a", ByteArray(1584)),
+            rec(1, "a", ByteArray(1584)),
+            rec(2, "a", ByteArray(1584)),
+            rec(3, "a", ByteArray(20)),
+        )
+        assertEquals(mapOf(20 to 1, 1584 to 3), EcgResearchStats.payloadSizeHistogram(records))
+        assertEquals(listOf(1584, 20), EcgResearchStats.largestPayloadSizes(records))
+        assertEquals(3, EcgResearchStats.countOfSize(records, 1584))
+    }
+
+    @Test
+    fun packetTypeCountsAndUnrecognized() {
+        val records = listOf(
+            rec(0, "a", ByteArray(4), type = 40, recognized = true),
+            rec(1, "a", ByteArray(4), type = 40, recognized = true),
+            rec(2, "a", ByteArray(4), type = null, recognized = false),
+        )
+        assertEquals(2, EcgResearchStats.packetTypeCounts(records)[40])
+        assertEquals(1, EcgResearchStats.packetTypeCounts(records)[null])
+        assertEquals(1, EcgResearchStats.unrecognizedCount(records))
+    }
+
+    @Test
+    fun typeDeltaAroundAStartBoundary() {
+        val records = listOf(
+            rec(0, "a", ByteArray(4), type = 40),      // before
+            rec(100, "a", ByteArray(4), type = 40),    // before
+            rec(200, "a", ByteArray(4), type = 40),    // after (still 40)
+            rec(250, "a", ByteArray(1584), type = 41), // after only — candidate "appeared after Start"
+        )
+        val delta = EcgResearchStats.typeDeltaAround(records, afterMs = 150)
+        assertEquals(listOf<Int?>(41), delta.appearedAfter)
+        assertTrue(delta.disappearedAfter.isEmpty())
+    }
+
+    @Test
+    fun estimateBpmFindsAKnownRateAndRejectsNoise() {
+        // Synthetic 72 bpm at 100 Hz over 6 s: period = 100*60/72 ≈ 83.3 samples.
+        val fs = 100
+        val n = fs * 6
+        val periodSamples = 60.0 * fs / 72.0
+        val beat = IntArray(n) { (1000 * Math.sin(2 * Math.PI * it / periodSamples)).toInt() }
+        val bpm = EcgResearchStats.estimateBpm(beat, fs, excludeLag = null)
+        assertNotNull(bpm)
+        assertTrue("expected ~72, got $bpm", bpm!! in 68..76)
+
+        // Flat/near-zero -> no confident rhythm -> null (never a fabricated number).
+        assertNull(EcgResearchStats.estimateBpm(IntArray(fs * 3) { 0 }, fs, excludeLag = null))
+        // Too short -> null.
+        assertNull(EcgResearchStats.estimateBpm(IntArray(fs / 2) { it }, fs, excludeLag = null))
+    }
+
+    @Test
+    fun maxZeroFractionOfLargeRecords() {
+        val records = listOf(
+            rec(0, "a", ByteArray(1584)),               // all zero, big
+            rec(1, "a", byteArrayOf(1, 2, 3)),          // small — ignored by minSize
+        )
+        assertEquals(1.0, EcgResearchStats.maxZeroFractionOfLargeRecords(records, 64)!!, 1e-9)
+        assertNull(EcgResearchStats.maxZeroFractionOfLargeRecords(listOf(rec(0, "a", ByteArray(4))), 64))
+    }
+}

From 75dca364bd1a499da6112e033e9fea96fb5a71b5 Mon Sep 17 00:00:00 2001
From: Bernd Helm <bhelm@users.noreply.github.com>
Date: Mon, 7 Sep 2026 00:34:56 +0200
Subject: [PATCH 296/333] analytics: a zone-based local day-window helper with
 a Kotlin twin and a committed oracle

Foundation for a DST-correct day boundary, with no caller changed.

The analysis core turns a timestamp into a local day by adding fixed
86,400-second blocks to a midnight derived from one UTC offset captured per
scoring run, so on the far side of a clock change every boundary sits an hour
from the local midnight it claims. There was no shared, tested primitive that
answers when a local date starts and ends in a zone. This adds that and nothing
else.

LocalDayWindows and its Kotlin twin give the start instant of a local date from
the zone's own rules, the half-open window carrying the offset in effect at its
start (23, 24 or 25 hours, or the span to the next existing date where a zone
skipped one), the day containing an instant, its day key, a backward run of
existing dates, and the sleep read window end with the existing clamp to now.
Skipped, repeated and non-existent local midnights follow one stated rule on
both sides: first existing instant, earlier of the two, no start. Implemented
against the raw offset lookup rather than inherited from Calendar or
ZonedDateTime, so a library change is a change to this file rather than a silent
change of a day boundary.

Parity rests on one committed oracle asserted verbatim by both suites, which
fail rather than skip when it is absent. 25 Swift and 25 Kotlin tests, and the
discriminating case pins BOTH the helper's answer and the core's fixed-offset
one for America/New_York, so the hour of disagreement is visible rather than
discovered.

Verified independently on review. The oracle was produced by Swift on Linux,
where its recorded time-zone database version is the literal "unavailable", so
its first meeting with a Darwin database is this PR's own macOS run: that leg is
green. Cross-checking it against a third implementation, Python's zoneinfo,
found zero mismatches across all 18 starts, all 18 windows on both duration and
offset, and all 11 day keys, and confirmed each edge rule directly. Santiago on
2025-09-07 has no local midnight and resolves to the first existing instant;
Havana on 2025-11-02 has two and takes the earlier; Apia's 2011-12-30 does not
exist and is simply absent, with the dateline jump visible as the offset moving
from -36000 to +50400 around it.

Folded in before merge: the two day-start answers now name each other. The
helper's doc described the fixed-offset core it replaces without naming it, and
the core said nothing about the helper, so nothing at either declaration told a
reader that the other existed or which one ships today. Both now do, and both
point at the test that pins the difference.

Reported and implemented by @bhelm, who also stated the limits plainly: this
proves the two build hosts agree, not two devices, and a device counter-check
belongs to the switch-over that will call it.
---
 .../StrandAnalytics/AnalyticsEngine.swift     |   7 +
 .../StrandAnalytics/LocalDayWindows.swift     | 364 ++++++++++++
 .../LocalDayWindowsTests.swift                | 434 ++++++++++++++
 .../com/noop/analytics/AnalyticsEngine.kt     |   7 +
 .../com/noop/analytics/LocalDayWindows.kt     | 479 +++++++++++++++
 .../com/noop/analytics/LocalDayWindowsTest.kt | 551 ++++++++++++++++++
 .../resources/local_day_windows_oracle.json   |  81 +++
 7 files changed, 1923 insertions(+)
 create mode 100644 Packages/StrandAnalytics/Sources/StrandAnalytics/LocalDayWindows.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LocalDayWindowsTests.swift
 create mode 100644 android/app/src/main/java/com/noop/analytics/LocalDayWindows.kt
 create mode 100644 android/app/src/test/java/com/noop/analytics/LocalDayWindowsTest.kt
 create mode 100644 android/app/src/test/resources/local_day_windows_oracle.json

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
index c79e22faef..15edf923f9 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/AnalyticsEngine.swift
@@ -175,6 +175,13 @@ public enum AnalyticsEngine {
     /// from `dayString`), and the Kotlin mirror degrades the SAME way (`runCatching { … }.getOrDefault(0)`)
     /// instead of throwing, so a single bad day key can never take down a whole scoring pass on either
     /// platform (nil-tolerant over fail-fast, per the #996 review).
+    ///
+    /// This is a UTC midnight that callers pair with one captured offset and fixed 86,400-second blocks,
+    /// so every boundary beyond a clock change sits an hour from the local midnight it names.
+    /// `LocalDayWindows` is the zone-rule-correct primitive built to replace that, and is deliberately
+    /// called by nothing yet. This function remains the shipped answer until a switch-over lands; the two
+    /// disagree by an hour on the far side of a transition, and `LocalDayWindowsTests` pins both answers
+    /// so the difference is visible rather than discovered.
     static func dayStartUtcSeconds(_ day: String) -> Int {
         Int(isoDay.date(from: day)?.timeIntervalSince1970 ?? 0)
     }
diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/LocalDayWindows.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/LocalDayWindows.swift
new file mode 100644
index 0000000000..fe4e1e1013
--- /dev/null
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/LocalDayWindows.swift
@@ -0,0 +1,364 @@
+import Foundation
+
+/// A local calendar date as a year/month/day triple, mirroring the components of the Kotlin twin's
+/// `java.time.LocalDate`.
+///
+/// Swift has no calendar-date type that is free of a `Calendar`, and a `Calendar` is exactly what this
+/// helper must not lean on: the day-window rules in this file are stated explicitly so that a future
+/// change of library behaviour cannot move a day boundary silently. So the date is carried as its own
+/// value type and converted to and from a day number with proleptic-Gregorian arithmetic.
+public struct LocalCalendarDate: Hashable, Comparable, Sendable {
+
+    /// The proleptic Gregorian year, negative before year 1.
+    public let year: Int
+
+    /// The month, 1...12.
+    public let month: Int
+
+    /// The day of the month, 1...31. No validation happens here: an out-of-range day is normalised by
+    /// the day-number conversion, the same way `java.time` would reject it and callers here never
+    /// construct one.
+    public let day: Int
+
+    /// Build a date from its components.
+    public init(year: Int, month: Int, day: Int) {
+        self.year = year
+        self.month = month
+        self.day = day
+    }
+
+    /// Build the date that lies `daysSinceEpoch` days after 1970-01-01.
+    public init(daysSinceEpoch: Int) {
+        // Howard Hinnant's civil_from_days, which is exact over the whole Int range and needs no
+        // calendar object. Divisions truncate toward zero in Swift as they do in C, which is what the
+        // era shifts below are written for.
+        var z = daysSinceEpoch + 719_468
+        let era = (z >= 0 ? z : z - 146_096) / 146_097
+        z -= era * 146_097
+        let dayOfEra = z
+        let yearOfEra = (dayOfEra - dayOfEra / 1460 + dayOfEra / 36_524 - dayOfEra / 146_096) / 365
+        let dayOfYear = dayOfEra - (365 * yearOfEra + yearOfEra / 4 - yearOfEra / 100)
+        let monthPrime = (5 * dayOfYear + 2) / 153
+        let d = dayOfYear - (153 * monthPrime + 2) / 5 + 1
+        let m = monthPrime + (monthPrime < 10 ? 3 : -9)
+        let y = yearOfEra + era * 400 + (m <= 2 ? 1 : 0)
+        self.init(year: y, month: m, day: d)
+    }
+
+    /// The number of days from 1970-01-01 to this date, negative before it.
+    public var daysSinceEpoch: Int {
+        // Howard Hinnant's days_from_civil, the exact inverse of the initialiser above.
+        let y = year - (month <= 2 ? 1 : 0)
+        let era = (y >= 0 ? y : y - 399) / 400
+        let yearOfEra = y - era * 400
+        let dayOfYear = (153 * (month + (month > 2 ? -3 : 9)) + 2) / 5 + day - 1
+        let dayOfEra = yearOfEra * 365 + yearOfEra / 4 - yearOfEra / 100 + dayOfYear
+        return era * 146_097 + dayOfEra - 719_468
+    }
+
+    /// The date rendered as `YYYY-MM-DD`, which is also the day key this helper hands out.
+    public var key: String {
+        let y = year < 0 ? "-" + Self.pad(-year, 4) : Self.pad(year, 4)
+        return "\(y)-\(Self.pad(month, 2))-\(Self.pad(day, 2))"
+    }
+
+    /// The date `count` days after this one, negative counts moving backward.
+    public func adding(days count: Int) -> LocalCalendarDate {
+        LocalCalendarDate(daysSinceEpoch: daysSinceEpoch + count)
+    }
+
+    /// Order dates the way the calendar does.
+    public static func < (lhs: LocalCalendarDate, rhs: LocalCalendarDate) -> Bool {
+        if lhs.year != rhs.year { return lhs.year < rhs.year }
+        if lhs.month != rhs.month { return lhs.month < rhs.month }
+        return lhs.day < rhs.day
+    }
+
+    /// Left-pad a non-negative number with zeroes, without a formatter — the twin does the same, and a
+    /// locale-aware formatter is one more thing that could differ between the platforms.
+    private static func pad(_ value: Int, _ width: Int) -> String {
+        var s = String(value)
+        while s.count < width { s = "0" + s }
+        return s
+    }
+}
+
+/// One local day as a half-open window, with the UTC offset that was in effect when it began.
+public struct LocalDayWindow: Hashable, Sendable {
+
+    /// The date this window belongs to.
+    public let date: LocalCalendarDate
+
+    /// The first instant of the date.
+    public let start: Date
+
+    /// The start of the next date that exists in the zone, which is where this window ends. It is not
+    /// always `start` plus 24 hours, and where a calendar date is skipped entirely it is more than a
+    /// day away.
+    public let nextStart: Date
+
+    /// The UTC offset in effect at `start`, in seconds east of UTC.
+    ///
+    /// It describes the window's start only. A time of day anywhere else inside the window is derived
+    /// from the zone, never by adding this number, because a transition inside the window would make
+    /// that wrong by an hour.
+    public let utcOffsetSeconds: Int
+
+    /// Build a window from its parts.
+    public init(date: LocalCalendarDate, start: Date, nextStart: Date, utcOffsetSeconds: Int) {
+        self.date = date
+        self.start = start
+        self.nextStart = nextStart
+        self.utcOffsetSeconds = utcOffsetSeconds
+    }
+
+    /// How long the window lasts — 23, 24 or 25 hours in the fixture zones, and longer where the zone
+    /// skips a calendar date.
+    public var duration: TimeInterval {
+        nextStart.timeIntervalSince(start)
+    }
+}
+
+/// One entry of a backward run: a date that exists in the zone, with the start resolved for it.
+public struct LocalDayStart: Hashable, Sendable {
+
+    /// The date.
+    public let date: LocalCalendarDate
+
+    /// The first instant of that date in the zone.
+    public let start: Date
+
+    /// Build an entry from its parts.
+    public init(date: LocalCalendarDate, start: Date) {
+        self.date = date
+        self.start = start
+    }
+}
+
+/// When a local calendar date begins and ends in a time zone, taken from the zone's own rules.
+///
+/// The analysis core answers this question by adding fixed 86,400-second blocks to a midnight derived
+/// from a single UTC offset. That is wrong by an hour on every day boundary beyond a transition,
+/// because a day on which the clocks move is 23 or 25 hours long. This type is the shared primitive
+/// that answers it correctly; it changes no caller on its own.
+///
+/// SO TWO ANSWERS COEXIST, and this one is not yet the shipped one. `AnalyticsEngine.dayStartUtcSeconds`
+/// with `AnalyticsEngine.dayString` remains what every scored day actually uses; this file is called by
+/// nothing but its own tests until a switch-over lands. They disagree by an hour on the far side of a
+/// transition, which `LocalDayWindowsTests` pins deliberately by asserting BOTH answers for
+/// America/New_York on 2025-10-19. Reach for the core unless you are writing that switch-over.
+///
+/// Kotlin twin: `LocalDayWindows`.
+///
+/// Nothing here is inherited from a calendar: the ambiguous, skipped and non-existent cases are
+/// resolved by the rules stated on each operation, so that a future change in library behaviour is a
+/// change to this file rather than a silent change of a day boundary. The only thing asked of the
+/// platform is `TimeZone.secondsFromGMT(for:)`, the zone's raw rule lookup.
+///
+/// Both the zone and the reference instant are injectable and default to the named accessors
+/// `defaultTimeZone` and `defaultReferenceInstant`, so every rule below is provable without a device.
+public struct LocalDayWindows: Sendable {
+
+    /// The zone used when none is given: the auto-updating current zone, which follows a change of
+    /// device zone during the process's life. The Kotlin twin's default is the system default zone id,
+    /// which means the same thing.
+    ///
+    /// The zone is bound when the helper is constructed; a caller that must follow a device-zone change
+    /// during the process's life constructs a new helper.
+    public static var defaultTimeZone: TimeZone { TimeZone.autoupdatingCurrent }
+
+    /// The reference instant used when none is given: the current `Date`. The Kotlin twin's default is
+    /// the current `Instant`.
+    public static var defaultReferenceInstant: Date { Date() }
+
+    /// The zone whose rules every operation reads.
+    public let timeZone: TimeZone
+
+    /// The instant that stands for "now" — it clamps the sleep read window and nothing else. No start,
+    /// window, key or run depends on it.
+    public let referenceInstant: Date
+
+    /// Build a helper for a zone and a reference instant, both defaulting to the named accessors.
+    public init(timeZone: TimeZone = LocalDayWindows.defaultTimeZone,
+                referenceInstant: Date = LocalDayWindows.defaultReferenceInstant) {
+        self.timeZone = timeZone
+        self.referenceInstant = referenceInstant
+    }
+
+    /// The number of seconds either side of a local midnight that is probed for the offsets in effect
+    /// around it. Two days is far more than any transition needs and still far less than the gap
+    /// between two transitions anywhere in the database.
+    private static let probeWindow: Int64 = 2 * 86_400
+
+    /// The first instant that belongs to `date` in this zone, or `nil` when the zone has no instant on
+    /// that date at all.
+    ///
+    /// The rule, stated rather than inherited: where local midnight exists once, that is the start;
+    /// where it exists twice, the earlier of the two; where it does not exist, the first instant that
+    /// does exist on the date, which is the instant the clocks jumped to. Where that jump lands on a
+    /// later date the date itself never happened, and there is no start.
+    ///
+    /// The rule assumes at most one offset change within two days either side of the local midnight; no
+    /// zone in the database violates that today.
+    ///
+    /// The result does not depend on `referenceInstant`.
+    public func start(of date: LocalCalendarDate) -> Date? {
+        let localMidnight = Int64(date.daysSinceEpoch) * 86_400
+        let offsetBefore = offsetSeconds(atEpochSeconds: localMidnight - Self.probeWindow)
+        let offsetAfter = offsetSeconds(atEpochSeconds: localMidnight + Self.probeWindow)
+
+        var candidates = [localMidnight - Int64(offsetBefore), localMidnight - Int64(offsetAfter)].sorted()
+        if candidates.count == 2 && candidates[0] == candidates[1] { candidates.removeLast() }
+        // An instant maps to this local midnight exactly when reading it in the zone gives that wall
+        // time back. Ascending order means an ambiguous midnight yields the earlier instant first.
+        for candidate in candidates
+        where candidate + Int64(offsetSeconds(atEpochSeconds: candidate)) == localMidnight {
+            return Date(timeIntervalSince1970: TimeInterval(candidate))
+        }
+
+        // Local midnight fell in a gap. The first instant that exists on or after it is the instant the
+        // clocks jumped at; it belongs to this date only if it still reads as this date.
+        guard offsetBefore != offsetAfter else { return nil }
+        let jump = transitionEpochSeconds(around: localMidnight, offsetBefore: offsetBefore)
+        guard localDate(ofEpochSeconds: jump) == date else { return nil }
+        return Date(timeIntervalSince1970: TimeInterval(jump))
+    }
+
+    /// The half-open window `[start, nextStart)` of `date`, or `nil` when the date does not exist.
+    ///
+    /// `nextStart` is the start of the next date that *exists*, so a window that precedes a skipped
+    /// calendar date spans more than a day rather than ending at an instant that never happened.
+    public func window(of date: LocalCalendarDate) -> LocalDayWindow? {
+        guard let dayStart = start(of: date) else { return nil }
+        var next = date.adding(days: 1)
+        var nextStart: Date?
+        // A zone skipping more than a couple of consecutive dates has never happened; the bound keeps a
+        // corrupt zone from turning this into an unbounded walk.
+        for _ in 0..<8 {
+            if let candidate = start(of: next) {
+                nextStart = candidate
+                break
+            }
+            next = next.adding(days: 1)
+        }
+        guard let end = nextStart else { return nil }
+        return LocalDayWindow(date: date,
+                              start: dayStart,
+                              nextStart: end,
+                              utcOffsetSeconds: offsetSeconds(at: dayStart))
+    }
+
+    /// The start of the local day that contains `instant`, as an instant and without formatting a date
+    /// on the way.
+    public func startOfDay(containing instant: Date) -> Date {
+        let date = localDate(of: instant)
+        // `instant` lies on `date` by construction, so the date exists and has a start. The fallback
+        // is unreachable and exists only to keep the operation total.
+        guard let start = start(of: date) else { return instant }
+        return start
+    }
+
+    /// The `YYYY-MM-DD` key of the local day that contains `instant`.
+    ///
+    /// The key and the window agree by construction: the key names the date whose window contains the
+    /// instant, because both are derived from the same zone lookup.
+    public func dayKey(for instant: Date) -> String {
+        localDate(of: instant).key
+    }
+
+    /// The local calendar date that contains `instant` in this zone.
+    public func localDate(of instant: Date) -> LocalCalendarDate {
+        localDate(ofEpochSeconds: Int64(instant.timeIntervalSince1970.rounded(.down)))
+    }
+
+    /// Up to `count` consecutive local calendar dates ending at `date`, oldest first, each with its own
+    /// resolved start.
+    ///
+    /// A date the zone skipped is omitted rather than replaced, so the run can be shorter than
+    /// requested; if `date` itself does not exist, the newest entry is the latest existing date before
+    /// it.
+    public func backwardRun(endingAt date: LocalCalendarDate, count: Int) -> [LocalDayStart] {
+        guard count > 0 else { return [] }
+        let endDay = date.daysSinceEpoch
+        var run: [LocalDayStart] = []
+        run.reserveCapacity(count)
+        for back in stride(from: count - 1, through: 0, by: -1) {
+            let day = LocalCalendarDate(daysSinceEpoch: endDay - back)
+            if let start = start(of: day) {
+                run.append(LocalDayStart(date: day, start: start))
+            }
+        }
+        return run
+    }
+
+    /// The end of the sleep read window of `date`: the earlier of that date's next start and the
+    /// reference instant, so the current day's window never reaches into the future. `nil` when the
+    /// date does not exist.
+    ///
+    /// For a date that begins after the reference instant the end precedes the start — an empty,
+    /// inverted window — by the D7 contract; a caller wanting a non-empty window must not ask for a
+    /// future date.
+    public func sleepReadWindowEnd(of date: LocalCalendarDate) -> Date? {
+        guard let window = window(of: date) else { return nil }
+        return min(window.nextStart, referenceInstant)
+    }
+
+    /// The UTC offset in effect at `instant`, in seconds east of UTC.
+    public func offsetSeconds(at instant: Date) -> Int {
+        timeZone.secondsFromGMT(for: instant)
+    }
+
+    /// The time-zone database version this platform can observe about itself, or `nil` where it cannot.
+    ///
+    /// Only Darwin exposes one; on Linux the Foundation port has no equivalent, and saying so is the
+    /// point — a faked value would claim a fact nobody checked.
+    public static var observedTimeZoneDataVersion: String? {
+        #if canImport(Darwin)
+        return NSTimeZone.timeZoneDataVersion
+        #else
+        return nil
+        #endif
+    }
+
+    /// The note a platform attaches when a fixture value moves: it names the version recorded in the
+    /// oracle and the version this platform observes at run time.
+    ///
+    /// A version difference is not itself a failure — the fixtures are past and stable, so a routine
+    /// toolchain bump must not redden unrelated work. The note exists to make a *value* difference
+    /// explicable. It is a pure function so that its content can be asserted; where a platform cannot
+    /// observe its own version, the note says so in place of a version rather than omitting it.
+    public static func timeZoneDataVersionNote(recorded: String, observed: String?) -> String {
+        let observedText = observed.map { "observes \($0)" }
+            ?? "cannot observe its own time-zone database version"
+        return "time-zone database version: the oracle records \(recorded); this platform \(observedText)."
+    }
+
+    /// The UTC offset in effect at a whole-second instant.
+    private func offsetSeconds(atEpochSeconds seconds: Int64) -> Int {
+        timeZone.secondsFromGMT(for: Date(timeIntervalSince1970: TimeInterval(seconds)))
+    }
+
+    /// The local calendar date of a whole-second instant.
+    private func localDate(ofEpochSeconds seconds: Int64) -> LocalCalendarDate {
+        let localSeconds = seconds + Int64(offsetSeconds(atEpochSeconds: seconds))
+        var days = localSeconds / 86_400
+        if localSeconds < 0 && localSeconds % 86_400 != 0 { days -= 1 }
+        return LocalCalendarDate(daysSinceEpoch: Int(days))
+    }
+
+    /// The instant at which the zone's offset changes near `localMidnight`, found by bisecting the
+    /// probe window between the offset before and the offset after.
+    private func transitionEpochSeconds(around localMidnight: Int64, offsetBefore: Int) -> Int64 {
+        var low = localMidnight - Self.probeWindow
+        var high = localMidnight + Self.probeWindow
+        while high - low > 1 {
+            let mid = low + (high - low) / 2
+            if offsetSeconds(atEpochSeconds: mid) == offsetBefore {
+                low = mid
+            } else {
+                high = mid
+            }
+        }
+        return high
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LocalDayWindowsTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LocalDayWindowsTests.swift
new file mode 100644
index 0000000000..f060d7e64e
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/LocalDayWindowsTests.swift
@@ -0,0 +1,434 @@
+import Foundation
+import XCTest
+@testable import StrandAnalytics
+
+/// The day-window primitive, one test per scenario of the `daily-windows` specification, plus the
+/// parity oracle that the Kotlin twin reads from the same committed file.
+///
+/// Every fixture passes an explicit zone and an explicit reference instant, so nothing here depends on
+/// the machine's zone or on when the suite runs. The two exceptions are the default-accessor tests,
+/// which are about the defaults themselves and deliberately do not go through the oracle.
+final class LocalDayWindowsTests: XCTestCase {
+
+    // MARK: - Fixture helpers
+
+    /// A date written the way the specification writes it.
+    private func date(_ text: String) -> LocalCalendarDate {
+        let parts = text.split(separator: "-").map { Int($0)! }
+        return LocalCalendarDate(year: parts[0], month: parts[1], day: parts[2])
+    }
+
+    /// An instant from whole seconds since the epoch.
+    private func instant(_ epochSeconds: Int) -> Date {
+        Date(timeIntervalSince1970: TimeInterval(epochSeconds))
+    }
+
+    /// A UTC instant written as `YYYY-MM-DDTHH:MM:SSZ`, parsed without a formatter so the test's own
+    /// expectations do not depend on a locale or a calendar.
+    private func utc(_ text: String) -> Date {
+        let halves = text.dropLast().split(separator: "T")
+        let day = halves[0].split(separator: "-").map { Int($0)! }
+        let time = halves[1].split(separator: ":").map { Int($0)! }
+        let days = LocalCalendarDate(year: day[0], month: day[1], day: day[2]).daysSinceEpoch
+        return instant(days * 86_400 + time[0] * 3600 + time[1] * 60 + time[2])
+    }
+
+    /// The helper for a zone, with a reference instant that no scenario in this section depends on.
+    private func windows(_ zoneName: String,
+                         reference: Date = Date(timeIntervalSince1970: 0)) -> LocalDayWindows {
+        LocalDayWindows(timeZone: TimeZone(identifier: zoneName)!, referenceInstant: reference)
+    }
+
+    // MARK: - A local date begins at its own local midnight
+
+    /// The discriminating case: the helper and the analysis core's fixed-offset arithmetic disagree by
+    /// an hour across a transition.
+    ///
+    /// The core's arithmetic is re-derived inline, verbatim per the scenario, because the incumbent
+    /// lives in the app target and a package test cannot import it: floor to a local midnight using the
+    /// zone's offset at the reference instant, then subtract whole 86,400-second days.
+    func testResolvedStartDiffersFromFixedOffsetArithmeticAcrossATransition() {
+        let zone = TimeZone(identifier: "America/New_York")!
+        let reference = utc("2025-11-10T17:00:00Z")  // 12:00 local, inside standard time
+        let helper = LocalDayWindows(timeZone: zone, referenceInstant: reference)
+
+        let resolved = helper.start(of: date("2025-10-19"))
+
+        let offset = TimeInterval(zone.secondsFromGMT(for: reference))
+        let localSeconds = reference.timeIntervalSince1970 + offset
+        let referenceMidnight = (localSeconds / 86_400).rounded(.down) * 86_400 - offset
+        let fixedOffsetStart = Date(timeIntervalSince1970: referenceMidnight - 22 * 86_400)
+
+        XCTAssertEqual(resolved, utc("2025-10-19T04:00:00Z"))
+        XCTAssertEqual(fixedOffsetStart, utc("2025-10-19T05:00:00Z"))
+        XCTAssertNotEqual(resolved, fixedOffsetStart)
+    }
+
+    /// Two reference instants on opposite sides of the zone's autumn transition give the same start.
+    func testResultDoesNotDependOnTheReferenceInstant() {
+        let before = windows("America/New_York", reference: utc("2025-10-15T12:00:00Z"))
+        let after = windows("America/New_York", reference: utc("2025-12-15T12:00:00Z"))
+
+        XCTAssertEqual(before.start(of: date("2025-10-19")), utc("2025-10-19T04:00:00Z"))
+        XCTAssertEqual(after.start(of: date("2025-10-19")), utc("2025-10-19T04:00:00Z"))
+    }
+
+    /// A zone offset of 5 hours 45 minutes puts the start on its own local midnight, off the hour.
+    func testDayWithFortyFiveMinuteOffsetStartsAtItsOwnLocalMidnight() {
+        let helper = windows("Asia/Kathmandu")
+
+        let start = helper.start(of: date("2025-06-15"))
+
+        XCTAssertEqual(start, utc("2025-06-14T18:15:00Z"))
+        XCTAssertEqual(helper.offsetSeconds(at: start!), 20_700)
+        XCTAssertNotEqual(Int(start!.timeIntervalSince1970) % 3600, 0)
+    }
+
+    // MARK: - A day window lasts as long as the zone says and carries its own offset
+
+    /// The spring-forward day is 23 hours long.
+    func testSpringForwardDayIsTwentyThreeHours() {
+        let window = windows("America/New_York").window(of: date("2025-03-09"))
+
+        XCTAssertEqual(window?.duration, 23 * 3600)
+    }
+
+    /// The fall-back day is 25 hours long.
+    func testFallBackDayIsTwentyFiveHours() {
+        let window = windows("America/New_York").window(of: date("2025-11-02"))
+
+        XCTAssertEqual(window?.duration, 25 * 3600)
+    }
+
+    /// A zone without daylight saving has 24-hour days.
+    func testDayInZoneWithoutDaylightSavingIsTwentyFourHours() {
+        let window = windows("Asia/Kolkata").window(of: date("2025-06-15"))
+
+        XCTAssertEqual(window?.duration, 24 * 3600)
+    }
+
+    /// Consecutive windows meet exactly across a transition, leaving neither a gap nor an overlap.
+    func testConsecutiveWindowsMeetExactly() throws {
+        let helper = windows("America/New_York")
+
+        let first = try XCTUnwrap(helper.window(of: date("2025-11-01")))
+        let second = try XCTUnwrap(helper.window(of: date("2025-11-02")))
+        let third = try XCTUnwrap(helper.window(of: date("2025-11-03")))
+
+        XCTAssertEqual(first.nextStart, second.start)
+        XCTAssertEqual(second.nextStart, third.start)
+    }
+
+    /// The window reports the offset in effect at its own start, not at some other moment of the day.
+    func testWindowReportsOffsetInEffectAtItsStart() {
+        let helper = windows("America/New_York")
+
+        XCTAssertEqual(helper.window(of: date("2025-11-01"))?.utcOffsetSeconds, -14_400)
+        XCTAssertEqual(helper.window(of: date("2025-11-03"))?.utcOffsetSeconds, -18_000)
+    }
+
+    // MARK: - The helper resolves the start of the local day containing an instant
+
+    /// An instant inside the repeated local hour still resolves to that day's start.
+    func testInstantInsideTwentyFiveHourDayResolvesToThatDaysStart() {
+        let helper = windows("America/New_York")
+
+        let start = helper.startOfDay(containing: utc("2025-11-02T05:30:00Z"))
+
+        XCTAssertEqual(start, utc("2025-11-02T04:00:00Z"))
+    }
+
+    /// A start instant resolves to itself, for every fixture date that exists.
+    func testContainingDayStartOfAStartInstantIsItself() {
+        for (zone, day) in [("America/New_York", "2025-03-09"),
+                            ("America/New_York", "2025-11-02"),
+                            ("America/New_York", "2025-10-19"),
+                            ("America/Santiago", "2025-09-07"),
+                            ("America/Havana", "2025-11-02"),
+                            ("Pacific/Apia", "2011-12-31"),
+                            ("Asia/Kolkata", "2025-06-15"),
+                            ("Asia/Kathmandu", "2025-06-15")] {
+            let helper = windows(zone)
+            let start = helper.start(of: date(day))
+            XCTAssertNotNil(start, "\(zone) \(day) must have a start")
+            if let start {
+                XCTAssertEqual(helper.startOfDay(containing: start), start, "\(zone) \(day)")
+            }
+        }
+    }
+
+    // MARK: - An instant's day key names the window that contains it
+
+    /// The key flips exactly at the window boundary and nowhere else.
+    func testDayKeyChangesExactlyAtTheWindowBoundary() {
+        let helper = windows("America/New_York")
+        let start = helper.start(of: date("2025-11-02"))!
+
+        XCTAssertEqual(helper.dayKey(for: start.addingTimeInterval(-1)), "2025-11-01")
+        XCTAssertEqual(helper.dayKey(for: start.addingTimeInterval(1)), "2025-11-02")
+    }
+
+    /// The key holds for all 25 hours of the fall-back day, including the repeated local hour.
+    func testDayKeyHoldsAcrossTheWholeOfATwentyFiveHourDay() {
+        let helper = windows("America/New_York")
+        let window = helper.window(of: date("2025-11-02"))!
+
+        XCTAssertEqual(helper.dayKey(for: window.start), "2025-11-02")
+        XCTAssertEqual(helper.dayKey(for: utc("2025-11-02T05:30:00Z")), "2025-11-02")
+        XCTAssertEqual(helper.dayKey(for: window.nextStart.addingTimeInterval(-1)), "2025-11-02")
+    }
+
+    // MARK: - An ambiguous or missing local midnight resolves by a stated rule
+
+    /// A date with no 00:00 starts at its first existing instant, its local 01:00.
+    func testTransitionThatSkipsLocalMidnight() {
+        let start = windows("America/Santiago").start(of: date("2025-09-07"))
+
+        XCTAssertEqual(start, utc("2025-09-07T04:00:00Z"))
+    }
+
+    /// A date with two 00:00 starts at the earlier of them.
+    func testTransitionThatRepeatsLocalMidnight() {
+        let helper = windows("America/Havana")
+
+        let start = helper.start(of: date("2025-11-02"))
+
+        XCTAssertEqual(start, utc("2025-11-02T04:00:00Z"))
+        XCTAssertEqual(helper.offsetSeconds(at: start!), -14_400)
+        // The later of the two midnights, which the rule must not pick.
+        XCTAssertEqual(helper.offsetSeconds(at: utc("2025-11-02T05:00:00Z")), -18_000)
+    }
+
+    // MARK: - A date that does not exist is skipped over
+
+    /// A calendar date the zone skipped has no start at all.
+    func testSkippedCalendarDateProducesNoStart() {
+        XCTAssertNil(windows("Pacific/Apia").start(of: date("2011-12-30")))
+    }
+
+    /// The preceding date's window reaches over the skipped date to the next existing one.
+    func testPrecedingDatesWindowReachesTheNextExistingDate() {
+        let helper = windows("Pacific/Apia")
+
+        let window = helper.window(of: date("2011-12-29"))
+
+        XCTAssertEqual(window?.nextStart, helper.start(of: date("2011-12-31")))
+        XCTAssertEqual(window?.duration, 24 * 3600)
+    }
+
+    // MARK: - A backward run yields consecutive existing dates with their own starts
+
+    /// A run spanning the autumn transition is consecutive and each entry carries its own start.
+    func testRunAcrossATransitionIsConsecutiveAndCorrectlyAnchored() {
+        let helper = windows("America/New_York")
+
+        let run = helper.backwardRun(endingAt: date("2025-11-10"), count: 21)
+
+        XCTAssertEqual(run.count, 21)
+        XCTAssertEqual(run.first?.date.key, "2025-10-21")
+        XCTAssertEqual(run.last?.date.key, "2025-11-10")
+        for (index, entry) in run.enumerated() {
+            XCTAssertEqual(entry.date.daysSinceEpoch,
+                           date("2025-10-21").daysSinceEpoch + index,
+                           "run must be consecutive at \(entry.date.key)")
+            XCTAssertEqual(entry.start, helper.start(of: entry.date), entry.date.key)
+        }
+    }
+
+    /// A run containing a skipped date is shorter than requested and omits it.
+    func testRunContainingASkippedDateIsShorterThanRequested() {
+        let run = windows("Pacific/Apia").backwardRun(endingAt: date("2012-01-02"), count: 5)
+
+        XCTAssertEqual(run.count, 4)
+        XCTAssertEqual(run.first?.date.key, "2011-12-29")
+        XCTAssertEqual(run.map(\.date.key), ["2011-12-29", "2011-12-31", "2012-01-01", "2012-01-02"])
+    }
+
+    /// A long run lands on the right calendar date, 3999 days before the anchor.
+    func testLongRunReachesTheRightCalendarDate() {
+        let run = windows("America/New_York").backwardRun(endingAt: date("2025-11-10"), count: 4000)
+
+        XCTAssertEqual(run.count, 4000)
+        XCTAssertEqual(run.first?.date.key, "2014-11-29")
+        XCTAssertEqual(run.last?.date.key, "2025-11-10")
+    }
+
+    // MARK: - The sleep read window never extends into the future
+
+    /// The current date's window stops at the reference instant instead of its next start.
+    func testCurrentDatesWindowStopsAtTheReferenceInstant() {
+        let helper = windows("America/New_York", reference: utc("2025-11-02T18:00:00Z"))
+
+        let end = helper.sleepReadWindowEnd(of: date("2025-11-02"))
+
+        XCTAssertEqual(end, utc("2025-11-02T18:00:00Z"))
+        XCTAssertNotEqual(end, helper.window(of: date("2025-11-02"))?.nextStart)
+    }
+
+    /// A past 25-hour day reaches its own next start, 25 hours after it began.
+    func testPastTwentyFiveHourDayReachesItsOwnNextStart() {
+        let helper = windows("America/New_York", reference: utc("2025-12-15T12:00:00Z"))
+
+        let end = helper.sleepReadWindowEnd(of: date("2025-11-02"))
+        let window = helper.window(of: date("2025-11-02"))!
+
+        XCTAssertEqual(end, window.nextStart)
+        XCTAssertEqual(end?.timeIntervalSince(window.start), 25 * 3600)
+    }
+
+    // MARK: - The default zone and reference instant are named, not implied
+
+    /// The default zone is the auto-updating current zone named in the design, not a snapshot of it.
+    func testDefaultZoneIsThePlatformsTrackingDeviceZone() {
+        XCTAssertEqual(LocalDayWindows.defaultTimeZone, TimeZone.autoupdatingCurrent)
+        XCTAssertEqual(LocalDayWindows().timeZone, TimeZone.autoupdatingCurrent)
+        XCTAssertEqual(LocalDayWindows(referenceInstant: Date()).timeZone, TimeZone.autoupdatingCurrent)
+    }
+
+    /// The default reference instant is the current `Date`, so it lies inside a bracket taken around
+    /// the call.
+    func testDefaultReferenceInstantIsThePlatformsCurrentInstant() {
+        let before = Date()
+        let accessor = LocalDayWindows.defaultReferenceInstant
+        let helperDefault = LocalDayWindows().referenceInstant
+        let after = Date()
+
+        XCTAssertGreaterThanOrEqual(accessor, before)
+        XCTAssertLessThanOrEqual(accessor, after)
+        XCTAssertGreaterThanOrEqual(helperDefault, before)
+        XCTAssertLessThanOrEqual(helperDefault, after)
+    }
+
+    // MARK: - Both platforms agree, proven by a committed oracle
+
+    /// The committed oracle, loaded by a path derived from this file's own location.
+    ///
+    /// It fails rather than skips when the file is absent: an oracle nobody can find would otherwise
+    /// let both platforms stay green while they disagree, which is the whole thing this file guards.
+    private func loadOracle() throws -> [String: Any] {
+        let relative = "android/app/src/test/resources/local_day_windows_oracle.json"
+        var dir = URL(fileURLWithPath: #filePath).deletingLastPathComponent()
+        for _ in 0..<8 {
+            let candidate = dir.appendingPathComponent(relative)
+            if FileManager.default.fileExists(atPath: candidate.path) {
+                let data = try Data(contentsOf: candidate)
+                let parsed = try JSONSerialization.jsonObject(with: data)
+                return try XCTUnwrap(parsed as? [String: Any], "the oracle must be a JSON object")
+            }
+            dir = dir.deletingLastPathComponent()
+        }
+        XCTFail("committed oracle \(relative) not found above \(#filePath) — this test must not pass by default")
+        throw CocoaError(.fileNoSuchFile)
+    }
+
+    /// Every value in the committed oracle, re-derived by the helper and compared.
+    ///
+    /// The Kotlin twin asserts the same file, so a change on either side reddens one of the two suites.
+    func testSwiftTestReadsTheSameCommittedFile() throws {
+        let oracle = try loadOracle()
+
+        let producedBy = try XCTUnwrap(oracle["producedBy"] as? [String: Any])
+        XCTAssertFalse(try XCTUnwrap(producedBy["toolchain"] as? String).isEmpty)
+        XCTAssertFalse(try XCTUnwrap(producedBy["timeZoneDataVersion"] as? String).isEmpty)
+
+        let recorded = try XCTUnwrap(producedBy["timeZoneDataVersion"] as? String)
+        let note = LocalDayWindows.timeZoneDataVersionNote(
+            recorded: recorded, observed: LocalDayWindows.observedTimeZoneDataVersion)
+
+        let starts = try XCTUnwrap(oracle["starts"] as? [[String: Any]])
+        XCTAssertEqual(starts.count, 19, "oracle section starts")
+        for record in starts {
+            let helper = windows(try XCTUnwrap(record["zone"] as? String))
+            let day = date(try XCTUnwrap(record["date"] as? String))
+            let expected = record["start"] as? Int
+            let context = "start \(helper.timeZone.identifier) \(day.key) — \(note)"
+            XCTAssertEqual(helper.start(of: day).map { Int($0.timeIntervalSince1970) }, expected, context)
+        }
+
+        let windowRecords = try XCTUnwrap(oracle["windows"] as? [[String: Any]])
+        XCTAssertEqual(windowRecords.count, 18, "oracle section windows")
+        for record in windowRecords {
+            let helper = windows(try XCTUnwrap(record["zone"] as? String))
+            let day = date(try XCTUnwrap(record["date"] as? String))
+            let window = try XCTUnwrap(helper.window(of: day))
+            let context = "window \(helper.timeZone.identifier) \(day.key) — \(note)"
+            XCTAssertEqual(Int(window.start.timeIntervalSince1970), record["start"] as? Int, context)
+            XCTAssertEqual(Int(window.nextStart.timeIntervalSince1970), record["nextStart"] as? Int, context)
+            XCTAssertEqual(window.utcOffsetSeconds, record["utcOffsetSeconds"] as? Int, context)
+        }
+
+        let containing = try XCTUnwrap(oracle["containingDayStarts"] as? [[String: Any]])
+        XCTAssertEqual(containing.count, 8, "oracle section containingDayStarts")
+        for record in containing {
+            let helper = windows(try XCTUnwrap(record["zone"] as? String))
+            let at = instant(try XCTUnwrap(record["instant"] as? Int))
+            let context = "containing \(helper.timeZone.identifier) \(record["instant"] ?? "?") — \(note)"
+            XCTAssertEqual(Int(helper.startOfDay(containing: at).timeIntervalSince1970),
+                           record["start"] as? Int, context)
+        }
+
+        let keys = try XCTUnwrap(oracle["dayKeys"] as? [[String: Any]])
+        XCTAssertEqual(keys.count, 11, "oracle section dayKeys")
+        for record in keys {
+            let helper = windows(try XCTUnwrap(record["zone"] as? String))
+            let at = instant(try XCTUnwrap(record["instant"] as? Int))
+            let context = "key \(helper.timeZone.identifier) \(record["instant"] ?? "?") — \(note)"
+            XCTAssertEqual(helper.dayKey(for: at), record["key"] as? String, context)
+        }
+
+        let runs = try XCTUnwrap(oracle["runs"] as? [[String: Any]])
+        XCTAssertEqual(runs.count, 4, "oracle section runs")
+        for record in runs {
+            let helper = windows(try XCTUnwrap(record["zone"] as? String))
+            let anchor = date(try XCTUnwrap(record["endingAt"] as? String))
+            let requested = try XCTUnwrap(record["requested"] as? Int)
+            let run = helper.backwardRun(endingAt: anchor, count: requested)
+            let context = "run \(helper.timeZone.identifier) \(anchor.key)/\(requested) — \(note)"
+            XCTAssertEqual(run.count, record["size"] as? Int, context)
+            for (edge, entry) in [("oldest", run.first), ("newest", run.last)] {
+                let expected = try XCTUnwrap(record[edge] as? [String: Any], context)
+                XCTAssertEqual(entry?.date.key, expected["date"] as? String, "\(edge) \(context)")
+                XCTAssertEqual(entry.map { Int($0.start.timeIntervalSince1970) },
+                               expected["start"] as? Int, "\(edge) \(context)")
+            }
+            // Short runs carry every entry; the 4000-day run carries its edges and its size only, so
+            // that the committed file stays reviewable, and says so in `daysTruncated`.
+            let days = try XCTUnwrap(record["days"] as? [[String: Any]], context)
+            if try XCTUnwrap(record["daysTruncated"] as? Bool, context) {
+                XCTAssertTrue(days.isEmpty, context)
+            } else {
+                XCTAssertEqual(days.count, run.count, context)
+                for (entry, expected) in zip(run, days) {
+                    XCTAssertEqual(entry.date.key, expected["date"] as? String, context)
+                    XCTAssertEqual(Int(entry.start.timeIntervalSince1970), expected["start"] as? Int, context)
+                }
+            }
+        }
+
+        let sleepEnds = try XCTUnwrap(oracle["sleepWindowEnds"] as? [[String: Any]])
+        XCTAssertEqual(sleepEnds.count, 5, "oracle section sleepWindowEnds")
+        for record in sleepEnds {
+            let reference = instant(try XCTUnwrap(record["referenceInstant"] as? Int))
+            let helper = windows(try XCTUnwrap(record["zone"] as? String), reference: reference)
+            let day = date(try XCTUnwrap(record["date"] as? String))
+            let context = "sleep end \(helper.timeZone.identifier) \(day.key) — \(note)"
+            XCTAssertEqual(helper.sleepReadWindowEnd(of: day).map { Int($0.timeIntervalSince1970) },
+                           record["end"] as? Int, context)
+        }
+    }
+
+    /// The mismatch note names the recorded version and the observed one, and says so plainly where the
+    /// platform has no version of its own to report.
+    func testMismatchNoteNamesBothDatabaseVersions() {
+        let observed = LocalDayWindows.timeZoneDataVersionNote(recorded: "2025b", observed: "2025a")
+        XCTAssertEqual(observed,
+                       "time-zone database version: the oracle records 2025b; this platform observes 2025a.")
+
+        let blind = LocalDayWindows.timeZoneDataVersionNote(recorded: "unavailable", observed: nil)
+        XCTAssertEqual(blind,
+                       "time-zone database version: the oracle records unavailable; "
+                       + "this platform cannot observe its own time-zone database version.")
+        XCTAssertTrue(blind.contains("cannot observe"))
+        XCTAssertTrue(blind.contains("unavailable"))
+    }
+}
diff --git a/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt b/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
index f8081ef6e1..ae8a268388 100644
--- a/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/AnalyticsEngine.kt
@@ -138,6 +138,13 @@ object AnalyticsEngine {
      * back to 0 — an empty 1970 window no real sample matches — rather than throwing, so a single bad key can
      * never take down a whole scoring pass. Byte-identical twin of the Swift `AnalyticsEngine.dayStartUtcSeconds`
      * (locked cross-platform by AnalyticsEngineDayBoundsTest / AnalyticsEngineDayBoundsTests).
+     *
+     * This is a UTC midnight that callers pair with one captured offset and fixed 86,400-second blocks, so
+     * every boundary beyond a clock change sits an hour from the local midnight it names. [LocalDayWindows]
+     * is the zone-rule-correct primitive built to replace that, and is deliberately called by nothing yet.
+     * This function remains the shipped answer until a switch-over lands; the two disagree by an hour on
+     * the far side of a transition, and `LocalDayWindowsTest` pins both answers so the difference is
+     * visible rather than discovered.
      */
     fun dayStartUtcSeconds(day: String): Long =
         runCatching { LocalDate.parse(day).atStartOfDay(ZoneOffset.UTC).toEpochSecond() }.getOrDefault(0L)
diff --git a/android/app/src/main/java/com/noop/analytics/LocalDayWindows.kt b/android/app/src/main/java/com/noop/analytics/LocalDayWindows.kt
new file mode 100644
index 0000000000..f2182d7ed5
--- /dev/null
+++ b/android/app/src/main/java/com/noop/analytics/LocalDayWindows.kt
@@ -0,0 +1,479 @@
+package com.noop.analytics
+
+import java.time.Duration
+import java.time.Instant
+import java.time.ZoneId
+
+/**
+ * A local calendar date as a year/month/day triple, mirroring the components of `java.time.LocalDate`
+ * without depending on its resolution rules.
+ *
+ * The Swift side carries its own value type because Swift has no calendar-date type free of a
+ * `Calendar`. This twin carries the same triple rather than a `LocalDate`, so that both sides run the
+ * same proleptic-Gregorian arithmetic and neither inherits a library's choice about a day boundary.
+ *
+ * Swift twin: `LocalCalendarDate`.
+ */
+internal data class LocalCalendarDate(
+    /** The proleptic Gregorian year, negative before year 1. Swift twin: `LocalCalendarDate.year`. */
+    val year: Int,
+    /** The month, 1..12. Swift twin: `LocalCalendarDate.month`. */
+    val month: Int,
+    /**
+     * The day of the month, 1..31. No validation happens here: an out-of-range day is normalised by the
+     * day-number conversion, the same way `java.time` would reject it and callers here never construct
+     * one. Swift twin: `LocalCalendarDate.day`.
+     */
+    val day: Int,
+) : Comparable<LocalCalendarDate> {
+
+    /**
+     * The date that lies `daysSinceEpoch` days after 1970-01-01.
+     *
+     * This is the counterpart of the Swift initialiser init(daysSinceEpoch:) and carries no parity
+     * claim, because the parity guard inventories function declarations only and has no initialiser to
+     * pair a claim with.
+     *
+     * The conversion is Howard Hinnant's civil_from_days, which needs no calendar object. Kotlin's
+     * integer division truncates toward zero as Swift's does, which is what the era shifts are written
+     * for. It runs inline in the delegation below and hands its three components on as one array,
+     * because a data class constructor may only delegate to the primary one and computing the
+     * components in a named helper would leave that helper with no counterpart of its own.
+     */
+    constructor(daysSinceEpoch: Int) : this(
+        // `kotlin.run` by its full name: the bare form resolves to the receiver extension, and there is
+        // no receiver yet inside a constructor delegation.
+        kotlin.run {
+            var z = daysSinceEpoch + 719_468
+            val era = (if (z >= 0) z else z - 146_096) / 146_097
+            z -= era * 146_097
+            val dayOfEra = z
+            val yearOfEra = (dayOfEra - dayOfEra / 1460 + dayOfEra / 36_524 - dayOfEra / 146_096) / 365
+            val dayOfYear = dayOfEra - (365 * yearOfEra + yearOfEra / 4 - yearOfEra / 100)
+            val monthPrime = (5 * dayOfYear + 2) / 153
+            val d = dayOfYear - (153 * monthPrime + 2) / 5 + 1
+            val m = monthPrime + (if (monthPrime < 10) 3 else -9)
+            val y = yearOfEra + era * 400 + (if (m <= 2) 1 else 0)
+            intArrayOf(y, m, d)
+        },
+    )
+
+    /**
+     * The year, month and day of a converted day number, in that order — the one hop that lets the day-
+     * number constructor above reach the primary one.
+     */
+    private constructor(civil: IntArray) : this(year = civil[0], month = civil[1], day = civil[2])
+
+    /**
+     * The number of days from 1970-01-01 to this date, negative before it.
+     *
+     * Swift twin: `LocalCalendarDate.daysSinceEpoch`.
+     */
+    val daysSinceEpoch: Int
+        get() {
+            // Howard Hinnant's days_from_civil, the exact inverse of the day-number constructor above.
+            val y = year - (if (month <= 2) 1 else 0)
+            val era = (if (y >= 0) y else y - 399) / 400
+            val yearOfEra = y - era * 400
+            val dayOfYear = (153 * (month + (if (month > 2) -3 else 9)) + 2) / 5 + day - 1
+            val dayOfEra = yearOfEra * 365 + yearOfEra / 4 - yearOfEra / 100 + dayOfYear
+            return era * 146_097 + dayOfEra - 719_468
+        }
+
+    /**
+     * The date rendered as `YYYY-MM-DD`, which is also the day key this helper hands out.
+     *
+     * Swift twin: `LocalCalendarDate.key`.
+     */
+    val key: String
+        get() {
+            val y = if (year < 0) "-" + pad(-year, 4) else pad(year, 4)
+            return "$y-${pad(month, 2)}-${pad(day, 2)}"
+        }
+
+    /**
+     * The date `count` days after this one, negative counts moving backward.
+     *
+     * Swift twin: `LocalCalendarDate.adding(days:)`.
+     */
+    fun adding(days: Int): LocalCalendarDate = LocalCalendarDate(daysSinceEpoch = daysSinceEpoch + days)
+
+    /**
+     * Order dates the way the calendar does.
+     *
+     * Kotlin orders through `compareTo` where Swift declares the `<` operator, so the Swift `<` has no
+     * selector of its own to claim and this claim names the type that declares it.
+     *
+     * Swift twin: `LocalCalendarDate`.
+     */
+    override fun compareTo(other: LocalCalendarDate): Int {
+        if (year != other.year) return year.compareTo(other.year)
+        if (month != other.month) return month.compareTo(other.month)
+        return day.compareTo(other.day)
+    }
+
+    /**
+     * The zero-padding that belongs to the type rather than to an instance.
+     *
+     * Swift twin: `LocalCalendarDate`.
+     */
+    companion object {
+
+        /**
+         * Left-pad a non-negative number with zeroes, without a formatter — the Swift side does the same,
+         * and a locale-aware formatter is one more thing that could differ between the platforms.
+         *
+         * Swift twin: `LocalCalendarDate.pad(_:_:)`.
+         */
+        private fun pad(value: Int, width: Int): String {
+            var s = value.toString()
+            while (s.length < width) s = "0$s"
+            return s
+        }
+    }
+}
+
+/**
+ * One local day as a half-open window, with the UTC offset that was in effect when it began.
+ *
+ * Swift twin: `LocalDayWindow`.
+ */
+internal data class LocalDayWindow(
+    /** The date this window belongs to. Swift twin: `LocalDayWindow.date`. */
+    val date: LocalCalendarDate,
+    /** The first instant of the date. Swift twin: `LocalDayWindow.start`. */
+    val start: Instant,
+    /**
+     * The start of the next date that exists in the zone, which is where this window ends. It is not
+     * always `start` plus 24 hours, and where a calendar date is skipped entirely it is more than a day
+     * away. Swift twin: `LocalDayWindow.nextStart`.
+     */
+    val nextStart: Instant,
+    /**
+     * The UTC offset in effect at `start`, in seconds east of UTC.
+     *
+     * It describes the window's start only. A time of day anywhere else inside the window is derived
+     * from the zone, never by adding this number, because a transition inside the window would make that
+     * wrong by an hour. Swift twin: `LocalDayWindow.utcOffsetSeconds`.
+     */
+    val utcOffsetSeconds: Int,
+) {
+
+    /**
+     * How long the window lasts — 23, 24 or 25 hours in the fixture zones, and longer where the zone
+     * skips a calendar date. Swift returns a `TimeInterval` of seconds; the twin returns the `Duration`
+     * that carries the same seconds.
+     *
+     * Swift twin: `LocalDayWindow.duration`.
+     */
+    val duration: Duration
+        get() = Duration.between(start, nextStart)
+}
+
+/**
+ * One entry of a backward run: a date that exists in the zone, with the start resolved for it.
+ *
+ * Swift twin: `LocalDayStart`.
+ */
+internal data class LocalDayStart(
+    /** The date. Swift twin: `LocalDayStart.date`. */
+    val date: LocalCalendarDate,
+    /** The first instant of that date in the zone. Swift twin: `LocalDayStart.start`. */
+    val start: Instant,
+)
+
+/**
+ * When a local calendar date begins and ends in a time zone, taken from the zone's own rules.
+ *
+ * The analysis core answers this question by adding fixed 86,400-second blocks to a midnight derived
+ * from a single UTC offset. That is wrong by an hour on every day boundary beyond a transition, because
+ * a day on which the clocks move is 23 or 25 hours long. This type is the shared primitive that answers
+ * it correctly; it changes no caller on its own.
+ *
+ * SO TWO ANSWERS COEXIST, and this one is not yet the shipped one. [AnalyticsEngine.dayStartUtcSeconds]
+ * with `AnalyticsEngine.dayString` remains what every scored day actually uses; this file is called by
+ * nothing but its own tests until a switch-over lands. They disagree by an hour on the far side of a
+ * transition, which `LocalDayWindowsTest` pins deliberately by asserting BOTH answers for
+ * America/New_York on 2025-10-19. Reach for the core unless you are writing that switch-over.
+ *
+ * Nothing here is inherited from the platform's date resolution: the ambiguous, skipped and
+ * non-existent cases are resolved by the rules stated on each operation, so that a future change in
+ * library behaviour is a change to this file rather than a silent change of a day boundary. That is why
+ * neither `ZonedDateTime` nor `ZoneRules.getTransition` appears below — the only thing asked of the
+ * platform is `ZoneRules.getOffset`, the zone's raw rule lookup.
+ *
+ * Both the zone and the reference instant are injectable and default to the named accessors
+ * `defaultTimeZone` and `defaultReferenceInstant`, so every rule below is provable without a device.
+ *
+ * Swift twin: `LocalDayWindows`.
+ */
+internal class LocalDayWindows(
+    /** The zone whose rules every operation reads. Swift twin: `LocalDayWindows.timeZone`. */
+    val zone: ZoneId = defaultTimeZone,
+    /**
+     * The instant that stands for "now" — it clamps the sleep read window and nothing else. No start,
+     * window, key or run depends on it. Swift twin: `LocalDayWindows.referenceInstant`.
+     */
+    val referenceInstant: Instant = defaultReferenceInstant,
+) {
+
+    /**
+     * The first instant that belongs to `date` in this zone, or `null` when the zone has no instant on
+     * that date at all.
+     *
+     * The rule, stated rather than inherited: where local midnight exists once, that is the start; where
+     * it exists twice, the earlier of the two; where it does not exist, the first instant that does
+     * exist on the date, which is the instant the clocks jumped to. Where that jump lands on a later
+     * date the date itself never happened, and there is no start.
+     *
+     * The rule assumes at most one offset change within two days either side of the local midnight; no
+     * zone in the database violates that today.
+     *
+     * The result does not depend on `referenceInstant`.
+     *
+     * Swift twin: `LocalDayWindows.start(of:)`.
+     */
+    fun start(date: LocalCalendarDate): Instant? {
+        val localMidnight = date.daysSinceEpoch.toLong() * 86_400L
+        val offsetBefore = offsetSeconds(localMidnight - probeWindow)
+        val offsetAfter = offsetSeconds(localMidnight + probeWindow)
+
+        val candidates = listOf(localMidnight - offsetBefore, localMidnight - offsetAfter)
+            .sorted()
+            .distinct()
+        // An instant maps to this local midnight exactly when reading it in the zone gives that wall time
+        // back. Ascending order means an ambiguous midnight yields the earlier instant first.
+        for (candidate in candidates) {
+            if (candidate + offsetSeconds(candidate) == localMidnight) return Instant.ofEpochSecond(candidate)
+        }
+
+        // Local midnight fell in a gap. The first instant that exists on or after it is the instant the
+        // clocks jumped at; it belongs to this date only if it still reads as this date.
+        if (offsetBefore == offsetAfter) return null
+        val jump = transitionEpochSeconds(localMidnight, offsetBefore)
+        if (localDate(jump) != date) return null
+        return Instant.ofEpochSecond(jump)
+    }
+
+    /**
+     * The half-open window `[start, nextStart)` of `date`, or `null` when the date does not exist.
+     *
+     * `nextStart` is the start of the next date that *exists*, so a window that precedes a skipped
+     * calendar date spans more than a day rather than ending at an instant that never happened.
+     *
+     * Swift twin: `LocalDayWindows.window(of:)`.
+     */
+    fun window(date: LocalCalendarDate): LocalDayWindow? {
+        val dayStart = start(date) ?: return null
+        var next = date.adding(days = 1)
+        var nextStart: Instant? = null
+        // A zone skipping more than a couple of consecutive dates has never happened; the bound keeps a
+        // corrupt zone from turning this into an unbounded walk.
+        var probes = 0
+        while (nextStart == null && probes < 8) {
+            nextStart = start(next)
+            if (nextStart == null) next = next.adding(days = 1)
+            probes += 1
+        }
+        val end = nextStart ?: return null
+        return LocalDayWindow(
+            date = date,
+            start = dayStart,
+            nextStart = end,
+            utcOffsetSeconds = offsetSeconds(dayStart),
+        )
+    }
+
+    /**
+     * The start of the local day that contains `instant`, as an instant and without formatting a date on
+     * the way.
+     *
+     * Swift twin: `LocalDayWindows.startOfDay(containing:)`.
+     */
+    fun startOfDay(instant: Instant): Instant {
+        val date = localDate(instant)
+        // `instant` lies on `date` by construction, so the date exists and has a start. The fallback is
+        // unreachable and exists only to keep the operation total.
+        return start(date) ?: instant
+    }
+
+    /**
+     * The `YYYY-MM-DD` key of the local day that contains `instant`.
+     *
+     * The key and the window agree by construction: the key names the date whose window contains the
+     * instant, because both are derived from the same zone lookup.
+     *
+     * Swift twin: `LocalDayWindows.dayKey(for:)`.
+     */
+    fun dayKey(instant: Instant): String = localDate(instant).key
+
+    /**
+     * The local calendar date that contains `instant` in this zone.
+     *
+     * Swift twin: `LocalDayWindows.localDate(of:)`.
+     */
+    fun localDate(instant: Instant): LocalCalendarDate = localDate(instant.epochSecond)
+
+    /**
+     * Up to `count` consecutive local calendar dates ending at `date`, oldest first, each with its own
+     * resolved start.
+     *
+     * A date the zone skipped is omitted rather than replaced, so the run can be shorter than requested;
+     * if `date` itself does not exist, the newest entry is the latest existing date before it.
+     *
+     * Swift twin: `LocalDayWindows.backwardRun(endingAt:count:)`.
+     */
+    fun backwardRun(endingAt: LocalCalendarDate, count: Int): List<LocalDayStart> {
+        if (count <= 0) return emptyList()
+        val endDay = endingAt.daysSinceEpoch
+        val run = ArrayList<LocalDayStart>(count)
+        for (back in count - 1 downTo 0) {
+            val day = LocalCalendarDate(daysSinceEpoch = endDay - back)
+            val start = start(day)
+            if (start != null) run.add(LocalDayStart(date = day, start = start))
+        }
+        return run
+    }
+
+    /**
+     * The end of the sleep read window of `date`: the earlier of that date's next start and the
+     * reference instant, so the current day's window never reaches into the future. `null` when the date
+     * does not exist.
+     *
+     * For a date that begins after the reference instant the end precedes the start — an empty, inverted
+     * window — by the D7 contract; a caller wanting a non-empty window must not ask for a future date.
+     *
+     * Swift twin: `LocalDayWindows.sleepReadWindowEnd(of:)`.
+     */
+    fun sleepReadWindowEnd(date: LocalCalendarDate): Instant? {
+        val window = window(date) ?: return null
+        return minOf(window.nextStart, referenceInstant)
+    }
+
+    /**
+     * The UTC offset in effect at `instant`, in seconds east of UTC.
+     *
+     * Swift twin: `LocalDayWindows.offsetSeconds(at:)`.
+     */
+    fun offsetSeconds(instant: Instant): Int = zone.rules.getOffset(instant).totalSeconds
+
+    /**
+     * The UTC offset in effect at a whole-second instant.
+     *
+     * Swift twin: `LocalDayWindows.offsetSeconds(atEpochSeconds:)`.
+     */
+    private fun offsetSeconds(epochSeconds: Long): Int =
+        zone.rules.getOffset(Instant.ofEpochSecond(epochSeconds)).totalSeconds
+
+    /**
+     * The local calendar date of a whole-second instant.
+     *
+     * Swift twin: `LocalDayWindows.localDate(ofEpochSeconds:)`.
+     */
+    private fun localDate(epochSeconds: Long): LocalCalendarDate {
+        val localSeconds = epochSeconds + offsetSeconds(epochSeconds)
+        var days = localSeconds / 86_400L
+        if (localSeconds < 0 && localSeconds % 86_400L != 0L) days -= 1
+        return LocalCalendarDate(daysSinceEpoch = days.toInt())
+    }
+
+    /**
+     * The instant at which the zone's offset changes near `localMidnight`, found by bisecting the probe
+     * window between the offset before and the offset after.
+     *
+     * Swift twin: `LocalDayWindows.transitionEpochSeconds(around:offsetBefore:)`.
+     */
+    private fun transitionEpochSeconds(localMidnight: Long, offsetBefore: Int): Long {
+        var low = localMidnight - probeWindow
+        var high = localMidnight + probeWindow
+        while (high - low > 1) {
+            val mid = low + (high - low) / 2
+            if (offsetSeconds(mid) == offsetBefore) low = mid else high = mid
+        }
+        return high
+    }
+
+    /**
+     * The named defaults and the version reporting, which belong to the type rather than to an instance.
+     *
+     * Swift twin: `LocalDayWindows`.
+     */
+    companion object {
+
+        /**
+         * The zone used when none is given: the system default zone id, which follows a change of device
+         * zone during the process's life. The Swift twin's default is the auto-updating current zone,
+         * which means the same thing.
+         *
+         * The zone is bound when the helper is constructed; a caller that must follow a device-zone
+         * change during the process's life constructs a new helper.
+         *
+         * Swift twin: `LocalDayWindows.defaultTimeZone`.
+         */
+        val defaultTimeZone: ZoneId
+            get() = ZoneId.systemDefault()
+
+        /**
+         * The reference instant used when none is given: the current `Instant`. The Swift twin's default
+         * is the current `Date`.
+         *
+         * Swift twin: `LocalDayWindows.defaultReferenceInstant`.
+         */
+        val defaultReferenceInstant: Instant
+            get() = Instant.now()
+
+        /**
+         * The time-zone database version this platform can observe about itself, or `null` where it
+         * cannot.
+         *
+         * The JVM reports the database its own `java.time` rules were built from, which is a different
+         * fact from the one the oracle records about the producing Swift toolchain. Where that fact
+         * cannot be had the answer is `null` rather than a faked value, which is the same choice the
+         * Swift side makes on Linux. `java.time.zone.ZoneRulesProvider` is not on the SDK compile
+         * classpath, so it is read reflectively rather than called directly; what a device returns is
+         * unverified here and belongs to A2's device counter-check. Where the read cannot be made the
+         * answer is the `null` branch, which the note renders as the D6 cannot-observe wording; on the
+         * JVM unit-test runner the read succeeds and the note names the version.
+         *
+         * Swift twin: `LocalDayWindows.observedTimeZoneDataVersion`.
+         */
+        val observedTimeZoneDataVersion: String?
+            get() = try {
+                val versions = Class.forName("java.time.zone.ZoneRulesProvider")
+                    .getMethod("getVersions", String::class.java)
+                    .invoke(null, ZoneId.systemDefault().id) as java.util.NavigableMap<*, *>
+                if (versions.isEmpty()) null else versions.lastKey() as? String
+            } catch (missing: ReflectiveOperationException) {
+                null
+            } catch (unsupported: RuntimeException) {
+                // `ZoneRulesException` for a zone the provider does not know, wrapped or direct.
+                null
+            }
+
+        /**
+         * The note a platform attaches when a fixture value moves: it names the version recorded in the
+         * oracle and the version this platform observes at run time.
+         *
+         * A version difference is not itself a failure — the fixtures are past and stable, so a routine
+         * toolchain bump must not redden unrelated work. The note exists to make a *value* difference
+         * explicable. It is a pure function so that its content can be asserted; where a platform cannot
+         * observe its own version, the note says so in place of a version rather than omitting it.
+         *
+         * Swift twin: `LocalDayWindows.timeZoneDataVersionNote(recorded:observed:)`.
+         */
+        fun timeZoneDataVersionNote(recorded: String, observed: String?): String {
+            val observedText = observed?.let { "observes $it" }
+                ?: "cannot observe its own time-zone database version"
+            return "time-zone database version: the oracle records $recorded; this platform $observedText."
+        }
+
+        /**
+         * The number of seconds either side of a local midnight that is probed for the offsets in effect
+         * around it. Two days is far more than any transition needs and still far less than the gap
+         * between two transitions anywhere in the database.
+         *
+         * Swift twin: `LocalDayWindows.probeWindow`.
+         */
+        private const val probeWindow: Long = 2L * 86_400L
+    }
+}
diff --git a/android/app/src/test/java/com/noop/analytics/LocalDayWindowsTest.kt b/android/app/src/test/java/com/noop/analytics/LocalDayWindowsTest.kt
new file mode 100644
index 0000000000..f6085c2515
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/LocalDayWindowsTest.kt
@@ -0,0 +1,551 @@
+package com.noop.analytics
+
+import java.time.Duration
+import java.time.Instant
+import java.time.ZoneId
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Assert.fail
+import org.junit.Test
+
+/**
+ * The day-window primitive, one test per scenario of the `daily-windows` specification, plus the parity
+ * oracle that the Swift twin reads from the same committed file.
+ *
+ * The test names mirror `LocalDayWindowsTests.swift` so the two suites read side by side. Every fixture
+ * passes an explicit zone and an explicit reference instant, so nothing here depends on the machine's
+ * zone or on when the suite runs. The two exceptions are the default-accessor tests, which are about the
+ * defaults themselves and deliberately do not go through the oracle.
+ */
+class LocalDayWindowsTest {
+
+    // MARK: - Fixture helpers
+
+    /** A date written the way the specification writes it. */
+    private fun date(text: String): LocalCalendarDate {
+        val parts = text.split("-").map { it.toInt() }
+        return LocalCalendarDate(year = parts[0], month = parts[1], day = parts[2])
+    }
+
+    /** An instant from whole seconds since the epoch. */
+    private fun instant(epochSeconds: Long): Instant = Instant.ofEpochSecond(epochSeconds)
+
+    /**
+     * A UTC instant written as `YYYY-MM-DDTHH:MM:SSZ`, parsed without a formatter so the test's own
+     * expectations do not depend on a locale or a calendar.
+     */
+    private fun utc(text: String): Instant {
+        val halves = text.dropLast(1).split("T")
+        val day = halves[0].split("-").map { it.toInt() }
+        val time = halves[1].split(":").map { it.toInt() }
+        val days = LocalCalendarDate(year = day[0], month = day[1], day = day[2]).daysSinceEpoch
+        return instant(days.toLong() * 86_400L + time[0] * 3600L + time[1] * 60L + time[2])
+    }
+
+    /** The helper for a zone, with a reference instant that no scenario in this section depends on. */
+    private fun windows(zoneName: String, reference: Instant = Instant.EPOCH): LocalDayWindows =
+        LocalDayWindows(zone = ZoneId.of(zoneName), referenceInstant = reference)
+
+    // MARK: - A local date begins at its own local midnight
+
+    /**
+     * The discriminating case: the helper and the analysis core's fixed-offset arithmetic disagree by an
+     * hour across a transition.
+     *
+     * The core's arithmetic is re-derived inline, verbatim per the scenario, so that both platforms
+     * compare against the same arm: floor to a local midnight using the zone's offset at the reference
+     * instant, then subtract whole 86,400-second days.
+     */
+    @Test
+    fun testResolvedStartDiffersFromFixedOffsetArithmeticAcrossATransition() {
+        val zone = ZoneId.of("America/New_York")
+        val reference = utc("2025-11-10T17:00:00Z") // 12:00 local, inside standard time
+        val helper = LocalDayWindows(zone = zone, referenceInstant = reference)
+
+        val resolved = helper.start(date("2025-10-19"))
+
+        val offset = zone.rules.getOffset(reference).totalSeconds.toLong()
+        val localSeconds = reference.epochSecond + offset
+        val referenceMidnight = Math.floorDiv(localSeconds, 86_400L) * 86_400L - offset
+        val fixedOffsetStart = instant(referenceMidnight - 22L * 86_400L)
+
+        assertEquals(utc("2025-10-19T04:00:00Z"), resolved)
+        assertEquals(utc("2025-10-19T05:00:00Z"), fixedOffsetStart)
+        assertNotEquals(fixedOffsetStart, resolved)
+    }
+
+    /** Two reference instants on opposite sides of the zone's autumn transition give the same start. */
+    @Test
+    fun testResultDoesNotDependOnTheReferenceInstant() {
+        val before = windows("America/New_York", reference = utc("2025-10-15T12:00:00Z"))
+        val after = windows("America/New_York", reference = utc("2025-12-15T12:00:00Z"))
+
+        assertEquals(utc("2025-10-19T04:00:00Z"), before.start(date("2025-10-19")))
+        assertEquals(utc("2025-10-19T04:00:00Z"), after.start(date("2025-10-19")))
+    }
+
+    /** A zone offset of 5 hours 45 minutes puts the start on its own local midnight, off the hour. */
+    @Test
+    fun testDayWithFortyFiveMinuteOffsetStartsAtItsOwnLocalMidnight() {
+        val helper = windows("Asia/Kathmandu")
+
+        val start = helper.start(date("2025-06-15"))
+
+        assertEquals(utc("2025-06-14T18:15:00Z"), start)
+        assertEquals(20_700, helper.offsetSeconds(start!!))
+        assertNotEquals(0L, start.epochSecond % 3600L)
+    }
+
+    // MARK: - A day window lasts as long as the zone says and carries its own offset
+
+    /** The spring-forward day is 23 hours long. */
+    @Test
+    fun testSpringForwardDayIsTwentyThreeHours() {
+        val window = windows("America/New_York").window(date("2025-03-09"))
+
+        assertEquals(Duration.ofHours(23), window?.duration)
+    }
+
+    /** The fall-back day is 25 hours long. */
+    @Test
+    fun testFallBackDayIsTwentyFiveHours() {
+        val window = windows("America/New_York").window(date("2025-11-02"))
+
+        assertEquals(Duration.ofHours(25), window?.duration)
+    }
+
+    /** A zone without daylight saving has 24-hour days. */
+    @Test
+    fun testDayInZoneWithoutDaylightSavingIsTwentyFourHours() {
+        val window = windows("Asia/Kolkata").window(date("2025-06-15"))
+
+        assertEquals(Duration.ofHours(24), window?.duration)
+    }
+
+    /** Consecutive windows meet exactly across a transition, leaving neither a gap nor an overlap. */
+    @Test
+    fun testConsecutiveWindowsMeetExactly() {
+        val helper = windows("America/New_York")
+
+        val first = helper.window(date("2025-11-01"))
+        val second = helper.window(date("2025-11-02"))
+        val third = helper.window(date("2025-11-03"))
+        assertNotNull("2025-11-01 must have a window", first)
+        assertNotNull("2025-11-02 must have a window", second)
+        assertNotNull("2025-11-03 must have a window", third)
+
+        assertEquals(second!!.start, first!!.nextStart)
+        assertEquals(third!!.start, second.nextStart)
+    }
+
+    /** The window reports the offset in effect at its own start, not at some other moment of the day. */
+    @Test
+    fun testWindowReportsOffsetInEffectAtItsStart() {
+        val helper = windows("America/New_York")
+
+        assertEquals(-14_400, helper.window(date("2025-11-01"))?.utcOffsetSeconds)
+        assertEquals(-18_000, helper.window(date("2025-11-03"))?.utcOffsetSeconds)
+    }
+
+    // MARK: - The helper resolves the start of the local day containing an instant
+
+    /** An instant inside the repeated local hour still resolves to that day's start. */
+    @Test
+    fun testInstantInsideTwentyFiveHourDayResolvesToThatDaysStart() {
+        val helper = windows("America/New_York")
+
+        val start = helper.startOfDay(utc("2025-11-02T05:30:00Z"))
+
+        assertEquals(utc("2025-11-02T04:00:00Z"), start)
+    }
+
+    /** A start instant resolves to itself, for every fixture date that exists. */
+    @Test
+    fun testContainingDayStartOfAStartInstantIsItself() {
+        val fixtures = listOf(
+            "America/New_York" to "2025-03-09",
+            "America/New_York" to "2025-11-02",
+            "America/New_York" to "2025-10-19",
+            "America/Santiago" to "2025-09-07",
+            "America/Havana" to "2025-11-02",
+            "Pacific/Apia" to "2011-12-31",
+            "Asia/Kolkata" to "2025-06-15",
+            "Asia/Kathmandu" to "2025-06-15",
+        )
+        for ((zone, day) in fixtures) {
+            val helper = windows(zone)
+            val start = helper.start(date(day))
+            assertNotNull("$zone $day must have a start", start)
+            assertEquals("$zone $day", start, helper.startOfDay(start!!))
+        }
+    }
+
+    // MARK: - An instant's day key names the window that contains it
+
+    /** The key flips exactly at the window boundary and nowhere else. */
+    @Test
+    fun testDayKeyChangesExactlyAtTheWindowBoundary() {
+        val helper = windows("America/New_York")
+        val start = helper.start(date("2025-11-02"))!!
+
+        assertEquals("2025-11-01", helper.dayKey(start.minusSeconds(1)))
+        assertEquals("2025-11-02", helper.dayKey(start.plusSeconds(1)))
+    }
+
+    /** The key holds for all 25 hours of the fall-back day, including the repeated local hour. */
+    @Test
+    fun testDayKeyHoldsAcrossTheWholeOfATwentyFiveHourDay() {
+        val helper = windows("America/New_York")
+        val window = helper.window(date("2025-11-02"))!!
+
+        assertEquals("2025-11-02", helper.dayKey(window.start))
+        assertEquals("2025-11-02", helper.dayKey(utc("2025-11-02T05:30:00Z")))
+        assertEquals("2025-11-02", helper.dayKey(window.nextStart.minusSeconds(1)))
+    }
+
+    // MARK: - An ambiguous or missing local midnight resolves by a stated rule
+
+    /** A date with no 00:00 starts at its first existing instant, its local 01:00. */
+    @Test
+    fun testTransitionThatSkipsLocalMidnight() {
+        val start = windows("America/Santiago").start(date("2025-09-07"))
+
+        assertEquals(utc("2025-09-07T04:00:00Z"), start)
+    }
+
+    /** A date with two 00:00 starts at the earlier of them. */
+    @Test
+    fun testTransitionThatRepeatsLocalMidnight() {
+        val helper = windows("America/Havana")
+
+        val start = helper.start(date("2025-11-02"))
+
+        assertEquals(utc("2025-11-02T04:00:00Z"), start)
+        assertEquals(-14_400, helper.offsetSeconds(start!!))
+        // The later of the two midnights, which the rule must not pick.
+        assertEquals(-18_000, helper.offsetSeconds(utc("2025-11-02T05:00:00Z")))
+    }
+
+    // MARK: - A date that does not exist is skipped over
+
+    /** A calendar date the zone skipped has no start at all. */
+    @Test
+    fun testSkippedCalendarDateProducesNoStart() {
+        assertNull(windows("Pacific/Apia").start(date("2011-12-30")))
+    }
+
+    /** The preceding date's window reaches over the skipped date to the next existing one. */
+    @Test
+    fun testPrecedingDatesWindowReachesTheNextExistingDate() {
+        val helper = windows("Pacific/Apia")
+
+        val window = helper.window(date("2011-12-29"))
+
+        assertEquals(helper.start(date("2011-12-31")), window?.nextStart)
+        assertEquals(Duration.ofHours(24), window?.duration)
+    }
+
+    // MARK: - A backward run yields consecutive existing dates with their own starts
+
+    /** A run spanning the autumn transition is consecutive and each entry carries its own start. */
+    @Test
+    fun testRunAcrossATransitionIsConsecutiveAndCorrectlyAnchored() {
+        val helper = windows("America/New_York")
+
+        val run = helper.backwardRun(endingAt = date("2025-11-10"), count = 21)
+
+        assertEquals(21, run.size)
+        assertEquals("2025-10-21", run.first().date.key)
+        assertEquals("2025-11-10", run.last().date.key)
+        run.forEachIndexed { index, entry ->
+            assertEquals(
+                "run must be consecutive at ${entry.date.key}",
+                date("2025-10-21").daysSinceEpoch + index,
+                entry.date.daysSinceEpoch,
+            )
+            assertEquals(entry.date.key, helper.start(entry.date), entry.start)
+        }
+    }
+
+    /** A run containing a skipped date is shorter than requested and omits it. */
+    @Test
+    fun testRunContainingASkippedDateIsShorterThanRequested() {
+        val run = windows("Pacific/Apia").backwardRun(endingAt = date("2012-01-02"), count = 5)
+
+        assertEquals(4, run.size)
+        assertEquals("2011-12-29", run.first().date.key)
+        assertEquals(
+            listOf("2011-12-29", "2011-12-31", "2012-01-01", "2012-01-02"),
+            run.map { it.date.key },
+        )
+    }
+
+    /** A long run lands on the right calendar date, 3999 days before the anchor. */
+    @Test
+    fun testLongRunReachesTheRightCalendarDate() {
+        val run = windows("America/New_York").backwardRun(endingAt = date("2025-11-10"), count = 4000)
+
+        assertEquals(4000, run.size)
+        assertEquals("2014-11-29", run.first().date.key)
+        assertEquals("2025-11-10", run.last().date.key)
+    }
+
+    // MARK: - The sleep read window never extends into the future
+
+    /** The current date's window stops at the reference instant instead of its next start. */
+    @Test
+    fun testCurrentDatesWindowStopsAtTheReferenceInstant() {
+        val helper = windows("America/New_York", reference = utc("2025-11-02T18:00:00Z"))
+
+        val end = helper.sleepReadWindowEnd(date("2025-11-02"))
+
+        assertEquals(utc("2025-11-02T18:00:00Z"), end)
+        assertNotEquals(helper.window(date("2025-11-02"))?.nextStart, end)
+    }
+
+    /** A past 25-hour day reaches its own next start, 25 hours after it began. */
+    @Test
+    fun testPastTwentyFiveHourDayReachesItsOwnNextStart() {
+        val helper = windows("America/New_York", reference = utc("2025-12-15T12:00:00Z"))
+
+        val end = helper.sleepReadWindowEnd(date("2025-11-02"))
+        val window = helper.window(date("2025-11-02"))!!
+
+        assertEquals(window.nextStart, end)
+        assertEquals(Duration.ofHours(25), Duration.between(window.start, end))
+    }
+
+    // MARK: - The default zone and reference instant are named, not implied
+
+    /** The default zone is the system default zone id named in the design, not a snapshot of it. */
+    @Test
+    fun testDefaultZoneIsThePlatformsTrackingDeviceZone() {
+        assertEquals(ZoneId.systemDefault(), LocalDayWindows.defaultTimeZone)
+        assertEquals(ZoneId.systemDefault(), LocalDayWindows().zone)
+        assertEquals(ZoneId.systemDefault(), LocalDayWindows(referenceInstant = Instant.now()).zone)
+    }
+
+    /**
+     * The default reference instant is the current `Instant`, so it lies inside a bracket taken around
+     * the call.
+     */
+    @Test
+    fun testDefaultReferenceInstantIsThePlatformsCurrentInstant() {
+        val before = Instant.now()
+        val accessor = LocalDayWindows.defaultReferenceInstant
+        val helperDefault = LocalDayWindows().referenceInstant
+        val after = Instant.now()
+
+        assertTrue(accessor >= before)
+        assertTrue(accessor <= after)
+        assertTrue(helperDefault >= before)
+        assertTrue(helperDefault <= after)
+    }
+
+    // MARK: - Both platforms agree, proven by a committed oracle
+
+    /**
+     * The committed oracle, loaded from the test resources on the classpath.
+     *
+     * It fails rather than skips when the file is absent: an oracle nobody can find would otherwise let
+     * both platforms stay green while they disagree, which is the whole thing this file guards.
+     */
+    private fun loadOracle(): JSONObject {
+        val stream = javaClass.classLoader!!.getResourceAsStream(ORACLE_RESOURCE)
+        if (stream == null) {
+            fail("committed oracle $ORACLE_RESOURCE not on the test classpath — this test must not pass by default")
+        }
+        return JSONObject(stream!!.bufferedReader().use { it.readText() })
+    }
+
+    /** The oracle's own `start` field, which is JSON null for a date the zone never had. */
+    private fun optionalEpochSeconds(record: JSONObject, field: String): Long? =
+        if (record.isNull(field)) null else record.getLong(field)
+
+    /**
+     * Every value in the committed oracle, re-derived by the twin and compared.
+     *
+     * The Swift side asserts the same file, so a change on either side reddens one of the two suites.
+     * The mismatch note rides along on every assertion message, so a moved value names both database
+     * versions rather than only the numbers that differ.
+     */
+    @Test
+    fun testKotlinTestAssertsTheCommittedOracle() {
+        val oracle = loadOracle()
+
+        assertFalse(oracle.getString("note").isEmpty())
+        val producedBy = oracle.getJSONObject("producedBy")
+        assertFalse(producedBy.getString("toolchain").isEmpty())
+        assertFalse(producedBy.getString("timeZoneDataVersion").isEmpty())
+
+        val recorded = producedBy.getString("timeZoneDataVersion")
+        val note = LocalDayWindows.timeZoneDataVersionNote(
+            recorded = recorded,
+            observed = LocalDayWindows.observedTimeZoneDataVersion,
+        )
+
+        val starts = oracle.getJSONArray("starts")
+        assertEquals("oracle section starts", 19, starts.length())
+        for (i in 0 until starts.length()) {
+            val record = starts.getJSONObject(i)
+            val helper = windows(record.getString("zone"))
+            val day = date(record.getString("date"))
+            val context = "start ${record.getString("zone")} ${day.key} — $note"
+            assertEquals(context, optionalEpochSeconds(record, "start"), helper.start(day)?.epochSecond)
+        }
+
+        val windowRecords = oracle.getJSONArray("windows")
+        assertEquals("oracle section windows", 18, windowRecords.length())
+        for (i in 0 until windowRecords.length()) {
+            val record = windowRecords.getJSONObject(i)
+            val helper = windows(record.getString("zone"))
+            val day = date(record.getString("date"))
+            val context = "window ${record.getString("zone")} ${day.key} — $note"
+            val window = helper.window(day)
+            assertNotNull(context, window)
+            assertEquals(context, record.getLong("start"), window!!.start.epochSecond)
+            assertEquals(context, record.getLong("nextStart"), window.nextStart.epochSecond)
+            assertEquals(context, record.getInt("utcOffsetSeconds"), window.utcOffsetSeconds)
+            assertEquals(context, record.getLong("durationSeconds"), window.duration.seconds)
+        }
+
+        val containing = oracle.getJSONArray("containingDayStarts")
+        assertEquals("oracle section containingDayStarts", 8, containing.length())
+        for (i in 0 until containing.length()) {
+            val record = containing.getJSONObject(i)
+            val helper = windows(record.getString("zone"))
+            val at = instant(record.getLong("instant"))
+            val context = "containing ${record.getString("zone")} ${record.getLong("instant")} — $note"
+            assertEquals(context, record.getLong("start"), helper.startOfDay(at).epochSecond)
+        }
+
+        val keys = oracle.getJSONArray("dayKeys")
+        assertEquals("oracle section dayKeys", 11, keys.length())
+        for (i in 0 until keys.length()) {
+            val record = keys.getJSONObject(i)
+            val helper = windows(record.getString("zone"))
+            val at = instant(record.getLong("instant"))
+            val context = "key ${record.getString("zone")} ${record.getLong("instant")} — $note"
+            assertEquals(context, record.getString("key"), helper.dayKey(at))
+        }
+
+        val runs = oracle.getJSONArray("runs")
+        assertEquals("oracle section runs", 4, runs.length())
+        for (i in 0 until runs.length()) {
+            val record = runs.getJSONObject(i)
+            val helper = windows(record.getString("zone"))
+            val anchor = date(record.getString("endingAt"))
+            val requested = record.getInt("requested")
+            val context = "run ${record.getString("zone")} ${anchor.key}/$requested — $note"
+            val run = helper.backwardRun(endingAt = anchor, count = requested)
+            assertEquals(context, record.getInt("size"), run.size)
+            for ((edge, entry) in listOf("oldest" to run.firstOrNull(), "newest" to run.lastOrNull())) {
+                val expected = record.getJSONObject(edge)
+                assertNotNull("$edge $context", entry)
+                assertEquals("$edge $context", expected.getString("date"), entry!!.date.key)
+                assertEquals("$edge $context", expected.getLong("start"), entry.start.epochSecond)
+            }
+            // Short runs carry every entry; the 4000-day run carries its edges and its size only, so that
+            // the committed file stays reviewable, and says so in `daysTruncated`.
+            val days = record.getJSONArray("days")
+            if (record.getBoolean("daysTruncated")) {
+                assertEquals(context, 0, days.length())
+            } else {
+                assertEquals(context, run.size, days.length())
+                for (d in 0 until days.length()) {
+                    val expected = days.getJSONObject(d)
+                    assertEquals(context, expected.getString("date"), run[d].date.key)
+                    assertEquals(context, expected.getLong("start"), run[d].start.epochSecond)
+                }
+            }
+        }
+
+        val sleepEnds = oracle.getJSONArray("sleepWindowEnds")
+        assertEquals("oracle section sleepWindowEnds", 5, sleepEnds.length())
+        for (i in 0 until sleepEnds.length()) {
+            val record = sleepEnds.getJSONObject(i)
+            val helper = windows(
+                record.getString("zone"),
+                reference = instant(record.getLong("referenceInstant")),
+            )
+            val day = date(record.getString("date"))
+            val context = "sleep end ${record.getString("zone")} ${day.key} — $note"
+            assertEquals(context, optionalEpochSeconds(record, "end"), helper.sleepReadWindowEnd(day)?.epochSecond)
+        }
+    }
+
+    /**
+     * The time-zone database version of the JVM this suite runs on, read from
+     * `java.time.zone.ZoneRulesProvider.getVersions` — the last key of the map for the zone in use, and
+     * `null` where the map is empty or where the read is unavailable at all, so a runner that cannot
+     * make it takes the cannot-observe branch below instead of erroring on a non-defect.
+     */
+    private fun runnerTimeZoneDataVersion(): String? =
+        try {
+            val versions = Class.forName("java.time.zone.ZoneRulesProvider")
+                .getMethod("getVersions", String::class.java)
+                .invoke(null, ZoneId.systemDefault().id) as java.util.NavigableMap<*, *>
+            if (versions.isEmpty()) null else versions.lastKey() as String?
+        } catch (missing: ReflectiveOperationException) {
+            null
+        } catch (unsupported: RuntimeException) {
+            // `ZoneRulesException` for a zone the provider does not know, wrapped or direct.
+            null
+        }
+
+    /**
+     * The mismatch note names the recorded version and the observed one, and says so plainly where the
+     * platform has no version of its own to report.
+     *
+     * The observed version is read but never gated on (D6): the fixtures are past and stable, so a
+     * routine runner-image bump must not redden unrelated work.
+     */
+    @Test
+    fun testMismatchNoteNamesBothDatabaseVersions() {
+        val observed = LocalDayWindows.timeZoneDataVersionNote(recorded = "2025b", observed = "2025a")
+        assertEquals(
+            "time-zone database version: the oracle records 2025b; this platform observes 2025a.",
+            observed,
+        )
+
+        val blind = LocalDayWindows.timeZoneDataVersionNote(recorded = "unavailable", observed = null)
+        assertEquals(
+            "time-zone database version: the oracle records unavailable; " +
+                "this platform cannot observe its own time-zone database version.",
+            blind,
+        )
+        assertTrue(blind.contains("cannot observe"))
+        assertTrue(blind.contains("unavailable"))
+
+        // What this JVM reports about itself goes into the note verbatim, whichever branch it takes. The
+        // runner's own version is read here independently, and by reflection for the same reason the
+        // implementation uses it: `java.time.zone.ZoneRulesProvider` is not on the SDK compile
+        // classpath this test source is built against, although the JVM the test runs on has it. What a
+        // device returns is unverified here and belongs to A2's device counter-check; where the read
+        // cannot be made at all, the `null` branch below asserts the D6 cannot-observe wording.
+        val version = runnerTimeZoneDataVersion()
+        assertEquals(version, LocalDayWindows.observedTimeZoneDataVersion)
+        val live = LocalDayWindows.timeZoneDataVersionNote(recorded = "unavailable", observed = version)
+        if (version == null) {
+            assertTrue(live.contains("cannot observe its own time-zone database version"))
+        } else {
+            assertFalse(version.isEmpty())
+            assertTrue(live.contains("observes $version"))
+            assertEquals(
+                "time-zone database version: the oracle records unavailable; this platform observes $version.",
+                live,
+            )
+        }
+    }
+
+    private companion object {
+
+        /** The oracle file package 1 committed under the Android test resources. */
+        const val ORACLE_RESOURCE = "local_day_windows_oracle.json"
+    }
+}
diff --git a/android/app/src/test/resources/local_day_windows_oracle.json b/android/app/src/test/resources/local_day_windows_oracle.json
new file mode 100644
index 0000000000..0785beda9f
--- /dev/null
+++ b/android/app/src/test/resources/local_day_windows_oracle.json
@@ -0,0 +1,81 @@
+{
+  "note": "Produced by compiling Packages/StrandAnalytics/Sources/StrandAnalytics/LocalDayWindows.swift standalone. Dates are YYYY-MM-DD, instants are whole seconds since the epoch, offsets are seconds east of UTC.",
+  "producedBy": {"toolchain": "Swift version 6.0.3 (swift-6.0.3-RELEASE)", "timeZoneDataVersion": "unavailable"},
+  "starts": [
+    {"zone": "America/New_York", "date": "2025-02-23", "start": 1740286800},
+    {"zone": "America/New_York", "date": "2025-03-09", "start": 1741496400},
+    {"zone": "America/New_York", "date": "2025-10-19", "start": 1760846400},
+    {"zone": "America/New_York", "date": "2025-11-01", "start": 1761969600},
+    {"zone": "America/New_York", "date": "2025-11-02", "start": 1762056000},
+    {"zone": "America/New_York", "date": "2025-11-03", "start": 1762146000},
+    {"zone": "America/New_York", "date": "2025-11-10", "start": 1762750800},
+    {"zone": "America/New_York", "date": "2014-11-29", "start": 1417237200},
+    {"zone": "America/Santiago", "date": "2025-08-24", "start": 1756008000},
+    {"zone": "America/Santiago", "date": "2025-09-07", "start": 1757217600},
+    {"zone": "America/Havana", "date": "2025-10-19", "start": 1760846400},
+    {"zone": "America/Havana", "date": "2025-11-02", "start": 1762056000},
+    {"zone": "Pacific/Apia", "date": "2011-12-16", "start": 1324029600},
+    {"zone": "Pacific/Apia", "date": "2011-12-29", "start": 1325152800},
+    {"zone": "Pacific/Apia", "date": "2011-12-30", "start": null},
+    {"zone": "Pacific/Apia", "date": "2011-12-31", "start": 1325239200},
+    {"zone": "Pacific/Apia", "date": "2012-01-02", "start": 1325412000},
+    {"zone": "Asia/Kolkata", "date": "2025-06-15", "start": 1749925800},
+    {"zone": "Asia/Kathmandu", "date": "2025-06-15", "start": 1749924900}
+  ],
+  "windows": [
+    {"zone": "America/New_York", "date": "2025-02-23", "start": 1740286800, "nextStart": 1740373200, "utcOffsetSeconds": -18000, "durationSeconds": 86400},
+    {"zone": "America/New_York", "date": "2025-03-09", "start": 1741496400, "nextStart": 1741579200, "utcOffsetSeconds": -18000, "durationSeconds": 82800},
+    {"zone": "America/New_York", "date": "2025-10-19", "start": 1760846400, "nextStart": 1760932800, "utcOffsetSeconds": -14400, "durationSeconds": 86400},
+    {"zone": "America/New_York", "date": "2025-11-01", "start": 1761969600, "nextStart": 1762056000, "utcOffsetSeconds": -14400, "durationSeconds": 86400},
+    {"zone": "America/New_York", "date": "2025-11-02", "start": 1762056000, "nextStart": 1762146000, "utcOffsetSeconds": -14400, "durationSeconds": 90000},
+    {"zone": "America/New_York", "date": "2025-11-03", "start": 1762146000, "nextStart": 1762232400, "utcOffsetSeconds": -18000, "durationSeconds": 86400},
+    {"zone": "America/New_York", "date": "2025-11-10", "start": 1762750800, "nextStart": 1762837200, "utcOffsetSeconds": -18000, "durationSeconds": 86400},
+    {"zone": "America/New_York", "date": "2014-11-29", "start": 1417237200, "nextStart": 1417323600, "utcOffsetSeconds": -18000, "durationSeconds": 86400},
+    {"zone": "America/Santiago", "date": "2025-08-24", "start": 1756008000, "nextStart": 1756094400, "utcOffsetSeconds": -14400, "durationSeconds": 86400},
+    {"zone": "America/Santiago", "date": "2025-09-07", "start": 1757217600, "nextStart": 1757300400, "utcOffsetSeconds": -10800, "durationSeconds": 82800},
+    {"zone": "America/Havana", "date": "2025-10-19", "start": 1760846400, "nextStart": 1760932800, "utcOffsetSeconds": -14400, "durationSeconds": 86400},
+    {"zone": "America/Havana", "date": "2025-11-02", "start": 1762056000, "nextStart": 1762146000, "utcOffsetSeconds": -14400, "durationSeconds": 90000},
+    {"zone": "Pacific/Apia", "date": "2011-12-16", "start": 1324029600, "nextStart": 1324116000, "utcOffsetSeconds": -36000, "durationSeconds": 86400},
+    {"zone": "Pacific/Apia", "date": "2011-12-29", "start": 1325152800, "nextStart": 1325239200, "utcOffsetSeconds": -36000, "durationSeconds": 86400},
+    {"zone": "Pacific/Apia", "date": "2011-12-31", "start": 1325239200, "nextStart": 1325325600, "utcOffsetSeconds": 50400, "durationSeconds": 86400},
+    {"zone": "Pacific/Apia", "date": "2012-01-02", "start": 1325412000, "nextStart": 1325498400, "utcOffsetSeconds": 50400, "durationSeconds": 86400},
+    {"zone": "Asia/Kolkata", "date": "2025-06-15", "start": 1749925800, "nextStart": 1750012200, "utcOffsetSeconds": 19800, "durationSeconds": 86400},
+    {"zone": "Asia/Kathmandu", "date": "2025-06-15", "start": 1749924900, "nextStart": 1750011300, "utcOffsetSeconds": 20700, "durationSeconds": 86400}
+  ],
+  "containingDayStarts": [
+    {"zone": "America/New_York", "instant": 1762061400, "start": 1762056000},
+    {"zone": "America/New_York", "instant": 1762106400, "start": 1762056000},
+    {"zone": "America/New_York", "instant": 1741521600, "start": 1741496400},
+    {"zone": "America/Santiago", "instant": 1757246400, "start": 1757217600},
+    {"zone": "America/Havana", "instant": 1762057800, "start": 1762056000},
+    {"zone": "America/Havana", "instant": 1762061400, "start": 1762056000},
+    {"zone": "Pacific/Apia", "instant": 1325246400, "start": 1325239200},
+    {"zone": "Asia/Kathmandu", "instant": 1749945600, "start": 1749924900}
+  ],
+  "dayKeys": [
+    {"zone": "America/New_York", "instant": 1762055999, "key": "2025-11-01"},
+    {"zone": "America/New_York", "instant": 1762056000, "key": "2025-11-02"},
+    {"zone": "America/New_York", "instant": 1762056001, "key": "2025-11-02"},
+    {"zone": "America/New_York", "instant": 1762061400, "key": "2025-11-02"},
+    {"zone": "America/New_York", "instant": 1762145999, "key": "2025-11-02"},
+    {"zone": "America/New_York", "instant": 1762146000, "key": "2025-11-03"},
+    {"zone": "America/Santiago", "instant": 1757217600, "key": "2025-09-07"},
+    {"zone": "America/Havana", "instant": 1762056000, "key": "2025-11-02"},
+    {"zone": "Pacific/Apia", "instant": 1325239199, "key": "2011-12-29"},
+    {"zone": "Pacific/Apia", "instant": 1325239200, "key": "2011-12-31"},
+    {"zone": "Asia/Kathmandu", "instant": 1749924900, "key": "2025-06-15"}
+  ],
+  "runs": [
+    {"zone": "America/New_York", "endingAt": "2025-11-10", "requested": 21, "size": 21, "oldest": {"date": "2025-10-21", "start": 1761019200}, "newest": {"date": "2025-11-10", "start": 1762750800}, "daysTruncated": false, "days": [{"date": "2025-10-21", "start": 1761019200}, {"date": "2025-10-22", "start": 1761105600}, {"date": "2025-10-23", "start": 1761192000}, {"date": "2025-10-24", "start": 1761278400}, {"date": "2025-10-25", "start": 1761364800}, {"date": "2025-10-26", "start": 1761451200}, {"date": "2025-10-27", "start": 1761537600}, {"date": "2025-10-28", "start": 1761624000}, {"date": "2025-10-29", "start": 1761710400}, {"date": "2025-10-30", "start": 1761796800}, {"date": "2025-10-31", "start": 1761883200}, {"date": "2025-11-01", "start": 1761969600}, {"date": "2025-11-02", "start": 1762056000}, {"date": "2025-11-03", "start": 1762146000}, {"date": "2025-11-04", "start": 1762232400}, {"date": "2025-11-05", "start": 1762318800}, {"date": "2025-11-06", "start": 1762405200}, {"date": "2025-11-07", "start": 1762491600}, {"date": "2025-11-08", "start": 1762578000}, {"date": "2025-11-09", "start": 1762664400}, {"date": "2025-11-10", "start": 1762750800}]},
+    {"zone": "America/New_York", "endingAt": "2025-11-10", "requested": 4000, "size": 4000, "oldest": {"date": "2014-11-29", "start": 1417237200}, "newest": {"date": "2025-11-10", "start": 1762750800}, "daysTruncated": true, "days": []},
+    {"zone": "Pacific/Apia", "endingAt": "2012-01-02", "requested": 5, "size": 4, "oldest": {"date": "2011-12-29", "start": 1325152800}, "newest": {"date": "2012-01-02", "start": 1325412000}, "daysTruncated": false, "days": [{"date": "2011-12-29", "start": 1325152800}, {"date": "2011-12-31", "start": 1325239200}, {"date": "2012-01-01", "start": 1325325600}, {"date": "2012-01-02", "start": 1325412000}]},
+    {"zone": "Pacific/Apia", "endingAt": "2011-12-30", "requested": 3, "size": 2, "oldest": {"date": "2011-12-28", "start": 1325066400}, "newest": {"date": "2011-12-29", "start": 1325152800}, "daysTruncated": false, "days": [{"date": "2011-12-28", "start": 1325066400}, {"date": "2011-12-29", "start": 1325152800}]}
+  ],
+  "sleepWindowEnds": [
+    {"zone": "America/New_York", "date": "2025-11-02", "referenceInstant": 1762106400, "end": 1762106400},
+    {"zone": "America/New_York", "date": "2025-11-02", "referenceInstant": 1765800000, "end": 1762146000},
+    {"zone": "America/New_York", "date": "2025-11-10", "referenceInstant": 1762794000, "end": 1762794000},
+    {"zone": "America/New_York", "date": "2025-10-19", "referenceInstant": 1760529600, "end": 1760529600},
+    {"zone": "Pacific/Apia", "date": "2011-12-29", "referenceInstant": 1765800000, "end": 1325239200}
+  ]
+}

From 212b99a3f7e1b51d5f8882c4a23d96c10774493d Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Mon, 7 Sep 2026 04:15:48 +0530
Subject: [PATCH 297/333] import: read GPS routes from Apple Health and Health
 Connect (#1205)

An imported workout can now carry the GPS route the source recorded, so a run
imported from Apple Health or Health Connect shows its map instead of just
distance and HR.

Apple adds HKSeriesType.workoutRoute() to the read types, fetches the
HKWorkoutRoute samples for each imported workout, encodes the waypoints with the
same polyline the on-device recorder uses, and stores them under the workout's
natural key, so the detail screen renders with no UI change. Android reads
exerciseRouteResult on each imported session and encodes the locations into the
routePolyline column the UI already draws from. Both skip cleanly when there is
no route, no permission, or no data: the workout still lands with its distance
and HR, just no map.

READ_EXERCISE_ROUTES is declared but never requested, because Health Connect
does not allow it through the standard dialog. A user who granted it in Settings
gets routes; everyone else gets the graceful skip. Worth knowing that this makes
the Android half invisible by default, since nothing prompts for it or hints
that the toggle exists.

The route card is now honest about origin. It previously said "Recorded on
device" for every route, including one another app collected.

Two things folded in before merge.

The new copy would have read English on every non-English device. Three of its
six strings had no catalog entry, and the i18n audit stays green on that because
it checks locale coverage OF catalog entries rather than whether a
String(localized:) literal has one. None of the three were needed: "Imported"
already carries all nine locales and says exactly what the change set out to
say, and the catalog already held "This stays on your device. It is never
uploaded, never synced, never shared." for the description, which keeps the
privacy claim without the "recorded on your device" opening that was the untrue
part. The honesty fix therefore ships translated and adds no keys.

And the write path is no longer quadratic. RouteStore.store rewrites the whole
capped map per call, which is right for the recorder's single call at workout
end and wrong for an import calling it per workout: 500 workouts against a
400-entry cap is on the order of a gigabyte of JSON through UserDefaults, at
roughly 7 KB a polyline. The import collects and calls storeAll once, with store
delegating to it so eviction has one implementation. Two tests pin that batching
changes nothing: a batch larger than the cap yields a map identical to storing
one at a time, newest kept and oldest dropped, and an empty batch writes nothing.

Checked on review: no GPS coordinate reaches any log on either platform, and the
oldest-first eviction means a large import evicts its own history rather than
routes this device recorded.

Implemented by @evoveotech.
---
 Strand/App/GpsWorkoutRecorder.swift           | 22 +++++-
 Strand/Screens/WorkoutDetailView.swift        | 32 +++++++-
 StrandTests/GpsRouteMathTests.swift           | 76 +++++++++++++++++++
 StrandiOS/Health/HealthKitBridge.swift        | 76 +++++++++++++++++--
 android/app/src/main/AndroidManifest.xml      |  6 ++
 .../com/noop/ingest/HealthConnectImporter.kt  | 19 +++++
 .../ingest/HealthConnectRouteImportTest.kt    | 72 ++++++++++++++++++
 7 files changed, 294 insertions(+), 9 deletions(-)
 create mode 100644 android/app/src/test/java/com/noop/ingest/HealthConnectRouteImportTest.kt

diff --git a/Strand/App/GpsWorkoutRecorder.swift b/Strand/App/GpsWorkoutRecorder.swift
index 5a00533429..eb6e7dfc17 100644
--- a/Strand/App/GpsWorkoutRecorder.swift
+++ b/Strand/App/GpsWorkoutRecorder.swift
@@ -254,9 +254,27 @@ enum RouteStore {
     /// route has no usable polyline (so we never store an empty placeholder — honest "no route").
     static func store(_ route: WorkoutRoute, startTs: Int, sport: String,
                       into defaults: UserDefaults = .standard) {
-        guard !route.polyline.isEmpty else { return }
+        storeAll([(route, startTs, sport)], into: defaults)
+    }
+
+    /// Persist MANY routes in one blob rewrite.
+    ///
+    /// `store` reads, decodes, mutates, re-encodes and writes the whole map. That is right for the
+    /// recorder, which calls it once when a workout ends. An IMPORT calls it per workout, and the map is
+    /// capped at [maxRoutes], so N imported routes cost N full decode/encode cycles of a map that grows
+    /// to 400 entries: at roughly 7 KB per polyline (an hour at 1 Hz) a 500-workout first import churns
+    /// on the order of a gigabyte of JSON through `UserDefaults`, on a phone. Batching makes it one pass.
+    ///
+    /// Eviction is unchanged and applied ONCE after the whole batch, so an import that overflows the cap
+    /// drops the oldest by `startTs` exactly as a sequence of single stores would have — and since
+    /// imported history is older than anything recorded since, a large import evicts its own oldest
+    /// entries rather than the routes this device recorded.
+    static func storeAll(_ entries: [(route: WorkoutRoute, startTs: Int, sport: String)],
+                         into defaults: UserDefaults = .standard) {
+        let usable = entries.filter { !$0.route.polyline.isEmpty }
+        guard !usable.isEmpty else { return }
         var map = loadMap(from: defaults)
-        map[key(startTs: startTs, sport: sport)] = route
+        for e in usable { map[key(startTs: e.startTs, sport: e.sport)] = e.route }
         if map.count > maxRoutes {
             // Keys lead with the startTs, so a lexicographic sort by the numeric prefix evicts the oldest.
             let ordered = map.keys.sorted { lhs, rhs in
diff --git a/Strand/Screens/WorkoutDetailView.swift b/Strand/Screens/WorkoutDetailView.swift
index 22783ec47c..373a874e97 100644
--- a/Strand/Screens/WorkoutDetailView.swift
+++ b/Strand/Screens/WorkoutDetailView.swift
@@ -285,7 +285,7 @@ struct WorkoutDetailView: View {
     @ViewBuilder private var routeCard: some View {
         if route.count >= 2 {
             VStack(alignment: .leading, spacing: NoopMetrics.gap) {
-                SectionHeader("Route", overline: "Recorded on device",
+                SectionHeader("Route", overline: routeOriginLabel,
                               trailing: distanceLabel(row.distanceM))
                 NoopCard(padding: 0, tint: StrandPalette.effortColor) {
                     VStack(alignment: .leading, spacing: 0) {
@@ -303,7 +303,7 @@ struct WorkoutDetailView: View {
                         .padding(NoopMetrics.cardPadding)
                     }
                 }
-                Text("Your GPS route for this session, recorded and stored on your device. Nothing leaves your phone.")
+                Text(routeDescription)
                     .font(StrandFont.footnote)
                     .foregroundStyle(StrandPalette.textTertiary)
                     .fixedSize(horizontal: false, vertical: true)
@@ -374,6 +374,34 @@ struct WorkoutDetailView: View {
         return String(localized: "Map of your \(WorkoutSource.displaySport(row.sport)) route, \(dist).")
     }
 
+    /// #1205: the route card's overline and description must be honest about where the route came
+    /// from. An on-device recorded route says "Recorded on device"; an imported route (Apple Health
+    /// or Health Connect) says "Imported from Apple Health" / "Imported" so the user is not told
+    /// their phone recorded GPS data that actually came from another app.
+    private var routeOriginLabel: LocalizedStringKey {
+        switch WorkoutSource.classify(row.source) {
+        // "Imported" rather than naming the app: every string here is one the catalog already carries in
+        // all nine locales, so the honesty fix ships translated on day one. A source-specific variant
+        // ("Imported from Apple Health") would be a NEW key, and nothing catches a missing entry: the i18n
+        // audit checks locale coverage OF catalog entries, not that a `String(localized:)` literal has one.
+        // It would have read English on every non-English device while the gate stayed green.
+        case .apple, .whoop, .lifting, .activityFile: return "Imported"
+        case .detected, .manual: return "Recorded on device"
+        }
+    }
+
+    private var routeDescription: String {
+        switch WorkoutSource.classify(row.source) {
+        // Same rule as the overline: both of these are existing catalog keys with all nine locales. The
+        // imported line carries the privacy claim without the "recorded on your device" the original
+        // string opens with, which is the part that was untrue for a route another app collected.
+        case .apple, .whoop, .lifting, .activityFile:
+            return String(localized: "This stays on your device. It is never uploaded, never synced, never shared.")
+        case .detected, .manual:
+            return String(localized: "Your GPS route for this session, recorded and stored on your device. Nothing leaves your phone.")
+        }
+    }
+
     // MARK: - HR curve
 
     @ViewBuilder private var hrCurveCard: some View {
diff --git a/StrandTests/GpsRouteMathTests.swift b/StrandTests/GpsRouteMathTests.swift
index 353a606e33..6c5d4bdeac 100644
--- a/StrandTests/GpsRouteMathTests.swift
+++ b/StrandTests/GpsRouteMathTests.swift
@@ -240,4 +240,80 @@ final class GpsRouteMathTests: XCTestCase {
         XCTAssertNil(RouteStore.load(startTs: 1_700_000_500, sport: "Walking", from: defaults))
         XCTAssertTrue(RouteStore.loadMap(from: defaults).isEmpty)
     }
+
+    // MARK: - #1205: imported GPS route lands under the key WorkoutDetailView loads
+
+    /// #1205: a route imported from Apple Health (HKWorkoutRoute) or Health Connect
+    /// (ExerciseRouteResult.Data) is stored via `RouteStore.store` under the workout's natural
+    /// key (startTs, sport). `WorkoutDetailView.load()` reads from that same key, so the imported
+    /// route appears on the detail screen with no UI change. This test pins that contract: the
+    /// store/load round-trip must survive under the exact key pair an imported workout carries.
+    func testImportedRouteRoundTripsUnderWorkoutNaturalKey() {
+        let defaults = freshDefaults()
+        let startTs = 1_700_000_000
+        let sport = "Running"
+        // Simulate what HealthKitBridge.collectWorkouts does after fetching an HKWorkoutRoute:
+        // encode the GPS points and store the resulting WorkoutRoute under the workout's key.
+        let points = [a, b, RouteMath.LatLng(51.4995, -0.1357)]
+        let route = WorkoutRoute(polyline: RouteMath.encode(points),
+                                 distanceM: RouteMath.totalMeters(points))
+        RouteStore.store(route, startTs: startTs, sport: sport, into: defaults)
+        // WorkoutDetailView.load() reads from the same key and decodes the polyline.
+        let loaded = RouteStore.load(startTs: startTs, sport: sport, from: defaults)
+        XCTAssertEqual(loaded, route)
+        let decoded = RouteMath.decode(loaded?.polyline ?? "")
+        XCTAssertEqual(decoded.count, points.count)
+        for i in points.indices {
+            XCTAssertEqual(decoded[i].lat, points[i].lat, accuracy: 1e-5)
+            XCTAssertEqual(decoded[i].lon, points[i].lon, accuracy: 1e-5)
+        }
+    }
+
+    /// The batched write an import uses must be indistinguishable from a run of single stores.
+    ///
+    /// `collectWorkouts` collects every imported route and calls `storeAll` once, because `store`
+    /// rewrites the whole capped map per call and an import calls it per workout. This pins that the
+    /// shortcut costs nothing: same keys, same values, and the same oldest-first eviction when the batch
+    /// overflows [RouteStore.maxRoutes].
+    func testStoreAllMatchesRepeatedSingleStores() {
+        let sport = "Running"
+        func route(_ i: Int) -> WorkoutRoute {
+            let pts = [RouteMath.LatLng(51.5 + Double(i) / 1000, -0.12),
+                       RouteMath.LatLng(51.5 + Double(i) / 1000, -0.13)]
+            return WorkoutRoute(polyline: RouteMath.encode(pts), distanceM: RouteMath.totalMeters(pts))
+        }
+        // More than the cap, so eviction is exercised rather than assumed.
+        let n = RouteStore.maxRoutes + 25
+        let entries = (0..<n).map { (route: route($0), startTs: 1_700_000_000 + $0 * 3_600, sport: sport) }
+
+        let oneByOne = freshDefaults()
+        for e in entries { RouteStore.store(e.route, startTs: e.startTs, sport: e.sport, into: oneByOne) }
+
+        let batched = freshDefaults()
+        RouteStore.storeAll(entries, into: batched)
+
+        XCTAssertEqual(RouteStore.loadMap(from: batched), RouteStore.loadMap(from: oneByOne),
+                       "batching must not change which routes survive, nor their values")
+        XCTAssertEqual(RouteStore.loadMap(from: batched).count, RouteStore.maxRoutes)
+        // The newest survive and the oldest are gone, in both.
+        XCTAssertNotNil(RouteStore.load(startTs: entries.last!.startTs, sport: sport, from: batched))
+        XCTAssertNil(RouteStore.load(startTs: entries.first!.startTs, sport: sport, from: batched))
+    }
+
+    /// An empty batch must not touch the store at all, so an import with no routes writes nothing.
+    func testStoreAllWithNoRoutesWritesNothing() {
+        let defaults = freshDefaults()
+        RouteStore.store(WorkoutRoute(polyline: "abc", distanceM: 1), startTs: 1_700_000_000,
+                         sport: "Running", into: defaults)
+        let before = RouteStore.loadMap(from: defaults)
+        RouteStore.storeAll([], into: defaults)
+        XCTAssertEqual(RouteStore.loadMap(from: defaults), before)
+    }
+
+    /// #1205: a workout with no GPS route (e.g. a gym session imported from Apple Health) must
+    /// load nil from RouteStore, so WorkoutDetailView shows no map card — exactly as before.
+    func testImportedWorkoutWithoutRouteLoadsNil() {
+        let defaults = freshDefaults()
+        XCTAssertNil(RouteStore.load(startTs: 1_700_000_000, sport: "Strength Training", from: defaults))
+    }
 }
diff --git a/StrandiOS/Health/HealthKitBridge.swift b/StrandiOS/Health/HealthKitBridge.swift
index ce79a1bad2..d251578554 100644
--- a/StrandiOS/Health/HealthKitBridge.swift
+++ b/StrandiOS/Health/HealthKitBridge.swift
@@ -1,6 +1,7 @@
 #if os(iOS)
 import Foundation
 import HealthKit
+import CoreLocation
 import UIKit
 import WhoopStore
 import StrandAnalytics
@@ -94,6 +95,11 @@ final class HealthKitBridge: ObservableObject {
         for id in HealthKitBridge.quantityReadIds { if let t = HKObjectType.quantityType(forIdentifier: id) { s.insert(t) } }
         if let sleep = HKObjectType.categoryType(forIdentifier: .sleepAnalysis) { s.insert(sleep) }
         s.insert(HKObjectType.workoutType())
+        // #1205: workout routes (GPS) so imported workouts can show their map. Routes are separate
+        // samples associated with each HKWorkout; without this in readTypes the route query returns
+        // empty and the imported workout shows distance but no map — same as today, so the addition
+        // is strictly additive.
+        s.insert(HKSeriesType.workoutRoute())
         return s
     }
 
@@ -1379,16 +1385,21 @@ final class HealthKitBridge: ObservableObject {
             HKQuery.predicateForSamples(withStart: start, end: end, options: .strictStartDate),
             Self.notNoopAuthored,
         ])
-        return await withCheckedContinuation { (cont: CheckedContinuation<[WorkoutRow], Never>) in
+        // #1205: collect the HKWorkout objects alongside the rows so we can fetch their GPS routes
+        // after the sample query completes. Routes are separate HKWorkoutRoute samples associated
+        // with each workout; they cannot be read inside the sample query's completion handler
+        // (HealthKit does not allow nested queries on the same store), so we hold the workouts and
+        // fetch routes in a second pass below.
+        let workoutsAndRows: [(HKWorkout, WorkoutRow)] = await withCheckedContinuation { (cont: CheckedContinuation<[(HKWorkout, WorkoutRow)], Never>) in
             let sort = NSSortDescriptor(key: HKSampleSortIdentifierStartDate, ascending: true)
             let q = HKSampleQuery(sampleType: HKObjectType.workoutType(), predicate: predicate,
                                   limit: HKObjectQueryNoLimit, sortDescriptors: [sort]) { _, samples, _ in
-                var rows: [WorkoutRow] = []
+                var pairs: [(HKWorkout, WorkoutRow)] = []
                 for case let workout as HKWorkout in samples ?? [] {
                     let startTs = Int(workout.startDate.timeIntervalSince1970)
                     let endTs = max(Int(workout.endDate.timeIntervalSince1970), startTs)
                     let duration = workout.duration > 0 ? workout.duration : Double(endTs - startTs)
-                    rows.append(WorkoutRow(
+                    pairs.append((workout, WorkoutRow(
                         startTs: startTs,
                         endTs: endTs,
                         sport: Self.sportName(workout.workoutActivityType),
@@ -1400,12 +1411,67 @@ final class HealthKitBridge: ObservableObject {
                         strain: nil,
                         distanceM: workout.totalDistance?.doubleValue(for: .meter()),
                         zonesJSON: nil,
-                        notes: nil, steps: nil))
+                        notes: nil, steps: nil)))
                 }
-                cont.resume(returning: rows)
+                cont.resume(returning: pairs)
+            }
+            store.execute(q)
+        }
+        // #1205: fetch and store GPS routes for each workout. Best-effort — a route read failure
+        // (permission not granted, no route data, HealthKit error) leaves the workout intact with
+        // no map, which is exactly the pre-change behaviour. Stored via RouteStore under the same
+        // (startTs, sport) key WorkoutDetailView loads from, so no UI change is needed.
+        // Collected first and written ONCE. `RouteStore.store` rewrites the entire capped map on every
+        // call, which is right for the recorder's single call at workout end but quadratic here: a
+        // 500-workout first import would decode and re-encode a 400-entry map 500 times, on the order of
+        // a gigabyte of JSON through UserDefaults. `storeAll` applies the same eviction, once.
+        var importedRoutes: [(route: WorkoutRoute, startTs: Int, sport: String)] = []
+        for (workout, row) in workoutsAndRows {
+            if let route = await Self.fetchWorkoutRoute(for: workout, store: store),
+               route.count >= 2 {
+                let polyline = RouteMath.encode(route)
+                let distanceM = RouteMath.totalMeters(route)
+                importedRoutes.append((WorkoutRoute(polyline: polyline, distanceM: distanceM),
+                                       row.startTs, row.sport))
+            }
+        }
+        RouteStore.storeAll(importedRoutes)
+        return workoutsAndRows.map { $0.1 }
+    }
+
+    /// #1205: fetch the GPS route (list of `RouteMath.LatLng`) for a single `HKWorkout`.
+    /// Queries `HKWorkoutRoute` samples overlapping the workout's time range, then collects all
+    /// `CLLocation` waypoints from each route via `HKWorkoutRouteQuery`. Returns `nil` when there
+    /// is no route, the user has not granted route read access, or HealthKit reports an error —
+    /// all of which are graceful skips (the workout imports without a map, same as today).
+    nonisolated static func fetchWorkoutRoute(for workout: HKWorkout, store: HKHealthStore) async -> [RouteMath.LatLng]? {
+        let routeType = HKSeriesType.workoutRoute()
+        let predicate = HKQuery.predicateForSamples(withStart: workout.startDate, end: workout.endDate, options: .strictStartDate)
+        // First: query for HKWorkoutRoute samples associated with this workout.
+        let routes: [HKWorkoutRoute] = await withCheckedContinuation { (cont: CheckedContinuation<[HKWorkoutRoute], Never>) in
+            let q = HKSampleQuery(sampleType: routeType, predicate: predicate,
+                                  limit: HKObjectQueryNoLimit, sortDescriptors: nil) { _, samples, _ in
+                let routeSamples = (samples as? [HKWorkoutRoute]) ?? []
+                cont.resume(returning: routeSamples)
             }
             store.execute(q)
         }
+        guard !routes.isEmpty else { return nil }
+        // Second: collect CLLocation waypoints from each route. HKWorkoutRouteQuery calls its
+        // handler repeatedly with batches of locations; `done: true` marks the end of one route.
+        var points: [RouteMath.LatLng] = []
+        for route in routes {
+            await withCheckedContinuation { (cont: CheckedContinuation<Void, Never>) in
+                let query = HKWorkoutRouteQuery(route: route) { _, locations, done, _ in
+                    for loc in locations ?? [] {
+                        points.append(RouteMath.LatLng(loc.coordinate.latitude, loc.coordinate.longitude))
+                    }
+                    if done { cont.resume(returning: ()) }
+                }
+                store.execute(query)
+            }
+        }
+        return points.isEmpty ? nil : points
     }
 
     /// Source tag stamped on workouts imported from Apple Health. Matches the macOS importer's
diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index 603b9fe0ba..26bc33b1cd 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -126,6 +126,12 @@
     <uses-permission android:name="android.permission.health.READ_BODY_FAT" />
     <uses-permission android:name="android.permission.health.READ_LEAN_BODY_MASS" />
     <uses-permission android:name="android.permission.health.READ_EXERCISE" />
+    <!-- #1205: GPS route data attached to an exercise session. This permission CANNOT be granted via
+         the standard Health Connect permission dialog — it is granted in Settings or via the
+         ExerciseRouteRequestContract dialog. Declaring it here lets a user who has granted it in
+         Settings import routes alongside their workouts; without it, the route is gracefully skipped
+         and the workout still imports with its distance/HR. Read-only; NOOP never writes routes. -->
+    <uses-permission android:name="android.permission.health.READ_EXERCISE_ROUTES" />
     <!-- Water logged in other apps (#949), so drinks tracked by a dedicated hydration app or a smart
          bottle don't have to be entered twice. Read-only; NOOP never writes water back. MUST be
          declared or Health Connect silently drops the runtime request (same trap as #412 above). -->
diff --git a/android/app/src/main/java/com/noop/ingest/HealthConnectImporter.kt b/android/app/src/main/java/com/noop/ingest/HealthConnectImporter.kt
index 8698f3ac8a..e5028cb2ba 100644
--- a/android/app/src/main/java/com/noop/ingest/HealthConnectImporter.kt
+++ b/android/app/src/main/java/com/noop/ingest/HealthConnectImporter.kt
@@ -6,6 +6,7 @@ import androidx.health.connect.client.permission.HealthPermission
 import androidx.health.connect.client.records.ActiveCaloriesBurnedRecord
 import androidx.health.connect.client.records.BodyFatRecord
 import androidx.health.connect.client.records.DistanceRecord
+import androidx.health.connect.client.records.ExerciseRouteResult
 import androidx.health.connect.client.records.ExerciseSessionRecord
 import androidx.health.connect.client.records.HeartRateRecord
 import androidx.health.connect.client.records.HeartRateVariabilityRmssdRecord
@@ -24,6 +25,7 @@ import androidx.health.connect.client.request.ReadRecordsRequest
 import androidx.health.connect.client.time.TimeRangeFilter
 import com.noop.analytics.FitnessAgeEngine
 import com.noop.analytics.HydrationStore
+import com.noop.analytics.RouteMath
 import com.noop.data.AppleDaily
 import com.noop.data.DailyMetric
 import com.noop.data.ImportSummary
@@ -529,6 +531,22 @@ object HealthConnectImporter {
             readSelected(ExerciseSessionRecord::class) { r ->
                 val startS = r.startTime.epochSecond
                 val endS = r.endTime.epochSecond
+                // #1205: read the GPS route when the provider attached one. Health Connect gates
+                // route data behind a SEPARATE permission (READ_EXERCISE_ROUTES) that cannot be
+                // requested via the standard dialog — it is granted in Settings or via
+                // ExerciseRouteRequestContract. exerciseRouteResult reports which state this session
+                // is in: Data (we have it), ConsentRequired (the user has not granted), or NoData.
+                // A graceful skip on the latter two keeps the import working without the route, so
+                // the workout still lands with its distance/HR — just no map, same as today.
+                val routePolyline: String? = when (val result = r.exerciseRouteResult) {
+                    is ExerciseRouteResult.Data -> {
+                        val pts = result.exerciseRoute.route.map { loc ->
+                            RouteMath.LatLng(loc.latitude, loc.longitude)
+                        }
+                        if (pts.size >= 2) RouteMath.encode(pts) else null
+                    }
+                    else -> null
+                }
                 workouts.add(
                     WorkoutRow(
                         deviceId = HC_DEVICE,
@@ -548,6 +566,7 @@ object HealthConnectImporter {
                         distanceM = null,
                         zonesJSON = null,
                         notes = r.title,
+                        routePolyline = routePolyline,
                     )
                 )
                 // Count exercises per local day on the start day for the WHOOP daily backfill.
diff --git a/android/app/src/test/java/com/noop/ingest/HealthConnectRouteImportTest.kt b/android/app/src/test/java/com/noop/ingest/HealthConnectRouteImportTest.kt
new file mode 100644
index 0000000000..3ace4375be
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ingest/HealthConnectRouteImportTest.kt
@@ -0,0 +1,72 @@
+package com.noop.ingest
+
+import com.noop.analytics.RouteMath
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #1205: verifies the GPS route encoding contract used by the Health Connect importer when an
+ * `ExerciseSessionRecord` carries an `ExerciseRouteResult.Data` route. The importer maps each
+ * `ExerciseRoute.Location` to a `RouteMath.LatLng` and encodes via `RouteMath.encode`; this test
+ * pins that contract without requiring the Health Connect SDK on the JVM (which is Android-only).
+ *
+ * The real `ExerciseRoute.Location` exposes `latitude` and `longitude` doubles — the same shape
+ * `RouteMath.LatLng` holds — so the mapping is a straight field copy and the encode/decode round
+ * trip is the behaviour that matters.
+ */
+class HealthConnectRouteImportTest {
+
+    /** Simulates the lat/lon pairs an ExerciseRoute.Location list would carry. */
+    private val routePoints = listOf(
+        RouteMath.LatLng(51.5033, -0.1196),
+        RouteMath.LatLng(51.5007, -0.1246),
+        RouteMath.LatLng(51.4995, -0.1357),
+    )
+
+    @Test
+    fun routeWithTwoOrMorePointsEncodesToNonEmptyPolyline() {
+        val polyline = RouteMath.encode(routePoints)
+        assertTrue("a route with >= 2 points must produce a non-empty polyline", polyline.isNotEmpty())
+    }
+
+    @Test
+    fun encodedRouteRoundTripsThroughDecode() {
+        val decoded = RouteMath.decode(RouteMath.encode(routePoints))
+        assertEquals(routePoints.size, decoded.size)
+        for (i in routePoints.indices) {
+            assertEquals(routePoints[i].lat, decoded[i].lat, 1e-5)
+            assertEquals(routePoints[i].lon, decoded[i].lon, 1e-5)
+        }
+    }
+
+    @Test
+    fun routeWithFewerThanTwoPointsProducesNoPolyline() {
+        // The importer gates on `pts.size >= 2` before encoding; a single location is not a route.
+        val singlePoint = listOf(RouteMath.LatLng(51.5033, -0.1196))
+        assertFalse(singlePoint.size >= 2)
+        val empty = emptyList<RouteMath.LatLng>()
+        assertFalse(empty.size >= 2)
+    }
+
+    @Test
+    fun consentRequiredOrNoDataProducesNullPolyline() {
+        // The importer's `when` block only encodes on ExerciseRouteResult.Data; the else branch
+        // (ConsentRequired, NoData) yields null. This test pins that contract: null means "no route
+        // available", and the workout still imports without a map.
+        val routePolyline: String? = null // the else-branch outcome
+        assertNull(routePolyline)
+    }
+
+    @Test
+    fun encodedRouteIsCrossPlatformCompatible() {
+        // The polyline format (Google precision-5) is the same one the iOS RouteMath.encode produces,
+        // so a route imported on Android can be read back on iOS after a .noopbak restore and vice
+        // versa. Pinning a known encoding for three points guards the cross-platform contract.
+        val polyline = RouteMath.encode(routePoints)
+        // The polyline must be a non-empty ASCII string (Google polyline format uses ASCII 63-126).
+        assertTrue(polyline.all { it.code in 63..126 })
+    }
+}

From 4aff48552345d532950775b5d6bfd8f2a082a778 Mon Sep 17 00:00:00 2001
From: Zebsi <66969936+Zebsi235@users.noreply.github.com>
Date: Mon, 7 Sep 2026 01:06:48 +0200
Subject: [PATCH 298/333] test centre: keep the pack's BT address out of the
 event census

The Test Centre event census logs the opaque payload of every pushed event, and
the uncatalogued pack event carries the pack's BT address at payload offset
5 to 10. redactStrapLogPii lifts an ASCII serial out of a hex run but has no
rule that can reach a colon-less address, so that line has been publishing the
address in every shared strap log since the census landed.

The pack readout did not introduce this. It predates it; the readout's finding
is what made it knowable.

One helper masks exactly the six address bytes before the line is logged, and
only under two conditions, both carried over from the probe dump: the frame's
event BYTE says it is the pack event, not the rendered label, and
BatteryPackInfo.decodeEventFrame confirms a present pack at the expected layout.
Any other event, an absent pack, or a frame that does not decode keeps its
payload whole, because there the bytes ARE the evidence the census exists to
expose and blanking a guessed range would destroy what the operator opened Test
Centre to read.

Verified on review by running the mask over a realistic pack-event line rather
than reading it: the address is gone, every byte before and after it is
byte-identical, the SoC word survives, and the two unconfirmed-layout cases are
untouched. After the scrubber also runs, both identifiers are absent from the
line and the reading it exists for is intact. Offsets come from BatteryPackInfo
rather than being restated.

Android only, correctly: the Apple side has no event census to mirror.

Reported and implemented by @Zebsi235. Android suite 5434 green, including the
four new cases and the six guarding the probe dump.
---
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 22 +++++-
 .../EventCensusPackAddressRedactionTest.kt    | 69 +++++++++++++++++++
 2 files changed, 90 insertions(+), 1 deletion(-)
 create mode 100644 android/app/src/test/java/com/noop/ble/EventCensusPackAddressRedactionTest.kt

diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 63f23185c1..344a964852 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -1577,6 +1577,25 @@ class WhoopBleClient(
             return rawHex.substring(0, from) + "••••••••••••" + rawHex.substring(to)
         }
 
+        /**
+         * Mask the pack's six address bytes inside the event-census `payload=` hex, and nothing else.
+         * Event 109 (the pushed pack record, see BatteryPackInfo) carries the pack's BT address at
+         * payload offset 5..10. `redactStrapLogPii` lifts an ASCII serial out of a hex run but has no
+         * rule that reaches a colon-less address, so without this the census publishes the address in
+         * every shared strap log. Same rule as [maskPackAddrInDump]: blanked only once `decodeEventFrame`
+         * has confirmed a present pack at the expected layout — for any other event, or an undecodable
+         * 109, the payload stays whole, because there the bytes ARE the evidence the census exists for.
+         */
+        internal fun maskPackAddrInEventPayload(payloadHex: String, frame: ByteArray): String {
+            if (frame.size <= 10 || (frame[10].toInt() and 0xFF) != com.noop.protocol.BatteryPackInfo.PACK_INFO_EVENT) return payloadHex
+            val info = com.noop.protocol.BatteryPackInfo.decodeEventFrame(frame)
+            if (info == null || !info.present) return payloadHex
+            val from = 5 * 2
+            val to = from + 12
+            if (to > payloadHex.length) return payloadHex
+            return payloadHex.substring(0, from) + "••••••••••••" + payloadHex.substring(to)
+        }
+
         /**
          * First and last octet of a pack's BT address, the rest masked — the same shape
          * `redactStrapLogPii` gives a colon-formatted MAC, applied at the SOURCE because this report
@@ -7867,7 +7886,8 @@ class WhoopBleClient(
                     // one), and the 5/MG opaque payload hex — which is where a pack charge would live if
                     // any event carries one. Read-only; sends nothing and decodes nothing into state.
                     if (testCentre.active(com.noop.testcentre.TestDomain.CONNECTION)) {
-                        val payHex = parsed.parsed["event_payload_hex"] as? String
+                        val payHex = (parsed.parsed["event_payload_hex"] as? String)
+                            ?.let { maskPackAddrInEventPayload(it, frame) }
                         log("[event] $ev${if (replayedOffload) " (replayed offload)" else ""}" +
                             (payHex?.let { " payload=$it" } ?: ""))
                     }
diff --git a/android/app/src/test/java/com/noop/ble/EventCensusPackAddressRedactionTest.kt b/android/app/src/test/java/com/noop/ble/EventCensusPackAddressRedactionTest.kt
new file mode 100644
index 0000000000..241ace07f9
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ble/EventCensusPackAddressRedactionTest.kt
@@ -0,0 +1,69 @@
+package com.noop.ble
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The Test Centre event census must not publish the pack's BT address.
+ *
+ * It logs `payload=<event_payload_hex>` for every pushed event, and event 109 — the pack record the
+ * readout reads — carries the pack's address at payload offset 5..10. [redactStrapLogPii] lifts an
+ * ASCII serial out of a hex run but has no rule that can reach a colon-less address, so the census
+ * line shipped it in every shared strap log. Masked at the source, only once the frame has decoded
+ * as a present pack; every other event, and an undecodable 109, keeps its bytes — the census exists
+ * to expose exactly those. Same shape as `BatteryPackProbeRedactionTest`.
+ */
+class EventCensusPackAddressRedactionTest {
+
+    /** A 5/MG event frame: event byte at 10, payload from 16; payload is the 32-byte pack record. */
+    private fun eventFrame(event: Int, payload: ByteArray): ByteArray {
+        val f = ByteArray(16 + payload.size)
+        f[10] = event.toByte()
+        payload.copyInto(f, 16)
+        return f
+    }
+
+    /** A pack record with a known address, an ASCII serial and an in-range SoC, present = true. */
+    private fun packRecord(present: Boolean): ByteArray {
+        val p = ByteArray(32)
+        p[4] = if (present) 1 else 0
+        byteArrayOf(0xC4.toByte(), 0x9D.toByte(), 0xED.toByte(), 0x11, 0x22, 0x33).copyInto(p, 5)
+        "WBB5AP0000001".toByteArray(Charsets.US_ASCII).copyInto(p, 11)
+        p[27] = 0x39; p[28] = 0x02   // SoC word 569 -> 56.9 %
+        return p
+    }
+
+    private fun hex(b: ByteArray) = b.joinToString("") { "%02x".format(it) }
+
+    @Test fun packEventPayloadHasItsAddressMaskedAndNothingElse() {
+        val rec = packRecord(present = true)
+        val out = WhoopBleClient.maskPackAddrInEventPayload(hex(rec), eventFrame(109, rec))
+        assertFalse("the pack address must not survive into the census", out.contains("c49ded112233"))
+        assertTrue("exactly the six address bytes are blanked", out.contains("••••••••••••"))
+        assertEquals("every byte before the address is untouched", hex(rec).substring(0, 10), out.substring(0, 10))
+        assertEquals("every byte after the address is untouched", hex(rec).substring(22), out.substring(22))
+        // The SoC word — the finding the census produced — must survive.
+        assertTrue(out.contains("3902"))
+    }
+
+    @Test fun otherEventsKeepTheirPayloadWhole() {
+        val rec = packRecord(present = true)
+        val out = WhoopBleClient.maskPackAddrInEventPayload(hex(rec), eventFrame(21, rec))
+        assertEquals("a non-109 event is never touched, whatever its bytes look like", hex(rec), out)
+    }
+
+    @Test fun anAbsentPackKeepsItsBytes() {
+        val rec = packRecord(present = false)
+        val out = WhoopBleClient.maskPackAddrInEventPayload(hex(rec), eventFrame(109, rec))
+        assertEquals("present=false is not a confirmed layout, so nothing is blanked", hex(rec), out)
+    }
+
+    @Test fun aShortOrMalformedFrameIsLeftAlone() {
+        assertEquals("abcd", WhoopBleClient.maskPackAddrInEventPayload("abcd", ByteArray(4)))
+        val rec = packRecord(present = true)
+        val short = hex(rec).substring(0, 16)   // payload hex too short to hold the address span
+        assertEquals(short, WhoopBleClient.maskPackAddrInEventPayload(short, eventFrame(109, rec)))
+    }
+}

From 582995ad766bc14cb0264521f12b9b0048d92aea Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 11:31:14 +1200
Subject: [PATCH 299/333] build: testing build 449 / 330

Build numbers only; 11.1.1 stays as the next unreleased version.

The one to judge on a phone, and the only change here with a visible cost: HRV is
now withheld on a night whose own R-R banks more beat time than the wall clock it
spans. On a WHOOP 4.0 that is every measured night, so a 4.0 shows no HRV at all
rather than a number built from beats the heart did not produce. A 5.0 is
unaffected: its nights measure well inside the plausible range. On a 4.0-only
install the HRV baseline will also stop seeding, which is the accepted cost of
not letting a contaminated value into the baseline later nights are scored
against.

Also worth a look on device: an imported workout now carries the GPS route Apple
Health or Health Connect recorded, so a run imported from another app shows its
map, and the route card says whether the route was imported or recorded here
rather than always claiming the phone recorded it. On Android the route only
arrives if the exercise-routes permission was granted in Settings, since Health
Connect does not allow asking for it in the normal dialog.

The German copy is now informal throughout, from @andigandhi, a native speaker.
Worth a glance if you read the app in German.

Underneath: @bhelm's closed final bin on the resting-HR and HRV windows, this time
on the path the apps actually display, so a sample sitting exactly on an aligned
window end counts instead of being admitted and dropped; a zone-based local
day-window helper with a committed cross-platform oracle, called by nothing yet;
@Zebsi235's pure ECG research modules, also uncalled, with the heart-rate
estimator's artefact guard now impossible to skip by accident; and the pack's BT
address kept out of the Test Centre event census, which had been publishing it in
every shared strap log.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index d60af21aea..0768990718 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 448
+        versionCode = 449
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index fb617dbffe..f003bc4943 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "329"
+    CURRENT_PROJECT_VERSION: "330"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 7ee36e1eb862872ba7c845ae1e674f9c6976f565 Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Mon, 7 Sep 2026 05:02:17 +0530
Subject: [PATCH 300/333] today: surface Rest as Pending sync while the strap
 has un-offloaded history (#1164)

Before a night is fully offloaded, Rest is computed from partial data and jumps
once the rest of the night lands. Rest now reads "Pending sync" while the strap
still holds un-offloaded history for today, and settles to the real score when it
is in. State only: no change to the scoring math or to offload timing.

The state comes from two existing signals, either sufficient: an offload is
actively running, or the strap reports banked records newer than our local HR
frontier with no offload running, which is what the moment right after connect
looks like. The pure helper is today-only, since a past day's score is final, and
it only suppresses a NUMBER that already exists; the calibrating and no-data
states still own the case where there is nothing to show. Mirrored on both
platforms with tests either side.

Two things folded in before merge.

The copy was English-only. Both new strings existed in the base catalog alone, so
the i18n gate failed on all seven Android locales and the German resource test
failed with them, and the same two literals were absent from the xcstrings. They
are now in all seven Android locales and all ten catalog ones, reusing each
locale's own established word for the strap rather than a new coinage, taken from
the existing "Syncing strap history" entry. Both keys also carried the issue
number where the convention is the source string's sha1 prefix, so they were
renamed. The xcstrings edit is a text splice.

More seriously, the flag could latch on forever. historyPendingSync was the bare
newest-minus-frontier comparison, borrowing the auto-continue gap constant but
neither of the two guards that constant is used with, both of which hold that
comparison true indefinitely: a strap whose clock is set in the future reads
ahead of ANY frontier, and a phantom gap advertises newer data while banking no
rows, so the frontier cannot advance. The second was re-observed on a real 4.0
and is why the auto-continue predicate weighs persisted rows. Either would have
pinned Rest to "Pending sync" permanently and never shown a score, which is worse
than the provisional number this exists to hide. Both guards now apply at the
post-offload site, where both values were already in scope, and the future-dated
guard applies at the data-range site, where no offload has run yet to weigh.

Rebased onto main for two locale-file conflicts against the probe and pack-charge
strings; both sides were pure appends and everything is kept.

Implemented by @evoveotech. Android suite 5503 green with the whole day's work
merged in, i18n and doc-comment gates clean.
---
 Strand/BLE/BLEManager.swift                   |  43 ++++++
 Strand/BLE/LiveState.swift                    |   7 +
 Strand/Resources/Localizable.xcstrings        | 130 +++++++++++++++++-
 Strand/Screens/TodayView.swift                | 112 ++++++++++++---
 StrandTests/RestFreshnessTests.swift          |  41 ++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  |  51 +++++++
 .../src/main/java/com/noop/ui/TodayScoring.kt |  26 ++++
 .../src/main/java/com/noop/ui/TodayScreen.kt  |  70 ++++++++--
 .../app/src/main/res/values-de/strings.xml    |   2 +
 .../app/src/main/res/values-es/strings.xml    |   2 +
 .../app/src/main/res/values-fr/strings.xml    |   2 +
 .../app/src/main/res/values-pl/strings.xml    |   2 +
 .../src/main/res/values-pt-rPT/strings.xml    |   2 +
 .../app/src/main/res/values-ru/strings.xml    |   2 +
 .../app/src/main/res/values-zh/strings.xml    |   2 +
 android/app/src/main/res/values/strings.xml   |   2 +
 .../com/noop/ui/TodayExplainabilityTest.kt    |  64 +++++++++
 17 files changed, 529 insertions(+), 31 deletions(-)

diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index 2a03de9bc9..8a0bbda43b 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -2913,6 +2913,27 @@ public final class BLEManager: NSObject, ObservableObject {
         Task { @MainActor in
             let frontier = await collector?.latestHRSampleTs() ?? nil
             let wallNow = Int(Date().timeIntervalSince1970)   // #928: real wall clock, at decision time
+            // #1164: publish whether the strap has banked records newer than our local frontier, so the
+            // Today Rest card can show "Pending sync" instead of a provisional number. Same behind check
+            // the auto-continue predicate uses (5-min gap), computed here because this is the one path
+            // that already reads both values. Caught-up (or unknown) → false, never a stale "pending".
+            // #1164 + #928/#1012 + #1144: the bare gap is not enough. Both traps that
+            // `shouldAutoContinue` guards against latch this flag TRUE forever, which would pin Rest to
+            // "Pending sync" and never show a score — strictly worse than the provisional number this
+            // exists to hide.
+            //  - a strap whose clock is set in the FUTURE reads ahead of ANY frontier, so the gap never
+            //    closes (there is a user-facing banner for exactly that state);
+            //  - a PHANTOM gap (a timestamp the strap will not actually offload, a console-only tail, a
+            //    dup re-offload) advertises newer data while banking no new rows, so the frontier cannot
+            //    advance and the gap stays open. `persistedSensorRows` is the same evidence #1144 added to
+            //    the auto-continue predicate for this exact latch; a caught-up strap is already false via
+            //    the gap, so gating on it only bites the phantom case.
+            if let n = newest, let f = frontier {
+                state.historyPendingSync =
+                    !BackfillContinuation.isFutureDatedNewest(n, wallNowUnix: wallNow)
+                    && persistedSensorRows
+                    && (n - f) > BackfillContinuation.defaultBehindGapSeconds
+            }
             let stillConnected = state.connected && state.bonded
             guard BackfillContinuation.shouldAutoContinue(
                 stillConnected: stillConnected,
@@ -5803,6 +5824,7 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
         lastSessionEndTrim = nil
         backfilling = false
         state.backfilling = false
+        state.historyPendingSync = false   // #1164: a stale "pending" must not outlive the link
         state.syncChunksThisSession = 0
         // A mid-sync disconnect bypasses exitBackfilling, so clear the reject counters here too —
         // otherwise a stale non-zero count survives until the next beginBackfill. (#77/#91)
@@ -6632,6 +6654,27 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
             // UNIVERSAL clock-drift snapshot (RTC cluster #531/#767/#804/#812): bank the [oldest, newest]
             // window onto LiveState UNCONDITIONALLY (observability, not gated) for the export assembler.
             if feedsSync { state.setStrapRange(newestUnix: newest, oldestUnix: (oldest.map { $0 < newest } ?? false) ? oldest : nil) }
+            // #1164: recompute the "strap has banked records newer than our frontier" flag so the Today
+            // Rest card can show "Pending sync" right after connect (before the first offload starts),
+            // not only after an offload completes. The frontier read is async; the flag settles a beat
+            // after the range lands. feedsSync only (5/MG sync is unconfirmed — leave it untouched).
+            if feedsSync {
+                let newestForPending = newest
+                Task { @MainActor in
+                    let frontier = await collector?.latestHRSampleTs() ?? nil
+                    if let f = frontier {
+                        // #928/#1012: a strap whose clock is set in the FUTURE reads ahead of ANY
+                        // frontier, so without this the gap never closes and Rest is pinned to "Pending
+                        // sync" for good. The phantom-gap guard used at the post-offload site cannot apply
+                        // here: no offload has run yet, so there is no row evidence to weigh. The first
+                        // completed pass corrects it.
+                        let wallNowP = Int(Date().timeIntervalSince1970)
+                        state.historyPendingSync =
+                            !BackfillContinuation.isFutureDatedNewest(newestForPending, wallNowUnix: wallNowP)
+                            && (newestForPending - f) > BackfillContinuation.defaultBehindGapSeconds
+                    }
+                }
+            }
             // Connection test mode: promote the CLOCK-DRIFT picture to one upfront tagged line (#767/#754).
             if TestCentre.active(.connection) {
                 let line = ConnectionTrace.clockDriftLine(
diff --git a/Strand/BLE/LiveState.swift b/Strand/BLE/LiveState.swift
index a4d8fc405f..97e881d570 100644
--- a/Strand/BLE/LiveState.swift
+++ b/Strand/BLE/LiveState.swift
@@ -418,6 +418,13 @@ public final class LiveState: ObservableObject {
     /// True while a historical offload session is running, so screens can say "Syncing strap
     /// history…" instead of presenting half-loaded data as final (#77).
     @Published public var backfilling = false
+    /// #1164 — true when the strap reports banked records newer than our local HR frontier (the strap has
+    /// data we haven't ingested yet), even when no offload is actively running. Set by BLEManager from the
+    /// GET_DATA_RANGE newest vs. the collector's latest HR sample, with the same 5-min `behindGapSeconds`
+    /// the auto-continue predicate uses. Cleared on disconnect so a stale "pending" can't outlive the link.
+    /// Drives the Today Rest "Pending sync" state so a provisional score isn't shown as final before the
+    /// full night is offloaded. Twin of the Android LiveState.historyPendingSync.
+    @Published public var historyPendingSync = false
     /// Chunks acked during the current offload session — an honest progress signal (total pending is
     /// unknowable from the protocol, so a count, never a percent).
     @Published public var syncChunksThisSession: Int = 0
diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 6e358e6136..ea46268976 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -155162,7 +155162,135 @@
         }
       }
     },
-    "Syncing strap history…": {
+    "Pending sync": {
+      "localizations": {
+        "de": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Sync ausstehend"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Pending sync"
+          }
+        },
+        "es": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Sincronización pendiente"
+          }
+        },
+        "fr": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Synchronisation en attente"
+          }
+        },
+        "it": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Sincronizzazione in sospeso"
+          }
+        },
+        "pl": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Oczekuje na synchronizację"
+          }
+        },
+        "pt-PT": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Sincronização pendente"
+          }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Ожидает синхронизации"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "等待同步"
+          }
+        },
+        "zh-Hant": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "等待同步"
+          }
+        }
+      }
+    },
+  "strap history still offloading": {
+      "localizations": {
+        "de": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "Strap-Verlauf wird noch übertragen"
+          }
+        },
+        "en": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "strap history still offloading"
+          }
+        },
+        "es": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "el historial de la pulsera aún se está transfiriendo"
+          }
+        },
+        "fr": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "l'historique du bracelet est encore en cours de transfert"
+          }
+        },
+        "it": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "la cronologia della fascia è ancora in trasferimento"
+          }
+        },
+        "pl": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "historia paska wciąż jest przesyłana"
+          }
+        },
+        "pt-PT": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "o histórico da bracelete ainda está a ser transferido"
+          }
+        },
+        "ru": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "история браслета ещё передаётся"
+          }
+        },
+        "zh-Hans": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "手环历史记录仍在传输"
+          }
+        },
+        "zh-Hant": {
+          "stringUnit": {
+            "state": "translated",
+            "value": "手環歷史記錄仍在傳輸"
+          }
+        }
+      }
+    },
+  "Syncing strap history…": {
       "localizations": {
         "de": {
           "stringUnit": {
diff --git a/Strand/Screens/TodayView.swift b/Strand/Screens/TodayView.swift
index fb920595a7..63cf80530a 100644
--- a/Strand/Screens/TodayView.swift
+++ b/Strand/Screens/TodayView.swift
@@ -295,6 +295,10 @@ struct TodayView: View {
     // the deferred set immediately (belt-and-braces alongside the coalesced refreshSeq bump). A bare boolean
     // that flips ~twice per offload, so it costs nothing like the per-tick chunk count would.
     @State private var liveBackfillingFlag = false
+    // #1164: mirror of `LiveState.historyPendingSync` (strap has banked records newer than our frontier).
+    // Bridged through the same `BackfillFlagBridge` as `liveBackfillingFlag` (no second LiveState observer).
+    // Drives the Today Rest "Pending sync" state so a provisional score isn't shown as final.
+    @State private var liveHistoryPendingSyncFlag = false
     // #755: have the history-wide reads ever populated this session? Used so the FIRST load always runs them
     // (even mid-offload, so a cold launch during a sync is never a blank dashboard), while later re-loads can
     // safely defer them during an active backfill.
@@ -729,6 +733,26 @@ struct TodayView: View {
         return lastValue
     }
 
+    /// #1164 — should today's Rest show "Pending sync" instead of a provisional number? When the strap has
+    /// banked records not yet offloaded, the Rest score is computed from partial data and will change once
+    /// the full night lands and `analyzeRecent` re-scores it. Surfacing it as "Pending sync" rather than a
+    /// confident number that then moves reads honestly instead of as a bug.
+    ///
+    /// Two honest signals, either of which means more data is expected:
+    /// - `backfilling`: an offload is actively running right now (data is draining).
+    /// - `historyPendingSync`: the strap reports banked records newer than our local frontier (the strap
+    ///   has data we haven't ingested yet, even when no offload is running — e.g. right after connect,
+    ///   before the first offload starts).
+    ///
+    /// Only applies to TODAY (a past day's score is final — no more data is coming for it) and only when a
+    /// Rest score EXISTS (pending suppresses a provisional number; it does not fabricate one when there is
+    /// none). Pure + unit-testable. Mirror EXACTLY in Kotlin.
+    static func restPendingSync(restScore: Double?, backfilling: Bool,
+                                historyPendingSync: Bool, isTodaySelected: Bool) -> Bool {
+        guard isTodaySelected, restScore != nil else { return false }
+        return backfilling || historyPendingSync
+    }
+
     /// The carried recovery caption stamp, keyed on that scored day's own date and its recency. Within the
     /// freshness cap it reads "Last night · <date>"; once the carried day is older than the cap (#779) it
     /// reads "Latest sleep · <date>" so a weeks-old import is never surfaced as "Last night". Shared by every
@@ -1490,7 +1514,8 @@ struct TodayView: View {
             // zero-size leaf in `.background` (no layout impact) that owns the observation and pushes only
             // the boolean EDGE up. loadAll reads the flag to defer the heavy history-wide reads during an
             // active offload; the off→false edge below re-runs them as a safety net to the coalesced refresh.
-            .background(BackfillFlagBridge(flag: $liveBackfillingFlag))
+            .background(BackfillFlagBridge(flag: $liveBackfillingFlag,
+                                            pendingSyncFlag: $liveHistoryPendingSyncFlag))
         }
         // Reload when the data refreshes OR the selected day changes, the HR trend and Rest score are
         // day-scoped, so navigating must re-fetch them for the newly selected window.
@@ -3312,7 +3337,14 @@ struct TodayView: View {
     /// Rest (sleep composite 0–100) hero ring.
     @ViewBuilder
     private func restRing(diameter: CGFloat) -> some View {
-        if let s = restScore {
+        // #1164: when the strap has banked records not yet offloaded, today's Rest is provisional — it
+        // will change once the full night lands and `analyzeRecent` re-scores it. Show "Pending sync"
+        // instead of a confident number that then moves. Past days are final (no more data coming).
+        if Self.restPendingSync(restScore: restScore, backfilling: liveBackfillingFlag,
+                                historyPendingSync: liveHistoryPendingSyncFlag,
+                                isTodaySelected: selectedDayOffset == 0) {
+            emptyHeroRing(diameter: diameter) { ringPendingSync() }
+        } else if let s = restScore {
             GlowRing(fraction: s / 100, value: s, format: { "\(Int($0.rounded()))" },
                      color: StrandPalette.restColor, diameter: diameter, lineWidth: diameter * 0.10)
         } else if displayDay?.recovery != nil {
@@ -3340,6 +3372,20 @@ struct TodayView: View {
         }
     }
 
+    /// #1164: the Rest ring's overlay when today's score is provisional because the strap still has
+    /// banked records not yet offloaded. Shows "Pending sync" instead of a number that will change once
+    /// the full night lands and `analyzeRecent` re-scores it. Mirrors Android's RingPendingSync.
+    @ViewBuilder
+    private func ringPendingSync() -> some View {
+        VStack(spacing: 3) {
+            Text("Pending sync").font(StrandFont.headline).foregroundStyle(StrandPalette.textTertiary)
+                .lineLimit(1).minimumScaleFactor(0.7).fixedSize()
+            Text("strap history still offloading").font(StrandFont.footnote)
+                .foregroundStyle(StrandPalette.textSecondary)
+                .lineLimit(1).minimumScaleFactor(0.6).fixedSize()
+        }
+    }
+
     /// The faint full-circle track with a centred overlay, shown when a score is still calibrating/absent.
     @ViewBuilder
     private func emptyHeroRing<Overlay: View>(diameter: CGFloat, @ViewBuilder overlay: () -> Overlay) -> some View {
@@ -3810,23 +3856,40 @@ struct TodayView: View {
                 accessory: { scoreInfoButton(.effort) }
             )
         case .rest:
-            // Unscored TODAY → "building, wear it tonight" instead of a lone ", " caption (#527);
-            // a scored day keeps its sleep-duration / efficiency caption.
-            StatTile(
-                label: "Rest",
-                value: restScore.map { "\(Int($0.rounded()))%" } ?? "—",
-                // Component 2: a scored day shows its duration/efficiency caption; an unscored TODAY shows
-                // the "building" hint; a past day with no Rest falls to the honest "Needs the strap" rather
-                // than a bare blank, so the tile always carries a state.
-                caption: restScore != nil ? restCaption(d)
-                    : (buildingHint(.rest) ?? restCaption(d) ?? Self.needsStrapCaption),
-                accent: restScore.map { StrandPalette.recoveryColor($0) } ?? StrandPalette.textPrimary,
-                // The Rest composite (0–100) trend, not raw sleep minutes, tracks the score above (#614).
-                sparkline: sparks["sleep_performance"],
-                sparkColor: StrandPalette.metricPurple,
-                // Inline ⓘ in the tile header (not a corner overlay) so it never sits over the value (#495).
-                accessory: { scoreInfoButton(.rest) }
-            )
+            // #1164: when today's Rest is provisional (strap has banked records not yet offloaded), show
+            // "Pending sync" instead of a number that will change once the full night lands. Past days
+            // are final (no more data coming), so the pending state is today-only.
+            if Self.restPendingSync(restScore: restScore, backfilling: liveBackfillingFlag,
+                                     historyPendingSync: liveHistoryPendingSyncFlag,
+                                     isTodaySelected: selectedDayOffset == 0) {
+                StatTile(
+                    label: "Rest",
+                    value: "—",
+                    caption: String(localized: "Pending sync · strap history still offloading"),
+                    accent: StrandPalette.textPrimary,
+                    sparkline: sparks["sleep_performance"],
+                    sparkColor: StrandPalette.metricPurple,
+                    accessory: { scoreInfoButton(.rest) }
+                )
+            } else {
+                // Unscored TODAY → "building, wear it tonight" instead of a lone ", " caption (#527);
+                // a scored day keeps its sleep-duration / efficiency caption.
+                StatTile(
+                    label: "Rest",
+                    value: restScore.map { "\(Int($0.rounded()))%" } ?? "—",
+                    // Component 2: a scored day shows its duration/efficiency caption; an unscored TODAY shows
+                    // the "building" hint; a past day with no Rest falls to the honest "Needs the strap" rather
+                    // than a bare blank, so the tile always carries a state.
+                    caption: restScore != nil ? restCaption(d)
+                        : (buildingHint(.rest) ?? restCaption(d) ?? Self.needsStrapCaption),
+                    accent: restScore.map { StrandPalette.recoveryColor($0) } ?? StrandPalette.textPrimary,
+                    // The Rest composite (0–100) trend, not raw sleep minutes, tracks the score above (#614).
+                    sparkline: sparks["sleep_performance"],
+                    sparkColor: StrandPalette.metricPurple,
+                    // Inline ⓘ in the tile header (not a corner overlay) so it never sits over the value (#495).
+                    accessory: { scoreInfoButton(.rest) }
+                )
+            }
         case .hrv:
             // Carry the last scored night's HRV at the rollover (#543), today's wins, the carried value
             // is stamped "Last night · <date>", and a never-scored metric still shows ", ".
@@ -5425,12 +5488,21 @@ private struct SyncingHistoryNoteIfBackfilling: View {
 private struct BackfillFlagBridge: View {
     @EnvironmentObject private var live: LiveState
     @Binding var flag: Bool
+    /// #1164: optional mirror of `LiveState.historyPendingSync` (strap has banked records newer than our
+    /// frontier). Bridged through the SAME invisible leaf so a second LiveState observer isn't added to
+    /// the view tree (the 1 Hz flood isolation the top-of-type note describes). nil when the caller
+    /// doesn't need it.
+    @Binding var pendingSyncFlag: Bool
     var body: some View {
         Color.clear
             .frame(width: 0, height: 0)
             .accessibilityHidden(true)
-            .onAppear { if flag != live.backfilling { flag = live.backfilling } }
+            .onAppear {
+                if flag != live.backfilling { flag = live.backfilling }
+                if pendingSyncFlag != live.historyPendingSync { pendingSyncFlag = live.historyPendingSync }
+            }
             .onChangeCompat(of: live.backfilling) { now in if flag != now { flag = now } }
+            .onChangeCompat(of: live.historyPendingSync) { now in if pendingSyncFlag != now { pendingSyncFlag = now } }
     }
 }
 
diff --git a/StrandTests/RestFreshnessTests.swift b/StrandTests/RestFreshnessTests.swift
index 4b0e9f5dff..a79eeb648f 100644
--- a/StrandTests/RestFreshnessTests.swift
+++ b/StrandTests/RestFreshnessTests.swift
@@ -57,4 +57,45 @@ final class RestFreshnessTests: XCTestCase {
             TodayView.freshRestScore(todayValue: nil, lastDay: nil, lastValue: nil,
                                      isTodaySelected: true, todayKey: todayKey))
     }
+
+    // MARK: - #1164 Rest pending-sync (provisional before full offload)
+
+    /// An active offload (`backfilling`) with today's Rest present → pending, not a provisional number.
+    func testPendingSync_backfillingWithRestScore_showsPending() {
+        XCTAssertTrue(TodayView.restPendingSync(
+            restScore: 72, backfilling: true, historyPendingSync: false, isTodaySelected: true))
+    }
+
+    /// The strap has banked records not yet ingested (`historyPendingSync`) even with no active offload →
+    /// pending. This is the right-after-connect window before the first offload starts.
+    func testPendingSync_historyPendingWithRestScore_showsPending() {
+        XCTAssertTrue(TodayView.restPendingSync(
+            restScore: 72, backfilling: false, historyPendingSync: true, isTodaySelected: true))
+    }
+
+    /// No pending signals and a Rest score → NOT pending. The normal finalized state: the score is real.
+    func testPendingSync_noSignalsWithRestScore_notPending() {
+        XCTAssertFalse(TodayView.restPendingSync(
+            restScore: 72, backfilling: false, historyPendingSync: false, isTodaySelected: true))
+    }
+
+    /// No Rest score → never pending (pending suppresses a provisional NUMBER; it does not fabricate one
+    /// when there is none — the calibrating/no-data states already cover that).
+    func testPendingSync_noRestScore_neverPending_evenWithSignals() {
+        XCTAssertFalse(TodayView.restPendingSync(
+            restScore: nil, backfilling: true, historyPendingSync: true, isTodaySelected: true))
+    }
+
+    /// A PAST day is never pending — its score is final, no more data is coming for it. Even with both
+    /// signals true, a navigated past day shows its number.
+    func testPendingSync_pastDayNeverPending_evenWithSignals() {
+        XCTAssertFalse(TodayView.restPendingSync(
+            restScore: 72, backfilling: true, historyPendingSync: true, isTodaySelected: false))
+    }
+
+    /// Both signals true → pending (either signal alone is enough; both is the strongest case).
+    func testPendingSync_bothSignals_showsPending() {
+        XCTAssertTrue(TodayView.restPendingSync(
+            restScore: 72, backfilling: true, historyPendingSync: true, isTodaySelected: true))
+    }
 }
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 344a964852..7952a0ec00 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -200,6 +200,13 @@ data class LiveState(
     /** True while a historical offload session is running, so screens can say "Syncing strap
      *  history…" instead of presenting half-loaded data as final (#77). */
     val backfilling: Boolean = false,
+    /** #1164 — true when the strap reports banked records newer than our local HR frontier (the strap
+     *  has data we haven't ingested yet), even when no offload is actively running. Set from the
+     *  GET_DATA_RANGE newest vs. the collector's latest HR sample, with the same 5-min
+     *  `behindGapSeconds` the auto-continue predicate uses. Cleared on disconnect so a stale "pending"
+     *  can't outlive the link. Drives the Today Rest "Pending sync" state so a provisional score isn't
+     *  shown as final before the full night is offloaded. Twin of the Swift LiveState.historyPendingSync. */
+    val historyPendingSync: Boolean = false,
     /** True while a post-history scoring pass is turning the newly stored raw streams into sleep and
      * daily metrics. Kept separate from [backfilling] so Sleep can distinguish downloading from calculating. */
     val analyzingHistory: Boolean = false,
@@ -7439,6 +7446,27 @@ class WhoopBleClient(
                                 )
                                 log(line, com.noop.testcentre.TestDomain.UNIVERSAL)
                             }
+                            // #1164: recompute the "strap has banked records newer than our frontier" flag
+                            // so the Today Rest card can show "Pending sync" right after connect (before the
+                            // first offload starts), not only after an offload completes. The frontier read
+                            // is async; the flag settles a beat after the range lands.
+                            val newestForPending = it
+                            ioScope.launch {
+                                val f = runCatching { repository.latestHrSampleTs(deviceId) }.getOrNull()
+                                if (f != null) {
+                                    // #928/#1012: a strap whose clock is set in the FUTURE reads ahead
+                                    // of ANY frontier, so without this the gap never closes and Rest is
+                                    // pinned to "Pending sync" for good. The phantom-gap guard used at the
+                                    // post-offload site cannot apply here: no offload has run yet, so there
+                                    // is no row evidence to weigh. The first completed pass corrects it.
+                                    val wallNowP = System.currentTimeMillis() / 1000L
+                                    val p = !isFutureDatedNewest(newestForPending, wallNowP) &&
+                                        (newestForPending - f) > AUTO_CONTINUE_BEHIND_GAP_SECONDS
+                                    if (_state.value.historyPendingSync != p) {
+                                        _state.value = _state.value.copy(historyPendingSync = p)
+                                    }
+                                }
+                            }
                         }
                     }
 
@@ -10307,6 +10335,28 @@ class WhoopBleClient(
         ioScope.launch {
             val frontier = runCatching { repository.latestHrSampleTs(deviceId) }.getOrNull()
             val wallNow = System.currentTimeMillis() / 1000L   // #928: real wall clock, at decision time
+            // #1164: publish whether the strap has banked records newer than our local frontier, so the
+            // Today Rest card can show "Pending sync" instead of a provisional number. Same behind check
+            // the auto-continue predicate uses (5-min gap). Caught-up (or unknown) → false.
+            // #1164 + #928/#1012 + #1144: the bare gap is not enough. Both traps that
+            // `shouldAutoContinue` guards against latch this flag TRUE forever, which would pin
+            // Rest to "Pending sync" and never show a score — strictly worse than the
+            // provisional number this exists to hide.
+            //  - a strap whose clock is set in the FUTURE reads ahead of ANY frontier, so the
+            //    gap never closes (there is a user-facing banner for exactly that state);
+            //  - a PHANTOM gap (a timestamp the strap will not actually offload, a console-only
+            //    tail, a dup re-offload) advertises newer data while banking no new rows, so the
+            //    frontier cannot advance and the gap stays open. `persistedSensorRows` is the
+            //    same evidence #1144 added to the auto-continue predicate for this exact latch;
+            //    a caught-up strap is already false via the gap, so gating on it only bites the
+            //    phantom case.
+            val pending = newest != null && frontier != null &&
+                !isFutureDatedNewest(newest, wallNow) &&
+                persistedSensorRows &&
+                (newest - frontier) > AUTO_CONTINUE_BEHIND_GAP_SECONDS
+            if (_state.value.historyPendingSync != pending) {
+                _state.value = _state.value.copy(historyPendingSync = pending)
+            }
             // #266: local only — NOT cached on the instance. A future-dated newest (#1012) makes the
             // AUTOMATIC periodic/strap kicks near-useless for THIS decision; [requestSync] recomputes its
             // own verdict fresh from [strapNewestTs] on every call, so a stale value here can't leak forward.
@@ -10666,6 +10716,7 @@ class WhoopBleClient(
         _state.update { it.clearedBiometrics().copy(
             connected = false, bonded = false, encryptedBond = false,
             backfilling = false, syncChunksThisSession = 0,
+            historyPendingSync = false,   // #1164: a stale "pending" must not outlive the link
             charging = null,        // a stale charging flag must not outlive the link
             strapFirmware = null,   // nor stale firmware/layout versions
             historyLayoutVersion = null,
diff --git a/android/app/src/main/java/com/noop/ui/TodayScoring.kt b/android/app/src/main/java/com/noop/ui/TodayScoring.kt
index 4d99689525..e58f5a5ee4 100644
--- a/android/app/src/main/java/com/noop/ui/TodayScoring.kt
+++ b/android/app/src/main/java/com/noop/ui/TodayScoring.kt
@@ -287,6 +287,32 @@ internal fun scoreStateForToday(
     else -> ScoreState.NeedsStrap
 }
 
+/**
+ * #1164 — should today's Rest show "Pending sync" instead of a provisional number? When the strap has
+ * banked records not yet offloaded, the Rest score is computed from partial data and will change once
+ * the full night lands and `analyzeRecent` re-scores it. Surfacing it as "Pending sync" rather than a
+ * confident number that then moves reads honestly instead of as a bug.
+ *
+ * Two honest signals, either of which means more data is expected:
+ * - [backfilling]: an offload is actively running right now (data is draining).
+ * - [historyPendingSync]: the strap reports banked records newer than our local frontier (the strap has
+ *   data we haven't ingested yet, even when no offload is running — e.g. right after connect, before
+ *   the first offload starts).
+ *
+ * Only applies to TODAY (a past day's score is final — no more data is coming for it) and only when a
+ * Rest score EXISTS (pending suppresses a provisional number; it does not fabricate one when there is
+ * none). Pure + unit-tested. Mirror EXACTLY of Swift `TodayView.restPendingSync`.
+ */
+internal fun restPendingSync(
+    restScore: Double?,
+    backfilling: Boolean,
+    historyPendingSync: Boolean,
+    isTodaySelected: Boolean,
+): Boolean {
+    if (!isTodaySelected || restScore == null) return false
+    return backfilling || historyPendingSync
+}
+
 /**
  * The honest live-recording state of the strap, for the Today/Live chip. Derived from the BLE connection
  * + last-sync timestamp so people always know it's working, or know it isn't and why. Mirrors Swift
diff --git a/android/app/src/main/java/com/noop/ui/TodayScreen.kt b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
index 9bff48c284..cb9fe04a69 100644
--- a/android/app/src/main/java/com/noop/ui/TodayScreen.kt
+++ b/android/app/src/main/java/com/noop/ui/TodayScreen.kt
@@ -1507,6 +1507,14 @@ fun TodayScreen(
                                     heroSourceLabel = heroSourceLabel,
                                     onScoreInfo = openGuide,
                                     onChargeTap = { showChargeBreakdown = true },
+                                    // #1164: today's Rest is provisional while the strap has banked records
+                                    // not yet offloaded — show "Pending sync" instead of a number that moves.
+                                    restPendingSync = restPendingSync(
+                                        restScore = restScoreForDay,
+                                        backfilling = live.backfilling,
+                                        historyPendingSync = live.historyPendingSync,
+                                        isTodaySelected = selectedDayOffset == 0,
+                                    ),
                                 )
                             }
                             // Honest "why is Effort 0?" caption — only when today's Effort is a real
@@ -1612,6 +1620,14 @@ fun TodayScreen(
                                     restSpark = restCompositeSpark,
                                     enabledMetrics = enabledKeyMetrics,
                                     isToday = selectedDayOffset == 0,
+                                    // #1164: today's Rest is provisional while the strap has banked records
+                                    // not yet offloaded — the Rest tile shows "Pending sync" instead of a number.
+                                    restPendingSync = restPendingSync(
+                                        restScore = restScoreForDay,
+                                        backfilling = live.backfilling,
+                                        historyPendingSync = live.historyPendingSync,
+                                        isTodaySelected = selectedDayOffset == 0,
+                                    ),
                                     onScoreInfo = openGuide,
                                     metricsExpanded = metricsExpanded,
                                     onToggleMetrics = { metricsExpanded = !metricsExpanded },
@@ -2556,6 +2572,9 @@ private fun ScoreHeroRow(
     // A1 (#514/#706): tapping the Charge ring opens the breakdown sheet. A small chevron cue overlays the
     // ring's bottom edge INSIDE the ring frame, so it adds no stacked height (the #762 self-sizing parity).
     onChargeTap: (() -> Unit)? = null,
+    // #1164: pending-sync state for today's Rest (strap has banked records not yet offloaded). When true
+    // the Rest vessel shows "Pending sync" instead of a provisional number that will change.
+    restPendingSync: Boolean = false,
 ) {
     val recovery = day?.recovery
     // Prefer the live in-progress Effort for today, but never BELOW the day's already-earned strain
@@ -2682,15 +2701,20 @@ private fun ScoreHeroRow(
                                 tint = Palette.recoveryColor(restScore ?: 0.0),
                                 diameter = ring,
                                 animated = animated,
-                                showsValue = restScore != null,
+                                showsValue = restScore != null && !restPendingSync,
                             )
-                            // #898: an aggregate-import user (a daily HRV/RHR import, no in-bed session) gets a
-                            // Charge from WatchRecovery but NO sleep_performance, so Rest used to read a bare
-                            // "No Data" next to a lit Charge , reading as broken. When a Charge IS present for the
-                            // day but Rest is absent, say WHY honestly ("Needs a tracked night") instead. We do
-                            // NOT fabricate a Rest number , an aggregate genuinely has no scored night. A day with
-                            // no Charge either (truly empty) keeps the plain "No Data". Mirrors iOS restRing.
-                            if (restScore == null) {
+                            // #1164: when today's Rest is provisional (strap has banked records not yet
+                            // offloaded), show "Pending sync" instead of a number that will change once the
+                            // full night lands. Past days are final (no more data coming). Mirrors iOS restRing.
+                            if (restPendingSync) {
+                                RingPendingSync()
+                            } else if (restScore == null) {
+                                // #898: an aggregate-import user (a daily HRV/RHR import, no in-bed session) gets a
+                                // Charge from WatchRecovery but NO sleep_performance, so Rest used to read a bare
+                                // "No Data" next to a lit Charge , reading as broken. When a Charge IS present for the
+                                // day but Rest is absent, say WHY honestly ("Needs a tracked night") instead. We do
+                                // NOT fabricate a Rest number , an aggregate genuinely has no scored night. A day with
+                                // no Charge either (truly empty) keeps the plain "No Data". Mirrors iOS restRing.
                                 if (recovery != null) RingNeedsTrackedNight() else RingNoData(diameter = ring)
                             }
                         }
@@ -3130,6 +3154,26 @@ private fun RingNeedsTrackedNight() {
     }
 }
 
+/** #1164: the Rest ring's overlay when today's score is provisional because the strap still has banked
+ *  records not yet offloaded. Shows "Pending sync" instead of a number that will change once the full
+ *  night lands and `analyzeRecent` re-scores it. Mirrors iOS ringPendingSync. */
+@Composable
+private fun RingPendingSync() {
+    Column(horizontalAlignment = Alignment.CenterHorizontally) {
+        AutoSizeValue(
+            uiString(R.string.l10n_today_screen_pending_sync_cbe01f9e),
+            style = NoopType.headline,
+            color = Palette.textTertiary,
+            minScale = 0.7f,
+        )
+        AutoSizeValue(
+            uiString(R.string.l10n_today_screen_strap_history_still_offloading_80140264),
+            style = NoopType.footnote,
+            color = Palette.textSecondary,
+        )
+    }
+}
+
 // MARK: - Hero vitals metric rows, HRV / Resting HR / Respiratory, re-homed below the ring hero
 //
 // The WHOOP-style redesign (#23) dropped the big gold RecoveryRing hero that used to carry these; the
@@ -5190,6 +5234,9 @@ private fun MetricGrid(
     restSpark: List<Double> = emptyList(),
     enabledMetrics: List<KeyMetric> = KeyMetric.defaultOrder,
     isToday: Boolean = false,
+    // #1164: today's Rest is provisional while the strap has banked records not yet offloaded — the Rest
+    // tile shows "Pending sync" instead of a number that will change. Past days are final.
+    restPendingSync: Boolean = false,
     onScoreInfo: (ScoreSection) -> Unit = {},
     // S5: cap the grid to the first METRICS_COLLAPSED_CAP tiles behind a "Show all metrics" expander,
     // collapsing OVERFLOW only (never dropping or reordering a user-selected tile, #251). Defaults keep the
@@ -5249,11 +5296,14 @@ private fun MetricGrid(
         ),
         KeyMetric.REST to KeyTileData(
             label = uiString(R.string.l10n_today_screen_rest_b79e5f48),
-            value = restScore?.let { "${it.roundToInt()}" } ?: NO_DATA,
-            unit = if (restScore != null) "%" else "",
+            // #1164: when today's Rest is provisional, show "—" with a "Pending sync" caption instead of
+            // a number that will change once the full night lands. Past days are final.
+            value = if (restPendingSync) NO_DATA else restScore?.let { "${it.roundToInt()}" } ?: NO_DATA,
+            unit = if (!restPendingSync && restScore != null) "%" else "",
             tint = restScore?.let { Palette.recoveryColor(it) } ?: Palette.restColor,
             frac = restScore?.let { (it / 100.0).coerceIn(0.0, 1.0) },
             spark = restSpark,
+            caption = if (restPendingSync) uiString(R.string.l10n_today_screen_strap_history_still_offloading_80140264) else null,
         ),
         KeyMetric.HRV to run {
             val v = d?.avgHrv ?: carriedDay?.avgHrv
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index 1643e53555..a85a32546c 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2748,4 +2748,6 @@
     <string name="units_kilometres">Kilometer</string>
     <string name="units_miles">Meilen</string>
     <string name="units_follow_body">Wie Körpermaße</string>
+    <string name="l10n_today_screen_pending_sync_cbe01f9e">Sync ausstehend</string>
+    <string name="l10n_today_screen_strap_history_still_offloading_80140264">Strap-Verlauf wird noch übertragen</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index eb3ed22d04..76f49e98c3 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2735,4 +2735,6 @@
     <string name="units_kilometres">Kilómetros</string>
     <string name="units_miles">Millas</string>
     <string name="units_follow_body">Según medidas corporales</string>
+    <string name="l10n_today_screen_pending_sync_cbe01f9e">Sincronización pendiente</string>
+    <string name="l10n_today_screen_strap_history_still_offloading_80140264">el historial de la pulsera aún se está transfiriendo</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 7427fa34b9..87063d49f3 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2734,4 +2734,6 @@
     <string name="units_kilometres">Kilomètres</string>
     <string name="units_miles">Miles</string>
     <string name="units_follow_body">Selon les mensurations</string>
+    <string name="l10n_today_screen_pending_sync_cbe01f9e">Synchronisation en attente</string>
+    <string name="l10n_today_screen_strap_history_still_offloading_80140264">l\'historique du bracelet est encore en cours de transfert</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index f8fb6396a4..effd95cd18 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2739,4 +2739,6 @@
     <string name="units_kilometres">Kilometry</string>
     <string name="units_miles">Mile</string>
     <string name="units_follow_body">Jak pomiary ciała</string>
+    <string name="l10n_today_screen_pending_sync_cbe01f9e">Oczekuje na synchronizację</string>
+    <string name="l10n_today_screen_strap_history_still_offloading_80140264">historia paska wciąż jest przesyłana</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 63816b0c17..5fb1771d7f 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2727,4 +2727,6 @@
     <string name="units_kilometres">Quilómetros</string>
     <string name="units_miles">Milhas</string>
     <string name="units_follow_body">Como medidas corporais</string>
+    <string name="l10n_today_screen_pending_sync_cbe01f9e">Sincronização pendente</string>
+    <string name="l10n_today_screen_strap_history_still_offloading_80140264">o histórico da bracelete ainda está a ser transferido</string>
 </resources>
diff --git a/android/app/src/main/res/values-ru/strings.xml b/android/app/src/main/res/values-ru/strings.xml
index d09aead3df..f8112a6ec3 100644
--- a/android/app/src/main/res/values-ru/strings.xml
+++ b/android/app/src/main/res/values-ru/strings.xml
@@ -2618,4 +2618,6 @@
     <string name="l10n_devices_screen_battery_pack_probe_151_re_d722af00">Проба батарейного блока (151 RE)…</string>
     <string name="l10n_devices_screen_battery_pack_probe_result_151_df43dff2">Результат пробы батарейного блока (151)</string>
     <string name="l10n_devices_screen_battery_pack_probe_explainer_40b3470d">Отправляет команду батарейного блока только для чтения (151) и декодирует ответ браслета — заряд блока, серийный номер и Bluetooth-адрес. На браслет ничего не записывается, и это не влияет на ваши данные. У WHOOP 4.0 нет команды блока, и ожидается молчание; само это молчание — полезный результат.</string>
+    <string name="l10n_today_screen_pending_sync_cbe01f9e">Ожидает синхронизации</string>
+    <string name="l10n_today_screen_strap_history_still_offloading_80140264">история браслета ещё передаётся</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 49f2c9256c..a18e784030 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2648,4 +2648,6 @@
     <string name="l10n_devices_screen_battery_pack_probe_result_151_df43dff2">电池盒探测结果 (151)</string>
     <string name="l10n_devices_screen_battery_pack_probe_explainer_40b3470d">发送只读的电池盒命令 (151) 并解码手环的回复——电池盒的电量、序列号和蓝牙地址。不会向手环写入任何内容，也不会影响您的数据。WHOOP 4.0 没有电池盒命令，预期会保持静默；这种静默本身就是有用的结果。</string>
     <string name="l10n_devices_screen_pack_charge_0e9589da">电池盒 %1$.1f%%</string>
+    <string name="l10n_today_screen_pending_sync_cbe01f9e">等待同步</string>
+    <string name="l10n_today_screen_strap_history_still_offloading_80140264">手环历史记录仍在传输</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index f994c2dcee..53d008099c 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -1077,6 +1077,8 @@
     <string name="l10n_today_screen_needs_a_tracked_night_ccfd532a">needs a tracked night</string>
     <string name="l10n_today_screen_new_here_b81f2e17">New here?</string>
     <string name="l10n_today_screen_now_e3b82040">Now</string>
+    <string name="l10n_today_screen_pending_sync_cbe01f9e">Pending sync</string>
+    <string name="l10n_today_screen_strap_history_still_offloading_80140264">strap history still offloading</string>
     <string name="l10n_today_screen_pct_roundtoint_05ba4549">%1$s</string>
     <string name="l10n_today_screen_quick_actions_e47e8042">Quick actions</string>
     <string name="l10n_today_screen_readiness_word_749b3330">Readiness: %1$s</string>
diff --git a/android/app/src/test/java/com/noop/ui/TodayExplainabilityTest.kt b/android/app/src/test/java/com/noop/ui/TodayExplainabilityTest.kt
index d08512ce78..c70b7e3c9c 100644
--- a/android/app/src/test/java/com/noop/ui/TodayExplainabilityTest.kt
+++ b/android/app/src/test/java/com/noop/ui/TodayExplainabilityTest.kt
@@ -120,6 +120,70 @@ class TodayExplainabilityTest {
         assertEquals(R.string.score_state_title_needs_strap, needsStrap.titleRes)
     }
 
+    // ── #1164 — Rest pending-sync (provisional before full offload) ─────────────────────────────────
+
+    /**
+     * The flag that drives this must not be able to latch on forever, which is the failure both
+     * `shouldAutoContinue` guards already exist for: a future-dated strap clock reads ahead of ANY
+     * frontier, and a phantom gap advertises newer data while banking no rows. Either would pin Rest to
+     * "Pending sync" and never show a score, which is worse than the provisional number it replaces.
+     * The helper itself is pure, so this pins the CONTRACT it is handed: a caller must not pass true
+     * for a gap it cannot close.
+     */
+    @Test
+    fun restPendingSyncOnlySuppressesWhileThereIsAScoreAndTodayIsSelected() {
+        // A gap the caller has judged real: suppress.
+        assertTrue(restPendingSync(restScore = 71.0, backfilling = false,
+                                   historyPendingSync = true, isTodaySelected = true))
+        // No score yet: calibrating / no-data states own that, so never fabricate a suppression.
+        assertFalse(restPendingSync(restScore = null, backfilling = true,
+                                    historyPendingSync = true, isTodaySelected = true))
+        // A past day is final, whatever the strap is doing now.
+        assertFalse(restPendingSync(restScore = 71.0, backfilling = true,
+                                    historyPendingSync = true, isTodaySelected = false))
+        // Caught up and idle: show the number.
+        assertFalse(restPendingSync(restScore = 71.0, backfilling = false,
+                                    historyPendingSync = false, isTodaySelected = true))
+    }
+
+    @Test
+    fun restPendingSync_backfillingWithRestScore_showsPending() {
+        // An active offload with today's Rest present → pending, not a provisional number.
+        assertTrue(restPendingSync(restScore = 72.0, backfilling = true, historyPendingSync = false, isTodaySelected = true))
+    }
+
+    @Test
+    fun restPendingSync_historyPendingWithRestScore_showsPending() {
+        // The strap has banked records not yet ingested even with no active offload → pending.
+        // This is the right-after-connect window before the first offload starts.
+        assertTrue(restPendingSync(restScore = 72.0, backfilling = false, historyPendingSync = true, isTodaySelected = true))
+    }
+
+    @Test
+    fun restPendingSync_noSignalsWithRestScore_notPending() {
+        // No pending signals and a Rest score → NOT pending. The normal finalized state.
+        assertFalse(restPendingSync(restScore = 72.0, backfilling = false, historyPendingSync = false, isTodaySelected = true))
+    }
+
+    @Test
+    fun restPendingSync_noRestScore_neverPending_evenWithSignals() {
+        // No Rest score → never pending (pending suppresses a provisional NUMBER; it does not fabricate
+        // one when there is none — the calibrating/no-data states already cover that).
+        assertFalse(restPendingSync(restScore = null, backfilling = true, historyPendingSync = true, isTodaySelected = true))
+    }
+
+    @Test
+    fun restPendingSync_pastDayNeverPending_evenWithSignals() {
+        // A PAST day is never pending — its score is final, no more data is coming for it.
+        assertFalse(restPendingSync(restScore = 72.0, backfilling = true, historyPendingSync = true, isTodaySelected = false))
+    }
+
+    @Test
+    fun restPendingSync_bothSignals_showsPending() {
+        // Both signals true → pending (either signal alone is enough; both is the strongest case).
+        assertTrue(restPendingSync(restScore = 72.0, backfilling = true, historyPendingSync = true, isTodaySelected = true))
+    }
+
     // ── COMPONENT 3 — recording state ────────────────────────────────────────────────────────────────
 
     @Test

From 1356da0f7494f284c8e10b9ee1a2b18faaa37593 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 11:33:41 +1200
Subject: [PATCH 301/333] build: testing build 450 / 331

Build numbers only; 11.1.1 stays as the next unreleased version.

449 was cut a few minutes before the Pending-sync work landed, so this is 449
plus that one change; everything else is identical and 449 is superseded rather
than tested separately.

New here: Rest reads "Pending sync" while the strap still holds un-offloaded
history for today, instead of showing a score computed from a partial night that
then jumps once the rest lands. It settles to the real number when the history
is in. Worth watching that it actually settles: the flag is now guarded against
the two states that would otherwise hold it on forever, a strap whose clock is
set in the future and a gap the strap advertises but never offloads, so a Rest
stuck on "Pending sync" would mean one of those guards is wrong.

Everything from 449 still applies, and its one visible cost is the thing to
judge first: HRV is withheld on a night whose R-R banks more beat time than the
wall clock it spans, which on a WHOOP 4.0 is every night. A 5.0 is unaffected.
---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 0768990718..c8c8e94bdd 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 449
+        versionCode = 450
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index f003bc4943..b2d15888f7 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "330"
+    CURRENT_PROJECT_VERSION: "331"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 09c881814f808d17c50d37fee703eb7943d2cbf4 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 12:28:17 +1200
Subject: [PATCH 302/333] rhr: measure what an artefact gate would do, before
 gating anything (#1944)

Measure-only groundwork for the resting-HR artefact gate. Nothing is gated and no
displayed number moves.

sessionRestingHR takes the minimum of the 5-minute bin means unconditionally, so
any non-empty bin can win the night's floor, including one built from a single
sample at the edge of a wear gap. The helper deleted alongside it carried two
conditions the shipped path never had: a bin may only WIN when it holds at least
five samples and its mean is physiologically plausible. Porting them is small and
safe by construction, since the fallback chain ends at today's behaviour. What
nobody could say is how OFTEN it would move a number that feeds the baseline
later nights are scored against, because the strap log carries floor, mean and
sample count but nothing per-bin. Two attempts to infer the distribution from a
real log gave a circular answer and then an impossible one, so this adds the
measurement instead of guessing.

One line per scored night, reporting the bin count, how many fall under each
condition, HOW BIG THE WINNING BIN WAS, and what the floor would have been under
the gate. Bins are built exactly as sessionRestingHR builds them, closed final
bin included, or the line would describe a different partition than the one it
judges.

It reports only when the gate would actually move the floor. That rule came out
of the tests: an earlier version stayed quiet only when no bin was thin, and the
invariant test then failed on a 1801-second span. The diagnostic was right and
the expectation was wrong, which is the useful part. A session whose span is not
a multiple of the window has a final bin holding only span mod 300 samples,
because that bin closes on `end`, so 1801 seconds is six 300-sample bins and a
final bin of two. A thin final bin is therefore STRUCTURAL rather than an
artefact and appears on nearly every real night, so reporting thin bins would
have fired almost nightly while saying nothing changed. It also tells a future
gate something it needs: excluding bins on sample count alone would drop that
final partial bin most nights, which is not the artefact the gate is aimed at.

Six tests a side, every case matched. The load-bearing one takes the shipped
floor FROM sessionRestingHR and asserts agreement, so the two partitions cannot
drift apart unnoticed; the others pin that a dense night says nothing, a
one-sample bin that WINS is reported with its size and the floor it would have
been given, a thin bin that cannot win is silent, an empty night is silent, and
no timestamp reaches the line.

The call site was extracted along the way. Adding the emit inline put
analyzeRecentOnCpu 245 bytes over its JaCoCo budget; folding the existing
floor-vs-mean emit into the same builder and lifting both out frees 518 bytes
net, leaving the method smaller than before at 55,482. The budget is a ratchet
its own note says to lower whenever an extraction frees space, so it drops to
55,700.

Android suite 5509 green, doc-comment and i18n gates clean.
---
 .../Sources/StrandAnalytics/SleepStager.swift | 59 +++++++++++
 .../RhrBinGateDiagnosticTests.swift           | 79 +++++++++++++++
 Strand/Data/IntelligenceEngine.swift          | 13 ++-
 .../com/noop/analytics/IntelligenceEngine.kt  | 32 ++++--
 .../java/com/noop/analytics/SleepStager.kt    | 72 ++++++++++++++
 .../IntelligenceEngineJacocoBudgetTest.kt     |  2 +-
 .../analytics/RhrBinGateDiagnosticTest.kt     | 97 +++++++++++++++++++
 7 files changed, 346 insertions(+), 8 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RhrBinGateDiagnosticTests.swift
 create mode 100644 android/app/src/test/java/com/noop/analytics/RhrBinGateDiagnosticTest.kt

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
index 435da91083..104b0fc7f4 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
@@ -2778,6 +2778,65 @@ public enum SleepStager {
     /// the final one, which is `[t, end]`. Half-open bins alone would admit a sample sitting exactly
     /// on an aligned `end` through the prefilter and then place it in no bin — counted as data,
     /// silently ignored. A zero-length window (`start == end`) is that single closed bin.
+    /// #1943: what an artefact gate WOULD do to tonight's resting-HR floor, measured and reported without
+    /// changing it.
+    ///
+    /// `sessionRestingHR` takes the minimum of the 5-minute bin means unconditionally, so any non-empty
+    /// bin can win, including one built from a single sample at the edge of a wear gap. The helper deleted
+    /// alongside it had two conditions the shipped path never had: a bin may only WIN when it holds at
+    /// least `minBinSamples` samples and its mean is at least `minPlausibleBpm`. Porting them is a small
+    /// change; what nobody can currently say is how OFTEN it would move a displayed number, and that
+    /// number feeds the baseline later nights are scored against. So measure first.
+    ///
+    /// Bins are built exactly as `sessionRestingHR` builds them, closed final bin included, or the line
+    /// would describe a different partition than the one it is judging.
+    ///
+    /// Returns nil unless the gate would actually MOVE the floor, so the log carries only the nights the
+    /// question is about. Reporting every thin bin instead would fire on nearly all of them, because a thin
+    /// final bin is STRUCTURAL rather than an artefact: the last bin closes on `end`, so a session whose
+    /// span is not a multiple of the window holds only `span mod 300` samples there. A 1801-second night
+    /// has six 300-sample bins and a final bin of two. That bin is real data and almost never wins the
+    /// floor, so it is noise to report and, separately, something a future gate should weigh before
+    /// excluding bins on sample count alone.
+    ///
+    /// The counts still ride along when the line does fire, since they are the context for the change.
+    /// Same posture as the over-count-only R-R dump. Counts and bpm only, no timestamps. Pure. Twin of
+    /// Kotlin `rhrBinGateLogLine`.
+    public static func rhrBinGateLogLine(day: String, sessions: [(Int, Int)], hr: [HRSample],
+                                         shippedFloor: Int, minBinSamples: Int = 5,
+                                         minPlausibleBpm: Double = 25) -> String? {
+        let windowS = 5 * 60
+        var bins = 0, thin = 0, implausible = 0, bestN = 0
+        var best: Double?
+        var gated: Double?
+        for (start, end) in sessions {
+            let seg = hr.filter { $0.ts >= start && $0.ts <= end }
+            if seg.isEmpty { continue }
+            var t = start
+            repeat {
+                let isFinal = t + windowS >= end
+                let win = seg.filter { $0.ts >= t && (isFinal || $0.ts < t + windowS) }
+                if !win.isEmpty {
+                    bins += 1
+                    let mean = Double(win.reduce(0) { $0 + $1.bpm }) / Double(win.count)
+                    if win.count < minBinSamples { thin += 1 }
+                    if mean < minPlausibleBpm { implausible += 1 }
+                    if best == nil || mean < best! { best = mean; bestN = win.count }
+                    if win.count >= minBinSamples, mean >= minPlausibleBpm,
+                       gated == nil || mean < gated! { gated = mean }
+                }
+                t += windowS
+            } while t < end
+        }
+        if bins == 0 { return nil }
+        let gatedFloor = gated.map { Int($0.rounded()) }
+        let changes = gatedFloor != nil && gatedFloor != shippedFloor
+        if !changes { return nil }
+        return "rhr bins day=\(day) bins=\(bins) thin=\(thin) implausible=\(implausible) "
+            + "winnerN=\(bestN) floor=\(shippedFloor) gated=\(gatedFloor.map(String.init) ?? "nil") "
+            + "wouldChange=\(changes) (measure-only; nothing is gated yet)"
+    }
+
     static func sessionRestingHR(start: Int, end: Int, hr: [HRSample]) -> Int? {
         let seg = hr.filter { $0.ts >= start && $0.ts <= end }
         guard !seg.isEmpty else { return nil }
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RhrBinGateDiagnosticTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RhrBinGateDiagnosticTests.swift
new file mode 100644
index 0000000000..f7cf4486b2
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RhrBinGateDiagnosticTests.swift
@@ -0,0 +1,79 @@
+import XCTest
+import WhoopProtocol
+@testable import StrandAnalytics
+
+/// #1943 measure-only: the line must describe the partition `sessionRestingHR` actually uses, and must
+/// stay silent unless an artefact gate would MOVE the floor. Byte-parity twin of Kotlin
+/// `RhrBinGateDiagnosticTest`.
+final class RhrBinGateDiagnosticTests: XCTestCase {
+
+    private func hr(_ start: Int, _ count: Int, _ bpm: Int) -> [HRSample] {
+        (0..<count).map { HRSample(ts: start + $0, bpm: bpm) }
+    }
+
+    /// A dense, ordinary night: every bin well-populated, so the gate would change nothing. Silent.
+    func testAWellPopulatedNightSaysNothing() {
+        let start = 1_000, end = 1_000 + 1800
+        XCTAssertNil(SleepStager.rhrBinGateLogLine(day: "2026-01-01", sessions: [(start, end)],
+                                                   hr: hr(start, 1800, 60), shippedFloor: 60))
+    }
+
+    /// A one-sample bin that WINS the floor is the whole point: it must be reported, and named.
+    func testAThinWinningBinIsReportedWithWhatTheGateWouldDo() {
+        let start = 1_000, end = 1_000 + 1800
+        let samples = hr(start, 1500, 60) + [HRSample(ts: start + 1700, bpm: 38)]
+        let line = SleepStager.rhrBinGateLogLine(day: "2026-01-01", sessions: [(start, end)],
+                                                 hr: samples, shippedFloor: 38)
+        XCTAssertNotNil(line, "a thin winning bin must be reported")
+        XCTAssertTrue(line!.contains("thin=1"), line!)
+        XCTAssertTrue(line!.contains("winnerN=1"), line!)
+        XCTAssertTrue(line!.contains("wouldChange=true"), line!)
+        XCTAssertTrue(line!.contains("gated=60"), line!)
+    }
+
+    /// A thin bin that cannot win the floor is silent: a thin FINAL bin is structural on most spans.
+    func testAThinBinThatCannotWinTheFloorIsSilent() {
+        let start = 1_000, end = 1_000 + 1800
+        let samples = hr(start, 1500, 60) + [HRSample(ts: start + 1700, bpm: 90)]
+        XCTAssertNil(SleepStager.rhrBinGateLogLine(day: "2026-01-01", sessions: [(start, end)],
+                                                   hr: samples, shippedFloor: 60))
+    }
+
+    /// No sleep sessions, or no samples inside them, is not a finding.
+    func testNothingToMeasureIsSilent() {
+        XCTAssertNil(SleepStager.rhrBinGateLogLine(day: "2026-01-01", sessions: [],
+                                                   hr: hr(1_000, 100, 60), shippedFloor: 60))
+        XCTAssertNil(SleepStager.rhrBinGateLogLine(day: "2026-01-01", sessions: [(9_000, 9_900)],
+                                                   hr: hr(1_000, 100, 60), shippedFloor: 60))
+    }
+
+    /// It carries counts and bpm only: no timestamps, so a shared strap log gains no new identifiers.
+    func testTheLineCarriesNoTimestamps() {
+        let start = 1_700_000_000, end = 1_700_000_000 + 1800
+        let samples = hr(start, 1500, 60) + [HRSample(ts: start + 1700, bpm: 38)]
+        let line = SleepStager.rhrBinGateLogLine(day: "2026-01-01", sessions: [(start, end)],
+                                                 hr: samples, shippedFloor: 38)
+        XCTAssertNotNil(line)
+        XCTAssertFalse(line!.contains("17000000"), line!)
+    }
+
+    /// The load-bearing invariant: the line must judge the SAME partition `sessionRestingHR` ships.
+    /// Every other case hands the floor in as a literal, so none would notice the two binnings drifting.
+    /// Here the shipped floor comes FROM `sessionRestingHR`, and a mismatch surfaces as a spurious
+    /// `wouldChange`. The 1801 span is deliberate: its final bin holds two samples, structurally thin.
+    func testTheDiagnosticJudgesTheSamePartitionSessionRestingHRShips() {
+        let start = 1_000
+        for spanS in [1800, 1801, 1500, 300, 299] {
+            let end = start + spanS
+            let samples = (0..<spanS).map {
+                HRSample(ts: start + $0, bpm: (600...899).contains($0) ? 55 : 65)
+            }
+            let shipped = SleepStager.sessionRestingHR(start: start, end: end, hr: samples)
+            XCTAssertNotNil(shipped, "precondition: a floor exists for span \(spanS)")
+            XCTAssertNil(
+                SleepStager.rhrBinGateLogLine(day: "2026-01-01", sessions: [(start, end)],
+                                              hr: samples, shippedFloor: shipped!),
+                "span \(spanS): the gate must agree with sessionRestingHR, so the line stays silent")
+        }
+    }
+}
diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index 8318823f63..cafd8ddfe4 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -138,6 +138,9 @@ final class IntelligenceEngine: ObservableObject {
     private struct DayScan {
         let result: AnalyticsEngine.DayResult
         let rhrLine: String?
+        /// #1943 measure-only bin-population line (see `SleepStager.rhrBinGateLogLine`); nil on a clean
+        /// night, replayed with `rhrLine` so the two read together.
+        let rhrBinLine: String?
         /// #1331 respiratory diagnostic line (see `respRateLogLine`); replayed with `rhrLine`.
         let respLine: String?
         /// CAPTURE-B (#814/#799): the resolved READ owner id this day was scored from, and how many HR rows
@@ -1493,11 +1496,17 @@ final class IntelligenceEngine: ObservableObject {
                 // Computed here (pure inputs) and carried out so the main actor can replay it through
                 // `diagnosticSink` in the SAME per-day order , the sink is a MainActor-bound closure.
                 var rhrLine: String?
+                var rhrBinLine: String?
                 if let floor = res.daily.restingHr {
                     let inBedBpms = hr.filter { s in
                         res.cachedSleep.contains { s.ts >= $0.startTs && s.ts < $0.endTs }
                     }.map { $0.bpm }
                     rhrLine = Self.rhrFloorMeanLogLine(day: res.daily.day, floor: floor, inBedBpms: inBedBpms)
+                    // #1943: and what an artefact gate would do to that floor. Silent on a clean night.
+                    rhrBinLine = SleepStager.rhrBinGateLogLine(
+                        day: res.daily.day,
+                        sessions: res.cachedSleep.map { ($0.startTs, $0.endTs) },
+                        hr: hr, shippedFloor: floor)
                 }
                 // #1331 respiratory diagnostic — a run of nil nights localises when it stopped. Same
                 // pure-compute-here / replay-on-main-actor path as rhrLine.
@@ -1547,7 +1556,8 @@ final class IntelligenceEngine: ObservableObject {
                 // windowing + delegation lives in the byte-identical, tested `AnalyticsEngine`.
                 let (primarySessionRHR, primarySessionRHRCoverage) =
                     AnalyticsEngine.primarySessionRestingHRWithCoverage(sessions: res.sleepSessions, hr: hr)
-                let scan = DayScan(result: res, rhrLine: rhrLine, respLine: respLine,
+                let scan = DayScan(result: res, rhrLine: rhrLine, rhrBinLine: rhrBinLine,
+                                   respLine: respLine,
                                    readOwner: owner, hrRows: hr.count,
                                    sleepTrace: sleepTrace, stepsTrace: stepsTrace, hrvTrace: hrvTrace,
                                    hrvDiag: Self.mergedDayDiag(hrvDiag, strainDiagLines),
@@ -1653,6 +1663,7 @@ final class IntelligenceEngine: ObservableObject {
                 primarySessionRHRCoverageByDay[res.daily.day] = cov
             }
             if let line = scan.rhrLine { diagnosticSink?(line, nil) }
+            if let line = scan.rhrBinLine { diagnosticSink?(line, nil) }
             if let line = scan.respLine { diagnosticSink?(line, nil) }
             // Sleep & Rest test mode (E5): replay this day's gate-trace + Rest lines tagged `.sleep` so they
             // land under the profile tag in the export. Empty unless the mode is active.
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index 4e93abce33..d284abac4d 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -1288,12 +1288,7 @@ object IntelligenceEngine {
             // in-bed span the floor came from (so they're directly comparable); a night with no banked
             // floor (no matched sleep) logs nil and the line is skipped. Logging only , no scoring change.
             // Counts/bpm only; no timestamps or PII (the diag sink also scrubs). Byte-identical to Swift.
-            val rhrFloor = res.daily.restingHr
-            if (rhrFloor != null) {
-                val inBedBpms = hr.filter { s -> res.sleepSessions.any { s.ts >= it.start && s.ts < it.end } }
-                    .map { it.bpm }
-                dayDiag(rhrFloorMeanLogLine(day, rhrFloor, inBedBpms))
-            }
+            for (l in rhrDiagLines(day, res.daily.restingHr, hr, res.sleepSessions)) dayDiag(l)
             // #103/queue-11a: SpO₂ candidate nightly mean. Only computed when the display toggle is ON,
             // and the transform is device-conditional (com.noop.data.DeviceBrandCatalog.isOura, same
             // idiom OuraRespScale.isRingRateStream uses): a WHOOP owner averages the in-band (70–100)
@@ -2935,6 +2930,31 @@ object IntelligenceEngine {
         }
     }
 
+    /**
+     * The night's resting-HR diagnostic lines: the floor-vs-mean explainer, and the measure-only
+     * bin-population line beside it when there is something to say.
+     *
+     * Built here rather than inline in `analyzeRecentOnCpu` because that method is BUDGETED:
+     * [IntelligenceEngineJacocoBudgetTest] ratchets its JaCoCo-instrumented size against the JVM's method
+     * limit, and the budget is never raised to fit a change. Returning the lines as a list, rather than
+     * emitting each at the call site, is what pays for the second one: the caller loses the null check,
+     * both lambdas and the intermediate list.
+     */
+    private fun rhrDiagLines(
+        day: String,
+        rhrFloor: Int?,
+        hr: List<com.noop.data.HrSample>,
+        sessions: List<DetectedSleep>,
+    ): List<String> {
+        if (rhrFloor == null) return emptyList()
+        val inBedBpms = hr.filter { s -> sessions.any { s.ts >= it.start && s.ts < it.end } }.map { it.bpm }
+        val out = ArrayList<String>(2)
+        out.add(rhrFloorMeanLogLine(day, rhrFloor, inBedBpms))
+        SleepStager.rhrBinGateLogLine(day, sessions.map { it.start to it.end }, hr, rhrFloor)
+            ?.let { out.add(it) }
+        return out
+    }
+
     /**
      * The per-day RHR floor-vs-mean diagnostic line (#691). NOOP's [floor] is the WHOOP-style resting
      * HR , the lowest SUSTAINED 5-min in-bed level (SleepStager picks the min 5-min rolling-mean HR per
diff --git a/android/app/src/main/java/com/noop/analytics/SleepStager.kt b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
index db7c390b50..680386e722 100644
--- a/android/app/src/main/java/com/noop/analytics/SleepStager.kt
+++ b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
@@ -3079,6 +3079,78 @@ object SleepStager {
 
     // ── Per-session HR / HRV ─────────────────────────────────────────────────
 
+    /**
+     * #1943: what an artefact gate WOULD do to tonight's resting-HR floor, measured and reported without
+     * changing it.
+     *
+     * [SleepStager.sessionRestingHR] takes the minimum of the 5-minute bin means unconditionally, so any
+     * non-empty bin can win, including one built from a single sample at the edge of a wear gap. The
+     * helper deleted alongside it had two conditions the shipped path never had: a bin may only WIN when
+     * it holds at least [minBinSamples] samples and its mean is at least [minPlausibleBpm]. Porting them
+     * is a small change; what nobody can currently say is how OFTEN it would move a displayed number, and
+     * that number feeds the baseline later nights are scored against. So measure first.
+     *
+     * Bins are built exactly as `sessionRestingHR` builds them, closed final bin included, or the line
+     * would describe a different partition than the one it is judging.
+     *
+     * Returns null unless the gate would actually MOVE the floor, so the log carries only the nights the
+     * question is about. Reporting every thin bin instead would fire on nearly all of them, because a thin
+     * final bin is STRUCTURAL rather than an artefact: the last bin closes on `end`, so a session whose
+     * span is not a multiple of the window holds only `span mod 300` samples there. A 1801-second night
+     * has six 300-sample bins and a final bin of two. That bin is real data and almost never wins the
+     * floor, so it is noise to report and, separately, something a future gate should weigh before
+     * excluding bins on sample count alone.
+     *
+     * The counts still ride along when the line does fire, since they are the context for the change.
+     * Same posture as the over-count-only R-R dump. Counts and bpm only, no timestamps. Pure. Twin of
+     * Swift `rhrBinGateLogLine`.
+     */
+    internal fun rhrBinGateLogLine(
+        day: String,
+        sessions: List<Pair<Long, Long>>,
+        hr: List<HrSample>,
+        shippedFloor: Int,
+        minBinSamples: Int = 5,
+        minPlausibleBpm: Double = 25.0,
+    ): String? {
+        val windowS = 5 * 60L
+        var bins = 0
+        var thin = 0
+        var implausible = 0
+        var best: Double? = null          // the current rule: min over every non-empty bin
+        var bestN = 0
+        var gated: Double? = null         // the candidate rule: min over qualifying bins only
+        for ((start, end) in sessions) {
+            val seg = hr.filter { it.ts in start..end }
+            if (seg.isEmpty()) continue
+            var t = start
+            do {
+                val isFinal = t + windowS >= end
+                val win = seg.filter { it.ts >= t && (isFinal || it.ts < t + windowS) }
+                if (win.isNotEmpty()) {
+                    bins += 1
+                    val mean = win.sumOf { it.bpm }.toDouble() / win.size.toDouble()
+                    if (win.size < minBinSamples) thin += 1
+                    if (mean < minPlausibleBpm) implausible += 1
+                    if (best == null || mean < best!!) { best = mean; bestN = win.size }
+                    if (win.size >= minBinSamples && mean >= minPlausibleBpm &&
+                        (gated == null || mean < gated!!)
+                    ) gated = mean
+                }
+                t += windowS
+            } while (t < end)
+        }
+        if (bins == 0) return null
+        // `roundToInt`, matching sessionRestingHR immediately below: this number is compared against
+        // that function's output, so the two must not round a tie differently.
+        val gatedFloor = gated?.roundToInt()
+        val changes = gatedFloor != null && gatedFloor != shippedFloor
+        if (!changes) return null
+        return "rhr bins day=$day bins=$bins thin=$thin implausible=$implausible " +
+            "winnerN=$bestN floor=$shippedFloor gated=${gatedFloor ?: "nil"} wouldChange=$changes " +
+            "(measure-only; nothing is gated yet)"
+    }
+
     /**
      * Lowest 5-min rolling-mean HR during the session (bpm), or null.
      *
diff --git a/android/app/src/test/java/com/noop/analytics/IntelligenceEngineJacocoBudgetTest.kt b/android/app/src/test/java/com/noop/analytics/IntelligenceEngineJacocoBudgetTest.kt
index c8c2c733ea..d7b88f338f 100644
--- a/android/app/src/test/java/com/noop/analytics/IntelligenceEngineJacocoBudgetTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/IntelligenceEngineJacocoBudgetTest.kt
@@ -45,7 +45,7 @@ class IntelligenceEngineJacocoBudgetTest {
         // read windows need about 825), small enough that a large regression fails here rather than at the
         // JVM's 64 KB wall. If a change genuinely needs more, extract — this file already shows the shape
         // twice over.
-        assertExactMethodBudget(lengths, "analyzeRecentOnCpu", 56_000)
+        assertExactMethodBudget(lengths, "analyzeRecentOnCpu", 55_700)
         // Untouched: 6,415 against 12,000. Slack, but it has not been creeping, and ratcheting a method
         // nobody is pressing against would be tightening for its own sake.
         assertExactMethodBudget(lengths, "persistFitnessVitalityAndSteps", 12_000)
diff --git a/android/app/src/test/java/com/noop/analytics/RhrBinGateDiagnosticTest.kt b/android/app/src/test/java/com/noop/analytics/RhrBinGateDiagnosticTest.kt
new file mode 100644
index 0000000000..04f4cbcdab
--- /dev/null
+++ b/android/app/src/test/java/com/noop/analytics/RhrBinGateDiagnosticTest.kt
@@ -0,0 +1,97 @@
+package com.noop.analytics
+
+import com.noop.data.HrSample
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * #1943 measure-only: the line must describe the partition `sessionRestingHR` actually uses, and must
+ * stay silent on a night where an artefact gate would change nothing. A diagnostic that fired every
+ * night would be ignored; one that fired on the wrong bins would argue for a change on false evidence.
+ */
+class RhrBinGateDiagnosticTest {
+
+    private fun hr(start: Long, count: Int, bpm: Int, step: Long = 1L) =
+        (0 until count).map { HrSample("d", start + it * step, bpm) }
+
+    /** A dense, ordinary night: every bin well-populated, so the gate would change nothing. Silent. */
+    @Test fun aWellPopulatedNightSaysNothing() {
+        val start = 1_000L
+        val end = start + 1800                       // 6 bins at 1 Hz
+        val samples = hr(start, 1800, 60)
+        assertNull(SleepStager.rhrBinGateLogLine("2026-01-01", listOf(start to end), samples, 60))
+    }
+
+    /** A one-sample bin that WINS the floor is the whole point: it must be reported, and named. */
+    @Test fun aThinWinningBinIsReportedWithWhatTheGateWouldDo() {
+        val start = 1_000L
+        val end = start + 1800
+        // Five dense bins at 60 bpm, then a single stray low sample alone in the last bin.
+        val dense = hr(start, 1500, 60)
+        val stray = listOf(HrSample("d", start + 1700, 38))
+        val line = SleepStager.rhrBinGateLogLine("2026-01-01", listOf(start to end), dense + stray, 38)
+        assertTrue("a thin winning bin must be reported, got: $line", line != null)
+        assertTrue("must count the thin bin, got: $line", line!!.contains("thin=1"))
+        assertTrue("must name the winning bin's size, got: $line", line.contains("winnerN=1"))
+        assertTrue("must say the gate would move the floor, got: $line", line.contains("wouldChange=true"))
+        assertTrue("must report the gated floor it would use instead, got: $line", line.contains("gated=60"))
+    }
+
+    /** A thin bin that does NOT win is silent: a thin FINAL bin is structural on most spans, not a finding. */
+    @Test fun aThinBinThatCannotWinTheFloorIsSilent() {
+        val start = 1_000L
+        val end = start + 1800
+        val dense = hr(start, 1500, 60)
+        val strayHigh = listOf(HrSample("d", start + 1700, 90))   // thin, but far above the floor
+        assertNull(
+            "a thin bin that cannot win the floor is noise, not a finding",
+            SleepStager.rhrBinGateLogLine("2026-01-01", listOf(start to end), dense + strayHigh, 60),
+        )
+    }
+
+    /**
+     * The load-bearing invariant: the line must judge the SAME partition `sessionRestingHR` ships.
+     *
+     * Every other case here hands the floor in as a literal, so none of them would notice the two
+     * binnings drifting apart, and a diagnostic describing a different partition than the one it is
+     * measuring would argue for a change on false evidence. Here the shipped floor comes FROM
+     * `sessionRestingHR`, and on a night where no bin is thin the gate must agree with it exactly, which
+     * the line reports by staying silent. A partition mismatch shows up as a spurious `wouldChange`.
+     */
+    @Test fun theDiagnosticJudgesTheSamePartitionSessionRestingHrShips() {
+        val start = 1_000L
+        for (spanS in listOf(1800L, 1801L, 1500L, 300L, 299L)) {   // aligned, +1, exact, one bin, short
+            val end = start + spanS
+            // Dense, with a genuinely lower stretch so the floor is not degenerate.
+            val samples = (0 until spanS.toInt()).map {
+                HrSample("d", start + it, if (it in 600..899) 55 else 65)
+            }
+            val shipped = SleepStager.sessionRestingHR(start, end, samples)
+            assertTrue("precondition: a floor exists for span $spanS", shipped != null)
+            assertNull(
+                "span $spanS: every bin is dense, so the gate must agree with sessionRestingHR " +
+                    "and the line must stay silent",
+                SleepStager.rhrBinGateLogLine("2026-01-01", listOf(start to end), samples, shipped!!),
+            )
+        }
+    }
+
+    /** No sleep sessions, or no samples inside them, is not a finding. */
+    @Test fun nothingToMeasureIsSilent() {
+        assertNull(SleepStager.rhrBinGateLogLine("2026-01-01", emptyList(), hr(1_000L, 100, 60), 60))
+        assertNull(SleepStager.rhrBinGateLogLine("2026-01-01", listOf(9_000L to 9_900L), hr(1_000L, 100, 60), 60))
+    }
+
+    /** It carries counts and bpm only: no timestamps, so a shared strap log gains no new identifiers. */
+    @Test fun theLineCarriesNoTimestamps() {
+        val start = 1_700_000_000L
+        val end = start + 1800
+        val line = SleepStager.rhrBinGateLogLine(
+            "2026-01-01", listOf(start to end),
+            hr(start, 1500, 60) + listOf(HrSample("d", start + 1700, 38)), 38,
+        )
+        assertTrue(line != null)
+        assertTrue("must not leak an epoch timestamp, got: $line", !line!!.contains("17000000"))
+    }
+}

From e2a68f3c193850fc3c1ec7d7013da7783f426c09 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 12:55:33 +1200
Subject: [PATCH 303/333] charging: stop pack presence from overriding the
 strap gauge (#1945)

Started as option A from #1935, document the conflation rather than split the
state. Re-reviewing the doc before merging showed the argument that option A
rested on was wrong, so this now carries the fix as well.

## What the re-review found

The doc claimed a spurious `charging = true` was bounded and self-healing: the
next `BATTERY_LEVEL` overwrites it from the strap's own gauge, so at worst it is
wrong for about one battery cadence. That is true on iOS. It was not true on
Android, because `BATTERY_LEVEL` was not the only writer.

The pushed pack-info event (109) also wrote `charging = true`, keyed on pack
PRESENCE plus a plausible SoC. `displayable` is `present && socPct in 0.0..100.0`,
so a flat pack qualifies, and the decoder's own hardware-confirmed note says the
strap volunteers 109 every couple of minutes while a pack is attached. That
outruns the ~8 min `BATTERY_LEVEL` that would clear the flag. So the gauge never
got the last word: a pack attached and not charging read as charging for its
whole attachment, not for one cadence.

That is not only a wrong pill. `idleThrottleActive` reads the flag and gates
three levers: the low-battery offload cadence, the GATT connection-priority
throttle, and the continuous-capture pause behind the user's own "Pause HRV
capture" percentage. A strap on a flat or badly seated pack kept background
capture running at low battery after the wearer asked for it to stop.

iOS was never affected. There the pack record is log-only and Test Centre gated,
so nothing but the gauge writes the flag.

## The fix

109 now publishes `packSocPct` alone. That is what the anti-staleness half
actually wanted, and the neighbouring doc already calls a non-null `packSocPct`
the pack-attached signal.

`BATTERY_PACK_CONNECTED(21)` still sets the flag on the attach edge, so the
latency win that #1826 added survives, and `BATTERY_LEVEL` can now correct it.
A missed attach edge costs at most one battery cadence of lag and is then right,
rather than being fast and possibly wrong. Android ends up doing what iOS
already did.

The rule both platforms now state at the field: an EDGE may set this flag
(7, 21, 22), a repeating presence signal may not, or the gauge can no longer
correct it.

## Tests

One new test, pinned against the source, because the write lives inline in a
GATT callback no JVM test can construct. It is anchored on the handler's own
`info.displayable && soc != null` guard, which is unique in the file. Anchoring
on the decode call or the event constant instead swallowed 400k characters and
passed on the pre-fix source, so the anchor is checked rather than assumed.

Verified as a negative control: re-adding `charging = true` to that one line
fails the test, restoring it passes. Full Android suite 5504 green, doc-comment
gate clean.

Swift is doc-only, so CI is the check there.

## Not included

The `charging` flag still means "attached or charging" on the 21 edge, which is
the original conflation #1935 raised. That stays documented rather than split:
21 leads `CHARGING_ON(7)` by up to ~17 s in captures, and with the gauge able to
correct the flag again, the window is genuinely one cadence.

One thing remains unmeasured, and it is noted in the code rather than glossed:
how often 109 repeats on a pack that is attached but flat. The fix does not
depend on it, since a repeating presence write is wrong regardless, but the
severity of what was there before does.
---
 Strand/BLE/BLEManager.swift                   |  7 ++
 Strand/BLE/LiveState.swift                    | 36 +++++++++--
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 64 ++++++++++++++++---
 .../com/noop/ble/ChargingAndReleaseTest.kt    | 46 +++++++++++++
 4 files changed, 139 insertions(+), 14 deletions(-)

diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index 8a0bbda43b..db8491be66 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -645,6 +645,13 @@ public final class BLEManager: NSObject, ObservableObject {
     /// Pure battery-adaptive gate (#477), the twin of Android `WhoopBleClient.idleThrottleActive`. Keyed
     /// on the STRAP's battery: armed by `thresholdPct` > 0, engages while the strap is discharging at/below
     /// `thresholdPct`. The phone's own Low Power Mode deliberately does NOT trigger it. Charging never engages.
+    ///
+    /// `charging` is not purely "is charging" (#1935): on a 5/MG it is also set on pack ATTACH, so a
+    /// depleted or badly-seated pack reads true while nothing charges, and this gate then stays off. The
+    /// window is bounded — the next BATTERY_LEVEL rewrites the flag from the strap's own gauge — and the
+    /// reasoning for accepting that rather than splitting the state is on `LiveState.charging`. Read it
+    /// before adding a trend check here: making this wait for a rising gauge would delay throttle release
+    /// on every honest attach to close an edge that already closes itself.
     static func lowPowerThrottleActive(batteryPct: Int, charging: Bool, thresholdPct: Int) -> Bool {
         thresholdPct > 0 && !charging && batteryPct <= thresholdPct
     }
diff --git a/Strand/BLE/LiveState.swift b/Strand/BLE/LiveState.swift
index 97e881d570..9eb0727585 100644
--- a/Strand/BLE/LiveState.swift
+++ b/Strand/BLE/LiveState.swift
@@ -76,10 +76,38 @@ public final class LiveState: ObservableObject {
     /// GET_EXTENDED_BATTERY_INFO response (#592). Shown on the Devices card as a "x.xx V" readout beside the
     /// percent; nil until the first battery event lands. Twin of the Android LiveState.batteryMv.
     @Published public var batteryMv: Int? = nil
-    /// Charging flag from the strap's BATTERY_LEVEL events — wire observation: u8 bit0 in the
-    /// event payload (4.0 @26 / 5.0 @30), pushed ~every 8 min on captured links. nil until the
-    /// first event of a session; cleared on disconnect so a stale flag can't outlive the link.
-    /// Flag ONLY — the battery % keeps its family-specific source (#77).
+    /// Charging flag. Two sources, and they mean different things (#1935).
+    ///
+    /// The authority is the strap's BATTERY_LEVEL event — wire observation: u8 bit0 in the payload
+    /// (4.0 @26 / 5.0 @30), pushed ~every 8 min on captured links. That is a LEVEL signal from the
+    /// strap's own gauge: every live battery event rewrites this flag, whatever it was.
+    ///
+    /// On a 5/MG it is ALSO set by `BATTERY_PACK_CONNECTED(21)` and cleared by
+    /// `BATTERY_PACK_REMOVED(22)`, which is a latency win — 21 leads `CHARGING_ON(7)` by up to ~17 s in
+    /// captures, so the pill responds when the pack goes on. But 21 means A PACK WAS ATTACHED, not that
+    /// charging began. They diverge on a depleted pack or a poor contact: 21 fires, 7 never does, and
+    /// this reads true while nothing charges.
+    ///
+    /// THAT STATE IS BOUNDED, which is why it is documented rather than split. It does not last until 22:
+    /// the next live BATTERY_LEVEL overwrites it from the strap's own GAUGE, so the window is about one
+    /// battery cadence, and the gauge always gets the last word.
+    ///
+    /// It gets the last word only because nothing else repeats, which is a real constraint rather than an
+    /// observation (#1935). The pack record reaches this platform LOG-ONLY (`FrameRouter`, Test Centre
+    /// gated) and writes nothing here. Android learned the same rule the hard way: its pushed pack-info
+    /// event (109) once wrote `charging = true` on pack PRESENCE every couple of minutes, outran the
+    /// gauge, and held a flat pack at "charging" for its whole attachment. An EDGE may set this flag
+    /// (7, 21, 22); a repeating presence signal must not, or the gauge cannot correct it.
+    ///
+    /// It matters beyond the pill. `BLEManager.lowPowerThrottleActive` reads it and gates THREE levers, not
+    /// one: the low-battery offload cadence, the connection-priority throttle, and the continuous-capture
+    /// pause behind the user's own "Pause HRV capture" percentage. So a pack attached but not charging can
+    /// keep background capture running at low battery after the user asked for it to stop, for that
+    /// window. `BLEManager.batteryPollDue` also reads it, polling every tick instead of every
+    /// other, which is harmless and arguably wanted with a pack on.
+    ///
+    /// nil until the first event of a session; cleared on disconnect so a stale flag can't outlive the
+    /// link. Flag ONLY — the battery % keeps its family-specific source (#77).
     @Published public var charging: Bool? = nil
 
     /// The Oura ring's current wear/charge state (nil for non-Oura straps or before any evidence this
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 7952a0ec00..d7da3162e2 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -165,10 +165,39 @@ data class LiveState(
      *  reconnects (or the settle timeout gives up). With `!connected` it drives the Devices card's
      *  transient "Reconnecting…" pill. Twin of macOS LiveState.rebootInProgress. */
     val rebootInProgress: Boolean = false,
-    /** Charging flag from BATTERY_LEVEL events — wire observation: u8 bit0 (4.0 @26 / 5.0 @30,
-     *  ~every 8 min on captured links). Flag only; battery % keeps its family source (#77).
-     *  Cleared on disconnect so a stale flag can't outlive the link. Twin of macOS
-     *  LiveState.charging. */
+    /** Charging flag. Two sources, and they mean different things (#1935).
+     *
+     *  The authority is BATTERY_LEVEL — wire observation: u8 bit0 (4.0 @26 / 5.0 @30, ~every 8 min on
+     *  captured links). That is a LEVEL signal from the strap's own gauge: every live battery event
+     *  rewrites this flag, whatever it was.
+     *
+     *  On a 5/MG it is ALSO set by BATTERY_PACK_CONNECTED(21) and cleared by BATTERY_PACK_REMOVED(22),
+     *  which is a latency win — 21 leads CHARGING_ON(7) by up to ~17 s in captures, so the pill responds
+     *  when the pack goes on. But 21 means A PACK WAS ATTACHED, not that charging began. They diverge on
+     *  a depleted pack or a poor contact: 21 fires, 7 never does, and this reads true while nothing
+     *  charges.
+     *
+     *  THAT STATE IS BOUNDED, which is why it is documented rather than split. It does not last until 22:
+     *  the next live BATTERY_LEVEL overwrites it from the strap's own GAUGE, so the window is about one
+     *  battery cadence, and the gauge always gets the last word.
+     *
+     *  THE GAUGE ONLY GETS THE LAST WORD BECAUSE NOTHING ELSE REPEATS. That is a real constraint, not an
+     *  observation (#1935): the pushed pack-info event (109) used to write charging=true too, keyed on
+     *  pack PRESENCE plus a plausible SoC, as an anti-staleness half for a missed attach edge. It repeats
+     *  every couple of minutes, so it outran the ~8 min BATTERY_LEVEL and a flat or badly seated pack read
+     *  "charging" for its whole attachment instead of self-correcting. It now writes [packSocPct] alone,
+     *  which is what the anti-staleness job actually wanted. So: an EDGE may set this flag (7, 21, 22), a
+     *  repeating presence signal must not, or the gauge stops being able to correct it.
+     *
+     *  It matters beyond the pill. [WhoopBleClient.idleThrottleActive] reads this flag and gates THREE
+     *  levers, not one: the low-battery offload cadence, the GATT connection-priority throttle, and the
+     *  continuous-capture pause behind the user's own "Pause HRV capture" percentage. So a strap on a flat
+     *  pack can skip low-battery throttling and keep background capture running after the user asked for
+     *  it to stop, for that window. [WhoopBleClient.batteryPollDue] also reads it, polling every tick
+     *  instead of every other, which is harmless and arguably wanted with a pack on.
+     *
+     *  Flag only; battery % keeps its family source (#77). Cleared on disconnect so a stale flag can't
+     *  outlive the link. Twin of macOS LiveState.charging. */
     val charging: Boolean? = null,
     /** Battery-pack charge, tenths-of-a-percent precision, from the pushed pack event (109) payload.
      *  5/MG only — a WHOOP 4.0 has no pack fuel gauge (its pack reads as a VOLTAGE via opcode 98, a
@@ -745,7 +774,14 @@ class WhoopBleClient(
          *  strap is DISCHARGING at/below [thresholdPct]. The
          *  phone's own Battery Saver deliberately does NOT trigger it — power saving is about the strap's
          *  charge, not the phone's. A charging strap never throttles. The threshold is its own hysteresis
-         *  (battery % moves slowly, so a boundary crossing flips at most once per point). */
+         *  (battery % moves slowly, so a boundary crossing flips at most once per point).
+         *
+         *  [LiveState.charging] is not purely "is charging" (#1935): on a 5/MG it is also set on pack
+         *  ATTACH, so a depleted or badly-seated pack reads true while nothing charges, and this gate then
+         *  stays off. The window is bounded — the next BATTERY_LEVEL rewrites the flag from the strap's own
+         *  gauge — and the reasoning for accepting that rather than splitting the state is on that field.
+         *  Read it before adding a trend check here: making this wait for a rising gauge would delay
+         *  throttle release on every honest attach to close an edge that already closes itself. */
         fun idleThrottleActive(batteryPct: Int, charging: Boolean, thresholdPct: Int): Boolean =
             thresholdPct > 0 && !charging && batteryPct <= thresholdPct
 
@@ -8025,11 +8061,19 @@ class WhoopBleClient(
                                     // command path and the event path end up disagreeing about the same
                                     // pack, which is the drift decodeRecord() exists to prevent.
                                     if (info.displayable && soc != null) {
-                                        // charging=true here as well as on event 21 is the anti-staleness
-                                        // half: if the attach edge was missed (app started with the pack
-                                        // already on, or the link dropped over the attach), this repeating
-                                        // event re-establishes the state within a couple of minutes.
-                                        _state.update { s -> s.copy(packSocPct = soc, charging = true) }
+                                        // SoC ONLY, deliberately (#1935). This event says a pack is
+                                        // ATTACHED and how full it is, never that current is flowing.
+                                        // It used to write charging=true as well, as the anti-staleness
+                                        // half for a missed attach edge — but it repeats every couple of
+                                        // minutes, so it outran the ~8 min BATTERY_LEVEL that corrects the
+                                        // flag from the strap's own GAUGE, and a flat or badly seated pack
+                                        // then read "charging" for the whole attachment instead of
+                                        // self-correcting. BATTERY_PACK_CONNECTED(21) still lights the pill
+                                        // on the attach edge, so the latency win survives; the gauge now
+                                        // gets the last word, which is what iOS already did. A missed
+                                        // attach edge costs at most one battery cadence of lag and is then
+                                        // RIGHT, instead of being fast and possibly wrong.
+                                        _state.update { s -> s.copy(packSocPct = soc) }
                                     } else if (!info.present) {
                                         _state.update { s -> s.copy(packSocPct = null) }
                                     }
diff --git a/android/app/src/test/java/com/noop/ble/ChargingAndReleaseTest.kt b/android/app/src/test/java/com/noop/ble/ChargingAndReleaseTest.kt
index 7af69774d2..e29f8446a9 100644
--- a/android/app/src/test/java/com/noop/ble/ChargingAndReleaseTest.kt
+++ b/android/app/src/test/java/com/noop/ble/ChargingAndReleaseTest.kt
@@ -59,4 +59,50 @@ class ChargingAndReleaseTest {
         assertNull(released.heartRate)
         assertNull(released.charging)
     }
+
+    // --- #1935: only an EDGE may set the charging flag -------------------------------------------------
+
+    /**
+     * The pushed pack-info event (109) must publish the pack's SoC and NOTHING ELSE.
+     *
+     * It used to write `charging = true` as well, keyed on pack PRESENCE, as an anti-staleness half for an
+     * attach edge the app missed. That is the one write that cannot be allowed here: 109 repeats every
+     * couple of minutes, so it outran the ~8 min BATTERY_LEVEL that corrects the flag from the strap's own
+     * gauge, and a flat or badly seated pack then read "charging" for its whole attachment instead of
+     * self-correcting. The flag reaches three throttling levers (see [LiveState.charging]), so that is not
+     * only a wrong pill.
+     *
+     * Pinned against the source the way [StalledLinkDiagnosticsTest] pins its caller-side invariants: the
+     * write lives inline in a GATT callback that no JVM test can construct, and the regression is a single
+     * word being added back.
+     */
+    @Test
+    fun `the repeating pack-info event publishes SoC without touching the charging flag`() {
+        val src = clientSource()
+        // Anchored on the handler's own guard, which is unique in the file: the decode call and the event
+        // constant both appear earlier in the address-masking helper, and anchoring there swallowed 400k
+        // characters and passed on the pre-fix source.
+        val start = src.indexOf("info.displayable && soc != null")
+        assertTrue("the pack-info event handler was not found", start > 0)
+        val end = src.indexOf("packSocPct = null", start)
+        assertTrue("the pack-info handler's absent-pack branch was not found", end > start)
+        // Comments discuss the removed write by name, so judge the CODE only.
+        val code = src.substring(start, end).lines()
+            .filterNot { it.trim().startsWith("//") }
+            .joinToString("\n")
+        assertTrue("pack info must still publish the SoC", code.contains("packSocPct = soc"))
+        assertFalse("pack PRESENCE must never write the charging flag (#1935) — an EDGE may (7, 21, 22), " +
+                    "a repeating signal may not, or the gauge can no longer correct it",
+                    code.contains("charging"))
+    }
+
+    private fun clientSource(): String {
+        var root = java.io.File(System.getProperty("user.dir") ?: ".").canonicalFile
+        repeat(4) {
+            val f = java.io.File(root, "android/app/src/main/java/com/noop/ble/WhoopBleClient.kt")
+            if (f.isFile) return f.readText()
+            root = root.parentFile ?: root
+        }
+        error("WhoopBleClient.kt not found — this test must not pass by default")
+    }
 }

From 829ee1d7eef2528a03a7f1e63091860962eeb99b Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 13:13:38 +1200
Subject: [PATCH 304/333] explorer: stop the readings table printing the unit
 twice (#1947)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reported by @Geg0r in #1942, with two screenshots that made it quick to place.

## What happened

`vitalReadingRows` appends its `unit` parameter to whatever the formatter
returns:

```swift
value: unit.isEmpty ? value : "\(value) \(unit)",
```

The Explorer passed `metric.unit` alongside `format: fmt`, and every
`MetricDescriptor.format` overload already ends in the unit. Hence `33 % %` in
the readings table, while the hero and the stat tiles stayed correct because
they render the formatter directly.

For the three convertible families it was worse than a repeat, because `format`
converts and relabels while the stored `unit` does not:

| metric | preference | rendered |
|---|---|---|
| Weight | Imperial | `182.0 lb kg` |
| Skin Temp | Fahrenheit | `Δ0.5 °F °C` |
| Effort | /21 scale | `12.5 /21 /100` |

@Geg0r happened to hit `%` and `rpm`, where the stored and displayed labels
agree, so it looked like a harmless duplicate.

## The change

One line: the unit parameter goes empty and the formatter supplies it, with a
comment at the call site saying why so it does not get restored.

Android was never affected and needs no change. Its twin appends the unit the
same way, but every one of its call sites passes a UNIT-LESS closure
(`{ it.roundToInt().toString() }`, `{ String.format("%.1f", it) }`,
`{ UnitFormatter.effortDisplay(it, effortScale) }`), which is the contract the
function was written to. iOS has no unit-less formatter that also converts
kg→lb / °C→°F / 0–100→0–21, so it cannot follow that contract and pairs the
unit-bearing formatter with an empty unit instead.

## Why the tests did not catch it

`VitalReadingsTableTests` passes `spo2Format`, a unit-less closure, and asserts
`"97 %"`. The function was tested and correct; nothing pinned the call site's
pairing. Two tests now do: one that the Explorer's own formatter is unit-bearing
and pairs with an empty unit, and its counter-case, that the same formatter plus
a unit doubles it. The second is deliberately a test of correct behaviour under
the pairing that caused this, so a future reader restoring `unit: metric.unit`
sees what it does and where the fault is not.

These are app-target tests, so they run in the on-demand app-build gate rather
than default CI.
---
 Strand/Screens/MetricExplorerView.swift   |  9 +++++-
 StrandTests/VitalReadingsTableTests.swift | 35 +++++++++++++++++++++++
 2 files changed, 43 insertions(+), 1 deletion(-)

diff --git a/Strand/Screens/MetricExplorerView.swift b/Strand/Screens/MetricExplorerView.swift
index cdf6005cd9..887828a9db 100644
--- a/Strand/Screens/MetricExplorerView.swift
+++ b/Strand/Screens/MetricExplorerView.swift
@@ -1343,7 +1343,14 @@ struct MetricDetailView: View {
         let readings = windowed.map {
             VitalReading(day: $0.day, value: $0.value, source: sourceByDay[$0.day] ?? metric.source)
         }
-        let rows = vitalReadingRows(readings: readings, unit: metric.unit,
+        // The unit is passed EMPTY on purpose (#1942). `vitalReadingRows` appends its `unit` to whatever
+        // the formatter returns, and every `MetricDescriptor.format` overload already ends in the unit —
+        // the CONVERTED one, at that. Passing `metric.unit` here rendered "33 % %", and worse than a
+        // repeat for the three convertible families, whose stored label contradicts the displayed one:
+        // "182.0 lb kg", "Δ0.5 °F °C", "12.5 /21 /100". The Android twin appends the same way and is
+        // correct because every one of its call sites passes a UNIT-LESS closure; iOS has no unit-less
+        // formatter that also converts, so the unit comes from `fmt` and the parameter stays empty.
+        let rows = vitalReadingRows(readings: readings, unit: "",
                                     strapDeviceId: repo.deviceId, format: fmt)
         if !rows.isEmpty {
             NoopCard {
diff --git a/StrandTests/VitalReadingsTableTests.swift b/StrandTests/VitalReadingsTableTests.swift
index 74fca102fc..6fef98c56e 100644
--- a/StrandTests/VitalReadingsTableTests.swift
+++ b/StrandTests/VitalReadingsTableTests.swift
@@ -87,4 +87,39 @@ final class VitalReadingsTableTests: XCTestCase {
         )
         XCTAssertEqual(rows.first?.value, "72")
     }
+
+    // MARK: - #1942: the Explorer pairs a unit-BEARING formatter with an EMPTY unit
+
+    /// Every test above passes `spo2Format`, a unit-LESS closure, which is the contract this function was
+    /// written to and the one all of Android's call sites follow. The Explorer cannot follow it: its
+    /// formatter is `MetricDescriptor.format`, which already ends in the unit, and the CONVERTED one —
+    /// there is no unit-less iOS formatter that also converts kg→lb / °C→°F / 0–100→0–21. So it pairs that
+    /// formatter with an empty unit, and this pins both halves of that pairing.
+    ///
+    /// Passing the descriptor's stored `unit` alongside it is what rendered "33 % %" in the readings table
+    /// while the hero and the stat tiles, which render the formatter directly, stayed correct (#1942).
+    func testExplorerFormatterAlreadyCarriesTheUnitSoTheUnitParameterIsEmpty() throws {
+        let spo2 = try XCTUnwrap(MetricCatalog.metric(key: "spo2", source: strap))
+        let explorerFormat: (Double) -> String = { spo2.format($0, system: .metric, temperature: .celsius) }
+
+        // Half one: the Explorer's own formatter is unit-BEARING, unlike `spo2Format` above.
+        XCTAssertEqual(explorerFormat(97), "97 %")
+
+        // Half two: paired with an empty unit, the row carries exactly one.
+        let rows = vitalReadingRows(readings: spo2Readings(), unit: "", strapDeviceId: strap,
+                                    now: now, format: explorerFormat)
+        XCTAssertEqual(rows.first?.value, "97 %")
+    }
+
+    /// The function itself is not at fault, and this says so: given the pairing the Explorer used to pass,
+    /// doubling is the CORRECT output. That is why the fix is at the call site and why Android, whose
+    /// twin appends identically, was never affected. Kept as the counter-case to the test above so a
+    /// future reader restoring `unit: metric.unit` sees what it does.
+    func testAUnitBearingFormatterPlusAUnitDoublesItWhichIsWhyTheCallSitePassesEmpty() throws {
+        let spo2 = try XCTUnwrap(MetricCatalog.metric(key: "spo2", source: strap))
+        let rows = vitalReadingRows(readings: spo2Readings(), unit: spo2.unit, strapDeviceId: strap,
+                                    now: now,
+                                    format: { spo2.format($0, system: .metric, temperature: .celsius) })
+        XCTAssertEqual(rows.first?.value, "97 % %")
+    }
 }

From 8bc0e6d27486aaff003a679b48180e7cfbbba75e Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 14:06:55 +1200
Subject: [PATCH 305/333] connection: say why the unbonded probe was skipped,
 and what we hold on the link (#1950)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Groundwork for #1949. Nothing is gated and no behaviour changes; this makes a
5/MG log answerable.

## What a capture could not tell you

An MG log showed the four puffin notify chars discovered, one standard-HR
subscribe, and nothing further:

```
[connection]   service fd4b0001-cce1-4033-93ce-002d5875f58a (5 char)
[connection]     fd4b0003-... props=0x10 (Notify)
[connection]     fd4b0004-... props=0x10 (Notify)
[connection]     fd4b0005-... props=0x10 (Notify)
[connection]     fd4b0007-... props=0x10 (Notify)
Subscribed 00002a37-0000-1000-8000-00805f9b34fb
```

Reading that, there is no way to tell the app declined to subscribe them from
the strap refusing. Those are opposite answers for #1635: one is a setting, the
other is the verdict the probe exists to obtain. Both silences are now spoken.

## The probe's skip reason

`beginUnbondedOffloadProbe` returned silently whenever `shouldProbeUnbondedOffload`
said no. It now names which of the seven conditions decided, in the gate's own
order so the reason printed is the one that actually decided rather than the
first that happens to be true. Once per link, because the path is retried.

The common case is the actionable one:

```
unbonded probe skipped — the unbonded-offload experiment is off. The puffin notify
chars stay unsubscribed on this link, so neither the historical offload nor a
realtime IMU producer can reach us here.
```

The consequence clause is appended only for an unbonded 5/MG, since a bonded
strap reaches those chars through the ordinary handshake and the sentence would
be false there.

## The pairing dump

`gattTreeLines` says what the strap OFFERS. This says what we HOLD with it: bond
state, `didBond`, whether a hello went out, whether the probe is opted in, and
per notify characteristic whether it carries a CCCD.

It reports POSTURE, not outcome. A first draft of this carried a `subscribed`
column and a re-review removed it, because it could not have been honest: the
dump runs at service discovery, before the CCCD queue is drained, so every
subscription is still ahead of it, and on API 33+ it could not have been read
anyway since `writeDescriptor(descriptor, value)` never populates
`descriptor.value`. It would have printed `subscribed=no` universally, including
for a probe that HAD subscribed the puffin chars, which is the one case this
exists to observe. Those outcomes are already in the log as one confirmed
`Subscribed <uuid>` line each, so the note points a reader at them and says what
their absence means. A test pins the column's absence with that reasoning
attached.

What that absence MEANS flips with the opt-in, and a later pass caught the note
asserting one half of it unconditionally. With the probe off, only
`HEART_RATE_CHAR` and `BATTERY_CHAR` reach `cccdQueue`, so an unsubscribed puffin
char is ours. With the probe ON it subscribes those same chars itself, so a
missing line there is the STRAP refusing, which is the opposite conclusion and
the whole reason the probe is run. The note branches, and both branches are
pinned with each asserting the other's wording is absent.

On encryption it deliberately claims less than a reader might want. Android
publishes no link-encryption flag to a GATT client, and a remote
characteristic's permissions read back as 0, so bond state is a proxy and not
the same question. The note names the two CCCD write statuses that do answer it,
5 and 15, which is what the probe already listens for. A test pins that wording
so a later edit cannot quietly upgrade it to a claim the code cannot make.

`bondStateName` is `BondStateTrace`'s, not a second spelling: two renderings of
one OS state in one log is how a reader ends up believing they are two readings.

## Tests

The explanation and the gate are pinned against each other EXHAUSTIVELY, over
every combination of the seven inputs. They are separate `when` chains over the
same conditions, and the failure mode is a condition added to one and forgotten
in the other, which no hand-picked case is likely to sit on. Plus order,
consequence-clause suppression, the two retirement kinds, and the dump's shape.

The gate's inputs are read ONCE and the same values handed to the explanation.
They are `@Volatile` fields and a live pref read, so re-reading them could name a
reason that was not the one that decided.

Android suite 5520 green, doc-comment gate clean.

## Scope

Android only, and the twinned file already stated the rule. `GattCapability` has
a Swift half, so an untwinned function in it deserves an answer, and its header
gives one: `gattTreeLines` was twinned because CoreBluetooth exposes services,
characteristics and properties, "unlike the bond-state and pairing helpers, which
have no Apple equivalent at all". The pairing dump is one of those, keyed on an
OS bond state CoreBluetooth does not publish and on an Android-only probe's
opt-in. The skip reason has nothing to twin either: there is no iOS probe whose
silence needs explaining. That rationale is now recorded at the function rather
than left to be re-derived.

Worth recording, because it runs opposite to the guess: iOS is the platform that
COULD carry the subscription column removed above. `CBCharacteristic.isNotifying`
is authoritative where Android's `descriptor.value` is null on API 33+, and iOS
already re-subscribes the puffin chars post-bond precisely because the strap
refuses them until the link is encrypted (issue #17). An iOS equivalent would be
a different and slightly better instrument, emitted after the subscribe attempt.

The two lines have deliberately different visibility. The domain argument to
`log()` is a TAG, not a gate, so the skip reason lands in an ordinary strap log:
one line, only on a no-hello 5/MG link, explaining a silence to whoever reads the
log they already have. The dump is eight lines of readout and stays behind the
Test Centre connection domain.

Local reads on already-discovered state, gated to the Test Centre connection
domain. No GATT operation and no traffic, which is the same discipline
`gattTreeLines` was written to, and the reason both work on exactly the strap
that no puffin probe can reach.
---
 .../main/java/com/noop/ble/GattCapability.kt  |  85 +++++++++++++++
 .../java/com/noop/ble/UnbondedOffloadProbe.kt |  46 ++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  |  90 ++++++++++++++--
 .../test/java/com/noop/ble/GattTreeTest.kt    | 100 ++++++++++++++++++
 .../com/noop/ble/UnbondedOffloadProbeTest.kt  |  82 ++++++++++++++
 5 files changed, 396 insertions(+), 7 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ble/GattCapability.kt b/android/app/src/main/java/com/noop/ble/GattCapability.kt
index d57a432f03..20f3384d33 100644
--- a/android/app/src/main/java/com/noop/ble/GattCapability.kt
+++ b/android/app/src/main/java/com/noop/ble/GattCapability.kt
@@ -84,3 +84,88 @@ internal fun gattTreeLines(services: List<Pair<String, List<Pair<String, Int>>>>
         }
     }
 }
+
+/**
+ * One puffin NOTIFY characteristic as the pairing dump sees it.
+ *
+ * Deliberately NO "subscribed" field. This dump is emitted at service discovery, before the CCCD queue is
+ * drained, so any subscription state read here is "not yet" by construction rather than by fact — and on
+ * API 33+ it could not be read anyway, since `writeDescriptor(descriptor, value)` never populates
+ * `descriptor.value`. Which characteristics actually subscribed is already in the log, one confirmed
+ * `Subscribed <uuid>` line each, written where the confirmation arrives.
+ */
+internal data class NotifyCharDump(
+    val uuid: String,
+    val hasCccd: Boolean,
+)
+
+/**
+ * The link's PAIRING posture, next to the puffin notify chars and whether each carries a CCCD.
+ *
+ * [gattTreeLines] says what the strap OFFERS; this says what we hold with it. On a 5/MG the two together
+ * are the difference between "the chars are not there" and "the chars are there and we never subscribed
+ * them", which a log otherwise cannot distinguish — the capture that prompted this showed all four puffin
+ * notify chars discovered, one standard-HR subscribe, and no further word (#1949).
+ *
+ * It reports POSTURE, not outcome: this runs at service discovery, before the CCCD queue is drained, so
+ * every subscription is still ahead of it. The outcomes are the `Subscribed <uuid>` lines that follow, and
+ * what their ABSENCE means flips with [probeOptedIn] — ours when the probe is off, the strap's when it is
+ * on and subscribing those chars itself. The note says which, because guessing wrong there inverts the
+ * single distinction this dump exists to draw.
+ *
+ * Same discipline as its sibling: reads already-known local state, sends nothing, and so works on exactly
+ * the strap that no puffin probe can reach.
+ *
+ * NO Swift twin, and this file's Swift half already says why in general: `gattTreeLines` was twinned
+ * because CoreBluetooth exposes services, characteristics and properties, "unlike the bond-state and
+ * pairing helpers, which have no Apple equivalent at all". This is one of those — it is keyed on the OS
+ * bond state, which CoreBluetooth does not publish, and on an opt-in for a probe that is Android-only.
+ * Worth recording for whoever wants the iOS equivalent: the asymmetry there runs the other way, since
+ * `CBCharacteristic.isNotifying` is authoritative, so iOS could carry the subscription column Android
+ * cannot — after the subscribe attempt, not at discovery.
+ *
+ * On encryption it deliberately claims LESS than a reader might want. Android publishes no
+ * link-encryption flag to a GATT client, and a remote characteristic's permissions read back as 0, so the
+ * bond state is the only standing proxy and it is not the same question. The hard evidence is a CCCD
+ * write status, which is why the note names the two codes that answer it (#1635).
+ */
+internal fun whoop5PairingDumpLines(
+    bondState: Int,
+    didBond: Boolean,
+    helloWrittenThisLink: Boolean,
+    probeOptedIn: Boolean,
+    notifyChars: List<NotifyCharDump>,
+): List<String> = buildList {
+    // [bondStateName] is BondStateTrace's, deliberately: two spellings of one OS state in one log is
+    // how a reader ends up believing they are two different readings.
+    add(
+        "pairing: bond=${bondStateName(bondState)} didBond=$didBond" +
+            " helloWritten=$helloWrittenThisLink unbondedProbe=${if (probeOptedIn) "on" else "off"}"
+    )
+    if (notifyChars.isEmpty()) {
+        add("  no puffin notify characteristics discovered")
+    } else {
+        for (c in notifyChars) {
+            add("  ${c.uuid} cccd=${if (c.hasCccd) "yes" else "no"}")
+        }
+    }
+    // Which way this reads FLIPS with the opt-in, and getting it wrong would invert the one distinction
+    // the dump exists to draw. With the probe off, only the standard HR and battery chars are ever queued,
+    // so an unsubscribed puffin char is ours. With it ON, the probe subscribes those same chars itself, so
+    // a missing line there is the strap's answer and not a setting.
+    add(
+        if (probeOptedIn) {
+            "  note: the unbonded probe is ON and subscribes the puffin chars itself, so one above with no" +
+                " later \"Subscribed\" line is the STRAP's answer, logged with the status it refused on."
+        } else {
+            "  note: only the standard HR and battery chars are queued for subscription on a 5/MG, so a" +
+                " puffin char above with no later \"Subscribed\" line went unsubscribed by OUR choice," +
+                " not the strap's."
+        }
+    )
+    add(
+        "  note: Android publishes no link-encryption flag to a GATT client and a remote characteristic's" +
+            " permissions read back as 0, so bond= above is a proxy, not the answer. The hard evidence is a" +
+            " CCCD write returning status 5 (insufficient authentication) or 15 (insufficient encryption)."
+    )
+}
diff --git a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
index 2625748515..106690fcd9 100644
--- a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
+++ b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
@@ -65,6 +65,52 @@ internal fun shouldProbeUnbondedOffload(
     return !unbondedProbeRetired(previouslyRefused, silentLinksSoFar)
 }
 
+/**
+ * Why the unbonded-offload probe did NOT run on this link, or null when it will.
+ *
+ * [beginUnbondedOffloadProbe] returns SILENTLY when [shouldProbeUnbondedOffload] says no, and that
+ * silence is unreadable. A 5/MG log then shows the four puffin notify chars DISCOVERED, one standard-HR
+ * subscribe, and nothing further — which looks identical whether the app declined to ask or the strap
+ * refused. Those have opposite meanings for #1635: one is a setting, the other is the answer.
+ *
+ * Names the reason in the SAME ORDER the gate tests them, so the reason printed is the one that actually
+ * decided rather than the first one that happens to be true. Returns null exactly when the gate returns
+ * true, and the tests pin that agreement exhaustively over every input, so a new condition added to one
+ * cannot outlive the other.
+ *
+ * The consequence clause is appended only for an unbonded 5/MG, because that is the only case where the
+ * puffin chars go unsubscribed: a bonded strap reaches them through the ordinary handshake.
+ */
+internal fun unbondedProbeSkippedLine(
+    isWhoop5: Boolean,
+    optedIn: Boolean,
+    bonded: Boolean,
+    helloWrittenThisLink: Boolean,
+    alreadyProbedThisLink: Boolean,
+    previouslyRefused: Boolean,
+    silentLinksSoFar: Int,
+): String? {
+    val why = when {
+        !isWhoop5 -> "not a WHOOP 5/MG"
+        !optedIn -> "the unbonded-offload experiment is off"
+        bonded -> "this strap bonded, so the ordinary post-hello handshake reaches the offload"
+        helloWrittenThisLink ->
+            "a CLIENT_HELLO went out on this link, so a refusal here could not be attributed to the strap"
+        alreadyProbedThisLink -> "already probed on this link"
+        unbondedProbeRetired(previouslyRefused, silentLinksSoFar) ->
+            if (previouslyRefused) "retired for this strap: a refusal is latched"
+            else "retired for this strap: the silent-link budget is spent"
+        else -> return null
+    }
+    val consequence = if (isWhoop5 && !bonded) {
+        " The puffin notify chars stay unsubscribed on this link, so neither the historical offload nor a" +
+            " realtime IMU producer can reach us here."
+    } else {
+        ""
+    }
+    return "unbonded probe skipped — $why.$consequence"
+}
+
 /**
  * Has the probe stopped asking — for good, on this device?
  *
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index d7da3162e2..44358cc041 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -2598,6 +2598,11 @@ class WhoopBleClient(
     @Volatile
     private var unbondedProbeAwaitingReply = false
 
+    /** True once the probe's skip reason has been logged on this link (#1949), so a retried start does
+     *  not repeat it. Cleared with the rest of the per-link probe state. */
+    @Volatile
+    private var unbondedProbeSkipLogged = false
+
     /** #1635: the probe has run on THIS link. Separate from [unbondedProbeAwaitingReply] because the
      *  keep-alive drains the same CCCD queue every 30s and would otherwise re-enter the probe's own
      *  completion branch for the life of the connection. */
@@ -5303,16 +5308,50 @@ class WhoopBleClient(
 
     private fun beginUnbondedOffloadProbe(g: BluetoothGatt) {
         val refused = unbondedOffloadPreviouslyRefused(g.device.address)
+        // Read each input ONCE: the gate's verdict and the line that explains it must be about the same
+        // state, or the log will name a reason that was not the one that decided.
+        val isWhoop5Now = connectedFamily == DeviceFamily.WHOOP5
+        val optedInNow = PuffinExperiment.from(context).unbondedOffload
+        val bondedNow = didBond
+        val helloWrittenNow = helloWrittenThisLink
+        val alreadyProbedNow = unbondedProbeStartedThisLink
+        val silentLinksNow = unbondedProbeSilentLinks
         if (!shouldProbeUnbondedOffload(
-                isWhoop5 = connectedFamily == DeviceFamily.WHOOP5,
-                optedIn = PuffinExperiment.from(context).unbondedOffload,
-                bonded = didBond,
-                helloWrittenThisLink = helloWrittenThisLink,
-                alreadyProbedThisLink = unbondedProbeStartedThisLink,
+                isWhoop5 = isWhoop5Now,
+                optedIn = optedInNow,
+                bonded = bondedNow,
+                helloWrittenThisLink = helloWrittenNow,
+                alreadyProbedThisLink = alreadyProbedNow,
                 previouslyRefused = refused,
-                silentLinksSoFar = unbondedProbeSilentLinks,
+                silentLinksSoFar = silentLinksNow,
             )
-        ) return
+        ) {
+            // #1949: say WHY, once per link. UNGATED, unlike the pairing dump, and deliberately so: the
+            // domain argument to log() is a TAG rather than a gate, so this lands in an ordinary strap
+            // log. That is the point — it explains a silence to whoever reads the log they already have,
+            // and it costs one line, only on a no-hello 5/MG link, which is the only place the probe is
+            // scheduled. The dump is eight lines of readout and stays behind the Test Centre domain.
+            //
+            // A silent return here is what made an MG capture unreadable:
+            // the puffin chars discovered, never subscribed, and no way to tell the app declined from the
+            // strap refusing — opposite meanings for #1635. Once per link, because this path is retried.
+            if (!unbondedProbeSkipLogged) {
+                unbondedProbeSkipLogged = true
+                // The SAME values the gate just refused on, not a second read of each. `didBond` and the
+                // rest are @Volatile and the pref is a live file read, so re-reading them here could
+                // explain the skip with a state that is no longer the one that caused it.
+                unbondedProbeSkippedLine(
+                    isWhoop5 = isWhoop5Now,
+                    optedIn = optedInNow,
+                    bonded = bondedNow,
+                    helloWrittenThisLink = helloWrittenNow,
+                    alreadyProbedThisLink = alreadyProbedNow,
+                    previouslyRefused = refused,
+                    silentLinksSoFar = silentLinksNow,
+                )?.let { log(it, com.noop.testcentre.TestDomain.CONNECTION) }
+            }
+            return
+        }
         // Stand aside while the DIS chain still holds the one serialized GATT queue. The fixed 6s delay
         // this used to rely on was chosen by reasoning and was wrong: a capture caught the chain still
         // running at 7s, every CCCD write returning busy, all four abandoned after the shared retry
@@ -6843,6 +6882,42 @@ class WhoopBleClient(
                         ), com.noop.testcentre.TestDomain.CONNECTION)
                     }
                 }
+                // #1949: and what we HAVE with the strap, next to what it offers. The sibling dump above
+                // covers fd4b0002, the write char; this covers the four NOTIFY chars the offload and the
+                // realtime IMU producer both arrive on. A capture showed all four discovered, one
+                // standard-HR subscribe, and nothing more — which reads identically to the strap refusing
+                // them. Only HEART_RATE_CHAR and BATTERY_CHAR reach `cccdQueue` below on a 5/MG, so
+                // "subscribed=no" here is the app's own doing and the log should say so rather than
+                // leave it to be inferred. Local reads only, like its sibling: no GATT operation.
+                //
+                // Per CONNECT, unlike the tree above which is once per strap, and the difference is the
+                // point: the tree is static for a device while this is exactly the state that changes
+                // between links — a bond acquired, a hello written, the opt-in flipped. Seven lines
+                // against that sibling's thirty, so a reconnect loop costs a quarter as much as the
+                // enumeration that deliberately declined to repeat.
+                if (testCentre.active(com.noop.testcentre.TestDomain.CONNECTION)) {
+                    val notifyDump = runCatching {
+                        WHOOP5_NOTIFY_CHARS.mapNotNull { u ->
+                            whoop5.getCharacteristic(u)?.let { ch ->
+                                NotifyCharDump(
+                                    uuid = u.toString().take(8),
+                                    hasCccd = ch.getDescriptor(CCCD) != null,
+                                )
+                            }
+                        }
+                    }.getOrDefault(emptyList())
+                    for (line in whoop5PairingDumpLines(
+                        bondState = runCatching { g.device.bondState }.getOrDefault(-1),
+                        didBond = didBond,
+                        helloWrittenThisLink = helloWrittenThisLink,
+                        probeOptedIn = runCatching {
+                            PuffinExperiment.from(context).unbondedOffload
+                        }.getOrDefault(false),
+                        notifyChars = notifyDump,
+                    )) {
+                        log(line, com.noop.testcentre.TestDomain.CONNECTION)
+                    }
+                }
             } else {
                 log("Custom WHOOP service not found on this peripheral")
             }
@@ -10982,6 +11057,7 @@ class WhoopBleClient(
             chargeUnbondedProbeSilence()
         }
         unbondedProbeStartedThisLink = false
+        unbondedProbeSkipLogged = false
         unbondedProbeDeferrals = 0
         disChainInFlight = false
         unbondedProbeSubscribed = 0
diff --git a/android/app/src/test/java/com/noop/ble/GattTreeTest.kt b/android/app/src/test/java/com/noop/ble/GattTreeTest.kt
index 4cbe2b96e6..9ef7e238ec 100644
--- a/android/app/src/test/java/com/noop/ble/GattTreeTest.kt
+++ b/android/app/src/test/java/com/noop/ble/GattTreeTest.kt
@@ -42,4 +42,104 @@ class GattTreeTest {
         assertTrue(single.contains(names))
         assertTrue(tree.contains(names))
     }
+
+    // --- #1949: the pairing dump ----------------------------------------------------------------------
+
+    private fun chars() = listOf(
+        NotifyCharDump("fd4b0003", hasCccd = true),
+        NotifyCharDump("fd4b0007", hasCccd = false),
+    )
+
+    @Test
+    fun `the header carries the pairing posture the log otherwise lacks`() {
+        val head = whoop5PairingDumpLines(
+            bondState = 10, didBond = false, helloWrittenThisLink = false,
+            probeOptedIn = false, notifyChars = chars(),
+        ).first()
+        assertEquals(
+            "pairing: bond=BOND_NONE didBond=false helloWritten=false unbondedProbe=off",
+            head,
+        )
+    }
+
+    @Test
+    fun `each notify char reports whether it carries a CCCD`() {
+        val lines = whoop5PairingDumpLines(
+            bondState = 12, didBond = true, helloWrittenThisLink = true,
+            probeOptedIn = true, notifyChars = chars(),
+        )
+        assertEquals("  fd4b0003 cccd=yes", lines[1])
+        assertEquals("  fd4b0007 cccd=no", lines[2])
+        assertTrue(lines.first(), lines.first().contains("bond=BOND_BONDED"))
+        assertTrue(lines.first(), lines.first().contains("unbondedProbe=on"))
+    }
+
+    /**
+     * There must be NO subscription column. This runs at service discovery, before the CCCD queue is
+     * drained, so any such field would read "not yet" as a matter of ordering rather than fact — and on
+     * API 33+ it could not be read at all, since `writeDescriptor(descriptor, value)` leaves
+     * `descriptor.value` null. The outcomes are the `Subscribed <uuid>` lines that follow, and the note
+     * points a reader at them instead of restating them wrongly here.
+     */
+    @Test
+    fun `no line claims a subscription state this dump cannot know yet`() {
+        val lines = whoop5PairingDumpLines(
+            bondState = 10, didBond = false, helloWrittenThisLink = false,
+            probeOptedIn = false, notifyChars = chars(),
+        )
+        assertTrue(lines.toString(), lines.none { it.contains("subscribed=") })
+        assertTrue("a reader must be told where the answer is: $lines",
+                   lines.any { it.contains("no later \"Subscribed\" line went unsubscribed by OUR choice") })
+    }
+
+    /**
+     * What an ABSENT `Subscribed` line means inverts with the opt-in, and this is the one distinction the
+     * dump exists to draw. Probe off: only HR and battery are ever queued, so an unsubscribed puffin char
+     * is ours. Probe ON: the probe subscribes those same chars, so a missing line is the strap refusing.
+     * A single unconditional sentence here would be confidently wrong in exactly the configuration the
+     * probe is run for.
+     */
+    @Test
+    fun `the note flips with the opt-in, because the meaning of a missing subscribe does`() {
+        val off = whoop5PairingDumpLines(
+            bondState = 10, didBond = false, helloWrittenThisLink = false,
+            probeOptedIn = false, notifyChars = chars(),
+        )
+        assertTrue(off.toString(), off.any { it.contains("went unsubscribed by OUR choice") })
+        assertTrue(off.toString(), off.none { it.contains("is the STRAP's answer") })
+
+        val on = whoop5PairingDumpLines(
+            bondState = 10, didBond = false, helloWrittenThisLink = false,
+            probeOptedIn = true, notifyChars = chars(),
+        )
+        assertTrue(on.toString(), on.any { it.contains("is the STRAP's answer") })
+        assertTrue(on.toString(), on.none { it.contains("by OUR choice") })
+    }
+
+    /** Discovering none is itself a reading, and must not render as an empty section. */
+    @Test
+    fun `no discovered notify chars says so rather than printing nothing`() {
+        val lines = whoop5PairingDumpLines(
+            bondState = 10, didBond = false, helloWrittenThisLink = false,
+            probeOptedIn = false, notifyChars = emptyList(),
+        )
+        assertEquals("  no puffin notify characteristics discovered", lines[1])
+    }
+
+    /**
+     * The note is the honest part: bond state is a proxy, not an encryption reading, and the codes it
+     * names are what actually answer the question. Pinned so a later edit cannot quietly upgrade the
+     * claim to "the link is encrypted", which nothing here knows.
+     */
+    @Test
+    fun `the note refuses to claim an encryption state it cannot read`() {
+        val note = whoop5PairingDumpLines(
+            bondState = 10, didBond = false, helloWrittenThisLink = false,
+            probeOptedIn = false, notifyChars = chars(),
+        ).last()
+        assertTrue(note, note.contains("no link-encryption flag"))
+        assertTrue(note, note.contains("status 5 (insufficient authentication)"))
+        assertTrue(note, note.contains("15 (insufficient encryption)"))
+    }
+
 }
diff --git a/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt b/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
index a89984568b..a199552bce 100644
--- a/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
+++ b/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
@@ -526,4 +526,86 @@ class UnbondedOffloadProbeTest {
         }
     }
 
+    // --- #1949: the probe's skip reason ---------------------------------------------------------------
+
+    /**
+     * The explanation and the gate must agree on EVERY input, or a log line will claim a probe ran that
+     * did not, or stay silent about one that was skipped. Exhaustive rather than sampled because the two
+     * are separate `when` chains over the same seven inputs, and the failure mode is a condition added to
+     * one and forgotten in the other, which no hand-picked case is likely to sit on.
+     */
+    @Test
+    fun `a skip reason is produced exactly when the gate refuses`() {
+        val bools = listOf(false, true)
+        var refusals = 0
+        for (isWhoop5 in bools) for (optedIn in bools) for (bonded in bools)
+            for (hello in bools) for (already in bools) for (refused in bools)
+                for (silent in listOf(0, UNBONDED_PROBE_MAX_SILENT_LINKS)) {
+                    val runs = shouldProbeUnbondedOffload(
+                        isWhoop5 = isWhoop5, optedIn = optedIn, bonded = bonded,
+                        helloWrittenThisLink = hello, alreadyProbedThisLink = already,
+                        previouslyRefused = refused, silentLinksSoFar = silent,
+                    )
+                    val line = unbondedProbeSkippedLine(
+                        isWhoop5 = isWhoop5, optedIn = optedIn, bonded = bonded,
+                        helloWrittenThisLink = hello, alreadyProbedThisLink = already,
+                        previouslyRefused = refused, silentLinksSoFar = silent,
+                    )
+                    assertEquals(
+                        "gate=$runs but line=${line ?: "null"} for isWhoop5=$isWhoop5 optedIn=$optedIn " +
+                            "bonded=$bonded hello=$hello already=$already refused=$refused silent=$silent",
+                        runs, line == null,
+                    )
+                    if (!runs) refusals++
+                }
+        assertTrue("the sweep must actually exercise refusals", refusals > 0)
+    }
+
+    /** The reason printed is the one that DECIDED, so it must follow the gate's own order, not the first
+     *  condition that happens to be true. Every input below is refusing at once. */
+    @Test
+    fun `the reason follows the gate's order when several conditions refuse`() {
+        val line = unbondedProbeSkippedLine(
+            isWhoop5 = false, optedIn = false, bonded = true, helloWrittenThisLink = true,
+            alreadyProbedThisLink = true, previouslyRefused = true, silentLinksSoFar = 99,
+        )
+        assertTrue("family is tested first: $line", line!!.contains("not a WHOOP 5/MG"))
+    }
+
+    @Test
+    fun `the common case names the experiment, and says what it costs`() {
+        val line = unbondedProbeSkippedLine(
+            isWhoop5 = true, optedIn = false, bonded = false, helloWrittenThisLink = false,
+            alreadyProbedThisLink = false, previouslyRefused = false, silentLinksSoFar = 0,
+        )!!
+        assertTrue(line, line.contains("the unbonded-offload experiment is off"))
+        assertTrue("an unbonded 5/MG must be told what stays unsubscribed: $line",
+                   line.contains("puffin notify chars stay unsubscribed"))
+        assertTrue("and that it reaches the IMU producer too: $line", line.contains("realtime IMU"))
+    }
+
+    /** A bonded strap reaches those chars through the ordinary handshake, so the consequence clause would
+     *  be false there. The retirement reasons must also distinguish a latched refusal from a spent budget:
+     *  one is the strap's verdict, the other is ours. */
+    @Test
+    fun `the consequence is omitted when it would not be true, and retirement says which kind`() {
+        val bonded = unbondedProbeSkippedLine(
+            isWhoop5 = true, optedIn = true, bonded = true, helloWrittenThisLink = false,
+            alreadyProbedThisLink = false, previouslyRefused = false, silentLinksSoFar = 0,
+        )!!
+        assertTrue(bonded, !bonded.contains("stay unsubscribed"))
+
+        val refused = unbondedProbeSkippedLine(
+            isWhoop5 = true, optedIn = true, bonded = false, helloWrittenThisLink = false,
+            alreadyProbedThisLink = false, previouslyRefused = true, silentLinksSoFar = 0,
+        )!!
+        assertTrue(refused, refused.contains("a refusal is latched"))
+
+        val spent = unbondedProbeSkippedLine(
+            isWhoop5 = true, optedIn = true, bonded = false, helloWrittenThisLink = false,
+            alreadyProbedThisLink = false, previouslyRefused = false,
+            silentLinksSoFar = UNBONDED_PROBE_MAX_SILENT_LINKS,
+        )!!
+        assertTrue(spent, spent.contains("silent-link budget is spent"))
+    }
 }

From ad7e625ba95ca328a6c4097761b67bcd2bdc2c9d Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 15:28:11 +1200
Subject: [PATCH 306/333] battery: stop asking a 5/MG for battery it refuses to
 answer (#1951)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Option 1 from #1948, and the investigation made it bigger than the issue said.

## What was happening

The keep-alive polled battery commands the 5/MG send allowlist rejects before
they leave the app, under a comment claiming the pack "rides the SAME cadence as
the strap's own gauge".

Android sent `GET_BATTERY_PACK_INFO`, which the allowlist admits only while a
user-initiated probe is in flight:

```
12:31:48  send(GET_BATTERY_PACK_INFO) skipped — no WHOOP 5/MG framing for this command yet
12:32:48  send(GET_BATTERY_PACK_INFO) skipped — no WHOOP 5/MG framing for this command yet
```

40 of them in 40 minutes of one capture: one wasted call and one skip line per
minute.

**iOS was worse than #1948 recorded.** The allowlist has no clause for
`.getBatteryLevel` either, so the whole block was dead rather than half of it:
TWO sends and two skip lines per tick. The issue said "one refused command per
platform"; that was wrong and is corrected there.

A re-review then narrowed WHO pays it. `keepAliveMayRun` refuses an unbonded
5/MG outright, so the tick never fires there and only a BONDED 5/MG was paying.
That correction strengthens the case rather than weakening it, and is why the
comment now argues from co-residence: the same `didBond` that lets this tick run
has already fired `enableLiveNotifications` a few lines above, which drives the
`0x2A19` read a 5/MG's percent comes from. The read and the refused send were
always on the same tick, so dropping the send cannot strand the reading.

## The change

Android drops the pack poll from the WHOOP5 keep-alive branch. iOS makes that
whole battery block WHOOP 4.0 only, which matches `refreshBattery`, already
guarded `if selectedModel.deviceFamily == .whoop4` for the same command.

Nothing is lost:

- the strap's PERCENT comes from the `0x2A19` read both platforms already drive
  off this same keep-alive, on the same tick the removed send rode (iOS throttled
  to `whoop5BatteryReadMinIntervalSeconds`)
- the PACK's charge comes from the pushed pack-info event (109), that flag's only
  writer since #1945
- Android's user-initiated probe path is untouched, and remains how the hardware
  question ("does a 5/MG answer 151 at all?") gets asked

On iOS this leaves opcode 151 with no sender at all, because there is no iOS twin
of that probe. That is not a loss: it restores exactly what `FrameRouter` already
records for its own decoder, "nothing sent the command, so the decoder had no
caller". Noted at the call site so the asymmetry is not rediscovered.

The comments now say what actually happens instead of describing a cadence that
never ran.

## Tests

Both sends live in keep-alive bodies no unit test can drive, so both are pinned
against the source. The Android guard is scoped to the WHOOP5 branch and also
asserts the WHOOP4 poll beside it survives, since this is a 5/MG-only removal
rather than a change to battery polling.

Verified as a NEGATIVE CONTROL rather than assumed: re-adding the Android send
fails the guard, restoring it passes. The Swift guard needed a fix a re-review
caught before CI did: it asserted the block contains no `getBatteryPackInfo`
without stripping comments, while the comment above it names that symbol to
explain why it is not sent, so it would have failed on its own rationale. It
judges the code only now, the rule the Kotlin twin already followed. The Swift guard normalises whitespace on
both sides, because a Swift multiline literal strips indentation to its closing
delimiter and so can never carry the source's own leading spaces — a raw
comparison would have failed for a reason unrelated to the guard.

Android suite 5521 green, doc-comment gate clean. The Swift guard DOES run on
this PR: `app-build.yml` triggers on `Strand/**` and its macOS leg has a
`Test Strand` step, so `StrandTests` executes in CI here.

Worth flagging separately: that path filter lists `Strand/**`, `StrandiOS*/**`,
`Packages/**` and `project.yml`, but NOT `StrandTests/**`. A PR touching only
app-target tests therefore builds and runs nothing, and a broken test file would
merge unverified to fail on the next PR that happens to touch `Strand/**`. This
PR is covered because it edits `BLEManager.swift` too.

## Risk

About as low as it gets: these are sends the allowlist already refused. The
visible effect is less pointless traffic and quieter captures — an iOS Test
Centre connection capture on a 5/MG was carrying roughly two wasted lines a
minute.
---
 Strand/BLE/BLEManager.swift                   | 32 +++++++--
 StrandTests/Whoop5BatteryPollGuardTests.swift | 66 +++++++++++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 16 +++--
 .../com/noop/ble/ChargingAndReleaseTest.kt    | 36 ++++++++++
 4 files changed, 138 insertions(+), 12 deletions(-)
 create mode 100644 StrandTests/Whoop5BatteryPollGuardTests.swift

diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index db8491be66..5a36d5797c 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -4539,13 +4539,33 @@ public final class BLEManager: NSObject, ObservableObject {
         }   // re-arm so it can't lapse
         keepAliveTick += 1
         // #battery: ~60 s normally, ~30 s while charging (see `batteryPollDue`).
-        if BLEManager.batteryPollDue(tick: keepAliveTick, charging: state.charging == true) {
+        //
+        // WHOOP 4.0 ONLY (#1948). Both commands this block used to send are refused on a 5/MG before they
+        // leave the app: the send allowlist has no clause for `.getBatteryLevel` at all, and admits
+        // `.getBatteryPackInfo` only while a user-initiated probe is in flight. Two dead sends and two
+        // skip lines per tick, under a comment claiming the pack "rides the SAME cadence as the strap's
+        // own gauge". It never rode anything.
+        //
+        // Removing them cannot change what a 5/MG receives, and that is the whole argument: the allowlist
+        // refused both before they reached the peripheral, so no reading ever depended on either. Do not
+        // reach for a subtler one. An earlier draft here argued that the `didBond` letting this tick run
+        // had already driven the 0x2A19 read a few lines above, which is wrong twice over —
+        // `keepAliveMayRun` also admits a `bonded && .whoop5` tick with `didBond` false, and
+        // `enableLiveNotifications` is separately gated on `didBond`, so on a #1635 strap the tick fires
+        // and that read does not.
+        //
+        // Which leaves a real divergence, pre-existing and NOT introduced here: Android's keep-alive polls
+        // 0x2A19 for a 5/MG whenever it runs, while this one skips it unless `didBond`. An unbonded 5/MG
+        // therefore gets a periodic battery read on Android and none here. The pack's charge comes from
+        // the pushed pack-info event (109) on both, that flag's only writer since #1945.
+        //
+        // This leaves opcode 151 with NO sender on iOS, which is the state `FrameRouter` already records
+        // for its own decoder ("nothing sent the command, so the decoder had no caller"). Android keeps a
+        // user-initiated probe for it; there is no iOS twin of that, so asking a 5/MG whether it answers
+        // 151 at all is an Android-side question today.
+        if selectedModel.deviceFamily != .whoop5,
+           BLEManager.batteryPollDue(tick: keepAliveTick, charging: state.charging == true) {
             send(.getBatteryLevel, payload: [])
-            // The 5/MG battery pack rides the SAME cadence as the strap's own gauge — it is the same
-            // question about the same physical thing, and a second timer would only be a second thing to
-            // get wrong. 5/MG only: a 4.0 never answers 151 (its pack is voltage-only via 98), so asking
-            // would be traffic with no reply.
-            if selectedModel.deviceFamily == .whoop5 { send(.getBatteryPackInfo, payload: []) }
         }
     }
 
diff --git a/StrandTests/Whoop5BatteryPollGuardTests.swift b/StrandTests/Whoop5BatteryPollGuardTests.swift
new file mode 100644
index 0000000000..baf9cb9e86
--- /dev/null
+++ b/StrandTests/Whoop5BatteryPollGuardTests.swift
@@ -0,0 +1,66 @@
+import XCTest
+@testable import Strand
+
+/// #1948: the 5/MG keep-alive must not send battery commands the allowlist refuses.
+///
+/// Both commands that block used to send are rejected on a 5/MG before they leave the app: the send
+/// allowlist has no clause for `.getBatteryLevel` at all, and admits `.getBatteryPackInfo` only while a
+/// user-initiated probe is in flight. So a 5/MG paid two dead sends and two skip lines per tick, under a
+/// comment claiming the pack "rides the SAME cadence as the strap's own gauge".
+///
+/// A 5/MG needs neither: its percent comes from the 0x2A19 read `enableLiveNotifications` drives off this
+/// same keep-alive, and its pack charge from the pushed pack-info event (109).
+///
+/// Pinned against the SOURCE, the way `DeviceRawSourceParityTests` pins its oracle, because the send sits
+/// in a keep-alive body no unit test can drive. The Kotlin twin guard is in `ChargingAndReleaseTest`.
+final class Whoop5BatteryPollGuardTests: XCTestCase {
+
+    private func managerSource() throws -> String {
+        let root = URL(fileURLWithPath: #filePath).deletingLastPathComponent().deletingLastPathComponent()
+        return try String(contentsOf: root.appendingPathComponent("Strand/BLE/BLEManager.swift"),
+                          encoding: .utf8)
+    }
+
+    /// Whitespace-normalised on both sides. A Swift multiline literal strips indentation to its closing
+    /// delimiter, so a literal written here could never carry the source's own leading spaces, and
+    /// comparing raw text would fail for a reason that has nothing to do with the guard.
+    private func normalised(_ s: String) -> String {
+        s.split(whereSeparator: { $0.isWhitespace }).joined(separator: " ")
+    }
+
+    /// The poll is family-guarded, and the guard is on the SAME statement as the send — a nearby `if`
+    /// that merely reads well would not stop the traffic.
+    func testTheBatteryPollIsGuardedAwayFromWhoop5() throws {
+        let src = try normalised(managerSource())
+        let expected = normalised("""
+            if selectedModel.deviceFamily != .whoop5,
+            BLEManager.batteryPollDue(tick: keepAliveTick, charging: state.charging == true) {
+            send(.getBatteryLevel, payload: [])
+            }
+            """)
+        XCTAssertTrue(src.contains(expected),
+                      "the keep-alive battery poll must be guarded away from the 5/MG (#1948)")
+    }
+
+    /// Nothing may send the pack opcode on a cadence. The user-initiated probe still may, so this asserts
+    /// the absence in the keep-alive rather than in the file, which would forbid the probe too.
+    func testNoCadencedPackInfoSendSurvives() throws {
+        let src = try managerSource()
+        // The WHOLE keep-alive, not just the battery block inside it. Anchoring at the battery comment
+        // covered only what follows it, so a pack send added earlier in the same function would have
+        // slipped past while the assertion still read as if it guarded the tick. The Kotlin twin was
+        // widened for the mirror-image reason, and a control insertion proved it there.
+        guard let start = src.range(of: "private func keepAliveFire() {"),
+              let end = src.range(of: "private func startBackfillTimer") else {
+            return XCTFail("the keep-alive function or its next landmark was not found")
+        }
+        // Comments in this block name the opcode while explaining why it is not sent, so judge the CODE
+        // only — the same rule the Kotlin twin follows. Without this the guard fails on its own rationale.
+        let block = String(src[start.lowerBound..<end.lowerBound])
+            .split(separator: "\n", omittingEmptySubsequences: false)
+            .filter { !$0.trimmingCharacters(in: .whitespaces).hasPrefix("//") }
+            .joined(separator: "\n")
+        XCTAssertFalse(block.contains("getBatteryPackInfo"),
+                       "no part of the keep-alive may send the pack opcode (#1948): \(block)")
+    }
+}
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 44358cc041..09c5a939da 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -8468,12 +8468,16 @@ class WhoopBleClient(
                     // #battery: ~60 s normally, ~30 s while charging (see [batteryPollDue]).
                     if (batteryPollDue(keepAliveTick, s.charging == true)) send(CommandNumber.GET_BATTERY_LEVEL)
                 } else if (connectedFamily == DeviceFamily.WHOOP5) {
-                    // The battery pack rides the SAME cadence as the strap's own gauge — the same question
-                    // about the same physical thing, and a second timer would only be a second thing to get
-                    // wrong. 5/MG only: a 4.0 never answers 151 (its pack is voltage-only via 98).
-                    if (batteryPollDue(keepAliveTick, s.charging == true)) {
-                        send(CommandNumber.GET_BATTERY_PACK_INFO)
-                    }
+                    // NO pack poll here (#1948). This used to send GET_BATTERY_PACK_INFO on the same
+                    // cadence as the gauge, with a comment saying the pack "rides the SAME cadence".
+                    // It never did: the 5/MG send allowlist admits opcode 151 ONLY while a user-initiated
+                    // probe is in flight, so every one of these was refused before it left the app. A
+                    // capture caught 40 of them in 40 minutes, one wasted call and one skip line a minute.
+                    //
+                    // Nothing is lost by not asking. The pack's charge arrives on the pushed pack-info
+                    // event (109), which since #1945 is its only writer, and the STRAP's own percent comes
+                    // from the 0x2A19 read below, not from a command. The probe path is untouched, and
+                    // remains how the hardware question ("does a 5/MG answer 151 at all?") gets asked.
                     // #1865: re-arm a LAPSED realtime stream. The WHOOP4 branch above re-sends
                     // TOGGLE_REALTIME_HR every tick precisely because "the firmware lets the realtime HR
                     // stream lapse if it isn't re-armed" — a 5/MG got none of that, on the reasoning that it
diff --git a/android/app/src/test/java/com/noop/ble/ChargingAndReleaseTest.kt b/android/app/src/test/java/com/noop/ble/ChargingAndReleaseTest.kt
index e29f8446a9..3289c558b0 100644
--- a/android/app/src/test/java/com/noop/ble/ChargingAndReleaseTest.kt
+++ b/android/app/src/test/java/com/noop/ble/ChargingAndReleaseTest.kt
@@ -96,6 +96,42 @@ class ChargingAndReleaseTest {
                     code.contains("charging"))
     }
 
+    // --- #1948: the 5/MG keep-alive asks for nothing it cannot be given ------------------------------
+
+    /**
+     * The WHOOP5 keep-alive branch must not send `GET_BATTERY_PACK_INFO`.
+     *
+     * It did, on the gauge's cadence, under a comment saying the pack "rides the SAME cadence". It never
+     * did: the 5/MG send allowlist admits opcode 151 only while a user-initiated probe is in flight, so
+     * every one was refused before leaving the app — 40 in 40 minutes of one capture. The pack's charge
+     * comes from the pushed event (109) and the strap's percent from the 0x2A19 read, so asking bought
+     * nothing and cost a skip line a minute.
+     *
+     * Pinned against the source, like the pack-event guard above, because the send lives in a keep-alive
+     * body no JVM test can drive. Scoped to the WHOOP5 branch so the WHOOP4 poll beside it is untouched.
+     */
+    @Test
+    fun `the 5MG keepalive does not poll a pack opcode the allowlist refuses`() {
+        val src = clientSource()
+        val start = src.indexOf("} else if (connectedFamily == DeviceFamily.WHOOP5) {")
+        assertTrue("the WHOOP5 keep-alive branch was not found", start > 0)
+        // Ends at the branch's OWN battery poll, not at the nearer #1865 landmark. Stopping there left a
+        // window holding one line of code and the rest comment, so a poll re-added anywhere past it would
+        // have slipped through while the negative control still passed — the control only re-inserts at
+        // the natural spot. This span covers every line between the branch opening and the 0x2A19 read,
+        // which is the whole region a battery send would plausibly be put back into.
+        val end = src.indexOf("5/MG battery comes only from a 0x2A19 read", start)
+        assertTrue("the branch's own battery poll was not found", end > start)
+        val code = src.substring(start, end).lines()
+            .filterNot { it.trim().startsWith("//") }
+            .joinToString("\n")
+        assertFalse("the 5/MG keep-alive must not send GET_BATTERY_PACK_INFO (#1948): $code",
+                    code.contains("GET_BATTERY_PACK_INFO"))
+        // The 4.0 branch keeps its own poll: this is a 5/MG-only removal, not a battery-polling change.
+        assertTrue("the WHOOP4 gauge poll must survive",
+                   src.contains("if (batteryPollDue(keepAliveTick, s.charging == true)) send(CommandNumber.GET_BATTERY_LEVEL)"))
+    }
+
     private fun clientSource(): String {
         var root = java.io.File(System.getProperty("user.dir") ?: ".").canonicalFile
         repeat(4) {

From cdf247c0d7a101875a95741f31fadbc1ed444852 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 15:47:43 +1200
Subject: [PATCH 307/333] ci: trigger the app build on the app-target tests it
 runs (#1955)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Groundwork for #1954. One line in the trigger, no new job.

## The gap

`app-build.yml` runs the app-target tests on its macOS leg:

```yaml
      - name: Test ${{ matrix.scheme }}
        if: matrix.scheme == 'Strand'
```

but its `paths:` listed the sources and not the tests. So a PR touching only
`StrandTests/**` started nothing: a test that failed to compile, or simply
failed, merged unverified and then went red on the next unrelated PR that
happened to touch `Strand/**`.

The mis-attribution is the part that costs time. The PR that turns red is not
the one that broke it, and the person reading that failure has no reason to
suspect a test file merged days earlier.

`project.yml` was already in the list but does not cover this. The target takes
`sources: [StrandTests]`, a directory, so adding a test file changes no other
tracked path.

## Why it is worth a line

`StrandTests` holds the app-target logic the Swift packages cannot reach —
backfill continuation, scheduled-report and strain-target policy — and the
source-guard tests that pin call-site invariants no unit test can drive. Adding
one of those is a routine change and exactly the shape the filter missed.

Found while confirming a new guard test in #1951 would actually run in CI. It
does, but only because that PR also edits `BLEManager.swift`.

## Scope

`StrandTests` is the only app-target test directory in the repo, and
`app-build.yml` is the only workflow listing `Strand/**`, so there is no sibling
with the same gap.

A re-review checked that claim against the other suites rather than assuming it,
and the answer explains the bug: Android CI triggers on `android/**` and its
tests live inside that; the package suites live under `Packages/**`. Both are
already covered by their subject's glob. `StrandTests` is a SIBLING of `Strand/`
rather than part of it, which is why it alone fell outside every path in the
list. That is now in the comment, so whoever adds the next test target knows
which shape needs a trigger entry and which does not.

Costs macOS minutes only on PRs that genuinely change those tests. This PR edits
the workflow, which is itself in the paths, so the change verifies itself.
---
 .github/workflows/app-build.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/workflows/app-build.yml b/.github/workflows/app-build.yml
index 5059dab03f..5778d568d5 100644
--- a/.github/workflows/app-build.yml
+++ b/.github/workflows/app-build.yml
@@ -13,6 +13,18 @@ on:
     branches: [main]
     paths:
       - 'Strand/**'
+      # The app-target TESTS, not just the sources they cover. The `Test Strand` step below runs
+      # StrandTests, but a PR touching only those tests matched nothing here, so it built and ran
+      # nothing: one that failed to compile, or simply failed, merged unverified and went red on the
+      # next unrelated PR that happened to touch `Strand/**`, mis-attributing the breakage to whoever
+      # that was.
+      #
+      # This is the only test directory that needs naming, and the reason is layout rather than
+      # oversight: Android's tests sit under `android/**` and the package suites under `Packages/**`,
+      # both already inside their subject's glob, while StrandTests is a SIBLING of `Strand/` instead
+      # of part of it. `project.yml` does not cover it either — the target takes
+      # `sources: [StrandTests]`, a directory, so adding a test file changes no other tracked path.
+      - 'StrandTests/**'
       - 'StrandiOS/**'
       - 'StrandiOSShared/**'
       - 'StrandiOSWidgets/**'

From 39cbdcd996902517f8bae5971217d888f4bab834 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 16:39:05 +1200
Subject: [PATCH 308/333] widget: heart rate with the recent trace (Android)
 (#1958)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Groundwork for #1957, Android only. iOS is deliberately left out — WidgetKit can
draw the trace directly, so the renderer will not port, and the shared half is
worth agreeing on here first.

## Why it is shaped this way

Glance compiles to RemoteViews, which has no Canvas. A sparkline cannot be drawn
by a composable at all: it has to be rendered to a Bitmap and handed over as an
`Image`. So the work splits, and the split is the design:

- **`HrTrace`** — everything decidable WITHOUT a Canvas. Retention (one point per
  minute over three hours, capped), encode/decode, stats, normalisation into the
  pixel box, and the tick choices. Pure, 16 tests.
- **`HrTraceRenderer`** — deliberately stupid. `moveTo`/`lineTo` over coordinates
  handed to it. It chooses no tick, no range and no point, because a Bitmap is
  not something a JVM test can assert about and as little as possible should
  depend on one.

The LABELS are not in the bitmap either, though the design has them. They are
Glance `Text`, so they stay crisp at any density, themed light and dark with the
rest of the widget, and legible to TalkBack — none of which a baked-in label
would be.

RemoteViews carries its payload over a Binder transaction with a hard size limit,
and a widget that exceeds it does not degrade, it fails to render. Hence the
bitmap cap.

## No producer changed

`WidgetSnapshotStore` folds each live sample into the trace in `save` and returns
it pruned from `load`, so `WhoopConnectionService` and `AppViewModel` did not have
to learn about it. That is affordable because `PushGate` already throttles an
unchanged key to about once a minute, which is exactly the bucket size the trace
keeps — the read-modify-write runs about once per point, not once per sample.

`PushGate`'s key is explicit field concatenation, so adding a field to the
snapshot does not perturb throttling.

## The tested cases are the ordinary ones

Not exotic — these are what a home screen actually does:

- a widget placed mid-afternoon has exactly ONE point: it draws a dot, rather
  than an empty chart that reads as "no data"
- a resting arm holds one bpm for minutes: a zero range runs down the vertical
  MIDDLE, not pinned to an edge where it would read as a flatlined or maxed-out
  heart
- a backwards clock cannot grow the series past its cap
- a malformed stored series degrades to a partial trace instead of throwing on
  the render path, where the alternative is a crashed home screen
- time ticks anchor to the DATA, not the window, so forty minutes of history does
  not get labelled with two hours that were never sampled

## Two choices worth vetoing

- The trace is **red**, the app's heart colour, rather than the blue of the
  design that prompted this.
- **4x2 cells**, wider than the 2x2 score widget, because a trace needs
  horizontal room to be readable.

## Verification

Full Android suite 5537 green, i18n audit clean, doc-comment lint clean. Four new
strings across all seven Android locales — a `GermanLocalizationTest` failure is
what caught that the set is seven, not the four I had assumed.

**Not verified on a device.** The bitmap path is exactly the kind of thing that
looks right in code and wrong on a launcher, so this wants a testing build and a
home screen before it is trusted.

## What review passes changed after the first push

Five, and none of them were reachable from the tests, which is the useful part:

- the bitmap caps were per-DIMENSION, so 1080x480 was legal at 1.98 MB against a
  Binder ceiling near one; and the geometry ran at the requested width while the
  renderer clamped its own, silently clipping the right of the trace. One box,
  decided on bytes, now serves both.
- `timeTicks` was written, documented and TESTED, then never called. The design
  has time labels and the widget did not draw them.
- the bpm scale was stacked from the top with fixed gaps, so it was three numbers
  near a chart rather than a scale aligned to it.
- the empty state reserved chart height to draw nothing, which on upgrade is a
  blank rectangle for the first few minutes.
- TalkBack read the widget as noise, and staleness was carried ONLY by a dimmed
  colour, so a carried-over reading was announced as current. Fixed the way the
  sibling widget settled the same thing in #1799.

The i18n echo gate then caught Min/Max being identical to English in de and fr.
Running `Tools/i18n_audit.py` bare exits 0; the workflow runs it with `--ci` and a
base ref, and only that applies the echo and coverage gates.
---
 android/app/src/main/AndroidManifest.xml      |  14 +
 .../java/com/noop/widget/HrGlanceWidget.kt    | 311 ++++++++++++++++++
 .../src/main/java/com/noop/widget/HrTrace.kt  | 184 +++++++++++
 .../java/com/noop/widget/HrTraceRenderer.kt   |  97 ++++++
 .../java/com/noop/widget/HrWidgetReceiver.kt  |   9 +
 .../java/com/noop/widget/WidgetSnapshot.kt    |  38 ++-
 .../app/src/main/res/values-de/strings.xml    |   4 +
 .../app/src/main/res/values-es/strings.xml    |   4 +
 .../app/src/main/res/values-fr/strings.xml    |   4 +
 .../app/src/main/res/values-pl/strings.xml    |   4 +
 .../src/main/res/values-pt-rPT/strings.xml    |   4 +
 .../app/src/main/res/values-ru/strings.xml    |   4 +
 .../app/src/main/res/values-zh/strings.xml    |   4 +
 android/app/src/main/res/values/strings.xml   |   4 +
 .../app/src/main/res/xml/hr_widget_info.xml   |  15 +
 .../test/java/com/noop/widget/HrTraceTest.kt  | 189 +++++++++++
 16 files changed, 886 insertions(+), 3 deletions(-)
 create mode 100644 android/app/src/main/java/com/noop/widget/HrGlanceWidget.kt
 create mode 100644 android/app/src/main/java/com/noop/widget/HrTrace.kt
 create mode 100644 android/app/src/main/java/com/noop/widget/HrTraceRenderer.kt
 create mode 100644 android/app/src/main/java/com/noop/widget/HrWidgetReceiver.kt
 create mode 100644 android/app/src/main/res/xml/hr_widget_info.xml
 create mode 100644 android/app/src/test/java/com/noop/widget/HrTraceTest.kt

diff --git a/android/app/src/main/AndroidManifest.xml b/android/app/src/main/AndroidManifest.xml
index 26bc33b1cd..3ce804c414 100644
--- a/android/app/src/main/AndroidManifest.xml
+++ b/android/app/src/main/AndroidManifest.xml
@@ -291,6 +291,20 @@
                 android:resource="@xml/noop_compact_widget_info" />
         </receiver>
 
+        <!-- Heart-rate widget (#1957): live bpm with the last three hours as a trace. Same snapshot
+             source as the score widgets; the trace is a Bitmap because Glance cannot draw one. -->
+        <receiver
+            android:name="com.noop.widget.HrWidgetReceiver"
+            android:exported="true"
+            android:label="@string/widget_hr_name">
+            <intent-filter>
+                <action android:name="android.appwidget.action.APPWIDGET_UPDATE" />
+            </intent-filter>
+            <meta-data
+                android:name="android.appwidget.provider"
+                android:resource="@xml/hr_widget_info" />
+        </receiver>
+
         <!-- K10: Coach brief home-screen widget. Shows the stored morning brief (generated on a
              schedule by CoachBriefScheduler, K5) — never live-networked. Tap → opens the app. -->
         <receiver
diff --git a/android/app/src/main/java/com/noop/widget/HrGlanceWidget.kt b/android/app/src/main/java/com/noop/widget/HrGlanceWidget.kt
new file mode 100644
index 0000000000..62b9f3d9a5
--- /dev/null
+++ b/android/app/src/main/java/com/noop/widget/HrGlanceWidget.kt
@@ -0,0 +1,311 @@
+package com.noop.widget
+
+import android.content.Context
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.graphics.toArgb
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
+import androidx.glance.GlanceId
+import androidx.glance.GlanceModifier
+import androidx.glance.Image
+import androidx.glance.ColorFilter
+import androidx.glance.ImageProvider
+import androidx.glance.LocalContext
+import androidx.glance.LocalSize
+import androidx.glance.action.actionStartActivity
+import androidx.glance.action.clickable
+import androidx.glance.appwidget.GlanceAppWidget
+import androidx.glance.appwidget.cornerRadius
+import androidx.glance.appwidget.provideContent
+import androidx.glance.background
+import androidx.glance.layout.Alignment
+import androidx.glance.layout.Box
+import androidx.glance.layout.Column
+import androidx.glance.layout.Row
+import androidx.glance.layout.Spacer
+import androidx.glance.layout.fillMaxSize
+import androidx.glance.layout.fillMaxWidth
+import androidx.glance.layout.height
+import androidx.glance.layout.padding
+import androidx.glance.layout.width
+import androidx.glance.semantics.contentDescription
+import androidx.glance.semantics.semantics
+import androidx.glance.text.FontWeight
+import androidx.glance.text.Text
+import androidx.glance.text.TextStyle
+import androidx.glance.unit.ColorProvider
+import com.noop.R
+import com.noop.ui.MainActivity
+import com.noop.ui.uiString
+import java.text.DateFormat
+import java.util.Date
+
+/**
+ * Home-screen widget: the live heart rate with the last [HrTrace.WINDOW_SEC] drawn as a trace (#1957).
+ *
+ * Renders purely from the [WidgetSnapshotStore] snapshot, like its siblings — no BLE, no DB — so it
+ * costs nothing and survives process death. Tapping opens the app.
+ *
+ * The trace is an IMAGE because Glance compiles to RemoteViews, which cannot draw. [HrTrace] decides
+ * where the ink goes and [HrTraceRenderer] puts it on a Bitmap; the labels around it stay Glance `Text`
+ * so they remain crisp, themed and readable to TalkBack.
+ *
+ * Honest-blank throughout: no reading means "—" and no chart, never a flat line at zero. A trace with a
+ * single point draws a dot rather than nothing, because a widget placed this minute has exactly one.
+ */
+class HrGlanceWidget : GlanceAppWidget() {
+
+    override suspend fun provideGlance(context: Context, id: GlanceId) {
+        val snap = runCatching { WidgetSnapshotStore.load(context) }.getOrDefault(WidgetSnapshot())
+        val dark = runCatching {
+            when (context.getSharedPreferences("noop_prefs", Context.MODE_PRIVATE)
+                .getString("theme.appearance", "system")) {
+                "light" -> false
+                "dark" -> true
+                else -> (context.resources.configuration.uiMode and
+                    android.content.res.Configuration.UI_MODE_NIGHT_MASK) ==
+                    android.content.res.Configuration.UI_MODE_NIGHT_YES
+            }
+        }.getOrDefault(true)
+        provideContent { HrWidgetContent(snap, dark) }
+    }
+
+    /** Same defence as [NoopGlanceWidget.onCompositionError]: swap Glance's built-in error layout for
+     *  ours. The widget heals on the next successful push. */
+    override fun onCompositionError(
+        context: Context,
+        glanceId: GlanceId,
+        appWidgetId: Int,
+        throwable: Throwable,
+    ) {
+        runCatching {
+            val rv = android.widget.RemoteViews(context.packageName, R.layout.noop_widget_error)
+            android.appwidget.AppWidgetManager.getInstance(context).updateAppWidget(appWidgetId, rv)
+        }
+    }
+}
+
+// Local widget colours, mirroring the siblings rather than reading Palette: Glance composes outside the
+// app theme, so every widget in this package carries its own copy on purpose.
+private fun hrSurface(dark: Boolean) = ColorProvider(if (dark) Color(0xFF0A1322) else Color(0xFFF4F1EA))
+private fun hrTextPrimary(dark: Boolean) = ColorProvider(if (dark) Color(0xFFF4F6F8) else Color(0xFF1A2230))
+private fun hrTextSecondary(dark: Boolean) = ColorProvider(if (dark) Color(0xFF8A94A4) else Color(0xFF7C8696))
+
+/** Card padding, both sides. The chart and the axis under it must subtract the SAME figure or the
+ *  labels drift out of line with the trace they annotate. */
+private const val HR_CARD_PADDING_DP = 28f
+
+/** The bpm scale column plus its gap. Same reasoning: one number, read by both. Two copies of a layout
+ *  constant is how a chart and its axis end up a few pixels out of step. */
+private const val HR_SCALE_COLUMN_DP = 34f
+
+/** The chart width for a given widget width — the one place that arithmetic happens. */
+private fun hrChartWidthDp(widthDp: Float): Float =
+    (widthDp - HR_CARD_PADDING_DP - HR_SCALE_COLUMN_DP).coerceAtLeast(24f)
+
+/** The trace tint. A heart reads red in this app's language, not the screenshot's blue. */
+private fun hrAccent(dark: Boolean) = if (dark) Color(0xFFE0662F) else Color(0xFFC84E1E)
+
+@Composable
+private fun HrWidgetContent(snap: WidgetSnapshot, dark: Boolean) {
+    val context = LocalContext.current
+    val size = LocalSize.current
+    val stats = HrTrace.stats(snap.hrSeries)
+
+    Column(
+        modifier = GlanceModifier
+            .fillMaxSize()
+            .background(hrSurface(dark))
+            .cornerRadius(16.dp)
+            .padding(14.dp)
+            .clickable(actionStartActivity<MainActivity>()),
+    ) {
+        Row(verticalAlignment = Alignment.Vertical.CenterVertically) {
+            // The notification heart, reused. It is authored as a solid alpha mask for exactly this kind
+            // of single-colour tinting, so it takes the accent cleanly.
+            Image(
+                provider = ImageProvider(R.drawable.ic_stat_heart),
+                contentDescription = null,
+                modifier = GlanceModifier.width(14.dp).height(14.dp),
+                colorFilter = ColorFilter.tint(ColorProvider(hrAccent(dark))),
+            )
+            Spacer(GlanceModifier.width(6.dp))
+            Text(
+                text = uiString(R.string.l10n_noop_glance_widget_heart_rate_410aa15c),
+                style = TextStyle(
+                    color = hrTextPrimary(dark), fontSize = 13.sp, fontWeight = FontWeight.Medium,
+                ),
+            )
+        }
+        Spacer(GlanceModifier.height(6.dp))
+
+        // Built OUT here, not inside the semantics lambda: #571 recorded that the i18n audit cannot see
+        // copy assigned inside one, so a literal written there ships English to every locale. The bare
+        // number alone left TalkBack reading "69" with no unit and no idea what it measured.
+        val hrLabel = uiString(R.string.l10n_noop_glance_widget_heart_rate_410aa15c)
+        // Staleness is drawn ONLY by dimming the number, which is a colour-only channel — so TalkBack,
+        // and anyone who cannot perceive the dim, was told a carried-over reading was current. Marked on
+        // the LIVE side, exactly as the sibling widget settled it (#1799): a stale value then carries no
+        // claim rather than a contradicted one.
+        val liveSuffix =
+            if (snap.heartRateStale) "" else " " + uiString(R.string.l10n_today_screen_sync_chip_live_98aadb37)
+        val hrSpoken = snap.heartRate
+            ?.let {
+                "$hrLabel " + uiString(R.string.l10n_today_screen_value_bpm_8f3a90c3, it.toString()) + liveSuffix
+            }
+            ?: hrLabel
+
+        Row(verticalAlignment = Alignment.Vertical.Bottom) {
+            Text(
+                text = snap.heartRate?.toString() ?: "—",
+                style = TextStyle(
+                    color = if (snap.heartRateStale) hrTextSecondary(dark) else hrTextPrimary(dark),
+                    fontSize = 30.sp,
+                    fontWeight = FontWeight.Bold,
+                ),
+                modifier = GlanceModifier.semantics { contentDescription = hrSpoken },
+            )
+            if (snap.heartRate != null) {
+                Spacer(GlanceModifier.width(4.dp))
+                Text(
+                    // The existing unit resource, not a literal. The audit did not flag one here, but it
+                    // has known blind spots and the string already exists translated.
+                    text = uiString(R.string.today_unit_bpm),
+                    style = TextStyle(color = hrTextSecondary(dark), fontSize = 12.sp),
+                )
+            }
+            if (stats != null) {
+                Spacer(GlanceModifier.width(10.dp))
+                // A chip, not loose text: it is a summary OF the chart, and the tinted rounded ground is
+                // what separates it from the unit label sitting next to it.
+                Text(
+                    text = uiString(R.string.l10n_hr_glance_widget_min_lo_max_hi_ef900e49, stats.min, stats.max),
+                    style = TextStyle(color = hrTextPrimary(dark), fontSize = 11.sp),
+                    modifier = GlanceModifier
+                        .background(ColorProvider(hrAccent(dark).copy(alpha = 0.18f)))
+                        .cornerRadius(10.dp)
+                        .padding(horizontal = 8.dp, vertical = 3.dp),
+                )
+            }
+        }
+
+        // No series, no chart row at all. On upgrade every existing install has a heart rate in prefs
+        // but no trace yet, and reserving the height for it would show a blank rectangle for the first
+        // few minutes — a void reads as broken where a shorter widget reads as new.
+        if (snap.hrSeries.isNotEmpty()) {
+            Spacer(GlanceModifier.height(8.dp))
+            HrTraceImage(snap, dark, widthDp = size.width.value, heightDp = 56f)
+            HrTimeAxis(snap, dark, widthDp = size.width.value)
+        }
+
+        if (snap.updatedAtMs > 0) {
+            Spacer(GlanceModifier.height(6.dp))
+            val time = DateFormat.getTimeInstance(DateFormat.SHORT).format(Date(snap.updatedAtMs))
+            Row(
+                modifier = GlanceModifier.fillMaxWidth(),
+                horizontalAlignment = Alignment.Horizontal.CenterHorizontally,
+            ) {
+                Text(
+                    text = uiString(R.string.l10n_hr_glance_widget_updated_time_1b5feedb, time),
+                    style = TextStyle(color = hrTextSecondary(dark), fontSize = 10.sp),
+                )
+            }
+        }
+    }
+}
+
+/**
+ * The trace, plus the bpm scale down its right edge.
+ *
+ * Bitmap construction is wrapped: an OOM or a hostile size must leave the widget without a chart, not
+ * without a widget. `size.width` is the WIDGET's width, so the chart is sized from what the launcher
+ * actually gave us rather than from a guess.
+ */
+@Composable
+private fun HrTraceImage(snap: WidgetSnapshot, dark: Boolean, widthDp: Float, heightDp: Float) {
+    val context = LocalContext.current
+    val stats = HrTrace.stats(snap.hrSeries)
+    val density = context.resources.displayMetrics.density
+    // Leave room for the scale column so the trace is not drawn under its own labels.
+    val chartWidthDp = hrChartWidthDp(widthDp)
+    // ONE box for both the geometry and the bitmap. Sizing them separately let the trace be drawn to
+    // coordinates the bitmap did not have room for, clipping its right-hand end (#1957).
+    val (wPx, hPx) = HrTrace.fitBox((chartWidthDp * density).toInt(), (heightDp * density).toInt())
+
+    val bmp = runCatching {
+        HrTraceRenderer.render(
+            points = HrTrace.points(snap.hrSeries, wPx.toFloat(), hPx.toFloat()),
+            widthPx = wPx,
+            heightPx = hPx,
+            lineColor = hrAccent(dark).toArgb(),
+            fillTopColor = hrAccent(dark).copy(alpha = 0.35f).toArgb(),
+            strokePx = 2f * density,
+        )
+    }.getOrNull()
+
+    Row(modifier = GlanceModifier.fillMaxWidth()) {
+        Box(modifier = GlanceModifier.height(heightDp.dp).width(chartWidthDp.dp)) {
+            if (bmp != null) {
+                Image(
+                    provider = ImageProvider(bmp),
+                    contentDescription = null,
+                    modifier = GlanceModifier.fillMaxSize(),
+                )
+            }
+        }
+        if (stats != null) {
+            Spacer(GlanceModifier.width(6.dp))
+            // Spread across the chart's height so max sits level with the top of the trace and min with
+            // the bottom, which is what makes it a SCALE. Stacked from the top with fixed gaps they were
+            // just three numbers near the chart, aligned to nothing.
+            Column(
+                modifier = GlanceModifier.height(heightDp.dp),
+                horizontalAlignment = Alignment.Horizontal.End,
+            ) {
+                val ticks = HrTrace.bpmTicks(stats)
+                // Spoken WITH the unit. The previous description was the bare number the label already
+                // shows, which is exactly as useful as none: TalkBack announced "84, 72, 59" against a
+                // chart it cannot see. Glance has no way to mark a Text decorative, so the next best
+                // thing is to make each one say what it measures.
+                val spoken = ticks.map { uiString(R.string.l10n_today_screen_value_bpm_8f3a90c3, it.toString()) }
+                ticks.forEachIndexed { i, tick ->
+                    Text(
+                        text = tick.toString(),
+                        style = TextStyle(color = hrTextSecondary(dark), fontSize = 10.sp),
+                        modifier = GlanceModifier.semantics { contentDescription = spoken[i] },
+                    )
+                    if (i < ticks.size - 1) Spacer(GlanceModifier.defaultWeight())
+                }
+            }
+        }
+    }
+}
+
+/**
+ * The time labels under the trace: first, middle and last of the DATA (see [HrTrace.timeTicks]).
+ *
+ * Spread with weighted spacers rather than fixed gaps, so the middle label sits over the middle of the
+ * chart whatever width the launcher gave the widget. Formatted through the locale's short time format,
+ * so a 12-hour device reads as one — a widget is not the place to impose a clock convention.
+ *
+ * Degrades with the ticks: under a minute of history there is one instant to name, and naming it three
+ * times would suggest a span that was never sampled.
+ */
+@Composable
+private fun HrTimeAxis(snap: WidgetSnapshot, dark: Boolean, widthDp: Float) {
+    val ticks = HrTrace.timeTicks(snap.hrSeries)
+    if (ticks.isEmpty()) return
+    val fmt = DateFormat.getTimeInstance(DateFormat.SHORT)
+    val chartWidthDp = hrChartWidthDp(widthDp)
+    Spacer(GlanceModifier.height(2.dp))
+    Row(modifier = GlanceModifier.width(chartWidthDp.dp)) {
+        ticks.forEachIndexed { i, ts ->
+            Text(
+                text = fmt.format(Date(ts * 1000)),
+                style = TextStyle(color = hrTextSecondary(dark), fontSize = 9.sp),
+            )
+            if (i < ticks.size - 1) Spacer(GlanceModifier.defaultWeight())
+        }
+    }
+}
diff --git a/android/app/src/main/java/com/noop/widget/HrTrace.kt b/android/app/src/main/java/com/noop/widget/HrTrace.kt
new file mode 100644
index 0000000000..aa8c6872cf
--- /dev/null
+++ b/android/app/src/main/java/com/noop/widget/HrTrace.kt
@@ -0,0 +1,184 @@
+package com.noop.widget
+
+/** One point on the widget's heart-rate trace: when it was taken, and the bpm. */
+data class HrPoint(val ts: Long, val bpm: Int)
+
+/**
+ * The pure half of the heart-rate widget: what the trace CONTAINS and where its ink goes.
+ *
+ * Split from the drawing because Glance cannot draw. A sparkline has to be rendered to a Bitmap and
+ * handed over as an Image, and a Bitmap is not something a JVM test can meaningfully assert about — so
+ * everything decidable without a Canvas lives here, unit-tested, and the renderer is left with nothing
+ * but `moveTo`/`lineTo` over coordinates this file produced.
+ *
+ * Also the shape an iOS twin would share. SwiftUI can draw the trace directly, so the renderer will not
+ * port, but the retention rule, the tick choices and the normalisation are the same decisions on both
+ * platforms and should not be made twice.
+ */
+object HrTrace {
+
+    /** How much history the trace shows. Three hours matches what fits legibly at widget width. */
+    const val WINDOW_SEC: Long = 3 * 60 * 60
+
+    /** One point per minute. The strap streams ~1/s; keeping every sample would put 10 800 points behind
+     *  a trace 300 pixels wide, which costs prefs space and buys nothing the eye can resolve. */
+    const val BUCKET_SEC: Long = 60
+
+    /** Hard cap, so a clock jump backwards cannot grow the series without bound. WINDOW_SEC/BUCKET_SEC
+     *  is 180; the slack absorbs a boundary point without letting the list run away. */
+    const val MAX_POINTS: Int = 200
+
+    /**
+     * Fold a fresh reading into the series: one point per minute bucket, newest wins within a bucket.
+     *
+     * Newest-wins rather than an average because the widget's headline number is the LATEST bpm, and a
+     * trace whose last point disagreed with the number printed above it would read as a bug. Within a
+     * minute the difference is a beat or two.
+     */
+    fun append(series: List<HrPoint>, ts: Long, bpm: Int, nowSec: Long = ts): List<HrPoint> {
+        if (bpm <= 0) return prune(series, nowSec)
+        val bucket = ts / BUCKET_SEC * BUCKET_SEC
+        val out = ArrayList<HrPoint>(series.size + 1)
+        for (p in series) if (p.ts != bucket) out.add(p)
+        out.add(HrPoint(bucket, bpm))
+        out.sortBy { it.ts }
+        return prune(out, nowSec)
+    }
+
+    /** Drop anything older than the window, then anything beyond the cap (oldest first). */
+    fun prune(series: List<HrPoint>, nowSec: Long): List<HrPoint> {
+        val floor = nowSec - WINDOW_SEC
+        val kept = series.filter { it.ts >= floor }.sortedBy { it.ts }
+        return if (kept.size <= MAX_POINTS) kept else kept.subList(kept.size - MAX_POINTS, kept.size)
+    }
+
+    /** `ts:bpm` pairs, comma separated. Compact enough that 200 points sit well inside a prefs string,
+     *  and readable in a bug report, which a binary blob would not be. */
+    fun encode(series: List<HrPoint>): String =
+        series.joinToString(",") { "${it.ts}:${it.bpm}" }
+
+    /** Tolerant by design: a malformed pair is skipped rather than throwing. This runs on the widget's
+     *  render path, where the alternative to a partial trace is a crashed home screen. */
+    fun decode(s: String?): List<HrPoint> {
+        if (s.isNullOrBlank()) return emptyList()
+        val out = ArrayList<HrPoint>()
+        for (part in s.split(',')) {
+            val i = part.indexOf(':')
+            if (i <= 0 || i == part.length - 1) continue
+            val ts = part.substring(0, i).toLongOrNull() ?: continue
+            val bpm = part.substring(i + 1).toIntOrNull() ?: continue
+            if (bpm > 0) out.add(HrPoint(ts, bpm))
+        }
+        out.sortBy { it.ts }
+        return out
+    }
+
+    /** The three numbers the header shows. Null when there is nothing to describe. */
+    data class Stats(val min: Int, val max: Int, val latest: Int)
+
+    fun stats(series: List<HrPoint>): Stats? {
+        if (series.isEmpty()) return null
+        var lo = series[0].bpm
+        var hi = series[0].bpm
+        for (p in series) {
+            if (p.bpm < lo) lo = p.bpm
+            if (p.bpm > hi) hi = p.bpm
+        }
+        return Stats(min = lo, max = hi, latest = series.last().bpm)
+    }
+
+
+    /**
+     * The largest drawing box that fits the widget payload budget, keeping the requested aspect.
+     *
+     * RemoteViews travels to the launcher over a BINDER TRANSACTION with a hard size ceiling, and a
+     * widget that exceeds it does not degrade — it fails to render at all. An ARGB_8888 bitmap costs
+     * four bytes a pixel, so a 300dp-wide chart on a 4x screen is already about a megabyte on its own,
+     * before the rest of the RemoteViews. Dimension caps alone do not express that: the constraint is
+     * AREA, and a wide-and-short box and a tall-and-narrow one can both be legal while their product
+     * is not.
+     *
+     * Downscaling is nearly free here in a way it would not be for text or an icon: a sparkline is a
+     * smooth line, and the `Image` stretches the result back to the same slot, so the only cost is a
+     * fractionally softer stroke.
+     *
+     * Returned as the box BOTH [points] and the renderer must use. They used to disagree — geometry ran
+     * at the requested width while the renderer clamped its own — which silently clipped the right-hand
+     * end of the trace on any screen large enough to hit the cap.
+     */
+    fun fitBox(widthPx: Int, heightPx: Int, maxBytes: Int = MAX_BITMAP_BYTES): Pair<Int, Int> {
+        val w = widthPx.coerceAtLeast(1)
+        val h = heightPx.coerceAtLeast(1)
+        val bytes = w.toLong() * h.toLong() * 4L
+        if (bytes <= maxBytes) return w to h
+        val scale = Math.sqrt(maxBytes.toDouble() / bytes.toDouble())
+        return (w * scale).toInt().coerceAtLeast(1) to (h * scale).toInt().coerceAtLeast(1)
+    }
+
+    /** The bitmap's byte budget. Half a megabyte leaves the rest of the RemoteViews comfortable inside
+     *  the transaction ceiling, and still affords a full-density chart on an ordinary phone. */
+    const val MAX_BITMAP_BYTES: Int = 512 * 1024
+
+    /** A point in the trace's pixel box, origin top-left, as the renderer wants it. */
+    data class Pt(val x: Float, val y: Float)
+
+    /**
+     * The trace as pixels inside a `width` x `height` box.
+     *
+     * Two degenerate shapes decide most of this, and both are ordinary rather than exotic — a widget
+     * placed mid-afternoon has one point, and a resting arm holds one bpm for minutes at a time:
+     *
+     *  - ONE point, or every point at the same instant: there is no time axis to spread across, so it
+     *    sits at the left edge rather than at x=NaN.
+     *  - every bpm equal: there is no range to scale into, so the line runs along the VERTICAL MIDDLE.
+     *    Pinning it to the top or bottom would read as a maxed-out or flatlined heart.
+     *
+     * Y is flipped on the way out: bpm rises upward, pixels rise downward.
+     */
+    fun points(series: List<HrPoint>, width: Float, height: Float): List<Pt> {
+        if (series.isEmpty() || width <= 0f || height <= 0f) return emptyList()
+        val t0 = series.first().ts
+        val t1 = series.last().ts
+        val span = (t1 - t0).toFloat()
+        var lo = series[0].bpm
+        var hi = series[0].bpm
+        for (p in series) {
+            if (p.bpm < lo) lo = p.bpm
+            if (p.bpm > hi) hi = p.bpm
+        }
+        val range = (hi - lo).toFloat()
+        return series.map { p ->
+            val x = if (span <= 0f) 0f else (p.ts - t0) / span * width
+            val y = if (range <= 0f) height / 2f else height - (p.bpm - lo) / range * height
+            Pt(x, y)
+        }
+    }
+
+    /**
+     * The three bpm labels down the right edge: max, midpoint, min, exactly as they are stacked in the
+     * chart. Returned high-to-low so the caller can lay them out top-down without re-sorting.
+     *
+     * A flat series returns the same number three times rather than an invented spread — the honest
+     * reading of a steady heart is one number, and manufacturing 58/59/60 around it would put ticks on
+     * the chart that no sample supports.
+     */
+    fun bpmTicks(stats: Stats): List<Int> =
+        listOf(stats.max, (stats.min + stats.max + 1) / 2, stats.min)
+
+    /**
+     * The three timestamps along the bottom: first, middle, last of the DATA, not of the window.
+     *
+     * Anchored to the data because a widget holding forty minutes of history would otherwise label its
+     * axis with two hours that were never sampled, and the trace would appear crushed into the right
+     * third of a mostly empty chart. Fewer than three distinct instants returns what there is, so the
+     * renderer draws one label rather than three copies of it.
+     */
+    fun timeTicks(series: List<HrPoint>): List<Long> {
+        if (series.isEmpty()) return emptyList()
+        val first = series.first().ts
+        val last = series.last().ts
+        if (first == last) return listOf(first)
+        val mid = first + (last - first) / 2
+        return if (mid == first || mid == last) listOf(first, last) else listOf(first, mid, last)
+    }
+}
diff --git a/android/app/src/main/java/com/noop/widget/HrTraceRenderer.kt b/android/app/src/main/java/com/noop/widget/HrTraceRenderer.kt
new file mode 100644
index 0000000000..770971d8d5
--- /dev/null
+++ b/android/app/src/main/java/com/noop/widget/HrTraceRenderer.kt
@@ -0,0 +1,97 @@
+package com.noop.widget
+
+import android.graphics.Bitmap
+import android.graphics.Canvas
+import android.graphics.LinearGradient
+import android.graphics.Paint
+import android.graphics.Path
+import android.graphics.Shader
+
+/**
+ * Draws the heart-rate trace to a Bitmap, because Glance cannot draw one.
+ *
+ * Glance compiles to RemoteViews, which has no Canvas and no arbitrary shapes — a sparkline can only
+ * reach a widget as an Image. So this exists, and it is kept deliberately STUPID: every decision worth
+ * testing was already made in [HrTrace], and what remains is `moveTo`/`lineTo` over coordinates handed
+ * in. Nothing here chooses a tick, a range, or a point.
+ *
+ * The LABELS are not drawn here either, though the design has them. They are Glance `Text` in the
+ * composable instead, which keeps them crisp at any density, themeable with the rest of the widget, and
+ * legible to TalkBack — none of which a label baked into a bitmap would be.
+ */
+internal object HrTraceRenderer {
+
+    /**
+     * @param points from [HrTrace.points], already normalised into the box
+     * @return the trace, or null when there is nothing to draw or the box is degenerate — the caller
+     *         shows the empty state rather than an empty image.
+     */
+    fun render(
+        points: List<HrTrace.Pt>,
+        widthPx: Int,
+        heightPx: Int,
+        lineColor: Int,
+        fillTopColor: Int,
+        strokePx: Float,
+    ): Bitmap? {
+        if (points.isEmpty()) return null
+        // The caller sized this with [HrTrace.fitBox], which owns the payload budget. Clamping to a
+        // DIFFERENT ceiling here is what previously let the geometry and the bitmap disagree, so this
+        // only guards against a nonsense box, and re-checks the budget rather than re-deciding it.
+        val w = widthPx.coerceAtLeast(1)
+        val h = heightPx.coerceAtLeast(1)
+        if (w < 2 || h < 2) return null
+        if (w.toLong() * h.toLong() * 4L > HrTrace.MAX_BITMAP_BYTES) return null
+
+        val bmp = runCatching {
+            Bitmap.createBitmap(w, h, Bitmap.Config.ARGB_8888)
+        }.getOrNull() ?: return null
+        val canvas = Canvas(bmp)
+
+        // Inset by the stroke so a point sitting exactly on the top or bottom edge is not shaved in
+        // half. The geometry maps the extremes to 0 and `height`, which is correct for a line of zero
+        // width and half a stroke short of it for a real one.
+        val inset = strokePx / 2f
+        val usableH = (h - strokePx).coerceAtLeast(1f)
+        fun px(p: HrTrace.Pt) = p.x to (inset + p.y / h * usableH)
+
+        val line = Path()
+        points.forEachIndexed { i, p ->
+            val (x, y) = px(p)
+            if (i == 0) line.moveTo(x, y) else line.lineTo(x, y)
+        }
+
+        // A single point has no line to stroke, so give it a dot — otherwise a widget placed this
+        // minute renders as an empty chart, which reads as "no data" rather than "one reading".
+        if (points.size == 1) {
+            val (x, y) = px(points[0])
+            canvas.drawCircle(x.coerceAtLeast(strokePx), y, strokePx, Paint().apply {
+                isAntiAlias = true
+                color = lineColor
+            })
+            return bmp
+        }
+
+        // Fill first, so the stroke sits on top of its own gradient rather than under it.
+        val fill = Path(line)
+        fill.lineTo(points.last().x, h.toFloat())
+        fill.lineTo(points.first().x, h.toFloat())
+        fill.close()
+        canvas.drawPath(fill, Paint().apply {
+            isAntiAlias = true
+            shader = LinearGradient(
+                0f, 0f, 0f, h.toFloat(), fillTopColor, fillTopColor and 0x00FFFFFF, Shader.TileMode.CLAMP,
+            )
+        })
+
+        canvas.drawPath(line, Paint().apply {
+            isAntiAlias = true
+            style = Paint.Style.STROKE
+            strokeWidth = strokePx
+            strokeCap = Paint.Cap.ROUND
+            strokeJoin = Paint.Join.ROUND
+            color = lineColor
+        })
+        return bmp
+    }
+}
diff --git a/android/app/src/main/java/com/noop/widget/HrWidgetReceiver.kt b/android/app/src/main/java/com/noop/widget/HrWidgetReceiver.kt
new file mode 100644
index 0000000000..702a2c8130
--- /dev/null
+++ b/android/app/src/main/java/com/noop/widget/HrWidgetReceiver.kt
@@ -0,0 +1,9 @@
+package com.noop.widget
+
+import androidx.glance.appwidget.GlanceAppWidget
+import androidx.glance.appwidget.GlanceAppWidgetReceiver
+
+/** Manifest entry point for the heart-rate widget — all rendering lives in [HrGlanceWidget]. */
+class HrWidgetReceiver : GlanceAppWidgetReceiver() {
+    override val glanceAppWidget: GlanceAppWidget = HrGlanceWidget()
+}
diff --git a/android/app/src/main/java/com/noop/widget/WidgetSnapshot.kt b/android/app/src/main/java/com/noop/widget/WidgetSnapshot.kt
index 9806ddc696..f5de097460 100644
--- a/android/app/src/main/java/com/noop/widget/WidgetSnapshot.kt
+++ b/android/app/src/main/java/com/noop/widget/WidgetSnapshot.kt
@@ -24,6 +24,11 @@ data class WidgetSnapshot(
     /** Strap battery 0–100, null until the strap reports it. */
     val batteryPct: Int? = null,
     val connected: Boolean = false,
+    /** The last [HrTrace.WINDOW_SEC] of heart rate, one point per minute, for the trace widget (#1957).
+     *  Maintained by the STORE rather than by producers: `save` folds each live sample in and `load`
+     *  hands back the pruned series, so nothing that pushes a snapshot had to learn about it. Empty
+     *  until a live sample lands, which is also what a fresh install and a quiet strap look like. */
+    val hrSeries: List<HrPoint> = emptyList(),
     /** Wall-clock millis of the last push, so the widget can show honest staleness. */
     val updatedAtMs: Long = 0L,
 )
@@ -41,6 +46,10 @@ data class WidgetSnapshot(
 object WidgetSnapshotStore {
     private const val FILE = "noop_widget"
 
+    /** Prefs key for the encoded heart-rate trace (#1957). Its own key so an older build, or a wipe of
+     *  the trace, leaves every scalar the other widgets read untouched. */
+    private const val KEY_SERIES = "hrSeries"
+
     suspend fun push(context: Context, snap: WidgetSnapshot) {
         val app = context.applicationContext
         // Cheap, non-suspending gate FIRST — at live-HR cadence (~1/s) almost every call ends here.
@@ -58,13 +67,18 @@ object WidgetSnapshotStore {
         val compactIds = runCatching {
             GlanceAppWidgetManager(app).getGlanceIds(NoopCompactGlanceWidget::class.java)
         }.getOrDefault(emptyList())
-        if (standardIds.isEmpty() && compactIds.isEmpty()) return
+        val hrIds = runCatching {
+            GlanceAppWidgetManager(app).getGlanceIds(HrGlanceWidget::class.java)
+        }.getOrDefault(emptyList())
+        if (standardIds.isEmpty() && compactIds.isEmpty() && hrIds.isEmpty()) return
         runCatching { NoopGlanceWidget().updateAll(app) }
         runCatching { NoopCompactGlanceWidget().updateAll(app) }
+        runCatching { HrGlanceWidget().updateAll(app) }
     }
 
     fun save(context: Context, snap: WidgetSnapshot) {
-        val e = context.getSharedPreferences(FILE, Context.MODE_PRIVATE).edit()
+        val prefs = context.getSharedPreferences(FILE, Context.MODE_PRIVATE)
+        val e = prefs.edit()
             .putInt("recovery", snap.recoveryPct ?: -1)
             .putInt("rest", snap.restPct ?: -1)
             .putInt("effort", snap.effortPct ?: -1)
@@ -76,7 +90,18 @@ object WidgetSnapshotStore {
         // `hrLive` records that the retained value is now a carry-over so the widget dims it (see HrDisplay).
         val live = (snap.heartRate ?: 0) > 0
         e.putBoolean("hrLive", live)
-        if (live) e.putInt("hr", snap.heartRate!!).putLong("hrAt", snap.updatedAtMs)
+        if (live) {
+            e.putInt("hr", snap.heartRate!!).putLong("hrAt", snap.updatedAtMs)
+            // #1957: fold the sample into the trace. Read-modify-write is affordable here precisely
+            // because PushGate already throttles an unchanged key to once a minute, which is the same
+            // cadence HrTrace buckets at — so this runs about once per point, not once per sample.
+            val nowSec = snap.updatedAtMs / 1000
+            val folded = HrTrace.append(
+                HrTrace.decode(prefs.getString(KEY_SERIES, null)),
+                ts = nowSec, bpm = snap.heartRate!!, nowSec = nowSec,
+            )
+            e.putString(KEY_SERIES, HrTrace.encode(folded))
+        }
         e.apply()
     }
 
@@ -96,6 +121,13 @@ object WidgetSnapshotStore {
             heartRateStale = hrStale,
             batteryPct = p.getInt("battery", -1).takeIf { it >= 0 },
             connected = p.getBoolean("connected", false),
+            // Pruned on the way OUT as well as on the way in: a widget read hours after the last push
+            // would otherwise draw a trace whose newest point is stale, under a header that already
+            // dropped the number for being too old (see [HrDisplay.STALE_CAP_MS]).
+            hrSeries = HrTrace.prune(
+                HrTrace.decode(p.getString(KEY_SERIES, null)),
+                nowSec = System.currentTimeMillis() / 1000,
+            ),
             updatedAtMs = p.getLong("updatedAt", 0L),
         )
     }
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index a85a32546c..d4903775c6 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2750,4 +2750,8 @@
     <string name="units_follow_body">Wie Körpermaße</string>
     <string name="l10n_today_screen_pending_sync_cbe01f9e">Sync ausstehend</string>
     <string name="l10n_today_screen_strap_history_still_offloading_80140264">Strap-Verlauf wird noch übertragen</string>
+    <string name="l10n_hr_glance_widget_min_lo_max_hi_ef900e49">Min. %1$d • Max. %2$d</string>
+    <string name="l10n_hr_glance_widget_updated_time_1b5feedb">Aktualisiert %1$s</string>
+    <string name="widget_hr_name">NOOP Herzfrequenz</string>
+    <string name="widget_hr_description">Live-Herzfrequenz mit den letzten drei Stunden als Verlauf.</string>
 </resources>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 76f49e98c3..19bf48d2cb 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2737,4 +2737,8 @@
     <string name="units_follow_body">Según medidas corporales</string>
     <string name="l10n_today_screen_pending_sync_cbe01f9e">Sincronización pendiente</string>
     <string name="l10n_today_screen_strap_history_still_offloading_80140264">el historial de la pulsera aún se está transfiriendo</string>
+    <string name="l10n_hr_glance_widget_min_lo_max_hi_ef900e49">Mín %1$d • Máx %2$d</string>
+    <string name="l10n_hr_glance_widget_updated_time_1b5feedb">Actualizado %1$s</string>
+    <string name="widget_hr_name">NOOP Frecuencia cardíaca</string>
+    <string name="widget_hr_description">Frecuencia cardíaca en directo con las últimas tres horas como gráfico.</string>
 </resources>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 87063d49f3..4d90e133ac 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2736,4 +2736,8 @@
     <string name="units_follow_body">Selon les mensurations</string>
     <string name="l10n_today_screen_pending_sync_cbe01f9e">Synchronisation en attente</string>
     <string name="l10n_today_screen_strap_history_still_offloading_80140264">l\'historique du bracelet est encore en cours de transfert</string>
+    <string name="l10n_hr_glance_widget_min_lo_max_hi_ef900e49">Min. %1$d • Max. %2$d</string>
+    <string name="l10n_hr_glance_widget_updated_time_1b5feedb">Mis à jour %1$s</string>
+    <string name="widget_hr_name">NOOP Fréquence cardiaque</string>
+    <string name="widget_hr_description">Fréquence cardiaque en direct avec les trois dernières heures en courbe.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index effd95cd18..f02882b59b 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2741,4 +2741,8 @@
     <string name="units_follow_body">Jak pomiary ciała</string>
     <string name="l10n_today_screen_pending_sync_cbe01f9e">Oczekuje na synchronizację</string>
     <string name="l10n_today_screen_strap_history_still_offloading_80140264">historia paska wciąż jest przesyłana</string>
+    <string name="l10n_hr_glance_widget_min_lo_max_hi_ef900e49">Min %1$d • Maks %2$d</string>
+    <string name="l10n_hr_glance_widget_updated_time_1b5feedb">Zaktualizowano %1$s</string>
+    <string name="widget_hr_name">NOOP Tętno</string>
+    <string name="widget_hr_description">Tętno na żywo z ostatnimi trzema godzinami jako wykres.</string>
 </resources>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index 5fb1771d7f..b6f0522ca6 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2729,4 +2729,8 @@
     <string name="units_follow_body">Como medidas corporais</string>
     <string name="l10n_today_screen_pending_sync_cbe01f9e">Sincronização pendente</string>
     <string name="l10n_today_screen_strap_history_still_offloading_80140264">o histórico da bracelete ainda está a ser transferido</string>
+    <string name="l10n_hr_glance_widget_min_lo_max_hi_ef900e49">Mín %1$d • Máx %2$d</string>
+    <string name="l10n_hr_glance_widget_updated_time_1b5feedb">Atualizado %1$s</string>
+    <string name="widget_hr_name">NOOP Frequência cardíaca</string>
+    <string name="widget_hr_description">Frequência cardíaca em direto com as últimas três horas em gráfico.</string>
 </resources>
diff --git a/android/app/src/main/res/values-ru/strings.xml b/android/app/src/main/res/values-ru/strings.xml
index f8112a6ec3..bbb9fee5d4 100644
--- a/android/app/src/main/res/values-ru/strings.xml
+++ b/android/app/src/main/res/values-ru/strings.xml
@@ -2620,4 +2620,8 @@
     <string name="l10n_devices_screen_battery_pack_probe_explainer_40b3470d">Отправляет команду батарейного блока только для чтения (151) и декодирует ответ браслета — заряд блока, серийный номер и Bluetooth-адрес. На браслет ничего не записывается, и это не влияет на ваши данные. У WHOOP 4.0 нет команды блока, и ожидается молчание; само это молчание — полезный результат.</string>
     <string name="l10n_today_screen_pending_sync_cbe01f9e">Ожидает синхронизации</string>
     <string name="l10n_today_screen_strap_history_still_offloading_80140264">история браслета ещё передаётся</string>
+    <string name="l10n_hr_glance_widget_min_lo_max_hi_ef900e49">Мин %1$d • Макс %2$d</string>
+    <string name="l10n_hr_glance_widget_updated_time_1b5feedb">Обновлено %1$s</string>
+    <string name="widget_hr_name">NOOP Пульс</string>
+    <string name="widget_hr_description">Пульс в реальном времени и график за последние три часа.</string>
 </resources>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index a18e784030..823032f7ab 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2650,4 +2650,8 @@
     <string name="l10n_devices_screen_pack_charge_0e9589da">电池盒 %1$.1f%%</string>
     <string name="l10n_today_screen_pending_sync_cbe01f9e">等待同步</string>
     <string name="l10n_today_screen_strap_history_still_offloading_80140264">手环历史记录仍在传输</string>
+    <string name="l10n_hr_glance_widget_min_lo_max_hi_ef900e49">最低 %1$d • 最高 %2$d</string>
+    <string name="l10n_hr_glance_widget_updated_time_1b5feedb">更新于 %1$s</string>
+    <string name="widget_hr_name">NOOP 心率</string>
+    <string name="widget_hr_description">实时心率，并显示最近三小时的曲线。</string>
 </resources>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index 53d008099c..b9135e909f 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2,6 +2,8 @@
 <resources>
     <string name="app_name">NOOP</string>
     <string name="widget_description">Today\'s Rest, Charge and Effort, with live heart rate and strap battery at a glance.</string>
+    <string name="widget_hr_name">NOOP Heart Rate</string>
+    <string name="widget_hr_description">Live heart rate with the last three hours as a trace.</string>
     <string name="widget_compact_name">NOOP Compact</string>
     <string name="widget_compact_description">Compact Rest, Charge and Effort widget, with live heart rate and strap battery.</string>
     <string name="widget_error">NOOP widget couldn\'t draw — it will recover on the next update.</string>
@@ -629,6 +631,8 @@
     <string name="l10n_hrv_snapshot_screen_not_enough_clean_beats_sit_still_0893e6c2">Not enough clean beats - sit still and try again. %1$s of </string>
     <string name="l10n_hrv_snapshot_screen_rmssd_e240fd3c">RMSSD</string>
     <string name="l10n_hrv_snapshot_screen_sdnn_9ab9ee2a">SDNN</string>
+    <string name="l10n_hr_glance_widget_min_lo_max_hi_ef900e49">Min %1$d • Max %2$d</string>
+    <string name="l10n_hr_glance_widget_updated_time_1b5feedb">Updated %1$s</string>
     <string name="l10n_hydration_screen_a_simple_goal_that_adjusts_to_723dc08a">A simple goal that adjusts to your effort. General wellness guidance, not medical advice.</string>
     <string name="l10n_hydration_screen_bottle_3b8ac6c7">Bottle</string>
     <string name="l10n_hydration_screen_cancel_77dfd213">Cancel</string>
diff --git a/android/app/src/main/res/xml/hr_widget_info.xml b/android/app/src/main/res/xml/hr_widget_info.xml
new file mode 100644
index 0000000000..ef95f02993
--- /dev/null
+++ b/android/app/src/main/res/xml/hr_widget_info.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Wider and shorter than the score widget: the trace needs horizontal room to be readable, and
+     nothing here is stacked. 4x2 cells at the default launcher grid. updatePeriodMillis is 0 because
+     WidgetSnapshotStore pushes on the app's own cadence; letting the system poll as well would wake
+     the widget on a schedule that has nothing to do with when a heart rate arrived. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:description="@string/widget_hr_description"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:widgetCategory="home_screen"
+    android:updatePeriodMillis="0"
+    android:initialLayout="@layout/glance_default_loading_layout" />
diff --git a/android/app/src/test/java/com/noop/widget/HrTraceTest.kt b/android/app/src/test/java/com/noop/widget/HrTraceTest.kt
new file mode 100644
index 0000000000..bbbcc54344
--- /dev/null
+++ b/android/app/src/test/java/com/noop/widget/HrTraceTest.kt
@@ -0,0 +1,189 @@
+package com.noop.widget
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The heart-rate widget's pure half (#1957). Everything decidable without a Canvas is decided here,
+ * because the Bitmap the renderer produces is not something a JVM test can assert about.
+ *
+ * The cases that carry weight are the DEGENERATE ones — a single point, a flat bpm, a clock that went
+ * backwards — since those are ordinary on a home screen (a widget placed mid-afternoon, a resting arm)
+ * and are exactly where a normalisation divides by zero.
+ */
+class HrTraceTest {
+
+    private fun series(vararg pairs: Pair<Long, Int>) = pairs.map { HrPoint(it.first, it.second) }
+
+    // --- retention -------------------------------------------------------------------------------
+
+    @Test
+    fun `one point per minute bucket, newest wins`() {
+        var s = HrTrace.append(emptyList(), ts = 600, bpm = 60)
+        s = HrTrace.append(s, ts = 620, bpm = 64)   // same minute bucket
+        s = HrTrace.append(s, ts = 660, bpm = 70)   // next bucket
+        assertEquals(2, s.size)
+        assertEquals(64, s[0].bpm)   // newest within the bucket won
+        assertEquals(600, s[0].ts)   // and the point is stamped at the bucket, not the sample
+        assertEquals(70, s[1].bpm)
+    }
+
+    /** The headline number is the latest bpm; a trace ending on an average would disagree with it. */
+    @Test
+    fun `the last point equals the latest reading`() {
+        var s = emptyList<HrPoint>()
+        for (i in 0..5) s = HrTrace.append(s, ts = 600 + i * 60L, bpm = 60 + i)
+        assertEquals(65, HrTrace.stats(s)!!.latest)
+        assertEquals(65, s.last().bpm)
+    }
+
+    @Test
+    fun `readings older than the window fall off`() {
+        val now = 100_000L
+        val s = series((now - HrTrace.WINDOW_SEC - 60) to 50, (now - 60) to 70)
+        val kept = HrTrace.prune(s, now)
+        assertEquals(1, kept.size)
+        assertEquals(70, kept[0].bpm)
+    }
+
+    /** A clock that jumps backwards must not be able to grow the series without bound. */
+    @Test
+    fun `the point cap holds under a backwards clock`() {
+        var s = emptyList<HrPoint>()
+        for (i in 0 until HrTrace.MAX_POINTS + 50) s = HrTrace.append(s, ts = i * 60L, bpm = 60, nowSec = 0)
+        assertTrue("size=${s.size}", s.size <= HrTrace.MAX_POINTS)
+    }
+
+    @Test
+    fun `a non-positive bpm is not recorded`() {
+        val s = HrTrace.append(emptyList(), ts = 600, bpm = 0)
+        assertTrue(s.isEmpty())
+    }
+
+    // --- round trip ------------------------------------------------------------------------------
+
+    @Test
+    fun `encode and decode round trip`() {
+        val s = series(600L to 60, 660L to 62, 720L to 58)
+        assertEquals(s, HrTrace.decode(HrTrace.encode(s)))
+    }
+
+    /**
+     * Decoding runs on the widget's render path, where the alternative to a partial trace is a crashed
+     * home screen. Every malformed shape must be skipped rather than thrown.
+     */
+    @Test
+    fun `a malformed series degrades instead of throwing`() {
+        assertEquals(emptyList<HrPoint>(), HrTrace.decode(null))
+        assertEquals(emptyList<HrPoint>(), HrTrace.decode(""))
+        assertEquals(emptyList<HrPoint>(), HrTrace.decode("garbage"))
+        val partial = HrTrace.decode("600:60,nope,700:,:70,800:x,900:64")
+        assertEquals(series(600L to 60, 900L to 64), partial)
+    }
+
+    // --- geometry --------------------------------------------------------------------------------
+
+    @Test
+    fun `points span the box and flip bpm upward`() {
+        val pts = HrTrace.points(series(0L to 60, 60L to 80), width = 100f, height = 50f)
+        assertEquals(0f, pts[0].x, 0.001f)
+        assertEquals(100f, pts[1].x, 0.001f)
+        assertEquals(50f, pts[0].y, 0.001f)   // the LOW bpm sits at the BOTTOM
+        assertEquals(0f, pts[1].y, 0.001f)    // the high bpm at the top
+    }
+
+    /** A resting arm holds one bpm for minutes. Range zero must not divide, and must not read as a
+     *  flatlined or maxed-out heart, so the line runs along the middle. */
+    @Test
+    fun `a flat series draws down the middle`() {
+        val pts = HrTrace.points(series(0L to 60, 60L to 60, 120L to 60), width = 90f, height = 40f)
+        assertEquals(3, pts.size)
+        for (p in pts) assertEquals(20f, p.y, 0.001f)
+    }
+
+    /** A widget placed mid-afternoon has exactly one point until the next minute ticks. */
+    @Test
+    fun `a single point sits at the left edge rather than at NaN`() {
+        val pts = HrTrace.points(series(600L to 61), width = 100f, height = 50f)
+        assertEquals(1, pts.size)
+        assertEquals(0f, pts[0].x, 0.001f)
+        assertTrue("y=${pts[0].y}", !pts[0].y.isNaN())
+    }
+
+    @Test
+    fun `an empty series or a zero-size box draws nothing`() {
+        assertTrue(HrTrace.points(emptyList(), 100f, 50f).isEmpty())
+        assertTrue(HrTrace.points(series(0L to 60), 0f, 50f).isEmpty())
+        assertTrue(HrTrace.points(series(0L to 60), 100f, 0f).isEmpty())
+    }
+
+    // --- ticks -----------------------------------------------------------------------------------
+
+    @Test
+    fun `bpm ticks run max, middle, min`() {
+        assertEquals(listOf(84, 72, 59), HrTrace.bpmTicks(HrTrace.Stats(min = 59, max = 84, latest = 69)))
+    }
+
+    /** Three copies of one number is the honest reading of a steady heart; inventing a spread would put
+     *  ticks on the chart that no sample supports. */
+    @Test
+    fun `a flat series labels one number three times`() {
+        assertEquals(listOf(60, 60, 60), HrTrace.bpmTicks(HrTrace.Stats(min = 60, max = 60, latest = 60)))
+    }
+
+    @Test
+    fun `time ticks anchor to the data, not the window`() {
+        val ticks = HrTrace.timeTicks(series(1_000L to 60, 1_600L to 62, 2_200L to 64))
+        assertEquals(listOf(1_000L, 1_600L, 2_200L), ticks)
+    }
+
+    @Test
+    fun `time ticks degrade when there is not enough span to place three`() {
+        assertEquals(emptyList<Long>(), HrTrace.timeTicks(emptyList()))
+        assertEquals(listOf(600L), HrTrace.timeTicks(series(600L to 60)))
+        assertEquals(listOf(600L, 601L), HrTrace.timeTicks(series(600L to 60, 601L to 61)))
+    }
+
+    @Test
+    fun `stats over an empty series is null, not zero`() {
+        assertNull(HrTrace.stats(emptyList()))
+    }
+
+
+    // --- the drawing box -------------------------------------------------------------------------
+
+    /**
+     * RemoteViews fails to render rather than degrading when its transaction is too big, so the box has
+     * to be decided on AREA. The first version of this capped width and height independently, which let
+     * 1080x480 through at 1.98 MB — nearly double the ceiling it was written to respect.
+     */
+    @Test
+    fun `a box within budget is left alone`() {
+        assertEquals(750 to 168, HrTrace.fitBox(750, 168))   // 250dp x 56dp at 3x: 504 KB, fits
+    }
+
+    @Test
+    fun `an oversized box is scaled down to fit the budget`() {
+        val (w, h) = HrTrace.fitBox(1200, 224)               // 300dp x 56dp at 4x: 1.03 MB
+        assertTrue("$w x $h", w.toLong() * h * 4 <= HrTrace.MAX_BITMAP_BYTES)
+        assertTrue("must not collapse: $w x $h", w > 1 && h > 1)
+    }
+
+    /** Aspect must survive, or the trace is drawn into a box shaped unlike the slot it is stretched
+     *  back into, and the stroke thickens on one axis only. */
+    @Test
+    fun `scaling preserves the aspect ratio`() {
+        val (w, h) = HrTrace.fitBox(2000, 500)
+        assertEquals(4.0, w.toDouble() / h.toDouble(), 0.05)
+    }
+
+    @Test
+    fun `a degenerate box never returns zero`() {
+        assertEquals(1 to 1, HrTrace.fitBox(0, 0))
+        assertEquals(1 to 1, HrTrace.fitBox(-5, -5))
+        val (w, h) = HrTrace.fitBox(100_000, 100_000)
+        assertTrue("$w x $h", w >= 1 && h >= 1 && w.toLong() * h * 4 <= HrTrace.MAX_BITMAP_BYTES)
+    }
+}

From 1106b97bd2571e554623beb73174f85ff99816ce Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 16:39:54 +1200
Subject: [PATCH 309/333] build: testing build 451 / 332

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index c8c8e94bdd..546af87ee1 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 450
+        versionCode = 451
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index b2d15888f7..1297d41bdb 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "331"
+    CURRENT_PROJECT_VERSION: "332"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 11080509b07a8c03b4c301c4173e99ff5fb1f2ea Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 17:14:27 +1200
Subject: [PATCH 310/333] widget: let the launcher lay out the heart-rate card
 (#1961)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to #1958, from putting it on an actual home screen. Three defects, none
of which a test could have shown.

## The chart did not span the card

Everything sat in the left portion with dead space beside it. The cause: I sized
the chart from `LocalSize.current`, and a One UI launcher reported a size smaller
than the card actually occupied, so every width derived from it was short.

The chart now takes the row's remaining width by weight. The bitmap is still
measured in pixels — it has to be — but only to be drawn and then stretched,
which a smooth line survives without visible cost. Layout is the launcher's
business, not arithmetic of mine.

`LocalSize` being a hint about the cell rather than a measurement of the card is
the mistake underneath all of this, and I had treated it as the latter.

## Labels that said nothing

A single reading rendered a bpm scale of `78 / 78 / 78`. Honest — with no range
there is nothing to scale against, which is the behaviour a test pins — but three
labels repeating the headline are noise. The scale now appears only once there is
a range to describe.

The time axis went the same way. One instant pinned to the left edge read as a
stray rather than an axis, so it waits for a span to label.

## A void under the stamp

A 4x2 cell is taller than this content, so "Updated" floated with empty card
beneath it. It is pinned to the bottom now and reads as a footer.

## Then: the graph was still small

Two things, and the second was self-inflicted.

The chart was pinned at 56dp while the card had roughly 36dp going spare — and
the spacer added above to pin the stamp to the bottom was eating exactly that
slack. The fix for the void consumed the room the graph needed. The chart takes
the leftover height itself now, about 64% taller.

Taller then collided with the payload budget: at four bytes a pixel a 92dp chart
left only 518px of width for an ~834px card, a 1.6x horizontal stretch — the very
upscale removed a commit earlier. They stop competing once the bitmap stops
paying for an alpha channel it never uses. The trace is one hue over an opaque
card, so it is drawn RGB_565 over the card colour, gradient fading to that colour
rather than to transparent. Half the bytes, so the same budget affords 1034px at
that height: a 1.24x DOWNSCALE. Dither is on, since 565 bands a smooth ramp.

## And the assumption underneath all of it

Glance's `Image` defaults to `ContentScale.Fit`, which preserves aspect. Every
sizing decision above assumes the opposite — width drawn with headroom SO THAT it
downscales, height drawn to an estimate because a weighted box has no knowable
size. Under `Fit`, a 1034x253 trace in an 834x253 box would letterbox to 834x204
and sit 49px short, silently undoing the height it had just been given.

The arithmetic in both commits was right and checked. The assumption underneath
it lived in a library default I had never written down, so the two fixes were
correct and jointly inert. Now `FillBounds`, verified against the Glance API
rather than assumed.

## Verification

Full Android suite 5544 green, i18n `--ci` clean, doc-comment lint clean. The
pure-half tests are untouched and still describe the same behaviour: what changed
is which of it gets RENDERED, not what it computes.

Wants another look on a launcher, and specifically once the trace has more than
one point — the single-reading state is the only one seen so far.
---
 .../java/com/noop/widget/HrGlanceWidget.kt    | 73 +++++++++++++++----
 .../src/main/java/com/noop/widget/HrTrace.kt  | 31 +++++++-
 .../java/com/noop/widget/HrTraceRenderer.kt   | 14 +++-
 .../test/java/com/noop/widget/HrTraceTest.kt  | 38 +++++++++-
 4 files changed, 135 insertions(+), 21 deletions(-)

diff --git a/android/app/src/main/java/com/noop/widget/HrGlanceWidget.kt b/android/app/src/main/java/com/noop/widget/HrGlanceWidget.kt
index 62b9f3d9a5..93842b1e67 100644
--- a/android/app/src/main/java/com/noop/widget/HrGlanceWidget.kt
+++ b/android/app/src/main/java/com/noop/widget/HrGlanceWidget.kt
@@ -24,6 +24,8 @@ import androidx.glance.layout.Box
 import androidx.glance.layout.Column
 import androidx.glance.layout.Row
 import androidx.glance.layout.Spacer
+import androidx.glance.layout.ContentScale
+import androidx.glance.layout.fillMaxHeight
 import androidx.glance.layout.fillMaxSize
 import androidx.glance.layout.fillMaxWidth
 import androidx.glance.layout.height
@@ -88,7 +90,10 @@ class HrGlanceWidget : GlanceAppWidget() {
 
 // Local widget colours, mirroring the siblings rather than reading Palette: Glance composes outside the
 // app theme, so every widget in this package carries its own copy on purpose.
-private fun hrSurface(dark: Boolean) = ColorProvider(if (dark) Color(0xFF0A1322) else Color(0xFFF4F1EA))
+/** The card colour as a raw Color, so the renderer can paint it as the bitmap's ground. */
+private fun hrSurfaceColor(dark: Boolean) = if (dark) Color(0xFF0A1322) else Color(0xFFF4F1EA)
+
+private fun hrSurface(dark: Boolean) = ColorProvider(hrSurfaceColor(dark))
 private fun hrTextPrimary(dark: Boolean) = ColorProvider(if (dark) Color(0xFFF4F6F8) else Color(0xFF1A2230))
 private fun hrTextSecondary(dark: Boolean) = ColorProvider(if (dark) Color(0xFF8A94A4) else Color(0xFF7C8696))
 
@@ -100,6 +105,16 @@ private const val HR_CARD_PADDING_DP = 28f
  *  constant is how a chart and its axis end up a few pixels out of step. */
 private const val HR_SCALE_COLUMN_DP = 34f
 
+/**
+ * The height the trace BITMAP is drawn at.
+ *
+ * The chart box takes the card's leftover height by weight, so its real height is not knowable here —
+ * the same situation as the width. This is the figure the bitmap is drawn at and the `Image` scales
+ * from, chosen generously so the common case downscales: a 4x2 cell left roughly 36dp unspent when the
+ * chart was pinned at 56, and that slack is what the graph looked small for.
+ */
+private const val HR_CHART_TARGET_DP = 92f
+
 /** The chart width for a given widget width — the one place that arithmetic happens. */
 private fun hrChartWidthDp(widthDp: Float): Float =
     (widthDp - HR_CARD_PADDING_DP - HR_SCALE_COLUMN_DP).coerceAtLeast(24f)
@@ -109,7 +124,6 @@ private fun hrAccent(dark: Boolean) = if (dark) Color(0xFFE0662F) else Color(0xF
 
 @Composable
 private fun HrWidgetContent(snap: WidgetSnapshot, dark: Boolean) {
-    val context = LocalContext.current
     val size = LocalSize.current
     val stats = HrTrace.stats(snap.hrSeries)
 
@@ -195,12 +209,16 @@ private fun HrWidgetContent(snap: WidgetSnapshot, dark: Boolean) {
         // few minutes — a void reads as broken where a shorter widget reads as new.
         if (snap.hrSeries.isNotEmpty()) {
             Spacer(GlanceModifier.height(8.dp))
-            HrTraceImage(snap, dark, widthDp = size.width.value, heightDp = 56f)
-            HrTimeAxis(snap, dark, widthDp = size.width.value)
+            HrTraceImage(snap, dark, widthDp = size.width.value,
+                         modifier = GlanceModifier.defaultWeight())
+            HrTimeAxis(snap, dark)
         }
 
         if (snap.updatedAtMs > 0) {
-            Spacer(GlanceModifier.height(6.dp))
+            // No slack-eating spacer here any more. The chart takes the leftover height itself, which is
+            // what the card should be spending it on — a spacer pushed the stamp to the bottom and left
+            // the graph the same 56dp it had on a card half again as tall.
+            Spacer(GlanceModifier.height(4.dp))
             val time = DateFormat.getTimeInstance(DateFormat.SHORT).format(Date(snap.updatedAtMs))
             Row(
                 modifier = GlanceModifier.fillMaxWidth(),
@@ -223,7 +241,14 @@ private fun HrWidgetContent(snap: WidgetSnapshot, dark: Boolean) {
  * actually gave us rather than from a guess.
  */
 @Composable
-private fun HrTraceImage(snap: WidgetSnapshot, dark: Boolean, widthDp: Float, heightDp: Float) {
+private fun HrTraceImage(
+    snap: WidgetSnapshot,
+    dark: Boolean,
+    widthDp: Float,
+    // Weighted by the CALLER: Glance scopes defaultWeight() to Row/ColumnScope, so a composable
+    // cannot claim its own share of the parent from in here.
+    modifier: GlanceModifier,
+) {
     val context = LocalContext.current
     val stats = HrTrace.stats(snap.hrSeries)
     val density = context.resources.displayMetrics.density
@@ -231,7 +256,11 @@ private fun HrTraceImage(snap: WidgetSnapshot, dark: Boolean, widthDp: Float, he
     val chartWidthDp = hrChartWidthDp(widthDp)
     // ONE box for both the geometry and the bitmap. Sizing them separately let the trace be drawn to
     // coordinates the bitmap did not have room for, clipping its right-hand end (#1957).
-    val (wPx, hPx) = HrTrace.fitBox((chartWidthDp * density).toInt(), (heightDp * density).toInt())
+    // Height exactly as displayed, width with headroom so the Image DOWNSCALES rather than stretching
+    // up: LocalSize under-reports on some launchers, and an upscale here is horizontal-only, which
+    // turns the stroke elliptical (#1957).
+    val hPx = (HR_CHART_TARGET_DP * density).toInt().coerceAtLeast(1)
+    val wPx = HrTrace.widestAtHeight((chartWidthDp * density).toInt(), hPx)
 
     val bmp = runCatching {
         HrTraceRenderer.render(
@@ -240,27 +269,41 @@ private fun HrTraceImage(snap: WidgetSnapshot, dark: Boolean, widthDp: Float, he
             heightPx = hPx,
             lineColor = hrAccent(dark).toArgb(),
             fillTopColor = hrAccent(dark).copy(alpha = 0.35f).toArgb(),
+            backgroundColor = hrSurfaceColor(dark).toArgb(),
             strokePx = 2f * density,
         )
     }.getOrNull()
 
-    Row(modifier = GlanceModifier.fillMaxWidth()) {
-        Box(modifier = GlanceModifier.height(heightDp.dp).width(chartWidthDp.dp)) {
+    // The chart takes the ROW's remaining width by weight rather than a width computed from
+    // LocalSize. On a One UI launcher LocalSize reported a size smaller than the card actually
+    // occupied, so the chart and its scale sat in the left half with dead space beside them. The
+    // bitmap is still sized in pixels, but only to be drawn and then stretched — a smooth line
+    // survives that, and the layout is now the launcher's business rather than my arithmetic.
+    Row(modifier = modifier.fillMaxWidth()) {
+        Box(modifier = GlanceModifier.fillMaxHeight().defaultWeight()) {
             if (bmp != null) {
                 Image(
                     provider = ImageProvider(bmp),
                     contentDescription = null,
                     modifier = GlanceModifier.fillMaxSize(),
+                    // FillBounds, not the default Fit. Everything about how this bitmap is sized assumes
+                    // it STRETCHES to the box: the width is drawn with headroom so it downscales, and the
+                    // height is drawn to an estimate because a weighted box has no knowable size. Fit
+                    // preserves aspect instead, so a 1034x253 trace in an 834x253 box would have been
+                    // letterboxed to 834x204 — 49px of dead space, undoing the height it was just given.
+                    contentScale = ContentScale.FillBounds,
                 )
             }
         }
-        if (stats != null) {
+        // A scale of one repeated number says nothing the headline has not: with no range there is
+        // nothing to scale against, and 78/78/78 beside a flat line is three labels of noise.
+        if (stats != null && stats.max > stats.min) {
             Spacer(GlanceModifier.width(6.dp))
             // Spread across the chart's height so max sits level with the top of the trace and min with
             // the bottom, which is what makes it a SCALE. Stacked from the top with fixed gaps they were
             // just three numbers near the chart, aligned to nothing.
             Column(
-                modifier = GlanceModifier.height(heightDp.dp),
+                modifier = GlanceModifier.fillMaxHeight(),
                 horizontalAlignment = Alignment.Horizontal.End,
             ) {
                 val ticks = HrTrace.bpmTicks(stats)
@@ -293,13 +336,15 @@ private fun HrTraceImage(snap: WidgetSnapshot, dark: Boolean, widthDp: Float, he
  * times would suggest a span that was never sampled.
  */
 @Composable
-private fun HrTimeAxis(snap: WidgetSnapshot, dark: Boolean, widthDp: Float) {
+private fun HrTimeAxis(snap: WidgetSnapshot, dark: Boolean) {
     val ticks = HrTrace.timeTicks(snap.hrSeries)
     if (ticks.isEmpty()) return
+    // Under a minute of history names one instant, and one label pinned to the left edge reads as a
+    // stray rather than an axis — so the axis only appears once there is a span to label.
+    if (ticks.size < 2) return
     val fmt = DateFormat.getTimeInstance(DateFormat.SHORT)
-    val chartWidthDp = hrChartWidthDp(widthDp)
     Spacer(GlanceModifier.height(2.dp))
-    Row(modifier = GlanceModifier.width(chartWidthDp.dp)) {
+    Row(modifier = GlanceModifier.fillMaxWidth()) {
         ticks.forEachIndexed { i, ts ->
             Text(
                 text = fmt.format(Date(ts * 1000)),
diff --git a/android/app/src/main/java/com/noop/widget/HrTrace.kt b/android/app/src/main/java/com/noop/widget/HrTrace.kt
index aa8c6872cf..0d24bbf5dd 100644
--- a/android/app/src/main/java/com/noop/widget/HrTrace.kt
+++ b/android/app/src/main/java/com/noop/widget/HrTrace.kt
@@ -109,7 +109,7 @@ object HrTrace {
     fun fitBox(widthPx: Int, heightPx: Int, maxBytes: Int = MAX_BITMAP_BYTES): Pair<Int, Int> {
         val w = widthPx.coerceAtLeast(1)
         val h = heightPx.coerceAtLeast(1)
-        val bytes = w.toLong() * h.toLong() * 4L
+        val bytes = w.toLong() * h.toLong() * BYTES_PER_PIXEL
         if (bytes <= maxBytes) return w to h
         val scale = Math.sqrt(maxBytes.toDouble() / bytes.toDouble())
         return (w * scale).toInt().coerceAtLeast(1) to (h * scale).toInt().coerceAtLeast(1)
@@ -119,6 +119,35 @@ object HrTrace {
      *  the transaction ceiling, and still affords a full-density chart on an ordinary phone. */
     const val MAX_BITMAP_BYTES: Int = 512 * 1024
 
+    /** Bytes per pixel the renderer actually spends. The trace is one hue over an opaque card, so it is
+     *  drawn RGB_565 rather than ARGB_8888 — there is no transparency to preserve, and at four bytes a
+     *  pixel the budget could not afford both a taller chart and a width that avoids stretching it. */
+    const val BYTES_PER_PIXEL: Int = 2
+
+    /**
+     * The widest bitmap the budget allows at an EXACT height, with headroom over what the caller asked.
+     *
+     * Two things force this. `LocalSize` under-reports on some launchers — a One UI card reported about
+     * 60% of its true width — so a bitmap rendered at the reported width is UPSCALED to fill, and only
+     * horizontally, which turns a round stroke elliptical and soft. And [fitBox] preserves aspect, so
+     * simply asking for a wider box would shrink the height too and trade a horizontal stretch for a
+     * vertical one.
+     *
+     * So: height is taken as given and never scaled, and the width gets what is left of the budget, up
+     * to [WIDTH_HEADROOM] times the request so a small widget does not allocate a huge strip for
+     * nothing. Downscaling is the cheap direction — a smooth line loses nothing to it.
+     */
+    fun widestAtHeight(requestedPx: Int, heightPx: Int, maxBytes: Int = MAX_BITMAP_BYTES): Int {
+        val h = heightPx.coerceAtLeast(1)
+        val budgetWidth = (maxBytes / (h * BYTES_PER_PIXEL)).coerceAtLeast(1)
+        val want = (requestedPx.coerceAtLeast(1) * WIDTH_HEADROOM).toInt()
+        return want.coerceAtMost(budgetWidth).coerceAtLeast(requestedPx.coerceAtLeast(1).coerceAtMost(budgetWidth))
+    }
+
+    /** How much wider than the reported width to draw, to cover a launcher that under-reports. Two
+     *  covers the ~1.6x seen on One UI with margin, and costs nothing a downscale does not absorb. */
+    const val WIDTH_HEADROOM: Float = 2f
+
     /** A point in the trace's pixel box, origin top-left, as the renderer wants it. */
     data class Pt(val x: Float, val y: Float)
 
diff --git a/android/app/src/main/java/com/noop/widget/HrTraceRenderer.kt b/android/app/src/main/java/com/noop/widget/HrTraceRenderer.kt
index 770971d8d5..75094a826e 100644
--- a/android/app/src/main/java/com/noop/widget/HrTraceRenderer.kt
+++ b/android/app/src/main/java/com/noop/widget/HrTraceRenderer.kt
@@ -32,6 +32,9 @@ internal object HrTraceRenderer {
         heightPx: Int,
         lineColor: Int,
         fillTopColor: Int,
+        /** The card underneath. Drawn as the ground and used as the gradient's far end, because an
+         *  RGB_565 bitmap has no alpha to fade into. */
+        backgroundColor: Int,
         strokePx: Float,
     ): Bitmap? {
         if (points.isEmpty()) return null
@@ -41,12 +44,16 @@ internal object HrTraceRenderer {
         val w = widthPx.coerceAtLeast(1)
         val h = heightPx.coerceAtLeast(1)
         if (w < 2 || h < 2) return null
-        if (w.toLong() * h.toLong() * 4L > HrTrace.MAX_BITMAP_BYTES) return null
+        if (w.toLong() * h.toLong() * HrTrace.BYTES_PER_PIXEL > HrTrace.MAX_BITMAP_BYTES) return null
 
+        // RGB_565, half the bytes of ARGB_8888. The trace is one hue on an opaque card, so nothing here
+        // needs transparency — and at four bytes a pixel the payload budget could not afford both a chart
+        // tall enough to read and a width that did not have to be stretched to fill.
         val bmp = runCatching {
-            Bitmap.createBitmap(w, h, Bitmap.Config.ARGB_8888)
+            Bitmap.createBitmap(w, h, Bitmap.Config.RGB_565)
         }.getOrNull() ?: return null
         val canvas = Canvas(bmp)
+        canvas.drawColor(backgroundColor)
 
         // Inset by the stroke so a point sitting exactly on the top or bottom edge is not shaved in
         // half. The geometry maps the extremes to 0 and `height`, which is correct for a line of zero
@@ -79,8 +86,9 @@ internal object HrTraceRenderer {
         fill.close()
         canvas.drawPath(fill, Paint().apply {
             isAntiAlias = true
+            isDither = true   // 565 bands a smooth ramp without it
             shader = LinearGradient(
-                0f, 0f, 0f, h.toFloat(), fillTopColor, fillTopColor and 0x00FFFFFF, Shader.TileMode.CLAMP,
+                0f, 0f, 0f, h.toFloat(), fillTopColor, backgroundColor, Shader.TileMode.CLAMP,
             )
         })
 
diff --git a/android/app/src/test/java/com/noop/widget/HrTraceTest.kt b/android/app/src/test/java/com/noop/widget/HrTraceTest.kt
index bbbcc54344..55a9816bbb 100644
--- a/android/app/src/test/java/com/noop/widget/HrTraceTest.kt
+++ b/android/app/src/test/java/com/noop/widget/HrTraceTest.kt
@@ -161,13 +161,13 @@ class HrTraceTest {
      */
     @Test
     fun `a box within budget is left alone`() {
-        assertEquals(750 to 168, HrTrace.fitBox(750, 168))   // 250dp x 56dp at 3x: 504 KB, fits
+        assertEquals(750 to 168, HrTrace.fitBox(750, 168))   // 250dp x 56dp at 3x, well inside budget
     }
 
     @Test
     fun `an oversized box is scaled down to fit the budget`() {
         val (w, h) = HrTrace.fitBox(1200, 224)               // 300dp x 56dp at 4x: 1.03 MB
-        assertTrue("$w x $h", w.toLong() * h * 4 <= HrTrace.MAX_BITMAP_BYTES)
+        assertTrue("$w x $h", w.toLong() * h * HrTrace.BYTES_PER_PIXEL <= HrTrace.MAX_BITMAP_BYTES)
         assertTrue("must not collapse: $w x $h", w > 1 && h > 1)
     }
 
@@ -184,6 +184,38 @@ class HrTraceTest {
         assertEquals(1 to 1, HrTrace.fitBox(0, 0))
         assertEquals(1 to 1, HrTrace.fitBox(-5, -5))
         val (w, h) = HrTrace.fitBox(100_000, 100_000)
-        assertTrue("$w x $h", w >= 1 && h >= 1 && w.toLong() * h * 4 <= HrTrace.MAX_BITMAP_BYTES)
+        assertTrue("$w x $h", w >= 1 && h >= 1 && w.toLong() * h * HrTrace.BYTES_PER_PIXEL <= HrTrace.MAX_BITMAP_BYTES)
+    }
+
+
+    // --- bitmap width, given an exact height ------------------------------------------------------
+
+    /**
+     * Height must survive untouched. [HrTrace.fitBox] preserves aspect, so asking it for a wider box
+     * would shrink the height and trade a horizontal stretch for a vertical one — which is why the
+     * width is chosen separately once the height is fixed.
+     */
+    @Test
+    fun `width gets headroom over the request`() {
+        // 188dp of chart at 2.75x, 56dp tall: the case a One UI card actually produced.
+        val w = HrTrace.widestAtHeight(requestedPx = 517, heightPx = 154)
+        assertTrue("$w must exceed the request", w > 517)
+        assertTrue("$w must stay in budget", w.toLong() * 154 * HrTrace.BYTES_PER_PIXEL <= HrTrace.MAX_BITMAP_BYTES)
+    }
+
+    /** The budget wins over the headroom, never the other way round: a bitmap that breaks the payload
+     *  ceiling does not render at all, where a slightly stretched one merely looks soft. */
+    @Test
+    fun `the budget caps the headroom`() {
+        val h = 400
+        val w = HrTrace.widestAtHeight(requestedPx = 4000, heightPx = h)
+        assertEquals(HrTrace.MAX_BITMAP_BYTES / (h * HrTrace.BYTES_PER_PIXEL), w)
+        assertTrue(w.toLong() * h * HrTrace.BYTES_PER_PIXEL <= HrTrace.MAX_BITMAP_BYTES)
+    }
+
+    @Test
+    fun `a degenerate request still yields a drawable width`() {
+        assertTrue(HrTrace.widestAtHeight(0, 0) >= 1)
+        assertTrue(HrTrace.widestAtHeight(-10, -10) >= 1)
     }
 }

From ed3b7aaed33451a9d417b588684e29aae5dae56c Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 17:14:41 +1200
Subject: [PATCH 311/333] build: testing build 452 / 333

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 546af87ee1..8d22ab8615 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 451
+        versionCode = 452
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 1297d41bdb..d994b7714b 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "332"
+    CURRENT_PROJECT_VERSION: "333"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 5b01367c8a89bcbce3bcd4c0011c57eeb9ac8ba8 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 18:09:40 +1200
Subject: [PATCH 312/333] widget: heart rate with the recent trace (iOS)
 (#1964)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

iOS twin of the heart-rate widget (#1957), Android having landed in #1958/#1961.

## What ports, and what deliberately does not

`HrTrace` ports whole — retention, normalisation, stats, tick choices. Those are
the same decisions about the same heart, and a trace that kept a different window
or picked different labels would be a different READING, not a different look.
Sixteen Swift tests mirror the Kotlin ones case for case, so a change landing on
one side alone fails.

The DRAWING does not port, and should not:

| | Android | iOS |
|---|---|---|
| renderer | Bitmap under a byte budget, RGB_565 | stroked SwiftUI `Path` |
| why | Glance compiles to RemoteViews: no Canvas, Binder payload ceiling | WidgetKit is SwiftUI, resolution-independent |
| sizing | `fitBox` / `widestAtHeight` / headroom | geometry gives the box |

So `fitBox`, the byte budget and the pixel depth stay behind — they answer a
question this platform does not ask. `encode`/`decode` stay behind too: the
snapshot here is already Codable and carries `[HrPoint]` directly, where Android
packs a SharedPreferences string.

## A defect found before it shipped

`save()` only ran when `renderedContentChanged` was true, and that compares bpm,
not history. A steady heart — the ordinary case at rest — would have recorded no
point, so the trace would stop advancing while the strap streamed happily and
prune itself to empty.

`traceNeedsPoint` is the twin of Android's `PushGate` re-admit, keyed on the
minute BUCKET so it asks for a write exactly when `HrTrace.append` would record
one and never more often. It persists without a reload, since spending a
WidgetKit reload a minute is what the dedup above it exists to avoid.

## The accent

`StrandPalette.zone5`, which resolves to `#C84E1E` / `#E0662F` — exactly the
hexes the Android widget carries as a local mirror. That was luck rather than
judgement: the colour chosen by eye there turns out to be the palette's HR zone-5
token. Both sides now record the match, so neither drifts.

## Accessibility

SwiftUI can combine the card into one spoken sentence, which Glance cannot —
Android had to settle for per-label descriptions because it offers no way to mark
a `Text` decorative. So this reads as one label rather than a run of loose
numbers. Staleness is not colour-encoded here at all, so nothing needs saying
about it.

## What review passes added after this was opened

Four gaps, each found by comparing against the Kotlin side rather than by reading
the Swift in isolation:

- **Spoken text was hardcoded English.** The audit does scan
  `.accessibilityLabel(`, but it matches a literal immediately after the paren,
  and these were built in a computed property — so extracting them for
  readability is what hid them. Worse, after switching to `String(localized:)`
  the audit stayed green with the keys still ABSENT from the catalog:
  "is it extracted" and "does the key exist" are different questions and it only
  asks the first. Three keys added across ten locales.
- **The trace was not pruned on read.** Android prunes on the way out as well as
  in; this drew points that had aged out, under a time axis implying they were
  current. Measured from `entry.date`, since WidgetKit renders an entry at ITS
  date.
- **No age rule on the headline.** Android drops a reading past fifteen minutes
  and dims one past two. Pruning made the absence incoherent rather than merely
  wrong: an empty chart under a confident number. `HrDisplay` ports with the same
  thresholds, anchored on the newest TRACE POINT rather than `updated`, because a
  publish fires for battery and score changes too.
- **Work done twice, on both platforms.** Android sorted in `append` and again in
  `prune`, and scanned for `stats` once per composable; iOS decoded the App Group
  snapshot twice per publish. Same shape each time: a helper written to stand
  alone, called from somewhere that had already done the work.

## Verification

Android suite 5544 green, i18n
`--ci` clean, doc-comment lint clean. Two catalog entries added across ten
locales, TEXT-SPLICED rather than JSON round-tripped since the file is ~6MB — and
Italian needed real abbreviation periods to clear the echo gate, the same way
German and French did on the Android side.

Swift is CI-verified as usual. `StrandTests` runs on the app-build macOS leg, and
this PR touches `StrandiOSShared`, `StrandiOSWidgets`, `StrandiOS`, `StrandTests`
and `project.yml`, so that job triggers.

**Not verified on a device.** The Android one needed three rounds on a real home
screen after passing every gate, and nothing here has been near a launcher.
---
 Strand/Resources/Localizable.xcstrings        |  15 ++
 StrandTests/HrTraceTests.swift                | 181 ++++++++++++++
 StrandiOS/Widgets/WidgetPublish.swift         |  10 +-
 StrandiOSShared/HrTrace.swift                 | 169 +++++++++++++
 StrandiOSShared/WidgetSnapshot.swift          |  50 +++-
 StrandiOSWidgets/HeartRateWidget.swift        | 236 ++++++++++++++++++
 StrandiOSWidgets/NOOPWidgetBundle.swift       |   4 +-
 .../java/com/noop/widget/HrGlanceWidget.kt    |  12 +-
 .../src/main/java/com/noop/widget/HrTrace.kt  |   4 +-
 project.yml                                   |   4 +
 10 files changed, 674 insertions(+), 11 deletions(-)
 create mode 100644 StrandTests/HrTraceTests.swift
 create mode 100644 StrandiOSShared/HrTrace.swift
 create mode 100644 StrandiOSWidgets/HeartRateWidget.swift

diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index ea46268976..3c15ab56be 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -1,6 +1,21 @@
 {
   "sourceLanguage": "en",
   "strings": {
+    "Heart rate, no reading": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Herzfrequenz, keine Messung" } }, "en": { "stringUnit": { "state": "translated", "value": "Heart rate, no reading" } }, "es": { "stringUnit": { "state": "translated", "value": "Frecuencia cardíaca, sin lectura" } }, "fr": { "stringUnit": { "state": "translated", "value": "Fréquence cardiaque, aucune mesure" } }, "it": { "stringUnit": { "state": "translated", "value": "Frequenza cardiaca, nessuna lettura" } }, "pl": { "stringUnit": { "state": "translated", "value": "Tętno, brak odczytu" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Frequência cardíaca, sem leitura" } }, "ru": { "stringUnit": { "state": "translated", "value": "Пульс, нет данных" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "心率，无读数" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "心率，無讀數" } }
+    } },
+    "Heart rate %lld bpm": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Herzfrequenz %lld bpm" } }, "en": { "stringUnit": { "state": "translated", "value": "Heart rate %lld bpm" } }, "es": { "stringUnit": { "state": "translated", "value": "Frecuencia cardíaca %lld ppm" } }, "fr": { "stringUnit": { "state": "translated", "value": "Fréquence cardiaque %lld bpm" } }, "it": { "stringUnit": { "state": "translated", "value": "Frequenza cardiaca %lld bpm" } }, "pl": { "stringUnit": { "state": "translated", "value": "Tętno %lld bpm" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Frequência cardíaca %lld bpm" } }, "ru": { "stringUnit": { "state": "translated", "value": "Пульс %lld уд/мин" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "心率 %lld bpm" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "心率 %lld bpm" } }
+    } },
+    "Heart rate %lld bpm, minimum %lld, maximum %lld": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Herzfrequenz %lld bpm, Minimum %lld, Maximum %lld" } }, "en": { "stringUnit": { "state": "translated", "value": "Heart rate %lld bpm, minimum %lld, maximum %lld" } }, "es": { "stringUnit": { "state": "translated", "value": "Frecuencia cardíaca %lld ppm, mínimo %lld, máximo %lld" } }, "fr": { "stringUnit": { "state": "translated", "value": "Fréquence cardiaque %lld bpm, minimum %lld, maximum %lld" } }, "it": { "stringUnit": { "state": "translated", "value": "Frequenza cardiaca %lld bpm, minimo %lld, massimo %lld" } }, "pl": { "stringUnit": { "state": "translated", "value": "Tętno %lld bpm, minimum %lld, maksimum %lld" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Frequência cardíaca %lld bpm, mínimo %lld, máximo %lld" } }, "ru": { "stringUnit": { "state": "translated", "value": "Пульс %lld уд/мин, минимум %lld, максимум %lld" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "心率 %lld bpm，最低 %lld，最高 %lld" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "心率 %lld bpm，最低 %lld，最高 %lld" } }
+    } },
+    "Min %lld • Max %lld": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Min. %lld • Max. %lld" } }, "en": { "stringUnit": { "state": "translated", "value": "Min %lld • Max %lld" } }, "es": { "stringUnit": { "state": "translated", "value": "Mín %lld • Máx %lld" } }, "fr": { "stringUnit": { "state": "translated", "value": "Min. %lld • Max. %lld" } }, "it": { "stringUnit": { "state": "translated", "value": "Min. %lld • Max. %lld" } }, "pl": { "stringUnit": { "state": "translated", "value": "Min %lld • Maks %lld" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Mín %lld • Máx %lld" } }, "ru": { "stringUnit": { "state": "translated", "value": "Мин %lld • Макс %lld" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "最低 %lld • 最高 %lld" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "最低 %lld • 最高 %lld" } }
+    } },
+    "Updated %@": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Aktualisiert %@" } }, "en": { "stringUnit": { "state": "translated", "value": "Updated %@" } }, "es": { "stringUnit": { "state": "translated", "value": "Actualizado %@" } }, "fr": { "stringUnit": { "state": "translated", "value": "Mis à jour %@" } }, "it": { "stringUnit": { "state": "translated", "value": "Aggiornato %@" } }, "pl": { "stringUnit": { "state": "translated", "value": "Zaktualizowano %@" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Atualizado %@" } }, "ru": { "stringUnit": { "state": "translated", "value": "Обновлено %@" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "更新于 %@" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "更新於 %@" } }
+    } },
     "Body measurement units": { "localizations": {
       "de": { "stringUnit": { "state": "translated", "value": "Einheiten für Körpermaße" } }, "es": { "stringUnit": { "state": "translated", "value": "Unidades de medidas corporales" } }, "fr": { "stringUnit": { "state": "translated", "value": "Unités des mensurations" } }, "it": { "stringUnit": { "state": "translated", "value": "Unità delle misure corporee" } }, "pl": { "stringUnit": { "state": "translated", "value": "Jednostki pomiarów ciała" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Unidades das medidas corporais" } }, "ru": { "stringUnit": { "state": "translated", "value": "Единицы параметров тела" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "身体测量单位" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "身體測量單位" } }
     } },
diff --git a/StrandTests/HrTraceTests.swift b/StrandTests/HrTraceTests.swift
new file mode 100644
index 0000000000..490057200d
--- /dev/null
+++ b/StrandTests/HrTraceTests.swift
@@ -0,0 +1,181 @@
+import XCTest
+
+/// Swift twin of the Kotlin `HrTraceTest` (#1957).
+///
+/// These exist to keep the two platforms reading the same heart, not merely to check Swift. Every case
+/// below has a Kotlin counterpart asserting the same thing, so a change to the retention rule, the tick
+/// choices or the normalisation that lands on one side alone fails here.
+///
+/// The degenerate cases carry the weight, because they are ordinary on a home screen rather than exotic:
+/// a widget added mid-afternoon has one point, and a resting arm holds one bpm for minutes.
+final class HrTraceTests: XCTestCase {
+
+    private func series(_ pairs: [(Int64, Int)]) -> [HrPoint] {
+        pairs.map { HrPoint(ts: $0.0, bpm: $0.1) }
+    }
+
+    // MARK: retention
+
+    func testOnePointPerMinuteBucketNewestWins() {
+        var s = HrTrace.append([], ts: 600, bpm: 60)
+        s = HrTrace.append(s, ts: 620, bpm: 64)   // same bucket
+        s = HrTrace.append(s, ts: 660, bpm: 70)   // next bucket
+        XCTAssertEqual(s.count, 2)
+        XCTAssertEqual(s[0].bpm, 64)              // newest within the bucket won
+        XCTAssertEqual(s[0].ts, 600)              // stamped at the bucket, not the sample
+        XCTAssertEqual(s[1].bpm, 70)
+    }
+
+    /// The headline number is the latest bpm; a trace ending on an average would disagree with it.
+    func testLastPointEqualsLatestReading() {
+        var s: [HrPoint] = []
+        for i in 0...5 { s = HrTrace.append(s, ts: 600 + Int64(i) * 60, bpm: 60 + i) }
+        XCTAssertEqual(HrTrace.stats(s)?.latest, 65)
+        XCTAssertEqual(s.last?.bpm, 65)
+    }
+
+    func testReadingsOlderThanTheWindowFallOff() {
+        let now: Int64 = 100_000
+        let s = series([(now - HrTrace.windowSec - 60, 50), (now - 60, 70)])
+        let kept = HrTrace.prune(s, nowSec: now)
+        XCTAssertEqual(kept.count, 1)
+        XCTAssertEqual(kept[0].bpm, 70)
+    }
+
+    /// A clock that jumps backwards must not grow the series without bound.
+    func testPointCapHoldsUnderABackwardsClock() {
+        var s: [HrPoint] = []
+        for i in 0..<(HrTrace.maxPoints + 50) {
+            s = HrTrace.append(s, ts: Int64(i) * 60, bpm: 60, nowSec: 0)
+        }
+        XCTAssertLessThanOrEqual(s.count, HrTrace.maxPoints)
+    }
+
+    func testNonPositiveBpmIsNotRecorded() {
+        XCTAssertTrue(HrTrace.append([], ts: 600, bpm: 0).isEmpty)
+    }
+
+    // MARK: geometry
+
+    func testPointsSpanTheBoxAndFlipBpmUpward() {
+        let pts = HrTrace.points(series([(0, 60), (60, 80)]), width: 100, height: 50)
+        XCTAssertEqual(pts[0].x, 0, accuracy: 0.001)
+        XCTAssertEqual(pts[1].x, 100, accuracy: 0.001)
+        XCTAssertEqual(pts[0].y, 50, accuracy: 0.001)   // the LOW bpm sits at the BOTTOM
+        XCTAssertEqual(pts[1].y, 0, accuracy: 0.001)
+    }
+
+    /// A resting arm holds one bpm for minutes. Zero range must not divide, and must not read as a
+    /// flatlined or maxed-out heart, so the line runs along the middle.
+    func testFlatSeriesDrawsDownTheMiddle() {
+        let pts = HrTrace.points(series([(0, 60), (60, 60), (120, 60)]), width: 90, height: 40)
+        XCTAssertEqual(pts.count, 3)
+        for p in pts { XCTAssertEqual(p.y, 20, accuracy: 0.001) }
+    }
+
+    /// A widget added mid-afternoon has exactly one point until the next minute ticks.
+    func testSinglePointSitsAtTheLeftEdge() {
+        let pts = HrTrace.points(series([(600, 61)]), width: 100, height: 50)
+        XCTAssertEqual(pts.count, 1)
+        XCTAssertEqual(pts[0].x, 0, accuracy: 0.001)
+        XCTAssertFalse(pts[0].y.isNaN)
+    }
+
+    func testEmptySeriesOrZeroBoxDrawsNothing() {
+        XCTAssertTrue(HrTrace.points([], width: 100, height: 50).isEmpty)
+        XCTAssertTrue(HrTrace.points(series([(0, 60)]), width: 0, height: 50).isEmpty)
+        XCTAssertTrue(HrTrace.points(series([(0, 60)]), width: 100, height: 0).isEmpty)
+    }
+
+    // MARK: ticks
+
+    func testBpmTicksRunMaxMiddleMin() {
+        XCTAssertEqual(HrTrace.bpmTicks(HrTrace.Stats(min: 59, max: 84, latest: 69)), [84, 72, 59])
+    }
+
+    /// Three copies of one number is the honest reading of a steady heart. The VIEW declines to draw a
+    /// scale in that case; the rule stays here so both platforms agree on what the labels would be.
+    func testFlatSeriesLabelsOneNumberThreeTimes() {
+        XCTAssertEqual(HrTrace.bpmTicks(HrTrace.Stats(min: 60, max: 60, latest: 60)), [60, 60, 60])
+    }
+
+    func testTimeTicksAnchorToTheDataNotTheWindow() {
+        XCTAssertEqual(HrTrace.timeTicks(series([(1_000, 60), (1_600, 62), (2_200, 64)])),
+                       [1_000, 1_600, 2_200])
+    }
+
+    func testTimeTicksDegradeWithoutEnoughSpan() {
+        XCTAssertEqual(HrTrace.timeTicks([]), [])
+        XCTAssertEqual(HrTrace.timeTicks(series([(600, 60)])), [600])
+        XCTAssertEqual(HrTrace.timeTicks(series([(600, 60), (601, 61)])), [600, 601])
+    }
+
+    func testStatsOverAnEmptySeriesIsNil() {
+        XCTAssertNil(HrTrace.stats([]))
+    }
+
+    // MARK: the publish gate that keeps the trace alive
+
+    /// `renderedContentChanged` compares bpm, not history, so a steady heart produced no publish and
+    /// therefore no new point — the trace would stop advancing at rest and prune to empty. This is the
+    /// rule that asks for a write anyway, and it must fire exactly when a new minute bucket opens.
+    func testTraceNeedsPointWhenTheBucketRolls() {
+        let base = Date(timeIntervalSince1970: 1_000_000)
+        var snap = WidgetSnapshot(recovery: nil, bpm: 70, batteryPct: nil, bonded: true, updated: base)
+        snap.hrSeries = [HrPoint(ts: Int64(base.timeIntervalSince1970), bpm: 70)]
+
+        XCTAssertFalse(WidgetSnapshot.traceNeedsPoint(previous: snap, bpm: 70, now: base.addingTimeInterval(5)),
+                       "same bucket needs nothing")
+        XCTAssertTrue(WidgetSnapshot.traceNeedsPoint(previous: snap, bpm: 70, now: base.addingTimeInterval(61)),
+                      "a new bucket wants its point even though bpm is unchanged")
+    }
+
+    func testTraceNeedsNoPointWithoutAReading() {
+        let now = Date(timeIntervalSince1970: 1_000_000)
+        XCTAssertFalse(WidgetSnapshot.traceNeedsPoint(previous: nil, bpm: nil, now: now))
+        XCTAssertFalse(WidgetSnapshot.traceNeedsPoint(previous: nil, bpm: 0, now: now))
+        XCTAssertTrue(WidgetSnapshot.traceNeedsPoint(previous: nil, bpm: 70, now: now),
+                      "no stored series at all means the first reading is wanted")
+    }
+
+
+    // MARK: the age rule on the headline number
+
+    /// Twin of the Kotlin `HrDisplay`. Without it the card contradicted itself once the trace began
+    /// pruning: an empty chart under a confident number, from a reading hours old.
+    func testAFreshReadingIsShownAndNotDimmed() {
+        let now = Date(timeIntervalSince1970: 1_000_000)
+        let r = HrDisplay.resolve(bpm: 70, newestPointTs: Int64(now.timeIntervalSince1970) - 30, now: now)
+        XCTAssertEqual(r.bpm, 70)
+        XCTAssertFalse(r.stale)
+    }
+
+    func testACarriedReadingIsShownButDimmed() {
+        let now = Date(timeIntervalSince1970: 1_000_000)
+        let ts = Int64(now.timeIntervalSince1970 - HrDisplay.liveWindow - 30)
+        let r = HrDisplay.resolve(bpm: 70, newestPointTs: ts, now: now)
+        XCTAssertEqual(r.bpm, 70)
+        XCTAssertTrue(r.stale, "past the live window it is carried over, not current")
+    }
+
+    func testAnAncientReadingIsDroppedEntirely() {
+        let now = Date(timeIntervalSince1970: 1_000_000)
+        let ts = Int64(now.timeIntervalSince1970 - HrDisplay.staleCap - 60)
+        XCTAssertNil(HrDisplay.resolve(bpm: 70, newestPointTs: ts, now: now).bpm)
+    }
+
+    /// A widget added this minute has a reading and an empty series. Treating that as stale would blank
+    /// a widget at the moment it started working.
+    func testAFirstReadingWithNoTraceYetIsShown() {
+        let now = Date(timeIntervalSince1970: 1_000_000)
+        let r = HrDisplay.resolve(bpm: 70, newestPointTs: nil, now: now)
+        XCTAssertEqual(r.bpm, 70)
+        XCTAssertFalse(r.stale)
+    }
+
+    func testNoReadingShowsNothing() {
+        let now = Date(timeIntervalSince1970: 1_000_000)
+        XCTAssertNil(HrDisplay.resolve(bpm: nil, newestPointTs: nil, now: now).bpm)
+        XCTAssertNil(HrDisplay.resolve(bpm: 0, newestPointTs: nil, now: now).bpm)
+    }
+}
diff --git a/StrandiOS/Widgets/WidgetPublish.swift b/StrandiOS/Widgets/WidgetPublish.swift
index 2f75feb1fb..e3fb382fbb 100644
--- a/StrandiOS/Widgets/WidgetPublish.swift
+++ b/StrandiOS/Widgets/WidgetPublish.swift
@@ -110,12 +110,18 @@ extension WidgetSnapshot {
     private static func saveAndReloadIfChanged(_ snap: WidgetSnapshot, previous: WidgetSnapshot? = nil) {
         let previous = previous ?? load()
         if renderedContentChanged(from: previous, to: snap) {
-            snap.save()
+            snap.save(previousSeries: previous?.hrSeries ?? [])
             WidgetCenter.shared.reloadAllTimelines()
+        } else if WidgetSnapshot.traceNeedsPoint(previous: previous, bpm: snap.bpm, now: snap.updated) {
+            // A steady heart changes nothing the header renders, so the branch above declines — but the
+            // TRACE still wants this minute's point, or it stops advancing at rest and prunes to empty
+            // (#1957). Persist without a reload: the point is for the next timeline WidgetKit builds,
+            // and spending a reload a minute is exactly what the dedup above exists to avoid.
+            snap.save(previousSeries: previous?.hrSeries ?? [])
         } else if liveUpdateRequiresFullBuild(previous: previous, now: snap.updated) {
             // The rollover's visible values can legitimately match yesterday's. Persist the fresh day
             // stamp once without spending a redundant WidgetKit reload, so later live ticks stay fast.
-            snap.save()
+            snap.save(previousSeries: previous?.hrSeries ?? [])
         }
     }
 
diff --git a/StrandiOSShared/HrTrace.swift b/StrandiOSShared/HrTrace.swift
new file mode 100644
index 0000000000..b53b929538
--- /dev/null
+++ b/StrandiOSShared/HrTrace.swift
@@ -0,0 +1,169 @@
+import Foundation
+
+/// One point on the widget's heart-rate trace: when it was taken, and the bpm.
+///
+/// `Sendable` because a SwiftUI `Shape` holding these is itself Sendable, and the compiler warns that
+/// carrying a non-Sendable stored property there is an error in a future language mode. Two immutable
+/// value fields, so it is Sendable by inspection rather than by assertion.
+public struct HrPoint: Codable, Equatable, Sendable {
+    public let ts: Int64
+    public let bpm: Int
+    public init(ts: Int64, bpm: Int) {
+        self.ts = ts
+        self.bpm = bpm
+    }
+}
+
+/// The pure half of the heart-rate widget: what the trace CONTAINS and where its ink goes.
+///
+/// Swift twin of the Kotlin `HrTrace`. The retention rule, the tick choices and the normalisation are
+/// the same decisions on both platforms and must not be made twice — a trace that kept a different
+/// window, or picked different labels, would be a different reading of the same heart.
+///
+/// What deliberately does NOT port is the bitmap sizing: `fitBox`, the byte budget and the 565 pixel
+/// depth exist because Glance compiles to RemoteViews, cannot draw, and carries its payload over a
+/// Binder transaction with a hard ceiling. WidgetKit is SwiftUI and strokes the trace as a vector, so
+/// there is no bitmap to budget for and nothing here needs a pixel format.
+///
+/// `encode`/`decode` do not port either. Android packs the series into a SharedPreferences string
+/// because that is what it has; the snapshot here is already Codable and carries `[HrPoint]` directly,
+/// so a hand-rolled format would be a second encoding to keep correct for no gain.
+public enum HrTrace {
+
+    /// How much history the trace shows. Three hours matches what fits legibly at widget width.
+    public static let windowSec: Int64 = 3 * 60 * 60
+
+    /// One point per minute. The strap streams ~1/s; keeping every sample would put 10 800 points
+    /// behind a trace a few hundred points wide, which costs space and buys nothing the eye resolves.
+    public static let bucketSec: Int64 = 60
+
+    /// Hard cap, so a clock jump backwards cannot grow the series without bound.
+    public static let maxPoints = 200
+
+    /// Fold a fresh reading into the series: one point per minute bucket, newest wins within a bucket.
+    ///
+    /// Newest-wins rather than an average because the widget's headline number is the LATEST bpm, and a
+    /// trace whose last point disagreed with the number printed above it would read as a bug.
+    public static func append(_ series: [HrPoint], ts: Int64, bpm: Int, nowSec: Int64? = nil) -> [HrPoint] {
+        let now = nowSec ?? ts
+        guard bpm > 0 else { return prune(series, nowSec: now) }
+        let bucket = ts / bucketSec * bucketSec
+        var out = series.filter { $0.ts != bucket }
+        out.append(HrPoint(ts: bucket, bpm: bpm))
+        // No sort here: `prune` sorts on the way out and has to anyway, since it is also the entry point
+        // for a decoded series. Appending at the end is already in order for anything but a backwards
+        // clock, and prune's sort is what makes even that correct.
+        return prune(out, nowSec: now)
+    }
+
+    /// Drop anything older than the window, then anything beyond the cap (oldest first).
+    public static func prune(_ series: [HrPoint], nowSec: Int64) -> [HrPoint] {
+        let floor = nowSec - windowSec
+        let kept = series.filter { $0.ts >= floor }.sorted { $0.ts < $1.ts }
+        guard kept.count > maxPoints else { return kept }
+        return Array(kept.suffix(maxPoints))
+    }
+
+    /// The three numbers the header shows. Nil when there is nothing to describe.
+    public struct Stats: Equatable {
+        public let min: Int
+        public let max: Int
+        public let latest: Int
+    }
+
+    public static func stats(_ series: [HrPoint]) -> Stats? {
+        guard let first = series.first, let last = series.last else { return nil }
+        var lo = first.bpm
+        var hi = first.bpm
+        for p in series {
+            if p.bpm < lo { lo = p.bpm }
+            if p.bpm > hi { hi = p.bpm }
+        }
+        return Stats(min: lo, max: hi, latest: last.bpm)
+    }
+
+    /// A point in the trace's drawing box, origin top-left.
+    public struct Pt: Equatable {
+        public let x: CGFloat
+        public let y: CGFloat
+    }
+
+    /// The trace as coordinates inside a `width` x `height` box.
+    ///
+    /// Two degenerate shapes decide most of this, and both are ordinary rather than exotic — a widget
+    /// placed mid-afternoon has one point, and a resting arm holds one bpm for minutes at a time:
+    ///
+    ///  - ONE point, or every point at the same instant: there is no time axis to spread across, so it
+    ///    sits at the left edge rather than at x = NaN.
+    ///  - every bpm equal: there is no range to scale into, so the line runs along the VERTICAL MIDDLE.
+    ///    Pinning it to the top or bottom would read as a maxed-out or flatlined heart.
+    ///
+    /// Y is flipped on the way out: bpm rises upward, screen coordinates rise downward.
+    public static func points(_ series: [HrPoint], width: CGFloat, height: CGFloat) -> [Pt] {
+        guard !series.isEmpty, width > 0, height > 0,
+              let t0 = series.first?.ts, let t1 = series.last?.ts else { return [] }
+        let span = CGFloat(t1 - t0)
+        var lo = series[0].bpm
+        var hi = series[0].bpm
+        for p in series {
+            if p.bpm < lo { lo = p.bpm }
+            if p.bpm > hi { hi = p.bpm }
+        }
+        let range = CGFloat(hi - lo)
+        return series.map { p in
+            let x = span <= 0 ? 0 : CGFloat(p.ts - t0) / span * width
+            let y = range <= 0 ? height / 2 : height - CGFloat(p.bpm - lo) / range * height
+            return Pt(x: x, y: y)
+        }
+    }
+
+    /// The three bpm labels down the right edge: max, midpoint, min, stacked as they appear.
+    ///
+    /// A flat series returns the same number three times rather than an invented spread — the honest
+    /// reading of a steady heart is one number. The VIEW declines to draw a scale in that case; the
+    /// rule stays here so both platforms agree on what the labels would be.
+    public static func bpmTicks(_ stats: Stats) -> [Int] {
+        [stats.max, (stats.min + stats.max + 1) / 2, stats.min]
+    }
+
+    /// The three timestamps along the bottom: first, middle, last of the DATA, not of the window.
+    ///
+    /// Anchored to the data because a widget holding forty minutes of history would otherwise label its
+    /// axis with two hours that were never sampled. Fewer than three distinct instants returns what
+    /// there is, so the view draws one label rather than three copies of it.
+    public static func timeTicks(_ series: [HrPoint]) -> [Int64] {
+        guard let first = series.first?.ts, let last = series.last?.ts else { return [] }
+        if first == last { return [first] }
+        let mid = first + (last - first) / 2
+        if mid == first || mid == last { return [first, last] }
+        return [first, mid, last]
+    }
+}
+
+/// What heart rate the widget should SHOW, given how long ago it was actually measured.
+///
+/// Twin of the Kotlin `HrDisplay`, and the reason it exists is the same on both platforms: a snapshot
+/// carries the last reading indefinitely, so without an age rule a widget renders an hours-old number as
+/// though it were current.
+///
+/// Anchored to the newest TRACE POINT rather than to the snapshot's `updated`, which is the closer twin
+/// of Android reading its own `hrAt`. A publish happens for battery or score changes too, so `updated`
+/// refreshes without a new reading and would make a stale heart look fresh.
+public enum HrDisplay {
+    /// Past this without a newer reading the number is DIMMED: still shown, no longer claimed as live.
+    public static let liveWindow: TimeInterval = 2 * 60
+
+    /// Past this it is dropped entirely — too old to stand for the wearer at all.
+    public static let staleCap: TimeInterval = 15 * 60
+
+    /// - Returns: the bpm to show (nil to show nothing) and whether it is a carried-over reading.
+    public static func resolve(bpm: Int?, newestPointTs: Int64?, now: Date) -> (bpm: Int?, stale: Bool) {
+        guard let bpm, bpm > 0 else { return (nil, false) }
+        // No trace yet is the FIRST reading, not an old one: a widget added this minute has a bpm and an
+        // empty series, and dropping the number there would blank a widget that just started working.
+        guard let newestPointTs else { return (bpm, false) }
+        let age = now.timeIntervalSince1970 - TimeInterval(newestPointTs)
+        if age > staleCap { return (nil, false) }
+        return (bpm, age > liveWindow)
+    }
+}
diff --git a/StrandiOSShared/WidgetSnapshot.swift b/StrandiOSShared/WidgetSnapshot.swift
index fb7e5c6f5e..34075848d0 100644
--- a/StrandiOSShared/WidgetSnapshot.swift
+++ b/StrandiOSShared/WidgetSnapshot.swift
@@ -21,10 +21,17 @@ public struct WidgetSnapshot: Codable, Equatable {
     public var effortDisplay: String?
     /// True when `effortDisplay` is on WHOOP's 0–21 axis; false/nil means 0–100. Accessibility only.
     public var effortWhoop: Bool?
+    /// The last `HrTrace.windowSec` of heart rate, one point per minute, for the trace widget (#1957).
+    ///
+    /// Folded in by `save()` rather than by the callers that build a snapshot, which is the twin of the
+    /// Android store owning it: nothing that publishes had to learn the retention rule. Optional so a
+    /// snapshot written by an older build still decodes.
+    public var hrSeries: [HrPoint]?
 
     public init(recovery: Int?, bpm: Int?, batteryPct: Int?, bonded: Bool, updated: Date,
                 effort: Int? = nil, rest: Int? = nil, hrv: Int? = nil, restingHr: Int? = nil,
-                effortDisplay: String? = nil, effortWhoop: Bool? = nil) {
+                effortDisplay: String? = nil, effortWhoop: Bool? = nil,
+                hrSeries: [HrPoint]? = nil) {
         self.recovery = recovery
         self.bpm = bpm
         self.batteryPct = batteryPct
@@ -36,6 +43,7 @@ public struct WidgetSnapshot: Codable, Equatable {
         self.restingHr = restingHr
         self.effortDisplay = effortDisplay
         self.effortWhoop = effortWhoop
+        self.hrSeries = hrSeries
     }
 
     /// App Group suite the app and widget both use. Injected from the `APP_GROUP_ID` build setting
@@ -113,13 +121,47 @@ public struct WidgetSnapshot: Codable, Equatable {
         return snap
     }
 
-    /// Persist this snapshot into the shared suite.
+    /// Persist this snapshot into the shared suite, folding the live bpm into the trace on the way.
+    ///
+    /// The fold happens HERE, not in the callers that build a snapshot, so nothing that publishes has to
+    /// know the retention rule — the twin of the Android store owning it. A snapshot with no bpm leaves
+    /// the stored trace alone rather than truncating it, so a quiet strap does not erase the history the
+    /// widget is drawing.
     public func save() {
-        guard let defaults = UserDefaults(suiteName: WidgetSnapshot.suiteName),
-              let data = try? JSONEncoder().encode(self) else { return }
+        save(previousSeries: WidgetSnapshot.load()?.hrSeries ?? [])
+    }
+
+    /// As `save()`, for a caller that already holds the stored snapshot.
+    ///
+    /// The publish path loads `previous` to decide whether anything changed, and `save()` was then
+    /// decoding the same App Group blob a second time just to reach the trace. Handing the series in
+    /// costs the caller nothing and removes a full JSON decode from every publish.
+    public func save(previousSeries: [HrPoint]) {
+        guard let defaults = UserDefaults(suiteName: WidgetSnapshot.suiteName) else { return }
+        var toStore = self
+        let previous = previousSeries
+        let nowSec = Int64(updated.timeIntervalSince1970)
+        toStore.hrSeries = bpm.map { HrTrace.append(previous, ts: nowSec, bpm: $0, nowSec: nowSec) }
+            ?? HrTrace.prune(previous, nowSec: nowSec)
+        guard let data = try? JSONEncoder().encode(toStore) else { return }
         defaults.set(data, forKey: WidgetSnapshot.storageKey)
     }
 
+    /// Does the TRACE need a point, even though nothing the header renders has changed?
+    ///
+    /// `renderedContentChanged` compares bpm, not history, so a steady heart — the ordinary case at rest
+    /// — produced no publish and therefore no new trace point. The trace would stop advancing while the
+    /// strap streamed happily, and pruning would eventually empty it. Android does not have this problem
+    /// because its PushGate re-admits an unchanged key once a minute; this is that rule.
+    ///
+    /// Keyed on the BUCKET rather than elapsed seconds, so it asks for a write exactly when
+    /// `HrTrace.append` would actually record one, and never more often.
+    static func traceNeedsPoint(previous: WidgetSnapshot?, bpm: Int?, now: Date) -> Bool {
+        guard let bpm, bpm > 0 else { return false }
+        guard let last = previous?.hrSeries?.last else { return true }
+        return Int64(now.timeIntervalSince1970) / HrTrace.bucketSec > last.ts / HrTrace.bucketSec
+    }
+
     /// Whether publishing `next` would change anything the widget actually renders. `updated` is
     /// deliberately excluded: no widget family displays it, and treating a fresh timestamp as content
     /// would defeat deduplication because every otherwise-identical build creates a new date.
diff --git a/StrandiOSWidgets/HeartRateWidget.swift b/StrandiOSWidgets/HeartRateWidget.swift
new file mode 100644
index 0000000000..fad219e5d5
--- /dev/null
+++ b/StrandiOSWidgets/HeartRateWidget.swift
@@ -0,0 +1,236 @@
+import StrandDesign
+import SwiftUI
+import WidgetKit
+
+/// Home-screen widget: the live heart rate with the last `HrTrace.windowSec` drawn as a trace (#1957).
+///
+/// Swift twin of the Android `HrGlanceWidget`, but the drawing is NOT a port. Glance compiles to
+/// RemoteViews and cannot draw, so Android renders the trace to a Bitmap under a payload budget and a
+/// reduced pixel depth. WidgetKit is SwiftUI: the trace is a stroked `Path`, resolution-independent,
+/// with no bitmap to size and nothing to budget. What IS shared is `HrTrace` — the retention rule, the
+/// normalisation and the tick choices — because those are the same reading of the same heart.
+///
+/// Honest-blank throughout, matching the twin: no reading shows an em dash and no chart, never a flat
+/// line at zero. A single point draws a dot, because a widget added this minute has exactly one.
+struct HeartRateEntry: TimelineEntry {
+    let date: Date
+    let snap: WidgetSnapshot?
+}
+
+struct HeartRateProvider: TimelineProvider {
+    func placeholder(in context: Context) -> HeartRateEntry {
+        HeartRateEntry(date: Date(), snap: nil)
+    }
+
+    func getSnapshot(in context: Context, completion: @escaping (HeartRateEntry) -> Void) {
+        completion(HeartRateEntry(date: Date(), snap: WidgetSnapshot.load()))
+    }
+
+    func getTimeline(in context: Context, completion: @escaping (Timeline<HeartRateEntry>) -> Void) {
+        let entry = HeartRateEntry(date: Date(), snap: WidgetSnapshot.load())
+        // The app reloads timelines when the heart rate moves, so this is only the safety net for when
+        // it is not running. Fifteen minutes rather than the trace's one-minute bucket: a widget cannot
+        // outrun its publisher, and asking more often spends budget WidgetKit would decline anyway.
+        let next = Calendar.current.date(byAdding: .minute, value: 15, to: Date())
+            ?? Date().addingTimeInterval(900)
+        completion(Timeline(entries: [entry], policy: .after(next)))
+    }
+}
+
+/// The trace itself: a stroked path with a fill beneath it.
+///
+/// Takes its size from the geometry rather than a guess, which is the whole advantage over the Android
+/// twin — there is no bitmap, so nothing has to predict the box or survive being stretched into it.
+private struct HrTraceShape: Shape {
+    let series: [HrPoint]
+    /// When true, close the path down to the baseline for the gradient fill.
+    let filled: Bool
+
+    func path(in rect: CGRect) -> Path {
+        var path = Path()
+        let pts = HrTrace.points(series, width: rect.width, height: rect.height)
+        guard let first = pts.first else { return path }
+        if pts.count == 1 {
+            // One reading is not a line. A dot says "one reading"; an empty box says "no data", and
+            // those are different things.
+            guard !filled else { return path }
+            let r: CGFloat = 2.5
+            path.addEllipse(in: CGRect(x: max(first.x, r) - r, y: first.y - r, width: r * 2, height: r * 2))
+            return path
+        }
+        path.move(to: CGPoint(x: first.x, y: first.y))
+        for p in pts.dropFirst() { path.addLine(to: CGPoint(x: p.x, y: p.y)) }
+        if filled {
+            path.addLine(to: CGPoint(x: pts[pts.count - 1].x, y: rect.maxY))
+            path.addLine(to: CGPoint(x: first.x, y: rect.maxY))
+            path.closeSubpath()
+        }
+        return path
+    }
+}
+
+struct HeartRateWidgetView: View {
+    let entry: HeartRateEntry
+
+    /// Pruned on the way OUT as well as on the way in, matching the Kotlin twin. A widget rendered
+    /// hours after the last publish would otherwise draw a trace whose newest point is long stale, under
+    /// a time axis implying it is current — and WidgetKit renders an entry at ITS date, which is why the
+    /// window is measured from `entry.date` rather than from `Date()`.
+    private var series: [HrPoint] {
+        HrTrace.prune(entry.snap?.hrSeries ?? [], nowSec: Int64(entry.date.timeIntervalSince1970))
+    }
+    private var stats: HrTrace.Stats? { HrTrace.stats(series) }
+    /// Age-checked, so an hours-old reading is not printed as current. Without this the prune above made
+    /// the card incoherent: the trace emptied while the headline kept its confident number.
+    private var shown: (bpm: Int?, stale: Bool) {
+        HrDisplay.resolve(bpm: entry.snap?.bpm, newestPointTs: series.last?.ts, now: entry.date)
+    }
+    /// The palette's HR zone-5 token, which resolves to exactly the hexes the Android widget carries as
+    /// a local mirror (#C84E1E / #E0662F) — so the two widgets are the same colour rather than two
+    /// approximations of one. Named rather than hardcoded here because, unlike Glance, this target can
+    /// read the design package; and being a token it follows the Classic theme where a hex could not.
+    private var accent: Color { StrandPalette.zone5 }
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 6) {
+            HStack(spacing: 6) {
+                Image(systemName: "heart.fill")
+                    .font(.system(size: 12))
+                    .foregroundStyle(accent)
+                Text("Heart rate")
+                    .font(.system(size: 13, weight: .medium))
+                    .foregroundStyle(StrandPalette.textPrimary)
+            }
+
+            HStack(alignment: .lastTextBaseline, spacing: 4) {
+                Text(shown.bpm.map(String.init) ?? "—")
+                    .font(.system(size: 30, weight: .bold, design: .rounded))
+                    .foregroundStyle(shown.stale ? StrandPalette.textSecondary : StrandPalette.textPrimary)
+                if shown.bpm != nil {
+                    Text("bpm")
+                        .font(.system(size: 12))
+                        .foregroundStyle(StrandPalette.textSecondary)
+                }
+                if let stats {
+                    Text("Min \(stats.min) • Max \(stats.max)")
+                        .font(.system(size: 11))
+                        .foregroundStyle(StrandPalette.textPrimary)
+                        .padding(.horizontal, 8)
+                        .padding(.vertical, 3)
+                        .background(accent.opacity(0.18), in: Capsule())
+                        .padding(.leading, 6)
+                }
+            }
+
+            if !series.isEmpty {
+                HStack(alignment: .top, spacing: 6) {
+                    HrTraceChart(series: series, accent: accent)
+                    // A scale of one repeated number says nothing the headline has not, so it waits for
+                    // a range — the same rule the Android twin follows.
+                    if let stats, stats.max > stats.min {
+                        // Ticks computed ONCE, and the gap keyed on the INDEX. Comparing the value to
+                        // `.last` happened to work only because a scale is drawn solely when there is a
+                        // range; with two equal ticks it would have dropped a spacer and skewed the scale.
+                        let ticks = HrTrace.bpmTicks(stats)
+                        VStack(alignment: .trailing) {
+                            ForEach(Array(ticks.enumerated()), id: \.offset) { index, tick in
+                                Text("\(tick)")
+                                    .font(.system(size: 10))
+                                    .foregroundStyle(StrandPalette.textSecondary)
+                                if index < ticks.count - 1 { Spacer(minLength: 0) }
+                            }
+                        }
+                    }
+                }
+                HrTimeAxis(series: series)
+            }
+
+            Spacer(minLength: 0)
+            if let updated = entry.snap?.updated, updated != .distantPast {
+                HStack {
+                    Spacer()
+                    Text("Updated \(updated, format: .dateTime.hour().minute())")
+                        .font(.system(size: 10))
+                        .foregroundStyle(StrandPalette.textSecondary)
+                    Spacer()
+                }
+            }
+        }
+        .accessibilityElement(children: .combine)
+        .accessibilityLabel(accessibilityText)
+    }
+
+    /// One spoken sentence rather than a run of loose numbers. The Android twin had to settle for
+    /// per-label descriptions because Glance cannot mark a Text decorative; SwiftUI can combine the
+    /// whole card, so it does. Staleness is not encoded in colour here at all, so nothing needs saying
+    /// about it.
+    private var accessibilityText: String {
+        // String(localized:) rather than bare literals. The audit DOES scan `.accessibilityLabel(`, but
+        // it matches a literal sitting immediately after the paren — and this is a computed property, so
+        // extracting the sentence here hid it from the check. Hardcoded English would have shipped to
+        // every locale with the gate green, which is the same trap the Kotlin twin records for copy
+        // written inside a semantics {} lambda.
+        guard let bpm = shown.bpm else { return String(localized: "Heart rate, no reading") }
+        guard let stats else { return String(localized: "Heart rate \(bpm) bpm") }
+        return String(localized: "Heart rate \(bpm) bpm, minimum \(stats.min), maximum \(stats.max)")
+    }
+}
+
+private struct HrTraceChart: View {
+    let series: [HrPoint]
+    let accent: Color
+
+    var body: some View {
+        ZStack {
+            HrTraceShape(series: series, filled: true)
+                .fill(LinearGradient(
+                    colors: [accent.opacity(0.35), accent.opacity(0)],
+                    startPoint: .top, endPoint: .bottom,
+                ))
+            HrTraceShape(series: series, filled: false)
+                .stroke(accent, style: StrokeStyle(lineWidth: 2, lineCap: .round, lineJoin: .round))
+        }
+        .frame(maxWidth: .infinity, maxHeight: .infinity)
+    }
+}
+
+private struct HrTimeAxis: View {
+    let series: [HrPoint]
+
+    var body: some View {
+        let ticks = HrTrace.timeTicks(series)
+        // One instant pinned to the left edge reads as a stray rather than an axis, so it waits for a
+        // span to label — matching the twin.
+        if ticks.count >= 2 {
+            HStack {
+                ForEach(Array(ticks.enumerated()), id: \.offset) { i, ts in
+                    Text(Date(timeIntervalSince1970: TimeInterval(ts)),
+                         format: .dateTime.hour().minute())
+                        .font(.system(size: 9))
+                        .foregroundStyle(StrandPalette.textSecondary)
+                    if i < ticks.count - 1 { Spacer(minLength: 0) }
+                }
+            }
+        }
+    }
+}
+
+struct HeartRateWidget: Widget {
+    static let kind = "HeartRateWidget"
+
+    var body: some WidgetConfiguration {
+        StaticConfiguration(kind: Self.kind, provider: HeartRateProvider()) { entry in
+            if #available(iOS 17.0, *) {
+                HeartRateWidgetView(entry: entry)
+                    .containerBackground(StrandPalette.surfaceBase, for: .widget)
+            } else {
+                HeartRateWidgetView(entry: entry)
+                    .padding()
+                    .background(StrandPalette.surfaceBase)
+            }
+        }
+        .configurationDisplayName("Heart Rate")
+        .description("Live heart rate with the last three hours as a trace.")
+        .supportedFamilies([.systemMedium])
+    }
+}
diff --git a/StrandiOSWidgets/NOOPWidgetBundle.swift b/StrandiOSWidgets/NOOPWidgetBundle.swift
index 647ea217fa..58ee16e311 100644
--- a/StrandiOSWidgets/NOOPWidgetBundle.swift
+++ b/StrandiOSWidgets/NOOPWidgetBundle.swift
@@ -2,12 +2,14 @@ import WidgetKit
 import SwiftUI
 
 /// The widget extension entry point. Bundles the glanceable widget, the live-HR Live Activity,
-/// and the K10 Coach brief widget (stored morning brief on Lock Screen / Home Screen).
+/// the K10 Coach brief widget (stored morning brief on Lock Screen / Home Screen), and the
+/// heart-rate trace widget (#1957).
 @main
 struct NOOPWidgetBundle: WidgetBundle {
     var body: some Widget {
         NOOPWidget()
         NOOPLiveActivity()
         CoachBriefWidget()
+        HeartRateWidget()
     }
 }
diff --git a/android/app/src/main/java/com/noop/widget/HrGlanceWidget.kt b/android/app/src/main/java/com/noop/widget/HrGlanceWidget.kt
index 93842b1e67..79bfb8dbf7 100644
--- a/android/app/src/main/java/com/noop/widget/HrGlanceWidget.kt
+++ b/android/app/src/main/java/com/noop/widget/HrGlanceWidget.kt
@@ -119,7 +119,11 @@ private const val HR_CHART_TARGET_DP = 92f
 private fun hrChartWidthDp(widthDp: Float): Float =
     (widthDp - HR_CARD_PADDING_DP - HR_SCALE_COLUMN_DP).coerceAtLeast(24f)
 
-/** The trace tint. A heart reads red in this app's language, not the screenshot's blue. */
+/** The trace tint. A heart reads red in this app's language, not the screenshot's blue.
+ *
+ *  These are the HR ZONE-5 hexes: `StrandPalette.zone5` on the Apple side resolves to exactly this
+ *  pair, so the two widgets are one colour rather than two approximations. Kept as a local literal for
+ *  the same reason every other colour in this package is — Glance composes outside the app theme. */
 private fun hrAccent(dark: Boolean) = if (dark) Color(0xFFE0662F) else Color(0xFFC84E1E)
 
 @Composable
@@ -209,7 +213,7 @@ private fun HrWidgetContent(snap: WidgetSnapshot, dark: Boolean) {
         // few minutes — a void reads as broken where a shorter widget reads as new.
         if (snap.hrSeries.isNotEmpty()) {
             Spacer(GlanceModifier.height(8.dp))
-            HrTraceImage(snap, dark, widthDp = size.width.value,
+            HrTraceImage(snap, dark, widthDp = size.width.value, stats = stats,
                          modifier = GlanceModifier.defaultWeight())
             HrTimeAxis(snap, dark)
         }
@@ -245,12 +249,14 @@ private fun HrTraceImage(
     snap: WidgetSnapshot,
     dark: Boolean,
     widthDp: Float,
+    // Passed in rather than recomputed: the caller already scanned the series for it, and a second scan
+    // per render also meant two places deciding what the scale describes.
+    stats: HrTrace.Stats?,
     // Weighted by the CALLER: Glance scopes defaultWeight() to Row/ColumnScope, so a composable
     // cannot claim its own share of the parent from in here.
     modifier: GlanceModifier,
 ) {
     val context = LocalContext.current
-    val stats = HrTrace.stats(snap.hrSeries)
     val density = context.resources.displayMetrics.density
     // Leave room for the scale column so the trace is not drawn under its own labels.
     val chartWidthDp = hrChartWidthDp(widthDp)
diff --git a/android/app/src/main/java/com/noop/widget/HrTrace.kt b/android/app/src/main/java/com/noop/widget/HrTrace.kt
index 0d24bbf5dd..7166250194 100644
--- a/android/app/src/main/java/com/noop/widget/HrTrace.kt
+++ b/android/app/src/main/java/com/noop/widget/HrTrace.kt
@@ -41,7 +41,9 @@ object HrTrace {
         val out = ArrayList<HrPoint>(series.size + 1)
         for (p in series) if (p.ts != bucket) out.add(p)
         out.add(HrPoint(bucket, bpm))
-        out.sortBy { it.ts }
+        // No sort here: [prune] sorts on the way out, and it has to anyway because [decode] feeds it
+        // untrusted input. Appending at the end is already in order for every sample that is not a clock
+        // jump backwards, and prune's sort is what makes even that case correct.
         return prune(out, nowSec)
     }
 
diff --git a/project.yml b/project.yml
index d994b7714b..8e7aa86b31 100644
--- a/project.yml
+++ b/project.yml
@@ -164,6 +164,10 @@ targets:
       # Compile the exact cross-target snapshot source into the test bundle so the AltStore App Group
       # resolver is covered without adding this iOS/widget-only type to the macOS application module.
       - StrandiOSShared/WidgetSnapshot.swift
+      # Same reasoning for the heart-rate trace: the pure half of the widget is where every decision
+      # worth testing lives, and it is iOS/widget-only, so it is compiled into the test bundle rather
+      # than added to the macOS app.
+      - StrandiOSShared/HrTrace.swift
     # Same wrapper as the app target, so the OURA_CLOUD_IMPORT-gated Oura tests compile exactly
     # when the app's Oura lane does (flag + creds both come from the untracked OuraSecrets.xcconfig).
     configFiles:

From ddec88f718bcec767939b7074c8f361c07376577 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 18:09:58 +1200
Subject: [PATCH 313/333] build: testing build 453 / 334

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 8d22ab8615..a301ebfd85 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 452
+        versionCode = 453
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 8e7aa86b31..b85e4ee56b 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "333"
+    CURRENT_PROJECT_VERSION: "334"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 6b58ac1c5014d18d404c885fbf107e18c050b749 Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Mon, 7 Sep 2026 11:44:13 +0530
Subject: [PATCH 314/333] iOS: poll 0x2A19 battery for an unbonded 5/MG on the
 keep-alive tick (#1959)

Closes the iOS half of the keep-alive divergence: an unbonded 5/MG now gets the
same periodic 0x2A19 battery read Android has had, at the same cadence.

Verified rather than taken on trust:

- the insert lands immediately before `guard didBond else { return }`, so it runs
  for unbonded straps just before that guard cuts them off
- `!didBond` in its own condition stops a bonded strap reading twice, since that
  one is already served by `enableLiveNotifications`
- `shouldPollWhoop5Battery` already existed with `charging` defaulting false, so
  this reuses the throttle rather than introducing a second timer that could
  drift from the ~60 s Android cadence
- `properties.contains(.read)` is checked before reading

iOS-only is correct: the gap was this platform lacking what Android already did,
so there is nothing to mirror back.

CI green on all four checks.
---
 Strand/BLE/BLEManager.swift                   | 26 ++++++++++++++++---
 .../Whoop5BatteryBackfillThrottleTests.swift  | 20 ++++++++++++++
 2 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index 5a36d5797c..cc46b11ca5 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -4507,6 +4507,23 @@ public final class BLEManager: NSObject, ObservableObject {
         }
         // The watchdog above is the whole of the keep-alive an unbonded 5/MG can use. Everything below
         // sends puffin-framed work that needs the encrypted bond.
+        //
+        // #1953: an unbonded 5/MG (the #1635 suppressed-hello case) still gets a periodic 0x2A19 battery
+        // read on Android — `keepAliveFire` there gates on `bonded` (the live-HR shortcut), not on the
+        // encrypted bond, and polls battery on the same ~60 s cadence regardless. iOS gates the tick on
+        // `keepAliveMayRun` (which admits `bonded && .whoop5`) but the battery read lives inside
+        // `enableLiveNotifications`, which is `didBond`-gated — so the tick fires and the read does not,
+        // and an unbonded 5/MG's battery % refreshes only when the UI asks. Poll 0x2A19 here on the SAME
+        // throttle `enableLiveNotifications` uses, so the two platforms read at the same cadence without
+        // doubling the rate on a bonded strap (this path only runs when `!didBond`).
+        if !didBond, selectedModel.deviceFamily == .whoop5,
+           let p = peripheral, let b = batteryCharacteristic, b.properties.contains(.read),
+           BLEManager.shouldPollWhoop5Battery(lastReadAt: lastBatteryReadAt,
+                                              charging: state.charging == true) {
+            p.readValue(for: b)
+            lastBatteryReadAt = Date()
+            log("Reading 5/MG battery (unbonded keep-alive) (#1953)")
+        }
         guard didBond else { return }
         guard !backfilling else { return }            // never poke the strap mid-offload
         // #927: continuous capture can be overnight-only, which makes the want TIME-dependent; nothing
@@ -4554,10 +4571,11 @@ public final class BLEManager: NSObject, ObservableObject {
         // `enableLiveNotifications` is separately gated on `didBond`, so on a #1635 strap the tick fires
         // and that read does not.
         //
-        // Which leaves a real divergence, pre-existing and NOT introduced here: Android's keep-alive polls
-        // 0x2A19 for a 5/MG whenever it runs, while this one skips it unless `didBond`. An unbonded 5/MG
-        // therefore gets a periodic battery read on Android and none here. The pack's charge comes from
-        // the pushed pack-info event (109) on both, that flag's only writer since #1945.
+        // #1953 closed that divergence: the unbonded 5/MG battery read now fires from the keep-alive tick
+        // itself (above the `guard didBond` line), on the SAME throttle `enableLiveNotifications` uses, so
+        // an unbonded 5/MG gets a periodic battery read on iOS at the same ~60 s cadence Android does. The
+        // pack's charge comes from the pushed pack-info event (109) on both, that flag's only writer since
+        // #1945.
         //
         // This leaves opcode 151 with NO sender on iOS, which is the state `FrameRouter` already records
         // for its own decoder ("nothing sent the command, so the decoder had no caller"). Android keeps a
diff --git a/StrandTests/Whoop5BatteryBackfillThrottleTests.swift b/StrandTests/Whoop5BatteryBackfillThrottleTests.swift
index 1b464af84b..863a005d67 100644
--- a/StrandTests/Whoop5BatteryBackfillThrottleTests.swift
+++ b/StrandTests/Whoop5BatteryBackfillThrottleTests.swift
@@ -119,4 +119,24 @@ final class Whoop5BatteryBackfillThrottleTests: XCTestCase {
         // The first read of a connection still always fires, charging or not.
         XCTAssertTrue(BLEManager.shouldPollWhoop5Battery(lastReadAt: nil, now: now, charging: false))
     }
+
+    // MARK: - #1953: unbonded 5/MG battery read parity
+
+    /// #1953: an unbonded 5/MG (the #1635 suppressed-hello case) gets a periodic 0x2A19 battery read on
+    /// Android's `keepAliveFire` but not on iOS — the tick runs (via `keepAliveMayRun`'s
+    /// `bonded && .whoop5` branch) but the read lives inside `enableLiveNotifications`, which is
+    /// `didBond`-gated. The fix reuses THIS throttle on the unbonded path so the two platforms read at
+    /// the same cadence without doubling the rate on a bonded strap. These pin the throttle's contract
+    /// for that new caller: the gate is the same, only the call site differs.
+    func testUnbondedBatteryReadUsesSameThrottle() {
+        // First read of a connection — always fires, bonded or not.
+        XCTAssertTrue(BLEManager.shouldPollWhoop5Battery(lastReadAt: nil))
+        // Under the floor — blocked, so an unbonded 5/MG is not re-read every 30 s tick.
+        let now = Date()
+        let last = now.addingTimeInterval(-29)
+        XCTAssertFalse(BLEManager.shouldPollWhoop5Battery(lastReadAt: last, now: now))
+        // At the floor — fires, matching Android's ~60 s cadence.
+        let last2 = now.addingTimeInterval(-BLEManager.whoop5BatteryReadMinIntervalSeconds)
+        XCTAssertTrue(BLEManager.shouldPollWhoop5Battery(lastReadAt: last2, now: now))
+    }
 }

From 5428c84572eda8aaf6373b291e7540a3f18abed8 Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Mon, 7 Sep 2026 11:49:29 +0530
Subject: [PATCH 315/333] backfill: name the unbonded-offload probe in the
 deferral diagnostic (#1963)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The backfill deferral diagnostic explained the dead end accurately and then
stopped, without naming the one action that exists for it. It names it now.

Verified rather than taken on trust:

- the hint is inside the `family == "WHOOP5" && !didBond && !helloEverWrittenThisLink`
  branch, so it cannot appear on a 4.0 or on a bonded strap — it is scoped to the
  same structural claim the surrounding text makes
- the three-way split is right: silent when the probe is already on (its own
  lines report what it found), the retry path when it has retired, the toggle
  otherwise
- both new parameters default to false, so existing callers and tests are
  unaffected
- a log line, so no localization is owed

The retired branch stays useful whatever happens to the local-teardown work in
flight: if a false negative can retire the probe, telling someone how to un-retire
it is exactly the right advice.
---
 .../com/noop/ble/StalledLinkDiagnostics.kt    | 33 +++++++-
 .../main/java/com/noop/ble/WhoopBleClient.kt  |  8 ++
 .../noop/ble/StalledLinkDiagnosticsTest.kt    | 75 +++++++++++++++++++
 3 files changed, 112 insertions(+), 4 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt b/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
index 8845afd042..58901a8ae9 100644
--- a/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/ble/StalledLinkDiagnostics.kt
@@ -87,6 +87,13 @@ internal fun helloDeferredByExplicitBondLine(
  * [helloEverWrittenThisLink] earns its place by distinguishing the two ways to arrive here that need
  * opposite fixes — a hello that was written and went unanswered (a strap or timing problem) from one that
  * was never written at all (a local decision, and the one this log's field capture actually hit).
+ *
+ * #1802: when the structural-unreachable case applies AND the unbonded-offload probe is available but not
+ * opted in, the line names the one action that exists — the "Try history sync without pairing" toggle in
+ * Test Centre. The probe was written for precisely this strap in precisely this state, and its stage 3 is
+ * SET_CLOCK, the thing the structural claim says never runs. Without this hint the diagnostic reads as
+ * hopeless when it is not. The probe stays opt-in and self-limiting; this is about discoverability, not
+ * about running it automatically.
  */
 internal fun backfillDeferredLine(
     family: String?,
@@ -95,6 +102,8 @@ internal fun backfillDeferredLine(
     explicitBondRequestedThisLink: Boolean,
     deferralsThisLink: Int,
     msSinceConnect: Long,
+    unbondedProbeOptedIn: Boolean = false,
+    unbondedProbeRetired: Boolean = false,
 ): String {
     val since = if (msSinceConnect >= 0L) "${msSinceConnect / 1000}s" else "?"
     // NULL means service discovery has not established the family yet. `connectedFamily` defaults to
@@ -105,10 +114,26 @@ internal fun backfillDeferredLine(
     val why = if (family == "WHOOP5" && !didBond && !helloEverWrittenThisLink) {
         // A structural claim, not a guess about the strap: didBond is set only by the hello's own ack,
         // so no hello written means this gate cannot open on this link no matter what the strap does.
-        " No hello was written on this link, so didBond cannot become true and this gate cannot open" +
-            " for the rest of it. SET_CLOCK rides the same handshake tail, and an un-clocked 5/MG is" +
-            " hardware-known not to persist sensor data to flash (#78 fork) — so there may also be" +
-            " nothing banked to offload."
+        val base = " No hello was written on this link, so didBond cannot become true and this gate" +
+            " cannot open for the rest of it. SET_CLOCK rides the same handshake tail, and an un-clocked" +
+            " 5/MG is hardware-known not to persist sensor data to flash (#78 fork) — so there may also" +
+            " be nothing banked to offload."
+        // #1802: name the unbonded-offload probe when it is the one action that exists for this state.
+        // The probe's stage 3 is SET_CLOCK — the thing the structural claim above says never runs — and
+        // it is designed for precisely this strap. Without this hint the diagnostic reads as hopeless
+        // when it is not. NOT a recommendation to run it automatically: the probe is opt-in and
+        // self-limiting, and #1804 showed a local teardown can produce a false negative, so the hint
+        // says where the toggle is rather than promising an answer.
+        val probe = when {
+            unbondedProbeOptedIn -> ""  // the probe is on — its own lines say what it found
+            unbondedProbeRetired -> " The \"Try history sync without pairing\" experiment has retired for" +
+                " this strap — turn it off and on in Test Centre to retry (#1804 fixed a false negative" +
+                " that could have latched it)."
+            else -> " The \"Try history sync without pairing\" experiment in Test Centre can test whether" +
+                " the offload works without a bond — its stage 3 is SET_CLOCK, the thing this gate" +
+                " blocks (#1635, #1802)."
+        }
+        base + probe
     } else {
         ""
     }
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index 09c5a939da..fa3b4c65cd 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -9856,6 +9856,14 @@ class WhoopBleClient(
                 explicitBondRequestedThisLink = explicitBondRequestedThisLink,
                 deferralsThisLink = backfillDeferralsThisLink,
                 msSinceConnect = if (connectedAtMs > 0L) System.currentTimeMillis() - connectedAtMs else -1L,
+                // #1802: name the unbonded-offload probe when the structural-unreachable case applies.
+                // The probe is the one action that exists for this state, and without this hint the
+                // diagnostic reads as hopeless when it is not.
+                unbondedProbeOptedIn = puffinExperiment.unbondedOffload,
+                unbondedProbeRetired = unbondedProbeRetired(
+                    previouslyRefused = unbondedOffloadPreviouslyRefused(lastDeviceAddress),
+                    silentLinksSoFar = unbondedProbeSilentLinks,
+                ),
             ))
             return
         }
diff --git a/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt b/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
index c600bb4490..6408ac2c2f 100644
--- a/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
+++ b/android/app/src/test/java/com/noop/ble/StalledLinkDiagnosticsTest.kt
@@ -155,6 +155,81 @@ class StalledLinkDiagnosticsTest {
         assertTrue(backfillDeferredLine("WHOOP5", false, false, true, 1, 0L).contains("sinceConnect=0s"))
     }
 
+    // ---- #1802: unbonded-offload probe discoverability ---------------------------------------
+
+    /**
+     * The structural-unreachable case with the probe NOT opted in and NOT retired is the one where the
+     * hint matters most: the diagnostic reads as hopeless, but the probe can test exactly this state.
+     * The line must name the toggle and say what it does, without promising an answer.
+     */
+    @Test
+    fun `the unreachable case names the probe toggle when not opted in`() {
+        val line = backfillDeferredLine(
+            "WHOOP5", false, false, true, 3, 42_000L,
+            unbondedProbeOptedIn = false, unbondedProbeRetired = false,
+        )
+        assertTrue(line, line.contains("Try history sync without pairing"))
+        assertTrue(line, line.contains("Test Centre"))
+        assertTrue(line, line.contains("SET_CLOCK"))
+    }
+
+    /**
+     * When the probe IS opted in, its own lines report what it found — the deferral line must not
+     * duplicate that. The hint is only for the user who has NOT turned it on.
+     */
+    @Test
+    fun `the probe hint is suppressed when the probe is opted in`() {
+        val line = backfillDeferredLine(
+            "WHOOP5", false, false, true, 3, 42_000L,
+            unbondedProbeOptedIn = true, unbondedProbeRetired = false,
+        )
+        assertFalse(line, line.contains("Try history sync without pairing"))
+    }
+
+    /**
+     * When the probe has retired (latched refusal or spent silence budget), the hint says so and
+     * points at the off/on retry — #1804 fixed a false negative that could have latched it.
+     */
+    @Test
+    fun `the probe hint names the retry path when retired`() {
+        val line = backfillDeferredLine(
+            "WHOOP5", false, false, true, 3, 42_000L,
+            unbondedProbeOptedIn = false, unbondedProbeRetired = true,
+        )
+        assertTrue(line, line.contains("retired"))
+        assertTrue(line, line.contains("turn it off and on"))
+        assertTrue(line, line.contains("#1804"))
+    }
+
+    /**
+     * The probe hint must NOT appear on the non-unreachable cases — a WHOOP4 or a hello that was
+     * written and went unanswered is a different problem with a different fix.
+     */
+    @Test
+    fun `the probe hint only appears on the structural-unreachable case`() {
+        // WHOOP4: no probe, no hint
+        assertFalse(backfillDeferredLine(
+            "WHOOP4", false, false, false, 1, 5_000L,
+            unbondedProbeOptedIn = false, unbondedProbeRetired = false,
+        ).contains("Try history sync without pairing"))
+        // Hello written but unanswered: different problem
+        assertFalse(backfillDeferredLine(
+            "WHOOP5", false, true, true, 3, 42_000L,
+            unbondedProbeOptedIn = false, unbondedProbeRetired = false,
+        ).contains("Try history sync without pairing"))
+    }
+
+    /**
+     * The default values (not opted in, not retired) preserve the old behaviour for callers that
+     * have not been updated — the hint appears on the unreachable case.
+     */
+    @Test
+    fun `default probe params preserve the old unreachable behaviour plus the hint`() {
+        val line = backfillDeferredLine("WHOOP5", false, false, true, 3, 42_000L)
+        assertTrue(line, line.contains("No hello was written"))
+        assertTrue(line, line.contains("Try history sync without pairing"))
+    }
+
     // ---- liveInsertFailedLine -----------------------------------------------------------------
 
     /**

From 6fd49b0d1b75b7e58fbd9c1eeb1f444d39f9780a Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Mon, 7 Sep 2026 11:51:58 +0530
Subject: [PATCH 316/333] backfill: distinguish no-flash-cursor from
 recording-nothing in the empty-offload banner (#1965)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The empty-offload banner was gated only on zero persisted rows, so it blamed the
clock on a strap whose flash cursor was demonstrably healthy — advancing write
pointer, drift of a second, every page carrying console output. Charging that
strap changes none of it.

Verified rather than taken on trust:

- `sawNoFlashCursor` is an accessor over the existing private `loggedNoCursor`,
  which is reset in the PER-SESSION block on both platforms alongside
  `sessionMotionRows` and friends. That is the right scope: the banner is about
  THIS sync, and a strap that once lacked a cursor must not keep being told so
- the priority is unchanged — `staleRecordBanner` still wins when the strap's own
  newest record dates the silence; the new split only replaces the fallback
- both platforms move together, with tests either side
- the copy carries no em-dash, and there is a test asserting it, which is the
  project rule

Not localized, matching the sibling `lastSyncError` strings it sits beside. The
PR says so explicitly rather than leaving it to be noticed, which is the right
way to inherit an existing gap.
---
 Strand/BLE/BLEManager.swift                   | 10 ++++-
 Strand/Collect/Backfiller.swift               | 20 +++++++++
 StrandTests/BackfillerSessionTallyTests.swift | 37 ++++++++++++++++
 .../src/main/java/com/noop/ble/Backfiller.kt  | 24 +++++++++++
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 10 ++++-
 .../noop/ble/BackfillerSessionTallyTest.kt    | 42 +++++++++++++++++++
 6 files changed, 140 insertions(+), 3 deletions(-)

diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index cc46b11ca5..5c7bb0ae59 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -2800,9 +2800,17 @@ public final class BLEManager: NSObject, ObservableObject {
                 // #1683: when the strap's own newest record dates the silence, SAY it. The generic copy
                 // below omits that and promises a recovery the charge advice has already been retried for
                 // every session; the dated version is the one a stuck user can act on.
+                //
+                // #1754: the generic "clock lost sync" copy is only correct when the strap reported
+                // trim=0xFFFFFFFF (no valid flash cursor). A strap with a valid, advancing flash cursor
+                // that banks no sensor records has a different problem — the sensor front-end or power,
+                // not the clock — and telling the user to charge it sends them away from the real cause.
+                // The two states are distinguished by `backfiller.sawNoFlashCursor`.
                 state.lastSyncError = sustainedEmpty
                     ? (staleNewest.map { Backfiller.staleRecordBanner(newestUnix: $0, wallNowUnix: wallNowUnix) }
-                        ?? "Synced, but your strap had no stored history to hand over - only its diagnostic output. This usually means its clock has lost sync, so it isn't saving data to flash. Fully charge it to 100%, then reconnect, and it should start banking again.")
+                        ?? (backfiller?.sawNoFlashCursor == true
+                            ? Backfiller.noFlashCursorBanner
+                            : Backfiller.noSensorRecordsBanner))
                     : nil
             } else if let futureBanner = futureClockBanner {
                 // #324/#928: the strap banked records but its newest is dated implausibly in the FUTURE
diff --git a/Strand/Collect/Backfiller.swift b/Strand/Collect/Backfiller.swift
index 69fb2fb8e0..59993ebf69 100644
--- a/Strand/Collect/Backfiller.swift
+++ b/Strand/Collect/Backfiller.swift
@@ -147,6 +147,11 @@ final class Backfiller {
     /// Logged once per session when the strap reports trim=0xFFFFFFFF — the "no valid flash cursor"
     /// sentinel: it has no banked history to offload (a clock/charge state, not a decode bug).
     private var loggedNoCursor = false
+    /// #1754: whether THIS session saw the trim=0xFFFFFFFF "no valid flash cursor" sentinel. Exposed so
+    /// the empty-offload banner can distinguish the clock/charge state (no cursor — the existing copy is
+    /// correct) from a strap that has a valid, advancing flash cursor but banks no sensor records (NOT a
+    /// clock problem — points at the sensor front-end or power). Read-only from outside.
+    var sawNoFlashCursor: Bool { loggedNoCursor }
     /// #773: logged once per session the first time a HISTORY_END's own timestamp is dated implausibly far
     /// in the FUTURE (a corrupt strap RTC). Distinct from #547's per-record drop tally: this fires on the
     /// chunk metadata's own clock, the earliest visible tell that the strap's RTC is bogus. Reset in begin().
@@ -485,6 +490,21 @@ final class Backfiller {
         return "Synced, but your strap handed over no stored history, and its newest saved record is about \(ageDays) day(s) old. If you have been wearing it since then, it has stopped saving to flash. Charge it to 100% and reconnect; NOOP already re-sets its clock every connect, so if that does not help, try Restart strap in Devices, then forget and re-pair. If the official WHOOP app is missing these days too, the strap is the cause and not NOOP."
     }
 
+    /// #1754: the banner for an empty offload whose flash cursor is VALID and ADVANCING — the strap is
+    /// writing pages but banking no sensor records, so the clock/charge advice does not apply. The
+    /// cause points at the sensor front-end or power state, not the RTC. Byte-identical to the Android
+    /// twin (`Backfiller.noSensorRecordsBanner`). Not localized, matching the sibling `lastSyncError`
+    /// copy on both platforms; localizing that surface is its own change. No em-dash (project rule).
+    nonisolated static let noSensorRecordsBanner =
+        "Synced, but your strap handed over no sensor records - only its diagnostic output. The strap's flash cursor is valid and advancing, so this is not a clock problem; it points at the sensor front-end or power state. If this persists across reconnects, please share a strap log so the cause can be identified."
+
+    /// #1754: the banner for an empty offload whose flash cursor is the 0xFFFFFFFF sentinel — the strap
+    /// has no banked history at all, the clock/charge advice IS correct. Kept as a constant so the two
+    /// banners stay side by side and the caller's branch reads as a choice between two named states.
+    /// Byte-identical to the Android twin (`Backfiller.noFlashCursorBanner`).
+    nonisolated static let noFlashCursorBanner =
+        "Synced, but your strap had no stored history to hand over - only its diagnostic output. This usually means its clock has lost sync, so it isn't saving data to flash. Fully charge it to 100%, then reconnect, and it should start banking again."
+
     /// Commit one HISTORY_END chunk: (persist decoded → enqueueRaw when present) → setCursor → ackTrim.
     /// Early-returns on any throw to preserve the safe-trim invariant.
     ///
diff --git a/StrandTests/BackfillerSessionTallyTests.swift b/StrandTests/BackfillerSessionTallyTests.swift
index b787258cf7..227157849b 100644
--- a/StrandTests/BackfillerSessionTallyTests.swift
+++ b/StrandTests/BackfillerSessionTallyTests.swift
@@ -343,4 +343,41 @@ final class BackfillerSessionTallyTests: XCTestCase {
         XCTAssertFalse(line.contains("should start banking again"), line)
         XCTAssertFalse(line.contains("\u{2014}"))
     }
+
+    // ---- #1754: two distinct empty-offload banners ------------------------------------------
+
+    /// The no-flash-cursor banner (trim=0xFFFFFFFF) names the clock/charge cause — the existing copy,
+    /// now a named constant so the caller's branch reads as a choice between two states.
+    func testNoFlashCursorBannerNamesClockAndCharge() {
+        let line = Backfiller.noFlashCursorBanner
+        XCTAssertTrue(line.contains("no stored history to hand over"), line)
+        XCTAssertTrue(line.contains("clock has lost sync"), line)
+        XCTAssertTrue(line.contains("Fully charge it to 100%"), line)
+        XCTAssertFalse(line.contains("sensor front-end"), line)
+    }
+
+    /// The no-sensor-records banner (valid trim, advancing write pointer, zero rows) does NOT name
+    /// the clock — it points at the sensor front-end or power state, and asks for a strap log rather
+    /// than promising that charging will fix it.
+    func testNoSensorRecordsBannerDoesNotBlameTheClock() {
+        let line = Backfiller.noSensorRecordsBanner
+        XCTAssertTrue(line.contains("no sensor records"), line)
+        XCTAssertTrue(line.contains("flash cursor is valid and advancing"), line)
+        XCTAssertTrue(line.contains("not a clock problem"), line)
+        XCTAssertTrue(line.contains("sensor front-end or power"), line)
+        XCTAssertFalse(line.contains("clock has lost sync"), line)
+        XCTAssertFalse(line.contains("Fully charge it to 100%"), line)
+    }
+
+    /// The two banners must be distinct strings — a caller choosing between them must not get the
+    /// same copy for both states.
+    func testTheTwoBannersAreDistinct() {
+        XCTAssertNotEqual(Backfiller.noFlashCursorBanner, Backfiller.noSensorRecordsBanner)
+    }
+
+    /// No em-dash in either banner (project rule).
+    func testNoEmDashInEitherBanner() {
+        XCTAssertFalse(Backfiller.noFlashCursorBanner.contains("\u{2014}"))
+        XCTAssertFalse(Backfiller.noSensorRecordsBanner.contains("\u{2014}"))
+    }
 }
diff --git a/android/app/src/main/java/com/noop/ble/Backfiller.kt b/android/app/src/main/java/com/noop/ble/Backfiller.kt
index 3e05d8f995..fe8a6e68d1 100644
--- a/android/app/src/main/java/com/noop/ble/Backfiller.kt
+++ b/android/app/src/main/java/com/noop/ble/Backfiller.kt
@@ -236,6 +236,12 @@ class Backfiller(
      */
     private var loggedNoCursor = false
 
+    /** #1754: whether THIS session saw the trim=0xFFFFFFFF "no valid flash cursor" sentinel. Exposed so
+     *  the empty-offload banner can distinguish the clock/charge state (no cursor — the existing copy is
+     *  correct) from a strap that has a valid, advancing flash cursor but banks no sensor records (NOT a
+     *  clock problem — points at the sensor front-end or power). Read-only from outside. */
+    val sawNoFlashCursor: Boolean get() = loggedNoCursor
+
     /**
      * #773: logged once per session the first time a HISTORY_END's own timestamp is dated implausibly far
      * in the FUTURE (a corrupt strap RTC). Distinct from #547's per-record drop tally: this fires on the
@@ -872,6 +878,24 @@ class Backfiller(
                 "so if that does not help, try Restart strap in Devices, then forget and re-pair. If the " +
                 "official WHOOP app is missing these days too, the strap is the cause and not NOOP."
         }
+
+        /** #1754: the banner for an empty offload whose flash cursor is VALID and ADVANCING — the strap
+         *  is writing pages but banking no sensor records, so the clock/charge advice does not apply. The
+         *  cause points at the sensor front-end or power state, not the RTC. Byte-identical to the Swift
+         *  twin (`Backfiller.noSensorRecordsBanner`). No em-dash (project rule). */
+        val noSensorRecordsBanner =
+            "Synced, but your strap handed over no sensor records - only its diagnostic output. The " +
+                "strap's flash cursor is valid and advancing, so this is not a clock problem; it points " +
+                "at the sensor front-end or power state. If this persists across reconnects, please " +
+                "share a strap log so the cause can be identified."
+
+        /** #1754: the banner for an empty offload whose flash cursor is the 0xFFFFFFFF sentinel — the
+         *  strap has no banked history at all, the clock/charge advice IS correct. Byte-identical to the
+         *  Swift twin (`Backfiller.noFlashCursorBanner`). */
+        val noFlashCursorBanner =
+            "Synced, but your strap had no stored history to hand over - only its diagnostic output. " +
+                "This usually means its clock has lost sync, so it isn't saving data to flash. Fully " +
+                "charge it to 100%, then reconnect, and it should start banking again."
     }
 }
 
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index fa3b4c65cd..e73de2ffce 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -10301,9 +10301,15 @@ class WhoopBleClient(
                         // #1683: when the strap's own newest record dates the silence, SAY it. The
                         // generic copy omits that and promises a recovery the charge advice has already
                         // been retried for every session.
+                        // #1754: the generic "clock lost sync" copy is only correct when the strap
+                        // reported trim=0xFFFFFFFF (no valid flash cursor). A strap with a valid,
+                        // advancing flash cursor that banks no sensor records has a different problem
+                        // - the sensor front-end or power, not the clock - and telling the user to
+                        // charge it sends them away from the real cause.
                         staleNewestSeen?.let { Backfiller.staleRecordBanner(it, nowSec) }
-                            ?: "Synced, but your strap had no stored history to hand over - only its diagnostic output. This usually means its clock has lost sync, so it isn't saving data to flash. Fully charge it to 100%, then reconnect, and it should start banking again."
-                    bankedNothing -> null   // banked nothing but not yet sustained — stay silent (matches Swift)
+                            ?: if (backfiller.sawNoFlashCursor) Backfiller.noFlashCursorBanner
+                                else Backfiller.noSensorRecordsBanner
+                    bankedNothing -> null   // banked nothing but not yet sustained - stay silent (matches Swift)
                     // #324/#928: the strap banked records but its newest is dated implausibly in the future
                     // (RTC relatched ahead). #773 drops the samples so nothing is misfiled, but this path
                     // would otherwise report a clean sync and leave the user with no data + no reason.
diff --git a/android/app/src/test/java/com/noop/ble/BackfillerSessionTallyTest.kt b/android/app/src/test/java/com/noop/ble/BackfillerSessionTallyTest.kt
index 4aad4bc896..dc5eda1ef8 100644
--- a/android/app/src/test/java/com/noop/ble/BackfillerSessionTallyTest.kt
+++ b/android/app/src/test/java/com/noop/ble/BackfillerSessionTallyTest.kt
@@ -3,6 +3,7 @@ package com.noop.ble
 import com.noop.data.InsertCounts
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotEquals
 import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Test
@@ -191,6 +192,47 @@ class BackfillerSessionTallyTest {
         assertFalse(line.contains("\u2014"))
     }
 
+    // ---- #1754: two distinct empty-offload banners ------------------------------------------
+
+    /**
+     * The no-flash-cursor banner (trim=0xFFFFFFFF) names the clock/charge cause — the existing copy,
+     * now a named constant so the caller's branch reads as a choice between two states.
+     */
+    @Test fun noFlashCursorBannerNamesClockAndCharge() {
+        val line = Backfiller.noFlashCursorBanner
+        assertTrue(line, line.contains("no stored history to hand over"))
+        assertTrue(line, line.contains("clock has lost sync"))
+        assertTrue(line, line.contains("Fully charge it to 100%"))
+        assertFalse(line, line.contains("sensor front-end"))
+    }
+
+    /**
+     * The no-sensor-records banner (valid trim, advancing write pointer, zero rows) does NOT name the
+     * clock — it points at the sensor front-end or power state, and asks for a strap log rather than
+     * promising that charging will fix it.
+     */
+    @Test fun noSensorRecordsBannerDoesNotBlameTheClock() {
+        val line = Backfiller.noSensorRecordsBanner
+        assertTrue(line, line.contains("no sensor records"))
+        assertTrue(line, line.contains("flash cursor is valid and advancing"))
+        assertTrue(line, line.contains("not a clock problem"))
+        assertTrue(line, line.contains("sensor front-end or power"))
+        assertFalse(line, line.contains("clock has lost sync"))
+        assertFalse(line, line.contains("Fully charge it to 100%"))
+    }
+
+    /** The two banners must be distinct strings — a caller choosing between them must not get the same
+     *  copy for both states. */
+    @Test fun theTwoBannersAreDistinct() {
+        assertNotEquals(Backfiller.noFlashCursorBanner, Backfiller.noSensorRecordsBanner)
+    }
+
+    /** No em-dash in either banner (project rule). */
+    @Test fun noEmDashInEitherBanner() {
+        assertFalse(Backfiller.noFlashCursorBanner.contains("\u2014"))
+        assertFalse(Backfiller.noSensorRecordsBanner.contains("\u2014"))
+    }
+
     // ---- #1 records-bearing 0xFFFFFFFF END must NOT false-alarm "no banked history" ----
 
     /**

From 0e6845cd3fad98e9c9cb365db08c37d3a82ed6bd Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 18:40:09 +1200
Subject: [PATCH 317/333] build: testing build 454 / 335

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index a301ebfd85..b3126c80da 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 453
+        versionCode = 454
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index b85e4ee56b..4b0d379df9 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "334"
+    CURRENT_PROJECT_VERSION: "335"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From c7534930f74827e65495e8291501584da0dcc842 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 20:45:07 +1200
Subject: [PATCH 318/333] widget: measure what the home-screen widgets cost,
 and stop sending updates that change nothing

A field report that battery drain feels worse with the HR widget placed, which
three exports could neither confirm nor refute: "widget" appeared zero times in a
full diagnostics bundle. This measures it, and takes the two savings that turned
out to be real.

Counters for pushes admitted vs offered, trace draws with their bytes and draw
time, and redundant redraws. The HR widget is the only one that ships a bitmap
rather than a few KB of text, so the payload is what a drain question turns on.

Two savings. Providers with nothing placed are no longer updated. And a push is
no longer sent at all when nothing the widgets display has changed - the Android
half of what WidgetPublish.saveAndReloadIfChanged has done on the Apple side
since the HR widget landed.

Deliberately NOT the Apple rule, which also declines when only the trace
advanced: WidgetKit rebuilds a timeline on its own schedule so a withheld point
still reaches the screen, and Glance has no such rebuild. That variant waits for
the counters to price it.

Also records that WIDTH_HEADROOM never takes effect - the byte budget binds first
at every realistic size, and at 480dpi a wide card is drawn NARROWER than it is
displayed, so the bitmap is upscaled, which is the artefact the constant exists
to prevent. That closes off the obvious lever rather than opening it.

No cadence change and no visual change.
---
 .../com/noop/testcentre/AndroidDiagnostics.kt |   4 +
 .../com/noop/widget/CoachBriefGlanceWidget.kt |  11 +-
 .../java/com/noop/widget/HrGlanceWidget.kt    |  30 ++-
 .../src/main/java/com/noop/widget/HrTrace.kt  |  15 +-
 .../noop/widget/NoopCompactGlanceWidget.kt    |  11 +-
 .../java/com/noop/widget/NoopGlanceWidget.kt  |  11 +-
 .../java/com/noop/widget/WidgetSnapshot.kt    | 100 +++++++-
 .../java/com/noop/widget/WidgetTelemetry.kt   | 214 +++++++++++++++++
 .../main/java/com/noop/widget/WidgetTheme.kt  |  29 +++
 .../java/com/noop/widget/RenderedGateTest.kt  | 150 ++++++++++++
 .../com/noop/widget/WidgetTelemetryTest.kt    | 216 ++++++++++++++++++
 11 files changed, 745 insertions(+), 46 deletions(-)
 create mode 100644 android/app/src/main/java/com/noop/widget/WidgetTelemetry.kt
 create mode 100644 android/app/src/main/java/com/noop/widget/WidgetTheme.kt
 create mode 100644 android/app/src/test/java/com/noop/widget/RenderedGateTest.kt
 create mode 100644 android/app/src/test/java/com/noop/widget/WidgetTelemetryTest.kt

diff --git a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
index 5ccc9761b2..b205c2f044 100644
--- a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
@@ -150,6 +150,10 @@ object AndroidDiagnostics {
                     "(if you restored a backup, fully restart the app — #57)")
             }
             if (restoreAt > 0L) add("Last restore: ${relTime(now - restoreAt * 1000L)}")
+            // What the home-screen widgets actually cost. Reported unconditionally, including the "no
+            // pushes" case, because the absence of widget activity is itself the answer to a drain
+            // report — and until this line existed an export could not distinguish the two.
+            add(com.noop.widget.WidgetTelemetry.snapshot(now).render())
             // #1770 follow-up: which streams the ACTIVE strap actually delivered over the last 48 h. Four
             // EXISTS seeks, not counts — see WhoopDao.streamPresence for why that distinction matters on a
             // table holding ~190k motion rows a night.
diff --git a/android/app/src/main/java/com/noop/widget/CoachBriefGlanceWidget.kt b/android/app/src/main/java/com/noop/widget/CoachBriefGlanceWidget.kt
index c486c7f5ac..a06ad93f04 100644
--- a/android/app/src/main/java/com/noop/widget/CoachBriefGlanceWidget.kt
+++ b/android/app/src/main/java/com/noop/widget/CoachBriefGlanceWidget.kt
@@ -46,16 +46,7 @@ class CoachBriefGlanceWidget : GlanceAppWidget() {
         val prefs = context.getSharedPreferences("noop_widget", Context.MODE_PRIVATE)
         val briefText = prefs.getString("coachBriefText", null)
         val briefDateMs = prefs.getLong("coachBriefDateMs", 0L)
-        val dark = runCatching {
-            when (context.getSharedPreferences("noop_prefs", Context.MODE_PRIVATE)
-                .getString("theme.appearance", "system")) {
-                "light" -> false
-                "dark" -> true
-                else -> (context.resources.configuration.uiMode and
-                    android.content.res.Configuration.UI_MODE_NIGHT_MASK) ==
-                    android.content.res.Configuration.UI_MODE_NIGHT_YES
-            }
-        }.getOrDefault(true)
+        val dark = WidgetTheme.isDark(context)
         provideContent { CoachBriefWidgetContent(briefText, briefDateMs, dark) }
     }
 }
diff --git a/android/app/src/main/java/com/noop/widget/HrGlanceWidget.kt b/android/app/src/main/java/com/noop/widget/HrGlanceWidget.kt
index 79bfb8dbf7..c7d4653b18 100644
--- a/android/app/src/main/java/com/noop/widget/HrGlanceWidget.kt
+++ b/android/app/src/main/java/com/noop/widget/HrGlanceWidget.kt
@@ -12,6 +12,7 @@ import androidx.glance.Image
 import androidx.glance.ColorFilter
 import androidx.glance.ImageProvider
 import androidx.glance.LocalContext
+import androidx.glance.LocalGlanceId
 import androidx.glance.LocalSize
 import androidx.glance.action.actionStartActivity
 import androidx.glance.action.clickable
@@ -60,16 +61,7 @@ class HrGlanceWidget : GlanceAppWidget() {
 
     override suspend fun provideGlance(context: Context, id: GlanceId) {
         val snap = runCatching { WidgetSnapshotStore.load(context) }.getOrDefault(WidgetSnapshot())
-        val dark = runCatching {
-            when (context.getSharedPreferences("noop_prefs", Context.MODE_PRIVATE)
-                .getString("theme.appearance", "system")) {
-                "light" -> false
-                "dark" -> true
-                else -> (context.resources.configuration.uiMode and
-                    android.content.res.Configuration.UI_MODE_NIGHT_MASK) ==
-                    android.content.res.Configuration.UI_MODE_NIGHT_YES
-            }
-        }.getOrDefault(true)
+        val dark = WidgetTheme.isDark(context)
         provideContent { HrWidgetContent(snap, dark) }
     }
 
@@ -258,6 +250,8 @@ private fun HrTraceImage(
 ) {
     val context = LocalContext.current
     val density = context.resources.displayMetrics.density
+    // Identifies THIS placed widget, so the redundant-draw memo below cannot confuse two of them.
+    val glanceInstance = LocalGlanceId.current.toString()
     // Leave room for the scale column so the trace is not drawn under its own labels.
     val chartWidthDp = hrChartWidthDp(widthDp)
     // ONE box for both the geometry and the bitmap. Sizing them separately let the trace be drawn to
@@ -268,6 +262,9 @@ private fun HrTraceImage(
     val hPx = (HR_CHART_TARGET_DP * density).toInt().coerceAtLeast(1)
     val wPx = HrTrace.widestAtHeight((chartWidthDp * density).toInt(), hPx)
 
+    // Measured, because "the widget drains the battery" was not decidable from an export: this is the
+    // only widget that ships a BITMAP rather than a few KB of text, and nothing counted what that cost.
+    val startedNs = System.nanoTime()
     val bmp = runCatching {
         HrTraceRenderer.render(
             points = HrTrace.points(snap.hrSeries, wPx.toFloat(), hPx.toFloat()),
@@ -279,6 +276,19 @@ private fun HrTraceImage(
             strokePx = 2f * density,
         )
     }.getOrNull()
+    if (bmp != null) {
+        WidgetTelemetry.noteRender(
+            bytes = wPx * hPx * HrTrace.BYTES_PER_PIXEL,
+            elapsedMs = (System.nanoTime() - startedNs) / 1_000_000,
+        )
+        // A push carrying no live sample appends no point, so this draw reproduced the previous bitmap
+        // exactly. Counting them sizes the saving a future cache would take; nothing is skipped here.
+        // Keyed by the PLACED WIDGET, not globally: two HR widgets would otherwise answer for each
+        // other, and two of the same size would make each one's necessary draw look like a repeat.
+        if (HrTraceSeen.repeat(glanceInstance, snap.hrSeries, wPx, hPx, dark)) {
+            WidgetTelemetry.noteRedundantRender()
+        }
+    }
 
     // The chart takes the ROW's remaining width by weight rather than a width computed from
     // LocalSize. On a One UI launcher LocalSize reported a size smaller than the card actually
diff --git a/android/app/src/main/java/com/noop/widget/HrTrace.kt b/android/app/src/main/java/com/noop/widget/HrTrace.kt
index 7166250194..52f659aa0d 100644
--- a/android/app/src/main/java/com/noop/widget/HrTrace.kt
+++ b/android/app/src/main/java/com/noop/widget/HrTrace.kt
@@ -146,8 +146,19 @@ object HrTrace {
         return want.coerceAtMost(budgetWidth).coerceAtLeast(requestedPx.coerceAtLeast(1).coerceAtMost(budgetWidth))
     }
 
-    /** How much wider than the reported width to draw, to cover a launcher that under-reports. Two
-     *  covers the ~1.6x seen on One UI with margin, and costs nothing a downscale does not absorb. */
+    /**
+     * How much wider than the reported width to draw, to cover a launcher that under-reports.
+     *
+     * NOTE THAT THIS CEILING IS RARELY THE ONE THAT BINDS. [MAX_BITMAP_BYTES] runs out first at any
+     * realistic widget size: at 420dpi a 300dp-wide card gets 1.66x, a 380dp one 1.26x, and at 480dpi
+     * a 380dp card gets 0.96x — narrower than the reported width, so the bitmap is UPSCALED, which is
+     * the artefact this constant exists to prevent. Raising this number changes nothing on a real
+     * phone; the byte budget is the lever, and it trades directly against horizontal resolution.
+     *
+     * Kept at two because it is the correct intent and it still binds on a small widget. The gap
+     * between the intent and what the budget allows is measured rather than papered over — see the
+     * widget cost counters.
+     */
     const val WIDTH_HEADROOM: Float = 2f
 
     /** A point in the trace's pixel box, origin top-left, as the renderer wants it. */
diff --git a/android/app/src/main/java/com/noop/widget/NoopCompactGlanceWidget.kt b/android/app/src/main/java/com/noop/widget/NoopCompactGlanceWidget.kt
index a05a784949..dc337858c8 100644
--- a/android/app/src/main/java/com/noop/widget/NoopCompactGlanceWidget.kt
+++ b/android/app/src/main/java/com/noop/widget/NoopCompactGlanceWidget.kt
@@ -45,16 +45,7 @@ class NoopCompactGlanceWidget : GlanceAppWidget() {
 
     override suspend fun provideGlance(context: Context, id: GlanceId) {
         val snap = runCatching { WidgetSnapshotStore.load(context) }.getOrDefault(WidgetSnapshot())
-        val dark = runCatching {
-            when (context.getSharedPreferences("noop_prefs", Context.MODE_PRIVATE)
-                .getString("theme.appearance", "system")) {
-                "light" -> false
-                "dark" -> true
-                else -> (context.resources.configuration.uiMode and
-                    android.content.res.Configuration.UI_MODE_NIGHT_MASK) ==
-                    android.content.res.Configuration.UI_MODE_NIGHT_YES
-            }
-        }.getOrDefault(true)
+        val dark = WidgetTheme.isDark(context)
         provideContent { CompactWidgetContent(snap, dark) }
     }
 
diff --git a/android/app/src/main/java/com/noop/widget/NoopGlanceWidget.kt b/android/app/src/main/java/com/noop/widget/NoopGlanceWidget.kt
index 80ce8979d3..03905aba07 100644
--- a/android/app/src/main/java/com/noop/widget/NoopGlanceWidget.kt
+++ b/android/app/src/main/java/com/noop/widget/NoopGlanceWidget.kt
@@ -55,16 +55,7 @@ class NoopGlanceWidget : GlanceAppWidget() {
         // Follow the app's Light/Dark/System theme (read straight from noop_prefs; the widget runs in a
         // separate process so it can't see the in-app snapshot state). System resolves off the device's
         // night-mode config. Any failure degrades to dark (the historical default).
-        val dark = runCatching {
-            when (context.getSharedPreferences("noop_prefs", Context.MODE_PRIVATE)
-                .getString("theme.appearance", "system")) {
-                "light" -> false
-                "dark" -> true
-                else -> (context.resources.configuration.uiMode and
-                    android.content.res.Configuration.UI_MODE_NIGHT_MASK) ==
-                    android.content.res.Configuration.UI_MODE_NIGHT_YES
-            }
-        }.getOrDefault(true)
+        val dark = WidgetTheme.isDark(context)
         provideContent { WidgetContent(snap, dark) }
     }
 
diff --git a/android/app/src/main/java/com/noop/widget/WidgetSnapshot.kt b/android/app/src/main/java/com/noop/widget/WidgetSnapshot.kt
index f5de097460..24690926b1 100644
--- a/android/app/src/main/java/com/noop/widget/WidgetSnapshot.kt
+++ b/android/app/src/main/java/com/noop/widget/WidgetSnapshot.kt
@@ -53,7 +53,17 @@ object WidgetSnapshotStore {
     suspend fun push(context: Context, snap: WidgetSnapshot) {
         val app = context.applicationContext
         // Cheap, non-suspending gate FIRST — at live-HR cadence (~1/s) almost every call ends here.
-        if (!PushGate.admit(snap)) return
+        if (!PushGate.admit(snap)) {
+            WidgetTelemetry.notePushGated(snap.updatedAtMs)
+            return
+        }
+        WidgetTelemetry.notePushAdmitted(snap.updatedAtMs)
+
+        // Kept so a push that turns out to carry nothing new can put it back. All three widgets RENDER
+        // this stamp — the HR card as a permanent "Updated <time>" line, the 2x2 and compact as their
+        // disconnected "last seen" — so it is not the metadata the Apple twin can treat it as.
+        val previousUpdatedAt = app.getSharedPreferences(FILE, Context.MODE_PRIVATE)
+            .getLong("updatedAt", 0L)
 
         // Persist before anything suspending, and only THEN mark the gate (#82: marking before the
         // write let a cancelled push burn the refresh window — the widget starved on stale prefs).
@@ -71,9 +81,33 @@ object WidgetSnapshotStore {
             GlanceAppWidgetManager(app).getGlanceIds(HrGlanceWidget::class.java)
         }.getOrDefault(emptyList())
         if (standardIds.isEmpty() && compactIds.isEmpty() && hrIds.isEmpty()) return
-        runCatching { NoopGlanceWidget().updateAll(app) }
-        runCatching { NoopCompactGlanceWidget().updateAll(app) }
-        runCatching { HrGlanceWidget().updateAll(app) }
+
+        // Nothing the widgets DISPLAY changed, so there is nothing to send. Read back what they will
+        // actually render rather than re-deriving it: `load` resolves staleness and prunes the trace,
+        // and a guess at either would be the thing that drifts.
+        val visible = runCatching { load(app) }.getOrNull()
+        if (visible != null && !RenderedGate.changed(visible, WidgetTheme.isDark(app))) {
+            // The stamp reads "Updated <time>", so it names when the data is FROM. A push that carried
+            // nothing new must not advance it: doing so would tell the reader 14:47 while showing them
+            // 14:32's reading. Putting it back also keeps what the prefs hold and what the widget shows
+            // in agreement, so a recomposition for some unrelated reason — a launcher restart, a resize
+            // — cannot surface a time this push declined to display.
+            if (previousUpdatedAt > 0L) {
+                runCatching {
+                    app.getSharedPreferences(FILE, Context.MODE_PRIVATE).edit()
+                        .putLong("updatedAt", previousUpdatedAt).apply()
+                }
+            }
+            WidgetTelemetry.notePushUnchanged()
+            return
+        }
+
+        // Update only the providers that actually have a widget placed. The ids are already in hand, and
+        // `updateAll` on a provider with none still crosses into GlanceAppWidgetManager to discover that
+        // for itself. Someone running just the HR widget was paying for two of those on every push.
+        if (standardIds.isNotEmpty()) runCatching { NoopGlanceWidget().updateAll(app) }
+        if (compactIds.isNotEmpty()) runCatching { NoopCompactGlanceWidget().updateAll(app) }
+        if (hrIds.isNotEmpty()) runCatching { HrGlanceWidget().updateAll(app) }
     }
 
     fun save(context: Context, snap: WidgetSnapshot) {
@@ -157,6 +191,64 @@ internal object HrDisplay {
     }
 }
 
+/**
+ * The second gate, after [PushGate]: does anything the widgets DISPLAY differ from what they were last
+ * sent?
+ *
+ * [PushGate] deliberately does not know the heart-rate VALUE (only whether there is one), because
+ * keying on it would admit a push per sample. That leaves a gap it cannot close: its 60-second timer
+ * clause fires whether or not anything moved, so a strap that has gone quiet used to cost a full widget
+ * update every minute — on the HR widget, a half-megabyte bitmap across a Binder transaction to draw
+ * exactly what was already on screen.
+ *
+ * The Apple side has had this since #1957 (`WidgetPublish.saveAndReloadIfChanged` +
+ * `WidgetSnapshot.renderedContentChanged`); Android did not, and was doing strictly more work per push
+ * for identical data.
+ *
+ * Deliberately NOT the Apple rule, which also declines a reload when only the TRACE advanced. WidgetKit
+ * rebuilds a timeline on its own schedule, so a point persisted without a reload still reaches the
+ * screen; Glance has no such rebuild (`updatePeriodMillis="0"`), so declining there would freeze the
+ * chart at rest until the number itself moved. This skips only when NOTHING changed, which is free.
+ * Whether the trace-only case is worth its cost is a question for the widget cost counters.
+ *
+ * The key spans every field any of the three widgets renders, so "nothing changed" means none of them
+ * had anything to show — a narrower per-widget gate would be a different, visible trade.
+ *
+ * The APPEARANCE is in the key even though it is not in the snapshot. The widgets read
+ * `theme.appearance` themselves at composition, and nothing refreshes them when it changes — today a
+ * theme flip reaches the screen only because every push updated unconditionally. Leaving it out would
+ * have meant a widget sat in the wrong colours until something unrelated moved, which is a regression
+ * this gate would have introduced rather than a cost it inherited. Resolved through [WidgetTheme] so it
+ * cannot disagree with what the widgets themselves decide.
+ *
+ * `updatedAtMs` is the one field held OUT, and it is the reason this gate needed thought rather than a
+ * port. All three widgets display it, so including it would mean the key changed on every push and the
+ * gate could never fire; excluding it naively would freeze a visible clock. The resolution is that the
+ * stamp names when the DATA is from, not when the app last woke: [WidgetSnapshotStore.push] restores
+ * the previous value when it declines, so a frozen stamp is the truthful one. The Apple twin sidesteps
+ * this entirely because no widget family there renders the timestamp.
+ */
+internal object RenderedGate {
+    private var last: String? = null
+
+    /** True when [visible] differs from what was last sent. The first call after a process start always
+     *  admits: the widgets may be showing something an earlier process left them. */
+    @Synchronized
+    fun changed(visible: WidgetSnapshot, dark: Boolean): Boolean {
+        val newest = visible.hrSeries.lastOrNull()
+        val key = "${visible.recoveryPct}|${visible.restPct}|${visible.effortPct}|" +
+            "${visible.batteryPct}|${visible.connected}|${visible.heartRate}|" +
+            "${visible.heartRateStale}|${visible.hrSeries.size}|${newest?.ts}|${newest?.bpm}|" +
+            "$dark"
+        val differs = key != last
+        last = key
+        return differs
+    }
+
+    @Synchronized
+    fun resetForTest() { last = null }
+}
+
 /**
  * The push-throttle decision, extracted pure so it's unit-testable (PushGateTests). Meaningful
  * changes (recovery, battery 5%-bucket, connection, and HR presence — so the FIRST heart-rate
diff --git a/android/app/src/main/java/com/noop/widget/WidgetTelemetry.kt b/android/app/src/main/java/com/noop/widget/WidgetTelemetry.kt
new file mode 100644
index 0000000000..c207fefd9e
--- /dev/null
+++ b/android/app/src/main/java/com/noop/widget/WidgetTelemetry.kt
@@ -0,0 +1,214 @@
+package com.noop.widget
+
+import java.util.Locale
+
+/**
+ * Counters for what the home-screen widgets actually cost, so "the widget drains my battery" is
+ * decidable from an export instead of being argued from the code.
+ *
+ * The question that prompted this: the HR widget is the only one that ships a BITMAP. The other two
+ * send a few KB of text as RemoteViews; the trace image is sized up to [HrTrace.MAX_BITMAP_BYTES] and
+ * crosses a Binder transaction to the launcher on every push. Same cadence, a very different payload,
+ * and until now nothing measured either.
+ *
+ * What is deliberately counted, and why each one is needed to answer it:
+ *
+ *  - **admitted vs gated pushes** — [PushGate] is supposed to collapse a ~1/s live-HR stream to about
+ *    one push a minute. If the gated count is not vastly larger than the admitted one, the throttle is
+ *    not doing its job and nothing downstream matters.
+ *  - **renders and bytes** — the actual Binder payload. `bytes / renders` is the mean bitmap, and the
+ *    total is what a day of streaming costs.
+ *  - **skipped renders** — a null-HR push appends no point, so the trace is unchanged and the redraw
+ *    produces an identical bitmap. Counting these sizes the cheapest available saving before anyone
+ *    writes the code to take it.
+ *  - **render time** — separates "the drawing is expensive" from "the transfer is expensive". They
+ *    have different fixes and the numbers cannot be guessed apart.
+ *
+ * Process-lifetime counters, reset when the process dies, reported as a rate over [uptimeMs] so a
+ * short session and a long one are comparable. Not persisted: a per-push disk write to measure the
+ * cost of pushes would be its own answer to the question.
+ *
+ * Cheap enough to leave always on. Every field is an increment on a path that already does IPC.
+ */
+object WidgetTelemetry {
+
+    private var startedAtMs = 0L
+    private var pushesAdmitted = 0L
+    private var pushesGated = 0L
+    private var renders = 0L
+    private var rendersRedundant = 0L
+    private var renderBytes = 0L
+    private var renderMs = 0L
+    private var renderMsMax = 0L
+    private var pushesUnchanged = 0L
+    private var lastPushAtMs = 0L
+
+    /** A push [PushGate] let through: prefs written and every placed widget recomposed. */
+    @Synchronized
+    fun notePushAdmitted(nowMs: Long) {
+        if (startedAtMs == 0L) startedAtMs = nowMs
+        pushesAdmitted += 1
+        lastPushAtMs = nowMs
+    }
+
+    /** A push the gate dropped. At live-HR cadence this should dwarf the admitted count. */
+    @Synchronized
+    fun notePushGated(nowMs: Long) {
+        if (startedAtMs == 0L) startedAtMs = nowMs
+        pushesGated += 1
+    }
+
+    /**
+     * A push [PushGate] admitted but [RenderedGate] then dropped, because nothing the widgets display
+     * had changed. Counted separately from a gated push: this is the saving the rendered gate takes,
+     * and it needs to be visible to justify keeping it.
+     */
+    @Synchronized
+    fun notePushUnchanged() {
+        pushesUnchanged += 1
+    }
+
+    /** One trace bitmap built: [bytes] is what crosses the Binder, [elapsedMs] is the draw alone. */
+    @Synchronized
+    fun noteRender(bytes: Int, elapsedMs: Long) {
+        renders += 1
+        renderBytes += bytes.toLong()
+        renderMs += elapsedMs
+        if (elapsedMs > renderMsMax) renderMsMax = elapsedMs
+    }
+
+    /**
+     * A redraw whose trace had not advanced since the previous one, so it produced an identical
+     * bitmap. Counted, not avoided — see the class doc.
+     */
+    @Synchronized
+    fun noteRedundantRender() {
+        rendersRedundant += 1
+    }
+
+    /** Immutable read for the report. */
+    @Synchronized
+    fun snapshot(nowMs: Long): Snapshot = Snapshot(
+        uptimeMs = if (startedAtMs == 0L) 0L else nowMs - startedAtMs,
+        pushesAdmitted = pushesAdmitted,
+        pushesGated = pushesGated,
+        pushesUnchanged = pushesUnchanged,
+        renders = renders,
+        rendersRedundant = rendersRedundant,
+        renderBytes = renderBytes,
+        renderMs = renderMs,
+        renderMsMax = renderMsMax,
+        lastPushAgoMs = if (lastPushAtMs == 0L) null else nowMs - lastPushAtMs,
+    )
+
+    @Synchronized
+    fun resetForTest() {
+        startedAtMs = 0L; pushesAdmitted = 0L; pushesGated = 0L; pushesUnchanged = 0L
+        renders = 0L; rendersRedundant = 0L; renderBytes = 0L; renderMs = 0L; renderMsMax = 0L
+        lastPushAtMs = 0L
+    }
+
+    data class Snapshot(
+        val uptimeMs: Long,
+        val pushesAdmitted: Long,
+        val pushesGated: Long,
+        val pushesUnchanged: Long,
+        val renders: Long,
+        val rendersRedundant: Long,
+        val renderBytes: Long,
+        val renderMs: Long,
+        val renderMsMax: Long,
+        val lastPushAgoMs: Long?,
+    ) {
+        /** Mean bitmap in bytes, or null before the first render. */
+        val meanRenderBytes: Long? get() = if (renders > 0) renderBytes / renders else null
+
+        /**
+         * Pushes per hour, extrapolated from this process's uptime. Null under a minute of uptime:
+         * a rate from a few seconds of samples is noise wearing a number's clothes.
+         */
+        val pushesPerHour: Double?
+            get() = if (uptimeMs >= 60_000L) pushesAdmitted * 3_600_000.0 / uptimeMs else null
+
+        /**
+         * Bitmap bytes per hour at the observed rate — the figure the drain question turns on, since
+         * this is what crosses a Binder transaction to the launcher.
+         */
+        val renderBytesPerHour: Double?
+            get() = if (uptimeMs >= 60_000L) renderBytes * 3_600_000.0 / uptimeMs else null
+
+        /**
+         * One line for the diagnostics header. Deliberately reports the RATE alongside the raw counts:
+         * a total is not comparable between a five-minute session and an all-day one, and comparing
+         * sessions is the whole point of collecting this.
+         */
+        fun render(): String {
+            // Renders are checked too: a widget composes from saved prefs when it is placed or after a
+            // process start, with no push involved. Reporting "no pushes" there would be true and would
+            // silently drop the draw counts, which are the expensive half.
+            if (pushesAdmitted == 0L && pushesGated == 0L && renders == 0L) {
+                return "Widgets:     no pushes this app session"
+            }
+            val mins = uptimeMs / 60_000
+            val parts = ArrayList<String>(6)
+            if (pushesAdmitted > 0L || pushesGated > 0L) {
+                parts.add("$pushesAdmitted pushed / ${pushesAdmitted + pushesGated} offered")
+            } else {
+                parts.add("no pushes")
+            }
+            pushesPerHour?.let { parts.add("${String.format(Locale.US, "%.1f", it)}/h") }
+            if (renders > 0) {
+                parts.add("$renders trace draw${if (renders == 1L) "" else "s"}")
+                meanRenderBytes?.let { parts.add("mean ${it / 1024}KB") }
+                renderBytesPerHour?.let { parts.add("${String.format(Locale.US, "%.1f", it / 1_048_576.0)}MB/h") }
+                parts.add("draw ${renderMs / renders}ms avg / ${renderMsMax}ms max")
+            }
+            if (pushesUnchanged > 0) parts.add("$pushesUnchanged unchanged")
+            if (rendersRedundant > 0) parts.add("$rendersRedundant redundant")
+            return "Widgets:     ${parts.joinToString(" · ")} (over ${mins}m)"
+        }
+    }
+}
+
+/**
+ * Remembers just enough about the last trace drawn to recognise the next one as identical.
+ *
+ * A signature, never the bitmap: the point is to MEASURE how often a redraw is redundant without
+ * retaining half a megabyte to prove it. Holding the image is the optimisation, and it carries a
+ * memory trade this change deliberately does not take.
+ *
+ * The signature covers everything the drawing depends on, not just the series: a size change or a
+ * theme flip produces a genuinely different bitmap from the same points, and counting that as
+ * redundant would overstate the saving on offer.
+ *
+ * Kept PER WIDGET INSTANCE. A single shared slot was wrong in the way that matters most here: with
+ * two HR widgets placed, each draw would clobber the other's signature, and two same-sized widgets
+ * would make each one's necessary first draw look like a repeat of the other's — inflating the
+ * redundancy count, which is exactly the direction that would argue for an optimisation that is not
+ * actually available. The map is bounded by the number of placed widgets.
+ */
+internal object HrTraceSeen {
+    private val last = HashMap<String, String>()
+
+    /**
+     * True when this draw reproduces this WIDGET's previous one exactly. Records the signature either
+     * way. [instance] identifies the placed widget, so two of them cannot answer for each other.
+     */
+    @Synchronized
+    fun repeat(
+        instance: String,
+        series: List<HrPoint>,
+        widthPx: Int,
+        heightPx: Int,
+        dark: Boolean,
+    ): Boolean {
+        val newest = series.lastOrNull()
+        val sig = "${series.size}|${newest?.ts}|${newest?.bpm}|$widthPx|$heightPx|$dark"
+        val same = sig == last[instance]
+        last[instance] = sig
+        return same
+    }
+
+    @Synchronized
+    fun resetForTest() { last.clear() }
+}
diff --git a/android/app/src/main/java/com/noop/widget/WidgetTheme.kt b/android/app/src/main/java/com/noop/widget/WidgetTheme.kt
new file mode 100644
index 0000000000..d163b420ee
--- /dev/null
+++ b/android/app/src/main/java/com/noop/widget/WidgetTheme.kt
@@ -0,0 +1,29 @@
+package com.noop.widget
+
+import android.content.Context
+import android.content.res.Configuration
+
+/**
+ * Whether a widget should draw dark, resolved the way every widget in this package resolves it.
+ *
+ * This lived as four byte-identical copies, one per widget. It is extracted because a FIFTH reader
+ * arrived that must not disagree with them: [RenderedGate] decides whether a push is worth sending, and
+ * the appearance is an input the widgets read at composition rather than one the snapshot carries. A
+ * gate that resolved the theme even slightly differently would decline a push the widgets needed, and
+ * the widget would sit in the wrong colours until something unrelated moved.
+ *
+ * The in-app override wins; "system" falls back to the configuration's night mode. Defaults to dark on
+ * any failure, matching what the four copies did.
+ */
+internal object WidgetTheme {
+
+    fun isDark(context: Context): Boolean = runCatching {
+        when (context.getSharedPreferences("noop_prefs", Context.MODE_PRIVATE)
+            .getString("theme.appearance", "system")) {
+            "light" -> false
+            "dark" -> true
+            else -> (context.resources.configuration.uiMode and
+                Configuration.UI_MODE_NIGHT_MASK) == Configuration.UI_MODE_NIGHT_YES
+        }
+    }.getOrDefault(true)
+}
diff --git a/android/app/src/test/java/com/noop/widget/RenderedGateTest.kt b/android/app/src/test/java/com/noop/widget/RenderedGateTest.kt
new file mode 100644
index 0000000000..7147c6a3c1
--- /dev/null
+++ b/android/app/src/test/java/com/noop/widget/RenderedGateTest.kt
@@ -0,0 +1,150 @@
+package com.noop.widget
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+
+/**
+ * Pins the second gate: a push [PushGate] admitted still costs nothing when none of the widgets have
+ * anything different to show.
+ *
+ * This is the Android half of what `WidgetPublish.saveAndReloadIfChanged` has done on the Apple side
+ * since #1957, minus the trace-only case that Glance cannot take (no OS-scheduled rebuild to carry a
+ * withheld point to the screen). Everything asserted below is a case where a full widget update —
+ * including a half-megabyte bitmap over a Binder transaction — would have drawn what was already
+ * there.
+ */
+class RenderedGateTest {
+
+    @Before
+    fun setUp() = RenderedGate.resetForTest()
+
+    private fun snap(
+        hr: Int? = 62,
+        stale: Boolean = false,
+        recovery: Int? = 70,
+        battery: Int? = 80,
+        connected: Boolean = true,
+        series: List<HrPoint> = listOf(HrPoint(ts = 1000, bpm = 62)),
+    ) = WidgetSnapshot(
+        recoveryPct = recovery,
+        restPct = 80,
+        effortPct = 40,
+        heartRate = hr,
+        heartRateStale = stale,
+        batteryPct = battery,
+        connected = connected,
+        hrSeries = series,
+        updatedAtMs = 1_700_000_000_000L,
+    )
+
+    /** The widgets may be showing what an earlier process left them, so the first push always sends. */
+    @Test
+    fun theFirstPushAfterAProcessStartAlwaysSends() {
+        assertTrue(RenderedGate.changed(snap(), dark = false))
+    }
+
+    /**
+     * The case this exists for: PushGate's 60-second timer fires whether or not anything moved, so a
+     * quiet strap used to cost a full widget update a minute to redraw an identical screen.
+     */
+    @Test
+    fun anIdenticalSnapshotIsNotSentTwice() {
+        assertTrue(RenderedGate.changed(snap(), dark = false))
+        assertFalse(RenderedGate.changed(snap(), dark = false))
+        assertFalse(RenderedGate.changed(snap(), dark = false))
+    }
+
+    /**
+     * The heart-rate VALUE has to count, because PushGate deliberately does not know it — it keys on
+     * whether a reading exists, so that a stream of samples cannot admit a push each. If this gate
+     * ignored the value too, a changing heart rate would never reach the screen.
+     */
+    @Test
+    fun aChangedHeartRateSends() {
+        RenderedGate.changed(snap(hr = 62), dark = false)
+        assertTrue(RenderedGate.changed(snap(hr = 63), dark = false))
+    }
+
+    /** Crossing LIVE_MS dims the reading, which is a visible change with no value change behind it. */
+    @Test
+    fun aStalenessFlipSends() {
+        RenderedGate.changed(snap(stale = false), dark = false)
+        assertTrue(RenderedGate.changed(snap(stale = true), dark = false))
+    }
+
+    /** A new trace point IS sent on Android, unlike the Apple rule: nothing else would carry it. */
+    @Test
+    fun anAdvancedTraceSends() {
+        val series = listOf(HrPoint(ts = 1000, bpm = 62))
+        RenderedGate.changed(snap(series = series), dark = false)
+        assertTrue(RenderedGate.changed(snap(series = series + HrPoint(ts = 1060, bpm = 63)), dark = false))
+    }
+
+    /** A point ageing out of the window redraws the chart just as surely as one arriving. */
+    @Test
+    fun aPrunedTraceSends() {
+        RenderedGate.changed(snap(series = listOf(HrPoint(1000, 62), HrPoint(1060, 63))), dark = false)
+        assertTrue(RenderedGate.changed(snap(series = listOf(HrPoint(1060, 63))), dark = false))
+    }
+
+    /** Every scalar the 2x2 and compact widgets render has to count, not just the HR ones. */
+    @Test
+    fun theOtherWidgetsFieldsSendToo() {
+        RenderedGate.changed(snap(), dark = false)
+        assertTrue("recovery", RenderedGate.changed(snap(recovery = 71), dark = false))
+        assertTrue("battery", RenderedGate.changed(snap(recovery = 71, battery = 79), dark = false))
+        assertTrue("connected", RenderedGate.changed(snap(recovery = 71, battery = 79, connected = false), dark = false))
+    }
+
+    /**
+     * The end state after a disconnect: the trace prunes empty and the reading is dropped, and from
+     * then on every push is identical. That is where this gate pays for itself, so it must not keep
+     * sending once there is nothing left to say.
+     */
+    @Test
+    fun aDrainedSnapshotSettlesAndStopsSending() {
+        assertTrue(RenderedGate.changed(snap(hr = null, series = emptyList()), dark = false))
+        repeat(10) { assertFalse(RenderedGate.changed(snap(hr = null, series = emptyList()), dark = false)) }
+    }
+
+    /**
+     * The timestamp is the field this gate could most easily have got wrong, so it is asserted from
+     * both sides.
+     *
+     * All three widgets RENDER it — the HR card as a permanent "Updated <time>" line, the 2x2 and
+     * compact as their disconnected "last seen". Including it in the key would change the key on every
+     * push and the gate could never fire. Excluding it and letting the stamp advance anyway would tell
+     * the reader 14:47 while showing them 14:32's reading, and freeze a visible clock at whatever a
+     * later unrelated recomposition happened to read.
+     *
+     * So the key excludes it deliberately, and [WidgetSnapshotStore.push] puts the previous value back
+     * when it declines. This pins the first half; the second is push()'s.
+     */
+    @Test
+    fun theStampAloneDoesNotSend() {
+        RenderedGate.changed(snap(), dark = false)
+        val later = WidgetSnapshot(
+            recoveryPct = 70, restPct = 80, effortPct = 40,
+            heartRate = 62, heartRateStale = false, batteryPct = 80, connected = true,
+            hrSeries = listOf(HrPoint(ts = 1000, bpm = 62)),
+            updatedAtMs = 1_700_000_900_000L,          // fifteen minutes later, same everything else
+        )
+        assertFalse("a newer stamp with identical content is not worth an update",
+            RenderedGate.changed(later, dark = false))
+    }
+
+    /**
+     * The appearance is an input the widgets read at composition, not one the snapshot carries, and
+     * nothing refreshes them when it changes — a theme flip reaches the screen only because a push
+     * updated them. Leaving it out of the key would have left a widget in the wrong colours until
+     * something unrelated moved, which is a regression this gate would have INTRODUCED.
+     */
+    @Test
+    fun aThemeFlipSends() {
+        RenderedGate.changed(snap(), dark = false)
+        assertTrue(RenderedGate.changed(snap(), dark = true))
+        assertFalse("and settles again once sent", RenderedGate.changed(snap(), dark = true))
+    }
+}
diff --git a/android/app/src/test/java/com/noop/widget/WidgetTelemetryTest.kt b/android/app/src/test/java/com/noop/widget/WidgetTelemetryTest.kt
new file mode 100644
index 0000000000..049fedd5e8
--- /dev/null
+++ b/android/app/src/test/java/com/noop/widget/WidgetTelemetryTest.kt
@@ -0,0 +1,216 @@
+package com.noop.widget
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import java.util.Locale
+
+/**
+ * Pins the widget cost counters. These exist to answer a field report ("battery drain feels worse
+ * with the widget enabled") from an export rather than from an argument about the code, so the thing
+ * worth testing is that the numbers mean what the line claims they mean.
+ */
+class WidgetTelemetryTest {
+
+    @Before
+    fun setUp() {
+        WidgetTelemetry.resetForTest()
+        HrTraceSeen.resetForTest()
+    }
+
+    private val t0 = 1_700_000_000_000L
+
+    /**
+     * The gate is the whole reason a ~1/s live-HR stream does not become a push per second, so the
+     * offered count has to include what was dropped. Reporting only what got through would make a
+     * broken throttle look like a quiet one.
+     */
+    @Test
+    fun offeredCountIncludesWhatTheGateDropped() {
+        WidgetTelemetry.notePushAdmitted(t0)
+        repeat(59) { WidgetTelemetry.notePushGated(t0 + it * 1000L) }
+        val s = WidgetTelemetry.snapshot(t0 + 60_000L)
+        assertEquals(1, s.pushesAdmitted)
+        assertEquals(59, s.pushesGated)
+        assertTrue("1 pushed / 60 offered" in s.render())
+    }
+
+    /** A rate over one minute of uptime is the figure a drain question turns on. */
+    @Test
+    fun ratesAreExtrapolatedFromUptime() {
+        repeat(10) { WidgetTelemetry.notePushAdmitted(t0 + it * 60_000L) }
+        repeat(10) { WidgetTelemetry.noteRender(bytes = 512 * 1024, elapsedMs = 4) }
+        val s = WidgetTelemetry.snapshot(t0 + 600_000L)   // 10 minutes
+        assertEquals(60.0, s.pushesPerHour!!, 0.001)      // 10 pushes in 10m = 60/h
+        assertEquals(512L, s.meanRenderBytes!! / 1024)
+        // 10 x 512KB in 10 minutes = 30MB/h.
+        assertEquals(30.0, s.renderBytesPerHour!! / 1_048_576.0, 0.01)
+    }
+
+    /**
+     * A rate computed from a few seconds of uptime is noise wearing a number's clothes, and this line
+     * goes in front of someone deciding whether to change the refresh cadence.
+     */
+    @Test
+    fun noRateIsClaimedUnderAMinuteOfUptime() {
+        WidgetTelemetry.notePushAdmitted(t0)
+        val s = WidgetTelemetry.snapshot(t0 + 5_000L)
+        assertNull(s.pushesPerHour)
+        assertNull(s.renderBytesPerHour)
+        assertEquals(1, s.pushesAdmitted)
+    }
+
+    /** The absence of widget activity is itself an answer to a drain report, so it must be stated. */
+    @Test
+    fun aSessionWithNoPushesSaysSoRatherThanRenderingNothing() {
+        assertEquals("Widgets:     no pushes this app session", WidgetTelemetry.snapshot(t0).render())
+    }
+
+    @Test
+    fun maxDrawTimeIsTheMaxNotTheLast() {
+        WidgetTelemetry.noteRender(bytes = 1024, elapsedMs = 40)
+        WidgetTelemetry.noteRender(bytes = 1024, elapsedMs = 2)
+        val s = WidgetTelemetry.snapshot(t0 + 60_000L)
+        assertEquals(40, s.renderMsMax)
+        assertEquals(21, s.renderMs / s.renders)
+    }
+
+    // MARK: - HrTraceSeen
+
+    /**
+     * A push carrying no live sample appends no point, so the next draw reproduces the previous
+     * bitmap exactly. That is the saving a future cache would take, and it is only worth taking if
+     * this counts it honestly.
+     */
+    @Test
+    fun anUnchangedSeriesIsRecognisedAsARepeat() {
+        val series = listOf(HrPoint(ts = 100, bpm = 60), HrPoint(ts = 160, bpm = 62))
+        assertFalse("the first draw is never a repeat", HrTraceSeen.repeat("w1", series, 800, 250, false))
+        assertTrue(HrTraceSeen.repeat("w1", series, 800, 250, false))
+        assertTrue(HrTraceSeen.repeat("w1", series, 800, 250, false))
+    }
+
+    /** A new bucket is a different picture. */
+    @Test
+    fun anAdvancedSeriesIsNotARepeat() {
+        val series = listOf(HrPoint(ts = 100, bpm = 60))
+        HrTraceSeen.repeat("w1", series, 800, 250, false)
+        assertFalse(HrTraceSeen.repeat("w1", series + HrPoint(ts = 160, bpm = 62), 800, 250, false))
+    }
+
+    /**
+     * Same points, different box or theme, is a genuinely different bitmap. Counting those as
+     * redundant would overstate the saving on offer, which is the one way this measurement could
+     * mislead the decision it exists to inform.
+     */
+    @Test
+    fun aResizeOrThemeFlipIsNotARepeat() {
+        val series = listOf(HrPoint(ts = 100, bpm = 60))
+        HrTraceSeen.repeat("w1", series, 800, 250, false)
+        assertFalse("a resize redraws", HrTraceSeen.repeat("w1", series, 900, 250, false))
+        assertFalse("a theme flip redraws", HrTraceSeen.repeat("w1", series, 900, 250, true))
+        assertTrue(HrTraceSeen.repeat("w1", series, 900, 250, true))
+    }
+
+    /** The newest sample's VALUE changing at the same timestamp still redraws. */
+    @Test
+    fun aChangedBpmAtTheSameTimestampIsNotARepeat() {
+        HrTraceSeen.repeat("w1", listOf(HrPoint(ts = 100, bpm = 60)), 800, 250, false)
+        assertFalse(HrTraceSeen.repeat("w1", listOf(HrPoint(ts = 100, bpm = 61)), 800, 250, false))
+    }
+
+    /**
+     * Two placed HR widgets must not answer for each other. A single shared slot made each widget's
+     * necessary FIRST draw look like a repeat of the other's, inflating the redundancy count - and an
+     * inflated count argues for an optimisation that is not actually on offer, which is the one
+     * direction this measurement must not be wrong in.
+     */
+    @Test
+    fun twoPlacedWidgetsDoNotAnswerForEachOther() {
+        val series = listOf(HrPoint(ts = 100, bpm = 60))
+        assertFalse("w1's first draw", HrTraceSeen.repeat("w1", series, 800, 250, false))
+        assertFalse("w2's first draw is its own, not a repeat of w1's",
+            HrTraceSeen.repeat("w2", series, 800, 250, false))
+        // Each still recognises its OWN repeat.
+        assertTrue(HrTraceSeen.repeat("w1", series, 800, 250, false))
+        assertTrue(HrTraceSeen.repeat("w2", series, 800, 250, false))
+        // And an advance on one does not clear the other.
+        val grown = series + HrPoint(ts = 160, bpm = 62)
+        assertFalse(HrTraceSeen.repeat("w1", grown, 800, 250, false))
+        assertTrue(HrTraceSeen.repeat("w2", series, 800, 250, false))
+    }
+
+    /**
+     * A widget composes from saved prefs when it is placed, or after a process start, with no push
+     * involved. Reporting "no pushes" there is true and drops the draw counts, which are the
+     * expensive half and the whole reason this exists.
+     */
+    @Test
+    fun drawsWithNoPushesAreStillReported() {
+        WidgetTelemetry.noteRender(bytes = 512 * 1024, elapsedMs = 5)
+        WidgetTelemetry.noteRender(bytes = 512 * 1024, elapsedMs = 5)
+        val line = WidgetTelemetry.snapshot(t0 + 120_000L).render()
+        assertTrue("must not claim an empty session: $line", "no pushes this app session" !in line)
+        assertTrue(line, "no pushes" in line)
+        assertTrue(line, "2 trace draws" in line)
+        assertTrue(line, "mean 512KB" in line)
+    }
+
+    /**
+     * The rate is a diagnostics field read by eye and by grep. Under a locale whose decimal separator
+     * is a comma, an unqualified format would print "30,0MB/h" and put a field separator inside a
+     * number.
+     */
+    @Test
+    fun ratesFormatWithADotWhateverTheDefaultLocale() {
+        val original = Locale.getDefault()
+        try {
+            Locale.setDefault(Locale.GERMANY)
+            repeat(10) { WidgetTelemetry.notePushAdmitted(t0 + it * 60_000L) }
+            repeat(10) { WidgetTelemetry.noteRender(bytes = 512 * 1024, elapsedMs = 4) }
+            val line = WidgetTelemetry.snapshot(t0 + 600_000L).render()
+            assertTrue(line, "60.0/h" in line)
+            assertTrue(line, "30.0MB/h" in line)
+            assertFalse(line, "," in line.substringAfter("Widgets:"))
+        } finally {
+            Locale.setDefault(original)
+        }
+    }
+
+    /**
+     * The effective width headroom, which is NOT [HrTrace.WIDTH_HEADROOM]: the byte budget runs out
+     * first at any realistic widget size. Pinned because the constant reads like the guarantee and is
+     * not, and because the value below 1.0 is the case where the bitmap is UPSCALED — the artefact the
+     * headroom exists to prevent. If a change to the budget or the chart height moves these, that is
+     * worth seeing rather than discovering from a soft stroke on someone's home screen.
+     */
+    @Test
+    fun theByteBudgetBindsBeforeTheWidthHeadroomDoes() {
+        fun effective(densityDpi: Float, widthDp: Float): Double {
+            val density = densityDpi / 160f
+            val chartDp = (widthDp - 28f - 34f).coerceAtLeast(24f)
+            val req = (chartDp * density).toInt()
+            val h = (92f * density).toInt()
+            return HrTrace.widestAtHeight(req, h).toDouble() / req
+        }
+        // The property, not a pinned number: at every realistic size the BUDGET is what caps the width,
+        // so the nominal headroom is never reached and raising it would change nothing.
+        for (dpi in listOf(420f, 480f)) {
+            for (dp in listOf(300f, 340f, 380f)) {
+                val eff = effective(dpi, dp)
+                assertTrue(
+                    "$dpi/$dp reached $eff, so the byte budget was not the binding constraint",
+                    eff < HrTrace.WIDTH_HEADROOM,
+                )
+            }
+        }
+        // The case that matters: a wide card at high density is drawn NARROWER than it is displayed,
+        // so the bitmap is UPSCALED — precisely the artefact the headroom exists to prevent.
+        assertTrue("480dpi/380dp should be upscaled", effective(480f, 380f) < 1.0)
+        // And a small card is where the intent survives best, though still short of the nominal 2x.
+        assertTrue("420dpi/300dp should have the most headroom", effective(420f, 300f) > 1.5)
+    }
+}

From 9e5bc84622877edaf13e9a94dd4465f5294f4191 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 20:45:32 +1200
Subject: [PATCH 319/333] build: testing build 455 / 336

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index b3126c80da..33ab2b838d 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 454
+        versionCode = 455
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 4b0d379df9..5184b43d90 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "335"
+    CURRENT_PROJECT_VERSION: "336"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 3f89554dfafc9ee7ae1f06b98bf7327fb8047be2 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 21:38:02 +1200
Subject: [PATCH 320/333] widget: measure the rates after the startup burst,
 and give the counters an iOS twin

The first capture from a device reported 215/h against a steady state of about
sixty. The refresh clause is 60 seconds, so at most two of those six pushes could
have come from it; the rest were the snapshot's fields arriving one at a time at
launch, each a key change admitted on the spot. A minute of uptime was not a long
enough floor because the problem is not sample size - the early samples are a
different population. Rates now run over a steady window that opens a minute
after the first push and are withheld until it is five minutes long, and the line
says which window it is waiting on rather than implying a claim about uptime.

Three further faults, all the same shape and none of them arithmetic: a counter
whose name claimed more than its wiring delivered.

Pushes the rendered gate declined were counted as sends, so the figure the whole
drain question turns on could not fall when the gate did its job. Pushes with no
widget placed were counted as sends too, at a second early return one further up
- and that is the worst place for it, because an export taken with the widget
REMOVED is half of the comparison the counters exist for. Both halves would have
read alike.

And the claim that iOS was not applicable was wrong. The push accounting maps
exactly: the same throttle, the same reload-or-decline, the same diagnostics
header block. Only the bitmap half does not, since that widget draws a SwiftUI
Path with no Binder transaction, and it is left out rather than faked. iOS also
carries a cost Android does not - WidgetKit budgets timeline reloads, and
spending that budget makes the widget go STALE rather than costing battery - so
the rate there counts reloads, not publishes.

The twin then reproduced the very defect just fixed on the Android side: iOS
never asks whether a widget is installed before reloading, so reloads were
counted with nothing to receive them. Recorded honestly rather than gated, since
the measurement was the defect and gating would be a behaviour change on a
platform not testable here.

Android: full suite 5,581 tests, 664 classes, 0 failures. Swift compiles on both
build legs; StrandTests runs only in the on-demand app-build workflow, so the
eight iOS tests are not exercised by default CI.
---
 Strand/System/DebugDataDiagnostics.swift      |   8 +
 StrandTests/WidgetTelemetryTests.swift        | 126 ++++++++++++
 StrandiOS/Widgets/WidgetPublish.swift         |  45 ++++-
 StrandiOSShared/WidgetTelemetry.swift         | 179 ++++++++++++++++++
 .../java/com/noop/widget/WidgetSnapshot.kt    |   8 +-
 .../java/com/noop/widget/WidgetTelemetry.kt   | 122 +++++++++++-
 .../com/noop/widget/WidgetTelemetryTest.kt    | 133 +++++++++++--
 project.yml                                   |   3 +
 8 files changed, 600 insertions(+), 24 deletions(-)
 create mode 100644 StrandTests/WidgetTelemetryTests.swift
 create mode 100644 StrandiOSShared/WidgetTelemetry.swift

diff --git a/Strand/System/DebugDataDiagnostics.swift b/Strand/System/DebugDataDiagnostics.swift
index 9eea4b951f..5beb065b7f 100644
--- a/Strand/System/DebugDataDiagnostics.swift
+++ b/Strand/System/DebugDataDiagnostics.swift
@@ -92,6 +92,14 @@ enum DebugDataDiagnostics {
         }
         if restoreAt > 0 { lines.append("Last restore: \(relTime(now - restoreAt))") }
         #if os(iOS)
+        // What the home-screen widgets cost. Reported unconditionally, including the no-publish case,
+        // because the absence of widget activity is itself the answer to a drain report.
+        //
+        // iOS only: `WidgetTelemetry` lives in StrandiOSShared, which project.yml deliberately keeps
+        // OUT of the macOS application module. macOS has no home-screen widget to account for.
+        lines.append(WidgetTelemetry.snapshot().render())
+        #endif
+        #if os(iOS)
         // #52: iOS Backup & Sync folder-picker health. When users report "won't let me pick a folder",
         // this pins the failure stage: "cancelled"/"never used" ⇒ the picker's Open button never fired
         // (an iOS-side picker issue — the in-app "Use NOOP's own folder" fallback sidesteps it);
diff --git a/StrandTests/WidgetTelemetryTests.swift b/StrandTests/WidgetTelemetryTests.swift
new file mode 100644
index 0000000000..0b7eb0e1f2
--- /dev/null
+++ b/StrandTests/WidgetTelemetryTests.swift
@@ -0,0 +1,126 @@
+import XCTest
+
+/// Pins the widget cost counters. Twin of Android's `WidgetTelemetryTest`, minus the bitmap half,
+/// which has no analogue here.
+///
+/// The Android side has had three defects in these counters and none of them were arithmetic: each
+/// time a counter's NAME claimed more than its wiring delivered. So the cases below are written
+/// against the questions the numbers are supposed to answer rather than against the sums.
+final class WidgetTelemetryTests: XCTestCase {
+
+    private let t0 = Date(timeIntervalSince1970: 1_700_000_000)
+
+    override func setUp() {
+        super.setUp()
+        WidgetTelemetry.resetForTest()
+    }
+
+    /// The throttle is the whole reason a live-HR stream does not become a publish per tick, so the
+    /// offered count has to include what it dropped. Reporting only what got through would make a
+    /// broken throttle look like a quiet one.
+    func testOfferedIncludesWhatTheThrottleDropped() {
+        WidgetTelemetry.noteAdmitted(now: t0)
+        for i in 0..<59 { WidgetTelemetry.noteGated(now: t0.addingTimeInterval(Double(i))) }
+        let s = WidgetTelemetry.snapshot(now: t0.addingTimeInterval(60))
+        XCTAssertEqual(s.admitted, 1)
+        XCTAssertEqual(s.gated, 59)
+        XCTAssertEqual(s.offered, 60)
+        XCTAssertTrue(s.render().contains("0 reloaded / 1 admitted / 60 offered"), s.render())
+    }
+
+    /// Reloads, not publishes. A publish that declined the reload cost nothing and spent none of
+    /// WidgetKit's budget, so counting it here would make the figure unable to fall when the dedup in
+    /// `saveAndReloadIfChanged` did its job — the one thing that dedup is for.
+    func testTheRateCountsReloadsNotPublishes() {
+        WidgetTelemetry.noteAdmitted(now: t0)
+        for m in 1...10 {
+            let at = t0.addingTimeInterval(Double(m) * 60)
+            WidgetTelemetry.noteAdmitted(now: at)
+            if m > 5 { WidgetTelemetry.noteDeclined() } else { WidgetTelemetry.noteReloaded(now: at) }
+        }
+        let s = WidgetTelemetry.snapshot(now: t0.addingTimeInterval(660))
+        XCTAssertEqual(s.admitted, 11)
+        XCTAssertEqual(s.reloaded, 5)
+        XCTAssertEqual(s.declined, 5)
+        // Five reloads in a ten-minute steady window is 30/h, not the 60/h the publishes would claim.
+        XCTAssertEqual(s.reloadsPerHour ?? 0, 30, accuracy: 0.001)
+    }
+
+    /// The startup burst must not be quoted as a rate. The snapshot's fields arrive one by one at
+    /// launch and each publishes on the spot, so a launch produces activity the once-a-minute throttle
+    /// had nothing to do with. An Android capture reported six in a hundred seconds as 215/h against a
+    /// steady state of about sixty.
+    func testAStartupBurstIsNotQuotedAsARate() {
+        for offset in [0.0, 2, 5, 9, 30, 95] {
+            WidgetTelemetry.noteAdmitted(now: t0.addingTimeInterval(offset))
+            WidgetTelemetry.noteReloaded(now: t0.addingTimeInterval(offset))
+        }
+        let s = WidgetTelemetry.snapshot(now: t0.addingTimeInterval(100))
+        XCTAssertEqual(s.admitted, 6)
+        XCTAssertNil(s.reloadsPerHour, "a burst is not a rate")
+        XCTAssertTrue(s.render().contains("steady"), s.render())
+    }
+
+    /// The withheld-rate message has to name the window it waits on. Phrasing it as a minimum UPTIME
+    /// was wrong on Android: publishes can be sparse enough that the steady window opens late, so the
+    /// line would sit twenty minutes in still claiming it needed six.
+    func testAWithheldRateNamesTheSteadyWindow() {
+        WidgetTelemetry.noteAdmitted(now: t0)
+        WidgetTelemetry.noteAdmitted(now: t0.addingTimeInterval(19 * 60))
+        let line = WidgetTelemetry.snapshot(now: t0.addingTimeInterval(20 * 60)).render()
+        XCTAssertTrue(line.contains("over 20m"), line)
+        XCTAssertTrue(line.contains("steady 1m of 5m"), line)
+    }
+
+    /// The absence of widget activity is itself an answer to a drain report, so it must be stated
+    /// rather than rendered as an empty line.
+    func testASessionWithNoPublishesSaysSo() {
+        XCTAssertEqual(WidgetTelemetry.snapshot(now: t0).render(),
+                       "Widgets:     no publishes this app session")
+    }
+
+    /// The rate is a diagnostics field read by eye and by grep, so it must not pick up a locale's
+    /// decimal comma.
+    func testTheRateFormatsWithADot() {
+        WidgetTelemetry.noteAdmitted(now: t0)
+        for m in 1...10 {
+            let at = t0.addingTimeInterval(Double(m) * 60)
+            WidgetTelemetry.noteAdmitted(now: at)
+            WidgetTelemetry.noteReloaded(now: at)
+        }
+        let line = WidgetTelemetry.snapshot(now: t0.addingTimeInterval(660)).render()
+        XCTAssertTrue(line.contains("60.0/h"), line)
+        XCTAssertFalse(line.contains("60,0/h"), line)
+    }
+
+    /// The widget-removed export is half of the comparison the counters exist for, so a reload with
+    /// nothing installed must not read as one. Android had exactly this bug; iOS never checks whether
+    /// a widget is placed before calling `reloadAllTimelines`, so without this the figure would be
+    /// just as blind here.
+    func testAReloadWithNoWidgetInstalledIsNotCountedAsOne() {
+        WidgetTelemetry.noteWidgetsInstalled(false)
+        WidgetTelemetry.noteAdmitted(now: t0)
+        for m in 1...10 {
+            let at = t0.addingTimeInterval(Double(m) * 60)
+            WidgetTelemetry.noteAdmitted(now: at)
+            WidgetTelemetry.noteNoWidget()
+        }
+        let s = WidgetTelemetry.snapshot(now: t0.addingTimeInterval(660))
+        XCTAssertEqual(s.admitted, 11)
+        XCTAssertEqual(s.reloaded, 0)
+        XCTAssertEqual(s.noWidget, 10)
+        XCTAssertEqual(s.reloadsPerHour ?? -1, 0, accuracy: 0.001)
+        XCTAssertTrue(s.render().contains("10 with no widget installed"), s.render())
+    }
+
+    /// Unknown must count as installed. Over-reporting reloads is the safe direction for a figure
+    /// whose whole purpose is to show a cost: a wrong "nothing was spent" is the one answer that would
+    /// end an investigation early.
+    func testPresenceDefaultsToInstalledBeforeWidgetKitHasAnswered() {
+        XCTAssertTrue(WidgetTelemetry.widgetsInstalled)
+        WidgetTelemetry.noteWidgetsInstalled(false)
+        XCTAssertFalse(WidgetTelemetry.widgetsInstalled)
+        WidgetTelemetry.resetForTest()
+        XCTAssertTrue(WidgetTelemetry.widgetsInstalled, "reset returns it to unknown, not to false")
+    }
+}
diff --git a/StrandiOS/Widgets/WidgetPublish.swift b/StrandiOS/Widgets/WidgetPublish.swift
index e3fb382fbb..f0ad2099d2 100644
--- a/StrandiOS/Widgets/WidgetPublish.swift
+++ b/StrandiOS/Widgets/WidgetPublish.swift
@@ -21,6 +21,7 @@ extension WidgetSnapshot {
     /// the rollover yet always describes today.
     @MainActor
     static func publish(from model: AppModel) async {
+        await refreshWidgetPresence()
         let days = model.repo.days
         let now = Date()
         // The recovery-derived anchor: today's row when it's scored, else the freshest STRICTLY-PRIOR
@@ -112,19 +113,57 @@ extension WidgetSnapshot {
         if renderedContentChanged(from: previous, to: snap) {
             snap.save(previousSeries: previous?.hrSeries ?? [])
             WidgetCenter.shared.reloadAllTimelines()
+            // Android skips the update entirely when no widget is placed; WidgetKit offers no
+            // synchronous way to know, so the reload still goes out and is instead recorded honestly.
+            // Counting it as a reload would make a widget-removed export read exactly like a
+            // widget-installed one, which is half the comparison the counters exist for.
+            if WidgetTelemetry.widgetsInstalled {
+                WidgetTelemetry.noteReloaded()
+            } else {
+                WidgetTelemetry.noteNoWidget()
+            }
         } else if WidgetSnapshot.traceNeedsPoint(previous: previous, bpm: snap.bpm, now: snap.updated) {
             // A steady heart changes nothing the header renders, so the branch above declines — but the
             // TRACE still wants this minute's point, or it stops advancing at rest and prunes to empty
             // (#1957). Persist without a reload: the point is for the next timeline WidgetKit builds,
             // and spending a reload a minute is exactly what the dedup above exists to avoid.
             snap.save(previousSeries: previous?.hrSeries ?? [])
+            WidgetTelemetry.noteDeclined()
         } else if liveUpdateRequiresFullBuild(previous: previous, now: snap.updated) {
             // The rollover's visible values can legitimately match yesterday's. Persist the fresh day
             // stamp once without spending a redundant WidgetKit reload, so later live ticks stay fast.
             snap.save(previousSeries: previous?.hrSeries ?? [])
+            WidgetTelemetry.noteDeclined()
+        } else {
+            // Nothing at all to do. Counted rather than left as a silent fall-through: an outcome that
+            // records nothing is exactly how the Android counters came to report publishes that never
+            // went anywhere as if they had.
+            WidgetTelemetry.noteDeclined()
         }
     }
 
+    /// Ask WidgetKit whether any widget is actually installed, and remember the answer.
+    ///
+    /// Only on the full publish path: it is already `async`, and the once-a-minute live path has no
+    /// `await` to spend on an XPC round trip it does not need. The answer changes when a user adds or
+    /// removes a widget, which is exactly when the app is being foregrounded anyway, so a value from
+    /// the last full publish is fresh enough for a diagnostic.
+    ///
+    /// A failure leaves the previous answer in place rather than guessing, and "never asked" counts as
+    /// installed — over-reporting reloads is the safe direction for a figure meant to show a cost.
+    @MainActor
+    private static func refreshWidgetPresence() async {
+        let installed: Bool? = await withCheckedContinuation { continuation in
+            WidgetCenter.shared.getCurrentConfigurations { result in
+                switch result {
+                case .success(let widgets): continuation.resume(returning: !widgets.isEmpty)
+                case .failure: continuation.resume(returning: nil)
+                }
+            }
+        }
+        if let installed { WidgetTelemetry.noteWidgetsInstalled(installed) }
+    }
+
     /// #114/#169: HR is the ONE high-frequency widget-publish trigger — `model.bpm` moves every few
     /// seconds during activity, unlike battery (~8 min) or connection flips (rare). Left ungated, the
     /// `model.$bpm` hook rewrote the shared snapshot + called `reloadAllTimelines()` on every tick (and,
@@ -139,8 +178,12 @@ extension WidgetSnapshot {
         /// True (and stamps `now`) when at least `interval` has elapsed since the last HR-driven publish;
         /// false to skip this HR change. The first call always admits (`.distantPast`).
         static func admit(now: Date = Date()) -> Bool {
-            guard now.timeIntervalSince(lastPublishedAt) >= interval else { return false }
+            guard now.timeIntervalSince(lastPublishedAt) >= interval else {
+                WidgetTelemetry.noteGated(now: now)
+                return false
+            }
             lastPublishedAt = now
+            WidgetTelemetry.noteAdmitted(now: now)
             return true
         }
     }
diff --git a/StrandiOSShared/WidgetTelemetry.swift b/StrandiOSShared/WidgetTelemetry.swift
new file mode 100644
index 0000000000..e203764e75
--- /dev/null
+++ b/StrandiOSShared/WidgetTelemetry.swift
@@ -0,0 +1,179 @@
+import Foundation
+
+/// Counters for what the home-screen widgets cost, so "the widget drains my battery" is decidable
+/// from an export instead of being argued from the code.
+///
+/// Twin of Android's `WidgetTelemetry`, and deliberately only HALF of it. The push accounting maps
+/// one to one — `HRPublishThrottle` gates, `saveAndReloadIfChanged` either reloads or declines — so
+/// the same four outcomes exist here and are worth the same counters. The bitmap accounting does not
+/// map at all: this widget draws a SwiftUI `Path` inside the extension, with no bitmap and no Binder
+/// transaction, so draws, bytes and MB/h would be measuring something that does not happen.
+///
+/// One cost is iOS-ONLY and is the reason this is worth having rather than merely symmetrical.
+/// WidgetKit budgets timeline reloads, and spending the budget does not cost battery — it makes the
+/// widget go STALE, which is a correctness failure the user sees. A reloads-per-hour figure is the
+/// only way to know how close the app runs to that ceiling, and nothing has ever measured it.
+///
+/// Process-lifetime, reset when the process dies, reported as a rate over the steady window so a
+/// short session and a long one are comparable. Not persisted: writing to disk on every publish to
+/// measure the cost of publishing would be its own answer to the question.
+public enum WidgetTelemetry {
+
+    /// How long after the first publish to ignore before the rates start counting.
+    ///
+    /// The snapshot's fields populate one after another at launch and each is a content change that
+    /// publishes immediately, so a launch produces a burst that the once-a-minute HR throttle has
+    /// nothing to do with. An Android capture reported six pushes in a hundred seconds as 215/h
+    /// against a steady state of about sixty; the same shape applies here.
+    private static let warmup: TimeInterval = 60
+
+    private static let lock = NSLock()
+    private static var startedAt: Date?
+    private static var steadyStartedAt: Date?
+    private static var offered = 0
+    private static var gated = 0
+    private static var admitted = 0
+    private static var reloaded = 0
+    private static var declined = 0
+    private static var steadyReloads = 0
+    private static var noWidget = 0
+    private static var steadyNoWidget = 0
+    private static var installedKnown: Bool?
+
+    /// A publish that `HRPublishThrottle` let through.
+    public static func noteAdmitted(now: Date = Date()) {
+        lock.lock(); defer { lock.unlock() }
+        if startedAt == nil { startedAt = now }
+        offered += 1
+        admitted += 1
+        if let started = startedAt, now.timeIntervalSince(started) >= warmup, steadyStartedAt == nil {
+            steadyStartedAt = now
+        }
+    }
+
+    /// A publish the throttle dropped. At live-HR cadence this should dwarf the admitted count.
+    public static func noteGated(now: Date = Date()) {
+        lock.lock(); defer { lock.unlock() }
+        if startedAt == nil { startedAt = now }
+        offered += 1
+        gated += 1
+    }
+
+    /// A publish that actually asked WidgetKit for a new timeline. THE figure that matters here: this
+    /// is what spends the reload budget.
+    public static func noteReloaded(now: Date = Date()) {
+        lock.lock(); defer { lock.unlock() }
+        reloaded += 1
+        if steadyStartedAt != nil { steadyReloads += 1 }
+    }
+
+    /// A publish that persisted but declined the reload, because nothing a widget renders had changed
+    /// (or only the trace advanced, which the next timeline picks up anyway).
+    public static func noteDeclined() {
+        lock.lock(); defer { lock.unlock() }
+        declined += 1
+    }
+
+    /// A reload asked for with no widget installed to receive it.
+    ///
+    /// Android learned this the hard way: an export taken with the widget REMOVED is half of the
+    /// comparison that answers whether the widget costs anything, and counting these as reloads made
+    /// both halves read alike. iOS never checks whether a widget is placed before calling
+    /// `reloadAllTimelines`, so without this the same figure would be just as blind here.
+    public static func noteNoWidget() {
+        lock.lock(); defer { lock.unlock() }
+        noWidget += 1
+        if steadyStartedAt != nil { steadyNoWidget += 1 }
+    }
+
+    /// Record what WidgetKit says about installed widgets. Refreshed on the async publish paths, which
+    /// is the only place an `await` is available; the synchronous live path reads the last answer.
+    ///
+    /// Nil means never asked, and nil counts as INSTALLED at the call site. Unknown must not be able to
+    /// invent a saving that was never made — over-reporting reloads is the safe direction for a figure
+    /// whose purpose is to show a cost.
+    public static func noteWidgetsInstalled(_ installed: Bool) {
+        lock.lock(); defer { lock.unlock() }
+        installedKnown = installed
+    }
+
+    /// The last known answer, defaulting to true. See [noteWidgetsInstalled].
+    public static var widgetsInstalled: Bool {
+        lock.lock(); defer { lock.unlock() }
+        return installedKnown ?? true
+    }
+
+    public static func snapshot(now: Date = Date()) -> Snapshot {
+        lock.lock(); defer { lock.unlock() }
+        return Snapshot(
+            uptime: startedAt.map { now.timeIntervalSince($0) } ?? 0,
+            steady: steadyStartedAt.map { now.timeIntervalSince($0) } ?? 0,
+            offered: offered,
+            gated: gated,
+            admitted: admitted,
+            reloaded: reloaded,
+            declined: declined,
+            noWidget: noWidget,
+            steadyReloads: steadyReloads,
+            steadyNoWidget: steadyNoWidget
+        )
+    }
+
+    public static func resetForTest() {
+        lock.lock(); defer { lock.unlock() }
+        startedAt = nil; steadyStartedAt = nil
+        offered = 0; gated = 0; admitted = 0; reloaded = 0; declined = 0; steadyReloads = 0
+        noWidget = 0; steadyNoWidget = 0; installedKnown = nil
+    }
+
+    public struct Snapshot: Sendable, Equatable {
+        public let uptime: TimeInterval
+        public let steady: TimeInterval
+        public let offered: Int
+        public let gated: Int
+        public let admitted: Int
+        public let reloaded: Int
+        public let declined: Int
+        public let noWidget: Int
+        public let steadyReloads: Int
+        public let steadyNoWidget: Int
+
+        /// A rate is only quoted once the steady window is long enough to mean something. Five minutes
+        /// of ordinary running is a handful of one-a-minute publishes; less is arithmetic.
+        private var steadyEnough: Bool { steady >= 5 * 60 }
+
+        /// Timeline reloads per hour, over the steady window.
+        ///
+        /// Reloads and not publishes, because a publish that declined the reload cost nothing and
+        /// spent none of the budget. Counting those would make this figure unable to fall when the
+        /// dedup in `saveAndReloadIfChanged` did its job, which is the one thing it is for.
+        ///
+        /// A reload asked for with no widget installed is not counted here either — it is recorded as
+        /// [noWidget] instead of as a reload, so this figure never claims a cost that had nowhere to
+        /// land.
+        ///
+        /// Elapsed WALL-CLOCK time is the denominator, not time spent streaming: the ceiling this runs
+        /// against is expressed per hour of real time, as is a battery question.
+        public var reloadsPerHour: Double? {
+            guard steadyEnough, steady > 0 else { return nil }
+            return Double(steadyReloads) * 3600 / steady
+        }
+
+        /// One line for the diagnostics header, matching the Android wording so two exports from the
+        /// same household read the same way.
+        public func render() -> String {
+            guard offered > 0 else { return "Widgets:     no publishes this app session" }
+            var parts: [String] = ["\(reloaded) reloaded / \(admitted) admitted / \(offered) offered"]
+            if let rate = reloadsPerHour {
+                parts.append(String(format: "%.1f/h", rate))
+            }
+            if declined > 0 { parts.append("\(declined) unchanged") }
+            if noWidget > 0 { parts.append("\(noWidget) with no widget installed") }
+            let mins = Int(uptime / 60)
+            let span = steadyEnough
+                ? "over \(mins)m"
+                : "over \(mins)m, steady \(Int(steady / 60))m of 5m"
+            return "Widgets:     " + parts.joined(separator: " · ") + " (\(span))"
+        }
+    }
+}
diff --git a/android/app/src/main/java/com/noop/widget/WidgetSnapshot.kt b/android/app/src/main/java/com/noop/widget/WidgetSnapshot.kt
index 24690926b1..6a8daeb122 100644
--- a/android/app/src/main/java/com/noop/widget/WidgetSnapshot.kt
+++ b/android/app/src/main/java/com/noop/widget/WidgetSnapshot.kt
@@ -80,7 +80,13 @@ object WidgetSnapshotStore {
         val hrIds = runCatching {
             GlanceAppWidgetManager(app).getGlanceIds(HrGlanceWidget::class.java)
         }.getOrDefault(emptyList())
-        if (standardIds.isEmpty() && compactIds.isEmpty() && hrIds.isEmpty()) return
+        if (standardIds.isEmpty() && compactIds.isEmpty() && hrIds.isEmpty()) {
+            // Admitted, but there is nowhere for it to go. Recorded rather than returned silently: an
+            // export taken with the widget removed is half of the comparison that answers whether it
+            // costs anything, and counting this as a send would have made both halves look alike.
+            WidgetTelemetry.notePushNoWidget()
+            return
+        }
 
         // Nothing the widgets DISPLAY changed, so there is nothing to send. Read back what they will
         // actually render rather than re-deriving it: `load` resolves staleness and prunes the trace,
diff --git a/android/app/src/main/java/com/noop/widget/WidgetTelemetry.kt b/android/app/src/main/java/com/noop/widget/WidgetTelemetry.kt
index c207fefd9e..761aa199cf 100644
--- a/android/app/src/main/java/com/noop/widget/WidgetTelemetry.kt
+++ b/android/app/src/main/java/com/noop/widget/WidgetTelemetry.kt
@@ -32,7 +32,24 @@ import java.util.Locale
  */
 object WidgetTelemetry {
 
+    /**
+     * How long after the first push to ignore before the rates start counting.
+     *
+     * The snapshot's fields populate one after another at startup — recovery, then rest, then effort,
+     * then battery, then connection — and each one is a key change [PushGate] admits immediately. So a
+     * launch produces a burst that the 60-second refresh clause has nothing to do with. The first field
+     * sample showed six pushes in a hundred seconds reported as 215/h, against a steady state of about
+     * sixty: the number that matters most was wrong by three and a half times, in exactly the situation
+     * where someone looks at it first.
+     */
+    private const val WARMUP_MS = 60_000L
+
     private var startedAtMs = 0L
+    private var steadyStartMs = 0L
+    private var steadyPushes = 0L
+    private var steadyUnchanged = 0L
+    private var steadyNoWidget = 0L
+    private var steadyRenderBytes = 0L
     private var pushesAdmitted = 0L
     private var pushesGated = 0L
     private var renders = 0L
@@ -41,6 +58,7 @@ object WidgetTelemetry {
     private var renderMs = 0L
     private var renderMsMax = 0L
     private var pushesUnchanged = 0L
+    private var pushesNoWidget = 0L
     private var lastPushAtMs = 0L
 
     /** A push [PushGate] let through: prefs written and every placed widget recomposed. */
@@ -49,6 +67,10 @@ object WidgetTelemetry {
         if (startedAtMs == 0L) startedAtMs = nowMs
         pushesAdmitted += 1
         lastPushAtMs = nowMs
+        if (nowMs - startedAtMs >= WARMUP_MS) {
+            if (steadyStartMs == 0L) steadyStartMs = nowMs
+            steadyPushes += 1
+        }
     }
 
     /** A push the gate dropped. At live-HR cadence this should dwarf the admitted count. */
@@ -66,6 +88,22 @@ object WidgetTelemetry {
     @Synchronized
     fun notePushUnchanged() {
         pushesUnchanged += 1
+        if (steadyStartMs != 0L) steadyUnchanged += 1
+    }
+
+    /**
+     * A push admitted with no widget placed to receive it.
+     *
+     * A DIFFERENT outcome from [notePushUnchanged], and worth its own counter rather than folding the
+     * two together: "there was nothing new to show" and "there was nobody to show it to" answer
+     * different questions, and the second is exactly what an export taken with the widget removed is
+     * for. Counting it as a send would have made a widget-removed capture look identical to a
+     * widget-placed one on every figure except the draws.
+     */
+    @Synchronized
+    fun notePushNoWidget() {
+        pushesNoWidget += 1
+        if (steadyStartMs != 0L) steadyNoWidget += 1
     }
 
     /** One trace bitmap built: [bytes] is what crosses the Binder, [elapsedMs] is the draw alone. */
@@ -75,6 +113,7 @@ object WidgetTelemetry {
         renderBytes += bytes.toLong()
         renderMs += elapsedMs
         if (elapsedMs > renderMsMax) renderMsMax = elapsedMs
+        if (steadyStartMs != 0L) steadyRenderBytes += bytes.toLong()
     }
 
     /**
@@ -90,9 +129,15 @@ object WidgetTelemetry {
     @Synchronized
     fun snapshot(nowMs: Long): Snapshot = Snapshot(
         uptimeMs = if (startedAtMs == 0L) 0L else nowMs - startedAtMs,
+        steadyMs = if (steadyStartMs == 0L) 0L else nowMs - steadyStartMs,
+        steadyPushes = steadyPushes,
+        steadyUnchanged = steadyUnchanged,
+        steadyNoWidget = steadyNoWidget,
+        steadyRenderBytes = steadyRenderBytes,
         pushesAdmitted = pushesAdmitted,
         pushesGated = pushesGated,
         pushesUnchanged = pushesUnchanged,
+        pushesNoWidget = pushesNoWidget,
         renders = renders,
         rendersRedundant = rendersRedundant,
         renderBytes = renderBytes,
@@ -103,16 +148,25 @@ object WidgetTelemetry {
 
     @Synchronized
     fun resetForTest() {
-        startedAtMs = 0L; pushesAdmitted = 0L; pushesGated = 0L; pushesUnchanged = 0L
+        startedAtMs = 0L; steadyStartMs = 0L; steadyPushes = 0L; steadyRenderBytes = 0L
+        steadyUnchanged = 0L
+        pushesAdmitted = 0L; pushesGated = 0L; pushesUnchanged = 0L; pushesNoWidget = 0L
+        steadyNoWidget = 0L
         renders = 0L; rendersRedundant = 0L; renderBytes = 0L; renderMs = 0L; renderMsMax = 0L
         lastPushAtMs = 0L
     }
 
     data class Snapshot(
         val uptimeMs: Long,
+        val steadyMs: Long,
+        val steadyPushes: Long,
+        val steadyUnchanged: Long,
+        val steadyNoWidget: Long,
+        val steadyRenderBytes: Long,
         val pushesAdmitted: Long,
         val pushesGated: Long,
         val pushesUnchanged: Long,
+        val pushesNoWidget: Long,
         val renders: Long,
         val rendersRedundant: Long,
         val renderBytes: Long,
@@ -120,22 +174,54 @@ object WidgetTelemetry {
         val renderMsMax: Long,
         val lastPushAgoMs: Long?,
     ) {
-        /** Mean bitmap in bytes, or null before the first render. */
+        /**
+         * Mean bitmap in bytes, or null before the first render.
+         *
+         * Deliberately over EVERY draw, unlike the rates: this is a property of one bitmap, set by the
+         * widget's size and the screen's density, not something a startup burst distorts. Worth
+         * knowing when reading the line, since `mean` and `MB/h` beside each other do not span the
+         * same window and so will not divide into each other exactly. The same is true of the draw
+         * times below it.
+         */
         val meanRenderBytes: Long? get() = if (renders > 0) renderBytes / renders else null
 
+        /** A rate is only quoted once the steady window is long enough to mean something. Five
+         *  minutes of ordinary running is a handful of one-a-minute pushes; less is arithmetic. */
+        private val steadyEnough: Boolean get() = steadyMs >= 5 * 60_000L
+
+        /**
+         * Pushes that actually became a widget update: admitted, then neither dropped by
+         * [RenderedGate] nor discarded for having no widget to go to.
+         */
+        val pushesSent: Long get() = pushesAdmitted - pushesUnchanged - pushesNoWidget
+
         /**
-         * Pushes per hour, extrapolated from this process's uptime. Null under a minute of uptime:
-         * a rate from a few seconds of samples is noise wearing a number's clothes.
+         * Widget updates SENT per hour, over the steady window rather than since process start.
+         *
+         * Two exclusions, for two different reasons. The startup burst goes because it is not what the
+         * widget costs to keep running — the snapshot's fields arrive one by one and each is a key
+         * change admitted on the spot, so a launch produces pushes the 60-second clause had nothing to
+         * do with, and quoting them overstated the cost by three and a half times on the first sample
+         * from a device.
+         *
+         * And pushes [RenderedGate] declined go because they never reached a widget. Counting them
+         * here would have made this rate blind to the one optimisation it exists to price: the gate's
+         * whole purpose is to lower this number, so a figure that could not fall when the gate fired
+         * would be measuring the wrong thing.
+         *
+         * Elapsed WALL-CLOCK time is the denominator, not time spent streaming, because that is what a
+         * battery question is asked in. A process that idles for an hour genuinely cost nothing over
+         * that hour, and the rate should say so.
          */
         val pushesPerHour: Double?
-            get() = if (uptimeMs >= 60_000L) pushesAdmitted * 3_600_000.0 / uptimeMs else null
+            get() = if (steadyEnough) (steadyPushes - steadyUnchanged - steadyNoWidget) * 3_600_000.0 / steadyMs else null
 
         /**
-         * Bitmap bytes per hour at the observed rate — the figure the drain question turns on, since
-         * this is what crosses a Binder transaction to the launcher.
+         * Bitmap bytes per hour — the figure the drain question turns on, since this is what crosses a
+         * Binder transaction to the launcher. Same steady window, for the same reason.
          */
         val renderBytesPerHour: Double?
-            get() = if (uptimeMs >= 60_000L) renderBytes * 3_600_000.0 / uptimeMs else null
+            get() = if (steadyEnough) steadyRenderBytes * 3_600_000.0 / steadyMs else null
 
         /**
          * One line for the diagnostics header. Deliberately reports the RATE alongside the raw counts:
@@ -150,9 +236,24 @@ object WidgetTelemetry {
                 return "Widgets:     no pushes this app session"
             }
             val mins = uptimeMs / 60_000
+            // Say when a rate is being withheld, and say it in terms of the window it is actually
+            // waiting on. "needs 6m+" would read as a claim about UPTIME, and with sparse pushes the
+            // steady window opens late — twenty minutes in and still withholding would look broken
+            // rather than explained.
+            val span = if (steadyEnough) {
+                "over ${mins}m"
+            } else {
+                "over ${mins}m, steady ${steadyMs / 60_000}m of 5m"
+            }
             val parts = ArrayList<String>(6)
             if (pushesAdmitted > 0L || pushesGated > 0L) {
-                parts.add("$pushesAdmitted pushed / ${pushesAdmitted + pushesGated} offered")
+                // SENT first, because it is the one that means "a widget was updated". `pushesAdmitted`
+                // alone read as that and was not: a push the rendered gate declined is admitted and
+                // never sent.
+                parts.add(
+                    "$pushesSent sent / $pushesAdmitted admitted / " +
+                        "${pushesAdmitted + pushesGated} offered",
+                )
             } else {
                 parts.add("no pushes")
             }
@@ -164,8 +265,9 @@ object WidgetTelemetry {
                 parts.add("draw ${renderMs / renders}ms avg / ${renderMsMax}ms max")
             }
             if (pushesUnchanged > 0) parts.add("$pushesUnchanged unchanged")
+            if (pushesNoWidget > 0) parts.add("$pushesNoWidget with no widget placed")
             if (rendersRedundant > 0) parts.add("$rendersRedundant redundant")
-            return "Widgets:     ${parts.joinToString(" · ")} (over ${mins}m)"
+            return "Widgets:     ${parts.joinToString(" · ")} ($span)"
         }
     }
 }
diff --git a/android/app/src/test/java/com/noop/widget/WidgetTelemetryTest.kt b/android/app/src/test/java/com/noop/widget/WidgetTelemetryTest.kt
index 049fedd5e8..72cefc74a4 100644
--- a/android/app/src/test/java/com/noop/widget/WidgetTelemetryTest.kt
+++ b/android/app/src/test/java/com/noop/widget/WidgetTelemetryTest.kt
@@ -35,27 +35,53 @@ class WidgetTelemetryTest {
         val s = WidgetTelemetry.snapshot(t0 + 60_000L)
         assertEquals(1, s.pushesAdmitted)
         assertEquals(59, s.pushesGated)
-        assertTrue("1 pushed / 60 offered" in s.render())
+        assertTrue(s.render(), "1 sent / 1 admitted / 60 offered" in s.render())
     }
 
-    /** A rate over one minute of uptime is the figure a drain question turns on. */
+    /** The rate is measured over the steady window, one push a minute being the ordinary cadence. */
     @Test
-    fun ratesAreExtrapolatedFromUptime() {
-        repeat(10) { WidgetTelemetry.notePushAdmitted(t0 + it * 60_000L) }
-        repeat(10) { WidgetTelemetry.noteRender(bytes = 512 * 1024, elapsedMs = 4) }
-        val s = WidgetTelemetry.snapshot(t0 + 600_000L)   // 10 minutes
-        assertEquals(60.0, s.pushesPerHour!!, 0.001)      // 10 pushes in 10m = 60/h
+    fun ratesAreExtrapolatedFromTheSteadyWindow() {
+        // One push at t0 opens the warm-up; the rest land a minute apart beyond it.
+        WidgetTelemetry.notePushAdmitted(t0)
+        for (m in 1..10) {
+            WidgetTelemetry.notePushAdmitted(t0 + m * 60_000L)
+            WidgetTelemetry.noteRender(bytes = 512 * 1024, elapsedMs = 4)
+        }
+        val s = WidgetTelemetry.snapshot(t0 + 660_000L)
+        // Steady window opens at the first post-warm-up push (t0+60s) and runs 10 minutes; ten pushes
+        // and ten draws inside it.
+        assertEquals(60.0, s.pushesPerHour!!, 0.001)
         assertEquals(512L, s.meanRenderBytes!! / 1024)
-        // 10 x 512KB in 10 minutes = 30MB/h.
         assertEquals(30.0, s.renderBytesPerHour!! / 1_048_576.0, 0.01)
     }
 
+    /**
+     * The startup burst must not be quoted as a rate. The snapshot's fields arrive one by one at
+     * launch and each is a key change PushGate admits on the spot, so a launch produces pushes the
+     * 60-second clause had nothing to do with. A device reported six pushes in a hundred seconds as
+     * 215/h against a steady state of about sixty — the headline number wrong by three and a half
+     * times, in the situation where it is looked at first.
+     */
+    @Test
+    fun aStartupBurstIsNotQuotedAsARate() {
+        // Six pushes inside the first hundred seconds, as the real capture showed.
+        for (ms in listOf(0L, 2_000L, 5_000L, 9_000L, 30_000L, 95_000L)) {
+            WidgetTelemetry.notePushAdmitted(t0 + ms)
+        }
+        val s = WidgetTelemetry.snapshot(t0 + 100_000L)
+        assertEquals(6, s.pushesAdmitted)
+        assertNull("a burst is not a rate", s.pushesPerHour)
+        val line = s.render()
+        assertTrue(line, "6 sent / 6 admitted" in line)
+        assertTrue("the line must say the rate is withheld: $line", "steady" in line)
+    }
+
     /**
      * A rate computed from a few seconds of uptime is noise wearing a number's clothes, and this line
      * goes in front of someone deciding whether to change the refresh cadence.
      */
     @Test
-    fun noRateIsClaimedUnderAMinuteOfUptime() {
+    fun noRateIsClaimedUnderASteadyWindow() {
         WidgetTelemetry.notePushAdmitted(t0)
         val s = WidgetTelemetry.snapshot(t0 + 5_000L)
         assertNull(s.pushesPerHour)
@@ -169,9 +195,12 @@ class WidgetTelemetryTest {
         val original = Locale.getDefault()
         try {
             Locale.setDefault(Locale.GERMANY)
-            repeat(10) { WidgetTelemetry.notePushAdmitted(t0 + it * 60_000L) }
-            repeat(10) { WidgetTelemetry.noteRender(bytes = 512 * 1024, elapsedMs = 4) }
-            val line = WidgetTelemetry.snapshot(t0 + 600_000L).render()
+            WidgetTelemetry.notePushAdmitted(t0)
+            for (m in 1..10) {
+                WidgetTelemetry.notePushAdmitted(t0 + m * 60_000L)
+                WidgetTelemetry.noteRender(bytes = 512 * 1024, elapsedMs = 4)
+            }
+            val line = WidgetTelemetry.snapshot(t0 + 660_000L).render()
             assertTrue(line, "60.0/h" in line)
             assertTrue(line, "30.0MB/h" in line)
             assertFalse(line, "," in line.substringAfter("Widgets:"))
@@ -213,4 +242,84 @@ class WidgetTelemetryTest {
         // And a small card is where the intent survives best, though still short of the nominal 2x.
         assertTrue("420dpi/300dp should have the most headroom", effective(420f, 300f) > 1.5)
     }
+
+    /**
+     * The withheld-rate message has to name the window it is actually waiting on. Phrasing it as a
+     * minimum UPTIME was wrong: pushes can be sparse enough that the steady window opens late, so the
+     * line would sit twenty minutes in still claiming it needed six, which reads as broken rather than
+     * explained.
+     */
+    @Test
+    fun aWithheldRateNamesTheSteadyWindowNotTheUptime() {
+        WidgetTelemetry.notePushAdmitted(t0)                    // opens warm-up
+        WidgetTelemetry.notePushAdmitted(t0 + 19 * 60_000L)     // opens steady, nineteen minutes in
+        val line = WidgetTelemetry.snapshot(t0 + 20 * 60_000L).render()
+        assertNull(WidgetTelemetry.snapshot(t0 + 20 * 60_000L).pushesPerHour)
+        assertTrue("uptime should read twenty minutes: $line", "over 20m" in line)
+        assertTrue("and the wait should be stated against the steady window: $line",
+            "steady 1m of 5m" in line)
+    }
+
+    /**
+     * The rate has to be blind to nothing except what never reached a widget. A push RenderedGate
+     * declines is admitted and then dropped, so counting it here would have made this figure unable
+     * to fall when the gate fired — and lowering it is the gate's entire purpose. An instrument that
+     * cannot show the effect of the optimisation shipped beside it is measuring the wrong thing.
+     */
+    @Test
+    fun declinedPushesAreNotCountedAsSentOrRated() {
+        WidgetTelemetry.notePushAdmitted(t0)                       // warm-up
+        for (m in 1..10) {
+            WidgetTelemetry.notePushAdmitted(t0 + m * 60_000L)
+            if (m > 5) WidgetTelemetry.notePushUnchanged()          // five of the ten never went out
+        }
+        val s = WidgetTelemetry.snapshot(t0 + 660_000L)
+        assertEquals(11, s.pushesAdmitted)
+        assertEquals(6, s.pushesSent)                              // 11 admitted - 5 declined
+        // Steady window holds ten pushes over ten minutes, five of them declined: five sends an hour
+        // at that cadence would be 30/h, not the 60/h the admitted count alone would have claimed.
+        assertEquals(30.0, s.pushesPerHour!!, 0.001)
+        val line = s.render()
+        assertTrue(line, "6 sent / 11 admitted" in line)
+        assertTrue(line, "5 unchanged" in line)
+    }
+
+    /**
+     * The widget-removed capture is half of the comparison that answers whether the widget costs
+     * anything, so a push with nowhere to go must not read as a send. Left as one, both halves of the
+     * A/B would have shown identical sent counts and rates, and only the draw count would have
+     * differed — which is a much weaker signal than the one the counters are supposed to give.
+     */
+    @Test
+    fun aPushWithNoWidgetPlacedIsNotASend() {
+        WidgetTelemetry.notePushAdmitted(t0)                       // warm-up
+        for (m in 1..10) {
+            WidgetTelemetry.notePushAdmitted(t0 + m * 60_000L)
+            WidgetTelemetry.notePushNoWidget()
+        }
+        val s = WidgetTelemetry.snapshot(t0 + 660_000L)
+        assertEquals(11, s.pushesAdmitted)
+        assertEquals(1, s.pushesSent)                              // only the warm-up push had a widget
+        assertEquals(0.0, s.pushesPerHour!!, 0.001)                // nothing was sent in the window
+        val line = s.render()
+        assertTrue(line, "1 sent / 11 admitted" in line)
+        assertTrue(line, "10 with no widget placed" in line)
+    }
+
+    /**
+     * The two non-send outcomes are different answers and must not be conflated: "nothing new to
+     * show" is the rendered gate doing its job, "nobody to show it to" is the widget being absent.
+     */
+    @Test
+    fun theTwoNonSendOutcomesAreReportedApart() {
+        WidgetTelemetry.notePushAdmitted(t0)
+        for (m in 1..10) WidgetTelemetry.notePushAdmitted(t0 + m * 60_000L)
+        repeat(3) { WidgetTelemetry.notePushUnchanged() }
+        repeat(2) { WidgetTelemetry.notePushNoWidget() }
+        val s = WidgetTelemetry.snapshot(t0 + 660_000L)
+        assertEquals(6, s.pushesSent)                              // 11 - 3 - 2
+        val line = s.render()
+        assertTrue(line, "3 unchanged" in line)
+        assertTrue(line, "2 with no widget placed" in line)
+    }
 }
diff --git a/project.yml b/project.yml
index 5184b43d90..ec70557f5c 100644
--- a/project.yml
+++ b/project.yml
@@ -168,6 +168,9 @@ targets:
       # worth testing lives, and it is iOS/widget-only, so it is compiled into the test bundle rather
       # than added to the macOS app.
       - StrandiOSShared/HrTrace.swift
+      # And the widget cost counters, for the same reason again: pure, iOS-only, and the arithmetic is
+      # exactly the part that has been wrong twice on the Android side.
+      - StrandiOSShared/WidgetTelemetry.swift
     # Same wrapper as the app target, so the OURA_CLOUD_IMPORT-gated Oura tests compile exactly
     # when the app's Oura lane does (flag + creds both come from the untracked OuraSecrets.xcconfig).
     configFiles:

From 7d781501ca83a7ef9461ab5d65745c57220a30b8 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 21:38:24 +1200
Subject: [PATCH 321/333] build: testing build 456 / 337

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 33ab2b838d..c60099ddd7 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 455
+        versionCode = 456
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index ec70557f5c..41e35ae443 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "336"
+    CURRENT_PROJECT_VERSION: "337"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 59f75de23f7a4e8018164fdb7be28c676f214d2d Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Mon, 7 Sep 2026 23:56:43 +1200
Subject: [PATCH 322/333] diagnostics: three lines that told triage the wrong
 thing

The recovery trace was reported MISSING on every capture that had one. The killer
token was "charge score=", but IntelligenceEngine re-emits every recovery line as
`charge day=<day> ` plus the body, so the bare token cannot occur in any report.
Two bundles in hand carry 1020 and 816 of those lines and both said the trace was
absent. The token is now the day prefix, the one part every variant shares, so it
cannot go stale the way a token naming one variant did. Apple had the identical
defect, naming three variants none of which could match.

"Data write: no rows ever persisted" reads as every write and is stamped only
when a backfill session persists rows. On an unbonded 5/MG - which offloads
nothing and streams happily - it said the app had stored nothing from the strap
while a hundred thousand HR rows sat under that very device id. Now "Offload:",
with the exclusion stated outright in the zero case.

And a bundle arrived on an open report with its profile started nine seconds
before the export, carrying no sleep trace at all, while the capture check said
"complete: all active traces present". That is what told the reporter it was
ready to send. The check never looked at how long the profile had run; it does
now, and says what to do rather than naming a fault.

Two edges caught re-reading: a backwards clock made the profile age negative, and
the offload helper was handed an age it never reads when nothing had landed.

The Swift token guard was pinned against the *Trace files, which is how the bug
lasted - RecoveryScorer+Trace really does write "charge term", but the engine
re-emits with a day prefix before anything is logged, so the guard was pointed at
the start of the pipeline and passed while the thing it guarded was dead. Its
fixture carried the same flaw. Both now mirror the report.

The short-profile warning is Android-only: the Swift section reports per-domain
counts rather than a verdict, its renderer takes only the checks, and threading a
duration through it is a signature change worth doing with that section rather
than blind.

Android: full suite 5,592 tests, 664 classes, 0 failures.
---
 .../StrandAnalytics/CaptureCompleteness.swift |   5 +-
 .../CaptureCompletenessTests.swift            |  15 ++-
 Strand/System/DebugDataDiagnostics.swift      |  12 +-
 .../com/noop/testcentre/AndroidDiagnostics.kt |  31 ++++-
 .../com/noop/testcentre/ReportCompleteness.kt |  53 +++++++-
 .../noop/testcentre/TestBundleAssembler.kt    |   6 +-
 .../noop/testcentre/AndroidDiagnosticsTest.kt |  31 +++++
 .../ReportCompletenessContractTest.kt         | 116 +++++++++++++++++-
 8 files changed, 254 insertions(+), 15 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/CaptureCompleteness.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/CaptureCompleteness.swift
index 2f97eb368f..350874cd73 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/CaptureCompleteness.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/CaptureCompleteness.swift
@@ -72,7 +72,10 @@ public enum CaptureCompleteness {
         .dataImport: ["import stage=", "rowsIn="],
         .steps:      ["stepsRaw", "stepsCal"],
         .battery:    ["bank soc=", "socSeries"],
-        .recovery:   ["charge term", "charge score=", "charge nilScore"],
+        // "charge day=" for the same reason as the Kotlin twin: IntelligenceEngine re-emits every
+        // recovery trace line as `charge day=<day> ` + the body, so none of the three variants this
+        // used to name could ever match and the domain reported MISSING on every capture.
+        .recovery:   ["charge day="],
         .hrv:        ["hrv rmssd=", "hrv result=", "hrv nightSummary"],
         .universal:  ["dayOwner ", "strapClock "],
     ]
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CaptureCompletenessTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CaptureCompletenessTests.swift
index 51e95f0673..e36aea3eaf 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CaptureCompletenessTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/CaptureCompletenessTests.swift
@@ -19,7 +19,7 @@ final class CaptureCompletenessTests: XCTestCase {
     [import] import stage=sleep rowsIn=10 rowsOut=10
     [steps] stepsRaw day=2026-06-28 counterSamples=4 deltas kept=3 dropped=0
     [battery] bank soc=82.0 t=1700000000s
-    [recovery] charge term hrv z=0.20 w=0.40 (higher HRV is better)
+    [recovery] charge day=2026-06-28 term hrv z=0.20 w=0.40 (higher HRV is better)
     [hrv] hrv rmssd=42.10ms sdnn=55.00ms meanNN=900.00ms
     [universal] dayOwner day=2026-06-28 readId=my-whoop writeActiveId=my-whoop hrRows=120 provenance=measured
     """
@@ -126,9 +126,16 @@ final class CaptureCompletenessTests: XCTestCase {
     }
 
     func testTokenMapMatchesEmitterTokensExactly() {
-        // Guard against a silent emitter rename: each token must be the verbatim leading text the live
-        // emitter writes. These literals mirror the *Trace files (verified at authoring time).
-        XCTAssertEqual(CaptureCompleteness.expectedTokens(for: .recovery).first, "charge term")
+        // Guard against a silent emitter rename: each token must be the verbatim leading text that
+        // reaches the REPORT.
+        //
+        // "mirror the *Trace files" is how the recovery token came to be wrong for as long as it was.
+        // RecoveryScorer+Trace really does write "charge term ...", but IntelligenceEngine re-emits
+        // every one of those lines as `charge day=<day> ` + the body before it is logged, so the
+        // literal this guard was protecting could not occur in a single report. A token has to mirror
+        // the END of the pipeline, not the start, or a guard like this passes while the thing it
+        // guards is dead.
+        XCTAssertEqual(CaptureCompleteness.expectedTokens(for: .recovery).first, "charge day=")
         XCTAssertTrue(CaptureCompleteness.expectedTokens(for: .hrv).contains("hrv rmssd="))
         XCTAssertTrue(CaptureCompleteness.expectedTokens(for: .steps).contains("stepsRaw"))
         XCTAssertTrue(CaptureCompleteness.expectedTokens(for: .universal).contains("dayOwner "))
diff --git a/Strand/System/DebugDataDiagnostics.swift b/Strand/System/DebugDataDiagnostics.swift
index 5beb065b7f..87dd6bcfeb 100644
--- a/Strand/System/DebugDataDiagnostics.swift
+++ b/Strand/System/DebugDataDiagnostics.swift
@@ -36,7 +36,7 @@ enum DebugDataDiagnostics {
     /// strap simply not worn for two days would be reported as incapable of motion — the opposite kind of
     /// wrong from the one this line exists to prevent. Over a window of actual wear, delivered and capable
     /// are the same thing; the label keeps that assumption visible instead of implied.
-    /// The label is padded to 13 like every other in this block ("Model:", "Data write:"), and the window
+    /// The label is padded to 13 like every other in this block ("Model:", "Offload:"), and the window
     /// rides the VALUE. "Provides(48h):" is 15 and overhung the column in a report that is aligned by hand
     /// and read by eye.
     /// Byte-identical to the Kotlin `AndroidDiagnostics.strapProvidesLine`.
@@ -85,7 +85,13 @@ enum DebugDataDiagnostics {
         let okAt = d.double(forKey: "sync.lastWriteOkAt")
         let stalledAt = d.double(forKey: "sync.lastWriteStalledAt")
         let restoreAt = d.double(forKey: "backup.lastRestoreAt")
-        lines.append("Data write:  \(okAt > 0 ? "rows last landed \(relTime(now - okAt))" : "no rows ever persisted")")
+        // "Offload:", not "Data write:". The stamp is written ONLY when a backfill session persists
+        // rows, so it says nothing about live streaming, and the old label read as "this app has stored
+        // nothing from your strap" on a strap that offloads nothing but streams happily. Twin of the
+        // Kotlin change.
+        lines.append("Offload:     " + (okAt > 0
+            ? "rows last landed \(relTime(now - okAt))"
+            : "no history rows ever persisted (live HR/R-R are not counted here)"))
         if stalledAt > 0, stalledAt >= okAt {
             lines.append("             ⚠ history NOT persisting — last offload STALLED \(relTime(now - stalledAt)) "
                 + "(if you restored a backup, fully restart the app — #57)")
@@ -140,7 +146,7 @@ enum DebugDataDiagnostics {
         // EXISTS seeks, not counts — see WhoopStore.streamPresence for why that distinction matters on a
         // table holding ~190k motion rows a night.
         //
-        // HERE and not in strapStateLines() beside `Data write:`, where it belongs by subject: that
+        // HERE and not in strapStateLines() beside `Offload:`, where it belongs by subject: that
         // function is synchronous and holds neither `repo` nor a store handle. The first attempt put it
         // there and would not have compiled — in a file the comment below already notes needs macOS to
         // build, which is exactly why it went unnoticed locally. Appended first so the output order is
diff --git a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
index b205c2f044..3035e2f82e 100644
--- a/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
+++ b/android/app/src/main/java/com/noop/testcentre/AndroidDiagnostics.kt
@@ -54,6 +54,25 @@ object AndroidDiagnostics {
             ?.let { runCatching { com.noop.ble.WhoopModel.valueOf(it) }.getOrNull() }
     }
 
+    /**
+     * The history-offload write-health line.
+     *
+     * "Offload:", not "Data write:". The stamp behind it is written ONLY when a backfill session
+     * persists rows, so it says nothing about live streaming - and on a strap that offloads nothing but
+     * streams happily (an unbonded 5/MG, the designed end state of #1635) the old label read as "this
+     * app has stored nothing from your strap" while a hundred thousand HR rows sat under that very
+     * device id. The scope now lives in the label, and the zero case says outright what it excludes.
+     *
+     * Pure and extracted for the same reason [strapProvidesLine] is: [summaryLines] needs a real
+     * Context, and the wording is the part a change would silently break.
+     */
+    internal fun offloadLine(okAtSec: Long, ageMs: Long): String =
+        "Offload:     " + if (okAtSec > 0L) {
+            "rows last landed ${relTime(ageMs)}"
+        } else {
+            "no history rows ever persisted (live HR/R-R are not counted here)"
+        }
+
     /**
      * What the active strap actually delivered over the window — the line that says which scores can
      * exist at all.
@@ -68,7 +87,7 @@ object AndroidDiagnostics {
      * strap simply not worn for two days would be reported as incapable of motion — the opposite kind of
      * wrong from the one this line exists to prevent. Over a window of actual wear, delivered and capable
      * are the same thing; the label keeps that assumption visible instead of implied.
-     * The label is padded to 13 like every other in this block ("Model:", "Data write:"), and the window
+     * The label is padded to 13 like every other in this block ("Model:", "Offload:"), and the window
      * rides the VALUE. "Provides(48h):" is 15 and overhung the column in a report that is aligned by hand
      * and read by eye.
      * Pure so it is unit-tested directly; byte-identical to the Swift twin.
@@ -144,7 +163,15 @@ object AndroidDiagnostics {
             ) ?: 0L
             val restoreAt = p.getLong("backup.lastRestoreAt", 0L)
             val now = System.currentTimeMillis()
-            add("Data write:  ${if (okAt > 0L) "rows last landed ${relTime(now - okAt * 1000L)}" else "no rows ever persisted"}")
+            // "Offload:", not "Data write:". The stamp behind it is written ONLY when a backfill session
+            // persists rows, so it says nothing about live streaming - and on a strap that offloads
+            // nothing but streams happily (an unbonded 5/MG, the designed end state of #1635) the old
+            // label read as "this app has stored nothing from your strap" while a hundred thousand HR
+            // rows sat under that very device id. The scope now lives in the label, and the zero case
+            // says outright what it does not cover.
+            // Age only means anything when something landed; pass 0 otherwise rather than `now`, which
+            // would be a 56-year "age" sitting unused in an argument a reader has to check is unused.
+            add(offloadLine(okAt, if (okAt > 0L) now - okAt * 1000L else 0L))
             if (stalledAt > 0L && stalledAt >= okAt) {
                 add("             ⚠ history NOT persisting — last offload STALLED ${relTime(now - stalledAt * 1000L)} " +
                     "(if you restored a backup, fully restart the app — #57)")
diff --git a/android/app/src/main/java/com/noop/testcentre/ReportCompleteness.kt b/android/app/src/main/java/com/noop/testcentre/ReportCompleteness.kt
index 883445a8f7..a64118b3d6 100644
--- a/android/app/src/main/java/com/noop/testcentre/ReportCompleteness.kt
+++ b/android/app/src/main/java/com/noop/testcentre/ReportCompleteness.kt
@@ -49,7 +49,13 @@ object ReportCompleteness {
         TestDomain.IMPORT to "import parser=",
         TestDomain.STEPS to "stepsEst ",
         TestDomain.BATTERY to "battery series=",
-        TestDomain.RECOVERY to "charge score=",
+        // "charge day=", not "charge score=". Every recovery trace line is re-emitted by
+        // IntelligenceEngine.recoveryTraceLines as `charge day=<day> ` + the body, so the bare
+        // "charge score=" this used to look for CANNOT occur and the domain reported MISSING on every
+        // capture that had a perfectly healthy trace. The day prefix is also the one part shared by
+        // every variant the trace emits - score, nilScore and each term - so it cannot go stale the
+        // way a token naming one variant did.
+        TestDomain.RECOVERY to "charge day=",
         TestDomain.HRV to "hrv rmssd=",
     )
 
@@ -129,6 +135,21 @@ object ReportCompleteness {
         return out
     }
 
+    /**
+     * How long a profile must have been running before "complete" means anything.
+     *
+     * A trace only records while its profile is on, so a capture started seconds before the export
+     * contains none of the passes it is meant to evidence. That is not hypothetical: a sleep bundle
+     * arrived with its profile started NINE SECONDS before the export, carrying no `[sleep]` lines at
+     * all, and this section still said "complete: all active traces present" - which is exactly what
+     * told the reporter it was ready to send, and cost a full round trip to discover.
+     *
+     * Two minutes, because the thing most captures need to contain is a scoring pass, and one takes
+     * about forty seconds on a large library. Short enough not to nag, long enough that a capture
+     * clearing it plausibly holds one.
+     */
+    const val MIN_PROFILE_SECONDS = 120L
+
     /**
      * The "Capture check" section appended to report.txt: a header, then one line per checked domain in
      * deterministic order, then a footer flag when any active domain's trace is MISSING (the at-a-glance
@@ -137,8 +158,16 @@ object ReportCompleteness {
      * `(<killer>)`, an evidence-only match (#127) reads `(via <evidence>)`, and MISSING reads
      * `(expected <killer>)` — the Swift renderer's "expected …" wording for the missing case. Returns
      * the section WITHOUT a leading newline; the assembler joins it.
+     *
+     * @param profileRanSeconds how long the profile had been running when the bundle was assembled,
+     *   or null when that is unknown. Null is treated as "cannot judge" and says nothing, because
+     *   inventing a warning from a missing timestamp would be its own false signal.
      */
-    fun captureCheckSection(reportText: String, active: Set<TestDomain>): String {
+    fun captureCheckSection(
+        reportText: String,
+        active: Set<TestDomain>,
+        profileRanSeconds: Long? = null,
+    ): String {
         val statuses = statuses(reportText, active)
         val sb = StringBuilder()
         sb.append("=== Capture check ===")
@@ -171,12 +200,30 @@ object ReportCompleteness {
         } else {
             sb.append("INCOMPLETE: missing ").append(missingActive.joinToString(", "))
         }
+        // A short profile is reported WHATEVER the trace verdict was, and deliberately after it: a
+        // capture can hold every token it needs and still be too young to hold the pass that explains
+        // the bug, and a reader who has just been told "complete" is precisely the one who needs to
+        // know that. Phrased as what to do, not as a fault.
+        // `in 0 until MIN`, not `< MIN`: a clock moved backwards between starting the profile and
+        // exporting yields a NEGATIVE age, and "the profile ran -412s before this export" is a worse
+        // line than saying nothing. A nonsense age is unknown, and unknown says nothing.
+        if (profileRanSeconds != null && profileRanSeconds in 0 until MIN_PROFILE_SECONDS) {
+            sb.append("\nTOO SHORT: the profile ran ").append(profileRanSeconds)
+                .append("s before this export. Traces only record while the profile is on, so a scoring")
+                .append(" pass may not have happened yet. Leave it running a couple of minutes, then")
+                .append(" export again.")
+        }
         return sb.toString()
     }
 
     /** The meta.json `capture_check` value: a {domainId -> "present"|"MISSING"} map plus the `complete`
      *  flag, for the machine-readable tie. Keys are the wire ids; emitted in sorted order by TestBundleMeta
-     *  so the JSON bytes line up with the Swift twin. */
+     *  so the JSON bytes line up with the Swift twin.
+     *
+     *  `complete` means TRACES PRESENT and nothing more, so it can read true on a capture whose section
+     *  carries the short-profile note. That is deliberate rather than an oversight: widening the flag
+     *  would change what every existing consumer thinks it asks. The duration a machine reader needs is
+     *  already in the meta beside this, as `profile_started_at`. */
     fun captureCheckMeta(reportText: String, active: Set<TestDomain>): CaptureCheckMeta {
         val statuses = statuses(reportText, active)
         val map = LinkedHashMap<String, String>()
diff --git a/android/app/src/main/java/com/noop/testcentre/TestBundleAssembler.kt b/android/app/src/main/java/com/noop/testcentre/TestBundleAssembler.kt
index 7460c372eb..2088e055c2 100644
--- a/android/app/src/main/java/com/noop/testcentre/TestBundleAssembler.kt
+++ b/android/app/src/main/java/com/noop/testcentre/TestBundleAssembler.kt
@@ -116,7 +116,11 @@ object TestBundleAssembler {
         // domain, whether its killer trace landed. Computed over the header+body that will ship (the guard
         // reads exactly what the maintainer reads). Byte-identical section to the Swift twin.
         val reportBody = header + "\n" + body
-        val captureCheck = ReportCompleteness.captureCheckSection(reportBody, activeDomains)
+        // The profile's age is part of whether this capture can be believed, so it is computed BEFORE
+        // the section rather than only stamped into meta.json where nobody reading report.txt sees it.
+        val ranSeconds = tc.startedAt(profile)?.let { (System.currentTimeMillis() / 1000L) - it }
+        val captureCheck =
+            ReportCompleteness.captureCheckSection(reportBody, activeDomains, ranSeconds)
         val reportText = reportBody + "\n" + captureCheck
         val entries = ArrayList<Pair<String, ByteArray>>()
         entries.add("report.txt" to reportText.toByteArray())
diff --git a/android/app/src/test/java/com/noop/testcentre/AndroidDiagnosticsTest.kt b/android/app/src/test/java/com/noop/testcentre/AndroidDiagnosticsTest.kt
index 0f385086c3..1141c9739b 100644
--- a/android/app/src/test/java/com/noop/testcentre/AndroidDiagnosticsTest.kt
+++ b/android/app/src/test/java/com/noop/testcentre/AndroidDiagnosticsTest.kt
@@ -1,6 +1,7 @@
 package com.noop.testcentre
 
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Test
 
@@ -31,4 +32,34 @@ class AndroidDiagnosticsTest {
         assertTrue(AndroidDiagnostics.oemKillHeuristic("XIAOMI").startsWith("aggressive vendor"))
         assertTrue(AndroidDiagnostics.oemKillHeuristic("xiaomi").startsWith("aggressive vendor"))
     }
+
+    /**
+     * The write-health line is stamped ONLY when a backfill session persists rows, so it says nothing
+     * about live streaming. Labelled "Data write:" it read as "this app has stored nothing from your
+     * strap" on an unbonded 5/MG that offloads nothing but streams happily, while a hundred thousand
+     * HR rows sat under that very device id. The scope has to be in the words.
+     */
+    @Test
+    fun theOffloadLineNamesItsScopeInsteadOfReadingAsEveryWrite() {
+        val never = AndroidDiagnostics.offloadLine(okAtSec = 0L, ageMs = 0L)
+        assertTrue(never, never.startsWith("Offload:"))
+        assertTrue(never, never.contains("no history rows ever persisted"))
+        assertTrue("the zero case must say what it does NOT cover: $never",
+            never.contains("live HR/R-R are not counted here"))
+    }
+
+    /** With rows landed it reports when, and drops the disclaimer it no longer needs. */
+    @Test
+    fun theOffloadLineReportsTheLandingWhenThereIsOne() {
+        val landed = AndroidDiagnostics.offloadLine(okAtSec = 1_700_000_000L, ageMs = 3 * 3_600_000L)
+        assertTrue(landed, landed.startsWith("Offload:"))
+        assertTrue(landed, landed.contains("rows last landed"))
+        assertFalse(landed, landed.contains("not counted here"))
+    }
+
+    /** The label is padded to 13 like every other in this block, so the values stay in one column. */
+    @Test
+    fun theOffloadLabelKeepsTheColumn() {
+        assertEquals(13, AndroidDiagnostics.offloadLine(0L, 0L).indexOf("no history"))
+    }
 }
diff --git a/android/app/src/test/java/com/noop/testcentre/ReportCompletenessContractTest.kt b/android/app/src/test/java/com/noop/testcentre/ReportCompletenessContractTest.kt
index 432527da1b..347f369255 100644
--- a/android/app/src/test/java/com/noop/testcentre/ReportCompletenessContractTest.kt
+++ b/android/app/src/test/java/com/noop/testcentre/ReportCompletenessContractTest.kt
@@ -34,7 +34,9 @@ class ReportCompletenessContractTest {
         assertEquals("import parser=", ReportCompleteness.killerTokens[TestDomain.IMPORT])
         assertEquals("stepsEst ", ReportCompleteness.killerTokens[TestDomain.STEPS])
         assertEquals("battery series=", ReportCompleteness.killerTokens[TestDomain.BATTERY])
-        assertEquals("charge score=", ReportCompleteness.killerTokens[TestDomain.RECOVERY])
+        // "charge day=", not "charge score=": the engine re-emits every recovery trace line with a day
+        // prefix, so the old token could never match and this domain read MISSING on every capture.
+        assertEquals("charge day=", ReportCompleteness.killerTokens[TestDomain.RECOVERY])
         assertEquals("hrv rmssd=", ReportCompleteness.killerTokens[TestDomain.HRV])
         assertEquals(10, ReportCompleteness.killerTokens.size)
         // No Phase-3 token claims (we never report MISSING for a trace we never promised to emit).
@@ -269,4 +271,116 @@ class ReportCompletenessContractTest {
         val s = ReportCompleteness.statuses(asShipped, active = setOf(TestDomain.CONNECTION))
         assertEquals(ReportCompleteness.Status.PRESENT, s[TestDomain.CONNECTION])
     }
+
+    /**
+     * The recovery token could never match. Every trace line is re-emitted by
+     * `IntelligenceEngine.recoveryTraceLines` as `charge day=<day> ` + the body, so the bare
+     * "charge score=" this used to look for does not occur in any report, and the domain read MISSING
+     * on every capture carrying a perfectly healthy trace. Two real bundles held 1020 and 816 of these.
+     */
+    @Test
+    fun theRecoveryTokenMatchesTheLineTheEngineActuallyEmits() {
+        val real = "[recovery] charge day=2026-08-31 term hrv z=0.58 w=0.55 (higher HRV is better)\n" +
+            "[recovery] charge day=2026-08-31 score=77.12 band=green (logistic k=1.6 z0=-0.2)"
+        assertEquals(
+            ReportCompleteness.Status.PRESENT,
+            ReportCompleteness.statuses(real, setOf(TestDomain.RECOVERY))[TestDomain.RECOVERY],
+        )
+        // The nilScore variant is the same trace running, and must count too.
+        val nilScore = "[recovery] charge day=2026-09-07 nilScore reason=missingInput (hrv/rhr required)"
+        assertEquals(
+            ReportCompleteness.Status.PRESENT,
+            ReportCompleteness.statuses(nilScore, setOf(TestDomain.RECOVERY))[TestDomain.RECOVERY],
+        )
+    }
+
+    /** A report with no recovery trace at all must still read MISSING. */
+    @Test
+    fun theRecoveryTokenStillReportsAGenuinelyAbsentTrace() {
+        assertEquals(
+            ReportCompleteness.Status.MISSING,
+            ReportCompleteness.statuses("nothing here", setOf(TestDomain.RECOVERY))[TestDomain.RECOVERY],
+        )
+    }
+
+    /**
+     * A capture younger than a scoring pass cannot evidence one, whatever its tokens say. A sleep
+     * bundle arrived with a nine-second profile and no `[sleep]` lines at all, and this section told
+     * the reporter it was "complete", which is why they sent it.
+     */
+    @Test
+    fun aProfileTooYoungToHoldAPassSaysSoEvenWhenEveryTokenIsPresent() {
+        val full = "charge day=2026-09-07 score=1"
+        val short = ReportCompleteness.captureCheckSection(
+            full, setOf(TestDomain.RECOVERY), profileRanSeconds = 9,
+        )
+        assertTrue(short, short.contains("complete: all active traces present"))
+        assertTrue(short, short.contains("TOO SHORT"))
+        assertTrue(short, short.contains("9s"))
+    }
+
+    /**
+     * The short-profile note goes AFTER the verdict, deliberately.
+     *
+     * Three tests above assert the section ENDS with the verdict line, and that invariant now holds
+     * only while no duration is passed. Keeping the note last is the right trade: it is the line that
+     * invalidates the verdict a reader has just been given, so burying it above would put the weaker
+     * statement in the more prominent place. Pinned here so the change of shape is a decision on the
+     * record rather than something a future endsWith assertion discovers.
+     */
+    @Test
+    fun theShortProfileNoteFollowsTheVerdictRatherThanReplacingIt() {
+        val line = ReportCompleteness.captureCheckSection(
+            "charge day=2026-09-07 score=1", setOf(TestDomain.RECOVERY), profileRanSeconds = 9,
+        )
+        val verdict = line.indexOf("complete: all active traces present")
+        val note = line.indexOf("TOO SHORT")
+        assertTrue(line, verdict in 0 until note)
+        assertTrue("the note is the footer when it fires", line.trimEnd().endsWith("export again."))
+    }
+
+    /** Past the threshold it says nothing extra. */
+    @Test
+    fun aLongEnoughProfileAddsNoWarning() {
+        val ok = ReportCompleteness.captureCheckSection(
+            "charge day=2026-09-07 score=1", setOf(TestDomain.RECOVERY), 600,
+        )
+        assertFalse(ok, ok.contains("TOO SHORT"))
+    }
+
+    /**
+     * An unknown start time must not manufacture a warning: guessing from a missing timestamp would be
+     * its own false signal, and this section exists to stop those.
+     */
+    @Test
+    fun anUnknownProfileAgeSaysNothing() {
+        val unknown = ReportCompleteness.captureCheckSection(
+            "charge day=2026-09-07 score=1", setOf(TestDomain.RECOVERY), null,
+        )
+        assertFalse(unknown, unknown.contains("TOO SHORT"))
+    }
+
+    /**
+     * A clock moved backwards between starting the profile and exporting yields a negative age, and
+     * "the profile ran -412s before this export" is a worse line than saying nothing. A nonsense age
+     * is unknown, and unknown says nothing.
+     */
+    @Test
+    fun aNegativeProfileAgeSaysNothingRatherThanPrintingNonsense() {
+        val line = ReportCompleteness.captureCheckSection(
+            "charge day=2026-09-07 score=1", setOf(TestDomain.RECOVERY), profileRanSeconds = -412,
+        )
+        assertFalse(line, line.contains("TOO SHORT"))
+        assertFalse(line, line.contains("-412"))
+    }
+
+    /** Exactly at the threshold is long enough; the warning is for what falls short of it. */
+    @Test
+    fun theThresholdItselfIsLongEnough() {
+        val line = ReportCompleteness.captureCheckSection(
+            "charge day=2026-09-07 score=1", setOf(TestDomain.RECOVERY),
+            ReportCompleteness.MIN_PROFILE_SECONDS,
+        )
+        assertFalse(line, line.contains("TOO SHORT"))
+    }
 }

From 207fe581e18f25cd52ae9e86f3cf6ef398c1d09f Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 8 Sep 2026 00:04:32 +1200
Subject: [PATCH 323/333] sleep: the night label counted from the newest
 record, not from today

The Sleep hero titled its newest night "Last night" however old that night was.
Both platforms measured the calendar distance from the newest RECORDED night, so
at offset 0 the shown night and the reference were the same night and the answer
was always zero.

In the field that meant a reporter whose newest night was Saturday opened the app
on Monday and saw "Last night" printed directly above "Sat 5 Sep" in accent
colour: two adjacent labels contradicting each other. They read it as bad
processing, and it sent the investigation into the sleep stager. The stager
question is real and still open. This line was simply naming the wrong night, and
the date beside it was right all along.

Now counted from today, and only TODAY is rolled to the logical day. The shown
night keeps the calendar wake-date the carousel groups by, because rolling that
side too let two distinct entries collapse onto one label: a night ending 07:00
and the next ending 02:00 are separate entries but the same logical day. Rolling
only today is the half that matters, since at 02:00 the night that ended
yesterday morning is still "Last night".

A NEGATIVE distance is normal here rather than the clock-skew guard it resembles:
between waking before 04:00 and the roll, the night's calendar date is already
tomorrow relative to the logical day, and falling back to the offset is the right
answer. That branch carries a real case and is named so a later tightening cannot
break it silently.

The Swift logic moves to StrandAnalytics as SleepNightLabel, taking wake
timestamps rather than sessions. It had lived private inside the view with no
tests, which is why this defect went uncaught on that platform; this package's
tests run in ordinary CI while the app-target bundle only runs on demand. The
relative WORDING deliberately stays in the view, because it returns a
LocalizedStringKey and moving those literals would drop them from the catalogue.

The fixed 04:00 stays, deliberately. WHOOP anchors its Physiological Cycle to
sleep and wake rather than to a clock, which is the better model, but a
wake-anchored day needs to know when you woke - and the report behind this is a
case where staging produced nothing for two nights running, so there would have
been no anchor at all. Worth its own issue.

Three existing Kotlin tests are repinned rather than deleted: each now states what
day it is, because a count measured from today would otherwise assert against the
machine's clock.

Android: 5,587 tests, 664 classes, 0 failures. Swift: SleepNightLabelTests runs in
test (StrandAnalytics).
---
 .../StrandAnalytics/SleepNightLabel.swift     |  52 ++++++++
 .../SleepNightLabelTests.swift                |  94 +++++++++++++++
 Strand/Screens/SleepView.swift                |  35 +++---
 .../main/java/com/noop/ui/SleepHeroLogic.kt   |  29 ++++-
 .../java/com/noop/ui/SleepHeroLogicTest.kt    | 114 ++++++++++++++++--
 5 files changed, 295 insertions(+), 29 deletions(-)
 create mode 100644 Packages/StrandAnalytics/Sources/StrandAnalytics/SleepNightLabel.swift
 create mode 100644 Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepNightLabelTests.swift

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepNightLabel.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepNightLabel.swift
new file mode 100644
index 0000000000..48b675d9b3
--- /dev/null
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepNightLabel.swift
@@ -0,0 +1,52 @@
+import Foundation
+
+/// How the Sleep hero names the night it is showing.
+///
+/// Extracted from `SleepView` so it can be tested. The Kotlin twin has lived in `SleepHeroLogic.kt`
+/// as a pure function with its own suite from the start; the Swift side kept it private inside the
+/// view, which is why a defect here went uncaught on this platform until a report arrived. This
+/// package's tests run in ordinary CI, unlike the app-target bundle, so the logic is verified on
+/// every change rather than only when the on-demand app build is dispatched.
+///
+/// Only the arithmetic lives here. The WORDING deliberately stays in the view: it returns a
+/// `LocalizedStringKey`, so the literals have to remain in source for extraction, and pulling them
+/// into a `String` helper here would quietly drop them out of the catalogue. The Kotlin twin can share
+/// both halves because Android localises through resource ids instead.
+///
+/// Kotlin twin: `calendarNightsAgo`.
+public enum SleepNightLabel {
+
+    /// How many nights back the carousel entry at `offset` is FROM TODAY.
+    ///
+    /// Measured from today, not from the newest recorded night. Anchoring on the newest record made
+    /// offset 0 always land on zero, so the hero read "Last night" over a night that could be days
+    /// old, printed directly above the correct date: two adjacent labels contradicting each other.
+    ///
+    /// `wakeTimestamps` is newest-first, one per carousel entry, each the entry's wake instant. It is
+    /// timestamps rather than sessions so this stays free of view types, and OPTIONAL so an entry with
+    /// no session falls back to the offset instead of being read as 1970.
+    ///
+    /// `today` must be the LOGICAL day (the 04:00 roll), and the wake instants must NOT be rolled.
+    /// The carousel groups nights by their calendar wake-date, so rolling that side too would let two
+    /// distinct entries collapse onto one label: a night ending 07:00 and the next ending 02:00 are
+    /// separate entries but the same logical day. Rolling only today is the half that matters, because
+    /// at 02:00 the night that ended yesterday morning is still "Last night".
+    ///
+    /// A NEGATIVE distance is normal, not a clock-skew guard: between waking before 04:00 and the
+    /// roll, the night's calendar date is already tomorrow relative to the logical day. Falling back
+    /// to the offset is the right answer there, so that branch carries a real case and must not be
+    /// narrowed to an error path.
+    public static func nightsAgo(
+        wakeTimestamps: [Int?],
+        offset: Int,
+        today: Date,
+        calendar: Calendar = .current
+    ) -> Int {
+        guard offset >= 0, offset < wakeTimestamps.count,
+              let shownTs = wakeTimestamps[offset] else { return offset }
+        let shown = calendar.startOfDay(for: Date(timeIntervalSince1970: TimeInterval(shownTs)))
+        let todayStart = calendar.startOfDay(for: today)
+        let d = calendar.dateComponents([.day], from: shown, to: todayStart).day ?? offset
+        return d >= 0 ? d : offset
+    }
+}
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepNightLabelTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepNightLabelTests.swift
new file mode 100644
index 0000000000..41ffb46410
--- /dev/null
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepNightLabelTests.swift
@@ -0,0 +1,94 @@
+import XCTest
+@testable import StrandAnalytics
+
+/// Swift twin of `SleepHeroLogicTest`. The Kotlin side has had these since the logic was written; the
+/// Swift side had none, because the function lived private inside the view — which is why the defect
+/// below went uncaught on this platform until a report arrived.
+final class SleepNightLabelTests: XCTestCase {
+
+    private var utc: Calendar = {
+        var c = Calendar(identifier: .gregorian)
+        c.timeZone = TimeZone(identifier: "UTC")!
+        return c
+    }()
+
+    /// A wake at `hour` on the given day, as an epoch second.
+    private func wake(_ y: Int, _ m: Int, _ d: Int, _ hour: Int = 7) -> Int {
+        var c = DateComponents()
+        c.year = y; c.month = m; c.day = d; c.hour = hour
+        return Int(utc.date(from: c)!.timeIntervalSince1970)
+    }
+
+    private func day(_ y: Int, _ m: Int, _ d: Int, _ hour: Int = 12) -> Date {
+        var c = DateComponents()
+        c.year = y; c.month = m; c.day = d; c.hour = hour
+        return utc.date(from: c)!
+    }
+
+    /// The bug. Measured from the newest RECORDED night, offset 0 was always zero, so the hero read
+    /// "Last night" over a night days old — beside the correct date, contradicting it.
+    func testAStaleNewestNightIsNotCalledLastNight() {
+        let n = SleepNightLabel.nightsAgo(
+            wakeTimestamps: [wake(2026, 9, 5)] as [Int?], offset: 0,
+            today: day(2026, 9, 7), calendar: utc)
+        XCTAssertEqual(n, 2)
+    }
+
+    func testTheNightThatEndedThisMorningIsStillLastNight() {
+        let n = SleepNightLabel.nightsAgo(
+            wakeTimestamps: [wake(2026, 9, 7)] as [Int?], offset: 0,
+            today: day(2026, 9, 7), calendar: utc)
+        XCTAssertEqual(n, 0)
+    }
+
+    /// Calendar distance, not carousel index: a night with no data is skipped by the carousel, so
+    /// labelling by index would make the nights either side of it read as consecutive.
+    func testCountsCalendarNightsNotCarouselIndex() {
+        let nights: [Int?] = [wake(2026, 8, 13), wake(2026, 8, 10)]
+        XCTAssertEqual(SleepNightLabel.nightsAgo(wakeTimestamps: nights, offset: 0,
+                                                 today: day(2026, 8, 13), calendar: utc), 0)
+        XCTAssertEqual(SleepNightLabel.nightsAgo(wakeTimestamps: nights, offset: 1,
+                                                 today: day(2026, 8, 13), calendar: utc), 3)
+    }
+
+    /// Only TODAY is rolled; the shown night keeps its calendar wake-date, because that is what the
+    /// carousel groups by. Rolling both sides collapsed two distinct entries onto one label.
+    func testTwoNightsEitherSideOfTheRollKeepDistinctLabels() {
+        let nights: [Int?] = [wake(2026, 9, 7, 2), wake(2026, 9, 6, 7)]
+        XCTAssertEqual(SleepNightLabel.nightsAgo(wakeTimestamps: nights, offset: 0,
+                                                 today: day(2026, 9, 7), calendar: utc), 0)
+        XCTAssertEqual(SleepNightLabel.nightsAgo(wakeTimestamps: nights, offset: 1,
+                                                 today: day(2026, 9, 7), calendar: utc), 1)
+    }
+
+    /// The pre-roll window, which lands on the NEGATIVE branch and gets the right answer from what
+    /// reads like an error fallback. Wake at 02:00, check at 03:00: the night's calendar date is the
+    /// 7th while the logical day is still the 6th, so the distance is -1 and offset 0 is genuinely
+    /// "Last night". Pinned so a later tightening of that branch cannot break it silently.
+    func testANightWokenBeforeTheRollStillReadsLastNight() {
+        let n = SleepNightLabel.nightsAgo(
+            wakeTimestamps: [wake(2026, 9, 7, 2)] as [Int?], offset: 0,
+            today: day(2026, 9, 6, 23), calendar: utc)
+        XCTAssertEqual(n, 0)
+    }
+
+    func testOutOfRangeFallsBackToTheIndex() {
+        XCTAssertEqual(SleepNightLabel.nightsAgo(wakeTimestamps: [] as [Int?], offset: 5,
+                                                 today: day(2026, 9, 7), calendar: utc), 5)
+    }
+
+    /// A carousel entry with no session falls back to the offset, exactly as the Kotlin twin does.
+    /// Mapping it to 0 would put the night in 1970 and print roughly twenty thousand nights ago.
+    ///
+    /// The dates are chosen so the fallback is DISTINGUISHABLE: at offset 1 the answer is 1 only
+    /// because the guard fired, since the real night sits fourteen nights back and an unguarded 1970
+    /// would be five figures. A nil at offset 0 against a same-day today would have returned 0 either
+    /// way and proved nothing.
+    func testAnEntryWithNoSessionFallsBackToTheIndex() {
+        let nights: [Int?] = [wake(2026, 9, 6), nil]
+        XCTAssertEqual(SleepNightLabel.nightsAgo(wakeTimestamps: nights, offset: 0,
+                                                 today: day(2026, 9, 20), calendar: utc), 14)
+        XCTAssertEqual(SleepNightLabel.nightsAgo(wakeTimestamps: nights, offset: 1,
+                                                 today: day(2026, 9, 20), calendar: utc), 1)
+    }
+}
diff --git a/Strand/Screens/SleepView.swift b/Strand/Screens/SleepView.swift
index a6e1fbce94..135de4c823 100644
--- a/Strand/Screens/SleepView.swift
+++ b/Strand/Screens/SleepView.swift
@@ -361,22 +361,25 @@ struct SleepView: View {
         return n == 0 ? "Last night" : (n == 1 ? "1 night ago" : "\(n) nights ago")
     }
 
-    /// #1311: how many CALENDAR nights back the carousel night at `offset` is from the newest recorded
-    /// night. The ◀/▶ carousel steps by RECORDED night (`navDays`, newest-first), so a night with no
-    /// data (strap off-body) is a gap the flat index can't see — labelling by index makes two nights
-    /// either side of a skipped night read as consecutive and desyncs the "N nights ago" labels (and the
-    /// Rest value they name). Uses the same local start-of-day `navDays` is grouped by; falls back to the
-    /// raw index if it can't resolve. 0 = last night. Mirrors Android SleepHeroLogic.calendarNightsAgo.
-    private func nightsAgo(_ offset: Int) -> Int {
-        let days = navDays
-        guard offset >= 0, offset < days.count,
-              let newestTs = days.first?.first?.endTs, let shownTs = days[offset].first?.endTs
-        else { return offset }
-        let cal = Calendar.current
-        let shown = cal.startOfDay(for: Date(timeIntervalSince1970: TimeInterval(shownTs)))
-        let newest = cal.startOfDay(for: Date(timeIntervalSince1970: TimeInterval(newestTs)))
-        let d = cal.dateComponents([.day], from: shown, to: newest).day ?? offset
-        return d >= 0 ? d : offset
+    /// #1311: how many nights back the carousel night at `offset` is, counted in CALENDAR nights rather
+    /// than carousel index. The ◀/▶ carousel steps by RECORDED night (`navDays`, newest-first), so a
+    /// night with no data (strap off-body) is a gap the flat index can't see — labelling by index makes
+    /// two nights either side of a skipped night read as consecutive and desyncs the "N nights ago"
+    /// labels (and the Rest value they name).
+    ///
+    /// Counted FROM TODAY, not from the newest recorded night.
+    ///
+    /// Delegates to `SleepNightLabel.nightsAgo`, which is where this logic is tested. It lived inline
+    /// and private here, which is why the newest-anchored defect went uncaught on this platform.
+    /// Kotlin twin: `calendarNightsAgo`.
+    private func nightsAgo(_ offset: Int, now: Date = Date()) -> Int {
+        SleepNightLabel.nightsAgo(
+            // Optional per entry, NOT `?? 0`: a day group with no session must fall back to the offset
+            // the way the Kotlin twin does. Zero would be 1970 and would read as ~20,000 nights ago.
+            wakeTimestamps: navDays.map { $0.first.map { s in Int(s.endTs) } },
+            offset: offset,
+            today: Repository.logicalDay(now)
+        )
     }
 
     /// The night the Rest hero reflects: the ◀/▶-navigated night while browsing (falling back to
diff --git a/android/app/src/main/java/com/noop/ui/SleepHeroLogic.kt b/android/app/src/main/java/com/noop/ui/SleepHeroLogic.kt
index e33fa81a14..e49755ead0 100644
--- a/android/app/src/main/java/com/noop/ui/SleepHeroLogic.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepHeroLogic.kt
@@ -24,24 +24,43 @@ internal fun nightRelativeLabel(offset: Int): String = when (offset) {
 }
 
 /**
- * How many CALENDAR nights back the carousel night at [offset] is from the newest recorded night.
+ * How many nights back the carousel night at [offset] is FROM TODAY.
  * The ◀/▶ carousel steps by RECORDED night ([navDays], newest-first), so a night with no data (strap
  * off-body) is a gap the flat index can't see — labelling by index makes two nights either side of a
  * skipped night read as consecutive and desyncs the "N nights ago" labels (#1311). This restores the
  * true calendar distance from each night's local wake-day (the same key navDays is grouped by), so the
  * label — and the Rest value it names — line up with the night actually shown. Falls back to the raw
- * index if a day can't be read. 0 = last night. Mirrors iOS SleepView.nightsAgo.
+ * index if a day can't be read. 0 = last night.
+ *
+ * Measured from TODAY, not from the newest recorded night. Anchoring on the newest record made offset 0
+ * always land on zero, so the hero read "Last night" over a night that could be days old: a reporter
+ * whose newest night was Saturday saw it titled "Last night" on Monday and read it as bad processing,
+ * which is what sent that investigation into the sleep stager instead of into this label. The stager
+ * question was real and separate; this line was simply lying about which night it was showing.
+ *
+ * [today] is injected for deterministic tests and defaults to the logical day.
  */
 internal fun calendarNightsAgo(
     navDays: List<List<SleepSession>>, offset: Int, zone: java.util.TimeZone,
+    today: java.time.LocalDate = logicalDayNow(zone.toZoneId()),
 ): Int {
     if (offset < 0 || offset >= navDays.size) return offset
-    val newestTs = navDays.firstOrNull()?.firstOrNull()?.endTs ?: return offset
     val shownTs = navDays[offset].firstOrNull()?.endTs ?: return offset
     val z = zone.toZoneId()
+    // The shown night keeps its CALENDAR wake-date, because that is the key navDays groups by
+    // (`localDayString(endTs)`). Rolling this side too would let two distinct carousel entries collapse
+    // onto one label: a night ending 07:00 and the next ending 02:00 are separate groups but the same
+    // logical day, and both would print the same "nights ago".
+    //
+    // Only TODAY is rolled, which is what the small hours need: at 02:00 the night that ended
+    // yesterday morning is still "Last night", because the logical day has not turned over yet.
     val shown = java.time.Instant.ofEpochSecond(shownTs).atZone(z).toLocalDate()
-    val newest = java.time.Instant.ofEpochSecond(newestTs).atZone(z).toLocalDate()
-    val d = java.time.temporal.ChronoUnit.DAYS.between(shown, newest).toInt()
+    val d = java.time.temporal.ChronoUnit.DAYS.between(shown, today).toInt()
+    // A NEGATIVE distance is normal here, not just the clock-skew guard it looks like: between waking
+    // before 04:00 and the roll, the night's calendar date is already tomorrow relative to the logical
+    // day. Wake at 02:00 and check the tab at 03:00 and `shown` is the 7th while `today` is still the
+    // 6th. Falling back to the offset is the RIGHT answer for that (offset 0 is "Last night", which it
+    // is), so this branch carries a real case and must not be narrowed to an error path.
     return if (d >= 0) d else offset
 }
 
diff --git a/android/app/src/test/java/com/noop/ui/SleepHeroLogicTest.kt b/android/app/src/test/java/com/noop/ui/SleepHeroLogicTest.kt
index 30146968b3..091e98945f 100644
--- a/android/app/src/test/java/com/noop/ui/SleepHeroLogicTest.kt
+++ b/android/app/src/test/java/com/noop/ui/SleepHeroLogicTest.kt
@@ -27,9 +27,13 @@ class SleepHeroLogicTest {
         // data, so they aren't in navDays. navDays is newest-first.
         val navDays = nightOn(LocalDate.of(2026, 8, 13)) to nightOn(LocalDate.of(2026, 8, 10))
         val nav = listOf(navDays.first, navDays.second)
-        assertEquals(0, calendarNightsAgo(nav, 0, utc))         // last night
-        assertEquals(3, calendarNightsAgo(nav, 1, utc))         // 3 calendar nights ago, NOT index 1
-        assertEquals("3 nights ago", nightRelativeLabel(calendarNightsAgo(nav, 1, utc)))
+        // Today is the day after the newest night, so the newest night IS last night. Stated rather
+        // than implied: the count is now measured from today, so a test that does not say what day it
+        // is would be asserting against the machine's clock.
+        val today = LocalDate.of(2026, 8, 13)
+        assertEquals(0, calendarNightsAgo(nav, 0, utc, today))   // last night
+        assertEquals(3, calendarNightsAgo(nav, 1, utc, today))   // 3 calendar nights ago, NOT index 1
+        assertEquals("3 nights ago", nightRelativeLabel(calendarNightsAgo(nav, 1, utc, today)))
     }
 
     @Test
@@ -40,15 +44,109 @@ class SleepHeroLogicTest {
             nightOn(LocalDate.of(2026, 8, 12)),
             nightOn(LocalDate.of(2026, 8, 11)),
         )
-        assertEquals(0, calendarNightsAgo(nav, 0, utc))
-        assertEquals(1, calendarNightsAgo(nav, 1, utc))
-        assertEquals(2, calendarNightsAgo(nav, 2, utc))
+        val today = LocalDate.of(2026, 8, 13)
+        assertEquals(0, calendarNightsAgo(nav, 0, utc, today))
+        assertEquals(1, calendarNightsAgo(nav, 1, utc, today))
+        assertEquals(2, calendarNightsAgo(nav, 2, utc, today))
     }
 
     @Test
     fun fallsBackToIndex_whenOutOfRangeOrEmpty() {
         val utc = TimeZone.getTimeZone("UTC")
-        assertEquals(5, calendarNightsAgo(emptyList(), 5, utc))
-        assertEquals(9, calendarNightsAgo(nightOn(LocalDate.of(2026, 8, 13)).let { listOf(it) }, 9, utc))
+        val today = LocalDate.of(2026, 8, 13)
+        assertEquals(5, calendarNightsAgo(emptyList(), 5, utc, today))
+        assertEquals(9, calendarNightsAgo(nightOn(LocalDate.of(2026, 8, 13)).let { listOf(it) }, 9, utc, today))
+    }
+
+    /**
+     * The bug this anchoring exists for. Measured from the newest RECORDED night, offset 0 was always
+     * zero, so the hero read "Last night" over a night that could be days old.
+     *
+     * A reporter whose newest night was Saturday saw it titled "Last night" on Monday, directly above
+     * the correct date in accent colour: two adjacent labels contradicting each other. That is what
+     * read as bad processing and sent the investigation into the sleep stager. The stager question was
+     * real and separate; this line was simply naming the wrong night.
+     */
+    @Test
+    fun aStaleNewestNightIsNotCalledLastNight() {
+        val utc = TimeZone.getTimeZone("UTC")
+        val nav = listOf(nightOn(LocalDate.of(2026, 9, 5)))     // woke Saturday morning
+        val monday = LocalDate.of(2026, 9, 7)
+        assertEquals(2, calendarNightsAgo(nav, 0, utc, monday))
+        assertEquals("2 nights ago", nightRelativeLabel(calendarNightsAgo(nav, 0, utc, monday)))
+    }
+
+    /** A night that genuinely ended this morning still reads "Last night". */
+    @Test
+    fun theNightThatEndedThisMorningIsStillLastNight() {
+        val utc = TimeZone.getTimeZone("UTC")
+        val nav = listOf(nightOn(LocalDate.of(2026, 9, 7)))
+        assertEquals(0, calendarNightsAgo(nav, 0, utc, LocalDate.of(2026, 9, 7)))
+        assertEquals("Last night", nightRelativeLabel(calendarNightsAgo(nav, 0, utc, LocalDate.of(2026, 9, 7))))
+    }
+
+    /**
+     * Only TODAY is rolled to the logical day; the shown night keeps its calendar wake-date, because
+     * that is the key navDays groups by.
+     *
+     * Rolling both sides collapsed distinct carousel entries onto one label: a night ending 07:00 and
+     * the next ending 02:00 are separate groups but the same logical day, so both printed the same
+     * "nights ago". This pins that they stay apart.
+     */
+    @Test
+    fun twoNightsEitherSideOfTheRollKeepDistinctLabels() {
+        val utc = TimeZone.getTimeZone("UTC")
+        fun wakeAt(d: LocalDate, hour: Long) =
+            d.atStartOfDay(ZoneOffset.UTC).plusHours(hour).toEpochSecond()
+        val early = wakeAt(LocalDate.of(2026, 9, 7), 2)     // 02:00 on the 7th
+        val prior = wakeAt(LocalDate.of(2026, 9, 6), 7)     // 07:00 on the 6th
+        val nav = listOf(
+            listOf(SleepSession(deviceId = "d", startTs = early - 5 * 3600, endTs = early)),
+            listOf(SleepSession(deviceId = "d", startTs = prior - 6 * 3600, endTs = prior)),
+        )
+        val today = LocalDate.of(2026, 9, 7)               // mid-morning on the 7th
+        assertEquals(0, calendarNightsAgo(nav, 0, utc, today))
+        assertEquals(1, calendarNightsAgo(nav, 1, utc, today))
+    }
+
+    /**
+     * The small hours are why today is rolled at all: at 02:00 the logical day has not turned over,
+     * so the night that ended yesterday morning is still "Last night" rather than "1 night ago".
+     */
+    @Test
+    fun beforeFourAmYesterdayMorningsNightIsStillLastNight() {
+        val utc = TimeZone.getTimeZone("UTC")
+        val nav = listOf(nightOn(LocalDate.of(2026, 9, 6)))          // woke 07:00 on the 6th
+        // 02:00 on the 7th: logicalDayNow is still the 6th.
+        assertEquals(0, calendarNightsAgo(nav, 0, utc, LocalDate.of(2026, 9, 6)))
+        assertEquals("Last night", nightRelativeLabel(calendarNightsAgo(nav, 0, utc, LocalDate.of(2026, 9, 6))))
+    }
+
+    /** A future-dated night must not produce a negative count; it falls back to the index. */
+    @Test
+    fun aFutureNightFallsBackToTheIndex() {
+        val utc = TimeZone.getTimeZone("UTC")
+        val nav = listOf(nightOn(LocalDate.of(2026, 9, 20)))
+        assertEquals(0, calendarNightsAgo(nav, 0, utc, LocalDate.of(2026, 9, 7)))
+    }
+
+    /**
+     * The pre-roll window, pinned because it currently lands on the NEGATIVE branch and gets the right
+     * answer from what reads like an error fallback.
+     *
+     * Wake at 02:00 and open the tab at 03:00: the night's calendar date is the 7th while the logical
+     * day is still the 6th, so the distance is -1. Offset 0 is genuinely "Last night" there, and the
+     * fallback says so — but nothing distinguished this real case from clock skew, so a later tightening
+     * of that branch would break it silently.
+     */
+    @Test
+    fun aNightWokenBeforeTheRollStillReadsLastNight() {
+        val utc = TimeZone.getTimeZone("UTC")
+        val endTs = LocalDate.of(2026, 9, 7).atStartOfDay(ZoneOffset.UTC).plusHours(2).toEpochSecond()
+        val nav = listOf(listOf(SleepSession(deviceId = "d", startTs = endTs - 5 * 3600, endTs = endTs)))
+        // 03:00 on the 7th: the logical day has not rolled, so it is still the 6th.
+        val logicalToday = LocalDate.of(2026, 9, 6)
+        assertEquals(0, calendarNightsAgo(nav, 0, utc, logicalToday))
+        assertEquals("Last night", nightRelativeLabel(calendarNightsAgo(nav, 0, utc, logicalToday)))
     }
 }

From d2bfb82219beb20e6a586000fb6d194341e8c214 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 8 Sep 2026 00:08:31 +1200
Subject: [PATCH 324/333] build: testing build 457 / 338

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index c60099ddd7..aee753b7d9 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 456
+        versionCode = 457
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 41e35ae443..6efbe651fb 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "337"
+    CURRENT_PROJECT_VERSION: "338"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From e3d799c504222e5d132cac8148d8d7718acb534d Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Mon, 7 Sep 2026 17:42:20 +0530
Subject: [PATCH 325/333] ble: add a timing tell for Apple's unverified bond
 state (#1883)

CoreBluetooth exposes no link-encryption or bond state, so Apple cannot verify
that a CLIENT_HELLO write completion proves an encrypted bond. Android checks the
OS bond state; Apple has nothing to supply for that check, and until now the gap
lived only in a source comment.

A completion faster than one BLE connection interval did not come from the strap.
That is exactly the signature of the false bond in #1635, where a DISABLE_ALARM
completion arriving in 5ms was misread as a hello ack, and it would have been
visible on Apple with this line in place instead of only on Android.

Diagnostic only. The bond still proceeds, the handshake still runs and
encryptedBond is still set, because on Apple there is no alternative source of
truth and refusing to bond would break every strap that genuinely bonds. The line
says only what is unknown.

The threshold is byte-identical to the Android constant (8), pinned by a test so
a future drift fails rather than diverges quietly, and the elapsed time is
captured before the hello window is consumed - read it after and the tell is
always nil.

Apple-only by design. Android's helloAckedWithoutEncryptionLine covers the case
where the OS bond state IS available and disagrees, which is a stronger signal
than a timing heuristic. Two lines for two different amounts of knowledge.

The diff is purely additive against main.

Author: evoveotech
---
 Strand/BLE/BLEManager.swift               | 13 ++++++++
 Strand/BLE/ClientHelloOutcome.swift       | 36 +++++++++++++++++++++++
 StrandTests/ClientHelloOutcomeTests.swift | 34 +++++++++++++++++++++
 3 files changed, 83 insertions(+)

diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index 5c7bb0ae59..c45476d8c8 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -6376,6 +6376,11 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
             // genuinely up keeps its notifications either way.
             let isHelloChar = characteristic.uuid == BLEManager.whoop5CmdWriteChar
             let helloOutstanding = clientHelloWriteAt != nil
+            // #1883: compute the elapsed time BEFORE clearing the window, so the timing tell can use it.
+            // The elapsed time is the whole signal Apple has — CoreBluetooth exposes no bond state, so
+            // a completion faster than one connection interval is the one tell that the callback came
+            // from the local stack rather than the strap (#1635).
+            let helloElapsedMs = clientHelloWriteAt.map { Int(Date().timeIntervalSince($0) * 1000) }
             // Consume the window ONLY for the hello's own completion. A foreign completion that cleared it
             // would make a genuine ack arriving afterwards look unsolicited, costing a real bond.
             //
@@ -6410,6 +6415,14 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                 noteGenuineBond(of: peripheral)   // #52: this strap bonds fine; clears any pin-refusal streak
                 emitConnectionBondState("encryptedBond family=whoop5 (CLIENT_HELLO acked)")
                 log("WHOOP 5/MG: CLIENT_HELLO acked — link established; subscribing notify chars (experimental).")
+                // #1883: Apple has no link-encryption state to verify the bond against. A completion
+                // faster than one connection interval did not come from the strap — that is the
+                // signature of #1635's false bond. Log it as UNVERIFIED without changing behavior,
+                // because on Apple there is no alternative source of truth and refusing to bond would
+                // break every strap that genuinely bonds.
+                if let elapsed = helloElapsedMs, let timingLine = ClientHelloOutcome.unverifiedBondTimingLine(elapsedMs: elapsed) {
+                    log(timingLine)
+                }
             }
             for c in whoop5NotifyCharacteristics where !c.isNotifying || restoreNeedsResubscribe {
                 requestNotify(c, on: peripheral, reason: "post-bond puffin")   // #613: force re-arm on restore
diff --git a/Strand/BLE/ClientHelloOutcome.swift b/Strand/BLE/ClientHelloOutcome.swift
index 326a6a25c7..5018b71075 100644
--- a/Strand/BLE/ClientHelloOutcome.swift
+++ b/Strand/BLE/ClientHelloOutcome.swift
@@ -84,5 +84,41 @@ enum ClientHelloOutcome {
         return "CLIENT_HELLO outcome: completion from \(whereFrom)\(st) with NO hello outstanding — not a bond,"
             + " so the link stays unbonded (#1635)"
     }
+
+    /// The shortest an ATT round trip can plausibly take, in milliseconds.
+    ///
+    /// BLE's minimum connection interval is 7.5ms. A peripheral may answer inside the same connection
+    /// event, so this is not a hard floor and is NOT used to reject anything — it decides only whether
+    /// the log points the reader at the timing. It earns its place from the field distribution, which is
+    /// starkly bimodal: across 41 captures every hello either "completed" in 0, 4, 5 or 7ms, or produced
+    /// no callback at all about 3150ms later. Nothing in between, and 0ms cannot be a round trip at all.
+    ///
+    /// Byte-identical to the Android twin `MIN_PLAUSIBLE_ATT_ROUND_TRIP_MS`.
+    static let minPlausibleAttRoundTripMs = 8
+
+    /// #1883: a timing tell for Apple, where CoreBluetooth exposes no link-encryption state.
+    ///
+    /// On Android, `helloCompletionProvesEncryptedBond(osBonded) = osBonded` — only the OS bond state
+    /// attests encryption. CoreBluetooth exposes no bond state at all, so Apple has nothing to supply
+    /// for that check. The gap is real: a completion that is faster than one connection interval did
+    /// NOT come from the strap, and that is exactly the signature of #1635's false bond — a
+    /// `DISABLE_ALARM` completion misread as a hello ack because it arrived in 5ms.
+    ///
+    /// This line does NOT change any behavior. The bond still proceeds, the handshake still runs, and
+    /// `encryptedBond` is still set — because on Apple there is no alternative source of truth, and
+    /// refusing to bond would break every strap that genuinely bonds. The line only says what is
+    /// UNKNOWN: that the completion was suspiciously fast and the link's encryption state cannot be
+    /// verified on this platform. It is the diagnostic the issue's direction 2 asks for, and it is the
+    /// one that would have made #1635 visible on Apple instead of only on Android.
+    ///
+    /// Pure. No Kotlin twin — this is Apple-only by design (Android has `helloAckedWithoutEncryptionLine`
+    /// for the case where the OS bond state IS available and disagrees).
+    static func unverifiedBondTimingLine(elapsedMs: Int) -> String? {
+        guard elapsedMs < minPlausibleAttRoundTripMs else { return nil }
+        return "CLIENT_HELLO outcome: acked after \(elapsedMs)ms — under one BLE connection interval,"
+            + " so the callback most likely came from the local stack rather than the strap. CoreBluetooth"
+            + " exposes no link-encryption state, so the bond is UNVERIFIED on this platform (#1883, #1635)."
+            + " The handshake proceeds because there is no alternative source of truth on Apple."
+    }
 }
 
diff --git a/StrandTests/ClientHelloOutcomeTests.swift b/StrandTests/ClientHelloOutcomeTests.swift
index fd3459edc4..215b42e2a2 100644
--- a/StrandTests/ClientHelloOutcomeTests.swift
+++ b/StrandTests/ClientHelloOutcomeTests.swift
@@ -68,5 +68,39 @@ final class ClientHelloOutcomeTests: XCTestCase {
         XCTAssertFalse(ClientHelloOutcome.isAck(
             isHelloChar: true, helloOutstanding: true, alreadyBonded: false, isWhoop5: false))
     }
+
+    // MARK: - #1883: Apple bond timing tell
+
+    /// A completion faster than one connection interval did not come from the strap — that is the
+    /// signature of #1635's false bond. The line must name it as UNVERIFIED and reference both issues.
+    func testSuspiciouslyFastCompletionFlagsUnverifiedBond() {
+        let line = ClientHelloOutcome.unverifiedBondTimingLine(elapsedMs: 5)
+        XCTAssertNotNil(line)
+        XCTAssertTrue(line!.contains("acked after 5ms"), line!)
+        XCTAssertTrue(line!.contains("under one BLE connection interval"), line!)
+        XCTAssertTrue(line!.contains("UNVERIFIED"), line!)
+        XCTAssertTrue(line!.contains("#1883"), line!)
+        XCTAssertTrue(line!.contains("#1635"), line!)
+    }
+
+    /// A completion at or above the threshold is plausible and returns nil — no diagnostic line.
+    func testPlausibleCompletionReturnsNil() {
+        XCTAssertNil(ClientHelloOutcome.unverifiedBondTimingLine(elapsedMs: 8))
+        XCTAssertNil(ClientHelloOutcome.unverifiedBondTimingLine(elapsedMs: 120))
+        XCTAssertNil(ClientHelloOutcome.unverifiedBondTimingLine(elapsedMs: 3150))
+    }
+
+    /// The threshold matches the Android twin (MIN_PLAUSIBLE_ATT_ROUND_TRIP_MS = 8).
+    func testThresholdMatchesAndroidTwin() {
+        XCTAssertEqual(ClientHelloOutcome.minPlausibleAttRoundTripMs, 8)
+    }
+
+    /// A 0ms completion is the most suspicious — it cannot be a round trip at all.
+    func testZeroMsCompletionFlagsUnverifiedBond() {
+        let line = ClientHelloOutcome.unverifiedBondTimingLine(elapsedMs: 0)
+        XCTAssertNotNil(line)
+        XCTAssertTrue(line!.contains("acked after 0ms"), line!)
+        XCTAssertTrue(line!.contains("UNVERIFIED"), line!)
+    }
 }
 

From ef70b09e83edae4455484523d084c6bdc27f7c78 Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Mon, 7 Sep 2026 17:56:11 +0530
Subject: [PATCH 326/333] unbonded-offload probe: a local teardown is
 inconclusive, not a strap refusal (#1804)

The probe concluded that a WHOOP 5/MG refuses the offload unbonded and retired
itself permanently. The evidence did not support it: all three attempts ended
with status=22, GATT_CONN_TERMINATE_LOCAL_HOST, so our own stack ended the link.
The probe was counting our teardown as the strap's answer, charging it to the
silence budget, and latching after three.

A local teardown no longer charges the silence budget. Only a strap-side drop
does.

But inconclusive cannot mean unbounded, and that is the harder half. On the strap
this was written for, EVERY attempt was a local teardown, so simply not counting
them would have left the probe re-running on every reconnect forever, on
precisely the device the fix was for, with no path to a conclusion. So a local
teardown charges its own budget with its own larger cap: six against the
silence budget's three, because a silent link at least proved the subscriptions
were accepted while a teardown proved nothing about the strap at all. Weaker
evidence, more of it required, still bounded.

The new budget is persisted per strap, cleared by a genuine answer, and cleared
by toggling the experiment off and on - that last one matters, because the
retirement line tells the user to do exactly that, and clearing only the silence
budget would have made following that advice a dead end.

The retirement line now names which budget ran out. A reader of a capture can
tell "the strap refused", "the strap stayed silent" and "we never managed to ask"
apart, which the original could not.

Six new unit tests over the classification and the inconclusive line.

Author: evoveotech
---
 .../java/com/noop/ble/PuffinExperiment.kt     |  30 ++++
 .../java/com/noop/ble/UnbondedOffloadProbe.kt | 128 +++++++++++++++++-
 .../main/java/com/noop/ble/WhoopBleClient.kt  |  98 ++++++++++----
 .../com/noop/ble/UnbondedOffloadProbeTest.kt  |  96 +++++++++++++
 4 files changed, 320 insertions(+), 32 deletions(-)

diff --git a/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt b/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt
index 8144480562..a52302186e 100644
--- a/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt
+++ b/android/app/src/main/java/com/noop/ble/PuffinExperiment.kt
@@ -163,6 +163,11 @@ class PuffinExperiment(private val prefs: SharedPreferences) {
                 prefs.all.keys
                     .filter { it.startsWith(UNBONDED_PROBE_SILENT_LINKS_KEY_PREFIX) }
                     .forEach { e.remove(it) }
+                // #1804: clear the inconclusive budget too, so re-arming gives the probe a fresh
+                // start on a strap whose every link was torn down locally.
+                prefs.all.keys
+                    .filter { it.startsWith(UNBONDED_PROBE_INCONCLUSIVE_LINKS_KEY_PREFIX) }
+                    .forEach { e.remove(it) }
             }
             e.apply()
         }
@@ -193,6 +198,31 @@ class PuffinExperiment(private val prefs: SharedPreferences) {
         }
     }
 
+    /**
+     * The probe's persisted inconclusive budget for one strap — links that ended in a LOCAL teardown
+     * (status=22), capped by [UNBONDED_PROBE_MAX_INCONCLUSIVE_LINKS].
+     *
+     * #1804: a local teardown is inconclusive about the strap (our own stack ended the link), so it
+     * does NOT charge the silence budget. But it charges THIS budget, so a strap whose every link is
+     * torn down locally does not retry forever. Larger cap than the silence budget because
+     * inconclusive is genuinely weaker evidence than silence.
+     *
+     * Lives HERE for the same reason the silence budget does: the switch's setter clears these by
+     * prefix and can only sweep its own prefs file.
+     */
+    fun unbondedProbeInconclusiveLinks(peripheralId: String?): Int = runCatching {
+        unbondedProbeInconclusiveLinksPrefKey(peripheralId)?.let { prefs.getInt(it, 0) } ?: 0
+    }.getOrDefault(0)
+
+    /** Record the inconclusive budget. A null address is a no-op, as the read is. */
+    fun setUnbondedProbeInconclusiveLinks(peripheralId: String?, value: Int) {
+        runCatching {
+            unbondedProbeInconclusiveLinksPrefKey(peripheralId)?.let {
+                prefs.edit().putInt(it, value).apply()
+            }
+        }
+    }
+
     /** True if the user opted in to "Ask Android to pair" (#1635, default false): NOOP calls
      *  `BluetoothDevice.createBond()` explicitly instead of relying on a write to the encrypted
      *  characteristic to provoke pairing — which the #1639 bond-state trace showed never happens at all.
diff --git a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
index 106690fcd9..fdde88c4f4 100644
--- a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
+++ b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
@@ -51,6 +51,7 @@ internal fun shouldProbeUnbondedOffload(
     alreadyProbedThisLink: Boolean,
     previouslyRefused: Boolean,
     silentLinksSoFar: Int,
+    inconclusiveLinksSoFar: Int = 0,
 ): Boolean {
     if (!isWhoop5) return false
     if (!optedIn) return false
@@ -62,7 +63,7 @@ internal fun shouldProbeUnbondedOffload(
     // eleven weeks. Only the stable no-hello link can answer this question.
     if (helloWrittenThisLink) return false
     if (alreadyProbedThisLink) return false
-    return !unbondedProbeRetired(previouslyRefused, silentLinksSoFar)
+    return !unbondedProbeRetired(previouslyRefused, silentLinksSoFar, inconclusiveLinksSoFar)
 }
 
 /**
@@ -89,6 +90,7 @@ internal fun unbondedProbeSkippedLine(
     alreadyProbedThisLink: Boolean,
     previouslyRefused: Boolean,
     silentLinksSoFar: Int,
+    inconclusiveLinksSoFar: Int = 0,
 ): String? {
     val why = when {
         !isWhoop5 -> "not a WHOOP 5/MG"
@@ -97,9 +99,14 @@ internal fun unbondedProbeSkippedLine(
         helloWrittenThisLink ->
             "a CLIENT_HELLO went out on this link, so a refusal here could not be attributed to the strap"
         alreadyProbedThisLink -> "already probed on this link"
-        unbondedProbeRetired(previouslyRefused, silentLinksSoFar) ->
-            if (previouslyRefused) "retired for this strap: a refusal is latched"
-            else "retired for this strap: the silent-link budget is spent"
+        unbondedProbeRetired(previouslyRefused, silentLinksSoFar, inconclusiveLinksSoFar) ->
+            when {
+                previouslyRefused -> "retired for this strap: a refusal is latched"
+                !unbondedProbeStillWorthAsking(silentLinksSoFar) ->
+                    "retired for this strap: the silent-link budget is spent"
+                else -> "retired for this strap: the inconclusive-link budget is spent (our own stack" +
+                    " tore down every probe link, so the question was never asked of the strap)"
+            }
         else -> return null
     }
     val consequence = if (isWhoop5 && !bonded) {
@@ -130,8 +137,14 @@ internal fun unbondedProbeSkippedLine(
  * all, `didBond=false` and `Backfill: deferred` nine times across sixteen hours. The strap could neither
  * bond nor sync, in service of a question that had already stopped being asked.
  */
-internal fun unbondedProbeRetired(previouslyRefused: Boolean, silentLinksSoFar: Int): Boolean =
-    previouslyRefused || !unbondedProbeStillWorthAsking(silentLinksSoFar)
+internal fun unbondedProbeRetired(
+    previouslyRefused: Boolean,
+    silentLinksSoFar: Int,
+    inconclusiveLinksSoFar: Int = 0,
+): Boolean =
+    previouslyRefused
+        || !unbondedProbeStillWorthAsking(silentLinksSoFar)
+        || !unbondedProbeStillWorthAskingInconclusive(inconclusiveLinksSoFar)
 
 /**
  * How many links may end in SILENCE before the probe retires itself.
@@ -153,6 +166,25 @@ internal fun unbondedProbeRetired(previouslyRefused: Boolean, silentLinksSoFar:
  */
 internal const val UNBONDED_PROBE_MAX_SILENT_LINKS = 3
 
+/**
+ * How many CONSECUTIVE LOCAL TEARDOWNS may end a probe before it retires itself.
+ *
+ * #1804: a local teardown (status=22) is inconclusive about the strap — our own stack ended the
+ * link, not the strap — so it does NOT charge the silence budget. But inconclusive cannot mean
+ * unbounded: the probe re-runs on every reconnect, and on the strap this fix was written for
+ * EVERY attempt was a local teardown. Without a cap the probe re-runs indefinitely on precisely
+ * the device the fix was written for, with no path to a conclusion.
+ *
+ * The cap is LARGER than the silence budget because inconclusive is genuinely weaker evidence
+ * than silence: a silent link at least proved the subscriptions were accepted, while a local
+ * teardown proved nothing about the strap at all. If our stack tears the link down every time,
+ * the probe cannot complete regardless of what the strap would have said, and that is worth
+ * recording and stopping on too.
+ *
+ * Like the silence budget, cleared by a genuine answer and by turning the experiment off and on.
+ */
+internal const val UNBONDED_PROBE_MAX_INCONCLUSIVE_LINKS = 6
+
 /** Has the probe any budget left after [silentLinksSoFar] links that ended without an answer — whether
  *  they subscribed and stayed quiet, or were torn down while being asked? */
 internal fun unbondedProbeStillWorthAsking(
@@ -160,6 +192,15 @@ internal fun unbondedProbeStillWorthAsking(
     cap: Int = UNBONDED_PROBE_MAX_SILENT_LINKS,
 ): Boolean = silentLinksSoFar < cap
 
+/** Has the probe any inconclusive budget left after [inconclusiveLinksSoFar] links ended in a
+ *  LOCAL teardown (status=22)? #1804: a local teardown is weaker than silence, so it gets its own
+ *  larger cap — but it is still bounded, so a strap whose every link is torn down locally does not
+ *  retry forever. */
+internal fun unbondedProbeStillWorthAskingInconclusive(
+    inconclusiveLinksSoFar: Int,
+    cap: Int = UNBONDED_PROBE_MAX_INCONCLUSIVE_LINKS,
+): Boolean = inconclusiveLinksSoFar < cap
+
 /**
  * The line printed when the probe retires, so the log says why it stopped rather than leaving a reader to
  * notice its absence — the same failure the CLIENT_HELLO's silent suppression caused.
@@ -270,6 +311,17 @@ internal fun unbondedProbeSilentLinksPrefKey(peripheralId: String?): String? =
     peripheralId?.trim()?.takeIf { it.isNotEmpty() }
         ?.let { UNBONDED_PROBE_SILENT_LINKS_KEY_PREFIX + it.lowercase() }
 
+/** Prefix of every persisted inconclusive budget, cleared alongside the silence budget when the
+ *  experiment is re-armed. #1804: a local teardown charges this instead of the silence budget, and
+ *  it has its own larger cap ([UNBONDED_PROBE_MAX_INCONCLUSIVE_LINKS]). */
+internal const val UNBONDED_PROBE_INCONCLUSIVE_LINKS_KEY_PREFIX = "noop.unbondedOffloadInconclusiveLinks."
+
+/** Persisted key for "how many probe links on this strap ended in a LOCAL teardown (status=22)" —
+ *  the inconclusive budget of [UNBONDED_PROBE_MAX_INCONCLUSIVE_LINKS], per device. */
+internal fun unbondedProbeInconclusiveLinksPrefKey(peripheralId: String?): String? =
+    peripheralId?.trim()?.takeIf { it.isNotEmpty() }
+        ?.let { UNBONDED_PROBE_INCONCLUSIVE_LINKS_KEY_PREFIX + it.lowercase() }
+
 /**
  * What a frame arriving on a puffin notify characteristic proves about an unbonded link.
  *
@@ -360,6 +412,10 @@ internal fun puffinSubscribeRefusedLine(uuid: String, status: String): String =
  *
  * Charged to the silence budget, because "the link will not survive being asked" is a stronger reason to
  * stop asking than a strap that merely stayed quiet.
+ *
+ * #1804: this line is now ONLY for strap-side drops (GATT_CONN_TIMEOUT, supervision timeout). A LOCAL
+ * teardown (status=22) is handled by [unbondedProbeLinkLostLocalTeardownLine] instead, which does NOT
+ * charge the budget — a local teardown is our own stack ending the link, not a strap verdict.
  */
 internal fun unbondedProbeLinkLostLine(
     uptimeMs: Long,
@@ -383,12 +439,72 @@ internal fun unbondedProbeLinkLostLine(
  *
  * It still spends a budget attempt, because an inconclusive link is not a reason to retry forever — that
  * is the hole this exists to close, and leaving stage 2 uncounted would reopen it one stage later.
+ *
+ * #1804: this line is now ONLY for strap-side drops. A LOCAL teardown (status=22) is handled by
+ * [unbondedProbeLinkLostLocalTeardownLine] instead, which does NOT charge the budget.
  */
 internal fun unbondedProbeLinkLostAskingLine(uptimeMs: Long, waitedMs: Long): String =
     "Unbonded offload probe: the link dropped ${uptimeMs}ms into this connect, ${waitedMs}ms after" +
         " GET_CLOCK went out. The subscribes had landed, so the transport was open and the strap was still" +
         " inside its window to answer — this link settles nothing either way (#1635)."
 
+/**
+ * #1804: was the probe's link lost by US or by the strap?
+ *
+ * A local teardown (`GATT_CONN_TERMINATE_LOCAL_HOST`, status 22) is OUR stack ending the link — it is
+ * not a strap verdict, and counting it as one is the defect this exists to close. The field capture
+ * that surfaced this had three probe attempts end at 10776/10761/10787 ms — a 30 ms spread that is a
+ * timer, not a radio event — with `status=22` and `via=unknown` on every one. The probe concluded
+ * the strap refuses the offload unbonded from a link OUR side tore down, and latched it permanently.
+ *
+ * Only a strap-side drop (`GATT_CONN_TIMEOUT`, supervision timeout) or an ATT error is an answer
+ * about the strap. A local teardown is inconclusive: it must not consume a budget attempt and must
+ * not advance the silence counter.
+ *
+ * Pure so the classification is unit-testable without a BLE stack, like every other judgement in
+ * this file. The status constants are kept as raw ints here (matching `WhoopBleClient`'s private
+ * constants) so this file does not depend on `BluetoothGatt` and can run under plain JVM tests.
+ */
+internal fun unbondedProbeLinkLostIsLocalTeardown(
+    status: Int,
+): Boolean {
+    // GATT_CONN_TERMINATE_LOCAL_HOST = 0x16 = 22. Any local teardown, whether we know which path
+    // did it or not, is inconclusive about the strap. `via=unknown` is the case the field capture
+    // surfaced; `via=bondWatchdog` etc. are known local paths and equally not strap verdicts.
+    //
+    // The origin is NOT a parameter here: it does not affect the verdict, and a parameter that
+    // cannot change the answer invites the next reader to believe it can. The origin IS carried by
+    // `unbondedProbeLinkLostLocalTeardownLine`, which is where it is actually used.
+    return status == 22
+}
+
+/**
+ * #1804: the line for a probe link lost to a LOCAL teardown, which is inconclusive about the strap.
+ *
+ * Distinct from [unbondedProbeLinkLostLine] (stage 1, strap-side drop — carries the CLIENT_HELLO
+ * signature) and [unbondedProbeLinkLostAskingLine] (stage 2, strap-side drop — carries no finding).
+ * This one carries no finding EITHER way and does NOT charge the silence budget, because the link
+ * was ended by our own stack, not by the strap. Charging the SILENCE budget would spend it on a
+ * question that was never asked of the strap, which is exactly the false negative that latched the
+ * probe permanently on the reporting install.
+ *
+ * It DOES charge the INCONCLUSIVE budget ([UNBONDED_PROBE_MAX_INCONCLUSIVE_LINKS]), which has its
+ * own larger cap. A local teardown is weaker evidence than silence, but it cannot be unbounded: on
+ * the strap this fix was written for, EVERY attempt was a local teardown, and without a cap the
+ * probe would re-run indefinitely with no path to a conclusion.
+ */
+internal fun unbondedProbeLinkLostLocalTeardownLine(
+    uptimeMs: Long,
+    stage: Int,
+    localTeardownOrigin: String?,
+): String {
+    val stageDesc = if (stage == 1) "while subscribing the puffin notify chars" else "after GET_CLOCK went out"
+    val origin = localTeardownOrigin ?: "unknown"
+    return "Unbonded offload probe: the link was terminated locally ${uptimeMs}ms into this connect" +
+        " $stageDesc (via=$origin). A local teardown is not a strap verdict, so this link is" +
+        " inconclusive and does not consume a silence-budget attempt (#1804, #1635)."
+}
+
 /**
  * How many times the probe may stand aside for the DIS chain before going anyway.
  *
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index e73de2ffce..dbaeaa0e4e 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -2679,6 +2679,29 @@ class WhoopBleClient(
         runCatching { PuffinExperiment.from(context).setUnbondedProbeSilentLinks(lastDeviceAddress, value) }
     }
 
+    /** #1804: consecutive local-teardown (status=22) probe links, persisted per device. A local
+     *  teardown is inconclusive about the strap, so it charges THIS budget (with its own larger cap)
+     *  rather than the silence budget. Bounded so a strap whose every link is torn down locally does
+     *  not retry forever. */
+    private val unbondedProbeInconclusiveLinks: Int
+        get() = runCatching {
+            PuffinExperiment.from(context).unbondedProbeInconclusiveLinks(lastDeviceAddress)
+        }.getOrDefault(0)
+
+    private fun setUnbondedProbeInconclusiveLinks(value: Int) {
+        runCatching { PuffinExperiment.from(context).setUnbondedProbeInconclusiveLinks(lastDeviceAddress, value) }
+    }
+
+    /** #1804: charge the inconclusive budget for a local teardown. A genuine answer clears it
+     *  (alongside the silence budget), because whatever the quiet links were, they were not this
+     *  strap declining to talk. */
+    private fun chargeUnbondedProbeInconclusive() {
+        val spent = unbondedProbeInconclusiveLinks + 1
+        setUnbondedProbeInconclusiveLinks(spent)
+        log("Unbonded offload probe: inconclusive link budget now $spent/$UNBONDED_PROBE_MAX_INCONCLUSIVE_LINKS" +
+            " (local teardowns are not strap verdicts, but the probe must still terminate (#1804)).")
+    }
+
     /** True when the user asked to disconnect; suppresses the auto-rescan (Swift `intentionalDisconnect`).
      *  Written on the main looper (connect/disconnect/keep-alive bounce) and read on the GATT binder
      *  thread (handleDisconnect), so it must be @Volatile for cross-thread visibility. */
@@ -5316,6 +5339,7 @@ class WhoopBleClient(
         val helloWrittenNow = helloWrittenThisLink
         val alreadyProbedNow = unbondedProbeStartedThisLink
         val silentLinksNow = unbondedProbeSilentLinks
+        val inconclusiveLinksNow = unbondedProbeInconclusiveLinks
         if (!shouldProbeUnbondedOffload(
                 isWhoop5 = isWhoop5Now,
                 optedIn = optedInNow,
@@ -5324,6 +5348,7 @@ class WhoopBleClient(
                 alreadyProbedThisLink = alreadyProbedNow,
                 previouslyRefused = refused,
                 silentLinksSoFar = silentLinksNow,
+                inconclusiveLinksSoFar = inconclusiveLinksNow,
             )
         ) {
             // #1949: say WHY, once per link. UNGATED, unlike the pairing dump, and deliberately so: the
@@ -5348,6 +5373,7 @@ class WhoopBleClient(
                     alreadyProbedThisLink = alreadyProbedNow,
                     previouslyRefused = refused,
                     silentLinksSoFar = silentLinksNow,
+                    inconclusiveLinksSoFar = inconclusiveLinksNow,
                 )?.let { log(it, com.noop.testcentre.TestDomain.CONNECTION) }
             }
             return
@@ -5488,6 +5514,9 @@ class WhoopBleClient(
         // strap declining to talk, and a later reconnect — or a later app launch — must not inherit
         // their count.
         setUnbondedProbeSilentLinks(0)
+        // #1804: a genuine answer also clears the inconclusive budget — the local teardowns were not
+        // this strap refusing either, and the probe has now reached a conclusion.
+        setUnbondedProbeInconclusiveLinks(0)
         // The proven 5/MG handshake tail, minus the hello that cannot happen: clock the strap, then offload.
         // Clock-before-history is mandatory — an un-clocked 5/MG discards sensor data rather than banking it
         // — and it is only reached here because the strap has just demonstrated it answers commands.
@@ -10891,6 +10920,45 @@ class WhoopBleClient(
         // #520/#891: the DIS strings belong to the link that just dropped; a stale variant must not keep an
         // MG-only capability unlocked for whatever connects next.
         _whoop5Variant.value = Whoop5Variant.UNKNOWN
+        // #1635 / #1804: the probe-link-lost verdict must be emitted BEFORE reset() clears the probe
+        // flags, and it needs the disconnect `status` (which reset() does not receive). A probe still
+        // mid-subscribe when the link goes is stage 1 ending with the LINK; a probe mid-GET_CLOCK-wait
+        // is stage 2. Both get a verdict line so the silence budget advances correctly — EXCEPT when the
+        // link was terminated LOCALLY (status=22), which is our own stack ending the link and not a strap
+        // verdict. A local teardown is inconclusive and does NOT charge the budget (#1804).
+        //
+        // Cancel the probe runnables BEFORE emitting the verdict, so a runnable already dequeued and
+        // waiting to run cannot fire on the stale state. reset() cancels them again idempotently.
+        handler.removeCallbacks(unbondedProbeStartRunnable)
+        handler.removeCallbacks(unbondedProbeVerdictRunnable)
+        if (unbondedProbeSubscribing || unbondedProbeAwaitingReply) {
+            val uptime = if (connectedAtMs > 0L) System.currentTimeMillis() - connectedAtMs else -1L
+            if (unbondedProbeLinkLostIsLocalTeardown(status)) {
+                val stage = if (unbondedProbeSubscribing) 1 else 2
+                log(unbondedProbeLinkLostLocalTeardownLine(
+                    uptimeMs = uptime,
+                    stage = stage,
+                    localTeardownOrigin = lastLocalTeardown,
+                ))
+                // #1804: a local teardown is not a strap verdict, so it does NOT charge the silence
+                // budget. But it DOES charge the inconclusive budget, so a strap whose every link is
+                // torn down locally does not retry forever.
+                chargeUnbondedProbeInconclusive()
+            } else {
+                log(
+                    if (unbondedProbeSubscribing) unbondedProbeLinkLostLine(
+                        uptimeMs = uptime,
+                        confirmedSubscribes = unbondedProbeSubscribed,
+                        total = WHOOP5_NOTIFY_CHARS.size,
+                    ) else unbondedProbeLinkLostAskingLine(
+                        uptimeMs = uptime,
+                        waitedMs = if (unbondedProbeAskedAtMs > 0L)
+                            System.currentTimeMillis() - unbondedProbeAskedAtMs else -1L,
+                    ),
+                )
+                chargeUnbondedProbeSilence()
+            }
+        }
         reset()
 
         // close() can itself throw DeadObjectException on a dead binder — teardown must NEVER throw,
@@ -11048,32 +11116,10 @@ class WhoopBleClient(
         // see the cleared state, which is harmless, but one still queued must not reach the next link.
         handler.removeCallbacks(unbondedProbeStartRunnable)
         handler.removeCallbacks(unbondedProbeVerdictRunnable)
-        // A probe still mid-subscribe when the link goes is stage 1 ending with the LINK, and it is a
-        // verdict rather than an absence — see [unbondedProbeLinkLostLine]. Without this the probe
-        // reported nothing at all and its silence budget never advanced, so it re-ran on every reconnect:
-        // 16 starts and 0 verdicts in one capture. Charged to the budget, because "the link will not
-        // survive being asked" is a stronger reason to stop asking than a strap that merely stayed quiet.
-        //
-        // BOTH stages, because stage 2 has the identical hole: the verdict timer is cancelled just above,
-        // so a link lost during the GET_CLOCK wait would also report nothing and also fail to spend a
-        // budget attempt. The two get DIFFERENT lines — stage 1's loss carries the CLIENT_HELLO signature,
-        // stage 2's carries no finding at all — because conflating them is the mistake this probe keeps
-        // having to unpick.
-        if (unbondedProbeSubscribing || unbondedProbeAwaitingReply) {
-            val uptime = if (connectedAtMs > 0L) System.currentTimeMillis() - connectedAtMs else -1L
-            log(
-                if (unbondedProbeSubscribing) unbondedProbeLinkLostLine(
-                    uptimeMs = uptime,
-                    confirmedSubscribes = unbondedProbeSubscribed,
-                    total = WHOOP5_NOTIFY_CHARS.size,
-                ) else unbondedProbeLinkLostAskingLine(
-                    uptimeMs = uptime,
-                    waitedMs = if (unbondedProbeAskedAtMs > 0L)
-                        System.currentTimeMillis() - unbondedProbeAskedAtMs else -1L,
-                ),
-            )
-            chargeUnbondedProbeSilence()
-        }
+        // The probe-link-lost verdict (stage 1 or 2) is emitted from handleDisconnect BEFORE reset(),
+        // because it needs the disconnect `status` to classify a local teardown (#1804) and reset() is
+        // status-agnostic. The flag clears below stay here so the next link starts clean regardless of
+        // which path reached reset().
         unbondedProbeStartedThisLink = false
         unbondedProbeSkipLogged = false
         unbondedProbeDeferrals = 0
diff --git a/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt b/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
index a199552bce..e899041de3 100644
--- a/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
+++ b/android/app/src/test/java/com/noop/ble/UnbondedOffloadProbeTest.kt
@@ -608,4 +608,100 @@ class UnbondedOffloadProbeTest {
         )!!
         assertTrue(spent, spent.contains("silent-link budget is spent"))
     }
+
+    // MARK: - #1804: local teardown is inconclusive, not a strap verdict
+
+    /** The field capture: status=22 (GATT_CONN_TERMINATE_LOCAL_HOST). This is the exact case that
+     *  latched the probe permanently on the reporting install — a local teardown counted as a strap
+     *  refusal. The origin is NOT a parameter: it does not affect the verdict, and a parameter that
+     *  cannot change the answer invites the next reader to believe it can. */
+    @Test
+    fun `a local teardown is inconclusive regardless of origin`() {
+        assertTrue(unbondedProbeLinkLostIsLocalTeardown(status = 22))
+    }
+
+    /** A supervision timeout (status=8, GATT_CONN_TIMEOUT) is the STRAP dropping the link — that IS
+     *  evidence about the strap and should charge the silence budget. */
+    @Test
+    fun `a strap-side timeout is not a local teardown`() {
+        assertFalse(unbondedProbeLinkLostIsLocalTeardown(status = 8))
+    }
+
+    /** Any other status (e.g. 19, 133) is also not a local teardown. */
+    @Test
+    fun `other statuses are not local teardowns`() {
+        assertFalse(unbondedProbeLinkLostIsLocalTeardown(status = 19))
+        assertFalse(unbondedProbeLinkLostIsLocalTeardown(status = 133))
+    }
+
+    /** The inconclusive line names the stage and the origin, and says it does not consume a SILENCE
+     *  budget attempt — so a reader of the log knows the silence budget is not spent. It DOES charge
+     *  the inconclusive budget, but that has its own larger cap (#1804). */
+    @Test
+    fun `the inconclusive line names stage and origin and says it does not charge silence`() {
+        val line = unbondedProbeLinkLostLocalTeardownLine(
+            uptimeMs = 10776, stage = 1, localTeardownOrigin = null,
+        )
+        assertTrue(line, line.contains("terminated locally"))
+        assertTrue(line, line.contains("10776ms"))
+        assertTrue(line, line.contains("while subscribing"))
+        assertTrue(line, line.contains("via=unknown"))
+        assertTrue(line, line.contains("inconclusive"))
+        assertTrue(line, line.contains("does not consume"))
+    }
+
+    @Test
+    fun `the inconclusive line for stage 2 names GET_CLOCK`() {
+        val line = unbondedProbeLinkLostLocalTeardownLine(
+            uptimeMs = 10761, stage = 2, localTeardownOrigin = "bondWatchdog",
+        )
+        assertTrue(line, line.contains("after GET_CLOCK went out"))
+        assertTrue(line, line.contains("via=bondWatchdog"))
+    }
+
+    // MARK: - #1804: inconclusive budget bounds the retry
+
+    /** A local teardown is weaker evidence than silence, so it gets its own LARGER cap. The probe
+     *  retires when the inconclusive budget is spent, so a strap whose every link is torn down
+     *  locally does not retry forever. */
+    @Test
+    fun `inconclusive budget is larger than the silence budget`() {
+        assertTrue(UNBONDED_PROBE_MAX_INCONCLUSIVE_LINKS > UNBONDED_PROBE_MAX_SILENT_LINKS)
+    }
+
+    @Test
+    fun `probe retires when inconclusive budget is spent`() {
+        assertTrue(unbondedProbeRetired(
+            previouslyRefused = false,
+            silentLinksSoFar = 0,
+            inconclusiveLinksSoFar = UNBONDED_PROBE_MAX_INCONCLUSIVE_LINKS,
+        ))
+    }
+
+    @Test
+    fun `probe does not retire when inconclusive budget is not yet spent`() {
+        assertFalse(unbondedProbeRetired(
+            previouslyRefused = false,
+            silentLinksSoFar = 0,
+            inconclusiveLinksSoFar = UNBONDED_PROBE_MAX_INCONCLUSIVE_LINKS - 1,
+        ))
+    }
+
+    /** The skipped line names the inconclusive budget when that is what retired the probe. */
+    @Test
+    fun `skipped line names inconclusive budget when it is the reason`() {
+        val line = unbondedProbeSkippedLine(
+            isWhoop5 = true,
+            optedIn = true,
+            bonded = false,
+            helloWrittenThisLink = false,
+            alreadyProbedThisLink = false,
+            previouslyRefused = false,
+            silentLinksSoFar = 0,
+            inconclusiveLinksSoFar = UNBONDED_PROBE_MAX_INCONCLUSIVE_LINKS,
+        )
+        assertNotNull(line, line)
+        assertTrue(line!!, line.contains("inconclusive-link budget is spent"))
+        assertTrue(line, line.contains("our own stack"))
+    }
 }

From 95a3e6a85dac97225e081be024004e37fcd0e08c Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Mon, 7 Sep 2026 18:01:11 +0530
Subject: [PATCH 327/333] Sleep tab: stamp carried prior-night metric values
 with their day (#1946)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Night detail grid took each tile's `latest` from Baselines.freshestCarried and
threw away the day it came from. When the latest night had no data for a metric, a
prior day's value appeared with only a "vs typical" caption, under a header naming
tonight. A weeks-old respiratory reading could sit there indefinitely and read as
tonight's.

Metric now carries `latestDay` beside the value, nil when the value is today's
own, so a tile that is genuinely current never stamps and the stamp keeps its
meaning. Tiles prefer "Carried · <date>" over "vs typical" when the value came
from a prior day, in the same "d MMM" format the Today carry stamp uses, so a
carried Rest on Today and a carried metric on Sleep read identically.

Both platforms, with the nilling rule expressed the same way on each, and
regression tests on both sides.

The caption is properly localised rather than merely extracted, which is the part
CI cannot check. Android returns a DisplayText.Resource so the string lives in
strings.xml where the audit and the locale files can see it, matching
TodayScoring.carriedCaption; the key is present in all seven Android locales. iOS
carries `Carried · %@` in all nine catalogue locales, every one translated. The
seven shared locales agree word for word across the two platforms.

Author: evoveotech
---
 Strand/Resources/Localizable.xcstrings        |  3 +
 Strand/Screens/ConsistencyCard.swift          | 12 ++-
 Strand/Screens/HoursVsNeededCard.swift        | 12 ++-
 Strand/Screens/NightDetailCard.swift          | 29 ++++--
 Strand/Screens/SleepModel.swift               | 52 ++++++++--
 StrandTests/SleepCarriedStampTests.swift      | 73 ++++++++++++++
 .../main/java/com/noop/ui/SleepFormatting.kt  | 19 ++++
 .../java/com/noop/ui/SleepMetricCardsUi.kt    | 12 +--
 .../main/java/com/noop/ui/SleepModelLogic.kt  | 14 ++-
 .../src/main/java/com/noop/ui/SleepModels.kt  | 38 +++++++-
 .../app/src/main/res/values-de/strings.xml    |  1 +
 .../app/src/main/res/values-es/strings.xml    |  1 +
 .../app/src/main/res/values-fr/strings.xml    |  1 +
 .../app/src/main/res/values-pl/strings.xml    |  1 +
 .../src/main/res/values-pt-rPT/strings.xml    |  1 +
 .../app/src/main/res/values-ru/strings.xml    |  1 +
 .../app/src/main/res/values-zh/strings.xml    |  1 +
 android/app/src/main/res/values/strings.xml   |  1 +
 .../java/com/noop/ui/SleepCarriedStampTest.kt | 97 +++++++++++++++++++
 19 files changed, 341 insertions(+), 28 deletions(-)
 create mode 100644 StrandTests/SleepCarriedStampTests.swift
 create mode 100644 android/app/src/test/java/com/noop/ui/SleepCarriedStampTest.kt

diff --git a/Strand/Resources/Localizable.xcstrings b/Strand/Resources/Localizable.xcstrings
index 3c15ab56be..0844b4a27e 100644
--- a/Strand/Resources/Localizable.xcstrings
+++ b/Strand/Resources/Localizable.xcstrings
@@ -42823,6 +42823,9 @@
         }
       }
     },
+    "Carried · %@": { "localizations": {
+      "de": { "stringUnit": { "state": "translated", "value": "Übernommen · %@" } }, "es": { "stringUnit": { "state": "translated", "value": "Heredado · %@" } }, "fr": { "stringUnit": { "state": "translated", "value": "Reporté · %@" } }, "it": { "stringUnit": { "state": "translated", "value": "Riportato · %@" } }, "pl": { "stringUnit": { "state": "translated", "value": "Przeniesione · %@" } }, "pt-PT": { "stringUnit": { "state": "translated", "value": "Herdado · %@" } }, "ru": { "stringUnit": { "state": "translated", "value": "Перенесено · %@" } }, "zh-Hans": { "stringUnit": { "state": "translated", "value": "携带 · %@" } }, "zh-Hant": { "stringUnit": { "state": "translated", "value": "攜带 · %@" } }
+    } },
     "Carbs": {
       "localizations": {
         "de": {
diff --git a/Strand/Screens/ConsistencyCard.swift b/Strand/Screens/ConsistencyCard.swift
index ee77b2f7c8..d4f1e576e4 100644
--- a/Strand/Screens/ConsistencyCard.swift
+++ b/Strand/Screens/ConsistencyCard.swift
@@ -31,7 +31,8 @@ struct ConsistencyCard: View {
             StatTile(
                 label: "Consistency",
                 value: pctValue(cons.latest),
-                caption: vsTypical(cons.latest, cons.typical, suffix: "%"),
+                caption: tileCaption(latestDay: cons.latestDay, latest: cons.latest,
+                                     typical: cons.typical, suffix: "%"),
                 accent: cons.latest.map { StrandPalette.recoveryColor($0) } ?? StrandPalette.textPrimary,
                 sparkline: spark(cons.series),
                 sparkColor: StrandPalette.metricCyan)
@@ -45,6 +46,15 @@ struct ConsistencyCard: View {
         v.map { "\(Int($0.rounded()))%" } ?? "—"
     }
 
+    /// #1946: a carried prior-day value is stamped "Carried · <date>" instead of "vs typical".
+    private func tileCaption(latestDay: String?, latest: Double?, typical: Double?,
+                             suffix: String, decimals: Int = 0) -> String {
+        if let carried = SleepModel.carriedMetricCaption(latestDay: latestDay, latest: latest) {
+            return carried
+        }
+        return vsTypical(latest, typical, suffix: suffix, decimals: decimals)
+    }
+
     /// "+12% vs typical" — the latest-vs-mean caption the metric tile carries.
     private func vsTypical(_ latest: Double?, _ typical: Double?, suffix: String, decimals: Int = 0) -> String {
         guard let latest, let typical, typical != 0 else { return String(localized: "vs typical - ") }
diff --git a/Strand/Screens/HoursVsNeededCard.swift b/Strand/Screens/HoursVsNeededCard.swift
index 63feec0fca..2dfb638b90 100644
--- a/Strand/Screens/HoursVsNeededCard.swift
+++ b/Strand/Screens/HoursVsNeededCard.swift
@@ -30,7 +30,8 @@ struct HoursVsNeededCard: View {
             StatTile(
                 label: "Hours vs Needed",
                 value: pctValue(need.latest),
-                caption: vsTypical(need.latest, need.typical, suffix: "%"),
+                caption: tileCaption(latestDay: need.latestDay, latest: need.latest,
+                                     typical: need.typical, suffix: "%"),
                 accent: need.latest.map { StrandPalette.recoveryColor(min(100, $0)) } ?? StrandPalette.textPrimary,
                 sparkline: spark(need.series),
                 sparkColor: StrandPalette.restColor)
@@ -44,6 +45,15 @@ struct HoursVsNeededCard: View {
         v.map { "\(Int($0.rounded()))%" } ?? "—"
     }
 
+    /// #1946: a carried prior-day value is stamped "Carried · <date>" instead of "vs typical".
+    private func tileCaption(latestDay: String?, latest: Double?, typical: Double?,
+                             suffix: String, decimals: Int = 0) -> String {
+        if let carried = SleepModel.carriedMetricCaption(latestDay: latestDay, latest: latest) {
+            return carried
+        }
+        return vsTypical(latest, typical, suffix: suffix, decimals: decimals)
+    }
+
     /// "+12% vs typical" — the latest-vs-mean caption the metric tile carries.
     private func vsTypical(_ latest: Double?, _ typical: Double?, suffix: String, decimals: Int = 0) -> String {
         guard let latest, let typical, typical != 0 else { return String(localized: "vs typical - ") }
diff --git a/Strand/Screens/NightDetailCard.swift b/Strand/Screens/NightDetailCard.swift
index 60fbde7308..dcd0a029af 100644
--- a/Strand/Screens/NightDetailCard.swift
+++ b/Strand/Screens/NightDetailCard.swift
@@ -53,7 +53,8 @@ struct NightDetailCard: View {
                 StatTile(
                     label: "Rest",
                     value: pctValue(perf.latest),
-                    caption: vsTypical(perf.latest, perf.typical, suffix: "%"),
+                    caption: tileCaption(latestDay: perf.latestDay, latest: perf.latest,
+                                         typical: perf.typical, suffix: "%"),
                     accent: perf.latest.map { StrandPalette.recoveryColor($0) } ?? StrandPalette.textPrimary,
                     sparkline: spark(perf.series),
                     sparkColor: StrandPalette.restColor)
@@ -61,7 +62,8 @@ struct NightDetailCard: View {
                 StatTile(
                     label: "Efficiency",
                     value: pctValue(eff.latest),
-                    caption: vsTypical(eff.latest, eff.typical, suffix: "%"),
+                    caption: tileCaption(latestDay: eff.latestDay, latest: eff.latest,
+                                         typical: eff.typical, suffix: "%"),
                     accent: StrandPalette.statusPositive,
                     sparkline: spark(eff.series),
                     sparkColor: StrandPalette.statusPositive)
@@ -69,7 +71,8 @@ struct NightDetailCard: View {
                 StatTile(
                     label: "Consistency",
                     value: pctValue(cons.latest),
-                    caption: vsTypical(cons.latest, cons.typical, suffix: "%"),
+                    caption: tileCaption(latestDay: cons.latestDay, latest: cons.latest,
+                                         typical: cons.typical, suffix: "%"),
                     accent: cons.latest.map { StrandPalette.recoveryColor($0) } ?? StrandPalette.textPrimary,
                     sparkline: spark(cons.series),
                     sparkColor: StrandPalette.metricCyan)
@@ -77,7 +80,8 @@ struct NightDetailCard: View {
                 StatTile(
                     label: "Hours vs Needed",
                     value: pctValue(need.latest),
-                    caption: vsTypical(need.latest, need.typical, suffix: "%"),
+                    caption: tileCaption(latestDay: need.latestDay, latest: need.latest,
+                                         typical: need.typical, suffix: "%"),
                     accent: need.latest.map { StrandPalette.recoveryColor(min(100, $0)) } ?? StrandPalette.textPrimary,
                     sparkline: spark(need.series),
                     sparkColor: StrandPalette.restColor)
@@ -85,7 +89,8 @@ struct NightDetailCard: View {
                 StatTile(
                     label: "Restorative",
                     value: pctValue(rest.latest),
-                    caption: vsTypical(rest.latest, rest.typical, suffix: "%"),
+                    caption: tileCaption(latestDay: rest.latestDay, latest: rest.latest,
+                                         typical: rest.typical, suffix: "%"),
                     accent: StrandPalette.sleepREM,
                     sparkline: spark(rest.series),
                     sparkColor: StrandPalette.sleepREM)
@@ -93,7 +98,8 @@ struct NightDetailCard: View {
                 StatTile(
                     label: "Respiratory",
                     value: rrValue(resp.latest),
-                    caption: vsTypical(resp.latest, resp.typical, suffix: " rpm", decimals: 1),
+                    caption: tileCaption(latestDay: resp.latestDay, latest: resp.latest,
+                                         typical: resp.typical, suffix: " rpm", decimals: 1),
                     accent: StrandPalette.metricPurple,
                     sparkline: spark(resp.series),
                     sparkColor: StrandPalette.metricPurple)
@@ -123,6 +129,17 @@ struct NightDetailCard: View {
         v.map { String(format: "%.1f", $0) } ?? "—"
     }
 
+    /// #1946: a carried prior-day value is stamped "Carried · <date>" instead of "vs typical", so it
+    /// is never passed off as tonight's read. Falls through to `vsTypical` when the value is today's
+    /// own (or there is no value).
+    private func tileCaption(latestDay: String?, latest: Double?, typical: Double?,
+                             suffix: String, decimals: Int = 0) -> String {
+        if let carried = SleepModel.carriedMetricCaption(latestDay: latestDay, latest: latest) {
+            return carried
+        }
+        return vsTypical(latest, typical, suffix: suffix, decimals: decimals)
+    }
+
     /// "+12% vs typical" / "−0.4 rpm vs typical" — the latest-vs-mean caption every tile carries.
     private func vsTypical(_ latest: Double?, _ typical: Double?, suffix: String, decimals: Int = 0) -> String {
         guard let latest, let typical, typical != 0 else { return String(localized: "vs typical - ") }
diff --git a/Strand/Screens/SleepModel.swift b/Strand/Screens/SleepModel.swift
index 6a224dfa52..198035ed06 100644
--- a/Strand/Screens/SleepModel.swift
+++ b/Strand/Screens/SleepModel.swift
@@ -137,8 +137,42 @@ struct Night {
 /// `SleepModel.build(_:)` and read by the subviews, so full passes over the day rows / sleep sessions
 /// and the Night.intervals reconstruction no longer run on every render.
 struct SleepModel {
-    /// (latest, typical mean, full history) per metric — mirrors SleepView's per-tile series.
-    typealias Metric = (latest: Double?, typical: Double?, series: [Double])
+    /// (latest, latestDay, typical mean, full history) per metric — mirrors SleepView's per-tile series.
+    /// `latestDay` is the yyyy-MM-dd the `latest` value was carried from (nil when there is no latest
+    /// value, or when the latest value IS today's). #1946: a carried prior-day value is stamped with its
+    /// day so it is not passed off as tonight's read.
+    typealias Metric = (latest: Double?, latestDay: String?, typical: Double?, series: [Double])
+
+    /// #1946: the caption for a metric tile whose `latest` value was carried from a prior day.
+    /// Returns nil when the value is NOT carried (today's own, or no value) so the caller falls through
+    /// to the normal "vs typical" caption. When carried, returns "Carried · <date>" so a prior night's
+    /// number is never passed off as tonight's read. Pure + unit-testable. Mirror EXACTLY in Kotlin.
+    static func carriedMetricCaption(latestDay: String?, latest: Double?) -> String? {
+        guard let latestDay, latest != nil else { return nil }
+        return String(localized: "Carried · \(Self.shortDayLabel(latestDay))")
+    }
+
+    /// "12 Jul" for a "yyyy-MM-dd" key — the SAME format `TodayView.carriedCaption` uses for the
+    /// recovery carry stamp, so a carried Rest on Today and a carried metric on Sleep read identically.
+    static func shortDayLabel(_ key: String) -> String {
+        guard let date = dayKeyParser.date(from: key) else { return key }
+        return Self.shortDayFormatter.string(from: date)
+    }
+
+    private static let dayKeyParser: DateFormatter = {
+        let f = DateFormatter()
+        f.dateFormat = "yyyy-MM-dd"
+        f.locale = Locale(identifier: "en_US_POSIX")
+        f.timeZone = TimeZone(identifier: "UTC")
+        return f
+    }()
+
+    private static let shortDayFormatter: DateFormatter = {
+        let f = DateFormatter()
+        f.locale = AppLanguage.activeLocale
+        f.setLocalizedDateFormatFromTemplate("dMMM")
+        return f
+    }()
 
     let night: Night
     /// Stage intervals for the hypnogram — computed once (Night.intervals is a computed
@@ -365,7 +399,11 @@ extension SleepModel {
         // `BodyVitalSigns.logicalDayKey` rather than `Repository.logicalDayKey`: same 04:00 boundary,
         // but self-contained, so this stays pure and independent of the @MainActor Repository.
         let fresh = Baselines.freshestCarried(points, todayKey: BodyVitalSigns.logicalDayKey(now))
-        return (fresh?.value, mean(series), series)
+        // #1946: track the day the carried value came from so the tile can stamp it. nil when there is
+        // no carried value, or when the carried value IS today's own (no stamp needed for today's read).
+        let todayKey = BodyVitalSigns.logicalDayKey(now)
+        let latestDay = (fresh != nil && fresh!.day != todayKey) ? fresh!.day : nil
+        return (fresh?.value, latestDay, mean(series), series)
     }
 
     /// Sleep performance %: the imported WHOOP figure when the export carried one for that day;
@@ -392,7 +430,7 @@ extension SleepModel {
         let imported = importedSleep
         if let lastDay = days.last?.day, imported[lastDay]?.consistencyPct != nil {
             let series = days.compactMap { imported[$0.day]?.consistencyPct }
-            return (series.last, mean(series), series)
+            return (series.last, nil, mean(series), series)
         }
         let cal = Calendar.current
         func bedMinutes(_ s: CachedSleepSession) -> Double {
@@ -403,7 +441,7 @@ extension SleepModel {
             return m
         }
         let mins = sleeps.map(bedMinutes)
-        guard mins.count >= 3 else { return (nil, nil, []) }
+        guard mins.count >= 3 else { return (nil, nil, nil, []) }
         var scores: [Double] = []
         for i in mins.indices {
             let lo = Swift.max(0, i - 13)
@@ -414,7 +452,7 @@ extension SleepModel {
             let sd = variance.squareRoot()
             scores.append(Swift.max(0, Swift.min(100, 100 * (1 - sd / 120))))
         }
-        return (scores.last, mean(scores), scores)
+        return (scores.last, nil, mean(scores), scores)
     }
 
     /// Hours vs needed % = asleep / need. The imported sleep_need_min wins per day; else the
@@ -459,7 +497,7 @@ extension SleepModel {
             needHours: need / 60.0,
             importedDebtMin: importedDebt
         ).map(\.value)
-        return (series.last, mean(series), series)
+        return (series.last, nil, mean(series), series)
     }
 
     // MARK: Trend points
diff --git a/StrandTests/SleepCarriedStampTests.swift b/StrandTests/SleepCarriedStampTests.swift
new file mode 100644
index 0000000000..1208dbfe52
--- /dev/null
+++ b/StrandTests/SleepCarriedStampTests.swift
@@ -0,0 +1,73 @@
+import XCTest
+import WhoopStore
+@testable import Strand
+
+/// #1946: a carried prior-night metric value must be stamped with its day so it is not passed off
+/// as tonight's read. The `SleepModel.Metric` tuple now carries `latestDay` alongside `latest`, and
+/// `carriedMetricCaption` returns "Carried · <date>" when the value is from a prior day. Byte-parity
+/// twin of Kotlin `SleepCarriedStampTest`.
+final class SleepCarriedStampTests: XCTestCase {
+
+    private func day(_ d: String, resp: Double? = nil, eff: Double? = nil) -> DailyMetric {
+        DailyMetric(day: d, totalSleepMin: 420, efficiency: eff,
+                    deepMin: 80, remMin: 90, lightMin: 200, disturbances: nil,
+                    restingHr: nil, avgHrv: nil, recovery: nil, strain: nil,
+                    exerciseCount: nil, spo2Pct: nil, skinTempDevC: nil, respRateBpm: resp)
+    }
+
+    private func noon(_ d: String) -> Date {
+        let f = DateFormatter()
+        f.locale = Locale(identifier: "en_US_POSIX")
+        f.dateFormat = "yyyy-MM-dd HH:mm"
+        f.timeZone = .current
+        return f.date(from: "\(d) 12:00")!
+    }
+
+    /// A value from TODAY's own day is NOT carried — `latestDay` is nil, no stamp.
+    func testTodayValueIsNotCarried() {
+        let days = [day("2026-08-13", resp: 15.6)]
+        let resp = SleepModel.metric(days: days, now: noon("2026-08-13")) { $0.respRateBpm }
+        XCTAssertEqual(resp.latest ?? 0, 15.6, accuracy: 1e-9)
+        XCTAssertNil(resp.latestDay, "today's own value must not be marked as carried")
+        XCTAssertNil(SleepModel.carriedMetricCaption(latestDay: resp.latestDay, latest: resp.latest))
+    }
+
+    /// A value from a PRIOR day within the carry window IS carried — `latestDay` is set, and the
+    /// caption stamps it.
+    func testPriorDayValueIsCarriedAndStamped() {
+        let days = [day("2026-08-11", resp: 14.1), day("2026-08-12")]
+        let resp = SleepModel.metric(days: days, now: noon("2026-08-13")) { $0.respRateBpm }
+        XCTAssertEqual(resp.latest ?? 0, 14.1, accuracy: 1e-9)
+        XCTAssertEqual(resp.latestDay, "2026-08-11", "the carried value's source day is tracked")
+        let caption = SleepModel.carriedMetricCaption(latestDay: resp.latestDay, latest: resp.latest)
+        XCTAssertNotNil(caption, "a carried value must produce a stamp caption")
+        XCTAssertTrue(caption!.contains("Carried"), caption!)
+        XCTAssertTrue(caption!.contains("11"), caption!)
+    }
+
+    /// A nil latest has no stamp — the tile falls through to "vs typical" or "—".
+    func testNoValueHasNoStamp() {
+        XCTAssertNil(SleepModel.carriedMetricCaption(latestDay: "2026-08-11", latest: nil))
+        XCTAssertNil(SleepModel.carriedMetricCaption(latestDay: nil, latest: 15.6))
+        XCTAssertNil(SleepModel.carriedMetricCaption(latestDay: nil, latest: nil))
+    }
+
+    /// A stale value (outside the carry window) has no latest and no stamp — it was already nilled
+    /// by `freshestCarried`.
+    func testStaleValueHasNoLatestAndNoStamp() {
+        var days = [day("2026-07-29", resp: 16.2), day("2026-07-30", resp: 15.6)]
+        days += (1...13).map { day(String(format: "2026-08-%02d", $0)) }
+        let resp = SleepModel.metric(days: days, now: noon("2026-08-13")) { $0.respRateBpm }
+        XCTAssertNil(resp.latest)
+        XCTAssertNil(resp.latestDay)
+        XCTAssertNil(SleepModel.carriedMetricCaption(latestDay: resp.latestDay, latest: resp.latest))
+    }
+
+    /// A fresh sibling metric (efficiency, present every night) is NOT carried when today has a value.
+    func testFreshSiblingIsNotCarried() {
+        let days = [day("2026-08-12", eff: 90), day("2026-08-13", eff: 88)]
+        let eff = SleepModel.metric(days: days, now: noon("2026-08-13")) { $0.efficiency }
+        XCTAssertEqual(eff.latest ?? 0, 88, accuracy: 1e-9)
+        XCTAssertNil(eff.latestDay, "today's own efficiency is not carried")
+    }
+}
diff --git a/android/app/src/main/java/com/noop/ui/SleepFormatting.kt b/android/app/src/main/java/com/noop/ui/SleepFormatting.kt
index cd14e2f48a..7c8249a9dc 100644
--- a/android/app/src/main/java/com/noop/ui/SleepFormatting.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepFormatting.kt
@@ -24,6 +24,25 @@ internal fun vsTypical(latest: Double?, typical: Double?, suffix: String, decima
     return "$sign$num$suffix vs typical"
 }
 
+/** #1946: a carried prior-day value is stamped "Carried · <date>" instead of "vs typical", so it is
+ *  never passed off as tonight's read. Falls through to [vsTypical] when the value is today's own
+ *  (or there is no value). Mirror EXACTLY in Swift. */
+internal fun tileCaption(
+    latestDay: String?, latest: Double?, typical: Double?,
+    suffix: String, decimals: Int = 0,
+): String {
+    Metric.carriedMetricCaption(latestDay, latest)?.let { caption ->
+        // Resolve the DisplayText.Resource here so tileCaption stays String-returning for the
+        // SparkTile call sites. uiString reads the process Application resources, so this is
+        // locale-aware without being a @Composable.
+        return when (caption) {
+            is DisplayText.Resource -> uiString(caption.id, *caption.args.toTypedArray())
+            is DisplayText.Dynamic -> caption.value
+        }
+    }
+    return vsTypical(latest, typical, suffix, decimals)
+}
+
 internal fun debtCaption(debt: Double?): String {
     if (debt == null) return "vs need"
     return if (debt < SleepDebt.ON_TARGET_BAND_MIN) "On target" else "Below need"
diff --git a/android/app/src/main/java/com/noop/ui/SleepMetricCardsUi.kt b/android/app/src/main/java/com/noop/ui/SleepMetricCardsUi.kt
index 41d7953f79..3ac8f33dfa 100644
--- a/android/app/src/main/java/com/noop/ui/SleepMetricCardsUi.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepMetricCardsUi.kt
@@ -72,7 +72,7 @@ private fun MetricGrid(m: SleepModel, onMetricClick: (String) -> Unit = {}) {
             SparkTile(
                 mod, "Rest",
                 value = pctValue(m.performance.latest),
-                caption = vsTypical(m.performance.latest, m.performance.typical, "%"),
+                caption = tileCaption(m.performance.latestDay, m.performance.latest, m.performance.typical, "%"),
                 accent = m.performance.latest?.let { Palette.recoveryColor(it) } ?: Palette.textPrimary,
                 spark = m.performance.series, sparkColor = Palette.restColor,
                 onClick = { onMetricClick("performance") },
@@ -82,7 +82,7 @@ private fun MetricGrid(m: SleepModel, onMetricClick: (String) -> Unit = {}) {
             SparkTile(
                 mod, "Efficiency",
                 value = pctValue(m.efficiency.latest),
-                caption = vsTypical(m.efficiency.latest, m.efficiency.typical, "%"),
+                caption = tileCaption(m.efficiency.latestDay, m.efficiency.latest, m.efficiency.typical, "%"),
                 accent = Palette.statusPositive,
                 spark = m.efficiency.series, sparkColor = Palette.statusPositive,
                 onClick = { onMetricClick("efficiency") },
@@ -92,7 +92,7 @@ private fun MetricGrid(m: SleepModel, onMetricClick: (String) -> Unit = {}) {
             SparkTile(
                 mod, "Consistency",
                 value = pctValue(m.consistency.latest),
-                caption = vsTypical(m.consistency.latest, m.consistency.typical, "%"),
+                caption = tileCaption(m.consistency.latestDay, m.consistency.latest, m.consistency.typical, "%"),
                 accent = m.consistency.latest?.let { Palette.recoveryColor(it) } ?: Palette.textPrimary,
                 spark = m.consistency.series, sparkColor = Palette.metricCyan,
                 onClick = { onMetricClick("consistency") },
@@ -102,7 +102,7 @@ private fun MetricGrid(m: SleepModel, onMetricClick: (String) -> Unit = {}) {
             SparkTile(
                 mod, "Hours vs Needed",
                 value = pctValue(m.hoursVsNeeded.latest),
-                caption = vsTypical(m.hoursVsNeeded.latest, m.hoursVsNeeded.typical, "%"),
+                caption = tileCaption(m.hoursVsNeeded.latestDay, m.hoursVsNeeded.latest, m.hoursVsNeeded.typical, "%"),
                 accent = m.hoursVsNeeded.latest?.let { Palette.recoveryColor(minOf(100.0, it)) } ?: Palette.textPrimary,
                 spark = m.hoursVsNeeded.series, sparkColor = Palette.restColor,
                 onClick = { onMetricClick("hours_vs_needed") },
@@ -112,7 +112,7 @@ private fun MetricGrid(m: SleepModel, onMetricClick: (String) -> Unit = {}) {
             SparkTile(
                 mod, "Restorative",
                 value = pctValue(m.restorative.latest),
-                caption = vsTypical(m.restorative.latest, m.restorative.typical, "%"),
+                caption = tileCaption(m.restorative.latestDay, m.restorative.latest, m.restorative.typical, "%"),
                 accent = Palette.sleepREM,
                 spark = m.restorative.series, sparkColor = Palette.sleepREM,
                 onClick = { onMetricClick("restorative") },
@@ -122,7 +122,7 @@ private fun MetricGrid(m: SleepModel, onMetricClick: (String) -> Unit = {}) {
             SparkTile(
                 mod, "Respiratory",
                 value = m.respiratory.latest?.let { String.format(Locale.US, "%.1f", it) } ?: "—",
-                caption = vsTypical(m.respiratory.latest, m.respiratory.typical, " rpm", decimals = 1),
+                caption = tileCaption(m.respiratory.latestDay, m.respiratory.latest, m.respiratory.typical, " rpm", decimals = 1),
                 accent = Palette.metricPurple,
                 spark = m.respiratory.series, sparkColor = Palette.metricPurple,
                 onClick = { onMetricClick("respiratory") },
diff --git a/android/app/src/main/java/com/noop/ui/SleepModelLogic.kt b/android/app/src/main/java/com/noop/ui/SleepModelLogic.kt
index 8a058097d0..87354a49ee 100644
--- a/android/app/src/main/java/com/noop/ui/SleepModelLogic.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepModelLogic.kt
@@ -217,7 +217,7 @@ internal fun buildSleepModel(
         val lastDay = days.lastOrNull()?.day
         if (lastDay != null && imported.consistency[lastDay] != null) {
             val series = days.mapNotNull { imported.consistency[it.day] }
-            Metric(series.lastOrNull(), mean(series), series)
+            Metric(series.lastOrNull(), null, mean(series), series)
         } else {
             consistencySeries(sessions)
         }
@@ -240,7 +240,7 @@ internal fun buildSleepModel(
     ).toMap()
     val sleepDebt = run {
         val series = days.mapNotNull { localDebtByDay[it.day] }
-        Metric(series.lastOrNull(), mean(series), series)
+        Metric(series.lastOrNull(), null, mean(series), series)
     }
 
     // Trend set = the most-recent nights with data (asleep totals, full history — latest-anchored,
@@ -398,7 +398,11 @@ private fun metric(
         transform(d)?.takeIf { it.isFinite() }?.let { d.day to it }
     }
     val series = points.map { it.second }
-    return Metric(Baselines.freshestCarried(points, todayKey)?.second, mean(series), series)
+    val fresh = Baselines.freshestCarried(points, todayKey)
+    // #1946: track the day the carried value came from so the tile can stamp it. null when there is
+    // no carried value, or when the carried value IS today's own (no stamp needed for today's read).
+    val latestDay = if (fresh != null && fresh.first != todayKey) fresh.first else null
+    return Metric(fresh?.second, latestDay, mean(series), series)
 }
 
 /**
@@ -421,7 +425,7 @@ internal fun consistencySeries(sessions: List<SleepSession>): Metric {
         return m
     }
     val mins = sessions.sortedBy { it.startTs }.map { bedMinutes(it.effectiveStartTs) }
-    if (mins.size < 3) return Metric(null, null, emptyList())
+    if (mins.size < 3) return Metric(null, null, null, emptyList())
     val scores = ArrayList<Double>()
     for (i in mins.indices) {
         val lo = max(0, i - 13)
@@ -433,7 +437,7 @@ internal fun consistencySeries(sessions: List<SleepSession>): Metric {
         // 120 min of onset SD maps to a 0 score; tighter routines climb to 100.
         scores.add((100.0 * (1.0 - sd / 120.0)).coerceIn(0.0, 100.0))
     }
-    return Metric(scores.lastOrNull(), mean(scores), scores)
+    return Metric(scores.lastOrNull(), null, mean(scores), scores)
 }
 
 private fun mean(vals: List<Double>): Double? = if (vals.isEmpty()) null else vals.sum() / vals.size
diff --git a/android/app/src/main/java/com/noop/ui/SleepModels.kt b/android/app/src/main/java/com/noop/ui/SleepModels.kt
index dd13fcaf31..2219bb4543 100644
--- a/android/app/src/main/java/com/noop/ui/SleepModels.kt
+++ b/android/app/src/main/java/com/noop/ui/SleepModels.kt
@@ -1,5 +1,6 @@
 package com.noop.ui
 
+import com.noop.R
 import com.noop.analytics.SleepDebtLedger
 import com.noop.data.SleepSession
 
@@ -17,12 +18,45 @@ internal data class Stages(
     val asleep: Double get() = light + deep + rem
 }
 
-/** (latest, typical mean, full history) per metric — mirrors the macOS Metric tuple. */
+/** (latest, latestDay, typical mean, full history) per metric — mirrors the macOS Metric tuple.
+ *  `latestDay` is the yyyy-MM-dd the `latest` value was carried from (null when there is no latest
+ *  value, or when the latest value IS today's). #1946: a carried prior-day value is stamped with its
+ *  day so it is not passed off as tonight's read. */
 internal data class Metric(
     val latest: Double?,
+    val latestDay: String?,
     val typical: Double?,
     val series: List<Double>,
-)
+) {
+
+    companion object {
+        /** #1946: the caption for a metric tile whose `latest` value was carried from a prior day.
+         *  Returns null when the value is NOT carried (today's own, or no value) so the caller falls
+         *  through to the normal "vs typical" caption. When carried, returns a [DisplayText.Resource]
+         *  so the string lives in `strings.xml` where the i18n audit and the locale files can see it
+         *  — matching [carriedCaption] in TodayScoring, which solved the same problem for the Today
+         *  carry stamp. Mirror EXACTLY in Swift. */
+        fun carriedMetricCaption(latestDay: String?, latest: Double?): DisplayText? {
+            if (latestDay == null || latest == null) return null
+            return DisplayText.Resource(
+                R.string.sleep_carried_metric_caption,
+                listOf(shortDayLabel(latestDay)),
+            )
+        }
+
+        /** "12 Jul" for a "yyyy-MM-dd" key — the SAME format the Today carry stamp uses, so a carried
+         *  Rest on Today and a carried metric on Sleep read identically. */
+        private val dayKeyParser = java.text.SimpleDateFormat("yyyy-MM-dd", java.util.Locale.US).apply {
+            timeZone = java.util.TimeZone.getTimeZone("UTC")
+        }
+
+        fun shortDayLabel(key: String): String {
+            val date = runCatching { dayKeyParser.parse(key) }.getOrNull() ?: return key
+            val f = java.text.SimpleDateFormat("d MMM", java.util.Locale.getDefault())
+            return f.format(date)
+        }
+    }
+}
 
 /** Export-verbatim per-day sleep figures (metricSeries keys mirroring macOS WhoopImporter). */
 internal data class ImportedSleepSeries(
diff --git a/android/app/src/main/res/values-de/strings.xml b/android/app/src/main/res/values-de/strings.xml
index d4903775c6..bca1d103dc 100644
--- a/android/app/src/main/res/values-de/strings.xml
+++ b/android/app/src/main/res/values-de/strings.xml
@@ -2222,6 +2222,7 @@
     <string name="today_score_solid">STABIL</string>
     <string name="today_charge_carried">Charge-Wert · %1$s</string>
     <string name="today_recovery_carried">Erholung · %1$s</string>
+    <string name="sleep_carried_metric_caption">Übernommen · %1$s</string>
     <string name="today_show_fewer_metrics">Weniger anzeigen</string>
     <string name="today_show_all_metrics">Alle Messwerte anzeigen (%1$d)</string>
     <string name="today_hr_empty_selected_day">Keine Herzfrequenzdaten für diesen Tag. Gehe zu einem Tag zurück, an dem du den Strap getragen hast.</string>
diff --git a/android/app/src/main/res/values-es/strings.xml b/android/app/src/main/res/values-es/strings.xml
index 19bf48d2cb..906398edb4 100644
--- a/android/app/src/main/res/values-es/strings.xml
+++ b/android/app/src/main/res/values-es/strings.xml
@@ -2209,6 +2209,7 @@
     <string name="today_score_solid">SÓLIDO</string>
     <string name="today_charge_carried">Carga · %1$s</string>
     <string name="today_recovery_carried">Recuperación · %1$s</string>
+    <string name="sleep_carried_metric_caption">Heredado · %1$s</string>
     <string name="today_show_fewer_metrics">Mostrar menos</string>
     <string name="today_show_all_metrics">Mostrar todas las métricas (%1$d)</string>
     <string name="today_hr_empty_selected_day">No hay datos de frecuencia cardíaca para este día. Vuelve a un día en que llevaras la pulsera.</string>
diff --git a/android/app/src/main/res/values-fr/strings.xml b/android/app/src/main/res/values-fr/strings.xml
index 4d90e133ac..e19389c53d 100644
--- a/android/app/src/main/res/values-fr/strings.xml
+++ b/android/app/src/main/res/values-fr/strings.xml
@@ -2208,6 +2208,7 @@
     <string name="today_score_solid">FIABLE</string>
     <string name="today_charge_carried">Score de Charge · %1$s</string>
     <string name="today_recovery_carried">Récupération · %1$s</string>
+    <string name="sleep_carried_metric_caption">Reporté · %1$s</string>
     <string name="today_show_fewer_metrics">Afficher moins</string>
     <string name="today_show_all_metrics">Afficher toutes les mesures (%1$d)</string>
     <string name="today_hr_empty_selected_day">Aucune donnée de fréquence cardiaque pour ce jour. Revenez à un jour où vous portiez le bracelet.</string>
diff --git a/android/app/src/main/res/values-pl/strings.xml b/android/app/src/main/res/values-pl/strings.xml
index f02882b59b..03045b3ce2 100644
--- a/android/app/src/main/res/values-pl/strings.xml
+++ b/android/app/src/main/res/values-pl/strings.xml
@@ -2201,6 +2201,7 @@
     <string name="today_score_solid">PEWNY</string>
     <string name="today_charge_carried">Energia · %1$s</string>
     <string name="today_recovery_carried">Regeneracja · %1$s</string>
+    <string name="sleep_carried_metric_caption">Przeniesione · %1$s</string>
     <string name="today_show_fewer_metrics">Pokaż mniej</string>
     <string name="today_show_all_metrics">Pokaż wszystkie wskaźniki (%1$d)</string>
     <string name="today_hr_empty_selected_day">Brak danych tętna dla tego dnia. Wróć do dnia, w którym opaska była noszona.</string>
diff --git a/android/app/src/main/res/values-pt-rPT/strings.xml b/android/app/src/main/res/values-pt-rPT/strings.xml
index b6f0522ca6..5b4762ecf2 100644
--- a/android/app/src/main/res/values-pt-rPT/strings.xml
+++ b/android/app/src/main/res/values-pt-rPT/strings.xml
@@ -2201,6 +2201,7 @@
     <string name="today_score_solid">FIÁVEL</string>
     <string name="today_charge_carried">Carga · %1$s</string>
     <string name="today_recovery_carried">Recuperação · %1$s</string>
+    <string name="sleep_carried_metric_caption">Herdado · %1$s</string>
     <string name="today_show_fewer_metrics">Mostrar menos</string>
     <string name="today_show_all_metrics">Mostrar todas as métricas (%1$d)</string>
     <string name="today_hr_empty_selected_day">Não há dados de frequência cardíaca para este dia. Recua até um dia em que tenhas usado a pulseira.</string>
diff --git a/android/app/src/main/res/values-ru/strings.xml b/android/app/src/main/res/values-ru/strings.xml
index bbb9fee5d4..59edc85abd 100644
--- a/android/app/src/main/res/values-ru/strings.xml
+++ b/android/app/src/main/res/values-ru/strings.xml
@@ -2152,6 +2152,7 @@
     <string name="today_score_solid">Стабильный</string>
     <string name="today_charge_carried">Заряд · %1$s</string>
     <string name="today_recovery_carried">Восстановление · %1$s</string>
+    <string name="sleep_carried_metric_caption">Перенесено · %1$s</string>
     <string name="today_show_fewer_metrics">Показать меньше</string>
     <string name="today_show_all_metrics">Показать все метрики (%1$d)</string>
     <string name="today_hr_empty_selected_day">Нет пульса за этот день. Вернитесь к дню, когда браслет был надет.</string>
diff --git a/android/app/src/main/res/values-zh/strings.xml b/android/app/src/main/res/values-zh/strings.xml
index 823032f7ab..8eccde2552 100644
--- a/android/app/src/main/res/values-zh/strings.xml
+++ b/android/app/src/main/res/values-zh/strings.xml
@@ -2132,6 +2132,7 @@
     <string name="today_score_solid">可靠</string>
     <string name="today_charge_carried">充能 · %1$s</string>
     <string name="today_recovery_carried">恢复 · %1$s</string>
+    <string name="sleep_carried_metric_caption">携带 · %1$s</string>
     <string name="today_show_fewer_metrics">收起</string>
     <string name="today_show_all_metrics">显示全部指标（%1$d）</string>
     <string name="today_hr_empty_selected_day">当天没有心率数据。请返回到佩戴手环的日期。</string>
diff --git a/android/app/src/main/res/values/strings.xml b/android/app/src/main/res/values/strings.xml
index b9135e909f..b447d15f6e 100644
--- a/android/app/src/main/res/values/strings.xml
+++ b/android/app/src/main/res/values/strings.xml
@@ -2327,6 +2327,7 @@
     <string name="today_score_solid">SOLID</string>
     <string name="today_charge_carried">Charge · %1$s</string>
     <string name="today_recovery_carried">Recovery · %1$s</string>
+    <string name="sleep_carried_metric_caption">Carried · %1$s</string>
     <string name="today_show_fewer_metrics">Show fewer</string>
     <string name="today_show_all_metrics">Show all metrics (%1$d)</string>
     <string name="today_hr_empty_selected_day">No heart rate for this day. Step back to a day the strap was worn.</string>
diff --git a/android/app/src/test/java/com/noop/ui/SleepCarriedStampTest.kt b/android/app/src/test/java/com/noop/ui/SleepCarriedStampTest.kt
new file mode 100644
index 0000000000..c22496a93a
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ui/SleepCarriedStampTest.kt
@@ -0,0 +1,97 @@
+package com.noop.ui
+
+import com.noop.data.DailyMetric
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/** #1946: a carried prior-night metric value must be stamped with its day so it is not passed off
+ *  as tonight's read. The [Metric] data class now carries `latestDay` alongside `latest`, and
+ *  [Metric.carriedMetricCaption] returns a [DisplayText.Resource] when the value is from a prior
+ *  day, so the string lives in `strings.xml` where the i18n audit and the locale files can see it.
+ *  Byte-parity twin of Swift `SleepCarriedStampTests`. */
+class SleepCarriedStampTest {
+
+    private fun day(d: String, resp: Double? = null, eff: Double? = null): DailyMetric =
+        DailyMetric(
+            deviceId = "test", day = d, totalSleepMin = 420.0, efficiency = eff,
+            deepMin = 80.0, remMin = 90.0, lightMin = 200.0, disturbances = null,
+            restingHr = null, avgHrv = null, recovery = null, strain = null,
+            exerciseCount = null, spo2Pct = null, skinTempDevC = null, respRateBpm = resp,
+        )
+
+    private fun metric(
+        days: List<DailyMetric>,
+        todayKey: String,
+        transform: (DailyMetric) -> Double?,
+    ): Metric {
+        val points = days.mapNotNull { d ->
+            transform(d)?.takeIf { it.isFinite() }?.let { d.day to it }
+        }
+        val series = points.map { it.second }
+        val fresh = com.noop.analytics.Baselines.freshestCarried(points, todayKey)
+        val latestDay = if (fresh != null && fresh.first != todayKey) fresh.first else null
+        return Metric(fresh?.second, latestDay, if (series.isEmpty()) null else series.average(), series)
+    }
+
+    /** Resolve a DisplayText to its raw string for assertions. */
+    private fun DisplayText?.asString(): String? = when (this) {
+        is DisplayText.Resource -> {
+            // The test runs under JVM unit tests without Android resources, so resolve the
+            // format string manually. The resource is "Carried · %1$s".
+            "Carried · ${args.joinToString("")}"
+        }
+        is DisplayText.Dynamic -> value
+        null -> null
+    }
+
+    /** A value from TODAY's own day is NOT carried — `latestDay` is null, no stamp. */
+    @Test fun todayValueIsNotCarried() {
+        val days = listOf(day("2026-08-13", resp = 15.6))
+        val resp = metric(days, "2026-08-13") { it.respRateBpm }
+        assertEquals(15.6, resp.latest!!, 1e-9)
+        assertNull("today's own value must not be marked as carried", resp.latestDay)
+        assertNull(Metric.carriedMetricCaption(resp.latestDay, resp.latest))
+    }
+
+    /** A value from a PRIOR day within the carry window IS carried — `latestDay` is set, and the
+     *  caption stamps it as a DisplayText.Resource pointing at the string resource. */
+    @Test fun priorDayValueIsCarriedAndStamped() {
+        val days = listOf(day("2026-08-11", resp = 14.1), day("2026-08-12"))
+        val resp = metric(days, "2026-08-13") { it.respRateBpm }
+        assertEquals(14.1, resp.latest!!, 1e-9)
+        assertEquals("the carried value's source day is tracked", "2026-08-11", resp.latestDay)
+        val caption = Metric.carriedMetricCaption(resp.latestDay, resp.latest)
+        assertNotNull("a carried value must produce a stamp caption", caption)
+        assertTrue("caption must be a Resource", caption is DisplayText.Resource)
+        val resolved = caption.asString()
+        assertTrue("caption must contain 'Carried': $resolved", resolved!!.contains("Carried"))
+    }
+
+    /** A nil latest has no stamp — the tile falls through to "vs typical" or "—". */
+    @Test fun noValueHasNoStamp() {
+        assertNull(Metric.carriedMetricCaption("2026-08-11", null))
+        assertNull(Metric.carriedMetricCaption(null, 15.6))
+        assertNull(Metric.carriedMetricCaption(null, null))
+    }
+
+    /** A stale value (outside the carry window) has no latest and no stamp. */
+    @Test fun staleValueHasNoLatestAndNoStamp() {
+        val days = mutableListOf(day("2026-07-29", resp = 16.2), day("2026-07-30", resp = 15.6))
+        for (i in 1..13) days.add(day(String.format("2026-08-%02d", i)))
+        val resp = metric(days, "2026-08-13") { it.respRateBpm }
+        assertNull(resp.latest)
+        assertNull(resp.latestDay)
+        assertNull(Metric.carriedMetricCaption(resp.latestDay, resp.latest))
+    }
+
+    /** A fresh sibling metric (efficiency, present every night) is NOT carried when today has a value. */
+    @Test fun freshSiblingIsNotCarried() {
+        val days = listOf(day("2026-08-12", eff = 90.0), day("2026-08-13", eff = 88.0))
+        val eff = metric(days, "2026-08-13") { it.efficiency }
+        assertEquals(88.0, eff.latest!!, 1e-9)
+        assertNull("today's own efficiency is not carried", eff.latestDay)
+    }
+}

From 71433ae1e29ca98d94c75d5ccf5d9beea5eddecc Mon Sep 17 00:00:00 2001
From: EvoVeo Tech <evoveo.tech@gmail.com>
Date: Mon, 7 Sep 2026 18:04:11 +0530
Subject: [PATCH 328/333] sessionRestingHR: gate bins on sample count +
 plausibility before letting them win the floor (#1943)

sessionRestingHR took the minimum of 5-minute bin means unconditionally, so any
non-empty bin could win the night's resting HR: a one-sample bin at the edge of a
wear gap, or a bin whose mean was a dropout-driven sub-physiological dip. That
number is displayed, stored on the daily row, and folded into the baseline later
nights are scored against.

The now-removed RecoveryScorer.restingHR had exactly this hardening. The shipped
path never did.

A bin now qualifies to win only with at least five samples and a mean of at least
25 bpm. When nothing qualifies the floor falls back to the lowest of all bin
means, then to the all-sample mean, so a sparse but genuine night keeps a floor
rather than blanking. The fallback chain matters more than the thresholds.

The thresholds are one constant per platform, read by both the gate and its
conformance check, so a drift between the two is structurally impossible rather
than merely documented.

The rhrBinGateLogLine diagnostic reports the UNGATED floor against the shipped
one and fires only when the gate moved it. Applied the other way round it would
have gone permanently silent the moment the gate shipped, retiring the instrument
before it had ever reported on a real night. Now the gate and the measurement of
its effect land together, and the frequency question that #1943 was opened to
answer stays answerable.

Expect the first re-score to move historical resting HR on any of the last 21
nights whose floor was won by a thin or implausible bin. That is a correction
rather than a regression, and the diagnostic is what makes it legible.

Both platforms, with the constants, the fallback chain and the inversion matching
on each. Regression tests on both sides.

Author: evoveotech
---
 .../Sources/StrandAnalytics/SleepStager.swift | 79 +++++++++++------
 .../RhrBinGateDiagnosticTests.swift           | 33 ++++---
 .../SleepStagerTests.swift                    | 62 +++++++++++++
 Strand/Data/IntelligenceEngine.swift          |  3 +-
 .../com/noop/analytics/IntelligenceEngine.kt  |  4 +-
 .../java/com/noop/analytics/SleepStager.kt    | 87 ++++++++++++-------
 .../analytics/RhrBinGateDiagnosticTest.kt     | 32 ++++---
 .../SleepStagerWindowEndpointTest.kt          | 72 +++++++++++++++
 docs/ANALYTICS.md                             |  2 +-
 9 files changed, 286 insertions(+), 88 deletions(-)

diff --git a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
index 104b0fc7f4..4962a38fe9 100644
--- a/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
+++ b/Packages/StrandAnalytics/Sources/StrandAnalytics/SleepStager.swift
@@ -71,6 +71,17 @@ public struct SleepSession: Equatable, Sendable {
 
 public enum SleepStager {
 
+    // MARK: - #1943: RHR bin-gate thresholds (shared by sessionRestingHR and rhrBinGateLogLine)
+    // One constant per threshold, read by both the gate and its conformance check, so a drift
+    // between the two is structurally impossible rather than merely documented.
+
+    /// Minimum samples in a 5-min bin for it to qualify as a candidate for the night's resting HR.
+    /// A one-sample bin at the edge of a wear gap cannot become the floor.
+    public static let rhrMinBinSamples: Int = 5
+    /// Minimum plausible mean HR (bpm) for a bin to qualify. A dropout-driven sub-physiological
+    /// dip cannot become the floor.
+    public static let rhrMinPlausibleBpm: Double = 25
+
     // MARK: - Stage 0 constants (sleep.py)
 
     /// Per-sample gravity change (g) at/below which a sample is "still".
@@ -2778,36 +2789,34 @@ public enum SleepStager {
     /// the final one, which is `[t, end]`. Half-open bins alone would admit a sample sitting exactly
     /// on an aligned `end` through the prefilter and then place it in no bin — counted as data,
     /// silently ignored. A zero-length window (`start == end`) is that single closed bin.
-    /// #1943: what an artefact gate WOULD do to tonight's resting-HR floor, measured and reported without
-    /// changing it.
+    /// #1943: a conformance check that reports when the artefact gate `sessionRestingHR` applies
+    /// actually MOVED the floor. The shipped floor IS the gated floor, so comparing the gated floor
+    /// against it is silent by construction. Instead, this reports the UNGATED floor (the old rule:
+    /// min over every non-empty bin) against the shipped one, so the line fires when the gate
+    /// excluded the bin that would otherwise have won — which is exactly the frequency and magnitude
+    /// the measure-only diagnostic was meant to learn, and would never have reported otherwise.
     ///
-    /// `sessionRestingHR` takes the minimum of the 5-minute bin means unconditionally, so any non-empty
-    /// bin can win, including one built from a single sample at the edge of a wear gap. The helper deleted
-    /// alongside it had two conditions the shipped path never had: a bin may only WIN when it holds at
-    /// least `minBinSamples` samples and its mean is at least `minPlausibleBpm`. Porting them is a small
-    /// change; what nobody can currently say is how OFTEN it would move a displayed number, and that
-    /// number feeds the baseline later nights are scored against. So measure first.
+    /// `sessionRestingHR` gates bins on `rhrMinBinSamples` and `rhrMinPlausibleBpm` before letting them
+    /// win the floor, falling back to the lowest of all bin means when no bin qualifies. This helper
+    /// reproduces the same partition and the same gate, and ALSO computes the ungated floor (min over
+    /// every non-empty bin, the pre-#1943 rule) so the two can be compared.
     ///
     /// Bins are built exactly as `sessionRestingHR` builds them, closed final bin included, or the line
     /// would describe a different partition than the one it is judging.
     ///
-    /// Returns nil unless the gate would actually MOVE the floor, so the log carries only the nights the
-    /// question is about. Reporting every thin bin instead would fire on nearly all of them, because a thin
-    /// final bin is STRUCTURAL rather than an artefact: the last bin closes on `end`, so a session whose
-    /// span is not a multiple of the window holds only `span mod 300` samples there. A 1801-second night
-    /// has six 300-sample bins and a final bin of two. That bin is real data and almost never wins the
-    /// floor, so it is noise to report and, separately, something a future gate should weigh before
-    /// excluding bins on sample count alone.
+    /// Returns nil unless the gate actually MOVED the floor (ungated != shipped), so the log carries
+    /// only the nights the gate did something. If it turns out to fire on one night in fifty, that is
+    /// worth knowing; if it fires nightly, that is worth knowing sooner.
     ///
     /// The counts still ride along when the line does fire, since they are the context for the change.
     /// Same posture as the over-count-only R-R dump. Counts and bpm only, no timestamps. Pure. Twin of
     /// Kotlin `rhrBinGateLogLine`.
     public static func rhrBinGateLogLine(day: String, sessions: [(Int, Int)], hr: [HRSample],
-                                         shippedFloor: Int, minBinSamples: Int = 5,
-                                         minPlausibleBpm: Double = 25) -> String? {
+                                         shippedFloor: Int, minBinSamples: Int = rhrMinBinSamples,
+                                         minPlausibleBpm: Double = rhrMinPlausibleBpm) -> String? {
         let windowS = 5 * 60
-        var bins = 0, thin = 0, implausible = 0, bestN = 0
-        var best: Double?
+        var bins = 0, thin = 0, implausible = 0, ungatedN = 0
+        var ungated: Double?
         var gated: Double?
         for (start, end) in sessions {
             let seg = hr.filter { $0.ts >= start && $0.ts <= end }
@@ -2821,7 +2830,7 @@ public enum SleepStager {
                     let mean = Double(win.reduce(0) { $0 + $1.bpm }) / Double(win.count)
                     if win.count < minBinSamples { thin += 1 }
                     if mean < minPlausibleBpm { implausible += 1 }
-                    if best == nil || mean < best! { best = mean; bestN = win.count }
+                    if ungated == nil || mean < ungated! { ungated = mean; ungatedN = win.count }
                     if win.count >= minBinSamples, mean >= minPlausibleBpm,
                        gated == nil || mean < gated! { gated = mean }
                 }
@@ -2829,19 +2838,30 @@ public enum SleepStager {
             } while t < end
         }
         if bins == 0 { return nil }
+        let ungatedFloor = ungated.map { Int($0.rounded()) }
+        // The gate moved the floor when the ungated floor differs from the shipped one. The shipped
+        // floor IS the gated floor, so this fires when the gate excluded the bin that would have won
+        // under the old rule — which is the frequency and magnitude we want to learn.
+        let moved = ungatedFloor != nil && ungatedFloor != shippedFloor
+        if !moved { return nil }
         let gatedFloor = gated.map { Int($0.rounded()) }
-        let changes = gatedFloor != nil && gatedFloor != shippedFloor
-        if !changes { return nil }
         return "rhr bins day=\(day) bins=\(bins) thin=\(thin) implausible=\(implausible) "
-            + "winnerN=\(bestN) floor=\(shippedFloor) gated=\(gatedFloor.map(String.init) ?? "nil") "
-            + "wouldChange=\(changes) (measure-only; nothing is gated yet)"
+            + "winnerN=\(ungatedN) ungated=\(ungatedFloor.map(String.init) ?? "nil") "
+            + "gated=\(gatedFloor.map(String.init) ?? "nil") shipped=\(shippedFloor) gateMoved=\(moved)"
     }
 
     static func sessionRestingHR(start: Int, end: Int, hr: [HRSample]) -> Int? {
         let seg = hr.filter { $0.ts >= start && $0.ts <= end }
         guard !seg.isEmpty else { return nil }
         let windowS = 5 * 60
-        var means: [Double] = []
+        // #1943: a bin qualifies to WIN the floor only when it is well-populated (≥ rhrMinBinSamples)
+        // and its mean is physiologically plausible (≥ rhrMinPlausibleBpm). A one-sample bin at the
+        // edge of a wear gap, or a dropout-driven sub-physiological dip, cannot become the night's
+        // resting HR — that number is displayed, stored on the daily row, and fed to the baseline
+        // later nights are scored against. If no bin qualifies, fall back to the lowest of ALL bin
+        // means (ungated), then the all-sample mean — preserving the never-null-on-data behaviour.
+        var gatedMeans: [Double] = []
+        var allMeans: [Double] = []
         var t = start
         repeat {
             // The last bin (its half-open end reaches or passes `end`) closes on `end` instead,
@@ -2850,10 +2870,15 @@ public enum SleepStager {
             // zero-length window, where that single closed bin is the whole window.
             let isFinal = t + windowS >= end
             let win = seg.filter { $0.ts >= t && (isFinal || $0.ts < t + windowS) }
-            if !win.isEmpty { means.append(Double(win.reduce(0) { $0 + $1.bpm }) / Double(win.count)) }
+            if !win.isEmpty {
+                let mean = Double(win.reduce(0) { $0 + $1.bpm }) / Double(win.count)
+                allMeans.append(mean)
+                if win.count >= rhrMinBinSamples && mean >= rhrMinPlausibleBpm { gatedMeans.append(mean) }
+            }
             t += windowS
         } while t < end
-        if let m = means.min() { return Int(m.rounded()) }
+        if let m = gatedMeans.min() { return Int(m.rounded()) }
+        if let m = allMeans.min() { return Int(m.rounded()) }
         let all = Double(seg.reduce(0) { $0 + $1.bpm }) / Double(seg.count)
         return Int(all.rounded())
     }
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RhrBinGateDiagnosticTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RhrBinGateDiagnosticTests.swift
index f7cf4486b2..ec5b5c4a1a 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RhrBinGateDiagnosticTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/RhrBinGateDiagnosticTests.swift
@@ -2,36 +2,43 @@ import XCTest
 import WhoopProtocol
 @testable import StrandAnalytics
 
-/// #1943 measure-only: the line must describe the partition `sessionRestingHR` actually uses, and must
-/// stay silent unless an artefact gate would MOVE the floor. Byte-parity twin of Kotlin
-/// `RhrBinGateDiagnosticTest`.
+/// #1943 conformance check: the line reports when the gate MOVED the floor by comparing the UNGATED
+/// floor (the old rule: min over every non-empty bin) against the shipped one (which IS the gated
+/// floor). The line fires when the gate excluded the bin that would otherwise have won — which is
+/// the frequency and magnitude the measure-only diagnostic was meant to learn. Byte-parity twin of
+/// Kotlin `RhrBinGateDiagnosticTest`.
 final class RhrBinGateDiagnosticTests: XCTestCase {
 
     private func hr(_ start: Int, _ count: Int, _ bpm: Int) -> [HRSample] {
         (0..<count).map { HRSample(ts: start + $0, bpm: bpm) }
     }
 
-    /// A dense, ordinary night: every bin well-populated, so the gate would change nothing. Silent.
+    /// A dense, ordinary night: every bin well-populated, so the gate moves nothing. Silent.
     func testAWellPopulatedNightSaysNothing() {
         let start = 1_000, end = 1_000 + 1800
         XCTAssertNil(SleepStager.rhrBinGateLogLine(day: "2026-01-01", sessions: [(start, end)],
                                                    hr: hr(start, 1800, 60), shippedFloor: 60))
     }
 
-    /// A one-sample bin that WINS the floor is the whole point: it must be reported, and named.
-    func testAThinWinningBinIsReportedWithWhatTheGateWouldDo() {
+    /// A one-sample bin that WINS under the old rule is the whole point: the gate excludes it, so
+    /// the ungated floor (38) differs from the shipped/gated floor (60), and the line fires.
+    func testAThinWinningBinIsReportedAsGateMoved() {
         let start = 1_000, end = 1_000 + 1800
         let samples = hr(start, 1500, 60) + [HRSample(ts: start + 1700, bpm: 38)]
+        // shippedFloor is 60 — the gated floor that sessionRestingHR now ships.
         let line = SleepStager.rhrBinGateLogLine(day: "2026-01-01", sessions: [(start, end)],
-                                                 hr: samples, shippedFloor: 38)
+                                                 hr: samples, shippedFloor: 60)
         XCTAssertNotNil(line, "a thin winning bin must be reported")
         XCTAssertTrue(line!.contains("thin=1"), line!)
         XCTAssertTrue(line!.contains("winnerN=1"), line!)
-        XCTAssertTrue(line!.contains("wouldChange=true"), line!)
+        XCTAssertTrue(line!.contains("ungated=38"), line!)
         XCTAssertTrue(line!.contains("gated=60"), line!)
+        XCTAssertTrue(line!.contains("shipped=60"), line!)
+        XCTAssertTrue(line!.contains("gateMoved=true"), line!)
     }
 
-    /// A thin bin that cannot win the floor is silent: a thin FINAL bin is structural on most spans.
+    /// A thin bin that cannot win the floor even under the old rule is silent: the ungated floor
+    /// matches the shipped one, so the gate moved nothing.
     func testAThinBinThatCannotWinTheFloorIsSilent() {
         let start = 1_000, end = 1_000 + 1800
         let samples = hr(start, 1500, 60) + [HRSample(ts: start + 1700, bpm: 90)]
@@ -52,15 +59,15 @@ final class RhrBinGateDiagnosticTests: XCTestCase {
         let start = 1_700_000_000, end = 1_700_000_000 + 1800
         let samples = hr(start, 1500, 60) + [HRSample(ts: start + 1700, bpm: 38)]
         let line = SleepStager.rhrBinGateLogLine(day: "2026-01-01", sessions: [(start, end)],
-                                                 hr: samples, shippedFloor: 38)
+                                                 hr: samples, shippedFloor: 60)
         XCTAssertNotNil(line)
         XCTAssertFalse(line!.contains("17000000"), line!)
     }
 
     /// The load-bearing invariant: the line must judge the SAME partition `sessionRestingHR` ships.
-    /// Every other case hands the floor in as a literal, so none would notice the two binnings drifting.
-    /// Here the shipped floor comes FROM `sessionRestingHR`, and a mismatch surfaces as a spurious
-    /// `wouldChange`. The 1801 span is deliberate: its final bin holds two samples, structurally thin.
+    /// Here the shipped floor comes FROM `sessionRestingHR`, and the gate agrees, so the ungated
+    /// floor matches the shipped one and the line stays silent. The 1801 span is deliberate: its
+    /// final bin holds two samples, structurally thin.
     func testTheDiagnosticJudgesTheSamePartitionSessionRestingHRShips() {
         let start = 1_000
         for spanS in [1800, 1801, 1500, 300, 299] {
diff --git a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerTests.swift b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerTests.swift
index 5563ce1c3f..aac9f9147c 100644
--- a/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerTests.swift
+++ b/Packages/StrandAnalytics/Tests/StrandAnalyticsTests/SleepStagerTests.swift
@@ -923,6 +923,68 @@ final class SleepStagerTests: XCTestCase {
         }
     }
 
+    // MARK: - #1943: sessionRestingHR bin-population + plausibility gates
+
+    // A one-sample bin at a dropout bpm would have won the floor before the gate. The gate excludes
+    // it (winnerN < minBinSamples), and the floor falls back to the next-best qualifying bin.
+    func testSessionRestingHRThinBinCannotWinTheFloor() {
+        // 300 samples at 60 in the first bin (qualifies), one sample at 38 in the final bin (thin).
+        // Before #1943 the floor was 38; now the thin bin is excluded and the floor is 60.
+        var hr: [HRSample] = (0..<300).map { HRSample(ts: $0, bpm: 60) }
+        hr.append(HRSample(ts: 600, bpm: 38))
+        XCTAssertEqual(SleepStager.sessionRestingHR(start: 0, end: 600, hr: hr), 60,
+                       "a one-sample bin cannot win the floor under the #1943 gate")
+    }
+
+    // A sub-physiological mean (below 25 bpm) is excluded even when the bin is well-populated, so a
+    // dropout artefact sustained across several samples cannot become the resting HR either.
+    func testSessionRestingHRImplausibleBinCannotWinTheFloor() {
+        // 300 samples at 60 (qualifies), then 300 samples at 20 (well-populated but implausible).
+        // Before #1943 the floor was 20; now the implausible bin is excluded and the floor is 60.
+        let hr: [HRSample] = (0..<300).map { HRSample(ts: $0, bpm: 60) }
+            + (300..<600).map { HRSample(ts: $0, bpm: 20) }
+        XCTAssertEqual(SleepStager.sessionRestingHR(start: 0, end: 600, hr: hr), 60,
+                       "a sub-25 bpm bin cannot win the floor under the #1943 gate")
+    }
+
+    // When every bin is thin or implausible, the gate falls back to the lowest of ALL bin means
+    // (ungated), preserving the never-null-on-data behaviour. The floor is the same as before the
+    // gate existed.
+    func testSessionRestingHRAllBinsGatedFallsBackToUngatedMin() {
+        // Two bins, each with one sample: 40 and 50. Neither qualifies (both thin). The fallback
+        // is the min of all bin means = 40, the same value the ungated path produced.
+        let hr: [HRSample] = [HRSample(ts: 0, bpm: 40), HRSample(ts: 300, bpm: 50)]
+        XCTAssertEqual(SleepStager.sessionRestingHR(start: 0, end: 600, hr: hr), 40,
+                       "when no bin qualifies, the floor falls back to the ungated min")
+    }
+
+    // A dense, ordinary night (every bin well-populated and plausible) is unchanged by the gate.
+    func testSessionRestingHRDenseNightUnchangedByGate() {
+        let hr: [HRSample] = (0..<1800).map { HRSample(ts: $0, bpm: 60) }
+        XCTAssertEqual(SleepStager.sessionRestingHR(start: 0, end: 1800, hr: hr), 60,
+                       "a well-populated night is unchanged by the gate")
+    }
+
+    // The gate's threshold is exactly 5 samples: a bin with 5 qualifies, a bin with 4 does not.
+    func testSessionRestingHRBinSampleCountBoundary() {
+        // First bin: 300 samples at 70 (qualifies). Final bin: 4 samples at 40 (below threshold).
+        // The 4-sample bin is excluded; the floor is 70.
+        var hr: [HRSample] = (0..<300).map { HRSample(ts: $0, bpm: 70) }
+        hr.append(contentsOf: (0..<4).map { _ in HRSample(ts: 600, bpm: 40) })
+        XCTAssertEqual(SleepStager.sessionRestingHR(start: 0, end: 600, hr: hr), 70,
+                       "a 4-sample bin is below the minBinSamples=5 threshold and cannot win")
+    }
+
+    // The plausibility gate's threshold is exactly 25 bpm: a mean of 25 qualifies, 24.9 does not.
+    func testSessionRestingHRPlausibilityBoundary() {
+        // First bin: 300 samples at 60 (qualifies). Final bin: 300 samples at 24 (implausible).
+        // The 24-bpm bin is excluded; the floor is 60.
+        let hr: [HRSample] = (0..<300).map { HRSample(ts: $0, bpm: 60) }
+            + (300..<600).map { HRSample(ts: $0, bpm: 24) }
+        XCTAssertEqual(SleepStager.sessionRestingHR(start: 0, end: 600, hr: hr), 60,
+                       "a 24-bpm mean is below the minPlausibleBpm=25 threshold and cannot win")
+    }
+
     func testSessionHrvWindowsAlignedEndpointBeatsFillTheFinalWindow() {
         // 120 beats in the opening window plus three beats exactly on an aligned end = 600. The
         // second window is the final one, so it closes on `end` and holds those three beats;
diff --git a/Strand/Data/IntelligenceEngine.swift b/Strand/Data/IntelligenceEngine.swift
index cafd8ddfe4..234f60d16c 100644
--- a/Strand/Data/IntelligenceEngine.swift
+++ b/Strand/Data/IntelligenceEngine.swift
@@ -1502,7 +1502,8 @@ final class IntelligenceEngine: ObservableObject {
                         res.cachedSleep.contains { s.ts >= $0.startTs && s.ts < $0.endTs }
                     }.map { $0.bpm }
                     rhrLine = Self.rhrFloorMeanLogLine(day: res.daily.day, floor: floor, inBedBpms: inBedBpms)
-                    // #1943: and what an artefact gate would do to that floor. Silent on a clean night.
+                    // #1943: conformance check that the gate `sessionRestingHR` now applies agrees with
+                    // the shipped floor. Silent when the gate is correctly applied.
                     rhrBinLine = SleepStager.rhrBinGateLogLine(
                         day: res.daily.day,
                         sessions: res.cachedSleep.map { ($0.startTs, $0.endTs) },
diff --git a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
index d284abac4d..dd4d4e492b 100644
--- a/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
+++ b/android/app/src/main/java/com/noop/analytics/IntelligenceEngine.kt
@@ -2931,8 +2931,8 @@ object IntelligenceEngine {
     }
 
     /**
-     * The night's resting-HR diagnostic lines: the floor-vs-mean explainer, and the measure-only
-     * bin-population line beside it when there is something to say.
+     * The night's resting-HR diagnostic lines: the floor-vs-mean explainer, and the #1943
+     * conformance line beside it when the gate and the shipped floor disagree.
      *
      * Built here rather than inline in `analyzeRecentOnCpu` because that method is BUDGETED:
      * [IntelligenceEngineJacocoBudgetTest] ratchets its JaCoCo-instrumented size against the JVM's method
diff --git a/android/app/src/main/java/com/noop/analytics/SleepStager.kt b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
index 680386e722..7ab0fcb9dd 100644
--- a/android/app/src/main/java/com/noop/analytics/SleepStager.kt
+++ b/android/app/src/main/java/com/noop/analytics/SleepStager.kt
@@ -48,6 +48,18 @@ import kotlin.math.sqrt
  */
 object SleepStager {
 
+    // ── #1943: RHR bin-gate thresholds (shared by sessionRestingHR and rhrBinGateLogLine) ──────
+    // One constant per threshold, read by both the gate and its conformance check, so a drift
+    // between the two is structurally impossible rather than merely documented.
+
+    /** Minimum samples in a 5-min bin for it to qualify as a candidate for the night's resting HR.
+     *  A one-sample bin at the edge of a wear gap cannot become the floor. */
+    const val rhrMinBinSamples: Int = 5
+
+    /** Minimum plausible mean HR (bpm) for a bin to qualify. A dropout-driven sub-physiological
+     *  dip cannot become the floor. */
+    const val rhrMinPlausibleBpm: Double = 25.0
+
     // ── Stage 0 constants (sleep.py) ─────────────────────────────────────────
 
     /** Per-sample gravity change (g) at/below which a sample is "still". */
@@ -3080,26 +3092,24 @@ object SleepStager {
     // ── Per-session HR / HRV ─────────────────────────────────────────────────
 
     /**
-     * #1943: what an artefact gate WOULD do to tonight's resting-HR floor, measured and reported without
-     * changing it.
+     * #1943: a conformance check that reports when the artefact gate `sessionRestingHR` applies
+     * actually MOVED the floor. The shipped floor IS the gated floor, so comparing the gated floor
+     * against it is silent by construction. Instead, this reports the UNGATED floor (the old rule:
+     * min over every non-empty bin) against the shipped one, so the line fires when the gate
+     * excluded the bin that would otherwise have won — which is exactly the frequency and magnitude
+     * the measure-only diagnostic was meant to learn, and would never have reported otherwise.
      *
-     * [SleepStager.sessionRestingHR] takes the minimum of the 5-minute bin means unconditionally, so any
-     * non-empty bin can win, including one built from a single sample at the edge of a wear gap. The
-     * helper deleted alongside it had two conditions the shipped path never had: a bin may only WIN when
-     * it holds at least [minBinSamples] samples and its mean is at least [minPlausibleBpm]. Porting them
-     * is a small change; what nobody can currently say is how OFTEN it would move a displayed number, and
-     * that number feeds the baseline later nights are scored against. So measure first.
+     * [SleepStager.sessionRestingHR] gates bins on [rhrMinBinSamples] and [rhrMinPlausibleBpm] before
+     * letting them win the floor, falling back to the lowest of all bin means when no bin qualifies.
+     * This helper reproduces the same partition and the same gate, and ALSO computes the ungated floor
+     * (min over every non-empty bin, the pre-#1943 rule) so the two can be compared.
      *
      * Bins are built exactly as `sessionRestingHR` builds them, closed final bin included, or the line
      * would describe a different partition than the one it is judging.
      *
-     * Returns null unless the gate would actually MOVE the floor, so the log carries only the nights the
-     * question is about. Reporting every thin bin instead would fire on nearly all of them, because a thin
-     * final bin is STRUCTURAL rather than an artefact: the last bin closes on `end`, so a session whose
-     * span is not a multiple of the window holds only `span mod 300` samples there. A 1801-second night
-     * has six 300-sample bins and a final bin of two. That bin is real data and almost never wins the
-     * floor, so it is noise to report and, separately, something a future gate should weigh before
-     * excluding bins on sample count alone.
+     * Returns null unless the gate actually MOVED the floor (ungated != shipped), so the log carries
+     * only the nights the gate did something. If it turns out to fire on one night in fifty, that is
+     * worth knowing; if it fires nightly, that is worth knowing sooner.
      *
      * The counts still ride along when the line does fire, since they are the context for the change.
      * Same posture as the over-count-only R-R dump. Counts and bpm only, no timestamps. Pure. Twin of
@@ -3110,16 +3120,16 @@ object SleepStager {
         sessions: List<Pair<Long, Long>>,
         hr: List<HrSample>,
         shippedFloor: Int,
-        minBinSamples: Int = 5,
-        minPlausibleBpm: Double = 25.0,
+        minBinSamples: Int = rhrMinBinSamples,
+        minPlausibleBpm: Double = rhrMinPlausibleBpm,
     ): String? {
         val windowS = 5 * 60L
         var bins = 0
         var thin = 0
         var implausible = 0
-        var best: Double? = null          // the current rule: min over every non-empty bin
-        var bestN = 0
-        var gated: Double? = null         // the candidate rule: min over qualifying bins only
+        var ungated: Double? = null      // the pre-#1943 rule: min over every non-empty bin
+        var ungatedN = 0
+        var gated: Double? = null        // the current rule: min over qualifying bins only
         for ((start, end) in sessions) {
             val seg = hr.filter { it.ts in start..end }
             if (seg.isEmpty()) continue
@@ -3132,7 +3142,7 @@ object SleepStager {
                     val mean = win.sumOf { it.bpm }.toDouble() / win.size.toDouble()
                     if (win.size < minBinSamples) thin += 1
                     if (mean < minPlausibleBpm) implausible += 1
-                    if (best == null || mean < best!!) { best = mean; bestN = win.size }
+                    if (ungated == null || mean < ungated!!) { ungated = mean; ungatedN = win.size }
                     if (win.size >= minBinSamples && mean >= minPlausibleBpm &&
                         (gated == null || mean < gated!!)
                     ) gated = mean
@@ -3141,14 +3151,18 @@ object SleepStager {
             } while (t < end)
         }
         if (bins == 0) return null
-        // `roundToInt`, matching sessionRestingHR immediately below: this number is compared against
-        // that function's output, so the two must not round a tie differently.
+        // `roundToInt`, matching sessionRestingHR: these numbers are compared against that function's
+        // output, so the two must not round a tie differently.
+        val ungatedFloor = ungated?.roundToInt()
+        // The gate moved the floor when the ungated floor differs from the shipped one. The shipped
+        // floor IS the gated floor, so this fires when the gate excluded the bin that would have won
+        // under the old rule — which is the frequency and magnitude we want to learn.
+        val moved = ungatedFloor != null && ungatedFloor != shippedFloor
+        if (!moved) return null
         val gatedFloor = gated?.roundToInt()
-        val changes = gatedFloor != null && gatedFloor != shippedFloor
-        if (!changes) return null
         return "rhr bins day=$day bins=$bins thin=$thin implausible=$implausible " +
-            "winnerN=$bestN floor=$shippedFloor gated=${gatedFloor ?: "nil"} wouldChange=$changes " +
-            "(measure-only; nothing is gated yet)"
+            "winnerN=$ungatedN ungated=${ungatedFloor ?: "nil"} gated=${gatedFloor ?: "nil"} " +
+            "shipped=$shippedFloor gateMoved=$moved"
     }
 
     /**
@@ -3163,7 +3177,14 @@ object SleepStager {
         val seg = hr.filter { it.ts in start..end }
         if (seg.isEmpty()) return null
         val windowS = 5 * 60L
-        val means = ArrayList<Double>()
+        // #1943: a bin qualifies to WIN the floor only when it is well-populated (≥ rhrMinBinSamples)
+        // and its mean is physiologically plausible (≥ rhrMinPlausibleBpm). A one-sample bin at the
+        // edge of a wear gap, or a dropout-driven sub-physiological dip, cannot become the night's
+        // resting HR — that number is displayed, stored on the daily row, and fed to the baseline
+        // later nights are scored against. If no bin qualifies, fall back to the lowest of ALL bin
+        // means (ungated), then the all-sample mean — preserving the never-null-on-data behaviour.
+        val gatedMeans = ArrayList<Double>()
+        val allMeans = ArrayList<Double>()
         var t = start
         do {
             // The last bin (its half-open end reaches or passes `end`) closes on `end` instead,
@@ -3172,11 +3193,17 @@ object SleepStager {
             // window, where that single closed bin is the whole window.
             val isFinal = t + windowS >= end
             val win = seg.filter { it.ts >= t && (isFinal || it.ts < t + windowS) }
-            if (win.isNotEmpty()) means.add(win.sumOf { it.bpm }.toDouble() / win.size.toDouble())
+            if (win.isNotEmpty()) {
+                val mean = win.sumOf { it.bpm }.toDouble() / win.size.toDouble()
+                allMeans.add(mean)
+                if (win.size >= rhrMinBinSamples && mean >= rhrMinPlausibleBpm) gatedMeans.add(mean)
+            }
             t += windowS
         } while (t < end)
-        val m = means.minOrNull()
+        val m = gatedMeans.minOrNull()
         if (m != null) return m.roundToInt()
+        val am = allMeans.minOrNull()
+        if (am != null) return am.roundToInt()
         val all = seg.sumOf { it.bpm }.toDouble() / seg.size.toDouble()
         return all.roundToInt()
     }
diff --git a/android/app/src/test/java/com/noop/analytics/RhrBinGateDiagnosticTest.kt b/android/app/src/test/java/com/noop/analytics/RhrBinGateDiagnosticTest.kt
index 04f4cbcdab..48850bd18c 100644
--- a/android/app/src/test/java/com/noop/analytics/RhrBinGateDiagnosticTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/RhrBinGateDiagnosticTest.kt
@@ -6,16 +6,17 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 /**
- * #1943 measure-only: the line must describe the partition `sessionRestingHR` actually uses, and must
- * stay silent on a night where an artefact gate would change nothing. A diagnostic that fired every
- * night would be ignored; one that fired on the wrong bins would argue for a change on false evidence.
+ * #1943 conformance check: the line reports when the gate MOVED the floor by comparing the UNGATED
+ * floor (the old rule: min over every non-empty bin) against the shipped one (which IS the gated
+ * floor). The line fires when the gate excluded the bin that would otherwise have won — which is
+ * the frequency and magnitude the measure-only diagnostic was meant to learn.
  */
 class RhrBinGateDiagnosticTest {
 
     private fun hr(start: Long, count: Int, bpm: Int, step: Long = 1L) =
         (0 until count).map { HrSample("d", start + it * step, bpm) }
 
-    /** A dense, ordinary night: every bin well-populated, so the gate would change nothing. Silent. */
+    /** A dense, ordinary night: every bin well-populated, so the gate moves nothing. Silent. */
     @Test fun aWellPopulatedNightSaysNothing() {
         val start = 1_000L
         val end = start + 1800                       // 6 bins at 1 Hz
@@ -23,19 +24,23 @@ class RhrBinGateDiagnosticTest {
         assertNull(SleepStager.rhrBinGateLogLine("2026-01-01", listOf(start to end), samples, 60))
     }
 
-    /** A one-sample bin that WINS the floor is the whole point: it must be reported, and named. */
-    @Test fun aThinWinningBinIsReportedWithWhatTheGateWouldDo() {
+    /** A one-sample bin that WINS under the old rule is the whole point: the gate excludes it, so
+     *  the ungated floor (38) differs from the shipped/gated floor (60), and the line fires. */
+    @Test fun aThinWinningBinIsReportedAsGateMoved() {
         val start = 1_000L
         val end = start + 1800
         // Five dense bins at 60 bpm, then a single stray low sample alone in the last bin.
         val dense = hr(start, 1500, 60)
         val stray = listOf(HrSample("d", start + 1700, 38))
-        val line = SleepStager.rhrBinGateLogLine("2026-01-01", listOf(start to end), dense + stray, 38)
+        // shippedFloor is 60 — the gated floor that sessionRestingHR now ships.
+        val line = SleepStager.rhrBinGateLogLine("2026-01-01", listOf(start to end), dense + stray, 60)
         assertTrue("a thin winning bin must be reported, got: $line", line != null)
         assertTrue("must count the thin bin, got: $line", line!!.contains("thin=1"))
         assertTrue("must name the winning bin's size, got: $line", line.contains("winnerN=1"))
-        assertTrue("must say the gate would move the floor, got: $line", line.contains("wouldChange=true"))
-        assertTrue("must report the gated floor it would use instead, got: $line", line.contains("gated=60"))
+        assertTrue("must report the ungated floor, got: $line", line.contains("ungated=38"))
+        assertTrue("must report the gated floor, got: $line", line.contains("gated=60"))
+        assertTrue("must report the shipped floor, got: $line", line.contains("shipped=60"))
+        assertTrue("must say the gate moved the floor, got: $line", line.contains("gateMoved=true"))
     }
 
     /** A thin bin that does NOT win is silent: a thin FINAL bin is structural on most spans, not a finding. */
@@ -54,10 +59,9 @@ class RhrBinGateDiagnosticTest {
      * The load-bearing invariant: the line must judge the SAME partition `sessionRestingHR` ships.
      *
      * Every other case here hands the floor in as a literal, so none of them would notice the two
-     * binnings drifting apart, and a diagnostic describing a different partition than the one it is
-     * measuring would argue for a change on false evidence. Here the shipped floor comes FROM
-     * `sessionRestingHR`, and on a night where no bin is thin the gate must agree with it exactly, which
-     * the line reports by staying silent. A partition mismatch shows up as a spurious `wouldChange`.
+     * binnings drifting apart. Here the shipped floor comes FROM `sessionRestingHR`, and on a night
+     * where no bin is thin the gate must agree with it exactly, which the line reports by staying
+     * silent. A partition mismatch shows up as a spurious `gateMoved`.
      */
     @Test fun theDiagnosticJudgesTheSamePartitionSessionRestingHrShips() {
         val start = 1_000L
@@ -89,7 +93,7 @@ class RhrBinGateDiagnosticTest {
         val end = start + 1800
         val line = SleepStager.rhrBinGateLogLine(
             "2026-01-01", listOf(start to end),
-            hr(start, 1500, 60) + listOf(HrSample("d", start + 1700, 38)), 38,
+            hr(start, 1500, 60) + listOf(HrSample("d", start + 1700, 38)), 60,
         )
         assertTrue(line != null)
         assertTrue("must not leak an epoch timestamp, got: $line", !line!!.contains("17000000"))
diff --git a/android/app/src/test/java/com/noop/analytics/SleepStagerWindowEndpointTest.kt b/android/app/src/test/java/com/noop/analytics/SleepStagerWindowEndpointTest.kt
index 69ef8e7a65..a7bc6c8902 100644
--- a/android/app/src/test/java/com/noop/analytics/SleepStagerWindowEndpointTest.kt
+++ b/android/app/src/test/java/com/noop/analytics/SleepStagerWindowEndpointTest.kt
@@ -93,6 +93,78 @@ class SleepStagerWindowEndpointTest {
         }
     }
 
+    // MARK: - #1943: sessionRestingHR bin-population + plausibility gates
+
+    @Test
+    fun thinBinCannotWinTheFloor() {
+        // 300 samples at 60 in the first bin (qualifies), one sample at 38 in the final bin (thin).
+        // Before #1943 the floor was 38; now the thin bin is excluded and the floor is 60.
+        val samples = ArrayList<HrSample>()
+        for (i in 0 until 300) samples.add(hr(i.toLong(), 60))
+        samples.add(hr(600L, 38))
+        assertEquals(
+            "a one-sample bin cannot win the floor under the #1943 gate",
+            60, SleepStager.sessionRestingHR(0L, 600L, samples)
+        )
+    }
+
+    @Test
+    fun implausibleBinCannotWinTheFloor() {
+        // 300 samples at 60 (qualifies), then 300 samples at 20 (well-populated but implausible).
+        // Before #1943 the floor was 20; now the implausible bin is excluded and the floor is 60.
+        val samples = ArrayList<HrSample>()
+        for (i in 0 until 300) samples.add(hr(i.toLong(), 60))
+        for (i in 300 until 600) samples.add(hr(i.toLong(), 20))
+        assertEquals(
+            "a sub-25 bpm bin cannot win the floor under the #1943 gate",
+            60, SleepStager.sessionRestingHR(0L, 600L, samples)
+        )
+    }
+
+    @Test
+    fun allBinsGatedFallsBackToUngatedMin() {
+        // Two bins, each with one sample: 40 and 50. Neither qualifies (both thin). The fallback
+        // is the min of all bin means = 40, the same value the ungated path produced.
+        val samples = listOf(hr(0L, 40), hr(300L, 50))
+        assertEquals(
+            "when no bin qualifies, the floor falls back to the ungated min",
+            40, SleepStager.sessionRestingHR(0L, 600L, samples)
+        )
+    }
+
+    @Test
+    fun denseNightUnchangedByGate() {
+        val samples = (0 until 1800).map { hr(it.toLong(), 60) }
+        assertEquals(
+            "a well-populated night is unchanged by the gate",
+            60, SleepStager.sessionRestingHR(0L, 1800L, samples)
+        )
+    }
+
+    @Test
+    fun binSampleCountBoundary() {
+        // First bin: 300 samples at 70 (qualifies). Final bin: 4 samples at 40 (below threshold).
+        val samples = ArrayList<HrSample>()
+        for (i in 0 until 300) samples.add(hr(i.toLong(), 70))
+        for (i in 0 until 4) samples.add(hr(600L, 40))
+        assertEquals(
+            "a 4-sample bin is below the minBinSamples=5 threshold and cannot win",
+            70, SleepStager.sessionRestingHR(0L, 600L, samples)
+        )
+    }
+
+    @Test
+    fun plausibilityBoundary() {
+        // First bin: 300 samples at 60 (qualifies). Final bin: 300 samples at 24 (implausible).
+        val samples = ArrayList<HrSample>()
+        for (i in 0 until 300) samples.add(hr(i.toLong(), 60))
+        for (i in 300 until 600) samples.add(hr(i.toLong(), 24))
+        assertEquals(
+            "a 24-bpm mean is below the minPlausibleBpm=25 threshold and cannot win",
+            60, SleepStager.sessionRestingHR(0L, 600L, samples)
+        )
+    }
+
     @Test
     fun alignedEndpointBeatsFillTheFinalHrvWindow() {
         // 120 beats in the opening window plus three beats exactly on an aligned end = 600. The
diff --git a/docs/ANALYTICS.md b/docs/ANALYTICS.md
index 38c452fce2..a59079c26b 100644
--- a/docs/ANALYTICS.md
+++ b/docs/ANALYTICS.md
@@ -331,7 +331,7 @@ Consecutive same-stage epochs are merged into `StageSegment`s tiling `[start, en
 
 ### Per-session resting HR and HRV
 
-`sessionRestingHR` is the **minimum of 5-minute non-overlapping bin means** of the HR samples in `[start, end]` — "lowest sustained HR", which rejects single-beat dips while capturing the night's true floor. With no bin populated it falls back to the all-sample mean, so a session with data never scores nil. `sessionHrvWindows` tumbles the same 5-minute grid over the RR series, cleans each bucket (range filter + Malik ectopic rejection, gap-aware) and emits one window per bin tagged with the stage at its center; `sessionAvgHRV` is the mean of those window RMSSDs. These two are the shipped source of the per-session `restingHR` / `avgHRV`, of the HRV nightly trace and of the last-deep-run comparator.
+`sessionRestingHR` is the **minimum of 5-minute non-overlapping bin means** of the HR samples in `[start, end]` — "lowest sustained HR", which rejects single-beat dips while capturing the night's true floor. A bin qualifies to win only when it holds at least 5 samples and its mean is at least 25 bpm (#1943), so a one-sample bin at the edge of a wear gap or a dropout-driven sub-physiological dip cannot become the night's resting HR. When no bin qualifies, the floor falls back to the lowest of all bin means (ungated), then the all-sample mean, so a session with data never scores nil. `sessionHrvWindows` tumbles the same 5-minute grid over the RR series, cleans each bucket (range filter + Malik ectopic rejection, gap-aware) and emits one window per bin tagged with the stage at its center; `sessionAvgHRV` is the mean of those window RMSSDs. These two are the shipped source of the per-session `restingHR` / `avgHRV`, of the HRV nightly trace and of the last-deep-run comparator.
 
 **Window endpoint rule.** The session window is closed at both ends, so the binning is too: bins are `[t, t + 300)` except the last one, which is `[t, end]`. A sample or beat sitting exactly on an aligned `end` passes the `[start, end]` prefilter, so it must land in a bin rather than be admitted and then dropped. A zero-length window (`start == end`) is that single closed bin. Bin start times, the stage-tagging center and the RMSSD math are unaffected.
 

From d6cc5882d7a607542a647f61d60ec3e11c8571aa Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 8 Sep 2026 00:35:47 +1200
Subject: [PATCH 329/333] build: testing build 458 / 339

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index aee753b7d9..25ecded31a 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 457
+        versionCode = 458
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 6efbe651fb..8b559b605a 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "338"
+    CURRENT_PROJECT_VERSION: "339"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 7e7972a0d8533c52f396032ef411b026b9244aa9 Mon Sep 17 00:00:00 2001
From: Pipiche <8291674+pipiche38@users.noreply.github.com>
Date: Mon, 7 Sep 2026 14:54:30 +0200
Subject: [PATCH 330/333] fix(sleep): drop a stagesJSON write that would make a
 stored night less complete

upsertSleepSessions took whatever stagesJSON a caller passed, unconditionally,
whenever the stored row was not userEdited. A device can serve the same night's
hypnogram more than once - a reconnect mid-day, a resumed drain - and nothing
compared the new payload against what was already there.

Reproduced from a real .noopbak pair. Same primary key, same startTs: a
96-segment full night replaced in place by a 5-segment tail covering about a
tenth of its own claimed span, with efficiency recomputed off just that slice and
so reading 99%. No second row, no userEdited interaction. The surviving segments
were correctly decoded; they were simply the wrong ten percent.

Before the write, the candidate's stage-timeline richness is compared against the
stored row's on the same 0/1/2 scale SleepMerge already uses to pick a day's best
session for display. A strictly less complete candidate is dropped WHOLE rather
than partially applied, so the row never ends up with old stages beside a new
efficiency, which would be worse than either input.

Equal richness still writes, so an ordinary refresh updates in place and a row
cannot freeze. A userEdited row is untouched either way: the guard engages only
when both sides are non-edited, and a hand-correction still wins from either
direction.

It lives in the store rather than in a caller deliberately. A guard in one caller
protects one caller, and there are several on each platform.

One consequence worth knowing: a non-userEdited row's stagesJSON can no longer be
reduced or cleared, so a night staged wrongly but completely is sticky until a
user edit or a delete. Richness is the only proxy available and more stages is
almost always the better night, but it is a real trade rather than a free win.

Android is untouched and needs a different shape, since Room's @Upsert has no
per-field CASE to extend. Tracked, along with the wider finding that Android has
no store-level userEdited preservation either and relies on each caller to filter
edited sessions.

Author: pipiche38
---
 .../Sources/WhoopStore/MetricsCache.swift     | 30 +++++++
 .../WhoopStoreTests/MetricsCacheTests.swift   | 78 ++++++++++++++++++-
 2 files changed, 105 insertions(+), 3 deletions(-)

diff --git a/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift b/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift
index 45d9eac17a..f519632d38 100644
--- a/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift
+++ b/Packages/WhoopStore/Sources/WhoopStore/MetricsCache.swift
@@ -198,11 +198,29 @@ extension WhoopStore {
     // MARK: - Upserts (idempotent by natural key; latest server value wins on conflict)
 
     /// Upsert cached sleep sessions. Natural key (deviceId, startTs). Returns rows changed.
+    ///
+    /// A non-user-edited candidate whose stage timeline is LESS complete than what's already stored for
+    /// the same (deviceId, startTs) is dropped whole rather than written: a device can serve the same
+    /// night's hypnogram more than once (a reconnect mid-day, a resumed drain), and a later, shorter
+    /// decode has no business overwriting an earlier, fuller one — the two would otherwise silently
+    /// disagree on `stagesJSON` vs. `efficiency`/`endTs` for the same row. `HypnogramCoverage`'s 0/1/2
+    /// richness rank (none / holed / covers-its-span) is the same scale `SleepMerge` already judges a
+    /// day's best session on for DISPLAY; this applies the identical comparison at WRITE time so it
+    /// protects every caller (BLE live sources, importers, recomputes), not just the ones a caller
+    /// happens to gate behind their own dedup toggle.
     @discardableResult
     public func upsertSleepSessions(_ sessions: [CachedSleepSession], deviceId: String) async throws -> Int {
         try syncWrite { db in
             var n = 0
             for s in sessions {
+                if !s.userEdited, let existing = try Self.storedSleepSession(db, deviceId: deviceId, startTs: s.startTs),
+                   !existing.userEdited {
+                    let candidate = CachedSleepSession(startTs: s.startTs, endTs: s.endTs, efficiency: nil,
+                                                       restingHr: nil, avgHrv: nil, stagesJSON: s.stagesJSON)
+                    if SleepMerge.richness(candidate) < SleepMerge.richness(existing) {
+                        continue   // a less-complete re-serve of this night must never clobber the stored one
+                    }
+                }
                 try db.execute(sql: """
                     INSERT INTO sleepSession
                         (deviceId, startTs, endTs, efficiency, restingHr, avgHrv, stagesJSON,
@@ -231,6 +249,18 @@ extension WhoopStore {
         }
     }
 
+    /// The stored row at (deviceId, startTs), or nil when there is none yet — the completeness check
+    /// `upsertSleepSessions` runs before deciding whether a candidate may overwrite it. Only the fields
+    /// that check needs are read; `efficiency`/`restingHr`/`avgHrv` are left nil since richness never
+    /// looks at them.
+    private static func storedSleepSession(_ db: Database, deviceId: String, startTs: Int) throws -> CachedSleepSession? {
+        guard let row = try Row.fetchOne(db, sql: """
+            SELECT endTs, stagesJSON, userEdited FROM sleepSession WHERE deviceId = ? AND startTs = ?
+            """, arguments: [deviceId, startTs]) else { return nil }
+        return CachedSleepSession(startTs: startTs, endTs: row["endTs"], efficiency: nil, restingHr: nil,
+                                  avgHrv: nil, stagesJSON: row["stagesJSON"], userEdited: row["userEdited"])
+    }
+
     /// Hand-correct a sleep session's bed (onset) and/or wake (end) time. Sets `userEdited = 1` so the
     /// next recompute/import `upsertSleepSessions` preserves the corrected bounds instead of overwriting
     /// them with the strap-detected values. Keyed by the stable detected natural key
diff --git a/Packages/WhoopStore/Tests/WhoopStoreTests/MetricsCacheTests.swift b/Packages/WhoopStore/Tests/WhoopStoreTests/MetricsCacheTests.swift
index f6cb7d549a..bd7fb5a0fc 100644
--- a/Packages/WhoopStore/Tests/WhoopStoreTests/MetricsCacheTests.swift
+++ b/Packages/WhoopStore/Tests/WhoopStoreTests/MetricsCacheTests.swift
@@ -32,15 +32,87 @@ final class MetricsCacheTests: XCTestCase {
         XCTAssertEqual(rows.count, 1)
         XCTAssertEqual(rows[0], s)
 
-        // Re-upsert the same natural key with updated values → no duplicate, value updated.
+        // Re-upsert the same natural key with updated values, stages covering their (shorter) new span
+        // just as fully as before → no duplicate, value updated (an ordinary refresh, not a regression).
         let s2 = CachedSleepSession(startTs: 1000, endTs: 6000, efficiency: 0.95,
-                                    restingHr: 50, avgHrv: 70.0, stagesJSON: nil)
+                                    restingHr: 50, avgHrv: 70.0,
+                                    stagesJSON: "[{\"start\":1000,\"end\":6000,\"stage\":\"light\"}]")
         try await store.upsertSleepSessions([s2], deviceId: "devA")
         rows = try await store.sleepSessions(deviceId: "devA", from: 0, to: 100_000, limit: 100)
         XCTAssertEqual(rows.count, 1, "same (deviceId,startTs) must not duplicate")
         XCTAssertEqual(rows[0].endTs, 6000)
         XCTAssertEqual(rows[0].efficiency, 0.95)
-        XCTAssertNil(rows[0].stagesJSON)
+        XCTAssertEqual(rows[0].stagesJSON, s2.stagesJSON)
+    }
+
+    /// A candidate whose stage timeline is LESS complete than what's already stored for the same
+    /// (deviceId, startTs) must be dropped whole — a device serving the same night's hypnogram twice (a
+    /// reconnect mid-day, a resumed drain) must never have its later, thinner decode clobber an earlier,
+    /// fuller one. Reproduces the exact shape of a real incident: a full-night hypnogram (96 segments,
+    /// fully covering its span) overwritten by a 5-segment tail slice covering only ~10% of the same
+    /// claimed span.
+    func testUpsertSleepSessionsDropsALessCompleteCandidate() async throws {
+        let store = try await WhoopStore.inMemory()
+        let full = CachedSleepSession(startTs: 1_000_000, endTs: 1_032_531, efficiency: 0.886,
+                                      restingHr: 50, avgHrv: 60,
+                                      stagesJSON: "[{\"start\":1000000,\"end\":1032531,\"stage\":\"light\"}]")
+        try await store.upsertSleepSessions([full], deviceId: "oura-ring")
+
+        // Same night, same key, but the "candidate" only covers the tail ~10% of the claimed span —
+        // holed, per HypnogramCoverage — with a bogus efficiency recomputed off just that slice.
+        let holedTail = CachedSleepSession(startTs: 1_000_000, endTs: 1_032_532, efficiency: 0.99,
+                                           restingHr: 48, avgHrv: 58,
+                                           stagesJSON: "[{\"start\":1029411,\"end\":1032532,\"stage\":\"rem\"}]")
+        try await store.upsertSleepSessions([holedTail], deviceId: "oura-ring")
+
+        let rows = try await store.sleepSessions(deviceId: "oura-ring", from: 0, to: 2_000_000, limit: 100)
+        XCTAssertEqual(rows.count, 1)
+        XCTAssertEqual(rows[0], full, "the fuller, previously-stored night must survive untouched")
+    }
+
+    /// The mirror case: a candidate that IMPROVES on a holed stored row (fills in more of the same span)
+    /// must still win — the guard compares richness, it does not freeze the row forever.
+    func testUpsertSleepSessionsAcceptsAMoreCompleteCandidate() async throws {
+        let store = try await WhoopStore.inMemory()
+        let holed = CachedSleepSession(startTs: 1_000_000, endTs: 1_032_531, efficiency: 0.5,
+                                       restingHr: 50, avgHrv: 60,
+                                       stagesJSON: "[{\"start\":1000000,\"end\":1004000,\"stage\":\"light\"}]")
+        try await store.upsertSleepSessions([holed], deviceId: "oura-ring")
+
+        let full = CachedSleepSession(startTs: 1_000_000, endTs: 1_032_531, efficiency: 0.886,
+                                      restingHr: 48, avgHrv: 58,
+                                      stagesJSON: "[{\"start\":1000000,\"end\":1032531,\"stage\":\"light\"}]")
+        try await store.upsertSleepSessions([full], deviceId: "oura-ring")
+
+        let rows = try await store.sleepSessions(deviceId: "oura-ring", from: 0, to: 2_000_000, limit: 100)
+        XCTAssertEqual(rows.count, 1)
+        XCTAssertEqual(rows[0], full, "a candidate that covers more of the night must still win")
+    }
+
+    /// The completeness guard must never engage for a user-edited row — `applySleepEdit`'s bounds/stages
+    /// are the dedicated correction path, and `upsertSleepSessions` already protects them unconditionally
+    /// regardless of richness. (Guards against the new check accidentally widening what "protected" means.)
+    func testUpsertSleepSessionsGuardNeverOverridesUserEditedProtection() async throws {
+        let store = try await WhoopStore.inMemory()
+        let full = CachedSleepSession(startTs: 1_000_000, endTs: 1_032_531, efficiency: 0.886,
+                                      restingHr: 50, avgHrv: 60,
+                                      stagesJSON: "[{\"start\":1000000,\"end\":1032531,\"stage\":\"light\"}]")
+        try await store.upsertSleepSessions([full], deviceId: "oura-ring")
+        _ = try await store.applySleepEdit(deviceId: "oura-ring", detectedStartTs: 1_000_000,
+                                           newStartTs: 1_000_000, newEndTs: 1_032_531,
+                                           stagesJSON: "[{\"start\":1000000,\"end\":1032531,\"stage\":\"deep\"}]")
+
+        // A richer-still re-decode arrives; the user's edit must still win untouched.
+        let richer = CachedSleepSession(startTs: 1_000_000, endTs: 1_032_531, efficiency: 0.9,
+                                        restingHr: 47, avgHrv: 57,
+                                        stagesJSON: "[{\"start\":1000000,\"end\":1016000,\"stage\":\"light\"}," +
+                                                    "{\"start\":1016000,\"end\":1032531,\"stage\":\"rem\"}]")
+        try await store.upsertSleepSessions([richer], deviceId: "oura-ring")
+
+        let rows = try await store.sleepSessions(deviceId: "oura-ring", from: 0, to: 2_000_000, limit: 100)
+        XCTAssertEqual(rows.count, 1)
+        XCTAssertTrue(rows[0].userEdited)
+        XCTAssertEqual(rows[0].stagesJSON, "[{\"start\":1000000,\"end\":1032531,\"stage\":\"deep\"}]")
     }
 
     /// #345: the persisted sparse-coverage flag survives write→read, REFRESHES on a recompute (excluded

From e59a641fabeafc352df964c818d7a600a09fd6f4 Mon Sep 17 00:00:00 2001
From: Fanboynz <mp3geek@gmail.com>
Date: Tue, 8 Sep 2026 00:54:47 +1200
Subject: [PATCH 331/333] build: testing build 459 / 340

---
 android/app/build.gradle.kts | 2 +-
 project.yml                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/android/app/build.gradle.kts b/android/app/build.gradle.kts
index 25ecded31a..30bafcf48d 100644
--- a/android/app/build.gradle.kts
+++ b/android/app/build.gradle.kts
@@ -26,7 +26,7 @@ android {
         applicationId = "com.noop.whoop"
         minSdk = 26
         targetSdk = 34
-        versionCode = 458
+        versionCode = 459
         versionName = "11.1.1"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
diff --git a/project.yml b/project.yml
index 8b559b605a..c6d41aeea6 100644
--- a/project.yml
+++ b/project.yml
@@ -21,7 +21,7 @@ settings:
     # iOS build number (CFBundleVersion). GLOBAL so the iOS app AND its widget extension inherit the
     # SAME value — they must match or iOS warns "extension version must match parent app" (#416).
     # macOS sets its own CFBundleVersion on the Strand target and is unaffected by this.
-    CURRENT_PROJECT_VERSION: "339"
+    CURRENT_PROJECT_VERSION: "340"
     SWIFT_VERSION: "5.0"
     # Emit localizable strings so Xcode auto-extracts every LocalizedStringKey into the
     # String Catalog on build (the English (US) base entries).

From 81da85cbd6032e461b5033f1df4cee08f2810797 Mon Sep 17 00:00:00 2001
From: Bernd Helm <helm@rw23.de>
Date: Tue, 8 Sep 2026 02:09:42 +0200
Subject: [PATCH 332/333] fix(protocol): propagate the full frame integrity
 verdict to every consumer

The frame verifiers computed a combined integrity result (header checksum,
payload CRC32, structural length) but the parsers discarded it and returned a
constant ok=true; downstream gates only rejected a proven-bad payload CRC, so
bad-header and unverifiable frames drove live state and history metadata.

ParsedFrame now carries the verifier's full verdict plus a non-optional
rejection reason on both platforms; family minimum and exact lengths are
enforced in the verifier; inner field reads are bounded by the CRC trailer;
the six state-driving gates (router, historical classifier, stream/history
extraction, clock correlation, data-range reply, offload) require the full
verdict; evidence-preserving readers keep archiving rejected frames; a shared
Swift-generated oracle pins verdict, reason and history classification on
both sides; the Python capture tools apply the same family minimums and
filter on the full verdict; docs updated.

Fixes bhelm/noop#5.
---
 .../Sources/WhoopProtocol/DataRange.swift     |  19 +
 .../WhoopProtocol/FrameDiagnostics.swift      | 138 ++++
 .../Sources/WhoopProtocol/Framing.swift       | 156 +++-
 .../WhoopProtocol/HistoricalMeta.swift        |  12 +-
 .../WhoopProtocol/HistoricalStreams.swift     |  46 +-
 .../Sources/WhoopProtocol/Interpreter.swift   | 313 ++++---
 .../Sources/WhoopProtocol/PostHooks.swift     | 124 ++-
 .../Sources/WhoopProtocol/PuffinCapture.swift |  51 +-
 .../Sources/WhoopProtocol/ReTools.swift       |  23 +-
 .../Sources/WhoopProtocol/Streams.swift       |   7 +-
 .../Sources/whoop-decode/main.swift           |  42 +-
 .../WhoopProtocol/Sources/whoop-re/main.swift |  12 +-
 .../WhoopProtocolTests/DataRangeTests.swift   |  65 ++
 .../DeviceConfigReadProbeTests.swift          |  34 +
 .../FastPathParityTests.swift                 |  11 +-
 .../FeatureFlagProbeTests.swift               |  33 +
 .../FrameDiagnosticsTests.swift               | 218 +++++
 .../FrameIntegrityOracleTests.swift           | 203 +++++
 .../FrameIntegrityTests.swift                 | 402 +++++++++
 .../WhoopProtocolTests/FramingTests.swift     |  12 +-
 .../HistoricalMetaTests.swift                 | 105 +++
 .../HistoricalV24Tests.swift                  |   7 +-
 .../WhoopProtocolTests/ReToolsTests.swift     |  29 +-
 .../RejectedHistoryTests.swift                |  94 +++
 .../Resources/frame_integrity_oracle.json     | 498 ++++++++++++
 .../WhoopProtocolTests/StreamsTests.swift     |  54 ++
 .../WhoopProtocolTests/Whoop5EcgTests.swift   |  26 +
 .../Whoop5RawOpticalTests.swift               |  25 +
 Strand/BLE/BLEManager.swift                   |  97 ++-
 Strand/BLE/FrameRouter.swift                  |  94 ++-
 Strand/Collect/ClockCorrelation.swift         |  15 +-
 .../AppTargetFrameCorpusIntegrityTests.swift  |  74 ++
 StrandTests/BackfillMetaForgeryTests.swift    | 180 ++++
 StrandTests/FrameIntegrityGateTests.swift     | 297 +++++++
 Tools/linux-capture/decode_features.py        |  25 +-
 Tools/linux-capture/test_decode_features.py   |  77 +-
 Tools/linux-capture/test_whoop_frame.py       |  65 ++
 Tools/linux-capture/whoop_frame.py            |  21 +-
 .../java/com/noop/ble/FrameRejectTally.kt     | 143 ++++
 .../java/com/noop/ble/UnbondedOffloadProbe.kt |  20 +-
 .../main/java/com/noop/ble/WhoopBleClient.kt  | 141 +++-
 .../com/noop/protocol/BackfillCaptureJsonl.kt |  45 +
 .../noop/protocol/BackfillCaptureSummary.kt   |  29 +-
 .../main/java/com/noop/protocol/DataRange.kt  |  20 +
 .../main/java/com/noop/protocol/Framing.kt    | 419 +++++++---
 .../com/noop/protocol/HistoricalStreams.kt    | 196 +++--
 .../java/com/noop/protocol/ParsedFrame.kt     |  33 +-
 .../main/java/com/noop/protocol/Streams.kt    |   6 +-
 .../main/java/com/noop/protocol/Whoop5Ecg.kt  |  33 +-
 .../test/java/com/noop/ble/FrameGateTest.kt   | 235 ++++++
 .../noop/ble/FrameRejectDiagnosticsTest.kt    | 296 +++++++
 .../java/com/noop/ble/Whoop5OffloadTest.kt    |  30 +-
 .../noop/protocol/FrameIntegrityOracleTest.kt | 208 +++++
 .../com/noop/protocol/FrameIntegrityTest.kt   | 768 ++++++++++++++++++
 .../java/com/noop/protocol/FramingTest.kt     |  11 +-
 .../resources/frame_integrity_oracle.json     | 498 ++++++++++++
 docs/ANDROID.md                               |  43 +-
 docs/BLE_REVERSE_ENGINEERING.md               |  14 +
 docs/CONTRIBUTING.md                          |  50 +-
 docs/LIBRARY.md                               |  41 +-
 docs/PRIVACY_SECURITY.md                      |  74 +-
 docs/PROTOCOL.md                              | 133 ++-
 62 files changed, 6641 insertions(+), 549 deletions(-)
 create mode 100644 Packages/WhoopProtocol/Sources/WhoopProtocol/FrameDiagnostics.swift
 create mode 100644 Packages/WhoopProtocol/Tests/WhoopProtocolTests/FrameDiagnosticsTests.swift
 create mode 100644 Packages/WhoopProtocol/Tests/WhoopProtocolTests/FrameIntegrityOracleTests.swift
 create mode 100644 Packages/WhoopProtocol/Tests/WhoopProtocolTests/FrameIntegrityTests.swift
 create mode 100644 Packages/WhoopProtocol/Tests/WhoopProtocolTests/Resources/frame_integrity_oracle.json
 create mode 100644 StrandTests/AppTargetFrameCorpusIntegrityTests.swift
 create mode 100644 StrandTests/BackfillMetaForgeryTests.swift
 create mode 100644 StrandTests/FrameIntegrityGateTests.swift
 create mode 100644 android/app/src/main/java/com/noop/ble/FrameRejectTally.kt
 create mode 100644 android/app/src/test/java/com/noop/ble/FrameGateTest.kt
 create mode 100644 android/app/src/test/java/com/noop/ble/FrameRejectDiagnosticsTest.kt
 create mode 100644 android/app/src/test/java/com/noop/protocol/FrameIntegrityOracleTest.kt
 create mode 100644 android/app/src/test/java/com/noop/protocol/FrameIntegrityTest.kt
 create mode 100644 android/app/src/test/resources/frame_integrity_oracle.json

diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/DataRange.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/DataRange.swift
index ca2ee57e94..e9dce4abfa 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/DataRange.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/DataRange.swift
@@ -88,6 +88,25 @@ public enum DataRange {
         return behind
     }
 
+    /// The BLE seam's decision on a GET_DATA_RANGE COMMAND_RESPONSE: is this a reply to `opcode`, and
+    /// may it move state? A reply is accepted only on the verifier's FULL verdict.
+    ///
+    /// This one reply does not merely report a timestamp: `newestUnix`/`oldestUnix` become the window
+    /// every drained record of the same sync is checked against (#547). A damaged reply that narrows
+    /// the window makes the real records fall through it — the section persists nothing and is acked
+    /// anyway, which is the permanent loss the integrity gate exists to stop. So the gate belongs to
+    /// this decision, not to the seam that happens to host it: as a predicate it is testable off the
+    /// app target, where nothing compiles the seam.
+    ///
+    /// `verdictOK` is the FULL verdict of the single parse the caller already holds, taken lazily so a
+    /// frame that is not this reply costs one byte compare and no parse. The opcode is passed in rather
+    /// than restated here: the command table lives with the caller.
+    public static func acceptsReply(_ frame: [UInt8], cmdOff: Int, opcode: UInt8,
+                                    verdictOK: @autoclosure () -> Bool) -> Bool {
+        guard cmdOff >= 0, cmdOff < frame.count, frame[cmdOff] == opcode else { return false }
+        return verdictOK()
+    }
+
     /// True when a GET_DATA_RANGE COMMAND_RESPONSE is the `PENDING(2)` acknowledgement rather than the
     /// answer. The strap replies twice: a short PENDING ack, then the payload with `SUCCESS(1)`. Framing's
     /// own result-code table already states it — "2=PENDING precedes SUCCESS on GET_DATA_RANGE
diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/FrameDiagnostics.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/FrameDiagnostics.swift
new file mode 100644
index 0000000000..2215082b73
--- /dev/null
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/FrameDiagnostics.swift
@@ -0,0 +1,138 @@
+import Foundation
+
+// Diagnosis for the frame-integrity gate: what a rejected frame still tells us, how often each reason
+// occurred, and how a frame is rendered for a human. All pure and app-free, so the counters and the
+// inspector's line are covered by `swift test` rather than only by running the tool.
+
+public extension ParsedFrame {
+    /// Whether the decoder got a PACKET TYPE out of this frame — the parseability question, which is
+    /// NOT the integrity question `ok` answers.
+    ///
+    /// The two used to be the same value, so every diagnostic surface that wanted "did this decode?"
+    /// read `ok`. Now `ok` means "header checksum, payload CRC32 and structural length all agree", and
+    /// reading it as parseability would blank the packet type of exactly the frames a capture exists to
+    /// map: a frame with a flipped header byte still decodes its type, its sequence number and its
+    /// fields, and losing that in the record is losing the evidence.
+    ///
+    /// True when the parse produced a real type name rather than the `INVALID/FRAGMENT` placeholder the
+    /// parsers return for a byte run below the family minimum or without a start-of-frame byte.
+    var isParsable: Bool { typeName != ParsedFrame.unparsableTypeName }
+
+    /// The placeholder type name both parsers use for a byte run they could not read at all.
+    static var unparsableTypeName: String { "INVALID/FRAGMENT" }
+
+    /// True for the frame class that passed the gates BEFORE this change: the payload CRC32 verified,
+    /// but the envelope did not — a wrong header checksum, a declared length below the family minimum,
+    /// a truncated frame or one with trailing bytes.
+    ///
+    /// It is deliberately read off the parse result and needs no second verification: both values are
+    /// already on the frame the consumer was handed.
+    var payloadCRCOKButEnvelopeRejected: Bool { !ok && crcOK == true }
+}
+
+/// Per-reason rejection counters for one connection, plus the ONE extra named counter the hardware run
+/// is read from.
+///
+/// Why a plain per-reason count is not enough (D3): the abort criterion for the hardware run is a
+/// CONJUNCTION — "header checksum or length wrong WHILE the payload CRC32 verifies" — and no single
+/// reason bucket can express it. The length bucket in particular also collects the harmless resyncs
+/// after a lost notification, which were happening before this change too. So
+/// `payloadCRCOKButEnvelopeRejected` is counted separately; it is the class that used to pass, and thus
+/// the cleanest regression signal.
+///
+/// Counted per reason only — NOT additionally per device family. A connection talks to exactly one
+/// strap, so a family dimension would be constant.
+///
+/// A tally asserts only what it observed: an unverifiable payload CRC32 is counted as
+/// `payloadCRCUnverifiable`, never folded into `payloadCRCMismatch`. "Could not be checked" is not
+/// "was wrong".
+public struct FrameRejectTally: Equatable, Sendable {
+    /// How often each reason was the FIRST rule a frame failed. `.none` is never counted.
+    public private(set) var counts: [FrameRejectReason: Int] = [:]
+
+    /// The named class from D3: envelope rejected while the payload CRC32 verified.
+    public private(set) var payloadCRCOKButEnvelopeRejected = 0
+
+    /// The reassembler's monotonic drop count already folded into `.belowMinimumLength`, so repeated
+    /// folds of the same counter cannot double-count.
+    private var absorbedReassemblerDrops = 0
+
+    public init() {}
+
+    /// Count one parse result. Intact frames are ignored, so this can sit on the frame path unguarded.
+    /// Returns the reason recorded, or `.none` when the frame was intact and nothing was counted.
+    @discardableResult
+    public mutating func note(_ parsed: ParsedFrame) -> FrameRejectReason {
+        guard !parsed.ok else { return .none }
+        let reason = parsed.rejectReason
+        counts[reason, default: 0] += 1
+        if parsed.payloadCRCOKButEnvelopeRejected { payloadCRCOKButEnvelopeRejected += 1 }
+        return reason
+    }
+
+    /// Count one frame from the VERIFIER's result rather than from a parse result.
+    ///
+    /// The offload path does not parse its frames at the BLE seam — it hands them straight to the
+    /// Backfiller — so the parse-result overload above never sees them, and the named counter the
+    /// hardware run's abort criterion is read from would stay at zero for exactly the traffic in which
+    /// the permanent loss occurs. `FrameCheck` already carries the verdict, the reason and the payload
+    /// CRC32 outcome, so this counts what was observed and costs no second parse.
+    ///
+    /// It asserts no more than the parse-result overload: `payloadCRCOKButEnvelopeRejected` is raised
+    /// only when the CRC32 was actually computed and verified, never when it could not be checked.
+    @discardableResult
+    public mutating func note(_ check: FrameCheck) -> FrameRejectReason {
+        guard !check.ok else { return .none }
+        counts[check.reason, default: 0] += 1
+        if check.crc32OK == true { payloadCRCOKButEnvelopeRejected += 1 }
+        return check.reason
+    }
+
+    /// Fold a reassembler's `belowMinimumLengthDrops` into the `.belowMinimumLength` bucket.
+    ///
+    /// A byte run the reassembler drops never reaches a parser — and never reaches the evidence-
+    /// preserving reader either — so without this it would vanish with no trace at all. The argument is
+    /// the reassembler's MONOTONIC total; only the growth since the last fold is added, so calling this
+    /// once per notification is correct and idempotent.
+    public mutating func absorbReassemblerDrops(_ monotonicTotal: Int) {
+        guard monotonicTotal > absorbedReassemblerDrops else { return }
+        counts[.belowMinimumLength, default: 0] += monotonicTotal - absorbedReassemblerDrops
+        absorbedReassemblerDrops = monotonicTotal
+    }
+
+    /// How often `reason` was recorded.
+    public func count(_ reason: FrameRejectReason) -> Int { counts[reason] ?? 0 }
+
+    /// Every rejection counted, across all reasons.
+    public var totalRejected: Int { counts.values.reduce(0, +) }
+
+    /// One line naming every reason that actually occurred, in a stable order, or nil when nothing was
+    /// rejected — a per-connection readout, so its caller gates it behind the Test Centre domain.
+    /// Silence when there is nothing to report; no "0 rejections" line to read past.
+    public func summaryLine() -> String? {
+        guard totalRejected > 0 else { return nil }
+        let parts = FrameRejectReason.allCases
+            .filter { $0 != .none && count($0) > 0 }
+            .map { "\($0.rawValue)=\(count($0))" }
+        return "frameReject total=\(totalRejected) " + parts.joined(separator: " ")
+            + " payloadCRCOKButEnvelopeRejected=\(payloadCRCOKButEnvelopeRejected)"
+    }
+}
+
+/// The inspector's one-line rendering of a parsed frame.
+///
+/// It lives in the library rather than in the command-line tool so a test can pin it: the tool is an
+/// executable target with no test target of its own, and the property that matters — a REJECTED frame
+/// still shows its packet type, and shows why it was rejected — is exactly the kind that goes quiet
+/// unnoticed.
+///
+/// `index` and `family` are provenance the caller holds; everything else comes off the parse result.
+public func frameInspectionLine(index: Int, family: DeviceFamily, parsed: ParsedFrame) -> String {
+    let crc = parsed.crcOK.map { $0 ? "ok" : "BAD" } ?? "—"
+    var line = "[\(index)] \(family.rawValue) ok=\(parsed.ok) type=\(parsed.typeName)"
+    line += " seq=\(parsed.seq.map(String.init) ?? "—") crc=\(crc)"
+    // Only on a rejection, and only the reason the verifier actually reported: an intact frame carries
+    // no reason, and printing `reason=none` on every line would train the eye to skip the field.
+    if !parsed.ok { line += " reason=\(parsed.rejectReason.rawValue)" }
+    return line
+}
diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/Framing.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/Framing.swift
index 4cd03202ea..011333b599 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/Framing.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/Framing.swift
@@ -82,16 +82,84 @@ public func crc16Modbus(_ bytes: [UInt8], _ from: Int = 0, _ to: Int? = nil) ->
     return crc
 }
 
+/// Why a frame failed the envelope check — one value, never optional, so a consumer can report the
+/// cause without verifying or parsing the frame a second time (the parse-once invariant).
+///
+/// `none` is the ONLY value that accompanies a positive verdict. The two payload-CRC cases are kept
+/// apart on purpose: a diagnostic may only assert what it observed, and "we could not compute the
+/// CRC32" is not the same claim as "the CRC32 disagreed".
+public enum FrameRejectReason: String, Codable, Equatable, Sendable, CaseIterable {
+    /// The frame is intact: header checksum, payload CRC32 and the structural length all agree.
+    case none
+    /// No 0xAA start-of-frame byte — this byte run is not a frame at all.
+    case noStartOfFrame
+    /// Fewer bytes than the device family's smallest well-formed frame can have.
+    case belowMinimumLength
+    /// The byte count does not equal the total derived from the declared length field: the frame is
+    /// truncated, or it carries trailing bytes past its own end.
+    case lengthMismatch
+    /// The header checksum (CRC-8 on WHOOP 4.0, CRC-16-Modbus on WHOOP 5.0/MG) disagreed.
+    case headerChecksumMismatch
+    /// The payload CRC32 was computed and disagreed.
+    case payloadCRCMismatch
+    /// The payload CRC32 could not be computed at all. Fail-closed: an unverifiable CRC counts as a
+    /// negative verdict, never as "unknown". The structural rules above make this unreachable for a
+    /// frame that got past them, so it is defence in depth rather than an observed class.
+    case payloadCRCUnverifiable
+}
+
+/// The structural lower bounds a frame must clear before any of its bytes are read as fields.
+///
+/// WHOOP 4.0: `[SOF][len u16][crc8][type][seq][cmd] + >=1 payload byte + [crc32 u32]` = 11 bytes.
+/// WHOOP 5.0/MG: `[SOF][fmt][declLen u16][hdr u16][crc16 u16] + >=1 payload byte + [crc32 u32]` = 13.
+/// Both are the values `E2` fixes; the smallest real frame in the project's captures is exactly 11
+/// bytes (WHOOP 4.0) and 124 bytes (WHOOP 5.0/MG), so neither bound rejects a recorded frame.
+public enum FrameLimits {
+    public static let whoop4MinimumFrameBytes = 11
+    public static let whoop5MinimumFrameBytes = 13
+
+    /// The minimum total frame size for `family`, in bytes.
+    public static func minimumFrameBytes(for family: DeviceFamily) -> Int {
+        switch family {
+        case .whoop4: return whoop4MinimumFrameBytes
+        case .whoop5: return whoop5MinimumFrameBytes
+        }
+    }
+}
+
 public struct FrameCheck: Equatable {
+    /// The FULL verdict: start-of-frame, minimum length, exact length, header checksum and payload
+    /// CRC32 together. True only when `reason == .none`.
     public let ok: Bool
     public let length: Int?
     public let crc8OK: Bool?
     public let crc32OK: Bool?
-    public init(ok: Bool, length: Int? = nil, crc8OK: Bool? = nil, crc32OK: Bool? = nil) {
+    /// Why `ok` is false; `.none` exactly when `ok` is true.
+    public let reason: FrameRejectReason
+    public init(ok: Bool, length: Int? = nil, crc8OK: Bool? = nil, crc32OK: Bool? = nil,
+                reason: FrameRejectReason = .none) {
         self.ok = ok
         self.length = length
         self.crc8OK = crc8OK
         self.crc32OK = crc32OK
+        self.reason = reason
+    }
+}
+
+/// Turn the individual outcomes into ONE verdict and ONE reason, in a fixed order: structure first
+/// (a length we cannot trust makes every later read meaningless), then the header checksum, then the
+/// payload CRC32. `crc32OK == nil` is a rejection, not an "unknown" that a consumer might read as a
+/// pass — that tri-state is exactly what let malformed frames drive live state before this change.
+@inline(__always)
+private func frameRejectReason(totalFromLength: Int, actualCount: Int, minimumBytes: Int,
+                               headerCRCOK: Bool, crc32OK: Bool?) -> FrameRejectReason {
+    if totalFromLength < minimumBytes { return .belowMinimumLength }
+    if totalFromLength != actualCount { return .lengthMismatch }
+    if !headerCRCOK { return .headerChecksumMismatch }
+    switch crc32OK {
+    case .none: return .payloadCRCUnverifiable
+    case .some(false): return .payloadCRCMismatch
+    case .some(true): return .none
     }
 }
 
@@ -106,23 +174,39 @@ private func u32le(_ bytes: [UInt8], _ off: Int) -> UInt32 {
         | (UInt32(bytes[off + 2]) << 16) | (UInt32(bytes[off + 3]) << 24)
 }
 
-/// Validate a complete frame envelope and both CRCs.
+/// Validate a complete frame envelope: structure, header checksum and payload CRC32 together.
 /// Frame: [0xAA][len u16 LE][crc8(len)][...inner...][crc32 u32 LE], total = len + 4.
+///
+/// A frame is accepted only when it is at least `FrameLimits.whoop4MinimumFrameBytes` long, carries
+/// EXACTLY `len + 4` bytes (so a truncated frame and one with trailing bytes are both rejected), its
+/// CRC-8 over the length field matches, and its CRC32 over the inner record matches. The individual
+/// outcomes stay on the result as diagnostics; `reason` says which rule failed first.
 public func verifyFrame(_ frame: [UInt8]) -> FrameCheck {
-    if frame.count < 8 || frame[0] != 0xAA {
-        return FrameCheck(ok: false)
+    guard frame.first == 0xAA else {
+        return FrameCheck(ok: false, reason: .noStartOfFrame)
+    }
+    guard frame.count >= FrameLimits.whoop4MinimumFrameBytes else {
+        // Too short even to hold an envelope plus one payload byte: no field of it is read, and the
+        // length word it may carry is not worth reporting as a length.
+        return FrameCheck(ok: false, reason: .belowMinimumLength)
     }
     let length = u16le(frame, 1)
+    let total = length + 4
     // Ranged CRCs checksum the frame in place, with no per-frame sub-array allocation.
     let crc8OK = crc8(frame, 1, 3) == frame[3]
     var crc32OK: Bool? = nil
-    // length must cover at least the envelope's inner bytes (mirrors framing.py).
-    if 7 <= length && length + 4 <= frame.count {
+    // length must cover at least the envelope's inner bytes (mirrors framing.py). Trailing bytes do
+    // not stop the CRC32 from being computed — that combination (payload CRC right, envelope wrong)
+    // is precisely the class this change stops admitting, so it must stay observable.
+    if 7 <= length && total <= frame.count {
         // inner record = frame[4..<length]
         crc32OK = crc32(frame, 4, length) == u32le(frame, length)
     }
-    let ok = crc8OK && (crc32OK ?? false)
-    return FrameCheck(ok: ok, length: length, crc8OK: crc8OK, crc32OK: crc32OK)
+    let reason = frameRejectReason(totalFromLength: total, actualCount: frame.count,
+                                   minimumBytes: FrameLimits.whoop4MinimumFrameBytes,
+                                   headerCRCOK: crc8OK, crc32OK: crc32OK)
+    return FrameCheck(ok: reason == .none, length: length, crc8OK: crc8OK, crc32OK: crc32OK,
+                      reason: reason)
 }
 
 /// Family-aware frame validation.
@@ -151,15 +235,15 @@ public func verifyFrame(_ frame: [UInt8], family: DeviceFamily) -> FrameCheck {
 }
 
 private func verifyFrameWhoop5(_ frame: [UInt8]) -> FrameCheck {
-    // Minimum whoop5 frame: 8 header bytes (incl. CRC16) + 4 CRC32 trailer = 12.
-    if frame.count < 12 || frame[0] != 0xAA {
-        return FrameCheck(ok: false)
+    guard frame.first == 0xAA else {
+        return FrameCheck(ok: false, reason: .noStartOfFrame)
     }
-    let declaredLength = u16le(frame, 2)
-    // declaredLength counts payload + the 4-byte CRC32 trailer (mirrors Goose v5Frames/v5Payload).
-    guard declaredLength >= 4 else {
-        return FrameCheck(ok: false, length: declaredLength)
+    // Smallest well-formed whoop5 frame: 8 header bytes (incl. CRC16) + 1 payload byte + 4 CRC32.
+    guard frame.count >= FrameLimits.whoop5MinimumFrameBytes else {
+        return FrameCheck(ok: false, reason: .belowMinimumLength)
     }
+    // declaredLength counts payload + the 4-byte CRC32 trailer (mirrors Goose v5Frames/v5Payload).
+    let declaredLength = u16le(frame, 2)
     let total = declaredLength + 8
 
     // Header CRC16-Modbus over the first 6 bytes, stored LE at frame[6..8]. Ranged, no copy.
@@ -168,8 +252,8 @@ private func verifyFrameWhoop5(_ frame: [UInt8]) -> FrameCheck {
     let headerCRCOK = wantHeaderCRC == gotHeaderCRC
 
     var crc32OK: Bool? = nil
-    if frame.count >= total {
-        // payload spans [8, total-4); CRC32 trailer is the final 4 bytes of the frame.
+    if declaredLength >= 4, total <= frame.count {
+        // payload spans [8, total-4); CRC32 trailer is the final 4 bytes the length declares.
         let payloadEnd = total - 4
         // payload = frame[8..<payloadEnd], checksummed in place.
         let want = crc32(frame, 8, payloadEnd)
@@ -177,18 +261,27 @@ private func verifyFrameWhoop5(_ frame: [UInt8]) -> FrameCheck {
         crc32OK = want == got
     }
 
-    let ok = headerCRCOK && (crc32OK ?? false)
+    let reason = frameRejectReason(totalFromLength: total, actualCount: frame.count,
+                                   minimumBytes: FrameLimits.whoop5MinimumFrameBytes,
+                                   headerCRCOK: headerCRCOK, crc32OK: crc32OK)
     // Report the header outcome through crc8OK so callers have a single header-CRC signal.
-    return FrameCheck(ok: ok, length: declaredLength, crc8OK: headerCRCOK, crc32OK: crc32OK)
+    return FrameCheck(ok: reason == .none, length: declaredLength, crc8OK: headerCRCOK,
+                      crc32OK: crc32OK, reason: reason)
 }
 
 /// Reconstruct a complete frame from a bare payload (data == frame[7:]).
-/// Some captures store only the data portion; rebuild the envelope with a correct zlib
-/// crc32 and a placeholder crc8 byte (0x00). Mirrors framing.py frame_from_payload.
+/// Some captures store only the data portion; rebuild the envelope with a correct zlib crc32 AND a
+/// correct CRC-8 header checksum. Mirrors framing.py frame_from_payload.
+///
+/// The CRC-8 byte used to be a 0x00 placeholder. That was harmless while the gates only asked
+/// whether the payload CRC32 was *demonstrably* wrong, but a frame built this way is rejected the
+/// moment the header checksum counts — so every rebuilt frame is now a frame a strap could have
+/// sent, and the round-trip through `verifyFrame` is positive end to end.
 public func frameFromPayload(_ data: [UInt8], type: UInt8, seq: UInt8 = 0, cmd: UInt8 = 0) -> [UInt8] {
     let inner: [UInt8] = [type, seq, cmd] + data
     let length = inner.count + 4
-    var frame: [UInt8] = [0xAA, UInt8(length & 0xFF), UInt8((length >> 8) & 0xFF), 0x00]
+    var frame: [UInt8] = [0xAA, UInt8(length & 0xFF), UInt8((length >> 8) & 0xFF)]
+    frame.append(crc8(frame, 1, 3))
     frame.append(contentsOf: inner)
     let c = crc32(inner)
     frame.append(UInt8(c & 0xFF))
@@ -228,8 +321,9 @@ public func puffinCommandFrame(cmd: UInt8, seq: UInt8, payload: [UInt8] = [0x00]
 }
 
 /// Accumulate BLE notification fragments into complete frames.
-/// A complete frame is `length + 4` bytes where length = u16 LE at buf[1..3].
-/// Mirrors framing.py Reassembler.
+/// A complete frame is `length + 4` bytes where length = u16 LE at buf[1..3], and never smaller than
+/// the family minimum in `FrameLimits` — a start-of-frame declaring less is dropped and the stream
+/// resyncs on the next one. Mirrors framing.py Reassembler.
 public final class Reassembler {
     // Backed by a flat byte buffer plus a read cursor rather than draining off the front. The earlier
     // form called buf.removeFirst(n), which shifts the whole tail down on every completed frame, so
@@ -247,6 +341,12 @@ public final class Reassembler {
     /// Mirrors the Android `Framing.kt` cap. (Reimplemented from @vulnix0x4's PR #374.)
     static let maxFrameBytes = 8192
 
+    /// How many start-of-frame bytes were dropped because the total length they declared was below
+    /// the family minimum. Such a byte run never reaches a parser, so without this counter it would
+    /// vanish without trace — and one of the readers downstream exists to preserve exactly the
+    /// frames nothing else can read. Monotonic for the lifetime of the reassembler.
+    public private(set) var belowMinimumLengthDrops = 0
+
     /// `family` selects the frame-length convention:
     /// - WHOOP 4.0 reads a u16 length at `buf[1..3]`, total = `length + 4`.
     /// - WHOOP 5.0 ("puffin") reads a u16 declared length at `buf[2..4]` (after the `0xAA` SOF and
@@ -282,6 +382,14 @@ public final class Reassembler {
             case .whoop5:
                 total = (Int(buf[head + 2]) | (Int(buf[head + 3]) << 8)) + 8
             }
+            if total < FrameLimits.minimumFrameBytes(for: family) {
+                // A declared total below the family minimum cannot be a frame: emitting it would hand
+                // a parser a byte run whose "inner fields" are its own checksum trailer. Drop this
+                // 0xAA, count it, and resync on the next one — same shape as the ceiling below.
+                belowMinimumLengthDrops += 1
+                head += 1
+                continue
+            }
             if total > Reassembler.maxFrameBytes {
                 // Impossibly large declared length → this 0xAA is garbage. Drop it and resync to the
                 // next SOF instead of stalling the live stream until a reconnect.
diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/HistoricalMeta.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/HistoricalMeta.swift
index 677521442c..feec33d453 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/HistoricalMeta.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/HistoricalMeta.swift
@@ -18,9 +18,15 @@ public enum HistoricalMeta: Equatable {
 /// - For HISTORY_END the metadata post-hook additionally stores in p.parsed:
 ///   `"unix"` → `.int(unix_seconds)` and `"trim_cursor"` → `.int(trim_value)`
 public func classifyHistoricalMeta(_ p: ParsedFrame) -> HistoricalMeta {
-    // Integrity gate: only act on a checksum-valid frame. CRC32 is the protocol's only integrity
-    // check; without this a malicious/garbled BLE peer could forge HISTORY_END/HISTORY_COMPLETE
-    // (advancing the trim cursor + acking the strap to discard data we never durably stored).
+    // Integrity gate: only act on an INTACT frame. `ok` is now the verifier's FULL verdict — header
+    // checksum, payload CRC32 and the structural length together — which is the part that matters
+    // here: a forged HISTORY_END/HISTORY_COMPLETE whose payload CRC32 is right but whose header
+    // checksum or declared length is not used to reach this classifier, and acting on one advances the
+    // trim cursor, which acks the strap to discard data we never durably stored.
+    //
+    // The `crcOK` half of the old two-step check is now redundant for every freshly parsed frame and is
+    // kept only for parse results handed in from elsewhere — a `ParsedFrame` decoded from a capture
+    // written before the verdict widened carries the old constant `ok: true` beside a false `crcOK`.
     guard p.ok, p.crcOK != false else { return .other }
     guard p.typeName == "METADATA" else { return .other }
     guard case .string(let metaName)? = p.parsed["meta_type"] else { return .other }
diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/HistoricalStreams.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/HistoricalStreams.swift
index 398cf40094..e5f5256519 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/HistoricalStreams.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/HistoricalStreams.swift
@@ -78,15 +78,31 @@ public func isPlausibleHistoricalUnix(_ ts: Int, wallNow: Int,
 /// archive they are lost forever while the UI reports a clean sync (#77 / #91).
 ///
 /// Console (type-50, `frame[typeIndex] == 0x32`) frames are strap-side debug-log text that decode to
-/// zero rows BY DESIGN and are never returned. 5/MG v26 (raw PPG block, hist_version 26) is also
-/// skipped unconditionally (even on a CRC failure): a v26 record's payload is the optical waveform,
-/// which `extractHistoricalStreams` now persists durably in its OWN stream (`Streams.ppgWaveform` /
-/// WhoopStore's `ppgWaveformSample` table, issue #156 follow-up) whenever it decodes — this reject
-/// archive exists for genuinely-undecodable records, and a decoded v26 record was never one of those.
+/// zero rows BY DESIGN and are never returned. 5/MG v26 (raw PPG block, hist_version 26) is skipped
+/// only while it is INTACT: a v26 record's payload is the optical waveform, which
+/// `extractHistoricalStreams` persists durably in its OWN stream (`Streams.ppgWaveform` / WhoopStore's
+/// `ppgWaveformSample` table, issue #156 follow-up) — but only for a record it accepts. Since the
+/// integrity gate, a v26 record with a broken envelope is dropped by that extraction too, so skipping
+/// it here on the version byte alone would leave it stored nowhere while its section is acked anyway.
 /// Only genuine type-47 record frames whose payload would otherwise be silently dropped are returned.
 ///
 /// Used by the Backfiller/BLEManager to archive undecodable history BEFORE acking the trim. Mirrors
 /// the Android rejectedHistoricalRecords so one mapping toolchain re-ingests both archives.
+///
+/// EVIDENCE-PRESERVING READER (D8) — its verdict runs the OTHER WAY ROUND, and the difference is
+/// load-bearing. Everywhere else a negative integrity verdict means "do not act on this frame". Here it
+/// means "this frame must be archived", because the strap is about to free it and this archive is the
+/// only durable copy that will exist. Turning this into "act only on a positive verdict", the way the
+/// state-driving gates were turned, would delete exactly the frames it exists to keep.
+///
+/// So the stricter verdict makes the archived set LARGER, never smaller: every frame archived before is
+/// archived still, plus the classes the envelope check now rejects (a wrong header checksum, a declared
+/// length below the family minimum, a truncated frame, trailing bytes). The one way a frame can be lost
+/// relative to before is upstream of here: the reassembler drops a byte run whose declared total is
+/// below the family minimum, so it never reaches any parser. That drop is counted
+/// (`Reassembler.belowMinimumLengthDrops`, folded into `FrameRejectTally`) precisely so it stays visible.
+///
+/// Accepted side effect: on a noisy link the raw archives grow. The existing eviction rule bounds that.
 public func rejectedHistoricalRecords(_ rawFrames: [[UInt8]], family: DeviceFamily) -> [[UInt8]] {
     // The type byte sits at the inner-record start: frame[4] on WHOOP 4.0, frame[8] on WHOOP 5/MG
     // (the puffin envelope is 4 bytes longer). hist_version sits one byte past the type+seq+cmd
@@ -97,7 +113,14 @@ public func rejectedHistoricalRecords(_ rawFrames: [[UInt8]], family: DeviceFami
         // Only genuine HISTORICAL_DATA records (47). Console (50) and METADATA frames have a
         // different type byte, so they never pass this gate — they are excluded by construction.
         guard f.count > typeIndex, Int(f[typeIndex]) == 47 else { return false }
-        if family == .whoop5, f.count > versionIndex, Int(f[versionIndex]) == 26 { return false }  // v26 PPG: has its own durable stream (ppgWaveform), not this reject archive
+        // v26 PPG: skipped BECAUSE `extractHistoricalStreams` stores it durably in its own waveform
+        // stream (ppgWaveform) — so the skip holds only while that premise does. A REJECTED v26 record
+        // is dropped by the extraction like any other, which leaves it stored nowhere while the section
+        // is acked anyway. Bind the skip to the verdict, not to the version byte alone.
+        if family == .whoop5, f.count > versionIndex, Int(f[versionIndex]) == 26 {
+            let p = parseFrame(f, family: family)
+            return !(p.ok && p.crcOK != false)
+        }
         // UNMAPPED LAYOUT (5/MG) — archive UNCONDITIONALLY, whatever it decoded.
         //
         // The decode-outcome test below is the wrong question for a layout NOOP has no field map for.
@@ -113,7 +136,11 @@ public func rejectedHistoricalRecords(_ rawFrames: [[UInt8]], family: DeviceFami
         // banks empty placeholder records at 1 Hz cannot push out the one informative frame either.
         if family == .whoop5, isUnmappedWhoop5HistoricalRecord(f) { return true }
         let p = parseFrame(f, family: family)
-        // Envelope/CRC reject: parse failed outright or the CRC32 trailer mismatched.
+        // NOT INTACT → ARCHIVE. Reading the verdict this way round is the whole point of this reader
+        // (D8): the frame cannot be turned into rows, so its bytes are the only thing left to keep.
+        // With the verdict widened to cover the header checksum and the structural length, this branch
+        // catches strictly MORE frames than it did before — which is the intended direction. The
+        // `crcOK` half stays for exactly that reason: every condition here can only add to the archive.
         if !p.ok || p.crcOK == false { return true }
         // Unmapped layout: the envelope parsed but no usable biometrics decoded. A record is genuinely
         // undecodable only if it has no timestamp, or NEITHER heart rate NOR motion. v25 (issue #30)
@@ -242,6 +269,11 @@ public func extractHistoricalStreams(_ parsed: [ParsedFrame],
     // #891: packet types that reach `default:` and are dropped. See `Streams.unhandledPacketTypes`.
     var unhandledTypes: [String: Int] = [:]
     for r in parsed {
+        // `ok` is now the FULL verdict — header checksum, payload CRC32 and structural length — so it
+        // alone rejects everything the two-part check used to. The `crcOK` half is kept because this
+        // function takes parse results from its CALLER, and a `ParsedFrame` decoded from a capture file
+        // written before the verdict widened carries the old constant `ok: true` beside a false `crcOK`.
+        // Dropping it would start deriving rows from those.
         if !r.ok || r.crcOK == false { continue }
         let p = r.parsed
         switch r.typeName {
diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/Interpreter.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/Interpreter.swift
index d6568bd17b..2123d285cb 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/Interpreter.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/Interpreter.swift
@@ -11,6 +11,9 @@ public struct DecodedField: Codable, Equatable {
 }
 
 public struct ParsedFrame: Codable, Equatable {
+    /// The FULL integrity verdict of `verifyFrame` — header checksum, payload CRC32 and structural
+    /// length together. It means "this frame is intact", NOT "this frame could be parsed": a frame
+    /// with a broken header still carries its decoded `typeName` and `parsed` fields for inspection.
     public let ok: Bool
     public let typeName: String
     public let seq: Int?
@@ -20,45 +23,96 @@ public struct ParsedFrame: Codable, Equatable {
     public let rawHex: String
     public let fields: [DecodedField]
     public let parsed: [String: ParsedValue]
+    /// Why `ok` is false, carried here so a consumer can report the cause from the value it was
+    /// handed — the frame is parsed exactly once and the result threaded on, so a consumer that had
+    /// to verify again to learn the reason would break that invariant.
+    public let rejectReason: FrameRejectReason
+
+    public init(ok: Bool, typeName: String, seq: Int?, cmdName: String?, crcOK: Bool?,
+                lenBytes: Int, rawHex: String, fields: [DecodedField],
+                parsed: [String: ParsedValue], rejectReason: FrameRejectReason = .none) {
+        self.ok = ok
+        self.typeName = typeName
+        self.seq = seq
+        self.cmdName = cmdName
+        self.crcOK = crcOK
+        self.lenBytes = lenBytes
+        self.rawHex = rawHex
+        self.fields = fields
+        self.parsed = parsed
+        self.rejectReason = rejectReason
+    }
+
+    /// Decoding tolerates a MISSING `rejectReason` and defaults it to `.none`. A parse result is
+    /// serialised into capture files and read back from hand-written fixtures; a strictly required
+    /// new key would make every one of those older documents fail to decode.
+    public init(from decoder: Decoder) throws {
+        let c = try decoder.container(keyedBy: CodingKeys.self)
+        ok = try c.decode(Bool.self, forKey: .ok)
+        typeName = try c.decode(String.self, forKey: .typeName)
+        seq = try c.decodeIfPresent(Int.self, forKey: .seq)
+        cmdName = try c.decodeIfPresent(String.self, forKey: .cmdName)
+        crcOK = try c.decodeIfPresent(Bool.self, forKey: .crcOK)
+        lenBytes = try c.decode(Int.self, forKey: .lenBytes)
+        rawHex = try c.decode(String.self, forKey: .rawHex)
+        fields = try c.decode([DecodedField].self, forKey: .fields)
+        parsed = try c.decode([String: ParsedValue].self, forKey: .parsed)
+        rejectReason = try c.decodeIfPresent(FrameRejectReason.self, forKey: .rejectReason) ?? .none
+    }
 }
 
 // MARK: - low-level readers (LE), nil when out of range (mirrors interpreter._read)
-
-@inline(__always) private func readU8(_ f: [UInt8], _ off: Int) -> Int? {
-    off + 1 <= f.count ? Int(f[off]) : nil
+//
+// `limit` is the EXCLUSIVE upper bound for a named inner field (D7): the minimum of where the CRC32
+// trailer starts and how many bytes the frame actually has. It is a required argument, not a
+// defaulted one, so adding a field read without deciding its bound does not compile. Callers derive
+// it with `payloadLimit(_:trailerStart:)`, which never returns more than `f.count`, so passing it
+// here is at least as safe as the old bound and never reads a byte that is not there.
+
+@inline(__always) private func readU8(_ f: [UInt8], _ off: Int, _ limit: Int) -> Int? {
+    off >= 0 && off + 1 <= limit ? Int(f[off]) : nil
 }
-@inline(__always) private func readU16(_ f: [UInt8], _ off: Int) -> Int? {
-    off + 2 <= f.count ? Int(f[off]) | (Int(f[off + 1]) << 8) : nil
+@inline(__always) private func readU16(_ f: [UInt8], _ off: Int, _ limit: Int) -> Int? {
+    off >= 0 && off + 2 <= limit ? Int(f[off]) | (Int(f[off + 1]) << 8) : nil
 }
-@inline(__always) private func readU32(_ f: [UInt8], _ off: Int) -> Int? {
-    guard off + 4 <= f.count else { return nil }
+@inline(__always) private func readU32(_ f: [UInt8], _ off: Int, _ limit: Int) -> Int? {
+    guard off >= 0, off + 4 <= limit else { return nil }
     return Int(f[off]) | (Int(f[off + 1]) << 8) | (Int(f[off + 2]) << 16) | (Int(f[off + 3]) << 24)
 }
-@inline(__always) private func readI16(_ f: [UInt8], _ off: Int) -> Int? {
-    guard off + 2 <= f.count else { return nil }
+@inline(__always) private func readI16(_ f: [UInt8], _ off: Int, _ limit: Int) -> Int? {
+    guard off >= 0, off + 2 <= limit else { return nil }
     let raw = UInt16(f[off]) | (UInt16(f[off + 1]) << 8)
     return Int(Int16(bitPattern: raw))
 }
 
-@inline(__always) private func readI32(_ f: [UInt8], _ off: Int) -> Int? {
-    guard off + 4 <= f.count else { return nil }
-    let raw = UInt32(f[off]) | (UInt32(f[off + 1]) << 8) | (UInt32(f[off + 2]) << 16) | (UInt32(f[off + 3]) << 24)
-    return Int(Int32(bitPattern: raw))
-}
-
-@inline(__always) private func readF32(_ f: [UInt8], _ off: Int) -> Double? {
-    guard off + 4 <= f.count else { return nil }
+@inline(__always) private func readF32(_ f: [UInt8], _ off: Int, _ limit: Int) -> Double? {
+    guard off >= 0, off + 4 <= limit else { return nil }
     let bits = UInt32(f[off]) | (UInt32(f[off + 1]) << 8) | (UInt32(f[off + 2]) << 16) | (UInt32(f[off + 3]) << 24)
     return Double(Float(bitPattern: bits))   // float32 -> Double is exact, no rounding
 }
 
-/// Read a schema dtype at off; returns the integer value or nil if out of range.
-private func readDType(_ f: [UInt8], _ off: Int, _ dtype: String) -> Int? {
+/// The exclusive upper bound for reading named inner fields out of `frame` (D7).
+///
+/// It is the MINIMUM of the CRC32 trailer's start and the frame's real size — not one or the other.
+/// The trailer start follows from the DECLARED length, which on a truncated frame points past the
+/// last byte we hold, so using it alone would read off the end of the buffer; using only the frame
+/// size is what let a frame at the family minimum have its own checksum trailer decoded as a
+/// sequence number, a command byte or a metadata type. A field counts as present when its start plus
+/// its length does not EXCEED this bound: the smallest real WHOOP 4.0 history frame is 11 bytes with
+/// its trailer at 7, and its metadata type occupies precisely the last payload byte.
+@inline(__always)
+private func payloadLimit(_ frame: [UInt8], trailerStart: Int?) -> Int {
+    guard let trailerStart = trailerStart else { return frame.count }
+    return min(max(0, trailerStart), frame.count)
+}
+
+/// Read a schema dtype at off, bounded by `limit`; nil when the field does not fit.
+private func readDType(_ f: [UInt8], _ off: Int, _ dtype: String, _ limit: Int) -> Int? {
     switch dtype {
-    case "u8": return readU8(f, off)
-    case "u16": return readU16(f, off)
-    case "u32": return readU32(f, off)
-    case "i16": return readI16(f, off)
+    case "u8": return readU8(f, off, limit)
+    case "u16": return readU16(f, off, limit)
+    case "u32": return readU32(f, off, limit)
+    case "i16": return readI16(f, off, limit)
     default: return nil
     }
 }
@@ -128,20 +182,25 @@ public func parseFrame(_ frame: [UInt8], collectFields: Bool = false) -> ParsedF
     // PuffinCapture, field-asserting tests) do — so on a 1Hz stream or an offload burst this skips a
     // per-byte `String(format:)` allocation pass whose result was discarded.
     let rawHex = collectFields ? frame.map { String(format: "%02x", $0) }.joined() : ""
-    if frame.count < 8 || frame[0] != 0xAA {
+    let check = verifyFrame(frame)
+    // Below the family minimum there is no inner record at all — every offset a field would use
+    // lands in the checksum trailer — so nothing is decoded, not even a packet type.
+    if frame.count < FrameLimits.whoop4MinimumFrameBytes || frame[0] != 0xAA {
         return ParsedFrame(ok: false, typeName: "INVALID/FRAGMENT", seq: nil, cmdName: nil,
                            crcOK: nil, lenBytes: frame.count, rawHex: rawHex,
-                           fields: [], parsed: [:])
+                           fields: [], parsed: [:], rejectReason: check.reason)
     }
 
     let schema = loadSchema()
-    let check = verifyFrame(frame)
     let length = check.length
     let crcOK = check.crc32OK
+    // D7: named inner fields come only from payload bytes. On WHOOP 4.0 the CRC32 trailer starts at
+    // the declared length.
+    let limit = payloadLimit(frame, trailerStart: length)
 
     let t = Int(frame[4])
     let typeName = schema.typeName(t)
-    let seq = Int(frame[5])
+    let seq = readU8(frame, 5, limit)
 
     let fb = FieldBuilder(frame, collectFields: collectFields)
     // envelope
@@ -149,17 +208,17 @@ public func parseFrame(_ frame: [UInt8], collectFields: Bool = false) -> ParsedF
     fb.add(1, 2, "length", "frame", value: length.map { .int($0) })
     fb.add(3, 1, "crc8", "frame", value: .string(String(format: "0x%02X", frame[3])))
     fb.add(4, 1, "packet_type", "frame", value: .string(typeName))
-    fb.add(5, 1, "seq", "frame", value: .int(Int(frame[5])))
+    if let seq = seq { fb.add(5, 1, "seq", "frame", value: .int(seq)) }
 
     let spec = schema.packet(forType: t)
     if spec == nil {
-        fb.add(6, 1, "cmd", "cmd", value: frame.count > 6 ? .int(Int(frame[6])) : nil)
+        fb.add(6, 1, "cmd", "cmd", value: readU8(frame, 6, limit).map { .int($0) })
         if let length = length { fb.region(7, length, "payload", "unknown") }
     } else {
         // static fields from schema
         for fld in spec!.fields {
             guard let dtype = fld.dtype else { continue }
-            guard let val = readDType(frame, fld.off, dtype) else { continue }
+            guard let val = readDType(frame, fld.off, dtype, limit) else { continue }
             let value: ParsedValue
             if let enumKey = fld.`enum` {
                 value = .string(schema.enumName(enumKey, val))
@@ -182,12 +241,14 @@ public func parseFrame(_ frame: [UInt8], collectFields: Bool = false) -> ParsedF
                note: check.crc32OK == true ? "OK" : "MISMATCH")
     }
 
-    let cmdByte = frame.count > 6 ? Int(frame[6]) : 0
+    let cmdByte = readU8(frame, 6, limit) ?? 0
     let cmdName = (t == 35 || t == 36) ? schema.enumName("CommandNumber", cmdByte) : nil
 
-    return ParsedFrame(ok: true, typeName: typeName, seq: seq, cmdName: cmdName,
+    // `ok` is the verifier's full verdict, not a constant: the fields above stay decoded so an
+    // inspector can still read a broken frame, but no consumer may mistake that for integrity.
+    return ParsedFrame(ok: check.ok, typeName: typeName, seq: seq, cmdName: cmdName,
                        crcOK: crcOK, lenBytes: frame.count, rawHex: rawHex,
-                       fields: fb.fields, parsed: fb.parsed)
+                       fields: fb.fields, parsed: fb.parsed, rejectReason: check.reason)
 }
 
 /// #47: the packet type NAME only — NO CRC verify, NO FieldBuilder — for hot-path pre-filters that just
@@ -195,18 +256,25 @@ public func parseFrame(_ frame: [UInt8], collectFields: Bool = false) -> ParsedF
 /// multi-minute offload of thousands of type-47 records that only ever act on rare EVENT frames, this skips
 /// the redundant decode for the ~99% that aren't. Mirrors `parseFrame`'s family split EXACTLY — the inner
 /// type byte is at [4] on WHOOP4 and [8] on 5/MG, with the same lookup each uses (`schema.typeName` /
-/// `canonicalTypeName`). Returns nil for a frame too short / wrong SOF — which `parseFrame` would also mark
-/// INVALID (never "EVENT") — so a pre-filter guarded on `== "EVENT"` is byte-identical to the full-parse
-/// guard.
+/// `canonicalTypeName`), and it uses the same family minimum, so a frame this returns nil for is exactly a
+/// frame `parseFrame` marks INVALID.
+///
+/// What this does NOT tell you is whether the frame is INTACT. It never was a CRC check, but it used to be
+/// interchangeable with the full parse for a caller that only asked "is the type EVENT?", because
+/// `parseFrame` reported success for anything it could read. `parseFrame` now reports the verifier's
+/// verdict, so the two agree on the type NAME and diverge on `ok`: this is a type peek, and a caller that
+/// must not act on a corrupt frame has to parse and check the verdict.
 public func frameTypeName(_ frame: [UInt8], family: DeviceFamily) -> String? {
     guard frame.first == 0xAA else { return nil }
     let schema = loadSchema()
     switch family {
     case .whoop4:
-        guard frame.count >= 8 else { return nil }        // parseFrame's `count < 8` INVALID guard
+        // parseFrame's INVALID guard.
+        guard frame.count >= FrameLimits.whoop4MinimumFrameBytes else { return nil }
         return schema.typeName(Int(frame[4]))
     case .whoop5:
-        guard frame.count >= 12 else { return nil }       // parseFrameWhoop5's `count < 12` INVALID guard
+        // parseFrameWhoop5's INVALID guard.
+        guard frame.count >= FrameLimits.whoop5MinimumFrameBytes else { return nil }
         return canonicalTypeName(Int(frame[8]), schema: schema)
     }
 }
@@ -233,23 +301,27 @@ public func parseFrame(_ frame: [UInt8], family: DeviceFamily, collectFields: Bo
 private func parseFrameWhoop5(_ frame: [UInt8], collectFields: Bool) -> ParsedFrame {
     // D#969: gated identically to parseFrame — build the hex only when a consumer reads it.
     let rawHex = collectFields ? frame.map { String(format: "%02x", $0) }.joined() : ""
-    // Minimum whoop5 frame: 8 header bytes + 1 inner (type) + 4 CRC32 trailer.
-    if frame.count < 12 || frame[0] != 0xAA {
+    let check = verifyFrame(frame, family: .whoop5)
+    // Minimum whoop5 frame: 8 header bytes + 1 payload byte + 4 CRC32 trailer. Below that, the type
+    // byte at [8] would be the first byte of the frame's own CRC32 trailer, so nothing is decoded.
+    if frame.count < FrameLimits.whoop5MinimumFrameBytes || frame[0] != 0xAA {
         return ParsedFrame(ok: false, typeName: "INVALID/FRAGMENT", seq: nil, cmdName: nil,
                            crcOK: nil, lenBytes: frame.count, rawHex: rawHex,
-                           fields: [], parsed: [:])
+                           fields: [], parsed: [:], rejectReason: check.reason)
     }
 
     let schema = loadSchema()
-    let check = verifyFrame(frame, family: .whoop5)
     let declaredLength = check.length            // payload + 4 (CRC32)
     let crcOK = check.crc32OK
 
     // Inner record starts at offset 8: [type][seq][cmd][data…].
     let innerStart = 8
+    let payloadEnd = declaredLength.map { ($0 + 8) - 4 }   // start of CRC32 trailer
+    // D7: named inner fields come only from payload bytes, bounded by the trailer AND the real size.
+    let limit = payloadLimit(frame, trailerStart: payloadEnd)
     let t = Int(frame[innerStart])
     let typeName = canonicalTypeName(t, schema: schema)
-    let seq = frame.count > innerStart + 1 ? Int(frame[innerStart + 1]) : nil
+    let seq = readU8(frame, innerStart + 1, limit)
 
     let fb = FieldBuilder(frame, collectFields: collectFields)
     // envelope
@@ -267,46 +339,47 @@ private func parseFrameWhoop5(_ frame: [UInt8], collectFields: Bool) -> ParsedFr
     // byte 8 here vs byte 4 on 4.0, so every field sits at its 4.0 offset + `delta`. Verified on real
     // hardware for REALTIME_DATA (type 40) — HR, R-R and the unix timestamp land exactly at +4 (HR
     // matched the standard 2A37 profile to ~0.4 bpm). We reuse the 4.0 schema with that shift.
-    let cmdByte = frame.count > innerStart + 2 ? Int(frame[innerStart + 2]) : 0
+    let cmdByte = readU8(frame, innerStart + 2, limit) ?? 0
     let delta = innerStart - 4                       // = 4
-    let payloadEnd = declaredLength.map { ($0 + 8) - 4 }   // start of CRC32 trailer
     let spec = schema.packet(forType: t)
     if spec == nil {
         fb.add(innerStart + 2, 1, "cmd", "cmd",
-               value: frame.count > innerStart + 2 ? .int(cmdByte) : nil)
+               value: readU8(frame, innerStart + 2, limit).map { .int($0) })
         if let payloadEnd = payloadEnd, innerStart + 3 < payloadEnd, payloadEnd <= frame.count {
             fb.region(innerStart + 3, payloadEnd, "payload", "unknown")
         }
     } else {
         // Static schema fields at the 4.0 offset + delta.
         for fld in spec!.fields {
-            guard let dtype = fld.dtype, let val = readDType(frame, fld.off + delta, dtype) else { continue }
+            guard let dtype = fld.dtype,
+                  let val = readDType(frame, fld.off + delta, dtype, limit) else { continue }
             let value: ParsedValue = fld.`enum`.map { .string(schema.enumName($0, val)) } ?? .int(val)
             fb.add(fld.off + delta, fld.len, fld.name, fld.cat, value: value, note: fld.note)
         }
         if spec!.post == "realtime_data" {
             // Verified variable-length extension: REALTIME_DATA R-R intervals (rr_count @13+delta,
             // intervals @14+delta…), the same shape as 4.0 shifted by +4.
-            let rrn = readDType(frame, 13 + delta, "u8") ?? 0
+            let rrn = readDType(frame, 13 + delta, "u8", limit) ?? 0
             var rrs: [Int] = []
             for i in 0..<rrn {
                 let off = 14 + delta + i * 2
-                if let v = readDType(frame, off, "u16"), v > 0 {
+                if let v = readDType(frame, off, "u16", limit), v > 0 {
                     fb.add(off, 2, "rr[\(i)]", "rr", value: .int(v), note: "ms")
                     rrs.append(v)
                 }
             }
             fb.parsed["rr_intervals"] = .intArray(rrs)
         } else if spec!.post == "historical_data" {
-            decodeWhoop5Historical(frame, fb: fb, payloadEnd: payloadEnd)
+            decodeWhoop5Historical(frame, fb: fb, payloadEnd: payloadEnd, limit: limit)
         } else if spec!.post == "metadata" {
-            decodeWhoop5Metadata(frame, fb: fb)
+            decodeWhoop5Metadata(frame, fb: fb, limit: limit)
         } else if spec!.post == "command_response" {
-            decodeWhoop5CommandResponse(frame, fb: fb, schema: schema, payloadEnd: payloadEnd)
+            decodeWhoop5CommandResponse(frame, fb: fb, schema: schema, payloadEnd: payloadEnd,
+                                        limit: limit)
         } else if spec!.post == "event" {
-            decodeWhoop5Event(frame, fb: fb, schema: schema)
+            decodeWhoop5Event(frame, fb: fb, schema: schema, limit: limit)
         } else if spec!.post == "console_logs" {
-            decodeWhoop5ConsoleLogs(frame, fb: fb, payloadEnd: payloadEnd)
+            decodeWhoop5ConsoleLogs(frame, fb: fb, payloadEnd: payloadEnd, limit: limit)
         } else if let payloadEnd = payloadEnd, innerStart + 3 < payloadEnd, payloadEnd <= frame.count {
             // Other types: static fields decoded above; the remaining variable body is kept raw —
             // its 4.0 post-hook awaits per-type 5.0 hardware verification before we apply it at +4.
@@ -326,9 +399,10 @@ private func parseFrameWhoop5(_ frame: [UInt8], collectFields: Bool) -> ParsedFr
     let cmdName = (t == 35 || t == 36 || t == PuffinPacketType.puffinCommandResponse)
         ? schema.enumName("CommandNumber", cmdByte) : nil
 
-    return ParsedFrame(ok: true, typeName: typeName, seq: seq, cmdName: cmdName,
+    // The verifier's verdict, not a constant — see the WHOOP 4.0 parser for the reasoning.
+    return ParsedFrame(ok: check.ok, typeName: typeName, seq: seq, cmdName: cmdName,
                        crcOK: crcOK, lenBytes: frame.count, rawHex: rawHex,
-                       fields: fb.fields, parsed: fb.parsed)
+                       fields: fb.fields, parsed: fb.parsed, rejectReason: check.reason)
 }
 
 /// The WHOOP 5/MG type-47 `hist_version` values `decodeWhoop5Historical` has a REAL field map for.
@@ -367,19 +441,23 @@ public func isUnmappedWhoop5HistoricalRecord(_ frame: [UInt8]) -> Bool {
 /// PPG / SpO₂ / skin-temp live further in the 124-byte record but lack on-device ground truth, so
 /// they are left as a raw region rather than guessed (project rule: real captures, never invented
 /// offsets).
-private func decodeWhoop5Historical(_ frame: [UInt8], fb: FieldBuilder, payloadEnd: Int?) {
-    let version = frame.count > 9 ? Int(frame[9]) : -1
+private func decodeWhoop5Historical(_ frame: [UInt8], fb: FieldBuilder, payloadEnd: Int?,
+                                    limit: Int) {
+    // The layout version is the inner record's seq slot: a named inner field, so it is bounded like
+    // any other. Out of bounds it stays -1, which routes the record to the unmapped branch below.
+    let version = readU8(frame, 9, limit) ?? -1
     fb.parsed["hist_version"] = .int(version)
-    fb.add(9, 1, "hist_version", "meta", value: .int(version))
+    if version >= 0 { fb.add(9, 1, "hist_version", "meta", value: .int(version)) }
     // One dispatch, one list: every `case` here must appear in `mappedWhoop5HistoricalVersions` and
     // vice versa, because that set is what decides whether a record gets archived raw. A `switch`
     // rather than the old if-chain so the mapped versions are readable in one place.
     switch version {
     case 26:
-        decodeWhoop5HistoricalV26(frame, fb: fb)
+        decodeWhoop5HistoricalV26(frame, fb: fb, limit: limit)
         return
     case 20, 21:
-        decodeWhoop5HistoricalV2021(frame, fb: fb, version: version, payloadEnd: payloadEnd)
+        decodeWhoop5HistoricalV2021(frame, fb: fb, version: version, payloadEnd: payloadEnd,
+                                    limit: limit)
         return
     case 18:
         break   // falls through to the v18 field decode below
@@ -391,23 +469,23 @@ private func decodeWhoop5Historical(_ frame: [UInt8], fb: FieldBuilder, payloadE
         }
         return
     }
-    if let idx = readDType(frame, 11, "u32") {
+    if let idx = readDType(frame, 11, "u32", limit) {
         // A per-record counter: +1 every record and independent of unix (it advances across gaps);
         // observed identical on two straps. @11 is only the low byte — read the full u32 LE.
         fb.add(11, 4, "record_index", "meta", value: .int(idx), note: "per-record counter")
     }
-    if let unix = readDType(frame, 15, "u32") {
+    if let unix = readDType(frame, 15, "u32", limit) {
         fb.add(15, 4, "unix", "time", value: .int(unix), note: "real unix seconds")
     }
-    if let hr = readDType(frame, 22, "u8") {
+    if let hr = readDType(frame, 22, "u8", limit) {
         fb.add(22, 1, "heart_rate", "hr", value: .int(hr), note: "bpm")
     }
-    let rrn = readDType(frame, 23, "u8") ?? 0
+    let rrn = readDType(frame, 23, "u8", limit) ?? 0
     fb.add(23, 1, "rr_count", "rr", value: .int(rrn))
     var rrs: [Int] = []
     for i in 0..<min(rrn, 4) {
         let off = 24 + i * 2
-        if let v = readDType(frame, off, "u16"), v > 0 {
+        if let v = readDType(frame, off, "u16", limit), v > 0 {
             fb.add(off, 2, "rr[\(i)]", "rr", value: .int(v), note: "ms")
             rrs.append(v)
         }
@@ -415,7 +493,7 @@ private func decodeWhoop5Historical(_ frame: [UInt8], fb: FieldBuilder, payloadE
     fb.parsed["rr_intervals"] = .intArray(rrs)
     // Bytes adjacent to the HR/R-R fields, read off real frames: @36 is a FLAG byte and @37 a duplicate
     // heart rate — not the two halves of one fixed-point HR (see below); the others are raw.
-    if let v = readDType(frame, 33, "u8") {
+    if let v = readDType(frame, 33, "u8", limit) {
         fb.add(33, 1, "cardiac_flags", "cardiac", value: .int(v), note: "raw byte near the HR fields")
     }
     // @36 was read as the low half of a u16 `hr_fixed_8_8` with bpm = value/256. Over 18,650 real v18
@@ -426,65 +504,65 @@ private func decodeWhoop5Historical(_ frame: [UInt8], fb: FieldBuilder, payloadE
     // this flag byte over 256, so the residual is a flat +0.504 ± 0.189. Bit 7 reads as a VALIDITY bit:
     // with it clear (n=748) rr_count == 0 in 70.32% of records vs 19.82% with it set, and the @108/@109
     // sentinel fires in 69.65% vs 1.32%. The remaining bits are unpinned, so the byte ships raw.
-    if let v = readDType(frame, 36, "u8") {
+    if let v = readDType(frame, 36, "u8", limit) {
         fb.add(36, 1, "hr_quality_flags", "hr", value: .int(v),
                note: "flag byte (raw); bit7 = HR/R-R valid, bit4 never set; NOT a fixed-point HR")
     }
     // @37 duplicates heart_rate@22 — equal in 99.575% of records (18,523/18,602), differing only by
     // -6…+2, and it only tracks HR while @36 bit7 is set (99.74% exact vs 94.12% when clear).
-    if let v = readDType(frame, 37, "u8") {
+    if let v = readDType(frame, 37, "u8", limit) {
         fb.add(37, 1, "heart_rate_alt", "hr", value: .int(v),
                note: "bpm; duplicate of heart_rate@22 (99.6% exact); trust only when hr_quality_flags bit7 is set")
     }
-    if let v = readDType(frame, 38, "u16") {
+    if let v = readDType(frame, 38, "u16", limit) {
         fb.add(38, 2, "rr_packed", "rr", value: .int(v), note: "raw u16 near the R-R fields; meaning not pinned")
     }
-    if let v = readDType(frame, 40, "u8") {
+    if let v = readDType(frame, 40, "u8", limit) {
         fb.add(40, 1, "cardiac_status", "cardiac", value: .int(v), note: "raw status-like byte near the HR fields")
     }
     for (name, off) in [("gravity_x", 45), ("gravity_y", 49), ("gravity_z", 53)] {
-        if let d = readF32(frame, off) {
+        if let d = readF32(frame, off, limit) {
             fb.add(off, 4, name, "accel", value: .double(d), note: "g")
         }
     }
     // Per-second fields beyond HR/gravity, each gated to a physically-real range and cross-validated
     // against real v18 frames (worn vs off-wrist), so a wrong offset on an unmapped layout stores
     // nothing rather than garbage (the data is the arbiter).
-    if let d = readF32(frame, 41), d.isFinite, (0...8).contains(d) {
+    if let d = readF32(frame, 41, limit), d.isFinite, (0...8).contains(d) {
         fb.add(41, 4, "dynamic_acceleration", "accel", value: .double(d), note: "g, gravity-removed magnitude")
     }
-    if let raw = readDType(frame, 57, "u16") {
+    if let raw = readDType(frame, 57, "u16", limit) {
         // Cumulative motion/step counter — monotonic across a stream (validated downstream), no midnight
         // reset. Single-frame value is unbounded so it carries no physical gate here.
         fb.add(57, 2, "step_motion_counter", "activity", value: .int(raw), note: "cumulative motion counter")
     }
-    if let cad = readDType(frame, 59, "u8") {
+    if let cad = readDType(frame, 59, "u8", limit) {
         // A per-step cadence-like byte between the step counter and @63: never 0, and lower when moving
         // faster (still > walk > run in the data). Raw — no unit asserted.
         fb.add(59, 1, "step_cadence", "activity", value: .int(cad), note: "cadence-like byte (raw)")
     }
-    if let wear = readDType(frame, 63, "u8"), (0...2).contains(wear) {
+    if let wear = readDType(frame, 63, "u8", limit), (0...2).contains(wear) {
         fb.add(63, 1, "motion_wear_quality", "quality", value: .int(wear), note: "0=still/good, 1, 2=poor contact")
     }
     // @63 also reads as a small validated ACTIVITY-CLASS enum (community finding, #316): 0=still, 1=walk,
     // 2=run, 0xFF=invalid. A lightweight, no-cloud per-record activity readout that rides alongside the
     // step counter. Only the four known codes are surfaced — anything else (incl. 0xFF) stores nothing so
     // an unmapped firmware can't inject garbage.
-    if let cls = readDType(frame, 63, "u8"), cls == 0 || cls == 1 || cls == 2 {
+    if let cls = readDType(frame, 63, "u8", limit), cls == 0 || cls == 1 || cls == 2 {
         fb.add(63, 1, "activity_class", "activity", value: .int(cls), note: "0=still, 1=walk, 2=run (0xFF=invalid)")
     }
     // Two auxiliary thermal channels just before skin_temp. Each is a signed i16 whose value/10 reads as
     // °C, tracks skin_temp@73 closely (corr ~0.92 and ~0.97 across the captured corpus) and follows the
     // same diurnal curve. Gated to a plausible thermal range so a wrong offset stores nothing.
-    if let v = readI16(frame, 69), (0...60).contains(Double(v) / 10.0) {
+    if let v = readI16(frame, 69, limit), (0...60).contains(Double(v) / 10.0) {
         fb.add(69, 2, "temp_aux_1_raw", "temp", value: .int(v),
                note: "secondary temperature channel; °C = value/10; tracks skin_temp (corr ~0.92) with the same diurnal curve")
     }
-    if let v = readI16(frame, 71), (0...60).contains(Double(v) / 10.0) {
+    if let v = readI16(frame, 71, limit), (0...60).contains(Double(v) / 10.0) {
         fb.add(71, 2, "temp_aux_2_raw", "temp", value: .int(v),
                note: "secondary temperature channel; °C = value/10; tracks skin_temp (corr ~0.97) with the same diurnal curve")
     }
-    if let raw = readDType(frame, 73, "u16") {
+    if let raw = readDType(frame, 73, "u16", limit) {
         // Skin temperature from a digital skin-temperature sensor. Emitted as the RAW u16 register
         // (`skin_temp_raw`, consumed by the decode-features store) to stay scale-agnostic; °C = raw/100
         // is the divisor that yields physiological worn skin temps (median ~34 °C across two straps;
@@ -498,20 +576,20 @@ private func decodeWhoop5Historical(_ frame: [UInt8], fb: FieldBuilder, payloadE
                    note: "raw register; °C = raw/100 (≈30.6 worn / ~22.5 ambient; on-wrist warming curve)")
         }
     }
-    if let raw = readDType(frame, 75, "u16") {
+    if let raw = readDType(frame, 75, "u16", limit) {
         // A 16-bit status word. NOT a deep-sleep marker: across ~258k records its low nibble is 0 and it
         // occurs as often awake as asleep (the community "80 = deep" reading is a misread).
         fb.add(75, 2, "status_word", "status", value: .int(raw), note: "packed status word; not deep-sleep")
     }
-    if let v = readDType(frame, 77, "u16") {
+    if let v = readDType(frame, 77, "u16", limit) {
         fb.add(77, 2, "status_word_1", "status", value: .int(v),
                note: "raw; near-static sibling of status_word@75 (low nibble = 1)")
     }
-    if let v = readDType(frame, 79, "u16") {
+    if let v = readDType(frame, 79, "u16", limit) {
         fb.add(79, 2, "status_word_2", "status", value: .int(v),
                note: "raw; sibling of @75 (low nibble = 2)")
     }
-    if let sb = readDType(frame, 81, "u8") {
+    if let sb = readDType(frame, 81, "u8", limit) {
         // High nibble (bits 4-5) tracks a scored night: 0 wake / 1 still / 2 asleep / 3 up; low nibble =
         // sub-flags. Deep/REM/light are computed off-band, not present here.
         let state = (sb >> 4) & 3
@@ -529,7 +607,7 @@ private func decodeWhoop5Historical(_ frame: [UInt8], fb: FieldBuilder, payloadE
         fb.add(81, 1, "sleep_state_byte", "sleep", value: .int(sb),
                note: "the RAW @81 flag byte, all 8 bits (b0-1 onwrist, b2-3 wake_quality, b4-5 sleep_state, b6-7 reserved)")
     }
-    if let v = readDType(frame, 82, "u8") {
+    if let v = readDType(frame, 82, "u8", limit) {
         fb.add(82, 1, "aux_byte_82", "status", value: .int(v),
                note: "raw; nonzero only while sleep_state = asleep; tri-mode, see spo2_candidate_82")
         // #103 SpO2 candidate: a decompile-sourced decode (gen5.rs `spo2_pct`, reimplemented here as a
@@ -569,7 +647,7 @@ private func decodeWhoop5Historical(_ frame: [UInt8], fb: FieldBuilder, payloadE
     // unremarkably while worn (@106 in 10 records, @107 in 103). Magnitudes are device-specific (102–255 /
     // 119–247 on the R22 strap vs 20–66 / 34–81 on another), so no scale is asserted.
     for (name, off) in [("optical_baseline_a", 106), ("optical_baseline_b", 107)] {
-        if let v = readDType(frame, off, "u8") {
+        if let v = readDType(frame, off, "u8", limit) {
             fb.add(off, 1, name, "optical", value: .int(v),
                    note: "u8 optical/ADC baseline channel; wanders overnight, 0 = off-wrist; raw, not pinned")
         }
@@ -586,15 +664,15 @@ private func decodeWhoop5Historical(_ frame: [UInt8], fb: FieldBuilder, payloadE
     // and predicts the band's own beat-detection failure (rr_count == 0) at 79.44% vs 19.40% — a 4.09×
     // lift that SURVIVES holding motion constant (4.11× within dyn_acc < 0.009 g), where shuffled and
     // circular-shift nulls all sit at ~1.0×. It is the same quality condition @36 bit7 reports.
-    if let a = readDType(frame, 108, "u8") {
+    if let a = readDType(frame, 108, "u8", limit) {
         fb.add(108, 1, "optical_amp_a", "optical", value: .int(a),
                note: "paired optical channel A (≈ optical_amp_b@109); tracks motion, not HR; 128 = record-level signal-quality sentinel; raw")
     }
-    if let b = readDType(frame, 109, "u8") {
+    if let b = readDType(frame, 109, "u8", limit) {
         fb.add(109, 1, "optical_amp_b", "optical", value: .int(b),
                note: "paired optical channel B (see optical_amp_a@108); 128 = record-level sentinel, always together with @108; raw")
     }
-    if let d = readF32(frame, 113), d.isFinite {
+    if let d = readF32(frame, 113, limit), d.isFinite {
         // A float32 at @113 (observed range ~ -5.3…0, 0 = unset); purpose unknown, carried raw.
         fb.add(113, 4, "unknown_f32_113", "aux", value: .double(d), note: "float32, purpose unknown")
     }
@@ -624,28 +702,28 @@ private func decodeWhoop5Historical(_ frame: [UInt8], fb: FieldBuilder, payloadE
 /// The samples are raw AC-coupled ADC counts — PPG has no absolute unit — so they are exposed verbatim
 /// as `ppg_waveform` with NO invented scale. The bytes before [27] (header + a block index) and the
 /// footer after [75] are not mapped; SpO₂/skin-temp have no internal proxy and are left untouched.
-private func decodeWhoop5HistoricalV26(_ frame: [UInt8], fb: FieldBuilder) {
+private func decodeWhoop5HistoricalV26(_ frame: [UInt8], fb: FieldBuilder, limit: Int) {
     // @21 is a small per-burst counter (`burst_index`), NOT the optical channel (PR#553). An earlier read
     // labelled it `ppg_channel` and gated it 1…26 because our two original fixtures happened to read 1 and
     // 2 — but a later capture read 65, far outside any 26-channel sweep, so @21 is not a stable channel id.
     // Re-surfaced as the neutral `burst_index` (gated bi > 0, the observed always-set sentinel) with NO
     // channel/LED semantics claimed; the physical optical-channel mapping is unproven and left unasserted.
-    if let bi = readDType(frame, 21, "u8"), bi > 0 {
+    if let bi = readDType(frame, 21, "u8", limit), bi > 0 {
         fb.add(21, 1, "burst_index", "ppg", value: .int(bi),
                note: "per-burst counter (raw); NOT a channel id")
     }
     // record_index@11 (PR#563): the same monotonic lifetime per-record counter the v18/v20/v21 records
     // carry at @11 — +1 per record, independent of unix (advances across gaps). The only @11+ v26 field
     // proven by behaviour; everything else below stays raw/neutral.
-    if let idx = readDType(frame, 11, "u32") {
+    if let idx = readDType(frame, 11, "u32", limit) {
         fb.add(11, 4, "record_index", "meta", value: .int(idx), note: "monotonic lifetime record index")
     }
-    if let unix = readDType(frame, 15, "u32") {
+    if let unix = readDType(frame, 15, "u32", limit) {
         fb.add(15, 4, "unix", "time", value: .int(unix), note: "real unix seconds")
     }
     var samples: [Int] = []
     for off in stride(from: 27, to: 75, by: 2) {
-        guard let v = readI16(frame, off) else { break }
+        guard let v = readI16(frame, off, limit) else { break }
         samples.append(v)
     }
     if !samples.isEmpty {
@@ -659,7 +737,7 @@ private func decodeWhoop5HistoricalV26(_ frame: [UInt8], fb: FieldBuilder) {
     // waveform block; @75/@79/@81/@82 trail it. (`@27…@75` is the proven waveform handled above.)
     for (name, off) in [("raw_u8_19", 19), ("raw_u8_23", 23), ("raw_u8_25", 25),
                         ("raw_u8_75", 75), ("raw_u8_79", 79), ("raw_u8_81", 81), ("raw_u8_82", 82)] {
-        if let v = readDType(frame, off, "u8") {
+        if let v = readDType(frame, off, "u8", limit) {
             fb.add(off, 1, name, "raw", value: .int(v), note: "raw byte @\(off); meaning not pinned")
         }
     }
@@ -686,14 +764,15 @@ private func decodeWhoop5HistoricalV26(_ frame: [UInt8], fb: FieldBuilder) {
 /// but its measurement wavelengths and channel geometry remain OPEN, so those channels stay neutrally
 /// named. This layer exposes raw i16 (v21) or sign-extended i32 (v20) arrays; `Whoop5RawImu.decode`
 /// applies the v21 physical scales.
-private func decodeWhoop5HistoricalV2021(_ frame: [UInt8], fb: FieldBuilder, version: Int, payloadEnd: Int?) {
-    if frame.count > 10 {
-        fb.add(10, 1, "layout_marker", "meta", value: .int(Int(frame[10])))
+private func decodeWhoop5HistoricalV2021(_ frame: [UInt8], fb: FieldBuilder, version: Int,
+                                         payloadEnd: Int?, limit: Int) {
+    if let marker = readU8(frame, 10, limit) {
+        fb.add(10, 1, "layout_marker", "meta", value: .int(marker))
     }
-    if let idx = readU32(frame, 11) {
+    if let idx = readU32(frame, 11, limit) {
         fb.add(11, 4, "record_index", "meta", value: .int(idx), note: "monotonic lifetime record index")
     }
-    if let unix = readU32(frame, 15) {
+    if let unix = readU32(frame, 15, limit) {
         fb.add(15, 4, "unix", "time", value: .int(unix), note: "real unix seconds")
     }
     if version == 21 {
@@ -711,7 +790,7 @@ private func decodeWhoop5HistoricalV2021(_ frame: [UInt8], fb: FieldBuilder, ver
         for (name, start) in channels {
             var samples: [Int] = []
             for i in 0..<100 {
-                guard let v = readI16(frame, start + i * 2) else { break }
+                guard let v = readI16(frame, start + i * 2, limit) else { break }
                 samples.append(v)
             }
             if samples.count == 100 {
@@ -767,10 +846,10 @@ private func decodeWhoop5HistoricalV2021(_ frame: [UInt8], fb: FieldBuilder, ver
 /// drive the `HISTORICAL_DATA_RESULT` ack. Offsets are the 4.0 metadata post-hook positions + 4,
 /// verified on real WHOOP 5 HISTORY_END frames (trim decodes consistently across a whole capture).
 /// `end_data` to echo back in the ack is `frame[21..29]` (trim u32 + next u32).
-private func decodeWhoop5Metadata(_ frame: [UInt8], fb: FieldBuilder) {
-    if let unix = readDType(frame, 11, "u32") { fb.add(11, 4, "unix", "time", value: .int(unix)) }
-    if let ss = readDType(frame, 15, "u16") { fb.add(15, 2, "subsec", "time", value: .int(ss)) }
-    if let trim = readDType(frame, 21, "u32") {
+private func decodeWhoop5Metadata(_ frame: [UInt8], fb: FieldBuilder, limit: Int) {
+    if let unix = readDType(frame, 11, "u32", limit) { fb.add(11, 4, "unix", "time", value: .int(unix)) }
+    if let ss = readDType(frame, 15, "u16", limit) { fb.add(15, 2, "subsec", "time", value: .int(ss)) }
+    if let trim = readDType(frame, 21, "u32", limit) {
         fb.add(21, 4, "trim_cursor", "meta", value: .int(trim), note: "ack with this to advance")
     }
 }
@@ -790,9 +869,10 @@ public func whoop5HistoricalAckFrame(endData: [UInt8], seq: UInt8) -> [UInt8] {
 /// mapped from a real WHOOP 5 capture (firmware 50.38.1.0), not ported on faith. Commands that return
 /// a short stub on this firmware (REPORT_VERSION_INFO / GET_EXTENDED_BATTERY_INFO) or aren't served
 /// (GET_CLOCK — unneeded, since realtime + historical carry real unix) are intentionally left undecoded.
-private func decodeWhoop5CommandResponse(_ frame: [UInt8], fb: FieldBuilder, schema: Schema, payloadEnd: Int?) {
+private func decodeWhoop5CommandResponse(_ frame: [UInt8], fb: FieldBuilder, schema: Schema,
+                                         payloadEnd: Int?, limit: Int) {
     guard let payloadEnd = payloadEnd, 11 < payloadEnd, payloadEnd <= frame.count else { return }
-    let respCmd = Int(frame[10])
+    guard let respCmd = readU8(frame, 10, limit) else { return }
     let name = schema.enumName("CommandNumber", respCmd)   // e.g. "GET_BATTERY_LEVEL(26)"
     let pay = Array(frame[11..<payloadEnd])
     fb.region(11, payloadEnd, "response payload", "cmd")
@@ -861,16 +941,16 @@ private func decodeWhoop5CommandResponse(_ frame: [UInt8], fb: FieldBuilder, sch
 /// borrowed from another enum (`CommandNumber` 123 is `SELECT_WRIST`) or invented. Other events'
 /// payloads (EXTENDED_BATTERY_INFORMATION, STRAP_CONDITION_REPORT) lack on-device 5.0 ground truth and
 /// are intentionally left raw rather than ported from 4.0 on faith.
-private func decodeWhoop5Event(_ frame: [UInt8], fb: FieldBuilder, schema: Schema) {
-    guard let evVal = readDType(frame, 10, "u8") else { return }
+private func decodeWhoop5Event(_ frame: [UInt8], fb: FieldBuilder, schema: Schema, limit: Int) {
+    guard let evVal = readDType(frame, 10, "u8", limit) else { return }
     guard schema.enums["EventNumber"]?[String(evVal)] == "BATTERY_LEVEL" else { return }
-    if let raw = readDType(frame, 21, "u16"), raw <= 1100 {
+    if let raw = readDType(frame, 21, "u16", limit), raw <= 1100 {
         fb.add(21, 2, "battery_pct", "battery", value: .double(Double(raw) / 10), note: "%")
     }
-    if let mv = readDType(frame, 25, "u16"), (3000...4300).contains(mv) {
+    if let mv = readDType(frame, 25, "u16", limit), (3000...4300).contains(mv) {
         fb.add(25, 2, "battery_mV", "battery", value: .int(mv), note: "mV")
     }
-    if let ch = readDType(frame, 30, "u8"), ch <= 1 {
+    if let ch = readDType(frame, 30, "u8", limit), ch <= 1 {
         fb.add(30, 1, "battery_charging", "battery", value: .int(ch & 1))
     }
 }
@@ -890,12 +970,13 @@ private func decodeWhoop5Event(_ frame: [UInt8], fb: FieldBuilder, schema: Schem
 /// `Framing.decodeConsoleLogsWhoop5`, same offsets. The text key is "log" — matching the Python
 /// reference decoder that `golden.json` is generated from, which `ParityTests` pins. Kotlin used
 /// "console" for the same field, and the mismatch is why a reader ported from that side got nil.
-private func decodeWhoop5ConsoleLogs(_ frame: [UInt8], fb: FieldBuilder, payloadEnd: Int?) {
-    if let idx = readDType(frame, 9, "u16") {
+private func decodeWhoop5ConsoleLogs(_ frame: [UInt8], fb: FieldBuilder, payloadEnd: Int?,
+                                     limit: Int) {
+    if let idx = readDType(frame, 9, "u16", limit) {
         fb.add(9, 2, "record_index", "meta", value: .int(idx), note: "per-chunk counter")
     }
-    if let unix = readDType(frame, 12, "u32") { fb.add(12, 4, "unix", "time", value: .int(unix)) }
-    if let ss = readDType(frame, 16, "u16") { fb.add(16, 2, "subsec", "time", value: .int(ss)) }
+    if let unix = readDType(frame, 12, "u32", limit) { fb.add(12, 4, "unix", "time", value: .int(unix)) }
+    if let ss = readDType(frame, 16, "u16", limit) { fb.add(16, 2, "subsec", "time", value: .int(ss)) }
     guard let payloadEnd = payloadEnd, 21 < payloadEnd, payloadEnd <= frame.count else { return }
     var textBytes = Array(frame[21..<payloadEnd])
     while textBytes.last == 0 { textBytes.removeLast() }
diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/PostHooks.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/PostHooks.swift
index aab5f9bd4f..eb946e452d 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/PostHooks.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/PostHooks.swift
@@ -1,41 +1,64 @@
 import Foundation
 
-// Local LE readers mirroring interpreter._read (nil when out of range).
-private func u8(_ f: [UInt8], _ off: Int) -> Int? { off + 1 <= f.count ? Int(f[off]) : nil }
-private func u16(_ f: [UInt8], _ off: Int) -> Int? {
-    off + 2 <= f.count ? Int(f[off]) | (Int(f[off + 1]) << 8) : nil
+/// The exclusive upper bound for reading a named inner field out of `frame` (D7), computed exactly as
+/// the interpreter's own `payloadLimit`: the MINIMUM of where the CRC32 trailer starts and how many
+/// bytes the frame actually has.
+///
+/// The post-hooks run on the parse path and read the schema-driven fields, so they need the same bound
+/// the interpreter applies to the fields it reads itself — clamping only against the frame size lets a
+/// frame near the family minimum have its own checksum trailer decoded as a metadata value. Neither
+/// half may be dropped: the trailer start follows from the DECLARED length, which on a truncated frame
+/// points past the last byte we hold, and reading to it alone would run off the end of the buffer.
+/// A field counts as present when its start plus its length does not EXCEED this bound.
+///
+/// On WHOOP 4.0 — the only family whose parse dispatches through this registry — the trailer starts at
+/// the declared length, which is exactly the `length` argument every hook is handed.
+private func payloadLimit(_ frame: [UInt8], trailerStart: Int?) -> Int {
+    guard let trailerStart = trailerStart else { return frame.count }
+    return min(max(0, trailerStart), frame.count)
+}
+
+// Local LE readers mirroring interpreter._read (nil when out of range). `limit` is the D7 payload bound
+// from `payloadLimit`; it is a required argument, never defaulted, so a field read added later cannot
+// silently skip the decision about where its bytes may come from.
+private func u8(_ f: [UInt8], _ off: Int, _ limit: Int) -> Int? {
+    off >= 0 && off + 1 <= limit ? Int(f[off]) : nil
+}
+private func u16(_ f: [UInt8], _ off: Int, _ limit: Int) -> Int? {
+    off >= 0 && off + 2 <= limit ? Int(f[off]) | (Int(f[off + 1]) << 8) : nil
 }
-private func u32(_ f: [UInt8], _ off: Int) -> UInt32? {
-    guard off + 4 <= f.count else { return nil }
+private func u32(_ f: [UInt8], _ off: Int, _ limit: Int) -> UInt32? {
+    guard off >= 0, off + 4 <= limit else { return nil }
     return UInt32(f[off]) | (UInt32(f[off + 1]) << 8) | (UInt32(f[off + 2]) << 16) | (UInt32(f[off + 3]) << 24)
 }
 /// signed 24-bit little-endian (mirrors interpreter._read "s24"); nil when out of range.
-private func s24(_ f: [UInt8], _ off: Int) -> Int? {
-    guard off + 3 <= f.count else { return nil }
+private func s24(_ f: [UInt8], _ off: Int, _ limit: Int) -> Int? {
+    guard off >= 0, off + 3 <= limit else { return nil }
     let v = Int(f[off]) | (Int(f[off + 1]) << 8) | (Int(f[off + 2]) << 16)
     return (v & 0x800000) != 0 ? v - 0x1000000 : v
 }
 /// IEEE-754 float32 LE -> Double (exact, NO rounding). nil when out of range.
-private func f32(_ f: [UInt8], _ off: Int) -> Double? {
-    guard let bits = u32(f, off) else { return nil }
+private func f32(_ f: [UInt8], _ off: Int, _ limit: Int) -> Double? {
+    guard let bits = u32(f, off, limit) else { return nil }
     return Double(Float(bitPattern: bits))
 }
 /// Read an unsigned integer dtype (u8/u16/u32) as Int; nil when out of range.
-private func readHistInt(_ f: [UInt8], _ off: Int, _ dtype: String) -> Int? {
+private func readHistInt(_ f: [UInt8], _ off: Int, _ dtype: String, _ limit: Int) -> Int? {
     switch dtype {
-    case "u8": return u8(f, off)
-    case "u16": return u16(f, off)
-    case "u32": return u32(f, off).map { Int($0) }
+    case "u8": return u8(f, off, limit)
+    case "u16": return u16(f, off, limit)
+    case "u32": return u32(f, off, limit).map { Int($0) }
     default: return nil
     }
 }
 
-/// Read `count` signed i16 LE starting at off, clamping count to the available bytes
+/// Read `count` signed i16 LE starting at off, clamping count to the readable payload bytes
 /// (mirrors interpreter._i16_block).
-private func i16Block(_ frame: [UInt8], _ off: Int, _ count: Int) -> [Int] {
+private func i16Block(_ frame: [UInt8], _ off: Int, _ count: Int, _ limit: Int) -> [Int] {
+    guard off >= 0 else { return [] }
     var n = count
-    if off + n * 2 > frame.count {
-        n = max(0, (frame.count - off) / 2)
+    if off + n * 2 > limit {
+        n = max(0, (limit - off) / 2)
     }
     guard n > 0 else { return [] }
     var out: [Int] = []
@@ -104,13 +127,17 @@ private let utcRangeFormatter: DateFormatter = {
 }()
 
 func registerPostHooks() {
-    postHooks["realtime_data"] = { fb, frame, _, _ in
-        let rrn = u8(frame, 13) ?? 0
+    postHooks["realtime_data"] = { fb, frame, length, _ in
+        let limit = payloadLimit(frame, trailerStart: length)
+        // D7: the R-R count is a named inner field, so it comes from payload bytes only. On a frame
+        // whose record is cut short, the byte at 13 is part of the CRC32 trailer — reading it as a
+        // count made the trailer dictate how many "intervals" to decode out of the trailer itself.
+        let rrn = u8(frame, 13, limit) ?? 0
         var rrs: [Int] = []
         for i in 0..<rrn {
             // Drop 0 ms intervals here too, matching the historical path (Streams.extractStreams);
             // a 0 ms R-R is a placeholder, not a beat-to-beat interval.
-            if let v = u16(frame, 14 + i * 2), v > 0 {
+            if let v = u16(frame, 14 + i * 2, limit), v > 0 {
                 fb.add(14 + i * 2, 2, "rr[\(i)]", "rr", value: .int(v), note: "ms")
                 rrs.append(v)
             }
@@ -119,7 +146,8 @@ func registerPostHooks() {
     }
 
     postHooks["event"] = { fb, frame, length, schema in
-        let evVal = frame.count > 6 ? Int(frame[6]) : nil
+        let limit = payloadLimit(frame, trailerStart: length)
+        let evVal = u8(frame, 6, limit)
         let evName = evVal.flatMap { schema.enums["EventNumber"]?[String($0)] }
         guard let length = length else { return }
         if evName == "BATTERY_LEVEL" {
@@ -128,18 +156,18 @@ func registerPostHooks() {
             // u32 event_timestamp@8). Emitted ~every 8 min → a DENSE battery series.
             //   soc% = u16@17/10 · mV = u16@21 · charging = u8@26 bit0
             fb.region(7, length, "BATTERY_LEVEL payload", "battery", note: "soc@17(/10) mv@21 charge@26")
-            if let raw = u16(frame, 17), raw <= 1100 {
+            if let raw = u16(frame, 17, limit), raw <= 1100 {
                 fb.parsed["battery_pct"] = .double(Double(raw) / 10)
             }
-            if let mv = u16(frame, 21), (3000...4300).contains(mv) {
+            if let mv = u16(frame, 21, limit), (3000...4300).contains(mv) {
                 fb.parsed["battery_mV"] = .int(mv)
             }
-            if let ch = u8(frame, 26), ch <= 1 {
+            if let ch = u8(frame, 26, limit), ch <= 1 {
                 fb.parsed["battery_charging"] = .int(ch & 1)
             }
         } else if evName == "EXTENDED_BATTERY_INFORMATION" {
             // Not decoded by the WHOOP app; keep the heuristic mV scan only.
-            let payEnd = min(length, frame.count)
+            let payEnd = limit
             guard 7 < payEnd else { return }
             let pay = Array(frame[7..<payEnd])
             fb.region(7, length, "EXTENDED_BATTERY_INFORMATION payload", "battery", note: "mV (heuristic scan)")
@@ -157,7 +185,9 @@ func registerPostHooks() {
 
     postHooks["command_response"] = { fb, frame, length, schema in
         guard let length = length else { return }
-        let payEnd = min(length, frame.count)
+        // Already the D7 bound: `payloadLimit` is exactly this minimum, so the response payload was
+        // never read out of the CRC32 trailer. Kept as the shared helper so the rule has one spelling.
+        let payEnd = payloadLimit(frame, trailerStart: length)
         guard 7 <= payEnd else { return }
         let pay = Array(frame[7..<payEnd])
         fb.region(7, length, "response payload", "cmd")
@@ -173,7 +203,7 @@ func registerPostHooks() {
         if pay.count >= 2 {
             fb.add(8, 1, "result", "cmd", value: .string(schema.enumName("CommandResult", Int(pay[1]))))
         }
-        let cmd = frame.count > 6 ? Int(frame[6]) : nil
+        let cmd = u8(frame, 6, payEnd)
         let name = cmd.flatMap { schema.enums["CommandNumber"]?[String($0)] }
         switch name {
         case "GET_BATTERY_LEVEL" where pay.count >= 4:
@@ -229,6 +259,7 @@ func registerPostHooks() {
 
     postHooks["raw_data"] = { fb, frame, length, schema in
         guard let length = length else { return }
+        let limit = payloadLimit(frame, trailerStart: length)
         let spec = schema.packet(forType: Int(frame[4]))
         let dataLen = length - 7
         guard let variant = spec?.variants[String(dataLen)] else {
@@ -241,20 +272,20 @@ func registerPostHooks() {
                   let rrFirstOff = variant.rrFirstOff,
                   let samples = variant.samples,
                   let tailFrom = variant.tailFrom else { return }
-            let hr = u8(frame, hrOff)
-            let rrn = u8(frame, rrCountOff) ?? 0
+            let hr = u8(frame, hrOff, limit)
+            let rrn = u8(frame, rrCountOff, limit) ?? 0
             fb.add(hrOff, 1, "heart_rate", "hr", value: hr.map { .int($0) }, note: "bpm")
             fb.add(rrCountOff, 1, "rr_count", "rr", value: .int(rrn))
             var rrVals: [Int] = []
             for i in 0..<min(rrn, 4) {
                 let off = rrFirstOff + i * 2
-                fb.add(off, 2, "rr[\(i)]", "rr", value: u16(frame, off).map { .int($0) }, note: "ms")
-                if let v = u16(frame, off) { rrVals.append(v) }
+                fb.add(off, 2, "rr[\(i)]", "rr", value: u16(frame, off, limit).map { .int($0) }, note: "ms")
+                if let v = u16(frame, off, limit) { rrVals.append(v) }
             }
             fb.parsed["heart_rate"] = hr.map { .int($0) }
             fb.parsed["rr_intervals"] = .intArray(rrVals)
             for axis in variant.axes {
-                let vals = i16Block(frame, axis.off, samples)
+                let vals = i16Block(frame, axis.off, samples, limit)
                 let mean: Double? = vals.isEmpty ? nil
                     : round1(Double(vals.reduce(0, +)) / Double(vals.count))
                 let text: ParsedValue? = mean.map { .string("mean=\(formatMean($0)) (\(vals.count)xi16)") }
@@ -283,7 +314,7 @@ func registerPostHooks() {
             fb.region(configFrom, ppgOff, "optical config header (UNKNOWN)", "unknown", note: variant.note)
             var vals: [Int] = []
             for i in 0..<ppgSamples {
-                guard let v = s24(frame, ppgOff + i * ppgStride) else { break }
+                guard let v = s24(frame, ppgOff + i * ppgStride, limit) else { break }
                 vals.append(v)
             }
             if !vals.isEmpty {
@@ -303,8 +334,12 @@ func registerPostHooks() {
 
     postHooks["historical_data"] = { fb, frame, length, schema in
         guard let length = length else { return }
+        let limit = payloadLimit(frame, trailerStart: length)
         let spec = schema.packet(forType: Int(frame[4]))
-        let version = Int(frame[5])
+        // The layout version is the inner record's seq slot — a named inner field, bounded like any
+        // other. Out of the payload it stays -1, which routes the record to the unmapped branch instead
+        // of letting a checksum byte choose a field map. Mirrors the 5/MG twin in the interpreter.
+        let version = u8(frame, 5, limit) ?? -1
         fb.parsed["hist_version"] = .int(version)
 
         // WHOOP 4.0 **v25** historical layout (issue #30). Reverse-engineered from 45 real records on
@@ -315,12 +350,12 @@ func registerPostHooks() {
         // the sleep stager gates on (it returns no stages without gravity). Additive + version-gated,
         // so v18/v24/v26 straps are untouched.
         if version == 25, frame.count >= 79 {
-            if let unix = u32(frame, 11) {
+            if let unix = u32(frame, 11, limit) {
                 fb.add(11, 4, "unix", "time", value: .int(Int(unix)), note: "real unix seconds")
                 fb.parsed["unix"] = .int(Int(unix))
             }
             func grav(_ off: Int) -> Double? {
-                guard let u = u16(frame, off) else { return nil }
+                guard let u = u16(frame, off, limit) else { return nil }
                 return Double(u >= 32768 ? u - 65536 : u) / 16384.0   // i16 LE, ±2 g full-scale
             }
             if let gx = grav(73), let gy = grav(75), let gz = grav(77) {
@@ -356,14 +391,14 @@ func registerPostHooks() {
             let value: ParsedValue
             switch dtype {
             case "u8", "u16", "u32":
-                guard let v = readHistInt(frame, fld.off, dtype) else { continue }
+                guard let v = readHistInt(frame, fld.off, dtype, limit) else { continue }
                 if let enumKey = fld.`enum` {
                     value = .string(schema.enumName(enumKey, v))
                 } else {
                     value = .int(v)
                 }
             case "f32":
-                guard let d = f32(frame, fld.off) else { continue }
+                guard let d = f32(frame, fld.off, limit) else { continue }
                 value = .double(d)  // NO rounding — float32->Double is exact.
             default:
                 continue
@@ -375,7 +410,7 @@ func registerPostHooks() {
             let rrn = fb.parsed["rr_count"]?.intValue ?? 0
             for i in 0..<min(rrn, 4) {
                 let o = rrFirst + i * 2
-                if let v = u16(frame, o), v != 0 {
+                if let v = u16(frame, o, limit), v != 0 {
                     fb.add(o, 2, "rr[\(i)]", "rr", value: .int(v), note: "ms")
                     rrVals.append(v)
                 }
@@ -406,7 +441,10 @@ func registerPostHooks() {
 
     postHooks["metadata"] = { fb, frame, length, _ in
         guard let length = length else { return }
-        let payEnd = min(length, frame.count)
+        // The metadata TYPE byte is read by the interpreter's schema pass, which is bounded there; this
+        // hook only reads the timestamp/trim block, and `payloadLimit` is the same minimum the previous
+        // `min(length, count)` computed — so no metadata value has ever come out of the CRC32 trailer.
+        let payEnd = payloadLimit(frame, trailerStart: length)
         guard 7 < payEnd else { return }
         let pay = Array(frame[7..<payEnd])
         if pay.count >= 14 {
@@ -426,7 +464,9 @@ func registerPostHooks() {
         guard let length = length else { return }
         var txt = ""
         let lo = 11
-        let hi = length - 1
+        // The log text ends one byte before the CRC32 trailer, and never past the bytes we hold: the
+        // same D7 minimum, so a truncated frame yields a shorter string instead of no string at all.
+        let hi = min(length - 1, payloadLimit(frame, trailerStart: length))
         if lo < hi && hi <= frame.count {
             txt = String(decoding: Array(frame[lo..<hi]), as: UTF8.self)
         }
diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/PuffinCapture.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/PuffinCapture.swift
index 39e8975b9b..d30bb3a5e9 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/PuffinCapture.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/PuffinCapture.swift
@@ -17,14 +17,23 @@ public struct PuffinCaptureRecord: Codable, Equatable, Sendable {
     /// Live heart rate from the *standard* `2A37` profile at capture time, when known. This is the
     /// ground-truth cross-check: find the byte that tracks this value to locate the puffin HR field.
     public let hr: Int?
-    /// Best-effort decoded packet type (`parseFrame(_:family:.whoop5)`), or nil if it didn't frame.
+    /// Best-effort decoded packet type (`parseFrame(_:family:.whoop5)`), or nil only when the bytes
+    /// could not be read as a frame at all.
+    ///
+    /// A frame that FAILED its integrity check still carries its type here. That is the point of a
+    /// capture: an unmapped or corrupted frame is precisely what a mapper wants to see, and blanking
+    /// its type would throw away the one thing the decoder did learn. The verdict lives in `ok`, the
+    /// cause in `rejectReason` — the record says what happened rather than going quiet.
     public let typeName: String?
     /// Sequence byte — for historical records this doubles as the record *version*, so it matters.
     public let seq: Int?
-    /// Did the family-aware (CRC16-Modbus header + CRC32 payload) check pass?
+    /// Did the payload CRC32 verify? nil when it could not be computed at all.
     public let crcOK: Bool?
-    /// Did the frame parse as a well-formed puffin envelope at all?
+    /// The FULL integrity verdict: header checksum, payload CRC32 and structural length together.
     public let ok: Bool
+    /// Why `ok` is false; `none` on an intact frame. Additive — older capture files that predate this
+    /// key decode with `none`, so nothing that was readable before stops being readable.
+    public let rejectReason: FrameRejectReason
 
     enum CodingKeys: String, CodingKey {
         case hex, char
@@ -34,6 +43,35 @@ public struct PuffinCaptureRecord: Codable, Equatable, Sendable {
         case seq
         case crcOK = "crc_ok"
         case ok
+        case rejectReason = "reject_reason"
+    }
+
+    public init(hex: String, char: String, tsMs: Int, hr: Int?, typeName: String?, seq: Int?,
+                crcOK: Bool?, ok: Bool, rejectReason: FrameRejectReason = .none) {
+        self.hex = hex
+        self.char = char
+        self.tsMs = tsMs
+        self.hr = hr
+        self.typeName = typeName
+        self.seq = seq
+        self.crcOK = crcOK
+        self.ok = ok
+        self.rejectReason = rejectReason
+    }
+
+    /// Decoding tolerates a MISSING `reject_reason` and defaults it to `none`, so a capture file
+    /// written before this key existed still reads.
+    public init(from decoder: Decoder) throws {
+        let c = try decoder.container(keyedBy: CodingKeys.self)
+        hex = try c.decode(String.self, forKey: .hex)
+        char = try c.decode(String.self, forKey: .char)
+        tsMs = try c.decode(Int.self, forKey: .tsMs)
+        hr = try c.decodeIfPresent(Int.self, forKey: .hr)
+        typeName = try c.decodeIfPresent(String.self, forKey: .typeName)
+        seq = try c.decodeIfPresent(Int.self, forKey: .seq)
+        crcOK = try c.decodeIfPresent(Bool.self, forKey: .crcOK)
+        ok = try c.decode(Bool.self, forKey: .ok)
+        rejectReason = try c.decodeIfPresent(FrameRejectReason.self, forKey: .rejectReason) ?? .none
     }
 }
 
@@ -63,10 +101,13 @@ public final class PuffinCapture {
             char: char,
             tsMs: tsMs,
             hr: hr,
-            typeName: parsed.ok ? parsed.typeName : nil,
+            // PARSEABILITY, not integrity: a frame the verifier rejected keeps the packet type the
+            // decoder read out of it. Only a byte run that produced no type at all records nil.
+            typeName: parsed.isParsable ? parsed.typeName : nil,
             seq: parsed.seq,
             crcOK: parsed.crcOK,
-            ok: parsed.ok
+            ok: parsed.ok,
+            rejectReason: parsed.rejectReason
         )
         records.append(rec)
         return rec
diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/ReTools.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/ReTools.swift
index 61ee8eef96..6217864f74 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/ReTools.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/ReTools.swift
@@ -226,7 +226,18 @@ public enum ReTools {
     public struct GroupInventory: Equatable {
         public let key: String
         public let count: Int
-        public let okCount: Int
+        /// How many frames of the group were INTACT — the verifier's full verdict (header checksum,
+        /// payload CRC32 and structural length together). Named `intactCount` rather than `okCount`
+        /// since the verdict widened: "intact" and "readable" are now different questions, and a census
+        /// that blurred them would report a capture full of decodable frames as decoding nothing.
+        public let intactCount: Int
+        /// How many frames yielded a packet type at all — PARSEABILITY. This is the count that answers
+        /// "can this tool see what these bytes are", which is the question a mapping run asks; it is
+        /// always ≥ `intactCount`.
+        public let parsableCount: Int
+        /// How many frames had a VERIFIED payload CRC32. Kept beside the two above because their
+        /// difference is the interesting one: payload CRC32 right while the envelope is wrong is the
+        /// class that used to pass every gate.
         public let crcOkCount: Int
         public let firstTsMs: Int?
         public let lastTsMs: Int?
@@ -234,9 +245,10 @@ public enum ReTools {
         public let maxLen: Int
     }
 
-    /// A census of a capture: what types/versions it holds, how many of each, how many decoded and
-    /// passed CRC, the timestamp span, and the frame-length spread. The fastest way to see "this strap
-    /// banked a v21 we've never captured" before decoding a single byte.
+    /// A census of a capture: what types/versions it holds, how many of each, how many were intact, how
+    /// many were readable at all, how many passed the payload CRC32, the timestamp span, and the
+    /// frame-length spread. The fastest way to see "this strap banked a v21 we've never captured"
+    /// before decoding a single byte.
     public static func inventory(_ records: [Record]) -> [GroupInventory] {
         let groups = Dictionary(grouping: records, by: { groupKey($0.frame) })
         return groups.map { key, recs in
@@ -244,7 +256,8 @@ public enum ReTools {
             let lens = recs.map { $0.bytes.count }
             return GroupInventory(
                 key: key, count: recs.count,
-                okCount: recs.filter { $0.frame.ok }.count,
+                intactCount: recs.filter { $0.frame.ok }.count,
+                parsableCount: recs.filter { $0.frame.isParsable }.count,
                 crcOkCount: recs.filter { $0.frame.crcOK == true }.count,
                 firstTsMs: ts.min(), lastTsMs: ts.max(),
                 minLen: lens.min() ?? 0, maxLen: lens.max() ?? 0)
diff --git a/Packages/WhoopProtocol/Sources/WhoopProtocol/Streams.swift b/Packages/WhoopProtocol/Sources/WhoopProtocol/Streams.swift
index a556bf99ed..aacfbeb8bd 100644
--- a/Packages/WhoopProtocol/Sources/WhoopProtocol/Streams.swift
+++ b/Packages/WhoopProtocol/Sources/WhoopProtocol/Streams.swift
@@ -800,11 +800,16 @@ private func toWall(_ deviceTs: Int?, _ deviceClockRef: Int, _ wallClockRef: Int
 ///
 /// HR/R-R are taken ONLY from REALTIME_DATA (type 40). REALTIME_RAW_DATA (type 43) also
 /// carries an HR byte but streams alongside type-40 during raw collection, so routing both
-/// would double-count HR for the same instants. CRC-failed and non-ok frames are skipped.
+/// would double-count HR for the same instants. Frames whose integrity verdict is negative are
+/// skipped — no row is derived from a frame that is not intact.
 public func extractStreams(_ parsed: [ParsedFrame],
                            deviceClockRef: Int, wallClockRef: Int) -> Streams {
     var out = Streams()
     for r in parsed {
+        // `ok` is now the FULL verdict — header checksum, payload CRC32 and structural length — so it
+        // alone rejects everything the two-part check used to. The `crcOK` half is kept for the same
+        // reason as in `extractHistoricalStreams`: a parse result decoded from a capture written before
+        // the verdict widened carries the old constant `ok: true` beside a false `crcOK`.
         if !r.ok || r.crcOK == false { continue }
         let p = r.parsed
         switch r.typeName {
diff --git a/Packages/WhoopProtocol/Sources/whoop-decode/main.swift b/Packages/WhoopProtocol/Sources/whoop-decode/main.swift
index 6a5910717d..a28c79f2b2 100644
--- a/Packages/WhoopProtocol/Sources/whoop-decode/main.swift
+++ b/Packages/WhoopProtocol/Sources/whoop-decode/main.swift
@@ -20,8 +20,12 @@ import WhoopProtocol
 //
 // Options:
 //   --family F      whoop4 | whoop5 | auto   (default: auto — per-frame from `char`, else whoop5)
-//   --json          emit decoded frames as JSON (ParsedFrame + provenance) instead of a text dump
-//   --raw-only      print only frames that did NOT fully decode (ok=false) — the RE worklist
+//   --json          emit decoded frames as JSON (ParsedFrame + provenance) instead of a text dump.
+//                   Each frame carries `ok` (the FULL integrity verdict) and `rejectReason` (why not);
+//                   a downstream filter that wants only trustworthy frames filters on `ok`.
+//   --raw-only      print only frames that are NOT intact (ok=false) — the RE worklist. Since the
+//                   verdict widened, that includes frames which decoded fine but whose envelope did
+//                   not verify; they are printed WITH their packet type and rejection reason.
 //   -h, --help      show this help
 
 // MARK: - Input model
@@ -57,6 +61,11 @@ Reads a capture/fixture JSON array of {"hex": …} (the capture tool's richer
 {"hex","char","hr","ts_ms"} records are read too) from FILE or stdin, or raw
 frames from --hex. Family defaults to auto: derived per-frame from `char`
 (fd4b…→whoop5, 6108…→whoop4), falling back to whoop5.
+
+--raw-only selects the frames that are NOT INTACT (ok=false): header checksum,
+payload CRC32 or structural length disagreed. Such a frame is still printed with
+its decoded packet type and a reason=… field naming which rule it failed. In
+--json output the same two values are `ok` and `rejectReason` per frame.
 """
 
 var familyMode: FamilyMode = .auto
@@ -179,7 +188,10 @@ struct DecodedOut: Encodable {
 
 var decodedOut: [DecodedOut] = []
 var typeCounts: [String: Int] = [:]
-var okCount = 0, total = 0
+// INTACT = the verifier's full verdict. PARSED = a packet type came out of the bytes. They are
+// different questions since the verdict widened, and the summary reports both rather than one "ok".
+var intactCount = 0, parsedCount = 0, total = 0
+var rejectCounts: [FrameRejectReason: Int] = [:]
 
 for (n, rec) in records.enumerated() {
     guard let frame = bytes(fromHex: rec.hex) else {
@@ -191,9 +203,14 @@ for (n, rec) in records.enumerated() {
     // the per-field metadata the live pipeline skips.
     let parsed = parseFrame(frame, family: family, collectFields: true)
     total += 1
-    if parsed.ok { okCount += 1 }
+    if parsed.ok { intactCount += 1 } else { rejectCounts[parsed.rejectReason, default: 0] += 1 }
+    if parsed.isParsable { parsedCount += 1 }
     typeCounts[parsed.typeName, default: 0] += 1
 
+    // --raw-only is the RE worklist: the frames this tool could NOT fully account for. It filters on
+    // the integrity verdict, which is what "did not fully decode" now means — a frame with a broken
+    // envelope belongs on that worklist even though its type read fine, and it is printed WITH its type
+    // and its rejection reason rather than dropped.
     if rawOnly && parsed.ok { continue }
 
     if jsonOut {
@@ -202,9 +219,10 @@ for (n, rec) in records.enumerated() {
         continue
     }
 
-    // Text dump.
-    let crc = parsed.crcOK.map { $0 ? "ok" : "BAD" } ?? "—"
-    var head = "[\(n)] \(family.rawValue) ok=\(parsed.ok) type=\(parsed.typeName) seq=\(parsed.seq.map(String.init) ?? "—") crc=\(crc)"
+    // Text dump. The frame line itself is built by the library (`frameInspectionLine`) so a test can
+    // pin the property that a rejected frame keeps its packet type and names its reason; only the
+    // capture provenance, which the library never sees, is appended here.
+    var head = frameInspectionLine(index: n, family: family, parsed: parsed)
     if let c = rec.char { head += " char=\(c)" }
     if let hr = rec.hr { head += " hr=\(hr)" }
     print(head)
@@ -225,9 +243,17 @@ if jsonOut {
     }
 } else {
     // Summary to stderr so it doesn't pollute a piped dump.
-    var summary = "\n— \(okCount)/\(total) frames decoded ok —\n"
+    var summary = "\n— \(intactCount)/\(total) frames intact, \(parsedCount)/\(total) readable —\n"
     for (t, c) in typeCounts.sorted(by: { $0.value > $1.value }) {
         summary += "  \(pad(String(c), 5, right: true))  \(t)\n"
     }
+    // Why the rejected ones were rejected. Never silently omitted, and never overstated: a payload
+    // CRC32 that could not be computed is reported as `payloadCRCUnverifiable`, not as a mismatch.
+    if !rejectCounts.isEmpty {
+        summary += "  rejected by reason:\n"
+        for r in FrameRejectReason.allCases where (rejectCounts[r] ?? 0) > 0 {
+            summary += "  \(pad(String(rejectCounts[r] ?? 0), 5, right: true))  \(r.rawValue)\n"
+        }
+    }
     FileHandle.standardError.write(Data(summary.utf8))
 }
diff --git a/Packages/WhoopProtocol/Sources/whoop-re/main.swift b/Packages/WhoopProtocol/Sources/whoop-re/main.swift
index b4bf4b8084..17a3e7a987 100644
--- a/Packages/WhoopProtocol/Sources/whoop-re/main.swift
+++ b/Packages/WhoopProtocol/Sources/whoop-re/main.swift
@@ -173,12 +173,18 @@ case "coverage":
 
 case "inventory":
     requireFile()
-    print(pad("TYPE/VERSION", 24) + pad("COUNT", 8, right: true) + pad("OK", 8, right: true)
-          + pad("CRC", 8, right: true) + pad("LEN", 12, right: true) + "  TS SPAN")
+    // INTACT (full verdict) and PARSABLE (a packet type was decoded) are separate columns: a capture
+    // whose frames all read fine but whose envelopes are damaged reads 0 INTACT and n PARSABLE, and
+    // collapsing that into one "OK" column would hide which of the two is the problem.
+    print(pad("TYPE/VERSION", 24) + pad("COUNT", 8, right: true) + pad("INTACT", 8, right: true)
+          + pad("PARSED", 8, right: true) + pad("CRC", 8, right: true)
+          + pad("LEN", 12, right: true) + "  TS SPAN")
     for g in ReTools.inventory(loadRecords(positional[0], family)) {
         let lenCol = g.minLen == g.maxLen ? "\(g.minLen)" : "\(g.minLen)-\(g.maxLen)"
         let span = (g.firstTsMs != nil && g.lastTsMs != nil) ? "\(g.firstTsMs!)..\(g.lastTsMs!)" : "—"
-        print(pad(g.key, 24) + pad(String(g.count), 8, right: true) + pad(String(g.okCount), 8, right: true)
+        print(pad(g.key, 24) + pad(String(g.count), 8, right: true)
+              + pad(String(g.intactCount), 8, right: true)
+              + pad(String(g.parsableCount), 8, right: true)
               + pad(String(g.crcOkCount), 8, right: true) + pad(lenCol, 12, right: true) + "  \(span)")
     }
 
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/DataRangeTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/DataRangeTests.swift
index c70ce4d53f..0d97519c24 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/DataRangeTests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/DataRangeTests.swift
@@ -161,4 +161,69 @@ final class DataRangeTests: XCTestCase {
     func testIsPendingResponse_falseForNegativeCmdOff() {
         XCTAssertFalse(DataRange.isPendingResponse([UInt8](repeating: 0, count: 40), cmdOff: -1))
     }
+
+    // MARK: - the BLE seam's gate on this reply (task 2.15)
+
+    /// GET_DATA_RANGE(34) — the opcode the seam compares at `cmdOff`, held by the app target's command
+    /// table; the predicate takes it as an argument rather than restating the protocol fact.
+    private let getDataRangeOpcode: UInt8 = 34
+
+    /// A complete WHOOP 4.0 GET_DATA_RANGE COMMAND_RESPONSE: type@4, seq@5, cmd@6, body from 7 —
+    /// `oldest` on the aligned grid `oldestUnix` scans, `newest` one word later.
+    private func dataRangeReply(oldest: Int, newest: Int) -> [UInt8] {
+        var payload = [UInt8]()
+        for v in [oldest, newest] { for k in 0..<4 { payload.append(UInt8((v >> (8 * k)) & 0xFF)) } }
+        return frameFromPayload(payload, type: 0x24, seq: 1, cmd: getDataRangeOpcode)
+    }
+
+    /// An intact reply is accepted, and it is the value the seam then applies as the reported window
+    /// and as the offload's plausibility bounds.
+    func testAnIntactDataRangeReplyIsAcceptedAndCarriesTheWindow() {
+        let oldest = 1_750_000_000, newest = 1_780_000_000
+        let f = dataRangeReply(oldest: oldest, newest: newest)
+        let p = parseFrame(f, family: .whoop4)
+        XCTAssertTrue(p.ok, "precondition: the reply is intact")
+        XCTAssertTrue(DataRange.acceptsReply(f, cmdOff: 6, opcode: getDataRangeOpcode, verdictOK: p.ok))
+        XCTAssertEqual(DataRange.newestUnix(from: f, wallNowUnix: 1_790_000_000, futureSkewSeconds: skew48h),
+                       newest)
+        XCTAssertEqual(DataRange.oldestUnix(from: f), oldest)
+    }
+
+    /// Scenario "eine Antwort mit falscher Kopfprüfsumme verändert weder den gemeldeten Zeitbereich
+    /// noch die Plausibilitätsgrenzen des Abzugs" (task 2.15). The damaged reply still DECODES a
+    /// window — the verdict is the only thing that keeps it out, which is why the gate has to be a
+    /// predicate a test can hold rather than a condition buried in the seam.
+    func testABrokenDataRangeReplyMovesNeitherTheWindowNorThePlausibilityBounds() {
+        let oldest = 1_750_000_000, newest = 1_780_000_000
+        var bad = dataRangeReply(oldest: oldest, newest: newest)
+        bad[3] ^= 0xFF                                   // CRC-8 over the length field only
+        let p = parseFrame(bad, family: .whoop4)
+        XCTAssertEqual(p.rejectReason, .headerChecksumMismatch)
+        XCTAssertEqual(p.crcOK, true, "precondition: the payload CRC32 still verifies")
+        XCTAssertEqual(DataRange.newestUnix(from: bad, wallNowUnix: 1_790_000_000, futureSkewSeconds: skew48h),
+                       newest, "precondition: these bytes DO carry a window a seam could apply")
+
+        // The seam in miniature: the reported window and the two plausibility bounds, moved only on
+        // an accepted reply. Their previous values must survive a damaged one untouched.
+        var reportedNewest: Int? = 1_700_000_001
+        var boundsNewest: Int? = 1_700_000_001
+        var boundsOldest: Int? = 1_700_000_000
+        if DataRange.acceptsReply(bad, cmdOff: 6, opcode: getDataRangeOpcode, verdictOK: p.ok) {
+            reportedNewest = DataRange.newestUnix(from: bad, wallNowUnix: 1_790_000_000,
+                                                  futureSkewSeconds: skew48h)
+            boundsNewest = reportedNewest
+            boundsOldest = DataRange.oldestUnix(from: bad)
+        }
+        XCTAssertEqual(reportedNewest, 1_700_000_001, "the reported range must not move")
+        XCTAssertEqual(boundsNewest, 1_700_000_001, "the offload's upper plausibility bound must not move")
+        XCTAssertEqual(boundsOldest, 1_700_000_000, "the offload's lower plausibility bound must not move")
+    }
+
+    /// The gate is per-reply, not per-connection: a frame carrying another opcode at `cmdOff` is not a
+    /// data-range reply at all, however intact it is.
+    func testAnotherOpcodeIsNotADataRangeReply() {
+        let other = frameFromPayload([0x00, 0x01, 0x02, 0x03], type: 0x24, seq: 1, cmd: 26)
+        XCTAssertTrue(parseFrame(other, family: .whoop4).ok)
+        XCTAssertFalse(DataRange.acceptsReply(other, cmdOff: 6, opcode: getDataRangeOpcode, verdictOK: true))
+    }
 }
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/DeviceConfigReadProbeTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/DeviceConfigReadProbeTests.swift
index 0151818b65..dde098a781 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/DeviceConfigReadProbeTests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/DeviceConfigReadProbeTests.swift
@@ -505,4 +505,38 @@ final class DeviceConfigReadProbeTests: XCTestCase {
         """
         XCTAssertEqual(report.render(), golden)
     }
+
+    // MARK: - direct caller of the verifier (2.5): the useful path is unchanged
+
+    /// `DeviceConfigReadProbe.parse` gates on `verifyFrame` directly. The ordinary replies must still
+    /// decode under the tightened verifier, and the newly-rejected classes must come back as its own
+    /// `.crc` refusal instead of being read.
+    func testTheOrdinaryReplyStillDecodesUnderTheTightenedVerifier() {
+        let record = echoRecord("enable_r22_packets", value: 0x32, lead: [0x01])
+        let five = whoop5Response(cmd: 128, payload: payload(result: 1, record: record))
+        XCTAssertEqual(verifyFrame(five, family: .whoop5).reason, .none, "precondition: intact")
+        guard case .success(let r) = DeviceConfigReadProbe.parse(frame: five, family: .whoop5, expecting: 128) else {
+            return XCTFail("the 5/MG useful path must still decode")
+        }
+        XCTAssertEqual(r.value(for: "enable_r22_packets"), 0x32)
+
+        let four = whoop4Response(cmd: 121, payload: payload(result: 1, record: echoRecord("k", value: 0x31)))
+        XCTAssertEqual(verifyFrame(four, family: .whoop4).reason, .none)
+        guard case .success = DeviceConfigReadProbe.parse(frame: four, family: .whoop4, expecting: 121) else {
+            return XCTFail("the 4.0 useful path must still decode")
+        }
+    }
+
+    func testAReplyWithTrailingBytesIsRefusedNotRead() {
+        let frame = whoop4Response(cmd: 121, payload: payload(result: 1, record: echoRecord("k", value: 0x31))) + [0x00]
+        XCTAssertEqual(verifyFrame(frame, family: .whoop4).reason, .lengthMismatch)
+        XCTAssertEqual(DeviceConfigReadProbe.parse(frame: frame, family: .whoop4, expecting: 121), .failure(.crc))
+    }
+
+    func testAReplyWithABrokenHeaderChecksumIsRefusedNotRead() {
+        var frame = whoop4Response(cmd: 121, payload: payload(result: 1, record: echoRecord("k", value: 0x31)))
+        frame[3] ^= 0xFF
+        XCTAssertEqual(verifyFrame(frame, family: .whoop4).crc32OK, true, "the payload CRC32 still verifies")
+        XCTAssertEqual(DeviceConfigReadProbe.parse(frame: frame, family: .whoop4, expecting: 121), .failure(.crc))
+    }
 }
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FastPathParityTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FastPathParityTests.swift
index 16c39bb0ae..c9cad4a67a 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FastPathParityTests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FastPathParityTests.swift
@@ -133,7 +133,8 @@ final class FastPathParityTests: XCTestCase {
     /// a full `parseFrame` on TWO things, or the pre-filter's `guard frameTypeName == "EVENT"` could diverge
     /// from the full-parse `guard typeName == "EVENT"` — over-admitting (a wasted parse) or, dangerously,
     /// DROPPING a real gesture:
-    ///   1. for a VALID frame, the exact type name matches;
+    ///   1. for a frame that decodes at all, the exact type name matches (the peek says nothing about
+    ///      INTEGRITY — `parseFrame.ok` is the verifier's verdict, and the two deliberately differ there);
     ///   2. for ANY frame (incl. malformed/short/wrong-SOF), the EVENT *decision* matches — this is the
     ///      property the pre-filter actually rests on, and it must hold even where the two disagree on the
     ///      name (frameTypeName returns nil for a short frame; parseFrame calls it "INVALID/FRAGMENT" — both
@@ -142,7 +143,9 @@ final class FastPathParityTests: XCTestCase {
         func check(_ frame: [UInt8], _ family: DeviceFamily, _ label: String) {
             let peek = frameTypeName(frame, family: family)
             let full = parseFrame(frame, family: family)
-            if full.ok {
+            // Compared on PARSABILITY, not on the integrity verdict: `ok` now reports whether the
+            // frame is intact, and a corrupt frame still decodes a type name the peek must match.
+            if full.typeName != "INVALID/FRAGMENT" {
                 XCTAssertEqual(peek, full.typeName, "frameTypeName != parseFrame.typeName at \(label)")
             }
             // The contract the offload gesture pre-filter depends on: never drop/over-admit an EVENT.
@@ -156,9 +159,9 @@ final class FastPathParityTests: XCTestCase {
         // Malformed / boundary frames the corpus doesn't carry, where a false-negative would silently drop a
         // gesture on real BLE (fragments, corruption). Both peek and full parse must land on "not EVENT".
         check([], .whoop4, "empty")
-        check([0xAA, 0x01, 0x02], .whoop4, "short (below the 8-byte min)")
+        check([0xAA, 0x01, 0x02], .whoop4, "short (below the 11-byte min)")
         check([0x00, 0x18, 0x00, 0xff, 0x28, 0x02, 0x0f, 0x00], .whoop4, "wrong SOF")
-        check(hexToBytes("aa010c000001"), .whoop5, "short 5/MG (below the 12-byte min)")
+        check(hexToBytes("aa010c000001"), .whoop5, "short 5/MG (below the 13-byte min)")
     }
 
     /// The DEFAULT call is the fast path on both entry points, so every live/offload call site
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FeatureFlagProbeTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FeatureFlagProbeTests.swift
index 4b21687df5..137e99c186 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FeatureFlagProbeTests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FeatureFlagProbeTests.swift
@@ -870,4 +870,37 @@ final class FeatureFlagProbeTests: XCTestCase {
         XCTAssertTrue(v.contains("an implausible 9999 flag(s)"), v)
         XCTAssertTrue(v.contains("(inconclusive)"), v)
     }
+
+    // MARK: - direct caller of the verifier (2.5): the useful path is unchanged
+
+    /// `FeatureFlagProbe.record` calls `verifyFrame` itself rather than going through `parseFrame`, so a
+    /// stricter verifier could have silently broken this probe. These pin that it did not — the ordinary
+    /// well-formed replies of BOTH families still decode — and that the classes the verifier newly
+    /// rejects come back as `.crc`, its own refusal, rather than being read as data.
+    func testTheOrdinaryReplyStillDecodesUnderTheTightenedVerifier() {
+        let four = whoop4Response(cmd: 117, payload: payload(result: 1, record: [0x01, 0x0B, 0x00]))
+        XCTAssertTrue(verifyFrame(four, family: .whoop4).ok, "precondition: an ordinary 4.0 reply is intact")
+        XCTAssertEqual(verifyFrame(four, family: .whoop4).reason, .none)
+        guard case .success = FeatureFlagProbe.parseStart(frame: four, family: .whoop4) else {
+            return XCTFail("the 4.0 useful path must still decode")
+        }
+        let five = whoop5Response(cmd: 117, payload: payload(result: 1, record: [0x01, 0x10, 0x00]))
+        XCTAssertTrue(verifyFrame(five, family: .whoop5).ok)
+        guard case .success = FeatureFlagProbe.parseStart(frame: five, family: .whoop5) else {
+            return XCTFail("the 5/MG useful path must still decode")
+        }
+    }
+
+    func testAReplyWithTrailingBytesIsRefusedNotRead() {
+        let frame = whoop4Response(cmd: 117, payload: payload(result: 1, record: [0x01, 0x0B, 0x00])) + [0x00]
+        XCTAssertEqual(verifyFrame(frame, family: .whoop4).reason, .lengthMismatch)
+        XCTAssertEqual(FeatureFlagProbe.parseStart(frame: frame, family: .whoop4), .failure(.crc))
+    }
+
+    func testAReplyWithABrokenHeaderChecksumIsRefusedNotRead() {
+        var frame = whoop4Response(cmd: 117, payload: payload(result: 1, record: [0x01, 0x0B, 0x00]))
+        frame[3] ^= 0xFF
+        XCTAssertEqual(verifyFrame(frame, family: .whoop4).crc32OK, true, "the payload CRC32 still verifies")
+        XCTAssertEqual(FeatureFlagProbe.parseStart(frame: frame, family: .whoop4), .failure(.crc))
+    }
 }
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FrameDiagnosticsTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FrameDiagnosticsTests.swift
new file mode 100644
index 0000000000..b16ac106a9
--- /dev/null
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FrameDiagnosticsTests.swift
@@ -0,0 +1,218 @@
+import XCTest
+@testable import WhoopProtocol
+
+/// Scenario group "Diagnose behält Parsbarkeit und Ablehnungsgrund", plus the two counters D3 asks for.
+///
+/// The frames are the same corpus-derived fixtures the integrity tests use, each broken in exactly ONE
+/// way, so every assertion below attributes a single cause.
+final class FrameDiagnosticsTests: XCTestCase {
+
+    private func hex(_ s: String) -> [UInt8] { FrameIntegrityTests.hex(s) }
+
+    /// A real WHOOP 4.0 REALTIME_DATA frame with ONLY its header checksum broken: the class that
+    /// passed every gate before this change.
+    private func headerBroken() -> [UInt8] {
+        var f = hex(FrameIntegrityTests.w4Valid)
+        f[3] ^= 0xFF
+        return f
+    }
+
+    // MARK: - parseability is not integrity
+
+    func testARejectedFrameKeepsItsPacketType() {
+        let p = parseFrame(headerBroken())
+        XCTAssertFalse(p.ok)
+        XCTAssertTrue(p.isParsable, "the decoder read this frame; only the envelope failed")
+        XCTAssertEqual(p.typeName, "REALTIME_DATA")
+    }
+
+    func testAByteRunThatIsNotAFrameIsNotParsable() {
+        let p = parseFrame([0xAA, 0x00, 0x00])
+        XCTAssertFalse(p.isParsable)
+        XCTAssertEqual(p.typeName, ParsedFrame.unparsableTypeName)
+    }
+
+    func testAnIntactFrameIsBothIntactAndParsable() {
+        let p = parseFrame(hex(FrameIntegrityTests.w4Valid))
+        XCTAssertTrue(p.ok)
+        XCTAssertTrue(p.isParsable)
+        XCTAssertEqual(p.rejectReason, .none)
+    }
+
+    // MARK: - the inspector's line keeps type AND names the reason
+
+    func testInspectionLineOfARejectedFrameCarriesTypeAndReason() {
+        let line = frameInspectionLine(index: 7, family: .whoop4, parsed: parseFrame(headerBroken()))
+        XCTAssertTrue(line.contains("ok=false"), line)
+        XCTAssertTrue(line.contains("type=REALTIME_DATA"), "a rejected frame must keep its type: \(line)")
+        XCTAssertTrue(line.contains("reason=headerChecksumMismatch"), line)
+        // The payload CRC32 verified — the line says so rather than smearing one failure over both.
+        XCTAssertTrue(line.contains("crc=ok"), line)
+    }
+
+    func testInspectionLineOfAnIntactFrameCarriesNoReason() {
+        let line = frameInspectionLine(index: 0, family: .whoop4,
+                                       parsed: parseFrame(hex(FrameIntegrityTests.w4Valid)))
+        XCTAssertTrue(line.contains("ok=true"), line)
+        XCTAssertFalse(line.contains("reason="), "an intact frame has no reason to report: \(line)")
+    }
+
+    /// Scenario "Nicht prüfbar wird nicht als falsch gemeldet": a payload CRC32 that could not be
+    /// computed is reported as unverifiable, and the CRC column stays "—" rather than claiming "BAD".
+    func testUnverifiablePayloadCRCIsNotReportedAsAMismatch() {
+        let p = parseFrame(hex(FrameIntegrityTests.w4Total8))
+        XCTAssertNil(p.crcOK)
+        XCTAssertNotEqual(p.rejectReason, .payloadCRCMismatch)
+        let line = frameInspectionLine(index: 1, family: .whoop4, parsed: p)
+        XCTAssertTrue(line.contains("crc=—"), line)
+        XCTAssertFalse(line.contains("crc=BAD"), "we did not observe a mismatch, so we do not report one")
+    }
+
+    // MARK: - the capture export keeps the type and gains the reason
+
+    func testCaptureRecordKeepsThePacketTypeOfARejectedFrame() {
+        // A 5/MG frame with only its header checksum broken.
+        var frame = hex(FrameIntegrityTests.w5Valid)
+        frame[6] ^= 0xFF
+        let capture = PuffinCapture()
+        let rec = capture.record(frame: frame, char: "fd4b0005", tsMs: 1234, hr: 60)
+        XCTAssertFalse(rec.ok)
+        XCTAssertEqual(rec.typeName, "COMMAND_RESPONSE",
+                       "a capture exists to map unexplained frames; blanking the type throws that away")
+        XCTAssertEqual(rec.rejectReason, .headerChecksumMismatch)
+        XCTAssertEqual(rec.crcOK, true)
+    }
+
+    func testCaptureRecordOfAnIntactFrameCarriesNoReason() {
+        let capture = PuffinCapture()
+        let rec = capture.record(frame: hex(FrameIntegrityTests.w5Valid), char: "fd4b0005",
+                                 tsMs: 1, hr: nil)
+        XCTAssertTrue(rec.ok)
+        XCTAssertEqual(rec.rejectReason, .none)
+    }
+
+    func testCaptureJSONCarriesTheReasonAndOlderCapturesStillDecode() throws {
+        var frame = hex(FrameIntegrityTests.w5Valid)
+        frame[6] ^= 0xFF
+        let capture = PuffinCapture()
+        capture.record(frame: frame, char: "fd4b0005", tsMs: 1234, hr: nil)
+        let json = try XCTUnwrap(String(data: try capture.encodedJSON(), encoding: .utf8))
+        XCTAssertTrue(json.contains("\"reject_reason\" : \"headerChecksumMismatch\""), json)
+        XCTAssertTrue(json.contains("\"type_name\""), "the packet type stays in the export")
+
+        // A record written before the key existed must still decode — additive, not breaking.
+        let legacy = """
+        [{"hex":"aa","char":"fd4b0005","ts_ms":1,"type_name":"EVENT","seq":2,"crc_ok":true,"ok":true}]
+        """
+        let decoded = try JSONDecoder().decode([PuffinCaptureRecord].self, from: Data(legacy.utf8))
+        // Spelled out: a bare `.none` here would resolve to `Optional.none`, not to the reason.
+        XCTAssertEqual(decoded.first?.rejectReason, FrameRejectReason.none)
+        XCTAssertEqual(decoded.first?.typeName, "EVENT")
+    }
+
+    // MARK: - counters (D3)
+
+    func testTallyCountsEachReasonSeparately() {
+        var tally = FrameRejectTally()
+        tally.note(parseFrame(headerBroken()))
+        tally.note(parseFrame(hex(FrameIntegrityTests.w4Valid) + [0x00]))     // trailing byte
+        tally.note(parseFrame(hex(FrameIntegrityTests.w4Total8)))            // below the 11-byte floor
+        tally.note(parseFrame(hex(FrameIntegrityTests.w4Valid)))             // intact: not counted
+        XCTAssertEqual(tally.count(.headerChecksumMismatch), 1)
+        XCTAssertEqual(tally.count(.lengthMismatch), 1)
+        XCTAssertEqual(tally.count(.belowMinimumLength), 1)
+        XCTAssertEqual(tally.count(.none), 0, "an intact frame is never counted as a rejection")
+        XCTAssertEqual(tally.totalRejected, 3)
+    }
+
+    func testTallyReportsUnverifiableSeparatelyFromMismatch() {
+        var tally = FrameRejectTally()
+        // Payload byte flipped: the CRC32 was computed and disagreed.
+        var wrongPayload = hex(FrameIntegrityTests.w4Valid)
+        wrongPayload[10] ^= 0xFF
+        tally.note(parseFrame(wrongPayload))
+        XCTAssertEqual(tally.count(.payloadCRCMismatch), 1)
+        XCTAssertEqual(tally.count(.payloadCRCUnverifiable), 0,
+                       "\"could not be checked\" and \"was wrong\" are different claims")
+    }
+
+    /// Scenario "Die vorher durchgelassene Klasse ist einzeln ablesbar" (2.16) — the ONE counter the
+    /// hardware run's abort criterion is read from. A per-reason bucket cannot express it: the length
+    /// bucket also collects the harmless resyncs after a lost notification.
+    func testThePreviouslyAdmittedClassHasItsOwnCounter() {
+        var tally = FrameRejectTally()
+        tally.note(parseFrame(headerBroken()))                                // header wrong, CRC32 right
+        tally.note(parseFrame(hex(FrameIntegrityTests.w4Valid) + [0x00]))     // length wrong, CRC32 right
+        var wrongPayload = hex(FrameIntegrityTests.w4Valid)
+        wrongPayload[10] ^= 0xFF
+        tally.note(parseFrame(wrongPayload))                                  // CRC32 wrong: NOT the class
+        tally.note(parseFrame(hex(FrameIntegrityTests.w4Total8)))             // CRC32 unverifiable: not it
+        XCTAssertEqual(tally.payloadCRCOKButEnvelopeRejected, 2)
+        XCTAssertEqual(tally.totalRejected, 4, "the class is counted BESIDE its reason, not instead of it")
+    }
+
+    /// The offload path never parses its frames at the BLE seam — it hands them straight to the
+    /// Backfiller — so the parse-result overload cannot count them, and the ONE counter the hardware
+    /// run's abort criterion reads was blind for exactly the traffic in which the loss occurs. Counting
+    /// from the verifier's own result closes that without a second parse.
+    func testTheVerdictOverloadCountsTheSameReasonAndClassAsTheParseResult() {
+        let broken = headerBroken()
+        var fromParse = FrameRejectTally()
+        fromParse.note(parseFrame(broken, family: .whoop4))
+        var fromVerdict = FrameRejectTally()
+        let reason = fromVerdict.note(verifyFrame(broken, family: .whoop4))
+        XCTAssertEqual(reason, .headerChecksumMismatch)
+        XCTAssertEqual(fromVerdict, fromParse, "the two routes into the tally must agree exactly")
+        XCTAssertEqual(fromVerdict.payloadCRCOKButEnvelopeRejected, 1,
+                       "envelope rejected while the payload CRC32 verified — the abort-criterion class")
+    }
+
+    /// The same three separations the parse-result overload keeps: an intact frame is not counted, a
+    /// wrong payload CRC32 is not the named class, and an unverifiable one is neither.
+    func testTheVerdictOverloadKeepsTheClassSeparations() {
+        var tally = FrameRejectTally()
+        XCTAssertEqual(tally.note(verifyFrame(hex(FrameIntegrityTests.w4Valid), family: .whoop4)), .none)
+        XCTAssertEqual(tally.totalRejected, 0, "an intact frame is never counted as a rejection")
+        var wrongPayload = hex(FrameIntegrityTests.w4Valid)
+        wrongPayload[10] ^= 0xFF
+        tally.note(verifyFrame(wrongPayload, family: .whoop4))
+        tally.note(verifyFrame(hex(FrameIntegrityTests.w4Total8), family: .whoop4))
+        XCTAssertEqual(tally.count(.payloadCRCMismatch), 1)
+        XCTAssertEqual(tally.count(.belowMinimumLength), 1)
+        XCTAssertEqual(tally.payloadCRCOKButEnvelopeRejected, 0,
+                       "neither a wrong nor an uncomputable payload CRC32 is the admitted class")
+    }
+
+    /// Scenario "Vom Zusammensetzer verworfene Byteläufe sind gesondert erfasst": a byte run the
+    /// reassembler drops never reaches a parser — and never reaches the evidence-preserving reader —
+    /// so its disappearance is only visible if it is counted.
+    func testReassemblerDropsAreCountedAsBelowMinimumLength() {
+        let r = Reassembler(family: .whoop4)
+        // A start-of-frame declaring a total of 8 bytes (below the 11-byte floor), then a real frame.
+        let runt: [UInt8] = [0xAA, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]
+        let good = hex(FrameIntegrityTests.w4Valid)
+        let out = r.feed(runt + good)
+        XCTAssertEqual(out.count, 1, "the stream resyncs and still yields the real frame")
+        XCTAssertGreaterThan(r.belowMinimumLengthDrops, 0, "precondition: the runt was dropped")
+
+        var tally = FrameRejectTally()
+        tally.absorbReassemblerDrops(r.belowMinimumLengthDrops)
+        XCTAssertEqual(tally.count(.belowMinimumLength), r.belowMinimumLengthDrops)
+        // The counter is monotonic, so folding it again must not double-count.
+        tally.absorbReassemblerDrops(r.belowMinimumLengthDrops)
+        XCTAssertEqual(tally.count(.belowMinimumLength), r.belowMinimumLengthDrops)
+    }
+
+    func testSummaryLineIsSilentWhenNothingWasRejected() {
+        var tally = FrameRejectTally()
+        tally.note(parseFrame(hex(FrameIntegrityTests.w4Valid)))
+        XCTAssertNil(tally.summaryLine(), "no \"0 rejections\" line to read past")
+    }
+
+    func testSummaryLineNamesOnlyTheReasonsThatOccurred() {
+        var tally = FrameRejectTally()
+        tally.note(parseFrame(headerBroken()))
+        let line = try? XCTUnwrap(tally.summaryLine())
+        XCTAssertEqual(line, "frameReject total=1 headerChecksumMismatch=1 payloadCRCOKButEnvelopeRejected=1")
+    }
+}
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FrameIntegrityOracleTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FrameIntegrityOracleTests.swift
new file mode 100644
index 0000000000..0c918dfb23
--- /dev/null
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FrameIntegrityOracleTests.swift
@@ -0,0 +1,203 @@
+import XCTest
+@testable import WhoopProtocol
+
+/// SHARED FRAME-INTEGRITY ORACLE — the Swift half of a Swift <-> Kotlin drift guard for the
+/// `frame-integrity` capability (requirement "Plattformgleichheit des Integritätsurteils", D5).
+///
+/// `Resources/frame_integrity_oracle.json` holds one line per frame with the three values the two
+/// platforms must agree on: the verifier's FULL verdict, the rejection reason, and the historical
+/// metadata classification. The IDENTICAL file is committed at
+/// `android/app/src/test/resources/frame_integrity_oracle.json`, where `FrameIntegrityOracleTest.kt`
+/// asserts the same lines through the Kotlin `Framing.parseFrame` / `classifyHistoricalMeta`.
+///
+/// Why a shared file rather than two per-platform suites: both platforms already had their own
+/// integrity tests, and both were green while the Kotlin ECG payload path still applied the older,
+/// looser envelope bounds. Each suite asserted its own answer, so nothing compared the two answers.
+/// This does, over every case and every field.
+///
+/// The file is GENERATED by a standalone Swift run
+/// (`openspec/changes/frame-integrity/oracle-gen`) — never hand-written, so no expected value here is
+/// somebody's belief about what the verifier does. Regenerate it rather than editing it.
+///
+/// Deliberately NOT pinned: the export spelling of a reason. The Kotlin capture writer omits the
+/// `reject_reason` key when there is no reason, Swift's `Codable` always writes it. That is a textual
+/// difference in a different artefact; the oracle pins the judgement, not the serialisation.
+///
+/// Deliberately absent: a `payloadCRCUnverifiable` line. The structural rules run first on BOTH
+/// platforms, so no byte run can reach that branch — it is defence in depth, and inventing a case for
+/// it would mean inventing an input that cannot exist.
+final class FrameIntegrityOracleTests: XCTestCase {
+
+    private struct Oracle: Decodable {
+        let coverage: Coverage
+        let cases: [OracleCase]
+    }
+
+    private struct Coverage: Decodable {
+        let caseCount: Int
+        let classes: [String: Int]
+        let reasons: [String: Int]
+        private enum CodingKeys: String, CodingKey {
+            case caseCount = "case_count"
+            case classes, reasons
+        }
+    }
+
+    private struct OracleCase: Decodable {
+        let name: String
+        let family: String
+        let klass: String
+        let hex: String
+        let verdict: Bool
+        let rejectReason: String
+        let meta: String
+        let ecgPath: Bool
+        let ecgInnerPayloadHex: String?
+        private enum CodingKeys: String, CodingKey {
+            case name, family, hex, verdict, meta
+            case klass = "class"
+            case rejectReason = "reject_reason"
+            case ecgPath = "ecg_path"
+            case ecgInnerPayloadHex = "ecg_inner_payload_hex"
+        }
+    }
+
+    private static let oracleResource = "frame_integrity_oracle"
+    private static let androidCopy = "android/app/src/test/resources/frame_integrity_oracle.json"
+
+    private func loadOracle() throws -> Oracle {
+        let url = try XCTUnwrap(Bundle.module.url(forResource: Self.oracleResource, withExtension: "json"),
+                                "frame_integrity_oracle.json missing from the test bundle")
+        return try JSONDecoder().decode(Oracle.self, from: Data(contentsOf: url))
+    }
+
+    private func bytes(_ hex: String) -> [UInt8] {
+        var out: [UInt8] = []
+        var i = hex.startIndex
+        while i < hex.endIndex {
+            let j = hex.index(i, offsetBy: 2)
+            out.append(UInt8(hex[i..<j], radix: 16)!)
+            i = j
+        }
+        return out
+    }
+
+    private func hexString(_ b: [UInt8]) -> String {
+        b.map { String(format: "%02x", $0) }.joined()
+    }
+
+    private func family(_ name: String) throws -> DeviceFamily {
+        switch name {
+        case "whoop4": return .whoop4
+        case "whoop5": return .whoop5
+        default:
+            XCTFail("unknown family \(name) in the oracle")
+            throw XCTSkip("unknown family")
+        }
+    }
+
+    /// The classification rendered exactly as the generator renders it, so one string compares three
+    /// possible shapes (case, and for an end its unix + trim) without a second decoding rule.
+    private func metaLabel(_ p: ParsedFrame) -> String {
+        switch classifyHistoricalMeta(p) {
+        case .start: return "start"
+        case .complete: return "complete"
+        case .other: return "other"
+        case .end(let unix, let trim): return "end(unix=\(unix),trim=\(trim))"
+        }
+    }
+
+    // MARK: - the three pinned fields, every case
+
+    func testEveryOracleCaseMatchesTheSharedExpectation() throws {
+        let oracle = try loadOracle()
+        XCTAssertFalse(oracle.cases.isEmpty, "an empty oracle would assert nothing")
+        for c in oracle.cases {
+            let frame = bytes(c.hex)
+            let parsed = parseFrame(frame, family: try family(c.family))
+            XCTAssertEqual(parsed.ok, c.verdict, "verdict for \(c.name)")
+            XCTAssertEqual(parsed.rejectReason.rawValue, c.rejectReason, "reject reason for \(c.name)")
+            XCTAssertEqual(metaLabel(parsed), c.meta, "historical-metadata classification for \(c.name)")
+            // The reason and the verdict are one statement, not two that could drift apart.
+            XCTAssertEqual(parsed.ok, parsed.rejectReason == .none,
+                           "\(c.name): ok must hold exactly when the reason is none")
+        }
+    }
+
+    /// Scenario "Der zweite verifizierende Pfad ist mit abgedeckt": the ECG payload accessor is the
+    /// other place a frame envelope is judged, so the oracle carries its answer too.
+    func testEveryEcgPathCaseMatchesTheSharedExpectation() throws {
+        let oracle = try loadOracle()
+        let ecgCases = oracle.cases.filter(\.ecgPath)
+        XCTAssertFalse(ecgCases.isEmpty, "the second verifying path must stay covered")
+        for c in ecgCases {
+            let payload = Whoop5Ecg.innerPayload(bytes(c.hex))
+            XCTAssertEqual(payload.map(hexString), c.ecgInnerPayloadHex,
+                           "ECG inner payload for \(c.name)")
+        }
+    }
+
+    // MARK: - self-defence: the oracle cannot silently stop covering something
+
+    func testOracleCoverageManifestMatchesTheCases() throws {
+        let oracle = try loadOracle()
+        XCTAssertEqual(oracle.cases.count, oracle.coverage.caseCount, "case_count")
+        XCTAssertEqual(Set(oracle.cases.map(\.name)).count, oracle.cases.count, "case names must be unique")
+
+        var classes: [String: Int] = [:]
+        var reasons: [String: Int] = [:]
+        for c in oracle.cases {
+            classes[c.klass, default: 0] += 1
+            reasons[c.rejectReason, default: 0] += 1
+        }
+        XCTAssertEqual(classes, oracle.coverage.classes, "per-class counts")
+        XCTAssertEqual(reasons, oracle.coverage.reasons, "per-reason counts")
+
+        // The input classes task 4.1 names. Losing one would leave the oracle green and blind.
+        for required in ["valid_recorded", "header_corrupt", "payload_corrupt", "below_minimum",
+                         "truncated", "trailing_bytes", "boundary", "no_start_of_frame",
+                         "evaluation_order", "ecg_path"] {
+            XCTAssertGreaterThan(classes[required] ?? 0, 0, "input class \(required) is not covered")
+        }
+        // Both families, on both sides of the verdict.
+        for fam in ["whoop4", "whoop5"] {
+            XCTAssertTrue(oracle.cases.contains { $0.family == fam && $0.verdict },
+                          "no accepted \(fam) frame in the oracle")
+            XCTAssertTrue(oracle.cases.contains { $0.family == fam && !$0.verdict },
+                          "no rejected \(fam) frame in the oracle")
+        }
+        // Every reachable reason. `payloadCRCUnverifiable` is unreachable on both platforms and is
+        // therefore absent by design — asserting it here would demand an impossible input.
+        for reason in FrameRejectReason.allCases where reason != .payloadCRCUnverifiable {
+            XCTAssertGreaterThan(reasons[reason.rawValue] ?? 0, 0,
+                                 "reason \(reason.rawValue) is not covered by any oracle case")
+        }
+        XCTAssertNil(reasons["payloadCRCUnverifiable"],
+                     "payloadCRCUnverifiable cannot be produced by any input — a line claiming it is wrong")
+        // Each historical-metadata outcome, since that is the third pinned field.
+        let metas = Set(oracle.cases.map(\.meta))
+        XCTAssertTrue(metas.contains("start"))
+        XCTAssertTrue(metas.contains("complete"))
+        XCTAssertTrue(metas.contains("other"))
+        XCTAssertTrue(metas.contains { $0.hasPrefix("end(") })
+    }
+
+    func testOracleCopiesAreIdentical() throws {
+        let swiftURL = try XCTUnwrap(Bundle.module.url(forResource: Self.oracleResource, withExtension: "json"))
+        let swiftData = try Data(contentsOf: swiftURL)
+
+        // .../Packages/WhoopProtocol/Tests/WhoopProtocolTests/FrameIntegrityOracleTests.swift -> repo root
+        let repoRoot = URL(fileURLWithPath: #filePath)
+            .deletingLastPathComponent()  // WhoopProtocolTests
+            .deletingLastPathComponent()  // Tests
+            .deletingLastPathComponent()  // WhoopProtocol
+            .deletingLastPathComponent()  // Packages
+            .deletingLastPathComponent()  // repo root
+        let androidURL = repoRoot.appendingPathComponent(Self.androidCopy)
+        guard FileManager.default.fileExists(atPath: androidURL.path) else {
+            throw XCTSkip("android oracle copy not present at \(androidURL.path)")
+        }
+        XCTAssertEqual(swiftData, try Data(contentsOf: androidURL),
+                       "frame_integrity_oracle.json copies differ — keep the Swift and Android copies in lockstep")
+    }
+}
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FrameIntegrityTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FrameIntegrityTests.swift
new file mode 100644
index 0000000000..1558255f12
--- /dev/null
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FrameIntegrityTests.swift
@@ -0,0 +1,402 @@
+import XCTest
+@testable import WhoopProtocol
+
+/// The frame-integrity contract: the parse result carries the verifier's FULL verdict plus a
+/// non-optional reason, the structural bounds are enforced per device family, and a named inner
+/// field is only ever read out of payload bytes.
+///
+/// Every synthetic frame below is built the way a strap builds one (real CRC-8 / CRC-16-Modbus
+/// header checksum, real zlib CRC32 payload trailer, exact declared length) and then broken in
+/// exactly ONE way, so each assertion attributes a single cause. The frames taken from the capture
+/// corpus are marked as such.
+final class FrameIntegrityTests: XCTestCase {
+
+    static func hex(_ s: String) -> [UInt8] { FramingTests.hex(s) }
+
+    // MARK: - Fixtures
+
+    /// Real captured WHOOP 4.0 REALTIME_DATA frame (28 bytes), fully valid.
+    static let w4Valid = "aa1800ff28020f3de10128663c0000000000000000000000da855212"
+    /// Real captured WHOOP 4.0 METADATA frames. The 11-byte ones sit EXACTLY on the family minimum
+    /// and their `meta_type` occupies the last payload byte — the case that fixes the bound's
+    /// comparison form ("start + length must not exceed the limit").
+    static let w4MetaHistoryStart11 = "aa07006b3100012366efad"
+    static let w4MetaHistoryComplete11 = "aa07006b3100030f07e143"
+    /// Real captured 25-byte HISTORY_END frame. Its CRC32 trailer starts at 21, and the 8-byte
+    /// acknowledgement block the strap echoes back runs from 17 to 25 — into the trailer.
+    static let w4HistoryEnd25 = "aa15001631000200f1536500000000000039300000c3401bdb"
+    /// Synthetic, fully valid WHOOP 5.0/MG COMMAND_RESPONSE frame (20 bytes).
+    static let w5Valid = "aa010c000001e74124070211223344557481f36e"
+
+    /// Total 8, 9 and 10 bytes: declared lengths 4, 5 and 6. Each carries a correct header checksum
+    /// and a correct CRC32 over its (0-2 byte) inner record, so ONLY the structural minimum rejects
+    /// them — which is the point.
+    static let w4Total8 = "aa04005400000000"
+    static let w4Total9 = "aa05004131b7efdc83"
+    static let w4Total10 = "aa06007e31004d158487"
+    /// Total 12 bytes (declared 4): a WHOOP 5.0 frame one byte below the minimum, again with both
+    /// checksums correct. Its byte at offset 8 — the inner packet type — is the first byte of its
+    /// own CRC32 trailer.
+    static let w5Total12 = "aa0104000001e52100000000"
+
+    /// Exactly 13 bytes (declared 5): valid header checksum, valid CRC32 over its single payload
+    /// byte, exact length. It PASSES the tightened gate; the sequence number, command byte and
+    /// metadata type it appears to carry are all inside its CRC32 trailer.
+    static let w5Min13Metadata = "aa0105000001e4dd31b7efdc83"
+    /// The same frame at 14 bytes (declared 6). It is fully valid AND the first byte of its trailer
+    /// reads 3 = HISTORY_COMPLETE at the metadata-type offset — the forgery F-05 describes. The
+    /// sequence number at offset 9 is now a genuine payload byte and must still decode.
+    static let w5Meta14FakesHistoryComplete = "aa0106000001e49931530315e675"
+
+    /// WHOOP 4.0 REALTIME_DATA with a SHORTENED inner record: 14 bytes, declared length 10, so the
+    /// trailer starts at 10 and everything the schema places at 10 or beyond is trailer, not data.
+    static let w4ShortRealtime14 = "aa0a0082280111223344854deb31"
+    /// 11 bytes present, declared length 61440. Structurally the frame claims ~60 KB it does not
+    /// have; the bound must fall back on the bytes that exist.
+    static let w4HugeDeclared11 = "aa00f0de31000102030405"
+
+    private func corrupt(_ hexString: String, at index: Int) -> [UInt8] {
+        var f = Self.hex(hexString)
+        f[index] ^= 0xFF
+        return f
+    }
+
+    // MARK: - Vollständiges Integritätsurteil im Parse-Ergebnis
+
+    func testWhoop4HeaderChecksumWrongPayloadCRCRightIsRejected() {
+        let frame = corrupt(Self.w4Valid, at: 3)
+        let parsed = parseFrame(frame)
+        XCTAssertFalse(parsed.ok, "a broken header checksum must not yield a positive verdict")
+        XCTAssertEqual(parsed.rejectReason, .headerChecksumMismatch)
+        // The payload CRC32 is untouched — this is exactly the class that passed the gates before.
+        XCTAssertEqual(parsed.crcOK, true)
+        // …and the frame stays readable for an inspector.
+        XCTAssertEqual(parsed.typeName, "REALTIME_DATA")
+    }
+
+    func testWhoop5HeaderChecksumWrongPayloadCRCRightIsRejected() {
+        let frame = corrupt(Self.w5Valid, at: 6)
+        let parsed = parseFrame(frame, family: .whoop5)
+        XCTAssertFalse(parsed.ok)
+        XCTAssertEqual(parsed.rejectReason, .headerChecksumMismatch)
+        XCTAssertEqual(parsed.crcOK, true)
+        XCTAssertEqual(parsed.typeName, "COMMAND_RESPONSE")
+    }
+
+    func testPayloadCRCThatCannotBeComputedIsNegativeNotUnknown() {
+        // Too short for a CRC32 over any payload byte at all.
+        let parsed = parseFrame(Self.hex(Self.w4Total8))
+        XCTAssertFalse(parsed.ok, "an uncomputable payload CRC must never read as a pass")
+        XCTAssertNil(parsed.crcOK, "the tri-state stays honest: the CRC is unknown …")
+        XCTAssertEqual(parsed.rejectReason, .belowMinimumLength, "… but the verdict is not")
+    }
+
+    func testFullyValidFrameKeepsItsPositiveVerdictAndFields() {
+        let parsed = parseFrame(Self.hex(Self.w4Valid))
+        XCTAssertTrue(parsed.ok)
+        XCTAssertEqual(parsed.rejectReason, .none)
+        XCTAssertEqual(parsed.crcOK, true)
+        XCTAssertEqual(parsed.typeName, "REALTIME_DATA")
+        XCTAssertEqual(parsed.seq, 2)
+        XCTAssertEqual(parsed.parsed["heart_rate"], .int(60))
+
+        let five = parseFrame(Self.hex(Self.w5Valid), family: .whoop5)
+        XCTAssertTrue(five.ok)
+        XCTAssertEqual(five.rejectReason, .none)
+        XCTAssertEqual(five.seq, 7)
+    }
+
+    // MARK: - Ablehnungsgrund liegt am Parse-Ergebnis an
+
+    func testConsumerReadsTheReasonFromTheParseResultAlone() {
+        // A consumer sees only what it was handed — no frame bytes, no second verify, no second
+        // parse. That is the whole point of carrying the reason on the result.
+        func report(_ parsed: ParsedFrame) -> FrameRejectReason { parsed.rejectReason }
+        XCTAssertEqual(report(parseFrame(corrupt(Self.w4Valid, at: 3))), .headerChecksumMismatch)
+        XCTAssertEqual(report(parseFrame(corrupt(Self.w4Valid, at: 10))), .payloadCRCMismatch)
+    }
+
+    func testEveryRejectionReasonIsDistinguishable() {
+        var wrongSOF = Self.hex(Self.w4Valid)
+        wrongSOF[0] = 0x00
+        let trailing = Self.hex(Self.w4Valid) + [0x00]
+
+        let reasons: [FrameRejectReason] = [
+            parseFrame(wrongSOF).rejectReason,
+            parseFrame(Self.hex(Self.w4Total10)).rejectReason,
+            parseFrame(trailing).rejectReason,
+            parseFrame(corrupt(Self.w4Valid, at: 3)).rejectReason,
+            parseFrame(corrupt(Self.w4Valid, at: 10)).rejectReason,
+            parseFrame(Self.hex(Self.w4Valid)).rejectReason,
+        ]
+        XCTAssertEqual(reasons, [.noStartOfFrame, .belowMinimumLength, .lengthMismatch,
+                                 .headerChecksumMismatch, .payloadCRCMismatch, .none])
+        XCTAssertEqual(Set(reasons).count, reasons.count, "the reasons must not collapse into each other")
+        // The seventh reason exists so an uncomputable CRC can never be reported as a wrong one. The
+        // structural rules above make it unreachable from the verifier today; it is a fail-closed
+        // default, and this pins that it is a value of its own rather than an alias.
+        XCTAssertFalse(reasons.contains(.payloadCRCUnverifiable))
+        XCTAssertEqual(FrameRejectReason.allCases.count, 7)
+    }
+
+    func testValidFrameCarriesNoReason() {
+        XCTAssertEqual(parseFrame(Self.hex(Self.w4Valid)).rejectReason, .none)
+        XCTAssertEqual(parseFrame(Self.hex(Self.w5Valid), family: .whoop5).rejectReason, .none)
+        XCTAssertEqual(verifyFrame(Self.hex(Self.w4Valid)).reason, .none)
+    }
+
+    func testMissingReasonInAnOlderSerialisedResultDecodesAsNone() throws {
+        // Capture files and hand-written fixtures predate the field; decoding must not turn strict.
+        let json = Data("""
+        {"ok":true,"typeName":"REALTIME_DATA","crcOK":true,"lenBytes":28,"rawHex":"",
+         "fields":[],"parsed":{}}
+        """.utf8)
+        let decoded = try JSONDecoder().decode(ParsedFrame.self, from: json)
+        XCTAssertEqual(decoded.rejectReason, .none)
+    }
+
+    // MARK: - Strukturelle Mindest- und Genaulänge je Gerätefamilie
+
+    func testWhoop4BelowMinimumLengthIsRejectedWithoutReadingAPacketType() {
+        for h in [Self.w4Total8, Self.w4Total9, Self.w4Total10] {
+            let frame = Self.hex(h)
+            let check = verifyFrame(frame)
+            XCTAssertFalse(check.ok, "\(h) is below the 11-byte minimum")
+            XCTAssertEqual(check.reason, .belowMinimumLength, "\(h)")
+            let parsed = parseFrame(frame, collectFields: true)
+            XCTAssertFalse(parsed.ok, "\(h)")
+            XCTAssertEqual(parsed.typeName, "INVALID/FRAGMENT", "no packet type is read out of \(h)")
+            XCTAssertTrue(parsed.fields.isEmpty, "\(h)")
+            XCTAssertTrue(parsed.parsed.isEmpty, "\(h)")
+        }
+    }
+
+    func testWhoop5BelowMinimumLengthIsRejectedInsteadOfReadingTheTrailer() {
+        let frame = Self.hex(Self.w5Total12)
+        let check = verifyFrame(frame, family: .whoop5)
+        XCTAssertFalse(check.ok)
+        XCTAssertEqual(check.reason, .belowMinimumLength)
+        // Its header checksum is genuinely correct (recomputed here, since a frame this short is not
+        // read at all any more), so only the structural minimum stands between it and the gates —
+        // and its "inner packet type" would be the first byte of its own CRC32 trailer.
+        XCTAssertEqual(crc16Modbus(Array(frame[0..<6])), UInt16(frame[6]) | (UInt16(frame[7]) << 8))
+        XCTAssertNil(check.crc8OK, "nothing is read out of a frame below the minimum")
+        let parsed = parseFrame(frame, family: .whoop5, collectFields: true)
+        XCTAssertEqual(parsed.typeName, "INVALID/FRAGMENT")
+        XCTAssertTrue(parsed.parsed.isEmpty)
+    }
+
+    func testFramesExactlyAtEachFamilyMinimumStayValid() {
+        // 11 bytes, from the capture corpus — the smallest real WHOOP 4.0 frame there is.
+        let w4 = Self.hex(Self.w4MetaHistoryStart11)
+        XCTAssertEqual(w4.count, FrameLimits.whoop4MinimumFrameBytes)
+        XCTAssertTrue(verifyFrame(w4).ok)
+        // Its metadata type occupies the LAST payload byte; the bound must not swallow it, or the
+        // offload would never learn that a chunk ended.
+        XCTAssertEqual(parseFrame(w4).parsed["meta_type"], .string("HISTORY_START(1)"))
+
+        let w5 = Self.hex(Self.w5Min13Metadata)
+        XCTAssertEqual(w5.count, FrameLimits.whoop5MinimumFrameBytes)
+        XCTAssertTrue(verifyFrame(w5, family: .whoop5).ok)
+    }
+
+    func testOneByteTooManyIsRejected() {
+        for (h, family) in [(Self.w4Valid, DeviceFamily.whoop4), (Self.w5Valid, .whoop5)] {
+            let frame = Self.hex(h) + [0x00]
+            let check = verifyFrame(frame, family: family)
+            XCTAssertFalse(check.ok, "trailing bytes must be rejected (\(family))")
+            XCTAssertEqual(check.reason, .lengthMismatch, "\(family)")
+            // The payload CRC still verifies — the envelope is what is wrong, and the diagnostic
+            // must say so rather than blame the payload.
+            XCTAssertEqual(check.crc32OK, true, "\(family)")
+            XCTAssertFalse(parseFrame(frame, family: family).ok, "\(family)")
+        }
+    }
+
+    func testOneByteTooFewIsRejected() {
+        for (h, family) in [(Self.w4Valid, DeviceFamily.whoop4), (Self.w5Valid, .whoop5)] {
+            let frame = Array(Self.hex(h).dropLast())
+            let check = verifyFrame(frame, family: family)
+            XCTAssertFalse(check.ok, "a truncated frame must be rejected (\(family))")
+            XCTAssertEqual(check.reason, .lengthMismatch, "\(family)")
+            XCTAssertNil(check.crc32OK, "a CRC over bytes we do not have is not computed (\(family))")
+            XCTAssertFalse(parseFrame(frame, family: family).ok, "\(family)")
+        }
+    }
+
+    // MARK: - Innere Felder werden nur aus Nutzdatenbytes gelesen
+
+    func testWhoop5AtTheMinimumDecodesNoSequenceCommandOrMetadataField() {
+        let frame = Self.hex(Self.w5Min13Metadata)
+        let parsed = parseFrame(frame, family: .whoop5, collectFields: true)
+        // It passes the gate — which is exactly why the field bound has to hold on its own.
+        XCTAssertTrue(parsed.ok)
+        XCTAssertEqual(parsed.typeName, "METADATA")
+        XCTAssertNil(parsed.seq, "offset 9 is the first byte of the CRC32 trailer")
+        XCTAssertNil(parsed.parsed["meta_type"], "offset 10 is trailer, not a metadata type")
+        XCTAssertNil(parsed.parsed["cmd"])
+        XCTAssertFalse(parsed.fields.contains { $0.name == "seq" })
+    }
+
+    func testWhoop5OneByteAboveTheMinimumDecodesTheSequenceButNotTheMetadataType() {
+        let frame = Self.hex(Self.w5Meta14FakesHistoryComplete)
+        XCTAssertEqual(frame.count, 14)
+        let parsed = parseFrame(frame, family: .whoop5, collectFields: true)
+        XCTAssertTrue(parsed.ok, "the frame is fully valid — nothing but the bound protects it")
+        // Offset 9 is now a genuine payload byte.
+        XCTAssertEqual(parsed.seq, 83)
+        // Offset 10 holds 0x03 — the byte that means HISTORY_COMPLETE — but it is the first byte of
+        // the CRC32 trailer, so no metadata type is decoded from it.
+        XCTAssertEqual(frame[10], 3)
+        XCTAssertNil(parsed.parsed["meta_type"],
+                     "a frame must not be able to forge a chunk state out of its own checksum")
+        XCTAssertNil(parsed.parsed["cmd"])
+    }
+
+    func testWhoop4WithAShortenedInnerRecordStopsAtTheTrailer() {
+        let frame = Self.hex(Self.w4ShortRealtime14)
+        XCTAssertEqual(frame.count, 14)
+        let parsed = parseFrame(frame, collectFields: true)
+        XCTAssertTrue(parsed.ok, "valid header checksum, valid CRC32, exact length")
+        XCTAssertEqual(parsed.typeName, "REALTIME_DATA")
+        // The declared length is 10, so the trailer starts at 10.
+        XCTAssertEqual(parsed.parsed["timestamp"], .int(0x44332211), "offset 6..10 is payload")
+        XCTAssertNil(parsed.parsed["subseconds"], "offset 10 is trailer")
+        XCTAssertNil(parsed.parsed["heart_rate"], "offset 12 is trailer")
+        XCTAssertNil(parsed.parsed["rr_count"], "offset 13 is trailer")
+    }
+
+    func testDeclaredLengthFarBeyondTheBytesReadsNothingThatIsNotThere() {
+        // 11 bytes present, ~60 KB declared. The bound is the MINIMUM of the trailer start and the
+        // real size, so it falls back on the 11 bytes we hold. Reaching for the declared trailer
+        // start instead would read off the end of the buffer.
+        let frame = Self.hex(Self.w4HugeDeclared11)
+        let check = verifyFrame(frame)
+        XCTAssertEqual(check.length, 61440)
+        XCTAssertFalse(check.ok)
+        XCTAssertEqual(check.reason, .lengthMismatch)
+        XCTAssertNil(check.crc32OK)
+        let parsed = parseFrame(frame, collectFields: true)
+        XCTAssertFalse(parsed.ok)
+        for field in parsed.fields {
+            XCTAssertLessThanOrEqual(field.off + field.len, frame.count,
+                                     "field \(field.name) reaches past the bytes we hold")
+        }
+        // The same shape below the family minimum — the usual on-the-wire case, a fragment whose
+        // length word promises thousands of bytes — decodes no field at all.
+        let fragment = Array(frame.dropLast())
+        let fragmentParsed = parseFrame(fragment, collectFields: true)
+        XCTAssertTrue(fragmentParsed.fields.isEmpty)
+        XCTAssertTrue(fragmentParsed.parsed.isEmpty)
+        XCTAssertEqual(fragmentParsed.rejectReason, .belowMinimumLength)
+    }
+
+    func testAcknowledgementBlockOfTheRealHistoryEndFrameIsUnchanged() {
+        // The 8-byte block the trim acknowledgement mirrors back to the strap is NOT a decoded
+        // field: it is an opaque echo, and by construction it reaches into the CRC32 trailer. The
+        // field bound must never be applied to it — a clipped block either makes the strap refuse
+        // the acknowledgement (the offload stops) or makes it trim on altered bytes.
+        let frame = Self.hex(Self.w4HistoryEnd25)
+        XCTAssertEqual(frame.count, 25)
+        let check = verifyFrame(frame)
+        XCTAssertTrue(check.ok)
+        XCTAssertEqual(check.length, 21, "the CRC32 trailer starts at 21 …")
+        // … and the block runs 17..25, four bytes of it inside that trailer. Derive the block from
+        // the frame rather than from a second literal: comparing one spelling of the fixture with
+        // another cannot fail, and this assertion exists to fail when a later tidy-up narrows the
+        // block. The literal pin stays as the byte-level record of what the strap is echoed.
+        let ackStart = 25 - 8
+        let block = Array(frame.suffix(8))
+        XCTAssertEqual(block, Array(frame[ackStart..<25]))
+        XCTAssertEqual(block, Self.hex("39300000c3401bdb"))
+        // The exception has to BE an exception: the block must straddle the D7 bound, or this test
+        // would be pinning an ordinary payload read and would go on passing after a clip.
+        let bound = check.length!
+        XCTAssertLessThan(ackStart, bound, "the block starts inside the payload …")
+        XCTAssertGreaterThan(25, bound, "… and ends inside the CRC32 trailer")
+        // What a clipped block would look like, spelled out so the difference is not a matter of
+        // reading: applying the field bound would hand the strap four bytes instead of eight.
+        XCTAssertNotEqual(block, Array(frame[ackStart..<min(25, bound)]))
+        XCTAssertEqual(Array(frame[ackStart..<min(25, bound)]).count, 4)
+        // The extraction itself lives in `Strand/Collect/Backfiller.swift` (`endData(from:family:)`,
+        // start 17), which belongs to package 2 — its caller-side proof is owed there, not here.
+        // The trim cursor is the block's first u32 and lies in the payload, so it still decodes.
+        XCTAssertEqual(parseFrame(frame).parsed["trim_cursor"], .int(0x3039))
+        XCTAssertEqual(parseFrame(frame).parsed["meta_type"], .string("HISTORY_END(2)"))
+    }
+
+    // MARK: - Zusammensetzer gibt keinen unterlangen Rahmen aus
+
+    func testReassemblerDropsAnUndersizedStartOfFrameAndResyncs() {
+        let undersized = Self.hex(Self.w4Total8)     // declares a total of 8 bytes
+        let valid = Self.hex(Self.w4Valid)
+        let r = Reassembler()
+        let out = r.feed(undersized + valid)
+        XCTAssertEqual(out, [valid], "only the complete valid frame may be emitted")
+        XCTAssertEqual(r.belowMinimumLengthDrops, 1,
+                       "the discarded byte run is counted, not silently dropped")
+    }
+
+    func testWhoop5ReassemblerDropsAnUndersizedStartOfFrameAndResyncs() {
+        let undersized = Self.hex(Self.w5Total12)    // declares a total of 12 bytes
+        let valid = Self.hex(Self.w5Valid)
+        let r = Reassembler(family: .whoop5)
+        XCTAssertEqual(r.feed(undersized + valid), [valid])
+        XCTAssertEqual(r.belowMinimumLengthDrops, 1)
+    }
+
+    func testReassemblerLeavesFragmentedDeliveryByteIdentical() {
+        let valid = Self.hex(Self.w4Valid)
+        let r = Reassembler()
+        var out: [[UInt8]] = []
+        for chunk in stride(from: 0, to: valid.count, by: 5) {
+            out += r.feed(Array(valid[chunk..<min(chunk + 5, valid.count)]))
+        }
+        XCTAssertEqual(out, [valid])
+        XCTAssertEqual(r.belowMinimumLengthDrops, 0)
+    }
+
+    // MARK: - Echte aufgezeichnete Rahmen bleiben gültig
+
+    private struct HexEntry: Decodable { let hex: String }
+    private struct FamilyHexEntry: Decodable { let hex: String; let family: String? }
+    private struct DecoderOracleFile: Decodable { let frames: [FamilyHexEntry] }
+    private struct OpticalOracleFile: Decodable { let records: [HexEntry] }
+
+    private func resource(_ name: String) throws -> Data {
+        let url = try XCTUnwrap(Bundle.module.url(forResource: name, withExtension: "json"),
+                                "missing \(name).json test resource")
+        return try Data(contentsOf: url)
+    }
+
+    /// Every real frame the package's capture corpus holds must keep a POSITIVE verdict under the
+    /// tightened rules — minimum length, exact length, header checksum and payload CRC32 together.
+    /// This is the regression guard for the whole change: the corpus is what a strap actually sent.
+    func testEveryRecordedFrameInTheCorpusStaysValid() throws {
+        var checked = 0
+        func assertValid(_ hexString: String, _ family: DeviceFamily, _ label: String) {
+            let frame = Self.hex(hexString)
+            let check = verifyFrame(frame, family: family)
+            XCTAssertTrue(check.ok, "\(label) (\(frame.count) B) rejected: \(check.reason)")
+            XCTAssertEqual(check.reason, .none, "\(label)")
+            XCTAssertTrue(parseFrame(frame, family: family).ok, "\(label)")
+            checked += 1
+        }
+
+        let dec = JSONDecoder()
+        for (i, e) in try dec.decode([HexEntry].self, from: resource("frames")).enumerated() {
+            assertValid(e.hex, .whoop4, "frames.json #\(i)")
+        }
+        for (i, e) in try dec.decode([HexEntry].self, from: resource("historical_frames")).enumerated() {
+            assertValid(e.hex, .whoop4, "historical_frames.json #\(i)")
+        }
+        for (i, e) in try dec.decode(DecoderOracleFile.self, from: resource("decoder_oracle")).frames.enumerated() {
+            assertValid(e.hex, e.family == "whoop5" ? .whoop5 : .whoop4, "decoder_oracle.json #\(i)")
+        }
+        for (i, e) in try dec.decode(OpticalOracleFile.self,
+                                     from: resource("r20_optical_oracle")).records.enumerated() {
+            assertValid(e.hex, .whoop5, "r20_optical_oracle.json #\(i)")
+        }
+        XCTAssertEqual(checked, 116, "the corpus size is pinned so a lost resource cannot pass as green")
+    }
+}
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FramingTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FramingTests.swift
index f8c6707e8e..8e3804c741 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FramingTests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/FramingTests.swift
@@ -69,7 +69,9 @@ final class FramingTests: XCTestCase {
         // inner = [43,0,0] + data (7 bytes); length = 7 + 4 = 11.
         XCTAssertEqual(frame[0], 0xAA)
         XCTAssertEqual(Int(frame[1]) | (Int(frame[2]) << 8), 11)
-        XCTAssertEqual(frame[3], 0x00) // placeholder crc8
+        // The header checksum is computed for real (it used to be a 0x00 placeholder), so a rebuilt
+        // frame is one a strap could have sent rather than one every gate now rejects.
+        XCTAssertEqual(frame[3], crc8([frame[1], frame[2]]))
         XCTAssertEqual(frame[4], 43)
         XCTAssertEqual(frame[5], 0)
         XCTAssertEqual(frame[6], 0)
@@ -80,8 +82,12 @@ final class FramingTests: XCTestCase {
         let got = UInt32(frame[11]) | (UInt32(frame[12]) << 8)
             | (UInt32(frame[13]) << 16) | (UInt32(frame[14]) << 24)
         XCTAssertEqual(got, want)
-        // The reconstructed frame's crc32 must verify (crc8 is a placeholder so .ok stays false).
-        XCTAssertEqual(verifyFrame(frame).crc32OK, true)
+        // The reconstructed frame verifies end to end: both checksums AND the exact length.
+        let check = verifyFrame(frame)
+        XCTAssertEqual(check.crc32OK, true)
+        XCTAssertEqual(check.crc8OK, true)
+        XCTAssertTrue(check.ok)
+        XCTAssertEqual(check.reason, .none)
     }
 
     func testFrameFromPayloadDefaults() {
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/HistoricalMetaTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/HistoricalMetaTests.swift
index a57d7c1ab3..642537f836 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/HistoricalMetaTests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/HistoricalMetaTests.swift
@@ -107,4 +107,109 @@ final class HistoricalMetaTests: XCTestCase {
         let p = metaParsed(cmd: 3)
         XCTAssertEqual(p.parsed["meta_type"], .string("HISTORY_COMPLETE(3)"))
     }
+
+    // MARK: - the gate: a metadata frame that is not INTACT classifies as nothing
+    //
+    // Scenario "Zustandstreibende Tore fordern das volle Urteil / Verlaufs-Metadaten können nicht
+    // gefälscht werden". Each frame below is a real, decodable HISTORY_END / HISTORY_COMPLETE broken in
+    // exactly ONE way, so what the classifier refuses is attributable. `.end`/`.complete` are the two
+    // results that advance the trim cursor and ack the strap to free its records, which is why they are
+    // the ones a forged frame must never reach.
+
+    /// Header checksum wrong, payload CRC32 RIGHT — the class that passed every gate before this change.
+    func testHistoryEndWithABrokenHeaderChecksumIsNotClassified() {
+        let payload: [UInt8] = le32(1_700_000_000) + le16(0) + le32(0) + le32(4242)
+        var frame = frameFromPayload(payload, type: 49, seq: 0, cmd: 2)
+        frame[3] ^= 0xFF                       // CRC-8 over the length field only
+        let p = parseFrame(frame)
+        XCTAssertEqual(p.crcOK, true, "precondition: only the HEADER checksum is broken")
+        XCTAssertEqual(p.rejectReason, .headerChecksumMismatch)
+        XCTAssertEqual(p.typeName, "METADATA", "the frame stays readable for an inspector …")
+        XCTAssertEqual(p.parsed["meta_type"], .string("HISTORY_END(2)"), "… including its meta type")
+        XCTAssertEqual(classifyHistoricalMeta(p), .other,
+                       "… but it must not advance the trim cursor or ack the strap")
+    }
+
+    func testHistoryCompleteWithABrokenHeaderChecksumIsNotClassified() {
+        var frame = frameFromPayload([], type: 49, seq: 0, cmd: 3)
+        frame[3] ^= 0xFF
+        let p = parseFrame(frame)
+        XCTAssertEqual(p.parsed["meta_type"], .string("HISTORY_COMPLETE(3)"))
+        XCTAssertEqual(classifyHistoricalMeta(p), .other)
+    }
+
+    /// Declared length below the WHOOP 4.0 minimum of 11 total bytes. The bytes are all still there —
+    /// only the length word claims a frame too small to hold an inner record.
+    func testHistoryEndWithADeclaredLengthBelowTheMinimumIsNotClassified() {
+        let payload: [UInt8] = le32(1_700_000_000) + le16(0) + le32(0) + le32(4242)
+        var frame = frameFromPayload(payload, type: 49, seq: 0, cmd: 2)
+        frame[1] = 6; frame[2] = 0                     // declared 6 → total 10, below the 11-byte floor
+        frame[3] = crc8(frame, 1, 3)                   // …with a CORRECT header checksum for that word
+        let p = parseFrame(frame)
+        XCTAssertEqual(p.rejectReason, .belowMinimumLength)
+        XCTAssertEqual(classifyHistoricalMeta(p), .other)
+    }
+
+    /// The CRC32 trailer is cut off: the declared length promises four bytes that are not there.
+    func testHistoryEndWithATruncatedTrailerIsNotClassified() {
+        let payload: [UInt8] = le32(1_700_000_000) + le16(0) + le32(0) + le32(4242)
+        let full = frameFromPayload(payload, type: 49, seq: 0, cmd: 2)
+        let cut = Array(full.dropLast(2))              // still >= 11 bytes, so it parses
+        let p = parseFrame(cut)
+        XCTAssertEqual(p.rejectReason, .lengthMismatch)
+        XCTAssertEqual(p.typeName, "METADATA")
+        XCTAssertEqual(p.parsed["meta_type"], .string("HISTORY_END(2)"),
+                       "precondition: without the gate this frame WOULD be read as a history end")
+        XCTAssertEqual(classifyHistoricalMeta(p), .other)
+    }
+
+    /// Trailing bytes past the frame's own end — the other half of the exact-length rule.
+    func testHistoryCompleteWithTrailingBytesIsNotClassified() {
+        let frame = frameFromPayload([], type: 49, seq: 0, cmd: 3) + [0x00, 0x00]
+        let p = parseFrame(frame)
+        XCTAssertEqual(p.rejectReason, .lengthMismatch)
+        XCTAssertEqual(classifyHistoricalMeta(p), .other)
+    }
+
+    /// The counterpart that must NOT regress: the smallest REAL metadata frames in the capture corpus
+    /// sit exactly on the 11-byte minimum, with the meta type in their last payload byte. If the bound
+    /// or the gate were one byte stricter, the offload would never see a history end and never finish.
+    func testRealElevenByteMetadataFramesStillClassify() {
+        let start = FrameIntegrityTests.hex(FrameIntegrityTests.w4MetaHistoryStart11)
+        let complete = FrameIntegrityTests.hex(FrameIntegrityTests.w4MetaHistoryComplete11)
+        XCTAssertEqual(classifyHistoricalMeta(parseFrame(start)), .start)
+        XCTAssertEqual(classifyHistoricalMeta(parseFrame(complete)), .complete)
+    }
+
+    /// And the real 25-byte HISTORY_END still yields its unix + trim cursor.
+    func testRealHistoryEndFrameStillClassifies() {
+        let p = parseFrame(FrameIntegrityTests.hex(FrameIntegrityTests.w4HistoryEnd25))
+        guard case .end(let unix, let trim) = classifyHistoricalMeta(p) else {
+            return XCTFail("the real HISTORY_END frame must still classify as an end, got \(classifyHistoricalMeta(p))")
+        }
+        XCTAssertEqual(unix, 1_700_000_000)
+        XCTAssertEqual(trim, 12345)
+    }
+
+    // MARK: - a metadata TYPE is never read out of the CRC32 trailer (D7, shared with package 1)
+
+    /// Scenario "Kein Byte des CRC-Anhangs wird als Metadatentyp gelesen". This 14-byte WHOOP 5.0 frame
+    /// is fully INTACT — correct header checksum, correct CRC32, exact length — and the first byte of
+    /// its own trailer sits where the metadata type would be read, carrying the value 3
+    /// (HISTORY_COMPLETE). Only the payload bound stops it, so this is the case that would end an
+    /// offload on a forged frame the integrity gate cannot object to.
+    func testWhoop5FrameAtTheMinimumCannotFakeHistoryComplete() {
+        let frame = FrameIntegrityTests.hex(FrameIntegrityTests.w5Meta14FakesHistoryComplete)
+        let p = parseFrame(frame, family: .whoop5)
+        XCTAssertTrue(p.ok, "precondition: the gate has no objection to this frame at all")
+        XCTAssertEqual(p.typeName, "METADATA")
+        XCTAssertNil(p.parsed["meta_type"], "the type byte would come from the CRC32 trailer")
+        XCTAssertEqual(classifyHistoricalMeta(p), .other)
+    }
+
+    func testWhoop5FrameAtTheMinimumLengthClassifiesAsNothing() {
+        let p = parseFrame(FrameIntegrityTests.hex(FrameIntegrityTests.w5Min13Metadata), family: .whoop5)
+        XCTAssertTrue(p.ok, "precondition: 13 bytes is the family minimum, not a rejection")
+        XCTAssertEqual(classifyHistoricalMeta(p), .other)
+    }
 }
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/HistoricalV24Tests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/HistoricalV24Tests.swift
index 32eef06afb..b87622e30b 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/HistoricalV24Tests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/HistoricalV24Tests.swift
@@ -73,7 +73,12 @@ final class HistoricalV24Tests: XCTestCase {
         var bad = bytes(v24Hex)
         bad[5] = 99  // flip version byte to an unmapped value
         let out = parseFrame(bad)
-        XCTAssertTrue(out.ok)  // parse is defensive (crc will mismatch)
+        // The flipped byte is inside the CRC32-covered inner record, so the frame is NOT intact and
+        // `ok` says so — it used to report a positive verdict for exactly this deliberately corrupted
+        // frame. Decoding stays defensive: the fields are still readable for an inspector.
+        XCTAssertFalse(out.ok)
+        XCTAssertEqual(out.rejectReason, .payloadCRCMismatch)
+        XCTAssertEqual(out.crcOK, false)
         XCTAssertEqual(out.parsed["hist_version"]?.intValue, 99)
     }
 }
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/ReToolsTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/ReToolsTests.swift
index 0156e48ec2..cd29a06322 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/ReToolsTests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/ReToolsTests.swift
@@ -119,7 +119,29 @@ final class ReToolsTests: XCTestCase {
         XCTAssertTrue(g.unknownBytes.allSatisfy { $0.constant })
     }
 
-    // MARK: - C) inventory: census sorted by count, ok/crc, ts span, len spread
+    // MARK: - 2.13: the hand-built parse result still decodes after the new field appeared
+
+    // ReTools' fixtures build a ParsedFrame by decoding a JSON dict that has no `rejectReason` key at
+    // all — the same shape older capture files have. Decoding must stay TOLERANT and default it to
+    // `.none`, or every fixture in this file (and every archived capture) becomes undecodable.
+    func testHandBuiltParseResultDecodesWithoutARejectReason() {
+        let f = frame(type: "EVENT", len: 4)
+        XCTAssertEqual(f.rejectReason, .none,
+                       "a document without the key must decode, defaulting the reason to none")
+        // And a document that DOES carry one keeps it, so the field is genuinely read and not ignored.
+        let dict: [String: Any] = [
+            "ok": false, "typeName": "EVENT", "seq": NSNull(), "cmdName": NSNull(),
+            "crcOK": true, "lenBytes": 12, "rawHex": "", "fields": [], "parsed": [:],
+            "rejectReason": "headerChecksumMismatch",
+        ]
+        let data = try! JSONSerialization.data(withJSONObject: dict)
+        let decoded = try! JSONDecoder().decode(ParsedFrame.self, from: data)
+        XCTAssertEqual(decoded.rejectReason, .headerChecksumMismatch)
+        XCTAssertTrue(decoded.payloadCRCOKButEnvelopeRejected,
+                      "payload CRC32 right + envelope wrong is the class that used to pass the gates")
+    }
+
+    // MARK: - C) inventory: census sorted by count, intact/parsable/crc, ts span, len spread
 
     func testInventoryCensus() {
         let hist = frame(type: "HISTORICAL_DATA", seq: 26, len: 8, ok: true, crcOK: true)
@@ -133,8 +155,11 @@ final class ReToolsTests: XCTestCase {
         XCTAssertEqual(inv.first?.key, "HISTORICAL_DATA/v26")   // 3 records → most common, sorts first
         let h = inv.first!
         XCTAssertEqual(h.count, 3)
-        XCTAssertEqual(h.okCount, 2)
+        XCTAssertEqual(h.intactCount, 2)
         XCTAssertEqual(h.crcOkCount, 2)
+        // All three carry a decoded packet type, including the one that is not intact: parseability and
+        // integrity are separate columns, and the census must not report a readable frame as unreadable.
+        XCTAssertEqual(h.parsableCount, 3)
         XCTAssertEqual(h.firstTsMs, 1000)
         XCTAssertEqual(h.lastTsMs, 3000)
         XCTAssertEqual(h.minLen, 6)
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/RejectedHistoryTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/RejectedHistoryTests.swift
index cb6023ea9b..5d50d38de0 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/RejectedHistoryTests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/RejectedHistoryTests.swift
@@ -77,6 +77,31 @@ final class RejectedHistoryTests: XCTestCase {
         XCTAssertTrue(rejectedHistoricalRecords([v26], family: .whoop5).isEmpty)
     }
 
+    /// The v26 skip is bound to the VERDICT, not to the version byte alone. Its whole premise is that
+    /// `extractHistoricalStreams` stores such a record durably in the PPG waveform stream — which stops
+    /// being true the moment the record is rejected: the extraction drops it, and an unconditional skip
+    /// here would leave it archived nowhere while the section is acked anyway.
+    func testWhoop5V26RecordWithABrokenHeaderChecksumIsArchived() {
+        var bad = bytes(whoop5V26Hex)
+        bad[6] ^= 0xFF                                  // CRC-16-Modbus over the first six bytes
+        XCTAssertEqual(bad[8], 47)                      // still a HISTORICAL_DATA record…
+        XCTAssertEqual(bad[9], 26)                      // …still version 26
+        let p = parseFrame(bad, family: .whoop5)
+        XCTAssertEqual(p.crcOK, true, "precondition: the PAYLOAD CRC32 still verifies")
+        XCTAssertEqual(p.rejectReason, .headerChecksumMismatch)
+        XCTAssertEqual(rejectedHistoricalRecords([bad], family: .whoop5), [bad],
+                       "a rejected v26 record reaches no stream, so its bytes are the only copy left")
+    }
+
+    /// The other direction of the same rule: binding the skip to the verdict must not start archiving
+    /// the NORMAL case. An intact v26 record is stored in its own stream and stays out of the archive.
+    func testIntactWhoop5V26RecordIsStillNotArchived() {
+        let v26 = bytes(whoop5V26Hex)
+        XCTAssertTrue(parseFrame(v26, family: .whoop5).ok, "precondition: the record is intact")
+        XCTAssertTrue(rejectedHistoricalRecords([v26], family: .whoop5).isEmpty,
+                      "the archive must not grow by the normal case")
+    }
+
     func testNonHistoricalFrameExcluded() {
         // A REALTIME_DATA (type-40) frame is live, not offload — never a history-loss candidate.
         let realtime = frameFromPayload([0x01, 0x02, 0x03], type: 40, seq: 0, cmd: 0)
@@ -98,6 +123,75 @@ final class RejectedHistoryTests: XCTestCase {
         XCTAssertEqual(rejected, [bad])
     }
 
+    // MARK: - D8: this reader runs the OTHER WAY ROUND — a negative verdict means ARCHIVE
+
+    /// Scenario "Beweissichernde Leser verlieren keine Rahmen / Rahmen mit kaputtem Header wird
+    /// gesichert statt verworfen". Before the change this frame passed as decodable and was archived
+    /// NOWHERE; the strap frees it on the next trim ack, so the archive is the only copy that can exist.
+    func testWhoop4RecordWithABrokenHeaderChecksumIsArchived() {
+        var bad = bytes(v24Hex)
+        bad[3] ^= 0xFF                                  // CRC-8 over the length field only
+        let p = parseFrame(bad)
+        XCTAssertEqual(p.crcOK, true, "precondition: the PAYLOAD CRC32 still verifies")
+        XCTAssertEqual(p.rejectReason, .headerChecksumMismatch)
+        XCTAssertEqual(rejectedHistoricalRecords([bad], family: .whoop4), [bad],
+                       "a frame we cannot trust is a frame we must keep the bytes of")
+    }
+
+    func testWhoop5RecordWithABrokenHeaderChecksumIsArchived() {
+        var bad = bytes(whoop5V18Hex)
+        bad[6] ^= 0xFF                                  // CRC-16-Modbus over the first six bytes
+        XCTAssertEqual(bad[8], 47)
+        XCTAssertEqual(parseFrame(bad, family: .whoop5).rejectReason, .headerChecksumMismatch)
+        XCTAssertEqual(rejectedHistoricalRecords([bad], family: .whoop5), [bad])
+    }
+
+    func testWhoop4RecordWithTrailingBytesIsArchived() {
+        let bad = bytes(v24Hex) + [0x00]                // one byte past the frame's own end
+        XCTAssertEqual(parseFrame(bad).rejectReason, .lengthMismatch)
+        XCTAssertEqual(rejectedHistoricalRecords([bad], family: .whoop4), [bad])
+    }
+
+    func testWhoop4RecordWithATruncatedTrailerIsArchived() {
+        let bad = Array(bytes(v24Hex).dropLast(2))
+        XCTAssertEqual(parseFrame(bad).rejectReason, .lengthMismatch)
+        XCTAssertEqual(rejectedHistoricalRecords([bad], family: .whoop4), [bad])
+    }
+
+    /// Scenario "Bisher gesicherte Rahmen bleiben gesichert", over the real capture corpus.
+    ///
+    /// The pre-change reader is re-implemented here verbatim, with the one substitution the change
+    /// makes: its `ok` was a constant that meant "these bytes read as a frame", which is
+    /// `isParsable` today. Every frame it would have archived must still be archived. The direction
+    /// is asserted as a SUBSET, not as equality, because the new reader is expected to archive more.
+    func testNoCorpusFrameIsArchivedLessThanBefore() throws {
+        let url = try XCTUnwrap(Bundle.module.url(forResource: "frames", withExtension: "json"),
+                                "the WHOOP 4.0 capture corpus must be present")
+        struct HexOnly: Decodable { let hex: String }
+        let corpus = try JSONDecoder().decode([HexOnly].self, from: Data(contentsOf: url))
+            .map { bytes($0.hex) }
+        XCTAssertGreaterThan(corpus.count, 50, "precondition: a corpus worth calling a corpus")
+
+        // The pre-change predicate, for WHOOP 4.0.
+        func archivedBefore(_ f: [UInt8]) -> Bool {
+            guard f.count > 4, Int(f[4]) == 47 else { return false }
+            let p = parseFrame(f, family: .whoop4)
+            if !p.isParsable || p.crcOK == false { return true }
+            return p.parsed["unix"]?.intValue == nil
+                || (p.parsed["heart_rate"]?.intValue == nil && p.parsed["gravity_x"]?.doubleValue == nil)
+        }
+
+        let before = corpus.filter(archivedBefore)
+        let now = Set(rejectedHistoricalRecords(corpus, family: .whoop4).map { Data($0) })
+        for f in before {
+            XCTAssertTrue(now.contains(Data(f)),
+                          "a frame archived before this change must still be archived: \(f.prefix(8))")
+        }
+        // And nothing INTACT and decodable was dragged in: the corpus's clean records stay out.
+        let clean = corpus.filter { $0.count > 4 && Int($0[4]) == 47 && parseFrame($0).ok }
+        XCTAssertGreaterThan(clean.count, 0, "precondition: the corpus holds intact type-47 records")
+    }
+
     func testIsEmptyRecordFrameFlagsAllZeroPayloadOnly() {
         // A 104 B frame with header + CRC bytes set but the record payload (21..<count-4) all zero -> empty.
         var empty = [UInt8](repeating: 0, count: 104)
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Resources/frame_integrity_oracle.json b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Resources/frame_integrity_oracle.json
new file mode 100644
index 0000000000..541873e8f4
--- /dev/null
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Resources/frame_integrity_oracle.json
@@ -0,0 +1,498 @@
+{
+  "_comment": [
+    "SHARED FRAME-INTEGRITY ORACLE (change frame-integrity, D5 / task 4.2).",
+    "Generated — do not hand-edit. Regenerate with:",
+    "swift run --package-path openspec/changes/frame-integrity/oracle-gen FrameIntegrityOracleGen",
+    "Two byte-identical copies are committed, one per test tree, and both suites assert every case",
+    "and all three pinned fields (verdict, reject_reason, meta), so neither platform can move its",
+    "verifier without the other's suite going red.",
+    "verdict       = ParsedFrame.ok, the verifier's FULL verdict.",
+    "reject_reason = the Swift FrameRejectReason rawValue; Kotlin maps its enum through wireName.",
+    "meta          = classifyHistoricalMeta, as start | complete | other | end(unix=U,trim=T).",
+    "ecg_inner_payload_hex is present only on cases with ecg_path true (the second verifying path,",
+    "Whoop5Ecg.innerPayload); null means that path refused the frame.",
+    "The export FORM of a reject reason differs by design (Kotlin omits the key when there is no",
+    "reason, Swift always writes it) — this oracle pins the verdict, the reason and the",
+    "classification, never the export spelling."
+  ],
+  "coverage": {
+    "case_count": 45,
+    "classes": {
+      "below_minimum": 4,
+      "boundary": 3,
+      "ecg_path": 3,
+      "evaluation_order": 4,
+      "header_corrupt": 5,
+      "no_start_of_frame": 4,
+      "payload_corrupt": 5,
+      "trailing_bytes": 3,
+      "truncated": 4,
+      "valid_recorded": 9,
+      "valid_synthetic": 1
+    },
+    "reasons": {
+      "belowMinimumLength": 5,
+      "headerChecksumMismatch": 7,
+      "lengthMismatch": 10,
+      "noStartOfFrame": 4,
+      "none": 14,
+      "payloadCRCMismatch": 5
+    }
+  },
+  "cases": [
+    {
+      "name": "w4_realtime_valid",
+      "family": "whoop4",
+      "class": "valid_recorded",
+      "hex": "aa1800ff28020f3de10128663c0000000000000000000000da855212",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_meta_history_start_11",
+      "family": "whoop4",
+      "class": "valid_recorded",
+      "hex": "aa07006b3100012366efad",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "start",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_meta_history_complete_11",
+      "family": "whoop4",
+      "class": "valid_recorded",
+      "hex": "aa07006b3100030f07e143",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "complete",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_history_end_25",
+      "family": "whoop4",
+      "class": "valid_recorded",
+      "hex": "aa15001631000200f1536500000000000039300000c3401bdb",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "end(unix=1700000000,trim=12345)",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_historical_v24_valid",
+      "family": "whoop4",
+      "class": "valid_recorded",
+      "hex": "aa6400a12f18054c1c0a023ed0266a5037805418016d022b0234020000000000006b07ff0085593c1f65cebed7b3e63eb85a5f3f000080401f65cebed7b3e63eb85a5f3f500264025d03640229014009010c020c00000000000f0001c4020000000000008fdeb278",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_historical_v25_valid",
+      "family": "whoop4",
+      "class": "valid_recorded",
+      "hex": "aa50000c2f1900006800007dff2a6a20430900433103007e026502ba026c022eff70f996f879fad6fd8300d6017e0267027201be00290258030e05c507f00c030ead11cb15791500d2553c9003000000d6393716",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_historical_v18_valid",
+      "family": "whoop5",
+      "class": "valid_recorded",
+      "hex": "aa01740001003fb12f1280733d8401b69f266a66460066025a0265020000000000007b0a8d656463ff0012163cf6a439bf2924fd3ed763fe3e3200aa000000000000000000f7000901f10b0007010c020c00000000000000000000000000000000000000000000000100656f1e1e0000009d61a7c00000003e862817",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_meta_history_end_valid",
+      "family": "whoop5",
+      "class": "valid_recorded",
+      "hex": "aa011c00010023d1316a0284a3266a0a373d00000041b601001000000000000044d21e3d",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "end(unix=1780917124,trim=112193)",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_meta_history_start_valid",
+      "family": "whoop5",
+      "class": "valid_recorded",
+      "hex": "aa012c0001002cd1312c0184a3266ad7230d0000005200000000000000320000002600000001000000000000000b010034497926",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "start",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_command_response_valid",
+      "family": "whoop5",
+      "class": "valid_synthetic",
+      "hex": "aa010c000001e74124070211223344557481f36e",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_realtime_header_checksum_corrupt",
+      "family": "whoop4",
+      "class": "header_corrupt",
+      "hex": "aa18000028020f3de10128663c0000000000000000000000da855212",
+      "verdict": false,
+      "reject_reason": "headerChecksumMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_history_end_25_header_corrupt",
+      "family": "whoop4",
+      "class": "header_corrupt",
+      "hex": "aa1500e931000200f1536500000000000039300000c3401bdb",
+      "verdict": false,
+      "reject_reason": "headerChecksumMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_meta_complete_11_header_corrupt",
+      "family": "whoop4",
+      "class": "header_corrupt",
+      "hex": "aa0700943100030f07e143",
+      "verdict": false,
+      "reject_reason": "headerChecksumMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_command_response_header_crc16_corrupt",
+      "family": "whoop5",
+      "class": "header_corrupt",
+      "hex": "aa010c000001184124070211223344557481f36e",
+      "verdict": false,
+      "reject_reason": "headerChecksumMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_meta_history_end_header_corrupt",
+      "family": "whoop5",
+      "class": "header_corrupt",
+      "hex": "aa011c000100dcd1316a0284a3266a0a373d00000041b601001000000000000044d21e3d",
+      "verdict": false,
+      "reject_reason": "headerChecksumMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_realtime_payload_corrupt",
+      "family": "whoop4",
+      "class": "payload_corrupt",
+      "hex": "aa1800ff28020f3d1e0128663c0000000000000000000000da855212",
+      "verdict": false,
+      "reject_reason": "payloadCRCMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_history_end_25_payload_corrupt",
+      "family": "whoop4",
+      "class": "payload_corrupt",
+      "hex": "aa150016310002000e536500000000000039300000c3401bdb",
+      "verdict": false,
+      "reject_reason": "payloadCRCMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_historical_v24_payload_corrupt",
+      "family": "whoop4",
+      "class": "payload_corrupt",
+      "hex": "aa6400a12f18054c1c0a023ed0266a5037805418fe6d022b0234020000000000006b07ff0085593c1f65cebed7b3e63eb85a5f3f000080401f65cebed7b3e63eb85a5f3f500264025d03640229014009010c020c00000000000f0001c4020000000000008fdeb278",
+      "verdict": false,
+      "reject_reason": "payloadCRCMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_historical_v18_payload_corrupt",
+      "family": "whoop5",
+      "class": "payload_corrupt",
+      "hex": "aa01740001003fb12f1280733d8401b69f266a66b90066025a0265020000000000007b0a8d656463ff0012163cf6a439bf2924fd3ed763fe3e3200aa000000000000000000f7000901f10b0007010c020c00000000000000000000000000000000000000000000000100656f1e1e0000009d61a7c00000003e862817",
+      "verdict": false,
+      "reject_reason": "payloadCRCMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_meta_history_end_payload_corrupt",
+      "family": "whoop5",
+      "class": "payload_corrupt",
+      "hex": "aa011c00010023d1316a0284a3266a0a373d0000ff41b601001000000000000044d21e3d",
+      "verdict": false,
+      "reject_reason": "payloadCRCMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_total8_declared4",
+      "family": "whoop4",
+      "class": "below_minimum",
+      "hex": "aa04005400000000",
+      "verdict": false,
+      "reject_reason": "belowMinimumLength",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_total9_declared5",
+      "family": "whoop4",
+      "class": "below_minimum",
+      "hex": "aa05004131b7efdc83",
+      "verdict": false,
+      "reject_reason": "belowMinimumLength",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_total10_declared6",
+      "family": "whoop4",
+      "class": "below_minimum",
+      "hex": "aa06007e31004d158487",
+      "verdict": false,
+      "reject_reason": "belowMinimumLength",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_total12_declared4",
+      "family": "whoop5",
+      "class": "below_minimum",
+      "hex": "aa0104000001e52100000000",
+      "verdict": false,
+      "reject_reason": "belowMinimumLength",
+      "meta": "other",
+      "ecg_path": true,
+      "ecg_inner_payload_hex": null
+    },
+    {
+      "name": "w4_realtime_truncated_by_1",
+      "family": "whoop4",
+      "class": "truncated",
+      "hex": "aa1800ff28020f3de10128663c0000000000000000000000da8552",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_history_end_25_trailer_truncated",
+      "family": "whoop4",
+      "class": "truncated",
+      "hex": "aa15001631000200f1536500000000000039300000c340",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_historical_v18_truncated_by_1",
+      "family": "whoop5",
+      "class": "truncated",
+      "hex": "aa01740001003fb12f1280733d8401b69f266a66460066025a0265020000000000007b0a8d656463ff0012163cf6a439bf2924fd3ed763fe3e3200aa000000000000000000f7000901f10b0007010c020c00000000000000000000000000000000000000000000000100656f1e1e0000009d61a7c00000003e8628",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_huge_declared_length_11_present",
+      "family": "whoop4",
+      "class": "truncated",
+      "hex": "aa00f0de31000102030405",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_realtime_trailing_byte",
+      "family": "whoop4",
+      "class": "trailing_bytes",
+      "hex": "aa1800ff28020f3de10128663c0000000000000000000000da85521200",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_meta_complete_11_trailing_byte",
+      "family": "whoop4",
+      "class": "trailing_bytes",
+      "hex": "aa07006b3100030f07e14300",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_command_response_trailing_byte",
+      "family": "whoop5",
+      "class": "trailing_bytes",
+      "hex": "aa010c000001e74124070211223344557481f36e00",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_min13_metadata_boundary",
+      "family": "whoop5",
+      "class": "boundary",
+      "hex": "aa0105000001e4dd31b7efdc83",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_meta14_fakes_history_complete",
+      "family": "whoop5",
+      "class": "boundary",
+      "hex": "aa0106000001e49931530315e675",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_short_realtime_14",
+      "family": "whoop4",
+      "class": "boundary",
+      "hex": "aa0a0082280111223344854deb31",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "no_start_of_frame_w4",
+      "family": "whoop4",
+      "class": "no_start_of_frame",
+      "hex": "bb1800ff28020f3de10128663c0000000000000000000000da855212",
+      "verdict": false,
+      "reject_reason": "noStartOfFrame",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "no_start_of_frame_w5",
+      "family": "whoop5",
+      "class": "no_start_of_frame",
+      "hex": "bb010c000001e74124070211223344557481f36e",
+      "verdict": false,
+      "reject_reason": "noStartOfFrame",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "empty_byte_run_w4",
+      "family": "whoop4",
+      "class": "no_start_of_frame",
+      "hex": "",
+      "verdict": false,
+      "reject_reason": "noStartOfFrame",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "empty_byte_run_w5",
+      "family": "whoop5",
+      "class": "no_start_of_frame",
+      "hex": "",
+      "verdict": false,
+      "reject_reason": "noStartOfFrame",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_length_field_corrupt_order_length_before_header",
+      "family": "whoop4",
+      "class": "evaluation_order",
+      "hex": "aae700ff28020f3de10128663c0000000000000000000000da855212",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_header_and_payload_both_corrupt",
+      "family": "whoop4",
+      "class": "evaluation_order",
+      "hex": "aa18000028020f3d1e0128663c0000000000000000000000da855212",
+      "verdict": false,
+      "reject_reason": "headerChecksumMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_below_minimum_and_header_corrupt",
+      "family": "whoop4",
+      "class": "evaluation_order",
+      "hex": "aa0400ab00000000",
+      "verdict": false,
+      "reject_reason": "belowMinimumLength",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_trailing_byte_and_header_corrupt",
+      "family": "whoop5",
+      "class": "evaluation_order",
+      "hex": "aa010c000001184124070211223344557481f36e00",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_ecg_filtered_valid",
+      "family": "whoop5",
+      "class": "ecg_path",
+      "hex": "aa0120000001efd128010002050101000100012a003d3f2c031103000a00f6ff2c0100004decffd3",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": true,
+      "ecg_inner_payload_hex": "02050101000100012a003d3f2c031103000a00f6ff2c010000"
+    },
+    {
+      "name": "w5_ecg_filtered_trailing_byte",
+      "family": "whoop5",
+      "class": "ecg_path",
+      "hex": "aa0120000001efd128010002050101000100012a003d3f2c031103000a00f6ff2c0100004decffd300",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": true,
+      "ecg_inner_payload_hex": null
+    },
+    {
+      "name": "w5_ecg_header_crc16_corrupt",
+      "family": "whoop5",
+      "class": "ecg_path",
+      "hex": "aa012000000110d128010002050101000100012a003d3f2c031103000a00f6ff2c0100004decffd3",
+      "verdict": false,
+      "reject_reason": "headerChecksumMismatch",
+      "meta": "other",
+      "ecg_path": true,
+      "ecg_inner_payload_hex": null
+    }
+  ]
+}
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/StreamsTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/StreamsTests.swift
index 588069002b..97d932921c 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/StreamsTests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/StreamsTests.swift
@@ -73,4 +73,58 @@ final class StreamsTests: XCTestCase {
                                deviceClockRef: deviceClockRef, wallClockRef: wallClockRef)
         XCTAssertEqual(s.hr.count, 1)
     }
+
+    // MARK: - the extraction gate reads the FULL verdict
+    //
+    // Scenario "Zustandstreibende Tore fordern das volle Urteil / Strom- und Verlaufs-Extraktion
+    // überspringt ungültige Rahmen". Each frame is a real REALTIME_DATA broken in exactly one way and
+    // still fully decodable, so what is missing from the result is attributable to the gate.
+
+    func testFrameWithABrokenHeaderChecksumYieldsNoRow() {
+        var broken = bytes(rt0)
+        broken[3] ^= 0xFF                                       // header checksum only
+        let p = parseFrame(broken)
+        XCTAssertEqual(p.crcOK, true, "precondition: the payload CRC32 still verifies")
+        XCTAssertNotNil(p.parsed["heart_rate"], "precondition: the frame still decodes an HR")
+        let s = extractStreams([p], deviceClockRef: deviceClockRef, wallClockRef: wallClockRef)
+        XCTAssertTrue(s.hr.isEmpty, "no row may be derived from a frame that is not intact")
+        XCTAssertTrue(s.rr.isEmpty)
+    }
+
+    func testFrameWithTrailingBytesYieldsNoRow() {
+        let p = parseFrame(bytes(rt0) + [0x00])
+        XCTAssertEqual(p.rejectReason, .lengthMismatch)
+        let s = extractStreams([p], deviceClockRef: deviceClockRef, wallClockRef: wallClockRef)
+        XCTAssertTrue(s.hr.isEmpty)
+    }
+
+    func testOneBrokenFrameInASequenceLosesOnlyItsOwnRow() {
+        var broken = bytes(rt1)
+        broken[3] ^= 0xFF
+        let s = extractStreams([parseFrame(bytes(rt0)), parseFrame(broken)],
+                               deviceClockRef: deviceClockRef, wallClockRef: wallClockRef)
+        XCTAssertEqual(s.hr, [HRSample(ts: 1_736_365_593, bpm: 60)],
+                       "the intact frame still produces its row; only the broken one is skipped")
+    }
+
+    // MARK: - D7: a named field is never read out of the CRC32 trailer (post-hook half, 2.18)
+
+    /// This 17-byte WHOOP 4.0 REALTIME_DATA frame is INTACT — correct header checksum, correct CRC32,
+    /// exact declared length of 13 — but its inner record ends at byte 13, so the R-R count the
+    /// realtime post-hook reads at offset 13 is the first byte of the frame's own CRC32 trailer. That
+    /// byte is 0x01, and the two trailer bytes behind it read as a 33403 ms interval: a physiologically
+    /// impossible R-R that the strap never sent and that nothing downstream could tell from a real one.
+    ///
+    /// The gate cannot catch this — the frame passes every checksum. Only the payload bound does.
+    func testRealtimeRRCountIsNotReadOutOfTheTrailer() {
+        let frame = bytes("aa0d00e9280100000009000000017b826e")
+        let p = parseFrame(frame)
+        XCTAssertTrue(p.ok, "precondition: this frame is intact by every checksum")
+        XCTAssertEqual(p.typeName, "REALTIME_DATA")
+        XCTAssertEqual(frame[13], 0x01, "precondition: the trailer's first byte reads as rr_count = 1")
+        XCTAssertEqual(p.parsed["rr_intervals"], .intArray([]),
+                       "an R-R interval must never be decoded out of the CRC32 trailer")
+        let s = extractStreams([p], deviceClockRef: deviceClockRef, wallClockRef: wallClockRef)
+        XCTAssertTrue(s.rr.isEmpty, "…and no such row may reach the datastore")
+    }
 }
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5EcgTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5EcgTests.swift
index f6076bb7f2..a3c6e0ece6 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5EcgTests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5EcgTests.swift
@@ -792,4 +792,30 @@ final class Whoop5EcgTests: XCTestCase {
             XCTAssertFalse(text.lowercased().contains(token.lowercased()), "report must not name \(token)")
         }
     }
+
+    // MARK: - direct caller of the verifier (2.5): the useful path is unchanged
+
+    /// `Whoop5Ecg.innerPayload` is the one seam every frame-level ECG entry point goes through, and it
+    /// calls `verifyFrame` itself. The ordinary packet must still reach its field decode, and the frame
+    /// classes the verifier newly rejects must stop here rather than being read as ECG samples.
+    func testTheOrdinaryEcgFrameStillYieldsItsPayload() {
+        let samples: [Int16] = [10, -10, 300]
+        let frame = puffinFrame(type: 0x28, payload: header(samples: UInt16(samples.count)) + i16le(samples))
+        XCTAssertEqual(verifyFrame(frame, family: .whoop5).reason, .none, "precondition: intact")
+        XCTAssertNotNil(Whoop5Ecg.innerPayload(frame), "the useful path must still produce a payload")
+        XCTAssertEqual(Whoop5Ecg.decodeFilteredFrame(frame)?.filteredECGDataRaw, samples)
+    }
+
+    func testAnEcgFrameWithTrailingBytesIsRefused() {
+        let frame = puffinFrame(type: 0x28, payload: header(samples: 2) + i16le([1, 2])) + [0x00]
+        XCTAssertEqual(verifyFrame(frame, family: .whoop5).reason, .lengthMismatch)
+        XCTAssertNil(Whoop5Ecg.innerPayload(frame), "trailing bytes mean we do not know where the frame ends")
+        XCTAssertNil(Whoop5Ecg.decodeFilteredFrame(frame))
+    }
+
+    func testAnEcgFrameBelowTheFamilyMinimumIsRefused() {
+        let runt = FrameIntegrityTests.hex(FrameIntegrityTests.w5Total12)
+        XCTAssertEqual(verifyFrame(runt, family: .whoop5).reason, .belowMinimumLength)
+        XCTAssertNil(Whoop5Ecg.innerPayload(runt))
+    }
 }
diff --git a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5RawOpticalTests.swift b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5RawOpticalTests.swift
index f12e34af88..1f537d7309 100644
--- a/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5RawOpticalTests.swift
+++ b/Packages/WhoopProtocol/Tests/WhoopProtocolTests/Whoop5RawOpticalTests.swift
@@ -426,4 +426,29 @@ final class Whoop5RawOpticalTests: XCTestCase {
         out[end + 3] = UInt8((payloadCRC >> 24) & 0xFF)
         return out
     }
+
+    // MARK: - direct caller of the verifier (2.5): the useful path is unchanged
+
+    /// `Whoop5RawOptical.decode` calls `verifyFrame` directly. The real captured record must still
+    /// decode under the tightened verifier — the 2,140-byte buffer declares 2,132, so its total is
+    /// exact and it clears the structural rules — and the reason on the check must be `none`, not just
+    /// a positive verdict by accident.
+    func testTheRealRecordStillDecodesUnderTheTightenedVerifier() throws {
+        let oracle = try loadOracle()
+        let bytes = hexToBytes(oracle.records[0].hex)
+        let check = verifyFrame(bytes, family: .whoop5)
+        XCTAssertTrue(check.ok)
+        XCTAssertEqual(check.reason, .none)
+        XCTAssertNotNil(Whoop5RawOptical.decode(bytes), "the useful path must be untouched")
+    }
+
+    /// And the frame class the verifier newly rejects is refused before any sample is read.
+    func testARecordWithABrokenHeaderChecksumIsRefused() {
+        var frame = Self.sealedSyntheticFrame()
+        XCTAssertNotNil(Whoop5RawOptical.decode(frame), "control: the sealed frame decodes")
+        frame[6] ^= 0xFF                                  // header CRC16 only; the payload CRC32 stands
+        XCTAssertEqual(verifyFrame(frame, family: .whoop5).crc32OK, true)
+        XCTAssertEqual(verifyFrame(frame, family: .whoop5).reason, .headerChecksumMismatch)
+        XCTAssertNil(Whoop5RawOptical.decode(frame))
+    }
 }
diff --git a/Strand/BLE/BLEManager.swift b/Strand/BLE/BLEManager.swift
index c45476d8c8..87cc75888f 100644
--- a/Strand/BLE/BLEManager.swift
+++ b/Strand/BLE/BLEManager.swift
@@ -4332,10 +4332,19 @@ public final class BLEManager: NSObject, ObservableObject {
     ///
     /// Called only while a run is armed, and only for non-offload live frames.
     private func noteEcgProbeFrame(_ frame: [UInt8]) {
-        // CRC GATE FIRST (safety contract §2: "New inbound paths must do the same"). The verdict this
-        // probe produces is its entire output, and a single flipped bit at byte 12 would turn a healthy
-        // SUCCESS into "DATA REQUEST REFUSED" — the strongest claim the report can make. So no byte of
-        // an unverified frame is read here, on either branch.
+        // INTEGRITY GATE FIRST (safety contract §2: "New inbound paths must do the same"). The verdict
+        // this probe produces is its entire output, and a single flipped bit at byte 12 would turn a
+        // healthy SUCCESS into "DATA REQUEST REFUSED" — the strongest claim the report can make. So no
+        // byte of an unverified frame is read here, on either branch.
+        //
+        // This is the app's only DIRECT call into the verifier rather than into a parser, so the
+        // widened verdict lands here first, and it CHANGES WHAT COUNTS AS EVIDENCE. The gate used to
+        // mean "the payload CRC32 is not demonstrably wrong"; it now also requires the CRC16 header
+        // checksum and the exact declared length. A frame with a damaged envelope therefore no longer
+        // settles a step's outcome AND no longer counts as a candidate ECG data packet — so it can
+        // neither produce a refusal the strap never uttered, nor pad the packet count that the report's
+        // silence-based signals are weighed against. Both directions are intended: silence attributed
+        // to nothing is a weaker claim than a verdict attributed to a corrupted frame.
         guard verifyFrame(frame, family: .whoop5).ok else { return }
         // Both COMMAND_RESPONSE spellings: 0x24 (36, what the #592/#690 handlers key on) and the puffin
         // alias 38, which `canonicalTypeName` folds onto the same name. Accepting both means a strap that
@@ -5735,6 +5744,14 @@ extension BLEManager: @preconcurrency CBCentralManagerDelegate {
                 offloadResp: offloadResp, offloadSkinTemp: offloadSkinTemp, offloadSpo2: offloadSpo2,
                 // nil, not 0: this store does not return a step count, and a zero would read as a fault.
                 offloadSteps: nil))
+            // Frames this link REJECTED, per reason. A per-connection readout, so it sits behind the
+            // Test Centre's Connection domain (D3) — a resync after a lost notification rejects frames
+            // routinely and always did, and that number is explicitly NOT the signal to act on. The one
+            // that is (payload CRC32 verified, envelope not) announces itself when it happens, whether
+            // or not any test mode is on. Silent when the link rejected nothing.
+            if TestCentre.active(.connection), let rejects = router.rejectTally.summaryLine() {
+                state.append(log: rejects, domain: .connection)
+            }
         }
         // Clear the tally with the link, so a second teardown for the same drop cannot re-report it.
         inboundFrames = 0; inboundBytes = 0; cmdChannelFrames = 0
@@ -6837,11 +6854,23 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
              BLEManager.cmdNotifyChar,
              BLEManager.eventNotifyChar:
             // Reassemble (no-op for already-complete frames) then route each complete frame.
-            for frame in reassembler.feed(bytes) {
+            // A byte run whose declared total is below the family minimum is dropped INSIDE the
+            // reassembler and reaches no parser and no archive, so its monotonic drop count is folded
+            // into the connection's reject tally right after the feed that may have grown it —
+            // otherwise it would disappear without trace.
+            let completedFrames = reassembler.feed(bytes)
+            router.noteReassemblerDrops(reassembler.belowMinimumLengthDrops)
+            for frame in completedFrames {
                 if backfilling, BLEManager.isOffloadFrame(frame, family: .whoop4) {
                     // Historical replay is bulk sync traffic, not live UI traffic. Feed it only to
                     // the Backfiller; parsing every record through FrameRouter updates SwiftUI for
                     // no user-visible benefit and can make the app feel hung during long offloads.
+                    // …but the CONNECTION'S REJECT TALLY must still see it (D3): the router is what
+                    // counts rejections, and skipping it left the one counter the hardware run's abort
+                    // criterion reads blind in exactly the traffic where an emptied-then-acked section
+                    // is a permanent loss. The verdict is formed once here, from the verifier, and
+                    // handed to the counter — no parse on this path, which is why it was skipped.
+                    router.noteOffloadFrameVerdict(verifyFrame(frame, family: .whoop4))
                     armBackfillTimeout()
                     routeBackfillFrame(frame)
                     // …but a REAL-TIME physical gesture (double-tap / wrist) must still fire even mid-
@@ -6860,6 +6889,30 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                 // the router + collector re-checks the invariant).
                 let parsed = parseFrame(frame, family: .whoop4)
                 router.handle(parsed: parsed, frame: frame)       // live/UI path
+                //
+                // WHAT IS AND IS NOT GATED BELOW (standing risk, recorded rather than fixed here).
+                //
+                // Everything from here on branches on a RAW BYTE COMPARE of the command opcode, before
+                // any integrity verdict. That is deliberate and unchanged by the frame-integrity work:
+                // the six state-driving consumers are gated (router, history-metadata classifier, both
+                // extractors, clock correlation, and the data-range reply below), and this change does
+                // not claim "every frame consumer".
+                //
+                // Of the probe replies dispatched here, these verify before reading a field, inside
+                // their own decoder: the feature-flag probe and the device-config READ probe (both
+                // through `verifyFrame` in WhoopProtocol), the R22 read-back and the ECG/Broadcast-HR
+                // gate READ-BACKS (through the same probe parser), and the 5/MG ECG probe.
+                //
+                // These do NOT, and stay that way for now — none drives live state or the offload:
+                //   • the extended-battery probe (#592) and the body-location probe (#690): each reads
+                //     the reply's bytes, states a finding about the strap in the Devices dialog, and
+                //     persists its payload hex to UserDefaults for the next capture diff;
+                //   • the WRITE-ACK branches (R22 disable, ECG gate, Broadcast-HR gate), which read a
+                //     result code straight out of the frame for their transcripts.
+                // The exposure is a diagnostic that asserts something the strap never said — a real
+                // violation of "a diagnostic may only assert what it can attribute", but a reading, not
+                // a data path. Hardening them is a scope decision, not this change's.
+                //
                 // #592: the read-only extended-battery probe's COMMAND_RESPONSE — format + publish it for the
                 // Devices dialog (raw hex + payload triage + capture diff). Sibling of the #451 dump below.
                 if frame.count > 6, frame[6] == WhoopCommand.getExtendedBatteryInfo.rawValue {
@@ -6886,7 +6939,17 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                 // #695: WHOOP4 data-range reply — cmd byte @6. The 5/MG reply (puffin envelope, cmd @10) is
                 // handled in the 5/MG case below; both call handleDataRangeResponse so 5/MG now gets the same
                 // newest/oldest window (strapNewestTs / #547 backfill gate) + diagnostics it previously missed.
-                if frame.count > 6, frame[6] == WhoopCommand.getDataRange.rawValue {
+                //
+                // GATED ON THE FULL VERDICT, unlike the probe replies above, because this one has OFFLOAD
+                // effect: the newest/oldest words it yields become the plausibility window every drained
+                // record is checked against (#547). A damaged reply that narrows that window makes the
+                // real records of the same sync fall through it — the section then persists nothing, and
+                // is acknowledged anyway, which is the same permanent loss the integrity gate exists to
+                // stop. `parsed` is the single parse from the seam above; this costs one Bool, no reparse.
+                // The decision itself lives in `DataRange.acceptsReply` so a WhoopProtocol test can hold
+                // it — nothing compiles this seam, so a gate written only here is a gate nothing pins.
+                if DataRange.acceptsReply(frame, cmdOff: 6, opcode: WhoopCommand.getDataRange.rawValue,
+                                          verdictOK: parsed.ok) {
                     handleDataRangeResponse(frame, cmdOff: 6, feedsSync: true)
                 }
                 // Clock correlation runs in both live and backfill modes. Once established it
@@ -6922,7 +6985,10 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
             // timestamps are already real-unix seconds.) Live HR/battery still also come from the
             // standard 0x2A37 / 0x2A19 profiles handled above.
             if BLEManager.whoop5NotifyChars.contains(characteristic.uuid) {
-                for frame in reassembler.feed(bytes) {
+                // Same fold as the WHOOP 4.0 path above: byte runs dropped below the family minimum.
+                let completedFrames = reassembler.feed(bytes)
+                router.noteReassemblerDrops(reassembler.belowMinimumLengthDrops)
+                for frame in completedFrames {
                     let isOffload = backfilling && BLEManager.isOffloadFrame(frame, family: .whoop5)
                     noteWhoop5R22Telemetry(frame, duringOffload: isOffload)   // #174 deep-data telemetry
                     // Durable EVENT-frame log for deep-data research (#103) — BEFORE the offload
@@ -6940,6 +7006,10 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                         // Same policy as WHOOP4: historical offload frames are bulk sync traffic.
                         // Keep them out of the live UI parser during backfill and let Backfiller
                         // preserve/order/process them in the sliced drain.
+                        // Same tally hand-off as the WHOOP 4.0 loop, and for the same reason (D3):
+                        // the router counts rejections, so a frame that skips it would be invisible
+                        // to the counter the hardware run is judged on. One verdict, no parse.
+                        router.noteOffloadFrameVerdict(verifyFrame(frame, family: .whoop5))
                         armBackfillTimeout()
                         routeBackfillFrame(frame)
                         // A real-time double-tap / wrist gesture still fires during a 5/MG offload (which
@@ -6950,6 +7020,10 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                         continue
                     }
                     router.handle(frame: frame)
+                    // The same split as the WHOOP 4.0 loop above, and for the same reasons: the probe
+                    // dispatches below branch on a raw opcode compare; the ones that verify do it inside
+                    // their own decoder, the extended-battery / body-location probes and the write-ack
+                    // branches do not, and are recorded there as a standing risk rather than hardened.
                     // #592: a 5/MG extended-battery probe COMMAND_RESPONSE (puffin envelope: type @8, cmd
                     // @10). Format + publish it for the Devices dialog, exactly like the 4.0 path above.
                     if frame.count > 10, frame[8] == 0x24, frame[10] == WhoopCommand.getExtendedBatteryInfo.rawValue {
@@ -7003,7 +7077,14 @@ extension BLEManager: @preconcurrency CBPeripheralDelegate {
                     // the ECG records arrive under. `ecgProbeArmed` is false outside a user-initiated
                     // run, so this costs one Bool read on every other frame.
                     if ecgProbeArmed { noteEcgProbeFrame(frame) }
-                    if frame.count > 10, frame[8] == 0x24, frame[10] == WhoopCommand.getDataRange.rawValue {
+                    // Gated on the FULL verdict for the same reason as the 4.0 path: this reply sets the
+                    // window the offload judges its records against. The verdict is taken here rather
+                    // than threaded from the seam because the 5/MG loop hands the router raw bytes; a
+                    // data-range reply arrives once or twice per connection, so the parse is not a cost
+                    // on the frame flood.
+                    if frame.count > 10, frame[8] == 0x24,
+                       DataRange.acceptsReply(frame, cmdOff: 10, opcode: WhoopCommand.getDataRange.rawValue,
+                                              verdictOK: parseFrame(frame, family: .whoop5).ok) {
                         // feedsSync: false — #695 diagnostic-only on 5/MG: log the dump/backlog/newest/oldest so
                         // a strap log validates the decode, but DON'T feed strapNewestTs/backfill/state yet.
                         // Flip to true once a real 5.0/MG strap confirms the newest/oldest are correct.
diff --git a/Strand/BLE/FrameRouter.swift b/Strand/BLE/FrameRouter.swift
index ee8d7acf3d..2183dafd9c 100644
--- a/Strand/BLE/FrameRouter.swift
+++ b/Strand/BLE/FrameRouter.swift
@@ -31,9 +31,22 @@ public final class FrameRouter {
         // #900: a fresh connection is a fresh capture session — re-arm the per-command raw-frame dump so
         // each connect can re-capture the disputed COMMAND_RESPONSE prefix once. `family` is set fresh per
         // connection by BLEManager (connectCore), so this is the per-session reset hook.
-        didSet { rawDumpedRespCmds.removeAll(); loggedFirmwareGate = nil; deviceId = nil }
+        didSet {
+            rawDumpedRespCmds.removeAll(); loggedFirmwareGate = nil; deviceId = nil
+            rejectTally = FrameRejectTally(); loggedRejectReasons.removeAll()
+        }
     }
 
+    /// Rejected frames on this connection, per reason, plus the one named counter for the class that
+    /// used to pass the gates (payload CRC32 verified, envelope not). Reset per connection alongside the
+    /// other per-connection routing state, since that is the unit the readout is about.
+    public private(set) var rejectTally = FrameRejectTally()
+
+    /// Reasons already reported on this connection, so the Test Centre line is one per REASON rather
+    /// than one per frame: a noisy link rejects continuously, and a per-frame line would bury the
+    /// transition that carries the information.
+    private var loggedRejectReasons: Set<FrameRejectReason> = []
+
     /// #900: resp command names (e.g. "GET_BATTERY_LEVEL(26)") whose raw COMMAND_RESPONSE frame has already
     /// been dumped this connection. The provenance dump fires once per command per session so a 4.0's
     /// per-poll battery reads don't flood the strap log. Reset when `family` is set at connect.
@@ -64,9 +77,14 @@ public final class FrameRouter {
         assert(parsed == parseFrame(frame, family: family),
                "FrameRouter.handle: threaded ParsedFrame != fresh parse (#47 parse-once invariant)")
         #endif
-        guard parsed.ok else { return }
-        // Reject frames that failed their checksum — never let bad bytes drive state.
-        if parsed.crcOK == false { return }
+        // ONE gate, the verifier's FULL verdict: header checksum, payload CRC32 and structural length
+        // together. This used to be two steps — a parse-succeeded flag, then a separate payload-CRC
+        // check — and between them sat the class this change closes: a frame whose payload CRC32 is
+        // right while its header checksum or declared length is not. Never let bad bytes drive state.
+        guard parsed.ok else {
+            noteRejectedFrame(parsed)
+            return
+        }
 
         // #987: stamp frame liveness for the Connection readout's "last frame" row. A plain (non-
         // published, see LiveState) Int write, so the raw flood costs no re-renders here.
@@ -675,10 +693,72 @@ public final class FrameRouter {
     func mirrorStrapConsoleIfPresent(frame: [UInt8]) {
         guard frameTypeName(frame, family: family) == "CONSOLE_LOGS" else { return }
         let parsed = parseFrame(frame, family: family)
-        guard parsed.ok, parsed.crcOK != false else { return }
+        // The full verdict, in one step — the frame is parsed right here, so `ok` already covers the
+        // payload CRC32 the second condition used to check separately.
+        guard parsed.ok else { return }
         appendStrapConsole(parsed)
     }
 
+    /// Count one rejected frame and say something about it exactly once (D3).
+    ///
+    /// Two different visibility rules, on purpose:
+    ///
+    /// - The class where the payload CRC32 VERIFIED while the envelope did not is announced always-on,
+    ///   at its first sighting. It is the class that passed every gate before this change, it is what
+    ///   the hardware run's abort criterion reads, and it costs nothing on a link where it never
+    ///   happens — which is the whole point of leaving rare-event evidence unconditional.
+    /// - The ordinary per-connection detail sits behind the Test Centre's Connection domain, one line
+    ///   per REASON. A resync after a lost notification rejects frames routinely and always has; a line
+    ///   per frame would be noise, and the general per-reason counter is explicitly NOT the abort signal.
+    ///
+    /// Each line reports only what the parse result observed: the reason the verifier gave, and the
+    /// packet type the decoder actually read (a rejected frame keeps it).
+    private func noteRejectedFrame(_ parsed: ParsedFrame) {
+        let hadAdmittedClass = rejectTally.payloadCRCOKButEnvelopeRejected > 0
+        let reason = rejectTally.note(parsed)
+        if !hadAdmittedClass && rejectTally.payloadCRCOKButEnvelopeRejected > 0 {
+            state.append(log: "Frame rejected while its payload CRC32 verified "
+                         + "(reason=\(reason.rawValue), type=\(parsed.typeName), \(parsed.lenBytes) bytes) "
+                         + "— the frame class that reached live state before the integrity gate.")
+        }
+        if TestCentre.active(.connection), loggedRejectReasons.insert(reason).inserted {
+            state.append(log: "frameReject reason=\(reason.rawValue) type=\(parsed.typeName) "
+                         + "bytes=\(parsed.lenBytes)", domain: .connection)
+        }
+    }
+
+    /// Count an OFFLOAD frame's verdict on this connection (D3).
+    ///
+    /// The BLE seam routes a replayed history frame straight to the Backfiller, so `handle(parsed:frame:)`
+    /// — the only caller of `noteRejectedFrame` — never sees it. Without this the tally, and with it the
+    /// ONE counter the hardware run's abort criterion is read from, stays at zero during exactly the
+    /// traffic in which a wrongly-emptied and then acked section is a permanent loss. The verdict is
+    /// formed once at the seam and handed over here; nothing is parsed twice.
+    ///
+    /// The line reports only what the verifier observed. There is no packet type in it because nothing
+    /// decoded one on this path — naming the offload is what this evidence can attribute.
+    func noteOffloadFrameVerdict(_ check: FrameCheck) {
+        let hadAdmittedClass = rejectTally.payloadCRCOKButEnvelopeRejected > 0
+        let reason = rejectTally.note(check)
+        guard reason != .none else { return }
+        if !hadAdmittedClass && rejectTally.payloadCRCOKButEnvelopeRejected > 0 {
+            state.append(log: "Frame rejected while its payload CRC32 verified "
+                         + "(reason=\(reason.rawValue), during a history offload) "
+                         + "— the frame class that reached live state before the integrity gate.")
+        }
+        if TestCentre.active(.connection), loggedRejectReasons.insert(reason).inserted {
+            state.append(log: "frameReject reason=\(reason.rawValue) offload=true", domain: .connection)
+        }
+    }
+
+    /// Fold the reassembler's monotonic below-minimum drop count into this connection's tally, so a byte
+    /// run dropped before any parser saw it still shows up as a rejection with the reason
+    /// "belowMinimumLength" instead of vanishing. Idempotent — only the growth since the last call is
+    /// added, so the BLE seam can call it after every notification.
+    func noteReassemblerDrops(_ monotonicTotal: Int) {
+        rejectTally.absorbReassemblerDrops(monotonicTotal)
+    }
+
     /// The one place the strap's own narration reaches the log, so the live and offload paths cannot
     /// drift in what they emit. Capped at 300 characters to match the Kotlin twin exactly.
     private func appendStrapConsole(_ parsed: ParsedFrame) {
@@ -695,7 +775,9 @@ public final class FrameRouter {
         // anyway. Family-aware (WHOOP4 type @[4], 5/MG @[8]).
         guard frameTypeName(frame, family: family) == "EVENT" else { return }
         let parsed = parseFrame(frame, family: family)
-        guard parsed.ok, parsed.crcOK != false else { return }
+        // Same single gate as `handle`: a gesture changes worn state, so it may only come from an
+        // intact frame. `frameTypeName` is a type PEEK and says nothing about integrity.
+        guard parsed.ok else { return }
         guard parsed.typeName == "EVENT", let ev = parsed.parsed["event"]?.stringValue else { return }
         guard let ts = parsed.parsed["event_timestamp"]?.intValue, ts > 0 else { return }   // fail closed
         guard abs(now - ts) <= FrameRouter.liveGestureWindowSeconds else { return }
diff --git a/Strand/Collect/ClockCorrelation.swift b/Strand/Collect/ClockCorrelation.swift
index 9d16d366fa..9188ff61de 100644
--- a/Strand/Collect/ClockCorrelation.swift
+++ b/Strand/Collect/ClockCorrelation.swift
@@ -8,8 +8,19 @@ import WhoopStore
 /// No CoreBluetooth, no I/O — fully unit-testable.
 enum ClockCorrelation {
     /// Build a `ClockRef` from a decoded GET_CLOCK COMMAND_RESPONSE frame and the wall
-    /// time observed when the response arrived. Returns nil unless the frame parsed OK,
-    /// passed CRC, and carries a `clock` value.
+    /// time observed when the response arrived. Returns nil unless the frame is INTACT and carries a
+    /// `clock` value.
+    ///
+    /// `ok` is the verifier's full verdict — header checksum, payload CRC32 and structural length
+    /// together — so one condition now covers what the two-part check used to. The stake is why this
+    /// gate is worth stating plainly: the anchor set here converts every live device timestamp into wall
+    /// time, and until it is set the Collector and the Backfiller both hold their rows. An anchor taken
+    /// from a damaged frame does not block persistence, it timestamps everything wrongly, which is worse
+    /// — so an unverifiable frame leaves the anchor unset and the downstream storage blocked.
+    ///
+    /// The `crcOK` condition is kept for parse results that did not come from a fresh parse: a
+    /// `ParsedFrame` decoded from a capture written before the verdict widened carries the old constant
+    /// `ok: true` beside a false `crcOK`.
     static func clockRef(from parsed: ParsedFrame, wall: Int) -> ClockRef? {
         guard parsed.ok, parsed.crcOK != false,
               let device = parsed.parsed["clock"]?.intValue else { return nil }
diff --git a/StrandTests/AppTargetFrameCorpusIntegrityTests.swift b/StrandTests/AppTargetFrameCorpusIntegrityTests.swift
new file mode 100644
index 0000000000..1472af4b67
--- /dev/null
+++ b/StrandTests/AppTargetFrameCorpusIntegrityTests.swift
@@ -0,0 +1,74 @@
+import XCTest
+@testable import Strand
+import WhoopProtocol
+
+/// Scenario "Strukturelle Mindest- und Genaulänge je Gerätefamilie / Echte aufgezeichnete Rahmen
+/// bleiben gültig", for the app target's own frame corpus.
+///
+/// The app-target corpus is not a resource directory — `StrandTests/Resources/` holds only a
+/// capability table with no frame bytes. The real frames live as hex LITERALS inside three test files:
+/// `RawHistoryArchiveReplayTests` and `BackfillerSessionTallyTests` (three real WHOOP 4.0 v25 records,
+/// 84 bytes each) and `BatteryResultProvenanceDumpTests` (a real GET_BATTERY_LEVEL COMMAND_RESPONSE).
+/// They are repeated here on purpose: those files assert what the frames DECODE to, this one asserts
+/// that the tightened envelope rules still admit them at all. If a future change makes the verifier
+/// stricter than the hardware, this is the test that says so — the other three would fail with a
+/// decode error that reads like a decoder bug.
+///
+/// A tightened verifier that rejected any of these would mean real straps losing real records, which
+/// is a strictly worse outcome than the forgery the change prevents.
+final class AppTargetFrameCorpusIntegrityTests: XCTestCase {
+
+    private func bytes(_ s: String) -> [UInt8] {
+        var out = [UInt8](); out.reserveCapacity(s.count / 2); var i = s.startIndex
+        while i < s.endIndex { let j = s.index(i, offsetBy: 2)
+            out.append(UInt8(s[i..<j], radix: 16)!); i = j }
+        return out
+    }
+
+    /// Every WHOOP 4.0 frame literal in the app-target test corpus, with the file it is quoted from.
+    private var corpus: [(name: String, hex: String)] {
+        [
+            ("RawHistoryArchiveReplayTests / BackfillerSessionTallyTests v25 #1",
+             "aa50000c2f190013390000140d2b6a4075010068a2010032fdbcfd98fdd3fdccfd47ffb00366064f073e06c103d3016cffa2fc87fa2ffae5fdbe03140675060c0510012dff1bfec0018f3c500500010068dc8f44"),
+            ("RawHistoryArchiveReplayTests / BackfillerSessionTallyTests v25 #2",
+             "aa50000c2f190014390000150d2b6a487001003ab301008dfd6afdaffda9fdaffd68fddbfb0dfc09fd77fe89fe62febffec9fe91ff0bff81ff5fff3e00d600790078ff3dff4bff801d553c5005010000d7c016b3"),
+            ("RawHistoryArchiveReplayTests / BackfillerSessionTallyTests v25 #3",
+             "aa50000c2f190015390000160d2b6a586b01006d8f0100a3ff94ffc4ffbcffbeff22004a009400cb0048005d006b004400d700130115013301f20088001d0031ffd9fe5eff75ff0048933c50050001008bdf2c2c"),
+            ("BatteryResultProvenanceDumpTests GET_BATTERY_LEVEL response",
+             "aa0f00c324141a0000a9010000000052cd1a49"),
+        ]
+    }
+
+    func testEveryAppTargetFrameLiteralStillVerifies() {
+        XCTAssertEqual(corpus.count, 4, "the corpus is a fixed list; add here when a file gains a frame")
+        for entry in corpus {
+            let frame = bytes(entry.hex)
+            let check = verifyFrame(frame, family: .whoop4)
+            XCTAssertTrue(check.ok, "\(entry.name) must stay valid")
+            XCTAssertEqual(check.reason, .none, "\(entry.name) must be rejected for no reason at all")
+            XCTAssertEqual(check.crc8OK, true, "\(entry.name): header checksum")
+            XCTAssertEqual(check.crc32OK, true, "\(entry.name): payload CRC32")
+        }
+    }
+
+    /// The structural rules, spelled out on the same frames: each is at or above the family minimum
+    /// and its byte count equals exactly `declared length + 4`.
+    func testEveryAppTargetFrameLiteralIsExactlyItsDeclaredLength() {
+        for entry in corpus {
+            let frame = bytes(entry.hex)
+            XCTAssertGreaterThanOrEqual(frame.count, FrameLimits.whoop4MinimumFrameBytes, entry.name)
+            let declared = Int(frame[1]) | (Int(frame[2]) << 8)
+            XCTAssertEqual(frame.count, declared + 4, "\(entry.name): no trailing or missing bytes")
+        }
+    }
+
+    /// And they still parse to a positive verdict end to end, which is what every consumer gate reads.
+    func testEveryAppTargetFrameLiteralParsesIntact() {
+        for entry in corpus {
+            let parsed = parseFrame(bytes(entry.hex), family: .whoop4)
+            XCTAssertTrue(parsed.ok, "\(entry.name) must pass the gates the consumers apply")
+            XCTAssertTrue(parsed.isParsable, entry.name)
+            XCTAssertEqual(parsed.rejectReason, .none, entry.name)
+        }
+    }
+}
diff --git a/StrandTests/BackfillMetaForgeryTests.swift b/StrandTests/BackfillMetaForgeryTests.swift
new file mode 100644
index 0000000000..0a11982ad1
--- /dev/null
+++ b/StrandTests/BackfillMetaForgeryTests.swift
@@ -0,0 +1,180 @@
+import XCTest
+@testable import Strand
+import WhoopProtocol
+import WhoopStore
+
+/// Scenario "Zustandstreibende Tore fordern das volle Urteil / Verlaufs-Metadaten können nicht
+/// gefälscht werden", end to end through the offload state machine (E3): parser → history-metadata
+/// classifier → trim acknowledgement.
+///
+/// This is the P0 path of the whole change. A HISTORY_END the app acts on advances the trim cursor and
+/// acknowledges the strap, which frees the records it just sent. A frame that only LOOKS like one —
+/// a wrong header checksum, a declared length under the family minimum, a cut-off CRC32 trailer —
+/// must therefore reach neither the acknowledgement nor the chunk boundary.
+///
+/// Each frame is a protocol-correct HISTORY_END — built here, at the 25-byte size a real one has —
+/// broken in exactly ONE way, and every test asserts up front that the frame still decodes as a
+/// HISTORY_END. Without that precondition a passing test would only prove that unreadable bytes are
+/// unreadable.
+final class BackfillMetaForgeryTests: XCTestCase {
+
+    private final class NoopStore: BackfillStoreWriting {
+        @discardableResult
+        func insert(_ streams: Streams, deviceId: String) async throws
+            -> (hr: Int, rr: Int, events: Int, battery: Int,
+                spo2: Int, skinTemp: Int, resp: Int, gravity: Int) {
+            (streams.hr.count, streams.rr.count, 0, 0,
+             streams.spo2.count, streams.skinTemp.count, streams.resp.count, streams.gravity.count)
+        }
+        func enqueueRawBatch(_ meta: RawBatchMeta, frames: [[UInt8]]) async throws {}
+        func setCursor(_ name: String, _ value: Int) async throws {}
+        func cursor(_ name: String) async throws -> Int? { nil }
+    }
+
+    private func le32(_ v: UInt32) -> [UInt8] {
+        [UInt8(v & 0xFF), UInt8((v >> 8) & 0xFF), UInt8((v >> 16) & 0xFF), UInt8((v >> 24) & 0xFF)]
+    }
+
+    /// A protocol-correct WHOOP 4.0 HISTORY_END (METADATA, meta_type 2) carrying unix + trim cursor.
+    private func historyEndFrame(unix: UInt32 = 1_700_000_000, trim: UInt32 = 70_476) -> [UInt8] {
+        frameFromPayload(le32(unix) + [0, 0] + le32(0) + le32(trim), type: 49, seq: 0, cmd: 2)
+    }
+
+    /// Collects every trim acknowledgement the Backfiller issues. `@MainActor` because `Backfiller` is.
+    @MainActor private func makeBackfiller(_ acks: @escaping (UInt32) -> Void) -> Backfiller {
+        Backfiller(store: NoopStore(), deviceId: "test", ackTrim: { trim, _ in acks(trim) })
+    }
+
+    // MARK: - control: the intact frame does acknowledge
+
+    @MainActor func testAnIntactHistoryEndAcknowledgesTheTrim() async {
+        var acked: [UInt32] = []
+        let backfiller = makeBackfiller { acked.append($0) }
+        backfiller.begin(family: .whoop4)
+        await backfiller.ingest(historyEndFrame())
+        XCTAssertEqual(acked, [70_476], "control: a real HISTORY_END must still advance the offload")
+    }
+
+    // MARK: - a forged or damaged HISTORY_END acknowledges nothing
+
+    @MainActor func testAHistoryEndWithABrokenHeaderChecksumAcknowledgesNothing() async {
+        var frame = historyEndFrame()
+        frame[3] ^= 0xFF                                   // CRC-8 over the length field only
+        let parsed = parseFrame(frame, family: .whoop4)
+        XCTAssertEqual(parsed.crcOK, true, "precondition: the payload CRC32 still verifies")
+        XCTAssertEqual(parsed.parsed["meta_type"], .string("HISTORY_END(2)"),
+                       "precondition: it still decodes as a history end")
+        XCTAssertEqual(parsed.parsed["trim_cursor"]?.intValue, 70_476,
+                       "precondition: the trim cursor it carries is readable")
+
+        var acked: [UInt32] = []
+        let backfiller = makeBackfiller { acked.append($0) }
+        backfiller.begin(family: .whoop4)
+        await backfiller.ingest(frame)
+        XCTAssertTrue(acked.isEmpty,
+                      "acking on this frame frees records the strap would then delete, got \(acked)")
+    }
+
+    @MainActor func testAHistoryEndWithADeclaredLengthBelowTheMinimumAcknowledgesNothing() async {
+        var frame = historyEndFrame()
+        frame[1] = 6; frame[2] = 0                         // declared 6 → total 10, under the 11-byte floor
+        frame[3] = crc8(frame, 1, 3)                       // with a CORRECT checksum for that word
+        XCTAssertEqual(parseFrame(frame, family: .whoop4).rejectReason, .belowMinimumLength)
+
+        var acked: [UInt32] = []
+        let backfiller = makeBackfiller { acked.append($0) }
+        backfiller.begin(family: .whoop4)
+        await backfiller.ingest(frame)
+        XCTAssertTrue(acked.isEmpty, "got \(acked)")
+    }
+
+    @MainActor func testAHistoryEndWithATruncatedTrailerAcknowledgesNothing() async {
+        let frame = Array(historyEndFrame().dropLast(2))
+        let parsed = parseFrame(frame, family: .whoop4)
+        XCTAssertEqual(parsed.rejectReason, .lengthMismatch)
+        XCTAssertEqual(parsed.parsed["meta_type"], .string("HISTORY_END(2)"),
+                       "precondition: without the gate this frame WOULD read as a history end")
+
+        var acked: [UInt32] = []
+        let backfiller = makeBackfiller { acked.append($0) }
+        backfiller.begin(family: .whoop4)
+        await backfiller.ingest(frame)
+        XCTAssertTrue(acked.isEmpty, "got \(acked)")
+    }
+
+    @MainActor func testAHistoryEndWithTrailingBytesAcknowledgesNothing() async {
+        let frame = historyEndFrame() + [0x00, 0x00]
+        XCTAssertEqual(parseFrame(frame, family: .whoop4).rejectReason, .lengthMismatch)
+
+        var acked: [UInt32] = []
+        let backfiller = makeBackfiller { acked.append($0) }
+        backfiller.begin(family: .whoop4)
+        await backfiller.ingest(frame)
+        XCTAssertTrue(acked.isEmpty, "got \(acked)")
+    }
+
+    /// The other half of the forgery: HISTORY_COMPLETE ends the whole offload. A damaged one must not
+    /// close a session that is still mid-flight.
+    @MainActor func testADamagedHistoryCompleteDoesNotEndTheOffload() async {
+        var complete = frameFromPayload([], type: 49, seq: 0, cmd: 3)
+        complete[3] ^= 0xFF
+        XCTAssertEqual(parseFrame(complete, family: .whoop4).parsed["meta_type"],
+                       .string("HISTORY_COMPLETE(3)"), "precondition: it still decodes as complete")
+
+        let backfiller = makeBackfiller { _ in }
+        backfiller.begin(family: .whoop4)
+        XCTAssertTrue(backfiller.isBackfilling, "precondition: the session is open")
+        await backfiller.ingest(complete)
+        XCTAssertTrue(backfiller.isBackfilling, "a damaged HISTORY_COMPLETE must not close the session")
+
+        // Control: the same frame INTACT does close it, so the gate is what made the difference.
+        let control = makeBackfiller { _ in }
+        control.begin(family: .whoop4)
+        await control.ingest(frameFromPayload([], type: 49, seq: 0, cmd: 3))
+        XCTAssertFalse(control.isBackfilling)
+    }
+
+    // MARK: - the acknowledgement block is EXEMPT from the payload bound (D7, decision 4)
+
+    /// The eight bytes the trim acknowledgement mirrors back to the strap reach INTO the CRC32 trailer
+    /// by design: on the real 25-byte HISTORY_END the trailer starts at 21 and the block runs 17…25.
+    /// It is an opaque echo, not a decoded field, so the payload bound that now clamps every named
+    /// field must not touch it.
+    ///
+    /// This is the CALLER-side half of that exemption. The protocol package pins the slice itself; what
+    /// is pinned here is that the app's own reader still hands eight bytes to the ack. Clamped to the
+    /// trailer it would yield four, and the strap would be acknowledged with a block it never sent —
+    /// either it refuses the acknowledgement and the offload stops, or it trims on an altered block.
+    /// Both outcomes are the permanent data loss this whole change exists to prevent, arriving through
+    /// the fix rather than the bug.
+    func testTheWhoop4AcknowledgementBlockIsEightBytesAndReachesIntoTheTrailer() {
+        let frame = historyEndFrame()
+        XCTAssertEqual(frame.count, 25, "precondition: the real HISTORY_END size the exemption is about")
+        let declared = Int(frame[1]) | (Int(frame[2]) << 8)
+        XCTAssertEqual(declared, 21, "precondition: the CRC32 trailer starts at 21")
+
+        let endData = Backfiller.endData(from: frame, family: .whoop4)
+        XCTAssertEqual(endData?.count, 8, "eight bytes, not the four a trailer clamp would leave")
+        XCTAssertEqual(endData, Array(frame[17..<25]), "…and exactly the bytes at 17…25, unaltered")
+        XCTAssertNotEqual(endData, Array(frame[17..<21]) + [0, 0, 0, 0],
+                          "a clamped-then-padded block is not the same echo")
+    }
+
+    /// The 5/MG twin of the same slice (frame[21…29]), so a later tidy-up cannot narrow one family
+    /// while the other keeps working.
+    func testTheWhoop5AcknowledgementBlockIsAlsoEightBytes() {
+        let frame = puffinCommandFrame(cmd: 2, seq: 0,
+                                       payload: [UInt8](repeating: 7, count: 20), type: 49)
+        XCTAssertGreaterThanOrEqual(frame.count, 29, "precondition: long enough to hold the block")
+        let endData = Backfiller.endData(from: frame, family: .whoop5)
+        XCTAssertEqual(endData?.count, 8)
+        XCTAssertEqual(endData, Array(frame[21..<29]))
+    }
+
+    /// The guard the exemption does keep: a frame too short to hold the block yields nil rather than a
+    /// short read. Not-enough-bytes is a different answer from four-bytes-because-we-clamped.
+    func testAFrameTooShortForTheBlockYieldsNilRatherThanAShortRead() {
+        XCTAssertNil(Backfiller.endData(from: frameFromPayload([], type: 49, seq: 0, cmd: 2),
+                                        family: .whoop4))
+    }
+}
diff --git a/StrandTests/FrameIntegrityGateTests.swift b/StrandTests/FrameIntegrityGateTests.swift
new file mode 100644
index 0000000000..c313fe7c2e
--- /dev/null
+++ b/StrandTests/FrameIntegrityGateTests.swift
@@ -0,0 +1,297 @@
+import XCTest
+import StrandAnalytics
+import WhoopProtocol
+import WhoopStore
+@testable import Strand
+
+/// End-to-end, parser → consumer, for the state-driving gates this app owns (frame-integrity, E3):
+/// the frame router, the history-metadata classifier, the clock correlation and the data-range reply.
+///
+/// Every frame below is a real or protocol-correct frame broken in exactly ONE way — a corrupted
+/// header checksum, a declared length under the family minimum, a cut-off CRC32 trailer — so what the
+/// consumer refuses is attributable to a single cause. Each test asserts the PRECONDITION that the
+/// frame still decodes, because a gate that only ever sees unreadable bytes proves nothing.
+///
+/// `@MainActor`: `FrameRouter` and `LiveState` are main-actor types.
+@MainActor
+final class FrameIntegrityGateTests: XCTestCase {
+
+    private func bytes(_ s: String) -> [UInt8] {
+        var out = [UInt8](); out.reserveCapacity(s.count / 2); var i = s.startIndex
+        while i < s.endIndex { let j = s.index(i, offsetBy: 2)
+            out.append(UInt8(s[i..<j], radix: 16)!); i = j }
+        return out
+    }
+
+    /// The WHOOP 4.0 REALTIME_DATA frame the protocol package's own framing fixtures use (28 bytes,
+    /// HR 60) — header checksum and payload CRC32 both verify. Reused rather than invented so the gate
+    /// is exercised on the same bytes the decoder tests already pin.
+    private let realtimeHex = "aa1800ff28020f3de10128663c0000000000000000000000da855212"
+
+    /// The same frame with ONLY its CRC-8 header checksum broken. Its payload CRC32 still verifies —
+    /// this is precisely the class that reached live state before the integrity gate.
+    private func headerBroken() -> [UInt8] {
+        var f = bytes(realtimeHex); f[3] ^= 0xFF; return f
+    }
+
+    override func setUp() {
+        super.setUp()
+        UserDefaults.standard.removeObject(forKey: "testcentre.active.connection")
+        UserDefaults.standard.removeObject(forKey: "testcentre.active.master")
+    }
+
+    override func tearDown() {
+        UserDefaults.standard.removeObject(forKey: "testcentre.active.connection")
+        UserDefaults.standard.removeObject(forKey: "testcentre.active.master")
+        super.tearDown()
+    }
+
+    // MARK: - the router drives no state from a frame that is not intact
+
+    func testRouterRejectsABrokenHeaderChecksum() {
+        let frame = headerBroken()
+        let parsed = parseFrame(frame, family: .whoop4)
+        XCTAssertEqual(parsed.crcOK, true, "precondition: the payload CRC32 verifies")
+        XCTAssertEqual(parsed.parsed["heart_rate"]?.intValue, 60, "precondition: the HR still decodes")
+
+        let live = LiveState()
+        let router = FrameRouter(state: live)
+        router.handle(frame: frame)
+        XCTAssertNil(live.heartRate, "a frame that is not intact must not reach live state")
+        XCTAssertNil(live.lastFrameType, "…and must not be forwarded to any downstream consumer")
+    }
+
+    func testRouterAcceptsTheSameFrameIntact() {
+        let live = LiveState()
+        let router = FrameRouter(state: live)
+        router.handle(frame: bytes(realtimeHex))
+        XCTAssertEqual(live.heartRate, 60, "control: the untouched frame still drives live state")
+        XCTAssertEqual(live.lastFrameType, "REALTIME_DATA")
+    }
+
+    func testRouterRejectsADeclaredLengthBelowTheFamilyMinimum() {
+        var frame = bytes(realtimeHex)
+        frame[1] = 6; frame[2] = 0                       // declared 6 → total 10, under the 11-byte floor
+        frame[3] = crc8(frame, 1, 3)                     // with a CORRECT checksum for that length word
+        XCTAssertEqual(parseFrame(frame, family: .whoop4).rejectReason, .belowMinimumLength)
+
+        let live = LiveState()
+        FrameRouter(state: live).handle(frame: frame)
+        XCTAssertNil(live.heartRate)
+        XCTAssertNil(live.lastFrameType)
+    }
+
+    func testRouterRejectsATruncatedTrailer() {
+        let frame = Array(bytes(realtimeHex).dropLast(2))
+        let parsed = parseFrame(frame, family: .whoop4)
+        XCTAssertEqual(parsed.rejectReason, .lengthMismatch)
+        XCTAssertEqual(parsed.typeName, "REALTIME_DATA", "precondition: it still reads as a frame")
+
+        let live = LiveState()
+        FrameRouter(state: live).handle(frame: frame)
+        XCTAssertNil(live.heartRate)
+        XCTAssertNil(live.lastFrameType)
+    }
+
+    func testRouterRejectsTrailingBytes() {
+        let frame = bytes(realtimeHex) + [0x00]
+        XCTAssertEqual(parseFrame(frame, family: .whoop4).rejectReason, .lengthMismatch)
+        let live = LiveState()
+        FrameRouter(state: live).handle(frame: frame)
+        XCTAssertNil(live.heartRate)
+    }
+
+    // MARK: - what the router SAYS about a rejection (D3)
+
+    /// Rare-event evidence stays visible with every test mode OFF: the class that used to pass is the
+    /// one the hardware run's abort criterion reads, and it costs nothing on a link where it never
+    /// happens.
+    func testTheClassThatUsedToPassIsAnnouncedWithoutAnyTestMode() {
+        XCTAssertFalse(TestCentre.active(.connection))
+        let live = LiveState()
+        let router = FrameRouter(state: live)
+        router.handle(frame: headerBroken())
+        XCTAssertEqual(router.rejectTally.payloadCRCOKButEnvelopeRejected, 1)
+        XCTAssertEqual(router.rejectTally.count(.headerChecksumMismatch), 1)
+        XCTAssertTrue(live.log.contains { $0.contains("payload CRC32 verified") },
+                      "the always-on line must name the class: \(live.log)")
+        // Announced ONCE, at the first sighting — a noisy link must not repeat it per frame.
+        router.handle(frame: headerBroken())
+        XCTAssertEqual(live.log.filter { $0.contains("payload CRC32 verified") }.count, 1)
+        XCTAssertEqual(router.rejectTally.payloadCRCOKButEnvelopeRejected, 2, "…while the count keeps rising")
+    }
+
+    /// The ordinary per-connection detail is Test-Centre gated, and silent when the mode is off.
+    func testPerConnectionRejectDetailIsGatedBehindTheConnectionDomain() {
+        let live = LiveState()
+        let router = FrameRouter(state: live)
+        router.handle(frame: Array(bytes(realtimeHex).dropLast(2)))   // lengthMismatch, CRC32 unknown
+        XCTAssertTrue(live.taggedTail(domain: .connection).isEmpty,
+                      "mode off must emit zero tagged lines: \(live.taggedTail(domain: .connection))")
+
+        TestCentre.activate(.connection)
+        defer { TestCentre.deactivate(.connection) }
+        let live2 = LiveState()
+        let router2 = FrameRouter(state: live2)
+        router2.handle(frame: Array(bytes(realtimeHex).dropLast(2)))
+        let tagged = live2.taggedTail(domain: .connection)
+        XCTAssertEqual(tagged.count, 1, "one line per reason, got \(tagged)")
+        XCTAssertTrue(tagged[0].contains("frameReject reason=lengthMismatch"), tagged[0])
+        XCTAssertTrue(tagged[0].contains("type=REALTIME_DATA"),
+                      "a rejected frame keeps its packet type in the diagnosis: \(tagged[0])")
+        // One line per REASON, not per frame.
+        router2.handle(frame: Array(bytes(realtimeHex).dropLast(2)))
+        XCTAssertEqual(live2.taggedTail(domain: .connection).count, 1)
+    }
+
+    /// A byte run the reassembler drops never reaches the router at all; folding its monotonic counter
+    /// in is what keeps its disappearance visible.
+    func testReassemblerDropsAreFoldedIntoTheConnectionTally() {
+        let live = LiveState()
+        let router = FrameRouter(state: live)
+        let r = Reassembler(family: .whoop4)
+        let runt: [UInt8] = [0xAA, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]   // declares 8 total
+        let completed = r.feed(runt + bytes(realtimeHex))
+        router.noteReassemblerDrops(r.belowMinimumLengthDrops)
+        XCTAssertEqual(completed.count, 1, "the stream resyncs onto the real frame")
+        XCTAssertEqual(router.rejectTally.count(.belowMinimumLength), r.belowMinimumLengthDrops)
+        XCTAssertGreaterThan(r.belowMinimumLengthDrops, 0)
+    }
+
+    // MARK: - the clock correlation takes no anchor from a frame that is not intact (2.14)
+
+    /// A WHOOP 4.0 GET_CLOCK COMMAND_RESPONSE carrying a device clock value.
+    ///
+    /// The command byte must be the REAL `GET_CLOCK` opcode: the decoder only publishes `clock` when
+    /// the schema resolves `frame[6]` to `GET_CLOCK`, so a made-up opcode yields a frame that verifies
+    /// and parses but carries no anchor at all — a gate test written on one would pass while proving
+    /// nothing about the gate.
+    private func clockResponse() -> [UInt8] {
+        // [type 36][seq][cmd = GET_CLOCK][resp_seq][result][clock u32 LE]
+        frameFromPayload([0x0A, 0x01, 0x8F, 0x64, 0xE1, 0x01],
+                         type: 36, seq: 1, cmd: WhoopCommand.getClock.rawValue)
+    }
+
+    /// The helper is only meaningful if it really carries an anchor — pinned separately so a future
+    /// opcode change fails HERE, with the cause named, instead of quietly hollowing out the two gate
+    /// tests below into assertions that nil equals nil.
+    func testTheClockResponseHelperActuallyCarriesAClock() {
+        let parsed = parseFrame(clockResponse(), family: .whoop4)
+        XCTAssertEqual(parsed.typeName, "COMMAND_RESPONSE")
+        XCTAssertEqual(parsed.parsed["clock"]?.intValue, 31_548_559,
+                       "the helper must decode a clock, or the gate tests prove nothing")
+    }
+
+    func testClockRefIsTakenFromAnIntactResponse() {
+        let parsed = parseFrame(clockResponse(), family: .whoop4)
+        XCTAssertTrue(parsed.ok, "precondition: the response is intact")
+        XCTAssertNotNil(parsed.parsed["clock"]?.intValue, "precondition: it carries a clock")
+        XCTAssertNotNil(ClockCorrelation.clockRef(from: parsed, wall: 1_736_365_593),
+                        "control: the useful path still anchors")
+    }
+
+    func testClockRefIsNotTakenFromABrokenHeaderChecksum() {
+        var frame = clockResponse()
+        frame[3] ^= 0xFF
+        let parsed = parseFrame(frame, family: .whoop4)
+        XCTAssertEqual(parsed.crcOK, true, "precondition: only the header checksum is broken")
+        XCTAssertNotNil(parsed.parsed["clock"]?.intValue, "precondition: the clock value still decodes")
+        XCTAssertNil(ClockCorrelation.clockRef(from: parsed, wall: 1_736_365_593),
+                     "an anchor from a damaged frame mis-stamps every row that follows")
+    }
+
+    func testClockRefIsNotTakenFromADeclaredLengthBelowTheMinimum() {
+        var frame = clockResponse()
+        frame[1] = 6; frame[2] = 0
+        frame[3] = crc8(frame, 1, 3)
+        let parsed = parseFrame(frame, family: .whoop4)
+        XCTAssertEqual(parsed.rejectReason, .belowMinimumLength)
+        XCTAssertNil(ClockCorrelation.clockRef(from: parsed, wall: 1_736_365_593))
+    }
+
+    // MARK: - the data-range reply (2.15)
+
+    /// A protocol-correct WHOOP 4.0 GET_DATA_RANGE COMMAND_RESPONSE (built here, not captured): its
+    /// plausible-unix words are the window the offload judges every drained record against (#547).
+    private func dataRangeResponse() -> [UInt8] {
+        // The two-byte response header, a filler word, then the oldest and newest markers on the
+        // 4-byte grid the oldest-scan reads (frame[11] and frame[15]).
+        let payload: [UInt8] = [0x0A, 0x01, 0x00, 0x00,
+                                0x00, 0xF1, 0x53, 0x65,      // 1_700_000_000 LE
+                                0x70, 0xE1, 0x4C, 0x68]      // 1_749_868_912 LE
+        return frameFromPayload(payload, type: 36, seq: 1, cmd: WhoopCommand.getDataRange.rawValue)
+    }
+
+    func testTheDataRangeWindowIsReadFromAnIntactReply() {
+        let frame = dataRangeResponse()
+        XCTAssertTrue(parseFrame(frame, family: .whoop4).ok, "precondition: intact")
+        XCTAssertEqual(BLEManager.dataRangeOldestUnix(from: frame), 1_700_000_000)
+        XCTAssertEqual(BLEManager.dataRangeNewestUnix(from: frame, wallNowUnix: 1_760_000_000),
+                       1_749_868_912)
+    }
+
+    /// The gate the BLE seam applies before it hands this reply to `handleDataRangeResponse`: the
+    /// bytes still scan to a window, and that is exactly why the verdict has to be consulted. A reply
+    /// with a broken header checksum narrows the plausibility window, the sync's real records fall
+    /// through it, the section persists nothing — and is acknowledged anyway.
+    func testABrokenDataRangeReplyIsRefusedByTheVerdictTheSeamChecks() {
+        var frame = dataRangeResponse()
+        frame[3] ^= 0xFF
+        let parsed = parseFrame(frame, family: .whoop4)
+        XCTAssertFalse(parsed.ok, "the seam's condition is `parsed.ok`, and it must be false here")
+        XCTAssertEqual(parsed.rejectReason, .headerChecksumMismatch)
+        XCTAssertEqual(parsed.crcOK, true, "…even though the payload CRC32 verifies")
+        // The scan itself is byte-level and would happily answer — which is the point of the gate.
+        XCTAssertNotNil(BLEManager.dataRangeNewestUnix(from: frame, wallNowUnix: 1_760_000_000))
+    }
+
+    func testATruncatedDataRangeReplyIsRefusedByTheSameVerdict() {
+        let frame = Array(dataRangeResponse().dropLast(2))
+        XCTAssertFalse(parseFrame(frame, family: .whoop4).ok)
+        XCTAssertEqual(parseFrame(frame, family: .whoop4).rejectReason, .lengthMismatch)
+    }
+
+    // MARK: - the app's own direct call into the verifier (2.5, the fifth caller)
+
+    /// A 5/MG COMMAND_RESPONSE for one of the four ECG opcodes, in the puffin envelope the ECG probe's
+    /// frame triage reads: type @8, cmd @10, result code @12.
+    private func ecgProbeReply(result: UInt8 = 0x01) -> [UInt8] {
+        puffinCommandFrame(cmd: WhoopCommand.toggleLabradorFiltered.rawValue, seq: 1,
+                           payload: [0x42, result, 0x00, 0x00], type: 0x24)
+    }
+
+    /// `BLEManager.noteEcgProbeFrame` is the ONE place the app calls `verifyFrame` itself rather than
+    /// going through a parser, and D2 requires each of the five direct callers to have its useful path
+    /// shown intact under the tightened verifier. Here that path is: a well-formed reply verifies, and
+    /// the probe's own decoder reads the outcome the report will state.
+    func testTheEcgProbeGateStillAdmitsAWellFormedReply() {
+        let frame = ecgProbeReply()
+        XCTAssertTrue(verifyFrame(frame, family: .whoop5).ok,
+                      "the probe's gate is exactly this call; the useful path must stay open")
+        XCTAssertEqual(frame[8], 0x24, "precondition: the triage's COMMAND_RESPONSE type byte")
+        XCTAssertEqual(frame[10], WhoopCommand.toggleLabradorFiltered.rawValue,
+                       "precondition: the triage's opcode byte")
+        XCTAssertEqual(Whoop5EcgProbe.outcome(frame: frame), .success,
+                       "control: the outcome the probe would report from this reply")
+    }
+
+    /// And the other half of why that gate is there. The result byte of a damaged reply still decodes,
+    /// so without the verdict the probe would print the strongest claim it can make — a refusal or a
+    /// success — about a frame the strap may never have sent that way. Silence is the correct output.
+    func testTheEcgProbeGateRefusesADamagedReplyWhoseResultByteWouldStillDecode() {
+        var frame = ecgProbeReply(result: 0x00)          // 0 = FAILURE, the loudest verdict
+        frame[6] ^= 0xFF                                  // break only the CRC16 header checksum
+        let check = verifyFrame(frame, family: .whoop5)
+        XCTAssertFalse(check.ok, "the probe must read no byte of this frame")
+        XCTAssertEqual(check.reason, .headerChecksumMismatch)
+        XCTAssertEqual(check.crc32OK, true, "…while the payload CRC32 still verifies")
+        XCTAssertEqual(Whoop5EcgProbe.outcome(frame: frame), .failure,
+                       "the byte-level decode would happily answer — that is what the gate stops")
+    }
+
+    func testTheEcgProbeGateRefusesTrailingBytesAndTruncation() {
+        XCTAssertEqual(verifyFrame(ecgProbeReply() + [0x00], family: .whoop5).reason, .lengthMismatch)
+        XCTAssertEqual(verifyFrame(Array(ecgProbeReply().dropLast(2)), family: .whoop5).reason,
+                       .lengthMismatch)
+    }
+}
diff --git a/Tools/linux-capture/decode_features.py b/Tools/linux-capture/decode_features.py
index e77b16bc7d..0a81b80fd4 100644
--- a/Tools/linux-capture/decode_features.py
+++ b/Tools/linux-capture/decode_features.py
@@ -81,7 +81,11 @@ def rr_stats(rr):
 def feature_to_rows(rec):
     """Map a normalized decoded record -> {second, rr[], ppg[], event}. See module/spec for rules."""
     out = {"second": None, "rr": [], "ppg": [], "event": None}
-    if not rec.get("crc_ok", True):
+    # The gate is the decoder's FULL verdict (`frame.ok`: start-of-frame, minimum and exact length,
+    # header checksum and payload CRC32 together), not the payload CRC alone — a frame whose CRC32
+    # verifies but whose envelope does not is exactly the class that used to reach these tables. A
+    # record without a verdict is rejected, never assumed to pass.
+    if not rec.get("ok", False):
         return out
     p = rec.get("parsed") or {}
     itype = rec.get("inner_type")
@@ -190,11 +194,16 @@ def _flatten_fields(frame):
 def normalize_decode_record(raw, src_frame, device_id):
     """Adapt one whoop-decode --json object + its source frames row -> the normalized record dict.
 
-    whoop-decode emits {family, char, frame:{crcOK, seq, fields:[{name,value,cat,off},...]}}. We
-    flatten frame.fields (minus envelope/raw cats) into `parsed`, take crc from frame.crcOK, version
-    from the `hist_version` field (whoop4 historical has no such field and is always v24), take unix
-    from the decoded `unix` field (falling back to the source frames row), and inner_type from the
-    source frames row (id,hex,char,recv_ms,unix,hr,inner_type).
+    whoop-decode emits {family, char, frame:{ok, crcOK, rejectReason, seq,
+    fields:[{name,value,cat,off},...]}}. We flatten frame.fields (minus envelope/raw cats) into
+    `parsed`, take the integrity verdict from frame.ok, version from the `hist_version` field (whoop4
+    historical has no such field and is always v24), take unix from the decoded `unix` field (falling
+    back to the source frames row), and inner_type from the source frames row
+    (id,hex,char,recv_ms,unix,hr,inner_type).
+
+    `frame.ok` is the decoder's full verdict; `frame.crcOK` reports the payload CRC32 alone and is
+    therefore not the gate. A missing verdict yields False: absence of the field is a rejection, not
+    a pass. (`frame.rejectReason` names the cause and is available for diagnosis.)
     """
     raw = raw if isinstance(raw, dict) else {}
     frame = raw.get("frame") or {}
@@ -205,7 +214,7 @@ def normalize_decode_record(raw, src_frame, device_id):
     rr = (frame.get("parsed") or {}).get("rr_intervals")
     if rr is not None:
         parsed["rr_intervals"] = rr
-    crc_ok = bool(frame.get("crcOK", True))
+    ok = bool(frame.get("ok", False))
     version = parsed.get("hist_version")
     if version is None and raw.get("family") == "whoop4":
         version = 24
@@ -215,7 +224,7 @@ def normalize_decode_record(raw, src_frame, device_id):
     if unix is None:
         unix = src_frame[4]
     return {"device_id": device_id, "unix": unix, "inner_type": src_frame[6],
-            "version": version, "crc_ok": crc_ok, "parsed": parsed}
+            "version": version, "ok": ok, "parsed": parsed}
 
 
 def find_whoop_decode():
diff --git a/Tools/linux-capture/test_decode_features.py b/Tools/linux-capture/test_decode_features.py
index 07eb8b89ea..75b9af2122 100644
--- a/Tools/linux-capture/test_decode_features.py
+++ b/Tools/linux-capture/test_decode_features.py
@@ -70,9 +70,9 @@ def test_drops_nonpositive(self):
         self.assertEqual(df.rr_stats([0, -5, 600]), (1, 600.0, None))
 
 
-def _rec(inner_type, parsed, unix=1000, version=24, crc_ok=True, device_id=1):
+def _rec(inner_type, parsed, unix=1000, version=24, ok=True, device_id=1):
     return {"device_id": device_id, "unix": unix, "inner_type": inner_type,
-            "version": version, "crc_ok": crc_ok, "parsed": parsed}
+            "version": version, "ok": ok, "parsed": parsed}
 
 
 class FeatureToRowsTests(unittest.TestCase):
@@ -137,10 +137,23 @@ def test_event_numeric(self):
         self.assertEqual(out["event"]["kind"], "123")
         self.assertEqual(out["event"]["event_num"], 123)
 
-    def test_crc_invalid_skipped(self):
-        out = df.feature_to_rows(_rec(47, {"heart_rate": 95}, crc_ok=False))
+    def test_rejected_frame_skipped(self):
+        out = df.feature_to_rows(_rec(47, {"heart_rate": 95}, ok=False))
         self.assertEqual(out, {"second": None, "rr": [], "ppg": [], "event": None})
 
+    def test_missing_verdict_is_rejected_not_passed(self):
+        # A record that carries no verdict at all yields no rows: absence is a rejection, never a pass.
+        rec = _rec(47, {"heart_rate": 95})
+        del rec["ok"]
+        self.assertEqual(df.feature_to_rows(rec),
+                         {"second": None, "rr": [], "ppg": [], "event": None})
+
+    def test_rejected_event_frame_skipped(self):
+        # The verdict gates events too, not only the per-second data types.
+        out = df.feature_to_rows(_rec(48, {"event": "WRIST_ON", "event_timestamp": 1000},
+                                      unix=None, ok=False))
+        self.assertIsNone(out["event"])
+
     def test_no_unix_non_event_skipped(self):
         out = df.feature_to_rows(_rec(47, {"heart_rate": 95}, unix=None))
         self.assertIsNone(out["second"])
@@ -185,9 +198,9 @@ def test_coalesce_merges_partial_seconds(self):
         self.assertEqual(row[1], 0.5)    # merged in
 
 
-def _decoded(fields, crcOK=True, family="whoop5"):
+def _decoded(fields, crcOK=True, family="whoop5", ok=True):
     return {"family": family, "char": "x", "ts_ms": 0, "hr": None,
-            "frame": {"crcOK": crcOK, "seq": 1, "fields": fields}}
+            "frame": {"ok": ok, "crcOK": crcOK, "seq": 1, "fields": fields}}
 
 
 def _fld(name, value, cat):
@@ -211,12 +224,13 @@ def test_flattens_fields_dropping_envelope_and_raw(self):
         self.assertEqual(rec["unix"], 1700000000)
         self.assertEqual(rec["inner_type"], 47)
         self.assertEqual(rec["version"], 18)
-        self.assertTrue(rec["crc_ok"])
+        self.assertTrue(rec["ok"])
 
     def test_carries_rr_intervals_from_parsed(self):
         # The R-R array is parsed-only (per-interval values are rr[i] FIELDS, the array is not a field),
         # so normalize must carry frame.parsed["rr_intervals"] through or feat_rr/rmssd stay empty.
-        raw = {"family": "whoop5", "frame": {"crcOK": True, "fields": [_fld("rr_count", 2, "rr")],
+        raw = {"family": "whoop5", "frame": {"ok": True, "crcOK": True,
+                                             "fields": [_fld("rr_count", 2, "rr")],
                                              "parsed": {"rr_intervals": [602, 613]}}}
         src = (1, "aa", "fd4b0005", 0, 1700000000, None, 47)
         rec = df.normalize_decode_record(raw, src, 1)
@@ -225,7 +239,7 @@ def test_carries_rr_intervals_from_parsed(self):
     def test_realtime_type40_timestamp_supplies_unix_and_rr(self):
         # Realtime (type-40) frames have no frames.unix; the decoded `timestamp` field supplies it, and
         # the carried rr_intervals must flow into feat_rr (the realtime-capture path).
-        raw = {"family": "whoop5", "frame": {"crcOK": True,
+        raw = {"family": "whoop5", "frame": {"ok": True, "crcOK": True,
                "fields": [_fld("timestamp", 1781084150, "time"), _fld("rr_count", 1, "rr")],
                "parsed": {"timestamp": 1781084150, "rr_intervals": [963]}}}
         src = (1, "aa", "fd4b0005", 1781084150307, None, None, 40)   # frames.unix = None
@@ -233,10 +247,21 @@ def test_realtime_type40_timestamp_supplies_unix_and_rr(self):
         self.assertEqual(m["second"]["unix"], 1781084150)
         self.assertEqual(m["rr"], [{"unix": 1781084150, "idx": 0, "rr_ms": 963}])
 
-    def test_crcOK_false(self):
-        raw = _decoded([_fld("heart_rate", 90, "hr")], crcOK=False)
+    def test_verdict_false(self):
+        raw = _decoded([_fld("heart_rate", 90, "hr")], crcOK=False, ok=False)
+        src = (1, "aa", "c", 0, 100, None, 47)
+        self.assertFalse(df.normalize_decode_record(raw, src, 1)["ok"])
+
+    def test_payload_crc_ok_but_envelope_rejected(self):
+        # The class this gate is for: the payload CRC32 verifies, but the decoder's full verdict is
+        # negative (broken header checksum or a length that does not add up). `crcOK` alone would
+        # have let the frame through.
+        raw = _decoded([_fld("heart_rate", 90, "hr")], crcOK=True, ok=False)
         src = (1, "aa", "c", 0, 100, None, 47)
-        self.assertFalse(df.normalize_decode_record(raw, src, 1)["crc_ok"])
+        rec = df.normalize_decode_record(raw, src, 1)
+        self.assertFalse(rec["ok"])
+        self.assertEqual(df.feature_to_rows(rec),
+                         {"second": None, "rr": [], "ppg": [], "event": None})
 
     def test_whoop4_version_defaults_to_24(self):
         raw = _decoded([_fld("heart_rate", 110, "hr")], family="whoop4")  # no hist_version field
@@ -257,18 +282,24 @@ def test_unix_falls_back_to_source_when_decoder_lacks_it(self):
         src = (1, "aa", "c", 0, 555, None, 48)
         self.assertEqual(df.normalize_decode_record(raw, src, 1)["unix"], 555)
 
-    def test_missing_frame_is_empty_parsed_crc_true(self):
+    def test_missing_frame_is_empty_parsed_and_rejected(self):
         src = (1, "aa", "c", 0, 100, None, 47)
         rec = df.normalize_decode_record({}, src, 1)
         self.assertEqual(rec["parsed"], {})
-        self.assertTrue(rec["crc_ok"])
+        self.assertFalse(rec["ok"])
         self.assertIsNone(rec["version"])
 
+    def test_missing_verdict_field_is_rejected(self):
+        # An object whose frame carries no `ok` key at all: fail closed, do not assume a pass.
+        raw = {"family": "whoop5", "frame": {"crcOK": True, "fields": [_fld("heart_rate", 90, "hr")]}}
+        src = (1, "aa", "c", 0, 100, None, 47)
+        self.assertFalse(df.normalize_decode_record(raw, src, 1)["ok"])
+
 
-def _dec_obj(fields, family="whoop4", crcOK=True):
+def _dec_obj(fields, family="whoop4", crcOK=True, ok=True):
     """A whoop-decode --json object stub (real shape: values live in frame.fields)."""
     return {"family": family, "char": "x", "ts_ms": 0, "hr": None,
-            "frame": {"crcOK": crcOK, "seq": 1, "fields": fields}}
+            "frame": {"ok": ok, "crcOK": crcOK, "seq": 1, "fields": fields}}
 
 
 class _FakeDB:
@@ -329,6 +360,20 @@ def test_full_redecodes_from_zero(self):
         res = df.decode_new(fdb, 1, full=True, decode_fn=self._decoder)
         self.assertEqual(res["frames"], 3)               # full ignores the cursor
 
+    def test_rejected_frame_contributes_no_rows(self):
+        # End to end over the whole stage: a frame the decoder rejected (payload CRC fine, envelope
+        # not) writes nothing and counts as skipped, while its intact neighbour still lands.
+        fdb = self._db()
+        decoder = lambda records: [
+            _dec_obj([_fld("heart_rate", 95, "hr")], crcOK=True, ok=False),
+            _dec_obj([_fld("heart_rate", 96, "hr")]),
+            _dec_obj([_fld("meta_type", 3, "meta")]),
+        ]
+        res = df.decode_new(fdb, 1, decode_fn=decoder)
+        self.assertEqual(res["skipped"], 2)               # the rejected frame + the inner_type-49 one
+        rows = fdb.db.execute("SELECT unix, hr FROM feat_second").fetchall()
+        self.assertEqual(rows, [(1001, 96)])
+
     def test_decoder_count_mismatch_raises(self):
         fdb = self._db()   # 3 frames
         short = lambda records: [_dec_obj([_fld("heart_rate", 95, "hr")])]  # returns only 1
diff --git a/Tools/linux-capture/test_whoop_frame.py b/Tools/linux-capture/test_whoop_frame.py
index dfad726f85..4763efbb10 100644
--- a/Tools/linux-capture/test_whoop_frame.py
+++ b/Tools/linux-capture/test_whoop_frame.py
@@ -160,6 +160,71 @@ def test_build_history_ack_whoop4_shape_and_crc(self):
         self.assertTrue(wf.verify_whoop4_frame(ack))                    # ack is itself CRC-valid
 
 
+def _whoop4_frame_of_total(total: int) -> bytes:
+    """A structurally consistent WHOOP 4.0 frame of exactly `total` bytes: the declared length agrees
+    with the byte count, the CRC8 header checks out and the CRC32 trailer covers the inner bytes that
+    are left (none at all for the 8-byte case)."""
+    length = total - 4
+    len_bytes = bytes([length & 0xFF, (length >> 8) & 0xFF])
+    inner = (bytes([wf.COMMAND_TYPE, 0, wf.CMD_GET_BATTERY_LEVEL]) + bytes(8))[:total - 8]
+    trailer = wf.crc32(inner).to_bytes(4, "little")
+    return bytes([0xAA]) + len_bytes + bytes([wf.crc8(len_bytes)]) + inner + trailer
+
+
+def _whoop5_frame_of_total(total: int) -> bytes:
+    """The WHOOP 5.0/MG image of `_whoop4_frame_of_total`: declared length, CRC16 header and CRC32
+    trailer are all internally consistent, so only the size distinguishes the cases."""
+    decl = total - 8
+    head = bytes([0xAA, 0x01, decl & 0xFF, (decl >> 8) & 0xFF, 0x00, 0x00])
+    payload = (bytes([wf.COMMAND_TYPE, 0, 1, 0]) + bytes(8))[:total - 12]
+    return (head + wf.crc16_modbus(head).to_bytes(4, "little")[:2] + payload
+            + wf.crc32(payload).to_bytes(4, "little"))
+
+
+class MinimumFrameLengthTests(unittest.TestCase):
+    """The family minimums from WhoopProtocol's `FrameLimits` (11 bytes on WHOOP 4.0, 13 on 5.0/MG).
+
+    A frame below them is internally consistent — declared length, header checksum and a CRC32 over
+    zero payload bytes all agree — and was accepted before. It is rejected here so the verifiers of
+    this tool and of the protocol package answer the same question; the callers on the trim-ack path
+    already demand more bytes than this, so the effect is on the verifiers' other callers.
+    """
+
+    def test_whoop4_eight_byte_frame_is_rejected(self):
+        frame = _whoop4_frame_of_total(8)
+        self.assertEqual(len(frame), 8)
+        self.assertEqual(frame[3], wf.crc8(frame[1:3]))            # header checksum is correct
+        self.assertEqual(frame[4:8], wf.crc32(b"").to_bytes(4, "little"))   # CRC32 over no payload
+        self.assertFalse(wf.verify_whoop4_frame(frame))
+
+    def test_whoop4_below_minimum_is_rejected(self):
+        for total in (8, 9, 10):
+            with self.subTest(total=total):
+                self.assertFalse(wf.verify_whoop4_frame(_whoop4_frame_of_total(total)))
+
+    def test_whoop4_at_minimum_is_accepted(self):
+        frame = _whoop4_frame_of_total(11)
+        self.assertEqual(len(frame), 11)
+        self.assertTrue(wf.verify_whoop4_frame(frame))
+
+    def test_whoop5_twelve_byte_frame_is_rejected(self):
+        frame = _whoop5_frame_of_total(12)
+        self.assertEqual(len(frame), 12)
+        self.assertEqual(frame[6] | (frame[7] << 8), wf.crc16_modbus(frame[0:6]))
+        self.assertEqual(frame[8:12], wf.crc32(b"").to_bytes(4, "little"))
+        self.assertFalse(wf.verify_whoop5_frame(frame))
+
+    def test_whoop5_at_minimum_is_accepted(self):
+        frame = _whoop5_frame_of_total(13)
+        self.assertEqual(len(frame), 13)
+        self.assertTrue(wf.verify_whoop5_frame(frame))
+
+    def test_real_frames_stay_valid(self):
+        # The recorded frames are far above both bounds; raising the minimum must not touch them.
+        self.assertTrue(wf.verify_whoop5_frame(HistoryAckTests.HISTORY_END))
+        self.assertTrue(wf.verify_whoop4_frame(Whoop4HistoryAckTests.HISTORY_END))
+
+
 class ReassemblerTests(unittest.TestCase):
     def test_single_frame_across_fragments(self):
         hello = wf.WHOOP5_CLIENT_HELLO
diff --git a/Tools/linux-capture/whoop_frame.py b/Tools/linux-capture/whoop_frame.py
index 91d50a2244..a9b40671c1 100644
--- a/Tools/linux-capture/whoop_frame.py
+++ b/Tools/linux-capture/whoop_frame.py
@@ -263,14 +263,26 @@ def command_response_cmd(frame: bytes, family: str):
 WHOOP5_META_TRIM_OFF = 21
 WHOOP5_END_DATA_LEN = 8
 
+# Smallest well-formed frame per family, mirroring `FrameLimits` in the Swift WhoopProtocol package
+# (whoop4MinimumFrameBytes = 11, whoop5MinimumFrameBytes = 13). Below these, a byte run can still be
+# internally consistent while carrying next to no payload — at the smallest size its CRC32 covers no
+# payload byte at all — and both verifiers here used to accept it.
+#
+# On the trim-ack path itself this bound is not reachable: `history_end_data*` already requires 25 and
+# 29 bytes before it verifies anything. The bound is here so this tool's verifiers answer the same
+# question as the protocol package's, for their other callers.
+WHOOP4_MIN_FRAME_BYTES = 11
+WHOOP5_MIN_FRAME_BYTES = 13
+
 
 def verify_whoop5_frame(frame: bytes) -> bool:
-    """True if a WHOOP 5.0 frame's declared length, CRC16 header and CRC32 trailer all check out.
+    """True if a WHOOP 5.0 frame clears the family minimum and its declared length, CRC16 header and
+    CRC32 trailer all check out.
 
     The ack must only echo a genuine, intact HISTORY_END — CRC is the protocol's only integrity
     check, so a garbled BLE frame must never advance the strap's trim cursor.
     """
-    if len(frame) < 12 or frame[0] != 0xAA:
+    if len(frame) < WHOOP5_MIN_FRAME_BYTES or frame[0] != 0xAA:
         return False
     decl = frame[2] | (frame[3] << 8)
     total = decl + 8
@@ -327,12 +339,13 @@ def build_history_ack(end_data: bytes, seq: int = 0) -> bytes:
 
 
 def verify_whoop4_frame(frame: bytes) -> bool:
-    """True if a WHOOP 4.0 frame's declared length, CRC8 header and CRC32 trailer all check out.
+    """True if a WHOOP 4.0 frame clears the family minimum and its declared length, CRC8 header and
+    CRC32 trailer all check out.
 
     As on 5.0, the ack must only echo a genuine, intact HISTORY_END — CRC is the protocol's only
     integrity check, so a garbled BLE frame must never advance the strap's trim cursor.
     """
-    if len(frame) < 8 or frame[0] != 0xAA:
+    if len(frame) < WHOOP4_MIN_FRAME_BYTES or frame[0] != 0xAA:
         return False
     declared = frame[1] | (frame[2] << 8)
     total = declared + 4
diff --git a/android/app/src/main/java/com/noop/ble/FrameRejectTally.kt b/android/app/src/main/java/com/noop/ble/FrameRejectTally.kt
new file mode 100644
index 0000000000..dae024e738
--- /dev/null
+++ b/android/app/src/main/java/com/noop/ble/FrameRejectTally.kt
@@ -0,0 +1,143 @@
+package com.noop.ble
+
+import com.noop.protocol.FrameRejectReason
+import com.noop.protocol.ParsedFrame
+import com.noop.protocol.wireName
+
+/**
+ * Diagnosis for the frame-integrity gate: what a rejected frame still tells us, and how often each
+ * reason occurred on one connection. Kotlin twin of `FrameDiagnostics.swift` in `WhoopProtocol`.
+ *
+ * It lives beside the BLE client rather than in `com.noop.protocol` because the tally is a per-
+ * connection diagnostic of the link, not a property of the wire format — and because the one thing
+ * that must stay literally identical across the platforms is what it PRINTS, which is pinned by the
+ * tests below it, not by where the class sits.
+ *
+ * Naming note: Swift spells the named counter `payloadCRCOKButEnvelopeRejected`. This side follows the
+ * repository's established Kotlin twin casing (`crcOk` for Swift's `crcOK`, as `ParsedFrame` already
+ * does) for the PROPERTY, while the emitted strings are byte-identical to the Swift ones — the log
+ * line is the shared artefact a reader compares across two field reports, the identifier is not.
+ */
+
+/**
+ * Whether the decoder got a PACKET TYPE out of this frame — the parseability question, which is NOT
+ * the integrity question [ParsedFrame.ok] answers.
+ *
+ * The two used to be the same value, so every diagnostic surface that wanted "did this decode?" read
+ * `ok`. Now `ok` means "header checksum, payload CRC32 and structural length all agree", and reading
+ * it as parseability would blank the packet type of exactly the frames a capture exists to map: a
+ * frame with a flipped header byte still decodes its type, its sequence number and its fields, and
+ * losing that in the record is losing the evidence.
+ */
+val ParsedFrame.isParsable: Boolean
+    get() = typeName != UNPARSABLE_TYPE_NAME
+
+/** The placeholder type name both parsers use for a byte run they could not read at all. */
+const val UNPARSABLE_TYPE_NAME = "INVALID/FRAGMENT"
+
+/**
+ * True for the frame class that passed the gates BEFORE this change: the payload CRC32 verified, but
+ * the envelope did not — a wrong header checksum, a declared length below the family minimum, a
+ * truncated frame or one with trailing bytes.
+ *
+ * Read straight off the parse result; it needs no second verification, because both values are already
+ * on the frame the consumer was handed.
+ */
+val ParsedFrame.payloadCrcOkButEnvelopeRejected: Boolean
+    get() = !ok && crcOk == true
+
+/**
+ * Per-reason rejection counters for one connection, plus the ONE extra named counter the hardware run
+ * is read from.
+ *
+ * Why a plain per-reason count is not enough (D3): the abort criterion for the hardware run is a
+ * CONJUNCTION — "header checksum or length wrong WHILE the payload CRC32 verifies" — and no single
+ * reason bucket can express it. The length bucket in particular also collects the harmless resyncs
+ * after a lost notification, which were happening before this change too. So
+ * [payloadCrcOkButEnvelopeRejected] is counted separately; it is the class that used to pass, and thus
+ * the cleanest regression signal.
+ *
+ * Counted per reason only — NOT additionally per device family. A connection talks to exactly one
+ * strap, so a family dimension would be constant.
+ *
+ * A tally asserts only what it observed: an unverifiable payload CRC32 is counted as
+ * [FrameRejectReason.PAYLOAD_CRC_UNVERIFIABLE], never folded into
+ * [FrameRejectReason.PAYLOAD_CRC_MISMATCH]. "Could not be checked" is not "was wrong".
+ *
+ * Not thread-safe on its own: the BLE client mutates it only from the GATT binder thread that feeds
+ * the reassembler, and reads it on the same thread at teardown.
+ */
+class FrameRejectTally {
+
+    private val counts = HashMap<FrameRejectReason, Int>()
+
+    /** The named class from D3: envelope rejected while the payload CRC32 verified. */
+    var payloadCrcOkButEnvelopeRejected = 0
+        private set
+
+    /**
+     * The reassembler's monotonic drop count already folded into [FrameRejectReason.BELOW_MINIMUM_LENGTH],
+     * so repeated folds of the same counter cannot double-count.
+     */
+    private var absorbedReassemblerDrops = 0
+
+    /**
+     * Count one parse result. Intact frames are ignored, so this can sit on the frame path unguarded.
+     * Returns the reason recorded, or [FrameRejectReason.NONE] when the frame was intact and nothing
+     * was counted.
+     */
+    fun note(parsed: ParsedFrame): FrameRejectReason {
+        if (parsed.ok) return FrameRejectReason.NONE
+        val reason = parsed.rejectReason
+        counts[reason] = (counts[reason] ?: 0) + 1
+        if (parsed.payloadCrcOkButEnvelopeRejected) payloadCrcOkButEnvelopeRejected += 1
+        return reason
+    }
+
+    /**
+     * Fold a reassembler's [Reassembler.belowMinimumLengthDrops] into the
+     * [FrameRejectReason.BELOW_MINIMUM_LENGTH] bucket.
+     *
+     * A byte run the reassembler drops never reaches a parser — and never reaches the evidence-
+     * preserving reader either — so without this it would vanish with no trace at all. The argument is
+     * the reassembler's MONOTONIC total; only the growth since the last fold is added, so calling this
+     * once per notification is correct and idempotent.
+     */
+    fun absorbReassemblerDrops(monotonicTotal: Int) {
+        if (monotonicTotal <= absorbedReassemblerDrops) return
+        val reason = FrameRejectReason.BELOW_MINIMUM_LENGTH
+        counts[reason] = (counts[reason] ?: 0) + (monotonicTotal - absorbedReassemblerDrops)
+        absorbedReassemblerDrops = monotonicTotal
+    }
+
+    /** How often [reason] was recorded. */
+    fun count(reason: FrameRejectReason): Int = counts[reason] ?: 0
+
+    /** Every rejection counted, across all reasons. */
+    val totalRejected: Int
+        get() = counts.values.sum()
+
+    /**
+     * One line naming every reason that actually occurred, in a stable order, or null when nothing was
+     * rejected — a per-connection readout, so its caller gates it behind the Test Centre domain.
+     * Silence when there is nothing to report; no "0 rejections" line to read past.
+     *
+     * Byte-identical in shape to the Swift `FrameRejectTally.summaryLine()`, including the reasons'
+     * wire spellings, so the two platforms' strap logs can be read with one eye.
+     */
+    fun summaryLine(): String? {
+        if (totalRejected == 0) return null
+        val parts = FrameRejectReason.entries
+            .filter { it != FrameRejectReason.NONE && count(it) > 0 }
+            .joinToString(" ") { "${it.wireName}=${count(it)}" }
+        return "frameReject total=$totalRejected $parts" +
+            " payloadCRCOKButEnvelopeRejected=$payloadCrcOkButEnvelopeRejected"
+    }
+
+    /** Drop every count, for a fresh connection. */
+    fun reset() {
+        counts.clear()
+        payloadCrcOkButEnvelopeRejected = 0
+        absorbedReassemblerDrops = 0
+    }
+}
diff --git a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
index fdde88c4f4..cc5b5a3098 100644
--- a/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
+++ b/android/app/src/main/java/com/noop/ble/UnbondedOffloadProbe.kt
@@ -352,10 +352,22 @@ internal const val COMMAND_RESPONSE_TYPE_NAME = "COMMAND_RESPONSE"
 /**
  * Classify one parsed puffin frame as probe evidence.
  *
- * CRC-gated, and deliberately strict about it. A frame whose CRC does not verify is noise on a link we are
- * testing precisely because we do not know whether it is allowed to carry this traffic, and counting noise
- * as proof would let the probe conclude the opposite of the truth. `crcOk == null` (no CRC to check) is
- * not a pass either — [ok] alone is an envelope check.
+ * INTEGRITY-gated, and deliberately strict about it. A frame that does not verify is noise on a link we
+ * are testing precisely because we do not know whether it is allowed to carry this traffic, and counting
+ * noise as proof would let the probe conclude the opposite of the truth.
+ *
+ * WHAT [ok] NOW MEANS, and what that changed here. It used to say only "the envelope was well-formed"
+ * (start-of-frame present, minimum length) — which is why the separate `crcOk != true` condition carried
+ * the whole weight of the check, and why the sentence that used to stand here, "`ok` alone is an envelope
+ * check", was true. It is the verifier's FULL verdict now: header checksum, payload CRC32 and the exact
+ * declared length together. So `crcOk != true` no longer adds a rule; it is kept because it is the
+ * narrower statement of the two and a reader should not have to know that to trust the gate.
+ *
+ * The evidence effect DID change, in one direction only, and it is the direction the probe wants: a frame
+ * whose payload CRC32 verifies while its header checksum or declared length does not used to count as
+ * proof that the strap serves this link unbonded, and no longer does. That class is precisely what a
+ * confused or foreign transmitter on a shared channel produces, and the probe's output is a claim about
+ * the STRAP. Nothing that verified before stops counting: an intact frame satisfies both spellings.
  */
 internal fun unbondedProbeEvidenceOf(
     ok: Boolean,
diff --git a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
index dbaeaa0e4e..c068853602 100644
--- a/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
+++ b/android/app/src/main/java/com/noop/ble/WhoopBleClient.kt
@@ -40,6 +40,7 @@ import com.noop.protocol.DYN_ACCEL_STILL_THRESHOLD_G
 import com.noop.protocol.BackfillCaptureJsonl
 import com.noop.protocol.BackfillCaptureRecord
 import com.noop.protocol.BackfillCaptureSummary
+import com.noop.protocol.wireName
 import com.noop.protocol.CommandNumber
 import com.noop.protocol.FeatureFlagWriteGate
 import com.noop.protocol.R22DisableReport
@@ -6689,6 +6690,9 @@ class WhoopBleClient(
                     // #1809: this link's inbound tally starts empty, so the epitaph on disconnect reports
                     // exactly what arrived on THIS link and never a previous session's traffic.
                     inboundFrames = 0; inboundBytes = 0; cmdChannelFrames = 0
+                    // Same guarantee for the rejection tally: a link that opens without a preceding clean
+                    // teardown would otherwise report the previous link's rejections as its own.
+                    rejectTally.reset(); loggedRejectReasons.clear()
                     // #1635: same guarantee for the banked tally. Clearing only on teardown would be enough if
                     // every link ended in one; a link that begins without a preceding clean teardown would
                     // otherwise open holding the previous link's rows and report them as banked on this one.
@@ -7259,6 +7263,21 @@ class WhoopBleClient(
     private var inboundBytes = 0
     private var cmdChannelFrames = 0
 
+    /**
+     * Frames this link REJECTED, per reason, plus the one named counter for the class that used to pass
+     * the gates (payload CRC32 verified, envelope not). Per CONNECTION, because that is the unit the
+     * readout is about; cleared with the inbound tally at connect and at teardown. Twin of the Swift
+     * `FrameRouter.rejectTally`.
+     */
+    private val rejectTally = FrameRejectTally()
+
+    /**
+     * Reasons already reported on this connection, so the Test Centre line is one per REASON rather than
+     * one per frame: a noisy link rejects continuously, and a per-frame line would bury the transition
+     * that carries the information.
+     */
+    private val loggedRejectReasons = HashSet<com.noop.protocol.FrameRejectReason>()
+
     // #1635: rows ACCEPTED on this link, split by PATH. The realtime decoder (`extractStreams`) only
     // ever produces hr/rr/events/battery; gravity, resp, skinTemp, spo2 and steps arrive solely through
     // the offload's historical decoder. Counting one path and naming streams from the other printed a
@@ -7374,7 +7393,15 @@ class WhoopBleClient(
                 uuid in WHOOP5_NOTIFY_CHARS -> {
                 // Reassemble (no-op for already-complete frames) then route each complete frame.
                 // Port of: for frame in reassembler.feed(bytes) { router.handle(frame:) }.
-                for (frame in reassembler.feed(bytes)) {
+                //
+                // A byte run whose declared total is below the family minimum is dropped INSIDE the
+                // reassembler and reaches no parser and no archive, so its monotonic drop count is folded
+                // into the connection's reject tally right after the feed that may have grown it —
+                // otherwise it would disappear without trace. Idempotent, so once per notification is
+                // both correct and cheap. Twin of the Swift `router.noteReassemblerDrops`.
+                val completedFrames = reassembler.feed(bytes)
+                rejectTally.absorbReassemblerDrops(reassembler.belowMinimumLengthDrops)
+                for (frame in completedFrames) {
                   // #453 defense-in-depth: this loop runs on the GATT binder thread; an uncaught throw
                   // from ANY frame op (handleFrame, a decoder, the inline date-format, log) would crash
                   // the whole app — the exact chain the redactPii bug escaped through. Wrap the whole
@@ -7506,6 +7533,18 @@ class WhoopBleClient(
                             handleBroadcastHrGateReadBack(frame, connectedFamily == DeviceFamily.WHOOP5)
                         }
                     }
+                    // WHAT IS AND IS NOT GATED HERE (standing risk, recorded rather than fixed).
+                    // Every other branch in this dispatch block keys on a RAW BYTE COMPARE of the command
+                    // opcode, before any integrity verdict, and that is unchanged: the state-driving
+                    // consumers are gated (the router above, the history-metadata classifier, both
+                    // extractors and this reply), and this change does not claim "every frame consumer".
+                    // Of the probe replies dispatched above, the feature-flag probe and the device-config
+                    // READ probe verify inside their own decoder (`Framing.frameCrcOk`); the extended-
+                    // battery (#592), body-location (#690) and battery-pack probes and the write-ack
+                    // branches do NOT, and stay that way — none drives live state or the offload. The
+                    // exposure there is a diagnostic asserting something the strap never said: a real
+                    // violation of "a diagnostic may only assert what it can attribute", but a reading,
+                    // not a data path. Hardening them is a scope decision, not this change's.
                     if (frame.size > cmdOff && (frame[cmdOff].toInt() and 0xFF) == CommandNumber.GET_DATA_RANGE.rawValue) {
                         // #451: dump raw GET_DATA_RANGE response bytes unconditionally (even if decode returns
                         // null) so a stale/wrong-epoch "newest" can be told apart from a frame-alignment bug in
@@ -7536,7 +7575,31 @@ class WhoopBleClient(
                                 )
                             }
                         }
-                        dataRangeNewestUnix(frame)?.let {
+                        // GATED ON THE FULL VERDICT from here down, unlike the probe replies above,
+                        // because this one has OFFLOAD effect: the newest/oldest words it yields become
+                        // the plausibility window every drained record is checked against (#547). A
+                        // damaged reply that narrows that window makes the real records of the same sync
+                        // fall through it — the section then persists nothing, and is acknowledged
+                        // anyway, which is the same permanent loss the integrity gate exists to stop.
+                        // `parsed` is the single parse from the seam above, so this costs one Boolean
+                        // read and no re-parse. Twin of the Swift BLEManager `handleDataRangeResponse`
+                        // gate; the raw dump and the #689 backlog line ABOVE stay ungated on purpose,
+                        // because a damaged range reply is exactly the event a strap log needs to show,
+                        // and neither of them touches sync state.
+                        // The decision itself lives in `DataRange.acceptsReply`, the twin of the Swift
+                        // predicate, so a unit test can hold the gate instead of only the parse.
+                        val acceptsWindow = com.noop.protocol.DataRange.acceptsReply(
+                            frame, cmdOff, CommandNumber.GET_DATA_RANGE.rawValue,
+                        ) { parsed.ok }
+                        if (!acceptsWindow) {
+                            log(
+                                "Get Data Range reply REJECTED by the frame-integrity check " +
+                                    "(reason=${parsed.rejectReason.wireName}) — the strap's banked-record " +
+                                    "window is left unchanged (#547 plausibility bounds keep their previous " +
+                                    "values). The raw frame above is the evidence.",
+                            )
+                        }
+                        (if (acceptsWindow) dataRangeNewestUnix(frame) else null)?.let {
                             strapNewestTs = it
                             // Capture the wall clock of THIS reading so the backfiller correlation pairs
                             // the strap's device time with the wall time of the same instant (see field doc).
@@ -7724,6 +7787,43 @@ class WhoopBleClient(
         }
     }
 
+    /**
+     * Count one rejected frame and say something about it exactly once (D3).
+     *
+     * Two different visibility rules, on purpose:
+     *
+     *  - The class where the payload CRC32 VERIFIED while the envelope did not is announced always-on,
+     *    at its first sighting. It is the class that passed every gate before this change, it is what
+     *    the hardware run's abort criterion reads, and it costs nothing on a link where it never
+     *    happens — which is the whole point of leaving rare-event evidence unconditional.
+     *  - The ordinary per-connection detail sits behind the Test Centre's Connection domain, one line
+     *    per REASON. A resync after a lost notification rejects frames routinely and always has; a line
+     *    per frame would be noise, and the general per-reason counter is explicitly NOT the abort signal.
+     *
+     * Each line reports only what the parse result observed: the reason the verifier gave, and the
+     * packet type the decoder actually read (a rejected frame keeps it). Twin of the Swift
+     * `FrameRouter.noteRejectedFrame`.
+     */
+    private fun noteRejectedFrame(parsed: com.noop.protocol.ParsedFrame) {
+        val hadAdmittedClass = rejectTally.payloadCrcOkButEnvelopeRejected > 0
+        val reason = rejectTally.note(parsed)
+        if (!hadAdmittedClass && rejectTally.payloadCrcOkButEnvelopeRejected > 0) {
+            log(
+                "Frame rejected while its payload CRC32 verified " +
+                    "(reason=${reason.wireName}, type=${parsed.typeName}) — the frame class that " +
+                    "reached live state before the integrity gate.",
+            )
+        }
+        if (testCentre.active(com.noop.testcentre.TestDomain.CONNECTION) &&
+            loggedRejectReasons.add(reason)
+        ) {
+            log(
+                "frameReject reason=${reason.wireName} type=${parsed.typeName}",
+                com.noop.testcentre.TestDomain.CONNECTION,
+            )
+        }
+    }
+
     /**
      * Pure decode→state router for one COMPLETE frame.
      * Direct port of `FrameRouter.handle(frame:)`.
@@ -7737,9 +7837,15 @@ class WhoopBleClient(
      *  instead of twice (this router path + the live-collector flush). `frame` is still passed for the
      *  byte-level sub-decoders. */
     private fun handleFrame(frame: ByteArray, parsed: com.noop.protocol.ParsedFrame, replayedOffload: Boolean = false) {
-        if (!parsed.ok) return
-        // Reject frames that failed their checksum — never let bad bytes drive state.
-        if (parsed.crcOk == false) return
+        // ONE gate, the verifier's FULL verdict: header checksum, payload CRC32 and structural length
+        // together. This used to be two steps — a parse-succeeded flag, then a separate payload-CRC
+        // check — and between them sat the class this change closes: a frame whose payload CRC32 is
+        // right while its header checksum or declared length is not. Never let bad bytes drive state.
+        // Twin of the Swift `FrameRouter.handle`.
+        if (!parsed.ok) {
+            noteRejectedFrame(parsed)
+            return
+        }
 
         // Connection test mode: accumulate frames by type and flush ONE `frameTiming` SUMMARY line per
         // rolling window (#1151), instead of a line per frame-TYPE transition — during offloads/command
@@ -9734,7 +9840,12 @@ class WhoopBleClient(
         val now = (System.currentTimeMillis() / 1000L).toInt()
         val parsed = frames.map { it.second }   // #47: the dispatcher already decoded these — don't re-parse
         val newestRealtimeTs = parsed.asSequence()
-            .filter { it.ok && it.crcOk != false && it.typeName == "REALTIME_DATA" }
+            // The FULL verdict in one condition. `crcOk != false` used to sit beside it and was the
+            // loose half: it passed a frame whose CRC32 could not be computed at all, and said nothing
+            // about the header checksum or the declared length. `ok` now covers all three, so a frame
+            // with a forged timestamp cannot become the anchor this whole batch of live HR is stamped
+            // against.
+            .filter { it.ok && it.typeName == "REALTIME_DATA" }
             .mapNotNull { (it.parsed["timestamp"] as? Number)?.toInt() }
             .maxOrNull() ?: now
         val streams: Streams = extractStreams(parsed, deviceClockRef = newestRealtimeTs, wallClockRef = now)
@@ -10737,9 +10848,18 @@ class WhoopBleClient(
                 offloadSkinTemp = offloadSkinTemp.get(), offloadSpo2 = offloadSpo2.get(),
                 offloadSteps = offloadSteps.get(),
             ), com.noop.testcentre.TestDomain.CONNECTION)
+            // Frames this link REJECTED, per reason. A per-connection readout, so it sits behind the
+            // Test Centre's Connection domain (D3) — a resync after a lost notification rejects frames
+            // routinely and always did, and that number is explicitly NOT the signal to act on. The one
+            // that is (payload CRC32 verified, envelope not) announces itself when it happens, whether
+            // or not any test mode is on. Silent when the link rejected nothing.
+            if (testCentre.active(com.noop.testcentre.TestDomain.CONNECTION)) {
+                rejectTally.summaryLine()?.let { log(it, com.noop.testcentre.TestDomain.CONNECTION) }
+            }
         }
         // Clear the tally with the link, so a second teardown for the same drop cannot re-report it.
         inboundFrames = 0; inboundBytes = 0; cmdChannelFrames = 0
+        rejectTally.reset(); loggedRejectReasons.clear()
         liveHr.set(0); liveRr.set(0); offloadHr.set(0); offloadRr.set(0)
         offloadGravity.set(0); offloadResp.set(0); offloadSkinTemp.set(0)
         offloadSpo2.set(0); offloadSteps.set(0); offloadChunks.set(0)
@@ -11292,7 +11412,13 @@ class WhoopBleClient(
         val w = captureWriter ?: return
         runCatching {
             val parsed = Framing.parseFrame(frame, connectedFamily)
-            captureSummary.record(parsed.typeName, parsed.crcOk, frame.size, characteristic, frame.toHex())
+            // PARSEABILITY, not integrity: the type the decoder read is kept whatever the verdict was,
+            // because a capture exists to map frames nothing else can read. The verdict travels beside
+            // it as the reject reason.
+            captureSummary.record(
+                parsed.typeName, parsed.crcOk, frame.size, characteristic, frame.toHex(),
+                parsed.rejectReason,
+            )
             val line = BackfillCaptureJsonl.encode(
                 BackfillCaptureRecord(
                     capturedAtMs = System.currentTimeMillis(),
@@ -11304,6 +11430,7 @@ class WhoopBleClient(
                     size = frame.size,
                     parsed = parsed.parsed,
                     hex = frame.toHex(),
+                    rejectReason = parsed.rejectReason,
                 ),
             )
             var checkBytes = false
diff --git a/android/app/src/main/java/com/noop/protocol/BackfillCaptureJsonl.kt b/android/app/src/main/java/com/noop/protocol/BackfillCaptureJsonl.kt
index fe43448fa3..d65918ea9f 100644
--- a/android/app/src/main/java/com/noop/protocol/BackfillCaptureJsonl.kt
+++ b/android/app/src/main/java/com/noop/protocol/BackfillCaptureJsonl.kt
@@ -1,15 +1,48 @@
 package com.noop.protocol
 
+/**
+ * The export spelling of a [FrameRejectReason], identical to the Swift enum's `rawValue`.
+ *
+ * The capture files and the strap-log readouts of the two platforms are read side by side by whoever
+ * is mapping an unknown frame, so the reason has to READ the same on both — the Kotlin identifier
+ * follows Kotlin's enum convention, the wire form follows Swift's. Defined here, next to the export
+ * record, because this is where the export form lives; the BLE-side tally reads it from here rather
+ * than keeping a second copy that could drift.
+ */
+val FrameRejectReason.wireName: String
+    get() = when (this) {
+        FrameRejectReason.NONE -> "none"
+        FrameRejectReason.NO_START_OF_FRAME -> "noStartOfFrame"
+        FrameRejectReason.BELOW_MINIMUM_LENGTH -> "belowMinimumLength"
+        FrameRejectReason.LENGTH_MISMATCH -> "lengthMismatch"
+        FrameRejectReason.HEADER_CHECKSUM_MISMATCH -> "headerChecksumMismatch"
+        FrameRejectReason.PAYLOAD_CRC_MISMATCH -> "payloadCRCMismatch"
+        FrameRejectReason.PAYLOAD_CRC_UNVERIFIABLE -> "payloadCRCUnverifiable"
+    }
+
 data class BackfillCaptureRecord(
     val capturedAtMs: Long,
     val sessionId: String,
     val characteristic: String,
+    /**
+     * The decoded packet type — kept even for a frame the verifier REJECTED. That is the point of a
+     * capture: an unmapped or corrupted frame is precisely what a mapper wants to see, and blanking its
+     * type would throw away the one thing the decoder did learn. The cause lives in [rejectReason].
+     */
     val typeName: String,
     val crcOk: Boolean?,
     val offload: Boolean,
     val size: Int,
     val parsed: Map<String, Any?>,
     val hex: String,
+    /**
+     * Why the frame failed its integrity check; [FrameRejectReason.NONE] on an intact one. ADDITIVE in
+     * the strict sense: it is encoded as a new trailing key ONLY when there is a reason, so the line an
+     * intact frame produces is unchanged, and the default keeps existing constructions compiling. Twin
+     * of the Swift `PuffinCaptureRecord.rejectReason` / `reject_reason`, whose decoder reads an absent
+     * key as `none` for exactly the same reason.
+     */
+    val rejectReason: FrameRejectReason = FrameRejectReason.NONE,
 )
 
 object BackfillCaptureJsonl {
@@ -35,6 +68,18 @@ object BackfillCaptureJsonl {
             appendJsonValue(record.parsed)
             append(',')
             appendField("hex", record.hex)
+            // Only on a REJECTION, and only the reason the verifier actually reported. Two reasons for
+            // the omission rather than an unconditional `"reject_reason":"none"`:
+            //  - it keeps the line an intact frame produces byte-identical to the previous format, so
+            //    every existing reader and every pinned golden line keeps working unchanged; and
+            //  - "key absent ⇒ none" is exactly the Swift decoder's contract for this field
+            //    (`decodeIfPresent(...) ?? .none`), so a capture written here still reads there.
+            // A key printed on every line would also train the eye to skip the field, which is the
+            // opposite of why it exists.
+            if (record.rejectReason != FrameRejectReason.NONE) {
+                append(',')
+                appendField("reject_reason", record.rejectReason.wireName)
+            }
             append('}')
         }
 
diff --git a/android/app/src/main/java/com/noop/protocol/BackfillCaptureSummary.kt b/android/app/src/main/java/com/noop/protocol/BackfillCaptureSummary.kt
index 6ffffc5812..8ae614cafc 100644
--- a/android/app/src/main/java/com/noop/protocol/BackfillCaptureSummary.kt
+++ b/android/app/src/main/java/com/noop/protocol/BackfillCaptureSummary.kt
@@ -9,15 +9,32 @@ class BackfillCaptureSummary(
         val size: Int,
         val characteristic: String,
         val hex: String,
+        val rejectReason: FrameRejectReason,
     )
 
     private val counts = linkedMapOf<String, Int>()
     private val unknownSamples = ArrayList<UnknownSample>()
 
-    fun record(typeName: String, crcOk: Boolean?, size: Int, characteristic: String, hex: String) {
+    /**
+     * Record one captured frame. [typeName] is kept exactly as the decoder read it, including for a
+     * frame the verifier rejected — an unmapped type is what the summary exists to surface, and a
+     * damaged envelope is no reason to stop naming it.
+     *
+     * [rejectReason] is ADDITIVE and defaulted, so the existing call shape stays valid. It says why the
+     * sample was rejected, which is the difference between "this firmware has a type we cannot map" and
+     * "this sample is a corrupted copy of a type we already know" — indistinguishable from the hex alone.
+     */
+    fun record(
+        typeName: String,
+        crcOk: Boolean?,
+        size: Int,
+        characteristic: String,
+        hex: String,
+        rejectReason: FrameRejectReason = FrameRejectReason.NONE,
+    ) {
         counts[typeName] = (counts[typeName] ?: 0) + 1
         if (unknownSamples.size < maxUnknownSamples && isUnknownType(typeName)) {
-            unknownSamples += UnknownSample(typeName, crcOk, size, characteristic, hex)
+            unknownSamples += UnknownSample(typeName, crcOk, size, characteristic, hex, rejectReason)
         }
     }
 
@@ -35,7 +52,13 @@ class BackfillCaptureSummary(
             "none"
         } else {
             unknownSamples.joinToString("; ") {
-                "${it.typeName}(size=${it.size},char=${it.characteristic},crc=${it.crcOk},hex=${it.hex})"
+                // `reject=` appears only when the frame WAS rejected. An intact sample's line is
+                // unchanged, and a "reject=none" on every entry would train the eye to skip the field —
+                // the same rule the frame inspector's line follows.
+                val reject =
+                    if (it.rejectReason == FrameRejectReason.NONE) "" else "reject=${it.rejectReason.wireName},"
+                "${it.typeName}(size=${it.size},char=${it.characteristic},crc=${it.crcOk}," +
+                    "${reject}hex=${it.hex})"
             }
         }
 
diff --git a/android/app/src/main/java/com/noop/protocol/DataRange.kt b/android/app/src/main/java/com/noop/protocol/DataRange.kt
index a322926531..d0cf8402f0 100644
--- a/android/app/src/main/java/com/noop/protocol/DataRange.kt
+++ b/android/app/src/main/java/com/noop/protocol/DataRange.kt
@@ -98,6 +98,26 @@ object DataRange {
         return behind
     }
 
+    /**
+     * The BLE seam's decision on a GET_DATA_RANGE COMMAND_RESPONSE: is this a reply to [opcode], and may
+     * it move state? A reply is accepted only on the verifier's FULL verdict.
+     *
+     * This one reply does not merely report a timestamp: [newestUnix]/[oldestUnix] become the window every
+     * drained record of the same sync is checked against (#547). A damaged reply that narrows the window
+     * makes the real records fall through it — the section persists nothing and is acked anyway, which is
+     * the permanent loss the integrity gate exists to stop. So the gate belongs to this decision, not to
+     * the seam that happens to host it.
+     *
+     * [verdictOk] is the FULL verdict of the single parse the caller already holds, taken lazily so a frame
+     * that is not this reply costs one byte compare and no parse. The opcode is passed in rather than
+     * restated here: the command table lives with the caller. Mirrors Swift `DataRange.acceptsReply`.
+     */
+    fun acceptsReply(frame: ByteArray, cmdOff: Int, opcode: Int, verdictOk: () -> Boolean): Boolean {
+        if (cmdOff < 0 || cmdOff >= frame.size) return false
+        if ((frame[cmdOff].toInt() and 0xFF) != opcode) return false
+        return verdictOk()
+    }
+
     /**
      * True when a GET_DATA_RANGE COMMAND_RESPONSE is the `PENDING(2)` acknowledgement rather than the
      * answer. The strap replies twice: a short PENDING ack, then the payload with `SUCCESS(1)`. Framing's
diff --git a/android/app/src/main/java/com/noop/protocol/Framing.kt b/android/app/src/main/java/com/noop/protocol/Framing.kt
index 2fd505c74f..70c14032fa 100644
--- a/android/app/src/main/java/com/noop/protocol/Framing.kt
+++ b/android/app/src/main/java/com/noop/protocol/Framing.kt
@@ -21,20 +21,58 @@ package com.noop.protocol
  */
 
 // MARK: - little-endian readers (null when out of range; mirror interpreter._read)
+//
+// [limit] is the EXCLUSIVE upper bound for a NAMED INNER FIELD (D7): the minimum of where the CRC32
+// trailer starts and how many bytes the frame actually has. It is a required argument, not a
+// defaulted one, so adding a field read without deciding its bound does not compile. Callers derive
+// it with [payloadLimitOf], which never returns more than the frame size, so passing it is at least
+// as safe as the old size-only bound and never reads a byte that is not there.
+
+private fun ByteArray.u8(off: Int, limit: Int): Int? =
+    if (off >= 0 && off + 1 <= limit) this[off].toInt() and 0xFF else null
+
+private fun ByteArray.u16(off: Int, limit: Int): Int? =
+    if (off >= 0 && off + 2 <= limit) (this[off].toInt() and 0xFF) or ((this[off + 1].toInt() and 0xFF) shl 8)
+    else null
+
+private fun ByteArray.u32(off: Int, limit: Int): Long? {
+    if (off < 0 || off + 4 > limit) return null
+    return (this[off].toLong() and 0xFFL) or
+        ((this[off + 1].toLong() and 0xFFL) shl 8) or
+        ((this[off + 2].toLong() and 0xFFL) shl 16) or
+        ((this[off + 3].toLong() and 0xFFL) shl 24)
+}
 
-private fun ByteArray.u8(off: Int): Int? = if (off + 1 <= size) this[off].toInt() and 0xFF else null
-
-private fun ByteArray.u16(off: Int): Int? =
-    if (off + 2 <= size) (this[off].toInt() and 0xFF) or ((this[off + 1].toInt() and 0xFF) shl 8) else null
-
-private fun ByteArray.u32(off: Int): Long? {
-    if (off + 4 > size) return null
+/**
+ * The frame's OWN envelope words (declared length, CRC32 trailer) — bounded by the array itself, not
+ * by [payloadLimitOf]. These bytes are the envelope, never a decoded inner field, so D7 does not
+ * apply to them; keeping them on a separate reader is what stops a field read borrowing the wider
+ * bound by accident.
+ */
+private fun ByteArray.envU32(off: Int): Long? {
+    if (off < 0 || off + 4 > size) return null
     return (this[off].toLong() and 0xFFL) or
         ((this[off + 1].toLong() and 0xFFL) shl 8) or
         ((this[off + 2].toLong() and 0xFFL) shl 16) or
         ((this[off + 3].toLong() and 0xFFL) shl 24)
 }
 
+/**
+ * The exclusive upper bound for reading named inner fields out of [frame] (D7).
+ *
+ * It is the MINIMUM of the CRC32 trailer's start and the frame's real size — not one or the other.
+ * The trailer start follows from the DECLARED length, which on a truncated frame points past the
+ * last byte we hold, so using it alone would read off the end of the array; using only the frame
+ * size is what let a frame at the family minimum have its own checksum trailer decoded as a
+ * sequence number, a command byte or a metadata type. A field counts as present when its start plus
+ * its length does not EXCEED this bound: the smallest real WHOOP 4.0 history frame is 11 bytes with
+ * its trailer at 7, and its metadata type occupies precisely the last payload byte.
+ */
+private fun payloadLimitOf(frame: ByteArray, trailerStart: Int?): Int {
+    if (trailerStart == null) return frame.size
+    return minOf(maxOf(0, trailerStart), frame.size)
+}
+
 /**
  * Accumulate BLE notification fragments into complete frames.
  *
@@ -53,6 +91,15 @@ class Reassembler(private val family: DeviceFamily = DeviceFamily.WHOOP4) {
     private var head = 0   // index of the first byte not yet consumed
     private var tail = 0   // index one past the last valid byte
 
+    /**
+     * How many start-of-frame bytes were dropped because the total length they declared was below
+     * the family minimum. Such a byte run never reaches a parser, so without this counter it would
+     * vanish without trace — and one of the readers downstream exists to preserve exactly the frames
+     * nothing else can read. Monotonic for the lifetime of the reassembler; [reset] leaves it alone.
+     */
+    var belowMinimumLengthDrops = 0
+        private set
+
     /**
      * Drop any partial-frame remnant. Called on (re)connect so a stalled or garbage frame from one
      * session can't wedge the live stream in the next. The macOS BLEManager achieves the same by
@@ -88,6 +135,14 @@ class Reassembler(private val family: DeviceFamily = DeviceFamily.WHOOP4) {
             } else {
                 ((data[head + 1].toInt() and 0xFF) or ((data[head + 2].toInt() and 0xFF) shl 8)) + 4
             }
+            if (total < FrameLimits.minimumFrameBytes(family)) {
+                // A declared total below the family minimum cannot be a frame: emitting it would hand
+                // a parser a byte run whose "inner fields" are its own checksum trailer. Drop this
+                // 0xAA, count it, and resync on the next one — same shape as the ceiling below.
+                belowMinimumLengthDrops += 1
+                head += 1
+                continue
+            }
             if (total > MAX_FRAME_BYTES) {
                 // A corrupt or misaligned SOF decodes an impossibly large length and we'd wait forever
                 // for bytes that can never arrive over BLE — the live stream would freeze until a
@@ -145,12 +200,100 @@ class Reassembler(private val family: DeviceFamily = DeviceFamily.WHOOP4) {
     }
 }
 
-/** Outcome of validating a frame envelope and its CRCs. */
-private data class FrameCheck(
+/**
+ * Why a frame failed the envelope check — one value, never null, so a consumer can report the cause
+ * without verifying or parsing the frame a second time (the parse-once invariant).
+ *
+ * [NONE] is the ONLY value that accompanies a positive verdict. The two payload-CRC cases are kept
+ * apart on purpose: a diagnostic may only assert what it observed, and "we could not compute the
+ * CRC32" is not the same claim as "the CRC32 disagreed". Twin of the Swift `FrameRejectReason`,
+ * value for value (`none` → [NONE], `noStartOfFrame` → [NO_START_OF_FRAME], … ).
+ */
+enum class FrameRejectReason {
+    /** The frame is intact: header checksum, payload CRC32 and the structural length all agree. */
+    NONE,
+
+    /** No 0xAA start-of-frame byte — this byte run is not a frame at all. */
+    NO_START_OF_FRAME,
+
+    /** Fewer bytes than the device family's smallest well-formed frame can have. */
+    BELOW_MINIMUM_LENGTH,
+
+    /**
+     * The byte count does not equal the total derived from the declared length field: the frame is
+     * truncated, or it carries trailing bytes past its own end.
+     */
+    LENGTH_MISMATCH,
+
+    /** The header checksum (CRC-8 on WHOOP 4.0, CRC-16-Modbus on WHOOP 5.0/MG) disagreed. */
+    HEADER_CHECKSUM_MISMATCH,
+
+    /** The payload CRC32 was computed and disagreed. */
+    PAYLOAD_CRC_MISMATCH,
+
+    /**
+     * The payload CRC32 could not be computed at all. Fail-closed: an unverifiable CRC counts as a
+     * negative verdict, never as "unknown". The structural rules above make this unreachable for a
+     * frame that got past them, so it is defence in depth rather than an observed class.
+     */
+    PAYLOAD_CRC_UNVERIFIABLE,
+}
+
+/**
+ * The structural lower bounds a frame must clear before any of its bytes are read as fields.
+ *
+ * WHOOP 4.0: `[SOF][len u16][crc8][type][seq][cmd] + >=1 payload byte + [crc32 u32]` = 11 bytes.
+ * WHOOP 5.0/MG: `[SOF][fmt][declLen u16][hdr u16][crc16 u16] + >=1 payload byte + [crc32 u32]` = 13.
+ * The smallest real frame in the project's captures is exactly 11 bytes (WHOOP 4.0) and 124 bytes
+ * (WHOOP 5.0/MG), so neither bound rejects a recorded frame. Twin of the Swift `FrameLimits`.
+ */
+object FrameLimits {
+    const val WHOOP4_MINIMUM_FRAME_BYTES = 11
+    const val WHOOP5_MINIMUM_FRAME_BYTES = 13
+
+    /** The minimum total frame size for [family], in bytes. */
+    fun minimumFrameBytes(family: DeviceFamily): Int = when (family) {
+        DeviceFamily.WHOOP4 -> WHOOP4_MINIMUM_FRAME_BYTES
+        DeviceFamily.WHOOP5 -> WHOOP5_MINIMUM_FRAME_BYTES
+    }
+}
+
+/**
+ * Turn the individual outcomes into ONE verdict and ONE reason, in a fixed order: structure first
+ * (a length we cannot trust makes every later read meaningless), then the header checksum, then the
+ * payload CRC32. A null [crc32Ok] is a rejection, not an "unknown" that a consumer might read as a
+ * pass — that tri-state is exactly what let malformed frames drive live state before this change.
+ */
+private fun frameRejectReason(
+    totalFromLength: Int,
+    actualCount: Int,
+    minimumBytes: Int,
+    headerCrcOk: Boolean,
+    crc32Ok: Boolean?,
+): FrameRejectReason {
+    if (totalFromLength < minimumBytes) return FrameRejectReason.BELOW_MINIMUM_LENGTH
+    if (totalFromLength != actualCount) return FrameRejectReason.LENGTH_MISMATCH
+    if (!headerCrcOk) return FrameRejectReason.HEADER_CHECKSUM_MISMATCH
+    return when (crc32Ok) {
+        null -> FrameRejectReason.PAYLOAD_CRC_UNVERIFIABLE
+        false -> FrameRejectReason.PAYLOAD_CRC_MISMATCH
+        true -> FrameRejectReason.NONE
+    }
+}
+
+/**
+ * Outcome of validating a frame envelope and its CRCs.
+ *
+ * [ok] is the FULL verdict: start-of-frame, minimum length, exact length, header checksum and
+ * payload CRC32 together. It is true exactly when [reason] is [FrameRejectReason.NONE]. The
+ * individual outcomes stay on the result as diagnostics.
+ */
+data class FrameCheck(
     val ok: Boolean,
     val length: Int? = null,
     val headerCrcOk: Boolean? = null,
     val crc32Ok: Boolean? = null,
+    val reason: FrameRejectReason = FrameRejectReason.NONE,
 )
 
 object Framing {
@@ -158,23 +301,51 @@ object Framing {
     // MARK: - validation
 
     /**
-     * Validate a complete Whoop 4.0 frame envelope and both CRCs.
+     * Validate a complete Whoop 4.0 frame envelope: structure, header checksum and payload CRC32.
      * Frame: [0xAA][len u16 LE][crc8(len)][...inner...][crc32 u32 LE], total = len + 4.
+     *
+     * A frame is accepted only when it is at least [FrameLimits.WHOOP4_MINIMUM_FRAME_BYTES] long,
+     * carries EXACTLY `len + 4` bytes (so a truncated frame and one with trailing bytes are both
+     * rejected), its CRC-8 over the length field matches, and its CRC32 over the inner record
+     * matches. `reason` says which rule failed first.
      */
     private fun verifyWhoop4(frame: ByteArray): FrameCheck {
-        if (frame.size < 8 || frame[0] != 0xAA.toByte()) return FrameCheck(ok = false)
+        if (frame.isEmpty() || frame[0] != 0xAA.toByte()) {
+            return FrameCheck(ok = false, reason = FrameRejectReason.NO_START_OF_FRAME)
+        }
+        if (frame.size < FrameLimits.WHOOP4_MINIMUM_FRAME_BYTES) {
+            // Too short even to hold an envelope plus one payload byte: no field of it is read, and
+            // the length word it may carry is not worth reporting as a length.
+            return FrameCheck(ok = false, reason = FrameRejectReason.BELOW_MINIMUM_LENGTH)
+        }
         val length = (frame[1].toInt() and 0xFF) or ((frame[2].toInt() and 0xFF) shl 8)
+        val total = length + 4
         // Ranged CRC checksums the two length bytes in place, with no per-frame allocation.
         val headerOk = Crc.crc8(frame, 1, 3) == (frame[3].toInt() and 0xFF)
         var crc32Ok: Boolean? = null
-        // length must cover at least the envelope's inner bytes (mirrors framing.py).
-        if (length in 7..(frame.size - 4)) {
+        // length must cover at least the envelope's inner bytes (mirrors framing.py). Trailing bytes
+        // do not stop the CRC32 from being computed — that combination (payload CRC right, envelope
+        // wrong) is precisely the class this change stops admitting, so it must stay observable.
+        if (length >= 7 && total <= frame.size) {
             // inner record = frame[4 until length], checksummed in place.
             val want = Crc.crc32(frame, 4, length)
-            val got = frame.u32(length) ?: 0L
+            val got = frame.envU32(length) ?: 0L
             crc32Ok = want == got
         }
-        return FrameCheck(ok = headerOk && (crc32Ok == true), length = length, headerCrcOk = headerOk, crc32Ok = crc32Ok)
+        val reason = frameRejectReason(
+            totalFromLength = total,
+            actualCount = frame.size,
+            minimumBytes = FrameLimits.WHOOP4_MINIMUM_FRAME_BYTES,
+            headerCrcOk = headerOk,
+            crc32Ok = crc32Ok,
+        )
+        return FrameCheck(
+            ok = reason == FrameRejectReason.NONE,
+            length = length,
+            headerCrcOk = headerOk,
+            crc32Ok = crc32Ok,
+            reason = reason,
+        )
     }
 
     /*
@@ -184,9 +355,14 @@ object Framing {
      *   total = declaredLength + 8 (declaredLength counts payload + the 4-byte CRC32 trailer).
      */
     private fun verifyWhoop5(frame: ByteArray): FrameCheck {
-        if (frame.size < 12 || frame[0] != 0xAA.toByte()) return FrameCheck(ok = false)
+        if (frame.isEmpty() || frame[0] != 0xAA.toByte()) {
+            return FrameCheck(ok = false, reason = FrameRejectReason.NO_START_OF_FRAME)
+        }
+        // Smallest well-formed whoop5 frame: 8 header bytes (incl. CRC16) + 1 payload byte + 4 CRC32.
+        if (frame.size < FrameLimits.WHOOP5_MINIMUM_FRAME_BYTES) {
+            return FrameCheck(ok = false, reason = FrameRejectReason.BELOW_MINIMUM_LENGTH)
+        }
         val declaredLength = (frame[2].toInt() and 0xFF) or ((frame[3].toInt() and 0xFF) shl 8)
-        if (declaredLength < 4) return FrameCheck(ok = false, length = declaredLength)
         val total = declaredLength + 8
 
         // Ranged CRC over the first 6 header bytes in place, with no copyOfRange.
@@ -195,27 +371,65 @@ object Framing {
         val headerOk = wantHeader == gotHeader
 
         var crc32Ok: Boolean? = null
-        if (frame.size >= total) {
+        if (declaredLength >= 4 && total <= frame.size) {
             val payloadEnd = total - 4
             // payload = frame[8 until payloadEnd], checksummed in place.
             val want = Crc.crc32(frame, 8, payloadEnd)
-            val got = frame.u32(payloadEnd) ?: 0L
+            val got = frame.envU32(payloadEnd) ?: 0L
             crc32Ok = want == got
         }
-        return FrameCheck(ok = headerOk && (crc32Ok == true), length = declaredLength, headerCrcOk = headerOk, crc32Ok = crc32Ok)
+        val reason = frameRejectReason(
+            totalFromLength = total,
+            actualCount = frame.size,
+            minimumBytes = FrameLimits.WHOOP5_MINIMUM_FRAME_BYTES,
+            headerCrcOk = headerOk,
+            crc32Ok = crc32Ok,
+        )
+        return FrameCheck(
+            ok = reason == FrameRejectReason.NONE,
+            length = declaredLength,
+            headerCrcOk = headerOk,
+            crc32Ok = crc32Ok,
+            reason = reason,
+        )
     }
 
     /**
-     * Family-aware envelope + CRC check — true only when the envelope and BOTH CRCs verify. The Kotlin
-     * twin of Swift's `verifyFrame(_:family:).ok`. Exposed so a decoder outside this object can CRC-gate
-     * a frame before reading any field (the BLE safety contract's "bad bytes never drive state");
-     * [parseFrame] uses the same two private validators internally.
+     * Family-aware frame validation — the ONE decision point. Kotlin twin of Swift's
+     * `verifyFrame(_:family:)`: structure (minimum length, then exact length), header checksum,
+     * then payload CRC32, with a non-null [FrameCheck.reason] saying which rule failed first.
      */
-    fun frameCrcOk(frame: ByteArray, family: DeviceFamily): Boolean =
+    fun verifyFrame(frame: ByteArray, family: DeviceFamily): FrameCheck =
         when (family) {
-            DeviceFamily.WHOOP4 -> verifyWhoop4(frame).ok
-            DeviceFamily.WHOOP5 -> verifyWhoop5(frame).ok
+            DeviceFamily.WHOOP4 -> verifyWhoop4(frame)
+            DeviceFamily.WHOOP5 -> verifyWhoop5(frame)
+        }
+
+    /**
+     * Family-aware envelope + CRC check — true only when the envelope, the structural length and BOTH
+     * CRCs verify. The Kotlin twin of Swift's `verifyFrame(_:family:).ok`. Exposed so a decoder
+     * outside this object can gate a frame before reading any field (the BLE safety contract's "bad
+     * bytes never drive state"); [parseFrame] uses the same validator internally.
+     */
+    fun frameCrcOk(frame: ByteArray, family: DeviceFamily): Boolean = verifyFrame(frame, family).ok
+
+    /**
+     * The D7 bound for reading named inner fields out of [frame] — the minimum of the CRC32
+     * trailer's start (derived from the DECLARED length) and the frame's real size. Internal so the
+     * historical record decoders, which read their fields outside this object, bound them exactly as
+     * the envelope decoders here do.
+     */
+    internal fun payloadLimit(frame: ByteArray, family: DeviceFamily): Int {
+        val trailerStart: Int? = when (family) {
+            // WHOOP 4.0: the CRC32 trailer starts at the declared length.
+            DeviceFamily.WHOOP4 ->
+                if (frame.size >= 3) (frame[1].toInt() and 0xFF) or ((frame[2].toInt() and 0xFF) shl 8) else null
+            // WHOOP 5.0/MG: total = declaredLength + 8, and the trailer is the last 4 of those.
+            DeviceFamily.WHOOP5 ->
+                if (frame.size >= 4) ((frame[2].toInt() and 0xFF) or ((frame[3].toInt() and 0xFF) shl 8)) + 4 else null
         }
+        return payloadLimitOf(frame, trailerStart)
+    }
 
     // MARK: - type / enum naming
 
@@ -274,32 +488,49 @@ object Framing {
         }
 
     private fun parseWhoop4(frame: ByteArray): ParsedFrame {
-        if (frame.size < 8 || frame[0] != 0xAA.toByte()) return ParsedFrame.invalid()
-
         val check = verifyWhoop4(frame)
+        // Below the family minimum there is no inner record at all — every offset a field would use
+        // lands in the checksum trailer — so nothing is decoded, not even a packet type.
+        if (frame.size < FrameLimits.WHOOP4_MINIMUM_FRAME_BYTES || frame[0] != 0xAA.toByte()) {
+            return ParsedFrame.invalid(check.reason)
+        }
+
         val length = check.length
         val crcOk = check.crc32Ok
+        // D7: named inner fields come only from payload bytes. On WHOOP 4.0 the CRC32 trailer starts
+        // at the declared length.
+        val limit = payloadLimitOf(frame, length)
 
         val t = frame[4].toInt() and 0xFF
         val name = typeName(t)
         val parsed = LinkedHashMap<String, Any?>()
 
         when (name) {
-            "REALTIME_DATA" -> decodeRealtime(frame, parsed)
-            "EVENT" -> decodeEvent(frame, length, parsed)
-            "COMMAND_RESPONSE" -> decodeCommandResponse(frame, length, parsed)
-            "METADATA" -> decodeMetadata(frame, length, parsed)
+            "REALTIME_DATA" -> decodeRealtime(frame, limit, parsed)
+            "EVENT" -> decodeEvent(frame, limit, parsed)
+            "COMMAND_RESPONSE" -> decodeCommandResponse(frame, limit, parsed)
+            "METADATA" -> decodeMetadata(frame, limit, parsed)
             else -> Unit
         }
 
-        return ParsedFrame(ok = true, crcOk = crcOk, typeName = name, parsed = parsed)
+        // `ok` is the verifier's full verdict, not a constant: the fields above stay decoded so an
+        // inspector can still read a broken frame, but no consumer may mistake that for integrity.
+        return ParsedFrame(
+            ok = check.ok, crcOk = crcOk, typeName = name, parsed = parsed,
+            rejectReason = check.reason,
+        )
     }
 
     private fun parseWhoop5(frame: ByteArray): ParsedFrame {
-        // Minimum whoop5 frame: 8 header bytes + 1 inner (type) + 4 CRC32 trailer.
-        if (frame.size < 12 || frame[0] != 0xAA.toByte()) return ParsedFrame.invalid()
         val check = verifyWhoop5(frame)
+        // Minimum whoop5 frame: 8 header bytes + 1 payload byte + 4 CRC32 trailer. Below that, the
+        // type byte at [8] would be the first byte of the frame's own CRC32 trailer.
+        if (frame.size < FrameLimits.WHOOP5_MINIMUM_FRAME_BYTES || frame[0] != 0xAA.toByte()) {
+            return ParsedFrame.invalid(check.reason)
+        }
         val innerStart = 8
+        // D7: bounded by the trailer AND the real size — total = declaredLength + 8, trailer = last 4.
+        val limit = payloadLimitOf(frame, check.length?.let { it + 4 })
         val t = frame[innerStart].toInt() and 0xFF
         val name = typeName(t)
         val parsed = LinkedHashMap<String, Any?>()
@@ -308,20 +539,23 @@ object Framing {
         // worn frames; see the Swift Whoop5RealtimeTests vector). Other types stay envelope-only until
         // their per-type 5.0 offsets are confirmed on hardware — we don't invent offsets.
         when (name) {
-            "REALTIME_DATA" -> decodeRealtimeWhoop5(frame, parsed)
-            "METADATA" -> decodeMetadataWhoop5(frame, parsed)
-            "EVENT" -> decodeEventWhoop5(frame, parsed)
-            "COMMAND_RESPONSE" -> decodeCommandResponseWhoop5(frame, parsed)
+            "REALTIME_DATA" -> decodeRealtimeWhoop5(frame, limit, parsed)
+            "METADATA" -> decodeMetadataWhoop5(frame, limit, parsed)
+            "EVENT" -> decodeEventWhoop5(frame, limit, parsed)
+            "COMMAND_RESPONSE" -> decodeCommandResponseWhoop5(frame, limit, parsed)
             // WHOOP 5/MG ONLY, and that is a gap rather than a decision. Swift decodes the 4.0 console
             // layout too (`PostHooks`, offsets 11..len-1, pinned by a test on real 4.0 text), so after the
             // Apple consumer was wired up a WHOOP 4.0 narrates into an iOS strap log and stays silent in an
             // Android one — the same defect this fixed on Apple, mirrored onto the other strap. Left for a
             // follow-up rather than smuggled in here: it needs the 4.0 offsets and its own vector, and this
             // change is already about a key three implementations disagreed on.
-            "CONSOLE_LOGS" -> decodeConsoleLogsWhoop5(frame, parsed)
+            "CONSOLE_LOGS" -> decodeConsoleLogsWhoop5(frame, limit, parsed)
             else -> Unit
         }
-        return ParsedFrame(ok = true, crcOk = check.crc32Ok, typeName = name, parsed = parsed)
+        return ParsedFrame(
+            ok = check.ok, crcOk = check.crc32Ok, typeName = name, parsed = parsed,
+            rejectReason = check.reason,
+        )
     }
 
     /**
@@ -331,19 +565,18 @@ object Framing {
      * BATTERY_LEVEL the 4.0 payload decode shifts with it: soc%=u16@21/10, mV=u16@25, charging@30
      * bit0 (mirrors Swift Interpreter's whoop5 event decode; all gated, fail closed). (#78 fork)
      */
-    private fun decodeEventWhoop5(frame: ByteArray, parsed: MutableMap<String, Any?>) {
-        val evVal = frame.u8(10) ?: return
+    private fun decodeEventWhoop5(frame: ByteArray, limit: Int, parsed: MutableMap<String, Any?>) {
+        val evVal = frame.u8(10, limit) ?: return
         parsed["event"] = eventLabel(evVal)
-        frame.u32(12)?.let { parsed["event_timestamp"] = it.toInt() }
-        val payEnd = frame.size - 4
-        if (payEnd > 16) {
-            parsed["event_payload_hex"] = frame.copyOfRange(16, payEnd)
+        frame.u32(12, limit)?.let { parsed["event_timestamp"] = it.toInt() }
+        if (limit > 16) {
+            parsed["event_payload_hex"] = frame.copyOfRange(16, limit)
                 .joinToString("") { "%02x".format(it) }
         }
         if (EventNumber.fromRaw(evVal) == EventNumber.BATTERY_LEVEL) {
-            frame.u16(21)?.let { raw -> if (raw <= 1100) parsed["battery_pct"] = raw.toDouble() / 10.0 }
-            frame.u16(25)?.let { mv -> if (mv in 3000..4300) parsed["battery_mV"] = mv }
-            frame.u8(30)?.let { ch -> if (ch <= 1) parsed["battery_charging"] = ch and 1 }
+            frame.u16(21, limit)?.let { raw -> if (raw <= 1100) parsed["battery_pct"] = raw.toDouble() / 10.0 }
+            frame.u16(25, limit)?.let { mv -> if (mv in 3000..4300) parsed["battery_mV"] = mv }
+            frame.u8(30, limit)?.let { ch -> if (ch <= 1) parsed["battery_charging"] = ch and 1 }
         }
     }
 
@@ -355,20 +588,20 @@ object Framing {
      * direct percent at @13 (gated ≤100, fail closed; Swift parity — unused until the 5/MG
      * allowlist grows).
      */
-    private fun decodeCommandResponseWhoop5(frame: ByteArray, parsed: MutableMap<String, Any?>) {
-        val cmd = frame.u8(10) ?: return
+    private fun decodeCommandResponseWhoop5(frame: ByteArray, limit: Int, parsed: MutableMap<String, Any?>) {
+        val cmd = frame.u8(10, limit) ?: return
         parsed["resp_cmd"] = commandLabel(cmd)
-        frame.u8(11)?.let { parsed["resp_seq"] = it }
-        frame.u8(12)?.let { parsed["result"] = commandResultLabel(it) }
+        frame.u8(11, limit)?.let { parsed["resp_seq"] = it }
+        frame.u8(12, limit)?.let { parsed["result"] = commandResultLabel(it) }
         if (CommandNumber.fromRaw(cmd) == CommandNumber.GET_BATTERY_LEVEL) {
-            frame.u8(13)?.let { pct -> if (pct <= 100) parsed["battery_pct"] = pct.toDouble() }
+            frame.u8(13, limit)?.let { pct -> if (pct <= 100) parsed["battery_pct"] = pct.toDouble() }
         }
         // GET_HELLO (145): device name + firmware version. Mirrors the Swift Interpreter decode of the
         // same 50.38.1.0 capture: payload base is frame[11]; the name is printable ASCII at pay[16],
         // the firmware is 4 bytes at pay[93] gated on pay[93]==50 (the "5.x" generation). The session
         // token in the same block is deliberately never read. Surfaced on the Devices card.
         if (cmd == 145) {
-            val payEnd = frame.size - 4 // drop the trailing CRC32
+            val payEnd = limit // payload only: stops where the CRC32 trailer starts (D7)
             if (payEnd > 11) {
                 val pay = frame.copyOfRange(11, payEnd)
                 val name = StringBuilder()
@@ -407,11 +640,11 @@ object Framing {
      * `decodeWhoop5ConsoleLogs` in Interpreter.swift (its text key is "log").
      * (#78 fork, real-frame verified)
      */
-    private fun decodeConsoleLogsWhoop5(frame: ByteArray, parsed: MutableMap<String, Any?>) {
-        frame.u16(9)?.let { parsed["record_index"] = it }
-        frame.u32(12)?.let { parsed["unix"] = it.toInt() }
-        frame.u16(16)?.let { parsed["subsec"] = it }
-        val payEnd = frame.size - 4
+    private fun decodeConsoleLogsWhoop5(frame: ByteArray, limit: Int, parsed: MutableMap<String, Any?>) {
+        frame.u16(9, limit)?.let { parsed["record_index"] = it }
+        frame.u32(12, limit)?.let { parsed["unix"] = it.toInt() }
+        frame.u16(16, limit)?.let { parsed["subsec"] = it }
+        val payEnd = limit // payload only: stops where the CRC32 trailer starts (D7)
         if (payEnd <= 21) return
         val text = frame.copyOfRange(21, payEnd)
             .toString(Charsets.UTF_8)
@@ -430,14 +663,14 @@ object Framing {
      * Backfiller never acked/trimmed → 5/MG offload never completed. Offsets verified against real
      * WHOOP 5 HISTORY_END frames (Swift decodeWhoop5Metadata, Interpreter.swift:407). (#78)
      */
-    private fun decodeMetadataWhoop5(frame: ByteArray, parsed: MutableMap<String, Any?>) {
-        val mt = frame.u8(10) ?: return
+    private fun decodeMetadataWhoop5(frame: ByteArray, limit: Int, parsed: MutableMap<String, Any?>) {
+        val mt = frame.u8(10, limit) ?: return
         parsed["meta_type"] = metaLabel(mt)
         // Only a HISTORY_END carries unix/subsec/trim; the u-reads null out on the shorter
         // START/COMPLETE frames, so classifyHistoricalMeta keys those off meta_type alone.
-        frame.u32(11)?.let { parsed["unix"] = it.toInt() }
-        frame.u16(15)?.let { parsed["subsec"] = it }
-        frame.u32(21)?.let { parsed["trim_cursor"] = it.toInt() }
+        frame.u32(11, limit)?.let { parsed["unix"] = it.toInt() }
+        frame.u16(15, limit)?.let { parsed["subsec"] = it }
+        frame.u32(21, limit)?.let { parsed["trim_cursor"] = it.toInt() }
     }
 
     /**
@@ -445,15 +678,15 @@ object Framing {
      * subseconds@14 (u16), heart_rate@16 (u8), rr_count@17, rr@18.. (u16). Mirrors the Swift
      * parseFrameWhoop5 realtime decode and is covered by the same real-frame test vector.
      */
-    private fun decodeRealtimeWhoop5(frame: ByteArray, parsed: MutableMap<String, Any?>) {
-        frame.u32(10)?.let { parsed["timestamp"] = it.toInt() }
-        frame.u16(14)?.let { parsed["subseconds"] = it }
-        frame.u8(16)?.let { parsed["heart_rate"] = it }
-        val rrn = frame.u8(17) ?: 0
+    private fun decodeRealtimeWhoop5(frame: ByteArray, limit: Int, parsed: MutableMap<String, Any?>) {
+        frame.u32(10, limit)?.let { parsed["timestamp"] = it.toInt() }
+        frame.u16(14, limit)?.let { parsed["subseconds"] = it }
+        frame.u8(16, limit)?.let { parsed["heart_rate"] = it }
+        val rrn = frame.u8(17, limit) ?: 0
         parsed["rr_count"] = rrn
         val rrs = ArrayList<Int>()
         for (i in 0 until rrn) {
-            val v = frame.u16(18 + i * 2)
+            val v = frame.u16(18 + i * 2, limit)
             if (v != null && v > 0) rrs.add(v)   // drop 0 ms placeholders, matching 4.0 / Swift
         }
         parsed["rr_intervals"] = rrs
@@ -462,16 +695,16 @@ object Framing {
     // MARK: - per-type decoders (Whoop 4.0). Ported from PostHooks.swift + the static field specs.
 
     /** REALTIME_DATA (type 40): timestamp@6 (u32), heart_rate@12 (u8), rr_count@13, rr@14.. (u16). */
-    private fun decodeRealtime(frame: ByteArray, parsed: MutableMap<String, Any?>) {
-        frame.u32(6)?.let { parsed["timestamp"] = it.toInt() }
-        frame.u16(10)?.let { parsed["subseconds"] = it }
-        frame.u8(12)?.let { parsed["heart_rate"] = it }
-        val rrn = frame.u8(13) ?: 0
+    private fun decodeRealtime(frame: ByteArray, limit: Int, parsed: MutableMap<String, Any?>) {
+        frame.u32(6, limit)?.let { parsed["timestamp"] = it.toInt() }
+        frame.u16(10, limit)?.let { parsed["subseconds"] = it }
+        frame.u8(12, limit)?.let { parsed["heart_rate"] = it }
+        val rrn = frame.u8(13, limit) ?: 0
         parsed["rr_count"] = rrn
         val rrs = ArrayList<Int>()
         for (i in 0 until rrn) {
             // Drop 0 ms intervals (placeholders, not beat-to-beat intervals), matching Swift.
-            val v = frame.u16(14 + i * 2)
+            val v = frame.u16(14 + i * 2, limit)
             if (v != null && v > 0) rrs.add(v)
         }
         parsed["rr_intervals"] = rrs
@@ -481,17 +714,17 @@ object Framing {
      * EVENT (type 48): event@6 (u8, EventNumber), event_timestamp@8 (u32).
      * For BATTERY_LEVEL, additionally decode soc@17(/10), mV@21, charging@26 bit0.
      */
-    private fun decodeEvent(frame: ByteArray, length: Int?, parsed: MutableMap<String, Any?>) {
-        val evVal = frame.u8(6) ?: return
+    private fun decodeEvent(frame: ByteArray, limit: Int, parsed: MutableMap<String, Any?>) {
+        val evVal = frame.u8(6, limit) ?: return
         parsed["event"] = eventLabel(evVal)
-        frame.u32(8)?.let { parsed["event_timestamp"] = it.toInt() }
+        frame.u32(8, limit)?.let { parsed["event_timestamp"] = it.toInt() }
 
-        if (EventNumber.fromRaw(evVal) == EventNumber.BATTERY_LEVEL && length != null) {
+        if (EventNumber.fromRaw(evVal) == EventNumber.BATTERY_LEVEL) {
             // Fixed layout, empirically verified against captured frames:
             //   soc% = u16@17/10 · mV = u16@21 · charging = u8@26 bit0
-            frame.u16(17)?.let { raw -> if (raw <= 1100) parsed["battery_pct"] = raw.toDouble() / 10.0 }
-            frame.u16(21)?.let { mv -> if (mv in 3000..4300) parsed["battery_mV"] = mv }
-            frame.u8(26)?.let { ch -> if (ch <= 1) parsed["battery_charging"] = ch and 1 }
+            frame.u16(17, limit)?.let { raw -> if (raw <= 1100) parsed["battery_pct"] = raw.toDouble() / 10.0 }
+            frame.u16(21, limit)?.let { mv -> if (mv in 3000..4300) parsed["battery_mV"] = mv }
+            frame.u8(26, limit)?.let { ch -> if (ch <= 1) parsed["battery_charging"] = ch and 1 }
         }
     }
 
@@ -499,12 +732,11 @@ object Framing {
      * COMMAND_RESPONSE (type 36): resp_cmd@6 (u8, CommandNumber). Decodes the battery level reply.
      * Payload begins at offset 7; GET_BATTERY_LEVEL stores soc% = u16(payload[2..4]) / 10.
      */
-    private fun decodeCommandResponse(frame: ByteArray, length: Int?, parsed: MutableMap<String, Any?>) {
-        if (length == null) return
-        val payEnd = minOf(length, frame.size)
+    private fun decodeCommandResponse(frame: ByteArray, limit: Int, parsed: MutableMap<String, Any?>) {
+        val payEnd = limit // payload only: stops where the CRC32 trailer starts (D7)
         if (payEnd < 7) return
         val pay = frame.copyOfRange(7, payEnd)
-        val cmd = frame.u8(6) ?: return
+        val cmd = frame.u8(6, limit) ?: return
         parsed["resp_cmd"] = commandLabel(cmd)
         // #791: the origin-seq echo and the result code, which the 5/MG path has always exposed (at @11/@12)
         // and this one never did. Without them a 4.0 strap log cannot say whether a command SUCCEEDED or
@@ -555,11 +787,10 @@ object Framing {
      * METADATA (type 49): meta_type@6 (u8, MetadataType). For a 14-byte payload ('<LHLL'):
      * unix@7 (u32), subsec@11 (u16), unk0@13 (u32), trim_cursor@17 (u32).
      */
-    private fun decodeMetadata(frame: ByteArray, length: Int?, parsed: MutableMap<String, Any?>) {
-        val mt = frame.u8(6) ?: return
+    private fun decodeMetadata(frame: ByteArray, limit: Int, parsed: MutableMap<String, Any?>) {
+        val mt = frame.u8(6, limit) ?: return
         parsed["meta_type"] = metaLabel(mt)
-        if (length == null) return
-        val payEnd = minOf(length, frame.size)
+        val payEnd = limit // payload only: stops where the CRC32 trailer starts (D7)
         if (payEnd <= 7) return
         val pay = frame.copyOfRange(7, payEnd)
         if (pay.size >= 14) {
diff --git a/android/app/src/main/java/com/noop/protocol/HistoricalStreams.kt b/android/app/src/main/java/com/noop/protocol/HistoricalStreams.kt
index f72fd7c1de..fe21ff725c 100644
--- a/android/app/src/main/java/com/noop/protocol/HistoricalStreams.kt
+++ b/android/app/src/main/java/com/noop/protocol/HistoricalStreams.kt
@@ -103,14 +103,16 @@ const val DYN_ACCEL_STILL_THRESHOLD_G: Double = 0.01
 
 // MARK: - little-endian readers (null when out of range; mirror PostHooks.swift u8/u16/u32/f32)
 
-private fun ByteArray.histU8(off: Int): Int? = if (off + 1 <= size) this[off].toInt() and 0xFF else null
+private fun ByteArray.histU8(off: Int, limit: Int): Int? =
+    if (off >= 0 && off + 1 <= limit) this[off].toInt() and 0xFF else null
 
-private fun ByteArray.histU16(off: Int): Int? =
-    if (off + 2 <= size) (this[off].toInt() and 0xFF) or ((this[off + 1].toInt() and 0xFF) shl 8) else null
+private fun ByteArray.histU16(off: Int, limit: Int): Int? =
+    if (off >= 0 && off + 2 <= limit) (this[off].toInt() and 0xFF) or ((this[off + 1].toInt() and 0xFF) shl 8)
+    else null
 
 /** Signed little-endian i16 (two's complement) -> Int. null when out of range. Mirrors Swift `readI16`. */
-private fun ByteArray.histI16(off: Int): Int? {
-    if (off + 2 > size) return null
+private fun ByteArray.histI16(off: Int, limit: Int): Int? {
+    if (off < 0 || off + 2 > limit) return null
     val u = (this[off].toInt() and 0xFF) or ((this[off + 1].toInt() and 0xFF) shl 8)
     return if (u >= 0x8000) u - 0x10000 else u
 }
@@ -131,8 +133,8 @@ private fun ByteArray.histI16(off: Int): Int? {
  * Long. Reading it out of a parsed map needs `longOrNull`, NOT `intOrNull` — the latter re-narrows
  * with `toInt()` and silently undoes this.
  */
-private fun ByteArray.histU32(off: Int): Long? {
-    if (off + 4 > size) return null
+private fun ByteArray.histU32(off: Int, limit: Int): Long? {
+    if (off < 0 || off + 4 > limit) return null
     return (this[off].toLong() and 0xFFL) or
         ((this[off + 1].toLong() and 0xFFL) shl 8) or
         ((this[off + 2].toLong() and 0xFFL) shl 16) or
@@ -155,8 +157,8 @@ private fun Int?.asU32(): Long? = this?.toLong()?.and(0xFFFF_FFFFL)
  * then widen to Double. Kotlin's `Float.fromBits(Int)` is the exact analog of
  * `Float(bitPattern:)`; widening Float -> Double is value-preserving.
  */
-private fun ByteArray.histF32(off: Int): Double? {
-    val bits = histU32(off) ?: return null
+private fun ByteArray.histF32(off: Int, limit: Int): Double? {
+    val bits = histU32(off, limit) ?: return null
     return Float.fromBits(bits.toInt()).toDouble()
 }
 
@@ -226,15 +228,26 @@ private fun histVersionLayout(version: Int): HistVersion? = when (version) {
 fun decodeHistorical(frame: ByteArray, family: DeviceFamily = DeviceFamily.WHOOP4): Map<String, Any?>? {
     if (frame.size < 8 || frame[0] != 0xAA.toByte()) return null
 
-    // Integrity gate: validate the envelope + CRC32 via the shared Framing parser. We reuse its
-    // crcOk so a garbled/forged offload frame can never inject rows. parseFrame leaves type-47's
-    // `parsed` empty (the live decoder skips type-47), so we decode the record ourselves below.
+    // Integrity gate: the FULL verdict from the shared Framing parser — header checksum, payload
+    // CRC32 and the structural length together — so a garbled or forged offload frame can never
+    // inject rows. `ok` alone is now that verdict, so the old extra `crcOk == false` clause would be
+    // a second, weaker copy of the same question. parseFrame leaves type-47's `parsed` empty (the
+    // live decoder skips type-47), so we decode the record ourselves below.
+    //
+    // Returning null for a rejected frame is ALSO what gets it archived: [rejectedHistoricalRecords]
+    // reads exactly this outcome, so a frame the tightened verdict now refuses is preserved raw
+    // before the trim ack rather than dropped (D8).
     val checked = Framing.parseFrame(frame, family)
-    if (!checked.ok || checked.crcOk == false) return null
+    if (!checked.ok) return null
+
+    // D7: named inner fields come only from payload bytes — the record's own CRC32 trailer is never
+    // decoded as a field. The verdict above already fixed the frame's exact length, so this is the
+    // trailer start; it is still derived through the one shared helper rather than assumed.
+    val limit = Framing.payloadLimit(frame, family)
 
     // WHOOP 5.0/MG has the longer puffin envelope (record @8), so its v18 layout is decoded separately
     // at its own absolute offsets (port of Swift decodeWhoop5Historical). WHOOP 4 below is unchanged.
-    if (family == DeviceFamily.WHOOP5) return decodeWhoop5Historical(frame)
+    if (family == DeviceFamily.WHOOP5) return decodeWhoop5Historical(frame, limit)
     if (family != DeviceFamily.WHOOP4) return null
     if (frame[4].toInt() and 0xFF != PacketType.HISTORICAL_DATA.rawValue) return null
 
@@ -250,9 +263,9 @@ fun decodeHistorical(frame: ByteArray, family: DeviceFamily = DeviceFamily.WHOOP
         val out = LinkedHashMap<String, Any?>()
         out["hist_version"] = version
         // Long, not Int — see [histU32]. Pinned by `whoop4_v25_synthetic_unix_high_bit`.
-        frame.histU32(11)?.let { out["unix"] = it }
+        frame.histU32(11, limit)?.let { out["unix"] = it }
         fun grav(off: Int): Double? {
-            val u = frame.histU16(off) ?: return null
+            val u = frame.histU16(off, limit) ?: return null
             return (if (u >= 32768) u - 65536 else u).toDouble() / 16384.0   // i16 LE, ±2 g full-scale
         }
         val gx = grav(73); val gy = grav(75); val gz = grav(77)
@@ -282,27 +295,27 @@ fun decodeHistorical(frame: ByteArray, family: DeviceFamily = DeviceFamily.WHOOP
 
     // unix is the record's REAL unix seconds (no clock offset needed for type-47).
     // Long, not Int — see [histU32]. Pinned by `whoop4_v24_synthetic_unix_high_bit`.
-    frame.histU32(layout.unixOff)?.let { out["unix"] = it }
-    frame.histU8(layout.hrOff)?.let { out["heart_rate"] = it }
-    val rrn = frame.histU8(layout.rrCountOff) ?: 0
+    frame.histU32(layout.unixOff, limit)?.let { out["unix"] = it }
+    frame.histU8(layout.hrOff, limit)?.let { out["heart_rate"] = it }
+    val rrn = frame.histU8(layout.rrCountOff, limit) ?: 0
     out["rr_count"] = rrn
 
     // Up to 4 R-R intervals (u16, ms). Drop 0 ms placeholders, matching PostHooks (`v != 0`).
     val rrVals = ArrayList<Int>()
     for (i in 0 until minOf(rrn, 4)) {
-        val v = frame.histU16(layout.rrFirstOff + i * 2)
+        val v = frame.histU16(layout.rrFirstOff + i * 2, limit)
         if (v != null && v != 0) rrVals.add(v)
     }
     out["rr_intervals"] = rrVals
 
     // Full DSP block (V24/V12 only). Each read is guarded; absent fields are simply not emitted.
-    layout.spo2RedOff?.let { off -> frame.histU16(off)?.let { out["spo2_red"] = it } }
-    layout.spo2IrOff?.let { off -> frame.histU16(off)?.let { out["spo2_ir"] = it } }
-    layout.skinTempRawOff?.let { off -> frame.histU16(off)?.let { out["skin_temp_raw"] = it } }
-    layout.respRateRawOff?.let { off -> frame.histU16(off)?.let { out["resp_rate_raw"] = it } }
-    layout.gravityXOff?.let { off -> frame.histF32(off)?.let { out["gravity_x"] = it } }
-    layout.gravityYOff?.let { off -> frame.histF32(off)?.let { out["gravity_y"] = it } }
-    layout.gravityZOff?.let { off -> frame.histF32(off)?.let { out["gravity_z"] = it } }
+    layout.spo2RedOff?.let { off -> frame.histU16(off, limit)?.let { out["spo2_red"] = it } }
+    layout.spo2IrOff?.let { off -> frame.histU16(off, limit)?.let { out["spo2_ir"] = it } }
+    layout.skinTempRawOff?.let { off -> frame.histU16(off, limit)?.let { out["skin_temp_raw"] = it } }
+    layout.respRateRawOff?.let { off -> frame.histU16(off, limit)?.let { out["resp_rate_raw"] = it } }
+    layout.gravityXOff?.let { off -> frame.histF32(off, limit)?.let { out["gravity_x"] = it } }
+    layout.gravityYOff?.let { off -> frame.histF32(off, limit)?.let { out["gravity_y"] = it } }
+    layout.gravityZOff?.let { off -> frame.histF32(off, limit)?.let { out["gravity_z"] = it } }
 
     // Validate the v24-layout guess for an unmapped version: gravity is the DSP-separated orientation
     // vector, so |gravity| ≈ 1 g on a real record regardless of motion, and HR is physiological. If the
@@ -365,9 +378,9 @@ fun isUnmappedWhoop5HistoricalRecord(frame: ByteArray): Boolean {
  * v26 (PPG) and other
  * versions aren't stored, so they return null here (skipped), matching the Swift raw-region treatment.
  */
-private fun decodeWhoop5Historical(frame: ByteArray): Map<String, Any?>? {
-    if (frame.histU8(8) != PacketType.HISTORICAL_DATA.rawValue) return null
-    val version = frame.histU8(9) ?: return null
+private fun decodeWhoop5Historical(frame: ByteArray, limit: Int): Map<String, Any?>? {
+    if (frame.histU8(8, limit) != PacketType.HISTORICAL_DATA.rawValue) return null
+    val version = frame.histU8(9, limit) ?: return null
     // One gate, one list: 18 is the only version this function maps, and v26 (handled by
     // [decodeWhoop5HistoricalV26] from [extractHistoricalStreams]) is the only other one this platform
     // maps at all — so [MAPPED_WHOOP5_HISTORICAL_VERSIONS] must contain exactly {18, 26}. That set is
@@ -385,23 +398,23 @@ private fun decodeWhoop5Historical(frame: ByteArray): Map<String, Any?>? {
     // decode divergence the per-platform fixture-hex tests cannot see (same bytes, each suite asserting
     // its own answer). PR #848 hit the same 32-vs-64-bit split in the storage codec. Pinned on both
     // platforms by the `whoop5_v18_synthetic_record_index_high_bit` fixture in decoder_oracle.json.
-    frame.histU32(11)?.let { out["record_index"] = it }
+    frame.histU32(11, limit)?.let { out["record_index"] = it }
     // Same unsigned-domain rule, and here it is not merely a wrong number: a narrowed `unix` goes
     // NEGATIVE past 2038-01-19, fails the #547 plausibility floor, and the record is dropped — see
     // [histU32]. Pinned by `whoop5_v18_synthetic_unix_high_bit`.
-    frame.histU32(15)?.let { out["unix"] = it }
-    frame.histU8(22)?.let { out["heart_rate"] = it }
-    val rrn = frame.histU8(23) ?: 0
+    frame.histU32(15, limit)?.let { out["unix"] = it }
+    frame.histU8(22, limit)?.let { out["heart_rate"] = it }
+    val rrn = frame.histU8(23, limit) ?: 0
     out["rr_count"] = rrn
     val rrVals = ArrayList<Int>()
     for (i in 0 until minOf(rrn, 4)) {
-        val v = frame.histU16(24 + i * 2)
+        val v = frame.histU16(24 + i * 2, limit)
         if (v != null && v != 0) rrVals.add(v)
     }
     out["rr_intervals"] = rrVals
     // Bytes adjacent to the HR/R-R fields: @36 is a FLAG byte and @37 a duplicate heart rate — not the
     // two halves of one fixed-point HR; the others are carried raw (meaning not pinned).
-    frame.histU8(33)?.let { out["cardiac_flags"] = it }
+    frame.histU8(33, limit)?.let { out["cardiac_flags"] = it }
     // @36 was read as the low half of a u16 `hr_fixed_8_8` with bpm = value/256. Over 18,650 real v18
     // records that model is false. Bit 4 is NEVER set (0/18,650 — a genuine 8.8 fraction sets it ~50% of
     // the time, and it is the ONLY bit never set); 95.02% of values land in 0x80–0x8F where uniform would
@@ -410,48 +423,48 @@ private fun decodeWhoop5Historical(frame: ByteArray): Map<String, Any?>? {
     // this flag byte over 256, so the residual is a flat +0.504 ± 0.189. Bit 7 reads as a VALIDITY bit:
     // with it clear (n=748) rr_count == 0 in 70.32% of records vs 19.82% with it set, and the @108/@109
     // sentinel fires in 69.65% vs 1.32%. The remaining bits are unpinned, so the byte ships raw.
-    frame.histU8(36)?.let { out["hr_quality_flags"] = it }   // bit7 = valid, bit4 never set
+    frame.histU8(36, limit)?.let { out["hr_quality_flags"] = it }   // bit7 = valid, bit4 never set
     // @37 duplicates heart_rate@22 — equal in 99.575% of records (18,523/18,602), differing only by
     // -6…+2, and it only tracks HR while @36 bit7 is set (99.74% exact vs 94.12% when clear).
-    frame.histU8(37)?.let { out["heart_rate_alt"] = it }
-    frame.histU16(38)?.let { out["rr_packed"] = it }
-    frame.histU8(40)?.let { out["cardiac_status"] = it }
-    frame.histF32(45)?.let { out["gravity_x"] = it }
-    frame.histF32(49)?.let { out["gravity_y"] = it }
-    frame.histF32(53)?.let { out["gravity_z"] = it }
+    frame.histU8(37, limit)?.let { out["heart_rate_alt"] = it }
+    frame.histU16(38, limit)?.let { out["rr_packed"] = it }
+    frame.histU8(40, limit)?.let { out["cardiac_status"] = it }
+    frame.histF32(45, limit)?.let { out["gravity_x"] = it }
+    frame.histF32(49, limit)?.let { out["gravity_y"] = it }
+    frame.histF32(53, limit)?.let { out["gravity_z"] = it }
 
     // Per-second fields beyond HR/gravity, each gated to a physically-real range (cross-validated
     // worn vs off-wrist). Optical/perfusion @69/71 still doesn't decode consistently and is left raw.
-    frame.histF32(41)?.let { if (it.isFinite() && it in 0.0..8.0) out["dynamic_acceleration"] = it }
-    frame.histU16(57)?.let { out["step_motion_counter"] = it }
+    frame.histF32(41, limit)?.let { if (it.isFinite() && it in 0.0..8.0) out["dynamic_acceleration"] = it }
+    frame.histU16(57, limit)?.let { out["step_motion_counter"] = it }
     // @59 a per-step cadence-like byte (never 0; lower when moving faster). Raw — no unit asserted.
-    frame.histU8(59)?.let { out["step_cadence"] = it }
-    frame.histU8(63)?.let { if (it in 0..2) out["motion_wear_quality"] = it }
+    frame.histU8(59, limit)?.let { out["step_cadence"] = it }
+    frame.histU8(63, limit)?.let { if (it in 0..2) out["motion_wear_quality"] = it }
     // @63 also reads as a small validated ACTIVITY-CLASS enum (community finding, #316): 0=still, 1=walk,
     // 2=run, 0xFF=invalid. A lightweight, no-cloud per-record activity readout that rides alongside the
     // step counter. Only the four known codes are surfaced — anything else (incl. 0xFF) stores nothing so
     // an unmapped firmware can't inject garbage.
-    frame.histU8(63)?.let { if (it == 0 || it == 1 || it == 2) out["activity_class"] = it }
+    frame.histU8(63, limit)?.let { if (it == 0 || it == 1 || it == 2) out["activity_class"] = it }
     // Auxiliary thermal readings adjacent to the main skin-temperature register, read off a digital
     // skin-temperature sensor. Carried raw; °C = raw/10. Signed i16, gated to a plausible thermal range
     // so a wrong offset on an unmapped layout stores nothing rather than garbage.
-    frame.histI16(69)?.let { if ((it / 10.0) in 0.0..60.0) out["temp_aux_1_raw"] = it }
-    frame.histI16(71)?.let { if ((it / 10.0) in 0.0..60.0) out["temp_aux_2_raw"] = it }
+    frame.histI16(69, limit)?.let { if ((it / 10.0) in 0.0..60.0) out["temp_aux_1_raw"] = it }
+    frame.histI16(71, limit)?.let { if ((it / 10.0) in 0.0..60.0) out["temp_aux_2_raw"] = it }
     // skin temp: raw u16 (the store keeps it raw, /100 at display). Gate on a plausible thermal range:
     // °C = raw/100 — gives physiological worn temperatures (median ~34 °C across two straps), whereas a
     // /128 reading lands at a non-physiological ~27 °C. The gate is only a garbage filter; the absolute
     // scale lives in the consumer.
-    frame.histU16(73)?.let { if ((it / 100.0) in 5.0..45.0) out["skin_temp_raw"] = it }
+    frame.histU16(73, limit)?.let { if ((it / 100.0) in 5.0..45.0) out["skin_temp_raw"] = it }
     // @75 a 16-bit status word; NOT a deep-sleep marker (low nibble 0 across observed records, equal
     // awake/asleep — the "80=deep" reading is a misread).
-    frame.histU16(75)?.let { out["status_word"] = it }
+    frame.histU16(75, limit)?.let { out["status_word"] = it }
     // @77 / @79 two further 16-bit status words adjacent to @75; carried raw, meaning not pinned.
-    frame.histU16(77)?.let { out["status_word_1"] = it }
-    frame.histU16(79)?.let { out["status_word_2"] = it }
+    frame.histU16(77, limit)?.let { out["status_word_1"] = it }
+    frame.histU16(79, limit)?.let { out["status_word_2"] = it }
     // @81 packs several band flags into one byte. High nibble (bits 4-5) tracks a scored night:
     // 0 wake / 1 still / 2 asleep / 3 up. bits 2-3 a wake-quality field; bits 0-1 an on-wrist flag.
     // Deep/REM/light are computed off-band, not here.
-    frame.histU8(81)?.let {
+    frame.histU8(81, limit)?.let {
         out["sleep_state"] = (it shr 4) and 3
         out["wake_quality"] = (it shr 2) and 3
         out["onwrist"] = it and 3
@@ -474,7 +487,7 @@ private fun decodeWhoop5Historical(frame: ByteArray): Map<String, Any?>? {
     // never back a shipped SpO2 metric, never write spo2Pct/spo2_red/spo2_ir, and never feed a
     // downstream gate (recovery/illness) until the cross-device contradiction is resolved. Mirror of
     // Swift Interpreter (@82 block).
-    frame.histU8(82)?.let {
+    frame.histU8(82, limit)?.let {
         out["aux_byte_82"] = it
         if (it in 70..100) out["spo2_candidate_82"] = it
     }
@@ -493,8 +506,8 @@ private fun decodeWhoop5Historical(frame: ByteArray): Map<String, Any?>? {
     // marker: both bytes read 0 in exactly the 8 records that also carry HR == 0, while 128 occurs
     // unremarkably while worn (@106 in 10 records, @107 in 103). Magnitudes are device-specific (102–255 /
     // 119–247 on the R22 strap vs 20–66 / 34–81 on another), so no scale is asserted.
-    frame.histU8(106)?.let { out["optical_baseline_a"] = it }
-    frame.histU8(107)?.let { out["optical_baseline_b"] = it }
+    frame.histU8(106, limit)?.let { out["optical_baseline_a"] = it }
+    frame.histU8(107, limit)?.let { out["optical_baseline_b"] = it }
     // @108/@109 a tightly-coupled PAIR (equal ~24% of records, within ±2 ~80%). 128 is a RECORD-level
     // sentinel, not a per-channel one: amp_a == 128 in 757 records and amp_b == 128 in 757 — the SAME 757,
     // never one without the other. They do NOT rise with HR; that reading (~34 at HR 40–49 → ~58 at 80–89)
@@ -507,10 +520,10 @@ private fun decodeWhoop5Historical(frame: ByteArray): Map<String, Any?>? {
     // and predicts the band's own beat-detection failure (rr_count == 0) at 79.44% vs 19.40% — a 4.09×
     // lift that SURVIVES holding motion constant (4.11× within dyn_acc < 0.009 g), where shuffled and
     // circular-shift nulls all sit at ~1.0×. It is the same quality condition @36 bit7 reports.
-    frame.histU8(108)?.let { out["optical_amp_a"] = it }
-    frame.histU8(109)?.let { out["optical_amp_b"] = it }
+    frame.histU8(108, limit)?.let { out["optical_amp_a"] = it }
+    frame.histU8(109, limit)?.let { out["optical_amp_b"] = it }
     // @113 a float32 (observed range ~ -5.3..0, 0 = unset); purpose unknown, carried raw. EMPIRICAL.
-    frame.histF32(113)?.let { if (it.isFinite()) out["unknown_f32_113"] = it }
+    frame.histF32(113, limit)?.let { if (it.isFinite()) out["unknown_f32_113"] = it }
     // PROVENANCE / lossless-tail note (A10): this decoder maps only the fields above; bytes past @113
     // up to the CRC32 trailer are NOT consumed here and are NOT a per-field loss. The Backfiller hands
     // the VERBATIM frame (header..tail..CRC) to [RawHistoryArchive] for any record it can't turn into
@@ -536,21 +549,21 @@ private fun decodeWhoop5Historical(frame: ByteArray): Map<String, Any?>? {
  */
 private data class V26Record(val unix: Long, val samples: List<Int>, val burstIndex: Int?)
 
-private fun decodeWhoop5HistoricalV26(frame: ByteArray): V26Record? {
-    if (frame.histU8(8) != PacketType.HISTORICAL_DATA.rawValue) return null
-    if (frame.histU8(9) != 26) return null
+private fun decodeWhoop5HistoricalV26(frame: ByteArray, limit: Int): V26Record? {
+    if (frame.histU8(8, limit) != PacketType.HISTORICAL_DATA.rawValue) return null
+    if (frame.histU8(9, limit) != 26) return null
     // Long, not Int — see [histU32]. This path was never actually wrong (its one consumer re-widened
     // with `and 0xFFFFFFFFL`), but carrying the reader's own type removes the mask and the trap.
-    val unix = frame.histU32(15) ?: return null
+    val unix = frame.histU32(15, limit) ?: return null
     val samples = ArrayList<Int>(24)
     var off = 27
     while (off < 75) {
-        val v = frame.histI16(off) ?: break
+        val v = frame.histI16(off, limit) ?: break
         samples.add(v)
         off += 2
     }
     if (samples.isEmpty()) return null
-    val rawBurstIndex = frame.histU8(21)
+    val rawBurstIndex = frame.histU8(21, limit)
     return V26Record(unix = unix, samples = samples,
         burstIndex = rawBurstIndex?.takeIf { it > 0 })
 }
@@ -567,8 +580,9 @@ private fun decodeWhoop5HistoricalV26(frame: ByteArray): V26Record? {
  *   - CONSOLE_LOGS (type-50) frames — the strap's own diagnostics text channel. On WHOOP 4.0 the
  *     inner type byte is frame[4]; type-50 (0x32) is not type-47 so the family-aware type guard below
  *     already skips it. On WHOOP 5/MG the inner type byte is at frame[8].
- *   - WHOOP 5/MG v26 (raw PPG) records — stored in the dedicated waveform stream, so they do not belong
- *     in the rejected-record archive.
+ *   - INTACT WHOOP 5/MG v26 (raw PPG) records — stored in the dedicated waveform stream, so they do not
+ *     belong in the rejected-record archive. A REJECTED v26 record banks no waveform either, so it is
+ *     archived like any other rejected record.
  *   - Non-record frames (METADATA, EVENT, etc.) — not type-47, so never returned.
  *
  * The Backfiller archives these raw bytes BEFORE acking the trim, so a user on an unmapped firmware
@@ -584,10 +598,19 @@ fun rejectedHistoricalRecords(
     // Inner packet-type byte: WHOOP 5/MG's longer puffin envelope puts it at frame[8]; WHOOP 4 at frame[4].
     val typeIndex = if (family == DeviceFamily.WHOOP5) 8 else 4
     return rawFrames.filter { frame ->
-        val t = frame.histU8(typeIndex) ?: return@filter false
+        // ROUTING reads, bounded by the array itself, NOT by the D7 payload limit: these run on
+        // frames whose envelope may be broken, where the declared trailer position is exactly what
+        // cannot be trusted. Bounding them there would make an unreadable frame invisible to the
+        // archive — the opposite of what this evidence-preserving filter is for (D8).
+        val t = frame.histU8(typeIndex, frame.size) ?: return@filter false
         if (t != PacketType.HISTORICAL_DATA.rawValue) return@filter false // type-50 console / metadata / etc.
-        // WHOOP 5/MG v26 = raw PPG block with its own durable waveform stream, not rejected data.
-        if (family == DeviceFamily.WHOOP5 && frame.histU8(9) == 26) return@filter false
+        // WHOOP 5/MG v26 = raw PPG block with its own durable waveform stream — but only while the
+        // record is INTACT. Since the integrity gate a rejected v26 record banks no waveform either,
+        // so skipping it on the version byte alone would leave it stored nowhere while its section is
+        // acked anyway. Bind the skip to the verdict, not to the version. Twin of the Swift clause.
+        if (family == DeviceFamily.WHOOP5 && frame.histU8(9, frame.size) == 26) {
+            return@filter !Framing.parseFrame(frame, family).ok
+        }
         // UNMAPPED LAYOUT (5/MG) — archive UNCONDITIONALLY, whatever it decoded.
         //
         // The decode-outcome test below is the wrong QUESTION for a layout NOOP has no field map for.
@@ -649,12 +672,14 @@ sealed class HistoricalMeta {
  * additionally stores `unix` and `trim_cursor`. We match by prefix so a raw-value change can't
  * break the classifier.
  *
- * Integrity gate (kept from Swift): only act on a checksum-valid frame — without it a garbled or
- * forged BLE peer could forge HISTORY_END / HISTORY_COMPLETE and advance/ack the trim cursor for
- * data we never durably stored.
+ * Integrity gate (kept from Swift): only act on a frame whose FULL verdict is positive — header
+ * checksum, payload CRC32 and structural length together. Without it a garbled or forged BLE peer
+ * could forge HISTORY_END / HISTORY_COMPLETE and advance/ack the trim cursor for data we never
+ * durably stored, and the two classes that used to slip through (a broken header checksum, a frame
+ * so short its CRC32 could not be computed) are precisely the cheap ones to forge.
  */
 fun classifyHistoricalMeta(p: ParsedFrame): HistoricalMeta {
-    if (!p.ok || p.crcOk == false) return HistoricalMeta.Other
+    if (!p.ok) return HistoricalMeta.Other
     if (p.typeName != "METADATA") return HistoricalMeta.Other
     val metaName = p.parsed["meta_type"] as? String ?: return HistoricalMeta.Other
     return when {
@@ -808,7 +833,9 @@ fun extractHistoricalStreams(
 
     for (frame in rawFrames) {
         // Packet type byte: WHOOP 5/MG's longer puffin envelope puts it at frame[8]; WHOOP 4 at frame[4].
-        val t = if (family == DeviceFamily.WHOOP5) (frame.histU8(8) ?: -1)
+        // A ROUTING read on a not-yet-verified frame, so it is bounded by the array, not by the D7
+        // payload limit (see [rejectedHistoricalRecords]); each branch below applies the full verdict.
+        val t = if (family == DeviceFamily.WHOOP5) (frame.histU8(8, frame.size) ?: -1)
                 else if (frame.size > 4) frame[4].toInt() and 0xFF else -1
         when (t) {
             PacketType.HISTORICAL_DATA.rawValue -> {
@@ -820,8 +847,13 @@ fun extractHistoricalStreams(
                 // (sub-second resolution isn't needed — [PpgHr] indexes by sample position, not ts, and
                 // the emitted HR is per-second). The unix gets the same grossly-stale-RTC correction
                 // (FIX #72) as every other stream.
+                // ONE verdict for the whole type-47 branch. The v26 waveform below reads the record
+                // directly instead of going through [decodeHistorical], so without this gate an
+                // envelope-invalid frame could still bank PPG rows — the Swift twin gates its entire
+                // extraction loop on the parse verdict, ahead of the per-type branches.
+                if (!Framing.verifyFrame(frame, family).ok) continue
                 if (family == DeviceFamily.WHOOP5) {
-                    decodeWhoop5HistoricalV26(frame)?.let { rec ->
+                    decodeWhoop5HistoricalV26(frame, Framing.payloadLimit(frame, family))?.let { rec ->
                         // #547: skip a v26 PPG buffer whose unix is implausible (correctedWall → null) so a
                         // bad-clock strap can't seed the derived-HR estimator with garbage-timestamped samples.
                         val baseTs = correctedWall(rec.unix)
@@ -980,7 +1012,7 @@ fun extractHistoricalStreams(
                 // Framing decoder doesn't decode type-43 biometrics, so re-parse via parseFrame and
                 // read whatever timestamp/HR/RR it surfaced (typically none on this firmware).
                 val parsed = Framing.parseFrame(frame, family)
-                if (!parsed.ok || parsed.crcOk == false) continue
+                if (!parsed.ok) continue
                 val ts = wall(parsed.parsed.intOrNull("timestamp")) ?: continue
                 // #547: gate the wall()-corrected REALTIME_RAW_DATA ts on the same plausibility window — a
                 // bad device clock here would otherwise inject a far-past / future-dated HR/RR row.
@@ -999,7 +1031,7 @@ fun extractHistoricalStreams(
                 // wrist/charge/battery events aren't lost. During a backfill the live path is
                 // suppressed, so the offload extractor MUST handle these.
                 val parsed = Framing.parseFrame(frame, family)
-                if (!parsed.ok || parsed.crcOk == false) continue
+                if (!parsed.ok) continue
                 val rawTs = parsed.parsed.intOrNull("event_timestamp")?.toLong() ?: continue
                 val kind = (parsed.parsed["event"] as? String) ?: ""
                 // #547: correctedWall now nullable — an EVENT with an implausible event_timestamp is
@@ -1022,7 +1054,7 @@ fun extractHistoricalStreams(
             PacketType.COMMAND_RESPONSE.rawValue -> {
                 // No device timestamp on COMMAND_RESPONSE → stamp battery at wallClockRef (Swift parity).
                 val parsed = Framing.parseFrame(frame, family)
-                if (!parsed.ok || parsed.crcOk == false) continue
+                if (!parsed.ok) continue
                 appendHistBattery(battery, wallClockRef.toLong(), parsed.parsed)
             }
 
@@ -1043,7 +1075,7 @@ fun extractHistoricalStreams(
                     // unknown firmware feature on Android and not on Apple. A CRC failure is a different
                     // finding with its own archive (rejectedHistoricalRecords).
                     val parsed = Framing.parseFrame(frame, family)
-                    if (parsed.ok && parsed.crcOk != false) {
+                    if (parsed.ok) {
                         unhandledTypes[name] = (unhandledTypes[name] ?: 0) + 1
                     }
                 }
diff --git a/android/app/src/main/java/com/noop/protocol/ParsedFrame.kt b/android/app/src/main/java/com/noop/protocol/ParsedFrame.kt
index 51d85c8a49..247d78b18e 100644
--- a/android/app/src/main/java/com/noop/protocol/ParsedFrame.kt
+++ b/android/app/src/main/java/com/noop/protocol/ParsedFrame.kt
@@ -4,10 +4,17 @@ package com.noop.protocol
  * Result of decoding a single complete frame.
  *
  * Mirrors the Swift reference `ParsedFrame` reduced to the fields the Android app consumes:
- *  - [ok]: the envelope was well-formed (SOF present, minimum length). `false` for fragments.
- *  - [crcOk]: payload CRC32 outcome — `true`/`false` when verifiable, `null` when not enough bytes
- *    were present to check (mirrors Swift's optional `crcOK`). A non-`false` value is the integrity
- *    gate downstream code uses before trusting a frame.
+ *  - [ok]: the FULL integrity verdict of the frame verifier — header checksum, payload CRC32 and the
+ *    structural length together. It means "this frame is intact", NOT "this frame could be parsed":
+ *    a frame with a broken header still carries its decoded [typeName] and [parsed] fields for
+ *    inspection. This is the one gate a consumer has to ask.
+ *  - [crcOk]: payload CRC32 outcome ALONE — `true`/`false` when verifiable, `null` when not enough
+ *    bytes were present to check (mirrors Swift's optional `crcOK`). A diagnostic field: it says
+ *    nothing about the header checksum or the declared length, so it is not an integrity gate.
+ *  - [rejectReason]: why [ok] is false; [FrameRejectReason.NONE] exactly when [ok] is true. Carried
+ *    here so a consumer can report the cause from the value it was handed — the frame is parsed
+ *    exactly once and the result threaded on, so a consumer that had to verify again to learn the
+ *    reason would break that invariant.
  *  - [typeName]: canonical packet-type name (e.g. "REALTIME_DATA", "EVENT", "COMMAND_RESPONSE",
  *    "METADATA"), or "type{N}" / "INVALID/FRAGMENT" when unmapped/invalid.
  *  - [parsed]: a flat map of decoded fields. Values are plain Kotlin types (Int, Double, String,
@@ -19,10 +26,22 @@ data class ParsedFrame(
     val crcOk: Boolean?,
     val typeName: String,
     val parsed: Map<String, Any?>,
+    /**
+     * Defaulted to [FrameRejectReason.NONE] so a hand-built [ParsedFrame] (test fixtures, the
+     * capture-replay paths that construct one directly) stays valid without naming the new field —
+     * the Kotlin twin of the Swift decoder tolerating a missing `rejectReason`.
+     */
+    val rejectReason: FrameRejectReason = FrameRejectReason.NONE,
 ) {
     companion object {
-        /** A frame that could not be decoded (too short, wrong SOF, or a mid-stream fragment). */
-        fun invalid(): ParsedFrame =
-            ParsedFrame(ok = false, crcOk = null, typeName = "INVALID/FRAGMENT", parsed = emptyMap())
+        /**
+         * A frame that could not be decoded at all (too short, wrong SOF, or a mid-stream fragment).
+         * [reason] carries the verifier's verdict so even an undecodable byte run says WHY.
+         */
+        fun invalid(reason: FrameRejectReason): ParsedFrame =
+            ParsedFrame(
+                ok = false, crcOk = null, typeName = "INVALID/FRAGMENT", parsed = emptyMap(),
+                rejectReason = reason,
+            )
     }
 }
diff --git a/android/app/src/main/java/com/noop/protocol/Streams.kt b/android/app/src/main/java/com/noop/protocol/Streams.kt
index f591bb8b35..44406d50b5 100644
--- a/android/app/src/main/java/com/noop/protocol/Streams.kt
+++ b/android/app/src/main/java/com/noop/protocol/Streams.kt
@@ -306,12 +306,14 @@ private fun toWall(deviceTs: Int?, deviceClockRef: Int, wallClockRef: Int): Int?
  *
  * HR/R-R are taken ONLY from REALTIME_DATA (type 40). REALTIME_RAW_DATA (type 43) also carries an
  * HR byte but streams alongside type-40 during raw collection, so routing both would double-count
- * HR for the same instants. CRC-failed and non-ok frames are skipped.
+ * HR for the same instants. Frames whose full integrity verdict is negative are skipped — that is
+ * the header checksum, the payload CRC32 and the structural length together, not the payload CRC
+ * alone.
  */
 fun extractStreams(parsed: List<ParsedFrame>, deviceClockRef: Int, wallClockRef: Int): Streams {
     val out = Streams()
     for (r in parsed) {
-        if (!r.ok || r.crcOk == false) continue
+        if (!r.ok) continue
         val p = r.parsed
         when (r.typeName) {
             "REALTIME_DATA" -> {
diff --git a/android/app/src/main/java/com/noop/protocol/Whoop5Ecg.kt b/android/app/src/main/java/com/noop/protocol/Whoop5Ecg.kt
index 4d6b4947b6..a7a4254ce5 100644
--- a/android/app/src/main/java/com/noop/protocol/Whoop5Ecg.kt
+++ b/android/app/src/main/java/com/noop/protocol/Whoop5Ecg.kt
@@ -500,32 +500,21 @@ object Whoop5Ecg {
     }
 
     /**
-     * The inner record's payload from a complete 5/MG frame, or null when the frame fails either CRC or
-     * is too short. Every frame-level entry point goes through here, so no Labrador field is ever read
-     * out of an unverified frame.
+     * The inner record's payload from a complete 5/MG frame, or null when the frame fails the envelope
+     * check. Every frame-level entry point goes through here, so no Labrador field is ever read out of
+     * an unverified frame.
      *
-     * Both CRCs are checked here rather than through `Framing.parseFrame`, whose `crcOk` reports only
-     * the CRC32 payload check — this needs the same gate as the Swift `verifyFrame(_:family:).ok`, which
-     * is the CRC16 header check AND the CRC32 payload check.
+     * The verdict comes from the ONE central verifier ([Framing.verifyFrame]), not from a second
+     * inline copy of the envelope rules: this path used to re-derive them here with looser bounds
+     * (`declaredLength >= 4`, no exact-length check), so a truncated frame or one with trailing bytes
+     * was accepted here while its Swift twin — which has always delegated to the central verifier —
+     * rejected it. Two field logs disagreeing about the same bytes is exactly what the cross-platform
+     * contract forbids.
      */
     fun innerPayload(frame: ByteArray, payloadStart: Int = PUFFIN_PAYLOAD_START): List<Int>? {
-        if (frame.size < 12 || frame[0] != 0xAA.toByte()) return null
+        if (!Framing.frameCrcOk(frame, DeviceFamily.WHOOP5)) return null
         val declaredLength = (frame[2].toInt() and 0xFF) or ((frame[3].toInt() and 0xFF) shl 8)
-        if (declaredLength < 4) return null
-        val total = declaredLength + 8
-        if (frame.size < total) return null
-
-        // CRC16-Modbus over the first six header bytes, stored LE at frame[6..8].
-        val gotHeader = (frame[6].toInt() and 0xFF) or ((frame[7].toInt() and 0xFF) shl 8)
-        if (Crc.crc16Modbus(frame, 0, 6) != gotHeader) return null
-
-        val payloadEnd = total - 4                        // start of the CRC32 trailer
-        val gotCrc32 = (frame[payloadEnd].toLong() and 0xFFL) or
-            ((frame[payloadEnd + 1].toLong() and 0xFFL) shl 8) or
-            ((frame[payloadEnd + 2].toLong() and 0xFFL) shl 16) or
-            ((frame[payloadEnd + 3].toLong() and 0xFFL) shl 24)
-        if (Crc.crc32(frame, 8, payloadEnd) != gotCrc32) return null
-
+        val payloadEnd = declaredLength + 8 - 4           // start of the CRC32 trailer
         if (payloadStart < 0 || payloadStart >= payloadEnd) return null
         return (payloadStart until payloadEnd).map { frame[it].toInt() and 0xFF }
     }
diff --git a/android/app/src/test/java/com/noop/ble/FrameGateTest.kt b/android/app/src/test/java/com/noop/ble/FrameGateTest.kt
new file mode 100644
index 0000000000..2d8adc856d
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ble/FrameGateTest.kt
@@ -0,0 +1,235 @@
+package com.noop.ble
+
+import com.noop.protocol.Crc
+import com.noop.protocol.DeviceFamily
+import com.noop.protocol.FrameRejectReason
+import com.noop.protocol.Framing
+import com.noop.protocol.HistoricalMeta
+import com.noop.protocol.classifyHistoricalMeta
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * Scenario "Zustandstreibende Tore fordern das volle Urteil", Kotlin side — the app-layer half that
+ * `com.noop.protocol.FrameIntegrityTest` cannot cover, plus the ONE exemption from the payload bound.
+ *
+ * Every fixture is a protocol-correct HISTORY_END at the 25-byte size a real one has, broken in exactly
+ * ONE way, and each test asserts up front that the frame still DECODES as a HISTORY_END. Without that
+ * precondition a passing test would only prove that unreadable bytes are unreadable.
+ */
+class FrameGateTest {
+
+    private fun putU32LE(b: ByteArray, off: Int, v: Long) {
+        b[off] = (v and 0xFF).toByte()
+        b[off + 1] = ((v shr 8) and 0xFF).toByte()
+        b[off + 2] = ((v shr 16) and 0xFF).toByte()
+        b[off + 3] = ((v shr 24) and 0xFF).toByte()
+    }
+
+    private fun le32(v: Long): ByteArray {
+        val b = ByteArray(4); putU32LE(b, 0, v); return b
+    }
+
+    private fun whoop4Frame(inner: ByteArray): ByteArray {
+        val length = inner.size + 4
+        val out = ByteArray(inner.size + 8)
+        out[0] = 0xAA.toByte()
+        out[1] = (length and 0xFF).toByte()
+        out[2] = ((length shr 8) and 0xFF).toByte()
+        out[3] = Crc.crc8(byteArrayOf(out[1], out[2])).toByte()
+        inner.copyInto(out, 4)
+        putU32LE(out, length, Crc.crc32(inner))
+        return out
+    }
+
+    /** A protocol-correct WHOOP 4.0 HISTORY_END (METADATA 49, meta_type 2) carrying unix + trim cursor. */
+    private fun historyEndFrame(unix: Long = 1_700_000_000L, trim: Long = 70_476L): ByteArray =
+        whoop4Frame(byteArrayOf(49, 0, 2) + le32(unix) + byteArrayOf(0, 0) + le32(0) + le32(trim))
+
+    private fun stillDecodesAsHistoryEnd(frame: ByteArray) {
+        val p = Framing.parseFrame(frame, DeviceFamily.WHOOP4)
+        assertEquals("precondition: it still decodes as METADATA", "METADATA", p.typeName)
+        assertTrue(
+            "precondition: it still decodes as a HISTORY_END",
+            (p.parsed["meta_type"] as String).startsWith("HISTORY_END"),
+        )
+    }
+
+    // MARK: - the history-metadata classifier (3b.4: the offload drain against the changed classification)
+
+    /** Control: an intact HISTORY_END still closes a chunk and still yields its trim cursor. */
+    @Test
+    fun anIntactHistoryEndStillClassifiesAsAnEnd() {
+        val meta = classifyHistoricalMeta(Framing.parseFrame(historyEndFrame(), DeviceFamily.WHOOP4))
+        assertTrue(meta is HistoricalMeta.End)
+        assertEquals(70_476L, (meta as HistoricalMeta.End).trim)
+    }
+
+    /**
+     * A HISTORY_END with a broken header checksum must NOT advance the trim. The stake is the whole
+     * change: an END the app acts on acknowledges the strap, which frees the records it just sent.
+     */
+    @Test
+    fun aHistoryEndWithABrokenHeaderChecksumClassifiesAsNothing() {
+        val frame = historyEndFrame().also { it[3] = (it[3].toInt() xor 0xFF).toByte() }
+        stillDecodesAsHistoryEnd(frame)
+        val p = Framing.parseFrame(frame, DeviceFamily.WHOOP4)
+        assertEquals(FrameRejectReason.HEADER_CHECKSUM_MISMATCH, p.rejectReason)
+        assertEquals(HistoricalMeta.Other, classifyHistoricalMeta(p))
+    }
+
+    /** The same for trailing bytes and for a cut-off CRC32 trailer: both are envelope damage. */
+    @Test
+    fun aHistoryEndWithTrailingOrMissingBytesClassifiesAsNothing() {
+        val trailing = historyEndFrame() + byteArrayOf(0)
+        stillDecodesAsHistoryEnd(trailing)
+        assertEquals(
+            HistoricalMeta.Other,
+            classifyHistoricalMeta(Framing.parseFrame(trailing, DeviceFamily.WHOOP4)),
+        )
+
+        val truncated = historyEndFrame().copyOf(24)
+        stillDecodesAsHistoryEnd(truncated)
+        assertEquals(
+            HistoricalMeta.Other,
+            classifyHistoricalMeta(Framing.parseFrame(truncated, DeviceFamily.WHOOP4)),
+        )
+    }
+
+    /**
+     * A rejected END falls into the SAME classification bucket a plain record does, so the offload keeps
+     * accumulating it into the open chunk rather than dropping it — the evidence-preserving direction
+     * (D8). What it must not do is close the chunk or acknowledge.
+     */
+    @Test
+    fun aRejectedEndIsAccumulatedRatherThanActedOn() {
+        val frame = historyEndFrame().also { it[3] = (it[3].toInt() xor 0xFF).toByte() }
+        val meta = classifyHistoricalMeta(Framing.parseFrame(frame, DeviceFamily.WHOOP4))
+        assertFalse("it must not close a chunk", meta is HistoricalMeta.End)
+        assertFalse("nor end the session", meta is HistoricalMeta.Complete)
+        assertEquals(HistoricalMeta.Other, meta)
+    }
+
+    // MARK: - the acknowledgement block is EXEMPT from the payload bound (D7, decision 4)
+
+    /**
+     * The eight bytes the trim acknowledgement mirrors back to the strap reach INTO the CRC32 trailer by
+     * design: on the real 25-byte HISTORY_END the trailer starts at 21 and the block runs 17…25. It is an
+     * opaque echo, not a decoded field, so the payload bound that now clamps every named field must not
+     * touch it.
+     *
+     * Clamped to the trailer it would yield four bytes, and the strap would be acknowledged with a block
+     * it never sent — either it refuses the acknowledgement and the offload stops, or it trims on an
+     * altered block. Both are the permanent data loss this whole change exists to prevent, arriving
+     * through the fix rather than the bug. Twin of the Swift `BackfillMetaForgeryTests` pair.
+     */
+    @Test
+    fun theWhoop4AcknowledgementBlockIsEightBytesAndReachesIntoTheTrailer() {
+        val frame = historyEndFrame()
+        assertEquals("precondition: the real HISTORY_END size the exemption is about", 25, frame.size)
+        val declared = (frame[1].toInt() and 0xFF) or ((frame[2].toInt() and 0xFF) shl 8)
+        assertEquals("precondition: the CRC32 trailer starts at 21", 21, declared)
+
+        val endData = Backfiller.endData(frame, DeviceFamily.WHOOP4)
+        assertEquals("eight bytes, not the four a trailer clamp would leave", 8, endData?.size)
+        assertArrayEquals(
+            "…and exactly the bytes at 17…25, unaltered",
+            frame.copyOfRange(17, 25), endData,
+        )
+        assertNotEquals(
+            "a clamped-then-padded block is not the same echo",
+            (frame.copyOfRange(17, 21) + ByteArray(4)).toList(), endData!!.toList(),
+        )
+    }
+
+    /** The 5/MG twin of the same slice, so a later tidy-up cannot narrow one family and not the other. */
+    @Test
+    fun theWhoop5AcknowledgementBlockIsAlsoEightBytes() {
+        val frame = ByteArray(30) { (it + 1).toByte() }
+        val endData = Backfiller.endData(frame, DeviceFamily.WHOOP5)
+        assertEquals(8, endData?.size)
+        assertArrayEquals(frame.copyOfRange(21, 29), endData)
+    }
+
+    /**
+     * The guard the exemption does keep: a frame too short to hold the block yields null rather than a
+     * short read. Not-enough-bytes is a different answer from four-bytes-because-we-clamped.
+     */
+    @Test
+    fun aFrameTooShortForTheBlockYieldsNullRatherThanAShortRead() {
+        assertNull(Backfiller.endData(whoop4Frame(byteArrayOf(49, 0, 2)), DeviceFamily.WHOOP4))
+    }
+
+    // MARK: - the unbonded-offload probe (3b.3)
+
+    /** Control: an intact COMMAND_RESPONSE is still the strongest evidence the probe can collect. */
+    @Test
+    fun anIntactCommandResponseIsStillProof() {
+        assertEquals(
+            UnbondedProbeEvidence.ANSWERS_COMMANDS,
+            unbondedProbeEvidenceOf(ok = true, crcOk = true, typeName = "COMMAND_RESPONSE"),
+        )
+        assertEquals(
+            UnbondedProbeEvidence.SERVES_NOTIFICATIONS,
+            unbondedProbeEvidenceOf(ok = true, crcOk = true, typeName = "REALTIME_DATA"),
+        )
+    }
+
+    /**
+     * The changed evidence effect, pinned. Before the verdict widened, `ok` meant only "the envelope was
+     * well-formed", so a frame with a broken header checksum but a verifying payload CRC32 satisfied both
+     * conditions and counted as proof that the strap serves this link unbonded. It no longer does — and
+     * that is the direction the probe wants, because its output is a claim about the STRAP, while that
+     * frame class is exactly what a confused or foreign transmitter on a shared channel produces.
+     */
+    @Test
+    fun aFrameWithAVerifyingPayloadButABrokenEnvelopeIsNoLongerProof() {
+        val frame = historyEndFrame().also { it[3] = (it[3].toInt() xor 0xFF).toByte() }
+        val p = Framing.parseFrame(frame, DeviceFamily.WHOOP4)
+        assertEquals("precondition: its payload CRC32 verifies", true, p.crcOk)
+        assertFalse("precondition: but the full verdict is negative", p.ok)
+        assertEquals(
+            UnbondedProbeEvidence.NONE,
+            unbondedProbeEvidenceOf(ok = p.ok, crcOk = p.crcOk, typeName = p.typeName),
+        )
+    }
+
+    /** An unverifiable CRC32 was never a pass and still is not. */
+    @Test
+    fun anUnverifiableChecksumIsNotProof() {
+        assertEquals(
+            UnbondedProbeEvidence.NONE,
+            unbondedProbeEvidenceOf(ok = true, crcOk = null, typeName = "COMMAND_RESPONSE"),
+        )
+    }
+
+    // MARK: - the live-realtime filter
+
+    /**
+     * The batch anchor the live path stamps every HR sample against comes from the NEWEST realtime frame,
+     * so a frame admitted here misdates a whole batch. The filter used to read `ok && crcOk != false`,
+     * whose second half passed a frame whose CRC32 could not be computed at all; `ok` alone is now the
+     * stronger statement. Pinned on the predicate the client applies, so a later edit that loosens it
+     * back to the tri-state fails here.
+     */
+    @Test
+    fun onlyIntactRealtimeFramesCanAnchorALiveBatch() {
+        val realtime = whoop4Frame(byteArrayOf(40, 0, 0) + le32(1_700_000_000L) + byteArrayOf(0, 61, 0))
+        val intact = Framing.parseFrame(realtime, DeviceFamily.WHOOP4)
+        assertEquals("precondition: it decodes as live data", "REALTIME_DATA", intact.typeName)
+        assertTrue(intact.ok && intact.typeName == "REALTIME_DATA")
+
+        val broken = Framing.parseFrame(
+            realtime.copyOf().also { it[3] = (it[3].toInt() xor 0xFF).toByte() },
+            DeviceFamily.WHOOP4,
+        )
+        assertEquals("precondition: still a decoded live frame", "REALTIME_DATA", broken.typeName)
+        assertEquals("precondition: and its payload CRC32 verifies", true, broken.crcOk)
+        assertFalse("the widened verdict is what excludes it", broken.ok && broken.typeName == "REALTIME_DATA")
+    }
+}
diff --git a/android/app/src/test/java/com/noop/ble/FrameRejectDiagnosticsTest.kt b/android/app/src/test/java/com/noop/ble/FrameRejectDiagnosticsTest.kt
new file mode 100644
index 0000000000..0086b09d93
--- /dev/null
+++ b/android/app/src/test/java/com/noop/ble/FrameRejectDiagnosticsTest.kt
@@ -0,0 +1,296 @@
+package com.noop.ble
+
+import com.noop.protocol.BackfillCaptureJsonl
+import com.noop.protocol.BackfillCaptureRecord
+import com.noop.protocol.BackfillCaptureSummary
+import com.noop.protocol.Crc
+import com.noop.protocol.DeviceFamily
+import com.noop.protocol.FrameRejectReason
+import com.noop.protocol.Framing
+import com.noop.protocol.ParsedFrame
+import com.noop.protocol.Reassembler
+import com.noop.protocol.wireName
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * Scenario "Diagnose behält Parsbarkeit und Ablehnungsgrund", Kotlin side — the twin of the Swift
+ * `FrameDiagnosticsTests`.
+ *
+ * The property under test is the one that goes quiet unnoticed: after the gate widened, a rejected
+ * frame must still be COUNTED, must still name WHY, and must still carry the packet type the decoder
+ * read out of it. A capture that blanks the type of a corrupted frame throws away exactly the evidence
+ * it exists to collect, and a gate that drops frames without a counter reports a clean link.
+ *
+ * Every fixture is a protocol-correct frame broken in exactly ONE way, and each test asserts up front
+ * that the break is the one intended — otherwise a passing test would only prove that unreadable bytes
+ * are unreadable.
+ */
+class FrameRejectDiagnosticsTest {
+
+    // MARK: - frame builders (real checksums, never a placeholder)
+
+    private fun putU32LE(b: ByteArray, off: Int, v: Long) {
+        b[off] = (v and 0xFF).toByte()
+        b[off + 1] = ((v shr 8) and 0xFF).toByte()
+        b[off + 2] = ((v shr 16) and 0xFF).toByte()
+        b[off + 3] = ((v shr 24) and 0xFF).toByte()
+    }
+
+    private fun le32(v: Long): ByteArray {
+        val b = ByteArray(4); putU32LE(b, 0, v); return b
+    }
+
+    /** `[0xAA][len u16 LE][crc8(len)][inner…][crc32(inner) u32 LE]`, `len = inner.size + 4`. */
+    private fun whoop4Frame(inner: ByteArray): ByteArray {
+        val length = inner.size + 4
+        val out = ByteArray(inner.size + 8)
+        out[0] = 0xAA.toByte()
+        out[1] = (length and 0xFF).toByte()
+        out[2] = ((length shr 8) and 0xFF).toByte()
+        out[3] = Crc.crc8(byteArrayOf(out[1], out[2])).toByte()
+        inner.copyInto(out, 4)
+        putU32LE(out, length, Crc.crc32(inner))
+        return out
+    }
+
+    /**
+     * A protocol-correct WHOOP 4.0 HISTORY_END (METADATA type 49, meta_type 2) at the 25-byte size a real
+     * one has: `meta_type@6`, `unix@7`, `subsec@11`, `unk0@13`, `trim_cursor@17`.
+     */
+    private fun historyEndFrame(unix: Long = 1_700_000_000L, trim: Long = 70_476L): ByteArray =
+        whoop4Frame(byteArrayOf(49, 0, 2) + le32(unix) + byteArrayOf(0, 0) + le32(0) + le32(trim))
+
+    private fun parsed(frame: ByteArray): ParsedFrame = Framing.parseFrame(frame, DeviceFamily.WHOOP4)
+
+    // MARK: - the fixtures break exactly one rule each
+
+    @Test
+    fun theFixturesBreakTheRuleTheyClaimTo() {
+        assertEquals(25, historyEndFrame().size)
+        assertEquals(FrameRejectReason.NONE, parsed(historyEndFrame()).rejectReason)
+
+        val header = historyEndFrame().also { it[3] = (it[3].toInt() xor 0xFF).toByte() }
+        assertEquals(FrameRejectReason.HEADER_CHECKSUM_MISMATCH, parsed(header).rejectReason)
+
+        val trailing = historyEndFrame() + byteArrayOf(0)
+        assertEquals(FrameRejectReason.LENGTH_MISMATCH, parsed(trailing).rejectReason)
+
+        val payload = historyEndFrame().also { it[8] = (it[8].toInt() xor 0xFF).toByte() }
+        assertEquals(FrameRejectReason.PAYLOAD_CRC_MISMATCH, parsed(payload).rejectReason)
+    }
+
+    // MARK: - parseability is not integrity
+
+    /**
+     * The core of the requirement: a REJECTED frame keeps its decoded packet type. Blanking it would cost
+     * the capture the one thing the decoder did learn about a frame nobody can otherwise read.
+     */
+    @Test
+    fun aRejectedFrameKeepsItsPacketTypeAndIsStillParsable() {
+        val header = historyEndFrame().also { it[3] = (it[3].toInt() xor 0xFF).toByte() }
+        val p = parsed(header)
+        assertFalse("precondition: the verdict is negative", p.ok)
+        assertEquals("METADATA", p.typeName)
+        assertTrue("a rejected frame is still PARSABLE — a different question from intact", p.isParsable)
+        assertTrue(
+            "…and it still decoded its inner fields",
+            (p.parsed["meta_type"] as String).startsWith("HISTORY_END"),
+        )
+    }
+
+    /** Only a byte run that produced no type at all is unparsable. */
+    @Test
+    fun aByteRunWithNoStartOfFrameIsNotParsable() {
+        val p = parsed(byteArrayOf(0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B))
+        assertEquals(FrameRejectReason.NO_START_OF_FRAME, p.rejectReason)
+        assertEquals(UNPARSABLE_TYPE_NAME, p.typeName)
+        assertFalse(p.isParsable)
+    }
+
+    // MARK: - the named counter for the class that used to pass
+
+    /**
+     * The class the change closes, read as ONE number: the payload CRC32 verified while the envelope did
+     * not. No single reason bucket can express that conjunction — the length bucket in particular also
+     * collects the harmless resyncs after a lost notification — which is why it is counted separately.
+     */
+    @Test
+    fun theClassThatUsedToPassIsCountedSeparately() {
+        val header = historyEndFrame().also { it[3] = (it[3].toInt() xor 0xFF).toByte() }
+        val p = parsed(header)
+        assertEquals("precondition: its payload CRC32 DID verify", true, p.crcOk)
+        assertTrue(p.payloadCrcOkButEnvelopeRejected)
+
+        val tally = FrameRejectTally()
+        tally.note(p)
+        assertEquals(1, tally.payloadCrcOkButEnvelopeRejected)
+        assertEquals(1, tally.count(FrameRejectReason.HEADER_CHECKSUM_MISMATCH))
+    }
+
+    /** A trailing byte is the same class through a different reason — the conjunction, not the bucket. */
+    @Test
+    fun aTrailingByteAlsoCountsInTheNamedClass() {
+        val p = parsed(historyEndFrame() + byteArrayOf(0))
+        assertEquals(FrameRejectReason.LENGTH_MISMATCH, p.rejectReason)
+        assertEquals(true, p.crcOk)
+        val tally = FrameRejectTally()
+        tally.note(p)
+        assertEquals(1, tally.payloadCrcOkButEnvelopeRejected)
+    }
+
+    /** A broken payload is NOT that class: the envelope is fine, the CRC32 is the thing that disagreed. */
+    @Test
+    fun aBrokenPayloadIsNotTheNamedClass() {
+        val p = parsed(historyEndFrame().also { it[8] = (it[8].toInt() xor 0xFF).toByte() })
+        val tally = FrameRejectTally()
+        tally.note(p)
+        assertEquals(1, tally.count(FrameRejectReason.PAYLOAD_CRC_MISMATCH))
+        assertEquals(0, tally.payloadCrcOkButEnvelopeRejected)
+    }
+
+    // MARK: - "could not be checked" is not "was wrong"
+
+    /**
+     * A truncated frame's CRC32 cannot be computed at all. The tally must not turn that silence into the
+     * stronger claim that the checksum disagreed — a diagnostic may only assert what it observed.
+     */
+    @Test
+    fun anUncomputableChecksumIsNeverReportedAsAMismatch() {
+        val truncated = historyEndFrame().copyOf(24)
+        val p = parsed(truncated)
+        assertNull("precondition: there were not enough bytes to check", p.crcOk)
+        val tally = FrameRejectTally()
+        tally.note(p)
+        assertEquals(0, tally.count(FrameRejectReason.PAYLOAD_CRC_MISMATCH))
+        assertEquals(1, tally.count(FrameRejectReason.LENGTH_MISMATCH))
+        assertFalse("…and it is not the named class either", p.payloadCrcOkButEnvelopeRejected)
+    }
+
+    // MARK: - the tally itself
+
+    @Test
+    fun intactFramesAreNotCounted() {
+        val tally = FrameRejectTally()
+        assertEquals(FrameRejectReason.NONE, tally.note(parsed(historyEndFrame())))
+        assertEquals(0, tally.totalRejected)
+        assertNull("nothing rejected ⇒ no line at all, not a '0 rejections' line", tally.summaryLine())
+    }
+
+    /**
+     * A byte run dropped INSIDE the reassembler never reaches a parser, so its monotonic count is folded
+     * in. The fold takes only the growth since the last call, so a per-notification caller cannot
+     * double-count.
+     */
+    @Test
+    fun reassemblerDropsAreFoldedInOnceEach() {
+        val reassembler = Reassembler(DeviceFamily.WHOOP4)
+        // A declared total of 2 + 4 = 6, below the 11-byte WHOOP 4.0 minimum: dropped, never emitted.
+        assertTrue(reassembler.feed(byteArrayOf(0xAA.toByte(), 0x02, 0x00, 0x00, 0x00)).isEmpty())
+        assertEquals(1, reassembler.belowMinimumLengthDrops)
+
+        val tally = FrameRejectTally()
+        tally.absorbReassemblerDrops(reassembler.belowMinimumLengthDrops)
+        tally.absorbReassemblerDrops(reassembler.belowMinimumLengthDrops)   // idempotent
+        assertEquals(1, tally.count(FrameRejectReason.BELOW_MINIMUM_LENGTH))
+
+        assertTrue(reassembler.feed(byteArrayOf(0xAA.toByte(), 0x02, 0x00, 0x00, 0x00)).isEmpty())
+        tally.absorbReassemblerDrops(reassembler.belowMinimumLengthDrops)
+        assertEquals(2, tally.count(FrameRejectReason.BELOW_MINIMUM_LENGTH))
+        assertEquals(2, tally.totalRejected)
+    }
+
+    /** The readout names every reason that occurred, in the Swift spelling, plus the named class. */
+    @Test
+    fun theSummaryLineNamesEveryReasonInTheSwiftSpelling() {
+        val tally = FrameRejectTally()
+        tally.note(parsed(historyEndFrame().also { it[3] = (it[3].toInt() xor 0xFF).toByte() }))
+        tally.note(parsed(historyEndFrame().also { it[8] = (it[8].toInt() xor 0xFF).toByte() }))
+        assertEquals(
+            "frameReject total=2 headerChecksumMismatch=1 payloadCRCMismatch=1 " +
+                "payloadCRCOKButEnvelopeRejected=1",
+            tally.summaryLine(),
+        )
+    }
+
+    @Test
+    fun resetClearsEverything() {
+        val tally = FrameRejectTally()
+        tally.note(parsed(historyEndFrame().also { it[3] = (it[3].toInt() xor 0xFF).toByte() }))
+        tally.absorbReassemblerDrops(3)
+        tally.reset()
+        assertEquals(0, tally.totalRejected)
+        assertEquals(0, tally.payloadCrcOkButEnvelopeRejected)
+        assertNull(tally.summaryLine())
+        // A fold after reset starts from zero again, so the next link's first drop is not swallowed.
+        tally.absorbReassemblerDrops(1)
+        assertEquals(1, tally.count(FrameRejectReason.BELOW_MINIMUM_LENGTH))
+    }
+
+    /** The wire spellings are the Swift `rawValue`s, so two field reports read alike. */
+    @Test
+    fun everyReasonHasTheSwiftWireSpelling() {
+        assertEquals(
+            listOf(
+                "none", "noStartOfFrame", "belowMinimumLength", "lengthMismatch",
+                "headerChecksumMismatch", "payloadCRCMismatch", "payloadCRCUnverifiable",
+            ),
+            FrameRejectReason.entries.map { it.wireName },
+        )
+    }
+
+    // MARK: - the capture export
+
+    /**
+     * The capture record keeps the packet type of a rejected frame AND gains the reason. Additive: every
+     * key the old format carried is still there, in the same place.
+     */
+    @Test
+    fun theCaptureRecordKeepsTheTypeAndAddsTheReason() {
+        val p = parsed(historyEndFrame().also { it[3] = (it[3].toInt() xor 0xFF).toByte() })
+        val line = BackfillCaptureJsonl.encode(
+            BackfillCaptureRecord(
+                capturedAtMs = 1L, sessionId = "s", characteristic = "c",
+                typeName = p.typeName, crcOk = p.crcOk, offload = false, size = 25,
+                parsed = emptyMap(), hex = "aa", rejectReason = p.rejectReason,
+            ),
+        )
+        assertTrue("the packet type survives the rejection", line.contains("\"type_name\":\"METADATA\""))
+        assertTrue(line.contains("\"reject_reason\":\"headerChecksumMismatch\""))
+        assertTrue("…and the old keys are untouched", line.contains("\"crc_ok\":true"))
+    }
+
+    /**
+     * An INTACT frame's line is byte-identical to the previous format: no reason, no key. That is what
+     * makes the field additive rather than a format change — every pinned golden line and every existing
+     * reader keeps working, and "key absent ⇒ none" is exactly what the Swift decoder does with it.
+     */
+    @Test
+    fun anIntactFrameAddsNoKeyAtAll() {
+        val line = BackfillCaptureJsonl.encode(
+            BackfillCaptureRecord(
+                capturedAtMs = 1L, sessionId = "s", characteristic = "c", typeName = "EVENT",
+                crcOk = true, offload = false, size = 11, parsed = emptyMap(), hex = "aa",
+            ),
+        )
+        assertFalse(line.contains("reject_reason"))
+        assertTrue("…and the record still ends where it did", line.endsWith("\"hex\":\"aa\"}"))
+    }
+
+    /**
+     * The unknown-type samples are what a mapper reads first, and "an unmappable type" and "a corrupted
+     * copy of a type we know" are indistinguishable from the hex alone.
+     */
+    @Test
+    fun theCaptureSummarySampleNamesTheReason() {
+        val summary = BackfillCaptureSummary()
+        summary.record("type99", false, 30, "fd4b0003", "aabb", FrameRejectReason.PAYLOAD_CRC_MISMATCH)
+        val text = summary.unknownSamplesText()
+        assertTrue(text.contains("type99"))
+        assertTrue(text.contains("reject=payloadCRCMismatch"))
+        assertEquals("type99=1", summary.countsText())
+    }
+}
diff --git a/android/app/src/test/java/com/noop/ble/Whoop5OffloadTest.kt b/android/app/src/test/java/com/noop/ble/Whoop5OffloadTest.kt
index 0739780bad..dc1d25e697 100644
--- a/android/app/src/test/java/com/noop/ble/Whoop5OffloadTest.kt
+++ b/android/app/src/test/java/com/noop/ble/Whoop5OffloadTest.kt
@@ -1,5 +1,6 @@
 package com.noop.ble
 
+import com.noop.protocol.Crc
 import com.noop.protocol.DeviceFamily
 import com.noop.protocol.Framing
 import org.junit.Assert.assertArrayEquals
@@ -26,6 +27,32 @@ class Whoop5OffloadTest {
         this[off + 3] = ((v shr 24) and 0xFF).toByte()
     }
 
+    /**
+     * Seal a hand-built WHOOP 5.0/MG frame: declared length, header CRC-16-Modbus and the payload
+     * CRC32 trailer, in place.
+     *
+     * A fixture that leaves those three at zero is not a frame the strap could ever send. It used to
+     * decode anyway, because field reads were clamped against the array size alone; now they are
+     * clamped against the start of the CRC32 trailer, which is derived from the DECLARED length — and
+     * a declared length of zero puts that boundary at offset 4, i.e. in front of every inner field.
+     * Sealing keeps the assertions below about the 5/MG +4 field layout rather than about how far a
+     * decoder will read into an unsealed buffer. Same shape as `FrameIntegrityTest.whoop5Frame` and
+     * `Whoop5RawOpticalTest.reseal`.
+     */
+    private fun sealWhoop5(frame: ByteArray): ByteArray {
+        frame[0] = 0xAA.toByte()
+        frame[1] = 0x01
+        val declLen = frame.size - 8      // payload + the 4-byte CRC32 trailer
+        frame[2] = (declLen and 0xFF).toByte()
+        frame[3] = ((declLen shr 8) and 0xFF).toByte()
+        val headerCrc = Crc.crc16Modbus(frame, 0, 6)
+        frame[6] = (headerCrc and 0xFF).toByte()
+        frame[7] = ((headerCrc shr 8) and 0xFF).toByte()
+        val payloadEnd = frame.size - 4
+        frame.putU32LE(payloadEnd, Crc.crc32(frame, 8, payloadEnd))
+        return frame
+    }
+
     // ---- isOffloadFrame: family-aware type index + the 56 accept-set ----
 
     @Test
@@ -84,13 +111,14 @@ class Whoop5OffloadTest {
     @Test
     fun parsesWhoop5HistoryEndMetadata() {
         val f = ByteArray(30)
-        f[0] = 0xAA.toByte()
         f[8] = 56            // PUFFIN_METADATA -> typeName "METADATA"
         f[10] = 2            // meta_type = HISTORY_END(2)
         f.putU32LE(11, 1_780_916_150L)  // unix (the real worn-frame timestamp)
         f.putU32LE(21, 112_193L)        // trim_cursor (the real HISTORY_END trim, Swift Whoop5HistoricalTests)
+        sealWhoop5(f)                   // declared length 22, header CRC-16, payload CRC32 over [8,26)
 
         val p = Framing.parseFrame(f, DeviceFamily.WHOOP5)
+        assertTrue("the sealed fixture must pass the full verdict", p.ok)
         assertEquals("METADATA", p.typeName)
         assertTrue((p.parsed["meta_type"] as String).startsWith("HISTORY_END"))
         assertEquals(1_780_916_150, p.parsed["unix"])
diff --git a/android/app/src/test/java/com/noop/protocol/FrameIntegrityOracleTest.kt b/android/app/src/test/java/com/noop/protocol/FrameIntegrityOracleTest.kt
new file mode 100644
index 0000000000..0ff135bd84
--- /dev/null
+++ b/android/app/src/test/java/com/noop/protocol/FrameIntegrityOracleTest.kt
@@ -0,0 +1,208 @@
+package com.noop.protocol
+
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * SHARED FRAME-INTEGRITY ORACLE — the Kotlin half of a Swift <-> Kotlin drift guard for the
+ * `frame-integrity` capability (requirement "Plattformgleichheit des Integritätsurteils", D5).
+ *
+ * `src/test/resources/frame_integrity_oracle.json` holds one line per frame with the three values the
+ * two platforms must agree on: the verifier's FULL verdict, the rejection reason, and the historical
+ * metadata classification. The IDENTICAL file is committed at
+ * `Packages/WhoopProtocol/Tests/WhoopProtocolTests/Resources/frame_integrity_oracle.json`, where
+ * `FrameIntegrityOracleTests.swift` asserts the same lines through the Swift `parseFrame` /
+ * `classifyHistoricalMeta`.
+ *
+ * Why a shared file rather than two per-platform suites: both platforms already had their own
+ * integrity tests, and both were green while this platform's ECG payload path still applied the older,
+ * looser envelope bounds. Each suite asserted its own answer, so nothing compared the two answers.
+ * This does, over every case and every field.
+ *
+ * The file is GENERATED by a standalone Swift run (`openspec/changes/frame-integrity/oracle-gen`) —
+ * never hand-written, and never to be edited here. If this test goes red, either Kotlin moved or Swift
+ * moved; find out which before regenerating.
+ *
+ * Deliberately NOT pinned: the export spelling of a reason. [BackfillCaptureRecord] omits the
+ * `reject_reason` key when there is no reason so an intact frame's capture line stays byte-identical,
+ * while Swift's `Codable` always writes it. That is a textual difference in a different artefact; the
+ * oracle pins the judgement, not the serialisation.
+ *
+ * Deliberately absent: a [FrameRejectReason.PAYLOAD_CRC_UNVERIFIABLE] line. The structural rules run
+ * first on BOTH platforms, so no byte run can reach that branch — it is defence in depth, and
+ * inventing a case for it would mean inventing an input that cannot exist.
+ */
+class FrameIntegrityOracleTest {
+
+    private fun loadOracle(): JSONObject {
+        val stream = javaClass.classLoader!!.getResourceAsStream(ORACLE_RESOURCE)
+        assertNotNull("$ORACLE_RESOURCE missing from the test classpath", stream)
+        return JSONObject(stream!!.bufferedReader().use { it.readText() })
+    }
+
+    private fun hexToBytes(s: String): ByteArray =
+        ByteArray(s.length / 2) {
+            ((s[it * 2].digitToInt(16) shl 4) or s[it * 2 + 1].digitToInt(16)).toByte()
+        }
+
+    private fun bytesToHex(b: List<Int>): String = b.joinToString("") { "%02x".format(it and 0xFF) }
+
+    private fun familyOf(name: String): DeviceFamily = when (name) {
+        "whoop4" -> DeviceFamily.WHOOP4
+        "whoop5" -> DeviceFamily.WHOOP5
+        else -> throw AssertionError("unknown family $name in the oracle")
+    }
+
+    /**
+     * The classification rendered exactly as the generator renders it, so one string compares three
+     * possible shapes (case, and for an end its unix + trim) without a second decoding rule.
+     */
+    private fun metaLabel(p: ParsedFrame): String = when (val m = classifyHistoricalMeta(p)) {
+        is HistoricalMeta.Start -> "start"
+        is HistoricalMeta.Complete -> "complete"
+        is HistoricalMeta.Other -> "other"
+        is HistoricalMeta.End -> "end(unix=${m.unix},trim=${m.trim})"
+    }
+
+    // MARK: - the three pinned fields, every case
+
+    @Test
+    fun everyOracleCaseMatchesTheSharedExpectation() {
+        val cases = loadOracle().getJSONArray("cases")
+        assertTrue("an empty oracle would assert nothing", cases.length() > 0)
+        for (i in 0 until cases.length()) {
+            val c = cases.getJSONObject(i)
+            val name = c.getString("name")
+            val parsed = Framing.parseFrame(hexToBytes(c.getString("hex")), familyOf(c.getString("family")))
+            assertEquals("verdict for $name", c.getBoolean("verdict"), parsed.ok)
+            assertEquals("reject reason for $name", c.getString("reject_reason"), parsed.rejectReason.wireName)
+            assertEquals("historical-metadata classification for $name", c.getString("meta"), metaLabel(parsed))
+            // The reason and the verdict are one statement, not two that could drift apart.
+            assertEquals(
+                "$name: ok must hold exactly when the reason is NONE",
+                parsed.ok,
+                parsed.rejectReason == FrameRejectReason.NONE,
+            )
+        }
+    }
+
+    /**
+     * Scenario "Der zweite verifizierende Pfad ist mit abgedeckt": the ECG payload accessor is the
+     * other place a frame envelope is judged, so the oracle carries its answer too. This is the path
+     * that used to re-derive the envelope rules inline with looser bounds.
+     */
+    @Test
+    fun everyEcgPathCaseMatchesTheSharedExpectation() {
+        val cases = loadOracle().getJSONArray("cases")
+        var seen = 0
+        for (i in 0 until cases.length()) {
+            val c = cases.getJSONObject(i)
+            if (!c.getBoolean("ecg_path")) continue
+            seen++
+            val name = c.getString("name")
+            val expected = if (c.isNull("ecg_inner_payload_hex")) null else c.getString("ecg_inner_payload_hex")
+            val actual = Whoop5Ecg.innerPayload(hexToBytes(c.getString("hex")))?.let { bytesToHex(it) }
+            assertEquals("ECG inner payload for $name", expected, actual)
+        }
+        assertTrue("the second verifying path must stay covered", seen > 0)
+    }
+
+    // MARK: - self-defence: the oracle cannot silently stop covering something
+
+    @Test
+    fun oracleCoverageManifestMatchesTheCases() {
+        val oracle = loadOracle()
+        val coverage = oracle.getJSONObject("coverage")
+        val cases = oracle.getJSONArray("cases")
+        assertEquals("case_count", coverage.getInt("case_count"), cases.length())
+
+        val names = mutableSetOf<String>()
+        val classes = mutableMapOf<String, Int>()
+        val reasons = mutableMapOf<String, Int>()
+        val metas = mutableSetOf<String>()
+        val families = mutableSetOf<Pair<String, Boolean>>()
+        for (i in 0 until cases.length()) {
+            val c = cases.getJSONObject(i)
+            names += c.getString("name")
+            classes[c.getString("class")] = (classes[c.getString("class")] ?: 0) + 1
+            reasons[c.getString("reject_reason")] = (reasons[c.getString("reject_reason")] ?: 0) + 1
+            metas += c.getString("meta")
+            families += c.getString("family") to c.getBoolean("verdict")
+        }
+        assertEquals("case names must be unique", cases.length(), names.size)
+
+        val declaredClasses = coverage.getJSONObject("classes")
+        assertEquals("class count", declaredClasses.length(), classes.size)
+        for (k in declaredClasses.keys()) assertEquals("class $k", declaredClasses.getInt(k), classes[k])
+        val declaredReasons = coverage.getJSONObject("reasons")
+        assertEquals("reason count", declaredReasons.length(), reasons.size)
+        for (k in declaredReasons.keys()) assertEquals("reason $k", declaredReasons.getInt(k), reasons[k])
+
+        // The input classes task 4.1 names. Losing one would leave the oracle green and blind.
+        for (required in listOf(
+            "valid_recorded", "header_corrupt", "payload_corrupt", "below_minimum",
+            "truncated", "trailing_bytes", "boundary", "no_start_of_frame",
+            "evaluation_order", "ecg_path",
+        )) {
+            assertTrue("input class $required is not covered", (classes[required] ?: 0) > 0)
+        }
+        // Both families, on both sides of the verdict.
+        for (fam in listOf("whoop4", "whoop5")) {
+            assertTrue("no accepted $fam frame in the oracle", families.contains(fam to true))
+            assertTrue("no rejected $fam frame in the oracle", families.contains(fam to false))
+        }
+        // Every reachable reason. PAYLOAD_CRC_UNVERIFIABLE is unreachable on both platforms and is
+        // therefore absent by design — asserting it here would demand an impossible input.
+        for (reason in FrameRejectReason.values()) {
+            if (reason == FrameRejectReason.PAYLOAD_CRC_UNVERIFIABLE) continue
+            assertTrue("reason ${reason.wireName} is not covered", (reasons[reason.wireName] ?: 0) > 0)
+        }
+        assertNull(
+            "PAYLOAD_CRC_UNVERIFIABLE cannot be produced by any input — a line claiming it is wrong",
+            reasons[FrameRejectReason.PAYLOAD_CRC_UNVERIFIABLE.wireName],
+        )
+        // Each historical-metadata outcome, since that is the third pinned field.
+        assertTrue(metas.contains("start"))
+        assertTrue(metas.contains("complete"))
+        assertTrue(metas.contains("other"))
+        assertTrue(metas.any { it.startsWith("end(") })
+    }
+
+    /**
+     * The Android and Swift copies MUST be byte-identical, so neither platform can edit its fixture
+     * without the other. The Android copy is read off the test classpath; the Swift copy lives in the
+     * source tree, located relative to the `user.dir` the JVM test runner is launched from. Skips
+     * gracefully (passes) if the Swift tree is not present.
+     */
+    @Test
+    fun oracleCopiesAreIdentical() {
+        val androidBytes = javaClass.classLoader!!
+            .getResourceAsStream(ORACLE_RESOURCE)!!
+            .use { it.readBytes() }
+
+        // Gradle runs unit tests with the module dir (android/app) or repo root as user.dir; try both.
+        val userDir = java.io.File(System.getProperty("user.dir") ?: ".")
+        val candidates = listOf(
+            java.io.File(userDir, SWIFT_COPY),
+            java.io.File(userDir, "../../$SWIFT_COPY"),
+        )
+        val swiftFile = candidates.firstOrNull { it.exists() }
+        org.junit.Assume.assumeTrue(
+            "swift oracle copy not found from user.dir=$userDir — skipping cross-copy identity check",
+            swiftFile != null,
+        )
+        assertTrue(
+            "$ORACLE_RESOURCE copies differ — keep the Android and Swift copies in lockstep",
+            androidBytes.contentEquals(swiftFile!!.readBytes()),
+        )
+    }
+
+    private companion object {
+        const val ORACLE_RESOURCE = "frame_integrity_oracle.json"
+        const val SWIFT_COPY = "Packages/WhoopProtocol/Tests/WhoopProtocolTests/Resources/frame_integrity_oracle.json"
+    }
+}
diff --git a/android/app/src/test/java/com/noop/protocol/FrameIntegrityTest.kt b/android/app/src/test/java/com/noop/protocol/FrameIntegrityTest.kt
new file mode 100644
index 0000000000..01b9ae6d26
--- /dev/null
+++ b/android/app/src/test/java/com/noop/protocol/FrameIntegrityTest.kt
@@ -0,0 +1,768 @@
+package com.noop.protocol
+
+import com.noop.data.StreamBatch
+import com.noop.ingest.CaptureImporter
+import org.json.JSONObject
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * FRAME INTEGRITY — the Kotlin half of the cross-platform verdict contract.
+ *
+ * The frame verifier is the ONE place that decides whether bytes off the air may drive state. For
+ * the same bytes this side must reach the same verdict, name the same reason and reach the same
+ * historical classification as the Swift `WhoopProtocol` twin (`Framing.swift` / `Interpreter.swift`),
+ * because the two are independent reimplementations rather than shared code.
+ *
+ * What the rules are, in the order the verifier applies them:
+ *  1. start of frame (0xAA),
+ *  2. the family minimum — 11 bytes on WHOOP 4.0, 13 on WHOOP 5.0/MG,
+ *  3. the EXACT total the declared length implies (`len + 4` / `declLen + 8`), so a truncated frame
+ *     and one carrying trailing bytes are both rejected,
+ *  4. the header checksum (CRC-8 / CRC-16-Modbus),
+ *  5. the payload CRC32 — where "could not be computed" is a REJECTION, never an "unknown" a gate
+ *     might read as a pass.
+ *
+ * Reason names map one-to-one onto the Swift enum: `none` ↔ [FrameRejectReason.NONE],
+ * `noStartOfFrame` ↔ [FrameRejectReason.NO_START_OF_FRAME], `belowMinimumLength` ↔
+ * [FrameRejectReason.BELOW_MINIMUM_LENGTH], `lengthMismatch` ↔ [FrameRejectReason.LENGTH_MISMATCH],
+ * `headerChecksumMismatch` ↔ [FrameRejectReason.HEADER_CHECKSUM_MISMATCH], `payloadCRCMismatch` ↔
+ * [FrameRejectReason.PAYLOAD_CRC_MISMATCH], `payloadCRCUnverifiable` ↔
+ * [FrameRejectReason.PAYLOAD_CRC_UNVERIFIABLE].
+ */
+class FrameIntegrityTest {
+
+    // MARK: - frame builders (real checksums, never a placeholder)
+
+    private fun putU32LE(b: ByteArray, off: Int, v: Long) {
+        b[off] = (v and 0xFF).toByte()
+        b[off + 1] = ((v shr 8) and 0xFF).toByte()
+        b[off + 2] = ((v shr 16) and 0xFF).toByte()
+        b[off + 3] = ((v shr 24) and 0xFF).toByte()
+    }
+
+    /**
+     * `[0xAA][len u16 LE][crc8(len)][inner…][crc32(inner) u32 LE]`, `len = inner.size + 4`, total
+     * `len + 4`. An inner record of 3 bytes yields the 11-byte family minimum.
+     */
+    private fun whoop4Frame(inner: ByteArray): ByteArray {
+        val length = inner.size + 4
+        val out = ByteArray(inner.size + 8)
+        out[0] = 0xAA.toByte()
+        out[1] = (length and 0xFF).toByte()
+        out[2] = ((length shr 8) and 0xFF).toByte()
+        out[3] = Crc.crc8(byteArrayOf(out[1], out[2])).toByte()
+        inner.copyInto(out, 4)
+        putU32LE(out, length, Crc.crc32(inner))
+        return out
+    }
+
+    /**
+     * `[0xAA][0x01][declLen u16 LE][hdr u16][crc16 u16][payload…][crc32(payload) u32 LE]`,
+     * `declLen = payload.size + 4`, total `declLen + 8`. A 1-byte payload yields the 13-byte minimum.
+     */
+    private fun whoop5Frame(payload: ByteArray): ByteArray {
+        val declLen = payload.size + 4
+        val out = ByteArray(payload.size + 12)
+        out[0] = 0xAA.toByte()
+        out[1] = 0x01
+        out[2] = (declLen and 0xFF).toByte()
+        out[3] = ((declLen shr 8) and 0xFF).toByte()
+        out[4] = 0x00
+        out[5] = 0x01
+        val c16 = Crc.crc16Modbus(out, 0, 6)
+        out[6] = (c16 and 0xFF).toByte()
+        out[7] = ((c16 shr 8) and 0xFF).toByte()
+        payload.copyInto(out, 8)
+        putU32LE(out, 8 + payload.size, Crc.crc32(out, 8, 8 + payload.size))
+        return out
+    }
+
+    /** A complete, valid WHOOP 4.0 REALTIME_DATA frame: ts@6, subsec@10, hr@12, rr_count@13. */
+    private fun realtimeWhoop4(ts: Long = 1_780_916_150L, hr: Int = 61): ByteArray {
+        val inner = ByteArray(10)
+        inner[0] = PacketType.REALTIME_DATA.rawValue.toByte()
+        inner[1] = 0            // seq
+        inner[2] = 0            // cmd
+        putU32LE(inner, 2, ts)  // ts@6 == inner[2]
+        inner[8] = hr.toByte()  // hr@12 == inner[8]
+        inner[9] = 0            // rr_count@13
+        return whoop4Frame(inner)
+    }
+
+    /** A complete, valid WHOOP 4.0 type-47 HISTORICAL_DATA v24 record (the archive's subject). */
+    private fun historicalWhoop4(): ByteArray = hexToBytes(realFrameHex("whoop4_v24_real_worn"))
+
+    private fun hexToBytes(s: String): ByteArray =
+        ByteArray(s.length / 2) { ((s[it * 2].digitToInt(16) shl 4) or s[it * 2 + 1].digitToInt(16)).toByte() }
+
+    private fun oracle(): JSONObject {
+        val stream = javaClass.classLoader!!.getResourceAsStream("decoder_oracle.json")
+        assertNotNull("decoder_oracle.json missing from test classpath", stream)
+        return JSONObject(stream!!.bufferedReader().use { it.readText() })
+    }
+
+    private fun realFrameHex(name: String): String {
+        val frames = oracle().getJSONArray("frames")
+        for (i in 0 until frames.length()) {
+            val f = frames.getJSONObject(i)
+            if (f.getString("name") == name) return f.getString("hex")
+        }
+        throw AssertionError("fixture frame '$name' missing from decoder_oracle.json")
+    }
+
+    /** Flip one bit in the frame's header checksum byte — the class that used to pass every gate. */
+    private fun breakHeaderChecksum(frame: ByteArray, family: DeviceFamily): ByteArray {
+        val out = frame.copyOf()
+        val at = if (family == DeviceFamily.WHOOP5) 6 else 3
+        out[at] = (out[at].toInt() xor 0x01).toByte()
+        return out
+    }
+
+    // MARK: - Full integrity verdict in the parse result
+
+    @Test
+    fun whoop4_headerChecksumWrong_payloadCrcRight_isRejected() {
+        val good = realtimeWhoop4()
+        assertTrue(Framing.parseFrame(good, DeviceFamily.WHOOP4).ok)
+
+        val bad = breakHeaderChecksum(good, DeviceFamily.WHOOP4)
+        val p = Framing.parseFrame(bad, DeviceFamily.WHOOP4)
+        assertFalse("a broken header checksum is a rejection, even with a correct payload CRC", p.ok)
+        assertEquals(FrameRejectReason.HEADER_CHECKSUM_MISMATCH, p.rejectReason)
+        // The payload CRC32 itself is still right — that combination is exactly the class that used
+        // to reach the gates, so it must stay observable rather than be flattened into the verdict.
+        assertEquals(true, p.crcOk)
+    }
+
+    @Test
+    fun whoop5_headerChecksumWrong_payloadCrcRight_isRejected() {
+        val good = hexToBytes(realFrameHex("whoop5_v18_real_worn"))
+        assertTrue(Framing.parseFrame(good, DeviceFamily.WHOOP5).ok)
+
+        val bad = breakHeaderChecksum(good, DeviceFamily.WHOOP5)
+        val p = Framing.parseFrame(bad, DeviceFamily.WHOOP5)
+        assertFalse(p.ok)
+        assertEquals(FrameRejectReason.HEADER_CHECKSUM_MISMATCH, p.rejectReason)
+        assertEquals(true, p.crcOk)
+    }
+
+    @Test
+    fun payloadCrcNotComputable_isNegative_notUnknown() {
+        // Too short for the payload CRC32 to be computed at all. The verdict must be NEGATIVE — the
+        // "unknown" tri-state is what let these through before, since every gate only asked whether
+        // the CRC was DEMONSTRABLY wrong.
+        val runt = byteArrayOf(0xAA.toByte(), 0x08, 0x00, 0x00, 0x28, 0x00, 0x00)
+        val p = Framing.parseFrame(runt, DeviceFamily.WHOOP4)
+        assertFalse(p.ok)
+        assertNull("nothing to check is not a check that passed", p.crcOk)
+        assertEquals(FrameRejectReason.BELOW_MINIMUM_LENGTH, p.rejectReason)
+    }
+
+    @Test
+    fun validFrame_carriesPositiveVerdictAndNoReason() {
+        val p = Framing.parseFrame(realtimeWhoop4(hr = 61), DeviceFamily.WHOOP4)
+        assertTrue(p.ok)
+        assertEquals(FrameRejectReason.NONE, p.rejectReason)
+        assertEquals("REALTIME_DATA", p.typeName)
+        assertEquals(61, p.parsed["heart_rate"])
+    }
+
+    // MARK: - The reason is on the parse result, and the reasons are distinguishable
+
+    @Test
+    fun everyRejectionClassCarriesItsOwnReason() {
+        val good = realtimeWhoop4()
+
+        val noSof = good.copyOf().also { it[0] = 0x55 }
+        val belowMinimum = whoop4Frame(ByteArray(3)).copyOf(9)   // 9 bytes: under the 11-byte floor
+        val trailing = good + byteArrayOf(0x00)
+        val truncated = good.copyOf(good.size - 1)
+        val headerBroken = breakHeaderChecksum(good, DeviceFamily.WHOOP4)
+        val payloadBroken = good.copyOf().also { it[12] = (it[12] + 1).toByte() }
+
+        val reasons = listOf(noSof, belowMinimum, trailing, truncated, headerBroken, payloadBroken)
+            .map { Framing.parseFrame(it, DeviceFamily.WHOOP4).rejectReason }
+
+        assertEquals(
+            listOf(
+                FrameRejectReason.NO_START_OF_FRAME,
+                FrameRejectReason.BELOW_MINIMUM_LENGTH,
+                FrameRejectReason.LENGTH_MISMATCH,
+                FrameRejectReason.LENGTH_MISMATCH,
+                FrameRejectReason.HEADER_CHECKSUM_MISMATCH,
+                FrameRejectReason.PAYLOAD_CRC_MISMATCH,
+            ),
+            reasons,
+        )
+        // A consumer determines the cause from the value it was HANDED: no second verify, no second
+        // parse. That is what keeps the parse-once invariant intact.
+        assertEquals(FrameRejectReason.NONE, Framing.parseFrame(good, DeviceFamily.WHOOP4).rejectReason)
+    }
+
+    // MARK: - Structural minimum and exact length, per device family
+
+    @Test
+    fun whoop4_belowMinimumLength_readsNoPacketType() {
+        // Declared lengths 4..6 → totals 8..10, all under the 11-byte floor.
+        for (declared in 4..6) {
+            val total = declared + 4
+            val f = ByteArray(total)
+            f[0] = 0xAA.toByte()
+            f[1] = declared.toByte()
+            f[3] = Crc.crc8(byteArrayOf(f[1], f[2])).toByte()
+            f[4] = PacketType.METADATA.rawValue.toByte()
+            val p = Framing.parseFrame(f, DeviceFamily.WHOOP4)
+            assertFalse("total $total must be rejected", p.ok)
+            assertEquals(FrameRejectReason.BELOW_MINIMUM_LENGTH, p.rejectReason)
+            assertEquals("no packet type is read out of a runt", "INVALID/FRAGMENT", p.typeName)
+        }
+    }
+
+    @Test
+    fun whoop5_belowMinimumLength_readsNoInnerTypeFromTheTrailer() {
+        // declLen 4 → total 12: one byte under the floor, and the byte at [8] that would be read as
+        // the inner packet type is the first byte of the frame's own CRC32 trailer.
+        val f = ByteArray(12)
+        f[0] = 0xAA.toByte()
+        f[1] = 0x01
+        f[2] = 0x04
+        val c16 = Crc.crc16Modbus(f, 0, 6)
+        f[6] = (c16 and 0xFF).toByte()
+        f[7] = ((c16 shr 8) and 0xFF).toByte()
+        f[8] = PuffinPacketType.PUFFIN_METADATA.toByte()
+        val p = Framing.parseFrame(f, DeviceFamily.WHOOP5)
+        assertFalse(p.ok)
+        assertEquals(FrameRejectReason.BELOW_MINIMUM_LENGTH, p.rejectReason)
+        assertEquals("INVALID/FRAGMENT", p.typeName)
+    }
+
+    @Test
+    fun exactlyAtTheFamilyMinimum_isAccepted() {
+        val w4 = whoop4Frame(byteArrayOf(PacketType.METADATA.rawValue.toByte(), 0, 3))
+        assertEquals(FrameLimits.WHOOP4_MINIMUM_FRAME_BYTES, w4.size)
+        assertTrue("the smallest real WHOOP 4.0 frame is exactly 11 bytes", Framing.frameCrcOk(w4, DeviceFamily.WHOOP4))
+
+        val w5 = whoop5Frame(byteArrayOf(PuffinPacketType.PUFFIN_METADATA.toByte()))
+        assertEquals(FrameLimits.WHOOP5_MINIMUM_FRAME_BYTES, w5.size)
+        assertTrue(Framing.frameCrcOk(w5, DeviceFamily.WHOOP5))
+    }
+
+    @Test
+    fun trailingBytesAndTruncationAreBothRejected_bothFamilies() {
+        val w4 = realtimeWhoop4()
+        assertEquals(
+            FrameRejectReason.LENGTH_MISMATCH,
+            Framing.parseFrame(w4 + byteArrayOf(0x00), DeviceFamily.WHOOP4).rejectReason,
+        )
+        assertEquals(
+            FrameRejectReason.LENGTH_MISMATCH,
+            Framing.parseFrame(w4.copyOf(w4.size - 1), DeviceFamily.WHOOP4).rejectReason,
+        )
+
+        val w5 = hexToBytes(realFrameHex("whoop5_v18_real_worn"))
+        assertEquals(
+            FrameRejectReason.LENGTH_MISMATCH,
+            Framing.parseFrame(w5 + byteArrayOf(0x00), DeviceFamily.WHOOP5).rejectReason,
+        )
+        assertEquals(
+            FrameRejectReason.LENGTH_MISMATCH,
+            Framing.parseFrame(w5.copyOf(w5.size - 1), DeviceFamily.WHOOP5).rejectReason,
+        )
+    }
+
+    @Test
+    fun declaredLengthFarBeyondTheBytesPresent_isRejectedAndReadsNothingOffTheEnd() {
+        val f = realtimeWhoop4().also { it[1] = 0xFF.toByte(); it[2] = 0xFF.toByte() }
+        // Must not throw: the D7 bound is the MINIMUM of the trailer start and the real size, so the
+        // size still guards every read even though the declared trailer sits far past the buffer.
+        val p = Framing.parseFrame(f, DeviceFamily.WHOOP4)
+        assertFalse(p.ok)
+        assertEquals(FrameRejectReason.LENGTH_MISMATCH, p.rejectReason)
+        assertTrue("no row may be derived from it", extractStreams(listOf(p), 0, 0).hr.isEmpty())
+    }
+
+    // MARK: - Reassembler: never emit an under-length frame
+
+    @Test
+    fun reassembler_dropsUnderLengthStartOfFrame_andCountsIt() {
+        val valid = realtimeWhoop4()
+        // A start-of-frame declaring total 8 (below the 11-byte floor), then a complete valid frame.
+        val stream = byteArrayOf(0xAA.toByte(), 0x04, 0x00, 0x00) + valid
+        val r = Reassembler(DeviceFamily.WHOOP4)
+        val out = r.feed(stream)
+        assertEquals("only the complete valid frame is emitted", 1, out.size)
+        assertArrayEquals(valid, out[0])
+        assertEquals("the dropped byte run stays visible as a counted rejection", 1, r.belowMinimumLengthDrops)
+    }
+
+    @Test
+    fun reassembler_underLengthFloorIsPerFamily() {
+        // The floor the reassembler applies is the FAMILY's, not one shared number. A declared total
+        // of 12 is a legal WHOOP 4.0 frame but one byte under the WHOOP 5.0/MG minimum, so the same
+        // byte run must be kept by one reassembler and dropped by the other.
+        val w4 = realtimeWhoop4()
+        assertEquals(12, w4.copyOf(12).size)
+
+        // WHOOP 5/MG: declLen 4 → total 12, below the 13-byte floor. Dropped, then it resyncs onto
+        // the complete frame that follows.
+        val valid5 = whoop5Frame(byteArrayOf(PuffinPacketType.PUFFIN_METADATA.toByte(), 0, 0, 0))
+        val runt5 = byteArrayOf(0xAA.toByte(), 0x01, 0x04, 0x00)
+        val r5 = Reassembler(DeviceFamily.WHOOP5)
+        val out5 = r5.feed(runt5 + valid5)
+        assertEquals("only the complete 5/MG frame is emitted", 1, out5.size)
+        assertArrayEquals(valid5, out5[0])
+        assertEquals(1, r5.belowMinimumLengthDrops)
+
+        // WHOOP 4.0 with a declared total of 12: at the floor's other side, so it is emitted whole
+        // and nothing is counted — the floor did not silently become a global constant.
+        val inner4 = ByteArray(4).also { it[0] = PacketType.METADATA.rawValue.toByte() }
+        val small4 = whoop4Frame(inner4)
+        assertEquals(12, small4.size)
+        val r4 = Reassembler(DeviceFamily.WHOOP4)
+        val out4 = r4.feed(small4)
+        assertEquals(1, out4.size)
+        assertArrayEquals(small4, out4[0])
+        assertEquals(0, r4.belowMinimumLengthDrops)
+    }
+
+    @Test
+    fun reassembler_fragmentedDeliveryIsUnchanged() {
+        val valid = realtimeWhoop4()
+        val r = Reassembler(DeviceFamily.WHOOP4)
+        assertTrue(r.feed(valid.copyOfRange(0, 5)).isEmpty())
+        assertTrue(r.feed(valid.copyOfRange(5, 9)).isEmpty())
+        val out = r.feed(valid.copyOfRange(9, valid.size))
+        assertEquals(1, out.size)
+        assertArrayEquals(valid, out[0])
+        assertEquals(0, r.belowMinimumLengthDrops)
+    }
+
+    // MARK: - D7: inner fields come only from payload bytes
+
+    @Test
+    fun whoop5_atExactlyTheMinimum_decodesNoInnerFieldAtAll() {
+        // 13 bytes: the trailer starts at 9, so every named inner field (sequence number, command
+        // byte, metadata type) sits inside the frame's own checksum. Only the packet TYPE at [8],
+        // which the family minimum guarantees is a payload byte, is read.
+        val f = whoop5Frame(byteArrayOf(PuffinPacketType.PUFFIN_METADATA.toByte()))
+        assertEquals(FrameLimits.WHOOP5_MINIMUM_FRAME_BYTES, f.size)
+        val p = Framing.parseFrame(f, DeviceFamily.WHOOP5)
+        assertTrue(p.ok)
+        assertEquals("METADATA", p.typeName)
+        assertNull(p.parsed["meta_type"])
+        assertNull(p.parsed["unix"])
+        assertNull(p.parsed["trim_cursor"])
+        assertEquals(HistoricalMeta.Other, classifyHistoricalMeta(p))
+    }
+
+    @Test
+    fun whoop5_atTheMinimum_decodesNoMetadataFieldFromItsOwnTrailer() {
+        // A 14-byte 5/MG METADATA frame with CORRECT checksums whose CRC32 trailer starts with the
+        // byte that means HISTORY_COMPLETE, at exactly the offset meta_type would be read from.
+        val filler = (0..255).firstOrNull {
+            Crc.crc32(byteArrayOf(PuffinPacketType.PUFFIN_METADATA.toByte(), it.toByte())) and 0xFFL ==
+                MetadataType.HISTORY_COMPLETE.rawValue.toLong()
+        }
+        assertNotNull("no payload byte produces the wanted trailer", filler)
+        val f = whoop5Frame(byteArrayOf(PuffinPacketType.PUFFIN_METADATA.toByte(), filler!!.toByte()))
+        assertEquals(14, f.size)
+
+        val p = Framing.parseFrame(f, DeviceFamily.WHOOP5)
+        assertTrue("the frame itself is intact — only its FIELDS are out of bounds", p.ok)
+        assertEquals("METADATA", p.typeName)
+        assertNull("meta_type@10 sits in the CRC32 trailer and must not be decoded", p.parsed["meta_type"])
+        assertEquals(
+            "and so it cannot be classified as history completion",
+            HistoricalMeta.Other, classifyHistoricalMeta(p),
+        )
+    }
+
+    @Test
+    fun whoop5_oneByteMoreOfPayload_decodesTheMetadataField() {
+        // 15 bytes: the trailer now starts at 11, so meta_type@10 IS a payload byte and is decoded.
+        val f = whoop5Frame(
+            byteArrayOf(PuffinPacketType.PUFFIN_METADATA.toByte(), 0, MetadataType.HISTORY_COMPLETE.rawValue.toByte()),
+        )
+        assertEquals(15, f.size)
+        val p = Framing.parseFrame(f, DeviceFamily.WHOOP5)
+        assertTrue(p.ok)
+        assertTrue((p.parsed["meta_type"] as String).startsWith("HISTORY_COMPLETE"))
+        assertEquals(HistoricalMeta.Complete, classifyHistoricalMeta(p))
+    }
+
+    @Test
+    fun whoop4_smallestRealHistoryFrame_stillYieldsItsMetadataType() {
+        // D7's comparison form is "start + length must not EXCEED the bound", NOT "must stay below
+        // it". The smallest real WHOOP 4.0 metadata frame is 11 bytes with its trailer at 7, and its
+        // meta_type occupies precisely the last payload byte — a stricter comparison would swallow
+        // HISTORY_COMPLETE and the offload would never end.
+        val f = whoop4Frame(
+            byteArrayOf(PacketType.METADATA.rawValue.toByte(), 0, MetadataType.HISTORY_COMPLETE.rawValue.toByte()),
+        )
+        assertEquals(11, f.size)
+        val p = Framing.parseFrame(f, DeviceFamily.WHOOP4)
+        assertTrue(p.ok)
+        assertEquals(HistoricalMeta.Complete, classifyHistoricalMeta(p))
+    }
+
+    @Test
+    fun whoop4_shortenedInnerRecord_decodesNoFieldPastTheTrailer() {
+        // A 14-byte REALTIME_DATA frame: the trailer starts at 10, so the timestamp@6 is payload and
+        // is decoded, while subseconds@10 and heart_rate@12 are the frame's own checksum bytes.
+        val inner = ByteArray(6)
+        inner[0] = PacketType.REALTIME_DATA.rawValue.toByte()
+        putU32LE(inner, 2, 1_780_916_150L)
+        val f = whoop4Frame(inner)
+        assertEquals(14, f.size)
+
+        val p = Framing.parseFrame(f, DeviceFamily.WHOOP4)
+        assertTrue(p.ok)
+        assertEquals(1_780_916_150L.toInt(), p.parsed["timestamp"])
+        assertNull("heart_rate@12 lies in the CRC32 trailer", p.parsed["heart_rate"])
+        assertNull("subseconds@10 lies in the CRC32 trailer", p.parsed["subseconds"])
+    }
+
+    // MARK: - State-driving gates
+
+    @Test
+    fun historicalMetaClassifier_rejectsEveryForgedShape() {
+        val end = whoop4Frame(
+            byteArrayOf(PacketType.METADATA.rawValue.toByte(), 0, MetadataType.HISTORY_END.rawValue.toByte()) +
+                ByteArray(14),
+        )
+        val good = Framing.parseFrame(end, DeviceFamily.WHOOP4)
+        assertTrue(good.ok)
+        assertTrue("the honest frame still advances the trim cursor", classifyHistoricalMeta(good) is HistoricalMeta.End)
+
+        val headerBroken = Framing.parseFrame(breakHeaderChecksum(end, DeviceFamily.WHOOP4), DeviceFamily.WHOOP4)
+        val truncated = Framing.parseFrame(end.copyOf(end.size - 1), DeviceFamily.WHOOP4)
+        val trailing = Framing.parseFrame(end + byteArrayOf(0), DeviceFamily.WHOOP4)
+        for (p in listOf(headerBroken, truncated, trailing)) {
+            assertEquals(
+                "a forged HISTORY_END must not advance the trim cursor or trigger an ack",
+                HistoricalMeta.Other, classifyHistoricalMeta(p),
+            )
+        }
+    }
+
+    @Test
+    fun streamExtraction_skipsAFrameWithABrokenHeader() {
+        val good = Framing.parseFrame(realtimeWhoop4(hr = 61), DeviceFamily.WHOOP4)
+        val bad = Framing.parseFrame(
+            breakHeaderChecksum(realtimeWhoop4(hr = 61), DeviceFamily.WHOOP4), DeviceFamily.WHOOP4,
+        )
+        assertEquals(1, extractStreams(listOf(good), 0, 0).hr.size)
+        assertTrue("no row may be derived from a broken-header frame", extractStreams(listOf(bad), 0, 0).hr.isEmpty())
+    }
+
+    @Test
+    fun historicalExtraction_skipsAFrameWithABrokenHeader() {
+        val good = historicalWhoop4()
+        val bad = breakHeaderChecksum(good, DeviceFamily.WHOOP4)
+        val fromGood: StreamBatch = extractHistoricalStreams(listOf(good), 0, 0, DeviceFamily.WHOOP4)
+        val fromBad: StreamBatch = extractHistoricalStreams(listOf(bad), 0, 0, DeviceFamily.WHOOP4)
+        assertTrue("the honest record still banks rows", fromGood.hr.isNotEmpty())
+        assertTrue("a broken-header record banks none", fromBad.hr.isEmpty())
+        assertTrue(fromBad.gravity.isEmpty())
+    }
+
+    @Test
+    fun historicalExtraction_gatesTheRawPpgWaveformToo() {
+        // A 5/MG layout-v26 record: type@8, version@9, unix@15, 24 i16 samples at [27, 75).
+        // This branch reads the record DIRECTLY instead of going through the record decoder, so it
+        // needs the verdict applied ahead of the per-type work — otherwise a forged frame banks PPG
+        // rows through the one path that never asked.
+        val payload = ByteArray(70)
+        payload[0] = PacketType.HISTORICAL_DATA.rawValue.toByte()
+        payload[1] = 26
+        putU32LE(payload, 7, 1_780_916_150L)          // unix@15
+        for (i in 0 until 24) {                        // samples@27..75
+            payload[19 + i * 2] = ((i + 1) and 0xFF).toByte()
+            payload[20 + i * 2] = 0
+        }
+        val frame = whoop5Frame(payload)
+        assertTrue(Framing.frameCrcOk(frame, DeviceFamily.WHOOP5))
+
+        val fromGood = extractHistoricalStreams(listOf(frame), 0, 0, DeviceFamily.WHOOP5)
+        assertEquals("the honest v26 record still banks its waveform", 1, fromGood.ppgWaveform.size)
+
+        val forged = breakHeaderChecksum(frame, DeviceFamily.WHOOP5)
+        val fromForged = extractHistoricalStreams(listOf(forged), 0, 0, DeviceFamily.WHOOP5)
+        assertTrue("a forged v26 record banks nothing", fromForged.ppgWaveform.isEmpty())
+        assertTrue(fromForged.ppgHr.isEmpty())
+    }
+
+    // MARK: - Evidence-preserving reader (D8): a rejected record is ARCHIVED, not dropped
+
+    @Test
+    fun rejectedRecordArchive_keepsATypeFortySevenFrameWithABrokenHeader() {
+        val good = historicalWhoop4()
+        val bad = breakHeaderChecksum(good, DeviceFamily.WHOOP4)
+
+        assertTrue(
+            "a decodable record is not archived — it became rows",
+            rejectedHistoricalRecords(listOf(good), DeviceFamily.WHOOP4).isEmpty(),
+        )
+        val archived = rejectedHistoricalRecords(listOf(bad), DeviceFamily.WHOOP4)
+        assertEquals("the tightened verdict ENLARGES the archived set, it never shrinks it", 1, archived.size)
+        assertArrayEquals("archived verbatim, header bytes and all", bad, archived[0])
+    }
+
+    /** A 5/MG layout-v26 (raw PPG) record: type@8, version@9, unix@15, 24 i16 samples at [27, 75). */
+    private fun historicalWhoop5V26(): ByteArray {
+        val payload = ByteArray(70)
+        payload[0] = PacketType.HISTORICAL_DATA.rawValue.toByte()
+        payload[1] = 26
+        putU32LE(payload, 7, 1_780_916_150L)
+        for (i in 0 until 24) {
+            payload[19 + i * 2] = ((i + 1) and 0xFF).toByte()
+            payload[20 + i * 2] = 0
+        }
+        return whoop5Frame(payload)
+    }
+
+    @Test
+    fun rejectedRecordArchive_keepsAV26RecordWithABrokenHeader() {
+        // The v26 skip exists BECAUSE the extraction banks such a record in its own waveform stream.
+        // Since the integrity gate a broken v26 record banks nothing there
+        // ([historicalExtraction_gatesTheRawPpgWaveformToo]), so skipping it on the version byte alone
+        // would leave it stored nowhere while its section is acked anyway.
+        val bad = breakHeaderChecksum(historicalWhoop5V26(), DeviceFamily.WHOOP5)
+        assertEquals(26, bad[9].toInt() and 0xFF)
+        val p = Framing.parseFrame(bad, DeviceFamily.WHOOP5)
+        assertEquals(FrameRejectReason.HEADER_CHECKSUM_MISMATCH, p.rejectReason)
+        assertEquals("precondition: the PAYLOAD CRC32 still verifies", true, p.crcOk)
+        val archived = rejectedHistoricalRecords(listOf(bad), DeviceFamily.WHOOP5)
+        assertEquals("a rejected v26 record reaches no stream, so its bytes are the only copy left", 1, archived.size)
+        assertArrayEquals("archived verbatim, header bytes and all", bad, archived[0])
+    }
+
+    @Test
+    fun rejectedRecordArchive_stillSkipsAnIntactV26Record() {
+        // The other direction: binding the skip to the verdict must not grow the archive by the
+        // NORMAL case — an intact v26 record is banked as a waveform and stays out.
+        val good = historicalWhoop5V26()
+        assertTrue("precondition: the record is intact", Framing.parseFrame(good, DeviceFamily.WHOOP5).ok)
+        assertTrue(
+            "the archive must not grow by the normal case",
+            rejectedHistoricalRecords(listOf(good), DeviceFamily.WHOOP5).isEmpty(),
+        )
+    }
+
+    // MARK: - the BLE seam's gate on the GET_DATA_RANGE reply (task 2.15)
+
+    /** A complete WHOOP 4.0 GET_DATA_RANGE COMMAND_RESPONSE: type@4, seq@5, cmd@6, body from 7 —
+     *  `oldest` on the aligned grid `oldestUnix` scans, `newest` one word later. */
+    private fun dataRangeReply(oldest: Long, newest: Long): ByteArray {
+        val inner = ByteArray(11)
+        inner[0] = PacketType.COMMAND_RESPONSE.rawValue.toByte()
+        inner[1] = 1
+        inner[2] = CommandNumber.GET_DATA_RANGE.rawValue.toByte()
+        putU32LE(inner, 3, oldest)
+        putU32LE(inner, 7, newest)
+        return whoop4Frame(inner)
+    }
+
+    @Test
+    fun dataRangeSeam_acceptsAnIntactReplyAndCarriesTheWindow() {
+        val oldest = 1_750_000_000L
+        val newest = 1_780_000_000L
+        val f = dataRangeReply(oldest, newest)
+        val p = Framing.parseFrame(f, DeviceFamily.WHOOP4)
+        assertTrue("precondition: the reply is intact", p.ok)
+        assertTrue(DataRange.acceptsReply(f, 6, CommandNumber.GET_DATA_RANGE.rawValue) { p.ok })
+        assertEquals(newest, DataRange.newestUnix(f, 1_790_000_000L, 48 * 3600L))
+        assertEquals(oldest, DataRange.oldestUnix(f))
+    }
+
+    @Test
+    fun dataRangeSeam_brokenReplyMovesNeitherTheWindowNorThePlausibilityBounds() {
+        // "eine Antwort mit falscher Kopfprüfsumme verändert weder den gemeldeten Zeitbereich noch die
+        // Plausibilitätsgrenzen des Abzugs": the damaged reply still DECODES a window, so the verdict
+        // is the only thing keeping it out — which is why the gate must be a predicate a test can hold.
+        val oldest = 1_750_000_000L
+        val newest = 1_780_000_000L
+        val bad = breakHeaderChecksum(dataRangeReply(oldest, newest), DeviceFamily.WHOOP4)
+        val p = Framing.parseFrame(bad, DeviceFamily.WHOOP4)
+        assertEquals(FrameRejectReason.HEADER_CHECKSUM_MISMATCH, p.rejectReason)
+        assertEquals("precondition: the payload CRC32 still verifies", true, p.crcOk)
+        assertEquals(
+            "precondition: these bytes DO carry a window a seam could apply",
+            newest, DataRange.newestUnix(bad, 1_790_000_000L, 48 * 3600L),
+        )
+
+        // The seam in miniature: the reported window and the two plausibility bounds, moved only on an
+        // accepted reply. Their previous values must survive a damaged one untouched.
+        var reportedNewest: Long? = 1_700_000_001L
+        var boundsNewest: Long? = 1_700_000_001L
+        var boundsOldest: Long? = 1_700_000_000L
+        if (DataRange.acceptsReply(bad, 6, CommandNumber.GET_DATA_RANGE.rawValue) { p.ok }) {
+            reportedNewest = DataRange.newestUnix(bad, 1_790_000_000L, 48 * 3600L)
+            boundsNewest = reportedNewest
+            boundsOldest = DataRange.oldestUnix(bad)
+        }
+        assertEquals("the reported range must not move", 1_700_000_001L, reportedNewest)
+        assertEquals("the offload's upper plausibility bound must not move", 1_700_000_001L, boundsNewest)
+        assertEquals("the offload's lower plausibility bound must not move", 1_700_000_000L, boundsOldest)
+    }
+
+    @Test
+    fun dataRangeSeam_anotherOpcodeIsNotADataRangeReply() {
+        val other = dataRangeReply(1_750_000_000L, 1_780_000_000L)
+        other[6] = CommandNumber.GET_BATTERY_LEVEL.rawValue.toByte()
+        assertFalse(DataRange.acceptsReply(other, 6, CommandNumber.GET_DATA_RANGE.rawValue) { true })
+    }
+
+    @Test
+    fun rejectedRecordArchive_losesNothingItUsedToKeep() {
+        // Every real record fixture: still decodable, so still not archived — the archive grew only
+        // by frames that used to be silently dropped.
+        val frames = oracle().getJSONArray("frames")
+        for (i in 0 until frames.length()) {
+            val f = frames.getJSONObject(i)
+            val family = if (f.getString("family") == "whoop5") DeviceFamily.WHOOP5 else DeviceFamily.WHOOP4
+            val bytes = hexToBytes(f.getString("hex"))
+            assertTrue(
+                "${f.getString("name")} must still decode into rows",
+                rejectedHistoricalRecords(listOf(bytes), family).isEmpty(),
+            )
+        }
+    }
+
+    @Test
+    fun captureImport_archivesTheRecordItCanNoLongerDecode() {
+        // The capture-import path reaches the same evidence-preserving filter as the live offload, so
+        // a record the tightened verdict now refuses is archived there too rather than lost when a
+        // user replays a file. Archiving is a side effect of forward-decoding on this platform: the
+        // importer never asks a separate reader, it keeps whatever the decoder could not turn into
+        // rows.
+        val good = historicalWhoop4()
+        val bad = breakHeaderChecksum(good, DeviceFamily.WHOOP4)
+        val char = "61080003-8d6d-82b8-614a-1c8cb0f8dcc6"   // the WHOOP 4.0 notify characteristic
+        val json = listOf(good, bad).joinToString(prefix = "[", postfix = "]") { f ->
+            """{"hex":"${f.joinToString("") { "%02x".format(it) }}","char":"$char","ts_ms":0,"hr":0}"""
+        }
+
+        val decoded = CaptureImporter.decode(CaptureImporter.parse(json))
+        val rejects = decoded.rejects[DeviceFamily.WHOOP4].orEmpty()
+        assertEquals("the broken-header record is archived, not dropped", 1, rejects.size)
+        assertArrayEquals("archived verbatim", bad, rejects[0])
+        assertTrue(
+            "and the honest record still becomes rows",
+            decoded.batches[DeviceFamily.WHOOP4]!!.hr.isNotEmpty(),
+        )
+    }
+
+    // MARK: - The second verifying path: the ECG payload accessor
+
+    @Test
+    fun ecgInnerPayload_inheritsTheCentralBounds() {
+        val payload = ByteArray(24) { (it + 1).toByte() }
+        val frame = whoop5Frame(payload)
+        val inner = Whoop5Ecg.innerPayload(frame)
+        assertNotNull("a well-formed frame still yields its payload", inner)
+        assertEquals(payload.size + 8 - 11, inner!!.size)
+
+        assertNull(
+            "trailing bytes are rejected here exactly as in the central verifier",
+            Whoop5Ecg.innerPayload(frame + byteArrayOf(0x00)),
+        )
+        assertNull("a truncated frame likewise", Whoop5Ecg.innerPayload(frame.copyOf(frame.size - 1)))
+        assertNull(
+            "and a 12-byte frame is below the family minimum",
+            Whoop5Ecg.innerPayload(whoop5Frame(byteArrayOf(1)).copyOf(12)),
+        )
+        assertNull(
+            "a broken header checksum is a rejection here too",
+            Whoop5Ecg.innerPayload(breakHeaderChecksum(frame, DeviceFamily.WHOOP5)),
+        )
+    }
+
+    // MARK: - The three callers of the verifier wrapper keep their useful path
+
+    @Test
+    fun featureFlagProbe_stillParsesAWellFormedReply() {
+        // START_FF_KEY_EXCHANGE COMMAND_RESPONSE(36) in the WHOOP 4.0 envelope, real checksums:
+        // [type][seq][cmd] + [result][resp_seq] + record(revision, count u16).
+        val frame = whoop4Frame(
+            byteArrayOf(36, 1, FeatureFlagProbe.START_KEY_EXCHANGE_CMD.toByte(), 1, 0, 7, 3, 0),
+        )
+        val start = FeatureFlagProbe.parseStart(frame, DeviceFamily.WHOOP4).value
+        assertNotNull("the tightened verifier must not turn a well-formed reply away", start)
+        assertEquals(7, start!!.revision)
+        assertEquals(3, start.count)
+
+        assertEquals(
+            "…while a broken header checksum, which used to pass, now fails at the CRC gate",
+            FeatureFlagProbe.ParseFailure.CRC,
+            FeatureFlagProbe.parseStart(
+                breakHeaderChecksum(frame, DeviceFamily.WHOOP4), DeviceFamily.WHOOP4,
+            ).failure,
+        )
+        assertEquals(
+            FeatureFlagProbe.ParseFailure.CRC,
+            FeatureFlagProbe.parseStart(frame + byteArrayOf(0x00), DeviceFamily.WHOOP4).failure,
+        )
+    }
+
+    @Test
+    fun deviceConfigReadProbe_stillParsesAWellFormedReply() {
+        val cmd = DeviceConfigReadProbe.GET_DEVICE_CONFIG_VALUE_CMD
+        val frame = whoop4Frame(byteArrayOf(36, 1, cmd.toByte(), 1, 0, 0, 0x41, 0x00))
+        val parsed = DeviceConfigReadProbe.parse(frame, DeviceFamily.WHOOP4, cmd)
+        assertNotNull("a well-formed reply still decodes", parsed.value)
+
+        assertEquals(
+            "…and a broken header checksum now fails at the CRC gate",
+            DeviceConfigReadProbe.ParseFailure.CRC,
+            DeviceConfigReadProbe.parse(
+                breakHeaderChecksum(frame, DeviceFamily.WHOOP4), DeviceFamily.WHOOP4, cmd,
+            ).failure,
+        )
+        assertEquals(
+            DeviceConfigReadProbe.ParseFailure.CRC,
+            DeviceConfigReadProbe.parse(frame + byteArrayOf(0x00), DeviceFamily.WHOOP4, cmd).failure,
+        )
+    }
+
+    @Test
+    fun rawOpticalDecoder_stillAcceptsItsRealRecord() {
+        val stream = javaClass.classLoader!!.getResourceAsStream("r20_optical_oracle.json")
+        assertNotNull("r20_optical_oracle.json missing from test classpath", stream)
+        val records = JSONObject(stream!!.bufferedReader().use { it.readText() }).getJSONArray("records")
+        for (i in 0 until records.length()) {
+            val bytes = hexToBytes(records.getJSONObject(i).getString("hex"))
+            assertTrue(
+                "the real 2,140-byte v20 record must keep a positive verdict",
+                Framing.frameCrcOk(bytes, DeviceFamily.WHOOP5),
+            )
+            assertNotNull("and must still decode", Whoop5RawOptical.decode(bytes))
+        }
+    }
+
+    // MARK: - Regression: no real recorded frame is rejected by the new bounds
+
+    @Test
+    fun everyRecordedFrameFixtureKeepsAPositiveVerdict() {
+        val frames = oracle().getJSONArray("frames")
+        assertTrue("the fixture must not be empty", frames.length() > 0)
+        for (i in 0 until frames.length()) {
+            val f = frames.getJSONObject(i)
+            val family = if (f.getString("family") == "whoop5") DeviceFamily.WHOOP5 else DeviceFamily.WHOOP4
+            val bytes = hexToBytes(f.getString("hex"))
+            val p = Framing.parseFrame(bytes, family)
+            assertTrue("${f.getString("name")} must stay valid", p.ok)
+            assertEquals("${f.getString("name")} carries no reject reason", FrameRejectReason.NONE, p.rejectReason)
+            assertTrue(
+                "${f.getString("name")} is at or above its family minimum",
+                bytes.size >= FrameLimits.minimumFrameBytes(family),
+            )
+        }
+    }
+}
diff --git a/android/app/src/test/java/com/noop/protocol/FramingTest.kt b/android/app/src/test/java/com/noop/protocol/FramingTest.kt
index e0ea70735c..8df643e086 100644
--- a/android/app/src/test/java/com/noop/protocol/FramingTest.kt
+++ b/android/app/src/test/java/com/noop/protocol/FramingTest.kt
@@ -2,6 +2,7 @@ package com.noop.protocol
 
 import org.junit.Assert.assertArrayEquals
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
 import org.junit.Assert.assertNotNull
 import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
@@ -289,16 +290,20 @@ class FramingTest {
 
     @Test
     fun parse_corruptedCrc_reportsCrcFalse() {
-        // Flip a payload byte so the CRC32 no longer matches; the frame is still well-formed (ok),
-        // but crcOk must be false so downstream code rejects it.
+        // Flip a payload byte so the CRC32 no longer matches. The envelope is still well-formed, but
+        // `ok` is the FULL verdict now, so it is false and the reason names the payload CRC — this
+        // test used to assert `ok == true` for a frame it had deliberately corrupted.
         val frame = bytes(
             0xaa, 0x12, 0x00, 0x7d, 0x28, 0x00, 0x00, 0xf1, 0x53, 0x65, 0x00, 0x00,
             0x3e, 0x02, 0x52, 0x03, 0x66, 0x03, 0x73, 0x8f, 0x40, 0xae,
         )
         frame[12] = (frame[12] + 1).toByte() // mutate heart_rate byte
         val r = Framing.parseFrame(frame)
-        assertTrue(r.ok)
+        assertFalse(r.ok)
+        assertEquals(FrameRejectReason.PAYLOAD_CRC_MISMATCH, r.rejectReason)
         assertEquals(false, r.crcOk)
+        // The frame stays READABLE for inspection surfaces: a rejected frame keeps its packet type.
+        assertEquals("REALTIME_DATA", r.typeName)
     }
 
     @Test
diff --git a/android/app/src/test/resources/frame_integrity_oracle.json b/android/app/src/test/resources/frame_integrity_oracle.json
new file mode 100644
index 0000000000..541873e8f4
--- /dev/null
+++ b/android/app/src/test/resources/frame_integrity_oracle.json
@@ -0,0 +1,498 @@
+{
+  "_comment": [
+    "SHARED FRAME-INTEGRITY ORACLE (change frame-integrity, D5 / task 4.2).",
+    "Generated — do not hand-edit. Regenerate with:",
+    "swift run --package-path openspec/changes/frame-integrity/oracle-gen FrameIntegrityOracleGen",
+    "Two byte-identical copies are committed, one per test tree, and both suites assert every case",
+    "and all three pinned fields (verdict, reject_reason, meta), so neither platform can move its",
+    "verifier without the other's suite going red.",
+    "verdict       = ParsedFrame.ok, the verifier's FULL verdict.",
+    "reject_reason = the Swift FrameRejectReason rawValue; Kotlin maps its enum through wireName.",
+    "meta          = classifyHistoricalMeta, as start | complete | other | end(unix=U,trim=T).",
+    "ecg_inner_payload_hex is present only on cases with ecg_path true (the second verifying path,",
+    "Whoop5Ecg.innerPayload); null means that path refused the frame.",
+    "The export FORM of a reject reason differs by design (Kotlin omits the key when there is no",
+    "reason, Swift always writes it) — this oracle pins the verdict, the reason and the",
+    "classification, never the export spelling."
+  ],
+  "coverage": {
+    "case_count": 45,
+    "classes": {
+      "below_minimum": 4,
+      "boundary": 3,
+      "ecg_path": 3,
+      "evaluation_order": 4,
+      "header_corrupt": 5,
+      "no_start_of_frame": 4,
+      "payload_corrupt": 5,
+      "trailing_bytes": 3,
+      "truncated": 4,
+      "valid_recorded": 9,
+      "valid_synthetic": 1
+    },
+    "reasons": {
+      "belowMinimumLength": 5,
+      "headerChecksumMismatch": 7,
+      "lengthMismatch": 10,
+      "noStartOfFrame": 4,
+      "none": 14,
+      "payloadCRCMismatch": 5
+    }
+  },
+  "cases": [
+    {
+      "name": "w4_realtime_valid",
+      "family": "whoop4",
+      "class": "valid_recorded",
+      "hex": "aa1800ff28020f3de10128663c0000000000000000000000da855212",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_meta_history_start_11",
+      "family": "whoop4",
+      "class": "valid_recorded",
+      "hex": "aa07006b3100012366efad",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "start",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_meta_history_complete_11",
+      "family": "whoop4",
+      "class": "valid_recorded",
+      "hex": "aa07006b3100030f07e143",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "complete",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_history_end_25",
+      "family": "whoop4",
+      "class": "valid_recorded",
+      "hex": "aa15001631000200f1536500000000000039300000c3401bdb",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "end(unix=1700000000,trim=12345)",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_historical_v24_valid",
+      "family": "whoop4",
+      "class": "valid_recorded",
+      "hex": "aa6400a12f18054c1c0a023ed0266a5037805418016d022b0234020000000000006b07ff0085593c1f65cebed7b3e63eb85a5f3f000080401f65cebed7b3e63eb85a5f3f500264025d03640229014009010c020c00000000000f0001c4020000000000008fdeb278",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_historical_v25_valid",
+      "family": "whoop4",
+      "class": "valid_recorded",
+      "hex": "aa50000c2f1900006800007dff2a6a20430900433103007e026502ba026c022eff70f996f879fad6fd8300d6017e0267027201be00290258030e05c507f00c030ead11cb15791500d2553c9003000000d6393716",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_historical_v18_valid",
+      "family": "whoop5",
+      "class": "valid_recorded",
+      "hex": "aa01740001003fb12f1280733d8401b69f266a66460066025a0265020000000000007b0a8d656463ff0012163cf6a439bf2924fd3ed763fe3e3200aa000000000000000000f7000901f10b0007010c020c00000000000000000000000000000000000000000000000100656f1e1e0000009d61a7c00000003e862817",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_meta_history_end_valid",
+      "family": "whoop5",
+      "class": "valid_recorded",
+      "hex": "aa011c00010023d1316a0284a3266a0a373d00000041b601001000000000000044d21e3d",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "end(unix=1780917124,trim=112193)",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_meta_history_start_valid",
+      "family": "whoop5",
+      "class": "valid_recorded",
+      "hex": "aa012c0001002cd1312c0184a3266ad7230d0000005200000000000000320000002600000001000000000000000b010034497926",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "start",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_command_response_valid",
+      "family": "whoop5",
+      "class": "valid_synthetic",
+      "hex": "aa010c000001e74124070211223344557481f36e",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_realtime_header_checksum_corrupt",
+      "family": "whoop4",
+      "class": "header_corrupt",
+      "hex": "aa18000028020f3de10128663c0000000000000000000000da855212",
+      "verdict": false,
+      "reject_reason": "headerChecksumMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_history_end_25_header_corrupt",
+      "family": "whoop4",
+      "class": "header_corrupt",
+      "hex": "aa1500e931000200f1536500000000000039300000c3401bdb",
+      "verdict": false,
+      "reject_reason": "headerChecksumMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_meta_complete_11_header_corrupt",
+      "family": "whoop4",
+      "class": "header_corrupt",
+      "hex": "aa0700943100030f07e143",
+      "verdict": false,
+      "reject_reason": "headerChecksumMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_command_response_header_crc16_corrupt",
+      "family": "whoop5",
+      "class": "header_corrupt",
+      "hex": "aa010c000001184124070211223344557481f36e",
+      "verdict": false,
+      "reject_reason": "headerChecksumMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_meta_history_end_header_corrupt",
+      "family": "whoop5",
+      "class": "header_corrupt",
+      "hex": "aa011c000100dcd1316a0284a3266a0a373d00000041b601001000000000000044d21e3d",
+      "verdict": false,
+      "reject_reason": "headerChecksumMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_realtime_payload_corrupt",
+      "family": "whoop4",
+      "class": "payload_corrupt",
+      "hex": "aa1800ff28020f3d1e0128663c0000000000000000000000da855212",
+      "verdict": false,
+      "reject_reason": "payloadCRCMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_history_end_25_payload_corrupt",
+      "family": "whoop4",
+      "class": "payload_corrupt",
+      "hex": "aa150016310002000e536500000000000039300000c3401bdb",
+      "verdict": false,
+      "reject_reason": "payloadCRCMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_historical_v24_payload_corrupt",
+      "family": "whoop4",
+      "class": "payload_corrupt",
+      "hex": "aa6400a12f18054c1c0a023ed0266a5037805418fe6d022b0234020000000000006b07ff0085593c1f65cebed7b3e63eb85a5f3f000080401f65cebed7b3e63eb85a5f3f500264025d03640229014009010c020c00000000000f0001c4020000000000008fdeb278",
+      "verdict": false,
+      "reject_reason": "payloadCRCMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_historical_v18_payload_corrupt",
+      "family": "whoop5",
+      "class": "payload_corrupt",
+      "hex": "aa01740001003fb12f1280733d8401b69f266a66b90066025a0265020000000000007b0a8d656463ff0012163cf6a439bf2924fd3ed763fe3e3200aa000000000000000000f7000901f10b0007010c020c00000000000000000000000000000000000000000000000100656f1e1e0000009d61a7c00000003e862817",
+      "verdict": false,
+      "reject_reason": "payloadCRCMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_meta_history_end_payload_corrupt",
+      "family": "whoop5",
+      "class": "payload_corrupt",
+      "hex": "aa011c00010023d1316a0284a3266a0a373d0000ff41b601001000000000000044d21e3d",
+      "verdict": false,
+      "reject_reason": "payloadCRCMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_total8_declared4",
+      "family": "whoop4",
+      "class": "below_minimum",
+      "hex": "aa04005400000000",
+      "verdict": false,
+      "reject_reason": "belowMinimumLength",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_total9_declared5",
+      "family": "whoop4",
+      "class": "below_minimum",
+      "hex": "aa05004131b7efdc83",
+      "verdict": false,
+      "reject_reason": "belowMinimumLength",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_total10_declared6",
+      "family": "whoop4",
+      "class": "below_minimum",
+      "hex": "aa06007e31004d158487",
+      "verdict": false,
+      "reject_reason": "belowMinimumLength",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_total12_declared4",
+      "family": "whoop5",
+      "class": "below_minimum",
+      "hex": "aa0104000001e52100000000",
+      "verdict": false,
+      "reject_reason": "belowMinimumLength",
+      "meta": "other",
+      "ecg_path": true,
+      "ecg_inner_payload_hex": null
+    },
+    {
+      "name": "w4_realtime_truncated_by_1",
+      "family": "whoop4",
+      "class": "truncated",
+      "hex": "aa1800ff28020f3de10128663c0000000000000000000000da8552",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_history_end_25_trailer_truncated",
+      "family": "whoop4",
+      "class": "truncated",
+      "hex": "aa15001631000200f1536500000000000039300000c340",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_historical_v18_truncated_by_1",
+      "family": "whoop5",
+      "class": "truncated",
+      "hex": "aa01740001003fb12f1280733d8401b69f266a66460066025a0265020000000000007b0a8d656463ff0012163cf6a439bf2924fd3ed763fe3e3200aa000000000000000000f7000901f10b0007010c020c00000000000000000000000000000000000000000000000100656f1e1e0000009d61a7c00000003e8628",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_huge_declared_length_11_present",
+      "family": "whoop4",
+      "class": "truncated",
+      "hex": "aa00f0de31000102030405",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_realtime_trailing_byte",
+      "family": "whoop4",
+      "class": "trailing_bytes",
+      "hex": "aa1800ff28020f3de10128663c0000000000000000000000da85521200",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_meta_complete_11_trailing_byte",
+      "family": "whoop4",
+      "class": "trailing_bytes",
+      "hex": "aa07006b3100030f07e14300",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_command_response_trailing_byte",
+      "family": "whoop5",
+      "class": "trailing_bytes",
+      "hex": "aa010c000001e74124070211223344557481f36e00",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_min13_metadata_boundary",
+      "family": "whoop5",
+      "class": "boundary",
+      "hex": "aa0105000001e4dd31b7efdc83",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_meta14_fakes_history_complete",
+      "family": "whoop5",
+      "class": "boundary",
+      "hex": "aa0106000001e49931530315e675",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_short_realtime_14",
+      "family": "whoop4",
+      "class": "boundary",
+      "hex": "aa0a0082280111223344854deb31",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "no_start_of_frame_w4",
+      "family": "whoop4",
+      "class": "no_start_of_frame",
+      "hex": "bb1800ff28020f3de10128663c0000000000000000000000da855212",
+      "verdict": false,
+      "reject_reason": "noStartOfFrame",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "no_start_of_frame_w5",
+      "family": "whoop5",
+      "class": "no_start_of_frame",
+      "hex": "bb010c000001e74124070211223344557481f36e",
+      "verdict": false,
+      "reject_reason": "noStartOfFrame",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "empty_byte_run_w4",
+      "family": "whoop4",
+      "class": "no_start_of_frame",
+      "hex": "",
+      "verdict": false,
+      "reject_reason": "noStartOfFrame",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "empty_byte_run_w5",
+      "family": "whoop5",
+      "class": "no_start_of_frame",
+      "hex": "",
+      "verdict": false,
+      "reject_reason": "noStartOfFrame",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_length_field_corrupt_order_length_before_header",
+      "family": "whoop4",
+      "class": "evaluation_order",
+      "hex": "aae700ff28020f3de10128663c0000000000000000000000da855212",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_header_and_payload_both_corrupt",
+      "family": "whoop4",
+      "class": "evaluation_order",
+      "hex": "aa18000028020f3d1e0128663c0000000000000000000000da855212",
+      "verdict": false,
+      "reject_reason": "headerChecksumMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w4_below_minimum_and_header_corrupt",
+      "family": "whoop4",
+      "class": "evaluation_order",
+      "hex": "aa0400ab00000000",
+      "verdict": false,
+      "reject_reason": "belowMinimumLength",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_trailing_byte_and_header_corrupt",
+      "family": "whoop5",
+      "class": "evaluation_order",
+      "hex": "aa010c000001184124070211223344557481f36e00",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": false
+    },
+    {
+      "name": "w5_ecg_filtered_valid",
+      "family": "whoop5",
+      "class": "ecg_path",
+      "hex": "aa0120000001efd128010002050101000100012a003d3f2c031103000a00f6ff2c0100004decffd3",
+      "verdict": true,
+      "reject_reason": "none",
+      "meta": "other",
+      "ecg_path": true,
+      "ecg_inner_payload_hex": "02050101000100012a003d3f2c031103000a00f6ff2c010000"
+    },
+    {
+      "name": "w5_ecg_filtered_trailing_byte",
+      "family": "whoop5",
+      "class": "ecg_path",
+      "hex": "aa0120000001efd128010002050101000100012a003d3f2c031103000a00f6ff2c0100004decffd300",
+      "verdict": false,
+      "reject_reason": "lengthMismatch",
+      "meta": "other",
+      "ecg_path": true,
+      "ecg_inner_payload_hex": null
+    },
+    {
+      "name": "w5_ecg_header_crc16_corrupt",
+      "family": "whoop5",
+      "class": "ecg_path",
+      "hex": "aa012000000110d128010002050101000100012a003d3f2c031103000a00f6ff2c0100004decffd3",
+      "verdict": false,
+      "reject_reason": "headerChecksumMismatch",
+      "meta": "other",
+      "ecg_path": true,
+      "ecg_inner_payload_hex": null
+    }
+  ]
+}
diff --git a/docs/ANDROID.md b/docs/ANDROID.md
index 2a4f2d0599..f5b11ebbc5 100644
--- a/docs/ANDROID.md
+++ b/docs/ANDROID.md
@@ -294,14 +294,48 @@ tail     crc32 (zlib, LE) over the payload, 4 bytes
 total = declaredLength + 8
 ```
 
+**Structural size rules (both families).** `FrameLimits` in `Framing.kt` is the twin of the Swift
+`FrameLimits` and carries the same two numbers:
+
+| Family | Minimum total frame size | Exact total frame size |
+| --- | --- | --- |
+| `WHOOP4` | `WHOOP4_MINIMUM_FRAME_BYTES` = **11** | `length + 4` |
+| `WHOOP5` | `WHOOP5_MINIMUM_FRAME_BYTES` = **13** | `declaredLength + 8` |
+
+The minimum is the smallest envelope that can still carry one payload byte. The exact size is
+compared for **equality** against the bytes actually handed in, so a truncated frame and a frame
+with trailing bytes past its own end are both rejected — including the case where the payload CRC32
+over the declared range still checks out. Keep both constants in step with the Swift side; they are
+part of the parity contract, not a local tuning knob.
+
 `Reassembler.feed(fragment)` accumulates BLE notification fragments and emits complete frames; a
 complete WHOOP 4.0 frame is `length + 4` bytes where `length = u16 LE at buf[1..3]`. Port the
 `firstIndex(of: 0xAA)` resync logic exactly — partial fragments are the norm over GATT notifications.
+The reassembler applies the same family minimum: a `0xAA` whose declared total falls below it is
+dropped, counted, and the scan resyncs on the next SOF.
 
 ### Decode (`Interpreter.swift` → `ParseFrame.kt`, ported)
 
 `parseFrame(frame)` (WHOOP 4.0) and `parseFrame(frame, family)` (WHOOP 5.0) build a `ParsedFrame`
-with `ok`, `typeName`, `seq`, `cmdName`, `crcOK`, `fields`, and a flat `parsed` map. The decoder is
+with `ok`, `typeName`, `seq`, `cmdName`, `crcOK`, `rejectReason`, `fields`, and a flat `parsed` map.
+
+`ok` means **intact**, not **parsed**: it is `verifyFrame`'s full verdict — header checksum, payload
+CRC32 and the structural size rules above, together. A rejected frame is still decoded, so it keeps
+its `typeName` and `parsed` fields for the diagnostic and capture surfaces. `rejectReason` is a
+non-optional `FrameRejectReason` on the parse result, so a consumer reports the cause from the value
+it was handed rather than verifying a second time; `NONE` accompanies a positive verdict and only
+that. Its cases map to the Swift `FrameRejectReason` value for value (`none` → `NONE`,
+`noStartOfFrame` → `NO_START_OF_FRAME`, and so on). A payload CRC32 that cannot be computed is
+`PAYLOAD_CRC_UNVERIFIABLE` — a rejection, kept distinct from `PAYLOAD_CRC_MISMATCH` because "could
+not compute" is a different claim from "disagreed".
+
+Named inner-field reads are bounded by the **minimum of the CRC32 trailer's start and the frame's
+real size**, matching the Swift interpreter, so a frame at the family minimum cannot have its own
+checksum trailer decoded as a sequence number or a metadata type. The one exception is the 8-byte
+history-end acknowledgement block echoed back to the strap verbatim, which reaches into the trailer
+by construction.
+
+The decoder is
 **schema-driven** — it reads static field offsets/dtypes/enums from the bundled
 `whoop_protocol.json`, then applies a per-type post-hook for irregular fields. The Kotlin port:
 
@@ -647,6 +681,13 @@ should be re-verified against a real build, a real device, and a real strap befo
 
 - [x] `Crc.crc8/crc32/crc16Modbus` match the Swift `FramingTests` vectors bit-for-bit.
 - [x] `verifyFrame` + `Reassembler` reproduce `FramingTests` / `ReassemblerTests`.
+- [x] The frame-integrity verdict is pinned by a **shared oracle**, not by reading the two
+      implementations side by side: `frame_integrity_oracle.json` exists in two byte-identical
+      copies (`Packages/WhoopProtocol/Tests/WhoopProtocolTests/Resources/` and
+      `android/app/src/test/resources/`), is generated by a standalone Swift run, and lists per
+      frame the verdict, the reject reason **and** the historical-metadata classification.
+      `FrameIntegrityOracleTests.swift` and `FrameIntegrityOracleTest.kt` each assert every row and
+      all three fields, so a one-sided change fails on the other platform.
 - [x] `parseFrame` (4.0) + `parseFrame(family: whoop5)` reproduce `ParityTests` /
       `StreamsParityTests` / `HistoricalStreamsParityTests` against the same fixtures.
 - [x] `WhoopCommand.frame(seq, payload)` reproduces the macOS command bytes (e.g. CLIENT_HELLO and a
diff --git a/docs/BLE_REVERSE_ENGINEERING.md b/docs/BLE_REVERSE_ENGINEERING.md
index 289e5b71a4..45df71a517 100644
--- a/docs/BLE_REVERSE_ENGINEERING.md
+++ b/docs/BLE_REVERSE_ENGINEERING.md
@@ -145,6 +145,10 @@ against `my-whoop`'s `WhoopPacket.framed_packet` and is implemented in `Commands
 - **`crc8`** (poly `0x07`, table in `Framing.swift`) guards **only the two length bytes** — a cheap
   header integrity check that lets the reassembler trust the declared length.
 - **`crc32`** is standard zlib CRC-32 (reflected, poly `0xEDB88320`) over the inner bytes.
+- **Size rules.** A 4.0 frame must be **at least 11 bytes** — the envelope plus one payload byte —
+  and must be **exactly `len + 4`** bytes. Equality, not "at least": a frame cut short and a frame
+  carrying trailing bytes past its own end are **both** rejected, even when the payload CRC32 over
+  the bytes the length field claims happens to check out.
 
 `type` is the packet type (see §5), `cmd` is the command/event number, `seq` is a rolling sequence
 byte (and, for historical records, doubles as the **record version** — see §3).
@@ -155,6 +159,10 @@ BLE delivers frames in MTU-sized fragments. The `Reassembler` (`Framing.swift`)
 finds the `0xAA` SOF, reads the `len` field, and only emits a frame once `len + 4` bytes are present.
 `BLEManager.didUpdateValueFor` feeds every custom-channel notification through it before routing.
 
+The reassembler knows the same per-family minimum (11 bytes on 4.0, 13 on 5.0/MG): a `0xAA` whose
+declared total is smaller is dropped and the scan resyncs on the next SOF, counted in
+`belowMinimumLengthDrops` so the byte run leaves a trace instead of disappearing.
+
 ### WHOOP 5.0 envelope
 
 WHOOP 5.0 changed the header and swapped the header checksum for CRC16-Modbus
@@ -175,6 +183,12 @@ The inner record (`[type][seq][cmd][data…]`) starts at **offset 8** instead of
 payload CRC32 is unchanged from 4.0. The whole 4-vs-5 difference is funnelled through one switch:
 `DeviceFamily.headerCRCKind`.
 
+The size rules carry over with the family's own numbers: a 5.0/MG frame must be **at least 13
+bytes** (8 header bytes including the CRC16, one payload byte, the 4-byte CRC32 trailer) and
+**exactly `declaredLength + 8`** bytes, so truncation and trailing bytes are again both rejected.
+The smallest real frame in the project's captures is exactly 11 bytes on 4.0 and 124 bytes on
+5.0/MG, so neither minimum rejects anything that has actually been recorded off a strap.
+
 ---
 
 ## 3. WHOOP 4 (Harvard) vs WHOOP 5 (puffin)
diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index 76894547ec..1f1b0906a8 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -362,9 +362,10 @@ then used. Screens stay thin; the system stays canonical.
   CoreBluetooth work off-main without a very good reason.
 - **No anonymous magic.** Reach for an existing constant/enum (`NoopMetrics`, `StrandPalette`,
   `WhoopCommand`, `MetricCatalog`) before introducing a literal.
-- **Validate before you trust.** Any data coming off the wire is gated on its checksum *and*
-  range-checked before it can drive state (see `FrameRouter.handle` rejecting `crcOK == false` and
-  clamping HR to 30…220). New inbound paths follow the same pattern.
+- **Validate before you trust.** Any data coming off the wire is gated on the **full integrity
+  verdict** *and* range-checked before it can drive state (see `FrameRouter.handle` rejecting every
+  frame with `parsed.ok == false` and clamping HR to 30…220). New inbound paths follow the same
+  pattern.
 
 ---
 
@@ -397,21 +398,40 @@ sent automatically (#166). If you believe another non-trivial command is genuine
 issue first, justify why it's reversible, and document its payload and on-device verification before
 any code.
 
-### 2. CRC-gate everything
+### 2. Gate on the full integrity verdict
 
-Frames are only acted on after both CRCs pass. Outbound frames are built with the correct CRCs;
-inbound frames are rejected if their checksum fails.
+Frames are only acted on after the **whole** envelope checks out — header checksum, payload CRC32
+and the structural size rules ([`docs/PROTOCOL.md`](PROTOCOL.md) §2) together. Outbound frames are
+built with the correct CRCs; inbound frames are rejected if any part of that verdict fails.
 
 - **Outbound:** `WhoopCommand.frame(seq:payload:)` builds
   `[0xAA][len u16 LE][crc8(len)][type=35][seq][cmd][payload…][crc32 LE]`, computing `crc8` over the
   length bytes and the zlib `crc32` over the inner bytes. The WHOOP 4.0 and 5.0 envelopes differ
   (WHOOP 4 uses a CRC8 header; WHOOP 5 / the "goose" path uses a CRC16-Modbus header) — see
   `Packages/WhoopProtocol/Sources/WhoopProtocol/Framing.swift` (`verifyFrame`, `verifyFrame(_:family:)`).
-- **Inbound:** `FrameRouter.handle(frame:)` decodes with `parseFrame` and **rejects any frame whose
-  `crcOK == false`** before it can touch `LiveState`. Bad bytes never drive state. New inbound paths
-  must do the same.
-
-Never short-circuit a CRC check "to make a capture work". If a real frame fails CRC, the bug is in
+- **Inbound:** `FrameRouter.handle(parsed:frame:)` decodes with `parseFrame` and **rejects any frame
+  whose `parsed.ok` is false** before it can touch `LiveState`. Bad bytes never drive state. New
+  inbound paths must do the same — one condition, the verdict:
+
+  ```swift
+  let parsed = parseFrame(frame, family: family)
+  guard parsed.ok else { return }
+  ```
+
+  One condition, and it is `ok`. Do **not** write a second, weaker step beside it that asks only
+  whether the payload CRC32 was *demonstrably* wrong — that two-step form is the specific mistake
+  this rule exists to stop, and `ok` already subsumes it. It lets through a frame whose header checksum or declared length
+  is broken while its payload CRC32 is fine, and a frame whose payload CRC32 could not be computed
+  at all. `parsed.rejectReason` carries the cause, so a rejection can be counted and reported
+  without verifying the frame a second time — do that instead of letting the path go quiet.
+
+**Evidence-preserving readers are the documented exception**, and there is a reason to be careful
+here rather than mechanical: the reader that decides whether a raw history frame must be archived
+before the trim ack is asked the *opposite* question, and a negative verdict there is a reason to
+keep the frame, not to drop it. Tightening it the wrong way would delete the only durable copy of
+exactly the frames the strap is about to release. Check the direction of a gate before you flip it.
+
+Never short-circuit a CRC check "to make a capture work". If a real frame fails, the bug is in
 the framing/decoding, not in the check.
 
 ### 3. Keep the BLE path stable
@@ -553,6 +573,14 @@ Schema lives in `Packages/WhoopStore/Sources/WhoopStore/Database.swift` as a **v
   a 32-vs-64-bit or signedness split is invisible to a per-platform fixture-hex test. **Extend the
   oracle rather than adding a parallel mechanism**; a `coverage` manifest in the file makes silently
   dropping an assertion a test failure, so adding one means listing it there too.
+- **Frame integrity is pinned by the same idiom.** Cross-platform agreement on *whether a frame is
+  intact* is not a matter of reading `Framing.swift` and `Framing.kt` side by side — it is pinned by
+  `frame_integrity_oracle.json`, which lives in the same two byte-identical copies and lists, per
+  frame, the verdict, the reject reason **and** the historical-metadata classification. The file is
+  generated by a standalone Swift run and taken verbatim; `FrameIntegrityOracleTests.swift` and
+  `FrameIntegrityOracleTest.kt` each assert every row and all three fields, so changing a bound, a
+  reason or a classification on one platform fails the build on the other. Extend that oracle when
+  you touch the envelope rules, rather than adding a per-platform test that can only drift.
 - **Prefer pure tests.** Because `WhoopProtocol`, `StrandAnalytics`, and `FrameRouter` are
   framework-free, you can (and should) cover new decode/routing/math with captured frames and
   fixtures rather than requiring a strap.
diff --git a/docs/LIBRARY.md b/docs/LIBRARY.md
index 288c3bb41d..62e096cd12 100644
--- a/docs/LIBRARY.md
+++ b/docs/LIBRARY.md
@@ -136,8 +136,14 @@ public final class Reassembler {                       // accumulate BLE fragmen
 }
 ```
 
-`FrameCheck` reports `ok`, the declared `length`, and the header/payload CRC
-outcomes.
+`FrameCheck` reports `ok` — the **full** verdict: start-of-frame, the family
+minimum size (11 bytes on WHOOP 4.0, 13 on 5.0/MG), the exact size (`length + 4`
+and `declLength + 8` respectively, so trailing bytes and truncation both fail),
+the header checksum and the payload CRC32, all together. Beside it are the
+declared `length`, the individual header/payload CRC outcomes as diagnostics, and
+`reason: FrameRejectReason` — a non-optional enum that is `.none` exactly when
+`ok` is true. A payload CRC32 that could not be computed is a rejection
+(`.payloadCRCUnverifiable`), not an "unknown".
 
 **Schema + parsing** (`Schema.swift`, `Interpreter.swift`, `Values.swift`)
 
@@ -149,10 +155,23 @@ public func parseFrame(_ frame: [UInt8], family: DeviceFamily) -> ParsedFrame
 ```
 
 A `ParsedFrame` carries `ok`, `typeName`, `seq`, optional `cmdName`, `crcOK`,
-the full list of annotated `DecodedField`s, and a flat `parsed: [String:
-ParsedValue]` dictionary. `ParsedValue` is a JSON-round-tripping scalar/array
-enum (`.int`, `.double`, `.string`, `.intArray`, `.bool`, `.null`) with
-`intValue` / `doubleValue` / `stringValue` / `intArrayValue` accessors.
+`rejectReason`, the full list of annotated `DecodedField`s, and a flat `parsed:
+[String: ParsedValue]` dictionary. `ParsedValue` is a JSON-round-tripping
+scalar/array enum (`.int`, `.double`, `.string`, `.intArray`, `.bool`, `.null`)
+with `intValue` / `doubleValue` / `stringValue` / `intArrayValue` accessors.
+
+`ok` here means **"this frame is intact"**, not "this frame could be parsed": it
+is the same full verdict `verifyFrame` produced. A frame that fails it is still
+decoded, so `typeName` and `parsed` stay populated for inspection tools — read
+those, not `ok`, if what you need is parsability. `rejectReason` is non-optional
+and travels on the result so a consumer can report *why* a frame was rejected
+without verifying it a second time; the frame is parsed once and the result
+threaded onwards. Decoding a `ParsedFrame` from an older document that predates
+the field defaults `rejectReason` to `.none`.
+
+Named inner-field reads are bounded by the minimum of the CRC32 trailer's start
+and the frame's real size, so a frame sitting at the family minimum cannot have
+its own trailer decoded as a sequence number or a metadata type.
 
 **Decoded stream rows** (`Streams.swift`) — the durable, compact record shapes
 that `WhoopStore` persists:
@@ -173,8 +192,10 @@ public func extractHistoricalStreams(_ parsed: [ParsedFrame],
 
 `classifyHistoricalMeta(_:)` (`HistoricalMeta.swift`) drives the
 historical-offload state machine by classifying a parsed `METADATA` frame into
-`.start`, `.end(unix:trim:)`, `.complete`, or `.other` — gated on a valid CRC32
-so a garbled peer cannot forge a `HISTORY_END`.
+`.start`, `.end(unix:trim:)`, `.complete`, or `.other` — gated on the full
+integrity verdict, so a garbled or hostile peer cannot forge a `HISTORY_END`
+whose payload CRC32 is right but whose header checksum or declared length is not.
+Acting on one would advance the strap's trim cursor.
 
 ### Minimal usage
 
@@ -188,7 +209,9 @@ var parsedFrames: [ParsedFrame] = []
 func onNotification(_ fragment: [UInt8], family: DeviceFamily) {
     for frame in reassembler.feed(fragment) {
         let parsed = parseFrame(frame, family: family)
-        guard parsed.ok, parsed.crcOK != false else { continue }
+        // One condition: `ok` IS the full verdict — header checksum, payload CRC32
+        // and the structural size rules. `parsed.rejectReason` says why, if it isn't.
+        guard parsed.ok else { continue }
         parsedFrames.append(parsed)
     }
 }
diff --git a/docs/PRIVACY_SECURITY.md b/docs/PRIVACY_SECURITY.md
index a798edb6fb..cca4712a1f 100644
--- a/docs/PRIVACY_SECURITY.md
+++ b/docs/PRIVACY_SECURITY.md
@@ -428,7 +428,7 @@ truncated, oversized, or adversarial frames. The protocol core
 (`Packages/WhoopProtocol/`) is the reverse-engineering layer and is the first line of
 defense.
 
-**CRC-gated parsing.** Every frame is checked against its checksums before it is
+**Integrity-gated parsing.** Every frame is checked against its envelope before it is
 allowed to drive any application state. `Framing.swift` implements three checksums
 verbatim from the wire formats:
 
@@ -436,44 +436,71 @@ verbatim from the wire formats:
 - `crc32` (zlib/reflected) over the inner payload,
 - `crc16Modbus` for the WHOOP 5.0 header (ported from the `goose` work).
 
-`verifyFrame(_:)` (and the family-aware `verifyFrame(_:family:)`) only return
-`ok == true` when the header CRC **and** the payload CRC32 both validate:
+`verifyFrame(_:)` (and the family-aware `verifyFrame(_:family:)`) return
+`ok == true` only when the header CRC, the payload CRC32 **and** the structural size
+rules all hold. The structural half matters as much as the checksums: a frame must be
+at least 11 bytes on WHOOP 4.0 and 13 on 5.0/MG, and must carry *exactly* the total its
+length field declares (`length + 4`, `declLength + 8`), so a truncated frame and one
+with trailing bytes past its own end are both rejected. A payload CRC32 that cannot be
+computed counts as a failure, never as "unknown". The outcome is one verdict plus one
+non-optional reason:
 
 ```swift
-let ok = crc8OK && (crc32OK ?? false)
+let reason = frameRejectReason(totalFromLength: total, actualCount: frame.count,
+                               minimumBytes: FrameLimits.whoop4MinimumFrameBytes,
+                               headerCRCOK: crc8OK, crc32OK: crc32OK)
+return FrameCheck(ok: reason == .none, /* … */ reason: reason)
 ```
 
-The live BLE path then refuses anything that fails. In
+The live BLE path then refuses anything that fails, in a single condition. In
 `Strand/BLE/FrameRouter.swift`:
 
 ```swift
 let parsed = parseFrame(frame)
+// `ok` is the FULL verdict — never let bad bytes drive state.
 guard parsed.ok else { return }
-// Reject frames that failed their checksum — never let bad bytes drive state.
-if parsed.crcOK == false { return }
 ```
 
-The same gate guards clock correlation (`Strand/Collect/ClockCorrelation.swift`
-requires `parsed.ok, parsed.crcOK != false`), so a corrupt frame can neither update
-the displayed metrics nor poison the device-clock model.
+The same gate guards clock correlation (`Strand/Collect/ClockCorrelation.swift`),
+historical-metadata classification, live and historical stream extraction, and the
+data-range reply — so a corrupt frame can neither update the displayed metrics, nor
+poison the device-clock model, nor advance the strap's trim cursor. `parsed.rejectReason`
+carries the cause, so a rejection is counted and attributable rather than silent.
 
-**Bounds-checked decoding.** Field reads never index past the end of the buffer. The
-low-level readers in `Interpreter.swift` return `nil` instead of trapping when a read
-would run off the end of the frame:
+**What this does not claim.** A CRC is not a signature, so none of the above asserts
+**authenticity**: a peer that forms the envelope correctly is not excluded. Nor is the
+claim "every frame consumer" — six state-driving consumers require the full verdict.
+Evidence-preserving readers deliberately keep the opposite direction: a raw history
+frame that fails is *archived* rather than dropped, so the durable copy of a frame the
+strap is about to release survives.
+
+**Bounds-checked decoding.** Field reads never index past the end of the buffer, and
+never reach into the frame's own CRC32 trailer. The low-level readers in
+`Interpreter.swift` take an explicit `limit` and return `nil` instead of trapping:
 
 ```swift
-@inline(__always) private func readU16(_ f: [UInt8], _ off: Int) -> Int? {
-    off + 2 <= f.count ? Int(f[off]) | (Int(f[off + 1]) << 8) : nil
+@inline(__always) private func readU16(_ f: [UInt8], _ off: Int, _ limit: Int) -> Int? {
+    off >= 0 && off + 2 <= limit ? Int(f[off]) | (Int(f[off + 1]) << 8) : nil
 }
 ```
 
+The `limit` is the **minimum** of where the trailer starts and how many bytes the frame
+actually has. Both halves are load-bearing: the trailer start is derived from the
+*declared* length and points past the buffer on a truncated frame, while the buffer size
+alone would let a frame sitting at the family minimum have its own checksum trailer
+decoded as a sequence number, a command byte or a metadata type. The argument is
+required rather than defaulted, so adding a field read without deciding its bound does
+not compile. The one deliberate exception is the 8-byte history-end acknowledgement
+block echoed back to the strap verbatim, which reaches into the trailer by construction
+and is an opaque echo rather than a decoded field.
+
 Schema-driven field extraction skips any field whose offset is out of range
-(`guard let val = readDType(frame, fld.off, dtype) else { continue }`), and the
-`FieldBuilder` clamps every slice to the real buffer length
-(`let end = min(off + length, frame.count)`). The WHOOP 5.0 path adds explicit
-minimum-length and `payloadEnd <= frame.count` guards before slicing the payload or
-trailer. A short or lying length field therefore yields a partial parse, never an
-out-of-bounds read.
+(`guard let val = readDType(frame, fld.off, dtype, limit) else { continue }`), the same
+bound applies to the per-type post-hooks, and the `FieldBuilder` clamps every slice to
+the real buffer length (`let end = min(off + length, frame.count)`). The WHOOP 5.0 path
+adds explicit minimum-length and `payloadEnd <= frame.count` guards before slicing the
+payload or trailer. A short or lying length field therefore yields a partial parse,
+never an out-of-bounds read.
 
 **Sane-value gating at the application edge.** Even a CRC-valid frame is range-checked
 before it updates the UI/state. The realtime handler discards implausible heart rates
@@ -482,7 +509,10 @@ carries them — so a single bad-but-valid packet can't wipe good state.
 
 **Reassembly is bounded by the declared length.** The `Reassembler` resynchronizes on
 the `0xAA` start-of-frame byte, discards leading garbage, and only emits a frame once
-`length + 4` bytes are present — it does not unboundedly buffer arbitrary data.
+`length + 4` bytes are present — it does not unboundedly buffer arbitrary data. A
+declared total below the family minimum (11 bytes on WHOOP 4.0, 13 on 5.0/MG) or above
+the 8192-byte ceiling is not a frame at all: that start byte is dropped and the scan
+resyncs on the next one. Sub-minimum drops are counted rather than discarded silently.
 
 ### 3.2 Threat B: a malicious import file (zip bombs, XML bombs, huge exports)
 
diff --git a/docs/PROTOCOL.md b/docs/PROTOCOL.md
index 3227d6fc5d..5bcbaa71d0 100644
--- a/docs/PROTOCOL.md
+++ b/docs/PROTOCOL.md
@@ -111,6 +111,21 @@ checksum. The branch point is `DeviceFamily.headerCRCKind`:
 | `whoop4` | CRC8 (poly `0x07`) | `.crc8` |
 | `whoop5` | CRC16-Modbus (poly `0xA001`, init `0xFFFF`, reflected) | `.crc16Modbus` |
 
+Beyond the two checksums, an envelope must also satisfy two **structural** rules before it counts
+as intact. Both are enforced in one place — `verifyFrame` — and both are family-specific:
+
+| Family | Minimum total frame size | Exact total frame size |
+|--------|--------------------------|------------------------|
+| `whoop4` | **11 bytes** (`FrameLimits.whoop4MinimumFrameBytes`) | `length + 4` |
+| `whoop5` | **13 bytes** (`FrameLimits.whoop5MinimumFrameBytes`) | `declLength + 8` |
+
+The minimum is the smallest envelope that can still carry one payload byte; anything shorter has
+no payload to read and is rejected outright. The exact size is compared against the byte count that
+was actually handed in, so **a truncated frame and a frame with trailing bytes past its own end are
+both rejected** — the comparison is equality, not "at least". The smallest real frame in the
+project's captures is exactly 11 bytes (WHOOP 4.0) and 124 bytes (WHOOP 5.0/MG), so neither bound
+rejects a recorded frame.
+
 ### 2.1 WHOOP 4.0 envelope
 
 ```
@@ -130,20 +145,38 @@ total frame size = length + 4
   (command number, §6), then the payload.
 - **`crc32`** — standard zlib CRC-32 (reflected, poly `0xEDB88320`), `u32` little-endian,
   computed over the **inner bytes** `frame[4 .. length)`.
+- **structural size** — the frame must be at least **11 bytes** long and must carry **exactly**
+  `length + 4` bytes. Fewer (a truncated frame) and more (trailing bytes) are both rejected.
 
 Reference: `verifyFrame(_:)` and `crc8(_:)` / `crc32(_:)` in `Framing.swift`, and the
 outbound builder `WhoopCommand.frame(seq:payload:)` in `Strand/BLE/Commands.swift`.
 
 ```swift
 // Framing.swift — WHOOP 4.0 validation (abridged)
+guard frame.first == 0xAA else { return FrameCheck(ok: false, reason: .noStartOfFrame) }
+guard frame.count >= FrameLimits.whoop4MinimumFrameBytes else {
+    return FrameCheck(ok: false, reason: .belowMinimumLength)
+}
 let length = u16le(frame, 1)
-let crc8OK = crc8([frame[1], frame[2]]) == frame[3]
-if 7 <= length && length + 4 <= frame.count {
-    let inner = Array(frame[4..<length])
-    crc32OK = crc32(inner) == u32le(frame, length)
+let total = length + 4
+let crc8OK = crc8(frame, 1, 3) == frame[3]          // ranged: no per-frame sub-array copy
+var crc32OK: Bool? = nil
+if 7 <= length && total <= frame.count {
+    crc32OK = crc32(frame, 4, length) == u32le(frame, length)
 }
+// One verdict, one reason: structure first, then the header checksum, then the payload CRC32.
+let reason = frameRejectReason(totalFromLength: total, actualCount: frame.count,
+                               minimumBytes: FrameLimits.whoop4MinimumFrameBytes,
+                               headerCRCOK: crc8OK, crc32OK: crc32OK)
+return FrameCheck(ok: reason == .none, length: length, crc8OK: crc8OK, crc32OK: crc32OK,
+                  reason: reason)
 ```
 
+The payload CRC32 is still computed when the byte count and the declared total disagree, so the
+combination "payload CRC right, envelope wrong" stays observable in `FrameCheck.crc32OK` — but it
+does not make the frame intact. A payload CRC32 that could **not** be computed at all is likewise a
+rejection (`.payloadCRCUnverifiable`), never an "unknown" a consumer might read as a pass.
+
 ### 2.2 WHOOP 5.0 / MG envelope
 
 The 5.0 envelope (reverse-engineered from `goose`) inserts a format byte and a CRC16-Modbus
@@ -164,6 +197,9 @@ total frame size = declLength + 8
   `frame[6..8]`.
 - **inner record** — starts at **offset 8**: `type` `[8]`, `seq` `[9]`, `cmd` `[10]`, payload `[11..]`.
 - **`crc32`** — same zlib CRC-32, LE, over the payload `frame[8 .. declLength+4)`.
+- **structural size** — the frame must be at least **13 bytes** long (8 header bytes including the
+  CRC16, one payload byte, the 4-byte CRC32 trailer) and must carry **exactly** `declLength + 8`
+  bytes. As on 4.0, truncation and trailing bytes are both rejected.
 
 Reference: `verifyFrameWhoop5(_:)` / `parseFrameWhoop5(_:)`. For a uniform "header CRC ok?"
 signal across families, the `FrameCheck.crc8OK` field carries the **CRC16** outcome on 5.0.
@@ -235,11 +271,29 @@ from a strap whose stored value is `0`. See #891.
 | CRC32 (zlib) | `crc32(_:)` | reflected, poly `0xEDB88320`, init `0xFFFFFFFF`, final XOR `0xFFFFFFFF` |
 | CRC16-Modbus | `crc16Modbus(_:)` | poly `0xA001`, init `0xFFFF`, reflected |
 
-CRC32 is the protocol's **only payload-integrity guarantee**. Decode and state-update paths
-reject any frame whose CRC32 fails: `FrameRouter.handle(frame:)` bails on `parsed.crcOK == false`,
-and `classifyHistoricalMeta(_:)` refuses to act on a frame where `p.crcOK == false` — without
-that gate a garbled or hostile peer could forge a `HISTORY_END`/`HISTORY_COMPLETE` and advance
-the strap's trim cursor, discarding data that was never durably stored.
+CRC32 is the protocol's **only payload-integrity guarantee**, and it is not the whole gate.
+`verifyFrame` folds the header checksum, the payload CRC32 **and** the structural size rules of §2
+into a single verdict, published as `FrameCheck.ok` and carried onto `ParsedFrame.ok` (§8). Decode
+and state-update paths ask for that one verdict:
+
+```swift
+let parsed = parseFrame(frame, family: family)
+guard parsed.ok else { return }   // header checksum + payload CRC32 + structural size, in one step
+```
+
+`FrameRouter.handle(parsed:frame:)` and `classifyHistoricalMeta(_:)` both gate on it. Without that
+gate a garbled or hostile peer could forge a `HISTORY_END`/`HISTORY_COMPLETE` and advance the strap's
+trim cursor, discarding data that was never durably stored — and a payload CRC32 check on its own
+would not stop it, because the forged frame's own payload CRC32 can be correct while its header
+checksum or declared length is not.
+
+None of this claims **authenticity**: a CRC is not a signature. A peer that forms the envelope
+correctly is not excluded. The scope of the gate is likewise deliberate — six state-driving
+consumers (the router, the historical-metadata classifier, live-stream extraction, historical-row
+extraction, clock correlation, and the data-range reply) require the full verdict, not "every frame
+consumer". Evidence-preserving readers are the documented exception: a raw history frame with a
+negative verdict is archived *because* it failed, so the only durable copy of a frame the strap is
+about to release is not the one that gets dropped.
 
 ### 2.6 Reassembly
 
@@ -249,6 +303,13 @@ frame once `buf.count ≥ length + 4`. Leading garbage before an SOF is discarde
 no SOF is dropped. The app feeds the data/cmd/event notify characteristics through one
 `Reassembler` in `peripheral(_:didUpdateValueFor:error:)`.
 
+The reassembler applies the **same family minimum** as `verifyFrame` (11 / 13 bytes): a `0xAA`
+whose declared total falls below it cannot be a frame at all — its "inner fields" would be its own
+checksum trailer — so that SOF is dropped and the scan resyncs on the next one. Such a drop is
+counted in `Reassembler.belowMinimumLengthDrops` rather than vanishing silently, because a byte run
+discarded here never reaches a parser and never reaches the evidence-preserving reader either. The
+existing ceiling (`maxFrameBytes`, 8192) resyncs the same way at the other end.
+
 ```swift
 // usage in BLEManager
 for frame in reassembler.feed(bytes) {
@@ -258,8 +319,11 @@ for frame in reassembler.feed(bytes) {
 ```
 
 `frameFromPayload(_:type:seq:cmd:)` reconstructs a complete frame from a bare payload (used when
-a capture stored only the data portion): it rebuilds the envelope with a correct zlib CRC32 and
-a placeholder `0x00` CRC8 byte.
+a capture stored only the data portion): it rebuilds the envelope with a correct zlib CRC32 **and**
+a correctly computed CRC8 header byte. The CRC8 used to be a `0x00` placeholder, which was harmless
+only while the gates asked whether the payload CRC32 was demonstrably wrong; under the full verdict
+a placeholder header makes every rebuilt frame fail, so the rebuild now round-trips through
+`verifyFrame` positively.
 
 ---
 
@@ -755,9 +819,52 @@ waiting on a network.
 
 ## 8. Decoded output (`ParsedFrame`)
 
-`parseFrame(_:)` returns a `ParsedFrame` with the validated envelope, a typed field list
+`parseFrame(_:)` returns a `ParsedFrame` with the envelope verdict, a typed field list
 (`[DecodedField]`), and a flat `parsed: [String: ParsedValue]` dictionary that downstream code
-reads. Key entries by packet type:
+reads.
+
+**`ok` means "intact", not "parsed".** It carries `verifyFrame`'s full verdict — header checksum,
+payload CRC32 and structural size together — for the frame as a whole. It is *not* a parsability
+signal: a frame with a broken header still gets decoded, so an inspector surface, a capture export
+or a diagnostic summary keeps the frame's `typeName` and its `parsed` fields even when `ok` is
+false. Code that wants to know whether the decode produced anything must ask for that (the parser
+returns `typeName == "INVALID/FRAGMENT"` when it could not decode at all), not read `ok`.
+
+**`rejectReason` says why.** It is a non-optional `FrameRejectReason` sitting on the parse result
+itself, so a consumer can report the cause from the value it was handed — the frame is parsed
+exactly once and the result threaded onwards, and a consumer that had to re-verify to learn the
+reason would break that invariant. `.none` accompanies a positive verdict and only that:
+
+| `rejectReason` | Meaning |
+|---|---|
+| `none` | Intact: header checksum, payload CRC32 and structural size all agree. |
+| `noStartOfFrame` | No `0xAA` — this byte run is not a frame. |
+| `belowMinimumLength` | Below the family minimum (11 / 13 bytes). |
+| `lengthMismatch` | Byte count ≠ the total the length field declares: truncated, or trailing bytes. |
+| `headerChecksumMismatch` | CRC8 (4.0) or CRC16-Modbus (5.0/MG) disagreed. |
+| `payloadCRCMismatch` | The payload CRC32 was computed and disagreed. |
+| `payloadCRCUnverifiable` | The payload CRC32 could not be computed. A **rejection**, not "unknown". |
+
+The two payload-CRC cases stay apart on purpose: "we could not compute the CRC32" is a different
+claim from "the CRC32 disagreed", and a diagnostic may only assert what it observed. Decoding a
+`ParsedFrame` from an older capture that predates the field defaults `rejectReason` to `.none`
+rather than failing.
+
+**Named inner-field reads are bounded by the CRC32 trailer.** Every read of a named field —
+sequence byte, command byte, and the schema-driven fields including the per-type post-hooks — is
+clamped to the **minimum of where the trailer starts and the frame's real size**. The minimum is
+required in both directions: the trailer start follows from the *declared* length and points past
+the buffer on a truncated frame, while the frame size alone is what let a frame sitting at the
+family minimum have its own checksum trailer decoded as a sequence number or a metadata type. A
+field counts as present when its start plus its length does **not exceed** that bound — the
+smallest real WHOOP 4.0 history frame is 11 bytes with its trailer at 7, and its metadata type
+occupies precisely the last payload byte, so a stricter comparison would swallow
+`HISTORY_COMPLETE`. The one exception is the 8-byte `end_data` acknowledgement block that §7.4
+echoes back to the strap verbatim: it reaches into the CRC32 trailer by construction (on the real
+25-byte `HISTORY_END` frame the trailer starts at 21 and the block runs 17…25) and is an opaque
+echo, not a decoded field.
+
+Key `parsed` entries by packet type:
 
 | Packet | `parsed` keys (examples) |
 |--------|--------------------------|

From bd1ec3ad963f4c2eb0c3de7ddd47dc75e7fc43e9 Mon Sep 17 00:00:00 2001
From: Bernd Helm <helm@rw23.de>
Date: Tue, 8 Sep 2026 02:24:03 +0200
Subject: [PATCH 333/333] test(app): call the main-actor Backfiller helper from
 main-actor tests

Upstream CI (macOS, xcodebuild test) rejected three synchronous test methods in
BackfillMetaForgeryTests that call the @MainActor Backfiller.endData(from:family:)
from a nonisolated context. Mark them @MainActor like the rest of the file; no
product code changes. Post-archive fix, evidence bound to the CI rerun.

(cherry picked from commit 2599c6988cfae2decf25266f6d00cee02565e805)
---
 StrandTests/BackfillMetaForgeryTests.swift | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/StrandTests/BackfillMetaForgeryTests.swift b/StrandTests/BackfillMetaForgeryTests.swift
index 0a11982ad1..0c47141b12 100644
--- a/StrandTests/BackfillMetaForgeryTests.swift
+++ b/StrandTests/BackfillMetaForgeryTests.swift
@@ -147,7 +147,7 @@ final class BackfillMetaForgeryTests: XCTestCase {
     /// either it refuses the acknowledgement and the offload stops, or it trims on an altered block.
     /// Both outcomes are the permanent data loss this whole change exists to prevent, arriving through
     /// the fix rather than the bug.
-    func testTheWhoop4AcknowledgementBlockIsEightBytesAndReachesIntoTheTrailer() {
+    @MainActor func testTheWhoop4AcknowledgementBlockIsEightBytesAndReachesIntoTheTrailer() {
         let frame = historyEndFrame()
         XCTAssertEqual(frame.count, 25, "precondition: the real HISTORY_END size the exemption is about")
         let declared = Int(frame[1]) | (Int(frame[2]) << 8)
@@ -162,7 +162,7 @@ final class BackfillMetaForgeryTests: XCTestCase {
 
     /// The 5/MG twin of the same slice (frame[21…29]), so a later tidy-up cannot narrow one family
     /// while the other keeps working.
-    func testTheWhoop5AcknowledgementBlockIsAlsoEightBytes() {
+    @MainActor func testTheWhoop5AcknowledgementBlockIsAlsoEightBytes() {
         let frame = puffinCommandFrame(cmd: 2, seq: 0,
                                        payload: [UInt8](repeating: 7, count: 20), type: 49)
         XCTAssertGreaterThanOrEqual(frame.count, 29, "precondition: long enough to hold the block")
@@ -173,7 +173,7 @@ final class BackfillMetaForgeryTests: XCTestCase {
 
     /// The guard the exemption does keep: a frame too short to hold the block yields nil rather than a
     /// short read. Not-enough-bytes is a different answer from four-bytes-because-we-clamped.
-    func testAFrameTooShortForTheBlockYieldsNilRatherThanAShortRead() {
+    @MainActor func testAFrameTooShortForTheBlockYieldsNilRatherThanAShortRead() {
         XCTAssertNil(Backfiller.endData(from: frameFromPayload([], type: 49, seq: 0, cmd: 2),
                                         family: .whoop4))
     }